@hexmon_tech/audit-cli

Command-line verification tools for audit log integrity chains.

Install

pnpm add @hexmon_tech/audit-cli
npm install @hexmon_tech/audit-cli

Compatibility

• Node.js >= 18
• Depends on @hexmon_tech/audit-export-postgres / pg for Postgres commands
• Installs the audit-cli binary via the bin entry in package.json

Commands

verify-file

Verify a JSONL file produced by the file sink.

pnpm --filter @hexmon_tech/audit-cli exec audit-cli verify-file --path ./audit.jsonl

verify-postgres

Verify audit records stored in Postgres.

pnpm --filter @hexmon_tech/audit-cli exec audit-cli verify-postgres \
  --connection "postgres://user:pass@localhost:5432/audit" \
  --from "2024-01-01" \
  --to "2024-01-31" \
  --tenantId "tenant-123"

Optional flags: --table (defaults to audit_events).

export-postgres

Export audit records from Postgres (JSON or CSV).

pnpm --filter @hexmon_tech/audit-cli exec audit-cli export-postgres \
  --connection "postgres://user:pass@localhost:5432/audit" \
  --from "2024-01-01" \
  --to "2024-01-31" \
  --tenantId "tenant-123" \
  --format json

Optional flags: --actorId, --action, --outcome, --pageSize, --cursor, --table, --multiTenantStrict.

retention-postgres

Run a retention delete for records older than a timestamp.

pnpm --filter @hexmon_tech/audit-cli exec audit-cli retention-postgres \
  --connection "postgres://user:pass@localhost:5432/audit" \
  --before "2024-01-01" \
  --dry-run

Optional flags: --table (defaults to audit_events).

Notes

• Verification uses the same hash chain algorithm as @hexmon_tech/audit-core.
• Hash chains are scoped per tenant when tenantId is present, otherwise per service.
• For distributed systems, see docs/INTEGRITY.md for ordering and coordination limits.