Log export with cryptographic completeness proof

During a regulatory examination, an auditor will request a complete export of audit records for a specified time period — and they will expect a way to verify that the export is complete and unaltered. Without a cryptographic hash and a record count in the export metadata, the auditor cannot distinguish a complete export from one where rows were selectively omitted. NIST 800-53 AU-9 requires protection of audit information integrity, which extends to exported copies. SOX §404 internal control assessments require that the process for producing audit evidence is itself controlled and verifiable. PCI-DSS 4.0 Req-10.3 requires that audit log files are protected. FINRA Rule 4511 requires that records be available for examination — an export without a completeness proof is an unverifiable record.

Add a completeness metadata block to every export response in src/app/api/admin/audit-logs/export/route.ts:

import crypto from 'crypto';

export async function GET(req: Request) {
  const { startDate, endDate } = Object.fromEntries(new URL(req.url).searchParams);
  const rows = await db('transaction_logs')
    .whereBetween('timestamp', [startDate, endDate]);

  const payload = JSON.stringify(rows);
  const exportHash = crypto.createHash('sha256').update(payload).digest('hex');

  return new Response(payload, {
    headers: {
      'Content-Type': 'application/json',
      'Content-Disposition': `attachment; filename=audit_${startDate}_${endDate}.json`,
      'X-Export-Record-Count': String(rows.length),
      'X-Export-Date-Range': `${startDate}/${endDate}`,
      'X-Export-Hash-SHA256': exportHash,
      'X-Export-Timestamp': new Date().toISOString()
    }
  });
}

Include the same four fields — record_count, date_range, export_hash, export_timestamp — in the response body or a sidecar manifest file so they travel with the export artifact.