We have a Node and TypeScript API where several endpoints change data that money depends on, and right now there is no record of who changed what. When something looks wrong we reconstruct it from application logs, which is slow and usually inconclusive. We want a proper audit log in Postgres.

First part is the write path: a table with a migration, and a small helper the endpoints call to record an event - who acted, what entity, what changed, and when. Store the before and after as JSON rather than a free-text message, so the record is queryable later. It must never block or break the request it is recording: if the audit write fails, the endpoint still succeeds and the failure is surfaced separately.

Second part is reading it back: an endpoint that returns events filtered by entity, by actor and by date range, with cursor pagination. Sensible defaults, and no unbounded queries - this table will get large. Third part is keeping it from growing forever: a retention job that removes events past a configurable age, plus tests covering the write path, the filters, and the case where the audit write itself fails.

Stack is TypeScript, Node and Postgres, migrations already run through the existing tooling. Repo access after hire. Deliverable is a PR into the audit branch with migrations, tests and a short