@better-forge/audit 0.1.0 → 0.1.1

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 BetterStatusPage contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 BetterStatusPage contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,5 +1,5 @@
-# @better-forge/audit
-
-Audit log: write, read, entity-type registry and routes.
-
-Status: skeleton. Depends on: `@better-forge/db`.
+# @better-forge/audit
+
+Audit log: write, read, entity-type registry and routes.
+
+Status: skeleton. Depends on: `@better-forge/db`.

package/dist/migrations.js

@@ -1,19 +1,19 @@
 /** The audit log. Steps run in this order. */
 export const auditMigrations = [
-    { kind: 'exec', sql: `
-CREATE TABLE IF NOT EXISTS audit_log (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  user_id INTEGER NOT NULL,
-  user_email TEXT NOT NULL,
-  action TEXT NOT NULL,
-  entity_type TEXT NOT NULL,
-  entity_id TEXT,
-  entity_name TEXT NOT NULL,
-  diff TEXT,
-  timestamp INTEGER NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_audit_log_timestamp ON audit_log(timestamp DESC);
-CREATE INDEX IF NOT EXISTS idx_audit_log_user ON audit_log(user_id);
+    { kind: 'exec', sql: `
+CREATE TABLE IF NOT EXISTS audit_log (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL,
+  user_email TEXT NOT NULL,
+  action TEXT NOT NULL,
+  entity_type TEXT NOT NULL,
+  entity_id TEXT,
+  entity_name TEXT NOT NULL,
+  diff TEXT,
+  timestamp INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_audit_log_timestamp ON audit_log(timestamp DESC);
+CREATE INDEX IF NOT EXISTS idx_audit_log_user ON audit_log(user_id);
 ` },
 ];
 //# sourceMappingURL=migrations.js.map

package/package.json

@@ -1,54 +1,54 @@
-{
-  "name": "@better-forge/audit",
-  "version": "0.1.0",
-  "description": "Audit log: write, read, entity-type registry and routes.",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/BElluu/Better-Forge.git",
-    "directory": "packages/audit"
-  },
-  "homepage": "https://github.com/BElluu/Better-Forge/tree/main/packages/audit#readme",
-  "bugs": {
-    "url": "https://github.com/BElluu/Better-Forge/issues"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "type": "module",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "dist",
-    "src",
-    "!src/**/*.test.*"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput"
-  },
-  "peerDependencies": {
-    "drizzle-orm": "^0.45.2",
-    "fastify": "^5.3.2"
-  },
-  "devDependencies": {
-    "@types/node": "^26.6.2",
-    "drizzle-orm": "^0.45.2",
-    "fastify": "^5.3.2",
-    "typescript": "^5.7.3"
-  },
-  "dependencies": {
-    "@better-forge/contracts": "0.1.0",
-    "@better-forge/db": "0.1.0"
-  },
-  "engines": {
-    "node": ">=26.10.0"
-  }
-}
+{
+  "name": "@better-forge/audit",
+  "version": "0.1.1",
+  "description": "Audit log: write, read, entity-type registry and routes.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/BElluu/Better-Forge.git",
+    "directory": "packages/audit"
+  },
+  "homepage": "https://github.com/BElluu/Better-Forge/tree/main/packages/audit#readme",
+  "bugs": {
+    "url": "https://github.com/BElluu/Better-Forge/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.*"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput"
+  },
+  "peerDependencies": {
+    "drizzle-orm": "^0.45.2",
+    "fastify": "^5.3.2"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.2",
+    "drizzle-orm": "^0.45.2",
+    "fastify": "^5.3.2",
+    "typescript": "^5.7.3"
+  },
+  "dependencies": {
+    "@better-forge/contracts": "0.1.1",
+    "@better-forge/db": "0.1.1"
+  },
+  "engines": {
+    "node": ">=26.10.0"
+  }
+}

package/src/audit.ts

@@ -1,149 +1,149 @@
-import type { FastifyPluginAsync } from 'fastify'
-import { and, desc, eq, gte, like, lte, sql } from 'drizzle-orm'
-import type { AuditAction } from '@better-forge/contracts'
-import type { SqliteDatabase } from '@better-forge/db'
-import { parsePagination } from './pagination.js'
-import { auditLog } from './tables.js'
-
-/** Keys whose values never reach the log. */
-export const DEFAULT_SENSITIVE_KEYS = /(password|secret|token|authorization|cookie|credential|vaultconfig|encryptedvalue|recoverycode)/i
-
-export interface Actor {
-  userId: number
-  userEmail: string
-}
-
-export interface AuditOptions {
-  /** The application's database handle. It is used lazily, so it may be opened after this is created. */
-  db: SqliteDatabase
-  /** Keys whose values are replaced by `[redacted]`. */
-  sensitiveKeys?: RegExp
-}
-
-/** Audit log: writing entries, redacted diffs and the admin read route. All state is in the returned closure. */
-export function createAudit(options: AuditOptions) {
-  const { db } = options
-  const sensitiveKey = options.sensitiveKeys ?? DEFAULT_SENSITIVE_KEYS
-
-  function redactValue(value: unknown): unknown {
-    if (Array.isArray(value)) return value.map(redactValue)
-    if (value && typeof value === 'object') return redactObj(value as Record<string, unknown>)
-    return value
-  }
-
-  /** Mask sensitive keys in a flat object. */
-  function redactObj(obj: Record<string, unknown>): Record<string, unknown> {
-    const out: Record<string, unknown> = {}
-    for (const [k, v] of Object.entries(obj)) {
-      out[k] = sensitiveKey.test(k) ? '[redacted]' : redactValue(v)
-    }
-    return out
-  }
-
-  /**
-   * Compute a field-level diff between two flat objects.
-   * Only changed keys are included. Sensitive keys are masked.
-   */
-  function diffObjects(
-    before: Record<string, unknown>,
-    after: Record<string, unknown>,
-  ): Record<string, { from: unknown; to: unknown }> {
-    const diff: Record<string, { from: unknown; to: unknown }> = {}
-    const keys = new Set([...Object.keys(before), ...Object.keys(after)])
-    for (const key of keys) {
-      if (JSON.stringify(before[key]) !== JSON.stringify(after[key])) {
-        diff[key] = {
-          from: sensitiveKey.test(key) ? '[redacted]' : redactValue(before[key]),
-          to: sensitiveKey.test(key) ? '[redacted]' : redactValue(after[key]),
-        }
-      }
-    }
-    return diff
-  }
-
-  /** Snapshot of an entity for a create/delete entry. Sensitive keys masked. */
-  function snapshot(obj: Record<string, unknown>): Record<string, unknown> {
-    return redactObj(obj)
-  }
-
-  /** Audit actor for an authenticated identity; an API token appears under its own name, with user id 0 (no user). */
-  function actor(identity: { userId: number; email: string }): Actor {
-    return { userId: identity.userId, userEmail: identity.email }
-  }
-
-  /**
-   * Write an audit log entry. Failures are swallowed so they never break the
-   * primary operation.
-   */
-  async function write(
-    who: Actor,
-    action: AuditAction,
-    entityType: string,
-    entityId: number | string | null,
-    entityName: string,
-    diff?: Record<string, unknown>,
-  ): Promise<void> {
-    try {
-      await db.insert(auditLog).values({
-        userId: who.userId,
-        userEmail: who.userEmail,
-        action,
-        entityType,
-        entityId: entityId !== null ? String(entityId) : null,
-        entityName,
-        diff: diff ? JSON.stringify(redactObj(diff)) : null,
-        timestamp: Date.now(),
-      })
-    } catch (err) {
-      console.error('[audit] write failed:', err)
-    }
-  }
-
-  /** `GET /`: the log, newest first, filterable. Register it under the prefix and the guards of your choice. */
-  const routes: FastifyPluginAsync = async (app) => {
-    app.get<{
-      Querystring: {
-        page?: string
-        limit?: string
-        userEmail?: string
-        entityType?: string
-        action?: string
-        from?: string   // unix ms
-        to?: string     // unix ms
-      }
-    }>('/', async (req) => {
-      const { page, limit, offset } = parsePagination(req.query, { defaultLimit: 50, maxLimit: 100 })
-
-      const conditions = []
-      if (req.query.userEmail) conditions.push(like(auditLog.userEmail, `%${req.query.userEmail}%`))
-      if (req.query.entityType) conditions.push(eq(auditLog.entityType, req.query.entityType))
-      if (req.query.action)     conditions.push(eq(auditLog.action, req.query.action))
-      if (req.query.from)       conditions.push(gte(auditLog.timestamp, Number(req.query.from)))
-      if (req.query.to)         conditions.push(lte(auditLog.timestamp, Number(req.query.to)))
-
-      const where = conditions.length > 0 ? and(...conditions) : undefined
-
-      const [entries, countResult] = await Promise.all([
-        db.select().from(auditLog)
-          .where(where)
-          .orderBy(desc(auditLog.timestamp))
-          .limit(limit)
-          .offset(offset),
-        db.select({ count: sql<number>`count(*)` }).from(auditLog).where(where),
-      ])
-
-      const total = countResult[0]?.count ?? 0
-      return {
-        entries: entries.map((e) => ({ ...e, diff: e.diff ? JSON.parse(e.diff) : null })),
-        total,
-        page,
-        limit,
-        pages: Math.ceil(total / limit),
-      }
-    })
-  }
-
-  return { write, diffObjects, snapshot, actor, routes }
-}
-
-export type Audit = ReturnType<typeof createAudit>
+import type { FastifyPluginAsync } from 'fastify'
+import { and, desc, eq, gte, like, lte, sql } from 'drizzle-orm'
+import type { AuditAction } from '@better-forge/contracts'
+import type { SqliteDatabase } from '@better-forge/db'
+import { parsePagination } from './pagination.js'
+import { auditLog } from './tables.js'
+
+/** Keys whose values never reach the log. */
+export const DEFAULT_SENSITIVE_KEYS = /(password|secret|token|authorization|cookie|credential|vaultconfig|encryptedvalue|recoverycode)/i
+
+export interface Actor {
+  userId: number
+  userEmail: string
+}
+
+export interface AuditOptions {
+  /** The application's database handle. It is used lazily, so it may be opened after this is created. */
+  db: SqliteDatabase
+  /** Keys whose values are replaced by `[redacted]`. */
+  sensitiveKeys?: RegExp
+}
+
+/** Audit log: writing entries, redacted diffs and the admin read route. All state is in the returned closure. */
+export function createAudit(options: AuditOptions) {
+  const { db } = options
+  const sensitiveKey = options.sensitiveKeys ?? DEFAULT_SENSITIVE_KEYS
+
+  function redactValue(value: unknown): unknown {
+    if (Array.isArray(value)) return value.map(redactValue)
+    if (value && typeof value === 'object') return redactObj(value as Record<string, unknown>)
+    return value
+  }
+
+  /** Mask sensitive keys in a flat object. */
+  function redactObj(obj: Record<string, unknown>): Record<string, unknown> {
+    const out: Record<string, unknown> = {}
+    for (const [k, v] of Object.entries(obj)) {
+      out[k] = sensitiveKey.test(k) ? '[redacted]' : redactValue(v)
+    }
+    return out
+  }
+
+  /**
+   * Compute a field-level diff between two flat objects.
+   * Only changed keys are included. Sensitive keys are masked.
+   */
+  function diffObjects(
+    before: Record<string, unknown>,
+    after: Record<string, unknown>,
+  ): Record<string, { from: unknown; to: unknown }> {
+    const diff: Record<string, { from: unknown; to: unknown }> = {}
+    const keys = new Set([...Object.keys(before), ...Object.keys(after)])
+    for (const key of keys) {
+      if (JSON.stringify(before[key]) !== JSON.stringify(after[key])) {
+        diff[key] = {
+          from: sensitiveKey.test(key) ? '[redacted]' : redactValue(before[key]),
+          to: sensitiveKey.test(key) ? '[redacted]' : redactValue(after[key]),
+        }
+      }
+    }
+    return diff
+  }
+
+  /** Snapshot of an entity for a create/delete entry. Sensitive keys masked. */
+  function snapshot(obj: Record<string, unknown>): Record<string, unknown> {
+    return redactObj(obj)
+  }
+
+  /** Audit actor for an authenticated identity; an API token appears under its own name, with user id 0 (no user). */
+  function actor(identity: { userId: number; email: string }): Actor {
+    return { userId: identity.userId, userEmail: identity.email }
+  }
+
+  /**
+   * Write an audit log entry. Failures are swallowed so they never break the
+   * primary operation.
+   */
+  async function write(
+    who: Actor,
+    action: AuditAction,
+    entityType: string,
+    entityId: number | string | null,
+    entityName: string,
+    diff?: Record<string, unknown>,
+  ): Promise<void> {
+    try {
+      await db.insert(auditLog).values({
+        userId: who.userId,
+        userEmail: who.userEmail,
+        action,
+        entityType,
+        entityId: entityId !== null ? String(entityId) : null,
+        entityName,
+        diff: diff ? JSON.stringify(redactObj(diff)) : null,
+        timestamp: Date.now(),
+      })
+    } catch (err) {
+      console.error('[audit] write failed:', err)
+    }
+  }
+
+  /** `GET /`: the log, newest first, filterable. Register it under the prefix and the guards of your choice. */
+  const routes: FastifyPluginAsync = async (app) => {
+    app.get<{
+      Querystring: {
+        page?: string
+        limit?: string
+        userEmail?: string
+        entityType?: string
+        action?: string
+        from?: string   // unix ms
+        to?: string     // unix ms
+      }
+    }>('/', async (req) => {
+      const { page, limit, offset } = parsePagination(req.query, { defaultLimit: 50, maxLimit: 100 })
+
+      const conditions = []
+      if (req.query.userEmail) conditions.push(like(auditLog.userEmail, `%${req.query.userEmail}%`))
+      if (req.query.entityType) conditions.push(eq(auditLog.entityType, req.query.entityType))
+      if (req.query.action)     conditions.push(eq(auditLog.action, req.query.action))
+      if (req.query.from)       conditions.push(gte(auditLog.timestamp, Number(req.query.from)))
+      if (req.query.to)         conditions.push(lte(auditLog.timestamp, Number(req.query.to)))
+
+      const where = conditions.length > 0 ? and(...conditions) : undefined
+
+      const [entries, countResult] = await Promise.all([
+        db.select().from(auditLog)
+          .where(where)
+          .orderBy(desc(auditLog.timestamp))
+          .limit(limit)
+          .offset(offset),
+        db.select({ count: sql<number>`count(*)` }).from(auditLog).where(where),
+      ])
+
+      const total = countResult[0]?.count ?? 0
+      return {
+        entries: entries.map((e) => ({ ...e, diff: e.diff ? JSON.parse(e.diff) : null })),
+        total,
+        page,
+        limit,
+        pages: Math.ceil(total / limit),
+      }
+    })
+  }
+
+  return { write, diffObjects, snapshot, actor, routes }
+}
+
+export type Audit = ReturnType<typeof createAudit>

package/src/index.ts

@@ -1,4 +1,4 @@
-export { createAudit, DEFAULT_SENSITIVE_KEYS, type Actor, type Audit, type AuditOptions } from './audit.js'
-export { auditDbModule } from './module.js'
-export { auditLog } from './tables.js'
-export { parsePagination, type Pagination, type PaginationOptions } from './pagination.js'
+export { createAudit, DEFAULT_SENSITIVE_KEYS, type Actor, type Audit, type AuditOptions } from './audit.js'
+export { auditDbModule } from './module.js'
+export { auditLog } from './tables.js'
+export { parsePagination, type Pagination, type PaginationOptions } from './pagination.js'

package/src/migrations.ts

@@ -1,20 +1,20 @@
-import type { MigrationStep } from '@better-forge/db'
-
-/** The audit log. Steps run in this order. */
-export const auditMigrations: readonly MigrationStep[] = [
-  { kind: 'exec', sql: `
-CREATE TABLE IF NOT EXISTS audit_log (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  user_id INTEGER NOT NULL,
-  user_email TEXT NOT NULL,
-  action TEXT NOT NULL,
-  entity_type TEXT NOT NULL,
-  entity_id TEXT,
-  entity_name TEXT NOT NULL,
-  diff TEXT,
-  timestamp INTEGER NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_audit_log_timestamp ON audit_log(timestamp DESC);
-CREATE INDEX IF NOT EXISTS idx_audit_log_user ON audit_log(user_id);
-` },
-]
+import type { MigrationStep } from '@better-forge/db'
+
+/** The audit log. Steps run in this order. */
+export const auditMigrations: readonly MigrationStep[] = [
+  { kind: 'exec', sql: `
+CREATE TABLE IF NOT EXISTS audit_log (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL,
+  user_email TEXT NOT NULL,
+  action TEXT NOT NULL,
+  entity_type TEXT NOT NULL,
+  entity_id TEXT,
+  entity_name TEXT NOT NULL,
+  diff TEXT,
+  timestamp INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_audit_log_timestamp ON audit_log(timestamp DESC);
+CREATE INDEX IF NOT EXISTS idx_audit_log_user ON audit_log(user_id);
+` },
+]

package/src/module.ts

@@ -1,6 +1,6 @@
-import type { DbModule } from '@better-forge/db'
-import * as tables from './tables.js'
-import { auditMigrations } from './migrations.js'
-
-/** The audit log table and its migrations, for the application's list of database modules. */
-export const auditDbModule = { id: 'audit', tables, migrations: auditMigrations } satisfies DbModule
+import type { DbModule } from '@better-forge/db'
+import * as tables from './tables.js'
+import { auditMigrations } from './migrations.js'
+
+/** The audit log table and its migrations, for the application's list of database modules. */
+export const auditDbModule = { id: 'audit', tables, migrations: auditMigrations } satisfies DbModule

package/src/pagination.ts

@@ -1,27 +1,27 @@
-export interface Pagination {
-  page: number
-  limit: number
-  offset: number
-}
-
-export interface PaginationOptions {
-  defaultLimit: number
-  maxLimit: number
-  /** Highest page accepted; keeps OFFSET within a sane range. */
-  maxPage?: number
-}
-
-const DEFAULT_MAX_PAGE = 100_000
-
-/**
- * Lenient paging for admin lists: missing, non-numeric or out-of-range values fall back to the
- * default or are clamped into range, so a hand-edited URL never fails the page.
- */
-export function parsePagination(query: { page?: string; limit?: string }, options: PaginationOptions): Pagination {
-  const maxPage = options.maxPage ?? DEFAULT_MAX_PAGE
-  const rawPage = Math.floor(Number(query.page ?? 1)) || 1
-  const rawLimit = Math.floor(Number(query.limit ?? options.defaultLimit)) || options.defaultLimit
-  const page = Math.min(maxPage, Math.max(1, rawPage))
-  const limit = Math.min(options.maxLimit, Math.max(1, rawLimit))
-  return { page, limit, offset: (page - 1) * limit }
-}
+export interface Pagination {
+  page: number
+  limit: number
+  offset: number
+}
+
+export interface PaginationOptions {
+  defaultLimit: number
+  maxLimit: number
+  /** Highest page accepted; keeps OFFSET within a sane range. */
+  maxPage?: number
+}
+
+const DEFAULT_MAX_PAGE = 100_000
+
+/**
+ * Lenient paging for admin lists: missing, non-numeric or out-of-range values fall back to the
+ * default or are clamped into range, so a hand-edited URL never fails the page.
+ */
+export function parsePagination(query: { page?: string; limit?: string }, options: PaginationOptions): Pagination {
+  const maxPage = options.maxPage ?? DEFAULT_MAX_PAGE
+  const rawPage = Math.floor(Number(query.page ?? 1)) || 1
+  const rawLimit = Math.floor(Number(query.limit ?? options.defaultLimit)) || options.defaultLimit
+  const page = Math.min(maxPage, Math.max(1, rawPage))
+  const limit = Math.min(options.maxLimit, Math.max(1, rawLimit))
+  return { page, limit, offset: (page - 1) * limit }
+}

package/src/tables.ts

@@ -1,13 +1,13 @@
-import { sqliteTable, integer, text } from 'drizzle-orm/sqlite-core'
-
-export const auditLog = sqliteTable('audit_log', {
-  id: integer('id').primaryKey({ autoIncrement: true }),
-  userId: integer('user_id').notNull(),
-  userEmail: text('user_email').notNull(),
-  action: text('action').notNull(),       // 'create' | 'update' | 'delete'
-  entityType: text('entity_type').notNull(),
-  entityId: text('entity_id'),
-  entityName: text('entity_name').notNull(),
-  diff: text('diff'),                     // JSON | null
-  timestamp: integer('timestamp').notNull(),
-})
+import { sqliteTable, integer, text } from 'drizzle-orm/sqlite-core'
+
+export const auditLog = sqliteTable('audit_log', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  userId: integer('user_id').notNull(),
+  userEmail: text('user_email').notNull(),
+  action: text('action').notNull(),       // 'create' | 'update' | 'delete'
+  entityType: text('entity_type').notNull(),
+  entityId: text('entity_id'),
+  entityName: text('entity_name').notNull(),
+  diff: text('diff'),                     // JSON | null
+  timestamp: integer('timestamp').notNull(),
+})