@checodo/better-auth-audit-log 0.0.0-stage → 0.1.0

package/dist/index-e6JB3Yiu.d.ts

@@ -0,0 +1,707 @@
+import { InferOptionSchema } from "better-auth";
+import { AuthContext } from "@better-auth/core";
+declare const auditLogSchema: {
+  /**
+   * One row per event. User ids are plain columns, not foreign keys: the
+   * log must outlive the users it mentions, `user-deleted` included.
+   */
+  auditEvent: {
+    fields: {
+      /** `sign-in`, `admin.ban-user`, or an app-defined type. */
+      type: {
+        type: "string";
+        required: true;
+        index: true;
+      };
+      /** "success" | "failure" */
+      status: {
+        type: "string";
+        required: true;
+      };
+      /** "low" | "medium" | "high" | "critical" */
+      severity: {
+        type: "string";
+        required: true;
+      };
+      /** The user the event is about. */
+      userId: {
+        type: "string";
+        required: false;
+        index: true;
+      };
+      /** The user who did it: the user themselves, or an admin. */
+      actorUserId: {
+        type: "string";
+        required: false;
+        index: true;
+      };
+      sessionId: {
+        type: "string";
+        required: false;
+      };
+      /** The session's active organization (organization plugin). */
+      organizationId: {
+        type: "string";
+        required: false;
+      };
+      ipAddress: {
+        type: "string";
+        required: false;
+      };
+      userAgent: {
+        type: "string";
+        required: false;
+      };
+      /** The error code of a failed request, e.g. `INVALID_EMAIL_OR_PASSWORD`. */
+      errorCode: {
+        type: "string";
+        required: false;
+      };
+      /** JSON-encoded. */
+      metadata: {
+        type: "string";
+        required: false;
+      };
+      createdAt: {
+        type: "date";
+        required: true;
+        index: true;
+      };
+    };
+  };
+};
+/** Added with the `hashChain` option: one link per event, in order. */
+declare const auditChainSchema: {
+  auditChain: {
+    fields: {
+      /** 1, 2, 3, ... Unique, so concurrent writers can't fork the chain. */
+      sequence: {
+        type: "number";
+        required: true;
+      };
+      /** The event's id. Not a foreign key: a deleted event must show as missing. */
+      eventId: {
+        type: "string";
+        required: true;
+      };
+      previousHash: {
+        type: "string";
+        required: true;
+      };
+      /** HMAC-SHA256 of the event, the sequence number, and `previousHash`. */
+      hash: {
+        type: "string";
+        required: true;
+      };
+      /** The event's `createdAt`, for retention. */
+      createdAt: {
+        type: "date";
+        required: true;
+        index: true;
+      };
+    };
+    indexes: {
+      fields: [string];
+      unique: true;
+    }[];
+  };
+};
+type AuditLogSchema = typeof auditLogSchema & Partial<typeof auditChainSchema>;
+type AuditEventStatus = "success" | "failure";
+type AuditEventSeverity = "low" | "medium" | "high" | "critical";
+/** Actions of better-auth's `admin` plugin the log records, as `admin.<action>`. */
+type AdminAuditAction = "create-user" | "update-user" | "set-role" | "set-user-password" | "ban-user" | "unban-user" | "impersonate-user" | "stop-impersonating" | "revoke-user-session" | "revoke-user-sessions" | "remove-user";
+/** The events the plugin records by itself. */
+type BuiltInAuditEventType = "sign-up" | "sign-in" | "sign-out" | "session-revoked" | "user-deleted" | "password-changed" | "password-reset" | "email-changed" | "email-verified" | "account-linked" | "account-unlinked" | `admin.${AdminAuditAction}`;
+/** A built-in event type, or one of your own (`auth.api.recordAuditEvent`, `paths`). */
+type AuditEventType = BuiltInAuditEventType | (string & {});
+/** An event as stored and returned by the plugin. */
+interface AuditEvent {
+  id: string;
+  type: AuditEventType;
+  status: AuditEventStatus;
+  severity: AuditEventSeverity;
+  /** The user the event is about. */
+  userId: string | null;
+  /** The user who did it: the user themselves, an admin, or `null` (e.g. a failed sign-in). */
+  actorUserId: string | null;
+  sessionId: string | null;
+  organizationId: string | null;
+  ipAddress: string | null;
+  userAgent: string | null;
+  /** The error code of a failed request, e.g. `INVALID_EMAIL_OR_PASSWORD`. */
+  errorCode: string | null;
+  metadata: Record<string, unknown> | null;
+  createdAt: Date;
+}
+/** An event before it is stored: what `beforeLog` sees and may change. */
+type AuditEventInput = Omit<AuditEvent, "id">;
+/** Filters for reading events. */
+interface AuditEventQuery {
+  userId?: string | undefined;
+  actorUserId?: string | undefined;
+  type?: string | undefined;
+  status?: AuditEventStatus | undefined;
+  /** Events at or after this time. */
+  from?: Date | undefined;
+  /** Events before this time. */
+  to?: Date | undefined;
+  limit: number;
+  offset: number;
+}
+/**
+ * Where events are kept. The default stores them in the plugin's
+ * `auditEvent` table through better-auth's database adapter;
+ * `memoryStorage()` keeps them in memory (tests, demos).
+ */
+interface AuditLogStorage {
+  write: (event: AuditEventInput) => Promise<AuditEvent>;
+  /** Newest first, with the total number of matching events. */
+  read: (query: AuditEventQuery) => Promise<{
+    events: AuditEvent[];
+    total: number;
+  }>;
+  /** Deletes events created before `date`; returns how many. */
+  deleteOlderThan: (date: Date) => Promise<number>;
+}
+interface AuditLogRetention {
+  /** Delete events older than this many days. */
+  days: number;
+  /**
+   * At most one sweep per this many seconds, started in the background by
+   * a recorded event. Defaults to `3600`. Use `auth.api.deleteExpiredAuditEvents`
+   * from a cron job instead, or as well.
+   */
+  sweepInterval?: number | undefined;
+}
+interface AuditLogOptions {
+  /**
+   * Which event types to record. A pattern ending in `.*` matches a group,
+   * e.g. `["sign-in", "admin.*"]`. Defaults to every event.
+   */
+  events?: readonly string[] | undefined;
+  /**
+   * Extra endpoints to record, by path, with the event type to use, e.g.
+   * `{ "/organization/delete": "organization.deleted" }`. The signed-in
+   * user is the event's user and actor.
+   */
+  paths?: Readonly<Record<string, string>> | undefined;
+  /** Severity per event type, overriding the built-in one. */
+  severity?: Readonly<Record<string, AuditEventSeverity>> | undefined;
+  /** Store the client's IP address (better-auth's `advanced.ipAddress` rules). Defaults to `true`. */
+  captureIp?: boolean | undefined;
+  /** Store the client's `User-Agent` header. Defaults to `true`. */
+  captureUserAgent?: boolean | undefined;
+  /**
+   * Changes or drops an event before it is stored, e.g. to pseudonymize
+   * IP addresses. Return the event to keep, `null` to drop it. If it
+   * throws, the event is dropped and the error logged.
+   */
+  beforeLog?: ((event: AuditEventInput) => AuditEventInput | null | Promise<AuditEventInput | null>) | undefined;
+  /** Called with every stored event, e.g. to forward it to a SIEM. Errors are logged. */
+  onEvent?: ((event: AuditEvent) => void | Promise<void>) | undefined;
+  /** Where to keep events. Defaults to the plugin's `auditEvent` table. */
+  storage?: AuditLogStorage | undefined;
+  /** Delete old events automatically. Off by default: events are kept forever. */
+  retention?: AuditLogRetention | undefined;
+  /**
+   * Chain events with keyed hashes, so changed or deleted events can be
+   * detected with `auth.api.verifyAuditChain`. Adds the `auditChain` table;
+   * needs the default database storage. `true` uses better-auth's secret;
+   * pass `{ secret }` to use a key of its own (at least 32 characters).
+   * Off by default.
+   */
+  hashChain?: boolean | {
+    secret?: string | undefined;
+  } | undefined;
+  /**
+   * Users with one of these roles (the `role` field of better-auth's
+   * `admin` plugin) may list every user's events. Defaults to `["admin"]`.
+   */
+  adminRoles?: readonly string[] | undefined;
+  /** Users with these ids may list every user's events, whatever their role. */
+  adminUserIds?: readonly string[] | undefined;
+  /**
+   * Rename the plugin's table or its columns, like better-auth's own
+   * plugins: `{ auditEvent: { modelName: "audit_events" } }`.
+   */
+  schema?: InferOptionSchema<AuditLogSchema> | undefined;
+}
+/** A link of the chain, as stored in the `auditChain` table. */
+interface AuditChainLink {
+  id: string;
+  /** 1, 2, 3, ...: unique, so concurrent writers can't fork the chain. */
+  sequence: number;
+  eventId: string;
+  previousHash: string;
+  hash: string;
+  /** The event's `createdAt`, for retention. */
+  createdAt: Date;
+}
+type ChainProblem =
+/** The event's content or the link changed after it was written. */
+"hash-mismatch" |
+/** The link's event was deleted. */
+"missing-event" |
+/** Links between this one and the previous were deleted. */
+"sequence-gap" |
+/** The link doesn't continue the previous link's hash. */
+"broken-link";
+interface ChainVerification {
+  /** Whether every link checks out and every event since the first link has one. */
+  valid: boolean;
+  /** How many links were checked. */
+  checked: number;
+  /** The first remaining link; older ones were deleted by retention. `null` without links. */
+  firstSequence: number | null;
+  lastSequence: number | null;
+  /** The newest hash. Store it elsewhere now and then to detect deleted newest events. */
+  lastHash: string | null;
+  /** Up to 100 problems, oldest first. */
+  problems: {
+    sequence: number;
+    eventId: string;
+    problem: ChainProblem;
+  }[];
+  /** Events stored since the first link that have no link (written around the chain). */
+  unchainedEvents: number;
+}
+/** What hooks and `recordAuditEvent` know about an event; the rest is filled in. */
+interface EventDetails {
+  type: string;
+  status?: AuditEventStatus | undefined;
+  severity?: AuditEventSeverity | undefined;
+  userId?: string | null | undefined;
+  actorUserId?: string | null | undefined;
+  sessionId?: string | null | undefined;
+  organizationId?: string | null | undefined;
+  ipAddress?: string | null | undefined;
+  userAgent?: string | null | undefined;
+  errorCode?: string | null | undefined;
+  metadata?: Record<string, unknown> | null | undefined;
+}
+/** What other plugins pass to `recordEvent`. */
+type PluginEventDetails = Omit<EventDetails, "ipAddress" | "userAgent">;
+declare const AUDIT_LOG_ERROR_CODES: {
+  YOU_ARE_NOT_ALLOWED_TO_LIST_OTHER_USERS_EVENTS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_OTHER_USERS_EVENTS">;
+  METADATA_TOO_LARGE: import("better-auth").RawError<"METADATA_TOO_LARGE">;
+  RETENTION_NOT_CONFIGURED: import("better-auth").RawError<"RETENTION_NOT_CONFIGURED">;
+  HASH_CHAIN_NOT_ENABLED: import("better-auth").RawError<"HASH_CHAIN_NOT_ENABLED">;
+};
+type AuditLogErrorCode = keyof typeof AUDIT_LOG_ERROR_CODES;
+/**
+ * Keeps events in memory, newest last. For tests and demos: events are
+ * lost on restart and not shared between server instances.
+ *
+ * @example
+ * ```ts
+ * const storage = memoryStorage();
+ * betterAuth({ plugins: [auditLog({ storage })] });
+ * storage.events; // every stored event
+ * ```
+ */
+declare function memoryStorage(): AuditLogStorage & {
+  readonly events: AuditEvent[];
+};
+/**
+ * Records security-relevant events: sign-ins (any method) and failed
+ * sign-ins, sign-ups, sign-outs, revoked sessions, password and email
+ * changes, linked accounts, deleted users, and the actions of better-auth's
+ * `admin` plugin. Users can list their own events, admins everyone's.
+ *
+ * @example
+ * ```ts
+ * import { betterAuth } from "better-auth";
+ * import { auditLog } from "@checodo/better-auth-audit-log";
+ *
+ * export const auth = betterAuth({
+ *   plugins: [
+ *     // ...other plugins, then:
+ *     auditLog({ retention: { days: 90 } }),
+ *   ],
+ * });
+ * ```
+ */
+declare const auditLog: (options?: AuditLogOptions) => {
+  endpoints: {
+    listAuditEvents: import("better-auth").StrictEndpoint<"/audit-log/list-events", {
+      method: "GET";
+      use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>>[];
+      query: import("zod").ZodOptional<import("zod").ZodObject<{
+        limit: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+        offset: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+        userId: import("zod").ZodOptional<import("zod").ZodString>;
+        actorUserId: import("zod").ZodOptional<import("zod").ZodString>;
+        type: import("zod").ZodOptional<import("zod").ZodString>;
+        status: import("zod").ZodOptional<import("zod").ZodEnum<{
+          success: "success";
+          failure: "failure";
+        }>>;
+        from: import("zod").ZodOptional<import("zod").ZodCoercedDate<unknown>>;
+        to: import("zod").ZodOptional<import("zod").ZodCoercedDate<unknown>>;
+      }, import("zod/v4/core").$strip>>;
+      metadata: {
+        openapi: {
+          description: string;
+        };
+      };
+    }, {
+      events: AuditEvent[];
+      total: number;
+    }>;
+    recordAuditEvent: import("better-auth").StrictEndpoint<string, {
+      method: "POST";
+      body: import("zod").ZodObject<{
+        type: import("zod").ZodString;
+        status: import("zod").ZodOptional<import("zod").ZodEnum<{
+          success: "success";
+          failure: "failure";
+        }>>;
+        severity: import("zod").ZodOptional<import("zod").ZodEnum<{
+          low: "low";
+          medium: "medium";
+          high: "high";
+          critical: "critical";
+        }>>;
+        userId: import("zod").ZodOptional<import("zod").ZodString>;
+        actorUserId: import("zod").ZodOptional<import("zod").ZodString>;
+        organizationId: import("zod").ZodOptional<import("zod").ZodString>;
+        errorCode: import("zod").ZodOptional<import("zod").ZodString>;
+        metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        openapi: {
+          description: string;
+        };
+      };
+    }, {
+      event: AuditEvent | null;
+    }>;
+    deleteExpiredAuditEvents: import("better-auth").StrictEndpoint<string, {
+      method: "POST";
+      body: import("zod").ZodOptional<import("zod").ZodObject<{
+        days: import("zod").ZodOptional<import("zod").ZodNumber>;
+      }, import("zod/v4/core").$strip>>;
+      metadata: {
+        openapi: {
+          description: string;
+        };
+      };
+    }, {
+      deleted: number;
+    }>;
+    verifyAuditChain: import("better-auth").StrictEndpoint<string, {
+      method: "POST";
+      metadata: {
+        openapi: {
+          description: string;
+        };
+      };
+    }, ChainVerification>;
+  };
+  hooks: {
+    before?: {
+      matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+      handler: import("better-auth/api").AuthMiddleware;
+    }[];
+    after?: {
+      matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+      handler: import("better-auth/api").AuthMiddleware;
+    }[];
+  };
+  $ERROR_CODES: {
+    YOU_ARE_NOT_ALLOWED_TO_LIST_OTHER_USERS_EVENTS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_OTHER_USERS_EVENTS">;
+    METADATA_TOO_LARGE: import("better-auth").RawError<"METADATA_TOO_LARGE">;
+    RETENTION_NOT_CONFIGURED: import("better-auth").RawError<"RETENTION_NOT_CONFIGURED">;
+    HASH_CHAIN_NOT_ENABLED: import("better-auth").RawError<"HASH_CHAIN_NOT_ENABLED">;
+  };
+  options: AuditLogOptions;
+  schema?: {
+    auditChain?: {
+      fields: {
+        sequence: {
+          type: "number";
+          required: true;
+        };
+        eventId: {
+          type: "string";
+          required: true;
+        };
+        previousHash: {
+          type: "string";
+          required: true;
+        };
+        hash: {
+          type: "string";
+          required: true;
+        };
+        createdAt: {
+          type: "date";
+          required: true;
+          index: true;
+        };
+      };
+      indexes: {
+        fields: [string];
+        unique: true;
+      }[];
+    } | undefined;
+    auditEvent: {
+      fields: {
+        type: {
+          type: "string";
+          required: true;
+          index: true;
+        };
+        status: {
+          type: "string";
+          required: true;
+        };
+        severity: {
+          type: "string";
+          required: true;
+        };
+        userId: {
+          type: "string";
+          required: false;
+          index: true;
+        };
+        actorUserId: {
+          type: "string";
+          required: false;
+          index: true;
+        };
+        sessionId: {
+          type: "string";
+          required: false;
+        };
+        organizationId: {
+          type: "string";
+          required: false;
+        };
+        ipAddress: {
+          type: "string";
+          required: false;
+        };
+        userAgent: {
+          type: "string";
+          required: false;
+        };
+        errorCode: {
+          type: "string";
+          required: false;
+        };
+        metadata: {
+          type: "string";
+          required: false;
+        };
+        createdAt: {
+          type: "date";
+          required: true;
+          index: true;
+        };
+      };
+    };
+  } | undefined;
+  id: "audit-log";
+  version: string;
+  init(ctx: AuthContext): {
+    options: {
+      databaseHooks: {
+        user?: {
+          create?: {
+            before?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                email?: string | undefined;
+                emailVerified?: boolean | undefined;
+                name?: string | undefined;
+                image?: string | null | undefined;
+              } & Record<string, any>;
+            }>;
+            after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          update?: {
+            before?: (user: Partial<import("better-auth").User> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                [x: string]: any;
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                email?: string | undefined;
+                emailVerified?: boolean | undefined;
+                name?: string | undefined;
+                image?: string | null | undefined;
+              };
+            }>;
+            after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          delete?: {
+            before?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+            after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+        };
+        session?: {
+          create?: {
+            before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                userId?: string | undefined;
+                expiresAt?: Date | undefined;
+                token?: string | undefined;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              } & Record<string, any>;
+            }>;
+            after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          update?: {
+            before?: (session: Partial<import("better-auth").Session> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                [x: string]: any;
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                userId?: string | undefined;
+                expiresAt?: Date | undefined;
+                token?: string | undefined;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              };
+            }>;
+            after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          delete?: {
+            before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+            after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+        };
+        account?: {
+          create?: {
+            before?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                providerId?: string | undefined;
+                accountId?: string | undefined;
+                userId?: string | undefined;
+                accessToken?: string | null | undefined;
+                refreshToken?: string | null | undefined;
+                idToken?: string | null | undefined;
+                accessTokenExpiresAt?: Date | null | undefined;
+                refreshTokenExpiresAt?: Date | null | undefined;
+                scope?: string | null | undefined;
+                password?: string | null | undefined;
+              } & Record<string, any>;
+            }>;
+            after?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          update?: {
+            before?: (account: Partial<import("better-auth").Account> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                [x: string]: any;
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                providerId?: string | undefined;
+                accountId?: string | undefined;
+                userId?: string | undefined;
+                accessToken?: string | null | undefined;
+                refreshToken?: string | null | undefined;
+                idToken?: string | null | undefined;
+                accessTokenExpiresAt?: Date | null | undefined;
+                refreshTokenExpiresAt?: Date | null | undefined;
+                scope?: string | null | undefined;
+                password?: string | null | undefined;
+              };
+            }>;
+            after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          delete?: {
+            before?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+            after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+        };
+        verification?: {
+          create?: {
+            before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                value?: string | undefined;
+                expiresAt?: Date | undefined;
+                identifier?: string | undefined;
+              } & Record<string, any>;
+            }>;
+            after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          update?: {
+            before?: (verification: Partial<import("better-auth").Verification> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                [x: string]: any;
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                value?: string | undefined;
+                expiresAt?: Date | undefined;
+                identifier?: string | undefined;
+              };
+            }>;
+            after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          delete?: {
+            before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+            after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+        };
+      } | undefined;
+    };
+  };
+} & {
+  /**
+   * Records an event from another plugin or your own server code, with
+   * the current request's user, session, IP address, and user agent:
+   * `ctx.context.getPlugin("audit-log")?.recordEvent({ type: "x.y", userId })`.
+   * Never throws.
+   */
+  recordEvent: (details: PluginEventDetails, endpoint?: import("better-auth").GenericEndpointContext | null | undefined) => Promise<void>;
+};
+type AuditLogPlugin = ReturnType<typeof auditLog>;
+/** Lets `auth.$context.getPlugin("audit-log")` infer this plugin's exact type. */
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    "audit-log": {
+      creator: typeof auditLog;
+    };
+  }
+}
+export { AuditLogOptions as _, AuditLogErrorCode as a, BuiltInAuditEventType as b, ChainProblem as c, AuditEvent as d, AuditEventInput as f, AuditEventType as g, AuditEventStatus as h, AUDIT_LOG_ERROR_CODES as i, ChainVerification as l, AuditEventSeverity as m, auditLog as n, PluginEventDetails as o, AuditEventQuery as p, memoryStorage as r, AuditChainLink as s, AuditLogPlugin as t, AdminAuditAction as u, AuditLogRetention as v, AuditLogStorage as y };
+//# sourceMappingURL=index-e6JB3Yiu.d.ts.map