@nebutra/audit 0.1.0 → 0.1.2

package/dist/schema.d.ts

@@ -0,0 +1,354 @@
+import { z } from "zod";
+export declare const ActorTypeSchema: z.ZodEnum<{
+    user: "user";
+    system: "system";
+    api_key: "api_key";
+    service: "service";
+}>;
+export type ActorType = z.infer<typeof ActorTypeSchema>;
+export declare const OutcomeSchema: z.ZodEnum<{
+    success: "success";
+    failure: "failure";
+    denied: "denied";
+}>;
+export type Outcome = z.infer<typeof OutcomeSchema>;
+export declare const SeveritySchema: z.ZodEnum<{
+    info: "info";
+    warning: "warning";
+    critical: "critical";
+}>;
+export type Severity = z.infer<typeof SeveritySchema>;
+export declare const ActorSchema: z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodEnum<{
+        user: "user";
+        system: "system";
+        api_key: "api_key";
+        service: "service";
+    }>;
+    email: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type Actor = z.infer<typeof ActorSchema>;
+export declare const ResourceSchema: z.ZodObject<{
+    type: z.ZodString;
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type Resource = z.infer<typeof ResourceSchema>;
+export declare const GeoSchema: z.ZodObject<{
+    country: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type Geo = z.infer<typeof GeoSchema>;
+export declare const ContextSchema: z.ZodObject<{
+    ip: z.ZodOptional<z.ZodString>;
+    userAgent: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+    sessionId: z.ZodOptional<z.ZodString>;
+    geo: z.ZodOptional<z.ZodObject<{
+        country: z.ZodOptional<z.ZodString>;
+        region: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type Context = z.infer<typeof ContextSchema>;
+export declare const ChangesSchema: z.ZodObject<{
+    before: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    after: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
+export type Changes = z.infer<typeof ChangesSchema>;
+export declare const ActionSchema: z.ZodString;
+export declare const AuditEventSchema: z.ZodObject<{
+    id: z.ZodString;
+    timestamp: z.ZodUnion<[z.ZodString, z.ZodPipe<z.ZodDate, z.ZodTransform<string, Date>>]>;
+    actor: z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodEnum<{
+            user: "user";
+            system: "system";
+            api_key: "api_key";
+            service: "service";
+        }>;
+        email: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    tenantId: z.ZodString;
+    action: z.ZodString;
+    resource: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    outcome: z.ZodEnum<{
+        success: "success";
+        failure: "failure";
+        denied: "denied";
+    }>;
+    severity: z.ZodDefault<z.ZodEnum<{
+        info: "info";
+        warning: "warning";
+        critical: "critical";
+    }>>;
+    context: z.ZodDefault<z.ZodObject<{
+        ip: z.ZodOptional<z.ZodString>;
+        userAgent: z.ZodOptional<z.ZodString>;
+        requestId: z.ZodOptional<z.ZodString>;
+        sessionId: z.ZodOptional<z.ZodString>;
+        geo: z.ZodOptional<z.ZodObject<{
+            country: z.ZodOptional<z.ZodString>;
+            region: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    changes: z.ZodOptional<z.ZodObject<{
+        before: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        after: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strip>>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type AuditEvent = z.infer<typeof AuditEventSchema>;
+export declare const AuditEventInputSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    timestamp: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodPipe<z.ZodDate, z.ZodTransform<string, Date>>]>>;
+    actor: z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodEnum<{
+            user: "user";
+            system: "system";
+            api_key: "api_key";
+            service: "service";
+        }>;
+        email: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    tenantId: z.ZodString;
+    action: z.ZodString;
+    resource: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    outcome: z.ZodEnum<{
+        success: "success";
+        failure: "failure";
+        denied: "denied";
+    }>;
+    severity: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
+        info: "info";
+        warning: "warning";
+        critical: "critical";
+    }>>>;
+    context: z.ZodOptional<z.ZodDefault<z.ZodObject<{
+        ip: z.ZodOptional<z.ZodString>;
+        userAgent: z.ZodOptional<z.ZodString>;
+        requestId: z.ZodOptional<z.ZodString>;
+        sessionId: z.ZodOptional<z.ZodString>;
+        geo: z.ZodOptional<z.ZodObject<{
+            country: z.ZodOptional<z.ZodString>;
+            region: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>>;
+    changes: z.ZodOptional<z.ZodObject<{
+        before: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        after: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strip>>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type AuditEventInput = z.input<typeof AuditEventInputSchema>;
+export declare const AuditQueryFilterSchema: z.ZodObject<{
+    tenantId: z.ZodOptional<z.ZodString>;
+    actorId: z.ZodOptional<z.ZodString>;
+    action: z.ZodOptional<z.ZodString>;
+    resourceType: z.ZodOptional<z.ZodString>;
+    resourceId: z.ZodOptional<z.ZodString>;
+    outcome: z.ZodOptional<z.ZodEnum<{
+        success: "success";
+        failure: "failure";
+        denied: "denied";
+    }>>;
+    startDate: z.ZodOptional<z.ZodDate>;
+    endDate: z.ZodOptional<z.ZodDate>;
+    limit: z.ZodDefault<z.ZodNumber>;
+    offset: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+export type AuditQueryFilter = z.input<typeof AuditQueryFilterSchema>;
+/**
+ * Declare a strongly-typed audit action.
+ *
+ * @example
+ * ```ts
+ * const ROLE_CHANGED = defineAction("org.member.role_changed", z.object({
+ *   oldRole: z.string(),
+ *   newRole: z.string(),
+ * }));
+ *
+ * await audit.log({
+ *   action: ROLE_CHANGED.name,
+ *   metadata: ROLE_CHANGED.metadata.parse({ oldRole: "member", newRole: "admin" }),
+ *   ...
+ * });
+ * ```
+ */
+export declare function defineAction<TName extends string, TMeta extends z.ZodTypeAny = z.ZodUnknown>(name: TName, metadataSchema?: TMeta): {
+    name: TName;
+    metadata: TMeta;
+};
+export declare const ACTIONS: {
+    readonly AUTH_LOGIN_SUCCESS: {
+        name: "auth.login.success";
+        metadata: z.ZodUnknown;
+    };
+    readonly AUTH_LOGIN_FAILURE: {
+        name: "auth.login.failure";
+        metadata: z.ZodUnknown;
+    };
+    readonly AUTH_LOGOUT: {
+        name: "auth.logout";
+        metadata: z.ZodUnknown;
+    };
+    readonly AUTH_SIGNUP: {
+        name: "auth.signup";
+        metadata: z.ZodUnknown;
+    };
+    readonly AUTH_SESSION_REVOKED: {
+        name: "auth.session.revoked";
+        metadata: z.ZodUnknown;
+    };
+    readonly AUTH_SESSION_REVOKED_OTHER: {
+        name: "auth.session.revoked_other";
+        metadata: z.ZodUnknown;
+    };
+    readonly AUTH_PASSWORD_CHANGED: {
+        name: "auth.password.changed";
+        metadata: z.ZodUnknown;
+    };
+    readonly AUTH_2FA_ENABLED: {
+        name: "auth.2fa.enabled";
+        metadata: z.ZodUnknown;
+    };
+    readonly AUTH_2FA_DISABLED: {
+        name: "auth.2fa.disabled";
+        metadata: z.ZodUnknown;
+    };
+    readonly ORG_CREATED: {
+        name: "org.created";
+        metadata: z.ZodUnknown;
+    };
+    readonly ORG_UPDATED: {
+        name: "org.updated";
+        metadata: z.ZodUnknown;
+    };
+    readonly ORG_DELETED: {
+        name: "org.deleted";
+        metadata: z.ZodUnknown;
+    };
+    readonly ORG_MEMBER_ADDED: {
+        name: "org.member.added";
+        metadata: z.ZodUnknown;
+    };
+    readonly ORG_MEMBER_REMOVED: {
+        name: "org.member.removed";
+        metadata: z.ZodUnknown;
+    };
+    readonly ORG_MEMBER_ROLE_CHANGED: {
+        name: "org.member.role_changed";
+        metadata: z.ZodObject<{
+            oldRole: z.ZodString;
+            newRole: z.ZodString;
+        }, z.core.$strip>;
+    };
+    readonly ADMIN_IMPERSONATE_STARTED: {
+        name: "admin.impersonate.started";
+        metadata: z.ZodUnknown;
+    };
+    readonly ADMIN_IMPERSONATE_ENDED: {
+        name: "admin.impersonate.ended";
+        metadata: z.ZodUnknown;
+    };
+    readonly ADMIN_USER_UPDATED: {
+        name: "admin.user.updated";
+        metadata: z.ZodUnknown;
+    };
+    readonly ADMIN_USER_DELETED: {
+        name: "admin.user.deleted";
+        metadata: z.ZodUnknown;
+    };
+    readonly ADMIN_ORG_UPDATED: {
+        name: "admin.org.updated";
+        metadata: z.ZodUnknown;
+    };
+    readonly ADMIN_ORG_DELETED: {
+        name: "admin.org.deleted";
+        metadata: z.ZodUnknown;
+    };
+    readonly ACCOUNT_EMAIL_CHANGED: {
+        name: "account.email.changed";
+        metadata: z.ZodUnknown;
+    };
+    readonly BILLING_CHECKOUT_STARTED: {
+        name: "billing.checkout.started";
+        metadata: z.ZodObject<{
+            priceId: z.ZodString;
+            quantity: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>;
+    };
+    readonly BILLING_SUBSCRIPTION_CREATED: {
+        name: "billing.subscription.created";
+        metadata: z.ZodUnknown;
+    };
+    readonly BILLING_SUBSCRIPTION_UPDATED: {
+        name: "billing.subscription.updated";
+        metadata: z.ZodUnknown;
+    };
+    readonly BILLING_SUBSCRIPTION_CANCELLED: {
+        name: "billing.subscription.cancelled";
+        metadata: z.ZodUnknown;
+    };
+    readonly DATA_EXPORT_REQUESTED: {
+        name: "data.export.requested";
+        metadata: z.ZodUnknown;
+    };
+    readonly DATA_EXPORT_COMPLETED: {
+        name: "data.export.completed";
+        metadata: z.ZodUnknown;
+    };
+    readonly SETTINGS_UPDATED: {
+        name: "settings.updated";
+        metadata: z.ZodUnknown;
+    };
+    readonly SECRET_ACCESS: {
+        name: "secret.access";
+        metadata: z.ZodUnknown;
+    };
+    readonly WEBHOOK_CREATED: {
+        name: "webhook.created";
+        metadata: z.ZodUnknown;
+    };
+    readonly WEBHOOK_UPDATED: {
+        name: "webhook.updated";
+        metadata: z.ZodUnknown;
+    };
+    readonly WEBHOOK_DELETED: {
+        name: "webhook.deleted";
+        metadata: z.ZodUnknown;
+    };
+    readonly WEBHOOK_DISPATCHED: {
+        name: "webhook.dispatched";
+        metadata: z.ZodUnknown;
+    };
+    readonly CRON_RUN: {
+        name: "cron.run";
+        metadata: z.ZodObject<{
+            job: z.ZodString;
+            durationMs: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>;
+    };
+    readonly API_KEY_CREATED: {
+        name: "api_key.created";
+        metadata: z.ZodUnknown;
+    };
+    readonly API_KEY_REVOKED: {
+        name: "api_key.revoked";
+        metadata: z.ZodUnknown;
+    };
+};
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,eAAe;;;;;EAAmD,CAAC;AAChF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,aAAa;;;;EAA2C,CAAC;AACtE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,eAAO,MAAM,cAAc;;;;EAA0C,CAAC;AACtE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAMtD,eAAO,MAAM,WAAW;;;;;;;;;;iBAKtB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEhD,eAAO,MAAM,cAAc;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,SAAS;;;iBAGpB,CAAC;AACH,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAE5C,eAAO,MAAM,aAAa;;;;;;;;;iBAMxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,eAAO,MAAM,aAAa;;;iBAGxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAOpD,eAAO,MAAM,YAAY,aAMrB,CAAC;AAML,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAe3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;iBAWjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,KAAK,SAAS,MAAM,EAAE,KAAK,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,EAC1F,IAAI,EAAE,KAAK,EACX,cAAc,CAAC,EAAE,KAAK,GACrB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,CAQlC;AAMD,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkEV,CAAC"}

package/dist/schema.js

@@ -0,0 +1,186 @@
+// =============================================================================
+// Audit Event Schema (Zod)
+// =============================================================================
+// Single source of truth for the structure of an audit event. Every persistence
+// provider, every API gateway middleware, and every test fixture validates
+// against the schemas defined here.
+//
+// Design goals (SOC 2 alignment):
+//   - WHO   : `actor` — the principal that performed the action
+//   - WHAT  : `action` + `resource` — dotted action name + the thing acted on
+//   - WHEN  : `timestamp` — ISO 8601, UTC
+//   - WHERE : `context.ip` + `context.geo` + `context.userAgent`
+//   - TENANT: `tenantId` — every event MUST be scoped to a tenant (or "system")
+//   - STATE : `changes.before` / `changes.after` for any state-mutating action
+//
+// The audit table itself is APPEND-ONLY — see MIGRATION.md.
+// =============================================================================
+import { z } from "zod";
+// -----------------------------------------------------------------------------
+// Primitive enums
+// -----------------------------------------------------------------------------
+export const ActorTypeSchema = z.enum(["user", "system", "api_key", "service"]);
+export const OutcomeSchema = z.enum(["success", "failure", "denied"]);
+export const SeveritySchema = z.enum(["info", "warning", "critical"]);
+// -----------------------------------------------------------------------------
+// Sub-schemas
+// -----------------------------------------------------------------------------
+export const ActorSchema = z.object({
+    id: z.string().min(1),
+    type: ActorTypeSchema,
+    email: z.string().email().optional(),
+    name: z.string().optional(),
+});
+export const ResourceSchema = z.object({
+    type: z.string().min(1),
+    id: z.string().min(1),
+    name: z.string().optional(),
+});
+export const GeoSchema = z.object({
+    country: z.string().optional(),
+    region: z.string().optional(),
+});
+export const ContextSchema = z.object({
+    ip: z.string().optional(),
+    userAgent: z.string().optional(),
+    requestId: z.string().optional(),
+    sessionId: z.string().optional(),
+    geo: GeoSchema.optional(),
+});
+export const ChangesSchema = z.object({
+    before: z.record(z.string(), z.unknown()),
+    after: z.record(z.string(), z.unknown()),
+});
+// -----------------------------------------------------------------------------
+// Action name — dotted string with at least two segments
+// e.g. "auth.login.success", "billing.subscription.created"
+// -----------------------------------------------------------------------------
+export const ActionSchema = z
+    .string()
+    .min(3)
+    .regex(/^[a-z][a-z0-9_]*(\.[a-z0-9_]+)+$/, {
+    message: "Action must be lowercase, dotted, and contain at least two segments (e.g. 'billing.subscription.created').",
+});
+// -----------------------------------------------------------------------------
+// Full audit event
+// -----------------------------------------------------------------------------
+export const AuditEventSchema = z.object({
+    id: z.string().uuid(),
+    timestamp: z
+        .string()
+        .datetime({ offset: true })
+        .or(z.date().transform((d) => d.toISOString())),
+    actor: ActorSchema,
+    tenantId: z.string().min(1),
+    action: ActionSchema,
+    resource: ResourceSchema,
+    outcome: OutcomeSchema,
+    severity: SeveritySchema.default("info"),
+    context: ContextSchema.default({}),
+    changes: ChangesSchema.optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+});
+// Input shape — `id` and `timestamp` are auto-generated when callers use the
+// helper APIs but may be supplied explicitly (e.g. backfills).
+export const AuditEventInputSchema = AuditEventSchema.partial({
+    id: true,
+    timestamp: true,
+    severity: true,
+    context: true,
+});
+// -----------------------------------------------------------------------------
+// Query filter
+// -----------------------------------------------------------------------------
+export const AuditQueryFilterSchema = z.object({
+    tenantId: z.string().optional(),
+    actorId: z.string().optional(),
+    action: z.string().optional(),
+    resourceType: z.string().optional(),
+    resourceId: z.string().optional(),
+    outcome: OutcomeSchema.optional(),
+    startDate: z.date().optional(),
+    endDate: z.date().optional(),
+    limit: z.number().int().positive().max(1000).default(100),
+    offset: z.number().int().nonnegative().default(0),
+});
+// -----------------------------------------------------------------------------
+// defineAction — strongly-typed action constructor
+// -----------------------------------------------------------------------------
+/**
+ * Declare a strongly-typed audit action.
+ *
+ * @example
+ * ```ts
+ * const ROLE_CHANGED = defineAction("org.member.role_changed", z.object({
+ *   oldRole: z.string(),
+ *   newRole: z.string(),
+ * }));
+ *
+ * await audit.log({
+ *   action: ROLE_CHANGED.name,
+ *   metadata: ROLE_CHANGED.metadata.parse({ oldRole: "member", newRole: "admin" }),
+ *   ...
+ * });
+ * ```
+ */
+export function defineAction(name, metadataSchema) {
+    // Validate the action name shape eagerly so misnamed actions fail at module
+    // load rather than first-call.
+    ActionSchema.parse(name);
+    return {
+        name,
+        metadata: (metadataSchema ?? z.unknown()),
+    };
+}
+// -----------------------------------------------------------------------------
+// Canonical action catalog (extend freely, keep names stable)
+// -----------------------------------------------------------------------------
+export const ACTIONS = {
+    // ── Auth ──
+    AUTH_LOGIN_SUCCESS: defineAction("auth.login.success"),
+    AUTH_LOGIN_FAILURE: defineAction("auth.login.failure"),
+    AUTH_LOGOUT: defineAction("auth.logout"),
+    AUTH_SIGNUP: defineAction("auth.signup"),
+    AUTH_SESSION_REVOKED: defineAction("auth.session.revoked"),
+    AUTH_SESSION_REVOKED_OTHER: defineAction("auth.session.revoked_other"),
+    AUTH_PASSWORD_CHANGED: defineAction("auth.password.changed"),
+    AUTH_2FA_ENABLED: defineAction("auth.2fa.enabled"),
+    AUTH_2FA_DISABLED: defineAction("auth.2fa.disabled"),
+    // ── Organizations ──
+    ORG_CREATED: defineAction("org.created"),
+    ORG_UPDATED: defineAction("org.updated"),
+    ORG_DELETED: defineAction("org.deleted"),
+    ORG_MEMBER_ADDED: defineAction("org.member.added"),
+    ORG_MEMBER_REMOVED: defineAction("org.member.removed"),
+    ORG_MEMBER_ROLE_CHANGED: defineAction("org.member.role_changed", z.object({ oldRole: z.string(), newRole: z.string() })),
+    // ── Admin ──
+    ADMIN_IMPERSONATE_STARTED: defineAction("admin.impersonate.started"),
+    ADMIN_IMPERSONATE_ENDED: defineAction("admin.impersonate.ended"),
+    ADMIN_USER_UPDATED: defineAction("admin.user.updated"),
+    ADMIN_USER_DELETED: defineAction("admin.user.deleted"),
+    ADMIN_ORG_UPDATED: defineAction("admin.org.updated"),
+    ADMIN_ORG_DELETED: defineAction("admin.org.deleted"),
+    // ── Account ──
+    ACCOUNT_EMAIL_CHANGED: defineAction("account.email.changed"),
+    // ── Billing ──
+    BILLING_CHECKOUT_STARTED: defineAction("billing.checkout.started", z.object({ priceId: z.string(), quantity: z.number().optional() })),
+    BILLING_SUBSCRIPTION_CREATED: defineAction("billing.subscription.created"),
+    BILLING_SUBSCRIPTION_UPDATED: defineAction("billing.subscription.updated"),
+    BILLING_SUBSCRIPTION_CANCELLED: defineAction("billing.subscription.cancelled"),
+    // ── Data ──
+    DATA_EXPORT_REQUESTED: defineAction("data.export.requested"),
+    DATA_EXPORT_COMPLETED: defineAction("data.export.completed"),
+    // ── Settings & Secrets ──
+    SETTINGS_UPDATED: defineAction("settings.updated"),
+    SECRET_ACCESS: defineAction("secret.access"),
+    // ── Webhooks ──
+    WEBHOOK_CREATED: defineAction("webhook.created"),
+    WEBHOOK_UPDATED: defineAction("webhook.updated"),
+    WEBHOOK_DELETED: defineAction("webhook.deleted"),
+    WEBHOOK_DISPATCHED: defineAction("webhook.dispatched"),
+    // ── Cron ──
+    CRON_RUN: defineAction("cron.run", z.object({ job: z.string(), durationMs: z.number().optional() })),
+    // ── API Keys ──
+    API_KEY_CREATED: defineAction("api_key.created"),
+    API_KEY_REVOKED: defineAction("api_key.revoked"),
+};

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@nebutra/audit",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Audit logging for sensitive operations",
   "private": false,
-  "license": "AGPL-3.0",
+  "license": "MIT",
   "type": "module",
   "nebutra": {
     "status": "wip",
@@ -47,10 +47,10 @@
   ],
   "dependencies": {
     "zod": "^4.3.6",
-    "@nebutra/logger": "0.1.0"
+    "@nebutra/logger": "0.1.2"
   },
   "peerDependencies": {
-    "@nebutra/db": "0.1.0"
+    "@nebutra/db": "0.1.2"
   },
   "peerDependenciesMeta": {
     "@nebutra/db": {
@@ -61,7 +61,7 @@
     "@types/node": "^22.19.15",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18",
-    "@nebutra/db": "0.1.0"
+    "@nebutra/db": "0.1.2"
   },
   "homepage": "https://github.com/Nebutra/Nebutra-Sailor/tree/main/packages/iam/audit#readme",
   "repository": {