@primstack/cli 0.0.1

package/dist/templates/api/fastify-supabase/src/db/schema/users.ts.template

@@ -0,0 +1,12 @@
+import { pgTable, uuid, varchar, timestamp } from 'drizzle-orm/pg-core';
+
+export const users = pgTable('users', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  email: varchar('email', { length: 255 }).notNull().unique(),
+  name: varchar('name', { length: 255 }),
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+  updatedAt: timestamp('updated_at').defaultNow().notNull(),
+});
+
+export type User = typeof users.$inferSelect;
+export type NewUser = typeof users.$inferInsert;

package/dist/templates/api/fastify-turso/.env.example.template

@@ -0,0 +1,11 @@
+# Server configuration
+PORT={{PORT}}
+HOST=0.0.0.0
+NODE_ENV=development
+
+# CORS (optional, defaults to allow all in development)
+# CORS_ORIGIN=https://your-frontend.com
+
+# Turso Database
+TURSO_DATABASE_URL=libsql://your-database.turso.io
+TURSO_AUTH_TOKEN=your-auth-token

package/dist/templates/api/fastify-turso/drizzle.config.ts.template

@@ -0,0 +1,11 @@
+import { defineConfig } from 'drizzle-kit';
+
+export default defineConfig({
+  schema: './src/db/schema',
+  out: './src/db/migrations',
+  dialect: 'turso',
+  dbCredentials: {
+    url: process.env.TURSO_DATABASE_URL!,
+    authToken: process.env.TURSO_AUTH_TOKEN,
+  },
+});

package/dist/templates/api/fastify-turso/package.json.template

@@ -0,0 +1,15 @@
+{
+  "scripts": {
+    "db:generate": "drizzle-kit generate",
+    "db:migrate": "drizzle-kit migrate",
+    "db:push": "drizzle-kit push",
+    "db:studio": "drizzle-kit studio"
+  },
+  "dependencies": {
+    "drizzle-orm": "^0.36.0",
+    "@libsql/client": "^0.14.0"
+  },
+  "devDependencies": {
+    "drizzle-kit": "^0.28.0"
+  }
+}

package/dist/templates/api/fastify-turso/src/db/index.ts.template

@@ -0,0 +1,10 @@
+import { drizzle } from 'drizzle-orm/libsql';
+import { createClient } from '@libsql/client';
+import * as schema from './schema/users.js';
+
+const client = createClient({
+  url: process.env.TURSO_DATABASE_URL!,
+  authToken: process.env.TURSO_AUTH_TOKEN!,
+});
+
+export const db = drizzle(client, { schema });

package/dist/templates/api/fastify-turso/src/db/schema/users.ts.template

@@ -0,0 +1,12 @@
+import { sqliteTable, text, integer } from 'drizzle-orm/sqlite-core';
+
+export const users = sqliteTable('users', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  email: text('email').notNull().unique(),
+  name: text('name'),
+  createdAt: text('created_at').notNull().default('CURRENT_TIMESTAMP'),
+  updatedAt: text('updated_at').notNull().default('CURRENT_TIMESTAMP'),
+});
+
+export type User = typeof users.$inferSelect;
+export type NewUser = typeof users.$inferInsert;

package/dist/templates/fullstack/api/.env.example.template

@@ -0,0 +1,10 @@
+# Server configuration
+PORT={{PORT}}
+HOST=0.0.0.0
+NODE_ENV=development
+
+# CORS (optional, defaults to allow all in development)
+# CORS_ORIGIN=https://your-frontend.com
+
+# Database (update with your credentials if needed)
+DATABASE_URL=postgresql://localhost:5432/{{PROJECT_NAME}}

package/dist/templates/fullstack/api/.gitignore.template

@@ -0,0 +1,4 @@
+node_modules/
+dist/
+.env
+*.log

package/dist/templates/fullstack/api/drizzle.config.ts.template

@@ -0,0 +1,14 @@
+import { defineConfig } from 'drizzle-kit';
+
+if (!process.env.DATABASE_URL) {
+  throw new Error('DATABASE_URL environment variable is required');
+}
+
+export default defineConfig({
+  schema: './src/db/schema',
+  out: './src/db/migrations',
+  dialect: 'postgresql',
+  dbCredentials: {
+    url: process.env.DATABASE_URL,
+  },
+});

package/dist/templates/fullstack/api/package.json.template

@@ -0,0 +1,33 @@
+{
+  "name": "@{{PROJECT_NAME}}/api",
+  "version": "0.0.1",
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "typecheck": "tsc --noEmit",
+    "db:generate": "drizzle-kit generate",
+    "db:migrate": "drizzle-kit migrate",
+    "db:push": "drizzle-kit push",
+    "db:studio": "drizzle-kit studio"
+  },
+  "dependencies": {
+    "@{{PROJECT_NAME}}/shared": "workspace:*",
+    "@fastify/cors": "^10.0.0",
+    "@fastify/helmet": "^13.0.0",
+    "@fastify/sensible": "^6.0.0",
+    "dotenv": "^16.4.0",
+    "fastify": "^5.0.0",
+    "drizzle-orm": "^0.36.0",
+    "pg": "^8.13.0",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "@types/pg": "^8.11.0",
+    "drizzle-kit": "^0.28.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.7.0"
+  }
+}

package/dist/templates/fullstack/api/src/db/index.ts.template

@@ -0,0 +1,13 @@
+import { drizzle } from 'drizzle-orm/node-postgres';
+import pg from 'pg';
+import * as schema from './schema/index.js';
+
+export const pool = new pg.Pool({
+  connectionString: process.env.DATABASE_URL,
+});
+
+export const db = drizzle(pool, { schema });
+
+export async function closeDatabase(): Promise<void> {
+  await pool.end();
+}

package/dist/templates/fullstack/api/src/db/schema/api-keys.ts.template

@@ -0,0 +1,19 @@
+import { pgTable, uuid, varchar, timestamp, index, uniqueIndex } from 'drizzle-orm/pg-core';
+import { organizations } from './organizations.js';
+
+export const apiKeys = pgTable('api_keys', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  organizationId: uuid('organization_id').notNull().references(() => organizations.id, { onDelete: 'cascade' }),
+  name: varchar('name', { length: 255 }).notNull(),
+  keyHash: varchar('key_hash', { length: 255 }).notNull(),
+  keyPrefix: varchar('key_prefix', { length: 8 }).notNull(),
+  lastUsedAt: timestamp('last_used_at'),
+  expiresAt: timestamp('expires_at'),
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+}, (table) => [
+  uniqueIndex('api_keys_key_hash_idx').on(table.keyHash),
+  index('api_keys_org_idx').on(table.organizationId),
+]);
+
+export type ApiKey = typeof apiKeys.$inferSelect;
+export type NewApiKey = typeof apiKeys.$inferInsert;

package/dist/templates/fullstack/api/src/db/schema/audit-logs.ts.template

@@ -0,0 +1,23 @@
+import { pgTable, uuid, varchar, timestamp, json, index } from 'drizzle-orm/pg-core';
+import { organizations } from './organizations.js';
+import { users } from './users.js';
+
+export const auditLogs = pgTable('audit_logs', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  organizationId: uuid('organization_id').notNull().references(() => organizations.id, { onDelete: 'cascade' }),
+  userId: uuid('user_id').references(() => users.id, { onDelete: 'set null' }),
+  action: varchar('action', { length: 255 }).notNull(),
+  resourceType: varchar('resource_type', { length: 100 }).notNull(),
+  resourceId: varchar('resource_id', { length: 255 }),
+  metadata: json('metadata').$type<Record<string, unknown>>().notNull().default({}),
+  ipAddress: varchar('ip_address', { length: 45 }),
+  userAgent: varchar('user_agent', { length: 500 }),
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+}, (table) => [
+  index('audit_logs_org_idx').on(table.organizationId),
+  index('audit_logs_action_idx').on(table.action),
+  index('audit_logs_created_idx').on(table.createdAt),
+]);
+
+export type AuditLog = typeof auditLogs.$inferSelect;
+export type NewAuditLog = typeof auditLogs.$inferInsert;

package/dist/templates/fullstack/api/src/db/schema/index.ts.template

@@ -0,0 +1,8 @@
+export * from './users.js';
+export * from './organizations.js';
+export * from './memberships.js';
+export * from './plans.js';
+export * from './subscriptions.js';
+export * from './invites.js';
+export * from './api-keys.js';
+export * from './audit-logs.js';

package/dist/templates/fullstack/api/src/db/schema/invites.ts.template

@@ -0,0 +1,19 @@
+import { pgTable, uuid, varchar, timestamp, index } from 'drizzle-orm/pg-core';
+import { organizations } from './organizations.js';
+
+export const invites = pgTable('invites', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  email: varchar('email', { length: 255 }).notNull(),
+  organizationId: uuid('organization_id').notNull().references(() => organizations.id, { onDelete: 'cascade' }),
+  role: varchar('role', { length: 50 }).notNull().$type<'admin' | 'member'>(),
+  token: varchar('token', { length: 255 }).notNull().unique(),
+  expiresAt: timestamp('expires_at').notNull(),
+  acceptedAt: timestamp('accepted_at'),
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+}, (table) => [
+  index('invites_email_idx').on(table.email),
+  index('invites_token_idx').on(table.token),
+]);
+
+export type Invite = typeof invites.$inferSelect;
+export type NewInvite = typeof invites.$inferInsert;

package/dist/templates/fullstack/api/src/db/schema/memberships.ts.template

@@ -0,0 +1,16 @@
+import { pgTable, uuid, varchar, timestamp, uniqueIndex } from 'drizzle-orm/pg-core';
+import { users } from './users.js';
+import { organizations } from './organizations.js';
+
+export const memberships = pgTable('memberships', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  userId: uuid('user_id').notNull().references(() => users.id, { onDelete: 'cascade' }),
+  organizationId: uuid('organization_id').notNull().references(() => organizations.id, { onDelete: 'cascade' }),
+  role: varchar('role', { length: 50 }).notNull().$type<'owner' | 'admin' | 'member'>(),
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+}, (table) => [
+  uniqueIndex('memberships_user_org_idx').on(table.userId, table.organizationId),
+]);
+
+export type Membership = typeof memberships.$inferSelect;
+export type NewMembership = typeof memberships.$inferInsert;

package/dist/templates/fullstack/api/src/db/schema/organizations.ts.template

@@ -0,0 +1,13 @@
+import { pgTable, uuid, varchar, timestamp } from 'drizzle-orm/pg-core';
+
+export const organizations = pgTable('organizations', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  name: varchar('name', { length: 255 }).notNull(),
+  slug: varchar('slug', { length: 255 }).notNull().unique(),
+  logoUrl: varchar('logo_url', { length: 500 }),
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+  updatedAt: timestamp('updated_at').defaultNow().notNull(),
+});
+
+export type Organization = typeof organizations.$inferSelect;
+export type NewOrganization = typeof organizations.$inferInsert;

package/dist/templates/fullstack/api/src/db/schema/plans.ts.template

@@ -0,0 +1,29 @@
+import { pgTable, uuid, varchar, integer, boolean, timestamp, json } from 'drizzle-orm/pg-core';
+
+export const plans = pgTable('plans', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  name: varchar('name', { length: 255 }).notNull(),
+  slug: varchar('slug', { length: 255 }).notNull().unique(),
+  description: varchar('description', { length: 1000 }),
+  priceMonthly: integer('price_monthly').notNull(), // cents
+  priceYearly: integer('price_yearly').notNull(),   // cents
+  features: json('features').$type<string[]>().notNull().default([]),
+  limits: json('limits').$type<{
+    seats: number | null;
+    storage: number | null;
+    apiCalls: number | null;
+  }>().notNull().default({ seats: null, storage: null, apiCalls: null }),
+  isActive: boolean('is_active').default(true).notNull(),
+
+  // Stripe integration fields
+  stripeProductIdTest: varchar('stripe_product_id_test', { length: 255 }),
+  stripeProductIdLive: varchar('stripe_product_id_live', { length: 255 }),
+  currentPriceLookupKeyMonthly: varchar('current_price_lookup_key_monthly', { length: 255 }), // e.g., 'pro_monthly_v2'
+  currentPriceLookupKeyYearly: varchar('current_price_lookup_key_yearly', { length: 255 }),
+
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+  updatedAt: timestamp('updated_at').defaultNow().notNull(),
+});
+
+export type Plan = typeof plans.$inferSelect;
+export type NewPlan = typeof plans.$inferInsert;

package/dist/templates/fullstack/api/src/db/schema/subscriptions.ts.template

@@ -0,0 +1,38 @@
+import { pgTable, uuid, varchar, boolean, timestamp, integer, index } from 'drizzle-orm/pg-core';
+import { organizations } from './organizations.js';
+import { plans } from './plans.js';
+
+export const subscriptions = pgTable('subscriptions', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  organizationId: uuid('organization_id').notNull().references(() => organizations.id, { onDelete: 'cascade' }),
+  planId: uuid('plan_id').notNull().references(() => plans.id),
+  status: varchar('status', { length: 50 }).notNull().$type<'active' | 'canceled' | 'past_due' | 'trialing' | 'incomplete'>(),
+  currentPeriodStart: timestamp('current_period_start').notNull(),
+  currentPeriodEnd: timestamp('current_period_end').notNull(),
+  cancelAtPeriodEnd: boolean('cancel_at_period_end').default(false).notNull(),
+
+  // Stripe integration fields
+  stripeSubscriptionId: varchar('stripe_subscription_id', { length: 255 }),
+  stripeCustomerId: varchar('stripe_customer_id', { length: 255 }),
+
+  // Price versioning (locks in the price at subscription time)
+  billingInterval: varchar('billing_interval', { length: 20 }).$type<'monthly' | 'yearly'>(),
+  priceLookupKey: varchar('price_lookup_key', { length: 255 }), // e.g., 'pro_monthly_v1'
+  priceVersion: integer('price_version'),
+  priceAmountCents: integer('price_amount_cents'), // Locked-in price
+
+  // Trial support
+  trialStart: timestamp('trial_start'),
+  trialEnd: timestamp('trial_end'),
+
+  canceledAt: timestamp('canceled_at'),
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+  updatedAt: timestamp('updated_at').defaultNow().notNull(),
+}, (table) => [
+  index('subscriptions_org_idx').on(table.organizationId),
+  index('subscriptions_stripe_id_idx').on(table.stripeSubscriptionId),
+  index('subscriptions_customer_idx').on(table.stripeCustomerId),
+]);
+
+export type Subscription = typeof subscriptions.$inferSelect;
+export type NewSubscription = typeof subscriptions.$inferInsert;

package/dist/templates/fullstack/api/src/db/schema/users.ts.template

@@ -0,0 +1,14 @@
+import { pgTable, uuid, varchar, boolean, timestamp } from 'drizzle-orm/pg-core';
+
+export const users = pgTable('users', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  email: varchar('email', { length: 255 }).notNull().unique(),
+  name: varchar('name', { length: 255 }),
+  avatarUrl: varchar('avatar_url', { length: 500 }),
+  emailVerified: boolean('email_verified').default(false).notNull(),
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+  updatedAt: timestamp('updated_at').defaultNow().notNull(),
+});
+
+export type User = typeof users.$inferSelect;
+export type NewUser = typeof users.$inferInsert;

package/dist/templates/fullstack/api/src/index.ts.template

@@ -0,0 +1,54 @@
+import Fastify from 'fastify';
+import cors from '@fastify/cors';
+import helmet from '@fastify/helmet';
+import sensible from '@fastify/sensible';
+import { env } from './lib/env.js';
+import { closeDatabase } from './db/index.js';
+import healthRoutes from './routes/health.js';
+
+const app = Fastify({
+  logger: {
+    level: env.NODE_ENV === 'development' ? 'info' : 'warn',
+  },
+});
+
+// Plugins
+app.register(helmet);
+app.register(cors, {
+  origin: env.NODE_ENV === 'development'
+    ? true
+    : (env.CORS_ORIGIN?.split(',').map((o) => o.trim()).filter(Boolean) ?? false),
+});
+app.register(sensible);
+
+// Routes
+app.register(healthRoutes, { prefix: '/health' });
+
+// Graceful shutdown
+const shutdown = async (signal: string) => {
+  app.log.info(`Received ${signal}, shutting down gracefully...`);
+  try {
+    await app.close();
+    await closeDatabase();
+    process.exit(0);
+  } catch (err) {
+    app.log.error('Error during shutdown:', err);
+    process.exit(1);
+  }
+};
+
+process.on('SIGTERM', () => shutdown('SIGTERM'));
+process.on('SIGINT', () => shutdown('SIGINT'));
+
+// Start server
+const start = async () => {
+  try {
+    await app.listen({ port: env.PORT, host: env.HOST });
+    app.log.info(`Server running at http://${env.HOST}:${env.PORT}`);
+  } catch (err) {
+    app.log.error(err);
+    process.exit(1);
+  }
+};
+
+start();

package/dist/templates/fullstack/api/src/lib/env.ts.template

@@ -0,0 +1,22 @@
+import 'dotenv/config';
+import { z } from 'zod';
+
+const envSchema = z.object({
+  PORT: z.coerce.number().default({{PORT}}),
+  HOST: z.string().default('0.0.0.0'),
+  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
+  CORS_ORIGIN: z.string().min(1).optional(),
+  DATABASE_URL: z.string().min(1),
+});
+
+export const env = envSchema
+  .superRefine((val, ctx) => {
+    if (val.NODE_ENV === 'production' && !val.CORS_ORIGIN) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'CORS_ORIGIN is required when NODE_ENV=production',
+        path: ['CORS_ORIGIN'],
+      });
+    }
+  })
+  .parse(process.env);

package/dist/templates/fullstack/api/src/routes/health.ts.template

@@ -0,0 +1,14 @@
+import { FastifyPluginAsync } from 'fastify';
+
+const healthRoutes: FastifyPluginAsync = async (fastify) => {
+  fastify.get('/', async () => {
+    return { status: 'ok', timestamp: new Date().toISOString() };
+  });
+
+  fastify.get('/ready', async () => {
+    // Add database connectivity check here if needed
+    return { status: 'ready', timestamp: new Date().toISOString() };
+  });
+};
+
+export default healthRoutes;

package/dist/templates/fullstack/api/tsconfig.json.template

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": ["ES2022"],
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "outDir": "./dist",
+    "rootDir": "./src"
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}

package/dist/templates/fullstack/root/.gitignore.template

@@ -0,0 +1,26 @@
+# Dependencies
+node_modules/
+
+# Build outputs
+dist/
+.turbo/
+
+# Environment
+.env
+.env.local
+.env.*.local
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Logs
+*.log
+npm-debug.log*
+pnpm-debug.log*

package/dist/templates/fullstack/root/package.json.template

@@ -0,0 +1,15 @@
+{
+  "name": "{{PROJECT_NAME}}",
+  "version": "0.0.1",
+  "private": true,
+  "scripts": {
+    "dev": "turbo dev",
+    "build": "turbo build",
+    "typecheck": "turbo typecheck",
+    "lint": "turbo lint"
+  },
+  "devDependencies": {
+    "turbo": "^2.0.0"
+  },
+  "packageManager": "pnpm@9.0.0"
+}

package/dist/templates/fullstack/root/pnpm-workspace.yaml.template

@@ -0,0 +1,3 @@
+packages:
+  - "apps/*"
+  - "packages/*"

package/dist/templates/fullstack/root/turbo.json.template

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://turbo.build/schema.json",
+  "tasks": {
+    "build": {
+      "dependsOn": ["^build"],
+      "outputs": ["dist/**"]
+    },
+    "dev": {
+      "cache": false,
+      "persistent": true
+    },
+    "typecheck": {
+      "dependsOn": ["^build"]
+    },
+    "lint": {}
+  }
+}

package/dist/templates/fullstack/shared/package.json.template

@@ -0,0 +1,36 @@
+{
+  "name": "@{{PROJECT_NAME}}/shared",
+  "version": "0.0.1",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./schemas": {
+      "types": "./dist/schemas/index.d.ts",
+      "import": "./dist/schemas/index.js"
+    },
+    "./types": {
+      "types": "./dist/types/index.d.ts",
+      "import": "./dist/types/index.js"
+    },
+    "./validators": {
+      "types": "./dist/validators/index.d.ts",
+      "import": "./dist/validators/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0"
+  }
+}

package/dist/templates/fullstack/shared/src/index.ts.template

@@ -0,0 +1,8 @@
+// Re-export all schemas
+export * from './schemas/index.js';
+
+// Re-export all types
+export * from './types/index.js';
+
+// Re-export validators
+export * from './validators/index.js';

package/dist/templates/fullstack/shared/src/schemas/api-key.ts.template

@@ -0,0 +1,28 @@
+import { z } from 'zod';
+
+export const apiKeySchema = z.object({
+  id: z.string().uuid(),
+  organizationId: z.string().uuid(),
+  name: z.string().min(1).max(255),
+  keyHash: z.string(), // hashed, never store plain
+  keyPrefix: z.string().length(8), // first 8 chars for identification
+  lastUsedAt: z.coerce.date().nullable(),
+  expiresAt: z.coerce.date().nullable(),
+  createdAt: z.coerce.date(),
+});
+
+export const createApiKeySchema = z.object({
+  organizationId: z.string().uuid(),
+  name: z.string().min(1).max(255),
+  expiresAt: z.coerce.date().nullable().optional(),
+});
+
+// What's returned when creating a new key (includes unhashed key once)
+export const apiKeyWithSecretSchema = apiKeySchema.extend({
+  key: z.string(), // full key, only shown once at creation
+});
+
+export const updateApiKeySchema = z.object({
+  name: z.string().min(1).max(255).optional(),
+  expiresAt: z.coerce.date().nullable().optional(),
+});

package/dist/templates/fullstack/shared/src/schemas/audit-log.ts.template

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+
+export const auditLogSchema = z.object({
+  id: z.string().uuid(),
+  organizationId: z.string().uuid(),
+  userId: z.string().uuid().nullable(),
+  action: z.string(), // e.g., 'user.created', 'subscription.upgraded'
+  resourceType: z.string(), // e.g., 'user', 'subscription'
+  resourceId: z.string().nullable(),
+  metadata: z.record(z.unknown()),
+  ipAddress: z.string().nullable(),
+  userAgent: z.string().nullable(),
+  createdAt: z.coerce.date(),
+});
+
+export const createAuditLogSchema = auditLogSchema.omit({
+  id: true,
+  createdAt: true,
+}).extend({
+  metadata: z.record(z.unknown()).optional(),
+});
+
+// Common audit actions
+export const AuditAction = {
+  USER_CREATED: 'user.created',
+  USER_UPDATED: 'user.updated',
+  USER_DELETED: 'user.deleted',
+  ORG_CREATED: 'organization.created',
+  ORG_UPDATED: 'organization.updated',
+  MEMBER_ADDED: 'member.added',
+  MEMBER_REMOVED: 'member.removed',
+  MEMBER_ROLE_CHANGED: 'member.role_changed',
+  SUBSCRIPTION_CREATED: 'subscription.created',
+  SUBSCRIPTION_UPGRADED: 'subscription.upgraded',
+  SUBSCRIPTION_DOWNGRADED: 'subscription.downgraded',
+  SUBSCRIPTION_CANCELED: 'subscription.canceled',
+  API_KEY_CREATED: 'api_key.created',
+  API_KEY_REVOKED: 'api_key.revoked',
+  INVITE_SENT: 'invite.sent',
+  INVITE_ACCEPTED: 'invite.accepted',
+} as const;