@stotles/better-auth-audit-logs 0.4.0-rc.1

package/dist/index.cjs

@@ -0,0 +1,828 @@
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
+var __toCommonJS = (from) => {
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __moduleCache;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+
+// src/index.ts
+var exports_src = {};
+__export(exports_src, {
+  auditLog: () => auditLog,
+  MemoryStorage: () => MemoryStorage
+});
+module.exports = __toCommonJS(exports_src);
+
+// src/schema.ts
+var import_db = require("better-auth/db");
+var baseSchema = {
+  auditLog: {
+    modelName: "auditLog",
+    fields: {
+      userId: {
+        type: "string",
+        required: false,
+        references: {
+          model: "user",
+          field: "id",
+          onDelete: "set null"
+        },
+        index: true
+      },
+      action: {
+        type: "string",
+        required: true,
+        sortable: true,
+        index: true
+      },
+      status: {
+        type: "string",
+        required: true,
+        sortable: true
+      },
+      severity: {
+        type: "string",
+        required: true,
+        sortable: true
+      },
+      ipAddress: {
+        type: "string",
+        required: false
+      },
+      userAgent: {
+        type: "string",
+        required: false,
+        returned: false
+      },
+      metadata: {
+        type: "string",
+        required: false
+      },
+      createdAt: {
+        type: "date",
+        required: true,
+        sortable: true,
+        index: true,
+        defaultValue: () => new Date
+      }
+    }
+  }
+};
+function buildSchema(options) {
+  return import_db.mergeSchema(baseSchema, options?.schema);
+}
+function getModelName(options) {
+  return options?.schema?.auditLog?.modelName ?? "auditLog";
+}
+var CRITICAL_FIELDS = ["userId", "action", "status", "severity", "metadata", "createdAt"];
+function validateSchema(schema) {
+  const model = schema.auditLog;
+  if (!model) {
+    throw new Error("[audit-log] Schema must define an auditLog model");
+  }
+  const fields = model.fields;
+  if (!fields || typeof fields !== "object") {
+    throw new Error("[audit-log] Schema auditLog model must have fields");
+  }
+  for (const field of CRITICAL_FIELDS) {
+    if (!(field in fields)) {
+      throw new Error(`[audit-log] Schema missing critical field: ${field}`);
+    }
+  }
+}
+
+// src/hooks/before.ts
+var import_api = require("better-auth/api");
+
+// src/utils/normalize-path.ts
+function normalizePath(path) {
+  return path.replace(/^\//, "").replace(/\//g, ":");
+}
+// src/utils/severity.ts
+var SEVERITY_MAP = new Map([
+  ["ban-user", "critical"],
+  ["impersonate-user", "critical"],
+  ["delete-user", "high"],
+  ["delete-account", "high"],
+  ["revoke-sessions", "high"],
+  ["revoke-other-sessions", "high"],
+  ["sign-in", "medium"],
+  ["sign-out", "medium"],
+  ["revoke-session", "medium"],
+  ["two-factor", "medium"],
+  ["change-password", "medium"],
+  ["reset-password", "medium"]
+]);
+function inferSeverity(action, status) {
+  for (const [pattern, severity] of SEVERITY_MAP) {
+    if (action.includes(pattern)) {
+      if (severity === "medium" && status === "failed")
+        return "high";
+      return severity;
+    }
+  }
+  return "low";
+}
+// src/utils/request-meta.ts
+var betterAuthApi = __toESM(require("better-auth/api"));
+var hasWarnedMissingGetIp = false;
+function getIpWrapper(req, options, logger) {
+  if ("getIP" in betterAuthApi) {
+    return betterAuthApi.getIP(req, options);
+  }
+  if ("getIp" in betterAuthApi) {
+    return betterAuthApi.getIp(req, options);
+  }
+  if (!hasWarnedMissingGetIp) {
+    hasWarnedMissingGetIp = true;
+    logger?.error("[audit-log] better-auth/api exposes neither getIP nor getIp; " + "IP addresses will not be captured. This likely means an incompatible better-auth version.");
+  }
+  return null;
+}
+function extractRequestMeta(request, headers, options, logger) {
+  return {
+    ipAddress: request ? getIpWrapper(request, options, logger) ?? null : null,
+    userAgent: headers?.get("user-agent") ?? null
+  };
+}
+// src/utils/sanitize.ts
+var DEFAULT_PII_FIELDS = [
+  "password",
+  "newPassword",
+  "currentPassword",
+  "token",
+  "secret",
+  "apiKey",
+  "refreshToken",
+  "accessToken",
+  "code",
+  "backupCode",
+  "otp"
+];
+async function sha256(value) {
+  const encoded = new TextEncoder().encode(value);
+  const buffer = await crypto.subtle.digest("SHA-256", encoded);
+  return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function redactPII(data, config) {
+  if (!config.enabled)
+    return data;
+  const fields = config.fields ?? DEFAULT_PII_FIELDS;
+  const strategy = config.strategy ?? "mask";
+  const result = { ...data };
+  for (const field of fields) {
+    if (!(field in result) || result[field] == null)
+      continue;
+    if (strategy === "remove") {
+      delete result[field];
+    } else if (strategy === "hash") {
+      result[field] = await sha256(String(result[field]));
+    } else {
+      result[field] = "[REDACTED]";
+    }
+  }
+  return result;
+}
+// src/utils/parse-metadata.ts
+function parseMetadata(raw) {
+  if (raw == null)
+    return {};
+  if (typeof raw === "object" && !Array.isArray(raw)) {
+    return raw;
+  }
+  if (typeof raw === "string") {
+    try {
+      const parsed = JSON.parse(raw);
+      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+        return parsed;
+      }
+      return {};
+    } catch {
+      return {};
+    }
+  }
+  return {};
+}
+// src/utils/validate-entry.ts
+var import_zod = require("zod");
+var auditLogEntrySchema = import_zod.z.object({
+  userId: import_zod.z.string().nullable(),
+  action: import_zod.z.string().min(1),
+  status: import_zod.z.enum(["success", "failed"]),
+  severity: import_zod.z.enum(["low", "medium", "high", "critical"]),
+  ipAddress: import_zod.z.string().nullable(),
+  userAgent: import_zod.z.string().nullable(),
+  metadata: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()),
+  createdAt: import_zod.z.date()
+});
+function validateEntry(entry, logger) {
+  const result = auditLogEntrySchema.safeParse(entry);
+  if (!result.success) {
+    logger?.warn("[audit-log] beforeLog returned invalid entry, skipping write:", result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`));
+    return null;
+  }
+  return result.data;
+}
+// src/utils/retry.ts
+async function withRetry(fn, opts) {
+  let lastError;
+  for (let attempt = 0;attempt <= opts.maxRetries; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      lastError = err;
+      if (attempt < opts.maxRetries) {
+        const delay = opts.baseDelayMs * Math.pow(2, attempt);
+        await new Promise((r) => setTimeout(r, delay));
+      }
+    }
+  }
+  throw lastError;
+}
+// src/internal.ts
+async function buildLogEntry(path, status, params) {
+  const action = normalizePath(path);
+  const severity = params.pathConfig?.severity ?? inferSeverity(action, status);
+  const captureOpts = {
+    ...params.options.capture,
+    ...params.pathConfig?.capture
+  };
+  const { ipAddress, userAgent } = extractRequestMeta(captureOpts.ipAddress !== false ? params.request : undefined, captureOpts.userAgent !== false ? params.headers : undefined, params.authOptions, params.logger);
+  let metadata = params.metadata ?? {};
+  if (params.options.piiRedaction.enabled) {
+    metadata = await redactPII(metadata, params.options.piiRedaction);
+  }
+  return {
+    userId: params.userId,
+    action,
+    status,
+    severity,
+    ipAddress,
+    userAgent,
+    metadata,
+    createdAt: new Date
+  };
+}
+async function buildLogEntryFromAction(action, status, params) {
+  const severity = inferSeverity(action, status);
+  const { ipAddress, userAgent } = extractRequestMeta(params.options.capture.ipAddress !== false ? params.request : undefined, params.options.capture.userAgent !== false ? params.headers : undefined, params.authOptions, params.logger);
+  let metadata = params.metadata ?? {};
+  if (params.options.piiRedaction.enabled) {
+    metadata = await redactPII(metadata, params.options.piiRedaction);
+  }
+  return {
+    userId: params.userId,
+    action,
+    status,
+    severity,
+    ipAddress,
+    userAgent,
+    metadata,
+    createdAt: new Date
+  };
+}
+async function writeEntry(ctx, entry, opts, modelName) {
+  const doFullWrite = async () => {
+    let finalEntry = entry;
+    if (opts.beforeLog) {
+      const modified = await opts.beforeLog(finalEntry, ctx);
+      if (modified === null)
+        return;
+      const validated = validateEntry(modified, ctx.context.logger);
+      if (validated === null)
+        return;
+      finalEntry = validated;
+    }
+    let written;
+    try {
+      written = await withRetry(async () => {
+        if (opts.storage) {
+          const result = { id: crypto.randomUUID(), ...finalEntry };
+          await opts.storage.write(result);
+          return result;
+        }
+        const record = await ctx.context.adapter.create({
+          model: modelName,
+          data: {
+            ...finalEntry,
+            metadata: JSON.stringify(finalEntry.metadata)
+          }
+        });
+        return {
+          ...record,
+          metadata: finalEntry.metadata
+        };
+      }, { maxRetries: 2, baseDelayMs: 100 });
+    } catch (err) {
+      ctx.context.logger?.error("[audit-log] storage write failed after retries", err);
+      opts.onWriteError?.(err, finalEntry);
+      throw err;
+    }
+    if (opts.afterLog)
+      await opts.afterLog(written);
+  };
+  if (opts.nonBlocking) {
+    ctx.context.runInBackground(doFullWrite().catch((err) => {
+      ctx.context.logger?.error("[audit-log] background write failed", err);
+      opts.onWriteError?.(err, entry);
+    }));
+  } else {
+    await doFullWrite();
+  }
+}
+
+// src/hooks/before.ts
+function createBeforeHooks(opts, modelName) {
+  return [
+    {
+      matcher: (context) => !!context.path && opts.beforePaths.some((p) => context.path.startsWith(p)) && opts.shouldCapture(context.path),
+      handler: import_api.createAuthMiddleware(async (ctx) => {
+        try {
+          const session = await import_api.getSessionFromCtx(ctx);
+          const path = ctx.path;
+          const pathConfig = opts.getPathConfig(path);
+          const entry = await buildLogEntry(path, "success", {
+            userId: session?.user?.id ?? null,
+            request: ctx.request,
+            headers: ctx.headers,
+            pathConfig,
+            options: opts,
+            authOptions: ctx.context.options,
+            logger: ctx.context.logger
+          });
+          await writeEntry(ctx, entry, opts, modelName);
+        } catch (err) {
+          ctx.context.logger?.error("[audit-log] before hook failed", err);
+        }
+      })
+    }
+  ];
+}
+// src/hooks/after.ts
+var import_api2 = require("better-auth/api");
+function createAfterHooks(opts, modelName) {
+  return [
+    {
+      matcher: (context) => !!context.path && !opts.beforePaths.some((p) => context.path.startsWith(p)) && opts.shouldCapture(context.path),
+      handler: import_api2.createAuthMiddleware(async (ctx) => {
+        try {
+          const path = ctx.path;
+          const isError = ctx.context.returned instanceof Error;
+          const status = isError ? "failed" : "success";
+          const user = ctx.context.newSession?.user ?? ctx.context.session?.user;
+          const pathConfig = opts.getPathConfig(path);
+          const metadata = {};
+          if (opts.capture.requestBody && ctx.body) {
+            metadata.requestBody = ctx.body;
+          }
+          if (isError) {
+            const err = ctx.context.returned;
+            metadata.error = {
+              message: err.message,
+              ...err.status !== undefined && { status: err.status },
+              ...err.code !== undefined && { code: err.code }
+            };
+          }
+          const entry = await buildLogEntry(path, status, {
+            userId: user?.id ?? null,
+            request: ctx.request,
+            headers: ctx.headers,
+            metadata,
+            pathConfig,
+            options: opts,
+            authOptions: ctx.context.options,
+            logger: ctx.context.logger
+          });
+          await writeEntry(ctx, entry, opts, modelName);
+        } catch (err) {
+          ctx.context.logger?.error("[audit-log] after hook failed", err);
+        }
+      })
+    }
+  ];
+}
+// src/endpoints/list-logs.ts
+var import_api3 = require("better-auth/api");
+var import_zod2 = require("zod");
+function createListLogsEndpoint(opts, modelName) {
+  return import_api3.createAuthEndpoint("/audit-log/list", {
+    method: "GET",
+    use: [import_api3.sessionMiddleware],
+    query: import_zod2.z.object({
+      userId: import_zod2.z.string().optional(),
+      action: import_zod2.z.string().optional(),
+      status: import_zod2.z.enum(["success", "failed"]).optional(),
+      from: import_zod2.z.string().optional(),
+      to: import_zod2.z.string().optional(),
+      limit: import_zod2.z.coerce.number().min(1).max(500).optional().default(50),
+      offset: import_zod2.z.coerce.number().min(0).optional().default(0)
+    })
+  }, async (ctx) => {
+    const session = ctx.context.session;
+    const targetUserId = ctx.query.userId ?? session.user.id;
+    if (targetUserId !== session.user.id) {
+      throw new import_api3.APIError("FORBIDDEN", {
+        message: "Cannot query other users' audit logs"
+      });
+    }
+    const fromDate = ctx.query.from ? new Date(ctx.query.from) : undefined;
+    const toDate = ctx.query.to ? new Date(ctx.query.to) : undefined;
+    try {
+      if (opts.storage?.read) {
+        const readOpts = {
+          userId: targetUserId,
+          action: ctx.query.action,
+          status: ctx.query.status,
+          from: fromDate,
+          to: toDate,
+          limit: ctx.query.limit,
+          offset: ctx.query.offset
+        };
+        const result = await opts.storage.read(readOpts);
+        if (result.entries.length > readOpts.limit) {
+          result.entries = result.entries.slice(0, readOpts.limit);
+        }
+        if (opts.piiRedaction.enabled) {
+          for (let i = 0;i < result.entries.length; i++) {
+            result.entries[i] = {
+              ...result.entries[i],
+              metadata: await redactPII(result.entries[i].metadata, opts.piiRedaction)
+            };
+          }
+        }
+        return ctx.json(result);
+      }
+      const where = [{ field: "userId", value: targetUserId }];
+      if (ctx.query.action) {
+        where.push({ field: "action", value: ctx.query.action });
+      }
+      if (ctx.query.status) {
+        where.push({ field: "status", value: ctx.query.status });
+      }
+      if (fromDate) {
+        where.push({ field: "createdAt", operator: "gte", value: fromDate });
+      }
+      if (toDate) {
+        where.push({ field: "createdAt", operator: "lte", value: toDate });
+      }
+      const [entries, total] = await Promise.all([
+        ctx.context.adapter.findMany({
+          model: modelName,
+          where,
+          sortBy: { field: "createdAt", direction: "desc" },
+          limit: ctx.query.limit,
+          offset: ctx.query.offset
+        }),
+        ctx.context.adapter.count({ model: modelName, where })
+      ]);
+      let parsed = entries.map((e) => ({
+        ...e,
+        metadata: parseMetadata(e["metadata"])
+      }));
+      if (opts.piiRedaction.enabled) {
+        parsed = await Promise.all(parsed.map(async (e) => ({
+          ...e,
+          metadata: await redactPII(e.metadata, opts.piiRedaction)
+        })));
+      }
+      return ctx.json({ entries: parsed, total });
+    } catch (err) {
+      if (err instanceof import_api3.APIError)
+        throw err;
+      ctx.context.logger?.error("[audit-log] list failed", err);
+      throw new import_api3.APIError("INTERNAL_SERVER_ERROR", {
+        message: "Failed to retrieve audit logs"
+      });
+    }
+  });
+}
+// src/endpoints/get-log.ts
+var import_api4 = require("better-auth/api");
+function createGetLogEndpoint(opts, modelName) {
+  return import_api4.createAuthEndpoint("/audit-log/:id", { method: "GET", use: [import_api4.sessionMiddleware] }, async (ctx) => {
+    const id = ctx.params?.id;
+    if (!id) {
+      throw new import_api4.APIError("BAD_REQUEST", {
+        message: "Missing audit log entry id"
+      });
+    }
+    const session = ctx.context.session;
+    try {
+      if (opts.storage?.readById) {
+        const entry2 = await opts.storage.readById(id);
+        if (!entry2 || entry2.userId !== session.user.id) {
+          throw new import_api4.APIError("NOT_FOUND", {
+            message: "Audit log entry not found"
+          });
+        }
+        if (opts.piiRedaction.enabled) {
+          entry2.metadata = await redactPII(entry2.metadata, opts.piiRedaction);
+        }
+        return ctx.json(entry2);
+      }
+      const record = await ctx.context.adapter.findOne({
+        model: modelName,
+        where: [
+          { field: "id", value: id },
+          { field: "userId", value: session.user.id }
+        ]
+      });
+      if (!record) {
+        throw new import_api4.APIError("NOT_FOUND", {
+          message: "Audit log entry not found"
+        });
+      }
+      let metadata = parseMetadata(record["metadata"]);
+      if (opts.piiRedaction.enabled) {
+        metadata = await redactPII(metadata, opts.piiRedaction);
+      }
+      const entry = {
+        ...record,
+        metadata
+      };
+      return ctx.json(entry);
+    } catch (err) {
+      if (err instanceof import_api4.APIError)
+        throw err;
+      ctx.context.logger?.error("[audit-log] get failed", err);
+      throw new import_api4.APIError("INTERNAL_SERVER_ERROR", {
+        message: "Failed to retrieve audit log entry"
+      });
+    }
+  });
+}
+// src/endpoints/insert-log.ts
+var import_api5 = require("better-auth/api");
+var import_zod3 = require("zod");
+
+// src/utils/validate-metadata.ts
+var DEFAULT_METADATA_LIMITS = {
+  maxBytes: 64 * 1024,
+  maxDepth: 5
+};
+function measureDepth(value, current = 0) {
+  if (current > 100)
+    return current;
+  if (typeof value !== "object" || value === null)
+    return current;
+  if (Array.isArray(value)) {
+    let max2 = current;
+    for (const item of value) {
+      max2 = Math.max(max2, measureDepth(item, current + 1));
+    }
+    return max2;
+  }
+  let max = current;
+  for (const v of Object.values(value)) {
+    max = Math.max(max, measureDepth(v, current + 1));
+  }
+  return max;
+}
+function validateMetadataSize(metadata, limits = DEFAULT_METADATA_LIMITS) {
+  const depth = measureDepth(metadata);
+  if (depth > limits.maxDepth) {
+    return `Metadata exceeds maximum depth of ${limits.maxDepth}`;
+  }
+  const bytes = new TextEncoder().encode(JSON.stringify(metadata)).byteLength;
+  if (bytes > limits.maxBytes) {
+    return `Metadata exceeds maximum size of ${limits.maxBytes} bytes`;
+  }
+  return null;
+}
+
+// src/endpoints/insert-log.ts
+function createInsertLogEndpoint(opts, modelName) {
+  return import_api5.createAuthEndpoint("/audit-log/insert", {
+    method: "POST",
+    use: [import_api5.sessionMiddleware],
+    body: import_zod3.z.object({
+      action: import_zod3.z.string().min(1),
+      status: import_zod3.z.enum(["success", "failed"]).optional().default("success"),
+      severity: import_zod3.z.enum(["low", "medium", "high", "critical"]).optional(),
+      metadata: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()).optional().default({})
+    })
+  }, async (ctx) => {
+    const session = ctx.context.session;
+    const { action, status, severity, metadata } = ctx.body;
+    if (opts.metadataLimits !== false) {
+      const error = validateMetadataSize(metadata, opts.metadataLimits);
+      if (error) {
+        throw new import_api5.APIError("BAD_REQUEST", { message: error });
+      }
+    }
+    try {
+      const entry = await buildLogEntryFromAction(action, status, {
+        userId: session.user.id,
+        request: ctx.request,
+        headers: ctx.headers,
+        metadata,
+        options: opts,
+        authOptions: ctx.context.options,
+        logger: ctx.context.logger
+      });
+      if (severity) {
+        entry.severity = severity;
+      }
+      await writeEntry(ctx, entry, opts, modelName);
+      return ctx.json({ success: true });
+    } catch (err) {
+      if (err instanceof import_api5.APIError)
+        throw err;
+      ctx.context.logger?.error("[audit-log] insert failed", err);
+      throw new import_api5.APIError("INTERNAL_SERVER_ERROR", {
+        message: "Failed to insert audit log entry"
+      });
+    }
+  });
+}
+// src/plugin.ts
+var DEFAULT_BEFORE_PATHS = [
+  "/sign-out",
+  "/delete-user",
+  "/revoke-session",
+  "/revoke-sessions",
+  "/revoke-other-sessions"
+];
+function validateStorageAdapter(storage) {
+  if (!storage)
+    return;
+  if (typeof storage.write !== "function") {
+    throw new Error("[audit-log] Custom storage adapter must implement write(entry): Promise<void>");
+  }
+  if (storage.read !== undefined && typeof storage.read !== "function") {
+    throw new Error("[audit-log] storage.read must be a function if provided");
+  }
+  if (storage.readById !== undefined && typeof storage.readById !== "function") {
+    throw new Error("[audit-log] storage.readById must be a function if provided");
+  }
+  if (storage.deleteOlderThan !== undefined && typeof storage.deleteOlderThan !== "function") {
+    throw new Error("[audit-log] storage.deleteOlderThan must be a function if provided");
+  }
+}
+function resolveOptions(options) {
+  const pathsMap = new Map;
+  const hasPaths = (options?.paths?.length ?? 0) > 0;
+  for (const p of options?.paths ?? []) {
+    if (typeof p === "string") {
+      pathsMap.set(p, undefined);
+    } else {
+      pathsMap.set(p.path, p.config);
+    }
+  }
+  const metadataLimits = options?.metadataLimits === false ? false : {
+    maxBytes: options?.metadataLimits?.maxBytes ?? DEFAULT_METADATA_LIMITS.maxBytes,
+    maxDepth: options?.metadataLimits?.maxDepth ?? DEFAULT_METADATA_LIMITS.maxDepth
+  };
+  return {
+    enabled: options?.enabled ?? true,
+    nonBlocking: options?.nonBlocking ?? false,
+    storage: options?.storage,
+    capture: {
+      ipAddress: options?.capture?.ipAddress ?? true,
+      userAgent: options?.capture?.userAgent ?? true,
+      requestBody: options?.capture?.requestBody ?? false
+    },
+    piiRedaction: {
+      enabled: options?.piiRedaction?.enabled ?? false,
+      fields: options?.piiRedaction?.fields,
+      strategy: options?.piiRedaction?.strategy ?? "mask"
+    },
+    retention: options?.retention,
+    metadataLimits,
+    beforePaths: options?.beforePaths ?? DEFAULT_BEFORE_PATHS,
+    beforeLog: options?.beforeLog,
+    afterLog: options?.afterLog,
+    onWriteError: options?.onWriteError,
+    shouldCapture: (path) => !hasPaths || pathsMap.has(path),
+    getPathConfig: (path) => pathsMap.get(path)
+  };
+}
+function auditLog(options) {
+  validateStorageAdapter(options?.storage);
+  const schema = buildSchema(options);
+  validateSchema(schema);
+  const modelName = getModelName(options);
+  const resolved = resolveOptions(options);
+  const beforeHooks = resolved.enabled ? createBeforeHooks(resolved, modelName) : [];
+  const afterHooks = resolved.enabled ? createAfterHooks(resolved, modelName) : [];
+  return {
+    id: "audit-log",
+    schema,
+    hooks: {
+      before: beforeHooks,
+      after: afterHooks
+    },
+    endpoints: {
+      listAuditLogs: createListLogsEndpoint(resolved, modelName),
+      getAuditLog: createGetLogEndpoint(resolved, modelName),
+      insertAuditLog: createInsertLogEndpoint(resolved, modelName)
+    },
+    rateLimit: [
+      {
+        pathMatcher: (path) => path.startsWith("/audit-log/"),
+        window: 60,
+        max: 60
+      }
+    ]
+  };
+}
+// src/adapters/memory.ts
+var DEFAULT_MAX_ENTRIES = 1e4;
+
+class MemoryStorage {
+  entries = [];
+  maxEntries;
+  constructor(opts) {
+    this.maxEntries = opts?.maxEntries ?? DEFAULT_MAX_ENTRIES;
+  }
+  async write(entry) {
+    this.entries.push(entry);
+    if (this.entries.length > this.maxEntries) {
+      const excess = this.entries.length - this.maxEntries;
+      this.entries.splice(0, excess);
+    }
+  }
+  async read(opts) {
+    let filtered = this.entries.filter((e) => {
+      if (opts.userId !== undefined && e.userId !== opts.userId)
+        return false;
+      if (opts.action !== undefined && e.action !== opts.action)
+        return false;
+      if (opts.status !== undefined && e.status !== opts.status)
+        return false;
+      if (opts.from !== undefined && e.createdAt < opts.from)
+        return false;
+      if (opts.to !== undefined && e.createdAt > opts.to)
+        return false;
+      return true;
+    });
+    const total = filtered.length;
+    filtered = filtered.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime()).slice(opts.offset, opts.offset + opts.limit);
+    return { entries: filtered, total };
+  }
+  async readById(id) {
+    return this.entries.find((e) => e.id === id) ?? null;
+  }
+  async deleteOlderThan(date) {
+    const before = this.entries.length;
+    const retained = this.entries.filter((e) => e.createdAt >= date);
+    this.entries.length = 0;
+    this.entries.push(...retained);
+    return before - this.entries.length;
+  }
+}