betterstart-cli 0.0.12 → 0.0.14

package/dist/assets/adapters/next/templates/init/hooks/content-editor/use-content-editor-slash-menu.ts

@@ -15,12 +15,13 @@ import * as React from 'react'
 
 export function useContentEditorSlashMenu(editorRef: React.RefObject<Editor | null>) {
   const [slashMenu, setSlashMenu] = React.useState<SlashMenuState | null>(null)
+  const [slashSearchQuery, setSlashSearchQuery] = React.useState('')
   const [activeSlashIndexState, setActiveSlashIndexState] = React.useState(0)
   const slashMenuRef = React.useRef<SlashMenuState | null>(null)
   const activeSlashIndexRef = React.useRef(0)
   const filteredSlashCommands = React.useMemo(
-    () => getFilteredSlashCommands(slashMenu?.query ?? ''),
-    [slashMenu]
+    () => getFilteredSlashCommands(slashSearchQuery),
+    [slashSearchQuery]
   )
   const filteredSlashCommandsRef = React.useRef(filteredSlashCommands)
   const activeSlashIndex =
@@ -37,6 +38,23 @@ export function useContentEditorSlashMenu(editorRef: React.RefObject<Editor | nu
       isSameSlashMenuState(current, nextSlashMenu) ? current : nextSlashMenu
     )
 
+    setSlashSearchQuery((current) => {
+      const currentSlashMenu = slashMenuRef.current
+
+      if (!nextSlashMenu) return ''
+
+      if (
+        currentSlashMenu &&
+        currentSlashMenu.from === nextSlashMenu.from &&
+        currentSlashMenu.to === nextSlashMenu.to &&
+        currentSlashMenu.query === nextSlashMenu.query
+      ) {
+        return current
+      }
+
+      return nextSlashMenu.query
+    })
+
     setActiveSlashIndexState((current) =>
       slashMenuRef.current?.query === nextSlashMenu?.query && nextSlashMenu ? current : 0
     )
@@ -44,6 +62,12 @@ export function useContentEditorSlashMenu(editorRef: React.RefObject<Editor | nu
 
   const closeSlashMenu = React.useCallback(() => {
     setSlashMenu(null)
+    setSlashSearchQuery('')
+    setActiveSlashIndexState(0)
+  }, [])
+
+  const setSlashSearch = React.useCallback((query: string) => {
+    setSlashSearchQuery(query)
     setActiveSlashIndexState(0)
   }, [])
 
@@ -110,7 +134,9 @@ export function useContentEditorSlashMenu(editorRef: React.RefObject<Editor | nu
     handleSlashKeyDown,
     selectSlashCommand,
     setActiveSlashIndex: setActiveSlashIndexState,
+    setSlashSearch,
     slashMenu,
+    slashSearchQuery,
     updateSlashMenu
   }
 }

package/dist/assets/adapters/next/templates/init/hooks/content-editor/use-content-editor.ts

@@ -66,6 +66,7 @@ export function useContentEditor({
   const isInternalChange = React.useRef(false)
   const isSyncingRichContent = React.useRef(false)
   const editorRef = React.useRef<Editor | null>(null)
+  const isSlashMenuOpenRef = React.useRef(false)
   const {
     activeSlashIndex,
     closeSlashMenu,
@@ -73,10 +74,14 @@ export function useContentEditor({
     handleSlashKeyDown,
     selectSlashCommand,
     setActiveSlashIndex,
+    setSlashSearch,
     slashMenu,
+    slashSearchQuery,
     updateSlashMenu
   } = useContentEditorSlashMenu(editorRef)
 
+  isSlashMenuOpenRef.current = slashMenu !== null
+
   if (value !== lastValuePropRef.current) {
     lastValuePropRef.current = value
     latestMarkdownRef.current = value
@@ -158,7 +163,20 @@ export function useContentEditor({
       updateSlashMenu(nextEditor)
     },
     onSelectionUpdate: ({ editor: nextEditor }) => updateSlashMenu(nextEditor),
-    onBlur: closeSlashMenu
+    onBlur: ({ event }) => {
+      const nextFocusTarget = event.relatedTarget
+
+      if (isSlashMenuOpenRef.current && !nextFocusTarget) return
+
+      if (
+        nextFocusTarget instanceof Element &&
+        nextFocusTarget.closest('[data-content-editor-slash-menu]')
+      ) {
+        return
+      }
+
+      closeSlashMenu()
+    }
   })
 
   editorRef.current = editor
@@ -278,9 +296,12 @@ export function useContentEditor({
     handleSourceChange,
     handleSourceSelectionChange,
     mode,
+    closeSlashMenu,
     selectSlashCommand,
     setActiveSlashIndex,
+    setSlashSearch,
     slashMenu,
+    slashSearchQuery,
     sourceValue: latestMarkdownRef.current,
     sourceSelectionRequest,
     syncRichContent

package/dist/assets/adapters/next/templates/init/hooks/content-editor/use-table-button.ts

@@ -0,0 +1,85 @@
+'use client'
+
+import { normalizeCount } from '@admin/utils/editor/table-input'
+import { insertContentEditorTable } from '@admin/utils/editor/tiptap'
+import type { Editor } from '@tiptap/core'
+import * as React from 'react'
+
+const DEFAULT_TABLE_ROWS = 3
+const DEFAULT_TABLE_COLS = 3
+const MIN_TABLE_ROWS = 2
+const MIN_TABLE_COLS = 1
+
+interface UseTableButtonOptions {
+  disabled?: boolean
+  editor?: Editor | null
+  onInsertTable?: (size: { cols: number; rows: number }) => void
+}
+
+export function useTableButton({ disabled, editor, onInsertTable }: UseTableButtonOptions) {
+  const [isOpen, setIsOpen] = React.useState(false)
+  const [rows, setRows] = React.useState(String(DEFAULT_TABLE_ROWS))
+  const [cols, setCols] = React.useState(String(DEFAULT_TABLE_COLS))
+  const rowsId = React.useId()
+  const colsId = React.useId()
+  const canInsert = Boolean(onInsertTable || editor?.isEditable)
+  const isDisabled = disabled || !canInsert
+
+  const closePopover = React.useCallback(() => {
+    setIsOpen(false)
+    window.setTimeout(() => setIsOpen(false), 0)
+  }, [])
+
+  const insertTable = React.useCallback(() => {
+    if (isDisabled) return
+
+    const rowCount = normalizeCount(rows, DEFAULT_TABLE_ROWS, MIN_TABLE_ROWS)
+    const colCount = normalizeCount(cols, DEFAULT_TABLE_COLS, MIN_TABLE_COLS)
+
+    if (onInsertTable) {
+      onInsertTable({ cols: colCount, rows: rowCount })
+      closePopover()
+      return
+    }
+
+    if (!editor) return
+
+    insertContentEditorTable(editor, rowCount, colCount)
+    closePopover()
+  }, [closePopover, cols, editor, isDisabled, onInsertTable, rows])
+
+  const handleKeyDown = React.useCallback(
+    (event: React.KeyboardEvent<HTMLDivElement>) => {
+      if (event.key !== 'Enter') return
+
+      event.preventDefault()
+      event.stopPropagation()
+      insertTable()
+    },
+    [insertTable]
+  )
+
+  const handleRowsChange = React.useCallback((event: React.ChangeEvent<HTMLInputElement>) => {
+    setRows(event.target.value)
+  }, [])
+
+  const handleColsChange = React.useCallback((event: React.ChangeEvent<HTMLInputElement>) => {
+    setCols(event.target.value)
+  }, [])
+
+  return {
+    cols,
+    colsId,
+    handleColsChange,
+    handleKeyDown,
+    handleRowsChange,
+    insertTable,
+    isDisabled,
+    isOpen,
+    minCols: MIN_TABLE_COLS,
+    minRows: MIN_TABLE_ROWS,
+    rows,
+    rowsId,
+    setIsOpen
+  }
+}

package/dist/assets/adapters/next/templates/init/hooks/use-audit-log.ts

@@ -0,0 +1,23 @@
+'use client'
+
+import type { AuditLogPage, AuditLogQuery, CleanupAuditLogsResult } from '@admin/actions/audit'
+import { cleanupAuditLogs, getAuditLogs } from '@admin/actions/audit'
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+
+export function useAuditLogs(query: AuditLogQuery) {
+  return useQuery<AuditLogPage>({
+    queryKey: ['audit-log', query],
+    queryFn: () => getAuditLogs(query)
+  })
+}
+
+export function useCleanupAuditLogs() {
+  const queryClient = useQueryClient()
+
+  return useMutation<CleanupAuditLogsResult>({
+    mutationFn: () => cleanupAuditLogs(),
+    onSuccess: () => {
+      void queryClient.invalidateQueries({ queryKey: ['audit-log'] })
+    }
+  })
+}

package/dist/assets/adapters/next/templates/init/lib/actions/audit/cleanup-audit-logs.ts

@@ -0,0 +1,63 @@
+'use server'
+
+import { getSetting } from '@admin/actions/settings'
+import { requireRole, UserRole } from '@admin/auth/middleware'
+import db from '@admin/db'
+import { auditLog } from '@admin/db/schema'
+import { runAdminEventHooks } from '@admin/lib/lifecycle-hooks'
+import { lt } from 'drizzle-orm'
+import { getAuditRequestMetadata } from './request-metadata'
+import type { CleanupAuditLogsResult } from './types'
+
+const MS_PER_DAY = 24 * 60 * 60 * 1000
+
+function getRetentionDays(value: unknown): number | null {
+  if (typeof value !== 'number' || !Number.isFinite(value)) return null
+  const days = Math.floor(value)
+  return days > 0 ? days : null
+}
+
+export async function cleanupAuditLogs(): Promise<CleanupAuditLogsResult> {
+  const actor = await requireRole([UserRole.ADMIN])
+
+  try {
+    const settings = await getSetting()
+    const retentionEnabled = settings?.auditRetentionEnabled === true
+    const retentionDays = getRetentionDays(settings?.auditRetentionDays)
+
+    if (!retentionEnabled || !retentionDays) {
+      return { success: true, deletedCount: 0, skipped: true }
+    }
+
+    const cutoff = new Date(Date.now() - retentionDays * MS_PER_DAY).toISOString()
+    const deletedRows = await db
+      .delete(auditLog)
+      .where(lt(auditLog.createdAt, cutoff))
+      .returning({ id: auditLog.id })
+
+    const requestMetadata = await getAuditRequestMetadata()
+    await runAdminEventHooks({
+      category: 'system',
+      action: 'cleanup',
+      targetType: 'audit-log',
+      targetLabel: 'Audit log retention cleanup',
+      user: actor,
+      timestamp: new Date().toISOString(),
+      sourceType: 'system_job',
+      changedFields: [],
+      metadata: {
+        cutoff,
+        deletedCount: deletedRows.length,
+        retentionDays
+      },
+      ...requestMetadata
+    })
+
+    return { success: true, deletedCount: deletedRows.length, cutoff }
+  } catch (error) {
+    return {
+      success: false,
+      error: error instanceof Error ? error.message : 'Failed to clean up audit logs'
+    }
+  }
+}

package/dist/assets/adapters/next/templates/init/lib/actions/audit/get-audit-logs.ts

@@ -0,0 +1,122 @@
+'use server'
+
+import { requireRole, UserRole } from '@admin/auth/middleware'
+import db from '@admin/db'
+import { auditLog } from '@admin/db/schema'
+import { and, asc, desc, eq, gte, ilike, lt, or, sql } from 'drizzle-orm'
+import type { AuditLogEntry, AuditLogPage, AuditLogQuery } from './types'
+
+const DEFAULT_AUDIT_LOG_PAGE = 0
+const DEFAULT_AUDIT_LOG_PAGE_SIZE = 20
+const MAX_AUDIT_LOG_PAGE_SIZE = 100
+
+function clampPage(value: number | undefined): number {
+  if (typeof value !== 'number' || !Number.isFinite(value)) return DEFAULT_AUDIT_LOG_PAGE
+  return Math.max(0, Math.floor(value))
+}
+
+function normalizePageSize(value: number | undefined): number | null {
+  if (value === -1) return null
+
+  if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0) {
+    return DEFAULT_AUDIT_LOG_PAGE_SIZE
+  }
+
+  return Math.min(MAX_AUDIT_LOG_PAGE_SIZE, Math.max(1, Math.floor(value)))
+}
+
+function getAuditLogOrderBy(query: AuditLogQuery) {
+  const sortFn = query.dir === 'asc' ? asc : desc
+
+  switch (query.sort) {
+    case 'event':
+      return [sortFn(auditLog.category), sortFn(auditLog.action), desc(auditLog.createdAt)]
+    case 'target':
+      return [
+        sortFn(auditLog.targetType),
+        sortFn(auditLog.targetLabel),
+        sortFn(auditLog.targetId),
+        desc(auditLog.createdAt)
+      ]
+    case 'actor':
+      return [sortFn(auditLog.actorEmail), sortFn(auditLog.actorName), desc(auditLog.createdAt)]
+    case 'sourceType':
+      return [sortFn(auditLog.sourceType), desc(auditLog.createdAt)]
+    default:
+      return [sortFn(auditLog.createdAt)]
+  }
+}
+
+function getExclusiveDateUpperBound(value: string | undefined): string | null {
+  if (!value) return null
+  const date = new Date(value)
+  if (Number.isNaN(date.getTime())) return null
+
+  date.setUTCDate(date.getUTCDate() + 1)
+  return date.toISOString()
+}
+
+async function queryAuditLogs(query: AuditLogQuery = {}): Promise<AuditLogPage> {
+  const page = clampPage(query.page)
+  const pageSize = normalizePageSize(query.pageSize)
+  const offset = pageSize ? page * pageSize : 0
+  const conditions = []
+
+  if (query.category) conditions.push(eq(auditLog.category, query.category))
+  if (query.action) conditions.push(eq(auditLog.action, query.action))
+  if (query.targetType) conditions.push(ilike(auditLog.targetType, `%${query.targetType}%`))
+  if (query.actor) {
+    const actorPattern = `%${query.actor}%`
+    conditions.push(
+      or(ilike(auditLog.actorEmail, actorPattern), ilike(auditLog.actorName, actorPattern))
+    )
+  }
+  if (query.createdAtFrom) {
+    conditions.push(gte(auditLog.createdAt, query.createdAtFrom))
+  }
+  const createdAtExclusiveTo = getExclusiveDateUpperBound(query.createdAtTo)
+  if (createdAtExclusiveTo) {
+    conditions.push(lt(auditLog.createdAt, createdAtExclusiveTo))
+  }
+  if (query.search) {
+    const searchPattern = `%${query.search}%`
+    conditions.push(
+      or(
+        ilike(auditLog.targetId, searchPattern),
+        ilike(auditLog.targetLabel, searchPattern),
+        ilike(auditLog.actorEmail, searchPattern),
+        ilike(auditLog.actorName, searchPattern),
+        ilike(auditLog.sourceType, searchPattern),
+        ilike(auditLog.ipAddress, searchPattern),
+        ilike(auditLog.userAgent, searchPattern)
+      )
+    )
+  }
+
+  const where = conditions.length > 0 ? and(...conditions) : undefined
+  const orderBy = getAuditLogOrderBy(query)
+  const orderedQuery = db
+    .select()
+    .from(auditLog)
+    .where(where)
+    .orderBy(...orderBy)
+  const [rows, countResult] = await Promise.all([
+    pageSize ? orderedQuery.limit(pageSize).offset(offset) : orderedQuery,
+    db.select({ count: sql<number>`count(*)` }).from(auditLog).where(where)
+  ])
+  const total = Number(countResult[0]?.count ?? 0)
+  const resolvedPageSize = pageSize ?? total
+
+  return {
+    auditLogs: rows as AuditLogEntry[],
+    total,
+    page,
+    pageSize: resolvedPageSize,
+    totalPages: pageSize ? Math.max(1, Math.ceil(total / pageSize)) : 1
+  }
+}
+
+export async function getAuditLogs(query: AuditLogQuery = {}): Promise<AuditLogPage> {
+  await requireRole([UserRole.ADMIN])
+  return queryAuditLogs(query)
+}

package/dist/assets/adapters/next/templates/init/lib/actions/audit/index.ts

@@ -0,0 +1,19 @@
+export { cleanupAuditLogs } from './cleanup-audit-logs'
+export { getAuditLogs } from './get-audit-logs'
+export type {
+  AuditLogAction,
+  AuditLogCategory,
+  AuditLogEntry,
+  AuditLogPage,
+  AuditLogQuery,
+  AuditLogSortDirection,
+  AuditLogSortField,
+  AuditLogSourceType,
+  CleanupAuditLogsResult
+} from './types'
+export {
+  AUDIT_LOG_ACTIONS,
+  AUDIT_LOG_CATEGORIES,
+  AUDIT_LOG_SOURCE_TYPES,
+  auditLogCacheTags
+} from './types'

package/dist/assets/adapters/next/templates/init/lib/actions/audit/record-audit-event.ts

@@ -0,0 +1,37 @@
+import db from '@admin/db'
+import { auditLog } from '@admin/db/schema'
+import type { AdminEventContext } from '@admin/lib/lifecycle-hooks/types'
+
+const MAX_TARGET_TYPE_LENGTH = 100
+const MAX_SOURCE_TYPE_LENGTH = 50
+const MAX_IP_LENGTH = 100
+const MAX_USER_AGENT_LENGTH = 500
+
+function truncate(value: string | null | undefined, maxLength: number): string | null {
+  if (!value) return null
+  return value.length > maxLength ? value.slice(0, maxLength) : value
+}
+
+function normalizeChangedFields(value: readonly string[] | undefined): string[] {
+  return [...new Set(value ?? [])].filter(Boolean).sort((a, b) => a.localeCompare(b))
+}
+
+export async function recordAuditEvent(event: AdminEventContext): Promise<void> {
+  await db.insert(auditLog).values({
+    category: event.category,
+    action: event.action,
+    targetType: truncate(event.targetType, MAX_TARGET_TYPE_LENGTH) ?? 'unknown',
+    targetId: event.targetId ?? null,
+    targetLabel: event.targetLabel ?? null,
+    actorUserId: event.user?.id ?? null,
+    actorEmail: event.user?.email ?? null,
+    actorName: event.user?.name ?? null,
+    actorRole: typeof event.user?.role === 'string' ? event.user.role : null,
+    sourceType: truncate(event.sourceType, MAX_SOURCE_TYPE_LENGTH) ?? 'server_action',
+    ipAddress: truncate(event.ipAddress, MAX_IP_LENGTH),
+    userAgent: truncate(event.userAgent, MAX_USER_AGENT_LENGTH),
+    changedFields: normalizeChangedFields(event.changedFields),
+    metadata: event.metadata ?? null,
+    createdAt: event.timestamp
+  })
+}

package/dist/assets/adapters/next/templates/init/lib/actions/audit/register.ts

@@ -0,0 +1,13 @@
+import { registerAdminHook } from '@admin/lib/lifecycle-hooks/registry'
+import { recordAuditEvent } from './record-audit-event'
+
+let auditHooksRegistered = false
+
+export function registerAuditHooks(): void {
+  if (auditHooksRegistered) return
+  auditHooksRegistered = true
+
+  registerAdminHook({}, async (event) => {
+    await recordAuditEvent(event)
+  })
+}

package/dist/assets/adapters/next/templates/init/lib/actions/audit/request-metadata.ts

@@ -0,0 +1,37 @@
+import { headers } from 'next/headers'
+
+const MAX_IP_LENGTH = 100
+const MAX_USER_AGENT_LENGTH = 500
+
+function truncate(value: string | null, maxLength: number): string | null {
+  if (!value) return null
+  return value.length > maxLength ? value.slice(0, maxLength) : value
+}
+
+function firstHeaderValue(value: string | null): string | null {
+  return value?.split(',')[0]?.trim() || null
+}
+
+export async function getAuditRequestMetadata(): Promise<{
+  ipAddress: string | null
+  userAgent: string | null
+}> {
+  try {
+    const requestHeaders = await headers()
+    const ipAddress =
+      firstHeaderValue(requestHeaders.get('x-forwarded-for')) ??
+      firstHeaderValue(requestHeaders.get('x-real-ip')) ??
+      firstHeaderValue(requestHeaders.get('cf-connecting-ip'))
+    const userAgent = requestHeaders.get('user-agent')?.trim() || null
+
+    return {
+      ipAddress: truncate(ipAddress, MAX_IP_LENGTH),
+      userAgent: truncate(userAgent, MAX_USER_AGENT_LENGTH)
+    }
+  } catch {
+    return {
+      ipAddress: null,
+      userAgent: null
+    }
+  }
+}

package/dist/assets/adapters/next/templates/init/lib/actions/audit/types.ts

@@ -0,0 +1,77 @@
+export const AUDIT_LOG_CATEGORIES = [
+  'entity',
+  'form',
+  'settings',
+  'user',
+  'auth',
+  'media',
+  'system'
+] as const
+export const AUDIT_LOG_ACTIONS = [
+  'create',
+  'update',
+  'delete',
+  'publish',
+  'unpublish',
+  'cleanup'
+] as const
+export const AUDIT_LOG_SOURCE_TYPES = ['admin_ui', 'server_action', 'system_job'] as const
+
+export type AuditLogCategory = (typeof AUDIT_LOG_CATEGORIES)[number]
+export type AuditLogAction = (typeof AUDIT_LOG_ACTIONS)[number]
+export type AuditLogSourceType = (typeof AUDIT_LOG_SOURCE_TYPES)[number]
+export type AuditLogSortField = 'createdAt' | 'event' | 'target' | 'actor' | 'sourceType'
+export type AuditLogSortDirection = 'asc' | 'desc'
+
+export interface AuditLogEntry {
+  id: string
+  category: AuditLogCategory
+  action: AuditLogAction
+  targetType: string
+  targetId: string | null
+  targetLabel: string | null
+  actorUserId: string | null
+  actorEmail: string | null
+  actorName: string | null
+  actorRole: string | null
+  sourceType: AuditLogSourceType
+  ipAddress: string | null
+  userAgent: string | null
+  changedFields: string[]
+  metadata: Record<string, unknown> | null
+  createdAt: string
+}
+
+export interface AuditLogQuery {
+  search?: string
+  category?: AuditLogCategory
+  action?: AuditLogAction
+  targetType?: string
+  actor?: string
+  createdAtFrom?: string
+  createdAtTo?: string
+  page?: number
+  pageSize?: number
+  sort?: AuditLogSortField
+  dir?: AuditLogSortDirection
+}
+
+export interface AuditLogPage {
+  auditLogs: AuditLogEntry[]
+  total: number
+  page: number
+  pageSize: number
+  totalPages: number
+}
+
+export interface CleanupAuditLogsResult {
+  success: boolean
+  error?: string
+  deletedCount?: number
+  cutoff?: string
+  skipped?: boolean
+}
+
+export const auditLogCacheTags = {
+  all: 'audit-log:all'
+} as const

package/dist/assets/adapters/next/templates/init/lib/actions/forms/upsert-form-settings.ts

@@ -1,5 +1,6 @@
 'use server'
 
+import { requireRole, UserRole } from '@admin/auth/middleware'
 import db from '@admin/db'
 import { formSettings } from '@admin/db/schema'
 import { updateTag } from 'next/cache'
@@ -10,6 +11,8 @@ export async function upsertFormSettings(
   formName: string,
   data: UpsertFormSettingsInput
 ): Promise<FormSettingsResult> {
+  await requireRole([UserRole.ADMIN, UserRole.EDITOR])
+
   try {
     const [settings] = await db
       .insert(formSettings)

package/dist/assets/adapters/next/templates/init/lib/actions/media/create-media.ts

@@ -1,8 +1,11 @@
 'use server'
 
+import { getAuditRequestMetadata } from '@admin/actions/audit/request-metadata'
 import { getSession } from '@admin/auth/middleware'
 import db from '@admin/db'
 import { adminMedia } from '@admin/db/schema'
+import { runAdminEventHooks } from '@admin/lib/lifecycle-hooks'
+import { getTouchedFieldNames } from '@admin/utils/audit/audit'
 import { updateTag } from 'next/cache'
 import { getMediaById } from './get-media-by-id'
 import { type CreateMediaInput, type CreateMediaResult, mediaCacheTags } from './types'
@@ -12,6 +15,7 @@ export async function createMedia(data: CreateMediaInput): Promise<CreateMediaRe
     const session = await getSession()
     const actorId = session?.user?.id ?? null
     const now = new Date().toISOString()
+    const auditRequestMetadata = await getAuditRequestMetadata()
     const [row] = await db
       .insert(adminMedia)
       .values({
@@ -27,6 +31,21 @@ export async function createMedia(data: CreateMediaInput): Promise<CreateMediaRe
       updateTag(mediaCacheTags.byId(row.id))
     }
     const media = row ? await getMediaById(row.id) : null
+    if (media) {
+      runAdminEventHooks({
+        category: 'media',
+        action: 'create',
+        targetType: 'media',
+        targetId: media.id,
+        targetLabel: media.filename,
+        user: session?.user ?? null,
+        timestamp: now,
+        sourceType: 'admin_ui' as const,
+        changedFields: getTouchedFieldNames(data as unknown as Record<string, unknown>),
+        metadata: { contentType: media.contentType, size: media.size },
+        ...auditRequestMetadata
+      })
+    }
     return media
       ? { success: true, media }
       : { success: false, error: 'Failed to create media record' }