betterstart-cli 0.0.12 → 0.0.14

package/dist/assets/adapters/next/templates/init/lib/actions/media/delete-media-bulk.ts

@@ -1,16 +1,24 @@
 'use server'
 
+import { getAuditRequestMetadata } from '@admin/actions/audit/request-metadata'
+import { requireRole, UserRole } from '@admin/auth/middleware'
 import db from '@admin/db'
 import { adminMedia } from '@admin/db/schema'
+import { runAdminEventHooks } from '@admin/lib/lifecycle-hooks'
 import { inArray } from 'drizzle-orm'
 import { updateTag } from 'next/cache'
 import type { DeleteMediaBulkResult } from './types'
 import { mediaCacheTags } from './types'
 
 export async function deleteMediaBulk(ids: string[]): Promise<DeleteMediaBulkResult> {
+  const actor = await requireRole([UserRole.ADMIN, UserRole.EDITOR])
+
   if (ids.length === 0) return { success: true, deletedCount: 0 }
 
   try {
+    const now = new Date().toISOString()
+    const auditRequestMetadata = await getAuditRequestMetadata()
+    const mediaRows = await db.select().from(adminMedia).where(inArray(adminMedia.id, ids))
     const deletedRows = await db
       .delete(adminMedia)
       .where(inArray(adminMedia.id, ids))
@@ -19,6 +27,21 @@ export async function deleteMediaBulk(ids: string[]): Promise<DeleteMediaBulkRes
     for (const id of ids) {
       updateTag(mediaCacheTags.byId(id))
     }
+    for (const media of mediaRows) {
+      runAdminEventHooks({
+        category: 'media',
+        action: 'delete',
+        targetType: 'media',
+        targetId: media.id,
+        targetLabel: media.filename,
+        user: actor,
+        timestamp: now,
+        sourceType: 'admin_ui' as const,
+        changedFields: [],
+        metadata: { contentType: media.contentType, bulk: true },
+        ...auditRequestMetadata
+      })
+    }
     return { success: true, deletedCount: deletedRows.length }
   } catch (error) {
     return {

package/dist/assets/adapters/next/templates/init/lib/actions/media/delete-media.ts

@@ -1,17 +1,38 @@
 'use server'
 
+import { getAuditRequestMetadata } from '@admin/actions/audit/request-metadata'
+import { requireRole, UserRole } from '@admin/auth/middleware'
 import db from '@admin/db'
 import { adminMedia } from '@admin/db/schema'
+import { runAdminEventHooks } from '@admin/lib/lifecycle-hooks'
 import { eq } from 'drizzle-orm'
 import { updateTag } from 'next/cache'
 import type { DeleteMediaResult } from './types'
 import { mediaCacheTags } from './types'
 
 export async function deleteMedia(id: string): Promise<DeleteMediaResult> {
+  const actor = await requireRole([UserRole.ADMIN, UserRole.EDITOR])
+
   try {
+    const now = new Date().toISOString()
+    const auditRequestMetadata = await getAuditRequestMetadata()
+    const [deletedMedia] = await db.select().from(adminMedia).where(eq(adminMedia.id, id)).limit(1)
     await db.delete(adminMedia).where(eq(adminMedia.id, id))
     updateTag(mediaCacheTags.all)
     updateTag(mediaCacheTags.byId(id))
+    runAdminEventHooks({
+      category: 'media',
+      action: 'delete',
+      targetType: 'media',
+      targetId: id,
+      targetLabel: deletedMedia?.filename ?? id,
+      user: actor,
+      timestamp: now,
+      sourceType: 'admin_ui' as const,
+      changedFields: [],
+      metadata: { contentType: deletedMedia?.contentType ?? null },
+      ...auditRequestMetadata
+    })
     return { success: true }
   } catch (error) {
     return {

package/dist/assets/adapters/next/templates/init/lib/actions/media/update-media.ts

@@ -1,8 +1,11 @@
 'use server'
 
+import { getAuditRequestMetadata } from '@admin/actions/audit/request-metadata'
 import { getSession } from '@admin/auth/middleware'
 import db from '@admin/db'
 import { adminMedia } from '@admin/db/schema'
+import { runAdminEventHooks } from '@admin/lib/lifecycle-hooks'
+import { getChangedFieldNames } from '@admin/utils/audit/audit'
 import { eq } from 'drizzle-orm'
 import { updateTag } from 'next/cache'
 import type { UpdateMediaResult } from './types'
@@ -15,16 +18,35 @@ export async function updateMedia(
   try {
     const session = await getSession()
     const actorId = session?.user?.id ?? null
+    const now = new Date().toISOString()
+    const auditRequestMetadata = await getAuditRequestMetadata()
+    const [previousMedia] = await db.select().from(adminMedia).where(eq(adminMedia.id, id)).limit(1)
     await db
       .update(adminMedia)
       .set({
         ...data,
-        updatedAt: new Date().toISOString(),
+        updatedAt: now,
         updatedBy: actorId
       })
       .where(eq(adminMedia.id, id))
     updateTag(mediaCacheTags.all)
     updateTag(mediaCacheTags.byId(id))
+    runAdminEventHooks({
+      category: 'media',
+      action: 'update',
+      targetType: 'media',
+      targetId: id,
+      targetLabel: previousMedia?.filename ?? id,
+      user: session?.user ?? null,
+      timestamp: now,
+      sourceType: 'admin_ui' as const,
+      changedFields: getChangedFieldNames(
+        previousMedia as unknown as Record<string, unknown>,
+        data as Record<string, unknown>
+      ),
+      metadata: { contentType: previousMedia?.contentType ?? null },
+      ...auditRequestMetadata
+    })
     return { success: true }
   } catch (error) {
     return {

package/dist/assets/adapters/next/templates/init/lib/actions/profile/update-email.ts

@@ -1,9 +1,11 @@
 'use server'
 
+import { getAuditRequestMetadata } from '@admin/actions/audit/request-metadata'
 import { auth } from '@admin/auth'
 import { getSession } from '@admin/auth/middleware'
 import db from '@admin/db'
 import { user } from '@admin/db/schema'
+import { runAdminEventHooks } from '@admin/lib/lifecycle-hooks'
 import { eq } from 'drizzle-orm'
 import { headers } from 'next/headers'
 import { invalidateUsersCache } from './invalidate-users-cache'
@@ -19,6 +21,8 @@ export async function updateEmail(
       return { success: false, error: 'Not authenticated' }
     }
 
+    const now = new Date().toISOString()
+    const auditRequestMetadata = await getAuditRequestMetadata()
     const verification = await auth.api
       .verifyPassword({
         body: { password: currentPassword },
@@ -46,6 +50,19 @@ export async function updateEmail(
       .where(eq(user.id, session.user.id))
 
     await invalidateUsersCache()
+    runAdminEventHooks({
+      category: 'auth',
+      action: 'update',
+      targetType: 'user',
+      targetId: session.user.id,
+      targetLabel: session.user.email,
+      user: session.user,
+      timestamp: now,
+      sourceType: 'admin_ui' as const,
+      changedFields: ['email'],
+      metadata: { operation: 'email_change' },
+      ...auditRequestMetadata
+    })
 
     return { success: true }
   } catch (error) {

package/dist/assets/adapters/next/templates/init/lib/actions/upload/upload-files.ts

@@ -2,6 +2,7 @@
 
 import { createMedia } from '@admin/actions/media'
 import { saveUpload } from '@admin/actions/storage'
+import { requireRole, UserRole } from '@admin/auth/middleware'
 import type { UploadedFile } from '@admin/types'
 import type { FileValidationConfig, UploadResult } from './types'
 
@@ -9,6 +10,8 @@ export async function uploadFiles(
   formData: FormData,
   config: FileValidationConfig = {}
 ): Promise<UploadResult> {
+  await requireRole([UserRole.ADMIN, UserRole.EDITOR])
+
   try {
     const files: File[] = []
     const prefix = formData.get('prefix')?.toString() || 'uploads'

package/dist/assets/adapters/next/templates/init/lib/actions/upload/upload-media-from-url.ts

@@ -2,6 +2,7 @@
 
 import { createMedia } from '@admin/actions/media'
 import { saveUpload } from '@admin/actions/storage'
+import { requireRole, UserRole } from '@admin/auth/middleware'
 import {
   DEFAULT_REMOTE_ACCEPT,
   getRemoteFilename,
@@ -14,6 +15,8 @@ export async function uploadMediaFromUrl(
   mediaUrl: string,
   { prefix = 'media', accept = DEFAULT_REMOTE_ACCEPT, maxSizeInBytes }: RemoteUploadOptions = {}
 ): Promise<UploadResult> {
+  await requireRole([UserRole.ADMIN, UserRole.EDITOR])
+
   try {
     const url = new URL(mediaUrl)
     if (!['http:', 'https:'].includes(url.protocol)) {

package/dist/assets/adapters/next/templates/init/lib/actions/users/create-user.ts

@@ -1,18 +1,23 @@
 'use server'
 
+import { getAuditRequestMetadata } from '@admin/actions/audit/request-metadata'
 import { auth } from '@admin/auth'
 import { requireRole, UserRole } from '@admin/auth/middleware'
 import db from '@admin/db'
 import { user } from '@admin/db/schema'
+import { runAdminEventHooks } from '@admin/lib/lifecycle-hooks'
+import { getTouchedFieldNames } from '@admin/utils/audit/audit'
 import { eq } from 'drizzle-orm'
 import { updateTag } from 'next/cache'
 import type { CreateUserInput, CreateUserResult } from './types'
 import { usersCacheTags } from './types'
 
 export async function createUser(input: CreateUserInput): Promise<CreateUserResult> {
-  await requireRole([UserRole.ADMIN, UserRole.EDITOR])
+  const actor = await requireRole([UserRole.ADMIN, UserRole.EDITOR])
 
   try {
+    const now = new Date().toISOString()
+    const auditRequestMetadata = await getAuditRequestMetadata()
     const result = await auth.api.signUpEmail({
       body: {
         email: input.email,
@@ -33,6 +38,19 @@ export async function createUser(input: CreateUserInput): Promise<CreateUserResu
       })
       .where(eq(user.id, result.user.id))
     updateTag(usersCacheTags.all)
+    runAdminEventHooks({
+      category: 'user',
+      action: 'create',
+      targetType: 'user',
+      targetId: result.user.id,
+      targetLabel: result.user.email,
+      user: actor,
+      timestamp: now,
+      sourceType: 'admin_ui' as const,
+      changedFields: getTouchedFieldNames(input as unknown as Record<string, unknown>),
+      metadata: { role: input.role },
+      ...auditRequestMetadata
+    })
 
     return {
       success: true,

package/dist/assets/adapters/next/templates/init/lib/actions/users/delete-user.ts

@@ -1,19 +1,41 @@
 'use server'
 
+import { getAuditRequestMetadata } from '@admin/actions/audit/request-metadata'
 import { requireRole, UserRole } from '@admin/auth/middleware'
 import db from '@admin/db'
 import { user } from '@admin/db/schema'
+import { runAdminEventHooks } from '@admin/lib/lifecycle-hooks'
 import { eq } from 'drizzle-orm'
 import { updateTag } from 'next/cache'
 import type { DeleteUserResult } from './types'
 import { usersCacheTags } from './types'
 
 export async function deleteUser(userId: string): Promise<DeleteUserResult> {
-  await requireRole([UserRole.ADMIN, UserRole.EDITOR])
+  const actor = await requireRole([UserRole.ADMIN, UserRole.EDITOR])
 
   try {
+    const now = new Date().toISOString()
+    const auditRequestMetadata = await getAuditRequestMetadata()
+    const [deletedUser] = await db
+      .select({ email: user.email, name: user.name, role: user.role })
+      .from(user)
+      .where(eq(user.id, userId))
+      .limit(1)
     await db.delete(user).where(eq(user.id, userId))
     updateTag(usersCacheTags.all)
+    runAdminEventHooks({
+      category: 'user',
+      action: 'delete',
+      targetType: 'user',
+      targetId: userId,
+      targetLabel: deletedUser?.email ?? userId,
+      user: actor,
+      timestamp: now,
+      sourceType: 'admin_ui' as const,
+      changedFields: [],
+      metadata: { role: deletedUser?.role ?? null },
+      ...auditRequestMetadata
+    })
     return { success: true }
   } catch (error) {
     return {

package/dist/assets/adapters/next/templates/init/lib/actions/users/update-user-role.ts

@@ -1,8 +1,10 @@
 'use server'
 
+import { getAuditRequestMetadata } from '@admin/actions/audit/request-metadata'
 import { requireRole, UserRole } from '@admin/auth/middleware'
 import db from '@admin/db'
 import { user } from '@admin/db/schema'
+import { runAdminEventHooks } from '@admin/lib/lifecycle-hooks'
 import { eq } from 'drizzle-orm'
 import { updateTag } from 'next/cache'
 import type { UpdateUserRoleResult } from './types'
@@ -12,11 +14,31 @@ export async function updateUserRole(
   userId: string,
   role: UserRole
 ): Promise<UpdateUserRoleResult> {
-  await requireRole([UserRole.ADMIN, UserRole.EDITOR])
+  const actor = await requireRole([UserRole.ADMIN, UserRole.EDITOR])
 
   try {
+    const now = new Date().toISOString()
+    const auditRequestMetadata = await getAuditRequestMetadata()
+    const [previousUser] = await db
+      .select({ email: user.email, name: user.name, role: user.role })
+      .from(user)
+      .where(eq(user.id, userId))
+      .limit(1)
     await db.update(user).set({ role, updatedAt: new Date() }).where(eq(user.id, userId))
     updateTag(usersCacheTags.all)
+    runAdminEventHooks({
+      category: 'user',
+      action: 'update',
+      targetType: 'user',
+      targetId: userId,
+      targetLabel: previousUser?.email ?? userId,
+      user: actor,
+      timestamp: now,
+      sourceType: 'admin_ui' as const,
+      changedFields: previousUser?.role === role ? [] : ['role'],
+      metadata: { operation: 'role_update' },
+      ...auditRequestMetadata
+    })
 
     return { success: true }
   } catch (error) {

package/dist/assets/adapters/next/templates/init/lib/db/core/schema.ts

@@ -129,6 +129,55 @@ export const entityVersions = pgTable(
   ]
 )
 
+// ============================================================================
+// Audit Log
+// ============================================================================
+
+export const auditLog = pgTable(
+  'AuditLog',
+  {
+    id: uuid().defaultRandom().primaryKey().notNull(),
+    category: varchar('category', { length: 50 }).notNull(),
+    action: varchar('action', { length: 50 }).notNull(),
+    targetType: varchar('target_type', { length: 100 }).notNull(),
+    targetId: text('target_id'),
+    targetLabel: text('target_label'),
+    actorUserId: text('actor_user_id').references(() => user.id, {
+      onDelete: 'set null'
+    }),
+    actorEmail: text('actor_email'),
+    actorName: text('actor_name'),
+    actorRole: text('actor_role'),
+    sourceType: varchar('source_type', { length: 50 }).notNull().default('server_action'),
+    ipAddress: varchar('ip_address', { length: 100 }),
+    userAgent: varchar('user_agent', { length: 500 }),
+    changedFields: text('changed_fields').array().notNull().default(sql`ARRAY[]::text[]`),
+    metadata: jsonb('metadata'),
+    createdAt: timestamp('created_at', { precision: 3, mode: 'string' })
+      .default(sql`CURRENT_TIMESTAMP`)
+      .notNull()
+  },
+  (table) => [
+    index('AuditLog_createdAt_idx').using('btree', table.createdAt.desc().nullsLast()),
+    index('AuditLog_category_action_createdAt_idx').using(
+      'btree',
+      table.category.asc().nullsLast().op('text_ops'),
+      table.action.asc().nullsLast().op('text_ops'),
+      table.createdAt.desc().nullsLast()
+    ),
+    index('AuditLog_target_idx').using(
+      'btree',
+      table.targetType.asc().nullsLast().op('text_ops'),
+      table.targetId.asc().nullsLast().op('text_ops')
+    ),
+    index('AuditLog_actor_createdAt_idx').using(
+      'btree',
+      table.actorUserId.asc().nullsLast().op('text_ops'),
+      table.createdAt.desc().nullsLast()
+    )
+  ]
+)
+
 // ============================================================================
 // Media Library
 // ============================================================================

package/dist/assets/adapters/next/templates/init/lib/lifecycle-hooks/index.ts

@@ -3,11 +3,16 @@ import './register.local'
 
 export {
   getLifecycleHookSummary,
+  getRegisteredAdminHooks,
   getRegisteredHooks,
+  registerAdminHook,
   registerHook
 } from './registry'
-export { runAfterHooks, runBeforeHooks } from './runner'
+export { runAdminEventHooks, runAfterHooks, runBeforeHooks } from './runner'
 export type {
+  AdminEventContext,
+  AdminEventDescriptor,
+  AdminEventHookHandler,
   AfterLifecycleHookEvent,
   AfterLifecycleHookHandler,
   BeforeLifecycleHookEvent,

package/dist/assets/adapters/next/templates/init/lib/lifecycle-hooks/register.ts

@@ -7,3 +7,6 @@
 // registerHook('posts', 'afterCreate', async ({ user, entityId, data }) => {
 //   console.log('Post created', { userId: user.id, entityId, data })
 // })
+import { registerAuditHooks } from '@admin/actions/audit/register'
+
+registerAuditHooks()

package/dist/assets/adapters/next/templates/init/lib/lifecycle-hooks/registry.ts

@@ -1,8 +1,17 @@
-import type { LifecycleHookEvent, LifecycleHookHandler } from './types'
+import type {
+  AdminEventDescriptor,
+  AdminEventHookHandler,
+  LifecycleHookEvent,
+  LifecycleHookHandler
+} from './types'
 
 type HookBuckets = Map<LifecycleHookEvent, LifecycleHookHandler<LifecycleHookEvent>[]>
 
 const lifecycleHooks = new Map<string, HookBuckets>()
+const adminEventHooks: Array<{
+  descriptor: AdminEventDescriptor
+  handler: AdminEventHookHandler
+}> = []
 
 export function registerHook<Event extends LifecycleHookEvent>(
   entityType: string,
@@ -53,3 +62,29 @@ export function getLifecycleHookSummary(): Record<
 
   return summary
 }
+
+export function registerAdminHook(
+  descriptor: AdminEventDescriptor,
+  handler: AdminEventHookHandler
+): () => void {
+  adminEventHooks.push({ descriptor, handler })
+
+  return () => {
+    const index = adminEventHooks.findIndex((entry) => entry.handler === handler)
+    if (index >= 0) {
+      adminEventHooks.splice(index, 1)
+    }
+  }
+}
+
+export function getRegisteredAdminHooks(
+  event: Required<AdminEventDescriptor>
+): AdminEventHookHandler[] {
+  return adminEventHooks
+    .filter(({ descriptor }) => {
+      if (descriptor.category && descriptor.category !== event.category) return false
+      if (descriptor.action && descriptor.action !== event.action) return false
+      return true
+    })
+    .map(({ handler }) => handler)
+}

package/dist/assets/adapters/next/templates/init/lib/lifecycle-hooks/runner.ts

@@ -1,5 +1,6 @@
-import { getRegisteredHooks } from './registry'
+import { getRegisteredAdminHooks, getRegisteredHooks } from './registry'
 import type {
+  AdminEventContext,
   AfterLifecycleHookEvent,
   BeforeLifecycleHookEvent,
   LifecycleHookAbort,
@@ -33,19 +34,123 @@ export async function runBeforeHooks(
   }
 }
 
-export function runAfterHooks(event: AfterLifecycleHookEvent, context: LifecycleHookContext): void {
-  const handlers = getRegisteredHooks(context.entityType, event)
+function getAdminActionFromLifecycleEvent(
+  event: AfterLifecycleHookEvent
+): AdminEventContext['action'] | null {
+  if (event === 'afterCreate') return 'create'
+  if (event === 'afterUpdate') return 'update'
+  if (event === 'afterDelete') return 'delete'
+  if (event === 'afterPublish') return 'publish'
+  if (event === 'afterUnpublish') return 'unpublish'
+  return null
+}
+
+function getTargetLabel(data: Record<string, unknown> | undefined): string | null {
+  if (!data) return null
+
+  for (const fieldName of ['title', 'name', 'label', 'slug', 'email', 'filename']) {
+    const value = data[fieldName]
+    if (typeof value === 'string' && value.trim()) return value
+  }
+
+  return null
+}
+
+function getChangedFieldsFromLifecycleContext(
+  event: AfterLifecycleHookEvent,
+  context: LifecycleHookContext
+): string[] {
+  if (context.changedFields) return context.changedFields
+  if (event === 'afterDelete') return []
+
+  return Object.keys(context.input ?? {})
+    .filter((fieldName) => fieldName !== 'id')
+    .sort((a, b) => a.localeCompare(b))
+}
+
+function toAdminEventContext(
+  event: AfterLifecycleHookEvent,
+  context: LifecycleHookContext
+): AdminEventContext | null {
+  const action = getAdminActionFromLifecycleEvent(event)
+  if (!action) return null
+
+  return {
+    category: context.schemaType === 'form' ? 'form' : 'entity',
+    action,
+    targetType: context.entityType,
+    targetId: context.entityId ?? null,
+    targetLabel: context.targetLabel ?? getTargetLabel(context.data),
+    user: context.user,
+    timestamp: context.timestamp,
+    sourceType: context.sourceType ?? 'admin_ui',
+    ipAddress: context.ipAddress ?? null,
+    userAgent: context.userAgent ?? null,
+    changedFields: getChangedFieldsFromLifecycleContext(event, context),
+    metadata: {
+      entityType: context.entityType,
+      schemaType: context.schemaType ?? 'entity',
+      ...(context.metadata ?? {})
+    }
+  }
+}
+
+function runSettledHook<Context>(
+  handler: (context: Context) => void | Promise<void>,
+  context: Context
+): Promise<void> {
+  try {
+    return Promise.resolve(handler(context))
+  } catch (error) {
+    return Promise.reject(error)
+  }
+}
+
+export function runAdminEventHooks(context: AdminEventContext): void {
+  const handlers = getRegisteredAdminHooks({
+    category: context.category,
+    action: context.action
+  })
   if (handlers.length === 0) return
 
-  void Promise.allSettled(handlers.map((handler) => handler(context))).then((results) => {
-    for (const result of results) {
-      if (result.status === 'rejected') {
-        console.error('Lifecycle hook failed:', {
-          entityType: context.entityType,
-          event,
-          error: result.reason
-        })
+  void Promise.allSettled(handlers.map((handler) => runSettledHook(handler, context))).then(
+    (results) => {
+      for (const result of results) {
+        if (result.status === 'rejected') {
+          console.error('Admin event hook failed:', {
+            category: context.category,
+            action: context.action,
+            targetType: context.targetType,
+            targetId: context.targetId,
+            error: result.reason
+          })
+        }
       }
     }
-  })
+  )
+}
+
+export function runAfterHooks(event: AfterLifecycleHookEvent, context: LifecycleHookContext): void {
+  const handlers = getRegisteredHooks(context.entityType, event)
+
+  if (handlers.length > 0) {
+    void Promise.allSettled(handlers.map((handler) => runSettledHook(handler, context))).then(
+      (results) => {
+        for (const result of results) {
+          if (result.status === 'rejected') {
+            console.error('Lifecycle hook failed:', {
+              entityType: context.entityType,
+              event,
+              error: result.reason
+            })
+          }
+        }
+      }
+    )
+  }
+
+  const adminEvent = toAdminEventContext(event, context)
+  if (adminEvent) {
+    runAdminEventHooks(adminEvent)
+  }
 }

package/dist/assets/adapters/next/templates/init/lib/lifecycle-hooks/types.ts

@@ -1,3 +1,8 @@
+import type {
+  AuditLogAction,
+  AuditLogCategory,
+  AuditLogSourceType
+} from '@admin/actions/audit/types'
 import type { User } from '@admin/auth'
 
 export type LifecycleHookEvent =
@@ -16,12 +21,39 @@ export type BeforeLifecycleHookEvent = Extract<LifecycleHookEvent, `before${stri
 export type AfterLifecycleHookEvent = Extract<LifecycleHookEvent, `after${string}`>
 
 export interface LifecycleHookContext {
-  user: User
+  user: User | null
   entityType: string
+  schemaType?: 'entity' | 'form' | undefined
   timestamp: string
   entityId?: string | undefined
   input?: Record<string, unknown> | undefined
   data?: Record<string, unknown> | undefined
+  changedFields?: string[] | undefined
+  sourceType?: AuditLogSourceType | undefined
+  ipAddress?: string | null | undefined
+  userAgent?: string | null | undefined
+  targetLabel?: string | null | undefined
+  metadata?: Record<string, unknown> | undefined
+}
+
+export interface AdminEventDescriptor {
+  category?: AuditLogCategory
+  action?: AuditLogAction
+}
+
+export interface AdminEventContext {
+  category: AuditLogCategory
+  action: AuditLogAction
+  targetType: string
+  targetId?: string | null | undefined
+  targetLabel?: string | null | undefined
+  user?: User | null | undefined
+  timestamp: string
+  sourceType?: AuditLogSourceType | undefined
+  ipAddress?: string | null | undefined
+  userAgent?: string | null | undefined
+  changedFields?: string[] | undefined
+  metadata?: Record<string, unknown> | undefined
 }
 
 export interface LifecycleHookAbort {
@@ -37,3 +69,5 @@ export type AfterLifecycleHookHandler = (context: LifecycleHookContext) => void
 
 export type LifecycleHookHandler<Event extends LifecycleHookEvent> =
   Event extends BeforeLifecycleHookEvent ? BeforeLifecycleHookHandler : AfterLifecycleHookHandler
+
+export type AdminEventHookHandler = (context: AdminEventContext) => void | Promise<void>