A stored audit record extends AuditEntry with an internally
assigned id (UUID v4) and timestamp (wall-clock epoch ms).
To work around exactOptionalPropertyTypes with inherited optional fields
from AuditEntry, we redeclare resourceId/userId/before/after/
metadata with | undefined so assigning { resourceId: undefined }
compiles cleanly.
id: string
Internally assigned unique identifier (UUID v4).
timestamp: number
Wall-clock epoch milliseconds, assigned by the storage at append.
action: string
The audited action (e.g. 'user.login').
resource: string
The audited resource type (e.g. 'session').
resourceId: string | undefined
The affected resource instance identifier, when known.
userId: string | undefined
The acting principal's identifier, when authenticated.
result: "success" | "failure"
Whether the audited operation succeeded or failed.
before: Readonly<Record<string, unknown>> | undefined
Resource state before the operation, when captured.
after: Readonly<Record<string, unknown>> | undefined
Resource state after the operation, when captured.
metadata: Readonly<Record<string, unknown>> | undefined
Free-form structured context attached by the caller.