@absolutejs/auth 0.30.0-beta.1 → 0.30.0-beta.2

package/dist/plugins/denyDisposableEmail.d.ts

@@ -0,0 +1,7 @@
+export type DenyDisposableEmailDecision = {
+    allow: false;
+    reason: string;
+} | {
+    allow: true;
+};
+export declare const denyDisposableEmailPlugin: (email: string) => Promise<DenyDisposableEmailDecision>;

package/dist/plugins/discordAlert.d.ts

@@ -0,0 +1,7 @@
+import type { AuditEvent, AuditEventType, AuditSink } from '../audit/types';
+export type DiscordAlertOptions = {
+    events?: readonly AuditEventType[];
+    formatContent?: (event: AuditEvent) => string;
+    webhookUrl: string;
+};
+export declare const discordAlertPlugin: ({ events, formatContent, webhookUrl }: DiscordAlertOptions) => AuditSink;

package/dist/plugins/geoBlock.d.ts

@@ -0,0 +1,8 @@
+export type GeoBlockOptions = {
+    allowCountries: readonly string[];
+    denyCountries?: never;
+} | {
+    allowCountries?: never;
+    denyCountries: readonly string[];
+};
+export declare const geoBlockPlugin: (options: GeoBlockOptions) => (headers: Record<string, string | undefined>) => boolean;

package/dist/plugins/index.d.ts

@@ -0,0 +1,12 @@
+export { denyDisposableEmailPlugin } from './denyDisposableEmail';
+export type { DenyDisposableEmailDecision } from './denyDisposableEmail';
+export { discordAlertPlugin } from './discordAlert';
+export type { DiscordAlertOptions } from './discordAlert';
+export { geoBlockPlugin } from './geoBlock';
+export type { GeoBlockOptions } from './geoBlock';
+export { pagerdutyAlertPlugin } from './pagerdutyAlert';
+export type { PagerDutyAlertOptions, PagerDutySeverity } from './pagerdutyAlert';
+export { posthogIdentifyPlugin } from './posthogIdentify';
+export type { PosthogIdentifyOptions } from './posthogIdentify';
+export { slackAlertPlugin } from './slackAlert';
+export type { SlackAlertOptions } from './slackAlert';

package/dist/plugins/index.js

@@ -0,0 +1,183 @@
+// @bun
+// src/credentials/emailValidation.ts
+import { resolveMx } from "dns/promises";
+var EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
+var DISPOSABLE_DOMAINS = new Set([
+  "10minutemail.com",
+  "fakeinbox.com",
+  "getnada.com",
+  "guerrillamail.com",
+  "mailinator.com",
+  "maildrop.cc",
+  "sharklasers.com",
+  "temp-mail.org",
+  "tempmail.com",
+  "throwaway.email",
+  "trashmail.com",
+  "yopmail.com"
+]);
+var domainOf = (email) => email.slice(email.lastIndexOf("@") + 1).toLowerCase();
+var hasMxRecord = async (domain) => {
+  try {
+    return (await resolveMx(domain)).length > 0;
+  } catch {
+    return false;
+  }
+};
+var isDisposableEmail = (email, extraDomains) => {
+  const domain = domainOf(email);
+  return DISPOSABLE_DOMAINS.has(domain) || extraDomains !== undefined && new Set(extraDomains).has(domain);
+};
+var validateEmailDeliverability = async (email, options) => {
+  const normalized = email.trim().toLowerCase();
+  if (!EMAIL_PATTERN.test(normalized)) {
+    return { ok: false, reason: "invalid_format" };
+  }
+  if (isDisposableEmail(normalized, options?.disposableDomains)) {
+    return { ok: false, reason: "disposable" };
+  }
+  if (options?.checkMx === true && !await hasMxRecord(domainOf(normalized))) {
+    return { ok: false, reason: "no_mx" };
+  }
+  return { ok: true };
+};
+
+// src/plugins/denyDisposableEmail.ts
+var denyDisposableEmailPlugin = async (email) => {
+  const trimmed = email.trim().toLowerCase();
+  if (await isDisposableEmail(trimmed)) {
+    return { allow: false, reason: "disposable_email" };
+  }
+  return { allow: true };
+};
+// src/plugins/discordAlert.ts
+var defaultContent = (event) => {
+  const when = new Date(event.at).toISOString();
+  const who = event.userId ?? event.ip ?? "unknown";
+  return `\uD83D\uDD10 **${event.type}** \u2014 ${who} at ${when}`;
+};
+var discordAlertPlugin = ({
+  events,
+  formatContent = defaultContent,
+  webhookUrl
+}) => ({
+  append: async (event) => {
+    if (events !== undefined && !events.includes(event.type))
+      return;
+    await fetch(webhookUrl, {
+      body: JSON.stringify({ content: formatContent(event) }),
+      headers: { "content-type": "application/json" },
+      method: "POST"
+    }).catch(() => {
+      return;
+    });
+  }
+});
+// src/plugins/geoBlock.ts
+var readCountry = (headers) => headers["x-client-country"]?.toUpperCase() ?? headers["cf-ipcountry"]?.toUpperCase();
+var geoBlockPlugin = (options) => {
+  const allow = options.allowCountries === undefined ? undefined : new Set(options.allowCountries.map((country) => country.toUpperCase()));
+  const deny = options.denyCountries === undefined ? undefined : new Set(options.denyCountries.map((country) => country.toUpperCase()));
+  return (headers) => {
+    const country = readCountry(headers);
+    if (country === undefined)
+      return false;
+    if (deny !== undefined)
+      return deny.has(country);
+    if (allow !== undefined)
+      return !allow.has(country);
+    return false;
+  };
+};
+// src/plugins/pagerdutyAlert.ts
+var PAGERDUTY_EVENTS_URL = "https://events.pagerduty.com/v2/enqueue";
+var pagerdutyAlertPlugin = ({
+  events,
+  routingKey,
+  severity = "warning",
+  source = "absolutejs-auth"
+}) => ({
+  append: async (event) => {
+    if (events !== undefined && !events.includes(event.type))
+      return;
+    await fetch(PAGERDUTY_EVENTS_URL, {
+      body: JSON.stringify({
+        event_action: "trigger",
+        payload: {
+          custom_details: event.metadata ?? {},
+          severity,
+          source,
+          summary: `auth event: ${event.type} (user=${event.userId ?? "unknown"})`,
+          timestamp: new Date(event.at).toISOString()
+        },
+        routing_key: routingKey
+      }),
+      headers: { "content-type": "application/json" },
+      method: "POST"
+    }).catch(() => {
+      return;
+    });
+  }
+});
+// src/plugins/posthogIdentify.ts
+var DEFAULT_HOST = "https://us.i.posthog.com";
+var posthogIdentifyPlugin = ({
+  host = DEFAULT_HOST,
+  projectApiKey,
+  properties = (event) => ({ ...event.metadata ?? {} })
+}) => ({
+  append: async (event) => {
+    if (event.userId === undefined)
+      return;
+    await fetch(`${host}/capture/`, {
+      body: JSON.stringify({
+        api_key: projectApiKey,
+        distinct_id: event.userId,
+        event: "$identify",
+        properties: {
+          $set: properties(event),
+          $set_once: { first_seen_event: event.type }
+        },
+        timestamp: new Date(event.at).toISOString()
+      }),
+      headers: { "content-type": "application/json" },
+      method: "POST"
+    }).catch(() => {
+      return;
+    });
+  }
+});
+// src/plugins/slackAlert.ts
+var defaultFormat = (event) => {
+  const when = new Date(event.at).toISOString();
+  const who = event.userId ?? event.ip ?? "unknown";
+  return `\uD83D\uDD10 *${event.type}* \u2014 ${who} at ${when}`;
+};
+var slackAlertPlugin = ({
+  events,
+  formatMessage = defaultFormat,
+  webhookUrl
+}) => ({
+  append: async (event) => {
+    if (events !== undefined && !events.includes(event.type))
+      return;
+    await fetch(webhookUrl, {
+      body: JSON.stringify({ text: formatMessage(event) }),
+      headers: { "content-type": "application/json" },
+      method: "POST"
+    }).catch(() => {
+      return;
+    });
+  }
+});
+export {
+  slackAlertPlugin,
+  posthogIdentifyPlugin,
+  pagerdutyAlertPlugin,
+  geoBlockPlugin,
+  discordAlertPlugin,
+  denyDisposableEmailPlugin
+};
+
+//# debugId=671489C19A19639D64756E2164756E21
+//# sourceMappingURL=index.js.map

package/dist/plugins/index.js.map

@@ -0,0 +1,16 @@
+{
+  "version": 3,
+  "sources": ["../src/credentials/emailValidation.ts", "../src/plugins/denyDisposableEmail.ts", "../src/plugins/discordAlert.ts", "../src/plugins/geoBlock.ts", "../src/plugins/pagerdutyAlert.ts", "../src/plugins/posthogIdentify.ts", "../src/plugins/slackAlert.ts"],
+  "sourcesContent": [
+    "import { resolveMx } from 'node:dns/promises';\n\n// Email deliverability validation for sign-up — format, disposable-domain block, and an\n// optional MX check. A starter disposable list ships built-in; extend it with your own.\n\nexport type EmailValidationResult = {\n\tok: boolean;\n\treason?: 'disposable' | 'invalid_format' | 'no_mx';\n};\n\nconst EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/u;\n\nconst DISPOSABLE_DOMAINS = new Set([\n\t'10minutemail.com',\n\t'fakeinbox.com',\n\t'getnada.com',\n\t'guerrillamail.com',\n\t'mailinator.com',\n\t'maildrop.cc',\n\t'sharklasers.com',\n\t'temp-mail.org',\n\t'tempmail.com',\n\t'throwaway.email',\n\t'trashmail.com',\n\t'yopmail.com'\n]);\n\nconst domainOf = (email: string) =>\n\temail.slice(email.lastIndexOf('@') + 1).toLowerCase();\n\nconst hasMxRecord = async (domain: string) => {\n\ttry {\n\t\treturn (await resolveMx(domain)).length > 0;\n\t} catch {\n\t\treturn false;\n\t}\n};\n\n// Whether an email's domain is a known disposable/temporary provider (built-in list plus any\n// `extraDomains` you pass).\nexport const isDisposableEmail = (\n\temail: string,\n\textraDomains?: Iterable<string>\n) => {\n\tconst domain = domainOf(email);\n\n\treturn (\n\t\tDISPOSABLE_DOMAINS.has(domain) ||\n\t\t(extraDomains !== undefined && new Set(extraDomains).has(domain))\n\t);\n};\n\n// Validate an email for sign-up. With `checkMx`, also confirms the domain has MX records\n// (a network lookup). Wire it into your register flow before creating the user.\nexport const validateEmailDeliverability = async (\n\temail: string,\n\toptions?: { checkMx?: boolean; disposableDomains?: Iterable<string> }\n): Promise<EmailValidationResult> => {\n\tconst normalized = email.trim().toLowerCase();\n\tif (!EMAIL_PATTERN.test(normalized)) {\n\t\treturn { ok: false, reason: 'invalid_format' };\n\t}\n\tif (isDisposableEmail(normalized, options?.disposableDomains)) {\n\t\treturn { ok: false, reason: 'disposable' };\n\t}\n\tif (\n\t\toptions?.checkMx === true &&\n\t\t!(await hasMxRecord(domainOf(normalized)))\n\t) {\n\t\treturn { ok: false, reason: 'no_mx' };\n\t}\n\n\treturn { ok: true };\n};\n",
+    "// Tiny wrapper around the existing `isDisposableEmail` so it slots into the\n// CredentialsConfig.onCreateCredentialUser hook chain. Composes with whatever else the\n// consumer is doing in onCreateCredentialUser — call this first, fall through on pass.\n//\n// ~10 lines; mostly here as a concrete demonstration that \"plugin\" = \"named function\".\n\nimport { isDisposableEmail } from '../credentials/emailValidation';\n\nexport type DenyDisposableEmailDecision =\n\t| { allow: false; reason: string }\n\t| { allow: true };\n\nexport const denyDisposableEmailPlugin = async (\n\temail: string\n): Promise<DenyDisposableEmailDecision> => {\n\tconst trimmed = email.trim().toLowerCase();\n\tif (await isDisposableEmail(trimmed)) {\n\t\treturn { allow: false, reason: 'disposable_email' };\n\t}\n\n\treturn { allow: true };\n};\n",
+    "// Discord webhook plugin — same shape as slackAlert, slightly different payload.\n// ~20 lines; copy + modify if you want embeds, mentions, etc.\n\nimport type { AuditEvent, AuditEventType, AuditSink } from '../audit/types';\n\nexport type DiscordAlertOptions = {\n\tevents?: readonly AuditEventType[];\n\tformatContent?: (event: AuditEvent) => string;\n\twebhookUrl: string;\n};\n\nconst defaultContent = (event: AuditEvent) => {\n\tconst when = new Date(event.at).toISOString();\n\tconst who = event.userId ?? event.ip ?? 'unknown';\n\n\treturn `🔐 **${event.type}** — ${who} at ${when}`;\n};\n\nexport const discordAlertPlugin = ({\n\tevents,\n\tformatContent = defaultContent,\n\twebhookUrl\n}: DiscordAlertOptions): AuditSink => ({\n\tappend: async (event) => {\n\t\tif (events !== undefined && !events.includes(event.type)) return;\n\t\tawait fetch(webhookUrl, {\n\t\t\tbody: JSON.stringify({ content: formatContent(event) }),\n\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\tmethod: 'POST'\n\t\t}).catch(() => undefined);\n\t}\n});\n",
+    "// Geo-block plugin — gate credential login on the request's country (from\n// `x-client-country` or `cf-ipcountry`). Pair with `isMfaRequired` (force MFA in\n// blocked countries) OR fail closed by throwing in your own login handler.\n//\n// ~25 lines; one Set lookup.\n\nconst readCountry = (headers: Record<string, string | undefined>) =>\n\theaders['x-client-country']?.toUpperCase() ??\n\theaders['cf-ipcountry']?.toUpperCase();\n\nexport type GeoBlockOptions =\n\t| { allowCountries: readonly string[]; denyCountries?: never }\n\t| { allowCountries?: never; denyCountries: readonly string[] };\n\n// Returns `true` when the request should be BLOCKED (i.e. the user is in a deny-listed\n// country, or not in the allow-list). The consumer uses the return to either force\n// MFA via `isMfaRequired` or to reject the login outright.\nexport const geoBlockPlugin = (options: GeoBlockOptions) => {\n\tconst allow =\n\t\toptions.allowCountries === undefined\n\t\t\t? undefined\n\t\t\t: new Set(options.allowCountries.map((country) => country.toUpperCase()));\n\tconst deny =\n\t\toptions.denyCountries === undefined\n\t\t\t? undefined\n\t\t\t: new Set(options.denyCountries.map((country) => country.toUpperCase()));\n\n\treturn (headers: Record<string, string | undefined>) => {\n\t\tconst country = readCountry(headers);\n\t\tif (country === undefined) return false;\n\t\tif (deny !== undefined) return deny.has(country);\n\t\tif (allow !== undefined) return !allow.has(country);\n\n\t\treturn false;\n\t};\n};\n",
+    "// PagerDuty Events API v2 plugin. Posts a trigger event to a PagerDuty service —\n// pair with security-critical audit events (credentials_login_failed, mfa_challenge_failed,\n// impersonation_started) by passing `events: [...]`. Severity defaults to 'warning' but\n// most consumers wire 'critical' for these.\n//\n// Get a routing key from a PagerDuty integration: Service → Integrations → +Add → Events API v2.\n\nimport type { AuditEventType, AuditSink } from '../audit/types';\n\nconst PAGERDUTY_EVENTS_URL = 'https://events.pagerduty.com/v2/enqueue';\n\nexport type PagerDutySeverity = 'critical' | 'error' | 'info' | 'warning';\n\nexport type PagerDutyAlertOptions = {\n\tevents?: readonly AuditEventType[];\n\troutingKey: string;\n\tseverity?: PagerDutySeverity;\n\t// Optional source identifier (e.g. your service name) for grouping in PagerDuty.\n\tsource?: string;\n};\n\nexport const pagerdutyAlertPlugin = ({\n\tevents,\n\troutingKey,\n\tseverity = 'warning',\n\tsource = 'absolutejs-auth'\n}: PagerDutyAlertOptions): AuditSink => ({\n\tappend: async (event) => {\n\t\tif (events !== undefined && !events.includes(event.type)) return;\n\t\tawait fetch(PAGERDUTY_EVENTS_URL, {\n\t\t\tbody: JSON.stringify({\n\t\t\t\tevent_action: 'trigger',\n\t\t\t\tpayload: {\n\t\t\t\t\tcustom_details: event.metadata ?? {},\n\t\t\t\t\tseverity,\n\t\t\t\t\tsource,\n\t\t\t\t\tsummary: `auth event: ${event.type} (user=${event.userId ?? 'unknown'})`,\n\t\t\t\t\ttimestamp: new Date(event.at).toISOString()\n\t\t\t\t},\n\t\t\t\trouting_key: routingKey\n\t\t\t}),\n\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\tmethod: 'POST'\n\t\t}).catch(() => undefined);\n\t}\n});\n",
+    "// PostHog server-side identify. Pair with audit events that have a `userId` (register,\n// credentials_login, oauth_login, …) to push the user to PostHog with their\n// email/properties so server-side events tie back to the right person.\n//\n// ~25 lines; one POST per event. Drop into the audit chain via composition or use as\n// an `AuditSink` directly.\n\nimport type { AuditEvent, AuditSink } from '../audit/types';\n\nexport type PosthogIdentifyOptions = {\n\thost?: string; // defaults to PostHog Cloud US\n\tprojectApiKey: string;\n\t// Pull the properties to send from the audit event metadata + your own enrichment.\n\tproperties?: (event: AuditEvent) => Record<string, unknown>;\n};\n\nconst DEFAULT_HOST = 'https://us.i.posthog.com';\n\nexport const posthogIdentifyPlugin = ({\n\thost = DEFAULT_HOST,\n\tprojectApiKey,\n\tproperties = (event) => ({ ...(event.metadata ?? {}) })\n}: PosthogIdentifyOptions): AuditSink => ({\n\tappend: async (event) => {\n\t\tif (event.userId === undefined) return;\n\t\tawait fetch(`${host}/capture/`, {\n\t\t\tbody: JSON.stringify({\n\t\t\t\tapi_key: projectApiKey,\n\t\t\t\tdistinct_id: event.userId,\n\t\t\t\tevent: '$identify',\n\t\t\t\tproperties: {\n\t\t\t\t\t$set: properties(event),\n\t\t\t\t\t$set_once: { first_seen_event: event.type }\n\t\t\t\t},\n\t\t\t\ttimestamp: new Date(event.at).toISOString()\n\t\t\t}),\n\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\tmethod: 'POST'\n\t\t}).catch(() => undefined);\n\t}\n});\n",
+    "// Slack webhook plugin. Pair with `audit.onAuditEvent` OR drop into the audit chain\n// (it's a valid `AuditSink`) to post a one-line summary of chosen audit events to a\n// Slack channel webhook. Fire-and-forget, ~30 lines — copy + modify if you want a\n// different message shape.\n\nimport type { AuditEvent, AuditEventType, AuditSink } from '../audit/types';\n\nexport type SlackAlertOptions = {\n\t// Optional event-type allow-list. Without it, EVERY event posts — typically you\n\t// want to filter to security-relevant events like login failures + MFA failures.\n\tevents?: readonly AuditEventType[];\n\t// Build the Slack message body from the event. Default is one short line; override\n\t// to use Block Kit, attachments, mentions, etc.\n\tformatMessage?: (event: AuditEvent) => string;\n\twebhookUrl: string;\n};\n\nconst defaultFormat = (event: AuditEvent) => {\n\tconst when = new Date(event.at).toISOString();\n\tconst who = event.userId ?? event.ip ?? 'unknown';\n\n\treturn `🔐 *${event.type}* — ${who} at ${when}`;\n};\n\nexport const slackAlertPlugin = ({\n\tevents,\n\tformatMessage = defaultFormat,\n\twebhookUrl\n}: SlackAlertOptions): AuditSink => ({\n\tappend: async (event) => {\n\t\tif (events !== undefined && !events.includes(event.type)) return;\n\t\tawait fetch(webhookUrl, {\n\t\t\tbody: JSON.stringify({ text: formatMessage(event) }),\n\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\tmethod: 'POST'\n\t\t}).catch(() => undefined);\n\t}\n});\n"
+  ],
+  "mappings": ";;AAAA;AAUA,IAAM,gBAAgB;AAEtB,IAAM,qBAAqB,IAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC;AAED,IAAM,WAAW,CAAC,UACjB,MAAM,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,EAAE,YAAY;AAErD,IAAM,cAAc,OAAO,WAAmB;AAAA,EAC7C,IAAI;AAAA,IACH,QAAQ,MAAM,UAAU,MAAM,GAAG,SAAS;AAAA,IACzC,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAMF,IAAM,oBAAoB,CAChC,OACA,iBACI;AAAA,EACJ,MAAM,SAAS,SAAS,KAAK;AAAA,EAE7B,OACC,mBAAmB,IAAI,MAAM,KAC5B,iBAAiB,aAAa,IAAI,IAAI,YAAY,EAAE,IAAI,MAAM;AAAA;AAM1D,IAAM,8BAA8B,OAC1C,OACA,YACoC;AAAA,EACpC,MAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAAA,EAC5C,IAAI,CAAC,cAAc,KAAK,UAAU,GAAG;AAAA,IACpC,OAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB;AAAA,EAC9C;AAAA,EACA,IAAI,kBAAkB,YAAY,SAAS,iBAAiB,GAAG;AAAA,IAC9D,OAAO,EAAE,IAAI,OAAO,QAAQ,aAAa;AAAA,EAC1C;AAAA,EACA,IACC,SAAS,YAAY,QACrB,CAAE,MAAM,YAAY,SAAS,UAAU,CAAC,GACvC;AAAA,IACD,OAAO,EAAE,IAAI,OAAO,QAAQ,QAAQ;AAAA,EACrC;AAAA,EAEA,OAAO,EAAE,IAAI,KAAK;AAAA;;;AC5DZ,IAAM,4BAA4B,OACxC,UAC0C;AAAA,EAC1C,MAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AAAA,EACzC,IAAI,MAAM,kBAAkB,OAAO,GAAG;AAAA,IACrC,OAAO,EAAE,OAAO,OAAO,QAAQ,mBAAmB;AAAA,EACnD;AAAA,EAEA,OAAO,EAAE,OAAO,KAAK;AAAA;;ACTtB,IAAM,iBAAiB,CAAC,UAAsB;AAAA,EAC7C,MAAM,OAAO,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,EAC5C,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM;AAAA,EAExC,OAAO,kBAAO,MAAM,iBAAY,UAAU;AAAA;AAGpC,IAAM,qBAAqB;AAAA,EACjC;AAAA,EACA,gBAAgB;AAAA,EAChB;AAAA,OACsC;AAAA,EACtC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,WAAW,aAAa,CAAC,OAAO,SAAS,MAAM,IAAI;AAAA,MAAG;AAAA,IAC1D,MAAM,MAAM,YAAY;AAAA,MACvB,MAAM,KAAK,UAAU,EAAE,SAAS,cAAc,KAAK,EAAE,CAAC;AAAA,MACtD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;;ACzBA,IAAM,cAAc,CAAC,YACpB,QAAQ,qBAAqB,YAAY,KACzC,QAAQ,iBAAiB,YAAY;AAS/B,IAAM,iBAAiB,CAAC,YAA6B;AAAA,EAC3D,MAAM,QACL,QAAQ,mBAAmB,YACxB,YACA,IAAI,IAAI,QAAQ,eAAe,IAAI,CAAC,YAAY,QAAQ,YAAY,CAAC,CAAC;AAAA,EAC1E,MAAM,OACL,QAAQ,kBAAkB,YACvB,YACA,IAAI,IAAI,QAAQ,cAAc,IAAI,CAAC,YAAY,QAAQ,YAAY,CAAC,CAAC;AAAA,EAEzE,OAAO,CAAC,YAAgD;AAAA,IACvD,MAAM,UAAU,YAAY,OAAO;AAAA,IACnC,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,IAClC,IAAI,SAAS;AAAA,MAAW,OAAO,KAAK,IAAI,OAAO;AAAA,IAC/C,IAAI,UAAU;AAAA,MAAW,OAAO,CAAC,MAAM,IAAI,OAAO;AAAA,IAElD,OAAO;AAAA;AAAA;;ACxBT,IAAM,uBAAuB;AAYtB,IAAM,uBAAuB;AAAA,EACnC;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX,SAAS;AAAA,OAC+B;AAAA,EACxC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,WAAW,aAAa,CAAC,OAAO,SAAS,MAAM,IAAI;AAAA,MAAG;AAAA,IAC1D,MAAM,MAAM,sBAAsB;AAAA,MACjC,MAAM,KAAK,UAAU;AAAA,QACpB,cAAc;AAAA,QACd,SAAS;AAAA,UACR,gBAAgB,MAAM,YAAY,CAAC;AAAA,UACnC;AAAA,UACA;AAAA,UACA,SAAS,eAAe,MAAM,cAAc,MAAM,UAAU;AAAA,UAC5D,WAAW,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,QAC3C;AAAA,QACA,aAAa;AAAA,MACd,CAAC;AAAA,MACD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;;AC7BA,IAAM,eAAe;AAEd,IAAM,wBAAwB;AAAA,EACpC,OAAO;AAAA,EACP;AAAA,EACA,aAAa,CAAC,WAAW,KAAM,MAAM,YAAY,CAAC,EAAG;AAAA,OACZ;AAAA,EACzC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,MAAM,WAAW;AAAA,MAAW;AAAA,IAChC,MAAM,MAAM,GAAG,iBAAiB;AAAA,MAC/B,MAAM,KAAK,UAAU;AAAA,QACpB,SAAS;AAAA,QACT,aAAa,MAAM;AAAA,QACnB,OAAO;AAAA,QACP,YAAY;AAAA,UACX,MAAM,WAAW,KAAK;AAAA,UACtB,WAAW,EAAE,kBAAkB,MAAM,KAAK;AAAA,QAC3C;AAAA,QACA,WAAW,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,MAC3C,CAAC;AAAA,MACD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;;ACvBA,IAAM,gBAAgB,CAAC,UAAsB;AAAA,EAC5C,MAAM,OAAO,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,EAC5C,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM;AAAA,EAExC,OAAO,iBAAM,MAAM,gBAAW,UAAU;AAAA;AAGlC,IAAM,mBAAmB;AAAA,EAC/B;AAAA,EACA,gBAAgB;AAAA,EAChB;AAAA,OACoC;AAAA,EACpC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,WAAW,aAAa,CAAC,OAAO,SAAS,MAAM,IAAI;AAAA,MAAG;AAAA,IAC1D,MAAM,MAAM,YAAY;AAAA,MACvB,MAAM,KAAK,UAAU,EAAE,MAAM,cAAc,KAAK,EAAE,CAAC;AAAA,MACnD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;",
+  "debugId": "671489C19A19639D64756E2164756E21",
+  "names": []
+}

package/dist/plugins/pagerdutyAlert.d.ts

@@ -0,0 +1,9 @@
+import type { AuditEventType, AuditSink } from '../audit/types';
+export type PagerDutySeverity = 'critical' | 'error' | 'info' | 'warning';
+export type PagerDutyAlertOptions = {
+    events?: readonly AuditEventType[];
+    routingKey: string;
+    severity?: PagerDutySeverity;
+    source?: string;
+};
+export declare const pagerdutyAlertPlugin: ({ events, routingKey, severity, source }: PagerDutyAlertOptions) => AuditSink;

package/dist/plugins/posthogIdentify.d.ts

@@ -0,0 +1,7 @@
+import type { AuditEvent, AuditSink } from '../audit/types';
+export type PosthogIdentifyOptions = {
+    host?: string;
+    projectApiKey: string;
+    properties?: (event: AuditEvent) => Record<string, unknown>;
+};
+export declare const posthogIdentifyPlugin: ({ host, projectApiKey, properties }: PosthogIdentifyOptions) => AuditSink;

package/dist/plugins/slackAlert.d.ts

@@ -0,0 +1,7 @@
+import type { AuditEvent, AuditEventType, AuditSink } from '../audit/types';
+export type SlackAlertOptions = {
+    events?: readonly AuditEventType[];
+    formatMessage?: (event: AuditEvent) => string;
+    webhookUrl: string;
+};
+export declare const slackAlertPlugin: ({ events, formatMessage, webhookUrl }: SlackAlertOptions) => AuditSink;

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.30.0-beta.1",
+	"version": "0.30.0-beta.2",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {
@@ -10,7 +10,7 @@
 	"license": "CC BY-NC 4.0",
 	"author": "Alex Kahn",
 	"scripts": {
-		"build": "rm -rf dist && bun build src/index.ts src/htmx/index.ts src/client/index.ts src/client/react.ts --outdir dist --sourcemap --target=bun --external elysia --external react && tsc --emitDeclarationOnly --project tsconfig.json",
+		"build": "rm -rf dist && bun build src/index.ts src/htmx/index.ts src/client/index.ts src/client/react.ts src/plugins/index.ts --outdir dist --sourcemap --target=bun --external elysia --external react && tsc --emitDeclarationOnly --project tsconfig.json",
 		"config": "absolute config",
 		"test": "bun test",
 		"format": "absolute prettier --write",
@@ -73,6 +73,10 @@
 			"import": "./dist/htmx/index.js",
 			"types": "./dist/htmx/index.d.ts"
 		},
+		"./plugins": {
+			"import": "./dist/plugins/index.js",
+			"types": "./dist/plugins/index.d.ts"
+		},
 		"./react": {
 			"import": "./dist/client/react.js",
 			"types": "./dist/client/react.d.ts"