@absolutejs/auth 0.34.0 → 0.35.0

package/dist/migrations/generate.d.ts

@@ -0,0 +1,2 @@
+import { type PgTable } from 'drizzle-orm/pg-core';
+export declare const tablesToInitSql: (tables: PgTable[]) => string;

package/dist/migrations/index.d.ts

@@ -0,0 +1,5 @@
+import type { BlockMigrations } from './types';
+export type BlockName = 'adaptive' | 'apikeys' | 'audit' | 'credentials' | 'fga' | 'linkedProviders' | 'lockout' | 'mfa' | 'oidc' | 'organizations' | 'passwordless' | 'portal' | 'roles' | 'scim' | 'sessions' | 'sso' | 'vault' | 'webauthn' | 'webhooks';
+export declare const blockMigrations: Record<BlockName, BlockMigrations>;
+export { runMigrations } from './runner';
+export type { Migration, BlockMigrations } from './types';

package/dist/migrations/runner.d.ts

@@ -0,0 +1,13 @@
+import { type BlockName } from './index';
+export type RunMigrationsOptions = {
+    databaseUrl: string;
+    /** Subset of blocks to apply. Omit to apply every block the package ships. */
+    blocks?: BlockName[];
+    /** Optional logger; defaults to console.log. Pass `() => undefined` for silent mode. */
+    log?: (message: string) => void;
+};
+export type MigrationRunResult = {
+    applied: string[];
+    skipped: string[];
+};
+export declare const runMigrations: ({ blocks, databaseUrl, log }: RunMigrationsOptions) => Promise<MigrationRunResult>;

package/dist/migrations/types.d.ts

@@ -0,0 +1,14 @@
+export type Migration = {
+    /** Stable identifier — stored in `auth_migrations` to track applied state. Must be
+     *  monotonically ordered within a block (e.g. `0001_init`, `0002_add_foo_column`). */
+    id: string;
+    /** Idempotent SQL. Use `CREATE TABLE IF NOT EXISTS` so re-running is a no-op even if
+     *  the consumer wired the tables by hand before adopting the migration runner. */
+    sql: string;
+};
+export type BlockMigrations = {
+    /** Block name as used in the CLI's `--blocks` flag and in `runMigrations({ blocks })`.
+     *  Convention: same string as the `src/<block>/` directory. */
+    block: string;
+    migrations: Migration[];
+};

package/dist/plugins/index.js

@@ -1,4 +1,6 @@
 // @bun
+var __require = import.meta.require;
+
 // src/credentials/emailValidation.ts
 import { resolveMx } from "dns/promises";
 var EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
@@ -179,5 +181,5 @@ export {
   denyDisposableEmailPlugin
 };
 
-//# debugId=671489C19A19639D64756E2164756E21
+//# debugId=48E6CCF48B1E27E064756E2164756E21
 //# sourceMappingURL=index.js.map

package/dist/plugins/index.js.map

@@ -10,7 +10,7 @@
     "// PostHog server-side identify. Pair with audit events that have a `userId` (register,\n// credentials_login, oauth_login, …) to push the user to PostHog with their\n// email/properties so server-side events tie back to the right person.\n//\n// ~25 lines; one POST per event. Drop into the audit chain via composition or use as\n// an `AuditSink` directly.\n\nimport type { AuditEvent, AuditSink } from '../audit/types';\n\nexport type PosthogIdentifyOptions = {\n\thost?: string; // defaults to PostHog Cloud US\n\tprojectApiKey: string;\n\t// Pull the properties to send from the audit event metadata + your own enrichment.\n\tproperties?: (event: AuditEvent) => Record<string, unknown>;\n};\n\nconst DEFAULT_HOST = 'https://us.i.posthog.com';\n\nexport const posthogIdentifyPlugin = ({\n\thost = DEFAULT_HOST,\n\tprojectApiKey,\n\tproperties = (event) => ({ ...(event.metadata ?? {}) })\n}: PosthogIdentifyOptions): AuditSink => ({\n\tappend: async (event) => {\n\t\tif (event.userId === undefined) return;\n\t\tawait fetch(`${host}/capture/`, {\n\t\t\tbody: JSON.stringify({\n\t\t\t\tapi_key: projectApiKey,\n\t\t\t\tdistinct_id: event.userId,\n\t\t\t\tevent: '$identify',\n\t\t\t\tproperties: {\n\t\t\t\t\t$set: properties(event),\n\t\t\t\t\t$set_once: { first_seen_event: event.type }\n\t\t\t\t},\n\t\t\t\ttimestamp: new Date(event.at).toISOString()\n\t\t\t}),\n\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\tmethod: 'POST'\n\t\t}).catch(() => undefined);\n\t}\n});\n",
     "// Slack webhook plugin. Pair with `audit.onAuditEvent` OR drop into the audit chain\n// (it's a valid `AuditSink`) to post a one-line summary of chosen audit events to a\n// Slack channel webhook. Fire-and-forget, ~30 lines — copy + modify if you want a\n// different message shape.\n\nimport type { AuditEvent, AuditEventType, AuditSink } from '../audit/types';\n\nexport type SlackAlertOptions = {\n\t// Optional event-type allow-list. Without it, EVERY event posts — typically you\n\t// want to filter to security-relevant events like login failures + MFA failures.\n\tevents?: readonly AuditEventType[];\n\t// Build the Slack message body from the event. Default is one short line; override\n\t// to use Block Kit, attachments, mentions, etc.\n\tformatMessage?: (event: AuditEvent) => string;\n\twebhookUrl: string;\n};\n\nconst defaultFormat = (event: AuditEvent) => {\n\tconst when = new Date(event.at).toISOString();\n\tconst who = event.userId ?? event.ip ?? 'unknown';\n\n\treturn `🔐 *${event.type}* — ${who} at ${when}`;\n};\n\nexport const slackAlertPlugin = ({\n\tevents,\n\tformatMessage = defaultFormat,\n\twebhookUrl\n}: SlackAlertOptions): AuditSink => ({\n\tappend: async (event) => {\n\t\tif (events !== undefined && !events.includes(event.type)) return;\n\t\tawait fetch(webhookUrl, {\n\t\t\tbody: JSON.stringify({ text: formatMessage(event) }),\n\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\tmethod: 'POST'\n\t\t}).catch(() => undefined);\n\t}\n});\n"
   ],
-  "mappings": ";;AAAA;AAUA,IAAM,gBAAgB;AAEtB,IAAM,qBAAqB,IAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC;AAED,IAAM,WAAW,CAAC,UACjB,MAAM,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,EAAE,YAAY;AAErD,IAAM,cAAc,OAAO,WAAmB;AAAA,EAC7C,IAAI;AAAA,IACH,QAAQ,MAAM,UAAU,MAAM,GAAG,SAAS;AAAA,IACzC,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAMF,IAAM,oBAAoB,CAChC,OACA,iBACI;AAAA,EACJ,MAAM,SAAS,SAAS,KAAK;AAAA,EAE7B,OACC,mBAAmB,IAAI,MAAM,KAC5B,iBAAiB,aAAa,IAAI,IAAI,YAAY,EAAE,IAAI,MAAM;AAAA;AAM1D,IAAM,8BAA8B,OAC1C,OACA,YACoC;AAAA,EACpC,MAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAAA,EAC5C,IAAI,CAAC,cAAc,KAAK,UAAU,GAAG;AAAA,IACpC,OAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB;AAAA,EAC9C;AAAA,EACA,IAAI,kBAAkB,YAAY,SAAS,iBAAiB,GAAG;AAAA,IAC9D,OAAO,EAAE,IAAI,OAAO,QAAQ,aAAa;AAAA,EAC1C;AAAA,EACA,IACC,SAAS,YAAY,QACrB,CAAE,MAAM,YAAY,SAAS,UAAU,CAAC,GACvC;AAAA,IACD,OAAO,EAAE,IAAI,OAAO,QAAQ,QAAQ;AAAA,EACrC;AAAA,EAEA,OAAO,EAAE,IAAI,KAAK;AAAA;;;AC5DZ,IAAM,4BAA4B,OACxC,UAC0C;AAAA,EAC1C,MAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AAAA,EACzC,IAAI,MAAM,kBAAkB,OAAO,GAAG;AAAA,IACrC,OAAO,EAAE,OAAO,OAAO,QAAQ,mBAAmB;AAAA,EACnD;AAAA,EAEA,OAAO,EAAE,OAAO,KAAK;AAAA;;ACTtB,IAAM,iBAAiB,CAAC,UAAsB;AAAA,EAC7C,MAAM,OAAO,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,EAC5C,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM;AAAA,EAExC,OAAO,kBAAO,MAAM,iBAAY,UAAU;AAAA;AAGpC,IAAM,qBAAqB;AAAA,EACjC;AAAA,EACA,gBAAgB;AAAA,EAChB;AAAA,OACsC;AAAA,EACtC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,WAAW,aAAa,CAAC,OAAO,SAAS,MAAM,IAAI;AAAA,MAAG;AAAA,IAC1D,MAAM,MAAM,YAAY;AAAA,MACvB,MAAM,KAAK,UAAU,EAAE,SAAS,cAAc,KAAK,EAAE,CAAC;AAAA,MACtD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;;ACzBA,IAAM,cAAc,CAAC,YACpB,QAAQ,qBAAqB,YAAY,KACzC,QAAQ,iBAAiB,YAAY;AAS/B,IAAM,iBAAiB,CAAC,YAA6B;AAAA,EAC3D,MAAM,QACL,QAAQ,mBAAmB,YACxB,YACA,IAAI,IAAI,QAAQ,eAAe,IAAI,CAAC,YAAY,QAAQ,YAAY,CAAC,CAAC;AAAA,EAC1E,MAAM,OACL,QAAQ,kBAAkB,YACvB,YACA,IAAI,IAAI,QAAQ,cAAc,IAAI,CAAC,YAAY,QAAQ,YAAY,CAAC,CAAC;AAAA,EAEzE,OAAO,CAAC,YAAgD;AAAA,IACvD,MAAM,UAAU,YAAY,OAAO;AAAA,IACnC,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,IAClC,IAAI,SAAS;AAAA,MAAW,OAAO,KAAK,IAAI,OAAO;AAAA,IAC/C,IAAI,UAAU;AAAA,MAAW,OAAO,CAAC,MAAM,IAAI,OAAO;AAAA,IAElD,OAAO;AAAA;AAAA;;ACxBT,IAAM,uBAAuB;AAYtB,IAAM,uBAAuB;AAAA,EACnC;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX,SAAS;AAAA,OAC+B;AAAA,EACxC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,WAAW,aAAa,CAAC,OAAO,SAAS,MAAM,IAAI;AAAA,MAAG;AAAA,IAC1D,MAAM,MAAM,sBAAsB;AAAA,MACjC,MAAM,KAAK,UAAU;AAAA,QACpB,cAAc;AAAA,QACd,SAAS;AAAA,UACR,gBAAgB,MAAM,YAAY,CAAC;AAAA,UACnC;AAAA,UACA;AAAA,UACA,SAAS,eAAe,MAAM,cAAc,MAAM,UAAU;AAAA,UAC5D,WAAW,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,QAC3C;AAAA,QACA,aAAa;AAAA,MACd,CAAC;AAAA,MACD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;;AC7BA,IAAM,eAAe;AAEd,IAAM,wBAAwB;AAAA,EACpC,OAAO;AAAA,EACP;AAAA,EACA,aAAa,CAAC,WAAW,KAAM,MAAM,YAAY,CAAC,EAAG;AAAA,OACZ;AAAA,EACzC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,MAAM,WAAW;AAAA,MAAW;AAAA,IAChC,MAAM,MAAM,GAAG,iBAAiB;AAAA,MAC/B,MAAM,KAAK,UAAU;AAAA,QACpB,SAAS;AAAA,QACT,aAAa,MAAM;AAAA,QACnB,OAAO;AAAA,QACP,YAAY;AAAA,UACX,MAAM,WAAW,KAAK;AAAA,UACtB,WAAW,EAAE,kBAAkB,MAAM,KAAK;AAAA,QAC3C;AAAA,QACA,WAAW,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,MAC3C,CAAC;AAAA,MACD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;;ACvBA,IAAM,gBAAgB,CAAC,UAAsB;AAAA,EAC5C,MAAM,OAAO,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,EAC5C,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM;AAAA,EAExC,OAAO,iBAAM,MAAM,gBAAW,UAAU;AAAA;AAGlC,IAAM,mBAAmB;AAAA,EAC/B;AAAA,EACA,gBAAgB;AAAA,EAChB;AAAA,OACoC;AAAA,EACpC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,WAAW,aAAa,CAAC,OAAO,SAAS,MAAM,IAAI;AAAA,MAAG;AAAA,IAC1D,MAAM,MAAM,YAAY;AAAA,MACvB,MAAM,KAAK,UAAU,EAAE,MAAM,cAAc,KAAK,EAAE,CAAC;AAAA,MACnD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;",
-  "debugId": "671489C19A19639D64756E2164756E21",
+  "mappings": ";;;;AAAA;AAUA,IAAM,gBAAgB;AAEtB,IAAM,qBAAqB,IAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC;AAED,IAAM,WAAW,CAAC,UACjB,MAAM,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,EAAE,YAAY;AAErD,IAAM,cAAc,OAAO,WAAmB;AAAA,EAC7C,IAAI;AAAA,IACH,QAAQ,MAAM,UAAU,MAAM,GAAG,SAAS;AAAA,IACzC,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAMF,IAAM,oBAAoB,CAChC,OACA,iBACI;AAAA,EACJ,MAAM,SAAS,SAAS,KAAK;AAAA,EAE7B,OACC,mBAAmB,IAAI,MAAM,KAC5B,iBAAiB,aAAa,IAAI,IAAI,YAAY,EAAE,IAAI,MAAM;AAAA;AAM1D,IAAM,8BAA8B,OAC1C,OACA,YACoC;AAAA,EACpC,MAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAAA,EAC5C,IAAI,CAAC,cAAc,KAAK,UAAU,GAAG;AAAA,IACpC,OAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB;AAAA,EAC9C;AAAA,EACA,IAAI,kBAAkB,YAAY,SAAS,iBAAiB,GAAG;AAAA,IAC9D,OAAO,EAAE,IAAI,OAAO,QAAQ,aAAa;AAAA,EAC1C;AAAA,EACA,IACC,SAAS,YAAY,QACrB,CAAE,MAAM,YAAY,SAAS,UAAU,CAAC,GACvC;AAAA,IACD,OAAO,EAAE,IAAI,OAAO,QAAQ,QAAQ;AAAA,EACrC;AAAA,EAEA,OAAO,EAAE,IAAI,KAAK;AAAA;;;AC5DZ,IAAM,4BAA4B,OACxC,UAC0C;AAAA,EAC1C,MAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AAAA,EACzC,IAAI,MAAM,kBAAkB,OAAO,GAAG;AAAA,IACrC,OAAO,EAAE,OAAO,OAAO,QAAQ,mBAAmB;AAAA,EACnD;AAAA,EAEA,OAAO,EAAE,OAAO,KAAK;AAAA;;ACTtB,IAAM,iBAAiB,CAAC,UAAsB;AAAA,EAC7C,MAAM,OAAO,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,EAC5C,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM;AAAA,EAExC,OAAO,kBAAO,MAAM,iBAAY,UAAU;AAAA;AAGpC,IAAM,qBAAqB;AAAA,EACjC;AAAA,EACA,gBAAgB;AAAA,EAChB;AAAA,OACsC;AAAA,EACtC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,WAAW,aAAa,CAAC,OAAO,SAAS,MAAM,IAAI;AAAA,MAAG;AAAA,IAC1D,MAAM,MAAM,YAAY;AAAA,MACvB,MAAM,KAAK,UAAU,EAAE,SAAS,cAAc,KAAK,EAAE,CAAC;AAAA,MACtD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;;ACzBA,IAAM,cAAc,CAAC,YACpB,QAAQ,qBAAqB,YAAY,KACzC,QAAQ,iBAAiB,YAAY;AAS/B,IAAM,iBAAiB,CAAC,YAA6B;AAAA,EAC3D,MAAM,QACL,QAAQ,mBAAmB,YACxB,YACA,IAAI,IAAI,QAAQ,eAAe,IAAI,CAAC,YAAY,QAAQ,YAAY,CAAC,CAAC;AAAA,EAC1E,MAAM,OACL,QAAQ,kBAAkB,YACvB,YACA,IAAI,IAAI,QAAQ,cAAc,IAAI,CAAC,YAAY,QAAQ,YAAY,CAAC,CAAC;AAAA,EAEzE,OAAO,CAAC,YAAgD;AAAA,IACvD,MAAM,UAAU,YAAY,OAAO;AAAA,IACnC,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,IAClC,IAAI,SAAS;AAAA,MAAW,OAAO,KAAK,IAAI,OAAO;AAAA,IAC/C,IAAI,UAAU;AAAA,MAAW,OAAO,CAAC,MAAM,IAAI,OAAO;AAAA,IAElD,OAAO;AAAA;AAAA;;ACxBT,IAAM,uBAAuB;AAYtB,IAAM,uBAAuB;AAAA,EACnC;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX,SAAS;AAAA,OAC+B;AAAA,EACxC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,WAAW,aAAa,CAAC,OAAO,SAAS,MAAM,IAAI;AAAA,MAAG;AAAA,IAC1D,MAAM,MAAM,sBAAsB;AAAA,MACjC,MAAM,KAAK,UAAU;AAAA,QACpB,cAAc;AAAA,QACd,SAAS;AAAA,UACR,gBAAgB,MAAM,YAAY,CAAC;AAAA,UACnC;AAAA,UACA;AAAA,UACA,SAAS,eAAe,MAAM,cAAc,MAAM,UAAU;AAAA,UAC5D,WAAW,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,QAC3C;AAAA,QACA,aAAa;AAAA,MACd,CAAC;AAAA,MACD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;;AC7BA,IAAM,eAAe;AAEd,IAAM,wBAAwB;AAAA,EACpC,OAAO;AAAA,EACP;AAAA,EACA,aAAa,CAAC,WAAW,KAAM,MAAM,YAAY,CAAC,EAAG;AAAA,OACZ;AAAA,EACzC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,MAAM,WAAW;AAAA,MAAW;AAAA,IAChC,MAAM,MAAM,GAAG,iBAAiB;AAAA,MAC/B,MAAM,KAAK,UAAU;AAAA,QACpB,SAAS;AAAA,QACT,aAAa,MAAM;AAAA,QACnB,OAAO;AAAA,QACP,YAAY;AAAA,UACX,MAAM,WAAW,KAAK;AAAA,UACtB,WAAW,EAAE,kBAAkB,MAAM,KAAK;AAAA,QAC3C;AAAA,QACA,WAAW,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,MAC3C,CAAC;AAAA,MACD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;;ACvBA,IAAM,gBAAgB,CAAC,UAAsB;AAAA,EAC5C,MAAM,OAAO,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,EAC5C,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM;AAAA,EAExC,OAAO,iBAAM,MAAM,gBAAW,UAAU;AAAA;AAGlC,IAAM,mBAAmB;AAAA,EAC/B;AAAA,EACA,gBAAgB;AAAA,EAChB;AAAA,OACoC;AAAA,EACpC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,WAAW,aAAa,CAAC,OAAO,SAAS,MAAM,IAAI;AAAA,MAAG;AAAA,IAC1D,MAAM,MAAM,YAAY;AAAA,MACvB,MAAM,KAAK,UAAU,EAAE,MAAM,cAAc,KAAK,EAAE,CAAC;AAAA,MACnD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;",
+  "debugId": "48E6CCF48B1E27E064756E2164756E21",
   "names": []
 }

package/dist/telemetry/tracing.d.ts

@@ -0,0 +1,15 @@
+import type { Attributes, Span, TracerProvider } from '@opentelemetry/api';
+export type TracingConfig = {
+    /** Plug in your `@opentelemetry/sdk-trace-node` (or `-web` / `-bun`) TracerProvider
+     *  here. When omitted, every `withSpan` call short-circuits and the package never
+     *  loads `@opentelemetry/api`. */
+    tracerProvider: TracerProvider;
+    /** Service name attribute attached to every span. Defaults to `@absolutejs/auth`. */
+    serviceName?: string;
+};
+type SpanWork<Result> = (span: Span | undefined) => Promise<Result>;
+type WithSpanFn = <Result>(name: string, attributes: Attributes | undefined, work: SpanWork<Result>) => Promise<Result>;
+export declare const __resetTracingForTests: () => void;
+export declare const initTracing: (config: TracingConfig) => Promise<void>;
+export declare const withSpan: WithSpanFn;
+export {};

package/dist/types.d.ts

@@ -19,6 +19,7 @@ import type { ScimConfig } from './scim/config';
 import type { SessionsConfig } from './session/sessionsConfig';
 import type { AuthSessionStore } from './session/types';
 import type { SSOConfig } from './sso/config';
+import type { TracingConfig } from './telemetry/tracing';
 import type { WebAuthnConfig } from './webauthn/config';
 import type { WebhooksConfig } from './webhooks/config';
 export type AuthIntent = 'login' | 'link_identity' | 'link_connector';
@@ -199,6 +200,13 @@ export type AuthConfig<UserType> = {
      *  dev server. If you run prod without setting `NODE_ENV=production`, set
      *  `cookieSecure: true` explicitly. */
     cookieSecure?: boolean;
+    /** OpenTelemetry instrumentation. Pass your configured `TracerProvider` (from
+     *  `@opentelemetry/sdk-trace-node` / `-web` / `-bun`) and the package emits spans for
+     *  every key flow: `auth.credentials.login`, `auth.oauth.callback`, `auth.mfa.challenge`,
+     *  `auth.webhook.deliver`, etc. Pipe the spans into Datadog / Honeycomb / Grafana Tempo /
+     *  Sentry / Jaeger / whichever APM you already pay for. `@opentelemetry/api` is an
+     *  OPTIONAL peer dep — consumers that leave `tracing` unset never load it. */
+    tracing?: TracingConfig;
     authorizeRoute?: AuthorizeRoute;
     profileRoute?: RouteString;
     callbackRoute?: RouteString;

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.34.0",
+	"version": "0.35.0",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {
@@ -7,10 +7,13 @@
 		"url": "https://github.com/absolutejs/absolute-auth.git"
 	},
 	"main": "./dist/index.js",
+	"bin": {
+		"absolute-auth": "./dist/cli/migrate.js"
+	},
 	"license": "CC BY-NC 4.0",
 	"author": "Alex Kahn",
 	"scripts": {
-		"build": "rm -rf dist && bun build src/index.ts src/htmx/index.ts src/client/index.ts src/client/react.ts src/client/vue.ts src/client/solid.ts src/client/svelte.ts src/plugins/index.ts --outdir dist --sourcemap --target=bun --external elysia --external react --external vue --external solid-js --external svelte && bun build src/fingerprint-client/index.ts --outdir dist/fingerprint-client --sourcemap --target=browser && tsc --emitDeclarationOnly --project tsconfig.json",
+		"build": "rm -rf dist && bun build src/index.ts src/htmx/index.ts src/client/index.ts src/client/react.ts src/client/vue.ts src/client/solid.ts src/client/svelte.ts src/plugins/index.ts --outdir dist --sourcemap --target=bun --external elysia --external react --external vue --external solid-js --external svelte --external @opentelemetry/api && bun build src/cli/migrate.ts --outdir dist/cli --sourcemap --target=bun --external @neondatabase/serverless --external drizzle-orm && bun build src/fingerprint-client/index.ts --outdir dist/fingerprint-client --sourcemap --target=browser && tsc --emitDeclarationOnly --project tsconfig.json && chmod +x dist/cli/migrate.js",
 		"config": "absolute config",
 		"test": "bun test",
 		"format": "absolute prettier --write",
@@ -28,6 +31,7 @@
 	],
 	"types": "./dist/index.d.ts",
 	"peerDependencies": {
+		"@opentelemetry/api": ">=1.7",
 		"elysia": ">= 1.4.26",
 		"react": ">=18 <20",
 		"solid-js": ">=1.8",
@@ -35,6 +39,9 @@
 		"vue": ">=3.4"
 	},
 	"peerDependenciesMeta": {
+		"@opentelemetry/api": {
+			"optional": true
+		},
 		"react": {
 			"optional": true
 		},
@@ -57,6 +64,8 @@
 	"devDependencies": {
 		"@absolutejs/absolute": "^0.19.0-beta.1023",
 		"@eslint/js": "^10.0.1",
+		"@opentelemetry/api": "^1.9.1",
+		"@opentelemetry/sdk-trace-base": "^2.7.1",
 		"@stylistic/eslint-plugin": "^5.10.0",
 		"@types/bun": "1.2.9",
 		"@types/react": "^19.0.0",