@adonis-agora/authkit-server 0.34.0

package/build/src/mixins/with_auth_user.js

@@ -0,0 +1,46 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { column, beforeSave } from '@adonisjs/lucid/orm';
+import { Scrypt } from '@adonisjs/core/hash/drivers/scrypt';
+import { jsonColumn } from './json_column.js';
+const hasher = new Scrypt({});
+export function withAuthUser() {
+    return (superclass) => {
+        class AuthUserMixin extends superclass {
+            static async hashAuthUserPassword(user) {
+                if (user.$dirty.password) {
+                    user.password = await hasher.make(user.password);
+                }
+            }
+            async verifyPassword(plain) {
+                // `verify` do driver devolve false (não lança) em hash de formato
+                // desconhecido — o lazy rehash + legacyVerifier no store cuidam disso.
+                return hasher.verify(this.password, plain);
+            }
+            passwordNeedsRehash() {
+                // Hash não reconhecido pelo hasher atual (formato legado) OU com
+                // parâmetros desatualizados → precisa re-hash.
+                if (!hasher.isValidHash(this.password))
+                    return true;
+                return hasher.needsReHash(this.password);
+            }
+        }
+        __decorate([
+            column()
+        ], AuthUserMixin.prototype, "email", void 0);
+        __decorate([
+            column({ serializeAs: null })
+        ], AuthUserMixin.prototype, "password", void 0);
+        __decorate([
+            column(jsonColumn({ fallback: [], emptyOnWrite: 'serialize' }))
+        ], AuthUserMixin.prototype, "globalRoles", void 0);
+        __decorate([
+            beforeSave()
+        ], AuthUserMixin, "hashAuthUserPassword", null);
+        return AuthUserMixin;
+    };
+}

package/build/src/mixins/with_credentials.d.ts

@@ -0,0 +1,20 @@
+import { BaseModel } from '@adonisjs/lucid/orm';
+import type { NormalizeConstructor } from '@adonisjs/core/types/helpers';
+import { DateTime } from 'luxon';
+/**
+ * Instância composta pelo mixin {@link withCredentials}.
+ */
+export interface CredentialsRow {
+    emailVerifiedAt: DateTime | null;
+    emailVerificationToken: string | null;
+    passwordResetToken: string | null;
+    passwordResetExpiresAt: DateTime | null;
+    readonly isEmailVerified: boolean;
+}
+/**
+ * Classe resultante da composição com o mixin {@link withCredentials}.
+ */
+export type CredentialsClass<Model extends NormalizeConstructor<typeof BaseModel>> = Model & {
+    new (...args: any[]): CredentialsRow;
+};
+export declare function withCredentials(): <Model extends NormalizeConstructor<typeof BaseModel>>(superclass: Model) => CredentialsClass<Model>;

package/build/src/mixins/with_credentials.js

@@ -0,0 +1,29 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { column } from '@adonisjs/lucid/orm';
+export function withCredentials() {
+    return (superclass) => {
+        class CredentialsMixin extends superclass {
+            get isEmailVerified() {
+                return this.emailVerifiedAt !== null;
+            }
+        }
+        __decorate([
+            column.dateTime()
+        ], CredentialsMixin.prototype, "emailVerifiedAt", void 0);
+        __decorate([
+            column({ serializeAs: null })
+        ], CredentialsMixin.prototype, "emailVerificationToken", void 0);
+        __decorate([
+            column({ serializeAs: null })
+        ], CredentialsMixin.prototype, "passwordResetToken", void 0);
+        __decorate([
+            column.dateTime({ serializeAs: null })
+        ], CredentialsMixin.prototype, "passwordResetExpiresAt", void 0);
+        return CredentialsMixin;
+    };
+}

package/build/src/mixins/with_mfa.d.ts

@@ -0,0 +1,35 @@
+import { BaseModel } from '@adonisjs/lucid/orm';
+import type { NormalizeConstructor } from '@adonisjs/core/types/helpers';
+import { DateTime } from 'luxon';
+/**
+ * @deprecated O estado de MFA deixou de viver no model do host. Estas propriedades
+ * NÃO existem mais na linha do model — o tipo é mantido apenas por compatibilidade
+ * de assinatura. Use os métodos da {@link MfaCapability} do store (que batem na
+ * tabela lib-owned `auth_mfa`).
+ */
+export interface MfaRow {
+    totpSecret: string | null;
+    mfaEnabledAt: DateTime | null;
+    recoveryCodes: string[] | null;
+    lastTotpStep: number | null;
+    readonly isMfaEnabled: boolean;
+}
+/**
+ * @deprecated Veja {@link MfaRow}. O mixin {@link withMfa} virou um no-op de schema.
+ */
+export type MfaClass<Model extends NormalizeConstructor<typeof BaseModel>> = Model;
+/**
+ * Mixin de MFA/TOTP — AGORA UM NO-OP DE SCHEMA.
+ *
+ * O estado de MFA (`totp_secret`, `mfa_enabled_at`, `recovery_codes`,
+ * `last_totp_step`) é LIB-OWNED: vive na tabela própria auto-gerida `auth_mfa`
+ * (criada pelo `ensureAuthkitSchema`), keyed por `account_id`. O host NÃO precisa
+ * mais de migration para MFA e o model NÃO carrega mais essas colunas.
+ *
+ * O export `withMfa` é MANTIDO por compatibilidade — os apps continuam compondo
+ * `withMfa()` no model sem precisar mudar nada — mas ele não adiciona mais nenhuma
+ * coluna nem comportamento. Toda a leitura/escrita de MFA passa pelos métodos da
+ * {@link MfaCapability} do store (`getMfaState`, `verifyTotp`, etc.), que operam
+ * sobre `auth_mfa`.
+ */
+export declare function withMfa(): <Model extends NormalizeConstructor<typeof BaseModel>>(superclass: Model) => Model;

package/build/src/mixins/with_mfa.js

@@ -0,0 +1,21 @@
+/**
+ * Mixin de MFA/TOTP — AGORA UM NO-OP DE SCHEMA.
+ *
+ * O estado de MFA (`totp_secret`, `mfa_enabled_at`, `recovery_codes`,
+ * `last_totp_step`) é LIB-OWNED: vive na tabela própria auto-gerida `auth_mfa`
+ * (criada pelo `ensureAuthkitSchema`), keyed por `account_id`. O host NÃO precisa
+ * mais de migration para MFA e o model NÃO carrega mais essas colunas.
+ *
+ * O export `withMfa` é MANTIDO por compatibilidade — os apps continuam compondo
+ * `withMfa()` no model sem precisar mudar nada — mas ele não adiciona mais nenhuma
+ * coluna nem comportamento. Toda a leitura/escrita de MFA passa pelos métodos da
+ * {@link MfaCapability} do store (`getMfaState`, `verifyTotp`, etc.), que operam
+ * sobre `auth_mfa`.
+ */
+export function withMfa() {
+    return (superclass) => {
+        // No-op: nenhuma coluna/decorator adicionado. Apps que compõem `withMfa()`
+        // continuam compilando; o estado de MFA vive em `auth_mfa` (lib-owned).
+        return superclass;
+    };
+}

package/build/src/mixins/with_personal_access_token.d.ts

@@ -0,0 +1,19 @@
+import { BaseModel } from '@adonisjs/lucid/orm';
+import type { NormalizeConstructor } from '@adonisjs/core/types/helpers';
+import { DateTime } from 'luxon';
+/** Instância composta pelo mixin {@link withPersonalAccessToken}. */
+export interface PersonalAccessTokenRow {
+    userId: string;
+    name: string;
+    tokenHash: string;
+    scopes: string[];
+    audience: string | null;
+    expiresAt: DateTime | null;
+    lastUsedAt: DateTime | null;
+    createdAt: DateTime;
+    updatedAt: DateTime;
+}
+export type PersonalAccessTokenClass<Model extends NormalizeConstructor<typeof BaseModel>> = Model & {
+    new (...args: any[]): PersonalAccessTokenRow;
+};
+export declare function withPersonalAccessToken(): <Model extends NormalizeConstructor<typeof BaseModel>>(superclass: Model) => PersonalAccessTokenClass<Model>;

package/build/src/mixins/with_personal_access_token.js

@@ -0,0 +1,42 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { column } from '@adonisjs/lucid/orm';
+import { jsonColumn } from './json_column.js';
+export function withPersonalAccessToken() {
+    return (superclass) => {
+        class PatMixin extends superclass {
+        }
+        __decorate([
+            column()
+        ], PatMixin.prototype, "userId", void 0);
+        __decorate([
+            column()
+        ], PatMixin.prototype, "name", void 0);
+        __decorate([
+            column({ serializeAs: null })
+        ], PatMixin.prototype, "tokenHash", void 0);
+        __decorate([
+            column(jsonColumn({ fallback: [] }))
+        ], PatMixin.prototype, "scopes", void 0);
+        __decorate([
+            column()
+        ], PatMixin.prototype, "audience", void 0);
+        __decorate([
+            column.dateTime()
+        ], PatMixin.prototype, "expiresAt", void 0);
+        __decorate([
+            column.dateTime()
+        ], PatMixin.prototype, "lastUsedAt", void 0);
+        __decorate([
+            column.dateTime({ autoCreate: true })
+        ], PatMixin.prototype, "createdAt", void 0);
+        __decorate([
+            column.dateTime({ autoCreate: true, autoUpdate: true })
+        ], PatMixin.prototype, "updatedAt", void 0);
+        return PatMixin;
+    };
+}

package/build/src/mixins/with_provider_identity.d.ts

@@ -0,0 +1,20 @@
+import { BaseModel } from '@adonisjs/lucid/orm';
+import type { NormalizeConstructor } from '@adonisjs/core/types/helpers';
+import { DateTime } from 'luxon';
+/**
+ * Instância composta pelo mixin {@link withProviderIdentity}. Liga uma conta
+ * (`accountId`) a uma identidade externa `(provider, providerUserId)` — ex.:
+ * Google, GitHub. Uma conta pode ter várias identidades (account linking).
+ */
+export interface ProviderIdentityRow {
+    provider: string;
+    providerUserId: string;
+    accountId: string;
+    email: string | null;
+    createdAt: DateTime;
+    updatedAt: DateTime;
+}
+export type ProviderIdentityClass<Model extends NormalizeConstructor<typeof BaseModel>> = Model & {
+    new (...args: any[]): ProviderIdentityRow;
+};
+export declare function withProviderIdentity(): <Model extends NormalizeConstructor<typeof BaseModel>>(superclass: Model) => ProviderIdentityClass<Model>;

package/build/src/mixins/with_provider_identity.js

@@ -0,0 +1,32 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { column } from '@adonisjs/lucid/orm';
+export function withProviderIdentity() {
+    return (superclass) => {
+        class ProviderIdentityMixin extends superclass {
+        }
+        __decorate([
+            column()
+        ], ProviderIdentityMixin.prototype, "provider", void 0);
+        __decorate([
+            column()
+        ], ProviderIdentityMixin.prototype, "providerUserId", void 0);
+        __decorate([
+            column()
+        ], ProviderIdentityMixin.prototype, "accountId", void 0);
+        __decorate([
+            column()
+        ], ProviderIdentityMixin.prototype, "email", void 0);
+        __decorate([
+            column.dateTime({ autoCreate: true })
+        ], ProviderIdentityMixin.prototype, "createdAt", void 0);
+        __decorate([
+            column.dateTime({ autoCreate: true, autoUpdate: true })
+        ], ProviderIdentityMixin.prototype, "updatedAt", void 0);
+        return ProviderIdentityMixin;
+    };
+}

package/build/src/mixins/with_webauthn_credential.d.ts

@@ -0,0 +1,37 @@
+import { BaseModel } from '@adonisjs/lucid/orm';
+import type { NormalizeConstructor } from '@adonisjs/core/types/helpers';
+import { DateTime } from 'luxon';
+/**
+ * Instância composta pelo mixin {@link withWebauthnCredential}. Representa uma
+ * credencial WebAuthn / passkey ligada a uma conta (`accountId`). Uma conta pode
+ * ter várias credenciais (vários dispositivos/authenticators).
+ *
+ * O `id` é o credential id (base64url) devolvido pelo authenticator — é a chave
+ * primária. `publicKey` é a chave pública COSE em base64url (texto). `counter` é
+ * o contador do signature counter (anti-replay), atualizado a cada autenticação.
+ */
+export interface WebauthnCredentialRow {
+    /** Conta dona desta credencial (→ auth.users). */
+    accountId: string;
+    /** Chave pública COSE em base64url (texto). */
+    publicKey: string;
+    /** Signature counter (anti-replay); atualizado a cada autenticação. */
+    counter: number;
+    /** Transports reportados (ex.: ['internal','hybrid']); null = desconhecido. */
+    transports: string[] | null;
+    /** Rótulo legível opcional (ex.: nome do dispositivo). */
+    label: string | null;
+    createdAt: DateTime;
+    updatedAt: DateTime;
+}
+export type WebauthnCredentialClass<Model extends NormalizeConstructor<typeof BaseModel>> = Model & {
+    new (...args: any[]): WebauthnCredentialRow;
+};
+/**
+ * Mixin de credenciais WebAuthn / passkey. Adiciona as colunas
+ * `account_id`, `public_key`, `counter`, `transports`, `label` + timestamps ao
+ * model. Segue o mesmo padrão de {@link withProviderIdentity}: o host compõe um
+ * model dedicado (`compose(BaseModel, withWebauthnCredential())`) e passa para o
+ * `lucidAccountStore` via a opção `webauthnCredentialModel`.
+ */
+export declare function withWebauthnCredential(): <Model extends NormalizeConstructor<typeof BaseModel>>(superclass: Model) => WebauthnCredentialClass<Model>;

package/build/src/mixins/with_webauthn_credential.js

@@ -0,0 +1,46 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { column } from '@adonisjs/lucid/orm';
+import { jsonColumn } from './json_column.js';
+/**
+ * Mixin de credenciais WebAuthn / passkey. Adiciona as colunas
+ * `account_id`, `public_key`, `counter`, `transports`, `label` + timestamps ao
+ * model. Segue o mesmo padrão de {@link withProviderIdentity}: o host compõe um
+ * model dedicado (`compose(BaseModel, withWebauthnCredential())`) e passa para o
+ * `lucidAccountStore` via a opção `webauthnCredentialModel`.
+ */
+export function withWebauthnCredential() {
+    return (superclass) => {
+        class WebauthnCredentialMixin extends superclass {
+        }
+        __decorate([
+            column()
+        ], WebauthnCredentialMixin.prototype, "accountId", void 0);
+        __decorate([
+            column()
+        ], WebauthnCredentialMixin.prototype, "publicKey", void 0);
+        __decorate([
+            column()
+        ], WebauthnCredentialMixin.prototype, "counter", void 0);
+        __decorate([
+            column(jsonColumn({
+                fallback: null,
+                treatEmptyArrayAsEmpty: true,
+            }))
+        ], WebauthnCredentialMixin.prototype, "transports", void 0);
+        __decorate([
+            column()
+        ], WebauthnCredentialMixin.prototype, "label", void 0);
+        __decorate([
+            column.dateTime({ autoCreate: true })
+        ], WebauthnCredentialMixin.prototype, "createdAt", void 0);
+        __decorate([
+            column.dateTime({ autoCreate: true, autoUpdate: true })
+        ], WebauthnCredentialMixin.prototype, "updatedAt", void 0);
+        return WebauthnCredentialMixin;
+    };
+}

package/build/src/observability/diagnostics_bridge.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Republica `event` no barramento de diagnostics como `agora:authkit:<event>`
+ * (o canal/diagnostics suffix É o nome do evento — sem tabela de mapeamento).
+ * Best-effort: qualquer erro é engolido para nunca quebrar a request.
+ */
+export declare function emitDiagnostic(event: string, payload: unknown): void;

package/build/src/observability/diagnostics_bridge.js

@@ -0,0 +1,27 @@
+/**
+ * Ponte estrutural (best-effort) entre a auditoria do authkit e o barramento de
+ * diagnostics do Agora. Lê o slot global `@agora/diagnostics:emit` de forma
+ * ESTRUTURAL — nunca importa `@adonis-agora/diagnostics` — e degrada para no-op
+ * quando o diagnostics não está instalado. Mesmo idioma do
+ * `adonis-resilience`/`diagnosticsSink`.
+ *
+ * Sempre ligado: como `emit` é gratuito quando não há nada inscrito, o custo é
+ * desprezível por padrão; um watcher (Telescope ou qualquer
+ * `onDiagnostic('authkit', …)`) registra quando presente. Nada aqui pode lançar
+ * para dentro do caminho de auth.
+ */
+const EMIT_SLOT = Symbol.for("@agora/diagnostics:emit");
+/**
+ * Republica `event` no barramento de diagnostics como `agora:authkit:<event>`
+ * (o canal/diagnostics suffix É o nome do evento — sem tabela de mapeamento).
+ * Best-effort: qualquer erro é engolido para nunca quebrar a request.
+ */
+export function emitDiagnostic(event, payload) {
+    try {
+        const emit = globalThis[EMIT_SLOT];
+        emit?.("authkit", event, payload);
+    }
+    catch {
+        // best-effort: a ponte de diagnostics nunca quebra o caminho de auth.
+    }
+}

package/build/src/observability/metrics_controller.d.ts

@@ -0,0 +1,5 @@
+import type { HttpContext } from '@adonisjs/core/http';
+export default class MetricsController {
+    json(ctx: HttpContext): Promise<any>;
+    dashboard(ctx: HttpContext): Promise<void>;
+}

package/build/src/observability/metrics_controller.js

@@ -0,0 +1,24 @@
+function renderDashboardHtml(snapshot) {
+    const counters = Object.entries(snapshot.counters)
+        .map(([k, v]) => `<tr><td>${k}</td><td>${v}</td></tr>`)
+        .join('');
+    const histograms = Object.entries(snapshot.histograms)
+        .map(([k, h]) => `<tr><td>${k}</td><td>${h.count}</td><td>${h.sum}</td><td>${h.min}</td><td>${h.max}</td></tr>`)
+        .join('');
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="refresh" content="5"><title>AuthKit — Metrics</title>
+<style>body{font-family:system-ui,sans-serif;margin:2rem;color:#111}h1{font-size:1.2rem}table{border-collapse:collapse;margin:1rem 0;width:100%}th,td{border:1px solid #ddd;padding:.4rem .6rem;text-align:left;font-size:.9rem}th{background:#f5f5f5}</style>
+</head><body><h1>AuthKit — Metrics</h1><p>Updated: ${snapshot.updatedAt ? new Date(snapshot.updatedAt).toISOString() : '—'}</p>
+<h2>Counters</h2><table><thead><tr><th>Metric</th><th>Total</th></tr></thead><tbody>${counters || '<tr><td colspan="2">—</td></tr>'}</tbody></table>
+<h2>Histograms</h2><table><thead><tr><th>Metric</th><th>Count</th><th>Sum</th><th>Min</th><th>Max</th></tr></thead><tbody>${histograms || '<tr><td colspan="5">—</td></tr>'}</tbody></table>
+</body></html>`;
+}
+export default class MetricsController {
+    async json(ctx) {
+        const recorder = await ctx.containerResolver.make('authkit.metrics');
+        return recorder.snapshot();
+    }
+    async dashboard(ctx) {
+        const recorder = await ctx.containerResolver.make('authkit.metrics');
+        return ctx.response.type('html').send(renderDashboardHtml(recorder.snapshot()));
+    }
+}

package/build/src/observability/metrics_service.d.ts

@@ -0,0 +1,2 @@
+import { type MetricsRecorder, type ObservabilityConfig } from '@adonis-agora/authkit-core';
+export declare function createMetricsRecorder(observability: ObservabilityConfig, meterName: string): Promise<MetricsRecorder>;

package/build/src/observability/metrics_service.js

@@ -0,0 +1,7 @@
+import { NoopRecorder } from '@adonis-agora/authkit-core';
+import { OtelRecorder } from './otel_recorder.js';
+export async function createMetricsRecorder(observability, meterName) {
+    if (!observability.metrics)
+        return new NoopRecorder();
+    return OtelRecorder.create(meterName);
+}

package/build/src/observability/otel_recorder.d.ts

@@ -0,0 +1,10 @@
+import { type AuthkitMetricName, type MetricsRecorder, type MetricsSnapshot } from '@adonis-agora/authkit-core';
+/** Recorder que (best-effort) emite via @opentelemetry/api e SEMPRE agrega em memória. */
+export declare class OtelRecorder implements MetricsRecorder {
+    #private;
+    private constructor();
+    static create(name: string): Promise<OtelRecorder>;
+    increment(name: AuthkitMetricName, attributes?: Record<string, string | number>): void;
+    record(name: AuthkitMetricName, value: number, attributes?: Record<string, string | number>): void;
+    snapshot(): MetricsSnapshot;
+}

package/build/src/observability/otel_recorder.js

@@ -0,0 +1,59 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { InMemorySnapshot, } from '@adonis-agora/authkit-core';
+/** Recorder que (best-effort) emite via @opentelemetry/api e SEMPRE agrega em memória. */
+export class OtelRecorder {
+    #snapshot = new InMemorySnapshot();
+    #counters = new Map();
+    #histograms = new Map();
+    #meter;
+    constructor(meter) {
+        this.#meter = meter;
+    }
+    static async create(name) {
+        let meter = null;
+        try {
+            // Specifier dinâmico (não-estático) para que o TS não tente resolver o
+            // peer opcional @opentelemetry/api em tempo de compilação. Em runtime,
+            // se o pacote não estiver instalado, caímos no catch e ficamos no-op.
+            const moduleName = '@opentelemetry/api';
+            const otel = await import(__rewriteRelativeImportExtension(moduleName));
+            meter = otel.metrics.getMeter(name);
+        }
+        catch {
+            meter = null;
+        }
+        return new OtelRecorder(meter);
+    }
+    increment(name, attributes) {
+        this.#snapshot.bump(name);
+        if (!this.#meter)
+            return;
+        let c = this.#counters.get(name);
+        if (!c) {
+            c = this.#meter.createCounter(name);
+            this.#counters.set(name, c);
+        }
+        c.add(1, attributes);
+    }
+    record(name, value, attributes) {
+        this.#snapshot.observe(name, value);
+        if (!this.#meter)
+            return;
+        let h = this.#histograms.get(name);
+        if (!h) {
+            h = this.#meter.createHistogram(name);
+            this.#histograms.set(name, h);
+        }
+        h.record(value, attributes);
+    }
+    snapshot() {
+        return this.#snapshot.read();
+    }
+}

package/build/src/observability/telescope/data_providers.d.ts

@@ -0,0 +1,24 @@
+import type { DataProvider } from "@adonis-agora/telescope";
+/**
+ * A stat (`{ value, delta?, spark? }`) over a window for a set of event types.
+ * `query.metric` chooses the grouping; `query.windowMs` the window (default 24h).
+ */
+export declare function authkitEventCountProvider(): DataProvider;
+/**
+ * Login success rate as a gauge (`{ value, min, max }`), over `query.windowMs`
+ * (default 24h). `1` when there were no logins in the window.
+ */
+export declare function authkitLoginSuccessRateProvider(): DataProvider;
+/**
+ * Logins over time as `timeseries` rows (`{ rows: [{ label, success, failure }] }`),
+ * bucketed into `query.buckets ?? 24` equal time buckets across the captured span.
+ */
+export declare function authkitLoginsOverTimeProvider(): DataProvider;
+export declare function authkitEventBreakdownProvider(): DataProvider;
+/**
+ * Recent PAT + impersonation activity as `table` rows (newest-first), bounded by
+ * `query.limit` (default 50). Each row exposes the event, subject and actor.
+ */
+export declare function authkitTokenActivityProvider(): DataProvider;
+/** Every authkit data provider, in registration order. */
+export declare function authkitDataProviders(): DataProvider[];