@nxgt/janus-telemetry 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Steve Tsala
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,110 @@
+# @nxgt/janus-telemetry
+
+[`@nxgt/janus`](https://www.npmjs.com/package/@nxgt/janus) on
+[`@nxgt/telemetry`](https://www.npmjs.com/package/@nxgt/telemetry): a span per
+flow and per permission check, and the security events an audit reads — who
+signed up, in and out, why a sign-in was refused, which users were deleted or
+deactivated, whose password changed, and who was granted what. **Never a
+login, an e-mail, a password, a session token, a one-time token or a
+session id.**
+
+```ts
+import { janus } from '@nxgt/janus';
+import { permissions } from '@nxgt/janus/permissions';
+import { instrumentJanus, instrumentPermissions } from '@nxgt/janus-telemetry';
+
+export const auth = instrumentJanus(janus({ users, hasher, ...mongo }));
+export const access = instrumentPermissions(permissions({ model, store: mongo.relations }));
+```
+
+The instances answer exactly as before, with the same types; everything they
+do now shows up in the telemetry you installed —
+`createTelemetry(…).install()`, or `@nxgt/telemetry-hono`'s server span, which
+the flows' spans nest under.
+
+> **0.x.** A minor version may still change the surface; the changelog says how.
+
+## Install
+
+```sh
+bun add @nxgt/janus-telemetry @nxgt/janus @nxgt/telemetry
+bun add -d typescript
+```
+
+Every peer is required: `@nxgt/janus`, `@nxgt/telemetry` (0.2.1 or later) and
+`typescript` (6). `@nxgt/janus` and `@nxgt/telemetry` are **peers**: one copy of `@nxgt/janus`, so
+`instanceof JanusError` holds, and one of `@nxgt/telemetry`, so there is one
+current span. Like `@nxgt/janus`, it expects `"moduleResolution": "bundler"`.
+
+## API
+
+| Export | What it is |
+| --- | --- |
+| `instrumentJanus(auth)` | The same `janus()` instance, frozen, with every flow traced under its call path — `auth.signIn` as `janus.signIn`, `auth.patient.signIn` as `janus.patient.signIn` — and the security events written as logs. `cookie` stays synchronous and untraced |
+| `instrumentPermissions(access)` | The same `permissions()` instance, frozen, with `can`, `list`, `grant` and `revoke` traced, and one audit event per tuple written |
+| `JanusLike`, `PermissionsLike` | What each accepts: `instrumentJanus(access)` and `instrumentPermissions(auth)` do not compile |
+
+## What is written
+
+### Spans
+
+| Span | Attributes |
+| --- | --- |
+| `janus.<flow>`, `janus.<type>.<flow>` | `janus.user.type`; `user.id` once the answer names a user; `janus.session.renewed` for `authenticate` |
+| `janus.can` | `janus.subject.type`, `janus.subject.id`, `janus.permission`, `janus.object.type`, `janus.object.id`, and the answer, `janus.allowed` |
+| `janus.list` | the subject, `janus.permission`, `janus.object.type`, and `janus.page.items`, how many it found |
+| `janus.grant`, `janus.revoke` | the object, `janus.relation`, and the subject — `janus.subject.relation` for a subject set |
+
+**A refusal is an answer, not a failure.** A wrong password, a taken login, a
+spent token, a denial: the span is `ok`, and a refusal carries
+`janus.refusal`, its code. A failure — `STORE_FAILED`, `UNSUPPORTED`,
+`PERMISSION_DEPTH`, `HASH_UNSUPPORTED`, or anything that is not a `JanusError`
+— fails the span, with `janus.error.code`, and `janus.store.slot` and
+`janus.store.operation` naming the store that could not answer.
+
+### Events
+
+Logs from the source `@nxgt/janus`, each with `janus.user.type` and `user.id`
+when the flow knows them — `janus.signOut` carries neither:
+
+| Event | Severity | When |
+| --- | --- | --- |
+| `janus.signUp` | info | a user signed up |
+| `janus.signIn` | info | a user signed in |
+| `janus.signIn.refused` | **warn** | a sign-in was refused, with `janus.refusal` — `CREDENTIALS_INVALID` with `janus.refusal.reason` (`unknownLogin`, `noPassword`, `wrongPassword`), or `USER_INACTIVE` with the `user.id` of the deactivated user |
+| `janus.signOut` | info | a session was signed out |
+| `janus.signOutEverywhere` | info | every session of a user was revoked |
+| `janus.user.deleted` | info | a user was deleted |
+| `janus.user.activated`, `janus.user.deactivated` | info | `setActive` |
+| `janus.password.changed`, `janus.password.set`, `janus.password.reset` | info | the user's change, an admin's, a reset |
+| `janus.email.verified` | info | an e-mail was confirmed |
+| `janus.tuple.granted`, `janus.tuple.revoked` | info | a tuple was written, with the object, relation and subject |
+
+## Traps
+
+- **Instrument the instance you hand out.** Wrap `janus()` and
+  `permissions()` where they are created, and export the wrapped ones: a
+  route given the unwrapped instance is not traced.
+- **The instances are copies, frozen.** `instrumentJanus(auth) !== auth`, and
+  nothing can be added to it. Everything `janus()` answered is there.
+- **Nothing is written without a telemetry.** With none installed, the spans
+  and events go nowhere, as `@nxgt/telemetry` does everywhere: the flows still
+  answer.
+- **A refused sign-in for bad credentials names no user.** `janus.signIn.refused`
+  with `CREDENTIALS_INVALID` carries the reason and the user type, never the
+  login that was tried: rate limiting per login is the application's, from the
+  request. Only `USER_INACTIVE` — the password was right, the user is
+  deactivated — carries `user.id`.
+- **One copy of `@nxgt/janus`.** A refusal is told from a failure by
+  `instanceof JanusError`: with a second copy installed, every wrong password
+  fails its span.
+
+## Documentation
+
+- [Tracing Janus](docs/guide/tracing.md) — wiring it with a Hono app, reading the spans and events, the audit trail
+- [Troubleshooting](docs/troubleshooting.md) — what you see, why, and the fix
+- [Roadmap](docs/roadmap.md) — what is next, and what is not planned
+
+## Licence
+
+MIT

package/dist/flows.d.ts

@@ -0,0 +1,24 @@
+/** What `janus()` answers, as far as it is read: its user types and its flows. */
+export interface JanusLike {
+    readonly types: readonly string[];
+    readonly authenticate: (...args: never[]) => Promise<unknown>;
+}
+/**
+ * The same `janus()` instance, with every flow traced — a span per call,
+ * named `janus.signIn` or `janus.patient.signIn` — and the events a security
+ * review reads written as logs: sign-ups, sign-ins and the reason one was
+ * refused, sign-outs, deleted and deactivated users, changed passwords.
+ *
+ * ```ts
+ * const auth = instrumentJanus(janus({ users, store, hasher }));
+ * ```
+ *
+ * **A refusal is an answer**: a wrong password leaves its span `ok`, with
+ * `janus.refusal` set, and is a `janus.signIn.refused` warning — never a
+ * failed span. A store that cannot answer is one, with `janus.store.slot`.
+ *
+ * Nothing written carries a login, an e-mail, a password, a token or a
+ * session id: user types, user ids, codes and reasons only.
+ */
+export declare function instrumentJanus<A extends JanusLike>(auth: A): A;
+//# sourceMappingURL=flows.d.ts.map

package/dist/flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flows.d.ts","sourceRoot":"","sources":["../src/flows.ts"],"names":[],"mappings":"AA6BA,kFAAkF;AAClF,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9D;AA2GD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAQ/D"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `@nxgt/janus-telemetry` — `@nxgt/janus` on `@nxgt/telemetry`.
+ *
+ * - `instrumentJanus(auth)` — a span per flow, and the security events worth
+ *   an audit trail: sign-ups, sign-ins and why one was refused, sign-outs,
+ *   deleted and deactivated users, changed passwords;
+ * - `instrumentPermissions(access)` — a span per `can` and `list`, and an event
+ *   per tuple granted or revoked.
+ *
+ * A refusal is an answer, never a failed span; nothing written carries a
+ * login, an e-mail, a password or a token.
+ */
+export { instrumentJanus, type JanusLike } from './flows';
+export { instrumentPermissions, type PermissionsLike } from './permissions';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,286 @@
+// src/flows.ts
+import { createLogger, event } from "@nxgt/telemetry";
+
+// src/traced.ts
+import { JanusError } from "@nxgt/janus";
+import { span } from "@nxgt/telemetry";
+function kindOf(code) {
+  switch (code) {
+    case "STORE_FAILED":
+    case "UNSUPPORTED":
+    case "PERMISSION_DEPTH":
+    case "HASH_UNSUPPORTED":
+      return "failure";
+    case "NOT_FOUND":
+    case "LOGIN_TAKEN":
+    case "VERSION_CONFLICT":
+    case "USER_INVALID":
+    case "PASSWORD_TOO_SHORT":
+    case "CREDENTIALS_INVALID":
+    case "USER_INACTIVE":
+    case "TOKEN_UNKNOWN":
+    case "TOKEN_SPENT":
+    case "TOKEN_EXPIRED":
+    case "TOKEN_STALE":
+    case "INVALID_CURSOR":
+      return "refusal";
+  }
+}
+function isRefusal(error) {
+  return error instanceof JanusError && kindOf(error.code) === "refusal";
+}
+function fieldsOf(fields) {
+  const kept = {};
+  for (const [key, value] of Object.entries(fields)) {
+    if (value !== undefined)
+      kept[key] = value;
+  }
+  return kept;
+}
+function idOf(value) {
+  if (typeof value === "string")
+    return value;
+  if (typeof value === "object" && value !== null && "id" in value) {
+    const id = value.id;
+    if (typeof id === "string")
+      return id;
+  }
+  return;
+}
+function typeOf(value) {
+  if (typeof value === "object" && value !== null && "type" in value) {
+    const type = value.type;
+    if (typeof type === "string")
+      return type;
+  }
+  return;
+}
+async function traced(name, fields, call, after) {
+  const ended = await span(name, { attributes: fields }, async (scope) => {
+    let outcome;
+    try {
+      outcome = { ok: true, value: await call() };
+    } catch (error) {
+      if (error instanceof JanusError) {
+        scope.attribute("janus.error.code", error.code);
+        if (error.slot !== undefined)
+          scope.attribute("janus.store.slot", error.slot);
+        if (error.operation !== undefined) {
+          scope.attribute("janus.store.operation", error.operation);
+        }
+      }
+      if (!isRefusal(error))
+        throw error;
+      scope.attribute("janus.refusal", error.code);
+      outcome = { ok: false, refusal: error };
+    }
+    try {
+      after(scope, outcome);
+    } catch {}
+    return outcome;
+  });
+  if (!ended.ok)
+    throw ended.refusal;
+  return ended.value;
+}
+
+// src/flows.ts
+var log = createLogger("@nxgt/janus");
+var events = {
+  signedUp: event("janus.signUp"),
+  signedIn: event("janus.signIn"),
+  signInRefused: event("janus.signIn.refused"),
+  signedOut: event("janus.signOut"),
+  signedOutEverywhere: event("janus.signOutEverywhere"),
+  userDeleted: event("janus.user.deleted"),
+  userActivated: event("janus.user.activated"),
+  userDeactivated: event("janus.user.deactivated"),
+  passwordChanged: event("janus.password.changed"),
+  passwordSet: event("janus.password.set"),
+  passwordReset: event("janus.password.reset"),
+  emailVerified: event("janus.email.verified")
+};
+var WRITTEN = {
+  signUp: (call, outcome) => {
+    if (outcome.ok)
+      log.info(events.signedUp(userFields(call, outcome.value)));
+  },
+  signIn: (call, outcome) => {
+    if (outcome.ok) {
+      log.info(events.signedIn(userFields(call, outcome.value)));
+    } else {
+      log.warn(events.signInRefused(refusalFields(call, outcome.refusal)));
+    }
+  },
+  signOut: (_call, outcome) => {
+    if (outcome.ok && outcome.value === true)
+      log.info(events.signedOut());
+  },
+  signOutEverywhere: (call, outcome) => {
+    if (outcome.ok)
+      log.info(events.signedOutEverywhere(argumentUser(call)));
+  },
+  delete: (call, outcome) => {
+    if (outcome.ok && outcome.value === true) {
+      log.info(events.userDeleted(argumentUser(call)));
+    }
+  },
+  setActive: (call, outcome) => {
+    if (!outcome.ok)
+      return;
+    const written = call.args[1] === true ? events.userActivated : events.userDeactivated;
+    log.info(written(argumentUser(call)));
+  },
+  changePassword: (call, outcome) => {
+    if (outcome.ok)
+      log.info(events.passwordChanged(argumentUser(call)));
+  },
+  setPassword: (call, outcome) => {
+    if (outcome.ok)
+      log.info(events.passwordSet(argumentUser(call)));
+  },
+  "resetPassword.confirm": (call, outcome) => {
+    if (outcome.ok)
+      log.info(events.passwordReset(userFields(call, outcome.value)));
+  },
+  "verifyEmail.confirm": (call, outcome) => {
+    if (outcome.ok)
+      log.info(events.emailVerified(userFields(call, outcome.value)));
+  }
+};
+function userFields(call, value) {
+  const user = typeof value === "object" && value !== null && "user" in value ? value.user : value;
+  return fieldsOf({
+    "janus.user.type": typeOf(user) ?? call.userType,
+    "user.id": idOf(user)
+  });
+}
+function argumentUser(call) {
+  return fieldsOf({
+    "janus.user.type": call.userType,
+    "user.id": idOf(call.args[0])
+  });
+}
+function refusalFields(call, refusal) {
+  return fieldsOf({
+    "janus.user.type": refusal.userType ?? call.userType,
+    "janus.refusal": refusal.code,
+    "janus.refusal.reason": refusal.reason,
+    "user.id": refusal.userId
+  });
+}
+function answered(scope, call, outcome) {
+  if (outcome.ok) {
+    const fields = userFields(call, outcome.value);
+    for (const [key, value] of Object.entries(fields))
+      scope.attribute(key, value);
+    const value = outcome.value;
+    if (typeof value === "object" && value !== null && "renewed" in value) {
+      scope.attribute("janus.session.renewed", value.renewed === true);
+    }
+  }
+  WRITTEN[call.flow]?.(call, outcome);
+}
+var UNTRACED = new Set(["cookie"]);
+function instrumentJanus(auth) {
+  const types = auth.types.filter((type) => typeof type === "string");
+  const only = types.length === 1 ? types[0] : undefined;
+  return traceObject(auth, [], (path) => path[0] !== undefined && types.includes(path[0]) ? { userType: path[0], flow: path.slice(1) } : { userType: only, flow: path });
+}
+function traceObject(target, path, split) {
+  const copy = {};
+  for (const [key, value] of Object.entries(target)) {
+    if (UNTRACED.has(key)) {
+      copy[key] = value;
+    } else if (typeof value === "function") {
+      copy[key] = traceFunction(value, target, [...path, key], split);
+    } else if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+      copy[key] = traceObject(value, [...path, key], split);
+    } else {
+      copy[key] = value;
+    }
+  }
+  return Object.freeze(copy);
+}
+function traceFunction(fn, self, path, split) {
+  const { userType, flow } = split(path);
+  const name = `janus.${path.join(".")}`;
+  const fields = fieldsOf({ "janus.user.type": userType });
+  return (...args) => {
+    const call = { flow: flow.join("."), userType, args };
+    return traced(name, fields, () => Promise.resolve(fn.apply(self, args)), (scope, outcome) => answered(scope, call, outcome));
+  };
+}
+// src/permissions.ts
+import { createLogger as createLogger2, event as event2 } from "@nxgt/telemetry";
+var log2 = createLogger2("@nxgt/janus");
+var granted = event2("janus.tuple.granted");
+var revoked = event2("janus.tuple.revoked");
+function subjectFields(subject) {
+  const relation = typeof subject === "object" && subject !== null && "relation" in subject ? subject.relation : undefined;
+  return fieldsOf({
+    "janus.subject.type": typeOf(subject),
+    "janus.subject.id": idOf(subject),
+    "janus.subject.relation": typeof relation === "string" ? relation : undefined
+  });
+}
+function objectFields(object) {
+  return fieldsOf({
+    "janus.object.type": typeOf(object),
+    "janus.object.id": idOf(object)
+  });
+}
+var TRACERS = {
+  can: (fn) => (...args) => traced("janus.can", fieldsOf({
+    ...subjectFields(args[0]),
+    "janus.permission": typeof args[1] === "string" ? args[1] : undefined,
+    ...objectFields(args[2])
+  }), () => fn(...args), (scope, outcome) => {
+    if (outcome.ok)
+      scope.attribute("janus.allowed", outcome.value === true);
+  }),
+  list: (fn) => (...args) => traced("janus.list", fieldsOf({
+    ...subjectFields(args[0]),
+    "janus.permission": typeof args[1] === "string" ? args[1] : undefined,
+    "janus.object.type": typeof args[2] === "string" ? args[2] : undefined
+  }), () => fn(...args), (scope, outcome) => {
+    const page = outcome.ok ? outcome.value : undefined;
+    if (typeof page === "object" && page !== null && "items" in page) {
+      const items = page.items;
+      if (Array.isArray(items))
+        scope.attribute("janus.page.items", items.length);
+    }
+  }),
+  grant: (fn) => tupleWrite("janus.grant", granted, fn),
+  revoke: (fn) => tupleWrite("janus.revoke", revoked, fn)
+};
+function tupleWrite(name, written, fn) {
+  return (...args) => {
+    const fields = fieldsOf({
+      ...objectFields(args[0]),
+      "janus.relation": typeof args[1] === "string" ? args[1] : undefined,
+      ...subjectFields(args[2])
+    });
+    return traced(name, fields, () => fn(...args), (_scope, outcome) => {
+      if (outcome.ok)
+        log2.info(written(fields));
+    });
+  };
+}
+function instrumentPermissions(access) {
+  const copy = Object.fromEntries(Object.entries(access));
+  for (const [key, tracer] of Object.entries(TRACERS)) {
+    const method = copy[key];
+    if (typeof method !== "function")
+      continue;
+    copy[key] = tracer((...args) => Promise.resolve(method.apply(access, args)));
+  }
+  return Object.freeze(copy);
+}
+export {
+  instrumentJanus,
+  instrumentPermissions
+};
+
+//# debugId=D02888C2C0C3C5D064756E2164756E21
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/flows.ts", "../src/traced.ts", "../src/permissions.ts"],
+  "sourcesContent": [
+    "import type { JanusError } from '@nxgt/janus';\nimport { createLogger, event, type SpanScope } from '@nxgt/telemetry';\nimport {\n\ttype Fields,\n\tfieldsOf,\n\tidOf,\n\ttype Outcome,\n\ttraced,\n\ttypeOf,\n} from './traced';\n\nconst log = createLogger('@nxgt/janus');\n\n/** The events a security review reads: who signed in, out, up, and what changed. */\nconst events = {\n\tsignedUp: event('janus.signUp'),\n\tsignedIn: event('janus.signIn'),\n\tsignInRefused: event('janus.signIn.refused'),\n\tsignedOut: event('janus.signOut'),\n\tsignedOutEverywhere: event('janus.signOutEverywhere'),\n\tuserDeleted: event('janus.user.deleted'),\n\tuserActivated: event('janus.user.activated'),\n\tuserDeactivated: event('janus.user.deactivated'),\n\tpasswordChanged: event('janus.password.changed'),\n\tpasswordSet: event('janus.password.set'),\n\tpasswordReset: event('janus.password.reset'),\n\temailVerified: event('janus.email.verified'),\n};\n\n/** What `janus()` answers, as far as it is read: its user types and its flows. */\nexport interface JanusLike {\n\treadonly types: readonly string[];\n\treadonly authenticate: (...args: never[]) => Promise<unknown>;\n}\n\n/** One call of a flow, as the events read it. */\ninterface Call {\n\t/** `signIn`, `verifyEmail.confirm`: the flow without the user type. */\n\treadonly flow: string;\n\treadonly userType: string | undefined;\n\treadonly args: readonly unknown[];\n}\n\n/**\n * What each flow writes once it answered. Nothing here reads a login, an\n * e-mail, a password or a token: only user types, ids, codes and reasons.\n */\nconst WRITTEN: Readonly<\n\tRecord<string, (call: Call, outcome: Outcome) => void>\n> = {\n\tsignUp: (call, outcome) => {\n\t\tif (outcome.ok) log.info(events.signedUp(userFields(call, outcome.value)));\n\t},\n\tsignIn: (call, outcome) => {\n\t\tif (outcome.ok) {\n\t\t\tlog.info(events.signedIn(userFields(call, outcome.value)));\n\t\t} else {\n\t\t\tlog.warn(events.signInRefused(refusalFields(call, outcome.refusal)));\n\t\t}\n\t},\n\tsignOut: (_call, outcome) => {\n\t\tif (outcome.ok && outcome.value === true) log.info(events.signedOut());\n\t},\n\tsignOutEverywhere: (call, outcome) => {\n\t\tif (outcome.ok) log.info(events.signedOutEverywhere(argumentUser(call)));\n\t},\n\tdelete: (call, outcome) => {\n\t\tif (outcome.ok && outcome.value === true) {\n\t\t\tlog.info(events.userDeleted(argumentUser(call)));\n\t\t}\n\t},\n\tsetActive: (call, outcome) => {\n\t\tif (!outcome.ok) return;\n\t\tconst written =\n\t\t\tcall.args[1] === true ? events.userActivated : events.userDeactivated;\n\t\tlog.info(written(argumentUser(call)));\n\t},\n\tchangePassword: (call, outcome) => {\n\t\tif (outcome.ok) log.info(events.passwordChanged(argumentUser(call)));\n\t},\n\tsetPassword: (call, outcome) => {\n\t\tif (outcome.ok) log.info(events.passwordSet(argumentUser(call)));\n\t},\n\t'resetPassword.confirm': (call, outcome) => {\n\t\tif (outcome.ok)\n\t\t\tlog.info(events.passwordReset(userFields(call, outcome.value)));\n\t},\n\t'verifyEmail.confirm': (call, outcome) => {\n\t\tif (outcome.ok)\n\t\t\tlog.info(events.emailVerified(userFields(call, outcome.value)));\n\t},\n};\n\n/** The user an answer names — `{ user }` or the user itself — as fields. */\nfunction userFields(call: Call, value: unknown): Fields {\n\tconst user =\n\t\ttypeof value === 'object' && value !== null && 'user' in value\n\t\t\t? value.user\n\t\t\t: value;\n\treturn fieldsOf({\n\t\t'janus.user.type': typeOf(user) ?? call.userType,\n\t\t'user.id': idOf(user),\n\t});\n}\n\n/** The user a flow was called for: its first argument. */\nfunction argumentUser(call: Call): Fields {\n\treturn fieldsOf({\n\t\t'janus.user.type': call.userType,\n\t\t'user.id': idOf(call.args[0]),\n\t});\n}\n\n/** Why a sign-in was refused: the code, the reason, and the user when one holds the login. */\nfunction refusalFields(call: Call, refusal: JanusError): Fields {\n\treturn fieldsOf({\n\t\t'janus.user.type': refusal.userType ?? call.userType,\n\t\t'janus.refusal': refusal.code,\n\t\t'janus.refusal.reason': refusal.reason,\n\t\t'user.id': refusal.userId,\n\t});\n}\n\n/** What a span learns from an answer: whose it is, never what it holds. */\nfunction answered(scope: SpanScope, call: Call, outcome: Outcome): void {\n\tif (outcome.ok) {\n\t\tconst fields = userFields(call, outcome.value);\n\t\tfor (const [key, value] of Object.entries(fields))\n\t\t\tscope.attribute(key, value);\n\t\tconst value = outcome.value;\n\t\tif (typeof value === 'object' && value !== null && 'renewed' in value) {\n\t\t\tscope.attribute('janus.session.renewed', value.renewed === true);\n\t\t}\n\t}\n\tWRITTEN[call.flow]?.(call, outcome);\n}\n\n/** `cookie` answers synchronously: it is the one part of `janus()` not traced. */\nconst UNTRACED = new Set(['cookie']);\n\n/**\n * The same `janus()` instance, with every flow traced — a span per call,\n * named `janus.signIn` or `janus.patient.signIn` — and the events a security\n * review reads written as logs: sign-ups, sign-ins and the reason one was\n * refused, sign-outs, deleted and deactivated users, changed passwords.\n *\n * ```ts\n * const auth = instrumentJanus(janus({ users, store, hasher }));\n * ```\n *\n * **A refusal is an answer**: a wrong password leaves its span `ok`, with\n * `janus.refusal` set, and is a `janus.signIn.refused` warning — never a\n * failed span. A store that cannot answer is one, with `janus.store.slot`.\n *\n * Nothing written carries a login, an e-mail, a password, a token or a\n * session id: user types, user ids, codes and reasons only.\n */\nexport function instrumentJanus<A extends JanusLike>(auth: A): A {\n\tconst types = auth.types.filter((type) => typeof type === 'string');\n\tconst only = types.length === 1 ? types[0] : undefined;\n\treturn traceObject(auth, [], (path) =>\n\t\tpath[0] !== undefined && types.includes(path[0])\n\t\t\t? { userType: path[0], flow: path.slice(1) }\n\t\t\t: { userType: only, flow: path },\n\t);\n}\n\ntype Split = (path: readonly string[]) => {\n\treadonly userType: string | undefined;\n\treadonly flow: readonly string[];\n};\n\n/**\n * A traced copy of `target`, frozen: its functions traced, its plain objects —\n * a user type's flows, `verifyEmail` — copied the same way. A copy rather\n * than a Proxy, which may not answer differently for a frozen property.\n */\nfunction traceObject<O extends object>(\n\ttarget: O,\n\tpath: readonly string[],\n\tsplit: Split,\n): O {\n\tconst copy: Record<string, unknown> = {};\n\tfor (const [key, value] of Object.entries(target)) {\n\t\tif (UNTRACED.has(key)) {\n\t\t\tcopy[key] = value;\n\t\t} else if (typeof value === 'function') {\n\t\t\tcopy[key] = traceFunction(\n\t\t\t\tvalue as (...args: unknown[]) => unknown,\n\t\t\t\ttarget,\n\t\t\t\t[...path, key],\n\t\t\t\tsplit,\n\t\t\t);\n\t\t} else if (\n\t\t\ttypeof value === 'object' &&\n\t\t\tvalue !== null &&\n\t\t\t!Array.isArray(value)\n\t\t) {\n\t\t\tcopy[key] = traceObject(value, [...path, key], split);\n\t\t} else {\n\t\t\tcopy[key] = value;\n\t\t}\n\t}\n\treturn Object.freeze(copy) as O;\n}\n\nfunction traceFunction(\n\tfn: (...args: unknown[]) => unknown,\n\tself: object,\n\tpath: readonly string[],\n\tsplit: Split,\n): (...args: unknown[]) => Promise<unknown> {\n\tconst { userType, flow } = split(path);\n\tconst name = `janus.${path.join('.')}`;\n\tconst fields = fieldsOf({ 'janus.user.type': userType });\n\treturn (...args) => {\n\t\tconst call: Call = { flow: flow.join('.'), userType, args };\n\t\treturn traced(\n\t\t\tname,\n\t\t\tfields,\n\t\t\t() => Promise.resolve(fn.apply(self, args)),\n\t\t\t(scope, outcome) => answered(scope, call, outcome),\n\t\t);\n\t};\n}\n",
+    "import { JanusError, type JanusErrorCode } from '@nxgt/janus';\nimport { type SpanScope, span } from '@nxgt/telemetry';\n\n/**\n * What each code is. A **failure** is the server's to fix, and fails its span;\n * a **refusal** — a wrong password, a taken login, a spent token — is an\n * answer, and leaves it `ok`. Exhaustive, so a new code does not compile until\n * it is classified.\n */\nfunction kindOf(code: JanusErrorCode): 'failure' | 'refusal' {\n\tswitch (code) {\n\t\tcase 'STORE_FAILED':\n\t\tcase 'UNSUPPORTED':\n\t\tcase 'PERMISSION_DEPTH':\n\t\tcase 'HASH_UNSUPPORTED':\n\t\t\treturn 'failure';\n\t\tcase 'NOT_FOUND':\n\t\tcase 'LOGIN_TAKEN':\n\t\tcase 'VERSION_CONFLICT':\n\t\tcase 'USER_INVALID':\n\t\tcase 'PASSWORD_TOO_SHORT':\n\t\tcase 'CREDENTIALS_INVALID':\n\t\tcase 'USER_INACTIVE':\n\t\tcase 'TOKEN_UNKNOWN':\n\t\tcase 'TOKEN_SPENT':\n\t\tcase 'TOKEN_EXPIRED':\n\t\tcase 'TOKEN_STALE':\n\t\tcase 'INVALID_CURSOR':\n\t\t\treturn 'refusal';\n\t}\n}\n\n/** A `JanusError` the caller caused; anything else, or a failure code, is not. */\nexport function isRefusal(error: unknown): error is JanusError {\n\treturn error instanceof JanusError && kindOf(error.code) === 'refusal';\n}\n\n/** What a span or an event carries: scalars only, and never an absent one. */\nexport type Fields = Readonly<Record<string, string | number | boolean>>;\n\n/** `fields` without its `undefined` values. */\nexport function fieldsOf(\n\tfields: Readonly<Record<string, string | number | boolean | undefined>>,\n): Fields {\n\tconst kept: Record<string, string | number | boolean> = {};\n\tfor (const [key, value] of Object.entries(fields)) {\n\t\tif (value !== undefined) kept[key] = value;\n\t}\n\treturn kept;\n}\n\n/** The `id` of a user reference, a subject or an object — or nothing. */\nexport function idOf(value: unknown): string | undefined {\n\tif (typeof value === 'string') return value;\n\tif (typeof value === 'object' && value !== null && 'id' in value) {\n\t\tconst id: unknown = value.id;\n\t\tif (typeof id === 'string') return id;\n\t}\n\treturn undefined;\n}\n\n/** The `type` of a subject or an object — or nothing. */\nexport function typeOf(value: unknown): string | undefined {\n\tif (typeof value === 'object' && value !== null && 'type' in value) {\n\t\tconst type: unknown = value.type;\n\t\tif (typeof type === 'string') return type;\n\t}\n\treturn undefined;\n}\n\n/** How a traced call ended, for what is written after it. */\nexport type Outcome =\n\t| { readonly ok: true; readonly value: unknown }\n\t| { readonly ok: false; readonly refusal: JanusError };\n\n/**\n * Runs `call` in a span. **A refusal is an answer**: the span ends `ok`, with\n * `janus.refusal` set to its code, and the error is rethrown once the span is\n * over. A failure is rethrown inside it, so the span is `error`, with the\n * store slot and operation a `StoreFailure` names.\n *\n * `after` sees the outcome inside the span, outside the flow's `try`, and a\n * throw from it is dropped: telemetry never changes what a flow answers.\n */\nexport async function traced<T>(\n\tname: string,\n\tfields: Fields,\n\tcall: () => Promise<T>,\n\tafter: (scope: SpanScope, outcome: Outcome) => void,\n): Promise<T> {\n\tconst ended = await span(name, { attributes: fields }, async (scope) => {\n\t\tlet outcome: { ok: true; value: T } | { ok: false; refusal: JanusError };\n\t\ttry {\n\t\t\toutcome = { ok: true, value: await call() };\n\t\t} catch (error) {\n\t\t\tif (error instanceof JanusError) {\n\t\t\t\tscope.attribute('janus.error.code', error.code);\n\t\t\t\tif (error.slot !== undefined)\n\t\t\t\t\tscope.attribute('janus.store.slot', error.slot);\n\t\t\t\tif (error.operation !== undefined) {\n\t\t\t\t\tscope.attribute('janus.store.operation', error.operation);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (!isRefusal(error)) throw error;\n\t\t\tscope.attribute('janus.refusal', error.code);\n\t\t\toutcome = { ok: false, refusal: error };\n\t\t}\n\t\ttry {\n\t\t\tafter(scope, outcome);\n\t\t} catch {\n\t\t\t// A signal is never worth a flow's answer.\n\t\t}\n\t\treturn outcome;\n\t});\n\tif (!ended.ok) throw ended.refusal;\n\treturn ended.value;\n}\n",
+    "import { createLogger, event, type TelemetryEvent } from '@nxgt/telemetry';\nimport { type Fields, fieldsOf, idOf, traced, typeOf } from './traced';\n\nconst log = createLogger('@nxgt/janus');\n\n/** The audit trail of who was given what: one event per tuple written. */\nconst granted = event('janus.tuple.granted');\nconst revoked = event('janus.tuple.revoked');\n\n/** A subject — a user, an object, or a subject set — as fields. */\nfunction subjectFields(subject: unknown): Fields {\n\tconst relation =\n\t\ttypeof subject === 'object' && subject !== null && 'relation' in subject\n\t\t\t? subject.relation\n\t\t\t: undefined;\n\treturn fieldsOf({\n\t\t'janus.subject.type': typeOf(subject),\n\t\t'janus.subject.id': idOf(subject),\n\t\t'janus.subject.relation':\n\t\t\ttypeof relation === 'string' ? relation : undefined,\n\t});\n}\n\nfunction objectFields(object: unknown): Fields {\n\treturn fieldsOf({\n\t\t'janus.object.type': typeOf(object),\n\t\t'janus.object.id': idOf(object),\n\t});\n}\n\n/** What `permissions()` answers, as far as it is traced. */\nexport interface PermissionsLike {\n\treadonly can: (...args: never[]) => Promise<boolean>;\n\treadonly list: (...args: never[]) => Promise<unknown>;\n\treadonly grant: (...args: never[]) => Promise<unknown>;\n\treadonly revoke: (...args: never[]) => Promise<unknown>;\n}\n\ntype Traced = (...args: unknown[]) => Promise<unknown>;\n\n/** How each method of `permissions()` is traced. */\nconst TRACERS: Readonly<Record<string, (fn: Traced) => Traced>> = {\n\tcan:\n\t\t(fn) =>\n\t\t(...args) =>\n\t\t\ttraced(\n\t\t\t\t'janus.can',\n\t\t\t\tfieldsOf({\n\t\t\t\t\t...subjectFields(args[0]),\n\t\t\t\t\t'janus.permission': typeof args[1] === 'string' ? args[1] : undefined,\n\t\t\t\t\t...objectFields(args[2]),\n\t\t\t\t}),\n\t\t\t\t() => fn(...args),\n\t\t\t\t(scope, outcome) => {\n\t\t\t\t\tif (outcome.ok)\n\t\t\t\t\t\tscope.attribute('janus.allowed', outcome.value === true);\n\t\t\t\t},\n\t\t\t),\n\tlist:\n\t\t(fn) =>\n\t\t(...args) =>\n\t\t\ttraced(\n\t\t\t\t'janus.list',\n\t\t\t\tfieldsOf({\n\t\t\t\t\t...subjectFields(args[0]),\n\t\t\t\t\t'janus.permission': typeof args[1] === 'string' ? args[1] : undefined,\n\t\t\t\t\t'janus.object.type':\n\t\t\t\t\t\ttypeof args[2] === 'string' ? args[2] : undefined,\n\t\t\t\t}),\n\t\t\t\t() => fn(...args),\n\t\t\t\t(scope, outcome) => {\n\t\t\t\t\tconst page = outcome.ok ? outcome.value : undefined;\n\t\t\t\t\tif (typeof page === 'object' && page !== null && 'items' in page) {\n\t\t\t\t\t\tconst items = page.items;\n\t\t\t\t\t\tif (Array.isArray(items))\n\t\t\t\t\t\t\tscope.attribute('janus.page.items', items.length);\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t),\n\tgrant: (fn) => tupleWrite('janus.grant', granted, fn),\n\trevoke: (fn) => tupleWrite('janus.revoke', revoked, fn),\n};\n\nfunction tupleWrite(\n\tname: string,\n\twritten: (fields: Fields) => TelemetryEvent,\n\tfn: Traced,\n): Traced {\n\treturn (...args) => {\n\t\tconst fields = fieldsOf({\n\t\t\t...objectFields(args[0]),\n\t\t\t'janus.relation': typeof args[1] === 'string' ? args[1] : undefined,\n\t\t\t...subjectFields(args[2]),\n\t\t});\n\t\treturn traced(\n\t\t\tname,\n\t\t\tfields,\n\t\t\t() => fn(...args),\n\t\t\t(_scope, outcome) => {\n\t\t\t\tif (outcome.ok) log.info(written(fields));\n\t\t\t},\n\t\t);\n\t};\n}\n\n/**\n * The same `permissions()` instance, traced: a span per `can` — its subject,\n * permission, object and whether it was allowed — and per `list`, and a\n * `janus.tuple.granted` or `janus.tuple.revoked` event for every tuple\n * written, the audit trail of who was given what.\n *\n * ```ts\n * const access = instrumentPermissions(permissions({ model, store }));\n * ```\n *\n * A denial is an answer, not a failure: `janus.allowed` is `false` and the\n * span is `ok`. A relation store that cannot answer fails the span.\n */\nexport function instrumentPermissions<A extends PermissionsLike>(access: A): A {\n\t// `permissions()` answers a frozen object, which a Proxy may not answer\n\t// differently for: the traced methods go on a copy, frozen in turn.\n\tconst copy: Record<string, unknown> = Object.fromEntries(\n\t\tObject.entries(access),\n\t);\n\tfor (const [key, tracer] of Object.entries(TRACERS)) {\n\t\tconst method: unknown = copy[key];\n\t\tif (typeof method !== 'function') continue;\n\t\tcopy[key] = tracer((...args) =>\n\t\t\tPromise.resolve(method.apply(access, args)),\n\t\t);\n\t}\n\treturn Object.freeze(copy) as A;\n}\n"
+  ],
+  "mappings": ";AACA;;;ACDA;AACA;AAQA,SAAS,MAAM,CAAC,MAA6C;AAAA,EAC5D,QAAQ;AAAA,SACF;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,MACJ,OAAO;AAAA;AAAA;AAKH,SAAS,SAAS,CAAC,OAAqC;AAAA,EAC9D,OAAO,iBAAiB,cAAc,OAAO,MAAM,IAAI,MAAM;AAAA;AAOvD,SAAS,QAAQ,CACvB,QACS;AAAA,EACT,MAAM,OAAkD,CAAC;AAAA,EACzD,YAAY,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;AAAA,IAClD,IAAI,UAAU;AAAA,MAAW,KAAK,OAAO;AAAA,EACtC;AAAA,EACA,OAAO;AAAA;AAID,SAAS,IAAI,CAAC,OAAoC;AAAA,EACxD,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,QAAQ,OAAO;AAAA,IACjE,MAAM,KAAc,MAAM;AAAA,IAC1B,IAAI,OAAO,OAAO;AAAA,MAAU,OAAO;AAAA,EACpC;AAAA,EACA;AAAA;AAIM,SAAS,MAAM,CAAC,OAAoC;AAAA,EAC1D,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,OAAO;AAAA,IACnE,MAAM,OAAgB,MAAM;AAAA,IAC5B,IAAI,OAAO,SAAS;AAAA,MAAU,OAAO;AAAA,EACtC;AAAA,EACA;AAAA;AAiBD,eAAsB,MAAS,CAC9B,MACA,QACA,MACA,OACa;AAAA,EACb,MAAM,QAAQ,MAAM,KAAK,MAAM,EAAE,YAAY,OAAO,GAAG,OAAO,UAAU;AAAA,IACvE,IAAI;AAAA,IACJ,IAAI;AAAA,MACH,UAAU,EAAE,IAAI,MAAM,OAAO,MAAM,KAAK,EAAE;AAAA,MACzC,OAAO,OAAO;AAAA,MACf,IAAI,iBAAiB,YAAY;AAAA,QAChC,MAAM,UAAU,oBAAoB,MAAM,IAAI;AAAA,QAC9C,IAAI,MAAM,SAAS;AAAA,UAClB,MAAM,UAAU,oBAAoB,MAAM,IAAI;AAAA,QAC/C,IAAI,MAAM,cAAc,WAAW;AAAA,UAClC,MAAM,UAAU,yBAAyB,MAAM,SAAS;AAAA,QACzD;AAAA,MACD;AAAA,MACA,IAAI,CAAC,UAAU,KAAK;AAAA,QAAG,MAAM;AAAA,MAC7B,MAAM,UAAU,iBAAiB,MAAM,IAAI;AAAA,MAC3C,UAAU,EAAE,IAAI,OAAO,SAAS,MAAM;AAAA;AAAA,IAEvC,IAAI;AAAA,MACH,MAAM,OAAO,OAAO;AAAA,MACnB,MAAM;AAAA,IAGR,OAAO;AAAA,GACP;AAAA,EACD,IAAI,CAAC,MAAM;AAAA,IAAI,MAAM,MAAM;AAAA,EAC3B,OAAO,MAAM;AAAA;;;ADxGd,IAAM,MAAM,aAAa,aAAa;AAGtC,IAAM,SAAS;AAAA,EACd,UAAU,MAAM,cAAc;AAAA,EAC9B,UAAU,MAAM,cAAc;AAAA,EAC9B,eAAe,MAAM,sBAAsB;AAAA,EAC3C,WAAW,MAAM,eAAe;AAAA,EAChC,qBAAqB,MAAM,yBAAyB;AAAA,EACpD,aAAa,MAAM,oBAAoB;AAAA,EACvC,eAAe,MAAM,sBAAsB;AAAA,EAC3C,iBAAiB,MAAM,wBAAwB;AAAA,EAC/C,iBAAiB,MAAM,wBAAwB;AAAA,EAC/C,aAAa,MAAM,oBAAoB;AAAA,EACvC,eAAe,MAAM,sBAAsB;AAAA,EAC3C,eAAe,MAAM,sBAAsB;AAC5C;AAoBA,IAAM,UAEF;AAAA,EACH,QAAQ,CAAC,MAAM,YAAY;AAAA,IAC1B,IAAI,QAAQ;AAAA,MAAI,IAAI,KAAK,OAAO,SAAS,WAAW,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA;AAAA,EAE1E,QAAQ,CAAC,MAAM,YAAY;AAAA,IAC1B,IAAI,QAAQ,IAAI;AAAA,MACf,IAAI,KAAK,OAAO,SAAS,WAAW,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,IAC1D,EAAO;AAAA,MACN,IAAI,KAAK,OAAO,cAAc,cAAc,MAAM,QAAQ,OAAO,CAAC,CAAC;AAAA;AAAA;AAAA,EAGrE,SAAS,CAAC,OAAO,YAAY;AAAA,IAC5B,IAAI,QAAQ,MAAM,QAAQ,UAAU;AAAA,MAAM,IAAI,KAAK,OAAO,UAAU,CAAC;AAAA;AAAA,EAEtE,mBAAmB,CAAC,MAAM,YAAY;AAAA,IACrC,IAAI,QAAQ;AAAA,MAAI,IAAI,KAAK,OAAO,oBAAoB,aAAa,IAAI,CAAC,CAAC;AAAA;AAAA,EAExE,QAAQ,CAAC,MAAM,YAAY;AAAA,IAC1B,IAAI,QAAQ,MAAM,QAAQ,UAAU,MAAM;AAAA,MACzC,IAAI,KAAK,OAAO,YAAY,aAAa,IAAI,CAAC,CAAC;AAAA,IAChD;AAAA;AAAA,EAED,WAAW,CAAC,MAAM,YAAY;AAAA,IAC7B,IAAI,CAAC,QAAQ;AAAA,MAAI;AAAA,IACjB,MAAM,UACL,KAAK,KAAK,OAAO,OAAO,OAAO,gBAAgB,OAAO;AAAA,IACvD,IAAI,KAAK,QAAQ,aAAa,IAAI,CAAC,CAAC;AAAA;AAAA,EAErC,gBAAgB,CAAC,MAAM,YAAY;AAAA,IAClC,IAAI,QAAQ;AAAA,MAAI,IAAI,KAAK,OAAO,gBAAgB,aAAa,IAAI,CAAC,CAAC;AAAA;AAAA,EAEpE,aAAa,CAAC,MAAM,YAAY;AAAA,IAC/B,IAAI,QAAQ;AAAA,MAAI,IAAI,KAAK,OAAO,YAAY,aAAa,IAAI,CAAC,CAAC;AAAA;AAAA,EAEhE,yBAAyB,CAAC,MAAM,YAAY;AAAA,IAC3C,IAAI,QAAQ;AAAA,MACX,IAAI,KAAK,OAAO,cAAc,WAAW,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA;AAAA,EAEhE,uBAAuB,CAAC,MAAM,YAAY;AAAA,IACzC,IAAI,QAAQ;AAAA,MACX,IAAI,KAAK,OAAO,cAAc,WAAW,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA;AAEjE;AAGA,SAAS,UAAU,CAAC,MAAY,OAAwB;AAAA,EACvD,MAAM,OACL,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QACtD,MAAM,OACN;AAAA,EACJ,OAAO,SAAS;AAAA,IACf,mBAAmB,OAAO,IAAI,KAAK,KAAK;AAAA,IACxC,WAAW,KAAK,IAAI;AAAA,EACrB,CAAC;AAAA;AAIF,SAAS,YAAY,CAAC,MAAoB;AAAA,EACzC,OAAO,SAAS;AAAA,IACf,mBAAmB,KAAK;AAAA,IACxB,WAAW,KAAK,KAAK,KAAK,EAAE;AAAA,EAC7B,CAAC;AAAA;AAIF,SAAS,aAAa,CAAC,MAAY,SAA6B;AAAA,EAC/D,OAAO,SAAS;AAAA,IACf,mBAAmB,QAAQ,YAAY,KAAK;AAAA,IAC5C,iBAAiB,QAAQ;AAAA,IACzB,wBAAwB,QAAQ;AAAA,IAChC,WAAW,QAAQ;AAAA,EACpB,CAAC;AAAA;AAIF,SAAS,QAAQ,CAAC,OAAkB,MAAY,SAAwB;AAAA,EACvE,IAAI,QAAQ,IAAI;AAAA,IACf,MAAM,SAAS,WAAW,MAAM,QAAQ,KAAK;AAAA,IAC7C,YAAY,KAAK,UAAU,OAAO,QAAQ,MAAM;AAAA,MAC/C,MAAM,UAAU,KAAK,KAAK;AAAA,IAC3B,MAAM,QAAQ,QAAQ;AAAA,IACtB,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,aAAa,OAAO;AAAA,MACtE,MAAM,UAAU,yBAAyB,MAAM,YAAY,IAAI;AAAA,IAChE;AAAA,EACD;AAAA,EACA,QAAQ,KAAK,QAAQ,MAAM,OAAO;AAAA;AAInC,IAAM,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC;AAmB5B,SAAS,eAAoC,CAAC,MAAY;AAAA,EAChE,MAAM,QAAQ,KAAK,MAAM,OAAO,CAAC,SAAS,OAAO,SAAS,QAAQ;AAAA,EAClE,MAAM,OAAO,MAAM,WAAW,IAAI,MAAM,KAAK;AAAA,EAC7C,OAAO,YAAY,MAAM,CAAC,GAAG,CAAC,SAC7B,KAAK,OAAO,aAAa,MAAM,SAAS,KAAK,EAAE,IAC5C,EAAE,UAAU,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,IACzC,EAAE,UAAU,MAAM,MAAM,KAAK,CACjC;AAAA;AAaD,SAAS,WAA6B,CACrC,QACA,MACA,OACI;AAAA,EACJ,MAAM,OAAgC,CAAC;AAAA,EACvC,YAAY,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;AAAA,IAClD,IAAI,SAAS,IAAI,GAAG,GAAG;AAAA,MACtB,KAAK,OAAO;AAAA,IACb,EAAO,SAAI,OAAO,UAAU,YAAY;AAAA,MACvC,KAAK,OAAO,cACX,OACA,QACA,CAAC,GAAG,MAAM,GAAG,GACb,KACD;AAAA,IACD,EAAO,SACN,OAAO,UAAU,YACjB,UAAU,QACV,CAAC,MAAM,QAAQ,KAAK,GACnB;AAAA,MACD,KAAK,OAAO,YAAY,OAAO,CAAC,GAAG,MAAM,GAAG,GAAG,KAAK;AAAA,IACrD,EAAO;AAAA,MACN,KAAK,OAAO;AAAA;AAAA,EAEd;AAAA,EACA,OAAO,OAAO,OAAO,IAAI;AAAA;AAG1B,SAAS,aAAa,CACrB,IACA,MACA,MACA,OAC2C;AAAA,EAC3C,QAAQ,UAAU,SAAS,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,SAAS,KAAK,KAAK,GAAG;AAAA,EACnC,MAAM,SAAS,SAAS,EAAE,mBAAmB,SAAS,CAAC;AAAA,EACvD,OAAO,IAAI,SAAS;AAAA,IACnB,MAAM,OAAa,EAAE,MAAM,KAAK,KAAK,GAAG,GAAG,UAAU,KAAK;AAAA,IAC1D,OAAO,OACN,MACA,QACA,MAAM,QAAQ,QAAQ,GAAG,MAAM,MAAM,IAAI,CAAC,GAC1C,CAAC,OAAO,YAAY,SAAS,OAAO,MAAM,OAAO,CAClD;AAAA;AAAA;;AE9NF,yBAAS,wBAAc;AAGvB,IAAM,OAAM,cAAa,aAAa;AAGtC,IAAM,UAAU,OAAM,qBAAqB;AAC3C,IAAM,UAAU,OAAM,qBAAqB;AAG3C,SAAS,aAAa,CAAC,SAA0B;AAAA,EAChD,MAAM,WACL,OAAO,YAAY,YAAY,YAAY,QAAQ,cAAc,UAC9D,QAAQ,WACR;AAAA,EACJ,OAAO,SAAS;AAAA,IACf,sBAAsB,OAAO,OAAO;AAAA,IACpC,oBAAoB,KAAK,OAAO;AAAA,IAChC,0BACC,OAAO,aAAa,WAAW,WAAW;AAAA,EAC5C,CAAC;AAAA;AAGF,SAAS,YAAY,CAAC,QAAyB;AAAA,EAC9C,OAAO,SAAS;AAAA,IACf,qBAAqB,OAAO,MAAM;AAAA,IAClC,mBAAmB,KAAK,MAAM;AAAA,EAC/B,CAAC;AAAA;AAcF,IAAM,UAA4D;AAAA,EACjE,KACC,CAAC,OACD,IAAI,SACH,OACC,aACA,SAAS;AAAA,OACL,cAAc,KAAK,EAAE;AAAA,IACxB,oBAAoB,OAAO,KAAK,OAAO,WAAW,KAAK,KAAK;AAAA,OACzD,aAAa,KAAK,EAAE;AAAA,EACxB,CAAC,GACD,MAAM,GAAG,GAAG,IAAI,GAChB,CAAC,OAAO,YAAY;AAAA,IACnB,IAAI,QAAQ;AAAA,MACX,MAAM,UAAU,iBAAiB,QAAQ,UAAU,IAAI;AAAA,GAE1D;AAAA,EACF,MACC,CAAC,OACD,IAAI,SACH,OACC,cACA,SAAS;AAAA,OACL,cAAc,KAAK,EAAE;AAAA,IACxB,oBAAoB,OAAO,KAAK,OAAO,WAAW,KAAK,KAAK;AAAA,IAC5D,qBACC,OAAO,KAAK,OAAO,WAAW,KAAK,KAAK;AAAA,EAC1C,CAAC,GACD,MAAM,GAAG,GAAG,IAAI,GAChB,CAAC,OAAO,YAAY;AAAA,IACnB,MAAM,OAAO,QAAQ,KAAK,QAAQ,QAAQ;AAAA,IAC1C,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,WAAW,MAAM;AAAA,MACjE,MAAM,QAAQ,KAAK;AAAA,MACnB,IAAI,MAAM,QAAQ,KAAK;AAAA,QACtB,MAAM,UAAU,oBAAoB,MAAM,MAAM;AAAA,IAClD;AAAA,GAEF;AAAA,EACF,OAAO,CAAC,OAAO,WAAW,eAAe,SAAS,EAAE;AAAA,EACpD,QAAQ,CAAC,OAAO,WAAW,gBAAgB,SAAS,EAAE;AACvD;AAEA,SAAS,UAAU,CAClB,MACA,SACA,IACS;AAAA,EACT,OAAO,IAAI,SAAS;AAAA,IACnB,MAAM,SAAS,SAAS;AAAA,SACpB,aAAa,KAAK,EAAE;AAAA,MACvB,kBAAkB,OAAO,KAAK,OAAO,WAAW,KAAK,KAAK;AAAA,SACvD,cAAc,KAAK,EAAE;AAAA,IACzB,CAAC;AAAA,IACD,OAAO,OACN,MACA,QACA,MAAM,GAAG,GAAG,IAAI,GAChB,CAAC,QAAQ,YAAY;AAAA,MACpB,IAAI,QAAQ;AAAA,QAAI,KAAI,KAAK,QAAQ,MAAM,CAAC;AAAA,KAE1C;AAAA;AAAA;AAiBK,SAAS,qBAAgD,CAAC,QAAc;AAAA,EAG9E,MAAM,OAAgC,OAAO,YAC5C,OAAO,QAAQ,MAAM,CACtB;AAAA,EACA,YAAY,KAAK,WAAW,OAAO,QAAQ,OAAO,GAAG;AAAA,IACpD,MAAM,SAAkB,KAAK;AAAA,IAC7B,IAAI,OAAO,WAAW;AAAA,MAAY;AAAA,IAClC,KAAK,OAAO,OAAO,IAAI,SACtB,QAAQ,QAAQ,OAAO,MAAM,QAAQ,IAAI,CAAC,CAC3C;AAAA,EACD;AAAA,EACA,OAAO,OAAO,OAAO,IAAI;AAAA;",
+  "debugId": "D02888C2C0C3C5D064756E2164756E21",
+  "names": []
+}

package/dist/permissions.d.ts

@@ -0,0 +1,22 @@
+/** What `permissions()` answers, as far as it is traced. */
+export interface PermissionsLike {
+    readonly can: (...args: never[]) => Promise<boolean>;
+    readonly list: (...args: never[]) => Promise<unknown>;
+    readonly grant: (...args: never[]) => Promise<unknown>;
+    readonly revoke: (...args: never[]) => Promise<unknown>;
+}
+/**
+ * The same `permissions()` instance, traced: a span per `can` — its subject,
+ * permission, object and whether it was allowed — and per `list`, and a
+ * `janus.tuple.granted` or `janus.tuple.revoked` event for every tuple
+ * written, the audit trail of who was given what.
+ *
+ * ```ts
+ * const access = instrumentPermissions(permissions({ model, store }));
+ * ```
+ *
+ * A denial is an answer, not a failure: `janus.allowed` is `false` and the
+ * span is `ok`. A relation store that cannot answer fails the span.
+ */
+export declare function instrumentPermissions<A extends PermissionsLike>(access: A): A;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AA8BA,4DAA4D;AAC5D,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAqED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,eAAe,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAc7E"}

package/dist/traced.d.ts

@@ -0,0 +1,31 @@
+import { JanusError } from '@nxgt/janus';
+import { type SpanScope } from '@nxgt/telemetry';
+/** A `JanusError` the caller caused; anything else, or a failure code, is not. */
+export declare function isRefusal(error: unknown): error is JanusError;
+/** What a span or an event carries: scalars only, and never an absent one. */
+export type Fields = Readonly<Record<string, string | number | boolean>>;
+/** `fields` without its `undefined` values. */
+export declare function fieldsOf(fields: Readonly<Record<string, string | number | boolean | undefined>>): Fields;
+/** The `id` of a user reference, a subject or an object — or nothing. */
+export declare function idOf(value: unknown): string | undefined;
+/** The `type` of a subject or an object — or nothing. */
+export declare function typeOf(value: unknown): string | undefined;
+/** How a traced call ended, for what is written after it. */
+export type Outcome = {
+    readonly ok: true;
+    readonly value: unknown;
+} | {
+    readonly ok: false;
+    readonly refusal: JanusError;
+};
+/**
+ * Runs `call` in a span. **A refusal is an answer**: the span ends `ok`, with
+ * `janus.refusal` set to its code, and the error is rethrown once the span is
+ * over. A failure is rethrown inside it, so the span is `error`, with the
+ * store slot and operation a `StoreFailure` names.
+ *
+ * `after` sees the outcome inside the span, outside the flow's `try`, and a
+ * throw from it is dropped: telemetry never changes what a flow answers.
+ */
+export declare function traced<T>(name: string, fields: Fields, call: () => Promise<T>, after: (scope: SpanScope, outcome: Outcome) => void): Promise<T>;
+//# sourceMappingURL=traced.d.ts.map

package/dist/traced.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traced.d.ts","sourceRoot":"","sources":["../src/traced.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAuB,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,KAAK,SAAS,EAAQ,MAAM,iBAAiB,CAAC;AA+BvD,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAE7D;AAED,8EAA8E;AAC9E,MAAM,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;AAEzE,+CAA+C;AAC/C,wBAAgB,QAAQ,CACvB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC,GACrE,MAAM,CAMR;AAED,yEAAyE;AACzE,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAOvD;AAED,yDAAyD;AACzD,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAMzD;AAED,6DAA6D;AAC7D,MAAM,MAAM,OAAO,GAChB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC;AAExD;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAAC,CAAC,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACtB,KAAK,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,GACjD,OAAO,CAAC,CAAC,CAAC,CA2BZ"}

package/docs/README.md

@@ -0,0 +1,14 @@
+# @nxgt/janus-telemetry — documentation
+
+The [README](../README.md) lists every span and event; these pages give the
+detail.
+
+| Page | Read it when |
+| --- | --- |
+| [Tracing Janus](guide/tracing.md) | You are wiring it into an application, or reading what it wrote |
+| [Troubleshooting](troubleshooting.md) | A span or an event is missing, or says something you did not expect |
+| [Roadmap](roadmap.md) | You want to know what is coming, what shipped, and what is deliberately not planned |
+
+The words — user, session, object, permission, refusal, failure — are
+[`@nxgt/janus`'s vocabulary](https://github.com/softistx/nxgt-janus/blob/develop/packages/janus/docs/guide/vocabulary.md),
+and mean the same here.

package/docs/guide/tracing.md

@@ -0,0 +1,117 @@
+# Tracing Janus
+
+This page is for making what `@nxgt/janus` does visible — its flows as spans,
+its security events as logs — in an application that already installs
+`@nxgt/telemetry`.
+
+## Wiring
+
+Wrap the instances where they are created, and export only the wrapped ones:
+
+```ts
+// auth.ts
+import { janus, scryptHasher } from '@nxgt/janus';
+import { defineModel, permissions } from '@nxgt/janus/permissions';
+import { createMongoAdapter } from '@nxgt/janus-mongo';
+import { instrumentJanus, instrumentPermissions } from '@nxgt/janus-telemetry';
+
+const mongo = createMongoAdapter(db);
+
+export const auth = instrumentJanus(
+	janus({ users, hasher: scryptHasher(), ...mongo }),
+);
+
+export const access = instrumentPermissions(
+	permissions({ model: defineModel({ subjects: auth.types, types }), store: mongo.relations }),
+);
+```
+
+`auth.types` reads the same through the wrapper, so the model is defined from
+the wrapped instance as from the plain one.
+
+With Hono, `@nxgt/telemetry-hono` opens a server span per request, and every
+flow a route calls nests under it:
+
+```ts
+import { telemetry } from '@nxgt/telemetry-hono';
+import { bindJanus } from '@nxgt/janus-hono';
+
+const j = bindJanus({ auth, access });
+
+const app = new Hono()
+	.use(telemetry({ service: 'clinic' }), j.session(), j.provide())
+	.get('/records/:id', j.permission('view', 'record', recordOf), (c) => c.json(c.var.object));
+```
+
+A request to `/records/r1` is then one trace:
+
+```
+GET /records/:id                         server
+├─ janus.authenticate                    user.id, janus.user.type, janus.session.renewed
+└─ janus.can                             janus.permission=view, janus.object.id=r1, janus.allowed=true
+```
+
+## Refusals and failures
+
+A span answers one question: **did Janus work?** A wrong password is Janus
+working — it answered a refusal — so the span is `ok` and carries
+`janus.refusal: 'CREDENTIALS_INVALID'`. A store that cannot answer is Janus
+failing, so the span is `error`, with the store named:
+
+```
+janus.patient.signIn   error   janus.error.code=STORE_FAILED  janus.store.slot=users  janus.store.operation=findUserByLogin
+```
+
+The failures are `STORE_FAILED`, `UNSUPPORTED`, `PERMISSION_DEPTH`,
+`HASH_UNSUPPORTED`, and anything thrown that is not a `JanusError`. Every other
+code is a refusal. An alert on failed `janus.*` spans therefore fires on an
+outage, never on users mistyping their password.
+
+## The audit trail
+
+The events are logs, from the source `@nxgt/janus`, written inside the flow's
+span — so each carries its `traceId`, and the request that caused it is one
+query away. Refused sign-ins are **warnings**; everything else is info:
+
+```ts
+// Every refused sign-in of the last hour, in a collector that stores logs:
+// name = 'janus.signIn.refused' AND at > now() - 1h, grouped by janus.refusal.reason
+```
+
+`janus.tuple.granted` and `janus.tuple.revoked` are the record of who was
+given what:
+
+```
+janus.tuple.granted   janus.object.type=record  janus.object.id=r1  janus.relation=owners  janus.subject.type=patient  janus.subject.id=u1
+```
+
+## What is never written
+
+A login, an e-mail, a password, a session token, a one-time token, a session id — nothing a log reader
+could sign in with, or use to tell who holds an account. A refused sign-in by
+an unknown login says `janus.refusal.reason: 'unknownLogin'`, not which login
+was tried; only `USER_INACTIVE` names the user, whose password was right.
+The spec that holds this runs every flow and searches every signal
+for each of them.
+
+## In a test
+
+Give the test a telemetry of its own, as `@nxgt/telemetry` recommends, and read
+what it received:
+
+```ts
+import { createTelemetry, type Signal, withTelemetry } from '@nxgt/telemetry';
+
+const received: Signal[] = [];
+const telemetry = createTelemetry('test', {
+	exporters: [{ export: (_resource, batch) => void received.push(...batch) }],
+});
+await withTelemetry(telemetry, () => auth.patient.signIn({ email, password }));
+await telemetry.close(); // flushes
+received.find((signal) => signal.name === 'janus.signIn'); // the event
+```
+
+## See also
+
+- [`@nxgt/telemetry`](https://www.npmjs.com/package/@nxgt/telemetry) — installing a telemetry, exporters, sampling
+- [`@nxgt/janus-hono`](https://www.npmjs.com/package/@nxgt/janus-hono) — the routes these flows run in

package/docs/roadmap.md

@@ -0,0 +1,35 @@
+# Roadmap
+
+Where `@nxgt/janus-telemetry` is heading. A direction, not a commitment: there
+are no dates here, and the version something shipped in is the only number.
+
+## Now
+
+Nothing yet.
+
+## Next
+
+Nothing yet.
+
+## Later
+
+- **Metrics** — sign-ins, refusals and checks as counters, once
+  `@nxgt/telemetry` carries metrics as a third signal.
+- **Store spans** — a span per store call, for an adapter with no
+  instrumentation of its own. MongoDB has one:
+  `@nxgt/telemetry-mongo`'s `instrumentMongo`.
+
+## Not planned
+
+- **An OpenTelemetry SDK** — like `@nxgt/telemetry`, it speaks OTLP through its
+  exporters and depends on no `@opentelemetry/*` package.
+- **Writing a login, an e-mail, a password, a session token, a one-time token
+  or a session id** — in any span or event, on any setting.
+- **`moduleResolution: "nodenext"`** — like `@nxgt/janus`, the package imports
+  without extensions. Use `"moduleResolution": "bundler"`.
+
+## Shipped
+
+- **The first release, v0.1.0** — `instrumentJanus` and
+  `instrumentPermissions`: a span per flow and per permission check, and the
+  security events worth an audit trail.

package/docs/troubleshooting.md

@@ -0,0 +1,86 @@
+# Troubleshooting `@nxgt/janus-telemetry`
+
+Each entry is headed by what you see. This package defines no error class and
+throws nothing of its own: an error that reaches you is `@nxgt/janus`'s, as it
+would be without it.
+
+## Index
+
+- [No `janus.*` span or event at all](#no-janus-span-or-event-at-all)
+- [Some routes are traced, others not](#some-routes-are-traced-others-not)
+- [`TypeError: Cannot add property …, object is not extensible` (Node), `Attempting to define property on object that is not extensible.` (Bun)](#typeerror-cannot-add-property--object-is-not-extensible)
+- [A wrong password does not fail the span](#a-wrong-password-does-not-fail-the-span)
+- [`janus.signIn.refused` has no `user.id`](#janussigninrefused-has-no-userid)
+- [Every wrong password fails its span](#every-wrong-password-fails-its-span)
+
+### No `janus.*` span or event at all
+
+**When:** the flows answer, and the exporter receives nothing from them.
+
+**Why:** no telemetry is installed, or the flows run outside it. Without one,
+`@nxgt/telemetry` drops signals in silence, by design.
+
+**Fix:** install one at startup, before the first request.
+
+```ts
+createTelemetry('clinic', { exporters: [consoleExporter()] }).install();
+```
+
+### Some routes are traced, others not
+
+**When:** `janus.*` spans appear for some requests only.
+
+**Why:** those routes use the unwrapped instance — imported from where
+`janus()` was called, rather than the wrapped export.
+
+**Fix:** export only the wrapped instance, and create it once:
+`export const auth = instrumentJanus(janus({ … }))`.
+
+### `TypeError: Cannot add property …, object is not extensible`
+
+Under Bun: `TypeError: Attempting to define property on object that is not
+extensible.`
+
+**When:** assigning to the instance `instrumentJanus` or
+`instrumentPermissions` answered.
+
+**Why:** they answer a frozen copy, as `permissions()` itself does.
+
+**Fix:** keep what you want to add beside the instance, not on it.
+
+### A wrong password does not fail the span
+
+**When:** a `janus.signIn` span is `ok` although the sign-in threw
+`CREDENTIALS_INVALID`.
+
+**Why:** a refusal is an answer — Janus worked. The span carries
+`janus.refusal`, and the `janus.signIn.refused` warning says why. Only a
+failure, such as `STORE_FAILED`, fails a span.
+
+**Fix:** nothing. Query `janus.refusal` or the warning to count refusals.
+
+### `janus.signIn.refused` has no `user.id`
+
+**When:** a sign-in refused with `CREDENTIALS_INVALID` carries the reason and
+the user type, and no user. (`USER_INACTIVE` does carry `user.id`: the
+password was right, so the user is known.)
+
+**Why:** the error `@nxgt/janus` throws for bad credentials names no user —
+`unknownLogin` has none to name, and the others do not say which, so a
+response cannot tell which accounts exist. The login tried is never written.
+
+**Fix:** to count refusals per account, do it where the login is known — in
+your sign-in route, from the request — not from telemetry.
+
+### Every wrong password fails its span
+
+**When:** `janus.signIn` spans fail with `janus.error.code` absent, for
+refusals such as `CREDENTIALS_INVALID`.
+
+**Why:** two copies of `@nxgt/janus` are installed — the application's and
+another one, nested under a dependency. A refusal is recognised with
+`instanceof JanusError`, which fails across copies, so it is taken for a
+failure.
+
+**Fix:** keep one copy: `bun pm ls | grep @nxgt/janus` should print one
+version. Align the versions, or dedupe the lockfile.

package/package.json

@@ -0,0 +1,62 @@
+{
+	"name": "@nxgt/janus-telemetry",
+	"version": "0.1.0",
+	"description": "Observability for @nxgt/janus on @nxgt/telemetry: a span per flow and per permission check, and the security events worth an audit trail — never a login, an e-mail, a password, a session token, a one-time token or a session id",
+	"license": "MIT",
+	"type": "module",
+	"main": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"files": [
+		"dist",
+		"docs",
+		"README.md",
+		"package.json",
+		"LICENSE"
+	],
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"import": "./dist/index.js",
+			"default": "./dist/index.js"
+		},
+		"./package.json": "./package.json"
+	},
+	"keywords": [
+		"identity",
+		"authentication",
+		"observability",
+		"telemetry",
+		"janus",
+		"typescript"
+	],
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/softistx/nxgt-janus.git",
+		"directory": "packages/janus-telemetry"
+	},
+	"publishConfig": {
+		"registry": "https://registry.npmjs.org",
+		"access": "public"
+	},
+	"scripts": {
+		"build": "bun run ../../build.ts",
+		"test": "bun test src",
+		"typecheck": "tsc --noEmit"
+	},
+	"nxgt": {
+		"entrypoints": [
+			"src/index.ts"
+		]
+	},
+	"devDependencies": {
+		"@nxgt/janus": "^0.2.2",
+		"@nxgt/telemetry": "0.2.1",
+		"@types/bun": "^1.4.2",
+		"zod": "^4.6.5"
+	},
+	"peerDependencies": {
+		"@nxgt/janus": "^0.2.2",
+		"@nxgt/telemetry": "^0.2.1",
+		"typescript": "^6.0.3"
+	}
+}