@gatwech/auth 1.0.0-beta.18 → 1.0.0-beta.19

package/dist/sentinel-C-D1IHJo.mjs

@@ -0,0 +1,1395 @@
+import { t as getIp } from "./get-request-ip-DSjrEpGo.mjs";
+import { t as safeJSONParse } from "./json-D0TBLy4q.mjs";
+import { n as deleteSessionCookie } from "./cookies-BuvlgcA-.mjs";
+import { n as mergeSchema } from "./date-CMr04reD.mjs";
+import { a as CREDENTIAL_SIGN_IN_PATHS, c as SIGN_IN_PATHS, l as VERIFICATION_PATHS, s as SECURITY_EVENT_TYPES, t as getAuditRecorder } from "./registry-CqG_3Qnx.mjs";
+import { t as getPasswordBreachCount } from "./haveibeenpwned-CzNda7Tn.mjs";
+import { c as verifySolution, i as createNonce, n as POW_REASON_HEADER, o as parsePowHeader, r as POW_SOLUTION_HEADER, t as POW_CHALLENGE_HEADER } from "./pow-OK01yPG3.mjs";
+import { env } from "@gatwech/core/env";
+import { PayvoAuthError } from "@gatwech/core/error";
+import { defineErrorCodes } from "@gatwech/core/utils";
+import { APIError } from "better-call";
+import { createAuthMiddleware } from "@gatwech/core/api";
+import { betterFetch } from "@better-fetch/fetch";
+
+//#region src/plugins/sentinel/actions.ts
+const CHALLENGE_TTL_MS = 6e4;
+/**
+* Applies a security action: records the event and decides whether the
+* request continues, gets a proof-of-work challenge or is blocked
+*/
+async function executeAction(params) {
+	const { auth, event, action, reason } = params;
+	const recorder = getAuditRecorder(auth);
+	const record = async (eventType, status) => {
+		if (!recorder) {
+			auth.logger.warn(`[sentinel] ${reason}: ${status}`, params.metadata);
+			return;
+		}
+		await recorder(event, {
+			eventType,
+			status,
+			userId: params.userId ?? null,
+			identifier: params.identifier ?? null,
+			ipAddress: params.ipAddress,
+			visitorId: params.visitorId,
+			eventData: {
+				reason,
+				action,
+				...params.metadata
+			}
+		});
+	};
+	if (action === "log") {
+		await record(params.eventType, "success");
+		return { outcome: "allow" };
+	}
+	if (action === "challenge") {
+		if (params.challengePassed) {
+			await record(SECURITY_EVENT_TYPES.ALLOWED_AFTER_CHALLENGE, "success");
+			return { outcome: "allow" };
+		}
+		const nonce = createNonce();
+		try {
+			await params.store.saveChallenge({
+				nonce,
+				difficulty: params.difficulty,
+				reason,
+				ipAddress: params.ipAddress,
+				visitorId: params.visitorId,
+				expiresAt: new Date(Date.now() + CHALLENGE_TTL_MS)
+			});
+		} catch (e) {
+			auth.logger.error("[sentinel] Failed to save challenge", e);
+		}
+		await record(params.eventType, "challenged");
+		return {
+			outcome: "challenge",
+			reason,
+			nonce,
+			difficulty: params.difficulty
+		};
+	}
+	await record(params.eventType, "blocked");
+	await record(SECURITY_EVENT_TYPES.BLOCKED, "blocked");
+	return {
+		outcome: "block",
+		reason
+	};
+}
+function challengeHeaders(decision) {
+	return {
+		[POW_CHALLENGE_HEADER]: `${decision.nonce}:${decision.difficulty}`,
+		[POW_REASON_HEADER]: decision.reason,
+		"access-control-expose-headers": `${POW_CHALLENGE_HEADER}, ${POW_REASON_HEADER}`
+	};
+}
+const SENTINEL_ERROR_CODES = defineErrorCodes({
+	POW_CHALLENGE_REQUIRED: "Challenge required",
+	SECURITY_BLOCKED: "Request blocked for security reasons"
+});
+/** The error for a decision, or null when the request is allowed */
+function errorForDecision(decision) {
+	if (decision.outcome === "allow") return null;
+	if (decision.outcome === "challenge") return new APIError("LOCKED", {
+		message: SENTINEL_ERROR_CODES.POW_CHALLENGE_REQUIRED,
+		code: "POW_CHALLENGE_REQUIRED",
+		challenge: {
+			nonce: decision.nonce,
+			difficulty: decision.difficulty,
+			reason: decision.reason
+		}
+	}, challengeHeaders(decision));
+	return new APIError("FORBIDDEN", {
+		message: SENTINEL_ERROR_CODES.SECURITY_BLOCKED,
+		code: "SECURITY_BLOCKED",
+		reason: decision.reason
+	});
+}
+/** Throws the error for a decision, for use in endpoint hooks */
+function throwForDecision(decision) {
+	const error = errorForDecision(decision);
+	if (error) throw error;
+}
+/** Builds the response for a decision, for use in `onRequest` */
+function responseForDecision(decision) {
+	if (decision.outcome === "allow") return void 0;
+	if (decision.outcome === "challenge") return new Response(JSON.stringify({
+		message: SENTINEL_ERROR_CODES.POW_CHALLENGE_REQUIRED,
+		code: "POW_CHALLENGE_REQUIRED",
+		challenge: {
+			nonce: decision.nonce,
+			difficulty: decision.difficulty,
+			reason: decision.reason
+		}
+	}), {
+		status: 423,
+		headers: {
+			"content-type": "application/json",
+			...challengeHeaders(decision)
+		}
+	});
+	return new Response(JSON.stringify({
+		message: SENTINEL_ERROR_CODES.SECURITY_BLOCKED,
+		code: "SECURITY_BLOCKED",
+		reason: decision.reason
+	}), {
+		status: 403,
+		headers: { "content-type": "application/json" }
+	});
+}
+
+//#endregion
+//#region src/plugins/sentinel/email.ts
+const GMAIL_DOMAINS = new Set(["gmail.com", "googlemail.com"]);
+/**
+* Providers that deliver `user+tag@domain` to `user@domain`, so the tag can be
+* dropped without changing the mailbox
+*/
+const PLUS_ADDRESSING_DOMAINS = new Set([
+	"gmail.com",
+	"googlemail.com",
+	"outlook.com",
+	"hotmail.com",
+	"live.com",
+	"msn.com",
+	"icloud.com",
+	"me.com",
+	"mac.com",
+	"protonmail.com",
+	"proton.me",
+	"pm.me",
+	"fastmail.com",
+	"zoho.com"
+]);
+/**
+* Normalizes an email address so aliases of the same mailbox match:
+* lowercases it, maps `googlemail.com` to `gmail.com`, removes dots in Gmail
+* addresses and strips plus-address tags on providers that support them
+*/
+function normalizeEmail(email) {
+	const trimmed = email.trim().toLowerCase();
+	const at = trimmed.lastIndexOf("@");
+	if (at < 1 || at === trimmed.length - 1) return trimmed;
+	let local = trimmed.slice(0, at);
+	let domain = trimmed.slice(at + 1);
+	if (domain === "googlemail.com") domain = "gmail.com";
+	if (PLUS_ADDRESSING_DOMAINS.has(domain)) local = local.split("+")[0];
+	if (GMAIL_DOMAINS.has(domain)) local = local.replace(/\./g, "");
+	return local ? `${local}@${domain}` : trimmed;
+}
+function getEmailDomain(email) {
+	const at = email.lastIndexOf("@");
+	return at < 0 ? "" : email.slice(at + 1).trim().toLowerCase();
+}
+let disposableDomains;
+/**
+* Whether a domain, or any parent domain, is a known disposable email
+* provider. The list is loaded on first use.
+*/
+async function isDisposableDomain(domain) {
+	disposableDomains ??= import("disposable-email-domains-js").then((module) => module.isDisposableEmailDomain);
+	const isDisposable = await disposableDomains;
+	const labels = domain.split(".");
+	for (let i = 0; i < labels.length - 1; i++) if (isDisposable(labels.slice(i).join("."))) return true;
+	return false;
+}
+/**
+* Whether a domain has at least one MX record. Returns null when the lookup
+* isn't possible, e.g. on runtimes without DNS access.
+*/
+async function hasMxRecords(domain) {
+	let dns;
+	try {
+		dns = await import("node:dns/promises");
+	} catch {
+		return null;
+	}
+	try {
+		return (await dns.resolveMx(domain)).length > 0;
+	} catch (e) {
+		const code = e.code;
+		if (code === "ENOTFOUND" || code === "ENODATA" || code === "ENOTIMP") return false;
+		return null;
+	}
+}
+/**
+* Heuristics for addresses that look generated rather than chosen by a
+* person
+*/
+function looksGenerated(email) {
+	const at = email.lastIndexOf("@");
+	const local = email.slice(0, at);
+	const domainName = email.slice(at + 1).split(".").slice(0, -1).join(".");
+	const letters = local.replace(/[^a-z]/gi, "");
+	return /\d{5,}/.test(local) || /\d{4,}/.test(domainName) || local.length >= 12 && letters.length / local.length < .4 || /(?:[a-z]\d){5,}/i.test(local) || /^[0-9a-f]{16,}$/i.test(local);
+}
+
+//#endregion
+//#region src/plugins/sentinel/geo.ts
+const EARTH_RADIUS_KM = 6371;
+const toRadians = (degrees) => degrees * Math.PI / 180;
+/** Great-circle distance between two coordinates, in kilometres */
+function haversineDistanceKm(from, to) {
+	const dLat = toRadians(to.latitude - from.latitude);
+	const dLon = toRadians(to.longitude - from.longitude);
+	const a = Math.sin(dLat / 2) ** 2 + Math.cos(toRadians(from.latitude)) * Math.cos(toRadians(to.latitude)) * Math.sin(dLon / 2) ** 2;
+	return EARTH_RADIUS_KM * 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1 - a));
+}
+/**
+* Speed needed to travel between two sign-ins, in km/h. Distances under
+* 50 km are treated as the same place, since IP geolocation isn't precise
+* enough to tell them apart.
+*/
+function travelSpeedKmh(from, to) {
+	const distance = haversineDistanceKm(from, to);
+	if (distance < 50) return 0;
+	return distance / (Math.max(Math.abs(to.at.getTime() - from.at.getTime()), 6e4) / 36e5);
+}
+
+//#endregion
+//#region src/plugins/sentinel/intel.ts
+const BOT_USER_AGENT = /bot|crawl|spider|slurp|headless|phantomjs|selenium|puppeteer|playwright|curl|wget|httpie|python-requests|python-urllib|aiohttp|go-http-client|okhttp|java\/|libwww|scrapy|postman|insomnia/i;
+/**
+* Local bot heuristics, used when neither a provider nor the hosted backend
+* gives a verdict
+*/
+function looksLikeBot(request) {
+	const userAgent = request.headers.get("user-agent")?.trim();
+	if (!userAgent) return true;
+	if (BOT_USER_AGENT.test(userAgent)) return true;
+	return !request.headers.get("accept-language") && !request.headers.get("x-visitor-id");
+}
+const UNKNOWN = {
+	suspiciousIp: null,
+	bot: null,
+	geo: null
+};
+/**
+* Asks the hosted backend about a request's IP address and client. Verdicts
+* are cached in secondary storage for as long as the backend allows.
+* Returns null verdicts when the backend isn't configured or can't answer.
+*/
+function createIntelClient(options) {
+	const apiKey = options.apiKey ?? env.PAYVO_INFRA_API_KEY;
+	const apiUrl = (options.apiUrl ?? env.PAYVO_INFRA_API_URL)?.replace(/\/+$/, "");
+	const kvUrl = (options.kvUrl ?? env.PAYVO_INFRA_KV_URL)?.replace(/\/+$/, "");
+	const configured = Boolean(apiKey && apiUrl);
+	const kv = {
+		timeout: options.kvOptions?.timeout ?? 1e3,
+		attempts: options.kvOptions?.retry?.attempts ?? 2,
+		baseDelay: options.kvOptions?.retry?.baseDelay ?? 400,
+		maxDelay: options.kvOptions?.retry?.maxDelay ?? 600
+	};
+	return {
+		configured,
+		verifiesVisitors: Boolean(kvUrl && apiKey),
+		misconfigured: Boolean((apiUrl || kvUrl) && !apiKey) || Boolean(apiKey && !apiUrl && !kvUrl),
+		async verifyVisitor(auth, request) {
+			if (!kvUrl || !apiKey) return request.visitorId;
+			const cacheKey = `sentinel:visitor:${request.visitorId}:${request.ip ?? ""}`;
+			const cached = await auth.secondaryStorage?.get(cacheKey);
+			if (typeof cached === "string") return cached || null;
+			for (let attempt = 0; attempt <= kv.attempts; attempt++) {
+				if (attempt > 0) {
+					const wait = Math.min(kv.baseDelay * 2 ** (attempt - 1), kv.maxDelay);
+					await new Promise((resolve) => setTimeout(resolve, wait));
+				}
+				const { data, error } = await betterFetch(`${kvUrl}/v1/visitors/verify`, {
+					method: "POST",
+					headers: {
+						...options.kvOptions?.headers,
+						authorization: `Bearer ${apiKey}`
+					},
+					body: request,
+					timeout: kv.timeout
+				}).catch((e) => ({
+					data: null,
+					error: e
+				}));
+				if (data && !error) {
+					const visitorId = data.valid ? data.visitorId ?? request.visitorId : null;
+					await auth.secondaryStorage?.set(cacheKey, visitorId ?? "", 300);
+					return visitorId;
+				}
+			}
+			auth.logger.error("[sentinel] Failed to verify visitor id");
+		},
+		async lookup(auth, request) {
+			const { ip, visitorId } = request;
+			if (!configured || !ip) return UNKNOWN;
+			const cacheKey = `sentinel:intel:${ip}:${visitorId ?? ""}`;
+			const cached = safeJSONParse(await auth.secondaryStorage?.get(cacheKey));
+			if (cached) return cached;
+			const { data, error } = await betterFetch(`${apiUrl}/v1/intel/request`, {
+				method: "POST",
+				headers: {
+					...options.apiOptions?.headers,
+					authorization: `Bearer ${apiKey}`
+				},
+				body: {
+					ip,
+					visitorId,
+					userAgent: request.userAgent,
+					headers: { "accept-language": request.acceptLanguage }
+				},
+				timeout: options.apiOptions?.timeout ?? 3e3
+			}).catch((e) => ({
+				data: null,
+				error: e
+			}));
+			if (error || !data) {
+				auth.logger.error("[sentinel] Failed to look up request intel", error);
+				return UNKNOWN;
+			}
+			const intel = {
+				suspiciousIp: data.ip?.suspicious ?? null,
+				bot: data.bot?.verdict === "bot" ? true : data.bot?.verdict === "human" ? false : null,
+				geo: data.geo ?? null
+			};
+			if (data.ttlSeconds && auth.secondaryStorage) await auth.secondaryStorage.set(cacheKey, JSON.stringify(intel), data.ttlSeconds);
+			return intel;
+		}
+	};
+}
+
+//#endregion
+//#region src/plugins/sentinel/schema.ts
+/** Added to users when `emailNormalization` is enabled */
+const normalizedEmailSchema = { user: { fields: { normalizedEmail: {
+	type: "string",
+	required: false,
+	input: false,
+	returned: false
+} } } };
+const schema = {
+	sentinelCounter: { fields: {
+		key: {
+			type: "string",
+			required: true,
+			unique: true
+		},
+		count: {
+			type: "number",
+			required: true
+		},
+		expiresAt: {
+			type: "date",
+			required: true
+		}
+	} },
+	sentinelSignIn: { fields: {
+		userId: {
+			type: "string",
+			required: true,
+			references: {
+				model: "user",
+				field: "id",
+				onDelete: "cascade"
+			}
+		},
+		ipAddress: {
+			type: "string",
+			required: false
+		},
+		visitorId: {
+			type: "string",
+			required: false
+		},
+		userAgent: {
+			type: "string",
+			required: false
+		},
+		country: {
+			type: "string",
+			required: false
+		},
+		city: {
+			type: "string",
+			required: false
+		},
+		latitude: {
+			type: "number",
+			required: false
+		},
+		longitude: {
+			type: "number",
+			required: false
+		},
+		createdAt: {
+			type: "date",
+			required: true
+		}
+	} },
+	powChallenge: { fields: {
+		nonce: {
+			type: "string",
+			required: true,
+			unique: true
+		},
+		difficulty: {
+			type: "number",
+			required: true
+		},
+		reason: {
+			type: "string",
+			required: true
+		},
+		ipAddress: {
+			type: "string",
+			required: false
+		},
+		visitorId: {
+			type: "string",
+			required: false
+		},
+		expiresAt: {
+			type: "date",
+			required: true
+		},
+		createdAt: {
+			type: "date",
+			required: true
+		}
+	} }
+};
+
+//#endregion
+//#region src/plugins/sentinel/store.ts
+const PREFIX = "sentinel:";
+/**
+* Counters and challenges, kept in secondary storage when it's configured
+* and in the database otherwise
+*/
+function createSentinelStore(auth) {
+	const storage = auth.secondaryStorage;
+	async function findCounter(key) {
+		return auth.adapter.findOne({
+			model: "sentinelCounter",
+			where: [{
+				field: "key",
+				value: key
+			}]
+		});
+	}
+	return {
+		async increment(name, ttlSeconds, options = {}) {
+			const key = PREFIX + name;
+			if (storage?.increment) {
+				const count = await storage.increment(key, ttlSeconds);
+				if (options.sliding && count > 1) await storage.set(key, String(count), ttlSeconds);
+				return count;
+			}
+			if (storage) {
+				const current = safeJSONParse(await storage.get(key));
+				const now = Date.now();
+				const expiresAt = current && current.expiresAt > now && !options.sliding ? current.expiresAt : now + ttlSeconds * 1e3;
+				const count = current && current.expiresAt > now ? current.count + 1 : 1;
+				await storage.set(key, JSON.stringify({
+					count,
+					expiresAt
+				}), Math.max(Math.ceil((expiresAt - now) / 1e3), 1));
+				return count;
+			}
+			let row = await findCounter(key);
+			if (!row) {
+				if (await auth.adapter.create({
+					model: "sentinelCounter",
+					data: {
+						key,
+						count: 1,
+						expiresAt: new Date(Date.now() + ttlSeconds * 1e3)
+					}
+				}).then(() => true, () => false)) return 1;
+				row = await findCounter(key);
+				if (!row) throw new Error(`Failed to create counter ${key}`);
+			}
+			if (new Date(row.expiresAt).getTime() <= Date.now()) {
+				await auth.adapter.update({
+					model: "sentinelCounter",
+					where: [{
+						field: "id",
+						value: row.id
+					}],
+					update: {
+						count: 1,
+						expiresAt: new Date(Date.now() + ttlSeconds * 1e3)
+					}
+				});
+				return 1;
+			}
+			await auth.adapter.update({
+				model: "sentinelCounter",
+				where: [{
+					field: "id",
+					value: row.id
+				}],
+				update: {
+					count: row.count + 1,
+					...options.sliding ? { expiresAt: new Date(Date.now() + ttlSeconds * 1e3) } : {}
+				}
+			});
+			return row.count + 1;
+		},
+		async get(name) {
+			const key = PREFIX + name;
+			if (storage) {
+				const value = await storage.get(key);
+				if (value === null || value === void 0) return 0;
+				if (storage.increment) return Number(value) || 0;
+				const current = safeJSONParse(value);
+				return current && current.expiresAt > Date.now() ? current.count : 0;
+			}
+			const row = await findCounter(key);
+			if (!row || new Date(row.expiresAt).getTime() <= Date.now()) return 0;
+			return row.count;
+		},
+		async reset(name) {
+			const key = PREFIX + name;
+			if (storage) {
+				await storage.delete(key);
+				return;
+			}
+			await auth.adapter.deleteMany({
+				model: "sentinelCounter",
+				where: [{
+					field: "key",
+					value: key
+				}]
+			});
+		},
+		async saveChallenge(challenge) {
+			const ttlSeconds = Math.max(Math.ceil((challenge.expiresAt.getTime() - Date.now()) / 1e3), 1);
+			if (storage) {
+				await storage.set(`${PREFIX}pow:${challenge.nonce}`, JSON.stringify(challenge), ttlSeconds);
+				return;
+			}
+			await auth.adapter.create({
+				model: "powChallenge",
+				data: {
+					...challenge,
+					createdAt: /* @__PURE__ */ new Date()
+				}
+			});
+		},
+		async consumeChallenge(nonce) {
+			let challenge = null;
+			if (storage) {
+				const key = `${PREFIX}pow:${nonce}`;
+				let value;
+				if (storage.getAndDelete) value = await storage.getAndDelete(key);
+				else {
+					value = await storage.get(key);
+					if (value) await storage.delete(key);
+				}
+				challenge = safeJSONParse(value);
+			} else {
+				const row = await auth.adapter.findOne({
+					model: "powChallenge",
+					where: [{
+						field: "nonce",
+						value: nonce
+					}]
+				});
+				if (!row) return null;
+				if (!await auth.adapter.create({
+					model: "sentinelCounter",
+					data: {
+						key: `${PREFIX}pow-used:${nonce}`,
+						count: 1,
+						expiresAt: new Date(row.expiresAt)
+					}
+				}).then(() => true).catch(() => false)) return null;
+				await auth.adapter.delete({
+					model: "powChallenge",
+					where: [{
+						field: "nonce",
+						value: nonce
+					}]
+				});
+				challenge = row;
+			}
+			if (!challenge) return null;
+			if (new Date(challenge.expiresAt).getTime() <= Date.now()) return null;
+			return challenge;
+		}
+	};
+}
+
+//#endregion
+//#region src/plugins/sentinel/index.ts
+const SIGN_UP_PATHS = ["/sign-up/email"];
+const PASSWORD_RESET_PATHS = ["/request-password-reset", "/forget-password/email-otp"];
+/** The email field normalized on each endpoint */
+const NORMALIZED_EMAIL_FIELDS = {
+	"/sign-up/email": "email",
+	"/sign-in/email": "email",
+	"/sign-in/email-otp": "email",
+	"/sign-in/magic-link": "email",
+	"/email-otp/send-verification-otp": "email",
+	"/email-otp/verify-email": "email",
+	"/email-otp/check-verification-otp": "email",
+	"/email-otp/reset-password": "email",
+	"/request-password-reset": "email",
+	"/forget-password/email-otp": "email",
+	"/change-email": "newEmail"
+};
+/** The new password field each endpoint accepts */
+const NEW_PASSWORD_FIELDS = {
+	"/sign-up/email": "password",
+	"/change-password": "newPassword",
+	"/set-password": "newPassword",
+	"/reset-password": "newPassword",
+	"/email-otp/reset-password": "password"
+};
+/**
+* Endpoints that check a password, one-time code or token, so failures count
+* towards credential stuffing
+*/
+const isAttemptPath = (path) => CREDENTIAL_SIGN_IN_PATHS.includes(path) || VERIFICATION_PATHS.includes(path);
+/** Account creation that isn't done by the visitor signing up */
+const isManagedAccountCreation = (path) => !path || path.startsWith("/admin/") || path === "/sign-in/anonymous";
+/** Social sign-ups, whose email the provider has already verified */
+const OAUTH_CALLBACK_PATHS = ["/callback/:id", "/oauth2/callback/:providerId"];
+const DAY_SECONDS = 1440 * 60;
+/**
+* Sign-ins checked with a password, which can be repeated with a challenge
+* solution
+*/
+const REPEATABLE_SIGN_IN_PATHS = [
+	"/sign-in/email",
+	"/sign-in/username",
+	"/sign-in/phone-number"
+];
+/** How long checks that passed on a first factor cover the second factor */
+const SECOND_FACTOR_SECONDS = 600;
+/** Response statuses that sentinel itself returns, not failed credentials */
+const SENTINEL_STATUSES = new Set([
+	403,
+	423,
+	429
+]);
+const sentinel = (options) => {
+	const opts = {
+		...options,
+		failOpen: options?.failOpen ?? true
+	};
+	const security = opts.security ?? {};
+	const difficulty = security.challengeDifficulty ?? 18;
+	const intel = createIntelClient(opts);
+	const credentialStuffing = security.credentialStuffing?.enabled ? {
+		action: security.credentialStuffing.action ?? "challenge",
+		thresholds: security.credentialStuffing.thresholds ?? {
+			challenge: 3,
+			block: 5
+		},
+		windowSeconds: security.credentialStuffing.windowSeconds ?? 3600,
+		cooldownSeconds: security.credentialStuffing.cooldownSeconds ?? 900
+	} : null;
+	const velocity = security.velocity?.enabled ? {
+		thresholds: security.velocity.thresholds ?? {
+			challenge: 10,
+			block: 20
+		},
+		maxSignupsPerVisitor: security.velocity.maxSignupsPerVisitor ?? 5,
+		maxPasswordResetsPerIp: security.velocity.maxPasswordResetsPerIp ?? 10,
+		maxSignInsPerIp: security.velocity.maxSignInsPerIp ?? 50,
+		windowSeconds: security.velocity.windowSeconds ?? 3600,
+		action: security.velocity.action ?? "challenge"
+	} : null;
+	const freeTrialAbuse = security.freeTrialAbuse?.enabled ? {
+		thresholds: security.freeTrialAbuse.thresholds,
+		maxAccountsPerVisitor: security.freeTrialAbuse.maxAccountsPerVisitor ?? 3,
+		retentionSeconds: Math.min(Math.max(security.freeTrialAbuse.retentionSeconds ?? 90 * DAY_SECONDS, DAY_SECONDS), 365 * DAY_SECONDS),
+		action: security.freeTrialAbuse.action ?? "block"
+	} : null;
+	const botBlocking = resolveToggle(security.botBlocking, "challenge");
+	const suspiciousIpBlocking = resolveToggle(security.suspiciousIpBlocking, "block");
+	if (security.geoBlocking?.allowList && security.geoBlocking.denyList) throw new PayvoAuthError("sentinel: use either geoBlocking.allowList or geoBlocking.denyList, not both");
+	const geoBlocking = security.geoBlocking?.allowList || security.geoBlocking?.denyList ? {
+		allowList: security.geoBlocking.allowList?.map((code) => code.toUpperCase()),
+		denyList: security.geoBlocking.denyList?.map((code) => code.toUpperCase()),
+		action: security.geoBlocking.action ?? "block"
+	} : null;
+	const impossibleTravel = security.impossibleTravel?.enabled ? {
+		maxSpeedKmh: security.impossibleTravel.maxSpeedKmh ?? 1e3,
+		action: security.impossibleTravel.action ?? "challenge"
+	} : null;
+	const compromisedPassword = security.compromisedPassword?.enabled ? {
+		action: security.compromisedPassword.action ?? "block",
+		minBreachCount: security.compromisedPassword.minBreachCount ?? 1
+	} : null;
+	const emailValidation = security.emailValidation?.enabled ? {
+		strictness: security.emailValidation.strictness ?? "medium",
+		action: security.emailValidation.action ?? "block",
+		domainAllowlist: new Set(security.emailValidation.domainAllowlist?.map((domain) => domain.toLowerCase()))
+	} : null;
+	const emailNormalization = security.emailNormalization?.enabled ?? false;
+	if (security.staleUsers?.notifyAdmin && !security.staleUsers.adminEmail) throw new PayvoAuthError("sentinel: staleUsers.adminEmail is required when notifyAdmin is true");
+	const staleUsers = security.staleUsers?.enabled ? {
+		staleDays: security.staleUsers.staleDays ?? 90,
+		action: security.staleUsers.action ?? "log",
+		notifyUser: security.staleUsers.notifyUser ?? false,
+		adminEmail: security.staleUsers.notifyAdmin ? security.staleUsers.adminEmail : void 0
+	} : null;
+	const unknownDeviceNotification = security.unknownDeviceNotification ?? false;
+	const tracksSignIns = Boolean(impossibleTravel || staleUsers || unknownDeviceNotification);
+	const checksAccountCreation = Boolean(freeTrialAbuse || velocity || emailValidation);
+	/** Challenge results, so each solution is checked once per request */
+	const challengeResults = /* @__PURE__ */ new WeakMap();
+	/** Verified visitor ids, so each request is checked once */
+	const visitorResults = /* @__PURE__ */ new WeakMap();
+	function clientIp(request, auth) {
+		if (!request) return null;
+		if (opts.providers?.getClientIp) return opts.providers.getClientIp(request);
+		return getIp(request, auth.options);
+	}
+	/**
+	* The visitor id sent by the client, checked with the identification
+	* service when one is configured
+	*/
+	function resolveVisitor(auth, headers, ip) {
+		const sent = headers?.get("x-visitor-id") || null;
+		if (!headers || !sent) return Promise.resolve({
+			id: null,
+			verified: false
+		});
+		const existing = visitorResults.get(headers);
+		if (existing) return existing;
+		const unchecked = {
+			id: opts.failOpen ? sent : null,
+			verified: false
+		};
+		const result = intel.verifyVisitor(auth, {
+			visitorId: sent,
+			ip,
+			userAgent: headers.get("user-agent")
+		}).then((verified) => verified === void 0 ? unchecked : {
+			id: verified,
+			verified: intel.verifiesVisitors
+		}).catch(() => unchecked);
+		visitorResults.set(headers, result);
+		return result;
+	}
+	function relativePath(request, auth) {
+		const pathname = new URL(request.url).pathname;
+		const basePath = auth.options.basePath ?? "/api/auth";
+		return pathname.startsWith(basePath) ? pathname.slice(basePath.length) || "/" : pathname;
+	}
+	/**
+	* Whether the request carries a valid, unused solution to a challenge
+	* issued to the same IP address and visitor
+	*/
+	function challengePassed(key, details, store, auth) {
+		const existing = challengeResults.get(key);
+		if (existing) return existing;
+		const result = (async () => {
+			const parsed = parsePowHeader(details.headers?.get(POW_SOLUTION_HEADER));
+			if (!parsed) return false;
+			try {
+				const challenge = await store.consumeChallenge(parsed.nonce);
+				if (!challenge) return false;
+				if (challenge.ipAddress && challenge.ipAddress !== details.ip) return false;
+				if (challenge.visitorId && challenge.visitorId !== details.visitorId) return false;
+				return await verifySolution(parsed.nonce, parsed.value, challenge.difficulty);
+			} catch (e) {
+				auth.logger.error("[sentinel] Failed to verify challenge", e);
+				return false;
+			}
+		})();
+		challengeResults.set(key, result);
+		return result;
+	}
+	/** Runs a check, applying `failOpen` when it can't complete */
+	async function guard(auth, check) {
+		try {
+			return await check();
+		} catch (e) {
+			if (e instanceof APIError) throw e;
+			auth.logger.error("[sentinel] Security check failed", e);
+			return opts.failOpen ? { outcome: "allow" } : {
+				outcome: "block",
+				reason: "check_failed"
+			};
+		}
+	}
+	async function requestDetails(ctx, identifier) {
+		const headers = ctx.headers ?? ctx.request?.headers;
+		const ip = clientIp(ctx.request ?? headers, ctx.context);
+		const body = ctx.body ?? {};
+		const value = identifier ?? [
+			body.email,
+			body.username,
+			body.phoneNumber
+		].find((field) => typeof field === "string");
+		const visitor = await resolveVisitor(ctx.context, headers, ip);
+		return {
+			headers,
+			ip,
+			visitorId: visitor.id,
+			visitorVerified: visitor.verified,
+			identifier: value && emailNormalization && value.includes("@") ? normalizeEmail(value) : value ?? null,
+			userAgent: headers?.get("user-agent") ?? null,
+			acceptLanguage: headers?.get("accept-language") ?? null
+		};
+	}
+	function act(ctx, store, details, action, eventType, reason, metadata, userId) {
+		return guard(ctx.context, async () => executeAction({
+			auth: ctx.context,
+			event: ctx,
+			store,
+			action,
+			eventType,
+			reason,
+			ipAddress: details.ip,
+			visitorId: details.visitorId,
+			identifier: details.identifier,
+			userId,
+			challengePassed: action === "challenge" ? await challengePassed(challengeKey(ctx, details), details, store, ctx.context) : false,
+			difficulty,
+			metadata
+		}));
+	}
+	/** The key a request's challenge result is cached under */
+	function challengeKey(ctx, details) {
+		return ctx.request ?? details.headers ?? ctx;
+	}
+	/**
+	* Counters a sign-in attempt is tracked under: one per visitor and IP
+	* address, and one per visitor and IP address for the account it signs in
+	* to
+	*/
+	function attemptKeys(details) {
+		const account = details.identifier?.toLowerCase();
+		return [details.visitorId ? `cs:visitor:${details.visitorId}` : null, details.ip ? `cs:ip:${details.ip}` : null].filter((scope) => scope !== null).map((scope) => ({
+			scope,
+			account: account ? `${scope}:account:${account}` : null
+		}));
+	}
+	/**
+	* Counts a sign-in attempt and returns the failed attempts before it.
+	* Attempts are counted before the password is checked, so attempts sent at
+	* the same time can't all pass the check. Successful sign-ins are counted
+	* separately and subtracted.
+	*/
+	async function countAttempt(store, keys, options$1) {
+		if (!credentialStuffing) return 0;
+		const { windowSeconds } = credentialStuffing;
+		const { readOnly } = options$1;
+		const count = (name) => readOnly ? store.get(name) : store.increment(name, windowSeconds);
+		const failures = await Promise.all(keys.map(async ({ scope, account }) => {
+			const total = await count(scope);
+			if (total === 1 && !readOnly) await store.reset(`${scope}:succeeded`);
+			const succeeded = await store.get(`${scope}:succeeded`);
+			const own = account ? await count(account) : 0;
+			return Math.max(total - succeeded, own) - 1;
+		}));
+		return Math.max(0, ...failures);
+	}
+	function counterNames(keys) {
+		return keys.flatMap(({ scope, account }) => account ? [scope, account] : [scope]);
+	}
+	/**
+	* Identities a rate limit counts under. A visitor id that wasn't verified
+	* can be changed on every request, so the IP address counts too.
+	*/
+	function rateIds(details) {
+		if (details.visitorId && details.visitorVerified) return [`visitor:${details.visitorId}`];
+		return [details.visitorId ? `visitor:${details.visitorId}` : null, details.ip ? `ip:${details.ip}` : null].filter((id) => id !== null);
+	}
+	/** Increments a counter for each identity and returns the highest count */
+	async function incrementAll(store, names, ttlSeconds) {
+		const counts = await Promise.all(names.map((name) => store.increment(name, ttlSeconds)));
+		return Math.max(0, ...counts);
+	}
+	/** The location of a request, from the provider or the hosted backend */
+	async function locate(auth, details) {
+		if (!details.ip) return null;
+		if (opts.providers?.resolveGeo) return opts.providers.resolveGeo(details.ip);
+		return (await intel.lookup(auth, details)).geo;
+	}
+	async function lastSignIn(auth, userId) {
+		const [row] = await auth.adapter.findMany({
+			model: "sentinelSignIn",
+			where: [{
+				field: "userId",
+				value: userId
+			}],
+			sortBy: {
+				field: "createdAt",
+				direction: "desc"
+			},
+			limit: 1
+		});
+		return row ?? null;
+	}
+	function daysSince(date) {
+		return Math.floor((Date.now() - new Date(date).getTime()) / (DAY_SECONDS * 1e3));
+	}
+	/** The travel speed from the previous sign-in, when both have coordinates */
+	function travel(previous, geo) {
+		if (previous?.latitude == null || previous.longitude == null || geo?.latitude == null || geo.longitude == null) return null;
+		const speedKmh = travelSpeedKmh({
+			latitude: previous.latitude,
+			longitude: previous.longitude,
+			at: new Date(previous.createdAt)
+		}, {
+			latitude: geo.latitude,
+			longitude: geo.longitude,
+			at: /* @__PURE__ */ new Date()
+		});
+		return {
+			speedKmh: Math.round(speedKmh),
+			from: {
+				country: previous.country,
+				city: previous.city
+			},
+			to: {
+				country: geo.country,
+				city: geo.city ?? null
+			}
+		};
+	}
+	async function notify(auth, notification) {
+		if (!opts.sendNotification) return;
+		try {
+			await opts.sendNotification(notification);
+		} catch (e) {
+			auth.logger.error("[sentinel] Failed to send notification", e);
+		}
+	}
+	/**
+	* The address of the account an email is an alias of, or null when the
+	* email is an account's address itself or no account matches
+	*/
+	async function findAliasedAddress(auth, email) {
+		const exact = await auth.adapter.findOne({
+			model: "user",
+			where: [{
+				field: "email",
+				value: email.toLowerCase()
+			}]
+		});
+		const normalizedEmail = normalizeEmail(email);
+		if (exact) {
+			if (!exact.normalizedEmail) await auth.adapter.update({
+				model: "user",
+				where: [{
+					field: "id",
+					value: exact.id
+				}],
+				update: { normalizedEmail }
+			});
+			return null;
+		}
+		return (await auth.adapter.findOne({
+			model: "user",
+			where: [{
+				field: "normalizedEmail",
+				value: normalizedEmail
+			}]
+		}))?.email ?? null;
+	}
+	/** Disposable domains, MX records and generated-looking addresses */
+	async function validateEmail(ctx, store, details, email) {
+		if (!emailValidation) return;
+		const domain = getEmailDomain(email);
+		if (!domain || emailValidation.domainAllowlist.has(domain)) return;
+		throwForDecision(await guard(ctx.context, async () => {
+			const { strictness } = emailValidation;
+			let check = null;
+			if (await isDisposableDomain(domain)) check = "disposable";
+			else if (strictness !== "low" && await hasMxRecords(domain) === false) check = "no_mx_records";
+			else if (strictness === "high" && looksGenerated(email.toLowerCase())) check = "generated";
+			if (!check) return { outcome: "allow" };
+			return act(ctx, store, details, emailValidation.action, SECURITY_EVENT_TYPES.INVALID_EMAIL, "invalid_email", {
+				domain,
+				check,
+				strictness
+			});
+		}));
+	}
+	/**
+	* Checks run when an account is about to be created, whichever endpoint
+	* creates it: email validation, sign-up velocity and free trial abuse
+	*/
+	async function checkAccountCreation(ctx, email) {
+		if (isManagedAccountCreation(ctx.path)) return;
+		const event = ctx;
+		const store = createSentinelStore(ctx.context);
+		const details = await requestDetails(event, email);
+		if (!OAUTH_CALLBACK_PATHS.includes(ctx.path)) await validateEmail(event, store, details, email);
+		if (velocity) {
+			const ids = rateIds(details);
+			if (ids.length) throwForDecision(await guard(ctx.context, async () => {
+				const count = await incrementAll(store, ids.map((id) => `velocity:sign-up:${id}`), velocity.windowSeconds);
+				if (count <= velocity.maxSignupsPerVisitor) return { outcome: "allow" };
+				return act(event, store, details, velocity.action, SECURITY_EVENT_TYPES.VELOCITY_EXCEEDED, "velocity", {
+					count,
+					limit: velocity.maxSignupsPerVisitor,
+					windowSeconds: velocity.windowSeconds
+				});
+			}));
+		}
+		if (freeTrialAbuse && details.visitorId) {
+			const visitorId = details.visitorId;
+			throwForDecision(await guard(ctx.context, async () => {
+				const created = await store.get(`trial:${visitorId}`);
+				const { thresholds } = freeTrialAbuse;
+				let action = null;
+				if (thresholds) {
+					if (created >= thresholds.block) action = "block";
+					else if (created >= thresholds.challenge) action = "challenge";
+				} else if (created >= freeTrialAbuse.maxAccountsPerVisitor) action = freeTrialAbuse.action;
+				if (!action) return { outcome: "allow" };
+				return act(event, store, details, action, SECURITY_EVENT_TYPES.FREE_TRIAL_ABUSE, "free_trial_abuse", { accounts: created });
+			}));
+		}
+	}
+	return {
+		id: "sentinel",
+		init(ctx) {
+			if ((unknownDeviceNotification || staleUsers?.notifyUser || staleUsers?.adminEmail) && !opts.sendNotification) ctx.logger.warn("[sentinel] Notifications are enabled but sendNotification is not set, so none will be sent");
+			if (intel.misconfigured) ctx.logger.warn("[sentinel] Missing PAYVO_INFRA_API_KEY or PAYVO_INFRA_API_URL. Security checks that use the hosted backend fall back to allow mode.");
+			if (!checksAccountCreation && !emailNormalization) return;
+			return { options: { databaseHooks: { user: {
+				create: {
+					async before(user, context) {
+						if (context && checksAccountCreation) await checkAccountCreation(context, user.email);
+						if (emailNormalization) return { data: {
+							...user,
+							normalizedEmail: normalizeEmail(user.email)
+						} };
+					},
+					async after(user, context) {
+						if (!freeTrialAbuse || !context) return;
+						if (isManagedAccountCreation(context.path)) return;
+						const event = context;
+						const headers = event.headers ?? event.request?.headers;
+						const ip = clientIp(event.request ?? headers, context.context);
+						const { id: visitorId } = await resolveVisitor(context.context, headers, ip);
+						if (!visitorId) return;
+						try {
+							await createSentinelStore(context.context).increment(`trial:${visitorId}`, freeTrialAbuse.retentionSeconds, { sliding: true });
+						} catch (e) {
+							context.context.logger.error("[sentinel] Failed to track sign-up", e);
+						}
+					}
+				},
+				update: { async before(data) {
+					if (!emailNormalization || typeof data.email !== "string") return;
+					return { data: {
+						...data,
+						normalizedEmail: normalizeEmail(data.email)
+					} };
+				} }
+			} } } };
+		},
+		async onRequest(request, ctx) {
+			if (!botBlocking && !suspiciousIpBlocking && !geoBlocking) return;
+			const store = createSentinelStore(ctx);
+			const event = {
+				context: ctx,
+				request,
+				headers: request.headers,
+				path: relativePath(request, ctx)
+			};
+			const response = responseForDecision(await guard(ctx, async () => {
+				const details = await requestDetails(event);
+				const { ip } = details;
+				const remote = await intel.lookup(ctx, details);
+				if (suspiciousIpBlocking && ip) {
+					if (opts.providers?.isSuspiciousIp ? await opts.providers.isSuspiciousIp(ip) : remote.suspiciousIp) {
+						const result = await act(event, store, details, suspiciousIpBlocking.action, SECURITY_EVENT_TYPES.SUSPICIOUS_IP, "suspicious_ip", { ip });
+						if (result.outcome !== "allow") return result;
+					}
+				}
+				if (geoBlocking && ip) {
+					const country = (opts.providers?.resolveGeo ? await opts.providers.resolveGeo(ip) : remote.geo)?.country?.toUpperCase() ?? null;
+					if (country ? geoBlocking.allowList ? !geoBlocking.allowList.includes(country) : Boolean(geoBlocking.denyList?.includes(country)) : Boolean(geoBlocking.allowList) && !opts.failOpen) {
+						const result = await act(event, store, details, geoBlocking.action, SECURITY_EVENT_TYPES.GEO_BLOCKED, "geo_blocking", { country });
+						if (result.outcome !== "allow") return result;
+					}
+				}
+				if (botBlocking) {
+					if (opts.providers?.isBot ? await opts.providers.isBot(request) : remote.bot ?? looksLikeBot(request)) {
+						const result = await act(event, store, details, botBlocking.action, SECURITY_EVENT_TYPES.BOT_BLOCKED, "bot", { userAgent: request.headers.get("user-agent") });
+						if (result.outcome !== "allow") return result;
+					}
+				}
+				return { outcome: "allow" };
+			}));
+			return response ? { response } : void 0;
+		},
+		hooks: {
+			before: [{
+				matcher(context) {
+					return emailNormalization && context.path in NORMALIZED_EMAIL_FIELDS;
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					const field = NORMALIZED_EMAIL_FIELDS[ctx.path];
+					const email = ctx.body?.[field];
+					if (typeof email !== "string") return;
+					const stored = await findAliasedAddress(ctx.context, email).catch((e) => {
+						ctx.context.logger.error("[sentinel] Failed to resolve alias", e);
+						return null;
+					});
+					if (!stored) return;
+					return { context: { body: {
+						...ctx.body,
+						[field]: stored
+					} } };
+				})
+			}, {
+				matcher(context) {
+					const isCredentialSignIn = CREDENTIAL_SIGN_IN_PATHS.includes(context.path);
+					return Boolean(credentialStuffing && isAttemptPath(context.path) || velocity && (isCredentialSignIn || SIGN_UP_PATHS.includes(context.path) || PASSWORD_RESET_PATHS.includes(context.path)) || emailValidation && context.path === "/change-email" || compromisedPassword && context.path in NEW_PASSWORD_FIELDS);
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					const store = createSentinelStore(ctx.context);
+					const details = await requestDetails(ctx);
+					const body = ctx.body ?? {};
+					if (emailValidation && ctx.path === "/change-email" && typeof body.newEmail === "string") await validateEmail(ctx, store, details, body.newEmail);
+					if (compromisedPassword && ctx.path in NEW_PASSWORD_FIELDS) {
+						const password = body[NEW_PASSWORD_FIELDS[ctx.path]];
+						if (typeof password === "string" && password) throwForDecision(await guard(ctx.context, async () => {
+							const breachCount = await getPasswordBreachCount(password);
+							if (breachCount < compromisedPassword.minBreachCount) return { outcome: "allow" };
+							return act(ctx, store, details, compromisedPassword.action, SECURITY_EVENT_TYPES.COMPROMISED_PASSWORD, "compromised_password", { breachCount });
+						}));
+					}
+					if (credentialStuffing && isAttemptPath(ctx.path)) throwForDecision(await guard(ctx.context, async () => {
+						const keys = attemptKeys(details);
+						const solved = Boolean(details.headers?.get(POW_SOLUTION_HEADER)) && await challengePassed(challengeKey(ctx, details), details, store, ctx.context);
+						const blocked = (await Promise.all(counterNames(keys).map((key) => store.get(`${key}:blocked`)))).some((value) => value > 0);
+						const failures = await countAttempt(store, keys, { readOnly: solved || blocked });
+						const { thresholds } = credentialStuffing;
+						const metadata = {
+							failedAttempts: failures,
+							thresholds
+						};
+						if (blocked || failures >= thresholds.block) return act(ctx, store, details, credentialStuffing.action === "log" ? "log" : "block", SECURITY_EVENT_TYPES.CREDENTIAL_STUFFING, "credential_stuffing", metadata);
+						if (failures >= thresholds.challenge) return act(ctx, store, details, credentialStuffing.action === "log" ? "log" : "challenge", SECURITY_EVENT_TYPES.CREDENTIAL_STUFFING, "credential_stuffing", metadata);
+						return { outcome: "allow" };
+					}));
+					if (velocity) {
+						const { windowSeconds } = velocity;
+						let limit = null;
+						if (CREDENTIAL_SIGN_IN_PATHS.includes(ctx.path) && details.ip) limit = {
+							name: `velocity:sign-in:${details.ip}`,
+							max: velocity.maxSignInsPerIp
+						};
+						else if (PASSWORD_RESET_PATHS.includes(ctx.path) && details.ip) limit = {
+							name: `velocity:password-reset:${details.ip}`,
+							max: velocity.maxPasswordResetsPerIp
+						};
+						const ids = rateIds(details);
+						const isTracked = CREDENTIAL_SIGN_IN_PATHS.includes(ctx.path) || SIGN_UP_PATHS.includes(ctx.path) || PASSWORD_RESET_PATHS.includes(ctx.path);
+						throwForDecision(await guard(ctx.context, async () => {
+							if (limit) {
+								const count = await store.increment(limit.name, windowSeconds);
+								if (count > limit.max) {
+									const result = await act(ctx, store, details, velocity.action, SECURITY_EVENT_TYPES.VELOCITY_EXCEEDED, "velocity", {
+										count,
+										limit: limit.max,
+										windowSeconds
+									});
+									if (result.outcome !== "allow") return result;
+								}
+							}
+							if (ids.length && isTracked) {
+								const total = await incrementAll(store, ids.map((id) => `velocity:total:${id}`), windowSeconds);
+								const { thresholds } = velocity;
+								if (total > thresholds.challenge) return act(ctx, store, details, total > thresholds.block ? "block" : "challenge", SECURITY_EVENT_TYPES.VELOCITY_EXCEEDED, "velocity", {
+									count: total,
+									thresholds,
+									windowSeconds
+								});
+							}
+							return { outcome: "allow" };
+						}));
+					}
+				})
+			}],
+			after: [{
+				matcher(context) {
+					return Boolean(credentialStuffing && isAttemptPath(context.path));
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					if (!credentialStuffing) return;
+					const returned = ctx.context.returned;
+					const status = returned instanceof APIError ? returned.statusCode : 200;
+					try {
+						const store = createSentinelStore(ctx.context);
+						const keys = attemptKeys(await requestDetails(ctx));
+						const { windowSeconds, cooldownSeconds, thresholds } = credentialStuffing;
+						if (status < 400) for (const { scope, account } of keys) {
+							const [total, succeeded, own] = await Promise.all([
+								store.get(scope),
+								store.get(`${scope}:succeeded`),
+								account ? store.get(account) : 0
+							]);
+							if (account) await store.reset(account);
+							if (total - succeeded <= own) {
+								await store.reset(scope);
+								await store.reset(`${scope}:succeeded`);
+							} else await store.increment(`${scope}:succeeded`, windowSeconds);
+						}
+						else if (!SENTINEL_STATUSES.has(status) && status < 500) {
+							const block = async (key, also = []) => {
+								await store.increment(`${key}:blocked`, cooldownSeconds);
+								await Promise.all([key, ...also].map((name) => store.reset(name)));
+							};
+							for (const { scope, account } of keys) {
+								const [total, succeeded] = await Promise.all([store.get(scope), store.get(`${scope}:succeeded`)]);
+								if (total - succeeded >= thresholds.block) await block(scope, [`${scope}:succeeded`]);
+								if (account && await store.get(account) >= thresholds.block) await block(account);
+							}
+						}
+					} catch (e) {
+						ctx.context.logger.error("[sentinel] Failed to track attempt", e);
+					}
+				})
+			}, {
+				matcher(context) {
+					return tracksSignIns && (SIGN_IN_PATHS.includes(context.path) || SIGN_UP_PATHS.includes(context.path));
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					const returned = ctx.context.returned;
+					const newSession = ctx.context.newSession;
+					if (!newSession || returned instanceof APIError && returned.statusCode >= 400) return;
+					const auth = ctx.context;
+					const store = createSentinelStore(auth);
+					const user = newSession.user;
+					const isSignUp = SIGN_UP_PATHS.includes(ctx.path);
+					const awaitsSecondFactor = Boolean(returned && !(returned instanceof APIError) && "twoFactorRedirect" in returned);
+					const passedKey = `checked:${user.id}`;
+					const checkedBefore = ctx.path.startsWith("/two-factor/") && await store.get(passedKey).catch(() => 0) > 0;
+					if (checkedBefore) await store.reset(passedKey).catch(() => {});
+					const repeatable = REPEATABLE_SIGN_IN_PATHS.includes(ctx.path);
+					/**
+					* Undoes a sign-in that a check rejects after the session was
+					* created. Sign-ins that can't be repeated with a solution are
+					* blocked instead of challenged.
+					*/
+					const reject = async (decision) => {
+						if (decision.outcome === "allow") return null;
+						await auth.internalAdapter.deleteSession(newSession.session.token).catch((e) => auth.logger.error("[sentinel] Failed to revoke session", e));
+						deleteSessionCookie(ctx);
+						auth.setNewSession(null);
+						return errorForDecision(decision);
+					};
+					const enforce = (action) => action === "challenge" && !repeatable ? "block" : action;
+					let details;
+					let previous;
+					let geo;
+					try {
+						details = await requestDetails(ctx, user.email);
+						previous = await lastSignIn(auth, user.id);
+						geo = await locate(auth, details).catch(() => null);
+					} catch (e) {
+						auth.logger.error("[sentinel] Failed to track sign-in", e);
+						return;
+					}
+					const signIn = {
+						at: /* @__PURE__ */ new Date(),
+						ipAddress: details.ip,
+						userAgent: details.userAgent,
+						location: [geo?.city, geo?.country].filter(Boolean).join(", ") || null
+					};
+					if (!isSignUp && !checkedBefore && impossibleTravel && previous) {
+						const trip = travel(previous, geo);
+						if (trip && trip.speedKmh > impossibleTravel.maxSpeedKmh) {
+							const rejected = await reject(await act(ctx, store, details, enforce(impossibleTravel.action), SECURITY_EVENT_TYPES.IMPOSSIBLE_TRAVEL, "impossible_travel", {
+								...trip,
+								maxSpeedKmh: impossibleTravel.maxSpeedKmh
+							}, user.id));
+							if (rejected) return rejected;
+						}
+					}
+					const daysInactive = !isSignUp && staleUsers && previous ? daysSince(previous.createdAt) : null;
+					const isStale = Boolean(staleUsers && daysInactive !== null && daysInactive > staleUsers.staleDays);
+					if (staleUsers && isStale && !checkedBefore) {
+						const rejected = await reject(await act(ctx, store, details, enforce(staleUsers.action), SECURITY_EVENT_TYPES.STALE_ACCOUNT, "stale_account", {
+							daysInactive,
+							staleDays: staleUsers.staleDays
+						}, user.id));
+						if (rejected) return rejected;
+					}
+					if (awaitsSecondFactor) {
+						await store.increment(passedKey, SECOND_FACTOR_SECONDS).catch((e) => auth.logger.error("[sentinel] Failed to track sign-in", e));
+						return;
+					}
+					try {
+						if (staleUsers && isStale && daysInactive !== null) {
+							if (staleUsers.notifyUser) await notify(auth, {
+								type: "stale-account",
+								recipient: "user",
+								email: user.email,
+								user,
+								signIn,
+								daysInactive
+							});
+							if (staleUsers.adminEmail) await notify(auth, {
+								type: "stale-account",
+								recipient: "admin",
+								email: staleUsers.adminEmail,
+								user,
+								signIn,
+								daysInactive
+							});
+						}
+						if (!isSignUp && unknownDeviceNotification && details.visitorId && previous) {
+							if (!await auth.adapter.findOne({
+								model: "sentinelSignIn",
+								where: [{
+									field: "userId",
+									value: user.id
+								}, {
+									field: "visitorId",
+									value: details.visitorId
+								}]
+							})) await notify(auth, {
+								type: "unknown-device",
+								recipient: "user",
+								email: user.email,
+								user,
+								signIn
+							});
+						}
+						await auth.adapter.create({
+							model: "sentinelSignIn",
+							data: {
+								userId: user.id,
+								ipAddress: details.ip,
+								visitorId: details.visitorId,
+								userAgent: details.userAgent,
+								country: geo?.country ?? null,
+								city: geo?.city ?? null,
+								latitude: geo?.latitude ?? null,
+								longitude: geo?.longitude ?? null,
+								createdAt: /* @__PURE__ */ new Date()
+							}
+						});
+					} catch (e) {
+						if (e instanceof APIError) throw e;
+						auth.logger.error("[sentinel] Failed to track sign-in", e);
+					}
+				})
+			}]
+		},
+		schema: mergeSchema(emailNormalization ? {
+			...schema,
+			...normalizedEmailSchema
+		} : schema, opts.schema),
+		$ERROR_CODES: SENTINEL_ERROR_CODES,
+		options: opts
+	};
+};
+function resolveToggle(value, defaultAction) {
+	if (!value) return null;
+	return { action: value === true ? defaultAction : value.action };
+}
+
+//#endregion
+export { SENTINEL_ERROR_CODES as i, haversineDistanceKm as n, normalizeEmail as r, sentinel as t };