@gatwech/auth 1.0.0-beta.18 → 1.0.0-beta.19

package/dist/index-DRM35ir1.d.mts

@@ -0,0 +1,3769 @@
+import { g as User$1 } from "./index-BNhJglHC.mjs";
+import { n as DBPrimitive } from "./index-Df0KhQRf-BEa5tdwJ.mjs";
+import { t as InferOptionSchema } from "./plugins-Dy_FrD4Y.mjs";
+import { o as Statements } from "./index-CxlWnL9c.mjs";
+import * as _gatwech_core61 from "@gatwech/core";
+import { AuthContext, GenericEndpointContext, HookEndpointContext } from "@gatwech/core";
+import * as better_call636 from "better-call";
+import { AuthEndpoint, AuthMiddleware, createAuthEndpoint as createAuthEndpoint$1, createAuthMiddleware as createAuthMiddleware$1, optionsMiddleware } from "@gatwech/core/api";
+import * as zod1419 from "zod";
+import * as _gatwech_core_db14 from "@gatwech/core/db";
+import * as zod_v4_core207 from "zod/v4/core";
+
+//#region src/plugins/api-key/schema.d.ts
+declare const apiKeySchema: ({
+  timeWindow,
+  rateLimitMax
+}: {
+  timeWindow: number;
+  rateLimitMax: number;
+}) => {
+  apikey: {
+    fields: {
+      /**
+       * The name of the key.
+       */
+      name: {
+        type: "string";
+        required: false;
+        input: false;
+      };
+      /**
+       * Shows the first few characters of the API key
+       * This allows you to show those few characters in the UI to make it easier for users to identify the API key.
+       */
+      start: {
+        type: "string";
+        required: false;
+        input: false;
+      };
+      /**
+       * The prefix of the key.
+       */
+      prefix: {
+        type: "string";
+        required: false;
+        input: false;
+      };
+      /**
+       * The hashed key value.
+       */
+      key: {
+        type: "string";
+        required: true;
+        input: false;
+      };
+      /**
+       * The user id of the user who created the key.
+       */
+      userId: {
+        type: "string";
+        references: {
+          model: string;
+          field: string;
+          onDelete: "cascade";
+        };
+        required: true;
+        input: false;
+      };
+      /**
+       * The interval to refill the key in milliseconds.
+       */
+      refillInterval: {
+        type: "number";
+        required: false;
+        input: false;
+      };
+      /**
+       * The amount to refill the remaining count of the key.
+       */
+      refillAmount: {
+        type: "number";
+        required: false;
+        input: false;
+      };
+      /**
+       * The date and time when the key was last refilled.
+       */
+      lastRefillAt: {
+        type: "date";
+        required: false;
+        input: false;
+      };
+      /**
+       * Whether the key is enabled.
+       */
+      enabled: {
+        type: "boolean";
+        required: false;
+        input: false;
+        defaultValue: true;
+      };
+      /**
+       * Whether the key has rate limiting enabled.
+       */
+      rateLimitEnabled: {
+        type: "boolean";
+        required: false;
+        input: false;
+        defaultValue: true;
+      };
+      /**
+       * The time window in milliseconds for the rate limit.
+       */
+      rateLimitTimeWindow: {
+        type: "number";
+        required: false;
+        input: false;
+        defaultValue: number;
+      };
+      /**
+       * The maximum number of requests allowed within the `rateLimitTimeWindow`.
+       */
+      rateLimitMax: {
+        type: "number";
+        required: false;
+        input: false;
+        defaultValue: number;
+      };
+      /**
+       * The number of requests made within the rate limit time window
+       */
+      requestCount: {
+        type: "number";
+        required: false;
+        input: false;
+        defaultValue: number;
+      };
+      /**
+       * The remaining number of requests before the key is revoked.
+       *
+       * If this is null, then the key is not revoked.
+       *
+       * If `refillInterval` & `refillAmount` are provided, than this will refill accordingly.
+       */
+      remaining: {
+        type: "number";
+        required: false;
+        input: false;
+      };
+      /**
+       * The date and time of the last request made to the key.
+       */
+      lastRequest: {
+        type: "date";
+        required: false;
+        input: false;
+      };
+      /**
+       * The date and time when the key will expire.
+       */
+      expiresAt: {
+        type: "date";
+        required: false;
+        input: false;
+      };
+      /**
+       * The date and time when the key was created.
+       */
+      createdAt: {
+        type: "date";
+        required: true;
+        input: false;
+      };
+      /**
+       * The date and time when the key was last updated.
+       */
+      updatedAt: {
+        type: "date";
+        required: true;
+        input: false;
+      };
+      /**
+       * The permissions of the key.
+       */
+      permissions: {
+        type: "string";
+        required: false;
+        input: false;
+      };
+      /**
+       * Any additional metadata you want to store with the key.
+       */
+      metadata: {
+        type: "string";
+        required: false;
+        input: true;
+        transform: {
+          input(value: _gatwech_core_db14.DBPrimitive): string;
+          output(value: _gatwech_core_db14.DBPrimitive): any;
+        };
+      };
+    };
+  };
+};
+//#endregion
+//#region src/plugins/api-key/types.d.ts
+interface ApiKeyOptions {
+  /**
+   * The header name to check for API key
+   * @default "x-api-key"
+   */
+  apiKeyHeaders?: (string | string[]) | undefined;
+  /**
+   * Disable hashing of the API key.
+   *
+   * ⚠️ Security Warning: It's strongly recommended to not disable hashing.
+   * Storing API keys in plaintext makes them vulnerable to database breaches, potentially exposing all your users' API keys.
+   *
+   * @default false
+   */
+  disableKeyHashing?: boolean | undefined;
+  /**
+   * The function to get the API key from the context
+   */
+  customAPIKeyGetter?: ((ctx: HookEndpointContext) => string | null) | undefined;
+  /**
+   * A custom function to validate the API key
+   */
+  customAPIKeyValidator?: ((options: {
+    ctx: GenericEndpointContext;
+    key: string;
+  }) => boolean | Promise<boolean>) | undefined;
+  /**
+   * custom key generation function
+   */
+  customKeyGenerator?: (options: {
+    /**
+     * The length of the API key to generate
+     */
+    length: number;
+    /**
+     * The prefix of the API key to generate
+     */
+    prefix: string | undefined;
+  }) => string | Promise<string>;
+  /**
+   * The configuration for storing the starting characters of the API key in the database.
+   *
+   * Useful if you want to display the starting characters of an API key in the UI.
+   */
+  startingCharactersConfig?: {
+    /**
+     * Whether to store the starting characters in the database. If false, we will set `start` to `null`.
+     *
+     * @default true
+     */
+    shouldStore?: boolean;
+    /**
+     * The length of the starting characters to store in the database.
+     *
+     * This includes the prefix length.
+     *
+     * @default 6
+     */
+    charactersLength?: number;
+  } | undefined;
+  /**
+   * The length of the API key. Longer is better. Default is 64. (Doesn't include the prefix length)
+   * @default 64
+   */
+  defaultKeyLength?: number | undefined;
+  /**
+   * The prefix of the API key.
+   *
+   * Note: We recommend you append an underscore to the prefix to make the prefix more identifiable. (eg `hello_`)
+   */
+  defaultPrefix?: string | undefined;
+  /**
+   * The maximum length of the prefix.
+   *
+   * @default 32
+   */
+  maximumPrefixLength?: number | undefined;
+  /**
+   * Whether to require a name for the API key.
+   *
+   * @default false
+   */
+  requireName?: boolean | undefined;
+  /**
+   * The minimum length of the prefix.
+   *
+   * @default 1
+   */
+  minimumPrefixLength?: number | undefined;
+  /**
+   * The maximum length of the name.
+   *
+   * @default 32
+   */
+  maximumNameLength?: number | undefined;
+  /**
+   * The minimum length of the name.
+   *
+   * @default 1
+   */
+  minimumNameLength?: number | undefined;
+  /**
+   * Whether to enable metadata for an API key.
+   *
+   * @default false
+   */
+  enableMetadata?: boolean | undefined;
+  /**
+   * Customize the key expiration.
+   */
+  keyExpiration?: {
+    /**
+     * The default expires time in milliseconds.
+     *
+     * If `null`, then there will be no expiration time.
+     *
+     * @default null
+     */
+    defaultExpiresIn?: number | null;
+    /**
+     * Whether to disable the expires time passed from the client.
+     *
+     * If `true`, the expires time will be based on the default values.
+     *
+     * @default false
+     */
+    disableCustomExpiresTime?: boolean;
+    /**
+     * The minimum expiresIn value allowed to be set from the client. in days.
+     *
+     * @default 1
+     */
+    minExpiresIn?: number;
+    /**
+     * The maximum expiresIn value allowed to be set from the client. in days.
+     *
+     * @default 365
+     */
+    maxExpiresIn?: number;
+  } | undefined;
+  /**
+   * Default rate limiting options.
+   */
+  rateLimit?: {
+    /**
+     * Whether to enable rate limiting.
+     *
+     * @default true
+     */
+    enabled?: boolean;
+    /**
+     * The duration in milliseconds where each request is counted.
+     *
+     * Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset.
+     *
+     * @default 1000 * 60 * 60 * 24 // 1 day
+     */
+    timeWindow?: number;
+    /**
+     * Maximum amount of requests allowed within a window
+     *
+     * Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset.
+     *
+     * @default 10 // 10 requests per day
+     */
+    maxRequests?: number;
+  } | undefined;
+  /**
+   * custom schema for the API key plugin
+   */
+  schema?: InferOptionSchema<ReturnType<typeof apiKeySchema>> | undefined;
+  /**
+   * An API Key can represent a valid session, so we automatically mock a session for the user if we find a valid API key in the request headers.
+   *
+   * ⚠︎ This is not recommended for production use, as it can lead to security issues.
+   * @default false
+   */
+  enableSessionForAPIKeys?: boolean | undefined;
+  /**
+   * Permissions for the API key.
+   */
+  permissions?: {
+    /**
+     * The default permissions for the API key.
+     */
+    defaultPermissions?: Statements | ((userId: string, ctx: GenericEndpointContext) => Statements | Promise<Statements>);
+  } | undefined;
+}
+type ApiKey = {
+  /**
+   * ID
+   */
+  id: string;
+  /**
+   * The name of the key
+   */
+  name: string | null;
+  /**
+   * Shows the first few characters of the API key, including the prefix.
+   * This allows you to show those few characters in the UI to make it easier for users to identify the API key.
+   */
+  start: string | null;
+  /**
+   * The API Key prefix. Stored as plain text.
+   */
+  prefix: string | null;
+  /**
+   * The hashed API key value
+   */
+  key: string;
+  /**
+   * The owner of the user id
+   */
+  userId: string;
+  /**
+   * The interval in milliseconds between refills of the `remaining` count
+   *
+   * @example 3600000 // refill every hour (3600000ms = 1h)
+   */
+  refillInterval: number | null;
+  /**
+   * The amount to refill
+   */
+  refillAmount: number | null;
+  /**
+   * The last refill date
+   */
+  lastRefillAt: Date | null;
+  /**
+   * Sets if key is enabled or disabled
+   *
+   * @default true
+   */
+  enabled: boolean;
+  /**
+   * Whether the key has rate limiting enabled.
+   */
+  rateLimitEnabled: boolean;
+  /**
+   * The duration in milliseconds
+   */
+  rateLimitTimeWindow: number | null;
+  /**
+   * Maximum amount of requests allowed within a window
+   */
+  rateLimitMax: number | null;
+  /**
+   * The number of requests made within the rate limit time window
+   */
+  requestCount: number;
+  /**
+   * Remaining requests (every time API key is used this should updated and should be updated on refill as well)
+   */
+  remaining: number | null;
+  /**
+   * When last request occurred
+   */
+  lastRequest: Date | null;
+  /**
+   * Expiry date of a key
+   */
+  expiresAt: Date | null;
+  /**
+   * created at
+   */
+  createdAt: Date;
+  /**
+   * updated at
+   */
+  updatedAt: Date;
+  /**
+   * Extra metadata about the apiKey
+   */
+  metadata: Record<string, any> | null;
+  /**
+   * Permissions for the API key
+   */
+  permissions?: ({
+    [key: string]: string[];
+  } | null) | undefined;
+};
+//#endregion
+//#region src/plugins/api-key/index.d.ts
+declare const defaultKeyHasher: (key: string) => Promise<string>;
+declare const ERROR_CODES: {
+  readonly INVALID_METADATA_TYPE: "metadata must be an object or undefined";
+  readonly REFILL_AMOUNT_AND_INTERVAL_REQUIRED: "refillAmount is required when refillInterval is provided";
+  readonly REFILL_INTERVAL_AND_AMOUNT_REQUIRED: "refillInterval is required when refillAmount is provided";
+  readonly USER_BANNED: "User is banned";
+  readonly UNAUTHORIZED_SESSION: "Unauthorized or invalid session";
+  readonly KEY_NOT_FOUND: "API Key not found";
+  readonly KEY_DISABLED: "API Key is disabled";
+  readonly KEY_EXPIRED: "API Key has expired";
+  readonly USAGE_EXCEEDED: "API Key has reached its usage limit";
+  readonly KEY_NOT_RECOVERABLE: "API Key is not recoverable";
+  readonly EXPIRES_IN_IS_TOO_SMALL: "The expiresIn is smaller than the predefined minimum value.";
+  readonly EXPIRES_IN_IS_TOO_LARGE: "The expiresIn is larger than the predefined maximum value.";
+  readonly INVALID_REMAINING: "The remaining count is either too large or too small.";
+  readonly INVALID_PREFIX_LENGTH: "The prefix length is either too large or too small.";
+  readonly INVALID_NAME_LENGTH: "The name length is either too large or too small.";
+  readonly METADATA_DISABLED: "Metadata is disabled.";
+  readonly RATE_LIMIT_EXCEEDED: "Rate limit exceeded.";
+  readonly NO_VALUES_TO_UPDATE: "No values to update.";
+  readonly KEY_DISABLED_EXPIRATION: "Custom key expiration values are disabled.";
+  readonly INVALID_API_KEY: "Invalid API key.";
+  readonly INVALID_USER_ID_FROM_API_KEY: "The user id from the API key is invalid.";
+  readonly INVALID_API_KEY_GETTER_RETURN_TYPE: "API Key getter returned an invalid key type. Expected string.";
+  readonly SERVER_ONLY_PROPERTY: "The property you're trying to set can only be set from the server auth instance only.";
+  readonly FAILED_TO_UPDATE_API_KEY: "Failed to update API key";
+  readonly NAME_REQUIRED: "API Key name is required.";
+};
+declare const API_KEY_TABLE_NAME = "apikey";
+declare const apiKey: (options?: ApiKeyOptions | undefined) => {
+  id: "api-key";
+  $ERROR_CODES: {
+    readonly INVALID_METADATA_TYPE: "metadata must be an object or undefined";
+    readonly REFILL_AMOUNT_AND_INTERVAL_REQUIRED: "refillAmount is required when refillInterval is provided";
+    readonly REFILL_INTERVAL_AND_AMOUNT_REQUIRED: "refillInterval is required when refillAmount is provided";
+    readonly USER_BANNED: "User is banned";
+    readonly UNAUTHORIZED_SESSION: "Unauthorized or invalid session";
+    readonly KEY_NOT_FOUND: "API Key not found";
+    readonly KEY_DISABLED: "API Key is disabled";
+    readonly KEY_EXPIRED: "API Key has expired";
+    readonly USAGE_EXCEEDED: "API Key has reached its usage limit";
+    readonly KEY_NOT_RECOVERABLE: "API Key is not recoverable";
+    readonly EXPIRES_IN_IS_TOO_SMALL: "The expiresIn is smaller than the predefined minimum value.";
+    readonly EXPIRES_IN_IS_TOO_LARGE: "The expiresIn is larger than the predefined maximum value.";
+    readonly INVALID_REMAINING: "The remaining count is either too large or too small.";
+    readonly INVALID_PREFIX_LENGTH: "The prefix length is either too large or too small.";
+    readonly INVALID_NAME_LENGTH: "The name length is either too large or too small.";
+    readonly METADATA_DISABLED: "Metadata is disabled.";
+    readonly RATE_LIMIT_EXCEEDED: "Rate limit exceeded.";
+    readonly NO_VALUES_TO_UPDATE: "No values to update.";
+    readonly KEY_DISABLED_EXPIRATION: "Custom key expiration values are disabled.";
+    readonly INVALID_API_KEY: "Invalid API key.";
+    readonly INVALID_USER_ID_FROM_API_KEY: "The user id from the API key is invalid.";
+    readonly INVALID_API_KEY_GETTER_RETURN_TYPE: "API Key getter returned an invalid key type. Expected string.";
+    readonly SERVER_ONLY_PROPERTY: "The property you're trying to set can only be set from the server auth instance only.";
+    readonly FAILED_TO_UPDATE_API_KEY: "Failed to update API key";
+    readonly NAME_REQUIRED: "API Key name is required.";
+  };
+  hooks: {
+    before: {
+      matcher: (ctx: _gatwech_core61.HookEndpointContext) => boolean;
+      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+        user: {
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          email: string;
+          emailVerified: boolean;
+          name: string;
+          image?: string | null | undefined;
+        };
+        session: {
+          id: string;
+          token: string;
+          userId: string;
+          userAgent: string | null;
+          ipAddress: string | null;
+          createdAt: Date;
+          updatedAt: Date;
+          expiresAt: Date;
+        };
+      } | {
+        context: better_call636.MiddlewareContext<better_call636.MiddlewareOptions, _gatwech_core61.AuthContext<_gatwech_core61.PayvoAuthOptions> & {
+          returned?: unknown | undefined;
+          responseHeaders?: Headers | undefined;
+        }>;
+      }>;
+    }[];
+  };
+  endpoints: {
+    /**
+     * ### Endpoint
+     *
+     * POST `/api-key/create`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.createApiKey`
+     *
+     * **client:**
+     * `authClient.apiKey.create`
+     *
+     * @see [Read our docs to learn more.](https://payvopayvo.com/docs/plugins/api-key#api-method-api-key-create)
+     */
+    createApiKey: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+        body: {
+          name?: string | undefined;
+          expiresIn?: number | null | undefined;
+          userId?: unknown;
+          prefix?: string | undefined;
+          remaining?: number | null | undefined;
+          metadata?: any;
+          refillAmount?: number | undefined;
+          refillInterval?: number | undefined;
+          rateLimitTimeWindow?: number | undefined;
+          rateLimitMax?: number | undefined;
+          rateLimitEnabled?: boolean | undefined;
+          permissions?: Record<string, string[]> | undefined;
+        };
+      } & {
+        method?: "POST" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call636.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          key: string;
+          metadata: any;
+          permissions: any;
+          id: string;
+          name: string | null;
+          start: string | null;
+          prefix: string | null;
+          userId: string;
+          refillInterval: number | null;
+          refillAmount: number | null;
+          lastRefillAt: Date | null;
+          enabled: boolean;
+          rateLimitEnabled: boolean;
+          rateLimitTimeWindow: number | null;
+          rateLimitMax: number | null;
+          requestCount: number;
+          remaining: number | null;
+          lastRequest: Date | null;
+          expiresAt: Date | null;
+          createdAt: Date;
+          updatedAt: Date;
+        };
+      } : {
+        key: string;
+        metadata: any;
+        permissions: any;
+        id: string;
+        name: string | null;
+        start: string | null;
+        prefix: string | null;
+        userId: string;
+        refillInterval: number | null;
+        refillAmount: number | null;
+        lastRefillAt: Date | null;
+        enabled: boolean;
+        rateLimitEnabled: boolean;
+        rateLimitTimeWindow: number | null;
+        rateLimitMax: number | null;
+        requestCount: number;
+        remaining: number | null;
+        lastRequest: Date | null;
+        expiresAt: Date | null;
+        createdAt: Date;
+        updatedAt: Date;
+      }>;
+      options: {
+        method: "POST";
+        body: zod1419.ZodObject<{
+          name: zod1419.ZodOptional<zod1419.ZodString>;
+          expiresIn: zod1419.ZodDefault<zod1419.ZodNullable<zod1419.ZodOptional<zod1419.ZodNumber>>>;
+          userId: zod1419.ZodOptional<zod1419.ZodCoercedString<unknown>>;
+          prefix: zod1419.ZodOptional<zod1419.ZodString>;
+          remaining: zod1419.ZodDefault<zod1419.ZodNullable<zod1419.ZodOptional<zod1419.ZodNumber>>>;
+          metadata: zod1419.ZodOptional<zod1419.ZodAny>;
+          refillAmount: zod1419.ZodOptional<zod1419.ZodNumber>;
+          refillInterval: zod1419.ZodOptional<zod1419.ZodNumber>;
+          rateLimitTimeWindow: zod1419.ZodOptional<zod1419.ZodNumber>;
+          rateLimitMax: zod1419.ZodOptional<zod1419.ZodNumber>;
+          rateLimitEnabled: zod1419.ZodOptional<zod1419.ZodBoolean>;
+          permissions: zod1419.ZodOptional<zod1419.ZodRecord<zod1419.ZodString, zod1419.ZodArray<zod1419.ZodString>>>;
+        }, zod_v4_core207.$strip>;
+        metadata: {
+          openapi: {
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        id: {
+                          type: string;
+                          description: string;
+                        };
+                        createdAt: {
+                          type: string;
+                          format: string;
+                          description: string;
+                        };
+                        updatedAt: {
+                          type: string;
+                          format: string;
+                          description: string;
+                        };
+                        name: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        prefix: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        start: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        key: {
+                          type: string;
+                          description: string;
+                        };
+                        enabled: {
+                          type: string;
+                          description: string;
+                        };
+                        expiresAt: {
+                          type: string;
+                          format: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        userId: {
+                          type: string;
+                          description: string;
+                        };
+                        lastRefillAt: {
+                          type: string;
+                          format: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        lastRequest: {
+                          type: string;
+                          format: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        metadata: {
+                          type: string;
+                          nullable: boolean;
+                          additionalProperties: boolean;
+                          description: string;
+                        };
+                        rateLimitMax: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        rateLimitTimeWindow: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        remaining: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        refillAmount: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        refillInterval: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        rateLimitEnabled: {
+                          type: string;
+                          description: string;
+                        };
+                        requestCount: {
+                          type: string;
+                          description: string;
+                        };
+                        permissions: {
+                          type: string;
+                          nullable: boolean;
+                          additionalProperties: {
+                            type: string;
+                            items: {
+                              type: string;
+                            };
+                          };
+                          description: string;
+                        };
+                      };
+                      required: string[];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      } & {
+        use: any[];
+      };
+      path: "/api-key/create";
+    };
+    /**
+     * ### Endpoint
+     *
+     * POST `/api-key/verify`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.verifyApiKey`
+     *
+     * @see [Read our docs to learn more.](https://payvopayvo.com/docs/plugins/api-key#api-method-api-key-verify)
+     */
+    verifyApiKey: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+        body: {
+          key: string;
+          permissions?: Record<string, string[]> | undefined;
+        };
+      } & {
+        method?: "POST" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call636.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          valid: boolean;
+          error: {
+            message: string | undefined;
+            code: string;
+          };
+          key: null;
+        } | {
+          valid: boolean;
+          error: null;
+          key: Omit<ApiKey, "key"> | null;
+        };
+      } : {
+        valid: boolean;
+        error: {
+          message: string | undefined;
+          code: string;
+        };
+        key: null;
+      } | {
+        valid: boolean;
+        error: null;
+        key: Omit<ApiKey, "key"> | null;
+      }>;
+      options: {
+        method: "POST";
+        body: zod1419.ZodObject<{
+          key: zod1419.ZodString;
+          permissions: zod1419.ZodOptional<zod1419.ZodRecord<zod1419.ZodString, zod1419.ZodArray<zod1419.ZodString>>>;
+        }, zod_v4_core207.$strip>;
+        metadata: {
+          SERVER_ONLY: true;
+        };
+      } & {
+        use: any[];
+      };
+      path: "/api-key/verify";
+    };
+    /**
+     * ### Endpoint
+     *
+     * GET `/api-key/get`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.getApiKey`
+     *
+     * **client:**
+     * `authClient.apiKey.get`
+     *
+     * @see [Read our docs to learn more.](https://payvopayvo.com/docs/plugins/api-key#api-method-api-key-get)
+     */
+    getApiKey: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+        body?: undefined;
+      } & {
+        method?: "GET" | undefined;
+      } & {
+        query: {
+          id: string;
+        };
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call636.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          permissions: {
+            [key: string]: string[];
+          } | null;
+          id: string;
+          name: string | null;
+          start: string | null;
+          prefix: string | null;
+          userId: string;
+          refillInterval: number | null;
+          refillAmount: number | null;
+          lastRefillAt: Date | null;
+          enabled: boolean;
+          rateLimitEnabled: boolean;
+          rateLimitTimeWindow: number | null;
+          rateLimitMax: number | null;
+          requestCount: number;
+          remaining: number | null;
+          lastRequest: Date | null;
+          expiresAt: Date | null;
+          createdAt: Date;
+          updatedAt: Date;
+          metadata: Record<string, any> | null;
+        };
+      } : {
+        permissions: {
+          [key: string]: string[];
+        } | null;
+        id: string;
+        name: string | null;
+        start: string | null;
+        prefix: string | null;
+        userId: string;
+        refillInterval: number | null;
+        refillAmount: number | null;
+        lastRefillAt: Date | null;
+        enabled: boolean;
+        rateLimitEnabled: boolean;
+        rateLimitTimeWindow: number | null;
+        rateLimitMax: number | null;
+        requestCount: number;
+        remaining: number | null;
+        lastRequest: Date | null;
+        expiresAt: Date | null;
+        createdAt: Date;
+        updatedAt: Date;
+        metadata: Record<string, any> | null;
+      }>;
+      options: {
+        method: "GET";
+        query: zod1419.ZodObject<{
+          id: zod1419.ZodString;
+        }, zod_v4_core207.$strip>;
+        use: ((inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>)[];
+        metadata: {
+          openapi: {
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        id: {
+                          type: string;
+                          description: string;
+                        };
+                        name: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        start: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        prefix: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        userId: {
+                          type: string;
+                          description: string;
+                        };
+                        refillInterval: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        refillAmount: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        lastRefillAt: {
+                          type: string;
+                          format: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        enabled: {
+                          type: string;
+                          description: string;
+                          default: boolean;
+                        };
+                        rateLimitEnabled: {
+                          type: string;
+                          description: string;
+                        };
+                        rateLimitTimeWindow: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        rateLimitMax: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        requestCount: {
+                          type: string;
+                          description: string;
+                        };
+                        remaining: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        lastRequest: {
+                          type: string;
+                          format: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        expiresAt: {
+                          type: string;
+                          format: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        createdAt: {
+                          type: string;
+                          format: string;
+                          description: string;
+                        };
+                        updatedAt: {
+                          type: string;
+                          format: string;
+                          description: string;
+                        };
+                        metadata: {
+                          type: string;
+                          nullable: boolean;
+                          additionalProperties: boolean;
+                          description: string;
+                        };
+                        permissions: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                      };
+                      required: string[];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      } & {
+        use: any[];
+      };
+      path: "/api-key/get";
+    };
+    /**
+     * ### Endpoint
+     *
+     * POST `/api-key/update`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.updateApiKey`
+     *
+     * **client:**
+     * `authClient.apiKey.update`
+     *
+     * @see [Read our docs to learn more.](https://payvopayvo.com/docs/plugins/api-key#api-method-api-key-update)
+     */
+    updateApiKey: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+        body: {
+          keyId: string;
+          userId?: unknown;
+          name?: string | undefined;
+          enabled?: boolean | undefined;
+          remaining?: number | undefined;
+          refillAmount?: number | undefined;
+          refillInterval?: number | undefined;
+          metadata?: any;
+          expiresIn?: number | null | undefined;
+          rateLimitEnabled?: boolean | undefined;
+          rateLimitTimeWindow?: number | undefined;
+          rateLimitMax?: number | undefined;
+          permissions?: Record<string, string[]> | null | undefined;
+        };
+      } & {
+        method?: "POST" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call636.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          permissions: {
+            [key: string]: string[];
+          } | null;
+          id: string;
+          name: string | null;
+          start: string | null;
+          prefix: string | null;
+          userId: string;
+          refillInterval: number | null;
+          refillAmount: number | null;
+          lastRefillAt: Date | null;
+          enabled: boolean;
+          rateLimitEnabled: boolean;
+          rateLimitTimeWindow: number | null;
+          rateLimitMax: number | null;
+          requestCount: number;
+          remaining: number | null;
+          lastRequest: Date | null;
+          expiresAt: Date | null;
+          createdAt: Date;
+          updatedAt: Date;
+          metadata: Record<string, any> | null;
+        };
+      } : {
+        permissions: {
+          [key: string]: string[];
+        } | null;
+        id: string;
+        name: string | null;
+        start: string | null;
+        prefix: string | null;
+        userId: string;
+        refillInterval: number | null;
+        refillAmount: number | null;
+        lastRefillAt: Date | null;
+        enabled: boolean;
+        rateLimitEnabled: boolean;
+        rateLimitTimeWindow: number | null;
+        rateLimitMax: number | null;
+        requestCount: number;
+        remaining: number | null;
+        lastRequest: Date | null;
+        expiresAt: Date | null;
+        createdAt: Date;
+        updatedAt: Date;
+        metadata: Record<string, any> | null;
+      }>;
+      options: {
+        method: "POST";
+        body: zod1419.ZodObject<{
+          keyId: zod1419.ZodString;
+          userId: zod1419.ZodOptional<zod1419.ZodCoercedString<unknown>>;
+          name: zod1419.ZodOptional<zod1419.ZodString>;
+          enabled: zod1419.ZodOptional<zod1419.ZodBoolean>;
+          remaining: zod1419.ZodOptional<zod1419.ZodNumber>;
+          refillAmount: zod1419.ZodOptional<zod1419.ZodNumber>;
+          refillInterval: zod1419.ZodOptional<zod1419.ZodNumber>;
+          metadata: zod1419.ZodOptional<zod1419.ZodAny>;
+          expiresIn: zod1419.ZodNullable<zod1419.ZodOptional<zod1419.ZodNumber>>;
+          rateLimitEnabled: zod1419.ZodOptional<zod1419.ZodBoolean>;
+          rateLimitTimeWindow: zod1419.ZodOptional<zod1419.ZodNumber>;
+          rateLimitMax: zod1419.ZodOptional<zod1419.ZodNumber>;
+          permissions: zod1419.ZodNullable<zod1419.ZodOptional<zod1419.ZodRecord<zod1419.ZodString, zod1419.ZodArray<zod1419.ZodString>>>>;
+        }, zod_v4_core207.$strip>;
+        metadata: {
+          openapi: {
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        id: {
+                          type: string;
+                          description: string;
+                        };
+                        name: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        start: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        prefix: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        userId: {
+                          type: string;
+                          description: string;
+                        };
+                        refillInterval: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        refillAmount: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        lastRefillAt: {
+                          type: string;
+                          format: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        enabled: {
+                          type: string;
+                          description: string;
+                          default: boolean;
+                        };
+                        rateLimitEnabled: {
+                          type: string;
+                          description: string;
+                        };
+                        rateLimitTimeWindow: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        rateLimitMax: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        requestCount: {
+                          type: string;
+                          description: string;
+                        };
+                        remaining: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        lastRequest: {
+                          type: string;
+                          format: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        expiresAt: {
+                          type: string;
+                          format: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                        createdAt: {
+                          type: string;
+                          format: string;
+                          description: string;
+                        };
+                        updatedAt: {
+                          type: string;
+                          format: string;
+                          description: string;
+                        };
+                        metadata: {
+                          type: string;
+                          nullable: boolean;
+                          additionalProperties: boolean;
+                          description: string;
+                        };
+                        permissions: {
+                          type: string;
+                          nullable: boolean;
+                          description: string;
+                        };
+                      };
+                      required: string[];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      } & {
+        use: any[];
+      };
+      path: "/api-key/update";
+    };
+    /**
+     * ### Endpoint
+     *
+     * POST `/api-key/delete`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.deleteApiKey`
+     *
+     * **client:**
+     * `authClient.apiKey.delete`
+     *
+     * @see [Read our docs to learn more.](https://payvopayvo.com/docs/plugins/api-key#api-method-api-key-delete)
+     */
+    deleteApiKey: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+        body: {
+          keyId: string;
+        };
+      } & {
+        method?: "POST" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call636.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          success: boolean;
+        };
+      } : {
+        success: boolean;
+      }>;
+      options: {
+        method: "POST";
+        body: zod1419.ZodObject<{
+          keyId: zod1419.ZodString;
+        }, zod_v4_core207.$strip>;
+        use: ((inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>)[];
+        metadata: {
+          openapi: {
+            description: string;
+            requestBody: {
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      keyId: {
+                        type: string;
+                        description: string;
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+            responses: {
+              "200": {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        success: {
+                          type: string;
+                          description: string;
+                        };
+                      };
+                      required: string[];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      } & {
+        use: any[];
+      };
+      path: "/api-key/delete";
+    };
+    /**
+     * ### Endpoint
+     *
+     * GET `/api-key/list`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.listApiKeys`
+     *
+     * **client:**
+     * `authClient.apiKey.list`
+     *
+     * @see [Read our docs to learn more.](https://payvopayvo.com/docs/plugins/api-key#api-method-api-key-list)
+     */
+    listApiKeys: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0?: ({
+        body?: undefined;
+      } & {
+        method?: "GET" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call636.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }) | undefined): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          permissions: {
+            [key: string]: string[];
+          } | null;
+          id: string;
+          name: string | null;
+          start: string | null;
+          prefix: string | null;
+          userId: string;
+          refillInterval: number | null;
+          refillAmount: number | null;
+          lastRefillAt: Date | null;
+          enabled: boolean;
+          rateLimitEnabled: boolean;
+          rateLimitTimeWindow: number | null;
+          rateLimitMax: number | null;
+          requestCount: number;
+          remaining: number | null;
+          lastRequest: Date | null;
+          expiresAt: Date | null;
+          createdAt: Date;
+          updatedAt: Date;
+          metadata: Record<string, any> | null;
+        }[];
+      } : {
+        permissions: {
+          [key: string]: string[];
+        } | null;
+        id: string;
+        name: string | null;
+        start: string | null;
+        prefix: string | null;
+        userId: string;
+        refillInterval: number | null;
+        refillAmount: number | null;
+        lastRefillAt: Date | null;
+        enabled: boolean;
+        rateLimitEnabled: boolean;
+        rateLimitTimeWindow: number | null;
+        rateLimitMax: number | null;
+        requestCount: number;
+        remaining: number | null;
+        lastRequest: Date | null;
+        expiresAt: Date | null;
+        createdAt: Date;
+        updatedAt: Date;
+        metadata: Record<string, any> | null;
+      }[]>;
+      options: {
+        method: "GET";
+        use: ((inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>)[];
+        metadata: {
+          openapi: {
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "array";
+                      items: {
+                        type: string;
+                        properties: {
+                          id: {
+                            type: string;
+                            description: string;
+                          };
+                          name: {
+                            type: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          start: {
+                            type: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          prefix: {
+                            type: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          userId: {
+                            type: string;
+                            description: string;
+                          };
+                          refillInterval: {
+                            type: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          refillAmount: {
+                            type: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          lastRefillAt: {
+                            type: string;
+                            format: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          enabled: {
+                            type: string;
+                            description: string;
+                            default: boolean;
+                          };
+                          rateLimitEnabled: {
+                            type: string;
+                            description: string;
+                          };
+                          rateLimitTimeWindow: {
+                            type: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          rateLimitMax: {
+                            type: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          requestCount: {
+                            type: string;
+                            description: string;
+                          };
+                          remaining: {
+                            type: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          lastRequest: {
+                            type: string;
+                            format: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          expiresAt: {
+                            type: string;
+                            format: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          createdAt: {
+                            type: string;
+                            format: string;
+                            description: string;
+                          };
+                          updatedAt: {
+                            type: string;
+                            format: string;
+                            description: string;
+                          };
+                          metadata: {
+                            type: string;
+                            nullable: boolean;
+                            additionalProperties: boolean;
+                            description: string;
+                          };
+                          permissions: {
+                            type: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                        };
+                        required: string[];
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      } & {
+        use: any[];
+      };
+      path: "/api-key/list";
+    };
+    /**
+     * ### Endpoint
+     *
+     * POST `/api-key/delete-all-expired-api-keys`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.deleteAllExpiredApiKeys`
+     *
+     * @see [Read our docs to learn more.](https://payvopayvo.com/docs/plugins/api-key#api-method-api-key-delete-all-expired-api-keys)
+     */
+    deleteAllExpiredApiKeys: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0?: ({
+        body?: undefined;
+      } & {
+        method?: "POST" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call636.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }) | undefined): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          success: boolean;
+          error: unknown;
+        };
+      } : {
+        success: boolean;
+        error: unknown;
+      }>;
+      options: {
+        method: "POST";
+        metadata: {
+          SERVER_ONLY: true;
+          client: boolean;
+        };
+      } & {
+        use: any[];
+      };
+      path: "/api-key/delete-all-expired-api-keys";
+    };
+  };
+  schema: {
+    apikey: {
+      fields: {
+        name: {
+          type: "string";
+          required: false;
+          input: false;
+        };
+        start: {
+          type: "string";
+          required: false;
+          input: false;
+        };
+        prefix: {
+          type: "string";
+          required: false;
+          input: false;
+        };
+        key: {
+          type: "string";
+          required: true;
+          input: false;
+        };
+        userId: {
+          type: "string";
+          references: {
+            model: string;
+            field: string;
+            onDelete: "cascade";
+          };
+          required: true;
+          input: false;
+        };
+        refillInterval: {
+          type: "number";
+          required: false;
+          input: false;
+        };
+        refillAmount: {
+          type: "number";
+          required: false;
+          input: false;
+        };
+        lastRefillAt: {
+          type: "date";
+          required: false;
+          input: false;
+        };
+        enabled: {
+          type: "boolean";
+          required: false;
+          input: false;
+          defaultValue: true;
+        };
+        rateLimitEnabled: {
+          type: "boolean";
+          required: false;
+          input: false;
+          defaultValue: true;
+        };
+        rateLimitTimeWindow: {
+          type: "number";
+          required: false;
+          input: false;
+          defaultValue: number;
+        };
+        rateLimitMax: {
+          type: "number";
+          required: false;
+          input: false;
+          defaultValue: number;
+        };
+        requestCount: {
+          type: "number";
+          required: false;
+          input: false;
+          defaultValue: number;
+        };
+        remaining: {
+          type: "number";
+          required: false;
+          input: false;
+        };
+        lastRequest: {
+          type: "date";
+          required: false;
+          input: false;
+        };
+        expiresAt: {
+          type: "date";
+          required: false;
+          input: false;
+        };
+        createdAt: {
+          type: "date";
+          required: true;
+          input: false;
+        };
+        updatedAt: {
+          type: "date";
+          required: true;
+          input: false;
+        };
+        permissions: {
+          type: "string";
+          required: false;
+          input: false;
+        };
+        metadata: {
+          type: "string";
+          required: false;
+          input: true;
+          transform: {
+            input(value: DBPrimitive): string;
+            output(value: DBPrimitive): any;
+          };
+        };
+      };
+    };
+  };
+};
+//#endregion
+//#region src/plugins/last-login-method/index.d.ts
+/**
+ * Configuration for tracking different authentication methods
+ */
+interface LastLoginMethodOptions {
+  /**
+   * Name of the cookie to store the last login method
+   * @default "payvo-auth.last_used_login_method"
+   */
+  cookieName?: string | undefined;
+  /**
+   * Cookie expiration time in seconds
+   * @default 2592000 (30 days)
+   */
+  maxAge?: number | undefined;
+  /**
+   * Custom method to resolve the last login method
+   * @param ctx - The context from the hook
+   * @returns The last login method
+   */
+  customResolveMethod?: ((ctx: GenericEndpointContext) => string | null) | undefined;
+  /**
+   * Store the last login method in the database. This will create a new field in the user table.
+   * @default false
+   */
+  storeInDatabase?: boolean | undefined;
+  /**
+   * Custom schema for the plugin
+   * @default undefined
+   */
+  schema?: {
+    user?: {
+      lastLoginMethod?: string;
+    };
+  } | undefined;
+}
+/**
+ * Plugin to track the last used login method
+ */
+declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O | undefined) => {
+  id: "last-login-method";
+  init(ctx: _gatwech_core61.AuthContext<_gatwech_core61.PayvoAuthOptions>): {
+    options: {
+      databaseHooks: {
+        user: {
+          create: {
+            before(user: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<{
+              data: {
+                lastLoginMethod: any;
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            } | undefined>;
+          };
+        };
+        session: {
+          create: {
+            after(session: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
+          };
+        };
+      };
+    };
+  };
+  hooks: {
+    after: {
+      matcher(): true;
+      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<void>;
+    }[];
+  };
+  schema: O["storeInDatabase"] extends true ? {
+    user: {
+      fields: {
+        lastLoginMethod: {
+          type: "string";
+          required: false;
+          input: false;
+        };
+      };
+    };
+  } : undefined;
+};
+//#endregion
+//#region src/plugins/audit-log/events.d.ts
+/**
+ * Audit event types recorded by the audit log plugin
+ */
+declare const AUDIT_EVENT_TYPES: {
+  readonly USER_SIGNED_UP: "user_signed_up";
+  readonly USER_PROFILE_UPDATED: "user_profile_updated";
+  readonly USER_PROFILE_IMAGE_UPDATED: "user_profile_image_updated";
+  readonly USER_EMAIL_VERIFIED: "user_email_verified";
+  readonly USER_BANNED: "user_banned";
+  readonly USER_UNBANNED: "user_unbanned";
+  readonly USER_DELETED: "user_deleted";
+  readonly USER_ROLE_UPDATED: "user_role_updated";
+  readonly USER_EMAIL_CHANGED: "user_email_changed";
+  readonly USER_PHONE_NUMBER_CHANGED: "user_phone_number_changed";
+  readonly USER_SIGNED_IN: "user_signed_in";
+  readonly USER_SIGNED_OUT: "user_signed_out";
+  readonly SESSION_CREATED: "session_created";
+  readonly SESSION_REVOKED: "session_revoked";
+  readonly SESSIONS_REVOKED_ALL: "sessions_revoked_all";
+  readonly USER_IMPERSONATED: "user_impersonated";
+  readonly USER_IMPERSONATION_STOPPED: "user_impersonation_stopped";
+  readonly DEVICE_AUTHORIZATION_APPROVED: "device_authorization_approved";
+  readonly DEVICE_AUTHORIZATION_DENIED: "device_authorization_denied";
+  readonly ACCOUNT_LINKED: "account_linked";
+  readonly ACCOUNT_UNLINKED: "account_unlinked";
+  readonly PASSWORD_CHANGED: "password_changed";
+  readonly TWO_FACTOR_ENABLED: "two_factor_enabled";
+  readonly TWO_FACTOR_DISABLED: "two_factor_disabled";
+  readonly BACKUP_CODES_GENERATED: "two_factor_backup_codes_generated";
+  readonly PASSKEY_ADDED: "passkey_added";
+  readonly PASSKEY_REMOVED: "passkey_removed";
+  readonly API_KEY_CREATED: "api_key_created";
+  readonly API_KEY_UPDATED: "api_key_updated";
+  readonly API_KEY_DELETED: "api_key_deleted";
+  readonly PASSWORD_RESET_REQUESTED: "password_reset_requested";
+  readonly PASSWORD_RESET_COMPLETED: "password_reset_completed";
+  readonly EMAIL_VERIFICATION_SENT: "email_verification_sent";
+  readonly ORGANIZATION_CREATED: "organization_created";
+  readonly ORGANIZATION_UPDATED: "organization_updated";
+  readonly ORGANIZATION_DELETED: "organization_deleted";
+  readonly ORGANIZATION_ROLE_CREATED: "organization_role_created";
+  readonly ORGANIZATION_ROLE_UPDATED: "organization_role_updated";
+  readonly ORGANIZATION_ROLE_DELETED: "organization_role_deleted";
+  readonly MEMBER_ADDED: "member_added";
+  readonly MEMBER_REMOVED: "member_removed";
+  readonly MEMBER_ROLE_UPDATED: "member_role_updated";
+  readonly MEMBER_INVITED: "member_invited";
+  readonly INVITE_ACCEPTED: "invite_accepted";
+  readonly INVITE_REJECTED: "invite_rejected";
+  readonly INVITE_CANCELLED: "invite_cancelled";
+  readonly TEAM_CREATED: "team_created";
+  readonly TEAM_UPDATED: "team_updated";
+  readonly TEAM_DELETED: "team_deleted";
+  readonly TEAM_MEMBER_ADDED: "team_member_added";
+  readonly TEAM_MEMBER_REMOVED: "team_member_removed";
+  readonly USER_SIGN_IN_FAILED: "user_sign_in_failed";
+  readonly VERIFICATION_FAILED: "verification_failed";
+};
+/**
+ * Security event types recorded by the sentinel plugin
+ *
+ * Declared here so both plugins share the same event types
+ */
+declare const SECURITY_EVENT_TYPES: {
+  readonly BLOCKED: "security_blocked";
+  readonly ALLOWED_AFTER_CHALLENGE: "security_allowed";
+  readonly CREDENTIAL_STUFFING: "security_credential_stuffing";
+  readonly IMPOSSIBLE_TRAVEL: "security_impossible_travel";
+  readonly GEO_BLOCKED: "security_geo_blocked";
+  readonly BOT_BLOCKED: "security_bot_blocked";
+  readonly SUSPICIOUS_IP: "security_suspicious_ip";
+  readonly VELOCITY_EXCEEDED: "security_velocity_exceeded";
+  readonly FREE_TRIAL_ABUSE: "security_free_trial_abuse";
+  readonly COMPROMISED_PASSWORD: "security_compromised_password";
+  readonly STALE_ACCOUNT: "security_stale_account";
+  readonly INVALID_EMAIL: "security_invalid_email";
+};
+type AuditEventType = (typeof AUDIT_EVENT_TYPES)[keyof typeof AUDIT_EVENT_TYPES] | (typeof SECURITY_EVENT_TYPES)[keyof typeof SECURITY_EVENT_TYPES];
+declare const ALL_EVENT_TYPES: AuditEventType[];
+/** Endpoints that complete a sign-in by creating a session */
+declare const SIGN_IN_PATHS: string[];
+/** Sign-in endpoints that check credentials, so a failure is a failed attempt */
+declare const CREDENTIAL_SIGN_IN_PATHS: string[];
+/**
+ * Endpoints that check a one-time code or token outside a sign-in, so a
+ * failure is a failed attempt
+ */
+declare const VERIFICATION_PATHS: string[];
+/** Endpoints whose successful response maps to a single event */
+declare const PATH_EVENTS: Record<string, AuditEventType>;
+//#endregion
+//#region src/plugins/audit-log/schema.d.ts
+declare const schema: {
+  auditLog: {
+    fields: {
+      eventType: {
+        type: "string";
+        required: true;
+      };
+      userId: {
+        type: "string";
+        required: false;
+      };
+      identifier: {
+        type: "string";
+        required: false;
+      };
+      organizationId: {
+        type: "string";
+        required: false;
+      };
+      status: {
+        type: "string";
+        required: true;
+      };
+      path: {
+        type: "string";
+        required: false;
+      };
+      ipAddress: {
+        type: "string";
+        required: false;
+      };
+      userAgent: {
+        type: "string";
+        required: false;
+      };
+      visitorId: {
+        type: "string";
+        required: false;
+      };
+      eventData: {
+        type: "json";
+        required: false;
+      };
+      createdAt: {
+        type: "date";
+        required: true;
+      };
+    };
+  };
+};
+//#endregion
+//#region src/plugins/audit-log/types.d.ts
+interface AuditEvent {
+  id: string;
+  eventType: AuditEventType;
+  status: "success" | "failure" | "blocked" | "challenged";
+  /**
+   * The user who performed the action
+   *
+   * Null when the actor is unknown, e.g. a failed sign-in
+   */
+  userId: string | null;
+  /**
+   * The actor's identity, such as an email, username or phone number
+   */
+  identifier: string | null;
+  organizationId: string | null;
+  /**
+   * The endpoint that triggered the event
+   */
+  path: string | null;
+  ipAddress: string | null;
+  userAgent: string | null;
+  visitorId: string | null;
+  /**
+   * Additional details about the event
+   *
+   * Never contains passwords, tokens or OTPs
+   */
+  eventData: Record<string, unknown> | null;
+  createdAt: Date;
+}
+interface AuditLogOptions {
+  /**
+   * Send events to the hosted backend
+   *
+   * Enabled when an API key and URL are configured, either here or through
+   * `PAYVO_INFRA_API_KEY` and `PAYVO_INFRA_API_URL`. Set to `false` to
+   * disable it.
+   */
+  remote?: {
+    /**
+     * The hosted backend API URL
+     *
+     * @default process.env.PAYVO_INFRA_API_URL
+     */
+    apiUrl?: string | undefined;
+    /**
+     * The hosted backend API key
+     *
+     * @default process.env.PAYVO_INFRA_API_KEY
+     */
+    apiKey?: string | undefined;
+    /**
+     * Request timeout in milliseconds
+     *
+     * @default 3000
+     */
+    timeout?: number | undefined;
+    /**
+     * Additional headers sent with every request
+     */
+    headers?: Record<string, string> | undefined;
+    /**
+     * Configure how events are batched before they are sent
+     */
+    batch?: {
+      /**
+       * Send buffered events once this many are queued
+       *
+       * @default 25
+       */
+      maxSize?: number | undefined;
+      /**
+       * Send buffered events after this many milliseconds
+       *
+       * @default 2000
+       */
+      flushIntervalMs?: number | undefined;
+    } | undefined;
+  } | false | undefined;
+  /**
+   * Write events to the `auditLog` table
+   *
+   * @default true
+   */
+  database?: boolean | undefined;
+  /**
+   * Called for every recorded event, e.g. to publish it to a message broker
+   *
+   * Errors are logged and ignored
+   */
+  onEvent?: ((event: AuditEvent) => void | Promise<void>) | undefined;
+  /**
+   * Event types that should not be recorded
+   */
+  exclude?: AuditEventType[] | undefined;
+  /**
+   * Record `user_sign_in_failed` events for failed sign-in attempts, and
+   * `verification_failed` events for wrong one-time codes and tokens
+   *
+   * @default true
+   */
+  trackFailedSignIns?: boolean | undefined;
+  /**
+   * Roles allowed to read every audit event through
+   * `/audit-log/get-all-audit-logs`
+   *
+   * @default ["admin"]
+   */
+  adminRoles?: string[] | undefined;
+  /**
+   * Custom schema for the audit log plugin
+   */
+  schema?: InferOptionSchema<typeof schema> | undefined;
+}
+//#endregion
+//#region src/plugins/sentinel/schema.d.ts
+declare const schema$1: {
+  sentinelCounter: {
+    fields: {
+      key: {
+        type: "string";
+        required: true;
+        unique: true;
+      };
+      count: {
+        type: "number";
+        required: true;
+      };
+      expiresAt: {
+        type: "date";
+        required: true;
+      };
+    };
+  };
+  sentinelSignIn: {
+    fields: {
+      userId: {
+        type: "string";
+        required: true;
+        references: {
+          model: string;
+          field: string;
+          onDelete: "cascade";
+        };
+      };
+      ipAddress: {
+        type: "string";
+        required: false;
+      };
+      visitorId: {
+        type: "string";
+        required: false;
+      };
+      userAgent: {
+        type: "string";
+        required: false;
+      };
+      country: {
+        type: "string";
+        required: false;
+      };
+      city: {
+        type: "string";
+        required: false;
+      };
+      latitude: {
+        type: "number";
+        required: false;
+      };
+      longitude: {
+        type: "number";
+        required: false;
+      };
+      createdAt: {
+        type: "date";
+        required: true;
+      };
+    };
+  };
+  powChallenge: {
+    fields: {
+      nonce: {
+        type: "string";
+        required: true;
+        unique: true;
+      };
+      difficulty: {
+        type: "number";
+        required: true;
+      };
+      reason: {
+        type: "string";
+        required: true;
+      };
+      ipAddress: {
+        type: "string";
+        required: false;
+      };
+      visitorId: {
+        type: "string";
+        required: false;
+      };
+      expiresAt: {
+        type: "date";
+        required: true;
+      };
+      createdAt: {
+        type: "date";
+        required: true;
+      };
+    };
+  };
+};
+//#endregion
+//#region src/plugins/sentinel/types.d.ts
+/**
+ * The action to take when a security check fails
+ *
+ * - `log`: record the event and let the request through
+ * - `challenge`: respond with `423` and a proof-of-work challenge
+ * - `block`: respond with `403`
+ */
+type SecurityAction = "log" | "challenge" | "block";
+type GeoLocation = {
+  /**
+   * ISO 3166-1 alpha-2 country code, e.g. "US"
+   */
+  country: string | null;
+  city?: string | null | undefined;
+  latitude?: number | null | undefined;
+  longitude?: number | null | undefined;
+};
+interface SentinelOptions {
+  /**
+   * The hosted backend API URL
+   *
+   * @default process.env.PAYVO_INFRA_API_URL
+   */
+  apiUrl?: string | undefined;
+  /**
+   * The hosted backend API key
+   *
+   * @default process.env.PAYVO_INFRA_API_KEY
+   */
+  apiKey?: string | undefined;
+  /**
+   * The hosted identification service URL, used to check that visitor ids
+   * sent by clients are genuine
+   *
+   * @default process.env.PAYVO_INFRA_KV_URL
+   */
+  kvUrl?: string | undefined;
+  /**
+   * Identification service HTTP options
+   */
+  kvOptions?: {
+    /**
+     * Request timeout in milliseconds
+     *
+     * @default 1000
+     */
+    timeout?: number | undefined;
+    /**
+     * Retries after a failed request, with exponential backoff
+     *
+     * @default { attempts: 2, baseDelay: 400, maxDelay: 600 }
+     */
+    retry?: {
+      attempts?: number | undefined;
+      baseDelay?: number | undefined;
+      maxDelay?: number | undefined;
+    } | undefined;
+    /**
+     * Additional headers sent with every request
+     */
+    headers?: Record<string, string> | undefined;
+  } | undefined;
+  /**
+   * Hosted backend HTTP options
+   */
+  apiOptions?: {
+    /**
+     * Request timeout in milliseconds
+     *
+     * @default 3000
+     */
+    timeout?: number | undefined;
+    /**
+     * Additional headers sent with every request
+     */
+    headers?: Record<string, string> | undefined;
+  } | undefined;
+  /**
+   * Allow requests through when a check can't complete, e.g. the hosted
+   * backend or secondary storage is unavailable
+   *
+   * @default true
+   */
+  failOpen?: boolean | undefined;
+  /**
+   * Local providers that replace the hosted backend
+   */
+  providers?: {
+    /**
+     * Resolve the client IP of a request
+     *
+     * By default the IP is read from the configured IP address headers
+     */
+    getClientIp?: ((request: Request | Headers) => string | null) | undefined;
+    /**
+     * Whether an IP address is known to be malicious
+     */
+    isSuspiciousIp?: ((ip: string) => boolean | Promise<boolean>) | undefined;
+    /**
+     * Whether a request comes from an automated client
+     */
+    isBot?: ((request: Request) => boolean | Promise<boolean>) | undefined;
+    /**
+     * Resolve the location of an IP address
+     */
+    resolveGeo?: ((ip: string) => GeoLocation | null | Promise<GeoLocation | null>) | undefined;
+  } | undefined;
+  /**
+   * Send a security notification, e.g. by email. Required for
+   * `unknownDeviceNotification` and the stale account notifications.
+   */
+  sendNotification?: ((notification: {
+    type: "unknown-device" | "stale-account";
+    /**
+     * Who the notification is for
+     */
+    recipient: "user" | "admin";
+    /**
+     * The address to send the notification to
+     */
+    email: string;
+    user: User$1;
+    signIn: {
+      at: Date;
+      ipAddress: string | null;
+      userAgent: string | null;
+      /**
+       * City and country, when known, e.g. "Berlin, DE"
+       */
+      location: string | null;
+    };
+    /**
+     * Days since the account was last active, for stale accounts
+     */
+    daysInactive?: number | undefined;
+  }) => void | Promise<void>) | undefined;
+  security?: {
+    /**
+     * Detect credential stuffing by tracking failed sign-in attempts per
+     * visitor, falling back to the IP address
+     */
+    credentialStuffing?: {
+      enabled: boolean;
+      /**
+       * Set to `log` to only record attempts. Otherwise the thresholds
+       * decide between a challenge and a block.
+       *
+       * @default "challenge"
+       */
+      action?: SecurityAction | undefined;
+      /**
+       * Number of failed attempts before a challenge or a block
+       *
+       * @default { challenge: 3, block: 5 }
+       */
+      thresholds?: {
+        challenge: number;
+        block: number;
+      } | undefined;
+      /**
+       * Window in seconds in which failed attempts are counted
+       *
+       * @default 3600
+       */
+      windowSeconds?: number | undefined;
+      /**
+       * Seconds a visitor stays blocked after reaching the block
+       * threshold
+       *
+       * @default 900
+       */
+      cooldownSeconds?: number | undefined;
+    } | undefined;
+    /**
+     * Limit how often authentication operations can be performed
+     */
+    velocity?: {
+      enabled: boolean;
+      /**
+       * Number of authentication requests per visitor in the window
+       * before a challenge or a block
+       *
+       * @default { challenge: 10, block: 20 }
+       */
+      thresholds?: {
+        challenge: number;
+        block: number;
+      } | undefined;
+      /**
+       * Maximum sign-ups per visitor in the window
+       *
+       * @default 5
+       */
+      maxSignupsPerVisitor?: number | undefined;
+      /**
+       * Maximum password reset requests per IP address in the window
+       *
+       * @default 10
+       */
+      maxPasswordResetsPerIp?: number | undefined;
+      /**
+       * Maximum sign-in attempts per IP address in the window
+       *
+       * @default 50
+       */
+      maxSignInsPerIp?: number | undefined;
+      /**
+       * Window in seconds
+       *
+       * @default 3600
+       */
+      windowSeconds?: number | undefined;
+      /**
+       * Action when a `max*` limit is exceeded
+       *
+       * @default "challenge"
+       */
+      action?: SecurityAction | undefined;
+    } | undefined;
+    /**
+     * Limit how many accounts a visitor can create
+     */
+    freeTrialAbuse?: {
+      enabled: boolean;
+      /**
+       * Number of accounts a visitor already created before a
+       * challenge or a block. Takes precedence over
+       * `maxAccountsPerVisitor`.
+       */
+      thresholds?: {
+        challenge: number;
+        block: number;
+      } | undefined;
+      /**
+       * Maximum accounts per visitor
+       *
+       * @default 3
+       */
+      maxAccountsPerVisitor?: number | undefined;
+      /**
+       * How long sign-ups are remembered per visitor, in seconds.
+       * Clamped to between 1 and 365 days.
+       *
+       * @default 7776000 (90 days)
+       */
+      retentionSeconds?: number | undefined;
+      /**
+       * Action when `maxAccountsPerVisitor` is reached
+       *
+       * @default "block"
+       */
+      action?: SecurityAction | undefined;
+    } | undefined;
+    /**
+     * Detect automated clients. `true` challenges them.
+     */
+    botBlocking?: (boolean | {
+      action: SecurityAction;
+    }) | undefined;
+    /**
+     * Detect requests from IP addresses known to be malicious. `true`
+     * blocks them.
+     */
+    suspiciousIpBlocking?: (boolean | {
+      action: SecurityAction;
+    }) | undefined;
+    /**
+     * Proof-of-work difficulty, in leading zero bits of the solution hash
+     *
+     * @default 18
+     */
+    /**
+     * Notify users when they sign in from a device they haven't used
+     * before, identified by the visitor id
+     *
+     * @default false
+     */
+    unknownDeviceNotification?: boolean | undefined;
+    /**
+     * Detect sign-ins from locations too far apart to travel between in
+     * the time since the previous sign-in. Checked once the credentials
+     * are verified; a challenge blocks sign-ins that can't be repeated,
+     * like magic links and one-time codes.
+     */
+    impossibleTravel?: {
+      enabled: boolean;
+      /**
+       * Fastest realistic travel speed, in km/h
+       *
+       * @default 1000
+       */
+      maxSpeedKmh?: number | undefined;
+      /**
+       * @default "challenge"
+       */
+      action?: SecurityAction | undefined;
+    } | undefined;
+    /**
+     * Challenge or block requests by country. Use either `allowList`
+     * or `denyList`.
+     */
+    geoBlocking?: {
+      /**
+       * Only allow these countries (ISO 3166-1 alpha-2)
+       */
+      allowList?: string[] | undefined;
+      /**
+       * Block these countries (ISO 3166-1 alpha-2)
+       */
+      denyList?: string[] | undefined;
+      /**
+       * @default "block"
+       */
+      action?: Exclude<SecurityAction, "log"> | undefined;
+    } | undefined;
+    /**
+     * Check new passwords against known breaches. Only the first 5
+     * characters of the password's SHA-1 hash are sent.
+     */
+    compromisedPassword?: {
+      enabled: boolean;
+      /**
+       * @default "block"
+       */
+      action?: SecurityAction | undefined;
+      /**
+       * Minimum number of breaches a password must appear in
+       *
+       * @default 1
+       */
+      minBreachCount?: number | undefined;
+    } | undefined;
+    /**
+     * Reject disposable email addresses and invalid email domains on
+     * sign-up and email changes
+     */
+    emailValidation?: {
+      enabled: boolean;
+      /**
+       * - `low`: block known disposable domains
+       * - `medium`: also require MX records
+       * - `high`: also reject addresses that look generated
+       *
+       * @default "medium"
+       */
+      strictness?: ("low" | "medium" | "high") | undefined;
+      /**
+       * @default "block"
+       */
+      action?: SecurityAction | undefined;
+      /**
+       * Domains that skip every check (exact match)
+       */
+      domainAllowlist?: string[] | undefined;
+    } | undefined;
+    /**
+     * Match aliases of the same mailbox, e.g. `j.doe+news@gmail.com` and
+     * `jdoe@gmail.com`. Addresses are kept as typed; an alias of an
+     * existing account signs in to it and can't be used for a new one.
+     * Adds a `normalizedEmail` field to users, set for existing users on
+     * their next sign-in.
+     */
+    emailNormalization?: {
+      /**
+       * @default false
+       */
+      enabled?: boolean | undefined;
+    } | undefined;
+    /**
+     * Detect sign-ins to accounts that haven't been used for a long time.
+     * Checked once the credentials are verified. Accounts are tracked
+     * from their first sign-in after sentinel is enabled.
+     */
+    staleUsers?: {
+      enabled: boolean;
+      /**
+       * Days of inactivity after which an account is stale
+       *
+       * @default 90
+       */
+      staleDays?: number | undefined;
+      /**
+       * @default "log"
+       */
+      action?: SecurityAction | undefined;
+      /**
+       * Notify the user through `sendNotification`
+       *
+       * @default false
+       */
+      notifyUser?: boolean | undefined;
+      /**
+       * Notify `adminEmail` through `sendNotification`
+       *
+       * @default false
+       */
+      notifyAdmin?: boolean | undefined;
+      /**
+       * Required when `notifyAdmin` is true
+       */
+      adminEmail?: string | undefined;
+    } | undefined;
+    challengeDifficulty?: number | undefined;
+  } | undefined;
+  /**
+   * Custom schema for the sentinel plugin
+   */
+  schema?: InferOptionSchema<typeof schema$1> | undefined;
+}
+//#endregion
+//#region src/plugins/sentinel/actions.d.ts
+declare const SENTINEL_ERROR_CODES: {
+  readonly POW_CHALLENGE_REQUIRED: "Challenge required";
+  readonly SECURITY_BLOCKED: "Request blocked for security reasons";
+};
+//#endregion
+//#region src/plugins/sentinel/email.d.ts
+/**
+ * Normalizes an email address so aliases of the same mailbox match:
+ * lowercases it, maps `googlemail.com` to `gmail.com`, removes dots in Gmail
+ * addresses and strips plus-address tags on providers that support them
+ */
+declare function normalizeEmail(email: string): string;
+//#endregion
+//#region src/plugins/sentinel/geo.d.ts
+/** Great-circle distance between two coordinates, in kilometres */
+declare function haversineDistanceKm(from: {
+  latitude: number;
+  longitude: number;
+}, to: {
+  latitude: number;
+  longitude: number;
+}): number;
+//#endregion
+//#region src/plugins/sentinel/pow.d.ts
+declare const POW_CHALLENGE_HEADER = "x-pow-challenge";
+declare const POW_REASON_HEADER = "x-pow-reason";
+declare const POW_SOLUTION_HEADER = "x-pow-solution";
+declare function createNonce(): string;
+/** Whether a hash starts with at least `difficulty` zero bits */
+declare function hasLeadingZeroBits(hash: Uint8Array, difficulty: number): boolean;
+/**
+ * Whether `sha256("<nonce>:<solution>")` has at least `difficulty` leading
+ * zero bits
+ */
+declare function verifySolution(nonce: string, solution: string, difficulty: number): Promise<boolean>;
+/**
+ * Find a solution for a challenge by trying incrementing counters. Yields to
+ * the event loop between batches, so solving doesn't block the page.
+ */
+declare function solveChallenge(nonce: string, difficulty: number): Promise<string>;
+/** Parses `<nonce>:<value>` header values */
+declare function parsePowHeader(value: string | null | undefined): {
+  nonce: string;
+  value: string;
+} | null;
+//#endregion
+//#region src/plugins/sentinel/index.d.ts
+declare const sentinel: (options?: SentinelOptions | undefined) => {
+  id: "sentinel";
+  init(ctx: AuthContext<_gatwech_core61.PayvoAuthOptions>): {
+    options: {
+      databaseHooks: {
+        user: {
+          create: {
+            before(user: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<{
+              data: {
+                normalizedEmail: string;
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            } | undefined>;
+            after(user: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
+          };
+          update: {
+            before(data: Partial<{
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            }> & Record<string, unknown>): Promise<{
+              data: {
+                normalizedEmail: string;
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                email?: string | undefined;
+                emailVerified?: boolean | undefined;
+                name?: string | undefined;
+                image?: string | null | undefined;
+              };
+            } | undefined>;
+          };
+        };
+      };
+    };
+  } | undefined;
+  onRequest(request: Request, ctx: AuthContext<_gatwech_core61.PayvoAuthOptions>): Promise<{
+    response: Response;
+  } | undefined>;
+  hooks: {
+    before: ({
+      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
+      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+        context: {
+          body: any;
+        };
+      } | undefined>;
+    } | {
+      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
+      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<void>;
+    })[];
+    after: ({
+      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
+      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<void>;
+    } | {
+      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
+      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<({
+        status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | better_call636.Status;
+        body: ({
+          message?: string;
+          code?: string;
+          cause?: unknown;
+        } & Record<string, any>) | undefined;
+        headers: HeadersInit;
+        statusCode: number;
+        name: string;
+        message: string;
+        stack?: string;
+        cause?: unknown;
+      } & {
+        errorStack: string | undefined;
+      }) | undefined>;
+    })[];
+  };
+  schema: {
+    sentinelCounter: {
+      fields: {
+        key: {
+          type: "string";
+          required: true;
+          unique: true;
+        };
+        count: {
+          type: "number";
+          required: true;
+        };
+        expiresAt: {
+          type: "date";
+          required: true;
+        };
+      };
+    };
+    sentinelSignIn: {
+      fields: {
+        userId: {
+          type: "string";
+          required: true;
+          references: {
+            model: string;
+            field: string;
+            onDelete: "cascade";
+          };
+        };
+        ipAddress: {
+          type: "string";
+          required: false;
+        };
+        visitorId: {
+          type: "string";
+          required: false;
+        };
+        userAgent: {
+          type: "string";
+          required: false;
+        };
+        country: {
+          type: "string";
+          required: false;
+        };
+        city: {
+          type: "string";
+          required: false;
+        };
+        latitude: {
+          type: "number";
+          required: false;
+        };
+        longitude: {
+          type: "number";
+          required: false;
+        };
+        createdAt: {
+          type: "date";
+          required: true;
+        };
+      };
+    };
+    powChallenge: {
+      fields: {
+        nonce: {
+          type: "string";
+          required: true;
+          unique: true;
+        };
+        difficulty: {
+          type: "number";
+          required: true;
+        };
+        reason: {
+          type: "string";
+          required: true;
+        };
+        ipAddress: {
+          type: "string";
+          required: false;
+        };
+        visitorId: {
+          type: "string";
+          required: false;
+        };
+        expiresAt: {
+          type: "date";
+          required: true;
+        };
+        createdAt: {
+          type: "date";
+          required: true;
+        };
+      };
+    };
+  };
+  $ERROR_CODES: {
+    readonly POW_CHALLENGE_REQUIRED: "Challenge required";
+    readonly SECURITY_BLOCKED: "Request blocked for security reasons";
+  };
+  options: {
+    failOpen: boolean;
+    apiUrl?: string | undefined;
+    apiKey?: string | undefined;
+    kvUrl?: string | undefined;
+    kvOptions?: {
+      timeout?: number | undefined;
+      retry?: {
+        attempts?: number | undefined;
+        baseDelay?: number | undefined;
+        maxDelay?: number | undefined;
+      } | undefined;
+      headers?: Record<string, string> | undefined;
+    } | undefined;
+    apiOptions?: {
+      timeout?: number | undefined;
+      headers?: Record<string, string> | undefined;
+    } | undefined;
+    providers?: {
+      getClientIp?: ((request: Request | Headers) => string | null) | undefined;
+      isSuspiciousIp?: ((ip: string) => boolean | Promise<boolean>) | undefined;
+      isBot?: ((request: Request) => boolean | Promise<boolean>) | undefined;
+      resolveGeo?: ((ip: string) => GeoLocation | null | Promise<GeoLocation | null>) | undefined;
+    } | undefined;
+    sendNotification?: ((notification: {
+      type: "unknown-device" | "stale-account";
+      recipient: "user" | "admin";
+      email: string;
+      user: User$1;
+      signIn: {
+        at: Date;
+        ipAddress: string | null;
+        userAgent: string | null;
+        location: string | null;
+      };
+      daysInactive?: number | undefined;
+    }) => void | Promise<void>) | undefined;
+    security?: {
+      credentialStuffing?: {
+        enabled: boolean;
+        action?: SecurityAction | undefined;
+        thresholds?: {
+          challenge: number;
+          block: number;
+        } | undefined;
+        windowSeconds?: number | undefined;
+        cooldownSeconds?: number | undefined;
+      } | undefined;
+      velocity?: {
+        enabled: boolean;
+        thresholds?: {
+          challenge: number;
+          block: number;
+        } | undefined;
+        maxSignupsPerVisitor?: number | undefined;
+        maxPasswordResetsPerIp?: number | undefined;
+        maxSignInsPerIp?: number | undefined;
+        windowSeconds?: number | undefined;
+        action?: SecurityAction | undefined;
+      } | undefined;
+      freeTrialAbuse?: {
+        enabled: boolean;
+        thresholds?: {
+          challenge: number;
+          block: number;
+        } | undefined;
+        maxAccountsPerVisitor?: number | undefined;
+        retentionSeconds?: number | undefined;
+        action?: SecurityAction | undefined;
+      } | undefined;
+      botBlocking?: (boolean | {
+        action: SecurityAction;
+      }) | undefined;
+      suspiciousIpBlocking?: (boolean | {
+        action: SecurityAction;
+      }) | undefined;
+      unknownDeviceNotification?: boolean | undefined;
+      impossibleTravel?: {
+        enabled: boolean;
+        maxSpeedKmh?: number | undefined;
+        action?: SecurityAction | undefined;
+      } | undefined;
+      geoBlocking?: {
+        allowList?: string[] | undefined;
+        denyList?: string[] | undefined;
+        action?: Exclude<SecurityAction, "log"> | undefined;
+      } | undefined;
+      compromisedPassword?: {
+        enabled: boolean;
+        action?: SecurityAction | undefined;
+        minBreachCount?: number | undefined;
+      } | undefined;
+      emailValidation?: {
+        enabled: boolean;
+        strictness?: ("low" | "medium" | "high") | undefined;
+        action?: SecurityAction | undefined;
+        domainAllowlist?: string[] | undefined;
+      } | undefined;
+      emailNormalization?: {
+        enabled?: boolean | undefined;
+      } | undefined;
+      staleUsers?: {
+        enabled: boolean;
+        staleDays?: number | undefined;
+        action?: SecurityAction | undefined;
+        notifyUser?: boolean | undefined;
+        notifyAdmin?: boolean | undefined;
+        adminEmail?: string | undefined;
+      } | undefined;
+      challengeDifficulty?: number | undefined;
+    } | undefined;
+    schema?: InferOptionSchema<typeof schema$1> | undefined;
+  };
+};
+//#endregion
+//#region src/plugins/audit-log/index.d.ts
+declare const AUDIT_LOG_ERROR_CODES: {
+  readonly AUDIT_LOG_ACCESS_DENIED: "You don't have access to these audit logs";
+  readonly AUDIT_LOG_UNAVAILABLE: "Audit logs are temporarily unavailable";
+};
+declare const auditLog: (options?: AuditLogOptions | undefined) => {
+  id: "audit-log";
+  init(ctx: AuthContext<_gatwech_core61.PayvoAuthOptions>): {
+    options: {
+      databaseHooks: {
+        user: {
+          create: {
+            after(user: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, unknown>, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
+          };
+          update: {
+            before(data: Partial<{
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            }> & Record<string, unknown>, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<{
+              data: Partial<{
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              }> & Record<string, unknown>;
+            }>;
+            after(user: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, unknown>, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
+          };
+          delete: {
+            after(user: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, unknown>, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
+          };
+        };
+        session: {
+          create: {
+            after(session: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            } & Record<string, unknown>, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
+          };
+        };
+        account: {
+          create: {
+            after(account: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              providerId: string;
+              accountId: string;
+              userId: string;
+              accessToken?: string | null | undefined;
+              refreshToken?: string | null | undefined;
+              idToken?: string | null | undefined;
+              accessTokenExpiresAt?: Date | null | undefined;
+              refreshTokenExpiresAt?: Date | null | undefined;
+              scope?: string | null | undefined;
+              password?: string | null | undefined;
+            }, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
+          };
+        };
+      };
+    };
+  };
+  hooks: {
+    before: {
+      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
+      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<void>;
+    }[];
+    after: {
+      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
+      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<void>;
+    }[];
+  };
+  endpoints: {
+    getAuditLogs: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0?: ({
+        body?: undefined;
+      } & {
+        method?: "GET" | undefined;
+      } & {
+        query?: {
+          limit?: string | number | undefined;
+          offset?: string | number | undefined;
+          eventType?: string | undefined;
+          identifier?: string | undefined;
+          organizationId?: string | undefined;
+          userId?: string | undefined;
+          startDate?: string | undefined;
+          endDate?: string | undefined;
+        } | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call636.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }) | undefined): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          events: AuditEvent[];
+          total: number;
+          limit: number;
+          offset: number;
+        };
+      } : {
+        events: AuditEvent[];
+        total: number;
+        limit: number;
+        offset: number;
+      }>;
+      options: {
+        method: "GET";
+        use: ((inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>)[];
+        query: zod1419.ZodOptional<zod1419.ZodObject<{
+          limit: zod1419.ZodOptional<zod1419.ZodUnion<[zod1419.ZodString, zod1419.ZodNumber]>>;
+          offset: zod1419.ZodOptional<zod1419.ZodUnion<[zod1419.ZodString, zod1419.ZodNumber]>>;
+          eventType: zod1419.ZodOptional<zod1419.ZodString>;
+          identifier: zod1419.ZodOptional<zod1419.ZodString>;
+          organizationId: zod1419.ZodOptional<zod1419.ZodString>;
+          userId: zod1419.ZodOptional<zod1419.ZodString>;
+          startDate: zod1419.ZodOptional<zod1419.ZodString>;
+          endDate: zod1419.ZodOptional<zod1419.ZodString>;
+        }, zod1419.core.$strip>>;
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              200: {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        events: {
+                          type: string;
+                          items: {
+                            type: string;
+                            properties: {
+                              id: {
+                                type: string;
+                              };
+                              eventType: {
+                                type: string;
+                              };
+                              status: {
+                                type: string;
+                              };
+                              userId: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              identifier: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              organizationId: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              path: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              ipAddress: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              userAgent: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              visitorId: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              eventData: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              createdAt: {
+                                type: string;
+                                format: string;
+                              };
+                            };
+                          };
+                        };
+                        total: {
+                          type: string;
+                        };
+                        limit: {
+                          type: string;
+                        };
+                        offset: {
+                          type: string;
+                        };
+                      };
+                      required: string[];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      } & {
+        use: any[];
+      };
+      path: "/audit-log/get-audit-logs";
+    };
+    getAllAuditLogs: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0?: ({
+        body?: undefined;
+      } & {
+        method?: "GET" | undefined;
+      } & {
+        query?: {
+          limit?: string | number | undefined;
+          offset?: string | number | undefined;
+          eventType?: string | undefined;
+          identifier?: string | undefined;
+          organizationId?: string | undefined;
+          userId?: string | undefined;
+          startDate?: string | undefined;
+          endDate?: string | undefined;
+        } | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call636.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }) | undefined): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          events: AuditEvent[];
+          total: number;
+          limit: number;
+          offset: number;
+        };
+      } : {
+        events: AuditEvent[];
+        total: number;
+        limit: number;
+        offset: number;
+      }>;
+      options: {
+        method: "GET";
+        use: ((inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>)[];
+        query: zod1419.ZodOptional<zod1419.ZodObject<{
+          limit: zod1419.ZodOptional<zod1419.ZodUnion<[zod1419.ZodString, zod1419.ZodNumber]>>;
+          offset: zod1419.ZodOptional<zod1419.ZodUnion<[zod1419.ZodString, zod1419.ZodNumber]>>;
+          eventType: zod1419.ZodOptional<zod1419.ZodString>;
+          identifier: zod1419.ZodOptional<zod1419.ZodString>;
+          organizationId: zod1419.ZodOptional<zod1419.ZodString>;
+          userId: zod1419.ZodOptional<zod1419.ZodString>;
+          startDate: zod1419.ZodOptional<zod1419.ZodString>;
+          endDate: zod1419.ZodOptional<zod1419.ZodString>;
+        }, zod1419.core.$strip>>;
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              200: {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        events: {
+                          type: string;
+                          items: {
+                            type: string;
+                            properties: {
+                              id: {
+                                type: string;
+                              };
+                              eventType: {
+                                type: string;
+                              };
+                              status: {
+                                type: string;
+                              };
+                              userId: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              identifier: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              organizationId: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              path: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              ipAddress: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              userAgent: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              visitorId: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              eventData: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              createdAt: {
+                                type: string;
+                                format: string;
+                              };
+                            };
+                          };
+                        };
+                        total: {
+                          type: string;
+                        };
+                        limit: {
+                          type: string;
+                        };
+                        offset: {
+                          type: string;
+                        };
+                      };
+                      required: string[];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      } & {
+        use: any[];
+      };
+      path: "/audit-log/get-all-audit-logs";
+    };
+    getEventTypes: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0?: ({
+        body?: undefined;
+      } & {
+        method?: "GET" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call636.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }) | undefined): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          types: AuditEventType[];
+        };
+      } : {
+        types: AuditEventType[];
+      }>;
+      options: {
+        method: "GET";
+        use: ((inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>)[];
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              200: {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        types: {
+                          type: string;
+                          items: {
+                            type: string;
+                          };
+                        };
+                      };
+                      required: string[];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      } & {
+        use: any[];
+      };
+      path: "/audit-log/get-event-types";
+    };
+  };
+  schema: {
+    auditLog: {
+      fields: {
+        eventType: {
+          type: "string";
+          required: true;
+        };
+        userId: {
+          type: "string";
+          required: false;
+        };
+        identifier: {
+          type: "string";
+          required: false;
+        };
+        organizationId: {
+          type: "string";
+          required: false;
+        };
+        status: {
+          type: "string";
+          required: true;
+        };
+        path: {
+          type: "string";
+          required: false;
+        };
+        ipAddress: {
+          type: "string";
+          required: false;
+        };
+        userAgent: {
+          type: "string";
+          required: false;
+        };
+        visitorId: {
+          type: "string";
+          required: false;
+        };
+        eventData: {
+          type: "json";
+          required: false;
+        };
+        createdAt: {
+          type: "date";
+          required: true;
+        };
+      };
+    };
+  };
+  $ERROR_CODES: {
+    readonly AUDIT_LOG_ACCESS_DENIED: "You don't have access to these audit logs";
+    readonly AUDIT_LOG_UNAVAILABLE: "Audit logs are temporarily unavailable";
+  };
+  options: {
+    database: boolean;
+    trackFailedSignIns: boolean;
+    adminRoles: string[];
+    remote?: {
+      apiUrl?: string | undefined;
+      apiKey?: string | undefined;
+      timeout?: number | undefined;
+      headers?: Record<string, string> | undefined;
+      batch?: {
+        maxSize?: number | undefined;
+        flushIntervalMs?: number | undefined;
+      } | undefined;
+    } | false | undefined;
+    onEvent?: ((event: AuditEvent) => void | Promise<void>) | undefined;
+    exclude?: AuditEventType[] | undefined;
+    schema?: InferOptionSchema<typeof schema> | undefined;
+  };
+};
+//#endregion
+export { SECURITY_EVENT_TYPES as A, AuditEvent as C, AuditEventType as D, AUDIT_EVENT_TYPES as E, API_KEY_TABLE_NAME as F, ERROR_CODES as I, apiKey as L, VERIFICATION_PATHS as M, LastLoginMethodOptions as N, CREDENTIAL_SIGN_IN_PATHS as O, lastLoginMethod as P, defaultKeyHasher as R, SentinelOptions as S, ALL_EVENT_TYPES as T, haversineDistanceKm as _, createAuthEndpoint$1 as a, GeoLocation as b, sentinel as c, POW_SOLUTION_HEADER as d, createNonce as f, verifySolution as g, solveChallenge as h, AuthMiddleware as i, SIGN_IN_PATHS as j, PATH_EVENTS as k, POW_CHALLENGE_HEADER as l, parsePowHeader as m, auditLog as n, createAuthMiddleware$1 as o, hasLeadingZeroBits as p, AuthEndpoint as r, optionsMiddleware as s, AUDIT_LOG_ERROR_CODES as t, POW_REASON_HEADER as u, normalizeEmail as v, AuditLogOptions as w, SecurityAction as x, SENTINEL_ERROR_CODES as y };