@gatwech/auth 1.0.0-beta.19 → 1.0.0-beta.21

package/dist/adapters/drizzle-adapter/index.mjs

@@ -10,6 +10,15 @@ import { PayvoAuthError } from "@gatwech/core/error";
 import { and, asc, count, desc, eq, gt, gte, inArray, like, lt, lte, ne, notInArray, or, sql } from "drizzle-orm";
 
 //#region src/adapters/drizzle-adapter/drizzle-adapter.ts
+/**
+* The number of rows a statement changed. Each driver reports it differently,
+* so this reads whichever field the driver sets.
+*/
+function affectedRows(result) {
+	const header = Array.isArray(result) && !("count" in result) ? result[0] : result;
+	const count$1 = header?.changes ?? header?.rowsAffected ?? header?.rowCount ?? header?.affectedRows ?? header?.count;
+	return Number(count$1 ?? 0);
+}
 const drizzleAdapter = (db, config) => {
 	let lazyOptions = null;
 	const createCustomAdapter = (db$1) => ({ getFieldName, debugLog }) => {
@@ -167,7 +176,7 @@ const drizzleAdapter = (db, config) => {
 			async updateMany({ model, where, update: values }) {
 				const schemaModel = getSchema(model);
 				const clause = convertWhereClause(where, model);
-				return await db$1.update(schemaModel).set(values).where(...clause);
+				return affectedRows(await db$1.update(schemaModel).set(values).where(...clause));
 			},
 			async delete({ model, where }) {
 				const schemaModel = getSchema(model);
@@ -177,7 +186,7 @@ const drizzleAdapter = (db, config) => {
 			async deleteMany({ model, where }) {
 				const schemaModel = getSchema(model);
 				const clause = convertWhereClause(where, model);
-				return await db$1.delete(schemaModel).where(...clause);
+				return affectedRows(await db$1.delete(schemaModel).where(...clause));
 			},
 			options: config
 		};

package/dist/adapters/index.d.mts

@@ -1,7 +1,7 @@
 import { u as Prettify } from "../helper-BgOIGHsu.mjs";
-import { A as Where$1 } from "../index-BNhJglHC.mjs";
+import { A as Where$1 } from "../index-BjCQ3jmE.mjs";
 import "../types-DNQ9XQrB.mjs";
-import "../index-Df0KhQRf-BEa5tdwJ.mjs";
+import "../index-BL_t8cRp-C4QYBsac.mjs";
 import "../plugins-Dy_FrD4Y.mjs";
 import { PayvoAuthOptions } from "@gatwech/core";
 import { DBFieldAttribute, PayvoAuthDBSchema } from "@gatwech/core/db";

package/dist/adapters/kysely-adapter/index.mjs

@@ -7,6 +7,6 @@ import { n as getKyselyDatabaseType, t as createKyselyAdapter } from "../../dial
 import "../../get-tables-CKvSyDST.mjs";
 import "../../misc-fKH4d5XQ.mjs";
 import "../../adapter-factory-xbLUJt85.mjs";
-import { t as kyselyAdapter } from "../../kysely-adapter-Bkm1liPW.mjs";
+import { t as kyselyAdapter } from "../../kysely-adapter-BidlNTiV.mjs";
 
 export { createKyselyAdapter, getKyselyDatabaseType, kyselyAdapter };

package/dist/adapters/memory-adapter/index.d.mts

@@ -1,4 +1,4 @@
-import { t as DBAdapter$1 } from "../../index-Df0KhQRf-BEa5tdwJ.mjs";
+import { t as DBAdapter$1 } from "../../index-BL_t8cRp-C4QYBsac.mjs";
 import { PayvoAuthOptions } from "@gatwech/core";
 import { DBAdapterDebugLogOption } from "@gatwech/core/db/adapter";
 

package/dist/adapters/memory-adapter/index.mjs

@@ -135,12 +135,12 @@ const memoryAdapter = (db, config) => {
 					});
 					return count;
 				},
-				updateMany({ model, where, update }) {
+				async updateMany({ model, where, update }) {
 					const res = convertWhereClause(where, model);
 					res.forEach((record) => {
 						Object.assign(record, update);
 					});
-					return res[0] || null;
+					return res.length;
 				}
 			};
 		}

package/dist/api/index.d.mts

@@ -1,6 +1,6 @@
 import "../helper-BgOIGHsu.mjs";
-import { $ as AuthEndpoint, At as ok, Bt as listUserAccounts, Ct as revokeSession, Dt as requestPasswordReset, Et as sessionMiddleware, Ft as verifyEmail, Gt as originCheckMiddleware, Ht as unlinkAccount, It as callbackOAuth, Kt as getOAuthState, Lt as accountInfo, Mt as createEmailVerificationToken, Nt as sendVerificationEmail, Ot as requestPasswordResetCallback, Pt as sendVerificationEmailFn, Q as APIError, Rt as getAccessToken, St as revokeOtherSessions, Tt as sensitiveSessionMiddleware, Ut as isSimpleRequest, Vt as refreshToken, Wt as originCheck, _t as freshSessionMiddleware, at as optionsMiddleware, bt as listSessions, ct as changePassword, dt as setPassword, et as AuthMiddleware, ft as updateUser, gt as signInSocial, ht as signInEmail, it as getEndpoints, jt as error, kt as resetPassword, lt as deleteUser, mt as signOut, nt as createAuthEndpoint, ot as router, pt as signUpEmail, rt as createAuthMiddleware, st as changeEmail, tt as checkEndpointConflicts, ut as deleteUserCallback, vt as getSession, wt as revokeSessions, xt as requestOnlySessionMiddleware, yt as getSessionFromCtx, zt as linkSocialAccount } from "../index-BNhJglHC.mjs";
+import { $ as AuthEndpoint, At as ok, Bt as listUserAccounts, Ct as revokeSession, Dt as requestPasswordReset, Et as sessionMiddleware, Ft as verifyEmail, Gt as originCheckMiddleware, Ht as unlinkAccount, It as callbackOAuth, Kt as getOAuthState, Lt as accountInfo, Mt as createEmailVerificationToken, Nt as sendVerificationEmail, Ot as requestPasswordResetCallback, Pt as sendVerificationEmailFn, Q as APIError, Rt as getAccessToken, St as revokeOtherSessions, Tt as sensitiveSessionMiddleware, Ut as isSimpleRequest, Vt as refreshToken, Wt as originCheck, _t as freshSessionMiddleware, at as optionsMiddleware, bt as listSessions, ct as changePassword, dt as setPassword, et as AuthMiddleware, ft as updateUser, gt as signInSocial, ht as signInEmail, it as getEndpoints, jt as error, kt as resetPassword, lt as deleteUser, mt as signOut, nt as createAuthEndpoint, ot as router, pt as signUpEmail, rt as createAuthMiddleware, st as changeEmail, tt as checkEndpointConflicts, ut as deleteUserCallback, vt as getSession, wt as revokeSessions, xt as requestOnlySessionMiddleware, yt as getSessionFromCtx, zt as linkSocialAccount } from "../index-BjCQ3jmE.mjs";
 import "../types-DNQ9XQrB.mjs";
-import "../index-Df0KhQRf-BEa5tdwJ.mjs";
+import "../index-BL_t8cRp-C4QYBsac.mjs";
 import "../plugins-Dy_FrD4Y.mjs";
 export { APIError, AuthEndpoint, AuthMiddleware, accountInfo, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, error, freshSessionMiddleware, getAccessToken, getEndpoints, getOAuthState, getSession, getSessionFromCtx, isSimpleRequest, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateUser, verifyEmail };

package/dist/api/index.mjs

@@ -8,7 +8,7 @@ import "../jwt-CmxZAGe2.mjs";
 import "../random-32E3cU5o.mjs";
 import "../cookies-BuvlgcA-.mjs";
 import "../date-CMr04reD.mjs";
-import "../db-7vHnL1XA.mjs";
+import "../db-CV59HpEF.mjs";
 import "../dialect-HsWUfpYY.mjs";
 import "../get-tables-CKvSyDST.mjs";
 import "../types-DCPpFKUB.mjs";

package/dist/{audit-log-DKsUWR8O.mjs → audit-log-DgqHJ-uv.mjs}

@@ -2,7 +2,7 @@ import { t as getIp } from "./get-request-ip-DSjrEpGo.mjs";
 import { t as generateRandomString } from "./random-32E3cU5o.mjs";
 import { n as mergeSchema } from "./date-CMr04reD.mjs";
 import { r as getSessionFromCtx, u as sessionMiddleware } from "./session-BB3oqApE.mjs";
-import { a as CREDENTIAL_SIGN_IN_PATHS, c as SIGN_IN_PATHS, i as AUDIT_EVENT_TYPES, l as VERIFICATION_PATHS, n as registerAuditRecorder, o as PATH_EVENTS, r as ALL_EVENT_TYPES } from "./registry-CqG_3Qnx.mjs";
+import { a as CREDENTIAL_SIGN_IN_PATHS, c as SIGN_IN_PATHS, i as AUDIT_EVENT_TYPES, l as VERIFICATION_PATHS, n as registerAuditRecorder, o as PATH_EVENTS, r as ALL_EVENT_TYPES, s as SECURITY_EVENT_TYPES } from "./registry-CqG_3Qnx.mjs";
 import { env } from "@gatwech/core/env";
 import { defineErrorCodes } from "@gatwech/core/utils";
 import { APIError } from "better-call";
@@ -11,9 +11,14 @@ import * as z$1 from "zod";
 import { betterFetch } from "@better-fetch/fetch";
 
 //#region src/plugins/audit-log/remote.ts
+/** Sends to the backend: the first attempt and up to 2 retries */
+const SEND_ATTEMPTS = 3;
+/** Delay before the first retry, doubled for the next */
+const RETRY_DELAY_MS = 250;
 /**
-* Batches events and sends them to the hosted backend. Sending is never
-* awaited by the auth flow, and failures are logged and dropped.
+* Sends each event to the hosted backend as it's recorded, in the
+* background, so the auth flow never waits for it. Failures are retried, then
+* logged and dropped.
 */
 function createRemoteSink(options) {
 	if (options === false) return {
@@ -28,47 +33,33 @@ function createRemoteSink(options) {
 	};
 	const baseURL = apiUrl.replace(/\/+$/, "");
 	const timeout = options?.timeout ?? 3e3;
-	const maxSize = options?.batch?.maxSize ?? 25;
-	const flushIntervalMs = options?.batch?.flushIntervalMs ?? 2e3;
 	const headers = {
 		...options?.headers,
 		authorization: `Bearer ${apiKey}`
 	};
-	let buffer = [];
-	let timer = null;
-	async function send(events, logger$1) {
-		const { error } = await betterFetch(`${baseURL}/v1/events`, {
-			method: "POST",
-			headers,
-			body: { events },
-			timeout
-		}).catch((e) => ({ error: e }));
-		if (error) logger$1?.error("[audit-log] Failed to send audit events", error);
-	}
-	async function flush(logger$1) {
-		if (timer) {
-			clearTimeout(timer);
-			timer = null;
+	/** Sends one event, retrying failures the backend may recover from */
+	async function send(event, logger$1) {
+		for (let attempt = 1;; attempt++) {
+			const { error } = await betterFetch(`${baseURL}/v1/events`, {
+				method: "POST",
+				headers,
+				body: { events: [event] },
+				timeout
+			}).catch((e) => ({ error: e }));
+			if (!error) return;
+			const status = error.status;
+			if (!(status === void 0 || status >= 500 || status === 408 || status === 429) || attempt === SEND_ATTEMPTS) {
+				logger$1.error("[audit-log] Failed to send audit event", error);
+				return;
+			}
+			await new Promise((resolve) => setTimeout(resolve, RETRY_DELAY_MS * 2 ** (attempt - 1)));
 		}
-		if (!buffer.length) return;
-		const events = buffer;
-		buffer = [];
-		await send(events, logger$1);
 	}
 	return {
 		sink: {
-			push(event, logger$1) {
-				buffer.push(event);
-				if (buffer.length >= maxSize) {
-					flush(logger$1);
-					return;
-				}
-				if (!timer) {
-					timer = setTimeout(() => void flush(logger$1), flushIntervalMs);
-					timer.unref?.();
-				}
+			push(event, auth) {
+				auth.runInBackground(send(event, auth.logger));
 			},
-			flush,
 			async query({ userIds, organizationIds,...query }) {
 				const params = new URLSearchParams();
 				for (const [key, value] of Object.entries(query)) if (value !== void 0) params.set(key, String(value));
@@ -177,20 +168,32 @@ function toPagination(query) {
 		offset: Math.max(Math.trunc(Number(query.offset) || 0), 0)
 	};
 }
+/**
+* Failed attempts and security decisions a user can see about their own
+* account before they are signed in
+*/
+const ACCOUNT_ATTEMPT_EVENT_TYPES = [
+	AUDIT_EVENT_TYPES.USER_SIGN_IN_FAILED,
+	AUDIT_EVENT_TYPES.VERIFICATION_FAILED,
+	SECURITY_EVENT_TYPES.BLOCKED,
+	SECURITY_EVENT_TYPES.CREDENTIAL_STUFFING,
+	SECURITY_EVENT_TYPES.VELOCITY_EXCEEDED
+];
+/** The most attempts on an account shown with a user's own events */
+const ACCOUNT_ATTEMPT_LIMIT = 50;
 const auditLog = (options) => {
 	const opts = {
 		...options,
 		database: options?.database ?? true,
 		trackFailedSignIns: options?.trackFailedSignIns ?? true,
-		adminRoles: options?.adminRoles ?? ["admin"]
+		adminRoles: options?.adminRoles ?? ["admin"],
+		organizationAdminRoles: options?.organizationAdminRoles ?? ["owner", "admin"],
+		showAttemptsOnOwnAccount: options?.showAttemptsOnOwnAccount ?? true
 	};
 	const excluded = new Set(opts.exclude ?? []);
 	const { sink: remote, misconfigured } = createRemoteSink(opts.remote);
 	const mergedSchema = mergeSchema(schema, opts.schema);
 	let authContext;
-	/** Pending update payloads, so `update.after` knows which fields changed */
-	const pendingUserUpdates = /* @__PURE__ */ new WeakMap();
-	const noContextKey = {};
 	/** Users created in a request, so their first account isn't a link */
 	const createdUsers = /* @__PURE__ */ new WeakMap();
 	/**
@@ -292,7 +295,7 @@ const auditLog = (options) => {
 				...data,
 				id: id || generateRandomString(32)
 			};
-			remote?.push(full, auth.logger);
+			remote?.push(full, auth);
 			const onEvent = opts.onEvent;
 			if (onEvent) await Promise.resolve().then(() => onEvent(full)).catch((e) => auth.logger.error("[audit-log] onEvent handler failed", e));
 		} catch (e) {
@@ -372,6 +375,70 @@ const auditLog = (options) => {
 			offset
 		};
 	}
+	/**
+	* Attempts made on a user's account before signing in, matched by the email
+	* that was typed. Anyone can type any email, so these are stripped of what
+	* identifies the person who made them. Only events since the user's account
+	* was created count, so an address's earlier history isn't shown.
+	*/
+	async function queryAccountAttempts(auth, user, filters) {
+		if (filters.eventType && !ACCOUNT_ATTEMPT_EVENT_TYPES.includes(filters.eventType)) return [];
+		const since = new Date(Math.max(new Date(user.createdAt).getTime(), filters.startDate ? new Date(filters.startDate).getTime() : 0));
+		const identifiers = [...new Set([
+			user.email,
+			user.email.toLowerCase(),
+			typeof user.normalizedEmail === "string" ? user.normalizedEmail : null
+		].filter((value) => Boolean(value)))];
+		let events;
+		if (remote) events = (await remote.query({
+			limit: 100,
+			offset: 0,
+			identifier: user.email.toLowerCase(),
+			startDate: since.toISOString(),
+			endDate: filters.endDate
+		})).events.filter((event) => !event.userId && (filters.eventType ? event.eventType === filters.eventType : ACCOUNT_ATTEMPT_EVENT_TYPES.includes(event.eventType)));
+		else {
+			const where = [
+				{
+					field: "identifier",
+					operator: "in",
+					value: identifiers
+				},
+				{
+					field: "eventType",
+					operator: "in",
+					value: filters.eventType ? [filters.eventType] : ACCOUNT_ATTEMPT_EVENT_TYPES
+				},
+				{
+					field: "createdAt",
+					operator: "gte",
+					value: since
+				}
+			];
+			if (filters.endDate) where.push({
+				field: "createdAt",
+				operator: "lte",
+				value: new Date(filters.endDate)
+			});
+			events = await auth.adapter.findMany({
+				model: "auditLog",
+				where,
+				limit: ACCOUNT_ATTEMPT_LIMIT * 4,
+				sortBy: {
+					field: "createdAt",
+					direction: "desc"
+				}
+			});
+			events = events.filter((event) => !event.userId);
+		}
+		return events.slice(0, ACCOUNT_ATTEMPT_LIMIT).map((event) => ({
+			...event,
+			ipAddress: null,
+			userAgent: null,
+			visitorId: null,
+			eventData: null
+		}));
+	}
 	/** Organization memberships of a user, empty without the organization plugin */
 	async function findMemberships(auth, userId) {
 		try {
@@ -418,25 +485,14 @@ const auditLog = (options) => {
 							identifier: user.email
 						});
 					} },
-					update: {
-						async before(data, context) {
-							const key = context ?? noContextKey;
-							const queue = pendingUserUpdates.get(key) ?? [];
-							queue.push(data);
-							pendingUserUpdates.set(key, queue);
-							return { data };
-						},
-						async after(user, context) {
-							const key = context ?? noContextKey;
-							const data = pendingUserUpdates.get(key)?.shift();
-							if (!user || !data) return;
-							for (const event of userEventsFromUpdate(data)) await record(context ?? void 0, {
-								...event,
-								userId: user.id,
-								identifier: user.email
-							});
-						}
-					},
+					update: { async after(user, context, data) {
+						if (!user || !data) return;
+						for (const event of userEventsFromUpdate(data)) await record(context ?? void 0, {
+							...event,
+							userId: user.id,
+							identifier: user.email
+						});
+					} },
 					delete: { async after(user, context) {
 						await record(context ?? void 0, {
 							eventType: AUDIT_EVENT_TYPES.USER_DELETED,
@@ -575,7 +631,7 @@ const auditLog = (options) => {
 				metadata: { openapi: {
 					operationId: "getAuditLogs",
 					summary: "Get audit logs",
-					description: "Get the current user's audit events, optionally restricted to an organization",
+					description: "Get the current user's audit events, optionally restricted to an organization, with failed attempts on their account",
 					responses: { 200: {
 						description: "Paginated audit events",
 						content: { "application/json": { schema: {
@@ -646,11 +702,24 @@ const auditLog = (options) => {
 				const { limit: _limit, offset: _offset,...filters } = ctx.query ?? {};
 				const pagination = toPagination(ctx.query ?? {});
 				if (filters.userId && filters.userId !== user.id) throw new APIError("FORBIDDEN", { message: AUDIT_LOG_ERROR_CODES.AUDIT_LOG_ACCESS_DENIED });
-				return ctx.json(await runQuery(ctx.context, {
+				const own = await runQuery(ctx.context, {
 					...filters,
 					...pagination,
+					limit: pagination.offset + pagination.limit,
+					offset: 0,
 					userId: user.id
-				}));
+				});
+				const attempts = opts.showAttemptsOnOwnAccount && !filters.organizationId ? await queryAccountAttempts(ctx.context, user, filters).catch((e) => {
+					ctx.context.logger.error("[audit-log] Failed to query account attempts", e);
+					return [];
+				}) : [];
+				const events = [...own.events, ...attempts].sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()).slice(pagination.offset, pagination.offset + pagination.limit);
+				return ctx.json({
+					events,
+					total: own.total + attempts.length,
+					limit: pagination.limit,
+					offset: pagination.offset
+				});
 			}),
 			getAllAuditLogs: createAuthEndpoint("/audit-log/get-all-audit-logs", {
 				method: "GET",
@@ -733,7 +802,7 @@ const auditLog = (options) => {
 					...filters,
 					...pagination
 				}));
-				const administered = (await findMemberships(ctx.context, user.id)).filter((m) => hasRole(m.role, ["owner", "admin"])).map((m) => m.organizationId);
+				const administered = (await findMemberships(ctx.context, user.id)).filter((m) => hasRole(m.role, opts.organizationAdminRoles)).map((m) => m.organizationId);
 				if (!administered.length || filters.organizationId && !administered.includes(filters.organizationId)) throw new APIError("FORBIDDEN", { message: AUDIT_LOG_ERROR_CODES.AUDIT_LOG_ACCESS_DENIED });
 				return ctx.json(await runQuery(ctx.context, {
 					...filters,

package/dist/{auth-vfCyIIeV.mjs → auth-BoEA9bN7.mjs}

@@ -3,7 +3,7 @@ import { r as getOrigin, t as getBaseURL } from "./url-VB2gAbTI.mjs";
 import { a as getEndpoints, n as checkEndpointConflicts, s as router } from "./api-Dk8Yj_J5.mjs";
 import { i as verifyPassword, r as hashPassword } from "./crypto-CCyta8xj.mjs";
 import { i as getCookies, t as createCookieGetter } from "./cookies-BuvlgcA-.mjs";
-import { a as createInternalAdapter, r as getAdapter, s as getMigrations } from "./db-7vHnL1XA.mjs";
+import { a as createInternalAdapter, r as getAdapter, s as getMigrations } from "./db-CV59HpEF.mjs";
 import { n as getKyselyDatabaseType } from "./dialect-HsWUfpYY.mjs";
 import { t as getAuthTables } from "./get-tables-CKvSyDST.mjs";
 import { t as checkPassword } from "./password-5CdcAVaH.mjs";
@@ -137,6 +137,19 @@ const init = async (options) => {
 			await runMigrations();
 		},
 		publishTelemetry: publish,
+		runInBackground(promise) {
+			const task = promise.catch((error) => {
+				logger$1.error("Background task failed", error);
+			});
+			options.advanced?.backgroundTasks?.handler(task);
+		},
+		async runInBackgroundOrAwait(promise) {
+			const handler = options.advanced?.backgroundTasks?.handler;
+			if (!handler || !promise) return promise;
+			handler(promise.catch((error) => {
+				logger$1.error("Background task failed", error);
+			}));
+		},
 		skipCSRFCheck: !!options.advanced?.disableCSRFCheck,
 		skipOriginCheck: options.advanced?.disableOriginCheck !== void 0 ? options.advanced.disableOriginCheck : isTest() ? true : false
 	});

package/dist/client/index.d.mts

@@ -1,13 +1,13 @@
 import { d as PrettifyDeep, h as UnionToIntersection } from "../helper-BgOIGHsu.mjs";
-import { B as InferPluginsFromClient, F as ClientStore, G as PayvoAuthClientPlugin, H as InferUserFromClient, I as InferActions, K as SessionQueryParams, L as InferAdditionalFromClient, M as AtomListener, N as ClientAtomListener, P as ClientOptions, R as InferClientAPI, U as IsSignal, V as InferSessionFromClient, W as PayvoAuthClientOptions, q as Store, z as InferErrorCodes } from "../index-BNhJglHC.mjs";
+import { B as InferPluginsFromClient, F as ClientStore, G as PayvoAuthClientPlugin, H as InferUserFromClient, I as InferActions, K as SessionQueryParams, L as InferAdditionalFromClient, M as AtomListener, N as ClientAtomListener, P as ClientOptions, R as InferClientAPI, U as IsSignal, V as InferSessionFromClient, W as PayvoAuthClientOptions, q as Store, z as InferErrorCodes } from "../index-BjCQ3jmE.mjs";
 import "../types-DNQ9XQrB.mjs";
-import "../index-Df0KhQRf-BEa5tdwJ.mjs";
+import "../index-BL_t8cRp-C4QYBsac.mjs";
 import "../plugins-Dy_FrD4Y.mjs";
 import { PayvoAuthClientOptions as PayvoAuthClientOptions$1, PayvoAuthClientPlugin as PayvoAuthClientPlugin$1, PayvoAuthOptions, PayvoAuthPlugin } from "@gatwech/core";
 import { BASE_ERROR_CODES } from "@gatwech/core/error";
-import * as _better_fetch_fetch36 from "@better-fetch/fetch";
+import * as _better_fetch_fetch20 from "@better-fetch/fetch";
 import { BetterFetch, BetterFetchError, BetterFetchOption } from "@better-fetch/fetch";
-import * as nanostores2 from "nanostores";
+import * as nanostores0 from "nanostores";
 import { Atom, PreinitializedWritableAtom, WritableAtom } from "nanostores";
 export * from "@better-fetch/fetch";
 export * from "nanostores";
@@ -79,27 +79,27 @@ declare function createAuthClient<Option extends PayvoAuthClientOptions$1>(optio
     error: BetterFetchError | null;
     isPending: boolean;
   }>;
-  $fetch: _better_fetch_fetch36.BetterFetch<{
-    plugins: (_better_fetch_fetch36.BetterFetchPlugin | {
+  $fetch: _better_fetch_fetch20.BetterFetch<{
+    plugins: (_better_fetch_fetch20.BetterFetchPlugin | {
       id: string;
       name: string;
       hooks: {
-        onSuccess(context: _better_fetch_fetch36.SuccessContext<any>): void;
+        onSuccess(context: _better_fetch_fetch20.SuccessContext<any>): void;
       };
     } | {
       id: string;
       name: string;
       hooks: {
-        onRequest<T extends Record<string, any>>(context: _better_fetch_fetch36.RequestContext<T>): void;
+        onRequest<T extends Record<string, any>>(context: _better_fetch_fetch20.RequestContext<T>): void;
       };
     } | {
       id: string;
       name: string;
       hooks: {
-        onSuccess: ((context: _better_fetch_fetch36.SuccessContext<any>) => Promise<void> | void) | undefined;
-        onError: ((context: _better_fetch_fetch36.ErrorContext) => Promise<void> | void) | undefined;
-        onRequest: (<T extends Record<string, any>>(context: _better_fetch_fetch36.RequestContext<T>) => Promise<_better_fetch_fetch36.RequestContext | void> | _better_fetch_fetch36.RequestContext | void) | undefined;
-        onResponse: ((context: _better_fetch_fetch36.ResponseContext) => Promise<Response | void | _better_fetch_fetch36.ResponseContext> | Response | _better_fetch_fetch36.ResponseContext | void) | undefined;
+        onSuccess: ((context: _better_fetch_fetch20.SuccessContext<any>) => Promise<void> | void) | undefined;
+        onError: ((context: _better_fetch_fetch20.ErrorContext) => Promise<void> | void) | undefined;
+        onRequest: (<T extends Record<string, any>>(context: _better_fetch_fetch20.RequestContext<T>) => Promise<_better_fetch_fetch20.RequestContext | void> | _better_fetch_fetch20.RequestContext | void) | undefined;
+        onResponse: ((context: _better_fetch_fetch20.ResponseContext) => Promise<Response | void | _better_fetch_fetch20.ResponseContext> | Response | _better_fetch_fetch20.ResponseContext | void) | undefined;
       };
     })[];
     method: string;
@@ -119,12 +119,12 @@ declare function createAuthClient<Option extends PayvoAuthClientOptions$1>(optio
     referrerPolicy?: ReferrerPolicy | undefined;
     signal?: (AbortSignal | null) | undefined;
     window?: null | undefined;
-    onRetry?: ((response: _better_fetch_fetch36.ResponseContext) => Promise<void> | void) | undefined;
+    onRetry?: ((response: _better_fetch_fetch20.ResponseContext) => Promise<void> | void) | undefined;
     hookOptions?: {
       cloneResponse?: boolean;
     } | undefined;
     timeout?: number | undefined;
-    customFetchImpl: _better_fetch_fetch36.FetchEsque;
+    customFetchImpl: _better_fetch_fetch20.FetchEsque;
     baseURL: string;
     throw?: boolean | undefined;
     auth?: ({
@@ -144,16 +144,16 @@ declare function createAuthClient<Option extends PayvoAuthClientOptions$1>(optio
     params?: any;
     duplex?: "full" | "half" | undefined;
     jsonParser: (text: string) => Promise<any> | any;
-    retry?: _better_fetch_fetch36.RetryOptions | undefined;
+    retry?: _better_fetch_fetch20.RetryOptions | undefined;
     retryAttempt?: number | undefined;
-    output?: (_better_fetch_fetch36.StandardSchemaV1 | typeof Blob | typeof File) | undefined;
-    errorSchema?: _better_fetch_fetch36.StandardSchemaV1 | undefined;
+    output?: (_better_fetch_fetch20.StandardSchemaV1 | typeof Blob | typeof File) | undefined;
+    errorSchema?: _better_fetch_fetch20.StandardSchemaV1 | undefined;
     disableValidation?: boolean | undefined;
   }, unknown, unknown, {}>;
   $store: {
     notify: (signal?: (Omit<string, "$sessionSignal"> | "$sessionSignal") | undefined) => void;
     listen: (signal: Omit<string, "$sessionSignal"> | "$sessionSignal", listener: (value: boolean, oldValue?: boolean | undefined) => void) => void;
-    atoms: Record<string, nanostores2.WritableAtom<any>>;
+    atoms: Record<string, nanostores0.WritableAtom<any>>;
   };
   $Infer: {
     Session: NonNullable<InferClientAPI<Option> extends {

package/dist/client/plugins/index.d.mts

@@ -1,34 +1,34 @@
 import { a as LiteralNumber, c as OmitId, d as PrettifyDeep, f as Primitive, g as WithoutEmpty, h as UnionToIntersection, i as HasRequiredKeys, l as PreserveJSDoc, m as StripEmptyObjects, n as DeepPartial, o as LiteralString, p as RequiredKeysOf, r as Expand, s as LiteralUnion, t as Awaitable, u as Prettify } from "../../helper-BgOIGHsu.mjs";
-import { K as SessionQueryParams, Y as Auth, g as User$1, h as Session$1, i as PayvoAuthPlugin$1, mn as InferAdditionalFieldsFromPluginOptions, r as PayvoAuthOptions$1 } from "../../index-BNhJglHC.mjs";
+import { K as SessionQueryParams, Y as Auth, g as User$1, h as Session$1, i as PayvoAuthPlugin$1, mn as InferAdditionalFieldsFromPluginOptions, r as PayvoAuthOptions$1 } from "../../index-BjCQ3jmE.mjs";
 import "../../types-DNQ9XQrB.mjs";
-import "../../index-Df0KhQRf-BEa5tdwJ.mjs";
+import "../../index-BL_t8cRp-C4QYBsac.mjs";
 import "../../plugins-Dy_FrD4Y.mjs";
 import { a as Role, i as AccessControl, o as Statements } from "../../index-CxlWnL9c.mjs";
-import { t as admin } from "../../index-EABwA_BH.mjs";
-import { r as anonymous } from "../../index-zBdYQGaS.mjs";
-import { L as apiKey } from "../../index-DRM35ir1.mjs";
-import "../../index-DS-R7st3.mjs";
-import "../../index-CgeC2eGC.mjs";
-import "../../index-DG-X1PK5.mjs";
-import { i as deviceAuthorizationClient } from "../../index-BAVzFqII.mjs";
-import { n as emailOTP } from "../../index-CUknVRZp.mjs";
-import { n as genericOAuth } from "../../index-CP3FNbOZ.mjs";
-import "../../index-Df4SvZaE.mjs";
-import { t as jwt } from "../../index-COGe8UJx.mjs";
-import { t as magicLink } from "../../index-Blmhq6eA.mjs";
-import { t as multiSession } from "../../index-Db8jqUq2.mjs";
-import "../../index-DyH_CgmX.mjs";
-import "../../index-BNDRYfTF.mjs";
-import { t as oneTimeToken } from "../../index-DXVU0HGr.mjs";
+import { t as admin } from "../../index-IX1to9TB.mjs";
+import { r as anonymous } from "../../index-CMG4Pnen.mjs";
+import { L as apiKey } from "../../index-BKy-8t2n.mjs";
+import "../../index-CbBQdS-u.mjs";
+import "../../index-C-IDh5yy.mjs";
+import "../../index-cPt-00xm.mjs";
+import { i as deviceAuthorizationClient } from "../../index-jEkJ2Zfk.mjs";
+import { n as emailOTP } from "../../index-D1OZ2e4m.mjs";
+import { n as genericOAuth } from "../../index-WV7VzW2H.mjs";
+import "../../index-Bhc37y9F.mjs";
+import { t as jwt } from "../../index-CM1rFdwV.mjs";
+import { t as magicLink } from "../../index-CTqynuxm.mjs";
+import { t as multiSession } from "../../index-CpH-1sse.mjs";
+import "../../index-oNlp4SvD.mjs";
+import "../../index-iRoaTsOj.mjs";
+import { t as oneTimeToken } from "../../index-BWYXZVsV.mjs";
 import "../../index-QmocqGM-.mjs";
-import { F as OrganizationOptions, S as Team, b as OrganizationRole, c as InferMember, f as InferTeam, g as Member, l as InferOrganization, p as Invitation, r as OrganizationPlugin, s as InferInvitation, v as Organization, w as TeamMember } from "../../index-CKnPAS5n.mjs";
-import { r as phoneNumber } from "../../index-CaqpCfE5.mjs";
-import { n as twoFactorClient } from "../../index-xoYsoOiR.mjs";
-import { n as Passkey, t as passkey } from "../../index-mxEUX2Gs.mjs";
-import { n as username } from "../../index-Cv9iMevV.mjs";
-import { t as auditLogClient } from "../../client-CSOs1YN7.mjs";
-import { t as sentinelClient } from "../../client-DZHNfxuR.mjs";
-import * as _gatwech_core58 from "@gatwech/core";
+import { F as OrganizationOptions, S as Team, b as OrganizationRole, c as InferMember, f as InferTeam, g as Member, l as InferOrganization, p as Invitation, r as OrganizationPlugin, s as InferInvitation, v as Organization, w as TeamMember } from "../../index-TrOnY3pM.mjs";
+import { r as phoneNumber } from "../../index-Dt2I0G4X.mjs";
+import { n as twoFactorClient } from "../../index-YeXSxzhX.mjs";
+import { n as Passkey, t as passkey } from "../../index-BECNG13R.mjs";
+import { n as username } from "../../index-Bxive_YT.mjs";
+import { t as auditLogClient } from "../../client-B00gkznv.mjs";
+import { t as sentinelClient } from "../../client-Da7tq8m6.mjs";
+import * as _gatwech_core53 from "@gatwech/core";
 import { ClientStore, PayvoAuthOptions } from "@gatwech/core";
 import { DBFieldAttribute } from "@gatwech/core/db";
 import * as _better_fetch_fetch53 from "@better-fetch/fetch";
@@ -369,7 +369,7 @@ interface GoogleOneTapActionOptions extends Omit<GoogleOneTapOptions, "clientId"
 }
 declare const oneTapClient: (options: GoogleOneTapOptions) => {
   id: "one-tap";
-  getActions: ($fetch: _better_fetch_fetch53.BetterFetch, _: _gatwech_core58.ClientStore) => {
+  getActions: ($fetch: _better_fetch_fetch53.BetterFetch, _: _gatwech_core53.ClientStore) => {
     oneTap: (opts?: GoogleOneTapActionOptions | undefined, fetchOptions?: BetterFetchOption | undefined) => Promise<void>;
   };
   getAtoms($fetch: _better_fetch_fetch53.BetterFetch): {};
@@ -471,7 +471,7 @@ declare const organizationClient: <CO extends OrganizationClientOptions>(options
       } ? true : false;
     };
   }>;
-  getActions: ($fetch: _better_fetch_fetch53.BetterFetch, _$store: _gatwech_core58.ClientStore, co: _gatwech_core58.PayvoAuthClientOptions | undefined) => {
+  getActions: ($fetch: _better_fetch_fetch53.BetterFetch, _$store: _gatwech_core53.ClientStore, co: _gatwech_core53.PayvoAuthClientOptions | undefined) => {
     $Infer: {
       ActiveOrganization: CO["teams"] extends {
         enabled: true;

package/dist/client/plugins/index.mjs

@@ -10,10 +10,10 @@ import { t as hasPermission } from "../../has-permission-Bvg8de8g.mjs";
 import { t as deviceAuthorizationClient } from "../../client-cBiytuOL.mjs";
 import { a as memberAc, o as ownerAc, r as defaultRoles, t as adminAc } from "../../access-CrwEFPHE.mjs";
 import { n as hasPermissionFn } from "../../permission-CDDWgA_O.mjs";
-import "../../pow-OK01yPG3.mjs";
+import "../../pow-DvkUopsK.mjs";
 import { t as twoFactorClient } from "../../client-BuveH3MN.mjs";
 import { t as auditLogClient } from "../../client-DzOqXJUm.mjs";
-import { t as sentinelClient } from "../../client-4QEb0rUr.mjs";
+import { t as sentinelClient } from "../../client-CMsC6-rl.mjs";
 import { atom } from "nanostores";
 import { WebAuthnError, startAuthentication, startRegistration } from "@simplewebauthn/browser";