@gatwech/auth 1.0.0-beta.19 → 1.0.0-beta.21

package/dist/{index-DRM35ir1.d.mts → index-BKy-8t2n.d.mts}

@@ -1,10 +1,10 @@
-import { g as User$1 } from "./index-BNhJglHC.mjs";
-import { n as DBPrimitive } from "./index-Df0KhQRf-BEa5tdwJ.mjs";
+import { g as User$1 } from "./index-BjCQ3jmE.mjs";
+import { n as DBPrimitive } from "./index-BL_t8cRp-C4QYBsac.mjs";
 import { t as InferOptionSchema } from "./plugins-Dy_FrD4Y.mjs";
 import { o as Statements } from "./index-CxlWnL9c.mjs";
-import * as _gatwech_core61 from "@gatwech/core";
+import * as _gatwech_core63 from "@gatwech/core";
 import { AuthContext, GenericEndpointContext, HookEndpointContext } from "@gatwech/core";
-import * as better_call636 from "better-call";
+import * as better_call643 from "better-call";
 import { AuthEndpoint, AuthMiddleware, createAuthEndpoint as createAuthEndpoint$1, createAuthMiddleware as createAuthMiddleware$1, optionsMiddleware } from "@gatwech/core/api";
 import * as zod1419 from "zod";
 import * as _gatwech_core_db14 from "@gatwech/core/db";
@@ -547,8 +547,8 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
   };
   hooks: {
     before: {
-      matcher: (ctx: _gatwech_core61.HookEndpointContext) => boolean;
-      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+      matcher: (ctx: _gatwech_core63.HookEndpointContext) => boolean;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
         user: {
           id: string;
           createdAt: Date;
@@ -569,7 +569,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
           expiresAt: Date;
         };
       } | {
-        context: better_call636.MiddlewareContext<better_call636.MiddlewareOptions, _gatwech_core61.AuthContext<_gatwech_core61.PayvoAuthOptions> & {
+        context: better_call643.MiddlewareContext<better_call643.MiddlewareOptions, _gatwech_core63.AuthContext<_gatwech_core63.PayvoAuthOptions> & {
           returned?: unknown | undefined;
           responseHeaders?: Headers | undefined;
         }>;
@@ -621,7 +621,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call636.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -855,7 +855,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call636.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -933,7 +933,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call636.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -993,7 +993,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
         query: zod1419.ZodObject<{
           id: zod1419.ZodString;
         }, zod_v4_core207.$strip>;
-        use: ((inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -1186,7 +1186,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call636.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1416,7 +1416,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call636.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1434,7 +1434,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
         body: zod1419.ZodObject<{
           keyId: zod1419.ZodString;
         }, zod_v4_core207.$strip>;
-        use: ((inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -1533,7 +1533,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call636.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1590,7 +1590,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       }[]>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -1769,7 +1769,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call636.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1959,7 +1959,7 @@ interface LastLoginMethodOptions {
  */
 declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O | undefined) => {
   id: "last-login-method";
-  init(ctx: _gatwech_core61.AuthContext<_gatwech_core61.PayvoAuthOptions>): {
+  init(ctx: _gatwech_core63.AuthContext<_gatwech_core63.PayvoAuthOptions>): {
     options: {
       databaseHooks: {
         user: {
@@ -1972,7 +1972,7 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<{
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<{
               data: {
                 lastLoginMethod: any;
                 id: string;
@@ -1997,7 +1997,7 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
               token: string;
               ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
       };
@@ -2006,7 +2006,7 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
   hooks: {
     after: {
       matcher(): true;
-      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<void>;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<void>;
     }[];
   };
   schema: O["storeInDatabase"] extends true ? {
@@ -2230,6 +2230,10 @@ interface AuditLogOptions {
     headers?: Record<string, string> | undefined;
     /**
      * Configure how events are batched before they are sent
+     *
+     * @deprecated Ignored: each event is sent as it's recorded, in the
+     * background. Use `advanced.backgroundTasks` to keep serverless
+     * functions alive until it's sent.
      */
     batch?: {
       /**
@@ -2276,6 +2280,24 @@ interface AuditLogOptions {
    * @default ["admin"]
    */
   adminRoles?: string[] | undefined;
+  /**
+   * Organization member roles allowed to read the events of their
+   * organization through `/audit-log/get-all-audit-logs`
+   *
+   * @default ["owner", "admin"]
+   */
+  organizationAdminRoles?: string[] | undefined;
+  /**
+   * Include failed sign-ins and security decisions made on a user's account
+   * before they were signed in in their own events. They are matched by the
+   * email that was typed, in lower case or as the user's email is stored, so
+   * anyone's attempt shows up; the IP address, user agent, visitor id and
+   * details are left out. Only the latest 50 events since the account was
+   * created are included.
+   *
+   * @default true
+   */
+  showAttemptsOnOwnAccount?: boolean | undefined;
   /**
    * Custom schema for the audit log plugin
    */
@@ -2361,6 +2383,10 @@ declare const schema$1: {
         type: "string";
         required: true;
       };
+      path: {
+        type: "string";
+        required: false;
+      };
       ipAddress: {
         type: "string";
         required: false;
@@ -2634,9 +2660,37 @@ interface SentinelOptions {
        * @default "block"
        */
       action?: SecurityAction | undefined;
+      /**
+       * Maximum accounts per IP address within `ipWindowSeconds`. This
+       * limit catches sign-ups that send no visitor id, or a different
+       * one each time, so it is higher than the per-visitor limit to
+       * allow for networks that share an address. Acts with `action`.
+       *
+       * @default 10
+       */
+      maxAccountsPerIp?: number | undefined;
+      /**
+       * How long sign-ups are remembered per IP address, in seconds.
+       * Clamped to between 1 and 365 days.
+       *
+       * @default 86400 (1 day)
+       */
+      ipWindowSeconds?: number | undefined;
+      /**
+       * Challenge sign-ups whose visitor id is missing or wasn't
+       * verified by the identification service. Without the service
+       * (`kvUrl` and an API key), every visitor id is unverified.
+       *
+       * Visitor limits are only reliable with the identification
+       * service, since a client can send any id otherwise.
+       *
+       * @default false
+       */
+      requireVerifiedVisitor?: boolean | undefined;
     } | undefined;
     /**
-     * Detect automated clients. `true` challenges them.
+     * Detect automated clients on sign-in, sign-up, password reset and
+     * verification requests. `true` challenges them.
      */
     botBlocking?: (boolean | {
       action: SecurityAction;
@@ -2842,7 +2896,7 @@ declare function parsePowHeader(value: string | null | undefined): {
 //#region src/plugins/sentinel/index.d.ts
 declare const sentinel: (options?: SentinelOptions | undefined) => {
   id: "sentinel";
-  init(ctx: AuthContext<_gatwech_core61.PayvoAuthOptions>): {
+  init(ctx: AuthContext<_gatwech_core63.PayvoAuthOptions>): {
     options: {
       databaseHooks: {
         user: {
@@ -2855,7 +2909,7 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<{
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<{
               data: {
                 normalizedEmail: string;
                 id: string;
@@ -2875,7 +2929,7 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
           };
           update: {
             before(data: Partial<{
@@ -2903,28 +2957,28 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
       };
     };
   } | undefined;
-  onRequest(request: Request, ctx: AuthContext<_gatwech_core61.PayvoAuthOptions>): Promise<{
+  onRequest(request: Request, ctx: AuthContext<_gatwech_core63.PayvoAuthOptions>): Promise<{
     response: Response;
   } | undefined>;
   hooks: {
     before: ({
-      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
-      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
         context: {
           body: any;
         };
       } | undefined>;
     } | {
-      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
-      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<void>;
     })[];
     after: ({
-      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
-      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<void>;
     } | {
-      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
-      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<({
-        status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | better_call636.Status;
+      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<({
+        status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | better_call643.Status;
         body: ({
           message?: string;
           code?: string;
@@ -3019,6 +3073,10 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
           type: "string";
           required: true;
         };
+        path: {
+          type: "string";
+          required: false;
+        };
         ipAddress: {
           type: "string";
           required: false;
@@ -3083,7 +3141,8 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
       credentialStuffing?: {
         enabled: boolean;
         action?: SecurityAction | undefined;
-        thresholds?: {
+        thresholds
+        /** Checked with the identification service, rather than taken as sent */? /** Checked with the identification service, rather than taken as sent */: {
           challenge: number;
           block: number;
         } | undefined;
@@ -3111,6 +3170,9 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
         maxAccountsPerVisitor?: number | undefined;
         retentionSeconds?: number | undefined;
         action?: SecurityAction | undefined;
+        maxAccountsPerIp?: number | undefined;
+        ipWindowSeconds?: number | undefined;
+        requireVerifiedVisitor?: boolean | undefined;
       } | undefined;
       botBlocking?: (boolean | {
         action: SecurityAction;
@@ -3164,7 +3226,7 @@ declare const AUDIT_LOG_ERROR_CODES: {
 };
 declare const auditLog: (options?: AuditLogOptions | undefined) => {
   id: "audit-log";
-  init(ctx: AuthContext<_gatwech_core61.PayvoAuthOptions>): {
+  init(ctx: AuthContext<_gatwech_core63.PayvoAuthOptions>): {
     options: {
       databaseHooks: {
         user: {
@@ -3177,10 +3239,10 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: _gatwech_core63.GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
           };
           update: {
-            before(data: Partial<{
+            after(user: {
               id: string;
               createdAt: Date;
               updatedAt: Date;
@@ -3188,18 +3250,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            }> & Record<string, unknown>, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<{
-              data: Partial<{
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-              }> & Record<string, unknown>;
-            }>;
-            after(user: {
+            } & Record<string, unknown>, context: _gatwech_core63.GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined, data: (Partial<{
               id: string;
               createdAt: Date;
               updatedAt: Date;
@@ -3207,7 +3258,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
+            }> & Record<string, unknown>) | undefined): Promise<void>;
           };
           delete: {
             after(user: {
@@ -3218,7 +3269,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: _gatwech_core63.GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
         session: {
@@ -3232,7 +3283,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               token: string;
               ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: _gatwech_core63.GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
         account: {
@@ -3251,7 +3302,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               refreshTokenExpiresAt?: Date | null | undefined;
               scope?: string | null | undefined;
               password?: string | null | undefined;
-            }, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
+            }, context: _gatwech_core63.GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
       };
@@ -3259,12 +3310,12 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
   };
   hooks: {
     before: {
-      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
-      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<void>;
     }[];
     after: {
-      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
-      handler: (inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<void>;
     }[];
   };
   endpoints: {
@@ -3293,7 +3344,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call636.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -3314,7 +3365,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       }>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -3461,7 +3512,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call636.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -3482,7 +3533,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       }>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -3620,7 +3671,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call636.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -3635,7 +3686,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       }>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call636.MiddlewareInputContext<better_call636.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -3750,6 +3801,8 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
     database: boolean;
     trackFailedSignIns: boolean;
     adminRoles: string[];
+    organizationAdminRoles: string[];
+    showAttemptsOnOwnAccount: boolean;
     remote?: {
       apiUrl?: string | undefined;
       apiKey?: string | undefined;

package/dist/{index-Df0KhQRf-BEa5tdwJ.d.mts → index-BL_t8cRp-C4QYBsac.d.mts}

@@ -25,7 +25,7 @@ type InternalLogger = { [K in LogLevel]: (...params: LogHandlerParams) => void }
 };
 declare const createLogger: (options?: Logger | undefined) => InternalLogger;
 //#endregion
-//#region ../core/dist/index-Df0KhQRf.d.mts
+//#region ../core/dist/index-BL_t8cRp.d.mts
 //#region src/db/type.d.ts
 type DBPreservedModels = "user" | "account" | "session" | "verification" | "rate-limit" | "organization" | "member" | "invitation" | "jwks" | "passkey" | "two-factor";
 type DBFieldType = "string" | "number" | "boolean" | "date" | "json" | `${"string" | "number"}[]` | Array<LiteralString>;
@@ -137,7 +137,7 @@ interface SecondaryStorage {
    * @param key - Key to get
    * @returns - Value of the key
    */
-  get: (key: string) => Awaitable$1<unknown>;
+  get: (key: string) => Awaitable<unknown>;
   /**
    * Atomically get a value and delete it from storage.
    *
@@ -149,7 +149,7 @@ interface SecondaryStorage {
    * breaking release, or require database-backed verification storage for
    * security-sensitive consume paths.
    */
-  getAndDelete?: (key: string) => Awaitable$1<unknown>;
+  getAndDelete?: (key: string) => Awaitable<unknown>;
   /**
    * Atomically increment the counter at `key` by one, returning the
    * post-increment value.
@@ -164,7 +164,7 @@ interface SecondaryStorage {
    * this required for secondary-storage-backed rate limiting in the next minor
    * on `next`.
    */
-  increment?: (key: string, ttl: number) => Awaitable$1<number>;
+  increment?: (key: string, ttl: number) => Awaitable<number>;
   set: (
   /**
    * Key to store
@@ -177,12 +177,12 @@ interface SecondaryStorage {
   /**
    * Time to live in seconds
    */
-  ttl?: number | undefined) => Awaitable$1<void | null | unknown>;
+  ttl?: number | undefined) => Awaitable<void | null | unknown>;
   /**
    *
    * @param key - Key to delete
    */
-  delete: (key: string) => Awaitable$1<void | null | string>;
+  delete: (key: string) => Awaitable<void | null | string>;
 }
 //#endregion
 //#region src/db/plugin.d.ts
@@ -912,7 +912,7 @@ type PayvoAuthCookies = {
 //#endregion
 //#region src/types/helper.d.ts
 type Primitive = string | number | symbol | bigint | boolean | null | undefined;
-type Awaitable$1<T> = T | Promise<T>;
+type Awaitable<T> = T | Promise<T>;
 type LiteralString = "" | (string & Record<never, never>);
 type LiteralUnion<LiteralType, BaseType extends Primitive> = LiteralType | (BaseType & Record<never, never>);
 //#endregion
@@ -1118,7 +1118,7 @@ type SocialProviders = { [K in SocialProviderList[number]]?: Parameters<(typeof
 type SocialProviderList = typeof socialProviderList;
 //#endregion
 //#region src/types/plugin.d.ts
-type Awaitable<T> = T | Promise<T>;
+type Awaitable$1<T> = T | Promise<T>;
 type DeepPartial<T> = T extends Function ? T : T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;
 type HookEndpointContext = Partial<EndpointContext<string, any> & Omit<InputContext<string, any>, "method">> & {
   path: string;
@@ -1134,7 +1134,7 @@ type PayvoAuthPlugin = {
    * The init function is called when the plugin is initialized.
    * You can return a new context or modify the existing context.
    */
-  init?: ((ctx: AuthContext) => Awaitable<{
+  init?: ((ctx: AuthContext) => Awaitable$1<{
     context?: DeepPartial<Omit<AuthContext, "options">>;
     options?: Partial<PayvoAuthOptions>;
   }> | void | Promise<void>) | undefined;
@@ -1355,6 +1355,27 @@ type PayvoAuthAdvancedOptions = {
    * Payvo Auth. And could lead to security vulnerabilities.
    */
   disableOriginCheck?: boolean | undefined;
+  /**
+   * Run deferred work, such as sending events to a remote service, after the
+   * response is sent. On serverless platforms, pass the platform's hook so
+   * the function stays alive until the work finishes.
+   *
+   * @example
+   * // Vercel
+   * import { waitUntil } from "@vercel/functions";
+   * advanced: { backgroundTasks: { handler: waitUntil } }
+   *
+   * @example
+   * // Cloudflare Workers, with the execution context kept in AsyncLocalStorage
+   * advanced: {
+   *   backgroundTasks: {
+   *     handler: (promise) => executionContext.getStore()?.waitUntil(promise),
+   *   },
+   * }
+   */
+  backgroundTasks?: {
+    handler: (promise: Promise<unknown>) => void;
+  } | undefined;
   /**
    * Configure cookies to be cross subdomains
    */
@@ -2100,9 +2121,10 @@ type PayvoAuthOptions = {
           data: Optional<User & Record<string, any>>;
         }>;
         /**
-         * Hook that is called after a user is updated.
+         * Hook that is called after a user is updated. `data` holds the
+         * fields that were written, after every `before` hook ran.
          */
-        after?: (user: User & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+        after?: (user: User & Record<string, unknown>, context?: GenericEndpointContext, data?: Partial<User> & Record<string, unknown>) => Promise<void>;
       };
       delete?: {
         /**
@@ -2147,9 +2169,10 @@ type PayvoAuthOptions = {
           data: Optional<Session & Record<string, any>>;
         }>;
         /**
-         * Hook that is called after a session is updated.
+         * Hook that is called after a session is updated. `data` holds the
+         * fields that were written, after every `before` hook ran.
          */
-        after?: (session: Session & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+        after?: (session: Session & Record<string, unknown>, context?: GenericEndpointContext, data?: Partial<Session> & Record<string, unknown>) => Promise<void>;
       };
       delete?: {
         /**
@@ -2194,9 +2217,10 @@ type PayvoAuthOptions = {
           data: Optional<Account & Record<string, any>>;
         }>;
         /**
-         * Hook that is called after a account is updated.
+         * Hook that is called after a account is updated. `data` holds the
+         * fields that were written, after every `before` hook ran.
          */
-        after?: (account: Account & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+        after?: (account: Account & Record<string, unknown>, context?: GenericEndpointContext, data?: Partial<Account> & Record<string, unknown>) => Promise<void>;
       };
       delete?: {
         /**
@@ -2238,9 +2262,11 @@ type PayvoAuthOptions = {
           data: Optional<Verification & Record<string, any>>;
         }>;
         /**
-         * Hook that is called after a verification is updated.
+         * Hook that is called after a verification is updated. `data`
+         * holds the fields that were written, after every `before` hook
+         * ran.
          */
-        after?: (verification: Verification & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+        after?: (verification: Verification & Record<string, unknown>, context?: GenericEndpointContext, data?: Partial<Verification> & Record<string, unknown>) => Promise<void>;
       };
       delete?: {
         /**
@@ -2524,6 +2550,19 @@ type AuthContext<Options extends PayvoAuthOptions = PayvoAuthOptions> = {
    * @default false
    */
   skipCSRFCheck: boolean;
+  /**
+   * Runs work after the response without blocking it, e.g. sending an
+   * event to a remote service.
+   *
+   * This is inferred from the `options.advanced?.backgroundTasks?.handler`
+   * option. Without one, the promise runs on its own.
+   */
+  runInBackground: (promise: Promise<unknown>) => void;
+  /**
+   * Runs work in the background when `advanced.backgroundTasks` is
+   * configured, and awaits it otherwise, for work that must finish
+   */
+  runInBackgroundOrAwait: (promise: Promise<unknown> | void) => Awaitable<unknown>;
 };
 //#endregion
 //#region src/types/plugin-client.d.ts