@gatwech/auth 1.0.0-beta.20 → 1.0.0-beta.21

package/dist/{index-D57DuhZR.d.mts → index-BKy-8t2n.d.mts}

@@ -1,14 +1,14 @@
-import { g as User$1 } from "./index-BNhJglHC.mjs";
-import { n as DBPrimitive } from "./index-Df0KhQRf-BEa5tdwJ.mjs";
+import { g as User$1 } from "./index-BjCQ3jmE.mjs";
+import { n as DBPrimitive } from "./index-BL_t8cRp-C4QYBsac.mjs";
 import { t as InferOptionSchema } from "./plugins-Dy_FrD4Y.mjs";
 import { o as Statements } from "./index-CxlWnL9c.mjs";
-import * as _gatwech_core53 from "@gatwech/core";
+import * as _gatwech_core63 from "@gatwech/core";
 import { AuthContext, GenericEndpointContext, HookEndpointContext } from "@gatwech/core";
-import * as better_call229 from "better-call";
+import * as better_call643 from "better-call";
 import { AuthEndpoint, AuthMiddleware, createAuthEndpoint as createAuthEndpoint$1, createAuthMiddleware as createAuthMiddleware$1, optionsMiddleware } from "@gatwech/core/api";
-import * as zod381 from "zod";
+import * as zod1419 from "zod";
 import * as _gatwech_core_db14 from "@gatwech/core/db";
-import * as zod_v4_core51 from "zod/v4/core";
+import * as zod_v4_core207 from "zod/v4/core";
 
 //#region src/plugins/api-key/schema.d.ts
 declare const apiKeySchema: ({
@@ -547,8 +547,8 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
   };
   hooks: {
     before: {
-      matcher: (ctx: _gatwech_core53.HookEndpointContext) => boolean;
-      handler: (inputContext: better_call229.MiddlewareInputContext<better_call229.MiddlewareOptions>) => Promise<{
+      matcher: (ctx: _gatwech_core63.HookEndpointContext) => boolean;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
         user: {
           id: string;
           createdAt: Date;
@@ -569,7 +569,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
           expiresAt: Date;
         };
       } | {
-        context: better_call229.MiddlewareContext<better_call229.MiddlewareOptions, _gatwech_core53.AuthContext<_gatwech_core53.PayvoAuthOptions> & {
+        context: better_call643.MiddlewareContext<better_call643.MiddlewareOptions, _gatwech_core63.AuthContext<_gatwech_core63.PayvoAuthOptions> & {
           returned?: unknown | undefined;
           responseHeaders?: Headers | undefined;
         }>;
@@ -621,7 +621,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call229.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -676,20 +676,20 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       }>;
       options: {
         method: "POST";
-        body: zod381.ZodObject<{
-          name: zod381.ZodOptional<zod381.ZodString>;
-          expiresIn: zod381.ZodDefault<zod381.ZodNullable<zod381.ZodOptional<zod381.ZodNumber>>>;
-          userId: zod381.ZodOptional<zod381.ZodCoercedString<unknown>>;
-          prefix: zod381.ZodOptional<zod381.ZodString>;
-          remaining: zod381.ZodDefault<zod381.ZodNullable<zod381.ZodOptional<zod381.ZodNumber>>>;
-          metadata: zod381.ZodOptional<zod381.ZodAny>;
-          refillAmount: zod381.ZodOptional<zod381.ZodNumber>;
-          refillInterval: zod381.ZodOptional<zod381.ZodNumber>;
-          rateLimitTimeWindow: zod381.ZodOptional<zod381.ZodNumber>;
-          rateLimitMax: zod381.ZodOptional<zod381.ZodNumber>;
-          rateLimitEnabled: zod381.ZodOptional<zod381.ZodBoolean>;
-          permissions: zod381.ZodOptional<zod381.ZodRecord<zod381.ZodString, zod381.ZodArray<zod381.ZodString>>>;
-        }, zod_v4_core51.$strip>;
+        body: zod1419.ZodObject<{
+          name: zod1419.ZodOptional<zod1419.ZodString>;
+          expiresIn: zod1419.ZodDefault<zod1419.ZodNullable<zod1419.ZodOptional<zod1419.ZodNumber>>>;
+          userId: zod1419.ZodOptional<zod1419.ZodCoercedString<unknown>>;
+          prefix: zod1419.ZodOptional<zod1419.ZodString>;
+          remaining: zod1419.ZodDefault<zod1419.ZodNullable<zod1419.ZodOptional<zod1419.ZodNumber>>>;
+          metadata: zod1419.ZodOptional<zod1419.ZodAny>;
+          refillAmount: zod1419.ZodOptional<zod1419.ZodNumber>;
+          refillInterval: zod1419.ZodOptional<zod1419.ZodNumber>;
+          rateLimitTimeWindow: zod1419.ZodOptional<zod1419.ZodNumber>;
+          rateLimitMax: zod1419.ZodOptional<zod1419.ZodNumber>;
+          rateLimitEnabled: zod1419.ZodOptional<zod1419.ZodBoolean>;
+          permissions: zod1419.ZodOptional<zod1419.ZodRecord<zod1419.ZodString, zod1419.ZodArray<zod1419.ZodString>>>;
+        }, zod_v4_core207.$strip>;
         metadata: {
           openapi: {
             description: string;
@@ -855,7 +855,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call229.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -888,10 +888,10 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       }>;
       options: {
         method: "POST";
-        body: zod381.ZodObject<{
-          key: zod381.ZodString;
-          permissions: zod381.ZodOptional<zod381.ZodRecord<zod381.ZodString, zod381.ZodArray<zod381.ZodString>>>;
-        }, zod_v4_core51.$strip>;
+        body: zod1419.ZodObject<{
+          key: zod1419.ZodString;
+          permissions: zod1419.ZodOptional<zod1419.ZodRecord<zod1419.ZodString, zod1419.ZodArray<zod1419.ZodString>>>;
+        }, zod_v4_core207.$strip>;
         metadata: {
           SERVER_ONLY: true;
         };
@@ -933,7 +933,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call229.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -990,10 +990,10 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       }>;
       options: {
         method: "GET";
-        query: zod381.ZodObject<{
-          id: zod381.ZodString;
-        }, zod_v4_core51.$strip>;
-        use: ((inputContext: better_call229.MiddlewareInputContext<better_call229.MiddlewareOptions>) => Promise<{
+        query: zod1419.ZodObject<{
+          id: zod1419.ZodString;
+        }, zod_v4_core207.$strip>;
+        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -1186,7 +1186,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call229.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1243,21 +1243,21 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       }>;
       options: {
         method: "POST";
-        body: zod381.ZodObject<{
-          keyId: zod381.ZodString;
-          userId: zod381.ZodOptional<zod381.ZodCoercedString<unknown>>;
-          name: zod381.ZodOptional<zod381.ZodString>;
-          enabled: zod381.ZodOptional<zod381.ZodBoolean>;
-          remaining: zod381.ZodOptional<zod381.ZodNumber>;
-          refillAmount: zod381.ZodOptional<zod381.ZodNumber>;
-          refillInterval: zod381.ZodOptional<zod381.ZodNumber>;
-          metadata: zod381.ZodOptional<zod381.ZodAny>;
-          expiresIn: zod381.ZodNullable<zod381.ZodOptional<zod381.ZodNumber>>;
-          rateLimitEnabled: zod381.ZodOptional<zod381.ZodBoolean>;
-          rateLimitTimeWindow: zod381.ZodOptional<zod381.ZodNumber>;
-          rateLimitMax: zod381.ZodOptional<zod381.ZodNumber>;
-          permissions: zod381.ZodNullable<zod381.ZodOptional<zod381.ZodRecord<zod381.ZodString, zod381.ZodArray<zod381.ZodString>>>>;
-        }, zod_v4_core51.$strip>;
+        body: zod1419.ZodObject<{
+          keyId: zod1419.ZodString;
+          userId: zod1419.ZodOptional<zod1419.ZodCoercedString<unknown>>;
+          name: zod1419.ZodOptional<zod1419.ZodString>;
+          enabled: zod1419.ZodOptional<zod1419.ZodBoolean>;
+          remaining: zod1419.ZodOptional<zod1419.ZodNumber>;
+          refillAmount: zod1419.ZodOptional<zod1419.ZodNumber>;
+          refillInterval: zod1419.ZodOptional<zod1419.ZodNumber>;
+          metadata: zod1419.ZodOptional<zod1419.ZodAny>;
+          expiresIn: zod1419.ZodNullable<zod1419.ZodOptional<zod1419.ZodNumber>>;
+          rateLimitEnabled: zod1419.ZodOptional<zod1419.ZodBoolean>;
+          rateLimitTimeWindow: zod1419.ZodOptional<zod1419.ZodNumber>;
+          rateLimitMax: zod1419.ZodOptional<zod1419.ZodNumber>;
+          permissions: zod1419.ZodNullable<zod1419.ZodOptional<zod1419.ZodRecord<zod1419.ZodString, zod1419.ZodArray<zod1419.ZodString>>>>;
+        }, zod_v4_core207.$strip>;
         metadata: {
           openapi: {
             description: string;
@@ -1416,7 +1416,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call229.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1431,10 +1431,10 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       }>;
       options: {
         method: "POST";
-        body: zod381.ZodObject<{
-          keyId: zod381.ZodString;
-        }, zod_v4_core51.$strip>;
-        use: ((inputContext: better_call229.MiddlewareInputContext<better_call229.MiddlewareOptions>) => Promise<{
+        body: zod1419.ZodObject<{
+          keyId: zod1419.ZodString;
+        }, zod_v4_core207.$strip>;
+        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -1533,7 +1533,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call229.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1590,7 +1590,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       }[]>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call229.MiddlewareInputContext<better_call229.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -1769,7 +1769,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call229.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1959,7 +1959,7 @@ interface LastLoginMethodOptions {
  */
 declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O | undefined) => {
   id: "last-login-method";
-  init(ctx: _gatwech_core53.AuthContext<_gatwech_core53.PayvoAuthOptions>): {
+  init(ctx: _gatwech_core63.AuthContext<_gatwech_core63.PayvoAuthOptions>): {
     options: {
       databaseHooks: {
         user: {
@@ -1972,7 +1972,7 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core53.PayvoAuthOptions> | undefined): Promise<{
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<{
               data: {
                 lastLoginMethod: any;
                 id: string;
@@ -1997,7 +1997,7 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
               token: string;
               ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core53.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
       };
@@ -2006,7 +2006,7 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
   hooks: {
     after: {
       matcher(): true;
-      handler: (inputContext: better_call229.MiddlewareInputContext<better_call229.MiddlewareOptions>) => Promise<void>;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<void>;
     }[];
   };
   schema: O["storeInDatabase"] extends true ? {
@@ -2230,6 +2230,10 @@ interface AuditLogOptions {
     headers?: Record<string, string> | undefined;
     /**
      * Configure how events are batched before they are sent
+     *
+     * @deprecated Ignored: each event is sent as it's recorded, in the
+     * background. Use `advanced.backgroundTasks` to keep serverless
+     * functions alive until it's sent.
      */
     batch?: {
       /**
@@ -2276,6 +2280,24 @@ interface AuditLogOptions {
    * @default ["admin"]
    */
   adminRoles?: string[] | undefined;
+  /**
+   * Organization member roles allowed to read the events of their
+   * organization through `/audit-log/get-all-audit-logs`
+   *
+   * @default ["owner", "admin"]
+   */
+  organizationAdminRoles?: string[] | undefined;
+  /**
+   * Include failed sign-ins and security decisions made on a user's account
+   * before they were signed in in their own events. They are matched by the
+   * email that was typed, in lower case or as the user's email is stored, so
+   * anyone's attempt shows up; the IP address, user agent, visitor id and
+   * details are left out. Only the latest 50 events since the account was
+   * created are included.
+   *
+   * @default true
+   */
+  showAttemptsOnOwnAccount?: boolean | undefined;
   /**
    * Custom schema for the audit log plugin
    */
@@ -2361,6 +2383,10 @@ declare const schema$1: {
         type: "string";
         required: true;
       };
+      path: {
+        type: "string";
+        required: false;
+      };
       ipAddress: {
         type: "string";
         required: false;
@@ -2634,9 +2660,37 @@ interface SentinelOptions {
        * @default "block"
        */
       action?: SecurityAction | undefined;
+      /**
+       * Maximum accounts per IP address within `ipWindowSeconds`. This
+       * limit catches sign-ups that send no visitor id, or a different
+       * one each time, so it is higher than the per-visitor limit to
+       * allow for networks that share an address. Acts with `action`.
+       *
+       * @default 10
+       */
+      maxAccountsPerIp?: number | undefined;
+      /**
+       * How long sign-ups are remembered per IP address, in seconds.
+       * Clamped to between 1 and 365 days.
+       *
+       * @default 86400 (1 day)
+       */
+      ipWindowSeconds?: number | undefined;
+      /**
+       * Challenge sign-ups whose visitor id is missing or wasn't
+       * verified by the identification service. Without the service
+       * (`kvUrl` and an API key), every visitor id is unverified.
+       *
+       * Visitor limits are only reliable with the identification
+       * service, since a client can send any id otherwise.
+       *
+       * @default false
+       */
+      requireVerifiedVisitor?: boolean | undefined;
     } | undefined;
     /**
-     * Detect automated clients. `true` challenges them.
+     * Detect automated clients on sign-in, sign-up, password reset and
+     * verification requests. `true` challenges them.
      */
     botBlocking?: (boolean | {
       action: SecurityAction;
@@ -2842,7 +2896,7 @@ declare function parsePowHeader(value: string | null | undefined): {
 //#region src/plugins/sentinel/index.d.ts
 declare const sentinel: (options?: SentinelOptions | undefined) => {
   id: "sentinel";
-  init(ctx: AuthContext<_gatwech_core53.PayvoAuthOptions>): {
+  init(ctx: AuthContext<_gatwech_core63.PayvoAuthOptions>): {
     options: {
       databaseHooks: {
         user: {
@@ -2855,7 +2909,7 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core53.PayvoAuthOptions> | undefined): Promise<{
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<{
               data: {
                 normalizedEmail: string;
                 id: string;
@@ -2875,7 +2929,7 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core53.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
           };
           update: {
             before(data: Partial<{
@@ -2903,28 +2957,28 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
       };
     };
   } | undefined;
-  onRequest(request: Request, ctx: AuthContext<_gatwech_core53.PayvoAuthOptions>): Promise<{
+  onRequest(request: Request, ctx: AuthContext<_gatwech_core63.PayvoAuthOptions>): Promise<{
     response: Response;
   } | undefined>;
   hooks: {
     before: ({
-      matcher(context: _gatwech_core53.HookEndpointContext): boolean;
-      handler: (inputContext: better_call229.MiddlewareInputContext<better_call229.MiddlewareOptions>) => Promise<{
+      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
         context: {
           body: any;
         };
       } | undefined>;
     } | {
-      matcher(context: _gatwech_core53.HookEndpointContext): boolean;
-      handler: (inputContext: better_call229.MiddlewareInputContext<better_call229.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<void>;
     })[];
     after: ({
-      matcher(context: _gatwech_core53.HookEndpointContext): boolean;
-      handler: (inputContext: better_call229.MiddlewareInputContext<better_call229.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<void>;
     } | {
-      matcher(context: _gatwech_core53.HookEndpointContext): boolean;
-      handler: (inputContext: better_call229.MiddlewareInputContext<better_call229.MiddlewareOptions>) => Promise<({
-        status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | better_call229.Status;
+      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<({
+        status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | better_call643.Status;
         body: ({
           message?: string;
           code?: string;
@@ -3019,6 +3073,10 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
           type: "string";
           required: true;
         };
+        path: {
+          type: "string";
+          required: false;
+        };
         ipAddress: {
           type: "string";
           required: false;
@@ -3083,7 +3141,8 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
       credentialStuffing?: {
         enabled: boolean;
         action?: SecurityAction | undefined;
-        thresholds?: {
+        thresholds
+        /** Checked with the identification service, rather than taken as sent */? /** Checked with the identification service, rather than taken as sent */: {
           challenge: number;
           block: number;
         } | undefined;
@@ -3111,6 +3170,9 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
         maxAccountsPerVisitor?: number | undefined;
         retentionSeconds?: number | undefined;
         action?: SecurityAction | undefined;
+        maxAccountsPerIp?: number | undefined;
+        ipWindowSeconds?: number | undefined;
+        requireVerifiedVisitor?: boolean | undefined;
       } | undefined;
       botBlocking?: (boolean | {
         action: SecurityAction;
@@ -3164,7 +3226,7 @@ declare const AUDIT_LOG_ERROR_CODES: {
 };
 declare const auditLog: (options?: AuditLogOptions | undefined) => {
   id: "audit-log";
-  init(ctx: AuthContext<_gatwech_core53.PayvoAuthOptions>): {
+  init(ctx: AuthContext<_gatwech_core63.PayvoAuthOptions>): {
     options: {
       databaseHooks: {
         user: {
@@ -3177,10 +3239,10 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core53.GenericEndpointContext<_gatwech_core53.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: _gatwech_core63.GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
           };
           update: {
-            before(data: Partial<{
+            after(user: {
               id: string;
               createdAt: Date;
               updatedAt: Date;
@@ -3188,18 +3250,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            }> & Record<string, unknown>, context: _gatwech_core53.GenericEndpointContext<_gatwech_core53.PayvoAuthOptions> | undefined): Promise<{
-              data: Partial<{
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-              }> & Record<string, unknown>;
-            }>;
-            after(user: {
+            } & Record<string, unknown>, context: _gatwech_core63.GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined, data: (Partial<{
               id: string;
               createdAt: Date;
               updatedAt: Date;
@@ -3207,7 +3258,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core53.GenericEndpointContext<_gatwech_core53.PayvoAuthOptions> | undefined): Promise<void>;
+            }> & Record<string, unknown>) | undefined): Promise<void>;
           };
           delete: {
             after(user: {
@@ -3218,7 +3269,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core53.GenericEndpointContext<_gatwech_core53.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: _gatwech_core63.GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
         session: {
@@ -3232,7 +3283,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               token: string;
               ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core53.GenericEndpointContext<_gatwech_core53.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: _gatwech_core63.GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
         account: {
@@ -3251,7 +3302,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               refreshTokenExpiresAt?: Date | null | undefined;
               scope?: string | null | undefined;
               password?: string | null | undefined;
-            }, context: _gatwech_core53.GenericEndpointContext<_gatwech_core53.PayvoAuthOptions> | undefined): Promise<void>;
+            }, context: _gatwech_core63.GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
       };
@@ -3259,12 +3310,12 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
   };
   hooks: {
     before: {
-      matcher(context: _gatwech_core53.HookEndpointContext): boolean;
-      handler: (inputContext: better_call229.MiddlewareInputContext<better_call229.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<void>;
     }[];
     after: {
-      matcher(context: _gatwech_core53.HookEndpointContext): boolean;
-      handler: (inputContext: better_call229.MiddlewareInputContext<better_call229.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
+      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<void>;
     }[];
   };
   endpoints: {
@@ -3293,7 +3344,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call229.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -3314,7 +3365,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       }>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call229.MiddlewareInputContext<better_call229.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -3337,16 +3388,16 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
             };
           };
         }>)[];
-        query: zod381.ZodOptional<zod381.ZodObject<{
-          limit: zod381.ZodOptional<zod381.ZodUnion<[zod381.ZodString, zod381.ZodNumber]>>;
-          offset: zod381.ZodOptional<zod381.ZodUnion<[zod381.ZodString, zod381.ZodNumber]>>;
-          eventType: zod381.ZodOptional<zod381.ZodString>;
-          identifier: zod381.ZodOptional<zod381.ZodString>;
-          organizationId: zod381.ZodOptional<zod381.ZodString>;
-          userId: zod381.ZodOptional<zod381.ZodString>;
-          startDate: zod381.ZodOptional<zod381.ZodString>;
-          endDate: zod381.ZodOptional<zod381.ZodString>;
-        }, zod381.core.$strip>>;
+        query: zod1419.ZodOptional<zod1419.ZodObject<{
+          limit: zod1419.ZodOptional<zod1419.ZodUnion<[zod1419.ZodString, zod1419.ZodNumber]>>;
+          offset: zod1419.ZodOptional<zod1419.ZodUnion<[zod1419.ZodString, zod1419.ZodNumber]>>;
+          eventType: zod1419.ZodOptional<zod1419.ZodString>;
+          identifier: zod1419.ZodOptional<zod1419.ZodString>;
+          organizationId: zod1419.ZodOptional<zod1419.ZodString>;
+          userId: zod1419.ZodOptional<zod1419.ZodString>;
+          startDate: zod1419.ZodOptional<zod1419.ZodString>;
+          endDate: zod1419.ZodOptional<zod1419.ZodString>;
+        }, zod1419.core.$strip>>;
         metadata: {
           openapi: {
             operationId: string;
@@ -3461,7 +3512,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call229.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -3482,7 +3533,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       }>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call229.MiddlewareInputContext<better_call229.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -3505,16 +3556,16 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
             };
           };
         }>)[];
-        query: zod381.ZodOptional<zod381.ZodObject<{
-          limit: zod381.ZodOptional<zod381.ZodUnion<[zod381.ZodString, zod381.ZodNumber]>>;
-          offset: zod381.ZodOptional<zod381.ZodUnion<[zod381.ZodString, zod381.ZodNumber]>>;
-          eventType: zod381.ZodOptional<zod381.ZodString>;
-          identifier: zod381.ZodOptional<zod381.ZodString>;
-          organizationId: zod381.ZodOptional<zod381.ZodString>;
-          userId: zod381.ZodOptional<zod381.ZodString>;
-          startDate: zod381.ZodOptional<zod381.ZodString>;
-          endDate: zod381.ZodOptional<zod381.ZodString>;
-        }, zod381.core.$strip>>;
+        query: zod1419.ZodOptional<zod1419.ZodObject<{
+          limit: zod1419.ZodOptional<zod1419.ZodUnion<[zod1419.ZodString, zod1419.ZodNumber]>>;
+          offset: zod1419.ZodOptional<zod1419.ZodUnion<[zod1419.ZodString, zod1419.ZodNumber]>>;
+          eventType: zod1419.ZodOptional<zod1419.ZodString>;
+          identifier: zod1419.ZodOptional<zod1419.ZodString>;
+          organizationId: zod1419.ZodOptional<zod1419.ZodString>;
+          userId: zod1419.ZodOptional<zod1419.ZodString>;
+          startDate: zod1419.ZodOptional<zod1419.ZodString>;
+          endDate: zod1419.ZodOptional<zod1419.ZodString>;
+        }, zod1419.core.$strip>>;
         metadata: {
           openapi: {
             operationId: string;
@@ -3620,7 +3671,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call229.Middleware[];
+        use?: better_call643.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -3635,7 +3686,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       }>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call229.MiddlewareInputContext<better_call229.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -3750,6 +3801,8 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
     database: boolean;
     trackFailedSignIns: boolean;
     adminRoles: string[];
+    organizationAdminRoles: string[];
+    showAttemptsOnOwnAccount: boolean;
     remote?: {
       apiUrl?: string | undefined;
       apiKey?: string | undefined;