@gatwech/auth 1.0.0-beta.21 → 1.0.0-beta.23

package/dist/{index-BKy-8t2n.d.mts → index-B7iZf_Dl.d.mts}

@@ -1,14 +1,14 @@
-import { g as User$1 } from "./index-BjCQ3jmE.mjs";
+import { g as User$1 } from "./index-3lfPQHhX.mjs";
 import { n as DBPrimitive } from "./index-BL_t8cRp-C4QYBsac.mjs";
 import { t as InferOptionSchema } from "./plugins-Dy_FrD4Y.mjs";
 import { o as Statements } from "./index-CxlWnL9c.mjs";
-import * as _gatwech_core63 from "@gatwech/core";
+import * as _gatwech_core61 from "@gatwech/core";
 import { AuthContext, GenericEndpointContext, HookEndpointContext } from "@gatwech/core";
-import * as better_call643 from "better-call";
+import * as better_call285 from "better-call";
 import { AuthEndpoint, AuthMiddleware, createAuthEndpoint as createAuthEndpoint$1, createAuthMiddleware as createAuthMiddleware$1, optionsMiddleware } from "@gatwech/core/api";
-import * as zod1419 from "zod";
+import * as zod381 from "zod";
 import * as _gatwech_core_db14 from "@gatwech/core/db";
-import * as zod_v4_core207 from "zod/v4/core";
+import * as zod_v4_core51 from "zod/v4/core";
 
 //#region src/plugins/api-key/schema.d.ts
 declare const apiKeySchema: ({
@@ -547,8 +547,8 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
   };
   hooks: {
     before: {
-      matcher: (ctx: _gatwech_core63.HookEndpointContext) => boolean;
-      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
+      matcher: (ctx: _gatwech_core61.HookEndpointContext) => boolean;
+      handler: (inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<{
         user: {
           id: string;
           createdAt: Date;
@@ -569,7 +569,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
           expiresAt: Date;
         };
       } | {
-        context: better_call643.MiddlewareContext<better_call643.MiddlewareOptions, _gatwech_core63.AuthContext<_gatwech_core63.PayvoAuthOptions> & {
+        context: better_call285.MiddlewareContext<better_call285.MiddlewareOptions, _gatwech_core61.AuthContext<_gatwech_core61.PayvoAuthOptions> & {
           returned?: unknown | undefined;
           responseHeaders?: Headers | undefined;
         }>;
@@ -621,7 +621,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call643.Middleware[];
+        use?: better_call285.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -676,20 +676,20 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       }>;
       options: {
         method: "POST";
-        body: zod1419.ZodObject<{
-          name: zod1419.ZodOptional<zod1419.ZodString>;
-          expiresIn: zod1419.ZodDefault<zod1419.ZodNullable<zod1419.ZodOptional<zod1419.ZodNumber>>>;
-          userId: zod1419.ZodOptional<zod1419.ZodCoercedString<unknown>>;
-          prefix: zod1419.ZodOptional<zod1419.ZodString>;
-          remaining: zod1419.ZodDefault<zod1419.ZodNullable<zod1419.ZodOptional<zod1419.ZodNumber>>>;
-          metadata: zod1419.ZodOptional<zod1419.ZodAny>;
-          refillAmount: zod1419.ZodOptional<zod1419.ZodNumber>;
-          refillInterval: zod1419.ZodOptional<zod1419.ZodNumber>;
-          rateLimitTimeWindow: zod1419.ZodOptional<zod1419.ZodNumber>;
-          rateLimitMax: zod1419.ZodOptional<zod1419.ZodNumber>;
-          rateLimitEnabled: zod1419.ZodOptional<zod1419.ZodBoolean>;
-          permissions: zod1419.ZodOptional<zod1419.ZodRecord<zod1419.ZodString, zod1419.ZodArray<zod1419.ZodString>>>;
-        }, zod_v4_core207.$strip>;
+        body: zod381.ZodObject<{
+          name: zod381.ZodOptional<zod381.ZodString>;
+          expiresIn: zod381.ZodDefault<zod381.ZodNullable<zod381.ZodOptional<zod381.ZodNumber>>>;
+          userId: zod381.ZodOptional<zod381.ZodCoercedString<unknown>>;
+          prefix: zod381.ZodOptional<zod381.ZodString>;
+          remaining: zod381.ZodDefault<zod381.ZodNullable<zod381.ZodOptional<zod381.ZodNumber>>>;
+          metadata: zod381.ZodOptional<zod381.ZodAny>;
+          refillAmount: zod381.ZodOptional<zod381.ZodNumber>;
+          refillInterval: zod381.ZodOptional<zod381.ZodNumber>;
+          rateLimitTimeWindow: zod381.ZodOptional<zod381.ZodNumber>;
+          rateLimitMax: zod381.ZodOptional<zod381.ZodNumber>;
+          rateLimitEnabled: zod381.ZodOptional<zod381.ZodBoolean>;
+          permissions: zod381.ZodOptional<zod381.ZodRecord<zod381.ZodString, zod381.ZodArray<zod381.ZodString>>>;
+        }, zod_v4_core51.$strip>;
         metadata: {
           openapi: {
             description: string;
@@ -855,7 +855,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call643.Middleware[];
+        use?: better_call285.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -888,10 +888,10 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       }>;
       options: {
         method: "POST";
-        body: zod1419.ZodObject<{
-          key: zod1419.ZodString;
-          permissions: zod1419.ZodOptional<zod1419.ZodRecord<zod1419.ZodString, zod1419.ZodArray<zod1419.ZodString>>>;
-        }, zod_v4_core207.$strip>;
+        body: zod381.ZodObject<{
+          key: zod381.ZodString;
+          permissions: zod381.ZodOptional<zod381.ZodRecord<zod381.ZodString, zod381.ZodArray<zod381.ZodString>>>;
+        }, zod_v4_core51.$strip>;
         metadata: {
           SERVER_ONLY: true;
         };
@@ -933,7 +933,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call643.Middleware[];
+        use?: better_call285.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -990,10 +990,10 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       }>;
       options: {
         method: "GET";
-        query: zod1419.ZodObject<{
-          id: zod1419.ZodString;
-        }, zod_v4_core207.$strip>;
-        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
+        query: zod381.ZodObject<{
+          id: zod381.ZodString;
+        }, zod_v4_core51.$strip>;
+        use: ((inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -1186,7 +1186,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call643.Middleware[];
+        use?: better_call285.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1243,21 +1243,21 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       }>;
       options: {
         method: "POST";
-        body: zod1419.ZodObject<{
-          keyId: zod1419.ZodString;
-          userId: zod1419.ZodOptional<zod1419.ZodCoercedString<unknown>>;
-          name: zod1419.ZodOptional<zod1419.ZodString>;
-          enabled: zod1419.ZodOptional<zod1419.ZodBoolean>;
-          remaining: zod1419.ZodOptional<zod1419.ZodNumber>;
-          refillAmount: zod1419.ZodOptional<zod1419.ZodNumber>;
-          refillInterval: zod1419.ZodOptional<zod1419.ZodNumber>;
-          metadata: zod1419.ZodOptional<zod1419.ZodAny>;
-          expiresIn: zod1419.ZodNullable<zod1419.ZodOptional<zod1419.ZodNumber>>;
-          rateLimitEnabled: zod1419.ZodOptional<zod1419.ZodBoolean>;
-          rateLimitTimeWindow: zod1419.ZodOptional<zod1419.ZodNumber>;
-          rateLimitMax: zod1419.ZodOptional<zod1419.ZodNumber>;
-          permissions: zod1419.ZodNullable<zod1419.ZodOptional<zod1419.ZodRecord<zod1419.ZodString, zod1419.ZodArray<zod1419.ZodString>>>>;
-        }, zod_v4_core207.$strip>;
+        body: zod381.ZodObject<{
+          keyId: zod381.ZodString;
+          userId: zod381.ZodOptional<zod381.ZodCoercedString<unknown>>;
+          name: zod381.ZodOptional<zod381.ZodString>;
+          enabled: zod381.ZodOptional<zod381.ZodBoolean>;
+          remaining: zod381.ZodOptional<zod381.ZodNumber>;
+          refillAmount: zod381.ZodOptional<zod381.ZodNumber>;
+          refillInterval: zod381.ZodOptional<zod381.ZodNumber>;
+          metadata: zod381.ZodOptional<zod381.ZodAny>;
+          expiresIn: zod381.ZodNullable<zod381.ZodOptional<zod381.ZodNumber>>;
+          rateLimitEnabled: zod381.ZodOptional<zod381.ZodBoolean>;
+          rateLimitTimeWindow: zod381.ZodOptional<zod381.ZodNumber>;
+          rateLimitMax: zod381.ZodOptional<zod381.ZodNumber>;
+          permissions: zod381.ZodNullable<zod381.ZodOptional<zod381.ZodRecord<zod381.ZodString, zod381.ZodArray<zod381.ZodString>>>>;
+        }, zod_v4_core51.$strip>;
         metadata: {
           openapi: {
             description: string;
@@ -1416,7 +1416,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call643.Middleware[];
+        use?: better_call285.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1431,10 +1431,10 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       }>;
       options: {
         method: "POST";
-        body: zod1419.ZodObject<{
-          keyId: zod1419.ZodString;
-        }, zod_v4_core207.$strip>;
-        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
+        body: zod381.ZodObject<{
+          keyId: zod381.ZodString;
+        }, zod_v4_core51.$strip>;
+        use: ((inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -1533,7 +1533,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call643.Middleware[];
+        use?: better_call285.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1590,7 +1590,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       }[]>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -1769,7 +1769,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call643.Middleware[];
+        use?: better_call285.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1959,7 +1959,7 @@ interface LastLoginMethodOptions {
  */
 declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O | undefined) => {
   id: "last-login-method";
-  init(ctx: _gatwech_core63.AuthContext<_gatwech_core63.PayvoAuthOptions>): {
+  init(ctx: _gatwech_core61.AuthContext<_gatwech_core61.PayvoAuthOptions>): {
     options: {
       databaseHooks: {
         user: {
@@ -1972,7 +1972,7 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<{
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<{
               data: {
                 lastLoginMethod: any;
                 id: string;
@@ -1997,7 +1997,7 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
               token: string;
               ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
       };
@@ -2006,7 +2006,7 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
   hooks: {
     after: {
       matcher(): true;
-      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<void>;
+      handler: (inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<void>;
     }[];
   };
   schema: O["storeInDatabase"] extends true ? {
@@ -2099,6 +2099,7 @@ declare const SECURITY_EVENT_TYPES: {
   readonly COMPROMISED_PASSWORD: "security_compromised_password";
   readonly STALE_ACCOUNT: "security_stale_account";
   readonly INVALID_EMAIL: "security_invalid_email";
+  readonly UNBLOCKED: "security_unblocked";
 };
 type AuditEventType = (typeof AUDIT_EVENT_TYPES)[keyof typeof AUDIT_EVENT_TYPES] | (typeof SECURITY_EVENT_TYPES)[keyof typeof SECURITY_EVENT_TYPES];
 declare const ALL_EVENT_TYPES: AuditEventType[];
@@ -2323,6 +2324,43 @@ declare const schema$1: {
       };
     };
   };
+  /** Active blocks, so an admin can list and lift them */
+  sentinelBlock: {
+    fields: {
+      /** The counter the block is kept under, e.g. `cs:ip:203.0.113.1` */
+      key: {
+        type: "string";
+        required: true;
+        unique: true;
+      };
+      feature: {
+        type: "string";
+        required: true;
+      };
+      /** What was blocked: a visitor id or an IP address */
+      kind: {
+        type: "string";
+        required: true;
+      };
+      identifier: {
+        type: "string";
+        required: true;
+      };
+      /** The account the attempts were on, when the block is for one */
+      account: {
+        type: "string";
+        required: false;
+      };
+      blockedUntil: {
+        type: "date";
+        required: true;
+      };
+      createdAt: {
+        type: "date";
+        required: true;
+      };
+    };
+  };
   sentinelSignIn: {
     fields: {
       userId: {
@@ -2515,6 +2553,13 @@ interface SentinelOptions {
      */
     resolveGeo?: ((ip: string) => GeoLocation | null | Promise<GeoLocation | null>) | undefined;
   } | undefined;
+  /**
+   * Roles allowed to list and lift blocks through `/sentinel/blocks` and
+   * `/sentinel/unblock`
+   *
+   * @default ["admin"]
+   */
+  adminRoles?: string[] | undefined;
   /**
    * Send a security notification, e.g. by email. Required for
    * `unknownDeviceNotification` and the stale account notifications.
@@ -2850,6 +2895,8 @@ interface SentinelOptions {
 declare const SENTINEL_ERROR_CODES: {
   readonly POW_CHALLENGE_REQUIRED: "Challenge required";
   readonly SECURITY_BLOCKED: "Request blocked for security reasons";
+  readonly SECURITY_ADMIN_REQUIRED: "Only an administrator can manage security blocks";
+  readonly BLOCK_NOT_FOUND: "That block doesn't exist or has ended";
 };
 //#endregion
 //#region src/plugins/sentinel/email.d.ts
@@ -2896,7 +2943,7 @@ declare function parsePowHeader(value: string | null | undefined): {
 //#region src/plugins/sentinel/index.d.ts
 declare const sentinel: (options?: SentinelOptions | undefined) => {
   id: "sentinel";
-  init(ctx: AuthContext<_gatwech_core63.PayvoAuthOptions>): {
+  init(ctx: AuthContext<_gatwech_core61.PayvoAuthOptions>): {
     options: {
       databaseHooks: {
         user: {
@@ -2909,7 +2956,7 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<{
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<{
               data: {
                 normalizedEmail: string;
                 id: string;
@@ -2929,7 +2976,7 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
           };
           update: {
             before(data: Partial<{
@@ -2957,28 +3004,28 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
       };
     };
   } | undefined;
-  onRequest(request: Request, ctx: AuthContext<_gatwech_core63.PayvoAuthOptions>): Promise<{
+  onRequest(request: Request, ctx: AuthContext<_gatwech_core61.PayvoAuthOptions>): Promise<{
     response: Response;
   } | undefined>;
   hooks: {
     before: ({
-      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
-      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
+      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
+      handler: (inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<{
         context: {
           body: any;
         };
       } | undefined>;
     } | {
-      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
-      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
+      handler: (inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<void>;
     })[];
     after: ({
-      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
-      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
+      handler: (inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<void>;
     } | {
-      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
-      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<({
-        status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | better_call643.Status;
+      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
+      handler: (inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<({
+        status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | better_call285.Status;
         body: ({
           message?: string;
           code?: string;
@@ -3013,6 +3060,39 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
         };
       };
     };
+    sentinelBlock: {
+      fields: {
+        key: {
+          type: "string";
+          required: true;
+          unique: true;
+        };
+        feature: {
+          type: "string";
+          required: true;
+        };
+        kind: {
+          type: "string";
+          required: true;
+        };
+        identifier: {
+          type: "string";
+          required: true;
+        };
+        account: {
+          type: "string";
+          required: false;
+        };
+        blockedUntil: {
+          type: "date";
+          required: true;
+        };
+        createdAt: {
+          type: "date";
+          required: true;
+        };
+      };
+    };
     sentinelSignIn: {
       fields: {
         userId: {
@@ -3096,9 +3176,221 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
       };
     };
   };
+  endpoints: {
+    listBlocks: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0?: ({
+        body?: undefined;
+      } & {
+        method?: "GET" | undefined;
+      } & {
+        query?: {
+          limit?: string | number | undefined;
+          offset?: string | number | undefined;
+        } | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call285.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }) | undefined): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          blocks: {
+            id: string;
+            key: string;
+            feature: string;
+            kind: string;
+            identifier: string;
+            account: string | null;
+            blockedUntil: Date;
+            createdAt: Date;
+          }[];
+          total: number;
+          limit: number;
+          offset: number;
+        };
+      } : {
+        blocks: {
+          id: string;
+          key: string;
+          feature: string;
+          kind: string;
+          identifier: string;
+          account: string | null;
+          blockedUntil: Date;
+          createdAt: Date;
+        }[];
+        total: number;
+        limit: number;
+        offset: number;
+      }>;
+      options: {
+        method: "GET";
+        use: ((inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>)[];
+        query: zod381.ZodOptional<zod381.ZodObject<{
+          limit: zod381.ZodOptional<zod381.ZodUnion<[zod381.ZodString, zod381.ZodNumber]>>;
+          offset: zod381.ZodOptional<zod381.ZodUnion<[zod381.ZodString, zod381.ZodNumber]>>;
+        }, zod381.core.$strip>>;
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+          };
+        };
+      } & {
+        use: any[];
+      };
+      path: "/sentinel/blocks";
+    };
+    unblock: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+        body: {
+          id: string;
+        };
+      } & {
+        method?: "POST" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call285.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          success: boolean;
+        };
+      } : {
+        success: boolean;
+      }>;
+      options: {
+        method: "POST";
+        use: ((inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>)[];
+        body: zod381.ZodObject<{
+          id: zod381.ZodString;
+        }, zod381.core.$strip>;
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+          };
+        };
+      } & {
+        use: any[];
+      };
+      path: "/sentinel/unblock";
+    };
+    deleteExpired: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0?: ({
+        body?: undefined;
+      } & {
+        method?: "POST" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call285.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }) | undefined): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          success: boolean;
+        };
+      } : {
+        success: boolean;
+      }>;
+      options: {
+        method: "POST";
+        metadata: {
+          SERVER_ONLY: true;
+          client: boolean;
+        };
+      } & {
+        use: any[];
+      };
+      path: "/sentinel/delete-expired";
+    };
+  };
   $ERROR_CODES: {
     readonly POW_CHALLENGE_REQUIRED: "Challenge required";
     readonly SECURITY_BLOCKED: "Request blocked for security reasons";
+    readonly SECURITY_ADMIN_REQUIRED: "Only an administrator can manage security blocks";
+    readonly BLOCK_NOT_FOUND: "That block doesn't exist or has ended";
   };
   options: {
     failOpen: boolean;
@@ -3124,6 +3416,7 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
       isBot?: ((request: Request) => boolean | Promise<boolean>) | undefined;
       resolveGeo?: ((ip: string) => GeoLocation | null | Promise<GeoLocation | null>) | undefined;
     } | undefined;
+    adminRoles?: string[] | undefined;
     sendNotification?: ((notification: {
       type: "unknown-device" | "stale-account";
       recipient: "user" | "admin";
@@ -3141,8 +3434,7 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
       credentialStuffing?: {
         enabled: boolean;
         action?: SecurityAction | undefined;
-        thresholds
-        /** Checked with the identification service, rather than taken as sent */? /** Checked with the identification service, rather than taken as sent */: {
+        thresholds?: {
           challenge: number;
           block: number;
         } | undefined;
@@ -3226,7 +3518,7 @@ declare const AUDIT_LOG_ERROR_CODES: {
 };
 declare const auditLog: (options?: AuditLogOptions | undefined) => {
   id: "audit-log";
-  init(ctx: AuthContext<_gatwech_core63.PayvoAuthOptions>): {
+  init(ctx: AuthContext<_gatwech_core61.PayvoAuthOptions>): {
     options: {
       databaseHooks: {
         user: {
@@ -3239,7 +3531,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core63.GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
           };
           update: {
             after(user: {
@@ -3250,7 +3542,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core63.GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined, data: (Partial<{
+            } & Record<string, unknown>, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined, data: (Partial<{
               id: string;
               createdAt: Date;
               updatedAt: Date;
@@ -3269,7 +3561,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core63.GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
         session: {
@@ -3283,7 +3575,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               token: string;
               ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core63.GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
         account: {
@@ -3302,7 +3594,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               refreshTokenExpiresAt?: Date | null | undefined;
               scope?: string | null | undefined;
               password?: string | null | undefined;
-            }, context: _gatwech_core63.GenericEndpointContext<_gatwech_core63.PayvoAuthOptions> | undefined): Promise<void>;
+            }, context: _gatwech_core61.GenericEndpointContext<_gatwech_core61.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
       };
@@ -3310,12 +3602,12 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
   };
   hooks: {
     before: {
-      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
-      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
+      handler: (inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<void>;
     }[];
     after: {
-      matcher(context: _gatwech_core63.HookEndpointContext): boolean;
-      handler: (inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core61.HookEndpointContext): boolean;
+      handler: (inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<void>;
     }[];
   };
   endpoints: {
@@ -3344,7 +3636,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call643.Middleware[];
+        use?: better_call285.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -3365,7 +3657,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       }>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -3388,16 +3680,16 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
             };
           };
         }>)[];
-        query: zod1419.ZodOptional<zod1419.ZodObject<{
-          limit: zod1419.ZodOptional<zod1419.ZodUnion<[zod1419.ZodString, zod1419.ZodNumber]>>;
-          offset: zod1419.ZodOptional<zod1419.ZodUnion<[zod1419.ZodString, zod1419.ZodNumber]>>;
-          eventType: zod1419.ZodOptional<zod1419.ZodString>;
-          identifier: zod1419.ZodOptional<zod1419.ZodString>;
-          organizationId: zod1419.ZodOptional<zod1419.ZodString>;
-          userId: zod1419.ZodOptional<zod1419.ZodString>;
-          startDate: zod1419.ZodOptional<zod1419.ZodString>;
-          endDate: zod1419.ZodOptional<zod1419.ZodString>;
-        }, zod1419.core.$strip>>;
+        query: zod381.ZodOptional<zod381.ZodObject<{
+          limit: zod381.ZodOptional<zod381.ZodUnion<[zod381.ZodString, zod381.ZodNumber]>>;
+          offset: zod381.ZodOptional<zod381.ZodUnion<[zod381.ZodString, zod381.ZodNumber]>>;
+          eventType: zod381.ZodOptional<zod381.ZodString>;
+          identifier: zod381.ZodOptional<zod381.ZodString>;
+          organizationId: zod381.ZodOptional<zod381.ZodString>;
+          userId: zod381.ZodOptional<zod381.ZodString>;
+          startDate: zod381.ZodOptional<zod381.ZodString>;
+          endDate: zod381.ZodOptional<zod381.ZodString>;
+        }, zod381.core.$strip>>;
         metadata: {
           openapi: {
             operationId: string;
@@ -3512,7 +3804,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call643.Middleware[];
+        use?: better_call285.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -3533,7 +3825,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       }>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -3556,16 +3848,16 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
             };
           };
         }>)[];
-        query: zod1419.ZodOptional<zod1419.ZodObject<{
-          limit: zod1419.ZodOptional<zod1419.ZodUnion<[zod1419.ZodString, zod1419.ZodNumber]>>;
-          offset: zod1419.ZodOptional<zod1419.ZodUnion<[zod1419.ZodString, zod1419.ZodNumber]>>;
-          eventType: zod1419.ZodOptional<zod1419.ZodString>;
-          identifier: zod1419.ZodOptional<zod1419.ZodString>;
-          organizationId: zod1419.ZodOptional<zod1419.ZodString>;
-          userId: zod1419.ZodOptional<zod1419.ZodString>;
-          startDate: zod1419.ZodOptional<zod1419.ZodString>;
-          endDate: zod1419.ZodOptional<zod1419.ZodString>;
-        }, zod1419.core.$strip>>;
+        query: zod381.ZodOptional<zod381.ZodObject<{
+          limit: zod381.ZodOptional<zod381.ZodUnion<[zod381.ZodString, zod381.ZodNumber]>>;
+          offset: zod381.ZodOptional<zod381.ZodUnion<[zod381.ZodString, zod381.ZodNumber]>>;
+          eventType: zod381.ZodOptional<zod381.ZodString>;
+          identifier: zod381.ZodOptional<zod381.ZodString>;
+          organizationId: zod381.ZodOptional<zod381.ZodString>;
+          userId: zod381.ZodOptional<zod381.ZodString>;
+          startDate: zod381.ZodOptional<zod381.ZodString>;
+          endDate: zod381.ZodOptional<zod381.ZodString>;
+        }, zod381.core.$strip>>;
         metadata: {
           openapi: {
             operationId: string;
@@ -3671,7 +3963,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call643.Middleware[];
+        use?: better_call285.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -3686,7 +3978,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       }>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call643.MiddlewareInputContext<better_call643.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call285.MiddlewareInputContext<better_call285.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -3742,6 +4034,51 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       };
       path: "/audit-log/get-event-types";
     };
+    deleteOldEvents: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+        body: {
+          olderThanDays: number;
+        };
+      } & {
+        method?: "POST" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call285.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          deleted: number;
+        };
+      } : {
+        deleted: number;
+      }>;
+      options: {
+        method: "POST";
+        body: zod381.ZodObject<{
+          olderThanDays: zod381.ZodNumber;
+        }, zod381.core.$strip>;
+        metadata: {
+          SERVER_ONLY: true;
+          client: boolean;
+        };
+      } & {
+        use: any[];
+      };
+      path: "/audit-log/delete-old-events";
+    };
   };
   schema: {
     auditLog: {