@gatwech/auth 1.0.0-beta.24 → 1.0.0-beta.25

package/dist/{index-DWSbFJWU.d.mts → index-DD_pxX-h.d.mts}

@@ -1,10 +1,10 @@
-import { g as User$1 } from "./index-CZtQ0rUe.mjs";
+import { g as User$1 } from "./index-CTjXncwM.mjs";
 import { n as DBPrimitive } from "./index-BL_t8cRp-C4QYBsac.mjs";
 import { t as InferOptionSchema } from "./plugins-Dy_FrD4Y.mjs";
 import { o as Statements } from "./index-CxlWnL9c.mjs";
-import * as _gatwech_core55 from "@gatwech/core";
+import * as _gatwech_core57 from "@gatwech/core";
 import { AuthContext, GenericEndpointContext, HookEndpointContext } from "@gatwech/core";
-import * as better_call239 from "better-call";
+import * as better_call278 from "better-call";
 import { AuthEndpoint, AuthMiddleware, createAuthEndpoint as createAuthEndpoint$1, createAuthMiddleware as createAuthMiddleware$1, optionsMiddleware } from "@gatwech/core/api";
 import * as zod381 from "zod";
 import * as _gatwech_core_db14 from "@gatwech/core/db";
@@ -547,8 +547,8 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
   };
   hooks: {
     before: {
-      matcher: (ctx: _gatwech_core55.HookEndpointContext) => boolean;
-      handler: (inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<{
+      matcher: (ctx: _gatwech_core57.HookEndpointContext) => boolean;
+      handler: (inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<{
         user: {
           id: string;
           createdAt: Date;
@@ -569,7 +569,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
           expiresAt: Date;
         };
       } | {
-        context: better_call239.MiddlewareContext<better_call239.MiddlewareOptions, _gatwech_core55.AuthContext<_gatwech_core55.PayvoAuthOptions> & {
+        context: better_call278.MiddlewareContext<better_call278.MiddlewareOptions, _gatwech_core57.AuthContext<_gatwech_core57.PayvoAuthOptions> & {
           returned?: unknown | undefined;
           responseHeaders?: Headers | undefined;
         }>;
@@ -621,7 +621,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call239.Middleware[];
+        use?: better_call278.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -855,7 +855,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call239.Middleware[];
+        use?: better_call278.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -933,7 +933,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call239.Middleware[];
+        use?: better_call278.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -993,7 +993,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
         query: zod381.ZodObject<{
           id: zod381.ZodString;
         }, zod_v4_core51.$strip>;
-        use: ((inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -1186,7 +1186,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call239.Middleware[];
+        use?: better_call278.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1416,7 +1416,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call239.Middleware[];
+        use?: better_call278.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1434,7 +1434,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
         body: zod381.ZodObject<{
           keyId: zod381.ZodString;
         }, zod_v4_core51.$strip>;
-        use: ((inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -1533,7 +1533,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call239.Middleware[];
+        use?: better_call278.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1590,7 +1590,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       }[]>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -1769,7 +1769,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call239.Middleware[];
+        use?: better_call278.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -1959,7 +1959,7 @@ interface LastLoginMethodOptions {
  */
 declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O | undefined) => {
   id: "last-login-method";
-  init(ctx: _gatwech_core55.AuthContext<_gatwech_core55.PayvoAuthOptions>): {
+  init(ctx: _gatwech_core57.AuthContext<_gatwech_core57.PayvoAuthOptions>): {
     options: {
       databaseHooks: {
         user: {
@@ -1972,7 +1972,7 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core55.PayvoAuthOptions> | undefined): Promise<{
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core57.PayvoAuthOptions> | undefined): Promise<{
               data: {
                 lastLoginMethod: any;
                 id: string;
@@ -1997,7 +1997,7 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
               token: string;
               ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core55.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core57.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
       };
@@ -2006,7 +2006,7 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
   hooks: {
     after: {
       matcher(): true;
-      handler: (inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<void>;
+      handler: (inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<void>;
     }[];
   };
   schema: O["storeInDatabase"] extends true ? {
@@ -2022,289 +2022,6 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
   } : undefined;
 };
 //#endregion
-//#region src/plugins/audit-log/events.d.ts
-/**
- * Audit event types recorded by the audit log plugin
- */
-declare const AUDIT_EVENT_TYPES: {
-  readonly USER_SIGNED_UP: "user_signed_up";
-  readonly USER_PROFILE_UPDATED: "user_profile_updated";
-  readonly USER_PROFILE_IMAGE_UPDATED: "user_profile_image_updated";
-  readonly USER_EMAIL_VERIFIED: "user_email_verified";
-  readonly USER_BANNED: "user_banned";
-  readonly USER_UNBANNED: "user_unbanned";
-  readonly USER_DELETED: "user_deleted";
-  readonly USER_ROLE_UPDATED: "user_role_updated";
-  readonly USER_EMAIL_CHANGED: "user_email_changed";
-  readonly USER_PHONE_NUMBER_CHANGED: "user_phone_number_changed";
-  readonly USER_SIGNED_IN: "user_signed_in";
-  readonly USER_SIGNED_OUT: "user_signed_out";
-  readonly SESSION_CREATED: "session_created";
-  readonly SESSION_REVOKED: "session_revoked";
-  readonly SESSIONS_REVOKED_ALL: "sessions_revoked_all";
-  readonly USER_IMPERSONATED: "user_impersonated";
-  readonly USER_IMPERSONATION_STOPPED: "user_impersonation_stopped";
-  readonly DEVICE_AUTHORIZATION_APPROVED: "device_authorization_approved";
-  readonly DEVICE_AUTHORIZATION_DENIED: "device_authorization_denied";
-  readonly ACCOUNT_LINKED: "account_linked";
-  readonly ACCOUNT_UNLINKED: "account_unlinked";
-  readonly PASSWORD_CHANGED: "password_changed";
-  readonly TWO_FACTOR_ENABLED: "two_factor_enabled";
-  readonly TWO_FACTOR_DISABLED: "two_factor_disabled";
-  readonly BACKUP_CODES_GENERATED: "two_factor_backup_codes_generated";
-  readonly PASSKEY_ADDED: "passkey_added";
-  readonly PASSKEY_REMOVED: "passkey_removed";
-  readonly API_KEY_CREATED: "api_key_created";
-  readonly API_KEY_UPDATED: "api_key_updated";
-  readonly API_KEY_DELETED: "api_key_deleted";
-  readonly PASSWORD_RESET_REQUESTED: "password_reset_requested";
-  readonly PASSWORD_RESET_COMPLETED: "password_reset_completed";
-  readonly EMAIL_VERIFICATION_SENT: "email_verification_sent";
-  readonly ORGANIZATION_CREATED: "organization_created";
-  readonly ORGANIZATION_UPDATED: "organization_updated";
-  readonly ORGANIZATION_DELETED: "organization_deleted";
-  readonly ORGANIZATION_ROLE_CREATED: "organization_role_created";
-  readonly ORGANIZATION_ROLE_UPDATED: "organization_role_updated";
-  readonly ORGANIZATION_ROLE_DELETED: "organization_role_deleted";
-  readonly MEMBER_ADDED: "member_added";
-  readonly MEMBER_REMOVED: "member_removed";
-  readonly MEMBER_ROLE_UPDATED: "member_role_updated";
-  readonly MEMBER_INVITED: "member_invited";
-  readonly INVITE_ACCEPTED: "invite_accepted";
-  readonly INVITE_REJECTED: "invite_rejected";
-  readonly INVITE_CANCELLED: "invite_cancelled";
-  readonly TEAM_CREATED: "team_created";
-  readonly TEAM_UPDATED: "team_updated";
-  readonly TEAM_DELETED: "team_deleted";
-  readonly TEAM_MEMBER_ADDED: "team_member_added";
-  readonly TEAM_MEMBER_REMOVED: "team_member_removed";
-  readonly USER_SIGN_IN_FAILED: "user_sign_in_failed";
-  readonly VERIFICATION_FAILED: "verification_failed";
-};
-/**
- * Security event types recorded by the sentinel plugin
- *
- * Declared here so both plugins share the same event types
- */
-declare const SECURITY_EVENT_TYPES: {
-  readonly BLOCKED: "security_blocked";
-  readonly ALLOWED_AFTER_CHALLENGE: "security_allowed";
-  readonly CREDENTIAL_STUFFING: "security_credential_stuffing";
-  readonly IMPOSSIBLE_TRAVEL: "security_impossible_travel";
-  readonly GEO_BLOCKED: "security_geo_blocked";
-  readonly BOT_BLOCKED: "security_bot_blocked";
-  readonly SUSPICIOUS_IP: "security_suspicious_ip";
-  readonly VELOCITY_EXCEEDED: "security_velocity_exceeded";
-  readonly FREE_TRIAL_ABUSE: "security_free_trial_abuse";
-  readonly COMPROMISED_PASSWORD: "security_compromised_password";
-  readonly STALE_ACCOUNT: "security_stale_account";
-  readonly INVALID_EMAIL: "security_invalid_email";
-  readonly UNBLOCKED: "security_unblocked";
-};
-type AuditEventType = (typeof AUDIT_EVENT_TYPES)[keyof typeof AUDIT_EVENT_TYPES] | (typeof SECURITY_EVENT_TYPES)[keyof typeof SECURITY_EVENT_TYPES];
-declare const ALL_EVENT_TYPES: AuditEventType[];
-/** Endpoints that complete a sign-in by creating a session */
-declare const SIGN_IN_PATHS: string[];
-/** Sign-in endpoints that check credentials, so a failure is a failed attempt */
-declare const CREDENTIAL_SIGN_IN_PATHS: string[];
-/**
- * Endpoints that check a one-time code or token outside a sign-in, so a
- * failure is a failed attempt
- */
-declare const VERIFICATION_PATHS: string[];
-/** Endpoints whose successful response maps to a single event */
-declare const PATH_EVENTS: Record<string, AuditEventType>;
-//#endregion
-//#region src/plugins/audit-log/schema.d.ts
-declare const schema: {
-  auditLog: {
-    fields: {
-      eventType: {
-        type: "string";
-        required: true;
-      };
-      userId: {
-        type: "string";
-        required: false;
-      };
-      identifier: {
-        type: "string";
-        required: false;
-      };
-      organizationId: {
-        type: "string";
-        required: false;
-      };
-      status: {
-        type: "string";
-        required: true;
-      };
-      path: {
-        type: "string";
-        required: false;
-      };
-      ipAddress: {
-        type: "string";
-        required: false;
-      };
-      userAgent: {
-        type: "string";
-        required: false;
-      };
-      visitorId: {
-        type: "string";
-        required: false;
-      };
-      eventData: {
-        type: "json";
-        required: false;
-      };
-      createdAt: {
-        type: "date";
-        required: true;
-      };
-    };
-  };
-};
-//#endregion
-//#region src/plugins/audit-log/types.d.ts
-interface AuditEvent {
-  id: string;
-  eventType: AuditEventType;
-  status: "success" | "failure" | "blocked" | "challenged";
-  /**
-   * The user who performed the action
-   *
-   * Null when the actor is unknown, e.g. a failed sign-in
-   */
-  userId: string | null;
-  /**
-   * The actor's identity, such as an email, username or phone number
-   */
-  identifier: string | null;
-  organizationId: string | null;
-  /**
-   * The endpoint that triggered the event
-   */
-  path: string | null;
-  ipAddress: string | null;
-  userAgent: string | null;
-  visitorId: string | null;
-  /**
-   * Additional details about the event
-   *
-   * Never contains passwords, tokens or OTPs
-   */
-  eventData: Record<string, unknown> | null;
-  createdAt: Date;
-}
-interface AuditLogOptions {
-  /**
-   * Send events to the hosted backend
-   *
-   * Enabled when an API key and URL are configured, either here or through
-   * `PAYVO_INFRA_API_KEY` and `PAYVO_INFRA_API_URL`. Set to `false` to
-   * disable it.
-   */
-  remote?: {
-    /**
-     * The hosted backend API URL
-     *
-     * @default process.env.PAYVO_INFRA_API_URL
-     */
-    apiUrl?: string | undefined;
-    /**
-     * The hosted backend API key
-     *
-     * @default process.env.PAYVO_INFRA_API_KEY
-     */
-    apiKey?: string | undefined;
-    /**
-     * Request timeout in milliseconds
-     *
-     * @default 3000
-     */
-    timeout?: number | undefined;
-    /**
-     * Additional headers sent with every request
-     */
-    headers?: Record<string, string> | undefined;
-    /**
-     * Configure how events are batched before they are sent
-     *
-     * @deprecated Ignored: each event is sent as it's recorded, in the
-     * background. Use `advanced.backgroundTasks` to keep serverless
-     * functions alive until it's sent.
-     */
-    batch?: {
-      /**
-       * Send buffered events once this many are queued
-       *
-       * @default 25
-       */
-      maxSize?: number | undefined;
-      /**
-       * Send buffered events after this many milliseconds
-       *
-       * @default 2000
-       */
-      flushIntervalMs?: number | undefined;
-    } | undefined;
-  } | false | undefined;
-  /**
-   * Write events to the `auditLog` table
-   *
-   * @default true
-   */
-  database?: boolean | undefined;
-  /**
-   * Called for every recorded event, e.g. to publish it to a message broker
-   *
-   * Errors are logged and ignored
-   */
-  onEvent?: ((event: AuditEvent) => void | Promise<void>) | undefined;
-  /**
-   * Event types that should not be recorded
-   */
-  exclude?: AuditEventType[] | undefined;
-  /**
-   * Record `user_sign_in_failed` events for failed sign-in attempts, and
-   * `verification_failed` events for wrong one-time codes and tokens
-   *
-   * @default true
-   */
-  trackFailedSignIns?: boolean | undefined;
-  /**
-   * Roles allowed to read every audit event through
-   * `/audit-log/get-all-audit-logs`
-   *
-   * @default ["admin"]
-   */
-  adminRoles?: string[] | undefined;
-  /**
-   * Organization member roles allowed to read the events of their
-   * organization through `/audit-log/get-all-audit-logs`
-   *
-   * @default ["owner", "admin"]
-   */
-  organizationAdminRoles?: string[] | undefined;
-  /**
-   * Include failed sign-ins and security decisions made on a user's account
-   * before they were signed in in their own events. They are matched by the
-   * email that was typed, in lower case or as the user's email is stored, so
-   * anyone's attempt shows up; the IP address, user agent, visitor id and
-   * details are left out. Only the latest 50 events since the account was
-   * created are included.
-   *
-   * @default true
-   */
-  showAttemptsOnOwnAccount?: boolean | undefined;
-  /**
-   * Custom schema for the audit log plugin
-   */
-  schema?: InferOptionSchema<typeof schema> | undefined;
-}
-//#endregion
 //#region src/plugins/sentinel/schema.d.ts
 declare const schema$1: {
   sentinelCounter: {
@@ -2554,7 +2271,7 @@ interface SentinelOptions {
     resolveGeo?: ((ip: string) => GeoLocation | null | Promise<GeoLocation | null>) | undefined;
   } | undefined;
   /**
-   * Roles allowed to list and lift blocks through `/sentinel/blocks` and
+   * Roles allowed to list and lift blocks through `/sentinel/list-blocks` and
    * `/sentinel/unblock`
    *
    * @default ["admin"]
@@ -2891,14 +2608,6 @@ interface SentinelOptions {
   schema?: InferOptionSchema<typeof schema$1> | undefined;
 }
 //#endregion
-//#region src/plugins/sentinel/actions.d.ts
-declare const SENTINEL_ERROR_CODES: {
-  readonly POW_CHALLENGE_REQUIRED: "Challenge required";
-  readonly SECURITY_BLOCKED: "Request blocked for security reasons";
-  readonly SECURITY_ADMIN_REQUIRED: "Only an administrator can manage security blocks";
-  readonly BLOCK_NOT_FOUND: "That block doesn't exist or has ended";
-};
-//#endregion
 //#region src/plugins/sentinel/email.d.ts
 /**
  * Normalizes an email address so aliases of the same mailbox match:
@@ -2940,10 +2649,18 @@ declare function parsePowHeader(value: string | null | undefined): {
   value: string;
 } | null;
 //#endregion
+//#region src/plugins/sentinel/error-codes.d.ts
+declare const SENTINEL_ERROR_CODES: {
+  readonly POW_CHALLENGE_REQUIRED: "Challenge required";
+  readonly SECURITY_BLOCKED: "Request blocked for security reasons";
+  readonly SECURITY_ADMIN_REQUIRED: "Only an administrator can manage security blocks";
+  readonly BLOCK_NOT_FOUND: "That block doesn't exist or has ended";
+};
+//#endregion
 //#region src/plugins/sentinel/index.d.ts
 declare const sentinel: (options?: SentinelOptions | undefined) => {
   id: "sentinel";
-  init(ctx: AuthContext<_gatwech_core55.PayvoAuthOptions>): {
+  init(ctx: AuthContext<_gatwech_core57.PayvoAuthOptions>): {
     options: {
       databaseHooks: {
         user: {
@@ -2956,7 +2673,7 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core55.PayvoAuthOptions> | undefined): Promise<{
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core57.PayvoAuthOptions> | undefined): Promise<{
               data: {
                 normalizedEmail: string;
                 id: string;
@@ -2976,7 +2693,7 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core55.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: GenericEndpointContext<_gatwech_core57.PayvoAuthOptions> | undefined): Promise<void>;
           };
           update: {
             before(data: Partial<{
@@ -3004,28 +2721,28 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
       };
     };
   } | undefined;
-  onRequest(request: Request, ctx: AuthContext<_gatwech_core55.PayvoAuthOptions>): Promise<{
+  onRequest(request: Request, ctx: AuthContext<_gatwech_core57.PayvoAuthOptions>): Promise<{
     response: Response;
   } | undefined>;
   hooks: {
     before: ({
-      matcher(context: _gatwech_core55.HookEndpointContext): boolean;
-      handler: (inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<{
+      matcher(context: _gatwech_core57.HookEndpointContext): boolean;
+      handler: (inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<{
         context: {
           body: any;
         };
       } | undefined>;
     } | {
-      matcher(context: _gatwech_core55.HookEndpointContext): boolean;
-      handler: (inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core57.HookEndpointContext): boolean;
+      handler: (inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<void>;
     })[];
     after: ({
-      matcher(context: _gatwech_core55.HookEndpointContext): boolean;
-      handler: (inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core57.HookEndpointContext): boolean;
+      handler: (inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<void>;
     } | {
-      matcher(context: _gatwech_core55.HookEndpointContext): boolean;
-      handler: (inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<({
-        status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | better_call239.Status;
+      matcher(context: _gatwech_core57.HookEndpointContext): boolean;
+      handler: (inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<({
+        status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | better_call278.Status;
         body: ({
           message?: string;
           code?: string;
@@ -3196,7 +2913,7 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call239.Middleware[];
+        use?: better_call278.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -3235,7 +2952,7 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
       }>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -3267,12 +2984,72 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
             operationId: string;
             summary: string;
             description: string;
+            responses: {
+              200: {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        blocks: {
+                          type: string;
+                          items: {
+                            type: string;
+                            properties: {
+                              id: {
+                                type: string;
+                              };
+                              key: {
+                                type: string;
+                              };
+                              feature: {
+                                type: string;
+                              };
+                              kind: {
+                                type: string;
+                                enum: string[];
+                              };
+                              identifier: {
+                                type: string;
+                              };
+                              account: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              blockedUntil: {
+                                type: string;
+                                format: string;
+                              };
+                              createdAt: {
+                                type: string;
+                                format: string;
+                              };
+                            };
+                          };
+                        };
+                        total: {
+                          type: string;
+                        };
+                        limit: {
+                          type: string;
+                        };
+                        offset: {
+                          type: string;
+                        };
+                      };
+                      required: string[];
+                    };
+                  };
+                };
+              };
+            };
           };
         };
       } & {
         use: any[];
       };
-      path: "/sentinel/blocks";
+      path: "/sentinel/list-blocks";
     };
     unblock: {
       <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
@@ -3292,7 +3069,7 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call239.Middleware[];
+        use?: better_call278.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -3307,7 +3084,7 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
       }>;
       options: {
         method: "POST";
-        use: ((inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -3338,6 +3115,24 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
             operationId: string;
             summary: string;
             description: string;
+            responses: {
+              200: {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        success: {
+                          type: string;
+                        };
+                      };
+                      required: string[];
+                    };
+                  };
+                };
+              };
+            };
           };
         };
       } & {
@@ -3361,7 +3156,7 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call239.Middleware[];
+        use?: better_call278.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -3511,14 +3306,419 @@ declare const sentinel: (options?: SentinelOptions | undefined) => {
   };
 };
 //#endregion
-//#region src/plugins/audit-log/index.d.ts
+//#region src/plugins/audit-log/events.d.ts
+/**
+ * Audit event types recorded by the audit log plugin
+ */
+declare const AUDIT_EVENT_TYPES: {
+  readonly USER_SIGNED_UP: "user_signed_up";
+  readonly USER_PROFILE_UPDATED: "user_profile_updated";
+  readonly USER_PROFILE_IMAGE_UPDATED: "user_profile_image_updated";
+  readonly USER_EMAIL_VERIFIED: "user_email_verified";
+  readonly USER_BANNED: "user_banned";
+  readonly USER_UNBANNED: "user_unbanned";
+  readonly USER_DELETED: "user_deleted";
+  readonly USER_ROLE_UPDATED: "user_role_updated";
+  readonly USER_EMAIL_CHANGED: "user_email_changed";
+  readonly USER_PHONE_NUMBER_CHANGED: "user_phone_number_changed";
+  readonly USER_SIGNED_IN: "user_signed_in";
+  readonly USER_SIGNED_OUT: "user_signed_out";
+  readonly SESSION_CREATED: "session_created";
+  readonly SESSION_REVOKED: "session_revoked";
+  readonly SESSIONS_REVOKED_ALL: "sessions_revoked_all";
+  readonly USER_IMPERSONATED: "user_impersonated";
+  readonly USER_IMPERSONATION_STOPPED: "user_impersonation_stopped";
+  readonly DEVICE_AUTHORIZATION_APPROVED: "device_authorization_approved";
+  readonly DEVICE_AUTHORIZATION_DENIED: "device_authorization_denied";
+  readonly ACCOUNT_LINKED: "account_linked";
+  readonly ACCOUNT_UNLINKED: "account_unlinked";
+  readonly PASSWORD_CHANGED: "password_changed";
+  readonly TWO_FACTOR_ENABLED: "two_factor_enabled";
+  readonly TWO_FACTOR_DISABLED: "two_factor_disabled";
+  readonly BACKUP_CODES_GENERATED: "two_factor_backup_codes_generated";
+  readonly PASSKEY_ADDED: "passkey_added";
+  readonly PASSKEY_REMOVED: "passkey_removed";
+  readonly API_KEY_CREATED: "api_key_created";
+  readonly API_KEY_UPDATED: "api_key_updated";
+  readonly API_KEY_DELETED: "api_key_deleted";
+  readonly PASSWORD_RESET_REQUESTED: "password_reset_requested";
+  readonly PASSWORD_RESET_COMPLETED: "password_reset_completed";
+  readonly EMAIL_VERIFICATION_SENT: "email_verification_sent";
+  readonly ORGANIZATION_CREATED: "organization_created";
+  readonly ORGANIZATION_UPDATED: "organization_updated";
+  readonly ORGANIZATION_DELETED: "organization_deleted";
+  readonly ORGANIZATION_ROLE_CREATED: "organization_role_created";
+  readonly ORGANIZATION_ROLE_UPDATED: "organization_role_updated";
+  readonly ORGANIZATION_ROLE_DELETED: "organization_role_deleted";
+  readonly MEMBER_ADDED: "member_added";
+  readonly MEMBER_REMOVED: "member_removed";
+  readonly MEMBER_ROLE_UPDATED: "member_role_updated";
+  readonly MEMBER_INVITED: "member_invited";
+  readonly INVITE_ACCEPTED: "invite_accepted";
+  readonly INVITE_REJECTED: "invite_rejected";
+  readonly INVITE_CANCELLED: "invite_cancelled";
+  readonly TEAM_CREATED: "team_created";
+  readonly TEAM_UPDATED: "team_updated";
+  readonly TEAM_DELETED: "team_deleted";
+  readonly TEAM_MEMBER_ADDED: "team_member_added";
+  readonly TEAM_MEMBER_REMOVED: "team_member_removed";
+  readonly USER_SIGN_IN_FAILED: "user_sign_in_failed";
+  readonly VERIFICATION_FAILED: "verification_failed";
+  readonly AUDIT_READ: "audit_read";
+  readonly AUDIT_EVENTS_DELETED: "audit_events_deleted";
+};
+/**
+ * Security event types recorded by the sentinel plugin
+ *
+ * Declared here so both plugins share the same event types
+ */
+declare const SECURITY_EVENT_TYPES: {
+  readonly BLOCKED: "security_blocked";
+  readonly ALLOWED_AFTER_CHALLENGE: "security_allowed";
+  readonly CREDENTIAL_STUFFING: "security_credential_stuffing";
+  readonly IMPOSSIBLE_TRAVEL: "security_impossible_travel";
+  readonly GEO_BLOCKED: "security_geo_blocked";
+  readonly BOT_BLOCKED: "security_bot_blocked";
+  readonly SUSPICIOUS_IP: "security_suspicious_ip";
+  readonly VELOCITY_EXCEEDED: "security_velocity_exceeded";
+  readonly FREE_TRIAL_ABUSE: "security_free_trial_abuse";
+  readonly COMPROMISED_PASSWORD: "security_compromised_password";
+  readonly STALE_ACCOUNT: "security_stale_account";
+  readonly INVALID_EMAIL: "security_invalid_email";
+  readonly UNBLOCKED: "security_unblocked";
+};
+type AuditEventType = (typeof AUDIT_EVENT_TYPES)[keyof typeof AUDIT_EVENT_TYPES] | (typeof SECURITY_EVENT_TYPES)[keyof typeof SECURITY_EVENT_TYPES];
+declare const ALL_EVENT_TYPES: AuditEventType[];
+/**
+ * The events that can't be excluded: who signed in or out and who failed to,
+ * changes to credentials, roles, bans and sessions, impersonation, reads and
+ * deletions of the audit log itself, and every security decision.
+ */
+declare const CORE_EVENT_TYPES: ("user_signed_up" | "user_banned" | "user_unbanned" | "user_deleted" | "user_role_updated" | "user_email_changed" | "user_signed_in" | "user_signed_out" | "session_revoked" | "sessions_revoked_all" | "user_impersonated" | "user_impersonation_stopped" | "password_changed" | "two_factor_enabled" | "two_factor_disabled" | "password_reset_completed" | "user_sign_in_failed" | "verification_failed" | "audit_read" | "audit_events_deleted" | "security_blocked" | "security_allowed" | "security_credential_stuffing" | "security_impossible_travel" | "security_geo_blocked" | "security_bot_blocked" | "security_suspicious_ip" | "security_velocity_exceeded" | "security_free_trial_abuse" | "security_compromised_password" | "security_stale_account" | "security_invalid_email" | "security_unblocked")[];
+/** Endpoints that complete a sign-in by creating a session */
+declare const SIGN_IN_PATHS: string[];
+/** Sign-in endpoints that check credentials, so a failure is a failed attempt */
+declare const CREDENTIAL_SIGN_IN_PATHS: string[];
+/**
+ * Endpoints that check a one-time code or token outside a sign-in, so a
+ * failure is a failed attempt
+ */
+declare const VERIFICATION_PATHS: string[];
+/** Endpoints whose successful response maps to a single event */
+declare const PATH_EVENTS: Record<string, AuditEventType>;
+/**
+ * The severity of each event type that isn't `info`. A failed, blocked or
+ * challenged event is at least `warning`.
+ */
+declare const EVENT_SEVERITIES: Partial<Record<AuditEventType, "warning" | "critical">>;
+//#endregion
+//#region src/plugins/audit-log/schema.d.ts
+declare const schema: {
+  auditLog: {
+    fields: {
+      eventType: {
+        type: "string";
+        required: true;
+      };
+      userId: {
+        type: "string";
+        required: false;
+      };
+      identifier: {
+        type: "string";
+        required: false;
+      };
+      organizationId: {
+        type: "string";
+        required: false;
+      };
+      status: {
+        type: "string";
+        required: true;
+      };
+      path: {
+        type: "string";
+        required: false;
+      };
+      ipAddress: {
+        type: "string";
+        required: false;
+      };
+      userAgent: {
+        type: "string";
+        required: false;
+      };
+      visitorId: {
+        type: "string";
+        required: false;
+      };
+      eventData: {
+        type: "json";
+        required: false;
+      };
+      /** The request chain the event belongs to, shared with other services */
+      traceId: {
+        type: "string";
+        required: false;
+      };
+      /** The single request within the chain */
+      requestId: {
+        type: "string";
+        required: false;
+      };
+      /** `user`, `admin` or `system` */
+      actorType: {
+        type: "string";
+        required: false;
+      };
+      /** `info`, `warning` or `critical` */
+      severity: {
+        type: "string";
+        required: false;
+      };
+      /** `v1:<HMAC-SHA256>` of the event's fields, when signing is configured */
+      signature: {
+        type: "string";
+        required: false;
+      };
+      createdAt: {
+        type: "date";
+        required: true;
+      };
+    };
+  };
+};
+//#endregion
+//#region src/plugins/audit-log/types.d.ts
+interface AuditEvent {
+  id: string;
+  eventType: AuditEventType;
+  status: "success" | "failure" | "blocked" | "challenged";
+  /**
+   * The user who performed the action
+   *
+   * Null when the actor is unknown, e.g. a failed sign-in
+   */
+  userId: string | null;
+  /**
+   * The actor's identity, such as an email, username or phone number
+   */
+  identifier: string | null;
+  organizationId: string | null;
+  /**
+   * The endpoint that triggered the event
+   */
+  path: string | null;
+  ipAddress: string | null;
+  userAgent: string | null;
+  visitorId: string | null;
+  /**
+   * Additional details about the event
+   *
+   * Never contains passwords, tokens or OTPs
+   */
+  eventData: Record<string, unknown> | null;
+  /**
+   * The request chain the event belongs to, from the `Trace-Id` or
+   * `traceparent` header, or minted for the request. Other services
+   * record the same id, so their events can be joined with these.
+   *
+   * Null for events recorded outside a request.
+   */
+  traceId: string | null;
+  /**
+   * The single request within the chain, from the `Request-Id` header, or
+   * minted for the request
+   */
+  requestId: string | null;
+  /**
+   * Who acted: `user` for the signed-in or signing-in user, `admin` for an
+   * admin acting on someone else or impersonating them, `system` without a
+   * request
+   */
+  actorType: "user" | "admin" | "system";
+  /**
+   * How much the event matters, from the event type and its status
+   */
+  severity: "info" | "warning" | "critical";
+  /**
+   * `v1:<HMAC-SHA256>` over the event's other fields, which shows whether
+   * the row was changed after it was recorded (see `verifyAuditEvent`)
+   *
+   * Null when no signing secret was configured.
+   */
+  signature: string | null;
+  createdAt: Date;
+}
+interface AuditLogOptions {
+  /**
+   * Send events to the hosted backend, in addition to the `auditLog` table
+   *
+   * Enabled when an API key and URL are configured, either here or through
+   * `PAYVO_INFRA_API_KEY` and `PAYVO_INFRA_API_URL`. Set to `false` to
+   * disable it.
+   */
+  remote?: {
+    /**
+     * The hosted backend API URL
+     *
+     * @default process.env.PAYVO_INFRA_API_URL
+     */
+    apiUrl?: string | undefined;
+    /**
+     * The hosted backend API key
+     *
+     * @default process.env.PAYVO_INFRA_API_KEY
+     */
+    apiKey?: string | undefined;
+    /**
+     * Request timeout in milliseconds
+     *
+     * @default 3000
+     */
+    timeout?: number | undefined;
+    /**
+     * Additional headers sent with every request
+     */
+    headers?: Record<string, string> | undefined;
+    /**
+     * Configure how events are batched before they are sent
+     *
+     * @deprecated Ignored: each event is sent as it's recorded, in the
+     * background. Use `advanced.backgroundTasks` to keep serverless
+     * functions alive until it's sent.
+     */
+    batch?: {
+      /**
+       * Send buffered events once this many are queued
+       *
+       * @default 25
+       */
+      maxSize?: number | undefined;
+      /**
+       * Send buffered events after this many milliseconds
+       *
+       * @default 2000
+       */
+      flushIntervalMs?: number | undefined;
+    } | undefined;
+  } | false | undefined;
+  /**
+   * Called for every recorded event, e.g. to publish it to a message broker
+   *
+   * Errors are logged and ignored
+   */
+  onEvent?: ((event: AuditEvent) => void | Promise<void>) | undefined;
+  /**
+   * How long events are kept at least. Deleting events with
+   * `deleteOldEvents` refuses a period shorter than `minimumDays`, and
+   * every deletion is recorded as an `audit_events_deleted` event.
+   *
+   * `minimumDays` is a whole number of at least 1. The right value is a
+   * compliance decision, so set it to what your regulator requires.
+   *
+   * @default { minimumDays: 365 }
+   */
+  retention?: {
+    minimumDays?: number | undefined;
+  } | undefined;
+  /**
+   * Signs every event with HMAC-SHA256, so a row that is changed after it
+   * is recorded no longer verifies
+   *
+   * `secret` signs and verifies; `secrets` maps an older key version to its
+   * secret, so keys can be rotated without signing old rows again. Without
+   * a secret events aren't signed, and the plugin refuses to start when
+   * `NODE_ENV` is `production`.
+   *
+   * @default { secret: process.env.PAYVO_AUDIT_SIGNING_SECRET }
+   */
+  integrity?: {
+    secret?: string | undefined;
+    secrets?: Record<string, string> | undefined;
+  } | undefined;
+  /**
+   * Keys whose values are replaced with `"[REDACTED]"` in an event's
+   * `eventData`, at any depth, before it is stored or sent anywhere
+   *
+   * Passwords, tokens, one-time codes, secrets, authorization and cookie
+   * headers and card data are always redacted. Keys are compared in lower
+   * case, without `-` or `_`.
+   *
+   * @default []
+   */
+  sensitiveKeys?: string[] | undefined;
+  /**
+   * Event types that should not be recorded
+   *
+   * The events in `CORE_EVENT_TYPES` can't be excluded, and `auditLog`
+   * refuses to start when one is listed here. Events are always written to
+   * the `auditLog` table, whatever else `remote` and `onEvent` do with them.
+   */
+  exclude?: AuditEventType[] | undefined;
+  /**
+   * Roles allowed to read every audit event through
+   * `/audit-log/get-all-audit-logs`
+   *
+   * @default ["admin"]
+   */
+  adminRoles?: string[] | undefined;
+  /**
+   * Organization member roles allowed to read the events of their
+   * organization through `/audit-log/get-all-audit-logs`
+   *
+   * @default ["owner", "admin"]
+   */
+  organizationAdminRoles?: string[] | undefined;
+  /**
+   * Include failed sign-ins and security decisions made on a user's account
+   * before they were signed in in their own events. They are matched by the
+   * email that was typed, in lower case or as the user's email is stored, so
+   * anyone's attempt shows up; the IP address, user agent, visitor id and
+   * details are left out. Only the latest 50 events since the account was
+   * created are included.
+   *
+   * @default true
+   */
+  showAttemptsOnOwnAccount?: boolean | undefined;
+  /**
+   * Custom schema for the audit log plugin
+   */
+  schema?: InferOptionSchema<typeof schema> | undefined;
+}
+//#endregion
+//#region src/plugins/audit-log/error-codes.d.ts
 declare const AUDIT_LOG_ERROR_CODES: {
   readonly AUDIT_LOG_ACCESS_DENIED: "You don't have access to these audit logs";
+  readonly AUDIT_CANNOT_BE_DISABLED: "Core audit events and the local audit store can't be turned off";
   readonly AUDIT_LOG_UNAVAILABLE: "Audit logs are temporarily unavailable";
+  readonly AUDIT_RETENTION_TOO_SHORT: "Audit events can't be deleted before the retention minimum has passed";
+  readonly AUDIT_SIGNING_SECRET_MISSING: "Audit events must be signed in production: set integrity.secret or PAYVO_AUDIT_SIGNING_SECRET";
 };
+//#endregion
+//#region src/plugins/audit-log/integrity.d.ts
+/**
+ * Whether an event's signature matches its fields, so a row that was changed
+ * after it was recorded doesn't verify.
+ *
+ * `integrity.secret` verifies signatures made with the current key, and
+ * `integrity.secrets` maps an older version to its key, so keys can be
+ * rotated without signing old rows again. An event without a signature, or
+ * with a version that has no key, doesn't verify.
+ *
+ * @example
+ * ```ts
+ * const events = await auth.api.getAllAuditLogs({ headers });
+ * events.events.every((event) => event.verified);
+ * await verifyAuditEvent(event, { secret: process.env.PAYVO_AUDIT_SIGNING_SECRET });
+ * ```
+ */
+declare function verifyAuditEvent(event: AuditEvent, integrity: NonNullable<AuditLogOptions["integrity"]>): Promise<boolean>;
+//#endregion
+//#region src/plugins/audit-log/index.d.ts
 declare const auditLog: (options?: AuditLogOptions | undefined) => {
   id: "audit-log";
-  init(ctx: AuthContext<_gatwech_core55.PayvoAuthOptions>): {
+  init(ctx: AuthContext<_gatwech_core57.PayvoAuthOptions>): {
     options: {
       databaseHooks: {
         user: {
@@ -3531,7 +3731,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core55.GenericEndpointContext<_gatwech_core55.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: _gatwech_core57.GenericEndpointContext<_gatwech_core57.PayvoAuthOptions> | undefined): Promise<void>;
           };
           update: {
             after(user: {
@@ -3542,7 +3742,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core55.GenericEndpointContext<_gatwech_core55.PayvoAuthOptions> | undefined, data: (Partial<{
+            } & Record<string, unknown>, context: _gatwech_core57.GenericEndpointContext<_gatwech_core57.PayvoAuthOptions> | undefined, data: (Partial<{
               id: string;
               createdAt: Date;
               updatedAt: Date;
@@ -3561,7 +3761,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core55.GenericEndpointContext<_gatwech_core55.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: _gatwech_core57.GenericEndpointContext<_gatwech_core57.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
         session: {
@@ -3575,7 +3775,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               token: string;
               ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
-            } & Record<string, unknown>, context: _gatwech_core55.GenericEndpointContext<_gatwech_core55.PayvoAuthOptions> | undefined): Promise<void>;
+            } & Record<string, unknown>, context: _gatwech_core57.GenericEndpointContext<_gatwech_core57.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
         account: {
@@ -3594,7 +3794,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
               refreshTokenExpiresAt?: Date | null | undefined;
               scope?: string | null | undefined;
               password?: string | null | undefined;
-            }, context: _gatwech_core55.GenericEndpointContext<_gatwech_core55.PayvoAuthOptions> | undefined): Promise<void>;
+            }, context: _gatwech_core57.GenericEndpointContext<_gatwech_core57.PayvoAuthOptions> | undefined): Promise<void>;
           };
         };
       };
@@ -3602,12 +3802,12 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
   };
   hooks: {
     before: {
-      matcher(context: _gatwech_core55.HookEndpointContext): boolean;
-      handler: (inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core57.HookEndpointContext): boolean;
+      handler: (inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<void>;
     }[];
     after: {
-      matcher(context: _gatwech_core55.HookEndpointContext): boolean;
-      handler: (inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _gatwech_core57.HookEndpointContext): boolean;
+      handler: (inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<void>;
     }[];
   };
   endpoints: {
@@ -3622,6 +3822,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
           offset?: string | number | undefined;
           eventType?: string | undefined;
           identifier?: string | undefined;
+          traceId?: string | undefined;
           organizationId?: string | undefined;
           userId?: string | undefined;
           startDate?: string | undefined;
@@ -3636,7 +3837,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call239.Middleware[];
+        use?: better_call278.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -3657,7 +3858,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       }>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -3685,6 +3886,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
           offset: zod381.ZodOptional<zod381.ZodUnion<[zod381.ZodString, zod381.ZodNumber]>>;
           eventType: zod381.ZodOptional<zod381.ZodString>;
           identifier: zod381.ZodOptional<zod381.ZodString>;
+          traceId: zod381.ZodOptional<zod381.ZodString>;
           organizationId: zod381.ZodOptional<zod381.ZodString>;
           userId: zod381.ZodOptional<zod381.ZodString>;
           startDate: zod381.ZodOptional<zod381.ZodString>;
@@ -3749,6 +3951,30 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
                                 type: string;
                                 nullable: boolean;
                               };
+                              traceId: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              requestId: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              actorType: {
+                                type: string;
+                                enum: string[];
+                              };
+                              severity: {
+                                type: string;
+                                enum: string[];
+                              };
+                              signature: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              verified: {
+                                type: string;
+                                description: string;
+                              };
                               createdAt: {
                                 type: string;
                                 format: string;
@@ -3790,6 +4016,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
           offset?: string | number | undefined;
           eventType?: string | undefined;
           identifier?: string | undefined;
+          traceId?: string | undefined;
           organizationId?: string | undefined;
           userId?: string | undefined;
           startDate?: string | undefined;
@@ -3804,7 +4031,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call239.Middleware[];
+        use?: better_call278.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -3812,20 +4039,24 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       }) | undefined): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
         headers: Headers;
         response: {
-          events: AuditEvent[];
+          events: (AuditEvent & {
+            verified?: boolean | undefined;
+          })[];
           total: number;
           limit: number;
           offset: number;
         };
       } : {
-        events: AuditEvent[];
+        events: (AuditEvent & {
+          verified?: boolean | undefined;
+        })[];
         total: number;
         limit: number;
         offset: number;
       }>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -3853,6 +4084,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
           offset: zod381.ZodOptional<zod381.ZodUnion<[zod381.ZodString, zod381.ZodNumber]>>;
           eventType: zod381.ZodOptional<zod381.ZodString>;
           identifier: zod381.ZodOptional<zod381.ZodString>;
+          traceId: zod381.ZodOptional<zod381.ZodString>;
           organizationId: zod381.ZodOptional<zod381.ZodString>;
           userId: zod381.ZodOptional<zod381.ZodString>;
           startDate: zod381.ZodOptional<zod381.ZodString>;
@@ -3917,6 +4149,30 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
                                 type: string;
                                 nullable: boolean;
                               };
+                              traceId: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              requestId: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              actorType: {
+                                type: string;
+                                enum: string[];
+                              };
+                              severity: {
+                                type: string;
+                                enum: string[];
+                              };
+                              signature: {
+                                type: string;
+                                nullable: boolean;
+                              };
+                              verified: {
+                                type: string;
+                                description: string;
+                              };
                               createdAt: {
                                 type: string;
                                 format: string;
@@ -3963,7 +4219,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call239.Middleware[];
+        use?: better_call278.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -3978,7 +4234,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       }>;
       options: {
         method: "GET";
-        use: ((inputContext: better_call239.MiddlewareInputContext<better_call239.MiddlewareOptions>) => Promise<{
+        use: ((inputContext: better_call278.MiddlewareInputContext<better_call278.MiddlewareOptions>) => Promise<{
           session: {
             session: Record<string, any> & {
               id: string;
@@ -4052,7 +4308,7 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       } & {
         asResponse?: boolean;
         returnHeaders?: boolean;
-        use?: better_call239.Middleware[];
+        use?: better_call278.Middleware[];
         path?: string;
       } & {
         asResponse?: AsResponse | undefined;
@@ -4073,6 +4329,29 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
         metadata: {
           SERVER_ONLY: true;
           client: boolean;
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              200: {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        deleted: {
+                          type: string;
+                        };
+                      };
+                      required: string[];
+                    };
+                  };
+                };
+              };
+            };
+          };
         };
       } & {
         use: any[];
@@ -4123,6 +4402,26 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
           type: "json";
           required: false;
         };
+        traceId: {
+          type: "string";
+          required: false;
+        };
+        requestId: {
+          type: "string";
+          required: false;
+        };
+        actorType: {
+          type: "string";
+          required: false;
+        };
+        severity: {
+          type: "string";
+          required: false;
+        };
+        signature: {
+          type: "string";
+          required: false;
+        };
         createdAt: {
           type: "date";
           required: true;
@@ -4132,11 +4431,12 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
   };
   $ERROR_CODES: {
     readonly AUDIT_LOG_ACCESS_DENIED: "You don't have access to these audit logs";
+    readonly AUDIT_CANNOT_BE_DISABLED: "Core audit events and the local audit store can't be turned off";
     readonly AUDIT_LOG_UNAVAILABLE: "Audit logs are temporarily unavailable";
+    readonly AUDIT_RETENTION_TOO_SHORT: "Audit events can't be deleted before the retention minimum has passed";
+    readonly AUDIT_SIGNING_SECRET_MISSING: "Audit events must be signed in production: set integrity.secret or PAYVO_AUDIT_SIGNING_SECRET";
   };
   options: {
-    database: boolean;
-    trackFailedSignIns: boolean;
     adminRoles: string[];
     organizationAdminRoles: string[];
     showAttemptsOnOwnAccount: boolean;
@@ -4151,9 +4451,17 @@ declare const auditLog: (options?: AuditLogOptions | undefined) => {
       } | undefined;
     } | false | undefined;
     onEvent?: ((event: AuditEvent) => void | Promise<void>) | undefined;
+    retention?: {
+      minimumDays?: number | undefined;
+    } | undefined;
+    integrity?: {
+      secret?: string | undefined;
+      secrets?: Record<string, string> | undefined;
+    } | undefined;
+    sensitiveKeys?: string[] | undefined;
     exclude?: AuditEventType[] | undefined;
     schema?: InferOptionSchema<typeof schema> | undefined;
   };
 };
 //#endregion
-export { SECURITY_EVENT_TYPES as A, AuditEvent as C, AuditEventType as D, AUDIT_EVENT_TYPES as E, API_KEY_TABLE_NAME as F, ERROR_CODES as I, apiKey as L, VERIFICATION_PATHS as M, LastLoginMethodOptions as N, CREDENTIAL_SIGN_IN_PATHS as O, lastLoginMethod as P, defaultKeyHasher as R, SentinelOptions as S, ALL_EVENT_TYPES as T, haversineDistanceKm as _, createAuthEndpoint$1 as a, GeoLocation as b, sentinel as c, POW_SOLUTION_HEADER as d, createNonce as f, verifySolution as g, solveChallenge as h, AuthMiddleware as i, SIGN_IN_PATHS as j, PATH_EVENTS as k, POW_CHALLENGE_HEADER as l, parsePowHeader as m, auditLog as n, createAuthMiddleware$1 as o, hasLeadingZeroBits as p, AuthEndpoint as r, optionsMiddleware as s, AUDIT_LOG_ERROR_CODES as t, POW_REASON_HEADER as u, normalizeEmail as v, AuditLogOptions as w, SecurityAction as x, SENTINEL_ERROR_CODES as y };
+export { verifySolution as A, apiKey as B, POW_CHALLENGE_HEADER as C, hasLeadingZeroBits as D, createNonce as E, SentinelOptions as F, LastLoginMethodOptions as I, lastLoginMethod as L, normalizeEmail as M, GeoLocation as N, parsePowHeader as O, SecurityAction as P, API_KEY_TABLE_NAME as R, SENTINEL_ERROR_CODES as S, POW_SOLUTION_HEADER as T, defaultKeyHasher as V, AuthMiddleware as _, AuditLogOptions as a, optionsMiddleware as b, AuditEventType as c, EVENT_SEVERITIES as d, PATH_EVENTS as f, AuthEndpoint as g, VERIFICATION_PATHS as h, AuditEvent as i, haversineDistanceKm as j, solveChallenge as k, CORE_EVENT_TYPES as l, SIGN_IN_PATHS as m, verifyAuditEvent as n, ALL_EVENT_TYPES as o, SECURITY_EVENT_TYPES as p, AUDIT_LOG_ERROR_CODES as r, AUDIT_EVENT_TYPES as s, auditLog as t, CREDENTIAL_SIGN_IN_PATHS as u, createAuthEndpoint$1 as v, POW_REASON_HEADER as w, sentinel as x, createAuthMiddleware$1 as y, ERROR_CODES as z };