alepha 0.19.0 → 0.19.2

package/dist/api/users/index.d.ts

@@ -1,25 +1,26 @@
-import * as alepha from "alepha";
+import * as _$alepha from "alepha";
 import { Alepha, AlephaError, Page, PageQuery, Primitive, Static, StaticEncode, TNull, TObject, TOptional, TSchema, TUnion } from "alepha";
+import { AuditService, CreateAudit } from "alepha/api/audits";
+import * as _$alepha_bucket0 from "alepha/bucket";
 import { CryptoProvider, IssuerPrimitive, IssuerPrimitiveOptions, UserAccount } from "alepha/security";
-import * as alepha_server0 from "alepha/server";
-import * as alepha_orm0 from "alepha/orm";
+import * as _$alepha_server0 from "alepha/server";
+import * as _$alepha_orm0 from "alepha/orm";
 import { Page as Page$1, Repository } from "alepha/orm";
-import * as alepha_logger0 from "alepha/logger";
-import { AuditService, CreateAudit } from "alepha/api/audits";
-import * as alepha_server_links0 from "alepha/server/links";
-import * as alepha_api_notifications0 from "alepha/api/notifications";
+import * as _$alepha_logger0 from "alepha/logger";
+import * as _$alepha_server_links0 from "alepha/server/links";
+import * as _$alepha_api_notifications0 from "alepha/api/notifications";
 import { OAuth2Profile, ServerAuthProvider, WithLinkFn, WithLoginFn } from "alepha/server/auth";
-import * as alepha_cache0 from "alepha/cache";
+import * as _$alepha_cache0 from "alepha/cache";
+import { CacheProvider } from "alepha/cache";
 import { DateTime, DateTimeProvider } from "alepha/datetime";
+import * as _$alepha_api_jobs0 from "alepha/api/jobs";
 import { FileSystemProvider } from "alepha/system";
-import * as alepha_bucket0 from "alepha/bucket";
-import * as alepha_api_jobs0 from "alepha/api/jobs";
-import * as alepha_api_parameters0 from "alepha/api/parameters";
+import { ParameterPrimitive } from "alepha/api/parameters";
 import { VerificationController } from "alepha/api/verifications";
-import * as typebox from "typebox";
-import * as drizzle_orm0 from "drizzle-orm";
+import * as _$typebox from "typebox";
+import * as _$drizzle_orm0 from "drizzle-orm";
 import { BuildExtraConfigColumns, SQL, SQLWrapper } from "drizzle-orm";
-import * as drizzle_orm_pg_core0 from "drizzle-orm/pg-core";
+import * as _$drizzle_orm_pg_core0 from "drizzle-orm/pg-core";
 import { LockConfig, LockStrength, PgColumn, PgColumnBuilderBase, PgDatabase, PgInsertValue, PgSelectBase, PgSequenceOptions, PgTableExtraConfigValue, PgTableWithColumns, PgTransaction, UpdateDeleteAction } from "drizzle-orm/pg-core";
 import { PgTransactionConfig } from "drizzle-orm/pg-core/session";
 import { LibSQLDatabase } from "drizzle-orm/libsql";
@@ -39,27 +40,32 @@ import { FileController } from "alepha/api/files";
  * - `"required"`: Field is shown and required.
  */
 type FieldRequirement = "none" | "optional" | "required";
-declare const realmAuthSettingsAtom: alepha.Atom<alepha.TObject<{
-  displayName: alepha.TOptional<alepha.TString>;
-  description: alepha.TOptional<alepha.TString>;
-  logoUrl: alepha.TOptional<alepha.TString>;
-  registrationAllowed: alepha.TBoolean;
-  email: alepha.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-  username: alepha.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-  usernameRegExp: alepha.TString;
-  phoneNumber: alepha.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-  verifyEmailRequired: alepha.TBoolean;
-  verifyPhoneRequired: alepha.TBoolean;
-  firstNameLastName: alepha.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-  resetPasswordAllowed: alepha.TBoolean;
-  adminEmails: alepha.TArray<alepha.TString>;
-  adminUsernames: alepha.TArray<alepha.TString>;
-  passwordPolicy: alepha.TObject<{
-    minLength: alepha.TInteger;
-    requireUppercase: alepha.TBoolean;
-    requireLowercase: alepha.TBoolean;
-    requireNumbers: alepha.TBoolean;
-    requireSpecialCharacters: alepha.TBoolean;
+declare const realmAuthSettingsAtom: _$alepha.Atom<_$alepha.TObject<{
+  displayName: _$alepha.TOptional<_$alepha.TString>;
+  description: _$alepha.TOptional<_$alepha.TString>;
+  logoUrl: _$alepha.TOptional<_$alepha.TString>;
+  registrationAllowed: _$alepha.TBoolean;
+  email: _$alepha.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
+  username: _$alepha.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
+  usernameRegExp: _$alepha.TString;
+  phoneNumber: _$alepha.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
+  verifyEmailRequired: _$alepha.TBoolean;
+  verifyPhoneRequired: _$alepha.TBoolean;
+  firstNameLastName: _$alepha.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
+  resetPasswordAllowed: _$alepha.TBoolean;
+  adminEmails: _$alepha.TArray<_$alepha.TString>;
+  adminUsernames: _$alepha.TArray<_$alepha.TString>;
+  passwordPolicy: _$alepha.TObject<{
+    minLength: _$alepha.TInteger;
+    requireUppercase: _$alepha.TBoolean;
+    requireLowercase: _$alepha.TBoolean;
+    requireNumbers: _$alepha.TBoolean;
+    requireSpecialCharacters: _$alepha.TBoolean;
+  }>;
+  loginRateLimit: _$alepha.TObject<{
+    ipMaxAttempts: _$alepha.TInteger;
+    accountMaxAttempts: _$alepha.TInteger;
+    windowMs: _$alepha.TInteger;
   }>;
 }>, "alepha.api.users.realmAuthSettings">;
 type RealmAuthSettings = Static<typeof realmAuthSettingsAtom.schema>;
@@ -144,6 +150,36 @@ interface EntityPrimitiveOptions<T extends TObject, Keys = keyof Static<T>> {
      * Partial index condition. Only rows matching this SQL expression are indexed.
      */
     where?: SQL;
+  } | {
+    /**
+     * SQL expressions for expression-based indexes.
+     *
+     * Can include column references and SQL functions like `LOWER()`, `UPPER()`, etc.
+     * Columns and expressions can be mixed together.
+     *
+     * @example
+     * ```ts
+     * // Case-insensitive unique username per realm
+     * indexes: [{
+     *   expressions: (self) => [self.realm, sql`LOWER(${self.username})`],
+     *   unique: true,
+     *   name: "users_realm_username_lower_idx",
+     * }]
+     * ```
+     */
+    expressions: (self: Record<Keys & string, any>) => (SQL | any)[];
+    /**
+     * Whether this should be a unique index (enforces uniqueness constraint).
+     */
+    unique?: boolean;
+    /**
+     * Custom name for the index. If not provided, generates name automatically.
+     */
+    name: string;
+    /**
+     * Partial index condition. Only rows matching this SQL expression are indexed.
+     */
+    where?: SQL;
   })[];
   /**
    * Foreign key constraints to maintain referential integrity.
@@ -254,6 +290,7 @@ declare const PG_IDENTITY: unique symbol;
 declare const PG_ENUM: unique symbol;
 declare const PG_REF: unique symbol;
 declare const PG_GENERATED: unique symbol;
+declare const PG_ORGANIZATION: unique symbol;
 /**
  * @deprecated Use `PG_IDENTITY` instead.
  */
@@ -269,6 +306,7 @@ type PgSymbols = {
   [PG_REF]: PgRefOptions;
   [PG_ENUM]: PgEnumOptions;
   [PG_GENERATED]: PgGeneratedOptions;
+  [PG_ORGANIZATION]: {};
   /**
    * @deprecated Use `PG_IDENTITY` instead.
    */
@@ -1085,7 +1123,7 @@ declare abstract class ModelBuilder {
   protected buildTableConfig<TConfig, TSelf>(entity: EntityPrimitive, builders: TableConfigBuilders<TConfig>, tableResolver?: (entityName: string) => any, customConfigHandler?: (config: any, self: TSelf) => TConfig[]): ((self: TSelf) => TConfig[]) | undefined;
 }
 //#endregion
-//#region ../../../../node_modules/@electric-sql/pglite/dist/pglite-SIPwY9Cm.d.ts
+//#region ../../../../node_modules/@electric-sql/pglite/dist/pglite-BdaQNAoW.d.ts
 type MessageName = 'parseComplete' | 'bindComplete' | 'closeComplete' | 'noData' | 'portalSuspended' | 'replicationStart' | 'emptyQuery' | 'copyDone' | 'copyData' | 'rowDescription' | 'parameterDescription' | 'parameterStatus' | 'backendKeyData' | 'notification' | 'readyForQuery' | 'commandComplete' | 'dataRow' | 'copyInResponse' | 'copyOutResponse' | 'authenticationOk' | 'authenticationMD5Password' | 'authenticationCleartextPassword' | 'authenticationSASL' | 'authenticationSASLContinue' | 'authenticationSASLFinal' | 'error' | 'notice';
 type BackendMessage = {
   name: MessageName;
@@ -1280,7 +1318,8 @@ interface PGliteOptions<TExtensions extends Extensions = Extensions> {
   extensions?: TExtensions;
   loadDataDir?: Blob | File;
   initialMemory?: number;
-  wasmModule?: WebAssembly.Module;
+  pgliteWasmModule?: WebAssembly.Module;
+  initdbWasmModule?: WebAssembly.Module;
   fsBundle?: Blob | File;
   parsers?: ParserOptions;
   serializers?: SerializerOptions;
@@ -5949,7 +5988,7 @@ declare const upPgSnapshot: (snapshot: Record<string, unknown>) => {
 //#endregion
 //#region ../../src/orm/core/providers/DrizzleKitProvider.d.ts
 declare class DrizzleKitProvider {
-  protected readonly log: alepha_logger0.Logger;
+  protected readonly log: _$alepha_logger0.Logger;
   protected readonly dateTime: DateTimeProvider;
   protected readonly alepha: Alepha;
   /**
@@ -6052,7 +6091,7 @@ type SQLLike = SQLWrapper | string;
 declare abstract class DatabaseProvider {
   protected readonly alepha: Alepha;
   protected readonly dateTime: DateTimeProvider;
-  protected readonly log: alepha_logger0.Logger;
+  protected readonly log: _$alepha_logger0.Logger;
   protected abstract readonly builder: ModelBuilder;
   protected readonly kit: DrizzleKitProvider;
   abstract readonly db: PgDatabase<any>;
@@ -6210,7 +6249,7 @@ declare class QueryManager {
   createPagination<T>(entities: T[], limit?: number, offset?: number, sort?: Array<{
     column: string;
     direction: "asc" | "desc";
-  }>): alepha.Page<T>;
+  }>): _$alepha.Page<T>;
 }
 interface PgJoin {
   table: string;
@@ -6244,7 +6283,7 @@ declare class PgRelationManager {
 declare abstract class Repository$1<T extends TObject> {
   readonly entity: EntityPrimitive<T>;
   readonly provider: DatabaseProvider;
-  protected readonly log: alepha_logger0.Logger;
+  protected readonly log: _$alepha_logger0.Logger;
   protected readonly relationManager: PgRelationManager;
   protected readonly queryManager: QueryManager;
   protected readonly dateTimeProvider: DateTimeProvider;
@@ -6322,15 +6361,15 @@ declare abstract class Repository$1<T extends TObject> {
   /**
    * Start a SELECT query on the table.
    */
-  protected rawSelect(opts?: StatementOptions): drizzle_orm_pg_core0.PgSelectBase<string, Record<string, PgColumn<drizzle_orm0.ColumnBaseConfig<drizzle_orm0.ColumnDataType, string>, {}, {}>>, "single", Record<string, "not-null">, false, never, {
+  protected rawSelect(opts?: StatementOptions): _$drizzle_orm_pg_core0.PgSelectBase<string, Record<string, PgColumn<_$drizzle_orm0.ColumnBaseConfig<_$drizzle_orm0.ColumnDataType, string>, {}, {}>>, "single", Record<string, "not-null">, false, never, {
     [x: string]: unknown;
   }[], {
-    [x: string]: PgColumn<drizzle_orm0.ColumnBaseConfig<drizzle_orm0.ColumnDataType, string>, {}, {}>;
+    [x: string]: PgColumn<_$drizzle_orm0.ColumnBaseConfig<_$drizzle_orm0.ColumnDataType, string>, {}, {}>;
   }>;
   /**
    * Start a SELECT DISTINCT query on the table.
    */
-  protected rawSelectDistinct(opts?: StatementOptions, columns?: (keyof Static<T>)[]): drizzle_orm_pg_core0.PgSelectBase<string, Record<string, any>, "partial", Record<string, "not-null">, false, never, {
+  protected rawSelectDistinct(opts?: StatementOptions, columns?: (keyof Static<T>)[]): _$drizzle_orm_pg_core0.PgSelectBase<string, Record<string, any>, "partial", Record<string, "not-null">, false, never, {
     [x: string]: any;
   }[], {
     [x: string]: any;
@@ -6338,15 +6377,15 @@ declare abstract class Repository$1<T extends TObject> {
   /**
    * Start an INSERT query on the table.
    */
-  protected rawInsert(opts?: StatementOptions): drizzle_orm_pg_core0.PgInsertBuilder<PgTableWithColumns<SchemaToTableConfig<T>>, any, false>;
+  protected rawInsert(opts?: StatementOptions): _$drizzle_orm_pg_core0.PgInsertBuilder<PgTableWithColumns<SchemaToTableConfig<T>>, any, false>;
   /**
    * Start an UPDATE query on the table.
    */
-  protected rawUpdate(opts?: StatementOptions): drizzle_orm_pg_core0.PgUpdateBuilder<PgTableWithColumns<SchemaToTableConfig<T>>, any>;
+  protected rawUpdate(opts?: StatementOptions): _$drizzle_orm_pg_core0.PgUpdateBuilder<PgTableWithColumns<SchemaToTableConfig<T>>, any>;
   /**
    * Start a DELETE query on the table.
    */
-  protected rawDelete(opts?: StatementOptions): drizzle_orm_pg_core0.PgDeleteBase<PgTableWithColumns<SchemaToTableConfig<T>>, any, undefined, undefined, false, never>;
+  protected rawDelete(opts?: StatementOptions): _$drizzle_orm_pg_core0.PgDeleteBase<PgTableWithColumns<SchemaToTableConfig<T>>, any, undefined, undefined, false, never>;
   /**
    * Create a Drizzle `select` query based on a JSON query object.
    *
@@ -6535,6 +6574,9 @@ declare abstract class Repository$1<T extends TObject> {
     force?: boolean;
   }): PgQueryWhereOrSQL<T>;
   protected deletedAt(): PgAttrField | undefined;
+  protected withOrganization(where: PgQueryWhereOrSQL<T>): PgQueryWhereOrSQL<T>;
+  protected stampOrganization(data: any): void;
+  protected organizationField(): PgAttrField | undefined;
   /**
    * Convert something to valid Pg Insert Value.
    */
@@ -6575,7 +6617,7 @@ declare abstract class Repository$1<T extends TObject> {
    */
   protected getPrimaryKey(schema: TObject): {
     key: string;
-    col: PgColumn<drizzle_orm0.ColumnBaseConfig<drizzle_orm0.ColumnDataType, string>, {}, {}>;
+    col: PgColumn<_$drizzle_orm0.ColumnBaseConfig<_$drizzle_orm0.ColumnDataType, string>, {}, {}>;
     type: TSchema;
   };
 }
@@ -6644,8 +6686,8 @@ type WithSQL<T> = { [P in keyof T]?: T[P] | SQL };
  * - `d1://BINDING_NAME` — Cloudflare D1
  * - `hyperdrive://BINDING_NAME` — Cloudflare Hyperdrive
  */
-declare const databaseEnvSchema: alepha.TObject<{
-  DATABASE_URL: alepha.TOptional<alepha.TString>;
+declare const databaseEnvSchema: _$alepha.TObject<{
+  DATABASE_URL: _$alepha.TOptional<_$alepha.TString>;
   /**
    * Enable or disable push-based schema synchronization (drizzle-kit push).
    *
@@ -6653,7 +6695,7 @@ declare const databaseEnvSchema: alepha.TObject<{
    * Set to `false` in development to skip automatic schema sync
    * (e.g. when managing migrations manually).
    */
-  DATABASE_SYNC: alepha.TOptional<alepha.TBoolean>;
+  DATABASE_SYNC: _$alepha.TOptional<_$alepha.TBoolean>;
 }>;
 declare module "alepha" {
   interface Env extends Partial<Static<typeof databaseEnvSchema>> {}
@@ -6679,26 +6721,26 @@ declare class UserAudits {
     userEmail?: string | undefined;
     resourceType?: string | undefined;
     resourceId?: string | undefined;
-    metadata?: typebox.StaticRecord<[], "Decode", {}, {
-      id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      type: alepha.TString;
-      action: alepha.TString;
-      severity: PgAttr<alepha.TUnsafe<"info" | "warning" | "critical">, typeof PG_DEFAULT>;
-      userId: alepha.TOptional<alepha.TString>;
-      userRealm: alepha.TOptional<alepha.TString>;
-      userEmail: alepha.TOptional<alepha.TString>;
-      resourceType: alepha.TOptional<alepha.TString>;
-      resourceId: alepha.TOptional<alepha.TString>;
-      description: alepha.TOptional<alepha.TString>;
-      metadata: alepha.TOptional<alepha.TRecord<string, alepha.TAny>>;
-      ipAddress: alepha.TOptional<alepha.TString>;
-      userAgent: alepha.TOptional<alepha.TString>;
-      sessionId: alepha.TOptional<alepha.TString>;
-      requestId: alepha.TOptional<alepha.TString>;
-      success: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
-      errorMessage: alepha.TOptional<alepha.TString>;
-    }, string, alepha.TAny> | undefined;
+    metadata?: _$typebox.StaticRecord<[], "Decode", {}, {
+      id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      type: _$alepha.TString;
+      action: _$alepha.TString;
+      severity: PgAttr<_$alepha.TUnsafe<"info" | "warning" | "critical">, typeof PG_DEFAULT>;
+      userId: _$alepha.TOptional<_$alepha.TString>;
+      userRealm: _$alepha.TOptional<_$alepha.TString>;
+      userEmail: _$alepha.TOptional<_$alepha.TString>;
+      resourceType: _$alepha.TOptional<_$alepha.TString>;
+      resourceId: _$alepha.TOptional<_$alepha.TString>;
+      description: _$alepha.TOptional<_$alepha.TString>;
+      metadata: _$alepha.TOptional<_$alepha.TRecord<string, _$alepha.TAny>>;
+      ipAddress: _$alepha.TOptional<_$alepha.TString>;
+      userAgent: _$alepha.TOptional<_$alepha.TString>;
+      sessionId: _$alepha.TOptional<_$alepha.TString>;
+      requestId: _$alepha.TOptional<_$alepha.TString>;
+      success: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      errorMessage: _$alepha.TOptional<_$alepha.TString>;
+    }, string, _$alepha.TAny> | undefined;
     ipAddress?: string | undefined;
     userAgent?: string | undefined;
     sessionId?: string | undefined;
@@ -6721,26 +6763,26 @@ declare class UserAudits {
     userEmail?: string | undefined;
     resourceType?: string | undefined;
     resourceId?: string | undefined;
-    metadata?: typebox.StaticRecord<[], "Decode", {}, {
-      id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      type: alepha.TString;
-      action: alepha.TString;
-      severity: PgAttr<alepha.TUnsafe<"info" | "warning" | "critical">, typeof PG_DEFAULT>;
-      userId: alepha.TOptional<alepha.TString>;
-      userRealm: alepha.TOptional<alepha.TString>;
-      userEmail: alepha.TOptional<alepha.TString>;
-      resourceType: alepha.TOptional<alepha.TString>;
-      resourceId: alepha.TOptional<alepha.TString>;
-      description: alepha.TOptional<alepha.TString>;
-      metadata: alepha.TOptional<alepha.TRecord<string, alepha.TAny>>;
-      ipAddress: alepha.TOptional<alepha.TString>;
-      userAgent: alepha.TOptional<alepha.TString>;
-      sessionId: alepha.TOptional<alepha.TString>;
-      requestId: alepha.TOptional<alepha.TString>;
-      success: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
-      errorMessage: alepha.TOptional<alepha.TString>;
-    }, string, alepha.TAny> | undefined;
+    metadata?: _$typebox.StaticRecord<[], "Decode", {}, {
+      id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      type: _$alepha.TString;
+      action: _$alepha.TString;
+      severity: PgAttr<_$alepha.TUnsafe<"info" | "warning" | "critical">, typeof PG_DEFAULT>;
+      userId: _$alepha.TOptional<_$alepha.TString>;
+      userRealm: _$alepha.TOptional<_$alepha.TString>;
+      userEmail: _$alepha.TOptional<_$alepha.TString>;
+      resourceType: _$alepha.TOptional<_$alepha.TString>;
+      resourceId: _$alepha.TOptional<_$alepha.TString>;
+      description: _$alepha.TOptional<_$alepha.TString>;
+      metadata: _$alepha.TOptional<_$alepha.TRecord<string, _$alepha.TAny>>;
+      ipAddress: _$alepha.TOptional<_$alepha.TString>;
+      userAgent: _$alepha.TOptional<_$alepha.TString>;
+      sessionId: _$alepha.TOptional<_$alepha.TString>;
+      requestId: _$alepha.TOptional<_$alepha.TString>;
+      success: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      errorMessage: _$alepha.TOptional<_$alepha.TString>;
+    }, string, _$alepha.TAny> | undefined;
     ipAddress?: string | undefined;
     userAgent?: string | undefined;
     sessionId?: string | undefined;
@@ -6763,26 +6805,26 @@ declare class UserAudits {
     userEmail?: string | undefined;
     resourceType?: string | undefined;
     resourceId?: string | undefined;
-    metadata?: typebox.StaticRecord<[], "Decode", {}, {
-      id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      type: alepha.TString;
-      action: alepha.TString;
-      severity: PgAttr<alepha.TUnsafe<"info" | "warning" | "critical">, typeof PG_DEFAULT>;
-      userId: alepha.TOptional<alepha.TString>;
-      userRealm: alepha.TOptional<alepha.TString>;
-      userEmail: alepha.TOptional<alepha.TString>;
-      resourceType: alepha.TOptional<alepha.TString>;
-      resourceId: alepha.TOptional<alepha.TString>;
-      description: alepha.TOptional<alepha.TString>;
-      metadata: alepha.TOptional<alepha.TRecord<string, alepha.TAny>>;
-      ipAddress: alepha.TOptional<alepha.TString>;
-      userAgent: alepha.TOptional<alepha.TString>;
-      sessionId: alepha.TOptional<alepha.TString>;
-      requestId: alepha.TOptional<alepha.TString>;
-      success: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
-      errorMessage: alepha.TOptional<alepha.TString>;
-    }, string, alepha.TAny> | undefined;
+    metadata?: _$typebox.StaticRecord<[], "Decode", {}, {
+      id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      type: _$alepha.TString;
+      action: _$alepha.TString;
+      severity: PgAttr<_$alepha.TUnsafe<"info" | "warning" | "critical">, typeof PG_DEFAULT>;
+      userId: _$alepha.TOptional<_$alepha.TString>;
+      userRealm: _$alepha.TOptional<_$alepha.TString>;
+      userEmail: _$alepha.TOptional<_$alepha.TString>;
+      resourceType: _$alepha.TOptional<_$alepha.TString>;
+      resourceId: _$alepha.TOptional<_$alepha.TString>;
+      description: _$alepha.TOptional<_$alepha.TString>;
+      metadata: _$alepha.TOptional<_$alepha.TRecord<string, _$alepha.TAny>>;
+      ipAddress: _$alepha.TOptional<_$alepha.TString>;
+      userAgent: _$alepha.TOptional<_$alepha.TString>;
+      sessionId: _$alepha.TOptional<_$alepha.TString>;
+      requestId: _$alepha.TOptional<_$alepha.TString>;
+      success: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      errorMessage: _$alepha.TOptional<_$alepha.TString>;
+    }, string, _$alepha.TAny> | undefined;
     ipAddress?: string | undefined;
     userAgent?: string | undefined;
     sessionId?: string | undefined;
@@ -6810,58 +6852,59 @@ declare class UserBuckets {
   /**
    * Bucket for user avatar storage.
    */
-  readonly avatars: alepha_bucket0.BucketPrimitive;
+  readonly avatars: _$alepha_bucket0.BucketPrimitive;
 }
 //#endregion
 //#region ../../src/api/users/entities/identities.d.ts
-declare const identities: alepha_orm0.EntityPrimitive<alepha.TObject<{
-  id: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_PRIMARY_KEY>, typeof alepha_orm0.PG_DEFAULT>;
-  version: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TInteger, typeof alepha_orm0.PG_VERSION>, typeof alepha_orm0.PG_DEFAULT>;
-  createdAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_CREATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-  updatedAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_UPDATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-  userId: alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_REF>;
-  password: alepha.TOptional<alepha.TString>;
-  provider: alepha.TString;
-  providerUserId: alepha.TOptional<alepha.TString>;
-  providerData: alepha.TOptional<alepha.TRecord<string, alepha.TAny>>;
+declare const identities: _$alepha_orm0.EntityPrimitive<_$alepha.TObject<{
+  id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
+  version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
+  createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+  updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+  userId: _$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_REF>;
+  password: _$alepha.TOptional<_$alepha.TString>;
+  provider: _$alepha.TString;
+  providerUserId: _$alepha.TOptional<_$alepha.TString>;
+  providerData: _$alepha.TOptional<_$alepha.TRecord<string, _$alepha.TAny>>;
 }>>;
 type IdentityEntity = Static<typeof identities.schema>;
 //#endregion
 //#region ../../src/api/users/entities/sessions.d.ts
-declare const sessions: alepha_orm0.EntityPrimitive<alepha.TObject<{
-  id: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_PRIMARY_KEY>, typeof alepha_orm0.PG_DEFAULT>;
-  version: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TInteger, typeof alepha_orm0.PG_VERSION>, typeof alepha_orm0.PG_DEFAULT>;
-  createdAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_CREATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-  updatedAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_UPDATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-  refreshToken: alepha.TString;
-  userId: alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_REF>;
-  expiresAt: alepha.TString;
-  ip: alepha.TOptional<alepha.TString>;
-  userAgent: alepha.TOptional<alepha.TObject<{
-    os: alepha.TString;
-    browser: alepha.TString;
-    device: alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+declare const sessions: _$alepha_orm0.EntityPrimitive<_$alepha.TObject<{
+  id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
+  version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
+  createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+  updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+  refreshToken: _$alepha.TString;
+  userId: _$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_REF>;
+  expiresAt: _$alepha.TString;
+  ip: _$alepha.TOptional<_$alepha.TString>;
+  userAgent: _$alepha.TOptional<_$alepha.TObject<{
+    os: _$alepha.TString;
+    browser: _$alepha.TString;
+    device: _$alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
   }>>;
 }>>;
 type SessionEntity = Static<typeof sessions.schema>;
 //#endregion
 //#region ../../src/api/users/entities/users.d.ts
 declare const DEFAULT_USER_REALM_NAME = "default";
-declare const users: alepha_orm0.EntityPrimitive<alepha.TObject<{
-  id: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_PRIMARY_KEY>, typeof alepha_orm0.PG_DEFAULT>;
-  version: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TInteger, typeof alepha_orm0.PG_VERSION>, typeof alepha_orm0.PG_DEFAULT>;
-  createdAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_CREATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-  updatedAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_UPDATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-  realm: alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_DEFAULT>;
-  username: alepha.TOptional<alepha.TString>;
-  email: alepha.TOptional<alepha.TString>;
-  phoneNumber: alepha.TOptional<alepha.TString>;
-  roles: alepha_orm0.PgAttr<alepha.TArray<alepha.TString>, typeof alepha_orm0.PG_DEFAULT>;
-  firstName: alepha.TOptional<alepha.TString>;
-  lastName: alepha.TOptional<alepha.TString>;
-  picture: alepha.TOptional<alepha.TString>;
-  enabled: alepha_orm0.PgAttr<alepha.TBoolean, typeof alepha_orm0.PG_DEFAULT>;
-  emailVerified: alepha_orm0.PgAttr<alepha.TBoolean, typeof alepha_orm0.PG_DEFAULT>;
+declare const users: _$alepha_orm0.EntityPrimitive<_$alepha.TObject<{
+  id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
+  version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
+  createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+  updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+  realm: _$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_DEFAULT>;
+  username: _$alepha.TOptional<_$alepha.TString>;
+  email: _$alepha.TOptional<_$alepha.TString>;
+  phoneNumber: _$alepha.TOptional<_$alepha.TString>;
+  roles: _$alepha_orm0.PgAttr<_$alepha.TArray<_$alepha.TString>, typeof _$alepha_orm0.PG_DEFAULT>;
+  firstName: _$alepha.TOptional<_$alepha.TString>;
+  lastName: _$alepha.TOptional<_$alepha.TString>;
+  picture: _$alepha.TOptional<_$alepha.TString>;
+  enabled: _$alepha_orm0.PgAttr<_$alepha.TBoolean, typeof _$alepha_orm0.PG_DEFAULT>;
+  emailVerified: _$alepha_orm0.PgAttr<_$alepha.TBoolean, typeof _$alepha_orm0.PG_DEFAULT>;
+  organizationId: _$alepha_orm0.PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof _$alepha_orm0.PG_ORGANIZATION>;
 }>>;
 type UserEntity = Static<typeof users.schema>;
 //#endregion
@@ -6883,11 +6926,13 @@ type RealmPrimitive = IssuerPrimitive & WithLinkFn & WithLoginFn;
 declare const $realm: (options?: RealmOptions) => RealmPrimitive;
 interface RealmFeatures {
   /**
-   * Enable session purge functionality for cleaning up expired sessions.
+   * Will enable Job module.
+   *
+   * - Enable session purge functionality for cleaning up expired sessions.
    *
    * @default false
    */
-  sessionPurge?: boolean;
+  jobs?: boolean;
   /**
    * Enable notification system for password reset, verification emails, etc.
    *
@@ -6977,50 +7022,53 @@ interface Realm {
   repositories: RealmRepositories;
   settings: RealmAuthSettings;
   features: RealmFeatures;
+  settingsParameter?: ParameterPrimitive<typeof realmAuthSettingsAtom.schema>;
+  getSettings(): Promise<RealmAuthSettings>;
 }
 declare class RealmProvider {
   protected readonly alepha: Alepha;
-  protected readonly defaultIdentities: Repository<alepha.TObject<{
-    id: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_PRIMARY_KEY>, typeof alepha_orm0.PG_DEFAULT>;
-    version: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TInteger, typeof alepha_orm0.PG_VERSION>, typeof alepha_orm0.PG_DEFAULT>;
-    createdAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_CREATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-    updatedAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_UPDATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-    userId: alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_REF>;
-    password: alepha.TOptional<alepha.TString>;
-    provider: alepha.TString;
-    providerUserId: alepha.TOptional<alepha.TString>;
-    providerData: alepha.TOptional<alepha.TRecord<string, alepha.TAny>>;
+  protected readonly defaultIdentities: Repository<_$alepha.TObject<{
+    id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
+    version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
+    createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    userId: _$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_REF>;
+    password: _$alepha.TOptional<_$alepha.TString>;
+    provider: _$alepha.TString;
+    providerUserId: _$alepha.TOptional<_$alepha.TString>;
+    providerData: _$alepha.TOptional<_$alepha.TRecord<string, _$alepha.TAny>>;
   }>>;
-  protected readonly defaultSessions: Repository<alepha.TObject<{
-    id: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_PRIMARY_KEY>, typeof alepha_orm0.PG_DEFAULT>;
-    version: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TInteger, typeof alepha_orm0.PG_VERSION>, typeof alepha_orm0.PG_DEFAULT>;
-    createdAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_CREATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-    updatedAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_UPDATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-    refreshToken: alepha.TString;
-    userId: alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_REF>;
-    expiresAt: alepha.TString;
-    ip: alepha.TOptional<alepha.TString>;
-    userAgent: alepha.TOptional<alepha.TObject<{
-      os: alepha.TString;
-      browser: alepha.TString;
-      device: alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  protected readonly defaultSessions: Repository<_$alepha.TObject<{
+    id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
+    version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
+    createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    refreshToken: _$alepha.TString;
+    userId: _$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_REF>;
+    expiresAt: _$alepha.TString;
+    ip: _$alepha.TOptional<_$alepha.TString>;
+    userAgent: _$alepha.TOptional<_$alepha.TObject<{
+      os: _$alepha.TString;
+      browser: _$alepha.TString;
+      device: _$alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
     }>>;
   }>>;
-  protected readonly defaultUsers: Repository<alepha.TObject<{
-    id: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_PRIMARY_KEY>, typeof alepha_orm0.PG_DEFAULT>;
-    version: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TInteger, typeof alepha_orm0.PG_VERSION>, typeof alepha_orm0.PG_DEFAULT>;
-    createdAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_CREATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-    updatedAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_UPDATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-    realm: alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_DEFAULT>;
-    username: alepha.TOptional<alepha.TString>;
-    email: alepha.TOptional<alepha.TString>;
-    phoneNumber: alepha.TOptional<alepha.TString>;
-    roles: alepha_orm0.PgAttr<alepha.TArray<alepha.TString>, typeof alepha_orm0.PG_DEFAULT>;
-    firstName: alepha.TOptional<alepha.TString>;
-    lastName: alepha.TOptional<alepha.TString>;
-    picture: alepha.TOptional<alepha.TString>;
-    enabled: alepha_orm0.PgAttr<alepha.TBoolean, typeof alepha_orm0.PG_DEFAULT>;
-    emailVerified: alepha_orm0.PgAttr<alepha.TBoolean, typeof alepha_orm0.PG_DEFAULT>;
+  protected readonly defaultUsers: Repository<_$alepha.TObject<{
+    id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
+    version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
+    createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    realm: _$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_DEFAULT>;
+    username: _$alepha.TOptional<_$alepha.TString>;
+    email: _$alepha.TOptional<_$alepha.TString>;
+    phoneNumber: _$alepha.TOptional<_$alepha.TString>;
+    roles: _$alepha_orm0.PgAttr<_$alepha.TArray<_$alepha.TString>, typeof _$alepha_orm0.PG_DEFAULT>;
+    firstName: _$alepha.TOptional<_$alepha.TString>;
+    lastName: _$alepha.TOptional<_$alepha.TString>;
+    picture: _$alepha.TOptional<_$alepha.TString>;
+    enabled: _$alepha_orm0.PgAttr<_$alepha.TBoolean, typeof _$alepha_orm0.PG_DEFAULT>;
+    emailVerified: _$alepha_orm0.PgAttr<_$alepha.TBoolean, typeof _$alepha_orm0.PG_DEFAULT>;
+    organizationId: _$alepha_orm0.PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof _$alepha_orm0.PG_ORGANIZATION>;
   }>>;
   protected realms: Map<string, Realm>;
   register(realmName: string, realmOptions?: RealmOptions): Realm;
@@ -7034,31 +7082,31 @@ declare class RealmProvider {
 }
 //#endregion
 //#region ../../src/api/users/schemas/identityQuerySchema.d.ts
-declare const identityQuerySchema: alepha.TObject<{
-  page: alepha.TOptional<alepha.TInteger>;
-  size: alepha.TOptional<alepha.TInteger>;
-  sort: alepha.TOptional<alepha.TString>;
-  userId: alepha.TOptional<alepha.TString>;
-  provider: alepha.TOptional<alepha.TString>;
+declare const identityQuerySchema: _$alepha.TObject<{
+  page: _$alepha.TOptional<_$alepha.TInteger>;
+  size: _$alepha.TOptional<_$alepha.TInteger>;
+  sort: _$alepha.TOptional<_$alepha.TString>;
+  userId: _$alepha.TOptional<_$alepha.TString>;
+  provider: _$alepha.TOptional<_$alepha.TString>;
 }>;
 type IdentityQuery = Static<typeof identityQuerySchema>;
 //#endregion
 //#region ../../src/api/users/services/IdentityService.d.ts
 declare class IdentityService {
   protected readonly alepha: Alepha;
-  protected readonly log: alepha_logger0.Logger;
+  protected readonly log: _$alepha_logger0.Logger;
   protected readonly realmProvider: RealmProvider;
   protected userAudits(realmName?: string): UserAudits | undefined;
-  identities(userRealmName?: string): alepha_orm0.Repository<alepha.TObject<{
-    id: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_PRIMARY_KEY>, typeof alepha_orm0.PG_DEFAULT>;
-    version: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TInteger, typeof alepha_orm0.PG_VERSION>, typeof alepha_orm0.PG_DEFAULT>;
-    createdAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_CREATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-    updatedAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_UPDATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-    userId: alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_REF>;
-    password: alepha.TOptional<alepha.TString>;
-    provider: alepha.TString;
-    providerUserId: alepha.TOptional<alepha.TString>;
-    providerData: alepha.TOptional<alepha.TRecord<string, alepha.TAny>>;
+  identities(userRealmName?: string): _$alepha_orm0.Repository<_$alepha.TObject<{
+    id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
+    version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
+    createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    userId: _$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_REF>;
+    password: _$alepha.TOptional<_$alepha.TString>;
+    provider: _$alepha.TString;
+    providerUserId: _$alepha.TOptional<_$alepha.TString>;
+    providerData: _$alepha.TOptional<_$alepha.TRecord<string, _$alepha.TAny>>;
   }>>;
   /**
    * Find identities with pagination and filtering.
@@ -7082,91 +7130,91 @@ declare class AdminIdentityController {
   /**
    * Find identities with pagination and filtering.
    */
-  readonly findIdentities: alepha_server0.ActionPrimitiveFn<{
-    query: alepha.TObject<{
-      page: alepha.TOptional<alepha.TInteger>;
-      size: alepha.TOptional<alepha.TInteger>;
-      sort: alepha.TOptional<alepha.TString>;
-      userId: alepha.TOptional<alepha.TString>;
-      provider: alepha.TOptional<alepha.TString>;
-      userRealmName: alepha.TOptional<alepha.TString>;
-    }>;
-    response: alepha.TPage<alepha.TObject<{
-      id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      userId: PgAttr<alepha.TString, typeof PG_REF>;
-      provider: alepha.TString;
-      providerUserId: alepha.TOptional<alepha.TString>;
-      providerData: alepha.TOptional<alepha.TRecord<string, alepha.TAny>>;
+  readonly findIdentities: _$alepha_server0.ActionPrimitiveFn<{
+    query: _$alepha.TObject<{
+      page: _$alepha.TOptional<_$alepha.TInteger>;
+      size: _$alepha.TOptional<_$alepha.TInteger>;
+      sort: _$alepha.TOptional<_$alepha.TString>;
+      userId: _$alepha.TOptional<_$alepha.TString>;
+      provider: _$alepha.TOptional<_$alepha.TString>;
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
+    }>;
+    response: _$alepha.TPage<_$alepha.TObject<{
+      id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      userId: PgAttr<_$alepha.TString, typeof PG_REF>;
+      provider: _$alepha.TString;
+      providerUserId: _$alepha.TOptional<_$alepha.TString>;
+      providerData: _$alepha.TOptional<_$alepha.TRecord<string, _$alepha.TAny>>;
     }>>;
   }>;
   /**
    * Get an identity by ID.
    */
-  readonly getIdentity: alepha_server0.ActionPrimitiveFn<{
-    params: alepha.TObject<{
-      id: alepha.TString;
+  readonly getIdentity: _$alepha_server0.ActionPrimitiveFn<{
+    params: _$alepha.TObject<{
+      id: _$alepha.TString;
     }>;
-    query: alepha.TObject<{
-      userRealmName: alepha.TOptional<alepha.TString>;
+    query: _$alepha.TObject<{
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
     }>;
-    response: alepha.TObject<{
-      id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      userId: PgAttr<alepha.TString, typeof PG_REF>;
-      provider: alepha.TString;
-      providerUserId: alepha.TOptional<alepha.TString>;
-      providerData: alepha.TOptional<alepha.TRecord<string, alepha.TAny>>;
+    response: _$alepha.TObject<{
+      id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      userId: PgAttr<_$alepha.TString, typeof PG_REF>;
+      provider: _$alepha.TString;
+      providerUserId: _$alepha.TOptional<_$alepha.TString>;
+      providerData: _$alepha.TOptional<_$alepha.TRecord<string, _$alepha.TAny>>;
     }>;
   }>;
   /**
    * Delete an identity.
    */
-  readonly deleteIdentity: alepha_server0.ActionPrimitiveFn<{
-    params: alepha.TObject<{
-      id: alepha.TString;
+  readonly deleteIdentity: _$alepha_server0.ActionPrimitiveFn<{
+    params: _$alepha.TObject<{
+      id: _$alepha.TString;
     }>;
-    query: alepha.TObject<{
-      userRealmName: alepha.TOptional<alepha.TString>;
+    query: _$alepha.TObject<{
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
     }>;
-    response: alepha.TObject<{
-      ok: alepha.TBoolean;
-      id: alepha.TOptional<alepha.TUnion<[alepha.TString, alepha.TInteger]>>;
-      count: alepha.TOptional<alepha.TNumber>;
+    response: _$alepha.TObject<{
+      ok: _$alepha.TBoolean;
+      id: _$alepha.TOptional<_$alepha.TUnion<[_$alepha.TString, _$alepha.TInteger]>>;
+      count: _$alepha.TOptional<_$alepha.TNumber>;
     }>;
   }>;
 }
 //#endregion
 //#region ../../src/api/users/schemas/sessionQuerySchema.d.ts
-declare const sessionQuerySchema: alepha.TObject<{
-  page: alepha.TOptional<alepha.TInteger>;
-  size: alepha.TOptional<alepha.TInteger>;
-  sort: alepha.TOptional<alepha.TString>;
-  userId: alepha.TOptional<alepha.TString>;
+declare const sessionQuerySchema: _$alepha.TObject<{
+  page: _$alepha.TOptional<_$alepha.TInteger>;
+  size: _$alepha.TOptional<_$alepha.TInteger>;
+  sort: _$alepha.TOptional<_$alepha.TString>;
+  userId: _$alepha.TOptional<_$alepha.TString>;
 }>;
 type SessionQuery = Static<typeof sessionQuerySchema>;
 //#endregion
 //#region ../../src/api/users/services/SessionCrudService.d.ts
 declare class SessionCrudService {
-  protected readonly log: alepha_logger0.Logger;
+  protected readonly log: _$alepha_logger0.Logger;
   protected readonly realmProvider: RealmProvider;
-  sessions(userRealmName?: string): alepha_orm0.Repository<alepha.TObject<{
-    id: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_PRIMARY_KEY>, typeof alepha_orm0.PG_DEFAULT>;
-    version: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TInteger, typeof alepha_orm0.PG_VERSION>, typeof alepha_orm0.PG_DEFAULT>;
-    createdAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_CREATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-    updatedAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_UPDATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-    refreshToken: alepha.TString;
-    userId: alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_REF>;
-    expiresAt: alepha.TString;
-    ip: alepha.TOptional<alepha.TString>;
-    userAgent: alepha.TOptional<alepha.TObject<{
-      os: alepha.TString;
-      browser: alepha.TString;
-      device: alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  sessions(userRealmName?: string): _$alepha_orm0.Repository<_$alepha.TObject<{
+    id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
+    version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
+    createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    refreshToken: _$alepha.TString;
+    userId: _$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_REF>;
+    expiresAt: _$alepha.TString;
+    ip: _$alepha.TOptional<_$alepha.TString>;
+    userAgent: _$alepha.TOptional<_$alepha.TObject<{
+      os: _$alepha.TString;
+      browser: _$alepha.TString;
+      device: _$alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
     }>>;
   }>>;
   /**
@@ -7191,170 +7239,173 @@ declare class AdminSessionController {
   /**
    * Find sessions with pagination and filtering.
    */
-  readonly findSessions: alepha_server0.ActionPrimitiveFn<{
-    query: alepha.TObject<{
-      page: alepha.TOptional<alepha.TInteger>;
-      size: alepha.TOptional<alepha.TInteger>;
-      sort: alepha.TOptional<alepha.TString>;
-      userId: alepha.TOptional<alepha.TString>;
-      userRealmName: alepha.TOptional<alepha.TString>;
-    }>;
-    response: alepha.TPage<alepha.TObject<{
-      id: alepha.TString;
-      version: alepha.TNumber;
-      createdAt: alepha.TString;
-      updatedAt: alepha.TString;
-      refreshToken: alepha.TString;
-      userId: alepha.TString;
-      expiresAt: alepha.TString;
-      ip: alepha.TOptional<alepha.TString>;
-      userAgent: alepha.TOptional<alepha.TObject<{
-        os: alepha.TString;
-        browser: alepha.TString;
-        device: alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  readonly findSessions: _$alepha_server0.ActionPrimitiveFn<{
+    query: _$alepha.TObject<{
+      page: _$alepha.TOptional<_$alepha.TInteger>;
+      size: _$alepha.TOptional<_$alepha.TInteger>;
+      sort: _$alepha.TOptional<_$alepha.TString>;
+      userId: _$alepha.TOptional<_$alepha.TString>;
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
+    }>;
+    response: _$alepha.TPage<_$alepha.TObject<{
+      id: _$alepha.TString;
+      version: _$alepha.TNumber;
+      createdAt: _$alepha.TString;
+      updatedAt: _$alepha.TString;
+      refreshToken: _$alepha.TString;
+      userId: _$alepha.TString;
+      expiresAt: _$alepha.TString;
+      ip: _$alepha.TOptional<_$alepha.TString>;
+      userAgent: _$alepha.TOptional<_$alepha.TObject<{
+        os: _$alepha.TString;
+        browser: _$alepha.TString;
+        device: _$alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
       }>>;
     }>>;
   }>;
   /**
    * Get a session by ID.
    */
-  readonly getSession: alepha_server0.ActionPrimitiveFn<{
-    params: alepha.TObject<{
-      id: alepha.TString;
-    }>;
-    query: alepha.TObject<{
-      userRealmName: alepha.TOptional<alepha.TString>;
-    }>;
-    response: alepha.TObject<{
-      id: alepha.TString;
-      version: alepha.TNumber;
-      createdAt: alepha.TString;
-      updatedAt: alepha.TString;
-      refreshToken: alepha.TString;
-      userId: alepha.TString;
-      expiresAt: alepha.TString;
-      ip: alepha.TOptional<alepha.TString>;
-      userAgent: alepha.TOptional<alepha.TObject<{
-        os: alepha.TString;
-        browser: alepha.TString;
-        device: alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  readonly getSession: _$alepha_server0.ActionPrimitiveFn<{
+    params: _$alepha.TObject<{
+      id: _$alepha.TString;
+    }>;
+    query: _$alepha.TObject<{
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
+    }>;
+    response: _$alepha.TObject<{
+      id: _$alepha.TString;
+      version: _$alepha.TNumber;
+      createdAt: _$alepha.TString;
+      updatedAt: _$alepha.TString;
+      refreshToken: _$alepha.TString;
+      userId: _$alepha.TString;
+      expiresAt: _$alepha.TString;
+      ip: _$alepha.TOptional<_$alepha.TString>;
+      userAgent: _$alepha.TOptional<_$alepha.TObject<{
+        os: _$alepha.TString;
+        browser: _$alepha.TString;
+        device: _$alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
       }>>;
     }>;
   }>;
   /**
    * Delete a session.
    */
-  readonly deleteSession: alepha_server0.ActionPrimitiveFn<{
-    params: alepha.TObject<{
-      id: alepha.TString;
+  readonly deleteSession: _$alepha_server0.ActionPrimitiveFn<{
+    params: _$alepha.TObject<{
+      id: _$alepha.TString;
     }>;
-    query: alepha.TObject<{
-      userRealmName: alepha.TOptional<alepha.TString>;
+    query: _$alepha.TObject<{
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
     }>;
-    response: alepha.TObject<{
-      ok: alepha.TBoolean;
-      id: alepha.TOptional<alepha.TUnion<[alepha.TString, alepha.TInteger]>>;
-      count: alepha.TOptional<alepha.TNumber>;
+    response: _$alepha.TObject<{
+      ok: _$alepha.TBoolean;
+      id: _$alepha.TOptional<_$alepha.TUnion<[_$alepha.TString, _$alepha.TInteger]>>;
+      count: _$alepha.TOptional<_$alepha.TNumber>;
     }>;
   }>;
 }
 //#endregion
 //#region ../../src/api/users/notifications/UserNotifications.d.ts
 declare class UserNotifications {
-  readonly passwordReset: alepha_api_notifications0.NotificationPrimitive<alepha.TObject<{
-    email: alepha.TString;
-    code: alepha.TString;
-    expiresInMinutes: alepha.TNumber;
+  readonly passwordReset: _$alepha_api_notifications0.NotificationPrimitive<_$alepha.TObject<{
+    email: _$alepha.TString;
+    code: _$alepha.TString;
+    expiresInMinutes: _$alepha.TNumber;
   }>>;
-  readonly emailVerification: alepha_api_notifications0.NotificationPrimitive<alepha.TObject<{
-    email: alepha.TString;
-    code: alepha.TString;
-    expiresInMinutes: alepha.TNumber;
+  readonly emailVerification: _$alepha_api_notifications0.NotificationPrimitive<_$alepha.TObject<{
+    email: _$alepha.TString;
+    code: _$alepha.TString;
+    expiresInMinutes: _$alepha.TNumber;
   }>>;
-  readonly phoneVerification: alepha_api_notifications0.NotificationPrimitive<alepha.TObject<{
-    phoneNumber: alepha.TString;
-    code: alepha.TString;
-    expiresInMinutes: alepha.TNumber;
+  readonly phoneVerification: _$alepha_api_notifications0.NotificationPrimitive<_$alepha.TObject<{
+    phoneNumber: _$alepha.TString;
+    code: _$alepha.TString;
+    expiresInMinutes: _$alepha.TNumber;
   }>>;
-  readonly passwordResetLink: alepha_api_notifications0.NotificationPrimitive<alepha.TObject<{
-    email: alepha.TString;
-    resetUrl: alepha.TString;
-    expiresInMinutes: alepha.TNumber;
+  readonly passwordResetLink: _$alepha_api_notifications0.NotificationPrimitive<_$alepha.TObject<{
+    email: _$alepha.TString;
+    resetUrl: _$alepha.TString;
+    expiresInMinutes: _$alepha.TNumber;
   }>>;
-  readonly emailVerificationLink: alepha_api_notifications0.NotificationPrimitive<alepha.TObject<{
-    email: alepha.TString;
-    verifyUrl: alepha.TString;
-    expiresInMinutes: alepha.TNumber;
+  readonly emailVerificationLink: _$alepha_api_notifications0.NotificationPrimitive<_$alepha.TObject<{
+    email: _$alepha.TString;
+    verifyUrl: _$alepha.TString;
+    expiresInMinutes: _$alepha.TNumber;
   }>>;
 }
 //#endregion
 //#region ../../src/api/users/schemas/createUserSchema.d.ts
-declare const createUserSchema: alepha.TObject<{
-  enabled: alepha.TOptional<PgAttr<alepha.TBoolean, typeof PG_DEFAULT>>;
-  email: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-  phoneNumber: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-  id: alepha.TOptional<PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>>;
-  version: alepha.TOptional<PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>>;
-  createdAt: alepha.TOptional<PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>>;
-  updatedAt: alepha.TOptional<PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>>;
-  username: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-  roles: alepha.TOptional<alepha.TArray<alepha.TString>>;
-  firstName: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-  lastName: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-  picture: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-  emailVerified: alepha.TOptional<PgAttr<alepha.TBoolean, typeof PG_DEFAULT>>;
+declare const createUserSchema: _$alepha.TObject<{
+  enabled: _$alepha.TOptional<PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>>;
+  email: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+  phoneNumber: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+  id: _$alepha.TOptional<PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>>;
+  version: _$alepha.TOptional<PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>>;
+  createdAt: _$alepha.TOptional<PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>>;
+  updatedAt: _$alepha.TOptional<PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>>;
+  username: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+  roles: _$alepha.TOptional<_$alepha.TArray<_$alepha.TString>>;
+  firstName: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+  lastName: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+  picture: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+  emailVerified: _$alepha.TOptional<PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>>;
+  organizationId: _$alepha.TOptional<PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof PG_ORGANIZATION>>;
 }>;
 type CreateUser = Static<typeof createUserSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/updateUserSchema.d.ts
-declare const updateUserSchema: alepha.TObject<{
-  enabled: alepha.TOptional<PgAttr<alepha.TBoolean, typeof PG_DEFAULT>>;
-  email: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-  phoneNumber: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-  realm: alepha.TOptional<PgAttr<alepha.TString, typeof PG_DEFAULT>>;
-  roles: alepha.TOptional<alepha.TArray<alepha.TString>>;
-  firstName: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-  lastName: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-  picture: alepha.TOptional<alepha.TOptional<alepha.TString>>;
+declare const updateUserSchema: _$alepha.TObject<{
+  enabled: _$alepha.TOptional<PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>>;
+  email: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+  phoneNumber: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+  realm: _$alepha.TOptional<PgAttr<_$alepha.TString, typeof PG_DEFAULT>>;
+  roles: _$alepha.TOptional<_$alepha.TArray<_$alepha.TString>>;
+  firstName: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+  lastName: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+  picture: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+  organizationId: _$alepha.TOptional<PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof PG_ORGANIZATION>>;
 }>;
 type UpdateUser = Static<typeof updateUserSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/userQuerySchema.d.ts
-declare const userQuerySchema: alepha.TObject<{
-  page: alepha.TOptional<alepha.TInteger>;
-  size: alepha.TOptional<alepha.TInteger>;
-  sort: alepha.TOptional<alepha.TString>;
-  email: alepha.TOptional<alepha.TString>;
-  enabled: alepha.TOptional<alepha.TBoolean>;
-  emailVerified: alepha.TOptional<alepha.TBoolean>;
-  roles: alepha.TOptional<alepha.TArray<alepha.TString>>;
-  query: alepha.TOptional<alepha.TString>;
+declare const userQuerySchema: _$alepha.TObject<{
+  page: _$alepha.TOptional<_$alepha.TInteger>;
+  size: _$alepha.TOptional<_$alepha.TInteger>;
+  sort: _$alepha.TOptional<_$alepha.TString>;
+  email: _$alepha.TOptional<_$alepha.TString>;
+  enabled: _$alepha.TOptional<_$alepha.TBoolean>;
+  emailVerified: _$alepha.TOptional<_$alepha.TBoolean>;
+  roles: _$alepha.TOptional<_$alepha.TArray<_$alepha.TString>>;
+  query: _$alepha.TOptional<_$alepha.TString>;
 }>;
 type UserQuery = Static<typeof userQuerySchema>;
 //#endregion
 //#region ../../src/api/users/services/UserService.d.ts
 declare class UserService {
   protected readonly alepha: Alepha;
-  protected readonly log: alepha_logger0.Logger;
-  protected readonly verificationController: alepha_server_links0.HttpVirtualClient<VerificationController>;
+  protected readonly log: _$alepha_logger0.Logger;
+  protected readonly verificationController: _$alepha_server_links0.HttpVirtualClient<VerificationController>;
   protected readonly realmProvider: RealmProvider;
   protected userAudits(realmName?: string): UserAudits | undefined;
   protected userNotifications(realmName?: string): UserNotifications | undefined;
-  users(userRealmName?: string): alepha_orm0.Repository<alepha.TObject<{
-    id: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_PRIMARY_KEY>, typeof alepha_orm0.PG_DEFAULT>;
-    version: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TInteger, typeof alepha_orm0.PG_VERSION>, typeof alepha_orm0.PG_DEFAULT>;
-    createdAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_CREATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-    updatedAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_UPDATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-    realm: alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_DEFAULT>;
-    username: alepha.TOptional<alepha.TString>;
-    email: alepha.TOptional<alepha.TString>;
-    phoneNumber: alepha.TOptional<alepha.TString>;
-    roles: alepha_orm0.PgAttr<alepha.TArray<alepha.TString>, typeof alepha_orm0.PG_DEFAULT>;
-    firstName: alepha.TOptional<alepha.TString>;
-    lastName: alepha.TOptional<alepha.TString>;
-    picture: alepha.TOptional<alepha.TString>;
-    enabled: alepha_orm0.PgAttr<alepha.TBoolean, typeof alepha_orm0.PG_DEFAULT>;
-    emailVerified: alepha_orm0.PgAttr<alepha.TBoolean, typeof alepha_orm0.PG_DEFAULT>;
+  users(userRealmName?: string): _$alepha_orm0.Repository<_$alepha.TObject<{
+    id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
+    version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
+    createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    realm: _$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_DEFAULT>;
+    username: _$alepha.TOptional<_$alepha.TString>;
+    email: _$alepha.TOptional<_$alepha.TString>;
+    phoneNumber: _$alepha.TOptional<_$alepha.TString>;
+    roles: _$alepha_orm0.PgAttr<_$alepha.TArray<_$alepha.TString>, typeof _$alepha_orm0.PG_DEFAULT>;
+    firstName: _$alepha.TOptional<_$alepha.TString>;
+    lastName: _$alepha.TOptional<_$alepha.TString>;
+    picture: _$alepha.TOptional<_$alepha.TString>;
+    enabled: _$alepha_orm0.PgAttr<_$alepha.TBoolean, typeof _$alepha_orm0.PG_DEFAULT>;
+    emailVerified: _$alepha_orm0.PgAttr<_$alepha.TBoolean, typeof _$alepha_orm0.PG_DEFAULT>;
+    organizationId: _$alepha_orm0.PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof _$alepha_orm0.PG_ORGANIZATION>;
   }>>;
   /**
    * Request email verification for a user.
@@ -7403,152 +7454,158 @@ declare class AdminUserController {
   /**
    * Find users with pagination and filtering.
    */
-  readonly findUsers: alepha_server0.ActionPrimitiveFn<{
-    query: alepha.TObject<{
-      page: alepha.TOptional<alepha.TInteger>;
-      size: alepha.TOptional<alepha.TInteger>;
-      sort: alepha.TOptional<alepha.TString>;
-      email: alepha.TOptional<alepha.TString>;
-      enabled: alepha.TOptional<alepha.TBoolean>;
-      emailVerified: alepha.TOptional<alepha.TBoolean>;
-      roles: alepha.TOptional<alepha.TArray<alepha.TString>>;
-      query: alepha.TOptional<alepha.TString>;
-      userRealmName: alepha.TOptional<alepha.TString>;
-    }>;
-    response: alepha.TPage<alepha.TObject<{
-      id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<alepha.TString, typeof PG_DEFAULT>;
-      username: alepha.TOptional<alepha.TString>;
-      email: alepha.TOptional<alepha.TString>;
-      phoneNumber: alepha.TOptional<alepha.TString>;
-      roles: PgAttr<alepha.TArray<alepha.TString>, typeof PG_DEFAULT>;
-      firstName: alepha.TOptional<alepha.TString>;
-      lastName: alepha.TOptional<alepha.TString>;
-      picture: alepha.TOptional<alepha.TString>;
-      enabled: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
+  readonly findUsers: _$alepha_server0.ActionPrimitiveFn<{
+    query: _$alepha.TObject<{
+      page: _$alepha.TOptional<_$alepha.TInteger>;
+      size: _$alepha.TOptional<_$alepha.TInteger>;
+      sort: _$alepha.TOptional<_$alepha.TString>;
+      email: _$alepha.TOptional<_$alepha.TString>;
+      enabled: _$alepha.TOptional<_$alepha.TBoolean>;
+      emailVerified: _$alepha.TOptional<_$alepha.TBoolean>;
+      roles: _$alepha.TOptional<_$alepha.TArray<_$alepha.TString>>;
+      query: _$alepha.TOptional<_$alepha.TString>;
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
+    }>;
+    response: _$alepha.TPage<_$alepha.TObject<{
+      id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<_$alepha.TString, typeof PG_DEFAULT>;
+      username: _$alepha.TOptional<_$alepha.TString>;
+      email: _$alepha.TOptional<_$alepha.TString>;
+      phoneNumber: _$alepha.TOptional<_$alepha.TString>;
+      roles: PgAttr<_$alepha.TArray<_$alepha.TString>, typeof PG_DEFAULT>;
+      firstName: _$alepha.TOptional<_$alepha.TString>;
+      lastName: _$alepha.TOptional<_$alepha.TString>;
+      picture: _$alepha.TOptional<_$alepha.TString>;
+      enabled: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      organizationId: PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof PG_ORGANIZATION>;
     }>>;
   }>;
   /**
    * Get a user by ID.
    */
-  readonly getUser: alepha_server0.ActionPrimitiveFn<{
-    params: alepha.TObject<{
-      id: alepha.TString;
-    }>;
-    query: alepha.TObject<{
-      userRealmName: alepha.TOptional<alepha.TString>;
-    }>;
-    response: alepha.TObject<{
-      id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<alepha.TString, typeof PG_DEFAULT>;
-      username: alepha.TOptional<alepha.TString>;
-      email: alepha.TOptional<alepha.TString>;
-      phoneNumber: alepha.TOptional<alepha.TString>;
-      roles: PgAttr<alepha.TArray<alepha.TString>, typeof PG_DEFAULT>;
-      firstName: alepha.TOptional<alepha.TString>;
-      lastName: alepha.TOptional<alepha.TString>;
-      picture: alepha.TOptional<alepha.TString>;
-      enabled: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
+  readonly getUser: _$alepha_server0.ActionPrimitiveFn<{
+    params: _$alepha.TObject<{
+      id: _$alepha.TString;
+    }>;
+    query: _$alepha.TObject<{
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
+    }>;
+    response: _$alepha.TObject<{
+      id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<_$alepha.TString, typeof PG_DEFAULT>;
+      username: _$alepha.TOptional<_$alepha.TString>;
+      email: _$alepha.TOptional<_$alepha.TString>;
+      phoneNumber: _$alepha.TOptional<_$alepha.TString>;
+      roles: PgAttr<_$alepha.TArray<_$alepha.TString>, typeof PG_DEFAULT>;
+      firstName: _$alepha.TOptional<_$alepha.TString>;
+      lastName: _$alepha.TOptional<_$alepha.TString>;
+      picture: _$alepha.TOptional<_$alepha.TString>;
+      enabled: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      organizationId: PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof PG_ORGANIZATION>;
     }>;
   }>;
   /**
    * Create a new user.
    */
-  readonly createUser: alepha_server0.ActionPrimitiveFn<{
-    query: alepha.TObject<{
-      userRealmName: alepha.TOptional<alepha.TString>;
-    }>;
-    body: alepha.TObject<{
-      enabled: alepha.TOptional<PgAttr<alepha.TBoolean, typeof PG_DEFAULT>>;
-      email: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-      phoneNumber: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-      id: alepha.TOptional<PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>>;
-      version: alepha.TOptional<PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>>;
-      createdAt: alepha.TOptional<PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>>;
-      updatedAt: alepha.TOptional<PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>>;
-      username: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-      roles: alepha.TOptional<alepha.TArray<alepha.TString>>;
-      firstName: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-      lastName: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-      picture: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-      emailVerified: alepha.TOptional<PgAttr<alepha.TBoolean, typeof PG_DEFAULT>>;
-    }>;
-    response: alepha.TObject<{
-      id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<alepha.TString, typeof PG_DEFAULT>;
-      username: alepha.TOptional<alepha.TString>;
-      email: alepha.TOptional<alepha.TString>;
-      phoneNumber: alepha.TOptional<alepha.TString>;
-      roles: PgAttr<alepha.TArray<alepha.TString>, typeof PG_DEFAULT>;
-      firstName: alepha.TOptional<alepha.TString>;
-      lastName: alepha.TOptional<alepha.TString>;
-      picture: alepha.TOptional<alepha.TString>;
-      enabled: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
+  readonly createUser: _$alepha_server0.ActionPrimitiveFn<{
+    query: _$alepha.TObject<{
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
+    }>;
+    body: _$alepha.TObject<{
+      enabled: _$alepha.TOptional<PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>>;
+      email: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+      phoneNumber: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+      id: _$alepha.TOptional<PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>>;
+      version: _$alepha.TOptional<PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>>;
+      createdAt: _$alepha.TOptional<PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>>;
+      updatedAt: _$alepha.TOptional<PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>>;
+      username: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+      roles: _$alepha.TOptional<_$alepha.TArray<_$alepha.TString>>;
+      firstName: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+      lastName: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+      picture: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+      emailVerified: _$alepha.TOptional<PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>>;
+      organizationId: _$alepha.TOptional<PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof PG_ORGANIZATION>>;
+    }>;
+    response: _$alepha.TObject<{
+      id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<_$alepha.TString, typeof PG_DEFAULT>;
+      username: _$alepha.TOptional<_$alepha.TString>;
+      email: _$alepha.TOptional<_$alepha.TString>;
+      phoneNumber: _$alepha.TOptional<_$alepha.TString>;
+      roles: PgAttr<_$alepha.TArray<_$alepha.TString>, typeof PG_DEFAULT>;
+      firstName: _$alepha.TOptional<_$alepha.TString>;
+      lastName: _$alepha.TOptional<_$alepha.TString>;
+      picture: _$alepha.TOptional<_$alepha.TString>;
+      enabled: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      organizationId: PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof PG_ORGANIZATION>;
     }>;
   }>;
   /**
    * Update a user.
    */
-  readonly updateUser: alepha_server0.ActionPrimitiveFn<{
-    params: alepha.TObject<{
-      id: alepha.TString;
-    }>;
-    query: alepha.TObject<{
-      userRealmName: alepha.TOptional<alepha.TString>;
-    }>;
-    body: alepha.TObject<{
-      enabled: alepha.TOptional<PgAttr<alepha.TBoolean, typeof PG_DEFAULT>>;
-      email: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-      phoneNumber: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-      realm: alepha.TOptional<PgAttr<alepha.TString, typeof PG_DEFAULT>>;
-      roles: alepha.TOptional<alepha.TArray<alepha.TString>>;
-      firstName: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-      lastName: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-      picture: alepha.TOptional<alepha.TOptional<alepha.TString>>;
-    }>;
-    response: alepha.TObject<{
-      id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<alepha.TString, typeof PG_DEFAULT>;
-      username: alepha.TOptional<alepha.TString>;
-      email: alepha.TOptional<alepha.TString>;
-      phoneNumber: alepha.TOptional<alepha.TString>;
-      roles: PgAttr<alepha.TArray<alepha.TString>, typeof PG_DEFAULT>;
-      firstName: alepha.TOptional<alepha.TString>;
-      lastName: alepha.TOptional<alepha.TString>;
-      picture: alepha.TOptional<alepha.TString>;
-      enabled: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
+  readonly updateUser: _$alepha_server0.ActionPrimitiveFn<{
+    params: _$alepha.TObject<{
+      id: _$alepha.TString;
+    }>;
+    query: _$alepha.TObject<{
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
+    }>;
+    body: _$alepha.TObject<{
+      enabled: _$alepha.TOptional<PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>>;
+      email: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+      phoneNumber: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+      realm: _$alepha.TOptional<PgAttr<_$alepha.TString, typeof PG_DEFAULT>>;
+      roles: _$alepha.TOptional<_$alepha.TArray<_$alepha.TString>>;
+      firstName: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+      lastName: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+      picture: _$alepha.TOptional<_$alepha.TOptional<_$alepha.TString>>;
+      organizationId: _$alepha.TOptional<PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof PG_ORGANIZATION>>;
+    }>;
+    response: _$alepha.TObject<{
+      id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<_$alepha.TString, typeof PG_DEFAULT>;
+      username: _$alepha.TOptional<_$alepha.TString>;
+      email: _$alepha.TOptional<_$alepha.TString>;
+      phoneNumber: _$alepha.TOptional<_$alepha.TString>;
+      roles: PgAttr<_$alepha.TArray<_$alepha.TString>, typeof PG_DEFAULT>;
+      firstName: _$alepha.TOptional<_$alepha.TString>;
+      lastName: _$alepha.TOptional<_$alepha.TString>;
+      picture: _$alepha.TOptional<_$alepha.TString>;
+      enabled: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      organizationId: PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof PG_ORGANIZATION>;
     }>;
   }>;
   /**
    * Delete a user.
    */
-  readonly deleteUser: alepha_server0.ActionPrimitiveFn<{
-    params: alepha.TObject<{
-      id: alepha.TString;
+  readonly deleteUser: _$alepha_server0.ActionPrimitiveFn<{
+    params: _$alepha.TObject<{
+      id: _$alepha.TString;
     }>;
-    query: alepha.TObject<{
-      userRealmName: alepha.TOptional<alepha.TString>;
+    query: _$alepha.TObject<{
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
     }>;
-    response: alepha.TObject<{
-      ok: alepha.TBoolean;
-      id: alepha.TOptional<alepha.TUnion<[alepha.TString, alepha.TInteger]>>;
-      count: alepha.TOptional<alepha.TNumber>;
+    response: _$alepha.TObject<{
+      ok: _$alepha.TBoolean;
+      id: _$alepha.TOptional<_$alepha.TUnion<[_$alepha.TString, _$alepha.TInteger]>>;
+      count: _$alepha.TOptional<_$alepha.TNumber>;
     }>;
   }>;
 }
@@ -7567,50 +7624,55 @@ declare class RealmController {
    * Get realm configuration settings.
    * This endpoint is not exposed in the API documentation.
    */
-  readonly getRealmConfig: alepha_server0.ActionPrimitiveFn<{
-    query: alepha.TObject<{
-      realmName: alepha.TOptional<alepha.TString>;
-    }>;
-    response: alepha.TObject<{
-      settings: alepha.TObject<{
-        displayName: alepha.TOptional<alepha.TString>;
-        description: alepha.TOptional<alepha.TString>;
-        logoUrl: alepha.TOptional<alepha.TString>;
-        registrationAllowed: alepha.TBoolean;
-        email: alepha.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-        username: alepha.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-        usernameRegExp: alepha.TString;
-        phoneNumber: alepha.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-        verifyEmailRequired: alepha.TBoolean;
-        verifyPhoneRequired: alepha.TBoolean;
-        firstNameLastName: alepha.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-        resetPasswordAllowed: alepha.TBoolean;
-        adminEmails: alepha.TArray<alepha.TString>;
-        adminUsernames: alepha.TArray<alepha.TString>;
-        passwordPolicy: alepha.TObject<{
-          minLength: alepha.TInteger;
-          requireUppercase: alepha.TBoolean;
-          requireLowercase: alepha.TBoolean;
-          requireNumbers: alepha.TBoolean;
-          requireSpecialCharacters: alepha.TBoolean;
+  readonly getRealmConfig: _$alepha_server0.ActionPrimitiveFn<{
+    query: _$alepha.TObject<{
+      realmName: _$alepha.TOptional<_$alepha.TString>;
+    }>;
+    response: _$alepha.TObject<{
+      settings: _$alepha.TObject<{
+        displayName: _$alepha.TOptional<_$alepha.TString>;
+        description: _$alepha.TOptional<_$alepha.TString>;
+        logoUrl: _$alepha.TOptional<_$alepha.TString>;
+        registrationAllowed: _$alepha.TBoolean;
+        email: _$alepha.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
+        username: _$alepha.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
+        usernameRegExp: _$alepha.TString;
+        phoneNumber: _$alepha.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
+        verifyEmailRequired: _$alepha.TBoolean;
+        verifyPhoneRequired: _$alepha.TBoolean;
+        firstNameLastName: _$alepha.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
+        resetPasswordAllowed: _$alepha.TBoolean;
+        adminEmails: _$alepha.TArray<_$alepha.TString>;
+        adminUsernames: _$alepha.TArray<_$alepha.TString>;
+        passwordPolicy: _$alepha.TObject<{
+          minLength: _$alepha.TInteger;
+          requireUppercase: _$alepha.TBoolean;
+          requireLowercase: _$alepha.TBoolean;
+          requireNumbers: _$alepha.TBoolean;
+          requireSpecialCharacters: _$alepha.TBoolean;
+        }>;
+        loginRateLimit: _$alepha.TObject<{
+          ipMaxAttempts: _$alepha.TInteger;
+          accountMaxAttempts: _$alepha.TInteger;
+          windowMs: _$alepha.TInteger;
         }>;
       }>;
-      realmName: alepha.TString;
-      authenticationMethods: alepha.TArray<alepha.TObject<{
-        name: alepha.TString;
-        type: alepha.TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
+      realmName: _$alepha.TString;
+      authenticationMethods: _$alepha.TArray<_$alepha.TObject<{
+        name: _$alepha.TString;
+        type: _$alepha.TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
       }>>;
     }>;
   }>;
-  readonly checkUsernameAvailability: alepha_server0.ActionPrimitiveFn<{
-    query: alepha.TObject<{
-      realmName: alepha.TOptional<alepha.TString>;
+  readonly checkUsernameAvailability: _$alepha_server0.ActionPrimitiveFn<{
+    query: _$alepha.TObject<{
+      realmName: _$alepha.TOptional<_$alepha.TString>;
     }>;
-    body: alepha.TObject<{
-      username: alepha.TString;
+    body: _$alepha.TObject<{
+      username: _$alepha.TString;
     }>;
-    response: alepha.TObject<{
-      available: alepha.TBoolean;
+    response: _$alepha.TObject<{
+      available: _$alepha.TBoolean;
     }>;
   }>;
 }
@@ -7622,10 +7684,10 @@ declare class RealmController {
  * Requires the intent ID from Phase 1, the verification code,
  * and the new password.
  */
-declare const completePasswordResetRequestSchema: alepha.TObject<{
-  intentId: alepha.TString;
-  code: alepha.TString;
-  newPassword: alepha.TString;
+declare const completePasswordResetRequestSchema: _$alepha.TObject<{
+  intentId: _$alepha.TString;
+  code: _$alepha.TString;
+  newPassword: _$alepha.TString;
 }>;
 type CompletePasswordResetRequest = Static<typeof completePasswordResetRequestSchema>;
 //#endregion
@@ -7636,9 +7698,9 @@ type CompletePasswordResetRequest = Static<typeof completePasswordResetRequestSc
  * Contains the intent ID needed for Phase 2 completion,
  * along with expiration time.
  */
-declare const passwordResetIntentResponseSchema: alepha.TObject<{
-  intentId: alepha.TString;
-  expiresAt: alepha.TString;
+declare const passwordResetIntentResponseSchema: _$alepha.TObject<{
+  intentId: _$alepha.TString;
+  expiresAt: _$alepha.TString;
 }>;
 type PasswordResetIntentResponse = Static<typeof passwordResetIntentResponseSchema>;
 //#endregion
@@ -7655,55 +7717,56 @@ interface PasswordResetIntent {
 }
 declare class CredentialService {
   protected readonly alepha: Alepha;
-  protected readonly log: alepha_logger0.Logger;
+  protected readonly log: _$alepha_logger0.Logger;
   protected readonly cryptoProvider: CryptoProvider;
   protected readonly dateTimeProvider: DateTimeProvider;
-  protected readonly verificationController: alepha_server_links0.HttpVirtualClient<VerificationController>;
+  protected readonly verificationController: _$alepha_server_links0.HttpVirtualClient<VerificationController>;
   protected readonly realmProvider: RealmProvider;
   protected userAudits(realmName?: string): UserAudits | undefined;
   protected userNotifications(realmName?: string): UserNotifications | undefined;
-  protected readonly intentCache: alepha_cache0.CacheMiddlewareFn<PasswordResetIntent>;
-  users(userRealmName?: string): Repository$1<alepha.TObject<{
-    id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    realm: PgAttr<alepha.TString, typeof PG_DEFAULT>;
-    username: alepha.TOptional<alepha.TString>;
-    email: alepha.TOptional<alepha.TString>;
-    phoneNumber: alepha.TOptional<alepha.TString>;
-    roles: PgAttr<alepha.TArray<alepha.TString>, typeof PG_DEFAULT>;
-    firstName: alepha.TOptional<alepha.TString>;
-    lastName: alepha.TOptional<alepha.TString>;
-    picture: alepha.TOptional<alepha.TString>;
-    enabled: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
-    emailVerified: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
+  protected readonly intentCache: _$alepha_cache0.CacheMiddlewareFn<PasswordResetIntent>;
+  users(userRealmName?: string): Repository$1<_$alepha.TObject<{
+    id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    realm: PgAttr<_$alepha.TString, typeof PG_DEFAULT>;
+    username: _$alepha.TOptional<_$alepha.TString>;
+    email: _$alepha.TOptional<_$alepha.TString>;
+    phoneNumber: _$alepha.TOptional<_$alepha.TString>;
+    roles: PgAttr<_$alepha.TArray<_$alepha.TString>, typeof PG_DEFAULT>;
+    firstName: _$alepha.TOptional<_$alepha.TString>;
+    lastName: _$alepha.TOptional<_$alepha.TString>;
+    picture: _$alepha.TOptional<_$alepha.TString>;
+    enabled: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+    emailVerified: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+    organizationId: PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof PG_ORGANIZATION>;
   }>>;
-  sessions(userRealmName?: string): Repository$1<alepha.TObject<{
-    id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    refreshToken: alepha.TString;
-    userId: PgAttr<alepha.TString, typeof PG_REF>;
-    expiresAt: alepha.TString;
-    ip: alepha.TOptional<alepha.TString>;
-    userAgent: alepha.TOptional<alepha.TObject<{
-      os: alepha.TString;
-      browser: alepha.TString;
-      device: alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  sessions(userRealmName?: string): Repository$1<_$alepha.TObject<{
+    id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    refreshToken: _$alepha.TString;
+    userId: PgAttr<_$alepha.TString, typeof PG_REF>;
+    expiresAt: _$alepha.TString;
+    ip: _$alepha.TOptional<_$alepha.TString>;
+    userAgent: _$alepha.TOptional<_$alepha.TObject<{
+      os: _$alepha.TString;
+      browser: _$alepha.TString;
+      device: _$alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
     }>>;
   }>>;
-  identities(userRealmName?: string): Repository$1<alepha.TObject<{
-    id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    userId: PgAttr<alepha.TString, typeof PG_REF>;
-    password: alepha.TOptional<alepha.TString>;
-    provider: alepha.TString;
-    providerUserId: alepha.TOptional<alepha.TString>;
-    providerData: alepha.TOptional<alepha.TRecord<string, alepha.TAny>>;
+  identities(userRealmName?: string): Repository$1<_$alepha.TObject<{
+    id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    userId: PgAttr<_$alepha.TString, typeof PG_REF>;
+    password: _$alepha.TOptional<_$alepha.TString>;
+    provider: _$alepha.TString;
+    providerUserId: _$alepha.TOptional<_$alepha.TString>;
+    providerData: _$alepha.TOptional<_$alepha.TRecord<string, _$alepha.TAny>>;
   }>>;
   /**
    * Phase 1: Create a password reset intent.
@@ -7740,11 +7803,11 @@ declare class CredentialService {
 }
 //#endregion
 //#region ../../src/api/users/schemas/completeRegistrationRequestSchema.d.ts
-declare const completeRegistrationRequestSchema: alepha.TObject<{
-  intentId: alepha.TString;
-  emailCode: alepha.TOptional<alepha.TString>;
-  phoneCode: alepha.TOptional<alepha.TString>;
-  captchaToken: alepha.TOptional<alepha.TString>;
+declare const completeRegistrationRequestSchema: _$alepha.TObject<{
+  intentId: _$alepha.TString;
+  emailCode: _$alepha.TOptional<_$alepha.TString>;
+  phoneCode: _$alepha.TOptional<_$alepha.TString>;
+  captchaToken: _$alepha.TOptional<_$alepha.TString>;
 }>;
 type CompleteRegistrationRequest = Static<typeof completeRegistrationRequestSchema>;
 //#endregion
@@ -7753,24 +7816,24 @@ type CompleteRegistrationRequest = Static<typeof completeRegistrationRequestSche
  * Schema for user registration request body.
  * Password is always required, other fields depend on realm settings.
  */
-declare const registerRequestSchema: alepha.TObject<{
-  password: alepha.TString;
-  username: alepha.TOptional<alepha.TString>;
-  email: alepha.TOptional<alepha.TString>;
-  phoneNumber: alepha.TOptional<alepha.TString>;
-  firstName: alepha.TOptional<alepha.TString>;
-  lastName: alepha.TOptional<alepha.TString>;
-  picture: alepha.TOptional<alepha.TString>;
+declare const registerRequestSchema: _$alepha.TObject<{
+  password: _$alepha.TString;
+  username: _$alepha.TOptional<_$alepha.TString>;
+  email: _$alepha.TOptional<_$alepha.TString>;
+  phoneNumber: _$alepha.TOptional<_$alepha.TString>;
+  firstName: _$alepha.TOptional<_$alepha.TString>;
+  lastName: _$alepha.TOptional<_$alepha.TString>;
+  picture: _$alepha.TOptional<_$alepha.TString>;
 }>;
 type RegisterRequest = Static<typeof registerRequestSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/registrationIntentResponseSchema.d.ts
-declare const registrationIntentResponseSchema: alepha.TObject<{
-  intentId: alepha.TString;
-  expectCaptcha: alepha.TBoolean;
-  expectEmailVerification: alepha.TBoolean;
-  expectPhoneVerification: alepha.TBoolean;
-  expiresAt: alepha.TString;
+declare const registrationIntentResponseSchema: _$alepha.TObject<{
+  intentId: _$alepha.TString;
+  expectCaptcha: _$alepha.TBoolean;
+  expectEmailVerification: _$alepha.TBoolean;
+  expectPhoneVerification: _$alepha.TBoolean;
+  expiresAt: _$alepha.TString;
 }>;
 type RegistrationIntentResponse = Static<typeof registrationIntentResponseSchema>;
 //#endregion
@@ -7798,12 +7861,12 @@ interface RegistrationIntent {
 }
 declare class RegistrationService {
   protected readonly alepha: Alepha;
-  protected readonly log: alepha_logger0.Logger;
+  protected readonly log: _$alepha_logger0.Logger;
   protected readonly dateTimeProvider: DateTimeProvider;
   protected readonly cryptoProvider: CryptoProvider;
-  protected readonly verificationController: alepha_server_links0.HttpVirtualClient<VerificationController>;
+  protected readonly verificationController: _$alepha_server_links0.HttpVirtualClient<VerificationController>;
   protected readonly realmProvider: RealmProvider;
-  protected readonly intentCache: alepha_cache0.CacheMiddlewareFn<RegistrationIntent>;
+  protected readonly intentCache: _$alepha_cache0.CacheMiddlewareFn<RegistrationIntent>;
   protected userAudits(realmName?: string): UserAudits | undefined;
   protected userNotifications(realmName?: string): UserNotifications;
   /**
@@ -7853,131 +7916,132 @@ declare class UserController {
    * Phase 1: Create a registration intent.
    * Validates data, creates verification sessions, and stores intent in cache.
    */
-  readonly createRegistrationIntent: alepha_server0.ActionPrimitiveFn<{
-    body: alepha.TObject<{
-      password: alepha.TString;
-      username: alepha.TOptional<alepha.TString>;
-      email: alepha.TOptional<alepha.TString>;
-      phoneNumber: alepha.TOptional<alepha.TString>;
-      firstName: alepha.TOptional<alepha.TString>;
-      lastName: alepha.TOptional<alepha.TString>;
-      picture: alepha.TOptional<alepha.TString>;
-    }>;
-    query: alepha.TObject<{
-      userRealmName: alepha.TOptional<alepha.TString>;
-    }>;
-    response: alepha.TObject<{
-      intentId: alepha.TString;
-      expectCaptcha: alepha.TBoolean;
-      expectEmailVerification: alepha.TBoolean;
-      expectPhoneVerification: alepha.TBoolean;
-      expiresAt: alepha.TString;
+  readonly createRegistrationIntent: _$alepha_server0.ActionPrimitiveFn<{
+    body: _$alepha.TObject<{
+      password: _$alepha.TString;
+      username: _$alepha.TOptional<_$alepha.TString>;
+      email: _$alepha.TOptional<_$alepha.TString>;
+      phoneNumber: _$alepha.TOptional<_$alepha.TString>;
+      firstName: _$alepha.TOptional<_$alepha.TString>;
+      lastName: _$alepha.TOptional<_$alepha.TString>;
+      picture: _$alepha.TOptional<_$alepha.TString>;
+    }>;
+    query: _$alepha.TObject<{
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
+    }>;
+    response: _$alepha.TObject<{
+      intentId: _$alepha.TString;
+      expectCaptcha: _$alepha.TBoolean;
+      expectEmailVerification: _$alepha.TBoolean;
+      expectPhoneVerification: _$alepha.TBoolean;
+      expiresAt: _$alepha.TString;
     }>;
   }>;
   /**
    * Phase 2: Complete registration using an intent.
    * Validates verification codes and creates the user.
    */
-  readonly createUserFromIntent: alepha_server0.ActionPrimitiveFn<{
-    body: alepha.TObject<{
-      intentId: alepha.TString;
-      emailCode: alepha.TOptional<alepha.TString>;
-      phoneCode: alepha.TOptional<alepha.TString>;
-      captchaToken: alepha.TOptional<alepha.TString>;
-    }>;
-    response: alepha.TObject<{
-      id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<alepha.TString, typeof PG_DEFAULT>;
-      username: alepha.TOptional<alepha.TString>;
-      email: alepha.TOptional<alepha.TString>;
-      phoneNumber: alepha.TOptional<alepha.TString>;
-      roles: PgAttr<alepha.TArray<alepha.TString>, typeof PG_DEFAULT>;
-      firstName: alepha.TOptional<alepha.TString>;
-      lastName: alepha.TOptional<alepha.TString>;
-      picture: alepha.TOptional<alepha.TString>;
-      enabled: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
+  readonly createUserFromIntent: _$alepha_server0.ActionPrimitiveFn<{
+    body: _$alepha.TObject<{
+      intentId: _$alepha.TString;
+      emailCode: _$alepha.TOptional<_$alepha.TString>;
+      phoneCode: _$alepha.TOptional<_$alepha.TString>;
+      captchaToken: _$alepha.TOptional<_$alepha.TString>;
+    }>;
+    response: _$alepha.TObject<{
+      id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<_$alepha.TString, typeof PG_DEFAULT>;
+      username: _$alepha.TOptional<_$alepha.TString>;
+      email: _$alepha.TOptional<_$alepha.TString>;
+      phoneNumber: _$alepha.TOptional<_$alepha.TString>;
+      roles: PgAttr<_$alepha.TArray<_$alepha.TString>, typeof PG_DEFAULT>;
+      firstName: _$alepha.TOptional<_$alepha.TString>;
+      lastName: _$alepha.TOptional<_$alepha.TString>;
+      picture: _$alepha.TOptional<_$alepha.TString>;
+      enabled: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      organizationId: PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof PG_ORGANIZATION>;
     }>;
   }>;
   /**
    * Phase 1: Create a password reset intent.
    * Validates email, sends verification code, and stores intent in cache.
    */
-  readonly createPasswordResetIntent: alepha_server0.ActionPrimitiveFn<{
-    query: alepha.TObject<{
-      userRealmName: alepha.TOptional<alepha.TString>;
+  readonly createPasswordResetIntent: _$alepha_server0.ActionPrimitiveFn<{
+    query: _$alepha.TObject<{
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
     }>;
-    body: alepha.TObject<{
-      email: alepha.TString;
+    body: _$alepha.TObject<{
+      email: _$alepha.TString;
     }>;
-    response: alepha.TObject<{
-      intentId: alepha.TString;
-      expiresAt: alepha.TString;
+    response: _$alepha.TObject<{
+      intentId: _$alepha.TString;
+      expiresAt: _$alepha.TString;
     }>;
   }>;
   /**
    * Phase 2: Complete password reset using an intent.
    * Validates verification code, updates password, and invalidates sessions.
    */
-  readonly completePasswordReset: alepha_server0.ActionPrimitiveFn<{
-    body: alepha.TObject<{
-      intentId: alepha.TString;
-      code: alepha.TString;
-      newPassword: alepha.TString;
+  readonly completePasswordReset: _$alepha_server0.ActionPrimitiveFn<{
+    body: _$alepha.TObject<{
+      intentId: _$alepha.TString;
+      code: _$alepha.TString;
+      newPassword: _$alepha.TString;
     }>;
-    response: alepha.TObject<{
-      ok: alepha.TBoolean;
-      id: alepha.TOptional<alepha.TUnion<[alepha.TString, alepha.TInteger]>>;
-      count: alepha.TOptional<alepha.TNumber>;
+    response: _$alepha.TObject<{
+      ok: _$alepha.TBoolean;
+      id: _$alepha.TOptional<_$alepha.TUnion<[_$alepha.TString, _$alepha.TInteger]>>;
+      count: _$alepha.TOptional<_$alepha.TNumber>;
     }>;
   }>;
   /**
    * @deprecated Use createPasswordResetIntent instead
    */
-  requestPasswordReset: alepha_server0.ActionPrimitiveFn<{
-    query: alepha.TObject<{
-      userRealmName: alepha.TOptional<alepha.TString>;
+  requestPasswordReset: _$alepha_server0.ActionPrimitiveFn<{
+    query: _$alepha.TObject<{
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
     }>;
-    body: alepha.TObject<{
-      email: alepha.TString;
+    body: _$alepha.TObject<{
+      email: _$alepha.TString;
     }>;
-    response: alepha.TObject<{
-      success: alepha.TBoolean;
-      message: alepha.TString;
+    response: _$alepha.TObject<{
+      success: _$alepha.TBoolean;
+      message: _$alepha.TString;
     }>;
   }>;
   /**
    * @deprecated Use completePasswordReset instead
    */
-  validateResetToken: alepha_server0.ActionPrimitiveFn<{
-    query: alepha.TObject<{
-      email: alepha.TString;
-      token: alepha.TString;
-      userRealmName: alepha.TOptional<alepha.TString>;
+  validateResetToken: _$alepha_server0.ActionPrimitiveFn<{
+    query: _$alepha.TObject<{
+      email: _$alepha.TString;
+      token: _$alepha.TString;
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
     }>;
-    response: alepha.TObject<{
-      valid: alepha.TBoolean;
-      email: alepha.TOptional<alepha.TString>;
+    response: _$alepha.TObject<{
+      valid: _$alepha.TBoolean;
+      email: _$alepha.TOptional<_$alepha.TString>;
     }>;
   }>;
   /**
    * @deprecated Use completePasswordReset instead
    */
-  resetPassword: alepha_server0.ActionPrimitiveFn<{
-    query: alepha.TObject<{
-      userRealmName: alepha.TOptional<alepha.TString>;
+  resetPassword: _$alepha_server0.ActionPrimitiveFn<{
+    query: _$alepha.TObject<{
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
     }>;
-    body: alepha.TObject<{
-      email: alepha.TString;
-      token: alepha.TString;
-      newPassword: alepha.TString;
+    body: _$alepha.TObject<{
+      email: _$alepha.TString;
+      token: _$alepha.TString;
+      newPassword: _$alepha.TString;
     }>;
-    response: alepha.TObject<{
-      success: alepha.TBoolean;
-      message: alepha.TString;
+    response: _$alepha.TObject<{
+      success: _$alepha.TBoolean;
+      message: _$alepha.TString;
     }>;
   }>;
   /**
@@ -7986,47 +8050,47 @@ declare class UserController {
    * @param method - The verification method: "code" (default) sends a 6-digit code, "link" sends a clickable verification link.
    * @param verifyUrl - Required when method is "link". The base URL for the verification link. Token and email will be appended as query params.
    */
-  requestEmailVerification: alepha_server0.ActionPrimitiveFn<{
-    query: alepha.TObject<{
-      userRealmName: alepha.TOptional<alepha.TString>;
-      method: alepha.TOptional<alepha.TUnsafe<"link" | "code">>;
-      verifyUrl: alepha.TOptional<alepha.TString>;
+  requestEmailVerification: _$alepha_server0.ActionPrimitiveFn<{
+    query: _$alepha.TObject<{
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
+      method: _$alepha.TOptional<_$alepha.TUnsafe<"link" | "code">>;
+      verifyUrl: _$alepha.TOptional<_$alepha.TString>;
     }>;
-    body: alepha.TObject<{
-      email: alepha.TString;
+    body: _$alepha.TObject<{
+      email: _$alepha.TString;
     }>;
-    response: alepha.TObject<{
-      success: alepha.TBoolean;
-      message: alepha.TString;
+    response: _$alepha.TObject<{
+      success: _$alepha.TBoolean;
+      message: _$alepha.TString;
     }>;
   }>;
   /**
    * Verify email with a valid token.
    * Updates the user's emailVerified status.
    */
-  verifyEmail: alepha_server0.ActionPrimitiveFn<{
-    query: alepha.TObject<{
-      userRealmName: alepha.TOptional<alepha.TString>;
+  verifyEmail: _$alepha_server0.ActionPrimitiveFn<{
+    query: _$alepha.TObject<{
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
     }>;
-    body: alepha.TObject<{
-      email: alepha.TString;
-      token: alepha.TString;
+    body: _$alepha.TObject<{
+      email: _$alepha.TString;
+      token: _$alepha.TString;
     }>;
-    response: alepha.TObject<{
-      success: alepha.TBoolean;
-      message: alepha.TString;
+    response: _$alepha.TObject<{
+      success: _$alepha.TBoolean;
+      message: _$alepha.TString;
     }>;
   }>;
   /**
    * Check if an email is verified.
    */
-  checkEmailVerification: alepha_server0.ActionPrimitiveFn<{
-    query: alepha.TObject<{
-      email: alepha.TString;
-      userRealmName: alepha.TOptional<alepha.TString>;
+  checkEmailVerification: _$alepha_server0.ActionPrimitiveFn<{
+    query: _$alepha.TObject<{
+      email: _$alepha.TString;
+      userRealmName: _$alepha.TOptional<_$alepha.TString>;
     }>;
-    response: alepha.TObject<{
-      verified: alepha.TBoolean;
+    response: _$alepha.TObject<{
+      verified: _$alepha.TBoolean;
     }>;
   }>;
 }
@@ -8043,21 +8107,21 @@ declare class UserController {
  * It is lazy-loaded when the `sessionPurge` feature is enabled in the realm.
  */
 declare class UserJobs {
-  protected readonly log: alepha_logger0.Logger;
+  protected readonly log: _$alepha_logger0.Logger;
   protected readonly dateTimeProvider: DateTimeProvider;
-  protected readonly sessionRepository: alepha_orm0.Repository<alepha.TObject<{
-    id: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_PRIMARY_KEY>, typeof alepha_orm0.PG_DEFAULT>;
-    version: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TInteger, typeof alepha_orm0.PG_VERSION>, typeof alepha_orm0.PG_DEFAULT>;
-    createdAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_CREATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-    updatedAt: alepha_orm0.PgAttr<alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_UPDATED_AT>, typeof alepha_orm0.PG_DEFAULT>;
-    refreshToken: alepha.TString;
-    userId: alepha_orm0.PgAttr<alepha.TString, typeof alepha_orm0.PG_REF>;
-    expiresAt: alepha.TString;
-    ip: alepha.TOptional<alepha.TString>;
-    userAgent: alepha.TOptional<alepha.TObject<{
-      os: alepha.TString;
-      browser: alepha.TString;
-      device: alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  protected readonly sessionRepository: _$alepha_orm0.Repository<_$alepha.TObject<{
+    id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
+    version: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_VERSION>, typeof _$alepha_orm0.PG_DEFAULT>;
+    createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    refreshToken: _$alepha.TString;
+    userId: _$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_REF>;
+    expiresAt: _$alepha.TString;
+    ip: _$alepha.TOptional<_$alepha.TString>;
+    userAgent: _$alepha.TOptional<_$alepha.TObject<{
+      os: _$alepha.TString;
+      browser: _$alepha.TString;
+      device: _$alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
     }>>;
   }>>;
   /**
@@ -8066,158 +8130,125 @@ declare class UserJobs {
    * This job runs daily at 3:00 AM and removes all sessions
    * where the `expiresAt` timestamp has passed.
    */
-  readonly purgeExpiredSessions: alepha_api_jobs0.JobPrimitive<alepha.TSchema>;
-}
-//#endregion
-//#region ../../src/api/users/parameters/UserParameters.d.ts
-/**
- * User-specific parameter service.
- *
- * This service wraps the core ParameterProvider to provide realm settings management.
- * It is lazy-loaded when the `parameters` feature is enabled in the realm.
- */
-declare class UserParameters {
-  /**
-   * Realm authentication settings parameter.
-   *
-   * Controls user registration, login methods, verification requirements,
-   * and password policies for the realm.
-   */
-  readonly realmSettings: alepha_api_parameters0.ParameterPrimitive<typebox.TObject<{
-    displayName: typebox.TOptional<typebox.TString>;
-    description: typebox.TOptional<typebox.TString>;
-    logoUrl: typebox.TOptional<typebox.TString>;
-    registrationAllowed: typebox.TBoolean;
-    email: typebox.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-    username: typebox.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-    usernameRegExp: typebox.TString;
-    phoneNumber: typebox.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-    verifyEmailRequired: typebox.TBoolean;
-    verifyPhoneRequired: typebox.TBoolean;
-    firstNameLastName: typebox.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-    resetPasswordAllowed: typebox.TBoolean;
-    adminEmails: typebox.TArray<typebox.TString>;
-    adminUsernames: typebox.TArray<typebox.TString>;
-    passwordPolicy: typebox.TObject<{
-      minLength: typebox.TInteger;
-      requireUppercase: typebox.TBoolean;
-      requireLowercase: typebox.TBoolean;
-      requireNumbers: typebox.TBoolean;
-      requireSpecialCharacters: typebox.TBoolean;
-    }>;
-  }>>;
+  readonly purgeExpiredSessions: _$alepha_api_jobs0.JobPrimitive<_$alepha.TSchema>;
 }
 //#endregion
 //#region ../../src/api/users/schemas/identityResourceSchema.d.ts
-declare const identityResourceSchema: alepha.TObject<{
-  id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-  version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-  createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-  updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-  userId: PgAttr<alepha.TString, typeof PG_REF>;
-  provider: alepha.TString;
-  providerUserId: alepha.TOptional<alepha.TString>;
-  providerData: alepha.TOptional<alepha.TRecord<string, alepha.TAny>>;
+declare const identityResourceSchema: _$alepha.TObject<{
+  id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+  version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+  createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+  updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+  userId: PgAttr<_$alepha.TString, typeof PG_REF>;
+  provider: _$alepha.TString;
+  providerUserId: _$alepha.TOptional<_$alepha.TString>;
+  providerData: _$alepha.TOptional<_$alepha.TRecord<string, _$alepha.TAny>>;
 }>;
 type IdentityResource = Static<typeof identityResourceSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/loginSchema.d.ts
-declare const loginSchema: alepha.TObject<{
-  username: alepha.TString;
-  password: alepha.TString;
+declare const loginSchema: _$alepha.TObject<{
+  username: _$alepha.TString;
+  password: _$alepha.TString;
 }>;
 type LoginInput = Static<typeof loginSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/realmConfigSchema.d.ts
-declare const realmConfigSchema: alepha.TObject<{
-  settings: alepha.TObject<{
-    displayName: alepha.TOptional<alepha.TString>;
-    description: alepha.TOptional<alepha.TString>;
-    logoUrl: alepha.TOptional<alepha.TString>;
-    registrationAllowed: alepha.TBoolean;
-    email: alepha.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-    username: alepha.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-    usernameRegExp: alepha.TString;
-    phoneNumber: alepha.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-    verifyEmailRequired: alepha.TBoolean;
-    verifyPhoneRequired: alepha.TBoolean;
-    firstNameLastName: alepha.TUnion<[typebox.TLiteral<"none">, typebox.TLiteral<"optional">, typebox.TLiteral<"required">]>;
-    resetPasswordAllowed: alepha.TBoolean;
-    adminEmails: alepha.TArray<alepha.TString>;
-    adminUsernames: alepha.TArray<alepha.TString>;
-    passwordPolicy: alepha.TObject<{
-      minLength: alepha.TInteger;
-      requireUppercase: alepha.TBoolean;
-      requireLowercase: alepha.TBoolean;
-      requireNumbers: alepha.TBoolean;
-      requireSpecialCharacters: alepha.TBoolean;
+declare const realmConfigSchema: _$alepha.TObject<{
+  settings: _$alepha.TObject<{
+    displayName: _$alepha.TOptional<_$alepha.TString>;
+    description: _$alepha.TOptional<_$alepha.TString>;
+    logoUrl: _$alepha.TOptional<_$alepha.TString>;
+    registrationAllowed: _$alepha.TBoolean;
+    email: _$alepha.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
+    username: _$alepha.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
+    usernameRegExp: _$alepha.TString;
+    phoneNumber: _$alepha.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
+    verifyEmailRequired: _$alepha.TBoolean;
+    verifyPhoneRequired: _$alepha.TBoolean;
+    firstNameLastName: _$alepha.TUnion<[_$typebox.TLiteral<"none">, _$typebox.TLiteral<"optional">, _$typebox.TLiteral<"required">]>;
+    resetPasswordAllowed: _$alepha.TBoolean;
+    adminEmails: _$alepha.TArray<_$alepha.TString>;
+    adminUsernames: _$alepha.TArray<_$alepha.TString>;
+    passwordPolicy: _$alepha.TObject<{
+      minLength: _$alepha.TInteger;
+      requireUppercase: _$alepha.TBoolean;
+      requireLowercase: _$alepha.TBoolean;
+      requireNumbers: _$alepha.TBoolean;
+      requireSpecialCharacters: _$alepha.TBoolean;
+    }>;
+    loginRateLimit: _$alepha.TObject<{
+      ipMaxAttempts: _$alepha.TInteger;
+      accountMaxAttempts: _$alepha.TInteger;
+      windowMs: _$alepha.TInteger;
     }>;
   }>;
-  realmName: alepha.TString;
-  authenticationMethods: alepha.TArray<alepha.TObject<{
-    name: alepha.TString;
-    type: alepha.TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
+  realmName: _$alepha.TString;
+  authenticationMethods: _$alepha.TArray<_$alepha.TObject<{
+    name: _$alepha.TString;
+    type: _$alepha.TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
   }>>;
 }>;
 type RealmConfig = Static<typeof realmConfigSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/registerSchema.d.ts
-declare const registerSchema: alepha.TObject<{
-  username: alepha.TString;
-  email: alepha.TString;
-  password: alepha.TString;
-  confirmPassword: alepha.TString;
-  firstName: alepha.TOptional<alepha.TString>;
-  lastName: alepha.TOptional<alepha.TString>;
+declare const registerSchema: _$alepha.TObject<{
+  username: _$alepha.TString;
+  email: _$alepha.TString;
+  password: _$alepha.TString;
+  confirmPassword: _$alepha.TString;
+  firstName: _$alepha.TOptional<_$alepha.TString>;
+  lastName: _$alepha.TOptional<_$alepha.TString>;
 }>;
 type RegisterInput = Static<typeof registerSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/resetPasswordSchema.d.ts
-declare const resetPasswordRequestSchema: alepha.TObject<{
-  email: alepha.TString;
+declare const resetPasswordRequestSchema: _$alepha.TObject<{
+  email: _$alepha.TString;
 }>;
-declare const resetPasswordSchema: alepha.TObject<{
-  token: alepha.TString;
-  password: alepha.TString;
-  confirmPassword: alepha.TString;
+declare const resetPasswordSchema: _$alepha.TObject<{
+  token: _$alepha.TString;
+  password: _$alepha.TString;
+  confirmPassword: _$alepha.TString;
 }>;
 type ResetPasswordRequest = Static<typeof resetPasswordRequestSchema>;
 type ResetPasswordInput = Static<typeof resetPasswordSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/sessionResourceSchema.d.ts
-declare const sessionResourceSchema: alepha.TObject<{
-  id: alepha.TString;
-  version: alepha.TNumber;
-  createdAt: alepha.TString;
-  updatedAt: alepha.TString;
-  refreshToken: alepha.TString;
-  userId: alepha.TString;
-  expiresAt: alepha.TString;
-  ip: alepha.TOptional<alepha.TString>;
-  userAgent: alepha.TOptional<alepha.TObject<{
-    os: alepha.TString;
-    browser: alepha.TString;
-    device: alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+declare const sessionResourceSchema: _$alepha.TObject<{
+  id: _$alepha.TString;
+  version: _$alepha.TNumber;
+  createdAt: _$alepha.TString;
+  updatedAt: _$alepha.TString;
+  refreshToken: _$alepha.TString;
+  userId: _$alepha.TString;
+  expiresAt: _$alepha.TString;
+  ip: _$alepha.TOptional<_$alepha.TString>;
+  userAgent: _$alepha.TOptional<_$alepha.TObject<{
+    os: _$alepha.TString;
+    browser: _$alepha.TString;
+    device: _$alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
   }>>;
 }>;
 type SessionResource = Static<typeof sessionResourceSchema>;
 //#endregion
 //#region ../../src/api/users/schemas/userResourceSchema.d.ts
-declare const userResourceSchema: alepha.TObject<{
-  id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-  version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-  createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-  updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-  realm: PgAttr<alepha.TString, typeof PG_DEFAULT>;
-  username: alepha.TOptional<alepha.TString>;
-  email: alepha.TOptional<alepha.TString>;
-  phoneNumber: alepha.TOptional<alepha.TString>;
-  roles: PgAttr<alepha.TArray<alepha.TString>, typeof PG_DEFAULT>;
-  firstName: alepha.TOptional<alepha.TString>;
-  lastName: alepha.TOptional<alepha.TString>;
-  picture: alepha.TOptional<alepha.TString>;
-  enabled: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
-  emailVerified: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
+declare const userResourceSchema: _$alepha.TObject<{
+  id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+  version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+  createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+  updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+  realm: PgAttr<_$alepha.TString, typeof PG_DEFAULT>;
+  username: _$alepha.TOptional<_$alepha.TString>;
+  email: _$alepha.TOptional<_$alepha.TString>;
+  phoneNumber: _$alepha.TOptional<_$alepha.TString>;
+  roles: PgAttr<_$alepha.TArray<_$alepha.TString>, typeof PG_DEFAULT>;
+  firstName: _$alepha.TOptional<_$alepha.TString>;
+  lastName: _$alepha.TOptional<_$alepha.TString>;
+  picture: _$alepha.TOptional<_$alepha.TString>;
+  enabled: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+  emailVerified: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+  organizationId: PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof PG_ORGANIZATION>;
 }>;
 type UserResource = Static<typeof userResourceSchema>;
 //#endregion
@@ -8227,51 +8258,53 @@ declare class SessionService {
   protected readonly fsp: FileSystemProvider;
   protected readonly dateTimeProvider: DateTimeProvider;
   protected readonly cryptoProvider: CryptoProvider;
-  protected readonly log: alepha_logger0.Logger;
+  protected readonly log: _$alepha_logger0.Logger;
   protected readonly realmProvider: RealmProvider;
-  protected readonly fileController: alepha_server_links0.HttpVirtualClient<FileController>;
+  protected readonly fileController: _$alepha_server_links0.HttpVirtualClient<FileController>;
+  protected readonly cacheProvider: CacheProvider;
   protected userAudits(realmName?: string): UserAudits | undefined;
-  users(userRealmName?: string): Repository$1<alepha.TObject<{
-    id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    realm: PgAttr<alepha.TString, typeof PG_DEFAULT>;
-    username: alepha.TOptional<alepha.TString>;
-    email: alepha.TOptional<alepha.TString>;
-    phoneNumber: alepha.TOptional<alepha.TString>;
-    roles: PgAttr<alepha.TArray<alepha.TString>, typeof PG_DEFAULT>;
-    firstName: alepha.TOptional<alepha.TString>;
-    lastName: alepha.TOptional<alepha.TString>;
-    picture: alepha.TOptional<alepha.TString>;
-    enabled: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
-    emailVerified: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
+  users(userRealmName?: string): Repository$1<_$alepha.TObject<{
+    id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    realm: PgAttr<_$alepha.TString, typeof PG_DEFAULT>;
+    username: _$alepha.TOptional<_$alepha.TString>;
+    email: _$alepha.TOptional<_$alepha.TString>;
+    phoneNumber: _$alepha.TOptional<_$alepha.TString>;
+    roles: PgAttr<_$alepha.TArray<_$alepha.TString>, typeof PG_DEFAULT>;
+    firstName: _$alepha.TOptional<_$alepha.TString>;
+    lastName: _$alepha.TOptional<_$alepha.TString>;
+    picture: _$alepha.TOptional<_$alepha.TString>;
+    enabled: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+    emailVerified: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+    organizationId: PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof PG_ORGANIZATION>;
   }>>;
-  sessions(userRealmName?: string): Repository$1<alepha.TObject<{
-    id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    refreshToken: alepha.TString;
-    userId: PgAttr<alepha.TString, typeof PG_REF>;
-    expiresAt: alepha.TString;
-    ip: alepha.TOptional<alepha.TString>;
-    userAgent: alepha.TOptional<alepha.TObject<{
-      os: alepha.TString;
-      browser: alepha.TString;
-      device: alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
+  sessions(userRealmName?: string): Repository$1<_$alepha.TObject<{
+    id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    refreshToken: _$alepha.TString;
+    userId: PgAttr<_$alepha.TString, typeof PG_REF>;
+    expiresAt: _$alepha.TString;
+    ip: _$alepha.TOptional<_$alepha.TString>;
+    userAgent: _$alepha.TOptional<_$alepha.TObject<{
+      os: _$alepha.TString;
+      browser: _$alepha.TString;
+      device: _$alepha.TUnsafe<"MOBILE" | "DESKTOP" | "TABLET">;
     }>>;
   }>>;
-  identities(userRealmName?: string): Repository$1<alepha.TObject<{
-    id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-    version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-    createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-    updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-    userId: PgAttr<alepha.TString, typeof PG_REF>;
-    password: alepha.TOptional<alepha.TString>;
-    provider: alepha.TString;
-    providerUserId: alepha.TOptional<alepha.TString>;
-    providerData: alepha.TOptional<alepha.TRecord<string, alepha.TAny>>;
+  identities(userRealmName?: string): Repository$1<_$alepha.TObject<{
+    id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+    version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+    createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+    updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+    userId: PgAttr<_$alepha.TString, typeof PG_REF>;
+    password: _$alepha.TOptional<_$alepha.TString>;
+    provider: _$alepha.TString;
+    providerUserId: _$alepha.TOptional<_$alepha.TString>;
+    providerData: _$alepha.TOptional<_$alepha.TRecord<string, _$alepha.TAny>>;
   }>>;
   /**
    * Check if user should be auto-promoted to admin based on adminEmails/adminUsernames settings.
@@ -8283,11 +8316,33 @@ declare class SessionService {
     username?: string | null;
     roles: string[];
   }, userRealmName?: string): Promise<boolean>;
+  /**
+   * Generate a unique username from an OAuth profile.
+   *
+   * 1. Extract candidate from email prefix
+   * 2. Sanitize against realm's usernameRegExp (strip invalid chars, truncate)
+   * 3. Check case-insensitive uniqueness, append suffix (2, 3, ...) if taken
+   * 4. Fall back to "user" + random 6-char alphanumeric if all else fails
+   */
+  protected generateUniqueUsername(profile: OAuth2Profile, realmSettings: any, users: any): Promise<string>;
   /**
    * Random delay to prevent timing attacks (50-200ms)
    * Uses cryptographically secure random number generation
    */
   protected randomDelay(): Promise<void>;
+  protected static readonly LOGIN_CACHE_NAME = "login-rate-limit";
+  /**
+   * Check if a login key is currently locked out.
+   * Read-only — does not increment the counter.
+   */
+  protected isLoginLocked(key: string, max: number): Promise<boolean>;
+  /**
+   * Record a failed login attempt. Uses getTyped + setTyped (not incr) so that
+   * each write refreshes the TTL — implementing sliding-window behavior.
+   *
+   * Returns `true` if this failure just crossed the lockout threshold.
+   */
+  protected recordFailedLogin(key: string, max: number, windowMs: number): Promise<boolean>;
   /**
    * Validate user credentials and return the user if valid.
    */
@@ -8297,36 +8352,38 @@ declare class SessionService {
     sessionId: string;
   }>;
   refreshSession(refreshToken: string, userRealmName?: string): Promise<{
-    user: PgStatic<alepha.TObject<{
-      id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<alepha.TString, typeof PG_DEFAULT>;
-      username: alepha.TOptional<alepha.TString>;
-      email: alepha.TOptional<alepha.TString>;
-      phoneNumber: alepha.TOptional<alepha.TString>;
-      roles: PgAttr<alepha.TArray<alepha.TString>, typeof PG_DEFAULT>;
-      firstName: alepha.TOptional<alepha.TString>;
-      lastName: alepha.TOptional<alepha.TString>;
-      picture: alepha.TOptional<alepha.TString>;
-      enabled: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
-    }>, PgRelationMap<alepha.TObject<{
-      id: PgAttr<PgAttr<alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-      version: PgAttr<PgAttr<alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
-      createdAt: PgAttr<PgAttr<alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-      updatedAt: PgAttr<PgAttr<alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
-      realm: PgAttr<alepha.TString, typeof PG_DEFAULT>;
-      username: alepha.TOptional<alepha.TString>;
-      email: alepha.TOptional<alepha.TString>;
-      phoneNumber: alepha.TOptional<alepha.TString>;
-      roles: PgAttr<alepha.TArray<alepha.TString>, typeof PG_DEFAULT>;
-      firstName: alepha.TOptional<alepha.TString>;
-      lastName: alepha.TOptional<alepha.TString>;
-      picture: alepha.TOptional<alepha.TString>;
-      enabled: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
-      emailVerified: PgAttr<alepha.TBoolean, typeof PG_DEFAULT>;
+    user: PgStatic<_$alepha.TObject<{
+      id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<_$alepha.TString, typeof PG_DEFAULT>;
+      username: _$alepha.TOptional<_$alepha.TString>;
+      email: _$alepha.TOptional<_$alepha.TString>;
+      phoneNumber: _$alepha.TOptional<_$alepha.TString>;
+      roles: PgAttr<_$alepha.TArray<_$alepha.TString>, typeof PG_DEFAULT>;
+      firstName: _$alepha.TOptional<_$alepha.TString>;
+      lastName: _$alepha.TOptional<_$alepha.TString>;
+      picture: _$alepha.TOptional<_$alepha.TString>;
+      enabled: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      organizationId: PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof PG_ORGANIZATION>;
+    }>, PgRelationMap<_$alepha.TObject<{
+      id: PgAttr<PgAttr<_$alepha.TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+      version: PgAttr<PgAttr<_$alepha.TInteger, typeof PG_VERSION>, typeof PG_DEFAULT>;
+      createdAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+      updatedAt: PgAttr<PgAttr<_$alepha.TString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
+      realm: PgAttr<_$alepha.TString, typeof PG_DEFAULT>;
+      username: _$alepha.TOptional<_$alepha.TString>;
+      email: _$alepha.TOptional<_$alepha.TString>;
+      phoneNumber: _$alepha.TOptional<_$alepha.TString>;
+      roles: PgAttr<_$alepha.TArray<_$alepha.TString>, typeof PG_DEFAULT>;
+      firstName: _$alepha.TOptional<_$alepha.TString>;
+      lastName: _$alepha.TOptional<_$alepha.TString>;
+      picture: _$alepha.TOptional<_$alepha.TString>;
+      enabled: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      emailVerified: PgAttr<_$alepha.TBoolean, typeof PG_DEFAULT>;
+      organizationId: PgAttr<_$alepha.TOptional<_$alepha.TString>, typeof PG_ORGANIZATION>;
     }>>>;
     expiresIn: number;
     sessionId: string;
@@ -8339,6 +8396,7 @@ declare class SessionService {
     firstName?: string | undefined;
     lastName?: string | undefined;
     picture?: string | undefined;
+    organizationId?: string | undefined;
     enabled: boolean;
     id: string;
     version: number;
@@ -8395,7 +8453,7 @@ declare class SessionService {
  *
  * @module alepha.api.users
  */
-declare const AlephaApiUsers: alepha.Service<alepha.Module>;
+declare const AlephaApiUsers: _$alepha.Service<_$alepha.Module>;
 //#endregion
-export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CompletePasswordResetRequest, CompleteRegistrationRequest, CreateUser, CredentialService, DEFAULT_USER_REALM_NAME, FieldRequirement, IdentityEntity, IdentityQuery, IdentityResource, IdentityService, LoginInput, PasswordResetIntentResponse, Realm, RealmAuthSettings, RealmConfig, RealmController, RealmFeatures, RealmOptions, RealmPrimitive, RealmProvider, RealmRepositories, RegisterInput, RegistrationIntentResponse, RegistrationService, ResetPasswordInput, ResetPasswordRequest, SessionCrudService, SessionEntity, SessionQuery, SessionResource, SessionService, UpdateUser, UserAudits, UserBuckets, UserController, UserEntity, UserJobs, UserNotifications, UserParameters, UserQuery, UserResource, UserService, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
+export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CompletePasswordResetRequest, CompleteRegistrationRequest, CreateUser, CredentialService, DEFAULT_USER_REALM_NAME, FieldRequirement, IdentityEntity, IdentityQuery, IdentityResource, IdentityService, LoginInput, PasswordResetIntentResponse, Realm, RealmAuthSettings, RealmConfig, RealmController, RealmFeatures, RealmOptions, RealmPrimitive, RealmProvider, RealmRepositories, RegisterInput, RegistrationIntentResponse, RegistrationService, ResetPasswordInput, ResetPasswordRequest, SessionCrudService, SessionEntity, SessionQuery, SessionResource, SessionService, UpdateUser, UserAudits, UserBuckets, UserController, UserEntity, UserJobs, UserNotifications, UserQuery, UserResource, UserService, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
 //# sourceMappingURL=index.d.ts.map