@better-auth/infra 0.2.10 → 0.2.12

package/dist/client.mjs

@@ -422,6 +422,8 @@ async function waitForIdentify(timeoutMs) {
 }
 //#endregion
 //#region src/sentinel/client.ts
+/** One recovery round after a consumed or superseded challenge (e.g. double-submit). */
+const MAX_POW_CHALLENGE_ROUNDS = 2;
 const sentinelClient = (options) => {
 	const autoSolve = options?.autoSolveChallenge !== false;
 	const $kv = createKV({
@@ -470,50 +472,55 @@ const sentinelClient = (options) => {
 				async onResponse(context) {
 					if (typeof window === "undefined") return context;
 					if (context.response.status !== 423 || !autoSolve) return context;
-					const challengeHeader = context.response.headers.get("X-PoW-Challenge");
-					const reason = context.response.headers.get("X-PoW-Reason") || "";
-					if (!challengeHeader) return context;
-					options?.onChallengeReceived?.(reason);
-					const challenge = decodePoWChallenge(challengeHeader);
-					if (!challenge) return context;
-					try {
-						const startTime = Date.now();
-						const solution = await solvePoWChallenge(challenge);
-						const solveTime = Date.now() - startTime;
-						options?.onChallengeSolved?.(solveTime);
-						const originalUrl = context.response.url;
-						const fingerprint = await getFingerprint();
-						const retryHeaders = new Headers();
-						retryHeaders.set("X-PoW-Solution", encodePoWSolution(solution));
-						if (fingerprint) {
-							retryHeaders.set("X-Visitor-Id", fingerprint.visitorId);
-							retryHeaders.set("X-Request-Id", fingerprint.requestId);
-						}
-						retryHeaders.set("Content-Type", "application/json");
-						let body;
-						if (context.request && context.request.body) body = context.request._originalBody;
-						const req = context.request;
-						const powRetry = createPowRetryTimeout(req.timeout);
+					if (!context.response.headers.get("X-PoW-Challenge")) return context;
+					const req = context.request;
+					let response = context.response;
+					const url = response.url;
+					const body = req._originalBody;
+					for (let round = 0; round < MAX_POW_CHALLENGE_ROUNDS; round++) {
+						if (response.status !== 423) break;
+						const challengeHeader = response.headers.get("X-PoW-Challenge");
+						if (!challengeHeader) break;
+						const reason = response.headers.get("X-PoW-Reason") || "";
+						options?.onChallengeReceived?.(reason);
+						const challenge = decodePoWChallenge(challengeHeader);
+						if (!challenge) break;
 						try {
-							const retryResponse = await fetch(originalUrl, {
-								method: req.method || "POST",
-								headers: retryHeaders,
-								body,
-								credentials: "include",
-								...powRetry.signal ? { signal: powRetry.signal } : {}
-							});
-							return {
-								...context,
-								response: retryResponse
-							};
-						} finally {
-							powRetry.cleanup?.();
+							const startTime = Date.now();
+							const solution = await solvePoWChallenge(challenge);
+							options?.onChallengeSolved?.(Date.now() - startTime);
+							const fingerprint = await getFingerprint();
+							const retryHeaders = new Headers();
+							retryHeaders.set("X-PoW-Solution", encodePoWSolution(solution));
+							if (fingerprint) {
+								retryHeaders.set("X-Visitor-Id", fingerprint.visitorId);
+								retryHeaders.set("X-Request-Id", fingerprint.requestId);
+							}
+							retryHeaders.set("Content-Type", "application/json");
+							const powRetry = createPowRetryTimeout(req.timeout);
+							try {
+								response = await fetch(url, {
+									method: req.method || "POST",
+									headers: retryHeaders,
+									body,
+									credentials: "include",
+									...powRetry.signal ? { signal: powRetry.signal } : {}
+								});
+							} finally {
+								powRetry.cleanup?.();
+							}
+							if (response.status !== 423) break;
+							if (!response.headers.get("X-PoW-Challenge")) break;
+						} catch (error) {
+							console.error("[Sentinel] Failed to solve PoW challenge:", error);
+							options?.onChallengeFailed?.(error instanceof Error ? error : new Error(String(error)));
+							return context;
 						}
-					} catch (error) {
-						console.error("[Sentinel] Failed to solve PoW challenge:", error);
-						options?.onChallengeFailed?.(error instanceof Error ? error : new Error(String(error)));
-						return context;
 					}
+					return {
+						...context,
+						response
+					};
 				},
 				async onRequest(context) {
 					if (context.body) context._originalBody = context.body;

package/dist/index.d.mts

@@ -117,6 +117,8 @@ interface SecurityVerdict {
   challenge?: string;
   reason?: string;
   details?: Record<string, unknown>;
+  /** Set when the request included a valid, consumed PoW solution. */
+  powVerified?: boolean;
 }
 interface CredentialStuffingResult {
   blocked: boolean;
@@ -265,7 +267,7 @@ declare const sentinel: (options?: SentinelOptions) => {
   };
   hooks: {
     before: ({
-      matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+      matcher: (context: Pick<import("better-auth").HookEndpointContext, "path">) => boolean;
       handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         context: {
           method: "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
@@ -437,7 +439,7 @@ declare const sentinel: (options?: SentinelOptions) => {
         };
       } | undefined>;
     } | {
-      matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+      matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
       handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     })[];
     after: {
@@ -555,6 +557,8 @@ type InfraEndpointContext = (GenericEndpointContext & {
     identification?: Identification | null | undefined;
     visitorId: string | null;
     requestId: string | null;
+    ip: string | null;
+    untrustedVisitorId: string | null;
     location: LocationData | undefined;
   };
 }) | undefined;
@@ -770,7 +774,7 @@ interface DashIdRow {
   id: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@better-auth+scim@1.6.11+89e630460ed02574/node_modules/@better-auth/scim/dist/index.d.mts
+//#region ../../node_modules/.bun/@better-auth+scim@1.6.11+25e6a1339d5195dd/node_modules/@better-auth/scim/dist/index.d.mts
 //#region src/types.d.ts
 interface SCIMProvider {
   id: string;
@@ -4523,7 +4527,6 @@ interface DashTwoFactorEnableResponse {
 }
 interface DashTwoFactorTotpViewResponse {
   totpURI: string;
-  secret: string;
 }
 interface DashTwoFactorBackupCodesResponse {
   backupCodes: string[];
@@ -5771,12 +5774,50 @@ declare const dash: <O extends DashOptions>(options?: O) => {
       body: import("zod").ZodObject<{
         token: import("zod").ZodString;
         password: import("zod").ZodOptional<import("zod").ZodString>;
-        providerId: import("zod").ZodOptional<import("zod").ZodString>;
-        providerAccountId: import("zod").ZodOptional<import("zod").ZodString>;
-        accessToken: import("zod").ZodOptional<import("zod").ZodString>;
-        refreshToken: import("zod").ZodOptional<import("zod").ZodString>;
       }, import("zod/v4/core").$strip>;
     }, DashCompleteInvitationResponse>;
+    dashCompleteInvitationSocial: import("better-call").StrictEndpoint<"/dash/complete-invitation-social", {
+      method: "GET";
+      query: import("zod").ZodObject<{
+        token: import("zod").ZodString;
+      }, import("zod/v4/core").$strip>;
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>)[];
+    }, {
+      status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | import("better-call").Status;
+      body: ({
+        message?: string;
+        code?: string;
+        cause?: unknown;
+      } & Record<string, any>) | undefined;
+      headers: HeadersInit;
+      statusCode: number;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    }>;
     dashCheckUserExists: import("better-call").StrictEndpoint<"/dash/check-user-exists", {
       method: "POST";
       use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{

package/dist/index.mjs

@@ -942,45 +942,67 @@ function extractIdentificationHeaders(request) {
 	};
 }
 /**
+* Visitor ID for security enforcement from a loaded identification record —
+* not a client-supplied X-Visitor-Id header alone.
+*/
+function resolveSecurityVisitorId(headerVisitorId, identification) {
+	const identified = identification?.visitorId ?? null;
+	if (!identified) return null;
+	if (headerVisitorId && headerVisitorId !== identified) logger.warn("[Sentinel] X-Visitor-Id does not match identification; using identification visitorId for security checks.");
+	return identified;
+}
+/** IP for security checks: prefer identify record, then request-derived fallback. */
+function resolveSecurityIp(identification, location) {
+	return identification?.ip ?? location?.ipAddress ?? null;
+}
+/**
+* Visitor id for observability and failed-login tracking when identification
+* is unavailable. Prefer bound visitor id, then a stable IP bucket; header is
+* legacy fallback only — not used for enforcement.
+*/
+function resolveUntrustedVisitorId(visitorId, ip, headerVisitorId) {
+	if (visitorId) return visitorId;
+	if (ip) return `ip:${ip}`;
+	return headerVisitorId;
+}
+/**
 * Early middleware that loads identification data.
 *
 * @param $kv — KV client from {@link createKV} for the same plugin options (one instance per plugin).
 */
 function createIdentificationMiddleware($kv) {
 	return createAuthMiddleware(async (ctx) => {
-		const { visitorId, requestId: headerRequestId } = extractIdentificationHeaders(ctx.request);
+		const { visitorId: headerVisitorId, requestId: headerRequestId } = extractIdentificationHeaders(ctx.request);
 		const requestId = headerRequestId ?? ctx.getCookie("__infra-rid") ?? null;
-		ctx.context.visitorId = visitorId;
 		ctx.context.requestId = requestId;
 		if (requestId) {
 			if (ctx.context.identification === void 0) ctx.context.identification = await getIdentification(requestId, $kv) ?? null;
 		} else ctx.context.identification = null;
-		const ipConfig = ctx.context.options?.advanced?.ipAddress;
-		if (ipConfig?.disableIpTracking === true) {
-			ctx.context.location = void 0;
-			return;
-		}
 		const identification = ctx.context.identification;
-		if (requestId && identification) {
+		const visitorId = resolveSecurityVisitorId(headerVisitorId, identification);
+		ctx.context.visitorId = visitorId;
+		const ipConfig = ctx.context.options?.advanced?.ipAddress;
+		let location;
+		if (ipConfig?.disableIpTracking === true) location = void 0;
+		else if (requestId && identification) {
 			const loc = getLocation(identification);
-			ctx.context.location = {
+			location = {
 				ipAddress: identification.ip || void 0,
 				city: loc?.city || void 0,
 				country: loc?.country?.name || void 0,
 				countryCode: loc?.country?.code || void 0
 			};
-			return;
-		}
-		const ipAddress = getClientIpFromRequest(ctx.request, ipConfig?.ipAddressHeaders || null);
-		if (ipAddress) {
-			const countryCode = getCountryCodeFromRequest(ctx.request);
-			ctx.context.location = {
+		} else {
+			const ipAddress = getClientIpFromRequest(ctx.request, ipConfig?.ipAddressHeaders || null);
+			if (ipAddress) location = {
 				ipAddress,
-				countryCode
+				countryCode: getCountryCodeFromRequest(ctx.request)
 			};
-			return;
+			else location = void 0;
 		}
-		ctx.context.location = void 0;
+		ctx.context.location = location;
+		ctx.context.ip = resolveSecurityIp(identification, location);
+		ctx.context.untrustedVisitorId = resolveUntrustedVisitorId(visitorId, ctx.context.ip, headerVisitorId);
 	});
 }
 /**
@@ -1024,7 +1046,13 @@ function getEvaluation(ctx) {
 function recordCheck(ctx, name) {
 	getEvaluation(ctx).checks.add(name);
 }
-/** Call immediately before throwing so the buffer reflects the final outcome. */
+/**
+* Call immediately before throwing so the buffer reflects the final outcome.
+*
+* `details.reason`, when set, is surfaced as the top-level dashboard reason
+* (see `emitEvaluation`) — so it must be a renderable reason, not a free-form
+* value. Put internal sub-states under a different key (e.g. `phase`).
+*/
 function setOutcome(ctx, outcome, triggeredBy, details) {
 	const ev = getEvaluation(ctx);
 	ev.outcome = outcome;
@@ -1052,6 +1080,7 @@ function emitEvaluation(ctx, trackEvent, options = {}) {
 			outcome: ev.outcome,
 			evaluatedChecks: [...ev.checks].sort(),
 			triggeredBy: ev.triggeredBy,
+			reason: ev.details?.reason ?? ev.triggeredBy,
 			identifier: options.identifier,
 			path,
 			userAgent: options.userAgent,
@@ -1171,9 +1200,11 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				logger.error("[Dash] Clear failed attempts error:", error);
 			}
 		},
-		async isBlocked(visitorId) {
+		async isBlocked(visitorId, ip) {
 			try {
-				return (await $api(`/security/is-blocked?visitorId=${encodeURIComponent(visitorId)}`, { method: "GET" })).blocked ?? false;
+				const params = new URLSearchParams({ visitorId });
+				if (ip) params.set("ip", ip);
+				return (await $api(`/security/is-blocked?${params.toString()}`, { method: "GET" })).blocked ?? false;
 			} catch (error) {
 				logger.warn("[Dash] Security is-blocked check failed:", error);
 				return false;
@@ -1483,52 +1514,47 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 }
 //#endregion
 //#region src/validation/matchers.ts
-const all = new Set([
+/**
+* Routes where a new or changed email address enters the system. Deliverability
+* and disposable validation runs here so invalid addresses are caught at the
+* source.
+*/
+const registrationPaths = [
 	"/sign-up/email",
-	"/email-otp/verify-email",
-	"/sign-in/email-otp",
-	"/sign-in/magic-link",
-	"/sign-in/email",
-	"/forget-password/email-otp",
-	"/email-otp/reset-password",
-	"/email-otp/create-verification-otp",
-	"/email-otp/get-verification-otp",
-	"/email-otp/send-verification-otp",
-	"/forget-password",
-	"/request-password-reset",
-	"/send-verification-email",
 	"/change-email",
 	"/organization/invite-member",
 	"/dash/organization/invite-member",
 	"/dash/create-user",
 	"/dash/update-user"
-]);
+];
 /**
-* Path is one of `[
-*   '/sign-up/email',
-*   '/email-otp/verify-email',
-*   '/sign-in/email-otp',
-*   '/sign-in/magic-link',
-*   '/sign-in/email',
-*   '/forget-password/email-otp',
-*   '/email-otp/reset-password',
-*   '/email-otp/create-verification-otp',
-*   '/email-otp/get-verification-otp',
-*   '/email-otp/send-verification-otp',
-*   '/forget-password',
-*   '/request-password-reset',
-*   '/send-verification-email',
-*   '/change-email',
-*   '/organization/invite-member',
-*   '/dash/organization/invite-member',
-*   '/dash/create-user',
-*   '/dash/update-user'
-* ]`.
-* @param context Request context
-* @param context.path Request path
-* @returns boolean
+* Authentication and account-recovery routes. These act on an already-known
+* address, so only the syntax check runs — a deliverability false-positive must
+* never lock out an existing user (better-auth#9803).
 */
+const authPaths = [
+	"/sign-in/email",
+	"/sign-in/email-otp",
+	"/sign-in/magic-link",
+	"/forget-password",
+	"/forget-password/email-otp",
+	"/request-password-reset",
+	"/send-verification-email",
+	"/email-otp/verify-email",
+	"/email-otp/reset-password",
+	"/email-otp/create-verification-otp",
+	"/email-otp/get-verification-otp",
+	"/email-otp/send-verification-otp"
+];
+const registration = new Set(registrationPaths);
+const all = new Set([...registrationPaths, ...authPaths]);
+/** Path carries an email we hook for normalization + syntax validation. */
 const allEmail = ({ path }) => !!path && all.has(path);
+/**
+* Path introduces a new or changed address — run full deliverability/disposable
+* validation. Authentication routes are intentionally excluded.
+*/
+const registrationEmail = ({ path }) => !!path && registration.has(path);
 //#endregion
 //#region src/validation/email.ts
 /**
@@ -1624,7 +1650,7 @@ async validate(email, checkMx = true) {
 			policy
 		};
 		try {
-			const { data } = await $kv("/email/validate", {
+			const { data, error } = await $kv("/email/validate", {
 				method: "POST",
 				body: {
 					email: trimmed,
@@ -1632,11 +1658,15 @@ async validate(email, checkMx = true) {
 					strictness: policy.strictness
 				}
 			});
+			if (error || !data) {
+				logger.warn("[Dash] Email validation unavailable, allowing email:", error);
+				return {
+					valid: true,
+					policy
+				};
+			}
 			return {
-				...data || {
-					valid: false,
-					reason: "invalid_format"
-				},
+				...data,
 				policy
 			};
 		} catch (error) {
@@ -1649,6 +1679,26 @@ async validate(email, checkMx = true) {
 	} };
 }
 /**
+* Map a raw validation result to a single dashboard reason and user-facing
+* message. One source so the recorded reason and the thrown message can't drift,
+* and a block always carries a populated reason (better-auth#9803).
+*/
+function resolveEmailBlock(result) {
+	const raw = result.reason ?? "";
+	if (result.disposable || raw === "blocklist" || raw.startsWith("known_disposable")) return {
+		reason: "disposable_email",
+		message: "Disposable email addresses are not allowed"
+	};
+	if (raw === "no_mx_records") return {
+		reason: "no_mx_records",
+		message: "This email domain cannot receive emails"
+	};
+	return {
+		reason: "invalid_email",
+		message: "This email address appears to be invalid"
+	};
+}
+/**
 * Basic local email format validation (fallback)
 */
 function isValidEmailFormatLocal(email) {
@@ -1714,14 +1764,15 @@ function createEmailValidationHook(validator, trackEvent) {
 			if (!isValidEmailFormatLocal(trimmed)) {
 				if (trackEvent) {
 					setOutcome(ctx, "blocked", "email_validity", {
-						reason: "invalid_format",
+						reason: "invalid_email",
+						rawReason: "invalid_format",
 						email: trimmed
 					});
 					emitEvaluation(ctx, trackEvent, { identifier: trimmed });
 				}
 				throw new APIError$1("BAD_REQUEST", { message: "Invalid email" });
 			}
-			if (validator) {
+			if (validator && registrationEmail(ctx)) {
 				const result = await validator.validate(trimmed);
 				const policy = result.policy;
 				if (!policy?.enabled) return;
@@ -1732,10 +1783,11 @@ function createEmailValidationHook(validator, trackEvent) {
 				const action = policy.action;
 				if (!result.valid) {
 					if (action === "allow") return;
-					const message = result.reason === "no_mx_records" ? "This email domain cannot receive emails" : result.disposable || result.reason === "blocklist" ? "Disposable email addresses are not allowed" : result.reason === "known_invalid_email" || result.reason === "known_invalid_host" || result.reason === "reserved_tld" || result.reason === "provider_local_too_short" ? "This email address appears to be invalid" : "Invalid email";
+					const { reason, message } = resolveEmailBlock(result);
 					if (trackEvent) {
 						setOutcome(ctx, "blocked", "email_validity", {
-							reason: result.reason,
+							reason,
+							rawReason: result.reason,
 							confidence: result.confidence,
 							email: trimmed
 						});
@@ -2006,6 +2058,7 @@ function throwChallengeError(challenge, reason, message = "Please complete a sec
 }
 /** Emits the `security_check` event inline before throwing — the after-hook won't run on throw. */
 async function handleSecurityVerdict(verdict, hookCtx, checkCtx, trackEvent, securityService) {
+	if (verdict.powVerified) recordCheck(hookCtx, "pow_challenge");
 	if (verdict.action === "allow") return;
 	const reason = verdict.reason || "unknown";
 	if (verdict.action === "challenge" && checkCtx.visitorId) {
@@ -2040,15 +2093,15 @@ async function handleSecurityVerdict(verdict, hookCtx, checkCtx, trackEvent, sec
 * Single API call from the plugin; server runs all configured rules and returns
 * one verdict — counts as one billable check.
 */
-async function runSecurityChecks(hookCtx, checkCtx, securityService, trackEvent, powVerified) {
-	if (powVerified) return;
+async function runSecurityChecks(hookCtx, checkCtx, securityService, trackEvent, powSolution) {
 	recordCheck(hookCtx, "server_security_check");
 	await handleSecurityVerdict(await securityService.checkSecurity({
 		visitorId: checkCtx.visitorId,
 		requestId: checkCtx.identification?.requestId || null,
-		ip: checkCtx.identification?.ip || null,
+		ip: checkCtx.ip,
 		path: checkCtx.path,
-		identifier: checkCtx.identifier
+		identifier: checkCtx.identifier,
+		powSolution: powSolution ?? void 0
 	}), hookCtx, checkCtx, trackEvent, securityService);
 }
 //#endregion
@@ -2228,16 +2281,6 @@ const sentinel = (options) => {
 					matcher: (ctx) => ctx.request?.method !== "GET",
 					handler: createIdentificationMiddleware($kv)
 				},
-				{
-					matcher: (ctx) => ctx.request?.method !== "GET",
-					handler: createAuthMiddleware(async (ctx) => {
-						const visitorId = ctx.context.visitorId;
-						const powSolution = ctx.headers?.get?.("X-PoW-Solution");
-						if (visitorId && powSolution) {
-							if ((await securityService.verifyPoWSolution(visitorId, powSolution)).valid) ctx.context.powVerified = true;
-						}
-					})
-				},
 				...emailHooks.before,
 				...phoneValidationHooks.before,
 				{
@@ -2245,6 +2288,7 @@ const sentinel = (options) => {
 					handler: createAuthMiddleware(async (ctx) => {
 						const visitorId = ctx.context.visitorId;
 						const identification = ctx.context.identification;
+						const ip = ctx.context.ip;
 						const isSignIn = matchesAnyRoute(ctx.path, [
 							routes.SIGN_IN_EMAIL,
 							routes.SIGN_IN_USERNAME,
@@ -2275,14 +2319,13 @@ const sentinel = (options) => {
 						if (!(isSignIn || isSignUp || isPasswordReset || isTwoFactor || isOtpSend || isMagicLinkVerify || isOrgCreate || isSensitiveAction)) return;
 						const requestBody = ctx.body;
 						const identifier = requestBody?.email || requestBody?.phone || requestBody?.username || void 0;
-						const powVerified = ctx.context.powVerified === true;
-						if (visitorId && powVerified) recordCheck(ctx, "pow_challenge");
-						if (visitorId) {
+						const powSolution = ctx.headers?.get?.("X-PoW-Solution");
+						if (visitorId || ip) {
 							recordCheck(ctx, "credential_stuffing");
-							if (await securityService.isBlocked(visitorId)) {
+							if (await securityService.isBlocked(visitorId ?? "", ip)) {
 								setOutcome(ctx, "blocked", "credential_stuffing", {
-									reason: "cooldown_active",
-									visitorId,
+									phase: "cooldown_active",
+									visitorId: ctx.context.untrustedVisitorId ?? void 0,
 									confidence: 1
 								});
 								emitEvaluation(ctx, trackEvent, {
@@ -2297,8 +2340,9 @@ const sentinel = (options) => {
 							identifier,
 							visitorId,
 							identification,
+							ip: ctx.context.ip,
 							userAgent: ctx.headers?.get?.("user-agent") || ""
-						}, securityService, trackEvent, powVerified);
+						}, securityService, trackEvent, powSolution);
 						if (matchesAnyRoute(ctx.path, [
 							routes.SIGN_UP_EMAIL,
 							routes.CHANGE_PASSWORD,
@@ -2331,22 +2375,21 @@ const sentinel = (options) => {
 			after: [{
 				matcher: (ctx) => ctx.request?.method !== "GET",
 				handler: createAuthMiddleware(async (ctx) => {
-					const visitorId = ctx.context.visitorId;
-					const identification = ctx.context.identification;
+					const untrustedVisitorId = ctx.context.untrustedVisitorId;
+					const ip = ctx.context.ip;
 					const body = ctx.body;
+					const loginId = matchesAnyRoute(ctx.path, [routes.SIGN_IN_USERNAME]) ? body?.username : body?.email;
+					const isPasswordSignInRoute = matchesAnyRoute(ctx.path, [
+						routes.SIGN_IN_EMAIL,
+						routes.SIGN_IN_USERNAME,
+						routes.SIGN_IN_EMAIL_OTP
+					]);
 					emitEvaluation(ctx, trackEvent, {
-						identifier: body?.email,
+						identifier: loginId,
 						userAgent: ctx.headers?.get?.("user-agent") || ""
 					});
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email && body?.password && visitorId) {
-						const { email, password } = body;
-						const ip = identification?.ip || null;
-						await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(email, visitorId, password, ip));
-					}
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && !(ctx.context.returned instanceof Error) && body?.email) {
-						const email = body.email;
-						await ctx.context.runInBackgroundOrAwait(securityService.clearFailedAttempts(email));
-					}
+					if (isPasswordSignInRoute && ctx.context.returned instanceof Error && loginId && body?.password && untrustedVisitorId) await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(loginId, untrustedVisitorId, body.password, ip));
+					if (isPasswordSignInRoute && !(ctx.context.returned instanceof Error) && loginId) await ctx.context.runInBackgroundOrAwait(securityService.clearFailedAttempts(loginId));
 				})
 			}]
 		}
@@ -2794,7 +2837,7 @@ const jwtValidateMiddleware = (options) => {
 };
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.2.10";
+const PLUGIN_VERSION = "0.2.12";
 //#endregion
 //#region src/routes/auth/config.ts
 const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
@@ -3636,6 +3679,31 @@ const executeAdapter = (options) => {
 };
 //#endregion
 //#region src/routes/invitations/index.ts
+async function verifyPendingInvitation(token, $api, ctx) {
+	const { data: invitation, error } = await $api("/api/internal/invitations/verify", {
+		method: "POST",
+		body: { token }
+	});
+	if (error || !invitation) {
+		ctx.context.logger.warn("[Dash] Failed to verify invitation", error);
+		throw new APIError("BAD_REQUEST", { message: "Invalid or expired invitation." });
+	}
+	if (invitation.status !== "pending") throw new APIError("BAD_REQUEST", { message: `This invitation has already been ${invitation.status}.` });
+	if (invitation.expiresAt) {
+		if (new Date(invitation.expiresAt) < /* @__PURE__ */ new Date()) {
+			const { error: markError } = await $api("/api/internal/invitations/mark-expired", {
+				method: "POST",
+				body: { token }
+			});
+			if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as expired", markError);
+			throw new APIError("BAD_REQUEST", { message: "This invitation has expired." });
+		}
+	}
+	return invitation;
+}
+function getFallbackRedirect(ctx) {
+	return typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : "/";
+}
 /**
 * Accept invitation endpoint
 * This is called when a user clicks the invitation link.
@@ -3648,25 +3716,7 @@ const acceptInvitation = (options) => {
 		query: z$1.object({ token: z$1.string() })
 	}, async (ctx) => {
 		const { token } = ctx.query;
-		const { data: invitation, error } = await $api("/api/internal/invitations/verify", {
-			method: "POST",
-			body: { token }
-		});
-		if (error || !invitation) {
-			ctx.context.logger.warn("[Dash] Failed to verify invitation", error);
-			throw new APIError("BAD_REQUEST", { message: "Invalid or expired invitation." });
-		}
-		if (invitation.status !== "pending") throw new APIError("BAD_REQUEST", { message: `This invitation has already been ${invitation.status}.` });
-		if (invitation.expiresAt) {
-			if (new Date(invitation.expiresAt) < /* @__PURE__ */ new Date()) {
-				const { error: markError } = await $api("/api/internal/invitations/mark-expired", {
-					method: "POST",
-					body: { token }
-				});
-				if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as expired", markError);
-				throw new APIError("BAD_REQUEST", { message: "This invitation has expired." });
-			}
-		}
+		const invitation = await verifyPendingInvitation(token, $api, ctx);
 		const invitationEmail = normalizeEmail(invitation.email, ctx.context);
 		const existingUser = await ctx.context.internalAdapter.findUserByEmail(invitationEmail).then((user) => user?.user);
 		if (existingUser) {
@@ -3727,24 +3777,12 @@ const completeInvitation = (options) => {
 		method: "POST",
 		body: z$1.object({
 			token: z$1.string(),
-			password: z$1.string().optional(),
-			providerId: z$1.string().optional(),
-			providerAccountId: z$1.string().optional(),
-			accessToken: z$1.string().optional(),
-			refreshToken: z$1.string().optional()
+			password: z$1.string().optional()
 		})
 	}, async (ctx) => {
-		const { token, password, providerId, providerAccountId, accessToken, refreshToken } = ctx.body;
-		const fallbackRedirect = typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : "/";
-		const { data: invitation, error } = await $api("/api/internal/invitations/verify", {
-			method: "POST",
-			body: { token }
-		});
-		if (error || !invitation) {
-			ctx.context.logger.warn("[Dash] Failed to verify invitation", error);
-			throw new APIError("BAD_REQUEST", { message: "Invalid or expired invitation." });
-		}
-		if (invitation.status !== "pending") throw new APIError("BAD_REQUEST", { message: `This invitation has already been ${invitation.status}.` });
+		const { token, password } = ctx.body;
+		const fallbackRedirect = getFallbackRedirect(ctx);
+		const invitation = await verifyPendingInvitation(token, $api, ctx);
 		if (!ctx.context) throw new APIError("BAD_REQUEST", { message: "Context is required" });
 		const invitationEmail = normalizeEmail(invitation.email, ctx.context);
 		const existingUser = await ctx.context.internalAdapter.findUserByEmail(invitationEmail).then((user) => user?.user);
@@ -3766,6 +3804,7 @@ const completeInvitation = (options) => {
 				redirectUrl: invitation.redirectUrl ?? fallbackRedirect
 			};
 		}
+		if (!password) throw new APIError("BAD_REQUEST", { message: "Password is required to complete this invitation." });
 		const user = await ctx.context.internalAdapter.createUser({
 			email: invitationEmail,
 			name: invitation.name || invitation.email.split("@")[0] || "",
@@ -3773,19 +3812,12 @@ const completeInvitation = (options) => {
 			createdAt: /* @__PURE__ */ new Date(),
 			updatedAt: /* @__PURE__ */ new Date()
 		});
-		if (password) await ctx.context.internalAdapter.createAccount({
+		await ctx.context.internalAdapter.createAccount({
 			userId: user.id,
 			providerId: "credential",
 			accountId: user.id,
 			password: await ctx.context.password.hash(password)
 		});
-		else if (providerId && providerAccountId) await ctx.context.internalAdapter.createAccount({
-			userId: user.id,
-			providerId,
-			accountId: providerAccountId,
-			accessToken,
-			refreshToken
-		});
 		const { error: markError } = await $api("/api/internal/invitations/mark-accepted", {
 			method: "POST",
 			body: {
@@ -3804,6 +3836,30 @@ const completeInvitation = (options) => {
 		};
 	});
 };
+const completeInvitationSocial = (options) => {
+	const { $api } = options;
+	return createAuthEndpoint("/dash/complete-invitation-social", {
+		method: "GET",
+		query: z$1.object({ token: z$1.string() }),
+		use: [sessionMiddleware]
+	}, async (ctx) => {
+		const sessionUser = ctx.context.session?.user;
+		if (!sessionUser) throw new APIError("UNAUTHORIZED", { message: "Authentication required." });
+		const invitation = await verifyPendingInvitation(ctx.query.token, $api, ctx);
+		const invitationEmail = normalizeEmail(invitation.email, ctx.context);
+		const sessionEmail = sessionUser.email ? normalizeEmail(sessionUser.email, ctx.context) : null;
+		if (!sessionEmail || sessionEmail !== invitationEmail) throw new APIError("BAD_REQUEST", { message: "Signed-in account does not match this invitation." });
+		const { error: markError } = await $api("/api/internal/invitations/mark-accepted", {
+			method: "POST",
+			body: {
+				token: ctx.query.token,
+				userId: sessionUser.id
+			}
+		});
+		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
+		return ctx.redirect((invitation.redirectUrl || getFallbackRedirect(ctx)).toString());
+	});
+};
 /**
 * Check if a user exists by email
 * Used by the platform to verify before sending invitation
@@ -5694,8 +5750,14 @@ function isPrivateIPv4(a, b) {
 	if (a === 169 && b === 254) return true;
 	if (a === 0) return true;
 	if (a === 100 && b >= 64 && b <= 127) return true;
+	if (a >= 224) return true;
 	return false;
 }
+function parseIPv4Quad(quad) {
+	const v4parts = quad.split(".").map(Number);
+	if (v4parts.length === 4 && v4parts.every((p) => !isNaN(p) && p >= 0 && p <= 255)) return [v4parts[0], v4parts[1]];
+	return null;
+}
 /**
 * Loopback, RFC1918, link-local, CGNAT, ULA, documentation, NAT64 well-known,
 * IPv4-mapped private, unspecified, and multicast (RFC 4291 section 2.7).
@@ -5732,12 +5794,23 @@ function parseIPv6(addr) {
 	if (left.length !== 8) return null;
 	return left;
 }
+/** True when the hostname is an IPv4 or IPv6 literal (not a DNS name). */
+function isIpLiteralHostname(hostname) {
+	const bare = hostname.replace(/^\[|\]$/g, "");
+	if (parseIPv4Quad(bare)) return true;
+	return parseIPv6(bare)?.length === 8;
+}
 /** Returns true if the hostname resolves to a private/reserved IP or is a local hostname. */
 function isPrivateHost(hostname) {
-	if (hostname === "localhost" || hostname.endsWith(".local") || hostname.endsWith(".internal")) return true;
+	if (hostname === "localhost" || hostname.endsWith(".local") || hostname.endsWith(".internal") || hostname.endsWith(".localhost")) return true;
 	const bare = hostname.replace(/^\[|\]$/g, "");
-	const v4parts = bare.split(".").map(Number);
-	if (v4parts.length === 4 && v4parts.every((p) => !isNaN(p) && p >= 0 && p <= 255)) return isPrivateIPv4(v4parts[0], v4parts[1]);
+	const v4 = parseIPv4Quad(bare);
+	if (v4) return isPrivateIPv4(v4[0], v4[1]);
+	const mappedTail = bare.match(/(?:^|:)([\d.]+)$/);
+	if (mappedTail && mappedTail[1].includes(".")) {
+		const mappedV4 = parseIPv4Quad(mappedTail[1]);
+		if (mappedV4) return isPrivateIPv4(mappedV4[0], mappedV4[1]);
+	}
 	const groups = parseIPv6(bare);
 	if (groups && groups.length === 8) return ipv6GroupsAreNonPublic(groups);
 	return false;
@@ -5822,13 +5895,20 @@ async function validateUrl(rawUrl, options = {}) {
 	const sync = validateUrlSync(rawUrl, options);
 	if (!sync.ok) return sync;
 	if (options.dns === false) return sync;
-	const addresses = await resolveHostnameAddresses(sync.url.hostname);
+	const hostname = sync.url.hostname;
+	const addresses = await resolveHostnameAddresses(hostname);
+	if (!isIpLiteralHostname(hostname) && !addresses?.length) return {
+		ok: false,
+		reason: "unresolved_host",
+		url: sync.url.href,
+		hostname
+	};
 	if (addresses) {
 		for (const addr of addresses) if (isPrivateHost(addr)) return {
 			ok: false,
 			reason: "private_dns",
 			url: sync.url.href,
-			hostname: sync.url.hostname,
+			hostname,
 			address: addr
 		};
 	}
@@ -6571,41 +6651,13 @@ const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-fac
 	} catch {}
 	const user = await ctx.context.internalAdapter.findUserById(userId);
 	const issuer = twoFactorPlugin.options?.issuer || ctx.context.appName || "BetterAuth";
-	return {
-		totpURI: `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(user?.email || userId)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30`,
-		secret
-	};
+	return { totpURI: `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(user?.email || userId)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30` };
 });
 const viewBackupCodes = (options) => createAuthEndpoint("/dash/view-backup-codes", {
 	method: "POST",
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
-}, async (ctx) => {
-	const { userId } = ctx.context.payload;
-	const twoFactorRecord = await ctx.context.adapter.findOne({
-		model: "twoFactor",
-		where: [{
-			field: "userId",
-			value: userId
-		}]
-	});
-	if (!twoFactorRecord) throw new APIError("NOT_FOUND", { message: "Two-factor authentication not set up for this user" });
-	let backupCodes;
-	try {
-		backupCodes = JSON.parse(twoFactorRecord.backupCodes);
-	} catch {
-		try {
-			const { symmetricDecrypt } = await import("better-auth/crypto");
-			const decrypted = await symmetricDecrypt({
-				key: ctx.context.secret,
-				data: twoFactorRecord.backupCodes
-			});
-			backupCodes = JSON.parse(decrypted);
-		} catch (decryptError) {
-			ctx.context.logger.debug("[Dash] Failed to decrypt backup codes:", decryptError);
-			throw new APIError("INTERNAL_SERVER_ERROR", { message: "Failed to decrypt backup codes" });
-		}
-	}
-	return { backupCodes };
+}, async () => {
+	throw new APIError("FORBIDDEN", { message: "Backup codes cannot be viewed after initial setup. Generate new codes instead." });
 });
 const disableTwoFactor = (options) => createAuthEndpoint("/dash/disable-two-factor", {
 	method: "POST",
@@ -8341,6 +8393,7 @@ const dash = (options) => {
 			getEventTypes: getEventTypes(settings),
 			dashAcceptInvitation: acceptInvitation(settings),
 			dashCompleteInvitation: completeInvitation(settings),
+			dashCompleteInvitationSocial: completeInvitationSocial(settings),
 			dashCheckUserExists: checkUserExists(settings),
 			listDashOrganizationDirectories: listOrganizationDirectories(settings),
 			createDashOrganizationDirectory: createOrganizationDirectory(settings),

package/dist/native.mjs

@@ -190,6 +190,8 @@ async function getOrCreateVisitorId(storage) {
 }
 //#endregion
 //#region src/sentinel/native/client.ts
+/** One recovery round after a consumed or superseded challenge (e.g. double-submit). */
+const MAX_POW_CHALLENGE_ROUNDS = 2;
 function scheduleIdentify(send) {
 	const run = () => {
 		try {
@@ -248,49 +250,54 @@ const sentinelNativeClient = (options) => {
 			hooks: {
 				async onResponse(context) {
 					if (context.response.status !== 423 || !autoSolve) return context;
-					const challengeHeader = context.response.headers.get("X-PoW-Challenge");
-					const reason = context.response.headers.get("X-PoW-Reason") || "";
-					if (!challengeHeader) return context;
-					options?.onChallengeReceived?.(reason);
-					const challenge = decodePoWChallenge(challengeHeader);
-					if (!challenge) return context;
-					try {
-						const startTime = Date.now();
-						const solution = await solvePoWChallenge(challenge);
-						const solveTime = Date.now() - startTime;
-						options?.onChallengeSolved?.(solveTime);
-						const originalUrl = context.response.url;
-						const fingerprint = await runtime.getFingerprint();
-						const retryHeaders = new Headers();
-						retryHeaders.set("X-PoW-Solution", encodePoWSolution(solution));
-						if (fingerprint) {
-							retryHeaders.set("X-Visitor-Id", fingerprint.visitorId);
-							retryHeaders.set("X-Request-Id", fingerprint.requestId);
-						}
-						retryHeaders.set("Content-Type", "application/json");
-						let body;
-						if (context.request?.body) body = context.request._originalBody;
-						const req = context.request;
-						const powRetry = createPowRetryTimeout(req.timeout);
+					if (!context.response.headers.get("X-PoW-Challenge")) return context;
+					const req = context.request;
+					let response = context.response;
+					const url = response.url;
+					const body = req._originalBody;
+					for (let round = 0; round < MAX_POW_CHALLENGE_ROUNDS; round++) {
+						if (response.status !== 423) break;
+						const challengeHeader = response.headers.get("X-PoW-Challenge");
+						if (!challengeHeader) break;
+						const reason = response.headers.get("X-PoW-Reason") || "";
+						options?.onChallengeReceived?.(reason);
+						const challenge = decodePoWChallenge(challengeHeader);
+						if (!challenge) break;
 						try {
-							const retryResponse = await fetch(originalUrl, {
-								method: req.method || "POST",
-								headers: retryHeaders,
-								body,
-								...powRetry.signal ? { signal: powRetry.signal } : {}
-							});
-							return {
-								...context,
-								response: retryResponse
-							};
-						} finally {
-							powRetry.cleanup?.();
+							const startTime = Date.now();
+							const solution = await solvePoWChallenge(challenge);
+							options?.onChallengeSolved?.(Date.now() - startTime);
+							const fingerprint = await runtime.getFingerprint();
+							const retryHeaders = new Headers();
+							retryHeaders.set("X-PoW-Solution", encodePoWSolution(solution));
+							if (fingerprint) {
+								retryHeaders.set("X-Visitor-Id", fingerprint.visitorId);
+								retryHeaders.set("X-Request-Id", fingerprint.requestId);
+							}
+							retryHeaders.set("Content-Type", "application/json");
+							const powRetry = createPowRetryTimeout(req.timeout);
+							try {
+								response = await fetch(url, {
+									method: req.method || "POST",
+									headers: retryHeaders,
+									body,
+									...powRetry.signal ? { signal: powRetry.signal } : {}
+								});
+							} finally {
+								powRetry.cleanup?.();
+							}
+							if (response.status !== 423) break;
+							if (!response.headers.get("X-PoW-Challenge")) break;
+						} catch (err) {
+							console.error("[Sentinel native] Failed to solve PoW challenge:", err);
+							options?.onChallengeFailed?.(err instanceof Error ? err : new Error(String(err)));
+							return context;
 						}
-					} catch (err) {
-						console.error("[Sentinel native] Failed to solve PoW challenge:", err);
-						options?.onChallengeFailed?.(err instanceof Error ? err : new Error(String(err)));
-						return context;
 					}
+					return {
+						...context,
+						response
+					};
 				},
 				async onRequest(context) {
 					if (context.body) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
@@ -79,7 +79,7 @@
     "@better-fetch/fetch": "^1.1.21",
     "better-call": "^1.3.2",
     "jose": "^6.1.0",
-    "libphonenumber-js": "^1.13.2"
+    "libphonenumber-js": "^1.13.3"
   },
   "peerDependencies": {
     "better-auth": ">=1.4.0",