@better-auth/infra 0.2.11 → 0.2.13

package/dist/index.mjs

@@ -1,10 +1,10 @@
 import { n as INFRA_API_URL, r as INFRA_KV_URL } from "./constants-CvriWQVc.mjs";
 import { n as createKV, t as createAPI } from "./fetch-DiAhoiKA.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
+import { getCurrentAuthContext } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger, parseState } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { APIError as APIError$1, createAuthEndpoint, createAuthMiddleware, requestPasswordReset, sendVerificationEmailFn, sessionMiddleware } from "better-auth/api";
-import { getCurrentAuthContext } from "@better-auth/core/context";
 import { createFetch } from "@better-fetch/fetch";
 import { isValidPhoneNumber, parsePhoneNumberFromString } from "libphonenumber-js";
 import { createLocalJWKSet, jwtVerify } from "jose";
@@ -108,6 +108,7 @@ const routes = {
 	DASH_ROUTE: "/dash",
 	DASH_UPDATE_USER: "/dash/update-user",
 	DASH_REVOKE_SESSIONS_ALL: "/dash/sessions/revoke-all",
+	DASH_IMPERSONATE_USER: "/dash/impersonate-user",
 	DASH_BAN_USER: "/dash/ban-user",
 	DASH_UNBAN_USER: "/dash/unban-user",
 	ADMIN_ROUTE: "/admin",
@@ -425,7 +426,7 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackSessionRevokedAll = (session, trigger, ctx, _location) => {
+	const trackSessionRevokedAll = (session, trigger, ctx, location) => {
 		const track = async () => {
 			const user = await getUserById(session.userId, ctx);
 			trackEvent({
@@ -438,7 +439,11 @@ const initSessionEvents = (tracker) => {
 					userEmail: user?.email ?? "unknown",
 					triggeredBy: trigger.triggeredBy,
 					triggerContext: trigger.triggerContext
-				}
+				},
+				ipAddress: location?.ipAddress,
+				city: location?.city,
+				country: location?.country,
+				countryCode: location?.countryCode
 			});
 		};
 		ctx.context.runInBackground(track());
@@ -527,7 +532,7 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackEmailVerificationSent = (session, user, trigger, _ctx) => {
+	const trackEmailVerificationSent = (session, user, trigger, location) => {
 		trackEvent({
 			eventKey: session.userId,
 			eventType: EVENT_TYPES.EMAIL_VERIFICATION_SENT,
@@ -539,10 +544,14 @@ const initSessionEvents = (tracker) => {
 				sessionId: session.id,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackEmailSignInAttempt = (ctx, trigger) => {
+	const trackEmailSignInAttempt = (ctx, trigger, location) => {
 		const track = async () => {
 			const user = await getUserByEmail(ctx.body.email, ctx);
 			trackEvent({
@@ -556,12 +565,16 @@ const initSessionEvents = (tracker) => {
 					loginMethod: getLoginMethod(ctx),
 					triggeredBy: user?.id ?? trigger.triggeredBy,
 					triggerContext: trigger.triggerContext
-				}
+				},
+				ipAddress: location?.ipAddress,
+				city: location?.city,
+				country: location?.country,
+				countryCode: location?.countryCode
 			});
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackSocialSignInAttempt = (ctx, trigger) => {
+	const trackSocialSignInAttempt = (ctx, trigger, location) => {
 		const track = async () => {
 			const user = await getUserByIdToken(ctx.body.provider, ctx.body.idToken, ctx);
 			trackEvent({
@@ -575,12 +588,16 @@ const initSessionEvents = (tracker) => {
 					loginMethod: getLoginMethod(ctx),
 					triggeredBy: user?.user.id ?? trigger.triggeredBy,
 					triggerContext: trigger.triggerContext
-				}
+				},
+				ipAddress: location?.ipAddress,
+				city: location?.city,
+				country: location?.country,
+				countryCode: location?.countryCode
 			});
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackSocialSignInRedirectionAttempt = (ctx, trigger) => {
+	const trackSocialSignInRedirectionAttempt = (ctx, trigger, location) => {
 		const track = async () => {
 			const user = await getUserByAuthorizationCode(tryDecode(ctx.params?.id), ctx);
 			trackEvent({
@@ -594,7 +611,11 @@ const initSessionEvents = (tracker) => {
 					loginMethod: getLoginMethod(ctx),
 					triggeredBy: trigger.triggeredBy,
 					triggerContext: trigger.triggerContext
-				}
+				},
+				ipAddress: location?.ipAddress,
+				city: location?.city,
+				country: location?.country,
+				countryCode: location?.countryCode
 			});
 		};
 		ctx.context.runInBackground(track());
@@ -942,45 +963,67 @@ function extractIdentificationHeaders(request) {
 	};
 }
 /**
+* Visitor ID for security enforcement from a loaded identification record —
+* not a client-supplied X-Visitor-Id header alone.
+*/
+function resolveSecurityVisitorId(headerVisitorId, identification) {
+	const identified = identification?.visitorId ?? null;
+	if (!identified) return null;
+	if (headerVisitorId && headerVisitorId !== identified) logger.warn("[Sentinel] X-Visitor-Id does not match identification; using identification visitorId for security checks.");
+	return identified;
+}
+/** IP for security checks: prefer identify record, then request-derived fallback. */
+function resolveSecurityIp(identification, location) {
+	return identification?.ip ?? location?.ipAddress ?? null;
+}
+/**
+* Visitor id for observability and failed-login tracking when identification
+* is unavailable. Prefer bound visitor id, then a stable IP bucket; header is
+* legacy fallback only — not used for enforcement.
+*/
+function resolveUntrustedVisitorId(visitorId, ip, headerVisitorId) {
+	if (visitorId) return visitorId;
+	if (ip) return `ip:${ip}`;
+	return headerVisitorId;
+}
+/**
 * Early middleware that loads identification data.
 *
 * @param $kv — KV client from {@link createKV} for the same plugin options (one instance per plugin).
 */
 function createIdentificationMiddleware($kv) {
 	return createAuthMiddleware(async (ctx) => {
-		const { visitorId, requestId: headerRequestId } = extractIdentificationHeaders(ctx.request);
+		const { visitorId: headerVisitorId, requestId: headerRequestId } = extractIdentificationHeaders(ctx.request);
 		const requestId = headerRequestId ?? ctx.getCookie("__infra-rid") ?? null;
-		ctx.context.visitorId = visitorId;
 		ctx.context.requestId = requestId;
 		if (requestId) {
 			if (ctx.context.identification === void 0) ctx.context.identification = await getIdentification(requestId, $kv) ?? null;
 		} else ctx.context.identification = null;
-		const ipConfig = ctx.context.options?.advanced?.ipAddress;
-		if (ipConfig?.disableIpTracking === true) {
-			ctx.context.location = void 0;
-			return;
-		}
 		const identification = ctx.context.identification;
-		if (requestId && identification) {
+		const visitorId = resolveSecurityVisitorId(headerVisitorId, identification);
+		ctx.context.visitorId = visitorId;
+		const ipConfig = ctx.context.options?.advanced?.ipAddress;
+		let location;
+		if (ipConfig?.disableIpTracking === true) location = void 0;
+		else if (requestId && identification) {
 			const loc = getLocation(identification);
-			ctx.context.location = {
+			location = {
 				ipAddress: identification.ip || void 0,
 				city: loc?.city || void 0,
 				country: loc?.country?.name || void 0,
 				countryCode: loc?.country?.code || void 0
 			};
-			return;
-		}
-		const ipAddress = getClientIpFromRequest(ctx.request, ipConfig?.ipAddressHeaders || null);
-		if (ipAddress) {
-			const countryCode = getCountryCodeFromRequest(ctx.request);
-			ctx.context.location = {
+		} else {
+			const ipAddress = getClientIpFromRequest(ctx.request, ipConfig?.ipAddressHeaders || null);
+			if (ipAddress) location = {
 				ipAddress,
-				countryCode
+				countryCode: getCountryCodeFromRequest(ctx.request)
 			};
-			return;
+			else location = void 0;
 		}
-		ctx.context.location = void 0;
+		ctx.context.location = location;
+		ctx.context.ip = resolveSecurityIp(identification, location);
+		ctx.context.untrustedVisitorId = resolveUntrustedVisitorId(visitorId, ctx.context.ip, headerVisitorId);
 	});
 }
 /**
@@ -1024,7 +1067,13 @@ function getEvaluation(ctx) {
 function recordCheck(ctx, name) {
 	getEvaluation(ctx).checks.add(name);
 }
-/** Call immediately before throwing so the buffer reflects the final outcome. */
+/**
+* Call immediately before throwing so the buffer reflects the final outcome.
+*
+* `details.reason`, when set, is surfaced as the top-level dashboard reason
+* (see `emitEvaluation`) — so it must be a renderable reason, not a free-form
+* value. Put internal sub-states under a different key (e.g. `phase`).
+*/
 function setOutcome(ctx, outcome, triggeredBy, details) {
 	const ev = getEvaluation(ctx);
 	ev.outcome = outcome;
@@ -1052,6 +1101,7 @@ function emitEvaluation(ctx, trackEvent, options = {}) {
 			outcome: ev.outcome,
 			evaluatedChecks: [...ev.checks].sort(),
 			triggeredBy: ev.triggeredBy,
+			reason: ev.details?.reason ?? ev.triggeredBy,
 			identifier: options.identifier,
 			path,
 			userAgent: options.userAgent,
@@ -1171,9 +1221,11 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				logger.error("[Dash] Clear failed attempts error:", error);
 			}
 		},
-		async isBlocked(visitorId) {
+		async isBlocked(visitorId, ip) {
 			try {
-				return (await $api(`/security/is-blocked?visitorId=${encodeURIComponent(visitorId)}`, { method: "GET" })).blocked ?? false;
+				const params = new URLSearchParams({ visitorId });
+				if (ip) params.set("ip", ip);
+				return (await $api(`/security/is-blocked?${params.toString()}`, { method: "GET" })).blocked ?? false;
 			} catch (error) {
 				logger.warn("[Dash] Security is-blocked check failed:", error);
 				return false;
@@ -1210,7 +1262,7 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				return "";
 			}
 		},
-		async checkImpossibleTravel(userId, currentLocation, visitorId, ip = null) {
+		async checkImpossibleTravel(userId, currentLocation, visitorId, ip = null, powSolution) {
 			if (!options.impossibleTravel?.enabled || !currentLocation) return null;
 			try {
 				const data = await $api("/security/impossible-travel", {
@@ -1220,7 +1272,8 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 						visitorId,
 						location: currentLocation,
 						ip,
-						config: options
+						config: options,
+						...powSolution ? { powSolution } : {}
 					}
 				});
 				if (data.isImpossible) {
@@ -1483,52 +1536,47 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 }
 //#endregion
 //#region src/validation/matchers.ts
-const all = new Set([
+/**
+* Routes where a new or changed email address enters the system. Deliverability
+* and disposable validation runs here so invalid addresses are caught at the
+* source.
+*/
+const registrationPaths = [
 	"/sign-up/email",
-	"/email-otp/verify-email",
-	"/sign-in/email-otp",
-	"/sign-in/magic-link",
-	"/sign-in/email",
-	"/forget-password/email-otp",
-	"/email-otp/reset-password",
-	"/email-otp/create-verification-otp",
-	"/email-otp/get-verification-otp",
-	"/email-otp/send-verification-otp",
-	"/forget-password",
-	"/request-password-reset",
-	"/send-verification-email",
 	"/change-email",
 	"/organization/invite-member",
 	"/dash/organization/invite-member",
 	"/dash/create-user",
 	"/dash/update-user"
-]);
+];
 /**
-* Path is one of `[
-*   '/sign-up/email',
-*   '/email-otp/verify-email',
-*   '/sign-in/email-otp',
-*   '/sign-in/magic-link',
-*   '/sign-in/email',
-*   '/forget-password/email-otp',
-*   '/email-otp/reset-password',
-*   '/email-otp/create-verification-otp',
-*   '/email-otp/get-verification-otp',
-*   '/email-otp/send-verification-otp',
-*   '/forget-password',
-*   '/request-password-reset',
-*   '/send-verification-email',
-*   '/change-email',
-*   '/organization/invite-member',
-*   '/dash/organization/invite-member',
-*   '/dash/create-user',
-*   '/dash/update-user'
-* ]`.
-* @param context Request context
-* @param context.path Request path
-* @returns boolean
+* Authentication and account-recovery routes. These act on an already-known
+* address, so only the syntax check runs — a deliverability false-positive must
+* never lock out an existing user (better-auth#9803).
 */
+const authPaths = [
+	"/sign-in/email",
+	"/sign-in/email-otp",
+	"/sign-in/magic-link",
+	"/forget-password",
+	"/forget-password/email-otp",
+	"/request-password-reset",
+	"/send-verification-email",
+	"/email-otp/verify-email",
+	"/email-otp/reset-password",
+	"/email-otp/create-verification-otp",
+	"/email-otp/get-verification-otp",
+	"/email-otp/send-verification-otp"
+];
+const registration = new Set(registrationPaths);
+const all = new Set([...registrationPaths, ...authPaths]);
+/** Path carries an email we hook for normalization + syntax validation. */
 const allEmail = ({ path }) => !!path && all.has(path);
+/**
+* Path introduces a new or changed address — run full deliverability/disposable
+* validation. Authentication routes are intentionally excluded.
+*/
+const registrationEmail = ({ path }) => !!path && registration.has(path);
 //#endregion
 //#region src/validation/email.ts
 /**
@@ -1624,7 +1672,7 @@ async validate(email, checkMx = true) {
 			policy
 		};
 		try {
-			const { data } = await $kv("/email/validate", {
+			const { data, error } = await $kv("/email/validate", {
 				method: "POST",
 				body: {
 					email: trimmed,
@@ -1632,11 +1680,15 @@ async validate(email, checkMx = true) {
 					strictness: policy.strictness
 				}
 			});
+			if (error || !data) {
+				logger.warn("[Dash] Email validation unavailable, allowing email:", error);
+				return {
+					valid: true,
+					policy
+				};
+			}
 			return {
-				...data || {
-					valid: false,
-					reason: "invalid_format"
-				},
+				...data,
 				policy
 			};
 		} catch (error) {
@@ -1649,6 +1701,26 @@ async validate(email, checkMx = true) {
 	} };
 }
 /**
+* Map a raw validation result to a single dashboard reason and user-facing
+* message. One source so the recorded reason and the thrown message can't drift,
+* and a block always carries a populated reason (better-auth#9803).
+*/
+function resolveEmailBlock(result) {
+	const raw = result.reason ?? "";
+	if (result.disposable || raw === "blocklist" || raw.startsWith("known_disposable")) return {
+		reason: "disposable_email",
+		message: "Disposable email addresses are not allowed"
+	};
+	if (raw === "no_mx_records") return {
+		reason: "no_mx_records",
+		message: "This email domain cannot receive emails"
+	};
+	return {
+		reason: "invalid_email",
+		message: "This email address appears to be invalid"
+	};
+}
+/**
 * Basic local email format validation (fallback)
 */
 function isValidEmailFormatLocal(email) {
@@ -1714,14 +1786,15 @@ function createEmailValidationHook(validator, trackEvent) {
 			if (!isValidEmailFormatLocal(trimmed)) {
 				if (trackEvent) {
 					setOutcome(ctx, "blocked", "email_validity", {
-						reason: "invalid_format",
+						reason: "invalid_email",
+						rawReason: "invalid_format",
 						email: trimmed
 					});
 					emitEvaluation(ctx, trackEvent, { identifier: trimmed });
 				}
 				throw new APIError$1("BAD_REQUEST", { message: "Invalid email" });
 			}
-			if (validator) {
+			if (validator && registrationEmail(ctx)) {
 				const result = await validator.validate(trimmed);
 				const policy = result.policy;
 				if (!policy?.enabled) return;
@@ -1732,10 +1805,11 @@ function createEmailValidationHook(validator, trackEvent) {
 				const action = policy.action;
 				if (!result.valid) {
 					if (action === "allow") return;
-					const message = result.reason === "no_mx_records" ? "This email domain cannot receive emails" : result.disposable || result.reason === "blocklist" ? "Disposable email addresses are not allowed" : result.reason === "known_invalid_email" || result.reason === "known_invalid_host" || result.reason === "reserved_tld" || result.reason === "provider_local_too_short" ? "This email address appears to be invalid" : "Invalid email";
+					const { reason, message } = resolveEmailBlock(result);
 					if (trackEvent) {
 						setOutcome(ctx, "blocked", "email_validity", {
-							reason: result.reason,
+							reason,
+							rawReason: result.reason,
 							confidence: result.confidence,
 							email: trimmed
 						});
@@ -2006,6 +2080,7 @@ function throwChallengeError(challenge, reason, message = "Please complete a sec
 }
 /** Emits the `security_check` event inline before throwing — the after-hook won't run on throw. */
 async function handleSecurityVerdict(verdict, hookCtx, checkCtx, trackEvent, securityService) {
+	if (verdict.powVerified) recordCheck(hookCtx, "pow_challenge");
 	if (verdict.action === "allow") return;
 	const reason = verdict.reason || "unknown";
 	if (verdict.action === "challenge" && checkCtx.visitorId) {
@@ -2040,15 +2115,15 @@ async function handleSecurityVerdict(verdict, hookCtx, checkCtx, trackEvent, sec
 * Single API call from the plugin; server runs all configured rules and returns
 * one verdict — counts as one billable check.
 */
-async function runSecurityChecks(hookCtx, checkCtx, securityService, trackEvent, powVerified) {
-	if (powVerified) return;
+async function runSecurityChecks(hookCtx, checkCtx, securityService, trackEvent, powSolution) {
 	recordCheck(hookCtx, "server_security_check");
 	await handleSecurityVerdict(await securityService.checkSecurity({
 		visitorId: checkCtx.visitorId,
 		requestId: checkCtx.identification?.requestId || null,
-		ip: checkCtx.identification?.ip || null,
+		ip: checkCtx.ip,
 		path: checkCtx.path,
-		identifier: checkCtx.identifier
+		identifier: checkCtx.identifier,
+		powSolution: powSolution ?? void 0
 	}), hookCtx, checkCtx, trackEvent, securityService);
 }
 //#endregion
@@ -2137,7 +2212,9 @@ const sentinel = (options) => {
 							const identification = ctx.context.identification;
 							if (session.userId && identification?.location && visitorId) {
 								recordCheck(ctx, "impossible_travel");
-								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId, identification.ip);
+								const powSolution = ctx.headers?.get?.("X-PoW-Solution") ?? null;
+								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId, identification.ip, powSolution);
+								if (travelCheck?.powVerified) recordCheck(ctx, "pow_challenge");
 								if (travelCheck?.isImpossible) {
 									if (travelCheck.action === "block") {
 										setOutcome(ctx, "blocked", "impossible_travel", {
@@ -2228,16 +2305,6 @@ const sentinel = (options) => {
 					matcher: (ctx) => ctx.request?.method !== "GET",
 					handler: createIdentificationMiddleware($kv)
 				},
-				{
-					matcher: (ctx) => ctx.request?.method !== "GET",
-					handler: createAuthMiddleware(async (ctx) => {
-						const visitorId = ctx.context.visitorId;
-						const powSolution = ctx.headers?.get?.("X-PoW-Solution");
-						if (visitorId && powSolution) {
-							if ((await securityService.verifyPoWSolution(visitorId, powSolution)).valid) ctx.context.powVerified = true;
-						}
-					})
-				},
 				...emailHooks.before,
 				...phoneValidationHooks.before,
 				{
@@ -2245,6 +2312,7 @@ const sentinel = (options) => {
 					handler: createAuthMiddleware(async (ctx) => {
 						const visitorId = ctx.context.visitorId;
 						const identification = ctx.context.identification;
+						const ip = ctx.context.ip;
 						const isSignIn = matchesAnyRoute(ctx.path, [
 							routes.SIGN_IN_EMAIL,
 							routes.SIGN_IN_USERNAME,
@@ -2275,14 +2343,13 @@ const sentinel = (options) => {
 						if (!(isSignIn || isSignUp || isPasswordReset || isTwoFactor || isOtpSend || isMagicLinkVerify || isOrgCreate || isSensitiveAction)) return;
 						const requestBody = ctx.body;
 						const identifier = requestBody?.email || requestBody?.phone || requestBody?.username || void 0;
-						const powVerified = ctx.context.powVerified === true;
-						if (visitorId && powVerified) recordCheck(ctx, "pow_challenge");
-						if (visitorId) {
+						const powSolution = ctx.headers?.get?.("X-PoW-Solution");
+						if (visitorId || ip) {
 							recordCheck(ctx, "credential_stuffing");
-							if (await securityService.isBlocked(visitorId)) {
+							if (await securityService.isBlocked(visitorId ?? "", ip)) {
 								setOutcome(ctx, "blocked", "credential_stuffing", {
-									reason: "cooldown_active",
-									visitorId,
+									phase: "cooldown_active",
+									visitorId: ctx.context.untrustedVisitorId ?? void 0,
 									confidence: 1
 								});
 								emitEvaluation(ctx, trackEvent, {
@@ -2297,8 +2364,9 @@ const sentinel = (options) => {
 							identifier,
 							visitorId,
 							identification,
+							ip: ctx.context.ip,
 							userAgent: ctx.headers?.get?.("user-agent") || ""
-						}, securityService, trackEvent, powVerified);
+						}, securityService, trackEvent, powSolution);
 						if (matchesAnyRoute(ctx.path, [
 							routes.SIGN_UP_EMAIL,
 							routes.CHANGE_PASSWORD,
@@ -2331,22 +2399,21 @@ const sentinel = (options) => {
 			after: [{
 				matcher: (ctx) => ctx.request?.method !== "GET",
 				handler: createAuthMiddleware(async (ctx) => {
-					const visitorId = ctx.context.visitorId;
-					const identification = ctx.context.identification;
+					const untrustedVisitorId = ctx.context.untrustedVisitorId;
+					const ip = ctx.context.ip;
 					const body = ctx.body;
+					const loginId = matchesAnyRoute(ctx.path, [routes.SIGN_IN_USERNAME]) ? body?.username : body?.email;
+					const isPasswordSignInRoute = matchesAnyRoute(ctx.path, [
+						routes.SIGN_IN_EMAIL,
+						routes.SIGN_IN_USERNAME,
+						routes.SIGN_IN_EMAIL_OTP
+					]);
 					emitEvaluation(ctx, trackEvent, {
-						identifier: body?.email,
+						identifier: loginId,
 						userAgent: ctx.headers?.get?.("user-agent") || ""
 					});
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email && body?.password && visitorId) {
-						const { email, password } = body;
-						const ip = identification?.ip || null;
-						await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(email, visitorId, password, ip));
-					}
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && !(ctx.context.returned instanceof Error) && body?.email) {
-						const email = body.email;
-						await ctx.context.runInBackgroundOrAwait(securityService.clearFailedAttempts(email));
-					}
+					if (isPasswordSignInRoute && ctx.context.returned instanceof Error && loginId && body?.password && untrustedVisitorId) await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(loginId, untrustedVisitorId, body.password, ip));
+					if (isPasswordSignInRoute && !(ctx.context.returned instanceof Error) && loginId) await ctx.context.runInBackgroundOrAwait(securityService.clearFailedAttempts(loginId));
 				})
 			}]
 		}
@@ -2356,7 +2423,7 @@ const sentinel = (options) => {
 //#region src/events/organization/events-invitation.ts
 const initInvitationEvents = (tracker) => {
 	const { trackEvent } = tracker;
-	const trackOrganizationMemberInvited = (organization, invitation, inviter, trigger) => {
+	const trackOrganizationMemberInvited = (organization, invitation, inviter, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_INVITED,
@@ -2374,10 +2441,14 @@ const initInvitationEvents = (tracker) => {
 				inviterEmail: inviter.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationMemberInviteAccepted = (organization, invitation, member, acceptedBy, trigger) => {
+	const trackOrganizationMemberInviteAccepted = (organization, invitation, member, acceptedBy, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_INVITE_ACCEPTED,
@@ -2397,10 +2468,14 @@ const initInvitationEvents = (tracker) => {
 				memberRole: member.role,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationMemberInviteRejected = (organization, invitation, rejectedBy, trigger) => {
+	const trackOrganizationMemberInviteRejected = (organization, invitation, rejectedBy, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_INVITE_REJECTED,
@@ -2418,10 +2493,14 @@ const initInvitationEvents = (tracker) => {
 				rejectedByName: rejectedBy.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationMemberInviteCanceled = (organization, invitation, cancelledBy, trigger) => {
+	const trackOrganizationMemberInviteCanceled = (organization, invitation, cancelledBy, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_INVITE_CANCELED,
@@ -2439,7 +2518,11 @@ const initInvitationEvents = (tracker) => {
 				cancelledByEmail: cancelledBy.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
 	return {
@@ -2453,7 +2536,7 @@ const initInvitationEvents = (tracker) => {
 //#region src/events/organization/events-member.ts
 const initMemberEvents = (tracker) => {
 	const { trackEvent } = tracker;
-	const trackOrganizationMemberAdded = (organization, member, user, trigger) => {
+	const trackOrganizationMemberAdded = (organization, member, user, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_ADDED,
@@ -2469,10 +2552,14 @@ const initMemberEvents = (tracker) => {
 				memberEmail: user.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationMemberRemoved = (organization, member, user, trigger) => {
+	const trackOrganizationMemberRemoved = (organization, member, user, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_REMOVED,
@@ -2488,10 +2575,14 @@ const initMemberEvents = (tracker) => {
 				memberEmail: user.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationMemberRoleUpdated = (organization, member, user, previousRole, trigger) => {
+	const trackOrganizationMemberRoleUpdated = (organization, member, user, previousRole, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_ROLE_UPDATED,
@@ -2508,7 +2599,11 @@ const initMemberEvents = (tracker) => {
 				memberEmail: user.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
 	return {
@@ -2521,7 +2616,7 @@ const initMemberEvents = (tracker) => {
 //#region src/events/organization/events-organization.ts
 const initOrganizationEvents = (tracker) => {
 	const { trackEvent } = tracker;
-	const trackOrganizationCreated = (organization, trigger) => {
+	const trackOrganizationCreated = (organization, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_CREATED,
@@ -2532,10 +2627,14 @@ const initOrganizationEvents = (tracker) => {
 				organizationName: organization.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationUpdated = (organization, trigger) => {
+	const trackOrganizationUpdated = (organization, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_UPDATED,
@@ -2546,7 +2645,11 @@ const initOrganizationEvents = (tracker) => {
 				organizationName: organization.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
 	return {
@@ -2558,7 +2661,7 @@ const initOrganizationEvents = (tracker) => {
 //#region src/events/organization/events-team.ts
 const initTeamEvents = (tracker) => {
 	const { trackEvent } = tracker;
-	const trackOrganizationTeamCreated = (organization, team, trigger) => {
+	const trackOrganizationTeamCreated = (organization, team, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_TEAM_CREATED,
@@ -2571,10 +2674,14 @@ const initTeamEvents = (tracker) => {
 				teamName: team.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationTeamUpdated = (organization, team, trigger) => {
+	const trackOrganizationTeamUpdated = (organization, team, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_TEAM_UPDATED,
@@ -2587,10 +2694,14 @@ const initTeamEvents = (tracker) => {
 				teamName: team.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationTeamDeleted = (organization, team, trigger) => {
+	const trackOrganizationTeamDeleted = (organization, team, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_TEAM_DELETED,
@@ -2603,10 +2714,14 @@ const initTeamEvents = (tracker) => {
 				teamName: team.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationTeamMemberAdded = (organization, team, user, teamMember, trigger) => {
+	const trackOrganizationTeamMemberAdded = (organization, team, user, teamMember, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_TEAM_MEMBER_ADDED,
@@ -2621,10 +2736,14 @@ const initTeamEvents = (tracker) => {
 				memberName: user.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationTeamMemberRemoved = (organization, team, user, teamMember, trigger) => {
+	const trackOrganizationTeamMemberRemoved = (organization, team, user, teamMember, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_TEAM_MEMBER_REMOVED,
@@ -2639,7 +2758,11 @@ const initTeamEvents = (tracker) => {
 				memberName: user.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
 	return {
@@ -2794,7 +2917,7 @@ const jwtValidateMiddleware = (options) => {
 };
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.2.11";
+const PLUGIN_VERSION = "0.2.13";
 //#endregion
 //#region src/routes/auth/config.ts
 const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
@@ -3636,6 +3759,31 @@ const executeAdapter = (options) => {
 };
 //#endregion
 //#region src/routes/invitations/index.ts
+async function verifyPendingInvitation(token, $api, ctx) {
+	const { data: invitation, error } = await $api("/api/internal/invitations/verify", {
+		method: "POST",
+		body: { token }
+	});
+	if (error || !invitation) {
+		ctx.context.logger.warn("[Dash] Failed to verify invitation", error);
+		throw new APIError("BAD_REQUEST", { message: "Invalid or expired invitation." });
+	}
+	if (invitation.status !== "pending") throw new APIError("BAD_REQUEST", { message: `This invitation has already been ${invitation.status}.` });
+	if (invitation.expiresAt) {
+		if (new Date(invitation.expiresAt) < /* @__PURE__ */ new Date()) {
+			const { error: markError } = await $api("/api/internal/invitations/mark-expired", {
+				method: "POST",
+				body: { token }
+			});
+			if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as expired", markError);
+			throw new APIError("BAD_REQUEST", { message: "This invitation has expired." });
+		}
+	}
+	return invitation;
+}
+function getFallbackRedirect(ctx) {
+	return typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : "/";
+}
 /**
 * Accept invitation endpoint
 * This is called when a user clicks the invitation link.
@@ -3648,25 +3796,7 @@ const acceptInvitation = (options) => {
 		query: z$1.object({ token: z$1.string() })
 	}, async (ctx) => {
 		const { token } = ctx.query;
-		const { data: invitation, error } = await $api("/api/internal/invitations/verify", {
-			method: "POST",
-			body: { token }
-		});
-		if (error || !invitation) {
-			ctx.context.logger.warn("[Dash] Failed to verify invitation", error);
-			throw new APIError("BAD_REQUEST", { message: "Invalid or expired invitation." });
-		}
-		if (invitation.status !== "pending") throw new APIError("BAD_REQUEST", { message: `This invitation has already been ${invitation.status}.` });
-		if (invitation.expiresAt) {
-			if (new Date(invitation.expiresAt) < /* @__PURE__ */ new Date()) {
-				const { error: markError } = await $api("/api/internal/invitations/mark-expired", {
-					method: "POST",
-					body: { token }
-				});
-				if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as expired", markError);
-				throw new APIError("BAD_REQUEST", { message: "This invitation has expired." });
-			}
-		}
+		const invitation = await verifyPendingInvitation(token, $api, ctx);
 		const invitationEmail = normalizeEmail(invitation.email, ctx.context);
 		const existingUser = await ctx.context.internalAdapter.findUserByEmail(invitationEmail).then((user) => user?.user);
 		if (existingUser) {
@@ -3727,24 +3857,12 @@ const completeInvitation = (options) => {
 		method: "POST",
 		body: z$1.object({
 			token: z$1.string(),
-			password: z$1.string().optional(),
-			providerId: z$1.string().optional(),
-			providerAccountId: z$1.string().optional(),
-			accessToken: z$1.string().optional(),
-			refreshToken: z$1.string().optional()
+			password: z$1.string().optional()
 		})
 	}, async (ctx) => {
-		const { token, password, providerId, providerAccountId, accessToken, refreshToken } = ctx.body;
-		const fallbackRedirect = typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : "/";
-		const { data: invitation, error } = await $api("/api/internal/invitations/verify", {
-			method: "POST",
-			body: { token }
-		});
-		if (error || !invitation) {
-			ctx.context.logger.warn("[Dash] Failed to verify invitation", error);
-			throw new APIError("BAD_REQUEST", { message: "Invalid or expired invitation." });
-		}
-		if (invitation.status !== "pending") throw new APIError("BAD_REQUEST", { message: `This invitation has already been ${invitation.status}.` });
+		const { token, password } = ctx.body;
+		const fallbackRedirect = getFallbackRedirect(ctx);
+		const invitation = await verifyPendingInvitation(token, $api, ctx);
 		if (!ctx.context) throw new APIError("BAD_REQUEST", { message: "Context is required" });
 		const invitationEmail = normalizeEmail(invitation.email, ctx.context);
 		const existingUser = await ctx.context.internalAdapter.findUserByEmail(invitationEmail).then((user) => user?.user);
@@ -3766,6 +3884,7 @@ const completeInvitation = (options) => {
 				redirectUrl: invitation.redirectUrl ?? fallbackRedirect
 			};
 		}
+		if (!password) throw new APIError("BAD_REQUEST", { message: "Password is required to complete this invitation." });
 		const user = await ctx.context.internalAdapter.createUser({
 			email: invitationEmail,
 			name: invitation.name || invitation.email.split("@")[0] || "",
@@ -3773,19 +3892,12 @@ const completeInvitation = (options) => {
 			createdAt: /* @__PURE__ */ new Date(),
 			updatedAt: /* @__PURE__ */ new Date()
 		});
-		if (password) await ctx.context.internalAdapter.createAccount({
+		await ctx.context.internalAdapter.createAccount({
 			userId: user.id,
 			providerId: "credential",
 			accountId: user.id,
 			password: await ctx.context.password.hash(password)
 		});
-		else if (providerId && providerAccountId) await ctx.context.internalAdapter.createAccount({
-			userId: user.id,
-			providerId,
-			accountId: providerAccountId,
-			accessToken,
-			refreshToken
-		});
 		const { error: markError } = await $api("/api/internal/invitations/mark-accepted", {
 			method: "POST",
 			body: {
@@ -3804,6 +3916,30 @@ const completeInvitation = (options) => {
 		};
 	});
 };
+const completeInvitationSocial = (options) => {
+	const { $api } = options;
+	return createAuthEndpoint("/dash/complete-invitation-social", {
+		method: "GET",
+		query: z$1.object({ token: z$1.string() }),
+		use: [sessionMiddleware]
+	}, async (ctx) => {
+		const sessionUser = ctx.context.session?.user;
+		if (!sessionUser) throw new APIError("UNAUTHORIZED", { message: "Authentication required." });
+		const invitation = await verifyPendingInvitation(ctx.query.token, $api, ctx);
+		const invitationEmail = normalizeEmail(invitation.email, ctx.context);
+		const sessionEmail = sessionUser.email ? normalizeEmail(sessionUser.email, ctx.context) : null;
+		if (!sessionEmail || sessionEmail !== invitationEmail) throw new APIError("BAD_REQUEST", { message: "Signed-in account does not match this invitation." });
+		const { error: markError } = await $api("/api/internal/invitations/mark-accepted", {
+			method: "POST",
+			body: {
+				token: ctx.query.token,
+				userId: sessionUser.id
+			}
+		});
+		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
+		return ctx.redirect((invitation.redirectUrl || getFallbackRedirect(ctx)).toString());
+	});
+};
 /**
 * Check if a user exists by email
 * Used by the platform to verify before sending invitation
@@ -5661,7 +5797,7 @@ const revokeAllSessions = (options) => createAuthEndpoint("/dash/sessions/revoke
 }, async (ctx) => {
 	const { userId } = ctx.body;
 	if (!await ctx.context.internalAdapter.findUserById(userId)) throw ctx.error("NOT_FOUND", { message: "User not found" });
-	await ctx.context.internalAdapter.deleteSessions(userId);
+	await ctx.context.internalAdapter.deleteUserSessions(userId);
 	return ctx.json({ success: true });
 });
 const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revoke-many", {
@@ -5670,7 +5806,7 @@ const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revok
 }, async (ctx) => {
 	const { userIds } = ctx.context.payload;
 	await withConcurrency(chunkArray(userIds, { batchSize: 50 }), async (chunk) => {
-		for (const userId of chunk) await ctx.context.internalAdapter.deleteSessions(userId);
+		for (const userId of chunk) await ctx.context.internalAdapter.deleteUserSessions(userId);
 	}, { concurrency: 3 });
 	return ctx.json({
 		success: true,
@@ -5694,8 +5830,14 @@ function isPrivateIPv4(a, b) {
 	if (a === 169 && b === 254) return true;
 	if (a === 0) return true;
 	if (a === 100 && b >= 64 && b <= 127) return true;
+	if (a >= 224) return true;
 	return false;
 }
+function parseIPv4Quad(quad) {
+	const v4parts = quad.split(".").map(Number);
+	if (v4parts.length === 4 && v4parts.every((p) => !isNaN(p) && p >= 0 && p <= 255)) return [v4parts[0], v4parts[1]];
+	return null;
+}
 /**
 * Loopback, RFC1918, link-local, CGNAT, ULA, documentation, NAT64 well-known,
 * IPv4-mapped private, unspecified, and multicast (RFC 4291 section 2.7).
@@ -5732,12 +5874,23 @@ function parseIPv6(addr) {
 	if (left.length !== 8) return null;
 	return left;
 }
+/** True when the hostname is an IPv4 or IPv6 literal (not a DNS name). */
+function isIpLiteralHostname(hostname) {
+	const bare = hostname.replace(/^\[|\]$/g, "");
+	if (parseIPv4Quad(bare)) return true;
+	return parseIPv6(bare)?.length === 8;
+}
 /** Returns true if the hostname resolves to a private/reserved IP or is a local hostname. */
 function isPrivateHost(hostname) {
-	if (hostname === "localhost" || hostname.endsWith(".local") || hostname.endsWith(".internal")) return true;
+	if (hostname === "localhost" || hostname.endsWith(".local") || hostname.endsWith(".internal") || hostname.endsWith(".localhost")) return true;
 	const bare = hostname.replace(/^\[|\]$/g, "");
-	const v4parts = bare.split(".").map(Number);
-	if (v4parts.length === 4 && v4parts.every((p) => !isNaN(p) && p >= 0 && p <= 255)) return isPrivateIPv4(v4parts[0], v4parts[1]);
+	const v4 = parseIPv4Quad(bare);
+	if (v4) return isPrivateIPv4(v4[0], v4[1]);
+	const mappedTail = bare.match(/(?:^|:)([\d.]+)$/);
+	if (mappedTail && mappedTail[1].includes(".")) {
+		const mappedV4 = parseIPv4Quad(mappedTail[1]);
+		if (mappedV4) return isPrivateIPv4(mappedV4[0], mappedV4[1]);
+	}
 	const groups = parseIPv6(bare);
 	if (groups && groups.length === 8) return ipv6GroupsAreNonPublic(groups);
 	return false;
@@ -5775,39 +5928,41 @@ async function resolveHostnameAddresses(hostname) {
 		return null;
 	}
 }
-function validateUrlSync(rawUrl, options = {}) {
-	const trimmed = rawUrl.trim();
+function validateUrlSync(input, options = {}) {
 	let parsed;
-	try {
-		parsed = new URL(trimmed);
-	} catch {
-		return {
-			ok: false,
-			reason: "invalid_url",
-			url: trimmed
-		};
+	if (input instanceof URL) parsed = input;
+	else {
+		const trimmed = input.trim();
+		try {
+			parsed = new URL(trimmed);
+		} catch {
+			return {
+				ok: false,
+				reason: "invalid_url"
+			};
+		}
 	}
 	if (!isAllowedProtocol(parsed.protocol, options.allowedProtocols)) return {
 		ok: false,
 		reason: "disallowed_protocol",
-		url: trimmed,
+		url: parsed,
 		protocol: parsed.protocol
 	};
 	if (parsed.username !== "" || parsed.password !== "") return {
 		ok: false,
 		reason: "embedded_credentials",
-		url: trimmed
+		url: parsed
 	};
 	if (isPrivateHost(parsed.hostname)) return {
 		ok: false,
 		reason: "private_host",
-		url: trimmed
+		url: parsed
 	};
 	if (options.allowedOrigins?.length) {
 		if (!isAllowedOrigin(parsed.origin, options.allowedOrigins)) return {
 			ok: false,
 			reason: "disallowed_origin",
-			url: trimmed,
+			url: parsed,
 			hostname: parsed.hostname,
 			origin: parsed.origin
 		};
@@ -5818,21 +5973,32 @@ function validateUrlSync(rawUrl, options = {}) {
 	};
 }
 /** SSRF checks with DNS resolution when available. */
-async function validateUrl(rawUrl, options = {}) {
-	const sync = validateUrlSync(rawUrl, options);
+async function validateUrl(input, options = {}) {
+	const sync = validateUrlSync(input, options);
 	if (!sync.ok) return sync;
 	if (options.dns === false) return sync;
-	const addresses = await resolveHostnameAddresses(sync.url.hostname);
+	const hostname = sync.url.hostname;
+	const addresses = await resolveHostnameAddresses(hostname);
+	if (!isIpLiteralHostname(hostname) && !addresses?.length) return {
+		ok: false,
+		reason: "unresolved_host",
+		url: sync.url,
+		hostname
+	};
 	if (addresses) {
 		for (const addr of addresses) if (isPrivateHost(addr)) return {
 			ok: false,
 			reason: "private_dns",
-			url: sync.url.href,
-			hostname: sync.url.hostname,
+			url: sync.url,
+			hostname,
 			address: addr
 		};
 	}
-	return sync;
+	return {
+		ok: true,
+		url: sync.url,
+		...addresses ? { addresses } : {}
+	};
 }
 function safeResolveUrl(raw, baseURL) {
 	const trim = raw.trim();
@@ -5848,12 +6014,6 @@ function safeResolveUrl(raw, baseURL) {
 }
 //#endregion
 //#region src/validation/ssrf.ts
-/**
-* SSRF protection for dash plugin outbound fetches.
-*
-* Uses @infra/utils at build time; tsdown bundles it into published dist so
-* consumers do not install the private workspace package.
-*/
 const REDIRECT_STATUSES = new Set([
 	301,
 	302,
@@ -5868,11 +6028,6 @@ var SsrfBlockedError = class extends Error {
 function isSsrfBlockedError(error) {
 	return error instanceof SsrfBlockedError;
 }
-/** Validates URL hostname literals and resolved DNS addresses. */
-async function parseAndValidateUrl(url) {
-	const result = await validateUrl(url);
-	return result.ok ? result.url : null;
-}
 /**
 * Fetch with SSRF checks on the initial URL and every redirect target.
 */
@@ -5880,8 +6035,9 @@ async function $outbound(url, options = {}) {
 	const { timeout, signal: callerSignal, ...fetchInit } = options;
 	let currentUrl = url;
 	for (let hop = 0;; hop++) {
-		const validated = await parseAndValidateUrl(currentUrl);
-		if (!validated) throw new SsrfBlockedError("Invalid or blocked URL");
+		const result = await validateUrl(currentUrl);
+		if (!result.ok) throw new SsrfBlockedError("Invalid or blocked URL");
+		const validated = result.url;
 		const signals = [];
 		if (callerSignal) signals.push(callerSignal);
 		if (timeout !== void 0 && timeout > 0) signals.push(AbortSignal.timeout(timeout));
@@ -5896,7 +6052,7 @@ async function $outbound(url, options = {}) {
 		const location = response.headers.get("location");
 		const next = location ? safeResolveUrl(location, validated.href) : null;
 		if (!next) throw new SsrfBlockedError("Invalid redirect location");
-		currentUrl = next.href;
+		currentUrl = next;
 	}
 }
 //#endregion
@@ -6011,23 +6167,19 @@ const oidcConfigSchema = z$1.object({
 });
 async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 	let idpMetadataXml = samlConfig.idpMetadata?.metadata;
-	if (!idpMetadataXml && samlConfig.idpMetadata?.metadataUrl) {
-		const validatedMetadataUrl = await parseAndValidateUrl(samlConfig.idpMetadata.metadataUrl);
-		if (!validatedMetadataUrl) throw ctx.error("BAD_REQUEST", { message: "Invalid or blocked IdP metadata URL" });
-		try {
-			const metadataResponse = await $outbound(validatedMetadataUrl.href, {
-				method: "GET",
-				headers: { Accept: "application/xml, text/xml" },
-				timeout: 15e3
-			});
-			if (!metadataResponse.ok) throw ctx.error("BAD_REQUEST", { message: `Failed to fetch IdP metadata from URL: ${metadataResponse.status} ${metadataResponse.statusText}` });
-			idpMetadataXml = await metadataResponse.text();
-		} catch (e) {
-			if (isSsrfBlockedError(e)) throw ctx.error("BAD_REQUEST", { message: "Invalid or blocked IdP metadata URL" });
-			if (e instanceof APIError$1) throw e;
-			ctx.context.logger.error("[Dash] Failed to fetch IdP metadata from URL:", e);
-			throw ctx.error("BAD_REQUEST", { message: "Failed to fetch IdP metadata from URL" });
-		}
+	if (!idpMetadataXml && samlConfig.idpMetadata?.metadataUrl) try {
+		const metadataResponse = await $outbound(samlConfig.idpMetadata.metadataUrl, {
+			method: "GET",
+			headers: { Accept: "application/xml, text/xml" },
+			timeout: 15e3
+		});
+		if (!metadataResponse.ok) throw ctx.error("BAD_REQUEST", { message: `Failed to fetch IdP metadata from URL: ${metadataResponse.status} ${metadataResponse.statusText}` });
+		idpMetadataXml = await metadataResponse.text();
+	} catch (e) {
+		if (isSsrfBlockedError(e)) throw ctx.error("BAD_REQUEST", { message: "Invalid or blocked IdP metadata URL" });
+		if (e instanceof APIError$1) throw e;
+		ctx.context.logger.error("[Dash] Failed to fetch IdP metadata from URL:", e);
+		throw ctx.error("BAD_REQUEST", { message: "Failed to fetch IdP metadata from URL" });
 	}
 	const metadataAlgorithmWarnings = [];
 	if (idpMetadataXml) {
@@ -6571,41 +6723,13 @@ const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-fac
 	} catch {}
 	const user = await ctx.context.internalAdapter.findUserById(userId);
 	const issuer = twoFactorPlugin.options?.issuer || ctx.context.appName || "BetterAuth";
-	return {
-		totpURI: `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(user?.email || userId)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30`,
-		secret
-	};
+	return { totpURI: `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(user?.email || userId)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30` };
 });
 const viewBackupCodes = (options) => createAuthEndpoint("/dash/view-backup-codes", {
 	method: "POST",
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
-}, async (ctx) => {
-	const { userId } = ctx.context.payload;
-	const twoFactorRecord = await ctx.context.adapter.findOne({
-		model: "twoFactor",
-		where: [{
-			field: "userId",
-			value: userId
-		}]
-	});
-	if (!twoFactorRecord) throw new APIError("NOT_FOUND", { message: "Two-factor authentication not set up for this user" });
-	let backupCodes;
-	try {
-		backupCodes = JSON.parse(twoFactorRecord.backupCodes);
-	} catch {
-		try {
-			const { symmetricDecrypt } = await import("better-auth/crypto");
-			const decrypted = await symmetricDecrypt({
-				key: ctx.context.secret,
-				data: twoFactorRecord.backupCodes
-			});
-			backupCodes = JSON.parse(decrypted);
-		} catch (decryptError) {
-			ctx.context.logger.debug("[Dash] Failed to decrypt backup codes:", decryptError);
-			throw new APIError("INTERNAL_SERVER_ERROR", { message: "Failed to decrypt backup codes" });
-		}
-	}
-	return { backupCodes };
+}, async () => {
+	throw new APIError("FORBIDDEN", { message: "Backup codes cannot be viewed after initial setup. Generate new codes instead." });
 });
 const disableTwoFactor = (options) => createAuthEndpoint("/dash/disable-two-factor", {
 	method: "POST",
@@ -7599,7 +7723,7 @@ const banUser = (options) => createAuthEndpoint("/dash/ban-user", {
 		banExpires: banExpires ? new Date(banExpires) : null,
 		updatedAt: /* @__PURE__ */ new Date()
 	});
-	await ctx.context.internalAdapter.deleteSessions(userId);
+	await ctx.context.internalAdapter.deleteUserSessions(userId);
 	return { success: true };
 });
 const banManyUsers = (options) => {
@@ -7929,6 +8053,13 @@ async function sendSMS(options, config) {
 }
 //#endregion
 //#region src/index.ts
+async function getRequestLocation() {
+	try {
+		return (await getCurrentAuthContext()).context.location;
+	} catch {
+		return;
+	}
+}
 const dash = (options) => {
 	const processedBulkOperationContexts = /* @__PURE__ */ new WeakSet();
 	const opts = resolveDashOptions(options);
@@ -7960,85 +8091,85 @@ const dash = (options) => {
 					const afterCreateOrganization = organizationHooks.afterCreateOrganization;
 					organizationHooks.afterCreateOrganization = async (...args) => {
 						const [{ organization, user }] = args;
-						trackOrganizationCreated(organization, getOrganizationTriggerInfo(user));
+						trackOrganizationCreated(organization, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterCreateOrganization) return afterCreateOrganization(...args);
 					};
 					const afterUpdateOrganization = organizationHooks.afterUpdateOrganization;
 					organizationHooks.afterUpdateOrganization = async (...args) => {
 						const [{ organization, user }] = args;
-						if (organization) trackOrganizationUpdated(organization, getOrganizationTriggerInfo(user));
+						if (organization) trackOrganizationUpdated(organization, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterUpdateOrganization) return afterUpdateOrganization(...args);
 					};
 					const afterAddMember = organizationHooks.afterAddMember;
 					organizationHooks.afterAddMember = async (...args) => {
 						const [{ organization, member, user }] = args;
-						trackOrganizationMemberAdded(organization, member, user, getOrganizationTriggerInfo(user));
+						trackOrganizationMemberAdded(organization, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterAddMember) return afterAddMember(...args);
 					};
 					const afterRemoveMember = organizationHooks.afterRemoveMember;
 					organizationHooks.afterRemoveMember = async (...args) => {
 						const [{ organization, member, user }] = args;
-						trackOrganizationMemberRemoved(organization, member, user, getOrganizationTriggerInfo(user));
+						trackOrganizationMemberRemoved(organization, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterRemoveMember) return afterRemoveMember(...args);
 					};
 					const afterUpdateMemberRole = organizationHooks.afterUpdateMemberRole;
 					organizationHooks.afterUpdateMemberRole = async (...args) => {
 						const [{ organization, member, user, previousRole }] = args;
-						trackOrganizationMemberRoleUpdated(organization, member, user, previousRole, getOrganizationTriggerInfo(user));
+						trackOrganizationMemberRoleUpdated(organization, member, user, previousRole, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterUpdateMemberRole) return afterUpdateMemberRole(...args);
 					};
 					const afterCreateInvitation = organizationHooks.afterCreateInvitation;
 					organizationHooks.afterCreateInvitation = async (...args) => {
 						const [{ organization, invitation, inviter }] = args;
-						trackOrganizationMemberInvited(organization, invitation, inviter, getOrganizationTriggerInfo(inviter));
+						trackOrganizationMemberInvited(organization, invitation, inviter, getOrganizationTriggerInfo(inviter), await getRequestLocation());
 						if (afterCreateInvitation) return afterCreateInvitation(...args);
 					};
 					const afterAcceptInvitation = organizationHooks.afterAcceptInvitation;
 					organizationHooks.afterAcceptInvitation = async (...args) => {
 						const [{ organization, invitation, member, user }] = args;
-						trackOrganizationMemberInviteAccepted(organization, invitation, member, user, getOrganizationTriggerInfo(user));
+						trackOrganizationMemberInviteAccepted(organization, invitation, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterAcceptInvitation) return afterAcceptInvitation(...args);
 					};
 					const afterRejectInvitation = organizationHooks.afterRejectInvitation;
 					organizationHooks.afterRejectInvitation = async (...args) => {
 						const [{ organization, invitation, user }] = args;
-						trackOrganizationMemberInviteRejected(organization, invitation, user, getOrganizationTriggerInfo(user));
+						trackOrganizationMemberInviteRejected(organization, invitation, user, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterRejectInvitation) return afterRejectInvitation(...args);
 					};
 					const afterCancelInvitation = organizationHooks.afterCancelInvitation;
 					organizationHooks.afterCancelInvitation = async (...args) => {
 						const [{ organization, invitation, cancelledBy }] = args;
-						trackOrganizationMemberInviteCanceled(organization, invitation, cancelledBy, getOrganizationTriggerInfo(cancelledBy));
+						trackOrganizationMemberInviteCanceled(organization, invitation, cancelledBy, getOrganizationTriggerInfo(cancelledBy), await getRequestLocation());
 						if (afterCancelInvitation) return afterCancelInvitation(...args);
 					};
 					const afterCreateTeam = organizationHooks.afterCreateTeam;
 					organizationHooks.afterCreateTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						trackOrganizationTeamCreated(organization, team, getOrganizationTriggerInfo(user));
+						trackOrganizationTeamCreated(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterCreateTeam) return afterCreateTeam(...args);
 					};
 					const afterUpdateTeam = organizationHooks.afterUpdateTeam;
 					organizationHooks.afterUpdateTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						if (team) trackOrganizationTeamUpdated(organization, team, getOrganizationTriggerInfo(user));
+						if (team) trackOrganizationTeamUpdated(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterUpdateTeam) return afterUpdateTeam(...args);
 					};
 					const afterDeleteTeam = organizationHooks.afterDeleteTeam;
 					organizationHooks.afterDeleteTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						trackOrganizationTeamDeleted(organization, team, getOrganizationTriggerInfo(user));
+						trackOrganizationTeamDeleted(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterDeleteTeam) return afterDeleteTeam(...args);
 					};
 					const afterAddTeamMember = organizationHooks.afterAddTeamMember;
 					organizationHooks.afterAddTeamMember = async (...args) => {
 						const [{ organization, team, user, teamMember }] = args;
-						trackOrganizationTeamMemberAdded(organization, team, user, teamMember, getOrganizationTriggerInfo(user));
+						trackOrganizationTeamMemberAdded(organization, team, user, teamMember, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterAddTeamMember) return afterAddTeamMember(...args);
 					};
 					const afterRemoveTeamMember = organizationHooks.afterRemoveTeamMember;
 					organizationHooks.afterRemoveTeamMember = async (...args) => {
 						const [{ organization, team, user, teamMember }] = args;
-						trackOrganizationTeamMemberRemoved(organization, team, user, teamMember, getOrganizationTriggerInfo(user));
+						trackOrganizationTeamMemberRemoved(organization, team, user, teamMember, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterRemoveTeamMember) return afterRemoveTeamMember(...args);
 					};
 				};
@@ -8219,7 +8350,11 @@ const dash = (options) => {
 				matcher: (ctx) => {
 					if (ctx.request?.method !== "GET") return true;
 					const path = new URL(ctx.request.url).pathname;
-					return matchesAnyRoute(path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]);
+					return matchesAnyRoute(path, [
+						routes.SIGN_IN_SOCIAL_CALLBACK,
+						routes.SIGN_IN_OAUTH_CALLBACK,
+						routes.DASH_IMPERSONATE_USER
+					]);
 				},
 				handler: createIdentificationMiddleware($kv)
 			}],
@@ -8227,16 +8362,20 @@ const dash = (options) => {
 				matcher: (ctx) => {
 					if (ctx.request?.method !== "GET") return true;
 					const path = new URL(ctx.request.url).pathname;
-					return matchesAnyRoute(path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]);
+					return matchesAnyRoute(path, [
+						routes.SIGN_IN_SOCIAL_CALLBACK,
+						routes.SIGN_IN_OAUTH_CALLBACK,
+						routes.DASH_IMPERSONATE_USER
+					]);
 				},
 				handler: createAuthMiddleware(async (_ctx) => {
 					const ctx = _ctx;
 					const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
-					if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx);
+					if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx.context.location);
 					const body = ctx.body;
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger);
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger);
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK]) && ctx.request?.method === "GET" && ctx.context.returned instanceof Error && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger);
+					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger, ctx.context.location);
+					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger, ctx.context.location);
+					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK]) && ctx.request?.method === "GET" && ctx.context.returned instanceof Error && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger, ctx.context.location);
 					const headerRequestId = ctx.request?.headers.get("X-Request-Id");
 					if (headerRequestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
 						maxAge: 600,
@@ -8341,6 +8480,7 @@ const dash = (options) => {
 			getEventTypes: getEventTypes(settings),
 			dashAcceptInvitation: acceptInvitation(settings),
 			dashCompleteInvitation: completeInvitation(settings),
+			dashCompleteInvitationSocial: completeInvitationSocial(settings),
 			dashCheckUserExists: checkUserExists(settings),
 			listDashOrganizationDirectories: listOrganizationDirectories(settings),
 			createDashOrganizationDirectory: createOrganizationDirectory(settings),