@better-auth/infra 0.2.13 → 0.3.0

package/dist/index.mjs

@@ -1,8 +1,8 @@
-import { n as INFRA_API_URL, r as INFRA_KV_URL } from "./constants-CvriWQVc.mjs";
-import { n as createKV, t as createAPI } from "./fetch-DiAhoiKA.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-vBiGTmGf.mjs";
+import { a as createAPI, o as createKV, r as hmacSha256Hex } from "./crypto-DjtrPUlP.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAuthContext } from "@better-auth/core/context";
-import { APIError, generateId, getAuthTables, logger, parseState } from "better-auth";
+import { APIError, generateId, getAuthTables, logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { APIError as APIError$1, createAuthEndpoint, createAuthMiddleware, requestPasswordReset, sendVerificationEmailFn, sessionMiddleware } from "better-auth/api";
 import { createFetch } from "@better-fetch/fetch";
@@ -10,6 +10,8 @@ import { isValidPhoneNumber, parsePhoneNumberFromString } from "libphonenumber-j
 import { createLocalJWKSet, jwtVerify } from "jose";
 import z$1, { z } from "zod";
 import { setSessionCookie } from "better-auth/cookies";
+import { generateRandomString, symmetricEncrypt } from "better-auth/crypto";
+import { createOTP } from "@better-auth/utils/otp";
 //#region src/options.ts
 function resolveConnectionOptions(options) {
 	return {
@@ -66,6 +68,7 @@ const EVENT_TYPES = {
 	USER_IMPERSONATED: "user_impersonated",
 	USER_IMPERSONATED_STOPPED: "user_impersonated_stopped"
 };
+const UNKNOWN_USER = "unknown";
 const routes = {
 	SEND_VERIFICATION_EMAIL: "/send-verification-email",
 	SIGN_IN: "/sign-in",
@@ -75,7 +78,7 @@ const routes = {
 	SIGN_IN_SOCIAL: "/sign-in/social",
 	SIGN_IN_ANONYMOUS: "/sign-in/anonymous",
 	SIGN_IN_SOCIAL_CALLBACK: "/callback/:id",
-	SIGN_IN_OAUTH_CALLBACK: "/oauth2/callback/:id",
+	SIGN_IN_OAUTH_CALLBACK: "/oauth2/callback/:providerId",
 	SIGN_OUT: "/sign-out",
 	SIGN_UP: "/sign-up",
 	SIGN_UP_EMAIL: "/sign-up/email",
@@ -106,7 +109,11 @@ const routes = {
 	API_KEY_CREATE: "/api-key/create",
 	LINK_SOCIAL: "/link-social",
 	DASH_ROUTE: "/dash",
+	DASH_ACCEPT_INVITATION: "/dash/accept-invitation",
+	DASH_COMPLETE_INVITATION_SOCIAL: "/dash/complete-invitation-social",
 	DASH_UPDATE_USER: "/dash/update-user",
+	DASH_SET_PASSWORD: "/dash/set-password",
+	DASH_SEND_VERIFICATION_EMAIL: "/dash/send-verification-email",
 	DASH_REVOKE_SESSIONS_ALL: "/dash/sessions/revoke-all",
 	DASH_IMPERSONATE_USER: "/dash/impersonate-user",
 	DASH_BAN_USER: "/dash/ban-user",
@@ -181,34 +188,6 @@ async function getUserById(userId, ctx) {
 	}
 	return user;
 }
-const getUserByIdToken = async (providerId, idToken, ctx) => {
-	const provider = ctx.context.socialProviders.find((p) => p.id === providerId);
-	let user = null;
-	if (provider) try {
-		user = await provider.getUserInfo(idToken);
-	} catch (error) {
-		logger.debug("[Dash] Failed to fetch user info:", error);
-	}
-	return user;
-};
-const getUserByAuthorizationCode = async (providerId, ctx) => {
-	let userInfo = null;
-	const provider = ctx.context.socialProviders.find((p) => p.id === providerId);
-	if (provider) try {
-		const codeVerifier = (await parseState(ctx)).codeVerifier;
-		const { code, device_id } = ctx.query ?? {};
-		const tokens = await provider.validateAuthorizationCode({
-			code,
-			codeVerifier,
-			deviceId: device_id,
-			redirectURI: `${ctx.context.baseURL}/callback/${provider.id}`
-		});
-		userInfo = await provider.getUserInfo({ ...tokens }).then((res) => res?.user);
-	} catch (error) {
-		logger.debug("[Dash] Failed to fetch user info:", error);
-	}
-	return userInfo;
-};
 //#endregion
 //#region src/events/core/events-account.ts
 const initAccountEvents = (tracker) => {
@@ -307,13 +286,22 @@ const stripQuery = (value) => value.split("?")[0] || value;
 const escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 const routeToRegex = (route) => {
 	const pattern = escapeRegex(stripQuery(route)).replace(/\/:([^/]+)/g, "/[^/]+");
-	return new RegExp(`${pattern}(?:$|[/?])`);
+	return new RegExp(`^${pattern}(?:$|[/?])`);
 };
 const matchesAnyRoute = (path, routes) => {
+	if (!path) return false;
 	const cleanPath = stripQuery(path);
 	return routes.some((route) => routeToRegex(route).test(cleanPath));
 };
 //#endregion
+//#region src/events/oauth-callback-provider.ts
+/** Provider id from social (`/callback/:id`) or generic OAuth (`/oauth2/callback/:providerId`). */
+function getOAuthCallbackProviderId(ctx) {
+	const id = ctx.params?.id ?? ctx.params?.providerId;
+	if (typeof id !== "string" || !id || id.startsWith(":")) return;
+	return id;
+}
+//#endregion
 //#region src/events/login-methods.ts
 const OAUTH_CALLBACK_PATHS = [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK];
 const PATH_TO_METHOD = [
@@ -336,15 +324,58 @@ const PATH_TO_METHOD = [
 	[routes.SIWE_VERIFY, "siwe"]
 ];
 const getLoginMethod = (ctx) => {
-	if (matchesAnyRoute(ctx.path, OAUTH_CALLBACK_PATHS)) {
-		const id = ctx.params?.id;
-		if (typeof id === "string" && id && !id.startsWith(":")) return id;
-		return null;
-	}
+	if (matchesAnyRoute(ctx.path, OAUTH_CALLBACK_PATHS)) return getOAuthCallbackProviderId(ctx) ?? null;
 	for (const [path, method] of PATH_TO_METHOD) if (matchesAnyRoute(ctx.path, [path])) return method;
 	return null;
 };
 //#endregion
+//#region src/events/core/oauth-callback-user.ts
+const OAUTH_CALLBACK_USER = Symbol.for("dash.oauthCallbackUser");
+/**
+* Stash OAuth profile on the request context when better-auth calls getUserInfo
+* during the callback, before the authorization code is consumed.
+*/
+function instrumentSocialProviders(providers) {
+	for (const provider of providers) {
+		const originalGetUserInfo = provider.getUserInfo.bind(provider);
+		provider.getUserInfo = async (token) => {
+			const result = await originalGetUserInfo(token);
+			const user = result?.user;
+			if (user) try {
+				const endpointCtx = await getCurrentAuthContext();
+				endpointCtx.context[OAUTH_CALLBACK_USER] = user;
+			} catch {}
+			return result;
+		};
+	}
+}
+async function resolveOAuthUser(providerId, ctx) {
+	const oauthUser = ctx.context[OAUTH_CALLBACK_USER];
+	if (!oauthUser) return null;
+	const email = oauthUser.email?.toLowerCase();
+	const accountId = oauthUser.id !== void 0 && oauthUser.id !== null ? String(oauthUser.id) : void 0;
+	if (email && accountId) try {
+		const result = await ctx.context.internalAdapter.findOAuthUser(email, accountId, providerId);
+		if (result?.user) return {
+			id: result.user.id,
+			email: result.user.email,
+			name: result.user.name
+		};
+	} catch (error) {
+		logger.debug("[Dash] Failed to find OAuth user:", error);
+	}
+	if (email) {
+		const user = await getUserByEmail(email, ctx);
+		if (user) return user;
+	}
+	if (!email && !oauthUser.name) return null;
+	return {
+		id: UNKNOWN_USER,
+		email: oauthUser.email ?? null,
+		name: oauthUser.name ?? "unknown"
+	};
+}
+//#endregion
 //#region src/events/core/events-session.ts
 const initSessionEvents = (tracker) => {
 	const { trackEvent } = tracker;
@@ -560,7 +591,7 @@ const initSessionEvents = (tracker) => {
 				eventDisplayName: "User sign-in attempt failed",
 				eventData: {
 					userId: user?.id ?? "unknown",
-					nameName: user?.name ?? "unknown",
+					userName: user?.name ?? "unknown",
 					userEmail: ctx.body.email,
 					loginMethod: getLoginMethod(ctx),
 					triggeredBy: user?.id ?? trigger.triggeredBy,
@@ -574,19 +605,19 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackSocialSignInAttempt = (ctx, trigger, location) => {
+	const trackSocialSignInFailure = (ctx, providerId, trigger, location) => {
 		const track = async () => {
-			const user = await getUserByIdToken(ctx.body.provider, ctx.body.idToken, ctx);
+			const user = await resolveOAuthUser(providerId, ctx);
 			trackEvent({
-				eventKey: user?.user.id.toString() ?? "unknown",
+				eventKey: user?.id ?? "unknown",
 				eventType: EVENT_TYPES.USER_SIGN_IN_FAILED,
 				eventDisplayName: "User sign-in attempt failed",
 				eventData: {
-					userId: user?.user.id.toString() ?? "unknown",
-					userName: user?.user.name ?? "unknown",
-					userEmail: user?.user.email ?? "unknown",
+					userId: user?.id ?? "unknown",
+					userName: user?.name ?? "unknown",
+					userEmail: user?.email ?? "unknown",
 					loginMethod: getLoginMethod(ctx),
-					triggeredBy: user?.user.id ?? trigger.triggeredBy,
+					triggeredBy: user && user.id !== "unknown" ? user.id : trigger.triggeredBy,
 					triggerContext: trigger.triggerContext
 				},
 				ipAddress: location?.ipAddress,
@@ -597,28 +628,13 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
+	const trackSocialSignInAttempt = (ctx, trigger, location) => {
+		trackSocialSignInFailure(ctx, ctx.body.provider, trigger, location);
+	};
 	const trackSocialSignInRedirectionAttempt = (ctx, trigger, location) => {
-		const track = async () => {
-			const user = await getUserByAuthorizationCode(tryDecode(ctx.params?.id), ctx);
-			trackEvent({
-				eventKey: user?.id.toString() ?? "unknown",
-				eventType: EVENT_TYPES.USER_SIGN_IN_FAILED,
-				eventDisplayName: "User sign-in attempt failed",
-				eventData: {
-					userId: user?.id.toString() ?? "unknown",
-					userName: user?.name ?? "unknown",
-					userEmail: user?.id ?? "unknown",
-					loginMethod: getLoginMethod(ctx),
-					triggeredBy: trigger.triggeredBy,
-					triggerContext: trigger.triggerContext
-				},
-				ipAddress: location?.ipAddress,
-				city: location?.city,
-				country: location?.country,
-				countryCode: location?.countryCode
-			});
-		};
-		ctx.context.runInBackground(track());
+		const providerId = getOAuthCallbackProviderId(ctx);
+		if (!providerId) return;
+		trackSocialSignInFailure(ctx, tryDecode(providerId), trigger, location);
 	};
 	return {
 		trackUserSignedIn,
@@ -888,6 +904,27 @@ const initTrackEvents = ($api) => {
 	return { tracker: { trackEvent } };
 };
 //#endregion
+//#region ../utils/dist/ip.mjs
+/** Platform-set client IP headers (not accepted from clients on the open internet). */
+const DEFAULT_TRUSTED_IP_HEADERS = [
+	"cf-connecting-ip",
+	"true-client-ip",
+	"x-vercel-forwarded-for"
+];
+/**
+* Resolves client IP from request headers.
+* Defaults to platform-trusted headers only; set `ipAddressHeaders` for self-hosted proxies.
+*/
+function resolveClientIpFromHeaders(headers, ipAddressHeaders) {
+	const headerNames = ipAddressHeaders?.length ? ipAddressHeaders : [...DEFAULT_TRUSTED_IP_HEADERS];
+	for (const headerName of headerNames) {
+		const value = headers.get(headerName);
+		if (!value) continue;
+		const ip = value.split(",")[0]?.trim();
+		if (ip) return ip;
+	}
+}
+//#endregion
 //#region src/identification.ts
 /**
 * Identification Service
@@ -908,6 +945,20 @@ function cleanupCache() {
 function maybeCleanup() {
 	if (Date.now() - lastCleanup > CACHE_TTL_MS || identificationCache.size > CACHE_MAX_SIZE) cleanupCache();
 }
+/** Retries 404 races with exponential backoff (≤1s total wait across retries). */
+const IDENTIFY_GET_RETRY = {
+	type: "exponential",
+	attempts: 2,
+	baseDelay: 400,
+	maxDelay: 600,
+	shouldRetry(response) {
+		if (response === null) return true;
+		return response.status === 404;
+	}
+};
+function identifyGetRetryDelay(attempt) {
+	return Math.min(600, 400 * 2 ** attempt);
+}
 /**
 * Fetch identification data from durable-kv by requestId
 */
@@ -915,14 +966,11 @@ async function getIdentification(requestId, $kv) {
 	maybeCleanup();
 	const cached = identificationCache.get(requestId);
 	if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) return cached.data;
-	const maxRetries = 3;
-	const retryDelays = [
-		50,
-		100,
-		200
-	];
-	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
-		const { data, error } = await $kv(`/identify/${requestId}`, { method: "GET" });
+	for (let networkAttempt = 0;; networkAttempt++) try {
+		const { data, error } = await $kv(`/identify/${requestId}`, {
+			method: "GET",
+			retry: IDENTIFY_GET_RETRY
+		});
 		if (data && !error) {
 			identificationCache.set(requestId, {
 				data,
@@ -930,24 +978,18 @@ async function getIdentification(requestId, $kv) {
 			});
 			return data;
 		}
-		const status = error?.status;
-		if (status === 404 && attempt < maxRetries) {
-			await new Promise((resolve) => setTimeout(resolve, retryDelays[attempt]));
-			continue;
-		}
-		if (status !== 404) identificationCache.set(requestId, {
+		if (error?.status !== 404) identificationCache.set(requestId, {
 			data: null,
 			timestamp: Date.now()
 		});
 		return null;
 	} catch (error) {
-		if (attempt === maxRetries) {
+		if (networkAttempt >= IDENTIFY_GET_RETRY.attempts) {
 			logger.error("[Dash] Failed to fetch identification:", error);
 			return null;
 		}
-		await new Promise((resolve) => setTimeout(resolve, retryDelays[attempt] || 50));
+		await new Promise((resolve) => setTimeout(resolve, identifyGetRetryDelay(networkAttempt)));
 	}
-	return null;
 }
 /**
 * Extract identification headers from a request
@@ -1004,23 +1046,22 @@ function createIdentificationMiddleware($kv) {
 		ctx.context.visitorId = visitorId;
 		const ipConfig = ctx.context.options?.advanced?.ipAddress;
 		let location;
+		const requestIp = ctx.request ? resolveClientIpFromHeaders(ctx.request.headers, ipConfig?.ipAddressHeaders || null) : void 0;
+		const requestCountryCode = getCountryCodeFromRequest(ctx.request);
 		if (ipConfig?.disableIpTracking === true) location = void 0;
 		else if (requestId && identification) {
 			const loc = getLocation(identification);
 			location = {
-				ipAddress: identification.ip || void 0,
+				ipAddress: identification.ip || requestIp || void 0,
 				city: loc?.city || void 0,
 				country: loc?.country?.name || void 0,
-				countryCode: loc?.country?.code || void 0
-			};
-		} else {
-			const ipAddress = getClientIpFromRequest(ctx.request, ipConfig?.ipAddressHeaders || null);
-			if (ipAddress) location = {
-				ipAddress,
-				countryCode: getCountryCodeFromRequest(ctx.request)
+				countryCode: loc?.country?.code || requestCountryCode || void 0
 			};
-			else location = void 0;
-		}
+		} else if (requestIp) location = {
+			ipAddress: requestIp,
+			countryCode: requestCountryCode
+		};
+		else location = void 0;
 		ctx.context.location = location;
 		ctx.context.ip = resolveSecurityIp(identification, location);
 		ctx.context.untrustedVisitorId = resolveUntrustedVisitorId(visitorId, ctx.context.ip, headerVisitorId);
@@ -1033,21 +1074,6 @@ function getLocation(identification) {
 	if (!identification) return null;
 	return identification.location;
 }
-function getClientIpFromRequest(request, ipAddressHeaders) {
-	if (!request) return void 0;
-	const headers = ipAddressHeaders?.length ? ipAddressHeaders : [
-		"cf-connecting-ip",
-		"x-forwarded-for",
-		"x-real-ip",
-		"x-vercel-forwarded-for"
-	];
-	for (const headerName of headers) {
-		const value = request.headers.get(headerName);
-		if (!value) continue;
-		const ip = value.split(",")[0]?.trim();
-		if (ip) return ip;
-	}
-}
 function getCountryCodeFromRequest(request) {
 	if (!request) return void 0;
 	const cc = request.headers.get("cf-ipcountry") ?? request.headers.get("x-vercel-ip-country");
@@ -1092,9 +1118,12 @@ function emitEvaluation(ctx, trackEvent, options = {}) {
 	ev.emitted = true;
 	const identification = ctx.context.identification ?? null;
 	const visitorId = ctx.context.visitorId ?? null;
+	const untrustedVisitorId = ctx.context.untrustedVisitorId ?? null;
+	const location = ctx.context.location;
 	const path = ctx.path ?? "";
+	const ipAddress = location?.ipAddress || identification?.ip || ctx.context.ip || void 0;
 	trackEvent({
-		eventKey: visitorId || identification?.ip || "unknown",
+		eventKey: visitorId || ipAddress || untrustedVisitorId || "unknown",
 		eventType: "security_check",
 		eventDisplayName: ev.outcome === "blocked" ? "Security: blocked" : ev.outcome === "challenged" ? "Security: challenged" : "Security: passed",
 		eventData: {
@@ -1107,19 +1136,14 @@ function emitEvaluation(ctx, trackEvent, options = {}) {
 			userAgent: options.userAgent,
 			details: ev.details
 		},
-		ipAddress: identification?.ip || void 0,
-		city: identification?.location?.city || void 0,
-		country: identification?.location?.country?.name || void 0,
-		countryCode: identification?.location?.country?.code || void 0
+		ipAddress,
+		city: location?.city || identification?.location?.city || void 0,
+		country: location?.country || identification?.location?.country?.name || void 0,
+		countryCode: location?.countryCode || identification?.location?.country?.code || void 0
 	});
 }
 //#endregion
 //#region src/sentinel/security.ts
-async function hashForFingerprint(input) {
-	const data = new TextEncoder().encode(input);
-	const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-	return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
 async function sha1Hash(input) {
 	const data = new TextEncoder().encode(input);
 	const hashBuffer = await crypto.subtle.digest("SHA-1", data);
@@ -1184,15 +1208,20 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				default: return "credential_stuffing";
 			}
 		},
-		async trackFailedAttempt(identifier, visitorId, password, ip) {
+		async trackFailedAttempt(identifier, visitorId, password, ip, requestId = null) {
 			try {
+				if (!conn.apiKey) {
+					logger.warn("[Sentinel] Missing apiKey; failed-login password fingerprint is skipped.");
+					return { blocked: false };
+				}
 				const data = await $api("/security/track-failed-login", {
 					method: "POST",
 					body: {
 						identifier,
 						visitorId,
-						passwordHash: await hashForFingerprint(password),
+						passwordHash: await hmacSha256Hex(conn.apiKey, password),
 						ip,
+						requestId,
 						config: options
 					}
 				});
@@ -1221,23 +1250,25 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				logger.error("[Dash] Clear failed attempts error:", error);
 			}
 		},
-		async isBlocked(visitorId, ip) {
+		async isBlocked(visitorId, ip, requestId = null) {
 			try {
 				const params = new URLSearchParams({ visitorId });
 				if (ip) params.set("ip", ip);
+				if (requestId) params.set("requestId", requestId);
 				return (await $api(`/security/is-blocked?${params.toString()}`, { method: "GET" })).blocked ?? false;
 			} catch (error) {
 				logger.warn("[Dash] Security is-blocked check failed:", error);
 				return false;
 			}
 		},
-		async verifyPoWSolution(visitorId, solution) {
+		async verifyPoWSolution(visitorId, solution, requestId = null) {
 			try {
 				return await $api("/security/pow/verify", {
 					method: "POST",
 					body: {
 						visitorId,
-						solution
+						solution,
+						requestId
 					}
 				});
 			} catch (error) {
@@ -1248,12 +1279,13 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				};
 			}
 		},
-		async generateChallenge(visitorId) {
+		async generateChallenge(visitorId, requestId = null) {
 			try {
 				return (await $api("/security/pow/generate", {
 					method: "POST",
 					body: {
 						visitorId,
+						requestId,
 						difficulty: options.challengeDifficulty
 					}
 				})).challenge || "";
@@ -1262,7 +1294,7 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				return "";
 			}
 		},
-		async checkImpossibleTravel(userId, currentLocation, visitorId, ip = null, powSolution) {
+		async checkImpossibleTravel(userId, currentLocation, visitorId, ip = null, powSolution, requestId = null) {
 			if (!options.impossibleTravel?.enabled || !currentLocation) return null;
 			try {
 				const data = await $api("/security/impossible-travel", {
@@ -1270,6 +1302,7 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 					body: {
 						userId,
 						visitorId,
+						requestId,
 						location: currentLocation,
 						ip,
 						config: options,
@@ -1319,20 +1352,23 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 			}
 		},
 		/**
-		* Check if a visitor has exceeded the free trial signup limit.
+		* Atomically reserve a signup slot before user creation.
 		*/
-		async checkFreeTrialAbuse(visitorId) {
+		async reserveFreeTrialSignup(visitorId, reservationId, requestId = null) {
 			if (!options.freeTrialAbuse?.enabled) return {
+				reserved: true,
 				isAbuse: false,
 				accountCount: 0,
 				maxAccounts: 0,
 				action: "log"
 			};
 			try {
-				const data = await $api("/security/free-trial-abuse/check", {
+				const data = await $api("/security/free-trial-abuse/reserve", {
 					method: "POST",
 					body: {
 						visitorId,
+						reservationId,
+						requestId,
 						config: options
 					}
 				});
@@ -1350,8 +1386,9 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				});
 				return data;
 			} catch (error) {
-				logger.warn("[Dash] Free trial abuse check failed:", error);
+				logger.warn("[Dash] Free trial abuse reserve failed:", error);
 				return {
+					reserved: true,
 					isAbuse: false,
 					accountCount: 0,
 					maxAccounts: 0,
@@ -1360,21 +1397,22 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 			}
 		},
 		/**
-		* Track a new signup for free trial abuse detection.
-		* Stores the userId for auditing purposes.
+		* Confirm a reserved signup slot with the created user id.
 		*/
-		async trackFreeTrialSignup(visitorId, userId) {
+		async confirmFreeTrialSignup(visitorId, reservationId, userId, requestId = null) {
 			if (!options.freeTrialAbuse?.enabled) return;
 			try {
-				await $api("/security/free-trial-abuse/track", {
+				await $api("/security/free-trial-abuse/confirm", {
 					method: "POST",
 					body: {
 						visitorId,
-						userId
+						reservationId,
+						userId,
+						requestId
 					}
 				});
 			} catch (error) {
-				logger.error("[Dash] Track free trial signup error:", error);
+				logger.error("[Dash] Confirm free trial signup error:", error);
 			}
 		},
 		async checkCompromisedPassword(password) {
@@ -2084,7 +2122,7 @@ async function handleSecurityVerdict(verdict, hookCtx, checkCtx, trackEvent, sec
 	if (verdict.action === "allow") return;
 	const reason = verdict.reason || "unknown";
 	if (verdict.action === "challenge" && checkCtx.visitorId) {
-		const challenge = verdict.challenge || await securityService.generateChallenge(checkCtx.visitorId);
+		const challenge = verdict.challenge || await securityService.generateChallenge(checkCtx.visitorId, checkCtx.identification?.requestId ?? null);
 		if (!challenge?.trim()) {
 			logger.warn("[Sentinel] Could not generate PoW challenge (service may be unavailable). Falling back to allow.");
 			return;
@@ -2119,7 +2157,7 @@ async function runSecurityChecks(hookCtx, checkCtx, securityService, trackEvent,
 	recordCheck(hookCtx, "server_security_check");
 	await handleSecurityVerdict(await securityService.checkSecurity({
 		visitorId: checkCtx.visitorId,
-		requestId: checkCtx.identification?.requestId || null,
+		requestId: checkCtx.identification?.requestId ?? checkCtx.requestId ?? null,
 		ip: checkCtx.ip,
 		path: checkCtx.path,
 		identifier: checkCtx.identifier,
@@ -2174,9 +2212,17 @@ const sentinel = (options) => {
 							async before(user, ctx) {
 								if (!ctx) return;
 								const visitorId = ctx.context.visitorId;
-								if (visitorId && opts.security?.freeTrialAbuse?.enabled) {
+								if (opts.security?.freeTrialAbuse?.enabled) {
+									if (!visitorId) {
+										recordCheck(ctx, "free_trial_abuse");
+										setOutcome(ctx, "blocked", "free_trial_abuse", { reason: "identification_required" });
+										emitEvaluation(ctx, trackEvent);
+										throw new APIError("FORBIDDEN", { message: "Account creation is not allowed without device identification." });
+									}
 									recordCheck(ctx, "free_trial_abuse");
-									const abuseCheck = await securityService.checkFreeTrialAbuse(visitorId);
+									const reservationId = crypto.randomUUID();
+									ctx.context.freeTrialReservationId = reservationId;
+									const abuseCheck = await securityService.reserveFreeTrialSignup(visitorId, reservationId, ctx.context.requestId ?? null);
 									if (abuseCheck.isAbuse && abuseCheck.action === "block") {
 										setOutcome(ctx, "blocked", "free_trial_abuse", {
 											accountCount: abuseCheck.accountCount,
@@ -2194,7 +2240,8 @@ const sentinel = (options) => {
 							async after(user, ctx) {
 								if (!ctx) return;
 								const visitorId = ctx.context.visitorId;
-								if (visitorId && opts.security?.freeTrialAbuse?.enabled) await ctx.context.runInBackgroundOrAwait(securityService.trackFreeTrialSignup(visitorId, user.id));
+								const reservationId = ctx.context.freeTrialReservationId;
+								if (visitorId && reservationId && opts.security?.freeTrialAbuse?.enabled) await ctx.context.runInBackgroundOrAwait(securityService.confirmFreeTrialSignup(visitorId, reservationId, user.id, ctx.context.requestId ?? null));
 							}
 						},
 						update: { async before(user, ctx) {
@@ -2213,7 +2260,7 @@ const sentinel = (options) => {
 							if (session.userId && identification?.location && visitorId) {
 								recordCheck(ctx, "impossible_travel");
 								const powSolution = ctx.headers?.get?.("X-PoW-Solution") ?? null;
-								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId, identification.ip, powSolution);
+								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId, identification.ip, powSolution, identification.requestId);
 								if (travelCheck?.powVerified) recordCheck(ctx, "pow_challenge");
 								if (travelCheck?.isImpossible) {
 									if (travelCheck.action === "block") {
@@ -2324,7 +2371,11 @@ const sentinel = (options) => {
 							routes.SIGN_IN_ANONYMOUS
 						]);
 						const isSignUp = matchesAnyRoute(ctx.path, [routes.SIGN_UP_EMAIL]);
-						const isPasswordReset = matchesAnyRoute(ctx.path, [routes.FORGET_PASSWORD, routes.REQUEST_PASSWORD_RESET]);
+						const isPasswordReset = matchesAnyRoute(ctx.path, [
+							routes.FORGET_PASSWORD,
+							routes.REQUEST_PASSWORD_RESET,
+							routes.RESET_PASSWORD
+						]);
 						const isTwoFactor = matchesAnyRoute(ctx.path, [
 							routes.TWO_FACTOR_VERIFY_TOTP,
 							routes.TWO_FACTOR_VERIFY_BACKUP,
@@ -2346,7 +2397,7 @@ const sentinel = (options) => {
 						const powSolution = ctx.headers?.get?.("X-PoW-Solution");
 						if (visitorId || ip) {
 							recordCheck(ctx, "credential_stuffing");
-							if (await securityService.isBlocked(visitorId ?? "", ip)) {
+							if (await securityService.isBlocked(visitorId ?? "", ip, ctx.context.requestId ?? null)) {
 								setOutcome(ctx, "blocked", "credential_stuffing", {
 									phase: "cooldown_active",
 									visitorId: ctx.context.untrustedVisitorId ?? void 0,
@@ -2363,6 +2414,7 @@ const sentinel = (options) => {
 							path: ctx.path,
 							identifier,
 							visitorId,
+							requestId: ctx.context.requestId ?? null,
 							identification,
 							ip: ctx.context.ip,
 							userAgent: ctx.headers?.get?.("user-agent") || ""
@@ -2412,7 +2464,7 @@ const sentinel = (options) => {
 						identifier: loginId,
 						userAgent: ctx.headers?.get?.("user-agent") || ""
 					});
-					if (isPasswordSignInRoute && ctx.context.returned instanceof Error && loginId && body?.password && untrustedVisitorId) await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(loginId, untrustedVisitorId, body.password, ip));
+					if (isPasswordSignInRoute && ctx.context.returned instanceof Error && loginId && body?.password && untrustedVisitorId) await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(loginId, untrustedVisitorId, body.password, ip, ctx.context.requestId ?? null));
 					if (isPasswordSignInRoute && !(ctx.context.returned instanceof Error) && loginId) await ctx.context.runInBackgroundOrAwait(securityService.clearFailedAttempts(loginId));
 				})
 			}]
@@ -2774,11 +2826,133 @@ const initTeamEvents = (tracker) => {
 	};
 };
 //#endregion
-//#region src/jwt.ts
+//#region ../utils/dist/redact.mjs
+const EXACT_SENSITIVE_STRING_KEYS_LOWER = new Set([...new Set([
+	"accessToken",
+	"apiKey",
+	"apiSecret",
+	"authorization",
+	"authToken",
+	"bearerToken",
+	"backupCodes",
+	"clientSecret",
+	"consumerSecret",
+	"credentialID",
+	"deviceCode",
+	"encPrivateKey",
+	"encPrivateKeyPass",
+	"encryptionKey",
+	"encryptionSecret",
+	"forwardHeaders",
+	"idToken",
+	"oidcConfig",
+	"pass",
+	"passwd",
+	"password",
+	"privateKey",
+	"privateKeyPass",
+	"pwd",
+	"refreshToken",
+	"samlConfig",
+	"secret",
+	"secretAccessKey",
+	"secretKey",
+	"signingSecret",
+	"stripeWebhookSecret",
+	"userCode",
+	"webhookSecret"
+])].map((k) => k.toLowerCase()));
+/**
+* Case-insensitive suffixes for unknown property names.
+*/
+const SENSITIVE_KEY_SUFFIXES_LOWER = [
+	"accesskey",
+	"secret",
+	"password",
+	"passphrase",
+	"privatekey",
+	"keypass",
+	"apikey",
+	"token",
+	"signingkey",
+	"credentials",
+	"authheader"
+];
+/**
+* Embedded secret substrings checked against the normalized (compact, lowercased) key.
+*/
+const SENSITIVE_KEY_SUBSTRINGS_LOWER = ["secretaccess", "accesskeysecret"];
+const REDACTED_SIMPLE_STRING = "[REDACTED]";
+function snakeCaseToCamelCase(key) {
+	return key.replace(/_([a-zA-Z])/g, (_, ch) => ch.toUpperCase());
+}
+function keyVariantsForMatching(key) {
+	const trimmed = key.replace(/^[\s._-]+/, "");
+	if (!trimmed) return [key];
+	const out = new Set([key, trimmed]);
+	if (trimmed.includes("_")) out.add(snakeCaseToCamelCase(trimmed));
+	return [...out];
+}
+/** Whether a property name should have string values redacted in `redact()`. */
+function isSensitiveStringKey(key) {
+	const variants = keyVariantsForMatching(key);
+	const compactLower = key.replace(/[\s._-]/g, "").toLowerCase();
+	const forms = new Set([compactLower]);
+	for (const raw of variants) {
+		forms.add(raw);
+		forms.add(raw.toLowerCase());
+	}
+	for (const form of forms) {
+		const fl = form.toLowerCase();
+		if (EXACT_SENSITIVE_STRING_KEYS_LOWER.has(fl)) return true;
+		for (const suffix of SENSITIVE_KEY_SUFFIXES_LOWER) if (fl.endsWith(suffix)) return true;
+		for (const substring of SENSITIVE_KEY_SUBSTRINGS_LOWER) if (compactLower.includes(substring)) return true;
+	}
+	return false;
+}
+function isPlainSerializable(value) {
+	if (value === null || typeof value !== "object") return true;
+	if (Array.isArray(value)) return true;
+	if (value instanceof Date) return true;
+	const constructor = Object.getPrototypeOf(value)?.constructor;
+	if (constructor && constructor.name !== "Object" && constructor.name !== "Array") return false;
+	return true;
+}
+function redactInner(value, visiting, options) {
+	if (value === null || value === void 0) return value;
+	if (typeof value === "function") return void 0;
+	if (typeof value !== "object") return value;
+	const obj = value;
+	if (visiting.has(obj)) return void 0;
+	visiting.add(obj);
+	try {
+		if (Array.isArray(value)) return value.map((item) => redactInner(item, visiting, options)).filter((item) => item !== void 0);
+		const result = {};
+		for (const [key, val] of Object.entries(value)) {
+			if (options?.excludeKeys?.has(key)) continue;
+			if (typeof val === "function") continue;
+			if (typeof val === "string" && isSensitiveStringKey(key)) {
+				result[key] = REDACTED_SIMPLE_STRING;
+				continue;
+			}
+			if (options?.skipNonPlainSerializable && val !== null && typeof val === "object" && !isPlainSerializable(val)) continue;
+			const redacted = redactInner(val, visiting, options);
+			if (redacted !== void 0) result[key] = redacted;
+		}
+		return result;
+	} finally {
+		visiting.delete(obj);
+	}
+}
+/** Recursively redact sensitive string values in a JSON-like object tree. */
+function redact(value, options) {
+	return redactInner(value, /* @__PURE__ */ new WeakSet(), options);
+}
+//#endregion
+//#region ../utils/dist/crypto/index.mjs
 /**
-* Hash the given value
-* Note: Must match @infra/utils/crypto hash()
-* @param value - The value to hash
+* One-way hash for storage and lookup. Returns hex-encoded digest.
+* Use to verify values without ever storing plaintext.
 */
 async function hash(value) {
 	const data = new TextEncoder().encode(value);
@@ -2786,6 +2960,32 @@ async function hash(value) {
 	const hashArray = new Uint8Array(hashBuffer);
 	return Array.from(hashArray).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+function hexToBytes(hex) {
+	if (hex.length % 2 !== 0) return null;
+	const bytes = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < bytes.length; i++) {
+		const byte = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+		if (Number.isNaN(byte)) return null;
+		bytes[i] = byte;
+	}
+	return bytes;
+}
+function timingSafeEqualBytes(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+	return diff === 0;
+}
+/** Constant-time comparison for hex-encoded digests (e.g. SHA-256 hashes). */
+function timingSafeEqualHash(a, b) {
+	if (a.length !== b.length) return false;
+	const aBytes = hexToBytes(a);
+	const bBytes = hexToBytes(b);
+	if (!aBytes || !bBytes || aBytes.length !== bBytes.length) return false;
+	return timingSafeEqualBytes(aBytes, bBytes);
+}
+//#endregion
+//#region src/jwt.ts
 /**
 * Skip JTI check for JWTs issued within this many seconds.
 * This is safe because replay attacks require time for interception.
@@ -2853,9 +3053,8 @@ const jwtMiddleware = (options, schema, getJWT) => {
 			});
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		const expectedHash = await hash(options.apiKey);
-		if (apiKeyHash !== expectedHash) {
-			ctx.context.logger.warn("[Dash] API key hash is invalid", apiKeyHash, expectedHash);
+		if (!timingSafeEqualHash(apiKeyHash, await hash(options.apiKey))) {
+			ctx.context.logger.warn("[Dash] API key hash mismatch");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
 		if (!isRecentlyIssued(payload)) {
@@ -2908,7 +3107,7 @@ const jwtValidateMiddleware = (options) => {
 			});
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		if (apiKeyHash !== await hash(options.apiKey)) {
+		if (!timingSafeEqualHash(apiKeyHash, await hash(options.apiKey))) {
 			ctx.context.logger.warn("[Dash] API key hash mismatch");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
@@ -2916,121 +3115,20 @@ const jwtValidateMiddleware = (options) => {
 	});
 };
 //#endregion
-//#region src/version.ts
-const PLUGIN_VERSION = "0.2.13";
-//#endregion
-//#region src/routes/auth/config.ts
+//#region src/lib/redact-plugin-options.ts
 const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
-const EXACT_SENSITIVE_STRING_KEYS_LOWER = new Set([...new Set([
-	"accessToken",
-	"apiKey",
-	"apiSecret",
-	"authorization",
-	"authToken",
-	"bearerToken",
-	"clientSecret",
-	"consumerSecret",
-	"encPrivateKey",
-	"encPrivateKeyPass",
-	"encryptionKey",
-	"encryptionSecret",
-	"idToken",
-	"password",
-	"privateKey",
-	"privateKeyPass",
-	"refreshToken",
-	"secret",
-	"secretKey",
-	"signingSecret",
-	"stripeWebhookSecret",
-	"webhookSecret"
-])].map((k) => k.toLowerCase()));
-/**
-* Case-insensitive suffixes for unknown plugin options
-* Matching is more permissive to account for unknown plugin options
-*/
-const SENSITIVE_KEY_SUFFIXES_LOWER = [
-	"secret",
-	"password",
-	"passphrase",
-	"privatekey",
-	"keypass",
-	"apikey",
-	"token",
-	"signingkey",
-	"credentials",
-	"authheader"
-];
-const REDACTED_SIMPLE_STRING = "[REDACTED]";
-function snakeCaseToCamelCase(key) {
-	return key.replace(/_([a-zA-Z])/g, (_, ch) => ch.toUpperCase());
+function redactPluginOptions(pluginId, options, optionsConfig) {
+	return redact(options, {
+		...optionsConfig,
+		excludeKeys: PLUGIN_OPTIONS_EXCLUDE_KEYS[pluginId]
+	});
 }
-function keyVariantsForMatching(key) {
-	const trimmed = key.replace(/^[\s._-]+/, "");
-	if (!trimmed) return [key];
-	const out = new Set([key, trimmed]);
-	if (trimmed.includes("_")) out.add(snakeCaseToCamelCase(trimmed));
-	return [...out];
-}
-function shouldRedactSensitiveStringKey(key) {
-	const variants = keyVariantsForMatching(key);
-	const compactLower = key.replace(/[\s._-]/g, "").toLowerCase();
-	const forms = new Set([compactLower]);
-	for (const raw of variants) {
-		forms.add(raw);
-		forms.add(raw.toLowerCase());
-	}
-	for (const form of forms) {
-		const fl = form.toLowerCase();
-		if (EXACT_SENSITIVE_STRING_KEYS_LOWER.has(fl)) return true;
-		for (const suffix of SENSITIVE_KEY_SUFFIXES_LOWER) if (fl.endsWith(suffix)) return true;
-	}
-	return false;
-}
-function isPlainSerializable(value) {
-	if (value === null || typeof value !== "object") return true;
-	if (Array.isArray(value)) return true;
-	if (value instanceof Date) return true;
-	const constructor = Object.getPrototypeOf(value)?.constructor;
-	if (constructor && constructor.name !== "Object" && constructor.name !== "Array") return false;
-	return true;
-}
-/**
-* Sanitize any plain JSON-like subtree from Better Auth options
-*/
-function sanitizeConfig(value, visiting, excludeKeys) {
-	if (value === null || value === void 0) return value;
-	if (typeof value === "function") return void 0;
-	if (typeof value !== "object") return value;
-	const obj = value;
-	if (visiting.has(obj)) return void 0;
-	visiting.add(obj);
-	try {
-		if (Array.isArray(value)) return value.map((item) => sanitizeConfig(item, visiting, excludeKeys)).filter((item) => item !== void 0);
-		const result = {};
-		for (const [key, val] of Object.entries(value)) {
-			if (excludeKeys?.has(key)) continue;
-			if (typeof val === "function") continue;
-			if (typeof val === "string" && shouldRedactSensitiveStringKey(key)) {
-				result[key] = REDACTED_SIMPLE_STRING;
-				continue;
-			}
-			if (val !== null && typeof val === "object" && !isPlainSerializable(val)) continue;
-			const sanitized = sanitizeConfig(val, visiting, excludeKeys);
-			if (sanitized !== void 0) result[key] = sanitized;
-		}
-		return result;
-	} finally {
-		visiting.delete(obj);
-	}
-}
-function sanitizePluginOptions(pluginId, options) {
-	return sanitizeConfig(options, /* @__PURE__ */ new WeakSet(), PLUGIN_OPTIONS_EXCLUDE_KEYS[pluginId]);
-}
-function estimateEntropy(str) {
-	const unique = new Set(str).size;
-	if (unique === 0) return 0;
-	return Math.log2(Math.pow(unique, str.length));
+//#endregion
+//#region src/routes/auth/config.ts
+function estimateEntropy(str) {
+	const unique = new Set(str).size;
+	if (unique === 0) return 0;
+	return Math.log2(Math.pow(unique, str.length));
 }
 const getConfig = (options) => {
 	return createAuthEndpoint("/dash/config", {
@@ -3042,13 +3140,13 @@ const getConfig = (options) => {
 		return {
 			version: ctx.context.version || null,
 			socialProviders: Object.keys(ctx.context.options.socialProviders || {}),
-			emailAndPassword: sanitizeConfig(ctx.context.options.emailAndPassword, /* @__PURE__ */ new WeakSet(), void 0),
+			emailAndPassword: redact(ctx.context.options.emailAndPassword, { skipNonPlainSerializable: true }),
 			plugins: ctx.context.options.plugins?.map((plugin) => {
 				const base = {
 					id: plugin.id,
 					schema: plugin.schema,
 					version: plugin.version,
-					options: sanitizePluginOptions(plugin.id, plugin.options)
+					options: redactPluginOptions(plugin.id, plugin.options, { skipNonPlainSerializable: true })
 				};
 				if (plugin.id === "dash" && !plugin.version) return {
 					...base,
@@ -3170,6 +3268,31 @@ const getValidate = (options) => {
 	});
 };
 //#endregion
+//#region src/semver.ts
+function parseVersion(version) {
+	if (!version) return null;
+	const match = version.trim().match(/^(\d+)\.(\d+)\.(\d+)/);
+	if (!match) return null;
+	return [
+		Number(match[1]),
+		Number(match[2]),
+		Number(match[3])
+	];
+}
+/** Compare semver strings (e.g. "1.7.0-beta.8" against "1.7" or "1.7.0"). */
+function isVersionAtLeast(version, target) {
+	const parsed = parseVersion(version);
+	if (!parsed) return false;
+	const targetParts = target.split(".").map(Number);
+	const major = targetParts[0] ?? 0;
+	const minor = targetParts[1] ?? 0;
+	const patch = targetParts[2] ?? 0;
+	const [vMajor, vMinor, vPatch] = parsed;
+	if (vMajor !== major) return vMajor > major;
+	if (vMinor !== minor) return vMinor > minor;
+	return vPatch >= patch;
+}
+//#endregion
 //#region src/routes/organization-guards.ts
 /** Returns true if organization plugin is enabled. */
 function isOrganizationEnabled(ctx) {
@@ -3231,6 +3354,11 @@ function getScimEndpoint(baseUrl) {
 function getSCIMPlugin(ctx) {
 	return ctx.context.getPlugin("scim");
 }
+function isScimDirectorySyncEnabled(scimPlugin, authVersion) {
+	if (!scimPlugin) return false;
+	if (isVersionAtLeast(authVersion, "1.7.0")) return true;
+	return scimPlugin.options?.providerOwnership?.enabled === true;
+}
 const DIRECTORY_SYNC_DUPLICATE_MESSAGE = "A directory sync connection with this provider ID already exists. Remove the existing connection or choose a different provider ID.";
 function isDuplicateDirectorySyncError(e) {
 	if (e instanceof APIError$1) return e.status === "CONFLICT" || /duplicate|already exists|unique constraint/i.test(e.message ?? "");
@@ -3248,7 +3376,7 @@ const listOrganizationDirectories = (options) => {
 		}
 		const organizationId = tryDecode(ctx.params.id);
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.listSCIMProviderConnections || !scimPlugin?.options?.providerOwnership?.enabled) {
+		if (!scimPlugin?.endpoints.listSCIMProviderConnections || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) {
 			ctx.context.logger.warn("[Dash] SCIM plugin not available or provider ownership disabled, returning empty directories list", { organizationId });
 			return [];
 		}
@@ -3285,7 +3413,7 @@ const createOrganizationDirectory = (options) => {
 		requireOrganizationPlugin(ctx);
 		const { organizationId } = ctx.context.payload;
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.generateSCIMToken || !scimPlugin?.options?.providerOwnership?.enabled) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
+		if (!scimPlugin?.endpoints.generateSCIMToken || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { providerId, ownerUserId } = ctx.body;
 		let scimToken;
 		try {
@@ -3320,7 +3448,7 @@ const deleteOrganizationDirectory = (options) => {
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.deleteSCIMProviderConnection || !scimPlugin?.options?.providerOwnership?.enabled) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
+		if (!scimPlugin?.endpoints.deleteSCIMProviderConnection || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { organizationId } = ctx.context.payload;
 		const { providerId } = ctx.body;
 		const ownerUserId = await getScimProviderOwner(ctx, organizationId, providerId);
@@ -3341,7 +3469,7 @@ const regenerateDirectoryToken = (options) => {
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.generateSCIMToken || !scimPlugin?.options?.providerOwnership?.enabled) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
+		if (!scimPlugin?.endpoints.generateSCIMToken || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { organizationId } = ctx.context.payload;
 		const { providerId } = ctx.body;
 		const ownerUserId = await getScimProviderOwner(ctx, organizationId, providerId);
@@ -3758,6 +3886,36 @@ const executeAdapter = (options) => {
 	});
 };
 //#endregion
+//#region src/lib/invitation-auth-mode.ts
+/** Route new users through the platform /invite/accept flow. */
+function usesPlatformInviteAcceptFlow(authMode) {
+	return authMode === "auth" || authMode === "credential_setup" || authMode === "create_with_session" || authMode === "create_no_session";
+}
+/** Whether complete-invitation should mint a session cookie. */
+function shouldCreateSessionOnInviteComplete(authMode) {
+	return authMode !== "create_no_session";
+}
+//#endregion
+//#region src/lib/safe-url.ts
+function isSafeHttpUrl(value) {
+	try {
+		const url = new URL(value);
+		return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "";
+	} catch {
+		return false;
+	}
+}
+/** http(s) absolute URL without embedded credentials. */
+const safeUrlSchema = z$1.string().trim().min(1).pipe(z$1.url().refine(isSafeHttpUrl, { message: "URL must be a valid http(s) URL without credentials" })).transform((value) => new URL(value).href);
+const optionalSafeUrlSchema = z$1.union([safeUrlSchema, z$1.literal("")]).optional();
+/** Validates http(s) redirect targets at use time; falls back when invalid. */
+function resolveSafeRedirectUrl(raw, fallback) {
+	if (raw == null || raw.trim() === "") return fallback;
+	const parsed = safeUrlSchema.safeParse(raw);
+	if (!parsed.success) return fallback;
+	return parsed.data;
+}
+//#endregion
 //#region src/routes/invitations/index.ts
 async function verifyPendingInvitation(token, $api, ctx) {
 	const { data: invitation, error } = await $api("/api/internal/invitations/verify", {
@@ -3784,6 +3942,9 @@ async function verifyPendingInvitation(token, $api, ctx) {
 function getFallbackRedirect(ctx) {
 	return typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : "/";
 }
+function resolveInvitationRedirect(ctx, raw) {
+	return resolveSafeRedirectUrl(raw, getFallbackRedirect(ctx));
+}
 /**
 * Accept invitation endpoint
 * This is called when a user clicks the invitation link.
@@ -3808,14 +3969,14 @@ const acceptInvitation = (options) => {
 				}
 			});
 			if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted (existing user)", markError);
-			await setSessionCookie(ctx, {
+			if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
 				session: await ctx.context.internalAdapter.createSession(existingUser.id),
 				user: existingUser
 			});
-			const redirectUrl = invitation.redirectUrl || ctx.context.options.baseURL || "/";
-			return ctx.redirect(redirectUrl.toString());
+			const redirectUrl = resolveInvitationRedirect(ctx, invitation.redirectUrl);
+			return ctx.redirect(redirectUrl);
 		}
-		if (invitation.authMode === "auth") {
+		if (usesPlatformInviteAcceptFlow(invitation.authMode)) {
 			const platformUrl = options.apiUrl || INFRA_API_URL;
 			const acceptPageUrl = new URL("/invite/accept", platformUrl);
 			acceptPageUrl.searchParams.set("token", token);
@@ -3823,13 +3984,15 @@ const acceptInvitation = (options) => {
 			acceptPageUrl.searchParams.set("callback", callbackUrl);
 			return ctx.redirect(acceptPageUrl.toString());
 		}
-		const user = await ctx.context.internalAdapter.createUser({
+		const userPayload = {
 			email: invitationEmail,
 			name: invitation.name || invitation.email.split("@")[0] || "",
 			emailVerified: true,
 			createdAt: /* @__PURE__ */ new Date(),
 			updatedAt: /* @__PURE__ */ new Date()
-		});
+		};
+		const adapter = ctx.context.internalAdapter;
+		const user = isVersionAtLeast(ctx.context.version, "1.7.0") ? await adapter.createUser(userPayload, { method: "admin" }) : await adapter.createUser(userPayload);
 		const { error: markError } = await $api("/api/internal/invitations/mark-accepted", {
 			method: "POST",
 			body: {
@@ -3838,12 +4001,12 @@ const acceptInvitation = (options) => {
 			}
 		});
 		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-		await setSessionCookie(ctx, {
+		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
 			session: await ctx.context.internalAdapter.createSession(user.id),
 			user
 		});
-		const redirectUrl = invitation.redirectUrl || ctx.context.options.baseURL || "/";
-		return ctx.redirect(redirectUrl.toString());
+		const redirectUrl = resolveInvitationRedirect(ctx, invitation.redirectUrl);
+		return ctx.redirect(redirectUrl);
 	});
 };
 /**
@@ -3861,7 +4024,6 @@ const completeInvitation = (options) => {
 		})
 	}, async (ctx) => {
 		const { token, password } = ctx.body;
-		const fallbackRedirect = getFallbackRedirect(ctx);
 		const invitation = await verifyPendingInvitation(token, $api, ctx);
 		if (!ctx.context) throw new APIError("BAD_REQUEST", { message: "Context is required" });
 		const invitationEmail = normalizeEmail(invitation.email, ctx.context);
@@ -3875,23 +4037,25 @@ const completeInvitation = (options) => {
 				}
 			});
 			if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-			await setSessionCookie(ctx, {
+			if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
 				session: await ctx.context.internalAdapter.createSession(existingUser.id),
 				user: existingUser
 			});
 			return {
 				success: true,
-				redirectUrl: invitation.redirectUrl ?? fallbackRedirect
+				redirectUrl: resolveInvitationRedirect(ctx, invitation.redirectUrl)
 			};
 		}
 		if (!password) throw new APIError("BAD_REQUEST", { message: "Password is required to complete this invitation." });
-		const user = await ctx.context.internalAdapter.createUser({
+		const userPayload = {
 			email: invitationEmail,
 			name: invitation.name || invitation.email.split("@")[0] || "",
 			emailVerified: true,
 			createdAt: /* @__PURE__ */ new Date(),
 			updatedAt: /* @__PURE__ */ new Date()
-		});
+		};
+		const adapter = ctx.context.internalAdapter;
+		const user = isVersionAtLeast(ctx.context.version, "1.7.0") ? await adapter.createUser(userPayload, { method: "admin" }) : await adapter.createUser(userPayload);
 		await ctx.context.internalAdapter.createAccount({
 			userId: user.id,
 			providerId: "credential",
@@ -3906,13 +4070,13 @@ const completeInvitation = (options) => {
 			}
 		});
 		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-		await setSessionCookie(ctx, {
+		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
 			session: await ctx.context.internalAdapter.createSession(user.id),
 			user
 		});
 		return {
 			success: true,
-			redirectUrl: invitation.redirectUrl ?? fallbackRedirect
+			redirectUrl: resolveInvitationRedirect(ctx, invitation.redirectUrl)
 		};
 	});
 };
@@ -3937,7 +4101,7 @@ const completeInvitationSocial = (options) => {
 			}
 		});
 		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-		return ctx.redirect((invitation.redirectUrl || getFallbackRedirect(ctx)).toString());
+		return ctx.redirect(resolveInvitationRedirect(ctx, invitation.redirectUrl));
 	});
 };
 /**
@@ -4119,11 +4283,15 @@ const cancelInvitation = (options) => {
 	}, async (ctx) => {
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
 		const { invitationId, organizationId } = ctx.context.payload;
+		if (ctx.body.invitationId !== invitationId) throw ctx.error("BAD_REQUEST", { message: "Invitation ID mismatch" });
 		const invitation = await ctx.context.adapter.findOne({
 			model: "invitation",
 			where: [{
 				field: "id",
 				value: invitationId
+			}, {
+				field: "organizationId",
+				value: organizationId
 			}]
 		});
 		if (!invitation) throw ctx.error("NOT_FOUND", { message: "Invitation not found" });
@@ -4152,6 +4320,9 @@ const cancelInvitation = (options) => {
 			where: [{
 				field: "id",
 				value: invitationId
+			}, {
+				field: "organizationId",
+				value: organizationId
 			}],
 			update: { status: "canceled" }
 		});
@@ -4177,11 +4348,15 @@ const resendInvitation = (options) => {
 	}, async (ctx) => {
 		const organizationPlugin = requireOrganizationPlugin(ctx);
 		const { invitationId, organizationId } = ctx.context.payload;
+		if (ctx.body.invitationId !== invitationId) throw ctx.error("BAD_REQUEST", { message: "Invitation ID mismatch" });
 		const invitation = await ctx.context.adapter.findOne({
 			model: "invitation",
 			where: [{
 				field: "id",
 				value: invitationId
+			}, {
+				field: "organizationId",
+				value: organizationId
 			}]
 		});
 		if (!invitation) throw ctx.error("NOT_FOUND", { message: "Invitation not found" });
@@ -4581,6 +4756,8 @@ async function withConcurrency(items, fn, options) {
 	if (executing.length > 0) await run();
 	return results;
 }
+/** Zod schema for validating organization/project slug format. */
+const slugSchema = z.string().min(1, "Slug is required").regex(/^[a-z0-9-]+$/, "Slug can only contain lowercase letters, numbers, and hyphens");
 //#endregion
 //#region src/routes/organizations/schemas.ts
 const DENIED_ORG_WRITE_KEYS = new Set([
@@ -4589,13 +4766,13 @@ const DENIED_ORG_WRITE_KEYS = new Set([
 	"updatedAt"
 ]);
 const CREATE_NON_PERSISTED_KEYS = new Set(["defaultTeamName"]);
-const CREATE_REQUEST_ONLY_KEYS = new Set(["userId", "skipDefaultTeam"]);
-const CORE_CREATE_KEYS = [
+const CREATE_REQUEST_ONLY_KEYS$1 = new Set(["userId", "skipDefaultTeam"]);
+const CORE_CREATE_KEYS$1 = [
 	"name",
 	"slug",
 	"logo"
 ];
-const CORE_UPDATE_KEYS = [
+const CORE_UPDATE_KEYS$1 = [
 	"name",
 	"slug",
 	"logo",
@@ -4611,7 +4788,7 @@ function getWritableOrganizationAdditionalFieldNames(orgOptions) {
 	}).map(([name]) => name);
 }
 function getWritableOrganizationFieldNames(orgOptions, mode) {
-	const keys = new Set(mode === "create" ? CORE_CREATE_KEYS : CORE_UPDATE_KEYS);
+	const keys = new Set(mode === "create" ? CORE_CREATE_KEYS$1 : CORE_UPDATE_KEYS$1);
 	for (const name of getWritableOrganizationAdditionalFieldNames(orgOptions)) keys.add(name);
 	return keys;
 }
@@ -4624,7 +4801,7 @@ function pickWritableOrganizationFields(body, orgOptions, mode) {
 	const skip = new Set([
 		...DENIED_ORG_WRITE_KEYS,
 		...mode === "create" ? CREATE_NON_PERSISTED_KEYS : [],
-		...mode === "create" ? CREATE_REQUEST_ONLY_KEYS : []
+		...mode === "create" ? CREATE_REQUEST_ONLY_KEYS$1 : []
 	]);
 	const result = {};
 	for (const [key, value] of Object.entries(body)) {
@@ -4635,19 +4812,19 @@ function pickWritableOrganizationFields(body, orgOptions, mode) {
 }
 const BaseCreateOrgCoreBodySchema = z$1.object({
 	name: z$1.string(),
-	slug: z$1.string(),
+	slug: slugSchema,
 	logo: z$1.string().optional(),
 	defaultTeamName: z$1.string().optional()
 });
 const BaseUpdateOrgCoreBodySchema = z$1.object({
-	logo: z$1.union([z$1.url(), z$1.literal("")]).optional(),
+	logo: optionalSafeUrlSchema,
 	name: z$1.string().optional(),
-	slug: z$1.string().optional(),
+	slug: slugSchema.optional(),
 	metadata: z$1.string().optional()
 });
 const CreateOrganizationBodySchema = BaseCreateOrgCoreBodySchema.catchall(z$1.unknown());
 const UpdateOrganizationBodySchema = BaseUpdateOrgCoreBodySchema.catchall(z$1.unknown());
-function createSchemaForDBField(field) {
+function createSchemaForDBField$1(field) {
 	switch (field.type) {
 		case "number": return field.required ? z$1.coerce.number() : z$1.coerce.number().optional();
 		case "boolean": return field.required ? z$1.coerce.boolean() : z$1.coerce.boolean().optional();
@@ -4662,13 +4839,13 @@ function createSchemaForDBField(field) {
 function validateWritableCreateOrganizationFields(data, options) {
 	const shape = {
 		name: z$1.string().min(1),
-		slug: z$1.string().min(1),
+		slug: slugSchema,
 		logo: z$1.string().optional()
 	};
 	const additional = getOrganizationAdditionalFields(options);
 	for (const [name, field] of Object.entries(additional)) {
 		if (field.input === false) continue;
-		shape[name] = createSchemaForDBField(field);
+		shape[name] = createSchemaForDBField$1(field);
 	}
 	const result = z$1.object(shape).strict().safeParse(data);
 	if (!result.success) throw result.error;
@@ -4684,14 +4861,14 @@ function validateWritableOrganizationUpdateFields(data, orgOptions) {
 	}]);
 	const shape = {
 		name: z$1.string().min(1).optional(),
-		slug: z$1.string().min(1).optional(),
-		logo: z$1.union([z$1.url(), z$1.literal("")]).optional(),
+		slug: slugSchema.optional(),
+		logo: optionalSafeUrlSchema,
 		metadata: z$1.string().optional()
 	};
 	const additional = getOrganizationAdditionalFields(orgOptions);
 	for (const [name, field] of Object.entries(additional)) {
 		if (field.input === false) continue;
-		shape[name] = createSchemaForDBField(field);
+		shape[name] = createSchemaForDBField$1(field);
 	}
 	const result = z$1.object(shape).partial().strict().safeParse(data);
 	if (!result.success) throw result.error;
@@ -5760,6 +5937,17 @@ const removeTeamMember = (options) => {
 	});
 };
 //#endregion
+//#region src/compat/internal-adapter.ts
+/** Deletes all sessions for a user across better-auth 1.4–1.6 internal adapter APIs. */
+async function deleteUserSessionsCompat(adapter, userId) {
+	if (typeof adapter.deleteUserSessions === "function") {
+		await adapter.deleteUserSessions(userId);
+		return;
+	}
+	if (typeof adapter.deleteSessions !== "function") throw new Error("Internal adapter does not support deleting user sessions");
+	await adapter.deleteSessions(userId);
+}
+//#endregion
 //#region src/routes/sessions/index.ts
 const revokeSession = (options) => createAuthEndpoint("/dash/sessions/revoke", {
 	method: "POST",
@@ -5797,7 +5985,7 @@ const revokeAllSessions = (options) => createAuthEndpoint("/dash/sessions/revoke
 }, async (ctx) => {
 	const { userId } = ctx.body;
 	if (!await ctx.context.internalAdapter.findUserById(userId)) throw ctx.error("NOT_FOUND", { message: "User not found" });
-	await ctx.context.internalAdapter.deleteUserSessions(userId);
+	await deleteUserSessionsCompat(ctx.context.internalAdapter, userId);
 	return ctx.json({ success: true });
 });
 const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revoke-many", {
@@ -5806,7 +5994,7 @@ const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revok
 }, async (ctx) => {
 	const { userIds } = ctx.context.payload;
 	await withConcurrency(chunkArray(userIds, { batchSize: 50 }), async (chunk) => {
-		for (const userId of chunk) await ctx.context.internalAdapter.deleteUserSessions(userId);
+		for (const userId of chunk) await deleteUserSessionsCompat(ctx.context.internalAdapter, userId);
 	}, { concurrency: 3 });
 	return ctx.json({
 		success: true,
@@ -5814,248 +6002,6 @@ const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revok
 	});
 });
 //#endregion
-//#region ../utils/dist/ip.mjs
-/**
-* SSRF (Server-Side Request Forgery) Protection
-*
-* IP and URL utilities to validate hostnames and URLs before server-side fetches.
-* Blocks requests to private/reserved networks. Covers IPv4 private ranges,
-* IPv6 private ranges, and IPv4-mapped IPv6 bypass vectors.
-*/
-function isPrivateIPv4(a, b) {
-	if (a === 10) return true;
-	if (a === 172 && b >= 16 && b <= 31) return true;
-	if (a === 192 && b === 168) return true;
-	if (a === 127) return true;
-	if (a === 169 && b === 254) return true;
-	if (a === 0) return true;
-	if (a === 100 && b >= 64 && b <= 127) return true;
-	if (a >= 224) return true;
-	return false;
-}
-function parseIPv4Quad(quad) {
-	const v4parts = quad.split(".").map(Number);
-	if (v4parts.length === 4 && v4parts.every((p) => !isNaN(p) && p >= 0 && p <= 255)) return [v4parts[0], v4parts[1]];
-	return null;
-}
-/**
-* Loopback, RFC1918, link-local, CGNAT, ULA, documentation, NAT64 well-known,
-* IPv4-mapped private, unspecified, and multicast (RFC 4291 section 2.7).
-*/
-function ipv6GroupsAreNonPublic(groups) {
-	if (groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1) return true;
-	if (groups.every((g) => g === 0)) return true;
-	if ((groups[0] & 65472) === 65152) return true;
-	if ((groups[0] & 65024) === 64512) return true;
-	if ((groups[0] & 65280) === 65280) return true;
-	if (groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && groups[5] === 65535) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
-	if (groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 65535 && groups[5] === 0) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
-	if (groups[0] === 100 && groups[1] === 65435 && groups.slice(2, 6).every((g) => g === 0)) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
-	if (groups[0] === 8193 && groups[1] === 3512) return true;
-	if (groups[0] === 256 && groups.slice(1, 4).every((g) => g === 0)) return true;
-	return false;
-}
-function parseIPv6(addr) {
-	const sides = addr.split("::");
-	if (sides.length > 2) return null;
-	const parseGroups = (s) => s === "" ? [] : s.split(":").map((g) => parseInt(g, 16));
-	const left = parseGroups(sides[0]);
-	const right = sides.length === 2 ? parseGroups(sides[1]) : [];
-	if (left.some(isNaN) || right.some(isNaN)) return null;
-	const missing = 8 - left.length - right.length;
-	if (sides.length === 2) {
-		if (missing < 0) return null;
-		return [
-			...left,
-			...Array(missing).fill(0),
-			...right
-		];
-	}
-	if (left.length !== 8) return null;
-	return left;
-}
-/** True when the hostname is an IPv4 or IPv6 literal (not a DNS name). */
-function isIpLiteralHostname(hostname) {
-	const bare = hostname.replace(/^\[|\]$/g, "");
-	if (parseIPv4Quad(bare)) return true;
-	return parseIPv6(bare)?.length === 8;
-}
-/** Returns true if the hostname resolves to a private/reserved IP or is a local hostname. */
-function isPrivateHost(hostname) {
-	if (hostname === "localhost" || hostname.endsWith(".local") || hostname.endsWith(".internal") || hostname.endsWith(".localhost")) return true;
-	const bare = hostname.replace(/^\[|\]$/g, "");
-	const v4 = parseIPv4Quad(bare);
-	if (v4) return isPrivateIPv4(v4[0], v4[1]);
-	const mappedTail = bare.match(/(?:^|:)([\d.]+)$/);
-	if (mappedTail && mappedTail[1].includes(".")) {
-		const mappedV4 = parseIPv4Quad(mappedTail[1]);
-		if (mappedV4) return isPrivateIPv4(mappedV4[0], mappedV4[1]);
-	}
-	const groups = parseIPv6(bare);
-	if (groups && groups.length === 8) return ipv6GroupsAreNonPublic(groups);
-	return false;
-}
-//#endregion
-//#region ../utils/dist/url.mjs
-/**
-* URL helpers: normalization, SSRF-safe parsing/validation, and path/query segments.
-*/
-const HTTP_PROTOCOLS = ["http:", "https:"];
-function isAllowedProtocol(protocol, allowedProtocols) {
-	return (allowedProtocols?.length ? allowedProtocols : HTTP_PROTOCOLS).includes(protocol);
-}
-function toAllowedOriginSet(allowedOrigins) {
-	const set = /* @__PURE__ */ new Set();
-	for (const raw of allowedOrigins) try {
-		const parsed = new URL(raw.trim());
-		if (isAllowedProtocol(parsed.protocol, HTTP_PROTOCOLS)) set.add(parsed.origin);
-	} catch {}
-	return set;
-}
-function isAllowedOrigin(origin, allowedOrigins) {
-	if (!allowedOrigins.length) return false;
-	return toAllowedOriginSet(allowedOrigins).has(origin);
-}
-async function resolveHostnameAddresses(hostname) {
-	try {
-		const dns = await import("node:dns").catch((e) => {
-			console.warn("Failed to load node:dns for DNS resolution", e);
-			return null;
-		});
-		if (!dns?.promises?.resolve) return null;
-		return await dns.promises.resolve(hostname);
-	} catch {
-		return null;
-	}
-}
-function validateUrlSync(input, options = {}) {
-	let parsed;
-	if (input instanceof URL) parsed = input;
-	else {
-		const trimmed = input.trim();
-		try {
-			parsed = new URL(trimmed);
-		} catch {
-			return {
-				ok: false,
-				reason: "invalid_url"
-			};
-		}
-	}
-	if (!isAllowedProtocol(parsed.protocol, options.allowedProtocols)) return {
-		ok: false,
-		reason: "disallowed_protocol",
-		url: parsed,
-		protocol: parsed.protocol
-	};
-	if (parsed.username !== "" || parsed.password !== "") return {
-		ok: false,
-		reason: "embedded_credentials",
-		url: parsed
-	};
-	if (isPrivateHost(parsed.hostname)) return {
-		ok: false,
-		reason: "private_host",
-		url: parsed
-	};
-	if (options.allowedOrigins?.length) {
-		if (!isAllowedOrigin(parsed.origin, options.allowedOrigins)) return {
-			ok: false,
-			reason: "disallowed_origin",
-			url: parsed,
-			hostname: parsed.hostname,
-			origin: parsed.origin
-		};
-	}
-	return {
-		ok: true,
-		url: parsed
-	};
-}
-/** SSRF checks with DNS resolution when available. */
-async function validateUrl(input, options = {}) {
-	const sync = validateUrlSync(input, options);
-	if (!sync.ok) return sync;
-	if (options.dns === false) return sync;
-	const hostname = sync.url.hostname;
-	const addresses = await resolveHostnameAddresses(hostname);
-	if (!isIpLiteralHostname(hostname) && !addresses?.length) return {
-		ok: false,
-		reason: "unresolved_host",
-		url: sync.url,
-		hostname
-	};
-	if (addresses) {
-		for (const addr of addresses) if (isPrivateHost(addr)) return {
-			ok: false,
-			reason: "private_dns",
-			url: sync.url,
-			hostname,
-			address: addr
-		};
-	}
-	return {
-		ok: true,
-		url: sync.url,
-		...addresses ? { addresses } : {}
-	};
-}
-function safeResolveUrl(raw, baseURL) {
-	const trim = raw.trim();
-	if (!trim) return null;
-	if (trim.startsWith("//") || trim.includes("\\")) return null;
-	if (/[\u0000-\u001F\u007F]/.test(trim)) return null;
-	try {
-		if (trim.startsWith("/")) return new URL(trim, baseURL);
-		return new URL(trim);
-	} catch {
-		return null;
-	}
-}
-//#endregion
-//#region src/validation/ssrf.ts
-const REDIRECT_STATUSES = new Set([
-	301,
-	302,
-	303,
-	307,
-	308
-]);
-const MAX_REDIRECTS = 10;
-var SsrfBlockedError = class extends Error {
-	name = "SsrfBlockedError";
-};
-function isSsrfBlockedError(error) {
-	return error instanceof SsrfBlockedError;
-}
-/**
-* Fetch with SSRF checks on the initial URL and every redirect target.
-*/
-async function $outbound(url, options = {}) {
-	const { timeout, signal: callerSignal, ...fetchInit } = options;
-	let currentUrl = url;
-	for (let hop = 0;; hop++) {
-		const result = await validateUrl(currentUrl);
-		if (!result.ok) throw new SsrfBlockedError("Invalid or blocked URL");
-		const validated = result.url;
-		const signals = [];
-		if (callerSignal) signals.push(callerSignal);
-		if (timeout !== void 0 && timeout > 0) signals.push(AbortSignal.timeout(timeout));
-		const response = await fetch(validated.href, {
-			...fetchInit,
-			redirect: "manual",
-			signal: signals.length === 0 ? void 0 : signals.length === 1 ? signals[0] : AbortSignal.any(signals)
-		});
-		if (!REDIRECT_STATUSES.has(response.status)) return response;
-		if (hop >= MAX_REDIRECTS) throw new SsrfBlockedError("Too many redirects");
-		await response.body?.cancel().catch(() => {});
-		const location = response.headers.get("location");
-		const next = location ? safeResolveUrl(location, validated.href) : null;
-		if (!next) throw new SsrfBlockedError("Invalid redirect location");
-		currentUrl = next;
-	}
-}
-//#endregion
 //#region src/routes/plugin-session.ts
 /**
 * Builds an in-memory session context for calling plugin endpoints
@@ -6115,6 +6061,16 @@ function extractAlgorithmsFromSAMLMetadata(metadataXml) {
 		digestAlgorithms
 	};
 }
+/** Extract the first IdP SSO URL from SAML metadata XML, if present. */
+function extractEntryPointFromSAMLMetadata(metadataXml) {
+	const match = metadataXml.match(/<(?:[\w-]+:)?SingleSignOnService\b[^>]*\bLocation=["']([^"']+)["']/i);
+	if (!match?.[1]) return void 0;
+	try {
+		return new URL(match[1]).toString();
+	} catch {
+		return;
+	}
+}
 function validateSAMLMetadataAlgorithms(metadataXml) {
 	const warnings = [];
 	const { signatureAlgorithms, digestAlgorithms } = extractAlgorithmsFromSAMLMetadata(metadataXml);
@@ -6124,10 +6080,6 @@ function validateSAMLMetadataAlgorithms(metadataXml) {
 }
 //#endregion
 //#region src/routes/sso/index.ts
-let ssoRuntimeModule;
-function loadSsoRuntime() {
-	return ssoRuntimeModule ??= import("@better-auth/sso");
-}
 function requireOrganizationAccess(ctx) {
 	const orgIdFromUrl = tryDecode(ctx.params.id);
 	const orgIdFromToken = ctx.context.payload?.organizationId;
@@ -6156,6 +6108,12 @@ const oidcConfigSchema = z$1.object({
 	clientSecret: z$1.string().optional(),
 	discoveryUrl: z$1.string().optional(),
 	issuer: z$1.string().optional(),
+	discoveryEndpoint: z$1.string().optional(),
+	authorizationEndpoint: z$1.string().optional(),
+	tokenEndpoint: z$1.string().optional(),
+	jwksEndpoint: z$1.string().optional(),
+	userInfoEndpoint: z$1.string().optional(),
+	tokenEndpointAuthentication: z$1.enum(["client_secret_post", "client_secret_basic"]).optional(),
 	mapping: z$1.object({
 		id: z$1.string().optional(),
 		email: z$1.string().optional(),
@@ -6166,21 +6124,8 @@ const oidcConfigSchema = z$1.object({
 	}).optional()
 });
 async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
-	let idpMetadataXml = samlConfig.idpMetadata?.metadata;
-	if (!idpMetadataXml && samlConfig.idpMetadata?.metadataUrl) try {
-		const metadataResponse = await $outbound(samlConfig.idpMetadata.metadataUrl, {
-			method: "GET",
-			headers: { Accept: "application/xml, text/xml" },
-			timeout: 15e3
-		});
-		if (!metadataResponse.ok) throw ctx.error("BAD_REQUEST", { message: `Failed to fetch IdP metadata from URL: ${metadataResponse.status} ${metadataResponse.statusText}` });
-		idpMetadataXml = await metadataResponse.text();
-	} catch (e) {
-		if (isSsrfBlockedError(e)) throw ctx.error("BAD_REQUEST", { message: "Invalid or blocked IdP metadata URL" });
-		if (e instanceof APIError$1) throw e;
-		ctx.context.logger.error("[Dash] Failed to fetch IdP metadata from URL:", e);
-		throw ctx.error("BAD_REQUEST", { message: "Failed to fetch IdP metadata from URL" });
-	}
+	const idpMetadataXml = samlConfig.idpMetadata?.metadata;
+	if (samlConfig.idpMetadata?.metadataUrl && !idpMetadataXml) throw ctx.error("BAD_REQUEST", { message: "IdP metadata URL must be resolved before submitting; provide idpMetadata.metadata" });
 	const metadataAlgorithmWarnings = [];
 	if (idpMetadataXml) {
 		try {
@@ -6203,14 +6148,22 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 		...samlConfig.cert ? { cert: samlConfig.cert } : {}
 	};
 	const m = samlConfig.mapping;
+	const resolvedEntryPoint = samlConfig.entryPoint?.trim() || (idpMetadataXml ? extractEntryPointFromSAMLMetadata(idpMetadataXml) : void 0);
+	const saml17OrNewer = isVersionAtLeast(ctx.context.version, "1.7.0");
+	if (saml17OrNewer && !resolvedEntryPoint) throw ctx.error("BAD_REQUEST", { message: "SAML entry point URL is required; provide entryPoint or IdP metadata with SingleSignOnService Location" });
 	return {
 		config: {
 			issuer: samlConfig.entityId ?? `${baseURL}/sso/saml2/sp/metadata?providerId=${providerId}`,
-			callbackUrl: `${baseURL}/sso/saml2/sp/acs/${providerId}`,
 			idpMetadata,
-			spMetadata: {},
-			entryPoint: samlConfig.entryPoint ?? "",
-			cert: samlConfig.cert ?? "",
+			...saml17OrNewer ? {
+				entryPoint: resolvedEntryPoint,
+				...samlConfig.cert ? { cert: samlConfig.cert } : {}
+			} : {
+				callbackUrl: `${baseURL}/sso/saml2/sp/acs/${providerId}`,
+				spMetadata: {},
+				entryPoint: resolvedEntryPoint ?? "",
+				cert: samlConfig.cert ?? ""
+			},
 			...m ? { mapping: {
 				id: m.id ?? "nameID",
 				email: m.email ?? "email",
@@ -6224,67 +6177,33 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 		...metadataAlgorithmWarnings.length > 0 ? { warnings: metadataAlgorithmWarnings } : {}
 	};
 }
-async function resolveOIDCConfig(oidcConfig, domain, ctx) {
-	let normalizedDomain = domain;
-	try {
-		if (domain.startsWith("http://") || domain.startsWith("https://")) normalizedDomain = new URL(domain).hostname;
-	} catch {
-		normalizedDomain = domain;
-	}
-	const issuerHint = oidcConfig.issuer || `https://${normalizedDomain}`;
-	const issuer = issuerHint.startsWith("http") ? issuerHint : `https://${issuerHint}`;
-	const sso = await loadSsoRuntime();
-	try {
-		const hydratedConfig = await sso.discoverOIDCConfig({
-			issuer,
-			discoveryEndpoint: oidcConfig.discoveryUrl,
-			isTrustedOrigin: (url) => {
-				try {
-					const issuerOrigin = new URL(issuer).origin;
-					return new URL(url).origin === issuerOrigin;
-				} catch {
-					return false;
-				}
-			}
-		});
-		const om = oidcConfig.mapping;
-		return {
-			config: {
-				clientId: oidcConfig.clientId,
-				clientSecret: oidcConfig.clientSecret,
-				issuer: hydratedConfig.issuer,
-				discoveryEndpoint: hydratedConfig.discoveryEndpoint,
-				authorizationEndpoint: hydratedConfig.authorizationEndpoint,
-				tokenEndpoint: hydratedConfig.tokenEndpoint,
-				jwksEndpoint: hydratedConfig.jwksEndpoint,
-				userInfoEndpoint: hydratedConfig.userInfoEndpoint,
-				tokenEndpointAuthentication: hydratedConfig.tokenEndpointAuthentication,
-				pkce: true,
-				...om ? { mapping: {
-					id: om.id ?? "sub",
-					email: om.email ?? "email",
-					name: om.name ?? "name",
-					emailVerified: om.emailVerified,
-					image: om.image,
-					extraFields: om.extraFields
-				} } : {}
-			},
-			issuer: hydratedConfig.issuer
-		};
-	} catch (e) {
-		if (e instanceof sso.DiscoveryError) {
-			ctx.context.logger.error("[Dash] OIDC discovery failed:", e);
-			throw ctx.error("BAD_REQUEST", {
-				message: `OIDC discovery failed: ${e.message}`,
-				code: e.code
-			});
-		}
-		ctx.context.logger.error("[Dash] OIDC discovery failed:", e);
-		throw ctx.error("BAD_REQUEST", {
-			message: `OIDC discovery failed: Unable to discover configuration from ${issuer}`,
-			code: "OIDC_DISCOVERY_FAILED"
-		});
-	}
+async function resolveOIDCConfig(oidcConfig, _domain, ctx) {
+	if (!oidcConfig.issuer || !oidcConfig.authorizationEndpoint || !oidcConfig.tokenEndpoint || !oidcConfig.jwksEndpoint) throw ctx.error("BAD_REQUEST", { message: "OIDC discovery must be resolved before submitting; provide issuer, authorizationEndpoint, tokenEndpoint, and jwksEndpoint" });
+	const om = oidcConfig.mapping;
+	const discoveryEndpoint = oidcConfig.discoveryEndpoint ?? oidcConfig.discoveryUrl ?? oidcConfig.issuer;
+	return {
+		config: {
+			clientId: oidcConfig.clientId,
+			clientSecret: oidcConfig.clientSecret,
+			issuer: oidcConfig.issuer,
+			discoveryEndpoint,
+			authorizationEndpoint: oidcConfig.authorizationEndpoint,
+			tokenEndpoint: oidcConfig.tokenEndpoint,
+			jwksEndpoint: oidcConfig.jwksEndpoint,
+			userInfoEndpoint: oidcConfig.userInfoEndpoint,
+			tokenEndpointAuthentication: oidcConfig.tokenEndpointAuthentication,
+			pkce: true,
+			...om ? { mapping: {
+				id: om.id ?? "sub",
+				email: om.email ?? "email",
+				name: om.name ?? "name",
+				emailVerified: om.emailVerified,
+				image: om.image,
+				extraFields: om.extraFields
+			} } : {}
+		},
+		issuer: oidcConfig.issuer
+	};
 }
 const listOrganizationSsoProviders = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-providers", {
@@ -6442,6 +6361,7 @@ const updateSsoProvider = (options) => {
 		try {
 			const result = await ssoPlugin.endpoints.updateSSOProvider({
 				body: updateBody,
+				params: { providerId },
 				context: {
 					...ctx.context,
 					...buildSessionContext(providerUserId)
@@ -6589,6 +6509,7 @@ const deleteSsoProvider = (options) => {
 		try {
 			await ssoPlugin.endpoints.deleteSSOProvider({
 				body: { providerId },
+				params: { providerId },
 				context: {
 					...ctx.context,
 					...buildSessionContext(provider.userId)
@@ -6646,6 +6567,64 @@ const markSsoProviderDomainVerified = (options) => {
 	});
 };
 //#endregion
+//#region src/routes/two-factor/backup-codes.ts
+/** Mirrors better-auth/plugins/two-factor/backup-codes generateBackupCodesFn. */
+function generateBackupCodesPlain(options) {
+	if (options?.customBackupCodesGenerate) return options.customBackupCodesGenerate();
+	const amount = options?.amount ?? 10;
+	const length = options?.length ?? 10;
+	return Array.from({ length: amount }, () => {
+		const code = generateRandomString(length, "a-z", "0-9", "A-Z");
+		return `${code.slice(0, 5)}-${code.slice(5)}`;
+	});
+}
+/** Mirrors better-auth/plugins/two-factor/backup-codes generateBackupCodes. */
+async function generateBackupCodes$1(secret, options) {
+	const backupCodes = generateBackupCodesPlain(options);
+	const json = JSON.stringify(backupCodes);
+	const storeBackupCodes = options?.storeBackupCodes ?? "encrypted";
+	if (storeBackupCodes === "encrypted") return {
+		backupCodes,
+		encryptedBackupCodes: await symmetricEncrypt({
+			key: secret,
+			data: json
+		})
+	};
+	if (typeof storeBackupCodes === "object" && "encrypt" in storeBackupCodes) return {
+		backupCodes,
+		encryptedBackupCodes: await storeBackupCodes.encrypt(json)
+	};
+	return {
+		backupCodes,
+		encryptedBackupCodes: json
+	};
+}
+function resolveBackupCodeOptions(twoFactorPlugin) {
+	return {
+		storeBackupCodes: "encrypted",
+		...twoFactorPlugin?.options?.backupCodeOptions
+	};
+}
+//#endregion
+//#region src/routes/two-factor/two-factor-options.ts
+function resolveTotpIssuer(twoFactorPlugin, appName) {
+	const options = twoFactorPlugin?.options;
+	return (options?.totpOptions)?.issuer ?? options?.issuer ?? appName ?? "BetterAuth";
+}
+function resolveTotpConfig(twoFactorPlugin) {
+	const totpOptions = twoFactorPlugin?.options?.totpOptions;
+	return {
+		digits: totpOptions?.digits ?? 6,
+		period: totpOptions?.period ?? 30
+	};
+}
+function buildTotpUri(params) {
+	return createOTP(params.secret, {
+		digits: params.digits,
+		period: params.period
+	}).url(params.issuer, params.account);
+}
+//#endregion
 //#region src/routes/two-factor/index.ts
 const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor", {
 	method: "POST",
@@ -6654,31 +6633,37 @@ const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
 	if (!twoFactorPlugin) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication plugin is not enabled" });
+	if (twoFactorPlugin.options?.totpOptions?.disable === true) throw new APIError("BAD_REQUEST", {
+		message: "TOTP is not configured",
+		code: "TOTP_NOT_CONFIGURED"
+	});
+	const twoFactorTable = twoFactorPlugin.options?.twoFactorTable ?? "twoFactor";
+	const user = await ctx.context.internalAdapter.findUserById(userId);
+	if (!user) throw new APIError("NOT_FOUND", { message: "User not found" });
+	if (user.twoFactorEnabled === true) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication is already enabled for this user" });
 	if (await ctx.context.adapter.findOne({
-		model: "twoFactor",
+		model: twoFactorTable,
+		where: [{
+			field: "userId",
+			value: userId
+		}]
+	})) await ctx.context.adapter.delete({
+		model: twoFactorTable,
 		where: [{
 			field: "userId",
 			value: userId
 		}]
-	})) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication is already enabled for this user" });
+	});
 	const { generateRandomString, symmetricEncrypt } = await import("better-auth/crypto");
-	const secret = generateRandomString(32, "A-Z");
-	const backupCodeAmount = 10;
-	const backupCodeLength = 10;
-	const backupCodes = [];
-	for (let i = 0; i < backupCodeAmount; i++) backupCodes.push(generateId(backupCodeLength).toUpperCase());
+	const secret = generateRandomString(32);
+	const { backupCodes, encryptedBackupCodes } = await generateBackupCodes$1(ctx.context.secret, resolveBackupCodeOptions(twoFactorPlugin));
 	const encryptedSecret = await symmetricEncrypt({
 		key: ctx.context.secret,
 		data: secret
 	});
-	const encryptedBackupCodes = await symmetricEncrypt({
-		key: ctx.context.secret,
-		data: JSON.stringify(backupCodes)
-	});
 	await ctx.context.adapter.create({
-		model: "twoFactor",
+		model: twoFactorTable,
 		data: {
-			id: generateId(32),
 			userId,
 			secret: encryptedSecret,
 			backupCodes: encryptedBackupCodes
@@ -6688,15 +6673,47 @@ const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor
 		twoFactorEnabled: true,
 		updatedAt: /* @__PURE__ */ new Date()
 	});
-	const user = await ctx.context.internalAdapter.findUserById(userId);
-	const issuer = twoFactorPlugin.options?.issuer || ctx.context.appName || "BetterAuth";
+	const totpConfig = resolveTotpConfig(twoFactorPlugin);
 	return {
 		success: true,
-		totpURI: `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(user?.email || userId)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30`,
+		totpURI: buildTotpUri({
+			secret,
+			issuer: resolveTotpIssuer(twoFactorPlugin, ctx.context.appName),
+			account: user?.email || userId,
+			digits: totpConfig.digits,
+			period: totpConfig.period
+		}),
 		secret,
 		backupCodes
 	};
 });
+const completeTwoFactorSetup = (options) => createAuthEndpoint("/dash/complete-two-factor-setup", {
+	method: "POST",
+	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+}, async (ctx) => {
+	const { userId } = ctx.context.payload;
+	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
+	if (!twoFactorPlugin) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication plugin is not enabled" });
+	const user = await ctx.context.internalAdapter.findUserById(userId);
+	if (!user) throw new APIError("NOT_FOUND", { message: "User not found" });
+	if (user.twoFactorEnabled === true) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication is already enabled for this user" });
+	const twoFactorTable = twoFactorPlugin.options?.twoFactorTable ?? "twoFactor";
+	if (!await ctx.context.adapter.findOne({
+		model: twoFactorTable,
+		where: [{
+			field: "userId",
+			value: userId
+		}]
+	})) throw new APIError("BAD_REQUEST", {
+		message: "Two-factor authentication setup has not been started",
+		code: "TWO_FACTOR_SETUP_NOT_PENDING"
+	});
+	await ctx.context.internalAdapter.updateUser(userId, {
+		twoFactorEnabled: true,
+		updatedAt: /* @__PURE__ */ new Date()
+	});
+	return { success: true };
+});
 const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-factor-totp-uri", {
 	method: "POST",
 	metadata: { scope: "http" },
@@ -6705,8 +6722,13 @@ const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-fac
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
 	if (!twoFactorPlugin) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication plugin is not enabled" });
+	if (twoFactorPlugin.options?.totpOptions?.disable === true) throw new APIError("BAD_REQUEST", {
+		message: "TOTP is not configured",
+		code: "TOTP_NOT_CONFIGURED"
+	});
+	const twoFactorTable = twoFactorPlugin.options?.twoFactorTable ?? "twoFactor";
 	const twoFactorRecord = await ctx.context.adapter.findOne({
-		model: "twoFactor",
+		model: twoFactorTable,
 		where: [{
 			field: "userId",
 			value: userId
@@ -6722,8 +6744,14 @@ const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-fac
 		});
 	} catch {}
 	const user = await ctx.context.internalAdapter.findUserById(userId);
-	const issuer = twoFactorPlugin.options?.issuer || ctx.context.appName || "BetterAuth";
-	return { totpURI: `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(user?.email || userId)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30` };
+	const totpConfig = resolveTotpConfig(twoFactorPlugin);
+	return { totpURI: buildTotpUri({
+		secret,
+		issuer: resolveTotpIssuer(twoFactorPlugin, ctx.context.appName),
+		account: user?.email || userId,
+		digits: totpConfig.digits,
+		period: totpConfig.period
+	}) };
 });
 const viewBackupCodes = (options) => createAuthEndpoint("/dash/view-backup-codes", {
 	method: "POST",
@@ -6736,9 +6764,11 @@ const disableTwoFactor = (options) => createAuthEndpoint("/dash/disable-two-fact
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
-	if (!ctx.context.getPlugin("two-factor")) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication is not enabled" });
+	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
+	if (!twoFactorPlugin) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication is not enabled" });
+	const twoFactorTable = twoFactorPlugin.options?.twoFactorTable ?? "twoFactor";
 	await ctx.context.adapter.delete({
-		model: "twoFactor",
+		model: twoFactorTable,
 		where: [{
 			field: "userId",
 			value: userId
@@ -6755,25 +6785,19 @@ const generateBackupCodes = (options) => createAuthEndpoint("/dash/generate-back
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
+	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
+	const twoFactorTable = twoFactorPlugin?.options?.twoFactorTable ?? "twoFactor";
 	const twoFactorRecord = await ctx.context.adapter.findOne({
-		model: "twoFactor",
+		model: twoFactorTable,
 		where: [{
 			field: "userId",
 			value: userId
 		}]
 	});
 	if (!twoFactorRecord) throw new APIError("NOT_FOUND", { message: "Two-factor authentication not set up for this user" });
-	const backupCodeAmount = 10;
-	const backupCodeLength = 10;
-	const newBackupCodes = [];
-	for (let i = 0; i < backupCodeAmount; i++) newBackupCodes.push(generateId(backupCodeLength).toUpperCase());
-	const { symmetricEncrypt } = await import("better-auth/crypto");
-	const encryptedCodes = await symmetricEncrypt({
-		key: ctx.context.secret,
-		data: JSON.stringify(newBackupCodes)
-	});
+	const { backupCodes: newBackupCodes, encryptedBackupCodes: encryptedCodes } = await generateBackupCodes$1(ctx.context.secret, resolveBackupCodeOptions(twoFactorPlugin));
 	await ctx.context.adapter.update({
-		model: "twoFactor",
+		model: twoFactorTable,
 		where: [{
 			field: "id",
 			value: twoFactorRecord.id
@@ -6783,6 +6807,196 @@ const generateBackupCodes = (options) => createAuthEndpoint("/dash/generate-back
 	return { backupCodes: newBackupCodes };
 });
 //#endregion
+//#region src/compat/sessions.ts
+/** Secondary-storage sessions on older better-auth builds may omit `id`; dash expects one. */
+function normalizeDashSessions(sessions) {
+	return sessions.map((session) => {
+		if (session.id) return session;
+		if (session.token) return {
+			...session,
+			id: session.token
+		};
+		return session;
+	});
+}
+//#endregion
+//#region src/lib/sanitize-sessions.ts
+/**
+* Strips bearer tokens from session records before returning them from dash handlers.
+*/
+function sanitizeSessions(sessions) {
+	return sessions.map((session) => {
+		const { token: _token, ...rest } = session;
+		return rest;
+	});
+}
+//#endregion
+//#region src/routes/two-factor/two-factor-status.ts
+async function resolveTwoFactorStatus(context, userId, user) {
+	if (!hasPlugin(context, "two-factor")) return;
+	if (user.twoFactorEnabled === true) return "enabled";
+	const twoFactorTable = context.getPlugin("two-factor")?.options?.twoFactorTable ?? "twoFactor";
+	return await context.adapter.findOne({
+		model: twoFactorTable,
+		where: [{
+			field: "userId",
+			value: userId
+		}]
+	}) ? "pending" : "disabled";
+}
+//#endregion
+//#region src/routes/users/schemas.ts
+const DENIED_USER_WRITE_KEYS = new Set([
+	"id",
+	"createdAt",
+	"updatedAt"
+]);
+/** Fields that must be changed through dedicated permission-checked endpoints. */
+const DENIED_SENSITIVE_USER_KEYS = new Set([
+	"banned",
+	"banReason",
+	"banExpires",
+	"role",
+	"password",
+	"twoFactorEnabled",
+	"twoFactorSecret"
+]);
+const CREATE_REQUEST_ONLY_KEYS = new Set([
+	"password",
+	"generatePassword",
+	"sendVerificationEmail",
+	"sendOrganizationInvite",
+	"organizationRole",
+	"organizationId"
+]);
+const CORE_CREATE_KEYS = [
+	"name",
+	"email",
+	"image",
+	"emailVerified"
+];
+const CORE_UPDATE_KEYS = [
+	"name",
+	"email",
+	"image",
+	"emailVerified"
+];
+/**
+* Mirrors Better Auth's user input schema merge:
+* `user.additionalFields` plus each plugin's `schema.user` fields.
+*/
+function getUserInputFields(options) {
+	let schema = { ...options?.user?.additionalFields ?? {} };
+	for (const plugin of options?.plugins ?? []) {
+		const pluginUser = plugin.schema?.user;
+		if (pluginUser?.fields) schema = {
+			...schema,
+			...pluginUser.fields
+		};
+		if (pluginUser?.additionalFields) schema = {
+			...schema,
+			...pluginUser.additionalFields
+		};
+	}
+	return schema;
+}
+function isWritableUserInputField(field) {
+	return field.input !== false && !field.references;
+}
+function getWritableUserAdditionalFieldNames(options) {
+	return Object.entries(getUserInputFields(options)).filter(([, field]) => isWritableUserInputField(field)).map(([name]) => name);
+}
+function getWritableUserFieldNames(options, mode) {
+	const keys = new Set(mode === "create" ? CORE_CREATE_KEYS : CORE_UPDATE_KEYS);
+	for (const name of getWritableUserAdditionalFieldNames(options)) keys.add(name);
+	return keys;
+}
+/**
+* Returns only user fields that may be persisted on create/update.
+* Strips unknown keys, denied keys, request-only fields, and non-input/reference additional fields.
+*/
+function pickWritableUserFields(body, options, mode) {
+	const allowed = getWritableUserFieldNames(options, mode);
+	const skip = new Set([
+		...DENIED_USER_WRITE_KEYS,
+		...DENIED_SENSITIVE_USER_KEYS,
+		...mode === "create" ? CREATE_REQUEST_ONLY_KEYS : []
+	]);
+	const result = {};
+	for (const [key, value] of Object.entries(body)) {
+		if (skip.has(key) || !allowed.has(key) || value === void 0) continue;
+		result[key] = value;
+	}
+	return result;
+}
+const BaseCreateUserCoreBodySchema = z$1.object({
+	name: z$1.string(),
+	email: z$1.email(),
+	image: z$1.string().optional(),
+	password: z$1.string().optional(),
+	generatePassword: z$1.boolean().optional(),
+	emailVerified: z$1.boolean().optional(),
+	sendVerificationEmail: z$1.boolean().optional(),
+	sendOrganizationInvite: z$1.boolean().optional(),
+	organizationRole: z$1.string().optional(),
+	organizationId: z$1.string().optional()
+});
+const BaseUpdateUserCoreBodySchema = z$1.object({
+	name: z$1.string().nullable().optional(),
+	email: z$1.email().optional(),
+	image: z$1.string().nullable().optional(),
+	emailVerified: z$1.boolean().optional()
+});
+const CreateUserBodySchema = BaseCreateUserCoreBodySchema.catchall(z$1.unknown());
+const UpdateUserBodySchema = BaseUpdateUserCoreBodySchema.catchall(z$1.unknown());
+function createSchemaForDBField(field) {
+	switch (field.type) {
+		case "number": return field.required ? z$1.coerce.number() : z$1.coerce.number().optional();
+		case "boolean": return field.required ? z$1.coerce.boolean() : z$1.coerce.boolean().optional();
+		case "date": return field.required ? z$1.union([z$1.string().min(1), z$1.coerce.date()]) : z$1.union([z$1.string(), z$1.coerce.date()]).optional();
+		default: return field.required ? z$1.string().min(1) : z$1.string().optional();
+	}
+}
+/**
+* Validates required core + configured additional fields on create.
+*/
+function validateWritableCreateUserFields(data, options) {
+	const shape = {
+		name: z$1.string().min(1),
+		email: z$1.email(),
+		image: z$1.string().optional(),
+		emailVerified: z$1.boolean().optional()
+	};
+	for (const [name, field] of Object.entries(getUserInputFields(options))) {
+		if (!isWritableUserInputField(field)) continue;
+		shape[name] = createSchemaForDBField(field);
+	}
+	const result = z$1.object(shape).strict().safeParse(data);
+	if (!result.success) throw result.error;
+}
+/**
+* Ensures at least one field is present on update and validates additional field types.
+*/
+function validateWritableUserUpdateFields(data, options) {
+	if (Object.keys(data).length === 0) throw new z$1.ZodError([{
+		code: "custom",
+		message: "No valid fields to update",
+		path: []
+	}]);
+	const shape = {
+		name: z$1.string().nullable().optional(),
+		email: z$1.email().optional(),
+		image: z$1.string().nullable().optional(),
+		emailVerified: z$1.boolean().optional()
+	};
+	for (const [name, field] of Object.entries(getUserInputFields(options))) {
+		if (!isWritableUserInputField(field)) continue;
+		shape[name] = createSchemaForDBField(field);
+	}
+	const result = z$1.object(shape).partial().strict().safeParse(data);
+	if (!result.success) throw result.error;
+}
+//#endregion
 //#region src/routes/users/index.ts
 function parseWhereClause(val) {
 	if (!val) return [];
@@ -6946,7 +7160,7 @@ const impersonateUser = (options) => {
 		query: z$1.object({ impersonation_token: z$1.string() }),
 		use: [jwtMiddleware(options, z$1.object({
 			userId: z$1.string(),
-			redirectUrl: z$1.url(),
+			redirectUrl: safeUrlSchema,
 			impersonatedBy: z$1.string().optional()
 		}), async (ctx) => {
 			return ctx.query.impersonation_token;
@@ -6974,25 +7188,21 @@ const createUser = (options) => {
 			organizationId: z$1.string().optional(),
 			organizationRole: z$1.string().optional()
 		}))],
-		body: z$1.looseObject({
-			name: z$1.string(),
-			email: z$1.email(),
-			image: z$1.string().optional(),
-			password: z$1.string().optional(),
-			generatePassword: z$1.boolean().optional(),
-			emailVerified: z$1.boolean().optional(),
-			sendVerificationEmail: z$1.boolean().optional(),
-			sendOrganizationInvite: z$1.boolean().optional(),
-			organizationRole: z$1.string().optional(),
-			organizationId: z$1.string().optional()
-		})
+		body: CreateUserBodySchema
 	}, async (ctx) => {
-		const userData = ctx.body;
+		const body = ctx.body;
+		const userData = pickWritableUserFields(body, ctx.context.options, "create");
+		try {
+			validateWritableCreateUserFields(userData, ctx.context.options);
+		} catch (error) {
+			if (error instanceof z$1.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
+			throw error;
+		}
 		const email = normalizeEmail(userData.email, ctx.context);
 		if (await ctx.context.internalAdapter.findUserByEmail(email)) throw new APIError("BAD_REQUEST", { message: "User with this email already exist" });
 		let password = null;
-		if (userData.generatePassword && !userData.password) password = generateId(12);
-		else if (userData.password && userData.password.trim() !== "") password = userData.password;
+		if (body.generatePassword && !body.password) password = generateId(12);
+		else if (body.password && typeof body.password === "string" && body.password.trim() !== "") password = body.password;
 		const userSchema = getAuthTables(ctx.context.options).user;
 		for (const field in userSchema.fields || {}) {
 			const value = userSchema.fields[field];
@@ -7009,24 +7219,28 @@ const createUser = (options) => {
 				}
 			}
 		}
-		const user = await ctx.context.internalAdapter.createUser({
+		const emailVerified = userData.emailVerified;
+		const userPayload = {
 			...userData,
+			name: userData.name,
 			email,
-			emailVerified: userData.emailVerified,
+			emailVerified,
 			createdAt: /* @__PURE__ */ new Date(),
 			updatedAt: /* @__PURE__ */ new Date()
-		});
+		};
+		const adapter = ctx.context.internalAdapter;
+		const user = isVersionAtLeast(ctx.context.version, "1.7.0") ? await adapter.createUser(userPayload, { method: "admin" }) : await adapter.createUser(userPayload);
 		if (password) await ctx.context.internalAdapter.createAccount({
 			userId: user.id,
 			providerId: "credential",
 			accountId: user.id,
 			password: await ctx.context.password.hash(password)
 		});
-		if (userData.sendVerificationEmail && !userData.emailVerified) {
+		if (body.sendVerificationEmail && !emailVerified) {
 			if (ctx.context.options.emailVerification?.sendVerificationEmail) await sendVerificationEmailFn(ctx, user);
 		}
-		const organizationId = ctx.context.payload?.organizationId || userData.organizationId;
-		const organizationRole = ctx.context.payload?.organizationRole || userData.organizationRole;
+		const organizationId = ctx.context.payload?.organizationId || body.organizationId;
+		const organizationRole = ctx.context.payload?.organizationRole || body.organizationRole;
 		if (organizationId) {
 			const orgOptions = requireOrganizationPlugin(ctx).options || {};
 			const role = organizationRole || "member";
@@ -7136,6 +7350,7 @@ const getUserDetails = (options) => {
 			} }
 		});
 		if (!user) throw ctx.error("NOT_FOUND", { message: "User not found" });
+		const twoFactorStatus = await resolveTwoFactorStatus(ctx.context, userId, user);
 		if (minimal) return {
 			...user,
 			lastActiveAt: user.lastActiveAt ?? null,
@@ -7143,10 +7358,11 @@ const getUserDetails = (options) => {
 			banReason: hasAdminPlugin ? user.banReason ?? null : null,
 			banExpires: hasAdminPlugin ? user.banExpires ?? null : null,
 			account: [],
-			session: []
+			session: [],
+			twoFactorStatus
 		};
 		const activityTrackingEnabled = !!options.activityTracking?.enabled;
-		const sessions = secondaryStorageOnly ? await ctx.context.internalAdapter.listSessions(userId) : user.session || [];
+		const sessions = secondaryStorageOnly ? normalizeDashSessions(await ctx.context.internalAdapter.listSessions(userId)) : user.session || [];
 		let lastActiveAt = null;
 		if (activityTrackingEnabled) {
 			lastActiveAt = user.lastActiveAt ?? null;
@@ -7175,13 +7391,15 @@ const getUserDetails = (options) => {
 				updateActivity();
 			}
 		}
+		const { session: _joinedSessions, ...userWithoutSessions } = user;
 		return {
-			...user,
-			...secondaryStorageOnly ? { session: sessions } : {},
+			...userWithoutSessions,
+			session: sanitizeSessions(sessions),
 			lastActiveAt,
 			banned: hasAdminPlugin ? user.banned ?? false : false,
 			banReason: hasAdminPlugin ? user.banReason ?? null : null,
-			banExpires: hasAdminPlugin ? user.banExpires ?? null : null
+			banExpires: hasAdminPlugin ? user.banExpires ?? null : null,
+			twoFactorStatus
 		};
 	});
 };
@@ -7234,20 +7452,19 @@ const getUserOrganizations = (options) => {
 const updateUser = (options) => createAuthEndpoint("/dash/update-user", {
 	method: "POST",
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-	body: z$1.looseObject({
-		name: z$1.string().optional(),
-		email: z$1.email().optional(),
-		image: z$1.string().optional(),
-		emailVerified: z$1.boolean().optional()
-	})
+	body: UpdateUserBodySchema
 }, async (ctx) => {
-	const updateData = ctx.body;
 	const userId = ctx.context.payload?.userId;
 	if (!userId) throw new APIError("FORBIDDEN", { message: "Invalid payload" });
-	const filteredData = Object.fromEntries(Object.entries(updateData).filter(([, value]) => value !== void 0));
-	if (Object.keys(filteredData).length === 0) throw new APIError("BAD_REQUEST", { message: "No valid fields to update" });
+	const updateData = pickWritableUserFields(ctx.body, ctx.context.options, "update");
+	try {
+		validateWritableUserUpdateFields(updateData, ctx.context.options);
+	} catch (error) {
+		if (error instanceof z$1.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
+		throw error;
+	}
 	const user = await ctx.context.internalAdapter.updateUser(userId, {
-		...filteredData,
+		...updateData,
 		updatedAt: /* @__PURE__ */ new Date()
 	});
 	if (!user) throw new APIError("NOT_FOUND", { message: "User not found" });
@@ -7711,11 +7928,12 @@ const banUser = (options) => createAuthEndpoint("/dash/ban-user", {
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
 	body: z$1.object({
 		banReason: z$1.string().optional(),
-		banExpires: z$1.number().optional()
+		banExpires: z$1.number().optional(),
+		deleteAllSessions: z$1.boolean().optional().default(true)
 	})
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
-	const { banReason, banExpires } = ctx.body;
+	const { banReason, banExpires, deleteAllSessions } = ctx.body;
 	if (!await ctx.context.internalAdapter.findUserById(userId)) throw new APIError("NOT_FOUND", { message: "User not found" });
 	await ctx.context.internalAdapter.updateUser(userId, {
 		banned: true,
@@ -7723,7 +7941,7 @@ const banUser = (options) => createAuthEndpoint("/dash/ban-user", {
 		banExpires: banExpires ? new Date(banExpires) : null,
 		updatedAt: /* @__PURE__ */ new Date()
 	});
-	await ctx.context.internalAdapter.deleteUserSessions(userId);
+	if (deleteAllSessions) await deleteUserSessionsCompat(ctx.context.internalAdapter, userId);
 	return { success: true };
 });
 const banManyUsers = (options) => {
@@ -7732,11 +7950,12 @@ const banManyUsers = (options) => {
 		use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))],
 		body: z$1.object({
 			banReason: z$1.string().optional(),
-			banExpires: z$1.number().optional()
+			banExpires: z$1.number().optional(),
+			deleteAllSessions: z$1.boolean().optional().default(true)
 		})
 	}, async (ctx) => {
 		const { userIds } = ctx.context.payload;
-		const { banReason, banExpires } = ctx.body;
+		const { banReason, banExpires, deleteAllSessions } = ctx.body;
 		const start = performance.now();
 		await withConcurrency(chunkArray(userIds, { batchSize: 50 }), async (chunk) => {
 			await ctx.context.adapter.updateMany({
@@ -7768,6 +7987,9 @@ const banManyUsers = (options) => {
 			select: ["id"]
 		})).map((u) => u.id);
 		const bannedUserIds = userIds.filter((id) => !skippedUserIds.includes(id));
+		if (deleteAllSessions && bannedUserIds.length > 0) await withConcurrency(chunkArray(bannedUserIds, { batchSize: 50 }), async (chunk) => {
+			for (const userId of chunk) await deleteUserSessionsCompat(ctx.context.internalAdapter, userId);
+		}, { concurrency: 3 });
 		const end = performance.now();
 		console.log(`Time taken to ban ${bannedUserIds.length} users: ${(end - start) / 1e3}s`, skippedUserIds.length > 0 ? `Skipped: ${skippedUserIds.length}` : "");
 		return ctx.json({
@@ -7794,7 +8016,7 @@ const unbanUser = (options) => createAuthEndpoint("/dash/unban-user", {
 const sendVerificationEmail = (options) => createAuthEndpoint("/dash/send-verification-email", {
 	method: "POST",
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-	body: z$1.object({ callbackUrl: z$1.url() })
+	body: z$1.object({ callbackUrl: safeUrlSchema })
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const { callbackUrl } = ctx.body;
@@ -7816,7 +8038,7 @@ const sendManyVerificationEmails = (options) => {
 	return createAuthEndpoint("/dash/send-many-verification-emails", {
 		method: "POST",
 		use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))],
-		body: z$1.object({ callbackUrl: z$1.url() })
+		body: z$1.object({ callbackUrl: safeUrlSchema })
 	}, async (ctx) => {
 		if (!ctx.context.options.emailVerification?.sendVerificationEmail) throw ctx.error("BAD_REQUEST", { message: "Email verification is not enabled" });
 		const { userIds } = ctx.context.payload;
@@ -7876,7 +8098,7 @@ const sendManyVerificationEmails = (options) => {
 const sendResetPasswordEmail = (options) => createAuthEndpoint("/dash/send-reset-password-email", {
 	method: "POST",
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-	body: z$1.object({ callbackUrl: z$1.url() })
+	body: z$1.object({ callbackUrl: safeUrlSchema })
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const user = await ctx.context.internalAdapter.findUserById(userId);
@@ -7968,6 +8190,8 @@ const SMS_TEMPLATES = {
 	"two-factor": { variables: {} },
 	"sign-in-otp": { variables: {} }
 };
+/** End-user IP forwarded to v1 SMS for abuse limits on server-to-server calls. */
+const BETTER_AUTH_CLIENT_IP_HEADER = "x-better-auth-client-ip";
 /**
 * Create an SMS sender instance
 */
@@ -7978,7 +8202,10 @@ function createSMSSender(config) {
 	if (!apiKey) logger.warn("[Dash] No API key provided for SMS sending. Set BETTER_AUTH_API_KEY environment variable or pass apiKey in config.");
 	const $api = createFetch({
 		baseURL: apiUrl,
-		headers: { Authorization: `Bearer ${apiKey}` },
+		headers: {
+			"user-agent": INFRA_USER_AGENT,
+			Authorization: `Bearer ${apiKey}`
+		},
 		timeout: config?.apiTimeout ?? 3e3
 	});
 	/**
@@ -7996,7 +8223,12 @@ function createSMSSender(config) {
 					to: options.to,
 					code: options.code,
 					template: options.template
-				}
+				},
+				...options.clientIp ? { headers: {
+					Authorization: `Bearer ${apiKey}`,
+					"user-agent": INFRA_USER_AGENT,
+					[BETTER_AUTH_CLIENT_IP_HEADER]: options.clientIp
+				} } : {}
 			});
 			if (error) return {
 				success: false,
@@ -8084,6 +8316,7 @@ const dash = (options) => {
 		options: opts,
 		version: PLUGIN_VERSION,
 		init(ctx) {
+			instrumentSocialProviders(ctx.socialProviders);
 			const organizationPlugin = ctx.getPlugin("organization");
 			if (organizationPlugin) {
 				const instrumentOrganizationHooks = (organizationPluginOptions) => {
@@ -8313,7 +8546,8 @@ const dash = (options) => {
 								routes.CHANGE_PASSWORD,
 								routes.SET_PASSWORD,
 								routes.RESET_PASSWORD,
-								routes.ADMIN_SET_PASSWORD
+								routes.ADMIN_SET_PASSWORD,
+								routes.DASH_SET_PASSWORD
 							])) trackAccountPasswordChange(account, trigger, ctx, location);
 						} },
 						delete: { async after(account, _ctx) {
@@ -8349,11 +8583,14 @@ const dash = (options) => {
 			before: [{
 				matcher: (ctx) => {
 					if (ctx.request?.method !== "GET") return true;
-					const path = new URL(ctx.request.url).pathname;
-					return matchesAnyRoute(path, [
+					return matchesAnyRoute(ctx.path, [
 						routes.SIGN_IN_SOCIAL_CALLBACK,
 						routes.SIGN_IN_OAUTH_CALLBACK,
-						routes.DASH_IMPERSONATE_USER
+						routes.DASH_IMPERSONATE_USER,
+						routes.VERIFY_EMAIL,
+						routes.MAGIC_LINK_VERIFY,
+						routes.DASH_ACCEPT_INVITATION,
+						routes.DASH_COMPLETE_INVITATION_SOCIAL
 					]);
 				},
 				handler: createIdentificationMiddleware($kv)
@@ -8361,8 +8598,7 @@ const dash = (options) => {
 			after: [{
 				matcher: (ctx) => {
 					if (ctx.request?.method !== "GET") return true;
-					const path = new URL(ctx.request.url).pathname;
-					return matchesAnyRoute(path, [
+					return matchesAnyRoute(ctx.path, [
 						routes.SIGN_IN_SOCIAL_CALLBACK,
 						routes.SIGN_IN_OAUTH_CALLBACK,
 						routes.DASH_IMPERSONATE_USER
@@ -8371,11 +8607,11 @@ const dash = (options) => {
 				handler: createAuthMiddleware(async (_ctx) => {
 					const ctx = _ctx;
 					const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
-					if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx.context.location);
+					if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL, routes.DASH_SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx.context.location);
 					const body = ctx.body;
 					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger, ctx.context.location);
 					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger, ctx.context.location);
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK]) && ctx.request?.method === "GET" && ctx.context.returned instanceof Error && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger, ctx.context.location);
+					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]) && ctx.request?.method === "GET" && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger, ctx.context.location);
 					const headerRequestId = ctx.request?.headers.get("X-Request-Id");
 					if (headerRequestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
 						maxAge: 600,
@@ -8470,6 +8706,7 @@ const dash = (options) => {
 			dashSendManyVerificationEmails: sendManyVerificationEmails(settings),
 			dashSendResetPasswordEmail: sendResetPasswordEmail(settings),
 			dashEnableTwoFactor: enableTwoFactor(settings),
+			dashCompleteTwoFactorSetup: completeTwoFactorSetup(settings),
 			dashViewTwoFactorTotpUri: viewTwoFactorTotpUri(settings),
 			dashViewBackupCodes: viewBackupCodes(settings),
 			dashDisableTwoFactor: disableTwoFactor(settings),