@better-auth/infra 0.2.14 → 0.3.0

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CLYqEwMV.mjs";
-import { n as createKV, t as createAPI } from "./fetch-Bl0S3xUi.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-vBiGTmGf.mjs";
+import { a as createAPI, o as createKV, r as hmacSha256Hex } from "./crypto-DjtrPUlP.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAuthContext } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
@@ -78,7 +78,7 @@ const routes = {
 	SIGN_IN_SOCIAL: "/sign-in/social",
 	SIGN_IN_ANONYMOUS: "/sign-in/anonymous",
 	SIGN_IN_SOCIAL_CALLBACK: "/callback/:id",
-	SIGN_IN_OAUTH_CALLBACK: "/oauth2/callback/:id",
+	SIGN_IN_OAUTH_CALLBACK: "/oauth2/callback/:providerId",
 	SIGN_OUT: "/sign-out",
 	SIGN_UP: "/sign-up",
 	SIGN_UP_EMAIL: "/sign-up/email",
@@ -112,6 +112,8 @@ const routes = {
 	DASH_ACCEPT_INVITATION: "/dash/accept-invitation",
 	DASH_COMPLETE_INVITATION_SOCIAL: "/dash/complete-invitation-social",
 	DASH_UPDATE_USER: "/dash/update-user",
+	DASH_SET_PASSWORD: "/dash/set-password",
+	DASH_SEND_VERIFICATION_EMAIL: "/dash/send-verification-email",
 	DASH_REVOKE_SESSIONS_ALL: "/dash/sessions/revoke-all",
 	DASH_IMPERSONATE_USER: "/dash/impersonate-user",
 	DASH_BAN_USER: "/dash/ban-user",
@@ -284,7 +286,7 @@ const stripQuery = (value) => value.split("?")[0] || value;
 const escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 const routeToRegex = (route) => {
 	const pattern = escapeRegex(stripQuery(route)).replace(/\/:([^/]+)/g, "/[^/]+");
-	return new RegExp(`${pattern}(?:$|[/?])`);
+	return new RegExp(`^${pattern}(?:$|[/?])`);
 };
 const matchesAnyRoute = (path, routes) => {
 	if (!path) return false;
@@ -292,6 +294,14 @@ const matchesAnyRoute = (path, routes) => {
 	return routes.some((route) => routeToRegex(route).test(cleanPath));
 };
 //#endregion
+//#region src/events/oauth-callback-provider.ts
+/** Provider id from social (`/callback/:id`) or generic OAuth (`/oauth2/callback/:providerId`). */
+function getOAuthCallbackProviderId(ctx) {
+	const id = ctx.params?.id ?? ctx.params?.providerId;
+	if (typeof id !== "string" || !id || id.startsWith(":")) return;
+	return id;
+}
+//#endregion
 //#region src/events/login-methods.ts
 const OAUTH_CALLBACK_PATHS = [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK];
 const PATH_TO_METHOD = [
@@ -314,11 +324,7 @@ const PATH_TO_METHOD = [
 	[routes.SIWE_VERIFY, "siwe"]
 ];
 const getLoginMethod = (ctx) => {
-	if (matchesAnyRoute(ctx.path, OAUTH_CALLBACK_PATHS)) {
-		const id = ctx.params?.id;
-		if (typeof id === "string" && id && !id.startsWith(":")) return id;
-		return null;
-	}
+	if (matchesAnyRoute(ctx.path, OAUTH_CALLBACK_PATHS)) return getOAuthCallbackProviderId(ctx) ?? null;
 	for (const [path, method] of PATH_TO_METHOD) if (matchesAnyRoute(ctx.path, [path])) return method;
 	return null;
 };
@@ -585,7 +591,7 @@ const initSessionEvents = (tracker) => {
 				eventDisplayName: "User sign-in attempt failed",
 				eventData: {
 					userId: user?.id ?? "unknown",
-					nameName: user?.name ?? "unknown",
+					userName: user?.name ?? "unknown",
 					userEmail: ctx.body.email,
 					loginMethod: getLoginMethod(ctx),
 					triggeredBy: user?.id ?? trigger.triggeredBy,
@@ -626,7 +632,9 @@ const initSessionEvents = (tracker) => {
 		trackSocialSignInFailure(ctx, ctx.body.provider, trigger, location);
 	};
 	const trackSocialSignInRedirectionAttempt = (ctx, trigger, location) => {
-		trackSocialSignInFailure(ctx, tryDecode(ctx.params?.id), trigger, location);
+		const providerId = getOAuthCallbackProviderId(ctx);
+		if (!providerId) return;
+		trackSocialSignInFailure(ctx, tryDecode(providerId), trigger, location);
 	};
 	return {
 		trackUserSignedIn,
@@ -896,6 +904,27 @@ const initTrackEvents = ($api) => {
 	return { tracker: { trackEvent } };
 };
 //#endregion
+//#region ../utils/dist/ip.mjs
+/** Platform-set client IP headers (not accepted from clients on the open internet). */
+const DEFAULT_TRUSTED_IP_HEADERS = [
+	"cf-connecting-ip",
+	"true-client-ip",
+	"x-vercel-forwarded-for"
+];
+/**
+* Resolves client IP from request headers.
+* Defaults to platform-trusted headers only; set `ipAddressHeaders` for self-hosted proxies.
+*/
+function resolveClientIpFromHeaders(headers, ipAddressHeaders) {
+	const headerNames = ipAddressHeaders?.length ? ipAddressHeaders : [...DEFAULT_TRUSTED_IP_HEADERS];
+	for (const headerName of headerNames) {
+		const value = headers.get(headerName);
+		if (!value) continue;
+		const ip = value.split(",")[0]?.trim();
+		if (ip) return ip;
+	}
+}
+//#endregion
 //#region src/identification.ts
 /**
 * Identification Service
@@ -916,6 +945,20 @@ function cleanupCache() {
 function maybeCleanup() {
 	if (Date.now() - lastCleanup > CACHE_TTL_MS || identificationCache.size > CACHE_MAX_SIZE) cleanupCache();
 }
+/** Retries 404 races with exponential backoff (≤1s total wait across retries). */
+const IDENTIFY_GET_RETRY = {
+	type: "exponential",
+	attempts: 2,
+	baseDelay: 400,
+	maxDelay: 600,
+	shouldRetry(response) {
+		if (response === null) return true;
+		return response.status === 404;
+	}
+};
+function identifyGetRetryDelay(attempt) {
+	return Math.min(600, 400 * 2 ** attempt);
+}
 /**
 * Fetch identification data from durable-kv by requestId
 */
@@ -923,14 +966,11 @@ async function getIdentification(requestId, $kv) {
 	maybeCleanup();
 	const cached = identificationCache.get(requestId);
 	if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) return cached.data;
-	const maxRetries = 3;
-	const retryDelays = [
-		50,
-		100,
-		200
-	];
-	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
-		const { data, error } = await $kv(`/identify/${requestId}`, { method: "GET" });
+	for (let networkAttempt = 0;; networkAttempt++) try {
+		const { data, error } = await $kv(`/identify/${requestId}`, {
+			method: "GET",
+			retry: IDENTIFY_GET_RETRY
+		});
 		if (data && !error) {
 			identificationCache.set(requestId, {
 				data,
@@ -938,24 +978,18 @@ async function getIdentification(requestId, $kv) {
 			});
 			return data;
 		}
-		const status = error?.status;
-		if (status === 404 && attempt < maxRetries) {
-			await new Promise((resolve) => setTimeout(resolve, retryDelays[attempt]));
-			continue;
-		}
-		if (status !== 404) identificationCache.set(requestId, {
+		if (error?.status !== 404) identificationCache.set(requestId, {
 			data: null,
 			timestamp: Date.now()
 		});
 		return null;
 	} catch (error) {
-		if (attempt === maxRetries) {
+		if (networkAttempt >= IDENTIFY_GET_RETRY.attempts) {
 			logger.error("[Dash] Failed to fetch identification:", error);
 			return null;
 		}
-		await new Promise((resolve) => setTimeout(resolve, retryDelays[attempt] || 50));
+		await new Promise((resolve) => setTimeout(resolve, identifyGetRetryDelay(networkAttempt)));
 	}
-	return null;
 }
 /**
 * Extract identification headers from a request
@@ -1012,7 +1046,7 @@ function createIdentificationMiddleware($kv) {
 		ctx.context.visitorId = visitorId;
 		const ipConfig = ctx.context.options?.advanced?.ipAddress;
 		let location;
-		const requestIp = getClientIpFromRequest(ctx.request, ipConfig?.ipAddressHeaders || null);
+		const requestIp = ctx.request ? resolveClientIpFromHeaders(ctx.request.headers, ipConfig?.ipAddressHeaders || null) : void 0;
 		const requestCountryCode = getCountryCodeFromRequest(ctx.request);
 		if (ipConfig?.disableIpTracking === true) location = void 0;
 		else if (requestId && identification) {
@@ -1040,21 +1074,6 @@ function getLocation(identification) {
 	if (!identification) return null;
 	return identification.location;
 }
-function getClientIpFromRequest(request, ipAddressHeaders) {
-	if (!request) return void 0;
-	const headers = ipAddressHeaders?.length ? ipAddressHeaders : [
-		"cf-connecting-ip",
-		"x-forwarded-for",
-		"x-real-ip",
-		"x-vercel-forwarded-for"
-	];
-	for (const headerName of headers) {
-		const value = request.headers.get(headerName);
-		if (!value) continue;
-		const ip = value.split(",")[0]?.trim();
-		if (ip) return ip;
-	}
-}
 function getCountryCodeFromRequest(request) {
 	if (!request) return void 0;
 	const cc = request.headers.get("cf-ipcountry") ?? request.headers.get("x-vercel-ip-country");
@@ -1099,11 +1118,12 @@ function emitEvaluation(ctx, trackEvent, options = {}) {
 	ev.emitted = true;
 	const identification = ctx.context.identification ?? null;
 	const visitorId = ctx.context.visitorId ?? null;
+	const untrustedVisitorId = ctx.context.untrustedVisitorId ?? null;
 	const location = ctx.context.location;
 	const path = ctx.path ?? "";
 	const ipAddress = location?.ipAddress || identification?.ip || ctx.context.ip || void 0;
 	trackEvent({
-		eventKey: visitorId || ipAddress || "unknown",
+		eventKey: visitorId || ipAddress || untrustedVisitorId || "unknown",
 		eventType: "security_check",
 		eventDisplayName: ev.outcome === "blocked" ? "Security: blocked" : ev.outcome === "challenged" ? "Security: challenged" : "Security: passed",
 		eventData: {
@@ -1124,11 +1144,6 @@ function emitEvaluation(ctx, trackEvent, options = {}) {
 }
 //#endregion
 //#region src/sentinel/security.ts
-async function hashForFingerprint(input) {
-	const data = new TextEncoder().encode(input);
-	const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-	return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
 async function sha1Hash(input) {
 	const data = new TextEncoder().encode(input);
 	const hashBuffer = await crypto.subtle.digest("SHA-1", data);
@@ -1193,15 +1208,20 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				default: return "credential_stuffing";
 			}
 		},
-		async trackFailedAttempt(identifier, visitorId, password, ip) {
+		async trackFailedAttempt(identifier, visitorId, password, ip, requestId = null) {
 			try {
+				if (!conn.apiKey) {
+					logger.warn("[Sentinel] Missing apiKey; failed-login password fingerprint is skipped.");
+					return { blocked: false };
+				}
 				const data = await $api("/security/track-failed-login", {
 					method: "POST",
 					body: {
 						identifier,
 						visitorId,
-						passwordHash: await hashForFingerprint(password),
+						passwordHash: await hmacSha256Hex(conn.apiKey, password),
 						ip,
+						requestId,
 						config: options
 					}
 				});
@@ -1230,23 +1250,25 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				logger.error("[Dash] Clear failed attempts error:", error);
 			}
 		},
-		async isBlocked(visitorId, ip) {
+		async isBlocked(visitorId, ip, requestId = null) {
 			try {
 				const params = new URLSearchParams({ visitorId });
 				if (ip) params.set("ip", ip);
+				if (requestId) params.set("requestId", requestId);
 				return (await $api(`/security/is-blocked?${params.toString()}`, { method: "GET" })).blocked ?? false;
 			} catch (error) {
 				logger.warn("[Dash] Security is-blocked check failed:", error);
 				return false;
 			}
 		},
-		async verifyPoWSolution(visitorId, solution) {
+		async verifyPoWSolution(visitorId, solution, requestId = null) {
 			try {
 				return await $api("/security/pow/verify", {
 					method: "POST",
 					body: {
 						visitorId,
-						solution
+						solution,
+						requestId
 					}
 				});
 			} catch (error) {
@@ -1257,12 +1279,13 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				};
 			}
 		},
-		async generateChallenge(visitorId) {
+		async generateChallenge(visitorId, requestId = null) {
 			try {
 				return (await $api("/security/pow/generate", {
 					method: "POST",
 					body: {
 						visitorId,
+						requestId,
 						difficulty: options.challengeDifficulty
 					}
 				})).challenge || "";
@@ -1271,7 +1294,7 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				return "";
 			}
 		},
-		async checkImpossibleTravel(userId, currentLocation, visitorId, ip = null, powSolution) {
+		async checkImpossibleTravel(userId, currentLocation, visitorId, ip = null, powSolution, requestId = null) {
 			if (!options.impossibleTravel?.enabled || !currentLocation) return null;
 			try {
 				const data = await $api("/security/impossible-travel", {
@@ -1279,6 +1302,7 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 					body: {
 						userId,
 						visitorId,
+						requestId,
 						location: currentLocation,
 						ip,
 						config: options,
@@ -1328,20 +1352,23 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 			}
 		},
 		/**
-		* Check if a visitor has exceeded the free trial signup limit.
+		* Atomically reserve a signup slot before user creation.
 		*/
-		async checkFreeTrialAbuse(visitorId) {
+		async reserveFreeTrialSignup(visitorId, reservationId, requestId = null) {
 			if (!options.freeTrialAbuse?.enabled) return {
+				reserved: true,
 				isAbuse: false,
 				accountCount: 0,
 				maxAccounts: 0,
 				action: "log"
 			};
 			try {
-				const data = await $api("/security/free-trial-abuse/check", {
+				const data = await $api("/security/free-trial-abuse/reserve", {
 					method: "POST",
 					body: {
 						visitorId,
+						reservationId,
+						requestId,
 						config: options
 					}
 				});
@@ -1359,8 +1386,9 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				});
 				return data;
 			} catch (error) {
-				logger.warn("[Dash] Free trial abuse check failed:", error);
+				logger.warn("[Dash] Free trial abuse reserve failed:", error);
 				return {
+					reserved: true,
 					isAbuse: false,
 					accountCount: 0,
 					maxAccounts: 0,
@@ -1369,21 +1397,22 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 			}
 		},
 		/**
-		* Track a new signup for free trial abuse detection.
-		* Stores the userId for auditing purposes.
+		* Confirm a reserved signup slot with the created user id.
 		*/
-		async trackFreeTrialSignup(visitorId, userId) {
+		async confirmFreeTrialSignup(visitorId, reservationId, userId, requestId = null) {
 			if (!options.freeTrialAbuse?.enabled) return;
 			try {
-				await $api("/security/free-trial-abuse/track", {
+				await $api("/security/free-trial-abuse/confirm", {
 					method: "POST",
 					body: {
 						visitorId,
-						userId
+						reservationId,
+						userId,
+						requestId
 					}
 				});
 			} catch (error) {
-				logger.error("[Dash] Track free trial signup error:", error);
+				logger.error("[Dash] Confirm free trial signup error:", error);
 			}
 		},
 		async checkCompromisedPassword(password) {
@@ -2093,7 +2122,7 @@ async function handleSecurityVerdict(verdict, hookCtx, checkCtx, trackEvent, sec
 	if (verdict.action === "allow") return;
 	const reason = verdict.reason || "unknown";
 	if (verdict.action === "challenge" && checkCtx.visitorId) {
-		const challenge = verdict.challenge || await securityService.generateChallenge(checkCtx.visitorId);
+		const challenge = verdict.challenge || await securityService.generateChallenge(checkCtx.visitorId, checkCtx.identification?.requestId ?? null);
 		if (!challenge?.trim()) {
 			logger.warn("[Sentinel] Could not generate PoW challenge (service may be unavailable). Falling back to allow.");
 			return;
@@ -2128,7 +2157,7 @@ async function runSecurityChecks(hookCtx, checkCtx, securityService, trackEvent,
 	recordCheck(hookCtx, "server_security_check");
 	await handleSecurityVerdict(await securityService.checkSecurity({
 		visitorId: checkCtx.visitorId,
-		requestId: checkCtx.identification?.requestId || null,
+		requestId: checkCtx.identification?.requestId ?? checkCtx.requestId ?? null,
 		ip: checkCtx.ip,
 		path: checkCtx.path,
 		identifier: checkCtx.identifier,
@@ -2183,9 +2212,17 @@ const sentinel = (options) => {
 							async before(user, ctx) {
 								if (!ctx) return;
 								const visitorId = ctx.context.visitorId;
-								if (visitorId && opts.security?.freeTrialAbuse?.enabled) {
+								if (opts.security?.freeTrialAbuse?.enabled) {
+									if (!visitorId) {
+										recordCheck(ctx, "free_trial_abuse");
+										setOutcome(ctx, "blocked", "free_trial_abuse", { reason: "identification_required" });
+										emitEvaluation(ctx, trackEvent);
+										throw new APIError("FORBIDDEN", { message: "Account creation is not allowed without device identification." });
+									}
 									recordCheck(ctx, "free_trial_abuse");
-									const abuseCheck = await securityService.checkFreeTrialAbuse(visitorId);
+									const reservationId = crypto.randomUUID();
+									ctx.context.freeTrialReservationId = reservationId;
+									const abuseCheck = await securityService.reserveFreeTrialSignup(visitorId, reservationId, ctx.context.requestId ?? null);
 									if (abuseCheck.isAbuse && abuseCheck.action === "block") {
 										setOutcome(ctx, "blocked", "free_trial_abuse", {
 											accountCount: abuseCheck.accountCount,
@@ -2203,7 +2240,8 @@ const sentinel = (options) => {
 							async after(user, ctx) {
 								if (!ctx) return;
 								const visitorId = ctx.context.visitorId;
-								if (visitorId && opts.security?.freeTrialAbuse?.enabled) await ctx.context.runInBackgroundOrAwait(securityService.trackFreeTrialSignup(visitorId, user.id));
+								const reservationId = ctx.context.freeTrialReservationId;
+								if (visitorId && reservationId && opts.security?.freeTrialAbuse?.enabled) await ctx.context.runInBackgroundOrAwait(securityService.confirmFreeTrialSignup(visitorId, reservationId, user.id, ctx.context.requestId ?? null));
 							}
 						},
 						update: { async before(user, ctx) {
@@ -2222,7 +2260,7 @@ const sentinel = (options) => {
 							if (session.userId && identification?.location && visitorId) {
 								recordCheck(ctx, "impossible_travel");
 								const powSolution = ctx.headers?.get?.("X-PoW-Solution") ?? null;
-								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId, identification.ip, powSolution);
+								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId, identification.ip, powSolution, identification.requestId);
 								if (travelCheck?.powVerified) recordCheck(ctx, "pow_challenge");
 								if (travelCheck?.isImpossible) {
 									if (travelCheck.action === "block") {
@@ -2333,7 +2371,11 @@ const sentinel = (options) => {
 							routes.SIGN_IN_ANONYMOUS
 						]);
 						const isSignUp = matchesAnyRoute(ctx.path, [routes.SIGN_UP_EMAIL]);
-						const isPasswordReset = matchesAnyRoute(ctx.path, [routes.FORGET_PASSWORD, routes.REQUEST_PASSWORD_RESET]);
+						const isPasswordReset = matchesAnyRoute(ctx.path, [
+							routes.FORGET_PASSWORD,
+							routes.REQUEST_PASSWORD_RESET,
+							routes.RESET_PASSWORD
+						]);
 						const isTwoFactor = matchesAnyRoute(ctx.path, [
 							routes.TWO_FACTOR_VERIFY_TOTP,
 							routes.TWO_FACTOR_VERIFY_BACKUP,
@@ -2355,7 +2397,7 @@ const sentinel = (options) => {
 						const powSolution = ctx.headers?.get?.("X-PoW-Solution");
 						if (visitorId || ip) {
 							recordCheck(ctx, "credential_stuffing");
-							if (await securityService.isBlocked(visitorId ?? "", ip)) {
+							if (await securityService.isBlocked(visitorId ?? "", ip, ctx.context.requestId ?? null)) {
 								setOutcome(ctx, "blocked", "credential_stuffing", {
 									phase: "cooldown_active",
 									visitorId: ctx.context.untrustedVisitorId ?? void 0,
@@ -2372,6 +2414,7 @@ const sentinel = (options) => {
 							path: ctx.path,
 							identifier,
 							visitorId,
+							requestId: ctx.context.requestId ?? null,
 							identification,
 							ip: ctx.context.ip,
 							userAgent: ctx.headers?.get?.("user-agent") || ""
@@ -2421,7 +2464,7 @@ const sentinel = (options) => {
 						identifier: loginId,
 						userAgent: ctx.headers?.get?.("user-agent") || ""
 					});
-					if (isPasswordSignInRoute && ctx.context.returned instanceof Error && loginId && body?.password && untrustedVisitorId) await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(loginId, untrustedVisitorId, body.password, ip));
+					if (isPasswordSignInRoute && ctx.context.returned instanceof Error && loginId && body?.password && untrustedVisitorId) await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(loginId, untrustedVisitorId, body.password, ip, ctx.context.requestId ?? null));
 					if (isPasswordSignInRoute && !(ctx.context.returned instanceof Error) && loginId) await ctx.context.runInBackgroundOrAwait(securityService.clearFailedAttempts(loginId));
 				})
 			}]
@@ -2783,6 +2826,129 @@ const initTeamEvents = (tracker) => {
 	};
 };
 //#endregion
+//#region ../utils/dist/redact.mjs
+const EXACT_SENSITIVE_STRING_KEYS_LOWER = new Set([...new Set([
+	"accessToken",
+	"apiKey",
+	"apiSecret",
+	"authorization",
+	"authToken",
+	"bearerToken",
+	"backupCodes",
+	"clientSecret",
+	"consumerSecret",
+	"credentialID",
+	"deviceCode",
+	"encPrivateKey",
+	"encPrivateKeyPass",
+	"encryptionKey",
+	"encryptionSecret",
+	"forwardHeaders",
+	"idToken",
+	"oidcConfig",
+	"pass",
+	"passwd",
+	"password",
+	"privateKey",
+	"privateKeyPass",
+	"pwd",
+	"refreshToken",
+	"samlConfig",
+	"secret",
+	"secretAccessKey",
+	"secretKey",
+	"signingSecret",
+	"stripeWebhookSecret",
+	"userCode",
+	"webhookSecret"
+])].map((k) => k.toLowerCase()));
+/**
+* Case-insensitive suffixes for unknown property names.
+*/
+const SENSITIVE_KEY_SUFFIXES_LOWER = [
+	"accesskey",
+	"secret",
+	"password",
+	"passphrase",
+	"privatekey",
+	"keypass",
+	"apikey",
+	"token",
+	"signingkey",
+	"credentials",
+	"authheader"
+];
+/**
+* Embedded secret substrings checked against the normalized (compact, lowercased) key.
+*/
+const SENSITIVE_KEY_SUBSTRINGS_LOWER = ["secretaccess", "accesskeysecret"];
+const REDACTED_SIMPLE_STRING = "[REDACTED]";
+function snakeCaseToCamelCase(key) {
+	return key.replace(/_([a-zA-Z])/g, (_, ch) => ch.toUpperCase());
+}
+function keyVariantsForMatching(key) {
+	const trimmed = key.replace(/^[\s._-]+/, "");
+	if (!trimmed) return [key];
+	const out = new Set([key, trimmed]);
+	if (trimmed.includes("_")) out.add(snakeCaseToCamelCase(trimmed));
+	return [...out];
+}
+/** Whether a property name should have string values redacted in `redact()`. */
+function isSensitiveStringKey(key) {
+	const variants = keyVariantsForMatching(key);
+	const compactLower = key.replace(/[\s._-]/g, "").toLowerCase();
+	const forms = new Set([compactLower]);
+	for (const raw of variants) {
+		forms.add(raw);
+		forms.add(raw.toLowerCase());
+	}
+	for (const form of forms) {
+		const fl = form.toLowerCase();
+		if (EXACT_SENSITIVE_STRING_KEYS_LOWER.has(fl)) return true;
+		for (const suffix of SENSITIVE_KEY_SUFFIXES_LOWER) if (fl.endsWith(suffix)) return true;
+		for (const substring of SENSITIVE_KEY_SUBSTRINGS_LOWER) if (compactLower.includes(substring)) return true;
+	}
+	return false;
+}
+function isPlainSerializable(value) {
+	if (value === null || typeof value !== "object") return true;
+	if (Array.isArray(value)) return true;
+	if (value instanceof Date) return true;
+	const constructor = Object.getPrototypeOf(value)?.constructor;
+	if (constructor && constructor.name !== "Object" && constructor.name !== "Array") return false;
+	return true;
+}
+function redactInner(value, visiting, options) {
+	if (value === null || value === void 0) return value;
+	if (typeof value === "function") return void 0;
+	if (typeof value !== "object") return value;
+	const obj = value;
+	if (visiting.has(obj)) return void 0;
+	visiting.add(obj);
+	try {
+		if (Array.isArray(value)) return value.map((item) => redactInner(item, visiting, options)).filter((item) => item !== void 0);
+		const result = {};
+		for (const [key, val] of Object.entries(value)) {
+			if (options?.excludeKeys?.has(key)) continue;
+			if (typeof val === "function") continue;
+			if (typeof val === "string" && isSensitiveStringKey(key)) {
+				result[key] = REDACTED_SIMPLE_STRING;
+				continue;
+			}
+			if (options?.skipNonPlainSerializable && val !== null && typeof val === "object" && !isPlainSerializable(val)) continue;
+			const redacted = redactInner(val, visiting, options);
+			if (redacted !== void 0) result[key] = redacted;
+		}
+		return result;
+	} finally {
+		visiting.delete(obj);
+	}
+}
+/** Recursively redact sensitive string values in a JSON-like object tree. */
+function redact(value, options) {
+	return redactInner(value, /* @__PURE__ */ new WeakSet(), options);
+}
+//#endregion
 //#region ../utils/dist/crypto/index.mjs
 /**
 * One-way hash for storage and lookup. Returns hex-encoded digest.
@@ -2949,114 +3115,16 @@ const jwtValidateMiddleware = (options) => {
 	});
 };
 //#endregion
-//#region src/routes/auth/config.ts
+//#region src/lib/redact-plugin-options.ts
 const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
-const EXACT_SENSITIVE_STRING_KEYS_LOWER = new Set([...new Set([
-	"accessToken",
-	"apiKey",
-	"apiSecret",
-	"authorization",
-	"authToken",
-	"bearerToken",
-	"clientSecret",
-	"consumerSecret",
-	"encPrivateKey",
-	"encPrivateKeyPass",
-	"encryptionKey",
-	"encryptionSecret",
-	"idToken",
-	"password",
-	"privateKey",
-	"privateKeyPass",
-	"refreshToken",
-	"secret",
-	"secretKey",
-	"signingSecret",
-	"stripeWebhookSecret",
-	"webhookSecret"
-])].map((k) => k.toLowerCase()));
-/**
-* Case-insensitive suffixes for unknown plugin options
-* Matching is more permissive to account for unknown plugin options
-*/
-const SENSITIVE_KEY_SUFFIXES_LOWER = [
-	"secret",
-	"password",
-	"passphrase",
-	"privatekey",
-	"keypass",
-	"apikey",
-	"token",
-	"signingkey",
-	"credentials",
-	"authheader"
-];
-const REDACTED_SIMPLE_STRING = "[REDACTED]";
-function snakeCaseToCamelCase(key) {
-	return key.replace(/_([a-zA-Z])/g, (_, ch) => ch.toUpperCase());
-}
-function keyVariantsForMatching(key) {
-	const trimmed = key.replace(/^[\s._-]+/, "");
-	if (!trimmed) return [key];
-	const out = new Set([key, trimmed]);
-	if (trimmed.includes("_")) out.add(snakeCaseToCamelCase(trimmed));
-	return [...out];
-}
-function shouldRedactSensitiveStringKey(key) {
-	const variants = keyVariantsForMatching(key);
-	const compactLower = key.replace(/[\s._-]/g, "").toLowerCase();
-	const forms = new Set([compactLower]);
-	for (const raw of variants) {
-		forms.add(raw);
-		forms.add(raw.toLowerCase());
-	}
-	for (const form of forms) {
-		const fl = form.toLowerCase();
-		if (EXACT_SENSITIVE_STRING_KEYS_LOWER.has(fl)) return true;
-		for (const suffix of SENSITIVE_KEY_SUFFIXES_LOWER) if (fl.endsWith(suffix)) return true;
-	}
-	return false;
-}
-function isPlainSerializable(value) {
-	if (value === null || typeof value !== "object") return true;
-	if (Array.isArray(value)) return true;
-	if (value instanceof Date) return true;
-	const constructor = Object.getPrototypeOf(value)?.constructor;
-	if (constructor && constructor.name !== "Object" && constructor.name !== "Array") return false;
-	return true;
-}
-/**
-* Sanitize any plain JSON-like subtree from Better Auth options
-*/
-function sanitizeConfig(value, visiting, excludeKeys) {
-	if (value === null || value === void 0) return value;
-	if (typeof value === "function") return void 0;
-	if (typeof value !== "object") return value;
-	const obj = value;
-	if (visiting.has(obj)) return void 0;
-	visiting.add(obj);
-	try {
-		if (Array.isArray(value)) return value.map((item) => sanitizeConfig(item, visiting, excludeKeys)).filter((item) => item !== void 0);
-		const result = {};
-		for (const [key, val] of Object.entries(value)) {
-			if (excludeKeys?.has(key)) continue;
-			if (typeof val === "function") continue;
-			if (typeof val === "string" && shouldRedactSensitiveStringKey(key)) {
-				result[key] = REDACTED_SIMPLE_STRING;
-				continue;
-			}
-			if (val !== null && typeof val === "object" && !isPlainSerializable(val)) continue;
-			const sanitized = sanitizeConfig(val, visiting, excludeKeys);
-			if (sanitized !== void 0) result[key] = sanitized;
-		}
-		return result;
-	} finally {
-		visiting.delete(obj);
-	}
-}
-function sanitizePluginOptions(pluginId, options) {
-	return sanitizeConfig(options, /* @__PURE__ */ new WeakSet(), PLUGIN_OPTIONS_EXCLUDE_KEYS[pluginId]);
+function redactPluginOptions(pluginId, options, optionsConfig) {
+	return redact(options, {
+		...optionsConfig,
+		excludeKeys: PLUGIN_OPTIONS_EXCLUDE_KEYS[pluginId]
+	});
 }
+//#endregion
+//#region src/routes/auth/config.ts
 function estimateEntropy(str) {
 	const unique = new Set(str).size;
 	if (unique === 0) return 0;
@@ -3072,13 +3140,13 @@ const getConfig = (options) => {
 		return {
 			version: ctx.context.version || null,
 			socialProviders: Object.keys(ctx.context.options.socialProviders || {}),
-			emailAndPassword: sanitizeConfig(ctx.context.options.emailAndPassword, /* @__PURE__ */ new WeakSet(), void 0),
+			emailAndPassword: redact(ctx.context.options.emailAndPassword, { skipNonPlainSerializable: true }),
 			plugins: ctx.context.options.plugins?.map((plugin) => {
 				const base = {
 					id: plugin.id,
 					schema: plugin.schema,
 					version: plugin.version,
-					options: sanitizePluginOptions(plugin.id, plugin.options)
+					options: redactPluginOptions(plugin.id, plugin.options, { skipNonPlainSerializable: true })
 				};
 				if (plugin.id === "dash" && !plugin.version) return {
 					...base,
@@ -3200,6 +3268,31 @@ const getValidate = (options) => {
 	});
 };
 //#endregion
+//#region src/semver.ts
+function parseVersion(version) {
+	if (!version) return null;
+	const match = version.trim().match(/^(\d+)\.(\d+)\.(\d+)/);
+	if (!match) return null;
+	return [
+		Number(match[1]),
+		Number(match[2]),
+		Number(match[3])
+	];
+}
+/** Compare semver strings (e.g. "1.7.0-beta.8" against "1.7" or "1.7.0"). */
+function isVersionAtLeast(version, target) {
+	const parsed = parseVersion(version);
+	if (!parsed) return false;
+	const targetParts = target.split(".").map(Number);
+	const major = targetParts[0] ?? 0;
+	const minor = targetParts[1] ?? 0;
+	const patch = targetParts[2] ?? 0;
+	const [vMajor, vMinor, vPatch] = parsed;
+	if (vMajor !== major) return vMajor > major;
+	if (vMinor !== minor) return vMinor > minor;
+	return vPatch >= patch;
+}
+//#endregion
 //#region src/routes/organization-guards.ts
 /** Returns true if organization plugin is enabled. */
 function isOrganizationEnabled(ctx) {
@@ -3261,6 +3354,11 @@ function getScimEndpoint(baseUrl) {
 function getSCIMPlugin(ctx) {
 	return ctx.context.getPlugin("scim");
 }
+function isScimDirectorySyncEnabled(scimPlugin, authVersion) {
+	if (!scimPlugin) return false;
+	if (isVersionAtLeast(authVersion, "1.7.0")) return true;
+	return scimPlugin.options?.providerOwnership?.enabled === true;
+}
 const DIRECTORY_SYNC_DUPLICATE_MESSAGE = "A directory sync connection with this provider ID already exists. Remove the existing connection or choose a different provider ID.";
 function isDuplicateDirectorySyncError(e) {
 	if (e instanceof APIError$1) return e.status === "CONFLICT" || /duplicate|already exists|unique constraint/i.test(e.message ?? "");
@@ -3278,7 +3376,7 @@ const listOrganizationDirectories = (options) => {
 		}
 		const organizationId = tryDecode(ctx.params.id);
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.listSCIMProviderConnections || !scimPlugin?.options?.providerOwnership?.enabled) {
+		if (!scimPlugin?.endpoints.listSCIMProviderConnections || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) {
 			ctx.context.logger.warn("[Dash] SCIM plugin not available or provider ownership disabled, returning empty directories list", { organizationId });
 			return [];
 		}
@@ -3315,7 +3413,7 @@ const createOrganizationDirectory = (options) => {
 		requireOrganizationPlugin(ctx);
 		const { organizationId } = ctx.context.payload;
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.generateSCIMToken || !scimPlugin?.options?.providerOwnership?.enabled) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
+		if (!scimPlugin?.endpoints.generateSCIMToken || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { providerId, ownerUserId } = ctx.body;
 		let scimToken;
 		try {
@@ -3350,7 +3448,7 @@ const deleteOrganizationDirectory = (options) => {
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.deleteSCIMProviderConnection || !scimPlugin?.options?.providerOwnership?.enabled) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
+		if (!scimPlugin?.endpoints.deleteSCIMProviderConnection || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { organizationId } = ctx.context.payload;
 		const { providerId } = ctx.body;
 		const ownerUserId = await getScimProviderOwner(ctx, organizationId, providerId);
@@ -3371,7 +3469,7 @@ const regenerateDirectoryToken = (options) => {
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.generateSCIMToken || !scimPlugin?.options?.providerOwnership?.enabled) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
+		if (!scimPlugin?.endpoints.generateSCIMToken || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { organizationId } = ctx.context.payload;
 		const { providerId } = ctx.body;
 		const ownerUserId = await getScimProviderOwner(ctx, organizationId, providerId);
@@ -3788,6 +3886,36 @@ const executeAdapter = (options) => {
 	});
 };
 //#endregion
+//#region src/lib/invitation-auth-mode.ts
+/** Route new users through the platform /invite/accept flow. */
+function usesPlatformInviteAcceptFlow(authMode) {
+	return authMode === "auth" || authMode === "credential_setup" || authMode === "create_with_session" || authMode === "create_no_session";
+}
+/** Whether complete-invitation should mint a session cookie. */
+function shouldCreateSessionOnInviteComplete(authMode) {
+	return authMode !== "create_no_session";
+}
+//#endregion
+//#region src/lib/safe-url.ts
+function isSafeHttpUrl(value) {
+	try {
+		const url = new URL(value);
+		return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "";
+	} catch {
+		return false;
+	}
+}
+/** http(s) absolute URL without embedded credentials. */
+const safeUrlSchema = z$1.string().trim().min(1).pipe(z$1.url().refine(isSafeHttpUrl, { message: "URL must be a valid http(s) URL without credentials" })).transform((value) => new URL(value).href);
+const optionalSafeUrlSchema = z$1.union([safeUrlSchema, z$1.literal("")]).optional();
+/** Validates http(s) redirect targets at use time; falls back when invalid. */
+function resolveSafeRedirectUrl(raw, fallback) {
+	if (raw == null || raw.trim() === "") return fallback;
+	const parsed = safeUrlSchema.safeParse(raw);
+	if (!parsed.success) return fallback;
+	return parsed.data;
+}
+//#endregion
 //#region src/routes/invitations/index.ts
 async function verifyPendingInvitation(token, $api, ctx) {
 	const { data: invitation, error } = await $api("/api/internal/invitations/verify", {
@@ -3814,6 +3942,9 @@ async function verifyPendingInvitation(token, $api, ctx) {
 function getFallbackRedirect(ctx) {
 	return typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : "/";
 }
+function resolveInvitationRedirect(ctx, raw) {
+	return resolveSafeRedirectUrl(raw, getFallbackRedirect(ctx));
+}
 /**
 * Accept invitation endpoint
 * This is called when a user clicks the invitation link.
@@ -3838,14 +3969,14 @@ const acceptInvitation = (options) => {
 				}
 			});
 			if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted (existing user)", markError);
-			await setSessionCookie(ctx, {
+			if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
 				session: await ctx.context.internalAdapter.createSession(existingUser.id),
 				user: existingUser
 			});
-			const redirectUrl = invitation.redirectUrl || ctx.context.options.baseURL || "/";
-			return ctx.redirect(redirectUrl.toString());
+			const redirectUrl = resolveInvitationRedirect(ctx, invitation.redirectUrl);
+			return ctx.redirect(redirectUrl);
 		}
-		if (invitation.authMode === "auth") {
+		if (usesPlatformInviteAcceptFlow(invitation.authMode)) {
 			const platformUrl = options.apiUrl || INFRA_API_URL;
 			const acceptPageUrl = new URL("/invite/accept", platformUrl);
 			acceptPageUrl.searchParams.set("token", token);
@@ -3853,13 +3984,15 @@ const acceptInvitation = (options) => {
 			acceptPageUrl.searchParams.set("callback", callbackUrl);
 			return ctx.redirect(acceptPageUrl.toString());
 		}
-		const user = await ctx.context.internalAdapter.createUser({
+		const userPayload = {
 			email: invitationEmail,
 			name: invitation.name || invitation.email.split("@")[0] || "",
 			emailVerified: true,
 			createdAt: /* @__PURE__ */ new Date(),
 			updatedAt: /* @__PURE__ */ new Date()
-		});
+		};
+		const adapter = ctx.context.internalAdapter;
+		const user = isVersionAtLeast(ctx.context.version, "1.7.0") ? await adapter.createUser(userPayload, { method: "admin" }) : await adapter.createUser(userPayload);
 		const { error: markError } = await $api("/api/internal/invitations/mark-accepted", {
 			method: "POST",
 			body: {
@@ -3868,12 +4001,12 @@ const acceptInvitation = (options) => {
 			}
 		});
 		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-		await setSessionCookie(ctx, {
+		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
 			session: await ctx.context.internalAdapter.createSession(user.id),
 			user
 		});
-		const redirectUrl = invitation.redirectUrl || ctx.context.options.baseURL || "/";
-		return ctx.redirect(redirectUrl.toString());
+		const redirectUrl = resolveInvitationRedirect(ctx, invitation.redirectUrl);
+		return ctx.redirect(redirectUrl);
 	});
 };
 /**
@@ -3891,7 +4024,6 @@ const completeInvitation = (options) => {
 		})
 	}, async (ctx) => {
 		const { token, password } = ctx.body;
-		const fallbackRedirect = getFallbackRedirect(ctx);
 		const invitation = await verifyPendingInvitation(token, $api, ctx);
 		if (!ctx.context) throw new APIError("BAD_REQUEST", { message: "Context is required" });
 		const invitationEmail = normalizeEmail(invitation.email, ctx.context);
@@ -3905,23 +4037,25 @@ const completeInvitation = (options) => {
 				}
 			});
 			if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-			await setSessionCookie(ctx, {
+			if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
 				session: await ctx.context.internalAdapter.createSession(existingUser.id),
 				user: existingUser
 			});
 			return {
 				success: true,
-				redirectUrl: invitation.redirectUrl ?? fallbackRedirect
+				redirectUrl: resolveInvitationRedirect(ctx, invitation.redirectUrl)
 			};
 		}
 		if (!password) throw new APIError("BAD_REQUEST", { message: "Password is required to complete this invitation." });
-		const user = await ctx.context.internalAdapter.createUser({
+		const userPayload = {
 			email: invitationEmail,
 			name: invitation.name || invitation.email.split("@")[0] || "",
 			emailVerified: true,
 			createdAt: /* @__PURE__ */ new Date(),
 			updatedAt: /* @__PURE__ */ new Date()
-		});
+		};
+		const adapter = ctx.context.internalAdapter;
+		const user = isVersionAtLeast(ctx.context.version, "1.7.0") ? await adapter.createUser(userPayload, { method: "admin" }) : await adapter.createUser(userPayload);
 		await ctx.context.internalAdapter.createAccount({
 			userId: user.id,
 			providerId: "credential",
@@ -3936,13 +4070,13 @@ const completeInvitation = (options) => {
 			}
 		});
 		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-		await setSessionCookie(ctx, {
+		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
 			session: await ctx.context.internalAdapter.createSession(user.id),
 			user
 		});
 		return {
 			success: true,
-			redirectUrl: invitation.redirectUrl ?? fallbackRedirect
+			redirectUrl: resolveInvitationRedirect(ctx, invitation.redirectUrl)
 		};
 	});
 };
@@ -3967,7 +4101,7 @@ const completeInvitationSocial = (options) => {
 			}
 		});
 		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-		return ctx.redirect((invitation.redirectUrl || getFallbackRedirect(ctx)).toString());
+		return ctx.redirect(resolveInvitationRedirect(ctx, invitation.redirectUrl));
 	});
 };
 /**
@@ -4149,11 +4283,15 @@ const cancelInvitation = (options) => {
 	}, async (ctx) => {
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
 		const { invitationId, organizationId } = ctx.context.payload;
+		if (ctx.body.invitationId !== invitationId) throw ctx.error("BAD_REQUEST", { message: "Invitation ID mismatch" });
 		const invitation = await ctx.context.adapter.findOne({
 			model: "invitation",
 			where: [{
 				field: "id",
 				value: invitationId
+			}, {
+				field: "organizationId",
+				value: organizationId
 			}]
 		});
 		if (!invitation) throw ctx.error("NOT_FOUND", { message: "Invitation not found" });
@@ -4182,6 +4320,9 @@ const cancelInvitation = (options) => {
 			where: [{
 				field: "id",
 				value: invitationId
+			}, {
+				field: "organizationId",
+				value: organizationId
 			}],
 			update: { status: "canceled" }
 		});
@@ -4207,11 +4348,15 @@ const resendInvitation = (options) => {
 	}, async (ctx) => {
 		const organizationPlugin = requireOrganizationPlugin(ctx);
 		const { invitationId, organizationId } = ctx.context.payload;
+		if (ctx.body.invitationId !== invitationId) throw ctx.error("BAD_REQUEST", { message: "Invitation ID mismatch" });
 		const invitation = await ctx.context.adapter.findOne({
 			model: "invitation",
 			where: [{
 				field: "id",
 				value: invitationId
+			}, {
+				field: "organizationId",
+				value: organizationId
 			}]
 		});
 		if (!invitation) throw ctx.error("NOT_FOUND", { message: "Invitation not found" });
@@ -4611,6 +4756,8 @@ async function withConcurrency(items, fn, options) {
 	if (executing.length > 0) await run();
 	return results;
 }
+/** Zod schema for validating organization/project slug format. */
+const slugSchema = z.string().min(1, "Slug is required").regex(/^[a-z0-9-]+$/, "Slug can only contain lowercase letters, numbers, and hyphens");
 //#endregion
 //#region src/routes/organizations/schemas.ts
 const DENIED_ORG_WRITE_KEYS = new Set([
@@ -4619,13 +4766,13 @@ const DENIED_ORG_WRITE_KEYS = new Set([
 	"updatedAt"
 ]);
 const CREATE_NON_PERSISTED_KEYS = new Set(["defaultTeamName"]);
-const CREATE_REQUEST_ONLY_KEYS = new Set(["userId", "skipDefaultTeam"]);
-const CORE_CREATE_KEYS = [
+const CREATE_REQUEST_ONLY_KEYS$1 = new Set(["userId", "skipDefaultTeam"]);
+const CORE_CREATE_KEYS$1 = [
 	"name",
 	"slug",
 	"logo"
 ];
-const CORE_UPDATE_KEYS = [
+const CORE_UPDATE_KEYS$1 = [
 	"name",
 	"slug",
 	"logo",
@@ -4641,7 +4788,7 @@ function getWritableOrganizationAdditionalFieldNames(orgOptions) {
 	}).map(([name]) => name);
 }
 function getWritableOrganizationFieldNames(orgOptions, mode) {
-	const keys = new Set(mode === "create" ? CORE_CREATE_KEYS : CORE_UPDATE_KEYS);
+	const keys = new Set(mode === "create" ? CORE_CREATE_KEYS$1 : CORE_UPDATE_KEYS$1);
 	for (const name of getWritableOrganizationAdditionalFieldNames(orgOptions)) keys.add(name);
 	return keys;
 }
@@ -4654,7 +4801,7 @@ function pickWritableOrganizationFields(body, orgOptions, mode) {
 	const skip = new Set([
 		...DENIED_ORG_WRITE_KEYS,
 		...mode === "create" ? CREATE_NON_PERSISTED_KEYS : [],
-		...mode === "create" ? CREATE_REQUEST_ONLY_KEYS : []
+		...mode === "create" ? CREATE_REQUEST_ONLY_KEYS$1 : []
 	]);
 	const result = {};
 	for (const [key, value] of Object.entries(body)) {
@@ -4665,19 +4812,19 @@ function pickWritableOrganizationFields(body, orgOptions, mode) {
 }
 const BaseCreateOrgCoreBodySchema = z$1.object({
 	name: z$1.string(),
-	slug: z$1.string(),
+	slug: slugSchema,
 	logo: z$1.string().optional(),
 	defaultTeamName: z$1.string().optional()
 });
 const BaseUpdateOrgCoreBodySchema = z$1.object({
-	logo: z$1.union([z$1.url(), z$1.literal("")]).optional(),
+	logo: optionalSafeUrlSchema,
 	name: z$1.string().optional(),
-	slug: z$1.string().optional(),
+	slug: slugSchema.optional(),
 	metadata: z$1.string().optional()
 });
 const CreateOrganizationBodySchema = BaseCreateOrgCoreBodySchema.catchall(z$1.unknown());
 const UpdateOrganizationBodySchema = BaseUpdateOrgCoreBodySchema.catchall(z$1.unknown());
-function createSchemaForDBField(field) {
+function createSchemaForDBField$1(field) {
 	switch (field.type) {
 		case "number": return field.required ? z$1.coerce.number() : z$1.coerce.number().optional();
 		case "boolean": return field.required ? z$1.coerce.boolean() : z$1.coerce.boolean().optional();
@@ -4692,13 +4839,13 @@ function createSchemaForDBField(field) {
 function validateWritableCreateOrganizationFields(data, options) {
 	const shape = {
 		name: z$1.string().min(1),
-		slug: z$1.string().min(1),
+		slug: slugSchema,
 		logo: z$1.string().optional()
 	};
 	const additional = getOrganizationAdditionalFields(options);
 	for (const [name, field] of Object.entries(additional)) {
 		if (field.input === false) continue;
-		shape[name] = createSchemaForDBField(field);
+		shape[name] = createSchemaForDBField$1(field);
 	}
 	const result = z$1.object(shape).strict().safeParse(data);
 	if (!result.success) throw result.error;
@@ -4714,14 +4861,14 @@ function validateWritableOrganizationUpdateFields(data, orgOptions) {
 	}]);
 	const shape = {
 		name: z$1.string().min(1).optional(),
-		slug: z$1.string().min(1).optional(),
-		logo: z$1.union([z$1.url(), z$1.literal("")]).optional(),
+		slug: slugSchema.optional(),
+		logo: optionalSafeUrlSchema,
 		metadata: z$1.string().optional()
 	};
 	const additional = getOrganizationAdditionalFields(orgOptions);
 	for (const [name, field] of Object.entries(additional)) {
 		if (field.input === false) continue;
-		shape[name] = createSchemaForDBField(field);
+		shape[name] = createSchemaForDBField$1(field);
 	}
 	const result = z$1.object(shape).partial().strict().safeParse(data);
 	if (!result.success) throw result.error;
@@ -5790,6 +5937,17 @@ const removeTeamMember = (options) => {
 	});
 };
 //#endregion
+//#region src/compat/internal-adapter.ts
+/** Deletes all sessions for a user across better-auth 1.4–1.6 internal adapter APIs. */
+async function deleteUserSessionsCompat(adapter, userId) {
+	if (typeof adapter.deleteUserSessions === "function") {
+		await adapter.deleteUserSessions(userId);
+		return;
+	}
+	if (typeof adapter.deleteSessions !== "function") throw new Error("Internal adapter does not support deleting user sessions");
+	await adapter.deleteSessions(userId);
+}
+//#endregion
 //#region src/routes/sessions/index.ts
 const revokeSession = (options) => createAuthEndpoint("/dash/sessions/revoke", {
 	method: "POST",
@@ -5827,7 +5985,7 @@ const revokeAllSessions = (options) => createAuthEndpoint("/dash/sessions/revoke
 }, async (ctx) => {
 	const { userId } = ctx.body;
 	if (!await ctx.context.internalAdapter.findUserById(userId)) throw ctx.error("NOT_FOUND", { message: "User not found" });
-	await ctx.context.internalAdapter.deleteUserSessions(userId);
+	await deleteUserSessionsCompat(ctx.context.internalAdapter, userId);
 	return ctx.json({ success: true });
 });
 const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revoke-many", {
@@ -5836,7 +5994,7 @@ const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revok
 }, async (ctx) => {
 	const { userIds } = ctx.context.payload;
 	await withConcurrency(chunkArray(userIds, { batchSize: 50 }), async (chunk) => {
-		for (const userId of chunk) await ctx.context.internalAdapter.deleteUserSessions(userId);
+		for (const userId of chunk) await deleteUserSessionsCompat(ctx.context.internalAdapter, userId);
 	}, { concurrency: 3 });
 	return ctx.json({
 		success: true,
@@ -5844,248 +6002,6 @@ const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revok
 	});
 });
 //#endregion
-//#region ../utils/dist/ip.mjs
-/**
-* SSRF (Server-Side Request Forgery) Protection
-*
-* IP and URL utilities to validate hostnames and URLs before server-side fetches.
-* Blocks requests to private/reserved networks. Covers IPv4 private ranges,
-* IPv6 private ranges, and IPv4-mapped IPv6 bypass vectors.
-*/
-function isPrivateIPv4(a, b) {
-	if (a === 10) return true;
-	if (a === 172 && b >= 16 && b <= 31) return true;
-	if (a === 192 && b === 168) return true;
-	if (a === 127) return true;
-	if (a === 169 && b === 254) return true;
-	if (a === 0) return true;
-	if (a === 100 && b >= 64 && b <= 127) return true;
-	if (a >= 224) return true;
-	return false;
-}
-function parseIPv4Quad(quad) {
-	const v4parts = quad.split(".").map(Number);
-	if (v4parts.length === 4 && v4parts.every((p) => !isNaN(p) && p >= 0 && p <= 255)) return [v4parts[0], v4parts[1]];
-	return null;
-}
-/**
-* Loopback, RFC1918, link-local, CGNAT, ULA, documentation, NAT64 well-known,
-* IPv4-mapped private, unspecified, and multicast (RFC 4291 section 2.7).
-*/
-function ipv6GroupsAreNonPublic(groups) {
-	if (groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1) return true;
-	if (groups.every((g) => g === 0)) return true;
-	if ((groups[0] & 65472) === 65152) return true;
-	if ((groups[0] & 65024) === 64512) return true;
-	if ((groups[0] & 65280) === 65280) return true;
-	if (groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && groups[5] === 65535) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
-	if (groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 65535 && groups[5] === 0) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
-	if (groups[0] === 100 && groups[1] === 65435 && groups.slice(2, 6).every((g) => g === 0)) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
-	if (groups[0] === 8193 && groups[1] === 3512) return true;
-	if (groups[0] === 256 && groups.slice(1, 4).every((g) => g === 0)) return true;
-	return false;
-}
-function parseIPv6(addr) {
-	const sides = addr.split("::");
-	if (sides.length > 2) return null;
-	const parseGroups = (s) => s === "" ? [] : s.split(":").map((g) => parseInt(g, 16));
-	const left = parseGroups(sides[0]);
-	const right = sides.length === 2 ? parseGroups(sides[1]) : [];
-	if (left.some(isNaN) || right.some(isNaN)) return null;
-	const missing = 8 - left.length - right.length;
-	if (sides.length === 2) {
-		if (missing < 0) return null;
-		return [
-			...left,
-			...Array(missing).fill(0),
-			...right
-		];
-	}
-	if (left.length !== 8) return null;
-	return left;
-}
-/** True when the hostname is an IPv4 or IPv6 literal (not a DNS name). */
-function isIpLiteralHostname(hostname) {
-	const bare = hostname.replace(/^\[|\]$/g, "");
-	if (parseIPv4Quad(bare)) return true;
-	return parseIPv6(bare)?.length === 8;
-}
-/** Returns true if the hostname resolves to a private/reserved IP or is a local hostname. */
-function isPrivateHost(hostname) {
-	if (hostname === "localhost" || hostname.endsWith(".local") || hostname.endsWith(".internal") || hostname.endsWith(".localhost")) return true;
-	const bare = hostname.replace(/^\[|\]$/g, "");
-	const v4 = parseIPv4Quad(bare);
-	if (v4) return isPrivateIPv4(v4[0], v4[1]);
-	const mappedTail = bare.match(/(?:^|:)([\d.]+)$/);
-	if (mappedTail && mappedTail[1].includes(".")) {
-		const mappedV4 = parseIPv4Quad(mappedTail[1]);
-		if (mappedV4) return isPrivateIPv4(mappedV4[0], mappedV4[1]);
-	}
-	const groups = parseIPv6(bare);
-	if (groups && groups.length === 8) return ipv6GroupsAreNonPublic(groups);
-	return false;
-}
-//#endregion
-//#region ../utils/dist/url.mjs
-/**
-* URL helpers: normalization, SSRF-safe parsing/validation, and path/query segments.
-*/
-const HTTP_PROTOCOLS = ["http:", "https:"];
-function isAllowedProtocol(protocol, allowedProtocols) {
-	return (allowedProtocols?.length ? allowedProtocols : HTTP_PROTOCOLS).includes(protocol);
-}
-function toAllowedOriginSet(allowedOrigins) {
-	const set = /* @__PURE__ */ new Set();
-	for (const raw of allowedOrigins) try {
-		const parsed = new URL(raw.trim());
-		if (isAllowedProtocol(parsed.protocol, HTTP_PROTOCOLS)) set.add(parsed.origin);
-	} catch {}
-	return set;
-}
-function isAllowedOrigin(origin, allowedOrigins) {
-	if (!allowedOrigins.length) return false;
-	return toAllowedOriginSet(allowedOrigins).has(origin);
-}
-async function resolveHostnameAddresses(hostname) {
-	try {
-		const dns = await import("node:dns").catch((e) => {
-			console.warn("Failed to load node:dns for DNS resolution", e);
-			return null;
-		});
-		if (!dns?.promises?.resolve) return null;
-		return await dns.promises.resolve(hostname);
-	} catch {
-		return null;
-	}
-}
-function validateUrlSync(input, options = {}) {
-	let parsed;
-	if (input instanceof URL) parsed = input;
-	else {
-		const trimmed = input.trim();
-		try {
-			parsed = new URL(trimmed);
-		} catch {
-			return {
-				ok: false,
-				reason: "invalid_url"
-			};
-		}
-	}
-	if (!isAllowedProtocol(parsed.protocol, options.allowedProtocols)) return {
-		ok: false,
-		reason: "disallowed_protocol",
-		url: parsed,
-		protocol: parsed.protocol
-	};
-	if (parsed.username !== "" || parsed.password !== "") return {
-		ok: false,
-		reason: "embedded_credentials",
-		url: parsed
-	};
-	if (isPrivateHost(parsed.hostname)) return {
-		ok: false,
-		reason: "private_host",
-		url: parsed
-	};
-	if (options.allowedOrigins?.length) {
-		if (!isAllowedOrigin(parsed.origin, options.allowedOrigins)) return {
-			ok: false,
-			reason: "disallowed_origin",
-			url: parsed,
-			hostname: parsed.hostname,
-			origin: parsed.origin
-		};
-	}
-	return {
-		ok: true,
-		url: parsed
-	};
-}
-/** SSRF checks with DNS resolution when available. */
-async function validateUrl(input, options = {}) {
-	const sync = validateUrlSync(input, options);
-	if (!sync.ok) return sync;
-	if (options.dns === false) return sync;
-	const hostname = sync.url.hostname;
-	const addresses = await resolveHostnameAddresses(hostname);
-	if (!isIpLiteralHostname(hostname) && !addresses?.length) return {
-		ok: false,
-		reason: "unresolved_host",
-		url: sync.url,
-		hostname
-	};
-	if (addresses) {
-		for (const addr of addresses) if (isPrivateHost(addr)) return {
-			ok: false,
-			reason: "private_dns",
-			url: sync.url,
-			hostname,
-			address: addr
-		};
-	}
-	return {
-		ok: true,
-		url: sync.url,
-		...addresses ? { addresses } : {}
-	};
-}
-function safeResolveUrl(raw, baseURL) {
-	const trim = raw.trim();
-	if (!trim) return null;
-	if (trim.startsWith("//") || trim.includes("\\")) return null;
-	if (/[\u0000-\u001F\u007F]/.test(trim)) return null;
-	try {
-		if (trim.startsWith("/")) return new URL(trim, baseURL);
-		return new URL(trim);
-	} catch {
-		return null;
-	}
-}
-//#endregion
-//#region src/validation/ssrf.ts
-const REDIRECT_STATUSES = new Set([
-	301,
-	302,
-	303,
-	307,
-	308
-]);
-const MAX_REDIRECTS = 10;
-var SsrfBlockedError = class extends Error {
-	name = "SsrfBlockedError";
-};
-function isSsrfBlockedError(error) {
-	return error instanceof SsrfBlockedError;
-}
-/**
-* Fetch with SSRF checks on the initial URL and every redirect target.
-*/
-async function $outbound(url, options = {}) {
-	const { timeout, signal: callerSignal, ...fetchInit } = options;
-	let currentUrl = url;
-	for (let hop = 0;; hop++) {
-		const result = await validateUrl(currentUrl);
-		if (!result.ok) throw new SsrfBlockedError("Invalid or blocked URL");
-		const validated = result.url;
-		const signals = [];
-		if (callerSignal) signals.push(callerSignal);
-		if (timeout !== void 0 && timeout > 0) signals.push(AbortSignal.timeout(timeout));
-		const response = await fetch(validated.href, {
-			...fetchInit,
-			redirect: "manual",
-			signal: signals.length === 0 ? void 0 : signals.length === 1 ? signals[0] : AbortSignal.any(signals)
-		});
-		if (!REDIRECT_STATUSES.has(response.status)) return response;
-		if (hop >= MAX_REDIRECTS) throw new SsrfBlockedError("Too many redirects");
-		await response.body?.cancel().catch(() => {});
-		const location = response.headers.get("location");
-		const next = location ? safeResolveUrl(location, validated.href) : null;
-		if (!next) throw new SsrfBlockedError("Invalid redirect location");
-		currentUrl = next;
-	}
-}
-//#endregion
 //#region src/routes/plugin-session.ts
 /**
 * Builds an in-memory session context for calling plugin endpoints
@@ -6145,6 +6061,16 @@ function extractAlgorithmsFromSAMLMetadata(metadataXml) {
 		digestAlgorithms
 	};
 }
+/** Extract the first IdP SSO URL from SAML metadata XML, if present. */
+function extractEntryPointFromSAMLMetadata(metadataXml) {
+	const match = metadataXml.match(/<(?:[\w-]+:)?SingleSignOnService\b[^>]*\bLocation=["']([^"']+)["']/i);
+	if (!match?.[1]) return void 0;
+	try {
+		return new URL(match[1]).toString();
+	} catch {
+		return;
+	}
+}
 function validateSAMLMetadataAlgorithms(metadataXml) {
 	const warnings = [];
 	const { signatureAlgorithms, digestAlgorithms } = extractAlgorithmsFromSAMLMetadata(metadataXml);
@@ -6154,10 +6080,6 @@ function validateSAMLMetadataAlgorithms(metadataXml) {
 }
 //#endregion
 //#region src/routes/sso/index.ts
-let ssoRuntimeModule;
-function loadSsoRuntime() {
-	return ssoRuntimeModule ??= import("@better-auth/sso");
-}
 function requireOrganizationAccess(ctx) {
 	const orgIdFromUrl = tryDecode(ctx.params.id);
 	const orgIdFromToken = ctx.context.payload?.organizationId;
@@ -6186,6 +6108,12 @@ const oidcConfigSchema = z$1.object({
 	clientSecret: z$1.string().optional(),
 	discoveryUrl: z$1.string().optional(),
 	issuer: z$1.string().optional(),
+	discoveryEndpoint: z$1.string().optional(),
+	authorizationEndpoint: z$1.string().optional(),
+	tokenEndpoint: z$1.string().optional(),
+	jwksEndpoint: z$1.string().optional(),
+	userInfoEndpoint: z$1.string().optional(),
+	tokenEndpointAuthentication: z$1.enum(["client_secret_post", "client_secret_basic"]).optional(),
 	mapping: z$1.object({
 		id: z$1.string().optional(),
 		email: z$1.string().optional(),
@@ -6196,21 +6124,8 @@ const oidcConfigSchema = z$1.object({
 	}).optional()
 });
 async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
-	let idpMetadataXml = samlConfig.idpMetadata?.metadata;
-	if (!idpMetadataXml && samlConfig.idpMetadata?.metadataUrl) try {
-		const metadataResponse = await $outbound(samlConfig.idpMetadata.metadataUrl, {
-			method: "GET",
-			headers: { Accept: "application/xml, text/xml" },
-			timeout: 15e3
-		});
-		if (!metadataResponse.ok) throw ctx.error("BAD_REQUEST", { message: `Failed to fetch IdP metadata from URL: ${metadataResponse.status} ${metadataResponse.statusText}` });
-		idpMetadataXml = await metadataResponse.text();
-	} catch (e) {
-		if (isSsrfBlockedError(e)) throw ctx.error("BAD_REQUEST", { message: "Invalid or blocked IdP metadata URL" });
-		if (e instanceof APIError$1) throw e;
-		ctx.context.logger.error("[Dash] Failed to fetch IdP metadata from URL:", e);
-		throw ctx.error("BAD_REQUEST", { message: "Failed to fetch IdP metadata from URL" });
-	}
+	const idpMetadataXml = samlConfig.idpMetadata?.metadata;
+	if (samlConfig.idpMetadata?.metadataUrl && !idpMetadataXml) throw ctx.error("BAD_REQUEST", { message: "IdP metadata URL must be resolved before submitting; provide idpMetadata.metadata" });
 	const metadataAlgorithmWarnings = [];
 	if (idpMetadataXml) {
 		try {
@@ -6233,14 +6148,22 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 		...samlConfig.cert ? { cert: samlConfig.cert } : {}
 	};
 	const m = samlConfig.mapping;
+	const resolvedEntryPoint = samlConfig.entryPoint?.trim() || (idpMetadataXml ? extractEntryPointFromSAMLMetadata(idpMetadataXml) : void 0);
+	const saml17OrNewer = isVersionAtLeast(ctx.context.version, "1.7.0");
+	if (saml17OrNewer && !resolvedEntryPoint) throw ctx.error("BAD_REQUEST", { message: "SAML entry point URL is required; provide entryPoint or IdP metadata with SingleSignOnService Location" });
 	return {
 		config: {
 			issuer: samlConfig.entityId ?? `${baseURL}/sso/saml2/sp/metadata?providerId=${providerId}`,
-			callbackUrl: `${baseURL}/sso/saml2/sp/acs/${providerId}`,
 			idpMetadata,
-			spMetadata: {},
-			entryPoint: samlConfig.entryPoint ?? "",
-			cert: samlConfig.cert ?? "",
+			...saml17OrNewer ? {
+				entryPoint: resolvedEntryPoint,
+				...samlConfig.cert ? { cert: samlConfig.cert } : {}
+			} : {
+				callbackUrl: `${baseURL}/sso/saml2/sp/acs/${providerId}`,
+				spMetadata: {},
+				entryPoint: resolvedEntryPoint ?? "",
+				cert: samlConfig.cert ?? ""
+			},
 			...m ? { mapping: {
 				id: m.id ?? "nameID",
 				email: m.email ?? "email",
@@ -6254,67 +6177,33 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 		...metadataAlgorithmWarnings.length > 0 ? { warnings: metadataAlgorithmWarnings } : {}
 	};
 }
-async function resolveOIDCConfig(oidcConfig, domain, ctx) {
-	let normalizedDomain = domain;
-	try {
-		if (domain.startsWith("http://") || domain.startsWith("https://")) normalizedDomain = new URL(domain).hostname;
-	} catch {
-		normalizedDomain = domain;
-	}
-	const issuerHint = oidcConfig.issuer || `https://${normalizedDomain}`;
-	const issuer = issuerHint.startsWith("http") ? issuerHint : `https://${issuerHint}`;
-	const sso = await loadSsoRuntime();
-	try {
-		const hydratedConfig = await sso.discoverOIDCConfig({
-			issuer,
-			discoveryEndpoint: oidcConfig.discoveryUrl,
-			isTrustedOrigin: (url) => {
-				try {
-					const issuerOrigin = new URL(issuer).origin;
-					return new URL(url).origin === issuerOrigin;
-				} catch {
-					return false;
-				}
-			}
-		});
-		const om = oidcConfig.mapping;
-		return {
-			config: {
-				clientId: oidcConfig.clientId,
-				clientSecret: oidcConfig.clientSecret,
-				issuer: hydratedConfig.issuer,
-				discoveryEndpoint: hydratedConfig.discoveryEndpoint,
-				authorizationEndpoint: hydratedConfig.authorizationEndpoint,
-				tokenEndpoint: hydratedConfig.tokenEndpoint,
-				jwksEndpoint: hydratedConfig.jwksEndpoint,
-				userInfoEndpoint: hydratedConfig.userInfoEndpoint,
-				tokenEndpointAuthentication: hydratedConfig.tokenEndpointAuthentication,
-				pkce: true,
-				...om ? { mapping: {
-					id: om.id ?? "sub",
-					email: om.email ?? "email",
-					name: om.name ?? "name",
-					emailVerified: om.emailVerified,
-					image: om.image,
-					extraFields: om.extraFields
-				} } : {}
-			},
-			issuer: hydratedConfig.issuer
-		};
-	} catch (e) {
-		if (e instanceof sso.DiscoveryError) {
-			ctx.context.logger.error("[Dash] OIDC discovery failed:", e);
-			throw ctx.error("BAD_REQUEST", {
-				message: `OIDC discovery failed: ${e.message}`,
-				code: e.code
-			});
-		}
-		ctx.context.logger.error("[Dash] OIDC discovery failed:", e);
-		throw ctx.error("BAD_REQUEST", {
-			message: `OIDC discovery failed: Unable to discover configuration from ${issuer}`,
-			code: "OIDC_DISCOVERY_FAILED"
-		});
-	}
+async function resolveOIDCConfig(oidcConfig, _domain, ctx) {
+	if (!oidcConfig.issuer || !oidcConfig.authorizationEndpoint || !oidcConfig.tokenEndpoint || !oidcConfig.jwksEndpoint) throw ctx.error("BAD_REQUEST", { message: "OIDC discovery must be resolved before submitting; provide issuer, authorizationEndpoint, tokenEndpoint, and jwksEndpoint" });
+	const om = oidcConfig.mapping;
+	const discoveryEndpoint = oidcConfig.discoveryEndpoint ?? oidcConfig.discoveryUrl ?? oidcConfig.issuer;
+	return {
+		config: {
+			clientId: oidcConfig.clientId,
+			clientSecret: oidcConfig.clientSecret,
+			issuer: oidcConfig.issuer,
+			discoveryEndpoint,
+			authorizationEndpoint: oidcConfig.authorizationEndpoint,
+			tokenEndpoint: oidcConfig.tokenEndpoint,
+			jwksEndpoint: oidcConfig.jwksEndpoint,
+			userInfoEndpoint: oidcConfig.userInfoEndpoint,
+			tokenEndpointAuthentication: oidcConfig.tokenEndpointAuthentication,
+			pkce: true,
+			...om ? { mapping: {
+				id: om.id ?? "sub",
+				email: om.email ?? "email",
+				name: om.name ?? "name",
+				emailVerified: om.emailVerified,
+				image: om.image,
+				extraFields: om.extraFields
+			} } : {}
+		},
+		issuer: oidcConfig.issuer
+	};
 }
 const listOrganizationSsoProviders = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-providers", {
@@ -6472,6 +6361,7 @@ const updateSsoProvider = (options) => {
 		try {
 			const result = await ssoPlugin.endpoints.updateSSOProvider({
 				body: updateBody,
+				params: { providerId },
 				context: {
 					...ctx.context,
 					...buildSessionContext(providerUserId)
@@ -6619,6 +6509,7 @@ const deleteSsoProvider = (options) => {
 		try {
 			await ssoPlugin.endpoints.deleteSSOProvider({
 				body: { providerId },
+				params: { providerId },
 				context: {
 					...ctx.context,
 					...buildSessionContext(provider.userId)
@@ -6916,6 +6807,30 @@ const generateBackupCodes = (options) => createAuthEndpoint("/dash/generate-back
 	return { backupCodes: newBackupCodes };
 });
 //#endregion
+//#region src/compat/sessions.ts
+/** Secondary-storage sessions on older better-auth builds may omit `id`; dash expects one. */
+function normalizeDashSessions(sessions) {
+	return sessions.map((session) => {
+		if (session.id) return session;
+		if (session.token) return {
+			...session,
+			id: session.token
+		};
+		return session;
+	});
+}
+//#endregion
+//#region src/lib/sanitize-sessions.ts
+/**
+* Strips bearer tokens from session records before returning them from dash handlers.
+*/
+function sanitizeSessions(sessions) {
+	return sessions.map((session) => {
+		const { token: _token, ...rest } = session;
+		return rest;
+	});
+}
+//#endregion
 //#region src/routes/two-factor/two-factor-status.ts
 async function resolveTwoFactorStatus(context, userId, user) {
 	if (!hasPlugin(context, "two-factor")) return;
@@ -6930,6 +6845,158 @@ async function resolveTwoFactorStatus(context, userId, user) {
 	}) ? "pending" : "disabled";
 }
 //#endregion
+//#region src/routes/users/schemas.ts
+const DENIED_USER_WRITE_KEYS = new Set([
+	"id",
+	"createdAt",
+	"updatedAt"
+]);
+/** Fields that must be changed through dedicated permission-checked endpoints. */
+const DENIED_SENSITIVE_USER_KEYS = new Set([
+	"banned",
+	"banReason",
+	"banExpires",
+	"role",
+	"password",
+	"twoFactorEnabled",
+	"twoFactorSecret"
+]);
+const CREATE_REQUEST_ONLY_KEYS = new Set([
+	"password",
+	"generatePassword",
+	"sendVerificationEmail",
+	"sendOrganizationInvite",
+	"organizationRole",
+	"organizationId"
+]);
+const CORE_CREATE_KEYS = [
+	"name",
+	"email",
+	"image",
+	"emailVerified"
+];
+const CORE_UPDATE_KEYS = [
+	"name",
+	"email",
+	"image",
+	"emailVerified"
+];
+/**
+* Mirrors Better Auth's user input schema merge:
+* `user.additionalFields` plus each plugin's `schema.user` fields.
+*/
+function getUserInputFields(options) {
+	let schema = { ...options?.user?.additionalFields ?? {} };
+	for (const plugin of options?.plugins ?? []) {
+		const pluginUser = plugin.schema?.user;
+		if (pluginUser?.fields) schema = {
+			...schema,
+			...pluginUser.fields
+		};
+		if (pluginUser?.additionalFields) schema = {
+			...schema,
+			...pluginUser.additionalFields
+		};
+	}
+	return schema;
+}
+function isWritableUserInputField(field) {
+	return field.input !== false && !field.references;
+}
+function getWritableUserAdditionalFieldNames(options) {
+	return Object.entries(getUserInputFields(options)).filter(([, field]) => isWritableUserInputField(field)).map(([name]) => name);
+}
+function getWritableUserFieldNames(options, mode) {
+	const keys = new Set(mode === "create" ? CORE_CREATE_KEYS : CORE_UPDATE_KEYS);
+	for (const name of getWritableUserAdditionalFieldNames(options)) keys.add(name);
+	return keys;
+}
+/**
+* Returns only user fields that may be persisted on create/update.
+* Strips unknown keys, denied keys, request-only fields, and non-input/reference additional fields.
+*/
+function pickWritableUserFields(body, options, mode) {
+	const allowed = getWritableUserFieldNames(options, mode);
+	const skip = new Set([
+		...DENIED_USER_WRITE_KEYS,
+		...DENIED_SENSITIVE_USER_KEYS,
+		...mode === "create" ? CREATE_REQUEST_ONLY_KEYS : []
+	]);
+	const result = {};
+	for (const [key, value] of Object.entries(body)) {
+		if (skip.has(key) || !allowed.has(key) || value === void 0) continue;
+		result[key] = value;
+	}
+	return result;
+}
+const BaseCreateUserCoreBodySchema = z$1.object({
+	name: z$1.string(),
+	email: z$1.email(),
+	image: z$1.string().optional(),
+	password: z$1.string().optional(),
+	generatePassword: z$1.boolean().optional(),
+	emailVerified: z$1.boolean().optional(),
+	sendVerificationEmail: z$1.boolean().optional(),
+	sendOrganizationInvite: z$1.boolean().optional(),
+	organizationRole: z$1.string().optional(),
+	organizationId: z$1.string().optional()
+});
+const BaseUpdateUserCoreBodySchema = z$1.object({
+	name: z$1.string().nullable().optional(),
+	email: z$1.email().optional(),
+	image: z$1.string().nullable().optional(),
+	emailVerified: z$1.boolean().optional()
+});
+const CreateUserBodySchema = BaseCreateUserCoreBodySchema.catchall(z$1.unknown());
+const UpdateUserBodySchema = BaseUpdateUserCoreBodySchema.catchall(z$1.unknown());
+function createSchemaForDBField(field) {
+	switch (field.type) {
+		case "number": return field.required ? z$1.coerce.number() : z$1.coerce.number().optional();
+		case "boolean": return field.required ? z$1.coerce.boolean() : z$1.coerce.boolean().optional();
+		case "date": return field.required ? z$1.union([z$1.string().min(1), z$1.coerce.date()]) : z$1.union([z$1.string(), z$1.coerce.date()]).optional();
+		default: return field.required ? z$1.string().min(1) : z$1.string().optional();
+	}
+}
+/**
+* Validates required core + configured additional fields on create.
+*/
+function validateWritableCreateUserFields(data, options) {
+	const shape = {
+		name: z$1.string().min(1),
+		email: z$1.email(),
+		image: z$1.string().optional(),
+		emailVerified: z$1.boolean().optional()
+	};
+	for (const [name, field] of Object.entries(getUserInputFields(options))) {
+		if (!isWritableUserInputField(field)) continue;
+		shape[name] = createSchemaForDBField(field);
+	}
+	const result = z$1.object(shape).strict().safeParse(data);
+	if (!result.success) throw result.error;
+}
+/**
+* Ensures at least one field is present on update and validates additional field types.
+*/
+function validateWritableUserUpdateFields(data, options) {
+	if (Object.keys(data).length === 0) throw new z$1.ZodError([{
+		code: "custom",
+		message: "No valid fields to update",
+		path: []
+	}]);
+	const shape = {
+		name: z$1.string().nullable().optional(),
+		email: z$1.email().optional(),
+		image: z$1.string().nullable().optional(),
+		emailVerified: z$1.boolean().optional()
+	};
+	for (const [name, field] of Object.entries(getUserInputFields(options))) {
+		if (!isWritableUserInputField(field)) continue;
+		shape[name] = createSchemaForDBField(field);
+	}
+	const result = z$1.object(shape).partial().strict().safeParse(data);
+	if (!result.success) throw result.error;
+}
+//#endregion
 //#region src/routes/users/index.ts
 function parseWhereClause(val) {
 	if (!val) return [];
@@ -7093,7 +7160,7 @@ const impersonateUser = (options) => {
 		query: z$1.object({ impersonation_token: z$1.string() }),
 		use: [jwtMiddleware(options, z$1.object({
 			userId: z$1.string(),
-			redirectUrl: z$1.url(),
+			redirectUrl: safeUrlSchema,
 			impersonatedBy: z$1.string().optional()
 		}), async (ctx) => {
 			return ctx.query.impersonation_token;
@@ -7121,25 +7188,21 @@ const createUser = (options) => {
 			organizationId: z$1.string().optional(),
 			organizationRole: z$1.string().optional()
 		}))],
-		body: z$1.looseObject({
-			name: z$1.string(),
-			email: z$1.email(),
-			image: z$1.string().optional(),
-			password: z$1.string().optional(),
-			generatePassword: z$1.boolean().optional(),
-			emailVerified: z$1.boolean().optional(),
-			sendVerificationEmail: z$1.boolean().optional(),
-			sendOrganizationInvite: z$1.boolean().optional(),
-			organizationRole: z$1.string().optional(),
-			organizationId: z$1.string().optional()
-		})
+		body: CreateUserBodySchema
 	}, async (ctx) => {
-		const userData = ctx.body;
+		const body = ctx.body;
+		const userData = pickWritableUserFields(body, ctx.context.options, "create");
+		try {
+			validateWritableCreateUserFields(userData, ctx.context.options);
+		} catch (error) {
+			if (error instanceof z$1.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
+			throw error;
+		}
 		const email = normalizeEmail(userData.email, ctx.context);
 		if (await ctx.context.internalAdapter.findUserByEmail(email)) throw new APIError("BAD_REQUEST", { message: "User with this email already exist" });
 		let password = null;
-		if (userData.generatePassword && !userData.password) password = generateId(12);
-		else if (userData.password && userData.password.trim() !== "") password = userData.password;
+		if (body.generatePassword && !body.password) password = generateId(12);
+		else if (body.password && typeof body.password === "string" && body.password.trim() !== "") password = body.password;
 		const userSchema = getAuthTables(ctx.context.options).user;
 		for (const field in userSchema.fields || {}) {
 			const value = userSchema.fields[field];
@@ -7156,24 +7219,28 @@ const createUser = (options) => {
 				}
 			}
 		}
-		const user = await ctx.context.internalAdapter.createUser({
+		const emailVerified = userData.emailVerified;
+		const userPayload = {
 			...userData,
+			name: userData.name,
 			email,
-			emailVerified: userData.emailVerified,
+			emailVerified,
 			createdAt: /* @__PURE__ */ new Date(),
 			updatedAt: /* @__PURE__ */ new Date()
-		});
+		};
+		const adapter = ctx.context.internalAdapter;
+		const user = isVersionAtLeast(ctx.context.version, "1.7.0") ? await adapter.createUser(userPayload, { method: "admin" }) : await adapter.createUser(userPayload);
 		if (password) await ctx.context.internalAdapter.createAccount({
 			userId: user.id,
 			providerId: "credential",
 			accountId: user.id,
 			password: await ctx.context.password.hash(password)
 		});
-		if (userData.sendVerificationEmail && !userData.emailVerified) {
+		if (body.sendVerificationEmail && !emailVerified) {
 			if (ctx.context.options.emailVerification?.sendVerificationEmail) await sendVerificationEmailFn(ctx, user);
 		}
-		const organizationId = ctx.context.payload?.organizationId || userData.organizationId;
-		const organizationRole = ctx.context.payload?.organizationRole || userData.organizationRole;
+		const organizationId = ctx.context.payload?.organizationId || body.organizationId;
+		const organizationRole = ctx.context.payload?.organizationRole || body.organizationRole;
 		if (organizationId) {
 			const orgOptions = requireOrganizationPlugin(ctx).options || {};
 			const role = organizationRole || "member";
@@ -7295,7 +7362,7 @@ const getUserDetails = (options) => {
 			twoFactorStatus
 		};
 		const activityTrackingEnabled = !!options.activityTracking?.enabled;
-		const sessions = secondaryStorageOnly ? await ctx.context.internalAdapter.listSessions(userId) : user.session || [];
+		const sessions = secondaryStorageOnly ? normalizeDashSessions(await ctx.context.internalAdapter.listSessions(userId)) : user.session || [];
 		let lastActiveAt = null;
 		if (activityTrackingEnabled) {
 			lastActiveAt = user.lastActiveAt ?? null;
@@ -7324,9 +7391,10 @@ const getUserDetails = (options) => {
 				updateActivity();
 			}
 		}
+		const { session: _joinedSessions, ...userWithoutSessions } = user;
 		return {
-			...user,
-			...secondaryStorageOnly ? { session: sessions } : {},
+			...userWithoutSessions,
+			session: sanitizeSessions(sessions),
 			lastActiveAt,
 			banned: hasAdminPlugin ? user.banned ?? false : false,
 			banReason: hasAdminPlugin ? user.banReason ?? null : null,
@@ -7384,20 +7452,19 @@ const getUserOrganizations = (options) => {
 const updateUser = (options) => createAuthEndpoint("/dash/update-user", {
 	method: "POST",
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-	body: z$1.looseObject({
-		name: z$1.string().optional(),
-		email: z$1.email().optional(),
-		image: z$1.string().optional(),
-		emailVerified: z$1.boolean().optional()
-	})
+	body: UpdateUserBodySchema
 }, async (ctx) => {
-	const updateData = ctx.body;
 	const userId = ctx.context.payload?.userId;
 	if (!userId) throw new APIError("FORBIDDEN", { message: "Invalid payload" });
-	const filteredData = Object.fromEntries(Object.entries(updateData).filter(([, value]) => value !== void 0));
-	if (Object.keys(filteredData).length === 0) throw new APIError("BAD_REQUEST", { message: "No valid fields to update" });
+	const updateData = pickWritableUserFields(ctx.body, ctx.context.options, "update");
+	try {
+		validateWritableUserUpdateFields(updateData, ctx.context.options);
+	} catch (error) {
+		if (error instanceof z$1.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
+		throw error;
+	}
 	const user = await ctx.context.internalAdapter.updateUser(userId, {
-		...filteredData,
+		...updateData,
 		updatedAt: /* @__PURE__ */ new Date()
 	});
 	if (!user) throw new APIError("NOT_FOUND", { message: "User not found" });
@@ -7861,11 +7928,12 @@ const banUser = (options) => createAuthEndpoint("/dash/ban-user", {
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
 	body: z$1.object({
 		banReason: z$1.string().optional(),
-		banExpires: z$1.number().optional()
+		banExpires: z$1.number().optional(),
+		deleteAllSessions: z$1.boolean().optional().default(true)
 	})
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
-	const { banReason, banExpires } = ctx.body;
+	const { banReason, banExpires, deleteAllSessions } = ctx.body;
 	if (!await ctx.context.internalAdapter.findUserById(userId)) throw new APIError("NOT_FOUND", { message: "User not found" });
 	await ctx.context.internalAdapter.updateUser(userId, {
 		banned: true,
@@ -7873,7 +7941,7 @@ const banUser = (options) => createAuthEndpoint("/dash/ban-user", {
 		banExpires: banExpires ? new Date(banExpires) : null,
 		updatedAt: /* @__PURE__ */ new Date()
 	});
-	await ctx.context.internalAdapter.deleteUserSessions(userId);
+	if (deleteAllSessions) await deleteUserSessionsCompat(ctx.context.internalAdapter, userId);
 	return { success: true };
 });
 const banManyUsers = (options) => {
@@ -7882,11 +7950,12 @@ const banManyUsers = (options) => {
 		use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))],
 		body: z$1.object({
 			banReason: z$1.string().optional(),
-			banExpires: z$1.number().optional()
+			banExpires: z$1.number().optional(),
+			deleteAllSessions: z$1.boolean().optional().default(true)
 		})
 	}, async (ctx) => {
 		const { userIds } = ctx.context.payload;
-		const { banReason, banExpires } = ctx.body;
+		const { banReason, banExpires, deleteAllSessions } = ctx.body;
 		const start = performance.now();
 		await withConcurrency(chunkArray(userIds, { batchSize: 50 }), async (chunk) => {
 			await ctx.context.adapter.updateMany({
@@ -7918,6 +7987,9 @@ const banManyUsers = (options) => {
 			select: ["id"]
 		})).map((u) => u.id);
 		const bannedUserIds = userIds.filter((id) => !skippedUserIds.includes(id));
+		if (deleteAllSessions && bannedUserIds.length > 0) await withConcurrency(chunkArray(bannedUserIds, { batchSize: 50 }), async (chunk) => {
+			for (const userId of chunk) await deleteUserSessionsCompat(ctx.context.internalAdapter, userId);
+		}, { concurrency: 3 });
 		const end = performance.now();
 		console.log(`Time taken to ban ${bannedUserIds.length} users: ${(end - start) / 1e3}s`, skippedUserIds.length > 0 ? `Skipped: ${skippedUserIds.length}` : "");
 		return ctx.json({
@@ -7944,7 +8016,7 @@ const unbanUser = (options) => createAuthEndpoint("/dash/unban-user", {
 const sendVerificationEmail = (options) => createAuthEndpoint("/dash/send-verification-email", {
 	method: "POST",
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-	body: z$1.object({ callbackUrl: z$1.url() })
+	body: z$1.object({ callbackUrl: safeUrlSchema })
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const { callbackUrl } = ctx.body;
@@ -7966,7 +8038,7 @@ const sendManyVerificationEmails = (options) => {
 	return createAuthEndpoint("/dash/send-many-verification-emails", {
 		method: "POST",
 		use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))],
-		body: z$1.object({ callbackUrl: z$1.url() })
+		body: z$1.object({ callbackUrl: safeUrlSchema })
 	}, async (ctx) => {
 		if (!ctx.context.options.emailVerification?.sendVerificationEmail) throw ctx.error("BAD_REQUEST", { message: "Email verification is not enabled" });
 		const { userIds } = ctx.context.payload;
@@ -8026,7 +8098,7 @@ const sendManyVerificationEmails = (options) => {
 const sendResetPasswordEmail = (options) => createAuthEndpoint("/dash/send-reset-password-email", {
 	method: "POST",
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-	body: z$1.object({ callbackUrl: z$1.url() })
+	body: z$1.object({ callbackUrl: safeUrlSchema })
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const user = await ctx.context.internalAdapter.findUserById(userId);
@@ -8118,6 +8190,8 @@ const SMS_TEMPLATES = {
 	"two-factor": { variables: {} },
 	"sign-in-otp": { variables: {} }
 };
+/** End-user IP forwarded to v1 SMS for abuse limits on server-to-server calls. */
+const BETTER_AUTH_CLIENT_IP_HEADER = "x-better-auth-client-ip";
 /**
 * Create an SMS sender instance
 */
@@ -8149,7 +8223,12 @@ function createSMSSender(config) {
 					to: options.to,
 					code: options.code,
 					template: options.template
-				}
+				},
+				...options.clientIp ? { headers: {
+					Authorization: `Bearer ${apiKey}`,
+					"user-agent": INFRA_USER_AGENT,
+					[BETTER_AUTH_CLIENT_IP_HEADER]: options.clientIp
+				} } : {}
 			});
 			if (error) return {
 				success: false,
@@ -8467,7 +8546,8 @@ const dash = (options) => {
 								routes.CHANGE_PASSWORD,
 								routes.SET_PASSWORD,
 								routes.RESET_PASSWORD,
-								routes.ADMIN_SET_PASSWORD
+								routes.ADMIN_SET_PASSWORD,
+								routes.DASH_SET_PASSWORD
 							])) trackAccountPasswordChange(account, trigger, ctx, location);
 						} },
 						delete: { async after(account, _ctx) {
@@ -8518,8 +8598,7 @@ const dash = (options) => {
 			after: [{
 				matcher: (ctx) => {
 					if (ctx.request?.method !== "GET") return true;
-					const path = new URL(ctx.request.url).pathname;
-					return matchesAnyRoute(path, [
+					return matchesAnyRoute(ctx.path, [
 						routes.SIGN_IN_SOCIAL_CALLBACK,
 						routes.SIGN_IN_OAUTH_CALLBACK,
 						routes.DASH_IMPERSONATE_USER
@@ -8528,11 +8607,11 @@ const dash = (options) => {
 				handler: createAuthMiddleware(async (_ctx) => {
 					const ctx = _ctx;
 					const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
-					if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx.context.location);
+					if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL, routes.DASH_SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx.context.location);
 					const body = ctx.body;
 					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger, ctx.context.location);
 					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger, ctx.context.location);
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK]) && ctx.request?.method === "GET" && ctx.context.returned instanceof Error && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger, ctx.context.location);
+					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]) && ctx.request?.method === "GET" && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger, ctx.context.location);
 					const headerRequestId = ctx.request?.headers.get("X-Request-Id");
 					if (headerRequestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
 						maxAge: 600,