@better-auth/infra 0.2.5 → 0.2.6

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { a as dashClient, i as DashGetAuditLogsInput, n as DashAuditLogsResponse, r as DashClientOptions, t as DashAuditLog } from "./dash-client-hJHp7l_X.mjs";
+import { a as DashGetAuditLogsInput, i as DashGetAllAuditLogsInput, n as DashAuditLogsResponse, o as dashClient, r as DashClientOptions, t as DashAuditLog } from "./dash-client-CVCHbtoB.mjs";
 import * as _$_better_fetch_fetch0 from "@better-fetch/fetch";
 
 //#region src/sentinel/client.d.ts
@@ -44,4 +44,4 @@ declare const sentinelClient: (options?: SentinelClientOptions) => {
   })[];
 };
 //#endregion
-export { type DashAuditLog, type DashAuditLogsResponse, type DashClientOptions, type DashGetAuditLogsInput, type SentinelClientOptions, dashClient, sentinelClient };
+export { type DashAuditLog, type DashAuditLogsResponse, type DashClientOptions, type DashGetAllAuditLogsInput, type DashGetAuditLogsInput, type SentinelClientOptions, dashClient, sentinelClient };

package/dist/client.mjs

@@ -1,5 +1,5 @@
 import { r as KV_TIMEOUT_MS } from "./constants-DdWGfvz1.mjs";
-import { a as identify, c as dashClient, i as generateRequestId, n as encodePoWSolution, r as solvePoWChallenge, s as hash, t as decodePoWChallenge } from "./pow-BUuN_EKw.mjs";
+import { a as identify, c as dashClient, i as generateRequestId, n as encodePoWSolution, r as solvePoWChallenge, s as hash, t as decodePoWChallenge } from "./pow-CT9ehp8e.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts
 function murmurhash3(str, seed = 0) {

package/dist/{dash-client-hJHp7l_X.d.mts → dash-client-CVCHbtoB.d.mts}

@@ -40,6 +40,15 @@ interface DashGetAuditLogsInput {
   user?: UserLike | null;
   session?: SessionLike | null;
 }
+interface DashGetAllAuditLogsInput {
+  limit?: number;
+  offset?: number;
+  organizationId?: string;
+  userId?: string;
+  eventType?: string;
+  identifier?: string;
+  session?: SessionLike | null;
+}
 interface DashClientOptions {
   resolveUserId?: (input: {
     userId?: string;
@@ -62,11 +71,23 @@ declare const dashClient: (options?: DashClientOptions) => {
         data: DashAuditLogsResponse;
         error: null;
       }>;
+      getAllAuditLogs: (input?: DashGetAllAuditLogsInput) => Promise<{
+        data: null;
+        error: {
+          message?: string | undefined;
+          status: number;
+          statusText: string;
+        };
+      } | {
+        data: DashAuditLogsResponse;
+        error: null;
+      }>;
     };
   };
   pathMethods: {
     "/events/audit-logs": "GET";
+    "/events/all-audit-logs": "GET";
   };
 };
 //#endregion
-export { dashClient as a, DashGetAuditLogsInput as i, DashAuditLogsResponse as n, DashClientOptions as r, DashAuditLog as t };
+export { DashGetAuditLogsInput as a, DashGetAllAuditLogsInput as i, DashAuditLogsResponse as n, dashClient as o, DashClientOptions as r, DashAuditLog as t };

package/dist/index.d.mts

@@ -726,7 +726,7 @@ interface DashIdRow {
   id: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@better-auth+scim@1.6.4+f772dc2362714ab9/node_modules/@better-auth/scim/dist/index.d.mts
+//#region ../../node_modules/.bun/@better-auth+scim@1.6.9+191040a6ff16b29a/node_modules/@better-auth/scim/dist/index.d.mts
 //#region src/types.d.ts
 interface SCIMProvider {
   id: string;
@@ -5637,6 +5637,40 @@ declare const dash: <O extends DashOptions>(options?: O) => {
         eventType: zod.ZodOptional<zod.ZodString>;
       }, zod_v4_core0.$strip>>;
     }, UserEventsResponse>;
+    getAllAuditLogs: _$better_call0.StrictEndpoint<"/events/all-audit-logs", {
+      method: "GET";
+      use: ((inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>)[];
+      query: zod.ZodOptional<zod.ZodObject<{
+        limit: zod.ZodOptional<zod.ZodUnion<[zod.ZodNumber, zod.ZodPipe<zod.ZodString, zod.ZodTransform<number, string>>]>>;
+        offset: zod.ZodOptional<zod.ZodUnion<[zod.ZodNumber, zod.ZodPipe<zod.ZodString, zod.ZodTransform<number, string>>]>>;
+        userId: zod.ZodOptional<zod.ZodString>;
+        organizationId: zod.ZodOptional<zod.ZodString>;
+        eventType: zod.ZodOptional<zod.ZodString>;
+        identifier: zod.ZodOptional<zod.ZodString>;
+      }, zod_v4_core0.$strip>>;
+    }, UserEventsResponse>;
     getEventTypes: _$better_call0.StrictEndpoint<"/events/types", {
       method: "GET";
       use: ((inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{

package/dist/index.mjs

@@ -997,6 +997,59 @@ function getCountryCodeFromRequest(request) {
 	return cc ? cc.toUpperCase() : void 0;
 }
 //#endregion
+//#region src/sentinel/evaluation.ts
+/** Lazily attach the buffer to the request context. */
+function getEvaluation(ctx) {
+	if (!ctx.context.sentinelEvaluation) ctx.context.sentinelEvaluation = {
+		checks: /* @__PURE__ */ new Set(),
+		outcome: "passed",
+		emitted: false
+	};
+	return ctx.context.sentinelEvaluation;
+}
+function recordCheck(ctx, name) {
+	getEvaluation(ctx).checks.add(name);
+}
+/** Call immediately before throwing so the buffer reflects the final outcome. */
+function setOutcome(ctx, outcome, triggeredBy, details) {
+	const ev = getEvaluation(ctx);
+	ev.outcome = outcome;
+	ev.triggeredBy = triggeredBy;
+	if (details) ev.details = details;
+}
+/**
+* Emit one `security_check` event for the request. Idempotent per request and
+* skipped when no checks ran (unprotected route, or short-circuit before any
+* sentinel hook). `evaluatedChecks` carries the per-type breakdown — all under
+* the same Stripe meter, so the array is for support inspection only.
+*/
+function emitEvaluation(ctx, trackEvent, options = {}) {
+	const ev = ctx.context.sentinelEvaluation;
+	if (!ev || ev.emitted || ev.checks.size === 0) return;
+	ev.emitted = true;
+	const identification = ctx.context.identification ?? null;
+	const visitorId = ctx.context.visitorId ?? null;
+	const path = ctx.path ?? "";
+	trackEvent({
+		eventKey: visitorId || identification?.ip || "unknown",
+		eventType: "security_check",
+		eventDisplayName: ev.outcome === "blocked" ? "Security: blocked" : ev.outcome === "challenged" ? "Security: challenged" : "Security: passed",
+		eventData: {
+			outcome: ev.outcome,
+			evaluatedChecks: [...ev.checks].sort(),
+			triggeredBy: ev.triggeredBy,
+			identifier: options.identifier,
+			path,
+			userAgent: options.userAgent,
+			details: ev.details
+		},
+		ipAddress: identification?.ip || void 0,
+		city: identification?.location?.city || void 0,
+		country: identification?.location?.country?.name || void 0,
+		countryCode: identification?.location?.country?.code || void 0
+	});
+}
+//#endregion
 //#region src/sentinel/security.ts
 async function hashForFingerprint(input) {
 	const data = new TextEncoder().encode(input);
@@ -1183,6 +1236,9 @@ function createSecurityClient(apiUrl, apiKey, options, onSecurityEvent) {
 				return null;
 			}
 		},
+		/**
+		* Store user's last known location for impossible travel detection
+		*/
 		async storeLastLocation(userId, location) {
 			if (!location) return;
 			try {
@@ -1197,6 +1253,9 @@ function createSecurityClient(apiUrl, apiKey, options, onSecurityEvent) {
 				logger.error("[Dash] Store last location error:", error);
 			}
 		},
+		/**
+		* Check if a visitor has exceeded the free trial signup limit.
+		*/
 		async checkFreeTrialAbuse(visitorId) {
 			if (!options.freeTrialAbuse?.enabled) return {
 				isAbuse: false,
@@ -1235,6 +1294,10 @@ function createSecurityClient(apiUrl, apiKey, options, onSecurityEvent) {
 				};
 			}
 		},
+		/**
+		* Track a new signup for free trial abuse detection.
+		* Stores the userId for auditing purposes.
+		*/
 		async trackFreeTrialSignup(visitorId, userId) {
 			if (!options.freeTrialAbuse?.enabled) return;
 			try {
@@ -1285,6 +1348,10 @@ function createSecurityClient(apiUrl, apiKey, options, onSecurityEvent) {
 				return { compromised: false };
 			}
 		},
+		/**
+		* Check if a user account is stale (inactive for a configured period)
+		* This helps detect potential account takeover when dormant accounts become active
+		*/
 		async checkStaleUser(userId, lastActiveAt) {
 			if (!options.staleUsers?.enabled) return { isStale: false };
 			try {
@@ -1317,6 +1384,9 @@ function createSecurityClient(apiUrl, apiKey, options, onSecurityEvent) {
 				return { isStale: false };
 			}
 		},
+		/**
+		* Send stale account reactivation notification to the user
+		*/
 		async notifyStaleAccountUser(userEmail, userName, daysSinceLastActive, identification, appName) {
 			const loginTime = (/* @__PURE__ */ new Date()).toLocaleString("en-US", {
 				dateStyle: "long",
@@ -1344,6 +1414,9 @@ function createSecurityClient(apiUrl, apiKey, options, onSecurityEvent) {
 			if (result.success) logger.info(`[Dash] Stale account notification sent to user: ${userEmail}`);
 			else logger.error(`[Dash] Failed to send stale account user notification: ${result.error}`);
 		},
+		/**
+		* Send stale account reactivation notification to the admin
+		*/
 		async notifyStaleAccountAdmin(adminEmail, userId, userEmail, userName, daysSinceLastActive, identification, appName) {
 			const loginTime = (/* @__PURE__ */ new Date()).toLocaleString("en-US", {
 				dateStyle: "long",
@@ -1522,7 +1595,12 @@ function createEmailValidator(options = {}) {
 		}
 		return null;
 	}
-	return { async validate(email, checkMx = true) {
+	return { 
+	/**
+	* Validate an email address
+	* Returns validation result - caller should use getPolicy() to determine action
+	*/
+async validate(email, checkMx = true) {
 		const trimmed = email.trim();
 		const policy = await fetchPolicy();
 		if (!policy?.enabled) return {
@@ -1608,16 +1686,27 @@ function createEmailNormalizationHook() {
 	};
 }
 /**
-* Create email validation hook with configurable validation strategy
+* Records `email_validity` on every email-bearing request. On block, emits the
+* `security_check` event inline before throwing — the after-hook won't run on throw.
 */
-function createEmailValidationHook(validator, onDisposableEmail) {
+function createEmailValidationHook(validator, trackEvent) {
 	return {
 		matcher: allEmail,
 		handler: createAuthMiddleware(async (ctx) => {
 			const { email } = getEmail(ctx);
 			if (typeof email !== "string") return;
 			const trimmed = email.trim();
-			if (!isValidEmailFormatLocal(trimmed)) throw new APIError$1("BAD_REQUEST", { message: "Invalid email" });
+			recordCheck(ctx, "email_validity");
+			if (!isValidEmailFormatLocal(trimmed)) {
+				if (trackEvent) {
+					setOutcome(ctx, "blocked", "email_validity", {
+						reason: "invalid_format",
+						email: trimmed
+					});
+					emitEvaluation(ctx, trackEvent, { identifier: trimmed });
+				}
+				throw new APIError$1("BAD_REQUEST", { message: "Invalid email" });
+			}
 			if (validator) {
 				const result = await validator.validate(trimmed);
 				const policy = result.policy;
@@ -1628,19 +1717,17 @@ function createEmailValidationHook(validator, onDisposableEmail) {
 				}
 				const action = policy.action;
 				if (!result.valid) {
-					if ((result.disposable || result.reason === "no_mx_records" || result.reason === "blocklist" || result.reason === "known_invalid_email" || result.reason === "known_invalid_host" || result.reason === "reserved_tld" || result.reason === "provider_local_too_short") && onDisposableEmail) {
-						const ip = ctx.request?.headers?.get("x-forwarded-for")?.split(",")[0] || ctx.request?.headers?.get("cf-connecting-ip") || void 0;
-						onDisposableEmail({
-							email: trimmed,
-							reason: result.reason || "disposable",
+					if (action === "allow") return;
+					const message = result.reason === "no_mx_records" ? "This email domain cannot receive emails" : result.disposable || result.reason === "blocklist" ? "Disposable email addresses are not allowed" : result.reason === "known_invalid_email" || result.reason === "known_invalid_host" || result.reason === "reserved_tld" || result.reason === "provider_local_too_short" ? "This email address appears to be invalid" : "Invalid email";
+					if (trackEvent) {
+						setOutcome(ctx, "blocked", "email_validity", {
+							reason: result.reason,
 							confidence: result.confidence,
-							ip,
-							path: ctx.path,
-							action
+							email: trimmed
 						});
+						emitEvaluation(ctx, trackEvent, { identifier: trimmed });
 					}
-					if (action === "allow") return;
-					throw new APIError$1("BAD_REQUEST", { message: result.reason === "no_mx_records" ? "This email domain cannot receive emails" : result.disposable || result.reason === "blocklist" ? "Disposable email addresses are not allowed" : result.reason === "known_invalid_email" || result.reason === "known_invalid_host" || result.reason === "reserved_tld" || result.reason === "provider_local_too_short" ? "This email address appears to be invalid" : "Invalid email" });
+					throw new APIError$1("BAD_REQUEST", { message });
 				}
 			}
 		})
@@ -1668,7 +1755,7 @@ function createEmailValidationHook(validator, onDisposableEmail) {
 * })
 */
 function createEmailHooks(options = {}) {
-	const { emailValidationOptions, emailNormalizationOptions, useApi = false, apiKey = "", apiUrl = INFRA_API_URL, kvUrl = INFRA_KV_URL, onDisposableEmail } = options;
+	const { emailValidationOptions, emailNormalizationOptions, useApi = false, apiKey = "", apiUrl = INFRA_API_URL, kvUrl = INFRA_KV_URL, trackEvent } = options;
 	const emailConfig = {
 		enabled: true,
 		strictness: "medium",
@@ -1683,7 +1770,7 @@ function createEmailHooks(options = {}) {
 		kvUrl,
 		apiKey,
 		emailValidationOptions: emailConfig
-	}) : void 0, onDisposableEmail)] : []] };
+	}) : void 0, trackEvent)] : []] };
 }
 //#endregion
 //#region src/validation/phone.ts
@@ -1898,32 +1985,6 @@ const ERROR_MESSAGES = {
 	compromised_password: "This password has been found in data breaches. Please choose a different password.",
 	impossible_travel: "Login blocked due to suspicious location change."
 };
-const DISPLAY_NAMES = {
-	geo_blocked: {
-		challenge: "Security: geo challenge",
-		block: "Security: geo blocked"
-	},
-	bot_detected: {
-		challenge: "Security: bot challenge",
-		block: "Security: bot blocked"
-	},
-	suspicious_ip_detected: {
-		challenge: "Security: anonymous IP challenge",
-		block: "Security: anonymous IP blocked"
-	},
-	rate_limited: {
-		challenge: "Security: velocity challenge",
-		block: "Security: velocity exceeded"
-	},
-	compromised_password: {
-		challenge: "Security: breached password warning",
-		block: "Security: breached password blocked"
-	},
-	impossible_travel: {
-		challenge: "Security: impossible travel challenge",
-		block: "Security: impossible travel blocked"
-	}
-};
 /**
 * Throw a challenge error with appropriate headers
 */
@@ -1938,73 +1999,52 @@ function throwChallengeError(challenge, reason, message = "Please complete a sec
 	};
 	throw error;
 }
-/**
-* Build common event data for security tracking
-*/
-function buildEventData(ctx, action, reason, confidence = 1, extraData) {
-	const { visitorId, identification, path, identifier, userAgent } = ctx;
-	const countryCode = identification?.location?.country?.code || void 0;
-	return {
-		eventKey: visitorId || identification?.ip || "unknown",
-		eventType: action === "challenged" ? "security_challenged" : "security_blocked",
-		eventDisplayName: DISPLAY_NAMES[reason]?.[action === "challenged" ? "challenge" : "block"] || `Security: ${reason}`,
-		eventData: {
-			action,
-			reason,
-			visitorId: visitorId || "",
-			path,
-			userAgent,
-			identifier,
-			confidence,
-			...extraData
-		},
-		ipAddress: identification?.ip || void 0,
-		city: identification?.location?.city || void 0,
-		country: identification?.location?.country?.name || void 0,
-		countryCode
-	};
-}
-/**
-* Handle a security check result by tracking events and throwing appropriate errors
-*
-* @param verdict - The security verdict from the security service
-* @param ctx - Security check context with request information
-* @param trackEvent - Function to track security events
-* @param securityService - Security service for generating challenges
-* @returns True if the request should be blocked
-*/
-async function handleSecurityVerdict(verdict, ctx, trackEvent, securityService) {
+/** Emits the `security_check` event inline before throwing — the after-hook won't run on throw. */
+async function handleSecurityVerdict(verdict, hookCtx, checkCtx, trackEvent, securityService) {
 	if (verdict.action === "allow") return;
 	const reason = verdict.reason || "unknown";
-	const confidence = 1;
-	if (verdict.action === "challenge" && ctx.visitorId) {
-		const challenge = verdict.challenge || await securityService.generateChallenge(ctx.visitorId);
+	if (verdict.action === "challenge" && checkCtx.visitorId) {
+		const challenge = verdict.challenge || await securityService.generateChallenge(checkCtx.visitorId);
 		if (!challenge?.trim()) {
 			logger.warn("[Sentinel] Could not generate PoW challenge (service may be unavailable). Falling back to allow.");
 			return;
 		}
-		trackEvent(buildEventData(ctx, "challenged", reason, confidence, verdict.details));
-		throwChallengeError(challenge, reason, "Please complete a security check to continue.");
-	} else if (verdict.action === "block") {
-		trackEvent(buildEventData(ctx, "blocked", reason, confidence, verdict.details));
+		setOutcome(hookCtx, "challenged", "server_security_check", {
+			reason,
+			...verdict.details
+		});
+		emitEvaluation(hookCtx, trackEvent, {
+			identifier: checkCtx.identifier,
+			userAgent: checkCtx.userAgent
+		});
+		throwChallengeError(challenge, reason);
+	}
+	if (verdict.action === "block") {
+		setOutcome(hookCtx, "blocked", "server_security_check", {
+			reason,
+			...verdict.details
+		});
+		emitEvaluation(hookCtx, trackEvent, {
+			identifier: checkCtx.identifier,
+			userAgent: checkCtx.userAgent
+		});
 		throw new APIError("FORBIDDEN", { message: ERROR_MESSAGES[reason] || "Access denied." });
 	}
 }
 /**
-* Run all security checks using the consolidated checkSecurity API
-*
-* This replaces the multiple individual check calls with a single API call
-* that handles all security checks server-side.
+* Single API call from the plugin; server runs all configured rules and returns
+* one verdict — counts as one billable check.
 */
-async function runSecurityChecks(ctx, securityService, trackEvent, powVerified) {
+async function runSecurityChecks(hookCtx, checkCtx, securityService, trackEvent, powVerified) {
 	if (powVerified) return;
+	recordCheck(hookCtx, "server_security_check");
 	await handleSecurityVerdict(await securityService.checkSecurity({
-		visitorId: ctx.visitorId,
-		requestId: ctx.identification?.requestId || null,
-		ip: ctx.identification?.ip || null,
-		path: ctx.path,
-		identifier: ctx.identifier
-	}), ctx, trackEvent, securityService);
+		visitorId: checkCtx.visitorId,
+		requestId: checkCtx.identification?.requestId || null,
+		ip: checkCtx.identification?.ip || null,
+		path: checkCtx.path,
+		identifier: checkCtx.identifier
+	}), hookCtx, checkCtx, trackEvent, securityService);
 }
 //#endregion
 //#region src/sentinel/sentinel.ts
@@ -2016,8 +2056,8 @@ const sentinel = (options) => {
 	const securityService = createSecurityClient(opts.apiUrl, opts.apiKey, opts.security || {}, (event) => {
 		trackEvent({
 			eventKey: event.visitorId || event.userId || "unknown",
-			eventType: `security_${event.type}`,
-			eventDisplayName: `Security: ${event.type.replace(/_/g, " ")}`,
+			eventType: "security_signal",
+			eventDisplayName: `Security signal: ${event.type.replace(/_/g, " ")}`,
 			eventData: {
 				type: event.type,
 				userId: event.userId || void 0,
@@ -2036,31 +2076,7 @@ const sentinel = (options) => {
 		apiKey: opts.apiKey,
 		apiUrl: opts.apiUrl,
 		kvUrl: opts.kvUrl,
-		onDisposableEmail: (data) => {
-			const isNoMxRecord = data.reason === "no_mx_records";
-			const reason = isNoMxRecord ? "no_mx_records" : "disposable_email";
-			const label = isNoMxRecord ? "No MX Records" : "Disposable Email";
-			const actionLabel = data.action === "allow" ? "allowed" : "blocked";
-			const actionVerb = data.action === "allow" ? "detected" : "blocked";
-			const eventType = data.action === "allow" ? "security_allowed" : "security_blocked";
-			const displayName = isNoMxRecord ? `Security: invalid email domain ${actionVerb}` : `Security: disposable email ${actionVerb}`;
-			const description = isNoMxRecord ? `${actionVerb.charAt(0).toUpperCase() + actionVerb.slice(1)} signup attempt with invalid email domain (no MX records): ${data.email}` : `${actionVerb.charAt(0).toUpperCase() + actionVerb.slice(1)} signup attempt with disposable email: ${data.email} (${data.reason}, ${data.confidence} confidence)`;
-			logger.info(`[Sentinel] Tracking ${reason} event for email: ${data.email} (action: ${actionLabel})`);
-			trackEvent({
-				eventKey: data.email,
-				eventType,
-				eventDisplayName: displayName,
-				eventData: {
-					action: actionLabel,
-					reason,
-					identifier: data.email,
-					detectionLabel: label,
-					description,
-					path: data.path
-				},
-				ipAddress: data.ip
-			});
-		}
+		trackEvent
 	});
 	return {
 		id: "sentinel",
@@ -2075,8 +2091,16 @@ const sentinel = (options) => {
 							if (!ctx) return;
 							const visitorId = ctx.context.visitorId;
 							if (visitorId && opts.security?.freeTrialAbuse?.enabled) {
+								recordCheck(ctx, "free_trial_abuse");
 								const abuseCheck = await securityService.checkFreeTrialAbuse(visitorId);
-								if (abuseCheck.isAbuse && abuseCheck.action === "block") throw new APIError("FORBIDDEN", { message: "Account creation is not allowed from this device." });
+								if (abuseCheck.isAbuse && abuseCheck.action === "block") {
+									setOutcome(ctx, "blocked", "free_trial_abuse", {
+										accountCount: abuseCheck.accountCount,
+										maxAccounts: abuseCheck.maxAccounts
+									});
+									emitEvaluation(ctx, trackEvent);
+									throw new APIError("FORBIDDEN", { message: "Account creation is not allowed from this device." });
+								}
 							}
 							if (user.email && typeof user.email === "string" && isEmailNormalizationEnabled(opts.security)) return { data: {
 								...user,
@@ -2095,10 +2119,29 @@ const sentinel = (options) => {
 							const visitorId = ctx.context.visitorId;
 							const identification = ctx.context.identification;
 							if (session.userId && identification?.location && visitorId) {
+								recordCheck(ctx, "impossible_travel");
 								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId);
 								if (travelCheck?.isImpossible) {
-									if (travelCheck.action === "block") throw new APIError("FORBIDDEN", { message: "Login blocked due to suspicious location change." });
-									if (travelCheck.action === "challenge" && travelCheck.challenge) throwChallengeError(travelCheck.challenge, "impossible_travel", "Unusual login location detected. Please complete a security check.");
+									if (travelCheck.action === "block") {
+										setOutcome(ctx, "blocked", "impossible_travel", {
+											from: travelCheck.from,
+											to: travelCheck.to,
+											distance: travelCheck.distance,
+											speedRequired: travelCheck.speedRequired
+										});
+										emitEvaluation(ctx, trackEvent);
+										throw new APIError("FORBIDDEN", { message: "Login blocked due to suspicious location change." });
+									}
+									if (travelCheck.action === "challenge" && travelCheck.challenge) {
+										setOutcome(ctx, "challenged", "impossible_travel", {
+											from: travelCheck.from,
+											to: travelCheck.to,
+											distance: travelCheck.distance,
+											speedRequired: travelCheck.speedRequired
+										});
+										emitEvaluation(ctx, trackEvent);
+										throwChallengeError(travelCheck.challenge, "impossible_travel", "Unusual login location detected. Please complete a security check.");
+									}
 								}
 							}
 						},
@@ -2128,6 +2171,7 @@ const sentinel = (options) => {
 								if (await securityService.checkUnknownDevice(session.userId, visitorId) && user?.email) await ctx.context.runInBackgroundOrAwait(securityService.notifyUnknownDevice(session.userId, user.email, identification));
 							}
 							if (opts.security?.staleUsers?.enabled && user) {
+								recordCheck(ctx, "stale_users");
 								const lastActiveAtForStale = activityTrackingEnabled ? user.lastActiveAt ?? null : null;
 								const staleCheck = await securityService.checkStaleUser(session.userId, lastActiveAtForStale);
 								if (staleCheck.isStale) {
@@ -2138,31 +2182,21 @@ const sentinel = (options) => {
 									if (notificationPromises.length > 0) Promise.all(notificationPromises).catch((error) => {
 										logger.error("[Sentinel] Failed to send stale account notifications:", error);
 									});
-									trackEvent({
-										eventKey: session.userId,
-										eventType: "security_stale_account",
-										eventDisplayName: "Security: stale account reactivated",
-										eventData: {
-											action: staleCheck.action === "block" ? "blocked" : staleCheck.action === "challenge" ? "challenged" : "logged",
-											reason: "stale_account_reactivation",
+									if (staleCheck.action === "block") {
+										setOutcome(ctx, "blocked", "stale_users", {
 											userId: session.userId,
 											daysSinceLastActive: staleCheck.daysSinceLastActive,
 											staleDays: staleCheck.staleDays,
 											lastActiveAt: staleCheck.lastActiveAt,
 											notifyUser: staleCheck.notifyUser,
-											notifyAdmin: staleCheck.notifyAdmin,
-											detectionLabel: "Stale Account Reactivation",
-											description: `Dormant account (inactive for ${staleCheck.daysSinceLastActive} days) became active`
-										},
-										ipAddress: identification?.ip || void 0,
-										city: identification?.location?.city || void 0,
-										country: identification?.location?.country?.name || void 0,
-										countryCode: identification?.location?.country?.code || void 0
-									});
-									if (staleCheck.action === "block") throw new APIError("FORBIDDEN", {
-										message: "This account has been inactive for an extended period. Please contact support to reactivate.",
-										code: "STALE_ACCOUNT"
-									});
+											notifyAdmin: staleCheck.notifyAdmin
+										});
+										emitEvaluation(ctx, trackEvent);
+										throw new APIError("FORBIDDEN", {
+											message: "This account has been inactive for an extended period. Please contact support to reactivate.",
+											code: "STALE_ACCOUNT"
+										});
+									}
 								}
 							}
 							if (identification?.location) await ctx.context.runInBackgroundOrAwait(securityService.storeLastLocation(session.userId, identification.location));
@@ -2225,52 +2259,23 @@ const sentinel = (options) => {
 						const requestBody = ctx.body;
 						const identifier = requestBody?.email || requestBody?.phone || requestBody?.username || void 0;
 						const powVerified = ctx.context.powVerified === true;
-						if (visitorId && powVerified) trackEvent({
-							eventKey: visitorId,
-							eventType: "security_allowed",
-							eventDisplayName: "Security: challenge completed",
-							eventData: {
-								action: "allowed",
-								reason: "pow_verified",
-								visitorId,
-								path: ctx.path,
-								userAgent: ctx.headers?.get?.("user-agent") || "",
-								identifier,
-								detectionLabel: "Challenge Completed",
-								description: identifier ? `Successfully completed security challenge for "${identifier}"` : "Successfully completed security challenge"
-							},
-							ipAddress: identification?.ip || void 0,
-							city: identification?.location?.city || void 0,
-							country: identification?.location?.country?.name || void 0,
-							countryCode: identification?.location?.country?.code || void 0
-						});
+						if (visitorId && powVerified) recordCheck(ctx, "pow_challenge");
 						if (visitorId) {
+							recordCheck(ctx, "credential_stuffing");
 							if (await securityService.isBlocked(visitorId)) {
-								trackEvent({
-									eventKey: visitorId,
-									eventType: "security_blocked",
-									eventDisplayName: "Security: credential stuffing blocked",
-									eventData: {
-										action: "blocked",
-										reason: "credential_stuffing",
-										visitorId,
-										path: ctx.path,
-										userAgent: ctx.headers?.get?.("user-agent") || "",
-										identifier,
-										detectionType: "cooldown_active",
-										detectionLabel: "Credential Stuffing",
-										description: identifier ? `Visitor attempting "${identifier}" still in cooldown from prior detection` : "Visitor still in cooldown from prior detection",
-										confidence: 1
-									},
-									ipAddress: identification?.ip || void 0,
-									city: identification?.location?.city || void 0,
-									country: identification?.location?.country?.name || void 0,
-									countryCode: identification?.location?.country?.code || void 0
+								setOutcome(ctx, "blocked", "credential_stuffing", {
+									reason: "cooldown_active",
+									visitorId,
+									confidence: 1
+								});
+								emitEvaluation(ctx, trackEvent, {
+									identifier,
+									userAgent: ctx.headers?.get?.("user-agent") || ""
 								});
 								throw new APIError(403, { message: "Too many failed attempts. Please try again later." });
 							}
 						}
-						await runSecurityChecks({
+						await runSecurityChecks(ctx, {
 							path: ctx.path,
 							identifier,
 							visitorId,
@@ -2286,12 +2291,20 @@ const sentinel = (options) => {
 							const body = ctx.body;
 							const passwordToCheck = body?.newPassword || body?.password;
 							if (passwordToCheck) {
+								recordCheck(ctx, "compromised_password");
 								const compromisedResult = await securityService.checkCompromisedPassword(passwordToCheck);
 								if (compromisedResult.compromised && compromisedResult.action) {
-									if (compromisedResult.action === "block") throw new APIError("BAD_REQUEST", {
-										message: "This password has been found in data breaches. Please choose a different password.",
-										code: "COMPROMISED_PASSWORD"
-									});
+									if (compromisedResult.action === "block") {
+										setOutcome(ctx, "blocked", "compromised_password", { breachCount: compromisedResult.breachCount });
+										emitEvaluation(ctx, trackEvent, {
+											identifier,
+											userAgent: ctx.headers?.get?.("user-agent") || ""
+										});
+										throw new APIError("BAD_REQUEST", {
+											message: "This password has been found in data breaches. Please choose a different password.",
+											code: "COMPROMISED_PASSWORD"
+										});
+									}
 								}
 							}
 						}
@@ -2304,6 +2317,10 @@ const sentinel = (options) => {
 					const visitorId = ctx.context.visitorId;
 					const identification = ctx.context.identification;
 					const body = ctx.body;
+					emitEvaluation(ctx, trackEvent, {
+						identifier: body?.email,
+						userAgent: ctx.headers?.get?.("user-agent") || ""
+					});
 					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email && body?.password && visitorId) {
 						const { email, password } = body;
 						const ip = identification?.ip || null;
@@ -2754,7 +2771,7 @@ const jwtValidateMiddleware = (options) => createAuthMiddleware(async (ctx) => {
 });
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.2.5";
+const PLUGIN_VERSION = "0.2.6";
 //#endregion
 //#region src/routes/auth/config.ts
 const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
@@ -3068,6 +3085,12 @@ function getScimEndpoint(baseUrl) {
 function getSCIMPlugin(ctx) {
 	return ctx.context.getPlugin("scim");
 }
+const DIRECTORY_SYNC_DUPLICATE_MESSAGE = "A directory sync connection with this provider ID already exists. Remove the existing connection or choose a different provider ID.";
+function isDuplicateDirectorySyncError(e) {
+	if (e instanceof APIError$1) return e.status === "CONFLICT" || /duplicate|already exists|unique constraint/i.test(e.message ?? "");
+	if (e instanceof Error) return /unique constraint|duplicate key|already exists|P2002/i.test(e.message);
+	return false;
+}
 const listOrganizationDirectories = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/directories", {
 		method: "GET",
@@ -3118,14 +3141,22 @@ const createOrganizationDirectory = (options) => {
 		const scimPlugin = getSCIMPlugin(ctx);
 		if (!scimPlugin?.endpoints.generateSCIMToken || !scimPlugin?.options?.providerOwnership?.enabled) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { providerId, ownerUserId } = ctx.body;
-		const { scimToken } = await scimPlugin.endpoints.generateSCIMToken({
-			body: {
-				providerId,
-				organizationId
-			},
-			context: await buildSyntheticSession(ctx, ownerUserId),
-			headers: ctx.request?.headers ?? new Headers()
-		});
+		let scimToken;
+		try {
+			scimToken = (await scimPlugin.endpoints.generateSCIMToken({
+				body: {
+					providerId,
+					organizationId
+				},
+				context: await buildSyntheticSession(ctx, ownerUserId),
+				headers: ctx.request?.headers ?? new Headers()
+			})).scimToken;
+		} catch (e) {
+			if (isDuplicateDirectorySyncError(e)) throw ctx.error("BAD_REQUEST", { message: DIRECTORY_SYNC_DUPLICATE_MESSAGE });
+			ctx.context.logger.error("[Dash] Failed to create directory sync provider (organizationId=%s, providerId=%s)", organizationId, providerId, e);
+			if (e instanceof APIError$1) throw e;
+			throw ctx.error("INTERNAL_SERVER_ERROR", { message: "Failed to create directory sync provider" });
+		}
 		if (!scimToken) throw ctx.error("INTERNAL_SERVER_ERROR", { message: "Failed to create directory sync provider" });
 		return {
 			organizationId,
@@ -3234,8 +3265,11 @@ const getUserEvents = (options) => {
 		method: "GET",
 		use: [sessionMiddleware],
 		query: z$1.object({
+			/** Maximum number of events to return (default: 50, max: 100) */
 			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
+			/** Number of events to skip for pagination (default: 0) */
 			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
+			/** Filter by event type (e.g., "user_signed_in") */
 			eventType: z$1.string().optional()
 		}).optional()
 	}, async (ctx) => {
@@ -3383,6 +3417,113 @@ const getAuditLogs = (options) => {
 		};
 	});
 };
+const OWNER_ADMIN_ROLES = new Set(["owner", "admin"]);
+function isOwnerOrAdminRole(role) {
+	return role !== void 0 && OWNER_ADMIN_ROLES.has(role);
+}
+/**
+* Get all audit logs the current user has access to
+* Queries can be restricted to a single organization, a single user, or all organizations the user has access to
+* @param options
+* @returns
+*/
+const getAllAuditLogs = (options) => {
+	const $fetch = createFetch({
+		baseURL: options.apiUrl,
+		headers: { "x-api-key": options.apiKey }
+	});
+	const getUserOrganizationRole = async (adapter, orgId, userId) => {
+		return (await adapter.findOne({
+			model: "member",
+			where: [{
+				field: "organizationId",
+				value: orgId
+			}, {
+				field: "userId",
+				value: userId
+			}],
+			select: ["role"]
+		}))?.role;
+	};
+	const listElevatedOrganizationIds = async (adapter, userId) => {
+		const memberships = await adapter.findMany({
+			model: "member",
+			where: [{
+				field: "userId",
+				value: userId
+			}],
+			select: ["organizationId", "role"]
+		});
+		const ids = /* @__PURE__ */ new Set();
+		for (const m of memberships) if (isOwnerOrAdminRole(m.role)) ids.add(m.organizationId);
+		return [...ids];
+	};
+	return createAuthEndpoint("/events/all-audit-logs", {
+		method: "GET",
+		use: [sessionMiddleware],
+		query: z$1.object({
+			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
+			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
+			userId: z$1.string().optional(),
+			organizationId: z$1.string().optional(),
+			/** Filter by event type (e.g. `organization_member_added`) */
+			eventType: z$1.string().optional(),
+			/** Match `eventData.identifier` (organization-scoped actor identity) */
+			identifier: z$1.string().optional()
+		}).refine((q) => {
+			const u = q.userId?.trim();
+			const o = q.organizationId?.trim();
+			return !(u && o);
+		}, { message: "Provide at most one of userId and organizationId." }).optional()
+	}, async (ctx) => {
+		const session = ctx.context.session;
+		if (!session?.user?.id) throw ctx.error("UNAUTHORIZED", { message: "You must be signed in to view activity logs" });
+		if (!options.apiKey) throw ctx.error("INTERNAL_SERVER_ERROR", { message: "Events API is not configured" });
+		const query = ctx.query ?? {};
+		const adapter = ctx.context.adapter;
+		const sessionUserId = session.user.id;
+		const limit = Math.min(Math.max(1, query.limit ?? 50), 100);
+		const offset = Math.max(0, query.offset ?? 0);
+		const organizationId = query.organizationId?.trim();
+		const userId = query.userId?.trim();
+		const forbidAccess = () => {
+			return ctx.error("FORBIDDEN", { message: "Only organization owners and admins can view activity logs." });
+		};
+		const elevatedOrgIds = await listElevatedOrganizationIds(adapter, sessionUserId);
+		if (organizationId) {
+			if (!isOwnerOrAdminRole(await getUserOrganizationRole(adapter, organizationId, sessionUserId))) throw forbidAccess();
+		} else if (userId) {
+			if (elevatedOrgIds.length === 0) throw forbidAccess();
+		} else if (elevatedOrgIds.length === 0) throw forbidAccess();
+		const apiQuery = {
+			limit: limit.toString(),
+			offset: offset.toString()
+		};
+		if (organizationId) apiQuery.organizationIds = organizationId;
+		else if (userId) {
+			apiQuery.userId = userId;
+			apiQuery.organizationIds = elevatedOrgIds.join(",");
+		} else apiQuery.organizationIds = elevatedOrgIds.join(",");
+		const eventTypeFilter = query.eventType?.trim();
+		const identifierFilter = query.identifier?.trim();
+		if (eventTypeFilter) apiQuery.eventType = eventTypeFilter;
+		if (identifierFilter) apiQuery.identifier = identifierFilter;
+		const { data, error } = await $fetch("/events/activity", {
+			method: "GET",
+			query: apiQuery
+		});
+		if (error || !data) {
+			ctx.context.logger.error("[Dash] Failed to fetch activity logs:", error);
+			throw ctx.error("INTERNAL_SERVER_ERROR", { message: "Failed to fetch activity logs" });
+		}
+		return {
+			events: data.events.map(transformEvent),
+			total: data.total,
+			limit: data.limit,
+			offset: data.offset
+		};
+	});
+};
 //#endregion
 //#region src/routes/execute-adapter/index.ts
 const whereClause = z.object({
@@ -6674,7 +6815,7 @@ const updateUser = (options) => createAuthEndpoint("/dash/update-user", {
 	const updateData = ctx.body;
 	const userId = ctx.context.payload?.userId;
 	if (!userId) throw new APIError("FORBIDDEN", { message: "Invalid payload" });
-	const filteredData = Object.fromEntries(Object.entries(updateData).filter(([_, value]) => value !== void 0));
+	const filteredData = Object.fromEntries(Object.entries(updateData).filter(([, value]) => value !== void 0));
 	if (Object.keys(filteredData).length === 0) throw new APIError("BAD_REQUEST", { message: "No valid fields to update" });
 	const user = await ctx.context.internalAdapter.updateUser(userId, {
 		...filteredData,
@@ -7874,6 +8015,7 @@ const dash = (options) => {
 			dashGenerateBackupCodes: generateBackupCodes(opts),
 			getUserEvents: getUserEvents(opts),
 			getAuditLogs: getAuditLogs(opts),
+			getAllAuditLogs: getAllAuditLogs(opts),
 			getEventTypes: getEventTypes(opts),
 			dashAcceptInvitation: acceptInvitation(opts),
 			dashCompleteInvitation: completeInvitation(opts),

package/dist/native.d.mts

@@ -1,4 +1,4 @@
-import { a as dashClient, i as DashGetAuditLogsInput, n as DashAuditLogsResponse, r as DashClientOptions, t as DashAuditLog } from "./dash-client-hJHp7l_X.mjs";
+import { a as DashGetAuditLogsInput, i as DashGetAllAuditLogsInput, n as DashAuditLogsResponse, o as dashClient, r as DashClientOptions, t as DashAuditLog } from "./dash-client-CVCHbtoB.mjs";
 import { BetterAuthClientPlugin } from "better-auth";
 
 //#region src/sentinel/native/client.d.ts
@@ -15,4 +15,4 @@ interface SentinelNativeClientOptions {
 }
 declare const sentinelNativeClient: (options?: SentinelNativeClientOptions) => BetterAuthClientPlugin;
 //#endregion
-export { type DashAuditLog, type DashAuditLogsResponse, type DashClientOptions, type DashGetAuditLogsInput, type SentinelNativeClientOptions, dashClient, sentinelNativeClient };
+export { type DashAuditLog, type DashAuditLogsResponse, type DashClientOptions, type DashGetAllAuditLogsInput, type DashGetAuditLogsInput, type SentinelNativeClientOptions, dashClient, sentinelNativeClient };

package/dist/native.mjs

@@ -1,4 +1,4 @@
-import { a as identify, c as dashClient, n as encodePoWSolution, o as bytesToHex, r as solvePoWChallenge, t as decodePoWChallenge } from "./pow-BUuN_EKw.mjs";
+import { a as identify, c as dashClient, n as encodePoWSolution, o as bytesToHex, r as solvePoWChallenge, t as decodePoWChallenge } from "./pow-CT9ehp8e.mjs";
 import { env } from "@better-auth/core/env";
 import { Dimensions, InteractionManager, PixelRatio, Platform } from "react-native";
 //#region src/sentinel/native/components.ts

package/dist/{pow-BUuN_EKw.mjs → pow-CT9ehp8e.mjs}

@@ -10,21 +10,39 @@ function resolveDashUserId(input, options) {
 const dashClient = (options) => {
 	return {
 		id: "dash",
-		getActions: ($fetch) => ({ dash: { getAuditLogs: async (input = {}) => {
-			const userId = resolveDashUserId(input, options);
-			return $fetch("/events/audit-logs", {
-				method: "GET",
-				query: {
-					limit: input.limit,
-					offset: input.offset,
-					organizationId: input.organizationId,
-					identifier: input.identifier,
-					eventType: input.eventType,
-					userId
-				}
-			});
-		} } }),
-		pathMethods: { "/events/audit-logs": "GET" }
+		getActions: ($fetch) => ({ dash: {
+			getAuditLogs: async (input = {}) => {
+				const userId = resolveDashUserId(input, options);
+				return $fetch("/events/audit-logs", {
+					method: "GET",
+					query: {
+						limit: input.limit,
+						offset: input.offset,
+						organizationId: input.organizationId,
+						identifier: input.identifier,
+						eventType: input.eventType,
+						userId
+					}
+				});
+			},
+			getAllAuditLogs: async (input = {}) => {
+				return $fetch("/events/all-audit-logs", {
+					method: "GET",
+					query: {
+						limit: input.limit,
+						offset: input.offset,
+						organizationId: input.organizationId,
+						userId: input.userId,
+						eventType: input.eventType,
+						identifier: input.identifier
+					}
+				});
+			}
+		} }),
+		pathMethods: {
+			"/events/audit-logs": "GET",
+			"/events/all-audit-logs": "GET"
+		}
 	};
 };
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
@@ -11,9 +11,9 @@
     "build": "tsdown",
     "dev": "tsdown --watch --no-clean",
     "typecheck": "tsc --noEmit",
-    "test": "bun test",
+    "test": "bun test --parallel",
     "test:watch": "bun test --watch",
-    "coverage": "bun test --coverage"
+    "coverage": "bun test --coverage --parallel"
   },
   "exports": {
     ".": {
@@ -69,8 +69,8 @@
     "better-auth": "catalog:",
     "expo-crypto": "^14.0.2",
     "happy-dom": "^20.9.0",
-    "msw": "^2.13.3",
-    "tsdown": "^0.21.9",
+    "msw": "^2.14.3",
+    "tsdown": "^0.21.10",
     "typescript": "catalog:",
     "zod": "catalog:"
   },
@@ -78,7 +78,7 @@
     "@better-fetch/fetch": "^1.1.21",
     "better-call": "^1.3.3",
     "jose": "^6.1.0",
-    "libphonenumber-js": "^1.12.36"
+    "libphonenumber-js": "^1.12.42"
   },
   "peerDependencies": {
     "better-auth": ">=1.4.0",