@better-auth/infra 0.2.5 → 0.2.7

package/dist/index.mjs

@@ -1,10 +1,11 @@
-import { n as INFRA_KV_URL, r as KV_TIMEOUT_MS, t as INFRA_API_URL } from "./constants-DdWGfvz1.mjs";
+import { n as INFRA_API_URL, r as INFRA_KV_URL } from "./constants-CvriWQVc.mjs";
+import { n as createKV, t as createAPI } from "./fetch-DiAhoiKA.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { APIError, generateId, getAuthTables, logger, parseState } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { APIError as APIError$1, createAuthEndpoint, createAuthMiddleware, requestPasswordReset, sendVerificationEmailFn, sessionMiddleware } from "better-auth/api";
 import { getCurrentAuthContext } from "@better-auth/core/context";
-import { betterFetch, createFetch } from "@better-fetch/fetch";
+import { createFetch } from "@better-fetch/fetch";
 import { isValidPhoneNumber, parsePhoneNumberFromString } from "libphonenumber-js";
 import { createLocalJWKSet, jwtVerify } from "jose";
 import z$1, { z } from "zod";
@@ -14,7 +15,9 @@ function resolveConnectionOptions(options) {
 	return {
 		apiUrl: options?.apiUrl || INFRA_API_URL,
 		kvUrl: options?.kvUrl || INFRA_KV_URL,
-		apiKey: options?.apiKey || env.BETTER_AUTH_API_KEY || ""
+		apiKey: options?.apiKey || env.BETTER_AUTH_API_KEY || "",
+		apiTimeout: options?.apiTimeout ?? 3e3,
+		kvTimeout: options?.kvTimeout ?? 1e3
 	};
 }
 function resolveDashOptions(options) {
@@ -96,6 +99,8 @@ const routes = {
 	EMAIL_OTP_SEND: "/email-otp/send-verification-otp",
 	PHONE_SEND_OTP: "/phone-number/send-otp",
 	PHONE_VERIFY_OTP: "/phone-number/verify-phone-number",
+	DEVICE_TOKEN: "/device/token",
+	SIWE_VERIFY: "/siwe/verify",
 	ORG_CREATE: "/organization/create",
 	ORG_INVITE_MEMBER: "/organization/invite-member",
 	API_KEY_CREATE: "/api-key/create",
@@ -109,7 +114,8 @@ const routes = {
 	ADMIN_REVOKE_USER_SESSIONS: "/admin/revoke-user-sessions",
 	ADMIN_SET_PASSWORD: "/admin/set-user-password",
 	ADMIN_BAN_USER: "/admin/ban-user",
-	ADMIN_UNBAN_USER: "/admin/unban-user"
+	ADMIN_UNBAN_USER: "/admin/unban-user",
+	ADMIN_IMPERSONATE_USER: "/admin/impersonate-user"
 };
 const ORGANIZATION_EVENT_TYPES = {
 	ORGANIZATION_CREATED: "organization_created",
@@ -308,16 +314,33 @@ const matchesAnyRoute = (path, routes) => {
 };
 //#endregion
 //#region src/events/login-methods.ts
-const loginPaths = [
-	routes.SIGN_IN_SOCIAL_CALLBACK,
-	routes.SIGN_IN_OAUTH_CALLBACK,
-	routes.SIGN_IN_EMAIL,
-	routes.SIGN_IN_SOCIAL,
-	routes.SIGN_IN_EMAIL_OTP,
-	routes.SIGN_UP_EMAIL
+const OAUTH_CALLBACK_PATHS = [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK];
+const PATH_TO_METHOD = [
+	[routes.SIGN_IN_EMAIL, "email"],
+	[routes.SIGN_UP_EMAIL, "email"],
+	[routes.SIGN_IN_USERNAME, "username"],
+	[routes.SIGN_IN_EMAIL_OTP, "email-otp"],
+	[routes.SIGN_IN_SOCIAL, "social"],
+	[routes.SIGN_IN_ANONYMOUS, "anonymous"],
+	[routes.SIGN_IN_PASSKEY, "passkey"],
+	[routes.SIGN_IN_MAGIC_LINK, "magic-link"],
+	[routes.MAGIC_LINK_VERIFY, "magic-link"],
+	[routes.SIGN_IN_SSO, "sso"],
+	[routes.PHONE_VERIFY_OTP, "phone"],
+	[routes.TWO_FACTOR_VERIFY_TOTP, "totp"],
+	[routes.TWO_FACTOR_VERIFY_OTP, "two-factor-otp"],
+	[routes.TWO_FACTOR_VERIFY_BACKUP, "backup-code"],
+	[routes.ADMIN_IMPERSONATE_USER, "impersonation"],
+	[routes.DEVICE_TOKEN, "device-code"],
+	[routes.SIWE_VERIFY, "siwe"]
 ];
 const getLoginMethod = (ctx) => {
-	if (matchesAnyRoute(ctx.path, loginPaths)) return ctx.params?.id ? ctx.params.id : ctx.path.split("/").pop();
+	if (matchesAnyRoute(ctx.path, OAUTH_CALLBACK_PATHS)) {
+		const id = ctx.params?.id;
+		if (typeof id === "string" && id && !id.startsWith(":")) return id;
+		return null;
+	}
+	for (const [path, method] of PATH_TO_METHOD) if (matchesAnyRoute(ctx.path, [path])) return method;
 	return null;
 };
 //#endregion
@@ -812,18 +835,11 @@ const getOrganizationTriggerInfo = (user) => {
 };
 //#endregion
 //#region src/events/index.ts
-const initTrackEvents = (options) => {
-	const $fetch = createFetch({
-		baseURL: options.apiUrl,
-		headers: {
-			"user-agent": "better-auth",
-			"x-api-key": options.apiKey
-		}
-	});
+const initTrackEvents = ($api) => {
 	const trackEvent = (data) => {
 		const track = async () => {
 			try {
-				await $fetch("/events/track", {
+				await $api("/events/track", {
 					method: "POST",
 					body: {
 						eventType: data.eventType,
@@ -874,11 +890,10 @@ function maybeCleanup() {
 /**
 * Fetch identification data from durable-kv by requestId
 */
-async function getIdentification(requestId, apiKey, kvUrl) {
+async function getIdentification(requestId, $kv) {
 	maybeCleanup();
 	const cached = identificationCache.get(requestId);
 	if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) return cached.data;
-	const baseUrl = kvUrl || INFRA_KV_URL;
 	const maxRetries = 3;
 	const retryDelays = [
 		50,
@@ -886,24 +901,20 @@ async function getIdentification(requestId, apiKey, kvUrl) {
 		200
 	];
 	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
-		const response = await fetch(`${baseUrl}/identify/${requestId}`, {
-			method: "GET",
-			headers: { "x-api-key": apiKey },
-			signal: AbortSignal.timeout(KV_TIMEOUT_MS)
-		});
-		if (response.ok) {
-			const data = await response.json();
+		const { data, error } = await $kv(`/identify/${requestId}`, { method: "GET" });
+		if (data && !error) {
 			identificationCache.set(requestId, {
 				data,
 				timestamp: Date.now()
 			});
 			return data;
 		}
-		if (response.status === 404 && attempt < maxRetries) {
+		const status = error?.status;
+		if (status === 404 && attempt < maxRetries) {
 			await new Promise((resolve) => setTimeout(resolve, retryDelays[attempt]));
 			continue;
 		}
-		if (response.status !== 404) identificationCache.set(requestId, {
+		if (status !== 404) identificationCache.set(requestId, {
 			data: null,
 			timestamp: Date.now()
 		});
@@ -931,16 +942,19 @@ function extractIdentificationHeaders(request) {
 	};
 }
 /**
-* Early middleware that loads identification data
+* Early middleware that loads identification data.
+*
+* @param $kv — KV client from {@link createKV} for the same plugin options (one instance per plugin).
 */
-function createIdentificationMiddleware(options) {
+function createIdentificationMiddleware($kv) {
 	return createAuthMiddleware(async (ctx) => {
 		const { visitorId, requestId: headerRequestId } = extractIdentificationHeaders(ctx.request);
 		const requestId = headerRequestId ?? ctx.getCookie("__infra-rid") ?? null;
 		ctx.context.visitorId = visitorId;
 		ctx.context.requestId = requestId;
-		if (requestId) ctx.context.identification = ctx.context.identification ?? await getIdentification(requestId, options.apiKey, options.kvUrl) ?? null;
-		else ctx.context.identification = null;
+		if (requestId) {
+			if (ctx.context.identification === void 0) ctx.context.identification = await getIdentification(requestId, $kv) ?? null;
+		} else ctx.context.identification = null;
 		const ipConfig = ctx.context.options?.advanced?.ipAddress;
 		if (ipConfig?.disableIpTracking === true) {
 			ctx.context.location = void 0;
@@ -997,6 +1011,59 @@ function getCountryCodeFromRequest(request) {
 	return cc ? cc.toUpperCase() : void 0;
 }
 //#endregion
+//#region src/sentinel/evaluation.ts
+/** Lazily attach the buffer to the request context. */
+function getEvaluation(ctx) {
+	if (!ctx.context.sentinelEvaluation) ctx.context.sentinelEvaluation = {
+		checks: /* @__PURE__ */ new Set(),
+		outcome: "passed",
+		emitted: false
+	};
+	return ctx.context.sentinelEvaluation;
+}
+function recordCheck(ctx, name) {
+	getEvaluation(ctx).checks.add(name);
+}
+/** Call immediately before throwing so the buffer reflects the final outcome. */
+function setOutcome(ctx, outcome, triggeredBy, details) {
+	const ev = getEvaluation(ctx);
+	ev.outcome = outcome;
+	ev.triggeredBy = triggeredBy;
+	if (details) ev.details = details;
+}
+/**
+* Emit one `security_check` event for the request. Idempotent per request and
+* skipped when no checks ran (unprotected route, or short-circuit before any
+* sentinel hook). `evaluatedChecks` carries the per-type breakdown — all under
+* the same Stripe meter, so the array is for support inspection only.
+*/
+function emitEvaluation(ctx, trackEvent, options = {}) {
+	const ev = ctx.context.sentinelEvaluation;
+	if (!ev || ev.emitted || ev.checks.size === 0) return;
+	ev.emitted = true;
+	const identification = ctx.context.identification ?? null;
+	const visitorId = ctx.context.visitorId ?? null;
+	const path = ctx.path ?? "";
+	trackEvent({
+		eventKey: visitorId || identification?.ip || "unknown",
+		eventType: "security_check",
+		eventDisplayName: ev.outcome === "blocked" ? "Security: blocked" : ev.outcome === "challenged" ? "Security: challenged" : "Security: passed",
+		eventData: {
+			outcome: ev.outcome,
+			evaluatedChecks: [...ev.checks].sort(),
+			triggeredBy: ev.triggeredBy,
+			identifier: options.identifier,
+			path,
+			userAgent: options.userAgent,
+			details: ev.details
+		},
+		ipAddress: identification?.ip || void 0,
+		city: identification?.location?.city || void 0,
+		country: identification?.location?.country?.name || void 0,
+		countryCode: identification?.location?.country?.code || void 0
+	});
+}
+//#endregion
 //#region src/sentinel/security.ts
 async function hashForFingerprint(input) {
 	const data = new TextEncoder().encode(input);
@@ -1011,23 +1078,19 @@ async function sha1Hash(input) {
 /**
 * Whether Sentinel should normalize emails for deduplication/sign-in consistency.
 * If `emailNormalization` is set, it wins; otherwise legacy behavior uses `emailValidation.enabled`.
-* @internal Not part of the package public API; used by the sentinel plugin and email helpers.
 */
 function isEmailNormalizationEnabled(security) {
 	const explicit = security?.emailNormalization;
 	if (explicit !== void 0) return explicit.enabled !== false;
 	return security?.emailValidation?.enabled !== false;
 }
-function createSecurityClient(apiUrl, apiKey, options, onSecurityEvent) {
-	const resolvedApiUrl = apiUrl || INFRA_API_URL;
-	const $api = createFetch({
-		baseURL: resolvedApiUrl,
-		headers: { "x-api-key": apiKey },
-		throw: true
-	});
+/**
+* @param $api — Dash client from `createAPI(opts, { throw: true })`.
+*/
+function createSecurityClient(conn, $api, options, onSecurityEvent) {
 	const emailSender = createEmailSender({
-		apiUrl: resolvedApiUrl,
-		apiKey
+		apiUrl: conn.apiUrl || INFRA_API_URL,
+		apiKey: conn.apiKey
 	});
 	function logEvent(event) {
 		const fullEvent = {
@@ -1183,6 +1246,9 @@ function createSecurityClient(apiUrl, apiKey, options, onSecurityEvent) {
 				return null;
 			}
 		},
+		/**
+		* Store user's last known location for impossible travel detection
+		*/
 		async storeLastLocation(userId, location) {
 			if (!location) return;
 			try {
@@ -1197,6 +1263,9 @@ function createSecurityClient(apiUrl, apiKey, options, onSecurityEvent) {
 				logger.error("[Dash] Store last location error:", error);
 			}
 		},
+		/**
+		* Check if a visitor has exceeded the free trial signup limit.
+		*/
 		async checkFreeTrialAbuse(visitorId) {
 			if (!options.freeTrialAbuse?.enabled) return {
 				isAbuse: false,
@@ -1235,6 +1304,10 @@ function createSecurityClient(apiUrl, apiKey, options, onSecurityEvent) {
 				};
 			}
 		},
+		/**
+		* Track a new signup for free trial abuse detection.
+		* Stores the userId for auditing purposes.
+		*/
 		async trackFreeTrialSignup(visitorId, userId) {
 			if (!options.freeTrialAbuse?.enabled) return;
 			try {
@@ -1285,6 +1358,10 @@ function createSecurityClient(apiUrl, apiKey, options, onSecurityEvent) {
 				return { compromised: false };
 			}
 		},
+		/**
+		* Check if a user account is stale (inactive for a configured period)
+		* This helps detect potential account takeover when dormant accounts become active
+		*/
 		async checkStaleUser(userId, lastActiveAt) {
 			if (!options.staleUsers?.enabled) return { isStale: false };
 			try {
@@ -1317,6 +1394,9 @@ function createSecurityClient(apiUrl, apiKey, options, onSecurityEvent) {
 				return { isStale: false };
 			}
 		},
+		/**
+		* Send stale account reactivation notification to the user
+		*/
 		async notifyStaleAccountUser(userEmail, userName, daysSinceLastActive, identification, appName) {
 			const loginTime = (/* @__PURE__ */ new Date()).toLocaleString("en-US", {
 				dateStyle: "long",
@@ -1344,6 +1424,9 @@ function createSecurityClient(apiUrl, apiKey, options, onSecurityEvent) {
 			if (result.success) logger.info(`[Dash] Stale account notification sent to user: ${userEmail}`);
 			else logger.error(`[Dash] Failed to send stale account user notification: ${result.error}`);
 		},
+		/**
+		* Send stale account reactivation notification to the admin
+		*/
 		async notifyStaleAccountAdmin(adminEmail, userId, userEmail, userName, daysSinceLastActive, identification, appName) {
 			const loginTime = (/* @__PURE__ */ new Date()).toLocaleString("en-US", {
 				dateStyle: "long",
@@ -1412,7 +1495,9 @@ const all = new Set([
 	"/forget-password",
 	"/request-password-reset",
 	"/send-verification-email",
-	"/change-email"
+	"/change-email",
+	"/organization/invite-member",
+	"/dash/organization/invite-member"
 ]);
 /**
 * Path is one of `[
@@ -1429,7 +1514,9 @@ const all = new Set([
 *   '/forget-password',
 *   '/request-password-reset',
 *   '/send-verification-email',
-*   '/change-email'
+*   '/change-email',
+*   '/organization/invite-member',
+*   '/dash/organization/invite-member'
 * ]`.
 * @param context Request context
 * @param context.path Request path
@@ -1487,17 +1574,11 @@ function normalizeEmail(email, context) {
 	if (GMAIL_LIKE_DOMAINS.has(domain)) localPart = localPart.replace(/\./g, "");
 	return `${localPart}@${domain}`;
 }
-function createEmailValidator(options = {}) {
-	const { apiKey = "", apiUrl = INFRA_API_URL, kvUrl = INFRA_KV_URL, emailValidationOptions = {} } = options;
-	const $api = createFetch({
-		baseURL: apiUrl,
-		headers: { "x-api-key": apiKey }
-	});
-	const $kv = createFetch({
-		baseURL: kvUrl,
-		headers: { "x-api-key": apiKey },
-		timeout: KV_TIMEOUT_MS
-	});
+function hasRemoteEmailClients(options) {
+	return options.$api !== void 0 && options.$kv !== void 0;
+}
+function createEmailValidator(options) {
+	const { $api, $kv, emailValidationOptions = {} } = options;
 	/**
 	* Fetch and resolve email validity policy from API with caching
 	* Sends client config to API which merges with user's dashboard settings
@@ -1522,7 +1603,12 @@ function createEmailValidator(options = {}) {
 		}
 		return null;
 	}
-	return { async validate(email, checkMx = true) {
+	return { 
+	/**
+	* Validate an email address
+	* Returns validation result - caller should use getPolicy() to determine action
+	*/
+async validate(email, checkMx = true) {
 		const trimmed = email.trim();
 		const policy = await fetchPolicy();
 		if (!policy?.enabled) return {
@@ -1608,16 +1694,27 @@ function createEmailNormalizationHook() {
 	};
 }
 /**
-* Create email validation hook with configurable validation strategy
+* Records `email_validity` on every email-bearing request. On block, emits the
+* `security_check` event inline before throwing — the after-hook won't run on throw.
 */
-function createEmailValidationHook(validator, onDisposableEmail) {
+function createEmailValidationHook(validator, trackEvent) {
 	return {
 		matcher: allEmail,
 		handler: createAuthMiddleware(async (ctx) => {
 			const { email } = getEmail(ctx);
 			if (typeof email !== "string") return;
 			const trimmed = email.trim();
-			if (!isValidEmailFormatLocal(trimmed)) throw new APIError$1("BAD_REQUEST", { message: "Invalid email" });
+			recordCheck(ctx, "email_validity");
+			if (!isValidEmailFormatLocal(trimmed)) {
+				if (trackEvent) {
+					setOutcome(ctx, "blocked", "email_validity", {
+						reason: "invalid_format",
+						email: trimmed
+					});
+					emitEvaluation(ctx, trackEvent, { identifier: trimmed });
+				}
+				throw new APIError$1("BAD_REQUEST", { message: "Invalid email" });
+			}
 			if (validator) {
 				const result = await validator.validate(trimmed);
 				const policy = result.policy;
@@ -1628,19 +1725,17 @@ function createEmailValidationHook(validator, onDisposableEmail) {
 				}
 				const action = policy.action;
 				if (!result.valid) {
-					if ((result.disposable || result.reason === "no_mx_records" || result.reason === "blocklist" || result.reason === "known_invalid_email" || result.reason === "known_invalid_host" || result.reason === "reserved_tld" || result.reason === "provider_local_too_short") && onDisposableEmail) {
-						const ip = ctx.request?.headers?.get("x-forwarded-for")?.split(",")[0] || ctx.request?.headers?.get("cf-connecting-ip") || void 0;
-						onDisposableEmail({
-							email: trimmed,
-							reason: result.reason || "disposable",
+					if (action === "allow") return;
+					const message = result.reason === "no_mx_records" ? "This email domain cannot receive emails" : result.disposable || result.reason === "blocklist" ? "Disposable email addresses are not allowed" : result.reason === "known_invalid_email" || result.reason === "known_invalid_host" || result.reason === "reserved_tld" || result.reason === "provider_local_too_short" ? "This email address appears to be invalid" : "Invalid email";
+					if (trackEvent) {
+						setOutcome(ctx, "blocked", "email_validity", {
+							reason: result.reason,
 							confidence: result.confidence,
-							ip,
-							path: ctx.path,
-							action
+							email: trimmed
 						});
+						emitEvaluation(ctx, trackEvent, { identifier: trimmed });
 					}
-					if (action === "allow") return;
-					throw new APIError$1("BAD_REQUEST", { message: result.reason === "no_mx_records" ? "This email domain cannot receive emails" : result.disposable || result.reason === "blocklist" ? "Disposable email addresses are not allowed" : result.reason === "known_invalid_email" || result.reason === "known_invalid_host" || result.reason === "reserved_tld" || result.reason === "provider_local_too_short" ? "This email address appears to be invalid" : "Invalid email" });
+					throw new APIError$1("BAD_REQUEST", { message });
 				}
 			}
 		})
@@ -1657,18 +1752,10 @@ function createEmailValidationHook(validator, onDisposableEmail) {
 *
 * @example
 * // API-backed validation
-* createEmailHooks({ useApi: true, apiKey: "your-api-key" })
-*
-* @example
-* // High strictness + API
-* createEmailHooks({
-*   emailValidationOptions: { strictness: "high" },
-*   useApi: true,
-*   apiKey: "your-api-key",
-* })
+* createEmailHooks({ $api, $kv })
 */
 function createEmailHooks(options = {}) {
-	const { emailValidationOptions, emailNormalizationOptions, useApi = false, apiKey = "", apiUrl = INFRA_API_URL, kvUrl = INFRA_KV_URL, onDisposableEmail } = options;
+	const { emailValidationOptions, emailNormalizationOptions, trackEvent } = options;
 	const emailConfig = {
 		enabled: true,
 		strictness: "medium",
@@ -1678,12 +1765,11 @@ function createEmailHooks(options = {}) {
 	return { before: [...isEmailNormalizationEnabled({
 		emailValidation: emailValidationOptions,
 		emailNormalization: emailNormalizationOptions
-	}) ? [createEmailNormalizationHook()] : [], ...emailConfig.enabled ? [createEmailValidationHook(useApi ? createEmailValidator({
-		apiUrl,
-		kvUrl,
-		apiKey,
+	}) ? [createEmailNormalizationHook()] : [], ...emailConfig.enabled ? [createEmailValidationHook(hasRemoteEmailClients(options) ? createEmailValidator({
+		$api: options.$api,
+		$kv: options.$kv,
 		emailValidationOptions: emailConfig
-	}) : void 0, onDisposableEmail)] : []] };
+	}) : void 0, trackEvent)] : []] };
 }
 //#endregion
 //#region src/validation/phone.ts
@@ -1898,32 +1984,6 @@ const ERROR_MESSAGES = {
 	compromised_password: "This password has been found in data breaches. Please choose a different password.",
 	impossible_travel: "Login blocked due to suspicious location change."
 };
-const DISPLAY_NAMES = {
-	geo_blocked: {
-		challenge: "Security: geo challenge",
-		block: "Security: geo blocked"
-	},
-	bot_detected: {
-		challenge: "Security: bot challenge",
-		block: "Security: bot blocked"
-	},
-	suspicious_ip_detected: {
-		challenge: "Security: anonymous IP challenge",
-		block: "Security: anonymous IP blocked"
-	},
-	rate_limited: {
-		challenge: "Security: velocity challenge",
-		block: "Security: velocity exceeded"
-	},
-	compromised_password: {
-		challenge: "Security: breached password warning",
-		block: "Security: breached password blocked"
-	},
-	impossible_travel: {
-		challenge: "Security: impossible travel challenge",
-		block: "Security: impossible travel blocked"
-	}
-};
 /**
 * Throw a challenge error with appropriate headers
 */
@@ -1938,86 +1998,68 @@ function throwChallengeError(challenge, reason, message = "Please complete a sec
 	};
 	throw error;
 }
-/**
-* Build common event data for security tracking
-*/
-function buildEventData(ctx, action, reason, confidence = 1, extraData) {
-	const { visitorId, identification, path, identifier, userAgent } = ctx;
-	const countryCode = identification?.location?.country?.code || void 0;
-	return {
-		eventKey: visitorId || identification?.ip || "unknown",
-		eventType: action === "challenged" ? "security_challenged" : "security_blocked",
-		eventDisplayName: DISPLAY_NAMES[reason]?.[action === "challenged" ? "challenge" : "block"] || `Security: ${reason}`,
-		eventData: {
-			action,
-			reason,
-			visitorId: visitorId || "",
-			path,
-			userAgent,
-			identifier,
-			confidence,
-			...extraData
-		},
-		ipAddress: identification?.ip || void 0,
-		city: identification?.location?.city || void 0,
-		country: identification?.location?.country?.name || void 0,
-		countryCode
-	};
-}
-/**
-* Handle a security check result by tracking events and throwing appropriate errors
-*
-* @param verdict - The security verdict from the security service
-* @param ctx - Security check context with request information
-* @param trackEvent - Function to track security events
-* @param securityService - Security service for generating challenges
-* @returns True if the request should be blocked
-*/
-async function handleSecurityVerdict(verdict, ctx, trackEvent, securityService) {
+/** Emits the `security_check` event inline before throwing — the after-hook won't run on throw. */
+async function handleSecurityVerdict(verdict, hookCtx, checkCtx, trackEvent, securityService) {
 	if (verdict.action === "allow") return;
 	const reason = verdict.reason || "unknown";
-	const confidence = 1;
-	if (verdict.action === "challenge" && ctx.visitorId) {
-		const challenge = verdict.challenge || await securityService.generateChallenge(ctx.visitorId);
+	if (verdict.action === "challenge" && checkCtx.visitorId) {
+		const challenge = verdict.challenge || await securityService.generateChallenge(checkCtx.visitorId);
 		if (!challenge?.trim()) {
 			logger.warn("[Sentinel] Could not generate PoW challenge (service may be unavailable). Falling back to allow.");
 			return;
 		}
-		trackEvent(buildEventData(ctx, "challenged", reason, confidence, verdict.details));
-		throwChallengeError(challenge, reason, "Please complete a security check to continue.");
-	} else if (verdict.action === "block") {
-		trackEvent(buildEventData(ctx, "blocked", reason, confidence, verdict.details));
+		setOutcome(hookCtx, "challenged", "server_security_check", {
+			reason,
+			...verdict.details
+		});
+		emitEvaluation(hookCtx, trackEvent, {
+			identifier: checkCtx.identifier,
+			userAgent: checkCtx.userAgent
+		});
+		throwChallengeError(challenge, reason);
+	}
+	if (verdict.action === "block") {
+		setOutcome(hookCtx, "blocked", "server_security_check", {
+			reason,
+			...verdict.details
+		});
+		emitEvaluation(hookCtx, trackEvent, {
+			identifier: checkCtx.identifier,
+			userAgent: checkCtx.userAgent
+		});
 		throw new APIError("FORBIDDEN", { message: ERROR_MESSAGES[reason] || "Access denied." });
 	}
 }
 /**
-* Run all security checks using the consolidated checkSecurity API
-*
-* This replaces the multiple individual check calls with a single API call
-* that handles all security checks server-side.
+* Single API call from the plugin; server runs all configured rules and returns
+* one verdict — counts as one billable check.
 */
-async function runSecurityChecks(ctx, securityService, trackEvent, powVerified) {
+async function runSecurityChecks(hookCtx, checkCtx, securityService, trackEvent, powVerified) {
 	if (powVerified) return;
+	recordCheck(hookCtx, "server_security_check");
 	await handleSecurityVerdict(await securityService.checkSecurity({
-		visitorId: ctx.visitorId,
-		requestId: ctx.identification?.requestId || null,
-		ip: ctx.identification?.ip || null,
-		path: ctx.path,
-		identifier: ctx.identifier
-	}), ctx, trackEvent, securityService);
+		visitorId: checkCtx.visitorId,
+		requestId: checkCtx.identification?.requestId || null,
+		ip: checkCtx.identification?.ip || null,
+		path: checkCtx.path,
+		identifier: checkCtx.identifier
+	}), hookCtx, checkCtx, trackEvent, securityService);
 }
 //#endregion
 //#region src/sentinel/sentinel.ts
 const sentinel = (options) => {
 	const opts = resolveSentinelOptions(options);
-	const { tracker } = initTrackEvents(opts);
+	const $api = createAPI(opts);
+	const $apiThrowing = createAPI(opts, { throw: true });
+	const $kv = createKV(opts);
+	const { tracker } = initTrackEvents($api);
 	const { trackEvent } = tracker;
 	if (!opts.apiKey) logger.warn("[Sentinel] Missing BETTER_AUTH_API_KEY. Security checks may fall back to allow mode when the Infra API rejects requests.");
-	const securityService = createSecurityClient(opts.apiUrl, opts.apiKey, opts.security || {}, (event) => {
+	const securityService = createSecurityClient(opts, $apiThrowing, opts.security || {}, (event) => {
 		trackEvent({
 			eventKey: event.visitorId || event.userId || "unknown",
-			eventType: `security_${event.type}`,
-			eventDisplayName: `Security: ${event.type.replace(/_/g, " ")}`,
+			eventType: "security_signal",
+			eventDisplayName: `Security signal: ${event.type.replace(/_/g, " ")}`,
 			eventData: {
 				type: event.type,
 				userId: event.userId || void 0,
@@ -2032,35 +2074,11 @@ const sentinel = (options) => {
 	const emailHooks = createEmailHooks({
 		emailValidationOptions: opts.security?.emailValidation,
 		emailNormalizationOptions: opts.security?.emailNormalization,
-		useApi: !!opts.apiKey,
-		apiKey: opts.apiKey,
-		apiUrl: opts.apiUrl,
-		kvUrl: opts.kvUrl,
-		onDisposableEmail: (data) => {
-			const isNoMxRecord = data.reason === "no_mx_records";
-			const reason = isNoMxRecord ? "no_mx_records" : "disposable_email";
-			const label = isNoMxRecord ? "No MX Records" : "Disposable Email";
-			const actionLabel = data.action === "allow" ? "allowed" : "blocked";
-			const actionVerb = data.action === "allow" ? "detected" : "blocked";
-			const eventType = data.action === "allow" ? "security_allowed" : "security_blocked";
-			const displayName = isNoMxRecord ? `Security: invalid email domain ${actionVerb}` : `Security: disposable email ${actionVerb}`;
-			const description = isNoMxRecord ? `${actionVerb.charAt(0).toUpperCase() + actionVerb.slice(1)} signup attempt with invalid email domain (no MX records): ${data.email}` : `${actionVerb.charAt(0).toUpperCase() + actionVerb.slice(1)} signup attempt with disposable email: ${data.email} (${data.reason}, ${data.confidence} confidence)`;
-			logger.info(`[Sentinel] Tracking ${reason} event for email: ${data.email} (action: ${actionLabel})`);
-			trackEvent({
-				eventKey: data.email,
-				eventType,
-				eventDisplayName: displayName,
-				eventData: {
-					action: actionLabel,
-					reason,
-					identifier: data.email,
-					detectionLabel: label,
-					description,
-					path: data.path
-				},
-				ipAddress: data.ip
-			});
-		}
+		trackEvent,
+		...opts.apiKey ? {
+			$api,
+			$kv
+		} : {}
 	});
 	return {
 		id: "sentinel",
@@ -2075,8 +2093,16 @@ const sentinel = (options) => {
 							if (!ctx) return;
 							const visitorId = ctx.context.visitorId;
 							if (visitorId && opts.security?.freeTrialAbuse?.enabled) {
+								recordCheck(ctx, "free_trial_abuse");
 								const abuseCheck = await securityService.checkFreeTrialAbuse(visitorId);
-								if (abuseCheck.isAbuse && abuseCheck.action === "block") throw new APIError("FORBIDDEN", { message: "Account creation is not allowed from this device." });
+								if (abuseCheck.isAbuse && abuseCheck.action === "block") {
+									setOutcome(ctx, "blocked", "free_trial_abuse", {
+										accountCount: abuseCheck.accountCount,
+										maxAccounts: abuseCheck.maxAccounts
+									});
+									emitEvaluation(ctx, trackEvent);
+									throw new APIError("FORBIDDEN", { message: "Account creation is not allowed from this device." });
+								}
 							}
 							if (user.email && typeof user.email === "string" && isEmailNormalizationEnabled(opts.security)) return { data: {
 								...user,
@@ -2095,10 +2121,29 @@ const sentinel = (options) => {
 							const visitorId = ctx.context.visitorId;
 							const identification = ctx.context.identification;
 							if (session.userId && identification?.location && visitorId) {
+								recordCheck(ctx, "impossible_travel");
 								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId);
 								if (travelCheck?.isImpossible) {
-									if (travelCheck.action === "block") throw new APIError("FORBIDDEN", { message: "Login blocked due to suspicious location change." });
-									if (travelCheck.action === "challenge" && travelCheck.challenge) throwChallengeError(travelCheck.challenge, "impossible_travel", "Unusual login location detected. Please complete a security check.");
+									if (travelCheck.action === "block") {
+										setOutcome(ctx, "blocked", "impossible_travel", {
+											from: travelCheck.from,
+											to: travelCheck.to,
+											distance: travelCheck.distance,
+											speedRequired: travelCheck.speedRequired
+										});
+										emitEvaluation(ctx, trackEvent);
+										throw new APIError("FORBIDDEN", { message: "Login blocked due to suspicious location change." });
+									}
+									if (travelCheck.action === "challenge" && travelCheck.challenge) {
+										setOutcome(ctx, "challenged", "impossible_travel", {
+											from: travelCheck.from,
+											to: travelCheck.to,
+											distance: travelCheck.distance,
+											speedRequired: travelCheck.speedRequired
+										});
+										emitEvaluation(ctx, trackEvent);
+										throwChallengeError(travelCheck.challenge, "impossible_travel", "Unusual login location detected. Please complete a security check.");
+									}
 								}
 							}
 						},
@@ -2128,6 +2173,7 @@ const sentinel = (options) => {
 								if (await securityService.checkUnknownDevice(session.userId, visitorId) && user?.email) await ctx.context.runInBackgroundOrAwait(securityService.notifyUnknownDevice(session.userId, user.email, identification));
 							}
 							if (opts.security?.staleUsers?.enabled && user) {
+								recordCheck(ctx, "stale_users");
 								const lastActiveAtForStale = activityTrackingEnabled ? user.lastActiveAt ?? null : null;
 								const staleCheck = await securityService.checkStaleUser(session.userId, lastActiveAtForStale);
 								if (staleCheck.isStale) {
@@ -2138,31 +2184,21 @@ const sentinel = (options) => {
 									if (notificationPromises.length > 0) Promise.all(notificationPromises).catch((error) => {
 										logger.error("[Sentinel] Failed to send stale account notifications:", error);
 									});
-									trackEvent({
-										eventKey: session.userId,
-										eventType: "security_stale_account",
-										eventDisplayName: "Security: stale account reactivated",
-										eventData: {
-											action: staleCheck.action === "block" ? "blocked" : staleCheck.action === "challenge" ? "challenged" : "logged",
-											reason: "stale_account_reactivation",
+									if (staleCheck.action === "block") {
+										setOutcome(ctx, "blocked", "stale_users", {
 											userId: session.userId,
 											daysSinceLastActive: staleCheck.daysSinceLastActive,
 											staleDays: staleCheck.staleDays,
 											lastActiveAt: staleCheck.lastActiveAt,
 											notifyUser: staleCheck.notifyUser,
-											notifyAdmin: staleCheck.notifyAdmin,
-											detectionLabel: "Stale Account Reactivation",
-											description: `Dormant account (inactive for ${staleCheck.daysSinceLastActive} days) became active`
-										},
-										ipAddress: identification?.ip || void 0,
-										city: identification?.location?.city || void 0,
-										country: identification?.location?.country?.name || void 0,
-										countryCode: identification?.location?.country?.code || void 0
-									});
-									if (staleCheck.action === "block") throw new APIError("FORBIDDEN", {
-										message: "This account has been inactive for an extended period. Please contact support to reactivate.",
-										code: "STALE_ACCOUNT"
-									});
+											notifyAdmin: staleCheck.notifyAdmin
+										});
+										emitEvaluation(ctx, trackEvent);
+										throw new APIError("FORBIDDEN", {
+											message: "This account has been inactive for an extended period. Please contact support to reactivate.",
+											code: "STALE_ACCOUNT"
+										});
+									}
 								}
 							}
 							if (identification?.location) await ctx.context.runInBackgroundOrAwait(securityService.storeLastLocation(session.userId, identification.location));
@@ -2175,7 +2211,7 @@ const sentinel = (options) => {
 			before: [
 				{
 					matcher: (ctx) => ctx.request?.method !== "GET",
-					handler: createIdentificationMiddleware(opts)
+					handler: createIdentificationMiddleware($kv)
 				},
 				{
 					matcher: (ctx) => ctx.request?.method !== "GET",
@@ -2225,52 +2261,23 @@ const sentinel = (options) => {
 						const requestBody = ctx.body;
 						const identifier = requestBody?.email || requestBody?.phone || requestBody?.username || void 0;
 						const powVerified = ctx.context.powVerified === true;
-						if (visitorId && powVerified) trackEvent({
-							eventKey: visitorId,
-							eventType: "security_allowed",
-							eventDisplayName: "Security: challenge completed",
-							eventData: {
-								action: "allowed",
-								reason: "pow_verified",
-								visitorId,
-								path: ctx.path,
-								userAgent: ctx.headers?.get?.("user-agent") || "",
-								identifier,
-								detectionLabel: "Challenge Completed",
-								description: identifier ? `Successfully completed security challenge for "${identifier}"` : "Successfully completed security challenge"
-							},
-							ipAddress: identification?.ip || void 0,
-							city: identification?.location?.city || void 0,
-							country: identification?.location?.country?.name || void 0,
-							countryCode: identification?.location?.country?.code || void 0
-						});
+						if (visitorId && powVerified) recordCheck(ctx, "pow_challenge");
 						if (visitorId) {
+							recordCheck(ctx, "credential_stuffing");
 							if (await securityService.isBlocked(visitorId)) {
-								trackEvent({
-									eventKey: visitorId,
-									eventType: "security_blocked",
-									eventDisplayName: "Security: credential stuffing blocked",
-									eventData: {
-										action: "blocked",
-										reason: "credential_stuffing",
-										visitorId,
-										path: ctx.path,
-										userAgent: ctx.headers?.get?.("user-agent") || "",
-										identifier,
-										detectionType: "cooldown_active",
-										detectionLabel: "Credential Stuffing",
-										description: identifier ? `Visitor attempting "${identifier}" still in cooldown from prior detection` : "Visitor still in cooldown from prior detection",
-										confidence: 1
-									},
-									ipAddress: identification?.ip || void 0,
-									city: identification?.location?.city || void 0,
-									country: identification?.location?.country?.name || void 0,
-									countryCode: identification?.location?.country?.code || void 0
+								setOutcome(ctx, "blocked", "credential_stuffing", {
+									reason: "cooldown_active",
+									visitorId,
+									confidence: 1
+								});
+								emitEvaluation(ctx, trackEvent, {
+									identifier,
+									userAgent: ctx.headers?.get?.("user-agent") || ""
 								});
 								throw new APIError(403, { message: "Too many failed attempts. Please try again later." });
 							}
 						}
-						await runSecurityChecks({
+						await runSecurityChecks(ctx, {
 							path: ctx.path,
 							identifier,
 							visitorId,
@@ -2286,12 +2293,20 @@ const sentinel = (options) => {
 							const body = ctx.body;
 							const passwordToCheck = body?.newPassword || body?.password;
 							if (passwordToCheck) {
+								recordCheck(ctx, "compromised_password");
 								const compromisedResult = await securityService.checkCompromisedPassword(passwordToCheck);
 								if (compromisedResult.compromised && compromisedResult.action) {
-									if (compromisedResult.action === "block") throw new APIError("BAD_REQUEST", {
-										message: "This password has been found in data breaches. Please choose a different password.",
-										code: "COMPROMISED_PASSWORD"
-									});
+									if (compromisedResult.action === "block") {
+										setOutcome(ctx, "blocked", "compromised_password", { breachCount: compromisedResult.breachCount });
+										emitEvaluation(ctx, trackEvent, {
+											identifier,
+											userAgent: ctx.headers?.get?.("user-agent") || ""
+										});
+										throw new APIError("BAD_REQUEST", {
+											message: "This password has been found in data breaches. Please choose a different password.",
+											code: "COMPROMISED_PASSWORD"
+										});
+									}
 								}
 							}
 						}
@@ -2304,6 +2319,10 @@ const sentinel = (options) => {
 					const visitorId = ctx.context.visitorId;
 					const identification = ctx.context.identification;
 					const body = ctx.body;
+					emitEvaluation(ctx, trackEvent, {
+						identifier: body?.email,
+						userAgent: ctx.headers?.get?.("user-agent") || ""
+					});
 					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email && body?.password && visitorId) {
 						const { email, password } = body;
 						const ip = identification?.ip || null;
@@ -2638,32 +2657,32 @@ const JTI_CHECK_GRACE_PERIOD_SECONDS = 30;
 const JWKS_CACHE_TTL_MS = 900 * 1e3;
 const jwksCache = /* @__PURE__ */ new Map();
 const inflightRequests = /* @__PURE__ */ new Map();
-async function fetchJWKS(ctx, apiUrl) {
-	const { data, error } = await betterFetch(`${apiUrl}/api/auth/jwks`);
+async function fetchJWKS(ctx, cacheKey, $api) {
+	const { data, error } = await $api("/api/auth/jwks");
 	if (error || !data) {
 		ctx.context.logger.warn("[Dash] Failed to fetch JWKS", error);
-		throw new APIError$1("UNAUTHORIZED", { message: "Invalid API key" });
+		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 	}
-	jwksCache.set(apiUrl, {
+	jwksCache.set(cacheKey, {
 		data,
 		expiresAt: Date.now() + JWKS_CACHE_TTL_MS
 	});
 	return createLocalJWKSet(data);
 }
-async function prefetchJWKS(ctx, apiUrl) {
-	const fetchPromise = fetchJWKS(ctx, apiUrl);
-	inflightRequests.set(apiUrl, fetchPromise);
-	fetchPromise.finally(() => inflightRequests.delete(apiUrl));
+async function prefetchJWKS(ctx, cacheKey, $api) {
+	const fetchPromise = fetchJWKS(ctx, cacheKey, $api);
+	inflightRequests.set(cacheKey, fetchPromise);
+	fetchPromise.finally(() => inflightRequests.delete(cacheKey));
 	return fetchPromise;
 }
-async function getJWKs(ctx, apiUrl) {
-	const cached = jwksCache.get(apiUrl);
+async function getJWKs(ctx, cacheKey, $api) {
+	const cached = jwksCache.get(cacheKey);
 	if (cached && Date.now() < cached.expiresAt) return createLocalJWKSet(cached.data);
 	if (cached) {
-		if (!inflightRequests.has(apiUrl)) prefetchJWKS(ctx, apiUrl);
+		if (!inflightRequests.has(cacheKey)) prefetchJWKS(ctx, cacheKey, $api);
 		return createLocalJWKSet(cached.data);
 	}
-	return inflightRequests.get(apiUrl) ?? prefetchJWKS(ctx, apiUrl);
+	return inflightRequests.get(cacheKey) ?? prefetchJWKS(ctx, cacheKey, $api);
 }
 /**
 * Check if JWT is recently issued and can skip JTI verification.
@@ -2675,86 +2694,92 @@ function isRecentlyIssued(payload) {
 	const issuedAt = payload.iat * 1e3;
 	return Date.now() - issuedAt < JTI_CHECK_GRACE_PERIOD_SECONDS * 1e3;
 }
-const jwtMiddleware = (options, schema, getJWT) => createAuthMiddleware(async (ctx) => {
-	const jwsFromHeader = getJWT ? await getJWT(ctx) : ctx.headers?.get("Authorization")?.split(" ")[1];
-	if (!jwsFromHeader) {
-		ctx.context.logger.warn("[Dash] JWT is missing from header");
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	}
-	const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(ctx, options.apiUrl), { maxTokenAge: "5m" }).catch((e) => {
-		ctx.context.logger.warn("[Dash] JWT verification failed:", e);
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	});
-	if (!isRecentlyIssued(payload)) {
-		const { error, data } = await betterFetch("/api/auth/check-jti", {
-			baseURL: options.apiUrl,
-			method: "POST",
-			headers: { "x-api-key": options.apiKey },
-			body: {
-				jti: payload.jti,
-				expiresAt: payload.exp
-			}
-		});
-		if (error || !data?.valid) {
-			ctx.context.logger.warn("[Dash] JTI check failed with error", error, data?.valid);
+const jwtMiddleware = (options, schema, getJWT) => {
+	const { $api } = options;
+	const cacheKey = options.apiUrl;
+	return createAuthMiddleware(async (ctx) => {
+		const jwsFromHeader = getJWT ? await getJWT(ctx) : ctx.headers?.get("Authorization")?.split(" ")[1];
+		if (!jwsFromHeader) {
+			ctx.context.logger.warn("[Dash] JWT is missing from header");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-	}
-	const apiKeyHash = payload.apiKeyHash;
-	if (typeof apiKeyHash !== "string" || !options.apiKey) {
-		ctx.context.logger.warn("[Dash] API key hash is missing or invalid", {
-			apiKeyHash,
-			apiKey: options.apiKey ? "present" : "missing"
+		const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(ctx, cacheKey, $api), { maxTokenAge: "5m" }).catch((e) => {
+			ctx.context.logger.warn("[Dash] JWT verification failed:", e);
+			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		});
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	}
-	const expectedHash = await hash(options.apiKey);
-	if (apiKeyHash !== expectedHash) {
-		ctx.context.logger.warn("[Dash] API key hash is invalid", apiKeyHash, expectedHash);
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	}
-	if (schema) {
-		const parsed = schema.safeParse(payload);
-		if (!parsed.success) {
-			ctx.context.logger.warn("[Dash] JWT payload is invalid", parsed.error);
+		const apiKeyHash = payload.apiKeyHash;
+		if (typeof apiKeyHash !== "string" || !options.apiKey) {
+			ctx.context.logger.warn("[Dash] API key hash is missing or invalid", {
+				apiKeyHash,
+				apiKey: options.apiKey ? "present" : "missing"
+			});
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		return { payload: parsed.data };
-	}
-	return { payload };
-});
+		const expectedHash = await hash(options.apiKey);
+		if (apiKeyHash !== expectedHash) {
+			ctx.context.logger.warn("[Dash] API key hash is invalid", apiKeyHash, expectedHash);
+			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+		}
+		if (!isRecentlyIssued(payload)) {
+			const { error, data } = await $api("/api/auth/check-jti", {
+				method: "POST",
+				body: {
+					jti: payload.jti,
+					expiresAt: payload.exp
+				}
+			});
+			if (error || !data?.valid) {
+				ctx.context.logger.warn("[Dash] JTI check failed with error", error, data?.valid);
+				throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+			}
+		}
+		if (schema) {
+			const parsed = schema.safeParse(payload);
+			if (!parsed.success) {
+				ctx.context.logger.warn("[Dash] JWT payload is invalid", parsed.error);
+				throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+			}
+			return { payload: parsed.data };
+		}
+		return { payload };
+	});
+};
 /**
 * Lightweight JWT middleware for /dash/validate. Verifies JWT signature and
 * apiKeyHash only—no JTI check. Used during onboarding when the org doesn't
 * exist yet.
 */
-const jwtValidateMiddleware = (options) => createAuthMiddleware(async (ctx) => {
-	const jwsFromHeader = ctx.headers?.get("Authorization")?.split(" ")[1];
-	if (!jwsFromHeader) {
-		ctx.context.logger.warn("[Dash] JWT is missing from header");
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	}
-	const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(ctx, options.apiUrl), { maxTokenAge: "5m" }).catch((e) => {
-		ctx.context.logger.error("[Dash] JWT verification failed:", e);
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	});
-	const apiKeyHash = payload.apiKeyHash;
-	if (typeof apiKeyHash !== "string" || !options.apiKey) {
-		ctx.context.logger.warn("[Dash] API key hash is missing or invalid", {
-			apiKeyHash: typeof apiKeyHash,
-			apiKey: options.apiKey ? "present" : "missing"
+const jwtValidateMiddleware = (options) => {
+	const { $api } = options;
+	const cacheKey = options.apiUrl;
+	return createAuthMiddleware(async (ctx) => {
+		const jwsFromHeader = ctx.headers?.get("Authorization")?.split(" ")[1];
+		if (!jwsFromHeader) {
+			ctx.context.logger.warn("[Dash] JWT is missing from header");
+			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+		}
+		const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(ctx, cacheKey, $api), { maxTokenAge: "5m" }).catch((e) => {
+			ctx.context.logger.error("[Dash] JWT verification failed:", e);
+			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		});
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	}
-	if (apiKeyHash !== await hash(options.apiKey)) {
-		ctx.context.logger.warn("[Dash] API key hash mismatch");
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	}
-	return { payload };
-});
+		const apiKeyHash = payload.apiKeyHash;
+		if (typeof apiKeyHash !== "string" || !options.apiKey) {
+			ctx.context.logger.warn("[Dash] API key hash is missing or invalid", {
+				apiKeyHash: typeof apiKeyHash,
+				apiKey: options.apiKey ? "present" : "missing"
+			});
+			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+		}
+		if (apiKeyHash !== await hash(options.apiKey)) {
+			ctx.context.logger.warn("[Dash] API key hash mismatch");
+			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+		}
+		return { payload };
+	});
+};
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.2.5";
+const PLUGIN_VERSION = "0.2.7";
 //#endregion
 //#region src/routes/auth/config.ts
 const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
@@ -3068,6 +3093,12 @@ function getScimEndpoint(baseUrl) {
 function getSCIMPlugin(ctx) {
 	return ctx.context.getPlugin("scim");
 }
+const DIRECTORY_SYNC_DUPLICATE_MESSAGE = "A directory sync connection with this provider ID already exists. Remove the existing connection or choose a different provider ID.";
+function isDuplicateDirectorySyncError(e) {
+	if (e instanceof APIError$1) return e.status === "CONFLICT" || /duplicate|already exists|unique constraint/i.test(e.message ?? "");
+	if (e instanceof Error) return /unique constraint|duplicate key|already exists|P2002/i.test(e.message);
+	return false;
+}
 const listOrganizationDirectories = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/directories", {
 		method: "GET",
@@ -3118,14 +3149,22 @@ const createOrganizationDirectory = (options) => {
 		const scimPlugin = getSCIMPlugin(ctx);
 		if (!scimPlugin?.endpoints.generateSCIMToken || !scimPlugin?.options?.providerOwnership?.enabled) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { providerId, ownerUserId } = ctx.body;
-		const { scimToken } = await scimPlugin.endpoints.generateSCIMToken({
-			body: {
-				providerId,
-				organizationId
-			},
-			context: await buildSyntheticSession(ctx, ownerUserId),
-			headers: ctx.request?.headers ?? new Headers()
-		});
+		let scimToken;
+		try {
+			scimToken = (await scimPlugin.endpoints.generateSCIMToken({
+				body: {
+					providerId,
+					organizationId
+				},
+				context: await buildSyntheticSession(ctx, ownerUserId),
+				headers: ctx.request?.headers ?? new Headers()
+			})).scimToken;
+		} catch (e) {
+			if (isDuplicateDirectorySyncError(e)) throw ctx.error("BAD_REQUEST", { message: DIRECTORY_SYNC_DUPLICATE_MESSAGE });
+			ctx.context.logger.error("[Dash] Failed to create directory sync provider (organizationId=%s, providerId=%s)", organizationId, providerId, e);
+			if (e instanceof APIError$1) throw e;
+			throw ctx.error("INTERNAL_SERVER_ERROR", { message: "Failed to create directory sync provider" });
+		}
 		if (!scimToken) throw ctx.error("INTERNAL_SERVER_ERROR", { message: "Failed to create directory sync provider" });
 		return {
 			organizationId,
@@ -3226,16 +3265,16 @@ function transformEvent(raw) {
 * ```
 */
 const getUserEvents = (options) => {
-	const $fetch = createFetch({
-		baseURL: options.apiUrl,
-		headers: { "x-api-key": options.apiKey }
-	});
+	const { $api } = options;
 	return createAuthEndpoint("/events/list", {
 		method: "GET",
 		use: [sessionMiddleware],
 		query: z$1.object({
+			/** Maximum number of events to return (default: 50, max: 100) */
 			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
+			/** Number of events to skip for pagination (default: 0) */
 			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
+			/** Filter by event type (e.g., "user_signed_in") */
 			eventType: z$1.string().optional()
 		}).optional()
 	}, async (ctx) => {
@@ -3245,7 +3284,7 @@ const getUserEvents = (options) => {
 		const requestedLimit = ctx.query?.limit ?? 50;
 		const limit = Math.min(Math.max(1, requestedLimit), 100);
 		const offset = Math.max(0, ctx.query?.offset ?? 0);
-		const { data, error } = await $fetch("/events/user", {
+		const { data, error } = await $api("/events/user", {
 			method: "GET",
 			query: {
 				userId: session.user.id,
@@ -3295,10 +3334,7 @@ const getEventTypes = (options) => {
 *   results to the resolved user/identifier.
 */
 const getAuditLogs = (options) => {
-	const $fetch = createFetch({
-		baseURL: options.apiUrl,
-		headers: { "x-api-key": options.apiKey }
-	});
+	const { $api } = options;
 	return createAuthEndpoint("/events/audit-logs", {
 		method: "GET",
 		use: [sessionMiddleware],
@@ -3330,7 +3366,7 @@ const getAuditLogs = (options) => {
 			if (!(sessionData.session?.activeOrganizationId === organizationId) && (!Array.isArray(sessionOrganizations) || !sessionOrganizations.some((org) => {
 				return org.id === organizationId;
 			}))) throw ctx.error("FORBIDDEN", { message: "Not allowed to access this organization" });
-			const { data, error } = await $fetch("/events/organization", {
+			const { data, error } = await $api("/events/organization", {
 				method: "GET",
 				query: {
 					organizationId,
@@ -3347,7 +3383,7 @@ const getAuditLogs = (options) => {
 			responseLimit = data.limit;
 			responseOffset = data.offset;
 		} else {
-			const { data, error } = await $fetch("/events/user", {
+			const { data, error } = await $api("/events/user", {
 				method: "GET",
 				query: {
 					userId: resolvedUserId,
@@ -3383,6 +3419,110 @@ const getAuditLogs = (options) => {
 		};
 	});
 };
+const OWNER_ADMIN_ROLES = new Set(["owner", "admin"]);
+function isOwnerOrAdminRole(role) {
+	return role !== void 0 && OWNER_ADMIN_ROLES.has(role);
+}
+/**
+* Get all audit logs the current user has access to
+* Queries can be restricted to a single organization, a single user, or all organizations the user has access to
+* @param options
+* @returns
+*/
+const getAllAuditLogs = (options) => {
+	const { $api } = options;
+	const getUserOrganizationRole = async (adapter, orgId, userId) => {
+		return (await adapter.findOne({
+			model: "member",
+			where: [{
+				field: "organizationId",
+				value: orgId
+			}, {
+				field: "userId",
+				value: userId
+			}],
+			select: ["role"]
+		}))?.role;
+	};
+	const listElevatedOrganizationIds = async (adapter, userId) => {
+		const memberships = await adapter.findMany({
+			model: "member",
+			where: [{
+				field: "userId",
+				value: userId
+			}],
+			select: ["organizationId", "role"]
+		});
+		const ids = /* @__PURE__ */ new Set();
+		for (const m of memberships) if (isOwnerOrAdminRole(m.role)) ids.add(m.organizationId);
+		return [...ids];
+	};
+	return createAuthEndpoint("/events/all-audit-logs", {
+		method: "GET",
+		use: [sessionMiddleware],
+		query: z$1.object({
+			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
+			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
+			userId: z$1.string().optional(),
+			organizationId: z$1.string().optional(),
+			/** Filter by event type (e.g. `organization_member_added`) */
+			eventType: z$1.string().optional(),
+			/** Match `eventData.identifier` (organization-scoped actor identity) */
+			identifier: z$1.string().optional()
+		}).refine((q) => {
+			const u = q.userId?.trim();
+			const o = q.organizationId?.trim();
+			return !(u && o);
+		}, { message: "Provide at most one of userId and organizationId." }).optional()
+	}, async (ctx) => {
+		const session = ctx.context.session;
+		if (!session?.user?.id) throw ctx.error("UNAUTHORIZED", { message: "You must be signed in to view activity logs" });
+		if (!options.apiKey) throw ctx.error("INTERNAL_SERVER_ERROR", { message: "Events API is not configured" });
+		const query = ctx.query ?? {};
+		const adapter = ctx.context.adapter;
+		const sessionUserId = session.user.id;
+		const limit = Math.min(Math.max(1, query.limit ?? 50), 100);
+		const offset = Math.max(0, query.offset ?? 0);
+		const organizationId = query.organizationId?.trim();
+		const userId = query.userId?.trim();
+		const forbidAccess = () => {
+			return ctx.error("FORBIDDEN", { message: "Only organization owners and admins can view activity logs." });
+		};
+		const elevatedOrgIds = await listElevatedOrganizationIds(adapter, sessionUserId);
+		if (organizationId) {
+			if (!isOwnerOrAdminRole(await getUserOrganizationRole(adapter, organizationId, sessionUserId))) throw forbidAccess();
+		} else if (userId) {
+			if (elevatedOrgIds.length === 0) throw forbidAccess();
+		} else if (elevatedOrgIds.length === 0) throw forbidAccess();
+		const apiQuery = {
+			limit: limit.toString(),
+			offset: offset.toString()
+		};
+		if (organizationId) apiQuery.organizationIds = organizationId;
+		else if (userId) {
+			apiQuery.userId = userId;
+			apiQuery.organizationIds = elevatedOrgIds.join(",");
+		} else apiQuery.organizationIds = elevatedOrgIds.join(",");
+		const eventTypeFilter = query.eventType?.trim();
+		const identifierFilter = query.identifier?.trim();
+		if (eventTypeFilter) apiQuery.eventType = eventTypeFilter;
+		if (identifierFilter) apiQuery.identifier = identifierFilter;
+		const { data, error } = await $api("/events/activity", {
+			method: "GET",
+			query: apiQuery
+		});
+		if (error || !data) {
+			ctx.context.logger.error("[Dash] Failed to fetch activity logs:", error);
+			throw ctx.error("INTERNAL_SERVER_ERROR", { message: "Failed to fetch activity logs" });
+		}
+		return {
+			events: data.events.map(transformEvent),
+			total: data.total,
+			limit: data.limit,
+			offset: data.offset
+		};
+	});
+};
 //#endregion
 //#region src/routes/execute-adapter/index.ts
 const whereClause = z.object({
@@ -3487,10 +3627,7 @@ const executeAdapter = (options) => {
 * It creates the user in the auth database and sets up a session.
 */
 const acceptInvitation = (options) => {
-	const $api = createFetch({
-		baseURL: options.apiUrl || INFRA_API_URL,
-		headers: { "x-api-key": options.apiKey }
-	});
+	const { $api } = options;
 	return createAuthEndpoint("/dash/accept-invitation", {
 		method: "GET",
 		query: z$1.object({ token: z$1.string() })
@@ -3570,10 +3707,7 @@ const acceptInvitation = (options) => {
 * This creates the user in the auth database and sets up a session
 */
 const completeInvitation = (options) => {
-	const $api = createFetch({
-		baseURL: options.apiUrl || INFRA_API_URL,
-		headers: { "x-api-key": options.apiKey }
-	});
+	const { $api } = options;
 	return createAuthEndpoint("/dash/complete-invitation", {
 		method: "POST",
 		body: z$1.object({
@@ -6674,7 +6808,7 @@ const updateUser = (options) => createAuthEndpoint("/dash/update-user", {
 	const updateData = ctx.body;
 	const userId = ctx.context.payload?.userId;
 	if (!userId) throw new APIError("FORBIDDEN", { message: "Invalid payload" });
-	const filteredData = Object.fromEntries(Object.entries(updateData).filter(([_, value]) => value !== void 0));
+	const filteredData = Object.fromEntries(Object.entries(updateData).filter(([, value]) => value !== void 0));
 	if (Object.keys(filteredData).length === 0) throw new APIError("BAD_REQUEST", { message: "No valid fields to update" });
 	const user = await ctx.context.internalAdapter.updateUser(userId, {
 		...filteredData,
@@ -7400,6 +7534,11 @@ function createSMSSender(config) {
 	const apiUrl = baseUrl.endsWith("/api") ? baseUrl : `${baseUrl}/api`;
 	const apiKey = config?.apiKey || env.BETTER_AUTH_API_KEY || "";
 	if (!apiKey) logger.warn("[Dash] No API key provided for SMS sending. Set BETTER_AUTH_API_KEY environment variable or pass apiKey in config.");
+	const $api = createFetch({
+		baseURL: apiUrl,
+		headers: { Authorization: `Bearer ${apiKey}` },
+		timeout: config?.apiTimeout ?? 3e3
+	});
 	/**
 	* Send an SMS with OTP code
 	*/
@@ -7409,25 +7548,25 @@ function createSMSSender(config) {
 			error: "API key not configured"
 		};
 		try {
-			const response = await fetch(`${apiUrl}/v1/sms/send`, {
+			const { data, error } = await $api("/v1/sms/send", {
 				method: "POST",
-				headers: {
-					"Content-Type": "application/json",
-					Authorization: `Bearer ${apiKey}`
-				},
-				body: JSON.stringify({
+				body: {
 					to: options.to,
 					code: options.code,
 					template: options.template
-				})
+				}
 			});
-			if (!response.ok) return {
+			if (error) return {
 				success: false,
-				error: (await response.json().catch(() => ({ message: "Unknown error" }))).message || `HTTP ${response.status}`
+				error: error.message || `HTTP ${error.status}`
+			};
+			if (typeof data !== "object" || data === null || Array.isArray(data)) return {
+				success: false,
+				error: "Failed to parse JSON"
 			};
 			return {
 				success: true,
-				messageId: (await response.json()).messageId
+				messageId: data.messageId
 			};
 		} catch (error) {
 			logger.warn("[Dash] SMS send failed:", error);
@@ -7475,8 +7614,14 @@ async function sendSMS(options, config) {
 const dash = (options) => {
 	const processedBulkOperationContexts = /* @__PURE__ */ new WeakSet();
 	const opts = resolveDashOptions(options);
+	const $api = createAPI(opts);
+	const settings = {
+		...opts,
+		$api
+	};
+	const $kv = createKV(opts);
 	const activityUpdateInterval = opts.activityTracking?.updateInterval ?? 3e5;
-	const { tracker } = initTrackEvents(opts);
+	const { tracker } = initTrackEvents($api);
 	const { trackUserSignedUp, trackUserProfileUpdated, trackUserProfileImageUpdated, trackUserEmailVerified, trackUserBanned, trackUserUnBanned, trackUserDeleted } = initUserEvents(tracker);
 	const { trackEmailVerificationSent, trackEmailSignInAttempt, trackUserSignedIn, trackUserSignedOut, trackSessionCreated, trackSocialSignInAttempt, trackSocialSignInRedirectionAttempt, trackUserImpersonated, trackUserImpersonationStop, trackSessionRevoked, trackSessionRevokedAll } = initSessionEvents(tracker);
 	const { trackAccountLinking, trackAccountUnlink, trackAccountPasswordChange } = initAccountEvents(tracker);
@@ -7758,7 +7903,7 @@ const dash = (options) => {
 					const path = new URL(ctx.request.url).pathname;
 					return matchesAnyRoute(path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]);
 				},
-				handler: createIdentificationMiddleware(opts)
+				handler: createIdentificationMiddleware($kv)
 			}],
 			after: [{
 				matcher: (ctx) => {
@@ -7773,7 +7918,7 @@ const dash = (options) => {
 					const body = ctx.body;
 					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger);
 					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger);
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK]) && ctx.context.returned instanceof Error) trackSocialSignInRedirectionAttempt(ctx, trigger);
+					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK]) && ctx.request?.method === "GET" && ctx.context.returned instanceof Error && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger);
 					const headerRequestId = ctx.request?.headers.get("X-Request-Id");
 					if (headerRequestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
 						maxAge: 600,
@@ -7811,78 +7956,79 @@ const dash = (options) => {
 			}]
 		},
 		endpoints: {
-			getDashConfig: getConfig(opts),
-			getDashValidate: getValidate(opts),
-			getDashUsers: getUsers(opts),
-			exportDashUsers: exportUsers(opts),
-			createDashUser: createUser(opts),
-			deleteDashUser: deleteUser(opts),
-			deleteManyDashUsers: deleteManyUsers(opts),
-			listDashOrganizations: listOrganizations(opts),
-			exportDashOrganizations: exportOrganizations(opts),
-			getDashOrganization: getOrganization(opts),
-			listDashOrganizationMembers: listOrganizationMembers(opts),
-			listDashOrganizationInvitations: listOrganizationInvitations(opts),
-			listDashOrganizationTeams: listOrganizationTeams(opts),
-			listDashOrganizationSsoProviders: listOrganizationSsoProviders(opts),
-			createDashSsoProvider: createSsoProvider(opts),
-			updateDashSsoProvider: updateSsoProvider(opts),
-			requestDashSsoVerificationToken: requestSsoVerificationToken(opts),
-			verifyDashSsoProviderDomain: verifySsoProviderDomain(opts),
-			deleteDashSsoProvider: deleteSsoProvider(opts),
-			markDashSsoProviderDomainVerified: markSsoProviderDomainVerified(opts),
-			listDashTeamMembers: listTeamMembers(opts),
-			createDashOrganization: createOrganization(opts),
-			deleteDashOrganization: deleteOrganization(opts),
-			deleteManyDashOrganizations: deleteManyOrganizations(opts),
-			getDashOrganizationOptions: getOrganizationOptions(opts),
-			getDashUser: getUserDetails(opts),
-			getDashUserOrganizations: getUserOrganizations(opts),
-			updateDashUser: updateUser(opts),
-			setDashPassword: setPassword(opts),
-			unlinkDashAccount: unlinkAccount(opts),
-			dashRevokeSession: revokeSession(opts),
-			dashRevokeAllSessions: revokeAllSessions(opts),
-			dashRevokeManySessions: revokeManySessions(opts),
-			dashImpersonateUser: impersonateUser(opts),
-			updateDashOrganization: updateOrganization(opts),
-			createDashTeam: createTeam(opts),
-			updateDashTeam: updateTeam(opts),
-			deleteDashTeam: deleteTeam(opts),
-			addDashTeamMember: addTeamMember(opts),
-			removeDashTeamMember: removeTeamMember(opts),
-			addDashMember: addMember(opts),
-			removeDashMember: removeMember(opts),
-			updateDashMemberRole: updateMemberRole(opts),
-			inviteDashMember: inviteMember(opts),
-			cancelDashInvitation: cancelInvitation(opts),
-			resendDashInvitation: resendInvitation(opts),
-			dashCheckUserByEmail: checkUserByEmail(opts),
-			dashGetUserStats: getUserStats(opts),
-			dashGetUserGraphData: getUserGraphData(opts),
-			dashGetUserRetentionData: getUserRetentionData(opts),
-			dashBanUser: banUser(opts),
-			dashBanManyUsers: banManyUsers(opts),
-			dashUnbanUser: unbanUser(opts),
-			dashSendVerificationEmail: sendVerificationEmail(opts),
-			dashSendManyVerificationEmails: sendManyVerificationEmails(opts),
-			dashSendResetPasswordEmail: sendResetPasswordEmail(opts),
-			dashEnableTwoFactor: enableTwoFactor(opts),
-			dashViewTwoFactorTotpUri: viewTwoFactorTotpUri(opts),
-			dashViewBackupCodes: viewBackupCodes(opts),
-			dashDisableTwoFactor: disableTwoFactor(opts),
-			dashGenerateBackupCodes: generateBackupCodes(opts),
-			getUserEvents: getUserEvents(opts),
-			getAuditLogs: getAuditLogs(opts),
-			getEventTypes: getEventTypes(opts),
-			dashAcceptInvitation: acceptInvitation(opts),
-			dashCompleteInvitation: completeInvitation(opts),
-			dashCheckUserExists: checkUserExists(opts),
-			listDashOrganizationDirectories: listOrganizationDirectories(opts),
-			createDashOrganizationDirectory: createOrganizationDirectory(opts),
-			deleteDashOrganizationDirectory: deleteOrganizationDirectory(opts),
-			regenerateDashDirectoryToken: regenerateDirectoryToken(opts),
-			dashExecuteAdapter: executeAdapter(opts)
+			getDashConfig: getConfig(settings),
+			getDashValidate: getValidate(settings),
+			getDashUsers: getUsers(settings),
+			exportDashUsers: exportUsers(settings),
+			createDashUser: createUser(settings),
+			deleteDashUser: deleteUser(settings),
+			deleteManyDashUsers: deleteManyUsers(settings),
+			listDashOrganizations: listOrganizations(settings),
+			exportDashOrganizations: exportOrganizations(settings),
+			getDashOrganization: getOrganization(settings),
+			listDashOrganizationMembers: listOrganizationMembers(settings),
+			listDashOrganizationInvitations: listOrganizationInvitations(settings),
+			listDashOrganizationTeams: listOrganizationTeams(settings),
+			listDashOrganizationSsoProviders: listOrganizationSsoProviders(settings),
+			createDashSsoProvider: createSsoProvider(settings),
+			updateDashSsoProvider: updateSsoProvider(settings),
+			requestDashSsoVerificationToken: requestSsoVerificationToken(settings),
+			verifyDashSsoProviderDomain: verifySsoProviderDomain(settings),
+			deleteDashSsoProvider: deleteSsoProvider(settings),
+			markDashSsoProviderDomainVerified: markSsoProviderDomainVerified(settings),
+			listDashTeamMembers: listTeamMembers(settings),
+			createDashOrganization: createOrganization(settings),
+			deleteDashOrganization: deleteOrganization(settings),
+			deleteManyDashOrganizations: deleteManyOrganizations(settings),
+			getDashOrganizationOptions: getOrganizationOptions(settings),
+			getDashUser: getUserDetails(settings),
+			getDashUserOrganizations: getUserOrganizations(settings),
+			updateDashUser: updateUser(settings),
+			setDashPassword: setPassword(settings),
+			unlinkDashAccount: unlinkAccount(settings),
+			dashRevokeSession: revokeSession(settings),
+			dashRevokeAllSessions: revokeAllSessions(settings),
+			dashRevokeManySessions: revokeManySessions(settings),
+			dashImpersonateUser: impersonateUser(settings),
+			updateDashOrganization: updateOrganization(settings),
+			createDashTeam: createTeam(settings),
+			updateDashTeam: updateTeam(settings),
+			deleteDashTeam: deleteTeam(settings),
+			addDashTeamMember: addTeamMember(settings),
+			removeDashTeamMember: removeTeamMember(settings),
+			addDashMember: addMember(settings),
+			removeDashMember: removeMember(settings),
+			updateDashMemberRole: updateMemberRole(settings),
+			inviteDashMember: inviteMember(settings),
+			cancelDashInvitation: cancelInvitation(settings),
+			resendDashInvitation: resendInvitation(settings),
+			dashCheckUserByEmail: checkUserByEmail(settings),
+			dashGetUserStats: getUserStats(settings),
+			dashGetUserGraphData: getUserGraphData(settings),
+			dashGetUserRetentionData: getUserRetentionData(settings),
+			dashBanUser: banUser(settings),
+			dashBanManyUsers: banManyUsers(settings),
+			dashUnbanUser: unbanUser(settings),
+			dashSendVerificationEmail: sendVerificationEmail(settings),
+			dashSendManyVerificationEmails: sendManyVerificationEmails(settings),
+			dashSendResetPasswordEmail: sendResetPasswordEmail(settings),
+			dashEnableTwoFactor: enableTwoFactor(settings),
+			dashViewTwoFactorTotpUri: viewTwoFactorTotpUri(settings),
+			dashViewBackupCodes: viewBackupCodes(settings),
+			dashDisableTwoFactor: disableTwoFactor(settings),
+			dashGenerateBackupCodes: generateBackupCodes(settings),
+			getUserEvents: getUserEvents(settings),
+			getAuditLogs: getAuditLogs(settings),
+			getAllAuditLogs: getAllAuditLogs(settings),
+			getEventTypes: getEventTypes(settings),
+			dashAcceptInvitation: acceptInvitation(settings),
+			dashCompleteInvitation: completeInvitation(settings),
+			dashCheckUserExists: checkUserExists(settings),
+			listDashOrganizationDirectories: listOrganizationDirectories(settings),
+			createDashOrganizationDirectory: createOrganizationDirectory(settings),
+			deleteDashOrganizationDirectory: deleteOrganizationDirectory(settings),
+			regenerateDashDirectoryToken: regenerateDirectoryToken(settings),
+			dashExecuteAdapter: executeAdapter(settings)
 		},
 		schema: opts.activityTracking?.enabled ? { user: { fields: { lastActiveAt: {
 			type: "date",