@better-auth/infra 0.3.4 → 0.3.5

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-D81vWTXm.mjs";
-import { a as createAPI, o as createKV, r as hmacSha256Hex } from "./crypto-BlYEkWgT.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-COVOGExF.mjs";
+import { a as createAPI, o as createKV, r as hmacSha256Hex } from "./crypto-DvC9lT5e.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAuthContext } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
@@ -148,6 +148,15 @@ const USER_EVENT_TYPES = {
 };
 //#endregion
 //#region src/events/core/adapter.ts
+function resolveUserFromContext(userId, ctx) {
+	for (const candidate of [ctx.context.session?.user, ctx.context.newSession?.user]) if (candidate?.id === userId) return {
+		id: candidate.id,
+		name: candidate.name,
+		email: candidate.email ?? null,
+		..."lastActiveAt" in candidate && candidate.lastActiveAt !== void 0 ? { lastActiveAt: candidate.lastActiveAt } : {}
+	};
+	return null;
+}
 const getUserByEmail = async (email, ctx) => {
 	let user = null;
 	try {
@@ -168,25 +177,26 @@ const getUserByEmail = async (email, ctx) => {
 	}
 	return user;
 };
-async function getUserById(userId, ctx) {
-	let user = null;
+async function getUserById(userId, ctx, options) {
+	const select = [
+		"id",
+		"name",
+		"email"
+	];
+	if (options?.includeLastActiveAt) select.push("lastActiveAt");
 	try {
-		user = await ctx.context.adapter.findOne({
+		return await ctx.context.adapter.findOne({
 			model: "user",
-			select: [
-				"id",
-				"name",
-				"email"
-			],
+			select,
 			where: [{
 				field: "id",
 				value: userId
 			}]
-		});
+		}) ?? null;
 	} catch (error) {
 		logger.debug("[Dash] Failed to fetch user info:", error);
+		return null;
 	}
-	return user;
 }
 //#endregion
 //#region src/events/core/events-account.ts
@@ -293,6 +303,8 @@ const matchesAnyRoute = (path, routes) => {
 	const cleanPath = stripQuery(path);
 	return routes.some((route) => routeToRegex(route).test(cleanPath));
 };
+/** True for `/dash` and any `/dash/*` handler (dashboard admin API). */
+const isDashRoute = (path) => matchesAnyRoute(path, ["/dash"]);
 //#endregion
 //#region src/events/oauth-callback-provider.ts
 /** Provider id from social (`/callback/:id`) or generic OAuth (`/oauth2/callback/:providerId`). */
@@ -379,10 +391,10 @@ async function resolveOAuthUser(providerId, ctx) {
 //#region src/events/core/events-session.ts
 const initSessionEvents = (tracker) => {
 	const { trackEvent } = tracker;
-	const trackUserSignedIn = (session, trigger, ctx, location) => {
+	const trackUserSignedIn = (session, trigger, ctx, location, knownUser) => {
 		const track = async () => {
 			const loginMethod = session.loginMethod ?? "unknown";
-			const user = await getUserById(session.userId, ctx);
+			const user = knownUser ?? await getUserById(session.userId, ctx);
 			trackEvent({
 				eventKey: session.userId,
 				eventType: EVENT_TYPES.USER_SIGNED_IN,
@@ -405,10 +417,10 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackUserSignedOut = (session, trigger, ctx, location) => {
+	const trackUserSignedOut = (session, trigger, ctx, location, knownUser) => {
 		const track = async () => {
 			const loginMethod = session.loginMethod ?? "unknown";
-			const user = await getUserById(session.userId, ctx);
+			const user = knownUser ?? await getUserById(session.userId, ctx);
 			trackEvent({
 				eventKey: session.userId,
 				eventType: EVENT_TYPES.USER_SIGNED_OUT,
@@ -431,10 +443,10 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackSessionRevoked = (session, trigger, ctx, location) => {
+	const trackSessionRevoked = (session, trigger, ctx, location, knownUser) => {
 		const track = async () => {
 			const loginMethod = session.loginMethod ?? "unknown";
-			const user = await getUserById(session.userId, ctx);
+			const user = knownUser ?? await getUserById(session.userId, ctx);
 			trackEvent({
 				eventKey: session.userId,
 				eventType: EVENT_TYPES.SESSION_REVOKED,
@@ -457,9 +469,9 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackSessionRevokedAll = (session, trigger, ctx, location) => {
+	const trackSessionRevokedAll = (session, trigger, ctx, location, knownUser) => {
 		const track = async () => {
-			const user = await getUserById(session.userId, ctx);
+			const user = knownUser ?? await getUserById(session.userId, ctx);
 			trackEvent({
 				eventKey: session.userId,
 				eventType: EVENT_TYPES.ALL_SESSIONS_REVOKED,
@@ -479,11 +491,11 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackUserImpersonated = (session, trigger, ctx, location) => {
+	const trackUserImpersonated = (session, trigger, ctx, location, knownUser, knownImpersonator) => {
 		const track = async () => {
 			const loginMethod = session.loginMethod ?? "unknown";
-			const user = await getUserById(session.userId, ctx);
-			const impersonator = session.impersonatedBy ? await getUserById(session.impersonatedBy, ctx) : null;
+			const user = knownUser ?? await getUserById(session.userId, ctx);
+			const impersonator = knownImpersonator ?? (session.impersonatedBy ? await getUserById(session.impersonatedBy, ctx) : null);
 			trackEvent({
 				eventKey: session.userId,
 				eventType: EVENT_TYPES.USER_IMPERSONATED,
@@ -508,11 +520,11 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackUserImpersonationStop = (session, trigger, ctx, location) => {
+	const trackUserImpersonationStop = (session, trigger, ctx, location, knownUser, knownImpersonator) => {
 		const track = async () => {
 			const loginMethod = session.loginMethod ?? "unknown";
-			const user = await getUserById(session.userId, ctx);
-			const impersonator = session.impersonatedBy ? await getUserById(session.impersonatedBy, ctx) : null;
+			const user = knownUser ?? await getUserById(session.userId, ctx);
+			const impersonator = knownImpersonator ?? (session.impersonatedBy ? await getUserById(session.impersonatedBy, ctx) : null);
 			trackEvent({
 				eventKey: session.userId,
 				eventType: EVENT_TYPES.USER_IMPERSONATED_STOPPED,
@@ -537,10 +549,10 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackSessionCreated = (session, trigger, ctx, location) => {
+	const trackSessionCreated = (session, trigger, ctx, location, knownUser) => {
 		const track = async () => {
 			const loginMethod = session.loginMethod ?? "unknown";
-			const user = await getUserById(session.userId, ctx);
+			const user = knownUser ?? await getUserById(session.userId, ctx);
 			trackEvent({
 				eventKey: session.userId,
 				eventType: EVENT_TYPES.SESSION_CREATED,
@@ -1033,12 +1045,19 @@ function resolveUntrustedVisitorId(visitorId, ip, headerVisitorId) {
 *
 * @param $kv — KV client from {@link createKV} for the same plugin options (one instance per plugin).
 */
-function createIdentificationMiddleware($kv) {
+function createIdentificationMiddleware($kv, options) {
 	return createAuthMiddleware(async (ctx) => {
-		const { visitorId: headerVisitorId, requestId: headerRequestId } = extractIdentificationHeaders(ctx.request);
-		const requestId = headerRequestId ?? ctx.getCookie("__infra-rid") ?? null;
+		const skipIdentification = options?.skipIdentification?.(ctx) ?? false;
+		let headerVisitorId = null;
+		let requestId = null;
+		if (!skipIdentification) {
+			const extracted = extractIdentificationHeaders(ctx.request);
+			headerVisitorId = extracted.visitorId;
+			requestId = extracted.requestId ?? ctx.getCookie("__infra-rid") ?? null;
+		}
 		ctx.context.requestId = requestId;
-		if (requestId) {
+		if (skipIdentification) ctx.context.identification = null;
+		else if (requestId) {
 			if (ctx.context.identification === void 0) ctx.context.identification = await getIdentification(requestId, $kv) ?? null;
 		} else ctx.context.identification = null;
 		const identification = ctx.context.identification;
@@ -1064,7 +1083,7 @@ function createIdentificationMiddleware($kv) {
 		else location = void 0;
 		ctx.context.location = location;
 		ctx.context.ip = resolveSecurityIp(identification, location);
-		ctx.context.untrustedVisitorId = resolveUntrustedVisitorId(visitorId, ctx.context.ip, headerVisitorId);
+		ctx.context.untrustedVisitorId = resolveUntrustedVisitorId(visitorId, ctx.context.ip, skipIdentification ? null : headerVisitorId);
 	});
 }
 /**
@@ -2210,6 +2229,13 @@ const sentinel = (options) => {
 						create: {
 							async before(user, ctx) {
 								if (!ctx) return;
+								if (isDashRoute(ctx.path)) {
+									if (user.email && typeof user.email === "string" && isEmailNormalizationEnabled(opts.security)) return { data: {
+										...user,
+										email: normalizeEmail(user.email, ctx.context)
+									} };
+									return;
+								}
 								const visitorId = ctx.context.visitorId;
 								if (opts.security?.freeTrialAbuse?.enabled) {
 									if (!visitorId) {
@@ -2237,7 +2263,7 @@ const sentinel = (options) => {
 								} };
 							},
 							async after(user, ctx) {
-								if (!ctx) return;
+								if (!ctx || isDashRoute(ctx.path)) return;
 								const visitorId = ctx.context.visitorId;
 								const reservationId = ctx.context.freeTrialReservationId;
 								if (visitorId && reservationId && opts.security?.freeTrialAbuse?.enabled) await ctx.context.runInBackgroundOrAwait(securityService.confirmFreeTrialSignup(visitorId, reservationId, user.id, ctx.context.requestId ?? null));
@@ -2253,7 +2279,7 @@ const sentinel = (options) => {
 					},
 					session: { create: {
 						async before(session, ctx) {
-							if (!ctx) return;
+							if (!ctx || isDashRoute(ctx.path)) return;
 							const visitorId = ctx.context.visitorId;
 							const identification = ctx.context.identification;
 							if (session.userId && identification?.location && visitorId) {
@@ -2286,24 +2312,12 @@ const sentinel = (options) => {
 							}
 						},
 						async after(session, ctx) {
-							if (!ctx || !session.userId) return;
+							if (!ctx || !session.userId || isDashRoute(ctx.path)) return;
 							const visitorId = ctx.context.visitorId;
 							const identification = ctx.context.identification;
 							let user = null;
-							const userSelect = [
-								"email",
-								"name",
-								...activityTrackingEnabled ? ["lastActiveAt"] : []
-							];
 							try {
-								user = await ctx.context.adapter.findOne({
-									model: "user",
-									select: [...userSelect],
-									where: [{
-										field: "id",
-										value: session.userId
-									}]
-								});
+								user = await getUserById(session.userId, ctx, { includeLastActiveAt: activityTrackingEnabled });
 							} catch (error) {
 								logger.warn("[Sentinel] Failed to fetch user for security checks:", error);
 							}
@@ -2349,12 +2363,12 @@ const sentinel = (options) => {
 			before: [
 				{
 					matcher: (ctx) => ctx.request?.method !== "GET",
-					handler: createIdentificationMiddleware($kv)
+					handler: createIdentificationMiddleware($kv, { skipIdentification: (ctx) => isDashRoute(ctx.path) })
 				},
 				...emailHooks.before,
 				...phoneValidationHooks.before,
 				{
-					matcher: (ctx) => ctx.request?.method !== "GET",
+					matcher: (ctx) => ctx.request?.method !== "GET" && !isDashRoute(ctx.path),
 					handler: createAuthMiddleware(async (ctx) => {
 						const visitorId = ctx.context.visitorId;
 						const identification = ctx.context.identification;
@@ -2448,7 +2462,7 @@ const sentinel = (options) => {
 				}
 			],
 			after: [{
-				matcher: (ctx) => ctx.request?.method !== "GET",
+				matcher: (ctx) => ctx.request?.method !== "GET" && !isDashRoute(ctx.path),
 				handler: createAuthMiddleware(async (ctx) => {
 					const untrustedVisitorId = ctx.context.untrustedVisitorId;
 					const ip = ctx.context.ip;
@@ -3332,7 +3346,7 @@ async function buildSyntheticSession(ctx, ownerUserId) {
 }
 //#endregion
 //#region src/routes/directory-sync/index.ts
-async function getScimProviderOwner(ctx, organizationId, providerId) {
+async function getLegacyScimProviderOwnerUserId(ctx, organizationId, providerId) {
 	const where = [{
 		field: "organizationId",
 		value: organizationId
@@ -3347,6 +3361,44 @@ async function getScimProviderOwner(ctx, organizationId, providerId) {
 		select: ["userId"]
 	}))?.userId ?? null;
 }
+function parseMemberRoles(role) {
+	return role.split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+function getScimManagementRoles(ctx) {
+	const creatorRole = ctx.context.getPlugin("organization")?.options?.creatorRole ?? "owner";
+	return Array.from(new Set(["admin", creatorRole]));
+}
+async function findOrganizationScimManagerUserId(ctx, organizationId) {
+	const requiredRoles = getScimManagementRoles(ctx);
+	const members = await ctx.context.adapter.findMany({
+		model: "member",
+		where: [{
+			field: "organizationId",
+			value: organizationId
+		}],
+		select: ["userId", "role"]
+	});
+	for (const member of members) if (parseMemberRoles(member.role).some((role) => requiredRoles.includes(role))) return member.userId;
+	return null;
+}
+async function organizationHasScimProviders(ctx, organizationId) {
+	return await ctx.context.adapter.findOne({
+		model: "scimProvider",
+		where: [{
+			field: "organizationId",
+			value: organizationId
+		}],
+		select: ["id"]
+	}) != null;
+}
+/** User id for synthetic SCIM management sessions (list/delete/regenerate). */
+async function resolveScimManagementUserId(ctx, organizationId, providerId) {
+	if (providerId) {
+		if (!await scimProviderExists(ctx, organizationId, providerId)) return null;
+	} else if (!await organizationHasScimProviders(ctx, organizationId)) return null;
+	if (isVersionAtLeast(ctx.context.version, "1.7.0")) return findOrganizationScimManagerUserId(ctx, organizationId);
+	return getLegacyScimProviderOwnerUserId(ctx, organizationId, providerId);
+}
 async function scimProviderExists(ctx, organizationId, providerId) {
 	return await ctx.context.adapter.findOne({
 		model: "scimProvider",
@@ -3391,14 +3443,14 @@ const listOrganizationDirectories = (options) => {
 			ctx.context.logger.warn("[Dash] SCIM plugin not available or provider ownership disabled, returning empty directories list", { organizationId });
 			return [];
 		}
-		const ownerUserId = await getScimProviderOwner(ctx, organizationId);
-		if (!ownerUserId) {
-			ctx.context.logger.warn("[Dash] No SCIM provider owner found for organization, returning empty directories list", { organizationId });
+		const managerUserId = await resolveScimManagementUserId(ctx, organizationId);
+		if (!managerUserId) {
+			ctx.context.logger.warn("[Dash] No SCIM provider or organization manager found, returning empty directories list", { organizationId });
 			return [];
 		}
 		try {
 			const { providers } = await scimPlugin.endpoints.listSCIMProviderConnections({
-				context: await buildSyntheticSession(ctx, ownerUserId),
+				context: await buildSyntheticSession(ctx, managerUserId),
 				headers: ctx.request?.headers ?? new Headers()
 			});
 			return providers.filter((p) => p.organizationId === organizationId).map((provider) => ({
@@ -3463,11 +3515,14 @@ const deleteOrganizationDirectory = (options) => {
 		if (!scimPlugin?.endpoints.deleteSCIMProviderConnection || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { organizationId } = ctx.context.payload;
 		const { providerId } = ctx.body;
-		const ownerUserId = await getScimProviderOwner(ctx, organizationId, providerId);
-		if (!ownerUserId) throw ctx.error("NOT_FOUND", { message: "Directory sync connection not found or missing owner" });
+		const managerUserId = await resolveScimManagementUserId(ctx, organizationId, providerId);
+		if (!managerUserId) throw ctx.error("NOT_FOUND", { message: "Directory sync connection not found or missing owner" });
 		await scimPlugin.endpoints.deleteSCIMProviderConnection({
-			body: { providerId },
-			context: await buildSyntheticSession(ctx, ownerUserId),
+			body: {
+				providerId,
+				organizationId
+			},
+			context: await buildSyntheticSession(ctx, managerUserId),
 			headers: ctx.request?.headers ?? new Headers()
 		});
 		return { success: true };
@@ -3484,14 +3539,14 @@ const regenerateDirectoryToken = (options) => {
 		if (!scimPlugin?.endpoints.generateSCIMToken || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { organizationId } = ctx.context.payload;
 		const { providerId } = ctx.body;
-		const ownerUserId = await getScimProviderOwner(ctx, organizationId, providerId);
-		if (!ownerUserId) throw ctx.error("NOT_FOUND", { message: "Directory sync connection not found or missing owner" });
+		const managerUserId = await resolveScimManagementUserId(ctx, organizationId, providerId);
+		if (!managerUserId) throw ctx.error("NOT_FOUND", { message: "Directory sync connection not found or missing owner" });
 		const { scimToken } = await scimPlugin.endpoints.generateSCIMToken({
 			body: {
 				providerId,
 				organizationId
 			},
-			context: await buildSyntheticSession(ctx, ownerUserId),
+			context: await buildSyntheticSession(ctx, managerUserId),
 			headers: ctx.request?.headers ?? new Headers()
 		});
 		if (!scimToken) throw ctx.error("INTERNAL_SERVER_ERROR", { message: "Failed to regenerate directory sync token" });
@@ -4251,6 +4306,13 @@ const checkUserExists = (options) => {
 	});
 };
 //#endregion
+//#region src/db-types.ts
+/** Unwrap a joined relation that may be a single item or an array. */
+function joinedRelation(value) {
+	if (value == null) return null;
+	return (Array.isArray(value) ? value[0] : value) ?? null;
+}
+//#endregion
 //#region src/routes/organizations/roles.ts
 const DEFAULT_ORG_MEMBER_ROLES = [
 	"member",
@@ -4268,6 +4330,14 @@ function validateOrganizationMemberRole(ctx, role, orgOptions) {
 	if (!allowedRoles.includes(role)) throw ctx.error("BAD_REQUEST", { message: `Invalid role. Allowed roles: ${allowedRoles.join(", ")}` });
 }
 //#endregion
+//#region src/routes/organizations/types.ts
+const ORGANIZATION_USER_PREVIEW_SELECT = [
+	"id",
+	"name",
+	"email",
+	"image"
+];
+//#endregion
 //#region src/routes/organizations/invitations.ts
 const listOrganizationInvitations = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/invitations", {
@@ -4293,7 +4363,9 @@ const listOrganizationInvitations = (options) => {
 				field: "email",
 				value: emails,
 				operator: "in"
-			}]
+			}],
+			select: [...ORGANIZATION_USER_PREVIEW_SELECT],
+			limit: emails.length
 		}) : [];
 		const userByEmail = new Map(users.filter((u) => u.email != null).map((u) => [normalizeEmail(u.email, ctx.context), u]));
 		return invitations.map((invitation) => {
@@ -4305,7 +4377,7 @@ const listOrganizationInvitations = (options) => {
 					id: user.id,
 					name: user.name,
 					email: user.email ?? void 0,
-					image: user.image || null
+					image: user.image ?? null
 				} : null
 			};
 		});
@@ -4369,7 +4441,8 @@ const checkUserByEmail = (options) => {
 			where: [{
 				field: "email",
 				value: email
-			}]
+			}],
+			select: [...ORGANIZATION_USER_PREVIEW_SELECT]
 		});
 		if (!user) return {
 			exists: false,
@@ -4410,7 +4483,7 @@ const cancelInvitation = (options) => {
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
 		const { invitationId, organizationId } = ctx.context.payload;
 		if (ctx.body.invitationId !== invitationId) throw ctx.error("BAD_REQUEST", { message: "Invitation ID mismatch" });
-		const invitation = await ctx.context.adapter.findOne({
+		const invitationRow = await ctx.context.adapter.findOne({
 			model: "invitation",
 			where: [{
 				field: "id",
@@ -4418,24 +4491,17 @@ const cancelInvitation = (options) => {
 			}, {
 				field: "organizationId",
 				value: organizationId
-			}]
+			}],
+			join: {
+				user: true,
+				organization: true
+			}
 		});
-		if (!invitation) throw ctx.error("NOT_FOUND", { message: "Invitation not found" });
-		const [user, organization] = await Promise.all([ctx.context.adapter.findOne({
-			model: "user",
-			where: [{
-				field: "id",
-				value: invitation.inviterId
-			}]
-		}), ctx.context.adapter.findOne({
-			model: "organization",
-			where: [{
-				field: "id",
-				value: organizationId
-			}]
-		})]);
-		if (!user) throw ctx.error("NOT_FOUND", { message: "Inviter user not found" });
-		if (!organization) throw ctx.error("NOT_FOUND", { message: "Organization not found" });
+		if (!invitationRow) throw ctx.error("NOT_FOUND", { message: "Invitation not found" });
+		const user = joinedRelation(invitationRow.user);
+		const organization = joinedRelation(invitationRow.organization);
+		if (!user || !organization) throw ctx.error("NOT_FOUND", { message: "Inviter not found or is not associated with this invitation" });
+		const invitation = invitationRow;
 		if (orgOptions?.organizationHooks?.beforeCancelInvitation) await orgOptions.organizationHooks.beforeCancelInvitation({
 			invitation,
 			organization,
@@ -4475,7 +4541,7 @@ const resendInvitation = (options) => {
 		const organizationPlugin = requireOrganizationPlugin(ctx);
 		const { invitationId, organizationId } = ctx.context.payload;
 		if (ctx.body.invitationId !== invitationId) throw ctx.error("BAD_REQUEST", { message: "Invitation ID mismatch" });
-		const invitation = await ctx.context.adapter.findOne({
+		const invitationRow = await ctx.context.adapter.findOne({
 			model: "invitation",
 			where: [{
 				field: "id",
@@ -4483,18 +4549,14 @@ const resendInvitation = (options) => {
 			}, {
 				field: "organizationId",
 				value: organizationId
-			}]
+			}],
+			join: { user: true }
 		});
-		if (!invitation) throw ctx.error("NOT_FOUND", { message: "Invitation not found" });
+		if (!invitationRow) throw ctx.error("NOT_FOUND", { message: "Invitation not found" });
+		const invitation = invitationRow;
 		if (invitation.status !== "pending") throw ctx.error("BAD_REQUEST", { message: "Only pending invitations can be resent" });
-		const invitedByUser = await ctx.context.adapter.findOne({
-			model: "user",
-			where: [{
-				field: "id",
-				value: invitation.inviterId
-			}]
-		});
-		if (!invitedByUser) throw ctx.error("BAD_REQUEST", { message: "Inviter user not found" });
+		const invitedByUser = joinedRelation(invitationRow.user);
+		if (!invitedByUser) throw ctx.error("BAD_REQUEST", { message: "Inviter not found or is not associated with this invitation" });
 		if (!organizationPlugin.endpoints?.createInvitation) throw ctx.error("INTERNAL_SERVER_ERROR", { message: "Organization plugin endpoints not available" });
 		const invitationEmail = normalizeEmail(invitation.email, ctx.context);
 		await organizationPlugin.endpoints.createInvitation({
@@ -4529,15 +4591,14 @@ const listOrganizationMembers = (options) => {
 			return [];
 		}
 		const organizationId = tryDecode(ctx.params.id);
-		const members = await ctx.context.adapter.findMany({
+		const [members, invitations] = await Promise.all([ctx.context.adapter.findMany({
 			model: "member",
 			where: [{
 				field: "organizationId",
 				value: organizationId
 			}],
 			join: { user: true }
-		});
-		const invitations = await ctx.context.adapter.findMany({
+		}), ctx.context.adapter.findMany({
 			model: "invitation",
 			where: [{
 				field: "organizationId",
@@ -4547,16 +4608,16 @@ const listOrganizationMembers = (options) => {
 				value: "accepted"
 			}],
 			join: { user: true }
-		});
+		})]);
 		const inviterById = /* @__PURE__ */ new Map();
 		for (const inv of invitations) {
-			const inviter = Array.isArray(inv.user) ? inv.user[0] : inv.user;
+			const inviter = joinedRelation(inv.user);
 			if (inviter && inv.inviterId) inviterById.set(inv.inviterId, inviter);
 		}
 		const invitationByEmail = new Map(invitations.map((i) => [i.email.toLowerCase(), i]));
 		const result = [];
 		for (const m of members) {
-			const joinedUser = Array.isArray(m.user) ? m.user[0] : m.user;
+			const joinedUser = joinedRelation(m.user);
 			if (!joinedUser) continue;
 			const invitation = joinedUser.email ? invitationByEmail.get(joinedUser.email.toLowerCase()) : void 0;
 			const inviter = invitation ? inviterById.get(invitation.inviterId) : void 0;
@@ -4646,7 +4707,7 @@ const removeMember = (options) => {
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
-		const member = await ctx.context.adapter.findOne({
+		const memberRow = await ctx.context.adapter.findOne({
 			model: "member",
 			where: [{
 				field: "id",
@@ -4654,24 +4715,17 @@ const removeMember = (options) => {
 			}, {
 				field: "organizationId",
 				value: organizationId
-			}]
+			}],
+			join: {
+				user: true,
+				organization: true
+			}
 		});
-		if (!member) throw ctx.error("NOT_FOUND", { message: "Member not found" });
-		const [user, organization] = await Promise.all([ctx.context.adapter.findOne({
-			model: "user",
-			where: [{
-				field: "id",
-				value: member.userId
-			}]
-		}), ctx.context.adapter.findOne({
-			model: "organization",
-			where: [{
-				field: "id",
-				value: organizationId
-			}]
-		})]);
-		if (!user) throw ctx.error("NOT_FOUND", { message: "User not found" });
-		if (!organization) throw ctx.error("NOT_FOUND", { message: "Organization not found" });
+		if (!memberRow) throw ctx.error("NOT_FOUND", { message: "Member not found" });
+		const user = joinedRelation(memberRow.user);
+		const organization = joinedRelation(memberRow.organization);
+		if (!user || !organization) throw ctx.error("NOT_FOUND", { message: "User not found or is not associated with this member" });
+		const member = memberRow;
 		if (orgOptions?.organizationHooks?.beforeRemoveMember) await orgOptions.organizationHooks.beforeRemoveMember({
 			member,
 			user,
@@ -4727,7 +4781,7 @@ const updateMemberRole = (options) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
 		validateOrganizationMemberRole(ctx, ctx.body.role, orgOptions);
-		const existingMember = await ctx.context.adapter.findOne({
+		const memberRow = await ctx.context.adapter.findOne({
 			model: "member",
 			where: [{
 				field: "id",
@@ -4735,24 +4789,17 @@ const updateMemberRole = (options) => {
 			}, {
 				field: "organizationId",
 				value: organizationId
-			}]
+			}],
+			join: {
+				user: true,
+				organization: true
+			}
 		});
-		if (!existingMember) throw ctx.error("NOT_FOUND", { message: "Member not found" });
-		const [user, organization] = await Promise.all([ctx.context.adapter.findOne({
-			model: "user",
-			where: [{
-				field: "id",
-				value: existingMember.userId
-			}]
-		}), ctx.context.adapter.findOne({
-			model: "organization",
-			where: [{
-				field: "id",
-				value: organizationId
-			}]
-		})]);
-		if (!user) throw ctx.error("NOT_FOUND", { message: "User not found" });
-		if (!organization) throw ctx.error("NOT_FOUND", { message: "Organization not found" });
+		if (!memberRow) throw ctx.error("NOT_FOUND", { message: "Member not found" });
+		const user = joinedRelation(memberRow.user);
+		const organization = joinedRelation(memberRow.organization);
+		if (!user || !organization) throw ctx.error("NOT_FOUND", { message: "User not found or is not associated with this member" });
+		const existingMember = memberRow;
 		const previousRole = existingMember.role;
 		let newRole = ctx.body.role;
 		if (orgOptions?.organizationHooks?.beforeUpdateMemberRole) {
@@ -5001,6 +5048,39 @@ function validateWritableOrganizationUpdateFields(data, orgOptions) {
 }
 //#endregion
 //#region src/routes/organizations/organization.ts
+const MEMBER_COUNT_BATCH_SIZE = 1e4;
+const MEMBER_COUNT_ORG_CHUNK_SIZE = 200;
+async function countMembersForOrganizationIdChunk(ctx, orgIdChunk) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const orgId of orgIdChunk) counts.set(orgId, 0);
+	let offset = 0;
+	while (true) {
+		const batch = await ctx.context.adapter.findMany({
+			model: "member",
+			where: [{
+				field: "organizationId",
+				value: orgIdChunk,
+				operator: "in"
+			}],
+			select: ["organizationId"],
+			limit: MEMBER_COUNT_BATCH_SIZE,
+			offset
+		});
+		for (const row of batch) counts.set(row.organizationId, (counts.get(row.organizationId) ?? 0) + 1);
+		if (batch.length < MEMBER_COUNT_BATCH_SIZE) break;
+		offset += MEMBER_COUNT_BATCH_SIZE;
+	}
+	return counts;
+}
+/** Count members per org in batched reads instead of one count query per org. */
+async function countMembersByOrganizationIds(ctx, orgIds) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const orgId of orgIds) counts.set(orgId, 0);
+	if (orgIds.length === 0) return counts;
+	const chunkMaps = await withConcurrency(chunkArray(orgIds, { batchSize: MEMBER_COUNT_ORG_CHUNK_SIZE }), (orgIdChunk) => countMembersForOrganizationIdChunk(ctx, orgIdChunk), { concurrency: 5 });
+	for (const chunkMap of chunkMaps) for (const [orgId, count] of chunkMap) counts.set(orgId, count);
+	return counts;
+}
 const listOrganizations = (options) => {
 	return createAuthEndpoint("/dash/list-organizations", {
 		method: "GET",
@@ -5082,15 +5162,7 @@ const listOrganizations = (options) => {
 			model: "organization",
 			where
 		})]);
-		const orgIds = organizations.map((o) => o.id);
-		const memberCounts = await withConcurrency(orgIds, (orgId) => ctx.context.adapter.count({
-			model: "member",
-			where: [{
-				field: "organizationId",
-				value: orgId
-			}]
-		}), { concurrency: 10 });
-		const memberCountByOrg = new Map(orgIds.map((orgId, i) => [orgId, memberCounts[i]]));
+		const memberCountByOrg = await countMembersByOrganizationIds(ctx, organizations.map((o) => o.id));
 		let withCounts = organizations.map((organization) => {
 			const memberCount = memberCountByOrg.get(organization.id) ?? 0;
 			return {
@@ -5123,6 +5195,7 @@ const listOrganizations = (options) => {
 				value: Array.from(allUserIds),
 				operator: "in"
 			}],
+			select: [...ORGANIZATION_USER_PREVIEW_SELECT],
 			limit: allUserIds.size
 		}) : [];
 		const userMap = new Map(users.map((u) => [u.id, u]));
@@ -5229,7 +5302,7 @@ const deleteOrganization = (options) => {
 		const { organizationId: bodyOrganizationId } = ctx.body;
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
 		if (organizationId !== bodyOrganizationId) throw ctx.error("BAD_REQUEST", { message: "Organization ID mismatch" });
-		const owners = await ctx.context.adapter.findMany({
+		const owner = (await ctx.context.adapter.findMany({
 			model: "member",
 			where: [{
 				field: "organizationId",
@@ -5243,20 +5316,14 @@ const deleteOrganization = (options) => {
 				direction: "asc"
 			},
 			limit: 1,
-			join: { user: true }
-		});
-		if (owners.length === 0) throw ctx.error("NOT_FOUND", { message: "Owner user not found" });
-		const owner = owners[0];
-		const deletedByUser = Array.isArray(owner.user) ? owner.user[0] : owner.user;
-		if (!deletedByUser) throw ctx.error("NOT_FOUND", { message: "Owner user not found" });
-		const organization = await ctx.context.adapter.findOne({
-			model: "organization",
-			where: [{
-				field: "id",
-				value: organizationId
-			}]
-		});
-		if (!organization) throw ctx.error("NOT_FOUND", { message: "Organization not found" });
+			join: {
+				user: true,
+				organization: true
+			}
+		}))[0];
+		const deletedByUser = owner ? joinedRelation(owner.user) : null;
+		const organization = owner ? joinedRelation(owner.organization) : null;
+		if (!owner || !deletedByUser || !organization) throw ctx.error("NOT_FOUND", { message: "Organization owner not found" });
 		if (orgOptions?.organizationHooks?.beforeDeleteOrganization) await orgOptions.organizationHooks.beforeDeleteOrganization({
 			organization,
 			user: deletedByUser
@@ -5297,7 +5364,8 @@ const deleteManyOrganizations = (options) => {
 			});
 			const remainingOrgs = await ctx.context.adapter.findMany({
 				model: "organization",
-				where
+				where,
+				select: ["id"]
 			});
 			for (const id of chunk) if (!remainingOrgs.some((u) => u.id === id)) deletedOrgIds.add(id);
 			else skippedOrgIds.add(id);
@@ -5483,18 +5551,7 @@ const updateOrganization = (options) => {
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
-		if (ctx.body.slug) {
-			const orgWithSlug = await ctx.context.adapter.findOne({
-				model: "organization",
-				where: [{
-					field: "slug",
-					value: ctx.body.slug
-				}],
-				select: ["id"]
-			});
-			if (orgWithSlug && orgWithSlug.id !== organizationId) throw ctx.error("BAD_REQUEST", { message: "Slug already exists" });
-		}
-		const owners = await ctx.context.adapter.findMany({
+		const ownersPromise = ctx.context.adapter.findMany({
 			model: "member",
 			where: [{
 				field: "organizationId",
@@ -5508,12 +5565,23 @@ const updateOrganization = (options) => {
 				direction: "asc"
 			},
 			limit: 1,
-			join: { user: true }
+			join: {
+				user: true,
+				organization: true
+			}
 		});
-		if (owners.length === 0) throw ctx.error("NOT_FOUND", { message: "Owner user not found" });
+		const [orgWithSlug, owners] = await Promise.all([ctx.body.slug ? ctx.context.adapter.findOne({
+			model: "organization",
+			where: [{
+				field: "slug",
+				value: ctx.body.slug
+			}],
+			select: ["id"]
+		}) : Promise.resolve(null), ownersPromise]);
+		if (orgWithSlug && orgWithSlug.id !== organizationId) throw ctx.error("BAD_REQUEST", { message: "Slug already exists" });
 		const owner = owners[0];
-		const updatedByUser = Array.isArray(owner.user) ? owner.user[0] : owner.user;
-		if (!updatedByUser) throw ctx.error("NOT_FOUND", { message: "Owner user not found" });
+		const updatedByUser = owner ? joinedRelation(owner.user) : null;
+		if (!owner || !updatedByUser || !joinedRelation(owner.organization)) throw ctx.error("NOT_FOUND", { message: "Organization owner not found" });
 		let updateData = pickWritableOrganizationFields(ctx.body, orgOptions, "update");
 		try {
 			validateWritableOrganizationUpdateFields(updateData, orgOptions);
@@ -5571,14 +5639,13 @@ const listOrganizationTeams = (options) => {
 		}
 		const organizationId = tryDecode(ctx.params.id);
 		try {
-			const teams = await ctx.context.adapter.findMany({
+			return await withConcurrency(await ctx.context.adapter.findMany({
 				model: "team",
 				where: [{
 					field: "organizationId",
 					value: organizationId
 				}]
-			});
-			return await Promise.all(teams.map(async (team) => {
+			}), async (team) => {
 				let memberCount = 0;
 				try {
 					memberCount = await ctx.context.adapter.count({
@@ -5596,7 +5663,7 @@ const listOrganizationTeams = (options) => {
 					...team,
 					memberCount
 				};
-			}));
+			}, { concurrency: 5 });
 		} catch (error) {
 			ctx.context.logger.warn("[Dash] Failed to list organization teams:", error);
 			return [];
@@ -5614,7 +5681,7 @@ const updateTeam = (options) => {
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireTeamsEnabled(ctx);
-		const existingTeam = await ctx.context.adapter.findOne({
+		const teamRow = await ctx.context.adapter.findOne({
 			model: "team",
 			where: [{
 				field: "id",
@@ -5622,18 +5689,13 @@ const updateTeam = (options) => {
 			}, {
 				field: "organizationId",
 				value: organizationId
-			}]
-		});
-		if (!existingTeam) throw ctx.error("NOT_FOUND", { message: "Team not found" });
-		const organization = await ctx.context.adapter.findOne({
-			model: "organization",
-			where: [{
-				field: "id",
-				value: organizationId
-			}]
+			}],
+			join: { organization: true }
 		});
-		if (!organization) throw ctx.error("NOT_FOUND", { message: "Organization not found" });
-		const owners = await ctx.context.adapter.findMany({
+		const organization = joinedRelation(teamRow?.organization);
+		if (!teamRow || !organization) throw ctx.error("NOT_FOUND", { message: "Team not found or does not belong to this organization" });
+		const existingTeam = teamRow;
+		const owner = (await ctx.context.adapter.findMany({
 			model: "member",
 			where: [{
 				field: "organizationId",
@@ -5648,11 +5710,9 @@ const updateTeam = (options) => {
 			},
 			limit: 1,
 			join: { user: true }
-		});
-		if (owners.length === 0) throw ctx.error("NOT_FOUND", { message: "Owner not found" });
-		const owner = owners[0];
-		const user = Array.isArray(owner.user) ? owner.user[0] : owner.user;
-		if (!user) throw ctx.error("NOT_FOUND", { message: "Owner user not found" });
+		}))[0];
+		const user = joinedRelation(owner?.user);
+		if (!owner || !user) throw ctx.error("NOT_FOUND", { message: "Organization owner not found" });
 		let updateData = { updatedAt: /* @__PURE__ */ new Date() };
 		if (ctx.body.name) updateData.name = ctx.body.name;
 		if (orgOptions?.organizationHooks?.beforeUpdateTeam) {
@@ -5692,7 +5752,7 @@ const deleteTeam = (options) => {
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireTeamsEnabled(ctx);
-		const team = await ctx.context.adapter.findOne({
+		const teamRow = await ctx.context.adapter.findOne({
 			model: "team",
 			where: [{
 				field: "id",
@@ -5700,17 +5760,12 @@ const deleteTeam = (options) => {
 			}, {
 				field: "organizationId",
 				value: organizationId
-			}]
-		});
-		if (!team) throw ctx.error("NOT_FOUND", { message: "Team not found" });
-		const organization = await ctx.context.adapter.findOne({
-			model: "organization",
-			where: [{
-				field: "id",
-				value: organizationId
-			}]
+			}],
+			join: { organization: true }
 		});
-		if (!organization) throw ctx.error("NOT_FOUND", { message: "Organization not found" });
+		const organization = joinedRelation(teamRow?.organization);
+		if (!teamRow || !organization) throw ctx.error("NOT_FOUND", { message: "Team not found or does not belong to this organization" });
+		const team = teamRow;
 		if (orgOptions?.teams?.allowRemovingAllTeams === false) {
 			if (await ctx.context.adapter.count({
 				model: "team",
@@ -5720,7 +5775,7 @@ const deleteTeam = (options) => {
 				}]
 			}) <= 1) throw ctx.error("BAD_REQUEST", { message: "Cannot remove the last team in the organization" });
 		}
-		const owners = await ctx.context.adapter.findMany({
+		const owner = (await ctx.context.adapter.findMany({
 			model: "member",
 			where: [{
 				field: "organizationId",
@@ -5735,11 +5790,9 @@ const deleteTeam = (options) => {
 			},
 			limit: 1,
 			join: { user: true }
-		});
-		if (owners.length === 0) throw ctx.error("NOT_FOUND", { message: "Owner not found" });
-		const owner = owners[0];
-		const user = Array.isArray(owner.user) ? owner.user[0] : owner.user;
-		if (!user) throw ctx.error("NOT_FOUND", { message: "Owner user not found" });
+		}))[0];
+		const user = joinedRelation(owner?.user);
+		if (!owner || !user) throw ctx.error("NOT_FOUND", { message: "Organization owner not found" });
 		if (orgOptions?.organizationHooks?.beforeDeleteTeam) await orgOptions.organizationHooks.beforeDeleteTeam({
 			team,
 			user,
@@ -5768,14 +5821,28 @@ const createTeam = (options) => {
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireTeamsEnabled(ctx);
-		const organization = await ctx.context.adapter.findOne({
-			model: "organization",
+		const owner = (await ctx.context.adapter.findMany({
+			model: "member",
 			where: [{
-				field: "id",
+				field: "organizationId",
 				value: organizationId
-			}]
-		});
-		if (!organization) throw ctx.error("NOT_FOUND", { message: "Organization not found" });
+			}, {
+				field: "role",
+				value: "owner"
+			}],
+			sortBy: {
+				field: "createdAt",
+				direction: "asc"
+			},
+			limit: 1,
+			join: {
+				user: true,
+				organization: true
+			}
+		}))[0];
+		const user = joinedRelation(owner?.user);
+		const organization = joinedRelation(owner?.organization);
+		if (!owner || !user || !organization) throw ctx.error("NOT_FOUND", { message: "Organization owner not found" });
 		if (orgOptions?.teams?.maximumTeams) {
 			const teamsCount = await ctx.context.adapter.count({
 				model: "team",
@@ -5790,26 +5857,6 @@ const createTeam = (options) => {
 			}) : orgOptions.teams.maximumTeams;
 			if (teamsCount >= maxTeams) throw ctx.error("BAD_REQUEST", { message: `Maximum number of teams (${maxTeams}) reached for this organization` });
 		}
-		const owners = await ctx.context.adapter.findMany({
-			model: "member",
-			where: [{
-				field: "organizationId",
-				value: organizationId
-			}, {
-				field: "role",
-				value: "owner"
-			}],
-			sortBy: {
-				field: "createdAt",
-				direction: "asc"
-			},
-			limit: 1,
-			join: { user: true }
-		});
-		if (owners.length === 0) throw ctx.error("NOT_FOUND", { message: "Owner not found" });
-		const owner = owners[0];
-		const user = Array.isArray(owner.user) ? owner.user[0] : owner.user;
-		if (!user) throw ctx.error("NOT_FOUND", { message: "Owner user not found" });
 		let teamData = {
 			name: ctx.body.name,
 			organizationId,
@@ -5868,7 +5915,7 @@ const listTeamMembers = (options) => {
 				}],
 				join: { user: true }
 			})).map((tm) => {
-				const user = Array.isArray(tm.user) ? tm.user[0] : tm.user;
+				const user = joinedRelation(tm.user);
 				return {
 					...tm,
 					user: user ? {
@@ -5896,7 +5943,7 @@ const addTeamMember = (options) => {
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireTeamsEnabled(ctx);
-		const team = await ctx.context.adapter.findOne({
+		const teamRow = await ctx.context.adapter.findOne({
 			model: "team",
 			where: [{
 				field: "id",
@@ -5904,26 +5951,13 @@ const addTeamMember = (options) => {
 			}, {
 				field: "organizationId",
 				value: organizationId
-			}]
-		});
-		if (!team) throw ctx.error("NOT_FOUND", { message: "Team not found" });
-		const organization = await ctx.context.adapter.findOne({
-			model: "organization",
-			where: [{
-				field: "id",
-				value: organizationId
-			}]
-		});
-		if (!organization) throw ctx.error("NOT_FOUND", { message: "Organization not found" });
-		const user = await ctx.context.adapter.findOne({
-			model: "user",
-			where: [{
-				field: "id",
-				value: ctx.body.userId
-			}]
+			}],
+			join: { organization: true }
 		});
-		if (!user) throw ctx.error("NOT_FOUND", { message: "User not found" });
-		if (!await ctx.context.adapter.findOne({
+		const organization = joinedRelation(teamRow?.organization);
+		if (!teamRow || !organization) throw ctx.error("NOT_FOUND", { message: "Team not found or does not belong to this organization" });
+		const team = teamRow;
+		const orgMember = await ctx.context.adapter.findOne({
 			model: "member",
 			where: [{
 				field: "userId",
@@ -5931,8 +5965,11 @@ const addTeamMember = (options) => {
 			}, {
 				field: "organizationId",
 				value: organizationId
-			}]
-		})) throw ctx.error("BAD_REQUEST", { message: "User is not a member of this organization" });
+			}],
+			join: { user: true }
+		});
+		const user = joinedRelation(orgMember?.user);
+		if (!orgMember || !user) throw ctx.error("BAD_REQUEST", { message: "User not found or is not a member of this organization" });
 		if (await ctx.context.adapter.count({
 			model: "teamMember",
 			where: [{
@@ -5999,7 +6036,7 @@ const removeTeamMember = (options) => {
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireTeamsEnabled(ctx);
-		const team = await ctx.context.adapter.findOne({
+		const teamRow = await ctx.context.adapter.findOne({
 			model: "team",
 			where: [{
 				field: "id",
@@ -6007,26 +6044,13 @@ const removeTeamMember = (options) => {
 			}, {
 				field: "organizationId",
 				value: organizationId
-			}]
-		});
-		if (!team) throw ctx.error("NOT_FOUND", { message: "Team not found" });
-		const organization = await ctx.context.adapter.findOne({
-			model: "organization",
-			where: [{
-				field: "id",
-				value: organizationId
-			}]
-		});
-		if (!organization) throw ctx.error("NOT_FOUND", { message: "Organization not found" });
-		const user = await ctx.context.adapter.findOne({
-			model: "user",
-			where: [{
-				field: "id",
-				value: ctx.body.userId
-			}]
+			}],
+			join: { organization: true }
 		});
-		if (!user) throw ctx.error("NOT_FOUND", { message: "User not found" });
-		const teamMember = await ctx.context.adapter.findOne({
+		const organization = joinedRelation(teamRow?.organization);
+		if (!teamRow || !organization) throw ctx.error("NOT_FOUND", { message: "Team not found or does not belong to this organization" });
+		const team = teamRow;
+		const teamMemberRow = await ctx.context.adapter.findOne({
 			model: "teamMember",
 			where: [{
 				field: "teamId",
@@ -6034,9 +6058,12 @@ const removeTeamMember = (options) => {
 			}, {
 				field: "userId",
 				value: ctx.body.userId
-			}]
+			}],
+			join: { user: true }
 		});
-		if (!teamMember) throw ctx.error("NOT_FOUND", { message: "User is not a member of this team" });
+		const user = joinedRelation(teamMemberRow?.user);
+		if (!teamMemberRow || !user) throw ctx.error("NOT_FOUND", { message: "User not found or is not a member of this team" });
+		const teamMember = teamMemberRow;
 		if (orgOptions?.organizationHooks?.beforeRemoveTeamMember) await orgOptions.organizationHooks.beforeRemoveTeamMember({
 			teamMember,
 			team,
@@ -6967,7 +6994,8 @@ async function resolveTwoFactorStatus(context, userId, user) {
 		where: [{
 			field: "userId",
 			value: userId
-		}]
+		}],
+		select: ["id"]
 	}) ? "pending" : "disabled";
 }
 //#endregion
@@ -7280,7 +7308,8 @@ const deleteManyUsers = (options) => {
 			});
 			const remainingUsers = await ctx.context.adapter.findMany({
 				model: "user",
-				where
+				where,
+				select: ["id"]
 			});
 			for (const id of chunk) if (!remainingUsers.some((u) => u.id === id)) deletedUserIds.add(id);
 			else skippedUserIds.add(id);
@@ -7470,35 +7499,72 @@ const unlinkAccount = (options) => {
 		return { success: true };
 	});
 };
+const getUserDetailsJwtSchema = z$1.object({
+	userId: z$1.string(),
+	sessionOnly: z$1.boolean().optional(),
+	accountOnly: z$1.boolean().optional()
+});
 const getUserDetails = (options) => {
 	return createAuthEndpoint("/dash/user", {
 		method: "GET",
-		use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
+		use: [jwtMiddleware(options, getUserDetailsJwtSchema)],
 		query: z$1.object({ minimal: z$1.boolean().or(z$1.string().transform((val) => val === "true")).optional() }).optional()
 	}, async (ctx) => {
-		const { userId } = ctx.context.payload;
+		const { userId, sessionOnly, accountOnly } = ctx.context.payload;
 		const minimal = !!ctx.query?.minimal;
+		if (sessionOnly && accountOnly) throw ctx.error("BAD_REQUEST", { message: "Cannot use sessionOnly and accountOnly together" });
 		const hasAdminPlugin = hasPlugin(ctx.context, "admin");
 		const secondaryStorageOnly = isSessionInSecondaryStorageOnly(ctx.context);
+		const join = (() => {
+			if (minimal) return void 0;
+			if (sessionOnly) return secondaryStorageOnly ? void 0 : { session: true };
+			if (accountOnly) return { account: true };
+			return {
+				account: true,
+				...secondaryStorageOnly ? {} : { session: true }
+			};
+		})();
 		const user = await ctx.context.adapter.findOne({
 			model: "user",
 			where: [{
 				field: "id",
 				value: userId
 			}],
-			...minimal ? {} : { join: {
-				account: true,
-				...secondaryStorageOnly ? {} : { session: true }
-			} }
+			...join ? { join } : {}
 		});
 		if (!user) throw ctx.error("NOT_FOUND", { message: "User not found" });
+		const banFields = {
+			banned: hasAdminPlugin ? user.banned ?? false : false,
+			banReason: hasAdminPlugin ? user.banReason ?? null : null,
+			banExpires: hasAdminPlugin ? user.banExpires ?? null : null
+		};
+		const lastActiveAtFromUser = user.lastActiveAt ?? null;
+		if (sessionOnly) {
+			const sessions = secondaryStorageOnly ? normalizeDashSessions(await ctx.context.internalAdapter.listSessions(userId)) : user.session || [];
+			const { session: _session, account: _account, ...userWithoutRelations } = user;
+			return {
+				...userWithoutRelations,
+				...banFields,
+				lastActiveAt: lastActiveAtFromUser,
+				session: sanitizeSessions(sessions),
+				account: []
+			};
+		}
+		if (accountOnly) {
+			const { session: _session, account, ...userWithoutRelations } = user;
+			return {
+				...userWithoutRelations,
+				...banFields,
+				lastActiveAt: lastActiveAtFromUser,
+				account: account || [],
+				session: []
+			};
+		}
 		const twoFactorStatus = await resolveTwoFactorStatus(ctx.context, userId, user);
 		if (minimal) return {
 			...user,
-			lastActiveAt: user.lastActiveAt ?? null,
-			banned: hasAdminPlugin ? user.banned ?? false : false,
-			banReason: hasAdminPlugin ? user.banReason ?? null : null,
-			banExpires: hasAdminPlugin ? user.banExpires ?? null : null,
+			lastActiveAt: lastActiveAtFromUser,
+			...banFields,
 			account: [],
 			session: [],
 			twoFactorStatus
@@ -7538,9 +7604,7 @@ const getUserDetails = (options) => {
 			...userWithoutSessions,
 			session: sanitizeSessions(sessions),
 			lastActiveAt,
-			banned: hasAdminPlugin ? user.banned ?? false : false,
-			banReason: hasAdminPlugin ? user.banReason ?? null : null,
-			banExpires: hasAdminPlugin ? user.banExpires ?? null : null,
+			...banFields,
 			twoFactorStatus
 		};
 	});
@@ -7645,7 +7709,7 @@ async function countUniqueActiveUsers(ctx, range, options) {
 					break;
 				}
 			}
-		}, { concurrency: 10 });
+		}, { concurrency: 5 });
 		return activeUserIds.size;
 	}
 	const sessions = await ctx.context.adapter.findMany({
@@ -7857,8 +7921,8 @@ const getUserGraphData = (options) => createAuthEndpoint("/dash/user-graph-data"
 			label
 		});
 	}
-	const allQueries = intervalData.flatMap((interval) => [
-		ctx.context.adapter.count({
+	const results = await withConcurrency(intervalData.flatMap((interval) => [
+		() => ctx.context.adapter.count({
 			model: "user",
 			where: [{
 				field: "createdAt",
@@ -7866,7 +7930,7 @@ const getUserGraphData = (options) => createAuthEndpoint("/dash/user-graph-data"
 				value: interval.endDate
 			}]
 		}),
-		ctx.context.adapter.count({
+		() => ctx.context.adapter.count({
 			model: "user",
 			where: [{
 				field: "createdAt",
@@ -7878,15 +7942,14 @@ const getUserGraphData = (options) => createAuthEndpoint("/dash/user-graph-data"
 				value: interval.endDate
 			}]
 		}),
-		countUniqueActiveUsers(ctx, {
+		() => countUniqueActiveUsers(ctx, {
 			from: interval.startDate,
 			to: interval.endDate
 		}, {
 			storeInSecondaryStorageOnly,
 			activityTrackingEnabled
 		})
-	]);
-	const results = await Promise.all(allQueries);
+	]), (runQuery) => runQuery(), { concurrency: 5 });
 	return {
 		data: intervalData.map((interval, idx) => ({
 			date: typeof interval.endDate === "object" ? interval.endDate : interval.endDate,
@@ -7948,41 +8011,19 @@ const getUserRetentionData = (options) => createAuthEndpoint("/dash/user-retenti
 	const activeStart = period === "daily" ? startOfUtcDay(now) : period === "weekly" ? startOfUtcWeek(now) : startOfUtcMonth(now);
 	const activeEnd = period === "daily" ? addUtcDays(activeStart, 1) : period === "weekly" ? addUtcDays(activeStart, 7) : addUtcMonths(activeStart, 1);
 	const prefix = period === "daily" ? "D" : period === "weekly" ? "W" : "M";
-	const data = [];
-	for (let n = 1; n <= horizons; n++) {
+	const activeStartIso = activeStart.toISOString();
+	const activeEndIso = activeEnd.toISOString();
+	const intervalMeta = Array.from({ length: horizons }, (_, index) => {
+		const n = index + 1;
 		const cohortStart = period === "daily" ? addUtcDays(activeStart, -n) : period === "weekly" ? addUtcDays(activeStart, -7 * n) : addUtcMonths(activeStart, -n);
-		const cohortEnd = period === "daily" ? addUtcDays(cohortStart, 1) : period === "weekly" ? addUtcDays(cohortStart, 7) : addUtcMonths(cohortStart, 1);
-		const cohortUsers = await ctx.context.adapter.findMany({
-			model: "user",
-			select: ["id"],
-			where: [{
-				field: "createdAt",
-				operator: "gte",
-				value: cohortStart
-			}, {
-				field: "createdAt",
-				operator: "lt",
-				value: cohortEnd
-			}]
-		});
-		const cohortSize = cohortUsers.length;
-		if (cohortSize === 0) {
-			data.push({
-				n,
-				label: `${prefix}${n}`,
-				cohortStart: cohortStart.toISOString(),
-				cohortEnd: cohortEnd.toISOString(),
-				activeStart: activeStart.toISOString(),
-				activeEnd: activeEnd.toISOString(),
-				cohortSize: 0,
-				retained: 0,
-				retentionRate: 0
-			});
-			continue;
-		}
-		const cohortUserIds = cohortUsers.map((u) => u.id);
-		let retained;
-		if (activityTrackingEnabled) retained = await ctx.context.adapter.count({
+		return {
+			n,
+			cohortStart,
+			cohortEnd: period === "daily" ? addUtcDays(cohortStart, 1) : period === "weekly" ? addUtcDays(cohortStart, 7) : addUtcMonths(cohortStart, 1)
+		};
+	});
+	const countRetainedUsers = async (cohortUserIds) => {
+		if (activityTrackingEnabled) return ctx.context.adapter.count({
 			model: "user",
 			where: [
 				{
@@ -8005,7 +8046,7 @@ const getUserRetentionData = (options) => createAuthEndpoint("/dash/user-retenti
 			ctx.context.logger.warn("[Dash] Failed to count retained users by lastActiveAt:", error);
 			return 0;
 		});
-		else if (secondaryOnly) {
+		if (secondaryOnly) {
 			const activeStartMs = activeStart.getTime();
 			const activeEndMs = activeEnd.getTime();
 			const retainedUsers = /* @__PURE__ */ new Set();
@@ -8018,50 +8059,78 @@ const getUserRetentionData = (options) => createAuthEndpoint("/dash/user-retenti
 						break;
 					}
 				}
-			}, { concurrency: 50 });
-			retained = retainedUsers.size;
-		} else {
-			const sessionsInActiveWindow = await ctx.context.adapter.findMany({
-				model: "session",
-				select: ["userId"],
-				where: [
-					{
-						field: "userId",
-						operator: "in",
-						value: cohortUserIds
-					},
-					{
-						field: "updatedAt",
-						operator: "gte",
-						value: activeStart
-					},
-					{
-						field: "updatedAt",
-						operator: "lt",
-						value: activeEnd
-					}
-				]
-			}).catch((error) => {
-				ctx.context.logger.warn("[Dash] Failed to fetch cohort sessions:", error);
-				return [];
-			});
-			retained = new Set(sessionsInActiveWindow.map((s) => s.userId)).size;
+			}, { concurrency: 5 });
+			return retainedUsers.size;
 		}
-		const retentionRate = cohortSize > 0 ? Math.round(retained / cohortSize * 100 * 10) / 10 : 0;
-		data.push({
-			n,
-			label: `${prefix}${n}`,
-			cohortStart: cohortStart.toISOString(),
-			cohortEnd: cohortEnd.toISOString(),
-			activeStart: activeStart.toISOString(),
-			activeEnd: activeEnd.toISOString(),
-			cohortSize,
-			retained,
-			retentionRate
+		const sessionsInActiveWindow = await ctx.context.adapter.findMany({
+			model: "session",
+			select: ["userId"],
+			where: [
+				{
+					field: "userId",
+					operator: "in",
+					value: cohortUserIds
+				},
+				{
+					field: "updatedAt",
+					operator: "gte",
+					value: activeStart
+				},
+				{
+					field: "updatedAt",
+					operator: "lt",
+					value: activeEnd
+				}
+			]
+		}).catch((error) => {
+			ctx.context.logger.warn("[Dash] Failed to fetch cohort sessions:", error);
+			return [];
 		});
-	}
+		return new Set(sessionsInActiveWindow.map((s) => s.userId)).size;
+	};
 	return {
-		data,
+		data: await withConcurrency(intervalMeta, async ({ n, cohortStart, cohortEnd }) => {
+			const cohortStartIso = cohortStart.toISOString();
+			const cohortEndIso = cohortEnd.toISOString();
+			const cohortUsers = await ctx.context.adapter.findMany({
+				model: "user",
+				select: ["id"],
+				where: [{
+					field: "createdAt",
+					operator: "gte",
+					value: cohortStart
+				}, {
+					field: "createdAt",
+					operator: "lt",
+					value: cohortEnd
+				}]
+			});
+			const cohortSize = cohortUsers.length;
+			if (cohortSize === 0) return {
+				n,
+				label: `${prefix}${n}`,
+				cohortStart: cohortStartIso,
+				cohortEnd: cohortEndIso,
+				activeStart: activeStartIso,
+				activeEnd: activeEndIso,
+				cohortSize: 0,
+				retained: 0,
+				retentionRate: 0
+			};
+			const retained = await countRetainedUsers(cohortUsers.map((u) => u.id));
+			const retentionRate = Math.round(retained / cohortSize * 100 * 10) / 10;
+			return {
+				n,
+				label: `${prefix}${n}`,
+				cohortStart: cohortStartIso,
+				cohortEnd: cohortEndIso,
+				activeStart: activeStartIso,
+				activeEnd: activeEndIso,
+				cohortSize,
+				retained,
+				retentionRate
+			};
+		}, { concurrency: 5 }),
 		period
 	};
 });
@@ -8611,6 +8680,7 @@ const dash = (options) => {
 									country: location?.country,
 									countryCode: location?.countryCode
 								};
+								const eventUser = resolveUserFromContext(session.userId, ctx);
 								let trigger = null;
 								if (matchesAnyRoute(ctx.path, [
 									routes.SIGN_IN,
@@ -8619,18 +8689,19 @@ const dash = (options) => {
 									routes.SIGN_IN_OAUTH_CALLBACK
 								])) {
 									trigger = getTriggerInfo(ctx, session.userId, enrichedSession);
-									trackUserSignedIn(enrichedSession, trigger, ctx, location);
+									trackUserSignedIn(enrichedSession, trigger, ctx, location, eventUser);
 								} else trigger = getTriggerInfo(ctx, session.userId);
-								trackSessionCreated(enrichedSession, trigger, ctx, location);
+								trackSessionCreated(enrichedSession, trigger, ctx, location, eventUser);
 								if ("impersonatedBy" in session && session.impersonatedBy) {
 									trigger = {
 										...trigger,
 										triggeredBy: session.impersonatedBy
 									};
-									trackUserImpersonated(enrichedSession, trigger, ctx, location);
+									const knownImpersonator = resolveUserFromContext(session.impersonatedBy, ctx);
+									trackUserImpersonated(enrichedSession, trigger, ctx, location, eventUser, knownImpersonator);
 								}
 								if (opts.activityTracking?.enabled) try {
-									await ctx.context.adapter.update({
+									await ctx.context.adapter.updateMany({
 										model: "user",
 										where: [{
 											field: "id",
@@ -8656,6 +8727,7 @@ const dash = (options) => {
 								countryCode: location?.countryCode
 							};
 							const trigger = getTriggerInfo(ctx, session.userId);
+							const eventUser = resolveUserFromContext(session.userId, ctx);
 							if (matchesAnyRoute(ctx.path, [
 								routes.REVOKE_ALL_SESSIONS,
 								routes.ADMIN_REVOKE_USER_SESSIONS,
@@ -8663,12 +8735,12 @@ const dash = (options) => {
 								routes.DASH_BAN_USER
 							])) {
 								if (!processedBulkOperationContexts.has(ctx)) {
-									trackSessionRevokedAll(enrichedSession, trigger, ctx, location);
+									trackSessionRevokedAll(enrichedSession, trigger, ctx, location, eventUser);
 									processedBulkOperationContexts.add(ctx);
 								}
-							} else if (matchesAnyRoute(path, [routes.SIGN_OUT])) trackUserSignedOut(enrichedSession, trigger, ctx, location);
-							else trackSessionRevoked(enrichedSession, trigger, ctx, location);
-							if ("impersonatedBy" in session && session.impersonatedBy) trackUserImpersonationStop(enrichedSession, trigger, ctx, location);
+							} else if (matchesAnyRoute(path, [routes.SIGN_OUT])) trackUserSignedOut(enrichedSession, trigger, ctx, location, eventUser);
+							else trackSessionRevoked(enrichedSession, trigger, ctx, location, eventUser);
+							if ("impersonatedBy" in session && session.impersonatedBy) trackUserImpersonationStop(enrichedSession, trigger, ctx, location, eventUser, resolveUserFromContext(session.impersonatedBy, ctx));
 						} }
 					},
 					account: {
@@ -8685,13 +8757,14 @@ const dash = (options) => {
 							const path = ctx.path;
 							const trigger = getTriggerInfo(ctx, account.userId);
 							const location = ctx.context.location;
-							if (matchesAnyRoute(path, [
+							if (!matchesAnyRoute(path, [
 								routes.CHANGE_PASSWORD,
 								routes.SET_PASSWORD,
 								routes.RESET_PASSWORD,
 								routes.ADMIN_SET_PASSWORD,
 								routes.DASH_SET_PASSWORD
-							])) trackAccountPasswordChange(account, trigger, ctx, location);
+							])) return;
+							trackAccountPasswordChange(account, trigger, ctx, location);
 						} },
 						delete: { async after(account, _ctx) {
 							const ctx = _ctx;
@@ -8736,7 +8809,7 @@ const dash = (options) => {
 						routes.DASH_COMPLETE_INVITATION_SOCIAL
 					]);
 				},
-				handler: createIdentificationMiddleware($kv)
+				handler: createIdentificationMiddleware($kv, { skipIdentification: (ctx) => isDashRoute(ctx.path) })
 			}],
 			after: [{
 				matcher: (ctx) => {
@@ -8779,13 +8852,15 @@ const dash = (options) => {
 					if (lastUpdate) {
 						if (now - new Date(lastUpdate).getTime() < activityUpdateInterval) return;
 					}
-					ctx.context.adapter.update({
+					ctx.context.adapter.updateMany({
 						model: "user",
 						where: [{
 							field: "id",
 							value: userId
 						}],
 						update: { lastActiveAt: /* @__PURE__ */ new Date() }
+					}).catch((error) => {
+						logger.warn("[Dash] Failed to update user activity", error);
 					});
 				}),
 				matcher: (ctx) => ctx.request?.method !== "GET"