@better-auth/infra 0.4.0 → 0.4.1

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CcJHk5SE.mjs";
-import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-CAdWFWEz.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CtvGRrlI.mjs";
+import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-CV91nSbp.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAdapter, getCurrentAuthContext, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
@@ -8,7 +8,7 @@ import { APIError as APIError$1, createAuthEndpoint, createAuthMiddleware, reque
 import { deleteSessionCookie, setSessionCookie } from "better-auth/cookies";
 import { createFetch } from "@better-fetch/fetch";
 import { isValidPhoneNumber, parsePhoneNumberFromString } from "libphonenumber-js";
-import z$1, { z } from "zod";
+import z, { z as z$1 } from "zod";
 import { createLocalJWKSet, jwtVerify } from "jose";
 import { generateRandomString, symmetricEncrypt } from "better-auth/crypto";
 import { createOTP } from "@better-auth/utils/otp";
@@ -313,7 +313,8 @@ function tryDecode(value) {
 const stripQuery = (value) => value.split("?")[0] || value;
 const escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 const routeToRegex = (route) => {
-	const pattern = escapeRegex(stripQuery(route)).replace(/\/:([^/]+)/g, "/[^/]+");
+	const normalized = stripQuery(route);
+	const pattern = escapeRegex(normalized).replace(/\/:([^/]+)/g, "/[^/]+");
 	return new RegExp(`^${pattern}(?:$|[/?])`);
 };
 const matchesAnyRoute = (path, routes) => {
@@ -1296,8 +1297,9 @@ function isEmailNormalizationEnabled(security) {
 * @param $api — Dash client from `createAPI(opts, { throw: true })`.
 */
 function createSecurityClient(conn, $api, options, onSecurityEvent) {
+	const resolvedApiUrl = conn.apiUrl || INFRA_API_URL;
 	const emailSender = createEmailSender({
-		apiUrl: conn.apiUrl || INFRA_API_URL,
+		apiUrl: resolvedApiUrl,
 		apiKey: conn.apiKey
 	});
 	function logEvent(event) {
@@ -1741,7 +1743,7 @@ const authPaths = [
 	"/email-otp/send-verification-otp"
 ];
 const registration = new Set(registrationPaths);
-const all = new Set([...registrationPaths, ...authPaths]);
+const all = /* @__PURE__ */ new Set([...registrationPaths, ...authPaths]);
 /** Path carries an email we hook for normalization + syntax validation. */
 const allEmail = ({ path }) => !!path && all.has(path);
 /**
@@ -1754,11 +1756,11 @@ const registrationEmail = ({ path }) => !!path && registration.has(path);
 /**
 * Gmail-like providers that ignore dots in the local part
 */
-const GMAIL_LIKE_DOMAINS = new Set(["gmail.com", "googlemail.com"]);
+const GMAIL_LIKE_DOMAINS = /* @__PURE__ */ new Set(["gmail.com", "googlemail.com"]);
 /**
 * Providers known to support plus addressing
 */
-const PLUS_ADDRESSING_DOMAINS = new Set([
+const PLUS_ADDRESSING_DOMAINS = /* @__PURE__ */ new Set([
 	"gmail.com",
 	"googlemail.com",
 	"outlook.com",
@@ -2028,7 +2030,7 @@ function createEmailHooks(options = {}) {
 * Common fake/test phone numbers that should be blocked
 * These are numbers commonly used in testing, movies, documentation, etc.
 */
-const INVALID_PHONE_NUMBERS = new Set([
+const INVALID_PHONE_NUMBERS = /* @__PURE__ */ new Set([
 	"+15550000000",
 	"+15550001111",
 	"+15550001234",
@@ -2117,7 +2119,7 @@ const INVALID_PHONE_PATTERNS = [
 * Key: country code, Value: set of invalid prefixes
 */
 const INVALID_PREFIXES_BY_COUNTRY = {
-	US: new Set([
+	US: /* @__PURE__ */ new Set([
 		"555",
 		"000",
 		"111",
@@ -2125,17 +2127,17 @@ const INVALID_PREFIXES_BY_COUNTRY = {
 		"411",
 		"611"
 	]),
-	CA: new Set([
+	CA: /* @__PURE__ */ new Set([
 		"555",
 		"000",
 		"911"
 	]),
-	GB: new Set([
+	GB: /* @__PURE__ */ new Set([
 		"7700900",
 		"1632960",
 		"1134960"
 	]),
-	AU: new Set([
+	AU: /* @__PURE__ */ new Set([
 		"0491570",
 		"0491571",
 		"0491572"
@@ -2205,7 +2207,7 @@ const validatePhone = (phone, options = {}) => {
 	if (blockVoip && phoneType === "VOIP") return false;
 	return true;
 };
-const allPhonePaths = new Set([
+const allPhonePaths = /* @__PURE__ */ new Set([
 	"/phone-number/send-otp",
 	"/phone-number/verify",
 	"/sign-in/phone-number",
@@ -2786,33 +2788,33 @@ const ALL_SCIM_SCOPES = [
 	"scim.groups.read",
 	"scim.groups.write"
 ];
-const scimScopeSchema = z$1.enum(ALL_SCIM_SCOPES);
+const scimScopeSchema = z.enum(ALL_SCIM_SCOPES);
 const credentialPolicySchema = {
-	scopes: z$1.array(scimScopeSchema).min(1).optional(),
-	expiresAt: z$1.coerce.date().optional()
+	scopes: z.array(scimScopeSchema).min(1).optional(),
+	expiresAt: z.coerce.date().optional()
 };
-const directorySyncSSOPairingSchema = z$1.discriminatedUnion("protocol", [z$1.object({
-	ssoProviderId: z$1.string().trim().min(1).max(255),
-	protocol: z$1.literal("oidc"),
-	externalIdSource: z$1.discriminatedUnion("kind", [z$1.object({ kind: z$1.literal("subject") }), z$1.object({
-		kind: z$1.literal("verifiedIdTokenClaim"),
-		name: z$1.string().trim().min(1).max(255)
+const directorySyncSSOPairingSchema = z.discriminatedUnion("protocol", [z.object({
+	ssoProviderId: z.string().trim().min(1).max(255),
+	protocol: z.literal("oidc"),
+	externalIdSource: z.discriminatedUnion("kind", [z.object({ kind: z.literal("subject") }), z.object({
+		kind: z.literal("verifiedIdTokenClaim"),
+		name: z.string().trim().min(1).max(255)
 	})])
-}), z$1.object({
-	ssoProviderId: z$1.string().trim().min(1).max(255),
-	protocol: z$1.literal("saml"),
-	externalIdSource: z$1.discriminatedUnion("kind", [z$1.object({ kind: z$1.literal("nameId") }), z$1.object({
-		kind: z$1.literal("attribute"),
-		name: z$1.string().trim().min(1).max(255)
+}), z.object({
+	ssoProviderId: z.string().trim().min(1).max(255),
+	protocol: z.literal("saml"),
+	externalIdSource: z.discriminatedUnion("kind", [z.object({ kind: z.literal("nameId") }), z.object({
+		kind: z.literal("attribute"),
+		name: z.string().trim().min(1).max(255)
 	})])
 })]);
-const createDirectoryBodySchema = z$1.object({
-	providerId: z$1.string().trim().min(1).max(255),
+const createDirectoryBodySchema = z.object({
+	providerId: z.string().trim().min(1).max(255),
 	pairing: directorySyncSSOPairingSchema.optional(),
 	...credentialPolicySchema
 });
-const rotateCredentialBodySchema = z$1.object(credentialPolicySchema);
-const emptyBodySchema = z$1.object({});
+const rotateCredentialBodySchema = z.object(credentialPolicySchema);
+const emptyBodySchema = z.object({});
 function setCredentialResponseSecurityHeaders(ctx) {
 	ctx.setHeader("Cache-Control", "no-store, max-age=0");
 	ctx.setHeader("Pragma", "no-cache");
@@ -2822,7 +2824,7 @@ function setCredentialResponseSecurityHeaders(ctx) {
 //#region src/directory-sync/pairing.ts
 let samlPolicyModule;
 function loadSAMLPolicy() {
-	samlPolicyModule ??= import("./saml-policy-BTVLoTyS.mjs");
+	samlPolicyModule ??= import("./saml-policy-DQR0MBLk.mjs");
 	return samlPolicyModule;
 }
 function isRecord$1(value) {
@@ -3017,35 +3019,41 @@ function instrumentDirectorySyncIntegration(ctx, options) {
 		logger.debug("[Dash] Managed directory sync enabled but SSO/SCIM plugins are not active. Skipping integration instrumentation");
 		return;
 	}
-	if (options.ssoPairing) if (ssoPlugin) if (!ssoPlugin.options) logger.error("[Dash] Managed directory sync ssoPairing requires sso({ ... }) (at least sso({})) so pairing callbacks can be installed on the shared options object.");
-	else {
-		const ssoOptions = ssoPlugin.options;
-		const previousResolveUser = ssoOptions.resolveUser;
-		ssoOptions.resolveUser = async (input, context) => {
-			const result = await resolveOrganizationDirectorySyncUser(input, context);
-			if (result.action !== "continue") return result;
-			if (previousResolveUser) return previousResolveUser(input, context);
-			return { action: "continue" };
-		};
-		const previousGuard = ssoOptions.guardProviderMutation;
-		ssoOptions.guardProviderMutation = async (input, context) => {
-			await guardDirectorySyncSSOProviderMutation(input, context);
-			if (previousGuard) await previousGuard(input, context);
-		};
+	if (options.ssoPairing) {
+		if (ssoPlugin) {
+			if (!ssoPlugin.options) logger.error("[Dash] Managed directory sync ssoPairing requires sso({ ... }) (at least sso({})) so pairing callbacks can be installed on the shared options object.");
+			else {
+				const ssoOptions = ssoPlugin.options;
+				const previousResolveUser = ssoOptions.resolveUser;
+				ssoOptions.resolveUser = async (input, context) => {
+					const result = await resolveOrganizationDirectorySyncUser(input, context);
+					if (result.action !== "continue") return result;
+					if (previousResolveUser) return previousResolveUser(input, context);
+					return { action: "continue" };
+				};
+				const previousGuard = ssoOptions.guardProviderMutation;
+				ssoOptions.guardProviderMutation = async (input, context) => {
+					await guardDirectorySyncSSOProviderMutation(input, context);
+					if (previousGuard) await previousGuard(input, context);
+				};
+			}
+		} else logger.debug("[Dash] Managed directory sync ssoPairing enabled but SSO plugin is not active. Skipping SSO pairing instrumentation");
 	}
-	else logger.debug("[Dash] Managed directory sync ssoPairing enabled but SSO plugin is not active. Skipping SSO pairing instrumentation");
-	if (options.membershipProjection.enabled) if (scimPlugin) if (!scimPlugin.options) logger.error("[Dash] Managed directory sync membershipProjection requires scim({ ... }) with an options object so membership projection can be installed.");
-	else {
-		const scimOptions = scimPlugin.options;
-		const projection = scimOptions.projection ??= {};
-		const previousReconcileUser = projection.reconcileUser;
-		const reconcileUser = createOrganizationMembershipProjection({ role: options.membershipProjection.role });
-		projection.reconcileUser = async (input, context) => {
-			await reconcileUser(input, context);
-			if (previousReconcileUser) await previousReconcileUser(input, context);
-		};
+	if (options.membershipProjection.enabled) {
+		if (scimPlugin) {
+			if (!scimPlugin.options) logger.error("[Dash] Managed directory sync membershipProjection requires scim({ ... }) with an options object so membership projection can be installed.");
+			else {
+				const scimOptions = scimPlugin.options;
+				const projection = scimOptions.projection ??= {};
+				const previousReconcileUser = projection.reconcileUser;
+				const reconcileUser = createOrganizationMembershipProjection({ role: options.membershipProjection.role });
+				projection.reconcileUser = async (input, context) => {
+					await reconcileUser(input, context);
+					if (previousReconcileUser) await previousReconcileUser(input, context);
+				};
+			}
+		} else logger.debug("[Dash] Managed directory sync membershipProjection enabled but SCIM plugin is not active. Skipping membership projection instrumentation");
 	}
-	else logger.debug("[Dash] Managed directory sync membershipProjection enabled but SCIM plugin is not active. Skipping membership projection instrumentation");
 }
 //#endregion
 //#region src/events/organization/events-invitation.ts
@@ -3462,7 +3470,7 @@ function snakeCaseToCamelCase(key) {
 function keyVariantsForMatching(key) {
 	const trimmed = key.replace(/^[\s._-]+/, "");
 	if (!trimmed) return [key];
-	const out = new Set([key, trimmed]);
+	const out = /* @__PURE__ */ new Set([key, trimmed]);
 	if (trimmed.includes("_")) out.add(snakeCaseToCamelCase(trimmed));
 	return [...out];
 }
@@ -3482,7 +3490,7 @@ function matchesNormalizedPatterns(key, patterns) {
 	if (!hasAnyPatterns(patterns)) return false;
 	const variants = keyVariantsForMatching(key);
 	const compactLower = key.replace(/[\s._-]/g, "").toLowerCase();
-	const forms = new Set([compactLower]);
+	const forms = /* @__PURE__ */ new Set([compactLower]);
 	for (const raw of variants) {
 		forms.add(raw);
 		forms.add(raw.toLowerCase());
@@ -3540,9 +3548,9 @@ function redact(value, options) {
 	const patterns = normalizePatterns(options?.patterns);
 	return redactInner(value, /* @__PURE__ */ new WeakSet(), options, patterns);
 }
-const DASH_PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
+const DASH_PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: /* @__PURE__ */ new Set(["stripeClient"]) };
 /** Storage-strategy enums that match sensitive key suffixes but are not secrets. */
-const DASH_PLUGIN_OPTIONS_IGNORE_KEYS = new Set([
+const DASH_PLUGIN_OPTIONS_IGNORE_KEYS = /* @__PURE__ */ new Set([
 	"storeApiKey",
 	"storeClientSecret",
 	"storeSCIMToken",
@@ -3623,7 +3631,7 @@ function timingSafeEqualHash(a, b) {
 * A freshly issued token is almost certainly legitimate.
 */
 const JTI_CHECK_GRACE_PERIOD_SECONDS = 30;
-const JWKS_CACHE_TTL_MS = 900 * 1e3;
+const JWKS_CACHE_TTL_MS = 9e5;
 const jwksCache = /* @__PURE__ */ new Map();
 const inflightRequests = /* @__PURE__ */ new Map();
 async function fetchJWKS(ctx, cacheKey, $api) {
@@ -3672,7 +3680,8 @@ const jwtMiddleware = (options, schema, getJWT) => {
 			ctx.context.logger.warn("[Dash] JWT is missing from header");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(ctx, cacheKey, $api), { maxTokenAge: "5m" }).catch((e) => {
+		const remoteJWKs = await getJWKs(ctx, cacheKey, $api);
+		const { payload } = await jwtVerify(jwsFromHeader, remoteJWKs, { maxTokenAge: "5m" }).catch((e) => {
 			ctx.context.logger.warn("[Dash] JWT verification failed:", e);
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		});
@@ -3726,7 +3735,8 @@ const jwtValidateMiddleware = (options) => {
 			ctx.context.logger.warn("[Dash] JWT is missing from header");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(ctx, cacheKey, $api), { maxTokenAge: "5m" }).catch((e) => {
+		const remoteJWKs = await getJWKs(ctx, cacheKey, $api);
+		const { payload } = await jwtVerify(jwsFromHeader, remoteJWKs, { maxTokenAge: "5m" }).catch((e) => {
 			ctx.context.logger.error("[Dash] JWT verification failed:", e);
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		});
@@ -4055,12 +4065,12 @@ function assertManagedDirectorySyncEnabled(ctx) {
 }
 //#endregion
 //#region src/routes/directory-sync/route-contract.ts
-const DIRECTORY_SYNC_CREDENTIAL_LIFETIME_MS = 365 * 24 * 60 * 60 * 1e3;
-const directorySyncClaimsSchema = z$1.object({
-	purpose: z$1.literal(DIRECTORY_SYNC_PURPOSE),
-	organizationId: z$1.string().trim().min(1),
-	actorId: z$1.string().trim().min(1),
-	setupOperationId: z$1.string().trim().min(16).max(255).optional()
+const DIRECTORY_SYNC_CREDENTIAL_LIFETIME_MS = 31536e6;
+const directorySyncClaimsSchema = z.object({
+	purpose: z.literal(DIRECTORY_SYNC_PURPOSE),
+	organizationId: z.string().trim().min(1),
+	actorId: z.string().trim().min(1),
+	setupOperationId: z.string().trim().min(16).max(255).optional()
 });
 function getScimEndpoint$1(baseUrl) {
 	return `${baseUrl}/scim/v2`;
@@ -4772,10 +4782,10 @@ const revokeDirectoryCredential = (options) => createAuthEndpoint("/dash/organiz
 const DIRECTORY_EVENTS_DEFAULT_LIMIT = 10;
 const DIRECTORY_PAGE_MAX_LIMIT = 100;
 const DIRECTORY_EVENTS_DEFAULT_SORT_DIRECTION = "desc";
-const directoryEventsQuerySchema = z$1.object({
-	limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-	offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-	sortDirection: z$1.enum(["asc", "desc"]).optional()
+const directoryEventsQuerySchema = z.object({
+	limit: z.number().or(z.string().transform(Number)).optional(),
+	offset: z.number().or(z.string().transform(Number)).optional(),
+	sortDirection: z.enum(["asc", "desc"]).optional()
 }).optional();
 function resolveDirectoryEventsPage(query) {
 	const requestedLimit = query?.limit;
@@ -4927,7 +4937,7 @@ function parseMemberRoles(role) {
 }
 function getScimManagementRoles(ctx) {
 	const creatorRole = ctx.context.getPlugin("organization")?.options?.creatorRole ?? "owner";
-	return Array.from(new Set(["admin", creatorRole]));
+	return Array.from(/* @__PURE__ */ new Set(["admin", creatorRole]));
 }
 async function findOrganizationScimManagerUserId(ctx, organizationId) {
 	const requiredRoles = getScimManagementRoles(ctx);
@@ -5028,10 +5038,10 @@ const listOrganizationDirectories = (options) => {
 const createOrganizationDirectoryLegacy = (options) => {
 	return createAuthEndpoint("/dash/organization/directory/create", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			providerId: z$1.string().min(1, "Provider ID is required"),
-			ownerUserId: z$1.string().min(1, "Owner user ID is required")
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			providerId: z.string().min(1, "Provider ID is required"),
+			ownerUserId: z.string().min(1, "Owner user ID is required")
 		})
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
@@ -5068,8 +5078,8 @@ const createOrganizationDirectoryLegacy = (options) => {
 const deleteOrganizationDirectoryLegacy = (options) => {
 	return createAuthEndpoint("/dash/organization/directory/delete", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ providerId: z$1.string().min(1, "Provider ID is required") })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ providerId: z.string().min(1, "Provider ID is required") })
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const scimPlugin = getSCIMPlugin(ctx);
@@ -5092,8 +5102,8 @@ const deleteOrganizationDirectoryLegacy = (options) => {
 const regenerateDirectoryTokenLegacy = (options) => {
 	return createAuthEndpoint("/dash/organization/directory/regenerate-token", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ providerId: z$1.string().min(1, "Provider ID is required") })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ providerId: z.string().min(1, "Provider ID is required") })
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const scimPlugin = getSCIMPlugin(ctx);
@@ -5163,13 +5173,13 @@ const getUserEvents = (options) => {
 	return createAuthEndpoint("/events/list", {
 		method: "GET",
 		use: [sessionMiddleware],
-		query: z$1.object({
+		query: z.object({
 			/** Maximum number of events to return (default: 50, max: 100) */
-			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
+			limit: z.number().or(z.string().transform(Number)).optional(),
 			/** Number of events to skip for pagination (default: 0) */
-			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
+			offset: z.number().or(z.string().transform(Number)).optional(),
 			/** Filter by event type (e.g., "user_signed_in") */
-			eventType: z$1.string().optional()
+			eventType: z.string().optional()
 		}).optional()
 	}, async (ctx) => {
 		const session = ctx.context.session;
@@ -5232,13 +5242,13 @@ const getAuditLogs = (options) => {
 	return createAuthEndpoint("/events/audit-logs", {
 		method: "GET",
 		use: [sessionMiddleware],
-		query: z$1.object({
-			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-			userId: z$1.string().optional(),
-			organizationId: z$1.string().optional(),
-			identifier: z$1.string().optional(),
-			eventType: z$1.string().optional()
+		query: z.object({
+			limit: z.number().or(z.string().transform(Number)).optional(),
+			offset: z.number().or(z.string().transform(Number)).optional(),
+			userId: z.string().optional(),
+			organizationId: z.string().optional(),
+			identifier: z.string().optional(),
+			eventType: z.string().optional()
 		}).optional()
 	}, async (ctx) => {
 		const session = ctx.context.session;
@@ -5313,7 +5323,7 @@ const getAuditLogs = (options) => {
 		};
 	});
 };
-const OWNER_ADMIN_ROLES = new Set(["owner", "admin"]);
+const OWNER_ADMIN_ROLES = /* @__PURE__ */ new Set(["owner", "admin"]);
 function isOwnerOrAdminRole(role) {
 	return role !== void 0 && OWNER_ADMIN_ROLES.has(role);
 }
@@ -5354,15 +5364,15 @@ const getAllAuditLogs = (options) => {
 	return createAuthEndpoint("/events/all-audit-logs", {
 		method: "GET",
 		use: [sessionMiddleware],
-		query: z$1.object({
-			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-			userId: z$1.string().optional(),
-			organizationId: z$1.string().optional(),
+		query: z.object({
+			limit: z.number().or(z.string().transform(Number)).optional(),
+			offset: z.number().or(z.string().transform(Number)).optional(),
+			userId: z.string().optional(),
+			organizationId: z.string().optional(),
 			/** Filter by event type (e.g. `organization_member_added`) */
-			eventType: z$1.string().optional(),
+			eventType: z.string().optional(),
 			/** Match `eventData.identifier` (organization-scoped actor identity) */
-			identifier: z$1.string().optional()
+			identifier: z.string().optional()
 		}).refine((q) => {
 			const u = q.userId?.trim();
 			const o = q.organizationId?.trim();
@@ -5419,10 +5429,10 @@ const getAllAuditLogs = (options) => {
 };
 //#endregion
 //#region src/routes/execute-adapter/index.ts
-const whereClause = z.object({
-	field: z.string(),
-	value: z.unknown(),
-	operator: z.enum([
+const whereClause = z$1.object({
+	field: z$1.string(),
+	value: z$1.unknown(),
+	operator: z$1.enum([
 		"eq",
 		"ne",
 		"gt",
@@ -5434,44 +5444,44 @@ const whereClause = z.object({
 		"starts_with",
 		"ends_with"
 	]).optional(),
-	connector: z.enum(["AND", "OR"]).optional()
+	connector: z$1.enum(["AND", "OR"]).optional()
 });
-const sortBySchema = z.object({
-	field: z.string(),
-	direction: z.enum(["asc", "desc"])
+const sortBySchema = z$1.object({
+	field: z$1.string(),
+	direction: z$1.enum(["asc", "desc"])
 });
-const actionSchema = z.discriminatedUnion("action", [
-	z.object({
-		action: z.literal("findOne"),
-		model: z.string(),
-		where: z.array(whereClause).optional(),
-		select: z.array(z.string()).optional(),
-		join: z.record(z.string(), z.boolean()).optional()
+const actionSchema = z$1.discriminatedUnion("action", [
+	z$1.object({
+		action: z$1.literal("findOne"),
+		model: z$1.string(),
+		where: z$1.array(whereClause).optional(),
+		select: z$1.array(z$1.string()).optional(),
+		join: z$1.record(z$1.string(), z$1.boolean()).optional()
 	}),
-	z.object({
-		action: z.literal("findMany"),
-		model: z.string(),
-		where: z.array(whereClause).optional(),
-		limit: z.number().optional(),
-		offset: z.number().optional(),
+	z$1.object({
+		action: z$1.literal("findMany"),
+		model: z$1.string(),
+		where: z$1.array(whereClause).optional(),
+		limit: z$1.number().optional(),
+		offset: z$1.number().optional(),
 		sortBy: sortBySchema.optional(),
-		join: z.record(z.string(), z.boolean()).optional()
+		join: z$1.record(z$1.string(), z$1.boolean()).optional()
 	}),
-	z.object({
-		action: z.literal("create"),
-		model: z.string(),
-		data: z.record(z.string(), z.unknown())
+	z$1.object({
+		action: z$1.literal("create"),
+		model: z$1.string(),
+		data: z$1.record(z$1.string(), z$1.unknown())
 	}),
-	z.object({
-		action: z.literal("update"),
-		model: z.string(),
-		where: z.array(whereClause),
-		update: z.record(z.string(), z.unknown())
+	z$1.object({
+		action: z$1.literal("update"),
+		model: z$1.string(),
+		where: z$1.array(whereClause),
+		update: z$1.record(z$1.string(), z$1.unknown())
 	}),
-	z.object({
-		action: z.literal("count"),
-		model: z.string(),
-		where: z.array(whereClause).optional()
+	z$1.object({
+		action: z$1.literal("count"),
+		model: z$1.string(),
+		where: z$1.array(whereClause).optional()
 	})
 ]);
 const executeAdapter = (options) => {
@@ -5589,8 +5599,8 @@ function isSafeHttpUrl(value) {
 	}
 }
 /** http(s) absolute URL without embedded credentials. */
-const safeUrlSchema = z$1.string().trim().min(1).pipe(z$1.url().refine(isSafeHttpUrl, { message: "URL must be a valid http(s) URL without credentials" })).transform((value) => new URL(value).href);
-const optionalSafeUrlSchema = z$1.union([safeUrlSchema, z$1.literal("")]).optional();
+const safeUrlSchema = z.string().trim().min(1).pipe(z.url().refine(isSafeHttpUrl, { message: "URL must be a valid http(s) URL without credentials" })).transform((value) => new URL(value).href);
+const optionalSafeUrlSchema = z.union([safeUrlSchema, z.literal("")]).optional();
 function getAuthBaseUrl(ctx) {
 	const baseURL = ctx.context.options.baseURL;
 	return typeof baseURL === "string" && baseURL.trim() ? baseURL : "/";
@@ -5669,10 +5679,13 @@ async function executePlatformInvitationCompletion(ctx, $api, invitation, args)
 			}
 		});
 		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
-			session: await ctx.context.internalAdapter.createSession(existingUser.id),
-			user: existingUser
-		});
+		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) {
+			const session = await ctx.context.internalAdapter.createSession(existingUser.id);
+			await setSessionCookie(ctx, {
+				session,
+				user: existingUser
+			});
+		}
 		return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)) };
 	}
 	if (!password && !allowsPasswordlessInviteComplete(invitation.authMode)) throw new APIError("BAD_REQUEST", { message: "Password is required to complete this invitation." });
@@ -5697,10 +5710,13 @@ async function executePlatformInvitationCompletion(ctx, $api, invitation, args)
 		}
 	});
 	if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-	if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
-		session: await ctx.context.internalAdapter.createSession(user.id),
-		user
-	});
+	if (shouldCreateSessionOnInviteComplete(invitation.authMode)) {
+		const session = await ctx.context.internalAdapter.createSession(user.id);
+		await setSessionCookie(ctx, {
+			session,
+			user
+		});
+	}
 	return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)) };
 }
 /**
@@ -5712,7 +5728,7 @@ const acceptInvitation = (options) => {
 	const { $api } = options;
 	return createAuthEndpoint("/dash/accept-invitation", {
 		method: "GET",
-		query: z$1.object({ token: z$1.string() })
+		query: z.object({ token: z.string() })
 	}, async (ctx) => {
 		const { token } = ctx.query;
 		const invitation = await verifyPendingInvitation(token, $api, ctx);
@@ -5727,10 +5743,13 @@ const acceptInvitation = (options) => {
 				}
 			});
 			if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted (existing user)", markError);
-			if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
-				session: await ctx.context.internalAdapter.createSession(existingUser.id),
-				user: existingUser
-			});
+			if (shouldCreateSessionOnInviteComplete(invitation.authMode)) {
+				const session = await ctx.context.internalAdapter.createSession(existingUser.id);
+				await setSessionCookie(ctx, {
+					session,
+					user: existingUser
+				});
+			}
 			const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx));
 			return ctx.redirect(redirectUrl);
 		}
@@ -5759,10 +5778,13 @@ const acceptInvitation = (options) => {
 			}
 		});
 		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
-			session: await ctx.context.internalAdapter.createSession(user.id),
-			user
-		});
+		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) {
+			const session = await ctx.context.internalAdapter.createSession(user.id);
+			await setSessionCookie(ctx, {
+				session,
+				user
+			});
+		}
 		const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx));
 		return ctx.redirect(redirectUrl);
 	});
@@ -5776,13 +5798,14 @@ const completeInvitation = (options) => {
 	const { $api } = options;
 	return createAuthEndpoint("/dash/complete-invitation", {
 		method: "POST",
-		body: z$1.object({
-			token: z$1.string(),
-			password: z$1.string().optional()
+		body: z.object({
+			token: z.string(),
+			password: z.string().optional()
 		})
 	}, async (ctx) => {
 		const { token, password } = ctx.body;
-		const { redirectUrl } = await executePlatformInvitationCompletion(ctx, $api, await verifyPendingInvitation(token, $api, ctx), {
+		const invitation = await verifyPendingInvitation(token, $api, ctx);
+		const { redirectUrl } = await executePlatformInvitationCompletion(ctx, $api, invitation, {
 			token,
 			password
 		});
@@ -5800,14 +5823,15 @@ const completeInvitationHandoff = (options) => {
 	const { $api } = options;
 	return createAuthEndpoint("/dash/complete-invitation-handoff", {
 		method: "GET",
-		query: z$1.object({ handoff: z$1.string().min(1) })
+		query: z.object({ handoff: z.string().min(1) })
 	}, async (ctx) => {
 		const { data, error } = await $api("/api/internal/invitations/redeem-handoff", {
 			method: "POST",
 			body: { handoff: ctx.query.handoff }
 		});
 		if (error || !data?.invitationToken) throw new APIError("BAD_REQUEST", { message: "This invitation link has expired. Please try again." });
-		const { redirectUrl } = await executePlatformInvitationCompletion(ctx, $api, await verifyPendingInvitation(data.invitationToken, $api, ctx), {
+		const invitation = await verifyPendingInvitation(data.invitationToken, $api, ctx);
+		const { redirectUrl } = await executePlatformInvitationCompletion(ctx, $api, invitation, {
 			token: data.invitationToken,
 			password: data.password ?? void 0
 		});
@@ -5818,7 +5842,7 @@ const completeInvitationSocial = (options) => {
 	const { $api } = options;
 	return createAuthEndpoint("/dash/complete-invitation-social", {
 		method: "GET",
-		query: z$1.object({ token: z$1.string() }),
+		query: z.object({ token: z.string() }),
 		use: [sessionMiddleware]
 	}, async (ctx) => {
 		const sessionUser = ctx.context.session?.user;
@@ -5853,7 +5877,7 @@ const checkUserExists = (options) => {
 	return createAuthEndpoint("/dash/check-user-exists", {
 		method: "POST",
 		use: [jwtMiddleware(options)],
-		body: z$1.object({ email: z$1.email() })
+		body: z.object({ email: z.email() })
 	}, async (ctx) => {
 		const { email } = ctx.body;
 		const normalizedEmail = normalizeEmail(email, ctx.context);
@@ -5883,7 +5907,7 @@ function getOrganizationRoleKeys(orgOptions) {
 	if (roles && typeof roles === "object" && Object.keys(roles).length > 0) return Object.keys(roles);
 	return [...DEFAULT_ORG_MEMBER_ROLES];
 }
-const organizationMemberRoleInputSchema = z$1.string().trim().min(1, "Role is required").max(64, "Role is too long").regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, "Role must start with a letter and contain only letters, numbers, hyphens, and underscores");
+const organizationMemberRoleInputSchema = z.string().trim().min(1, "Role is required").max(64, "Role is too long").regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, "Role must start with a letter and contain only letters, numbers, hyphens, and underscores");
 function validateOrganizationMemberRole(ctx, role, orgOptions) {
 	const allowedRoles = getOrganizationRoleKeys(orgOptions);
 	if (!allowedRoles.includes(role)) throw ctx.error("BAD_REQUEST", { message: `Invalid role. Allowed roles: ${allowedRoles.join(", ")}` });
@@ -5945,14 +5969,14 @@ const listOrganizationInvitations = (options) => {
 const inviteMember = (options) => {
 	return createAuthEndpoint("/dash/organization/invite-member", {
 		method: "POST",
-		body: z$1.object({
-			email: z$1.string(),
+		body: z.object({
+			email: z.string(),
 			role: organizationMemberRoleInputSchema,
-			invitedBy: z$1.string()
+			invitedBy: z.string()
 		}),
-		use: [jwtMiddleware(options, z$1.object({
-			organizationId: z$1.string(),
-			invitedBy: z$1.string()
+		use: [jwtMiddleware(options, z.object({
+			organizationId: z.string(),
+			invitedBy: z.string()
 		}))]
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
@@ -5989,8 +6013,8 @@ const inviteMember = (options) => {
 const checkUserByEmail = (options) => {
 	return createAuthEndpoint("/dash/organization/check-user-by-email", {
 		method: "POST",
-		body: z$1.object({ email: z$1.string() }),
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))]
+		body: z.object({ email: z.string() }),
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))]
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const { organizationId } = ctx.context.payload;
@@ -6033,11 +6057,11 @@ const checkUserByEmail = (options) => {
 const cancelInvitation = (options) => {
 	return createAuthEndpoint("/dash/organization/cancel-invitation", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({
-			organizationId: z$1.string(),
-			invitationId: z$1.string()
+		use: [jwtMiddleware(options, z.object({
+			organizationId: z.string(),
+			invitationId: z.string()
 		}))],
-		body: z$1.object({ invitationId: z$1.string() })
+		body: z.object({ invitationId: z.string() })
 	}, async (ctx) => {
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
 		const { invitationId, organizationId } = ctx.context.payload;
@@ -6091,11 +6115,11 @@ const cancelInvitation = (options) => {
 const resendInvitation = (options) => {
 	return createAuthEndpoint("/dash/organization/resend-invitation", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({
-			organizationId: z$1.string(),
-			invitationId: z$1.string()
+		use: [jwtMiddleware(options, z.object({
+			organizationId: z.string(),
+			invitationId: z.string()
 		}))],
-		body: z$1.object({ invitationId: z$1.string() })
+		body: z.object({ invitationId: z.string() })
 	}, async (ctx) => {
 		const organizationPlugin = requireOrganizationPlugin(ctx);
 		const { invitationId, organizationId } = ctx.context.payload;
@@ -6204,9 +6228,9 @@ const listOrganizationMembers = (options) => {
 const addMember = (options) => {
 	return createAuthEndpoint("/dash/organization/add-member", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			userId: z$1.string(),
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			userId: z.string(),
 			role: organizationMemberRoleInputSchema
 		})
 	}, async (ctx) => {
@@ -6261,8 +6285,8 @@ const addMember = (options) => {
 const removeMember = (options) => {
 	return createAuthEndpoint("/dash/organization/remove-member", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ memberId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ memberId: z.string() })
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
@@ -6331,9 +6355,9 @@ const removeMember = (options) => {
 const updateMemberRole = (options) => {
 	return createAuthEndpoint("/dash/organization/update-member-role", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			memberId: z$1.string(),
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			memberId: z.string(),
 			role: organizationMemberRoleInputSchema
 		})
 	}, async (ctx) => {
@@ -6392,7 +6416,7 @@ const updateMemberRole = (options) => {
 //#region src/export-factory.ts
 const exportFactory = (input, options) => async (ctx) => {
 	const batchSize = options?.batchSize || 1e4;
-	const staleMs = options?.staleMs || 300 * 1e3;
+	const staleMs = options?.staleMs || 3e5;
 	const enabledFields = options?.enabledFields || [];
 	const userLimit = input.limit;
 	const userOffset = input.offset || 0;
@@ -6489,16 +6513,16 @@ async function withConcurrency(items, fn, options) {
 	return results;
 }
 /** Zod schema for validating organization/project slug format. */
-const slugSchema = z.string().min(1, "Slug is required").regex(/^[a-z0-9-]+$/, "Slug can only contain lowercase letters, numbers, and hyphens");
+const slugSchema = z$1.string().min(1, "Slug is required").regex(/^[a-z0-9-]+$/, "Slug can only contain lowercase letters, numbers, and hyphens");
 //#endregion
 //#region src/routes/organizations/schemas.ts
-const DENIED_ORG_WRITE_KEYS = new Set([
+const DENIED_ORG_WRITE_KEYS = /* @__PURE__ */ new Set([
 	"id",
 	"createdAt",
 	"updatedAt"
 ]);
-const CREATE_NON_PERSISTED_KEYS = new Set(["defaultTeamName"]);
-const CREATE_REQUEST_ONLY_KEYS$1 = new Set(["userId", "skipDefaultTeam"]);
+const CREATE_NON_PERSISTED_KEYS = /* @__PURE__ */ new Set(["defaultTeamName"]);
+const CREATE_REQUEST_ONLY_KEYS$1 = /* @__PURE__ */ new Set(["userId", "skipDefaultTeam"]);
 const CORE_CREATE_KEYS$1 = [
 	"name",
 	"slug",
@@ -6530,7 +6554,7 @@ function getWritableOrganizationFieldNames(orgOptions, mode) {
 */
 function pickWritableOrganizationFields(body, orgOptions, mode) {
 	const allowed = getWritableOrganizationFieldNames(orgOptions, mode);
-	const skip = new Set([
+	const skip = /* @__PURE__ */ new Set([
 		...DENIED_ORG_WRITE_KEYS,
 		...mode === "create" ? CREATE_NON_PERSISTED_KEYS : [],
 		...mode === "create" ? CREATE_REQUEST_ONLY_KEYS$1 : []
@@ -6542,26 +6566,26 @@ function pickWritableOrganizationFields(body, orgOptions, mode) {
 	}
 	return result;
 }
-const BaseCreateOrgCoreBodySchema = z$1.object({
-	name: z$1.string(),
+const BaseCreateOrgCoreBodySchema = z.object({
+	name: z.string(),
 	slug: slugSchema,
-	logo: z$1.string().optional(),
-	defaultTeamName: z$1.string().optional()
+	logo: z.string().optional(),
+	defaultTeamName: z.string().optional()
 });
-const BaseUpdateOrgCoreBodySchema = z$1.object({
+const BaseUpdateOrgCoreBodySchema = z.object({
 	logo: optionalSafeUrlSchema,
-	name: z$1.string().optional(),
+	name: z.string().optional(),
 	slug: slugSchema.optional(),
-	metadata: z$1.string().optional()
+	metadata: z.string().optional()
 });
-const CreateOrganizationBodySchema = BaseCreateOrgCoreBodySchema.catchall(z$1.unknown());
-const UpdateOrganizationBodySchema = BaseUpdateOrgCoreBodySchema.catchall(z$1.unknown());
+const CreateOrganizationBodySchema = BaseCreateOrgCoreBodySchema.catchall(z.unknown());
+const UpdateOrganizationBodySchema = BaseUpdateOrgCoreBodySchema.catchall(z.unknown());
 function createSchemaForDBField$1(field) {
 	switch (field.type) {
-		case "number": return field.required ? z$1.coerce.number() : z$1.coerce.number().optional();
-		case "boolean": return field.required ? z$1.coerce.boolean() : z$1.coerce.boolean().optional();
-		case "date": return field.required ? z$1.union([z$1.string().min(1), z$1.coerce.date()]) : z$1.union([z$1.string(), z$1.coerce.date()]).optional();
-		default: return field.required ? z$1.string().min(1) : z$1.string().optional();
+		case "number": return field.required ? z.coerce.number() : z.coerce.number().optional();
+		case "boolean": return field.required ? z.coerce.boolean() : z.coerce.boolean().optional();
+		case "date": return field.required ? z.union([z.string().min(1), z.coerce.date()]) : z.union([z.string(), z.coerce.date()]).optional();
+		default: return field.required ? z.string().min(1) : z.string().optional();
 	}
 }
 /**
@@ -6570,39 +6594,39 @@ function createSchemaForDBField$1(field) {
 */
 function validateWritableCreateOrganizationFields(data, options) {
 	const shape = {
-		name: z$1.string().min(1),
+		name: z.string().min(1),
 		slug: slugSchema,
-		logo: z$1.string().optional()
+		logo: z.string().optional()
 	};
 	const additional = getOrganizationAdditionalFields(options);
 	for (const [name, field] of Object.entries(additional)) {
 		if (field.input === false) continue;
 		shape[name] = createSchemaForDBField$1(field);
 	}
-	const result = z$1.object(shape).strict().safeParse(data);
+	const result = z.object(shape).strict().safeParse(data);
 	if (!result.success) throw result.error;
 }
 /**
 * Ensures at least one field is present on update and validates additional field types.
 */
 function validateWritableOrganizationUpdateFields(data, orgOptions) {
-	if (Object.keys(data).length === 0) throw new z$1.ZodError([{
+	if (Object.keys(data).length === 0) throw new z.ZodError([{
 		code: "custom",
 		message: "No valid fields to update",
 		path: []
 	}]);
 	const shape = {
-		name: z$1.string().min(1).optional(),
+		name: z.string().min(1).optional(),
 		slug: slugSchema.optional(),
 		logo: optionalSafeUrlSchema,
-		metadata: z$1.string().optional()
+		metadata: z.string().optional()
 	};
 	const additional = getOrganizationAdditionalFields(orgOptions);
 	for (const [name, field] of Object.entries(additional)) {
 		if (field.input === false) continue;
 		shape[name] = createSchemaForDBField$1(field);
 	}
-	const result = z$1.object(shape).partial().strict().safeParse(data);
+	const result = z.object(shape).partial().strict().safeParse(data);
 	if (!result.success) throw result.error;
 }
 //#endregion
@@ -6644,26 +6668,26 @@ const listOrganizations = (options) => {
 	return createAuthEndpoint("/dash/list-organizations", {
 		method: "GET",
 		use: [jwtMiddleware(options)],
-		query: z$1.object({
-			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-			sortBy: z$1.enum([
+		query: z.object({
+			limit: z.number().or(z.string().transform(Number)).optional(),
+			offset: z.number().or(z.string().transform(Number)).optional(),
+			sortBy: z.enum([
 				"createdAt",
 				"name",
 				"slug",
 				"members"
 			]).optional(),
-			sortOrder: z$1.enum(["asc", "desc"]).optional(),
-			filterMembers: z$1.enum([
+			sortOrder: z.enum(["asc", "desc"]).optional(),
+			filterMembers: z.enum([
 				"abandoned",
 				"eq1",
 				"gt1",
 				"gt5",
 				"gt10"
 			]).optional(),
-			search: z$1.string().optional(),
-			startDate: z$1.date().or(z$1.string().transform((val) => new Date(val))).optional(),
-			endDate: z$1.date().or(z$1.string().transform((val) => new Date(val))).optional()
+			search: z.string().optional(),
+			startDate: z.date().or(z.string().transform((val) => new Date(val))).optional(),
+			endDate: z.date().or(z.string().transform((val) => new Date(val))).optional()
 		}).optional()
 	}, async (ctx) => {
 		const { limit = 10, offset = 0, sortBy = "createdAt", sortOrder = "desc", search, filterMembers } = ctx.query || {};
@@ -6784,12 +6808,12 @@ function parseWhereClause$1(val) {
 	if (!Array.isArray(parsed)) return [];
 	return parsed;
 }
-const exportOrganizationsQuerySchema = z$1.object({
-	limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-	offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-	sortBy: z$1.string().optional(),
-	sortOrder: z$1.enum(["asc", "desc"]).optional(),
-	where: z$1.string().transform(parseWhereClause$1).optional()
+const exportOrganizationsQuerySchema = z.object({
+	limit: z.number().or(z.string().transform(Number)).optional(),
+	offset: z.number().or(z.string().transform(Number)).optional(),
+	sortBy: z.string().optional(),
+	sortOrder: z.enum(["asc", "desc"]).optional(),
+	where: z.string().transform(parseWhereClause$1).optional()
 }).optional();
 const exportOrganizations = (options) => {
 	return createAuthEndpoint("/dash/export-organizations", {
@@ -6854,8 +6878,8 @@ const getOrganization = (options) => {
 const deleteOrganization = (options) => {
 	return createAuthEndpoint("/dash/organization/delete", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ organizationId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ organizationId: z.string() })
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const { organizationId: bodyOrganizationId } = ctx.body;
@@ -6904,7 +6928,7 @@ const deleteOrganization = (options) => {
 const deleteManyOrganizations = (options) => {
 	return createAuthEndpoint("/dash/organization/delete-many", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationIds: z$1.string().array() }))]
+		use: [jwtMiddleware(options, z.object({ organizationIds: z.string().array() }))]
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const { organizationIds } = ctx.context.payload;
@@ -6941,9 +6965,9 @@ const deleteManyOrganizations = (options) => {
 const createOrganization = (options) => {
 	return createAuthEndpoint("/dash/organization/create", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({
-			userId: z$1.string(),
-			skipDefaultTeam: z$1.boolean().optional().default(false)
+		use: [jwtMiddleware(options, z.object({
+			userId: z.string(),
+			skipDefaultTeam: z.boolean().optional().default(false)
 		}))],
 		body: CreateOrganizationBodySchema
 	}, async (ctx) => {
@@ -6969,7 +6993,7 @@ const createOrganization = (options) => {
 		try {
 			validateWritableCreateOrganizationFields(orgData, orgOptions);
 		} catch (error) {
-			if (error instanceof z$1.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
+			if (error instanceof z.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
 			throw error;
 		}
 		if (orgOptions.organizationCreation?.beforeCreate) {
@@ -7105,7 +7129,7 @@ const createOrganization = (options) => {
 const updateOrganization = (options) => {
 	return createAuthEndpoint("/dash/organization/update", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
 		body: UpdateOrganizationBodySchema
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
@@ -7145,7 +7169,7 @@ const updateOrganization = (options) => {
 		try {
 			validateWritableOrganizationUpdateFields(updateData, orgOptions);
 		} catch (error) {
-			if (error instanceof z$1.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
+			if (error instanceof z.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
 			throw error;
 		}
 		if (typeof updateData.metadata === "string") try {
@@ -7232,10 +7256,10 @@ const listOrganizationTeams = (options) => {
 const updateTeam = (options) => {
 	return createAuthEndpoint("/dash/organization/update-team", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			teamId: z$1.string(),
-			name: z$1.string().optional()
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			teamId: z.string(),
+			name: z.string().optional()
 		})
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
@@ -7306,8 +7330,8 @@ const updateTeam = (options) => {
 const deleteTeam = (options) => {
 	return createAuthEndpoint("/dash/organization/delete-team", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ teamId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ teamId: z.string() })
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireTeamsEnabled(ctx);
@@ -7375,8 +7399,8 @@ const deleteTeam = (options) => {
 const createTeam = (options) => {
 	return createAuthEndpoint("/dash/organization/create-team", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ name: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ name: z.string() })
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireTeamsEnabled(ctx);
@@ -7494,10 +7518,10 @@ const listTeamMembers = (options) => {
 const addTeamMember = (options) => {
 	return createAuthEndpoint("/dash/organization/add-team-member", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			teamId: z$1.string(),
-			userId: z$1.string()
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			teamId: z.string(),
+			userId: z.string()
 		})
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
@@ -7587,10 +7611,10 @@ const addTeamMember = (options) => {
 const removeTeamMember = (options) => {
 	return createAuthEndpoint("/dash/organization/remove-team-member", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			teamId: z$1.string(),
-			userId: z$1.string()
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			teamId: z.string(),
+			userId: z.string()
 		})
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
@@ -7693,7 +7717,7 @@ const revokeSession = (options) => createAuthEndpoint("/dash/sessions/revoke", {
 const revokeAllSessions = (options) => createAuthEndpoint("/dash/sessions/revoke-all", {
 	method: "POST",
 	use: [jwtMiddleware(options)],
-	body: z$1.object({ userId: z$1.string() })
+	body: z.object({ userId: z.string() })
 }, async (ctx) => {
 	const { userId } = ctx.body;
 	if (!await ctx.context.internalAdapter.findUserById(userId)) throw ctx.error("NOT_FOUND", { message: "User not found" });
@@ -7702,7 +7726,7 @@ const revokeAllSessions = (options) => createAuthEndpoint("/dash/sessions/revoke
 });
 const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revoke-many", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))]
+	use: [jwtMiddleware(options, z.object({ userIds: z.string().array() }))]
 }, async (ctx) => {
 	const { userIds } = ctx.context.payload;
 	await withConcurrency(chunkArray(userIds, { batchSize: 50 }), async (chunk) => {
@@ -7747,7 +7771,7 @@ function getSSOPlugin(ctx) {
 * (see packages/sso dist constants). Inlined so consumers (e.g. Metro) never
 * statically pull @better-auth/sso for validation-only code paths.
 */
-const DEFAULT_MAX_SAML_METADATA_SIZE = 100 * 1024;
+const DEFAULT_MAX_SAML_METADATA_SIZE = 102400;
 const RSA_SHA1 = "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
 const SHA1 = "http://www.w3.org/2000/09/xmldsig#sha1";
 /** @public */
@@ -7831,44 +7855,44 @@ function requireOrganizationAccess(ctx) {
 	const orgIdFromToken = ctx.context.payload?.organizationId;
 	if (!orgIdFromToken || orgIdFromUrl !== orgIdFromToken) throw ctx.error("FORBIDDEN", { message: "You do not have access to this organization" });
 }
-const samlConfigSchema = z$1.object({
-	idpMetadata: z$1.object({
-		metadata: z$1.string().optional(),
-		metadataUrl: z$1.string().optional()
+const samlConfigSchema = z.object({
+	idpMetadata: z.object({
+		metadata: z.string().optional(),
+		metadataUrl: z.string().optional()
 	}).optional(),
-	entryPoint: z$1.string().optional(),
-	cert: z$1.string().optional(),
-	entityId: z$1.string().optional(),
-	mapping: z$1.object({
+	entryPoint: z.string().optional(),
+	cert: z.string().optional(),
+	entityId: z.string().optional(),
+	mapping: z.object({
 		/** @deprecated Removed in better-auth 1.7+; SAML subject is NameID. */
-		id: z$1.string().optional(),
-		email: z$1.string().optional(),
-		emailVerified: z$1.string().optional(),
-		name: z$1.string().optional(),
-		firstName: z$1.string().optional(),
-		lastName: z$1.string().optional(),
-		extraFields: z$1.record(z$1.string(), z$1.any()).optional()
+		id: z.string().optional(),
+		email: z.string().optional(),
+		emailVerified: z.string().optional(),
+		name: z.string().optional(),
+		firstName: z.string().optional(),
+		lastName: z.string().optional(),
+		extraFields: z.record(z.string(), z.any()).optional()
 	}).optional()
 });
-const oidcConfigSchema = z$1.object({
-	clientId: z$1.string(),
-	clientSecret: z$1.string().optional(),
-	discoveryUrl: z$1.string().optional(),
-	issuer: z$1.string().optional(),
-	discoveryEndpoint: z$1.string().optional(),
-	authorizationEndpoint: z$1.string().optional(),
-	tokenEndpoint: z$1.string().optional(),
-	jwksEndpoint: z$1.string().optional(),
-	userInfoEndpoint: z$1.string().optional(),
-	tokenEndpointAuthentication: z$1.enum(["client_secret_post", "client_secret_basic"]).optional(),
-	mapping: z$1.object({
+const oidcConfigSchema = z.object({
+	clientId: z.string(),
+	clientSecret: z.string().optional(),
+	discoveryUrl: z.string().optional(),
+	issuer: z.string().optional(),
+	discoveryEndpoint: z.string().optional(),
+	authorizationEndpoint: z.string().optional(),
+	tokenEndpoint: z.string().optional(),
+	jwksEndpoint: z.string().optional(),
+	userInfoEndpoint: z.string().optional(),
+	tokenEndpointAuthentication: z.enum(["client_secret_post", "client_secret_basic"]).optional(),
+	mapping: z.object({
 		/** @deprecated Removed in better-auth 1.7+; OIDC subject is `sub`. */
-		id: z$1.string().optional(),
-		email: z$1.string().optional(),
-		emailVerified: z$1.string().optional(),
-		name: z$1.string().optional(),
-		image: z$1.string().optional(),
-		extraFields: z$1.record(z$1.string(), z$1.any()).optional()
+		id: z.string().optional(),
+		email: z.string().optional(),
+		emailVerified: z.string().optional(),
+		name: z.string().optional(),
+		image: z.string().optional(),
+		extraFields: z.record(z.string(), z.any()).optional()
 	}).optional()
 });
 async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
@@ -7961,7 +7985,7 @@ async function resolveOIDCConfig(oidcConfig, _domain, ctx) {
 const listOrganizationSsoProviders = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-providers", {
 		method: "GET",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))]
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))]
 	}, async (ctx) => {
 		if (!isOrganizationEnabled(ctx)) {
 			ctx.context.logger.warn("[Dash] Organization plugin not enabled, returning empty SSO providers list");
@@ -7990,12 +8014,12 @@ const listOrganizationSsoProviders = (options) => {
 const createSsoProvider = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/create", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			providerId: z$1.string(),
-			domain: z$1.string(),
-			protocol: z$1.enum(["SAML", "OIDC"]),
-			userId: z$1.string(),
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			providerId: z.string(),
+			domain: z.string(),
+			protocol: z.enum(["SAML", "OIDC"]),
+			userId: z.string(),
 			samlConfig: samlConfigSchema.optional(),
 			oidcConfig: oidcConfigSchema.optional()
 		})
@@ -8057,11 +8081,11 @@ const createSsoProvider = (options) => {
 const updateSsoProvider = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/update", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			providerId: z$1.string(),
-			domain: z$1.string(),
-			protocol: z$1.enum(["SAML", "OIDC"]),
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			providerId: z.string(),
+			domain: z.string(),
+			protocol: z.enum(["SAML", "OIDC"]),
 			samlConfig: samlConfigSchema.optional(),
 			oidcConfig: oidcConfigSchema.optional()
 		})
@@ -8140,8 +8164,8 @@ const updateSsoProvider = (options) => {
 const requestSsoVerificationToken = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/request-verification-token", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ providerId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ providerId: z.string() })
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		requireOrganizationAccess(ctx);
@@ -8188,8 +8212,8 @@ const requestSsoVerificationToken = (options) => {
 const verifySsoProviderDomain = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/verify-domain", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ providerId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ providerId: z.string() })
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		requireOrganizationAccess(ctx);
@@ -8235,8 +8259,8 @@ const verifySsoProviderDomain = (options) => {
 const deleteSsoProvider = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/delete", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ providerId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ providerId: z.string() })
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		requireOrganizationAccess(ctx);
@@ -8278,10 +8302,10 @@ const deleteSsoProvider = (options) => {
 const markSsoProviderDomainVerified = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/mark-domain-verified", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			providerId: z$1.string(),
-			verified: z$1.literal(false).describe("Clears domain verification. Domains can only be marked verified via DNS (verify-domain).")
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			providerId: z.string(),
+			verified: z.literal(false).describe("Clears domain verification. Domains can only be marked verified via DNS (verify-domain).")
 		})
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
@@ -8377,7 +8401,7 @@ function buildTotpUri(params) {
 //#region src/routes/two-factor/index.ts
 const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
@@ -8438,7 +8462,7 @@ const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor
 });
 const completeTwoFactorSetup = (options) => createAuthEndpoint("/dash/complete-two-factor-setup", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
@@ -8466,7 +8490,7 @@ const completeTwoFactorSetup = (options) => createAuthEndpoint("/dash/complete-t
 const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-factor-totp-uri", {
 	method: "POST",
 	metadata: { scope: "http" },
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
@@ -8504,13 +8528,13 @@ const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-fac
 });
 const viewBackupCodes = (options) => createAuthEndpoint("/dash/view-backup-codes", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async () => {
 	throw new APIError("FORBIDDEN", { message: "Backup codes cannot be viewed after initial setup. Generate new codes instead." });
 });
 const disableTwoFactor = (options) => createAuthEndpoint("/dash/disable-two-factor", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
@@ -8531,7 +8555,7 @@ const disableTwoFactor = (options) => createAuthEndpoint("/dash/disable-two-fact
 });
 const generateBackupCodes = (options) => createAuthEndpoint("/dash/generate-backup-codes", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
@@ -8596,13 +8620,13 @@ async function resolveTwoFactorStatus(context, userId, user) {
 }
 //#endregion
 //#region src/routes/users/schemas.ts
-const DENIED_USER_WRITE_KEYS = new Set([
+const DENIED_USER_WRITE_KEYS = /* @__PURE__ */ new Set([
 	"id",
 	"createdAt",
 	"updatedAt"
 ]);
 /** Fields that must be changed through dedicated permission-checked endpoints. */
-const DENIED_SENSITIVE_USER_KEYS = new Set([
+const DENIED_SENSITIVE_USER_KEYS = /* @__PURE__ */ new Set([
 	"banned",
 	"banReason",
 	"banExpires",
@@ -8611,7 +8635,7 @@ const DENIED_SENSITIVE_USER_KEYS = new Set([
 	"twoFactorEnabled",
 	"twoFactorSecret"
 ]);
-const CREATE_REQUEST_ONLY_KEYS = new Set([
+const CREATE_REQUEST_ONLY_KEYS = /* @__PURE__ */ new Set([
 	"password",
 	"generatePassword",
 	"sendVerificationEmail",
@@ -8667,7 +8691,7 @@ function getWritableUserFieldNames(options, mode) {
 */
 function pickWritableUserFields(body, options, mode) {
 	const allowed = getWritableUserFieldNames(options, mode);
-	const skip = new Set([
+	const skip = /* @__PURE__ */ new Set([
 		...DENIED_USER_WRITE_KEYS,
 		...DENIED_SENSITIVE_USER_KEYS,
 		...mode === "create" ? CREATE_REQUEST_ONLY_KEYS : []
@@ -8679,32 +8703,32 @@ function pickWritableUserFields(body, options, mode) {
 	}
 	return result;
 }
-const BaseCreateUserCoreBodySchema = z$1.object({
-	name: z$1.string(),
-	email: z$1.email(),
-	image: z$1.string().optional(),
-	password: z$1.string().optional(),
-	generatePassword: z$1.boolean().optional(),
-	emailVerified: z$1.boolean().optional(),
-	sendVerificationEmail: z$1.boolean().optional(),
-	sendOrganizationInvite: z$1.boolean().optional(),
-	organizationRole: z$1.string().optional(),
-	organizationId: z$1.string().optional()
+const BaseCreateUserCoreBodySchema = z.object({
+	name: z.string(),
+	email: z.email(),
+	image: z.string().optional(),
+	password: z.string().optional(),
+	generatePassword: z.boolean().optional(),
+	emailVerified: z.boolean().optional(),
+	sendVerificationEmail: z.boolean().optional(),
+	sendOrganizationInvite: z.boolean().optional(),
+	organizationRole: z.string().optional(),
+	organizationId: z.string().optional()
 });
-const BaseUpdateUserCoreBodySchema = z$1.object({
-	name: z$1.string().nullable().optional(),
-	email: z$1.email().optional(),
-	image: z$1.string().nullable().optional(),
-	emailVerified: z$1.boolean().optional()
+const BaseUpdateUserCoreBodySchema = z.object({
+	name: z.string().nullable().optional(),
+	email: z.email().optional(),
+	image: z.string().nullable().optional(),
+	emailVerified: z.boolean().optional()
 });
-const CreateUserBodySchema = BaseCreateUserCoreBodySchema.catchall(z$1.unknown());
-const UpdateUserBodySchema = BaseUpdateUserCoreBodySchema.catchall(z$1.unknown());
+const CreateUserBodySchema = BaseCreateUserCoreBodySchema.catchall(z.unknown());
+const UpdateUserBodySchema = BaseUpdateUserCoreBodySchema.catchall(z.unknown());
 function createSchemaForDBField(field) {
 	switch (field.type) {
-		case "number": return field.required ? z$1.coerce.number() : z$1.coerce.number().optional();
-		case "boolean": return field.required ? z$1.coerce.boolean() : z$1.coerce.boolean().optional();
-		case "date": return field.required ? z$1.union([z$1.string().min(1), z$1.coerce.date()]) : z$1.union([z$1.string(), z$1.coerce.date()]).optional();
-		default: return field.required ? z$1.string().min(1) : z$1.string().optional();
+		case "number": return field.required ? z.coerce.number() : z.coerce.number().optional();
+		case "boolean": return field.required ? z.coerce.boolean() : z.coerce.boolean().optional();
+		case "date": return field.required ? z.union([z.string().min(1), z.coerce.date()]) : z.union([z.string(), z.coerce.date()]).optional();
+		default: return field.required ? z.string().min(1) : z.string().optional();
 	}
 }
 /**
@@ -8712,38 +8736,38 @@ function createSchemaForDBField(field) {
 */
 function validateWritableCreateUserFields(data, options) {
 	const shape = {
-		name: z$1.string().min(1),
-		email: z$1.email(),
-		image: z$1.string().optional(),
-		emailVerified: z$1.boolean().optional()
+		name: z.string().min(1),
+		email: z.email(),
+		image: z.string().optional(),
+		emailVerified: z.boolean().optional()
 	};
 	for (const [name, field] of Object.entries(getUserInputFields(options))) {
 		if (!isWritableUserInputField(field)) continue;
 		shape[name] = createSchemaForDBField(field);
 	}
-	const result = z$1.object(shape).strict().safeParse(data);
+	const result = z.object(shape).strict().safeParse(data);
 	if (!result.success) throw result.error;
 }
 /**
 * Ensures at least one field is present on update and validates additional field types.
 */
 function validateWritableUserUpdateFields(data, options) {
-	if (Object.keys(data).length === 0) throw new z$1.ZodError([{
+	if (Object.keys(data).length === 0) throw new z.ZodError([{
 		code: "custom",
 		message: "No valid fields to update",
 		path: []
 	}]);
 	const shape = {
-		name: z$1.string().nullable().optional(),
-		email: z$1.email().optional(),
-		image: z$1.string().nullable().optional(),
-		emailVerified: z$1.boolean().optional()
+		name: z.string().nullable().optional(),
+		email: z.email().optional(),
+		image: z.string().nullable().optional(),
+		emailVerified: z.boolean().optional()
 	};
 	for (const [name, field] of Object.entries(getUserInputFields(options))) {
 		if (!isWritableUserInputField(field)) continue;
 		shape[name] = createSchemaForDBField(field);
 	}
-	const result = z$1.object(shape).partial().strict().safeParse(data);
+	const result = z.object(shape).partial().strict().safeParse(data);
 	if (!result.success) throw result.error;
 }
 //#endregion
@@ -8766,13 +8790,13 @@ function clampUserListOffset(value, fallback = 0) {
 	if (!Number.isFinite(n)) return fallback;
 	return Math.max(0, Math.floor(n));
 }
-const getUsersQuerySchema = z$1.object({
-	limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-	offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-	sortBy: z$1.string().optional(),
-	sortOrder: z$1.enum(["asc", "desc"]).optional(),
-	where: z$1.string().transform(parseWhereClause).optional(),
-	countWhere: z$1.string().transform(parseWhereClause).optional()
+const getUsersQuerySchema = z.object({
+	limit: z.number().or(z.string().transform(Number)).optional(),
+	offset: z.number().or(z.string().transform(Number)).optional(),
+	sortBy: z.string().optional(),
+	sortOrder: z.enum(["asc", "desc"]).optional(),
+	where: z.string().transform(parseWhereClause).optional(),
+	countWhere: z.string().transform(parseWhereClause).optional()
 }).optional();
 const getUsers = (options) => {
 	return createAuthEndpoint("/dash/list-users", {
@@ -8809,7 +8833,7 @@ const getUsers = (options) => {
 			model: "user",
 			where: [{
 				field: "lastActiveAt",
-				value: /* @__PURE__ */ new Date(Date.now() - 1e3 * 60 * 2),
+				value: /* @__PURE__ */ new Date(Date.now() - 12e4),
 				operator: "gte"
 			}]
 		}).catch((e) => {
@@ -8867,7 +8891,7 @@ const exportUsers = (options) => {
 const deleteUser = (options) => {
 	return createAuthEndpoint("/dash/delete-user", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+		use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 	}, async (ctx) => {
 		try {
 			await ctx.context.adapter.delete({
@@ -8886,7 +8910,7 @@ const deleteUser = (options) => {
 const deleteManyUsers = (options) => {
 	return createAuthEndpoint("/dash/delete-many-users", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))]
+		use: [jwtMiddleware(options, z.object({ userIds: z.string().array() }))]
 	}, async (ctx) => {
 		const { userIds } = ctx.context.payload;
 		const deletedUserIds = /* @__PURE__ */ new Set();
@@ -8922,11 +8946,11 @@ const deleteManyUsers = (options) => {
 const impersonateUser = (options) => {
 	return createAuthEndpoint("/dash/impersonate-user", {
 		method: "GET",
-		query: z$1.object({ impersonation_token: z$1.string() }),
-		use: [jwtMiddleware(options, z$1.object({
-			userId: z$1.string(),
+		query: z.object({ impersonation_token: z.string() }),
+		use: [jwtMiddleware(options, z.object({
+			userId: z.string(),
 			redirectUrl: safeUrlSchema,
-			impersonatedBy: z$1.string().optional()
+			impersonatedBy: z.string().optional()
 		}), async (ctx) => {
 			return ctx.query.impersonation_token;
 		})]
@@ -8936,7 +8960,7 @@ const impersonateUser = (options) => {
 		const trustedRedirectUrl = parseTrustedAuthRedirectUrl(ctx, redirectUrl);
 		if (!trustedRedirectUrl) throw ctx.error("BAD_REQUEST", { message: "Invalid redirect URL" });
 		const session = await ctx.context.internalAdapter.createSession(userId, true, {
-			expiresAt: new Date(Date.now() + 1e3 * 60 * 10),
+			expiresAt: new Date(Date.now() + 6e5),
 			impersonatedBy: impersonatedBy || void 0
 		});
 		const user = await ctx.context.internalAdapter.findUserById(userId);
@@ -8951,9 +8975,9 @@ const impersonateUser = (options) => {
 const createUser = (options) => {
 	return createAuthEndpoint("/dash/create-user", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({
-			organizationId: z$1.string().optional(),
-			organizationRole: z$1.string().optional()
+		use: [jwtMiddleware(options, z.object({
+			organizationId: z.string().optional(),
+			organizationRole: z.string().optional()
 		}))],
 		body: CreateUserBodySchema
 	}, async (ctx) => {
@@ -8962,7 +8986,7 @@ const createUser = (options) => {
 		try {
 			validateWritableCreateUserFields(userData, ctx.context.options);
 		} catch (error) {
-			if (error instanceof z$1.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
+			if (error instanceof z.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
 			throw error;
 		}
 		const email = normalizeEmail(userData.email, ctx.context);
@@ -9051,8 +9075,8 @@ const createUser = (options) => {
 const setPassword = (options) => {
 	return createAuthEndpoint("/dash/set-password", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-		body: z$1.object({ password: z$1.string().min(8) })
+		use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
+		body: z.object({ password: z.string().min(8) })
 	}, async (ctx) => {
 		const { userId } = ctx.context.payload;
 		const { password } = ctx.body;
@@ -9073,10 +9097,10 @@ const setPassword = (options) => {
 const unlinkAccount = (options) => {
 	return createAuthEndpoint("/dash/unlink-account", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-		body: z$1.object({
-			providerId: z$1.string(),
-			accountId: z$1.string()
+		use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
+		body: z.object({
+			providerId: z.string(),
+			accountId: z.string()
 		})
 	}, async (ctx) => {
 		const { userId } = ctx.context.payload;
@@ -9094,16 +9118,16 @@ const unlinkAccount = (options) => {
 		return { success: true };
 	});
 };
-const getUserDetailsJwtSchema = z$1.object({
-	userId: z$1.string(),
-	sessionOnly: z$1.boolean().optional(),
-	accountOnly: z$1.boolean().optional()
+const getUserDetailsJwtSchema = z.object({
+	userId: z.string(),
+	sessionOnly: z.boolean().optional(),
+	accountOnly: z.boolean().optional()
 });
 const getUserDetails = (options) => {
 	return createAuthEndpoint("/dash/user", {
 		method: "GET",
 		use: [jwtMiddleware(options, getUserDetailsJwtSchema)],
-		query: z$1.object({ minimal: z$1.boolean().or(z$1.string().transform((val) => val === "true")).optional() }).optional()
+		query: z.object({ minimal: z.boolean().or(z.string().transform((val) => val === "true")).optional() }).optional()
 	}, async (ctx) => {
 		const { userId, sessionOnly, accountOnly } = ctx.context.payload;
 		const minimal = !!ctx.query?.minimal;
@@ -9200,7 +9224,7 @@ const getUserDetails = (options) => {
 const getUserOrganizations = (options) => {
 	return createAuthEndpoint("/dash/user-organizations", {
 		method: "GET",
-		use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+		use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 	}, async (ctx) => {
 		const { userId } = ctx.context.payload;
 		if (!isOrganizationEnabled(ctx)) {
@@ -9245,7 +9269,7 @@ const getUserOrganizations = (options) => {
 };
 const updateUser = (options) => createAuthEndpoint("/dash/update-user", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
 	body: UpdateUserBodySchema
 }, async (ctx) => {
 	const userId = ctx.context.payload?.userId;
@@ -9254,7 +9278,7 @@ const updateUser = (options) => createAuthEndpoint("/dash/update-user", {
 	try {
 		validateWritableUserUpdateFields(updateData, ctx.context.options);
 	} catch (error) {
-		if (error instanceof z$1.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
+		if (error instanceof z.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
 		throw error;
 	}
 	const user = await ctx.context.internalAdapter.updateUser(userId, {
@@ -9340,12 +9364,12 @@ const getUserStats = (options) => createAuthEndpoint("/dash/user-stats", {
 	use: [jwtMiddleware(options)]
 }, async (ctx) => {
 	const now = /* @__PURE__ */ new Date();
-	const oneDayAgo = /* @__PURE__ */ new Date(now.getTime() - 1440 * 60 * 1e3);
-	const twoDaysAgo = /* @__PURE__ */ new Date(now.getTime() - 2880 * 60 * 1e3);
-	const oneWeekAgo = /* @__PURE__ */ new Date(now.getTime() - 10080 * 60 * 1e3);
-	const twoWeeksAgo = /* @__PURE__ */ new Date(now.getTime() - 336 * 60 * 60 * 1e3);
-	const oneMonthAgo = /* @__PURE__ */ new Date(now.getTime() - 720 * 60 * 60 * 1e3);
-	const twoMonthsAgo = /* @__PURE__ */ new Date(now.getTime() - 1440 * 60 * 60 * 1e3);
+	const oneDayAgo = /* @__PURE__ */ new Date(now.getTime() - 864e5);
+	const twoDaysAgo = /* @__PURE__ */ new Date(now.getTime() - 1728e5);
+	const oneWeekAgo = /* @__PURE__ */ new Date(now.getTime() - 6048e5);
+	const twoWeeksAgo = /* @__PURE__ */ new Date(now.getTime() - 12096e5);
+	const oneMonthAgo = /* @__PURE__ */ new Date(now.getTime() - 2592e6);
+	const twoMonthsAgo = /* @__PURE__ */ new Date(now.getTime() - 5184e6);
 	const activityTrackingEnabled = !!options.activityTracking?.enabled;
 	const storeInSecondaryStorageOnly = isSessionInSecondaryStorageOnly(ctx.context);
 	const [rDailySignups, rPrevDaySignups, rWeeklySignups, rPrevWeekSignups, rMonthlySignups, rPrevMonthSignups, rTotalUsers, rActiveDaily, rActivePrevDay, rActiveWeekly, rActivePrevWeek, rActiveMonthly, rActivePrevMonth] = await withConcurrency([
@@ -9480,7 +9504,7 @@ const getUserStats = (options) => createAuthEndpoint("/dash/user-stats", {
 const getUserGraphData = (options) => createAuthEndpoint("/dash/user-graph-data", {
 	method: "GET",
 	use: [jwtMiddleware(options)],
-	query: z$1.object({ period: z$1.enum([
+	query: z.object({ period: z.enum([
 		"daily",
 		"weekly",
 		"monthly"
@@ -9491,7 +9515,7 @@ const getUserGraphData = (options) => createAuthEndpoint("/dash/user-graph-data"
 	const activityTrackingEnabled = !!options.activityTracking?.enabled;
 	const storeInSecondaryStorageOnly = isSessionInSecondaryStorageOnly(ctx.context);
 	const intervals = period === "daily" ? 7 : period === "weekly" ? 8 : 6;
-	const msPerInterval = period === "daily" ? 1440 * 60 * 1e3 : period === "weekly" ? 10080 * 60 * 1e3 : 720 * 60 * 60 * 1e3;
+	const msPerInterval = period === "daily" ? 864e5 : period === "weekly" ? 6048e5 : 2592e6;
 	const intervalData = [];
 	for (let i = intervals - 1; i >= 0; i--) {
 		const endDate = new Date(now.getTime() - i * msPerInterval);
@@ -9552,7 +9576,7 @@ const getUserGraphData = (options) => createAuthEndpoint("/dash/user-graph-data"
 const getUserRetentionData = (options) => createAuthEndpoint("/dash/user-retention-data", {
 	method: "GET",
 	use: [jwtMiddleware(options)],
-	query: z$1.object({ period: z$1.enum([
+	query: z.object({ period: z.enum([
 		"daily",
 		"weekly",
 		"monthly"
@@ -9724,11 +9748,11 @@ const getUserRetentionData = (options) => createAuthEndpoint("/dash/user-retenti
 });
 const banUser = (options) => createAuthEndpoint("/dash/ban-user", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-	body: z$1.object({
-		banReason: z$1.string().optional(),
-		banExpires: z$1.number().optional(),
-		deleteAllSessions: z$1.boolean().optional().default(true)
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
+	body: z.object({
+		banReason: z.string().optional(),
+		banExpires: z.number().optional(),
+		deleteAllSessions: z.boolean().optional().default(true)
 	})
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
@@ -9746,11 +9770,11 @@ const banUser = (options) => createAuthEndpoint("/dash/ban-user", {
 const banManyUsers = (options) => {
 	return createAuthEndpoint("/dash/ban-many-users", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))],
-		body: z$1.object({
-			banReason: z$1.string().optional(),
-			banExpires: z$1.number().optional(),
-			deleteAllSessions: z$1.boolean().optional().default(true)
+		use: [jwtMiddleware(options, z.object({ userIds: z.string().array() }))],
+		body: z.object({
+			banReason: z.string().optional(),
+			banExpires: z.number().optional(),
+			deleteAllSessions: z.boolean().optional().default(true)
 		})
 	}, async (ctx) => {
 		const { userIds } = ctx.context.payload;
@@ -9800,7 +9824,7 @@ const banManyUsers = (options) => {
 };
 const unbanUser = (options) => createAuthEndpoint("/dash/unban-user", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	if (!await ctx.context.internalAdapter.findUserById(userId)) throw new APIError("NOT_FOUND", { message: "User not found" });
@@ -9814,8 +9838,8 @@ const unbanUser = (options) => createAuthEndpoint("/dash/unban-user", {
 });
 const sendVerificationEmail = (options) => createAuthEndpoint("/dash/send-verification-email", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-	body: z$1.object({ callbackUrl: safeUrlSchema })
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
+	body: z.object({ callbackUrl: safeUrlSchema })
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const callbackUrl = requireTrustedAuthCallbackUrl(ctx, ctx.body.callbackUrl);
@@ -9824,20 +9848,21 @@ const sendVerificationEmail = (options) => createAuthEndpoint("/dash/send-verifi
 	if (user.emailVerified) throw ctx.error("BAD_REQUEST", { message: "Email is already verified" });
 	if (!user.email) throw ctx.error("BAD_REQUEST", { message: "User has no associated email address" });
 	if (!ctx.context.options.emailVerification?.sendVerificationEmail) throw ctx.error("BAD_REQUEST", { message: "Email verification is not enabled" });
-	await sendVerificationEmailFn({
+	const modifiedCtx = {
 		...ctx,
 		body: {
 			...ctx.body,
 			callbackURL: callbackUrl
 		}
-	}, user);
+	};
+	await sendVerificationEmailFn(modifiedCtx, user);
 	return { success: true };
 });
 const sendManyVerificationEmails = (options) => {
 	return createAuthEndpoint("/dash/send-many-verification-emails", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))],
-		body: z$1.object({ callbackUrl: safeUrlSchema })
+		use: [jwtMiddleware(options, z.object({ userIds: z.string().array() }))],
+		body: z.object({ callbackUrl: safeUrlSchema })
 	}, async (ctx) => {
 		if (!ctx.context.options.emailVerification?.sendVerificationEmail) throw ctx.error("BAD_REQUEST", { message: "Email verification is not enabled" });
 		const { userIds } = ctx.context.payload;
@@ -9881,9 +9906,10 @@ const sendManyVerificationEmails = (options) => {
 					success: true,
 					id: user.id
 				};
-			}))) if (result.status === "fulfilled") if (result.value.success) sentEmailUserIds.add(result.value.id);
-			else skippedEmailUserIds.add(result.value.id);
-			else for (const { id } of users) skippedEmailUserIds.add(id);
+			}))) if (result.status === "fulfilled") {
+				if (result.value.success) sentEmailUserIds.add(result.value.id);
+				else skippedEmailUserIds.add(result.value.id);
+			} else for (const { id } of users) skippedEmailUserIds.add(id);
 		}, { concurrency: 2 });
 		const end = performance.now();
 		console.log(`Time taken to send verification emails to ${sentEmailUserIds.size} users: ${Math.round((end - start) / 1e3)}s`, skippedEmailUserIds.size > 0 ? `Skipped: ${skippedEmailUserIds.size}` : "");
@@ -9896,8 +9922,8 @@ const sendManyVerificationEmails = (options) => {
 };
 const sendResetPasswordEmail = (options) => createAuthEndpoint("/dash/send-reset-password-email", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-	body: z$1.object({ callbackUrl: safeUrlSchema })
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
+	body: z.object({ callbackUrl: safeUrlSchema })
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const callbackUrl = requireTrustedAuthCallbackUrl(ctx, ctx.body.callbackUrl);
@@ -9910,19 +9936,17 @@ const sendResetPasswordEmail = (options) => createAuthEndpoint("/dash/send-reset
 });
 //#endregion
 //#region src/pow.ts
+/**
+* Proof of Work Challenge System - Client Side
+*
+* Client-side PoW solver and encoding utilities.
+* Server-side challenge generation and verification moved to Infra API.
+*/
 /** Default difficulty in bits (18 = ~500ms solve time) */
 const DEFAULT_DIFFICULTY = 18;
 /** Challenge TTL in seconds */
 const CHALLENGE_TTL = 60;
 /**
-* SHA-256 hash function that works in both Node.js and browser
-*/
-async function sha256(message) {
-	const msgBuffer = new TextEncoder().encode(message);
-	const hashBuffer = await crypto.subtle.digest("SHA-256", msgBuffer);
-	return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-/**
 * Check if a hash has the required number of leading zero bits
 */
 function hasLeadingZeroBits(hash, bits) {
@@ -9942,7 +9966,8 @@ async function solvePoWChallenge(challenge) {
 	const { nonce, difficulty } = challenge;
 	let counter = 0;
 	while (true) {
-		if (hasLeadingZeroBits(await sha256(`${nonce}:${counter}`), difficulty)) return {
+		const input = `${nonce}:${counter}`;
+		if (hasLeadingZeroBits(await hash$1(input), difficulty)) return {
 			nonce,
 			counter
 		};
@@ -9972,7 +9997,8 @@ function encodePoWSolution(solution) {
 * Verify a PoW solution locally (for testing purposes)
 */
 async function verifyPoWSolution(nonce, counter, difficulty) {
-	return hasLeadingZeroBits(await sha256(`${nonce}:${counter}`), difficulty);
+	const input = `${nonce}:${counter}`;
+	return hasLeadingZeroBits(await hash$1(input), difficulty);
 }
 //#endregion
 //#region src/sms.ts
@@ -10167,85 +10193,117 @@ const dash = (options) => {
 					const afterCreateOrganization = organizationHooks.afterCreateOrganization;
 					organizationHooks.afterCreateOrganization = async (...args) => {
 						const [{ organization, user }] = args;
-						trackOrganizationCreated(organization, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationCreated(organization, trigger, location);
 						if (afterCreateOrganization) return afterCreateOrganization(...args);
 					};
 					const afterUpdateOrganization = organizationHooks.afterUpdateOrganization;
 					organizationHooks.afterUpdateOrganization = async (...args) => {
 						const [{ organization, user }] = args;
-						if (organization) trackOrganizationUpdated(organization, getOrganizationTriggerInfo(user), await getRequestLocation());
+						if (organization) {
+							const trigger = getOrganizationTriggerInfo(user);
+							const location = await getRequestLocation();
+							trackOrganizationUpdated(organization, trigger, location);
+						}
 						if (afterUpdateOrganization) return afterUpdateOrganization(...args);
 					};
 					const afterAddMember = organizationHooks.afterAddMember;
 					organizationHooks.afterAddMember = async (...args) => {
 						const [{ organization, member, user }] = args;
-						trackOrganizationMemberAdded(organization, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationMemberAdded(organization, member, user, trigger, location);
 						if (afterAddMember) return afterAddMember(...args);
 					};
 					const afterRemoveMember = organizationHooks.afterRemoveMember;
 					organizationHooks.afterRemoveMember = async (...args) => {
 						const [{ organization, member, user }] = args;
-						trackOrganizationMemberRemoved(organization, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationMemberRemoved(organization, member, user, trigger, location);
 						if (afterRemoveMember) return afterRemoveMember(...args);
 					};
 					const afterUpdateMemberRole = organizationHooks.afterUpdateMemberRole;
 					organizationHooks.afterUpdateMemberRole = async (...args) => {
 						const [{ organization, member, user, previousRole }] = args;
-						trackOrganizationMemberRoleUpdated(organization, member, user, previousRole, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationMemberRoleUpdated(organization, member, user, previousRole, trigger, location);
 						if (afterUpdateMemberRole) return afterUpdateMemberRole(...args);
 					};
 					const afterCreateInvitation = organizationHooks.afterCreateInvitation;
 					organizationHooks.afterCreateInvitation = async (...args) => {
 						const [{ organization, invitation, inviter }] = args;
-						trackOrganizationMemberInvited(organization, invitation, inviter, getOrganizationTriggerInfo(inviter), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(inviter);
+						const location = await getRequestLocation();
+						trackOrganizationMemberInvited(organization, invitation, inviter, trigger, location);
 						if (afterCreateInvitation) return afterCreateInvitation(...args);
 					};
 					const afterAcceptInvitation = organizationHooks.afterAcceptInvitation;
 					organizationHooks.afterAcceptInvitation = async (...args) => {
 						const [{ organization, invitation, member, user }] = args;
-						trackOrganizationMemberInviteAccepted(organization, invitation, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationMemberInviteAccepted(organization, invitation, member, user, trigger, location);
 						if (afterAcceptInvitation) return afterAcceptInvitation(...args);
 					};
 					const afterRejectInvitation = organizationHooks.afterRejectInvitation;
 					organizationHooks.afterRejectInvitation = async (...args) => {
 						const [{ organization, invitation, user }] = args;
-						trackOrganizationMemberInviteRejected(organization, invitation, user, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationMemberInviteRejected(organization, invitation, user, trigger, location);
 						if (afterRejectInvitation) return afterRejectInvitation(...args);
 					};
 					const afterCancelInvitation = organizationHooks.afterCancelInvitation;
 					organizationHooks.afterCancelInvitation = async (...args) => {
 						const [{ organization, invitation, cancelledBy }] = args;
-						trackOrganizationMemberInviteCanceled(organization, invitation, cancelledBy, getOrganizationTriggerInfo(cancelledBy), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(cancelledBy);
+						const location = await getRequestLocation();
+						trackOrganizationMemberInviteCanceled(organization, invitation, cancelledBy, trigger, location);
 						if (afterCancelInvitation) return afterCancelInvitation(...args);
 					};
 					const afterCreateTeam = organizationHooks.afterCreateTeam;
 					organizationHooks.afterCreateTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						trackOrganizationTeamCreated(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationTeamCreated(organization, team, trigger, location);
 						if (afterCreateTeam) return afterCreateTeam(...args);
 					};
 					const afterUpdateTeam = organizationHooks.afterUpdateTeam;
 					organizationHooks.afterUpdateTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						if (team) trackOrganizationTeamUpdated(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
+						if (team) {
+							const trigger = getOrganizationTriggerInfo(user);
+							const location = await getRequestLocation();
+							trackOrganizationTeamUpdated(organization, team, trigger, location);
+						}
 						if (afterUpdateTeam) return afterUpdateTeam(...args);
 					};
 					const afterDeleteTeam = organizationHooks.afterDeleteTeam;
 					organizationHooks.afterDeleteTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						trackOrganizationTeamDeleted(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationTeamDeleted(organization, team, trigger, location);
 						if (afterDeleteTeam) return afterDeleteTeam(...args);
 					};
 					const afterAddTeamMember = organizationHooks.afterAddTeamMember;
 					organizationHooks.afterAddTeamMember = async (...args) => {
 						const [{ organization, team, user, teamMember }] = args;
-						trackOrganizationTeamMemberAdded(organization, team, user, teamMember, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationTeamMemberAdded(organization, team, user, teamMember, trigger, location);
 						if (afterAddTeamMember) return afterAddTeamMember(...args);
 					};
 					const afterRemoveTeamMember = organizationHooks.afterRemoveTeamMember;
 					organizationHooks.afterRemoveTeamMember = async (...args) => {
 						const [{ organization, team, user, teamMember }] = args;
-						trackOrganizationTeamMemberRemoved(organization, team, user, teamMember, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationTeamMemberRemoved(organization, team, user, teamMember, trigger, location);
 						if (afterRemoveTeamMember) return afterRemoveTeamMember(...args);
 					};
 				};
@@ -10368,7 +10426,10 @@ const dash = (options) => {
 								}
 							} else if (matchesAnyRoute(path, [routes.SIGN_OUT])) trackUserSignedOut(enrichedSession, trigger, ctx, location, eventUser);
 							else trackSessionRevoked(enrichedSession, trigger, ctx, location, eventUser);
-							if ("impersonatedBy" in session && session.impersonatedBy) trackUserImpersonationStop(enrichedSession, trigger, ctx, location, eventUser, resolveUserFromContext(session.impersonatedBy, ctx));
+							if ("impersonatedBy" in session && session.impersonatedBy) {
+								const knownImpersonator = resolveUserFromContext(session.impersonatedBy, ctx);
+								trackUserImpersonationStop(enrichedSession, trigger, ctx, location, eventUser, knownImpersonator);
+							}
 						} }
 					},
 					account: {
@@ -10407,14 +10468,16 @@ const dash = (options) => {
 							const ctx = _ctx;
 							if (!ctx) return;
 							const path = ctx.path;
-							const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
+							const maybeUserId = ctx.context.session?.user.id ?? "unknown";
+							const trigger = getTriggerInfo(ctx, maybeUserId);
 							const location = ctx.context.location;
 							if (matchesAnyRoute(path, [routes.REQUEST_PASSWORD_RESET])) trackPasswordResetRequest(verification, trigger, ctx, location);
 						} },
 						delete: { async after(verification, ctx) {
 							if (!ctx) return;
 							const path = ctx.path;
-							const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
+							const maybeUserId = ctx.context.session?.user.id ?? "unknown";
+							const trigger = getTriggerInfo(ctx, maybeUserId);
 							const location = ctx.context.location;
 							if (matchesAnyRoute(path, [routes.RESET_PASSWORD])) trackPasswordResetRequestCompletion(verification, trigger, ctx, location);
 						} }
@@ -10462,7 +10525,8 @@ const dash = (options) => {
 					},
 					handler: createAuthMiddleware(async (_ctx) => {
 						const ctx = _ctx;
-						const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
+						const maybeUserId = ctx.context.session?.user.id ?? "unknown";
+						const trigger = getTriggerInfo(ctx, maybeUserId);
 						if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL, routes.DASH_SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx.context.location);
 						const body = ctx.body;
 						if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger, ctx.context.location);