@better-auth/infra 0.4.0 → 0.4.2

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CcJHk5SE.mjs";
-import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-CAdWFWEz.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CDhjfr8S.mjs";
+import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-D3yZH0Cy.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAdapter, getCurrentAuthContext, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
@@ -7,8 +7,11 @@ import { env } from "@better-auth/core/env";
 import { APIError as APIError$1, createAuthEndpoint, createAuthMiddleware, requestPasswordReset, sendVerificationEmailFn, sessionMiddleware } from "better-auth/api";
 import { deleteSessionCookie, setSessionCookie } from "better-auth/cookies";
 import { createFetch } from "@better-fetch/fetch";
+import { sha256 } from "@noble/hashes/sha2.js";
 import { isValidPhoneNumber, parsePhoneNumberFromString } from "libphonenumber-js";
-import z$1, { z } from "zod";
+import z, { z as z$1 } from "zod";
+import { DOMParser } from "@xmldom/xmldom";
+import { base64Url } from "@better-auth/utils/base64";
 import { createLocalJWKSet, jwtVerify } from "jose";
 import { generateRandomString, symmetricEncrypt } from "better-auth/crypto";
 import { createOTP } from "@better-auth/utils/otp";
@@ -313,7 +316,8 @@ function tryDecode(value) {
 const stripQuery = (value) => value.split("?")[0] || value;
 const escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 const routeToRegex = (route) => {
-	const pattern = escapeRegex(stripQuery(route)).replace(/\/:([^/]+)/g, "/[^/]+");
+	const normalized = stripQuery(route);
+	const pattern = escapeRegex(normalized).replace(/\/:([^/]+)/g, "/[^/]+");
 	return new RegExp(`^${pattern}(?:$|[/?])`);
 };
 const matchesAnyRoute = (path, routes) => {
@@ -373,6 +377,33 @@ function createLocalAccountIssuer(providerId) {
 function createOAuthAccountIssuer(providerId) {
 	return `local:oauth:${encodeURIComponent(providerId)}`;
 }
+/** Configured strategy when set; `null` when omitted (pre-option or default). */
+function getConfiguredAccountIdentityStrategy(account) {
+	const strategy = account?.identityStrategy;
+	if (strategy === "provider-id" || strategy === "issuer") return strategy;
+	return null;
+}
+/**
+* Effective strategy for account-key derivation.
+* Matches better-auth: omit/`"issuer"` → issuer-scoped; `"provider-id"` → provider-scoped.
+*/
+function resolveAccountIdentityStrategy(account) {
+	return getConfiguredAccountIdentityStrategy(account) ?? "issuer";
+}
+/**
+* Resolves the OAuth account issuer the same way better-auth does under
+* `account.identityStrategy`, including provider-scoped compatibility mode.
+*/
+async function resolveOAuthAccountIssuer(params) {
+	if (params.identityStrategy === "provider-id") return createOAuthAccountIssuer(params.providerId);
+	const { accountIssuer } = params;
+	if (typeof accountIssuer === "function") {
+		const issuer = await accountIssuer(params.context);
+		return typeof issuer === "string" && issuer.trim().length > 0 ? issuer : void 0;
+	}
+	if (typeof accountIssuer === "string" && accountIssuer.trim().length > 0) return accountIssuer;
+	return createOAuthAccountIssuer(params.providerId);
+}
 /** True when the installed better-auth build scopes accounts by issuer. */
 function supportsIssuerScopedAccounts(adapter) {
 	return typeof adapter.findAccountByKey === "function";
@@ -407,7 +438,7 @@ function normalizeProviderSubject(subject) {
 	if (!subject || subject === "undefined" || subject === "null") return;
 	return subject;
 }
-async function resolveAccountKey(provider, tokens, profile) {
+async function resolveAccountKey(provider, tokens, profile, identityStrategy) {
 	const keyedProvider = provider;
 	const context = {
 		tokens,
@@ -423,7 +454,12 @@ async function resolveAccountKey(provider, tokens, profile) {
 		}
 		const accountId = rawSubject ? normalizeProviderSubject(rawSubject) : void 0;
 		if (!accountId) return void 0;
-		const issuer = typeof keyedProvider.accountIssuer === "function" ? await keyedProvider.accountIssuer(context) : keyedProvider.accountIssuer ?? createOAuthAccountIssuer(provider.id);
+		const issuer = await resolveOAuthAccountIssuer({
+			providerId: provider.id,
+			identityStrategy,
+			accountIssuer: keyedProvider.accountIssuer,
+			context
+		});
 		if (!issuer) return void 0;
 		return {
 			issuer,
@@ -446,7 +482,8 @@ function instrumentSocialProviders(providers) {
 			if (user) try {
 				const endpointCtx = await getCurrentAuthContext();
 				const adapter = endpointCtx.context.internalAdapter;
-				const accountKey = result.data && typeof adapter.findAccountOwnerByKey === "function" ? await resolveAccountKey(provider, token, result.data) : void 0;
+				const identityStrategy = resolveAccountIdentityStrategy(endpointCtx.context.options.account);
+				const accountKey = result.data && typeof adapter.findAccountOwnerByKey === "function" ? await resolveAccountKey(provider, token, result.data, identityStrategy) : void 0;
 				endpointCtx.context[OAUTH_CALLBACK_USER] = {
 					user,
 					accountKey
@@ -1052,6 +1089,49 @@ function resolveClientIpFromHeaders(headers, ipAddressHeaders) {
 * when a request includes an X-Request-Id header.
 */
 const IDENTIFICATION_COOKIE_NAME = "__infra-rid";
+/** GET routes that need identification (OAuth callbacks, verify links, etc.). */
+const IDENTIFICATION_GET_ROUTES = [
+	routes.SIGN_IN_SOCIAL_CALLBACK,
+	routes.SIGN_IN_OAUTH_CALLBACK,
+	routes.DASH_IMPERSONATE_USER,
+	routes.VERIFY_EMAIL,
+	routes.MAGIC_LINK_VERIFY,
+	routes.DASH_ACCEPT_INVITATION,
+	routes.DASH_COMPLETE_INVITATION_SOCIAL
+];
+/** GET OAuth callbacks where user creation can run without identify headers. */
+const IDENTIFICATION_OAUTH_CALLBACK_GET_ROUTES = [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK];
+/**
+* Whether identification middleware should run for this request.
+* Non-GET always runs; GET only for routes that need cookie/KV resolution.
+*/
+function shouldRunIdentification(ctx, getRoutes = IDENTIFICATION_GET_ROUTES) {
+	if (ctx.request?.method !== "GET") return true;
+	return matchesAnyRoute(ctx.path, [...getRoutes]);
+}
+/**
+* Persist `X-Request-Id` as `__infra-rid` so redirect-flow OAuth callbacks
+* (GET, no identify headers) can resolve visitor identification from KV.
+* Must run in an after hook so Set-Cookie reaches the response.
+*/
+function createIdentificationCookieAfterMiddleware() {
+	return createAuthMiddleware(async (ctx) => {
+		const headerRequestId = ctx.request?.headers.get("X-Request-Id");
+		if (headerRequestId) {
+			ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
+				maxAge: 600,
+				sameSite: "lax",
+				httpOnly: true,
+				path: "/"
+			});
+			return;
+		}
+		if (ctx.context.requestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, "", {
+			maxAge: 0,
+			path: "/"
+		});
+	});
+}
 const identificationCache = /* @__PURE__ */ new Map();
 const CACHE_TTL_MS = 6e4;
 const CACHE_MAX_SIZE = 1e3;
@@ -1296,8 +1376,9 @@ function isEmailNormalizationEnabled(security) {
 * @param $api — Dash client from `createAPI(opts, { throw: true })`.
 */
 function createSecurityClient(conn, $api, options, onSecurityEvent) {
+	const resolvedApiUrl = conn.apiUrl || INFRA_API_URL;
 	const emailSender = createEmailSender({
-		apiUrl: conn.apiUrl || INFRA_API_URL,
+		apiUrl: resolvedApiUrl,
 		apiKey: conn.apiKey
 	});
 	function logEvent(event) {
@@ -1741,7 +1822,7 @@ const authPaths = [
 	"/email-otp/send-verification-otp"
 ];
 const registration = new Set(registrationPaths);
-const all = new Set([...registrationPaths, ...authPaths]);
+const all = /* @__PURE__ */ new Set([...registrationPaths, ...authPaths]);
 /** Path carries an email we hook for normalization + syntax validation. */
 const allEmail = ({ path }) => !!path && all.has(path);
 /**
@@ -1754,11 +1835,11 @@ const registrationEmail = ({ path }) => !!path && registration.has(path);
 /**
 * Gmail-like providers that ignore dots in the local part
 */
-const GMAIL_LIKE_DOMAINS = new Set(["gmail.com", "googlemail.com"]);
+const GMAIL_LIKE_DOMAINS = /* @__PURE__ */ new Set(["gmail.com", "googlemail.com"]);
 /**
 * Providers known to support plus addressing
 */
-const PLUS_ADDRESSING_DOMAINS = new Set([
+const PLUS_ADDRESSING_DOMAINS = /* @__PURE__ */ new Set([
 	"gmail.com",
 	"googlemail.com",
 	"outlook.com",
@@ -2028,7 +2109,7 @@ function createEmailHooks(options = {}) {
 * Common fake/test phone numbers that should be blocked
 * These are numbers commonly used in testing, movies, documentation, etc.
 */
-const INVALID_PHONE_NUMBERS = new Set([
+const INVALID_PHONE_NUMBERS = /* @__PURE__ */ new Set([
 	"+15550000000",
 	"+15550001111",
 	"+15550001234",
@@ -2117,7 +2198,7 @@ const INVALID_PHONE_PATTERNS = [
 * Key: country code, Value: set of invalid prefixes
 */
 const INVALID_PREFIXES_BY_COUNTRY = {
-	US: new Set([
+	US: /* @__PURE__ */ new Set([
 		"555",
 		"000",
 		"111",
@@ -2125,17 +2206,17 @@ const INVALID_PREFIXES_BY_COUNTRY = {
 		"411",
 		"611"
 	]),
-	CA: new Set([
+	CA: /* @__PURE__ */ new Set([
 		"555",
 		"000",
 		"911"
 	]),
-	GB: new Set([
+	GB: /* @__PURE__ */ new Set([
 		"7700900",
 		"1632960",
 		"1134960"
 	]),
-	AU: new Set([
+	AU: /* @__PURE__ */ new Set([
 		"0491570",
 		"0491571",
 		"0491572"
@@ -2205,7 +2286,7 @@ const validatePhone = (phone, options = {}) => {
 	if (blockVoip && phoneType === "VOIP") return false;
 	return true;
 };
-const allPhonePaths = new Set([
+const allPhonePaths = /* @__PURE__ */ new Set([
 	"/phone-number/send-otp",
 	"/phone-number/verify",
 	"/sign-in/phone-number",
@@ -2463,7 +2544,7 @@ const sentinel = (options) => {
 		hooks: {
 			before: [
 				{
-					matcher: (ctx) => ctx.request?.method !== "GET",
+					matcher: (ctx) => shouldRunIdentification(ctx, IDENTIFICATION_OAUTH_CALLBACK_GET_ROUTES),
 					handler: createIdentificationMiddleware($kv, {
 						skipIdentification: (ctx) => isDashRoute(ctx.path),
 						retry: opts.kvOptions.retry
@@ -2565,74 +2646,81 @@ const sentinel = (options) => {
 					})
 				}
 			],
-			after: [{
-				matcher: (ctx) => !!opts.security?.staleUsers?.enabled && !isDashRoute(ctx.path),
-				handler: createAuthMiddleware(async (ctx) => {
-					if (ctx.context.returned instanceof Error) return;
-					const created = ctx.context.newSession;
-					const userId = created?.user?.id ?? created?.session?.userId;
-					const sessionToken = created?.session?.token;
-					if (!userId || !sessionToken) return;
-					let user = created?.user ?? null;
-					try {
-						user = await getUserById(userId, ctx, { includeLastActiveAt: activityTrackingEnabled }) ?? user;
-					} catch (error) {
-						logger.warn("[Sentinel] Failed to fetch user for stale-account check:", error);
+			after: [
+				{
+					matcher: (ctx) => shouldRunIdentification(ctx, IDENTIFICATION_OAUTH_CALLBACK_GET_ROUTES),
+					handler: createIdentificationCookieAfterMiddleware()
+				},
+				{
+					matcher: (ctx) => !!opts.security?.staleUsers?.enabled && !isDashRoute(ctx.path),
+					handler: createAuthMiddleware(async (ctx) => {
+						if (ctx.context.returned instanceof Error) return;
+						const created = ctx.context.newSession;
+						const userId = created?.user?.id ?? created?.session?.userId;
+						const sessionToken = created?.session?.token;
+						if (!userId || !sessionToken) return;
+						let user = created?.user ?? null;
+						try {
+							user = await getUserById(userId, ctx, { includeLastActiveAt: activityTrackingEnabled }) ?? user;
+						} catch (error) {
+							logger.warn("[Sentinel] Failed to fetch user for stale-account check:", error);
+							if (!user) return;
+						}
 						if (!user) return;
-					}
-					if (!user) return;
-					recordCheck(ctx, "stale_users");
-					const staleCheck = await securityService.checkStaleUser(userId, activityTrackingEnabled ? user.lastActiveAt ?? null : null);
-					if (!staleCheck.isStale) return;
-					const identification = ctx.context.identification;
-					const staleOpts = opts.security?.staleUsers;
-					const notificationPromises = [];
-					if (staleCheck.notifyUser && user.email) notificationPromises.push(securityService.notifyStaleAccountUser(user.email, user.name || null, staleCheck.daysSinceLastActive || 0, identification));
-					if (staleCheck.notifyAdmin && staleOpts?.adminEmail) notificationPromises.push(securityService.notifyStaleAccountAdmin(staleOpts.adminEmail, userId, user.email || "unknown", user.name || null, staleCheck.daysSinceLastActive || 0, identification));
-					if (notificationPromises.length > 0) Promise.all(notificationPromises).catch((error) => {
-						logger.error("[Sentinel] Failed to send stale account notifications:", error);
-					});
-					if (staleCheck.action !== "block") return;
-					setOutcome(ctx, "blocked", "stale_users", {
-						userId,
-						daysSinceLastActive: staleCheck.daysSinceLastActive,
-						staleDays: staleCheck.staleDays,
-						lastActiveAt: staleCheck.lastActiveAt,
-						notifyUser: staleCheck.notifyUser,
-						notifyAdmin: staleCheck.notifyAdmin
-					});
-					emitEvaluation(ctx, trackEvent);
-					try {
-						await ctx.context.internalAdapter.deleteSession(sessionToken);
-					} catch (error) {
-						logger.warn("[Sentinel] Failed to delete stale-blocked session:", error);
-					}
-					deleteSessionCookie(ctx);
-					ctx.context.setNewSession(null);
-					throw new APIError("FORBIDDEN", STALE_ACCOUNT_BLOCK_ERROR);
-				})
-			}, {
-				matcher: (ctx) => ctx.request?.method !== "GET" && !isDashRoute(ctx.path),
-				handler: createAuthMiddleware(async (ctx) => {
-					const untrustedVisitorId = ctx.context.untrustedVisitorId;
-					const ip = ctx.context.ip;
-					const body = ctx.body;
-					const loginId = matchesAnyRoute(ctx.path, [routes.SIGN_IN_USERNAME]) ? body?.username : body?.email;
-					const isPasswordSignInRoute = matchesAnyRoute(ctx.path, [
-						routes.SIGN_IN_EMAIL,
-						routes.SIGN_IN_USERNAME,
-						routes.SIGN_IN_EMAIL_OTP
-					]);
-					emitEvaluation(ctx, trackEvent, {
-						identifier: loginId,
-						userAgent: ctx.headers?.get?.("user-agent") || ""
-					});
-					const returned = ctx.context.returned;
-					const staleBlocked = isStaleAccountError(returned);
-					if (isPasswordSignInRoute && returned instanceof Error && !staleBlocked && loginId && body?.password && untrustedVisitorId) await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(loginId, untrustedVisitorId, body.password, ip, ctx.context.requestId ?? null));
-					if (isPasswordSignInRoute && (!(returned instanceof Error) || staleBlocked) && loginId) await ctx.context.runInBackgroundOrAwait(securityService.clearFailedAttempts(loginId));
-				})
-			}]
+						recordCheck(ctx, "stale_users");
+						const staleCheck = await securityService.checkStaleUser(userId, activityTrackingEnabled ? user.lastActiveAt ?? null : null);
+						if (!staleCheck.isStale) return;
+						const identification = ctx.context.identification;
+						const staleOpts = opts.security?.staleUsers;
+						const notificationPromises = [];
+						if (staleCheck.notifyUser && user.email) notificationPromises.push(securityService.notifyStaleAccountUser(user.email, user.name || null, staleCheck.daysSinceLastActive || 0, identification));
+						if (staleCheck.notifyAdmin && staleOpts?.adminEmail) notificationPromises.push(securityService.notifyStaleAccountAdmin(staleOpts.adminEmail, userId, user.email || "unknown", user.name || null, staleCheck.daysSinceLastActive || 0, identification));
+						if (notificationPromises.length > 0) Promise.all(notificationPromises).catch((error) => {
+							logger.error("[Sentinel] Failed to send stale account notifications:", error);
+						});
+						if (staleCheck.action !== "block") return;
+						setOutcome(ctx, "blocked", "stale_users", {
+							userId,
+							daysSinceLastActive: staleCheck.daysSinceLastActive,
+							staleDays: staleCheck.staleDays,
+							lastActiveAt: staleCheck.lastActiveAt,
+							notifyUser: staleCheck.notifyUser,
+							notifyAdmin: staleCheck.notifyAdmin
+						});
+						emitEvaluation(ctx, trackEvent);
+						try {
+							await ctx.context.internalAdapter.deleteSession(sessionToken);
+						} catch (error) {
+							logger.warn("[Sentinel] Failed to delete stale-blocked session:", error);
+						}
+						deleteSessionCookie(ctx);
+						ctx.context.setNewSession(null);
+						throw new APIError("FORBIDDEN", STALE_ACCOUNT_BLOCK_ERROR);
+					})
+				},
+				{
+					matcher: (ctx) => ctx.request?.method !== "GET" && !isDashRoute(ctx.path),
+					handler: createAuthMiddleware(async (ctx) => {
+						const untrustedVisitorId = ctx.context.untrustedVisitorId;
+						const ip = ctx.context.ip;
+						const body = ctx.body;
+						const loginId = matchesAnyRoute(ctx.path, [routes.SIGN_IN_USERNAME]) ? body?.username : body?.email;
+						const isPasswordSignInRoute = matchesAnyRoute(ctx.path, [
+							routes.SIGN_IN_EMAIL,
+							routes.SIGN_IN_USERNAME,
+							routes.SIGN_IN_EMAIL_OTP
+						]);
+						emitEvaluation(ctx, trackEvent, {
+							identifier: loginId,
+							userAgent: ctx.headers?.get?.("user-agent") || ""
+						});
+						const returned = ctx.context.returned;
+						const staleBlocked = isStaleAccountError(returned);
+						if (isPasswordSignInRoute && returned instanceof Error && !staleBlocked && loginId && body?.password && untrustedVisitorId) await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(loginId, untrustedVisitorId, body.password, ip, ctx.context.requestId ?? null));
+						if (isPasswordSignInRoute && (!(returned instanceof Error) || staleBlocked) && loginId) await ctx.context.runInBackgroundOrAwait(securityService.clearFailedAttempts(loginId));
+					})
+				}
+			]
 		}
 	};
 };
@@ -2786,45 +2874,131 @@ const ALL_SCIM_SCOPES = [
 	"scim.groups.read",
 	"scim.groups.write"
 ];
-const scimScopeSchema = z$1.enum(ALL_SCIM_SCOPES);
+const scimScopeSchema = z.enum(ALL_SCIM_SCOPES);
 const credentialPolicySchema = {
-	scopes: z$1.array(scimScopeSchema).min(1).optional(),
-	expiresAt: z$1.coerce.date().optional()
+	scopes: z.array(scimScopeSchema).min(1).optional(),
+	expiresAt: z.coerce.date().optional()
 };
-const directorySyncSSOPairingSchema = z$1.discriminatedUnion("protocol", [z$1.object({
-	ssoProviderId: z$1.string().trim().min(1).max(255),
-	protocol: z$1.literal("oidc"),
-	externalIdSource: z$1.discriminatedUnion("kind", [z$1.object({ kind: z$1.literal("subject") }), z$1.object({
-		kind: z$1.literal("verifiedIdTokenClaim"),
-		name: z$1.string().trim().min(1).max(255)
+const directorySyncSSOPairingSchema = z.discriminatedUnion("protocol", [z.object({
+	ssoProviderId: z.string().trim().min(1).max(255),
+	protocol: z.literal("oidc"),
+	externalIdSource: z.discriminatedUnion("kind", [z.object({ kind: z.literal("subject") }), z.object({
+		kind: z.literal("verifiedIdTokenClaim"),
+		name: z.string().trim().min(1).max(255)
 	})])
-}), z$1.object({
-	ssoProviderId: z$1.string().trim().min(1).max(255),
-	protocol: z$1.literal("saml"),
-	externalIdSource: z$1.discriminatedUnion("kind", [z$1.object({ kind: z$1.literal("nameId") }), z$1.object({
-		kind: z$1.literal("attribute"),
-		name: z$1.string().trim().min(1).max(255)
+}), z.object({
+	ssoProviderId: z.string().trim().min(1).max(255),
+	protocol: z.literal("saml"),
+	externalIdSource: z.discriminatedUnion("kind", [z.object({ kind: z.literal("nameId") }), z.object({
+		kind: z.literal("attribute"),
+		name: z.string().trim().min(1).max(255)
 	})])
 })]);
-const createDirectoryBodySchema = z$1.object({
-	providerId: z$1.string().trim().min(1).max(255),
+const createDirectoryBodySchema = z.object({
+	providerId: z.string().trim().min(1).max(255),
 	pairing: directorySyncSSOPairingSchema.optional(),
 	...credentialPolicySchema
 });
-const rotateCredentialBodySchema = z$1.object(credentialPolicySchema);
-const emptyBodySchema = z$1.object({});
+const rotateCredentialBodySchema = z.object(credentialPolicySchema);
+const emptyBodySchema = z.object({});
 function setCredentialResponseSecurityHeaders(ctx) {
 	ctx.setHeader("Cache-Control", "no-store, max-age=0");
 	ctx.setHeader("Pragma", "no-cache");
 	ctx.setHeader("Referrer-Policy", "no-referrer");
 }
 //#endregion
-//#region src/directory-sync/pairing.ts
-let samlPolicyModule;
-function loadSAMLPolicy() {
-	samlPolicyModule ??= import("./saml-policy-BTVLoTyS.mjs");
-	return samlPolicyModule;
+//#region src/directory-sync/saml-policy.ts
+/**
+* Aligned with `@better-auth/sso` SAML metadata constants / helpers.
+* @see better-auth packages/sso parseSAMLServiceProviderMetadata
+*/
+const SAML_METADATA_NAMESPACE = "urn:oasis:names:tc:SAML:2.0:metadata";
+const HTTP_POST_BINDING = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+/**
+* Whether a SAML provider config requires signed assertions.
+*
+* Matches `@better-auth/sso` `deriveSAMLServiceProviderPolicy(...).wantAssertionsSigned`.
+* Invalid or unusable custom SP metadata throws (pairing maps this to BAD_REQUEST).
+*/
+function requiresSignedSAMLAssertions(config) {
+	const metadata = config.spMetadata?.metadata;
+	if (!metadata) return config.wantAssertionsSigned === true;
+	const parsedMetadata = parseSAMLServiceProviderMetadata(metadata);
+	if (!parsedMetadata.postAssertionConsumerServiceUrls.length) throw new Error("Unusable SAML service provider metadata");
+	return parsedMetadata.wantAssertionsSigned;
+}
+/**
+* Parses the security- and identity-relevant parts of SAML service-provider
+* metadata without relying on local-name-only XML matching.
+*
+* Port of `@better-auth/sso` `parseSAMLServiceProviderMetadata`.
+*/
+function parseSAMLServiceProviderMetadata(metadata) {
+	const document = new DOMParser({ onError: (_level, message) => {
+		throw new Error(message);
+	} }).parseFromString(metadata, "text/xml");
+	const entityDescriptor = document.documentElement;
+	if (!entityDescriptor || entityDescriptor.localName !== "EntityDescriptor" || entityDescriptor.namespaceURI !== SAML_METADATA_NAMESPACE) throw new Error("Invalid SAML EntityDescriptor");
+	const entityID = entityDescriptor.getAttribute("entityID")?.trim();
+	if (!entityID) throw new Error("Missing SAML entityID");
+	const serviceProviderDescriptors = directMetadataChildren(entityDescriptor, "SPSSODescriptor");
+	if (serviceProviderDescriptors.length === 0) throw new Error("SAML metadata must contain an SPSSODescriptor");
+	const acceptedServiceProviderDescriptors = new Set(serviceProviderDescriptors);
+	for (const element of Array.from(document.getElementsByTagName("*"))) {
+		if (element.localName === "EntityDescriptor" && element !== entityDescriptor) throw new Error("Invalid nested SAML EntityDescriptor");
+		if (element.localName === "SPSSODescriptor" && !acceptedServiceProviderDescriptors.has(element)) throw new Error("Invalid SAML SPSSODescriptor namespace or position");
+		if ((element.localName === "AssertionConsumerService" || element.localName === "NameIDFormat") && (element.namespaceURI !== SAML_METADATA_NAMESPACE || !element.parentNode || !isElement(element.parentNode) || !acceptedServiceProviderDescriptors.has(element.parentNode))) throw new Error(`Invalid SAML ${element.localName} namespace or position`);
+	}
+	const postAssertionConsumerServiceUrls = [];
+	const nameIDFormats = [];
+	let wantAssertionsSigned = false;
+	for (const descriptor of serviceProviderDescriptors) {
+		wantAssertionsSigned = parseXMLSchemaBoolean(descriptor.getAttribute("WantAssertionsSigned")) || wantAssertionsSigned;
+		for (const nameIDFormat of directMetadataChildren(descriptor, "NameIDFormat")) {
+			const value = nameIDFormat.textContent?.trim();
+			if (value) nameIDFormats.push(value);
+		}
+		for (const service of directMetadataChildren(descriptor, "AssertionConsumerService")) {
+			if (service.getAttribute("Binding") !== HTTP_POST_BINDING) continue;
+			const location = service.getAttribute("Location")?.trim();
+			if (!location || !isAbsoluteHttpUrl(location)) throw new Error("Invalid SAML POST AssertionConsumerService");
+			postAssertionConsumerServiceUrls.push(location);
+		}
+	}
+	return {
+		entityID,
+		nameIDFormats: [...new Set(nameIDFormats)],
+		postAssertionConsumerServiceUrls: [...new Set(postAssertionConsumerServiceUrls)],
+		wantAssertionsSigned
+	};
+}
+function isElement(node) {
+	return node.nodeType === 1;
+}
+function directMetadataChildren(element, localName) {
+	return Array.from(element.childNodes).filter((node) => isElement(node) && node.localName === localName && node.namespaceURI === SAML_METADATA_NAMESPACE);
 }
+function parseXMLSchemaBoolean(value) {
+	if (value === null) return false;
+	switch (value.trim()) {
+		case "true":
+		case "1": return true;
+		case "false":
+		case "0": return false;
+		default: throw new Error("Invalid XML Schema boolean");
+	}
+}
+function isAbsoluteHttpUrl(value) {
+	if (value.includes("#")) return false;
+	try {
+		const url = new URL(value);
+		return url.protocol === "http:" || url.protocol === "https:";
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/directory-sync/pairing.ts
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -2877,10 +3051,9 @@ async function resolveDirectorySyncSSOPairing(ctx, organizationId, pairing) {
 		if (!oidcConfiguration || samlConfiguration) throw ctx.error("BAD_REQUEST", { message: "The selected SSO provider is not an OIDC provider" });
 	} else {
 		if (!samlConfiguration || oidcConfiguration) throw ctx.error("BAD_REQUEST", { message: "The selected SSO provider is not a SAML provider" });
-		const samlPolicy = await loadSAMLPolicy();
 		let wantAssertionsSigned = false;
 		try {
-			wantAssertionsSigned = await samlPolicy.requiresSignedSAMLAssertions({
+			wantAssertionsSigned = requiresSignedSAMLAssertions({
 				spMetadata: isRecord$1(samlConfiguration.spMetadata) ? { metadata: typeof samlConfiguration.spMetadata.metadata === "string" ? samlConfiguration.spMetadata.metadata : void 0 } : void 0,
 				wantAssertionsSigned: samlConfiguration.wantAssertionsSigned === true
 			});
@@ -2927,17 +3100,228 @@ async function guardDirectorySyncSSOProviderMutation(input, context) {
 	}
 }
 //#endregion
+//#region src/directory-sync/scim-user-link.ts
+function createScopedKey(parts) {
+	return base64Url.encode(sha256(new TextEncoder().encode(JSON.stringify(parts))), { padding: false });
+}
+function createSCIMUserExternalIdKey(connectionId, externalId) {
+	return createScopedKey([
+		"scim-user-external-id",
+		connectionId,
+		externalId
+	]);
+}
+function createSCIMConnectionKey(connectionId) {
+	return createScopedKey(["scim-connection", connectionId]);
+}
+var SCIMIdentityMutationConflict = class extends Error {
+	constructor() {
+		super("The SCIM identity changed concurrently; retry the request");
+		this.name = "SCIMIdentityMutationConflict";
+	}
+};
+function concurrentIdentityMutation() {
+	throw new SCIMIdentityMutationConflict();
+}
+function hasIncrementOne(database) {
+	return typeof database.incrementOne === "function";
+}
+async function tryFenceActiveSCIMConnection(database, connectionId) {
+	return database.incrementOne({
+		model: "scimConnectionBinding",
+		where: [
+			{
+				field: "connectionKey",
+				value: createSCIMConnectionKey(connectionId)
+			},
+			{
+				field: "connectionId",
+				value: connectionId
+			},
+			{
+				field: "decommissionStatus",
+				value: "active"
+			}
+		],
+		increment: { decommissionRevision: 1 }
+	});
+}
+/**
+* Acquires an active provisioned User link inside the caller's transaction.
+* Returns null when no active link exists. Throws on concurrent identity mutation.
+*/
+async function acquireActiveSCIMUserLink(reference, context) {
+	if (!hasIncrementOne(context.database)) return null;
+	const database = context.database;
+	const externalIdKey = createSCIMUserExternalIdKey(reference.connectionId, reference.externalId);
+	const source = await database.findOne({
+		model: "scimUser",
+		where: [
+			{
+				field: "connectionId",
+				value: reference.connectionId
+			},
+			{
+				field: "externalIdKey",
+				value: externalIdKey
+			},
+			{
+				field: "externalId",
+				value: reference.externalId
+			},
+			{
+				field: "active",
+				value: true
+			}
+		]
+	});
+	if (!source) return null;
+	const binding = await database.findOne({
+		model: "scimConnectionBinding",
+		where: [
+			{
+				field: "connectionKey",
+				value: createSCIMConnectionKey(reference.connectionId)
+			},
+			{
+				field: "connectionId",
+				value: reference.connectionId
+			},
+			{
+				field: "decommissionStatus",
+				value: "active"
+			}
+		]
+	});
+	if (!binding || binding.provisioningDomainId !== source.provisioningDomainId) return null;
+	if (await database.findOne({
+		model: "scimIdentityTombstone",
+		where: [
+			{
+				field: "connectionId",
+				value: reference.connectionId
+			},
+			{
+				field: "externalIdKey",
+				value: externalIdKey
+			},
+			{
+				field: "externalId",
+				value: reference.externalId
+			}
+		]
+	})) return null;
+	const subject = await database.findOne({
+		model: "scimSubject",
+		where: [{
+			field: "userId",
+			value: source.userId
+		}]
+	});
+	if (!subject) return null;
+	if (!await database.findOne({
+		model: "user",
+		where: [{
+			field: "id",
+			value: source.userId
+		}]
+	})) return null;
+	const acquiredSubject = await database.incrementOne({
+		model: "scimSubject",
+		where: [
+			{
+				field: "id",
+				value: subject.id
+			},
+			{
+				field: "userId",
+				value: source.userId
+			},
+			{
+				field: "revision",
+				value: subject.revision
+			}
+		],
+		increment: { revision: 1 },
+		set: { updatedAt: /* @__PURE__ */ new Date() }
+	});
+	if (!acquiredSubject) concurrentIdentityMutation();
+	const acquiredSource = await database.findOne({
+		model: "scimUser",
+		where: [
+			{
+				field: "id",
+				value: source.id
+			},
+			{
+				field: "connectionId",
+				value: reference.connectionId
+			},
+			{
+				field: "provisioningDomainId",
+				value: binding.provisioningDomainId
+			},
+			{
+				field: "userId",
+				value: source.userId
+			},
+			{
+				field: "connectionUserKey",
+				value: source.connectionUserKey
+			},
+			{
+				field: "externalIdKey",
+				value: externalIdKey
+			},
+			{
+				field: "externalId",
+				value: reference.externalId
+			},
+			{
+				field: "active",
+				value: true
+			}
+		]
+	});
+	if (!acquiredSource || !acquiredSource.active || acquiredSource.userId !== acquiredSubject.userId) concurrentIdentityMutation();
+	if (!await database.findOne({
+		model: "user",
+		where: [{
+			field: "id",
+			value: acquiredSource.userId
+		}]
+	})) concurrentIdentityMutation();
+	if (await database.findOne({
+		model: "scimIdentityTombstone",
+		where: [
+			{
+				field: "connectionId",
+				value: reference.connectionId
+			},
+			{
+				field: "externalIdKey",
+				value: externalIdKey
+			},
+			{
+				field: "externalId",
+				value: reference.externalId
+			}
+		]
+	})) concurrentIdentityMutation();
+	const acquiredBinding = await tryFenceActiveSCIMConnection(database, reference.connectionId);
+	if (!acquiredBinding || acquiredBinding.id !== binding.id || acquiredBinding.provisioningDomainId !== acquiredSource.provisioningDomainId) concurrentIdentityMutation();
+	return {
+		scimUserId: source.id,
+		userId: source.userId
+	};
+}
+//#endregion
 //#region src/directory-sync/sso-user-resolution.ts
 const GENERIC_REJECTION = {
 	action: "reject",
 	code: "DIRECTORY_SYNC_AUTHENTICATION_FAILED",
 	message: "Unable to sign in with this SSO connection"
 };
-let scimCatalogModule;
-function loadSCIMCatalog() {
-	scimCatalogModule ??= import("@better-auth/scim");
-	return scimCatalogModule;
-}
 function readStringExternalId(value) {
 	if (typeof value === "string" && value.length > 0) return value;
 	return null;
@@ -2983,9 +3367,7 @@ async function resolveOrganizationDirectorySyncUser(input, context) {
 	const externalId = readExternalId(input, pairing);
 	if (!externalId) return GENERIC_REJECTION;
 	try {
-		const catalog = await loadSCIMCatalog();
-		if (typeof catalog.acquireActiveSCIMUserLink !== "function") return GENERIC_REJECTION;
-		const link = await catalog.acquireActiveSCIMUserLink({
+		const link = await acquireActiveSCIMUserLink({
 			connectionId: directory.connectionId,
 			externalId
 		}, { database: context.database });
@@ -3017,35 +3399,41 @@ function instrumentDirectorySyncIntegration(ctx, options) {
 		logger.debug("[Dash] Managed directory sync enabled but SSO/SCIM plugins are not active. Skipping integration instrumentation");
 		return;
 	}
-	if (options.ssoPairing) if (ssoPlugin) if (!ssoPlugin.options) logger.error("[Dash] Managed directory sync ssoPairing requires sso({ ... }) (at least sso({})) so pairing callbacks can be installed on the shared options object.");
-	else {
-		const ssoOptions = ssoPlugin.options;
-		const previousResolveUser = ssoOptions.resolveUser;
-		ssoOptions.resolveUser = async (input, context) => {
-			const result = await resolveOrganizationDirectorySyncUser(input, context);
-			if (result.action !== "continue") return result;
-			if (previousResolveUser) return previousResolveUser(input, context);
-			return { action: "continue" };
-		};
-		const previousGuard = ssoOptions.guardProviderMutation;
-		ssoOptions.guardProviderMutation = async (input, context) => {
-			await guardDirectorySyncSSOProviderMutation(input, context);
-			if (previousGuard) await previousGuard(input, context);
-		};
+	if (options.ssoPairing) {
+		if (ssoPlugin) {
+			if (!ssoPlugin.options) logger.error("[Dash] Managed directory sync ssoPairing requires sso({ ... }) (at least sso({})) so pairing callbacks can be installed on the shared options object.");
+			else {
+				const ssoOptions = ssoPlugin.options;
+				const previousResolveUser = ssoOptions.resolveUser;
+				ssoOptions.resolveUser = async (input, context) => {
+					const result = await resolveOrganizationDirectorySyncUser(input, context);
+					if (result.action !== "continue") return result;
+					if (previousResolveUser) return previousResolveUser(input, context);
+					return { action: "continue" };
+				};
+				const previousGuard = ssoOptions.guardProviderMutation;
+				ssoOptions.guardProviderMutation = async (input, context) => {
+					await guardDirectorySyncSSOProviderMutation(input, context);
+					if (previousGuard) await previousGuard(input, context);
+				};
+			}
+		} else logger.debug("[Dash] Managed directory sync ssoPairing enabled but SSO plugin is not active. Skipping SSO pairing instrumentation");
 	}
-	else logger.debug("[Dash] Managed directory sync ssoPairing enabled but SSO plugin is not active. Skipping SSO pairing instrumentation");
-	if (options.membershipProjection.enabled) if (scimPlugin) if (!scimPlugin.options) logger.error("[Dash] Managed directory sync membershipProjection requires scim({ ... }) with an options object so membership projection can be installed.");
-	else {
-		const scimOptions = scimPlugin.options;
-		const projection = scimOptions.projection ??= {};
-		const previousReconcileUser = projection.reconcileUser;
-		const reconcileUser = createOrganizationMembershipProjection({ role: options.membershipProjection.role });
-		projection.reconcileUser = async (input, context) => {
-			await reconcileUser(input, context);
-			if (previousReconcileUser) await previousReconcileUser(input, context);
-		};
+	if (options.membershipProjection.enabled) {
+		if (scimPlugin) {
+			if (!scimPlugin.options) logger.error("[Dash] Managed directory sync membershipProjection requires scim({ ... }) with an options object so membership projection can be installed.");
+			else {
+				const scimOptions = scimPlugin.options;
+				const projection = scimOptions.projection ??= {};
+				const previousReconcileUser = projection.reconcileUser;
+				const reconcileUser = createOrganizationMembershipProjection({ role: options.membershipProjection.role });
+				projection.reconcileUser = async (input, context) => {
+					await reconcileUser(input, context);
+					if (previousReconcileUser) await previousReconcileUser(input, context);
+				};
+			}
+		} else logger.debug("[Dash] Managed directory sync membershipProjection enabled but SCIM plugin is not active. Skipping membership projection instrumentation");
 	}
-	else logger.debug("[Dash] Managed directory sync membershipProjection enabled but SCIM plugin is not active. Skipping membership projection instrumentation");
 }
 //#endregion
 //#region src/events/organization/events-invitation.ts
@@ -3462,7 +3850,7 @@ function snakeCaseToCamelCase(key) {
 function keyVariantsForMatching(key) {
 	const trimmed = key.replace(/^[\s._-]+/, "");
 	if (!trimmed) return [key];
-	const out = new Set([key, trimmed]);
+	const out = /* @__PURE__ */ new Set([key, trimmed]);
 	if (trimmed.includes("_")) out.add(snakeCaseToCamelCase(trimmed));
 	return [...out];
 }
@@ -3482,7 +3870,7 @@ function matchesNormalizedPatterns(key, patterns) {
 	if (!hasAnyPatterns(patterns)) return false;
 	const variants = keyVariantsForMatching(key);
 	const compactLower = key.replace(/[\s._-]/g, "").toLowerCase();
-	const forms = new Set([compactLower]);
+	const forms = /* @__PURE__ */ new Set([compactLower]);
 	for (const raw of variants) {
 		forms.add(raw);
 		forms.add(raw.toLowerCase());
@@ -3540,9 +3928,9 @@ function redact(value, options) {
 	const patterns = normalizePatterns(options?.patterns);
 	return redactInner(value, /* @__PURE__ */ new WeakSet(), options, patterns);
 }
-const DASH_PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
+const DASH_PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: /* @__PURE__ */ new Set(["stripeClient"]) };
 /** Storage-strategy enums that match sensitive key suffixes but are not secrets. */
-const DASH_PLUGIN_OPTIONS_IGNORE_KEYS = new Set([
+const DASH_PLUGIN_OPTIONS_IGNORE_KEYS = /* @__PURE__ */ new Set([
 	"storeApiKey",
 	"storeClientSecret",
 	"storeSCIMToken",
@@ -3623,7 +4011,7 @@ function timingSafeEqualHash(a, b) {
 * A freshly issued token is almost certainly legitimate.
 */
 const JTI_CHECK_GRACE_PERIOD_SECONDS = 30;
-const JWKS_CACHE_TTL_MS = 900 * 1e3;
+const JWKS_CACHE_TTL_MS = 9e5;
 const jwksCache = /* @__PURE__ */ new Map();
 const inflightRequests = /* @__PURE__ */ new Map();
 async function fetchJWKS(ctx, cacheKey, $api) {
@@ -3672,7 +4060,8 @@ const jwtMiddleware = (options, schema, getJWT) => {
 			ctx.context.logger.warn("[Dash] JWT is missing from header");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(ctx, cacheKey, $api), { maxTokenAge: "5m" }).catch((e) => {
+		const remoteJWKs = await getJWKs(ctx, cacheKey, $api);
+		const { payload } = await jwtVerify(jwsFromHeader, remoteJWKs, { maxTokenAge: "5m" }).catch((e) => {
 			ctx.context.logger.warn("[Dash] JWT verification failed:", e);
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		});
@@ -3726,7 +4115,8 @@ const jwtValidateMiddleware = (options) => {
 			ctx.context.logger.warn("[Dash] JWT is missing from header");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(ctx, cacheKey, $api), { maxTokenAge: "5m" }).catch((e) => {
+		const remoteJWKs = await getJWKs(ctx, cacheKey, $api);
+		const { payload } = await jwtVerify(jwsFromHeader, remoteJWKs, { maxTokenAge: "5m" }).catch((e) => {
 			ctx.context.logger.error("[Dash] JWT verification failed:", e);
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		});
@@ -3901,6 +4291,7 @@ const getConfig = (options) => {
 				disableCSRFCheck: ctx.context.options.advanced?.disableCSRFCheck || false,
 				disableOriginCheck: ctx.context.options.advanced?.disableOriginCheck || false,
 				allowDifferentEmails: ctx.context.options.account?.accountLinking?.enabled && ctx.context.options.account?.accountLinking?.allowDifferentEmails || false,
+				identityStrategy: getConfiguredAccountIdentityStrategy(ctx.context.options.account),
 				skipStateCookieCheck: ctx.context.options.account?.skipStateCookieCheck || false,
 				storeStateCookieStrategy: ctx.context.options.account?.storeStateStrategy || null,
 				cookieCache: {
@@ -4055,12 +4446,12 @@ function assertManagedDirectorySyncEnabled(ctx) {
 }
 //#endregion
 //#region src/routes/directory-sync/route-contract.ts
-const DIRECTORY_SYNC_CREDENTIAL_LIFETIME_MS = 365 * 24 * 60 * 60 * 1e3;
-const directorySyncClaimsSchema = z$1.object({
-	purpose: z$1.literal(DIRECTORY_SYNC_PURPOSE),
-	organizationId: z$1.string().trim().min(1),
-	actorId: z$1.string().trim().min(1),
-	setupOperationId: z$1.string().trim().min(16).max(255).optional()
+const DIRECTORY_SYNC_CREDENTIAL_LIFETIME_MS = 31536e6;
+const directorySyncClaimsSchema = z.object({
+	purpose: z.literal(DIRECTORY_SYNC_PURPOSE),
+	organizationId: z.string().trim().min(1),
+	actorId: z.string().trim().min(1),
+	setupOperationId: z.string().trim().min(16).max(255).optional()
 });
 function getScimEndpoint$1(baseUrl) {
 	return `${baseUrl}/scim/v2`;
@@ -4326,14 +4717,6 @@ async function recoverManagedDirectoryConnection(ctx, row, input, policy) {
 async function createManagedDirectoryConnection(ctx, input, policy) {
 	await assertManagedDirectoryTransactionsConfigured(ctx);
 	if (input.pairing) await assertDirectorySyncSSOIntegrationConfigured(ctx);
-	if (input.pairing?.protocol === "saml") try {
-		await loadSAMLPolicy();
-	} catch {
-		throw ctx.error("NOT_IMPLEMENTED", {
-			code: "DIRECTORY_SYNC_SAML_POLICY_UNAVAILABLE",
-			message: "SAML pairing requires a compatible SSO package with service provider metadata policy support"
-		});
-	}
 	const aliasKey = await createAliasKey(input.organizationId, input.providerId);
 	const provisioningDomainId = await createProvisioningDomainId(input.organizationId, input.providerId);
 	const activeOrganizationKey = await createActiveOrganizationKey(input.organizationId);
@@ -4772,10 +5155,10 @@ const revokeDirectoryCredential = (options) => createAuthEndpoint("/dash/organiz
 const DIRECTORY_EVENTS_DEFAULT_LIMIT = 10;
 const DIRECTORY_PAGE_MAX_LIMIT = 100;
 const DIRECTORY_EVENTS_DEFAULT_SORT_DIRECTION = "desc";
-const directoryEventsQuerySchema = z$1.object({
-	limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-	offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-	sortDirection: z$1.enum(["asc", "desc"]).optional()
+const directoryEventsQuerySchema = z.object({
+	limit: z.number().or(z.string().transform(Number)).optional(),
+	offset: z.number().or(z.string().transform(Number)).optional(),
+	sortDirection: z.enum(["asc", "desc"]).optional()
 }).optional();
 function resolveDirectoryEventsPage(query) {
 	const requestedLimit = query?.limit;
@@ -4927,7 +5310,7 @@ function parseMemberRoles(role) {
 }
 function getScimManagementRoles(ctx) {
 	const creatorRole = ctx.context.getPlugin("organization")?.options?.creatorRole ?? "owner";
-	return Array.from(new Set(["admin", creatorRole]));
+	return Array.from(/* @__PURE__ */ new Set(["admin", creatorRole]));
 }
 async function findOrganizationScimManagerUserId(ctx, organizationId) {
 	const requiredRoles = getScimManagementRoles(ctx);
@@ -5028,10 +5411,10 @@ const listOrganizationDirectories = (options) => {
 const createOrganizationDirectoryLegacy = (options) => {
 	return createAuthEndpoint("/dash/organization/directory/create", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			providerId: z$1.string().min(1, "Provider ID is required"),
-			ownerUserId: z$1.string().min(1, "Owner user ID is required")
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			providerId: z.string().min(1, "Provider ID is required"),
+			ownerUserId: z.string().min(1, "Owner user ID is required")
 		})
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
@@ -5068,8 +5451,8 @@ const createOrganizationDirectoryLegacy = (options) => {
 const deleteOrganizationDirectoryLegacy = (options) => {
 	return createAuthEndpoint("/dash/organization/directory/delete", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ providerId: z$1.string().min(1, "Provider ID is required") })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ providerId: z.string().min(1, "Provider ID is required") })
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const scimPlugin = getSCIMPlugin(ctx);
@@ -5092,8 +5475,8 @@ const deleteOrganizationDirectoryLegacy = (options) => {
 const regenerateDirectoryTokenLegacy = (options) => {
 	return createAuthEndpoint("/dash/organization/directory/regenerate-token", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ providerId: z$1.string().min(1, "Provider ID is required") })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ providerId: z.string().min(1, "Provider ID is required") })
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const scimPlugin = getSCIMPlugin(ctx);
@@ -5163,13 +5546,13 @@ const getUserEvents = (options) => {
 	return createAuthEndpoint("/events/list", {
 		method: "GET",
 		use: [sessionMiddleware],
-		query: z$1.object({
+		query: z.object({
 			/** Maximum number of events to return (default: 50, max: 100) */
-			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
+			limit: z.number().or(z.string().transform(Number)).optional(),
 			/** Number of events to skip for pagination (default: 0) */
-			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
+			offset: z.number().or(z.string().transform(Number)).optional(),
 			/** Filter by event type (e.g., "user_signed_in") */
-			eventType: z$1.string().optional()
+			eventType: z.string().optional()
 		}).optional()
 	}, async (ctx) => {
 		const session = ctx.context.session;
@@ -5232,13 +5615,13 @@ const getAuditLogs = (options) => {
 	return createAuthEndpoint("/events/audit-logs", {
 		method: "GET",
 		use: [sessionMiddleware],
-		query: z$1.object({
-			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-			userId: z$1.string().optional(),
-			organizationId: z$1.string().optional(),
-			identifier: z$1.string().optional(),
-			eventType: z$1.string().optional()
+		query: z.object({
+			limit: z.number().or(z.string().transform(Number)).optional(),
+			offset: z.number().or(z.string().transform(Number)).optional(),
+			userId: z.string().optional(),
+			organizationId: z.string().optional(),
+			identifier: z.string().optional(),
+			eventType: z.string().optional()
 		}).optional()
 	}, async (ctx) => {
 		const session = ctx.context.session;
@@ -5313,7 +5696,7 @@ const getAuditLogs = (options) => {
 		};
 	});
 };
-const OWNER_ADMIN_ROLES = new Set(["owner", "admin"]);
+const OWNER_ADMIN_ROLES = /* @__PURE__ */ new Set(["owner", "admin"]);
 function isOwnerOrAdminRole(role) {
 	return role !== void 0 && OWNER_ADMIN_ROLES.has(role);
 }
@@ -5354,15 +5737,15 @@ const getAllAuditLogs = (options) => {
 	return createAuthEndpoint("/events/all-audit-logs", {
 		method: "GET",
 		use: [sessionMiddleware],
-		query: z$1.object({
-			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-			userId: z$1.string().optional(),
-			organizationId: z$1.string().optional(),
+		query: z.object({
+			limit: z.number().or(z.string().transform(Number)).optional(),
+			offset: z.number().or(z.string().transform(Number)).optional(),
+			userId: z.string().optional(),
+			organizationId: z.string().optional(),
 			/** Filter by event type (e.g. `organization_member_added`) */
-			eventType: z$1.string().optional(),
+			eventType: z.string().optional(),
 			/** Match `eventData.identifier` (organization-scoped actor identity) */
-			identifier: z$1.string().optional()
+			identifier: z.string().optional()
 		}).refine((q) => {
 			const u = q.userId?.trim();
 			const o = q.organizationId?.trim();
@@ -5419,10 +5802,10 @@ const getAllAuditLogs = (options) => {
 };
 //#endregion
 //#region src/routes/execute-adapter/index.ts
-const whereClause = z.object({
-	field: z.string(),
-	value: z.unknown(),
-	operator: z.enum([
+const whereClause = z$1.object({
+	field: z$1.string(),
+	value: z$1.unknown(),
+	operator: z$1.enum([
 		"eq",
 		"ne",
 		"gt",
@@ -5434,44 +5817,44 @@ const whereClause = z.object({
 		"starts_with",
 		"ends_with"
 	]).optional(),
-	connector: z.enum(["AND", "OR"]).optional()
+	connector: z$1.enum(["AND", "OR"]).optional()
 });
-const sortBySchema = z.object({
-	field: z.string(),
-	direction: z.enum(["asc", "desc"])
+const sortBySchema = z$1.object({
+	field: z$1.string(),
+	direction: z$1.enum(["asc", "desc"])
 });
-const actionSchema = z.discriminatedUnion("action", [
-	z.object({
-		action: z.literal("findOne"),
-		model: z.string(),
-		where: z.array(whereClause).optional(),
-		select: z.array(z.string()).optional(),
-		join: z.record(z.string(), z.boolean()).optional()
+const actionSchema = z$1.discriminatedUnion("action", [
+	z$1.object({
+		action: z$1.literal("findOne"),
+		model: z$1.string(),
+		where: z$1.array(whereClause).optional(),
+		select: z$1.array(z$1.string()).optional(),
+		join: z$1.record(z$1.string(), z$1.boolean()).optional()
 	}),
-	z.object({
-		action: z.literal("findMany"),
-		model: z.string(),
-		where: z.array(whereClause).optional(),
-		limit: z.number().optional(),
-		offset: z.number().optional(),
+	z$1.object({
+		action: z$1.literal("findMany"),
+		model: z$1.string(),
+		where: z$1.array(whereClause).optional(),
+		limit: z$1.number().optional(),
+		offset: z$1.number().optional(),
 		sortBy: sortBySchema.optional(),
-		join: z.record(z.string(), z.boolean()).optional()
+		join: z$1.record(z$1.string(), z$1.boolean()).optional()
 	}),
-	z.object({
-		action: z.literal("create"),
-		model: z.string(),
-		data: z.record(z.string(), z.unknown())
+	z$1.object({
+		action: z$1.literal("create"),
+		model: z$1.string(),
+		data: z$1.record(z$1.string(), z$1.unknown())
 	}),
-	z.object({
-		action: z.literal("update"),
-		model: z.string(),
-		where: z.array(whereClause),
-		update: z.record(z.string(), z.unknown())
+	z$1.object({
+		action: z$1.literal("update"),
+		model: z$1.string(),
+		where: z$1.array(whereClause),
+		update: z$1.record(z$1.string(), z$1.unknown())
 	}),
-	z.object({
-		action: z.literal("count"),
-		model: z.string(),
-		where: z.array(whereClause).optional()
+	z$1.object({
+		action: z$1.literal("count"),
+		model: z$1.string(),
+		where: z$1.array(whereClause).optional()
 	})
 ]);
 const executeAdapter = (options) => {
@@ -5589,8 +5972,8 @@ function isSafeHttpUrl(value) {
 	}
 }
 /** http(s) absolute URL without embedded credentials. */
-const safeUrlSchema = z$1.string().trim().min(1).pipe(z$1.url().refine(isSafeHttpUrl, { message: "URL must be a valid http(s) URL without credentials" })).transform((value) => new URL(value).href);
-const optionalSafeUrlSchema = z$1.union([safeUrlSchema, z$1.literal("")]).optional();
+const safeUrlSchema = z.string().trim().min(1).pipe(z.url().refine(isSafeHttpUrl, { message: "URL must be a valid http(s) URL without credentials" })).transform((value) => new URL(value).href);
+const optionalSafeUrlSchema = z.union([safeUrlSchema, z.literal("")]).optional();
 function getAuthBaseUrl(ctx) {
 	const baseURL = ctx.context.options.baseURL;
 	return typeof baseURL === "string" && baseURL.trim() ? baseURL : "/";
@@ -5669,10 +6052,13 @@ async function executePlatformInvitationCompletion(ctx, $api, invitation, args)
 			}
 		});
 		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
-			session: await ctx.context.internalAdapter.createSession(existingUser.id),
-			user: existingUser
-		});
+		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) {
+			const session = await ctx.context.internalAdapter.createSession(existingUser.id);
+			await setSessionCookie(ctx, {
+				session,
+				user: existingUser
+			});
+		}
 		return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)) };
 	}
 	if (!password && !allowsPasswordlessInviteComplete(invitation.authMode)) throw new APIError("BAD_REQUEST", { message: "Password is required to complete this invitation." });
@@ -5697,10 +6083,13 @@ async function executePlatformInvitationCompletion(ctx, $api, invitation, args)
 		}
 	});
 	if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-	if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
-		session: await ctx.context.internalAdapter.createSession(user.id),
-		user
-	});
+	if (shouldCreateSessionOnInviteComplete(invitation.authMode)) {
+		const session = await ctx.context.internalAdapter.createSession(user.id);
+		await setSessionCookie(ctx, {
+			session,
+			user
+		});
+	}
 	return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)) };
 }
 /**
@@ -5712,7 +6101,7 @@ const acceptInvitation = (options) => {
 	const { $api } = options;
 	return createAuthEndpoint("/dash/accept-invitation", {
 		method: "GET",
-		query: z$1.object({ token: z$1.string() })
+		query: z.object({ token: z.string() })
 	}, async (ctx) => {
 		const { token } = ctx.query;
 		const invitation = await verifyPendingInvitation(token, $api, ctx);
@@ -5727,10 +6116,13 @@ const acceptInvitation = (options) => {
 				}
 			});
 			if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted (existing user)", markError);
-			if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
-				session: await ctx.context.internalAdapter.createSession(existingUser.id),
-				user: existingUser
-			});
+			if (shouldCreateSessionOnInviteComplete(invitation.authMode)) {
+				const session = await ctx.context.internalAdapter.createSession(existingUser.id);
+				await setSessionCookie(ctx, {
+					session,
+					user: existingUser
+				});
+			}
 			const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx));
 			return ctx.redirect(redirectUrl);
 		}
@@ -5759,10 +6151,13 @@ const acceptInvitation = (options) => {
 			}
 		});
 		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
-			session: await ctx.context.internalAdapter.createSession(user.id),
-			user
-		});
+		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) {
+			const session = await ctx.context.internalAdapter.createSession(user.id);
+			await setSessionCookie(ctx, {
+				session,
+				user
+			});
+		}
 		const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx));
 		return ctx.redirect(redirectUrl);
 	});
@@ -5776,13 +6171,14 @@ const completeInvitation = (options) => {
 	const { $api } = options;
 	return createAuthEndpoint("/dash/complete-invitation", {
 		method: "POST",
-		body: z$1.object({
-			token: z$1.string(),
-			password: z$1.string().optional()
+		body: z.object({
+			token: z.string(),
+			password: z.string().optional()
 		})
 	}, async (ctx) => {
 		const { token, password } = ctx.body;
-		const { redirectUrl } = await executePlatformInvitationCompletion(ctx, $api, await verifyPendingInvitation(token, $api, ctx), {
+		const invitation = await verifyPendingInvitation(token, $api, ctx);
+		const { redirectUrl } = await executePlatformInvitationCompletion(ctx, $api, invitation, {
 			token,
 			password
 		});
@@ -5800,14 +6196,15 @@ const completeInvitationHandoff = (options) => {
 	const { $api } = options;
 	return createAuthEndpoint("/dash/complete-invitation-handoff", {
 		method: "GET",
-		query: z$1.object({ handoff: z$1.string().min(1) })
+		query: z.object({ handoff: z.string().min(1) })
 	}, async (ctx) => {
 		const { data, error } = await $api("/api/internal/invitations/redeem-handoff", {
 			method: "POST",
 			body: { handoff: ctx.query.handoff }
 		});
 		if (error || !data?.invitationToken) throw new APIError("BAD_REQUEST", { message: "This invitation link has expired. Please try again." });
-		const { redirectUrl } = await executePlatformInvitationCompletion(ctx, $api, await verifyPendingInvitation(data.invitationToken, $api, ctx), {
+		const invitation = await verifyPendingInvitation(data.invitationToken, $api, ctx);
+		const { redirectUrl } = await executePlatformInvitationCompletion(ctx, $api, invitation, {
 			token: data.invitationToken,
 			password: data.password ?? void 0
 		});
@@ -5818,7 +6215,7 @@ const completeInvitationSocial = (options) => {
 	const { $api } = options;
 	return createAuthEndpoint("/dash/complete-invitation-social", {
 		method: "GET",
-		query: z$1.object({ token: z$1.string() }),
+		query: z.object({ token: z.string() }),
 		use: [sessionMiddleware]
 	}, async (ctx) => {
 		const sessionUser = ctx.context.session?.user;
@@ -5853,7 +6250,7 @@ const checkUserExists = (options) => {
 	return createAuthEndpoint("/dash/check-user-exists", {
 		method: "POST",
 		use: [jwtMiddleware(options)],
-		body: z$1.object({ email: z$1.email() })
+		body: z.object({ email: z.email() })
 	}, async (ctx) => {
 		const { email } = ctx.body;
 		const normalizedEmail = normalizeEmail(email, ctx.context);
@@ -5883,7 +6280,7 @@ function getOrganizationRoleKeys(orgOptions) {
 	if (roles && typeof roles === "object" && Object.keys(roles).length > 0) return Object.keys(roles);
 	return [...DEFAULT_ORG_MEMBER_ROLES];
 }
-const organizationMemberRoleInputSchema = z$1.string().trim().min(1, "Role is required").max(64, "Role is too long").regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, "Role must start with a letter and contain only letters, numbers, hyphens, and underscores");
+const organizationMemberRoleInputSchema = z.string().trim().min(1, "Role is required").max(64, "Role is too long").regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, "Role must start with a letter and contain only letters, numbers, hyphens, and underscores");
 function validateOrganizationMemberRole(ctx, role, orgOptions) {
 	const allowedRoles = getOrganizationRoleKeys(orgOptions);
 	if (!allowedRoles.includes(role)) throw ctx.error("BAD_REQUEST", { message: `Invalid role. Allowed roles: ${allowedRoles.join(", ")}` });
@@ -5945,14 +6342,14 @@ const listOrganizationInvitations = (options) => {
 const inviteMember = (options) => {
 	return createAuthEndpoint("/dash/organization/invite-member", {
 		method: "POST",
-		body: z$1.object({
-			email: z$1.string(),
+		body: z.object({
+			email: z.string(),
 			role: organizationMemberRoleInputSchema,
-			invitedBy: z$1.string()
+			invitedBy: z.string()
 		}),
-		use: [jwtMiddleware(options, z$1.object({
-			organizationId: z$1.string(),
-			invitedBy: z$1.string()
+		use: [jwtMiddleware(options, z.object({
+			organizationId: z.string(),
+			invitedBy: z.string()
 		}))]
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
@@ -5989,8 +6386,8 @@ const inviteMember = (options) => {
 const checkUserByEmail = (options) => {
 	return createAuthEndpoint("/dash/organization/check-user-by-email", {
 		method: "POST",
-		body: z$1.object({ email: z$1.string() }),
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))]
+		body: z.object({ email: z.string() }),
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))]
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const { organizationId } = ctx.context.payload;
@@ -6033,11 +6430,11 @@ const checkUserByEmail = (options) => {
 const cancelInvitation = (options) => {
 	return createAuthEndpoint("/dash/organization/cancel-invitation", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({
-			organizationId: z$1.string(),
-			invitationId: z$1.string()
+		use: [jwtMiddleware(options, z.object({
+			organizationId: z.string(),
+			invitationId: z.string()
 		}))],
-		body: z$1.object({ invitationId: z$1.string() })
+		body: z.object({ invitationId: z.string() })
 	}, async (ctx) => {
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
 		const { invitationId, organizationId } = ctx.context.payload;
@@ -6091,11 +6488,11 @@ const cancelInvitation = (options) => {
 const resendInvitation = (options) => {
 	return createAuthEndpoint("/dash/organization/resend-invitation", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({
-			organizationId: z$1.string(),
-			invitationId: z$1.string()
+		use: [jwtMiddleware(options, z.object({
+			organizationId: z.string(),
+			invitationId: z.string()
 		}))],
-		body: z$1.object({ invitationId: z$1.string() })
+		body: z.object({ invitationId: z.string() })
 	}, async (ctx) => {
 		const organizationPlugin = requireOrganizationPlugin(ctx);
 		const { invitationId, organizationId } = ctx.context.payload;
@@ -6204,9 +6601,9 @@ const listOrganizationMembers = (options) => {
 const addMember = (options) => {
 	return createAuthEndpoint("/dash/organization/add-member", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			userId: z$1.string(),
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			userId: z.string(),
 			role: organizationMemberRoleInputSchema
 		})
 	}, async (ctx) => {
@@ -6261,8 +6658,8 @@ const addMember = (options) => {
 const removeMember = (options) => {
 	return createAuthEndpoint("/dash/organization/remove-member", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ memberId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ memberId: z.string() })
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
@@ -6331,9 +6728,9 @@ const removeMember = (options) => {
 const updateMemberRole = (options) => {
 	return createAuthEndpoint("/dash/organization/update-member-role", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			memberId: z$1.string(),
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			memberId: z.string(),
 			role: organizationMemberRoleInputSchema
 		})
 	}, async (ctx) => {
@@ -6392,7 +6789,7 @@ const updateMemberRole = (options) => {
 //#region src/export-factory.ts
 const exportFactory = (input, options) => async (ctx) => {
 	const batchSize = options?.batchSize || 1e4;
-	const staleMs = options?.staleMs || 300 * 1e3;
+	const staleMs = options?.staleMs || 3e5;
 	const enabledFields = options?.enabledFields || [];
 	const userLimit = input.limit;
 	const userOffset = input.offset || 0;
@@ -6489,16 +6886,16 @@ async function withConcurrency(items, fn, options) {
 	return results;
 }
 /** Zod schema for validating organization/project slug format. */
-const slugSchema = z.string().min(1, "Slug is required").regex(/^[a-z0-9-]+$/, "Slug can only contain lowercase letters, numbers, and hyphens");
+const slugSchema = z$1.string().min(1, "Slug is required").regex(/^[a-z0-9-]+$/, "Slug can only contain lowercase letters, numbers, and hyphens");
 //#endregion
 //#region src/routes/organizations/schemas.ts
-const DENIED_ORG_WRITE_KEYS = new Set([
+const DENIED_ORG_WRITE_KEYS = /* @__PURE__ */ new Set([
 	"id",
 	"createdAt",
 	"updatedAt"
 ]);
-const CREATE_NON_PERSISTED_KEYS = new Set(["defaultTeamName"]);
-const CREATE_REQUEST_ONLY_KEYS$1 = new Set(["userId", "skipDefaultTeam"]);
+const CREATE_NON_PERSISTED_KEYS = /* @__PURE__ */ new Set(["defaultTeamName"]);
+const CREATE_REQUEST_ONLY_KEYS$1 = /* @__PURE__ */ new Set(["userId", "skipDefaultTeam"]);
 const CORE_CREATE_KEYS$1 = [
 	"name",
 	"slug",
@@ -6530,7 +6927,7 @@ function getWritableOrganizationFieldNames(orgOptions, mode) {
 */
 function pickWritableOrganizationFields(body, orgOptions, mode) {
 	const allowed = getWritableOrganizationFieldNames(orgOptions, mode);
-	const skip = new Set([
+	const skip = /* @__PURE__ */ new Set([
 		...DENIED_ORG_WRITE_KEYS,
 		...mode === "create" ? CREATE_NON_PERSISTED_KEYS : [],
 		...mode === "create" ? CREATE_REQUEST_ONLY_KEYS$1 : []
@@ -6542,26 +6939,26 @@ function pickWritableOrganizationFields(body, orgOptions, mode) {
 	}
 	return result;
 }
-const BaseCreateOrgCoreBodySchema = z$1.object({
-	name: z$1.string(),
+const BaseCreateOrgCoreBodySchema = z.object({
+	name: z.string(),
 	slug: slugSchema,
-	logo: z$1.string().optional(),
-	defaultTeamName: z$1.string().optional()
+	logo: z.string().optional(),
+	defaultTeamName: z.string().optional()
 });
-const BaseUpdateOrgCoreBodySchema = z$1.object({
+const BaseUpdateOrgCoreBodySchema = z.object({
 	logo: optionalSafeUrlSchema,
-	name: z$1.string().optional(),
+	name: z.string().optional(),
 	slug: slugSchema.optional(),
-	metadata: z$1.string().optional()
+	metadata: z.string().optional()
 });
-const CreateOrganizationBodySchema = BaseCreateOrgCoreBodySchema.catchall(z$1.unknown());
-const UpdateOrganizationBodySchema = BaseUpdateOrgCoreBodySchema.catchall(z$1.unknown());
+const CreateOrganizationBodySchema = BaseCreateOrgCoreBodySchema.catchall(z.unknown());
+const UpdateOrganizationBodySchema = BaseUpdateOrgCoreBodySchema.catchall(z.unknown());
 function createSchemaForDBField$1(field) {
 	switch (field.type) {
-		case "number": return field.required ? z$1.coerce.number() : z$1.coerce.number().optional();
-		case "boolean": return field.required ? z$1.coerce.boolean() : z$1.coerce.boolean().optional();
-		case "date": return field.required ? z$1.union([z$1.string().min(1), z$1.coerce.date()]) : z$1.union([z$1.string(), z$1.coerce.date()]).optional();
-		default: return field.required ? z$1.string().min(1) : z$1.string().optional();
+		case "number": return field.required ? z.coerce.number() : z.coerce.number().optional();
+		case "boolean": return field.required ? z.coerce.boolean() : z.coerce.boolean().optional();
+		case "date": return field.required ? z.union([z.string().min(1), z.coerce.date()]) : z.union([z.string(), z.coerce.date()]).optional();
+		default: return field.required ? z.string().min(1) : z.string().optional();
 	}
 }
 /**
@@ -6570,39 +6967,39 @@ function createSchemaForDBField$1(field) {
 */
 function validateWritableCreateOrganizationFields(data, options) {
 	const shape = {
-		name: z$1.string().min(1),
+		name: z.string().min(1),
 		slug: slugSchema,
-		logo: z$1.string().optional()
+		logo: z.string().optional()
 	};
 	const additional = getOrganizationAdditionalFields(options);
 	for (const [name, field] of Object.entries(additional)) {
 		if (field.input === false) continue;
 		shape[name] = createSchemaForDBField$1(field);
 	}
-	const result = z$1.object(shape).strict().safeParse(data);
+	const result = z.object(shape).strict().safeParse(data);
 	if (!result.success) throw result.error;
 }
 /**
 * Ensures at least one field is present on update and validates additional field types.
 */
 function validateWritableOrganizationUpdateFields(data, orgOptions) {
-	if (Object.keys(data).length === 0) throw new z$1.ZodError([{
+	if (Object.keys(data).length === 0) throw new z.ZodError([{
 		code: "custom",
 		message: "No valid fields to update",
 		path: []
 	}]);
 	const shape = {
-		name: z$1.string().min(1).optional(),
+		name: z.string().min(1).optional(),
 		slug: slugSchema.optional(),
 		logo: optionalSafeUrlSchema,
-		metadata: z$1.string().optional()
+		metadata: z.string().optional()
 	};
 	const additional = getOrganizationAdditionalFields(orgOptions);
 	for (const [name, field] of Object.entries(additional)) {
 		if (field.input === false) continue;
 		shape[name] = createSchemaForDBField$1(field);
 	}
-	const result = z$1.object(shape).partial().strict().safeParse(data);
+	const result = z.object(shape).partial().strict().safeParse(data);
 	if (!result.success) throw result.error;
 }
 //#endregion
@@ -6644,26 +7041,26 @@ const listOrganizations = (options) => {
 	return createAuthEndpoint("/dash/list-organizations", {
 		method: "GET",
 		use: [jwtMiddleware(options)],
-		query: z$1.object({
-			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-			sortBy: z$1.enum([
+		query: z.object({
+			limit: z.number().or(z.string().transform(Number)).optional(),
+			offset: z.number().or(z.string().transform(Number)).optional(),
+			sortBy: z.enum([
 				"createdAt",
 				"name",
 				"slug",
 				"members"
 			]).optional(),
-			sortOrder: z$1.enum(["asc", "desc"]).optional(),
-			filterMembers: z$1.enum([
+			sortOrder: z.enum(["asc", "desc"]).optional(),
+			filterMembers: z.enum([
 				"abandoned",
 				"eq1",
 				"gt1",
 				"gt5",
 				"gt10"
 			]).optional(),
-			search: z$1.string().optional(),
-			startDate: z$1.date().or(z$1.string().transform((val) => new Date(val))).optional(),
-			endDate: z$1.date().or(z$1.string().transform((val) => new Date(val))).optional()
+			search: z.string().optional(),
+			startDate: z.date().or(z.string().transform((val) => new Date(val))).optional(),
+			endDate: z.date().or(z.string().transform((val) => new Date(val))).optional()
 		}).optional()
 	}, async (ctx) => {
 		const { limit = 10, offset = 0, sortBy = "createdAt", sortOrder = "desc", search, filterMembers } = ctx.query || {};
@@ -6784,12 +7181,12 @@ function parseWhereClause$1(val) {
 	if (!Array.isArray(parsed)) return [];
 	return parsed;
 }
-const exportOrganizationsQuerySchema = z$1.object({
-	limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-	offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-	sortBy: z$1.string().optional(),
-	sortOrder: z$1.enum(["asc", "desc"]).optional(),
-	where: z$1.string().transform(parseWhereClause$1).optional()
+const exportOrganizationsQuerySchema = z.object({
+	limit: z.number().or(z.string().transform(Number)).optional(),
+	offset: z.number().or(z.string().transform(Number)).optional(),
+	sortBy: z.string().optional(),
+	sortOrder: z.enum(["asc", "desc"]).optional(),
+	where: z.string().transform(parseWhereClause$1).optional()
 }).optional();
 const exportOrganizations = (options) => {
 	return createAuthEndpoint("/dash/export-organizations", {
@@ -6854,8 +7251,8 @@ const getOrganization = (options) => {
 const deleteOrganization = (options) => {
 	return createAuthEndpoint("/dash/organization/delete", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ organizationId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ organizationId: z.string() })
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const { organizationId: bodyOrganizationId } = ctx.body;
@@ -6904,7 +7301,7 @@ const deleteOrganization = (options) => {
 const deleteManyOrganizations = (options) => {
 	return createAuthEndpoint("/dash/organization/delete-many", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationIds: z$1.string().array() }))]
+		use: [jwtMiddleware(options, z.object({ organizationIds: z.string().array() }))]
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const { organizationIds } = ctx.context.payload;
@@ -6941,9 +7338,9 @@ const deleteManyOrganizations = (options) => {
 const createOrganization = (options) => {
 	return createAuthEndpoint("/dash/organization/create", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({
-			userId: z$1.string(),
-			skipDefaultTeam: z$1.boolean().optional().default(false)
+		use: [jwtMiddleware(options, z.object({
+			userId: z.string(),
+			skipDefaultTeam: z.boolean().optional().default(false)
 		}))],
 		body: CreateOrganizationBodySchema
 	}, async (ctx) => {
@@ -6969,7 +7366,7 @@ const createOrganization = (options) => {
 		try {
 			validateWritableCreateOrganizationFields(orgData, orgOptions);
 		} catch (error) {
-			if (error instanceof z$1.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
+			if (error instanceof z.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
 			throw error;
 		}
 		if (orgOptions.organizationCreation?.beforeCreate) {
@@ -7105,7 +7502,7 @@ const createOrganization = (options) => {
 const updateOrganization = (options) => {
 	return createAuthEndpoint("/dash/organization/update", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
 		body: UpdateOrganizationBodySchema
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
@@ -7145,7 +7542,7 @@ const updateOrganization = (options) => {
 		try {
 			validateWritableOrganizationUpdateFields(updateData, orgOptions);
 		} catch (error) {
-			if (error instanceof z$1.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
+			if (error instanceof z.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
 			throw error;
 		}
 		if (typeof updateData.metadata === "string") try {
@@ -7232,10 +7629,10 @@ const listOrganizationTeams = (options) => {
 const updateTeam = (options) => {
 	return createAuthEndpoint("/dash/organization/update-team", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			teamId: z$1.string(),
-			name: z$1.string().optional()
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			teamId: z.string(),
+			name: z.string().optional()
 		})
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
@@ -7306,8 +7703,8 @@ const updateTeam = (options) => {
 const deleteTeam = (options) => {
 	return createAuthEndpoint("/dash/organization/delete-team", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ teamId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ teamId: z.string() })
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireTeamsEnabled(ctx);
@@ -7375,8 +7772,8 @@ const deleteTeam = (options) => {
 const createTeam = (options) => {
 	return createAuthEndpoint("/dash/organization/create-team", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ name: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ name: z.string() })
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireTeamsEnabled(ctx);
@@ -7494,10 +7891,10 @@ const listTeamMembers = (options) => {
 const addTeamMember = (options) => {
 	return createAuthEndpoint("/dash/organization/add-team-member", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			teamId: z$1.string(),
-			userId: z$1.string()
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			teamId: z.string(),
+			userId: z.string()
 		})
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
@@ -7587,10 +7984,10 @@ const addTeamMember = (options) => {
 const removeTeamMember = (options) => {
 	return createAuthEndpoint("/dash/organization/remove-team-member", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			teamId: z$1.string(),
-			userId: z$1.string()
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			teamId: z.string(),
+			userId: z.string()
 		})
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
@@ -7693,7 +8090,7 @@ const revokeSession = (options) => createAuthEndpoint("/dash/sessions/revoke", {
 const revokeAllSessions = (options) => createAuthEndpoint("/dash/sessions/revoke-all", {
 	method: "POST",
 	use: [jwtMiddleware(options)],
-	body: z$1.object({ userId: z$1.string() })
+	body: z.object({ userId: z.string() })
 }, async (ctx) => {
 	const { userId } = ctx.body;
 	if (!await ctx.context.internalAdapter.findUserById(userId)) throw ctx.error("NOT_FOUND", { message: "User not found" });
@@ -7702,7 +8099,7 @@ const revokeAllSessions = (options) => createAuthEndpoint("/dash/sessions/revoke
 });
 const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revoke-many", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))]
+	use: [jwtMiddleware(options, z.object({ userIds: z.string().array() }))]
 }, async (ctx) => {
 	const { userIds } = ctx.context.payload;
 	await withConcurrency(chunkArray(userIds, { batchSize: 50 }), async (chunk) => {
@@ -7747,7 +8144,7 @@ function getSSOPlugin(ctx) {
 * (see packages/sso dist constants). Inlined so consumers (e.g. Metro) never
 * statically pull @better-auth/sso for validation-only code paths.
 */
-const DEFAULT_MAX_SAML_METADATA_SIZE = 100 * 1024;
+const DEFAULT_MAX_SAML_METADATA_SIZE = 102400;
 const RSA_SHA1 = "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
 const SHA1 = "http://www.w3.org/2000/09/xmldsig#sha1";
 /** @public */
@@ -7831,44 +8228,44 @@ function requireOrganizationAccess(ctx) {
 	const orgIdFromToken = ctx.context.payload?.organizationId;
 	if (!orgIdFromToken || orgIdFromUrl !== orgIdFromToken) throw ctx.error("FORBIDDEN", { message: "You do not have access to this organization" });
 }
-const samlConfigSchema = z$1.object({
-	idpMetadata: z$1.object({
-		metadata: z$1.string().optional(),
-		metadataUrl: z$1.string().optional()
+const samlConfigSchema = z.object({
+	idpMetadata: z.object({
+		metadata: z.string().optional(),
+		metadataUrl: z.string().optional()
 	}).optional(),
-	entryPoint: z$1.string().optional(),
-	cert: z$1.string().optional(),
-	entityId: z$1.string().optional(),
-	mapping: z$1.object({
+	entryPoint: z.string().optional(),
+	cert: z.string().optional(),
+	entityId: z.string().optional(),
+	mapping: z.object({
 		/** @deprecated Removed in better-auth 1.7+; SAML subject is NameID. */
-		id: z$1.string().optional(),
-		email: z$1.string().optional(),
-		emailVerified: z$1.string().optional(),
-		name: z$1.string().optional(),
-		firstName: z$1.string().optional(),
-		lastName: z$1.string().optional(),
-		extraFields: z$1.record(z$1.string(), z$1.any()).optional()
+		id: z.string().optional(),
+		email: z.string().optional(),
+		emailVerified: z.string().optional(),
+		name: z.string().optional(),
+		firstName: z.string().optional(),
+		lastName: z.string().optional(),
+		extraFields: z.record(z.string(), z.any()).optional()
 	}).optional()
 });
-const oidcConfigSchema = z$1.object({
-	clientId: z$1.string(),
-	clientSecret: z$1.string().optional(),
-	discoveryUrl: z$1.string().optional(),
-	issuer: z$1.string().optional(),
-	discoveryEndpoint: z$1.string().optional(),
-	authorizationEndpoint: z$1.string().optional(),
-	tokenEndpoint: z$1.string().optional(),
-	jwksEndpoint: z$1.string().optional(),
-	userInfoEndpoint: z$1.string().optional(),
-	tokenEndpointAuthentication: z$1.enum(["client_secret_post", "client_secret_basic"]).optional(),
-	mapping: z$1.object({
+const oidcConfigSchema = z.object({
+	clientId: z.string(),
+	clientSecret: z.string().optional(),
+	discoveryUrl: z.string().optional(),
+	issuer: z.string().optional(),
+	discoveryEndpoint: z.string().optional(),
+	authorizationEndpoint: z.string().optional(),
+	tokenEndpoint: z.string().optional(),
+	jwksEndpoint: z.string().optional(),
+	userInfoEndpoint: z.string().optional(),
+	tokenEndpointAuthentication: z.enum(["client_secret_post", "client_secret_basic"]).optional(),
+	mapping: z.object({
 		/** @deprecated Removed in better-auth 1.7+; OIDC subject is `sub`. */
-		id: z$1.string().optional(),
-		email: z$1.string().optional(),
-		emailVerified: z$1.string().optional(),
-		name: z$1.string().optional(),
-		image: z$1.string().optional(),
-		extraFields: z$1.record(z$1.string(), z$1.any()).optional()
+		id: z.string().optional(),
+		email: z.string().optional(),
+		emailVerified: z.string().optional(),
+		name: z.string().optional(),
+		image: z.string().optional(),
+		extraFields: z.record(z.string(), z.any()).optional()
 	}).optional()
 });
 async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
@@ -7961,7 +8358,7 @@ async function resolveOIDCConfig(oidcConfig, _domain, ctx) {
 const listOrganizationSsoProviders = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-providers", {
 		method: "GET",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))]
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))]
 	}, async (ctx) => {
 		if (!isOrganizationEnabled(ctx)) {
 			ctx.context.logger.warn("[Dash] Organization plugin not enabled, returning empty SSO providers list");
@@ -7990,12 +8387,12 @@ const listOrganizationSsoProviders = (options) => {
 const createSsoProvider = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/create", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			providerId: z$1.string(),
-			domain: z$1.string(),
-			protocol: z$1.enum(["SAML", "OIDC"]),
-			userId: z$1.string(),
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			providerId: z.string(),
+			domain: z.string(),
+			protocol: z.enum(["SAML", "OIDC"]),
+			userId: z.string(),
 			samlConfig: samlConfigSchema.optional(),
 			oidcConfig: oidcConfigSchema.optional()
 		})
@@ -8057,11 +8454,11 @@ const createSsoProvider = (options) => {
 const updateSsoProvider = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/update", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			providerId: z$1.string(),
-			domain: z$1.string(),
-			protocol: z$1.enum(["SAML", "OIDC"]),
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			providerId: z.string(),
+			domain: z.string(),
+			protocol: z.enum(["SAML", "OIDC"]),
 			samlConfig: samlConfigSchema.optional(),
 			oidcConfig: oidcConfigSchema.optional()
 		})
@@ -8140,8 +8537,8 @@ const updateSsoProvider = (options) => {
 const requestSsoVerificationToken = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/request-verification-token", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ providerId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ providerId: z.string() })
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		requireOrganizationAccess(ctx);
@@ -8188,8 +8585,8 @@ const requestSsoVerificationToken = (options) => {
 const verifySsoProviderDomain = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/verify-domain", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ providerId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ providerId: z.string() })
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		requireOrganizationAccess(ctx);
@@ -8235,8 +8632,8 @@ const verifySsoProviderDomain = (options) => {
 const deleteSsoProvider = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/delete", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ providerId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ providerId: z.string() })
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		requireOrganizationAccess(ctx);
@@ -8278,10 +8675,10 @@ const deleteSsoProvider = (options) => {
 const markSsoProviderDomainVerified = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/mark-domain-verified", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			providerId: z$1.string(),
-			verified: z$1.literal(false).describe("Clears domain verification. Domains can only be marked verified via DNS (verify-domain).")
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			providerId: z.string(),
+			verified: z.literal(false).describe("Clears domain verification. Domains can only be marked verified via DNS (verify-domain).")
 		})
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
@@ -8377,7 +8774,7 @@ function buildTotpUri(params) {
 //#region src/routes/two-factor/index.ts
 const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
@@ -8438,7 +8835,7 @@ const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor
 });
 const completeTwoFactorSetup = (options) => createAuthEndpoint("/dash/complete-two-factor-setup", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
@@ -8466,7 +8863,7 @@ const completeTwoFactorSetup = (options) => createAuthEndpoint("/dash/complete-t
 const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-factor-totp-uri", {
 	method: "POST",
 	metadata: { scope: "http" },
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
@@ -8504,13 +8901,13 @@ const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-fac
 });
 const viewBackupCodes = (options) => createAuthEndpoint("/dash/view-backup-codes", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async () => {
 	throw new APIError("FORBIDDEN", { message: "Backup codes cannot be viewed after initial setup. Generate new codes instead." });
 });
 const disableTwoFactor = (options) => createAuthEndpoint("/dash/disable-two-factor", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
@@ -8531,7 +8928,7 @@ const disableTwoFactor = (options) => createAuthEndpoint("/dash/disable-two-fact
 });
 const generateBackupCodes = (options) => createAuthEndpoint("/dash/generate-backup-codes", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
@@ -8596,13 +8993,13 @@ async function resolveTwoFactorStatus(context, userId, user) {
 }
 //#endregion
 //#region src/routes/users/schemas.ts
-const DENIED_USER_WRITE_KEYS = new Set([
+const DENIED_USER_WRITE_KEYS = /* @__PURE__ */ new Set([
 	"id",
 	"createdAt",
 	"updatedAt"
 ]);
 /** Fields that must be changed through dedicated permission-checked endpoints. */
-const DENIED_SENSITIVE_USER_KEYS = new Set([
+const DENIED_SENSITIVE_USER_KEYS = /* @__PURE__ */ new Set([
 	"banned",
 	"banReason",
 	"banExpires",
@@ -8611,7 +9008,7 @@ const DENIED_SENSITIVE_USER_KEYS = new Set([
 	"twoFactorEnabled",
 	"twoFactorSecret"
 ]);
-const CREATE_REQUEST_ONLY_KEYS = new Set([
+const CREATE_REQUEST_ONLY_KEYS = /* @__PURE__ */ new Set([
 	"password",
 	"generatePassword",
 	"sendVerificationEmail",
@@ -8667,7 +9064,7 @@ function getWritableUserFieldNames(options, mode) {
 */
 function pickWritableUserFields(body, options, mode) {
 	const allowed = getWritableUserFieldNames(options, mode);
-	const skip = new Set([
+	const skip = /* @__PURE__ */ new Set([
 		...DENIED_USER_WRITE_KEYS,
 		...DENIED_SENSITIVE_USER_KEYS,
 		...mode === "create" ? CREATE_REQUEST_ONLY_KEYS : []
@@ -8679,32 +9076,32 @@ function pickWritableUserFields(body, options, mode) {
 	}
 	return result;
 }
-const BaseCreateUserCoreBodySchema = z$1.object({
-	name: z$1.string(),
-	email: z$1.email(),
-	image: z$1.string().optional(),
-	password: z$1.string().optional(),
-	generatePassword: z$1.boolean().optional(),
-	emailVerified: z$1.boolean().optional(),
-	sendVerificationEmail: z$1.boolean().optional(),
-	sendOrganizationInvite: z$1.boolean().optional(),
-	organizationRole: z$1.string().optional(),
-	organizationId: z$1.string().optional()
+const BaseCreateUserCoreBodySchema = z.object({
+	name: z.string(),
+	email: z.email(),
+	image: z.string().optional(),
+	password: z.string().optional(),
+	generatePassword: z.boolean().optional(),
+	emailVerified: z.boolean().optional(),
+	sendVerificationEmail: z.boolean().optional(),
+	sendOrganizationInvite: z.boolean().optional(),
+	organizationRole: z.string().optional(),
+	organizationId: z.string().optional()
 });
-const BaseUpdateUserCoreBodySchema = z$1.object({
-	name: z$1.string().nullable().optional(),
-	email: z$1.email().optional(),
-	image: z$1.string().nullable().optional(),
-	emailVerified: z$1.boolean().optional()
+const BaseUpdateUserCoreBodySchema = z.object({
+	name: z.string().nullable().optional(),
+	email: z.email().optional(),
+	image: z.string().nullable().optional(),
+	emailVerified: z.boolean().optional()
 });
-const CreateUserBodySchema = BaseCreateUserCoreBodySchema.catchall(z$1.unknown());
-const UpdateUserBodySchema = BaseUpdateUserCoreBodySchema.catchall(z$1.unknown());
+const CreateUserBodySchema = BaseCreateUserCoreBodySchema.catchall(z.unknown());
+const UpdateUserBodySchema = BaseUpdateUserCoreBodySchema.catchall(z.unknown());
 function createSchemaForDBField(field) {
 	switch (field.type) {
-		case "number": return field.required ? z$1.coerce.number() : z$1.coerce.number().optional();
-		case "boolean": return field.required ? z$1.coerce.boolean() : z$1.coerce.boolean().optional();
-		case "date": return field.required ? z$1.union([z$1.string().min(1), z$1.coerce.date()]) : z$1.union([z$1.string(), z$1.coerce.date()]).optional();
-		default: return field.required ? z$1.string().min(1) : z$1.string().optional();
+		case "number": return field.required ? z.coerce.number() : z.coerce.number().optional();
+		case "boolean": return field.required ? z.coerce.boolean() : z.coerce.boolean().optional();
+		case "date": return field.required ? z.union([z.string().min(1), z.coerce.date()]) : z.union([z.string(), z.coerce.date()]).optional();
+		default: return field.required ? z.string().min(1) : z.string().optional();
 	}
 }
 /**
@@ -8712,38 +9109,38 @@ function createSchemaForDBField(field) {
 */
 function validateWritableCreateUserFields(data, options) {
 	const shape = {
-		name: z$1.string().min(1),
-		email: z$1.email(),
-		image: z$1.string().optional(),
-		emailVerified: z$1.boolean().optional()
+		name: z.string().min(1),
+		email: z.email(),
+		image: z.string().optional(),
+		emailVerified: z.boolean().optional()
 	};
 	for (const [name, field] of Object.entries(getUserInputFields(options))) {
 		if (!isWritableUserInputField(field)) continue;
 		shape[name] = createSchemaForDBField(field);
 	}
-	const result = z$1.object(shape).strict().safeParse(data);
+	const result = z.object(shape).strict().safeParse(data);
 	if (!result.success) throw result.error;
 }
 /**
 * Ensures at least one field is present on update and validates additional field types.
 */
 function validateWritableUserUpdateFields(data, options) {
-	if (Object.keys(data).length === 0) throw new z$1.ZodError([{
+	if (Object.keys(data).length === 0) throw new z.ZodError([{
 		code: "custom",
 		message: "No valid fields to update",
 		path: []
 	}]);
 	const shape = {
-		name: z$1.string().nullable().optional(),
-		email: z$1.email().optional(),
-		image: z$1.string().nullable().optional(),
-		emailVerified: z$1.boolean().optional()
+		name: z.string().nullable().optional(),
+		email: z.email().optional(),
+		image: z.string().nullable().optional(),
+		emailVerified: z.boolean().optional()
 	};
 	for (const [name, field] of Object.entries(getUserInputFields(options))) {
 		if (!isWritableUserInputField(field)) continue;
 		shape[name] = createSchemaForDBField(field);
 	}
-	const result = z$1.object(shape).partial().strict().safeParse(data);
+	const result = z.object(shape).partial().strict().safeParse(data);
 	if (!result.success) throw result.error;
 }
 //#endregion
@@ -8766,13 +9163,13 @@ function clampUserListOffset(value, fallback = 0) {
 	if (!Number.isFinite(n)) return fallback;
 	return Math.max(0, Math.floor(n));
 }
-const getUsersQuerySchema = z$1.object({
-	limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-	offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-	sortBy: z$1.string().optional(),
-	sortOrder: z$1.enum(["asc", "desc"]).optional(),
-	where: z$1.string().transform(parseWhereClause).optional(),
-	countWhere: z$1.string().transform(parseWhereClause).optional()
+const getUsersQuerySchema = z.object({
+	limit: z.number().or(z.string().transform(Number)).optional(),
+	offset: z.number().or(z.string().transform(Number)).optional(),
+	sortBy: z.string().optional(),
+	sortOrder: z.enum(["asc", "desc"]).optional(),
+	where: z.string().transform(parseWhereClause).optional(),
+	countWhere: z.string().transform(parseWhereClause).optional()
 }).optional();
 const getUsers = (options) => {
 	return createAuthEndpoint("/dash/list-users", {
@@ -8809,7 +9206,7 @@ const getUsers = (options) => {
 			model: "user",
 			where: [{
 				field: "lastActiveAt",
-				value: /* @__PURE__ */ new Date(Date.now() - 1e3 * 60 * 2),
+				value: /* @__PURE__ */ new Date(Date.now() - 12e4),
 				operator: "gte"
 			}]
 		}).catch((e) => {
@@ -8867,7 +9264,7 @@ const exportUsers = (options) => {
 const deleteUser = (options) => {
 	return createAuthEndpoint("/dash/delete-user", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+		use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 	}, async (ctx) => {
 		try {
 			await ctx.context.adapter.delete({
@@ -8886,7 +9283,7 @@ const deleteUser = (options) => {
 const deleteManyUsers = (options) => {
 	return createAuthEndpoint("/dash/delete-many-users", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))]
+		use: [jwtMiddleware(options, z.object({ userIds: z.string().array() }))]
 	}, async (ctx) => {
 		const { userIds } = ctx.context.payload;
 		const deletedUserIds = /* @__PURE__ */ new Set();
@@ -8922,11 +9319,11 @@ const deleteManyUsers = (options) => {
 const impersonateUser = (options) => {
 	return createAuthEndpoint("/dash/impersonate-user", {
 		method: "GET",
-		query: z$1.object({ impersonation_token: z$1.string() }),
-		use: [jwtMiddleware(options, z$1.object({
-			userId: z$1.string(),
+		query: z.object({ impersonation_token: z.string() }),
+		use: [jwtMiddleware(options, z.object({
+			userId: z.string(),
 			redirectUrl: safeUrlSchema,
-			impersonatedBy: z$1.string().optional()
+			impersonatedBy: z.string().optional()
 		}), async (ctx) => {
 			return ctx.query.impersonation_token;
 		})]
@@ -8936,7 +9333,7 @@ const impersonateUser = (options) => {
 		const trustedRedirectUrl = parseTrustedAuthRedirectUrl(ctx, redirectUrl);
 		if (!trustedRedirectUrl) throw ctx.error("BAD_REQUEST", { message: "Invalid redirect URL" });
 		const session = await ctx.context.internalAdapter.createSession(userId, true, {
-			expiresAt: new Date(Date.now() + 1e3 * 60 * 10),
+			expiresAt: new Date(Date.now() + 6e5),
 			impersonatedBy: impersonatedBy || void 0
 		});
 		const user = await ctx.context.internalAdapter.findUserById(userId);
@@ -8951,9 +9348,9 @@ const impersonateUser = (options) => {
 const createUser = (options) => {
 	return createAuthEndpoint("/dash/create-user", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({
-			organizationId: z$1.string().optional(),
-			organizationRole: z$1.string().optional()
+		use: [jwtMiddleware(options, z.object({
+			organizationId: z.string().optional(),
+			organizationRole: z.string().optional()
 		}))],
 		body: CreateUserBodySchema
 	}, async (ctx) => {
@@ -8962,7 +9359,7 @@ const createUser = (options) => {
 		try {
 			validateWritableCreateUserFields(userData, ctx.context.options);
 		} catch (error) {
-			if (error instanceof z$1.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
+			if (error instanceof z.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
 			throw error;
 		}
 		const email = normalizeEmail(userData.email, ctx.context);
@@ -9051,8 +9448,8 @@ const createUser = (options) => {
 const setPassword = (options) => {
 	return createAuthEndpoint("/dash/set-password", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-		body: z$1.object({ password: z$1.string().min(8) })
+		use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
+		body: z.object({ password: z.string().min(8) })
 	}, async (ctx) => {
 		const { userId } = ctx.context.payload;
 		const { password } = ctx.body;
@@ -9073,10 +9470,10 @@ const setPassword = (options) => {
 const unlinkAccount = (options) => {
 	return createAuthEndpoint("/dash/unlink-account", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-		body: z$1.object({
-			providerId: z$1.string(),
-			accountId: z$1.string()
+		use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
+		body: z.object({
+			providerId: z.string(),
+			accountId: z.string()
 		})
 	}, async (ctx) => {
 		const { userId } = ctx.context.payload;
@@ -9094,16 +9491,16 @@ const unlinkAccount = (options) => {
 		return { success: true };
 	});
 };
-const getUserDetailsJwtSchema = z$1.object({
-	userId: z$1.string(),
-	sessionOnly: z$1.boolean().optional(),
-	accountOnly: z$1.boolean().optional()
+const getUserDetailsJwtSchema = z.object({
+	userId: z.string(),
+	sessionOnly: z.boolean().optional(),
+	accountOnly: z.boolean().optional()
 });
 const getUserDetails = (options) => {
 	return createAuthEndpoint("/dash/user", {
 		method: "GET",
 		use: [jwtMiddleware(options, getUserDetailsJwtSchema)],
-		query: z$1.object({ minimal: z$1.boolean().or(z$1.string().transform((val) => val === "true")).optional() }).optional()
+		query: z.object({ minimal: z.boolean().or(z.string().transform((val) => val === "true")).optional() }).optional()
 	}, async (ctx) => {
 		const { userId, sessionOnly, accountOnly } = ctx.context.payload;
 		const minimal = !!ctx.query?.minimal;
@@ -9200,7 +9597,7 @@ const getUserDetails = (options) => {
 const getUserOrganizations = (options) => {
 	return createAuthEndpoint("/dash/user-organizations", {
 		method: "GET",
-		use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+		use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 	}, async (ctx) => {
 		const { userId } = ctx.context.payload;
 		if (!isOrganizationEnabled(ctx)) {
@@ -9245,7 +9642,7 @@ const getUserOrganizations = (options) => {
 };
 const updateUser = (options) => createAuthEndpoint("/dash/update-user", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
 	body: UpdateUserBodySchema
 }, async (ctx) => {
 	const userId = ctx.context.payload?.userId;
@@ -9254,7 +9651,7 @@ const updateUser = (options) => createAuthEndpoint("/dash/update-user", {
 	try {
 		validateWritableUserUpdateFields(updateData, ctx.context.options);
 	} catch (error) {
-		if (error instanceof z$1.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
+		if (error instanceof z.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
 		throw error;
 	}
 	const user = await ctx.context.internalAdapter.updateUser(userId, {
@@ -9340,12 +9737,12 @@ const getUserStats = (options) => createAuthEndpoint("/dash/user-stats", {
 	use: [jwtMiddleware(options)]
 }, async (ctx) => {
 	const now = /* @__PURE__ */ new Date();
-	const oneDayAgo = /* @__PURE__ */ new Date(now.getTime() - 1440 * 60 * 1e3);
-	const twoDaysAgo = /* @__PURE__ */ new Date(now.getTime() - 2880 * 60 * 1e3);
-	const oneWeekAgo = /* @__PURE__ */ new Date(now.getTime() - 10080 * 60 * 1e3);
-	const twoWeeksAgo = /* @__PURE__ */ new Date(now.getTime() - 336 * 60 * 60 * 1e3);
-	const oneMonthAgo = /* @__PURE__ */ new Date(now.getTime() - 720 * 60 * 60 * 1e3);
-	const twoMonthsAgo = /* @__PURE__ */ new Date(now.getTime() - 1440 * 60 * 60 * 1e3);
+	const oneDayAgo = /* @__PURE__ */ new Date(now.getTime() - 864e5);
+	const twoDaysAgo = /* @__PURE__ */ new Date(now.getTime() - 1728e5);
+	const oneWeekAgo = /* @__PURE__ */ new Date(now.getTime() - 6048e5);
+	const twoWeeksAgo = /* @__PURE__ */ new Date(now.getTime() - 12096e5);
+	const oneMonthAgo = /* @__PURE__ */ new Date(now.getTime() - 2592e6);
+	const twoMonthsAgo = /* @__PURE__ */ new Date(now.getTime() - 5184e6);
 	const activityTrackingEnabled = !!options.activityTracking?.enabled;
 	const storeInSecondaryStorageOnly = isSessionInSecondaryStorageOnly(ctx.context);
 	const [rDailySignups, rPrevDaySignups, rWeeklySignups, rPrevWeekSignups, rMonthlySignups, rPrevMonthSignups, rTotalUsers, rActiveDaily, rActivePrevDay, rActiveWeekly, rActivePrevWeek, rActiveMonthly, rActivePrevMonth] = await withConcurrency([
@@ -9480,7 +9877,7 @@ const getUserStats = (options) => createAuthEndpoint("/dash/user-stats", {
 const getUserGraphData = (options) => createAuthEndpoint("/dash/user-graph-data", {
 	method: "GET",
 	use: [jwtMiddleware(options)],
-	query: z$1.object({ period: z$1.enum([
+	query: z.object({ period: z.enum([
 		"daily",
 		"weekly",
 		"monthly"
@@ -9491,7 +9888,7 @@ const getUserGraphData = (options) => createAuthEndpoint("/dash/user-graph-data"
 	const activityTrackingEnabled = !!options.activityTracking?.enabled;
 	const storeInSecondaryStorageOnly = isSessionInSecondaryStorageOnly(ctx.context);
 	const intervals = period === "daily" ? 7 : period === "weekly" ? 8 : 6;
-	const msPerInterval = period === "daily" ? 1440 * 60 * 1e3 : period === "weekly" ? 10080 * 60 * 1e3 : 720 * 60 * 60 * 1e3;
+	const msPerInterval = period === "daily" ? 864e5 : period === "weekly" ? 6048e5 : 2592e6;
 	const intervalData = [];
 	for (let i = intervals - 1; i >= 0; i--) {
 		const endDate = new Date(now.getTime() - i * msPerInterval);
@@ -9552,7 +9949,7 @@ const getUserGraphData = (options) => createAuthEndpoint("/dash/user-graph-data"
 const getUserRetentionData = (options) => createAuthEndpoint("/dash/user-retention-data", {
 	method: "GET",
 	use: [jwtMiddleware(options)],
-	query: z$1.object({ period: z$1.enum([
+	query: z.object({ period: z.enum([
 		"daily",
 		"weekly",
 		"monthly"
@@ -9724,11 +10121,11 @@ const getUserRetentionData = (options) => createAuthEndpoint("/dash/user-retenti
 });
 const banUser = (options) => createAuthEndpoint("/dash/ban-user", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-	body: z$1.object({
-		banReason: z$1.string().optional(),
-		banExpires: z$1.number().optional(),
-		deleteAllSessions: z$1.boolean().optional().default(true)
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
+	body: z.object({
+		banReason: z.string().optional(),
+		banExpires: z.number().optional(),
+		deleteAllSessions: z.boolean().optional().default(true)
 	})
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
@@ -9746,11 +10143,11 @@ const banUser = (options) => createAuthEndpoint("/dash/ban-user", {
 const banManyUsers = (options) => {
 	return createAuthEndpoint("/dash/ban-many-users", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))],
-		body: z$1.object({
-			banReason: z$1.string().optional(),
-			banExpires: z$1.number().optional(),
-			deleteAllSessions: z$1.boolean().optional().default(true)
+		use: [jwtMiddleware(options, z.object({ userIds: z.string().array() }))],
+		body: z.object({
+			banReason: z.string().optional(),
+			banExpires: z.number().optional(),
+			deleteAllSessions: z.boolean().optional().default(true)
 		})
 	}, async (ctx) => {
 		const { userIds } = ctx.context.payload;
@@ -9800,7 +10197,7 @@ const banManyUsers = (options) => {
 };
 const unbanUser = (options) => createAuthEndpoint("/dash/unban-user", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	if (!await ctx.context.internalAdapter.findUserById(userId)) throw new APIError("NOT_FOUND", { message: "User not found" });
@@ -9814,8 +10211,8 @@ const unbanUser = (options) => createAuthEndpoint("/dash/unban-user", {
 });
 const sendVerificationEmail = (options) => createAuthEndpoint("/dash/send-verification-email", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-	body: z$1.object({ callbackUrl: safeUrlSchema })
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
+	body: z.object({ callbackUrl: safeUrlSchema })
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const callbackUrl = requireTrustedAuthCallbackUrl(ctx, ctx.body.callbackUrl);
@@ -9824,20 +10221,21 @@ const sendVerificationEmail = (options) => createAuthEndpoint("/dash/send-verifi
 	if (user.emailVerified) throw ctx.error("BAD_REQUEST", { message: "Email is already verified" });
 	if (!user.email) throw ctx.error("BAD_REQUEST", { message: "User has no associated email address" });
 	if (!ctx.context.options.emailVerification?.sendVerificationEmail) throw ctx.error("BAD_REQUEST", { message: "Email verification is not enabled" });
-	await sendVerificationEmailFn({
+	const modifiedCtx = {
 		...ctx,
 		body: {
 			...ctx.body,
 			callbackURL: callbackUrl
 		}
-	}, user);
+	};
+	await sendVerificationEmailFn(modifiedCtx, user);
 	return { success: true };
 });
 const sendManyVerificationEmails = (options) => {
 	return createAuthEndpoint("/dash/send-many-verification-emails", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))],
-		body: z$1.object({ callbackUrl: safeUrlSchema })
+		use: [jwtMiddleware(options, z.object({ userIds: z.string().array() }))],
+		body: z.object({ callbackUrl: safeUrlSchema })
 	}, async (ctx) => {
 		if (!ctx.context.options.emailVerification?.sendVerificationEmail) throw ctx.error("BAD_REQUEST", { message: "Email verification is not enabled" });
 		const { userIds } = ctx.context.payload;
@@ -9881,9 +10279,10 @@ const sendManyVerificationEmails = (options) => {
 					success: true,
 					id: user.id
 				};
-			}))) if (result.status === "fulfilled") if (result.value.success) sentEmailUserIds.add(result.value.id);
-			else skippedEmailUserIds.add(result.value.id);
-			else for (const { id } of users) skippedEmailUserIds.add(id);
+			}))) if (result.status === "fulfilled") {
+				if (result.value.success) sentEmailUserIds.add(result.value.id);
+				else skippedEmailUserIds.add(result.value.id);
+			} else for (const { id } of users) skippedEmailUserIds.add(id);
 		}, { concurrency: 2 });
 		const end = performance.now();
 		console.log(`Time taken to send verification emails to ${sentEmailUserIds.size} users: ${Math.round((end - start) / 1e3)}s`, skippedEmailUserIds.size > 0 ? `Skipped: ${skippedEmailUserIds.size}` : "");
@@ -9896,8 +10295,8 @@ const sendManyVerificationEmails = (options) => {
 };
 const sendResetPasswordEmail = (options) => createAuthEndpoint("/dash/send-reset-password-email", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-	body: z$1.object({ callbackUrl: safeUrlSchema })
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
+	body: z.object({ callbackUrl: safeUrlSchema })
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const callbackUrl = requireTrustedAuthCallbackUrl(ctx, ctx.body.callbackUrl);
@@ -9910,19 +10309,17 @@ const sendResetPasswordEmail = (options) => createAuthEndpoint("/dash/send-reset
 });
 //#endregion
 //#region src/pow.ts
+/**
+* Proof of Work Challenge System - Client Side
+*
+* Client-side PoW solver and encoding utilities.
+* Server-side challenge generation and verification moved to Infra API.
+*/
 /** Default difficulty in bits (18 = ~500ms solve time) */
 const DEFAULT_DIFFICULTY = 18;
 /** Challenge TTL in seconds */
 const CHALLENGE_TTL = 60;
 /**
-* SHA-256 hash function that works in both Node.js and browser
-*/
-async function sha256(message) {
-	const msgBuffer = new TextEncoder().encode(message);
-	const hashBuffer = await crypto.subtle.digest("SHA-256", msgBuffer);
-	return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-/**
 * Check if a hash has the required number of leading zero bits
 */
 function hasLeadingZeroBits(hash, bits) {
@@ -9942,7 +10339,8 @@ async function solvePoWChallenge(challenge) {
 	const { nonce, difficulty } = challenge;
 	let counter = 0;
 	while (true) {
-		if (hasLeadingZeroBits(await sha256(`${nonce}:${counter}`), difficulty)) return {
+		const input = `${nonce}:${counter}`;
+		if (hasLeadingZeroBits(await hash$1(input), difficulty)) return {
 			nonce,
 			counter
 		};
@@ -9972,7 +10370,8 @@ function encodePoWSolution(solution) {
 * Verify a PoW solution locally (for testing purposes)
 */
 async function verifyPoWSolution(nonce, counter, difficulty) {
-	return hasLeadingZeroBits(await sha256(`${nonce}:${counter}`), difficulty);
+	const input = `${nonce}:${counter}`;
+	return hasLeadingZeroBits(await hash$1(input), difficulty);
 }
 //#endregion
 //#region src/sms.ts
@@ -10167,85 +10566,117 @@ const dash = (options) => {
 					const afterCreateOrganization = organizationHooks.afterCreateOrganization;
 					organizationHooks.afterCreateOrganization = async (...args) => {
 						const [{ organization, user }] = args;
-						trackOrganizationCreated(organization, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationCreated(organization, trigger, location);
 						if (afterCreateOrganization) return afterCreateOrganization(...args);
 					};
 					const afterUpdateOrganization = organizationHooks.afterUpdateOrganization;
 					organizationHooks.afterUpdateOrganization = async (...args) => {
 						const [{ organization, user }] = args;
-						if (organization) trackOrganizationUpdated(organization, getOrganizationTriggerInfo(user), await getRequestLocation());
+						if (organization) {
+							const trigger = getOrganizationTriggerInfo(user);
+							const location = await getRequestLocation();
+							trackOrganizationUpdated(organization, trigger, location);
+						}
 						if (afterUpdateOrganization) return afterUpdateOrganization(...args);
 					};
 					const afterAddMember = organizationHooks.afterAddMember;
 					organizationHooks.afterAddMember = async (...args) => {
 						const [{ organization, member, user }] = args;
-						trackOrganizationMemberAdded(organization, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationMemberAdded(organization, member, user, trigger, location);
 						if (afterAddMember) return afterAddMember(...args);
 					};
 					const afterRemoveMember = organizationHooks.afterRemoveMember;
 					organizationHooks.afterRemoveMember = async (...args) => {
 						const [{ organization, member, user }] = args;
-						trackOrganizationMemberRemoved(organization, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationMemberRemoved(organization, member, user, trigger, location);
 						if (afterRemoveMember) return afterRemoveMember(...args);
 					};
 					const afterUpdateMemberRole = organizationHooks.afterUpdateMemberRole;
 					organizationHooks.afterUpdateMemberRole = async (...args) => {
 						const [{ organization, member, user, previousRole }] = args;
-						trackOrganizationMemberRoleUpdated(organization, member, user, previousRole, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationMemberRoleUpdated(organization, member, user, previousRole, trigger, location);
 						if (afterUpdateMemberRole) return afterUpdateMemberRole(...args);
 					};
 					const afterCreateInvitation = organizationHooks.afterCreateInvitation;
 					organizationHooks.afterCreateInvitation = async (...args) => {
 						const [{ organization, invitation, inviter }] = args;
-						trackOrganizationMemberInvited(organization, invitation, inviter, getOrganizationTriggerInfo(inviter), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(inviter);
+						const location = await getRequestLocation();
+						trackOrganizationMemberInvited(organization, invitation, inviter, trigger, location);
 						if (afterCreateInvitation) return afterCreateInvitation(...args);
 					};
 					const afterAcceptInvitation = organizationHooks.afterAcceptInvitation;
 					organizationHooks.afterAcceptInvitation = async (...args) => {
 						const [{ organization, invitation, member, user }] = args;
-						trackOrganizationMemberInviteAccepted(organization, invitation, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationMemberInviteAccepted(organization, invitation, member, user, trigger, location);
 						if (afterAcceptInvitation) return afterAcceptInvitation(...args);
 					};
 					const afterRejectInvitation = organizationHooks.afterRejectInvitation;
 					organizationHooks.afterRejectInvitation = async (...args) => {
 						const [{ organization, invitation, user }] = args;
-						trackOrganizationMemberInviteRejected(organization, invitation, user, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationMemberInviteRejected(organization, invitation, user, trigger, location);
 						if (afterRejectInvitation) return afterRejectInvitation(...args);
 					};
 					const afterCancelInvitation = organizationHooks.afterCancelInvitation;
 					organizationHooks.afterCancelInvitation = async (...args) => {
 						const [{ organization, invitation, cancelledBy }] = args;
-						trackOrganizationMemberInviteCanceled(organization, invitation, cancelledBy, getOrganizationTriggerInfo(cancelledBy), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(cancelledBy);
+						const location = await getRequestLocation();
+						trackOrganizationMemberInviteCanceled(organization, invitation, cancelledBy, trigger, location);
 						if (afterCancelInvitation) return afterCancelInvitation(...args);
 					};
 					const afterCreateTeam = organizationHooks.afterCreateTeam;
 					organizationHooks.afterCreateTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						trackOrganizationTeamCreated(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationTeamCreated(organization, team, trigger, location);
 						if (afterCreateTeam) return afterCreateTeam(...args);
 					};
 					const afterUpdateTeam = organizationHooks.afterUpdateTeam;
 					organizationHooks.afterUpdateTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						if (team) trackOrganizationTeamUpdated(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
+						if (team) {
+							const trigger = getOrganizationTriggerInfo(user);
+							const location = await getRequestLocation();
+							trackOrganizationTeamUpdated(organization, team, trigger, location);
+						}
 						if (afterUpdateTeam) return afterUpdateTeam(...args);
 					};
 					const afterDeleteTeam = organizationHooks.afterDeleteTeam;
 					organizationHooks.afterDeleteTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						trackOrganizationTeamDeleted(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationTeamDeleted(organization, team, trigger, location);
 						if (afterDeleteTeam) return afterDeleteTeam(...args);
 					};
 					const afterAddTeamMember = organizationHooks.afterAddTeamMember;
 					organizationHooks.afterAddTeamMember = async (...args) => {
 						const [{ organization, team, user, teamMember }] = args;
-						trackOrganizationTeamMemberAdded(organization, team, user, teamMember, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationTeamMemberAdded(organization, team, user, teamMember, trigger, location);
 						if (afterAddTeamMember) return afterAddTeamMember(...args);
 					};
 					const afterRemoveTeamMember = organizationHooks.afterRemoveTeamMember;
 					organizationHooks.afterRemoveTeamMember = async (...args) => {
 						const [{ organization, team, user, teamMember }] = args;
-						trackOrganizationTeamMemberRemoved(organization, team, user, teamMember, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationTeamMemberRemoved(organization, team, user, teamMember, trigger, location);
 						if (afterRemoveTeamMember) return afterRemoveTeamMember(...args);
 					};
 				};
@@ -10368,7 +10799,10 @@ const dash = (options) => {
 								}
 							} else if (matchesAnyRoute(path, [routes.SIGN_OUT])) trackUserSignedOut(enrichedSession, trigger, ctx, location, eventUser);
 							else trackSessionRevoked(enrichedSession, trigger, ctx, location, eventUser);
-							if ("impersonatedBy" in session && session.impersonatedBy) trackUserImpersonationStop(enrichedSession, trigger, ctx, location, eventUser, resolveUserFromContext(session.impersonatedBy, ctx));
+							if ("impersonatedBy" in session && session.impersonatedBy) {
+								const knownImpersonator = resolveUserFromContext(session.impersonatedBy, ctx);
+								trackUserImpersonationStop(enrichedSession, trigger, ctx, location, eventUser, knownImpersonator);
+							}
 						} }
 					},
 					account: {
@@ -10407,14 +10841,16 @@ const dash = (options) => {
 							const ctx = _ctx;
 							if (!ctx) return;
 							const path = ctx.path;
-							const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
+							const maybeUserId = ctx.context.session?.user.id ?? "unknown";
+							const trigger = getTriggerInfo(ctx, maybeUserId);
 							const location = ctx.context.location;
 							if (matchesAnyRoute(path, [routes.REQUEST_PASSWORD_RESET])) trackPasswordResetRequest(verification, trigger, ctx, location);
 						} },
 						delete: { async after(verification, ctx) {
 							if (!ctx) return;
 							const path = ctx.path;
-							const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
+							const maybeUserId = ctx.context.session?.user.id ?? "unknown";
+							const trigger = getTriggerInfo(ctx, maybeUserId);
 							const location = ctx.context.location;
 							if (matchesAnyRoute(path, [routes.RESET_PASSWORD])) trackPasswordResetRequestCompletion(verification, trigger, ctx, location);
 						} }
@@ -10425,18 +10861,7 @@ const dash = (options) => {
 		},
 		hooks: {
 			before: [{
-				matcher: (ctx) => {
-					if (ctx.request?.method !== "GET") return true;
-					return matchesAnyRoute(ctx.path, [
-						routes.SIGN_IN_SOCIAL_CALLBACK,
-						routes.SIGN_IN_OAUTH_CALLBACK,
-						routes.DASH_IMPERSONATE_USER,
-						routes.VERIFY_EMAIL,
-						routes.MAGIC_LINK_VERIFY,
-						routes.DASH_ACCEPT_INVITATION,
-						routes.DASH_COMPLETE_INVITATION_SOCIAL
-					]);
-				},
+				matcher: (ctx) => shouldRunIdentification(ctx, IDENTIFICATION_GET_ROUTES),
 				handler: createIdentificationMiddleware($kv, {
 					skipIdentification: (ctx) => isDashRoute(ctx.path),
 					retry: opts.kvOptions.retry
@@ -10462,25 +10887,19 @@ const dash = (options) => {
 					},
 					handler: createAuthMiddleware(async (_ctx) => {
 						const ctx = _ctx;
-						const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
+						const maybeUserId = ctx.context.session?.user.id ?? "unknown";
+						const trigger = getTriggerInfo(ctx, maybeUserId);
 						if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL, routes.DASH_SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx.context.location);
 						const body = ctx.body;
 						if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger, ctx.context.location);
 						if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger, ctx.context.location);
 						if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]) && ctx.request?.method === "GET" && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger, ctx.context.location);
-						const headerRequestId = ctx.request?.headers.get("X-Request-Id");
-						if (headerRequestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
-							maxAge: 600,
-							sameSite: "lax",
-							httpOnly: true,
-							path: "/"
-						});
-						else if (ctx.context.requestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, "", {
-							maxAge: 0,
-							path: "/"
-						});
 					})
 				},
+				{
+					matcher: (ctx) => shouldRunIdentification(ctx, IDENTIFICATION_GET_ROUTES),
+					handler: createIdentificationCookieAfterMiddleware()
+				},
 				{
 					handler: createAuthMiddleware(async (ctx) => {
 						if (!opts.activityTracking?.enabled) return;