@better-auth/infra 0.2.13 → 0.2.14

package/CHANGELOG.md

@@ -0,0 +1,41 @@
+# Changelog
+
+All notable changes to `@better-auth/infra` are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.2.14] - 2026-06-09
+
+### Added
+
+- **`dashCompleteTwoFactorSetup`** — New dashboard endpoint (`POST /dash/complete-two-factor-setup`) to mark 2FA as enabled after the user verifies their TOTP code, separating "setup started" from "setup complete"
+- **`twoFactorStatus` on user details** — `getUserDetails` now returns `twoFactorStatus: "disabled" | "pending" | "enabled"`, so the dashboard can distinguish users who started but haven't finished 2FA setup.
+
+### Changed
+
+- **Two-factor routes align with Better Auth** — Dashboard 2FA endpoints now respect the two-factor plugin's configuration: custom `twoFactorTable`, TOTP issuer/digits/period, and backup code options.
+- **`enableTwoFactor` behavior** — Orphaned setup records (user started `/two-factor/enable` but never verified) are cleared and replaced instead of returning "already enabled." Only users with `twoFactorEnabled: true` are treated as fully enabled.
+- **Event location coverage** — Tracked events now consistently include location, including: email verification, magic link verification, invitation acceptance, and social invitation completion.
+- **Outbound HTTP clients** — All outbound HTTP clients now send the same `User-Agent` header (`@better-auth/infra v{version}`) for simpler observability.
+
+### Fixed
+
+- **OAuth social sign-in failures** — Failed social login attempts are now correctly attributed to the user.
+
+### Security
+
+- **Timing-safe API key comparison** — JWT middleware now uses constant-time hash comparison when validating API keys.
+
+## [0.2.13] - 2026-06-05
+
+### Changed
+
+- Event tracking now consistently records location data on tracked events.
+
+### Fixed
+
+- Fixed impossible travel security challenges.
+
+[0.2.14]: https://github.com/better-auth/better-auth-infra/compare/@better-auth/infra@0.2.13...@better-auth/infra@0.2.14
+[0.2.13]: https://github.com/better-auth/better-auth-infra/compare/@better-auth/infra@0.2.12...@better-auth/infra@0.2.13

package/dist/client.mjs

@@ -1,5 +1,5 @@
-import "./constants-CvriWQVc.mjs";
-import { n as createKV } from "./fetch-DiAhoiKA.mjs";
+import "./constants-CLYqEwMV.mjs";
+import { n as createKV } from "./fetch-Bl0S3xUi.mjs";
 import { a as resolveSentinelClientIdentifyUrl, i as solvePoWChallenge, l as hash, n as decodePoWChallenge, o as generateRequestId, r as encodePoWSolution, s as identify, t as createPowRetryTimeout, u as dashClient } from "./pow-retry-D2RRftJr.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts

package/dist/{constants-CvriWQVc.mjs → constants-CLYqEwMV.mjs}

@@ -1,4 +1,8 @@
 import { env } from "@better-auth/core/env";
+//#endregion
+//#region src/version.ts
+const PLUGIN_VERSION = "0.2.14";
+//#endregion
 //#region src/constants.ts
 /**
 * Infrastructure API URL
@@ -16,5 +20,7 @@ const KV_TIMEOUT_MS = 1e3;
 * Timeout for API calls HTTP calls (ms)
 */
 const INFRA_API_TIMEOUT_MS = 3e3;
+/** User-Agent for outbound @better-auth/infra HTTP clients. */
+const INFRA_USER_AGENT = `@better-auth/infra v${PLUGIN_VERSION}`;
 //#endregion
-export { KV_TIMEOUT_MS as i, INFRA_API_URL as n, INFRA_KV_URL as r, INFRA_API_TIMEOUT_MS as t };
+export { KV_TIMEOUT_MS as a, INFRA_USER_AGENT as i, INFRA_API_URL as n, PLUGIN_VERSION as o, INFRA_KV_URL as r, INFRA_API_TIMEOUT_MS as t };

package/dist/email.mjs

@@ -1,4 +1,4 @@
-import { n as INFRA_API_URL } from "./constants-CvriWQVc.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CLYqEwMV.mjs";
 import { logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { createFetch } from "@better-fetch/fetch";
@@ -37,7 +37,10 @@ function createEmailSender(config) {
 	if (!apiKey) logger.warn("[Dash] No API key provided for email sending. Set BETTER_AUTH_API_KEY environment variable or pass apiKey in config.");
 	const $api = createFetch({
 		baseURL: apiUrl,
-		headers: { Authorization: `Bearer ${apiKey}` },
+		headers: {
+			"user-agent": INFRA_USER_AGENT,
+			Authorization: `Bearer ${apiKey}`
+		},
 		timeout: config?.apiTimeout ?? 3e3
 	});
 	/**

package/dist/{fetch-DiAhoiKA.mjs → fetch-Bl0S3xUi.mjs}

@@ -1,11 +1,11 @@
-import "./constants-CvriWQVc.mjs";
+import { i as INFRA_USER_AGENT } from "./constants-CLYqEwMV.mjs";
 import { createFetch } from "@better-fetch/fetch";
 //#region src/fetch.ts
 function createAPI(options, fetchOptions) {
 	return createFetch({
 		baseURL: options.apiUrl,
 		headers: {
-			"user-agent": "better-auth",
+			"user-agent": INFRA_USER_AGENT,
 			"x-api-key": options.apiKey
 		},
 		timeout: options.apiTimeout,
@@ -13,7 +13,7 @@ function createAPI(options, fetchOptions) {
 	});
 }
 function createKV(options, fetchOptions) {
-	const headers = { "user-agent": "better-auth" };
+	const headers = { "user-agent": INFRA_USER_AGENT };
 	if (options.apiKey) headers["x-api-key"] = options.apiKey;
 	return createFetch({
 		baseURL: options.kvUrl,

package/dist/index.d.mts

@@ -775,7 +775,7 @@ interface DashIdRow {
   id: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@better-auth+scim@1.6.14+790dbc3a881c5018/node_modules/@better-auth/scim/dist/index.d.mts
+//#region ../../node_modules/.bun/@better-auth+scim@1.6.15+095c64a03bdccbe8/node_modules/@better-auth/scim/dist/index.d.mts
 //#region src/types.d.ts
 interface SCIMProvider {
   id: string;
@@ -4532,6 +4532,7 @@ interface DashTwoFactorTotpViewResponse {
 interface DashTwoFactorBackupCodesResponse {
   backupCodes: string[];
 }
+type DashTwoFactorStatus = "disabled" | "pending" | "enabled";
 //#endregion
 //#region src/routes/users/types.d.ts
 type DashUser = User & {
@@ -4554,6 +4555,7 @@ type DashUserDetailsResponse = DashUser & {
   city?: string | null;
   country?: string | null;
   countryCode?: string | null;
+  twoFactorStatus?: DashTwoFactorStatus;
 };
 type DashUserOrganization = Pick<Organization, "id" | "name" | "slug" | "logo" | "createdAt"> & {
   role: string;
@@ -5591,6 +5593,14 @@ declare const dash: <O extends DashOptions>(options?: O) => {
         };
       }>)[];
     }, DashTwoFactorEnableResponse>;
+    dashCompleteTwoFactorSetup: import("better-call").StrictEndpoint<"/dash/complete-two-factor-setup", {
+      method: "POST";
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        payload: {
+          userId: string;
+        };
+      }>)[];
+    }, DashSuccessResponse>;
     dashViewTwoFactorTotpUri: import("better-call").StrictEndpoint<"/dash/view-two-factor-totp-uri", {
       method: "POST";
       metadata: {
@@ -6001,4 +6011,4 @@ declare const dash: <O extends DashOptions>(options?: O) => {
   } : {};
 };
 //#endregion
-export { type APIError, CHALLENGE_TTL, type CompromisedPasswordResult, type CredentialStuffingResult, type DBField, DEFAULT_DIFFICULTY, type DashAddTeamMemberResponse, type DashBanManyResponse, type DashCheckUserByEmailResponse, type DashCheckUserExistsResponse, type DashCompleteInvitationResponse, type DashConfigResponse, type DashCreateOrganizationBody, type DashCreateOrganizationResponse, type DashCreateTeamResponse, type DashCreateUserResponse, type DashDeleteManyUsersResponse, type DashDirectoryCreateResponse, type DashDirectoryDeleteResponse, type DashDirectoryItem, type DashDirectoryRegenerateTokenResponse, type DashExecuteAdapterCountResponse, type DashExecuteAdapterFindManyResponse, type DashExecuteAdapterFindOneResponse, type DashExecuteAdapterMutationResponse, type DashExecuteAdapterResponse, type DashExportOrganizationsResponse, type DashIdRow, type DashInviteMemberResponse, type DashMaybeSuccessResponse, type DashOptions, type DashOptionsInternal, type DashOptionsResolved, type DashOrganizationAddMemberResponse, type DashOrganizationDeleteManyResponse, type DashOrganizationDetailResponse, type DashOrganizationInvitationItem, type DashOrganizationInvitationListResponse, type DashOrganizationInvitationStatusItem, type DashOrganizationListResponse, type DashOrganizationMember, type DashOrganizationMemberListItem, type DashOrganizationMemberListResponse, type DashOrganizationMemberUser, type DashOrganizationOptionsResponse, type DashOrganizationTeamItem, type DashOrganizationTeamListResponse, type DashOrganizationUpdateMemberRoleResponse, type DashOrganizationUpdateResponse, type DashSendManyVerificationEmailsResponse, type DashSessionRevokeManyResponse, type DashSsoCreateProviderResponse, type DashSsoDeleteResponse, type DashSsoMarkDomainVerifiedResponse, type DashSsoProviderItem, type DashSsoProviderSummary, type DashSsoUpdateProviderResponse, type DashSsoVerificationTokenResponse, type DashSsoVerifyDomainResponse, type DashSuccessResponse, type DashTeam, type DashTeamMember, type DashTeamMemberListResponse, type DashTwoFactorBackupCodesResponse, type DashTwoFactorEnableResponse, type DashTwoFactorTotpViewResponse, type DashUpdateTeamResponse, type DashUpdateUserResponse, type DashUserDetailsResponse, type DashUserGraphDataResponse, type DashUserListResponse, type DashUserOrganizationsResponse, type DashUserRetentionDataResponse, type DashUserStatsActivePeriod, type DashUserStatsResponse, type DashUserStatsSignUpPeriod, type DashValidateResponse, type DirectorySyncConnection, EMAIL_TEMPLATES, type EmailConfig, type EmailTemplateId, type EmailTemplateVariables, type Endpoint, type EndpointOptions, type EventLocation, type EventTypesResponse, type ImpossibleTravelResult, type InfraEndpointContext, type InfraPluginConnectionOptions, type InfraPluginConnectionOptionsInternal, type LocationData, type LocationDataContext, type PoWChallenge, type PoWSolution, type SCIMPlugin, type SMSConfig, type SMSTemplateId, type SMSTemplateVariables, SMS_TEMPLATES, type SecurityEvent, type SecurityEventType, type SecurityOptions, type SecurityVerdict, type SendBulkEmailsOptions, type SendBulkEmailsResult, type SendEmailOptions, type SendEmailResult, type SendSMSOptions, type SendSMSResult, type SentinelOptions, type SentinelOptionsInternal, type StaleUserResult, type ThresholdConfig, USER_EVENT_TYPES, type UserEvent, type UserEventType, type UserEventsResponse, createEmailSender, createSMSSender, dash, decodePoWChallenge, encodePoWSolution, normalizeEmail, sendBulkEmails, sendEmail, sendSMS, sentinel, solvePoWChallenge, verifyPoWSolution };
+export { type APIError, CHALLENGE_TTL, type CompromisedPasswordResult, type CredentialStuffingResult, type DBField, DEFAULT_DIFFICULTY, type DashAddTeamMemberResponse, type DashBanManyResponse, type DashCheckUserByEmailResponse, type DashCheckUserExistsResponse, type DashCompleteInvitationResponse, type DashConfigResponse, type DashCreateOrganizationBody, type DashCreateOrganizationResponse, type DashCreateTeamResponse, type DashCreateUserResponse, type DashDeleteManyUsersResponse, type DashDirectoryCreateResponse, type DashDirectoryDeleteResponse, type DashDirectoryItem, type DashDirectoryRegenerateTokenResponse, type DashExecuteAdapterCountResponse, type DashExecuteAdapterFindManyResponse, type DashExecuteAdapterFindOneResponse, type DashExecuteAdapterMutationResponse, type DashExecuteAdapterResponse, type DashExportOrganizationsResponse, type DashIdRow, type DashInviteMemberResponse, type DashMaybeSuccessResponse, type DashOptions, type DashOptionsInternal, type DashOptionsResolved, type DashOrganizationAddMemberResponse, type DashOrganizationDeleteManyResponse, type DashOrganizationDetailResponse, type DashOrganizationInvitationItem, type DashOrganizationInvitationListResponse, type DashOrganizationInvitationStatusItem, type DashOrganizationListResponse, type DashOrganizationMember, type DashOrganizationMemberListItem, type DashOrganizationMemberListResponse, type DashOrganizationMemberUser, type DashOrganizationOptionsResponse, type DashOrganizationTeamItem, type DashOrganizationTeamListResponse, type DashOrganizationUpdateMemberRoleResponse, type DashOrganizationUpdateResponse, type DashSendManyVerificationEmailsResponse, type DashSessionRevokeManyResponse, type DashSsoCreateProviderResponse, type DashSsoDeleteResponse, type DashSsoMarkDomainVerifiedResponse, type DashSsoProviderItem, type DashSsoProviderSummary, type DashSsoUpdateProviderResponse, type DashSsoVerificationTokenResponse, type DashSsoVerifyDomainResponse, type DashSuccessResponse, type DashTeam, type DashTeamMember, type DashTeamMemberListResponse, type DashTwoFactorBackupCodesResponse, type DashTwoFactorEnableResponse, type DashTwoFactorStatus, type DashTwoFactorTotpViewResponse, type DashUpdateTeamResponse, type DashUpdateUserResponse, type DashUserDetailsResponse, type DashUserGraphDataResponse, type DashUserListResponse, type DashUserOrganizationsResponse, type DashUserRetentionDataResponse, type DashUserStatsActivePeriod, type DashUserStatsResponse, type DashUserStatsSignUpPeriod, type DashValidateResponse, type DirectorySyncConnection, EMAIL_TEMPLATES, type EmailConfig, type EmailTemplateId, type EmailTemplateVariables, type Endpoint, type EndpointOptions, type EventLocation, type EventTypesResponse, type ImpossibleTravelResult, type InfraEndpointContext, type InfraPluginConnectionOptions, type InfraPluginConnectionOptionsInternal, type LocationData, type LocationDataContext, type PoWChallenge, type PoWSolution, type SCIMPlugin, type SMSConfig, type SMSTemplateId, type SMSTemplateVariables, SMS_TEMPLATES, type SecurityEvent, type SecurityEventType, type SecurityOptions, type SecurityVerdict, type SendBulkEmailsOptions, type SendBulkEmailsResult, type SendEmailOptions, type SendEmailResult, type SendSMSOptions, type SendSMSResult, type SentinelOptions, type SentinelOptionsInternal, type StaleUserResult, type ThresholdConfig, USER_EVENT_TYPES, type UserEvent, type UserEventType, type UserEventsResponse, createEmailSender, createSMSSender, dash, decodePoWChallenge, encodePoWSolution, normalizeEmail, sendBulkEmails, sendEmail, sendSMS, sentinel, solvePoWChallenge, verifyPoWSolution };

package/dist/index.mjs

@@ -1,8 +1,8 @@
-import { n as INFRA_API_URL, r as INFRA_KV_URL } from "./constants-CvriWQVc.mjs";
-import { n as createKV, t as createAPI } from "./fetch-DiAhoiKA.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CLYqEwMV.mjs";
+import { n as createKV, t as createAPI } from "./fetch-Bl0S3xUi.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAuthContext } from "@better-auth/core/context";
-import { APIError, generateId, getAuthTables, logger, parseState } from "better-auth";
+import { APIError, generateId, getAuthTables, logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { APIError as APIError$1, createAuthEndpoint, createAuthMiddleware, requestPasswordReset, sendVerificationEmailFn, sessionMiddleware } from "better-auth/api";
 import { createFetch } from "@better-fetch/fetch";
@@ -10,6 +10,8 @@ import { isValidPhoneNumber, parsePhoneNumberFromString } from "libphonenumber-j
 import { createLocalJWKSet, jwtVerify } from "jose";
 import z$1, { z } from "zod";
 import { setSessionCookie } from "better-auth/cookies";
+import { generateRandomString, symmetricEncrypt } from "better-auth/crypto";
+import { createOTP } from "@better-auth/utils/otp";
 //#region src/options.ts
 function resolveConnectionOptions(options) {
 	return {
@@ -66,6 +68,7 @@ const EVENT_TYPES = {
 	USER_IMPERSONATED: "user_impersonated",
 	USER_IMPERSONATED_STOPPED: "user_impersonated_stopped"
 };
+const UNKNOWN_USER = "unknown";
 const routes = {
 	SEND_VERIFICATION_EMAIL: "/send-verification-email",
 	SIGN_IN: "/sign-in",
@@ -106,6 +109,8 @@ const routes = {
 	API_KEY_CREATE: "/api-key/create",
 	LINK_SOCIAL: "/link-social",
 	DASH_ROUTE: "/dash",
+	DASH_ACCEPT_INVITATION: "/dash/accept-invitation",
+	DASH_COMPLETE_INVITATION_SOCIAL: "/dash/complete-invitation-social",
 	DASH_UPDATE_USER: "/dash/update-user",
 	DASH_REVOKE_SESSIONS_ALL: "/dash/sessions/revoke-all",
 	DASH_IMPERSONATE_USER: "/dash/impersonate-user",
@@ -181,34 +186,6 @@ async function getUserById(userId, ctx) {
 	}
 	return user;
 }
-const getUserByIdToken = async (providerId, idToken, ctx) => {
-	const provider = ctx.context.socialProviders.find((p) => p.id === providerId);
-	let user = null;
-	if (provider) try {
-		user = await provider.getUserInfo(idToken);
-	} catch (error) {
-		logger.debug("[Dash] Failed to fetch user info:", error);
-	}
-	return user;
-};
-const getUserByAuthorizationCode = async (providerId, ctx) => {
-	let userInfo = null;
-	const provider = ctx.context.socialProviders.find((p) => p.id === providerId);
-	if (provider) try {
-		const codeVerifier = (await parseState(ctx)).codeVerifier;
-		const { code, device_id } = ctx.query ?? {};
-		const tokens = await provider.validateAuthorizationCode({
-			code,
-			codeVerifier,
-			deviceId: device_id,
-			redirectURI: `${ctx.context.baseURL}/callback/${provider.id}`
-		});
-		userInfo = await provider.getUserInfo({ ...tokens }).then((res) => res?.user);
-	} catch (error) {
-		logger.debug("[Dash] Failed to fetch user info:", error);
-	}
-	return userInfo;
-};
 //#endregion
 //#region src/events/core/events-account.ts
 const initAccountEvents = (tracker) => {
@@ -310,6 +287,7 @@ const routeToRegex = (route) => {
 	return new RegExp(`${pattern}(?:$|[/?])`);
 };
 const matchesAnyRoute = (path, routes) => {
+	if (!path) return false;
 	const cleanPath = stripQuery(path);
 	return routes.some((route) => routeToRegex(route).test(cleanPath));
 };
@@ -345,6 +323,53 @@ const getLoginMethod = (ctx) => {
 	return null;
 };
 //#endregion
+//#region src/events/core/oauth-callback-user.ts
+const OAUTH_CALLBACK_USER = Symbol.for("dash.oauthCallbackUser");
+/**
+* Stash OAuth profile on the request context when better-auth calls getUserInfo
+* during the callback, before the authorization code is consumed.
+*/
+function instrumentSocialProviders(providers) {
+	for (const provider of providers) {
+		const originalGetUserInfo = provider.getUserInfo.bind(provider);
+		provider.getUserInfo = async (token) => {
+			const result = await originalGetUserInfo(token);
+			const user = result?.user;
+			if (user) try {
+				const endpointCtx = await getCurrentAuthContext();
+				endpointCtx.context[OAUTH_CALLBACK_USER] = user;
+			} catch {}
+			return result;
+		};
+	}
+}
+async function resolveOAuthUser(providerId, ctx) {
+	const oauthUser = ctx.context[OAUTH_CALLBACK_USER];
+	if (!oauthUser) return null;
+	const email = oauthUser.email?.toLowerCase();
+	const accountId = oauthUser.id !== void 0 && oauthUser.id !== null ? String(oauthUser.id) : void 0;
+	if (email && accountId) try {
+		const result = await ctx.context.internalAdapter.findOAuthUser(email, accountId, providerId);
+		if (result?.user) return {
+			id: result.user.id,
+			email: result.user.email,
+			name: result.user.name
+		};
+	} catch (error) {
+		logger.debug("[Dash] Failed to find OAuth user:", error);
+	}
+	if (email) {
+		const user = await getUserByEmail(email, ctx);
+		if (user) return user;
+	}
+	if (!email && !oauthUser.name) return null;
+	return {
+		id: UNKNOWN_USER,
+		email: oauthUser.email ?? null,
+		name: oauthUser.name ?? "unknown"
+	};
+}
+//#endregion
 //#region src/events/core/events-session.ts
 const initSessionEvents = (tracker) => {
 	const { trackEvent } = tracker;
@@ -574,19 +599,19 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackSocialSignInAttempt = (ctx, trigger, location) => {
+	const trackSocialSignInFailure = (ctx, providerId, trigger, location) => {
 		const track = async () => {
-			const user = await getUserByIdToken(ctx.body.provider, ctx.body.idToken, ctx);
+			const user = await resolveOAuthUser(providerId, ctx);
 			trackEvent({
-				eventKey: user?.user.id.toString() ?? "unknown",
+				eventKey: user?.id ?? "unknown",
 				eventType: EVENT_TYPES.USER_SIGN_IN_FAILED,
 				eventDisplayName: "User sign-in attempt failed",
 				eventData: {
-					userId: user?.user.id.toString() ?? "unknown",
-					userName: user?.user.name ?? "unknown",
-					userEmail: user?.user.email ?? "unknown",
+					userId: user?.id ?? "unknown",
+					userName: user?.name ?? "unknown",
+					userEmail: user?.email ?? "unknown",
 					loginMethod: getLoginMethod(ctx),
-					triggeredBy: user?.user.id ?? trigger.triggeredBy,
+					triggeredBy: user && user.id !== "unknown" ? user.id : trigger.triggeredBy,
 					triggerContext: trigger.triggerContext
 				},
 				ipAddress: location?.ipAddress,
@@ -597,28 +622,11 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
+	const trackSocialSignInAttempt = (ctx, trigger, location) => {
+		trackSocialSignInFailure(ctx, ctx.body.provider, trigger, location);
+	};
 	const trackSocialSignInRedirectionAttempt = (ctx, trigger, location) => {
-		const track = async () => {
-			const user = await getUserByAuthorizationCode(tryDecode(ctx.params?.id), ctx);
-			trackEvent({
-				eventKey: user?.id.toString() ?? "unknown",
-				eventType: EVENT_TYPES.USER_SIGN_IN_FAILED,
-				eventDisplayName: "User sign-in attempt failed",
-				eventData: {
-					userId: user?.id.toString() ?? "unknown",
-					userName: user?.name ?? "unknown",
-					userEmail: user?.id ?? "unknown",
-					loginMethod: getLoginMethod(ctx),
-					triggeredBy: trigger.triggeredBy,
-					triggerContext: trigger.triggerContext
-				},
-				ipAddress: location?.ipAddress,
-				city: location?.city,
-				country: location?.country,
-				countryCode: location?.countryCode
-			});
-		};
-		ctx.context.runInBackground(track());
+		trackSocialSignInFailure(ctx, tryDecode(ctx.params?.id), trigger, location);
 	};
 	return {
 		trackUserSignedIn,
@@ -1004,23 +1012,22 @@ function createIdentificationMiddleware($kv) {
 		ctx.context.visitorId = visitorId;
 		const ipConfig = ctx.context.options?.advanced?.ipAddress;
 		let location;
+		const requestIp = getClientIpFromRequest(ctx.request, ipConfig?.ipAddressHeaders || null);
+		const requestCountryCode = getCountryCodeFromRequest(ctx.request);
 		if (ipConfig?.disableIpTracking === true) location = void 0;
 		else if (requestId && identification) {
 			const loc = getLocation(identification);
 			location = {
-				ipAddress: identification.ip || void 0,
+				ipAddress: identification.ip || requestIp || void 0,
 				city: loc?.city || void 0,
 				country: loc?.country?.name || void 0,
-				countryCode: loc?.country?.code || void 0
+				countryCode: loc?.country?.code || requestCountryCode || void 0
 			};
-		} else {
-			const ipAddress = getClientIpFromRequest(ctx.request, ipConfig?.ipAddressHeaders || null);
-			if (ipAddress) location = {
-				ipAddress,
-				countryCode: getCountryCodeFromRequest(ctx.request)
-			};
-			else location = void 0;
-		}
+		} else if (requestIp) location = {
+			ipAddress: requestIp,
+			countryCode: requestCountryCode
+		};
+		else location = void 0;
 		ctx.context.location = location;
 		ctx.context.ip = resolveSecurityIp(identification, location);
 		ctx.context.untrustedVisitorId = resolveUntrustedVisitorId(visitorId, ctx.context.ip, headerVisitorId);
@@ -1092,9 +1099,11 @@ function emitEvaluation(ctx, trackEvent, options = {}) {
 	ev.emitted = true;
 	const identification = ctx.context.identification ?? null;
 	const visitorId = ctx.context.visitorId ?? null;
+	const location = ctx.context.location;
 	const path = ctx.path ?? "";
+	const ipAddress = location?.ipAddress || identification?.ip || ctx.context.ip || void 0;
 	trackEvent({
-		eventKey: visitorId || identification?.ip || "unknown",
+		eventKey: visitorId || ipAddress || "unknown",
 		eventType: "security_check",
 		eventDisplayName: ev.outcome === "blocked" ? "Security: blocked" : ev.outcome === "challenged" ? "Security: challenged" : "Security: passed",
 		eventData: {
@@ -1107,10 +1116,10 @@ function emitEvaluation(ctx, trackEvent, options = {}) {
 			userAgent: options.userAgent,
 			details: ev.details
 		},
-		ipAddress: identification?.ip || void 0,
-		city: identification?.location?.city || void 0,
-		country: identification?.location?.country?.name || void 0,
-		countryCode: identification?.location?.country?.code || void 0
+		ipAddress,
+		city: location?.city || identification?.location?.city || void 0,
+		country: location?.country || identification?.location?.country?.name || void 0,
+		countryCode: location?.countryCode || identification?.location?.country?.code || void 0
 	});
 }
 //#endregion
@@ -2774,11 +2783,10 @@ const initTeamEvents = (tracker) => {
 	};
 };
 //#endregion
-//#region src/jwt.ts
+//#region ../utils/dist/crypto/index.mjs
 /**
-* Hash the given value
-* Note: Must match @infra/utils/crypto hash()
-* @param value - The value to hash
+* One-way hash for storage and lookup. Returns hex-encoded digest.
+* Use to verify values without ever storing plaintext.
 */
 async function hash(value) {
 	const data = new TextEncoder().encode(value);
@@ -2786,6 +2794,32 @@ async function hash(value) {
 	const hashArray = new Uint8Array(hashBuffer);
 	return Array.from(hashArray).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+function hexToBytes(hex) {
+	if (hex.length % 2 !== 0) return null;
+	const bytes = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < bytes.length; i++) {
+		const byte = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+		if (Number.isNaN(byte)) return null;
+		bytes[i] = byte;
+	}
+	return bytes;
+}
+function timingSafeEqualBytes(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+	return diff === 0;
+}
+/** Constant-time comparison for hex-encoded digests (e.g. SHA-256 hashes). */
+function timingSafeEqualHash(a, b) {
+	if (a.length !== b.length) return false;
+	const aBytes = hexToBytes(a);
+	const bBytes = hexToBytes(b);
+	if (!aBytes || !bBytes || aBytes.length !== bBytes.length) return false;
+	return timingSafeEqualBytes(aBytes, bBytes);
+}
+//#endregion
+//#region src/jwt.ts
 /**
 * Skip JTI check for JWTs issued within this many seconds.
 * This is safe because replay attacks require time for interception.
@@ -2853,9 +2887,8 @@ const jwtMiddleware = (options, schema, getJWT) => {
 			});
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		const expectedHash = await hash(options.apiKey);
-		if (apiKeyHash !== expectedHash) {
-			ctx.context.logger.warn("[Dash] API key hash is invalid", apiKeyHash, expectedHash);
+		if (!timingSafeEqualHash(apiKeyHash, await hash(options.apiKey))) {
+			ctx.context.logger.warn("[Dash] API key hash mismatch");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
 		if (!isRecentlyIssued(payload)) {
@@ -2908,7 +2941,7 @@ const jwtValidateMiddleware = (options) => {
 			});
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		if (apiKeyHash !== await hash(options.apiKey)) {
+		if (!timingSafeEqualHash(apiKeyHash, await hash(options.apiKey))) {
 			ctx.context.logger.warn("[Dash] API key hash mismatch");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
@@ -2916,9 +2949,6 @@ const jwtValidateMiddleware = (options) => {
 	});
 };
 //#endregion
-//#region src/version.ts
-const PLUGIN_VERSION = "0.2.13";
-//#endregion
 //#region src/routes/auth/config.ts
 const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
 const EXACT_SENSITIVE_STRING_KEYS_LOWER = new Set([...new Set([
@@ -6646,6 +6676,64 @@ const markSsoProviderDomainVerified = (options) => {
 	});
 };
 //#endregion
+//#region src/routes/two-factor/backup-codes.ts
+/** Mirrors better-auth/plugins/two-factor/backup-codes generateBackupCodesFn. */
+function generateBackupCodesPlain(options) {
+	if (options?.customBackupCodesGenerate) return options.customBackupCodesGenerate();
+	const amount = options?.amount ?? 10;
+	const length = options?.length ?? 10;
+	return Array.from({ length: amount }, () => {
+		const code = generateRandomString(length, "a-z", "0-9", "A-Z");
+		return `${code.slice(0, 5)}-${code.slice(5)}`;
+	});
+}
+/** Mirrors better-auth/plugins/two-factor/backup-codes generateBackupCodes. */
+async function generateBackupCodes$1(secret, options) {
+	const backupCodes = generateBackupCodesPlain(options);
+	const json = JSON.stringify(backupCodes);
+	const storeBackupCodes = options?.storeBackupCodes ?? "encrypted";
+	if (storeBackupCodes === "encrypted") return {
+		backupCodes,
+		encryptedBackupCodes: await symmetricEncrypt({
+			key: secret,
+			data: json
+		})
+	};
+	if (typeof storeBackupCodes === "object" && "encrypt" in storeBackupCodes) return {
+		backupCodes,
+		encryptedBackupCodes: await storeBackupCodes.encrypt(json)
+	};
+	return {
+		backupCodes,
+		encryptedBackupCodes: json
+	};
+}
+function resolveBackupCodeOptions(twoFactorPlugin) {
+	return {
+		storeBackupCodes: "encrypted",
+		...twoFactorPlugin?.options?.backupCodeOptions
+	};
+}
+//#endregion
+//#region src/routes/two-factor/two-factor-options.ts
+function resolveTotpIssuer(twoFactorPlugin, appName) {
+	const options = twoFactorPlugin?.options;
+	return (options?.totpOptions)?.issuer ?? options?.issuer ?? appName ?? "BetterAuth";
+}
+function resolveTotpConfig(twoFactorPlugin) {
+	const totpOptions = twoFactorPlugin?.options?.totpOptions;
+	return {
+		digits: totpOptions?.digits ?? 6,
+		period: totpOptions?.period ?? 30
+	};
+}
+function buildTotpUri(params) {
+	return createOTP(params.secret, {
+		digits: params.digits,
+		period: params.period
+	}).url(params.issuer, params.account);
+}
+//#endregion
 //#region src/routes/two-factor/index.ts
 const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor", {
 	method: "POST",
@@ -6654,31 +6742,37 @@ const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
 	if (!twoFactorPlugin) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication plugin is not enabled" });
+	if (twoFactorPlugin.options?.totpOptions?.disable === true) throw new APIError("BAD_REQUEST", {
+		message: "TOTP is not configured",
+		code: "TOTP_NOT_CONFIGURED"
+	});
+	const twoFactorTable = twoFactorPlugin.options?.twoFactorTable ?? "twoFactor";
+	const user = await ctx.context.internalAdapter.findUserById(userId);
+	if (!user) throw new APIError("NOT_FOUND", { message: "User not found" });
+	if (user.twoFactorEnabled === true) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication is already enabled for this user" });
 	if (await ctx.context.adapter.findOne({
-		model: "twoFactor",
+		model: twoFactorTable,
+		where: [{
+			field: "userId",
+			value: userId
+		}]
+	})) await ctx.context.adapter.delete({
+		model: twoFactorTable,
 		where: [{
 			field: "userId",
 			value: userId
 		}]
-	})) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication is already enabled for this user" });
+	});
 	const { generateRandomString, symmetricEncrypt } = await import("better-auth/crypto");
-	const secret = generateRandomString(32, "A-Z");
-	const backupCodeAmount = 10;
-	const backupCodeLength = 10;
-	const backupCodes = [];
-	for (let i = 0; i < backupCodeAmount; i++) backupCodes.push(generateId(backupCodeLength).toUpperCase());
+	const secret = generateRandomString(32);
+	const { backupCodes, encryptedBackupCodes } = await generateBackupCodes$1(ctx.context.secret, resolveBackupCodeOptions(twoFactorPlugin));
 	const encryptedSecret = await symmetricEncrypt({
 		key: ctx.context.secret,
 		data: secret
 	});
-	const encryptedBackupCodes = await symmetricEncrypt({
-		key: ctx.context.secret,
-		data: JSON.stringify(backupCodes)
-	});
 	await ctx.context.adapter.create({
-		model: "twoFactor",
+		model: twoFactorTable,
 		data: {
-			id: generateId(32),
 			userId,
 			secret: encryptedSecret,
 			backupCodes: encryptedBackupCodes
@@ -6688,15 +6782,47 @@ const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor
 		twoFactorEnabled: true,
 		updatedAt: /* @__PURE__ */ new Date()
 	});
-	const user = await ctx.context.internalAdapter.findUserById(userId);
-	const issuer = twoFactorPlugin.options?.issuer || ctx.context.appName || "BetterAuth";
+	const totpConfig = resolveTotpConfig(twoFactorPlugin);
 	return {
 		success: true,
-		totpURI: `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(user?.email || userId)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30`,
+		totpURI: buildTotpUri({
+			secret,
+			issuer: resolveTotpIssuer(twoFactorPlugin, ctx.context.appName),
+			account: user?.email || userId,
+			digits: totpConfig.digits,
+			period: totpConfig.period
+		}),
 		secret,
 		backupCodes
 	};
 });
+const completeTwoFactorSetup = (options) => createAuthEndpoint("/dash/complete-two-factor-setup", {
+	method: "POST",
+	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+}, async (ctx) => {
+	const { userId } = ctx.context.payload;
+	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
+	if (!twoFactorPlugin) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication plugin is not enabled" });
+	const user = await ctx.context.internalAdapter.findUserById(userId);
+	if (!user) throw new APIError("NOT_FOUND", { message: "User not found" });
+	if (user.twoFactorEnabled === true) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication is already enabled for this user" });
+	const twoFactorTable = twoFactorPlugin.options?.twoFactorTable ?? "twoFactor";
+	if (!await ctx.context.adapter.findOne({
+		model: twoFactorTable,
+		where: [{
+			field: "userId",
+			value: userId
+		}]
+	})) throw new APIError("BAD_REQUEST", {
+		message: "Two-factor authentication setup has not been started",
+		code: "TWO_FACTOR_SETUP_NOT_PENDING"
+	});
+	await ctx.context.internalAdapter.updateUser(userId, {
+		twoFactorEnabled: true,
+		updatedAt: /* @__PURE__ */ new Date()
+	});
+	return { success: true };
+});
 const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-factor-totp-uri", {
 	method: "POST",
 	metadata: { scope: "http" },
@@ -6705,8 +6831,13 @@ const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-fac
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
 	if (!twoFactorPlugin) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication plugin is not enabled" });
+	if (twoFactorPlugin.options?.totpOptions?.disable === true) throw new APIError("BAD_REQUEST", {
+		message: "TOTP is not configured",
+		code: "TOTP_NOT_CONFIGURED"
+	});
+	const twoFactorTable = twoFactorPlugin.options?.twoFactorTable ?? "twoFactor";
 	const twoFactorRecord = await ctx.context.adapter.findOne({
-		model: "twoFactor",
+		model: twoFactorTable,
 		where: [{
 			field: "userId",
 			value: userId
@@ -6722,8 +6853,14 @@ const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-fac
 		});
 	} catch {}
 	const user = await ctx.context.internalAdapter.findUserById(userId);
-	const issuer = twoFactorPlugin.options?.issuer || ctx.context.appName || "BetterAuth";
-	return { totpURI: `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(user?.email || userId)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30` };
+	const totpConfig = resolveTotpConfig(twoFactorPlugin);
+	return { totpURI: buildTotpUri({
+		secret,
+		issuer: resolveTotpIssuer(twoFactorPlugin, ctx.context.appName),
+		account: user?.email || userId,
+		digits: totpConfig.digits,
+		period: totpConfig.period
+	}) };
 });
 const viewBackupCodes = (options) => createAuthEndpoint("/dash/view-backup-codes", {
 	method: "POST",
@@ -6736,9 +6873,11 @@ const disableTwoFactor = (options) => createAuthEndpoint("/dash/disable-two-fact
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
-	if (!ctx.context.getPlugin("two-factor")) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication is not enabled" });
+	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
+	if (!twoFactorPlugin) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication is not enabled" });
+	const twoFactorTable = twoFactorPlugin.options?.twoFactorTable ?? "twoFactor";
 	await ctx.context.adapter.delete({
-		model: "twoFactor",
+		model: twoFactorTable,
 		where: [{
 			field: "userId",
 			value: userId
@@ -6755,25 +6894,19 @@ const generateBackupCodes = (options) => createAuthEndpoint("/dash/generate-back
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
+	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
+	const twoFactorTable = twoFactorPlugin?.options?.twoFactorTable ?? "twoFactor";
 	const twoFactorRecord = await ctx.context.adapter.findOne({
-		model: "twoFactor",
+		model: twoFactorTable,
 		where: [{
 			field: "userId",
 			value: userId
 		}]
 	});
 	if (!twoFactorRecord) throw new APIError("NOT_FOUND", { message: "Two-factor authentication not set up for this user" });
-	const backupCodeAmount = 10;
-	const backupCodeLength = 10;
-	const newBackupCodes = [];
-	for (let i = 0; i < backupCodeAmount; i++) newBackupCodes.push(generateId(backupCodeLength).toUpperCase());
-	const { symmetricEncrypt } = await import("better-auth/crypto");
-	const encryptedCodes = await symmetricEncrypt({
-		key: ctx.context.secret,
-		data: JSON.stringify(newBackupCodes)
-	});
+	const { backupCodes: newBackupCodes, encryptedBackupCodes: encryptedCodes } = await generateBackupCodes$1(ctx.context.secret, resolveBackupCodeOptions(twoFactorPlugin));
 	await ctx.context.adapter.update({
-		model: "twoFactor",
+		model: twoFactorTable,
 		where: [{
 			field: "id",
 			value: twoFactorRecord.id
@@ -6783,6 +6916,20 @@ const generateBackupCodes = (options) => createAuthEndpoint("/dash/generate-back
 	return { backupCodes: newBackupCodes };
 });
 //#endregion
+//#region src/routes/two-factor/two-factor-status.ts
+async function resolveTwoFactorStatus(context, userId, user) {
+	if (!hasPlugin(context, "two-factor")) return;
+	if (user.twoFactorEnabled === true) return "enabled";
+	const twoFactorTable = context.getPlugin("two-factor")?.options?.twoFactorTable ?? "twoFactor";
+	return await context.adapter.findOne({
+		model: twoFactorTable,
+		where: [{
+			field: "userId",
+			value: userId
+		}]
+	}) ? "pending" : "disabled";
+}
+//#endregion
 //#region src/routes/users/index.ts
 function parseWhereClause(val) {
 	if (!val) return [];
@@ -7136,6 +7283,7 @@ const getUserDetails = (options) => {
 			} }
 		});
 		if (!user) throw ctx.error("NOT_FOUND", { message: "User not found" });
+		const twoFactorStatus = await resolveTwoFactorStatus(ctx.context, userId, user);
 		if (minimal) return {
 			...user,
 			lastActiveAt: user.lastActiveAt ?? null,
@@ -7143,7 +7291,8 @@ const getUserDetails = (options) => {
 			banReason: hasAdminPlugin ? user.banReason ?? null : null,
 			banExpires: hasAdminPlugin ? user.banExpires ?? null : null,
 			account: [],
-			session: []
+			session: [],
+			twoFactorStatus
 		};
 		const activityTrackingEnabled = !!options.activityTracking?.enabled;
 		const sessions = secondaryStorageOnly ? await ctx.context.internalAdapter.listSessions(userId) : user.session || [];
@@ -7181,7 +7330,8 @@ const getUserDetails = (options) => {
 			lastActiveAt,
 			banned: hasAdminPlugin ? user.banned ?? false : false,
 			banReason: hasAdminPlugin ? user.banReason ?? null : null,
-			banExpires: hasAdminPlugin ? user.banExpires ?? null : null
+			banExpires: hasAdminPlugin ? user.banExpires ?? null : null,
+			twoFactorStatus
 		};
 	});
 };
@@ -7978,7 +8128,10 @@ function createSMSSender(config) {
 	if (!apiKey) logger.warn("[Dash] No API key provided for SMS sending. Set BETTER_AUTH_API_KEY environment variable or pass apiKey in config.");
 	const $api = createFetch({
 		baseURL: apiUrl,
-		headers: { Authorization: `Bearer ${apiKey}` },
+		headers: {
+			"user-agent": INFRA_USER_AGENT,
+			Authorization: `Bearer ${apiKey}`
+		},
 		timeout: config?.apiTimeout ?? 3e3
 	});
 	/**
@@ -8084,6 +8237,7 @@ const dash = (options) => {
 		options: opts,
 		version: PLUGIN_VERSION,
 		init(ctx) {
+			instrumentSocialProviders(ctx.socialProviders);
 			const organizationPlugin = ctx.getPlugin("organization");
 			if (organizationPlugin) {
 				const instrumentOrganizationHooks = (organizationPluginOptions) => {
@@ -8349,11 +8503,14 @@ const dash = (options) => {
 			before: [{
 				matcher: (ctx) => {
 					if (ctx.request?.method !== "GET") return true;
-					const path = new URL(ctx.request.url).pathname;
-					return matchesAnyRoute(path, [
+					return matchesAnyRoute(ctx.path, [
 						routes.SIGN_IN_SOCIAL_CALLBACK,
 						routes.SIGN_IN_OAUTH_CALLBACK,
-						routes.DASH_IMPERSONATE_USER
+						routes.DASH_IMPERSONATE_USER,
+						routes.VERIFY_EMAIL,
+						routes.MAGIC_LINK_VERIFY,
+						routes.DASH_ACCEPT_INVITATION,
+						routes.DASH_COMPLETE_INVITATION_SOCIAL
 					]);
 				},
 				handler: createIdentificationMiddleware($kv)
@@ -8470,6 +8627,7 @@ const dash = (options) => {
 			dashSendManyVerificationEmails: sendManyVerificationEmails(settings),
 			dashSendResetPasswordEmail: sendResetPasswordEmail(settings),
 			dashEnableTwoFactor: enableTwoFactor(settings),
+			dashCompleteTwoFactorSetup: completeTwoFactorSetup(settings),
 			dashViewTwoFactorTotpUri: viewTwoFactorTotpUri(settings),
 			dashViewBackupCodes: viewBackupCodes(settings),
 			dashDisableTwoFactor: disableTwoFactor(settings),

package/dist/native.mjs

@@ -1,5 +1,5 @@
-import "./constants-CvriWQVc.mjs";
-import { n as createKV } from "./fetch-DiAhoiKA.mjs";
+import "./constants-CLYqEwMV.mjs";
+import { n as createKV } from "./fetch-Bl0S3xUi.mjs";
 import { a as resolveSentinelClientIdentifyUrl, c as bytesToHex, i as solvePoWChallenge, n as decodePoWChallenge, r as encodePoWSolution, s as identify, t as createPowRetryTimeout, u as dashClient } from "./pow-retry-D2RRftJr.mjs";
 import { env } from "@better-auth/core/env";
 import { Dimensions, InteractionManager, PixelRatio, Platform } from "react-native";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.2.13",
+  "version": "0.2.14",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
@@ -39,7 +39,8 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "keywords": [
     "better-auth",
@@ -61,13 +62,13 @@
   },
   "homepage": "https://better-auth.com",
   "devDependencies": {
-    "@better-auth/scim": "1.6.14",
-    "@better-auth/sso": "1.6.14",
+    "@better-auth/scim": "1.6.15",
+    "@better-auth/sso": "1.6.15",
     "@infra/mocks": "0.0.0",
     "@infra/utils": "0.0.0",
     "@types/bun": "latest",
     "@types/node": "^24.12.0",
-    "better-auth": "1.6.14",
+    "better-auth": "1.6.15",
     "expo-crypto": "^14.0.2",
     "happy-dom": "^20.9.0",
     "msw": "^2.14.6",
@@ -76,6 +77,7 @@
     "zod": "^4.3.6"
   },
   "dependencies": {
+    "@better-auth/utils": "^0.4.1",
     "@better-fetch/fetch": "^1.1.21",
     "better-call": "^1.3.2",
     "jose": "^6.1.0",