@better-auth/infra 0.2.6 → 0.2.7

package/dist/index.mjs

@@ -1,10 +1,11 @@
-import { n as INFRA_KV_URL, r as KV_TIMEOUT_MS, t as INFRA_API_URL } from "./constants-DdWGfvz1.mjs";
+import { n as INFRA_API_URL, r as INFRA_KV_URL } from "./constants-CvriWQVc.mjs";
+import { n as createKV, t as createAPI } from "./fetch-DiAhoiKA.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { APIError, generateId, getAuthTables, logger, parseState } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { APIError as APIError$1, createAuthEndpoint, createAuthMiddleware, requestPasswordReset, sendVerificationEmailFn, sessionMiddleware } from "better-auth/api";
 import { getCurrentAuthContext } from "@better-auth/core/context";
-import { betterFetch, createFetch } from "@better-fetch/fetch";
+import { createFetch } from "@better-fetch/fetch";
 import { isValidPhoneNumber, parsePhoneNumberFromString } from "libphonenumber-js";
 import { createLocalJWKSet, jwtVerify } from "jose";
 import z$1, { z } from "zod";
@@ -14,7 +15,9 @@ function resolveConnectionOptions(options) {
 	return {
 		apiUrl: options?.apiUrl || INFRA_API_URL,
 		kvUrl: options?.kvUrl || INFRA_KV_URL,
-		apiKey: options?.apiKey || env.BETTER_AUTH_API_KEY || ""
+		apiKey: options?.apiKey || env.BETTER_AUTH_API_KEY || "",
+		apiTimeout: options?.apiTimeout ?? 3e3,
+		kvTimeout: options?.kvTimeout ?? 1e3
 	};
 }
 function resolveDashOptions(options) {
@@ -96,6 +99,8 @@ const routes = {
 	EMAIL_OTP_SEND: "/email-otp/send-verification-otp",
 	PHONE_SEND_OTP: "/phone-number/send-otp",
 	PHONE_VERIFY_OTP: "/phone-number/verify-phone-number",
+	DEVICE_TOKEN: "/device/token",
+	SIWE_VERIFY: "/siwe/verify",
 	ORG_CREATE: "/organization/create",
 	ORG_INVITE_MEMBER: "/organization/invite-member",
 	API_KEY_CREATE: "/api-key/create",
@@ -109,7 +114,8 @@ const routes = {
 	ADMIN_REVOKE_USER_SESSIONS: "/admin/revoke-user-sessions",
 	ADMIN_SET_PASSWORD: "/admin/set-user-password",
 	ADMIN_BAN_USER: "/admin/ban-user",
-	ADMIN_UNBAN_USER: "/admin/unban-user"
+	ADMIN_UNBAN_USER: "/admin/unban-user",
+	ADMIN_IMPERSONATE_USER: "/admin/impersonate-user"
 };
 const ORGANIZATION_EVENT_TYPES = {
 	ORGANIZATION_CREATED: "organization_created",
@@ -308,16 +314,33 @@ const matchesAnyRoute = (path, routes) => {
 };
 //#endregion
 //#region src/events/login-methods.ts
-const loginPaths = [
-	routes.SIGN_IN_SOCIAL_CALLBACK,
-	routes.SIGN_IN_OAUTH_CALLBACK,
-	routes.SIGN_IN_EMAIL,
-	routes.SIGN_IN_SOCIAL,
-	routes.SIGN_IN_EMAIL_OTP,
-	routes.SIGN_UP_EMAIL
+const OAUTH_CALLBACK_PATHS = [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK];
+const PATH_TO_METHOD = [
+	[routes.SIGN_IN_EMAIL, "email"],
+	[routes.SIGN_UP_EMAIL, "email"],
+	[routes.SIGN_IN_USERNAME, "username"],
+	[routes.SIGN_IN_EMAIL_OTP, "email-otp"],
+	[routes.SIGN_IN_SOCIAL, "social"],
+	[routes.SIGN_IN_ANONYMOUS, "anonymous"],
+	[routes.SIGN_IN_PASSKEY, "passkey"],
+	[routes.SIGN_IN_MAGIC_LINK, "magic-link"],
+	[routes.MAGIC_LINK_VERIFY, "magic-link"],
+	[routes.SIGN_IN_SSO, "sso"],
+	[routes.PHONE_VERIFY_OTP, "phone"],
+	[routes.TWO_FACTOR_VERIFY_TOTP, "totp"],
+	[routes.TWO_FACTOR_VERIFY_OTP, "two-factor-otp"],
+	[routes.TWO_FACTOR_VERIFY_BACKUP, "backup-code"],
+	[routes.ADMIN_IMPERSONATE_USER, "impersonation"],
+	[routes.DEVICE_TOKEN, "device-code"],
+	[routes.SIWE_VERIFY, "siwe"]
 ];
 const getLoginMethod = (ctx) => {
-	if (matchesAnyRoute(ctx.path, loginPaths)) return ctx.params?.id ? ctx.params.id : ctx.path.split("/").pop();
+	if (matchesAnyRoute(ctx.path, OAUTH_CALLBACK_PATHS)) {
+		const id = ctx.params?.id;
+		if (typeof id === "string" && id && !id.startsWith(":")) return id;
+		return null;
+	}
+	for (const [path, method] of PATH_TO_METHOD) if (matchesAnyRoute(ctx.path, [path])) return method;
 	return null;
 };
 //#endregion
@@ -812,18 +835,11 @@ const getOrganizationTriggerInfo = (user) => {
 };
 //#endregion
 //#region src/events/index.ts
-const initTrackEvents = (options) => {
-	const $fetch = createFetch({
-		baseURL: options.apiUrl,
-		headers: {
-			"user-agent": "better-auth",
-			"x-api-key": options.apiKey
-		}
-	});
+const initTrackEvents = ($api) => {
 	const trackEvent = (data) => {
 		const track = async () => {
 			try {
-				await $fetch("/events/track", {
+				await $api("/events/track", {
 					method: "POST",
 					body: {
 						eventType: data.eventType,
@@ -874,11 +890,10 @@ function maybeCleanup() {
 /**
 * Fetch identification data from durable-kv by requestId
 */
-async function getIdentification(requestId, apiKey, kvUrl) {
+async function getIdentification(requestId, $kv) {
 	maybeCleanup();
 	const cached = identificationCache.get(requestId);
 	if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) return cached.data;
-	const baseUrl = kvUrl || INFRA_KV_URL;
 	const maxRetries = 3;
 	const retryDelays = [
 		50,
@@ -886,24 +901,20 @@ async function getIdentification(requestId, apiKey, kvUrl) {
 		200
 	];
 	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
-		const response = await fetch(`${baseUrl}/identify/${requestId}`, {
-			method: "GET",
-			headers: { "x-api-key": apiKey },
-			signal: AbortSignal.timeout(KV_TIMEOUT_MS)
-		});
-		if (response.ok) {
-			const data = await response.json();
+		const { data, error } = await $kv(`/identify/${requestId}`, { method: "GET" });
+		if (data && !error) {
 			identificationCache.set(requestId, {
 				data,
 				timestamp: Date.now()
 			});
 			return data;
 		}
-		if (response.status === 404 && attempt < maxRetries) {
+		const status = error?.status;
+		if (status === 404 && attempt < maxRetries) {
 			await new Promise((resolve) => setTimeout(resolve, retryDelays[attempt]));
 			continue;
 		}
-		if (response.status !== 404) identificationCache.set(requestId, {
+		if (status !== 404) identificationCache.set(requestId, {
 			data: null,
 			timestamp: Date.now()
 		});
@@ -931,16 +942,19 @@ function extractIdentificationHeaders(request) {
 	};
 }
 /**
-* Early middleware that loads identification data
+* Early middleware that loads identification data.
+*
+* @param $kv — KV client from {@link createKV} for the same plugin options (one instance per plugin).
 */
-function createIdentificationMiddleware(options) {
+function createIdentificationMiddleware($kv) {
 	return createAuthMiddleware(async (ctx) => {
 		const { visitorId, requestId: headerRequestId } = extractIdentificationHeaders(ctx.request);
 		const requestId = headerRequestId ?? ctx.getCookie("__infra-rid") ?? null;
 		ctx.context.visitorId = visitorId;
 		ctx.context.requestId = requestId;
-		if (requestId) ctx.context.identification = ctx.context.identification ?? await getIdentification(requestId, options.apiKey, options.kvUrl) ?? null;
-		else ctx.context.identification = null;
+		if (requestId) {
+			if (ctx.context.identification === void 0) ctx.context.identification = await getIdentification(requestId, $kv) ?? null;
+		} else ctx.context.identification = null;
 		const ipConfig = ctx.context.options?.advanced?.ipAddress;
 		if (ipConfig?.disableIpTracking === true) {
 			ctx.context.location = void 0;
@@ -1064,23 +1078,19 @@ async function sha1Hash(input) {
 /**
 * Whether Sentinel should normalize emails for deduplication/sign-in consistency.
 * If `emailNormalization` is set, it wins; otherwise legacy behavior uses `emailValidation.enabled`.
-* @internal Not part of the package public API; used by the sentinel plugin and email helpers.
 */
 function isEmailNormalizationEnabled(security) {
 	const explicit = security?.emailNormalization;
 	if (explicit !== void 0) return explicit.enabled !== false;
 	return security?.emailValidation?.enabled !== false;
 }
-function createSecurityClient(apiUrl, apiKey, options, onSecurityEvent) {
-	const resolvedApiUrl = apiUrl || INFRA_API_URL;
-	const $api = createFetch({
-		baseURL: resolvedApiUrl,
-		headers: { "x-api-key": apiKey },
-		throw: true
-	});
+/**
+* @param $api — Dash client from `createAPI(opts, { throw: true })`.
+*/
+function createSecurityClient(conn, $api, options, onSecurityEvent) {
 	const emailSender = createEmailSender({
-		apiUrl: resolvedApiUrl,
-		apiKey
+		apiUrl: conn.apiUrl || INFRA_API_URL,
+		apiKey: conn.apiKey
 	});
 	function logEvent(event) {
 		const fullEvent = {
@@ -1485,7 +1495,9 @@ const all = new Set([
 	"/forget-password",
 	"/request-password-reset",
 	"/send-verification-email",
-	"/change-email"
+	"/change-email",
+	"/organization/invite-member",
+	"/dash/organization/invite-member"
 ]);
 /**
 * Path is one of `[
@@ -1502,7 +1514,9 @@ const all = new Set([
 *   '/forget-password',
 *   '/request-password-reset',
 *   '/send-verification-email',
-*   '/change-email'
+*   '/change-email',
+*   '/organization/invite-member',
+*   '/dash/organization/invite-member'
 * ]`.
 * @param context Request context
 * @param context.path Request path
@@ -1560,17 +1574,11 @@ function normalizeEmail(email, context) {
 	if (GMAIL_LIKE_DOMAINS.has(domain)) localPart = localPart.replace(/\./g, "");
 	return `${localPart}@${domain}`;
 }
-function createEmailValidator(options = {}) {
-	const { apiKey = "", apiUrl = INFRA_API_URL, kvUrl = INFRA_KV_URL, emailValidationOptions = {} } = options;
-	const $api = createFetch({
-		baseURL: apiUrl,
-		headers: { "x-api-key": apiKey }
-	});
-	const $kv = createFetch({
-		baseURL: kvUrl,
-		headers: { "x-api-key": apiKey },
-		timeout: KV_TIMEOUT_MS
-	});
+function hasRemoteEmailClients(options) {
+	return options.$api !== void 0 && options.$kv !== void 0;
+}
+function createEmailValidator(options) {
+	const { $api, $kv, emailValidationOptions = {} } = options;
 	/**
 	* Fetch and resolve email validity policy from API with caching
 	* Sends client config to API which merges with user's dashboard settings
@@ -1744,18 +1752,10 @@ function createEmailValidationHook(validator, trackEvent) {
 *
 * @example
 * // API-backed validation
-* createEmailHooks({ useApi: true, apiKey: "your-api-key" })
-*
-* @example
-* // High strictness + API
-* createEmailHooks({
-*   emailValidationOptions: { strictness: "high" },
-*   useApi: true,
-*   apiKey: "your-api-key",
-* })
+* createEmailHooks({ $api, $kv })
 */
 function createEmailHooks(options = {}) {
-	const { emailValidationOptions, emailNormalizationOptions, useApi = false, apiKey = "", apiUrl = INFRA_API_URL, kvUrl = INFRA_KV_URL, trackEvent } = options;
+	const { emailValidationOptions, emailNormalizationOptions, trackEvent } = options;
 	const emailConfig = {
 		enabled: true,
 		strictness: "medium",
@@ -1765,10 +1765,9 @@ function createEmailHooks(options = {}) {
 	return { before: [...isEmailNormalizationEnabled({
 		emailValidation: emailValidationOptions,
 		emailNormalization: emailNormalizationOptions
-	}) ? [createEmailNormalizationHook()] : [], ...emailConfig.enabled ? [createEmailValidationHook(useApi ? createEmailValidator({
-		apiUrl,
-		kvUrl,
-		apiKey,
+	}) ? [createEmailNormalizationHook()] : [], ...emailConfig.enabled ? [createEmailValidationHook(hasRemoteEmailClients(options) ? createEmailValidator({
+		$api: options.$api,
+		$kv: options.$kv,
 		emailValidationOptions: emailConfig
 	}) : void 0, trackEvent)] : []] };
 }
@@ -2050,10 +2049,13 @@ async function runSecurityChecks(hookCtx, checkCtx, securityService, trackEvent,
 //#region src/sentinel/sentinel.ts
 const sentinel = (options) => {
 	const opts = resolveSentinelOptions(options);
-	const { tracker } = initTrackEvents(opts);
+	const $api = createAPI(opts);
+	const $apiThrowing = createAPI(opts, { throw: true });
+	const $kv = createKV(opts);
+	const { tracker } = initTrackEvents($api);
 	const { trackEvent } = tracker;
 	if (!opts.apiKey) logger.warn("[Sentinel] Missing BETTER_AUTH_API_KEY. Security checks may fall back to allow mode when the Infra API rejects requests.");
-	const securityService = createSecurityClient(opts.apiUrl, opts.apiKey, opts.security || {}, (event) => {
+	const securityService = createSecurityClient(opts, $apiThrowing, opts.security || {}, (event) => {
 		trackEvent({
 			eventKey: event.visitorId || event.userId || "unknown",
 			eventType: "security_signal",
@@ -2072,11 +2074,11 @@ const sentinel = (options) => {
 	const emailHooks = createEmailHooks({
 		emailValidationOptions: opts.security?.emailValidation,
 		emailNormalizationOptions: opts.security?.emailNormalization,
-		useApi: !!opts.apiKey,
-		apiKey: opts.apiKey,
-		apiUrl: opts.apiUrl,
-		kvUrl: opts.kvUrl,
-		trackEvent
+		trackEvent,
+		...opts.apiKey ? {
+			$api,
+			$kv
+		} : {}
 	});
 	return {
 		id: "sentinel",
@@ -2209,7 +2211,7 @@ const sentinel = (options) => {
 			before: [
 				{
 					matcher: (ctx) => ctx.request?.method !== "GET",
-					handler: createIdentificationMiddleware(opts)
+					handler: createIdentificationMiddleware($kv)
 				},
 				{
 					matcher: (ctx) => ctx.request?.method !== "GET",
@@ -2655,32 +2657,32 @@ const JTI_CHECK_GRACE_PERIOD_SECONDS = 30;
 const JWKS_CACHE_TTL_MS = 900 * 1e3;
 const jwksCache = /* @__PURE__ */ new Map();
 const inflightRequests = /* @__PURE__ */ new Map();
-async function fetchJWKS(ctx, apiUrl) {
-	const { data, error } = await betterFetch(`${apiUrl}/api/auth/jwks`);
+async function fetchJWKS(ctx, cacheKey, $api) {
+	const { data, error } = await $api("/api/auth/jwks");
 	if (error || !data) {
 		ctx.context.logger.warn("[Dash] Failed to fetch JWKS", error);
-		throw new APIError$1("UNAUTHORIZED", { message: "Invalid API key" });
+		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 	}
-	jwksCache.set(apiUrl, {
+	jwksCache.set(cacheKey, {
 		data,
 		expiresAt: Date.now() + JWKS_CACHE_TTL_MS
 	});
 	return createLocalJWKSet(data);
 }
-async function prefetchJWKS(ctx, apiUrl) {
-	const fetchPromise = fetchJWKS(ctx, apiUrl);
-	inflightRequests.set(apiUrl, fetchPromise);
-	fetchPromise.finally(() => inflightRequests.delete(apiUrl));
+async function prefetchJWKS(ctx, cacheKey, $api) {
+	const fetchPromise = fetchJWKS(ctx, cacheKey, $api);
+	inflightRequests.set(cacheKey, fetchPromise);
+	fetchPromise.finally(() => inflightRequests.delete(cacheKey));
 	return fetchPromise;
 }
-async function getJWKs(ctx, apiUrl) {
-	const cached = jwksCache.get(apiUrl);
+async function getJWKs(ctx, cacheKey, $api) {
+	const cached = jwksCache.get(cacheKey);
 	if (cached && Date.now() < cached.expiresAt) return createLocalJWKSet(cached.data);
 	if (cached) {
-		if (!inflightRequests.has(apiUrl)) prefetchJWKS(ctx, apiUrl);
+		if (!inflightRequests.has(cacheKey)) prefetchJWKS(ctx, cacheKey, $api);
 		return createLocalJWKSet(cached.data);
 	}
-	return inflightRequests.get(apiUrl) ?? prefetchJWKS(ctx, apiUrl);
+	return inflightRequests.get(cacheKey) ?? prefetchJWKS(ctx, cacheKey, $api);
 }
 /**
 * Check if JWT is recently issued and can skip JTI verification.
@@ -2692,86 +2694,92 @@ function isRecentlyIssued(payload) {
 	const issuedAt = payload.iat * 1e3;
 	return Date.now() - issuedAt < JTI_CHECK_GRACE_PERIOD_SECONDS * 1e3;
 }
-const jwtMiddleware = (options, schema, getJWT) => createAuthMiddleware(async (ctx) => {
-	const jwsFromHeader = getJWT ? await getJWT(ctx) : ctx.headers?.get("Authorization")?.split(" ")[1];
-	if (!jwsFromHeader) {
-		ctx.context.logger.warn("[Dash] JWT is missing from header");
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	}
-	const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(ctx, options.apiUrl), { maxTokenAge: "5m" }).catch((e) => {
-		ctx.context.logger.warn("[Dash] JWT verification failed:", e);
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	});
-	if (!isRecentlyIssued(payload)) {
-		const { error, data } = await betterFetch("/api/auth/check-jti", {
-			baseURL: options.apiUrl,
-			method: "POST",
-			headers: { "x-api-key": options.apiKey },
-			body: {
-				jti: payload.jti,
-				expiresAt: payload.exp
-			}
-		});
-		if (error || !data?.valid) {
-			ctx.context.logger.warn("[Dash] JTI check failed with error", error, data?.valid);
+const jwtMiddleware = (options, schema, getJWT) => {
+	const { $api } = options;
+	const cacheKey = options.apiUrl;
+	return createAuthMiddleware(async (ctx) => {
+		const jwsFromHeader = getJWT ? await getJWT(ctx) : ctx.headers?.get("Authorization")?.split(" ")[1];
+		if (!jwsFromHeader) {
+			ctx.context.logger.warn("[Dash] JWT is missing from header");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-	}
-	const apiKeyHash = payload.apiKeyHash;
-	if (typeof apiKeyHash !== "string" || !options.apiKey) {
-		ctx.context.logger.warn("[Dash] API key hash is missing or invalid", {
-			apiKeyHash,
-			apiKey: options.apiKey ? "present" : "missing"
+		const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(ctx, cacheKey, $api), { maxTokenAge: "5m" }).catch((e) => {
+			ctx.context.logger.warn("[Dash] JWT verification failed:", e);
+			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		});
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	}
-	const expectedHash = await hash(options.apiKey);
-	if (apiKeyHash !== expectedHash) {
-		ctx.context.logger.warn("[Dash] API key hash is invalid", apiKeyHash, expectedHash);
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	}
-	if (schema) {
-		const parsed = schema.safeParse(payload);
-		if (!parsed.success) {
-			ctx.context.logger.warn("[Dash] JWT payload is invalid", parsed.error);
+		const apiKeyHash = payload.apiKeyHash;
+		if (typeof apiKeyHash !== "string" || !options.apiKey) {
+			ctx.context.logger.warn("[Dash] API key hash is missing or invalid", {
+				apiKeyHash,
+				apiKey: options.apiKey ? "present" : "missing"
+			});
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		return { payload: parsed.data };
-	}
-	return { payload };
-});
+		const expectedHash = await hash(options.apiKey);
+		if (apiKeyHash !== expectedHash) {
+			ctx.context.logger.warn("[Dash] API key hash is invalid", apiKeyHash, expectedHash);
+			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+		}
+		if (!isRecentlyIssued(payload)) {
+			const { error, data } = await $api("/api/auth/check-jti", {
+				method: "POST",
+				body: {
+					jti: payload.jti,
+					expiresAt: payload.exp
+				}
+			});
+			if (error || !data?.valid) {
+				ctx.context.logger.warn("[Dash] JTI check failed with error", error, data?.valid);
+				throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+			}
+		}
+		if (schema) {
+			const parsed = schema.safeParse(payload);
+			if (!parsed.success) {
+				ctx.context.logger.warn("[Dash] JWT payload is invalid", parsed.error);
+				throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+			}
+			return { payload: parsed.data };
+		}
+		return { payload };
+	});
+};
 /**
 * Lightweight JWT middleware for /dash/validate. Verifies JWT signature and
 * apiKeyHash only—no JTI check. Used during onboarding when the org doesn't
 * exist yet.
 */
-const jwtValidateMiddleware = (options) => createAuthMiddleware(async (ctx) => {
-	const jwsFromHeader = ctx.headers?.get("Authorization")?.split(" ")[1];
-	if (!jwsFromHeader) {
-		ctx.context.logger.warn("[Dash] JWT is missing from header");
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	}
-	const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(ctx, options.apiUrl), { maxTokenAge: "5m" }).catch((e) => {
-		ctx.context.logger.error("[Dash] JWT verification failed:", e);
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	});
-	const apiKeyHash = payload.apiKeyHash;
-	if (typeof apiKeyHash !== "string" || !options.apiKey) {
-		ctx.context.logger.warn("[Dash] API key hash is missing or invalid", {
-			apiKeyHash: typeof apiKeyHash,
-			apiKey: options.apiKey ? "present" : "missing"
+const jwtValidateMiddleware = (options) => {
+	const { $api } = options;
+	const cacheKey = options.apiUrl;
+	return createAuthMiddleware(async (ctx) => {
+		const jwsFromHeader = ctx.headers?.get("Authorization")?.split(" ")[1];
+		if (!jwsFromHeader) {
+			ctx.context.logger.warn("[Dash] JWT is missing from header");
+			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+		}
+		const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(ctx, cacheKey, $api), { maxTokenAge: "5m" }).catch((e) => {
+			ctx.context.logger.error("[Dash] JWT verification failed:", e);
+			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		});
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	}
-	if (apiKeyHash !== await hash(options.apiKey)) {
-		ctx.context.logger.warn("[Dash] API key hash mismatch");
-		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	}
-	return { payload };
-});
+		const apiKeyHash = payload.apiKeyHash;
+		if (typeof apiKeyHash !== "string" || !options.apiKey) {
+			ctx.context.logger.warn("[Dash] API key hash is missing or invalid", {
+				apiKeyHash: typeof apiKeyHash,
+				apiKey: options.apiKey ? "present" : "missing"
+			});
+			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+		}
+		if (apiKeyHash !== await hash(options.apiKey)) {
+			ctx.context.logger.warn("[Dash] API key hash mismatch");
+			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+		}
+		return { payload };
+	});
+};
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.2.6";
+const PLUGIN_VERSION = "0.2.7";
 //#endregion
 //#region src/routes/auth/config.ts
 const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
@@ -3257,10 +3265,7 @@ function transformEvent(raw) {
 * ```
 */
 const getUserEvents = (options) => {
-	const $fetch = createFetch({
-		baseURL: options.apiUrl,
-		headers: { "x-api-key": options.apiKey }
-	});
+	const { $api } = options;
 	return createAuthEndpoint("/events/list", {
 		method: "GET",
 		use: [sessionMiddleware],
@@ -3279,7 +3284,7 @@ const getUserEvents = (options) => {
 		const requestedLimit = ctx.query?.limit ?? 50;
 		const limit = Math.min(Math.max(1, requestedLimit), 100);
 		const offset = Math.max(0, ctx.query?.offset ?? 0);
-		const { data, error } = await $fetch("/events/user", {
+		const { data, error } = await $api("/events/user", {
 			method: "GET",
 			query: {
 				userId: session.user.id,
@@ -3329,10 +3334,7 @@ const getEventTypes = (options) => {
 *   results to the resolved user/identifier.
 */
 const getAuditLogs = (options) => {
-	const $fetch = createFetch({
-		baseURL: options.apiUrl,
-		headers: { "x-api-key": options.apiKey }
-	});
+	const { $api } = options;
 	return createAuthEndpoint("/events/audit-logs", {
 		method: "GET",
 		use: [sessionMiddleware],
@@ -3364,7 +3366,7 @@ const getAuditLogs = (options) => {
 			if (!(sessionData.session?.activeOrganizationId === organizationId) && (!Array.isArray(sessionOrganizations) || !sessionOrganizations.some((org) => {
 				return org.id === organizationId;
 			}))) throw ctx.error("FORBIDDEN", { message: "Not allowed to access this organization" });
-			const { data, error } = await $fetch("/events/organization", {
+			const { data, error } = await $api("/events/organization", {
 				method: "GET",
 				query: {
 					organizationId,
@@ -3381,7 +3383,7 @@ const getAuditLogs = (options) => {
 			responseLimit = data.limit;
 			responseOffset = data.offset;
 		} else {
-			const { data, error } = await $fetch("/events/user", {
+			const { data, error } = await $api("/events/user", {
 				method: "GET",
 				query: {
 					userId: resolvedUserId,
@@ -3428,10 +3430,7 @@ function isOwnerOrAdminRole(role) {
 * @returns
 */
 const getAllAuditLogs = (options) => {
-	const $fetch = createFetch({
-		baseURL: options.apiUrl,
-		headers: { "x-api-key": options.apiKey }
-	});
+	const { $api } = options;
 	const getUserOrganizationRole = async (adapter, orgId, userId) => {
 		return (await adapter.findOne({
 			model: "member",
@@ -3508,7 +3507,7 @@ const getAllAuditLogs = (options) => {
 		const identifierFilter = query.identifier?.trim();
 		if (eventTypeFilter) apiQuery.eventType = eventTypeFilter;
 		if (identifierFilter) apiQuery.identifier = identifierFilter;
-		const { data, error } = await $fetch("/events/activity", {
+		const { data, error } = await $api("/events/activity", {
 			method: "GET",
 			query: apiQuery
 		});
@@ -3628,10 +3627,7 @@ const executeAdapter = (options) => {
 * It creates the user in the auth database and sets up a session.
 */
 const acceptInvitation = (options) => {
-	const $api = createFetch({
-		baseURL: options.apiUrl || INFRA_API_URL,
-		headers: { "x-api-key": options.apiKey }
-	});
+	const { $api } = options;
 	return createAuthEndpoint("/dash/accept-invitation", {
 		method: "GET",
 		query: z$1.object({ token: z$1.string() })
@@ -3711,10 +3707,7 @@ const acceptInvitation = (options) => {
 * This creates the user in the auth database and sets up a session
 */
 const completeInvitation = (options) => {
-	const $api = createFetch({
-		baseURL: options.apiUrl || INFRA_API_URL,
-		headers: { "x-api-key": options.apiKey }
-	});
+	const { $api } = options;
 	return createAuthEndpoint("/dash/complete-invitation", {
 		method: "POST",
 		body: z$1.object({
@@ -7541,6 +7534,11 @@ function createSMSSender(config) {
 	const apiUrl = baseUrl.endsWith("/api") ? baseUrl : `${baseUrl}/api`;
 	const apiKey = config?.apiKey || env.BETTER_AUTH_API_KEY || "";
 	if (!apiKey) logger.warn("[Dash] No API key provided for SMS sending. Set BETTER_AUTH_API_KEY environment variable or pass apiKey in config.");
+	const $api = createFetch({
+		baseURL: apiUrl,
+		headers: { Authorization: `Bearer ${apiKey}` },
+		timeout: config?.apiTimeout ?? 3e3
+	});
 	/**
 	* Send an SMS with OTP code
 	*/
@@ -7550,25 +7548,25 @@ function createSMSSender(config) {
 			error: "API key not configured"
 		};
 		try {
-			const response = await fetch(`${apiUrl}/v1/sms/send`, {
+			const { data, error } = await $api("/v1/sms/send", {
 				method: "POST",
-				headers: {
-					"Content-Type": "application/json",
-					Authorization: `Bearer ${apiKey}`
-				},
-				body: JSON.stringify({
+				body: {
 					to: options.to,
 					code: options.code,
 					template: options.template
-				})
+				}
 			});
-			if (!response.ok) return {
+			if (error) return {
 				success: false,
-				error: (await response.json().catch(() => ({ message: "Unknown error" }))).message || `HTTP ${response.status}`
+				error: error.message || `HTTP ${error.status}`
+			};
+			if (typeof data !== "object" || data === null || Array.isArray(data)) return {
+				success: false,
+				error: "Failed to parse JSON"
 			};
 			return {
 				success: true,
-				messageId: (await response.json()).messageId
+				messageId: data.messageId
 			};
 		} catch (error) {
 			logger.warn("[Dash] SMS send failed:", error);
@@ -7616,8 +7614,14 @@ async function sendSMS(options, config) {
 const dash = (options) => {
 	const processedBulkOperationContexts = /* @__PURE__ */ new WeakSet();
 	const opts = resolveDashOptions(options);
+	const $api = createAPI(opts);
+	const settings = {
+		...opts,
+		$api
+	};
+	const $kv = createKV(opts);
 	const activityUpdateInterval = opts.activityTracking?.updateInterval ?? 3e5;
-	const { tracker } = initTrackEvents(opts);
+	const { tracker } = initTrackEvents($api);
 	const { trackUserSignedUp, trackUserProfileUpdated, trackUserProfileImageUpdated, trackUserEmailVerified, trackUserBanned, trackUserUnBanned, trackUserDeleted } = initUserEvents(tracker);
 	const { trackEmailVerificationSent, trackEmailSignInAttempt, trackUserSignedIn, trackUserSignedOut, trackSessionCreated, trackSocialSignInAttempt, trackSocialSignInRedirectionAttempt, trackUserImpersonated, trackUserImpersonationStop, trackSessionRevoked, trackSessionRevokedAll } = initSessionEvents(tracker);
 	const { trackAccountLinking, trackAccountUnlink, trackAccountPasswordChange } = initAccountEvents(tracker);
@@ -7899,7 +7903,7 @@ const dash = (options) => {
 					const path = new URL(ctx.request.url).pathname;
 					return matchesAnyRoute(path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]);
 				},
-				handler: createIdentificationMiddleware(opts)
+				handler: createIdentificationMiddleware($kv)
 			}],
 			after: [{
 				matcher: (ctx) => {
@@ -7914,7 +7918,7 @@ const dash = (options) => {
 					const body = ctx.body;
 					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger);
 					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger);
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK]) && ctx.context.returned instanceof Error) trackSocialSignInRedirectionAttempt(ctx, trigger);
+					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK]) && ctx.request?.method === "GET" && ctx.context.returned instanceof Error && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger);
 					const headerRequestId = ctx.request?.headers.get("X-Request-Id");
 					if (headerRequestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
 						maxAge: 600,
@@ -7952,79 +7956,79 @@ const dash = (options) => {
 			}]
 		},
 		endpoints: {
-			getDashConfig: getConfig(opts),
-			getDashValidate: getValidate(opts),
-			getDashUsers: getUsers(opts),
-			exportDashUsers: exportUsers(opts),
-			createDashUser: createUser(opts),
-			deleteDashUser: deleteUser(opts),
-			deleteManyDashUsers: deleteManyUsers(opts),
-			listDashOrganizations: listOrganizations(opts),
-			exportDashOrganizations: exportOrganizations(opts),
-			getDashOrganization: getOrganization(opts),
-			listDashOrganizationMembers: listOrganizationMembers(opts),
-			listDashOrganizationInvitations: listOrganizationInvitations(opts),
-			listDashOrganizationTeams: listOrganizationTeams(opts),
-			listDashOrganizationSsoProviders: listOrganizationSsoProviders(opts),
-			createDashSsoProvider: createSsoProvider(opts),
-			updateDashSsoProvider: updateSsoProvider(opts),
-			requestDashSsoVerificationToken: requestSsoVerificationToken(opts),
-			verifyDashSsoProviderDomain: verifySsoProviderDomain(opts),
-			deleteDashSsoProvider: deleteSsoProvider(opts),
-			markDashSsoProviderDomainVerified: markSsoProviderDomainVerified(opts),
-			listDashTeamMembers: listTeamMembers(opts),
-			createDashOrganization: createOrganization(opts),
-			deleteDashOrganization: deleteOrganization(opts),
-			deleteManyDashOrganizations: deleteManyOrganizations(opts),
-			getDashOrganizationOptions: getOrganizationOptions(opts),
-			getDashUser: getUserDetails(opts),
-			getDashUserOrganizations: getUserOrganizations(opts),
-			updateDashUser: updateUser(opts),
-			setDashPassword: setPassword(opts),
-			unlinkDashAccount: unlinkAccount(opts),
-			dashRevokeSession: revokeSession(opts),
-			dashRevokeAllSessions: revokeAllSessions(opts),
-			dashRevokeManySessions: revokeManySessions(opts),
-			dashImpersonateUser: impersonateUser(opts),
-			updateDashOrganization: updateOrganization(opts),
-			createDashTeam: createTeam(opts),
-			updateDashTeam: updateTeam(opts),
-			deleteDashTeam: deleteTeam(opts),
-			addDashTeamMember: addTeamMember(opts),
-			removeDashTeamMember: removeTeamMember(opts),
-			addDashMember: addMember(opts),
-			removeDashMember: removeMember(opts),
-			updateDashMemberRole: updateMemberRole(opts),
-			inviteDashMember: inviteMember(opts),
-			cancelDashInvitation: cancelInvitation(opts),
-			resendDashInvitation: resendInvitation(opts),
-			dashCheckUserByEmail: checkUserByEmail(opts),
-			dashGetUserStats: getUserStats(opts),
-			dashGetUserGraphData: getUserGraphData(opts),
-			dashGetUserRetentionData: getUserRetentionData(opts),
-			dashBanUser: banUser(opts),
-			dashBanManyUsers: banManyUsers(opts),
-			dashUnbanUser: unbanUser(opts),
-			dashSendVerificationEmail: sendVerificationEmail(opts),
-			dashSendManyVerificationEmails: sendManyVerificationEmails(opts),
-			dashSendResetPasswordEmail: sendResetPasswordEmail(opts),
-			dashEnableTwoFactor: enableTwoFactor(opts),
-			dashViewTwoFactorTotpUri: viewTwoFactorTotpUri(opts),
-			dashViewBackupCodes: viewBackupCodes(opts),
-			dashDisableTwoFactor: disableTwoFactor(opts),
-			dashGenerateBackupCodes: generateBackupCodes(opts),
-			getUserEvents: getUserEvents(opts),
-			getAuditLogs: getAuditLogs(opts),
-			getAllAuditLogs: getAllAuditLogs(opts),
-			getEventTypes: getEventTypes(opts),
-			dashAcceptInvitation: acceptInvitation(opts),
-			dashCompleteInvitation: completeInvitation(opts),
-			dashCheckUserExists: checkUserExists(opts),
-			listDashOrganizationDirectories: listOrganizationDirectories(opts),
-			createDashOrganizationDirectory: createOrganizationDirectory(opts),
-			deleteDashOrganizationDirectory: deleteOrganizationDirectory(opts),
-			regenerateDashDirectoryToken: regenerateDirectoryToken(opts),
-			dashExecuteAdapter: executeAdapter(opts)
+			getDashConfig: getConfig(settings),
+			getDashValidate: getValidate(settings),
+			getDashUsers: getUsers(settings),
+			exportDashUsers: exportUsers(settings),
+			createDashUser: createUser(settings),
+			deleteDashUser: deleteUser(settings),
+			deleteManyDashUsers: deleteManyUsers(settings),
+			listDashOrganizations: listOrganizations(settings),
+			exportDashOrganizations: exportOrganizations(settings),
+			getDashOrganization: getOrganization(settings),
+			listDashOrganizationMembers: listOrganizationMembers(settings),
+			listDashOrganizationInvitations: listOrganizationInvitations(settings),
+			listDashOrganizationTeams: listOrganizationTeams(settings),
+			listDashOrganizationSsoProviders: listOrganizationSsoProviders(settings),
+			createDashSsoProvider: createSsoProvider(settings),
+			updateDashSsoProvider: updateSsoProvider(settings),
+			requestDashSsoVerificationToken: requestSsoVerificationToken(settings),
+			verifyDashSsoProviderDomain: verifySsoProviderDomain(settings),
+			deleteDashSsoProvider: deleteSsoProvider(settings),
+			markDashSsoProviderDomainVerified: markSsoProviderDomainVerified(settings),
+			listDashTeamMembers: listTeamMembers(settings),
+			createDashOrganization: createOrganization(settings),
+			deleteDashOrganization: deleteOrganization(settings),
+			deleteManyDashOrganizations: deleteManyOrganizations(settings),
+			getDashOrganizationOptions: getOrganizationOptions(settings),
+			getDashUser: getUserDetails(settings),
+			getDashUserOrganizations: getUserOrganizations(settings),
+			updateDashUser: updateUser(settings),
+			setDashPassword: setPassword(settings),
+			unlinkDashAccount: unlinkAccount(settings),
+			dashRevokeSession: revokeSession(settings),
+			dashRevokeAllSessions: revokeAllSessions(settings),
+			dashRevokeManySessions: revokeManySessions(settings),
+			dashImpersonateUser: impersonateUser(settings),
+			updateDashOrganization: updateOrganization(settings),
+			createDashTeam: createTeam(settings),
+			updateDashTeam: updateTeam(settings),
+			deleteDashTeam: deleteTeam(settings),
+			addDashTeamMember: addTeamMember(settings),
+			removeDashTeamMember: removeTeamMember(settings),
+			addDashMember: addMember(settings),
+			removeDashMember: removeMember(settings),
+			updateDashMemberRole: updateMemberRole(settings),
+			inviteDashMember: inviteMember(settings),
+			cancelDashInvitation: cancelInvitation(settings),
+			resendDashInvitation: resendInvitation(settings),
+			dashCheckUserByEmail: checkUserByEmail(settings),
+			dashGetUserStats: getUserStats(settings),
+			dashGetUserGraphData: getUserGraphData(settings),
+			dashGetUserRetentionData: getUserRetentionData(settings),
+			dashBanUser: banUser(settings),
+			dashBanManyUsers: banManyUsers(settings),
+			dashUnbanUser: unbanUser(settings),
+			dashSendVerificationEmail: sendVerificationEmail(settings),
+			dashSendManyVerificationEmails: sendManyVerificationEmails(settings),
+			dashSendResetPasswordEmail: sendResetPasswordEmail(settings),
+			dashEnableTwoFactor: enableTwoFactor(settings),
+			dashViewTwoFactorTotpUri: viewTwoFactorTotpUri(settings),
+			dashViewBackupCodes: viewBackupCodes(settings),
+			dashDisableTwoFactor: disableTwoFactor(settings),
+			dashGenerateBackupCodes: generateBackupCodes(settings),
+			getUserEvents: getUserEvents(settings),
+			getAuditLogs: getAuditLogs(settings),
+			getAllAuditLogs: getAllAuditLogs(settings),
+			getEventTypes: getEventTypes(settings),
+			dashAcceptInvitation: acceptInvitation(settings),
+			dashCompleteInvitation: completeInvitation(settings),
+			dashCheckUserExists: checkUserExists(settings),
+			listDashOrganizationDirectories: listOrganizationDirectories(settings),
+			createDashOrganizationDirectory: createOrganizationDirectory(settings),
+			deleteDashOrganizationDirectory: deleteOrganizationDirectory(settings),
+			regenerateDashDirectoryToken: regenerateDirectoryToken(settings),
+			dashExecuteAdapter: executeAdapter(settings)
 		},
 		schema: opts.activityTracking?.enabled ? { user: { fields: { lastActiveAt: {
 			type: "date",