@better-auth/infra 0.4.6 → 0.4.8

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CApB_fKA.mjs";
-import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-CfK70MTZ.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-C8_UJzzu.mjs";
+import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-DRS7yhmR.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAdapter, getCurrentAuthContext, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
@@ -21,14 +21,18 @@ function resolveConnectionOptions(options) {
 		apiUrl: options?.apiUrl || INFRA_API_URL,
 		kvUrl: options?.kvUrl || INFRA_KV_URL,
 		apiKey: options?.apiKey || env.BETTER_AUTH_API_KEY || "",
-		apiOptions: { timeout: options?.apiOptions?.timeout ?? options?.apiTimeout ?? 3e3 },
+		apiOptions: {
+			timeout: options?.apiOptions?.timeout ?? options?.apiTimeout ?? 3e3,
+			headers: options?.apiOptions?.headers
+		},
 		kvOptions: {
 			timeout: options?.kvOptions?.timeout ?? options?.kvTimeout ?? 1e3,
 			retry: {
 				attempts: options?.kvOptions?.retry?.attempts ?? 2,
 				baseDelay: options?.kvOptions?.retry?.baseDelay ?? 400,
 				maxDelay: options?.kvOptions?.retry?.maxDelay ?? 600
-			}
+			},
+			headers: options?.kvOptions?.headers
 		}
 	};
 }
@@ -56,6 +60,21 @@ function resolveSentinelOptions(options) {
 	};
 }
 //#endregion
+//#region src/types.ts
+/** Type-only cast — does not wrap or mutate ctx. */
+function asInfraContext(ctx) {
+	return ctx;
+}
+/**
+* better-auth createAuthMiddleware with InfraAuthContext on `ctx.context`.
+* Pass-through at runtime — type-only (does not wrap the handler).
+*
+* Prefer this for dash/sentinel/identification hooks. Keep better-auth's
+* createAuthMiddleware where middleware return values must extend AuthContext
+* (e.g. JWT `payload` via `use: [...]`).
+*/
+const createAuthMiddleware$1 = createAuthMiddleware;
+//#endregion
 //#region ../utils/dist/ip.mjs
 /** Platform-set client IP headers (not accepted from clients on the open internet). */
 const DEFAULT_TRUSTED_IP_HEADERS = [
@@ -1102,7 +1121,7 @@ function shouldRunIdentification(ctx, getRoutes = IDENTIFICATION_GET_ROUTES) {
 * needs it; together they would append duplicate Set-Cookie headers).
 */
 function createIdentificationCookieAfterMiddleware() {
-	return createAuthMiddleware(async (ctx) => {
+	return createAuthMiddleware$1(async (ctx) => {
 		if (ctx.context.infraRidCookieSet) return;
 		ctx.context.infraRidCookieSet = true;
 		const headerRequestId = ctx.request?.headers.get("X-Request-Id");
@@ -1230,7 +1249,7 @@ function resolveUntrustedVisitorId(visitorId, ip, headerVisitorId) {
 */
 function createIdentificationMiddleware($kv, options) {
 	const retry = options?.retry ?? DEFAULT_KV_RETRY;
-	return createAuthMiddleware(async (ctx) => {
+	return createAuthMiddleware$1(async (ctx) => {
 		const skipIdentification = options?.skipIdentification?.(ctx) ?? false;
 		let headerVisitorId = null;
 		let requestId = null;
@@ -1368,7 +1387,8 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 	const resolvedApiUrl = conn.apiUrl || INFRA_API_URL;
 	const emailSender = createEmailSender({
 		apiUrl: resolvedApiUrl,
-		apiKey: conn.apiKey
+		apiKey: conn.apiKey,
+		apiOptions: { headers: conn.apiOptions.headers }
 	});
 	function logEvent(event) {
 		const fullEvent = {
@@ -2475,7 +2495,8 @@ const sentinel = (options) => {
 	const $kv = createKV({
 		kvUrl: opts.kvUrl,
 		apiKey: opts.apiKey,
-		timeout: opts.kvOptions.timeout
+		timeout: opts.kvOptions.timeout,
+		headers: opts.kvOptions.headers
 	});
 	const { tracker } = initTrackEvents($api);
 	const { trackEvent } = tracker;
@@ -2576,14 +2597,15 @@ const sentinel = (options) => {
 					customRules
 				} },
 				options: {
-					emailValidation: opts.security?.emailValidation,
-					emailNormalization: opts.security?.emailNormalization,
+					...opts.security?.emailValidation !== void 0 ? { emailValidation: opts.security.emailValidation } : {},
+					...opts.security?.emailNormalization !== void 0 ? { emailNormalization: opts.security.emailNormalization } : {},
 					rateLimit: { customRules },
 					databaseHooks: {
 						user: {
 							create: {
-								async before(user, ctx) {
-									if (!ctx) return;
+								async before(user, _ctx) {
+									if (!_ctx) return;
+									const ctx = asInfraContext(_ctx);
 									if (isDashRoute(ctx.path)) {
 										if (user.email && typeof user.email === "string" && isEmailNormalizationEnabled(opts.security)) return { data: {
 											...user,
@@ -2617,8 +2639,9 @@ const sentinel = (options) => {
 										email: normalizeEmail(user.email, ctx.context)
 									} };
 								},
-								async after(user, ctx) {
-									if (!ctx || isDashRoute(ctx.path)) return;
+								async after(user, _ctx) {
+									if (!_ctx || isDashRoute(_ctx.path)) return;
+									const ctx = asInfraContext(_ctx);
 									const visitorId = ctx.context.visitorId;
 									const reservationId = ctx.context.freeTrialReservationId;
 									if (visitorId && reservationId && opts.security?.freeTrialAbuse?.enabled) await ctx.context.runInBackgroundOrAwait(securityService.confirmFreeTrialSignup(visitorId, reservationId, user.id, ctx.context.requestId ?? null));
@@ -2633,8 +2656,9 @@ const sentinel = (options) => {
 							} }
 						},
 						session: { create: {
-							async before(session, ctx) {
-								if (!ctx || isDashRoute(ctx.path)) return;
+							async before(session, _ctx) {
+								if (!_ctx || isDashRoute(_ctx.path)) return;
+								const ctx = asInfraContext(_ctx);
 								const visitorId = ctx.context.visitorId;
 								const identification = ctx.context.identification;
 								if (session.userId && identification?.location && visitorId) {
@@ -2666,8 +2690,9 @@ const sentinel = (options) => {
 									}
 								}
 							},
-							async after(session, ctx) {
-								if (!ctx || !session.userId || isDashRoute(ctx.path)) return;
+							async after(session, _ctx) {
+								if (!_ctx || !session.userId || isDashRoute(_ctx.path)) return;
+								const ctx = asInfraContext(_ctx);
 								const visitorId = ctx.context.visitorId;
 								const identification = ctx.context.identification;
 								let user = null;
@@ -2699,7 +2724,7 @@ const sentinel = (options) => {
 				...phoneValidationHooks.before,
 				{
 					matcher: (ctx) => ctx.request?.method !== "GET" && !isDashRoute(ctx.path),
-					handler: createAuthMiddleware(async (ctx) => {
+					handler: createAuthMiddleware$1(async (ctx) => {
 						const visitorId = ctx.context.visitorId;
 						const identification = ctx.context.identification;
 						const ip = ctx.context.ip;
@@ -2759,7 +2784,7 @@ const sentinel = (options) => {
 				},
 				{
 					matcher: (ctx) => !!opts.security?.staleUsers?.enabled && !isDashRoute(ctx.path),
-					handler: createAuthMiddleware(async (ctx) => {
+					handler: createAuthMiddleware$1(async (ctx) => {
 						if (ctx.context.returned instanceof Error) return;
 						const created = ctx.context.newSession;
 						const userId = created?.user?.id ?? created?.session?.userId;
@@ -2806,7 +2831,7 @@ const sentinel = (options) => {
 				},
 				{
 					matcher: (ctx) => ctx.request?.method !== "GET" && !isDashRoute(ctx.path),
-					handler: createAuthMiddleware(async (ctx) => {
+					handler: createAuthMiddleware$1(async (ctx) => {
 						const untrustedVisitorId = ctx.context.untrustedVisitorId;
 						const ip = ctx.context.ip;
 						const body = ctx.body;
@@ -10525,11 +10550,12 @@ function createSMSSender(config) {
 	if (!apiKey) logger.warn("[Dash] No API key provided for SMS sending. Set BETTER_AUTH_API_KEY environment variable or pass apiKey in config.");
 	const $api = createFetch({
 		baseURL: apiUrl,
+		timeout: config?.apiOptions?.timeout ?? config?.apiTimeout ?? 3e3,
 		headers: {
+			...config?.apiOptions?.headers,
 			"user-agent": INFRA_USER_AGENT,
 			Authorization: `Bearer ${apiKey}`
-		},
-		timeout: config?.apiOptions?.timeout ?? config?.apiTimeout ?? 3e3
+		}
 	});
 	/**
 	* Send an SMS with OTP code
@@ -10622,7 +10648,7 @@ function setPendingSessionTracking(ctx, pending) {
 }
 async function getRequestLocation() {
 	try {
-		return (await getCurrentAuthContext()).context.location;
+		return asInfraContext(await getCurrentAuthContext()).context.location;
 	} catch {
 		return;
 	}
@@ -10638,7 +10664,8 @@ const dash = (options) => {
 	const $kv = createKV({
 		kvUrl: opts.kvUrl,
 		apiKey: opts.apiKey,
-		timeout: opts.kvOptions.timeout
+		timeout: opts.kvOptions.timeout,
+		headers: opts.kvOptions.headers
 	});
 	const activityUpdateInterval = opts.activityTracking?.updateInterval ?? 3e5;
 	const scheduleLastActiveUpdate = async (ctx, userId) => {
@@ -10970,7 +10997,8 @@ const dash = (options) => {
 							const location = ctx.context.location;
 							if (matchesAnyRoute(path, [routes.REQUEST_PASSWORD_RESET])) trackPasswordResetRequest(verification, trigger, ctx, location);
 						} },
-						delete: { async after(verification, ctx) {
+						delete: { async after(verification, _ctx) {
+							const ctx = _ctx;
 							if (!ctx) return;
 							const path = ctx.path;
 							const maybeUserId = ctx.context.session?.user.id ?? "unknown";
@@ -10994,7 +11022,7 @@ const dash = (options) => {
 			after: [
 				{
 					matcher: (ctx) => !!getPendingSessionTracking(ctx),
-					handler: createAuthMiddleware(async (ctx) => {
+					handler: createAuthMiddleware$1(async (ctx) => {
 						const pending = getPendingSessionTracking(ctx);
 						if (!pending) return;
 						trackSessionLifecycle(pending.enrichedSession, pending.userId, ctx, pending.location, resolveUserFromContext(pending.userId, ctx), pending.trackSignIn, pending.impersonatedBy);
@@ -11009,8 +11037,7 @@ const dash = (options) => {
 							routes.DASH_IMPERSONATE_USER
 						]);
 					},
-					handler: createAuthMiddleware(async (_ctx) => {
-						const ctx = _ctx;
+					handler: createAuthMiddleware$1(async (ctx) => {
 						const maybeUserId = ctx.context.session?.user.id ?? "unknown";
 						const trigger = getTriggerInfo(ctx, maybeUserId);
 						if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL, routes.DASH_SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx.context.location);
@@ -11025,7 +11052,7 @@ const dash = (options) => {
 					handler: createIdentificationCookieAfterMiddleware()
 				},
 				{
-					handler: createAuthMiddleware(async (ctx) => {
+					handler: createAuthMiddleware$1(async (ctx) => {
 						if (!opts.activityTracking?.enabled) return;
 						if (activityUpdateInterval === 0) return;
 						const session = ctx.context.session || ctx.context.newSession;

package/dist/native.d.mts

@@ -1,4 +1,4 @@
-import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-Cim5Fztg.mjs";
+import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-DgKA4Eq8.mjs";
 import { BetterAuthClientPlugin } from "better-auth";
 //#region src/sentinel/native/client.d.ts
 interface SentinelNativeClientOptions {

package/dist/native.mjs

@@ -1,5 +1,5 @@
-import { o as createKV, t as bytesToHex } from "./crypto-CfK70MTZ.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-DkrUdqDd.mjs";
+import { o as createKV, t as bytesToHex } from "./crypto-DRS7yhmR.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-Di0eUKbA.mjs";
 import { env } from "@better-auth/core/env";
 import { Dimensions, InteractionManager, PixelRatio, Platform } from "react-native";
 //#region src/sentinel/native/components.ts

package/dist/{pow-retry-DkrUdqDd.mjs → pow-retry-Di0eUKbA.mjs}

@@ -1,4 +1,4 @@
-import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-CfK70MTZ.mjs";
+import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-DRS7yhmR.mjs";
 //#region src/dash-client.ts
 function resolveDashUserId(input, options) {
 	return input.userId || options?.resolveUserId?.({

package/dist/{types-sP9ucYj1.d.mts → types-BkUWsMpe.d.mts}

@@ -1,7 +1,8 @@
-import { BetterAuthPlugin, GenericEndpointContext } from "better-auth";
+import { GenericEndpointContext } from "better-auth";
+import { createAuthMiddleware } from "better-auth/api";
 import { createFetch } from "@better-fetch/fetch";
 import { BetterAuthRateLimitRule } from "@better-auth/core";
-import { APIError as APIError$1, Endpoint, EndpointOptions } from "better-call";
+import { APIError as APIError$2, Endpoint, EndpointOptions } from "better-call";
 //#region src/identification.d.ts
 interface IPLocation {
   lat: number;
@@ -170,28 +171,13 @@ declare const sentinel: (options?: SentinelOptions) => {
   init(ctx: import("better-auth").AuthContext): {
     context: {
       rateLimit: {
-        customRules: {
-          [key: string]: false | BetterAuthRateLimitRule | ((request: Request, currentRule: BetterAuthRateLimitRule) => import("@better-auth/core").Awaitable<false | BetterAuthRateLimitRule>);
-        };
         enabled: boolean;
         window: number;
         max: number;
         storage: "memory" | "database" | "secondary-storage";
-        modelName?: import("better-auth").LiteralString | "rateLimit" | undefined;
-        fields?: Partial<Record<"key" | "count" | "lastRequest", string>> | undefined;
-        customStorage?: import("better-auth").BetterAuthRateLimitStorage | undefined;
-      };
+      } & Omit<import("better-auth").BetterAuthRateLimitOptions, "window" | "enabled" | "max" | "storage">;
     };
     options: {
-      emailValidation: {
-        enabled?: boolean;
-        strictness?: "low" | "medium" | "high";
-        action?: SecurityAction;
-        domainAllowlist?: string[];
-      } | undefined;
-      emailNormalization: {
-        enabled?: boolean;
-      } | undefined;
       rateLimit: {
         customRules: {
           [key: string]: false | BetterAuthRateLimitRule | ((request: Request, currentRule: BetterAuthRateLimitRule) => import("@better-auth/core").Awaitable<false | BetterAuthRateLimitRule>);
@@ -208,7 +194,7 @@ declare const sentinel: (options?: SentinelOptions) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, ctx: import("better-auth").GenericEndpointContext | null): Promise<{
+            } & Record<string, unknown>, _ctx: import("better-auth").GenericEndpointContext | null): Promise<{
               data: {
                 email: string;
                 id: string;
@@ -227,7 +213,7 @@ declare const sentinel: (options?: SentinelOptions) => {
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & Record<string, unknown>, ctx: import("better-auth").GenericEndpointContext | null): Promise<void>;
+            } & Record<string, unknown>, _ctx: import("better-auth").GenericEndpointContext | null): Promise<void>;
           };
           update: {
             before(user: Partial<{
@@ -262,7 +248,7 @@ declare const sentinel: (options?: SentinelOptions) => {
               token: string;
               ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
-            } & Record<string, unknown>, ctx: import("better-auth").GenericEndpointContext | null): Promise<void>;
+            } & Record<string, unknown>, _ctx: import("better-auth").GenericEndpointContext | null): Promise<void>;
             after(session: {
               id: string;
               createdAt: Date;
@@ -272,193 +258,29 @@ declare const sentinel: (options?: SentinelOptions) => {
               token: string;
               ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
-            } & Record<string, unknown>, ctx: import("better-auth").GenericEndpointContext | null): Promise<void>;
+            } & Record<string, unknown>, _ctx: import("better-auth").GenericEndpointContext | null): Promise<void>;
           };
         };
       };
+      emailNormalization?: {
+        enabled?: boolean;
+      } | undefined;
+      emailValidation?: {
+        enabled?: boolean;
+        strictness?: "low" | "medium" | "high";
+        action?: SecurityAction;
+        domainAllowlist?: string[];
+      } | undefined;
     };
   };
   hooks: {
-    before: ({
-      matcher: (context: Pick<import("better-auth").HookEndpointContext, "path">) => boolean;
-      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
-        context: {
-          method: "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
-          path: string;
-          body: any;
-          query: Record<string, any> | undefined;
-          params: Record<string, any> & string;
-          request: Request | undefined;
-          headers: Headers | undefined;
-          setHeader: ((key: string, value: string) => void) & ((key: string, value: string) => void);
-          setStatus: (status: import("better-call").Status) => void;
-          getHeader: ((key: string) => string | null) & ((key: string) => string | null);
-          getCookie: (key: string, prefix?: import("better-call").CookiePrefixOptions) => string | null;
-          getSignedCookie: (key: string, secret: string, prefix?: import("better-call").CookiePrefixOptions) => Promise<string | null | false>;
-          setCookie: (key: string, value: string, options?: import("better-call").CookieOptions) => string;
-          setSignedCookie: (key: string, value: string, secret: string, options?: import("better-call").CookieOptions) => Promise<string>;
-          responseHeaders: Headers;
-          json: (<R extends Record<string, any> | null>(json: R, routerResponse?: {
-            status?: number;
-            headers?: Record<string, string>;
-            response?: Response;
-            body?: Record<string, string>;
-          } | Response) => Promise<R>) & (<R extends Record<string, any> | null>(json: R, routerResponse?: {
-            status?: number;
-            headers?: Record<string, string>;
-            response?: Response;
-          } | Response) => Promise<R>);
-          context: {
-            [x: string]: any;
-          } & {
-            returned?: unknown | undefined;
-            responseHeaders?: Headers | undefined;
-            getPlugin: <ID extends import("better-auth").BetterAuthPluginRegistryIdentifier | import("better-auth").LiteralString, PluginOptions extends never>(pluginId: ID) => (ID extends keyof import("better-auth").BetterAuthPluginRegistry<unknown, unknown> ? import("better-auth").BetterAuthPluginRegistry<import("better-auth").BetterAuthOptions, PluginOptions>[ID] extends {
-              creator: infer C;
-            } ? C extends ((...args: any[]) => infer R) ? R : never : never : BetterAuthPlugin) | null;
-            hasPlugin: <ID extends import("better-auth").BetterAuthPluginRegistryIdentifier | import("better-auth").LiteralString>(pluginId: ID) => ID extends never ? true : boolean;
-            appName: string;
-            baseURL: string;
-            version: string;
-            options: import("better-auth").BetterAuthOptions;
-            trustedOrigins: string[];
-            trustedProviders: string[];
-            isTrustedOrigin: (url: string, settings?: {
-              allowRelativePaths: boolean;
-            }) => boolean;
-            oauthConfig: {
-              skipStateCookieCheck?: boolean | undefined;
-              storeStateStrategy: "database" | "cookie";
-            };
-            newSession: {
-              session: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                userId: string;
-                expiresAt: Date;
-                token: string;
-                ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
-              } & Record<string, any>;
-              user: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-              } & Record<string, any>;
-            } | null;
-            session: {
-              session: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                userId: string;
-                expiresAt: Date;
-                token: string;
-                ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
-              } & Record<string, any>;
-              user: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-              } & Record<string, any>;
-            } | null;
-            setNewSession: (session: {
-              session: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                userId: string;
-                expiresAt: Date;
-                token: string;
-                ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
-              } & Record<string, any>;
-              user: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-              } & Record<string, any>;
-            } | null) => void;
-            socialProviders: import("better-auth").OAuthProvider[];
-            authCookies: import("better-auth").BetterAuthCookies;
-            logger: ReturnType<(options?: import("better-auth").Logger | undefined) => import("better-auth").InternalLogger>;
-            rateLimit: {
-              enabled: boolean;
-              window: number;
-              max: number;
-              storage: "memory" | "database" | "secondary-storage";
-            } & Omit<import("better-auth").BetterAuthRateLimitOptions, "enabled" | "window" | "max" | "storage">;
-            adapter: import("better-auth").DBAdapter<import("better-auth").BetterAuthOptions>;
-            internalAdapter: import("better-auth").InternalAdapter<import("better-auth").BetterAuthOptions>;
-            createAuthCookie: (cookieName: string, overrideAttributes?: Partial<import("better-call").CookieOptions> | undefined) => import("better-auth").BetterAuthCookie;
-            secret: string;
-            secretConfig: string | import("better-auth").SecretConfig;
-            sessionConfig: {
-              updateAge: number;
-              expiresIn: number;
-              freshAge: number;
-              cookieRefreshCache: false | {
-                enabled: true;
-                updateAge: number;
-              };
-            };
-            generateId: (options: {
-              model: import("better-auth").ModelNames;
-              size?: number | undefined;
-            }) => string | false;
-            secondaryStorage: import("better-auth").SecondaryStorage | undefined;
-            password: {
-              hash: (password: string) => Promise<string>;
-              verify: (data: {
-                password: string;
-                hash: string;
-              }) => Promise<boolean>;
-              config: {
-                minPasswordLength: number;
-                maxPasswordLength: number;
-              };
-              checkPassword: (userId: string, ctx: import("better-auth").GenericEndpointContext<import("better-auth").BetterAuthOptions>) => Promise<boolean>;
-            };
-            tables: import("better-auth").BetterAuthDBSchema;
-            runMigrations: () => Promise<void>;
-            publishTelemetry: (event: {
-              type: string;
-              anonymousId?: string | undefined;
-              payload: Record<string, any>;
-            }) => Promise<void>;
-            skipOriginCheck: boolean | string[];
-            skipCSRFCheck: boolean;
-            runInBackground: (promise: Promise<unknown>) => void;
-            runInBackgroundOrAwait: (promise: Promise<unknown> | void) => import("better-auth").Awaitable<unknown>;
-          };
-          redirect: (url: string) => import("better-call").APIError;
-          error: (status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | import("better-call").Status, body?: {
-            message?: string;
-            code?: string;
-          } & Record<string, any>, headers?: HeadersInit) => import("better-call").APIError;
-        };
-      } | undefined>;
-    } | {
-      matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
-      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
-    })[];
+    before: {
+      matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+      handler: import("better-auth/api").AuthMiddleware;
+    }[];
     after: {
       matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
-      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
+      handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<unknown>>;
     }[];
   };
 };
@@ -497,11 +319,19 @@ interface ApiOptions {
    * @default 3000
    */
   timeout?: number;
+  /**
+   * Extra headers on every Dash API request.
+   * Cannot override built-in headers (`user-agent`, `x-api-key`).
+   */
+  headers?: Record<string, string>;
 }
 /**
  * Resolved {@link ApiOptions} with defaults applied.
  */
-type ApiOptionsResolved = Required<ApiOptions>;
+type ApiOptionsResolved = {
+  timeout: number;
+  headers?: Record<string, string>;
+};
 /**
  * KV HTTP client options.
  */
@@ -516,6 +346,11 @@ interface KvOptions {
    * @default { attempts: 2, baseDelay: 400, maxDelay: 600 }
    */
   retry?: KvRetryOptions;
+  /**
+   * Extra headers on every KV request.
+   * Cannot override built-in headers (`user-agent`, `x-api-key`).
+   */
+  headers?: Record<string, string>;
 }
 /**
  * Resolved {@link KvOptions} with defaults applied.
@@ -523,6 +358,7 @@ interface KvOptions {
 interface KvOptionsResolved {
   timeout: number;
   retry: KvRetryOptionsResolved;
+  headers?: Record<string, string>;
 }
 /**
  * Shared connection options used by infra plugins.
@@ -678,15 +514,44 @@ interface LocationData {
 }
 /** @deprecated Use LocationData instead */
 type LocationDataContext = LocationData;
-type InfraEndpointContext = (GenericEndpointContext & {
-  context: {
-    identification?: Identification | null | undefined;
-    visitorId: string | null;
-    requestId: string | null;
-    ip: string | null;
-    untrustedVisitorId: string | null;
-    location: LocationData | undefined;
-  };
-}) | undefined;
+/**
+ * Plugin-attached AuthContext fields. better-auth types AuthContext as a fixed
+ * object; prefer {@link createAuthMiddleware} for hooks, {@link asInfraContext}
+ * for database hooks / getCurrentAuthContext.
+ */
+type InfraAuthContext = GenericEndpointContext["context"] & {
+  identification?: Identification | null;
+  visitorId: string | null;
+  requestId: string | null;
+  ip: string | null;
+  untrustedVisitorId: string | null;
+  location: LocationData | undefined;
+  infraRidCookieSet?: boolean;
+  freeTrialReservationId?: string;
+  returned?: unknown;
+  payload?: unknown;
+};
+type InfraEndpointContextValue = Omit<GenericEndpointContext, "context"> & {
+  context: InfraAuthContext;
+};
+type InfraEndpointContext = InfraEndpointContextValue | undefined;
+/** Type-only cast — does not wrap or mutate ctx. */
+declare function asInfraContext<T extends {
+  context: object;
+}>(ctx: T): Omit<T, "context"> & {
+  context: InfraAuthContext;
+};
+/**
+ * better-auth createAuthMiddleware with InfraAuthContext on `ctx.context`.
+ * Pass-through at runtime — type-only (does not wrap the handler).
+ *
+ * Prefer this for dash/sentinel/identification hooks. Keep better-auth's
+ * createAuthMiddleware where middleware return values must extend AuthContext
+ * (e.g. JWT `payload` via `use: [...]`).
+ */
+declare const createAuthMiddleware$1: {
+  <R>(handler: (ctx: InfraEndpointContextValue) => R | Promise<R>): ReturnType<typeof createAuthMiddleware>;
+  <Options extends Record<string, unknown>, R>(options: Options, handler: (ctx: InfraEndpointContextValue) => R | Promise<R>): ReturnType<typeof createAuthMiddleware>;
+};
 //#endregion
-export { ImpossibleTravelResult as C, SecurityVerdict as D, SecurityOptions as E, StaleUserResult as O, CredentialStuffingResult as S, SecurityEventType as T, LocationDataContext as _, DashOptionsInternal as a, sentinel as b, EndpointOptions as c, InfraPluginConnectionOptionsInternal as d, KvOptions as f, LocationData as g, KvRetryOptionsResolved as h, DashOptions as i, ThresholdConfig as k, InfraEndpointContext as l, KvRetryOptions as m, ApiOptions as n, DashOptionsResolved as o, KvOptionsResolved as p, ApiOptionsResolved as r, Endpoint as s, APIError$1 as t, InfraPluginConnectionOptions as u, SentinelOptions as v, SecurityEvent as w, CompromisedPasswordResult as x, SentinelOptionsInternal as y };
+export { SecurityOptions as A, createAuthMiddleware$1 as C, ImpossibleTravelResult as D, CredentialStuffingResult as E, StaleUserResult as M, ThresholdConfig as N, SecurityEvent as O, asInfraContext as S, CompromisedPasswordResult as T, KvRetryOptionsResolved as _, DashOptionsInternal as a, SentinelOptions as b, EndpointOptions as c, InfraEndpointContextValue as d, InfraPluginConnectionOptions as f, KvRetryOptions as g, KvOptionsResolved as h, DashOptions as i, SecurityVerdict as j, SecurityEventType as k, InfraAuthContext as l, KvOptions as m, ApiOptions as n, DashOptionsResolved as o, InfraPluginConnectionOptionsInternal as p, ApiOptionsResolved as r, Endpoint as s, APIError$2 as t, InfraEndpointContext as u, LocationData as v, sentinel as w, SentinelOptionsInternal as x, LocationDataContext as y };