@keystrokehq/cli 0.1.104 → 0.1.107

package/dist/index.mjs

@@ -1,14 +1,13 @@
 #!/usr/bin/env node
-import { $ as CredentialInstanceRecordSchema, $n as WorkflowCanvasSchema, $t as PresignProjectSourceRequestSchema, A as ConnectManagedServiceCredentialRequestSchema, An as TriggerRunDetailResponseSchema, At as ListCredentialsPageResponseSchema, B as CreateCustomAppResponseSchema, Bn as UpdateProjectMemberRequestSchema, Bt as ListProjectsResponseSchema, C as ChannelConnectionListResponseSchema, Cn as StartOAuthConnectionResultSchema, Cr as parseErrorResponse, D as ConfirmCheckoutRequestSchema, Dn as TriggerInvokeInputsSchema, Dr as resolveDocsMcpUrl, Dt as ListAppsResponseSchema, E as CompleteProjectArtifactResponseSchema, En as TriggerDetailResponseSchema, Er as resolveConnectAppSlug, Et as ListApiKeysResponseSchema, F as CreateCredentialInstanceBodySchema, Fn as UpdateCredentialRequestSchema, Ft as ListOrganizationsResponseSchema, G as CreateProjectResponseSchema, Gn as UploadProjectSourceResponseSchema, Gt as OrganizationSidebarBrandingPatchSchema, H as CreateOrganizationResponseSchema, Hn as UpdateProjectRequestSchema, Ht as ManagedServiceKindSchema, I as CreateCredentialsRequestSchema, In as UpdateManagedServiceCredentialRequestSchema, It as ListProjectDeploymentsResponseSchema, J as CredentialAssignmentListResponseSchema, Jn as UserAvatarSchema, Jt as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, K as CreateSubscriptionCheckoutRequestSchema, Kn as UpsertGatewayAttachmentBodySchema, Kt as OrganizationSidebarBrandingSchema, L as CreateCredentialsResponseSchema, Ln as UpdateOrganizationMemberRequestSchema, Lt as ListProjectFilesResponseSchema, M as CreateApiKeyRequestSchema, Mn as UpdateAutoTopupRequestSchema, Mt as ListOrganizationInvitationsResponseSchema, N as CreateApiKeyResponseSchema, Nn as UpdateChannelBindingBodySchema, Nt as ListOrganizationMembersPageQuerySchema, O as ConfirmCheckoutResponseSchema, On as TriggerInvokeResponseSchema, Or as resolvePublicPlatformOrigin, Ot as ListChannelPlatformsResponseSchema, P as CreateBillingPortalRequestSchema, Pn as UpdateCredentialInstanceBodySchema, Pt as ListOrganizationMembersPageResponseSchema, Q as CredentialInstanceListResponseSchema, Qn as WorkflowCanvasRunSchema, Qt as PresignOrgLogoResponseSchema, R as CreateCreditsCheckoutRequestSchema, Rn as UpdateOrganizationMemberResponseSchema, Rt as ListProjectMembersResponseSchema, S as ChannelAccountListResponseSchema, Sn as StartOAuthConnectionInputSchema, Sr as parseAppSlug, St as InviteProjectMembersResponseSchema, T as ChannelDirectoryListResponseSchema, Tn as SubmitTeamRequestRequestSchema, Tt as ListAgentWorkspaceFilesResponseSchema, U as CreateProjectArtifactResponseSchema, Un as UpdateProjectSettingsRequestSchema, Ut as McpDiscoverResponseSchema, V as CreateOrganizationRequestSchema, Vn as UpdateProjectMemberResponseSchema, Vt as ManagedServiceCredentialSchema, W as CreateProjectRequestSchema, Wn as UploadProjectSourceManifestRequestSchema, Wt as OpenApiDiscoverResponseSchema, X as CredentialConsumerListQuerySchema, Xn as UserPreferencesSchema, Xt as PresignChatAttachmentResponseSchema, Y as CredentialAssignmentRecordSchema, Yn as UserPreferencesPatchSchema, Yt as PresignChatAttachmentRequestSchema, Z as CredentialConsumerListResponseSchema, Zn as WorkflowCanvasCredentialBindingsSchema, Zt as PresignOrgLogoRequestSchema, _ as BindChannelBodySchema, _n as SlugAvailabilityResponseSchema, _r as detectProjectPackageManagerFromSnapshot, _t as HistoryRunListQuerySchema, a as AgentSessionListResponseSchema, an as ProjectResponseSchema, ar as WorkflowRunResponseSchema, at as DownloadActiveProjectSourceResponseSchema, b as CatalogAppDetailResponseSchema, bn as StartMcpOAuthConnectionInputSchema, bt as InviteOrganizationMembersResponseSchema, c as AgentTriggerSummaryListResponseSchema, cn as PromptInputSchema, cr as WorkspaceTriggerDetailSchema, d as AutoTopupSummarySchema, dn as QueuedAgentPromptResponseSchema, dr as WorkspaceTriggerOverviewSchema, dt as GetCredentialResponseSchema, en as PresignProjectSourceResponseSchema, er as WorkflowRunDetailResponseSchema, f as BillingActivityResponseSchema, fn as QueuedRunResponseSchema, fr as WorkspaceTriggerRunListResponseSchema, ft as GetCustomAppResponseSchema, g as BillingUsageResponseSchema, gn as SkillSummaryListResponseSchema, gr as deriveCustomAppDisplay, gt as HistoryRunDetailResponseSchema, h as BillingSummaryResponseSchema, hn as SkillSummaryDetailResponseSchema, ht as HistoryRunCancelResponseSchema, i as AgentSessionDetailResponseSchema, in as ProjectReachabilityResponseSchema, ir as WorkflowRunListResponseSchema, it as DownloadActiveProjectArtifactResponseSchema, j as ConnectProvidersResponseSchema, jn as TriggerRunListResponseSchema, jt as ListManagedServiceCredentialsResponseSchema, k as ConnectAuthorizeUrlResponseSchema, kn as TriggerListResponseSchema, kr as slugifyAppName, kt as ListCredentialsPageQuerySchema, l as AppSlugAvailabilityResponseSchema, ln as PromptResponseSchema, lr as WorkspaceTriggerFileSchema, lt as GatewayAttachmentRecordSchema, m as BillingRedirectResponseSchema, mn as RecentResourceListResponseSchema, mr as buildConnectDeeplink, mt as HealthResponseSchema, n as AcceptOrganizationInvitationResponseSchema, nn as PresignUserAvatarResponseSchema, nr as WorkflowRunInputsPutBodySchema, nt as DOCS_SEARCH_TOOL, o as AgentSummaryDetailResponseSchema, on as ProjectSettingsResponseSchema, or as WorkflowSummaryDetailResponseSchema, ot as ErrorResponseSchema, p as BillingInvoiceUrlResponseSchema, pr as WorkspaceWorkflowOverviewSchema, pt as GraphqlDiscoverResponseSchema, q as CredentialAssignmentListQuerySchema, qn as UserAvatarPatchSchema, qt as PROJECT_PULL_STATE_RELATIVE_PATH, r as ActiveOrganizationResponseSchema, rn as ProjectPullStateSchema, rr as WorkflowRunInputsSchema, rt as DeclineOrganizationInvitationResponseSchema, s as AgentSummaryListResponseSchema, sn as ProjectSlugAvailabilityResponseSchema, sr as WorkflowSummaryListResponseSchema, st as ExecuteKeystrokeToolRequestSchema, t as ACTIVE_ORG_HEADER, tn as PresignUserAvatarRequestSchema, tr as WorkflowRunHooksResponseSchema, tt as DOCS_QUERY_TOOL, u as AssignCredentialBodySchema, ur as WorkspaceTriggerListResponseSchema, ut as GetAppCatalogEntryResponseSchema, v as CatalogActionDetailResponseSchema, vn as StartKeystrokeConnectionInputSchema, vr as isAcceptableInstallExit, vt as HistoryRunListResponseSchema, w as ChannelConnectionSchema, wn as SubmitMarketingContactRequestSchema, wt as ListAgentMemoryFilesResponseSchema, x as CatalogAppsPageResponseSchema, xn as StartMcpOAuthConnectionResultSchema, xt as InviteProjectMembersRequestSchema, y as CatalogActionsPageResponseSchema, yn as StartKeystrokeConnectionResultSchema, yr as listenPortFromPublicUrl, yt as InviteOrganizationMembersRequestSchema, z as CreateCustomAppRequestSchema, zn as UpdateOrganizationRequestSchema, zt as ListProjectMetricsResponseSchema } from "./dist-ZZlE2vk6.mjs";
-import { i as packProjectArtifact, n as withMcpReadClient, r as mergeFilteredArtifact, t as mapInParallelBatches } from "./dist-odLBD6p1.mjs";
-import { C as getWebUrl, E as resolvePlatformUrlForWebUrl, S as getPlatformUrl, _ as resolveCliRoot, a as formatReleaseAgeBlockMessage, b as getConfigDir, c as detectManagerFromLockfile, d as installDependencies$1, f as installPlaygroundDependencies, g as readCliVersion, h as isNewerVersion, i as fetchLatestCliRelease, l as buildPlaygroundWorkspace, m as resolvePackageManager, n as computeReleaseAgeRetryAfter, o as isReleaseAgeBlock, p as resolveGithubPackagesToken, r as readPnpmMinimumReleaseAgeMinutes, s as detectCliInstall, t as runPackageManagerUpdate, u as detectPackageManager, v as createCliConfig, w as DEFAULT_PLATFORM_URL, x as getEffectiveApiTarget, y as getCliConfigDir } from "./run-package-manager-update-BVuBh1a2.mjs";
+import { $ as CredentialInstanceListResponseSchema, $n as WorkflowCanvasRunSchema, $t as PresignOrgLogoResponseSchema, A as ConnectAuthorizeUrlResponseSchema, An as TriggerListResponseSchema, Ar as slugifyAppName, At as ListCredentialsPageQuerySchema, B as CreateCustomAppRequestSchema, Bn as UpdateOrganizationRequestSchema, Bt as ListProjectMetricsResponseSchema, C as ChannelAccountListResponseSchema, Cn as StartOAuthConnectionInputSchema, Cr as parseAppSlug, Ct as InviteProjectMembersResponseSchema, D as CompleteProjectArtifactResponseSchema, Dn as TriggerDetailResponseSchema, Dr as resolveConnectAppSlug, Dt as ListApiKeysResponseSchema, E as ChannelDirectoryListResponseSchema, En as SubmitTeamRequestRequestSchema, Et as ListAgentWorkspaceFilesResponseSchema, F as CreateBillingPortalRequestSchema, Fn as UpdateCredentialInstanceBodySchema, Ft as ListOrganizationMembersPageResponseSchema, G as CreateProjectRequestSchema, Gn as UploadProjectSourceManifestRequestSchema, Gt as OpenApiDiscoverResponseSchema, H as CreateOrganizationRequestSchema, Hn as UpdateProjectMemberResponseSchema, Ht as ManagedServiceCredentialSchema, I as CreateCredentialInstanceBodySchema, In as UpdateCredentialRequestSchema, It as ListOrganizationsResponseSchema, J as CredentialAssignmentListQuerySchema, Jn as UserAvatarPatchSchema, Jt as PROJECT_PULL_STATE_RELATIVE_PATH, K as CreateProjectResponseSchema, Kn as UploadProjectSourceResponseSchema, Kt as OrganizationSidebarBrandingPatchSchema, L as CreateCredentialsRequestSchema, Ln as UpdateManagedServiceCredentialRequestSchema, Lt as ListProjectDeploymentsResponseSchema, M as ConnectProvidersResponseSchema, Mn as TriggerRunListResponseSchema, Mt as ListManagedServiceCredentialsResponseSchema, N as CreateApiKeyRequestSchema, Nn as UpdateAutoTopupRequestSchema, Nt as ListOrganizationInvitationsResponseSchema, O as ConfirmCheckoutRequestSchema, On as TriggerInvokeInputsSchema, Or as resolveDocsMcpUrl, Ot as ListAppsResponseSchema, P as CreateApiKeyResponseSchema, Pn as UpdateChannelBindingBodySchema, Pt as ListOrganizationMembersPageQuerySchema, Q as CredentialConsumerListResponseSchema, Qn as WorkflowCanvasCredentialBindingsSchema, Qt as PresignOrgLogoRequestSchema, R as CreateCredentialsResponseSchema, Rn as UpdateOrganizationMemberRequestSchema, Rt as ListProjectFilesResponseSchema, S as CatalogAppsPageResponseSchema, Sn as StartMcpOAuthConnectionResultSchema, St as InviteProjectMembersRequestSchema, T as ChannelConnectionSchema, Tn as SubmitMarketingContactRequestSchema, Tt as ListAgentMemoryFilesResponseSchema, U as CreateOrganizationResponseSchema, Un as UpdateProjectRequestSchema, Ut as ManagedServiceKindSchema, V as CreateCustomAppResponseSchema, Vn as UpdateProjectMemberRequestSchema, Vt as ListProjectsResponseSchema, W as CreateProjectArtifactResponseSchema, Wn as UpdateProjectSettingsRequestSchema, Wt as McpDiscoverResponseSchema, X as CredentialAssignmentRecordSchema, Xn as UserPreferencesPatchSchema, Xt as PresignChatAttachmentRequestSchema, Y as CredentialAssignmentListResponseSchema, Yn as UserAvatarSchema, Yt as PROJECT_REACHABILITY_REQUEST_TIMEOUT_MS, Z as CredentialConsumerListQuerySchema, Zn as UserPreferencesSchema, Zt as PresignChatAttachmentResponseSchema, _ as BindChannelBodySchema, _n as SkillSummaryListResponseSchema, _r as deriveCustomAppDisplay, _t as HistoryRunDetailResponseSchema, a as AgentSessionListResponseSchema, an as ProjectReachabilityResponseSchema, ar as WorkflowRunListResponseSchema, at as DownloadActiveProjectArtifactResponseSchema, b as CatalogActionsPageResponseSchema, bn as StartKeystrokeConnectionResultSchema, br as listenPortFromPublicUrl, bt as InviteOrganizationMembersRequestSchema, c as AgentTriggerSummaryListResponseSchema, cn as ProjectSlugAvailabilityResponseSchema, cr as WorkflowSummaryListResponseSchema, ct as ExecuteKeystrokeToolRequestSchema, d as AutoTopupSummarySchema, dr as WorkspaceTriggerListResponseSchema, dt as GetAppCatalogEntryResponseSchema, en as PresignProjectSourceRequestSchema, er as WorkflowCanvasSchema, et as CredentialInstanceRecordSchema, f as BillingActivityResponseSchema, fn as QueuedAgentPromptResponseSchema, fr as WorkspaceTriggerOverviewSchema, ft as GetCredentialResponseSchema, g as BillingUsageResponseSchema, gn as SkillSummaryDetailResponseSchema, gt as HistoryRunCancelResponseSchema, h as BillingSummaryResponseSchema, hn as RecentResourceListResponseSchema, hr as buildConnectDeeplink, ht as HealthResponseSchema, i as AgentSessionDetailResponseSchema, in as ProjectPullStateSchema, ir as WorkflowRunInputsSchema, it as DeclineOrganizationInvitationResponseSchema, j as ConnectManagedServiceCredentialRequestSchema, jn as TriggerRunDetailResponseSchema, jt as ListCredentialsPageResponseSchema, k as ConfirmCheckoutResponseSchema, kn as TriggerInvokeResponseSchema, kr as resolvePublicPlatformOrigin, kt as ListChannelPlatformsResponseSchema, l as AppSlugAvailabilityResponseSchema, ln as PromptInputSchema, lr as WorkspaceTriggerDetailSchema, m as BillingRedirectResponseSchema, mr as WorkspaceWorkflowOverviewSchema, mt as GraphqlDiscoverResponseSchema, n as AcceptOrganizationInvitationResponseSchema, nn as PresignUserAvatarRequestSchema, nr as WorkflowRunHooksResponseSchema, nt as DOCS_QUERY_TOOL, o as AgentSummaryDetailResponseSchema, on as ProjectResponseSchema, or as WorkflowRunResponseSchema, ot as DownloadActiveProjectSourceResponseSchema, p as BillingInvoiceUrlResponseSchema, pn as QueuedRunResponseSchema, pr as WorkspaceTriggerRunListResponseSchema, pt as GetCustomAppResponseSchema, q as CreateSubscriptionCheckoutRequestSchema, qn as UpsertGatewayAttachmentBodySchema, qt as OrganizationSidebarBrandingSchema, r as ActiveOrganizationResponseSchema, rn as PresignUserAvatarResponseSchema, rr as WorkflowRunInputsPutBodySchema, rt as DOCS_SEARCH_TOOL, s as AgentSummaryListResponseSchema, sn as ProjectSettingsResponseSchema, sr as WorkflowSummaryDetailResponseSchema, st as ErrorResponseSchema, t as ACTIVE_ORG_HEADER, tn as PresignProjectSourceResponseSchema, tr as WorkflowRunDetailResponseSchema, u as AssignCredentialBodySchema, un as PromptResponseSchema, ur as WorkspaceTriggerFileSchema, ut as GatewayAttachmentRecordSchema, v as CLIENT_CHANNEL_HEADER, vn as SlugAvailabilityResponseSchema, vr as detectProjectPackageManagerFromSnapshot, vt as HistoryRunListQuerySchema, w as ChannelConnectionListResponseSchema, wn as StartOAuthConnectionResultSchema, wr as parseErrorResponse, x as CatalogAppDetailResponseSchema, xn as StartMcpOAuthConnectionInputSchema, xt as InviteOrganizationMembersResponseSchema, y as CatalogActionDetailResponseSchema, yn as StartKeystrokeConnectionInputSchema, yr as isAcceptableInstallExit, yt as HistoryRunListResponseSchema, z as CreateCreditsCheckoutRequestSchema, zn as UpdateOrganizationMemberResponseSchema, zt as ListProjectMembersResponseSchema } from "./dist-BoZPZ9Sz.mjs";
+import { a as alias, c as event, i as packProjectArtifact, l as flushTelemetry, n as withMcpReadClient, o as captureException, r as mergeFilteredArtifact, s as configureTelemetry, t as mapInParallelBatches, u as shutdownTelemetry } from "./dist-De18Uq1U.mjs";
+import { C as getWebUrl, E as resolvePlatformUrlForWebUrl, S as getPlatformUrl, _ as resolveCliRoot, a as formatReleaseAgeBlockMessage, b as getConfigDir, c as detectManagerFromLockfile, d as installDependencies$1, f as installPlaygroundDependencies, g as readCliVersion, h as isNewerVersion, i as fetchLatestCliRelease, l as buildPlaygroundWorkspace, m as resolvePackageManager, n as computeReleaseAgeRetryAfter, o as isReleaseAgeBlock, p as resolveGithubPackagesToken, r as readPnpmMinimumReleaseAgeMinutes, s as detectCliInstall, t as runPackageManagerUpdate, u as detectPackageManager, v as createCliConfig, w as DEFAULT_PLATFORM_URL, x as getEffectiveApiTarget, y as getCliConfigDir } from "./run-package-manager-update-D_jU5wZe.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { platform, release } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { Entry } from "@napi-rs/keyring";
 import { existsSync, lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { AsyncLocalStorage } from "node:async_hooks";
 import { PostHog } from "posthog-node";
 import { pathToFileURL } from "node:url";
 import { access, lstat, mkdir, readFile, readdir, rm, stat, symlink, writeFile } from "node:fs/promises";
@@ -415,7 +414,7 @@ const validateAndMerge = (...sources) => {
 	for (const source of sources) if ((!isObject(source) || Array.isArray(source)) && source !== void 0) throw new TypeError("The `options` argument must be an object");
 	return deepMerge({}, ...sources);
 };
-const mergeHeaders = (source1 = {}, source2 = {}) => {
+const mergeHeaders$1 = (source1 = {}, source2 = {}) => {
 	const result = new globalThis.Headers(source1);
 	const isHeadersInstance = source2 instanceof globalThis.Headers;
 	const source = new globalThis.Headers(source2);
@@ -423,7 +422,7 @@ const mergeHeaders = (source1 = {}, source2 = {}) => {
 	else result.set(key, value);
 	return result;
 };
-const isPlainObject$1 = (value) => {
+const isPlainObject$2 = (value) => {
 	if (!isObject(value) || Array.isArray(value)) return false;
 	const prototype = Object.getPrototypeOf(value);
 	return prototype === Object.prototype || prototype === null;
@@ -437,16 +436,16 @@ const cloneShallow = (value) => {
 	}
 	if (value instanceof globalThis.Headers) return new globalThis.Headers(value);
 	if (Array.isArray(value)) return [...value];
-	if (isPlainObject$1(value)) return { ...value };
+	if (isPlainObject$2(value)) return { ...value };
 	return value;
 };
 const normalizeHeaderObject = (headers) => Object.fromEntries(Object.entries(headers).filter((entry) => entry[1] !== void 0));
 const mergeHeaderContainers = (source1, source2) => {
-	if (isPlainObject$1(source1) && isPlainObject$1(source2)) return normalizeHeaderObject({
+	if (isPlainObject$2(source1) && isPlainObject$2(source2)) return normalizeHeaderObject({
 		...source1,
 		...source2
 	});
-	return mergeHeaders(source1, source2);
+	return mergeHeaders$1(source1, source2);
 };
 function newHookValue(original, incoming, property) {
 	return Object.hasOwn(incoming, property) && incoming[property] === void 0 ? [] : deepMerge(original[property] ?? [], incoming[property] ?? []);
@@ -904,7 +903,7 @@ var Ky = class Ky {
 		if (Object.hasOwn(options, "prefixUrl")) throw new Error(prefixUrlRenamedErrorMessage);
 		this.#options = {
 			...options,
-			headers: mergeHeaders(this.#input.headers, options.headers),
+			headers: mergeHeaders$1(this.#input.headers, options.headers),
 			hooks: mergeHooks({}, options.hooks),
 			method: normalizeRequestMethod(options.method ?? this.#input.method ?? "GET"),
 			prefix: String(options.prefix || ""),
@@ -1721,10 +1720,10 @@ function createJwtTokenCache(mint) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/version.mjs
-const PACKAGE_VERSION = "1.6.11";
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/version.mjs
+const PACKAGE_VERSION = "1.6.23";
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.4.3/node_modules/better-call/dist/error.mjs
+//#region ../../node_modules/.pnpm/better-call@1.3.7_zod@4.4.3/node_modules/better-call/dist/error.mjs
 function isErrorStackTraceLimitWritable() {
 	const desc = Object.getOwnPropertyDescriptor(Error, "stackTraceLimit");
 	if (desc === void 0) return Object.isExtensible(Error);
@@ -1836,7 +1835,7 @@ var InternalAPIError = class extends Error {
 };
 makeErrorForHideStackFrame(InternalAPIError, Error);
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+core@1.6.11_@better-auth+utils@0.4.0_@better-fetch+fetch@1.1.21_@opentelem_3f357e8652888625f393bee0c48e5205/node_modules/@better-auth/core/dist/error/index.mjs
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.23_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_398718bcf9b56a2240f5e645ad2d451e/node_modules/@better-auth/core/dist/error/index.mjs
 var BetterAuthError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -1846,7 +1845,7 @@ var BetterAuthError = class extends Error {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/plugins/device-authorization/client.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/plugins/device-authorization/client.mjs
 const deviceAuthorizationClient = () => {
 	return {
 		id: "device-authorization",
@@ -1862,6 +1861,175 @@ const deviceAuthorizationClient = () => {
 	};
 };
 //#endregion
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.23_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_398718bcf9b56a2240f5e645ad2d451e/node_modules/@better-auth/core/dist/env/env-impl.mjs
+const _envShim = Object.create(null);
+const _getEnv = (useShim) => globalThis.process?.env || globalThis.Deno?.env.toObject() || globalThis.__env__ || (useShim ? _envShim : globalThis);
+const env = new Proxy(_envShim, {
+	get(_, prop) {
+		return _getEnv()[prop] ?? _envShim[prop];
+	},
+	has(_, prop) {
+		return prop in _getEnv() || prop in _envShim;
+	},
+	set(_, prop, value) {
+		const env = _getEnv(true);
+		env[prop] = value;
+		return true;
+	},
+	deleteProperty(_, prop) {
+		if (!prop) return false;
+		const env = _getEnv(true);
+		delete env[prop];
+		return true;
+	},
+	ownKeys() {
+		const env = _getEnv(true);
+		return Object.keys(env);
+	}
+});
+env.NODE_ENV;
+/**
+* Get environment variable with fallback
+*/
+function getEnvVar(key, fallback) {
+	if (typeof process !== "undefined" && process.env) return process.env[key] ?? fallback;
+	if (typeof Deno !== "undefined") return Deno.env.get(key) ?? fallback;
+	if (typeof Bun !== "undefined") return Bun.env[key] ?? fallback;
+	return fallback;
+}
+Object.freeze({
+	get BETTER_AUTH_SECRET() {
+		return getEnvVar("BETTER_AUTH_SECRET");
+	},
+	get AUTH_SECRET() {
+		return getEnvVar("AUTH_SECRET");
+	},
+	get BETTER_AUTH_TELEMETRY() {
+		return getEnvVar("BETTER_AUTH_TELEMETRY");
+	},
+	get BETTER_AUTH_TELEMETRY_ID() {
+		return getEnvVar("BETTER_AUTH_TELEMETRY_ID");
+	},
+	get NODE_ENV() {
+		return getEnvVar("NODE_ENV", "development");
+	},
+	get PACKAGE_VERSION() {
+		return getEnvVar("PACKAGE_VERSION", "0.0.0");
+	},
+	get BETTER_AUTH_TELEMETRY_ENDPOINT() {
+		return getEnvVar("BETTER_AUTH_TELEMETRY_ENDPOINT", "");
+	}
+});
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/utils/url.mjs
+const SLASH_CHAR_CODE = "/".charCodeAt(0);
+function trimTrailingSlashes(value) {
+	let end = value.length;
+	while (end > 0 && value.charCodeAt(end - 1) === SLASH_CHAR_CODE) end--;
+	return end === value.length ? value : value.slice(0, end);
+}
+function checkHasPath(url) {
+	try {
+		return (trimTrailingSlashes(new URL(url).pathname) || "/") !== "/";
+	} catch {
+		throw new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`);
+	}
+}
+function assertHasProtocol(url) {
+	try {
+		const parsedUrl = new URL(url);
+		if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") throw new BetterAuthError(`Invalid base URL: ${url}. URL must include 'http://' or 'https://'`);
+	} catch (error) {
+		if (error instanceof BetterAuthError) throw error;
+		throw new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`, { cause: error });
+	}
+}
+function withPath(url, path = "/api/auth") {
+	assertHasProtocol(url);
+	if (checkHasPath(url)) return url;
+	const trimmedUrl = trimTrailingSlashes(url);
+	if (!path || path === "/") return trimmedUrl;
+	path = path.startsWith("/") ? path : `/${path}`;
+	return `${trimmedUrl}${path}`;
+}
+function validateProxyHeader(header, type) {
+	if (!header || header.trim() === "") return false;
+	if (type === "proto") return header === "http" || header === "https";
+	if (type === "host") {
+		if ([
+			/\.\./,
+			/\0/,
+			/[\s]/,
+			/^[.]/,
+			/[<>'"]/,
+			/javascript:/i,
+			/file:/i,
+			/data:/i
+		].some((pattern) => pattern.test(header))) return false;
+		return /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(:[0-9]{1,5})?$/.test(header) || /^(\d{1,3}\.){3}\d{1,3}(:[0-9]{1,5})?$/.test(header) || /^\[[0-9a-fA-F:]+\](:[0-9]{1,5})?$/.test(header) || /^localhost(:[0-9]{1,5})?$/i.test(header);
+	}
+	return false;
+}
+function getBaseURL(url, path, request, loadEnv, trustedProxyHeaders) {
+	if (url) return withPath(url, path);
+	if (loadEnv !== false) {
+		const fromEnv = env.BETTER_AUTH_URL || env.NEXT_PUBLIC_BETTER_AUTH_URL || env.PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_AUTH_URL || (env.BASE_URL !== "/" ? env.BASE_URL : void 0);
+		if (fromEnv) return withPath(fromEnv, path);
+	}
+	const fromRequest = request?.headers.get("x-forwarded-host");
+	const fromRequestProto = request?.headers.get("x-forwarded-proto");
+	if (fromRequest && fromRequestProto && trustedProxyHeaders) {
+		if (validateProxyHeader(fromRequestProto, "proto") && validateProxyHeader(fromRequest, "host")) try {
+			return withPath(`${fromRequestProto}://${fromRequest}`, path);
+		} catch (_error) {}
+	}
+	if (request) {
+		const url = getOrigin(request.url);
+		if (!url) throw new BetterAuthError("Could not get origin from request. Please provide a valid base URL.");
+		return withPath(url, path);
+	}
+	if (typeof window !== "undefined" && window.location) return withPath(window.location.origin, path);
+}
+function getOrigin(url) {
+	try {
+		const parsedUrl = new URL(url);
+		return parsedUrl.origin === "null" ? null : parsedUrl.origin;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.23_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_398718bcf9b56a2240f5e645ad2d451e/node_modules/@better-auth/core/dist/utils/url.mjs
+/**
+* Schemes that execute or embed code when navigated to or accepted as a
+* redirect target. These are never safe as an OAuth `redirect_uri` or as a
+* client-side navigation target (`window.location.href`, `location.assign`, ...).
+*/
+const DANGEROUS_URL_SCHEMES = [
+	"javascript:",
+	"data:",
+	"vbscript:"
+];
+/**
+* Returns `false` only when `value` is an absolute URL using a dangerous scheme
+* (`javascript:`, `data:`, `vbscript:`). Relative URLs (e.g. `/dashboard`) and
+* safe absolute schemes (`http`, `https`, custom app schemes such as
+* `myapp://`) return `true`.
+*
+* Use this to guard browser navigation sinks and any redirect target that may
+* originate from untrusted input. It is intentionally narrow: it blocks code
+* execution schemes without rejecting relative paths or mobile deep links.
+*/
+function isSafeUrlScheme(value) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return true;
+	}
+	return !DANGEROUS_URL_SCHEMES.includes(parsed.protocol);
+}
+//#endregion
 //#region ../../node_modules/.pnpm/nanostores@1.3.0/node_modules/nanostores/clean-stores/index.js
 const clean = Symbol("clean");
 //#endregion
@@ -1924,6 +2092,7 @@ const atom = /* @__NO_SIDE_EFFECTS__ */ (initialValue) => {
 };
 //#endregion
 //#region ../../node_modules/.pnpm/nanostores@1.3.0/node_modules/nanostores/lifecycle/index.js
+const SET = 2;
 const MOUNT = 5;
 const UNMOUNT = 6;
 const REVERT_MUTATION = 10;
@@ -1948,6 +2117,40 @@ let on = (object, listener, eventKey, mutateStore) => {
 		}
 	};
 };
+let onSet = ($store, listener) => on($store, listener, SET, (runListeners) => {
+	let originSet = $store.set;
+	let originSetKey = $store.setKey;
+	if ($store.setKey) $store.setKey = (changed, changedValue) => {
+		let isAborted;
+		let abort = () => {
+			isAborted = true;
+		};
+		runListeners({
+			abort,
+			changed,
+			newValue: {
+				...$store.value,
+				[changed]: changedValue
+			}
+		});
+		if (!isAborted) return originSetKey(changed, changedValue);
+	};
+	$store.set = (newValue) => {
+		let isAborted;
+		let abort = () => {
+			isAborted = true;
+		};
+		runListeners({
+			abort,
+			newValue
+		});
+		if (!isAborted) return originSet(newValue);
+	};
+	return () => {
+		$store.set = originSet;
+		$store.setKey = originSetKey;
+	};
+});
 const STORE_UNMOUNT_DELAY = 1e3;
 let onMount = ($store, initialize) => {
 	let listener = (payload) => {
@@ -1991,101 +2194,47 @@ let onMount = ($store, initialize) => {
 	});
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/query.mjs
-const isServer = () => typeof window === "undefined";
-const useAuthQuery = (initializedAtom, path, $fetch, options) => {
-	const value = /* @__PURE__ */ atom({
-		data: null,
-		error: null,
-		isPending: true,
-		isRefetching: false,
-		refetch: (queryParams) => fn(queryParams)
-	});
-	const fn = async (queryParams) => {
-		return new Promise((resolve) => {
-			const opts = typeof options === "function" ? options({
-				data: value.get().data,
-				error: value.get().error,
-				isPending: value.get().isPending
-			}) : options;
-			$fetch(path, {
-				...opts,
-				query: {
-					...opts?.query,
-					...queryParams?.query
-				},
-				async onSuccess(context) {
-					value.set({
-						data: context.data,
-						error: null,
-						isPending: false,
-						isRefetching: false,
-						refetch: value.value.refetch
-					});
-					await opts?.onSuccess?.(context);
-				},
-				async onError(context) {
-					const { request } = context;
-					const retryAttempts = typeof request.retry === "number" ? request.retry : request.retry?.attempts;
-					const retryAttempt = request.retryAttempt || 0;
-					if (retryAttempts && retryAttempt < retryAttempts) return;
-					const isUnauthorized = context.error.status === 401;
-					value.set({
-						error: context.error,
-						data: isUnauthorized ? null : value.get().data,
-						isPending: false,
-						isRefetching: false,
-						refetch: value.value.refetch
-					});
-					await opts?.onError?.(context);
-				},
-				async onRequest(context) {
-					const currentValue = value.get();
-					value.set({
-						isPending: currentValue.data === null,
-						data: currentValue.data,
-						error: null,
-						isRefetching: true,
-						refetch: value.value.refetch
-					});
-					await opts?.onRequest?.(context);
-				}
-			}).catch((error) => {
-				value.set({
-					error,
-					data: value.get().data,
-					isPending: false,
-					isRefetching: false,
-					refetch: value.value.refetch
-				});
-			}).finally(() => {
-				resolve(void 0);
-			});
-		});
-	};
-	initializedAtom = Array.isArray(initializedAtom) ? initializedAtom : [initializedAtom];
-	let isInitialized = false;
-	for (const initAtom of initializedAtom) initAtom.subscribe(async () => {
-		if (isServer()) return;
-		if (isInitialized) await fn();
-		else onMount(value, () => {
-			const timeoutId = setTimeout(async () => {
-				if (!isInitialized) {
-					isInitialized = true;
-					await fn();
-				}
-			}, 0);
-			return () => {
-				value.off();
-				initAtom.off();
-				clearTimeout(timeoutId);
-			};
-		});
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/equality.mjs
+function isPlainObject$1(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+/**
+* Deep structural equality for JSON-serializable values.
+* Handles: primitives, null, arrays, and plain objects.
+* Short-circuits on referential equality at every recursion level.
+*/
+function isJsonEqual(a, b) {
+	if (a === b) return true;
+	if (Array.isArray(a) && Array.isArray(b)) {
+		if (a.length !== b.length) return false;
+		for (let i = 0; i < a.length; i++) if (!isJsonEqual(a[i], b[i])) return false;
+		return true;
+	}
+	if (isPlainObject$1(a) && isPlainObject$1(b)) {
+		const keysA = Object.keys(a);
+		const keysB = Object.keys(b);
+		if (keysA.length !== keysB.length) return false;
+		for (const key of keysA) if (!(key in b) || !isJsonEqual(a[key], b[key])) return false;
+		return true;
+	}
+	return false;
+}
+/**
+* Attach an equality gate to a nanostores atom via `onSet`.
+* When `isEqual(currentValue, newValue)` returns true, the `set()` call
+* is aborted: no listeners fire, no framework re-renders occur.
+*
+* Returns the unsubscribe function from `onSet`.
+*/
+function withEquality(store, isEqual) {
+	return onSet(store, ({ newValue, abort }) => {
+		if (isEqual(store.value, newValue)) abort();
 	});
-	return value;
-};
+}
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/broadcast-channel.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/broadcast-channel.mjs
 const kBroadcastChannel = Symbol.for("better-auth:broadcast-channel");
 const now$1 = () => Math.floor(Date.now() / 1e3);
 var WindowBroadcastChannel = class {
@@ -2128,7 +2277,7 @@ function getGlobalBroadcastChannel(name = "better-auth.message") {
 	return globalThis[kBroadcastChannel];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/focus-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/focus-manager.mjs
 const kFocusManager = Symbol.for("better-auth:focus-manager");
 var WindowFocusManager = class {
 	listeners = /* @__PURE__ */ new Set();
@@ -2157,7 +2306,7 @@ function getGlobalFocusManager() {
 	return globalThis[kFocusManager];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/online-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/online-manager.mjs
 const kOnlineManager = Symbol.for("better-auth:online-manager");
 var WindowOnlineManager = class {
 	listeners = /* @__PURE__ */ new Set();
@@ -2189,7 +2338,7 @@ function getGlobalOnlineManager() {
 	return globalThis[kOnlineManager];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/parser.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/parser.mjs
 const PROTO_POLLUTION_PATTERNS = {
 	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
 	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
@@ -2225,7 +2374,6 @@ function betterJSONParse(value, options = {}) {
 	const { strict = false, warnings = false, reviver, parseDates = true } = options;
 	if (typeof value !== "string") return value;
 	const trimmed = value.trim();
-	if (trimmed.length > 0 && trimmed[0] === "\"" && trimmed.endsWith("\"") && !trimmed.slice(1, -1).includes("\"")) return trimmed.slice(1, -1);
 	const lowerValue = trimmed.toLowerCase();
 	if (lowerValue.length <= 9 && lowerValue in SPECIAL_VALUES) return SPECIAL_VALUES[lowerValue];
 	if (!JSON_SIGNATURE.test(trimmed)) {
@@ -2259,31 +2407,20 @@ function parseJSON(value, options = { strict: true }) {
 	return betterJSONParse(value, options);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/session-refresh.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/session-refresh.mjs
 const now = () => Math.floor(Date.now() / 1e3);
 /**
-* Normalize $fetch response: `throw: true` returns data directly, otherwise `{ data, error }`.
-*/
-function normalizeSessionResponse(res) {
-	if (typeof res === "object" && res !== null && "data" in res && "error" in res) return res;
-	return {
-		data: res,
-		error: null
-	};
-}
-/**
 * Rate limit: don't refetch on focus if a session request was made within this many seconds
 */
 const FOCUS_REFETCH_RATE_LIMIT_SECONDS = 5;
 function createSessionRefreshManager(opts) {
-	const { sessionAtom, sessionSignal, $fetch, options = {} } = opts;
+	const { fetchSession, shouldPollSession = () => true, sessionSignal, options = {} } = opts;
 	const refetchInterval = options.sessionOptions?.refetchInterval ?? 0;
 	const refetchOnWindowFocus = options.sessionOptions?.refetchOnWindowFocus ?? true;
 	const refetchWhenOffline = options.sessionOptions?.refetchWhenOffline ?? false;
 	const state = {
-		lastSync: 0,
-		lastSessionRequest: 0,
-		cachedSession: void 0
+		isInitialized: false,
+		lastSessionRequest: 0
 	};
 	const shouldRefetch = () => {
 		return refetchWhenOffline || getGlobalOnlineManager().isOnline;
@@ -2291,45 +2428,21 @@ function createSessionRefreshManager(opts) {
 	const triggerRefetch = (event) => {
 		if (!shouldRefetch()) return;
 		if (event?.event === "storage") {
-			state.lastSync = now();
-			sessionSignal.set(!sessionSignal.get());
+			fetchSession();
 			return;
 		}
-		const currentSession = sessionAtom.get();
-		const fetchSessionWithRefresh = () => {
-			state.lastSessionRequest = now();
-			$fetch("/get-session").then(async (res) => {
-				let { data, error } = normalizeSessionResponse(res);
-				if (data?.needsRefresh) try {
-					const refreshRes = await $fetch("/get-session", { method: "POST" });
-					({data, error} = normalizeSessionResponse(refreshRes));
-				} catch {}
-				const sessionData = data?.session && data?.user ? data : null;
-				sessionAtom.set({
-					...currentSession,
-					data: sessionData,
-					error
-				});
-				state.lastSync = now();
-				sessionSignal.set(!sessionSignal.get());
-			}).catch(() => {});
-		};
 		if (event?.event === "poll") {
-			fetchSessionWithRefresh();
+			state.lastSessionRequest = now();
+			fetchSession();
 			return;
 		}
 		if (event?.event === "visibilitychange") {
 			if (now() - state.lastSessionRequest < FOCUS_REFETCH_RATE_LIMIT_SECONDS) return;
 			state.lastSessionRequest = now();
-		}
-		if (event?.event === "visibilitychange") {
-			fetchSessionWithRefresh();
+			fetchSession();
 			return;
 		}
-		if (currentSession?.data === null || currentSession?.data === void 0) {
-			state.lastSync = now();
-			sessionSignal.set(!sessionSignal.get());
-		}
+		fetchSession();
 	};
 	const broadcastSessionUpdate = (trigger) => {
 		getGlobalBroadcastChannel().post({
@@ -2340,7 +2453,7 @@ function createSessionRefreshManager(opts) {
 	};
 	const setupPolling = () => {
 		if (refetchInterval && refetchInterval > 0) state.pollInterval = setInterval(() => {
-			if (sessionAtom.get()?.data) triggerRefetch({ event: "poll" });
+			if (shouldPollSession()) triggerRefetch({ event: "poll" });
 		}, refetchInterval * 1e3);
 	};
 	const setupBroadcast = () => {
@@ -2359,16 +2472,25 @@ function createSessionRefreshManager(opts) {
 			if (online) triggerRefetch({ event: "visibilitychange" });
 		});
 	};
+	const setupSignalSubscription = () => {
+		state.unsubscribeSignal = sessionSignal.listen(() => {
+			fetchSession();
+		});
+	};
 	const init = () => {
+		if (state.isInitialized) return;
+		state.isInitialized = true;
 		setupPolling();
 		setupBroadcast();
 		setupFocusRefetch();
 		setupOnlineRefetch();
-		getGlobalBroadcastChannel().setup();
-		getGlobalFocusManager().setup();
-		getGlobalOnlineManager().setup();
+		setupSignalSubscription();
+		state.cleanupBroadcastSetup = getGlobalBroadcastChannel().setup();
+		state.cleanupFocusSetup = getGlobalFocusManager().setup();
+		state.cleanupOnlineSetup = getGlobalOnlineManager().setup();
 	};
 	const cleanup = () => {
+		if (!state.isInitialized) return;
 		if (state.pollInterval) {
 			clearInterval(state.pollInterval);
 			state.pollInterval = void 0;
@@ -2385,9 +2507,24 @@ function createSessionRefreshManager(opts) {
 			state.unsubscribeOnline();
 			state.unsubscribeOnline = void 0;
 		}
-		state.lastSync = 0;
+		if (state.unsubscribeSignal) {
+			state.unsubscribeSignal();
+			state.unsubscribeSignal = void 0;
+		}
+		if (state.cleanupBroadcastSetup) {
+			state.cleanupBroadcastSetup();
+			state.cleanupBroadcastSetup = void 0;
+		}
+		if (state.cleanupFocusSetup) {
+			state.cleanupFocusSetup();
+			state.cleanupFocusSetup = void 0;
+		}
+		if (state.cleanupOnlineSetup) {
+			state.cleanupOnlineSetup();
+			state.cleanupOnlineSetup = void 0;
+		}
+		state.isInitialized = false;
 		state.lastSessionRequest = 0;
-		state.cachedSession = void 0;
 	};
 	return {
 		init,
@@ -2397,144 +2534,12 @@ function createSessionRefreshManager(opts) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+core@1.6.11_@better-auth+utils@0.4.0_@better-fetch+fetch@1.1.21_@opentelem_3f357e8652888625f393bee0c48e5205/node_modules/@better-auth/core/dist/env/env-impl.mjs
-const _envShim = Object.create(null);
-const _getEnv = (useShim) => globalThis.process?.env || globalThis.Deno?.env.toObject() || globalThis.__env__ || (useShim ? _envShim : globalThis);
-const env = new Proxy(_envShim, {
-	get(_, prop) {
-		return _getEnv()[prop] ?? _envShim[prop];
-	},
-	has(_, prop) {
-		return prop in _getEnv() || prop in _envShim;
-	},
-	set(_, prop, value) {
-		const env = _getEnv(true);
-		env[prop] = value;
-		return true;
-	},
-	deleteProperty(_, prop) {
-		if (!prop) return false;
-		const env = _getEnv(true);
-		delete env[prop];
-		return true;
-	},
-	ownKeys() {
-		const env = _getEnv(true);
-		return Object.keys(env);
-	}
-});
-typeof process !== "undefined" && process.env && process.env.NODE_ENV;
-/**
-* Get environment variable with fallback
-*/
-function getEnvVar(key, fallback) {
-	if (typeof process !== "undefined" && process.env) return process.env[key] ?? fallback;
-	if (typeof Deno !== "undefined") return Deno.env.get(key) ?? fallback;
-	if (typeof Bun !== "undefined") return Bun.env[key] ?? fallback;
-	return fallback;
-}
-Object.freeze({
-	get BETTER_AUTH_SECRET() {
-		return getEnvVar("BETTER_AUTH_SECRET");
-	},
-	get AUTH_SECRET() {
-		return getEnvVar("AUTH_SECRET");
-	},
-	get BETTER_AUTH_TELEMETRY() {
-		return getEnvVar("BETTER_AUTH_TELEMETRY");
-	},
-	get BETTER_AUTH_TELEMETRY_ID() {
-		return getEnvVar("BETTER_AUTH_TELEMETRY_ID");
-	},
-	get NODE_ENV() {
-		return getEnvVar("NODE_ENV", "development");
-	},
-	get PACKAGE_VERSION() {
-		return getEnvVar("PACKAGE_VERSION", "0.0.0");
-	},
-	get BETTER_AUTH_TELEMETRY_ENDPOINT() {
-		return getEnvVar("BETTER_AUTH_TELEMETRY_ENDPOINT", "");
-	}
-});
-//#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/utils/url.mjs
-function checkHasPath(url) {
-	try {
-		return (new URL(url).pathname.replace(/\/+$/, "") || "/") !== "/";
-	} catch {
-		throw new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`);
-	}
-}
-function assertHasProtocol(url) {
-	try {
-		const parsedUrl = new URL(url);
-		if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") throw new BetterAuthError(`Invalid base URL: ${url}. URL must include 'http://' or 'https://'`);
-	} catch (error) {
-		if (error instanceof BetterAuthError) throw error;
-		throw new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`, { cause: error });
-	}
-}
-function withPath(url, path = "/api/auth") {
-	assertHasProtocol(url);
-	if (checkHasPath(url)) return url;
-	const trimmedUrl = url.replace(/\/+$/, "");
-	if (!path || path === "/") return trimmedUrl;
-	path = path.startsWith("/") ? path : `/${path}`;
-	return `${trimmedUrl}${path}`;
-}
-function validateProxyHeader(header, type) {
-	if (!header || header.trim() === "") return false;
-	if (type === "proto") return header === "http" || header === "https";
-	if (type === "host") {
-		if ([
-			/\.\./,
-			/\0/,
-			/[\s]/,
-			/^[.]/,
-			/[<>'"]/,
-			/javascript:/i,
-			/file:/i,
-			/data:/i
-		].some((pattern) => pattern.test(header))) return false;
-		return /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(:[0-9]{1,5})?$/.test(header) || /^(\d{1,3}\.){3}\d{1,3}(:[0-9]{1,5})?$/.test(header) || /^\[[0-9a-fA-F:]+\](:[0-9]{1,5})?$/.test(header) || /^localhost(:[0-9]{1,5})?$/i.test(header);
-	}
-	return false;
-}
-function getBaseURL(url, path, request, loadEnv, trustedProxyHeaders) {
-	if (url) return withPath(url, path);
-	if (loadEnv !== false) {
-		const fromEnv = env.BETTER_AUTH_URL || env.NEXT_PUBLIC_BETTER_AUTH_URL || env.PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_AUTH_URL || (env.BASE_URL !== "/" ? env.BASE_URL : void 0);
-		if (fromEnv) return withPath(fromEnv, path);
-	}
-	const fromRequest = request?.headers.get("x-forwarded-host");
-	const fromRequestProto = request?.headers.get("x-forwarded-proto");
-	if (fromRequest && fromRequestProto && trustedProxyHeaders) {
-		if (validateProxyHeader(fromRequestProto, "proto") && validateProxyHeader(fromRequest, "host")) try {
-			return withPath(`${fromRequestProto}://${fromRequest}`, path);
-		} catch (_error) {}
-	}
-	if (request) {
-		const url = getOrigin(request.url);
-		if (!url) throw new BetterAuthError("Could not get origin from request. Please provide a valid base URL.");
-		return withPath(url, path);
-	}
-	if (typeof window !== "undefined" && window.location) return withPath(window.location.origin, path);
-}
-function getOrigin(url) {
-	try {
-		const parsedUrl = new URL(url);
-		return parsedUrl.origin === "null" ? null : parsedUrl.origin;
-	} catch {
-		return null;
-	}
-}
-//#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/fetch-plugins.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/fetch-plugins.mjs
 const redirectPlugin = {
 	id: "redirect",
 	name: "Redirect",
 	hooks: { onSuccess(context) {
-		if (context.data?.url && context.data?.redirect) {
+		if (context.data?.url && context.data?.redirect && isSafeUrlScheme(context.data.url)) {
 			if (typeof window !== "undefined" && window.location) {
 				if (window.location) try {
 					window.location.href = context.data.url;
@@ -2544,21 +2549,146 @@ const redirectPlugin = {
 	} }
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/session-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/session-atom.mjs
+const isServer = () => typeof window === "undefined";
+/**
+* Normalize $fetch response: `throw: true` returns data directly,
+* otherwise `{ data, error }`.
+*/
+function normalizeSessionResponse(res) {
+	if (typeof res === "object" && res !== null && "data" in res && "error" in res) return res;
+	return {
+		data: res,
+		error: null
+	};
+}
+function normalizeSessionData(data) {
+	if (!data) return null;
+	if (data.session === null && data.user === null) return null;
+	return data;
+}
+function isSessionAtomEqual(a, b) {
+	return isJsonEqual(a.data, b.data) && a.error === b.error && a.isPending === b.isPending && a.isRefetching === b.isRefetching && a.refetch === b.refetch;
+}
 function getSessionAtom($fetch, options) {
 	const $signal = /* @__PURE__ */ atom(false);
-	const session = useAuthQuery($signal, "/get-session", $fetch, { method: "GET" });
+	let abortController;
+	const refetch = (queryParams) => fetchSession(queryParams);
+	const session = /* @__PURE__ */ atom({
+		data: null,
+		error: null,
+		isPending: true,
+		isRefetching: false,
+		refetch
+	});
+	withEquality(session, isSessionAtomEqual);
+	const settleAbortedFetch = (controller) => {
+		if (abortController !== controller) return;
+		const current = session.get();
+		abortController = void 0;
+		if (!current.isPending && !current.isRefetching) return;
+		session.set({
+			...current,
+			isPending: false,
+			isRefetching: false,
+			refetch
+		});
+	};
+	const fetchSession = async (queryParams) => {
+		abortController?.abort();
+		const controller = new AbortController();
+		abortController = controller;
+		const current = session.get();
+		session.set({
+			...current,
+			isPending: current.data === null,
+			isRefetching: true,
+			error: null,
+			refetch
+		});
+		try {
+			const res = await $fetch("/get-session", {
+				method: "GET",
+				query: queryParams?.query,
+				signal: controller.signal
+			});
+			if (controller.signal.aborted) {
+				settleAbortedFetch(controller);
+				return;
+			}
+			let { data, error } = normalizeSessionResponse(res);
+			if (data?.needsRefresh) try {
+				const refreshRes = await $fetch("/get-session", {
+					method: "POST",
+					signal: controller.signal
+				});
+				if (controller.signal.aborted) {
+					settleAbortedFetch(controller);
+					return;
+				}
+				({data, error} = normalizeSessionResponse(refreshRes));
+			} catch {
+				if (controller.signal.aborted) {
+					settleAbortedFetch(controller);
+					return;
+				}
+			}
+			if (error) {
+				const latest = session.get();
+				const isUnauthorized = error?.status === 401;
+				session.set({
+					data: isUnauthorized ? null : latest.data,
+					error,
+					isPending: false,
+					isRefetching: false,
+					refetch
+				});
+				return;
+			}
+			const sessionData = normalizeSessionData(data);
+			const current = session.get();
+			const stableData = current.data != null && sessionData != null && isJsonEqual(current.data, sessionData) ? current.data : sessionData;
+			session.set({
+				data: stableData,
+				error: null,
+				isPending: false,
+				isRefetching: false,
+				refetch
+			});
+		} catch (fetchError) {
+			if (controller.signal.aborted) {
+				settleAbortedFetch(controller);
+				return;
+			}
+			const latest = session.get();
+			session.set({
+				data: latest.data,
+				error: fetchError,
+				isPending: false,
+				isRefetching: false,
+				refetch
+			});
+		}
+	};
 	let broadcastSessionUpdate = () => {};
 	onMount(session, () => {
+		let timeoutId;
+		if (!isServer()) timeoutId = setTimeout(() => {
+			fetchSession();
+		}, 0);
 		const refreshManager = createSessionRefreshManager({
-			sessionAtom: session,
+			fetchSession,
+			shouldPollSession: () => session.get().data != null,
 			sessionSignal: $signal,
-			$fetch,
 			options
 		});
 		refreshManager.init();
 		broadcastSessionUpdate = refreshManager.broadcastSessionUpdate;
 		return () => {
+			if (timeoutId) clearTimeout(timeoutId);
+			const controller = abortController;
+			controller?.abort();
+			if (controller) settleAbortedFetch(controller);
 			refreshManager.cleanup();
 		};
 	});
@@ -2597,7 +2727,7 @@ function createDefu(merger) {
 }
 const defu = createDefu();
 //#endregion
-//#region ../../node_modules/.pnpm/@better-fetch+fetch@1.1.21/node_modules/@better-fetch/fetch/dist/index.js
+//#region ../../node_modules/.pnpm/@better-fetch+fetch@1.3.1/node_modules/@better-fetch/fetch/dist/index.js
 var __defProp = Object.defineProperty;
 var __defProps = Object.defineProperties;
 var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
@@ -2764,13 +2894,25 @@ function getFetch(options) {
 	if (typeof window !== "undefined" && isFunction(window.fetch)) return window.fetch;
 	throw new Error("No fetch implementation found");
 }
+function mergeHeaders(...sources) {
+	const merged = {};
+	for (const source of sources) {
+		if (!source) continue;
+		if (source instanceof Headers) source.forEach((value, key) => {
+			merged[key] = value;
+		});
+		else {
+			const entries = Array.isArray(source) ? source : Object.entries(source);
+			for (const [key, value] of entries) if (value !== null && value !== void 0) merged[key] = value;
+		}
+	}
+	return merged;
+}
 async function getHeaders(opts) {
-	const headers = new Headers(opts == null ? void 0 : opts.headers);
-	const authHeader = await getAuthHeader(opts);
-	for (const [key, value] of Object.entries(authHeader || {})) headers.set(key, value);
+	const headers = new Headers(mergeHeaders(opts == null ? void 0 : opts.headers, await getAuthHeader(opts)));
 	if (!headers.has("content-type")) {
-		const t = detectContentType(opts == null ? void 0 : opts.body);
-		if (t) headers.set("content-type", t);
+		const contentType = detectContentType(opts == null ? void 0 : opts.body);
+		if (contentType) headers.set("content-type", contentType);
 	}
 	return headers;
 }
@@ -2778,18 +2920,17 @@ function detectContentType(body) {
 	if (isJSONSerializable(body)) return "application/json";
 	return null;
 }
-function getBody(options) {
-	if (!(options == null ? void 0 : options.body)) return null;
-	const headers = new Headers(options == null ? void 0 : options.headers);
-	if (isJSONSerializable(options.body) && !headers.has("content-type")) {
-		for (const [key, value] of Object.entries(options == null ? void 0 : options.body)) if (value instanceof Date) options.body[key] = value.toISOString();
-		return JSON.stringify(options.body);
-	}
-	if (headers.has("content-type") && headers.get("content-type") === "application/x-www-form-urlencoded") {
-		if (isJSONSerializable(options.body)) return new URLSearchParams(options.body).toString();
-		return options.body;
-	}
-	return options.body;
+function getMediaType(headers) {
+	const contentType = headers.get("content-type");
+	return contentType ? contentType.split(";")[0].trim().toLowerCase() : null;
+}
+function getBody(options, headers) {
+	const { body } = options;
+	if (!body) return null;
+	if (!isJSONSerializable(body)) return body;
+	if (typeof body === "string") return body;
+	if (getMediaType(headers) === "application/x-www-form-urlencoded") return new URLSearchParams(body).toString();
+	return JSON.stringify(body);
 }
 function getMethod$1(url, options) {
 	var _a;
@@ -2851,11 +2992,29 @@ var applySchemaPlugin = (config) => ({
 			if ((_d = schema.config) == null ? void 0 : _d.baseURL) {
 				if (urlKey.startsWith(schema.config.baseURL)) urlKey = urlKey.replace(schema.config.baseURL, "");
 			}
+			if (urlKey.startsWith("/") && urlKey.charAt(1) === "@") urlKey = urlKey.substring(1);
 			const keySchema = schema.schema[urlKey];
 			if (keySchema) {
+				let validatedHeaders = options == null ? void 0 : options.headers;
+				if (keySchema.headers && !(options == null ? void 0 : options.disableValidation)) {
+					const normalizedHeaders = {};
+					if (options == null ? void 0 : options.headers) {
+						if (options.headers instanceof Headers) options.headers.forEach((value, key) => {
+							normalizedHeaders[key.toLowerCase()] = value;
+						});
+						else if (typeof options.headers === "object") {
+							for (const [key, value] of Object.entries(options.headers)) if (value !== null && value !== void 0) normalizedHeaders[key.toLowerCase()] = value;
+						}
+					}
+					const validated = await parseStandardSchema(keySchema.headers, normalizedHeaders);
+					const finalHeaders = {};
+					for (const [key, value] of Object.entries(validated)) finalHeaders[key.toLowerCase()] = value;
+					validatedHeaders = finalHeaders;
+				}
 				let opts = __spreadProps(__spreadValues({}, options), {
 					method: keySchema.method,
-					output: keySchema.output
+					output: keySchema.output,
+					headers: validatedHeaders
 				});
 				if (!(options == null ? void 0 : options.disableValidation)) opts = __spreadProps(__spreadValues({}, opts), {
 					body: keySchema.input ? await parseStandardSchema(keySchema.input, options == null ? void 0 : options.body) : options == null ? void 0 : options.body,
@@ -2876,11 +3035,14 @@ var applySchemaPlugin = (config) => ({
 });
 var createFetch = (config) => {
 	async function $fetch(url, options) {
-		const opts = __spreadProps(__spreadValues(__spreadValues({}, config), options), { plugins: [
-			...(config == null ? void 0 : config.plugins) || [],
-			applySchemaPlugin(config || {}),
-			...(options == null ? void 0 : options.plugins) || []
-		] });
+		const opts = __spreadProps(__spreadValues(__spreadValues({}, config), options), {
+			headers: mergeHeaders(config == null ? void 0 : config.headers, options == null ? void 0 : options.headers),
+			plugins: [
+				...(config == null ? void 0 : config.plugins) || [],
+				applySchemaPlugin(config || {}),
+				...(options == null ? void 0 : options.plugins) || []
+			]
+		});
 		if (config == null ? void 0 : config.catchAllError) try {
 			return await betterFetch(url, opts);
 		} catch (error) {
@@ -2898,6 +3060,13 @@ var createFetch = (config) => {
 	}
 	return $fetch;
 };
+var isReservedPathSegment = (value) => value === "." || value === "..";
+function encodePathSegment(segment, pathParams) {
+	let pathSegment = segment;
+	for (const [key, value] of pathParams) pathSegment = pathSegment.replace(key, value);
+	if (isReservedPathSegment(pathSegment)) throw new TypeError("Path parameters cannot be reserved path segments");
+	return encodeURIComponent(pathSegment);
+}
 function getURL2(url, option) {
 	const { baseURL, params, query } = option || {
 		query: {},
@@ -2922,15 +3091,16 @@ function getURL2(url, option) {
 		} else serializedValue = JSON.stringify(value);
 		queryParams.set(key, serializedValue);
 	}
+	const pathParams = /* @__PURE__ */ new Map();
 	if (params) if (Array.isArray(params)) {
 		const paramPaths = path.split("/").filter((p) => p.startsWith(":"));
 		for (const [index, key] of paramPaths.entries()) {
 			const value = params[index];
-			path = path.replace(key, value);
+			pathParams.set(key, String(value));
 		}
-	} else for (const [key, value] of Object.entries(params)) path = path.replace(`:${key}`, String(value));
-	path = path.split("/").map(encodeURIComponent).join("/");
-	if (path.startsWith("/")) path = path.slice(1);
+	} else for (const [key, value] of Object.entries(params)) pathParams.set(`:${key}`, String(value));
+	path = path.split("/").map((segment) => encodePathSegment(segment, pathParams)).join("/");
+	path = path.replace(/^\/+/, "");
 	let queryParamString = queryParams.toString();
 	queryParamString = queryParamString.length > 0 ? `?${queryParamString}`.replace(/\+/g, "%20") : "";
 	if (!basePath.startsWith("http")) return `${basePath}${path}${queryParamString}`;
@@ -2943,10 +3113,10 @@ var betterFetch = async (url, options) => {
 	const controller = new AbortController();
 	const signal = (_a = opts.signal) != null ? _a : controller.signal;
 	const _url = getURL2(__url, opts);
-	const body = getBody(opts);
 	const headers = await getHeaders(opts);
+	const body = getBody(opts, headers);
 	const method = getMethod$1(__url, opts);
-	let context = __spreadProps(__spreadValues({}, opts), {
+	const context = __spreadProps(__spreadValues({}, opts), {
 		url: _url,
 		headers,
 		body,
@@ -2955,7 +3125,7 @@ var betterFetch = async (url, options) => {
 	});
 	for (const onRequest of hooks.onRequest) if (onRequest) {
 		const res = await onRequest(context);
-		if (typeof res === "object" && res !== null) context = res;
+		if (typeof res === "object" && res !== null) Object.assign(context, res);
 	}
 	if ("pipeTo" in context && typeof context.pipeTo === "function" || typeof ((_b = options == null ? void 0 : options.body) == null ? void 0 : _b.pipe) === "function") {
 		if (!("duplex" in context)) context.duplex = "half";
@@ -3031,7 +3201,7 @@ var betterFetch = async (url, options) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/config.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/config.mjs
 const resolvePublicAuthUrl = (basePath) => {
 	if (typeof process === "undefined") return void 0;
 	const path = basePath ?? "/api/auth";
@@ -3129,12 +3299,25 @@ const getClientConfig = (options, loadEnv) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/utils/is-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/utils/is-atom.mjs
 function isAtom(value) {
 	return typeof value === "object" && value !== null && "get" in value && typeof value.get === "function" && "lc" in value && typeof value.lc === "number";
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/proxy.mjs
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.23_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_@openteleme_398718bcf9b56a2240f5e645ad2d451e/node_modules/@better-auth/core/dist/utils/string.mjs
+function capitalizeFirstLetter(str) {
+	return str.charAt(0).toUpperCase() + str.slice(1);
+}
+const WORD_PATTERN = /[\p{Ll}\d]+|\p{Lu}+(?!\p{Ll})|\p{Lu}[\p{Ll}\d]+|\p{Lo}+/gu;
+const APOSTROPHE_PATTERN = /['\u2019]/g;
+function splitWords(input) {
+	return input.replace(APOSTROPHE_PATTERN, "").match(WORD_PATTERN) ?? [];
+}
+function toKebabCase(input) {
+	return splitWords(input).map((word) => word.toLowerCase()).join("-");
+}
+//#endregion
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/proxy.mjs
 function getMethod(path, knownPathMethods, args) {
 	const method = knownPathMethods[path];
 	const { fetchOptions, query: _query, ...body } = args || {};
@@ -3161,7 +3344,7 @@ function createDynamicPathProxy(routes, client, knownPathMethods, atoms, atomLis
 				return createProxy(fullPath);
 			},
 			apply: async (_, __, args) => {
-				const routePath = "/" + path.map((segment) => segment.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`)).join("/");
+				const routePath = "/" + path.map(toKebabCase).join("/");
 				const arg = args[0] || {};
 				const fetchOptions = args[1] || {};
 				const { query, fetchOptions: argFetchOptions, ...body } = arg;
@@ -3209,12 +3392,7 @@ function createDynamicPathProxy(routes, client, knownPathMethods, atoms, atomLis
 	return createProxy();
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+core@1.6.11_@better-auth+utils@0.4.0_@better-fetch+fetch@1.1.21_@opentelem_3f357e8652888625f393bee0c48e5205/node_modules/@better-auth/core/dist/utils/string.mjs
-function capitalizeFirstLetter(str) {
-	return str.charAt(0).toUpperCase() + str.slice(1);
-}
-//#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.11_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._122a35b1d4615e80ac3ce156f3d09434/node_modules/better-auth/dist/client/vanilla.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.23_@opentelemetry+api@1.9.1_@tanstack+react-start@1.168.26_crossws@0.4._c472a772c8203e3e5cd8f6066a81eb33/node_modules/better-auth/dist/client/vanilla.mjs
 function createAuthClient(options) {
 	const { pluginPathMethods, pluginsActions, pluginsAtoms, $fetch, atomListeners, $store } = getClientConfig(options);
 	const resolvedHooks = {};
@@ -3361,7 +3539,8 @@ function createCliClient(config, options) {
 	return createKeystrokeClient({
 		baseUrl: options.baseUrl,
 		auth: resolveCliAuth(config),
-		getActiveOrganizationId: options.platform ? () => options.organizationId ?? getResolvedOrganizationId() ?? null : void 0
+		getActiveOrganizationId: options.platform ? () => options.organizationId ?? getResolvedOrganizationId() ?? null : void 0,
+		ky: { headers: { [CLIENT_CHANNEL_HEADER]: "cli" } }
 	});
 }
 //#endregion
@@ -4935,7 +5114,8 @@ function createCliPlatformClient(config, options = {}) {
 		baseUrl: platformUrl,
 		auth: toPlatformAuth(resolveCliAuth(config)),
 		refreshBearerToken: () => getCliJwt(platformUrl, true),
-		getActiveOrganizationId: () => options.organizationId === void 0 ? getResolvedOrganizationId() ?? null : options.organizationId
+		getActiveOrganizationId: () => options.organizationId === void 0 ? getResolvedOrganizationId() ?? null : options.organizationId,
+		getExtraHeaders: () => ({ [CLIENT_CHANNEL_HEADER]: "cli" })
 	});
 }
 //#endregion
@@ -5202,88 +5382,6 @@ async function resolveApiTarget(config, options = {}) {
 	return resolvePlatformTarget(config, projectRef);
 }
 //#endregion
-//#region ../../packages/telemetry/dist/index.mjs
-const storage = new AsyncLocalStorage();
-function getTelemetryContext() {
-	return storage.getStore();
-}
-/**
-* Returns true when an error is an expected client/control-flow failure that
-* should not become an Error Tracking issue.
-*/
-function isExpectedError(error) {
-	if (!error || typeof error !== "object") return false;
-	const status = readStatus$1(error);
-	if (status !== void 0 && (status === 0 || status >= 400 && status < 500)) return true;
-	if ("name" in error && typeof error.name === "string") {
-		if (error.name === "AbortError" || error.name === "CanceledError" || error.name === "CancelledError" || error.name === "RunTimeoutError") return true;
-	}
-	return false;
-}
-function readStatus$1(error) {
-	if ("status" in error && typeof error.status === "number") return error.status;
-	if ("statusCode" in error && typeof error.statusCode === "number") return error.statusCode;
-}
-const EVENT_NAME_PATTERN = /^[a-z][a-z0-9_]*(:[a-z][a-z0-9_]*)?$/;
-let sink;
-function configureTelemetry(options) {
-	sink = options.sink;
-}
-async function flushTelemetry() {
-	await sink?.flush?.();
-}
-async function shutdownTelemetry() {
-	const current = sink;
-	sink = void 0;
-	await current?.shutdown?.();
-}
-async function captureException(input) {
-	if (isExpectedError(input.error) || !sink?.captureException) return;
-	const context = getTelemetryContext();
-	const actorId = input.actorId ?? context?.actorId;
-	const analyticsId = input.analyticsId ?? context?.analyticsId;
-	const organizationId = input.organizationId ?? context?.organizationId;
-	const projectId = input.projectId ?? context?.projectId;
-	const sessionId = input.sessionId ?? context?.sessionId;
-	const enriched = {
-		error: input.error,
-		...actorId ? { actorId } : {},
-		...analyticsId ? { analyticsId } : {},
-		...organizationId ? { organizationId } : {},
-		...projectId ? { projectId } : {},
-		...sessionId ? { sessionId } : {},
-		...input.operation ? { operation: input.operation } : {},
-		...input.properties ? { properties: input.properties } : {}
-	};
-	try {
-		await sink.captureException(enriched);
-	} catch (error) {
-		console.error("[telemetry] captureException sink failed", error);
-	}
-}
-async function event(input) {
-	if (!EVENT_NAME_PATTERN.test(input.name)) {
-		console.error(`[telemetry] rejected invalid event name: ${input.name}`);
-		return;
-	}
-	const actorId = input.actorId.trim();
-	if (!actorId) {
-		console.error("[telemetry] rejected event without actorId");
-		return;
-	}
-	if (!sink?.event) return;
-	try {
-		await sink.event({
-			...input,
-			actorId,
-			timestamp: input.timestamp ?? /* @__PURE__ */ new Date(),
-			uuid: input.uuid ?? globalThis.crypto.randomUUID()
-		});
-	} catch (error) {
-		console.error("[telemetry] event sink failed", error);
-	}
-}
-//#endregion
 //#region ../../packages/telemetry/dist/posthog-node.mjs
 const MAX_EVENT_BYTES = 9e5;
 function createPostHogSink(options) {
@@ -5331,6 +5429,21 @@ function createPostHogSink(options) {
 			client.capture(body);
 			if (immediate) await client.flush();
 		},
+		async groupIdentify(input) {
+			client.groupIdentify({
+				groupType: input.groupType,
+				groupKey: input.groupKey,
+				properties: sanitizeProperties(input.properties)
+			});
+			if (immediate) await client.flush();
+		},
+		async alias(input) {
+			client.alias({
+				distinctId: input.distinctId,
+				alias: input.alias
+			});
+			if (immediate) await client.flush();
+		},
 		async flush() {
 			await client.flush();
 		},
@@ -5388,25 +5501,56 @@ function shouldReportCliException(error, context) {
 }
 //#endregion
 //#region src/telemetry/identity.ts
-function getCliTelemetryActorId() {
-	return getOrCreateAnonymousDistinctId();
-}
-function getOrCreateAnonymousDistinctId(configDir = getCliConfigDir()) {
-	const path = join(configDir, "telemetry-distinct-id");
+const ANON_DISTINCT_ID_FILE = "telemetry-distinct-id";
+const USER_ID_FILE = "telemetry-user-id";
+function readTrimmedFile(path) {
 	try {
-		const existing = readFileSync(path, "utf8").trim();
-		if (existing) return existing;
-	} catch {}
-	const id = globalThis.crypto.randomUUID();
+		return readFileSync(path, "utf8").trim() || void 0;
+	} catch {
+		return;
+	}
+}
+function writeSecretFile(path, value, configDir) {
 	try {
 		mkdirSync(configDir, { recursive: true });
-		writeFileSync(path, `${id}\n`, {
+		writeFileSync(path, `${value}\n`, {
 			encoding: "utf8",
 			mode: 384
 		});
 	} catch {}
+}
+function getOrCreateAnonymousDistinctId(configDir = getCliConfigDir()) {
+	const path = join(configDir, ANON_DISTINCT_ID_FILE);
+	const existing = readTrimmedFile(path);
+	if (existing) return existing;
+	const id = globalThis.crypto.randomUUID();
+	writeSecretFile(path, id, configDir);
 	return id;
 }
+/** Persisted authenticated user id when present; otherwise the anonymous distinct id. */
+function getCliTelemetryActor(configDir = getCliConfigDir()) {
+	const userId = readTrimmedFile(join(configDir, USER_ID_FILE));
+	if (userId) return {
+		actorId: userId,
+		anonymous: false
+	};
+	return {
+		actorId: getOrCreateAnonymousDistinctId(configDir),
+		anonymous: true
+	};
+}
+/** Persist the authenticated user id next to the anonymous distinct id. */
+function persistCliTelemetryUserId(userId, configDir = getCliConfigDir()) {
+	const trimmed = userId.trim();
+	if (!trimmed) return;
+	writeSecretFile(join(configDir, USER_ID_FILE), trimmed, configDir);
+}
+/** Clear the authenticated user id on logout (keeps anonymous distinct id). */
+function clearCliTelemetryUserId(configDir = getCliConfigDir()) {
+	try {
+		unlinkSync(join(configDir, USER_ID_FILE));
+	} catch {}
+}
 //#endregion
 //#region src/telemetry/init.ts
 let enabled = false;
@@ -5458,9 +5602,10 @@ async function shutdownCliTelemetry() {
 }
 async function reportCliException(error, context) {
 	if (!enabled || isExpectedCliError(error) || !shouldReportCliException(error, context)) return;
+	const actor = getCliTelemetryActor();
 	await captureException({
 		error,
-		analyticsId: getCliTelemetryActorId(),
+		...actor.anonymous ? { analyticsId: actor.actorId } : { actorId: actor.actorId },
 		organizationId: context.organizationId,
 		projectId: context.projectId,
 		operation: context.operation ?? context.command ?? "cli.command",
@@ -5469,10 +5614,11 @@ async function reportCliException(error, context) {
 }
 async function trackCliEvent(name, input) {
 	if (!enabled) return;
+	const actor = getCliTelemetryActor();
 	await event({
 		name,
-		actorId: getCliTelemetryActorId(),
-		anonymous: true,
+		actorId: actor.actorId,
+		...actor.anonymous ? { anonymous: true } : {},
 		organizationId: input?.organizationId,
 		projectId: input?.projectId,
 		properties: baseProperties({
@@ -5481,6 +5627,21 @@ async function trackCliEvent(name, input) {
 		})
 	});
 }
+/**
+* Stitch anonymous CLI identity to an authenticated user id (fail-open).
+* Persists the user id so later events use it as actorId.
+*/
+async function aliasCliTelemetryUser(userId, configDir) {
+	const trimmed = userId.trim();
+	if (!trimmed) return;
+	const anonymousId = getOrCreateAnonymousDistinctId(configDir);
+	persistCliTelemetryUserId(trimmed, configDir);
+	if (!enabled || anonymousId === trimmed) return;
+	await alias({
+		distinctId: trimmed,
+		alias: anonymousId
+	}).catch(() => {});
+}
 //#endregion
 //#region src/errors/example-input.ts
 function exampleValueFromValidationMessage(message) {
@@ -6995,6 +7156,7 @@ function registerAuthLoginCommand(auth) {
 			setAccessToken(platformUrl, result.accessToken);
 			const user = await getSessionWithBearer(platformUrl, result.accessToken);
 			if (user) {
+				await aliasCliTelemetryUser(user.id);
 				await trackCliEvent("cli:auth_login", { userId: user.id });
 				process.stdout.write(`Logged in as ${user.name} (${user.email})\n`);
 			} else {
@@ -7022,6 +7184,7 @@ function registerAuthLogoutCommand(auth) {
 		const webUrl = options.webUrl ?? getWebUrl(config);
 		const platformUrl = getPlatformUrl(config);
 		clearAccessToken(platformUrl);
+		clearCliTelemetryUserId();
 		process.stdout.write(`${JSON.stringify({
 			authenticated: false,
 			webUrl,
@@ -7173,7 +7336,7 @@ function registerBuildCommand(program) {
 		try {
 			const root = resolveProjectRoot(options.dir);
 			await ensureSdkCurrent(root);
-			const { buildApp } = await import("./dist-C8eO3iET.mjs");
+			const { buildApp } = await import("./dist-yDNd8kGO.mjs");
 			await buildApp({ root });
 			process.stdout.write(`Built ${root}\n`);
 		} catch (error) {
@@ -7298,7 +7461,7 @@ async function sleep(ms) {
 }
 async function buildDeployArchive(client, root, projectId, filter) {
 	if (filter?.length) {
-		const { buildFilteredApp } = await import("./dist-C8eO3iET.mjs");
+		const { buildFilteredApp } = await import("./dist-yDNd8kGO.mjs");
 		const filtered = await buildFilteredApp({
 			root,
 			filter,
@@ -7320,7 +7483,7 @@ async function buildDeployArchive(client, root, projectId, filter) {
 			sourceFiles: filtered.sourceFiles
 		};
 	}
-	const { buildApp } = await import("./dist-C8eO3iET.mjs");
+	const { buildApp } = await import("./dist-yDNd8kGO.mjs");
 	const { sourceFiles } = await buildApp({
 		root,
 		collectSources: true,
@@ -7447,7 +7610,7 @@ function runtimeChildEnv(parentEnv, overrides) {
 //#region src/project/bootstrap-run.ts
 /** Node args + env for `@keystrokehq/build` bootstrap (shared by start + dev). */
 async function resolveBootstrapRun(options) {
-	const { resolveRuntimeBuildArtifact } = await import("./dist-C8eO3iET.mjs");
+	const { resolveRuntimeBuildArtifact } = await import("./dist-yDNd8kGO.mjs");
 	const loader = pathToFileURL(resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/runtime-loader.mjs")).href;
 	const bootstrap = resolveRuntimeBuildArtifact(options.runtimeNodeModules, "dist/standalone-bootstrap.mjs");
 	const args = [`--import=${loader}`];
@@ -7557,6 +7720,7 @@ function resolveDevServerUrl(root, portOverride) {
 	return url.origin;
 }
 async function runDev(options) {
+	trackCliEvent("cli:dev_started").catch(() => {});
 	const root = resolveProjectRoot(options.dir);
 	const runtimeNodeModules = resolveCliRuntimeNodeModules(resolveCliRoot(import.meta.url));
 	ensureNativeDeps(runtimeNodeModules);
@@ -7596,7 +7760,7 @@ async function runDev(options) {
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);
 	try {
-		const { watchApp } = await import("./dist-C8eO3iET.mjs");
+		const { watchApp } = await import("./dist-yDNd8kGO.mjs");
 		await watchApp({
 			root,
 			clean: false,
@@ -8658,7 +8822,7 @@ async function runStart(options) {
 	const apiPort = Number(new URL(serverUrl).port || 80);
 	const runtimeNodeModules = resolveCliRuntimeNodeModules(resolveCliRoot(import.meta.url));
 	ensureNativeDeps(runtimeNodeModules);
-	const { buildApp } = await import("./dist-C8eO3iET.mjs");
+	const { buildApp } = await import("./dist-yDNd8kGO.mjs");
 	await buildApp({
 		root,
 		clean: false
@@ -9396,7 +9560,8 @@ function registerConfigCommand(program) {
 	});
 }
 //#endregion
-//#region src/skills/sync-agents-guide.ts
+//#region src/command-path.ts
+/** Leaf-to-root command names under `keystroke`, e.g. `["auth", "login"]`. */
 function commandPath(command) {
 	const names = [];
 	for (let current = command; current; current = current.parent) {
@@ -9405,6 +9570,8 @@ function commandPath(command) {
 	}
 	return names;
 }
+//#endregion
+//#region src/skills/sync-agents-guide.ts
 function shouldSkipAutoSync(command) {
 	if (process.env.CI === "true" || process.env.CI === "1") return true;
 	if (commandPath(command)[0] === "init") return true;
@@ -9435,6 +9602,7 @@ async function syncAgentsGuide(command) {
 }
 //#endregion
 //#region src/program.ts
+const commandStartTimes = /* @__PURE__ */ new WeakMap();
 function createProgram() {
 	const program = new Command().name("keystroke").description("Build, run, and manage keystroke projects").version(readCliVersion()).option("--project <slug>", "Platform project slug (deploy target or one-off API target)").option("--organization <slug>", "Platform organization slug (org-scoped API target)").option("--local", "Force local keystroke server URL").hook("preAction", async (thisCommand, actionCommand) => {
 		const opts = thisCommand.opts();
@@ -9443,7 +9611,17 @@ function createProgram() {
 			organizationRef: opts.organization,
 			local: opts.local
 		});
+		commandStartTimes.set(actionCommand, Date.now());
 		await syncAgentsGuide(actionCommand);
+	}).hook("postAction", async (_thisCommand, actionCommand) => {
+		const startedAt = commandStartTimes.get(actionCommand);
+		const path = commandPath(actionCommand);
+		if (path.length === 0) return;
+		trackCliEvent("cli:command_ran", { properties: {
+			command_path: path.join(" "),
+			success: !process.exitCode,
+			duration_ms: startedAt !== void 0 ? Date.now() - startedAt : 0
+		} }).catch(() => {});
 	});
 	registerAuthCommand(program);
 	registerConnectCommand(program);
@@ -9476,7 +9654,7 @@ function createProgram() {
 async function runCli(argv) {
 	initCliTelemetry();
 	try {
-		const { maybeAutoUpdate } = await import("./maybe-auto-update-DflBoY7a.mjs");
+		const { maybeAutoUpdate } = await import("./maybe-auto-update-C-HUlgKp.mjs");
 		await maybeAutoUpdate(argv);
 		await createProgram().parseAsync(argv);
 	} finally {