better-near-auth 1.8.3 → 1.10.0

package/README.md

@@ -44,15 +44,46 @@ npm install better-near-auth
             siwn({
                 recipient: "myapp.com",
 
-                // Optional: enable gasless relay
-                relayer: {
-                  whitelistedContracts: ["myapp.near"],
-                },
+                // Optional: enable gasless relay (ephemeral mode by default)
+                relayer: true,
             }),
         ],
     });
     ```
 
+    **Relayer Configuration Options:**
+
+    ```ts
+    // Ephemeral mode (simplest) - auto-generated keypair
+    relayer: true
+
+    // Ephemeral mode (explicit) - same as above with custom settings
+    relayer: {
+      ephemeral: true,
+      whitelistedContracts: ["myapp.near"],
+      maxGasPerTransaction: "300000000000000",
+      maxDepositPerTransaction: "0",
+    }
+
+    // Explicit mode - bring your own key
+    relayer: {
+      accountId: "relayer.myapp.near",
+      privateKey: process.env.RELAYER_PRIVATE_KEY,
+      whitelistedContracts: ["myapp.near"],
+    }
+
+    // Per-network configuration
+    relayer: {
+      mainnet: {
+        whitelistedContracts: ["myapp.near"],
+      },
+      testnet: {
+        whitelistedContracts: ["myapp.testnet"],
+        maxGasPerTransaction: "100000000000000", // lower for testing
+      },
+    }
+    ```
+
 3. Generate the schema to add the necessary fields and tables to the database.
 
   ```bash
@@ -183,15 +214,42 @@ await authClient.near.disconnect();
 
 #### Relayer Configuration
 
+The relayer can be configured in several ways:
+
+| Value | Mode | Description |
+|---|---|---|
+| `true` | Ephemeral | Auto-generated ED25519 keypair (default) |
+| `RelayerEphemeralConfig` | Ephemeral | Ephemeral with custom settings |
+| `RelayerExplicitConfig` | Explicit | Bring your own key |
+| `RelayerDualNetworkConfig` | Mixed | Per-network configuration |
+
+**Ephemeral Config (`RelayerEphemeralConfig`):**
+
+| Option | Type | Default | Description |
+|---|---|---|---|
+| `whitelistedContracts` | `string[]` | — | Restrict relay to these contracts |
+| `maxGasPerTransaction` | `string` | — | Max gas per relayed tx |
+| `maxDepositPerTransaction` | `string` | — | Max deposit per relayed tx |
+
+**Explicit Config (`RelayerExplicitConfig`):**
+
 | Option | Type | Default | Description |
 |---|---|---|---|
-| `accountId` | `string` | — | Named relayer account (explicit mode) |
-| `privateKey` | `string` | — | Base64 private key (explicit mode) |
+| `accountId` | `string` | — | Named relayer account (required) |
+| `privateKey` | `string` | — | Base64 private key (required) |
+| `privateKeys` | `string[]` | — | Multiple keys for rotation |
 | `whitelistedContracts` | `string[]` | — | Restrict relay to these contracts |
 | `maxGasPerTransaction` | `string` | — | Max gas per relayed tx |
 | `maxDepositPerTransaction` | `string` | — | Max deposit per relayed tx |
 
-When `accountId` and `privateKey` are omitted, the relayer starts in **ephemeral mode**: an ED25519 keypair is generated on first startup, the implicit account ID is derived from the public key, and the private key is encrypted with AES-256-GCM (using `BETTER_AUTH_SECRET` as KEK via HKDF-SHA256) and stored in the database. The same keypair is recovered on restart.
+**Dual Network Config (`RelayerDualNetworkConfig`):**
+
+| Option | Type | Default | Description |
+|---|---|---|---|
+| `mainnet` | `RelayerEphemeralConfig \| RelayerExplicitConfig` | — | Mainnet relayer config |
+| `testnet` | `RelayerEphemeralConfig \| RelayerExplicitConfig` | — | Testnet relayer config |
+
+When using `relayer: true` or ephemeral config (no `accountId`/`privateKey`), an ED25519 keypair is generated on first startup, the implicit account ID is derived from the public key, and the private key is encrypted with AES-256-GCM (using `BETTER_AUTH_SECRET` as KEK via HKDF-SHA256) and stored in the database. The same keypair is recovered on restart.
 
 ### Client Options
 
@@ -332,6 +390,10 @@ export const auth = betterAuth({
 
       apiKey: process.env.FASTNEAR_API_KEY,
 
+      // Ephemeral mode (simplest)
+      relayer: true,
+
+      // OR explicit mode
       relayer: {
         accountId: "relayer.myapp.near",
         privateKey: process.env.RELAYER_PRIVATE_KEY,
@@ -339,6 +401,17 @@ export const auth = betterAuth({
         maxGasPerTransaction: "300000000000000",
         maxDepositPerTransaction: "0",
       },
+
+      // OR per-network configuration
+      relayer: {
+        mainnet: {
+          whitelistedContracts: ["myapp.near"],
+        },
+        testnet: {
+          whitelistedContracts: ["myapp.testnet"],
+          maxGasPerTransaction: "100000000000000",
+        },
+      },
     }),
   ],
 });
@@ -378,6 +451,9 @@ The plugin detects the network from the account ID:
 | "Network ID mismatch" | Ensure networkId matches the account's network |
 | Relay fails with "insufficient balance" | Fund the relayer account with NEAR |
 | Relay fails with "contract not whitelisted" | Add `receiverId` to `whitelistedContracts` |
+| Relayer not initializing (ephemeral mode) | Ensure `BETTER_AUTH_SECRET` is set; check startup logs for `[siwn] Relayer initialized` |
+| Empty `relayer_key` table | Relayer config not being passed; use `relayer: true` or provide config object |
+| "BETTER_AUTH_SECRET required" error | Required for ephemeral mode encryption; generate a secure random string |
 
 ## Examples
 

package/dist/index.d.ts

@@ -2,14 +2,27 @@ import type { DBAdapter } from "better-auth/types";
 import z from "zod";
 import { type AccountId, type DualNetworkConfig, type ListAccountsResponseT, type ListedNearAccount, type Profile, type SubAccountConfig } from "./types.js";
 export * from "./types.js";
-export interface RelayerConfig {
-    accountId?: string;
-    privateKey?: string;
+interface RelayerEphemeralConfig {
+    accountId?: never;
+    privateKey?: never;
+    ephemeral?: true;
+    whitelistedContracts?: string[];
+    maxGasPerTransaction?: string;
+    maxDepositPerTransaction?: string;
+}
+interface RelayerExplicitConfig {
+    accountId: string;
+    privateKey: string;
     privateKeys?: string[];
     whitelistedContracts?: string[];
     maxGasPerTransaction?: string;
     maxDepositPerTransaction?: string;
 }
+interface RelayerDualNetworkConfig {
+    mainnet?: RelayerEphemeralConfig | RelayerExplicitConfig;
+    testnet?: RelayerEphemeralConfig | RelayerExplicitConfig;
+}
+export type RelayerConfig = true | RelayerEphemeralConfig | RelayerExplicitConfig | RelayerDualNetworkConfig;
 export interface SIWNPluginOptions {
     recipient?: string;
     recipients?: DualNetworkConfig<string>;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAiB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AASlE,OAAO,CAAC,MAAM,KAAK,CAAC;AAGpB,OAAO,EACN,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EAEtB,KAAK,OAAO,EAGZ,KAAK,gBAAgB,EAqBrB,MAAM,YAAY,CAAC;AACpB,cAAc,YAAY,CAAC;AA8D3B,MAAM,WAAW,aAAa;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAClC;AA8LD,MAAM,WAAW,iBAAiB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACvC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC/D,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QACjC,SAAS,EAAE,SAAS,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,aAAa,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAC3D,OAAO,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;KAC/C,CAAC;IACF,UAAU,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;CACpE;AAED,eAAO,MAAM,IAAI,GAAI,SAAS,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+BA2GvB;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,MAAM,CAAC,EAAE,MAAM,CAAA;aAAE;;;;;;;;;2DA/OlC,CAAC;;;;4CAGvB,CADF;;;;;;;;;;;qCAWM,CAAC;qCACwB,CAAC;;;;;;;;;iCAQT,CAAA;;;;;;;;;;;qCAMJ,CAAA;qCAEc,CAAC;;;;;;;;;iCAW9B,CAAJ;;;;;;;;;;;qCAMgF,CAAC;qCAG/E,CAAC;;;;;;;;;iCAUW,CAAC;;;;;;;;;;;;;;6EA4BU,CAAC;;;;;;;;;;;;;;4BAeH,CAAC;;;;;;;;;;;;;;;;;;;mCAsBvB,CAAD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCA5M8B,CAAC;iCAIpB,CAAC;;;;;;;;;6BAWC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAfgB,CAAC;iCAIpB,CAAC;;;;;;;;;6BAWC,CAAC;;;;;;;;;;;;;;;;;;;;;iCAfgB,CAAC;iCAIpB,CAAC;;;;;;;;;6BAWC,CAAC;;;;;;;;;;;;;;;;;;;;;;;iCAfgB,CAAC;iCAIpB,CAAC;;;;;;;;;6BAWC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAfgB,CAAC;iCAIpB,CAAC;;;;;;;;;6BAWC,CAAC;;;;;;;;;;;;;;;;;;;iCAfgB,CAAC;iCAIpB,CAAC;;;;;;;;;6BAWC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;iCAfgB,CAAC;iCAIpB,CAAC;;;;;;;;;6BAWC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAfgB,CAAC;iCAIpB,CAAC;;;;;;;;;6BAWC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAfgB,CAAC;iCAIpB,CAAC;;;;;;;;;6BAWC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;iCAfgB,CAAC;iCAIpB,CAAC;;;;;;;;;6BAWC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAfgB,CAAC;iCAIpB,CAAC;;;;;;;;;6BAWC,CAAC;;;;;;;;;;;CA4/Cb,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAiB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AASlE,OAAO,CAAC,MAAM,KAAK,CAAC;AAGpB,OAAO,EACN,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EAEtB,KAAK,OAAO,EAGZ,KAAK,gBAAgB,EAqBrB,MAAM,YAAY,CAAC;AACpB,cAAc,YAAY,CAAC;AA8D3B,UAAU,sBAAsB;IAC/B,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,UAAU,qBAAqB;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,UAAU,wBAAwB;IACjC,OAAO,CAAC,EAAE,sBAAsB,GAAG,qBAAqB,CAAC;IACzD,OAAO,CAAC,EAAE,sBAAsB,GAAG,qBAAqB,CAAC;CACzD;AAED,MAAM,MAAM,aAAa,GACtB,IAAI,GACJ,sBAAsB,GACtB,qBAAqB,GACrB,wBAAwB,CAAC;AAsN5B,MAAM,WAAW,iBAAiB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACvC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC/D,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QACjC,SAAS,EAAE,SAAS,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,aAAa,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAC3D,OAAO,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;KAC/C,CAAC;IACF,UAAU,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;CACpE;AAED,eAAO,MAAM,IAAI,GAAI,SAAS,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+BA2HvB;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,MAAM,CAAC,EAAE,MAAM,CAAA;aAAE;;;;;;;;;2DAxSxD,CAAC;;;;4CACD,CAAD;;;;;;;;;;;qCAYC,CAAF;qCAA8C,CAAC;;;;;;;;;iCAQtB,CAAA;;;;;;;;;;;qCAMiE,CAAC;qCAC5E,CAAC;;;;;;;;;iCAMiC,CAAC;;;;;;;;;;;qCAMtB,CAAC;qCACG,CAAC;;;;;;;;;iCASgB,CAAC;;;;;;;;;;;;;;6EAoB1C,CAAC;;;;;;;;;;;;;;4BAekE,CAAC;;;;;;;;;;;;;;;;;;;mCA0B5D,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAhMhB,CAAC;iCAGO,CAAC;;;;;;;;;6BASQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAZlB,CAAC;iCAGO,CAAC;;;;;;;;;6BASQ,CAAC;;;;;;;;;;;;;;;;;;;;;iCAZlB,CAAC;iCAGO,CAAC;;;;;;;;;6BASQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;iCAZlB,CAAC;iCAGO,CAAC;;;;;;;;;6BASQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAZlB,CAAC;iCAGO,CAAC;;;;;;;;;6BASQ,CAAC;;;;;;;;;;;;;;;;;;;iCAZlB,CAAC;iCAGO,CAAC;;;;;;;;;6BASQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;iCAZlB,CAAC;iCAGO,CAAC;;;;;;;;;6BASQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAZlB,CAAC;iCAGO,CAAC;;;;;;;;;6BASQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAZlB,CAAC;iCAGO,CAAC;;;;;;;;;6BASQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;iCAZlB,CAAC;iCAGO,CAAC;;;;;;;;;6BASQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAZlB,CAAC;iCAGO,CAAC;;;;;;;;;6BASQ,CAAC;;;;;;;;;;;CAgkDjB,CAAC"}

package/dist/index.js

@@ -376,19 +376,29 @@ async function initRelayer(relayerConfig, network, adapter, secret, apiKey, rpcU
 	if (!relayerConfig) return null;
 	const headers = {};
 	if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
-	if (relayerConfig.accountId && (relayerConfig.privateKey || relayerConfig.privateKeys)) {
-		const keys = relayerConfig.privateKeys ?? (relayerConfig.privateKey ? [relayerConfig.privateKey] : []);
+	let networkConfig;
+	if (relayerConfig === true) networkConfig = {};
+	else if ("mainnet" in relayerConfig || "testnet" in relayerConfig) {
+		const dualConfig = relayerConfig;
+		networkConfig = network === "mainnet" ? dualConfig.mainnet : dualConfig.testnet;
+		if (!networkConfig) return null;
+	} else networkConfig = relayerConfig;
+	if ("accountId" in networkConfig && networkConfig.accountId && (networkConfig.privateKey || networkConfig.privateKeys)) {
+		const keys = networkConfig.privateKeys ?? (networkConfig.privateKey ? [networkConfig.privateKey] : []);
 		let keyStore;
-		if (keys.length === 1) keyStore = new InMemoryKeyStore({ [relayerConfig.accountId]: keys[0] });
-		else keyStore = new RotatingKeyStore({ [relayerConfig.accountId]: keys });
+		if (keys.length === 1) keyStore = new InMemoryKeyStore({ [networkConfig.accountId]: keys[0] });
+		else keyStore = new RotatingKeyStore({ [networkConfig.accountId]: keys });
 		const near = createNear(network, headers, rpcUrl, keyStore);
 		const explicitPublicKey = parseKey(keys[0]);
 		return {
 			near,
-			accountId: relayerConfig.accountId,
+			accountId: networkConfig.accountId,
 			network,
 			mode: "explicit",
-			publicKey: explicitPublicKey.publicKey.toString()
+			publicKey: explicitPublicKey.publicKey.toString(),
+			whitelistedContracts: networkConfig.whitelistedContracts,
+			maxGasPerTransaction: networkConfig.maxGasPerTransaction,
+			maxDepositPerTransaction: networkConfig.maxDepositPerTransaction
 		};
 	}
 	const existing = await adapter.findOne({
@@ -413,6 +423,9 @@ async function initRelayer(relayerConfig, network, adapter, secret, apiKey, rpcU
 			network,
 			mode: "ephemeral",
 			publicKey: keyPair.publicKey.toString(),
+			whitelistedContracts: networkConfig.whitelistedContracts,
+			maxGasPerTransaction: networkConfig.maxGasPerTransaction,
+			maxDepositPerTransaction: networkConfig.maxDepositPerTransaction,
 			createdAt: existing.createdAt,
 			lastUsedAt: existing.lastUsedAt
 		};
@@ -447,6 +460,9 @@ async function initRelayer(relayerConfig, network, adapter, secret, apiKey, rpcU
 		network,
 		mode: "ephemeral",
 		publicKey: keyPair.publicKey.toString(),
+		whitelistedContracts: networkConfig.whitelistedContracts,
+		maxGasPerTransaction: networkConfig.maxGasPerTransaction,
+		maxDepositPerTransaction: networkConfig.maxDepositPerTransaction,
 		createdAt,
 		lastUsedAt: createdAt
 	};
@@ -494,7 +510,8 @@ const siwn = (options) => {
 	};
 	const getRelayerConfig = (network) => {
 		if (!options.relayer) return void 0;
-		if ("mainnet" in options.relayer && typeof options.relayer.mainnet === "object") return options.relayer[network];
+		if (options.relayer === true) return true;
+		if ("mainnet" in options.relayer || "testnet" in options.relayer) return options.relayer[network];
 		return options.relayer;
 	};
 	const getRpcUrl = (network) => {
@@ -516,8 +533,12 @@ const siwn = (options) => {
 		const fromSecrets = getParentKey(network);
 		if (fromSecrets) return fromSecrets;
 		const relayerCfg = getRelayerConfig(network);
-		const parent = getSubAccountConfig(network)?.parentAccount ?? relayerCfg?.accountId;
-		if (parent && parent === relayerCfg?.accountId) return relayerCfg.privateKey ?? relayerCfg.privateKeys?.[0];
+		const subAccountCfg = getSubAccountConfig(network);
+		if (!relayerCfg || relayerCfg === true) return void 0;
+		if ("mainnet" in relayerCfg || "testnet" in relayerCfg) return void 0;
+		const explicitCfg = relayerCfg;
+		const parent = subAccountCfg?.parentAccount ?? explicitCfg.accountId;
+		if (parent && parent === explicitCfg.accountId) return explicitCfg.privateKey ?? explicitCfg.privateKeys?.[0];
 	};
 	const primaryNetwork = getSupportedNetworks()[0];
 	const relayerStates = /* @__PURE__ */ new Map();
@@ -528,12 +549,21 @@ const siwn = (options) => {
 		if (relayerStates.has(network)) return relayerStates.get(network) ?? null;
 		const existingInit = relayerInitPromises.get(network);
 		if (existingInit) return existingInit;
-		const initPromise = initRelayer(getRelayerConfig(network), network, adapter, secret, apiKey, getRpcUrl(network)).then((state) => {
+		const relayerCfg = getRelayerConfig(network);
+		const initPromise = initRelayer(relayerCfg, network, adapter, secret, apiKey, getRpcUrl(network)).then((state) => {
 			relayerStates.set(network, state);
 			relayerInitPromises.delete(network);
+			if (state) {
+				console.log(`[siwn] Relayer initialized: ${state.accountId} (${network}, ${state.mode})`);
+				if (state.mode === "ephemeral") {
+					console.log(`[siwn] Fund this account with NEAR to enable gasless relay`);
+					console.log(`[siwn] Private key is encrypted in DB — persists across restarts`);
+				}
+			} else if (relayerCfg) console.warn(`[siwn] Relayer config provided but not initialized for ${network}. Check BETTER_AUTH_SECRET for ephemeral mode.`);
 			return state;
 		}).catch((error) => {
 			relayerInitPromises.delete(network);
+			console.error(`[siwn] Failed to initialize relayer for ${network}:`, error);
 			throw error;
 		});
 		relayerInitPromises.set(network, initPromise);
@@ -1148,29 +1178,34 @@ const siwn = (options) => {
 						status: 401
 					});
 					const relayerConfigForNetwork = getRelayerConfig(network);
-					if (relayerConfigForNetwork?.whitelistedContracts?.length) {
-						if (!relayerConfigForNetwork.whitelistedContracts.includes(delegateAction.receiverId)) throw new APIError("FORBIDDEN", {
+					const isDualNetwork = relayerConfigForNetwork && typeof relayerConfigForNetwork === "object" && ("mainnet" in relayerConfigForNetwork || "testnet" in relayerConfigForNetwork);
+					const configWithLimits = relayerConfigForNetwork && typeof relayerConfigForNetwork === "object" && !isDualNetwork ? relayerConfigForNetwork : void 0;
+					const whitelistedContracts = configWithLimits?.whitelistedContracts;
+					if (whitelistedContracts?.length) {
+						if (!whitelistedContracts.includes(delegateAction.receiverId)) throw new APIError("FORBIDDEN", {
 							message: `Contract ${delegateAction.receiverId} is not whitelisted for relay`,
 							status: 403
 						});
 					}
-					if (relayerConfigForNetwork?.maxGasPerTransaction) {
+					const maxGasPerTransaction = configWithLimits?.maxGasPerTransaction;
+					if (maxGasPerTransaction) {
 						const totalGas = delegateAction.actions.reduce((sum, a) => {
 							return sum + ("functionCall" in a ? a.functionCall.gas : 0n);
 						}, 0n);
-						if (totalGas > BigInt(relayerConfigForNetwork.maxGasPerTransaction)) throw new APIError("BAD_REQUEST", {
-							message: `Transaction gas (${totalGas}) exceeds relayer limit (${relayerConfigForNetwork.maxGasPerTransaction})`,
+						if (totalGas > BigInt(maxGasPerTransaction)) throw new APIError("BAD_REQUEST", {
+							message: `Transaction gas (${totalGas}) exceeds relayer limit (${maxGasPerTransaction})`,
 							status: 400
 						});
 					}
-					if (relayerConfigForNetwork?.maxDepositPerTransaction) {
+					const maxDepositPerTransaction = configWithLimits?.maxDepositPerTransaction;
+					if (maxDepositPerTransaction) {
 						const totalDeposit = delegateAction.actions.reduce((sum, a) => {
 							if ("functionCall" in a) return sum + a.functionCall.deposit;
 							if ("transfer" in a) return sum + a.transfer.deposit;
 							return sum;
 						}, 0n);
-						if (totalDeposit > BigInt(relayerConfigForNetwork.maxDepositPerTransaction)) throw new APIError("BAD_REQUEST", {
-							message: `Transaction deposit (${totalDeposit}) exceeds relayer limit (${relayerConfigForNetwork.maxDepositPerTransaction})`,
+						if (totalDeposit > BigInt(maxDepositPerTransaction)) throw new APIError("BAD_REQUEST", {
+							message: `Transaction deposit (${totalDeposit}) exceeds relayer limit (${maxDepositPerTransaction})`,
 							status: 400
 						});
 					}