@better-auth/infra 0.4.7 → 0.4.9

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-BypXAAvQ.mjs";
-import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-C9Iqqv8l.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CdZodAXp.mjs";
+import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-DDadesq-.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAdapter, getCurrentAuthContext, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
@@ -21,14 +21,18 @@ function resolveConnectionOptions(options) {
 		apiUrl: options?.apiUrl || INFRA_API_URL,
 		kvUrl: options?.kvUrl || INFRA_KV_URL,
 		apiKey: options?.apiKey || env.BETTER_AUTH_API_KEY || "",
-		apiOptions: { timeout: options?.apiOptions?.timeout ?? options?.apiTimeout ?? 3e3 },
+		apiOptions: {
+			timeout: options?.apiOptions?.timeout ?? options?.apiTimeout ?? 3e3,
+			headers: options?.apiOptions?.headers
+		},
 		kvOptions: {
 			timeout: options?.kvOptions?.timeout ?? options?.kvTimeout ?? 1e3,
 			retry: {
 				attempts: options?.kvOptions?.retry?.attempts ?? 2,
 				baseDelay: options?.kvOptions?.retry?.baseDelay ?? 400,
 				maxDelay: options?.kvOptions?.retry?.maxDelay ?? 600
-			}
+			},
+			headers: options?.kvOptions?.headers
 		}
 	};
 }
@@ -56,6 +60,21 @@ function resolveSentinelOptions(options) {
 	};
 }
 //#endregion
+//#region src/types.ts
+/** Type-only cast — does not wrap or mutate ctx. */
+function asInfraContext(ctx) {
+	return ctx;
+}
+/**
+* better-auth createAuthMiddleware with InfraAuthContext on `ctx.context`.
+* Pass-through at runtime — type-only (does not wrap the handler).
+*
+* Prefer this for dash/sentinel/identification hooks. Keep better-auth's
+* createAuthMiddleware where middleware return values must extend AuthContext
+* (e.g. JWT `payload` via `use: [...]`).
+*/
+const createAuthMiddleware$1 = createAuthMiddleware;
+//#endregion
 //#region ../utils/dist/ip.mjs
 /** Platform-set client IP headers (not accepted from clients on the open internet). */
 const DEFAULT_TRUSTED_IP_HEADERS = [
@@ -77,6 +96,91 @@ function resolveClientIpFromHeaders(headers, ipAddressHeaders) {
 	}
 }
 //#endregion
+//#region ../utils/dist/url.mjs
+/**
+* URL helpers: normalization, SSRF-safe parsing/validation, and path/query segments.
+*/
+const HTTP_PROTOCOLS = ["http:", "https:"];
+function isAllowedProtocol(protocol, allowedProtocols) {
+	return (allowedProtocols?.length ? allowedProtocols : HTTP_PROTOCOLS).includes(protocol);
+}
+/** Normalizes a base URL and path by trimming slashes and joining them. */
+function normalizeUrl(base, path) {
+	return `${base.replace(/\/+$/, "")}${path ? `/${path.replace(/^\/+|\/+$/g, "")}` : ""}`;
+}
+function normalizePath(path) {
+	const trimmed = path.trim();
+	if (!trimmed) throw new Error("Path must be a non-empty string");
+	return `/${trimmed.replace(/^\/+|\/+$/g, "")}`;
+}
+/** Normalizes a base URL and path into separate parts and a joined URL. */
+function resolveBaseUrlPath(baseURL, basePath) {
+	const cleanBase = baseURL.trim().replace(/\/+$/, "");
+	const resolvedBasePath = normalizePath(basePath);
+	return {
+		baseURL: cleanBase,
+		basePath: resolvedBasePath,
+		url: normalizeUrl(cleanBase, resolvedBasePath)
+	};
+}
+/** Falls back when basePath is null, undefined, or blank/whitespace. */
+function resolveProjectBasePath(basePath) {
+	return basePath?.trim() || "/api/auth";
+}
+/**
+* Normalized project auth base URL + path (blank basePath → default).
+* If `baseURL` already has a non-root pathname, that path wins over `basePath`
+* (Better Auth path-in-baseURL form).
+*/
+function resolveProjectAuthBase(baseURL, basePath) {
+	try {
+		const url = new URL(baseURL);
+		const pathname = url.pathname.replace(/\/+$/, "") || "";
+		if (pathname && pathname !== "/") return resolveBaseUrlPath(url.origin, pathname);
+		return resolveBaseUrlPath(url.origin, resolveProjectBasePath(basePath));
+	} catch {
+		return resolveBaseUrlPath(baseURL, resolveProjectBasePath(basePath));
+	}
+}
+function toAllowedOriginSet(allowedOrigins) {
+	const set = /* @__PURE__ */ new Set();
+	for (const raw of allowedOrigins) try {
+		const parsed = new URL(raw.trim());
+		if (isAllowedProtocol(parsed.protocol, HTTP_PROTOCOLS)) set.add(parsed.origin);
+	} catch {}
+	return set;
+}
+function isAllowedOrigin(origin, allowedOrigins) {
+	if (!allowedOrigins.length) return false;
+	return toAllowedOriginSet(allowedOrigins).has(origin);
+}
+function safeResolveUrl(raw, baseURL) {
+	const trim = raw.trim();
+	if (!trim) return null;
+	if (trim.startsWith("//") || trim.includes("\\")) return null;
+	if (/[\u0000-\u001F\u007F]/.test(trim)) return null;
+	try {
+		if (trim.startsWith("/")) return new URL(trim, baseURL);
+		return new URL(trim);
+	} catch {
+		return null;
+	}
+}
+function getSafeUniqueOrigins(urls) {
+	return [...toAllowedOriginSet(urls)];
+}
+/**
+* Returns an absolute URL only if its protocol and origin are allowed (after
+* resolving relative paths against `baseURL`). Otherwise returns `null`.
+*/
+function safeUrlParse(input) {
+	if (input.raw == null || input.raw.trim() === "") return null;
+	const target = safeResolveUrl(input.raw, input.baseURL);
+	if (!target || !isAllowedProtocol(target.protocol, input.allowedProtocols)) return null;
+	if (!isAllowedOrigin(target.origin, input.allowedOrigins ?? [])) return null;
+	return target.href;
+}
+//#endregion
 //#region src/events/constants.ts
 const EVENT_TYPES = {
 	USER_CREATED: "user_created",
@@ -1102,7 +1206,7 @@ function shouldRunIdentification(ctx, getRoutes = IDENTIFICATION_GET_ROUTES) {
 * needs it; together they would append duplicate Set-Cookie headers).
 */
 function createIdentificationCookieAfterMiddleware() {
-	return createAuthMiddleware(async (ctx) => {
+	return createAuthMiddleware$1(async (ctx) => {
 		if (ctx.context.infraRidCookieSet) return;
 		ctx.context.infraRidCookieSet = true;
 		const headerRequestId = ctx.request?.headers.get("X-Request-Id");
@@ -1230,7 +1334,7 @@ function resolveUntrustedVisitorId(visitorId, ip, headerVisitorId) {
 */
 function createIdentificationMiddleware($kv, options) {
 	const retry = options?.retry ?? DEFAULT_KV_RETRY;
-	return createAuthMiddleware(async (ctx) => {
+	return createAuthMiddleware$1(async (ctx) => {
 		const skipIdentification = options?.skipIdentification?.(ctx) ?? false;
 		let headerVisitorId = null;
 		let requestId = null;
@@ -1368,7 +1472,8 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 	const resolvedApiUrl = conn.apiUrl || INFRA_API_URL;
 	const emailSender = createEmailSender({
 		apiUrl: resolvedApiUrl,
-		apiKey: conn.apiKey
+		apiKey: conn.apiKey,
+		apiOptions: { headers: conn.apiOptions.headers }
 	});
 	function logEvent(event) {
 		const fullEvent = {
@@ -2475,7 +2580,8 @@ const sentinel = (options) => {
 	const $kv = createKV({
 		kvUrl: opts.kvUrl,
 		apiKey: opts.apiKey,
-		timeout: opts.kvOptions.timeout
+		timeout: opts.kvOptions.timeout,
+		headers: opts.kvOptions.headers
 	});
 	const { tracker } = initTrackEvents($api);
 	const { trackEvent } = tracker;
@@ -2526,7 +2632,7 @@ const sentinel = (options) => {
 		id: "sentinel",
 		init(ctx) {
 			activityTrackingEnabled = (ctx.getPlugin("dash")?.options)?.activityTracking?.enabled === true;
-			const basePath = new URL(ctx.baseURL).pathname;
+			const basePath = ctx.baseURL ? resolveProjectAuthBase(ctx.baseURL, ctx.options.basePath).basePath : resolveProjectBasePath(ctx.options.basePath);
 			const ipHeaders = ctx.options.advanced?.ipAddress?.ipAddressHeaders || null;
 			const disableIpTracking = ctx.options.advanced?.ipAddress?.disableIpTracking === true;
 			/**
@@ -2582,8 +2688,9 @@ const sentinel = (options) => {
 					databaseHooks: {
 						user: {
 							create: {
-								async before(user, ctx) {
-									if (!ctx) return;
+								async before(user, _ctx) {
+									if (!_ctx) return;
+									const ctx = asInfraContext(_ctx);
 									if (isDashRoute(ctx.path)) {
 										if (user.email && typeof user.email === "string" && isEmailNormalizationEnabled(opts.security)) return { data: {
 											...user,
@@ -2617,8 +2724,9 @@ const sentinel = (options) => {
 										email: normalizeEmail(user.email, ctx.context)
 									} };
 								},
-								async after(user, ctx) {
-									if (!ctx || isDashRoute(ctx.path)) return;
+								async after(user, _ctx) {
+									if (!_ctx || isDashRoute(_ctx.path)) return;
+									const ctx = asInfraContext(_ctx);
 									const visitorId = ctx.context.visitorId;
 									const reservationId = ctx.context.freeTrialReservationId;
 									if (visitorId && reservationId && opts.security?.freeTrialAbuse?.enabled) await ctx.context.runInBackgroundOrAwait(securityService.confirmFreeTrialSignup(visitorId, reservationId, user.id, ctx.context.requestId ?? null));
@@ -2633,8 +2741,9 @@ const sentinel = (options) => {
 							} }
 						},
 						session: { create: {
-							async before(session, ctx) {
-								if (!ctx || isDashRoute(ctx.path)) return;
+							async before(session, _ctx) {
+								if (!_ctx || isDashRoute(_ctx.path)) return;
+								const ctx = asInfraContext(_ctx);
 								const visitorId = ctx.context.visitorId;
 								const identification = ctx.context.identification;
 								if (session.userId && identification?.location && visitorId) {
@@ -2666,8 +2775,9 @@ const sentinel = (options) => {
 									}
 								}
 							},
-							async after(session, ctx) {
-								if (!ctx || !session.userId || isDashRoute(ctx.path)) return;
+							async after(session, _ctx) {
+								if (!_ctx || !session.userId || isDashRoute(_ctx.path)) return;
+								const ctx = asInfraContext(_ctx);
 								const visitorId = ctx.context.visitorId;
 								const identification = ctx.context.identification;
 								let user = null;
@@ -2699,7 +2809,7 @@ const sentinel = (options) => {
 				...phoneValidationHooks.before,
 				{
 					matcher: (ctx) => ctx.request?.method !== "GET" && !isDashRoute(ctx.path),
-					handler: createAuthMiddleware(async (ctx) => {
+					handler: createAuthMiddleware$1(async (ctx) => {
 						const visitorId = ctx.context.visitorId;
 						const identification = ctx.context.identification;
 						const ip = ctx.context.ip;
@@ -2759,7 +2869,7 @@ const sentinel = (options) => {
 				},
 				{
 					matcher: (ctx) => !!opts.security?.staleUsers?.enabled && !isDashRoute(ctx.path),
-					handler: createAuthMiddleware(async (ctx) => {
+					handler: createAuthMiddleware$1(async (ctx) => {
 						if (ctx.context.returned instanceof Error) return;
 						const created = ctx.context.newSession;
 						const userId = created?.user?.id ?? created?.session?.userId;
@@ -2806,7 +2916,7 @@ const sentinel = (options) => {
 				},
 				{
 					matcher: (ctx) => ctx.request?.method !== "GET" && !isDashRoute(ctx.path),
-					handler: createAuthMiddleware(async (ctx) => {
+					handler: createAuthMiddleware$1(async (ctx) => {
 						const untrustedVisitorId = ctx.context.untrustedVisitorId;
 						const ip = ctx.context.ip;
 						const body = ctx.body;
@@ -4242,6 +4352,66 @@ const jwtValidateMiddleware = (options) => {
 	});
 };
 //#endregion
+//#region src/lib/safe-url.ts
+function isSafeHttpUrl(value) {
+	try {
+		const url = new URL(value);
+		return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "";
+	} catch {
+		return false;
+	}
+}
+/** http(s) absolute URL without embedded credentials. */
+const safeUrlSchema = z.string().trim().min(1).pipe(z.url().refine(isSafeHttpUrl, { message: "URL must be a valid http(s) URL without credentials" })).transform((value) => new URL(value).href);
+const optionalSafeUrlSchema = z.union([safeUrlSchema, z.literal("")]).optional();
+/**
+* Request-scoped full auth URL (origin + mount). Prefer over `options.baseURL`,
+* which is origin-only or a dynamic config object.
+* BA resolves this before endpoint handlers; missing value is a programming error.
+*/
+function getAuthBaseUrl(ctx) {
+	const resolved = ctx.context.baseURL?.trim();
+	if (!resolved) throw new APIError$1("INTERNAL_SERVER_ERROR", { message: "Auth base URL is not resolved for this request." });
+	return resolved;
+}
+/** App origin for post-auth redirects (not the auth mount path). */
+function getAuthOrigin(ctx) {
+	return new URL(getAuthBaseUrl(ctx)).origin;
+}
+function getAllowedAuthOrigins(ctx, extraOrigins = []) {
+	return getSafeUniqueOrigins([
+		getAuthBaseUrl(ctx),
+		...ctx.context.trustedOrigins ?? [],
+		...extraOrigins
+	]);
+}
+/**
+* Resolve a redirect against the auth server's base URL and trusted origins.
+* Falls back when the target origin is not allowed.
+*/
+function resolveTrustedAuthRedirectUrl(ctx, raw, fallback) {
+	return safeUrlParse({
+		raw,
+		baseURL: getAuthBaseUrl(ctx),
+		allowedOrigins: getAllowedAuthOrigins(ctx)
+	}) ?? fallback;
+}
+/** Returns a trusted redirect URL or null when the origin is not allowed. */
+function parseTrustedAuthRedirectUrl(ctx, raw) {
+	return safeUrlParse({
+		raw,
+		baseURL: getAuthBaseUrl(ctx),
+		allowedOrigins: getAllowedAuthOrigins(ctx)
+	});
+}
+const TRUSTED_CALLBACK_URL_ERROR = "Callback URL must use http(s) and match the auth base URL or a trusted origin.";
+/** Rejects email/redirect callbacks whose origin is not on the auth allowlist. */
+function requireTrustedAuthCallbackUrl(ctx, raw) {
+	const trusted = parseTrustedAuthRedirectUrl(ctx, raw);
+	if (!trusted) throw new APIError$1("BAD_REQUEST", { message: TRUSTED_CALLBACK_URL_ERROR });
+	return trusted;
+}
+//#endregion
 //#region ../utils/dist/semver.mjs
 /**
 * Parses a semver string into components.
@@ -4312,6 +4482,7 @@ const getConfig = (options) => {
 	}, async (ctx) => {
 		const advancedOptions = ctx.context.options.advanced;
 		const organizationPlugin = ctx.context.getPlugin("organization");
+		const authBase = resolveProjectAuthBase(getAuthBaseUrl(ctx), ctx.context.options.basePath);
 		return redactDashSettings({
 			version: ctx.context.version || null,
 			socialProviders: Object.keys(ctx.context.options.socialProviders || {}),
@@ -4381,8 +4552,8 @@ const getConfig = (options) => {
 				deleteUserEnabled: !!ctx.context.options.user?.deleteUser?.enabled,
 				modelName: ctx.context.options.user?.modelName
 			},
-			baseURL: ctx.context.options.baseURL,
-			basePath: ctx.context.options.basePath || "/api/auth",
+			baseURL: authBase.baseURL,
+			basePath: authBase.basePath,
 			emailVerification: { sendVerificationEmailEnabled: !!ctx.context.options.emailVerification?.sendVerificationEmail },
 			insights: {
 				hasDatabase: !!ctx.context.options.database,
@@ -4576,7 +4747,7 @@ const directorySyncClaimsSchema = z.object({
 	setupOperationId: z.string().trim().min(16).max(255).optional()
 });
 function getScimEndpoint$1(baseUrl) {
-	return `${baseUrl}/scim/v2`;
+	return normalizeUrl(baseUrl, "scim/v2");
 }
 function assertDirectorySyncClaims(ctx, organizationId) {
 	const claims = ctx.context.payload;
@@ -5478,7 +5649,7 @@ async function scimProviderExists(ctx, organizationId, providerId) {
 	}) != null;
 }
 function getScimEndpoint(baseUrl) {
-	return `${baseUrl}/scim/v2`;
+	return normalizeUrl(baseUrl, "scim/v2");
 }
 function resolveMode(ctx) {
 	return resolveDirectorySyncMode(getSCIMPlugin(ctx), isManagedDirectorySyncEnabled(ctx));
@@ -6037,105 +6208,6 @@ function allowsPasswordlessInviteComplete(authMode) {
 	return authMode === "create_with_session";
 }
 //#endregion
-//#region ../utils/dist/url.mjs
-/**
-* URL helpers: normalization, SSRF-safe parsing/validation, and path/query segments.
-*/
-const HTTP_PROTOCOLS = ["http:", "https:"];
-function isAllowedProtocol(protocol, allowedProtocols) {
-	return (allowedProtocols?.length ? allowedProtocols : HTTP_PROTOCOLS).includes(protocol);
-}
-function toAllowedOriginSet(allowedOrigins) {
-	const set = /* @__PURE__ */ new Set();
-	for (const raw of allowedOrigins) try {
-		const parsed = new URL(raw.trim());
-		if (isAllowedProtocol(parsed.protocol, HTTP_PROTOCOLS)) set.add(parsed.origin);
-	} catch {}
-	return set;
-}
-function isAllowedOrigin(origin, allowedOrigins) {
-	if (!allowedOrigins.length) return false;
-	return toAllowedOriginSet(allowedOrigins).has(origin);
-}
-function safeResolveUrl(raw, baseURL) {
-	const trim = raw.trim();
-	if (!trim) return null;
-	if (trim.startsWith("//") || trim.includes("\\")) return null;
-	if (/[\u0000-\u001F\u007F]/.test(trim)) return null;
-	try {
-		if (trim.startsWith("/")) return new URL(trim, baseURL);
-		return new URL(trim);
-	} catch {
-		return null;
-	}
-}
-function getSafeUniqueOrigins(urls) {
-	return [...toAllowedOriginSet(urls)];
-}
-/**
-* Returns an absolute URL only if its protocol and origin are allowed (after
-* resolving relative paths against `baseURL`). Otherwise returns `null`.
-*/
-function safeUrlParse(input) {
-	if (input.raw == null || input.raw.trim() === "") return null;
-	const target = safeResolveUrl(input.raw, input.baseURL);
-	if (!target || !isAllowedProtocol(target.protocol, input.allowedProtocols)) return null;
-	if (!isAllowedOrigin(target.origin, input.allowedOrigins ?? [])) return null;
-	return target.href;
-}
-//#endregion
-//#region src/lib/safe-url.ts
-function isSafeHttpUrl(value) {
-	try {
-		const url = new URL(value);
-		return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "";
-	} catch {
-		return false;
-	}
-}
-/** http(s) absolute URL without embedded credentials. */
-const safeUrlSchema = z.string().trim().min(1).pipe(z.url().refine(isSafeHttpUrl, { message: "URL must be a valid http(s) URL without credentials" })).transform((value) => new URL(value).href);
-const optionalSafeUrlSchema = z.union([safeUrlSchema, z.literal("")]).optional();
-function getAuthBaseUrl(ctx) {
-	const baseURL = ctx.context.options.baseURL;
-	return typeof baseURL === "string" && baseURL.trim() ? baseURL : "/";
-}
-function getAllowedAuthOrigins(ctx, extraOrigins = []) {
-	const baseURL = getAuthBaseUrl(ctx);
-	const trusted = ctx.context.options.trustedOrigins;
-	return getSafeUniqueOrigins([
-		baseURL,
-		...Array.isArray(trusted) ? trusted.filter((origin) => typeof origin === "string") : [],
-		...extraOrigins
-	]);
-}
-/**
-* Resolve a redirect against the auth server's base URL and trusted origins.
-* Falls back when the target origin is not allowed.
-*/
-function resolveTrustedAuthRedirectUrl(ctx, raw, fallback) {
-	return safeUrlParse({
-		raw,
-		baseURL: getAuthBaseUrl(ctx),
-		allowedOrigins: getAllowedAuthOrigins(ctx)
-	}) ?? fallback;
-}
-/** Returns a trusted redirect URL or null when the origin is not allowed. */
-function parseTrustedAuthRedirectUrl(ctx, raw) {
-	return safeUrlParse({
-		raw,
-		baseURL: getAuthBaseUrl(ctx),
-		allowedOrigins: getAllowedAuthOrigins(ctx)
-	});
-}
-const TRUSTED_CALLBACK_URL_ERROR = "Callback URL must use http(s) and match the auth base URL or a trusted origin.";
-/** Rejects email/redirect callbacks whose origin is not on the auth allowlist. */
-function requireTrustedAuthCallbackUrl(ctx, raw) {
-	const trusted = parseTrustedAuthRedirectUrl(ctx, raw);
-	if (!trusted) throw new APIError$1("BAD_REQUEST", { message: TRUSTED_CALLBACK_URL_ERROR });
-	return trusted;
-}
-//#endregion
 //#region src/routes/invitations/index.ts
 async function verifyPendingInvitation(token, $api, ctx) {
 	const { data: invitation, error } = await $api("/api/internal/invitations/verify", {
@@ -6181,7 +6253,7 @@ async function executePlatformInvitationCompletion(ctx, $api, invitation, args)
 				user: existingUser
 			});
 		}
-		return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)) };
+		return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthOrigin(ctx)) };
 	}
 	if (!password && !allowsPasswordlessInviteComplete(invitation.authMode)) throw new APIError("BAD_REQUEST", { message: "Password is required to complete this invitation." });
 	const userPayload = {
@@ -6212,7 +6284,7 @@ async function executePlatformInvitationCompletion(ctx, $api, invitation, args)
 			user
 		});
 	}
-	return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)) };
+	return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthOrigin(ctx)) };
 }
 /**
 * Accept invitation endpoint
@@ -6245,14 +6317,14 @@ const acceptInvitation = (options) => {
 					user: existingUser
 				});
 			}
-			const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx));
+			const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthOrigin(ctx));
 			return ctx.redirect(redirectUrl);
 		}
 		if (usesPlatformInviteAcceptFlow(invitation.authMode)) {
 			const platformUrl = options.apiUrl || INFRA_API_URL;
 			const acceptPageUrl = new URL("/invite/accept", platformUrl);
 			acceptPageUrl.searchParams.set("token", token);
-			const callbackUrl = `${ctx.context.options.baseURL}${ctx.context.options.basePath || "/api/auth"}/dash/complete-invitation`;
+			const callbackUrl = normalizeUrl(ctx.context.baseURL, "dash/complete-invitation");
 			acceptPageUrl.searchParams.set("callback", callbackUrl);
 			return ctx.redirect(acceptPageUrl.toString());
 		}
@@ -6280,7 +6352,7 @@ const acceptInvitation = (options) => {
 				user
 			});
 		}
-		const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx));
+		const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthOrigin(ctx));
 		return ctx.redirect(redirectUrl);
 	});
 };
@@ -6360,7 +6432,7 @@ const completeInvitationSocial = (options) => {
 			if (sessionCookieToken) await ctx.context.internalAdapter.deleteSession(sessionCookieToken);
 			deleteSessionCookie(ctx);
 		}
-		return ctx.redirect(resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)));
+		return ctx.redirect(resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthOrigin(ctx)));
 	});
 };
 /**
@@ -8414,7 +8486,7 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 	const ba17OrLater = isBetterAuth17OrLater(ctx.context.version);
 	if (saml17OrNewer && !resolvedEntryPoint) throw ctx.error("BAD_REQUEST", { message: "SAML entry point URL is required; provide entryPoint or IdP metadata with SingleSignOnService Location" });
 	if (ba17OrLater && !idpMetadataXml && !samlConfig.entityId?.trim()) throw ctx.error("BAD_REQUEST", { message: "IdP entity ID is required when IdP metadata XML is not provided" });
-	const spIssuer = `${baseURL}/sso/saml2/sp/metadata?providerId=${providerId}`;
+	const spIssuer = `${normalizeUrl(baseURL, "sso/saml2/sp/metadata")}?providerId=${providerId}`;
 	const idpMetadata = idpMetadataXml ? { metadata: idpMetadataXml } : {
 		...ba17OrLater ? { entityID: samlConfig.entityId } : {},
 		...samlConfig.entryPoint ? { singleSignOnService: [{
@@ -8432,7 +8504,7 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 				entryPoint: resolvedEntryPoint,
 				...samlConfig.cert ? { cert: samlConfig.cert } : {}
 			} : {
-				callbackUrl: `${baseURL}/sso/saml2/sp/acs/${providerId}`,
+				callbackUrl: normalizeUrl(baseURL, `sso/saml2/sp/acs/${providerId}`),
 				spMetadata: {},
 				entryPoint: resolvedEntryPoint ?? "",
 				cert: samlConfig.cert ?? ""
@@ -10525,11 +10597,12 @@ function createSMSSender(config) {
 	if (!apiKey) logger.warn("[Dash] No API key provided for SMS sending. Set BETTER_AUTH_API_KEY environment variable or pass apiKey in config.");
 	const $api = createFetch({
 		baseURL: apiUrl,
+		timeout: config?.apiOptions?.timeout ?? config?.apiTimeout ?? 3e3,
 		headers: {
+			...config?.apiOptions?.headers,
 			"user-agent": INFRA_USER_AGENT,
 			Authorization: `Bearer ${apiKey}`
-		},
-		timeout: config?.apiOptions?.timeout ?? config?.apiTimeout ?? 3e3
+		}
 	});
 	/**
 	* Send an SMS with OTP code
@@ -10622,7 +10695,7 @@ function setPendingSessionTracking(ctx, pending) {
 }
 async function getRequestLocation() {
 	try {
-		return (await getCurrentAuthContext()).context.location;
+		return asInfraContext(await getCurrentAuthContext()).context.location;
 	} catch {
 		return;
 	}
@@ -10638,7 +10711,8 @@ const dash = (options) => {
 	const $kv = createKV({
 		kvUrl: opts.kvUrl,
 		apiKey: opts.apiKey,
-		timeout: opts.kvOptions.timeout
+		timeout: opts.kvOptions.timeout,
+		headers: opts.kvOptions.headers
 	});
 	const activityUpdateInterval = opts.activityTracking?.updateInterval ?? 3e5;
 	const scheduleLastActiveUpdate = async (ctx, userId) => {
@@ -10970,7 +11044,8 @@ const dash = (options) => {
 							const location = ctx.context.location;
 							if (matchesAnyRoute(path, [routes.REQUEST_PASSWORD_RESET])) trackPasswordResetRequest(verification, trigger, ctx, location);
 						} },
-						delete: { async after(verification, ctx) {
+						delete: { async after(verification, _ctx) {
+							const ctx = _ctx;
 							if (!ctx) return;
 							const path = ctx.path;
 							const maybeUserId = ctx.context.session?.user.id ?? "unknown";
@@ -10994,7 +11069,7 @@ const dash = (options) => {
 			after: [
 				{
 					matcher: (ctx) => !!getPendingSessionTracking(ctx),
-					handler: createAuthMiddleware(async (ctx) => {
+					handler: createAuthMiddleware$1(async (ctx) => {
 						const pending = getPendingSessionTracking(ctx);
 						if (!pending) return;
 						trackSessionLifecycle(pending.enrichedSession, pending.userId, ctx, pending.location, resolveUserFromContext(pending.userId, ctx), pending.trackSignIn, pending.impersonatedBy);
@@ -11009,8 +11084,7 @@ const dash = (options) => {
 							routes.DASH_IMPERSONATE_USER
 						]);
 					},
-					handler: createAuthMiddleware(async (_ctx) => {
-						const ctx = _ctx;
+					handler: createAuthMiddleware$1(async (ctx) => {
 						const maybeUserId = ctx.context.session?.user.id ?? "unknown";
 						const trigger = getTriggerInfo(ctx, maybeUserId);
 						if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL, routes.DASH_SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx.context.location);
@@ -11025,7 +11099,7 @@ const dash = (options) => {
 					handler: createIdentificationCookieAfterMiddleware()
 				},
 				{
-					handler: createAuthMiddleware(async (ctx) => {
+					handler: createAuthMiddleware$1(async (ctx) => {
 						if (!opts.activityTracking?.enabled) return;
 						if (activityUpdateInterval === 0) return;
 						const session = ctx.context.session || ctx.context.newSession;

package/dist/native.d.mts

@@ -1,4 +1,4 @@
-import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-Be9mAljS.mjs";
+import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-DgKA4Eq8.mjs";
 import { BetterAuthClientPlugin } from "better-auth";
 //#region src/sentinel/native/client.d.ts
 interface SentinelNativeClientOptions {

package/dist/native.mjs

@@ -1,5 +1,5 @@
-import { o as createKV, t as bytesToHex } from "./crypto-C9Iqqv8l.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-Bk5otjQT.mjs";
+import { o as createKV, t as bytesToHex } from "./crypto-DDadesq-.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-DRUkPcBn.mjs";
 import { env } from "@better-auth/core/env";
 import { Dimensions, InteractionManager, PixelRatio, Platform } from "react-native";
 //#region src/sentinel/native/components.ts

package/dist/{pow-retry-Bk5otjQT.mjs → pow-retry-DRUkPcBn.mjs}

@@ -1,4 +1,4 @@
-import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-C9Iqqv8l.mjs";
+import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-DDadesq-.mjs";
 //#region src/dash-client.ts
 function resolveDashUserId(input, options) {
 	return input.userId || options?.resolveUserId?.({