@better-auth/infra 0.4.8 → 0.4.10

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to `@better-auth/infra` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0/).
 
+## [0.4.10] - 2026-09-21
+
+### Added
+
+- **`GET /dash/directory-sync/connection-count`** — Project-wide directory sync connection count (`{ count, mode }`). Managed mode counts `active` / `decommissioning` connections; legacy mode counts `scimProvider` rows. Returns 404 when directory sync is unavailable.
+
+### Fixed
+
+- **Stored vs resolved auth base** — Platform-stored `baseURL` + `basePath` always rejoin (a path on stored `baseURL` no longer overrides a saved `basePath`). Request-scoped mount resolution still follows Better Auth path-in-`baseURL` via `context.baseURL` (dash config, Sentinel).
+
+## [0.4.9] - 2026-09-09
+
+### Fixed
+
+- **Auth base URL / path** — `GET /dash/config` reports origin + effective mount path when `baseURL` embeds a path or uses dynamic `allowedHosts`. Invitation callbacks, SSO/SCIM endpoint URLs, and Sentinel route matching use the same resolved mount.
+
 ## [0.4.8] - 2026-09-09
 
 ### Added

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-DgKA4Eq8.mjs";
+import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-BfGftEgh.mjs";
 import { BetterFetchPlugin } from "@better-fetch/fetch";
 //#region src/sentinel/client.d.ts
 interface SentinelClientOptions {
@@ -34,9 +34,9 @@ interface SentinelClientOptions {
    */
   onChallengeFailed?: (error: Error) => void;
 }
-declare const sentinelClient: (options?: SentinelClientOptions) => {
+export declare const sentinelClient: (options?: SentinelClientOptions) => {
   id: "sentinel";
   fetchPlugins: BetterFetchPlugin[];
 };
 //#endregion
-export { type DashAuditLog, type DashAuditLogsResponse, type DashClientOptions, type DashGetAllAuditLogsInput, type DashGetAuditLogsInput, type SentinelClientOptions, dashClient, sentinelClient };
+export { type DashAuditLog, type DashAuditLogsResponse, type DashClientOptions, type DashGetAllAuditLogsInput, type DashGetAuditLogsInput, type SentinelClientOptions, dashClient };

package/dist/client.mjs

@@ -1,5 +1,5 @@
-import { n as hash, o as createKV } from "./crypto-DRS7yhmR.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-Di0eUKbA.mjs";
+import { n as hash, o as createKV } from "./crypto-Doziv2tH.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-DIkxDwZf.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts
 function murmurhash3(str, seed = 0) {

package/dist/{constants-C8_UJzzu.mjs → constants-DLZKaIkd.mjs}

@@ -1,7 +1,7 @@
 import { env } from "@better-auth/core/env";
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.4.8";
+const PLUGIN_VERSION = "0.4.10";
 //#endregion
 //#region src/constants.ts
 /**

package/dist/{crypto-DRS7yhmR.mjs → crypto-Doziv2tH.mjs}

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT } from "./constants-C8_UJzzu.mjs";
+import { i as INFRA_USER_AGENT } from "./constants-DLZKaIkd.mjs";
 import { createFetch } from "@better-fetch/fetch";
 import { sha256 } from "@noble/hashes/sha2.js";
 //#region src/fetch.ts

package/dist/email.d.mts

@@ -8,7 +8,7 @@
 /**
  * Email template definitions with their required variables
  */
-declare const EMAIL_TEMPLATES: {
+export declare const EMAIL_TEMPLATES: {
   readonly "verify-email": {
     readonly variables: {
       verificationCode?: string;
@@ -136,14 +136,14 @@ declare const EMAIL_TEMPLATES: {
     };
   };
 };
-type EmailTemplateId = keyof typeof EMAIL_TEMPLATES;
-type EmailTemplateVariables<T extends EmailTemplateId> = (typeof EMAIL_TEMPLATES)[T]["variables"];
-interface SendEmailResult {
+export type EmailTemplateId = keyof typeof EMAIL_TEMPLATES;
+export type EmailTemplateVariables<T extends EmailTemplateId> = (typeof EMAIL_TEMPLATES)[T]["variables"];
+export interface SendEmailResult {
   success: boolean;
   messageId?: string;
   error?: string;
 }
-interface EmailConfig {
+export interface EmailConfig {
   apiKey?: string;
   apiUrl?: string;
   /**
@@ -171,7 +171,7 @@ interface EmailConfig {
 /**
  * Type-safe send email options
  */
-type SendEmailOptions<T extends EmailTemplateId = EmailTemplateId> = {
+export type SendEmailOptions<T extends EmailTemplateId = EmailTemplateId> = {
   /**
    * The template ID to use
    */
@@ -192,7 +192,7 @@ type SendEmailOptions<T extends EmailTemplateId = EmailTemplateId> = {
 /**
  * Options for sending bulk emails
  */
-type SendBulkEmailsOptions<T extends EmailTemplateId = EmailTemplateId> = {
+export type SendBulkEmailsOptions<T extends EmailTemplateId = EmailTemplateId> = {
   /**
    * The template ID to use for all emails
    */
@@ -216,7 +216,7 @@ type SendBulkEmailsOptions<T extends EmailTemplateId = EmailTemplateId> = {
 /**
  * Result of a bulk email send operation
  */
-interface SendBulkEmailsResult {
+export interface SendBulkEmailsResult {
   success: boolean;
   failures?: Record<string, {
     error?: string;
@@ -226,7 +226,7 @@ interface SendBulkEmailsResult {
 /**
  * Create an email sender instance
  */
-declare function createEmailSender(config?: EmailConfig): {
+export declare function createEmailSender(config?: EmailConfig): {
   send: <T extends EmailTemplateId>(options: SendEmailOptions<T>) => Promise<SendEmailResult>;
   sendBulk: <T extends EmailTemplateId>(options: SendBulkEmailsOptions<T>) => Promise<SendBulkEmailsResult>;
   getTemplates: () => Promise<{
@@ -253,7 +253,7 @@ declare function createEmailSender(config?: EmailConfig): {
  * });
  * ```
  */
-declare function sendEmail<T extends EmailTemplateId>(options: SendEmailOptions<T>, config?: EmailConfig): Promise<SendEmailResult>;
+export declare function sendEmail<T extends EmailTemplateId>(options: SendEmailOptions<T>, config?: EmailConfig): Promise<SendEmailResult>;
 /**
  * Send bulk emails using the Better Auth dashboard's email templates.
  *
@@ -270,6 +270,5 @@ declare function sendEmail<T extends EmailTemplateId>(options: SendEmailOptions<
  * });
  * ```
  */
-declare function sendBulkEmails<T extends EmailTemplateId>(options: SendBulkEmailsOptions<T>, config?: EmailConfig): Promise<SendBulkEmailsResult>;
-//#endregion
-export { EMAIL_TEMPLATES, EmailConfig, EmailTemplateId, EmailTemplateVariables, SendBulkEmailsOptions, SendBulkEmailsResult, SendEmailOptions, SendEmailResult, createEmailSender, sendBulkEmails, sendEmail };
+export declare function sendBulkEmails<T extends EmailTemplateId>(options: SendBulkEmailsOptions<T>, config?: EmailConfig): Promise<SendBulkEmailsResult>;
+//#endregion

package/dist/email.mjs

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-C8_UJzzu.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-DLZKaIkd.mjs";
 import { logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { createFetch } from "@better-fetch/fetch";

package/dist/{identify-client-options-DgKA4Eq8.d.mts → identify-client-options-BfGftEgh.d.mts}

@@ -1,4 +1,4 @@
-import { g as KvRetryOptions } from "./types-BkUWsMpe.mjs";
+import { g as KvRetryOptions } from "./types-sFD6YavS.mjs";
 import { BetterAuthClientOptions, ClientStore } from "better-auth";
 import { BetterFetch } from "@better-fetch/fetch";
 //#region src/dash-client.d.ts

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { A as SecurityOptions, C as createAuthMiddleware, D as ImpossibleTravelResult, E as CredentialStuffingResult, M as StaleUserResult, N as ThresholdConfig, O as SecurityEvent, S as asInfraContext, T as CompromisedPasswordResult, _ as KvRetryOptionsResolved, a as DashOptionsInternal, b as SentinelOptions, c as EndpointOptions, d as InfraEndpointContextValue, f as InfraPluginConnectionOptions, g as KvRetryOptions, h as KvOptionsResolved, i as DashOptions, j as SecurityVerdict, k as SecurityEventType, l as InfraAuthContext, m as KvOptions, n as ApiOptions, o as DashOptionsResolved, p as InfraPluginConnectionOptionsInternal, r as ApiOptionsResolved, s as Endpoint, t as APIError, u as InfraEndpointContext, v as LocationData, w as sentinel, x as SentinelOptionsInternal, y as LocationDataContext } from "./types-BkUWsMpe.mjs";
+import { A as SecurityOptions, C as createAuthMiddleware, D as ImpossibleTravelResult, E as CredentialStuffingResult, M as StaleUserResult, N as ThresholdConfig, O as SecurityEvent, S as asInfraContext, T as CompromisedPasswordResult, _ as KvRetryOptionsResolved, a as DashOptionsInternal, b as SentinelOptions, c as EndpointOptions, d as InfraEndpointContextValue, f as InfraPluginConnectionOptions, g as KvRetryOptions, h as KvOptionsResolved, i as DashOptions, j as SecurityVerdict, k as SecurityEventType, l as InfraAuthContext, m as KvOptions, n as ApiOptions, o as DashOptionsResolved, p as InfraPluginConnectionOptionsInternal, r as ApiOptionsResolved, s as Endpoint, t as APIError, u as InfraEndpointContext, v as LocationData, w as sentinel, x as SentinelOptionsInternal, y as LocationDataContext } from "./types-sFD6YavS.mjs";
 import { EMAIL_TEMPLATES, EmailConfig, EmailTemplateId, EmailTemplateVariables, SendBulkEmailsOptions, SendBulkEmailsResult, SendEmailOptions, SendEmailResult, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { Account, AuthContext, GenericEndpointContext, Session, User } from "better-auth";
 import z from "zod";
@@ -30,26 +30,26 @@ interface PoWSolution {
   counter: number;
 }
 /** Default difficulty in bits (18 = ~500ms solve time) */
-declare const DEFAULT_DIFFICULTY = 18;
+export declare const DEFAULT_DIFFICULTY = 18;
 /** Challenge TTL in seconds */
-declare const CHALLENGE_TTL = 60;
+export declare const CHALLENGE_TTL = 60;
 /**
  * Solve a PoW challenge (browser-compatible)
  * This function is designed to run in a browser environment
  */
-declare function solvePoWChallenge(challenge: PoWChallenge): Promise<PoWSolution>;
+export declare function solvePoWChallenge(challenge: PoWChallenge): Promise<PoWSolution>;
 /**
  * Decode a base64-encoded challenge string (browser-compatible)
  */
-declare function decodePoWChallenge(encoded: string): PoWChallenge | null;
+export declare function decodePoWChallenge(encoded: string): PoWChallenge | null;
 /**
  * Encode a solution string (browser-compatible)
  */
-declare function encodePoWSolution(solution: PoWSolution): string;
+export declare function encodePoWSolution(solution: PoWSolution): string;
 /**
  * Verify a PoW solution locally (for testing purposes)
  */
-declare function verifyPoWSolution(nonce: string, counter: number, difficulty: number): Promise<boolean>;
+export declare function verifyPoWSolution(nonce: string, counter: number, difficulty: number): Promise<boolean>;
 //#endregion
 //#region src/sms.d.ts
 /**
@@ -61,7 +61,7 @@ declare function verifyPoWSolution(nonce: string, counter: number, difficulty: n
 /**
  * SMS template definitions with their required variables
  */
-declare const SMS_TEMPLATES: {
+export declare const SMS_TEMPLATES: {
   readonly "phone-verification": {
     readonly variables: {
       code: string;
@@ -140,7 +140,7 @@ interface SendSMSOptions {
 /**
  * Create an SMS sender instance
  */
-declare function createSMSSender(config?: SMSConfig): {
+export declare function createSMSSender(config?: SMSConfig): {
   send: (options: SendSMSOptions) => Promise<SendSMSResult>;
 };
 /**
@@ -171,7 +171,7 @@ declare function createSMSSender(config?: SMSConfig): {
  * });
  * ```
  */
-declare function sendSMS(options: SendSMSOptions, config?: SMSConfig): Promise<SendSMSResult>;
+export declare function sendSMS(options: SendSMSOptions, config?: SMSConfig): Promise<SendSMSResult>;
 //#endregion
 //#region src/routes/auth/types.d.ts
 type DBField = {
@@ -205,7 +205,9 @@ interface DashConfigResponse {
     deleteUserEnabled: boolean;
     modelName?: string;
   };
-  baseURL: unknown;
+  /** Origin only (never the dynamic allowedHosts object). */
+  baseURL: string;
+  /** Mount path; reflects path embedded in baseURL when present. */
   basePath: string;
   emailVerification: {
     sendVerificationEmailEnabled: boolean;
@@ -368,6 +370,10 @@ interface DashDirectoryRegenerateTokenResponse {
   scimToken: string;
   scimEndpoint: string;
 }
+interface DashDirectorySyncConnectionCountResponse {
+  count: number;
+  mode: "managed" | "legacy";
+}
 //#endregion
 //#region src/events/constants.d.ts
 declare const EVENT_TYPES: {
@@ -414,7 +420,7 @@ declare const ORGANIZATION_EVENT_TYPES: {
   readonly ORGANIZATION_TEAM_MEMBER_REMOVED: "organization_team_member_removed";
 };
 /** All audit event type string constants (user + organization). */
-declare const USER_EVENT_TYPES: {
+export declare const USER_EVENT_TYPES: {
   readonly ORGANIZATION_CREATED: "organization_created";
   readonly ORGANIZATION_UPDATED: "organization_updated";
   readonly ORGANIZATION_MEMBER_ADDED: "organization_member_added";
@@ -789,10 +795,10 @@ interface DashCheckUserExistsResponse {
  * @param email - Raw email to normalize
  * @param context - Auth context
  */
-declare function normalizeEmail(email: string, context: AuthContext): string;
+export declare function normalizeEmail(email: string, context: AuthContext): string;
 //#endregion
 //#region src/index.d.ts
-declare const dash: <O extends DashOptions>(options?: O) => {
+export declare const dash: <O extends DashOptions>(options?: O) => {
   id: "dash";
   options: DashOptionsResolved;
   version: string;
@@ -836,7 +842,7 @@ declare const dash: <O extends DashOptions>(options?: O) => {
         };
         session: {
           create: {
-            before(session: {
+            before(_session: {
               id: string;
               createdAt: Date;
               updatedAt: Date;
@@ -845,7 +851,7 @@ declare const dash: <O extends DashOptions>(options?: O) => {
               token: string;
               ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
-            } & Record<string, unknown>, _ctx: GenericEndpointContext | null): Promise<{
+            } & Record<string, unknown>, untypedCtx: GenericEndpointContext | null): Promise<{
               data: {
                 loginMethod: string | null;
               };
@@ -859,7 +865,7 @@ declare const dash: <O extends DashOptions>(options?: O) => {
               token: string;
               ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
-            } & Record<string, unknown>, _ctx: GenericEndpointContext | null): Promise<void>;
+            } & Record<string, unknown>, untypedCtx: GenericEndpointContext | null): Promise<void>;
           };
           delete: {
             after(session: {
@@ -2195,6 +2201,12 @@ declare const dash: <O extends DashOptions>(options?: O) => {
       }>>[];
       body: import("zod").ZodObject<{}, import("zod/v4/core").$strip>;
     }, DirectorySyncConnection>;
+    countDashDirectorySyncConnections: import("better-call").StrictEndpoint<"/dash/directory-sync/connection-count", {
+      method: "GET";
+      use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        payload: Record<string, unknown>;
+      }>>[];
+    }, DashDirectorySyncConnectionCountResponse>;
     dashExecuteAdapter: import("better-call").StrictEndpoint<"/dash/execute-adapter", {
       method: "POST";
       use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -2339,4 +2351,4 @@ declare const dash: <O extends DashOptions>(options?: O) => {
   } : {});
 };
 //#endregion
-export { type APIError, type ApiOptions, type ApiOptionsResolved, CHALLENGE_TTL, type CompromisedPasswordResult, type CredentialStuffingResult, type DBField, DEFAULT_DIFFICULTY, type DashAddTeamMemberResponse, type DashBanManyResponse, type DashCheckUserByEmailResponse, type DashCheckUserExistsResponse, type DashCompleteInvitationResponse, type DashConfigResponse, type DashCreateOrganizationBody, type DashCreateOrganizationResponse, type DashCreateTeamResponse, type DashCreateUserResponse, type DashDeleteManyUsersResponse, type DashDirectoryCreateResponse, type DashDirectoryCredential, type DashDirectoryDeleteResponse, type DashDirectoryEvent, type DashDirectoryEventsResponse, type DashDirectoryItem, type DashDirectoryRegenerateTokenResponse, type DashDirectoryRotateCredentialResponse, type DashDirectorySyncSSOPairing, type DashExecuteAdapterCountResponse, type DashExecuteAdapterFindManyResponse, type DashExecuteAdapterFindOneResponse, type DashExecuteAdapterMutationResponse, type DashExecuteAdapterResponse, type DashExportOrganizationsResponse, type DashIdRow, type DashInviteMemberResponse, type DashMaybeSuccessResponse, type DashOptions, type DashOptionsInternal, type DashOptionsResolved, type DashOrganizationAddMemberResponse, type DashOrganizationDeleteManyResponse, type DashOrganizationDetailResponse, type DashOrganizationInvitationItem, type DashOrganizationInvitationListResponse, type DashOrganizationInvitationStatusItem, type DashOrganizationListResponse, type DashOrganizationMember, type DashOrganizationMemberListItem, type DashOrganizationMemberListResponse, type DashOrganizationMemberUser, type DashOrganizationOptionsResponse, type DashOrganizationTeamItem, type DashOrganizationTeamListResponse, type DashOrganizationUpdateMemberRoleResponse, type DashOrganizationUpdateResponse, type DashSCIMManagedConnectionEventType, type DashSCIMManagedCredentialStatus, type DashSCIMScope, type DashSendManyVerificationEmailsResponse, type DashSessionRevokeManyResponse, type DashSsoCreateProviderResponse, type DashSsoDeleteResponse, type DashSsoMarkDomainVerifiedResponse, type DashSsoProviderItem, type DashSsoProviderSummary, type DashSsoUpdateProviderResponse, type DashSsoVerificationTokenResponse, type DashSsoVerifyDomainResponse, type DashSuccessResponse, type DashTeam, type DashTeamMember, type DashTeamMemberListResponse, type DashTwoFactorBackupCodesResponse, type DashTwoFactorEnableResponse, type DashTwoFactorStatus, type DashTwoFactorTotpViewResponse, type DashUpdateTeamResponse, type DashUpdateUserResponse, type DashUserDetailsResponse, type DashUserGraphDataResponse, type DashUserListResponse, type DashUserOrganizationsResponse, type DashUserRetentionDataResponse, type DashUserStatsActivePeriod, type DashUserStatsResponse, type DashUserStatsSignUpPeriod, type DashValidateResponse, type DirectorySyncConnection, type DirectorySyncConnectionStatus, type DirectorySyncMode, EMAIL_TEMPLATES, type EmailConfig, type EmailTemplateId, type EmailTemplateVariables, type Endpoint, type EndpointOptions, type EventLocation, type EventTypesResponse, type ImpossibleTravelResult, type InfraAuthContext, type InfraEndpointContext, type InfraEndpointContextValue, type InfraPluginConnectionOptions, type InfraPluginConnectionOptionsInternal, type KvOptions, type KvOptionsResolved, type KvRetryOptions, type KvRetryOptionsResolved, type LegacyDashDirectoryCreateResponse, type LegacyDashDirectoryItem, type LocationData, type LocationDataContext, type ORGANIZATION_USER_PREVIEW_SELECT, type OrganizationUserPreview, type PoWChallenge, type PoWSolution, type SCIMPlugin, type SMSConfig, type SMSTemplateId, type SMSTemplateVariables, SMS_TEMPLATES, type SecurityEvent, type SecurityEventType, type SecurityOptions, type SecurityVerdict, type SendBulkEmailsOptions, type SendBulkEmailsResult, type SendEmailOptions, type SendEmailResult, type SendSMSOptions, type SendSMSResult, type SentinelOptions, type SentinelOptionsInternal, type StaleUserResult, type ThresholdConfig, USER_EVENT_TYPES, type UserEvent, type UserEventType, type UserEventsResponse, type asInfraContext, type createAuthMiddleware, createEmailSender, createSMSSender, dash, decodePoWChallenge, encodePoWSolution, normalizeEmail, sendBulkEmails, sendEmail, sendSMS, sentinel, solvePoWChallenge, verifyPoWSolution };
+export { type APIError, type ApiOptions, type ApiOptionsResolved, type CompromisedPasswordResult, type CredentialStuffingResult, type DBField, type DashAddTeamMemberResponse, type DashBanManyResponse, type DashCheckUserByEmailResponse, type DashCheckUserExistsResponse, type DashCompleteInvitationResponse, type DashConfigResponse, type DashCreateOrganizationBody, type DashCreateOrganizationResponse, type DashCreateTeamResponse, type DashCreateUserResponse, type DashDeleteManyUsersResponse, type DashDirectoryCreateResponse, type DashDirectoryCredential, type DashDirectoryDeleteResponse, type DashDirectoryEvent, type DashDirectoryEventsResponse, type DashDirectoryItem, type DashDirectoryRegenerateTokenResponse, type DashDirectoryRotateCredentialResponse, type DashDirectorySyncConnectionCountResponse, type DashDirectorySyncSSOPairing, type DashExecuteAdapterCountResponse, type DashExecuteAdapterFindManyResponse, type DashExecuteAdapterFindOneResponse, type DashExecuteAdapterMutationResponse, type DashExecuteAdapterResponse, type DashExportOrganizationsResponse, type DashIdRow, type DashInviteMemberResponse, type DashMaybeSuccessResponse, type DashOptions, type DashOptionsInternal, type DashOptionsResolved, type DashOrganizationAddMemberResponse, type DashOrganizationDeleteManyResponse, type DashOrganizationDetailResponse, type DashOrganizationInvitationItem, type DashOrganizationInvitationListResponse, type DashOrganizationInvitationStatusItem, type DashOrganizationListResponse, type DashOrganizationMember, type DashOrganizationMemberListItem, type DashOrganizationMemberListResponse, type DashOrganizationMemberUser, type DashOrganizationOptionsResponse, type DashOrganizationTeamItem, type DashOrganizationTeamListResponse, type DashOrganizationUpdateMemberRoleResponse, type DashOrganizationUpdateResponse, type DashSCIMManagedConnectionEventType, type DashSCIMManagedCredentialStatus, type DashSCIMScope, type DashSendManyVerificationEmailsResponse, type DashSessionRevokeManyResponse, type DashSsoCreateProviderResponse, type DashSsoDeleteResponse, type DashSsoMarkDomainVerifiedResponse, type DashSsoProviderItem, type DashSsoProviderSummary, type DashSsoUpdateProviderResponse, type DashSsoVerificationTokenResponse, type DashSsoVerifyDomainResponse, type DashSuccessResponse, type DashTeam, type DashTeamMember, type DashTeamMemberListResponse, type DashTwoFactorBackupCodesResponse, type DashTwoFactorEnableResponse, type DashTwoFactorStatus, type DashTwoFactorTotpViewResponse, type DashUpdateTeamResponse, type DashUpdateUserResponse, type DashUserDetailsResponse, type DashUserGraphDataResponse, type DashUserListResponse, type DashUserOrganizationsResponse, type DashUserRetentionDataResponse, type DashUserStatsActivePeriod, type DashUserStatsResponse, type DashUserStatsSignUpPeriod, type DashValidateResponse, type DirectorySyncConnection, type DirectorySyncConnectionStatus, type DirectorySyncMode, EMAIL_TEMPLATES, type EmailConfig, type EmailTemplateId, type EmailTemplateVariables, type Endpoint, type EndpointOptions, type EventLocation, type EventTypesResponse, type ImpossibleTravelResult, type InfraAuthContext, type InfraEndpointContext, type InfraEndpointContextValue, type InfraPluginConnectionOptions, type InfraPluginConnectionOptionsInternal, type KvOptions, type KvOptionsResolved, type KvRetryOptions, type KvRetryOptionsResolved, type LegacyDashDirectoryCreateResponse, type LegacyDashDirectoryItem, type LocationData, type LocationDataContext, type ORGANIZATION_USER_PREVIEW_SELECT, type OrganizationUserPreview, type PoWChallenge, type PoWSolution, type SCIMPlugin, type SMSConfig, type SMSTemplateId, type SMSTemplateVariables, type SecurityEvent, type SecurityEventType, type SecurityOptions, type SecurityVerdict, type SendBulkEmailsOptions, type SendBulkEmailsResult, type SendEmailOptions, type SendEmailResult, type SendSMSOptions, type SendSMSResult, type SentinelOptions, type SentinelOptionsInternal, type StaleUserResult, type ThresholdConfig, type UserEvent, type UserEventType, type UserEventsResponse, type asInfraContext, type createAuthMiddleware, createEmailSender, sendBulkEmails, sendEmail, sentinel };

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-C8_UJzzu.mjs";
-import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-DRS7yhmR.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-DLZKaIkd.mjs";
+import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-Doziv2tH.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAdapter, getCurrentAuthContext, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
@@ -13,14 +13,24 @@ import z, { z as z$1 } from "zod";
 import { DOMParser } from "@xmldom/xmldom";
 import { base64Url } from "@better-auth/utils/base64";
 import { createLocalJWKSet, jwtVerify } from "jose";
-import { generateRandomString, symmetricEncrypt } from "better-auth/crypto";
+import { generateRandomString, symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
 import { createOTP } from "@better-auth/utils/otp";
 //#region src/options.ts
+/** @internal */
+function resolveApiKeys(raw) {
+	const apiKeys = (raw?.trim() || env.BETTER_AUTH_API_KEY?.trim() || "").split(",").map((k) => k.trim()).filter((k) => k.length > 0);
+	return {
+		apiKey: apiKeys[0] ?? "",
+		apiKeys
+	};
+}
 function resolveConnectionOptions(options) {
+	const { apiKey, apiKeys } = resolveApiKeys(options?.apiKey);
 	return {
 		apiUrl: options?.apiUrl || INFRA_API_URL,
 		kvUrl: options?.kvUrl || INFRA_KV_URL,
-		apiKey: options?.apiKey || env.BETTER_AUTH_API_KEY || "",
+		apiKey,
+		apiKeys,
 		apiOptions: {
 			timeout: options?.apiOptions?.timeout ?? options?.apiTimeout ?? 3e3,
 			headers: options?.apiOptions?.headers
@@ -96,6 +106,92 @@ function resolveClientIpFromHeaders(headers, ipAddressHeaders) {
 	}
 }
 //#endregion
+//#region ../utils/dist/url.mjs
+/**
+* URL helpers: normalization, SSRF-safe parsing/validation, and path/query segments.
+*/
+const HTTP_PROTOCOLS = ["http:", "https:"];
+function isAllowedProtocol(protocol, allowedProtocols) {
+	return (allowedProtocols?.length ? allowedProtocols : HTTP_PROTOCOLS).includes(protocol);
+}
+/** Normalizes a base URL and path by trimming slashes and joining them. */
+function normalizeUrl(base, path) {
+	return `${base.replace(/\/+$/, "")}${path ? `/${path.replace(/^\/+|\/+$/g, "")}` : ""}`;
+}
+function normalizePath(path) {
+	const trimmed = path.trim();
+	if (!trimmed) throw new Error("Path must be a non-empty string");
+	return `/${trimmed.replace(/^\/+|\/+$/g, "")}`;
+}
+/** Normalizes a base URL and path into separate parts and a joined URL. */
+function resolveBaseUrlPath(baseURL, basePath) {
+	const cleanBase = baseURL.trim().replace(/\/+$/, "");
+	const resolvedBasePath = normalizePath(basePath);
+	return {
+		baseURL: cleanBase,
+		basePath: resolvedBasePath,
+		url: normalizeUrl(cleanBase, resolvedBasePath)
+	};
+}
+/** Falls back when basePath is null, undefined, or blank/whitespace. */
+function resolveProjectBasePath(basePath) {
+	return basePath?.trim() || "/api/auth";
+}
+/**
+* Split a Better Auth **already-resolved** mount URL (`ctx.context.baseURL`).
+* Path embedded in that URL is the effective mount (BA path-in-baseURL /
+* withPath result). `fallbackBasePath` is used only when the mount URL has no
+* path (e.g. dynamic allowedHosts before a request sets the full URL).
+*/
+function resolveAuthMountBase(mountURL, fallbackBasePath) {
+	try {
+		const url = new URL(mountURL);
+		const pathname = url.pathname.replace(/\/+$/, "") || "";
+		if (pathname && pathname !== "/") return resolveBaseUrlPath(url.origin, pathname);
+		return resolveBaseUrlPath(url.origin, resolveProjectBasePath(fallbackBasePath));
+	} catch {
+		return resolveBaseUrlPath(mountURL, resolveProjectBasePath(fallbackBasePath));
+	}
+}
+function toAllowedOriginSet(allowedOrigins) {
+	const set = /* @__PURE__ */ new Set();
+	for (const raw of allowedOrigins) try {
+		const parsed = new URL(raw.trim());
+		if (isAllowedProtocol(parsed.protocol, HTTP_PROTOCOLS)) set.add(parsed.origin);
+	} catch {}
+	return set;
+}
+function isAllowedOrigin(origin, allowedOrigins) {
+	if (!allowedOrigins.length) return false;
+	return toAllowedOriginSet(allowedOrigins).has(origin);
+}
+function safeResolveUrl(raw, baseURL) {
+	const trim = raw.trim();
+	if (!trim) return null;
+	if (trim.startsWith("//") || trim.includes("\\")) return null;
+	if (/[\u0000-\u001F\u007F]/.test(trim)) return null;
+	try {
+		if (trim.startsWith("/")) return new URL(trim, baseURL);
+		return new URL(trim);
+	} catch {
+		return null;
+	}
+}
+function getSafeUniqueOrigins(urls) {
+	return [...toAllowedOriginSet(urls)];
+}
+/**
+* Returns an absolute URL only if its protocol and origin are allowed (after
+* resolving relative paths against `baseURL`). Otherwise returns `null`.
+*/
+function safeUrlParse(input) {
+	if (input.raw == null || input.raw.trim() === "") return null;
+	const target = safeResolveUrl(input.raw, input.baseURL);
+	if (!target || !isAllowedProtocol(target.protocol, input.allowedProtocols)) return null;
+	if (!isAllowedOrigin(target.origin, input.allowedOrigins ?? [])) return null;
+	return target.href;
+}
+//#endregion
 //#region src/events/constants.ts
 const EVENT_TYPES = {
 	USER_CREATED: "user_created",
@@ -1256,7 +1352,7 @@ function createIdentificationMiddleware($kv, options) {
 		if (!skipIdentification) {
 			const extracted = extractIdentificationHeaders(ctx.request);
 			headerVisitorId = extracted.visitorId;
-			requestId = extracted.requestId ?? ctx.getCookie("__infra-rid") ?? null;
+			requestId = extracted.requestId ?? ctx.getCookie(IDENTIFICATION_COOKIE_NAME) ?? null;
 		}
 		ctx.context.requestId = requestId;
 		if (skipIdentification) ctx.context.identification = null;
@@ -2547,7 +2643,7 @@ const sentinel = (options) => {
 		id: "sentinel",
 		init(ctx) {
 			activityTrackingEnabled = (ctx.getPlugin("dash")?.options)?.activityTracking?.enabled === true;
-			const basePath = new URL(ctx.baseURL).pathname;
+			const basePath = ctx.baseURL ? resolveAuthMountBase(ctx.baseURL, ctx.options.basePath).basePath : resolveProjectBasePath(ctx.options.basePath);
 			const ipHeaders = ctx.options.advanced?.ipAddress?.ipAddressHeaders || null;
 			const disableIpTracking = ctx.options.advanced?.ipAddress?.disableIpTracking === true;
 			/**
@@ -4197,14 +4293,14 @@ const jwtMiddleware = (options, schema, getJWT) => {
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		});
 		const apiKeyHash = payload.apiKeyHash;
-		if (typeof apiKeyHash !== "string" || !options.apiKey) {
+		if (typeof apiKeyHash !== "string" || options.apiKeys.length === 0) {
 			ctx.context.logger.warn("[Dash] API key hash is missing or invalid", {
 				apiKeyHash,
-				apiKey: options.apiKey ? "present" : "missing"
+				apiKey: options.apiKeys.length > 0 ? "present" : "missing"
 			});
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		if (!timingSafeEqualHash(apiKeyHash, await hash(options.apiKey))) {
+		if (!await apiKeyHashMatchesAny(apiKeyHash, options.apiKeys)) {
 			ctx.context.logger.warn("[Dash] API key hash mismatch");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
@@ -4252,20 +4348,85 @@ const jwtValidateMiddleware = (options) => {
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		});
 		const apiKeyHash = payload.apiKeyHash;
-		if (typeof apiKeyHash !== "string" || !options.apiKey) {
+		if (typeof apiKeyHash !== "string" || options.apiKeys.length === 0) {
 			ctx.context.logger.warn("[Dash] API key hash is missing or invalid", {
 				apiKeyHash: typeof apiKeyHash,
-				apiKey: options.apiKey ? "present" : "missing"
+				apiKey: options.apiKeys.length > 0 ? "present" : "missing"
 			});
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		if (!timingSafeEqualHash(apiKeyHash, await hash(options.apiKey))) {
+		if (!await apiKeyHashMatchesAny(apiKeyHash, options.apiKeys)) {
 			ctx.context.logger.warn("[Dash] API key hash mismatch");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
 		return { payload };
 	});
 };
+async function apiKeyHashMatchesAny(apiKeyHash, apiKeys) {
+	let matched = false;
+	for (const key of apiKeys) if (timingSafeEqualHash(apiKeyHash, await hash(key))) matched = true;
+	return matched;
+}
+//#endregion
+//#region src/lib/safe-url.ts
+function isSafeHttpUrl(value) {
+	try {
+		const url = new URL(value);
+		return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "";
+	} catch {
+		return false;
+	}
+}
+/** http(s) absolute URL without embedded credentials. */
+const safeUrlSchema = z.string().trim().min(1).pipe(z.url().refine(isSafeHttpUrl, { message: "URL must be a valid http(s) URL without credentials" })).transform((value) => new URL(value).href);
+const optionalSafeUrlSchema = z.union([safeUrlSchema, z.literal("")]).optional();
+/**
+* Request-scoped full auth URL (origin + mount). Prefer over `options.baseURL`,
+* which is origin-only or a dynamic config object.
+* BA resolves this before endpoint handlers; missing value is a programming error.
+*/
+function getAuthBaseUrl(ctx) {
+	const resolved = ctx.context.baseURL?.trim();
+	if (!resolved) throw new APIError$1("INTERNAL_SERVER_ERROR", { message: "Auth base URL is not resolved for this request." });
+	return resolved;
+}
+/** App origin for post-auth redirects (not the auth mount path). */
+function getAuthOrigin(ctx) {
+	return new URL(getAuthBaseUrl(ctx)).origin;
+}
+function getAllowedAuthOrigins(ctx, extraOrigins = []) {
+	return getSafeUniqueOrigins([
+		getAuthBaseUrl(ctx),
+		...ctx.context.trustedOrigins ?? [],
+		...extraOrigins
+	]);
+}
+/**
+* Resolve a redirect against the auth server's base URL and trusted origins.
+* Falls back when the target origin is not allowed.
+*/
+function resolveTrustedAuthRedirectUrl(ctx, raw, fallback) {
+	return safeUrlParse({
+		raw,
+		baseURL: getAuthBaseUrl(ctx),
+		allowedOrigins: getAllowedAuthOrigins(ctx)
+	}) ?? fallback;
+}
+/** Returns a trusted redirect URL or null when the origin is not allowed. */
+function parseTrustedAuthRedirectUrl(ctx, raw) {
+	return safeUrlParse({
+		raw,
+		baseURL: getAuthBaseUrl(ctx),
+		allowedOrigins: getAllowedAuthOrigins(ctx)
+	});
+}
+const TRUSTED_CALLBACK_URL_ERROR = "Callback URL must use http(s) and match the auth base URL or a trusted origin.";
+/** Rejects email/redirect callbacks whose origin is not on the auth allowlist. */
+function requireTrustedAuthCallbackUrl(ctx, raw) {
+	const trusted = parseTrustedAuthRedirectUrl(ctx, raw);
+	if (!trusted) throw new APIError$1("BAD_REQUEST", { message: TRUSTED_CALLBACK_URL_ERROR });
+	return trusted;
+}
 //#endregion
 //#region ../utils/dist/semver.mjs
 /**
@@ -4337,6 +4498,7 @@ const getConfig = (options) => {
 	}, async (ctx) => {
 		const advancedOptions = ctx.context.options.advanced;
 		const organizationPlugin = ctx.context.getPlugin("organization");
+		const authBase = resolveAuthMountBase(getAuthBaseUrl(ctx), ctx.context.options.basePath);
 		return redactDashSettings({
 			version: ctx.context.version || null,
 			socialProviders: Object.keys(ctx.context.options.socialProviders || {}),
@@ -4406,8 +4568,8 @@ const getConfig = (options) => {
 				deleteUserEnabled: !!ctx.context.options.user?.deleteUser?.enabled,
 				modelName: ctx.context.options.user?.modelName
 			},
-			baseURL: ctx.context.options.baseURL,
-			basePath: ctx.context.options.basePath || "/api/auth",
+			baseURL: authBase.baseURL,
+			basePath: authBase.basePath,
 			emailVerification: { sendVerificationEmailEnabled: !!ctx.context.options.emailVerification?.sendVerificationEmail },
 			insights: {
 				hasDatabase: !!ctx.context.options.database,
@@ -4601,7 +4763,7 @@ const directorySyncClaimsSchema = z.object({
 	setupOperationId: z.string().trim().min(16).max(255).optional()
 });
 function getScimEndpoint$1(baseUrl) {
-	return `${baseUrl}/scim/v2`;
+	return normalizeUrl(baseUrl, "scim/v2");
 }
 function assertDirectorySyncClaims(ctx, organizationId) {
 	const claims = ctx.context.payload;
@@ -5503,7 +5665,7 @@ async function scimProviderExists(ctx, organizationId, providerId) {
 	}) != null;
 }
 function getScimEndpoint(baseUrl) {
-	return `${baseUrl}/scim/v2`;
+	return normalizeUrl(baseUrl, "scim/v2");
 }
 function resolveMode(ctx) {
 	return resolveDirectorySyncMode(getSCIMPlugin(ctx), isManagedDirectorySyncEnabled(ctx));
@@ -5518,6 +5680,36 @@ function isDuplicateDirectorySyncError(e) {
 	if (e instanceof Error) return /unique constraint|duplicate key|already exists|P2002/i.test(e.message);
 	return false;
 }
+const countDirectorySyncConnections = (options) => {
+	return createAuthEndpoint("/dash/directory-sync/connection-count", {
+		method: "GET",
+		use: [jwtMiddleware(options)]
+	}, async (ctx) => {
+		const mode = resolveMode(ctx);
+		if (mode === "managed") return {
+			count: await ctx.context.adapter.count({
+				model: "directorySyncConnection",
+				where: [{
+					field: "status",
+					value: ["active", "decommissioning"],
+					operator: "in"
+				}]
+			}),
+			mode: "managed"
+		};
+		if (mode === "legacy") {
+			if (!isOrganizationEnabled(ctx)) return {
+				count: 0,
+				mode: "legacy"
+			};
+			return {
+				count: await ctx.context.adapter.count({ model: "scimProvider" }),
+				mode: "legacy"
+			};
+		}
+		throw ctx.error("NOT_FOUND", { message: "Directory sync connection count unavailable" });
+	});
+};
 const listOrganizationDirectories = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/directories", {
 		method: "GET",
@@ -6062,105 +6254,6 @@ function allowsPasswordlessInviteComplete(authMode) {
 	return authMode === "create_with_session";
 }
 //#endregion
-//#region ../utils/dist/url.mjs
-/**
-* URL helpers: normalization, SSRF-safe parsing/validation, and path/query segments.
-*/
-const HTTP_PROTOCOLS = ["http:", "https:"];
-function isAllowedProtocol(protocol, allowedProtocols) {
-	return (allowedProtocols?.length ? allowedProtocols : HTTP_PROTOCOLS).includes(protocol);
-}
-function toAllowedOriginSet(allowedOrigins) {
-	const set = /* @__PURE__ */ new Set();
-	for (const raw of allowedOrigins) try {
-		const parsed = new URL(raw.trim());
-		if (isAllowedProtocol(parsed.protocol, HTTP_PROTOCOLS)) set.add(parsed.origin);
-	} catch {}
-	return set;
-}
-function isAllowedOrigin(origin, allowedOrigins) {
-	if (!allowedOrigins.length) return false;
-	return toAllowedOriginSet(allowedOrigins).has(origin);
-}
-function safeResolveUrl(raw, baseURL) {
-	const trim = raw.trim();
-	if (!trim) return null;
-	if (trim.startsWith("//") || trim.includes("\\")) return null;
-	if (/[\u0000-\u001F\u007F]/.test(trim)) return null;
-	try {
-		if (trim.startsWith("/")) return new URL(trim, baseURL);
-		return new URL(trim);
-	} catch {
-		return null;
-	}
-}
-function getSafeUniqueOrigins(urls) {
-	return [...toAllowedOriginSet(urls)];
-}
-/**
-* Returns an absolute URL only if its protocol and origin are allowed (after
-* resolving relative paths against `baseURL`). Otherwise returns `null`.
-*/
-function safeUrlParse(input) {
-	if (input.raw == null || input.raw.trim() === "") return null;
-	const target = safeResolveUrl(input.raw, input.baseURL);
-	if (!target || !isAllowedProtocol(target.protocol, input.allowedProtocols)) return null;
-	if (!isAllowedOrigin(target.origin, input.allowedOrigins ?? [])) return null;
-	return target.href;
-}
-//#endregion
-//#region src/lib/safe-url.ts
-function isSafeHttpUrl(value) {
-	try {
-		const url = new URL(value);
-		return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "";
-	} catch {
-		return false;
-	}
-}
-/** http(s) absolute URL without embedded credentials. */
-const safeUrlSchema = z.string().trim().min(1).pipe(z.url().refine(isSafeHttpUrl, { message: "URL must be a valid http(s) URL without credentials" })).transform((value) => new URL(value).href);
-const optionalSafeUrlSchema = z.union([safeUrlSchema, z.literal("")]).optional();
-function getAuthBaseUrl(ctx) {
-	const baseURL = ctx.context.options.baseURL;
-	return typeof baseURL === "string" && baseURL.trim() ? baseURL : "/";
-}
-function getAllowedAuthOrigins(ctx, extraOrigins = []) {
-	const baseURL = getAuthBaseUrl(ctx);
-	const trusted = ctx.context.options.trustedOrigins;
-	return getSafeUniqueOrigins([
-		baseURL,
-		...Array.isArray(trusted) ? trusted.filter((origin) => typeof origin === "string") : [],
-		...extraOrigins
-	]);
-}
-/**
-* Resolve a redirect against the auth server's base URL and trusted origins.
-* Falls back when the target origin is not allowed.
-*/
-function resolveTrustedAuthRedirectUrl(ctx, raw, fallback) {
-	return safeUrlParse({
-		raw,
-		baseURL: getAuthBaseUrl(ctx),
-		allowedOrigins: getAllowedAuthOrigins(ctx)
-	}) ?? fallback;
-}
-/** Returns a trusted redirect URL or null when the origin is not allowed. */
-function parseTrustedAuthRedirectUrl(ctx, raw) {
-	return safeUrlParse({
-		raw,
-		baseURL: getAuthBaseUrl(ctx),
-		allowedOrigins: getAllowedAuthOrigins(ctx)
-	});
-}
-const TRUSTED_CALLBACK_URL_ERROR = "Callback URL must use http(s) and match the auth base URL or a trusted origin.";
-/** Rejects email/redirect callbacks whose origin is not on the auth allowlist. */
-function requireTrustedAuthCallbackUrl(ctx, raw) {
-	const trusted = parseTrustedAuthRedirectUrl(ctx, raw);
-	if (!trusted) throw new APIError$1("BAD_REQUEST", { message: TRUSTED_CALLBACK_URL_ERROR });
-	return trusted;
-}
-//#endregion
 //#region src/routes/invitations/index.ts
 async function verifyPendingInvitation(token, $api, ctx) {
 	const { data: invitation, error } = await $api("/api/internal/invitations/verify", {
@@ -6206,7 +6299,7 @@ async function executePlatformInvitationCompletion(ctx, $api, invitation, args)
 				user: existingUser
 			});
 		}
-		return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)) };
+		return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthOrigin(ctx)) };
 	}
 	if (!password && !allowsPasswordlessInviteComplete(invitation.authMode)) throw new APIError("BAD_REQUEST", { message: "Password is required to complete this invitation." });
 	const userPayload = {
@@ -6237,7 +6330,7 @@ async function executePlatformInvitationCompletion(ctx, $api, invitation, args)
 			user
 		});
 	}
-	return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)) };
+	return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthOrigin(ctx)) };
 }
 /**
 * Accept invitation endpoint
@@ -6270,14 +6363,14 @@ const acceptInvitation = (options) => {
 					user: existingUser
 				});
 			}
-			const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx));
+			const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthOrigin(ctx));
 			return ctx.redirect(redirectUrl);
 		}
 		if (usesPlatformInviteAcceptFlow(invitation.authMode)) {
 			const platformUrl = options.apiUrl || INFRA_API_URL;
 			const acceptPageUrl = new URL("/invite/accept", platformUrl);
 			acceptPageUrl.searchParams.set("token", token);
-			const callbackUrl = `${ctx.context.options.baseURL}${ctx.context.options.basePath || "/api/auth"}/dash/complete-invitation`;
+			const callbackUrl = normalizeUrl(ctx.context.baseURL, "dash/complete-invitation");
 			acceptPageUrl.searchParams.set("callback", callbackUrl);
 			return ctx.redirect(acceptPageUrl.toString());
 		}
@@ -6305,7 +6398,7 @@ const acceptInvitation = (options) => {
 				user
 			});
 		}
-		const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx));
+		const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthOrigin(ctx));
 		return ctx.redirect(redirectUrl);
 	});
 };
@@ -6385,7 +6478,7 @@ const completeInvitationSocial = (options) => {
 			if (sessionCookieToken) await ctx.context.internalAdapter.deleteSession(sessionCookieToken);
 			deleteSessionCookie(ctx);
 		}
-		return ctx.redirect(resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)));
+		return ctx.redirect(resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthOrigin(ctx)));
 	});
 };
 /**
@@ -8439,7 +8532,7 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 	const ba17OrLater = isBetterAuth17OrLater(ctx.context.version);
 	if (saml17OrNewer && !resolvedEntryPoint) throw ctx.error("BAD_REQUEST", { message: "SAML entry point URL is required; provide entryPoint or IdP metadata with SingleSignOnService Location" });
 	if (ba17OrLater && !idpMetadataXml && !samlConfig.entityId?.trim()) throw ctx.error("BAD_REQUEST", { message: "IdP entity ID is required when IdP metadata XML is not provided" });
-	const spIssuer = `${baseURL}/sso/saml2/sp/metadata?providerId=${providerId}`;
+	const spIssuer = `${normalizeUrl(baseURL, "sso/saml2/sp/metadata")}?providerId=${providerId}`;
 	const idpMetadata = idpMetadataXml ? { metadata: idpMetadataXml } : {
 		...ba17OrLater ? { entityID: samlConfig.entityId } : {},
 		...samlConfig.entryPoint ? { singleSignOnService: [{
@@ -8457,7 +8550,7 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 				entryPoint: resolvedEntryPoint,
 				...samlConfig.cert ? { cert: samlConfig.cert } : {}
 			} : {
-				callbackUrl: `${baseURL}/sso/saml2/sp/acs/${providerId}`,
+				callbackUrl: normalizeUrl(baseURL, `sso/saml2/sp/acs/${providerId}`),
 				spMetadata: {},
 				entryPoint: resolvedEntryPoint ?? "",
 				cert: samlConfig.cert ?? ""
@@ -8949,7 +9042,6 @@ const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor
 			value: userId
 		}]
 	});
-	const { generateRandomString, symmetricEncrypt } = await import("better-auth/crypto");
 	const secret = generateRandomString(32);
 	const { backupCodes, encryptedBackupCodes } = await generateBackupCodes$1(ctx.context.secret, resolveBackupCodeOptions(twoFactorPlugin));
 	const encryptedSecret = await symmetricEncrypt({
@@ -9032,7 +9124,6 @@ const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-fac
 	if (!twoFactorRecord) throw new APIError("NOT_FOUND", { message: "Two-factor authentication not set up for this user" });
 	let secret = twoFactorRecord.secret;
 	try {
-		const { symmetricDecrypt } = await import("better-auth/crypto");
 		secret = await symmetricDecrypt({
 			key: ctx.context.secret,
 			data: twoFactorRecord.secret
@@ -10883,13 +10974,13 @@ const dash = (options) => {
 					},
 					session: {
 						create: {
-							async before(session, _ctx) {
-								const ctx = _ctx;
+							async before(_session, untypedCtx) {
+								const ctx = untypedCtx;
 								if (!ctx) return;
 								return { data: { loginMethod: getLoginMethod(ctx) } };
 							},
-							async after(session, _ctx) {
-								const ctx = _ctx;
+							async after(session, untypedCtx) {
+								const ctx = untypedCtx;
 								if (!ctx || !session.userId) return;
 								const location = ctx.context.location;
 								const loginMethod = getLoginMethod(ctx) ?? void 0;
@@ -11152,6 +11243,7 @@ const dash = (options) => {
 			listDashManagedDirectoryEvents: listDirectoryEvents(settings),
 			decommissionDashManagedOrganizationDirectory: decommissionOrganizationDirectory(settings),
 			unpairDashManagedOrganizationDirectory: unpairOrganizationDirectory(settings),
+			countDashDirectorySyncConnections: countDirectorySyncConnections(settings),
 			dashExecuteAdapter: executeAdapter(settings)
 		},
 		schema: {

package/dist/native.d.mts

@@ -1,4 +1,4 @@
-import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-DgKA4Eq8.mjs";
+import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-BfGftEgh.mjs";
 import { BetterAuthClientPlugin } from "better-auth";
 //#region src/sentinel/native/client.d.ts
 interface SentinelNativeClientOptions {
@@ -22,6 +22,6 @@ interface SentinelNativeClientOptions {
     setItem: (key: string, value: string) => Promise<void>;
   };
 }
-declare const sentinelNativeClient: (options?: SentinelNativeClientOptions) => BetterAuthClientPlugin;
+export declare const sentinelNativeClient: (options?: SentinelNativeClientOptions) => BetterAuthClientPlugin;
 //#endregion
-export { type DashAuditLog, type DashAuditLogsResponse, type DashClientOptions, type DashGetAllAuditLogsInput, type DashGetAuditLogsInput, type SentinelNativeClientOptions, dashClient, sentinelNativeClient };
+export { type DashAuditLog, type DashAuditLogsResponse, type DashClientOptions, type DashGetAllAuditLogsInput, type DashGetAuditLogsInput, type SentinelNativeClientOptions, dashClient };

package/dist/native.mjs

@@ -1,5 +1,5 @@
-import { o as createKV, t as bytesToHex } from "./crypto-DRS7yhmR.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-Di0eUKbA.mjs";
+import { o as createKV, t as bytesToHex } from "./crypto-Doziv2tH.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-DIkxDwZf.mjs";
 import { env } from "@better-auth/core/env";
 import { Dimensions, InteractionManager, PixelRatio, Platform } from "react-native";
 //#region src/sentinel/native/components.ts

package/dist/{pow-retry-Di0eUKbA.mjs → pow-retry-DIkxDwZf.mjs}

@@ -1,4 +1,4 @@
-import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-DRS7yhmR.mjs";
+import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-Doziv2tH.mjs";
 //#region src/dash-client.ts
 function resolveDashUserId(input, options) {
 	return input.userId || options?.resolveUserId?.({

package/dist/{types-BkUWsMpe.d.mts → types-sFD6YavS.d.mts}

@@ -481,6 +481,8 @@ interface InfraPluginConnectionOptionsInternal extends Omit<InfraPluginConnectio
   apiUrl: string;
   kvUrl: string;
   apiKey: string;
+  /** @internal */
+  apiKeys: string[];
   apiOptions: ApiOptionsResolved;
   kvOptions: KvOptionsResolved;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.4.8",
+  "version": "0.4.10",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
@@ -66,32 +66,32 @@
   },
   "homepage": "https://better-auth.com",
   "devDependencies": {
-    "@better-auth/kysely-adapter": "1.7.3",
-    "@better-auth/scim": "1.7.3",
-    "@better-auth/sso": "1.7.3",
+    "@better-auth/kysely-adapter": "1.7.5",
+    "@better-auth/scim": "1.7.5",
+    "@better-auth/sso": "1.7.5",
     "@infra/mocks": "0.0.0",
     "@infra/utils": "0.0.0",
     "@types/bun": "latest",
     "@types/node": "^24.12.0",
     "@vitest/browser-playwright": "5.0.0",
     "@vitest/coverage-istanbul": "^5.0.0",
-    "better-auth": "1.7.3",
-    "expo-crypto": "^57.0.1",
+    "better-auth": "1.7.5",
+    "expo-crypto": "^57.0.3",
     "msw": "^2.14.6",
     "playwright": "^1.63.0",
-    "tsdown": "^0.22.14",
+    "tsdown": "^0.23.0",
     "typescript": "^6.0.3",
     "vitest": "^5.0.0",
     "zod": "4.5.4"
   },
   "dependencies": {
     "@better-auth/utils": "^0.4.2",
-    "@better-fetch/fetch": "1.3.1",
+    "@better-fetch/fetch": "1.3.2",
     "@noble/hashes": "^2.2.0",
     "@xmldom/xmldom": "^0.9.10",
     "better-call": "1.4.0",
-    "jose": "^6.2.10",
-    "libphonenumber-js": "^1.13.11"
+    "jose": "^6.2.12",
+    "libphonenumber-js": "^1.13.13"
   },
   "peerDependencies": {
     "better-auth": ">=1.4.0",