@better-auth/infra 0.4.9 → 0.4.11

package/CHANGELOG.md

@@ -5,11 +5,27 @@ All notable changes to `@better-auth/infra` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0/).
 
+## [0.4.11] - 2026-09-23
+
+### Added
+
+- **`GET /dash/sso/connection-count`** — Project-wide SSO connection count (`{ count }`). Counts `ssoProvider` rows across organizations. Returns `{ count: 0 }` when the organization plugin or SSO plugin is unavailable.
+
+## [0.4.10] - 2026-09-21
+
+### Added
+
+- **`GET /dash/directory-sync/connection-count`** — Project-wide directory sync connection count (`{ count, mode }`). Managed mode counts `active` / `decommissioning` connections; legacy mode counts `scimProvider` rows. Returns 404 when directory sync is unavailable.
+
+### Fixed
+
+- **Stored vs resolved auth base** — Platform-stored `baseURL` + `basePath` always rejoin (a path on stored `baseURL` no longer overrides a saved `basePath`). Request-scoped mount resolution still follows Better Auth path-in-`baseURL` via `context.baseURL` (dash config, Sentinel).
+
 ## [0.4.9] - 2026-09-09
 
 ### Fixed
 
-- **Auth base URL resolution** — Correctly handle Better Auth `baseURL` with an embedded path and dynamic `allowedHosts` (1.5+): dash config, invitation callbacks, SSO/SCIM endpoints, and Sentinel no longer use the wrong mount path or break on object `baseURL`.
+- **Auth base URL / path** — `GET /dash/config` reports origin + effective mount path when `baseURL` embeds a path or uses dynamic `allowedHosts`. Invitation callbacks, SSO/SCIM endpoint URLs, and Sentinel route matching use the same resolved mount.
 
 ## [0.4.8] - 2026-09-09
 

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-DgKA4Eq8.mjs";
+import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-BfGftEgh.mjs";
 import { BetterFetchPlugin } from "@better-fetch/fetch";
 //#region src/sentinel/client.d.ts
 interface SentinelClientOptions {
@@ -34,9 +34,9 @@ interface SentinelClientOptions {
    */
   onChallengeFailed?: (error: Error) => void;
 }
-declare const sentinelClient: (options?: SentinelClientOptions) => {
+export declare const sentinelClient: (options?: SentinelClientOptions) => {
   id: "sentinel";
   fetchPlugins: BetterFetchPlugin[];
 };
 //#endregion
-export { type DashAuditLog, type DashAuditLogsResponse, type DashClientOptions, type DashGetAllAuditLogsInput, type DashGetAuditLogsInput, type SentinelClientOptions, dashClient, sentinelClient };
+export { type DashAuditLog, type DashAuditLogsResponse, type DashClientOptions, type DashGetAllAuditLogsInput, type DashGetAuditLogsInput, type SentinelClientOptions, dashClient };

package/dist/client.mjs

@@ -1,5 +1,5 @@
-import { n as hash, o as createKV } from "./crypto-DDadesq-.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-DRUkPcBn.mjs";
+import { n as hash, o as createKV } from "./crypto-CgNWT4f3.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-B5TObAcM.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts
 function murmurhash3(str, seed = 0) {

package/dist/{constants-CdZodAXp.mjs → constants-C82aGVpa.mjs}

@@ -1,7 +1,7 @@
 import { env } from "@better-auth/core/env";
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.4.9";
+const PLUGIN_VERSION = "0.4.11";
 //#endregion
 //#region src/constants.ts
 /**

package/dist/{crypto-DDadesq-.mjs → crypto-CgNWT4f3.mjs}

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT } from "./constants-CdZodAXp.mjs";
+import { i as INFRA_USER_AGENT } from "./constants-C82aGVpa.mjs";
 import { createFetch } from "@better-fetch/fetch";
 import { sha256 } from "@noble/hashes/sha2.js";
 //#region src/fetch.ts

package/dist/email.d.mts

@@ -8,7 +8,7 @@
 /**
  * Email template definitions with their required variables
  */
-declare const EMAIL_TEMPLATES: {
+export declare const EMAIL_TEMPLATES: {
   readonly "verify-email": {
     readonly variables: {
       verificationCode?: string;
@@ -136,14 +136,14 @@ declare const EMAIL_TEMPLATES: {
     };
   };
 };
-type EmailTemplateId = keyof typeof EMAIL_TEMPLATES;
-type EmailTemplateVariables<T extends EmailTemplateId> = (typeof EMAIL_TEMPLATES)[T]["variables"];
-interface SendEmailResult {
+export type EmailTemplateId = keyof typeof EMAIL_TEMPLATES;
+export type EmailTemplateVariables<T extends EmailTemplateId> = (typeof EMAIL_TEMPLATES)[T]["variables"];
+export interface SendEmailResult {
   success: boolean;
   messageId?: string;
   error?: string;
 }
-interface EmailConfig {
+export interface EmailConfig {
   apiKey?: string;
   apiUrl?: string;
   /**
@@ -171,7 +171,7 @@ interface EmailConfig {
 /**
  * Type-safe send email options
  */
-type SendEmailOptions<T extends EmailTemplateId = EmailTemplateId> = {
+export type SendEmailOptions<T extends EmailTemplateId = EmailTemplateId> = {
   /**
    * The template ID to use
    */
@@ -192,7 +192,7 @@ type SendEmailOptions<T extends EmailTemplateId = EmailTemplateId> = {
 /**
  * Options for sending bulk emails
  */
-type SendBulkEmailsOptions<T extends EmailTemplateId = EmailTemplateId> = {
+export type SendBulkEmailsOptions<T extends EmailTemplateId = EmailTemplateId> = {
   /**
    * The template ID to use for all emails
    */
@@ -216,7 +216,7 @@ type SendBulkEmailsOptions<T extends EmailTemplateId = EmailTemplateId> = {
 /**
  * Result of a bulk email send operation
  */
-interface SendBulkEmailsResult {
+export interface SendBulkEmailsResult {
   success: boolean;
   failures?: Record<string, {
     error?: string;
@@ -226,7 +226,7 @@ interface SendBulkEmailsResult {
 /**
  * Create an email sender instance
  */
-declare function createEmailSender(config?: EmailConfig): {
+export declare function createEmailSender(config?: EmailConfig): {
   send: <T extends EmailTemplateId>(options: SendEmailOptions<T>) => Promise<SendEmailResult>;
   sendBulk: <T extends EmailTemplateId>(options: SendBulkEmailsOptions<T>) => Promise<SendBulkEmailsResult>;
   getTemplates: () => Promise<{
@@ -253,7 +253,7 @@ declare function createEmailSender(config?: EmailConfig): {
  * });
  * ```
  */
-declare function sendEmail<T extends EmailTemplateId>(options: SendEmailOptions<T>, config?: EmailConfig): Promise<SendEmailResult>;
+export declare function sendEmail<T extends EmailTemplateId>(options: SendEmailOptions<T>, config?: EmailConfig): Promise<SendEmailResult>;
 /**
  * Send bulk emails using the Better Auth dashboard's email templates.
  *
@@ -270,6 +270,5 @@ declare function sendEmail<T extends EmailTemplateId>(options: SendEmailOptions<
  * });
  * ```
  */
-declare function sendBulkEmails<T extends EmailTemplateId>(options: SendBulkEmailsOptions<T>, config?: EmailConfig): Promise<SendBulkEmailsResult>;
-//#endregion
-export { EMAIL_TEMPLATES, EmailConfig, EmailTemplateId, EmailTemplateVariables, SendBulkEmailsOptions, SendBulkEmailsResult, SendEmailOptions, SendEmailResult, createEmailSender, sendBulkEmails, sendEmail };
+export declare function sendBulkEmails<T extends EmailTemplateId>(options: SendBulkEmailsOptions<T>, config?: EmailConfig): Promise<SendBulkEmailsResult>;
+//#endregion

package/dist/email.mjs

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CdZodAXp.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-C82aGVpa.mjs";
 import { logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { createFetch } from "@better-fetch/fetch";

package/dist/{identify-client-options-DgKA4Eq8.d.mts → identify-client-options-BfGftEgh.d.mts}

@@ -1,4 +1,4 @@
-import { g as KvRetryOptions } from "./types-BkUWsMpe.mjs";
+import { g as KvRetryOptions } from "./types-sFD6YavS.mjs";
 import { BetterAuthClientOptions, ClientStore } from "better-auth";
 import { BetterFetch } from "@better-fetch/fetch";
 //#region src/dash-client.d.ts

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { A as SecurityOptions, C as createAuthMiddleware, D as ImpossibleTravelResult, E as CredentialStuffingResult, M as StaleUserResult, N as ThresholdConfig, O as SecurityEvent, S as asInfraContext, T as CompromisedPasswordResult, _ as KvRetryOptionsResolved, a as DashOptionsInternal, b as SentinelOptions, c as EndpointOptions, d as InfraEndpointContextValue, f as InfraPluginConnectionOptions, g as KvRetryOptions, h as KvOptionsResolved, i as DashOptions, j as SecurityVerdict, k as SecurityEventType, l as InfraAuthContext, m as KvOptions, n as ApiOptions, o as DashOptionsResolved, p as InfraPluginConnectionOptionsInternal, r as ApiOptionsResolved, s as Endpoint, t as APIError, u as InfraEndpointContext, v as LocationData, w as sentinel, x as SentinelOptionsInternal, y as LocationDataContext } from "./types-BkUWsMpe.mjs";
+import { A as SecurityOptions, C as createAuthMiddleware, D as ImpossibleTravelResult, E as CredentialStuffingResult, M as StaleUserResult, N as ThresholdConfig, O as SecurityEvent, S as asInfraContext, T as CompromisedPasswordResult, _ as KvRetryOptionsResolved, a as DashOptionsInternal, b as SentinelOptions, c as EndpointOptions, d as InfraEndpointContextValue, f as InfraPluginConnectionOptions, g as KvRetryOptions, h as KvOptionsResolved, i as DashOptions, j as SecurityVerdict, k as SecurityEventType, l as InfraAuthContext, m as KvOptions, n as ApiOptions, o as DashOptionsResolved, p as InfraPluginConnectionOptionsInternal, r as ApiOptionsResolved, s as Endpoint, t as APIError, u as InfraEndpointContext, v as LocationData, w as sentinel, x as SentinelOptionsInternal, y as LocationDataContext } from "./types-sFD6YavS.mjs";
 import { EMAIL_TEMPLATES, EmailConfig, EmailTemplateId, EmailTemplateVariables, SendBulkEmailsOptions, SendBulkEmailsResult, SendEmailOptions, SendEmailResult, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { Account, AuthContext, GenericEndpointContext, Session, User } from "better-auth";
 import z from "zod";
@@ -30,26 +30,26 @@ interface PoWSolution {
   counter: number;
 }
 /** Default difficulty in bits (18 = ~500ms solve time) */
-declare const DEFAULT_DIFFICULTY = 18;
+export declare const DEFAULT_DIFFICULTY = 18;
 /** Challenge TTL in seconds */
-declare const CHALLENGE_TTL = 60;
+export declare const CHALLENGE_TTL = 60;
 /**
  * Solve a PoW challenge (browser-compatible)
  * This function is designed to run in a browser environment
  */
-declare function solvePoWChallenge(challenge: PoWChallenge): Promise<PoWSolution>;
+export declare function solvePoWChallenge(challenge: PoWChallenge): Promise<PoWSolution>;
 /**
  * Decode a base64-encoded challenge string (browser-compatible)
  */
-declare function decodePoWChallenge(encoded: string): PoWChallenge | null;
+export declare function decodePoWChallenge(encoded: string): PoWChallenge | null;
 /**
  * Encode a solution string (browser-compatible)
  */
-declare function encodePoWSolution(solution: PoWSolution): string;
+export declare function encodePoWSolution(solution: PoWSolution): string;
 /**
  * Verify a PoW solution locally (for testing purposes)
  */
-declare function verifyPoWSolution(nonce: string, counter: number, difficulty: number): Promise<boolean>;
+export declare function verifyPoWSolution(nonce: string, counter: number, difficulty: number): Promise<boolean>;
 //#endregion
 //#region src/sms.d.ts
 /**
@@ -61,7 +61,7 @@ declare function verifyPoWSolution(nonce: string, counter: number, difficulty: n
 /**
  * SMS template definitions with their required variables
  */
-declare const SMS_TEMPLATES: {
+export declare const SMS_TEMPLATES: {
   readonly "phone-verification": {
     readonly variables: {
       code: string;
@@ -140,7 +140,7 @@ interface SendSMSOptions {
 /**
  * Create an SMS sender instance
  */
-declare function createSMSSender(config?: SMSConfig): {
+export declare function createSMSSender(config?: SMSConfig): {
   send: (options: SendSMSOptions) => Promise<SendSMSResult>;
 };
 /**
@@ -171,7 +171,7 @@ declare function createSMSSender(config?: SMSConfig): {
  * });
  * ```
  */
-declare function sendSMS(options: SendSMSOptions, config?: SMSConfig): Promise<SendSMSResult>;
+export declare function sendSMS(options: SendSMSOptions, config?: SMSConfig): Promise<SendSMSResult>;
 //#endregion
 //#region src/routes/auth/types.d.ts
 type DBField = {
@@ -370,6 +370,10 @@ interface DashDirectoryRegenerateTokenResponse {
   scimToken: string;
   scimEndpoint: string;
 }
+interface DashDirectorySyncConnectionCountResponse {
+  count: number;
+  mode: "managed" | "legacy";
+}
 //#endregion
 //#region src/events/constants.d.ts
 declare const EVENT_TYPES: {
@@ -416,7 +420,7 @@ declare const ORGANIZATION_EVENT_TYPES: {
   readonly ORGANIZATION_TEAM_MEMBER_REMOVED: "organization_team_member_removed";
 };
 /** All audit event type string constants (user + organization). */
-declare const USER_EVENT_TYPES: {
+export declare const USER_EVENT_TYPES: {
   readonly ORGANIZATION_CREATED: "organization_created";
   readonly ORGANIZATION_UPDATED: "organization_updated";
   readonly ORGANIZATION_MEMBER_ADDED: "organization_member_added";
@@ -662,6 +666,9 @@ interface DashSsoVerifyDomainResponse {
   verified: boolean;
   message?: string;
 }
+interface DashSsoConnectionCountResponse {
+  count: number;
+}
 //#endregion
 //#region src/routes/two-factor/types.d.ts
 interface DashTwoFactorEnableResponse {
@@ -791,10 +798,10 @@ interface DashCheckUserExistsResponse {
  * @param email - Raw email to normalize
  * @param context - Auth context
  */
-declare function normalizeEmail(email: string, context: AuthContext): string;
+export declare function normalizeEmail(email: string, context: AuthContext): string;
 //#endregion
 //#region src/index.d.ts
-declare const dash: <O extends DashOptions>(options?: O) => {
+export declare const dash: <O extends DashOptions>(options?: O) => {
   id: "dash";
   options: DashOptionsResolved;
   version: string;
@@ -838,7 +845,7 @@ declare const dash: <O extends DashOptions>(options?: O) => {
         };
         session: {
           create: {
-            before(session: {
+            before(_session: {
               id: string;
               createdAt: Date;
               updatedAt: Date;
@@ -847,7 +854,7 @@ declare const dash: <O extends DashOptions>(options?: O) => {
               token: string;
               ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
-            } & Record<string, unknown>, _ctx: GenericEndpointContext | null): Promise<{
+            } & Record<string, unknown>, untypedCtx: GenericEndpointContext | null): Promise<{
               data: {
                 loginMethod: string | null;
               };
@@ -861,7 +868,7 @@ declare const dash: <O extends DashOptions>(options?: O) => {
               token: string;
               ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
-            } & Record<string, unknown>, _ctx: GenericEndpointContext | null): Promise<void>;
+            } & Record<string, unknown>, untypedCtx: GenericEndpointContext | null): Promise<void>;
           };
           delete: {
             after(session: {
@@ -1303,6 +1310,12 @@ declare const dash: <O extends DashOptions>(options?: O) => {
         verified: import("zod").ZodLiteral<false>;
       }, import("zod/v4/core").$strip>;
     }, DashSsoMarkDomainVerifiedResponse>;
+    countDashSsoConnections: import("better-call").StrictEndpoint<"/dash/sso/connection-count", {
+      method: "GET";
+      use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        payload: Record<string, unknown>;
+      }>>[];
+    }, DashSsoConnectionCountResponse>;
     listDashTeamMembers: import("better-call").StrictEndpoint<"/dash/organization/:orgId/teams/:teamId/members", {
       method: "GET";
       use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -2197,6 +2210,12 @@ declare const dash: <O extends DashOptions>(options?: O) => {
       }>>[];
       body: import("zod").ZodObject<{}, import("zod/v4/core").$strip>;
     }, DirectorySyncConnection>;
+    countDashDirectorySyncConnections: import("better-call").StrictEndpoint<"/dash/directory-sync/connection-count", {
+      method: "GET";
+      use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        payload: Record<string, unknown>;
+      }>>[];
+    }, DashDirectorySyncConnectionCountResponse>;
     dashExecuteAdapter: import("better-call").StrictEndpoint<"/dash/execute-adapter", {
       method: "POST";
       use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -2341,4 +2360,4 @@ declare const dash: <O extends DashOptions>(options?: O) => {
   } : {});
 };
 //#endregion
-export { type APIError, type ApiOptions, type ApiOptionsResolved, CHALLENGE_TTL, type CompromisedPasswordResult, type CredentialStuffingResult, type DBField, DEFAULT_DIFFICULTY, type DashAddTeamMemberResponse, type DashBanManyResponse, type DashCheckUserByEmailResponse, type DashCheckUserExistsResponse, type DashCompleteInvitationResponse, type DashConfigResponse, type DashCreateOrganizationBody, type DashCreateOrganizationResponse, type DashCreateTeamResponse, type DashCreateUserResponse, type DashDeleteManyUsersResponse, type DashDirectoryCreateResponse, type DashDirectoryCredential, type DashDirectoryDeleteResponse, type DashDirectoryEvent, type DashDirectoryEventsResponse, type DashDirectoryItem, type DashDirectoryRegenerateTokenResponse, type DashDirectoryRotateCredentialResponse, type DashDirectorySyncSSOPairing, type DashExecuteAdapterCountResponse, type DashExecuteAdapterFindManyResponse, type DashExecuteAdapterFindOneResponse, type DashExecuteAdapterMutationResponse, type DashExecuteAdapterResponse, type DashExportOrganizationsResponse, type DashIdRow, type DashInviteMemberResponse, type DashMaybeSuccessResponse, type DashOptions, type DashOptionsInternal, type DashOptionsResolved, type DashOrganizationAddMemberResponse, type DashOrganizationDeleteManyResponse, type DashOrganizationDetailResponse, type DashOrganizationInvitationItem, type DashOrganizationInvitationListResponse, type DashOrganizationInvitationStatusItem, type DashOrganizationListResponse, type DashOrganizationMember, type DashOrganizationMemberListItem, type DashOrganizationMemberListResponse, type DashOrganizationMemberUser, type DashOrganizationOptionsResponse, type DashOrganizationTeamItem, type DashOrganizationTeamListResponse, type DashOrganizationUpdateMemberRoleResponse, type DashOrganizationUpdateResponse, type DashSCIMManagedConnectionEventType, type DashSCIMManagedCredentialStatus, type DashSCIMScope, type DashSendManyVerificationEmailsResponse, type DashSessionRevokeManyResponse, type DashSsoCreateProviderResponse, type DashSsoDeleteResponse, type DashSsoMarkDomainVerifiedResponse, type DashSsoProviderItem, type DashSsoProviderSummary, type DashSsoUpdateProviderResponse, type DashSsoVerificationTokenResponse, type DashSsoVerifyDomainResponse, type DashSuccessResponse, type DashTeam, type DashTeamMember, type DashTeamMemberListResponse, type DashTwoFactorBackupCodesResponse, type DashTwoFactorEnableResponse, type DashTwoFactorStatus, type DashTwoFactorTotpViewResponse, type DashUpdateTeamResponse, type DashUpdateUserResponse, type DashUserDetailsResponse, type DashUserGraphDataResponse, type DashUserListResponse, type DashUserOrganizationsResponse, type DashUserRetentionDataResponse, type DashUserStatsActivePeriod, type DashUserStatsResponse, type DashUserStatsSignUpPeriod, type DashValidateResponse, type DirectorySyncConnection, type DirectorySyncConnectionStatus, type DirectorySyncMode, EMAIL_TEMPLATES, type EmailConfig, type EmailTemplateId, type EmailTemplateVariables, type Endpoint, type EndpointOptions, type EventLocation, type EventTypesResponse, type ImpossibleTravelResult, type InfraAuthContext, type InfraEndpointContext, type InfraEndpointContextValue, type InfraPluginConnectionOptions, type InfraPluginConnectionOptionsInternal, type KvOptions, type KvOptionsResolved, type KvRetryOptions, type KvRetryOptionsResolved, type LegacyDashDirectoryCreateResponse, type LegacyDashDirectoryItem, type LocationData, type LocationDataContext, type ORGANIZATION_USER_PREVIEW_SELECT, type OrganizationUserPreview, type PoWChallenge, type PoWSolution, type SCIMPlugin, type SMSConfig, type SMSTemplateId, type SMSTemplateVariables, SMS_TEMPLATES, type SecurityEvent, type SecurityEventType, type SecurityOptions, type SecurityVerdict, type SendBulkEmailsOptions, type SendBulkEmailsResult, type SendEmailOptions, type SendEmailResult, type SendSMSOptions, type SendSMSResult, type SentinelOptions, type SentinelOptionsInternal, type StaleUserResult, type ThresholdConfig, USER_EVENT_TYPES, type UserEvent, type UserEventType, type UserEventsResponse, type asInfraContext, type createAuthMiddleware, createEmailSender, createSMSSender, dash, decodePoWChallenge, encodePoWSolution, normalizeEmail, sendBulkEmails, sendEmail, sendSMS, sentinel, solvePoWChallenge, verifyPoWSolution };
+export { type APIError, type ApiOptions, type ApiOptionsResolved, type CompromisedPasswordResult, type CredentialStuffingResult, type DBField, type DashAddTeamMemberResponse, type DashBanManyResponse, type DashCheckUserByEmailResponse, type DashCheckUserExistsResponse, type DashCompleteInvitationResponse, type DashConfigResponse, type DashCreateOrganizationBody, type DashCreateOrganizationResponse, type DashCreateTeamResponse, type DashCreateUserResponse, type DashDeleteManyUsersResponse, type DashDirectoryCreateResponse, type DashDirectoryCredential, type DashDirectoryDeleteResponse, type DashDirectoryEvent, type DashDirectoryEventsResponse, type DashDirectoryItem, type DashDirectoryRegenerateTokenResponse, type DashDirectoryRotateCredentialResponse, type DashDirectorySyncConnectionCountResponse, type DashDirectorySyncSSOPairing, type DashExecuteAdapterCountResponse, type DashExecuteAdapterFindManyResponse, type DashExecuteAdapterFindOneResponse, type DashExecuteAdapterMutationResponse, type DashExecuteAdapterResponse, type DashExportOrganizationsResponse, type DashIdRow, type DashInviteMemberResponse, type DashMaybeSuccessResponse, type DashOptions, type DashOptionsInternal, type DashOptionsResolved, type DashOrganizationAddMemberResponse, type DashOrganizationDeleteManyResponse, type DashOrganizationDetailResponse, type DashOrganizationInvitationItem, type DashOrganizationInvitationListResponse, type DashOrganizationInvitationStatusItem, type DashOrganizationListResponse, type DashOrganizationMember, type DashOrganizationMemberListItem, type DashOrganizationMemberListResponse, type DashOrganizationMemberUser, type DashOrganizationOptionsResponse, type DashOrganizationTeamItem, type DashOrganizationTeamListResponse, type DashOrganizationUpdateMemberRoleResponse, type DashOrganizationUpdateResponse, type DashSCIMManagedConnectionEventType, type DashSCIMManagedCredentialStatus, type DashSCIMScope, type DashSendManyVerificationEmailsResponse, type DashSessionRevokeManyResponse, type DashSsoConnectionCountResponse, type DashSsoCreateProviderResponse, type DashSsoDeleteResponse, type DashSsoMarkDomainVerifiedResponse, type DashSsoProviderItem, type DashSsoProviderSummary, type DashSsoUpdateProviderResponse, type DashSsoVerificationTokenResponse, type DashSsoVerifyDomainResponse, type DashSuccessResponse, type DashTeam, type DashTeamMember, type DashTeamMemberListResponse, type DashTwoFactorBackupCodesResponse, type DashTwoFactorEnableResponse, type DashTwoFactorStatus, type DashTwoFactorTotpViewResponse, type DashUpdateTeamResponse, type DashUpdateUserResponse, type DashUserDetailsResponse, type DashUserGraphDataResponse, type DashUserListResponse, type DashUserOrganizationsResponse, type DashUserRetentionDataResponse, type DashUserStatsActivePeriod, type DashUserStatsResponse, type DashUserStatsSignUpPeriod, type DashValidateResponse, type DirectorySyncConnection, type DirectorySyncConnectionStatus, type DirectorySyncMode, EMAIL_TEMPLATES, type EmailConfig, type EmailTemplateId, type EmailTemplateVariables, type Endpoint, type EndpointOptions, type EventLocation, type EventTypesResponse, type ImpossibleTravelResult, type InfraAuthContext, type InfraEndpointContext, type InfraEndpointContextValue, type InfraPluginConnectionOptions, type InfraPluginConnectionOptionsInternal, type KvOptions, type KvOptionsResolved, type KvRetryOptions, type KvRetryOptionsResolved, type LegacyDashDirectoryCreateResponse, type LegacyDashDirectoryItem, type LocationData, type LocationDataContext, type ORGANIZATION_USER_PREVIEW_SELECT, type OrganizationUserPreview, type PoWChallenge, type PoWSolution, type SCIMPlugin, type SMSConfig, type SMSTemplateId, type SMSTemplateVariables, type SecurityEvent, type SecurityEventType, type SecurityOptions, type SecurityVerdict, type SendBulkEmailsOptions, type SendBulkEmailsResult, type SendEmailOptions, type SendEmailResult, type SendSMSOptions, type SendSMSResult, type SentinelOptions, type SentinelOptionsInternal, type StaleUserResult, type ThresholdConfig, type UserEvent, type UserEventType, type UserEventsResponse, type asInfraContext, type createAuthMiddleware, createEmailSender, sendBulkEmails, sendEmail, sentinel };

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CdZodAXp.mjs";
-import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-DDadesq-.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-C82aGVpa.mjs";
+import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-CgNWT4f3.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAdapter, getCurrentAuthContext, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
@@ -13,14 +13,24 @@ import z, { z as z$1 } from "zod";
 import { DOMParser } from "@xmldom/xmldom";
 import { base64Url } from "@better-auth/utils/base64";
 import { createLocalJWKSet, jwtVerify } from "jose";
-import { generateRandomString, symmetricEncrypt } from "better-auth/crypto";
+import { generateRandomString, symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
 import { createOTP } from "@better-auth/utils/otp";
 //#region src/options.ts
+/** @internal */
+function resolveApiKeys(raw) {
+	const apiKeys = (raw?.trim() || env.BETTER_AUTH_API_KEY?.trim() || "").split(",").map((k) => k.trim()).filter((k) => k.length > 0);
+	return {
+		apiKey: apiKeys[0] ?? "",
+		apiKeys
+	};
+}
 function resolveConnectionOptions(options) {
+	const { apiKey, apiKeys } = resolveApiKeys(options?.apiKey);
 	return {
 		apiUrl: options?.apiUrl || INFRA_API_URL,
 		kvUrl: options?.kvUrl || INFRA_KV_URL,
-		apiKey: options?.apiKey || env.BETTER_AUTH_API_KEY || "",
+		apiKey,
+		apiKeys,
 		apiOptions: {
 			timeout: options?.apiOptions?.timeout ?? options?.apiTimeout ?? 3e3,
 			headers: options?.apiOptions?.headers
@@ -128,18 +138,19 @@ function resolveProjectBasePath(basePath) {
 	return basePath?.trim() || "/api/auth";
 }
 /**
-* Normalized project auth base URL + path (blank basePath → default).
-* If `baseURL` already has a non-root pathname, that path wins over `basePath`
-* (Better Auth path-in-baseURL form).
+* Split a Better Auth **already-resolved** mount URL (`ctx.context.baseURL`).
+* Path embedded in that URL is the effective mount (BA path-in-baseURL /
+* withPath result). `fallbackBasePath` is used only when the mount URL has no
+* path (e.g. dynamic allowedHosts before a request sets the full URL).
 */
-function resolveProjectAuthBase(baseURL, basePath) {
+function resolveAuthMountBase(mountURL, fallbackBasePath) {
 	try {
-		const url = new URL(baseURL);
+		const url = new URL(mountURL);
 		const pathname = url.pathname.replace(/\/+$/, "") || "";
 		if (pathname && pathname !== "/") return resolveBaseUrlPath(url.origin, pathname);
-		return resolveBaseUrlPath(url.origin, resolveProjectBasePath(basePath));
+		return resolveBaseUrlPath(url.origin, resolveProjectBasePath(fallbackBasePath));
 	} catch {
-		return resolveBaseUrlPath(baseURL, resolveProjectBasePath(basePath));
+		return resolveBaseUrlPath(mountURL, resolveProjectBasePath(fallbackBasePath));
 	}
 }
 function toAllowedOriginSet(allowedOrigins) {
@@ -1341,7 +1352,7 @@ function createIdentificationMiddleware($kv, options) {
 		if (!skipIdentification) {
 			const extracted = extractIdentificationHeaders(ctx.request);
 			headerVisitorId = extracted.visitorId;
-			requestId = extracted.requestId ?? ctx.getCookie("__infra-rid") ?? null;
+			requestId = extracted.requestId ?? ctx.getCookie(IDENTIFICATION_COOKIE_NAME) ?? null;
 		}
 		ctx.context.requestId = requestId;
 		if (skipIdentification) ctx.context.identification = null;
@@ -2632,7 +2643,7 @@ const sentinel = (options) => {
 		id: "sentinel",
 		init(ctx) {
 			activityTrackingEnabled = (ctx.getPlugin("dash")?.options)?.activityTracking?.enabled === true;
-			const basePath = ctx.baseURL ? resolveProjectAuthBase(ctx.baseURL, ctx.options.basePath).basePath : resolveProjectBasePath(ctx.options.basePath);
+			const basePath = ctx.baseURL ? resolveAuthMountBase(ctx.baseURL, ctx.options.basePath).basePath : resolveProjectBasePath(ctx.options.basePath);
 			const ipHeaders = ctx.options.advanced?.ipAddress?.ipAddressHeaders || null;
 			const disableIpTracking = ctx.options.advanced?.ipAddress?.disableIpTracking === true;
 			/**
@@ -4282,14 +4293,14 @@ const jwtMiddleware = (options, schema, getJWT) => {
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		});
 		const apiKeyHash = payload.apiKeyHash;
-		if (typeof apiKeyHash !== "string" || !options.apiKey) {
+		if (typeof apiKeyHash !== "string" || options.apiKeys.length === 0) {
 			ctx.context.logger.warn("[Dash] API key hash is missing or invalid", {
 				apiKeyHash,
-				apiKey: options.apiKey ? "present" : "missing"
+				apiKey: options.apiKeys.length > 0 ? "present" : "missing"
 			});
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		if (!timingSafeEqualHash(apiKeyHash, await hash(options.apiKey))) {
+		if (!await apiKeyHashMatchesAny(apiKeyHash, options.apiKeys)) {
 			ctx.context.logger.warn("[Dash] API key hash mismatch");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
@@ -4337,20 +4348,25 @@ const jwtValidateMiddleware = (options) => {
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		});
 		const apiKeyHash = payload.apiKeyHash;
-		if (typeof apiKeyHash !== "string" || !options.apiKey) {
+		if (typeof apiKeyHash !== "string" || options.apiKeys.length === 0) {
 			ctx.context.logger.warn("[Dash] API key hash is missing or invalid", {
 				apiKeyHash: typeof apiKeyHash,
-				apiKey: options.apiKey ? "present" : "missing"
+				apiKey: options.apiKeys.length > 0 ? "present" : "missing"
 			});
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		if (!timingSafeEqualHash(apiKeyHash, await hash(options.apiKey))) {
+		if (!await apiKeyHashMatchesAny(apiKeyHash, options.apiKeys)) {
 			ctx.context.logger.warn("[Dash] API key hash mismatch");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
 		return { payload };
 	});
 };
+async function apiKeyHashMatchesAny(apiKeyHash, apiKeys) {
+	let matched = false;
+	for (const key of apiKeys) if (timingSafeEqualHash(apiKeyHash, await hash(key))) matched = true;
+	return matched;
+}
 //#endregion
 //#region src/lib/safe-url.ts
 function isSafeHttpUrl(value) {
@@ -4482,7 +4498,7 @@ const getConfig = (options) => {
 	}, async (ctx) => {
 		const advancedOptions = ctx.context.options.advanced;
 		const organizationPlugin = ctx.context.getPlugin("organization");
-		const authBase = resolveProjectAuthBase(getAuthBaseUrl(ctx), ctx.context.options.basePath);
+		const authBase = resolveAuthMountBase(getAuthBaseUrl(ctx), ctx.context.options.basePath);
 		return redactDashSettings({
 			version: ctx.context.version || null,
 			socialProviders: Object.keys(ctx.context.options.socialProviders || {}),
@@ -5664,6 +5680,36 @@ function isDuplicateDirectorySyncError(e) {
 	if (e instanceof Error) return /unique constraint|duplicate key|already exists|P2002/i.test(e.message);
 	return false;
 }
+const countDirectorySyncConnections = (options) => {
+	return createAuthEndpoint("/dash/directory-sync/connection-count", {
+		method: "GET",
+		use: [jwtMiddleware(options)]
+	}, async (ctx) => {
+		const mode = resolveMode(ctx);
+		if (mode === "managed") return {
+			count: await ctx.context.adapter.count({
+				model: "directorySyncConnection",
+				where: [{
+					field: "status",
+					value: ["active", "decommissioning"],
+					operator: "in"
+				}]
+			}),
+			mode: "managed"
+		};
+		if (mode === "legacy") {
+			if (!isOrganizationEnabled(ctx)) return {
+				count: 0,
+				mode: "legacy"
+			};
+			return {
+				count: await ctx.context.adapter.count({ model: "scimProvider" }),
+				mode: "legacy"
+			};
+		}
+		throw ctx.error("NOT_FOUND", { message: "Directory sync connection count unavailable" });
+	});
+};
 const listOrganizationDirectories = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/directories", {
 		method: "GET",
@@ -8551,6 +8597,17 @@ async function resolveOIDCConfig(oidcConfig, _domain, ctx) {
 		issuer: oidcConfig.issuer
 	};
 }
+const countSsoConnections = (options) => {
+	return createAuthEndpoint("/dash/sso/connection-count", {
+		method: "GET",
+		use: [jwtMiddleware(options)]
+	}, async (ctx) => {
+		if (!isOrganizationEnabled(ctx)) return { count: 0 };
+		if (!ctx.context.getPlugin("sso")) return { count: 0 };
+		const count = await ctx.context.adapter.count({ model: "ssoProvider" });
+		return { count: typeof count === "number" && Number.isFinite(count) && count >= 0 ? Math.floor(count) : 0 };
+	});
+};
 const listOrganizationSsoProviders = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-providers", {
 		method: "GET",
@@ -8996,7 +9053,6 @@ const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor
 			value: userId
 		}]
 	});
-	const { generateRandomString, symmetricEncrypt } = await import("better-auth/crypto");
 	const secret = generateRandomString(32);
 	const { backupCodes, encryptedBackupCodes } = await generateBackupCodes$1(ctx.context.secret, resolveBackupCodeOptions(twoFactorPlugin));
 	const encryptedSecret = await symmetricEncrypt({
@@ -9079,7 +9135,6 @@ const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-fac
 	if (!twoFactorRecord) throw new APIError("NOT_FOUND", { message: "Two-factor authentication not set up for this user" });
 	let secret = twoFactorRecord.secret;
 	try {
-		const { symmetricDecrypt } = await import("better-auth/crypto");
 		secret = await symmetricDecrypt({
 			key: ctx.context.secret,
 			data: twoFactorRecord.secret
@@ -10930,13 +10985,13 @@ const dash = (options) => {
 					},
 					session: {
 						create: {
-							async before(session, _ctx) {
-								const ctx = _ctx;
+							async before(_session, untypedCtx) {
+								const ctx = untypedCtx;
 								if (!ctx) return;
 								return { data: { loginMethod: getLoginMethod(ctx) } };
 							},
-							async after(session, _ctx) {
-								const ctx = _ctx;
+							async after(session, untypedCtx) {
+								const ctx = untypedCtx;
 								if (!ctx || !session.userId) return;
 								const location = ctx.context.location;
 								const loginMethod = getLoginMethod(ctx) ?? void 0;
@@ -11137,6 +11192,7 @@ const dash = (options) => {
 			verifyDashSsoProviderDomain: verifySsoProviderDomain(settings),
 			deleteDashSsoProvider: deleteSsoProvider(settings),
 			markDashSsoProviderDomainVerified: markSsoProviderDomainVerified(settings),
+			countDashSsoConnections: countSsoConnections(settings),
 			listDashTeamMembers: listTeamMembers(settings),
 			createDashOrganization: createOrganization(settings),
 			deleteDashOrganization: deleteOrganization(settings),
@@ -11199,6 +11255,7 @@ const dash = (options) => {
 			listDashManagedDirectoryEvents: listDirectoryEvents(settings),
 			decommissionDashManagedOrganizationDirectory: decommissionOrganizationDirectory(settings),
 			unpairDashManagedOrganizationDirectory: unpairOrganizationDirectory(settings),
+			countDashDirectorySyncConnections: countDirectorySyncConnections(settings),
 			dashExecuteAdapter: executeAdapter(settings)
 		},
 		schema: {

package/dist/native.d.mts

@@ -1,4 +1,4 @@
-import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-DgKA4Eq8.mjs";
+import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-BfGftEgh.mjs";
 import { BetterAuthClientPlugin } from "better-auth";
 //#region src/sentinel/native/client.d.ts
 interface SentinelNativeClientOptions {
@@ -22,6 +22,6 @@ interface SentinelNativeClientOptions {
     setItem: (key: string, value: string) => Promise<void>;
   };
 }
-declare const sentinelNativeClient: (options?: SentinelNativeClientOptions) => BetterAuthClientPlugin;
+export declare const sentinelNativeClient: (options?: SentinelNativeClientOptions) => BetterAuthClientPlugin;
 //#endregion
-export { type DashAuditLog, type DashAuditLogsResponse, type DashClientOptions, type DashGetAllAuditLogsInput, type DashGetAuditLogsInput, type SentinelNativeClientOptions, dashClient, sentinelNativeClient };
+export { type DashAuditLog, type DashAuditLogsResponse, type DashClientOptions, type DashGetAllAuditLogsInput, type DashGetAuditLogsInput, type SentinelNativeClientOptions, dashClient };

package/dist/native.mjs

@@ -1,5 +1,5 @@
-import { o as createKV, t as bytesToHex } from "./crypto-DDadesq-.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-DRUkPcBn.mjs";
+import { o as createKV, t as bytesToHex } from "./crypto-CgNWT4f3.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-B5TObAcM.mjs";
 import { env } from "@better-auth/core/env";
 import { Dimensions, InteractionManager, PixelRatio, Platform } from "react-native";
 //#region src/sentinel/native/components.ts

package/dist/{pow-retry-DRUkPcBn.mjs → pow-retry-B5TObAcM.mjs}

@@ -1,4 +1,4 @@
-import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-DDadesq-.mjs";
+import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-CgNWT4f3.mjs";
 //#region src/dash-client.ts
 function resolveDashUserId(input, options) {
 	return input.userId || options?.resolveUserId?.({

package/dist/{types-BkUWsMpe.d.mts → types-sFD6YavS.d.mts}

@@ -481,6 +481,8 @@ interface InfraPluginConnectionOptionsInternal extends Omit<InfraPluginConnectio
   apiUrl: string;
   kvUrl: string;
   apiKey: string;
+  /** @internal */
+  apiKeys: string[];
   apiOptions: ApiOptionsResolved;
   kvOptions: KvOptionsResolved;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.4.9",
+  "version": "0.4.11",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
@@ -66,32 +66,32 @@
   },
   "homepage": "https://better-auth.com",
   "devDependencies": {
-    "@better-auth/kysely-adapter": "1.7.3",
-    "@better-auth/scim": "1.7.3",
-    "@better-auth/sso": "1.7.3",
+    "@better-auth/kysely-adapter": "1.7.5",
+    "@better-auth/scim": "1.7.5",
+    "@better-auth/sso": "1.7.5",
     "@infra/mocks": "0.0.0",
     "@infra/utils": "0.0.0",
     "@types/bun": "latest",
     "@types/node": "^24.12.0",
     "@vitest/browser-playwright": "5.0.0",
     "@vitest/coverage-istanbul": "^5.0.0",
-    "better-auth": "1.7.3",
-    "expo-crypto": "^57.0.1",
+    "better-auth": "1.7.5",
+    "expo-crypto": "^57.0.3",
     "msw": "^2.14.6",
     "playwright": "^1.63.0",
-    "tsdown": "^0.22.14",
+    "tsdown": "^0.23.0",
     "typescript": "^6.0.3",
     "vitest": "^5.0.0",
     "zod": "4.5.4"
   },
   "dependencies": {
     "@better-auth/utils": "^0.4.2",
-    "@better-fetch/fetch": "1.3.1",
+    "@better-fetch/fetch": "1.3.2",
     "@noble/hashes": "^2.2.0",
     "@xmldom/xmldom": "^0.9.10",
     "better-call": "1.4.0",
-    "jose": "^6.2.10",
-    "libphonenumber-js": "^1.13.11"
+    "jose": "^6.2.12",
+    "libphonenumber-js": "^1.13.13"
   },
   "peerDependencies": {
     "better-auth": ">=1.4.0",