@better-auth/infra 0.4.8 → 0.4.9

package/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to `@better-auth/infra` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0/).
 
+## [0.4.9] - 2026-09-09
+
+### Fixed
+
+- **Auth base URL resolution** — Correctly handle Better Auth `baseURL` with an embedded path and dynamic `allowedHosts` (1.5+): dash config, invitation callbacks, SSO/SCIM endpoints, and Sentinel no longer use the wrong mount path or break on object `baseURL`.
+
 ## [0.4.8] - 2026-09-09
 
 ### Added

package/dist/client.mjs

@@ -1,5 +1,5 @@
-import { n as hash, o as createKV } from "./crypto-DRS7yhmR.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-Di0eUKbA.mjs";
+import { n as hash, o as createKV } from "./crypto-DDadesq-.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-DRUkPcBn.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts
 function murmurhash3(str, seed = 0) {

package/dist/{constants-C8_UJzzu.mjs → constants-CdZodAXp.mjs}

@@ -1,7 +1,7 @@
 import { env } from "@better-auth/core/env";
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.4.8";
+const PLUGIN_VERSION = "0.4.9";
 //#endregion
 //#region src/constants.ts
 /**

package/dist/{crypto-DRS7yhmR.mjs → crypto-DDadesq-.mjs}

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT } from "./constants-C8_UJzzu.mjs";
+import { i as INFRA_USER_AGENT } from "./constants-CdZodAXp.mjs";
 import { createFetch } from "@better-fetch/fetch";
 import { sha256 } from "@noble/hashes/sha2.js";
 //#region src/fetch.ts

package/dist/email.mjs

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-C8_UJzzu.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CdZodAXp.mjs";
 import { logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { createFetch } from "@better-fetch/fetch";

package/dist/index.d.mts

@@ -205,7 +205,9 @@ interface DashConfigResponse {
     deleteUserEnabled: boolean;
     modelName?: string;
   };
-  baseURL: unknown;
+  /** Origin only (never the dynamic allowedHosts object). */
+  baseURL: string;
+  /** Mount path; reflects path embedded in baseURL when present. */
   basePath: string;
   emailVerification: {
     sendVerificationEmailEnabled: boolean;

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-C8_UJzzu.mjs";
-import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-DRS7yhmR.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CdZodAXp.mjs";
+import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-DDadesq-.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAdapter, getCurrentAuthContext, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
@@ -96,6 +96,91 @@ function resolveClientIpFromHeaders(headers, ipAddressHeaders) {
 	}
 }
 //#endregion
+//#region ../utils/dist/url.mjs
+/**
+* URL helpers: normalization, SSRF-safe parsing/validation, and path/query segments.
+*/
+const HTTP_PROTOCOLS = ["http:", "https:"];
+function isAllowedProtocol(protocol, allowedProtocols) {
+	return (allowedProtocols?.length ? allowedProtocols : HTTP_PROTOCOLS).includes(protocol);
+}
+/** Normalizes a base URL and path by trimming slashes and joining them. */
+function normalizeUrl(base, path) {
+	return `${base.replace(/\/+$/, "")}${path ? `/${path.replace(/^\/+|\/+$/g, "")}` : ""}`;
+}
+function normalizePath(path) {
+	const trimmed = path.trim();
+	if (!trimmed) throw new Error("Path must be a non-empty string");
+	return `/${trimmed.replace(/^\/+|\/+$/g, "")}`;
+}
+/** Normalizes a base URL and path into separate parts and a joined URL. */
+function resolveBaseUrlPath(baseURL, basePath) {
+	const cleanBase = baseURL.trim().replace(/\/+$/, "");
+	const resolvedBasePath = normalizePath(basePath);
+	return {
+		baseURL: cleanBase,
+		basePath: resolvedBasePath,
+		url: normalizeUrl(cleanBase, resolvedBasePath)
+	};
+}
+/** Falls back when basePath is null, undefined, or blank/whitespace. */
+function resolveProjectBasePath(basePath) {
+	return basePath?.trim() || "/api/auth";
+}
+/**
+* Normalized project auth base URL + path (blank basePath → default).
+* If `baseURL` already has a non-root pathname, that path wins over `basePath`
+* (Better Auth path-in-baseURL form).
+*/
+function resolveProjectAuthBase(baseURL, basePath) {
+	try {
+		const url = new URL(baseURL);
+		const pathname = url.pathname.replace(/\/+$/, "") || "";
+		if (pathname && pathname !== "/") return resolveBaseUrlPath(url.origin, pathname);
+		return resolveBaseUrlPath(url.origin, resolveProjectBasePath(basePath));
+	} catch {
+		return resolveBaseUrlPath(baseURL, resolveProjectBasePath(basePath));
+	}
+}
+function toAllowedOriginSet(allowedOrigins) {
+	const set = /* @__PURE__ */ new Set();
+	for (const raw of allowedOrigins) try {
+		const parsed = new URL(raw.trim());
+		if (isAllowedProtocol(parsed.protocol, HTTP_PROTOCOLS)) set.add(parsed.origin);
+	} catch {}
+	return set;
+}
+function isAllowedOrigin(origin, allowedOrigins) {
+	if (!allowedOrigins.length) return false;
+	return toAllowedOriginSet(allowedOrigins).has(origin);
+}
+function safeResolveUrl(raw, baseURL) {
+	const trim = raw.trim();
+	if (!trim) return null;
+	if (trim.startsWith("//") || trim.includes("\\")) return null;
+	if (/[\u0000-\u001F\u007F]/.test(trim)) return null;
+	try {
+		if (trim.startsWith("/")) return new URL(trim, baseURL);
+		return new URL(trim);
+	} catch {
+		return null;
+	}
+}
+function getSafeUniqueOrigins(urls) {
+	return [...toAllowedOriginSet(urls)];
+}
+/**
+* Returns an absolute URL only if its protocol and origin are allowed (after
+* resolving relative paths against `baseURL`). Otherwise returns `null`.
+*/
+function safeUrlParse(input) {
+	if (input.raw == null || input.raw.trim() === "") return null;
+	const target = safeResolveUrl(input.raw, input.baseURL);
+	if (!target || !isAllowedProtocol(target.protocol, input.allowedProtocols)) return null;
+	if (!isAllowedOrigin(target.origin, input.allowedOrigins ?? [])) return null;
+	return target.href;
+}
+//#endregion
 //#region src/events/constants.ts
 const EVENT_TYPES = {
 	USER_CREATED: "user_created",
@@ -2547,7 +2632,7 @@ const sentinel = (options) => {
 		id: "sentinel",
 		init(ctx) {
 			activityTrackingEnabled = (ctx.getPlugin("dash")?.options)?.activityTracking?.enabled === true;
-			const basePath = new URL(ctx.baseURL).pathname;
+			const basePath = ctx.baseURL ? resolveProjectAuthBase(ctx.baseURL, ctx.options.basePath).basePath : resolveProjectBasePath(ctx.options.basePath);
 			const ipHeaders = ctx.options.advanced?.ipAddress?.ipAddressHeaders || null;
 			const disableIpTracking = ctx.options.advanced?.ipAddress?.disableIpTracking === true;
 			/**
@@ -4267,6 +4352,66 @@ const jwtValidateMiddleware = (options) => {
 	});
 };
 //#endregion
+//#region src/lib/safe-url.ts
+function isSafeHttpUrl(value) {
+	try {
+		const url = new URL(value);
+		return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "";
+	} catch {
+		return false;
+	}
+}
+/** http(s) absolute URL without embedded credentials. */
+const safeUrlSchema = z.string().trim().min(1).pipe(z.url().refine(isSafeHttpUrl, { message: "URL must be a valid http(s) URL without credentials" })).transform((value) => new URL(value).href);
+const optionalSafeUrlSchema = z.union([safeUrlSchema, z.literal("")]).optional();
+/**
+* Request-scoped full auth URL (origin + mount). Prefer over `options.baseURL`,
+* which is origin-only or a dynamic config object.
+* BA resolves this before endpoint handlers; missing value is a programming error.
+*/
+function getAuthBaseUrl(ctx) {
+	const resolved = ctx.context.baseURL?.trim();
+	if (!resolved) throw new APIError$1("INTERNAL_SERVER_ERROR", { message: "Auth base URL is not resolved for this request." });
+	return resolved;
+}
+/** App origin for post-auth redirects (not the auth mount path). */
+function getAuthOrigin(ctx) {
+	return new URL(getAuthBaseUrl(ctx)).origin;
+}
+function getAllowedAuthOrigins(ctx, extraOrigins = []) {
+	return getSafeUniqueOrigins([
+		getAuthBaseUrl(ctx),
+		...ctx.context.trustedOrigins ?? [],
+		...extraOrigins
+	]);
+}
+/**
+* Resolve a redirect against the auth server's base URL and trusted origins.
+* Falls back when the target origin is not allowed.
+*/
+function resolveTrustedAuthRedirectUrl(ctx, raw, fallback) {
+	return safeUrlParse({
+		raw,
+		baseURL: getAuthBaseUrl(ctx),
+		allowedOrigins: getAllowedAuthOrigins(ctx)
+	}) ?? fallback;
+}
+/** Returns a trusted redirect URL or null when the origin is not allowed. */
+function parseTrustedAuthRedirectUrl(ctx, raw) {
+	return safeUrlParse({
+		raw,
+		baseURL: getAuthBaseUrl(ctx),
+		allowedOrigins: getAllowedAuthOrigins(ctx)
+	});
+}
+const TRUSTED_CALLBACK_URL_ERROR = "Callback URL must use http(s) and match the auth base URL or a trusted origin.";
+/** Rejects email/redirect callbacks whose origin is not on the auth allowlist. */
+function requireTrustedAuthCallbackUrl(ctx, raw) {
+	const trusted = parseTrustedAuthRedirectUrl(ctx, raw);
+	if (!trusted) throw new APIError$1("BAD_REQUEST", { message: TRUSTED_CALLBACK_URL_ERROR });
+	return trusted;
+}
+//#endregion
 //#region ../utils/dist/semver.mjs
 /**
 * Parses a semver string into components.
@@ -4337,6 +4482,7 @@ const getConfig = (options) => {
 	}, async (ctx) => {
 		const advancedOptions = ctx.context.options.advanced;
 		const organizationPlugin = ctx.context.getPlugin("organization");
+		const authBase = resolveProjectAuthBase(getAuthBaseUrl(ctx), ctx.context.options.basePath);
 		return redactDashSettings({
 			version: ctx.context.version || null,
 			socialProviders: Object.keys(ctx.context.options.socialProviders || {}),
@@ -4406,8 +4552,8 @@ const getConfig = (options) => {
 				deleteUserEnabled: !!ctx.context.options.user?.deleteUser?.enabled,
 				modelName: ctx.context.options.user?.modelName
 			},
-			baseURL: ctx.context.options.baseURL,
-			basePath: ctx.context.options.basePath || "/api/auth",
+			baseURL: authBase.baseURL,
+			basePath: authBase.basePath,
 			emailVerification: { sendVerificationEmailEnabled: !!ctx.context.options.emailVerification?.sendVerificationEmail },
 			insights: {
 				hasDatabase: !!ctx.context.options.database,
@@ -4601,7 +4747,7 @@ const directorySyncClaimsSchema = z.object({
 	setupOperationId: z.string().trim().min(16).max(255).optional()
 });
 function getScimEndpoint$1(baseUrl) {
-	return `${baseUrl}/scim/v2`;
+	return normalizeUrl(baseUrl, "scim/v2");
 }
 function assertDirectorySyncClaims(ctx, organizationId) {
 	const claims = ctx.context.payload;
@@ -5503,7 +5649,7 @@ async function scimProviderExists(ctx, organizationId, providerId) {
 	}) != null;
 }
 function getScimEndpoint(baseUrl) {
-	return `${baseUrl}/scim/v2`;
+	return normalizeUrl(baseUrl, "scim/v2");
 }
 function resolveMode(ctx) {
 	return resolveDirectorySyncMode(getSCIMPlugin(ctx), isManagedDirectorySyncEnabled(ctx));
@@ -6062,105 +6208,6 @@ function allowsPasswordlessInviteComplete(authMode) {
 	return authMode === "create_with_session";
 }
 //#endregion
-//#region ../utils/dist/url.mjs
-/**
-* URL helpers: normalization, SSRF-safe parsing/validation, and path/query segments.
-*/
-const HTTP_PROTOCOLS = ["http:", "https:"];
-function isAllowedProtocol(protocol, allowedProtocols) {
-	return (allowedProtocols?.length ? allowedProtocols : HTTP_PROTOCOLS).includes(protocol);
-}
-function toAllowedOriginSet(allowedOrigins) {
-	const set = /* @__PURE__ */ new Set();
-	for (const raw of allowedOrigins) try {
-		const parsed = new URL(raw.trim());
-		if (isAllowedProtocol(parsed.protocol, HTTP_PROTOCOLS)) set.add(parsed.origin);
-	} catch {}
-	return set;
-}
-function isAllowedOrigin(origin, allowedOrigins) {
-	if (!allowedOrigins.length) return false;
-	return toAllowedOriginSet(allowedOrigins).has(origin);
-}
-function safeResolveUrl(raw, baseURL) {
-	const trim = raw.trim();
-	if (!trim) return null;
-	if (trim.startsWith("//") || trim.includes("\\")) return null;
-	if (/[\u0000-\u001F\u007F]/.test(trim)) return null;
-	try {
-		if (trim.startsWith("/")) return new URL(trim, baseURL);
-		return new URL(trim);
-	} catch {
-		return null;
-	}
-}
-function getSafeUniqueOrigins(urls) {
-	return [...toAllowedOriginSet(urls)];
-}
-/**
-* Returns an absolute URL only if its protocol and origin are allowed (after
-* resolving relative paths against `baseURL`). Otherwise returns `null`.
-*/
-function safeUrlParse(input) {
-	if (input.raw == null || input.raw.trim() === "") return null;
-	const target = safeResolveUrl(input.raw, input.baseURL);
-	if (!target || !isAllowedProtocol(target.protocol, input.allowedProtocols)) return null;
-	if (!isAllowedOrigin(target.origin, input.allowedOrigins ?? [])) return null;
-	return target.href;
-}
-//#endregion
-//#region src/lib/safe-url.ts
-function isSafeHttpUrl(value) {
-	try {
-		const url = new URL(value);
-		return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "";
-	} catch {
-		return false;
-	}
-}
-/** http(s) absolute URL without embedded credentials. */
-const safeUrlSchema = z.string().trim().min(1).pipe(z.url().refine(isSafeHttpUrl, { message: "URL must be a valid http(s) URL without credentials" })).transform((value) => new URL(value).href);
-const optionalSafeUrlSchema = z.union([safeUrlSchema, z.literal("")]).optional();
-function getAuthBaseUrl(ctx) {
-	const baseURL = ctx.context.options.baseURL;
-	return typeof baseURL === "string" && baseURL.trim() ? baseURL : "/";
-}
-function getAllowedAuthOrigins(ctx, extraOrigins = []) {
-	const baseURL = getAuthBaseUrl(ctx);
-	const trusted = ctx.context.options.trustedOrigins;
-	return getSafeUniqueOrigins([
-		baseURL,
-		...Array.isArray(trusted) ? trusted.filter((origin) => typeof origin === "string") : [],
-		...extraOrigins
-	]);
-}
-/**
-* Resolve a redirect against the auth server's base URL and trusted origins.
-* Falls back when the target origin is not allowed.
-*/
-function resolveTrustedAuthRedirectUrl(ctx, raw, fallback) {
-	return safeUrlParse({
-		raw,
-		baseURL: getAuthBaseUrl(ctx),
-		allowedOrigins: getAllowedAuthOrigins(ctx)
-	}) ?? fallback;
-}
-/** Returns a trusted redirect URL or null when the origin is not allowed. */
-function parseTrustedAuthRedirectUrl(ctx, raw) {
-	return safeUrlParse({
-		raw,
-		baseURL: getAuthBaseUrl(ctx),
-		allowedOrigins: getAllowedAuthOrigins(ctx)
-	});
-}
-const TRUSTED_CALLBACK_URL_ERROR = "Callback URL must use http(s) and match the auth base URL or a trusted origin.";
-/** Rejects email/redirect callbacks whose origin is not on the auth allowlist. */
-function requireTrustedAuthCallbackUrl(ctx, raw) {
-	const trusted = parseTrustedAuthRedirectUrl(ctx, raw);
-	if (!trusted) throw new APIError$1("BAD_REQUEST", { message: TRUSTED_CALLBACK_URL_ERROR });
-	return trusted;
-}
-//#endregion
 //#region src/routes/invitations/index.ts
 async function verifyPendingInvitation(token, $api, ctx) {
 	const { data: invitation, error } = await $api("/api/internal/invitations/verify", {
@@ -6206,7 +6253,7 @@ async function executePlatformInvitationCompletion(ctx, $api, invitation, args)
 				user: existingUser
 			});
 		}
-		return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)) };
+		return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthOrigin(ctx)) };
 	}
 	if (!password && !allowsPasswordlessInviteComplete(invitation.authMode)) throw new APIError("BAD_REQUEST", { message: "Password is required to complete this invitation." });
 	const userPayload = {
@@ -6237,7 +6284,7 @@ async function executePlatformInvitationCompletion(ctx, $api, invitation, args)
 			user
 		});
 	}
-	return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)) };
+	return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthOrigin(ctx)) };
 }
 /**
 * Accept invitation endpoint
@@ -6270,14 +6317,14 @@ const acceptInvitation = (options) => {
 					user: existingUser
 				});
 			}
-			const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx));
+			const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthOrigin(ctx));
 			return ctx.redirect(redirectUrl);
 		}
 		if (usesPlatformInviteAcceptFlow(invitation.authMode)) {
 			const platformUrl = options.apiUrl || INFRA_API_URL;
 			const acceptPageUrl = new URL("/invite/accept", platformUrl);
 			acceptPageUrl.searchParams.set("token", token);
-			const callbackUrl = `${ctx.context.options.baseURL}${ctx.context.options.basePath || "/api/auth"}/dash/complete-invitation`;
+			const callbackUrl = normalizeUrl(ctx.context.baseURL, "dash/complete-invitation");
 			acceptPageUrl.searchParams.set("callback", callbackUrl);
 			return ctx.redirect(acceptPageUrl.toString());
 		}
@@ -6305,7 +6352,7 @@ const acceptInvitation = (options) => {
 				user
 			});
 		}
-		const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx));
+		const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthOrigin(ctx));
 		return ctx.redirect(redirectUrl);
 	});
 };
@@ -6385,7 +6432,7 @@ const completeInvitationSocial = (options) => {
 			if (sessionCookieToken) await ctx.context.internalAdapter.deleteSession(sessionCookieToken);
 			deleteSessionCookie(ctx);
 		}
-		return ctx.redirect(resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)));
+		return ctx.redirect(resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthOrigin(ctx)));
 	});
 };
 /**
@@ -8439,7 +8486,7 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 	const ba17OrLater = isBetterAuth17OrLater(ctx.context.version);
 	if (saml17OrNewer && !resolvedEntryPoint) throw ctx.error("BAD_REQUEST", { message: "SAML entry point URL is required; provide entryPoint or IdP metadata with SingleSignOnService Location" });
 	if (ba17OrLater && !idpMetadataXml && !samlConfig.entityId?.trim()) throw ctx.error("BAD_REQUEST", { message: "IdP entity ID is required when IdP metadata XML is not provided" });
-	const spIssuer = `${baseURL}/sso/saml2/sp/metadata?providerId=${providerId}`;
+	const spIssuer = `${normalizeUrl(baseURL, "sso/saml2/sp/metadata")}?providerId=${providerId}`;
 	const idpMetadata = idpMetadataXml ? { metadata: idpMetadataXml } : {
 		...ba17OrLater ? { entityID: samlConfig.entityId } : {},
 		...samlConfig.entryPoint ? { singleSignOnService: [{
@@ -8457,7 +8504,7 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 				entryPoint: resolvedEntryPoint,
 				...samlConfig.cert ? { cert: samlConfig.cert } : {}
 			} : {
-				callbackUrl: `${baseURL}/sso/saml2/sp/acs/${providerId}`,
+				callbackUrl: normalizeUrl(baseURL, `sso/saml2/sp/acs/${providerId}`),
 				spMetadata: {},
 				entryPoint: resolvedEntryPoint ?? "",
 				cert: samlConfig.cert ?? ""

package/dist/native.mjs

@@ -1,5 +1,5 @@
-import { o as createKV, t as bytesToHex } from "./crypto-DRS7yhmR.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-Di0eUKbA.mjs";
+import { o as createKV, t as bytesToHex } from "./crypto-DDadesq-.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-DRUkPcBn.mjs";
 import { env } from "@better-auth/core/env";
 import { Dimensions, InteractionManager, PixelRatio, Platform } from "react-native";
 //#region src/sentinel/native/components.ts

package/dist/{pow-retry-Di0eUKbA.mjs → pow-retry-DRUkPcBn.mjs}

@@ -1,4 +1,4 @@
-import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-DRS7yhmR.mjs";
+import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-DDadesq-.mjs";
 //#region src/dash-client.ts
 function resolveDashUserId(input, options) {
 	return input.userId || options?.resolveUserId?.({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.4.8",
+  "version": "0.4.9",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",