@better-auth/infra 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -5,8 +5,26 @@ All notable changes to `@better-auth/infra` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.2] - 2026-08-21
+
+### Fixed
+
+- **Identification on OAuth callbacks** — Sentinel and dash run identification on GET OAuth callback routes and persist `X-Request-Id` as the `__infra-rid` cookie in an after hook, so visitor identity resolves from KV across redirect-based social/OAuth sign-in (where identify headers are absent).
+- **Issuer-scoped account lookups** — OAuth callback user resolution honors `account.identityStrategy` (`issuer` vs `provider-id`) when deriving account keys, matching Better Auth 1.7 issuer-scoped identity and the provider-scoped compatibility mode.
+
+### Changed
+
+- **No runtime dependency on SCIM / SSO packages** — Directory-sync SCIM user-link acquisition and SAML SP policy checks are implemented in-package (aligned with `@better-auth/scim` / `@better-auth/sso`). Those packages remain type-only deps and are excluded from the published bundle.
+
+## [0.4.1] - 2026-08-19
+
+### Fixed
+
+- **React Native / Hermes crypto** — SHA-256 (including Sentinel PoW challenge solve/verify) no longer requires `crypto.subtle`. Prefers Web Crypto when present; otherwise falls back to `@noble/hashes`.
+
 ## [0.4.0] - 2026-08-14
 
+
 ### Added
 
 - **Managed SCIM directory sync** — Opt-in `dash({ managedDirectorySync: { enabled: true } })` control plane for Better Auth 1.7+ managed connections. Adds dashboard lifecycle endpoints to create, list, get, rotate credentials, revoke credentials, list events, unpair, and decommission organization directories, plus schema for `directorySyncConnection` / membership provenance, optional SSO pairing hooks, and SCIM → organization membership projection.

package/README.md

@@ -80,6 +80,10 @@ Use this plugin for your React Native / Expo app. This plugin is designed to wor
 pnpm add react-native @react-native-async-storage/async-storage
 # Optional, for richer device metadata in the identify payload:
 pnpm add expo-constants expo-device
+# Optional, secure visitor-id RNG (Expo):
+pnpm add expo-crypto
+# Or plain React Native — first import in the app entry:
+# import "react-native-get-random-values";
 ```
 
 `@react-native-async-storage/async-storage` is optional; if it is not installed, a session-only in-memory visitor id is used. For production, install it or pass `storage` (for example secure storage).

package/dist/client.d.mts

@@ -1,5 +1,4 @@
-import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-RI-JiXQx.mjs";
-
+import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-CgijjwVT.mjs";
 //#region src/sentinel/client.d.ts
 interface SentinelClientOptions {
   /**

package/dist/client.mjs

@@ -1,5 +1,5 @@
-import { n as hash, o as createKV } from "./crypto-CAdWFWEz.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-DZhZiYd_.mjs";
+import { n as hash, o as createKV } from "./crypto-D3yZH0Cy.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-jWGI__oh.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts
 function murmurhash3(str, seed = 0) {
@@ -325,7 +325,8 @@ async function generateVisitorId(components) {
 		fonts: components.fonts,
 		maxTouchPoints: components.maxTouchPoints
 	};
-	return (await hash(JSON.stringify(stableData))).slice(0, 20);
+	const dataString = JSON.stringify(stableData);
+	return (await hash(dataString)).slice(0, 20);
 }
 function calculateConfidence(components) {
 	const weights = {
@@ -435,11 +436,12 @@ function appendIdentification(headers, fingerprint) {
 const MAX_POW_CHALLENGE_ROUNDS = 2;
 const sentinelClient = (options) => {
 	const autoSolve = options?.autoSolveChallenge !== false;
+	const identifyUrl = resolveSentinelClientIdentifyUrl({
+		identifyUrl: options?.identifyUrl,
+		envKvUrl: env.BETTER_AUTH_KV_URL
+	});
 	const $kv = createKV({
-		kvUrl: resolveSentinelClientIdentifyUrl({
-			identifyUrl: options?.identifyUrl,
-			envKvUrl: env.BETTER_AUTH_KV_URL
-		}),
+		kvUrl: identifyUrl,
 		timeout: options?.identifyOptions?.timeout ?? options?.kvTimeout
 	}, {
 		throw: true,

package/dist/{constants-CcJHk5SE.mjs → constants-CDhjfr8S.mjs}

@@ -1,7 +1,7 @@
 import { env } from "@better-auth/core/env";
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.4.0";
+const PLUGIN_VERSION = "0.4.2";
 //#endregion
 //#region src/constants.ts
 /**

package/dist/{crypto-CAdWFWEz.mjs → crypto-D3yZH0Cy.mjs}

@@ -1,5 +1,6 @@
-import { i as INFRA_USER_AGENT } from "./constants-CcJHk5SE.mjs";
+import { i as INFRA_USER_AGENT } from "./constants-CDhjfr8S.mjs";
 import { createFetch } from "@better-fetch/fetch";
+import { sha256 } from "@noble/hashes/sha2.js";
 //#region src/fetch.ts
 function createAPI(options, fetchOptions) {
 	return createFetch({
@@ -32,19 +33,33 @@ function randomBytes(length) {
 function bytesToHex(bytes) {
 	return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+function getSubtle() {
+	try {
+		const c = globalThis.crypto;
+		if (c && typeof c.subtle === "object" && c.subtle != null) return c.subtle;
+	} catch {}
+	return null;
+}
+/** SHA-256 hex digest. Prefers Web Crypto; falls back to `@noble/hashes`. */
 async function hash(message) {
-	const msgBuffer = new TextEncoder().encode(message);
-	const hashBuffer = await crypto.subtle.digest("SHA-256", msgBuffer);
-	return bytesToHex(new Uint8Array(hashBuffer));
+	const data = new TextEncoder().encode(message);
+	const subtle = getSubtle();
+	if (subtle) {
+		const hashBuffer = await subtle.digest("SHA-256", data);
+		return bytesToHex(new Uint8Array(hashBuffer));
+	}
+	return bytesToHex(sha256(data));
 }
 /** Keyed HMAC-SHA256 for blinded fingerprints (e.g. failed-login passwords). */
 async function hmacSha256Hex(key, message) {
 	const encoder = new TextEncoder();
-	const cryptoKey = await crypto.subtle.importKey("raw", encoder.encode(key), {
+	const subtle = getSubtle();
+	if (!subtle) throw new Error("[@better-auth/infra] crypto.subtle is required for HMAC-SHA256");
+	const cryptoKey = await subtle.importKey("raw", encoder.encode(key), {
 		name: "HMAC",
 		hash: "SHA-256"
 	}, false, ["sign"]);
-	const signature = await crypto.subtle.sign("HMAC", cryptoKey, encoder.encode(message));
+	const signature = await subtle.sign("HMAC", cryptoKey, encoder.encode(message));
 	return bytesToHex(new Uint8Array(signature));
 }
 //#endregion

package/dist/email.mjs

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CcJHk5SE.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CDhjfr8S.mjs";
 import { logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { createFetch } from "@better-fetch/fetch";

package/dist/{identify-client-options-RI-JiXQx.d.mts → identify-client-options-CgijjwVT.d.mts}

@@ -1,7 +1,6 @@
-import { m as KvRetryOptions } from "./types-B673lCib.mjs";
+import { m as KvRetryOptions } from "./types-Ddk4r5x9.mjs";
 import { BetterAuthClientOptions, ClientStore } from "better-auth";
 import { BetterFetch } from "@better-fetch/fetch";
-
 //#region src/dash-client.d.ts
 interface DashAuditLog {
   eventType: string;

package/dist/index.d.mts

@@ -1,11 +1,11 @@
-import { C as ImpossibleTravelResult, D as SecurityVerdict, E as SecurityOptions, O as StaleUserResult, S as CredentialStuffingResult, T as SecurityEventType, _ as LocationDataContext, a as DashOptionsInternal, b as sentinel, c as EndpointOptions, d as InfraPluginConnectionOptionsInternal, f as KvOptions, g as LocationData, h as KvRetryOptionsResolved, i as DashOptions, k as ThresholdConfig, l as InfraEndpointContext, m as KvRetryOptions, n as ApiOptions, o as DashOptionsResolved, p as KvOptionsResolved, r as ApiOptionsResolved, s as Endpoint, t as APIError, u as InfraPluginConnectionOptions, v as SentinelOptions, w as SecurityEvent, x as CompromisedPasswordResult, y as SentinelOptionsInternal } from "./types-B673lCib.mjs";
+import { C as ImpossibleTravelResult, D as SecurityVerdict, E as SecurityOptions, O as StaleUserResult, S as CredentialStuffingResult, T as SecurityEventType, _ as LocationDataContext, a as DashOptionsInternal, b as sentinel, c as EndpointOptions, d as InfraPluginConnectionOptionsInternal, f as KvOptions, g as LocationData, h as KvRetryOptionsResolved, i as DashOptions, k as ThresholdConfig, l as InfraEndpointContext, m as KvRetryOptions, n as ApiOptions, o as DashOptionsResolved, p as KvOptionsResolved, r as ApiOptionsResolved, s as Endpoint, t as APIError, u as InfraPluginConnectionOptions, v as SentinelOptions, w as SecurityEvent, x as CompromisedPasswordResult, y as SentinelOptionsInternal } from "./types-Ddk4r5x9.mjs";
 import { EMAIL_TEMPLATES, EmailConfig, EmailTemplateId, EmailTemplateVariables, SendBulkEmailsOptions, SendBulkEmailsResult, SendEmailOptions, SendEmailResult, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { Account, AuthContext, GenericEndpointContext, Session, User } from "better-auth";
-import z$1 from "zod";
+import z from "zod";
 import { DBFieldAttribute } from "better-auth/db";
 import { Invitation, Member, Organization, Team, TeamMember } from "better-auth/plugins";
+import "better-auth/types";
 export type * from "better-call";
-
 //#region src/pow.d.ts
 /**
  * Proof of Work Challenge System - Client Side
@@ -249,7 +249,22 @@ type DashSCIMManagedConnectionEventType = "connection.created" | "credential.iss
 /** Lifecycle state for one Infrastructure-owned directory-sync alias. */
 type DirectorySyncConnectionStatus = "active" | "decommissioning" | "decommissioned";
 type DirectorySyncMode = "legacy" | "managed" | "unavailable";
-type SCIMPlugin = ReturnType<typeof import("@better-auth/scim").scim>;
+/**
+ * Structural stand-in for the SCIM plugin instance.
+ * Avoids `import("@better-auth/scim")` on the public type surface so consumers
+ * without that package can still typecheck the root entry.
+ */
+type SCIMPlugin = {
+  id?: string;
+  options?: {
+    providerOwnership?: {
+      enabled?: boolean;
+    };
+    managedConnections?: unknown;
+    [key: string]: unknown;
+  };
+  endpoints: Record<string, unknown>;
+};
 /** Public credential metadata. Raw bearer tokens are never included here. */
 interface DashDirectoryCredential {
   credentialId: string;