@better-auth/infra 0.4.2 → 0.4.4

package/CHANGELOG.md

@@ -5,8 +5,25 @@ All notable changes to `@better-auth/infra` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.4] - 2026-08-27
+
+### Added
+
+- **`GET /dash/config` adapter insight** — Config insights report database adapter identity and capability flags.
+
+### Changed
+
+- **Sentinel PoW vs rate limits** — Proof-of-work challenges no longer consume Better Auth rate-limit budget.
+
+## [0.4.3] - 2026-08-25
+
+### Added
+
+- **SAML `wantAssertionsSigned`** — Dash SSO create/update accept and persist `samlConfig.wantAssertionsSigned` (default `true`). Required for directory sync SAML pairing; can be disabled only when the IdP cannot sign assertions.
+
 ## [0.4.2] - 2026-08-21
 
+
 ### Fixed
 
 - **Identification on OAuth callbacks** — Sentinel and dash run identification on GET OAuth callback routes and persist `X-Request-Id` as the `__infra-rid` cookie in an after hook, so visitor identity resolves from KV across redirect-based social/OAuth sign-in (where identify headers are absent).

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-CgijjwVT.mjs";
+import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-Cim5Fztg.mjs";
 //#region src/sentinel/client.d.ts
 interface SentinelClientOptions {
   /**

package/dist/client.mjs

@@ -1,5 +1,5 @@
-import { n as hash, o as createKV } from "./crypto-D3yZH0Cy.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-jWGI__oh.mjs";
+import { n as hash, o as createKV } from "./crypto-DZClUivd.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-BvjK8YBw.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts
 function murmurhash3(str, seed = 0) {

package/dist/{constants-CDhjfr8S.mjs → constants-CARN9f1y.mjs}

@@ -1,7 +1,7 @@
 import { env } from "@better-auth/core/env";
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.4.2";
+const PLUGIN_VERSION = "0.4.4";
 //#endregion
 //#region src/constants.ts
 /**

package/dist/{crypto-D3yZH0Cy.mjs → crypto-DZClUivd.mjs}

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT } from "./constants-CDhjfr8S.mjs";
+import { i as INFRA_USER_AGENT } from "./constants-CARN9f1y.mjs";
 import { createFetch } from "@better-fetch/fetch";
 import { sha256 } from "@noble/hashes/sha2.js";
 //#region src/fetch.ts

package/dist/email.mjs

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CDhjfr8S.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CARN9f1y.mjs";
 import { logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { createFetch } from "@better-fetch/fetch";

package/dist/{identify-client-options-CgijjwVT.d.mts → identify-client-options-Cim5Fztg.d.mts}

@@ -1,4 +1,4 @@
-import { m as KvRetryOptions } from "./types-Ddk4r5x9.mjs";
+import { m as KvRetryOptions } from "./types-sP9ucYj1.mjs";
 import { BetterAuthClientOptions, ClientStore } from "better-auth";
 import { BetterFetch } from "@better-fetch/fetch";
 //#region src/dash-client.d.ts

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { C as ImpossibleTravelResult, D as SecurityVerdict, E as SecurityOptions, O as StaleUserResult, S as CredentialStuffingResult, T as SecurityEventType, _ as LocationDataContext, a as DashOptionsInternal, b as sentinel, c as EndpointOptions, d as InfraPluginConnectionOptionsInternal, f as KvOptions, g as LocationData, h as KvRetryOptionsResolved, i as DashOptions, k as ThresholdConfig, l as InfraEndpointContext, m as KvRetryOptions, n as ApiOptions, o as DashOptionsResolved, p as KvOptionsResolved, r as ApiOptionsResolved, s as Endpoint, t as APIError, u as InfraPluginConnectionOptions, v as SentinelOptions, w as SecurityEvent, x as CompromisedPasswordResult, y as SentinelOptionsInternal } from "./types-Ddk4r5x9.mjs";
+import { C as ImpossibleTravelResult, D as SecurityVerdict, E as SecurityOptions, O as StaleUserResult, S as CredentialStuffingResult, T as SecurityEventType, _ as LocationDataContext, a as DashOptionsInternal, b as sentinel, c as EndpointOptions, d as InfraPluginConnectionOptionsInternal, f as KvOptions, g as LocationData, h as KvRetryOptionsResolved, i as DashOptions, k as ThresholdConfig, l as InfraEndpointContext, m as KvRetryOptions, n as ApiOptions, o as DashOptionsResolved, p as KvOptionsResolved, r as ApiOptionsResolved, s as Endpoint, t as APIError, u as InfraPluginConnectionOptions, v as SentinelOptions, w as SecurityEvent, x as CompromisedPasswordResult, y as SentinelOptionsInternal } from "./types-sP9ucYj1.mjs";
 import { EMAIL_TEMPLATES, EmailConfig, EmailTemplateId, EmailTemplateVariables, SendBulkEmailsOptions, SendBulkEmailsResult, SendEmailOptions, SendEmailResult, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { Account, AuthContext, GenericEndpointContext, Session, User } from "better-auth";
 import z from "zod";
@@ -1157,6 +1157,7 @@ declare const dash: <O extends DashOptions>(options?: O) => {
           entryPoint: import("zod").ZodOptional<import("zod").ZodString>;
           cert: import("zod").ZodOptional<import("zod").ZodString>;
           entityId: import("zod").ZodOptional<import("zod").ZodString>;
+          wantAssertionsSigned: import("zod").ZodOptional<import("zod").ZodBoolean>;
           mapping: import("zod").ZodOptional<import("zod").ZodObject<{
             id: import("zod").ZodOptional<import("zod").ZodString>;
             email: import("zod").ZodOptional<import("zod").ZodString>;
@@ -1214,6 +1215,7 @@ declare const dash: <O extends DashOptions>(options?: O) => {
           entryPoint: import("zod").ZodOptional<import("zod").ZodString>;
           cert: import("zod").ZodOptional<import("zod").ZodString>;
           entityId: import("zod").ZodOptional<import("zod").ZodString>;
+          wantAssertionsSigned: import("zod").ZodOptional<import("zod").ZodBoolean>;
           mapping: import("zod").ZodOptional<import("zod").ZodObject<{
             id: import("zod").ZodOptional<import("zod").ZodString>;
             email: import("zod").ZodOptional<import("zod").ZodString>;

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CDhjfr8S.mjs";
-import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-D3yZH0Cy.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CARN9f1y.mjs";
+import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-DZClUivd.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAdapter, getCurrentAuthContext, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
@@ -56,6 +56,27 @@ function resolveSentinelOptions(options) {
 	};
 }
 //#endregion
+//#region ../utils/dist/ip.mjs
+/** Platform-set client IP headers (not accepted from clients on the open internet). */
+const DEFAULT_TRUSTED_IP_HEADERS = [
+	"cf-connecting-ip",
+	"true-client-ip",
+	"x-vercel-forwarded-for"
+];
+/**
+* Resolves client IP from request headers.
+* Defaults to platform-trusted headers only; set `ipAddressHeaders` for self-hosted proxies.
+*/
+function resolveClientIpFromHeaders(headers, ipAddressHeaders) {
+	const headerNames = ipAddressHeaders?.length ? ipAddressHeaders : [...DEFAULT_TRUSTED_IP_HEADERS];
+	for (const headerName of headerNames) {
+		const value = headers.get(headerName);
+		if (!value) continue;
+		const ip = value.split(",")[0]?.trim();
+		if (ip) return ip;
+	}
+}
+//#endregion
 //#region src/events/constants.ts
 const EVENT_TYPES = {
 	USER_CREATED: "user_created",
@@ -1060,27 +1081,6 @@ const initTrackEvents = ($api) => {
 	return { tracker: { trackEvent } };
 };
 //#endregion
-//#region ../utils/dist/ip.mjs
-/** Platform-set client IP headers (not accepted from clients on the open internet). */
-const DEFAULT_TRUSTED_IP_HEADERS = [
-	"cf-connecting-ip",
-	"true-client-ip",
-	"x-vercel-forwarded-for"
-];
-/**
-* Resolves client IP from request headers.
-* Defaults to platform-trusted headers only; set `ipAddressHeaders` for self-hosted proxies.
-*/
-function resolveClientIpFromHeaders(headers, ipAddressHeaders) {
-	const headerNames = ipAddressHeaders?.length ? ipAddressHeaders : [...DEFAULT_TRUSTED_IP_HEADERS];
-	for (const headerName of headerNames) {
-		const value = headers.get(headerName);
-		if (!value) continue;
-		const ip = value.split(",")[0]?.trim();
-		if (ip) return ip;
-	}
-}
-//#endregion
 //#region src/identification.ts
 /**
 * Identification Service
@@ -2316,6 +2316,9 @@ const ERROR_MESSAGES = {
 	compromised_password: "This password has been found in data breaches. Please choose a different password.",
 	impossible_travel: "Login blocked due to suspicious location change."
 };
+function securityBlockMessage(reason) {
+	return ERROR_MESSAGES[reason] || "Access denied.";
+}
 /**
 * Throw a challenge error with appropriate headers
 */
@@ -2330,56 +2333,152 @@ function throwChallengeError(challenge, reason, message = "Please complete a sec
 	};
 	throw error;
 }
-/** Emits the `security_check` event inline before throwing — the after-hook won't run on throw. */
-async function handleSecurityVerdict(verdict, hookCtx, checkCtx, trackEvent, securityService) {
-	if (verdict.powVerified) recordCheck(hookCtx, "pow_challenge");
-	if (verdict.action === "allow") return;
+/**
+* Cooldown → consolidated security check → challenge/block/allow.
+* Does not emit events or throw; callers apply the result.
+*/
+async function resolveAdmission(input, securityService) {
+	const requestId = input.identification?.requestId ?? input.requestId ?? null;
+	if (input.visitorId || input.ip) {
+		if (await securityService.isBlocked(input.visitorId ?? "", input.ip, requestId)) return { type: "cooldown" };
+	}
+	const verdict = await securityService.checkSecurity({
+		visitorId: input.visitorId,
+		requestId,
+		ip: input.ip,
+		path: input.path,
+		identifier: input.identifier,
+		powSolution: input.powSolution ?? void 0
+	});
+	if (verdict.action === "allow") return {
+		type: "allow",
+		powVerified: verdict.powVerified
+	};
 	const reason = verdict.reason || "unknown";
-	if (verdict.action === "challenge" && checkCtx.visitorId) {
-		const challenge = verdict.challenge || await securityService.generateChallenge(checkCtx.visitorId, checkCtx.identification?.requestId ?? null);
+	if (verdict.action === "challenge") {
+		if (!input.visitorId) return {
+			type: "allow",
+			powVerified: verdict.powVerified
+		};
+		const challenge = verdict.challenge || await securityService.generateChallenge(input.visitorId, requestId);
 		if (!challenge?.trim()) {
 			logger.warn("[Sentinel] Could not generate PoW challenge (service may be unavailable). Falling back to allow.");
-			return;
+			return {
+				type: "allow",
+				powVerified: verdict.powVerified
+			};
 		}
-		setOutcome(hookCtx, "challenged", "server_security_check", {
+		return {
+			type: "challenge",
+			challenge,
 			reason,
-			...verdict.details
-		});
-		emitEvaluation(hookCtx, trackEvent, {
-			identifier: checkCtx.identifier,
-			userAgent: checkCtx.userAgent
-		});
-		throwChallengeError(challenge, reason);
+			details: verdict.details
+		};
 	}
-	if (verdict.action === "block") {
-		setOutcome(hookCtx, "blocked", "server_security_check", {
-			reason,
-			...verdict.details
-		});
-		emitEvaluation(hookCtx, trackEvent, {
-			identifier: checkCtx.identifier,
-			userAgent: checkCtx.userAgent
+	return {
+		type: "block",
+		reason,
+		details: verdict.details
+	};
+}
+/**
+* Record evaluation side effects and throw on deny. Returns on allow.
+*/
+function applyAdmission(admission, hookCtx, meta, trackEvent) {
+	if (hookCtx.context.visitorId || hookCtx.context.ip) recordCheck(hookCtx, "credential_stuffing");
+	if (admission.type === "allow") {
+		recordCheck(hookCtx, "server_security_check");
+		if (admission.powVerified) recordCheck(hookCtx, "pow_challenge");
+		return;
+	}
+	if (admission.type === "cooldown") {
+		setOutcome(hookCtx, "blocked", "credential_stuffing", {
+			phase: "cooldown_active",
+			visitorId: hookCtx.context.untrustedVisitorId ?? void 0,
+			confidence: 1
+		});
+		emitEvaluation(hookCtx, trackEvent, meta);
+		throw new APIError(403, { message: "Too many failed attempts. Please try again later." });
+	}
+	if (admission.type === "challenge") {
+		recordCheck(hookCtx, "server_security_check");
+		setOutcome(hookCtx, "challenged", "server_security_check", {
+			reason: admission.reason,
+			...admission.details
 		});
-		throw new APIError("FORBIDDEN", { message: ERROR_MESSAGES[reason] || "Access denied." });
+		emitEvaluation(hookCtx, trackEvent, meta);
+		throwChallengeError(admission.challenge, admission.reason);
 	}
+	recordCheck(hookCtx, "server_security_check");
+	setOutcome(hookCtx, "blocked", "server_security_check", {
+		reason: admission.reason,
+		...admission.details
+	});
+	emitEvaluation(hookCtx, trackEvent, meta);
+	throw new APIError("FORBIDDEN", { message: securityBlockMessage(admission.reason) });
 }
 /**
-* Single API call from the plugin; server runs all configured rules and returns
-* one verdict — counts as one billable check.
+* Resolve + apply in one step (before-hook when rate-limit did not pre-decide).
 */
 async function runSecurityChecks(hookCtx, checkCtx, securityService, trackEvent, powSolution) {
-	recordCheck(hookCtx, "server_security_check");
-	await handleSecurityVerdict(await securityService.checkSecurity({
+	applyAdmission(await resolveAdmission({
 		visitorId: checkCtx.visitorId,
-		requestId: checkCtx.identification?.requestId ?? checkCtx.requestId ?? null,
+		requestId: checkCtx.requestId,
+		identification: checkCtx.identification,
 		ip: checkCtx.ip,
 		path: checkCtx.path,
 		identifier: checkCtx.identifier,
-		powSolution: powSolution ?? void 0
-	}), hookCtx, checkCtx, trackEvent, securityService);
+		powSolution
+	}, securityService), hookCtx, {
+		identifier: checkCtx.identifier,
+		userAgent: checkCtx.userAgent
+	}, trackEvent);
 }
 //#endregion
 //#region src/sentinel/sentinel.ts
+/**
+* Strip basePath from a request URL for path matching.
+* Local copy of BA's normalizePathname — `@better-auth/core/utils/url` is not
+* exported on 1.4; `@better-auth/core/utils` barrel is gone on 1.7.
+*/
+function normalizeAuthPath(requestUrl, basePath) {
+	try {
+		const pathname = new URL(requestUrl).pathname.replace(/\/+$/, "") || "/";
+		const base = basePath.replace(/\/+$/, "") || "";
+		if (!base || base === "/") return pathname;
+		if (pathname === base) return "/";
+		if (pathname.startsWith(`${base}/`)) return pathname.slice(base.length).replace(/\/+$/, "") || "/";
+		return pathname;
+	} catch {
+		return "/";
+	}
+}
+const SECURITY_PROTECTED_ROUTES = [
+	routes.SIGN_IN_EMAIL,
+	routes.SIGN_IN_USERNAME,
+	routes.SIGN_IN_EMAIL_OTP,
+	routes.SIGN_IN_SOCIAL,
+	routes.SIGN_IN_PASSKEY,
+	routes.SIGN_IN_MAGIC_LINK,
+	routes.SIGN_IN_SSO,
+	routes.SIGN_IN_ANONYMOUS,
+	routes.SIGN_UP_EMAIL,
+	routes.FORGET_PASSWORD,
+	routes.REQUEST_PASSWORD_RESET,
+	routes.RESET_PASSWORD,
+	routes.TWO_FACTOR_VERIFY_TOTP,
+	routes.TWO_FACTOR_VERIFY_BACKUP,
+	routes.TWO_FACTOR_VERIFY_OTP,
+	routes.EMAIL_OTP_SEND,
+	routes.PHONE_SEND_OTP,
+	routes.MAGIC_LINK_VERIFY,
+	routes.ORG_CREATE,
+	routes.CHANGE_EMAIL,
+	routes.CHANGE_PASSWORD,
+	routes.SET_PASSWORD,
+	routes.LINK_SOCIAL,
+	routes.PASSKEY_ADD
+];
 const sentinel = (options) => {
 	const opts = resolveSentinelOptions(options);
 	const $api = createAPI(opts);
@@ -2402,6 +2501,12 @@ const sentinel = (options) => {
 		return typeof err.body === "object" && err.body !== null && "code" in err.body && err.body.code === STALE_ACCOUNT_BLOCK_ERROR.code;
 	}
 	let activityTrackingEnabled = false;
+	/**
+	* Admission from rateLimit.customRules for this Request. Reused by the
+	* before-hook and by BA 1.5's second customRules pass on onResponse.
+	* Do not delete — response-phase must still hit. GC cleans up with Request.
+	*/
+	const rateLimitAdmission = /* @__PURE__ */ new WeakMap();
 	if (!opts.apiKey) logger.warn("[Sentinel] Missing BETTER_AUTH_API_KEY. Security checks may fall back to allow mode when the Infra API rejects requests.");
 	const securityService = createSecurityClient(opts, $apiThrowing, opts.security || {}, (event) => {
 		trackEvent({
@@ -2432,114 +2537,165 @@ const sentinel = (options) => {
 		id: "sentinel",
 		init(ctx) {
 			activityTrackingEnabled = (ctx.getPlugin("dash")?.options)?.activityTracking?.enabled === true;
-			return { options: {
-				emailValidation: opts.security?.emailValidation,
-				emailNormalization: opts.security?.emailNormalization,
-				databaseHooks: {
-					user: {
-						create: {
-							async before(user, ctx) {
-								if (!ctx) return;
-								if (isDashRoute(ctx.path)) {
+			const basePath = new URL(ctx.baseURL).pathname;
+			const ipHeaders = ctx.options.advanced?.ipAddress?.ipAddressHeaders || null;
+			const disableIpTracking = ctx.options.advanced?.ipAddress?.disableIpTracking === true;
+			/**
+			* After any user customRule resolves, run Sentinel admission so PoW
+			* challenges skip BA consume (protocol round-trip) even when the app
+			* owns path rules or `**`. Block/cooldown still consume.
+			*/
+			const applyCoordination = async (request, afterUser) => {
+				const path = normalizeAuthPath(request.url, basePath);
+				if (request.method === "GET" || isDashRoute(path) || !matchesAnyRoute(path, SECURITY_PROTECTED_ROUTES)) return afterUser;
+				try {
+					const cached = rateLimitAdmission.get(request);
+					if (cached) return cached.type === "challenge" ? false : afterUser;
+					const requestId = request.headers.get("X-Request-Id");
+					const identification = requestId ? await getIdentification(requestId, $kv, opts.kvOptions.retry) : null;
+					const ip = disableIpTracking ? identification?.ip ?? null : identification?.ip ?? resolveClientIpFromHeaders(request.headers, ipHeaders) ?? null;
+					const admission = await resolveAdmission({
+						visitorId: identification?.visitorId ?? null,
+						requestId,
+						identification,
+						ip,
+						path,
+						powSolution: request.headers.get("X-PoW-Solution")
+					}, securityService);
+					rateLimitAdmission.set(request, admission);
+					if (admission.type === "challenge") return false;
+					return afterUser;
+				} catch {
+					return afterUser;
+				}
+			};
+			const wrapCustomRule = (userRule) => {
+				return async (request, current) => {
+					const userResult = typeof userRule === "function" ? await userRule(request, current) : userRule;
+					return applyCoordination(request, userResult === false ? false : userResult || current);
+				};
+			};
+			const customRules = {};
+			for (const [key, rule] of Object.entries(ctx.rateLimit?.customRules ?? {})) {
+				if (rule === void 0) continue;
+				customRules[key] = wrapCustomRule(rule);
+			}
+			if (!Object.hasOwn(customRules, "**")) customRules["**"] = async (request, current) => applyCoordination(request, current);
+			return {
+				context: { rateLimit: {
+					...ctx.rateLimit,
+					customRules
+				} },
+				options: {
+					emailValidation: opts.security?.emailValidation,
+					emailNormalization: opts.security?.emailNormalization,
+					rateLimit: { customRules },
+					databaseHooks: {
+						user: {
+							create: {
+								async before(user, ctx) {
+									if (!ctx) return;
+									if (isDashRoute(ctx.path)) {
+										if (user.email && typeof user.email === "string" && isEmailNormalizationEnabled(opts.security)) return { data: {
+											...user,
+											email: normalizeEmail(user.email, ctx.context)
+										} };
+										return;
+									}
+									const visitorId = ctx.context.visitorId;
+									if (opts.security?.freeTrialAbuse?.enabled) {
+										if (!visitorId) {
+											recordCheck(ctx, "free_trial_abuse");
+											setOutcome(ctx, "blocked", "free_trial_abuse", { reason: "identification_required" });
+											emitEvaluation(ctx, trackEvent);
+											throw new APIError("FORBIDDEN", { message: "Account creation is not allowed without device identification." });
+										}
+										recordCheck(ctx, "free_trial_abuse");
+										const reservationId = crypto.randomUUID();
+										ctx.context.freeTrialReservationId = reservationId;
+										const abuseCheck = await securityService.reserveFreeTrialSignup(visitorId, reservationId, ctx.context.requestId ?? null);
+										if (abuseCheck.isAbuse && abuseCheck.action === "block") {
+											setOutcome(ctx, "blocked", "free_trial_abuse", {
+												accountCount: abuseCheck.accountCount,
+												maxAccounts: abuseCheck.maxAccounts
+											});
+											emitEvaluation(ctx, trackEvent);
+											throw new APIError("FORBIDDEN", { message: "Account creation is not allowed from this device." });
+										}
+									}
 									if (user.email && typeof user.email === "string" && isEmailNormalizationEnabled(opts.security)) return { data: {
 										...user,
 										email: normalizeEmail(user.email, ctx.context)
 									} };
-									return;
-								}
-								const visitorId = ctx.context.visitorId;
-								if (opts.security?.freeTrialAbuse?.enabled) {
-									if (!visitorId) {
-										recordCheck(ctx, "free_trial_abuse");
-										setOutcome(ctx, "blocked", "free_trial_abuse", { reason: "identification_required" });
-										emitEvaluation(ctx, trackEvent);
-										throw new APIError("FORBIDDEN", { message: "Account creation is not allowed without device identification." });
-									}
-									recordCheck(ctx, "free_trial_abuse");
-									const reservationId = crypto.randomUUID();
-									ctx.context.freeTrialReservationId = reservationId;
-									const abuseCheck = await securityService.reserveFreeTrialSignup(visitorId, reservationId, ctx.context.requestId ?? null);
-									if (abuseCheck.isAbuse && abuseCheck.action === "block") {
-										setOutcome(ctx, "blocked", "free_trial_abuse", {
-											accountCount: abuseCheck.accountCount,
-											maxAccounts: abuseCheck.maxAccounts
-										});
-										emitEvaluation(ctx, trackEvent);
-										throw new APIError("FORBIDDEN", { message: "Account creation is not allowed from this device." });
-									}
+								},
+								async after(user, ctx) {
+									if (!ctx || isDashRoute(ctx.path)) return;
+									const visitorId = ctx.context.visitorId;
+									const reservationId = ctx.context.freeTrialReservationId;
+									if (visitorId && reservationId && opts.security?.freeTrialAbuse?.enabled) await ctx.context.runInBackgroundOrAwait(securityService.confirmFreeTrialSignup(visitorId, reservationId, user.id, ctx.context.requestId ?? null));
 								}
+							},
+							update: { async before(user, ctx) {
+								if (!ctx) return;
 								if (user.email && typeof user.email === "string" && isEmailNormalizationEnabled(opts.security)) return { data: {
 									...user,
 									email: normalizeEmail(user.email, ctx.context)
 								} };
-							},
-							async after(user, ctx) {
+							} }
+						},
+						session: { create: {
+							async before(session, ctx) {
 								if (!ctx || isDashRoute(ctx.path)) return;
 								const visitorId = ctx.context.visitorId;
-								const reservationId = ctx.context.freeTrialReservationId;
-								if (visitorId && reservationId && opts.security?.freeTrialAbuse?.enabled) await ctx.context.runInBackgroundOrAwait(securityService.confirmFreeTrialSignup(visitorId, reservationId, user.id, ctx.context.requestId ?? null));
-							}
-						},
-						update: { async before(user, ctx) {
-							if (!ctx) return;
-							if (user.email && typeof user.email === "string" && isEmailNormalizationEnabled(opts.security)) return { data: {
-								...user,
-								email: normalizeEmail(user.email, ctx.context)
-							} };
-						} }
-					},
-					session: { create: {
-						async before(session, ctx) {
-							if (!ctx || isDashRoute(ctx.path)) return;
-							const visitorId = ctx.context.visitorId;
-							const identification = ctx.context.identification;
-							if (session.userId && identification?.location && visitorId) {
-								recordCheck(ctx, "impossible_travel");
-								const powSolution = ctx.headers?.get?.("X-PoW-Solution") ?? null;
-								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId, identification.ip, powSolution, identification.requestId);
-								if (travelCheck?.powVerified) recordCheck(ctx, "pow_challenge");
-								if (travelCheck?.isImpossible) {
-									if (travelCheck.action === "block") {
-										setOutcome(ctx, "blocked", "impossible_travel", {
-											from: travelCheck.from,
-											to: travelCheck.to,
-											distance: travelCheck.distance,
-											speedRequired: travelCheck.speedRequired
-										});
-										emitEvaluation(ctx, trackEvent);
-										throw new APIError("FORBIDDEN", { message: "Login blocked due to suspicious location change." });
-									}
-									if (travelCheck.action === "challenge" && travelCheck.challenge) {
-										setOutcome(ctx, "challenged", "impossible_travel", {
-											from: travelCheck.from,
-											to: travelCheck.to,
-											distance: travelCheck.distance,
-											speedRequired: travelCheck.speedRequired
-										});
-										emitEvaluation(ctx, trackEvent);
-										throwChallengeError(travelCheck.challenge, "impossible_travel", "Unusual login location detected. Please complete a security check.");
+								const identification = ctx.context.identification;
+								if (session.userId && identification?.location && visitorId) {
+									recordCheck(ctx, "impossible_travel");
+									const powSolution = ctx.headers?.get?.("X-PoW-Solution") ?? null;
+									const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId, identification.ip, powSolution, identification.requestId);
+									if (travelCheck?.powVerified) recordCheck(ctx, "pow_challenge");
+									if (travelCheck?.isImpossible) {
+										if (travelCheck.action === "block") {
+											setOutcome(ctx, "blocked", "impossible_travel", {
+												from: travelCheck.from,
+												to: travelCheck.to,
+												distance: travelCheck.distance,
+												speedRequired: travelCheck.speedRequired
+											});
+											emitEvaluation(ctx, trackEvent);
+											throw new APIError("FORBIDDEN", { message: "Login blocked due to suspicious location change." });
+										}
+										if (travelCheck.action === "challenge" && travelCheck.challenge) {
+											setOutcome(ctx, "challenged", "impossible_travel", {
+												from: travelCheck.from,
+												to: travelCheck.to,
+												distance: travelCheck.distance,
+												speedRequired: travelCheck.speedRequired
+											});
+											emitEvaluation(ctx, trackEvent);
+											throwChallengeError(travelCheck.challenge, "impossible_travel", "Unusual login location detected. Please complete a security check.");
+										}
 									}
 								}
+							},
+							async after(session, ctx) {
+								if (!ctx || !session.userId || isDashRoute(ctx.path)) return;
+								const visitorId = ctx.context.visitorId;
+								const identification = ctx.context.identification;
+								let user = null;
+								try {
+									user = await getUserById(session.userId, ctx, { includeLastActiveAt: activityTrackingEnabled });
+								} catch (error) {
+									logger.warn("[Sentinel] Failed to fetch user for security checks:", error);
+								}
+								if (visitorId) {
+									if (await securityService.checkUnknownDevice(session.userId, visitorId) && user?.email) await ctx.context.runInBackgroundOrAwait(securityService.notifyUnknownDevice(session.userId, user.email, identification));
+								}
+								if (opts.security?.impossibleTravel?.enabled && identification?.location) await ctx.context.runInBackgroundOrAwait(securityService.storeLastLocation(session.userId, identification.location, identification.ip));
 							}
-						},
-						async after(session, ctx) {
-							if (!ctx || !session.userId || isDashRoute(ctx.path)) return;
-							const visitorId = ctx.context.visitorId;
-							const identification = ctx.context.identification;
-							let user = null;
-							try {
-								user = await getUserById(session.userId, ctx, { includeLastActiveAt: activityTrackingEnabled });
-							} catch (error) {
-								logger.warn("[Sentinel] Failed to fetch user for security checks:", error);
-							}
-							if (visitorId) {
-								if (await securityService.checkUnknownDevice(session.userId, visitorId) && user?.email) await ctx.context.runInBackgroundOrAwait(securityService.notifyUnknownDevice(session.userId, user.email, identification));
-							}
-							if (opts.security?.impossibleTravel?.enabled && identification?.location) await ctx.context.runInBackgroundOrAwait(securityService.storeLastLocation(session.userId, identification.location, identification.ip));
-						}
-					} }
+						} }
+					}
 				}
-			} };
+			};
 		},
 		hooks: {
 			before: [
@@ -2558,64 +2714,25 @@ const sentinel = (options) => {
 						const visitorId = ctx.context.visitorId;
 						const identification = ctx.context.identification;
 						const ip = ctx.context.ip;
-						const isSignIn = matchesAnyRoute(ctx.path, [
-							routes.SIGN_IN_EMAIL,
-							routes.SIGN_IN_USERNAME,
-							routes.SIGN_IN_EMAIL_OTP,
-							routes.SIGN_IN_SOCIAL,
-							routes.SIGN_IN_PASSKEY,
-							routes.SIGN_IN_MAGIC_LINK,
-							routes.SIGN_IN_SSO,
-							routes.SIGN_IN_ANONYMOUS
-						]);
-						const isSignUp = matchesAnyRoute(ctx.path, [routes.SIGN_UP_EMAIL]);
-						const isPasswordReset = matchesAnyRoute(ctx.path, [
-							routes.FORGET_PASSWORD,
-							routes.REQUEST_PASSWORD_RESET,
-							routes.RESET_PASSWORD
-						]);
-						const isTwoFactor = matchesAnyRoute(ctx.path, [
-							routes.TWO_FACTOR_VERIFY_TOTP,
-							routes.TWO_FACTOR_VERIFY_BACKUP,
-							routes.TWO_FACTOR_VERIFY_OTP
-						]);
-						const isOtpSend = matchesAnyRoute(ctx.path, [routes.EMAIL_OTP_SEND, routes.PHONE_SEND_OTP]);
-						const isMagicLinkVerify = matchesAnyRoute(ctx.path, [routes.MAGIC_LINK_VERIFY]);
-						const isOrgCreate = matchesAnyRoute(ctx.path, [routes.ORG_CREATE]);
-						const isSensitiveAction = matchesAnyRoute(ctx.path, [
-							routes.CHANGE_EMAIL,
-							routes.CHANGE_PASSWORD,
-							routes.SET_PASSWORD,
-							routes.LINK_SOCIAL,
-							routes.PASSKEY_ADD
-						]);
-						if (!(isSignIn || isSignUp || isPasswordReset || isTwoFactor || isOtpSend || isMagicLinkVerify || isOrgCreate || isSensitiveAction)) return;
+						if (!matchesAnyRoute(ctx.path, SECURITY_PROTECTED_ROUTES)) return;
 						const requestBody = ctx.body;
 						const identifier = requestBody?.email || requestBody?.phone || requestBody?.username || void 0;
 						const powSolution = ctx.headers?.get?.("X-PoW-Solution");
-						if (visitorId || ip) {
-							recordCheck(ctx, "credential_stuffing");
-							if (await securityService.isBlocked(visitorId ?? "", ip, ctx.context.requestId ?? null)) {
-								setOutcome(ctx, "blocked", "credential_stuffing", {
-									phase: "cooldown_active",
-									visitorId: ctx.context.untrustedVisitorId ?? void 0,
-									confidence: 1
-								});
-								emitEvaluation(ctx, trackEvent, {
-									identifier,
-									userAgent: ctx.headers?.get?.("user-agent") || ""
-								});
-								throw new APIError(403, { message: "Too many failed attempts. Please try again later." });
-							}
-						}
-						await runSecurityChecks(ctx, {
-							path: ctx.path,
+						const userAgent = ctx.headers?.get?.("user-agent") || "";
+						const meta = {
+							identifier,
+							userAgent
+						};
+						const cached = ctx.request ? rateLimitAdmission.get(ctx.request) : void 0;
+						if (cached) applyAdmission(cached, ctx, meta, trackEvent);
+						else await runSecurityChecks(ctx, {
+							path: ctx.path ?? "",
 							identifier,
 							visitorId,
 							requestId: ctx.context.requestId ?? null,
 							identification,
-							ip: ctx.context.ip,
-							userAgent: ctx.headers?.get?.("user-agent") || ""
+							ip,
+							userAgent
 						}, securityService, trackEvent, powSolution);
 						if (matchesAnyRoute(ctx.path, [
 							routes.SIGN_UP_EMAIL,
@@ -2633,7 +2750,7 @@ const sentinel = (options) => {
 										setOutcome(ctx, "blocked", "compromised_password", { breachCount: compromisedResult.breachCount });
 										emitEvaluation(ctx, trackEvent, {
 											identifier,
-											userAgent: ctx.headers?.get?.("user-agent") || ""
+											userAgent
 										});
 										throw new APIError("BAD_REQUEST", {
 											message: "This password has been found in data breaches. Please choose a different password.",
@@ -4280,6 +4397,23 @@ const getConfig = (options) => {
 			emailVerification: { sendVerificationEmailEnabled: !!ctx.context.options.emailVerification?.sendVerificationEmail },
 			insights: {
 				hasDatabase: !!ctx.context.options.database,
+				adapter: (() => {
+					const adapter = ctx.context.adapter;
+					if (!adapter) return null;
+					const adapterConfig = adapter.options?.adapterConfig;
+					return {
+						id: adapter.id ?? adapterConfig?.adapterId ?? null,
+						name: adapterConfig?.adapterName ?? adapter.id ?? adapterConfig?.adapterId ?? null,
+						usePlural: adapterConfig?.usePlural ?? false,
+						supportsTransactions: typeof adapterConfig?.transaction === "function",
+						supportsJSON: typeof adapterConfig?.supportsJSON === "boolean" ? adapterConfig.supportsJSON : null,
+						supportsDates: typeof adapterConfig?.supportsDates === "boolean" ? adapterConfig.supportsDates : null,
+						supportsBooleans: typeof adapterConfig?.supportsBooleans === "boolean" ? adapterConfig.supportsBooleans : null,
+						supportsArrays: typeof adapterConfig?.supportsArrays === "boolean" ? adapterConfig.supportsArrays : null,
+						supportsNumericIds: typeof adapterConfig?.supportsNumericIds === "boolean" ? adapterConfig.supportsNumericIds : null,
+						supportsUUIDs: typeof adapterConfig?.supportsUUIDs === "boolean" ? adapterConfig.supportsUUIDs : null
+					};
+				})(),
 				cookies: advancedOptions?.cookies ? Object.entries(advancedOptions.cookies).map(([key, value]) => ({
 					key,
 					name: value?.name,
@@ -8236,6 +8370,7 @@ const samlConfigSchema = z.object({
 	entryPoint: z.string().optional(),
 	cert: z.string().optional(),
 	entityId: z.string().optional(),
+	wantAssertionsSigned: z.boolean().optional(),
 	mapping: z.object({
 		/** @deprecated Removed in better-auth 1.7+; SAML subject is NameID. */
 		id: z.string().optional(),
@@ -8304,6 +8439,7 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 		config: {
 			issuer: ba17OrLater && !idpMetadataXml ? spIssuer : samlConfig.entityId ?? spIssuer,
 			idpMetadata,
+			wantAssertionsSigned: samlConfig.wantAssertionsSigned ?? true,
 			...saml17OrNewer ? {
 				entryPoint: resolvedEntryPoint,
 				...samlConfig.cert ? { cert: samlConfig.cert } : {}

package/dist/native.d.mts

@@ -1,4 +1,4 @@
-import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-CgijjwVT.mjs";
+import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-Cim5Fztg.mjs";
 import { BetterAuthClientPlugin } from "better-auth";
 //#region src/sentinel/native/client.d.ts
 interface SentinelNativeClientOptions {

package/dist/native.mjs

@@ -1,5 +1,5 @@
-import { o as createKV, t as bytesToHex } from "./crypto-D3yZH0Cy.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-jWGI__oh.mjs";
+import { o as createKV, t as bytesToHex } from "./crypto-DZClUivd.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-BvjK8YBw.mjs";
 import { env } from "@better-auth/core/env";
 import { Dimensions, InteractionManager, PixelRatio, Platform } from "react-native";
 //#region src/sentinel/native/components.ts

package/dist/{pow-retry-jWGI__oh.mjs → pow-retry-BvjK8YBw.mjs}

@@ -1,4 +1,4 @@
-import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-D3yZH0Cy.mjs";
+import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-DZClUivd.mjs";
 //#region src/dash-client.ts
 function resolveDashUserId(input, options) {
 	return input.userId || options?.resolveUserId?.({

package/dist/{types-Ddk4r5x9.d.mts → types-sP9ucYj1.d.mts}

@@ -1,5 +1,6 @@
 import { BetterAuthPlugin, GenericEndpointContext } from "better-auth";
 import { createFetch } from "@better-fetch/fetch";
+import { BetterAuthRateLimitRule } from "@better-auth/core";
 import { APIError as APIError$1, Endpoint, EndpointOptions } from "better-call";
 //#region src/identification.d.ts
 interface IPLocation {
@@ -167,6 +168,20 @@ type SecurityEventType = "unknown_device" | "credential_stuffing" | "impossible_
 declare const sentinel: (options?: SentinelOptions) => {
   id: "sentinel";
   init(ctx: import("better-auth").AuthContext): {
+    context: {
+      rateLimit: {
+        customRules: {
+          [key: string]: false | BetterAuthRateLimitRule | ((request: Request, currentRule: BetterAuthRateLimitRule) => import("@better-auth/core").Awaitable<false | BetterAuthRateLimitRule>);
+        };
+        enabled: boolean;
+        window: number;
+        max: number;
+        storage: "memory" | "database" | "secondary-storage";
+        modelName?: import("better-auth").LiteralString | "rateLimit" | undefined;
+        fields?: Partial<Record<"key" | "count" | "lastRequest", string>> | undefined;
+        customStorage?: import("better-auth").BetterAuthRateLimitStorage | undefined;
+      };
+    };
     options: {
       emailValidation: {
         enabled?: boolean;
@@ -177,6 +192,11 @@ declare const sentinel: (options?: SentinelOptions) => {
       emailNormalization: {
         enabled?: boolean;
       } | undefined;
+      rateLimit: {
+        customRules: {
+          [key: string]: false | BetterAuthRateLimitRule | ((request: Request, currentRule: BetterAuthRateLimitRule) => import("@better-auth/core").Awaitable<false | BetterAuthRateLimitRule>);
+        };
+      };
       databaseHooks: {
         user: {
           create: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
@@ -74,7 +74,7 @@
     "happy-dom": "^20.9.0",
     "msw": "^2.14.6",
     "tsdown": "^0.22.14",
-    "typescript": "^5.9.2",
+    "typescript": "^6.0.3",
     "zod": "4.3.6"
   },
   "dependencies": {
@@ -83,7 +83,7 @@
     "@noble/hashes": "^2.2.0",
     "@xmldom/xmldom": "^0.9.10",
     "better-call": "1.3.7",
-    "jose": "^6.2.4",
+    "jose": "^6.2.9",
     "libphonenumber-js": "^1.13.11"
   },
   "peerDependencies": {