@better-auth/infra 0.4.4 → 0.4.6

package/CHANGELOG.md

@@ -3,7 +3,21 @@
 All notable changes to `@better-auth/infra` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0/).
+
+## [Unreleased]
+
+## [0.4.6] - 2026-09-07
+
+### Changed
+
+- **Better Auth 1.7.3 account identity** — Dropped never-shipped `account.identityStrategy` insights/compat. Issuer-scoped account paths (`issuer` column, `findAccountByKey`) remain only for better-auth 1.7.0–1.7.2; 1.7.3+ uses `(providerId, accountId)` again. Runtime still feature-detects issuer APIs when present.
+
+## [0.4.5] - 2026-08-28
+
+### Fixed
+
+- **Duplicate `__infra-rid` Set-Cookie** — When both `dash()` and `sentinel()` are installed, the identification cookie after-hook no longer appends the same `Set-Cookie` twice. The writer runs once per request via a shared context guard.
 
 ## [0.4.4] - 2026-08-27
 

package/dist/client.mjs

@@ -1,5 +1,5 @@
-import { n as hash, o as createKV } from "./crypto-DZClUivd.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-BvjK8YBw.mjs";
+import { n as hash, o as createKV } from "./crypto-CfK70MTZ.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-DkrUdqDd.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts
 function murmurhash3(str, seed = 0) {

package/dist/{constants-CARN9f1y.mjs → constants-CApB_fKA.mjs}

@@ -1,7 +1,7 @@
 import { env } from "@better-auth/core/env";
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.4.4";
+const PLUGIN_VERSION = "0.4.6";
 //#endregion
 //#region src/constants.ts
 /**

package/dist/{crypto-DZClUivd.mjs → crypto-CfK70MTZ.mjs}

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT } from "./constants-CARN9f1y.mjs";
+import { i as INFRA_USER_AGENT } from "./constants-CApB_fKA.mjs";
 import { createFetch } from "@better-fetch/fetch";
 import { sha256 } from "@noble/hashes/sha2.js";
 //#region src/fetch.ts

package/dist/email.mjs

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CARN9f1y.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CApB_fKA.mjs";
 import { logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { createFetch } from "@better-fetch/fetch";

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CARN9f1y.mjs";
-import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-DZClUivd.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CApB_fKA.mjs";
+import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-CfK70MTZ.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAdapter, getCurrentAuthContext, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
@@ -386,37 +386,23 @@ const getLoginMethod = (ctx) => {
 //#endregion
 //#region src/compat/account.ts
 /**
-* Mirrors better-auth 1.7+ `createLocalAccountIssuer` so infra can
+* Mirrors better-auth 1.7.0–1.7.2 `createLocalAccountIssuer` so infra can
 * typecheck against older core packages while emitting the same issuer strings.
 */
 function createLocalAccountIssuer(providerId) {
 	return `local:${encodeURIComponent(providerId)}`;
 }
 /**
-* Mirrors better-auth 1.7+ `createOAuthAccountIssuer`.
+* Mirrors better-auth 1.7.0–1.7.2 `createOAuthAccountIssuer`.
 */
 function createOAuthAccountIssuer(providerId) {
 	return `local:oauth:${encodeURIComponent(providerId)}`;
 }
-/** Configured strategy when set; `null` when omitted (pre-option or default). */
-function getConfiguredAccountIdentityStrategy(account) {
-	const strategy = account?.identityStrategy;
-	if (strategy === "provider-id" || strategy === "issuer") return strategy;
-	return null;
-}
-/**
-* Effective strategy for account-key derivation.
-* Matches better-auth: omit/`"issuer"` → issuer-scoped; `"provider-id"` → provider-scoped.
-*/
-function resolveAccountIdentityStrategy(account) {
-	return getConfiguredAccountIdentityStrategy(account) ?? "issuer";
-}
 /**
-* Resolves the OAuth account issuer the same way better-auth does under
-* `account.identityStrategy`, including provider-scoped compatibility mode.
+* Resolves the OAuth account issuer the same way better-auth 1.7.0–1.7.2 did
+* for issuer-scoped account keys.
 */
 async function resolveOAuthAccountIssuer(params) {
-	if (params.identityStrategy === "provider-id") return createOAuthAccountIssuer(params.providerId);
 	const { accountIssuer } = params;
 	if (typeof accountIssuer === "function") {
 		const issuer = await accountIssuer(params.context);
@@ -459,7 +445,7 @@ function normalizeProviderSubject(subject) {
 	if (!subject || subject === "undefined" || subject === "null") return;
 	return subject;
 }
-async function resolveAccountKey(provider, tokens, profile, identityStrategy) {
+async function resolveAccountKey(provider, tokens, profile) {
 	const keyedProvider = provider;
 	const context = {
 		tokens,
@@ -477,7 +463,6 @@ async function resolveAccountKey(provider, tokens, profile, identityStrategy) {
 		if (!accountId) return void 0;
 		const issuer = await resolveOAuthAccountIssuer({
 			providerId: provider.id,
-			identityStrategy,
 			accountIssuer: keyedProvider.accountIssuer,
 			context
 		});
@@ -503,8 +488,7 @@ function instrumentSocialProviders(providers) {
 			if (user) try {
 				const endpointCtx = await getCurrentAuthContext();
 				const adapter = endpointCtx.context.internalAdapter;
-				const identityStrategy = resolveAccountIdentityStrategy(endpointCtx.context.options.account);
-				const accountKey = result.data && typeof adapter.findAccountOwnerByKey === "function" ? await resolveAccountKey(provider, token, result.data, identityStrategy) : void 0;
+				const accountKey = result.data && typeof adapter.findAccountOwnerByKey === "function" ? await resolveAccountKey(provider, token, result.data) : void 0;
 				endpointCtx.context[OAUTH_CALLBACK_USER] = {
 					user,
 					accountKey
@@ -1113,9 +1097,14 @@ function shouldRunIdentification(ctx, getRoutes = IDENTIFICATION_GET_ROUTES) {
 * Persist `X-Request-Id` as `__infra-rid` so redirect-flow OAuth callbacks
 * (GET, no identify headers) can resolve visitor identification from KV.
 * Must run in an after hook so Set-Cookie reaches the response.
+*
+* Dedupes when both `dash()` and `sentinel()` register this hook (each alone
+* needs it; together they would append duplicate Set-Cookie headers).
 */
 function createIdentificationCookieAfterMiddleware() {
 	return createAuthMiddleware(async (ctx) => {
+		if (ctx.context.infraRidCookieSet) return;
+		ctx.context.infraRidCookieSet = true;
 		const headerRequestId = ctx.request?.headers.get("X-Request-Id");
 		if (headerRequestId) {
 			ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
@@ -4295,7 +4284,7 @@ function isVersionAtLeast(version, target) {
 }
 /**
 * True for better-auth 1.7+ (including 1.8+).
-* Marks the cutover for issuer-scoped accounts, protocol-defined SSO subjects,
+* Marks the cutover for protocol-defined SSO subjects,
 * `advanced.database.joins`, and post-legacy SCIM connections.
 * Keep in sync with `apps/web/lib/better-auth-compat.ts`.
 */
@@ -4425,7 +4414,6 @@ const getConfig = (options) => {
 				disableCSRFCheck: ctx.context.options.advanced?.disableCSRFCheck || false,
 				disableOriginCheck: ctx.context.options.advanced?.disableOriginCheck || false,
 				allowDifferentEmails: ctx.context.options.account?.accountLinking?.enabled && ctx.context.options.account?.accountLinking?.allowDifferentEmails || false,
-				identityStrategy: getConfiguredAccountIdentityStrategy(ctx.context.options.account),
 				skipStateCookieCheck: ctx.context.options.account?.skipStateCookieCheck || false,
 				storeStateCookieStrategy: ctx.context.options.account?.storeStateStrategy || null,
 				cookieCache: {

package/dist/native.mjs

@@ -1,5 +1,5 @@
-import { o as createKV, t as bytesToHex } from "./crypto-DZClUivd.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-BvjK8YBw.mjs";
+import { o as createKV, t as bytesToHex } from "./crypto-CfK70MTZ.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-DkrUdqDd.mjs";
 import { env } from "@better-auth/core/env";
 import { Dimensions, InteractionManager, PixelRatio, Platform } from "react-native";
 //#region src/sentinel/native/components.ts

package/dist/{pow-retry-BvjK8YBw.mjs → pow-retry-DkrUdqDd.mjs}

@@ -1,4 +1,4 @@
-import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-DZClUivd.mjs";
+import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-CfK70MTZ.mjs";
 //#region src/dash-client.ts
 function resolveDashUserId(input, options) {
 	return input.userId || options?.resolveUserId?.({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
@@ -8,8 +8,8 @@
   "types": "dist/index.d.mts",
   "sideEffects": false,
   "scripts": {
-    "build": "tsdown",
-    "dev": "tsdown --watch --no-clean",
+    "build": "bun --bun tsdown",
+    "dev": "bun --bun tsdown --watch --no-clean",
     "typecheck": "tsc --noEmit",
     "test": "bun test --parallel",
     "test:watch": "bun test --watch",
@@ -75,7 +75,7 @@
     "msw": "^2.14.6",
     "tsdown": "^0.22.14",
     "typescript": "^6.0.3",
-    "zod": "4.3.6"
+    "zod": "4.5.4"
   },
   "dependencies": {
     "@better-auth/utils": "^0.4.2",
@@ -83,7 +83,7 @@
     "@noble/hashes": "^2.2.0",
     "@xmldom/xmldom": "^0.9.10",
     "better-call": "1.3.7",
-    "jose": "^6.2.9",
+    "jose": "^6.2.10",
     "libphonenumber-js": "^1.13.11"
   },
   "peerDependencies": {