@better-auth/infra 0.4.5 → 0.4.7

package/CHANGELOG.md

@@ -3,7 +3,20 @@
 All notable changes to `@better-auth/infra` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0/).
+
+## [0.4.7] - 2026-09-07
+
+### Fixed
+
+- **Sentinel types under `exactOptionalPropertyTypes`** — `sentinel()`, `sentinelClient()`, and `sentinelNativeClient()` type-check cleanly when consumers enable TypeScript `exactOptionalPropertyTypes`.
+- **Sentinel audio fingerprint** — `sentinelClient()` now builds the audio component with `OfflineAudioContext` (and `webkitOfflineAudioContext`) instead of a live `AudioContext` + `ScriptProcessor`. Avoids autoplay/suspended-context and output-route failures in restricted browsers while keeping the same soft confidence signal on identify.
+
+## [0.4.6] - 2026-09-07
+
+### Changed
+
+- **Better Auth 1.7.3 account identity** — Dropped never-shipped `account.identityStrategy` insights/compat. Issuer-scoped account paths (`issuer` column, `findAccountByKey`) remain only for better-auth 1.7.0–1.7.2; 1.7.3+ uses `(providerId, accountId)` again. Runtime still feature-detects issuer APIs when present.
 
 ## [0.4.5] - 2026-08-28
 
@@ -216,4 +229,4 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [0.3.1]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.0...infra@v0.3.1
 [0.3.0]: https://github.com/better-auth/infrastructure/compare/infra@v0.2.14...infra@v0.3.0
 [0.2.14]: https://github.com/better-auth/better-auth-infra/compare/@better-auth/infra@0.2.13...@better-auth/infra@0.2.14
-[0.2.13]: https://github.com/better-auth/better-auth-infra/compare/@better-auth/infra@0.2.12...@better-auth/infra@0.2.13
+[0.2.13]: https://github.com/better-auth/better-auth-infra/compare/@better-auth/infra@0.2.12...@better-auth/infra@0.2.13

package/dist/client.d.mts

@@ -1,4 +1,5 @@
-import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-Cim5Fztg.mjs";
+import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-Be9mAljS.mjs";
+import { BetterFetchPlugin } from "@better-fetch/fetch";
 //#region src/sentinel/client.d.ts
 interface SentinelClientOptions {
   /**
@@ -35,21 +36,7 @@ interface SentinelClientOptions {
 }
 declare const sentinelClient: (options?: SentinelClientOptions) => {
   id: "sentinel";
-  fetchPlugins: ({
-    id: string;
-    name: string;
-    hooks: {
-      onRequest<T extends Record<string, any>>(context: import("@better-fetch/fetch").RequestContext<T>): Promise<import("@better-fetch/fetch").RequestContext<T>>;
-      onResponse?: undefined;
-    };
-  } | {
-    id: string;
-    name: string;
-    hooks: {
-      onResponse(context: import("@better-fetch/fetch").ResponseContext): Promise<import("@better-fetch/fetch").ResponseContext>;
-      onRequest<T extends Record<string, any>>(context: import("@better-fetch/fetch").RequestContext<T>): Promise<import("@better-fetch/fetch").RequestContext<T>>;
-    };
-  })[];
+  fetchPlugins: BetterFetchPlugin[];
 };
 //#endregion
 export { type DashAuditLog, type DashAuditLogsResponse, type DashClientOptions, type DashGetAllAuditLogsInput, type DashGetAuditLogsInput, type SentinelClientOptions, dashClient, sentinelClient };

package/dist/client.mjs

@@ -1,5 +1,5 @@
-import { n as hash, o as createKV } from "./crypto-BhIjjZNe.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-CsInOtOL.mjs";
+import { n as hash, o as createKV } from "./crypto-C9Iqqv8l.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-Bk5otjQT.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts
 function murmurhash3(str, seed = 0) {
@@ -123,54 +123,32 @@ function getWebGLFingerprint() {
 }
 async function getAudioFingerprint() {
 	try {
-		const AudioContextClass = window.AudioContext || window.webkitAudioContext;
-		if (!AudioContextClass) return null;
-		const context = new AudioContextClass();
+		const OfflineAudioContextClass = window.OfflineAudioContext || window.webkitOfflineAudioContext;
+		if (!OfflineAudioContextClass) return null;
+		const context = new OfflineAudioContextClass(1, 4096, 44100);
 		const oscillator = context.createOscillator();
-		const analyser = context.createAnalyser();
-		const gain = context.createGain();
-		const scriptProcessor = context.createScriptProcessor(4096, 1, 1);
-		gain.gain.value = 0;
+		const compressor = context.createDynamicsCompressor();
 		oscillator.type = "triangle";
 		oscillator.frequency.setValueAtTime(1e4, context.currentTime);
-		oscillator.connect(analyser);
-		analyser.connect(scriptProcessor);
-		scriptProcessor.connect(gain);
-		gain.connect(context.destination);
+		compressor.threshold.setValueAtTime(-50, context.currentTime);
+		compressor.knee.setValueAtTime(40, context.currentTime);
+		compressor.ratio.setValueAtTime(12, context.currentTime);
+		compressor.attack.setValueAtTime(0, context.currentTime);
+		compressor.release.setValueAtTime(.25, context.currentTime);
+		oscillator.connect(compressor);
+		compressor.connect(context.destination);
 		oscillator.start(0);
-		let resolved = false;
-		const cleanup = () => {
-			if (resolved) return;
-			resolved = true;
-			try {
-				oscillator.stop();
-				oscillator.disconnect();
-				analyser.disconnect();
-				scriptProcessor.disconnect();
-				gain.disconnect();
-			} catch {}
-			try {
-				if (context.state !== "closed") context.close();
-			} catch {}
-		};
-		return new Promise((resolve) => {
-			scriptProcessor.onaudioprocess = (e) => {
-				if (resolved) return;
-				const output = e.inputBuffer.getChannelData(0);
-				let sum = 0;
-				for (let i = 0; i < output.length; i++) {
-					const val = output[i];
-					if (val !== void 0) sum += Math.abs(val);
-				}
-				cleanup();
-				resolve(sum);
-			};
-			setTimeout(() => {
-				if (resolved) return;
-				cleanup();
-				resolve(null);
-			}, 1e3);
-		});
+		const buffer = await Promise.race([context.startRendering(), new Promise((resolve) => {
+			setTimeout(() => resolve(null), 1e3);
+		})]);
+		if (!buffer) return null;
+		const output = buffer.getChannelData(0);
+		let sum = 0;
+		for (let i = 0; i < output.length; i++) {
+			const val = output[i];
+			if (val !== void 0) sum += Math.abs(val);
+		}
+		return sum;
 	} catch {
 		return null;
 	}

package/dist/{constants-DjM7toCN.mjs → constants-BypXAAvQ.mjs}

@@ -1,7 +1,7 @@
 import { env } from "@better-auth/core/env";
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.4.5";
+const PLUGIN_VERSION = "0.4.7";
 //#endregion
 //#region src/constants.ts
 /**

package/dist/{crypto-BhIjjZNe.mjs → crypto-C9Iqqv8l.mjs}

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT } from "./constants-DjM7toCN.mjs";
+import { i as INFRA_USER_AGENT } from "./constants-BypXAAvQ.mjs";
 import { createFetch } from "@better-fetch/fetch";
 import { sha256 } from "@noble/hashes/sha2.js";
 //#region src/fetch.ts

package/dist/email.mjs

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-DjM7toCN.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-BypXAAvQ.mjs";
 import { logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { createFetch } from "@better-fetch/fetch";

package/dist/{identify-client-options-Cim5Fztg.d.mts → identify-client-options-Be9mAljS.d.mts}

@@ -1,4 +1,4 @@
-import { m as KvRetryOptions } from "./types-sP9ucYj1.mjs";
+import { m as KvRetryOptions } from "./types-Ba7NK8JV.mjs";
 import { BetterAuthClientOptions, ClientStore } from "better-auth";
 import { BetterFetch } from "@better-fetch/fetch";
 //#region src/dash-client.d.ts

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { C as ImpossibleTravelResult, D as SecurityVerdict, E as SecurityOptions, O as StaleUserResult, S as CredentialStuffingResult, T as SecurityEventType, _ as LocationDataContext, a as DashOptionsInternal, b as sentinel, c as EndpointOptions, d as InfraPluginConnectionOptionsInternal, f as KvOptions, g as LocationData, h as KvRetryOptionsResolved, i as DashOptions, k as ThresholdConfig, l as InfraEndpointContext, m as KvRetryOptions, n as ApiOptions, o as DashOptionsResolved, p as KvOptionsResolved, r as ApiOptionsResolved, s as Endpoint, t as APIError, u as InfraPluginConnectionOptions, v as SentinelOptions, w as SecurityEvent, x as CompromisedPasswordResult, y as SentinelOptionsInternal } from "./types-sP9ucYj1.mjs";
+import { C as ImpossibleTravelResult, D as SecurityVerdict, E as SecurityOptions, O as StaleUserResult, S as CredentialStuffingResult, T as SecurityEventType, _ as LocationDataContext, a as DashOptionsInternal, b as sentinel, c as EndpointOptions, d as InfraPluginConnectionOptionsInternal, f as KvOptions, g as LocationData, h as KvRetryOptionsResolved, i as DashOptions, k as ThresholdConfig, l as InfraEndpointContext, m as KvRetryOptions, n as ApiOptions, o as DashOptionsResolved, p as KvOptionsResolved, r as ApiOptionsResolved, s as Endpoint, t as APIError, u as InfraPluginConnectionOptions, v as SentinelOptions, w as SecurityEvent, x as CompromisedPasswordResult, y as SentinelOptionsInternal } from "./types-Ba7NK8JV.mjs";
 import { EMAIL_TEMPLATES, EmailConfig, EmailTemplateId, EmailTemplateVariables, SendBulkEmailsOptions, SendBulkEmailsResult, SendEmailOptions, SendEmailResult, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { Account, AuthContext, GenericEndpointContext, Session, User } from "better-auth";
 import z from "zod";

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-DjM7toCN.mjs";
-import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-BhIjjZNe.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-BypXAAvQ.mjs";
+import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-C9Iqqv8l.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAdapter, getCurrentAuthContext, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
@@ -386,37 +386,23 @@ const getLoginMethod = (ctx) => {
 //#endregion
 //#region src/compat/account.ts
 /**
-* Mirrors better-auth 1.7+ `createLocalAccountIssuer` so infra can
+* Mirrors better-auth 1.7.0–1.7.2 `createLocalAccountIssuer` so infra can
 * typecheck against older core packages while emitting the same issuer strings.
 */
 function createLocalAccountIssuer(providerId) {
 	return `local:${encodeURIComponent(providerId)}`;
 }
 /**
-* Mirrors better-auth 1.7+ `createOAuthAccountIssuer`.
+* Mirrors better-auth 1.7.0–1.7.2 `createOAuthAccountIssuer`.
 */
 function createOAuthAccountIssuer(providerId) {
 	return `local:oauth:${encodeURIComponent(providerId)}`;
 }
-/** Configured strategy when set; `null` when omitted (pre-option or default). */
-function getConfiguredAccountIdentityStrategy(account) {
-	const strategy = account?.identityStrategy;
-	if (strategy === "provider-id" || strategy === "issuer") return strategy;
-	return null;
-}
-/**
-* Effective strategy for account-key derivation.
-* Matches better-auth: omit/`"issuer"` → issuer-scoped; `"provider-id"` → provider-scoped.
-*/
-function resolveAccountIdentityStrategy(account) {
-	return getConfiguredAccountIdentityStrategy(account) ?? "issuer";
-}
 /**
-* Resolves the OAuth account issuer the same way better-auth does under
-* `account.identityStrategy`, including provider-scoped compatibility mode.
+* Resolves the OAuth account issuer the same way better-auth 1.7.0–1.7.2 did
+* for issuer-scoped account keys.
 */
 async function resolveOAuthAccountIssuer(params) {
-	if (params.identityStrategy === "provider-id") return createOAuthAccountIssuer(params.providerId);
 	const { accountIssuer } = params;
 	if (typeof accountIssuer === "function") {
 		const issuer = await accountIssuer(params.context);
@@ -459,7 +445,7 @@ function normalizeProviderSubject(subject) {
 	if (!subject || subject === "undefined" || subject === "null") return;
 	return subject;
 }
-async function resolveAccountKey(provider, tokens, profile, identityStrategy) {
+async function resolveAccountKey(provider, tokens, profile) {
 	const keyedProvider = provider;
 	const context = {
 		tokens,
@@ -477,7 +463,6 @@ async function resolveAccountKey(provider, tokens, profile, identityStrategy) {
 		if (!accountId) return void 0;
 		const issuer = await resolveOAuthAccountIssuer({
 			providerId: provider.id,
-			identityStrategy,
 			accountIssuer: keyedProvider.accountIssuer,
 			context
 		});
@@ -503,8 +488,7 @@ function instrumentSocialProviders(providers) {
 			if (user) try {
 				const endpointCtx = await getCurrentAuthContext();
 				const adapter = endpointCtx.context.internalAdapter;
-				const identityStrategy = resolveAccountIdentityStrategy(endpointCtx.context.options.account);
-				const accountKey = result.data && typeof adapter.findAccountOwnerByKey === "function" ? await resolveAccountKey(provider, token, result.data, identityStrategy) : void 0;
+				const accountKey = result.data && typeof adapter.findAccountOwnerByKey === "function" ? await resolveAccountKey(provider, token, result.data) : void 0;
 				endpointCtx.context[OAUTH_CALLBACK_USER] = {
 					user,
 					accountKey
@@ -2592,8 +2576,8 @@ const sentinel = (options) => {
 					customRules
 				} },
 				options: {
-					emailValidation: opts.security?.emailValidation,
-					emailNormalization: opts.security?.emailNormalization,
+					...opts.security?.emailValidation !== void 0 ? { emailValidation: opts.security.emailValidation } : {},
+					...opts.security?.emailNormalization !== void 0 ? { emailNormalization: opts.security.emailNormalization } : {},
 					rateLimit: { customRules },
 					databaseHooks: {
 						user: {
@@ -4300,7 +4284,7 @@ function isVersionAtLeast(version, target) {
 }
 /**
 * True for better-auth 1.7+ (including 1.8+).
-* Marks the cutover for issuer-scoped accounts, protocol-defined SSO subjects,
+* Marks the cutover for protocol-defined SSO subjects,
 * `advanced.database.joins`, and post-legacy SCIM connections.
 * Keep in sync with `apps/web/lib/better-auth-compat.ts`.
 */
@@ -4430,7 +4414,6 @@ const getConfig = (options) => {
 				disableCSRFCheck: ctx.context.options.advanced?.disableCSRFCheck || false,
 				disableOriginCheck: ctx.context.options.advanced?.disableOriginCheck || false,
 				allowDifferentEmails: ctx.context.options.account?.accountLinking?.enabled && ctx.context.options.account?.accountLinking?.allowDifferentEmails || false,
-				identityStrategy: getConfiguredAccountIdentityStrategy(ctx.context.options.account),
 				skipStateCookieCheck: ctx.context.options.account?.skipStateCookieCheck || false,
 				storeStateCookieStrategy: ctx.context.options.account?.storeStateStrategy || null,
 				cookieCache: {

package/dist/native.d.mts

@@ -1,4 +1,4 @@
-import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-Cim5Fztg.mjs";
+import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-Be9mAljS.mjs";
 import { BetterAuthClientPlugin } from "better-auth";
 //#region src/sentinel/native/client.d.ts
 interface SentinelNativeClientOptions {

package/dist/native.mjs

@@ -1,5 +1,5 @@
-import { o as createKV, t as bytesToHex } from "./crypto-BhIjjZNe.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-CsInOtOL.mjs";
+import { o as createKV, t as bytesToHex } from "./crypto-C9Iqqv8l.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-Bk5otjQT.mjs";
 import { env } from "@better-auth/core/env";
 import { Dimensions, InteractionManager, PixelRatio, Platform } from "react-native";
 //#region src/sentinel/native/components.ts

package/dist/{pow-retry-CsInOtOL.mjs → pow-retry-Bk5otjQT.mjs}

@@ -1,4 +1,4 @@
-import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-BhIjjZNe.mjs";
+import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-C9Iqqv8l.mjs";
 //#region src/dash-client.ts
 function resolveDashUserId(input, options) {
 	return input.userId || options?.resolveUserId?.({

package/dist/{types-sP9ucYj1.d.mts → types-Ba7NK8JV.d.mts}

@@ -170,28 +170,13 @@ declare const sentinel: (options?: SentinelOptions) => {
   init(ctx: import("better-auth").AuthContext): {
     context: {
       rateLimit: {
-        customRules: {
-          [key: string]: false | BetterAuthRateLimitRule | ((request: Request, currentRule: BetterAuthRateLimitRule) => import("@better-auth/core").Awaitable<false | BetterAuthRateLimitRule>);
-        };
         enabled: boolean;
         window: number;
         max: number;
         storage: "memory" | "database" | "secondary-storage";
-        modelName?: import("better-auth").LiteralString | "rateLimit" | undefined;
-        fields?: Partial<Record<"key" | "count" | "lastRequest", string>> | undefined;
-        customStorage?: import("better-auth").BetterAuthRateLimitStorage | undefined;
-      };
+      } & Omit<import("better-auth").BetterAuthRateLimitOptions, "window" | "enabled" | "max" | "storage">;
     };
     options: {
-      emailValidation: {
-        enabled?: boolean;
-        strictness?: "low" | "medium" | "high";
-        action?: SecurityAction;
-        domainAllowlist?: string[];
-      } | undefined;
-      emailNormalization: {
-        enabled?: boolean;
-      } | undefined;
       rateLimit: {
         customRules: {
           [key: string]: false | BetterAuthRateLimitRule | ((request: Request, currentRule: BetterAuthRateLimitRule) => import("@better-auth/core").Awaitable<false | BetterAuthRateLimitRule>);
@@ -276,6 +261,15 @@ declare const sentinel: (options?: SentinelOptions) => {
           };
         };
       };
+      emailNormalization?: {
+        enabled?: boolean;
+      } | undefined;
+      emailValidation?: {
+        enabled?: boolean;
+        strictness?: "low" | "medium" | "high";
+        action?: SecurityAction;
+        domainAllowlist?: string[];
+      } | undefined;
     };
   };
   hooks: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.4.5",
+  "version": "0.4.7",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
@@ -8,8 +8,8 @@
   "types": "dist/index.d.mts",
   "sideEffects": false,
   "scripts": {
-    "build": "tsdown",
-    "dev": "tsdown --watch --no-clean",
+    "build": "bun --bun tsdown",
+    "dev": "bun --bun tsdown --watch --no-clean",
     "typecheck": "tsc --noEmit",
     "test": "bun test --parallel",
     "test:watch": "bun test --watch",
@@ -17,21 +17,25 @@
   },
   "exports": {
     ".": {
+      "@infra/source": "./src/index.ts",
       "types": "./dist/index.d.mts",
       "import": "./dist/index.mjs",
       "default": "./dist/index.mjs"
     },
     "./client": {
+      "@infra/source": "./src/client.ts",
       "types": "./dist/client.d.mts",
       "import": "./dist/client.mjs",
       "default": "./dist/client.mjs"
     },
     "./email": {
+      "@infra/source": "./src/email.ts",
       "types": "./dist/email.d.mts",
       "import": "./dist/email.mjs",
       "default": "./dist/email.mjs"
     },
     "./native": {
+      "@infra/source": "./src/native.ts",
       "types": "./dist/native.d.mts",
       "import": "./dist/native.mjs",
       "default": "./dist/native.mjs"
@@ -75,7 +79,7 @@
     "msw": "^2.14.6",
     "tsdown": "^0.22.14",
     "typescript": "^6.0.3",
-    "zod": "4.3.6"
+    "zod": "4.5.4"
   },
   "dependencies": {
     "@better-auth/utils": "^0.4.2",
@@ -83,7 +87,7 @@
     "@noble/hashes": "^2.2.0",
     "@xmldom/xmldom": "^0.9.10",
     "better-call": "1.3.7",
-    "jose": "^6.2.9",
+    "jose": "^6.2.10",
     "libphonenumber-js": "^1.13.11"
   },
   "peerDependencies": {