@better-auth/infra 0.3.7 → 0.4.0

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to `@better-auth/infra` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.0] - 2026-08-14
+
+### Added
+
+- **Managed SCIM directory sync** — Opt-in `dash({ managedDirectorySync: { enabled: true } })` control plane for Better Auth 1.7+ managed connections. Adds dashboard lifecycle endpoints to create, list, get, rotate credentials, revoke credentials, list events, unpair, and decommission organization directories, plus schema for `directorySyncConnection` / membership provenance, optional SSO pairing hooks, and SCIM → organization membership projection.
+- **Issuer-scoped accounts** — Dashboard user create, set-password, and account unlink paths work with Better Auth 1.7 issuer-scoped account identity (`issuer` + subject) while remaining compatible with pre-issuer schemas.
+- **Configurable API / KV client options** — Shared `apiOptions` / `kvOptions` (timeout and KV retry/backoff) on `dash` and `sentinel`. Legacy `apiTimeout` / `kvTimeout` remain supported as deprecated aliases.
+- **`GET /dash/config` joins insight** — Config insights report `hasJoinsEnabled` from `advanced.database.joins` (and pre-1.7 `experimental.joins` when applicable).
+
+### Changed
+
+- **Better Auth 1.7 RC compatibility** — Support matrix and runtime paths updated through 1.7 rc.4 (issuer-scoped accounts, session lifecycle hooks, SSO domain verification contracts).
+- **SSO domain verification TXT records** — Dashboard domain verification uses the SSO plugin `tokenPrefix` and the `_` + prefix + provider id TXT name shape expected by Better Auth domain verification.
+- **Session lifecycle event tracking** — Sign-in / session-created / impersonation tracking deferred correctly when session creation runs before the user is available on the request context (Better Auth 1.7 rc.2+).
+- **Directory list mode split** — Legacy pre-1.7 SCIM provider listing stays on the legacy surface; managed connection APIs only run when managed directory sync is enabled.
+- **Account unlink body** — `unlinkAccount` requires `accountId` (local account row id) together with `providerId`.
+
+### Fixed
+
+- **SSO domain verify errors** — `verify-domain` maps provider-changed, already-verified, and missing-DNS cases to stable dashboard responses instead of leaking raw API errors.
+- **Sentinel stale-account handling** — Stale-user blocks clear the session cookie and surface a consistent `STALE_ACCOUNT` error after the endpoint runs, not only inside DB hooks.
+- **SCIM token redaction** — Sensitive SCIM credential fields stay redacted in dash config / plugin option dumps.
+
 ## [0.3.7] - 2026-07-20
 
 ### Added
@@ -144,6 +167,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 [0.3.7]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.6...infra@v0.3.7
 [0.3.6]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.5...infra@v0.3.6
+[0.4.0]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.7...infra@v0.4.0
 [0.3.5]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.4...infra@v0.3.5
 [0.3.4]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.3...infra@v0.3.4
 [0.3.3]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.2...infra@v0.3.3

package/README.md

@@ -104,7 +104,9 @@ export const authClient = createAuthClient({
 
 ### Options (`sentinelNativeClient`)
 
-- `identifyUrl?: string` — KV identify endpoint base (defaults to `BETTER_AUTH_KV_URL` from env, then `https://kv.better-auth.com`).
+- `identifyUrl?: string` — identify endpoint base (defaults to `BETTER_AUTH_KV_URL` from env, then `https://kv.better-auth.com`).
+- `identifyOptions?: { timeout?: number; retry?: { attempts?: number; baseDelay?: number; maxDelay?: number } }` — identify HTTP timeout (ms, default `1000`) and POST retry (defaults `2` / `400` / `600`).
+- `kvTimeout?: number` — **deprecated**, use `identifyOptions.timeout`.
 - `autoSolveChallenge?: boolean` — When `true` (default), `423` responses that include `X-PoW-Challenge` are solved and the request is retried once with `X-PoW-Solution`.
 - `onChallengeReceived?` / `onChallengeSolved?` / `onChallengeFailed?` — PoW lifecycle hooks (reason string, solve time in ms, or error).
 - `storage?: { getItem, setItem }` — Async key/value storage for a stable per-install visitor id (recommended for production).
@@ -270,7 +272,12 @@ The `dash()` plugin registers these event endpoints:
 - `apiUrl?: string`
 - `kvUrl?: string`
 - `apiKey?: string`
+- `apiOptions?: { timeout?: number }` (ms, default `3000`)
+- `kvOptions?: { timeout?: number; retry?: { attempts?: number; baseDelay?: number; maxDelay?: number } }` — KV timeout default `1000`; retry defaults `2` / `400` / `600`
+- `apiTimeout?: number` — **deprecated**, use `apiOptions.timeout`
+- `kvTimeout?: number` — **deprecated**, use `kvOptions.timeout`
 - `activityTracking?: { enabled?: boolean; updateInterval?: number }`
+- `managedDirectorySync?: { enabled?: boolean; ssoPairing?: boolean; membershipProjection?: { enabled?: boolean; role?: string } }` — opt into the 1.7+ managed directory-sync control plane (schema + reservation APIs). `enabled` alone turns on reservation tables/APIs. When enabled, dash `init` can also wire sibling-plugin callbacks: `ssoPairing` installs SSO `resolveUser` / `guardProviderMutation` (needed only for paired directories; requires `sso({})` or richer options — bare `sso()` leaves `options` undefined), and `membershipProjection` installs SCIM `projection.reconcileUser` for org membership sync. Defaults: `enabled: false`, `ssoPairing: true`, `membershipProjection.enabled: true`, `membershipProjection.role: "member"`. Required with `scim({ managedConnections })` for managed mode; does not affect or replace legacy pre-1.7 SCIM directory sync.
 
 `dash()` no longer accepts sentinel security config.
 
@@ -279,6 +286,10 @@ The `dash()` plugin registers these event endpoints:
 - `apiUrl?: string`
 - `kvUrl?: string`
 - `apiKey?: string`
+- `apiOptions?: { timeout?: number }` — same as `DashOptions`
+- `kvOptions?: { timeout?: number; retry?: { attempts?: number; baseDelay?: number; maxDelay?: number } }` — same as `DashOptions`
+- `apiTimeout?: number` — **deprecated**, use `apiOptions.timeout`
+- `kvTimeout?: number` — **deprecated**, use `kvOptions.timeout`
 - `security?: SecurityOptions`
 
 All security configuration now belongs in `sentinel()`.

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { a as DashGetAuditLogsInput, i as DashGetAllAuditLogsInput, n as DashAuditLogsResponse, o as dashClient, r as DashClientOptions, t as DashAuditLog } from "./dash-client-DXuu2ctl.mjs";
+import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-RI-JiXQx.mjs";
 
 //#region src/sentinel/client.d.ts
 interface SentinelClientOptions {
@@ -8,8 +8,13 @@ interface SentinelClientOptions {
    */
   identifyUrl?: string;
   /**
-   * Timeout for KV identify and related HTTP requests (milliseconds).
+   * Identify HTTP client options.
+   */
+  identifyOptions?: IdentifyClientOptions;
+  /**
+   * Timeout for identify and related HTTP requests (milliseconds).
    * @default 1000
+   * @deprecated Use `identifyOptions.timeout` instead.
    */
   kvTimeout?: number;
   /**

package/dist/client.mjs

@@ -1,5 +1,5 @@
-import { n as hash, o as createKV } from "./crypto--3ycICW4.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as dashClient, i as solvePoWChallenge, n as decodePoWChallenge, o as generateRequestId, r as encodePoWSolution, s as identify, t as createPowRetryTimeout } from "./pow-retry-Dy1D-TKx.mjs";
+import { n as hash, o as createKV } from "./crypto-CAdWFWEz.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-DZhZiYd_.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts
 function murmurhash3(str, seed = 0) {
@@ -440,20 +440,10 @@ const sentinelClient = (options) => {
 			identifyUrl: options?.identifyUrl,
 			envKvUrl: env.BETTER_AUTH_KV_URL
 		}),
-		kvTimeout: options?.kvTimeout
+		timeout: options?.identifyOptions?.timeout ?? options?.kvTimeout
 	}, {
 		throw: true,
-		retry: {
-			type: "exponential",
-			attempts: 2,
-			baseDelay: 400,
-			maxDelay: 600,
-			shouldRetry(response) {
-				if (response === null) return true;
-				if (response.status === 429) return true;
-				return response.status >= 500;
-			}
-		}
+		retry: resolveIdentifyClientRetry(options?.identifyOptions?.retry)
 	});
 	if (typeof window !== "undefined") {
 		const scheduleIdentify = () => {

package/dist/{constants-AfApXLhx.mjs → constants-CcJHk5SE.mjs}

@@ -1,7 +1,7 @@
 import { env } from "@better-auth/core/env";
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.3.7";
+const PLUGIN_VERSION = "0.4.0";
 //#endregion
 //#region src/constants.ts
 /**

package/dist/{crypto--3ycICW4.mjs → crypto-CAdWFWEz.mjs}

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT } from "./constants-AfApXLhx.mjs";
+import { i as INFRA_USER_AGENT } from "./constants-CcJHk5SE.mjs";
 import { createFetch } from "@better-fetch/fetch";
 //#region src/fetch.ts
 function createAPI(options, fetchOptions) {
@@ -8,7 +8,7 @@ function createAPI(options, fetchOptions) {
 			"user-agent": INFRA_USER_AGENT,
 			"x-api-key": options.apiKey
 		},
-		timeout: options.apiTimeout,
+		timeout: options.apiOptions.timeout,
 		...fetchOptions
 	});
 }
@@ -18,7 +18,7 @@ function createKV(options, fetchOptions) {
 	return createFetch({
 		baseURL: options.kvUrl,
 		headers,
-		timeout: options.kvTimeout ?? 1e3,
+		timeout: options.timeout ?? 1e3,
 		...fetchOptions
 	});
 }

package/dist/email.d.mts

@@ -146,9 +146,20 @@ interface SendEmailResult {
 interface EmailConfig {
   apiKey?: string;
   apiUrl?: string;
+  /**
+   * Dash API HTTP client options.
+   */
+  apiOptions?: {
+    /**
+     * Timeout for Dash email API HTTP requests (milliseconds).
+     * @default 3000
+     */
+    timeout?: number;
+  };
   /**
    * Timeout for Dash email API HTTP requests (milliseconds).
    * @default 3000
+   * @deprecated Use `apiOptions.timeout` instead.
    */
   apiTimeout?: number;
 }

package/dist/email.mjs

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-AfApXLhx.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CcJHk5SE.mjs";
 import { logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { createFetch } from "@better-fetch/fetch";
@@ -41,7 +41,7 @@ function createEmailSender(config) {
 			"user-agent": INFRA_USER_AGENT,
 			Authorization: `Bearer ${apiKey}`
 		},
-		timeout: config?.apiTimeout ?? 3e3
+		timeout: config?.apiOptions?.timeout ?? config?.apiTimeout ?? 3e3
 	});
 	/**
 	* Send an email using a template from Better Auth Infra

package/dist/{dash-client-DXuu2ctl.d.mts → identify-client-options-RI-JiXQx.d.mts}

@@ -1,3 +1,4 @@
+import { m as KvRetryOptions } from "./types-B673lCib.mjs";
 import { BetterAuthClientOptions, ClientStore } from "better-auth";
 import { BetterFetch } from "@better-fetch/fetch";
 
@@ -91,4 +92,18 @@ declare const dashClient: (options?: DashClientOptions) => {
   };
 };
 //#endregion
-export { DashGetAuditLogsInput as a, DashGetAllAuditLogsInput as i, DashAuditLogsResponse as n, dashClient as o, DashClientOptions as r, DashAuditLog as t };
+//#region src/sentinel/identify-client-options.d.ts
+type IdentifyClientOptions = {
+  /**
+   * Timeout for identify and related HTTP requests (milliseconds).
+   * @default 1000
+   */
+  timeout?: number;
+  /**
+   * Retry/backoff for identify POST requests.
+   * @default { attempts: 2, baseDelay: 400, maxDelay: 600 }
+   */
+  retry?: KvRetryOptions;
+};
+//#endregion
+export { DashGetAllAuditLogsInput as a, DashClientOptions as i, DashAuditLog as n, DashGetAuditLogsInput as o, DashAuditLogsResponse as r, dashClient as s, IdentifyClientOptions as t };