@better-auth/infra 0.3.7 → 0.4.1

package/CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to `@better-auth/infra` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.1] - 2026-08-19
+
+### Fixed
+
+- **React Native / Hermes crypto** — SHA-256 (including Sentinel PoW challenge solve/verify) no longer requires `crypto.subtle`. Prefers Web Crypto when present; otherwise falls back to `@noble/hashes`.
+
+## [0.4.0] - 2026-08-14
+
+
+### Added
+
+- **Managed SCIM directory sync** — Opt-in `dash({ managedDirectorySync: { enabled: true } })` control plane for Better Auth 1.7+ managed connections. Adds dashboard lifecycle endpoints to create, list, get, rotate credentials, revoke credentials, list events, unpair, and decommission organization directories, plus schema for `directorySyncConnection` / membership provenance, optional SSO pairing hooks, and SCIM → organization membership projection.
+- **Issuer-scoped accounts** — Dashboard user create, set-password, and account unlink paths work with Better Auth 1.7 issuer-scoped account identity (`issuer` + subject) while remaining compatible with pre-issuer schemas.
+- **Configurable API / KV client options** — Shared `apiOptions` / `kvOptions` (timeout and KV retry/backoff) on `dash` and `sentinel`. Legacy `apiTimeout` / `kvTimeout` remain supported as deprecated aliases.
+- **`GET /dash/config` joins insight** — Config insights report `hasJoinsEnabled` from `advanced.database.joins` (and pre-1.7 `experimental.joins` when applicable).
+
+### Changed
+
+- **Better Auth 1.7 RC compatibility** — Support matrix and runtime paths updated through 1.7 rc.4 (issuer-scoped accounts, session lifecycle hooks, SSO domain verification contracts).
+- **SSO domain verification TXT records** — Dashboard domain verification uses the SSO plugin `tokenPrefix` and the `_` + prefix + provider id TXT name shape expected by Better Auth domain verification.
+- **Session lifecycle event tracking** — Sign-in / session-created / impersonation tracking deferred correctly when session creation runs before the user is available on the request context (Better Auth 1.7 rc.2+).
+- **Directory list mode split** — Legacy pre-1.7 SCIM provider listing stays on the legacy surface; managed connection APIs only run when managed directory sync is enabled.
+- **Account unlink body** — `unlinkAccount` requires `accountId` (local account row id) together with `providerId`.
+
+### Fixed
+
+- **SSO domain verify errors** — `verify-domain` maps provider-changed, already-verified, and missing-DNS cases to stable dashboard responses instead of leaking raw API errors.
+- **Sentinel stale-account handling** — Stale-user blocks clear the session cookie and surface a consistent `STALE_ACCOUNT` error after the endpoint runs, not only inside DB hooks.
+- **SCIM token redaction** — Sensitive SCIM credential fields stay redacted in dash config / plugin option dumps.
+
 ## [0.3.7] - 2026-07-20
 
 ### Added
@@ -144,6 +174,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 [0.3.7]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.6...infra@v0.3.7
 [0.3.6]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.5...infra@v0.3.6
+[0.4.0]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.7...infra@v0.4.0
 [0.3.5]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.4...infra@v0.3.5
 [0.3.4]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.3...infra@v0.3.4
 [0.3.3]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.2...infra@v0.3.3

package/README.md

@@ -80,6 +80,10 @@ Use this plugin for your React Native / Expo app. This plugin is designed to wor
 pnpm add react-native @react-native-async-storage/async-storage
 # Optional, for richer device metadata in the identify payload:
 pnpm add expo-constants expo-device
+# Optional, secure visitor-id RNG (Expo):
+pnpm add expo-crypto
+# Or plain React Native — first import in the app entry:
+# import "react-native-get-random-values";
 ```
 
 `@react-native-async-storage/async-storage` is optional; if it is not installed, a session-only in-memory visitor id is used. For production, install it or pass `storage` (for example secure storage).
@@ -104,7 +108,9 @@ export const authClient = createAuthClient({
 
 ### Options (`sentinelNativeClient`)
 
-- `identifyUrl?: string` — KV identify endpoint base (defaults to `BETTER_AUTH_KV_URL` from env, then `https://kv.better-auth.com`).
+- `identifyUrl?: string` — identify endpoint base (defaults to `BETTER_AUTH_KV_URL` from env, then `https://kv.better-auth.com`).
+- `identifyOptions?: { timeout?: number; retry?: { attempts?: number; baseDelay?: number; maxDelay?: number } }` — identify HTTP timeout (ms, default `1000`) and POST retry (defaults `2` / `400` / `600`).
+- `kvTimeout?: number` — **deprecated**, use `identifyOptions.timeout`.
 - `autoSolveChallenge?: boolean` — When `true` (default), `423` responses that include `X-PoW-Challenge` are solved and the request is retried once with `X-PoW-Solution`.
 - `onChallengeReceived?` / `onChallengeSolved?` / `onChallengeFailed?` — PoW lifecycle hooks (reason string, solve time in ms, or error).
 - `storage?: { getItem, setItem }` — Async key/value storage for a stable per-install visitor id (recommended for production).
@@ -270,7 +276,12 @@ The `dash()` plugin registers these event endpoints:
 - `apiUrl?: string`
 - `kvUrl?: string`
 - `apiKey?: string`
+- `apiOptions?: { timeout?: number }` (ms, default `3000`)
+- `kvOptions?: { timeout?: number; retry?: { attempts?: number; baseDelay?: number; maxDelay?: number } }` — KV timeout default `1000`; retry defaults `2` / `400` / `600`
+- `apiTimeout?: number` — **deprecated**, use `apiOptions.timeout`
+- `kvTimeout?: number` — **deprecated**, use `kvOptions.timeout`
 - `activityTracking?: { enabled?: boolean; updateInterval?: number }`
+- `managedDirectorySync?: { enabled?: boolean; ssoPairing?: boolean; membershipProjection?: { enabled?: boolean; role?: string } }` — opt into the 1.7+ managed directory-sync control plane (schema + reservation APIs). `enabled` alone turns on reservation tables/APIs. When enabled, dash `init` can also wire sibling-plugin callbacks: `ssoPairing` installs SSO `resolveUser` / `guardProviderMutation` (needed only for paired directories; requires `sso({})` or richer options — bare `sso()` leaves `options` undefined), and `membershipProjection` installs SCIM `projection.reconcileUser` for org membership sync. Defaults: `enabled: false`, `ssoPairing: true`, `membershipProjection.enabled: true`, `membershipProjection.role: "member"`. Required with `scim({ managedConnections })` for managed mode; does not affect or replace legacy pre-1.7 SCIM directory sync.
 
 `dash()` no longer accepts sentinel security config.
 
@@ -279,6 +290,10 @@ The `dash()` plugin registers these event endpoints:
 - `apiUrl?: string`
 - `kvUrl?: string`
 - `apiKey?: string`
+- `apiOptions?: { timeout?: number }` — same as `DashOptions`
+- `kvOptions?: { timeout?: number; retry?: { attempts?: number; baseDelay?: number; maxDelay?: number } }` — same as `DashOptions`
+- `apiTimeout?: number` — **deprecated**, use `apiOptions.timeout`
+- `kvTimeout?: number` — **deprecated**, use `kvOptions.timeout`
 - `security?: SecurityOptions`
 
 All security configuration now belongs in `sentinel()`.

package/dist/client.d.mts

@@ -1,5 +1,4 @@
-import { a as DashGetAuditLogsInput, i as DashGetAllAuditLogsInput, n as DashAuditLogsResponse, o as dashClient, r as DashClientOptions, t as DashAuditLog } from "./dash-client-DXuu2ctl.mjs";
-
+import { a as DashGetAllAuditLogsInput, i as DashClientOptions, n as DashAuditLog, o as DashGetAuditLogsInput, r as DashAuditLogsResponse, s as dashClient, t as IdentifyClientOptions } from "./identify-client-options-CgijjwVT.mjs";
 //#region src/sentinel/client.d.ts
 interface SentinelClientOptions {
   /**
@@ -8,8 +7,13 @@ interface SentinelClientOptions {
    */
   identifyUrl?: string;
   /**
-   * Timeout for KV identify and related HTTP requests (milliseconds).
+   * Identify HTTP client options.
+   */
+  identifyOptions?: IdentifyClientOptions;
+  /**
+   * Timeout for identify and related HTTP requests (milliseconds).
    * @default 1000
+   * @deprecated Use `identifyOptions.timeout` instead.
    */
   kvTimeout?: number;
   /**

package/dist/client.mjs

@@ -1,5 +1,5 @@
-import { n as hash, o as createKV } from "./crypto--3ycICW4.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as dashClient, i as solvePoWChallenge, n as decodePoWChallenge, o as generateRequestId, r as encodePoWSolution, s as identify, t as createPowRetryTimeout } from "./pow-retry-Dy1D-TKx.mjs";
+import { n as hash, o as createKV } from "./crypto-CV91nSbp.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-7sPi32Ow.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts
 function murmurhash3(str, seed = 0) {
@@ -325,7 +325,8 @@ async function generateVisitorId(components) {
 		fonts: components.fonts,
 		maxTouchPoints: components.maxTouchPoints
 	};
-	return (await hash(JSON.stringify(stableData))).slice(0, 20);
+	const dataString = JSON.stringify(stableData);
+	return (await hash(dataString)).slice(0, 20);
 }
 function calculateConfidence(components) {
 	const weights = {
@@ -435,25 +436,16 @@ function appendIdentification(headers, fingerprint) {
 const MAX_POW_CHALLENGE_ROUNDS = 2;
 const sentinelClient = (options) => {
 	const autoSolve = options?.autoSolveChallenge !== false;
+	const identifyUrl = resolveSentinelClientIdentifyUrl({
+		identifyUrl: options?.identifyUrl,
+		envKvUrl: env.BETTER_AUTH_KV_URL
+	});
 	const $kv = createKV({
-		kvUrl: resolveSentinelClientIdentifyUrl({
-			identifyUrl: options?.identifyUrl,
-			envKvUrl: env.BETTER_AUTH_KV_URL
-		}),
-		kvTimeout: options?.kvTimeout
+		kvUrl: identifyUrl,
+		timeout: options?.identifyOptions?.timeout ?? options?.kvTimeout
 	}, {
 		throw: true,
-		retry: {
-			type: "exponential",
-			attempts: 2,
-			baseDelay: 400,
-			maxDelay: 600,
-			shouldRetry(response) {
-				if (response === null) return true;
-				if (response.status === 429) return true;
-				return response.status >= 500;
-			}
-		}
+		retry: resolveIdentifyClientRetry(options?.identifyOptions?.retry)
 	});
 	if (typeof window !== "undefined") {
 		const scheduleIdentify = () => {

package/dist/{constants-AfApXLhx.mjs → constants-CtvGRrlI.mjs}

@@ -1,7 +1,7 @@
 import { env } from "@better-auth/core/env";
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.3.7";
+const PLUGIN_VERSION = "0.4.1";
 //#endregion
 //#region src/constants.ts
 /**

package/dist/{crypto--3ycICW4.mjs → crypto-CV91nSbp.mjs}

@@ -1,5 +1,6 @@
-import { i as INFRA_USER_AGENT } from "./constants-AfApXLhx.mjs";
+import { i as INFRA_USER_AGENT } from "./constants-CtvGRrlI.mjs";
 import { createFetch } from "@better-fetch/fetch";
+import { sha256 } from "@noble/hashes/sha2.js";
 //#region src/fetch.ts
 function createAPI(options, fetchOptions) {
 	return createFetch({
@@ -8,7 +9,7 @@ function createAPI(options, fetchOptions) {
 			"user-agent": INFRA_USER_AGENT,
 			"x-api-key": options.apiKey
 		},
-		timeout: options.apiTimeout,
+		timeout: options.apiOptions.timeout,
 		...fetchOptions
 	});
 }
@@ -18,7 +19,7 @@ function createKV(options, fetchOptions) {
 	return createFetch({
 		baseURL: options.kvUrl,
 		headers,
-		timeout: options.kvTimeout ?? 1e3,
+		timeout: options.timeout ?? 1e3,
 		...fetchOptions
 	});
 }
@@ -32,19 +33,33 @@ function randomBytes(length) {
 function bytesToHex(bytes) {
 	return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+function getSubtle() {
+	try {
+		const c = globalThis.crypto;
+		if (c && typeof c.subtle === "object" && c.subtle != null) return c.subtle;
+	} catch {}
+	return null;
+}
+/** SHA-256 hex digest. Prefers Web Crypto; falls back to `@noble/hashes`. */
 async function hash(message) {
-	const msgBuffer = new TextEncoder().encode(message);
-	const hashBuffer = await crypto.subtle.digest("SHA-256", msgBuffer);
-	return bytesToHex(new Uint8Array(hashBuffer));
+	const data = new TextEncoder().encode(message);
+	const subtle = getSubtle();
+	if (subtle) {
+		const hashBuffer = await subtle.digest("SHA-256", data);
+		return bytesToHex(new Uint8Array(hashBuffer));
+	}
+	return bytesToHex(sha256(data));
 }
 /** Keyed HMAC-SHA256 for blinded fingerprints (e.g. failed-login passwords). */
 async function hmacSha256Hex(key, message) {
 	const encoder = new TextEncoder();
-	const cryptoKey = await crypto.subtle.importKey("raw", encoder.encode(key), {
+	const subtle = getSubtle();
+	if (!subtle) throw new Error("[@better-auth/infra] crypto.subtle is required for HMAC-SHA256");
+	const cryptoKey = await subtle.importKey("raw", encoder.encode(key), {
 		name: "HMAC",
 		hash: "SHA-256"
 	}, false, ["sign"]);
-	const signature = await crypto.subtle.sign("HMAC", cryptoKey, encoder.encode(message));
+	const signature = await subtle.sign("HMAC", cryptoKey, encoder.encode(message));
 	return bytesToHex(new Uint8Array(signature));
 }
 //#endregion

package/dist/email.d.mts

@@ -146,9 +146,20 @@ interface SendEmailResult {
 interface EmailConfig {
   apiKey?: string;
   apiUrl?: string;
+  /**
+   * Dash API HTTP client options.
+   */
+  apiOptions?: {
+    /**
+     * Timeout for Dash email API HTTP requests (milliseconds).
+     * @default 3000
+     */
+    timeout?: number;
+  };
   /**
    * Timeout for Dash email API HTTP requests (milliseconds).
    * @default 3000
+   * @deprecated Use `apiOptions.timeout` instead.
    */
   apiTimeout?: number;
 }

package/dist/email.mjs

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-AfApXLhx.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CtvGRrlI.mjs";
 import { logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { createFetch } from "@better-fetch/fetch";
@@ -41,7 +41,7 @@ function createEmailSender(config) {
 			"user-agent": INFRA_USER_AGENT,
 			Authorization: `Bearer ${apiKey}`
 		},
-		timeout: config?.apiTimeout ?? 3e3
+		timeout: config?.apiOptions?.timeout ?? config?.apiTimeout ?? 3e3
 	});
 	/**
 	* Send an email using a template from Better Auth Infra

package/dist/{dash-client-DXuu2ctl.d.mts → identify-client-options-CgijjwVT.d.mts}

@@ -1,6 +1,6 @@
+import { m as KvRetryOptions } from "./types-Ddk4r5x9.mjs";
 import { BetterAuthClientOptions, ClientStore } from "better-auth";
 import { BetterFetch } from "@better-fetch/fetch";
-
 //#region src/dash-client.d.ts
 interface DashAuditLog {
   eventType: string;
@@ -91,4 +91,18 @@ declare const dashClient: (options?: DashClientOptions) => {
   };
 };
 //#endregion
-export { DashGetAuditLogsInput as a, DashGetAllAuditLogsInput as i, DashAuditLogsResponse as n, dashClient as o, DashClientOptions as r, DashAuditLog as t };
+//#region src/sentinel/identify-client-options.d.ts
+type IdentifyClientOptions = {
+  /**
+   * Timeout for identify and related HTTP requests (milliseconds).
+   * @default 1000
+   */
+  timeout?: number;
+  /**
+   * Retry/backoff for identify POST requests.
+   * @default { attempts: 2, baseDelay: 400, maxDelay: 600 }
+   */
+  retry?: KvRetryOptions;
+};
+//#endregion
+export { DashGetAllAuditLogsInput as a, DashClientOptions as i, DashAuditLog as n, DashGetAuditLogsInput as o, DashAuditLogsResponse as r, dashClient as s, IdentifyClientOptions as t };