@better-auth/infra 0.4.1 → 0.4.2

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to `@better-auth/infra` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.2] - 2026-08-21
+
+### Fixed
+
+- **Identification on OAuth callbacks** — Sentinel and dash run identification on GET OAuth callback routes and persist `X-Request-Id` as the `__infra-rid` cookie in an after hook, so visitor identity resolves from KV across redirect-based social/OAuth sign-in (where identify headers are absent).
+- **Issuer-scoped account lookups** — OAuth callback user resolution honors `account.identityStrategy` (`issuer` vs `provider-id`) when deriving account keys, matching Better Auth 1.7 issuer-scoped identity and the provider-scoped compatibility mode.
+
+### Changed
+
+- **No runtime dependency on SCIM / SSO packages** — Directory-sync SCIM user-link acquisition and SAML SP policy checks are implemented in-package (aligned with `@better-auth/scim` / `@better-auth/sso`). Those packages remain type-only deps and are excluded from the published bundle.
+
 ## [0.4.1] - 2026-08-19
 
 ### Fixed

package/dist/client.mjs

@@ -1,5 +1,5 @@
-import { n as hash, o as createKV } from "./crypto-CV91nSbp.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-7sPi32Ow.mjs";
+import { n as hash, o as createKV } from "./crypto-D3yZH0Cy.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-jWGI__oh.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts
 function murmurhash3(str, seed = 0) {

package/dist/{constants-CtvGRrlI.mjs → constants-CDhjfr8S.mjs}

@@ -1,7 +1,7 @@
 import { env } from "@better-auth/core/env";
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.4.1";
+const PLUGIN_VERSION = "0.4.2";
 //#endregion
 //#region src/constants.ts
 /**

package/dist/{crypto-CV91nSbp.mjs → crypto-D3yZH0Cy.mjs}

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT } from "./constants-CtvGRrlI.mjs";
+import { i as INFRA_USER_AGENT } from "./constants-CDhjfr8S.mjs";
 import { createFetch } from "@better-fetch/fetch";
 import { sha256 } from "@noble/hashes/sha2.js";
 //#region src/fetch.ts

package/dist/email.mjs

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CtvGRrlI.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CDhjfr8S.mjs";
 import { logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { createFetch } from "@better-fetch/fetch";

package/dist/index.d.mts

@@ -249,7 +249,22 @@ type DashSCIMManagedConnectionEventType = "connection.created" | "credential.iss
 /** Lifecycle state for one Infrastructure-owned directory-sync alias. */
 type DirectorySyncConnectionStatus = "active" | "decommissioning" | "decommissioned";
 type DirectorySyncMode = "legacy" | "managed" | "unavailable";
-type SCIMPlugin = ReturnType<typeof import("@better-auth/scim").scim>;
+/**
+ * Structural stand-in for the SCIM plugin instance.
+ * Avoids `import("@better-auth/scim")` on the public type surface so consumers
+ * without that package can still typecheck the root entry.
+ */
+type SCIMPlugin = {
+  id?: string;
+  options?: {
+    providerOwnership?: {
+      enabled?: boolean;
+    };
+    managedConnections?: unknown;
+    [key: string]: unknown;
+  };
+  endpoints: Record<string, unknown>;
+};
 /** Public credential metadata. Raw bearer tokens are never included here. */
 interface DashDirectoryCredential {
   credentialId: string;

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CtvGRrlI.mjs";
-import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-CV91nSbp.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CDhjfr8S.mjs";
+import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-D3yZH0Cy.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAdapter, getCurrentAuthContext, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
@@ -7,8 +7,11 @@ import { env } from "@better-auth/core/env";
 import { APIError as APIError$1, createAuthEndpoint, createAuthMiddleware, requestPasswordReset, sendVerificationEmailFn, sessionMiddleware } from "better-auth/api";
 import { deleteSessionCookie, setSessionCookie } from "better-auth/cookies";
 import { createFetch } from "@better-fetch/fetch";
+import { sha256 } from "@noble/hashes/sha2.js";
 import { isValidPhoneNumber, parsePhoneNumberFromString } from "libphonenumber-js";
 import z, { z as z$1 } from "zod";
+import { DOMParser } from "@xmldom/xmldom";
+import { base64Url } from "@better-auth/utils/base64";
 import { createLocalJWKSet, jwtVerify } from "jose";
 import { generateRandomString, symmetricEncrypt } from "better-auth/crypto";
 import { createOTP } from "@better-auth/utils/otp";
@@ -374,6 +377,33 @@ function createLocalAccountIssuer(providerId) {
 function createOAuthAccountIssuer(providerId) {
 	return `local:oauth:${encodeURIComponent(providerId)}`;
 }
+/** Configured strategy when set; `null` when omitted (pre-option or default). */
+function getConfiguredAccountIdentityStrategy(account) {
+	const strategy = account?.identityStrategy;
+	if (strategy === "provider-id" || strategy === "issuer") return strategy;
+	return null;
+}
+/**
+* Effective strategy for account-key derivation.
+* Matches better-auth: omit/`"issuer"` → issuer-scoped; `"provider-id"` → provider-scoped.
+*/
+function resolveAccountIdentityStrategy(account) {
+	return getConfiguredAccountIdentityStrategy(account) ?? "issuer";
+}
+/**
+* Resolves the OAuth account issuer the same way better-auth does under
+* `account.identityStrategy`, including provider-scoped compatibility mode.
+*/
+async function resolveOAuthAccountIssuer(params) {
+	if (params.identityStrategy === "provider-id") return createOAuthAccountIssuer(params.providerId);
+	const { accountIssuer } = params;
+	if (typeof accountIssuer === "function") {
+		const issuer = await accountIssuer(params.context);
+		return typeof issuer === "string" && issuer.trim().length > 0 ? issuer : void 0;
+	}
+	if (typeof accountIssuer === "string" && accountIssuer.trim().length > 0) return accountIssuer;
+	return createOAuthAccountIssuer(params.providerId);
+}
 /** True when the installed better-auth build scopes accounts by issuer. */
 function supportsIssuerScopedAccounts(adapter) {
 	return typeof adapter.findAccountByKey === "function";
@@ -408,7 +438,7 @@ function normalizeProviderSubject(subject) {
 	if (!subject || subject === "undefined" || subject === "null") return;
 	return subject;
 }
-async function resolveAccountKey(provider, tokens, profile) {
+async function resolveAccountKey(provider, tokens, profile, identityStrategy) {
 	const keyedProvider = provider;
 	const context = {
 		tokens,
@@ -424,7 +454,12 @@ async function resolveAccountKey(provider, tokens, profile) {
 		}
 		const accountId = rawSubject ? normalizeProviderSubject(rawSubject) : void 0;
 		if (!accountId) return void 0;
-		const issuer = typeof keyedProvider.accountIssuer === "function" ? await keyedProvider.accountIssuer(context) : keyedProvider.accountIssuer ?? createOAuthAccountIssuer(provider.id);
+		const issuer = await resolveOAuthAccountIssuer({
+			providerId: provider.id,
+			identityStrategy,
+			accountIssuer: keyedProvider.accountIssuer,
+			context
+		});
 		if (!issuer) return void 0;
 		return {
 			issuer,
@@ -447,7 +482,8 @@ function instrumentSocialProviders(providers) {
 			if (user) try {
 				const endpointCtx = await getCurrentAuthContext();
 				const adapter = endpointCtx.context.internalAdapter;
-				const accountKey = result.data && typeof adapter.findAccountOwnerByKey === "function" ? await resolveAccountKey(provider, token, result.data) : void 0;
+				const identityStrategy = resolveAccountIdentityStrategy(endpointCtx.context.options.account);
+				const accountKey = result.data && typeof adapter.findAccountOwnerByKey === "function" ? await resolveAccountKey(provider, token, result.data, identityStrategy) : void 0;
 				endpointCtx.context[OAUTH_CALLBACK_USER] = {
 					user,
 					accountKey
@@ -1053,6 +1089,49 @@ function resolveClientIpFromHeaders(headers, ipAddressHeaders) {
 * when a request includes an X-Request-Id header.
 */
 const IDENTIFICATION_COOKIE_NAME = "__infra-rid";
+/** GET routes that need identification (OAuth callbacks, verify links, etc.). */
+const IDENTIFICATION_GET_ROUTES = [
+	routes.SIGN_IN_SOCIAL_CALLBACK,
+	routes.SIGN_IN_OAUTH_CALLBACK,
+	routes.DASH_IMPERSONATE_USER,
+	routes.VERIFY_EMAIL,
+	routes.MAGIC_LINK_VERIFY,
+	routes.DASH_ACCEPT_INVITATION,
+	routes.DASH_COMPLETE_INVITATION_SOCIAL
+];
+/** GET OAuth callbacks where user creation can run without identify headers. */
+const IDENTIFICATION_OAUTH_CALLBACK_GET_ROUTES = [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK];
+/**
+* Whether identification middleware should run for this request.
+* Non-GET always runs; GET only for routes that need cookie/KV resolution.
+*/
+function shouldRunIdentification(ctx, getRoutes = IDENTIFICATION_GET_ROUTES) {
+	if (ctx.request?.method !== "GET") return true;
+	return matchesAnyRoute(ctx.path, [...getRoutes]);
+}
+/**
+* Persist `X-Request-Id` as `__infra-rid` so redirect-flow OAuth callbacks
+* (GET, no identify headers) can resolve visitor identification from KV.
+* Must run in an after hook so Set-Cookie reaches the response.
+*/
+function createIdentificationCookieAfterMiddleware() {
+	return createAuthMiddleware(async (ctx) => {
+		const headerRequestId = ctx.request?.headers.get("X-Request-Id");
+		if (headerRequestId) {
+			ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
+				maxAge: 600,
+				sameSite: "lax",
+				httpOnly: true,
+				path: "/"
+			});
+			return;
+		}
+		if (ctx.context.requestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, "", {
+			maxAge: 0,
+			path: "/"
+		});
+	});
+}
 const identificationCache = /* @__PURE__ */ new Map();
 const CACHE_TTL_MS = 6e4;
 const CACHE_MAX_SIZE = 1e3;
@@ -2465,7 +2544,7 @@ const sentinel = (options) => {
 		hooks: {
 			before: [
 				{
-					matcher: (ctx) => ctx.request?.method !== "GET",
+					matcher: (ctx) => shouldRunIdentification(ctx, IDENTIFICATION_OAUTH_CALLBACK_GET_ROUTES),
 					handler: createIdentificationMiddleware($kv, {
 						skipIdentification: (ctx) => isDashRoute(ctx.path),
 						retry: opts.kvOptions.retry
@@ -2567,74 +2646,81 @@ const sentinel = (options) => {
 					})
 				}
 			],
-			after: [{
-				matcher: (ctx) => !!opts.security?.staleUsers?.enabled && !isDashRoute(ctx.path),
-				handler: createAuthMiddleware(async (ctx) => {
-					if (ctx.context.returned instanceof Error) return;
-					const created = ctx.context.newSession;
-					const userId = created?.user?.id ?? created?.session?.userId;
-					const sessionToken = created?.session?.token;
-					if (!userId || !sessionToken) return;
-					let user = created?.user ?? null;
-					try {
-						user = await getUserById(userId, ctx, { includeLastActiveAt: activityTrackingEnabled }) ?? user;
-					} catch (error) {
-						logger.warn("[Sentinel] Failed to fetch user for stale-account check:", error);
+			after: [
+				{
+					matcher: (ctx) => shouldRunIdentification(ctx, IDENTIFICATION_OAUTH_CALLBACK_GET_ROUTES),
+					handler: createIdentificationCookieAfterMiddleware()
+				},
+				{
+					matcher: (ctx) => !!opts.security?.staleUsers?.enabled && !isDashRoute(ctx.path),
+					handler: createAuthMiddleware(async (ctx) => {
+						if (ctx.context.returned instanceof Error) return;
+						const created = ctx.context.newSession;
+						const userId = created?.user?.id ?? created?.session?.userId;
+						const sessionToken = created?.session?.token;
+						if (!userId || !sessionToken) return;
+						let user = created?.user ?? null;
+						try {
+							user = await getUserById(userId, ctx, { includeLastActiveAt: activityTrackingEnabled }) ?? user;
+						} catch (error) {
+							logger.warn("[Sentinel] Failed to fetch user for stale-account check:", error);
+							if (!user) return;
+						}
 						if (!user) return;
-					}
-					if (!user) return;
-					recordCheck(ctx, "stale_users");
-					const staleCheck = await securityService.checkStaleUser(userId, activityTrackingEnabled ? user.lastActiveAt ?? null : null);
-					if (!staleCheck.isStale) return;
-					const identification = ctx.context.identification;
-					const staleOpts = opts.security?.staleUsers;
-					const notificationPromises = [];
-					if (staleCheck.notifyUser && user.email) notificationPromises.push(securityService.notifyStaleAccountUser(user.email, user.name || null, staleCheck.daysSinceLastActive || 0, identification));
-					if (staleCheck.notifyAdmin && staleOpts?.adminEmail) notificationPromises.push(securityService.notifyStaleAccountAdmin(staleOpts.adminEmail, userId, user.email || "unknown", user.name || null, staleCheck.daysSinceLastActive || 0, identification));
-					if (notificationPromises.length > 0) Promise.all(notificationPromises).catch((error) => {
-						logger.error("[Sentinel] Failed to send stale account notifications:", error);
-					});
-					if (staleCheck.action !== "block") return;
-					setOutcome(ctx, "blocked", "stale_users", {
-						userId,
-						daysSinceLastActive: staleCheck.daysSinceLastActive,
-						staleDays: staleCheck.staleDays,
-						lastActiveAt: staleCheck.lastActiveAt,
-						notifyUser: staleCheck.notifyUser,
-						notifyAdmin: staleCheck.notifyAdmin
-					});
-					emitEvaluation(ctx, trackEvent);
-					try {
-						await ctx.context.internalAdapter.deleteSession(sessionToken);
-					} catch (error) {
-						logger.warn("[Sentinel] Failed to delete stale-blocked session:", error);
-					}
-					deleteSessionCookie(ctx);
-					ctx.context.setNewSession(null);
-					throw new APIError("FORBIDDEN", STALE_ACCOUNT_BLOCK_ERROR);
-				})
-			}, {
-				matcher: (ctx) => ctx.request?.method !== "GET" && !isDashRoute(ctx.path),
-				handler: createAuthMiddleware(async (ctx) => {
-					const untrustedVisitorId = ctx.context.untrustedVisitorId;
-					const ip = ctx.context.ip;
-					const body = ctx.body;
-					const loginId = matchesAnyRoute(ctx.path, [routes.SIGN_IN_USERNAME]) ? body?.username : body?.email;
-					const isPasswordSignInRoute = matchesAnyRoute(ctx.path, [
-						routes.SIGN_IN_EMAIL,
-						routes.SIGN_IN_USERNAME,
-						routes.SIGN_IN_EMAIL_OTP
-					]);
-					emitEvaluation(ctx, trackEvent, {
-						identifier: loginId,
-						userAgent: ctx.headers?.get?.("user-agent") || ""
-					});
-					const returned = ctx.context.returned;
-					const staleBlocked = isStaleAccountError(returned);
-					if (isPasswordSignInRoute && returned instanceof Error && !staleBlocked && loginId && body?.password && untrustedVisitorId) await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(loginId, untrustedVisitorId, body.password, ip, ctx.context.requestId ?? null));
-					if (isPasswordSignInRoute && (!(returned instanceof Error) || staleBlocked) && loginId) await ctx.context.runInBackgroundOrAwait(securityService.clearFailedAttempts(loginId));
-				})
-			}]
+						recordCheck(ctx, "stale_users");
+						const staleCheck = await securityService.checkStaleUser(userId, activityTrackingEnabled ? user.lastActiveAt ?? null : null);
+						if (!staleCheck.isStale) return;
+						const identification = ctx.context.identification;
+						const staleOpts = opts.security?.staleUsers;
+						const notificationPromises = [];
+						if (staleCheck.notifyUser && user.email) notificationPromises.push(securityService.notifyStaleAccountUser(user.email, user.name || null, staleCheck.daysSinceLastActive || 0, identification));
+						if (staleCheck.notifyAdmin && staleOpts?.adminEmail) notificationPromises.push(securityService.notifyStaleAccountAdmin(staleOpts.adminEmail, userId, user.email || "unknown", user.name || null, staleCheck.daysSinceLastActive || 0, identification));
+						if (notificationPromises.length > 0) Promise.all(notificationPromises).catch((error) => {
+							logger.error("[Sentinel] Failed to send stale account notifications:", error);
+						});
+						if (staleCheck.action !== "block") return;
+						setOutcome(ctx, "blocked", "stale_users", {
+							userId,
+							daysSinceLastActive: staleCheck.daysSinceLastActive,
+							staleDays: staleCheck.staleDays,
+							lastActiveAt: staleCheck.lastActiveAt,
+							notifyUser: staleCheck.notifyUser,
+							notifyAdmin: staleCheck.notifyAdmin
+						});
+						emitEvaluation(ctx, trackEvent);
+						try {
+							await ctx.context.internalAdapter.deleteSession(sessionToken);
+						} catch (error) {
+							logger.warn("[Sentinel] Failed to delete stale-blocked session:", error);
+						}
+						deleteSessionCookie(ctx);
+						ctx.context.setNewSession(null);
+						throw new APIError("FORBIDDEN", STALE_ACCOUNT_BLOCK_ERROR);
+					})
+				},
+				{
+					matcher: (ctx) => ctx.request?.method !== "GET" && !isDashRoute(ctx.path),
+					handler: createAuthMiddleware(async (ctx) => {
+						const untrustedVisitorId = ctx.context.untrustedVisitorId;
+						const ip = ctx.context.ip;
+						const body = ctx.body;
+						const loginId = matchesAnyRoute(ctx.path, [routes.SIGN_IN_USERNAME]) ? body?.username : body?.email;
+						const isPasswordSignInRoute = matchesAnyRoute(ctx.path, [
+							routes.SIGN_IN_EMAIL,
+							routes.SIGN_IN_USERNAME,
+							routes.SIGN_IN_EMAIL_OTP
+						]);
+						emitEvaluation(ctx, trackEvent, {
+							identifier: loginId,
+							userAgent: ctx.headers?.get?.("user-agent") || ""
+						});
+						const returned = ctx.context.returned;
+						const staleBlocked = isStaleAccountError(returned);
+						if (isPasswordSignInRoute && returned instanceof Error && !staleBlocked && loginId && body?.password && untrustedVisitorId) await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(loginId, untrustedVisitorId, body.password, ip, ctx.context.requestId ?? null));
+						if (isPasswordSignInRoute && (!(returned instanceof Error) || staleBlocked) && loginId) await ctx.context.runInBackgroundOrAwait(securityService.clearFailedAttempts(loginId));
+					})
+				}
+			]
 		}
 	};
 };
@@ -2821,12 +2907,98 @@ function setCredentialResponseSecurityHeaders(ctx) {
 	ctx.setHeader("Referrer-Policy", "no-referrer");
 }
 //#endregion
-//#region src/directory-sync/pairing.ts
-let samlPolicyModule;
-function loadSAMLPolicy() {
-	samlPolicyModule ??= import("./saml-policy-DQR0MBLk.mjs");
-	return samlPolicyModule;
+//#region src/directory-sync/saml-policy.ts
+/**
+* Aligned with `@better-auth/sso` SAML metadata constants / helpers.
+* @see better-auth packages/sso parseSAMLServiceProviderMetadata
+*/
+const SAML_METADATA_NAMESPACE = "urn:oasis:names:tc:SAML:2.0:metadata";
+const HTTP_POST_BINDING = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+/**
+* Whether a SAML provider config requires signed assertions.
+*
+* Matches `@better-auth/sso` `deriveSAMLServiceProviderPolicy(...).wantAssertionsSigned`.
+* Invalid or unusable custom SP metadata throws (pairing maps this to BAD_REQUEST).
+*/
+function requiresSignedSAMLAssertions(config) {
+	const metadata = config.spMetadata?.metadata;
+	if (!metadata) return config.wantAssertionsSigned === true;
+	const parsedMetadata = parseSAMLServiceProviderMetadata(metadata);
+	if (!parsedMetadata.postAssertionConsumerServiceUrls.length) throw new Error("Unusable SAML service provider metadata");
+	return parsedMetadata.wantAssertionsSigned;
 }
+/**
+* Parses the security- and identity-relevant parts of SAML service-provider
+* metadata without relying on local-name-only XML matching.
+*
+* Port of `@better-auth/sso` `parseSAMLServiceProviderMetadata`.
+*/
+function parseSAMLServiceProviderMetadata(metadata) {
+	const document = new DOMParser({ onError: (_level, message) => {
+		throw new Error(message);
+	} }).parseFromString(metadata, "text/xml");
+	const entityDescriptor = document.documentElement;
+	if (!entityDescriptor || entityDescriptor.localName !== "EntityDescriptor" || entityDescriptor.namespaceURI !== SAML_METADATA_NAMESPACE) throw new Error("Invalid SAML EntityDescriptor");
+	const entityID = entityDescriptor.getAttribute("entityID")?.trim();
+	if (!entityID) throw new Error("Missing SAML entityID");
+	const serviceProviderDescriptors = directMetadataChildren(entityDescriptor, "SPSSODescriptor");
+	if (serviceProviderDescriptors.length === 0) throw new Error("SAML metadata must contain an SPSSODescriptor");
+	const acceptedServiceProviderDescriptors = new Set(serviceProviderDescriptors);
+	for (const element of Array.from(document.getElementsByTagName("*"))) {
+		if (element.localName === "EntityDescriptor" && element !== entityDescriptor) throw new Error("Invalid nested SAML EntityDescriptor");
+		if (element.localName === "SPSSODescriptor" && !acceptedServiceProviderDescriptors.has(element)) throw new Error("Invalid SAML SPSSODescriptor namespace or position");
+		if ((element.localName === "AssertionConsumerService" || element.localName === "NameIDFormat") && (element.namespaceURI !== SAML_METADATA_NAMESPACE || !element.parentNode || !isElement(element.parentNode) || !acceptedServiceProviderDescriptors.has(element.parentNode))) throw new Error(`Invalid SAML ${element.localName} namespace or position`);
+	}
+	const postAssertionConsumerServiceUrls = [];
+	const nameIDFormats = [];
+	let wantAssertionsSigned = false;
+	for (const descriptor of serviceProviderDescriptors) {
+		wantAssertionsSigned = parseXMLSchemaBoolean(descriptor.getAttribute("WantAssertionsSigned")) || wantAssertionsSigned;
+		for (const nameIDFormat of directMetadataChildren(descriptor, "NameIDFormat")) {
+			const value = nameIDFormat.textContent?.trim();
+			if (value) nameIDFormats.push(value);
+		}
+		for (const service of directMetadataChildren(descriptor, "AssertionConsumerService")) {
+			if (service.getAttribute("Binding") !== HTTP_POST_BINDING) continue;
+			const location = service.getAttribute("Location")?.trim();
+			if (!location || !isAbsoluteHttpUrl(location)) throw new Error("Invalid SAML POST AssertionConsumerService");
+			postAssertionConsumerServiceUrls.push(location);
+		}
+	}
+	return {
+		entityID,
+		nameIDFormats: [...new Set(nameIDFormats)],
+		postAssertionConsumerServiceUrls: [...new Set(postAssertionConsumerServiceUrls)],
+		wantAssertionsSigned
+	};
+}
+function isElement(node) {
+	return node.nodeType === 1;
+}
+function directMetadataChildren(element, localName) {
+	return Array.from(element.childNodes).filter((node) => isElement(node) && node.localName === localName && node.namespaceURI === SAML_METADATA_NAMESPACE);
+}
+function parseXMLSchemaBoolean(value) {
+	if (value === null) return false;
+	switch (value.trim()) {
+		case "true":
+		case "1": return true;
+		case "false":
+		case "0": return false;
+		default: throw new Error("Invalid XML Schema boolean");
+	}
+}
+function isAbsoluteHttpUrl(value) {
+	if (value.includes("#")) return false;
+	try {
+		const url = new URL(value);
+		return url.protocol === "http:" || url.protocol === "https:";
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/directory-sync/pairing.ts
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -2879,10 +3051,9 @@ async function resolveDirectorySyncSSOPairing(ctx, organizationId, pairing) {
 		if (!oidcConfiguration || samlConfiguration) throw ctx.error("BAD_REQUEST", { message: "The selected SSO provider is not an OIDC provider" });
 	} else {
 		if (!samlConfiguration || oidcConfiguration) throw ctx.error("BAD_REQUEST", { message: "The selected SSO provider is not a SAML provider" });
-		const samlPolicy = await loadSAMLPolicy();
 		let wantAssertionsSigned = false;
 		try {
-			wantAssertionsSigned = await samlPolicy.requiresSignedSAMLAssertions({
+			wantAssertionsSigned = requiresSignedSAMLAssertions({
 				spMetadata: isRecord$1(samlConfiguration.spMetadata) ? { metadata: typeof samlConfiguration.spMetadata.metadata === "string" ? samlConfiguration.spMetadata.metadata : void 0 } : void 0,
 				wantAssertionsSigned: samlConfiguration.wantAssertionsSigned === true
 			});
@@ -2929,17 +3100,228 @@ async function guardDirectorySyncSSOProviderMutation(input, context) {
 	}
 }
 //#endregion
+//#region src/directory-sync/scim-user-link.ts
+function createScopedKey(parts) {
+	return base64Url.encode(sha256(new TextEncoder().encode(JSON.stringify(parts))), { padding: false });
+}
+function createSCIMUserExternalIdKey(connectionId, externalId) {
+	return createScopedKey([
+		"scim-user-external-id",
+		connectionId,
+		externalId
+	]);
+}
+function createSCIMConnectionKey(connectionId) {
+	return createScopedKey(["scim-connection", connectionId]);
+}
+var SCIMIdentityMutationConflict = class extends Error {
+	constructor() {
+		super("The SCIM identity changed concurrently; retry the request");
+		this.name = "SCIMIdentityMutationConflict";
+	}
+};
+function concurrentIdentityMutation() {
+	throw new SCIMIdentityMutationConflict();
+}
+function hasIncrementOne(database) {
+	return typeof database.incrementOne === "function";
+}
+async function tryFenceActiveSCIMConnection(database, connectionId) {
+	return database.incrementOne({
+		model: "scimConnectionBinding",
+		where: [
+			{
+				field: "connectionKey",
+				value: createSCIMConnectionKey(connectionId)
+			},
+			{
+				field: "connectionId",
+				value: connectionId
+			},
+			{
+				field: "decommissionStatus",
+				value: "active"
+			}
+		],
+		increment: { decommissionRevision: 1 }
+	});
+}
+/**
+* Acquires an active provisioned User link inside the caller's transaction.
+* Returns null when no active link exists. Throws on concurrent identity mutation.
+*/
+async function acquireActiveSCIMUserLink(reference, context) {
+	if (!hasIncrementOne(context.database)) return null;
+	const database = context.database;
+	const externalIdKey = createSCIMUserExternalIdKey(reference.connectionId, reference.externalId);
+	const source = await database.findOne({
+		model: "scimUser",
+		where: [
+			{
+				field: "connectionId",
+				value: reference.connectionId
+			},
+			{
+				field: "externalIdKey",
+				value: externalIdKey
+			},
+			{
+				field: "externalId",
+				value: reference.externalId
+			},
+			{
+				field: "active",
+				value: true
+			}
+		]
+	});
+	if (!source) return null;
+	const binding = await database.findOne({
+		model: "scimConnectionBinding",
+		where: [
+			{
+				field: "connectionKey",
+				value: createSCIMConnectionKey(reference.connectionId)
+			},
+			{
+				field: "connectionId",
+				value: reference.connectionId
+			},
+			{
+				field: "decommissionStatus",
+				value: "active"
+			}
+		]
+	});
+	if (!binding || binding.provisioningDomainId !== source.provisioningDomainId) return null;
+	if (await database.findOne({
+		model: "scimIdentityTombstone",
+		where: [
+			{
+				field: "connectionId",
+				value: reference.connectionId
+			},
+			{
+				field: "externalIdKey",
+				value: externalIdKey
+			},
+			{
+				field: "externalId",
+				value: reference.externalId
+			}
+		]
+	})) return null;
+	const subject = await database.findOne({
+		model: "scimSubject",
+		where: [{
+			field: "userId",
+			value: source.userId
+		}]
+	});
+	if (!subject) return null;
+	if (!await database.findOne({
+		model: "user",
+		where: [{
+			field: "id",
+			value: source.userId
+		}]
+	})) return null;
+	const acquiredSubject = await database.incrementOne({
+		model: "scimSubject",
+		where: [
+			{
+				field: "id",
+				value: subject.id
+			},
+			{
+				field: "userId",
+				value: source.userId
+			},
+			{
+				field: "revision",
+				value: subject.revision
+			}
+		],
+		increment: { revision: 1 },
+		set: { updatedAt: /* @__PURE__ */ new Date() }
+	});
+	if (!acquiredSubject) concurrentIdentityMutation();
+	const acquiredSource = await database.findOne({
+		model: "scimUser",
+		where: [
+			{
+				field: "id",
+				value: source.id
+			},
+			{
+				field: "connectionId",
+				value: reference.connectionId
+			},
+			{
+				field: "provisioningDomainId",
+				value: binding.provisioningDomainId
+			},
+			{
+				field: "userId",
+				value: source.userId
+			},
+			{
+				field: "connectionUserKey",
+				value: source.connectionUserKey
+			},
+			{
+				field: "externalIdKey",
+				value: externalIdKey
+			},
+			{
+				field: "externalId",
+				value: reference.externalId
+			},
+			{
+				field: "active",
+				value: true
+			}
+		]
+	});
+	if (!acquiredSource || !acquiredSource.active || acquiredSource.userId !== acquiredSubject.userId) concurrentIdentityMutation();
+	if (!await database.findOne({
+		model: "user",
+		where: [{
+			field: "id",
+			value: acquiredSource.userId
+		}]
+	})) concurrentIdentityMutation();
+	if (await database.findOne({
+		model: "scimIdentityTombstone",
+		where: [
+			{
+				field: "connectionId",
+				value: reference.connectionId
+			},
+			{
+				field: "externalIdKey",
+				value: externalIdKey
+			},
+			{
+				field: "externalId",
+				value: reference.externalId
+			}
+		]
+	})) concurrentIdentityMutation();
+	const acquiredBinding = await tryFenceActiveSCIMConnection(database, reference.connectionId);
+	if (!acquiredBinding || acquiredBinding.id !== binding.id || acquiredBinding.provisioningDomainId !== acquiredSource.provisioningDomainId) concurrentIdentityMutation();
+	return {
+		scimUserId: source.id,
+		userId: source.userId
+	};
+}
+//#endregion
 //#region src/directory-sync/sso-user-resolution.ts
 const GENERIC_REJECTION = {
 	action: "reject",
 	code: "DIRECTORY_SYNC_AUTHENTICATION_FAILED",
 	message: "Unable to sign in with this SSO connection"
 };
-let scimCatalogModule;
-function loadSCIMCatalog() {
-	scimCatalogModule ??= import("@better-auth/scim");
-	return scimCatalogModule;
-}
 function readStringExternalId(value) {
 	if (typeof value === "string" && value.length > 0) return value;
 	return null;
@@ -2985,9 +3367,7 @@ async function resolveOrganizationDirectorySyncUser(input, context) {
 	const externalId = readExternalId(input, pairing);
 	if (!externalId) return GENERIC_REJECTION;
 	try {
-		const catalog = await loadSCIMCatalog();
-		if (typeof catalog.acquireActiveSCIMUserLink !== "function") return GENERIC_REJECTION;
-		const link = await catalog.acquireActiveSCIMUserLink({
+		const link = await acquireActiveSCIMUserLink({
 			connectionId: directory.connectionId,
 			externalId
 		}, { database: context.database });
@@ -3911,6 +4291,7 @@ const getConfig = (options) => {
 				disableCSRFCheck: ctx.context.options.advanced?.disableCSRFCheck || false,
 				disableOriginCheck: ctx.context.options.advanced?.disableOriginCheck || false,
 				allowDifferentEmails: ctx.context.options.account?.accountLinking?.enabled && ctx.context.options.account?.accountLinking?.allowDifferentEmails || false,
+				identityStrategy: getConfiguredAccountIdentityStrategy(ctx.context.options.account),
 				skipStateCookieCheck: ctx.context.options.account?.skipStateCookieCheck || false,
 				storeStateCookieStrategy: ctx.context.options.account?.storeStateStrategy || null,
 				cookieCache: {
@@ -4336,14 +4717,6 @@ async function recoverManagedDirectoryConnection(ctx, row, input, policy) {
 async function createManagedDirectoryConnection(ctx, input, policy) {
 	await assertManagedDirectoryTransactionsConfigured(ctx);
 	if (input.pairing) await assertDirectorySyncSSOIntegrationConfigured(ctx);
-	if (input.pairing?.protocol === "saml") try {
-		await loadSAMLPolicy();
-	} catch {
-		throw ctx.error("NOT_IMPLEMENTED", {
-			code: "DIRECTORY_SYNC_SAML_POLICY_UNAVAILABLE",
-			message: "SAML pairing requires a compatible SSO package with service provider metadata policy support"
-		});
-	}
 	const aliasKey = await createAliasKey(input.organizationId, input.providerId);
 	const provisioningDomainId = await createProvisioningDomainId(input.organizationId, input.providerId);
 	const activeOrganizationKey = await createActiveOrganizationKey(input.organizationId);
@@ -10488,18 +10861,7 @@ const dash = (options) => {
 		},
 		hooks: {
 			before: [{
-				matcher: (ctx) => {
-					if (ctx.request?.method !== "GET") return true;
-					return matchesAnyRoute(ctx.path, [
-						routes.SIGN_IN_SOCIAL_CALLBACK,
-						routes.SIGN_IN_OAUTH_CALLBACK,
-						routes.DASH_IMPERSONATE_USER,
-						routes.VERIFY_EMAIL,
-						routes.MAGIC_LINK_VERIFY,
-						routes.DASH_ACCEPT_INVITATION,
-						routes.DASH_COMPLETE_INVITATION_SOCIAL
-					]);
-				},
+				matcher: (ctx) => shouldRunIdentification(ctx, IDENTIFICATION_GET_ROUTES),
 				handler: createIdentificationMiddleware($kv, {
 					skipIdentification: (ctx) => isDashRoute(ctx.path),
 					retry: opts.kvOptions.retry
@@ -10532,19 +10894,12 @@ const dash = (options) => {
 						if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger, ctx.context.location);
 						if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger, ctx.context.location);
 						if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]) && ctx.request?.method === "GET" && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger, ctx.context.location);
-						const headerRequestId = ctx.request?.headers.get("X-Request-Id");
-						if (headerRequestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
-							maxAge: 600,
-							sameSite: "lax",
-							httpOnly: true,
-							path: "/"
-						});
-						else if (ctx.context.requestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, "", {
-							maxAge: 0,
-							path: "/"
-						});
 					})
 				},
+				{
+					matcher: (ctx) => shouldRunIdentification(ctx, IDENTIFICATION_GET_ROUTES),
+					handler: createIdentificationCookieAfterMiddleware()
+				},
 				{
 					handler: createAuthMiddleware(async (ctx) => {
 						if (!opts.activityTracking?.enabled) return;

package/dist/native.mjs

@@ -1,5 +1,5 @@
-import { o as createKV, t as bytesToHex } from "./crypto-CV91nSbp.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-7sPi32Ow.mjs";
+import { o as createKV, t as bytesToHex } from "./crypto-D3yZH0Cy.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-jWGI__oh.mjs";
 import { env } from "@better-auth/core/env";
 import { Dimensions, InteractionManager, PixelRatio, Platform } from "react-native";
 //#region src/sentinel/native/components.ts

package/dist/{pow-retry-7sPi32Ow.mjs → pow-retry-jWGI__oh.mjs}

@@ -1,4 +1,4 @@
-import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-CV91nSbp.mjs";
+import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-D3yZH0Cy.mjs";
 //#region src/dash-client.ts
 function resolveDashUserId(input, options) {
 	return input.userId || options?.resolveUserId?.({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
@@ -70,7 +70,7 @@
     "@types/bun": "latest",
     "@types/node": "^24.12.0",
     "better-auth": "1.7.0-rc.1",
-    "expo-crypto": "^14.0.2",
+    "expo-crypto": "^57.0.1",
     "happy-dom": "^20.9.0",
     "msw": "^2.14.6",
     "tsdown": "^0.22.14",
@@ -81,9 +81,10 @@
     "@better-auth/utils": "^0.4.2",
     "@better-fetch/fetch": "1.3.1",
     "@noble/hashes": "^2.2.0",
+    "@xmldom/xmldom": "^0.9.10",
     "better-call": "1.3.7",
     "jose": "^6.2.4",
-    "libphonenumber-js": "^1.13.9"
+    "libphonenumber-js": "^1.13.11"
   },
   "peerDependencies": {
     "better-auth": ">=1.4.0",

package/dist/saml-policy-DQR0MBLk.mjs

@@ -1,12 +0,0 @@
-//#region src/directory-sync/saml-policy.ts
-/**
-* `deriveSAMLServiceProviderPolicy` ships in `@better-auth/sso` 1.7.0+.
-* Load it at runtime so typecheck against older matrix versions still succeeds.
-*/
-async function requiresSignedSAMLAssertions(config) {
-	const sso = await import("@better-auth/sso");
-	if (typeof sso.deriveSAMLServiceProviderPolicy === "function") return sso.deriveSAMLServiceProviderPolicy(config).wantAssertionsSigned;
-	return config.wantAssertionsSigned === true;
-}
-//#endregion
-export { requiresSignedSAMLAssertions };