@better-auth/infra 0.4.2 → 0.4.3

package/CHANGELOG.md

@@ -5,8 +5,15 @@ All notable changes to `@better-auth/infra` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.3] - 2026-08-25
+
+### Added
+
+- **SAML `wantAssertionsSigned`** — Dash SSO create/update accept and persist `samlConfig.wantAssertionsSigned` (default `true`). Required for directory sync SAML pairing; can be disabled only when the IdP cannot sign assertions.
+
 ## [0.4.2] - 2026-08-21
 
+
 ### Fixed
 
 - **Identification on OAuth callbacks** — Sentinel and dash run identification on GET OAuth callback routes and persist `X-Request-Id` as the `__infra-rid` cookie in an after hook, so visitor identity resolves from KV across redirect-based social/OAuth sign-in (where identify headers are absent).

package/dist/client.mjs

@@ -1,5 +1,5 @@
-import { n as hash, o as createKV } from "./crypto-D3yZH0Cy.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-jWGI__oh.mjs";
+import { n as hash, o as createKV } from "./crypto-SmxL66Tk.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, s as generateRequestId, t as createPowRetryTimeout } from "./pow-retry-BWDJUT8X.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts
 function murmurhash3(str, seed = 0) {

package/dist/{constants-CDhjfr8S.mjs → constants-CA5EAv5K.mjs}

@@ -1,7 +1,7 @@
 import { env } from "@better-auth/core/env";
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.4.2";
+const PLUGIN_VERSION = "0.4.3";
 //#endregion
 //#region src/constants.ts
 /**

package/dist/{crypto-D3yZH0Cy.mjs → crypto-SmxL66Tk.mjs}

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT } from "./constants-CDhjfr8S.mjs";
+import { i as INFRA_USER_AGENT } from "./constants-CA5EAv5K.mjs";
 import { createFetch } from "@better-fetch/fetch";
 import { sha256 } from "@noble/hashes/sha2.js";
 //#region src/fetch.ts

package/dist/email.mjs

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CDhjfr8S.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CA5EAv5K.mjs";
 import { logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { createFetch } from "@better-fetch/fetch";

package/dist/index.d.mts

@@ -1157,6 +1157,7 @@ declare const dash: <O extends DashOptions>(options?: O) => {
           entryPoint: import("zod").ZodOptional<import("zod").ZodString>;
           cert: import("zod").ZodOptional<import("zod").ZodString>;
           entityId: import("zod").ZodOptional<import("zod").ZodString>;
+          wantAssertionsSigned: import("zod").ZodOptional<import("zod").ZodBoolean>;
           mapping: import("zod").ZodOptional<import("zod").ZodObject<{
             id: import("zod").ZodOptional<import("zod").ZodString>;
             email: import("zod").ZodOptional<import("zod").ZodString>;
@@ -1214,6 +1215,7 @@ declare const dash: <O extends DashOptions>(options?: O) => {
           entryPoint: import("zod").ZodOptional<import("zod").ZodString>;
           cert: import("zod").ZodOptional<import("zod").ZodString>;
           entityId: import("zod").ZodOptional<import("zod").ZodString>;
+          wantAssertionsSigned: import("zod").ZodOptional<import("zod").ZodBoolean>;
           mapping: import("zod").ZodOptional<import("zod").ZodObject<{
             id: import("zod").ZodOptional<import("zod").ZodString>;
             email: import("zod").ZodOptional<import("zod").ZodString>;

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CDhjfr8S.mjs";
-import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-D3yZH0Cy.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CA5EAv5K.mjs";
+import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-SmxL66Tk.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAdapter, getCurrentAuthContext, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
@@ -8236,6 +8236,7 @@ const samlConfigSchema = z.object({
 	entryPoint: z.string().optional(),
 	cert: z.string().optional(),
 	entityId: z.string().optional(),
+	wantAssertionsSigned: z.boolean().optional(),
 	mapping: z.object({
 		/** @deprecated Removed in better-auth 1.7+; SAML subject is NameID. */
 		id: z.string().optional(),
@@ -8304,6 +8305,7 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 		config: {
 			issuer: ba17OrLater && !idpMetadataXml ? spIssuer : samlConfig.entityId ?? spIssuer,
 			idpMetadata,
+			wantAssertionsSigned: samlConfig.wantAssertionsSigned ?? true,
 			...saml17OrNewer ? {
 				entryPoint: resolvedEntryPoint,
 				...samlConfig.cert ? { cert: samlConfig.cert } : {}

package/dist/native.mjs

@@ -1,5 +1,5 @@
-import { o as createKV, t as bytesToHex } from "./crypto-D3yZH0Cy.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-jWGI__oh.mjs";
+import { o as createKV, t as bytesToHex } from "./crypto-SmxL66Tk.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as identify, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as resolveIdentifyClientRetry, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-BWDJUT8X.mjs";
 import { env } from "@better-auth/core/env";
 import { Dimensions, InteractionManager, PixelRatio, Platform } from "react-native";
 //#region src/sentinel/native/components.ts

package/dist/{pow-retry-jWGI__oh.mjs → pow-retry-BWDJUT8X.mjs}

@@ -1,4 +1,4 @@
-import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-D3yZH0Cy.mjs";
+import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-SmxL66Tk.mjs";
 //#region src/dash-client.ts
 function resolveDashUserId(input, options) {
 	return input.userId || options?.resolveUserId?.({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
@@ -83,7 +83,7 @@
     "@noble/hashes": "^2.2.0",
     "@xmldom/xmldom": "^0.9.10",
     "better-call": "1.3.7",
-    "jose": "^6.2.4",
+    "jose": "^6.2.9",
     "libphonenumber-js": "^1.13.11"
   },
   "peerDependencies": {