better-auth 1.8.0-beta.9 on Node.js NPM

Important

Action required

If your SAML IdP sends no email attribute and a NameID in another Format or with no Format, send an email attribute or the emailAddress NameID Format, set samlConfig.mapping.email to the attribute it sends, or return the NameID from mapProfileToUser. (#12484)
If you use the OAuth provider, run npx auth@latest migrate or npx auth@latest generate before upgrading to add the new optional act column on oauthAccessToken; if you set act via customAccessTokenClaims, an extension claims.accessToken contributor, or a resource's customClaims, it is now stripped, so pass act to issueTokens in custom grants instead. (#12439)
If your clientAuthentication strategy returns a DPoP key (jkt), the token type is now DPoP, so make your clients send a DPoP proof with each request to a protected resource. (#12440)
If you have a custom OAuthProviderApi implementation, add the verifyDpopProof() and issueDpopNonce() methods. (#12437)
If your clients exchange their own access tokens bound by a mechanism other than DPoP, such as an mTLS certificate in cnf["x5t#S256"], have your clientAuthentication strategy return the same confirmation. (#12438)

`@better-auth/oauth-provider`

Added RFC 8693 delegation to oauthTokenExchange(), so a service can exchange tokens with an actor_token and get an act claim (#12439)

Added an expectedJkt option to provider.resolveConfirmation() so extension grants can keep a DPoP-bound token bound to the same key (#12436)
Added verifyDpopProof() and issueDpopNonce() to getOAuthProviderApi so plugin endpoints can verify DPoP proofs and nonces (#12437)

Fixed client_credentials tokens to be bound to the confirmation returned by a clientAuthentication strategy, such as an mTLS certificate thumbprint (#12440)
Fixed the OAuth provider to reject a malformed sender-constraint confirmation with server_error instead of issuing a token (#12443)
Fixed oauthTokenExchange() to require a matching confirmation when a client exchanges its own access token bound by a mechanism other than DPoP (#12438)

For detailed changes, see CHANGELOG

Added a mapProfileToUser option so OIDC and SAML SSO providers that send no email can still sign users in (#12484)
Changed SAML sign-in to use the NameID as the user's email only when its Format is the emailAddress format (#12484)
Fixed SAML users who sign in without a name attribute to get their email as their name instead of an opaque NameID (#12484)

For detailed changes, see CHANGELOG

Thanks to everyone who contributed to this release:

Full changelog: v1.8.0-beta.8...v1.8.0-beta.9