@better-auth/electron 1.6.15 → 1.6.16

package/dist/{client-D6xRwPM0.d.mts → client-hpd3q6M8.d.mts}

@@ -323,11 +323,6 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
       mode?: RequestMode | undefined;
       cache?: RequestCache | undefined;
       credentials?: RequestCredentials | undefined;
-      headers?: (HeadersInit & (HeadersInit | {
-        accept: "application/json" | "text/plain" | "application/octet-stream";
-        "content-type": "application/json" | "text/plain" | "application/x-www-form-urlencoded" | "multipart/form-data" | "application/octet-stream";
-        authorization: "Bearer" | "Basic";
-      })) | undefined;
       integrity?: string | undefined;
       keepalive?: boolean | undefined;
       method?: string | undefined;
@@ -361,6 +356,12 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
         prefix: string | (() => string | undefined) | undefined;
         value: string | (() => string | undefined) | undefined;
       }) | undefined;
+      headers?: {} | {
+        [x: string]: string | undefined;
+        accept?: ((string & {}) | "application/json" | "text/plain" | "application/octet-stream") | undefined;
+        "content-type"?: ((string & {}) | "application/x-www-form-urlencoded" | "application/json" | "text/plain" | "multipart/form-data" | "application/octet-stream") | undefined;
+        authorization?: ((string & {}) | `Bearer ${string}` | `Basic ${string}`) | undefined;
+      } | undefined;
       body?: any;
       query?: any;
       params?: any;
@@ -378,11 +379,6 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
         mode?: RequestMode | undefined;
         cache?: RequestCache | undefined;
         credentials?: RequestCredentials | undefined;
-        headers?: (HeadersInit & (HeadersInit | {
-          accept: "application/json" | "text/plain" | "application/octet-stream";
-          "content-type": "application/json" | "text/plain" | "application/x-www-form-urlencoded" | "multipart/form-data" | "application/octet-stream";
-          authorization: "Bearer" | "Basic";
-        })) | undefined;
         integrity?: string | undefined;
         keepalive?: boolean | undefined;
         method?: string | undefined;
@@ -416,6 +412,12 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
           prefix: string | (() => string | undefined) | undefined;
           value: string | (() => string | undefined) | undefined;
         }) | undefined;
+        headers?: {} | {
+          [x: string]: string | undefined;
+          accept?: ((string & {}) | "application/json" | "text/plain" | "application/octet-stream") | undefined;
+          "content-type"?: ((string & {}) | "application/x-www-form-urlencoded" | "application/json" | "text/plain" | "multipart/form-data" | "application/octet-stream") | undefined;
+          authorization?: ((string & {}) | `Bearer ${string}` | `Basic ${string}`) | undefined;
+        } | undefined;
         body?: any;
         query?: any;
         params?: any;

package/dist/client.d.mts

@@ -1,2 +1,2 @@
-import { _ as setupRenderer, a as authenticate, c as ElectronClientOptions, d as Storage, f as FetchUserImageResult, g as SetupRendererConfig, h as ExposedBridges, i as ElectronRequestAuthOptions, l as ElectronProxyClientOptions, m as normalizeUserOutput, n as handleDeepLink, o as kElectron, p as fetchUserImage, r as ElectronAuthenticateOptions, s as requestAuth, t as electronClient, u as ElectronSharedClientOptions, y as ElectronSharedOptions } from "./client-D6xRwPM0.mjs";
+import { _ as setupRenderer, a as authenticate, c as ElectronClientOptions, d as Storage, f as FetchUserImageResult, g as SetupRendererConfig, h as ExposedBridges, i as ElectronRequestAuthOptions, l as ElectronProxyClientOptions, m as normalizeUserOutput, n as handleDeepLink, o as kElectron, p as fetchUserImage, r as ElectronAuthenticateOptions, s as requestAuth, t as electronClient, u as ElectronSharedClientOptions, y as ElectronSharedOptions } from "./client-hpd3q6M8.mjs";
 export { ElectronAuthenticateOptions, ElectronClientOptions, ElectronProxyClientOptions, ElectronRequestAuthOptions, ElectronSharedClientOptions, ElectronSharedOptions, ExposedBridges, FetchUserImageResult, SetupRendererConfig, Storage, authenticate, electronClient, fetchUserImage, handleDeepLink, kElectron, normalizeUserOutput, requestAuth, setupRenderer };

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BPpah8cV.mjs";
+import { t as PACKAGE_VERSION } from "./version-KncHedVM.mjs";
 import { n as isProcessType, r as parseProtocolScheme, t as getChannelPrefixWithDelimiter } from "./utils-DxDKRT6e.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { base64, base64Url } from "@better-auth/utils/base64";

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { f as FetchUserImageResult, m as normalizeUserOutput, p as fetchUserImage, v as ElectronOptions, y as ElectronSharedOptions } from "./client-D6xRwPM0.mjs";
+import { f as FetchUserImageResult, m as normalizeUserOutput, p as fetchUserImage, v as ElectronOptions, y as ElectronSharedOptions } from "./client-hpd3q6M8.mjs";
 import * as better_auth0 from "better-auth";
 import * as z from "zod";
 import * as _better_auth_core0 from "@better-auth/core";
@@ -336,6 +336,7 @@ declare const electron: (options?: ElectronOptions | undefined) => {
     INVALID_CODE_VERIFIER: better_auth0.RawError<"INVALID_CODE_VERIFIER">;
     MISSING_STATE: better_auth0.RawError<"MISSING_STATE">;
     MISSING_PKCE: better_auth0.RawError<"MISSING_PKCE">;
+    INVALID_PKCE_METHOD: better_auth0.RawError<"INVALID_PKCE_METHOD">;
   };
 };
 //#endregion

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BPpah8cV.mjs";
+import { t as PACKAGE_VERSION } from "./version-KncHedVM.mjs";
 import { createAuthMiddleware } from "@better-auth/core/api";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { base64Url } from "@better-auth/utils/base64";
@@ -22,7 +22,8 @@ const ELECTRON_ERROR_CODES = defineErrorCodes({
 	MISSING_CODE_CHALLENGE: "missing code challenge",
 	INVALID_CODE_VERIFIER: "Invalid code verifier",
 	MISSING_STATE: "state is required",
-	MISSING_PKCE: "pkce is required"
+	MISSING_PKCE: "pkce is required",
+	INVALID_PKCE_METHOD: "PKCE method must be S256"
 });
 //#endregion
 //#region src/routes.ts
@@ -62,11 +63,10 @@ const electronToken = (_opts) => createAuthEndpoint("/electron/token", {
 	if (!tokenRecord) throw APIError.from("INTERNAL_SERVER_ERROR", ELECTRON_ERROR_CODES.INVALID_TOKEN);
 	if (tokenRecord.state !== ctx.body.state) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.STATE_MISMATCH);
 	if (!tokenRecord.codeChallenge) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.MISSING_CODE_CHALLENGE);
-	if (tokenRecord.codeChallengeMethod === "s256") {
-		const codeChallenge = Buffer.from(base64Url.decode(tokenRecord.codeChallenge));
-		const codeVerifier = Buffer.from(await createHash("SHA-256").digest(ctx.body.code_verifier));
-		if (codeChallenge.length !== codeVerifier.length || !timingSafeEqual(codeChallenge, codeVerifier)) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_CODE_VERIFIER);
-	} else if (tokenRecord.codeChallenge !== ctx.body.code_verifier) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_CODE_VERIFIER);
+	if (tokenRecord.codeChallengeMethod !== "s256") throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_PKCE_METHOD);
+	const codeChallenge = Buffer.from(base64Url.decode(tokenRecord.codeChallenge));
+	const codeVerifier = Buffer.from(await createHash("SHA-256").digest(ctx.body.code_verifier));
+	if (codeChallenge.length !== codeVerifier.length || !timingSafeEqual(codeChallenge, codeVerifier)) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_CODE_VERIFIER);
 	await ctx.context.internalAdapter.deleteVerificationByIdentifier(`electron:${ctx.body.token}`);
 	const user = await ctx.context.internalAdapter.findUserById(tokenRecord.userId);
 	if (!user) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.USER_NOT_FOUND);
@@ -119,13 +119,14 @@ const electronInitOAuthProxy = (opts) => createAuthEndpoint("/electron/init-oaut
 }, async (ctx) => {
 	const isSocialProvider = SocialProviderListEnum.safeParse(ctx.query.provider);
 	if (!isSocialProvider && !ctx.context.getPlugin("generic-oauth")) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PROVIDER_NOT_FOUND);
+	if (ctx.query.code_challenge_method && ctx.query.code_challenge_method.toLowerCase() !== "s256") throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_PKCE_METHOD);
 	const headers = new Headers(ctx.request?.headers);
 	headers.set("origin", new URL(ctx.context.baseURL).origin);
 	let setCookie = null;
 	const searchParams = new URLSearchParams();
 	searchParams.set("client_id", opts.clientID || "electron");
 	searchParams.set("code_challenge", ctx.query.code_challenge);
-	searchParams.set("code_challenge_method", ctx.query.code_challenge_method || "plain");
+	searchParams.set("code_challenge_method", "S256");
 	searchParams.set("state", ctx.query.state);
 	const res = await betterFetch(`${isSocialProvider ? "/sign-in/social" : "/sign-in/oauth2"}?${searchParams.toString()}`, {
 		baseURL: ctx.context.baseURL,
@@ -204,11 +205,12 @@ const electron = (options) => {
 		return !!(ctx.path?.startsWith("/sign-in") || ctx.path?.startsWith("/sign-up") || ctx.path?.startsWith("/callback") || ctx.path?.startsWith("/oauth2/callback") || ctx.path?.startsWith("/magic-link/verify") || ctx.path?.startsWith("/email-otp/verify-email") || ctx.path?.startsWith("/verify-email") || ctx.path?.startsWith("/one-tap/callback") || ctx.path?.startsWith("/passkey/verify-authentication") || ctx.path?.startsWith("/phone-number/verify"));
 	};
 	const handleTransfer = async (ctx, payload) => {
-		const { client_id, state, code_challenge, code_challenge_method = "plain" } = payload;
+		const { client_id, state, code_challenge, code_challenge_method } = payload;
 		const userId = ctx.context.session?.user.id || ctx.context.newSession?.user.id;
 		if (!userId || client_id !== opts.clientID) return null;
 		if (!state) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.MISSING_STATE);
 		if (!code_challenge) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.MISSING_PKCE);
+		if (code_challenge_method?.toLowerCase() !== "s256") throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_PKCE_METHOD);
 		const redirectCookieName = `${opts.cookiePrefix}.${opts.clientID}`;
 		const identifier = generateRandomString(32, "a-z", "A-Z", "0-9");
 		const codeExpiresInMs = opts.codeExpiresIn * 1e3;
@@ -218,7 +220,7 @@ const electron = (options) => {
 			value: JSON.stringify({
 				userId,
 				codeChallenge: code_challenge,
-				codeChallengeMethod: code_challenge_method.toLowerCase(),
+				codeChallengeMethod: "s256",
 				state
 			}),
 			expiresAt
@@ -259,7 +261,7 @@ const electron = (options) => {
 				const querySchema = z.object({
 					client_id: z.string(),
 					code_challenge: z.string().nonempty(),
-					code_challenge_method: z.string().optional().default("plain"),
+					code_challenge_method: z.string().optional(),
 					state: z.string().nonempty()
 				});
 				const cookie = ctx.context.createAuthCookie("transfer_token", { maxAge: opts.codeExpiresIn });

package/dist/preload.d.mts

@@ -1293,7 +1293,12 @@ interface GoogleOptions extends ProviderOptions<GoogleProfile> {
    */
   display?: ("page" | "popup" | "touch" | "wap") | undefined;
   /**
-   * The hosted domain of the user
+   * The hosted domain (Google Workspace) the user must belong to.
+   *
+   * This is sent to Google as the `hd` authorization hint and, when set, is
+   * also enforced against the `hd` claim of the returned id token/profile.
+   * Sign-in is rejected when the claim is missing or does not match, so this
+   * can be used to restrict sign-in to a Workspace domain.
    */
   hd?: string | undefined;
 }
@@ -3976,14 +3981,14 @@ type BaseAccount = z.infer<typeof accountSchema>;
  */
 type Account<DBOptions extends BetterAuthOptions["account"] = BetterAuthOptions["account"], Plugins extends BetterAuthOptions["plugins"] = BetterAuthOptions["plugins"]> = Prettify$1<BaseAccount & InferDBFieldsFromOptions<DBOptions> & InferDBFieldsFromPlugins<"account", Plugins>>; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/helper.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/helper.d.mts
 type Prettify<T> = { [K in keyof T]: T[K] } & {};
 type IsEmptyObject<T> = keyof T extends never ? true : false;
 type UnionToIntersection<Union> = (Union extends unknown ? (distributedUnion: Union) => void : never) extends ((mergedIntersection: infer Intersection) => void) ? Intersection & Union : never;
 type InferParamPath<Path> = Path extends `${infer _Start}:${infer Param}/${infer Rest}` ? { [K in Param | keyof InferParamPath<Rest>]: string } : Path extends `${infer _Start}:${infer Param}` ? { [K in Param]: string } : Path extends `${infer _Start}/${infer Rest}` ? InferParamPath<Rest> : {};
 type InferParamWildCard<Path> = Path extends `${infer _Start}/*:${infer Param}/${infer Rest}` | `${infer _Start}/**:${infer Param}/${infer Rest}` ? { [K in Param | keyof InferParamPath<Rest>]: string } : Path extends `${infer _Start}/*` ? { [K in "_"]: string } : Path extends `${infer _Start}/${infer Rest}` ? InferParamWildCard<Rest> : {}; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/standard-schema.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/standard-schema.d.mts
 //#region src/standard-schema.d.ts
 /** The Standard Schema interface. */
 interface StandardSchemaV1$1<Input = unknown, Output = Input> {
@@ -4041,7 +4046,7 @@ declare namespace StandardSchemaV1$1 {
   type InferOutput<Schema extends StandardSchemaV1$1> = NonNullable<Schema["~standard"]["types"]>["output"];
 } //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/error.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/error.d.mts
 declare const statusCodes: {
   OK: number;
   CREATED: number;
@@ -4119,7 +4124,7 @@ declare const APIError: new (status?: Status | "OK" | "CREATED" | "ACCEPTED" | "
   errorStack: string | undefined;
 }; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/cookies.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/cookies.d.mts
 //#region src/cookies.d.ts
 type CookiePrefixOptions = "host" | "secure";
 type CookieOptions = {
@@ -4209,7 +4214,7 @@ type CookieOptions = {
   prefix?: CookiePrefixOptions;
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/openapi.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/openapi.d.mts
 //#region src/openapi.d.ts
 type OpenAPISchemaType = "string" | "number" | "integer" | "boolean" | "array" | "object";
 interface OpenAPIParameter {
@@ -4231,7 +4236,7 @@ interface OpenAPIParameter {
   };
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/endpoint.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/endpoint.d.mts
 //#region src/endpoint.d.ts
 interface EndpointBaseOptions {
   /**
@@ -4552,6 +4557,22 @@ type EndpointContext<Path extends string, Options extends EndpointOptions, Conte
    * @returns - The cookie string
    */
   setSignedCookie: (key: string, value: string, secret: string, options?: CookieOptions) => Promise<string>;
+  /**
+   * Response headers
+   *
+   * The live `Headers` for the response being built in the current
+   * request. Read it to inspect what has already been queued, e.g. to
+   * avoid emitting a `Set-Cookie` twice or to check headers set by an
+   * earlier handler in the chain.
+   *
+   * @example
+   * ```ts
+   * const alreadySet = ctx.responseHeaders
+   *   .getSetCookie()
+   *   .some((c) => c.startsWith("session="));
+   * ```
+   */
+  responseHeaders: Headers;
   /**
    * JSON
    *
@@ -4594,7 +4615,7 @@ type Endpoint<Path extends string = string, Options extends EndpointOptions = En
   path: Path;
 }; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/middleware.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/middleware.d.mts
 //#region src/middleware.d.ts
 interface MiddlewareOptions extends Omit<EndpointOptions, "method"> {}
 type MiddlewareContext<Options extends MiddlewareOptions, Context = {}> = EndpointContext<string, Options & {
@@ -4701,7 +4722,7 @@ type Middleware<Options extends MiddlewareOptions = MiddlewareOptions, Handler e
   options: Options;
 }; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/context.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/context.d.mts
 //#region src/context.d.ts
 type HTTPMethod = "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
 type Method = HTTPMethod | "*";

package/dist/preload.mjs

@@ -1,5 +1,5 @@
 import electron, { contextBridge } from "electron";
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/error.mjs
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/error.mjs
 function isErrorStackTraceLimitWritable() {
 	const desc = Object.getOwnPropertyDescriptor(Error, "stackTraceLimit");
 	if (desc === void 0) return Object.isExtensible(Error);

package/dist/proxy.d.mts

@@ -1,4 +1,4 @@
-import { l as ElectronProxyClientOptions } from "./client-D6xRwPM0.mjs";
+import { l as ElectronProxyClientOptions } from "./client-hpd3q6M8.mjs";
 import { electron } from "./index.mjs";
 
 //#region src/proxy.d.ts

package/dist/proxy.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BPpah8cV.mjs";
+import { t as PACKAGE_VERSION } from "./version-KncHedVM.mjs";
 import { r as parseProtocolScheme } from "./utils-DxDKRT6e.mjs";
 import { parseCookies } from "better-auth/cookies";
 //#region src/proxy.ts

package/dist/storage.d.mts

@@ -1,4 +1,4 @@
-import { d as Storage } from "./client-D6xRwPM0.mjs";
+import { d as Storage } from "./client-hpd3q6M8.mjs";
 import { Options } from "conf";
 
 //#region src/storage.d.ts

package/dist/{version-BPpah8cV.mjs → version-KncHedVM.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.6.15";
+const PACKAGE_VERSION = "1.6.16";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/electron",
-  "version": "1.6.15",
+  "version": "1.6.16",
   "description": "Better Auth integration for Electron applications.",
   "type": "module",
   "license": "MIT",
@@ -80,17 +80,17 @@
     "better-sqlite3": "^12.6.2",
     "electron": "^41.2.2",
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.6.15",
-    "better-auth": "1.6.15"
+    "@better-auth/core": "1.6.16",
+    "better-auth": "1.6.16"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.1",
-    "@better-fetch/fetch": "1.1.21",
-    "better-call": "1.3.5",
+    "@better-fetch/fetch": "1.2.2",
+    "better-call": "1.3.6",
     "conf": "^15.0.2",
     "electron": ">=36.0.0",
-    "@better-auth/core": "^1.6.15",
-    "better-auth": "^1.6.15"
+    "@better-auth/core": "^1.6.16",
+    "better-auth": "^1.6.16"
   },
   "peerDependenciesMeta": {
     "electron": {