@better-auth/electron 1.6.15 → 1.6.17

package/dist/{client-D6xRwPM0.d.mts → client-hpd3q6M8.d.mts}

@@ -323,11 +323,6 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
       mode?: RequestMode | undefined;
       cache?: RequestCache | undefined;
       credentials?: RequestCredentials | undefined;
-      headers?: (HeadersInit & (HeadersInit | {
-        accept: "application/json" | "text/plain" | "application/octet-stream";
-        "content-type": "application/json" | "text/plain" | "application/x-www-form-urlencoded" | "multipart/form-data" | "application/octet-stream";
-        authorization: "Bearer" | "Basic";
-      })) | undefined;
       integrity?: string | undefined;
       keepalive?: boolean | undefined;
       method?: string | undefined;
@@ -361,6 +356,12 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
         prefix: string | (() => string | undefined) | undefined;
         value: string | (() => string | undefined) | undefined;
       }) | undefined;
+      headers?: {} | {
+        [x: string]: string | undefined;
+        accept?: ((string & {}) | "application/json" | "text/plain" | "application/octet-stream") | undefined;
+        "content-type"?: ((string & {}) | "application/x-www-form-urlencoded" | "application/json" | "text/plain" | "multipart/form-data" | "application/octet-stream") | undefined;
+        authorization?: ((string & {}) | `Bearer ${string}` | `Basic ${string}`) | undefined;
+      } | undefined;
       body?: any;
       query?: any;
       params?: any;
@@ -378,11 +379,6 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
         mode?: RequestMode | undefined;
         cache?: RequestCache | undefined;
         credentials?: RequestCredentials | undefined;
-        headers?: (HeadersInit & (HeadersInit | {
-          accept: "application/json" | "text/plain" | "application/octet-stream";
-          "content-type": "application/json" | "text/plain" | "application/x-www-form-urlencoded" | "multipart/form-data" | "application/octet-stream";
-          authorization: "Bearer" | "Basic";
-        })) | undefined;
         integrity?: string | undefined;
         keepalive?: boolean | undefined;
         method?: string | undefined;
@@ -416,6 +412,12 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
           prefix: string | (() => string | undefined) | undefined;
           value: string | (() => string | undefined) | undefined;
         }) | undefined;
+        headers?: {} | {
+          [x: string]: string | undefined;
+          accept?: ((string & {}) | "application/json" | "text/plain" | "application/octet-stream") | undefined;
+          "content-type"?: ((string & {}) | "application/x-www-form-urlencoded" | "application/json" | "text/plain" | "multipart/form-data" | "application/octet-stream") | undefined;
+          authorization?: ((string & {}) | `Bearer ${string}` | `Basic ${string}`) | undefined;
+        } | undefined;
         body?: any;
         query?: any;
         params?: any;

package/dist/client.d.mts

@@ -1,2 +1,2 @@
-import { _ as setupRenderer, a as authenticate, c as ElectronClientOptions, d as Storage, f as FetchUserImageResult, g as SetupRendererConfig, h as ExposedBridges, i as ElectronRequestAuthOptions, l as ElectronProxyClientOptions, m as normalizeUserOutput, n as handleDeepLink, o as kElectron, p as fetchUserImage, r as ElectronAuthenticateOptions, s as requestAuth, t as electronClient, u as ElectronSharedClientOptions, y as ElectronSharedOptions } from "./client-D6xRwPM0.mjs";
+import { _ as setupRenderer, a as authenticate, c as ElectronClientOptions, d as Storage, f as FetchUserImageResult, g as SetupRendererConfig, h as ExposedBridges, i as ElectronRequestAuthOptions, l as ElectronProxyClientOptions, m as normalizeUserOutput, n as handleDeepLink, o as kElectron, p as fetchUserImage, r as ElectronAuthenticateOptions, s as requestAuth, t as electronClient, u as ElectronSharedClientOptions, y as ElectronSharedOptions } from "./client-hpd3q6M8.mjs";
 export { ElectronAuthenticateOptions, ElectronClientOptions, ElectronProxyClientOptions, ElectronRequestAuthOptions, ElectronSharedClientOptions, ElectronSharedOptions, ExposedBridges, FetchUserImageResult, SetupRendererConfig, Storage, authenticate, electronClient, fetchUserImage, handleDeepLink, kElectron, normalizeUserOutput, requestAuth, setupRenderer };

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BPpah8cV.mjs";
+import { t as PACKAGE_VERSION } from "./version-BeZU0Td6.mjs";
 import { n as isProcessType, r as parseProtocolScheme, t as getChannelPrefixWithDelimiter } from "./utils-DxDKRT6e.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { base64, base64Url } from "@better-auth/utils/base64";
@@ -579,6 +579,16 @@ const electronClient = (options) => {
 	const cookieName = `${opts.storagePrefix}.cookie`;
 	const localCacheName = `${opts.storagePrefix}.local_cache`;
 	const { getDecrypted, setEncrypted } = storageAdapter(opts.storage, new Set([cookieName, localCacheName]));
+	const clearSessionCache = () => {
+		setEncrypted(cookieName, "{}");
+		store?.atoms.session?.set({
+			...store.atoms.session.get(),
+			data: null,
+			error: null,
+			isPending: false
+		});
+		setEncrypted(localCacheName, "{}");
+	};
 	if ((isDevelopment() || isTest()) && /^(?!\.)(?!.*\.\.)(?!.*\.$)[^.]+\.[^.]+$/.test(scheme)) console.warn("The provided scheme does not follow the reverse domain name notation. For example: `app.example.com` -> `com.example.app`.");
 	return {
 		id: "electron",
@@ -598,16 +608,7 @@ const electronClient = (options) => {
 					"electron-origin": `${scheme}:/`,
 					"x-skip-oauth-proxy": "true"
 				};
-				if (url.endsWith("/sign-out")) {
-					setEncrypted(cookieName, "{}");
-					store?.atoms.session?.set({
-						...store.atoms.session.get(),
-						data: null,
-						error: null,
-						isPending: false
-					});
-					setEncrypted(localCacheName, "{}");
-				}
+				if (url.endsWith("/sign-out")) clearSessionCache();
 				return {
 					url,
 					options
@@ -630,6 +631,7 @@ const electronClient = (options) => {
 						const data = context.data;
 						setEncrypted(localCacheName, JSON.stringify(data));
 					}
+					if (context.request.url.toString().includes("/sign-out")) clearSessionCache();
 				},
 				onError: async (context) => {
 					webContents.getFocusedWebContents()?.send(`${getChannelPrefixWithDelimiter(opts.channelPrefix)}error`, {

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { f as FetchUserImageResult, m as normalizeUserOutput, p as fetchUserImage, v as ElectronOptions, y as ElectronSharedOptions } from "./client-D6xRwPM0.mjs";
+import { f as FetchUserImageResult, m as normalizeUserOutput, p as fetchUserImage, v as ElectronOptions, y as ElectronSharedOptions } from "./client-hpd3q6M8.mjs";
 import * as better_auth0 from "better-auth";
 import * as z from "zod";
 import * as _better_auth_core0 from "@better-auth/core";
@@ -336,6 +336,7 @@ declare const electron: (options?: ElectronOptions | undefined) => {
     INVALID_CODE_VERIFIER: better_auth0.RawError<"INVALID_CODE_VERIFIER">;
     MISSING_STATE: better_auth0.RawError<"MISSING_STATE">;
     MISSING_PKCE: better_auth0.RawError<"MISSING_PKCE">;
+    INVALID_PKCE_METHOD: better_auth0.RawError<"INVALID_PKCE_METHOD">;
   };
 };
 //#endregion

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BPpah8cV.mjs";
+import { t as PACKAGE_VERSION } from "./version-BeZU0Td6.mjs";
 import { createAuthMiddleware } from "@better-auth/core/api";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { base64Url } from "@better-auth/utils/base64";
@@ -22,7 +22,8 @@ const ELECTRON_ERROR_CODES = defineErrorCodes({
 	MISSING_CODE_CHALLENGE: "missing code challenge",
 	INVALID_CODE_VERIFIER: "Invalid code verifier",
 	MISSING_STATE: "state is required",
-	MISSING_PKCE: "pkce is required"
+	MISSING_PKCE: "pkce is required",
+	INVALID_PKCE_METHOD: "PKCE method must be S256"
 });
 //#endregion
 //#region src/routes.ts
@@ -56,18 +57,16 @@ const electronToken = (_opts) => createAuthEndpoint("/electron/token", {
 		}
 	}
 }, async (ctx) => {
-	const token = await ctx.context.internalAdapter.findVerificationValue(`electron:${ctx.body.token}`);
-	if (!token || token.expiresAt < /* @__PURE__ */ new Date()) throw APIError.from("NOT_FOUND", ELECTRON_ERROR_CODES.INVALID_TOKEN);
+	const token = await ctx.context.internalAdapter.consumeVerificationValue(`electron:${ctx.body.token}`);
+	if (!token) throw APIError.from("NOT_FOUND", ELECTRON_ERROR_CODES.INVALID_TOKEN);
 	const tokenRecord = safeJSONParse$1(token.value);
 	if (!tokenRecord) throw APIError.from("INTERNAL_SERVER_ERROR", ELECTRON_ERROR_CODES.INVALID_TOKEN);
 	if (tokenRecord.state !== ctx.body.state) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.STATE_MISMATCH);
 	if (!tokenRecord.codeChallenge) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.MISSING_CODE_CHALLENGE);
-	if (tokenRecord.codeChallengeMethod === "s256") {
-		const codeChallenge = Buffer.from(base64Url.decode(tokenRecord.codeChallenge));
-		const codeVerifier = Buffer.from(await createHash("SHA-256").digest(ctx.body.code_verifier));
-		if (codeChallenge.length !== codeVerifier.length || !timingSafeEqual(codeChallenge, codeVerifier)) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_CODE_VERIFIER);
-	} else if (tokenRecord.codeChallenge !== ctx.body.code_verifier) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_CODE_VERIFIER);
-	await ctx.context.internalAdapter.deleteVerificationByIdentifier(`electron:${ctx.body.token}`);
+	if (tokenRecord.codeChallengeMethod !== "s256") throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_PKCE_METHOD);
+	const codeChallenge = Buffer.from(base64Url.decode(tokenRecord.codeChallenge));
+	const codeVerifier = Buffer.from(await createHash("SHA-256").digest(ctx.body.code_verifier));
+	if (codeChallenge.length !== codeVerifier.length || !timingSafeEqual(codeChallenge, codeVerifier)) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_CODE_VERIFIER);
 	const user = await ctx.context.internalAdapter.findUserById(tokenRecord.userId);
 	if (!user) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const session = await ctx.context.internalAdapter.createSession(user.id);
@@ -119,13 +118,14 @@ const electronInitOAuthProxy = (opts) => createAuthEndpoint("/electron/init-oaut
 }, async (ctx) => {
 	const isSocialProvider = SocialProviderListEnum.safeParse(ctx.query.provider);
 	if (!isSocialProvider && !ctx.context.getPlugin("generic-oauth")) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PROVIDER_NOT_FOUND);
+	if (ctx.query.code_challenge_method && ctx.query.code_challenge_method.toLowerCase() !== "s256") throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_PKCE_METHOD);
 	const headers = new Headers(ctx.request?.headers);
 	headers.set("origin", new URL(ctx.context.baseURL).origin);
 	let setCookie = null;
 	const searchParams = new URLSearchParams();
 	searchParams.set("client_id", opts.clientID || "electron");
 	searchParams.set("code_challenge", ctx.query.code_challenge);
-	searchParams.set("code_challenge_method", ctx.query.code_challenge_method || "plain");
+	searchParams.set("code_challenge_method", "S256");
 	searchParams.set("state", ctx.query.state);
 	const res = await betterFetch(`${isSocialProvider ? "/sign-in/social" : "/sign-in/oauth2"}?${searchParams.toString()}`, {
 		baseURL: ctx.context.baseURL,
@@ -204,11 +204,12 @@ const electron = (options) => {
 		return !!(ctx.path?.startsWith("/sign-in") || ctx.path?.startsWith("/sign-up") || ctx.path?.startsWith("/callback") || ctx.path?.startsWith("/oauth2/callback") || ctx.path?.startsWith("/magic-link/verify") || ctx.path?.startsWith("/email-otp/verify-email") || ctx.path?.startsWith("/verify-email") || ctx.path?.startsWith("/one-tap/callback") || ctx.path?.startsWith("/passkey/verify-authentication") || ctx.path?.startsWith("/phone-number/verify"));
 	};
 	const handleTransfer = async (ctx, payload) => {
-		const { client_id, state, code_challenge, code_challenge_method = "plain" } = payload;
+		const { client_id, state, code_challenge, code_challenge_method } = payload;
 		const userId = ctx.context.session?.user.id || ctx.context.newSession?.user.id;
 		if (!userId || client_id !== opts.clientID) return null;
 		if (!state) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.MISSING_STATE);
 		if (!code_challenge) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.MISSING_PKCE);
+		if (code_challenge_method?.toLowerCase() !== "s256") throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_PKCE_METHOD);
 		const redirectCookieName = `${opts.cookiePrefix}.${opts.clientID}`;
 		const identifier = generateRandomString(32, "a-z", "A-Z", "0-9");
 		const codeExpiresInMs = opts.codeExpiresIn * 1e3;
@@ -218,7 +219,7 @@ const electron = (options) => {
 			value: JSON.stringify({
 				userId,
 				codeChallenge: code_challenge,
-				codeChallengeMethod: code_challenge_method.toLowerCase(),
+				codeChallengeMethod: "s256",
 				state
 			}),
 			expiresAt
@@ -259,7 +260,7 @@ const electron = (options) => {
 				const querySchema = z.object({
 					client_id: z.string(),
 					code_challenge: z.string().nonempty(),
-					code_challenge_method: z.string().optional().default("plain"),
+					code_challenge_method: z.string().optional(),
 					state: z.string().nonempty()
 				});
 				const cookie = ctx.context.createAuthCookie("transfer_token", { maxAge: opts.codeExpiresIn });

package/dist/preload.d.mts

@@ -31,6 +31,7 @@ type DBAdapterDebugLogOption = boolean | {
   delete?: boolean | undefined;
   deleteMany?: boolean | undefined;
   consumeOne?: boolean | undefined;
+  incrementOne?: boolean | undefined;
   count?: boolean | undefined;
 } | {
   /**
@@ -206,7 +207,7 @@ interface DBAdapterFactoryConfig<Options extends BetterAuthOptions = BetterAuthO
     /**
      * The action which was called from the adapter.
      */
-    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "consumeOne" | "count";
+    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "consumeOne" | "incrementOne" | "count";
     /**
      * The model name.
      */
@@ -444,6 +445,36 @@ type DBAdapter<Options extends BetterAuthOptions = BetterAuthOptions> = {
     model: string;
     where: Where[];
   }) => Promise<T | null>;
+  /**
+   * Atomically apply signed numeric deltas to a single row matching the where
+   * clause. For each entry in `increment`, the operation applies
+   * `field = field + delta` in one atomic step; a negative delta decrements.
+   *
+   * The `where` clause is both the selector AND the guard: comparison
+   * operators are honored, so passing `{ field: "remaining", operator: "gt",
+   * value: 0 }` only mutates the row while `remaining` is still above zero.
+   * When the guard matches no row, the operation makes no change and returns
+   * `null`.
+   *
+   * The optional `set` map assigns absolute values to fields in the same
+   * atomic operation, alongside the increments.
+   *
+   * Returns the updated row, or `null` when the guard matched no row. Under
+   * concurrent invocation against the same row, this is the race-safe
+   * primitive for guarded counter updates (e.g. decrementing a remaining-uses
+   * counter only while it is still positive).
+   *
+   * Always defined on the factory-wrapped adapter. When the underlying
+   * `CustomAdapter` does not implement `incrementOne`, the factory provides a
+   * fallback that wraps `findMany + updateMany` in `transaction(...)` and
+   * re-applies the where clause as a compare-and-swap guard on the update.
+   */
+  incrementOne: <T>(data: {
+    model: string;
+    where: Where[];
+    increment: Record<string, number>;
+    set?: Record<string, unknown> | undefined;
+  }) => Promise<T | null>;
   /**
    * Execute multiple operations in a transaction.
    * If the adapter doesn't support transactions, operations will be executed sequentially.
@@ -538,6 +569,25 @@ interface CustomAdapter {
     model: string;
     where: CleanedWhere[];
   }) => Promise<T | null>;
+  /**
+   * Optional native atomic guarded counter mutation. Applies
+   * `field = field + delta` for each entry in `increment` (negative deltas
+   * decrement), with `where` acting as both selector and guard and `set`
+   * assigning absolute values in the same operation. Returns the updated row,
+   * or `null` when the guard matched no row.
+   *
+   * Implementing this natively (e.g. `UPDATE ... SET n = n + $delta WHERE ...
+   * RETURNING *`) gives one round trip and the strongest race-safety
+   * guarantee. When omitted, the adapter factory provides a transaction-based
+   * fallback over `findMany + updateMany`. TODO(increment-one-required):
+   * tighten to required in the next minor on `next`.
+   */
+  incrementOne?: <T>(data: {
+    model: string;
+    where: CleanedWhere[];
+    increment: Record<string, number>;
+    set?: Record<string, unknown> | undefined;
+  }) => Promise<T | null>;
   count: ({
     model,
     where
@@ -1293,7 +1343,12 @@ interface GoogleOptions extends ProviderOptions<GoogleProfile> {
    */
   display?: ("page" | "popup" | "touch" | "wap") | undefined;
   /**
-   * The hosted domain of the user
+   * The hosted domain (Google Workspace) the user must belong to.
+   *
+   * This is sent to Google as the `hd` authorization hint and, when set, is
+   * also enforced against the `hd` claim of the returned id token/profile.
+   * Sign-in is rejected when the claim is missing or does not match, so this
+   * can be used to restrict sign-in to a Workspace domain.
    */
   hd?: string | undefined;
 }
@@ -3976,14 +4031,14 @@ type BaseAccount = z.infer<typeof accountSchema>;
  */
 type Account<DBOptions extends BetterAuthOptions["account"] = BetterAuthOptions["account"], Plugins extends BetterAuthOptions["plugins"] = BetterAuthOptions["plugins"]> = Prettify$1<BaseAccount & InferDBFieldsFromOptions<DBOptions> & InferDBFieldsFromPlugins<"account", Plugins>>; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/helper.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/helper.d.mts
 type Prettify<T> = { [K in keyof T]: T[K] } & {};
 type IsEmptyObject<T> = keyof T extends never ? true : false;
 type UnionToIntersection<Union> = (Union extends unknown ? (distributedUnion: Union) => void : never) extends ((mergedIntersection: infer Intersection) => void) ? Intersection & Union : never;
 type InferParamPath<Path> = Path extends `${infer _Start}:${infer Param}/${infer Rest}` ? { [K in Param | keyof InferParamPath<Rest>]: string } : Path extends `${infer _Start}:${infer Param}` ? { [K in Param]: string } : Path extends `${infer _Start}/${infer Rest}` ? InferParamPath<Rest> : {};
 type InferParamWildCard<Path> = Path extends `${infer _Start}/*:${infer Param}/${infer Rest}` | `${infer _Start}/**:${infer Param}/${infer Rest}` ? { [K in Param | keyof InferParamPath<Rest>]: string } : Path extends `${infer _Start}/*` ? { [K in "_"]: string } : Path extends `${infer _Start}/${infer Rest}` ? InferParamWildCard<Rest> : {}; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/standard-schema.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/standard-schema.d.mts
 //#region src/standard-schema.d.ts
 /** The Standard Schema interface. */
 interface StandardSchemaV1$1<Input = unknown, Output = Input> {
@@ -4041,7 +4096,7 @@ declare namespace StandardSchemaV1$1 {
   type InferOutput<Schema extends StandardSchemaV1$1> = NonNullable<Schema["~standard"]["types"]>["output"];
 } //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/error.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/error.d.mts
 declare const statusCodes: {
   OK: number;
   CREATED: number;
@@ -4119,7 +4174,7 @@ declare const APIError: new (status?: Status | "OK" | "CREATED" | "ACCEPTED" | "
   errorStack: string | undefined;
 }; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/cookies.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/cookies.d.mts
 //#region src/cookies.d.ts
 type CookiePrefixOptions = "host" | "secure";
 type CookieOptions = {
@@ -4209,7 +4264,7 @@ type CookieOptions = {
   prefix?: CookiePrefixOptions;
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/openapi.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/openapi.d.mts
 //#region src/openapi.d.ts
 type OpenAPISchemaType = "string" | "number" | "integer" | "boolean" | "array" | "object";
 interface OpenAPIParameter {
@@ -4231,7 +4286,7 @@ interface OpenAPIParameter {
   };
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/endpoint.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/endpoint.d.mts
 //#region src/endpoint.d.ts
 interface EndpointBaseOptions {
   /**
@@ -4552,6 +4607,22 @@ type EndpointContext<Path extends string, Options extends EndpointOptions, Conte
    * @returns - The cookie string
    */
   setSignedCookie: (key: string, value: string, secret: string, options?: CookieOptions) => Promise<string>;
+  /**
+   * Response headers
+   *
+   * The live `Headers` for the response being built in the current
+   * request. Read it to inspect what has already been queued, e.g. to
+   * avoid emitting a `Set-Cookie` twice or to check headers set by an
+   * earlier handler in the chain.
+   *
+   * @example
+   * ```ts
+   * const alreadySet = ctx.responseHeaders
+   *   .getSetCookie()
+   *   .some((c) => c.startsWith("session="));
+   * ```
+   */
+  responseHeaders: Headers;
   /**
    * JSON
    *
@@ -4594,7 +4665,7 @@ type Endpoint<Path extends string = string, Options extends EndpointOptions = En
   path: Path;
 }; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/middleware.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/middleware.d.mts
 //#region src/middleware.d.ts
 interface MiddlewareOptions extends Omit<EndpointOptions, "method"> {}
 type MiddlewareContext<Options extends MiddlewareOptions, Context = {}> = EndpointContext<string, Options & {
@@ -4701,7 +4772,7 @@ type Middleware<Options extends MiddlewareOptions = MiddlewareOptions, Handler e
   options: Options;
 }; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/context.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/context.d.mts
 //#region src/context.d.ts
 type HTTPMethod = "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
 type Method = HTTPMethod | "*";
@@ -4917,6 +4988,22 @@ interface InternalAdapter<_Options extends BetterAuthOptions = BetterAuthOptions
    * pair at single-use credential consumption sites.
    */
   consumeVerificationValue(identifier: string): Promise<Verification | null>;
+  /**
+   * First-writer-wins create keyed by a deterministic primary key derived from
+   * `identifier`. Returns `true` when this caller created the row and `false`
+   * when a row for the same identifier already existed.
+   *
+   * The dual of `consumeVerificationValue`: reserve races to create a marker
+   * exactly once, where consume races to delete one exactly once. Use it for
+   * replay tombstones (a SAML assertion id, a JWT `jti`) where the first caller
+   * wins. The database path is atomic via the primary key; the
+   * secondary-storage-only path is best-effort under concurrency.
+   */
+  reserveVerificationValue(data: {
+    identifier: string;
+    value: string;
+    expiresAt: Date;
+  }): Promise<boolean>;
   updateVerificationByIdentifier(identifier: string, data: Partial<Verification>): Promise<Verification>;
   refreshUserSessions(user: User): Promise<void>;
 }
@@ -5403,6 +5490,35 @@ type BaseURLConfig = string | DynamicBaseURLConfig;
 interface BetterAuthRateLimitStorage {
   get: (key: string) => Promise<RateLimit | null | undefined>;
   set: (key: string, value: RateLimit, update?: boolean | undefined) => Promise<void>;
+  /**
+   * Atomically records one request against `key` within the `window`
+   * (in seconds) and reports whether it is allowed.
+   *
+   * When `allowed` is true the request was counted within the active window;
+   * when `allowed` is false the limit was already reached and `retryAfter` is
+   * the number of seconds until the window frees up. Whether the window slides
+   * or is fixed depends on the backing storage: the database backend resets
+   * once the window elapses, while secondary storage uses a fixed time-to-live
+   * set when the window first opens.
+   *
+   * Performing the check and the increment in a single step closes the
+   * concurrent-bypass gap of the separate `get`/`set` path: N simultaneous
+   * requests can no longer all pass a stale read before any increment lands.
+   *
+   * Optional for backwards compatibility. A storage without it falls back to
+   * the legacy non-atomic `get`/`set` path, which is best-effort under
+   * concurrency.
+   *
+   * TODO(rate-limit-consume-required): make this the sole required member on
+   * `next`, dropping `get`/`set` and the non-atomic fallback.
+   */
+  consume?: (key: string, rule: {
+    window: number;
+    max: number;
+  }) => Promise<{
+    allowed: boolean;
+    retryAfter: number | null;
+  }>;
 }
 type BetterAuthRateLimitRule = {
   /**
@@ -6856,6 +6972,21 @@ interface SecondaryStorage {
    * security-sensitive consume paths.
    */
   getAndDelete?: (key: string) => Awaitable<unknown>;
+  /**
+   * Atomically increment the counter at `key` by one, returning the
+   * post-increment value.
+   *
+   * When the key is absent, it is created with a value of `1` and the given
+   * `ttl` (in SECONDS). The TTL is applied only on creation; later increments
+   * never extend it, so the counter expires a fixed window after it was first
+   * created.
+   *
+   * This is optional for backwards compatibility with existing secondary
+   * storage implementations. TODO(secondary-storage-increment-required): make
+   * this required for secondary-storage-backed rate limiting in the next minor
+   * on `next`.
+   */
+  increment?: (key: string, ttl: number) => Awaitable<number>;
   set: (
   /**
    * Key to store

package/dist/preload.mjs

@@ -1,5 +1,5 @@
 import electron, { contextBridge } from "electron";
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/error.mjs
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/error.mjs
 function isErrorStackTraceLimitWritable() {
 	const desc = Object.getOwnPropertyDescriptor(Error, "stackTraceLimit");
 	if (desc === void 0) return Object.isExtensible(Error);

package/dist/proxy.d.mts

@@ -1,4 +1,4 @@
-import { l as ElectronProxyClientOptions } from "./client-D6xRwPM0.mjs";
+import { l as ElectronProxyClientOptions } from "./client-hpd3q6M8.mjs";
 import { electron } from "./index.mjs";
 
 //#region src/proxy.d.ts

package/dist/proxy.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BPpah8cV.mjs";
+import { t as PACKAGE_VERSION } from "./version-BeZU0Td6.mjs";
 import { r as parseProtocolScheme } from "./utils-DxDKRT6e.mjs";
 import { parseCookies } from "better-auth/cookies";
 //#region src/proxy.ts

package/dist/storage.d.mts

@@ -1,4 +1,4 @@
-import { d as Storage } from "./client-D6xRwPM0.mjs";
+import { d as Storage } from "./client-hpd3q6M8.mjs";
 import { Options } from "conf";
 
 //#region src/storage.d.ts

package/dist/{version-BPpah8cV.mjs → version-BeZU0Td6.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.6.15";
+const PACKAGE_VERSION = "1.6.17";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/electron",
-  "version": "1.6.15",
+  "version": "1.6.17",
   "description": "Better Auth integration for Electron applications.",
   "type": "module",
   "license": "MIT",
@@ -80,17 +80,17 @@
     "better-sqlite3": "^12.6.2",
     "electron": "^41.2.2",
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.6.15",
-    "better-auth": "1.6.15"
+    "better-auth": "1.6.17",
+    "@better-auth/core": "1.6.17"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.1",
-    "@better-fetch/fetch": "1.1.21",
-    "better-call": "1.3.5",
+    "@better-fetch/fetch": "1.3.0",
+    "better-call": "1.3.6",
     "conf": "^15.0.2",
     "electron": ">=36.0.0",
-    "@better-auth/core": "^1.6.15",
-    "better-auth": "^1.6.15"
+    "@better-auth/core": "^1.6.17",
+    "better-auth": "^1.6.17"
   },
   "peerDependenciesMeta": {
     "electron": {