@better-auth/electron 1.6.16 → 1.6.17

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-KncHedVM.mjs";
+import { t as PACKAGE_VERSION } from "./version-BeZU0Td6.mjs";
 import { n as isProcessType, r as parseProtocolScheme, t as getChannelPrefixWithDelimiter } from "./utils-DxDKRT6e.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { base64, base64Url } from "@better-auth/utils/base64";
@@ -579,6 +579,16 @@ const electronClient = (options) => {
 	const cookieName = `${opts.storagePrefix}.cookie`;
 	const localCacheName = `${opts.storagePrefix}.local_cache`;
 	const { getDecrypted, setEncrypted } = storageAdapter(opts.storage, new Set([cookieName, localCacheName]));
+	const clearSessionCache = () => {
+		setEncrypted(cookieName, "{}");
+		store?.atoms.session?.set({
+			...store.atoms.session.get(),
+			data: null,
+			error: null,
+			isPending: false
+		});
+		setEncrypted(localCacheName, "{}");
+	};
 	if ((isDevelopment() || isTest()) && /^(?!\.)(?!.*\.\.)(?!.*\.$)[^.]+\.[^.]+$/.test(scheme)) console.warn("The provided scheme does not follow the reverse domain name notation. For example: `app.example.com` -> `com.example.app`.");
 	return {
 		id: "electron",
@@ -598,16 +608,7 @@ const electronClient = (options) => {
 					"electron-origin": `${scheme}:/`,
 					"x-skip-oauth-proxy": "true"
 				};
-				if (url.endsWith("/sign-out")) {
-					setEncrypted(cookieName, "{}");
-					store?.atoms.session?.set({
-						...store.atoms.session.get(),
-						data: null,
-						error: null,
-						isPending: false
-					});
-					setEncrypted(localCacheName, "{}");
-				}
+				if (url.endsWith("/sign-out")) clearSessionCache();
 				return {
 					url,
 					options
@@ -630,6 +631,7 @@ const electronClient = (options) => {
 						const data = context.data;
 						setEncrypted(localCacheName, JSON.stringify(data));
 					}
+					if (context.request.url.toString().includes("/sign-out")) clearSessionCache();
 				},
 				onError: async (context) => {
 					webContents.getFocusedWebContents()?.send(`${getChannelPrefixWithDelimiter(opts.channelPrefix)}error`, {

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-KncHedVM.mjs";
+import { t as PACKAGE_VERSION } from "./version-BeZU0Td6.mjs";
 import { createAuthMiddleware } from "@better-auth/core/api";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { base64Url } from "@better-auth/utils/base64";
@@ -57,8 +57,8 @@ const electronToken = (_opts) => createAuthEndpoint("/electron/token", {
 		}
 	}
 }, async (ctx) => {
-	const token = await ctx.context.internalAdapter.findVerificationValue(`electron:${ctx.body.token}`);
-	if (!token || token.expiresAt < /* @__PURE__ */ new Date()) throw APIError.from("NOT_FOUND", ELECTRON_ERROR_CODES.INVALID_TOKEN);
+	const token = await ctx.context.internalAdapter.consumeVerificationValue(`electron:${ctx.body.token}`);
+	if (!token) throw APIError.from("NOT_FOUND", ELECTRON_ERROR_CODES.INVALID_TOKEN);
 	const tokenRecord = safeJSONParse$1(token.value);
 	if (!tokenRecord) throw APIError.from("INTERNAL_SERVER_ERROR", ELECTRON_ERROR_CODES.INVALID_TOKEN);
 	if (tokenRecord.state !== ctx.body.state) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.STATE_MISMATCH);
@@ -67,7 +67,6 @@ const electronToken = (_opts) => createAuthEndpoint("/electron/token", {
 	const codeChallenge = Buffer.from(base64Url.decode(tokenRecord.codeChallenge));
 	const codeVerifier = Buffer.from(await createHash("SHA-256").digest(ctx.body.code_verifier));
 	if (codeChallenge.length !== codeVerifier.length || !timingSafeEqual(codeChallenge, codeVerifier)) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_CODE_VERIFIER);
-	await ctx.context.internalAdapter.deleteVerificationByIdentifier(`electron:${ctx.body.token}`);
 	const user = await ctx.context.internalAdapter.findUserById(tokenRecord.userId);
 	if (!user) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const session = await ctx.context.internalAdapter.createSession(user.id);

package/dist/preload.d.mts

@@ -31,6 +31,7 @@ type DBAdapterDebugLogOption = boolean | {
   delete?: boolean | undefined;
   deleteMany?: boolean | undefined;
   consumeOne?: boolean | undefined;
+  incrementOne?: boolean | undefined;
   count?: boolean | undefined;
 } | {
   /**
@@ -206,7 +207,7 @@ interface DBAdapterFactoryConfig<Options extends BetterAuthOptions = BetterAuthO
     /**
      * The action which was called from the adapter.
      */
-    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "consumeOne" | "count";
+    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "consumeOne" | "incrementOne" | "count";
     /**
      * The model name.
      */
@@ -444,6 +445,36 @@ type DBAdapter<Options extends BetterAuthOptions = BetterAuthOptions> = {
     model: string;
     where: Where[];
   }) => Promise<T | null>;
+  /**
+   * Atomically apply signed numeric deltas to a single row matching the where
+   * clause. For each entry in `increment`, the operation applies
+   * `field = field + delta` in one atomic step; a negative delta decrements.
+   *
+   * The `where` clause is both the selector AND the guard: comparison
+   * operators are honored, so passing `{ field: "remaining", operator: "gt",
+   * value: 0 }` only mutates the row while `remaining` is still above zero.
+   * When the guard matches no row, the operation makes no change and returns
+   * `null`.
+   *
+   * The optional `set` map assigns absolute values to fields in the same
+   * atomic operation, alongside the increments.
+   *
+   * Returns the updated row, or `null` when the guard matched no row. Under
+   * concurrent invocation against the same row, this is the race-safe
+   * primitive for guarded counter updates (e.g. decrementing a remaining-uses
+   * counter only while it is still positive).
+   *
+   * Always defined on the factory-wrapped adapter. When the underlying
+   * `CustomAdapter` does not implement `incrementOne`, the factory provides a
+   * fallback that wraps `findMany + updateMany` in `transaction(...)` and
+   * re-applies the where clause as a compare-and-swap guard on the update.
+   */
+  incrementOne: <T>(data: {
+    model: string;
+    where: Where[];
+    increment: Record<string, number>;
+    set?: Record<string, unknown> | undefined;
+  }) => Promise<T | null>;
   /**
    * Execute multiple operations in a transaction.
    * If the adapter doesn't support transactions, operations will be executed sequentially.
@@ -538,6 +569,25 @@ interface CustomAdapter {
     model: string;
     where: CleanedWhere[];
   }) => Promise<T | null>;
+  /**
+   * Optional native atomic guarded counter mutation. Applies
+   * `field = field + delta` for each entry in `increment` (negative deltas
+   * decrement), with `where` acting as both selector and guard and `set`
+   * assigning absolute values in the same operation. Returns the updated row,
+   * or `null` when the guard matched no row.
+   *
+   * Implementing this natively (e.g. `UPDATE ... SET n = n + $delta WHERE ...
+   * RETURNING *`) gives one round trip and the strongest race-safety
+   * guarantee. When omitted, the adapter factory provides a transaction-based
+   * fallback over `findMany + updateMany`. TODO(increment-one-required):
+   * tighten to required in the next minor on `next`.
+   */
+  incrementOne?: <T>(data: {
+    model: string;
+    where: CleanedWhere[];
+    increment: Record<string, number>;
+    set?: Record<string, unknown> | undefined;
+  }) => Promise<T | null>;
   count: ({
     model,
     where
@@ -4938,6 +4988,22 @@ interface InternalAdapter<_Options extends BetterAuthOptions = BetterAuthOptions
    * pair at single-use credential consumption sites.
    */
   consumeVerificationValue(identifier: string): Promise<Verification | null>;
+  /**
+   * First-writer-wins create keyed by a deterministic primary key derived from
+   * `identifier`. Returns `true` when this caller created the row and `false`
+   * when a row for the same identifier already existed.
+   *
+   * The dual of `consumeVerificationValue`: reserve races to create a marker
+   * exactly once, where consume races to delete one exactly once. Use it for
+   * replay tombstones (a SAML assertion id, a JWT `jti`) where the first caller
+   * wins. The database path is atomic via the primary key; the
+   * secondary-storage-only path is best-effort under concurrency.
+   */
+  reserveVerificationValue(data: {
+    identifier: string;
+    value: string;
+    expiresAt: Date;
+  }): Promise<boolean>;
   updateVerificationByIdentifier(identifier: string, data: Partial<Verification>): Promise<Verification>;
   refreshUserSessions(user: User): Promise<void>;
 }
@@ -5424,6 +5490,35 @@ type BaseURLConfig = string | DynamicBaseURLConfig;
 interface BetterAuthRateLimitStorage {
   get: (key: string) => Promise<RateLimit | null | undefined>;
   set: (key: string, value: RateLimit, update?: boolean | undefined) => Promise<void>;
+  /**
+   * Atomically records one request against `key` within the `window`
+   * (in seconds) and reports whether it is allowed.
+   *
+   * When `allowed` is true the request was counted within the active window;
+   * when `allowed` is false the limit was already reached and `retryAfter` is
+   * the number of seconds until the window frees up. Whether the window slides
+   * or is fixed depends on the backing storage: the database backend resets
+   * once the window elapses, while secondary storage uses a fixed time-to-live
+   * set when the window first opens.
+   *
+   * Performing the check and the increment in a single step closes the
+   * concurrent-bypass gap of the separate `get`/`set` path: N simultaneous
+   * requests can no longer all pass a stale read before any increment lands.
+   *
+   * Optional for backwards compatibility. A storage without it falls back to
+   * the legacy non-atomic `get`/`set` path, which is best-effort under
+   * concurrency.
+   *
+   * TODO(rate-limit-consume-required): make this the sole required member on
+   * `next`, dropping `get`/`set` and the non-atomic fallback.
+   */
+  consume?: (key: string, rule: {
+    window: number;
+    max: number;
+  }) => Promise<{
+    allowed: boolean;
+    retryAfter: number | null;
+  }>;
 }
 type BetterAuthRateLimitRule = {
   /**
@@ -6877,6 +6972,21 @@ interface SecondaryStorage {
    * security-sensitive consume paths.
    */
   getAndDelete?: (key: string) => Awaitable<unknown>;
+  /**
+   * Atomically increment the counter at `key` by one, returning the
+   * post-increment value.
+   *
+   * When the key is absent, it is created with a value of `1` and the given
+   * `ttl` (in SECONDS). The TTL is applied only on creation; later increments
+   * never extend it, so the counter expires a fixed window after it was first
+   * created.
+   *
+   * This is optional for backwards compatibility with existing secondary
+   * storage implementations. TODO(secondary-storage-increment-required): make
+   * this required for secondary-storage-backed rate limiting in the next minor
+   * on `next`.
+   */
+  increment?: (key: string, ttl: number) => Awaitable<number>;
   set: (
   /**
    * Key to store

package/dist/proxy.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-KncHedVM.mjs";
+import { t as PACKAGE_VERSION } from "./version-BeZU0Td6.mjs";
 import { r as parseProtocolScheme } from "./utils-DxDKRT6e.mjs";
 import { parseCookies } from "better-auth/cookies";
 //#region src/proxy.ts

package/dist/{version-KncHedVM.mjs → version-BeZU0Td6.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.6.16";
+const PACKAGE_VERSION = "1.6.17";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/electron",
-  "version": "1.6.16",
+  "version": "1.6.17",
   "description": "Better Auth integration for Electron applications.",
   "type": "module",
   "license": "MIT",
@@ -80,17 +80,17 @@
     "better-sqlite3": "^12.6.2",
     "electron": "^41.2.2",
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.6.16",
-    "better-auth": "1.6.16"
+    "better-auth": "1.6.17",
+    "@better-auth/core": "1.6.17"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.1",
-    "@better-fetch/fetch": "1.2.2",
+    "@better-fetch/fetch": "1.3.0",
     "better-call": "1.3.6",
     "conf": "^15.0.2",
     "electron": ">=36.0.0",
-    "@better-auth/core": "^1.6.16",
-    "better-auth": "^1.6.16"
+    "@better-auth/core": "^1.6.17",
+    "better-auth": "^1.6.17"
   },
   "peerDependenciesMeta": {
     "electron": {