@better-auth/electron 1.7.0-beta.5 → 1.7.0-beta.6

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-DzWb5tB_.mjs";
+import { t as PACKAGE_VERSION } from "./version-BTlyLl-N.mjs";
 import { n as isProcessType, r as parseProtocolScheme, t as getChannelPrefixWithDelimiter } from "./utils-DxDKRT6e.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { base64, base64Url } from "@better-auth/utils/base64";
@@ -578,6 +578,16 @@ const electronClient = (options) => {
 	const cookieName = `${opts.storagePrefix}.cookie`;
 	const localCacheName = `${opts.storagePrefix}.local_cache`;
 	const { getDecrypted, setEncrypted } = storageAdapter(opts.storage, new Set([cookieName, localCacheName]));
+	const clearSessionCache = () => {
+		setEncrypted(cookieName, "{}");
+		store?.atoms.session?.set({
+			...store.atoms.session.get(),
+			data: null,
+			error: null,
+			isPending: false
+		});
+		setEncrypted(localCacheName, "{}");
+	};
 	if ((isDevelopment() || isTest()) && /^(?!\.)(?!.*\.\.)(?!.*\.$)[^.]+\.[^.]+$/.test(scheme)) console.warn("The provided scheme does not follow the reverse domain name notation. For example: `app.example.com` -> `com.example.app`.");
 	return {
 		id: "electron",
@@ -597,16 +607,7 @@ const electronClient = (options) => {
 					"user-agent": app.userAgentFallback,
 					"x-skip-oauth-proxy": "true"
 				};
-				if (url.endsWith("/sign-out")) {
-					setEncrypted(cookieName, "{}");
-					store?.atoms.session?.set({
-						...store.atoms.session.get(),
-						data: null,
-						error: null,
-						isPending: false
-					});
-					setEncrypted(localCacheName, "{}");
-				}
+				if (url.endsWith("/sign-out")) clearSessionCache();
 				return {
 					url,
 					options
@@ -629,6 +630,7 @@ const electronClient = (options) => {
 						const data = context.data;
 						setEncrypted(localCacheName, JSON.stringify(data));
 					}
+					if (context.request.url.toString().includes("/sign-out")) clearSessionCache();
 				},
 				onError: async (context) => {
 					webContents.getFocusedWebContents()?.send(`${getChannelPrefixWithDelimiter(opts.channelPrefix)}error`, {

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-DzWb5tB_.mjs";
+import { t as PACKAGE_VERSION } from "./version-BTlyLl-N.mjs";
 import { createAuthMiddleware } from "@better-auth/core/api";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { base64Url } from "@better-auth/utils/base64";
@@ -53,14 +53,13 @@ const electronToken = (_opts) => createAuthEndpoint("/electron/token", {
 		}
 	}
 }, async (ctx) => {
-	const token = await ctx.context.internalAdapter.findVerificationValue(`electron:${ctx.body.token}`);
-	if (!token || token.expiresAt < /* @__PURE__ */ new Date()) throw APIError.from("NOT_FOUND", ELECTRON_ERROR_CODES.INVALID_TOKEN);
+	const token = await ctx.context.internalAdapter.consumeVerificationValue(`electron:${ctx.body.token}`);
+	if (!token) throw APIError.from("NOT_FOUND", ELECTRON_ERROR_CODES.INVALID_TOKEN);
 	const tokenRecord = safeJSONParse$1(token.value);
 	if (!tokenRecord) throw APIError.from("INTERNAL_SERVER_ERROR", ELECTRON_ERROR_CODES.INVALID_TOKEN);
 	if (tokenRecord.state !== ctx.body.state) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.STATE_MISMATCH);
 	if (!tokenRecord.codeChallenge) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.MISSING_CODE_CHALLENGE);
 	if (await generateCodeChallenge(ctx.body.code_verifier) !== tokenRecord.codeChallenge) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_CODE_VERIFIER);
-	await ctx.context.internalAdapter.deleteVerificationByIdentifier(`electron:${ctx.body.token}`);
 	const user = await ctx.context.internalAdapter.findUserById(tokenRecord.userId);
 	if (!user) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const session = await ctx.context.internalAdapter.createSession(user.id);

package/dist/preload.d.mts

@@ -33,6 +33,7 @@ type DBAdapterDebugLogOption = boolean | {
   delete?: boolean | undefined;
   deleteMany?: boolean | undefined;
   consumeOne?: boolean | undefined;
+  incrementOne?: boolean | undefined;
   count?: boolean | undefined;
 } | {
   /**
@@ -208,7 +209,7 @@ interface DBAdapterFactoryConfig<Options extends BetterAuthOptions = BetterAuthO
     /**
      * The action which was called from the adapter.
      */
-    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "consumeOne" | "count";
+    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "consumeOne" | "incrementOne" | "count";
     /**
      * The model name.
      */
@@ -437,15 +438,43 @@ type DBAdapter<Options extends BetterAuthOptions = BetterAuthOptions> = {
    * race-safe primitive for consuming single-use credentials
    * (verification tokens, authorization codes, one-time tokens).
    *
-   * Always defined on the factory-wrapped adapter. When the underlying
-   * `CustomAdapter` does not implement `consumeOne`, the factory provides
-   * a fallback that wraps `findMany + deleteMany` in `transaction(...)`
-   * and returns the row only when the delete reports an affected row.
+   * Always defined on the factory-wrapped adapter. The underlying
+   * `CustomAdapter` must implement this natively; there is no portable
+   * fallback that can guarantee cross-process single-use semantics.
    */
   consumeOne: <T>(data: {
     model: string;
     where: Where[];
   }) => Promise<T | null>;
+  /**
+   * Atomically apply signed numeric deltas to a single row matching the where
+   * clause. For each entry in `increment`, the operation applies
+   * `field = field + delta` in one atomic step; a negative delta decrements.
+   *
+   * The `where` clause is both the selector AND the guard: comparison
+   * operators are honored, so passing `{ field: "remaining", operator: "gt",
+   * value: 0 }` only mutates the row while `remaining` is still above zero.
+   * When the guard matches no row, the operation makes no change and returns
+   * `null`.
+   *
+   * The optional `set` map assigns absolute values to fields in the same
+   * atomic operation, alongside the increments.
+   *
+   * Returns the updated row, or `null` when the guard matched no row. Under
+   * concurrent invocation against the same row, this is the race-safe
+   * primitive for guarded counter updates (e.g. decrementing a remaining-uses
+   * counter only while it is still positive).
+   *
+   * Always defined on the factory-wrapped adapter. The underlying
+   * `CustomAdapter` must implement this natively; there is no portable
+   * fallback that can guarantee guarded counter semantics across runtimes.
+   */
+  incrementOne: <T>(data: {
+    model: string;
+    where: Where[];
+    increment: Record<string, number>;
+    set?: Record<string, unknown> | undefined;
+  }) => Promise<T | null>;
   /**
    * Execute multiple operations in a transaction.
    * If the adapter doesn't support transactions, operations will be executed sequentially.
@@ -528,18 +557,33 @@ interface CustomAdapter {
     where: CleanedWhere[];
   }) => Promise<number>;
   /**
-   * Optional native atomic single-row consume. When omitted, the adapter
-   * factory falls back to `transaction(findMany + deleteMany)`.
+   * Native atomic single-row consume.
    * Implementing this method natively (e.g. `DELETE ... RETURNING *`,
    * `findOneAndDelete`, `OUTPUT deleted.*`) gives one round trip and the
    * strongest race-safety guarantee. Implementations must delete at most
-   * one matching row. TODO(consume-one-required): tighten to required in the
-   * next minor on `next`.
+   * one matching row.
    */
-  consumeOne?: <T>(data: {
+  consumeOne: <T>(data: {
     model: string;
     where: CleanedWhere[];
   }) => Promise<T | null>;
+  /**
+   * Native atomic guarded counter mutation. Applies
+   * `field = field + delta` for each entry in `increment` (negative deltas
+   * decrement), with `where` acting as both selector and guard and `set`
+   * assigning absolute values in the same operation. Returns the updated row,
+   * or `null` when the guard matched no row.
+   *
+   * Implementing this natively (e.g. `UPDATE ... SET n = n + $delta WHERE ...
+   * RETURNING *`) gives one round trip and the strongest race-safety
+   * guarantee.
+   */
+  incrementOne: <T>(data: {
+    model: string;
+    where: CleanedWhere[];
+    increment: Record<string, number>;
+    set?: Record<string, unknown> | undefined;
+  }) => Promise<T | null>;
   count: ({
     model,
     where
@@ -577,7 +621,6 @@ type BaseRateLimit = z.infer<typeof rateLimitSchema>;
 /**
  * Rate limit schema type used by better-auth for rate limiting
  */
-type RateLimit<DBOptions extends BetterAuthOptions["rateLimit"] = BetterAuthOptions["rateLimit"], Plugins extends BetterAuthOptions["plugins"] = BetterAuthOptions["plugins"]> = Prettify$1<BaseRateLimit & InferDBFieldsFromOptions<DBOptions> & InferDBFieldsFromPlugins<"rateLimit", Plugins>>; //#endregion
 //#endregion
 //#region ../core/dist/db/schema/session.d.mts
 //#region src/db/schema/session.d.ts
@@ -2783,6 +2826,7 @@ declare const socialProviders: {
       audience: string | string[];
       maxTokenAge: string;
       issuer: string | undefined;
+      verifyClaims: (claims: Record<string, unknown>) => boolean;
     };
     getUserInfo(token: OAuth2Tokens & {
       user?: {
@@ -5368,6 +5412,23 @@ interface InternalAdapter<_Options extends BetterAuthOptions = BetterAuthOptions
    * pair at single-use credential consumption sites.
    */
   consumeVerificationValue(identifier: string): Promise<Verification | null>;
+  /**
+   * First-writer-wins create keyed by a deterministic primary key derived from
+   * `identifier`. Returns `true` when this caller created the row and `false`
+   * when a row for the same identifier already existed.
+   *
+   * The dual of `consumeVerificationValue`: reserve races to create a marker
+   * exactly once, where consume races to delete one exactly once. Use it for
+   * replay tombstones (a SAML assertion id, a JWT `jti`) where the first caller
+   * wins. The database path is atomic via the primary key. Secondary-storage-only
+   * verification is not supported for reservation and runtime implementations
+   * should fail closed unless verification is backed by the database.
+   */
+  reserveVerificationValue(data: {
+    identifier: string;
+    value: string;
+    expiresAt: Date;
+  }): Promise<boolean>;
   updateVerificationByIdentifier(identifier: string, data: Partial<Verification>): Promise<Verification>;
   refreshUserSessions(user: User): Promise<void>;
 }
@@ -5919,8 +5980,30 @@ type DynamicBaseURLConfig = {
  */
 type BaseURLConfig = string | DynamicBaseURLConfig;
 interface BetterAuthRateLimitStorage {
-  get: (key: string) => Promise<RateLimit | null | undefined>;
-  set: (key: string, value: RateLimit, update?: boolean | undefined) => Promise<void>;
+  /**
+   * Atomically records one request against `key` within the rolling `window`
+   * (in seconds) and reports whether it is allowed.
+   *
+   * When `allowed` is true the count was incremented within the active window,
+   * or the window had elapsed and was reset to start at 1. When `allowed` is
+   * false the limit was already reached and `retryAfter` is the number of
+   * seconds until the window frees up.
+   *
+   * Performing the check and the increment in a single step closes the
+   * concurrent-bypass gap of the separate `get`/`set` path: N simultaneous
+   * requests can no longer all pass a stale read before any increment lands.
+   *
+   * Custom storages must implement this operation directly. Better Auth no
+   * longer accepts separate `get`/`set` rate-limit storage because that shape
+   * cannot enforce a distributed limit under concurrent requests.
+   */
+  consume: (key: string, rule: {
+    window: number;
+    max: number;
+  }) => Promise<{
+    allowed: boolean;
+    retryAfter: number | null;
+  }>;
 }
 type BetterAuthRateLimitRule = {
   /**
@@ -6702,6 +6785,20 @@ type BetterAuthOptions = {
        * @default "compact"
        */
       strategy?: "compact" | "jwt" | "jwe";
+      /**
+       * JWT-specific configuration for `strategy: "jwt"`.
+       */
+      jwt?: {
+        /**
+         * Which signing key is used for cookie-cache JWTs.
+         *
+         * - `"secret"`: uses the Better Auth secret with HS256.
+         * - `"jwt-plugin"`: uses the installed `jwt()` plugin's asymmetric signing keys.
+         *
+         * @default "secret"
+         */
+        signingKey?: "secret" | "jwt-plugin";
+      };
       /**
        * Controls stateless cookie cache refresh behavior.
        *
@@ -6881,9 +6978,13 @@ type BetterAuthOptions = {
      */
     storeStateStrategy?: "database" | "cookie";
     /**
-     * Store account data after oauth flow on a cookie
+     * Store provider account data after an OAuth flow in an encrypted
+     * cookie. This includes OAuth token material such as access tokens,
+     * refresh tokens, ID tokens, scopes, and token expiry.
      *
-     * This is useful for database-less flow
+     * This is useful for database-less flows, but large provider tokens can
+     * still hit browser or proxy cookie/header limits even though Better Auth
+     * chunks oversized account cookies.
      *
      * @default false
      *
@@ -7388,16 +7489,21 @@ interface SecondaryStorage {
   get: (key: string) => Awaitable<unknown>;
   /**
    * Atomically get a value and delete it from storage.
+   */
+  getAndDelete: (key: string) => Awaitable<unknown>;
+  /**
+   * Atomically increment the counter at `key` by one, returning the
+   * post-increment value.
    *
-   * This is optional for backwards compatibility with existing secondary
-   * storage implementations. Single-use credential consumers use it when
-   * present to avoid a read-then-delete race.
+   * When the key is absent, it is created with a value of `1` and the given
+   * `ttl` (in SECONDS). The TTL is applied only on creation; later increments
+   * never extend it, so the counter expires a fixed window after it was first
+   * created.
    *
-   * TODO(secondary-storage-atomic-consume): make this required in the next
-   * breaking release, or require database-backed verification storage for
-   * security-sensitive consume paths.
+   * Required so secondary-storage-backed rate limiting can enforce the limit
+   * in one distributed-safe operation.
    */
-  getAndDelete?: (key: string) => Awaitable<unknown>;
+  increment: (key: string, ttl: number) => Awaitable<number>;
   set: (
   /**
    * Key to store

package/dist/proxy.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-DzWb5tB_.mjs";
+import { t as PACKAGE_VERSION } from "./version-BTlyLl-N.mjs";
 import { r as parseProtocolScheme } from "./utils-DxDKRT6e.mjs";
 import { parseCookies } from "better-auth/cookies";
 //#region src/proxy.ts

package/dist/{version-DzWb5tB_.mjs → version-BTlyLl-N.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-beta.5";
+const PACKAGE_VERSION = "1.7.0-beta.6";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/electron",
-  "version": "1.7.0-beta.5",
+  "version": "1.7.0-beta.6",
   "description": "Better Auth integration for Electron applications.",
   "type": "module",
   "license": "MIT",
@@ -80,17 +80,17 @@
     "better-sqlite3": "^12.6.2",
     "electron": "^41.2.2",
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.7.0-beta.5",
-    "better-auth": "1.7.0-beta.5"
+    "@better-auth/core": "1.7.0-beta.6",
+    "better-auth": "1.7.0-beta.6"
   },
   "peerDependencies": {
-    "@better-auth/utils": "0.4.1",
-    "@better-fetch/fetch": "1.2.2",
+    "@better-auth/utils": "0.4.2",
+    "@better-fetch/fetch": "1.3.1",
     "better-call": "1.3.6",
     "conf": "^15.0.2",
     "electron": ">=36.0.0",
-    "@better-auth/core": "^1.7.0-beta.5",
-    "better-auth": "^1.7.0-beta.5"
+    "@better-auth/core": "^1.7.0-beta.6",
+    "better-auth": "^1.7.0-beta.6"
   },
   "peerDependenciesMeta": {
     "electron": {