@datar-platform/better-auth-dynamodb 0.1.0 → 0.2.0

package/dist/index.js

@@ -1,20 +1,79 @@
 // src/adapter.ts
 import { createAdapterFactory } from "better-auth/adapters";
 
+// src/errors.ts
+var DynamoDBAdapterError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "DynamoDBAdapterError";
+  }
+};
+var UniqueConstraintError = class extends DynamoDBAdapterError {
+  constructor(model, fields, options) {
+    super(
+      `better-auth-dynamodb: unique constraint violation on "${model}" (duplicate value for ${fields.join(", ")})`,
+      options
+    );
+    this.model = model;
+    this.fields = fields;
+    this.name = "UniqueConstraintError";
+  }
+  model;
+  fields;
+};
+var UnsupportedQueryError = class extends DynamoDBAdapterError {
+  constructor(message) {
+    super(message);
+    this.name = "UnsupportedQueryError";
+  }
+};
+var OptimisticLockError = class extends DynamoDBAdapterError {
+  constructor(model, id, options) {
+    super(
+      `better-auth-dynamodb: concurrent modification of "${model}" row "${id}" \u2014 the record changed between read and write`,
+      options
+    );
+    this.name = "OptimisticLockError";
+  }
+};
+var named = (error, name) => typeof error === "object" && error !== null && "name" in error && error.name === name;
+var isConditionalCheckFailed = (error) => named(error, "ConditionalCheckFailedException");
+var isTransactionCanceled = (error) => named(error, "TransactionCanceledException");
+function transactionCancellationCodes(error) {
+  if (typeof error !== "object" || error === null || !("CancellationReasons" in error)) {
+    return [];
+  }
+  const reasons = error.CancellationReasons;
+  if (!Array.isArray(reasons)) return [];
+  return reasons.map(
+    (reason) => typeof reason === "object" && reason !== null && "Code" in reason ? reason.Code : void 0
+  ).filter((code) => typeof code === "string");
+}
+var isConditionalTransactionCanceled = (error) => isTransactionCanceled(error) && transactionCancellationCodes(error).includes("ConditionalCheckFailed");
+var isTransactionConflict = (error) => isTransactionCanceled(error) && transactionCancellationCodes(error).includes("TransactionConflict");
+
 // src/pagination.ts
-async function drainPages(fetch) {
+var DEFAULT_MAX_PAGES = 25;
+async function drainPages(fetch, maxPages = DEFAULT_MAX_PAGES, label = "query") {
   const out = [];
   let cursor = void 0;
+  let pages = 0;
   do {
     const page = await fetch(cursor);
     out.push(...page.items);
     cursor = page.cursor;
+    if (++pages >= maxPages && cursor) {
+      throw new DynamoDBAdapterError(
+        `better-auth-dynamodb: ${label} exceeded maxPages (${maxPages}) with more pages remaining. Raise maxPages or narrow the query \u2014 returning a partial result here would silently drop rows.`
+      );
+    }
   } while (cursor);
   return out;
 }
 function matchOne(item, w) {
-  const actual = item[w.field];
-  const expected = w.value;
+  const fold = (v) => w.mode === "insensitive" && typeof v === "string" ? v.toLowerCase() : v;
+  const actual = fold(item[w.field]);
+  const expected = Array.isArray(w.value) ? w.value.map(fold) : fold(w.value);
   switch (w.operator) {
     case "eq":
       return actual === expected;
@@ -67,7 +126,7 @@ function applyWindow(items, offset, limit) {
 
 // src/planner.ts
 function isKeyable(w) {
-  return w.operator === "eq" && w.connector === "AND" && w.value != null;
+  return w.operator === "eq" && w.connector === "AND" && w.value != null && w.mode !== "insensitive";
 }
 function planQuery(model, where, indexMap) {
   const eqByField = /* @__PURE__ */ new Map();
@@ -82,6 +141,16 @@ function planQuery(model, where, indexMap) {
       residual: where.filter((w) => w !== idClause)
     };
   }
+  const idIn = where.find(
+    (w) => w.field === "id" && w.operator === "in" && w.connector === "AND" && Array.isArray(w.value)
+  );
+  if (idIn) {
+    return {
+      kind: "byIds",
+      ids: idIn.value.map(String),
+      residual: where.filter((w) => w !== idIn)
+    };
+  }
   const patterns = indexMap[model] ?? [];
   for (const pattern of patterns) {
     if (!pattern.pk.every((f) => eqByField.has(f))) continue;
@@ -117,13 +186,13 @@ function deriveIndexMap(schema) {
   for (const [model, table] of Object.entries(schema)) {
     const patterns = [];
     const seen = /* @__PURE__ */ new Set();
-    const add = (field) => {
+    const add = (field, unique = false) => {
       if (field === "id" || seen.has(field)) return;
       seen.add(field);
-      patterns.push({ index: lookupIndexName(field), pk: [field] });
+      patterns.push({ index: lookupIndexName(field), pk: [field], unique });
     };
     for (const [field, attr] of Object.entries(table.fields)) {
-      if (attr.unique) add(field);
+      if (attr.unique) add(field, true);
     }
     for (const [field, attr] of Object.entries(table.fields)) {
       if (attr.references) add(field);
@@ -137,28 +206,76 @@ function deriveIndexMap(schema) {
 }
 
 // src/stores/default/single-table-store.ts
+import { randomUUID } from "crypto";
 import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
 import {
   DeleteCommand,
   DynamoDBDocumentClient,
   GetCommand,
   PutCommand,
-  QueryCommand
+  QueryCommand,
+  TransactWriteCommand,
+  UpdateCommand
 } from "@aws-sdk/lib-dynamodb";
 
 // src/stores/default/key-codec.ts
+import { createHash } from "crypto";
 var PK = "__ba_pk";
 var SK = "__ba_sk";
 var TYPE_PK = "__ba_tpk";
 var TYPE_SK = "__ba_tsk";
 var TYPE_INDEX = "byType";
+var REVISION = "__ba_rev";
+var DEFAULT_TTL_ATTRIBUTE = "__ba_ttl";
 var SK_CONST = "#";
 var RESERVED_PREFIX = "__ba_";
+var ENTITY_PREFIX = "E";
+var LOOKUP_PREFIX = "L";
+var UNIQUE_PREFIX = "U";
+var MAX_PARTITION_KEY_BYTES = 2048;
+var MAX_SORT_KEY_BYTES = 1024;
+var MAX_VALUE_COMPONENT_BYTES = 256;
 var gsiName = (slot) => `lookup${slot}`;
 var gsiPk = (slot) => `__ba_g${slot}pk`;
 var gsiSk = (slot) => `__ba_g${slot}sk`;
-var enc = (v) => String(v);
-var joinValues = (values) => values.map(enc).join("#");
+var byteLength = (value) => Buffer.byteLength(value, "utf8");
+var component = (value) => `s${byteLength(value)}:${value}`;
+function encodeValue(value) {
+  if (value === null || value === void 0) return "null:";
+  if (value instanceof Date) return `date:${value.toISOString()}`;
+  switch (typeof value) {
+    case "string":
+      return `string:${value}`;
+    case "number":
+      return `number:${value}`;
+    case "boolean":
+      return `boolean:${value}`;
+    case "bigint":
+      return `bigint:${value}`;
+    case "symbol":
+      return `symbol:${value.description ?? ""}`;
+    case "function":
+      return "function:";
+    default:
+      return `object:${JSON.stringify(value)}`;
+  }
+}
+function valueComponent(value) {
+  const typed = encodeValue(value);
+  if (byteLength(typed) > MAX_VALUE_COMPONENT_BYTES) {
+    return `hs:${createHash("sha256").update(typed).digest("hex")}`;
+  }
+  return component(typed);
+}
+var joinValues = (values) => values.map(valueComponent).join("#");
+function checkedKey(value, label, maxBytes, keyType) {
+  if (byteLength(value) <= maxBytes) return value;
+  throw new DynamoDBAdapterError(
+    `better-auth-dynamodb: ${label} exceeds DynamoDB's ${maxBytes}-byte ${keyType} key limit. Field values are hashed past ${MAX_VALUE_COMPONENT_BYTES} bytes, so this means the model name, index name, or record id is itself too long.`
+  );
+}
+var partitionKey = (value, label) => checkedKey(value, label, MAX_PARTITION_KEY_BYTES, "partition");
+var sortKey = (value, label) => checkedKey(value, label, MAX_SORT_KEY_BYTES, "sort");
 function assignSlots(indexMap) {
   const slots = {};
   let maxSlots = 0;
@@ -173,16 +290,36 @@ function assignSlots(indexMap) {
   return { slots, maxSlots };
 }
 var primaryKey = (model, id) => ({
-  [PK]: `${model}#${id}`,
+  [PK]: partitionKey(
+    `${ENTITY_PREFIX}#${component(model)}#${component(id)}`,
+    "entity partition key"
+  ),
+  [SK]: SK_CONST
+});
+var uniqueMarkerKey = (model, index, values) => ({
+  [PK]: partitionKey(
+    `${UNIQUE_PREFIX}#${component(model)}#${component(index)}#${joinValues(values)}`,
+    "unique marker partition key"
+  ),
   [SK]: SK_CONST
 });
-var lookupPkValue = (model, index, values) => `${model}#${index}#${joinValues(values)}`;
+var lookupPkValue = (model, index, values) => partitionKey(
+  `${LOOKUP_PREFIX}#${component(model)}#${component(index)}#${joinValues(values)}`,
+  "lookup partition key"
+);
 function encodeKeys(model, item, indexMap, assignment) {
   const id = String(item.id);
   const keys = {
     ...primaryKey(model, id),
     [TYPE_PK]: model,
-    [TYPE_SK]: `${enc(item.createdAt ?? "")}#${id}`
+    // Deliberately *not* length-prefixed: this sort key exists to order a
+    // model's rows by creation time, and a byte-length prefix would sort
+    // lexicographically by length instead of chronologically. It is never used
+    // for `begins_with` lookups, so it carries no collision risk.
+    [TYPE_SK]: sortKey(
+      `${String(item.createdAt ?? "")}#${id}`,
+      "type sort key"
+    )
   };
   for (const pattern of indexMap[model] ?? []) {
     const pkValues = pattern.pk.map((f) => item[f]);
@@ -191,14 +328,17 @@ function encodeKeys(model, item, indexMap, assignment) {
     if (!slot) continue;
     keys[gsiPk(slot)] = lookupPkValue(model, pattern.index, pkValues);
     const skValues = (pattern.sk ?? []).map((f) => item[f]);
-    keys[gsiSk(slot)] = skValues.some((v) => v == null) ? `${id}` : `${joinValues(skValues)}#${id}`;
+    keys[gsiSk(slot)] = sortKey(
+      skValues.some((v) => v == null) ? component(id) : `${joinValues(skValues)}#${component(id)}`,
+      "lookup sort key"
+    );
   }
   return keys;
 }
 function encodeLookupQuery(model, index, key, indexMap, assignment) {
   const slot = assignment.slots[model]?.[index];
   if (!slot) {
-    throw new Error(
+    throw new DynamoDBAdapterError(
       `No physical slot for index "${index}" on model "${model}". Ensure the index is present in the adapter's index map.`
     );
   }
@@ -226,6 +366,7 @@ function stripReserved(item) {
 import {
   CreateTableCommand,
   ResourceInUseException,
+  UpdateTimeToLiveCommand,
   waitUntilTableExists
 } from "@aws-sdk/client-dynamodb";
 function buildTableDefinition(tableName, lookupSlots) {
@@ -282,9 +423,32 @@ async function ensureSchema(opts) {
     { client: opts.client, maxWaitTime: 60 },
     { TableName: opts.tableName }
   );
+  if (!opts.ttlAttribute) return;
+  try {
+    await opts.client.send(
+      new UpdateTimeToLiveCommand({
+        TableName: opts.tableName,
+        TimeToLiveSpecification: {
+          Enabled: true,
+          AttributeName: opts.ttlAttribute
+        }
+      })
+    );
+  } catch (error) {
+    if (!isAlreadyEnabled(error)) throw error;
+  }
 }
+var isAlreadyEnabled = (error) => typeof error === "object" && error !== null && "name" in error && error.name === "ValidationException" && typeof error.message === "string" && error.message.includes("already");
 function generateSchemaFile(opts) {
-  const table = buildTableDefinition(opts.tableName, opts.lookupSlots);
+  const table = {
+    ...buildTableDefinition(opts.tableName, opts.lookupSlots),
+    ...opts.ttlAttribute ? {
+      TimeToLiveSpecification: {
+        Enabled: true,
+        AttributeName: opts.ttlAttribute
+      }
+    } : {}
+  };
   const template = {
     AWSTemplateFormatVersion: "2010-09-09",
     Resources: {
@@ -308,6 +472,14 @@ export default dynamoDBSchema;
 }
 
 // src/stores/default/single-table-store.ts
+var MAX_TRANSACT_ITEMS = 100;
+var MAX_WRITE_ATTEMPTS = 3;
+var DEFAULT_MAX_PAGES2 = 25;
+var epochSeconds = (value) => {
+  const date = value instanceof Date ? value : typeof value === "string" || typeof value === "number" ? new Date(value) : void 0;
+  if (!date || Number.isNaN(date.getTime())) return void 0;
+  return Math.floor(date.getTime() / 1e3);
+};
 function createSingleTableStore(opts) {
   const tableName = opts.tableName ?? process.env.DYNAMODB_TABLE_NAME ?? "better-auth";
   const doc = opts.documentClient ?? DynamoDBDocumentClient.from(
@@ -319,59 +491,400 @@ function createSingleTableStore(opts) {
   );
   const indexMap = opts.indexMap;
   const assignment = assignSlots(indexMap);
+  const atomicUniqueness = opts.atomicUniqueness ?? true;
+  const maxPages = opts.maxPages ?? DEFAULT_MAX_PAGES2;
+  const ttl = opts.ttl === false ? void 0 : opts.ttl;
+  const ttlAttribute = ttl?.attributeName ?? DEFAULT_TTL_ATTRIBUTE;
+  const ttlFieldFor = (model) => ttl ? ttl.fields?.[model] ?? ttl.defaultField : void 0;
+  const ttlAttributesFor = (model, item) => {
+    const field = ttlFieldFor(model);
+    if (!field) return {};
+    const seconds = epochSeconds(item[field]);
+    return seconds === void 0 ? {} : { [ttlAttribute]: seconds };
+  };
+  const isExpired = (item) => {
+    if (!item || !ttl) return false;
+    const seconds = item[ttlAttribute];
+    return typeof seconds === "number" && seconds <= Math.floor(Date.now() / 1e3);
+  };
+  const modelHasTtl = (model) => Boolean(ttlFieldFor(model));
+  const uniquePatternsFor = (model) => atomicUniqueness ? (indexMap[model] ?? []).filter((p) => p.unique) : [];
+  const uniqueFieldNames = (model) => uniquePatternsFor(model).flatMap((p) => p.pk);
+  const markerItem = (model, pattern, values, ownerId, source) => ({
+    ...uniqueMarkerKey(model, pattern.index, values),
+    __ba_owner: ownerId,
+    ...ttlAttributesFor(model, source)
+  });
+  const applicableValues = (pattern, item) => {
+    const values = pattern.pk.map((f) => item[f]);
+    return values.some((v) => v == null) ? null : values;
+  };
+  const uniqueMarkerPuts = (model, item, id) => uniquePatternsFor(model).flatMap((pattern) => {
+    const values = applicableValues(pattern, item);
+    if (!values) return [];
+    return [
+      {
+        Put: {
+          TableName: tableName,
+          Item: markerItem(model, pattern, values, id, item),
+          ConditionExpression: "attribute_not_exists(#pk)",
+          ExpressionAttributeNames: { "#pk": PK }
+        }
+      }
+    ];
+  });
+  const uniqueMarkerDeletes = (model, item) => {
+    if (!item) return [];
+    return uniquePatternsFor(model).flatMap((pattern) => {
+      const values = applicableValues(pattern, item);
+      if (!values) return [];
+      return [
+        {
+          Delete: {
+            TableName: tableName,
+            Key: uniqueMarkerKey(model, pattern.index, values)
+          }
+        }
+      ];
+    });
+  };
+  const uniqueMarkerDiff = (model, before, after, id) => {
+    const items = [];
+    for (const pattern of uniquePatternsFor(model)) {
+      const oldValues = applicableValues(pattern, before);
+      const newValues = applicableValues(pattern, after);
+      if (oldValues?.length === newValues?.length && oldValues?.every((v, i) => v === newValues[i])) {
+        continue;
+      }
+      if (oldValues) {
+        items.push({
+          Delete: {
+            TableName: tableName,
+            Key: uniqueMarkerKey(model, pattern.index, oldValues)
+          }
+        });
+      }
+      if (newValues) {
+        items.push({
+          Put: {
+            TableName: tableName,
+            Item: markerItem(model, pattern, newValues, id, after),
+            ConditionExpression: "attribute_not_exists(#pk)",
+            ExpressionAttributeNames: { "#pk": PK }
+          }
+        });
+      }
+    }
+    return items;
+  };
+  const keyOf = (action) => {
+    const target = action.Put?.Item ?? action.Delete?.Key ?? action.Update?.Key ?? {};
+    return `${String(target[PK])}`;
+  };
+  const validateTransaction = (model, items) => {
+    if (items.length > MAX_TRANSACT_ITEMS) {
+      throw new DynamoDBAdapterError(
+        `better-auth-dynamodb: a single write to "${model}" would need ${items.length} transaction actions, over DynamoDB's ${MAX_TRANSACT_ITEMS}-action limit. Reduce the number of unique fields on this model.`
+      );
+    }
+    const seen = /* @__PURE__ */ new Set();
+    for (const item of items) {
+      const key = keyOf(item);
+      if (seen.has(key)) {
+        throw new DynamoDBAdapterError(
+          `better-auth-dynamodb: internal error \u2014 two actions in one transaction target the same item on "${model}". Please report this.`
+        );
+      }
+      seen.add(key);
+    }
+  };
+  const sendTransaction = async (model, items) => {
+    validateTransaction(model, items);
+    await doc.send(
+      new TransactWriteCommand({
+        TransactItems: items,
+        // Gives the SDK's internal retries of this one send a stable token.
+        // Not cross-invocation idempotency.
+        ClientRequestToken: randomUUID()
+      })
+    );
+  };
+  const asUniqueConflict = (model, err) => {
+    if (isConditionalTransactionCanceled(err)) {
+      throw new UniqueConstraintError(model, uniqueFieldNames(model), {
+        cause: err
+      });
+    }
+    throw err;
+  };
+  const readRaw = async (model, id) => {
+    const res = await doc.send(
+      new GetCommand({
+        TableName: tableName,
+        Key: primaryKey(model, id),
+        ConsistentRead: true
+      })
+    );
+    if (!res.Item || isExpired(res.Item)) return null;
+    return res.Item;
+  };
+  const revisionGuard = (existing) => {
+    const revision = existing[REVISION];
+    return revision === void 0 ? {
+      ConditionExpression: "attribute_exists(#pk) AND attribute_not_exists(#rev)",
+      ExpressionAttributeNames: { "#pk": PK, "#rev": REVISION }
+    } : {
+      ConditionExpression: "attribute_exists(#pk) AND #rev = :rev",
+      ExpressionAttributeNames: { "#pk": PK, "#rev": REVISION },
+      ExpressionAttributeValues: { ":rev": revision }
+    };
+  };
+  const rejectedByGuard = (err) => isConditionalCheckFailed(err) || isConditionalTransactionCanceled(err);
   const query = async (input, cursor, countOnly = false) => {
     const res = await doc.send(
       new QueryCommand({
         TableName: tableName,
         ExclusiveStartKey: cursor,
         ...countOnly ? { Select: "COUNT" } : {},
+        ...opts.pageSize ? { Limit: opts.pageSize } : {},
         ...input
       })
     );
     return {
-      items: countOnly ? [] : (res.Items ?? []).map((i) => stripReserved(i)),
+      items: countOnly ? [] : (res.Items ?? []).filter((item) => !isExpired(item)).map((i) => stripReserved(i)),
       count: res.Count ?? 0,
       cursor: res.LastEvaluatedKey
     };
   };
+  const putEntity = (model, item) => ({
+    Put: {
+      TableName: tableName,
+      Item: {
+        ...item,
+        ...encodeKeys(model, item, indexMap, assignment),
+        ...ttlAttributesFor(model, item),
+        [REVISION]: randomUUID()
+      },
+      ConditionExpression: "attribute_not_exists(#pk)",
+      ExpressionAttributeNames: { "#pk": PK }
+    }
+  });
+  const guardedWrite = async (model, id, build, onMissing) => {
+    for (let attempt = 1; attempt <= MAX_WRITE_ATTEMPTS; attempt++) {
+      const existing = await readRaw(model, id);
+      if (!existing) return onMissing();
+      const { items, result } = build(existing);
+      try {
+        await sendTransaction(model, items);
+        return result;
+      } catch (err) {
+        const guarded = rejectedByGuard(err);
+        if (!guarded && !isTransactionConflict(err)) throw err;
+        if (guarded && await lostToUniqueness(model, id, existing)) {
+          return asUniqueConflict(model, err);
+        }
+        if (attempt === MAX_WRITE_ATTEMPTS) {
+          throw new OptimisticLockError(model, id, { cause: err });
+        }
+      }
+    }
+    throw new OptimisticLockError(model, id);
+  };
+  const lostToUniqueness = async (model, id, previous) => {
+    if (uniquePatternsFor(model).length === 0) return false;
+    const current = await readRaw(model, id);
+    return Boolean(current) && current[REVISION] === previous[REVISION];
+  };
   return {
     async put(model, item) {
-      await doc.send(
-        new PutCommand({
-          TableName: tableName,
-          Item: { ...item, ...encodeKeys(model, item, indexMap, assignment) }
-        })
-      );
+      const id = String(item.id);
+      const entity = putEntity(model, item);
+      const markers = uniqueMarkerPuts(model, item, id);
+      try {
+        if (markers.length === 0) {
+          await doc.send(new PutCommand({ ...entity.Put }));
+        } else {
+          await sendTransaction(model, [entity, ...markers]);
+        }
+      } catch (err) {
+        if (isConditionalCheckFailed(err)) {
+          throw new DynamoDBAdapterError(
+            `better-auth-dynamodb: a "${model}" row with id "${id}" already exists.`,
+            { cause: err }
+          );
+        }
+        asUniqueConflict(model, err);
+      }
       return item;
     },
     async getById(model, id) {
-      const res = await doc.send(
-        new GetCommand({ TableName: tableName, Key: primaryKey(model, id) })
-      );
-      return stripReserved(res.Item);
+      const raw = await readRaw(model, id);
+      return stripReserved(raw);
     },
     async update(model, id, patch) {
-      const res = await doc.send(
-        new GetCommand({ TableName: tableName, Key: primaryKey(model, id) })
-      );
-      const existing = stripReserved(res.Item);
-      if (!existing) return null;
-      const merged = { ...existing, ...patch };
-      await doc.send(
-        new PutCommand({
-          TableName: tableName,
-          Item: {
-            ...merged,
-            ...encodeKeys(model, merged, indexMap, assignment)
-          }
-        })
+      return guardedWrite(
+        model,
+        id,
+        (existing) => {
+          const clean = stripReserved(existing);
+          const merged = { ...clean, ...patch };
+          return {
+            items: [
+              {
+                Put: {
+                  TableName: tableName,
+                  Item: {
+                    ...merged,
+                    ...encodeKeys(model, merged, indexMap, assignment),
+                    ...ttlAttributesFor(model, merged),
+                    [REVISION]: randomUUID()
+                  },
+                  ...revisionGuard(existing)
+                }
+              },
+              ...uniqueMarkerDiff(model, clean, merged, id)
+            ],
+            result: merged
+          };
+        },
+        () => null
       );
-      return merged;
     },
     async deleteById(model, id) {
-      await doc.send(
-        new DeleteCommand({ TableName: tableName, Key: primaryKey(model, id) })
+      await guardedWrite(
+        model,
+        id,
+        (existing) => ({
+          items: [
+            {
+              Delete: {
+                TableName: tableName,
+                Key: primaryKey(model, id),
+                ...revisionGuard(existing)
+              }
+            },
+            ...uniqueMarkerDeletes(model, stripReserved(existing))
+          ],
+          result: void 0
+        }),
+        () => void 0
+      );
+    },
+    async consumeOne(model, id) {
+      if (uniquePatternsFor(model).length === 0) {
+        const res = await doc.send(
+          new DeleteCommand({
+            TableName: tableName,
+            Key: primaryKey(model, id),
+            ReturnValues: "ALL_OLD"
+          })
+        );
+        const item = res.Attributes;
+        return isExpired(item) ? null : stripReserved(item);
+      }
+      const existing = await readRaw(model, id);
+      if (!existing) return null;
+      const clean = stripReserved(existing);
+      try {
+        await sendTransaction(model, [
+          {
+            Delete: {
+              TableName: tableName,
+              Key: primaryKey(model, id),
+              ...revisionGuard(existing)
+            }
+          },
+          ...uniqueMarkerDeletes(model, clean)
+        ]);
+      } catch (err) {
+        if (rejectedByGuard(err)) return null;
+        throw err;
+      }
+      return clean;
+    },
+    async incrementOne(model, id, { increment, set }) {
+      const indexedFields = new Set(
+        (indexMap[model] ?? []).flatMap((p) => [...p.pk, ...p.sk ?? []])
+      );
+      const touchesIndex = Object.keys(set ?? {}).some(
+        (f) => indexedFields.has(f)
       );
+      const ttlField = ttlFieldFor(model);
+      const touchesTtl = Boolean(ttlField && set && ttlField in set);
+      if (touchesIndex || touchesTtl) {
+        return guardedWrite(
+          model,
+          id,
+          (existing) => {
+            const clean = stripReserved(existing);
+            const merged = { ...clean, ...set ?? {} };
+            for (const [field, delta] of Object.entries(increment)) {
+              const current = merged[field];
+              merged[field] = (typeof current === "number" ? current : 0) + delta;
+            }
+            return {
+              items: [
+                {
+                  Put: {
+                    TableName: tableName,
+                    Item: {
+                      ...merged,
+                      ...encodeKeys(model, merged, indexMap, assignment),
+                      ...ttlAttributesFor(model, merged),
+                      [REVISION]: randomUUID()
+                    },
+                    ...revisionGuard(existing)
+                  }
+                },
+                ...uniqueMarkerDiff(model, clean, merged, id)
+              ],
+              result: merged
+            };
+          },
+          () => null
+        );
+      }
+      const names = { "#pk": PK, "#rev": REVISION };
+      const values = { ":rev": randomUUID() };
+      const addClauses = [];
+      const setClauses = ["#rev = :rev"];
+      let i = 0;
+      for (const [field, delta] of Object.entries(increment)) {
+        names[`#f${i}`] = field;
+        values[`:v${i}`] = delta;
+        addClauses.push(`#f${i} :v${i}`);
+        i++;
+      }
+      for (const [field, value] of Object.entries(set ?? {})) {
+        names[`#f${i}`] = field;
+        values[`:v${i}`] = value;
+        setClauses.push(`#f${i} = :v${i}`);
+        i++;
+      }
+      const expression = [
+        `SET ${setClauses.join(", ")}`,
+        addClauses.length ? `ADD ${addClauses.join(", ")}` : null
+      ].filter(Boolean).join(" ");
+      try {
+        const res = await doc.send(
+          new UpdateCommand({
+            TableName: tableName,
+            Key: primaryKey(model, id),
+            UpdateExpression: expression,
+            // Without this, `ADD` would happily create the row it was told to
+            // increment, turning "increment an existing counter" into an upsert.
+            ConditionExpression: "attribute_exists(#pk)",
+            ExpressionAttributeNames: names,
+            ExpressionAttributeValues: values,
+            ReturnValues: "ALL_NEW"
+          })
+        );
+        const item = res.Attributes;
+        return isExpired(item) ? null : stripReserved(item);
+      } catch (err) {
+        if (isConditionalCheckFailed(err)) return null;
+        throw err;
+      }
     },
     async queryIndex({ model, index, key, cursor }) {
       const lookup = encodeLookupQuery(model, index, key, indexMap, assignment);
@@ -407,6 +920,7 @@ function createSingleTableStore(opts) {
       return { items, cursor: next };
     },
     async count({ model, index, key }) {
+      if (modelHasTtl(model)) return null;
       let base;
       if (index && key) {
         const lookup = encodeLookupQuery(
@@ -432,10 +946,16 @@ function createSingleTableStore(opts) {
       }
       let total = 0;
       let cursor = void 0;
+      let pages = 0;
       do {
         const page = await query(base, cursor, true);
         total += page.count;
         cursor = page.cursor;
+        if (++pages >= maxPages && cursor) {
+          throw new DynamoDBAdapterError(
+            `better-auth-dynamodb: counting "${model}" exceeded maxPages (${maxPages}) with more pages remaining. Raise maxPages or narrow the query \u2014 returning a partial count would be wrong.`
+          );
+        }
       } while (cursor);
       return total;
     },
@@ -443,7 +963,8 @@ function createSingleTableStore(opts) {
       generateSchemaFile({
         tableName,
         lookupSlots: assignment.maxSlots,
-        file
+        file,
+        ttlAttribute: ttl ? ttlAttribute : void 0
       })
     )
   };
@@ -468,12 +989,18 @@ var dynamoAdapter = (config = {}) => {
       customTransformInput: ({ data, fieldAttributes }) => fieldAttributes.type === "date" && data instanceof Date ? data.toISOString() : data,
       customTransformOutput: ({ data, fieldAttributes }) => fieldAttributes.type === "date" && typeof data === "string" ? new Date(data) : data
     },
-    adapter: ({ schema, debugLog, getDefaultModelName }) => {
+    adapter: ({ schema, debugLog, getDefaultModelName, getFieldName }) => {
       const indexMap = config.indexMap ?? deriveIndexMap(schema);
+      const maxPages = config.maxPages ?? DEFAULT_MAX_PAGES;
       const store = config.store ?? createSingleTableStore({
         tableName: config.tableName,
         region: config.region,
         endpoint: config.endpoint,
+        documentClient: config.documentClient,
+        atomicUniqueness: config.atomicUniqueness,
+        maxPages,
+        pageSize: config.pageSize,
+        ttl: config.ttl,
         indexMap
       });
       const queryAll = async (model, where) => {
@@ -484,6 +1011,12 @@ var dynamoAdapter = (config = {}) => {
         if (plan.kind === "byId") {
           const one = await store.getById(model, plan.id);
           candidates = one ? [one] : [];
+        } else if (plan.kind === "byIds") {
+          const found = await mapBatched(
+            plan.ids,
+            (id) => store.getById(model, id)
+          );
+          candidates = found.filter((item) => item !== null);
         } else if (plan.kind === "index") {
           candidates = await drainPages(
             (cursor) => store.queryIndex({
@@ -491,11 +1024,20 @@ var dynamoAdapter = (config = {}) => {
               index: plan.index,
               key: plan.key,
               cursor
-            })
+            }),
+            maxPages,
+            `index query on "${model}"`
           );
         } else {
+          if (!config.unsafeAllowScan) {
+            throw new UnsupportedQueryError(
+              `better-auth-dynamodb: no index can serve this query on "${model}" (${describeWhere(clauses)}), so it would have to read every row of the model and filter in memory. Add the field to the index map \u2014 or to the Better Auth schema as \`unique\`, \`references\`, or \`index: true\` \u2014 or set \`unsafeAllowScan: true\` to accept the cost.`
+            );
+          }
           candidates = await drainPages(
-            (cursor) => store.listByType({ model, cursor })
+            (cursor) => store.listByType({ model, cursor }),
+            maxPages,
+            `model scan of "${model}"`
           );
         }
         return candidates.filter(
@@ -504,10 +1046,21 @@ var dynamoAdapter = (config = {}) => {
       };
       const resolveId = async (model, where) => {
         const plan = planQuery(model, where, indexMap);
-        if (plan.kind === "byId") return plan.id;
+        if (plan.kind === "byId" && plan.residual.length === 0) return plan.id;
         const [first] = await queryAll(model, where);
         return first ? String(first.id) : null;
       };
+      const project = (model, items, select) => {
+        if (!select?.length) return items;
+        const stored = select.map((field) => getFieldName({ model, field }));
+        return items.map((item) => {
+          const picked = {};
+          for (const field of stored) {
+            if (field in item) picked[field] = item[field];
+          }
+          return picked;
+        });
+      };
       return {
         async create({
           model,
@@ -563,10 +1116,11 @@ var dynamoAdapter = (config = {}) => {
         },
         async findOne({
           model,
-          where
+          where,
+          select
         }) {
           const m = getDefaultModelName(model);
-          const [first] = await queryAll(m, where);
+          const [first] = project(m, await queryAll(m, where), select);
           return first ?? null;
         },
         async findMany({
@@ -574,13 +1128,18 @@ var dynamoAdapter = (config = {}) => {
           where,
           limit,
           sortBy,
-          offset
+          offset,
+          select
         }) {
           const m = getDefaultModelName(model);
-          const items = applyWindow(
-            applySort(await queryAll(m, where), sortBy),
-            offset,
-            limit
+          const items = project(
+            m,
+            applyWindow(
+              applySort(await queryAll(m, where), sortBy),
+              offset,
+              limit
+            ),
+            select
           );
           return items;
         },
@@ -592,13 +1151,57 @@ var dynamoAdapter = (config = {}) => {
           const clauses = where ?? [];
           const plan = planQuery(m, clauses, indexMap);
           if (plan.residual.length === 0 && store.count) {
-            const fast = await store.count(
-              plan.kind === "index" ? { model: m, index: plan.index, key: plan.key } : { model: m }
-            );
-            if (fast != null) return fast;
+            if (plan.kind === "index") {
+              const fast = await store.count({
+                model: m,
+                index: plan.index,
+                key: plan.key
+              });
+              if (fast != null) return fast;
+            } else if (plan.kind === "listByType") {
+              const fast = await store.count({ model: m });
+              if (fast != null) return fast;
+            }
           }
           return (await queryAll(m, clauses)).length;
         },
+        async consumeOne({
+          model,
+          where
+        }) {
+          const m = getDefaultModelName(model);
+          const id = await resolveId(m, where);
+          if (!id) return null;
+          if (store.consumeOne)
+            return await store.consumeOne(m, id);
+          const item = await store.getById(m, id);
+          if (!item) return null;
+          await store.deleteById(m, id);
+          return item;
+        },
+        async incrementOne({
+          model,
+          where,
+          increment,
+          set
+        }) {
+          const m = getDefaultModelName(model);
+          const id = await resolveId(m, where);
+          if (!id) return null;
+          if (store.incrementOne) {
+            return await store.incrementOne(m, id, {
+              increment,
+              set
+            });
+          }
+          const current = await store.getById(m, id);
+          if (!current) return null;
+          const patch = { ...set };
+          for (const [field, delta] of Object.entries(increment)) {
+            patch[field] = (Number(current[field]) || 0) + delta;
+          }
+          return await store.update(m, id, patch);
+        },
         ...store.createSchema ? {
           createSchema: (props) => store.createSchema(props)
         } : {}
@@ -606,12 +1209,28 @@ var dynamoAdapter = (config = {}) => {
     }
   });
 };
+function describeWhere(where) {
+  if (where.length === 0) return "no where clause";
+  return where.map((w) => `${w.field} ${w.operator}`).join(", ");
+}
+async function mapBatched(items, op, chunkSize = 10) {
+  const out = [];
+  for (let i = 0; i < items.length; i += chunkSize) {
+    out.push(...await Promise.all(items.slice(i, i + chunkSize).map(op)));
+  }
+  return out;
+}
 async function runBatched(items, op, chunkSize = 10) {
   for (let i = 0; i < items.length; i += chunkSize) {
     await Promise.all(items.slice(i, i + chunkSize).map(op));
   }
 }
 export {
+  DEFAULT_TTL_ATTRIBUTE,
+  DynamoDBAdapterError,
+  OptimisticLockError,
+  UniqueConstraintError,
+  UnsupportedQueryError,
   assignSlots,
   buildTableDefinition,
   createSingleTableStore,
@@ -619,7 +1238,11 @@ export {
   dynamoAdapter,
   ensureSchema,
   generateSchemaFile,
+  isConditionalCheckFailed,
+  isConditionalTransactionCanceled,
+  isTransactionCanceled,
   matchesResidual,
-  planQuery
+  planQuery,
+  transactionCancellationCodes
 };
 //# sourceMappingURL=index.js.map