v0.3.0

Bug Fixes

• atprotoState.expiresAt now stored as a date instead of a raw epoch-millisecond number. This aligns with better-auth's own idiomatic handling of ephemeral tokens (e.g. verification.expiresAt) and maps to proper timestamp columns across dialects (SQLite date, Postgres timestamptz, MySQL timestamp(3)). The state store now normalizes both Date and legacy number values when reading.
• atprotoSession.userId is now nullable. During the OAuth flow a temporary session row is created before the user is identified. Previously this inserted an empty-string userId, which violated the NOT NULL + foreign-key constraint on Postgres and surfaced as CALLBACK_FAILED. The temp row now inserts null and is back-filled with the real userId in the callback handler once the user is resolved.

Maintenance

• Bumped hono (devDependency, used only in the demo) to 4.13.2, resolving 6 Dependabot advisories.
• Bumped SHA-pinned GitHub Actions: actions/checkout v7.0.1, actions/setup-node v7.0.0.

Migration

Fresh installs need nothing — the schema is generated correctly.

Existing deployments require a one-time manual migration. better-auth's auto-migration only adds missing tables/columns; it does not alter the type or nullability of existing columns (it only logs a warning). Run the following once against your database.

atprotoState is ephemeral (~10 min TTL), so dropping its rows is safe.

PostgreSQL

DELETE FROM "atprotoState";
ALTER TABLE "atprotoState"
  ALTER COLUMN "expiresAt" TYPE timestamptz USING to_timestamp("expiresAt" / 1000.0);
ALTER TABLE "atprotoSession"
  ALTER COLUMN "userId" DROP NOT NULL;

MySQL

DELETE FROM `atprotoState`;
ALTER TABLE `atprotoState`
  MODIFY COLUMN `expiresAt` TIMESTAMP(3) NULL;
ALTER TABLE `atprotoSession`
  MODIFY COLUMN `userId` VARCHAR(255) NULL;

SQLite

SQLite stores dates as timestamps and does not enforce a separate column type here, so only the nullability of userId matters. If your adapter created userId as NOT NULL, recreate the table (SQLite cannot drop a NOT NULL constraint via ALTER):

DELETE FROM "atprotoState";
-- Recreate atprotoSession with a nullable userId if it was NOT NULL.
-- Adjust column list to match your generated schema before running.

Full Changelog: v0.2.0...v0.3.0

v0.2.0

What's Changed

Dependencies

• @atcute/identity-resolver: 1.2.2 → 2.0.0
• @atcute/lexicons: 1.3.0 → 2.0.0
• @atcute/oauth-node-client: 1.1.0 → 2.0.0
• better-auth: 1.6.7 → 1.6.11
• hono: 4.12.16 → 4.12.23
• valibot: 1.3.1 → 1.4.1
• vite: 8.0.9 → 8.0.14
• vitest: 4.1.5 → 4.1.7
• oxlint: 1.61.0 → 1.67.0
• oxfmt: 0.46.0 → 0.52.0
• tsdown: 0.21.9 → 0.22.0
• bumpp: 11.0.1 → 11.1.0
• oxlint-tsgolint: 0.21.1 → 0.23.0

Note

The @atcute/* packages have been upgraded to v2. This is a minor version bump for better-auth-bsky as the underlying AT Protocol OAuth client library has changed major versions.

v0.1.9

What's Changed

Update all dependencies to their latest versions.

Notable major bumps

• TypeScript 5.x → 6.0.3
• Vite 6.x → 8.0.9
• Vitest 2.x → 4.1.5
• oxlint 1.57 → 1.61, oxfmt 0.42 → 0.46
• better-auth 1.5.x → 1.6.7
• @ATCUTE packages to latest minors

No code changes required — build, lint, and all 63 tests pass cleanly.

v0.1.8

What's Changed

• Bundle valibot instead of shipping as a runtime dependency — valibot (~2MB on disk) is now inlined into the build output, reducing the install footprint to just the ~8kb of code actually used. (Closes #1)
• Upgrade tsdown to v0.21.9 — Migrated from deprecated external option to the new deps namespace (deps.neverBundle, deps.onlyBundle). Fixes CI type-checking failure from v0.1.7.

Details

• Moved valibot from dependencies to devDependencies
• Configured deps.onlyBundle: ["valibot"] in tsdown to inline valibot into the bundle
• Configured deps.neverBundle with regex patterns for better-auth, better-call, @better-fetch/*, and @atcute/*
• No API changes — this is a transparent build optimization

v0.1.7

What's Changed

• Bundle valibot instead of shipping as a runtime dependency — valibot (~2MB on disk) is now inlined into the build output via tsdown's deps.onlyBundle, reducing the install footprint to just the ~8kb of code actually used. (#1)

Details

• Moved valibot from dependencies to devDependencies
• Added deps: { onlyBundle: ["valibot"] } to tsdown.config.ts
• No API changes — this is a transparent build optimization