@protobase/server 0.66.6 → 0.66.7

package/dist/assistant/delete-record-tool.d.ts

@@ -1,6 +1,6 @@
 import { AssistantTool, ToolContext } from "./tools.js";
 import { WriteRecordToolsInput } from "./write-tool-limits.js";
 //#region src/assistant/delete-record-tool.d.ts
-/** Deletes one record by its key and ETag once the user approves it, under the caller's access rules. */
+/** Deletes one record by its key, and its ETag when given, once the user approves it, under the caller's access rules. */
 export declare const deleteRecordTool: (input?: WriteRecordToolsInput) => AssistantTool<ToolContext>;
 //#endregion

package/dist/assistant/delete-record-tool.js

@@ -21,12 +21,15 @@ const deleteKeyOf = (value) => {
 	if (key === void 0) return void 0;
 	return (Array.isArray(key) ? key : [key]).every(keyPartOk) ? key : void 0;
 };
-const etagOf = (value) => typeof value === "string" && /^"[\x21\x23-\x2b\x2d-\x7e]+"$/.test(value) ? value : void 0;
-const usage = "Pass only the resource, key and etag as { \"resource\": \"<name>\", \"key\": \"<key>\", \"etag\": \"<the etag get_record gave>\" }; nothing was deleted.";
-/** Deletes one record by its key and ETag once the user approves it, under the caller's access rules. */
+const etagOf = (value) => {
+	if (value === void 0 || value === "*") return { etag: value };
+	return typeof value === "string" && /^"[\x21\x23-\x2b\x2d-\x7e]+"$/.test(value) ? { etag: value } : false;
+};
+const usage = "Pass only the resource, key and, optionally, etag as { \"resource\": \"<name>\", \"key\": \"<key>\", \"etag\": \"<the etag get_record gave>\" }; nothing was deleted.";
+/** Deletes one record by its key, and its ETag when given, once the user approves it, under the caller's access rules. */
 const deleteRecordTool = (input = {}) => defineTool({
 	name: "delete_record",
-	description: `Deletes one record of a resource by its key. Pass the etag get_record gave: it fails when someone changed the record since. A resource that soft deletes keeps the record, deleted; any other loses it for good. The user approves each delete in their client first; nothing is deleted without it.${onlyNote(input)}`,
+	description: `Deletes one record of a resource by its key. Pass the etag get_record gave to fail when someone changed the record since; without one, or with *, it deletes the record whatever its version. A resource that soft deletes keeps the record, deleted; any other loses it for good. The user approves each delete in their client first; nothing is deleted without it.${onlyNote(input)}`,
 	parameters: {
 		type: "object",
 		properties: {
@@ -37,11 +40,7 @@ const deleteRecordTool = (input = {}) => defineTool({
 				description: "The etag get_record gave, to fail when the record changed since."
 			}
 		},
-		required: [
-			"resource",
-			"key",
-			"etag"
-		],
+		required: ["resource", "key"],
 		additionalProperties: false
 	},
 	annotations: {
@@ -52,12 +51,13 @@ const deleteRecordTool = (input = {}) => defineTool({
 	run: async (args, context) => {
 		const resource = resourceOf(args);
 		const key = deleteKeyOf(args.key);
-		const etag = etagOf(args.etag);
-		if (!resource || key === void 0 || !etag || Object.keys(args).some((name) => !parameterNames.includes(name))) return usage;
+		const given = etagOf(args.etag);
+		if (!resource || key === void 0 || !given || Object.keys(args).some((name) => !parameterNames.includes(name))) return usage;
 		const refusal = outside(input, resource);
 		if (refusal) return refusal;
 		const softDelete = await context.records.softDeleteField(resource).then((field) => ({ field }), refused);
 		if (typeof softDelete === "string") return softDelete;
+		const { etag } = given;
 		const before = await recordBefore(context, resource, key, etag);
 		if (typeof before === "string") return before;
 		const { text, described } = await approvalTexts(context, resource);

package/dist/better-auth/auth-mail/auth-emails.d.ts

@@ -2,6 +2,7 @@ import "./account-exists-email.js";
 import "./change-email-code-email.js";
 import "./invitation-email.js";
 import "./no-account-email.js";
+import "./password-changed-email.js";
 import "./reset-password-email.js";
 import "./sign-in-code-email.js";
 import "./sign-up-code-email.js";

package/dist/better-auth/auth-mail/auth-emails.js

@@ -2,9 +2,10 @@ import { accountExistsEmail } from "./account-exists-email.js";
 import { changeEmailCodeEmail } from "./change-email-code-email.js";
 import { invitationEmail } from "./invitation-email.js";
 import { noAccountEmail } from "./no-account-email.js";
+import { passwordChangedEmail } from "./password-changed-email.js";
 import { resetPasswordEmail } from "./reset-password-email.js";
 import { signInCodeEmail } from "./sign-in-code-email.js";
 import { signUpCodeEmail } from "./sign-up-code-email.js";
 import { staffSignInEmail } from "./staff-sign-in-email.js";
 import { twoFactorCodeEmail } from "./two-factor-code-email.js";
-export { accountExistsEmail, changeEmailCodeEmail, invitationEmail, noAccountEmail, resetPasswordEmail, signInCodeEmail, signUpCodeEmail, staffSignInEmail, twoFactorCodeEmail };
+export { accountExistsEmail, changeEmailCodeEmail, invitationEmail, noAccountEmail, passwordChangedEmail, resetPasswordEmail, signInCodeEmail, signUpCodeEmail, staffSignInEmail, twoFactorCodeEmail };

package/dist/better-auth/auth-mail/password-changed-email.d.ts

@@ -0,0 +1 @@
+import "../../index.js";

package/dist/better-auth/auth-mail/password-changed-email.js

@@ -0,0 +1,32 @@
+import { defineEmail } from "../../mail/define-email.js";
+import { EmailButton, EmailLayout, EmailNote } from "../../mail/email-layout.js";
+import { signInPath } from "@protobase/schema";
+import { Text } from "react-email";
+import { jsx, jsxs } from "react/jsx-runtime";
+//#region src/better-auth/auth-mail/password-changed-email.tsx
+const PasswordChangedEmail = ({ app }) => /* @__PURE__ */ jsxs(EmailLayout, {
+	app,
+	preview: `The password of your ${app.name} account was changed`,
+	heading: "Your password was changed",
+	children: [
+		/* @__PURE__ */ jsxs(Text, { children: [
+			"The password of your account with ",
+			app.name,
+			" was just changed."
+		] }),
+		/* @__PURE__ */ jsx(Text, { children: "If this was not you, choose a new password at once with \"Forgot password?\" on the sign-in page:" }),
+		/* @__PURE__ */ jsx(EmailButton, {
+			href: new URL(signInPath({ step: "forgot-password" }), app.url).href,
+			children: "Choose a new password"
+		}),
+		/* @__PURE__ */ jsx(EmailNote, { children: "If this was you, ignore this email." })
+	]
+});
+/** The email to an account whose password changed: what happened, and how to take the account back if it was not them. */
+const passwordChangedEmail = defineEmail({
+	name: "password-changed",
+	subject: ({ app }) => `Your ${app.name} password was changed`,
+	component: PasswordChangedEmail
+});
+//#endregion
+export { passwordChangedEmail };

package/dist/better-auth/auth-settings.d.ts

@@ -1009,8 +1009,8 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
           $Infer: {
             body: {
               permissions: {
-                readonly user?: ("create" | "update" | "delete" | "list" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
-                readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                readonly user?: ("list" | "create" | "update" | "delete" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
+                readonly session?: ("list" | "delete" | "revoke")[] | undefined;
               };
             } & {
               userId?: string | undefined;
@@ -4463,6 +4463,14 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-password-checks";
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-set-password";
     endpoints: {
@@ -4498,6 +4506,32 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
         status: boolean;
       }>;
     };
+  } | {
+    id: "protobase-password-change";
+    endpoints: {
+      passwordChanged: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          email: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        status: boolean;
+      }>;
+    };
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          context: {
+            body: any;
+          };
+        } | undefined>>;
+      }[];
+      after: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-leaked-passwords";
     hooks: {

package/dist/better-auth/create-auth.d.ts

@@ -1141,8 +1141,8 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
           $Infer: {
             body: {
               permissions: {
-                readonly user?: ("create" | "update" | "delete" | "list" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
-                readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                readonly user?: ("list" | "create" | "update" | "delete" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
+                readonly session?: ("list" | "delete" | "revoke")[] | undefined;
               };
             } & {
               userId?: string | undefined;
@@ -2914,7 +2914,10 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
           email: string;
           emailVerified: boolean;
           name: string;
-          image?: string | null | undefined;
+          image? /**
+           * The secrets the app had before `secret`, newest first, such as `PROTOBASE_PREVIOUS_SECRETS`: what they encrypted
+           * still decrypts, so the signing keys keep signing after the secret changes. Default none.
+           */ : string | null | undefined;
         } & Record<string, any>;
       } | {
         status: boolean;
@@ -3099,7 +3102,11 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image? /**
+               * Refuses a new password that appears in a known data breach, by Have I Been Pwned's password list: at sign-up, from
+               * an invitation, and when a password is set, changed, reset or given by an admin. Only the first five characters of
+               * the password's SHA-1 hash leave the server. While the list cannot be reached, setting a password fails. Default off.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -4117,7 +4124,9 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent?
+              /** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */
+              /** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -4591,6 +4600,14 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-password-checks";
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-set-password";
     endpoints: {
@@ -4626,6 +4643,32 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         status: boolean;
       }>;
     };
+  } | {
+    id: "protobase-password-change";
+    endpoints: {
+      passwordChanged: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          email: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        status: boolean;
+      }>;
+    };
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          context: {
+            body: any;
+          };
+        } | undefined>>;
+      }[];
+      after: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-leaked-passwords";
     hooks: {
@@ -5091,7 +5134,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         member: import("better-auth/plugins").Member & Record<string, any>;
       }) => Promise<void | {
         data: {
-          name?: string;
+          name? /** Runs after a user is created, by any route: `createUser`, an admin, or a social sign-up. Default none. */ : string;
           slug?: string;
           logo?: string | null;
           metadata?: Record<string, any>;
@@ -8968,7 +9011,8 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
 }> & {
   /**
    * Answers a request from the app's iOS or Android build: Better Auth also trusts the Capacitor origin the request
-   * names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin.
+   * names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin. A
+   * Capacitor origin's POST without a JSON body is refused before it is granted, as only a page sends one.
    */
   handleMobile: (request: Request) => Promise<Response>;
   /**

package/dist/better-auth/create-auth.js

@@ -13,13 +13,14 @@ import { endReplacedSession } from "./end-replaced-session.js";
 import { authBasePath } from "./auth-base-path.js";
 import { authLogger } from "./auth-logger.js";
 import { cookiePrefixOf } from "./cookie-prefix.js";
-import { mobileRequests } from "./mobile-requests.js";
+import { jsonOnlyOnMobile, mobileRequests } from "./mobile-requests.js";
 import { passwordLength } from "./new-account-password.js";
 import { platformMailer } from "../mail/platform-mailer.js";
 import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
 import { defaultInvitationUrl } from "./invitations/invitation-link-hook.js";
 import { lastAdminGuardPlugin } from "./last-admin-guard.js";
 import { setPasswordPath, setPasswordPlugin } from "./set-password.js";
+import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
 import { leakedPasswordsPlugin } from "./leaked-passwords.js";
 import { lockedAccountsPlugin, readLockedAccounts } from "./locked-accounts.js";
@@ -35,6 +36,8 @@ import { passkeyHosts, readPasskeyDomain, resolvePasskeyDomain } from "./passkey
 import { coreNames, pluginNames } from "./snake-case-names.js";
 import { passkeyPlugin } from "./passkey-plugin.js";
 import { passwordResetOptions } from "./password-reset.js";
+import { mailPasswordChanged, passwordChangePlugin } from "./password-change.js";
+import { passwordChecksPlugin } from "./password-checks.js";
 import { rolesPlugin } from "./roles/roles-plugin.js";
 import { versionedSecrets } from "./secret-versions.js";
 import { signingKeyRotation, signingKeys } from "./signing-keys.js";
@@ -43,7 +46,6 @@ import { appSignInPolicy } from "./app-sign-in-policy.js";
 import { assertNoEndpointKeyClashes } from "./endpoint-key-clashes.js";
 import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin } from "./saml-sign-in.js";
 import { noAccountMailPlugin } from "./no-account-mail.js";
-import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { confirmedOnCreate, confirmedOnUpdate, emailConfirmedField } from "./email-confirmed.js";
 import { rehashPasswordsPlugin, verifyAcceptedHash } from "./password-hashes.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
@@ -177,7 +179,11 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			minPasswordLength: passwordLength.min,
 			maxPasswordLength: passwordLength.max,
 			...passwordHashes.length > 0 && { password: { verify: verifyAcceptedHash(passwordHashes) } },
-			...mail && passwordResetOptions(mail, mcp ? { onPasswordReset: async ({ user }) => revokeMcpGrants((await context()).adapter, user.id) } : {})
+			...mail && passwordResetOptions(mail, { onPasswordReset: async ({ user }) => {
+				const auth = await context();
+				if (mcp) await revokeMcpGrants(auth.adapter, user.id);
+				await mailPasswordChanged({ context: auth }, mail, user.email);
+			} })
 		},
 		...options.socialProviders && { socialProviders: options.socialProviders },
 		user: {
@@ -222,7 +228,9 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
 			...saml.length > 0 ? [loaded(plugins.samlPlugin, "sso.saml")(saml, options.baseURL), samlGuardPlugin(samlIds)] : [],
 			signInPolicyPlugin(policy),
+			passwordChecksPlugin(),
 			setPasswordPlugin(),
+			passwordChangePlugin(mail),
 			...options.leakedPasswords ? [leakedPasswordsPlugin()] : [],
 			goTrueSessionsPlugin({
 				issuer: goTrueIssuer(options.baseURL),
@@ -412,9 +420,10 @@ const createAuth = (options, plugins = {}) => {
 	return Object.assign(auth, {
 		/**
 		* Answers a request from the app's iOS or Android build: Better Auth also trusts the Capacitor origin the request
-		* names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin.
+		* names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin. A
+		* Capacitor origin's POST without a JSON body is refused before it is granted, as only a page sends one.
 		*/
-		handleMobile: (request) => auth.handler(mobile.grant(request)),
+		handleMobile: async (request) => jsonOnlyOnMobile(request) ?? auth.handler(mobile.grant(request)),
 		/**
 		* What runs when a user is deleted: `set` a named listener that removes what the app keeps of the user elsewhere,
 		* such as their devices; `run` is for a deletion outside Better Auth's endpoints (`deleteUser`).

package/dist/better-auth/mcp/revoke-grants.js

@@ -28,7 +28,11 @@ const revokeMcpGrants = async (adapter, userId, clientId) => {
 		where
 	});
 };
-const ownPaths = ["/revoke-sessions", "/revoke-other-sessions"];
+const ownPaths = [
+	"/revoke-sessions",
+	"/revoke-other-sessions",
+	"/change-password"
+];
 const adminPaths = [
 	"/admin/revoke-user-sessions",
 	"/admin/ban-user",
@@ -42,14 +46,14 @@ const securesAccount = (data) => {
 };
 /**
 * The user whose MCP grants a finished request ends, or `undefined`: the person who signed out everywhere, signed out
-* their other devices, or changed their password signing out the other devices; the user an admin ended the sessions
+* their other devices, or changed their password; the user an admin ended the sessions
 * of, banned, set the password of, or marked unverified. Nobody when the request failed.
 */
 const grantOwnerToRevoke = (request) => {
 	const { path, context } = request;
 	if (context.returned instanceof Error || path === void 0) return void 0;
 	const body = bodyOf(request);
-	if (ownPaths.includes(path) || path === "/change-password" && body.revokeOtherSessions === true) return context.session?.user.id;
+	if (ownPaths.includes(path)) return context.session?.user.id;
 	if (adminPaths.includes(path) || path === "/admin/update-user" && securesAccount(body.data)) return body.userId === void 0 ? void 0 : String(body.userId);
 };
 /**
@@ -62,7 +66,6 @@ const mcpGrantRevocation = () => ({
 		matcher: (context) => context.path !== void 0 && [
 			...ownPaths,
 			...adminPaths,
-			"/change-password",
 			"/admin/update-user"
 		].includes(context.path),
 		handler: createAuthMiddleware(async (ctx) => {

package/dist/better-auth/mobile-requests.js

@@ -1,5 +1,9 @@
 import { capacitorOrigins } from "../mobile-config.js";
 //#region src/better-auth/mobile-requests.ts
+const capacitorOriginOf = (request) => {
+	const origin = request.headers.get("origin");
+	return origin !== null && capacitorOrigins.includes(origin);
+};
 /**
 * Which requests come from the app's iOS or Android build: `grant` marks a request, and `trusted` gives the Capacitor
 * origin it names as an origin Better Auth trusts, for that very request only. Any other request, or an Origin that is
@@ -14,10 +18,26 @@ const mobileRequests = () => {
 		},
 		trusted: (request) => {
 			if (!request || !granted.has(request)) return [];
-			const origin = request.headers.get("origin");
-			return origin !== null && capacitorOrigins.includes(origin) ? [origin] : [];
+			return capacitorOriginOf(request) ? [request.headers.get("origin")] : [];
 		}
 	};
 };
+const mediaType = (request) => request.headers.get("content-type")?.split(";")[0].trim().toLowerCase();
+/**
+* Refuses a POST from a Capacitor origin whose body is not JSON. A page can send a form, `text/plain` or multipart POST
+* without a preflight, but not a JSON one, and `/api/auth` answers no preflight: so the grant only ever sees requests
+* the app's native HTTP sends. A request from any other origin is left alone, such as an identity provider's form POST.
+*/
+const jsonOnlyOnMobile = (request) => {
+	if (request.method !== "POST" || !capacitorOriginOf(request)) return;
+	if (mediaType(request) === "application/json") return;
+	return new Response(JSON.stringify({
+		message: "A request from the app takes a JSON body only",
+		code: "UNSUPPORTED_MEDIA_TYPE"
+	}), {
+		status: 415,
+		headers: { "content-type": "application/json" }
+	});
+};
 //#endregion
-export { mobileRequests };
+export { jsonOnlyOnMobile, mobileRequests };

package/dist/better-auth/password-change.js

@@ -0,0 +1,68 @@
+import { setPasswordPath } from "./set-password.js";
+import { sendAuthEmail } from "./auth-mail/send-auth-email.js";
+import * as z$1 from "zod";
+import { APIError, createAuthEndpoint, createAuthMiddleware } from "better-auth/api";
+//#region src/better-auth/password-change.ts
+/**
+* Mails `email` that its account's password changed, when the app has mail: in the background, as Better Auth sends
+* its own mail, so the answer does not wait on the mail server.
+*/
+const mailPasswordChanged = async (ctx, mail, email) => {
+	if (!mail) return;
+	await ctx.context.runInBackgroundOrAwait(sendAuthEmail(mail, "passwordChangedEmail", email, {}, ctx.context.baseURL));
+};
+const ownChanges = ["/change-password", setPasswordPath];
+const adminChange = "/admin/set-user-password";
+/** Whose account a finished request gave a new password: the address of the person, or the id of the user an admin set it for. */
+const changedAccount = ({ path, body, context }) => {
+	if (context.returned instanceof Error || path === void 0) return;
+	if (ownChanges.includes(path)) return context.session ? { email: context.session.user.email } : void 0;
+	const userId = typeof body === "object" && body !== null ? body.userId : void 0;
+	if (path === adminChange && userId !== void 0) return { userId: String(userId) };
+};
+/**
+* A password change ends the account's other sessions and tells its owner:
+* - `/change-password` always signs out the other devices, whatever `revokeOtherSessions` says: this device gets a
+*   new session, and the MCP grant revocation disconnects the account's MCP clients.
+* - When the app has mail, the owner is emailed after `/change-password`, a first password (`/account/set-password`)
+*   and an admin's `/admin/set-user-password`; `passwordChanged` mails them for a change outside these endpoints,
+*   such as the GoTrue-compatible `PUT /user`. A password reset mails them from `onPasswordReset`.
+*/
+const passwordChangePlugin = (mail) => ({
+	id: "protobase-password-change",
+	endpoints: { passwordChanged: createAuthEndpoint.serverOnly({
+		method: "POST",
+		body: z$1.object({ email: z$1.string() })
+	}, async (ctx) => {
+		await mailPasswordChanged(ctx, mail, ctx.body.email);
+		return ctx.json({ status: true });
+	}) },
+	hooks: {
+		before: [{
+			matcher: (ctx) => ctx.path === "/change-password",
+			handler: createAuthMiddleware(async (ctx) => {
+				if (typeof ctx.body !== "object" || ctx.body === null) return;
+				return { context: { body: {
+					...ctx.body,
+					revokeOtherSessions: true
+				} } };
+			})
+		}],
+		after: [{
+			matcher: (ctx) => ctx.path !== void 0 && [...ownChanges, adminChange].includes(ctx.path),
+			handler: createAuthMiddleware(async (ctx) => {
+				const changed = changedAccount(ctx);
+				if (!changed || !mail) return;
+				if ("email" in changed) {
+					await mailPasswordChanged(ctx, mail, changed.email);
+					return;
+				}
+				const user = await ctx.context.internalAdapter.findUserById(changed.userId);
+				if (!user) throw new APIError("NOT_FOUND", { message: "The user whose password was set is gone" });
+				await mailPasswordChanged(ctx, mail, user.email);
+			})
+		}]
+	}
+});
+//#endregion
+export { changedAccount, mailPasswordChanged, passwordChangePlugin };

package/dist/better-auth/password-checks.js

@@ -0,0 +1,69 @@
+import { APIError, createAuthMiddleware, getSessionFromCtx } from "better-auth/api";
+const maxTrackedAccounts = 1e4;
+const checkedFields = {
+	"/change-password": "currentPassword",
+	"/verify-password": "password",
+	"/delete-user": "password",
+	"/two-factor/enable": "password",
+	"/two-factor/disable": "password",
+	"/two-factor/get-totp-uri": "password",
+	"/two-factor/generate-backup-codes": "password"
+};
+/**
+* Counts the checks of each account in a fixed window that opens at its first check: `take` answers how many seconds
+* the account waits before its next check, or `undefined` when this one may go ahead and is counted. Bounded: a window
+* that ended is dropped, and at `maxTracked` accounts the oldest window is dropped.
+*/
+const checkCounter = ({ max, windowSeconds, maxTracked = maxTrackedAccounts, now = Date.now }) => {
+	const windows = /* @__PURE__ */ new Map();
+	const windowMs = windowSeconds * 1e3;
+	const prune = (at) => {
+		for (const [key, window] of windows) if (at - window.opened >= windowMs) windows.delete(key);
+		while (windows.size >= maxTracked) windows.delete(windows.keys().next().value);
+	};
+	return { take: (key) => {
+		const at = now();
+		const window = windows.get(key);
+		if (window && at - window.opened < windowMs) {
+			if (window.count >= max) return Math.ceil((window.opened + windowMs - at) / 1e3);
+			window.count += 1;
+			return;
+		}
+		windows.delete(key);
+		prune(at);
+		windows.set(key, {
+			opened: at,
+			count: 1
+		});
+	} };
+};
+/**
+* Limits the current-password checks behind a session to `passwordChecksPerWindow` an account a minute, on top of
+* Better Auth's limit per client address, so a stolen session cannot guess the password from many addresses. Every
+* check counts, a right one too, and is counted before the password is compared, so requests sent at once cannot pass
+* the limit together. A refused check answers `429 TOO_MANY_PASSWORD_CHECKS`, with `X-Retry-After` in seconds. A
+* request without a session is left to the endpoint, which refuses it. The count lives in this process's memory.
+*/
+const passwordChecksPlugin = (counter = checkCounter({
+	max: 5,
+	windowSeconds: 60
+})) => ({
+	id: "protobase-password-checks",
+	hooks: { before: [{
+		matcher: (ctx) => ctx.path !== void 0 && Object.hasOwn(checkedFields, ctx.path),
+		handler: createAuthMiddleware(async (ctx) => {
+			const password = ctx.body?.[checkedFields[ctx.path]];
+			if (typeof password !== "string" || password === "") return;
+			const session = await getSessionFromCtx(ctx);
+			if (!session) return;
+			const wait = counter.take(session.user.id);
+			if (wait === void 0) return;
+			throw new APIError("TOO_MANY_REQUESTS", {
+				code: "TOO_MANY_PASSWORD_CHECKS",
+				message: "Too many password attempts. Try again in a minute."
+			}, { "X-Retry-After": String(wait) });
+		})
+	}] }
+});
+//#endregion
+export { checkCounter, passwordChecksPlugin };

package/dist/better-auth/password-reset.js

@@ -5,7 +5,8 @@ const resetLinkLifetimeSeconds = 3600;
 const resetLinkLifetime = "1 hour";
 /**
 * Better Auth's own password reset, sending the link with `mail`. Resetting ends the user's sessions, so a reset
-* after a leaked password also signs out whoever used it, and `onPasswordReset` disconnects the user's MCP clients.
+* after a leaked password also signs out whoever used it, and `onPasswordReset` disconnects the user's MCP clients
+* and tells them their password changed.
 */
 const passwordResetOptions = (mail, { onPasswordReset } = {}) => ({
 	resetPasswordTokenExpiresIn: resetLinkLifetimeSeconds,

package/dist/better-auth/sign-in-mail.js

@@ -1,6 +1,9 @@
 import { sendAuthEmail } from "./auth-mail/send-auth-email.js";
-const codeLifetimeMinutes = 10;
-const codeLifetime = "10 minutes";
+import { emailCodeMinutes } from "@protobase/schema/internal";
+//#region src/better-auth/sign-in-mail.ts
+/** How long an emailed code works: in seconds for the sign-in code, and in the email's words. */
+const codeLifetimeSeconds = emailCodeMinutes * 60;
+const codeLifetime = `${emailCodeMinutes} minutes`;
 /**
 * Better Auth's email OTP plugin for signing in and changing the address: never a sign-up, codes stored hashed, sent
 * with `mail`. A new address gets its own email, with the code that moves the account to it. The plugin's other uses
@@ -8,7 +11,7 @@ const codeLifetime = "10 minutes";
 */
 const emailCodeOptions = (mail) => ({
 	disableSignUp: true,
-	expiresIn: 600,
+	expiresIn: codeLifetimeSeconds,
 	storeOTP: "hashed",
 	changeEmail: { enabled: true },
 	sendVerificationOTP: ({ email, otp, type }, ctx) => sendAuthEmail(mail, type === "change-email" ? "changeEmailCodeEmail" : "signInCodeEmail", email, {
@@ -26,7 +29,7 @@ const unusedEmailCodePaths = [
 ];
 /** The two-factor plugin's emailed code, sent with `mail`; stored hashed. */
 const twoFactorCodeOptions = (mail) => ({
-	period: codeLifetimeMinutes,
+	period: emailCodeMinutes,
 	storeOTP: "hashed",
 	sendOTP: ({ user, otp }, ctx) => sendAuthEmail(mail, "twoFactorCodeEmail", user.email, {
 		code: otp,
@@ -34,4 +37,4 @@ const twoFactorCodeOptions = (mail) => ({
 	}, ctx?.context.baseURL)
 });
 //#endregion
-export { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths };
+export { codeLifetime, codeLifetimeSeconds, emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths };

package/dist/better-auth/sign-up/sign-up-code.js

@@ -1,5 +1,6 @@
+import { codeLifetimeSeconds } from "../sign-in-mail.js";
 import { APIError } from "better-auth/api";
-const signUpCodeLifetime = "10 minutes";
+//#region src/better-auth/sign-up/sign-up-code.ts
 const allowedAttempts = 3;
 const identifierOf = (email) => `sign-up-otp-${email}`;
 /** The SHA-256 of `secret`, base64: what the store keeps of a code or a ticket. */
@@ -26,7 +27,7 @@ const issueSignUpCode = async (context, email) => {
 	await context.internalAdapter.createVerificationValue({
 		identifier,
 		value: `${await hashOf(code)}:0`,
-		expiresAt: new Date(Date.now() + 6e5)
+		expiresAt: new Date(Date.now() + codeLifetimeSeconds * 1e3)
 	});
 	return code;
 };
@@ -50,4 +51,4 @@ const consumeSignUpCode = async (context, email, code) => {
 	throw invalidCode();
 };
 //#endregion
-export { consumeSignUpCode, hashOf, issueSignUpCode, signUpCodeLifetime };
+export { consumeSignUpCode, hashOf, issueSignUpCode };

package/dist/better-auth/sign-up/sign-up-plugin.js

@@ -2,8 +2,9 @@ import { effectiveSignInPolicy } from "../sign-in-policy.js";
 import { readSignInPolicy } from "../policy-store.js";
 import { checkNewAccountPassword } from "../new-account-password.js";
 import { sendAuthEmail } from "../auth-mail/send-auth-email.js";
+import { codeLifetime } from "../sign-in-mail.js";
 import { createSignedUpAccount } from "./sign-up-account.js";
-import { consumeSignUpCode, issueSignUpCode, signUpCodeLifetime } from "./sign-up-code.js";
+import { consumeSignUpCode, issueSignUpCode } from "./sign-up-code.js";
 import { consumeSignUpTicket, issueSignUpTicket } from "./sign-up-ticket.js";
 import * as z$1 from "zod";
 import { APIError, createAuthEndpoint } from "better-auth/api";
@@ -40,7 +41,7 @@ const signUpPlugin = ({ role, mail, defaultPolicy }) => ({
 			if (await adapter.count({ model: "user" }) === 0) throw noAdminYet();
 			const sending = await internalAdapter.findUserByEmail(email) ? sendAuthEmail(mail, "accountExistsEmail", email, {}, ctx.context.baseURL) : sendAuthEmail(mail, "signUpCodeEmail", email, {
 				code: await issueSignUpCode(ctx.context, email),
-				lifetime: signUpCodeLifetime
+				lifetime: codeLifetime
 			}, ctx.context.baseURL);
 			await ctx.context.runInBackgroundOrAwait(sending);
 			return ctx.json({ sent: true });

package/dist/built-in-resources.d.ts

@@ -0,0 +1,89 @@
+import { EventsOptions } from "./changes/events-options.js";
+import { ResourceModel } from "@protobase/schema";
+//#region src/built-in-resources.d.ts
+export type BuiltInInput = {
+  models: ResourceModel[];
+  /** Whether the app declares jobs of its own. */
+  jobs: boolean;
+  /** Whether the app sends notifications. */
+  notifications: boolean;
+  events?: EventsOptions;
+};
+/**
+ * The resources and views the API adds beside the app's own, by what the app uses: Failed jobs once anything runs
+ * jobs (events, history, comments, AI fields, notifications or the app's jobs), Activity with history and Comments
+ * with comments.
+ */
+export declare const builtInResources: ({ models, jobs, notifications, events }: BuiltInInput) => {
+  resources: (import("@protobase/schema").ResourceBuilder<{
+    readonly id: import("@protobase/schema").Field<string>;
+    readonly name: import("@protobase/schema").Field<string>;
+    readonly error: import("@protobase/schema").Field<string | null>;
+    readonly attempts: import("@protobase/schema").Field<number>;
+    readonly failed_at: import("@protobase/schema").Field<string>;
+    readonly created_at: import("@protobase/schema").Field<string>;
+    readonly key: import("@protobase/schema").Field<string | null>;
+    readonly payload: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly output: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly retry: import("@protobase/schema").Field<boolean>;
+  }, import("@protobase/schema").Ref<"id", string>> | import("@protobase/schema").ResourceBuilder<{
+    readonly id: import("@protobase/schema").Field<string>;
+    readonly resource: import("@protobase/schema").Field<string>;
+    readonly record_key: import("@protobase/schema").Field<string>;
+    readonly tenant_id: import("@protobase/schema").Field<string | null>;
+    readonly operation: import("@protobase/schema").Field<"create" | "update" | "delete" | "undelete">;
+    readonly before: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly after: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly changed: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly actor_id: import("@protobase/schema").Field<string | null>;
+    readonly actor_roles: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly database_role: import("@protobase/schema").Field<string | null>;
+    readonly transaction: import("@protobase/schema").Field<string>;
+    readonly at: import("@protobase/schema").Field<string>;
+  }, import("@protobase/schema").Ref<"id", string>> | import("@protobase/schema").ResourceBuilder<{
+    readonly id: import("@protobase/schema").Field<string>;
+    readonly resource: import("@protobase/schema").Field<string>;
+    readonly record_key: import("@protobase/schema").Field<string>;
+    readonly tenant_id: import("@protobase/schema").Field<string | null>;
+    readonly author_id: import("@protobase/schema").Field<string>;
+    readonly body: import("@protobase/schema").Field<string>;
+    readonly mentions: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly created_at: import("@protobase/schema").Field<string>;
+  }, import("@protobase/schema").Ref<"id", string>>)[];
+  views: (import("@protobase/schema").ViewBuilder<import("@protobase/schema").ResourceBuilder<{
+    readonly id: import("@protobase/schema").Field<string>;
+    readonly name: import("@protobase/schema").Field<string>;
+    readonly error: import("@protobase/schema").Field<string | null>;
+    readonly attempts: import("@protobase/schema").Field<number>;
+    readonly failed_at: import("@protobase/schema").Field<string>;
+    readonly created_at: import("@protobase/schema").Field<string>;
+    readonly key: import("@protobase/schema").Field<string | null>;
+    readonly payload: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly output: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly retry: import("@protobase/schema").Field<boolean>;
+  }, import("@protobase/schema").Ref<"id", string>>> | import("@protobase/schema").ViewBuilder<import("@protobase/schema").ResourceBuilder<{
+    readonly id: import("@protobase/schema").Field<string>;
+    readonly resource: import("@protobase/schema").Field<string>;
+    readonly record_key: import("@protobase/schema").Field<string>;
+    readonly tenant_id: import("@protobase/schema").Field<string | null>;
+    readonly operation: import("@protobase/schema").Field<"create" | "update" | "delete" | "undelete">;
+    readonly before: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly after: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly changed: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly actor_id: import("@protobase/schema").Field<string | null>;
+    readonly actor_roles: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly database_role: import("@protobase/schema").Field<string | null>;
+    readonly transaction: import("@protobase/schema").Field<string>;
+    readonly at: import("@protobase/schema").Field<string>;
+  }, import("@protobase/schema").Ref<"id", string>>> | import("@protobase/schema").ViewBuilder<import("@protobase/schema").ResourceBuilder<{
+    readonly id: import("@protobase/schema").Field<string>;
+    readonly resource: import("@protobase/schema").Field<string>;
+    readonly record_key: import("@protobase/schema").Field<string>;
+    readonly tenant_id: import("@protobase/schema").Field<string | null>;
+    readonly author_id: import("@protobase/schema").Field<string>;
+    readonly body: import("@protobase/schema").Field<string>;
+    readonly mentions: import("@protobase/schema").Field<import("zod").JSONType>;
+    readonly created_at: import("@protobase/schema").Field<string>;
+  }, import("@protobase/schema").Ref<"id", string>>>)[];
+};
+//#endregion

package/dist/built-in-resources.js

@@ -0,0 +1,31 @@
+import { hasAiFields } from "./ai/ai-fields.js";
+import { isCaptured } from "./changes/capture-sql.js";
+import { changesSchema } from "./changes/events-options.js";
+import { commentsResource, commentsView } from "./comments/record-comments.js";
+import { activityResource, activityView } from "./history/activity.js";
+import { failedJobs, failedJobsView } from "./jobs/failed-jobs.js";
+//#region src/built-in-resources.ts
+/**
+* The resources and views the API adds beside the app's own, by what the app uses: Failed jobs once anything runs
+* jobs (events, history, comments, AI fields, notifications or the app's jobs), Activity with history and Comments
+* with comments.
+*/
+const builtInResources = ({ models, jobs, notifications, events }) => {
+	const withComments = models.some((model) => model.comments);
+	const withJobs = jobs || models.some(isCaptured) || withComments || hasAiFields(models) || notifications;
+	const withHistory = models.some((model) => model.history);
+	return {
+		resources: [
+			...withJobs ? [failedJobs] : [],
+			...withHistory ? [activityResource(changesSchema(events), { tenant: models.some((model) => model.history && model.tenant) })] : [],
+			...withComments ? [commentsResource({ tenant: models.some((model) => model.comments && model.tenant) })] : []
+		],
+		views: [
+			...withJobs ? [failedJobsView] : [],
+			...withHistory ? [activityView] : [],
+			...withComments ? [commentsView] : []
+		]
+	};
+};
+//#endregion
+export { builtInResources };

package/dist/changes/capture-schema.js

@@ -1,6 +1,8 @@
 import { isCaptured, quoteIdent, tableSql } from "./capture-sql.js";
+import { historyIndexes } from "../history/history-sql.js";
 import { capturePlan, planSql, uncaptured } from "./capture-plan.js";
 import { changesSchema } from "./events-options.js";
+import { hasIndexes } from "../has-indexes.js";
 import { sql } from "kysely";
 //#region src/changes/capture-schema.ts
 /** The command that writes what the config needs as a migration file of the project. */
@@ -25,7 +27,7 @@ const readCaptureState = async (db, schema, models) => {
       where not t.tgisinternal and (t.tgfoid::text = ${capture?.oid ?? ""} or t.tgrelid::text = any(${oids}::text[]))`);
 	return {
 		outbox: await exists("outbox"),
-		history: await exists("history"),
+		history: await exists("history") && await hasIndexes(db, schema, "history", historyIndexes.map(([name]) => name)),
 		notices: await exists("notices"),
 		...capture && { capture },
 		triggers: triggers.map((trigger) => ({

package/dist/comments/comments-sql.d.ts

@@ -1,7 +1,10 @@
 import { ResourceModel } from "@protobase/schema";
 import { Db } from "@protobase/query";
 //#region src/comments/comments-sql.d.ts
-/** The SQL that adds the `comments` schema and its table, `undefined` when it is there. The table is never dropped. */
+/**
+ * The SQL that adds the `comments` schema and its table, or the indexes it lacks, `undefined` when it has them all. The
+ * table is never dropped.
+ */
 export declare const commentsMigration: (db: Db) => Promise<string | undefined>;
 /** Refuses to go on while a resource has `.comments()` and the database lacks their table; the project's migrations add it. */
 export declare const checkComments: (db: Db, models: readonly ResourceModel[]) => Promise<void>;

package/dist/comments/comments-sql.js

@@ -1,8 +1,17 @@
+import { hasIndexes } from "../has-indexes.js";
 import { migrationCommand } from "../changes/capture-schema.js";
 import { sql } from "kysely";
 //#region src/comments/comments-sql.ts
 /** The table the comments of every resource with `.comments()` are kept in, in a schema of its own. */
 const commentsTable = "\"comments\".\"comments\"";
+/** An index for each read of the comments: the record pages', the admin list's filters, by name. */
+const commentsIndexes = [
+	["comments_record", "\"resource\", \"record_key\", \"id\""],
+	["comments_tenant", "\"tenant_id\", \"id\""],
+	["comments_author", "\"author_id\", \"id\""],
+	["comments_created_at", "\"created_at\""],
+	["comments_record_key", "\"record_key\""]
+];
 /**
 * A row per comment: the record it is on by resource and encoded key, its tenant, its author and the user ids it
 * mentions (`[]` for none). Every column the admin list filters on has an index.
@@ -17,12 +26,12 @@ const commentsTableSql = () => `create table if not exists ${commentsTable} (
   "mentions" jsonb not null,
   "created_at" timestamptz not null default now()
 );
-create index if not exists "comments_record" on ${commentsTable} ("resource", "record_key", "id");
-create index if not exists "comments_tenant" on ${commentsTable} ("tenant_id", "id");
-create index if not exists "comments_author" on ${commentsTable} ("author_id", "id");
-create index if not exists "comments_created_at" on ${commentsTable} ("created_at")`;
-const hasCommentsTable = async (db) => (await sql`select to_regclass('comments.comments') is not null as found`.execute(db)).rows[0].found;
-/** The SQL that adds the `comments` schema and its table, `undefined` when it is there. The table is never dropped. */
+${commentsIndexes.map(([name, columns]) => `create index if not exists "${name}" on ${commentsTable} (${columns})`).join(";\n")}`;
+const hasCommentsTable = async (db) => (await sql`select to_regclass('comments.comments') is not null as found`.execute(db)).rows[0].found && await hasIndexes(db, "comments", "comments", commentsIndexes.map(([name]) => name));
+/**
+* The SQL that adds the `comments` schema and its table, or the indexes it lacks, `undefined` when it has them all. The
+* table is never dropped.
+*/
 const commentsMigration = async (db) => {
 	if (await hasCommentsTable(db)) return void 0;
 	return `create schema if not exists "comments";\n\n${commentsTableSql()};`;
@@ -31,7 +40,7 @@ const commentsMigration = async (db) => {
 const checkComments = async (db, models) => {
 	if (!models.some((model) => model.comments)) return;
 	if (await hasCommentsTable(db)) return;
-	throw new Error(`The comments schema is missing, and resources with .comments() keep their comments in comments.comments. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
+	throw new Error(`The comments schema is missing or behind this version of Protobase, and resources with .comments() keep their comments in comments.comments. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
 };
 //#endregion
 export { checkComments, commentsMigration, commentsTable, commentsTableSql };

package/dist/comments/record-comments.js

@@ -15,7 +15,7 @@ const commentsResource = ({ tenant }) => {
 		author_id: f.text().readOnly().filterable(),
 		body: f.text().readOnly(),
 		mentions: f.json().readOnly(),
-		created_at: f.timestamp().readOnly().filterable()
+		created_at: f.timestamp().readOnly().dbDefault().filterable()
 	}).primaryKey((r) => r.id).access({
 		list: admins,
 		read: admins,

package/dist/config-exports.d.ts

@@ -1,2 +1,4 @@
 import { configExports } from "./resource-source.js";
-export { configExports };
+import { builtInResources } from "./built-in-resources.js";
+import { webhooksModule } from "./webhooks/table/webhooks-module.js";
+export { builtInResources, configExports, webhooksModule };

package/dist/config-exports.js

@@ -1,2 +1,4 @@
+import { builtInResources } from "./built-in-resources.js";
 import { configExports } from "./resource-source.js";
-export { configExports };
+import { webhooksModule } from "./webhooks/table/webhooks-module.js";
+export { builtInResources, configExports, webhooksModule };

package/dist/create-admin.js

@@ -50,8 +50,6 @@ import { appOrigin } from "./comments/app-origin.js";
 import { betterAuthActorNames } from "./history/actor-names.js";
 import { betterAuthCommentUsers } from "./comments/comment-users.js";
 import { mentionJob } from "./comments/mention-job.js";
-import { commentsResource, commentsView } from "./comments/record-comments.js";
-import { activityResource, activityView } from "./history/activity.js";
 import { historyDays } from "./history/options.js";
 import { pruneHistoryJob } from "./history/prune-history.js";
 import { callerRecords } from "./functions/records.js";
@@ -113,7 +111,7 @@ import { mcpIcons } from "./web-app/mcp-icons.js";
 import { recordRoutes } from "./routes/record.js";
 import { firstAdminUrl } from "./better-auth/first-admin-url.js";
 import { createScanGuard } from "./scan-guard.js";
-import { failedJobs, failedJobsView } from "./jobs/failed-jobs.js";
+import { builtInResources } from "./built-in-resources.js";
 import { Hono } from "hono";
 import { accountPage, accountPageName, checkPages, settingsResources, withSettingsFields } from "@protobase/layout";
 import { guestCallsPath, ringsPath, statusPath } from "@protobase/schema/internal";
@@ -129,22 +127,17 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	const appModels = appResources.map((resource) => resource.toModel());
 	const withComments = appModels.some((model) => model.comments);
 	const withAiFields = hasAiFields(appModels);
-	const withJobs = jobs.length > 0 || appModels.some(isCaptured) || withComments || withAiFields || notifications !== void 0;
 	const withHistory = appModels.some((model) => model.history);
 	const changes = changesSchema(events);
 	const days = historyDays(historyOptions);
-	const resources = [
-		...appResources,
-		...withJobs ? [failedJobs] : [],
-		...withHistory ? [activityResource(changes, { tenant: appModels.some((model) => model.history && model.tenant) })] : [],
-		...withComments ? [commentsResource({ tenant: appModels.some((model) => model.comments && model.tenant) })] : []
-	];
-	const views = [
-		...appViews,
-		...withJobs ? [failedJobsView] : [],
-		...withHistory ? [activityView] : [],
-		...withComments ? [commentsView] : []
-	];
+	const builtIn = builtInResources({
+		models: appModels,
+		jobs: jobs.length > 0,
+		notifications: notifications !== void 0,
+		...events && { events }
+	});
+	const resources = [...appResources, ...builtIn.resources];
+	const views = [...appViews, ...builtIn.views];
 	const commentUsers = withComments ? givenCommentUsers ?? (auth && betterAuthCommentUsers(auth)) : void 0;
 	const mentions = withComments ? mentionJob(commentUsers, shownAppName(auth, globalThis.process?.env ?? {})) : void 0;
 	const registry = buildRegistry(resources);

package/dist/gotrue/user-routes.js

@@ -24,9 +24,10 @@ const logoutScopes = [
 /**
 * The signed-in user's own endpoints, with their access token: `GET /user`, `PUT /user` for a new password or metadata,
 * and `POST /logout`. A token whose session has ended, by signing out or a ban, is GoTrue's `session_not_found`.
-* With MCP on, signing out everywhere or the other sessions, and setting a password, disconnect the user's MCP clients,
-* as the same steps do through Better Auth: GoTrue has no way to tell a password reset from a change, so every new
-* password does.
+* With MCP on, signing out everywhere or the other sessions disconnects the user's MCP clients, as the same steps do
+* through Better Auth. A new password signs out the other sessions, with the MCP clients, and mails the owner, as a
+* change through Better Auth does: GoTrue has no way to tell a password reset or a first password from a change, so
+* every new password does.
 */
 const userRoutes = ({ auth, context }) => {
 	const claimsOf = accessClaimsOf(goTrueTokens({ auth }));
@@ -85,7 +86,8 @@ const userRoutes = ({ auth, context }) => {
 				accountId: user.id,
 				password: hash
 			});
-			if (auth.mcp) await revokeMcpGrants(ctx.adapter, user.id);
+			await signOut(found.claims, "others");
+			await auth.api.passwordChanged({ body: { email: user.email } });
 		}
 		const merged = data && Object.fromEntries(Object.entries({
 			...userMetadata(user.metadata),

package/dist/has-indexes.js

@@ -0,0 +1,9 @@
+import { sql } from "kysely";
+//#region src/has-indexes.ts
+/** Whether the table `schema`.`table` has an index of each name in `names`. Only reads the catalogue. */
+const hasIndexes = async (db, schema, table, names) => {
+	const { rows } = await sql`select indexname as name from pg_indexes where schemaname = ${schema} and tablename = ${table}`.execute(db);
+	return names.every((name) => rows.some((row) => row.name === name));
+};
+//#endregion
+export { hasIndexes };

package/dist/history/history-sql.js

@@ -6,6 +6,17 @@ import { quoteIdent } from "../changes/capture-sql.js";
 * ones included. `actor_id` and `actor_roles` are the API's caller, `null` for a write from elsewhere; `database_role`
 * is the role that wrote, `null` for a change captured before Protobase kept it.
 */
+/** An index for each read the record pages and the Activity list take, by name, so a migration can add the ones a table lacks. */
+const historyIndexes = [
+	["history_record", "\"resource\", \"record_key\", \"id\""],
+	["history_tenant", "\"tenant_id\", \"id\""],
+	["history_at", "\"at\""],
+	["history_record_key", "\"record_key\""],
+	["history_operation", "\"operation\""],
+	["history_actor", "\"actor_id\""],
+	["history_database_role", "\"database_role\""],
+	["history_transaction", "\"transaction\""]
+];
 const historyTableSql = (schema) => {
 	const table = `${quoteIdent(schema)}."history"`;
 	return `create table if not exists ${table} (
@@ -23,9 +34,7 @@ const historyTableSql = (schema) => {
   "transaction" bigint not null,
   "at" timestamptz not null
 );
-create index if not exists "history_record" on ${table} ("resource", "record_key", "id");
-create index if not exists "history_tenant" on ${table} ("tenant_id", "id");
-create index if not exists "history_at" on ${table} ("at")`;
+${historyIndexes.map(([name, columns]) => `create index if not exists "${name}" on ${table} (${columns})`).join(";\n")}`;
 };
 //#endregion
-export { historyTableSql };
+export { historyIndexes, historyTableSql };

package/dist/internal.js

@@ -8,8 +8,8 @@ import { appPool, longQueryPool } from "./app-pool.js";
 import { betterAuthAuthenticator } from "./better-auth/authenticator.js";
 import { fileProviderOf } from "./files/provider-settings.js";
 import { declaredJob } from "./jobs/declared-job.js";
+import { webhooksModule } from "./webhooks/table/webhooks-module.js";
 import { appAuthOptions, buildAppAuth } from "./better-auth/auth-settings.js";
 import { buildAuthenticator } from "./better-auth/authenticate-settings.js";
-import { webhooksModule } from "./webhooks/table/webhooks-module.js";
 import { checkCallsOptions } from "./calls/calls-options.js";
 export { appAuthOptions, appPool, betterAuthAuthenticator, buildAppAuth, buildAuth, buildAuthenticator, checkCallsOptions, checkNotificationsOptions, checkStatusOptions, createAuth, declaredJob, fileProviderOf, isSubscription, loadAuthPlugins, localFiles, longQueryPool, s3Files, webhooksModule };

package/dist/mcp/mcp-input-schemas.js

@@ -0,0 +1,24 @@
+import { fromJsonSchema } from "@modelcontextprotocol/server";
+//#region src/mcp/mcp-input-schemas.ts
+/**
+* Turns a tool's parameters object into its MCP input schema, keeping the last `limit` it turned, least recently used
+* dropped first. The SDK compiles each schema object it is given into a cache that never lets go, so a server built per
+* request from the same tools gets the same input schema and adds nothing to it.
+*/
+const inputSchemaMemo = (limit) => {
+	const schemas = /* @__PURE__ */ new Map();
+	return (parameters) => {
+		const known = schemas.get(parameters);
+		if (known) {
+			schemas.delete(parameters);
+			schemas.set(parameters, known);
+			return known;
+		}
+		const schema = fromJsonSchema(parameters);
+		schemas.set(parameters, schema);
+		if (schemas.size > limit) schemas.delete(schemas.keys().next().value);
+		return schema;
+	};
+};
+//#endregion
+export { inputSchemaMemo };

package/dist/mcp/mcp-server.js

@@ -3,18 +3,12 @@ import { checkedTools } from "../assistant/checked-tools.js";
 import { refusalOf } from "../assistant/record-tool-args.js";
 import { ApprovalNeeded, approvalAsked, approvedUnasked, mcpApproval, writesUnasked } from "./mcp-approval.js";
 import { callHash, callScope, scopeHash } from "./mcp-call-hash.js";
+import { inputSchemaMemo } from "./mcp-input-schemas.js";
 import { mcpInstructions } from "./mcp-instructions.js";
-import { CLIENT_CAPABILITIES_META_KEY, McpServer, fromJsonSchema } from "@modelcontextprotocol/server";
+import { CLIENT_CAPABILITIES_META_KEY, McpServer } from "@modelcontextprotocol/server";
 //#region src/mcp/mcp-server.ts
 const capabilitiesOf = (envelope) => envelope?.[CLIENT_CAPABILITIES_META_KEY];
-const inputSchemas = /* @__PURE__ */ new WeakMap();
-const inputSchemaOf = (parameters) => {
-	const known = inputSchemas.get(parameters);
-	if (known) return known;
-	const schema = fromJsonSchema(parameters);
-	inputSchemas.set(parameters, schema);
-	return schema;
-};
+const inputSchemaOf = inputSchemaMemo(1e3);
 const failed = {
 	content: [{
 		type: "text",

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.66.6";
+var version = "0.66.7";
 //#endregion
 export { version };

package/dist/webhooks/table/schema-sql.js

@@ -1,7 +1,7 @@
 import { jobsSchema } from "../../jobs/schema.js";
 import { quoteIdent } from "../../changes/capture-sql.js";
 /** The comment the schema's functions carry, which the startup check reads. */
-const webhooksComment = `Protobase webhooks 1`;
+const webhooksComment = `Protobase webhooks 2`;
 /** The delivery jobs, whose waiting and failed ones the deliveries view lists. */
 const deliveryJobs = ["webhooks.deliver", "webhooks.deliver-ordered"];
 /** The job that sends a subscription a test event. */
@@ -34,8 +34,23 @@ const subscriptionsSql = (schema, changesSchema) => `create table if not exists
   "rotate_secret" boolean not null default false,
   "send_test" boolean not null default false,
   "resend_failed" boolean not null default false
-);
-create index if not exists "subscriptions_tenant" on ${quoteIdent(schema)}."subscriptions" ("tenant_id")`;
+)`;
+/**
+* An index for each read of the subscriptions the API takes: the tenant and owner every caller's rows keep to, the
+* sorts and filter the list offers, and pg_trgm ones for its search over the name and URL.
+*/
+const subscriptionsIndexesSql = (schema) => {
+	const table = `${quoteIdent(schema)}."subscriptions"`;
+	return `create extension if not exists pg_trgm;
+create index if not exists "subscriptions_tenant" on ${table} ("tenant_id");
+create index if not exists "subscriptions_owner" on ${table} ("owner_id");
+create index if not exists "subscriptions_created_at" on ${table} ("created_at");
+create index if not exists "subscriptions_name" on ${table} ("name");
+create index if not exists "subscriptions_enabled" on ${table} ("enabled");
+create index if not exists "subscriptions_last_success_at" on ${table} ("last_success_at");
+create index if not exists "subscriptions_name_search" on ${table} using gin ("name" gin_trgm_ops);
+create index if not exists "subscriptions_url_search" on ${table} using gin ("url" gin_trgm_ops)`;
+};
 const retryJobs = (where) => `update ${jobsSchema}.job
     set state = 'retry', retry_limit = retry_limit + 1, completed_on = null,
       start_after = greatest(start_after, ${jobsSchema}.job_now()), keep_until = greatest(keep_until, ${jobsSchema}.job_now() + interval '14 days')
@@ -110,7 +125,16 @@ const deliveryLogSql = (schema) => `create table if not exists ${quoteIdent(sche
   "response" text,
   "duration_ms" integer not null,
   "at" timestamptz not null default now()
-);
-create index if not exists "delivery_log_subscription" on ${quoteIdent(schema)}."delivery_log" ("subscription_id", "at")`;
+)`;
+/** An index for each filter and sort of the delivery log the API takes. */
+const deliveryLogIndexesSql = (schema) => {
+	const table = `${quoteIdent(schema)}."delivery_log"`;
+	return `create index if not exists "delivery_log_subscription" on ${table} ("subscription_id", "at");
+create index if not exists "delivery_log_at" on ${table} ("at");
+create index if not exists "delivery_log_event_id" on ${table} ("event_id");
+create index if not exists "delivery_log_event_type" on ${table} ("event_type");
+create index if not exists "delivery_log_status" on ${table} ("status");
+create index if not exists "delivery_log_status_code" on ${table} ("status_code")`;
+};
 //#endregion
-export { commandsSql, deliveriesSql, deliveryJobs, deliveryLogSql, sendTestJob, subscriptionsSql, webhooksComment };
+export { commandsSql, deliveriesSql, deliveryJobs, deliveryLogIndexesSql, deliveryLogSql, sendTestJob, subscriptionsIndexesSql, subscriptionsSql, webhooksComment };

package/dist/webhooks/table/schema.js

@@ -2,7 +2,7 @@ import { quoteIdent } from "../../changes/capture-sql.js";
 import { changesSchema } from "../../changes/events-options.js";
 import { migrationCommand } from "../../changes/capture-schema.js";
 import { webhooksSchema } from "./options.js";
-import { commandsSql, deliveriesSql, deliveryLogSql, subscriptionsSql, webhooksComment } from "./schema-sql.js";
+import { commandsSql, deliveriesSql, deliveryLogIndexesSql, deliveryLogSql, subscriptionsIndexesSql, subscriptionsSql, webhooksComment } from "./schema-sql.js";
 import { sql } from "kysely";
 //#region src/webhooks/table/schema.ts
 const functionNames = ["subscription_commands", "deliveries_resend"];
@@ -25,12 +25,18 @@ const webhooksMigration = async (db, options = {}, events) => {
 	const schema = webhooksSchema(options);
 	const found = await readWebhooksSchema(db, schema);
 	const needsLog = Boolean(options.deliveryLog) && !found.deliveryLog;
-	if (found.subscriptions && found.current && !needsLog) return void 0;
+	const current = found.subscriptions && found.current;
+	if (current && !needsLog) return void 0;
 	return `${[
 		`create schema if not exists ${quoteIdent(schema)}`,
 		...found.subscriptions ? [] : [subscriptionsSql(schema, changesSchema(events))],
-		...found.current && found.subscriptions ? [] : [commandsSql(schema), deliveriesSql(schema)],
-		...needsLog ? [deliveryLogSql(schema)] : []
+		...current ? [] : [
+			subscriptionsIndexesSql(schema),
+			commandsSql(schema),
+			deliveriesSql(schema)
+		],
+		...needsLog ? [deliveryLogSql(schema)] : [],
+		...needsLog || !current && found.deliveryLog ? [deliveryLogIndexesSql(schema)] : []
 	].join(";\n\n")};`;
 };
 /** Refuses to go on while the `webhooks` schema lacks what `webhooks` needs; the project's migrations add it. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.66.6",
+  "version": "0.66.7",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,9 +43,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.66.6",
-    "@protobase/query": "0.66.6",
-    "@protobase/schema": "0.66.6",
+    "@protobase/layout": "0.66.7",
+    "@protobase/query": "0.66.7",
+    "@protobase/schema": "0.66.7",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",