@protobase/server 0.66.6 → 0.66.8

package/dist/assistant/delete-record-tool.d.ts

@@ -1,6 +1,6 @@
 import { AssistantTool, ToolContext } from "./tools.js";
 import { WriteRecordToolsInput } from "./write-tool-limits.js";
 //#region src/assistant/delete-record-tool.d.ts
-/** Deletes one record by its key and ETag once the user approves it, under the caller's access rules. */
+/** Deletes one record by its key, and its ETag when given, once the user approves it, under the caller's access rules. */
 export declare const deleteRecordTool: (input?: WriteRecordToolsInput) => AssistantTool<ToolContext>;
 //#endregion

package/dist/assistant/delete-record-tool.js

@@ -21,12 +21,15 @@ const deleteKeyOf = (value) => {
 	if (key === void 0) return void 0;
 	return (Array.isArray(key) ? key : [key]).every(keyPartOk) ? key : void 0;
 };
-const etagOf = (value) => typeof value === "string" && /^"[\x21\x23-\x2b\x2d-\x7e]+"$/.test(value) ? value : void 0;
-const usage = "Pass only the resource, key and etag as { \"resource\": \"<name>\", \"key\": \"<key>\", \"etag\": \"<the etag get_record gave>\" }; nothing was deleted.";
-/** Deletes one record by its key and ETag once the user approves it, under the caller's access rules. */
+const etagOf = (value) => {
+	if (value === void 0 || value === "*") return { etag: value };
+	return typeof value === "string" && /^"[\x21\x23-\x2b\x2d-\x7e]+"$/.test(value) ? { etag: value } : false;
+};
+const usage = "Pass only the resource, key and, optionally, etag as { \"resource\": \"<name>\", \"key\": \"<key>\", \"etag\": \"<the etag get_record gave>\" }; nothing was deleted.";
+/** Deletes one record by its key, and its ETag when given, once the user approves it, under the caller's access rules. */
 const deleteRecordTool = (input = {}) => defineTool({
 	name: "delete_record",
-	description: `Deletes one record of a resource by its key. Pass the etag get_record gave: it fails when someone changed the record since. A resource that soft deletes keeps the record, deleted; any other loses it for good. The user approves each delete in their client first; nothing is deleted without it.${onlyNote(input)}`,
+	description: `Deletes one record of a resource by its key. Pass the etag get_record gave to fail when someone changed the record since; without one, or with *, it deletes the record whatever its version. A resource that soft deletes keeps the record, deleted; any other loses it for good. The user approves each delete in their client first; nothing is deleted without it.${onlyNote(input)}`,
 	parameters: {
 		type: "object",
 		properties: {
@@ -37,11 +40,7 @@ const deleteRecordTool = (input = {}) => defineTool({
 				description: "The etag get_record gave, to fail when the record changed since."
 			}
 		},
-		required: [
-			"resource",
-			"key",
-			"etag"
-		],
+		required: ["resource", "key"],
 		additionalProperties: false
 	},
 	annotations: {
@@ -52,12 +51,13 @@ const deleteRecordTool = (input = {}) => defineTool({
 	run: async (args, context) => {
 		const resource = resourceOf(args);
 		const key = deleteKeyOf(args.key);
-		const etag = etagOf(args.etag);
-		if (!resource || key === void 0 || !etag || Object.keys(args).some((name) => !parameterNames.includes(name))) return usage;
+		const given = etagOf(args.etag);
+		if (!resource || key === void 0 || !given || Object.keys(args).some((name) => !parameterNames.includes(name))) return usage;
 		const refusal = outside(input, resource);
 		if (refusal) return refusal;
 		const softDelete = await context.records.softDeleteField(resource).then((field) => ({ field }), refused);
 		if (typeof softDelete === "string") return softDelete;
+		const { etag } = given;
 		const before = await recordBefore(context, resource, key, etag);
 		if (typeof before === "string") return before;
 		const { text, described } = await approvalTexts(context, resource);

package/dist/better-auth/auth-mail/auth-emails.d.ts

@@ -1,7 +1,9 @@
 import "./account-exists-email.js";
 import "./change-email-code-email.js";
+import "./confirmation-code-email.js";
 import "./invitation-email.js";
 import "./no-account-email.js";
+import "./password-changed-email.js";
 import "./reset-password-email.js";
 import "./sign-in-code-email.js";
 import "./sign-up-code-email.js";

package/dist/better-auth/auth-mail/auth-emails.js

@@ -1,10 +1,12 @@
 import { accountExistsEmail } from "./account-exists-email.js";
 import { changeEmailCodeEmail } from "./change-email-code-email.js";
+import { confirmationCodeEmail } from "./confirmation-code-email.js";
 import { invitationEmail } from "./invitation-email.js";
 import { noAccountEmail } from "./no-account-email.js";
+import { passwordChangedEmail } from "./password-changed-email.js";
 import { resetPasswordEmail } from "./reset-password-email.js";
 import { signInCodeEmail } from "./sign-in-code-email.js";
 import { signUpCodeEmail } from "./sign-up-code-email.js";
 import { staffSignInEmail } from "./staff-sign-in-email.js";
 import { twoFactorCodeEmail } from "./two-factor-code-email.js";
-export { accountExistsEmail, changeEmailCodeEmail, invitationEmail, noAccountEmail, resetPasswordEmail, signInCodeEmail, signUpCodeEmail, staffSignInEmail, twoFactorCodeEmail };
+export { accountExistsEmail, changeEmailCodeEmail, confirmationCodeEmail, invitationEmail, noAccountEmail, passwordChangedEmail, resetPasswordEmail, signInCodeEmail, signUpCodeEmail, staffSignInEmail, twoFactorCodeEmail };

package/dist/better-auth/auth-mail/confirmation-code-email.d.ts

@@ -0,0 +1 @@
+import "../../index.js";

package/dist/better-auth/auth-mail/confirmation-code-email.js

@@ -0,0 +1,32 @@
+import { defineEmail } from "../../mail/define-email.js";
+import { EmailCode, EmailLayout, EmailNote } from "../../mail/email-layout.js";
+import { Text } from "react-email";
+import { jsx, jsxs } from "react/jsx-runtime";
+//#region src/better-auth/auth-mail/confirmation-code-email.tsx
+const ConfirmationCodeEmail = ({ app, code, lifetime }) => /* @__PURE__ */ jsxs(EmailLayout, {
+	app,
+	preview: `Your code to confirm it's you in ${app.name}`,
+	heading: "Confirm it's you",
+	children: [
+		/* @__PURE__ */ jsxs(Text, { children: [
+			"You are signed in to ",
+			app.name,
+			" and asked to confirm it's you. Use this code there:"
+		] }),
+		/* @__PURE__ */ jsx(EmailCode, { code }),
+		/* @__PURE__ */ jsxs(Text, { children: [
+			"It works for ",
+			lifetime,
+			", once, and only where you asked for it. It does not sign you in."
+		] }),
+		/* @__PURE__ */ jsx(EmailNote, { children: "If you did not ask for it, someone may be signed in to your account: sign out of your other devices on your account page." })
+	]
+});
+/** The email with a code that confirms it's them inside a signed-in session, for an account without a passkey or a second step. */
+const confirmationCodeEmail = defineEmail({
+	name: "confirmation-code",
+	subject: ({ app, code }) => `${code} confirms it's you in ${app.name}`,
+	component: ConfirmationCodeEmail
+});
+//#endregion
+export { confirmationCodeEmail };

package/dist/better-auth/auth-mail/password-changed-email.d.ts

@@ -0,0 +1 @@
+import "../../index.js";

package/dist/better-auth/auth-mail/password-changed-email.js

@@ -0,0 +1,32 @@
+import { defineEmail } from "../../mail/define-email.js";
+import { EmailButton, EmailLayout, EmailNote } from "../../mail/email-layout.js";
+import { signInPath } from "@protobase/schema";
+import { Text } from "react-email";
+import { jsx, jsxs } from "react/jsx-runtime";
+//#region src/better-auth/auth-mail/password-changed-email.tsx
+const PasswordChangedEmail = ({ app }) => /* @__PURE__ */ jsxs(EmailLayout, {
+	app,
+	preview: `The password of your ${app.name} account was changed`,
+	heading: "Your password was changed",
+	children: [
+		/* @__PURE__ */ jsxs(Text, { children: [
+			"The password of your account with ",
+			app.name,
+			" was just changed."
+		] }),
+		/* @__PURE__ */ jsx(Text, { children: "If this was not you, choose a new password at once with \"Forgot password?\" on the sign-in page:" }),
+		/* @__PURE__ */ jsx(EmailButton, {
+			href: new URL(signInPath({ step: "forgot-password" }), app.url).href,
+			children: "Choose a new password"
+		}),
+		/* @__PURE__ */ jsx(EmailNote, { children: "If this was you, ignore this email." })
+	]
+});
+/** The email to an account whose password changed: what happened, and how to take the account back if it was not them. */
+const passwordChangedEmail = defineEmail({
+	name: "password-changed",
+	subject: ({ app }) => `Your ${app.name} password was changed`,
+	component: PasswordChangedEmail
+});
+//#endregion
+export { passwordChangedEmail };

package/dist/better-auth/auth-settings.d.ts

@@ -146,6 +146,7 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
     };
   };
   session: {
+    freshAge: number;
     fields: {
       expiresAt: string;
       createdAt: string;
@@ -1009,8 +1010,8 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
           $Infer: {
             body: {
               permissions: {
-                readonly user?: ("create" | "update" | "delete" | "list" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
-                readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                readonly user?: ("list" | "create" | "update" | "delete" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
+                readonly session?: ("list" | "delete" | "revoke")[] | undefined;
               };
             } & {
               userId?: string | undefined;
@@ -2570,6 +2571,14 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-recent-confirmation";
+    hooks: {
+      before: {
+        matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "email-otp";
     version: string;
@@ -3110,6 +3119,69 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-confirmation-code";
+    endpoints: {
+      sendConfirmationCode: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, {
+        status: boolean;
+      }>;
+      verifyConfirmationCode: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          code: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        status: boolean;
+      }>;
+    };
   } | {
     id: "protobase-sign-up";
     endpoints: {
@@ -4463,6 +4535,14 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-password-checks";
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-set-password";
     endpoints: {
@@ -4498,6 +4578,32 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
         status: boolean;
       }>;
     };
+  } | {
+    id: "protobase-password-change";
+    endpoints: {
+      passwordChanged: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          email: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        status: boolean;
+      }>;
+    };
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          context: {
+            body: any;
+          };
+        } | undefined>>;
+      }[];
+      after: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-leaked-passwords";
     hooks: {

package/dist/better-auth/confirmation-code-plugin.d.ts

@@ -0,0 +1,9 @@
+import "./auth-mail/send-auth-email.js";
+import "zod";
+//#region src/better-auth/confirmation-code-plugin.d.ts
+/** The endpoints of the emailed confirmation code, as Better Auth's `ctx.path` names them. */
+export declare const confirmationCodePaths: {
+  send: string;
+  verify: string;
+};
+//#endregion

package/dist/better-auth/confirmation-code-plugin.js

@@ -0,0 +1,95 @@
+import { sendAuthEmail } from "./auth-mail/send-auth-email.js";
+import { codeLifetime } from "./sign-in-mail.js";
+import { saveStrongSignIn } from "./strong-sign-ins.js";
+import { checkConfirmationCode, dropConfirmationCode, newConfirmationCode, saveConfirmationCode } from "./confirmation-codes.js";
+import * as z$1 from "zod";
+import { APIError, createAuthEndpoint, sessionMiddleware } from "better-auth/api";
+//#region src/better-auth/confirmation-code-plugin.ts
+/** The endpoints of the emailed confirmation code, as Better Auth's `ctx.path` names them. */
+const confirmationCodePaths = {
+	send: "/account/confirmation-code/send",
+	verify: "/account/confirmation-code/verify"
+};
+const notOffered = {
+	code: "CONFIRMATION_CODE_NOT_OFFERED",
+	message: "Confirm it's you with your passkey or your second step instead."
+};
+const refusals = {
+	wrong: {
+		status: "BAD_REQUEST",
+		code: "INVALID_CODE",
+		message: "The code is not right."
+	},
+	"too-many": {
+		status: "FORBIDDEN",
+		code: "TOO_MANY_ATTEMPTS",
+		message: "Too many wrong codes. Ask for a new one."
+	},
+	expired: {
+		status: "BAD_REQUEST",
+		code: "OTP_EXPIRED",
+		message: "The code has expired. Ask for a new one."
+	}
+};
+const isOffered = async (context, { user }) => !user.twoFactorEnabled && await context.adapter.count({
+	model: "passkey",
+	where: [{
+		field: "userId",
+		value: user.id
+	}]
+}) === 0;
+/**
+* An emailed code that confirms it's them inside a session someone is signed in with, for an account without a passkey
+* or a second step, which has nothing stronger to confirm with: a right code notes a strong sign-in for that session
+* (`saveStrongSignIn`), as a passkey or a second step does. The code is its own kind, never a sign-in code; it belongs
+* to the session and user that asked for it, a new one ends the one before, and it stops working after a few wrong
+* ones (`confirmationCodeTries`). When the email cannot be sent, the request fails and no code is kept. The endpoints
+* read the session cookie only, so an MCP client or an app's token cannot ask for one; staff sessions are refused by
+* the staff plugin.
+*/
+const confirmationCodePlugin = (mail) => ({
+	id: "protobase-confirmation-code",
+	endpoints: {
+		/** `POST /account/confirmation-code/send`: emails the signed-in person a new confirmation code. */
+		sendConfirmationCode: createAuthEndpoint(confirmationCodePaths.send, {
+			method: "POST",
+			use: [sessionMiddleware]
+		}, async (ctx) => {
+			const signed = ctx.context.session;
+			if (!await isOffered(ctx.context, signed)) throw new APIError("FORBIDDEN", notOffered);
+			const holder = {
+				userId: signed.user.id,
+				sessionId: signed.session.id
+			};
+			await dropConfirmationCode(ctx.context.internalAdapter, holder.sessionId);
+			const code = newConfirmationCode();
+			await sendAuthEmail(mail, "confirmationCodeEmail", signed.user.email, {
+				code,
+				lifetime: codeLifetime
+			}, ctx.context.baseURL);
+			await saveConfirmationCode(ctx.context.internalAdapter, holder, code);
+			return ctx.json({ status: true });
+		}),
+		/** `POST /account/confirmation-code/verify` with `{ code }`: confirms the session with the code it was emailed. */
+		verifyConfirmationCode: createAuthEndpoint(confirmationCodePaths.verify, {
+			method: "POST",
+			use: [sessionMiddleware],
+			body: z$1.object({ code: z$1.string() })
+		}, async (ctx) => {
+			const signed = ctx.context.session;
+			if (!await isOffered(ctx.context, signed)) throw new APIError("FORBIDDEN", notOffered);
+			const checked = await checkConfirmationCode(ctx.context.internalAdapter, {
+				userId: signed.user.id,
+				sessionId: signed.session.id
+			}, ctx.body.code.trim());
+			if (checked !== "confirmed") {
+				const { status, ...refusal } = refusals[checked];
+				throw new APIError(status, refusal);
+			}
+			await saveStrongSignIn(ctx.context.internalAdapter, signed.session);
+			return ctx.json({ status: true });
+		})
+	}
+});
+//#endregion
+export { confirmationCodePaths, confirmationCodePlugin };

package/dist/better-auth/confirmation-codes.js

@@ -0,0 +1,54 @@
+import { emailCodeMinutes } from "@protobase/schema/internal";
+import { createHash, timingSafeEqual } from "node:crypto";
+import { generateRandomString } from "better-auth/crypto";
+const identifierOf = (sessionId) => `protobase-confirmation-code-${sessionId}`;
+const hashOf = (code) => createHash("sha256").update(code).digest("hex");
+const sameHash = (a, b) => a.length === b.length && timingSafeEqual(Buffer.from(a), Buffer.from(b));
+/** Ends the session's confirmation code, if it has one, so only a newer one works. */
+const dropConfirmationCode = (internal, sessionId) => internal.deleteVerificationByIdentifier(identifierOf(sessionId));
+/** A new six-digit code, as the email shows it. */
+const newConfirmationCode = () => generateRandomString(6, "0-9");
+/** Keeps `code` as the session's confirmation code for `emailCodeMinutes`, in place of any earlier one. */
+const saveConfirmationCode = async (internal, holder, code, now = /* @__PURE__ */ new Date()) => {
+	const identifier = identifierOf(holder.sessionId);
+	await internal.deleteVerificationByIdentifier(identifier);
+	const value = {
+		userId: holder.userId,
+		hash: hashOf(code),
+		wrong: 0
+	};
+	await internal.createVerificationValue({
+		identifier,
+		value: JSON.stringify(value),
+		expiresAt: new Date(now.getTime() + emailCodeMinutes * 6e4)
+	});
+};
+/**
+* Checks `code` against the session's confirmation code: a code of another session or user is none. A right code is
+* used up; a wrong one counts, and the code stops working at `confirmationCodeTries` wrong ones.
+*/
+const checkConfirmationCode = async (internal, holder, code, now = /* @__PURE__ */ new Date()) => {
+	const identifier = identifierOf(holder.sessionId);
+	const found = await internal.findVerificationValue(identifier);
+	if (!found || new Date(found.expiresAt) <= now) return "expired";
+	const stored = JSON.parse(found.value);
+	if (stored.userId !== holder.userId) return "expired";
+	if (sameHash(stored.hash, hashOf(code))) {
+		await internal.deleteVerificationByIdentifier(identifier);
+		return "confirmed";
+	}
+	await internal.deleteVerificationByIdentifier(identifier);
+	const wrong = stored.wrong + 1;
+	if (wrong >= 3) return "too-many";
+	await internal.createVerificationValue({
+		identifier,
+		value: JSON.stringify({
+			...stored,
+			wrong
+		}),
+		expiresAt: new Date(found.expiresAt)
+	});
+	return "wrong";
+};
+//#endregion
+export { checkConfirmationCode, dropConfirmationCode, newConfirmationCode, saveConfirmationCode };

package/dist/better-auth/create-auth.d.ts

@@ -22,6 +22,7 @@ import { SsoOptions } from "./saml-sign-in.js";
 import { samlPlugin } from "./saml-plugin.js";
 import { signUpPaths } from "./sign-up/sign-up-plugin.js";
 import { PasswordHash } from "./password-hashes.js";
+import { confirmationCodePaths } from "./confirmation-code-plugin.js";
 import { BetterAuthOptions } from "better-auth";
 import { JwtOptions } from "better-auth/plugins";
 //#region src/better-auth/create-auth.d.ts
@@ -278,6 +279,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
     };
   };
   session: {
+    freshAge: number;
     fields: {
       expiresAt: string;
       createdAt: string;
@@ -1141,8 +1143,8 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
           $Infer: {
             body: {
               permissions: {
-                readonly user?: ("create" | "update" | "delete" | "list" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
-                readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                readonly user?: ("list" | "create" | "update" | "delete" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
+                readonly session?: ("list" | "delete" | "revoke")[] | undefined;
               };
             } & {
               userId?: string | undefined;
@@ -2702,6 +2704,14 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-recent-confirmation";
+    hooks: {
+      before: {
+        matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "email-otp";
     version: string;
@@ -3242,6 +3252,69 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-confirmation-code";
+    endpoints: {
+      sendConfirmationCode: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, {
+        status: boolean;
+      }>;
+      verifyConfirmationCode: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          code: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        status: boolean;
+      }>;
+    };
   } | {
     id: "protobase-sign-up";
     endpoints: {
@@ -4591,6 +4664,14 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-password-checks";
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-set-password";
     endpoints: {
@@ -4626,6 +4707,32 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         status: boolean;
       }>;
     };
+  } | {
+    id: "protobase-password-change";
+    endpoints: {
+      passwordChanged: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          email: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        status: boolean;
+      }>;
+    };
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          context: {
+            body: any;
+          };
+        } | undefined>>;
+      }[];
+      after: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-leaked-passwords";
     hooks: {
@@ -8897,6 +9004,14 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         window: number;
         max: number;
       };
+      [confirmationCodePaths.send]: {
+        window: number;
+        max: number;
+      };
+      [confirmationCodePaths.verify]: {
+        window: number;
+        max: number;
+      };
       '/sign-in/email': {
         window: number;
         max: number;
@@ -8968,7 +9083,8 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
 }> & {
   /**
    * Answers a request from the app's iOS or Android build: Better Auth also trusts the Capacitor origin the request
-   * names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin.
+   * names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin. A
+   * Capacitor origin's POST without a JSON body is refused before it is granted, as only a page sends one.
    */
   handleMobile: (request: Request) => Promise<Response>;
   /**