@protobase/server 0.45.15 → 0.45.17

package/dist/create-admin.js

@@ -54,6 +54,7 @@ import { subscriptionUrlCheck, subscriptionWriteCheck } from "./webhooks/table/v
 import { deviceStore, removeDevicesWithUsers } from "./notifications/device-store-of.js";
 import { devicesPath } from "./notifications/paths.js";
 import { deviceRoutes } from "./notifications/routes.js";
+import { notificationSenders, webPushKey } from "./notifications/senders-of.js";
 import { visitorsBrowse, withAnonymous } from "./anonymous.js";
 import { checkBottomBars, checkShell } from "./check-shell.js";
 import { checkOwnerFields } from "./check-owners.js";
@@ -152,6 +153,8 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	const runtime = runtimeUrl(options.runtime, globalThis.process?.env ?? {});
 	const errorReporting = errorReportingSettings(options.errorReporting, globalThis.process?.env ?? {});
 	const maps = mapSettings(options.maps, globalThis.process?.env ?? {});
+	const senders = notifications ? notificationSenders(notifications) : [];
+	const pushKey = webPushKey(senders);
 	const locale = localeSetting(options.locale);
 	const plugins = pluginOptions(options.plugins, globalThis.process?.env ?? {}, bundlePlugins);
 	const sources = sourceOptions(options.sources, globalThis.process?.env ?? {});
@@ -204,6 +207,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		...runtime && { runtime },
 		...errorReporting && { errorReporting },
 		...maps && { maps },
+		...pushKey && { webPushKey: pushKey },
 		...locale && { locale },
 		plugins,
 		sources,

package/dist/deps.d.ts

@@ -47,6 +47,8 @@ export type Deps = {
   errorReporting?: ErrorReportingSettings;
   /** The map style the admin app draws maps with and the layers they may switch to, which `/meta` names to everyone. */
   maps?: MapSettings;
+  /** The VAPID public key browsers subscribe for Web Push with, when notifications have a web sender, which `/meta` names to everyone. */
+  webPushKey?: string;
   /** The language the admin app's screens are in for everyone, which `/meta` names to everyone. */
   locale?: Locale;
   /** The plugins `/meta` names to the callers they are for. */

package/dist/index.d.ts

@@ -20,6 +20,9 @@ import { HistoryOptions } from "./history/options.js";
 import { WebhooksOptions } from "./webhooks/table/options.js";
 import { ApnsEnvironment, Device, DeviceKind, NewDevice } from "./notifications/device.js";
 import { DeviceStore } from "./notifications/device-store.js";
+import { JsonObject, JsonValue } from "./notifications/json-value.js";
+import { PushMessage, PushMessageError, Urgency, WebPushFields, maxTtlSeconds, pushMessage, urgencies } from "./notifications/message.js";
+import { PushAnswer, PushSender } from "./notifications/sender.js";
 import { DeviceColumn, NotificationsOptions } from "./notifications/options.js";
 import { EventData, RunContext, SubscriptionDefinition, SubscriptionEvent, SubscriptionOptions, subscription } from "./webhooks/subscription.js";
 import { Sharp, renderVariant, thumbHash } from "./files/images.js";
@@ -95,6 +98,10 @@ import { deviceStore, removeDevicesWithUsers } from "./notifications/device-stor
 import { DeviceStoreError, postgresDeviceStore } from "./notifications/postgres-store.js";
 import { deviceIdParam, devicesPath } from "./notifications/paths.js";
 import { maxDevicesPerUser } from "./notifications/routes.js";
+import { notificationSenders } from "./notifications/senders-of.js";
+import { VapidSettings, readVapidSettings, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable } from "./notifications/web-push/vapid-settings.js";
+import { WebPushOptions, webPushSender } from "./notifications/web-push/web-push-sender.js";
+import { generateVapidKeys } from "./notifications/web-push/keys.js";
 import { MemberInput, NewOrganization, addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
 import { AssistantBackend, assistantProtocolRoutes } from "./assistant/protocol-routes.js";
 import { fileConversationStore } from "./assistant/file-conversation-store.js";
@@ -146,4 +153,4 @@ import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.
 import { MobileRelease, ReleaseFile, ServedReleaseFile, composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { MobileReleaseAppInput, OfferedRelease, mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewOrganization, type NewUser, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, processor, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewOrganization, type NewUser, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxTokenTtlSeconds, maxTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/index.js

@@ -56,10 +56,15 @@ import { recordOf, resourceChange } from "./changes/resource-change.js";
 import { defineFunction } from "./functions/define-function.js";
 import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
 import { subscription } from "./webhooks/subscription.js";
+import { generateVapidKeys } from "./notifications/web-push/keys.js";
 import { DeviceStoreError, postgresDeviceStore } from "./notifications/postgres-store.js";
 import { deviceStore, removeDevicesWithUsers } from "./notifications/device-store-of.js";
 import { deviceIdParam, devicesPath } from "./notifications/paths.js";
 import { maxDevicesPerUser } from "./notifications/routes.js";
+import { PushMessageError, maxTtlSeconds, pushMessage, urgencies } from "./notifications/message.js";
+import { readVapidSettings, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable } from "./notifications/web-push/vapid-settings.js";
+import { webPushSender } from "./notifications/web-push/web-push-sender.js";
+import { notificationSenders } from "./notifications/senders-of.js";
 import { errorReportingSettings, errorReportingVariable } from "./error-reporting/error-reporting-settings.js";
 import { storageCleanupSchedule } from "./files/cleanup-schedule.js";
 import { limitedFileStore, storeUsage } from "./files/limits.js";
@@ -110,4 +115,4 @@ import { jobsDrainApp } from "./jobs/drain-route.js";
 import { composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, processor, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HttpProblem, MissingCredentials, ModelError, PushMessageError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxTokenTtlSeconds, maxTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/meta.d.ts

@@ -49,6 +49,10 @@ export type CallerMeta = {
   errorReporting?: ErrorReportingSettings;
   /** The map style the admin app draws its maps with, and the layers they may switch to, when the app has one: public, as the tiles are. */
   maps?: MapSettings;
+  /** The VAPID public key browsers subscribe for Web Push with, when the app's notifications deliver to browsers: public, as any VAPID key is. */
+  notifications?: {
+    webPushKey: string;
+  };
   /** The language the admin app's screens are in, when the app sets one for everyone. */
   locale?: Locale;
   /** The hosts besides the app's own whose images the admin app draws with the page's referrer, when there are any. */

package/dist/meta.js

@@ -90,6 +90,7 @@ const createMeta = (deps, appName, appIcon) => {
 			...deps.runtime && seesRuntime(session.user.roles) && { runtime: { url: deps.runtime } },
 			...deps.errorReporting && { errorReporting: deps.errorReporting },
 			...deps.maps && { maps: deps.maps },
+			...deps.webPushKey && { notifications: { webPushKey: deps.webPushKey } },
 			...deps.locale && { locale: deps.locale },
 			...deps.files && deps.files.trustedHosts.length > 0 && { files: { trustedHosts: deps.files.trustedHosts } },
 			...plugins.length > 0 && { plugins },

package/dist/notifications/device.js

@@ -1,5 +1,11 @@
 //#region src/notifications/device.ts
+/** How a device receives push: a browser's Web Push subscription, an iOS app's APNs token or an Android app's FCM token. */
+const deviceKinds = [
+	"web",
+	"apns",
+	"fcm"
+];
 /** The APNs environment an iOS build's token belongs to. */
 const apnsEnvironments = ["sandbox", "production"];
 //#endregion
-export { apnsEnvironments };
+export { apnsEnvironments, deviceKinds };

package/dist/notifications/guarded-sender.js

@@ -0,0 +1,61 @@
+import { PushMessageError, pushMessage } from "./message.js";
+//#region src/notifications/guarded-sender.ts
+const results = /* @__PURE__ */ new Set([
+	"ok",
+	"gone",
+	"retry"
+]);
+const deepFrozen = (value) => {
+	if (typeof value !== "object" || value === null) return value;
+	for (const item of Object.values(value)) deepFrozen(item);
+	return Object.freeze(value);
+};
+const validAnswer = (answer) => {
+	if (typeof answer !== "object" || answer === null) return false;
+	const { id, result, retryAfterSeconds } = answer;
+	if (typeof id !== "string" || typeof result !== "string" || !results.has(result)) return false;
+	return retryAfterSeconds === void 0 || Number.isInteger(retryAfterSeconds) && retryAfterSeconds >= 0;
+};
+const answersFor = (batch, given) => {
+	const byId = /* @__PURE__ */ new Map();
+	for (const answer of Array.isArray(given) ? given : []) {
+		if (!validAnswer(answer) || byId.has(answer.id)) continue;
+		byId.set(answer.id, {
+			id: answer.id,
+			result: answer.result,
+			...answer.retryAfterSeconds !== void 0 && { retryAfterSeconds: answer.retryAfterSeconds }
+		});
+	}
+	return batch.map((device) => byId.get(device.id) ?? {
+		id: device.id,
+		result: "retry"
+	});
+};
+/**
+* `sender` as the code that sends calls it, whether built in or the app's own: the message is checked as `pushMessage`
+* checks it, and refused before the sender sees it; the sender gets a frozen copy of it and of the devices of its kinds
+* only, and answers each of those once, as above. A sender that throws throws an error of its own naming its index,
+* never the sender's, which may carry an endpoint or a key, but for a `PushMessageError`, which names a field only.
+*/
+const guardedSender = (sender, index) => {
+	const send = async (given, devices) => {
+		const message = deepFrozen(pushMessage(given));
+		const batch = deepFrozen(devices.filter((device) => sender.kinds.includes(device.kind)).map((device) => structuredClone(device)));
+		if (batch.length === 0) return [];
+		let answers;
+		try {
+			answers = await sender.send(message, batch);
+		} catch (error) {
+			if (error instanceof PushMessageError) throw error;
+			throw new Error(`notifications sender ${index} failed`);
+		}
+		return answersFor(batch, answers);
+	};
+	return {
+		kinds: [...sender.kinds],
+		...sender.publicKey !== void 0 && { publicKey: sender.publicKey },
+		send
+	};
+};
+//#endregion
+export { guardedSender };

package/dist/notifications/json-value.d.ts

@@ -0,0 +1,8 @@
+//#region src/notifications/json-value.d.ts
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+  [key: string]: JsonValue;
+};
+export type JsonObject = {
+  [key: string]: JsonValue;
+};
+//#endregion

package/dist/notifications/json-value.js

@@ -0,0 +1,54 @@
+//#region src/notifications/json-value.ts
+const forbiddenKeys = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+const maxDepth = 16;
+const isPlainObject = (value) => {
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+};
+/**
+* The path of the first part of `value` that is not plain JSON, or `undefined` when all of it is: plain objects,
+* arrays, strings, finite numbers, booleans and null, at most 16 levels deep, without a `__proto__`, `constructor` or
+* `prototype` key at any depth.
+*/
+const jsonProblem = (value, path, depth = 0) => {
+	if (depth > maxDepth) return path;
+	if (value === null || typeof value === "string" || typeof value === "boolean") return void 0;
+	if (typeof value === "number") return Number.isFinite(value) ? void 0 : path;
+	if (typeof value !== "object") return path;
+	if (Array.isArray(value)) {
+		for (const [index, item] of value.entries()) {
+			const problem = jsonProblem(item, `${path}.${index}`, depth + 1);
+			if (problem !== void 0) return problem;
+		}
+		return;
+	}
+	if (!isPlainObject(value)) return path;
+	for (const key of Reflect.ownKeys(value)) {
+		if (typeof key !== "string" || forbiddenKeys.has(key)) return `${path}.${String(key)}`;
+		const descriptor = Object.getOwnPropertyDescriptor(value, key);
+		if (!("value" in descriptor)) return `${path}.${key}`;
+		const problem = jsonProblem(descriptor.value, `${path}.${key}`, depth + 1);
+		if (problem !== void 0) return problem;
+	}
+};
+/** Whether `value` is a plain JSON object, as `jsonProblem` checks it. */
+const isJsonObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && isPlainObject(value);
+/**
+* `over` merged into `base`, objects key by key and anything else replaced, as new objects: neither is changed and no
+* key is assigned onto an object with a prototype. Both are plain JSON, as `jsonProblem` checks.
+*/
+const mergeJson = (base, over) => {
+	const merged = Object.create(null);
+	for (const [key, value] of Object.entries(base)) merged[key] = value;
+	for (const [key, value] of Object.entries(over)) {
+		const under = merged[key];
+		merged[key] = isJsonObject(under) && isJsonObject(value) ? mergeJson(under, value) : value;
+	}
+	return structuredClone({ ...merged });
+};
+//#endregion
+export { isJsonObject, jsonProblem, mergeJson };

package/dist/notifications/message.d.ts

@@ -0,0 +1,52 @@
+import { JsonObject } from "./json-value.js";
+//#region src/notifications/message.d.ts
+/** How soon a push service delivers a message, as Web Push names it (RFC 8030); the other senders map it to theirs. */
+export declare const urgencies: readonly ["very-low", "low", "normal", "high"];
+export type Urgency = (typeof urgencies)[number];
+/** The longest a push service keeps an undelivered message: 28 days, the most any of them keeps one. */
+export declare const maxTtlSeconds = 2419200;
+/**
+ * What `platform.web` may set beside the common message: the Web Push headers (RFC 8030's TTL, Urgency and Topic) and
+ * fields merged into the JSON payload the browser's service worker reads. Nothing else, such as the endpoint or a
+ * header of the sender's own.
+ */
+export type WebPushFields = {
+  ttl?: number;
+  urgency?: Urgency;
+  topic?: string;
+  payload?: JsonObject;
+};
+/**
+ * A notification as every sender takes it, plain data: `url` is opened on tap (an absolute `http` or `https` URL),
+ * `tag` replaces an earlier notification with the same tag, `ttl` is how long in seconds a push service keeps it for a
+ * device that is offline, and `platform` holds each protocol's own fields, merged into its request.
+ */
+export type PushMessage = {
+  title: string;
+  body?: string;
+  url?: string;
+  data?: JsonObject;
+  badge?: number;
+  sound?: string;
+  tag?: string;
+  ttl?: number;
+  urgency?: Urgency;
+  platform?: {
+    web?: WebPushFields;
+    apns?: JsonObject;
+    fcm?: JsonObject;
+  };
+};
+/** A message that is not one `pushMessage` accepts: `field` names the part at fault, never its value. */
+export declare class PushMessageError extends Error {
+  readonly field: string;
+  constructor(field: string);
+}
+/**
+ * The message, checked and as a new object, or a `PushMessageError` naming the first field at fault: every field
+ * within its format, only plain JSON in the free-form ones, and a `url` that is an absolute `http` or `https` URL,
+ * written as the WHATWG parser writes it. Senders check what they are given the same way, since a message is plain
+ * data and need not come from here.
+ */
+export declare const pushMessage: (input: PushMessage) => PushMessage;
+//#endregion

package/dist/notifications/message.js

@@ -0,0 +1,74 @@
+import { jsonProblem } from "./json-value.js";
+import { tapUrl } from "./tap-url.js";
+import { z } from "zod";
+//#region src/notifications/message.ts
+/** How soon a push service delivers a message, as Web Push names it (RFC 8030); the other senders map it to theirs. */
+const urgencies = [
+	"very-low",
+	"low",
+	"normal",
+	"high"
+];
+/** The longest a push service keeps an undelivered message: 28 days, the most any of them keeps one. */
+const maxTtlSeconds = 2419200;
+/** A message that is not one `pushMessage` accepts: `field` names the part at fault, never its value. */
+var PushMessageError = class extends Error {
+	field;
+	constructor(field) {
+		super(`The notification is invalid: ${field}`);
+		this.field = field;
+	}
+};
+const noControls = /^[^\u0000-\u001f\u007f]*$/;
+const noControlsButLines = /^[^\u0000-\u0008\u000b-\u001f\u007f]*$/;
+const topic = z.string().regex(/^[A-Za-z0-9_-]{1,32}$/);
+const ttl = z.number().int().min(0).max(maxTtlSeconds);
+const urgency = z.enum(urgencies);
+const json = z.custom((value) => typeof value === "object" && value !== null && !Array.isArray(value));
+const web = z.strictObject({
+	ttl: ttl.optional(),
+	urgency: urgency.optional(),
+	topic: topic.optional(),
+	payload: json.optional()
+});
+const message = z.strictObject({
+	title: z.string().min(1).max(256).regex(noControls),
+	body: z.string().max(2048).regex(noControlsButLines).optional(),
+	url: z.string().optional(),
+	data: json.optional(),
+	badge: z.number().int().min(0).max(1e6).optional(),
+	sound: z.string().min(1).max(256).regex(noControls).optional(),
+	tag: topic.optional(),
+	ttl: ttl.optional(),
+	urgency: urgency.optional(),
+	platform: z.strictObject({
+		web: web.optional(),
+		apns: json.optional(),
+		fcm: json.optional()
+	}).optional()
+});
+const issueField = (issue) => {
+	return (issue.code === "unrecognized_keys" ? [...issue.path, issue.keys[0]] : issue.path).join(".") || "message";
+};
+/**
+* The message, checked and as a new object, or a `PushMessageError` naming the first field at fault: every field
+* within its format, only plain JSON in the free-form ones, and a `url` that is an absolute `http` or `https` URL,
+* written as the WHATWG parser writes it. Senders check what they are given the same way, since a message is plain
+* data and need not come from here.
+*/
+const pushMessage = (input) => {
+	const problem = jsonProblem(input, "");
+	if (problem !== void 0) throw new PushMessageError(problem.slice(1) || "message");
+	const parsed = message.safeParse(input);
+	if (!parsed.success) throw new PushMessageError(issueField(parsed.error.issues[0]));
+	const checked = structuredClone(parsed.data);
+	if (checked.url === void 0) return checked;
+	const url = tapUrl(checked.url);
+	if (url === void 0) throw new PushMessageError("url");
+	return {
+		...checked,
+		url
+	};
+};
+//#endregion
+export { PushMessageError, maxTtlSeconds, pushMessage, urgencies };

package/dist/notifications/options.d.ts

@@ -1,4 +1,5 @@
 import { DeviceStore } from "./device-store.js";
+import { PushSender } from "./sender.js";
 //#region src/notifications/options.d.ts
 /** The columns of the devices table, by the name Protobase gives them. */
 export declare const deviceColumns: readonly ["id", "user_id", "kind", "token", "p256dh", "auth", "environment", "app_id", "user_agent", "created_at", "last_seen_at"];
@@ -16,5 +17,10 @@ export type NotificationsOptions = {
   };
   /** Keeps the devices somewhere else than the devices table, which is then not needed. */
   store?: DeviceStore;
+  /**
+   * Deliver notifications in place of the built-in senders, such as senders from a package; at most one for each kind
+   * of device. By default the built-in ones whose environment is set: Web Push with the `PROTOBASE_VAPID_*` variables.
+   */
+  senders?: PushSender[];
 };
 //#endregion

package/dist/notifications/options.js

@@ -1,4 +1,5 @@
 import { checkDeviceStore } from "./device-store.js";
+import { checkSenders } from "./sender.js";
 //#region src/notifications/options.ts
 /** The columns of the devices table, by the name Protobase gives them. */
 const deviceColumns = [
@@ -32,11 +33,12 @@ const notificationsNames = (options = {}) => {
 		columns
 	};
 };
-/** The options, checked as `notifications()` takes them: the names, and a given store's methods. */
+/** The options, checked as `notifications()` takes them: the names, a given store's methods and the senders given. */
 const checkNotificationsOptions = (options) => {
 	if (options.ui !== void 0 && typeof options.ui !== "boolean") throw new Error("notifications ui is true or false");
 	notificationsNames(options);
 	if (options.store !== void 0) checkDeviceStore(options.store);
+	if (options.senders !== void 0) checkSenders(options.senders);
 	return options;
 };
 //#endregion

package/dist/notifications/plugin.d.ts

@@ -4,7 +4,8 @@ import { ProjectConfig } from "../project-config.js";
 /**
  * Notifications: `extends: [notifications()]` in `protobase.config.ts`. It keeps each user's devices, in the
  * `notifications.devices` table that `protobase migration` writes or in the `store` given, and serves the endpoints
- * through which a signed-in user registers and removes their own (`devicesPath`).
+ * through which a signed-in user registers and removes their own (`devicesPath`). It delivers through `senders`, by
+ * default the built-in ones whose environment is set (see `notificationSenders`).
  */
 export declare const notifications: (options?: NotificationsOptions) => ProjectConfig;
 //#endregion

package/dist/notifications/plugin.js

@@ -3,7 +3,8 @@ import { checkNotificationsOptions } from "./options.js";
 /**
 * Notifications: `extends: [notifications()]` in `protobase.config.ts`. It keeps each user's devices, in the
 * `notifications.devices` table that `protobase migration` writes or in the `store` given, and serves the endpoints
-* through which a signed-in user registers and removes their own (`devicesPath`).
+* through which a signed-in user registers and removes their own (`devicesPath`). It delivers through `senders`, by
+* default the built-in ones whose environment is set (see `notificationSenders`).
 */
 const notifications = (options = {}) => ({
 	name: "protobase-notifications",

package/dist/notifications/sender.d.ts

@@ -0,0 +1,25 @@
+import { Device, DeviceKind } from "./device.js";
+import { PushMessage } from "./message.js";
+//#region src/notifications/sender.d.ts
+/**
+ * What a sender answers for one device: `ok` when the push service took the message, `gone` when the device no longer
+ * exists there and should be removed, `retry` when it may take the message later, after `retryAfterSeconds` when the
+ * push service says.
+ */
+export type PushAnswer = {
+  id: string;
+  result: 'ok' | 'gone' | 'retry';
+  retryAfterSeconds?: number;
+};
+/**
+ * Delivers notifications to the devices of its `kinds`, through their push service: the built-in Web Push sender, or
+ * one of the app's own passed as `notifications({ senders })`, typically from a package. `send` takes a message and a
+ * batch of devices of those kinds only, and answers each device by its id. A sender for `web` devices names the VAPID
+ * `publicKey` browsers subscribe with, which every client may read.
+ */
+export type PushSender = {
+  kinds: readonly DeviceKind[];
+  publicKey?: string;
+  send: (message: PushMessage, devices: readonly Device[]) => Promise<PushAnswer[]>;
+};
+//#endregion

package/dist/notifications/sender.js

@@ -0,0 +1,23 @@
+import { deviceKinds } from "./device.js";
+import { isPublicKey } from "./web-push/keys.js";
+//#region src/notifications/sender.ts
+const checkSender = (sender, index, claimed) => {
+	const name = `notifications({ senders }): sender ${index}`;
+	if (typeof sender !== "object" || sender === null || typeof sender.send !== "function") throw new Error(`${name} has no send method`);
+	if (!Array.isArray(sender.kinds) || sender.kinds.length === 0) throw new Error(`${name} names no kinds: ${deviceKinds.join(", ")}`);
+	for (const kind of sender.kinds) {
+		if (!deviceKinds.includes(kind)) throw new Error(`${name} names a kind that is none of ${deviceKinds.join(", ")}`);
+		if (claimed.has(kind)) throw new Error(`${name} delivers to ${kind} devices, as an earlier sender does`);
+		claimed.add(kind);
+	}
+	if (sender.publicKey !== void 0 && !isPublicKey(sender.publicKey)) throw new Error(`${name} has a publicKey that is not a P-256 public key in base64url`);
+};
+/** The senders, checked: each with a send method and kinds, no kind delivered by two, and a public key when one is named. */
+const checkSenders = (senders) => {
+	if (!Array.isArray(senders)) throw new Error("notifications({ senders }) is a list of senders");
+	const claimed = /* @__PURE__ */ new Set();
+	senders.forEach((sender, index) => checkSender(sender, index, claimed));
+	return senders;
+};
+//#endregion
+export { checkSenders };

package/dist/notifications/senders-of.d.ts

@@ -0,0 +1,10 @@
+import { PushSender } from "./sender.js";
+import { NotificationsOptions } from "./options.js";
+//#region src/notifications/senders-of.d.ts
+/**
+ * The senders `notifications()` delivers with: the app's own `senders`, which replace the built-in ones, or the
+ * built-in ones whose environment is set. Each comes guarded (see `guardedSender`): the code that sends calls them only
+ * through what this returns. A VAPID variable that is wrong stops startup.
+ */
+export declare const notificationSenders: (options: NotificationsOptions, env?: Record<string, string | undefined>) => PushSender[];
+//#endregion

package/dist/notifications/senders-of.js

@@ -0,0 +1,19 @@
+import { checkSenders } from "./sender.js";
+import { guardedSender } from "./guarded-sender.js";
+import { readVapidSettings } from "./web-push/vapid-settings.js";
+import { webPushSender } from "./web-push/web-push-sender.js";
+//#region src/notifications/senders-of.ts
+const builtInSenders = (env) => {
+	const vapid = readVapidSettings(env);
+	return vapid ? [webPushSender(vapid)] : [];
+};
+/**
+* The senders `notifications()` delivers with: the app's own `senders`, which replace the built-in ones, or the
+* built-in ones whose environment is set. Each comes guarded (see `guardedSender`): the code that sends calls them only
+* through what this returns. A VAPID variable that is wrong stops startup.
+*/
+const notificationSenders = (options, env = globalThis.process?.env ?? {}) => checkSenders(options.senders ?? builtInSenders(env)).map(guardedSender);
+/** The VAPID public key browsers subscribe with: the web sender's, when there is one. */
+const webPushKey = (senders) => senders.find((sender) => sender.kinds.includes("web"))?.publicKey;
+//#endregion
+export { notificationSenders, webPushKey };

package/dist/notifications/tap-url.js

@@ -0,0 +1,15 @@
+//#region src/notifications/tap-url.ts
+const plain = /^[^\s\u0000-\u001f\u007f-\u009f]+$/;
+/**
+* The URL a notification opens on tap, as the WHATWG parser writes it, or `undefined` when it is no absolute `http` or
+* `https` URL: a relative or scheme-relative URL, `javascript:`, `data:`, `file:`, `blob:` and every other scheme are
+* refused, since they would run or show content on tap. Any origin is allowed.
+*/
+const tapUrl = (value) => {
+	if (typeof value !== "string" || value.length > 2048 || !plain.test(value) || !URL.canParse(value)) return void 0;
+	const url = new URL(value);
+	if (url.protocol !== "https:" && url.protocol !== "http:") return void 0;
+	return url.href;
+};
+//#endregion
+export { tapUrl };

package/dist/notifications/web-push/encrypt.js

@@ -0,0 +1,45 @@
+import { createCipheriv, createECDH, hkdfSync, randomBytes } from "node:crypto";
+//#region src/notifications/web-push/encrypt.ts
+/** The record size the body is one record of. */
+const recordSize = 4096;
+/** The most plaintext one message carries: push services take a body of at most 4096 bytes, of which the 86-byte header, the 16-byte tag and the padding delimiter are not plaintext. */
+const maxPlaintextBytes = 3993;
+const derived = (ikm, salt, info, length) => Buffer.from(hkdfSync("sha256", ikm, salt, info, length));
+/**
+* `plaintext` encrypted for one subscription as Web Push's aes128gcm (RFC 8291, RFC 8188): a fresh ephemeral key and a
+* random 16-byte salt for every call, one record with its padding delimiter. `fixed` replaces both, for test vectors
+* only. Throws for a plaintext over `maxPlaintextBytes`.
+*/
+const encryptPayload = (plaintext, keys, fixed) => {
+	if (plaintext.length > 3993) throw new Error(`A Web Push payload carries at most ${maxPlaintextBytes} bytes`);
+	const salt = fixed?.salt ?? randomBytes(16);
+	const ecdh = fixed?.ecdh ?? createECDH("prime256v1");
+	const serverPublic = fixed ? ecdh.getPublicKey() : ecdh.generateKeys();
+	const secret = ecdh.computeSecret(keys.p256dh);
+	const keyInfo = Buffer.concat([
+		Buffer.from("WebPush: info\0"),
+		keys.p256dh,
+		serverPublic
+	]);
+	const ikm = derived(secret, keys.auth, keyInfo, 32);
+	const contentKey = derived(ikm, salt, Buffer.from("Content-Encoding: aes128gcm\0"), 16);
+	const nonce = derived(ikm, salt, Buffer.from("Content-Encoding: nonce\0"), 12);
+	const cipher = createCipheriv("aes-128-gcm", contentKey, nonce);
+	const ciphertext = Buffer.concat([
+		cipher.update(plaintext),
+		cipher.update(Buffer.from([2])),
+		cipher.final(),
+		cipher.getAuthTag()
+	]);
+	const size = Buffer.alloc(4);
+	size.writeUInt32BE(recordSize);
+	return Buffer.concat([
+		salt,
+		size,
+		Buffer.from([serverPublic.length]),
+		serverPublic,
+		ciphertext
+	]);
+};
+//#endregion
+export { encryptPayload, maxPlaintextBytes };

package/dist/notifications/web-push/keys.d.ts

@@ -0,0 +1,7 @@
+//#region src/notifications/web-push/keys.d.ts
+/** A fresh VAPID key pair, both in base64url, for `PROTOBASE_VAPID_PUBLIC_KEY` and `PROTOBASE_VAPID_PRIVATE_KEY`. */
+export declare const generateVapidKeys: () => {
+  publicKey: string;
+  privateKey: string;
+};
+//#endregion

package/dist/notifications/web-push/keys.js

@@ -0,0 +1,43 @@
+import { ECDH, createECDH } from "node:crypto";
+//#region src/notifications/web-push/keys.ts
+const curve = "prime256v1";
+const base64url = /^[A-Za-z0-9_-]+$/;
+/** The bytes of unpadded base64url text, or `undefined` for anything else. */
+const fromBase64url = (text) => typeof text === "string" && base64url.test(text) ? Buffer.from(text, "base64url") : void 0;
+/** Whether `bytes` is a P-256 public key, an uncompressed point on the curve, as browsers and VAPID give it. */
+const isPublicPoint = (bytes) => {
+	if (bytes?.length !== 65 || bytes[0] !== 4) return false;
+	try {
+		ECDH.convertKey(bytes, curve);
+		return true;
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ERR_CRYPTO_OPERATION_FAILED") return false;
+		throw error;
+	}
+};
+/** Whether `text` is a P-256 public key in base64url. */
+const isPublicKey = (text) => isPublicPoint(fromBase64url(text));
+/** The public key of a P-256 private key, or `undefined` when the bytes are none. */
+const publicKeyOf = (privateKey) => {
+	if (privateKey.length !== 32) return void 0;
+	const ecdh = createECDH(curve);
+	try {
+		ecdh.setPrivateKey(privateKey);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ERR_CRYPTO_INVALID_KEYTYPE") return void 0;
+		throw error;
+	}
+	return ecdh.getPublicKey();
+};
+/** A private key as 32 bytes: the runtime gives a key with leading zero bytes shorter. */
+const padPrivateKey = (privateKey) => Buffer.concat([Buffer.alloc(32 - privateKey.length), privateKey]);
+/** A fresh VAPID key pair, both in base64url, for `PROTOBASE_VAPID_PUBLIC_KEY` and `PROTOBASE_VAPID_PRIVATE_KEY`. */
+const generateVapidKeys = () => {
+	const ecdh = createECDH(curve);
+	return {
+		publicKey: ecdh.generateKeys().toString("base64url"),
+		privateKey: padPrivateKey(ecdh.getPrivateKey()).toString("base64url")
+	};
+};
+//#endregion
+export { fromBase64url, generateVapidKeys, isPublicKey, isPublicPoint, padPrivateKey, publicKeyOf };

package/dist/notifications/web-push/payload.js

@@ -0,0 +1,48 @@
+import { isJsonObject, mergeJson } from "../json-value.js";
+import { tapUrl } from "../tap-url.js";
+import { PushMessageError } from "../message.js";
+//#region src/notifications/web-push/payload.ts
+const checkedUrl = (value, field) => {
+	const url = tapUrl(value);
+	if (url === void 0) throw new PushMessageError(field);
+	return url;
+};
+const withCheckedUrls = (payload) => {
+	const checked = { ...payload };
+	if (checked.url !== void 0) checked.url = checkedUrl(checked.url, "platform.web.payload.url");
+	if (checked.notification === void 0) return checked;
+	if (!isJsonObject(checked.notification)) throw new PushMessageError("platform.web.payload.notification");
+	const notification = { ...checked.notification };
+	if (notification.navigate !== void 0) notification.navigate = checkedUrl(notification.navigate, "platform.web.payload.notification.navigate");
+	if (notification.actions !== void 0) {
+		if (!Array.isArray(notification.actions)) throw new PushMessageError("platform.web.payload.notification.actions");
+		notification.actions = notification.actions.map((action, index) => {
+			const field = `platform.web.payload.notification.actions.${index}`;
+			if (!isJsonObject(action)) throw new PushMessageError(field);
+			return action.navigate === void 0 ? action : {
+				...action,
+				navigate: checkedUrl(action.navigate, `${field}.navigate`)
+			};
+		});
+	}
+	return {
+		...checked,
+		notification
+	};
+};
+/**
+* The JSON a browser's service worker gets, from a checked message: its title, body, url, data, badge and tag, with
+* `platform.web.payload` merged over them. Every url in it is checked again after the merge, so the payload never
+* carries one that is no absolute `http` or `https` URL.
+*/
+const webPushPayload = (message) => {
+	const common = { title: message.title };
+	if (message.body !== void 0) common.body = message.body;
+	if (message.url !== void 0) common.url = message.url;
+	if (message.data !== void 0) common.data = message.data;
+	if (message.badge !== void 0) common.badge = message.badge;
+	if (message.tag !== void 0) common.tag = message.tag;
+	return withCheckedUrls(mergeJson(common, message.platform?.web?.payload ?? {}));
+};
+//#endregion
+export { webPushPayload };

package/dist/notifications/web-push/post.d.ts

@@ -0,0 +1,6 @@
+//#region src/notifications/web-push/post.d.ts
+export type PostOptions = {
+  fetch?: typeof fetch;
+  timeoutMs?: number;
+};
+//#endregion

package/dist/notifications/web-push/post.js

@@ -0,0 +1,47 @@
+//#region src/notifications/web-push/post.ts
+/** How long a push service has to answer before the device is answered `retry`. */
+const defaultPushTimeoutMs = 1e4;
+const retryAfter = (response) => {
+	const seconds = response.headers.get("retry-after")?.trim();
+	return seconds !== void 0 && /^\d{1,7}$/.test(seconds) ? {
+		result: "retry",
+		retryAfterSeconds: Number(seconds)
+	} : { result: "retry" };
+};
+/**
+* What a push service's status means for the device: any 2xx took it; 404 and 410 say the subscription is gone; every
+* other status, a redirect, a 429 or 5xx, and a 4xx that may be a configuration mistake (a wrong key), asks to try
+* again, so no mistake of ours removes devices.
+*/
+const pushResult = (response) => {
+	if (response.status >= 200 && response.status < 300) return { result: "ok" };
+	if (response.status === 404 || response.status === 410) return { result: "gone" };
+	return retryAfter(response);
+};
+const isTransient = (error) => error instanceof TypeError || error instanceof DOMException && (error.name === "TimeoutError" || error.name === "AbortError");
+/**
+* Posts one Web Push request and answers what it means for the device. Redirects are never followed, so the request
+* and its token reach only `url`, and an answer that does not come within the timeout is `retry`. Fetch's own errors
+* are never passed on, since they can name the URL: one that is not a missing answer becomes an error of its own.
+*/
+const postPush = async (url, headers, body, options = {}) => {
+	const request = new Request(url, {
+		method: "POST",
+		headers,
+		body,
+		redirect: "manual"
+	});
+	const signal = AbortSignal.timeout(options.timeoutMs ?? 1e4);
+	const send = options.fetch ?? fetch;
+	let response;
+	try {
+		response = await send(request, { signal });
+	} catch (error) {
+		if (isTransient(error)) return { result: "retry" };
+		throw new Error("A Web Push request failed unexpectedly");
+	}
+	await response.body?.cancel();
+	return pushResult(response);
+};
+//#endregion
+export { defaultPushTimeoutMs, postPush, pushResult };

package/dist/notifications/web-push/vapid-jwt.js

@@ -0,0 +1,45 @@
+import { sign } from "node:crypto";
+//#region src/notifications/web-push/vapid-jwt.ts
+/** How long a token is valid: RFC 8292 allows at most 24 hours. */
+const lifetimeSeconds = 43200;
+/** A token is signed again once less than this is left of it, so none expires on its way. */
+const refreshSeconds = 3600;
+/** The push services' origins a sender keeps a token for: a handful, as there are a handful of push services. */
+const maxAudiences = 16;
+const encoded = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+const signed = (settings, audience, exp) => {
+	const input = `${encoded({
+		typ: "JWT",
+		alg: "ES256"
+	})}.${encoded({
+		aud: audience,
+		exp,
+		sub: settings.subject
+	})}`;
+	return `${input}.${sign("sha256", Buffer.from(input), {
+		key: settings.privateKey,
+		dsaEncoding: "ieee-p1363"
+	}).toString("base64url")}`;
+};
+/**
+* The `Authorization` header of a Web Push request to a push service's origin (RFC 8292): `vapid t=<ES256 JWT>,
+* k=<public key>`. A token is reused for its origin until an hour before it expires; at most 16 origins are kept, the
+* least recently used dropped first. Each sender makes its own, so no two key pairs share a token.
+*/
+const vapidAuthorizer = (settings, now = Date.now) => {
+	const tokens = /* @__PURE__ */ new Map();
+	return (audience) => {
+		const seconds = Math.floor(now() / 1e3);
+		const kept = tokens.get(audience);
+		tokens.delete(audience);
+		const entry = kept && kept.exp - seconds > refreshSeconds ? kept : {
+			token: signed(settings, audience, seconds + lifetimeSeconds),
+			exp: seconds + lifetimeSeconds
+		};
+		tokens.set(audience, entry);
+		if (tokens.size > maxAudiences) tokens.delete(tokens.keys().next().value);
+		return `vapid t=${entry.token}, k=${settings.publicKey}`;
+	};
+};
+//#endregion
+export { vapidAuthorizer };

package/dist/notifications/web-push/vapid-settings.d.ts

@@ -0,0 +1,22 @@
+import { KeyObject } from "node:crypto";
+//#region src/notifications/web-push/vapid-settings.d.ts
+/**
+ * The VAPID key pair and contact (RFC 8292) the Web Push sender signs with. The private key is a `KeyObject`, which
+ * prints no key material when logged or serialized.
+ */
+export type VapidSettings = {
+  publicKey: string;
+  privateKey: KeyObject;
+  subject: string;
+};
+export declare const vapidPublicKeyVariable = "PROTOBASE_VAPID_PUBLIC_KEY";
+export declare const vapidPrivateKeyVariable = "PROTOBASE_VAPID_PRIVATE_KEY";
+export declare const vapidSubjectVariable = "PROTOBASE_VAPID_SUBJECT";
+/**
+ * The VAPID settings from `PROTOBASE_VAPID_PUBLIC_KEY`, `PROTOBASE_VAPID_PRIVATE_KEY` and `PROTOBASE_VAPID_SUBJECT`;
+ * `undefined` when none is set, which turns Web Push off. A blank variable counts as unset. Some set but not all, a key
+ * that is not one, a public key that is not the private key's, or a subject that is no `mailto:` or `https:` URL is a
+ * configuration error naming the variable, never its value, so the server stops at startup.
+ */
+export declare const readVapidSettings: (env: Record<string, string | undefined>) => VapidSettings | undefined;
+//#endregion

package/dist/notifications/web-push/vapid-settings.js

@@ -0,0 +1,51 @@
+import { fromBase64url, isPublicPoint, publicKeyOf } from "./keys.js";
+import { createPrivateKey } from "node:crypto";
+//#region src/notifications/web-push/vapid-settings.ts
+const vapidPublicKeyVariable = "PROTOBASE_VAPID_PUBLIC_KEY";
+const vapidPrivateKeyVariable = "PROTOBASE_VAPID_PRIVATE_KEY";
+const vapidSubjectVariable = "PROTOBASE_VAPID_SUBJECT";
+const variables = [
+	vapidPublicKeyVariable,
+	vapidPrivateKeyVariable,
+	vapidSubjectVariable
+];
+const isSubject = (subject) => {
+	if (/^mailto:[^\s@]+@[^\s@]+$/.test(subject)) return true;
+	return URL.canParse(subject) && new URL(subject).protocol === "https:" && !/\s/.test(subject);
+};
+/**
+* The VAPID settings from `PROTOBASE_VAPID_PUBLIC_KEY`, `PROTOBASE_VAPID_PRIVATE_KEY` and `PROTOBASE_VAPID_SUBJECT`;
+* `undefined` when none is set, which turns Web Push off. A blank variable counts as unset. Some set but not all, a key
+* that is not one, a public key that is not the private key's, or a subject that is no `mailto:` or `https:` URL is a
+* configuration error naming the variable, never its value, so the server stops at startup.
+*/
+const readVapidSettings = (env) => {
+	const [publicText, privateText, subject] = variables.map((name) => env[name]?.trim() || void 0);
+	if (!publicText && !privateText && !subject) return void 0;
+	const missing = variables.filter((name) => !env[name]?.trim());
+	if (missing.length > 0) throw new Error(`${missing.join(" and ")} must be set for Web Push, with ${variables.filter((name) => !missing.includes(name)).join(" and ")}; set all three, or none to turn Web Push off`);
+	const publicKey = fromBase64url(publicText);
+	if (!isPublicPoint(publicKey)) throw new Error(`${vapidPublicKeyVariable} is not a P-256 public key in base64url; generate a pair with protobase notifications vapid-keys`);
+	const privateKey = fromBase64url(privateText);
+	const derived = privateKey && publicKeyOf(privateKey);
+	if (!derived) throw new Error(`${vapidPrivateKeyVariable} is not a P-256 private key in base64url; generate a pair with protobase notifications vapid-keys`);
+	if (!derived.equals(publicKey)) throw new Error(`${vapidPublicKeyVariable} is not the public key of ${vapidPrivateKeyVariable}; set both from one pair`);
+	if (!isSubject(subject)) throw new Error(`${vapidSubjectVariable} must be a mailto: address or an https: URL, such as mailto:admin@example.com`);
+	const jwk = {
+		kty: "EC",
+		crv: "P-256",
+		d: privateKey.toString("base64url"),
+		x: publicKey.subarray(1, 33).toString("base64url"),
+		y: publicKey.subarray(33).toString("base64url")
+	};
+	return {
+		publicKey: publicKey.toString("base64url"),
+		privateKey: createPrivateKey({
+			key: jwk,
+			format: "jwk"
+		}),
+		subject
+	};
+};
+//#endregion
+export { readVapidSettings, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable };

package/dist/notifications/web-push/web-push-sender.d.ts

@@ -0,0 +1,15 @@
+import { PushSender } from "../sender.js";
+import { PostOptions } from "./post.js";
+import { VapidSettings } from "./vapid-settings.js";
+//#region src/notifications/web-push/web-push-sender.d.ts
+export type WebPushOptions = PostOptions & {
+  now?: () => number;
+};
+/**
+ * The built-in Web Push sender (RFC 8030, 8291, 8292): delivers to `web` devices, signed with the VAPID pair and
+ * encrypted for each device's keys. It checks the message as `pushMessage` does and throws before any request when it
+ * is not one. A device whose endpoint is not on a browser's push service, or whose keys are not a subscription's, is
+ * answered `gone` with no request. It logs nothing, and its errors and answers carry no endpoint, key or token.
+ */
+export declare const webPushSender: (settings: VapidSettings, options?: WebPushOptions) => PushSender;
+//#endregion

package/dist/notifications/web-push/web-push-sender.js

@@ -0,0 +1,74 @@
+import { fromBase64url, isPublicPoint } from "./keys.js";
+import { isPushEndpoint } from "../push-hosts.js";
+import { PushMessageError, pushMessage } from "../message.js";
+import { encryptPayload, maxPlaintextBytes } from "./encrypt.js";
+import { webPushPayload } from "./payload.js";
+import { postPush } from "./post.js";
+import { vapidAuthorizer } from "./vapid-jwt.js";
+//#region src/notifications/web-push/web-push-sender.ts
+/** How many requests one batch has open at once. */
+const concurrency = 8;
+const endpointOf = (device) => isPushEndpoint(device.token) ? new URL(device.token) : void 0;
+const keysOf = (device) => {
+	const p256dh = fromBase64url(device.p256dh);
+	const auth = fromBase64url(device.auth);
+	return isPublicPoint(p256dh) && auth?.length === 16 ? {
+		p256dh,
+		auth
+	} : void 0;
+};
+const headersOf = (message) => {
+	const web = message.platform?.web;
+	const urgency = web?.urgency ?? message.urgency;
+	const topic = web?.topic ?? message.tag;
+	return {
+		TTL: String(web?.ttl ?? message.ttl ?? 2419200),
+		...urgency !== void 0 && { Urgency: urgency },
+		...topic !== void 0 && { Topic: topic },
+		"Content-Type": "application/octet-stream",
+		"Content-Encoding": "aes128gcm"
+	};
+};
+/**
+* The built-in Web Push sender (RFC 8030, 8291, 8292): delivers to `web` devices, signed with the VAPID pair and
+* encrypted for each device's keys. It checks the message as `pushMessage` does and throws before any request when it
+* is not one. A device whose endpoint is not on a browser's push service, or whose keys are not a subscription's, is
+* answered `gone` with no request. It logs nothing, and its errors and answers carry no endpoint, key or token.
+*/
+const webPushSender = (settings, options = {}) => {
+	const authorization = vapidAuthorizer(settings, options.now);
+	const sendOne = async (device, headers, plaintext) => {
+		const url = endpointOf(device);
+		const keys = keysOf(device);
+		if (!url || !keys) return {
+			id: device.id,
+			result: "gone"
+		};
+		const body = encryptPayload(plaintext, keys);
+		const answer = await postPush(url, {
+			...headers,
+			Authorization: authorization(url.origin)
+		}, body, options);
+		return {
+			id: device.id,
+			...answer
+		};
+	};
+	const send = async (given, devices) => {
+		const message = pushMessage(given);
+		if (devices.some((device) => device.kind !== "web")) throw new Error("The Web Push sender was given a device that is not a web device");
+		const headers = headersOf(message);
+		const plaintext = Buffer.from(JSON.stringify(webPushPayload(message)));
+		if (plaintext.length > 3993) throw new PushMessageError(`message: its Web Push payload is over ${maxPlaintextBytes} bytes`);
+		const answers = [];
+		for (let start = 0; start < devices.length; start += concurrency) answers.push(...await Promise.all(devices.slice(start, start + concurrency).map((device) => sendOne(device, headers, plaintext))));
+		return answers;
+	};
+	return {
+		kinds: ["web"],
+		publicKey: settings.publicKey,
+		send
+	};
+};
+//#endregion
+export { webPushSender };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.45.15";
+var version = "0.45.17";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.45.15",
+  "version": "0.45.17",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.45.15",
-    "@protobase/query": "0.45.15",
-    "@protobase/schema": "0.45.15",
+    "@protobase/layout": "0.45.17",
+    "@protobase/query": "0.45.17",
+    "@protobase/schema": "0.45.17",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",