@protobase/server 0.45.18 → 0.45.19

package/dist/create-admin.js

@@ -57,6 +57,7 @@ import { devicesPath, historyPath } from "./notifications/paths.js";
 import { historyRoutes } from "./notifications/history-routes.js";
 import { deviceRoutes } from "./notifications/routes.js";
 import { notificationSenders, webPushKey } from "./notifications/senders-of.js";
+import { pushJob } from "./notifications/push-job.js";
 import { visitorsBrowse, withAnonymous } from "./anonymous.js";
 import { checkBottomBars, checkShell } from "./check-shell.js";
 import { checkOwnerFields } from "./check-owners.js";
@@ -105,7 +106,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	const appModels = appResources.map((resource) => resource.toModel());
 	const withComments = appModels.some((model) => model.comments);
 	const withAiFields = hasAiFields(appModels);
-	const withJobs = jobs.length > 0 || appModels.some(isCaptured) || withComments || withAiFields;
+	const withJobs = jobs.length > 0 || appModels.some(isCaptured) || withComments || withAiFields || notifications !== void 0;
 	const withHistory = appModels.some((model) => model.history);
 	const changes = changesSchema(events);
 	const days = historyDays(historyOptions);
@@ -435,7 +436,8 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		...webhooks.jobs,
 		...withHistory && days !== void 0 ? [pruneHistoryJob(changes, days)] : [],
 		...mentions ? [mentions] : [],
-		...fill ? [fill] : []
+		...fill ? [fill] : [],
+		...notifications ? [pushJob(notifications, senders)] : []
 	] });
 };
 //#endregion

package/dist/index.d.ts

@@ -13,6 +13,10 @@ import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
 import { StandardSchema, readJson } from "./functions/read-json.js";
+import { JsonObject, JsonValue } from "./notifications/json-value.js";
+import { HistoryPosition, NewNotification, StoredNotification, historyIdPattern, historyLimits } from "./notifications/history.js";
+import { PushMessage, PushMessageError, Urgency, WebPushFields, maxTtlSeconds, pushMessage, urgencies } from "./notifications/message.js";
+import { NotificationRecipients, NotificationSendError, SendNotification, maxMessageBytes, maxRecipients } from "./notifications/send-input.js";
 import { EnqueueOptions, JobContext, JobDefinition, JobOptions } from "./jobs/job-types.js";
 import { Admin, AuditEvent, AuditQueue, Authenticator, PipelineHook, ScanGuardMode, Session, SessionOrganization, TenantValue, User, ViewSource, WriteEvent, WriteOperation } from "./types.js";
 import { CommentUsers } from "./comments/comment-users.js";
@@ -20,10 +24,7 @@ import { HistoryOptions } from "./history/options.js";
 import { WebhooksOptions } from "./webhooks/table/options.js";
 import { ApnsEnvironment, Device, DeviceKind, NewDevice } from "./notifications/device.js";
 import { DeviceStore } from "./notifications/device-store.js";
-import { JsonObject, JsonValue } from "./notifications/json-value.js";
-import { HistoryPosition, NewNotification, StoredNotification, historyIdPattern, historyLimits } from "./notifications/history.js";
 import { HistoryStore, maxHistoryPage, maxUnreadCount } from "./notifications/history-store.js";
-import { PushMessage, PushMessageError, Urgency, WebPushFields, maxTtlSeconds, pushMessage, urgencies } from "./notifications/message.js";
 import { PushAnswer, PushSender } from "./notifications/sender.js";
 import { DeviceColumn, HistoryColumn, NotificationsOptions } from "./notifications/options.js";
 import { EventData, RunContext, SubscriptionDefinition, SubscriptionEvent, SubscriptionOptions, subscription } from "./webhooks/subscription.js";
@@ -104,6 +105,7 @@ import { historyStore, removeHistoryWithUsers } from "./notifications/history-st
 import { HistoryStoreError, postgresHistoryStore } from "./notifications/postgres-history-store.js";
 import { defaultHistoryPage } from "./notifications/history-routes.js";
 import { notificationSenders } from "./notifications/senders-of.js";
+import { sendNotification } from "./notifications/send-notification.js";
 import { VapidSettings, readVapidSettings, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable } from "./notifications/web-push/vapid-settings.js";
 import { WebPushOptions, webPushSender } from "./notifications/web-push/web-push-sender.js";
 import { generateVapidKeys } from "./notifications/web-push/keys.js";
@@ -158,4 +160,4 @@ import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.
 import { MobileRelease, ReleaseFile, ServedReleaseFile, composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { MobileReleaseAppInput, OfferedRelease, mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/index.js

@@ -70,6 +70,7 @@ import { PushMessageError, maxTtlSeconds, pushMessage, urgencies } from "./notif
 import { readVapidSettings, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable } from "./notifications/web-push/vapid-settings.js";
 import { webPushSender } from "./notifications/web-push/web-push-sender.js";
 import { notificationSenders } from "./notifications/senders-of.js";
+import { NotificationSendError, maxMessageBytes, maxRecipients } from "./notifications/send-input.js";
 import { errorReportingSettings, errorReportingVariable } from "./error-reporting/error-reporting-settings.js";
 import { storageCleanupSchedule } from "./files/cleanup-schedule.js";
 import { limitedFileStore, storeUsage } from "./files/limits.js";
@@ -102,6 +103,7 @@ import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.
 import { checkAi } from "./ai/check-ai.js";
 import { notifications } from "./notifications/plugin.js";
 import { checkNotificationsSchema, notificationsMigration } from "./notifications/schema.js";
+import { sendNotification } from "./notifications/send-notification.js";
 import { maxWidgetPropsBytes, widget } from "./assistant/widget.js";
 import { checkQueryRunner, queryRunnerMigration } from "./assistant/query-runner/query-runner.js";
 import { startErrorReporting } from "./error-reporting/error-reporter.js";
@@ -120,4 +122,4 @@ import { jobsDrainApp } from "./jobs/drain-route.js";
 import { composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, PushMessageError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, NotificationSendError, PushMessageError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/jobs/current.d.ts

@@ -4,6 +4,8 @@ import { Db } from "@protobase/query";
 /** What `defineJob(...).enqueue` reaches: the jobs runtime this process started. */
 export type JobsEnqueuer = {
   enqueue(definition: JobDefinition, db: Db, payload: unknown, options?: EnqueueOptions): Promise<string>;
+  /** The job of this name among the jobs this runtime took, or `undefined`. */
+  definition(name: string): JobDefinition | undefined;
   /** Has this process's worker of the job look for due jobs now rather than at its next poll; nothing without one. */
   wake(name: string): void;
 };

package/dist/jobs/job-progress.js

@@ -0,0 +1,30 @@
+import { jobsSchema } from "./schema.js";
+import { sql } from "kysely";
+//#region src/jobs/job-progress.ts
+/** Thrown when a try no longer holds its job: its time ran out and the job was failed, retried or taken by another try. */
+var StaleJobError = class extends Error {
+	name = "StaleJobError";
+	constructor(name) {
+		super(`Job "${name}" is no longer this try's: its time ran out`);
+	}
+};
+const held = (job) => sql`name = ${job.name} and id = ${job.id}::uuid and state = 'active' and started_on > ${job.startedOn}::timestamptz - interval '1 millisecond' and started_on < ${job.startedOn}::timestamptz + interval '1 millisecond'`;
+const table = sql.id(jobsSchema, "job");
+/** Throws a `StaleJobError` unless this try still holds the job. */
+const holdJob = async (db, job) => {
+	const { rows } = await sql`select 1 from ${table} where ${held(job)}`.execute(db);
+	if (rows.length === 0) throw new StaleJobError(job.name);
+};
+const updated = async (db, job, data) => {
+	if ((await sql`update ${table} set data = ${data} where ${held(job)}`.execute(db)).numAffectedRows !== 1n) throw new StaleJobError(job.name);
+};
+/**
+* Keeps `progress` in the job's payload under `progress`, where its next try finds it: pg-boss keeps a job's data
+* when it retries it. Only while this try holds the job, or it throws a `StaleJobError`; in `db`'s transaction when it
+* is one, so the work it marks commits with it.
+*/
+const saveJobProgress = (db, job, progress) => updated(db, job, sql`jsonb_set(data, '{progress}', ${JSON.stringify(progress)}::jsonb)`);
+/** Replaces the job's payload with `data`, as when what it held is done with; only while this try holds the job. */
+const replaceJobData = (db, job, data) => updated(db, job, sql`${JSON.stringify(data)}::jsonb`);
+//#endregion
+export { StaleJobError, holdJob, replaceJobData, saveJobProgress };

package/dist/jobs/job-types.d.ts

@@ -1,21 +1,26 @@
 import { Mailer } from "../mail/smtp-mailer.js";
 import { StandardSchema } from "../functions/read-json.js";
+import { SendNotification } from "../notifications/send-input.js";
 import { Db } from "@protobase/query";
 //#region src/jobs/job-types.d.ts
 /** What `run` gets beside the payload. */
 export type JobContext = {
   /** The database pool. The enqueuer's transaction has committed by the time a job runs. */
   db: Db;
+  /** The job, and when this try took it: each try takes it at a new time. */
   job: {
     id: string;
     name: string;
     attempt: number;
     maxAttempts: number;
+    startedOn: Date;
   };
   /** Aborted when the job's timeout passes, or when the worker shuts down and its grace period ends. */
   signal: AbortSignal;
   /** Sends mail through the app's SMTP server (`PROTOBASE_SMTP_URL`, `PROTOBASE_MAIL_FROM`); `undefined` when the app has no mail. */
   mail?: Mailer;
+  /** Sends a notification as `sendNotification` does; `undefined` when the app has no `notifications()`. */
+  sendNotification?: SendNotification;
 };
 export type JobOptions<Payload> = {
   /** Letters, digits, `_`, `-`, `.` and `/`; the job's queue in the `jobs` schema. */

package/dist/jobs/run-job.d.ts

@@ -1,3 +1,4 @@
+import "../notifications/send-input.js";
 import "./job-types.js";
 import "pg-boss";
 import { Db } from "@protobase/query";

package/dist/jobs/run-job.js

@@ -53,7 +53,7 @@ const namedTimeout = (definition, error) => {
 * One try of one job: completed when `run` returns, failed (to be retried while attempts are left) when it throws, and
 * failed for good on a `FatalJobError` or an invalid payload.
 */
-const runJob = async (definition, job, db, mail) => {
+const runJob = async (definition, job, db, { mail, sendNotification } = {}) => {
 	try {
 		const payload = await checkPayload(definition, job.data ?? void 0);
 		const context = {
@@ -62,10 +62,12 @@ const runJob = async (definition, job, db, mail) => {
 				id: job.id,
 				name: job.name,
 				attempt: job.retryCount + 1,
-				maxAttempts: job.retryLimit + 1
+				maxAttempts: job.retryLimit + 1,
+				startedOn: job.startedOn
 			},
 			signal: job.signal,
-			...mail && { mail }
+			...mail && { mail },
+			...sendNotification && { sendNotification }
 		};
 		await throughWriteFreeze(() => definition.options.run(payload, context), job.signal);
 		return {

package/dist/jobs/runtime.js

@@ -3,7 +3,9 @@ import { jobsSchema } from "./schema.js";
 import "./schedule.js";
 import { runJob, validatePayload } from "./run-job.js";
 import { platformMailer } from "../mail/platform-mailer.js";
+import "../notifications/push-job-name.js";
 import { runInBackground } from "../background-work.js";
+import { sendNotification } from "../notifications/send-notification.js";
 import { busyDatabase } from "./busy-database.js";
 import { jobsDatabase } from "./database.js";
 import { queueOptions, queueSettingsDiffer, sendOptions, workOptions } from "./options.js";
@@ -56,7 +58,10 @@ const startJobs = async ({ db, jobs, work = true, pollSeconds = 2, shutdownSecon
 			const current = definitions.get(definition.name) ?? definition;
 			return runInBackground(async () => {
 				if (current.options.schedule !== void 0 && job.singletonKey === "protobase.schedule") await schedules.following(current, job.startAfter);
-				return [await runJob(current, job, db, mail)];
+				return [await runJob(current, job, db, {
+					mail,
+					...definitions.has("notifications.send") && { sendNotification }
+				})];
 			}, { longQueries: current.options.longQueries });
 		});
 		workers.set(definition.name, {
@@ -139,6 +144,7 @@ const startJobs = async ({ db, jobs, work = true, pollSeconds = 2, shutdownSecon
 	const runtime = {
 		works: work,
 		enqueue,
+		definition: (name) => definitions.get(name),
 		wake,
 		update,
 		drain,

package/dist/notifications/deliver.js

@@ -0,0 +1,119 @@
+import { FatalJobError } from "../jobs/run-job.js";
+import { PushMessageError } from "./message.js";
+import { PushSenderError } from "./guarded-sender.js";
+import { historyEntry } from "./send-input.js";
+import { NotificationStoreError, storeCall } from "./store-call.js";
+//#region src/notifications/deliver.ts
+const tally = () => ({
+	retried: 0,
+	storeFailures: /* @__PURE__ */ new Map(),
+	strays: /* @__PURE__ */ new Map(),
+	refusedField: void 0
+});
+const counted = (counts, method, count = 1) => counts.set(method, (counts.get(method) ?? 0) + count);
+const listed = (counts) => [...counts].map(([method, count]) => `${count} in ${method}`).join(", ");
+/**
+* One try of a send, resuming from `given`: for a user send, each user's history entry when the send is for the inbox
+* (once, as `record` marks it), then the user's devices as the store lists them now; for a device send, the devices
+* with those ids now. A device the store gives that is not the user's, or not one asked for, gets nothing. Each kind's
+* devices go to its sender in one batch; a kind without a sender is skipped. An answer of `gone` removes the device,
+* `retry` leaves it to the next try once and gives up on it the second time, and any other is done. A sender that
+* throws leaves its batch to the next try. The try then throws, counting what is left, so the job retries it, or
+* completes the send.
+*/
+const deliver = async ({ to, message }, given, steps) => {
+	const progress = {
+		recorded: [...given.recorded],
+		done: [...given.done],
+		retried: [...given.retried]
+	};
+	const recorded = new Set(progress.recorded);
+	const done = new Set(progress.done);
+	const retried = new Set(progress.retried);
+	const left = tally();
+	const markDone = (id) => {
+		if (done.has(id)) return;
+		done.add(id);
+		progress.done.push(id);
+	};
+	if (steps.senders.length === 0 && !("userIds" in to && to.inbox)) return steps.complete();
+	const answered = async (sender, batch) => {
+		try {
+			return await sender.send(message, batch);
+		} catch (error) {
+			if (error instanceof PushSenderError) return void 0;
+			if (!(error instanceof PushMessageError)) throw error;
+			left.refusedField = error.field;
+			return batch.map((device) => ({
+				id: device.id,
+				result: "refused"
+			}));
+		}
+	};
+	const settle = async (device, answer) => {
+		if (answer.result === "gone") await storeCall("removeGone", () => steps.devices.removeGone([device.token]));
+		if (answer.result !== "retry" || retried.has(device.id)) return markDone(device.id);
+		retried.add(device.id);
+		progress.retried.push(device.id);
+		left.retried += 1;
+	};
+	const push = async (devices) => {
+		for (const device of devices) if (!steps.senders.some((sender) => sender.kinds.includes(device.kind))) markDone(device.id);
+		for (const sender of steps.senders) {
+			const batch = devices.filter((device) => sender.kinds.includes(device.kind) && !done.has(device.id));
+			if (batch.length === 0) continue;
+			await steps.hold();
+			const answers = await answered(sender, batch);
+			if (answers === void 0) left.retried += batch.length;
+			const byId = new Map((answers ?? []).map((answer) => [answer.id, answer]));
+			for (const device of answers ? batch : []) await settle(device, byId.get(device.id) ?? {
+				id: device.id,
+				result: "retry"
+			});
+			await steps.save(progress);
+		}
+	};
+	const forRecipient = async (run) => {
+		try {
+			await run();
+		} catch (error) {
+			if (!(error instanceof NotificationStoreError)) throw error;
+			counted(left.storeFailures, error.method);
+		}
+	};
+	if ("userIds" in to) for (const userId of to.userIds) await forRecipient(async () => {
+		if (to.inbox && !recorded.has(userId)) {
+			const next = {
+				...progress,
+				recorded: [...progress.recorded, userId]
+			};
+			await storeCall("record", () => steps.record(userId, historyEntry(message), next));
+			recorded.add(userId);
+			progress.recorded.push(userId);
+		}
+		const devices = await storeCall("listForUser", () => steps.devices.listForUser(userId));
+		const own = devices.filter((device) => device.userId === userId);
+		if (own.length < devices.length) counted(left.strays, "listForUser", devices.length - own.length);
+		await push(own);
+	});
+	else {
+		const wanted = new Set(to.deviceIds);
+		const ids = to.deviceIds.filter((id) => !done.has(id));
+		if (ids.length > 0) await forRecipient(async () => {
+			const devices = await storeCall("listByIds", () => steps.devices.listByIds(ids));
+			const asked = devices.filter((device) => wanted.has(device.id));
+			if (asked.length < devices.length) counted(left.strays, "listByIds", devices.length - asked.length);
+			await push(asked);
+		});
+	}
+	if (left.refusedField !== void 0) throw new FatalJobError(`notifications.send: a sender refused the message: ${left.refusedField}`);
+	const strays = left.strays.size > 0 ? `; devices the store gave that were not the recipients', which got nothing: ${listed(left.strays)}` : "";
+	if (left.retried > 0 || left.storeFailures.size > 0) {
+		const failures = left.storeFailures.size > 0 ? `; store failures: ${listed(left.storeFailures)}` : "";
+		throw new Error(`notifications.send: ${left.retried} deliveries are retried${failures}${strays}`);
+	}
+	await steps.complete();
+	if (strays) throw new FatalJobError(`notifications.send: delivered${strays}`);
+};
+//#endregion
+export { deliver };

package/dist/notifications/guarded-sender.js

@@ -3,8 +3,17 @@ import { PushMessageError, pushMessage } from "./message.js";
 const results = /* @__PURE__ */ new Set([
 	"ok",
 	"gone",
-	"retry"
+	"retry",
+	"refused"
 ]);
+/** What a guarded sender throws for what its sender threw: it names the sender's index alone. */
+var PushSenderError = class extends Error {
+	index;
+	constructor(index) {
+		super(`notifications sender ${index} failed`);
+		this.index = index;
+	}
+};
 const deepFrozen = (value) => {
 	if (typeof value !== "object" || value === null) return value;
 	for (const item of Object.values(value)) deepFrozen(item);
@@ -34,7 +43,7 @@ const answersFor = (batch, given) => {
 /**
 * `sender` as the code that sends calls it, whether built in or the app's own: the message is checked as `pushMessage`
 * checks it, and refused before the sender sees it; the sender gets a frozen copy of it and of the devices of its kinds
-* only, and answers each of those once, as above. A sender that throws throws an error of its own naming its index,
+* only, and answers each of those once, as above. A sender that throws throws a `PushSenderError` naming its index,
 * never the sender's, which may carry an endpoint or a key, but for a `PushMessageError`, which names a field only.
 */
 const guardedSender = (sender, index) => {
@@ -47,7 +56,7 @@ const guardedSender = (sender, index) => {
 			answers = await sender.send(message, batch);
 		} catch (error) {
 			if (error instanceof PushMessageError) throw error;
-			throw new Error(`notifications sender ${index} failed`);
+			throw new PushSenderError(index);
 		}
 		return answersFor(batch, answers);
 	};
@@ -58,4 +67,4 @@ const guardedSender = (sender, index) => {
 	};
 };
 //#endregion
-export { guardedSender };
+export { PushSenderError, guardedSender };

package/dist/notifications/history.js

@@ -12,6 +12,7 @@ const historyLimits = {
 const noControls = /^[^\u0000-\u001f\u007f]*$/;
 const noControlsButLines = /^[^\u0000-\u0008\u000b-\u001f\u007f]*$/;
 const text = (value, max, pattern) => typeof value === "string" && value.length <= max && pattern.test(value);
+/** The first field of the notification that is not within its format, or `undefined`. */
 const notificationProblem = (notification) => {
 	if (typeof notification !== "object" || notification === null) return "notification";
 	if (!text(notification.title, historyLimits.title, noControls) || notification.title === "") return "title";
@@ -38,4 +39,4 @@ const checkedNotification = (notification) => {
 	};
 };
 //#endregion
-export { checkedNotification, historyIdPattern, historyLimits };
+export { checkedNotification, historyIdPattern, historyLimits, notificationProblem };

package/dist/notifications/push-job-name.js

@@ -0,0 +1,5 @@
+//#region src/notifications/push-job-name.ts
+/** The job that delivers what `sendNotification` sends. */
+const pushJobName = "notifications.send";
+//#endregion
+export { pushJobName };

package/dist/notifications/push-job.js

@@ -0,0 +1,50 @@
+import { defineJob } from "../jobs/define-job.js";
+import { deviceStore } from "./device-store-of.js";
+import { HistoryStoreError } from "./postgres-history-store.js";
+import { historyStore } from "./history-store-of.js";
+import { holdJob, replaceJobData, saveJobProgress } from "../jobs/job-progress.js";
+import { deliver } from "./deliver.js";
+import { noProgress, pushPayload } from "./push-payload.js";
+import { pushJobName } from "./push-job-name.js";
+//#region src/notifications/push-job.ts
+const userGone = "23503";
+/**
+* Keeps the entry and the progress that marks it kept in one transaction, with the default store, so no try records
+* it twice. An app's own store records outside it. When the user was deleted since the send, the entry is not kept
+* and the user is marked all the same, after the transaction the failed insert ended.
+*/
+const recordOnce = (db, options, job) => async (userId, entry, progress) => {
+	try {
+		await db.transaction().execute(async (trx) => {
+			await historyStore(trx, options).record(userId, entry);
+			await saveJobProgress(trx, job, progress);
+		});
+	} catch (error) {
+		if (!(error instanceof HistoryStoreError && error.sqlState === userGone)) throw error;
+		await saveJobProgress(db, job, progress);
+	}
+};
+/**
+* The job that delivers what `sendNotification` sends, through `senders` (guarded, see `notificationSenders`) and the
+* stores `options` configure. A try resumes where the last one stopped (see `deliver`); once delivered, the job keeps
+* no message. A few tries only: a device that keeps asking for a retry is given up on the second time.
+*/
+const pushJob = (options, senders) => defineJob({
+	name: pushJobName,
+	payload: pushPayload,
+	maxAttempts: 5,
+	retryDelay: "1 minute",
+	run: async (payload, { db, job }) => {
+		if ("complete" in payload) return;
+		await deliver(payload, payload.progress ?? noProgress(), {
+			devices: deviceStore(db, options),
+			senders,
+			record: recordOnce(db, options, job),
+			save: (progress) => saveJobProgress(db, job, progress),
+			hold: () => holdJob(db, job),
+			complete: () => replaceJobData(db, job, { complete: true })
+		});
+	}
+});
+//#endregion
+export { pushJob };

package/dist/notifications/push-payload.js

@@ -0,0 +1,60 @@
+import { NotificationSendError, checkedSend, isPlainRecord, maxRecipients } from "./send-input.js";
+//#region src/notifications/push-payload.ts
+const noProgress = () => ({
+	recorded: [],
+	done: [],
+	retried: []
+});
+const maxProgressIds = maxRecipients * 64;
+const progressOf = (value) => {
+	if (!isPlainRecord(value)) return void 0;
+	const keys = Object.keys(value);
+	if (keys.length !== 3 || ![
+		"recorded",
+		"done",
+		"retried"
+	].every((key) => keys.includes(key))) return void 0;
+	if (![
+		value.recorded,
+		value.done,
+		value.retried
+	].every((list) => Array.isArray(list) && list.length <= maxProgressIds && list.every((id) => typeof id === "string"))) return void 0;
+	return {
+		recorded: [...value.recorded],
+		done: [...value.done],
+		retried: [...value.retried]
+	};
+};
+const invalid = (message) => ({ issues: [{ message }] });
+/**
+* The payload as the send job checks it when enqueued and before each try: the send checked again as `checkedSend`
+* checks it, so a job queued around `sendNotification` is refused the same way and runs nothing.
+*/
+const validate = (value) => {
+	if (!isPlainRecord(value)) return invalid("The notification send is not an object");
+	if (value.complete === true && Object.keys(value).length === 1) return { value: { complete: true } };
+	if (Object.keys(value).some((key) => ![
+		"to",
+		"message",
+		"progress"
+	].includes(key))) return invalid("The notification send has a field it does not take");
+	const progress = value.progress === void 0 ? void 0 : progressOf(value.progress);
+	if (value.progress !== void 0 && progress === void 0) return invalid("The notification send has an invalid progress");
+	let send;
+	try {
+		send = checkedSend(value.to, value.message);
+	} catch (error) {
+		if (!(error instanceof NotificationSendError)) throw error;
+		return invalid(error.message);
+	}
+	return { value: {
+		...send,
+		...progress && { progress }
+	} };
+};
+const pushPayload = { "~standard": {
+	version: 1,
+	validate
+} };
+//#endregion
+export { noProgress, pushPayload };

package/dist/notifications/send-input.d.ts

@@ -0,0 +1,28 @@
+import { PushMessage } from "./message.js";
+import { Db } from "@protobase/query";
+//#region src/notifications/send-input.d.ts
+/** The most users or devices one send reaches. */
+export declare const maxRecipients = 1000;
+/** The most bytes a checked message takes as JSON. */
+export declare const maxMessageBytes = 16384;
+/**
+ * Who a send reaches: users, saying whether it shows in their inbox, or devices by id, which it is only pushed to.
+ * `inbox` is required on a user send and refused on a device send.
+ */
+export type NotificationRecipients = {
+  userIds: readonly string[];
+  inbox: boolean;
+  deviceIds?: never;
+} | {
+  deviceIds: readonly string[];
+  userIds?: never;
+  inbox?: never;
+};
+/** Sends a notification as `sendNotification` does. */
+export type SendNotification = (db: Db, to: NotificationRecipients, message: PushMessage) => Promise<void>;
+/** A send that is not one `checkedSend` accepts: `field` names the part at fault, never its value. */
+export declare class NotificationSendError extends Error {
+  readonly field: string;
+  constructor(field: string);
+}
+//#endregion

package/dist/notifications/send-input.js

@@ -0,0 +1,80 @@
+import { notificationProblem } from "./history.js";
+import { PushMessageError, pushMessage } from "./message.js";
+//#region src/notifications/send-input.ts
+/** The most users or devices one send reaches. */
+const maxRecipients = 1e3;
+/** The most bytes a checked message takes as JSON. */
+const maxMessageBytes = 16384;
+/** A send that is not one `checkedSend` accepts: `field` names the part at fault, never its value. */
+var NotificationSendError = class extends Error {
+	field;
+	constructor(field) {
+		super(`The notification cannot be sent: its ${field} is invalid`);
+		this.field = field;
+	}
+};
+const idPattern = /^[^\u0000-\u001f\u007f]{1,256}$/;
+/** Whether `value` is an object literal, so its keys are all it holds. */
+const isPlainRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && [Object.prototype, null].includes(Object.getPrototypeOf(value));
+const checkedIds = (value, field) => {
+	if (!Array.isArray(value) || value.length === 0 || value.length > 1e3) throw new NotificationSendError(field);
+	if (!value.every((id) => typeof id === "string" && idPattern.test(id))) throw new NotificationSendError(field);
+	return [...new Set(value)];
+};
+const checkedKeys = (to, allowed) => {
+	const unknown = Object.keys(to).find((key) => !allowed.includes(key));
+	if (unknown !== void 0) throw new NotificationSendError(`to.${unknown}`);
+};
+const checkedRecipients = (to) => {
+	if (!isPlainRecord(to)) throw new NotificationSendError("to");
+	if (Object.hasOwn(to, "userIds") && Object.hasOwn(to, "deviceIds")) throw new NotificationSendError("to");
+	if (Object.hasOwn(to, "deviceIds")) {
+		checkedKeys(to, ["deviceIds"]);
+		return { deviceIds: checkedIds(to.deviceIds, "to.deviceIds") };
+	}
+	if (!Object.hasOwn(to, "userIds")) throw new NotificationSendError("to");
+	checkedKeys(to, ["userIds", "inbox"]);
+	if (typeof to.inbox !== "boolean") throw new NotificationSendError("to.inbox");
+	return {
+		userIds: checkedIds(to.userIds, "to.userIds"),
+		inbox: to.inbox
+	};
+};
+const checkedMessage = (message) => {
+	let checked;
+	try {
+		checked = pushMessage(message);
+	} catch (error) {
+		if (!(error instanceof PushMessageError)) throw error;
+		throw new NotificationSendError(error.field === "message" ? "message" : `message.${error.field}`);
+	}
+	if (Buffer.byteLength(JSON.stringify(checked)) > 16384) throw new NotificationSendError("message");
+	return checked;
+};
+/** The entry a user's history keeps of a checked message. */
+const historyEntry = (message) => ({
+	title: message.title,
+	body: message.body ?? null,
+	url: message.url ?? null,
+	data: message.data ?? null
+});
+/**
+* The send, checked, or a `NotificationSendError` naming the first field at fault: recipients of one kind, 1 to
+* `maxRecipients` ids, a user send's `inbox` a boolean, and a message `pushMessage` accepts, its url an absolute `http`
+* or `https` URL written as the parser writes it, of at most `maxMessageBytes`. For the inbox, the message must also be
+* one the history keeps.
+*/
+const checkedSend = (to, message) => {
+	const recipients = checkedRecipients(to);
+	const checked = checkedMessage(message);
+	if ("userIds" in recipients && recipients.inbox) {
+		const problem = notificationProblem(historyEntry(checked));
+		if (problem !== void 0) throw new NotificationSendError(`message.${problem}`);
+	}
+	return {
+		to: recipients,
+		message: checked
+	};
+};
+//#endregion
+export { NotificationSendError, checkedSend, historyEntry, isPlainRecord, maxMessageBytes, maxRecipients };

package/dist/notifications/send-notification.d.ts

@@ -0,0 +1,11 @@
+import { SendNotification } from "./send-input.js";
+//#region src/notifications/send-notification.d.ts
+/**
+ * Sends `message` to users or to devices as a background job, enqueued in `db`'s transaction when it is one, so it
+ * goes out only once that commits. A user send says whether it shows in the users' inbox: then each user's history
+ * keeps it, and either way it is pushed to their devices as they are when the job runs; a device send is only pushed.
+ * The send is checked before anything is enqueued (see `checkedSend`), and authorizes nothing: who gets what is the
+ * caller's to decide.
+ */
+export declare const sendNotification: SendNotification;
+//#endregion

package/dist/notifications/send-notification.js

@@ -0,0 +1,19 @@
+import { currentJobs } from "../jobs/current.js";
+import { checkedSend } from "./send-input.js";
+import { pushJobName } from "./push-job-name.js";
+//#region src/notifications/send-notification.ts
+/**
+* Sends `message` to users or to devices as a background job, enqueued in `db`'s transaction when it is one, so it
+* goes out only once that commits. A user send says whether it shows in the users' inbox: then each user's history
+* keeps it, and either way it is pushed to their devices as they are when the job runs; a device send is only pushed.
+* The send is checked before anything is enqueued (see `checkedSend`), and authorizes nothing: who gets what is the
+* caller's to decide.
+*/
+const sendNotification = async (db, to, message) => {
+	const send = checkedSend(to, message);
+	const job = currentJobs().definition(pushJobName);
+	if (!job) throw new Error("Notifications are off: add extends: [notifications()] to protobase.config.ts to send them");
+	await job.enqueue(db, send);
+};
+//#endregion
+export { sendNotification };

package/dist/notifications/sender.d.ts

@@ -1,14 +1,15 @@
-import { Device, DeviceKind } from "./device.js";
 import { PushMessage } from "./message.js";
+import { Device, DeviceKind } from "./device.js";
 //#region src/notifications/sender.d.ts
 /**
  * What a sender answers for one device: `ok` when the push service took the message, `gone` when the device no longer
  * exists there and should be removed, `retry` when it may take the message later, after `retryAfterSeconds` when the
- * push service says.
+ * push service says, and `refused` when the sender never delivers to the device as it is stored, such as one whose
+ * endpoint is on no known push service: it is neither retried nor removed.
  */
 export type PushAnswer = {
   id: string;
-  result: 'ok' | 'gone' | 'retry';
+  result: 'ok' | 'gone' | 'retry' | 'refused';
   retryAfterSeconds?: number;
 };
 /**

package/dist/notifications/store-call.js

@@ -0,0 +1,32 @@
+import { StaleJobError } from "../jobs/job-progress.js";
+//#region src/notifications/store-call.ts
+/** A device or history store method that failed while sending: it names the method and at most a SQLSTATE. */
+var NotificationStoreError = class extends Error {
+	method;
+	code;
+	constructor(method, code) {
+		super(`The notifications store's ${method} failed${code ? ` (${code})` : ""}`);
+		this.method = method;
+		this.code = code;
+	}
+};
+const sqlStatePattern = /^[0-9A-Z]{5}$/;
+const codeOf = (error) => {
+	const { sqlState, code } = typeof error === "object" && error !== null ? error : {};
+	return [sqlState, code].find((value) => typeof value === "string" && sqlStatePattern.test(value));
+};
+/**
+* Calls a store method for the send job. Whatever it throws becomes a `NotificationStoreError` with no cause: an app's
+* own store may throw a driver error whose message or detail holds a token or key, and the job keeps its error. A try
+* that no longer holds its job stops as it is.
+*/
+const storeCall = async (method, call) => {
+	try {
+		return await call();
+	} catch (error) {
+		if (error instanceof StaleJobError) throw error;
+		throw new NotificationStoreError(method, codeOf(error));
+	}
+};
+//#endregion
+export { NotificationStoreError, storeCall };

package/dist/notifications/web-push/web-push-sender.d.ts

@@ -9,7 +9,7 @@ export type WebPushOptions = PostOptions & {
  * The built-in Web Push sender (RFC 8030, 8291, 8292): delivers to `web` devices, signed with the VAPID pair and
  * encrypted for each device's keys. It checks the message as `pushMessage` does and throws before any request when it
  * is not one. A device whose endpoint is not on a browser's push service, or whose keys are not a subscription's, is
- * answered `gone` with no request. It logs nothing, and its errors and answers carry no endpoint, key or token.
+ * answered `refused` with no request. It logs nothing, and its errors and answers carry no endpoint, key or token.
  */
 export declare const webPushSender: (settings: VapidSettings, options?: WebPushOptions) => PushSender;
 //#endregion

package/dist/notifications/web-push/web-push-sender.js

@@ -33,7 +33,7 @@ const headersOf = (message) => {
 * The built-in Web Push sender (RFC 8030, 8291, 8292): delivers to `web` devices, signed with the VAPID pair and
 * encrypted for each device's keys. It checks the message as `pushMessage` does and throws before any request when it
 * is not one. A device whose endpoint is not on a browser's push service, or whose keys are not a subscription's, is
-* answered `gone` with no request. It logs nothing, and its errors and answers carry no endpoint, key or token.
+* answered `refused` with no request. It logs nothing, and its errors and answers carry no endpoint, key or token.
 */
 const webPushSender = (settings, options = {}) => {
 	const authorization = vapidAuthorizer(settings, options.now);
@@ -42,7 +42,7 @@ const webPushSender = (settings, options = {}) => {
 		const keys = keysOf(device);
 		if (!url || !keys) return {
 			id: device.id,
-			result: "gone"
+			result: "refused"
 		};
 		const body = encryptPayload(plaintext, keys);
 		const answer = await postPush(url, {

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.45.18";
+var version = "0.45.19";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.45.18",
+  "version": "0.45.19",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.45.18",
-    "@protobase/query": "0.45.18",
-    "@protobase/schema": "0.45.18",
+    "@protobase/layout": "0.45.19",
+    "@protobase/query": "0.45.19",
+    "@protobase/schema": "0.45.19",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",