@protobase/server 0.45.18 → 0.45.20

package/dist/better-auth/create-auth.d.ts

@@ -1,6 +1,7 @@
 import { StaffSignIn } from "./staff-log.js";
 import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
 import { ConnectedApp } from "./mcp/connected-apps.js";
+import { ReplacingContext } from "./end-replaced-session.js";
 import { UserDeletionListener } from "./user-deletion.js";
 import "./auth-base-path.js";
 import { Mailer } from "../mail/smtp-mailer.js";
@@ -3752,7 +3753,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               userId: string;
               expiresAt: Date;
               token: string;
-              ipAddress? /** The app keeps each user's metadata, in the column `users.metadata` names. */ : string | null | undefined;
+              ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
@@ -8590,25 +8591,6 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   })[];
   disabledPaths: string[];
   databaseHooks: {
-    session?: {
-      create: {
-        before: (session: {
-          userId: string;
-          activeOrganizationId?: string | null;
-        } & Record<string, unknown>) => Promise<{
-          data: {
-            activeOrganizationId: string;
-            userId: string;
-          };
-        } | undefined>;
-      };
-      update: {
-        after: (session: {
-          userId: string;
-          activeOrganizationId?: string | null;
-        }) => Promise<void>;
-      };
-    } | undefined;
     user: {
       create: {
         after?: ((user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>) | undefined;
@@ -8654,6 +8636,13 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         }>;
       };
     };
+    session: {
+      create: {
+        after: (session: {
+          token: string;
+        }, ctx: ReplacingContext | null) => Promise<void>;
+      };
+    };
   };
   rateLimit: {
     enabled: true;

package/dist/better-auth/create-auth.js

@@ -5,6 +5,7 @@ import { defaultSignInPolicy } from "./sign-in-policy.js";
 import { roleDefinitions } from "./organizations/role-definitions.js";
 import { signInPolicyPlugin } from "./policy-plugin.js";
 import { goTrueSessionsPlugin } from "../gotrue/sessions-plugin.js";
+import { endReplacedSession } from "./end-replaced-session.js";
 import { authBasePath } from "./auth-base-path.js";
 import { mobileRequests } from "./mobile-requests.js";
 import { passwordLength } from "./new-account-password.js";
@@ -43,6 +44,13 @@ import { betterAuth } from "better-auth";
 import { admin, emailOTP, genericOAuth, jwt } from "better-auth/plugins";
 import { adminAc, userAc } from "better-auth/plugins/admin/access";
 //#region src/better-auth/create-auth.ts
+const withEndedReplaced = (hooks) => ({
+	...hooks,
+	create: {
+		...hooks.create,
+		after: endReplacedSession
+	}
+});
 const platformOperator = () => readOperatorSettings(globalThis.process?.env ?? {});
 const platformSignInSettings = () => readPlatformSignIn(globalThis.process?.env ?? {});
 const platformOrigins = () => readOrigins(globalThis.process?.env ?? {});
@@ -244,7 +252,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				},
 				update: { before: async (user) => ({ data: confirmedOnUpdate(user, /* @__PURE__ */ new Date()) }) }
 			},
-			...organizations && { session: sessionOrganizationHooks(context) }
+			session: withEndedReplaced(organizations ? sessionOrganizationHooks(context) : {})
 		},
 		rateLimit: {
 			enabled: true,

package/dist/better-auth/end-replaced-session.d.ts

@@ -0,0 +1,17 @@
+//#region src/better-auth/end-replaced-session.d.ts
+/** The part of Better Auth's endpoint context that ending a replaced session reads. */
+export type ReplacingContext = {
+  getSignedCookie: (name: string, secret: string) => Promise<string | null | false>;
+  context: {
+    authCookies: {
+      sessionToken: {
+        name: string;
+      };
+    };
+    secret: string;
+    internalAdapter: {
+      deleteSession: (token: string) => Promise<void>;
+    };
+  };
+};
+//#endregion

package/dist/better-auth/end-replaced-session.js

@@ -0,0 +1,15 @@
+//#region src/better-auth/end-replaced-session.ts
+/**
+* Better Auth's `databaseHooks.session.create.after`: a sign-in in a browser ends the session that browser's cookie
+* held, whoever it was for, as the new session's cookie replaces it. Without this the old session would stand until it
+* expired, and with it the devices registered in it, which then kept getting their user's push in someone else's
+* browser. A staff sign-in as someone ends it too: nothing restores the earlier session when it stops.
+*/
+const endReplacedSession = async (session, ctx) => {
+	if (!ctx) return;
+	const held = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);
+	if (!held || held === session.token) return;
+	await ctx.context.internalAdapter.deleteSession(held);
+};
+//#endregion
+export { endReplacedSession };

package/dist/better-auth/live-sessions.js

@@ -0,0 +1,24 @@
+//#region src/better-auth/live-sessions.ts
+/**
+* Which of the sessions with these ids still stand, read from the store: each live one's id with its user's id. A
+* session signed out, revoked, ended by a ban or a newer sign-in in the same browser, or expired is not among them.
+* Reads by the session's id, never its token.
+*/
+const liveSessionsIn = async (context, ids, now = /* @__PURE__ */ new Date()) => {
+	const live = /* @__PURE__ */ new Map();
+	if (ids.length === 0) return live;
+	const rows = await context.adapter.findMany({
+		model: "session",
+		where: [{
+			field: "id",
+			operator: "in",
+			value: [...ids]
+		}]
+	});
+	for (const row of rows) if (ids.includes(row.id) && new Date(row.expiresAt) > now) live.set(row.id, String(row.userId));
+	return live;
+};
+/** `liveSessionsIn` on the store of this Better Auth instance. */
+const liveSessions = (auth) => async (ids) => liveSessionsIn(await auth.$context, ids);
+//#endregion
+export { liveSessions, liveSessionsIn };

package/dist/create-admin.js

@@ -57,6 +57,8 @@ import { devicesPath, historyPath } from "./notifications/paths.js";
 import { historyRoutes } from "./notifications/history-routes.js";
 import { deviceRoutes } from "./notifications/routes.js";
 import { notificationSenders, webPushKey } from "./notifications/senders-of.js";
+import { pushJob } from "./notifications/push-job.js";
+import { liveSessions } from "./better-auth/live-sessions.js";
 import { visitorsBrowse, withAnonymous } from "./anonymous.js";
 import { checkBottomBars, checkShell } from "./check-shell.js";
 import { checkOwnerFields } from "./check-owners.js";
@@ -105,7 +107,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	const appModels = appResources.map((resource) => resource.toModel());
 	const withComments = appModels.some((model) => model.comments);
 	const withAiFields = hasAiFields(appModels);
-	const withJobs = jobs.length > 0 || appModels.some(isCaptured) || withComments || withAiFields;
+	const withJobs = jobs.length > 0 || appModels.some(isCaptured) || withComments || withAiFields || notifications !== void 0;
 	const withHistory = appModels.some((model) => model.history);
 	const changes = changesSchema(events);
 	const days = historyDays(historyOptions);
@@ -373,7 +375,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	if (notifications) {
 		const devices = deviceStore(db, notifications);
 		if (auth) removeDevicesWithUsers(auth, devices);
-		app.route(devicesPath(systemPath), guarded((routes) => void routes.route("/", deviceRoutes(devices))));
+		app.route(devicesPath(systemPath), guarded((routes) => void routes.route("/", deviceRoutes(devices, { sessionRequired: Boolean(auth) }))));
 		const history = historyStore(db, notifications);
 		if (auth) removeHistoryWithUsers(auth, history);
 		app.route(historyPath(systemPath), guarded((routes) => void routes.route("/", historyRoutes(history, auth?.origins ?? []))));
@@ -435,7 +437,8 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		...webhooks.jobs,
 		...withHistory && days !== void 0 ? [pruneHistoryJob(changes, days)] : [],
 		...mentions ? [mentions] : [],
-		...fill ? [fill] : []
+		...fill ? [fill] : [],
+		...notifications ? [pushJob(notifications, senders, auth && liveSessions(auth))] : []
 	] });
 };
 //#endregion

package/dist/index.d.ts

@@ -13,6 +13,10 @@ import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
 import { StandardSchema, readJson } from "./functions/read-json.js";
+import { JsonObject, JsonValue } from "./notifications/json-value.js";
+import { HistoryPosition, NewNotification, StoredNotification, historyIdPattern, historyLimits } from "./notifications/history.js";
+import { PushMessage, PushMessageError, Urgency, WebPushFields, maxTtlSeconds, pushMessage, urgencies } from "./notifications/message.js";
+import { NotificationRecipients, NotificationSendError, SendNotification, maxMessageBytes, maxRecipients } from "./notifications/send-input.js";
 import { EnqueueOptions, JobContext, JobDefinition, JobOptions } from "./jobs/job-types.js";
 import { Admin, AuditEvent, AuditQueue, Authenticator, PipelineHook, ScanGuardMode, Session, SessionOrganization, TenantValue, User, ViewSource, WriteEvent, WriteOperation } from "./types.js";
 import { CommentUsers } from "./comments/comment-users.js";
@@ -20,10 +24,7 @@ import { HistoryOptions } from "./history/options.js";
 import { WebhooksOptions } from "./webhooks/table/options.js";
 import { ApnsEnvironment, Device, DeviceKind, NewDevice } from "./notifications/device.js";
 import { DeviceStore } from "./notifications/device-store.js";
-import { JsonObject, JsonValue } from "./notifications/json-value.js";
-import { HistoryPosition, NewNotification, StoredNotification, historyIdPattern, historyLimits } from "./notifications/history.js";
 import { HistoryStore, maxHistoryPage, maxUnreadCount } from "./notifications/history-store.js";
-import { PushMessage, PushMessageError, Urgency, WebPushFields, maxTtlSeconds, pushMessage, urgencies } from "./notifications/message.js";
 import { PushAnswer, PushSender } from "./notifications/sender.js";
 import { DeviceColumn, HistoryColumn, NotificationsOptions } from "./notifications/options.js";
 import { EventData, RunContext, SubscriptionDefinition, SubscriptionEvent, SubscriptionOptions, subscription } from "./webhooks/subscription.js";
@@ -104,6 +105,7 @@ import { historyStore, removeHistoryWithUsers } from "./notifications/history-st
 import { HistoryStoreError, postgresHistoryStore } from "./notifications/postgres-history-store.js";
 import { defaultHistoryPage } from "./notifications/history-routes.js";
 import { notificationSenders } from "./notifications/senders-of.js";
+import { sendNotification } from "./notifications/send-notification.js";
 import { VapidSettings, readVapidSettings, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable } from "./notifications/web-push/vapid-settings.js";
 import { WebPushOptions, webPushSender } from "./notifications/web-push/web-push-sender.js";
 import { generateVapidKeys } from "./notifications/web-push/keys.js";
@@ -158,4 +160,4 @@ import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.
 import { MobileRelease, ReleaseFile, ServedReleaseFile, composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { MobileReleaseAppInput, OfferedRelease, mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/index.js

@@ -70,6 +70,7 @@ import { PushMessageError, maxTtlSeconds, pushMessage, urgencies } from "./notif
 import { readVapidSettings, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable } from "./notifications/web-push/vapid-settings.js";
 import { webPushSender } from "./notifications/web-push/web-push-sender.js";
 import { notificationSenders } from "./notifications/senders-of.js";
+import { NotificationSendError, maxMessageBytes, maxRecipients } from "./notifications/send-input.js";
 import { errorReportingSettings, errorReportingVariable } from "./error-reporting/error-reporting-settings.js";
 import { storageCleanupSchedule } from "./files/cleanup-schedule.js";
 import { limitedFileStore, storeUsage } from "./files/limits.js";
@@ -102,6 +103,7 @@ import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.
 import { checkAi } from "./ai/check-ai.js";
 import { notifications } from "./notifications/plugin.js";
 import { checkNotificationsSchema, notificationsMigration } from "./notifications/schema.js";
+import { sendNotification } from "./notifications/send-notification.js";
 import { maxWidgetPropsBytes, widget } from "./assistant/widget.js";
 import { checkQueryRunner, queryRunnerMigration } from "./assistant/query-runner/query-runner.js";
 import { startErrorReporting } from "./error-reporting/error-reporter.js";
@@ -120,4 +122,4 @@ import { jobsDrainApp } from "./jobs/drain-route.js";
 import { composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, PushMessageError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, NotificationSendError, PushMessageError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/jobs/current.d.ts

@@ -4,6 +4,8 @@ import { Db } from "@protobase/query";
 /** What `defineJob(...).enqueue` reaches: the jobs runtime this process started. */
 export type JobsEnqueuer = {
   enqueue(definition: JobDefinition, db: Db, payload: unknown, options?: EnqueueOptions): Promise<string>;
+  /** The job of this name among the jobs this runtime took, or `undefined`. */
+  definition(name: string): JobDefinition | undefined;
   /** Has this process's worker of the job look for due jobs now rather than at its next poll; nothing without one. */
   wake(name: string): void;
 };

package/dist/jobs/job-progress.js

@@ -0,0 +1,30 @@
+import { jobsSchema } from "./schema.js";
+import { sql } from "kysely";
+//#region src/jobs/job-progress.ts
+/** Thrown when a try no longer holds its job: its time ran out and the job was failed, retried or taken by another try. */
+var StaleJobError = class extends Error {
+	name = "StaleJobError";
+	constructor(name) {
+		super(`Job "${name}" is no longer this try's: its time ran out`);
+	}
+};
+const held = (job) => sql`name = ${job.name} and id = ${job.id}::uuid and state = 'active' and started_on > ${job.startedOn}::timestamptz - interval '1 millisecond' and started_on < ${job.startedOn}::timestamptz + interval '1 millisecond'`;
+const table = sql.id(jobsSchema, "job");
+/** Throws a `StaleJobError` unless this try still holds the job. */
+const holdJob = async (db, job) => {
+	const { rows } = await sql`select 1 from ${table} where ${held(job)}`.execute(db);
+	if (rows.length === 0) throw new StaleJobError(job.name);
+};
+const updated = async (db, job, data) => {
+	if ((await sql`update ${table} set data = ${data} where ${held(job)}`.execute(db)).numAffectedRows !== 1n) throw new StaleJobError(job.name);
+};
+/**
+* Keeps `progress` in the job's payload under `progress`, where its next try finds it: pg-boss keeps a job's data
+* when it retries it. Only while this try holds the job, or it throws a `StaleJobError`; in `db`'s transaction when it
+* is one, so the work it marks commits with it.
+*/
+const saveJobProgress = (db, job, progress) => updated(db, job, sql`jsonb_set(data, '{progress}', ${JSON.stringify(progress)}::jsonb)`);
+/** Replaces the job's payload with `data`, as when what it held is done with; only while this try holds the job. */
+const replaceJobData = (db, job, data) => updated(db, job, sql`${JSON.stringify(data)}::jsonb`);
+//#endregion
+export { StaleJobError, holdJob, replaceJobData, saveJobProgress };

package/dist/jobs/job-types.d.ts

@@ -1,21 +1,26 @@
 import { Mailer } from "../mail/smtp-mailer.js";
 import { StandardSchema } from "../functions/read-json.js";
+import { SendNotification } from "../notifications/send-input.js";
 import { Db } from "@protobase/query";
 //#region src/jobs/job-types.d.ts
 /** What `run` gets beside the payload. */
 export type JobContext = {
   /** The database pool. The enqueuer's transaction has committed by the time a job runs. */
   db: Db;
+  /** The job, and when this try took it: each try takes it at a new time. */
   job: {
     id: string;
     name: string;
     attempt: number;
     maxAttempts: number;
+    startedOn: Date;
   };
   /** Aborted when the job's timeout passes, or when the worker shuts down and its grace period ends. */
   signal: AbortSignal;
   /** Sends mail through the app's SMTP server (`PROTOBASE_SMTP_URL`, `PROTOBASE_MAIL_FROM`); `undefined` when the app has no mail. */
   mail?: Mailer;
+  /** Sends a notification as `sendNotification` does; `undefined` when the app has no `notifications()`. */
+  sendNotification?: SendNotification;
 };
 export type JobOptions<Payload> = {
   /** Letters, digits, `_`, `-`, `.` and `/`; the job's queue in the `jobs` schema. */

package/dist/jobs/run-job.d.ts

@@ -1,3 +1,4 @@
+import "../notifications/send-input.js";
 import "./job-types.js";
 import "pg-boss";
 import { Db } from "@protobase/query";

package/dist/jobs/run-job.js

@@ -53,7 +53,7 @@ const namedTimeout = (definition, error) => {
 * One try of one job: completed when `run` returns, failed (to be retried while attempts are left) when it throws, and
 * failed for good on a `FatalJobError` or an invalid payload.
 */
-const runJob = async (definition, job, db, mail) => {
+const runJob = async (definition, job, db, { mail, sendNotification } = {}) => {
 	try {
 		const payload = await checkPayload(definition, job.data ?? void 0);
 		const context = {
@@ -62,10 +62,12 @@ const runJob = async (definition, job, db, mail) => {
 				id: job.id,
 				name: job.name,
 				attempt: job.retryCount + 1,
-				maxAttempts: job.retryLimit + 1
+				maxAttempts: job.retryLimit + 1,
+				startedOn: job.startedOn
 			},
 			signal: job.signal,
-			...mail && { mail }
+			...mail && { mail },
+			...sendNotification && { sendNotification }
 		};
 		await throughWriteFreeze(() => definition.options.run(payload, context), job.signal);
 		return {

package/dist/jobs/runtime.js

@@ -3,7 +3,9 @@ import { jobsSchema } from "./schema.js";
 import "./schedule.js";
 import { runJob, validatePayload } from "./run-job.js";
 import { platformMailer } from "../mail/platform-mailer.js";
+import "../notifications/push-job-name.js";
 import { runInBackground } from "../background-work.js";
+import { sendNotification } from "../notifications/send-notification.js";
 import { busyDatabase } from "./busy-database.js";
 import { jobsDatabase } from "./database.js";
 import { queueOptions, queueSettingsDiffer, sendOptions, workOptions } from "./options.js";
@@ -56,7 +58,10 @@ const startJobs = async ({ db, jobs, work = true, pollSeconds = 2, shutdownSecon
 			const current = definitions.get(definition.name) ?? definition;
 			return runInBackground(async () => {
 				if (current.options.schedule !== void 0 && job.singletonKey === "protobase.schedule") await schedules.following(current, job.startAfter);
-				return [await runJob(current, job, db, mail)];
+				return [await runJob(current, job, db, {
+					mail,
+					...definitions.has("notifications.send") && { sendNotification }
+				})];
 			}, { longQueries: current.options.longQueries });
 		});
 		workers.set(definition.name, {
@@ -139,6 +144,7 @@ const startJobs = async ({ db, jobs, work = true, pollSeconds = 2, shutdownSecon
 	const runtime = {
 		works: work,
 		enqueue,
+		definition: (name) => definitions.get(name),
 		wake,
 		update,
 		drain,

package/dist/notifications/caller.js

@@ -12,5 +12,19 @@ const ownSignInUser = (session) => {
 	if (userId === "" || session.user.id === void 0 || session.user.id === null) throw refuse();
 	return userId;
 };
+/**
+* The caller of a device request: `ownSignInUser`'s user, and the id of the session they signed in with, when their
+* authenticator names one. With `sessionRequired`, as with Protobase's auth, whose devices get push only while their
+* session stands, a caller without one is refused too.
+*/
+const ownSignInDevice = (session, sessionRequired) => {
+	const userId = ownSignInUser(session);
+	const sessionId = session.signIn?.session;
+	if (sessionRequired && (typeof sessionId !== "string" || sessionId === "")) throw forbidden("own-sign-in-only", "Only someone signed in as themselves can reach their devices and notifications");
+	return {
+		userId,
+		sessionId: typeof sessionId === "string" && sessionId !== "" ? sessionId : null
+	};
+};
 //#endregion
-export { ownSignInUser };
+export { ownSignInDevice, ownSignInUser };

package/dist/notifications/deliver.js

@@ -0,0 +1,133 @@
+import { FatalJobError } from "../jobs/run-job.js";
+import { PushMessageError } from "./message.js";
+import { PushSenderError } from "./guarded-sender.js";
+import { historyEntry } from "./send-input.js";
+import { NotificationStoreError, storeCall } from "./store-call.js";
+//#region src/notifications/deliver.ts
+const tally = () => ({
+	retried: 0,
+	storeFailures: /* @__PURE__ */ new Map(),
+	strays: /* @__PURE__ */ new Map(),
+	refusedField: void 0
+});
+const counted = (counts, method, count = 1) => counts.set(method, (counts.get(method) ?? 0) + count);
+const listed = (counts) => [...counts].map(([method, count]) => `${count} in ${method}`).join(", ");
+/**
+* One try of a send, resuming from `given`: for a user send, each user's history entry when the send is for the inbox
+* (once, as `record` marks it), then the user's devices as the store lists them now; for a device send, the devices
+* with those ids now. A device the store gives that is not the user's, or not one asked for, gets nothing. With
+* `liveSessions`, a device whose session no longer stands is removed instead of pushed to. Each kind's
+* devices go to its sender in one batch; a kind without a sender is skipped. An answer of `gone` removes the device,
+* `retry` leaves it to the next try once and gives up on it the second time, and any other is done. A sender that
+* throws leaves its batch to the next try. The try then throws, counting what is left, so the job retries it, or
+* completes the send.
+*/
+const deliver = async ({ to, message }, given, steps) => {
+	const progress = {
+		recorded: [...given.recorded],
+		done: [...given.done],
+		retried: [...given.retried]
+	};
+	const recorded = new Set(progress.recorded);
+	const done = new Set(progress.done);
+	const retried = new Set(progress.retried);
+	const left = tally();
+	const markDone = (id) => {
+		if (done.has(id)) return;
+		done.add(id);
+		progress.done.push(id);
+	};
+	if (steps.senders.length === 0 && !("userIds" in to && to.inbox)) return steps.complete();
+	const answered = async (sender, batch) => {
+		try {
+			return await sender.send(message, batch);
+		} catch (error) {
+			if (error instanceof PushSenderError) return void 0;
+			if (!(error instanceof PushMessageError)) throw error;
+			left.refusedField = error.field;
+			return batch.map((device) => ({
+				id: device.id,
+				result: "refused"
+			}));
+		}
+	};
+	const settle = async (device, answer) => {
+		if (answer.result === "gone") await storeCall("removeGone", () => steps.devices.removeGone([device.token]));
+		if (answer.result !== "retry" || retried.has(device.id)) return markDone(device.id);
+		retried.add(device.id);
+		progress.retried.push(device.id);
+		left.retried += 1;
+	};
+	const standing = async (devices) => {
+		const { liveSessions } = steps;
+		if (!liveSessions) return devices;
+		const pending = devices.filter((device) => !done.has(device.id));
+		const live = await liveSessions([...new Set(pending.flatMap((device) => device.sessionId === null ? [] : [device.sessionId]))]);
+		const stands = (device) => device.sessionId !== null && live.get(device.sessionId) === device.userId;
+		for (const device of pending.filter((device) => !stands(device))) {
+			await storeCall("remove", () => steps.devices.remove(device.userId, device.id));
+			markDone(device.id);
+		}
+		return pending.filter(stands);
+	};
+	const push = async (given) => {
+		const devices = await standing(given);
+		for (const device of devices) if (!steps.senders.some((sender) => sender.kinds.includes(device.kind))) markDone(device.id);
+		for (const sender of steps.senders) {
+			const batch = devices.filter((device) => sender.kinds.includes(device.kind) && !done.has(device.id));
+			if (batch.length === 0) continue;
+			await steps.hold();
+			const answers = await answered(sender, batch);
+			if (answers === void 0) left.retried += batch.length;
+			const byId = new Map((answers ?? []).map((answer) => [answer.id, answer]));
+			for (const device of answers ? batch : []) await settle(device, byId.get(device.id) ?? {
+				id: device.id,
+				result: "retry"
+			});
+			await steps.save(progress);
+		}
+	};
+	const forRecipient = async (run) => {
+		try {
+			await run();
+		} catch (error) {
+			if (!(error instanceof NotificationStoreError)) throw error;
+			counted(left.storeFailures, error.method);
+		}
+	};
+	if ("userIds" in to) for (const userId of to.userIds) await forRecipient(async () => {
+		if (to.inbox && !recorded.has(userId)) {
+			const next = {
+				...progress,
+				recorded: [...progress.recorded, userId]
+			};
+			await storeCall("record", () => steps.record(userId, historyEntry(message), next));
+			recorded.add(userId);
+			progress.recorded.push(userId);
+		}
+		const devices = await storeCall("listForUser", () => steps.devices.listForUser(userId));
+		const own = devices.filter((device) => device.userId === userId);
+		if (own.length < devices.length) counted(left.strays, "listForUser", devices.length - own.length);
+		await push(own);
+	});
+	else {
+		const wanted = new Set(to.deviceIds);
+		const ids = to.deviceIds.filter((id) => !done.has(id));
+		if (ids.length > 0) await forRecipient(async () => {
+			const devices = await storeCall("listByIds", () => steps.devices.listByIds(ids));
+			const asked = devices.filter((device) => wanted.has(device.id));
+			if (asked.length < devices.length) counted(left.strays, "listByIds", devices.length - asked.length);
+			await push(asked);
+		});
+	}
+	if (left.refusedField !== void 0) throw new FatalJobError(`notifications.send: a sender refused the message: ${left.refusedField}`);
+	const strays = left.strays.size > 0 ? `; devices the store gave that were not the recipients', which got nothing: ${listed(left.strays)}` : "";
+	if (left.retried > 0 || left.storeFailures.size > 0) {
+		const failures = left.storeFailures.size > 0 ? `; store failures: ${listed(left.storeFailures)}` : "";
+		throw new Error(`notifications.send: ${left.retried} deliveries are retried${failures}${strays}`);
+	}
+	await steps.complete();
+	if (strays) throw new FatalJobError(`notifications.send: delivered${strays}`);
+};
+//#endregion
+export { deliver };

package/dist/notifications/device-input.js

@@ -7,6 +7,7 @@ const text = (max) => z.string().min(1).max(max).regex(/^[^\u0000-\u001f\u007f]*
 const base64url = (bytes) => z.string().max(200).regex(/^[A-Za-z0-9_-]+$/).refine((value) => Buffer.from(value, "base64url").length === bytes);
 const appId = z.string().regex(/^[A-Za-z0-9._-]{1,155}$/);
 const userAgent = text(512).optional();
+const userId = text(255).optional();
 const web = z.strictObject({
 	kind: z.literal("web"),
 	endpoint: text(2048).refine(isPushEndpoint),
@@ -14,20 +15,23 @@ const web = z.strictObject({
 		p256dh: base64url(65),
 		auth: base64url(16)
 	}),
-	userAgent
+	userAgent,
+	userId
 });
 const apns = z.strictObject({
 	kind: z.literal("apns"),
 	token: z.string().regex(/^[0-9a-f]{64,200}$/),
 	environment: z.enum(apnsEnvironments),
 	appId,
-	userAgent
+	userAgent,
+	userId
 });
 const fcm = z.strictObject({
 	kind: z.literal("fcm"),
 	token: z.string().regex(/^[A-Za-z0-9_:-]{1,4096}$/),
 	appId: appId.optional(),
-	userAgent
+	userAgent,
+	userId
 });
 const registration = z.discriminatedUnion("kind", [
 	web,
@@ -37,8 +41,9 @@ const registration = z.discriminatedUnion("kind", [
 /** The largest register body, in bytes. */
 const maxDeviceBodyBytes = 8192;
 /**
-* The device a register request's JSON body describes, or a 400 that names the first field at fault and never its
-* value: one kind's fields only, each within its format and length, and nothing else, such as a user.
+* The device a register request's JSON body describes, and the user it names when it names one, or a 400 that names
+* the first field at fault and never its value: one kind's fields only, each within its format and length, and
+* nothing else.
 */
 const deviceInput = (body) => {
 	const parsed = registration.safeParse(body);
@@ -46,7 +51,13 @@ const deviceInput = (body) => {
 		const field = parsed.error.issues[0].path.join(".") || "body";
 		throw badRequest("invalid-device", `The device is invalid: ${field}`);
 	}
-	const device = parsed.data;
+	const { userId } = parsed.data;
+	return {
+		device: deviceOf(parsed.data),
+		...userId !== void 0 && { userId }
+	};
+};
+const deviceOf = (device) => {
 	const base = { userAgent: device.userAgent ?? null };
 	if (device.kind === "web") return {
 		...base,