@protobase/server 0.67.7 → 0.67.9

package/dist/config-exports.d.ts

@@ -6,4 +6,5 @@ import { maxTextLength } from "./user-tables/definition-resource.js";
 import { userTableResources } from "./user-tables/user-table-resources.js";
 import { builtInResources } from "./built-in-resources.js";
 import { webhooksModule } from "./webhooks/table/webhooks-module.js";
-export { type CheckedDefinition, builtInResources, configExports, definitionsSchema, maxTextLength, ownedTableNames, userTableResources, userTablesSchema, webhooksModule };
+import { workflowsModule } from "./workflows/workflows-module.js";
+export { type CheckedDefinition, builtInResources, configExports, definitionsSchema, maxTextLength, ownedTableNames, userTableResources, userTablesSchema, webhooksModule, workflowsModule };

package/dist/config-exports.js

@@ -5,4 +5,5 @@ import { configExports } from "./resource-source.js";
 import { ownedTableNames } from "./user-tables/owned-definitions.js";
 import { userTableResources } from "./user-tables/user-table-resources.js";
 import { webhooksModule } from "./webhooks/table/webhooks-module.js";
-export { builtInResources, configExports, definitionsSchema, maxTextLength, ownedTableNames, userTableResources, userTablesSchema, webhooksModule };
+import { workflowsModule } from "./workflows/workflows-module.js";
+export { builtInResources, configExports, definitionsSchema, maxTextLength, ownedTableNames, userTableResources, userTablesSchema, webhooksModule, workflowsModule };

package/dist/create-admin.d.ts

@@ -8,6 +8,7 @@ import { Admin, Authenticator, PageSource, ViewSource } from "./types.js";
 import { CommentUsers } from "./comments/comment-users.js";
 import { HistoryOptions } from "./history/options.js";
 import { WebhooksOptions } from "./webhooks/table/options.js";
+import { WorkflowsOptions } from "./workflows/options.js";
 import { NotificationsOptions } from "./notifications/options.js";
 import { CallsOptions } from "./calls/calls-options.js";
 import { StatusOptions } from "./status/options.js";
@@ -60,6 +61,8 @@ export type CreateAdminInput = {
   subscriptions?: SubscriptionDefinition[];
   /** Webhook subscriptions made in the admin app, from `webhooks: {}` (see `WebhooksOptions`). */
   webhooks?: WebhooksOptions;
+  /** Workflows made in the admin app and run on the app's jobs, from `workflows: {}` (see `WorkflowsOptions`). */
+  workflows?: WorkflowsOptions;
   /** How `/api/sb/realtime/v1` and `/api/channels` are served: by one process or several, and whether SQL sends to channels (see `RealtimeOptions`). */
   realtime?: RealtimeOptions;
   /** Each user's devices and the endpoints that register them, from `notifications: {}` (see `NotificationsOptions`). */
@@ -107,5 +110,5 @@ export type CreateAdminInput = {
   upgradeWebSocket?: UpgradeWebSocket;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-export declare const createAdmin: ({ resources: appResources, views: appViews, userTables, pages, userMenu, bottomBars, db, authenticate, auth, functions, secret, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, realtime, notifications, status, calls, mobile, app: identity, icons, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
+export declare const createAdmin: ({ resources: appResources, views: appViews, userTables, pages, userMenu, bottomBars, db, authenticate, auth, functions, secret, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, workflows: workflowsOptions, realtime, notifications, status, calls, mobile, app: identity, icons, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
 //#endregion

package/dist/create-admin.js

@@ -57,6 +57,7 @@ import { toApiFunction } from "./functions/define-function.js";
 import { createWebhooks } from "./webhooks/webhooks.js";
 import { webhookTable } from "./webhooks/table/webhook-table.js";
 import { subscriptionUrlCheck, subscriptionWriteCheck } from "./webhooks/table/validate-hook.js";
+import { workflowEngine } from "./workflows/workflow-engine.js";
 import { callsService } from "./calls/calls-service.js";
 import { ringRoutes } from "./calls/ring-routes.js";
 import { upgradeAuthenticator } from "./functions/upgrade-caller.js";
@@ -124,7 +125,7 @@ const declaredRoles = (auth, roles) => {
 	return names.length > 0 ? [...new Set(names)] : void 0;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-const createAdmin = ({ resources: appResources, views: appViews = [], userTables, pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, secret, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, realtime, notifications, status, calls, mobile, app: identity, icons, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
+const createAdmin = ({ resources: appResources, views: appViews = [], userTables, pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, secret, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, workflows: workflowsOptions, realtime, notifications, status, calls, mobile, app: identity, icons, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
 	const basePath = options.basePath ?? "/api/v1";
 	const appModels = appResources.map((resource) => resource.toModel());
 	const withComments = appModels.some((model) => model.comments);
@@ -223,6 +224,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 		storage: servesKeys
 	});
 	const table = webhooksOptions && webhookTable(webhooksOptions, auth);
+	const engine = workflowsOptions && workflowEngine(workflowsOptions, () => deps, auth);
 	const withAi = withAiFields || hasAiActions(viewModels);
 	const model = withAi ? aiModel(options.assistant, globalThis.process?.env ?? {}) : void 0;
 	const fill = withAiFields ? fillJob(() => deps) : void 0;
@@ -242,9 +244,10 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 			...options.writeHooks ?? [],
 			...served.hooks,
 			...table ? [subscriptionWriteCheck(registry.entries.map((entry) => entry.model))] : [],
+			...engine?.hooks ?? [],
 			...fill ? [fillHook(() => deps, fill)] : []
 		],
-		writeChecks: table?.checkUrl ? [subscriptionUrlCheck(table.checkUrl)] : [],
+		writeChecks: [...table?.checkUrl ? [subscriptionUrlCheck(table.checkUrl)] : [], ...engine?.writeChecks ?? []],
 		audit: options.audit ?? consoleAuditQueue(),
 		report: options.onUnhandledError ?? ((error) => console.error(error)),
 		accessOptions: {
@@ -572,6 +575,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 		metaPath: `${deps.systemPath}/meta`,
 		jobs: [
 			...webhooks.jobs,
+			...engine ? [engine.job] : [],
 			...withHistory && days !== void 0 ? [pruneHistoryJob(changes, days)] : [],
 			...mentions ? [mentions] : [],
 			...fill ? [fill] : [],

package/dist/index.d.ts

@@ -16,6 +16,7 @@ import { Admin, AuditEvent, AuditQueue, Authenticator, Membership, PipelineHook,
 import { CommentUsers } from "./comments/comment-users.js";
 import { HistoryOptions } from "./history/options.js";
 import { WebhooksOptions } from "./webhooks/table/options.js";
+import { WorkflowsOptions } from "./workflows/options.js";
 import { ApnsEnvironment, Device, DeviceKind, NewDevice } from "./notifications/device.js";
 import { DeviceStore } from "./notifications/device-store.js";
 import { HistoryStore, maxHistoryPage, maxUnreadCount } from "./notifications/history-store.js";
@@ -101,6 +102,8 @@ import { eventMatcher } from "./changes/match-events.js";
 import { parseColumns, readOutbox } from "./changes/outbox.js";
 import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
+import { checkWorkflowsSchema, workflowsMigration } from "./workflows/schema.js";
+import { StartWorkflowOptions, startWorkflow } from "./workflows/start-workflow.js";
 import { checkUserTablesSchema, userTablesMigration } from "./user-tables/schema.js";
 import { ownedDefinitionsMigration } from "./user-tables/owned-definitions.js";
 import { UserTables, userTableResources } from "./user-tables/user-table-resources.js";
@@ -189,4 +192,4 @@ import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/ru
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, normalizeRoles } from "./better-auth/create-auth.js";
-export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailAttachment, type MailMessage, MailServerTimeoutError, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PdfComponent, type PdfOptions, type PdfTemplate, PersonalMailError, type PersonalMailErrorCode, type PersonalMailProviderId, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type UserTables, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailAttachment, type MailMessage, MailServerTimeoutError, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PdfComponent, type PdfOptions, type PdfTemplate, PersonalMailError, type PersonalMailErrorCode, type PersonalMailProviderId, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StartWorkflowOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type UserTables, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WorkflowsOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, checkWorkflowsSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, startWorkflow, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, workflowsMigration, writeRecordTools };

package/dist/index.js

@@ -113,6 +113,8 @@ import { authStoreTables } from "./better-auth/auth-tables.js";
 import { checkResourcesOutsideAuthStore } from "./better-auth/store/resources-outside.js";
 import { checkComputed, computedMigration } from "./computed/computed-schema.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
+import { checkWorkflowsSchema, workflowsMigration } from "./workflows/schema.js";
+import { startWorkflow } from "./workflows/start-workflow.js";
 import { checkUserTablesSchema, userTablesMigration } from "./user-tables/schema.js";
 import { ownedDefinitionsMigration } from "./user-tables/owned-definitions.js";
 import { userTableResources } from "./user-tables/user-table-resources.js";
@@ -140,4 +142,4 @@ import { defineEmail } from "./mail/define-email.js";
 import { definePdf } from "./pdf/define-pdf.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MailServerTimeoutError, MissingCredentials, ModelError, NotificationSendError, PersonalMailError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MailServerTimeoutError, MissingCredentials, ModelError, NotificationSendError, PersonalMailError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, checkWorkflowsSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, startWorkflow, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, workflowsMigration, writeRecordTools };

package/dist/internal.d.ts

@@ -12,4 +12,5 @@ import { fileProviderOf } from "./files/provider-settings.js";
 import { declaredJob } from "./jobs/declared-job.js";
 import { AuthPlugins, buildAuth, createAuth, loadAuthPlugins } from "./better-auth/create-auth.js";
 import { webhooksModule } from "./webhooks/table/webhooks-module.js";
-export { type AppAuthInput, type AuthPlugins, appAuthOptions, appPool, betterAuthAuthenticator, buildAppAuth, buildAuth, buildAuthenticator, checkCallsOptions, checkNotificationsOptions, checkStatusOptions, createAuth, declaredJob, fileProviderOf, isSubscription, loadAuthPlugins, localFiles, longQueryPool, s3Files, webhooksModule };
+import { workflowsModule } from "./workflows/workflows-module.js";
+export { type AppAuthInput, type AuthPlugins, appAuthOptions, appPool, betterAuthAuthenticator, buildAppAuth, buildAuth, buildAuthenticator, checkCallsOptions, checkNotificationsOptions, checkStatusOptions, createAuth, declaredJob, fileProviderOf, isSubscription, loadAuthPlugins, localFiles, longQueryPool, s3Files, webhooksModule, workflowsModule };

package/dist/internal.js

@@ -9,7 +9,8 @@ import { betterAuthAuthenticator } from "./better-auth/authenticator.js";
 import { fileProviderOf } from "./files/provider-settings.js";
 import { declaredJob } from "./jobs/declared-job.js";
 import { webhooksModule } from "./webhooks/table/webhooks-module.js";
+import { workflowsModule } from "./workflows/workflows-module.js";
 import { appAuthOptions, buildAppAuth } from "./better-auth/auth-settings.js";
 import { buildAuthenticator } from "./better-auth/authenticate-settings.js";
 import { checkCallsOptions } from "./calls/calls-options.js";
-export { appAuthOptions, appPool, betterAuthAuthenticator, buildAppAuth, buildAuth, buildAuthenticator, checkCallsOptions, checkNotificationsOptions, checkStatusOptions, createAuth, declaredJob, fileProviderOf, isSubscription, loadAuthPlugins, localFiles, longQueryPool, s3Files, webhooksModule };
+export { appAuthOptions, appPool, betterAuthAuthenticator, buildAppAuth, buildAuth, buildAuthenticator, checkCallsOptions, checkNotificationsOptions, checkStatusOptions, createAuth, declaredJob, fileProviderOf, isSubscription, loadAuthPlugins, localFiles, longQueryPool, s3Files, webhooksModule, workflowsModule };

package/dist/jobs/database.js

@@ -19,7 +19,7 @@ const transactionStatements = (text) => {
 };
 /**
 * pg-boss's database over the app's own Kysely pool or transaction: one connection pool for the app and its jobs, the
-* same driver on Node, Bun and PGlite. Every statement runs on its own, or inside one transaction for pg-boss's
+* same driver on Node and Bun. Every statement runs on its own, or inside one transaction for pg-boss's
 * transaction texts, which works through a pooler in transaction mode: pg-boss takes only transaction-scoped locks.
 */
 const jobsDatabase = (db) => ({ executeSql: async (text, values) => {

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.67.7";
+var version = "0.67.9";
 //#endregion
 export { version };

package/dist/workflows/http-step.js

@@ -0,0 +1,103 @@
+import { AddressRefusedError, pinnedRequest } from "../webhooks/table/pinned-request.js";
+import { readLimited } from "../webhooks/table/read-limited.js";
+import { isFileValue, readRunFile, storeRunFile } from "./run-files.js";
+import { StepError } from "@protobase/workflows";
+//#region src/workflows/http-step.ts
+/** The most of an answer's body the `http` step reads; a larger one fails the step. */
+const httpBodyLimit = 10485760;
+/** How much of a failing answer's body its error keeps, after secrets are blanked out of it. */
+const causeBodyLength = 200;
+const methods = /* @__PURE__ */ new Set([
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]);
+const readings = /* @__PURE__ */ new Set([
+	"json",
+	"text",
+	"file"
+]);
+const invalid = (reason) => new StepError("Http.InvalidArguments", reason);
+const isTextRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((item) => typeof item === "string");
+const checked = (args) => {
+	if (typeof args.url !== "string" || !URL.canParse(args.url)) throw invalid("url must be an http or https URL");
+	const method = args.method === void 0 ? "GET" : String(args.method).toUpperCase();
+	if (!methods.has(method)) throw invalid(`method must be one of ${[...methods].join(", ")}`);
+	if (args.headers !== void 0 && !isTextRecord(args.headers)) throw invalid("headers must be an object of text values");
+	if (args.query !== void 0 && !isTextRecord(args.query)) throw invalid("query must be an object of text values");
+	const response = args.response ?? "json";
+	if (typeof response !== "string" || !readings.has(response)) throw invalid("response must be json, text or file");
+	const url = new URL(args.url);
+	for (const [name, value] of Object.entries(args.query ?? {})) url.searchParams.append(name, value);
+	return {
+		url,
+		method,
+		headers: new Headers(args.headers),
+		response
+	};
+};
+const answerBody = async (bytes, response, url, type, keep) => {
+	if (response === "file") return keep(bytes, decodeURIComponent(url.pathname.slice(url.pathname.lastIndexOf("/") + 1)), type?.split(";")[0]?.trim() || "application/octet-stream");
+	const text = new TextDecoder().decode(bytes);
+	if (response === "text") return text;
+	if (text.trim() === "") return null;
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		if (!(error instanceof SyntaxError)) throw error;
+		throw new StepError("Http.InvalidBody", `${url.host} answered with a body that is not JSON; read it with "response": "text"`);
+	}
+};
+/**
+* The `app:http` step: one request to `url`, built at run time, through the pinned request, which resolves its host
+* once and connects only to a public address it checked. It follows no redirect, reads at most `httpBodyLimit` of
+* the answer, and fails with `Http.Status` on a status outside 2xx, `Http.Network` when no answer came.
+*/
+const httpStep = ({ allowPrivateAddresses = false, resolve, files = () => void 0 } = {}) => async (args, { runId, signal, log, redact }) => {
+	const given = args ?? {};
+	const { url, method, headers, response: reading } = checked(given);
+	let body;
+	if (given.body !== void 0 && method !== "GET") {
+		if (isFileValue(given.body)) {
+			const file = await readRunFile(files(), runId, given.body, "body");
+			body = file.bytes;
+			if (!headers.has("content-type")) headers.set("content-type", file.ref.type ?? "application/octet-stream");
+		} else if (typeof given.body === "string") body = given.body;
+		else {
+			body = JSON.stringify(given.body);
+			if (!headers.has("content-type")) headers.set("content-type", "application/json");
+		}
+	}
+	const started = Date.now();
+	const answer = await pinnedRequest(url.href, {
+		method,
+		headers,
+		...body !== void 0 && { body },
+		signal
+	}, {
+		allowPrivateAddresses,
+		...resolve && { resolve }
+	}).catch((error) => {
+		if (error instanceof AddressRefusedError) throw new StepError("Http.AddressRefused", error.message);
+		if (signal.aborted) throw error;
+		throw new StepError("Http.Network", `No answer from ${url.host}: ${error instanceof Error ? error.message : String(error)}`);
+	});
+	const bytes = await readLimited(answer, 10485761);
+	log(`${method} ${given.url}`.replace(/[?#].*$/, "") + `: ${answer.status} in ${Date.now() - started} ms`);
+	if (bytes.length > 10485760) throw new StepError("Http.ResponseTooLarge", `The answer's body is larger than ${httpBodyLimit / 1024 / 1024} MiB, the most the http step reads`);
+	if (answer.status < 200 || answer.status > 299) {
+		const excerpt = redact(new TextDecoder().decode(bytes)).slice(0, causeBodyLength);
+		throw new StepError("Http.Status", `${url.host} answered ${answer.status}${excerpt ? `: ${excerpt}` : ""}`);
+	}
+	const kept = Object.fromEntries([...answer.headers].filter(([name]) => name !== "set-cookie"));
+	const keep = (data, name, type) => storeRunFile(files(), runId, data, name, type);
+	return {
+		status: answer.status,
+		headers: kept,
+		body: await answerBody(bytes, reading, url, answer.headers.get("content-type"), keep)
+	};
+};
+//#endregion
+export { httpBodyLimit, httpStep };

package/dist/workflows/input-limits.js

@@ -0,0 +1,22 @@
+import { badRequest } from "../problem.js";
+import { limits, nestingDepth } from "@protobase/workflows";
+//#region src/workflows/input-limits.ts
+/**
+* Refuses a run's input over `limits.inputBytes` as JSON or nested deeper than `limits.inputDepth`, before anything
+* evaluates it: a 400 problem, so the run is not created.
+*/
+const checkRunInput = (input) => {
+	if (nestingDepth(input, limits.inputDepth) > limits.inputDepth) throw badRequest("input-too-deep", `A run's input nests at most ${limits.inputDepth} levels of arrays and objects`);
+	const bytes = new TextEncoder().encode(JSON.stringify(input ?? null)).length;
+	if (bytes > limits.inputBytes) throw badRequest("input-too-large", `A run's input is at most ${limits.inputBytes / 1024 / 1024} MiB as JSON; this one is ${bytes} bytes`);
+};
+/**
+* The same limits on a run's input as the API sent it, before the body is validated, whose walk of a deeply nested
+* value would overflow the call stack.
+*/
+const runInputCheck = async ({ resource, operation, body }) => {
+	if (resource !== "workflow_runs" || operation !== "create" || typeof body !== "object" || body === null) return;
+	checkRunInput(body.input);
+};
+//#endregion
+export { checkRunInput, runInputCheck };

package/dist/workflows/mail-step.js

@@ -0,0 +1,58 @@
+import { readRunFile, runFileLimit } from "./run-files.js";
+import { StepError } from "@protobase/workflows";
+const invalid = (reason) => new StepError("Mail.InvalidArguments", reason);
+const line = (value, name) => {
+	if (typeof value !== "string" || value.trim() === "") throw invalid(`${name} must be text`);
+	if (/[\r\n]/.test(value)) throw invalid(`${name} must be one line`);
+	return value;
+};
+const recipients = (value) => {
+	const list = Array.isArray(value) ? value : [value];
+	if (list.length === 0 || list.length > 50) throw invalid(`to must be one address or a list of 1 to 50`);
+	return list.map((address, index) => {
+		const name = Array.isArray(value) ? `to[${index}]` : "to";
+		if (/[,;]/.test(line(address, name))) throw invalid(`${name} must be one address; give several as a list`);
+		return address;
+	}).join(", ");
+};
+const attachmentsOf = async (value, files, runId) => {
+	if (value === void 0 || value === null) return [];
+	if (!Array.isArray(value)) throw invalid("attachments must be a list of file values");
+	const attachments = [];
+	let total = 0;
+	for (const [index, item] of value.entries()) {
+		const { ref, bytes } = await readRunFile(files, runId, item, `attachments[${index}]`);
+		total += bytes.length;
+		if (total > 10485760) throw invalid(`attachments are larger than ${runFileLimit / 1024 / 1024} MiB together`);
+		attachments.push({
+			filename: ref.name,
+			content: bytes,
+			...ref.type && { contentType: ref.type }
+		});
+	}
+	return attachments;
+};
+/**
+* The `app:mail.send` step: one message from the app's own sender, with the app's mailer; a workflow cannot set the
+* sender. Its Message-ID comes from the step's idempotency key, the same for each try, so a receiver can tell a
+* repeated try from a new mail.
+*/
+const mailStep = (mail, files) => async (args, { runId, idempotencyKey }) => {
+	const given = args ?? {};
+	const mailer = mail();
+	if (!mailer) throw new StepError("States.TaskFailed", "The app sends no mail: set its mailer, or PROTOBASE_SMTP_URL and PROTOBASE_MAIL_FROM");
+	if (typeof given.text !== "string") throw invalid("text must be text");
+	if (given.html !== void 0 && typeof given.html !== "string") throw invalid("html must be text");
+	const messageId = `<${idempotencyKey.replace(/[^A-Za-z0-9.-]/g, ".")}@workflows.invalid>`;
+	await mailer.send({
+		to: recipients(given.to),
+		subject: line(given.subject, "subject"),
+		text: given.text,
+		...given.html !== void 0 && { html: given.html },
+		headers: { "Message-ID": messageId },
+		attachments: await attachmentsOf(given.attachments, files(), runId)
+	});
+	return { message_id: messageId };
+};
+//#endregion
+export { mailStep };

package/dist/workflows/options.d.ts

@@ -0,0 +1,27 @@
+import { TenantValue } from "../types.js";
+//#region src/workflows/options.d.ts
+/** Workflows made in the admin app (`workflows: {}`), kept with their runs in a schema of the app's database. */
+export type WorkflowsOptions = {
+  /** The schema of the workflows, their versions, runs and steps; default `workflows`. */
+  schema?: string;
+  /**
+   * The environment variables workflows may read, each as `$states.context.Secrets.<NAME>`; no other is reachable.
+   * Their values are blanked out of all a run records. Startup stops when one is unset or shorter than 8 characters.
+   */
+  secrets?: string[];
+  /**
+   * The roles a workflow's last editor holds now in its tenant, which its records steps act with. Default: read from
+   * the project's Better Auth (`auth`); a project that signs people in otherwise passes its own, which the CLI reads
+   * from the default export of `workflows/saved-by-roles.ts`.
+   */
+  savedByRoles?: (user: {
+    id: string;
+    tenant?: TenantValue;
+  }) => Promise<string[]>;
+  /**
+   * Lets the `app:http` step reach private, loopback and link-local addresses, for development and tests. Default
+   * false: a URL whose host resolves to one fails the step, so a workflow cannot reach the app's own network.
+   */
+  allowPrivateAddresses?: boolean;
+};
+//#endregion

package/dist/workflows/options.js

@@ -0,0 +1,19 @@
+//#region src/workflows/options.ts
+const schemaPattern = /^[a-z_][a-z0-9_]*$/;
+const secretName = /^[A-Z_][A-Z0-9_]*$/;
+/** The schema of the options, checked. */
+const workflowsSchema = (options = {}) => {
+	const schema = options.schema ?? "workflows";
+	if (!schemaPattern.test(schema)) throw new Error(`Invalid workflows schema "${schema}": use lowercase letters, digits and "_"`);
+	if (schema.length > 63) throw new Error(`Invalid workflows schema "${schema}": at most 63 characters`);
+	return schema;
+};
+/** The secrets workflows may read, by name, from `env`; startup stops on a name that is invalid or unset. */
+const workflowSecrets = (options, env) => Object.fromEntries((options.secrets ?? []).map((name) => {
+	if (!secretName.test(name)) throw new Error(`workflows.secrets: "${name}" is not an environment variable name; use capitals, digits and "_"`);
+	const value = env[name];
+	if (value === void 0 || value === "") throw new Error(`workflows.secrets names ${name}, which is not set`);
+	return [name, value];
+}));
+//#endregion
+export { workflowSecrets, workflowsSchema };

package/dist/workflows/piece-step.js

@@ -0,0 +1,11 @@
+import { StepError } from "@protobase/workflows";
+//#region src/workflows/piece-step.ts
+/**
+* The `app:piece` step, which a definition may name but which runs no piece yet: it fails with `Piece.Error` until the
+* app's plugins give it a handler that sends through the plugin context's guarded fetch.
+*/
+const pieceStep = async () => {
+	throw new StepError("Piece.Error", "No piece runs in this app yet");
+};
+//#endregion
+export { pieceStep };

package/dist/workflows/records-step.js

@@ -0,0 +1,114 @@
+import { HttpProblem } from "../problem.js";
+import { tenantScope } from "../tenant.js";
+import { issueTicket } from "../files/ticket.js";
+import { assistantRecords, toolEntry } from "../assistant/records.js";
+import { runFileRef } from "./run-files.js";
+import { sql } from "kysely";
+import { StepError } from "@protobase/workflows";
+//#region src/workflows/records-step.ts
+const ticketSeconds = 60;
+/**
+* The session a run's records steps act in: the user who saved the version the run pinned, with the roles they hold
+* now in the run's tenant, so a workflow never does more than its last editor may do today.
+*/
+const saverSession = async ({ deps, schema, roles }, runId) => {
+	const { rows } = await sql`select v.saved_by, r.tenant_id from ${sql.id(schema, "runs")} r
+    join ${sql.id(schema, "versions")} v on v.workflow_id = r.workflow_id and v.version = r.version where r.id = ${runId}`.execute(deps().db);
+	const row = rows[0];
+	if (!row?.saved_by) throw new StepError("Records.Refused", "The run's version was not saved by a user, so its steps act on no records");
+	const tenant = row.tenant_id ?? void 0;
+	const held = await roles({
+		id: row.saved_by,
+		...tenant !== void 0 && { tenant }
+	});
+	if (held.length === 0) throw new StepError("Records.Refused", "The workflow's last editor holds no role here any more, so its steps act on no records");
+	return {
+		user: {
+			id: row.saved_by,
+			roles: held
+		},
+		...tenant !== void 0 && {
+			tenant,
+			organization: { id: tenant }
+		}
+	};
+};
+const withTickets = async (deps, session, resource, data, runId) => {
+	const entry = toolEntry(deps, resource);
+	const result = { ...data };
+	for (const [name, value] of Object.entries(data)) {
+		const field = entry.model.fields[name];
+		if (field?.type === "decimal" && typeof value === "number") result[name] = String(value);
+		if (!field?.file || value === null || typeof value !== "object") continue;
+		if (!deps.files) throw new StepError("States.TaskFailed", "The app keeps no files");
+		const ref = runFileRef(runId, value, `data.${name}`);
+		const scope = {
+			tenant: String(tenantScope(entry, session)?.tenantValue ?? ""),
+			resource: entry.name,
+			field: name,
+			user: String(session.user.id)
+		};
+		result[name] = await issueTicket(deps.files.signer, {
+			provider: ref.provider,
+			path: ref.path,
+			name: ref.name,
+			...ref.size !== void 0 && { size: ref.size }
+		}, {}, scope, Math.floor(Date.now() / 1e3) + ticketSeconds);
+	}
+	return result;
+};
+const text = (value, name) => {
+	if (typeof value !== "string" || value === "") throw new StepError("Records.InvalidArguments", `${name} must be text`);
+	return value;
+};
+const keyOf = (value) => {
+	if (typeof value === "string" || typeof value === "number") return value;
+	if (Array.isArray(value) && value.every((part) => typeof part === "string" || typeof part === "number")) return value;
+	throw new StepError("Records.InvalidArguments", "key must be text, a number or a list of them");
+};
+const rowOf = (value, name) => {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new StepError("Records.InvalidArguments", `${name} must be an object of field values`);
+	return value;
+};
+const refusedAs = (error) => {
+	if (error instanceof HttpProblem) throw new StepError("Records.Refused", `${error.status} ${error.title}: ${error.detail}`);
+	throw error;
+};
+const run = async (input, operation, args, { runId }) => {
+	const resource = text(args.resource, "resource");
+	const deps = input.deps();
+	const session = await saverSession(input, runId);
+	const records = assistantRecords(deps, session);
+	if (operation === "get") return (await records.get(resource, keyOf(args.key))).record;
+	if (operation === "update") return (await records.update(resource, keyOf(args.key), await withTickets(deps, session, resource, rowOf(args.data, "data"), runId))).record;
+	if (operation === "list") return { records: (await records.list(resource, {
+		...args.filter !== void 0 && { filter: text(args.filter, "filter") },
+		...args.order_by !== void 0 && { order_by: text(args.order_by, "order_by") },
+		...args.limit !== void 0 && { page_size: Number(args.limit) }
+	})).items.map(({ etag: _, permissions: __, ...record }) => record) };
+	if (Array.isArray(args.data)) {
+		const operations = [];
+		for (const [index, item] of args.data.entries()) operations.push({
+			op: "create",
+			resource,
+			data: await withTickets(deps, session, resource, rowOf(item, `data[${index}]`), runId)
+		});
+		return (await records.batch(operations)).flatMap((result) => result.op === "create" ? [result.record] : []);
+	}
+	return (await records.create(resource, await withTickets(deps, session, resource, rowOf(args.data, "data"), runId))).record;
+};
+/**
+* The `app:records.*` steps: `create`, `update`, `get` and `list` through the app's API as the workflow's last editor,
+* so its access rules, tenant scope, validation and write hooks apply as they do to that user's own requests.
+*/
+const recordsSteps = (input) => {
+	const step = (operation) => (args, context) => run(input, operation, rowOf(args ?? {}, "Arguments"), context).catch(refusedAs);
+	return {
+		"app:records.create": step("create"),
+		"app:records.update": step("update"),
+		"app:records.get": step("get"),
+		"app:records.list": step("list")
+	};
+};
+//#endregion
+export { recordsSteps };