@protobase/server 0.67.9 → 0.67.11

package/dist/create-admin.js

@@ -38,8 +38,10 @@ import { changesSchema } from "./changes/events-options.js";
 import { mcpToolContext } from "./mcp/mcp-context.js";
 import { mcpHandler } from "./mcp/mcp-handler.js";
 import { closedMcpRoutes, mcpRoutes } from "./mcp/mcp-routes.js";
+import { mcpInstructions } from "./mcp/mcp-instructions.js";
 import { mcpServer } from "./mcp/mcp-server.js";
 import { mcpTools } from "./mcp/mcp-tools.js";
+import { workflowInstructions } from "./workflows/mcp/workflow-instructions.js";
 import { withoutSessionTokens } from "./better-auth/without-session-tokens.js";
 import { organizationRoutes } from "./better-auth/organizations/admin-routes.js";
 import { statusRoute } from "./better-auth/status-route.js";
@@ -384,8 +386,10 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 			sql: options.mcp !== false && options.mcp?.sql === true,
 			writes,
 			commented,
+			workflows: Boolean(engine),
 			own: options.mcp !== false && options.mcp?.tools || []
 		});
+		const instructions = engine ? `${mcpInstructions}\n${workflowInstructions}` : mcpInstructions;
 		const approvals = mcpApprovals();
 		const { resource } = auth.mcp;
 		const info = {
@@ -400,6 +404,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 			});
 			return mcpServer({
 				info,
+				instructions,
 				tools: tools(session),
 				context,
 				report,

package/dist/index.d.ts

@@ -152,6 +152,9 @@ import { McpServerInput, mcpServer } from "./mcp/mcp-server.js";
 import { mcpIcons } from "./web-app/mcp-icons.js";
 import { mcpInstructions } from "./mcp/mcp-instructions.js";
 import { McpToolsInput, mcpTools } from "./mcp/mcp-tools.js";
+import { workflowReadTools } from "./workflows/mcp/workflow-read-tools.js";
+import { workflowWriteTools } from "./workflows/mcp/workflow-write-tools.js";
+import { workflowInstructions } from "./workflows/mcp/workflow-instructions.js";
 import { McpGateInput, mcpGate, sessionOf } from "./mcp/mcp-gate.js";
 import { McpHandlerInput, mcpHandler } from "./mcp/mcp-handler.js";
 import { McpRoutesInput, mcpRoutes } from "./mcp/mcp-routes.js";
@@ -192,4 +195,4 @@ import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/ru
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, normalizeRoles } from "./better-auth/create-auth.js";
-export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailAttachment, type MailMessage, MailServerTimeoutError, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PdfComponent, type PdfOptions, type PdfTemplate, PersonalMailError, type PersonalMailErrorCode, type PersonalMailProviderId, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StartWorkflowOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type UserTables, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WorkflowsOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, checkWorkflowsSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, startWorkflow, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, workflowsMigration, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailAttachment, type MailMessage, MailServerTimeoutError, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PdfComponent, type PdfOptions, type PdfTemplate, PersonalMailError, type PersonalMailErrorCode, type PersonalMailProviderId, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StartWorkflowOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type UserTables, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WorkflowsOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, checkWorkflowsSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, startWorkflow, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, workflowInstructions, workflowReadTools, workflowWriteTools, workflowsMigration, writeRecordTools };

package/dist/index.js

@@ -55,7 +55,10 @@ import { deleteRecordTool } from "./assistant/delete-record-tool.js";
 import { createRecordTool, updateRecordTool, writeRecordTools } from "./assistant/write-record-tools.js";
 import { batchWriteTool } from "./assistant/batch-write-tool.js";
 import { addCommentTool, commentTools, listCommentsTool } from "./assistant/comment-tools.js";
+import { workflowReadTools } from "./workflows/mcp/workflow-read-tools.js";
+import { workflowWriteTools } from "./workflows/mcp/workflow-write-tools.js";
 import { mcpTools } from "./mcp/mcp-tools.js";
+import { workflowInstructions } from "./workflows/mcp/workflow-instructions.js";
 import { addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
 import { createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { coalesce } from "./changes/coalesce.js";
@@ -142,4 +145,4 @@ import { defineEmail } from "./mail/define-email.js";
 import { definePdf } from "./pdf/define-pdf.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MailServerTimeoutError, MissingCredentials, ModelError, NotificationSendError, PersonalMailError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, checkWorkflowsSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, startWorkflow, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, workflowsMigration, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MailServerTimeoutError, MissingCredentials, ModelError, NotificationSendError, PersonalMailError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, checkWorkflowsSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, startWorkflow, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, workflowInstructions, workflowReadTools, workflowWriteTools, workflowsMigration, writeRecordTools };

package/dist/mcp/mcp-tools.d.ts

@@ -18,14 +18,20 @@ export type McpToolsInput = {
    * those of them that `writes` lists when it lists some. None by default.
    */
   commented?: string[];
+  /**
+   * Offers the workflow tools, for an app with `workflows`: reading workflows, their types and runs, and checking
+   * definitions; with writes on, `create_workflow`, `update_workflow` and `run_workflow` too. Off by default.
+   */
+  workflows?: boolean;
   /** The app's own tools, offered to every caller after the built-in ones. */
   own?: AssistantTool[];
 };
 /**
  * The MCP tools for a caller: the record tools, the write tools when `writes` is on, the comment tools when a resource
- * takes comments, read-only SQL when `sql` is on and the caller sees the assistant, then the app's own tools. The
+ * takes comments, the workflow tools with `workflows`, read-only SQL when `sql` is on and the caller sees the
+ * assistant, then the app's own tools. The
  * tools are built once and only chosen per session: the MCP server compiles each tool's schema, and a schema object made
  * per request would be compiled again.
  */
-export declare const mcpTools: ({ db, sql, writes, commented, own }: McpToolsInput) => (session: Session) => AssistantTool[];
+export declare const mcpTools: ({ db, sql, writes, commented, workflows, own }: McpToolsInput) => (session: Session) => AssistantTool[];
 //#endregion

package/dist/mcp/mcp-tools.js

@@ -5,13 +5,17 @@ import { readRecordTools } from "../assistant/record-tools.js";
 import { writeRecordTools } from "../assistant/write-record-tools.js";
 import { batchWriteTool } from "../assistant/batch-write-tool.js";
 import { commentTools } from "../assistant/comment-tools.js";
+import { workflowReadTools } from "../workflows/mcp/workflow-read-tools.js";
+import { workflowWriteTools } from "../workflows/mcp/workflow-write-tools.js";
 //#region src/mcp/mcp-tools.ts
 const writeTools = (input) => [...writeRecordTools(input), batchWriteTool(input)];
 const builtInNames = (db) => new Set([
 	...readRecordTools(),
 	...writeTools({}),
 	...commentTools({ commented: ["comments"] }, {}),
-	readOnlyQueryTool(db)
+	readOnlyQueryTool(db),
+	...workflowReadTools(),
+	...workflowWriteTools()
 ].map((tool) => tool.name));
 /** The app's own tools; one whose name is taken twice, or by a built-in tool, stops the server at startup. */
 const checkedOwnTools = (db, own) => {
@@ -22,21 +26,24 @@ const checkedOwnTools = (db, own) => {
 };
 /**
 * The MCP tools for a caller: the record tools, the write tools when `writes` is on, the comment tools when a resource
-* takes comments, read-only SQL when `sql` is on and the caller sees the assistant, then the app's own tools. The
+* takes comments, the workflow tools with `workflows`, read-only SQL when `sql` is on and the caller sees the
+* assistant, then the app's own tools. The
 * tools are built once and only chosen per session: the MCP server compiles each tool's schema, and a schema object made
 * per request would be compiled again.
 */
-const mcpTools = ({ db, sql, writes, commented = [], own = [] }) => {
+const mcpTools = ({ db, sql, writes, commented = [], workflows = false, own = [] }) => {
 	const ownTools = checkedOwnTools(db, own);
 	const read = readRecordTools();
 	const limits = writes === false ? false : writes === true || !writes.resources ? {} : { resources: writes.resources };
 	const write = limits === false ? [] : writeTools(limits);
 	const comments = commentTools({ commented }, limits);
+	const flows = workflows ? [...workflowReadTools(), ...limits === false ? [] : workflowWriteTools(limits)] : [];
 	const query = sql ? [readOnlyQueryTool(db)] : [];
 	return (session) => [
 		...read,
 		...write,
 		...comments,
+		...flows,
 		...seesAssistant(session.user.roles) ? query : [],
 		...ownTools
 	];

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.67.9";
+var version = "0.67.11";
 //#endregion
 export { version };

package/dist/webhooks/attempt.js

@@ -1,9 +1,9 @@
+import { AddressRefusedError, pinnedRequest } from "./table/pinned-request.js";
+import { readLimited } from "./table/read-limited.js";
 import { invokeFunction } from "../functions/define-function.js";
 import { retryAfterMs } from "./retry-schedule.js";
 import { standardWebhookHeaders } from "./standard-webhooks.js";
 import { subscriberSession } from "./subscriber-view.js";
-import { AddressRefusedError, pinnedRequest } from "./table/pinned-request.js";
-import { readLimited } from "./table/read-limited.js";
 //#region src/webhooks/attempt.ts
 /** How long a receiver has to answer. */
 const attemptTimeoutMs = 15e3;

package/dist/webhooks/table/webhook-table.js

@@ -1,5 +1,5 @@
-import { betterAuthOwnerRoles } from "./owner-roles.js";
 import { checkWebhookUrl } from "./address-check.js";
+import { betterAuthOwnerRoles } from "./owner-roles.js";
 import { webhooksSchema } from "./options.js";
 import { tableSubscriptions } from "./table-subscriptions.js";
 //#region src/webhooks/table/webhook-table.ts

package/dist/workflows/mcp/merge-patch.js

@@ -0,0 +1,15 @@
+//#region src/workflows/mcp/merge-patch.ts
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* `patch` applied to `target` as a JSON Merge Patch (RFC 7396): an object merges into the object at its place, a member
+* set to null is removed, and any other value, a list included, replaces what was there. Neither input is changed.
+*/
+const mergePatch = (target, patch) => {
+	if (!isObject(patch)) return patch;
+	const merged = isObject(target) ? { ...target } : {};
+	for (const [name, value] of Object.entries(patch)) if (value === null) delete merged[name];
+	else merged[name] = mergePatch(merged[name], value);
+	return merged;
+};
+//#endregion
+export { mergePatch };

package/dist/workflows/mcp/type-catalog.js

@@ -0,0 +1,144 @@
+//#region src/workflows/mcp/type-catalog.ts
+const needs = (takes) => ({
+	required: true,
+	takes
+});
+const may = (takes) => ({
+	required: false,
+	takes
+});
+const resource = needs("the resource's name, as list_resources gives it");
+const key = needs("the record's key");
+const refused = ["Records.Refused: the API refused it, its status and message in the cause", "Records.InvalidArguments: an argument has the wrong type, named in the cause"];
+/** The step types a Task names as its `Resource`, as the workflows reference describes them. */
+const stepTypeCatalog = [
+	{
+		resource: "app:http",
+		does: "Sends one HTTP request to a public address and reads the answer.",
+		arguments: {
+			url: needs("an http or https URL"),
+			method: may("GET (default), POST, PUT, PATCH or DELETE"),
+			headers: may("an object of text values"),
+			query: may("an object of text values, added to the URL's query"),
+			body: may("text sent as it is, a file value sent as its bytes, any other value sent as JSON; a GET sends none"),
+			response: may("how the answer's body is read: json (default; empty is null), text, or file (kept as a file value of the run)")
+		},
+		result: "{ status, headers, body }",
+		errors: [
+			"Http.Status: a status outside 2xx; the cause names it with the start of the body",
+			"Http.Network: no answer",
+			"Http.InvalidArguments: an argument has the wrong type, named in the cause",
+			"Http.InvalidBody: response json, and the body is not JSON",
+			"Http.AddressRefused: the host is not a public address",
+			"Http.ResponseTooLarge: a body over 10 MiB"
+		]
+	},
+	{
+		resource: "app:records.create",
+		does: "Creates records of the app's resources, as the workflow's last editor.",
+		arguments: {
+			resource,
+			data: needs("an object of field values, or a list of them, created in one batch: all or none")
+		},
+		result: "the created record, or the list of them",
+		errors: refused
+	},
+	{
+		resource: "app:records.update",
+		does: "Updates one record, as the workflow's last editor.",
+		arguments: {
+			resource,
+			key,
+			data: needs("an object of the field values to change")
+		},
+		result: "the updated record",
+		errors: refused
+	},
+	{
+		resource: "app:records.get",
+		does: "Reads one record, as the workflow's last editor.",
+		arguments: {
+			resource,
+			key
+		},
+		result: "the record",
+		errors: refused
+	},
+	{
+		resource: "app:records.list",
+		does: "Lists records, as the workflow's last editor.",
+		arguments: {
+			resource,
+			filter: may("a filter in the API's syntax, such as status = \"open\""),
+			order_by: may("such as \"created_at desc\""),
+			limit: may("how many at most")
+		},
+		result: "{ records }",
+		errors: refused
+	},
+	{
+		resource: "app:mail.send",
+		does: "Sends a mail from the app's own sender.",
+		arguments: {
+			to: needs("one address, or a list of at most 50"),
+			subject: needs("one line of text"),
+			text: needs("the body as text"),
+			html: may("the body as HTML too"),
+			attachments: may("a list of file values the run keeps, at most 10 MiB together")
+		},
+		result: "{ message_id }",
+		errors: ["Mail.InvalidArguments: an argument has the wrong type, named in the cause", "States.TaskFailed: the app sends no mail, or the mailer refused it"]
+	},
+	{
+		resource: "app:piece",
+		does: "Runs an action of a connector. Not implemented yet: a run fails it.",
+		arguments: {
+			piece: needs("the connector's name"),
+			action: needs("one of its actions"),
+			connection: needs("the connection holding its sign-in"),
+			props: may("the action's arguments, by name")
+		},
+		result: "what the action returns",
+		errors: ["Piece.Error: always, until connectors are implemented"]
+	}
+];
+/** The triggers a definition's `trigger` holds exactly one of. */
+const triggerCatalog = [
+	{
+		trigger: "manual",
+		example: { manual: {} },
+		starts: "when someone runs the workflow, such as with run_workflow",
+		input: "the input they give"
+	},
+	{
+		trigger: "webhook",
+		example: { webhook: {} },
+		starts: "on each POST to the workflow's webhook address",
+		input: "{ body, headers, query }"
+	},
+	{
+		trigger: "schedule",
+		example: { schedule: {
+			cron: "0 6 * * 1-5",
+			timezone: "Europe/Amsterdam"
+		} },
+		starts: "on a 5-field cron, in an IANA time zone (default UTC)",
+		input: "{ scheduled_at }, ISO 8601 with the zone's offset"
+	},
+	{
+		trigger: "mail",
+		example: { mail: { mailbox: "support" } },
+		starts: "on each mail arriving in that mailbox",
+		input: "{ from, to, subject, text, html, received_at, attachments }"
+	},
+	{
+		trigger: "record",
+		example: { record: { events: ["orders.created"] } },
+		starts: "on each of those record events, <resource>.<event>",
+		input: "{ event, resource, key, after, before, changed }"
+	}
+];
+/** Only manual runs start for now: a save takes the other triggers, which start nothing yet. */
+const triggerNote = "Runs start only by hand (run_workflow) for now: a workflow saves with any trigger, and the other triggers start no runs yet.";
+//#endregion
+export { stepTypeCatalog, triggerCatalog, triggerNote };

package/dist/workflows/mcp/workflow-instructions.d.ts

@@ -0,0 +1,7 @@
+//#region src/workflows/mcp/workflow-instructions.d.ts
+/**
+ * What the MCP endpoint tells a client about workflows, beside reading records: the language, in the named-reads
+ * profile of the States Language with JSONata, and how the workflow tools find, make, change and test-run them.
+ */
+export declare const workflowInstructions: string;
+//#endregion

package/dist/workflows/mcp/workflow-instructions.js

@@ -0,0 +1,77 @@
+import { limits } from "@protobase/workflows";
+/**
+* What the MCP endpoint tells a client about workflows, beside reading records: the language, in the named-reads
+* profile of the States Language with JSONata, and how the workflow tools find, make, change and test-run them.
+*/
+const workflowInstructions = [
+	"Workflows: list_workflow_types names the step types and triggers with their arguments and inputs; list_workflows and get_workflow read workflows; validate_workflow checks a definition without saving it; create_workflow and update_workflow save one; run_workflow starts a run with an input, and get_workflow_run reads it with each step's input, output, logs and error. A run goes on in the background: read it again until its status is succeeded or failed, then fix the step that failed with update_workflow and run it again.",
+	"A definition is one JSON document: { \"trigger\": <exactly one trigger>, \"stateMachine\": { \"QueryLanguage\": \"JSONata\", \"StartAt\": \"<state>\", \"States\": { \"<state>\": <state>, ... } } }, the States Language with JSONata expressions, in a profile where every value is read by name. It holds no layout.",
+	"States: Task { Resource: <step type>, Arguments, TimeoutSeconds, Retry, Catch }; Pass { Output, Assign }; Choice { Choices: [{ Condition, Next, Output?, Assign? }], Default }; Map { Items, ItemProcessor: { StartAt, States }, MaxConcurrency }; Wait { Seconds | Timestamp }; Succeed { Output }; Fail { Error, Cause }. Every state may have Comment, Output and Assign. Task, Pass, Map and Wait have exactly one of Next (a state name) and End: true. State names are unique across the document, Maps included, and every state must be reachable from StartAt. InputPath, Parameters, ResultPath and the other JSONPath fields, and Parallel, are not part of the profile.",
+	"Expressions: a string that is whole \"{% ... %}\" is a JSONata expression whose value, of any type, the field takes; any other string is literal text. Build text inside one expression with &: \"{% 'Order ' & $order.id %}\". Expressions sit at any depth in Arguments, Output and Assign, and in Items, Condition, Seconds, Timestamp, Error and Cause.",
+	"Reading values by name, the only reads allowed: $states.context.Execution.Input (the run's input, in every state), $states.context.Execution.StartTime, $states.context.Secrets.<NAME> (a secret the app lists), $<variable> (assigned by a state that runs before), $states.result (a Task's or Map's result, in its Output and Assign), $states.errorOutput ({ Error, Cause }, in a Catch rule's Output and Assign), $states.input (the item, only in the first state of a Map's ItemProcessor). Never a bare field name, $ or $$ on its own, or $eval. Keep a result for later states with \"Assign\": { \"order\": \"{% $states.result %}\" }, read as $order from the next state on; a state inside a Map may not assign a name an outer state assigns.",
+	`Errors: a failing Task or Map fails with an error name, its step type's own (list_workflow_types names them), States.Timeout, States.TaskFailed, or States.QueryEvaluationError for an expression that failed. Retry: [{ ErrorEquals: ["States.ALL"], IntervalSeconds, MaxAttempts (retries after the first try, at most ${limits.retryAttempts}), BackoffRate }]; Catch: [{ ErrorEquals, Next, Assign }] goes on to Next once no retry is left; without a Catch the run fails. A Choice whose rules all fail and that has no Default fails with States.NoChoiceMatched.`,
+	`Limits: ${limits.states} states, a Map's MaxConcurrency ${limits.mapConcurrency}, a Task's TimeoutSeconds ${limits.taskTimeoutSeconds}.`,
+	`A saved or validated definition that does not fit is refused with problems, each { state, field, message }: the state (a Map's inner state as Map/State), the field such as Arguments.url, and what was expected. Fix those fields and try again; nothing was saved. An example: ${JSON.stringify({
+		trigger: { manual: {} },
+		stateMachine: {
+			QueryLanguage: "JSONata",
+			StartAt: "GetQuote",
+			States: {
+				GetQuote: {
+					Type: "Task",
+					Resource: "app:records.get",
+					Arguments: {
+						resource: "quotes",
+						key: "{% $states.context.Execution.Input.quote_id %}"
+					},
+					Assign: { quote: "{% $states.result %}" },
+					Next: "IsDraft"
+				},
+				IsDraft: {
+					Type: "Choice",
+					Choices: [{
+						Condition: "{% $quote.status = 'draft' %}",
+						Next: "Notify"
+					}],
+					Default: "NotADraft"
+				},
+				NotADraft: {
+					Type: "Fail",
+					Error: "Quote.NotDraft",
+					Cause: "{% 'Quote ' & $quote.id & ' is not a draft' %}"
+				},
+				Notify: {
+					Type: "Task",
+					Resource: "app:http",
+					Arguments: {
+						method: "POST",
+						url: "https://hooks.example.com/quotes",
+						body: {
+							id: "{% $quote.id %}",
+							total: "{% $quote.total %}"
+						}
+					},
+					Retry: [{
+						ErrorEquals: ["States.ALL"],
+						IntervalSeconds: 10,
+						MaxAttempts: 3
+					}],
+					Catch: [{
+						ErrorEquals: ["States.ALL"],
+						Next: "Failed",
+						Assign: { notifyError: "{% $states.errorOutput %}" }
+					}],
+					Output: "{% $states.result.body %}",
+					End: true
+				},
+				Failed: {
+					Type: "Fail",
+					Error: "Notify.Failed",
+					Cause: "{% $notifyError.Cause %}"
+				}
+			}
+		}
+	})}`
+].join("\n");
+//#endregion
+export { workflowInstructions };

package/dist/workflows/mcp/workflow-read-tools.d.ts

@@ -0,0 +1,6 @@
+import { AssistantTool, ToolContext } from "../../assistant/tools.js";
+import "../../index.js";
+//#region src/workflows/mcp/workflow-read-tools.d.ts
+/** The tools that read workflows, their types and runs, and check definitions. */
+export declare const workflowReadTools: () => AssistantTool<ToolContext>[];
+//#endregion

package/dist/workflows/mcp/workflow-read-tools.js

@@ -0,0 +1,209 @@
+import { defineTool } from "../../assistant/tools.js";
+import { refused } from "../../assistant/record-tool-args.js";
+import { stepTypeNames } from "../step-types.js";
+import { mergePatch } from "./merge-patch.js";
+import { stepTypeCatalog, triggerCatalog, triggerNote } from "./type-catalog.js";
+import { definitionParameter, editParameter, idOf, idParameter, objectOf, pageSizeOf, textOf } from "./workflow-tool-args.js";
+import { checkDefinition } from "@protobase/workflows";
+//#region src/workflows/mcp/workflow-read-tools.ts
+const reads = {
+	readOnlyHint: true,
+	openWorldHint: false
+};
+const listed = [
+	"id",
+	"name",
+	"description",
+	"version",
+	"updated_at"
+];
+/** The step types and triggers a definition may name, with their arguments, results, errors and run inputs. */
+const listWorkflowTypesTool = defineTool({
+	name: "list_workflow_types",
+	description: "Lists what a workflow definition may name, as JSON ({ step_types, triggers }): each step type a Task names as its Resource, with its Arguments (required or not, and what each takes), its result and the errors it fails with; and each trigger, how the definition holds it and the input a run gets from it.",
+	parameters: {
+		type: "object",
+		properties: {}
+	},
+	annotations: reads,
+	run: async () => JSON.stringify({
+		step_types: stepTypeCatalog,
+		triggers: triggerCatalog,
+		note: triggerNote
+	})
+});
+/** The workflows the caller may read, a page at a time, without their definitions. */
+const listWorkflowsTool = defineTool({
+	name: "list_workflows",
+	description: "Lists the workflows you may read, newest change first, as JSON ({ items, next_page_token }), each with its id, name, description and version but not its definition: get_workflow reads that. filter uses AIP-160 on name, such as name = \"Daily report\"; pass next_page_token back as page_token for the next page.",
+	parameters: {
+		type: "object",
+		properties: {
+			filter: {
+				type: "string",
+				description: "Such as name = \"Daily report\"."
+			},
+			page_size: {
+				type: "integer",
+				minimum: 1,
+				maximum: 100,
+				description: "Workflows per page, 20 by default."
+			},
+			page_token: {
+				type: "string",
+				description: "The next_page_token of the page before."
+			}
+		}
+	},
+	annotations: reads,
+	run: async (args, context) => {
+		const params = {
+			fields: listed,
+			order_by: "updated_at desc",
+			page_size: pageSizeOf(args.page_size, 20, 100),
+			...textOf(args.filter) && { filter: textOf(args.filter) },
+			...textOf(args.page_token) && { page_token: textOf(args.page_token) }
+		};
+		return context.records.list("workflows", params).then((page) => JSON.stringify({
+			items: page.items.map(({ etag: _etag, permissions: _permissions, ...item }) => item),
+			next_page_token: page.next_page_token
+		}), refused);
+	}
+});
+/** One workflow with its definition and the etag an update can pass. */
+const getWorkflowTool = defineTool({
+	name: "get_workflow",
+	description: "Reads one workflow by its id, as JSON ({ workflow, etag }): its name, description, version and whole definition. Pass the etag to update_workflow to fail when someone changed it since.",
+	parameters: {
+		type: "object",
+		properties: { id: idParameter },
+		required: ["id"]
+	},
+	annotations: reads,
+	run: async (args, context) => {
+		const id = idOf(args);
+		if (!id) return "Pass the workflow's id as { \"id\": \"<id>\" }.";
+		return context.records.get("workflows", id).then(({ record, etag }) => JSON.stringify({
+			workflow: record,
+			etag
+		}), refused);
+	}
+});
+const checked = (definition) => {
+	const problems = checkDefinition(definition, { resources: stepTypeNames });
+	return JSON.stringify(problems.length > 0 ? {
+		valid: false,
+		problems
+	} : { valid: true });
+};
+/** Checks a definition, or a saved one with an edit, without saving anything. */
+const validateWorkflowTool = defineTool({
+	name: "validate_workflow",
+	description: "Checks a definition as a save checks it, and saves nothing: pass a whole definition, or a workflow's id with an edit to check that edit of its saved definition. Returns JSON { valid: true }, or { valid: false, problems }, each problem { state, field, message } naming the state, the field and what was expected.",
+	parameters: {
+		type: "object",
+		properties: {
+			definition: definitionParameter,
+			id: idParameter,
+			edit: editParameter
+		}
+	},
+	annotations: reads,
+	run: async (args, context) => {
+		const id = idOf(args);
+		const edit = objectOf(args.edit);
+		if (args.definition !== void 0 && id === void 0 && edit === void 0) return checked(args.definition);
+		if (args.definition === void 0 && id && edit) return context.records.get("workflows", id).then(({ record }) => checked(mergePatch(record.definition, edit)), refused);
+		return "Pass either { \"definition\": { ... } } or { \"id\": \"<id>\", \"edit\": { ... } }.";
+	}
+});
+const runFields = [
+	"id",
+	"workflow_id",
+	"version",
+	"status",
+	"input",
+	"output",
+	"error",
+	"cause",
+	"resume_at",
+	"created_at",
+	"finished_at",
+	"duration_ms"
+];
+const stepFields = [
+	"state",
+	"scope",
+	"seq",
+	"type",
+	"attempt",
+	"status",
+	"input",
+	"output",
+	"assigned",
+	"logs",
+	"error",
+	"cause",
+	"next",
+	"resume_at",
+	"duration_ms"
+];
+/** A run with its steps in the order they ran, a page at a time. */
+const getWorkflowRunTool = defineTool({
+	name: "get_workflow_run",
+	description: "Reads a run by its id, as JSON ({ run, steps, next_page_token }): its status (queued, running, waiting, succeeded or failed), input, output, error and cause, and its steps in the order they ran, each with its state, scope (empty, or the Map item it ran in), try, status (succeeded, retrying, caught or failed), input, output, assigned variables, logs, error and cause. A run goes on in the background: read it again while it is queued, running or waiting. Pass state to read only that state's steps; pass next_page_token back as page_token for more steps.",
+	parameters: {
+		type: "object",
+		properties: {
+			run_id: {
+				type: "string",
+				description: "The run's id, as run_workflow gives it."
+			},
+			state: {
+				type: "string",
+				description: "Only this state's steps."
+			},
+			page_size: {
+				type: "integer",
+				minimum: 1,
+				maximum: 100,
+				description: "Steps per page, 20 by default."
+			},
+			page_token: {
+				type: "string",
+				description: "The next_page_token of the page before."
+			}
+		},
+		required: ["run_id"]
+	},
+	annotations: reads,
+	run: async (args, context) => {
+		const id = textOf(args.run_id);
+		if (!id) return "Pass the run's id as { \"run_id\": \"<id>\" }.";
+		const run = await context.records.get("workflow_runs", id, { fields: runFields }).then(({ record }) => record, refused);
+		if (typeof run === "string") return run;
+		const state = textOf(args.state);
+		const params = {
+			filter: `run_id = ${JSON.stringify(id)}${state ? ` AND state = ${JSON.stringify(state)}` : ""}`,
+			fields: stepFields,
+			order_by: "id",
+			page_size: pageSizeOf(args.page_size, 20, 100),
+			...textOf(args.page_token) && { page_token: textOf(args.page_token) }
+		};
+		return context.records.list("workflow_steps", params).then((page) => JSON.stringify({
+			run,
+			steps: page.items.map(({ etag: _etag, permissions: _permissions, ...step }) => step),
+			next_page_token: page.next_page_token
+		}), refused);
+	}
+});
+/** The tools that read workflows, their types and runs, and check definitions. */
+const workflowReadTools = () => [
+	listWorkflowTypesTool,
+	listWorkflowsTool,
+	getWorkflowTool,
+	validateWorkflowTool,
+	getWorkflowRunTool
+];
+//#endregion
+export { getWorkflowRunTool, getWorkflowTool, listWorkflowTypesTool, listWorkflowsTool, validateWorkflowTool, workflowReadTools };

package/dist/workflows/mcp/workflow-tool-args.js

@@ -0,0 +1,35 @@
+import { problemOf } from "../../error-handler.js";
+import { refused } from "../../assistant/record-tool-args.js";
+//#region src/workflows/mcp/workflow-tool-args.ts
+const idParameter = {
+	type: "string",
+	description: "The workflow's id, as list_workflows gives it."
+};
+const definitionParameter = {
+	type: "object",
+	description: "The whole definition: { \"trigger\": { ... }, \"stateMachine\": { \"QueryLanguage\": \"JSONata\", \"StartAt\": ..., \"States\": { ... } } }, as the server's instructions describe it."
+};
+const editParameter = {
+	type: "object",
+	description: "A small edit of the saved definition as a JSON Merge Patch (RFC 7396): only what changes, at its place in the document. An object merges into the object there, null removes a member, and any other value, a list included, replaces it. Such as { \"stateMachine\": { \"States\": { \"Fetch\": { \"Arguments\": { \"url\": \"https://...\" } }, \"Old\": null } } }."
+};
+const idOf = (args) => typeof args.id === "string" && args.id ? args.id : void 0;
+const objectOf = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+const textOf = (value) => typeof value === "string" ? value : void 0;
+/** A page size given as a whole number, cut to `max`; `fallback` when none is given. */
+const pageSizeOf = (value, fallback, max) => typeof value === "number" && Number.isInteger(value) && value > 0 ? Math.min(value, max) : fallback;
+/**
+* A save the workflow check refused, as `{ error, message, problems }`, each problem naming the state and field and
+* what was expected; any other refusal as `refused` words it.
+*/
+const workflowRefused = (error) => {
+	const problem = problemOf(error);
+	if (problem?.slug === "invalid-workflow") return JSON.stringify({
+		error: problem.slug,
+		message: "The definition does not fit the language; nothing was saved. Fix each problem and try again.",
+		problems: problem.extras.problems
+	});
+	return refused(error);
+};
+//#endregion
+export { definitionParameter, editParameter, idOf, idParameter, objectOf, pageSizeOf, textOf, workflowRefused };

package/dist/workflows/mcp/workflow-write-tools.d.ts

@@ -0,0 +1,7 @@
+import { AssistantTool, ToolContext } from "../../assistant/tools.js";
+import { WriteRecordToolsInput } from "../../assistant/write-tool-limits.js";
+import "../../index.js";
+//#region src/workflows/mcp/workflow-write-tools.d.ts
+/** The tools that save and run workflows, on the resources `input` allows. */
+export declare const workflowWriteTools: (input?: WriteRecordToolsInput) => AssistantTool<ToolContext>[];
+//#endregion

package/dist/workflows/mcp/workflow-write-tools.js

@@ -0,0 +1,149 @@
+import { notFound } from "../../problem.js";
+import { defineTool } from "../../assistant/tools.js";
+import { refused } from "../../assistant/record-tool-args.js";
+import { createApproval, updateApproval } from "../../assistant/write-prompts.js";
+import { approvalTexts, recordBefore } from "../../assistant/record-before.js";
+import { notApproved, onlyNote, outside } from "../../assistant/write-tool-limits.js";
+import { mergePatch } from "./merge-patch.js";
+import { definitionParameter, editParameter, idOf, idParameter, objectOf, textOf, workflowRefused } from "./workflow-tool-args.js";
+//#region src/workflows/mcp/workflow-write-tools.ts
+/**
+* `create_workflow`, `update_workflow` and `run_workflow`: saving and running workflows as the caller, through the
+* resources' access rules and the save check, each after the user approves it in their client, as the record write
+* tools ask. A refused definition comes back with its problems, each naming the state and field.
+*/
+const writes = {
+	readOnlyHint: false,
+	destructiveHint: false,
+	openWorldHint: false
+};
+const nameParameter = {
+	type: "string",
+	description: "A name, 1 to 100 characters."
+};
+const descriptionParameter = {
+	type: "string",
+	description: "What it does, for people; at most 2000 characters."
+};
+const saved = (record, etag) => JSON.stringify({
+	id: record.id,
+	version: record.version,
+	etag
+});
+/** Creates a workflow once the user approves it; a definition the check refuses saves nothing. */
+const createWorkflowTool = (input = {}) => defineTool({
+	name: "create_workflow",
+	description: `Creates a workflow from its name and whole definition, checked as validate_workflow checks it, and returns JSON { id, version, etag }. A definition that does not fit is refused with { error, problems }, each problem naming the state, the field and what was expected; nothing is saved then. The user approves each save in their client first.${onlyNote(input)}`,
+	parameters: {
+		type: "object",
+		properties: {
+			name: nameParameter,
+			description: descriptionParameter,
+			definition: definitionParameter
+		},
+		required: ["name", "definition"]
+	},
+	annotations: writes,
+	run: async (args, context) => {
+		const name = textOf(args.name);
+		const definition = objectOf(args.definition);
+		if (!name || !definition) return "Pass { \"name\": \"<name>\", \"definition\": { \"trigger\": ..., \"stateMachine\": ... } }.";
+		const refusal = outside(input, "workflows");
+		if (refusal) return refusal;
+		const data = {
+			name,
+			definition,
+			...textOf(args.description) !== void 0 && { description: textOf(args.description) }
+		};
+		const { text, described } = await approvalTexts(context, "workflows");
+		const answer = await context.approve(createApproval(text, described, data));
+		if (answer !== "approved") return notApproved(answer);
+		return context.records.create("workflows", data).then(({ record, etag }) => saved(record, etag), workflowRefused);
+	}
+});
+/** Changes a workflow's definition by an edit or a whole new one, or its name or description, once the user approves it. */
+const updateWorkflowTool = (input = {}) => defineTool({
+	name: "update_workflow",
+	description: `Changes a workflow: its definition by a small edit (edit, a JSON Merge Patch of the saved definition) or whole (definition), and its name or description. The changed definition is checked as validate_workflow checks it and saved as the workflow's next version; runs started before keep theirs. Returns JSON { id, version, etag }. A definition that does not fit is refused with { error, problems }, each naming the state, the field and what was expected; nothing is saved then. Pass the etag get_workflow gave to fail when someone changed it since. The user approves each save in their client first.${onlyNote(input)}`,
+	parameters: {
+		type: "object",
+		properties: {
+			id: idParameter,
+			edit: editParameter,
+			definition: definitionParameter,
+			name: nameParameter,
+			description: descriptionParameter,
+			etag: {
+				type: "string",
+				description: "The etag get_workflow gave, to fail when the workflow changed since."
+			}
+		},
+		required: ["id"]
+	},
+	annotations: writes,
+	run: async (args, context) => {
+		const id = idOf(args);
+		const edit = objectOf(args.edit);
+		const whole = objectOf(args.definition);
+		if (!id || edit && whole) return "Pass { \"id\": \"<id>\" } with either an edit or a whole definition, and any name or description to change.";
+		const refusal = outside(input, "workflows");
+		if (refusal) return refusal;
+		const before = await recordBefore(context, "workflows", id, textOf(args.etag) || void 0);
+		if (typeof before === "string") return before;
+		if (edit && !before) return refused(notFound("No workflows with this key that you may read"));
+		const definition = edit ? mergePatch(before.record.definition, edit) : whole;
+		const data = {
+			...definition !== void 0 && { definition },
+			...textOf(args.name) !== void 0 && { name: textOf(args.name) },
+			...textOf(args.description) !== void 0 && { description: textOf(args.description) }
+		};
+		if (Object.keys(data).length === 0) return "Pass an edit, a definition, a name or a description to change; nothing was saved.";
+		const { text, described } = await approvalTexts(context, "workflows");
+		const answer = await context.approve(updateApproval(text, described, id, before?.record ?? {}, data));
+		if (answer !== "approved") return notApproved(answer);
+		const etag = textOf(args.etag) || (edit ? before.etag : void 0);
+		return context.records.update("workflows", id, data, { ...etag && { etag } }).then(({ record, etag: next }) => saved(record, next), workflowRefused);
+	}
+});
+/** Starts a run of a workflow with an input once the user approves it. */
+const runWorkflowTool = (input = {}) => defineTool({
+	name: "run_workflow",
+	description: `Starts a run of a workflow's current version with an input, which its states read as $states.context.Execution.Input, and returns JSON { run_id, status }. The run goes on in the background, doing what its steps do (requests, mail, record writes) as the workflow's last editor: read it with get_workflow_run until its status is succeeded or failed. The user approves each run in their client first.${onlyNote(input)}`,
+	parameters: {
+		type: "object",
+		properties: {
+			id: idParameter,
+			input: { description: "The run's input, any JSON value, at most 1 MiB; an empty object by default." }
+		},
+		required: ["id"]
+	},
+	annotations: {
+		...writes,
+		openWorldHint: true
+	},
+	run: async (args, context) => {
+		const id = idOf(args);
+		if (!id) return "Pass { \"id\": \"<id>\", \"input\": { ... } }.";
+		const refusal = outside(input, "workflow_runs");
+		if (refusal) return refusal;
+		const data = {
+			workflow_id: id,
+			input: args.input ?? {}
+		};
+		const { text, described } = await approvalTexts(context, "workflow_runs");
+		const answer = await context.approve(createApproval(text, described, data));
+		if (answer !== "approved") return notApproved(answer);
+		return context.records.create("workflow_runs", data).then(({ record }) => JSON.stringify({
+			run_id: record.id,
+			status: record.status
+		}), refused);
+	}
+});
+/** The tools that save and run workflows, on the resources `input` allows. */
+const workflowWriteTools = (input = {}) => [
+	createWorkflowTool(input),
+	updateWorkflowTool(input),
+	runWorkflowTool(input)
+];
+//#endregion
+export { createWorkflowTool, runWorkflowTool, updateWorkflowTool, workflowWriteTools };

package/dist/workflows/save-hook.js

@@ -1,18 +1,37 @@
 import { badRequest } from "../problem.js";
+import { requiredStepInputs } from "@protobase/schema/internal";
 import { sql } from "kysely";
 import { checkDefinition, problemText } from "@protobase/workflows";
 //#region src/workflows/save-hook.ts
 /**
 * Checks a workflow's definition on every save that changes it, against the language's schema and the named-reads
 * profile, with the step types the app has, and keeps it as the version the table's trigger numbered, saved by the
-* caller. A refusal is a 400 problem naming each state and field, also listed as `problems`; the write rolls back.
+* caller. A refusal is a 400 problem naming each state and field, also listed as `problems`, and as the `definition`
+* field's `errors` with the state and field in their `params`, for a form to show each on its step; the write rolls back.
 */
 const workflowSaveHook = (schema, stepTypes) => async (event, trx) => {
 	if (event.resource.name !== "workflows" || !event.after) return;
 	if (event.operation !== "create" && event.operation !== "update") return;
 	if (event.operation === "update" && event.after.version === event.before?.version) return;
-	const problems = checkDefinition(event.after.definition, { resources: stepTypes });
-	if (problems.length > 0) throw badRequest("invalid-workflow", `The workflow cannot be saved: ${problems.map(problemText).join("; ")}`, { problems });
+	const problems = checkDefinition(event.after.definition, {
+		resources: stepTypes,
+		required: requiredStepInputs
+	});
+	if (problems.length > 0) {
+		const errors = problems.map((problem) => ({
+			code: "invalid-workflow",
+			field: "definition",
+			message: problemText(problem),
+			params: {
+				state: problem.state,
+				field: problem.field
+			}
+		}));
+		throw badRequest("invalid-workflow", `The workflow cannot be saved: ${problems.map(problemText).join("; ")}`, {
+			problems,
+			errors
+		});
+	}
 	await sql`insert into ${sql.id(schema, "versions")} (workflow_id, version, definition, saved_by, tenant_id)
     select w.id, w.version, w.definition, ${String(event.user.id)}, w.tenant_id from ${sql.id(schema, "workflows")} w where w.id = ${String(event.after.id)}`.execute(trx);
 };

package/dist/workflows/step-types.js

@@ -2,17 +2,10 @@ import { httpStep } from "./http-step.js";
 import { mailStep } from "./mail-step.js";
 import { pieceStep } from "./piece-step.js";
 import { recordsSteps } from "./records-step.js";
+import { workflowStepTypes } from "@protobase/schema/internal";
 //#region src/workflows/step-types.ts
-/** The step types a Task names as its `Resource`, as the language report lists them. */
-const stepTypeNames = [
-	"app:http",
-	"app:records.create",
-	"app:records.update",
-	"app:records.get",
-	"app:records.list",
-	"app:mail.send",
-	"app:piece"
-];
+/** The step types a Task names as its `Resource`, as the editor offers them. */
+const stepTypeNames = Object.keys(workflowStepTypes);
 /** The step types of one segment, which sends mail with the mailer of the job that runs it. */
 const stepTypes = ({ deps, schema, roles, allowPrivateAddresses }, mail) => {
 	const files = () => deps().files;

package/dist/workflows/store.js

@@ -17,15 +17,18 @@ const postgresRunStore = (schema) => {
         from ${steps} where run_id = ${id} order by scope, seq`.execute(db);
 			return rows;
 		},
-		save: async (db, id, step) => {
+		save: async (db, id, records) => {
+			const row = (step) => sql`(${step.scope}, ${step.seq}::integer, ${step.state}, ${step.type}, ${step.status}, ${step.attempt}::integer,
+        ${json(step.input)}::jsonb, ${json(step.output)}::jsonb, ${json(step.assigned)}::jsonb, ${step.next}, ${step.resumeAt ?? null}::timestamptz,
+        ${step.error ?? null}, ${step.cause ?? null}, ${JSON.stringify(step.logs)}::jsonb, ${step.startedAt}::timestamptz, ${step.finishedAt}::timestamptz)`;
 			const { rows } = await sql`insert into ${steps}
         (run_id, tenant_id, scope, seq, state, type, status, attempt, input, output, assigned, next, resume_at, error, cause, logs, started_at, finished_at)
-        select r.id, r.tenant_id, ${step.scope}, ${step.seq}, ${step.state}, ${step.type}, ${step.status}, ${step.attempt}, ${json(step.input)}::jsonb,
-          ${json(step.output)}::jsonb, ${json(step.assigned)}::jsonb, ${step.next}, ${step.resumeAt ?? null}, ${step.error ?? null}, ${step.cause ?? null},
-          ${JSON.stringify(step.logs)}::jsonb, ${step.startedAt}, ${step.finishedAt}
-        from ${runs} r where r.id = ${id}
+        select r.id, r.tenant_id, s.*
+        from ${runs} r, (values ${sql.join(records.map(row))})
+          as s (scope, seq, state, type, status, attempt, input, output, assigned, next, resume_at, error, cause, logs, started_at, finished_at)
+        where r.id = ${id}
         on conflict (run_id, scope, seq) do nothing returning id`.execute(db);
-			return rows.length > 0;
+			return rows.length === records.length;
 		},
 		update: async (db, id, change) => {
 			const ended = change.status === "succeeded" || change.status === "failed";

package/dist/workflows/workflow-engine.js

@@ -1,10 +1,10 @@
+import { stepTypeNames, stepTypes } from "./step-types.js";
 import { betterAuthOwnerRoles } from "../webhooks/table/owner-roles.js";
 import { runInputCheck } from "./input-limits.js";
 import { workflowSecrets, workflowsSchema } from "./options.js";
 import { workflowSaveHook } from "./save-hook.js";
 import { workflowsRunner } from "./segment-job.js";
 import { runStartHook } from "./start-hook.js";
-import { stepTypeNames, stepTypes } from "./step-types.js";
 //#region src/workflows/workflow-engine.ts
 /**
 * What `createAdmin` needs for `workflows`: the hooks that check saves and start runs, the check of a run's input before

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.67.9",
+  "version": "0.67.11",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,10 +44,10 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.67.9",
-    "@protobase/query": "0.67.9",
-    "@protobase/schema": "0.67.9",
-    "@protobase/workflows": "0.67.9",
+    "@protobase/layout": "0.67.11",
+    "@protobase/query": "0.67.11",
+    "@protobase/schema": "0.67.11",
+    "@protobase/workflows": "0.67.11",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",