@protobase/server 0.68.4 → 0.68.6

package/dist/create-admin.js

@@ -59,6 +59,8 @@ import { toApiFunction } from "./functions/define-function.js";
 import { createWebhooks } from "./webhooks/webhooks.js";
 import { webhookTable } from "./webhooks/table/webhook-table.js";
 import { subscriptionUrlCheck, subscriptionWriteCheck } from "./webhooks/table/validate-hook.js";
+import { hooksBase } from "./workflows/hooks/hook-paths.js";
+import { issueWebhook } from "./workflows/hooks/issue-webhook.js";
 import { workflowEngine } from "./workflows/workflow-engine.js";
 import { workflowTypesRoute } from "./workflows/workflow-types-route.js";
 import { callsService } from "./calls/calls-service.js";
@@ -387,7 +389,13 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 			sql: options.mcp !== false && options.mcp?.sql === true,
 			writes,
 			commented,
-			...engine && { workflows: engine.types },
+			...engine && { workflows: {
+				...engine.types,
+				issueWebhook: (session, id, secret) => issueWebhook(engine.issue, session, id, {
+					...secret !== void 0 && { secret },
+					origin: new URL(auth.mcp.resource).origin
+				})
+			} },
 			own: options.mcp !== false && options.mcp?.tools || []
 		});
 		const instructions = engine ? `${mcpInstructions}\n${workflowInstructions}` : mcpInstructions;
@@ -555,7 +563,9 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 			}));
 		}
 	}
+	if (engine) app.route(hooksBase(systemPath), engine.routes.hooks());
 	if (appModels.some((model) => model.live) || deps.calls) app.route(systemPath || "/", guarded((live) => void live.route("/", liveRoutes(feed, (session) => visibleNotices(deps, session))), withAnonymous(authenticate, options.roles)));
+	if (engine) app.route(`${systemPath}/workflows`, guarded((routes) => void routes.route("/", engine.routes.issue())));
 	app.route(basePath, api);
 	app.route(`${deps.systemPath}/meta`, metaApp);
 	app.route(systemPath || "/", webManifestRoute(appName, identity, icons));

package/dist/forms/rate-limit.js

@@ -8,32 +8,54 @@ const windowMs = 6e4;
 * sent). In development and tests a request without one is `127.0.0.1`.
 */
 const clientAddress = (headers) => getIP(headers, {}) ?? "unknown";
+/** The most keys a limit counts at once: a new key past it forgets the one whose window began first. */
+const rateLimitKeys = 1e4;
 /**
 * At most `perMinute` takes per key in a fixed window of a minute, kept in this process. Keys whose window has passed are
-* dropped as new ones come, so memory follows the clients of the last minute.
+* dropped as new ones come, and at most `maxKeys` are kept, the oldest window dropped first, so memory stays bounded
+* however many clients come within a minute.
 */
-const createRateLimit = ({ now = Date.now } = {}) => {
+const createRateLimit = ({ now = Date.now, maxKeys = rateLimitKeys } = {}) => {
 	const windows = /* @__PURE__ */ new Map();
 	const prune = (at) => {
-		for (const [key, window] of windows) if (at - window.start >= windowMs) windows.delete(key);
+		for (const [key, window] of windows) {
+			if (at - window.start < windowMs) return;
+			windows.delete(key);
+		}
+	};
+	const open = (key, at) => {
+		prune(at);
+		windows.delete(key);
+		if (windows.size >= maxKeys) windows.delete(windows.keys().next().value);
+		windows.set(key, {
+			start: at,
+			count: 1
+		});
+	};
+	const wait = (key, perMinute, at) => {
+		const current = windows.get(key);
+		if (!current || at - current.start >= windowMs || current.count < perMinute) return 0;
+		return Math.ceil((current.start + windowMs - at) / 1e3);
 	};
 	/** Counts a take for `key`: `0` when allowed, else the seconds until its window lets it through again. */
 	const take = (key, perMinute) => {
 		const at = now();
 		const current = windows.get(key);
 		if (!current || at - current.start >= windowMs) {
-			prune(at);
-			windows.set(key, {
-				start: at,
-				count: 1
-			});
+			open(key, at);
 			return 0;
 		}
-		if (current.count >= perMinute) return Math.ceil((current.start + windowMs - at) / 1e3);
+		const seconds = wait(key, perMinute, at);
+		if (seconds > 0) return seconds;
 		current.count += 1;
 		return 0;
 	};
-	return { take };
+	/** Whether `key` has spent its `perMinute` takes, without taking one: the seconds to wait, or `0`. */
+	const spent = (key, perMinute) => wait(key, perMinute, now());
+	return {
+		take,
+		spent
+	};
 };
 //#endregion
-export { clientAddress, createRateLimit };
+export { clientAddress, createRateLimit, rateLimitKeys };

package/dist/forms/routes.js

@@ -1,8 +1,8 @@
 import { HttpProblem, badRequest, notFound } from "../problem.js";
 import { runWrite } from "../write-pipeline.js";
 import { anonymousSession } from "../anonymous.js";
-import { pruneView } from "../view-access.js";
 import { clientAddress } from "./rate-limit.js";
+import { pruneView } from "../view-access.js";
 import { Hono } from "hono";
 import { restrictModel } from "@protobase/schema";
 //#region src/forms/routes.ts

package/dist/functions/verify-signature.js

@@ -1,4 +1,5 @@
 import { HttpProblem } from "../problem.js";
+import { timingSafeEqual } from "node:crypto";
 //#region src/functions/verify-signature.ts
 const invalid = (detail) => new HttpProblem(401, "invalid-signature", "Unauthorized", detail);
 const decodeHex = (text) => /^(?:[0-9a-f]{2})+$/i.test(text) ? new Uint8Array(text.match(/../g).map((pair) => parseInt(pair, 16))) : void 0;
@@ -7,8 +8,9 @@ const verifyHmac = async (key, hash, signature, content) => {
 	const cryptoKey = await crypto.subtle.importKey("raw", key, {
 		name: "HMAC",
 		hash
-	}, false, ["verify"]);
-	return crypto.subtle.verify("HMAC", cryptoKey, signature, new TextEncoder().encode(content));
+	}, false, ["sign"]);
+	const expected = new Uint8Array(await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(content)));
+	return signature.length === expected.length && timingSafeEqual(signature, expected);
 };
 /**
 * The request's body as text, once its HMAC signature checks out against `secret`, as GitHub, Shopify and many others

package/dist/index.d.ts

@@ -104,6 +104,7 @@ import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
 import { checkWorkflowsSchema, workflowsMigration } from "./workflows/schema.js";
 import { StartWorkflowOptions, startWorkflow } from "./workflows/start-workflow.js";
+import { hookPath, redactHookKeys, webhookIssuePath, webhookParams } from "./workflows/hooks/hook-paths.js";
 import { checkUserTablesSchema, userTablesMigration } from "./user-tables/schema.js";
 import { ownedDefinitionsMigration } from "./user-tables/owned-definitions.js";
 import { UserTables, userTableResources } from "./user-tables/user-table-resources.js";
@@ -196,4 +197,4 @@ import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/ru
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, normalizeRoles } from "./better-auth/create-auth.js";
-export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailAttachment, type MailMessage, MailServerTimeoutError, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PdfComponent, type PdfOptions, type PdfTemplate, PersonalMailError, type PersonalMailErrorCode, type PersonalMailProviderId, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StartWorkflowOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type UserTables, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WorkflowCatalog, type WorkflowTypes, type WorkflowsOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, checkWorkflowsSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, startWorkflow, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, workflowInstructions, workflowReadTools, workflowTypes, workflowWriteTools, workflowsMigration, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailAttachment, type MailMessage, MailServerTimeoutError, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PdfComponent, type PdfOptions, type PdfTemplate, PersonalMailError, type PersonalMailErrorCode, type PersonalMailProviderId, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StartWorkflowOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type UserTables, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WorkflowCatalog, type WorkflowTypes, type WorkflowsOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, checkWorkflowsSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, hookPath, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, redactHookKeys, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, startWorkflow, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhookIssuePath, webhookParams, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, workflowInstructions, workflowReadTools, workflowTypes, workflowWriteTools, workflowsMigration, writeRecordTools };

package/dist/index.js

@@ -68,6 +68,8 @@ import { recordOf, resourceChange } from "./changes/resource-change.js";
 import { defineFunction } from "./functions/define-function.js";
 import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
 import { subscription } from "./webhooks/subscription.js";
+import { verifySignature, verifyStandardWebhook } from "./functions/verify-signature.js";
+import { hookPath, redactHookKeys, webhookIssuePath, webhookParams } from "./workflows/hooks/hook-paths.js";
 import { startWorkflow } from "./workflows/start-workflow.js";
 import { workflowTypes } from "./workflows/workflow-types.js";
 import { historyIdPattern, historyLimits } from "./notifications/history.js";
@@ -135,7 +137,6 @@ import { checkQueryRunner, queryRunnerMigration } from "./assistant/query-runner
 import { startErrorReporting } from "./error-reporting/error-reporter.js";
 import { functionApp } from "./functions/function-app.js";
 import { readJson } from "./functions/read-json.js";
-import { verifySignature, verifyStandardWebhook } from "./functions/verify-signature.js";
 import { requireEnv } from "./functions/require-env.js";
 import { storeFile } from "./files/store-file.js";
 import { createFileCleanup } from "./files/file-cleanup.js";
@@ -146,4 +147,4 @@ import { defineEmail } from "./mail/define-email.js";
 import { definePdf } from "./pdf/define-pdf.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MailServerTimeoutError, MissingCredentials, ModelError, NotificationSendError, PersonalMailError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, checkWorkflowsSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, startWorkflow, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, workflowInstructions, workflowReadTools, workflowTypes, workflowWriteTools, workflowsMigration, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MailServerTimeoutError, MissingCredentials, ModelError, NotificationSendError, PersonalMailError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, checkWorkflowsSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, hookPath, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, redactHookKeys, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, startWorkflow, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhookIssuePath, webhookParams, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, workflowInstructions, workflowReadTools, workflowTypes, workflowWriteTools, workflowsMigration, writeRecordTools };

package/dist/locale/en.js

@@ -26,6 +26,9 @@ var en_default = {
 		"hidden": "hidden",
 		"yes": "Yes",
 		"no": "No",
+		"webhookTitle": "Issue a new webhook URL for {record}?",
+		"webhookBody": "Its old URL stops at once, and the new URL and secret are shown to this client once.",
+		"issue": "Issue",
 		"createNamedAction": "Create {resource} \"{title}\""
 	},
 	"mcp/approval": {

package/dist/locale/nl.js

@@ -26,6 +26,9 @@ var nl_default = {
 		"hidden": "verborgen",
 		"yes": "Ja",
 		"no": "Nee",
+		"webhookTitle": "Een nieuwe webhook-URL uitgeven voor {record}?",
+		"webhookBody": "De oude URL werkt meteen niet meer, en de nieuwe URL en het geheim worden eenmalig aan deze client getoond.",
+		"issue": "Uitgeven",
 		"createNamedAction": "{resource} \"{title}\" aanmaken"
 	},
 	"mcp/approval": {

package/dist/mcp/mcp-tools.d.ts

@@ -21,7 +21,8 @@ export type McpToolsInput = {
   commented?: string[];
   /**
    * Offers the workflow tools, for an app with `workflows`: reading workflows, their types and runs, and checking
-   * definitions against the app's types; with writes on, `create_workflow`, `update_workflow` and `run_workflow` too.
+   * definitions against the app's types; with writes on, `create_workflow`, `update_workflow`, `run_workflow`,
+   * `enable_workflow` and `new_webhook_url` too.
    * Off by default.
    */
   workflows?: WorkflowCatalog;

package/dist/mcp/mcp-tools.js

@@ -7,6 +7,7 @@ import { batchWriteTool } from "../assistant/batch-write-tool.js";
 import { commentTools } from "../assistant/comment-tools.js";
 import { workflowReadTools } from "../workflows/mcp/workflow-read-tools.js";
 import { workflowWriteTools } from "../workflows/mcp/workflow-write-tools.js";
+import { webhookTools } from "../workflows/mcp/webhook-tools.js";
 //#region src/mcp/mcp-tools.ts
 const writeTools = (input) => [...writeRecordTools(input), batchWriteTool(input)];
 const builtInNames = (db) => new Set([
@@ -21,7 +22,8 @@ const builtInNames = (db) => new Set([
 			triggers: {}
 		})
 	}),
-	...workflowWriteTools()
+	...workflowWriteTools(),
+	...webhookTools({}, () => Promise.reject(/* @__PURE__ */ new Error("Not called")))
 ].map((tool) => tool.name));
 /** The app's own tools; one whose name is taken twice, or by a built-in tool, stops the server at startup. */
 const checkedOwnTools = (db, own) => {
@@ -43,7 +45,7 @@ const mcpTools = ({ db, sql, writes, commented = [], workflows, own = [] }) => {
 	const limits = writes === false ? false : writes === true || !writes.resources ? {} : { resources: writes.resources };
 	const write = limits === false ? [] : writeTools(limits);
 	const comments = commentTools({ commented }, limits);
-	const flows = workflows ? [...workflowReadTools(workflows), ...limits === false ? [] : workflowWriteTools(limits)] : [];
+	const flows = workflows ? [...workflowReadTools(workflows), ...limits === false ? [] : [...workflowWriteTools(limits), ...webhookTools(limits, workflows.issueWebhook)]] : [];
 	const query = sql ? [readOnlyQueryTool(db)] : [];
 	return (session) => [
 		...read,

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.68.4";
+var version = "0.68.6";
 //#endregion
 export { version };

package/dist/user-tables/definitions-resources.js

@@ -51,7 +51,7 @@ const definitionsResources = ({ roles, taken, organizations = false }) => {
 		...organization
 	}).primaryKey((r) => r.id).explicitGrants().access(accessOf(roles, organizations)).validate((table) => [...issue("name", nameIssue(table.name)), ...issue("title_field", table.title_field ? nameProblem(table.title_field, "field") : void 0)]);
 	const fields = resource(fieldsResourceName).table(`${definitionsSchema}.fields`).fields({
-		table_id: f.relation(tablesResourceName).access(createOnly).filterable(),
+		table_id: f.relation(tablesResourceName).access(createOnly).filterable().sortable(),
 		name: f.text().access(createOnly),
 		label: f.text().max(maxLabelLength),
 		type: f.enum(definitionFieldTypes).access(createOnly),

package/dist/user-tables/definitions-views.js

@@ -82,7 +82,7 @@ const fieldsView = view(fieldsResourceName).names({
 		r.type,
 		r.position
 	],
-	sort: [[r.position, "asc"]]
+	sort: [[r.table_id, "asc"], [r.position, "asc"]]
 })).layout((r) => [l.section("Field", [
 	r.table_id,
 	r.label,

package/dist/user-tables/schema-sql.js

@@ -46,6 +46,11 @@ const fieldsSql = () => `create table ${definitionsSchema}.fields (
   check ((type = 'decimal') = (precision is not null and scale is not null))
 )`;
 /**
+* Serves a table's fields in position order, the order its own fields take: the admin's scan guard accepts a sort on
+* `position` only from an index that reaches it with `table_id` pinned. It also reaches a fields table made before it.
+*/
+const fieldsPositionIndexSql = () => `create index if not exists fields_position_idx on ${definitionsSchema}.fields (table_id, position)`;
+/**
 * Brings a definitions table made before organizations to the shape of `tablesSql`: a name unique per organization and
 * the served name.
 */
@@ -65,4 +70,4 @@ const schemasSql = () => [
 	`grant usage, create on schema ${userTablesSchema} to current_user`
 ];
 //#endregion
-export { fieldsOrganizationSql, fieldsSql, nameIndexesSql, organizationsSql, schemasSql, tablesSql, versionDefaultSql };
+export { fieldsOrganizationSql, fieldsPositionIndexSql, fieldsSql, nameIndexesSql, organizationsSql, schemasSql, tablesSql, versionDefaultSql };

package/dist/user-tables/schema.js

@@ -1,15 +1,16 @@
 import { migrationCommand } from "../changes/capture-schema.js";
 import { definitionsSchema, userTablesSchema } from "./names.js";
-import { fieldsOrganizationSql, fieldsSql, nameIndexesSql, organizationsSql, schemasSql, tablesSql, versionDefaultSql } from "./schema-sql.js";
+import { fieldsOrganizationSql, fieldsPositionIndexSql, fieldsSql, nameIndexesSql, organizationsSql, schemasSql, tablesSql, versionDefaultSql } from "./schema-sql.js";
 import { sql } from "kysely";
 //#region src/user-tables/schema.ts
-const current = (found) => found.tables && found.versionDefault && found.organizations && found.fields && found.data && found.trgm;
+const current = (found) => found.tables && found.versionDefault && found.organizations && found.fields && found.positionIndex && found.data && found.trgm;
 const readUserTablesSchema = async (db) => {
 	const { rows } = await sql`select
     to_regclass(${`${definitionsSchema}.tables`}) is not null as tables,
     exists (select from information_schema.columns where table_schema = ${definitionsSchema} and table_name = 'tables' and column_name = 'version' and column_default is not null) as "versionDefault",
     exists (select from information_schema.columns where table_schema = ${definitionsSchema} and table_name = 'tables' and column_name = 'table_name') as organizations,
     to_regclass(${`${definitionsSchema}.fields`}) is not null as fields,
+    to_regclass(${`${definitionsSchema}.fields_position_idx`}) is not null as "positionIndex",
     exists (select from pg_namespace where nspname = ${userTablesSchema}) as data,
     exists (select from pg_extension where extname = 'pg_trgm') as trgm`.execute(db);
 	return rows[0];
@@ -27,14 +28,15 @@ const userTablesMigration = async (db) => {
 	return `${[
 		...schemasSql(),
 		...tables,
-		...fields
+		...fields,
+		fieldsPositionIndexSql()
 	].join(";\n\n")};`;
 };
 /** Refuses to go on while the schemas of user tables are missing; the project's migrations add them. */
 const checkUserTablesSchema = async (db) => {
 	const found = await readUserTablesSchema(db);
 	if (current(found)) return;
-	throw new Error(`The ${definitionsSchema} or ${userTablesSchema} schema, the default of a definition's version, a definition's organization, or pg_trgm, is missing, and userTables keeps the tables users add there. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
+	throw new Error(`The ${definitionsSchema} or ${userTablesSchema} schema, the default of a definition's version, a definition's organization, the position index of its fields, or pg_trgm, is missing, and userTables keeps the tables users add there. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
 };
 //#endregion
 export { checkUserTablesSchema, userTablesMigration };

package/dist/workflows/hooks/hook-auth.js

@@ -0,0 +1,40 @@
+import { HttpProblem } from "../../problem.js";
+import { verifySignature, verifyStandardWebhook } from "../../functions/verify-signature.js";
+import { bearerMatches, usableSecret } from "./hook-secrets.js";
+//#region src/workflows/hooks/hook-auth.ts
+/** The hmac options of a trigger's `auth`, and the header its signature comes in, which the run never sees. */
+const hmacOptions = (input) => input.auth ?? {};
+const verified = (check) => check.then(() => true, (error) => {
+	if (error instanceof HttpProblem && error.status === 401) return false;
+	throw error;
+});
+/**
+* Whether the call proves it comes from the sender, by the trigger's mode: a Standard Webhooks signature within five
+* minutes, an HMAC of the body in the configured header, or the bearer secret. A secret the mode cannot check with, as
+* after the mode changed since the URL was issued, proves nothing. `signed` holds the bytes already read.
+*/
+const authenticated = async (signed, mode, hook) => {
+	if (mode === "bearer") {
+		const token = /^Bearer (.+)$/.exec(signed.headers.get("authorization") ?? "")?.[1];
+		return token !== void 0 && bearerMatches(token, hook.secret_hash);
+	}
+	if (!usableSecret(mode, hook.secret)) return false;
+	if (mode === "standard_webhooks") return verified(verifyStandardWebhook(signed, { secret: hook.secret }));
+	const { header, prefix, encoding, hash } = hmacOptions(hook.input);
+	if (!header) return false;
+	return verified(verifySignature(signed, {
+		secret: hook.secret,
+		header,
+		...prefix !== void 0 && { prefix },
+		...encoding && { encoding },
+		...hash && { hash }
+	}));
+};
+/** The key a call starts its run once under: the signed `webhook-id`, or the configured idempotency header's value. */
+const idempotencyKey = (request, mode, input) => {
+	if (mode === "standard_webhooks") return request.headers.get("webhook-id") ?? void 0;
+	const header = input.idempotency_header;
+	return typeof header === "string" ? request.headers.get(header) ?? void 0 : void 0;
+};
+//#endregion
+export { authenticated, hmacOptions, idempotencyKey };

package/dist/workflows/hooks/hook-event.js

@@ -0,0 +1,51 @@
+import { limits } from "@protobase/workflows";
+//#region src/workflows/hooks/hook-event.ts
+/**
+* Whether the call as its run sees it is over a run input's limit as JSON, which escaping makes larger than the body
+* itself: its body is then kept as a file of the run instead.
+*/
+const overInputLimit = (event) => new TextEncoder().encode(JSON.stringify(event)).length > limits.inputBytes;
+const dropped = (name, signatureHeader) => name === "authorization" || name === "proxy-authorization" || name === "cookie" || name.startsWith("webhook-") || name.startsWith("x-forwarded-") || name === "forwarded" || name === signatureHeader;
+/** The call's headers without its credentials, lower-cased as `Headers` keeps them, so no case of a name gets through. */
+const keptHeaders = (headers, signatureHeader) => {
+	const signature = signatureHeader?.toLowerCase();
+	return Object.fromEntries([...headers].filter(([name]) => !dropped(name, signature)));
+};
+const formFields = (params) => Object.fromEntries([...new Set(params.keys())].map((name) => {
+	const values = params.getAll(name);
+	return [name, values.length === 1 ? values[0] : values];
+}));
+const isJson = (type) => /^application\/([\w.+-]+\+)?json\b/i.test(type);
+const parsedBody = (bytes, type) => {
+	const text = new TextDecoder().decode(bytes);
+	if (isJson(type)) try {
+		return JSON.parse(text);
+	} catch (error) {
+		if (!(error instanceof SyntaxError)) throw error;
+		return text;
+	}
+	if (/^application\/x-www-form-urlencoded\b/i.test(type)) return formFields(new URLSearchParams(text));
+	return text;
+};
+/**
+* The call as its run sees it: method, query, headers without credentials, the body, or `file` when the caller kept the
+* body as a file of the run, as for a call over the run input's 1 MiB, and when it came. The address is left out: it holds the key.
+*/
+const hookEvent = (request, bytes, signatureHeader, file) => ({
+	method: request.method,
+	query: Object.fromEntries(new URL(request.url).searchParams),
+	headers: keptHeaders(request.headers, signatureHeader),
+	body: file ?? parsedBody(bytes, request.headers.get("content-type") ?? ""),
+	received_at: (/* @__PURE__ */ new Date()).toISOString()
+});
+/** The same call for a plugin's `receive`: the headers without credentials, the bytes read, and no key in its address. */
+const receivedRequest = (request, bytes, signatureHeader) => {
+	const url = new URL(request.url);
+	return new Request(`${url.origin}/?${url.searchParams}`, {
+		method: request.method,
+		headers: keptHeaders(request.headers, signatureHeader),
+		body: bytes
+	});
+};
+//#endregion
+export { hookEvent, keptHeaders, overInputLimit, receivedRequest };

package/dist/workflows/hooks/hook-paths.d.ts

@@ -0,0 +1,16 @@
+//#region src/workflows/hooks/hook-paths.d.ts
+/** The names of the parameters in the webhook addresses. */
+export declare const webhookParams: {
+  readonly workflow: "workflow";
+  readonly key: "key";
+};
+/** Where a workflow's webhook URL is issued, `POST <systemPath>/workflows/<id>/webhook`; the route's pattern without an id. */
+export declare const webhookIssuePath: (systemPath: string, workflow?: string) => string;
+/** The public address a webhook trigger is called at, `<systemPath>/workflows/hooks/<key>`; the route's pattern without a key. */
+export declare const hookPath: (systemPath: string, key?: string) => string;
+/**
+ * `text` with the key of every webhook address in it replaced by `[key]`, for a request log: the key opens the URL. A
+ * word of the line is read decoded as the router reads it, so an address written with escapes is redacted too.
+ */
+export declare const redactHookKeys: (text: string) => string;
+//#endregion

package/dist/workflows/hooks/hook-paths.js

@@ -0,0 +1,32 @@
+//#region src/workflows/hooks/hook-paths.ts
+/** The names of the parameters in the webhook addresses. */
+const webhookParams = {
+	workflow: "workflow",
+	key: "key"
+};
+/** Where a workflow's webhook URL is issued, `POST <systemPath>/workflows/<id>/webhook`; the route's pattern without an id. */
+const webhookIssuePath = (systemPath, workflow = `:${webhookParams.workflow}`) => `${systemPath}/workflows/${workflow}/webhook`;
+/** Where the webhook addresses live, the route the public address is mounted at. */
+const hooksBase = (systemPath) => `${systemPath}/workflows/hooks`;
+/** The public address a webhook trigger is called at, `<systemPath>/workflows/hooks/<key>`; the route's pattern without a key. */
+const hookPath = (systemPath, key = `:${webhookParams.key}`) => `${hooksBase(systemPath)}/${key}`;
+const hookAddress = /\/workflows\/hooks\/[^/?#]+/g;
+const decodedEscapes = (part) => part.replace(/(?:%[0-9A-Fa-f]{2})+/g, (escapes) => {
+	try {
+		return decodeURI(escapes);
+	} catch (error) {
+		if (!(error instanceof URIError)) throw error;
+		return escapes;
+	}
+});
+/**
+* `text` with the key of every webhook address in it replaced by `[key]`, for a request log: the key opens the URL. A
+* word of the line is read decoded as the router reads it, so an address written with escapes is redacted too.
+*/
+const redactHookKeys = (text) => text.replace(/\S+/g, (part) => {
+	const decoded = decodedEscapes(part);
+	const redacted = decoded.replace(hookAddress, "/workflows/hooks/[key]");
+	return redacted === decoded ? part : redacted;
+});
+//#endregion
+export { hookPath, hooksBase, redactHookKeys, webhookIssuePath, webhookParams };

package/dist/workflows/hooks/hook-route.js

@@ -0,0 +1,99 @@
+import { HttpProblem, badRequest, notFound, problemResponse, unauthorized } from "../../problem.js";
+import { clientAddress, createRateLimit } from "../../forms/rate-limit.js";
+import { callPlugin } from "../triggers/plugin-call.js";
+import { itemsProblem } from "../triggers/poll-result.js";
+import { removeRunFile, storeRunFile } from "../run-files.js";
+import { hookMode } from "./hook-secrets.js";
+import { authenticated, hmacOptions, idempotencyKey } from "./hook-auth.js";
+import { hookEvent, overInputLimit, receivedRequest } from "./hook-event.js";
+import { webhookParams } from "./hook-paths.js";
+import { findHook } from "./hook-store.js";
+import { startHookRuns } from "./hook-runs.js";
+import { readBody } from "./read-body.js";
+import { Hono } from "hono";
+import { limits } from "@protobase/workflows";
+import { webhookBodyCeiling, webhookBodyDefault } from "@protobase/workflows/plugin";
+//#region src/workflows/hooks/hook-route.ts
+/** Calls an address may have refused (401, 404 and, once a URL was found, 400 and 413) a minute before it waits. */
+const refusalsPerMinute = 30;
+/** Calls a minute that start runs, per trigger, when its input names no `per_minute`. */
+const callsPerMinute = 60;
+const tooMany = (seconds, detail) => new HttpProblem(429, "too-many-calls", "Too Many Requests", detail, {}, { "Retry-After": String(seconds) });
+const bodyLimit = (input) => Math.min(typeof input.body_limit === "number" ? input.body_limit : webhookBodyDefault, webhookBodyCeiling);
+/**
+* The public address a webhook trigger is called at, `POST .../workflows/hooks/<key>`, with no session: only POST; an
+* address that was refused 30 times this minute waits, before any lookup; the key must open a running webhook trigger
+* of an enabled version (404 for anything else, alike); the body is read up to the trigger's limit (413); the call
+* must prove it comes from the sender (401); then the trigger's own rate (429), spent only by calls that did; the run
+* starts once per signed id (202 `{ run_id }`). Each refusal starts no run. Its errors are its own: reported without
+* the request, answered with nothing of it.
+*/
+const hookRoute = (input) => {
+	const { db, schema } = input;
+	const refusals = createRateLimit();
+	const calls = createRateLimit();
+	const app = new Hono();
+	app.onError((error) => {
+		if (error instanceof HttpProblem) return problemResponse(error, "/workflows/hooks");
+		input.report(error);
+		return problemResponse(new HttpProblem(500, "internal-error", "Internal Server Error", "The call could not be taken; send it again"), "/workflows/hooks");
+	});
+	app.all(`/:${webhookParams.key}`, async (c) => {
+		if (c.req.method !== "POST") return c.body(null, 405, { Allow: "POST" });
+		const request = c.req.raw;
+		const address = clientAddress(request.headers);
+		const wait = refusals.spent(address, refusalsPerMinute);
+		if (wait > 0) throw tooMany(wait, "Too many refused calls from this address; wait a minute");
+		const refused = (problem) => {
+			refusals.take(address, refusalsPerMinute);
+			return problem;
+		};
+		const target = await findHook(db, schema, c.req.param(webhookParams.key), input.webhookTypes());
+		const type = target && input.webhooks(target.type);
+		if (!target || !type) throw refused(notFound("There is no webhook at this address"));
+		const bytes = await readBody(request, bodyLimit(target.input));
+		if (!bytes) throw refused(new HttpProblem(413, "body-too-large", "Payload Too Large", `The body is over ${bodyLimit(target.input)} bytes, the most this webhook takes`));
+		const mode = hookMode(target.input);
+		const signed = new Request(request.url, {
+			method: "POST",
+			headers: request.headers,
+			body: bytes
+		});
+		if (!mode || !await authenticated(signed, mode, target)) throw refused(unauthorized("The call does not carry this webhook's secret or signature"));
+		const perMinute = typeof target.input.per_minute === "number" ? target.input.per_minute : callsPerMinute;
+		const rate = calls.take(target.trigger_id, perMinute);
+		if (rate > 0) throw tooMany(rate, `This webhook takes ${perMinute} calls a minute`);
+		const key = idempotencyKey(request, mode, target.input);
+		if (key !== void 0 && key.length > 200) throw refused(badRequest("invalid-idempotency-key", `The call's id is over 200 characters`));
+		const runId = crypto.randomUUID();
+		const signatureHeader = mode === "hmac" ? hmacOptions(target.input).header : void 0;
+		const inline = hookEvent(request, bytes, signatureHeader);
+		const large = overInputLimit(inline);
+		if (large && !input.files()?.providers.private) throw refused(new HttpProblem(413, "body-too-large", "Payload Too Large", `The call is over a run input's ${limits.inputBytes} bytes as JSON, and this app keeps no files for larger ones`));
+		const file = large ? await storeRunFile(input.files(), runId, bytes, "body", request.headers.get("content-type") ?? "application/octet-stream") : void 0;
+		let started = false;
+		try {
+			const event = file ? hookEvent(request, bytes, signatureHeader, file) : inline;
+			const received = await callPlugin(() => type.receive({
+				request: receivedRequest(request, bytes, signatureHeader),
+				event,
+				idempotencyKey: key,
+				input: target.input
+			}), input.redact);
+			if (!("value" in received)) throw new Error(`The webhook trigger ${target.type} failed: ${"failed" in received ? received.failed : received.expired}`);
+			const { items, response } = received.value;
+			const problem = itemsProblem(items, file ? 1 : 100, false);
+			if (problem) throw new Error(`The webhook trigger ${target.type} ${problem}`);
+			const ids = await startHookRuns(db, schema, target, items, runId);
+			if (!ids) throw refused(notFound("There is no webhook at this address"));
+			started = ids[0] === runId;
+			if (response) return response;
+			return ids.length === 1 ? c.json({ run_id: ids[0] }, 202) : c.json({ run_ids: ids }, 202);
+		} finally {
+			if (file && !started) await removeRunFile(input.files(), file);
+		}
+	});
+	return app;
+};
+//#endregion
+export { hookRoute };