@protobase/server 0.68.5 → 0.68.6

package/dist/workflows/triggers/poll-job.js

@@ -0,0 +1,120 @@
+import { defineJob } from "../../jobs/define-job.js";
+import { callPlugin, triggerContext } from "./plugin-call.js";
+import { pollProblem, stateProblem } from "./poll-result.js";
+import { queueRuns } from "../start-workflow.js";
+import { backoffPollAt, nextPollAt, pollEvery } from "./poll-schedule.js";
+import { claimTrigger, saveNeedsSignIn, savePluginFailure, savePoll, saveRenewal, setNextJob } from "./trigger-claim.js";
+//#region src/workflows/triggers/poll-job.ts
+/** The plugin's most items a poll, as it declares them, never more than 100. */
+const pollLimit = (type) => Math.min(type.limit ?? 100, 100);
+/** How often a webhook trigger renews its subscription at its provider. */
+const renewEvery = (type) => type.renewEvery ?? "1 day";
+/**
+* The jobs that poll a polling trigger and renew a webhook trigger's subscription at its provider, each on the trigger's
+* claim (`claimTrigger`): only the job the trigger names runs it, so a stale or duplicate job does nothing. The plugin's
+* error marks the trigger failing and backs off; an expired sign-in stops it, with every trigger on that connection,
+* until its owner signs in again; any other error is thrown, and the job retries under its own id.
+*/
+const pollJobs = (input) => {
+	const { schema, redact } = input;
+	const queueNext = async (trx, job, claim, due) => {
+		const id = await job.enqueue(trx, {
+			trigger: claim.trigger,
+			generation: claim.generation,
+			due: due.toISOString()
+		}, { runAt: due });
+		await setNextJob(trx, schema, claim.trigger, id);
+	};
+	const failed = (db, job, claim, message, nextAt) => db.transaction().execute(async (trx) => {
+		if (await savePluginFailure(trx, schema, claim, message, nextAt)) await queueNext(trx, job, claim, nextAt);
+	});
+	const poll = defineJob({
+		name: "workflows.poll",
+		timeout: "5 minutes",
+		retryDelay: "5 seconds",
+		run: async ({ trigger, generation, due }, { db, job, signal }) => {
+			const claim = {
+				trigger,
+				generation,
+				job: job.id,
+				attempt: job.attempt
+			};
+			const claimed = await claimTrigger(db, schema, claim);
+			const type = claimed && input.polling(claimed.type);
+			if (!claimed || !type) return;
+			const interval = await callPlugin(async () => pollEvery(type, claimed.input), redact);
+			if (!("value" in interval)) return failed(db, poll, claim, "expired" in interval ? interval.expired : interval.failed, backoffPollAt("1 minute", claimed.consecutive_failures + 1, /* @__PURE__ */ new Date()));
+			const every = interval.value;
+			const limit = pollLimit(type);
+			const context = triggerContext(input, claimed.input, signal);
+			const outcome = await callPlugin(() => type.poll({
+				...context,
+				cursor: claimed.cursor,
+				store: claimed.store,
+				limit,
+				due: new Date(due)
+			}), redact);
+			const now = /* @__PURE__ */ new Date();
+			if ("expired" in outcome) return saveNeedsSignIn(db, schema, claim, claimed, outcome.expired);
+			const backoff = backoffPollAt(every, claimed.consecutive_failures + 1, now);
+			if ("failed" in outcome) return failed(db, poll, claim, outcome.failed, backoff);
+			const problem = pollProblem(outcome.value, limit);
+			if (problem) return failed(db, poll, claim, `The poll ${problem}`, backoff);
+			const { items, cursor, store } = outcome.value;
+			const dueAt = new Date(due);
+			const nextAt = nextPollAt(every, dueAt.getTime() > now.getTime() - 1e3 ? dueAt : now);
+			await db.transaction().execute(async (trx) => {
+				const runs = await savePoll(trx, schema, claim, items, {
+					cursor,
+					store: store === void 0 ? claimed.store : store,
+					nextAt
+				});
+				if (!runs) return;
+				await queueRuns(trx, runs);
+				await queueNext(trx, poll, claim, nextAt);
+			});
+		}
+	});
+	const renew = defineJob({
+		name: "workflows.renew",
+		timeout: "5 minutes",
+		retryDelay: "5 seconds",
+		run: async ({ trigger, generation }, { db, job, signal }) => {
+			const claim = {
+				trigger,
+				generation,
+				job: job.id,
+				attempt: job.attempt
+			};
+			const claimed = await claimTrigger(db, schema, claim);
+			const type = claimed && input.webhooks(claimed.type);
+			if (!claimed || !type?.renew) return;
+			const renewal = type.renew;
+			const context = triggerContext(input, claimed.input, signal);
+			const outcome = await callPlugin(() => renewal({
+				...context,
+				state: claimed.store
+			}), redact);
+			const now = /* @__PURE__ */ new Date();
+			if ("expired" in outcome) return saveNeedsSignIn(db, schema, claim, claimed, outcome.expired);
+			const backoff = backoffPollAt("1 minute", claimed.consecutive_failures + 1, now);
+			if ("failed" in outcome) return failed(db, renew, claim, outcome.failed, backoff);
+			const problem = stateProblem(outcome.value);
+			if (problem) return failed(db, renew, claim, `The renewal ${problem}`, backoff);
+			const nextAt = nextPollAt(renewEvery(type), now);
+			await db.transaction().execute(async (trx) => {
+				if (await saveRenewal(trx, schema, claim, {
+					store: outcome.value,
+					nextAt
+				})) await queueNext(trx, renew, claim, nextAt);
+			});
+		}
+	});
+	return {
+		poll,
+		renew,
+		jobs: [poll, renew]
+	};
+};
+//#endregion
+export { pollJobs, pollLimit, renewEvery };

package/dist/workflows/triggers/poll-result.js

@@ -0,0 +1,32 @@
+import { triggerStateBytes } from "../schema-sql.js";
+import { limits, nestingDepth } from "@protobase/workflows";
+const jsonBytes = (value) => new TextEncoder().encode(JSON.stringify(value ?? null)).length;
+/** What is wrong with one item's data as a run's input, as the run's own limits say. */
+const inputProblem = (data) => {
+	if (nestingDepth(data, limits.inputDepth) > limits.inputDepth) return `nests deeper than ${limits.inputDepth} levels`;
+	if (jsonBytes(data) > limits.inputBytes) return `is over ${limits.inputBytes / 1024 / 1024} MiB as JSON`;
+};
+/** What is wrong with the items a plugin gave, each needing a key when `keyed`; `undefined` when they all fit. */
+const itemsProblem = (items, most, keyed) => {
+	if (!Array.isArray(items)) return "gave no items array";
+	if (items.length > most) return `gave ${items.length} items, more than its limit of ${most}`;
+	for (const [index, item] of items.entries()) {
+		const { key, data } = item ?? {};
+		if ((keyed || key !== void 0) && (typeof key !== "string" || key.length === 0 || key.length > 200)) return `item ${index} has no key of 1 to 200 characters`;
+		const problem = inputProblem(data);
+		if (problem) return `item ${index}'s data ${problem}`;
+	}
+};
+/** What is wrong with a subscription's state a webhook plugin gave: over 64 KiB as JSON. */
+const stateProblem = (state) => jsonBytes(state) > 65536 ? `gave a state over ${triggerStateBytes / 1024} KiB as JSON` : void 0;
+/** What is wrong with a poll's result: its items, and its cursor and store over 64 KiB as JSON. */
+const pollProblem = (result, limit) => {
+	if (typeof result !== "object" || result === null) return "gave no result";
+	const { items, cursor, store } = result;
+	const problem = itemsProblem(items, limit, true);
+	if (problem) return problem;
+	if (jsonBytes(cursor) > 65536) return `gave a cursor over ${triggerStateBytes / 1024} KiB as JSON`;
+	if (store !== void 0 && jsonBytes(store) > 65536) return `gave a store over ${triggerStateBytes / 1024} KiB as JSON`;
+};
+//#endregion
+export { itemsProblem, pollProblem, stateProblem };

package/dist/workflows/triggers/poll-schedule.js

@@ -0,0 +1,32 @@
+import { nextRun } from "../../jobs/schedule.js";
+import { parseDuration } from "../../files/duration.js";
+//#region src/workflows/triggers/poll-schedule.ts
+/** The shortest time between two polls, whatever a plugin's `every` says. */
+const shortestMs = 1e3;
+/** The longest wait a failing trigger's backoff reaches. */
+const longestBackoffMs = 36e5;
+/** The base of a cron trigger's backoff, which has no interval of its own. */
+const cronBackoffMs = 6e4;
+/** How often a polling trigger polls for this input. */
+const pollEvery = (type, input) => typeof type.every === "function" ? type.every(input) : type.every;
+/** The time of the poll after one due at `after`: an interval later, or the cron's next time. */
+const nextPollAt = (every, after) => {
+	if (typeof every === "string") return new Date(after.getTime() + Math.max(parseDuration(every, "every"), shortestMs));
+	return nextRun(every.cron, every.timezone ?? "UTC", after);
+};
+/** The first poll of a trigger that starts at `now`: at once on an interval, at the cron's next time otherwise. */
+const firstPollAt = (every, now) => typeof every === "string" ? now : nextRun(every.cron, every.timezone ?? "UTC", now);
+/**
+* When a trigger that failed `failures` times in a row polls again: `every × 2^failures`, at most an hour and never
+* sooner than its interval; a cron trigger at its first time after a minute × 2^failures, at most an hour, from now.
+*/
+const backoffPollAt = (every, failures, now) => {
+	const factor = 2 ** Math.min(failures, 20);
+	if (typeof every === "string") {
+		const interval = Math.max(parseDuration(every, "every"), shortestMs);
+		return new Date(now.getTime() + Math.max(interval, Math.min(interval * factor, longestBackoffMs)));
+	}
+	return nextRun(every.cron, every.timezone ?? "UTC", new Date(now.getTime() + Math.min(cronBackoffMs * factor, longestBackoffMs)));
+};
+//#endregion
+export { backoffPollAt, firstPollAt, nextPollAt, pollEvery };

package/dist/workflows/triggers/trigger-claim.js

@@ -0,0 +1,81 @@
+import { sql } from "kysely";
+//#region src/workflows/triggers/trigger-claim.ts
+/**
+* Claims the trigger for this try of the job its row names, in one statement: only while it runs on this generation,
+* and only for a later try than the last that claimed it, so a retry of a job whose worker died takes its claim back,
+* and a try that ran past its timeout no longer holds it. `undefined` when the trigger was stopped, changed or moved
+* to another job.
+*/
+const claimTrigger = async (db, schema, { trigger, generation, job, attempt }) => {
+	const { rows } = await sql`update ${sql.id(schema, "triggers")} set poll_attempt = ${attempt}
+    where id = ${trigger} and generation = ${generation} and poll_job_id = ${job} and status in ('active', 'failing')
+      and (poll_attempt is null or poll_attempt < ${attempt})
+    returning id, workflow_id, version, tenant_id, type, input, cursor, store, connection_id, consecutive_failures`.execute(db);
+	return rows[0];
+};
+const held = (schema, { trigger, generation, job, attempt }) => sql`select id, workflow_id, version, tenant_id from ${sql.id(schema, "triggers")}
+    where id = ${trigger} and generation = ${generation} and poll_job_id = ${job} and poll_attempt = ${attempt} and status in ('active', 'failing') for update`;
+/**
+* Saves a successful poll in one statement that locks the trigger row while this try holds its claim: the runs of its
+* items, each once per workflow and key, and the new cursor and store, the trigger active again. The ids of the runs it
+* started, or `undefined` when the claim was gone and nothing was written.
+*/
+const savePoll = async (trx, schema, claim, items, { cursor, store, nextAt }) => {
+	const triggers = sql.id(schema, "triggers");
+	const { rows } = await sql`with t as (${held(schema, claim)}),
+    started as (insert into ${sql.id(schema, "runs")} (workflow_id, version, input, key, tenant_id, started_by)
+      select t.workflow_id, t.version, i.data, i.key, t.tenant_id, 'trigger:' || t.id from t cross join jsonb_to_recordset(${JSON.stringify(items)}::jsonb) as i(key text, data jsonb)
+      on conflict (workflow_id, key) do nothing returning id),
+    saved as (update ${triggers} set cursor = ${JSON.stringify(cursor ?? null)}::jsonb, store = ${JSON.stringify(store ?? null)}::jsonb, status = 'active',
+      consecutive_failures = 0, last_error = null, poll_attempt = null, next_poll_at = ${nextAt}, updated_at = now() from t where ${triggers}.id = t.id returning 1)
+    select (select count(*) from saved)::int as saved, coalesce((select json_agg(id) from started), '[]'::json) as runs`.execute(trx);
+	const row = rows[0];
+	return row.saved > 0 ? row.runs : void 0;
+};
+/** Saves a renewal's state while this try holds its claim; whether it did. */
+const saveRenewal = async (trx, schema, claim, { store, nextAt }) => {
+	const triggers = sql.id(schema, "triggers");
+	const { rows } = await sql`with t as (${held(schema, claim)})
+    update ${triggers} set store = ${JSON.stringify(store ?? null)}::jsonb, status = 'active', consecutive_failures = 0, last_error = null, poll_attempt = null,
+      next_poll_at = ${nextAt}, updated_at = now() from t where ${triggers}.id = t.id returning 1`.execute(trx);
+	return rows.length > 0;
+};
+/** Marks the trigger failing with the plugin's error, while this try holds its claim; whether it did. */
+const savePluginFailure = async (trx, schema, claim, message, nextAt) => {
+	const triggers = sql.id(schema, "triggers");
+	const error = JSON.stringify({
+		code: "plugin_error",
+		message,
+		at: (/* @__PURE__ */ new Date()).toISOString()
+	});
+	const { rows } = await sql`with t as (${held(schema, claim)})
+    update ${triggers} set status = 'failing', consecutive_failures = consecutive_failures + 1, last_error = ${error}::jsonb, poll_attempt = null,
+      next_poll_at = ${nextAt}, updated_at = now() from t where ${triggers}.id = t.id returning 1`.execute(trx);
+	return rows.length > 0;
+};
+/**
+* Names the job that polls or renews the trigger next, on the row the transaction holds locked. The new job's tries
+* count from one, so a claim an older job's try still holds is dropped with it.
+*/
+const setNextJob = async (trx, schema, trigger, job) => {
+	await sql`update ${sql.id(schema, "triggers")} set poll_job_id = ${job}, poll_attempt = null where id = ${trigger}`.execute(trx);
+};
+/**
+* The connection's sign-in expired: this trigger, while this try holds its claim, and every running trigger of the same
+* tenant on the same connection wait for a new sign-in, with no next poll. A trigger without a connection is the only
+* one it moves.
+*/
+const saveNeedsSignIn = async (db, schema, claim, trigger, message) => {
+	const error = JSON.stringify({
+		code: "link_expired",
+		message,
+		at: (/* @__PURE__ */ new Date()).toISOString()
+	});
+	const { trigger: id, generation, job, attempt } = claim;
+	await sql`update ${sql.id(schema, "triggers")} set status = 'needs_sign_in', last_error = ${error}::jsonb, poll_job_id = null, poll_attempt = null, next_poll_at = null, updated_at = now()
+    where status in ('active', 'failing') and (
+      (id = ${id} and generation = ${generation} and poll_job_id = ${job} and poll_attempt = ${attempt})
+      or (${trigger.connection_id}::text is not null and connection_id = ${trigger.connection_id} and tenant_id is not distinct from ${trigger.tenant_id}))`.execute(db);
+};
+//#endregion
+export { claimTrigger, saveNeedsSignIn, savePluginFailure, savePoll, saveRenewal, setNextJob };

package/dist/workflows/triggers/trigger-jobs.js

@@ -1,7 +1,10 @@
 import { defineJob } from "../../jobs/define-job.js";
+import { callPlugin, triggerContext } from "./plugin-call.js";
 import { readyAt, readyWhen, resolveTimeTerms } from "../ready/ready-when.js";
 import { activeTriggers, currentTrigger, triggerFailed } from "./trigger-row.js";
 import { orRefusal, readyContext, startIfReady } from "../ready/ready-start.js";
+import { pollJobs } from "./poll-job.js";
+import { triggerStarts } from "./trigger-start.js";
 import { encodeKey } from "@protobase/schema/internal";
 import { printFilter } from "@protobase/schema";
 import { sql } from "kysely";
@@ -10,12 +13,15 @@ import { sql } from "kysely";
 const passSize = 100;
 /**
 * The jobs that run triggers on every server process, so turning a workflow on, changing or turning it off needs no
-* restart: `workflows.trigger-start` (for a ready trigger, one pass over the records that already match, 100 per job),
-* `workflows.trigger-stop` (removes a stopped trigger), and `workflows.ready-check` (starts a run of one record when it
-* is ready, at the time its time terms say). Each acts only on the generation it was queued for.
+* restart: `workflows.trigger-start` (for a ready trigger, one pass over the records that already match, 100 per job;
+* for a polling one its first poll; for a subscribing webhook one its subscription), `workflows.trigger-stop`
+* (unsubscribes a stopped webhook trigger at its provider and removes it), `workflows.ready-check` (starts a run of one
+* record when it is ready, at the time its time terms say), and the poll and renewal jobs. Each acts only on the
+* generation it was queued for.
 */
 const triggerJobs = (input) => {
 	const { schema } = input;
+	const polls = pollJobs(input);
 	const readyCheck = defineJob({
 		name: "workflows.ready-check",
 		timeout: "5 minutes",
@@ -42,12 +48,20 @@ const triggerJobs = (input) => {
 			key: `ready:${trigger.id}:${trigger.generation}:${recordKey}:${at.toISOString()}`
 		});
 	};
+	const starts = triggerStarts(input, polls);
 	const start = defineJob({
 		name: "workflows.trigger-start",
 		timeout: "5 minutes",
-		run: async ({ trigger: id, generation, page_token }, { db }) => {
+		run: async ({ trigger: id, generation, page_token }, { db, signal }) => {
 			const trigger = await currentTrigger(db, schema, id, generation);
-			if (!trigger || !input.declared(trigger.type)) return;
+			if (!trigger) return;
+			const restart = async (later, at) => void await start.enqueue(later, {
+				trigger: id,
+				generation
+			}, { runAt: at });
+			if (input.polling(trigger.type)) return starts.startPolling(db, trigger, signal, restart);
+			if (input.webhooks(trigger.type)) return starts.startWebhook(db, trigger, signal, restart);
+			if (!input.declared(trigger.type)) return;
 			const found = await orRefusal(readyContext(input, trigger));
 			if ("refused" in found) return triggerFailed(db, schema, trigger, "refused", found.refused);
 			if (!found.value) return;
@@ -71,9 +85,24 @@ const triggerJobs = (input) => {
 			});
 		}
 	});
+	const unsubscribe = async (db, trigger, signal) => {
+		const { rows } = await sql`select type, input, store, store is not null as subscribed
+      from ${sql.id(schema, "triggers")} where id = ${trigger} and status = 'stopping'`.execute(db);
+		const row = rows[0];
+		const type = row?.subscribed ? input.webhooks(row.type) : void 0;
+		if (!row || !type?.unsubscribe) return;
+		const end = type.unsubscribe;
+		const outcome = await callPlugin(() => end({
+			...triggerContext(input, row.input, signal),
+			state: row.store
+		}), input.redact);
+		if ("failed" in outcome) throw new Error(`The trigger's unsubscribe failed: ${outcome.failed}`);
+	};
 	const stop = defineJob({
 		name: "workflows.trigger-stop",
-		run: async ({ trigger }, { db }) => {
+		timeout: "5 minutes",
+		run: async ({ trigger }, { db, signal }) => {
+			await unsubscribe(db, trigger, signal);
 			await sql`delete from ${sql.id(schema, "triggers")} where id = ${trigger} and status = 'stopping'`.execute(db);
 		}
 	});
@@ -103,7 +132,8 @@ const triggerJobs = (input) => {
 		jobs: [
 			start,
 			stop,
-			readyCheck
+			readyCheck,
+			...polls.jobs
 		],
 		start,
 		stop,

package/dist/workflows/triggers/trigger-start.js

@@ -0,0 +1,101 @@
+import { callPlugin, redactAlso, triggerContext } from "./plugin-call.js";
+import { stateProblem } from "./poll-result.js";
+import { hookMode } from "../hooks/hook-secrets.js";
+import { hookPath } from "../hooks/hook-paths.js";
+import { saveHook } from "../hooks/hook-store.js";
+import { backoffPollAt, firstPollAt, nextPollAt, pollEvery } from "./poll-schedule.js";
+import { setNextJob } from "./trigger-claim.js";
+import { renewEvery } from "./poll-job.js";
+import { sql } from "kysely";
+//#region src/workflows/triggers/trigger-start.ts
+const stateOf = async (db, schema, { id, generation }) => (await sql`select cursor, cursor is not null as has_cursor, store is not null as has_store, consecutive_failures from ${sql.id(schema, "triggers")}
+    where id = ${id} and generation = ${generation} and status in ('active', 'failing')`.execute(db)).rows[0];
+/**
+* Records a start the plugin refused: an expired sign-in waits for a new one; any other error marks the trigger failing
+* and tries the start again after the backoff.
+*/
+const startFailed = async (db, schema, trigger, outcome, failures, restart) => {
+	const expired = "expired" in outcome;
+	const error = JSON.stringify({
+		code: expired ? "link_expired" : "plugin_error",
+		message: expired ? outcome.expired : outcome.failed,
+		at: (/* @__PURE__ */ new Date()).toISOString()
+	});
+	const { rows } = await sql`update ${sql.id(schema, "triggers")} set status = ${expired ? "needs_sign_in" : "failing"}, consecutive_failures = consecutive_failures + 1,
+    last_error = ${error}::jsonb, updated_at = now() where id = ${trigger.id} and generation = ${trigger.generation} and status in ('active', 'failing') returning 1`.execute(db);
+	if (rows.length > 0 && !expired) await restart(db, backoffPollAt("1 minute", failures + 1, /* @__PURE__ */ new Date()));
+};
+const saveStart = (db, schema, trigger, column, value, nextAt, next) => db.transaction().execute(async (trx) => {
+	const { rows } = await sql`update ${sql.id(schema, "triggers")} set ${sql.ref(column)} = coalesce(${sql.ref(column)}, ${JSON.stringify(value ?? null)}::jsonb), status = 'active', consecutive_failures = 0, last_error = null, next_poll_at = ${nextAt ?? null}, updated_at = now()
+      where id = ${trigger.id} and generation = ${trigger.generation} and status in ('active', 'failing') returning 1`.execute(trx);
+	if (rows.length === 0 || !next) return;
+	await setNextJob(trx, schema, trigger.id, await next(trx));
+});
+/**
+* Starts a polling or subscribing webhook trigger: the plugin's `start` or `subscribe` runs only for a trigger that has
+* no cursor or subscription yet, so a new version on the same input carries on where the last one was; then its first
+* poll or renewal is queued, whose new job id leaves any older one with nothing to do.
+*/
+const triggerStarts = (input, jobs) => {
+	const { schema, redact } = input;
+	const startPolling = async (db, trigger, signal, restart) => {
+		const type = input.polling(trigger.type);
+		const state = type && await stateOf(db, schema, trigger);
+		if (!type || !state) return;
+		const first = await callPlugin(async () => firstPollAt(pollEvery(type, trigger.input), /* @__PURE__ */ new Date()), redact);
+		if (!("value" in first)) return startFailed(db, schema, trigger, first, state.consecutive_failures, restart);
+		const due = first.value;
+		let cursor = state.cursor;
+		if (!state.has_cursor) {
+			const outcome = await callPlugin(() => type.start(triggerContext(input, trigger.input, signal)), redact);
+			if (!("value" in outcome)) return startFailed(db, schema, trigger, outcome, state.consecutive_failures, restart);
+			const problem = stateProblem(outcome.value);
+			if (problem) return startFailed(db, schema, trigger, { failed: `The start ${problem}` }, state.consecutive_failures, restart);
+			cursor = outcome.value;
+		}
+		await saveStart(db, schema, trigger, "cursor", cursor, due, (trx) => jobs.poll.enqueue(trx, {
+			trigger: trigger.id,
+			generation: trigger.generation,
+			due: due.toISOString()
+		}, { runAt: due }));
+	};
+	const startWebhook = async (db, trigger, signal, restart) => {
+		const type = input.webhooks(trigger.type);
+		const state = type?.subscribe && await stateOf(db, schema, trigger);
+		const mode = hookMode(trigger.input);
+		if (!type?.subscribe || !state || state.has_store) return;
+		const origin = input.origin();
+		if (!origin || !mode) return startFailed(db, schema, trigger, { failed: origin ? "The trigger names an auth mode the app does not know" : "The app has no public address to subscribe with: give its auth a baseURL" }, state.consecutive_failures, restart);
+		const { key, secret } = await saveHook(db, schema, {
+			workflow: trigger.workflow_id,
+			tenant: trigger.tenant_id,
+			mode
+		});
+		const subscribe = type.subscribe;
+		const hidden = redactAlso([
+			key,
+			secret,
+			secret.replace(/^whsec_/, "")
+		], redact);
+		const outcome = await callPlugin(() => subscribe({
+			...triggerContext(input, trigger.input, signal),
+			url: `${origin}${hookPath(input.systemPath(), key)}`,
+			secret
+		}), hidden);
+		if (!("value" in outcome)) return startFailed(db, schema, trigger, outcome, state.consecutive_failures, restart);
+		const problem = stateProblem(outcome.value);
+		if (problem) return startFailed(db, schema, trigger, { failed: `The subscription ${problem}` }, state.consecutive_failures, restart);
+		const renewal = type.renew && nextPollAt(renewEvery(type), /* @__PURE__ */ new Date());
+		await saveStart(db, schema, trigger, "store", outcome.value, renewal, renewal && ((trx) => jobs.renew.enqueue(trx, {
+			trigger: trigger.id,
+			generation: trigger.generation,
+			due: renewal.toISOString()
+		}, { runAt: renewal })));
+	};
+	return {
+		startPolling,
+		startWebhook
+	};
+};
+//#endregion
+export { triggerStarts };

package/dist/workflows/workflow-engine.js

@@ -4,8 +4,12 @@ import { workflowSecrets, workflowsSchema } from "./options.js";
 import { workflowSaveHook } from "./save-hook.js";
 import { workflowsRunner } from "./segment-job.js";
 import { runStartHook } from "./start-hook.js";
+import { hookRoute } from "./hooks/hook-route.js";
+import { issueRoute } from "./hooks/issue-route.js";
+import { workflowDeleteHook } from "./triggers/delete-hook.js";
 import { triggerJobs } from "./triggers/trigger-jobs.js";
 import { workflowTypes } from "./workflow-types.js";
+import { secretRedactor } from "@protobase/workflows";
 //#region src/workflows/workflow-engine.ts
 /**
 * What `createAdmin` needs for `workflows`: the hooks that check saves and start runs, the check of a run's input before
@@ -30,15 +34,44 @@ const workflowEngine = (options, deps, auth) => {
 		tasks: (context) => types.tasks(input, context.mail),
 		secrets
 	});
+	const redactor = secretRedactor(Object.values(secrets));
+	const usable = (found) => (type) => types.check.triggers[type] ? found.get(type) : void 0;
 	const triggers = triggerJobs({
-		deps,
-		schema,
-		roles,
+		...input,
 		declared: (type) => types.ready.get(type),
-		readyTypes: [...types.ready.keys()].filter((id) => types.check.triggers[id] !== void 0)
+		readyTypes: [...types.ready.keys()].filter((id) => types.check.triggers[id] !== void 0),
+		polling: usable(types.polling),
+		webhooks: usable(types.webhooks),
+		redact: redactor.text,
+		origin: () => auth?.origins[0],
+		systemPath: () => deps().systemPath
 	});
+	const webhooks = usable(types.webhooks);
+	const issue = {
+		deps,
+		schema,
+		webhooks,
+		origin: () => auth?.origins[0]
+	};
 	return {
-		hooks: [workflowSaveHook(schema, types.check, triggers), runStartHook(runner, deps, schema)],
+		routes: {
+			hooks: () => hookRoute({
+				db: deps().db,
+				schema,
+				webhooks,
+				webhookTypes: () => [...types.webhooks.keys()].filter((id) => webhooks(id)),
+				files: () => deps().files,
+				report: (error) => deps().report(error),
+				redact: redactor.text
+			}),
+			issue: () => issueRoute(issue)
+		},
+		issue,
+		hooks: [
+			workflowSaveHook(schema, types.check, triggers),
+			workflowDeleteHook(schema, triggers),
+			runStartHook(runner, deps, schema)
+		],
 		writeChecks: [runInputCheck],
 		jobs: [job, ...triggers.jobs],
 		onChanges: triggers.onChanges,

package/dist/workflows/workflow-types.d.ts

@@ -2,7 +2,7 @@ import { Mailer } from "../mail/mail-message.js";
 import { ServicesInput } from "./plugin-services.js";
 import { ResourceModel } from "@protobase/schema";
 import { CheckOptions, LoadedPlugin, TaskHandlers } from "@protobase/workflows";
-import { Plugin, ReadyTrigger } from "@protobase/workflows/plugin";
+import { Plugin, PollingTrigger, ReadyTrigger, WebhookTrigger } from "@protobase/workflows/plugin";
 //#region src/workflows/workflow-types.d.ts
 type Models = (name: string) => ResourceModel | undefined;
 /**
@@ -17,6 +17,9 @@ export declare const workflowTypes: (loaded?: readonly LoadedPlugin[], models?:
   checkWith: (against: Models) => CheckOptions;
   tasks: (input: ServicesInput, mail: Mailer | undefined) => TaskHandlers;
   ready: Map<string, ReadyTrigger>;
+  polling: Map<string, PollingTrigger>;
+  webhooks: Map<string, WebhookTrigger>;
+  available: (id: string) => boolean;
 };
 export type WorkflowTypes = ReturnType<typeof workflowTypes>;
 //#endregion

package/dist/workflows/workflow-types.js

@@ -6,12 +6,13 @@ import { appPlugin } from "@protobase/workflow-plugins";
 //#region src/workflows/workflow-types.ts
 const unavailable = (type) => {
 	if (type.connection) return "It signs in through a connection, which this app cannot make yet";
-	if (type.kind === "polling" || type.kind === "webhook") return `This app does not run ${type.kind} triggers yet`;
 };
 const noConnection = (stepId, name) => ({ accessToken: () => Promise.reject(new ConnectionError("not_connected", `${stepId} signs in through "${name}", and this workflow has no sign-in for it`)) });
 const requiredInputs = (input) => Array.isArray(input.required) ? input.required : [];
+/** The triggers of `plugins` of one kind, by id. */
+const triggersOfKind = (plugins, kind) => new Map(plugins.flatMap((plugin) => Object.entries(plugin.triggers ?? {}).flatMap(([key, type]) => type.kind === kind ? [[`${plugin.name}:${key}`, type]] : [])));
 /** The ready triggers of `plugins`, by id. */
-const readyTriggers = (plugins) => new Map(plugins.flatMap((plugin) => Object.entries(plugin.triggers ?? {}).flatMap(([key, type]) => type.kind === "ready" ? [[`${plugin.name}:${key}`, type]] : [])));
+const readyTriggers = (plugins) => triggersOfKind(plugins, "ready");
 /**
 * The trigger and step types of an app: the built-in plugin, `app`, then the app's own, all through the same loader and
 * interface. `types` is the list the MCP tools and the editor read; `check` is what a save checks a definition against,
@@ -25,6 +26,8 @@ const workflowTypes = (loaded = [], models = () => void 0) => {
 	const types = typeList(plugins, unavailable);
 	const available = new Set(types.filter((type) => type.kind !== "step" && type.available).map((type) => type.id));
 	const ready = readyTriggers(plugins);
+	const polling = triggersOfKind(plugins, "polling");
+	const webhooks = triggersOfKind(plugins, "webhook");
 	const steps = types.filter((type) => type.kind === "step" && type.available);
 	const reasons = Object.fromEntries(types.flatMap((type) => type.reason === void 0 ? [] : [[type.id, type.reason]]));
 	const own = triggerChecks(plugins);
@@ -56,7 +59,10 @@ const workflowTypes = (loaded = [], models = () => void 0) => {
 		check,
 		checkWith,
 		tasks,
-		ready
+		ready,
+		polling,
+		webhooks,
+		available: (id) => available.has(id)
 	};
 };
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.68.5",
+  "version": "0.68.6",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,11 +44,11 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.68.5",
-    "@protobase/query": "0.68.5",
-    "@protobase/schema": "0.68.5",
-    "@protobase/workflow-plugins": "0.68.5",
-    "@protobase/workflows": "0.68.5",
+    "@protobase/layout": "0.68.6",
+    "@protobase/query": "0.68.6",
+    "@protobase/schema": "0.68.6",
+    "@protobase/workflow-plugins": "0.68.6",
+    "@protobase/workflows": "0.68.6",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",