@protobase/server 0.68.5 → 0.69.0

package/dist/index.d.ts

@@ -104,6 +104,7 @@ import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
 import { checkWorkflowsSchema, workflowsMigration } from "./workflows/schema.js";
 import { StartWorkflowOptions, startWorkflow } from "./workflows/start-workflow.js";
+import { hookPath, redactHookKeys, webhookIssuePath, webhookParams } from "./workflows/hooks/hook-paths.js";
 import { checkUserTablesSchema, userTablesMigration } from "./user-tables/schema.js";
 import { ownedDefinitionsMigration } from "./user-tables/owned-definitions.js";
 import { UserTables, userTableResources } from "./user-tables/user-table-resources.js";
@@ -196,4 +197,4 @@ import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/ru
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, normalizeRoles } from "./better-auth/create-auth.js";
-export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailAttachment, type MailMessage, MailServerTimeoutError, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PdfComponent, type PdfOptions, type PdfTemplate, PersonalMailError, type PersonalMailErrorCode, type PersonalMailProviderId, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StartWorkflowOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type UserTables, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WorkflowCatalog, type WorkflowTypes, type WorkflowsOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, checkWorkflowsSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, startWorkflow, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, workflowInstructions, workflowReadTools, workflowTypes, workflowWriteTools, workflowsMigration, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailAttachment, type MailMessage, MailServerTimeoutError, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PdfComponent, type PdfOptions, type PdfTemplate, PersonalMailError, type PersonalMailErrorCode, type PersonalMailProviderId, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StartWorkflowOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type UserTables, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WorkflowCatalog, type WorkflowTypes, type WorkflowsOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, checkWorkflowsSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, hookPath, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, redactHookKeys, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, startWorkflow, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhookIssuePath, webhookParams, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, workflowInstructions, workflowReadTools, workflowTypes, workflowWriteTools, workflowsMigration, writeRecordTools };

package/dist/index.js

@@ -68,6 +68,8 @@ import { recordOf, resourceChange } from "./changes/resource-change.js";
 import { defineFunction } from "./functions/define-function.js";
 import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
 import { subscription } from "./webhooks/subscription.js";
+import { verifySignature, verifyStandardWebhook } from "./functions/verify-signature.js";
+import { hookPath, redactHookKeys, webhookIssuePath, webhookParams } from "./workflows/hooks/hook-paths.js";
 import { startWorkflow } from "./workflows/start-workflow.js";
 import { workflowTypes } from "./workflows/workflow-types.js";
 import { historyIdPattern, historyLimits } from "./notifications/history.js";
@@ -135,7 +137,6 @@ import { checkQueryRunner, queryRunnerMigration } from "./assistant/query-runner
 import { startErrorReporting } from "./error-reporting/error-reporter.js";
 import { functionApp } from "./functions/function-app.js";
 import { readJson } from "./functions/read-json.js";
-import { verifySignature, verifyStandardWebhook } from "./functions/verify-signature.js";
 import { requireEnv } from "./functions/require-env.js";
 import { storeFile } from "./files/store-file.js";
 import { createFileCleanup } from "./files/file-cleanup.js";
@@ -146,4 +147,4 @@ import { defineEmail } from "./mail/define-email.js";
 import { definePdf } from "./pdf/define-pdf.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MailServerTimeoutError, MissingCredentials, ModelError, NotificationSendError, PersonalMailError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, checkWorkflowsSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, startWorkflow, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, workflowInstructions, workflowReadTools, workflowTypes, workflowWriteTools, workflowsMigration, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MailServerTimeoutError, MissingCredentials, ModelError, NotificationSendError, PersonalMailError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, checkWorkflowsSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, hookPath, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, redactHookKeys, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, startWorkflow, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhookIssuePath, webhookParams, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, workflowInstructions, workflowReadTools, workflowTypes, workflowWriteTools, workflowsMigration, writeRecordTools };

package/dist/locale/en.js

@@ -26,6 +26,9 @@ var en_default = {
 		"hidden": "hidden",
 		"yes": "Yes",
 		"no": "No",
+		"webhookTitle": "Issue a new webhook URL for {record}?",
+		"webhookBody": "Its old URL stops at once, and the new URL and secret are shown to this client once.",
+		"issue": "Issue",
 		"createNamedAction": "Create {resource} \"{title}\""
 	},
 	"mcp/approval": {

package/dist/locale/nl.js

@@ -26,6 +26,9 @@ var nl_default = {
 		"hidden": "verborgen",
 		"yes": "Ja",
 		"no": "Nee",
+		"webhookTitle": "Een nieuwe webhook-URL uitgeven voor {record}?",
+		"webhookBody": "De oude URL werkt meteen niet meer, en de nieuwe URL en het geheim worden eenmalig aan deze client getoond.",
+		"issue": "Uitgeven",
 		"createNamedAction": "{resource} \"{title}\" aanmaken"
 	},
 	"mcp/approval": {

package/dist/mcp/mcp-tools.d.ts

@@ -21,7 +21,8 @@ export type McpToolsInput = {
   commented?: string[];
   /**
    * Offers the workflow tools, for an app with `workflows`: reading workflows, their types and runs, and checking
-   * definitions against the app's types; with writes on, `create_workflow`, `update_workflow` and `run_workflow` too.
+   * definitions against the app's types; with writes on, `create_workflow`, `update_workflow`, `run_workflow`,
+   * `enable_workflow` and `new_webhook_url` too.
    * Off by default.
    */
   workflows?: WorkflowCatalog;

package/dist/mcp/mcp-tools.js

@@ -7,6 +7,7 @@ import { batchWriteTool } from "../assistant/batch-write-tool.js";
 import { commentTools } from "../assistant/comment-tools.js";
 import { workflowReadTools } from "../workflows/mcp/workflow-read-tools.js";
 import { workflowWriteTools } from "../workflows/mcp/workflow-write-tools.js";
+import { webhookTools } from "../workflows/mcp/webhook-tools.js";
 //#region src/mcp/mcp-tools.ts
 const writeTools = (input) => [...writeRecordTools(input), batchWriteTool(input)];
 const builtInNames = (db) => new Set([
@@ -21,7 +22,8 @@ const builtInNames = (db) => new Set([
 			triggers: {}
 		})
 	}),
-	...workflowWriteTools()
+	...workflowWriteTools(),
+	...webhookTools({}, () => Promise.reject(/* @__PURE__ */ new Error("Not called")))
 ].map((tool) => tool.name));
 /** The app's own tools; one whose name is taken twice, or by a built-in tool, stops the server at startup. */
 const checkedOwnTools = (db, own) => {
@@ -43,7 +45,7 @@ const mcpTools = ({ db, sql, writes, commented = [], workflows, own = [] }) => {
 	const limits = writes === false ? false : writes === true || !writes.resources ? {} : { resources: writes.resources };
 	const write = limits === false ? [] : writeTools(limits);
 	const comments = commentTools({ commented }, limits);
-	const flows = workflows ? [...workflowReadTools(workflows), ...limits === false ? [] : workflowWriteTools(limits)] : [];
+	const flows = workflows ? [...workflowReadTools(workflows), ...limits === false ? [] : [...workflowWriteTools(limits), ...webhookTools(limits, workflows.issueWebhook)]] : [];
 	const query = sql ? [readOnlyQueryTool(db)] : [];
 	return (session) => [
 		...read,

package/dist/notifications/history-routes.js

@@ -1,7 +1,7 @@
 import { badRequest } from "../problem.js";
+import { ownSignInUser } from "./caller.js";
 import { historyIdPattern } from "./history.js";
 import "./history-store.js";
-import { ownSignInUser } from "./caller.js";
 import { historyCursor, historyPosition } from "./history-cursor.js";
 import { jsonBody, jsonOnly, limitedBody, queryOf } from "./history-request.js";
 import { historyUrl } from "./history-url.js";

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.68.5";
+var version = "0.69.0";
 //#endregion
 export { version };

package/dist/personal-mail/linked-accounts.js

@@ -1,3 +1,4 @@
+import { watchRefusals } from "../better-auth/refresh-refusals.js";
 import { PersonalMailError } from "./personal-mail-error.js";
 import { APIError } from "better-auth/api";
 //#region src/personal-mail/linked-accounts.ts
@@ -5,7 +6,7 @@ const storedScopes = (scope) => (scope ?? "").split(/[\s,]+/).filter(Boolean);
 /**
 * The accounts Better Auth keeps, with the tokens it stores, decrypted when `encryptOAuthTokens` is on. Its
 * `getAccessToken` refreshes a token within five seconds of expiry with the provider's refresh token and stores the new
-* one; when the provider refuses the refresh, as for a revoked grant, that is `link_expired`.
+* one; when the provider refuses the refresh token, as for a revoked grant, that is `link_expired`.
 */
 const betterAuthLinkedAccounts = (auth) => ({
 	accounts: async (userId) => {
@@ -17,21 +18,24 @@ const betterAuthLinkedAccounts = (auth) => ({
 		}));
 	},
 	accessToken: async (userId, account, provider) => {
-		const accessToken = await validAccessToken(auth, userId, account.id, provider);
+		const accessToken = await accountAccessToken(auth, userId, account.id);
 		if (!accessToken) throw new PersonalMailError("link_expired", provider);
 		return accessToken;
 	}
 });
-const validAccessToken = async (auth, userId, accountId, provider) => {
-	try {
-		return (await auth.api.getAccessToken({ body: {
-			accountId,
-			userId
-		} })).accessToken;
-	} catch (error) {
-		if (error instanceof APIError && error.body?.code === "FAILED_TO_GET_ACCESS_TOKEN") throw new PersonalMailError("link_expired", provider);
-		throw error;
-	}
+/**
+* A valid access token of the account, refreshed first when it expired; undefined when the provider refused the refresh
+* token (`invalid_grant`) or the account holds none. A refresh that failed otherwise, as when the provider was down,
+* throws, so the caller tries again later rather than asking the person to connect the account again.
+*/
+const accountAccessToken = async (auth, userId, accountId) => {
+	const answer = await watchRefusals(() => auth.api.getAccessToken({ body: {
+		accountId,
+		userId
+	} }));
+	if ("value" in answer) return answer.value.accessToken || void 0;
+	if (answer.refused && answer.error instanceof APIError && answer.error.body?.code === "FAILED_TO_GET_ACCESS_TOKEN") return;
+	throw answer.error;
 };
 //#endregion
-export { betterAuthLinkedAccounts, storedScopes };
+export { accountAccessToken, betterAuthLinkedAccounts, storedScopes };

package/dist/types.d.ts

@@ -76,6 +76,8 @@ export type WriteEvent = {
   tenant?: TenantValue;
   /** The writer is a visitor without a token, through a public form. */
   anonymous?: true;
+  /** The writer's session as the API resolved it, for a hook that allows a write only for someone signed in as themselves (`ownSignInUser`). */
+  session: Session;
   before?: Row;
   after?: Row;
 };

package/dist/webhooks/attempt.js

@@ -1,9 +1,9 @@
+import { AddressRefusedError, pinnedRequest } from "./table/pinned-request.js";
+import { readLimited } from "./table/read-limited.js";
 import { invokeFunction } from "../functions/define-function.js";
 import { retryAfterMs } from "./retry-schedule.js";
 import { standardWebhookHeaders } from "./standard-webhooks.js";
 import { subscriberSession } from "./subscriber-view.js";
-import { AddressRefusedError, pinnedRequest } from "./table/pinned-request.js";
-import { readLimited } from "./table/read-limited.js";
 //#region src/webhooks/attempt.ts
 /** How long a receiver has to answer. */
 const attemptTimeoutMs = 15e3;

package/dist/webhooks/table/webhook-table.js

@@ -1,5 +1,5 @@
-import { betterAuthOwnerRoles } from "./owner-roles.js";
 import { checkWebhookUrl } from "./address-check.js";
+import { betterAuthOwnerRoles } from "./owner-roles.js";
 import { webhooksSchema } from "./options.js";
 import { tableSubscriptions } from "./table-subscriptions.js";
 //#region src/webhooks/table/webhook-table.ts

package/dist/workflows/connections/connection-accounts.js

@@ -0,0 +1,18 @@
+import { accountAccessToken, storedScopes } from "../../personal-mail/linked-accounts.js";
+//#region src/workflows/connections/connection-accounts.ts
+/** The accounts Better Auth keeps, read through its internal adapter, with its refreshing `getAccessToken`. */
+const betterAuthConnectionAccounts = (auth) => ({
+	find: async (userId, accountId) => {
+		const account = (await (await auth.$context).internalAdapter.findAccounts(userId)).find((candidate) => candidate.id === accountId);
+		if (!account) return;
+		return {
+			id: account.id,
+			providerId: account.providerId,
+			scopes: storedScopes(account.scope),
+			refreshToken: account.refreshToken ?? null
+		};
+	},
+	accessToken: (userId, accountId) => accountAccessToken(auth, userId, accountId)
+});
+//#endregion
+export { betterAuthConnectionAccounts };

package/dist/workflows/connections/connection-consent.js

@@ -0,0 +1,49 @@
+import { badRequest, forbidden } from "../../problem.js";
+import { connectionProviderId, holdsScopes } from "./connection-provider.js";
+import { ownSignInUser } from "../../notifications/caller.js";
+import { sql } from "kysely";
+import { usedConnections } from "@protobase/workflows";
+//#region src/workflows/connections/connection-consent.ts
+/** The refusal of every account the caller may not turn on, the same whether it exists or not. */
+const notOwnConnection = () => forbidden("own-sign-in-only", "Only the owner of each connection this workflow uses, signed in as themselves, can turn it on: turn it off to save it, and its owner turns it on again in the admin app");
+/**
+* Turning a version on is the consent that lets its runs sign in through the accounts it binds: it is refused unless
+* the caller is signed in as themselves (not staff signed in as them, nor an outside app acting for them) and owns
+* every bound account, of its connection's provider and holding its scopes. Returns who consented, which the version
+* keeps as `enabled_by`: the caller when they are signed in as themselves, else nobody, as for a version that binds
+* no account turned on by an outside app.
+*/
+const connectionConsent = ({ accounts, declarationOf, connectionOf }) => async (session, definition) => {
+	const keys = [...usedConnections(definition, connectionOf)];
+	if (keys.length === 0) {
+		if (session.anonymous || session.client || session.signIn?.staff !== false) return null;
+		return String(session.user.id);
+	}
+	const unbound = keys.filter((key) => !definition.connections?.[key]);
+	if (unbound.length > 0) throw badRequest("invalid-workflow", `Connect an account for ${unbound.join(", ")} in the workflow's connections before turning it on`);
+	const userId = ownSignInUser(session, "turn on a workflow that signs in through their connection");
+	for (const key of keys) {
+		const declaration = declarationOf(key);
+		const [plugin, name] = key.split(":");
+		const account = await accounts.find(userId, definition.connections[key]);
+		if (!account || account.providerId !== connectionProviderId(plugin, name, declaration) || !holdsScopes(account.scopes, declaration)) throw notOwnConnection();
+	}
+	return userId;
+};
+/**
+* Keeps who turned a version on, as its runs' steps read it, and withdraws the consent when the workflow is turned
+* off: every version's runs then sign in through no account until it is turned on again. Someone else turning a
+* version on withdraws the earlier person's consent on every other version, so a waiting run of one of them signs in
+* through no account of theirs; the earlier versions the same person turned on keep it.
+*/
+const saveConsent = async (trx, schema, workflowId, enabled, enabledBy) => {
+	const versions = sql.id(schema, "versions");
+	if (enabled === null) {
+		await sql`update ${versions} set enabled_by = null where workflow_id = ${workflowId} and enabled_by is not null`.execute(trx);
+		return;
+	}
+	await sql`update ${versions} set enabled_by = null where workflow_id = ${workflowId} and version <> ${enabled} and enabled_by is distinct from ${enabledBy}`.execute(trx);
+	await sql`update ${versions} set enabled_by = ${enabledBy} where workflow_id = ${workflowId} and version = ${enabled}`.execute(trx);
+};
+//#endregion
+export { connectionConsent, notOwnConnection, saveConsent };

package/dist/workflows/connections/connection-provider.js

@@ -0,0 +1,10 @@
+//#region src/workflows/connections/connection-provider.ts
+/**
+* The Better Auth provider id a connection's accounts are kept under: the app's sign-in provider it names, or one of
+* its own, `workflow-<plugin>-<connection>`, for an `oauth` connection; plugin and connection names hold no `-`.
+*/
+const connectionProviderId = (plugin, name, declaration) => "signIn" in declaration ? declaration.signIn : `workflow-${plugin}-${name}`;
+/** Whether an account's stored scopes hold every scope the connection asks for. */
+const holdsScopes = (stored, declaration) => (declaration.scopes ?? []).every((scope) => stored.includes(scope));
+//#endregion
+export { connectionProviderId, holdsScopes };

package/dist/workflows/connections/connection-tokens.js

@@ -0,0 +1,54 @@
+import { connectionProviderId, holdsScopes } from "./connection-provider.js";
+import { enablerMayUpdate } from "./enabler-authority.js";
+import { singleFlight } from "./single-flight.js";
+import { sql } from "kysely";
+import { ConnectionError } from "@protobase/workflows/plugin";
+//#region src/workflows/connections/connection-tokens.ts
+/**
+* An account's valid access token, refreshed when it expired, with overlapping refreshes of one account joined into
+* one. Another worker may rotate the refresh token between this one's read (`before`, the stored refresh token) and its
+* refresh, which the provider then refuses: reading the account once more tells that apart, and the stored token is
+* then the fresh one. Undefined when the provider refused it.
+*/
+const sharedRefresh = (accounts) => {
+	const refresh = singleFlight();
+	return async (userId, accountId, before) => {
+		const token = await refresh(accountId, () => accounts.accessToken(userId, accountId));
+		if (token) return token;
+		const after = await accounts.find(userId, accountId);
+		if (!after || after.refreshToken === before) return;
+		return refresh(accountId, () => accounts.accessToken(userId, accountId));
+	};
+};
+/**
+* The connection a step or trigger declared, bound by its workflow. Each `accessToken()` checks afresh, caching nothing:
+* the version it runs binds an account to the connection, the person who turned that version on owns that account of
+* the connection's provider with its scopes, and may still update the workflow in its tenant. Anything else is
+* `not_connected`, with one message that tells nothing of whether the account exists; a refresh the provider refuses
+* is `link_expired`. The token is blanked out of all the step records (`secret`).
+*/
+const connectionTokens = ({ deps, schema, roles, accounts }) => {
+	const tokenOf = sharedRefresh(accounts);
+	return (use) => {
+		const key = `${use.plugin}:${use.name}`;
+		const notConnected = () => new ConnectionError("not_connected", `This workflow has no connection it may use for ${key}: its owner connects an account and turns the workflow on`);
+		return { accessToken: async () => {
+			const ref = await use.version();
+			if (!ref) throw notConnected();
+			const db = deps().db;
+			const { rows } = await sql`select v.definition -> 'connections' ->> ${key} as account, v.enabled_by, v.tenant_id
+          from ${sql.id(schema, "versions")} v where v.workflow_id = ${ref.workflowId} and v.version = ${ref.version}`.execute(db);
+			const consent = rows[0];
+			if (!consent?.account || !consent.enabled_by) throw notConnected();
+			if (!await enablerMayUpdate(db, deps(), roles, consent.enabled_by, consent.tenant_id ?? void 0, ref.workflowId)) throw notConnected();
+			const account = await accounts.find(consent.enabled_by, consent.account);
+			if (!account || account.providerId !== connectionProviderId(use.plugin, use.name, use.declaration) || !holdsScopes(account.scopes, use.declaration)) throw notConnected();
+			const token = await tokenOf(consent.enabled_by, account.id, account.refreshToken);
+			if (!token) throw new ConnectionError("link_expired", `The account connected for ${key} no longer signs in: its owner connects it again`);
+			use.secret(token);
+			return token;
+		} };
+	};
+};
+//#endregion
+export { connectionTokens, sharedRefresh };

package/dist/workflows/connections/connection-triggers.js

@@ -0,0 +1,37 @@
+import { sql } from "kysely";
+//#region src/workflows/connections/connection-triggers.ts
+/**
+* The triggers of connected accounts, as sign-in tells of them: a link resumes the triggers waiting on that account's
+* sign-in, which poll again from the cursor they kept or renew the subscription they kept; a disconnect makes the
+* running ones wait for a new sign-in.
+*/
+const connectionTriggers = (db, schema, jobs) => {
+	const triggers = sql.id(schema, "triggers");
+	return {
+		linked: async (accountId) => {
+			await db().transaction().execute(async (trx) => {
+				const { rows } = await sql`update ${triggers} set status = 'active', consecutive_failures = 0, last_error = null, updated_at = now()
+          where connection_id = ${accountId} and status = 'needs_sign_in' returning id, generation`.execute(trx);
+				for (const row of rows) await jobs.start.enqueue(trx, {
+					trigger: row.id,
+					generation: row.generation
+				});
+			});
+		},
+		disconnected: async (accountId) => {
+			const error = JSON.stringify({
+				code: "link_expired",
+				message: "The connected account was disconnected: its owner connects it again",
+				at: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			await sql`update ${triggers} set status = 'needs_sign_in', last_error = ${error}::jsonb, poll_job_id = null, poll_attempt = null, next_poll_at = null, updated_at = now()
+        where connection_id = ${accountId} and status in ('active', 'failing')`.execute(db());
+		},
+		needsSignIn: async (accountIds) => {
+			const { rows } = await sql`select distinct connection_id from ${triggers} where status = 'needs_sign_in' and connection_id in (${sql.join(accountIds)})`.execute(db());
+			return rows.map((row) => row.connection_id);
+		}
+	};
+};
+//#endregion
+export { connectionTriggers };

package/dist/workflows/connections/connection-wiring.js

@@ -0,0 +1,73 @@
+import { connectionConsent } from "./connection-consent.js";
+import { enablerMayUpdate } from "./enabler-authority.js";
+import { enablerMailbox } from "./enabler-mailbox.js";
+import { connectionTokens } from "./connection-tokens.js";
+import { sql } from "kysely";
+import { ConnectionError } from "@protobase/workflows/plugin";
+//#region src/workflows/connections/connection-wiring.ts
+const noAccounts = {
+	find: async () => void 0,
+	accessToken: async () => void 0
+};
+/**
+* The connections of an app's workflows: the consent a save checks as a version is turned on, and the connection each
+* step and trigger that declares one gets, bound by the version its run or trigger runs.
+*/
+const connectionWiring = ({ deps, schema, roles, accounts = noAccounts, plugins, connectionOf, personalMailer }) => {
+	const declarationOf = (key) => {
+		const [plugin, name] = key.split(":");
+		return plugins.find((candidate) => candidate.name === plugin)?.connections?.[name];
+	};
+	const consent = connectionConsent({
+		accounts,
+		declarationOf,
+		connectionOf
+	});
+	const tokens = connectionTokens({
+		deps,
+		schema,
+		roles,
+		accounts
+	});
+	const use = (type, version, secret) => {
+		const key = connectionOf[type];
+		const declaration = key === void 0 ? void 0 : declarationOf(key);
+		if (!key || !declaration) return;
+		const [plugin, name] = key.split(":");
+		return tokens({
+			plugin,
+			name,
+			declaration,
+			version,
+			secret
+		});
+	};
+	const runVersion = async (runId) => {
+		const { rows } = await sql`select workflow_id, version from ${sql.id(schema, "runs")} where id = ${runId}`.execute(deps().db);
+		const run = rows[0];
+		return run?.version == null ? void 0 : {
+			workflowId: run.workflow_id,
+			version: run.version
+		};
+	};
+	const step = (stepId, name, task) => use(stepId, () => runVersion(task.runId), task.secret) ?? { accessToken: () => Promise.reject(new ConnectionError("not_connected", `${stepId} signs in through "${name}", which this app does not declare`)) };
+	const trigger = (row, secret) => use(row.type, async () => row.workflow_id === null ? void 0 : {
+		workflowId: row.workflow_id,
+		version: row.version
+	}, secret);
+	const runEnabler = async (runId) => {
+		const { rows } = await sql`select r.workflow_id, v.enabled_by, v.tenant_id from ${sql.id(schema, "runs")} r
+      join ${sql.id(schema, "versions")} v on v.workflow_id = r.workflow_id and v.version = r.version where r.id = ${runId}`.execute(deps().db);
+		const row = rows[0];
+		if (!row?.enabled_by) return null;
+		return await enablerMayUpdate(deps().db, deps(), roles, row.enabled_by, row.tenant_id ?? void 0, row.workflow_id) ? row.enabled_by : null;
+	};
+	return {
+		consent,
+		step,
+		trigger,
+		mailbox: personalMailer && ((task) => enablerMailbox(() => runEnabler(task.runId), personalMailer))
+	};
+};
+//#endregion
+export { connectionWiring };

package/dist/workflows/connections/enabler-authority.js

@@ -0,0 +1,35 @@
+import { requestAccess } from "../../request-access.js";
+import { deletedRows } from "../../params.js";
+import { fetchReadable } from "../../fetch-readable.js";
+import { mayUpdateWorkflow } from "../may-update-workflow.js";
+//#region src/workflows/connections/enabler-authority.ts
+/**
+* Whether the person who turned a workflow on may still do so: with the roles they hold now in its tenant, they may
+* read this one and update it, as its update row filter and record-level rule decide. Losing either, as when they were
+* demoted or left the organization, withdraws the connection their consent gave its runs.
+*/
+const enablerMayUpdate = async (db, deps, roles, enabledBy, tenant, workflowId) => {
+	const held = await roles({
+		id: enabledBy,
+		...tenant !== void 0 && { tenant }
+	});
+	if (held.length === 0) return false;
+	const entry = deps.registry.find("workflows");
+	const session = {
+		user: {
+			id: enabledBy,
+			roles: held
+		},
+		...tenant !== void 0 && {
+			tenant,
+			organization: { id: tenant }
+		}
+	};
+	const access = await requestAccess(deps, entry, session);
+	if (!access.resolved.operations.update) return false;
+	const found = await fetchReadable(db, access, [workflowId], deletedRows(access.full, false), {});
+	if (!found) return false;
+	return mayUpdateWorkflow(db, access, workflowId, found.record);
+};
+//#endregion
+export { enablerMayUpdate };

package/dist/workflows/connections/enabler-mailbox.js

@@ -0,0 +1,15 @@
+import { PersonalMailError } from "../../personal-mail/personal-mail-error.js";
+//#region src/workflows/connections/enabler-mailbox.ts
+/**
+* The step context's `mailbox`: each message goes out from the own mailbox of the person who turned the run's version
+* on, signed in as themselves, as `enablerOf` reads them afresh; nobody (a version an outside app turned on, a workflow
+* turned off, or someone who may no longer change it) sends nothing and fails `not_linked`. A job's own code gets no
+* such mailer: only this consent lets mail leave someone's mailbox without their own request.
+*/
+const enablerMailbox = (enablerOf, personalMailer) => ({ send: async (message) => {
+	const enabledBy = await enablerOf();
+	if (!enabledBy) throw new PersonalMailError("not_linked");
+	await personalMailer(enabledBy).send(message);
+} });
+//#endregion
+export { enablerMailbox };

package/dist/workflows/connections/single-flight.js

@@ -0,0 +1,17 @@
+//#region src/workflows/connections/single-flight.ts
+/**
+* Joins calls of one key that overlap: the second waits for the first's result instead of starting its own, such as a
+* second refresh of one account's token. An entry lives only while its call runs, so the map holds the calls in flight.
+*/
+const singleFlight = () => {
+	const running = /* @__PURE__ */ new Map();
+	return (key, call) => {
+		const joined = running.get(key);
+		if (joined) return joined;
+		const started = call().finally(() => running.delete(key));
+		running.set(key, started);
+		return started;
+	};
+};
+//#endregion
+export { singleFlight };

package/dist/workflows/hooks/hook-auth.js

@@ -0,0 +1,40 @@
+import { HttpProblem } from "../../problem.js";
+import { verifySignature, verifyStandardWebhook } from "../../functions/verify-signature.js";
+import { bearerMatches, usableSecret } from "./hook-secrets.js";
+//#region src/workflows/hooks/hook-auth.ts
+/** The hmac options of a trigger's `auth`, and the header its signature comes in, which the run never sees. */
+const hmacOptions = (input) => input.auth ?? {};
+const verified = (check) => check.then(() => true, (error) => {
+	if (error instanceof HttpProblem && error.status === 401) return false;
+	throw error;
+});
+/**
+* Whether the call proves it comes from the sender, by the trigger's mode: a Standard Webhooks signature within five
+* minutes, an HMAC of the body in the configured header, or the bearer secret. A secret the mode cannot check with, as
+* after the mode changed since the URL was issued, proves nothing. `signed` holds the bytes already read.
+*/
+const authenticated = async (signed, mode, hook) => {
+	if (mode === "bearer") {
+		const token = /^Bearer (.+)$/.exec(signed.headers.get("authorization") ?? "")?.[1];
+		return token !== void 0 && bearerMatches(token, hook.secret_hash);
+	}
+	if (!usableSecret(mode, hook.secret)) return false;
+	if (mode === "standard_webhooks") return verified(verifyStandardWebhook(signed, { secret: hook.secret }));
+	const { header, prefix, encoding, hash } = hmacOptions(hook.input);
+	if (!header) return false;
+	return verified(verifySignature(signed, {
+		secret: hook.secret,
+		header,
+		...prefix !== void 0 && { prefix },
+		...encoding && { encoding },
+		...hash && { hash }
+	}));
+};
+/** The key a call starts its run once under: the signed `webhook-id`, or the configured idempotency header's value. */
+const idempotencyKey = (request, mode, input) => {
+	if (mode === "standard_webhooks") return request.headers.get("webhook-id") ?? void 0;
+	const header = input.idempotency_header;
+	return typeof header === "string" ? request.headers.get(header) ?? void 0 : void 0;
+};
+//#endregion
+export { authenticated, hmacOptions, idempotencyKey };