@protobase/server 0.68.6 → 0.69.1

package/dist/workflows/connections/connection-consent.js

@@ -0,0 +1,49 @@
+import { badRequest, forbidden } from "../../problem.js";
+import { connectionProviderId, holdsScopes } from "./connection-provider.js";
+import { ownSignInUser } from "../../notifications/caller.js";
+import { sql } from "kysely";
+import { usedConnections } from "@protobase/workflows";
+//#region src/workflows/connections/connection-consent.ts
+/** The refusal of every account the caller may not turn on, the same whether it exists or not. */
+const notOwnConnection = () => forbidden("own-sign-in-only", "Only the owner of each connection this workflow uses, signed in as themselves, can turn it on: turn it off to save it, and its owner turns it on again in the admin app");
+/**
+* Turning a version on is the consent that lets its runs sign in through the accounts it binds: it is refused unless
+* the caller is signed in as themselves (not staff signed in as them, nor an outside app acting for them) and owns
+* every bound account, of its connection's provider and holding its scopes. Returns who consented, which the version
+* keeps as `enabled_by`: the caller when they are signed in as themselves, else nobody, as for a version that binds
+* no account turned on by an outside app.
+*/
+const connectionConsent = ({ accounts, declarationOf, connectionOf }) => async (session, definition) => {
+	const keys = [...usedConnections(definition, connectionOf)];
+	if (keys.length === 0) {
+		if (session.anonymous || session.client || session.signIn?.staff !== false) return null;
+		return String(session.user.id);
+	}
+	const unbound = keys.filter((key) => !definition.connections?.[key]);
+	if (unbound.length > 0) throw badRequest("invalid-workflow", `Connect an account for ${unbound.join(", ")} in the workflow's connections before turning it on`);
+	const userId = ownSignInUser(session, "turn on a workflow that signs in through their connection");
+	for (const key of keys) {
+		const declaration = declarationOf(key);
+		const [plugin, name] = key.split(":");
+		const account = await accounts.find(userId, definition.connections[key]);
+		if (!account || account.providerId !== connectionProviderId(plugin, name, declaration) || !holdsScopes(account.scopes, declaration)) throw notOwnConnection();
+	}
+	return userId;
+};
+/**
+* Keeps who turned a version on, as its runs' steps read it, and withdraws the consent when the workflow is turned
+* off: every version's runs then sign in through no account until it is turned on again. Someone else turning a
+* version on withdraws the earlier person's consent on every other version, so a waiting run of one of them signs in
+* through no account of theirs; the earlier versions the same person turned on keep it.
+*/
+const saveConsent = async (trx, schema, workflowId, enabled, enabledBy) => {
+	const versions = sql.id(schema, "versions");
+	if (enabled === null) {
+		await sql`update ${versions} set enabled_by = null where workflow_id = ${workflowId} and enabled_by is not null`.execute(trx);
+		return;
+	}
+	await sql`update ${versions} set enabled_by = null where workflow_id = ${workflowId} and version <> ${enabled} and enabled_by is distinct from ${enabledBy}`.execute(trx);
+	await sql`update ${versions} set enabled_by = ${enabledBy} where workflow_id = ${workflowId} and version = ${enabled}`.execute(trx);
+};
+//#endregion
+export { connectionConsent, notOwnConnection, saveConsent };

package/dist/workflows/connections/connection-provider.js

@@ -0,0 +1,10 @@
+//#region src/workflows/connections/connection-provider.ts
+/**
+* The Better Auth provider id a connection's accounts are kept under: the app's sign-in provider it names, or one of
+* its own, `workflow-<plugin>-<connection>`, for an `oauth` connection; plugin and connection names hold no `-`.
+*/
+const connectionProviderId = (plugin, name, declaration) => "signIn" in declaration ? declaration.signIn : `workflow-${plugin}-${name}`;
+/** Whether an account's stored scopes hold every scope the connection asks for. */
+const holdsScopes = (stored, declaration) => (declaration.scopes ?? []).every((scope) => stored.includes(scope));
+//#endregion
+export { connectionProviderId, holdsScopes };

package/dist/workflows/connections/connection-tokens.js

@@ -0,0 +1,54 @@
+import { connectionProviderId, holdsScopes } from "./connection-provider.js";
+import { enablerMayUpdate } from "./enabler-authority.js";
+import { singleFlight } from "./single-flight.js";
+import { sql } from "kysely";
+import { ConnectionError } from "@protobase/workflows/plugin";
+//#region src/workflows/connections/connection-tokens.ts
+/**
+* An account's valid access token, refreshed when it expired, with overlapping refreshes of one account joined into
+* one. Another worker may rotate the refresh token between this one's read (`before`, the stored refresh token) and its
+* refresh, which the provider then refuses: reading the account once more tells that apart, and the stored token is
+* then the fresh one. Undefined when the provider refused it.
+*/
+const sharedRefresh = (accounts) => {
+	const refresh = singleFlight();
+	return async (userId, accountId, before) => {
+		const token = await refresh(accountId, () => accounts.accessToken(userId, accountId));
+		if (token) return token;
+		const after = await accounts.find(userId, accountId);
+		if (!after || after.refreshToken === before) return;
+		return refresh(accountId, () => accounts.accessToken(userId, accountId));
+	};
+};
+/**
+* The connection a step or trigger declared, bound by its workflow. Each `accessToken()` checks afresh, caching nothing:
+* the version it runs binds an account to the connection, the person who turned that version on owns that account of
+* the connection's provider with its scopes, and may still update the workflow in its tenant. Anything else is
+* `not_connected`, with one message that tells nothing of whether the account exists; a refresh the provider refuses
+* is `link_expired`. The token is blanked out of all the step records (`secret`).
+*/
+const connectionTokens = ({ deps, schema, roles, accounts }) => {
+	const tokenOf = sharedRefresh(accounts);
+	return (use) => {
+		const key = `${use.plugin}:${use.name}`;
+		const notConnected = () => new ConnectionError("not_connected", `This workflow has no connection it may use for ${key}: its owner connects an account and turns the workflow on`);
+		return { accessToken: async () => {
+			const ref = await use.version();
+			if (!ref) throw notConnected();
+			const db = deps().db;
+			const { rows } = await sql`select v.definition -> 'connections' ->> ${key} as account, v.enabled_by, v.tenant_id
+          from ${sql.id(schema, "versions")} v where v.workflow_id = ${ref.workflowId} and v.version = ${ref.version}`.execute(db);
+			const consent = rows[0];
+			if (!consent?.account || !consent.enabled_by) throw notConnected();
+			if (!await enablerMayUpdate(db, deps(), roles, consent.enabled_by, consent.tenant_id ?? void 0, ref.workflowId)) throw notConnected();
+			const account = await accounts.find(consent.enabled_by, consent.account);
+			if (!account || account.providerId !== connectionProviderId(use.plugin, use.name, use.declaration) || !holdsScopes(account.scopes, use.declaration)) throw notConnected();
+			const token = await tokenOf(consent.enabled_by, account.id, account.refreshToken);
+			if (!token) throw new ConnectionError("link_expired", `The account connected for ${key} no longer signs in: its owner connects it again`);
+			use.secret(token);
+			return token;
+		} };
+	};
+};
+//#endregion
+export { connectionTokens, sharedRefresh };

package/dist/workflows/connections/connection-triggers.js

@@ -0,0 +1,37 @@
+import { sql } from "kysely";
+//#region src/workflows/connections/connection-triggers.ts
+/**
+* The triggers of connected accounts, as sign-in tells of them: a link resumes the triggers waiting on that account's
+* sign-in, which poll again from the cursor they kept or renew the subscription they kept; a disconnect makes the
+* running ones wait for a new sign-in.
+*/
+const connectionTriggers = (db, schema, jobs) => {
+	const triggers = sql.id(schema, "triggers");
+	return {
+		linked: async (accountId) => {
+			await db().transaction().execute(async (trx) => {
+				const { rows } = await sql`update ${triggers} set status = 'active', consecutive_failures = 0, last_error = null, updated_at = now()
+          where connection_id = ${accountId} and status = 'needs_sign_in' returning id, generation`.execute(trx);
+				for (const row of rows) await jobs.start.enqueue(trx, {
+					trigger: row.id,
+					generation: row.generation
+				});
+			});
+		},
+		disconnected: async (accountId) => {
+			const error = JSON.stringify({
+				code: "link_expired",
+				message: "The connected account was disconnected: its owner connects it again",
+				at: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			await sql`update ${triggers} set status = 'needs_sign_in', last_error = ${error}::jsonb, poll_job_id = null, poll_attempt = null, next_poll_at = null, updated_at = now()
+        where connection_id = ${accountId} and status in ('active', 'failing')`.execute(db());
+		},
+		needsSignIn: async (accountIds) => {
+			const { rows } = await sql`select distinct connection_id from ${triggers} where status = 'needs_sign_in' and connection_id in (${sql.join(accountIds)})`.execute(db());
+			return rows.map((row) => row.connection_id);
+		}
+	};
+};
+//#endregion
+export { connectionTriggers };

package/dist/workflows/connections/connection-wiring.js

@@ -0,0 +1,73 @@
+import { connectionConsent } from "./connection-consent.js";
+import { enablerMayUpdate } from "./enabler-authority.js";
+import { enablerMailbox } from "./enabler-mailbox.js";
+import { connectionTokens } from "./connection-tokens.js";
+import { sql } from "kysely";
+import { ConnectionError } from "@protobase/workflows/plugin";
+//#region src/workflows/connections/connection-wiring.ts
+const noAccounts = {
+	find: async () => void 0,
+	accessToken: async () => void 0
+};
+/**
+* The connections of an app's workflows: the consent a save checks as a version is turned on, and the connection each
+* step and trigger that declares one gets, bound by the version its run or trigger runs.
+*/
+const connectionWiring = ({ deps, schema, roles, accounts = noAccounts, plugins, connectionOf, personalMailer }) => {
+	const declarationOf = (key) => {
+		const [plugin, name] = key.split(":");
+		return plugins.find((candidate) => candidate.name === plugin)?.connections?.[name];
+	};
+	const consent = connectionConsent({
+		accounts,
+		declarationOf,
+		connectionOf
+	});
+	const tokens = connectionTokens({
+		deps,
+		schema,
+		roles,
+		accounts
+	});
+	const use = (type, version, secret) => {
+		const key = connectionOf[type];
+		const declaration = key === void 0 ? void 0 : declarationOf(key);
+		if (!key || !declaration) return;
+		const [plugin, name] = key.split(":");
+		return tokens({
+			plugin,
+			name,
+			declaration,
+			version,
+			secret
+		});
+	};
+	const runVersion = async (runId) => {
+		const { rows } = await sql`select workflow_id, version from ${sql.id(schema, "runs")} where id = ${runId}`.execute(deps().db);
+		const run = rows[0];
+		return run?.version == null ? void 0 : {
+			workflowId: run.workflow_id,
+			version: run.version
+		};
+	};
+	const step = (stepId, name, task) => use(stepId, () => runVersion(task.runId), task.secret) ?? { accessToken: () => Promise.reject(new ConnectionError("not_connected", `${stepId} signs in through "${name}", which this app does not declare`)) };
+	const trigger = (row, secret) => use(row.type, async () => row.workflow_id === null ? void 0 : {
+		workflowId: row.workflow_id,
+		version: row.version
+	}, secret);
+	const runEnabler = async (runId) => {
+		const { rows } = await sql`select r.workflow_id, v.enabled_by, v.tenant_id from ${sql.id(schema, "runs")} r
+      join ${sql.id(schema, "versions")} v on v.workflow_id = r.workflow_id and v.version = r.version where r.id = ${runId}`.execute(deps().db);
+		const row = rows[0];
+		if (!row?.enabled_by) return null;
+		return await enablerMayUpdate(deps().db, deps(), roles, row.enabled_by, row.tenant_id ?? void 0, row.workflow_id) ? row.enabled_by : null;
+	};
+	return {
+		consent,
+		step,
+		trigger,
+		mailbox: personalMailer && ((task) => enablerMailbox(() => runEnabler(task.runId), personalMailer))
+	};
+};
+//#endregion
+export { connectionWiring };

package/dist/workflows/connections/enabler-authority.js

@@ -0,0 +1,35 @@
+import { requestAccess } from "../../request-access.js";
+import { deletedRows } from "../../params.js";
+import { fetchReadable } from "../../fetch-readable.js";
+import { mayUpdateWorkflow } from "../may-update-workflow.js";
+//#region src/workflows/connections/enabler-authority.ts
+/**
+* Whether the person who turned a workflow on may still do so: with the roles they hold now in its tenant, they may
+* read this one and update it, as its update row filter and record-level rule decide. Losing either, as when they were
+* demoted or left the organization, withdraws the connection their consent gave its runs.
+*/
+const enablerMayUpdate = async (db, deps, roles, enabledBy, tenant, workflowId) => {
+	const held = await roles({
+		id: enabledBy,
+		...tenant !== void 0 && { tenant }
+	});
+	if (held.length === 0) return false;
+	const entry = deps.registry.find("workflows");
+	const session = {
+		user: {
+			id: enabledBy,
+			roles: held
+		},
+		...tenant !== void 0 && {
+			tenant,
+			organization: { id: tenant }
+		}
+	};
+	const access = await requestAccess(deps, entry, session);
+	if (!access.resolved.operations.update) return false;
+	const found = await fetchReadable(db, access, [workflowId], deletedRows(access.full, false), {});
+	if (!found) return false;
+	return mayUpdateWorkflow(db, access, workflowId, found.record);
+};
+//#endregion
+export { enablerMayUpdate };

package/dist/workflows/connections/enabler-mailbox.js

@@ -0,0 +1,15 @@
+import { PersonalMailError } from "../../personal-mail/personal-mail-error.js";
+//#region src/workflows/connections/enabler-mailbox.ts
+/**
+* The step context's `mailbox`: each message goes out from the own mailbox of the person who turned the run's version
+* on, signed in as themselves, as `enablerOf` reads them afresh; nobody (a version an outside app turned on, a workflow
+* turned off, or someone who may no longer change it) sends nothing and fails `not_linked`. A job's own code gets no
+* such mailer: only this consent lets mail leave someone's mailbox without their own request.
+*/
+const enablerMailbox = (enablerOf, personalMailer) => ({ send: async (message) => {
+	const enabledBy = await enablerOf();
+	if (!enabledBy) throw new PersonalMailError("not_linked");
+	await personalMailer(enabledBy).send(message);
+} });
+//#endregion
+export { enablerMailbox };

package/dist/workflows/connections/single-flight.js

@@ -0,0 +1,17 @@
+//#region src/workflows/connections/single-flight.ts
+/**
+* Joins calls of one key that overlap: the second waits for the first's result instead of starting its own, such as a
+* second refresh of one account's token. An entry lives only while its call runs, so the map holds the calls in flight.
+*/
+const singleFlight = () => {
+	const running = /* @__PURE__ */ new Map();
+	return (key, call) => {
+		const joined = running.get(key);
+		if (joined) return joined;
+		const started = call().finally(() => running.delete(key));
+		running.set(key, started);
+		return started;
+	};
+};
+//#endregion
+export { singleFlight };

package/dist/workflows/hooks/issue-webhook.js

@@ -1,31 +1,14 @@
 import { badRequest, notFound } from "../../problem.js";
-import { tenantScope } from "../../tenant.js";
-import { recordDecision, requestAccess, targetFilter } from "../../request-access.js";
+import { requestAccess } from "../../request-access.js";
 import { deletedRows } from "../../params.js";
-import { fetchRecord } from "../../records.js";
 import { fetchReadable } from "../../fetch-readable.js";
 import { hookMode } from "./hook-secrets.js";
 import { hookPath } from "./hook-paths.js";
 import { saveHook } from "./hook-store.js";
+import { mayUpdateWorkflow } from "../may-update-workflow.js";
 //#region src/workflows/hooks/issue-webhook.ts
 const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const missing = () => notFound("No workflows with this key that you may change");
-const mayUpdate = async (trx, access, id, record) => {
-	const tenant = tenantScope(access.entry, access.session)?.tenantValue;
-	const key = [access.full.fields[access.full.primaryKey[0]]];
-	const filter = targetFilter(access, "update");
-	if (filter && !await fetchRecord(trx, access.entry, [id], tenant, {
-		filter,
-		fields: key
-	})) return false;
-	if (!access.resolved.recordChecks.includes("update")) return true;
-	const decision = await recordDecision(access, "update", record);
-	if (typeof decision === "boolean") return decision;
-	return Boolean(await fetchRecord(trx, access.entry, [id], tenant, {
-		filter: decision,
-		fields: key
-	}));
-};
 /**
 * Gives a workflow a new webhook URL and secret, as `POST .../workflows/<id>/webhook` and `new_webhook_url` do: only for
 * a caller who may change that workflow in their tenant, as its update access decides; 404 for anyone else, as for a
@@ -39,7 +22,7 @@ const issueWebhook = async ({ deps, schema, webhooks, origin }, session, id, req
 	if (!access.resolved.operations.update) throw missing();
 	return deps().db.transaction().execute(async (trx) => {
 		const found = await fetchReadable(trx, access, [id], deletedRows(access.full, false), { lock: true });
-		if (!found || !await mayUpdate(trx, access, id, found.record)) throw missing();
+		if (!found || !await mayUpdateWorkflow(trx, access, id, found.record)) throw missing();
 		const record = found.record;
 		const [type, input] = Object.entries(record.definition.trigger)[0];
 		const trigger = webhooks(type);

package/dist/workflows/may-update-workflow.js

@@ -0,0 +1,26 @@
+import { tenantScope } from "../tenant.js";
+import { recordDecision, targetFilter } from "../request-access.js";
+import { fetchRecord } from "../records.js";
+//#region src/workflows/may-update-workflow.ts
+/**
+* Whether the caller may change this workflow as the record update path decides it: the update row filter and the
+* record-level update rule, beside the read access `fetchReadable` checked.
+*/
+const mayUpdateWorkflow = async (trx, access, id, record) => {
+	const tenant = tenantScope(access.entry, access.session)?.tenantValue;
+	const key = [access.full.fields[access.full.primaryKey[0]]];
+	const filter = targetFilter(access, "update");
+	if (filter && !await fetchRecord(trx, access.entry, [id], tenant, {
+		filter,
+		fields: key
+	})) return false;
+	if (!access.resolved.recordChecks.includes("update")) return true;
+	const decision = await recordDecision(access, "update", record);
+	if (typeof decision === "boolean") return decision;
+	return Boolean(await fetchRecord(trx, access.entry, [id], tenant, {
+		filter: decision,
+		fields: key
+	}));
+};
+//#endregion
+export { mayUpdateWorkflow };

package/dist/workflows/mcp/webhook-tools.js

@@ -1,4 +1,4 @@
-import { notFound, preconditionFailed } from "../../problem.js";
+import { HttpProblem, notFound, preconditionFailed } from "../../problem.js";
 import { defineTool } from "../../assistant/tools.js";
 import { refused } from "../../assistant/record-tool-args.js";
 import { recordName, updateApproval } from "../../assistant/write-prompts.js";
@@ -15,10 +15,17 @@ const writes = {
 	destructiveHint: false,
 	openWorldHint: false
 };
+const enableRefused = (error) => {
+	if (error instanceof HttpProblem && error.slug === "own-sign-in-only") return JSON.stringify({
+		error: "own-sign-in-only",
+		message: "This workflow signs in through a connected account, so it was not turned on: the account's owner turns it on in the admin app, on the workflow's page, signed in as themselves. Saving it stays open to you."
+	});
+	return refused(error);
+};
 /** Turns a workflow's trigger on, on its current version, or off, once the user approves it. */
 const enableWorkflowTool = (input = {}) => defineTool({
 	name: "enable_workflow",
-	description: `Turns a workflow's trigger on (enabled: true) on version, which must be its current version as create_workflow, update_workflow or get_workflow gave it, or off (enabled: false), and returns JSON { id, enabled_version }. A workflow saved since that version is refused; read it again. While on, its trigger starts runs: a webhook trigger whose sender you give a URL once it is issued with new_webhook_url, one that registers its own URL with its service as soon as it did, a polling trigger at its next poll. A later save keeps it on, on the new version. The user approves it in their client first.${onlyNote(input)}`,
+	description: `Turns a workflow's trigger on (enabled: true) on version, which must be its current version as create_workflow, update_workflow or get_workflow gave it, or off (enabled: false), and returns JSON { id, enabled_version }. A workflow saved since that version is refused; read it again. While on, its trigger starts runs: a webhook trigger whose sender you give a URL once it is issued with new_webhook_url, one that registers its own URL with its service as soon as it did, a polling trigger at its next poll. A later save keeps it on, on the new version. A workflow that signs in through a connected account (its connections) is turned on only by that account's owner in the admin app: here it is refused with error own-sign-in-only. The user approves it in their client first.${onlyNote(input)}`,
 	parameters: {
 		type: "object",
 		properties: {
@@ -52,7 +59,7 @@ const enableWorkflowTool = (input = {}) => defineTool({
 		return context.records.update("workflows", id, data, args.enabled ? { etag: before.etag } : {}).then(({ record }) => JSON.stringify({
 			id: record.id,
 			enabled_version: record.enabled_version
-		}), refused);
+		}), enableRefused);
 	}
 });
 /** Issues a new webhook URL and secret for a workflow, once the user approves it. */

package/dist/workflows/save-hook.js

@@ -1,5 +1,6 @@
 import { badRequest } from "../problem.js";
 import { syncTrigger } from "./triggers/trigger-sync.js";
+import { saveConsent } from "./connections/connection-consent.js";
 import { sql } from "kysely";
 import { checkDefinition, problemText } from "@protobase/workflows";
 //#region src/workflows/save-hook.ts
@@ -11,7 +12,7 @@ import { checkDefinition, problemText } from "@protobase/workflows";
 * `definition` field's `errors` with the state and field in their `params`, for a form to show each on its step; the
 * write rolls back.
 */
-const workflowSaveHook = (schema, types, jobs) => async (event, trx) => {
+const workflowSaveHook = (schema, types, jobs, consent) => async (event, trx) => {
 	if (event.resource.name !== "workflows" || !event.after) return;
 	if (event.operation !== "create" && event.operation !== "update") return;
 	const changed = event.operation === "create" || event.after.version !== event.before?.version;
@@ -35,7 +36,11 @@ const workflowSaveHook = (schema, types, jobs) => async (event, trx) => {
 	}
 	if (changed) await sql`insert into ${sql.id(schema, "versions")} (workflow_id, version, definition, saved_by, tenant_id)
       select w.id, w.version, w.definition, ${String(event.user.id)}, w.tenant_id from ${sql.id(schema, "workflows")} w where w.id = ${String(event.after.id)}`.execute(trx);
-	await syncTrigger(trx, schema, jobs, event.after);
+	const id = String(event.after.id);
+	const enabled = event.after.enabled_version;
+	const enabledBy = enabled === null ? null : await consent(event.session, event.after.definition);
+	await saveConsent(trx, schema, id, enabled, enabledBy);
+	await syncTrigger(trx, schema, jobs, event.after, types.connections);
 };
 //#endregion
 export { workflowSaveHook };

package/dist/workflows/schema-sql.js

@@ -1,6 +1,6 @@
 import { quoteIdent } from "../changes/capture-sql.js";
 /** The comment the schema's function carries, which the startup check reads. */
-const workflowsComment = `Protobase workflows 7`;
+const workflowsComment = `Protobase workflows 8`;
 const commentVersion = (comment) => {
 	const match = comment?.match(/^Protobase workflows (\d+)$/);
 	return match ? Number(match[1]) : void 0;
@@ -96,6 +96,8 @@ do $$ begin
     alter table ${s}."workflows" add constraint "workflows_enabled_version" foreign key ("id", "enabled_version") references ${s}."versions" ("workflow_id", "version") deferrable initially deferred;
   end if;
 end $$;
+-- Who turned the version on, signed in as themselves: the consent its runs sign in through their connections with.
+alter table ${s}."versions" add column if not exists "enabled_by" text;
 create table if not exists ${s}."triggers" (
   "id" uuid primary key default gen_random_uuid(),
   "workflow_id" uuid references ${s}."workflows" ("id") on delete set null,

package/dist/workflows/schema.js

@@ -16,7 +16,7 @@ const readWorkflowsSchema = async (db, schema) => {
 	const row = rows[0];
 	return {
 		tables: row.found,
-		current: row.found && row.trigger_rows && commentVersion(row.comment) === 7 && row.triggers === workflowsTriggers.length
+		current: row.found && row.trigger_rows && commentVersion(row.comment) === 8 && row.triggers === workflowsTriggers.length
 	};
 };
 /**

package/dist/workflows/triggers/plugin-call.js

@@ -11,6 +11,10 @@ const messageLength = 1e3;
 const callPlugin = (work, redact) => Promise.resolve().then(work).then((value) => ({ value }), (error) => {
 	const message = redact(error instanceof Error ? error.message : String(error)).slice(0, messageLength);
 	if (error instanceof ConnectionError && error.code === "link_expired") return { expired: message };
+	if (error instanceof ConnectionError && error.code === "not_connected") return {
+		failed: message,
+		unconnected: true
+	};
 	return { failed: message };
 });
 /**
@@ -22,14 +26,20 @@ const redactAlso = (values, redact) => {
 	return (text) => redact(blanked.reduce((kept, value) => kept.replaceAll(value, "[redacted]"), text));
 };
 /**
-* What a trigger's hooks get: its input, the guarded `fetch`, and the job's signal, which aborts at its timeout. No
-* type that needs a connection runs yet, so it has none.
+* What one call of a trigger's hook gets: its input, its connection, the guarded `fetch`, and the job's signal, which
+* aborts at its timeout; and `redact` for its outcome, which also blanks out each token its connection gave this call.
 */
-const triggerContext = ({ allowPrivateAddresses }, input, signal) => ({
-	input,
-	connection: void 0,
-	fetch: pluginFetch({ allowPrivateAddresses }),
-	signal
-});
+const triggerCall = ({ allowPrivateAddresses, connect }, trigger, signal, redact) => {
+	const issued = [];
+	return {
+		context: {
+			input: trigger.input,
+			connection: connect?.(trigger, (token) => void issued.push(token)),
+			fetch: pluginFetch({ allowPrivateAddresses }),
+			signal
+		},
+		redact: (text) => redactAlso(issued, redact)(text)
+	};
+};
 //#endregion
-export { callPlugin, redactAlso, triggerContext };
+export { callPlugin, redactAlso, triggerCall };

package/dist/workflows/triggers/poll-job.js

@@ -1,5 +1,5 @@
 import { defineJob } from "../../jobs/define-job.js";
-import { callPlugin, triggerContext } from "./plugin-call.js";
+import { callPlugin, triggerCall } from "./plugin-call.js";
 import { pollProblem, stateProblem } from "./poll-result.js";
 import { queueRuns } from "../start-workflow.js";
 import { backoffPollAt, nextPollAt, pollEvery } from "./poll-schedule.js";
@@ -46,14 +46,14 @@ const pollJobs = (input) => {
 			if (!("value" in interval)) return failed(db, poll, claim, "expired" in interval ? interval.expired : interval.failed, backoffPollAt("1 minute", claimed.consecutive_failures + 1, /* @__PURE__ */ new Date()));
 			const every = interval.value;
 			const limit = pollLimit(type);
-			const context = triggerContext(input, claimed.input, signal);
+			const call = triggerCall(input, claimed, signal, redact);
 			const outcome = await callPlugin(() => type.poll({
-				...context,
+				...call.context,
 				cursor: claimed.cursor,
 				store: claimed.store,
 				limit,
 				due: new Date(due)
-			}), redact);
+			}), call.redact);
 			const now = /* @__PURE__ */ new Date();
 			if ("expired" in outcome) return saveNeedsSignIn(db, schema, claim, claimed, outcome.expired);
 			const backoff = backoffPollAt(every, claimed.consecutive_failures + 1, now);
@@ -90,11 +90,11 @@ const pollJobs = (input) => {
 			const type = claimed && input.webhooks(claimed.type);
 			if (!claimed || !type?.renew) return;
 			const renewal = type.renew;
-			const context = triggerContext(input, claimed.input, signal);
+			const call = triggerCall(input, claimed, signal, redact);
 			const outcome = await callPlugin(() => renewal({
-				...context,
+				...call.context,
 				state: claimed.store
-			}), redact);
+			}), call.redact);
 			const now = /* @__PURE__ */ new Date();
 			if ("expired" in outcome) return saveNeedsSignIn(db, schema, claim, claimed, outcome.expired);
 			const backoff = backoffPollAt("1 minute", claimed.consecutive_failures + 1, now);

package/dist/workflows/triggers/trigger-jobs.js

@@ -1,5 +1,5 @@
 import { defineJob } from "../../jobs/define-job.js";
-import { callPlugin, triggerContext } from "./plugin-call.js";
+import { callPlugin, triggerCall } from "./plugin-call.js";
 import { readyAt, readyWhen, resolveTimeTerms } from "../ready/ready-when.js";
 import { activeTriggers, currentTrigger, triggerFailed } from "./trigger-row.js";
 import { orRefusal, readyContext, startIfReady } from "../ready/ready-start.js";
@@ -85,24 +85,40 @@ const triggerJobs = (input) => {
 			});
 		}
 	});
+	/**
+	* Ends a stopped webhook trigger's subscription at its provider: whether nothing is left there, so the trigger can go.
+	* Any error is tried again, as the job's, until the provider ends it. A sign-in the unsubscribe can no longer use, as
+	* once the workflow was turned off and so its connection with it, or once the provider refused it, cannot end it:
+	* the trigger then stays `stopping` with that error, as the record of a subscription the provider may still hold.
+	*/
 	const unsubscribe = async (db, trigger, signal) => {
-		const { rows } = await sql`select type, input, store, store is not null as subscribed
+		const { rows } = await sql`select type, input, workflow_id, version, store, store is not null as subscribed
       from ${sql.id(schema, "triggers")} where id = ${trigger} and status = 'stopping'`.execute(db);
 		const row = rows[0];
 		const type = row?.subscribed ? input.webhooks(row.type) : void 0;
-		if (!row || !type?.unsubscribe) return;
+		if (!row || !type?.unsubscribe) return true;
 		const end = type.unsubscribe;
+		const call = triggerCall(input, row, signal, input.redact);
 		const outcome = await callPlugin(() => end({
-			...triggerContext(input, row.input, signal),
+			...call.context,
 			state: row.store
-		}), input.redact);
-		if ("failed" in outcome) throw new Error(`The trigger's unsubscribe failed: ${outcome.failed}`);
+		}), call.redact);
+		if ("value" in outcome) return true;
+		if ("failed" in outcome && !outcome.unconnected) throw new Error(`The trigger's unsubscribe failed: ${outcome.failed}`);
+		const reason = "expired" in outcome ? outcome.expired : outcome.failed;
+		const error = JSON.stringify({
+			code: "expired" in outcome ? "link_expired" : "not_connected",
+			message: `The subscription could not be ended at the provider: ${reason}`,
+			at: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		await sql`update ${sql.id(schema, "triggers")} set last_error = ${error}::jsonb, updated_at = now() where id = ${trigger} and status = 'stopping'`.execute(db);
+		return false;
 	};
 	const stop = defineJob({
 		name: "workflows.trigger-stop",
 		timeout: "5 minutes",
 		run: async ({ trigger }, { db, signal }) => {
-			await unsubscribe(db, trigger, signal);
+			if (!await unsubscribe(db, trigger, signal)) return;
 			await sql`delete from ${sql.id(schema, "triggers")} where id = ${trigger} and status = 'stopping'`.execute(db);
 		}
 	});