@protobase/server 0.69.1 → 0.69.3

package/dist/better-auth/auth-settings.d.ts

@@ -1,5 +1,6 @@
 import { UserColumn } from "./user-table.js";
 import { Mailer } from "../mail/mail-message.js";
+import { Session } from "../types.js";
 import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
 import { Person } from "./organizations/people-endpoint.js";
@@ -3327,6 +3328,10 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
             scopes: string[];
             created_at: Date;
             needs_sign_in: boolean;
+            used_by: {
+              id: string;
+              name: string;
+            }[];
           }[];
         }[];
       }>;
@@ -9157,6 +9162,23 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
     events: {
       set: (next: ConnectionListener) => undefined;
     };
+    list: (session: Session) => Promise<{
+      key: string;
+      label: string;
+      provider: string;
+      scopes: string[];
+      link_params: Record<string, string>;
+      accounts: {
+        id: string;
+        scopes: string[];
+        created_at: Date;
+        needs_sign_in: boolean;
+        used_by: {
+          id: string;
+          name: string;
+        }[];
+      }[];
+    }[]>;
   };
   mcp: {
     resource: string;

package/dist/better-auth/connections/connection-events.d.ts

@@ -7,5 +7,12 @@ export type ConnectionListener = {
   disconnected: (accountId: string) => Promise<void>;
   /** The accounts among `accountIds` that a trigger waits on to be signed in again. */
   needsSignIn: (accountIds: string[]) => Promise<string[]>;
+  /** The workflows among those `userId` turned on, and may still change, whose enabled version binds one of `accountIds`, by account. */
+  uses: (userId: string, accountIds: string[]) => Promise<AccountUses>;
 };
+/** The workflows that use each account, by its id. */
+export type AccountUses = Record<string, {
+  id: string;
+  name: string;
+}[]>;
 //#endregion

package/dist/better-auth/connections/connection-events.js

@@ -9,7 +9,8 @@ const connectionEvents = () => {
 		set: (next) => void (listener = next),
 		linked: async (accountId) => listener?.linked(accountId),
 		disconnected: async (accountId) => listener?.disconnected(accountId),
-		needsSignIn: async (accountIds) => listener && accountIds.length > 0 ? listener.needsSignIn(accountIds) : []
+		needsSignIn: async (accountIds) => listener && accountIds.length > 0 ? listener.needsSignIn(accountIds) : [],
+		uses: async (userId, accountIds) => listener && accountIds.length > 0 ? listener.uses(userId, accountIds) : {}
 	};
 };
 //#endregion

package/dist/better-auth/connections/connections-plugin.js

@@ -1,5 +1,4 @@
-import { storedScopes } from "../../personal-mail/linked-accounts.js";
-import { holdsScopes } from "../../workflows/connections/connection-provider.js";
+import { listConnections } from "./list-connections.js";
 import { revokeToken } from "./revoke-token.js";
 import * as z$1 from "zod";
 import { decryptOAuthToken } from "better-auth/oauth2";
@@ -15,7 +14,8 @@ const notFound = () => new APIError("NOT_FOUND", {
 });
 /**
 * The signed-in person's connections: `GET /connections` lists each connection the app's workflow plugins declare with
-* the person's accounts that fit it, and whether a trigger waits for one to be signed in again, never a token.
+* the person's accounts that fit it, whether a trigger waits for one to be signed in again and the workflows that use
+* it, never a token (see `listConnections`).
 * `POST /connections/disconnect` revokes an account's token at its provider, then deletes it whatever the provider
 * answered, and stops the triggers on it; their own account only, and never the last account they sign in with. Connecting is
 * Better Auth's `/link-social`; a sign-in (not a link) through a provider only connections use is refused.
@@ -29,22 +29,12 @@ const connectionsPlugin = ({ connections, events, allowPrivateAddresses }) => {
 				method: "GET",
 				use: [sessionMiddleware]
 			}, async (ctx) => {
-				const accounts = await ctx.context.internalAdapter.findAccounts(ctx.context.session.user.id);
-				const fitting = (connection) => accounts.filter((account) => account.providerId === connection.providerId && holdsScopes(storedScopes(account.scope), connection.declaration));
-				const waiting = new Set(await events.needsSignIn(connections.flatMap((connection) => fitting(connection).map((account) => account.id))));
-				return ctx.json({ connections: connections.map((connection) => ({
-					key: connection.key,
-					label: connection.declaration.label,
-					provider: connection.providerId,
-					scopes: connection.declaration.scopes ?? [],
-					link_params: connection.declaration.link_params ?? {},
-					accounts: fitting(connection).map((account) => ({
-						id: account.id,
-						scopes: storedScopes(account.scope),
-						created_at: account.createdAt,
-						needs_sign_in: waiting.has(account.id)
-					}))
-				})) });
+				const adapter = ctx.context.internalAdapter;
+				return ctx.json({ connections: await listConnections({
+					findAccounts: (userId) => adapter.findAccounts(userId),
+					connections,
+					events
+				}, ctx.context.session.user.id) });
 			}),
 			disconnectConnection: createAuthEndpoint(connectionPaths.disconnect, {
 				method: "POST",

package/dist/better-auth/connections/list-connections.js

@@ -0,0 +1,34 @@
+import { storedScopes } from "../../personal-mail/linked-accounts.js";
+import { holdsScopes } from "../../workflows/connections/connection-provider.js";
+//#region src/better-auth/connections/list-connections.ts
+/**
+* A person's connections: each connection the app's workflow plugins declare with the person's accounts that fit it,
+* whether a trigger waits for one to be signed in again, and the workflows that use it. Each account's fields are picked
+* one by one, so no token leaves. `user` is the signed-in person's own id, from their session; reading without one fails,
+* since the store would read every person's accounts.
+*/
+const listConnections = async ({ findAccounts, connections, events }, user) => {
+	if (user === "" || user === void 0 || user === null) throw new Error("Connections are listed for a signed-in person's id");
+	const userId = String(user);
+	const accounts = await findAccounts(userId);
+	const fitting = (connection) => accounts.filter((account) => account.providerId === connection.providerId && holdsScopes(storedScopes(account.scope), connection.declaration));
+	const ids = connections.flatMap((connection) => fitting(connection).map((account) => account.id));
+	const waiting = new Set(await events.needsSignIn(ids));
+	const uses = await events.uses(userId, ids);
+	return connections.map((connection) => ({
+		key: connection.key,
+		label: connection.declaration.label,
+		provider: connection.providerId,
+		scopes: connection.declaration.scopes ?? [],
+		link_params: connection.declaration.link_params ?? {},
+		accounts: fitting(connection).map((account) => ({
+			id: account.id,
+			scopes: storedScopes(account.scope),
+			created_at: account.createdAt,
+			needs_sign_in: waiting.has(account.id),
+			used_by: uses[account.id] ?? []
+		}))
+	}));
+};
+//#endregion
+export { listConnections };

package/dist/better-auth/create-auth.d.ts

@@ -1,5 +1,6 @@
 import { UserColumn, UserTableOptions } from "./user-table.js";
 import { Mailer } from "../mail/mail-message.js";
+import { Session } from "../types.js";
 import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
 import { Person } from "./organizations/people-endpoint.js";
@@ -3215,7 +3216,11 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image? /**
+               * Refuses a new password that appears in a known data breach, by Have I Been Pwned's password list: at sign-up, from
+               * an invitation, and when a password is set, changed, reset or given by an admin. Only the first five characters of
+               * the password's SHA-1 hash leave the server. While the list cannot be reached, setting a password fails. Default off.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -3472,6 +3477,10 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
             scopes: string[];
             created_at: Date;
             needs_sign_in: boolean;
+            used_by: {
+              id: string;
+              name: string;
+            }[];
           }[];
         }[];
       }>;
@@ -9339,12 +9348,32 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
     signInProviders: string[];
     clients: string[];
   };
-  /** The workflow connections people connect accounts through, and the listener (`set`) the workflows give for their links and disconnects. */
+  /**
+   * The workflow connections people connect accounts through, the listener (`set`) the workflows give for their links
+   * and disconnects, and `list`, on the server only, of the session's own person's accounts, as `GET /connections` lists them.
+   */
   connections: {
     declared: ResolvedConnection[];
     events: {
       set: (next: ConnectionListener) => undefined;
     };
+    list: (session: Session) => Promise<{
+      key: string;
+      label: string;
+      provider: string;
+      scopes: string[];
+      link_params: Record<string, string>;
+      accounts: {
+        id: string;
+        scopes: string[];
+        created_at: Date;
+        needs_sign_in: boolean;
+        used_by: {
+          id: string;
+          name: string;
+        }[];
+      }[];
+    }[]>;
   };
   /** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */
   mcp: {

package/dist/better-auth/create-auth.js

@@ -12,6 +12,7 @@ import { personalMailer } from "../personal-mail/personal-mailer.js";
 import { mailLinkHooks } from "../personal-mail/mail-link-hooks.js";
 import { bothAccountHooks, connectionAccountHooks } from "./connections/connection-account-hooks.js";
 import { connectionEvents } from "./connections/connection-events.js";
+import { listConnections } from "./connections/list-connections.js";
 import { connectionProvidersPlugin } from "./connections/connection-oauth-provider.js";
 import { connectionsPlugin } from "./connections/connections-plugin.js";
 import { resolveConnections } from "./connections/declared-connections.js";
@@ -552,10 +553,18 @@ const createAuth = (options, plugins = {}) => {
 			signInProviders: socialProviders,
 			clients: connectionClients
 		},
-		/** The workflow connections people connect accounts through, and the listener (`set`) the workflows give for their links and disconnects. */
+		/**
+		* The workflow connections people connect accounts through, the listener (`set`) the workflows give for their links
+		* and disconnects, and `list`, on the server only, of the session's own person's accounts, as `GET /connections` lists them.
+		*/
 		connections: {
 			declared: resolvedConnections,
-			events: { set: events.set }
+			events: { set: events.set },
+			list: async (session) => listConnections({
+				findAccounts: async (userId) => (await auth.$context).internalAdapter.findAccounts(userId),
+				connections: resolvedConnections,
+				events
+			}, session.user.id)
 		},
 		/** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */
 		mcp: mcp && {

package/dist/create-admin.js

@@ -391,6 +391,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 			commented,
 			...engine && { workflows: {
 				...engine.types,
+				listConnections: auth.connections.list,
 				issueWebhook: (session, id, secret) => issueWebhook(engine.issue, session, id, {
 					...secret !== void 0 && { secret },
 					origin: new URL(auth.mcp.resource).origin

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.69.1";
+var version = "0.69.3";
 //#endregion
 export { version };

package/dist/workflows/connections/connection-tokens.js

@@ -27,8 +27,7 @@ const sharedRefresh = (accounts) => {
 * `not_connected`, with one message that tells nothing of whether the account exists; a refresh the provider refuses
 * is `link_expired`. The token is blanked out of all the step records (`secret`).
 */
-const connectionTokens = ({ deps, schema, roles, accounts }) => {
-	const tokenOf = sharedRefresh(accounts);
+const connectionTokens = ({ deps, schema, roles, accounts, refresh: tokenOf }) => {
 	return (use) => {
 		const key = `${use.plugin}:${use.name}`;
 		const notConnected = () => new ConnectionError("not_connected", `This workflow has no connection it may use for ${key}: its owner connects an account and turns the workflow on`);

package/dist/workflows/connections/connection-uses.js

@@ -0,0 +1,28 @@
+import { enablerMayUpdate } from "./enabler-authority.js";
+import { sql } from "kysely";
+//#region src/workflows/connections/connection-uses.ts
+/**
+* The workflows that use a person's accounts: those whose enabled version they turned on and binds one of the
+* accounts in its `connections`, kept only while they may still update the workflow, as a step's token needs.
+*/
+const connectionUses = ({ deps, schema, roles }) => async (userId, accountIds) => {
+	const uses = {};
+	if (accountIds.length === 0) return uses;
+	const db = deps().db;
+	const { rows } = await sql`select w.id, w.name, v.tenant_id, c.value as account
+    from ${sql.id(schema, "workflows")} w
+    join ${sql.id(schema, "versions")} v on v.workflow_id = w.id and v.version = w.enabled_version
+    cross join lateral jsonb_each_text(coalesce(v.definition -> 'connections', '{}'::jsonb)) c
+    where v.enabled_by = ${userId} and c.value in (${sql.join(accountIds)})
+    order by w.name, w.id`.execute(db);
+	for (const row of rows) {
+		if (!await enablerMayUpdate(db, deps(), roles, userId, row.tenant_id ?? void 0, row.id)) continue;
+		uses[row.account] = [...uses[row.account] ?? [], {
+			id: row.id,
+			name: row.name
+		}];
+	}
+	return uses;
+};
+//#endregion
+export { connectionUses };

package/dist/workflows/connections/connection-wiring.js

@@ -1,7 +1,8 @@
 import { connectionConsent } from "./connection-consent.js";
 import { enablerMayUpdate } from "./enabler-authority.js";
 import { enablerMailbox } from "./enabler-mailbox.js";
-import { connectionTokens } from "./connection-tokens.js";
+import { connectionTokens, sharedRefresh } from "./connection-tokens.js";
+import { stopConnection } from "./stop-connection.js";
 import { sql } from "kysely";
 import { ConnectionError } from "@protobase/workflows/plugin";
 //#region src/workflows/connections/connection-wiring.ts
@@ -10,8 +11,10 @@ const noAccounts = {
 	accessToken: async () => void 0
 };
 /**
-* The connections of an app's workflows: the consent a save checks as a version is turned on, and the connection each
-* step and trigger that declares one gets, bound by the version its run or trigger runs.
+* The connections of an app's workflows: the consent a save checks as a version is turned on, the connection each
+* step and trigger that declares one gets, bound by the version its run or trigger runs, and the one a stopped trigger's
+* unsubscribe gets (`stopping`), bound by the account and person its row recorded, which only the trigger stop job takes.
+* One refresh of an account is shared by them all.
 */
 const connectionWiring = ({ deps, schema, roles, accounts = noAccounts, plugins, connectionOf, personalMailer }) => {
 	const declarationOf = (key) => {
@@ -23,21 +26,33 @@ const connectionWiring = ({ deps, schema, roles, accounts = noAccounts, plugins,
 		declarationOf,
 		connectionOf
 	});
+	const refresh = sharedRefresh(accounts);
 	const tokens = connectionTokens({
 		deps,
 		schema,
 		roles,
-		accounts
+		accounts,
+		refresh
 	});
-	const use = (type, version, secret) => {
+	const stopTokens = stopConnection({
+		accounts,
+		refresh
+	});
+	const connectionFor = (type) => {
 		const key = connectionOf[type];
 		const declaration = key === void 0 ? void 0 : declarationOf(key);
 		if (!key || !declaration) return;
 		const [plugin, name] = key.split(":");
-		return tokens({
+		return {
 			plugin,
 			name,
-			declaration,
+			declaration
+		};
+	};
+	const use = (type, version, secret) => {
+		const connection = connectionFor(type);
+		return connection && tokens({
+			...connection,
 			version,
 			secret
 		});
@@ -55,6 +70,15 @@ const connectionWiring = ({ deps, schema, roles, accounts = noAccounts, plugins,
 		workflowId: row.workflow_id,
 		version: row.version
 	}, secret);
+	const stopping = (row, secret) => {
+		const connection = connectionFor(row.type);
+		return connection && stopTokens({
+			...connection,
+			accountId: row.connection_id,
+			userId: row.enabled_by,
+			secret
+		});
+	};
 	const runEnabler = async (runId) => {
 		const { rows } = await sql`select r.workflow_id, v.enabled_by, v.tenant_id from ${sql.id(schema, "runs")} r
       join ${sql.id(schema, "versions")} v on v.workflow_id = r.workflow_id and v.version = r.version where r.id = ${runId}`.execute(deps().db);
@@ -66,6 +90,7 @@ const connectionWiring = ({ deps, schema, roles, accounts = noAccounts, plugins,
 		consent,
 		step,
 		trigger,
+		stopping,
 		mailbox: personalMailer && ((task) => enablerMailbox(() => runEnabler(task.runId), personalMailer))
 	};
 };

package/dist/workflows/connections/stop-connection.js

@@ -0,0 +1,25 @@
+import { connectionProviderId, holdsScopes } from "./connection-provider.js";
+import { ConnectionError } from "@protobase/workflows/plugin";
+//#region src/workflows/connections/stop-connection.ts
+/**
+* The connection a stopped trigger's unsubscribe signs in with, once its workflow's consent was withdrawn: only the
+* account its row recorded, while that account still belongs to the person its row recorded as having turned it on,
+* of the connection's provider and with its scopes. A row that recorded neither, as one from before they were kept,
+* gets nothing. A refresh the provider refuses is `not_connected` too: the subscription stays, recorded, until its
+* owner ends it. Each `accessToken()` checks afresh, caching nothing; only the trigger stop job holds one.
+*/
+const stopConnection = ({ accounts, refresh }) => (use) => {
+	const key = `${use.plugin}:${use.name}`;
+	const notConnected = () => new ConnectionError("not_connected", `This trigger has no connection it may end its subscription with for ${key}: the account it was made with is no longer connected`);
+	return { accessToken: async () => {
+		if (!use.accountId || !use.userId) throw notConnected();
+		const account = await accounts.find(use.userId, use.accountId);
+		if (!account || account.providerId !== connectionProviderId(use.plugin, use.name, use.declaration) || !holdsScopes(account.scopes, use.declaration)) throw notConnected();
+		const token = await refresh(use.userId, account.id, account.refreshToken);
+		if (!token) throw new ConnectionError("not_connected", `The account connected for ${key} no longer signs in, so this trigger cannot end its subscription with it`);
+		use.secret(token);
+		return token;
+	} };
+};
+//#endregion
+export { stopConnection };

package/dist/workflows/mcp/connection-tools.d.ts

@@ -0,0 +1,15 @@
+import { Session } from "../../types.js";
+import "../../index.js";
+//#region src/workflows/mcp/connection-tools.d.ts
+type Connection = {
+  key: string;
+  label: string;
+  accounts: {
+    id: string;
+    scopes: string[];
+    needs_sign_in: boolean;
+  }[];
+};
+/** The session's own person's connections, each with their accounts that fit it, such as `auth.connections.list`. */
+export type ListConnections = (session: Session) => Promise<Connection[]>;
+//#endregion

package/dist/workflows/mcp/connection-tools.js

@@ -0,0 +1,32 @@
+import { defineTool } from "../../assistant/tools.js";
+//#region src/workflows/mcp/connection-tools.ts
+/**
+* The caller's own accounts, by connection, which a definition's `connections` binds by id. Each field is picked one by
+* one, so nothing more than the list reads leaves, and never a token; it takes no argument, so it lists no one else's.
+*/
+const listConnectionsTool = (list) => defineTool({
+	name: "list_connections",
+	description: "Lists the connections the app's workflow plugins declare with your own connected accounts, as JSON ({ connections }), each with its key, label and accounts, each account with its id, scopes and needs_sign_in. A workflow binds an account in its definition's connections, as { \"<key>\": \"<account id>\" }; an account is connected, or connected again when it needs a sign-in, on the account page.",
+	parameters: {
+		type: "object",
+		properties: {}
+	},
+	annotations: {
+		readOnlyHint: true,
+		openWorldHint: false
+	},
+	run: async (_args, context) => {
+		const connections = list ? await list(context.session) : [];
+		return JSON.stringify({ connections: connections.map(({ key, label, accounts }) => ({
+			key,
+			label,
+			accounts: accounts.map(({ id, scopes, needs_sign_in }) => ({
+				id,
+				scopes,
+				needs_sign_in
+			}))
+		})) });
+	}
+});
+//#endregion
+export { listConnectionsTool };

package/dist/workflows/mcp/workflow-instructions.js

@@ -4,7 +4,7 @@ import { limits } from "@protobase/workflows";
 * profile of the States Language with JSONata, and how the workflow tools find, make, change and test-run them.
 */
 const workflowInstructions = [
-	"Workflows: list_workflow_types names the step types and triggers with their arguments and inputs; list_workflows and get_workflow read workflows; validate_workflow checks a definition without saving it; create_workflow and update_workflow save one; run_workflow starts a run with an input, and get_workflow_run reads it with each step's input, output, logs and error. A run goes on in the background: read it again until its status is succeeded or failed, then fix the step that failed with update_workflow and run it again. A trigger starts runs only once enable_workflow turned the workflow on. A webhook trigger whose sender you give a URL, such as app:webhook, gets its URL and secret from new_webhook_url, shown once; one that registers its own URL with its service as the workflow is turned on needs none, and new_webhook_url refuses it.",
+	"Workflows: list_workflow_types names the step types and triggers with their arguments and inputs; list_workflows and get_workflow read workflows; validate_workflow checks a definition without saving it; create_workflow and update_workflow save one; run_workflow starts a run with an input, and get_workflow_run reads it with each step's input, output, logs and error. A run goes on in the background: read it again until its status is succeeded or failed, then fix the step that failed with update_workflow and run it again. A trigger starts runs only once enable_workflow turned the workflow on. A webhook trigger whose sender you give a URL, such as app:webhook, gets its URL and secret from new_webhook_url, shown once; one that registers its own URL with its service as the workflow is turned on needs none, and new_webhook_url refuses it. A step or trigger that signs in through a connection uses the account the definition's \"connections\" binds, { \"<connection key>\": \"<account id>\" }: list_connections gives your accounts.",
 	"A definition is one JSON document: { \"trigger\": <trigger>, \"stateMachine\": { \"QueryLanguage\": \"JSONata\", \"StartAt\": \"<state>\", \"States\": { \"<state>\": <state>, ... } } }, the States Language with JSONata expressions, in a profile where every value is read by name. It holds no layout. <trigger> is an object with one key: { \"<trigger id>\": <its input> } for a trigger list_workflow_types names, or { \"manual\": {} } for a workflow that runs only when someone starts it.",
 	"States: Task { Resource: <step type>, Arguments, TimeoutSeconds, Retry, Catch }; Pass { Output, Assign }; Choice { Choices: [{ Condition, Next, Output?, Assign? }], Default }; Map { Items, ItemProcessor: { StartAt, States }, MaxConcurrency }; Wait { Seconds | Timestamp }; Succeed { Output }; Fail { Error, Cause }. Every state may have Comment, Output and Assign. Task, Pass, Map and Wait have exactly one of Next (a state name) and End: true. State names are unique across the document, Maps included, and every state must be reachable from StartAt. InputPath, Parameters, ResultPath and the other JSONPath fields, and Parallel, are not part of the profile.",
 	"Expressions: a string that is whole \"{% ... %}\" is a JSONata expression whose value, of any type, the field takes; any other string is literal text. Build text inside one expression with &: \"{% 'Order ' & $order.id %}\". Expressions sit at any depth in Arguments, Output and Assign, and in Items, Condition, Seconds, Timestamp, Error and Cause.",

package/dist/workflows/mcp/workflow-read-tools.d.ts

@@ -1,5 +1,6 @@
 import { AssistantTool, ToolContext } from "../../assistant/tools.js";
 import { IssueWebhook } from "./webhook-tools.js";
+import { ListConnections } from "./connection-tools.js";
 import "../../index.js";
 import { ResourceModel } from "@protobase/schema";
 import { CheckOptions, TypeEntry } from "@protobase/workflows";
@@ -13,7 +14,9 @@ export type WorkflowCatalog = {
   checkWith: (models: (name: string) => ResourceModel | undefined) => CheckOptions;
   /** Issues a workflow's webhook URL as the caller, for `new_webhook_url`. */
   issueWebhook?: IssueWebhook;
+  /** The caller's own connected accounts, for `list_connections`; none without it. */
+  listConnections?: ListConnections;
 };
-/** The tools that read workflows, their types and runs, and check definitions. */
+/** The tools that read workflows, their types and runs and the caller's connections, and check definitions. */
 export declare const workflowReadTools: (catalog: WorkflowCatalog) => AssistantTool<ToolContext>[];
 //#endregion

package/dist/workflows/mcp/workflow-read-tools.js

@@ -1,5 +1,6 @@
 import { defineTool } from "../../assistant/tools.js";
 import { refused } from "../../assistant/record-tool-args.js";
+import { listConnectionsTool } from "./connection-tools.js";
 import { mergePatch } from "./merge-patch.js";
 import { definitionParameter, editParameter, idOf, idParameter, objectOf, pageSizeOf, textOf } from "./workflow-tool-args.js";
 import { checkDefinition, typeCatalog } from "@protobase/workflows";
@@ -194,13 +195,14 @@ const getWorkflowRunTool = defineTool({
 		}), refused);
 	}
 });
-/** The tools that read workflows, their types and runs, and check definitions. */
+/** The tools that read workflows, their types and runs and the caller's connections, and check definitions. */
 const workflowReadTools = (catalog) => [
 	listWorkflowTypesTool(catalog),
 	listWorkflowsTool,
 	getWorkflowTool,
 	validateWorkflowTool(catalog),
-	getWorkflowRunTool
+	getWorkflowRunTool,
+	listConnectionsTool(catalog.listConnections)
 ];
 //#endregion
 export { getWorkflowRunTool, getWorkflowTool, listWorkflowsTool, workflowReadTools };

package/dist/workflows/save-hook.js

@@ -40,7 +40,7 @@ const workflowSaveHook = (schema, types, jobs, consent) => async (event, trx) =>
 	const enabled = event.after.enabled_version;
 	const enabledBy = enabled === null ? null : await consent(event.session, event.after.definition);
 	await saveConsent(trx, schema, id, enabled, enabledBy);
-	await syncTrigger(trx, schema, jobs, event.after, types.connections);
+	await syncTrigger(trx, schema, jobs, event.after, enabledBy, types.connections);
 };
 //#endregion
 export { workflowSaveHook };

package/dist/workflows/schema-sql.js

@@ -1,6 +1,6 @@
 import { quoteIdent } from "../changes/capture-sql.js";
 /** The comment the schema's function carries, which the startup check reads. */
-const workflowsComment = `Protobase workflows 8`;
+const workflowsComment = `Protobase workflows 9`;
 const commentVersion = (comment) => {
 	const match = comment?.match(/^Protobase workflows (\d+)$/);
 	return match ? Number(match[1]) : void 0;
@@ -119,6 +119,8 @@ create table if not exists ${s}."triggers" (
   "updated_at" timestamptz not null default now()
 );
 alter table ${s}."triggers" add column if not exists "poll_attempt" integer;
+-- Who turned the trigger's version on: the only person whose account its stop job ends the subscription through.
+alter table ${s}."triggers" add column if not exists "enabled_by" text;
 -- A deleted workflow's trigger stays, without its workflow, until its stop job unsubscribed it at its provider.
 alter table ${s}."triggers" alter column "workflow_id" drop not null;
 do $$ begin

package/dist/workflows/schema.js

@@ -16,7 +16,7 @@ const readWorkflowsSchema = async (db, schema) => {
 	const row = rows[0];
 	return {
 		tables: row.found,
-		current: row.found && row.trigger_rows && commentVersion(row.comment) === 8 && row.triggers === workflowsTriggers.length
+		current: row.found && row.trigger_rows && commentVersion(row.comment) === 9 && row.triggers === workflowsTriggers.length
 	};
 };
 /**

package/dist/workflows/triggers/trigger-jobs.js

@@ -17,9 +17,9 @@ const passSize = 100;
 * for a polling one its first poll; for a subscribing webhook one its subscription), `workflows.trigger-stop`
 * (unsubscribes a stopped webhook trigger at its provider and removes it), `workflows.ready-check` (starts a run of one
 * record when it is ready, at the time its time terms say), and the poll and renewal jobs. Each acts only on the
-* generation it was queued for.
+* generation it was queued for. `stopConnect` is the stop job's alone, kept out of the `input` every other job gets.
 */
-const triggerJobs = (input) => {
+const triggerJobs = (input, stopConnect) => {
 	const { schema } = input;
 	const polls = pollJobs(input);
 	const readyCheck = defineJob({
@@ -87,18 +87,22 @@ const triggerJobs = (input) => {
 	});
 	/**
 	* Ends a stopped webhook trigger's subscription at its provider: whether nothing is left there, so the trigger can go.
-	* Any error is tried again, as the job's, until the provider ends it. A sign-in the unsubscribe can no longer use, as
-	* once the workflow was turned off and so its connection with it, or once the provider refused it, cannot end it:
-	* the trigger then stays `stopping` with that error, as the record of a subscription the provider may still hold.
+	* Any error is tried again, as the job's, until the provider ends it. It signs in through the account its row recorded,
+	* as the person who turned it on, even once the workflow was turned off or deleted (`stopConnect`). An account that is
+	* no longer theirs, or a sign-in the provider refused, cannot end it: the trigger then stays `stopping` with that
+	* error, as the record of a subscription the provider may still hold.
 	*/
 	const unsubscribe = async (db, trigger, signal) => {
-		const { rows } = await sql`select type, input, workflow_id, version, store, store is not null as subscribed
+		const { rows } = await sql`select type, input, workflow_id, version, connection_id, enabled_by, store, store is not null as subscribed
       from ${sql.id(schema, "triggers")} where id = ${trigger} and status = 'stopping'`.execute(db);
 		const row = rows[0];
 		const type = row?.subscribed ? input.webhooks(row.type) : void 0;
 		if (!row || !type?.unsubscribe) return true;
 		const end = type.unsubscribe;
-		const call = triggerCall(input, row, signal, input.redact);
+		const call = triggerCall({
+			allowPrivateAddresses: input.allowPrivateAddresses,
+			connect: (_, secret) => stopConnect?.(row, secret)
+		}, row, signal, input.redact);
 		const outcome = await callPlugin(() => end({
 			...call.context,
 			state: row.store

package/dist/workflows/triggers/trigger-sync.js

@@ -17,9 +17,11 @@ const triggerOf = (definition, connectionOf) => {
 * same write: turning it on inserts a running trigger and queues its start; a new version with the same type and input
 * keeps the row, so its state carries over, and passes over the records again; any other change, or turning it off, stops the old row and starts a new one.
 * The row keeps the account the trigger's connection binds (`connectionOf` names each type's connection), so an
-* expired sign-in stops every trigger on it, and connecting it again resumes them. Only the current version can be turned on.
+* expired sign-in stops every trigger on it, and connecting it again resumes them; and who turned it on (`enabledBy`,
+* which the save's consent decided), through whose account its stop job ends its subscription once it stops. A stopped
+* row keeps both. Only the current version can be turned on.
 */
-const syncTrigger = async (trx, schema, jobs, workflow, connectionOf = {}) => {
+const syncTrigger = async (trx, schema, jobs, workflow, enabledBy, connectionOf = {}) => {
 	const enabled = workflow.enabled_version;
 	if (enabled !== null && enabled !== workflow.version) throw badRequest("invalid-workflow", `Only the current version can be enabled: set enabled_version to ${String(workflow.version)}, or clear it to turn the workflow off`);
 	const wanted = enabled === null ? void 0 : triggerOf(workflow.definition, connectionOf);
@@ -30,7 +32,7 @@ const syncTrigger = async (trx, schema, jobs, workflow, connectionOf = {}) => {
 	const existing = rows[0];
 	if (existing?.same) {
 		if (existing.version === enabled) return;
-		await sql`update ${triggers} set version = ${enabled}, status = 'active', consecutive_failures = 0, last_error = null, updated_at = now() where id = ${existing.id}`.execute(trx);
+		await sql`update ${triggers} set version = ${enabled}, enabled_by = ${enabledBy}, status = 'active', consecutive_failures = 0, last_error = null, updated_at = now() where id = ${existing.id}`.execute(trx);
 		await jobs.start.enqueue(trx, {
 			trigger: existing.id,
 			generation: existing.generation
@@ -42,8 +44,8 @@ const syncTrigger = async (trx, schema, jobs, workflow, connectionOf = {}) => {
 		await jobs.stop.enqueue(trx, { trigger: existing.id });
 	}
 	if (!wanted) return;
-	const trigger = (await sql`insert into ${triggers} (workflow_id, version, tenant_id, type, input, connection_id, status, generation, consecutive_failures)
-    values (${id}, ${enabled}, ${workflow.tenant_id ?? null}, ${wanted.type}, ${JSON.stringify(wanted.input)}::jsonb, ${wanted.connection}, 'active', 1, 0) returning id`.execute(trx)).rows[0].id;
+	const trigger = (await sql`insert into ${triggers} (workflow_id, version, tenant_id, type, input, connection_id, enabled_by, status, generation, consecutive_failures)
+    values (${id}, ${enabled}, ${workflow.tenant_id ?? null}, ${wanted.type}, ${JSON.stringify(wanted.input)}::jsonb, ${wanted.connection}, ${enabledBy}, 'active', 1, 0) returning id`.execute(trx)).rows[0].id;
 	await jobs.start.enqueue(trx, {
 		trigger,
 		generation: 1

package/dist/workflows/workflow-engine.js

@@ -11,6 +11,7 @@ import { triggerJobs } from "./triggers/trigger-jobs.js";
 import { workflowTypes } from "./workflow-types.js";
 import { betterAuthConnectionAccounts } from "./connections/connection-accounts.js";
 import { connectionWiring } from "./connections/connection-wiring.js";
+import { connectionUses } from "./connections/connection-uses.js";
 import { connectionTriggers } from "./connections/connection-triggers.js";
 import { secretRedactor } from "@protobase/workflows";
 //#region src/workflows/workflow-engine.ts
@@ -59,8 +60,15 @@ const workflowEngine = (options, deps, auth) => {
 		redact: redactor.text,
 		origin: () => auth?.origins[0],
 		systemPath: () => deps().systemPath
+	}, connections.stopping);
+	auth?.connections.events.set({
+		...connectionTriggers(() => deps().db, schema, triggers),
+		uses: connectionUses({
+			deps,
+			schema,
+			roles
+		})
 	});
-	auth?.connections.events.set(connectionTriggers(() => deps().db, schema, triggers));
 	const webhooks = usable(types.webhooks);
 	const issue = {
 		deps,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.69.1",
+  "version": "0.69.3",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,11 +44,11 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.69.1",
-    "@protobase/query": "0.69.1",
-    "@protobase/schema": "0.69.1",
-    "@protobase/workflow-plugins": "0.69.1",
-    "@protobase/workflows": "0.69.1",
+    "@protobase/layout": "0.69.3",
+    "@protobase/query": "0.69.3",
+    "@protobase/schema": "0.69.3",
+    "@protobase/workflow-plugins": "0.69.3",
+    "@protobase/workflows": "0.69.3",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",