@protobase/server 0.8.2 → 0.10.0

package/dist/changes/capture-sql.js

@@ -1,3 +1,4 @@
+import { jobsSchema } from "../jobs/schema.js";
 //#region src/changes/capture-sql.ts
 const quoteIdent = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
 const quoteLiteral = (text) => `'${text.replaceAll("'", "''")}'`;
@@ -31,10 +32,16 @@ const outboxSql = (schema) => `create table if not exists ${quoteIdent(schema)}.
   "dispatch_after" timestamptz not null default now(),
   "created_at" timestamptz not null default now()
 )`;
+/** The job that turns captured changes into events and deliveries: one per writing transaction, run one at a time. */
+const dispatchJobName = "changes.dispatch";
+/** Every dispatch job's group in its ordered queue, so only one runs at a time, across processes too. */
+const dispatchGroup = "changes";
 /**
 * The body of `capture()`: its arguments are the resource, the columns to keep and the sensitive columns, whose names
 * it lists when they change but whose values it never keeps. It skips a transaction that set `<schema>.capture` to
-* `off`, and an update that changed none of those columns.
+* `off`, and an update that changed none of those columns. The first row a transaction captures enqueues a dispatch
+* job in the same transaction; `<schema>.dispatch` remembers that for the rest of it, and a rolled-back savepoint
+* forgets it with the job.
 */
 const captureBody = (schema) => `
 declare
@@ -71,6 +78,10 @@ begin
     changed,
     nullif(current_setting('${schema}.actor', true), '')::jsonb
   );
+  if current_setting('${schema}.dispatch', true) is distinct from 'queued' then
+    perform ${jobsSchema}.enqueue('${dispatchJobName}', null, null, null, '${dispatchGroup}');
+    perform set_config('${schema}.dispatch', 'queued', true);
+  end if;
   return null;
 end
 `;
@@ -105,4 +116,4 @@ const createTriggerSql = (schema, trigger, table) => {
 	return `create trigger ${quoteIdent(trigger.name)} ${timing} on ${table} for each row${when} execute function ${quoteIdent(schema)}."capture"(${args})`;
 };
 //#endregion
-export { captureBody, captureFunctionSql, createTriggerSql, dropTriggerSql, outboxSql, quoteIdent, resourceTriggers, tableSql };
+export { captureBody, captureFunctionSql, createTriggerSql, dispatchGroup, dispatchJobName, dropTriggerSql, outboxSql, quoteIdent, resourceTriggers, tableSql };

package/dist/changes/coalesce.d.ts

@@ -14,6 +14,8 @@ export type CapturedRow = {
   /** The columns an update changed, sensitive ones included; `null` for inserts and deletes. */
   changed: string[] | null;
   actor: EventActor | null;
+  /** When the writing transaction started, ISO 8601. */
+  at: string;
 };
 /**
  * One record's changes in one transaction, as one: its columns at the start (`before`, none when it was inserted) and
@@ -28,6 +30,8 @@ export type CoalescedChange = {
   actor: EventActor | null;
   /** The id of its last outbox row. */
   sequence: string;
+  /** When its last change's transaction started. */
+  at: string;
 };
 /**
  * The outbox rows of one or more transactions, in id order, as one change per (transaction, record). An insert then a

package/dist/changes/coalesce.js

@@ -17,7 +17,8 @@ const merged = ({ first, last, actor, listed }) => {
 		transaction: first.transaction,
 		resource: first.resource,
 		actor,
-		sequence: last.id
+		sequence: last.id,
+		at: last.at
 	};
 	const before = first.op === "INSERT" ? null : first.old;
 	const after = last.op === "DELETE" ? null : last.new;

package/dist/changes/outbox.d.ts

@@ -0,0 +1,14 @@
+import { Row } from "../types.js";
+import { CapturedRow } from "./coalesce.js";
+import { ResourceModel } from "@protobase/schema";
+import { Db } from "@protobase/query";
+//#region src/changes/outbox.d.ts
+/**
+ * A captured row's columns from the JSON text the database stores: the columns of 64-bit integer and decimal fields as
+ * their exact digits, other numbers as numbers. Needs a runtime that passes JSON.parse revivers the source text
+ * (Node 21 and later, Bun).
+ */
+export declare const parseColumns: (text: string | null, model?: ResourceModel) => Row | null;
+/** The oldest `limit` rows of the outbox that committed, in id order. */
+export declare const readOutbox: (db: Db, schema: string, models: readonly ResourceModel[], limit: number) => Promise<CapturedRow[]>;
+//#endregion

package/dist/changes/outbox.js

@@ -0,0 +1,51 @@
+import { quoteIdent } from "./capture-sql.js";
+import { sql } from "kysely";
+//#region src/changes/outbox.ts
+var ExactNumber = class {
+	source;
+	constructor(source) {
+		this.source = source;
+	}
+};
+const exact = (_key, value, context) => typeof value === "number" && context?.source !== void 0 ? new ExactNumber(context.source) : value;
+const plain = (value) => {
+	if (value instanceof ExactNumber) return Number(value.source);
+	if (Array.isArray(value)) return value.map(plain);
+	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, plain(item)]));
+	return value;
+};
+const textTypes = /* @__PURE__ */ new Set(["bigint", "decimal"]);
+/**
+* A captured row's columns from the JSON text the database stores: the columns of 64-bit integer and decimal fields as
+* their exact digits, other numbers as numbers. Needs a runtime that passes JSON.parse revivers the source text
+* (Node 21 and later, Bun).
+*/
+const parseColumns = (text, model) => {
+	if (text === null) return null;
+	const parsed = JSON.parse(text, exact);
+	const types = new Map(Object.values(model?.fields ?? {}).map((field) => [field.column, field.type]));
+	return Object.fromEntries(Object.entries(parsed).map(([column, value]) => [column, value instanceof ExactNumber && textTypes.has(types.get(column) ?? "") ? value.source : plain(value)]));
+};
+/** The oldest `limit` rows of the outbox that committed, in id order. */
+const readOutbox = async (db, schema, models, limit) => {
+	const byName = new Map(models.map((model) => [model.name, model]));
+	const { rows } = await sql`select "id"::text as id, "transaction"::text as transaction, "resource", "op", "old"::text as old, "new"::text as new, "changed",
+      "actor"::text as actor, to_char("created_at" at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') as at
+    from ${sql.raw(`${quoteIdent(schema)}."outbox"`)} where "dispatch_after" <= now() order by "id" limit ${limit}`.execute(db);
+	return rows.map((row) => {
+		const model = byName.get(row.resource);
+		return {
+			...row,
+			old: parseColumns(row.old, model),
+			new: parseColumns(row.new, model),
+			actor: row.actor === null ? null : JSON.parse(row.actor)
+		};
+	});
+};
+/** Removes dispatched rows from the outbox. */
+const deleteOutbox = async (db, schema, ids) => {
+	if (ids.length === 0) return;
+	await sql`delete from ${sql.raw(`${quoteIdent(schema)}."outbox"`)} where "id" = any(${ids}::bigint[])`.execute(db);
+};
+//#endregion
+export { deleteOutbox, parseColumns, readOutbox };

package/dist/changes/resource-change.d.ts

@@ -19,6 +19,8 @@ export type ResourceChange = {
   transaction: string;
   /** Grows with every change of a record, so receivers can drop stale events. */
   sequence: string;
+  /** When the change's transaction started, ISO 8601. */
+  at: string;
 };
 /** A captured row by field name, fields without a captured column left out. */
 export declare const recordOf: (model: ResourceModel, columns: Row) => Row;

package/dist/changes/resource-change.js

@@ -36,7 +36,8 @@ const resourceChange = (model, change) => {
 		source: change.actor ? "api" : "database",
 		...tenant != null && { tenant },
 		transaction: change.transaction,
-		sequence: change.sequence
+		sequence: change.sequence,
+		at: change.at
 	};
 };
 //#endregion

package/dist/check-shell.js

@@ -1,4 +1,4 @@
-import { navRecentErrors } from "@protobase/schema";
+import { bottomBarErrors, navRecentErrors } from "@protobase/schema";
 //#region src/check-shell.ts
 /** Fails at startup when a sidebar group or a user menu entry does not fit the resources, instead of on the first page load. */
 const checkShell = (registry, views, userMenu, pages = []) => {
@@ -13,5 +13,14 @@ const checkShell = (registry, views, userMenu, pages = []) => {
 		if (item.kind === "page" && !pages.includes(item.page)) throw new Error(`User menu: page "${item.page}" does not exist`);
 	}
 };
+/** Fails at startup when a bottom bar names a resource, page or role the app does not have, or bars share a role. */
+const checkBottomBars = (registry, bars, pages, roles) => {
+	const errors = bottomBarErrors(bars, {
+		resources: registry.entries.map((entry) => entry.name),
+		pages,
+		...roles && { roles }
+	});
+	if (errors.length > 0) throw new Error(errors.join("; "));
+};
 //#endregion
-export { checkShell };
+export { checkBottomBars, checkShell };

package/dist/create-admin.d.ts

@@ -1,13 +1,14 @@
 import { AdminAuth } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
+import { JobDefinition } from "./jobs/job-types.js";
+import { Admin, Authenticator, PageSource, ViewSource } from "./types.js";
+import { WebhooksOptions } from "./webhooks/table/options.js";
+import { SubscriptionDefinition } from "./webhooks/subscription.js";
 import { FilesOptions } from "./files/options.js";
-import { AdminEnv, Authenticator, PageSource, ViewSource } from "./types.js";
 import { ResourceSource } from "./resource-source.js";
 import { FunctionSource } from "./functions/define-function.js";
 import { AdminOptions } from "./admin-options.js";
-import { JobDefinition } from "./jobs/job-types.js";
-import { Hono } from "hono";
-import { UserMenuSource } from "@protobase/schema";
+import { BottomBarSource, UserMenuSource } from "@protobase/schema";
 import { Db } from "@protobase/query";
 //#region src/create-admin.d.ts
 export type CreateAdminInput = {
@@ -15,6 +16,8 @@ export type CreateAdminInput = {
   views?: ViewSource[];
   /** The `userMenu(...)` export of the config module: pages under the signed-in user in the sidebar. */
   userMenu?: UserMenuSource;
+  /** The `bottomBar(...)` exports of the config module, in order: tabs on phones for the roles each names. */
+  bottomBars?: BottomBarSource[];
   /** Composed pages (`page()` from @protobase/layout), served by /meta and checked against the resources here. */
   pages?: PageSource[];
   db: Db;
@@ -27,10 +30,14 @@ export type CreateAdminInput = {
   files?: FilesOptions;
   /** Where the changes that resources' events are raised from are captured (see `EventsOptions`). */
   events?: EventsOptions;
-  /** The app's jobs (see `defineJob`): with any, admins get the failed jobs page (`failedJobs`). */
+  /** The app's jobs (see `defineJob`): with any, or a resource with events, admins get the failed jobs page (`failed_jobs`). */
   jobs?: JobDefinition[];
+  /** Where the resources' events are delivered (`subscription(...)` exports of the config module). */
+  subscriptions?: SubscriptionDefinition[];
+  /** Webhook subscriptions made in the admin app, from `extends: [webhooks()]` (see `WebhooksOptions`). */
+  webhooks?: WebhooksOptions;
   options?: AdminOptions;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, db, authenticate, auth, functions, files: filesOptions, events, jobs, options }: CreateAdminInput) => Hono<AdminEnv, import("hono/types").BlankSchema, "/">;
+export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, jobs, subscriptions, webhooks: webhooksOptions, options }: CreateAdminInput) => Admin;
 //#endregion

package/dist/create-admin.js

@@ -3,16 +3,21 @@ import { createErrorHandler } from "./error-handler.js";
 import { assistantRecords } from "./assistant/records.js";
 import { builtInAssistant } from "./assistant/built-in-assistant.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
+import { webauthnPath } from "./better-auth/origins.js";
+import { apiCors, readCorsOrigins } from "./api-cors.js";
 import { authBasePath } from "./better-auth/create-auth.js";
 import { organizationRoutes } from "./better-auth/organizations/admin-routes.js";
 import { statusRoute } from "./better-auth/status-route.js";
 import { changesSchema } from "./changes/events-options.js";
-import { checkShell } from "./check-shell.js";
+import { callerRecords } from "./functions/records.js";
+import { toApiFunction } from "./functions/define-function.js";
+import { createWebhooks } from "./webhooks/webhooks.js";
+import { webhookTable } from "./webhooks/table/webhook-table.js";
+import { subscriptionWriteCheck } from "./webhooks/table/validate-hook.js";
+import { checkBottomBars, checkShell } from "./check-shell.js";
 import { checkViews } from "./check-views.js";
 import { createFilesRuntime } from "./files/runtime.js";
 import { fileRoutes } from "./files/routes.js";
-import { toApiFunction } from "./functions/define-function.js";
-import { callerRecords } from "./functions/records.js";
 import { functionRoutes } from "./functions/routes.js";
 import { runtimeUrl } from "./runtime/runtime-settings.js";
 import { createMeta } from "./meta.js";
@@ -27,17 +32,24 @@ import { failedJobs, failedJobsView } from "./jobs/failed-jobs.js";
 import { Hono } from "hono";
 import { checkPages } from "@protobase/layout";
 //#region src/create-admin.ts
+const declaredRoles = (auth, roles) => {
+	const names = [...auth?.roles ?? [], ...Object.keys(roles?.definitions ?? {})];
+	return names.length > 0 ? [...new Set(names)] : void 0;
+};
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, db, authenticate, auth, functions = {}, files: filesOptions, events, jobs = [], options = {} }) => {
+const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, jobs = [], subscriptions = [], webhooks: webhooksOptions, options = {} }) => {
 	const basePath = options.basePath ?? "/api/v1";
-	const resources = jobs.length > 0 ? [...appResources, failedJobs] : appResources;
-	const views = jobs.length > 0 ? [...appViews, failedJobsView] : appViews;
+	const withJobs = jobs.length > 0 || appResources.some((resource) => resource.toModel().events);
+	const resources = withJobs ? [...appResources, failedJobs] : appResources;
+	const views = withJobs ? [...appViews, failedJobsView] : appViews;
 	const registry = buildRegistry(resources);
 	const apiFunctions = Object.fromEntries(Object.entries(functions).map(([name, source]) => [name, toApiFunction(name, source)]));
 	const viewModels = views.map((view) => view.toModel());
 	const userMenuModel = userMenu?.toUserMenuModel();
 	const pageModels = pages.map((entry) => entry.toModel());
 	checkShell(registry, viewModels, userMenuModel, pageModels.map((entry) => entry.name));
+	const bottomBarModels = bottomBars.map((bar) => bar.toBottomBarModel());
+	checkBottomBars(registry, bottomBarModels, pageModels.map((entry) => entry.name), declaredRoles(auth, options.roles));
 	checkViews(registry, viewModels);
 	checkPages(pageModels, {
 		models: Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model])),
@@ -52,17 +64,19 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		models: registry.entries.map((entry) => entry.model),
 		systemPath
 	});
+	const table = webhooksOptions && webhookTable(webhooksOptions, auth);
 	const deps = {
 		db,
 		registry,
 		views: viewModels,
 		pages: pageModels,
 		...userMenuModel && { userMenu: userMenuModel },
+		bottomBars: bottomBarModels,
 		basePath,
 		systemPath,
 		statementTimeoutMs: options.statementTimeoutMs ?? 15e3,
 		guard: createScanGuard(db, options.scanGuard),
-		hooks: options.writeHooks ?? [],
+		hooks: [...options.writeHooks ?? [], ...table ? [subscriptionWriteCheck(registry.entries.map((entry) => entry.model), table.checkUrl)] : []],
 		audit: options.audit ?? consoleAuditQueue(),
 		accessOptions: {
 			...options.roles && { roles: options.roles },
@@ -100,6 +114,17 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	});
 	const app = new Hono();
 	app.onError(onError);
+	const corsOrigins = options.cors ?? readCorsOrigins(globalThis.process?.env ?? {});
+	const ownOrigins = auth?.origins ?? [];
+	if (corsOrigins !== void 0 || ownOrigins.length > 1) {
+		const answering = [authBasePath, ...Object.entries(apiFunctions).filter(([, fn]) => fn.options.cors).map(([name]) => `${systemPath}/functions/${name}`)];
+		const skip = (path) => answering.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+		app.use(`${systemPath}/*`, apiCors({
+			own: ownOrigins,
+			allowed: corsOrigins ?? [],
+			skip
+		}));
+	}
 	if (auth) {
 		app.route(authBasePath, statusRoute(auth));
 		if (auth.organizations) app.route(authBasePath, organizationRoutes({
@@ -109,6 +134,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			db
 		}));
 		app.on(["GET", "POST"], `${authBasePath}/*`, (c) => auth.handler(c.req.raw));
+		if (auth.origins.length > 1) app.get(webauthnPath, (c) => c.json({ origins: auth.origins }));
 	}
 	if (assistant?.kind === "built-in") {
 		const tools = options.assistant ? options.assistant.tools : void 0;
@@ -136,7 +162,15 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	app.route("/", fileRoutes(deps, authenticate));
 	app.route(basePath, api);
 	app.route(deps.systemPath || "/", system);
-	return app;
+	const webhooks = createWebhooks({
+		deps,
+		subscriptions,
+		functions: apiFunctions,
+		schema: changesSchema(events),
+		log: (line) => console.log(line),
+		...table && { table }
+	});
+	return Object.assign(app, { jobs: webhooks.jobs });
 };
 //#endregion
 export { createAdmin };

package/dist/index.d.ts

@@ -1,21 +1,26 @@
 import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { StaffSignIn } from "./better-auth/staff-log.js";
-import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-definitions.js";
 import { OperatorProvider, readOperatorSettings } from "./better-auth/operator-provider.js";
+import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-definitions.js";
 import { OrganizationRole, StoredMember, StoredOrganization } from "./better-auth/organizations/store.js";
 import { OrganizationsOptions } from "./better-auth/organizations/options.js";
 import { PlatformSignIn, readPlatformSignIn } from "./better-auth/platform-sign-in.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
+import { StandardSchema, readJson } from "./functions/read-json.js";
+import { EnqueueOptions, JobContext, JobDefinition, JobOptions } from "./jobs/job-types.js";
+import { Admin, AuditEvent, AuditQueue, Authenticator, PipelineHook, ScanGuardMode, Session, SessionOrganization, TenantValue, User, ViewSource, WriteEvent, WriteOperation } from "./types.js";
+import { WebhooksOptions } from "./webhooks/table/options.js";
+import { EventData, RunContext, SubscriptionDefinition, SubscriptionEvent, SubscriptionOptions, subscription } from "./webhooks/subscription.js";
 import { FileProvider, FileStore, StoredObject } from "./files/store.js";
 import { FilesOptions } from "./files/options.js";
-import { Admin, AuditEvent, AuditQueue, Authenticator, PipelineHook, ScanGuardMode, Session, SessionOrganization, TenantValue, User, ViewSource, WriteEvent, WriteOperation } from "./types.js";
 import { CleanupEntry, CleanupSchedule, ScheduledDelete, storageCleanupSchedule } from "./files/cleanup-schedule.js";
 import { CleanupReport } from "./files/cleanup-runner.js";
 import { ResourceSource, configExports } from "./resource-source.js";
 import { RecordKeyInput, ToolRecord, ToolRecords } from "./assistant/records.js";
 import { FunctionRecords, ListParams, RecordPage } from "./functions/records.js";
 import { ApiFunction, CorsOptions, FunctionApp, FunctionCaller, FunctionContext, FunctionHandler, FunctionOptions, FunctionSource, ProtectedFunctionOptions, PublicFunctionContext, PublicFunctionHandler, PublicFunctionOptions, defineFunction } from "./functions/define-function.js";
+import { CorsOrigins } from "./api-cors.js";
 import { ChatMessage, ChatTextPart, Completion, CompletionOptions, ModelError, ModelSettings, ReasoningDetail, ReasoningEffort, ToolCall, ToolSpec, streamChatCompletion } from "./assistant/chat-completions.js";
 import { ConversationRecord, ConversationStore } from "./assistant/conversation-store.js";
 import { Conversation, ConversationsOptions, conversationKey, createConversations } from "./assistant/conversations.js";
@@ -24,8 +29,6 @@ import { AssistantTool, ToolContext, defineTool } from "./assistant/tools.js";
 import { AssistantOptions, AssistantSettings, assistantRoles, assistantSettings, assistantVariables, seesAssistant } from "./assistant/assistant-settings.js";
 import { RuntimeOptions, runtimeUrl, runtimeVariable, seesRuntime } from "./runtime/runtime-settings.js";
 import { AdminOptions } from "./admin-options.js";
-import { StandardSchema, readJson } from "./functions/read-json.js";
-import { EnqueueOptions, JobContext, JobDefinition, JobOptions } from "./jobs/job-types.js";
 import { CreateAdminInput, createAdmin } from "./create-admin.js";
 import { ProjectConfig, defineConfig, mergeConfig } from "./project-config.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
@@ -35,11 +38,16 @@ import { BetterAuthAuthenticatorOptions, betterAuthAuthenticator } from "./bette
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
+import { webauthnPath } from "./better-auth/origins.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
 import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
 import { CapturedRow, CoalescedChange, coalesce } from "./changes/coalesce.js";
 import { ResourceChange, recordOf, resourceChange } from "./changes/resource-change.js";
 import { eventMatcher } from "./changes/match-events.js";
+import { parseColumns, readOutbox } from "./changes/outbox.js";
+import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
+import { webhooks } from "./webhooks/table/plugin.js";
+import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
 import { MemberInput, NewOrganization, addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
 import { AssistantBackend, assistantProtocolRoutes } from "./assistant/protocol-routes.js";
 import { fileConversationStore } from "./assistant/file-conversation-store.js";
@@ -60,4 +68,4 @@ import { FatalJobError } from "./jobs/run-job.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EnqueueOptions, type EventsOptions, FatalJobError, type FileCleanupInput, type FileObject, type FileProvider, type FileStore, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MemberInput, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RuntimeOptions, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type SignInPolicy, type SignInRule, type SignatureOptions, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, normalizeRoles, notFound, parseRoles, processor, readJson, readOnlyQueryTool, readOperatorSettings, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, startJobs, storageCleanupSchedule, streamChatCompletion, unauthorized, verifySignature, verifyStandardWebhook, widget, withCacheBreakpoints };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EnqueueOptions, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileObject, type FileProvider, type FileStore, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MemberInput, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type SignInPolicy, type SignInRule, type SignatureOptions, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints };

package/dist/index.js

@@ -9,8 +9,10 @@ import { readOnlyQueryTool, readWriteQueryTool } from "./assistant/query-tools.j
 import { requestApproval } from "./assistant/approval.js";
 import { withCacheBreakpoints } from "./assistant/cache-breakpoints.js";
 import { ModelError, streamChatCompletion } from "./assistant/chat-completions.js";
+import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
 import { runTurn } from "./assistant/turn.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
+import { webauthnPath } from "./better-auth/origins.js";
 import { readOperatorSettings } from "./better-auth/operator-provider.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
@@ -18,23 +20,28 @@ import { readPlatformSignIn } from "./better-auth/platform-sign-in.js";
 import { createAuth, normalizeRoles } from "./better-auth/create-auth.js";
 import { addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
 import { createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
+import { coalesce } from "./changes/coalesce.js";
+import { eventMatcher } from "./changes/match-events.js";
+import { parseColumns, readOutbox } from "./changes/outbox.js";
+import { recordOf, resourceChange } from "./changes/resource-change.js";
+import { defineJob, isJobDefinition, jobDefinitions } from "./jobs/define-job.js";
+import { FatalJobError } from "./jobs/run-job.js";
+import { defineFunction } from "./functions/define-function.js";
+import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
+import { subscription } from "./webhooks/subscription.js";
 import { storageCleanupSchedule } from "./files/cleanup-schedule.js";
 import { localFileStore, localFiles } from "./files/local-files.js";
-import { defineFunction } from "./functions/define-function.js";
 import { runtimeUrl, runtimeVariable, seesRuntime } from "./runtime/runtime-settings.js";
-import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
 import { createAdmin } from "./create-admin.js";
 import { configExports } from "./resource-source.js";
-import { defineJob, isJobDefinition, jobDefinitions } from "./jobs/define-job.js";
 import { defineConfig, mergeConfig } from "./project-config.js";
 import { jwtAuthenticator } from "./auth/jwt.js";
 import { betterAuthAuthenticator } from "./better-auth/authenticator.js";
 import { issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
 import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
-import { coalesce } from "./changes/coalesce.js";
-import { recordOf, resourceChange } from "./changes/resource-change.js";
-import { eventMatcher } from "./changes/match-events.js";
+import { webhooks } from "./webhooks/table/plugin.js";
+import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
 import { maxWidgetPropsBytes, widget } from "./assistant/widget.js";
 import { functionApp } from "./functions/function-app.js";
 import { readJson } from "./functions/read-json.js";
@@ -42,7 +49,6 @@ import { verifySignature, verifyStandardWebhook } from "./functions/verify-signa
 import { requireEnv } from "./functions/require-env.js";
 import { createFileCleanup } from "./files/file-cleanup.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
-import { FatalJobError } from "./jobs/run-job.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, normalizeRoles, notFound, parseRoles, processor, readJson, readOnlyQueryTool, readOperatorSettings, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, startJobs, storageCleanupSchedule, streamChatCompletion, unauthorized, verifySignature, verifyStandardWebhook, widget, withCacheBreakpoints };
+export { FatalJobError, HttpProblem, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints };

package/dist/jobs/current.d.ts

@@ -4,5 +4,7 @@ import { Db } from "@protobase/query";
 /** What `defineJob(...).enqueue` reaches: the jobs runtime this process started. */
 export type JobsEnqueuer = {
   enqueue(definition: JobDefinition, db: Db, payload: unknown, options?: EnqueueOptions): Promise<string>;
+  /** Has this process's worker of the job look for due jobs now rather than at its next poll; nothing without one. */
+  wake(name: string): void;
 };
 //#endregion

package/dist/jobs/current.js

@@ -7,6 +7,8 @@ const currentJobs = () => {
 	if (!runtime) throw new Error("Jobs are not running in this process: start them with startJobs(), as protobase dev, serve and worker do");
 	return runtime;
 };
+/** The running jobs runtime, if this process started one. */
+const runningJobs = () => holder[key];
 const setCurrentJobs = (runtime) => {
 	if (holder[key]) throw new Error("Jobs are already running in this process; stop them before starting them again");
 	holder[key] = runtime;
@@ -15,4 +17,4 @@ const clearCurrentJobs = (runtime) => {
 	if (holder[key] === runtime) delete holder[key];
 };
 //#endregion
-export { clearCurrentJobs, currentJobs, setCurrentJobs };
+export { clearCurrentJobs, currentJobs, runningJobs, setCurrentJobs };

package/dist/jobs/failed-jobs.js

@@ -6,13 +6,13 @@ const admins = ({ user }) => user?.roles?.includes("admin") ?? false;
 * The failed jobs, over the `jobs.failed` view: the admin app lists them with their last error, and retries or deletes
 * one through the view's triggers. Admins only, whatever the project's roles say.
 */
-const failedJobs = resource("failedJobs").table(`${jobsSchema}.failed`).fields({
+const failedJobs = resource("failed_jobs").table(`${jobsSchema}.failed`).fields({
 	id: f.uuid().readOnly().filterable(),
 	name: f.text().readOnly().filterable().sortable(),
 	error: f.text().optional().readOnly(),
 	attempts: f.integer().readOnly(),
-	failedAt: f.timestamp().readOnly().filterable().sortable(),
-	createdAt: f.timestamp().readOnly().sortable(),
+	failed_at: f.timestamp().readOnly().filterable().sortable(),
+	created_at: f.timestamp().readOnly().sortable(),
 	key: f.text().optional().readOnly().filterable(),
 	payload: f.json().optional().readOnly(),
 	output: f.json().optional().readOnly(),
@@ -24,23 +24,23 @@ const failedJobs = resource("failedJobs").table(`${jobsSchema}.failed`).fields({
 	delete: admins,
 	create: () => false
 });
-const failedJobsView = view("failedJobs").names({
+const failedJobsView = view("failed_jobs").names({
 	singular: "Failed job",
 	plural: "Failed jobs"
 }).icon("triangle-alert").title((r) => r.name).help("Jobs that used up their attempts, or failed for good. Retry one once its cause is fixed: it gets one more attempt.").fields((r) => ({
 	name: r.name.label("Job"),
 	error: r.error.label("Last error"),
-	failedAt: r.failedAt.label("Failed"),
-	createdAt: r.createdAt.label("Enqueued"),
+	failed_at: r.failed_at.label("Failed"),
+	created_at: r.created_at.label("Enqueued"),
 	output: r.output.label("Error details")
 })).list((r) => ({
 	columns: [
 		r.name,
 		r.error,
 		r.attempts,
-		r.failedAt
+		r.failed_at
 	],
-	sort: [[r.failedAt, "desc"]]
+	sort: [[r.failed_at, "desc"]]
 })).layout((r) => [
 	l.section("Failure", [r.error, r.output]),
 	l.section("Job", [
@@ -50,8 +50,8 @@ const failedJobsView = view("failedJobs").names({
 	]),
 	l.sidebar([
 		r.attempts,
-		r.failedAt,
-		r.createdAt
+		r.failed_at,
+		r.created_at
 	])
 ]).actions((a) => [a.update("retry", {
 	label: "Retry",

package/dist/jobs/functions-sql.js

@@ -1,5 +1,5 @@
 /** The comment each Protobase function in the jobs schema carries, which the startup check reads. */
-const functionsComment = `Protobase jobs 2`;
+const functionsComment = `Protobase jobs 3`;
 /** Protobase's own functions beside pg-boss's tables, by name; each carries `functionsComment`. */
 const functionNames = [
 	"enqueue",
@@ -11,7 +11,9 @@ const functionNames = [
 * `jobs.enqueue(name, payload, run_at, key, group_key, priority)`: a job from SQL, such as a trigger, in the caller's
 * transaction. It inserts what pg-boss's `send()` does, with the queue's retry settings; it creates a queue that no
 * worker has created yet. A `key` keeps one waiting job, as `mode: 'dedupe'` does, and an ordered job takes its group
-* as `group_key`. Tied to the pg-boss schema version, which the startup check pins.
+* as `group_key`, and an id from `uuidv7()`, which rises within a database session: pg-boss runs a group's jobs by their
+* transaction's start, then by id, so the jobs one transaction enqueues run in that order. Tied to the pg-boss schema
+* version, which the startup check pins.
 */
 const enqueue = (schema) => `create or replace function ${schema}.enqueue(
   job_name text,
@@ -45,14 +47,15 @@ begin
   end if;
   execute format(
     'insert into ${schema}.%I (name, data, priority, start_after, singleton_key, retry_limit, retry_delay, retry_backoff,
-       retry_delay_max, expire_seconds, deletion_seconds, keep_until, policy, dead_letter, heartbeat_seconds, upsert_by_key)
-     values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $4 + $12 * interval ''1s'', $13, $14, $15, $16)
+       retry_delay_max, expire_seconds, deletion_seconds, keep_until, policy, dead_letter, heartbeat_seconds, upsert_by_key, id)
+     values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $4 + $12 * interval ''1s'', $13, $14, $15, $16, $17)
      on conflict do nothing
      returning id',
     queue.table_name)
   using job_name, payload, priority, start, coalesce(key, group_key), queue.retry_limit, queue.retry_delay,
     queue.retry_backoff, queue.retry_delay_max, queue.expire_seconds, queue.deletion_seconds, queue.retention_seconds,
-    queue.policy, queue.dead_letter, queue.heartbeat_seconds, key is not null
+    queue.policy, queue.dead_letter, queue.heartbeat_seconds, key is not null,
+    case when group_key is null then gen_random_uuid() else uuidv7() end
   into job_id;
   -- A concurrent enqueue of the same key inserted first: its job is the one waiting.
   if job_id is null and key is not null then