@protobase/cli 0.66.5 → 0.66.7

package/dist/build/config-bundle.js

@@ -1,9 +1,12 @@
 import { findPackageDir, packageName } from "./packages/package-dir.js";
 import { hostModuleIds } from "../serve/host-module-ids.js";
+import { cliPackages } from "../dev/server-package.js";
+import { importProjectFiles } from "../project/import-project-file.js";
 import { loadSourceConfig } from "../config/source-config.js";
 import { layoutCheck } from "./layout-check.js";
 import { extensionImports } from "../project/extensions.js";
 import { viteBundle } from "./vite-bundle.js";
+import { cliProtobaseIds, provideCliModules } from "../project/cli-modules.js";
 import { collectComponents } from "./component-names.js";
 import { bundleEntryCode } from "./entry-code.js";
 import { hostPackages } from "./packages/host-packages.js";
@@ -67,9 +70,16 @@ const servedImports = (native) => {
 	};
 };
 const buildConfigBundle = async ({ projectDir, outFile, bun, extensions = [], components = /* @__PURE__ */ new Set() }) => {
+	if (process.versions.bun !== void 0) provideCliModules();
+	const cli = cliPackages();
+	const packages = {
+		...cli,
+		dedupe: [.../* @__PURE__ */ new Set([...cli.dedupe, ...cliProtobaseIds().map((id) => packageName(id))])]
+	};
 	const config = await loadSourceConfig(projectDir, {
 		command: "build",
-		extensions
+		extensions,
+		importModules: (files) => importProjectFiles(files, projectDir, packages)
 	});
 	const file = path.join(projectDir, "protobase-bundle-entry.js");
 	const native = /* @__PURE__ */ new Map();

package/dist/build/first-party-code.js

@@ -0,0 +1,22 @@
+import { firstPartyCodeKey } from "@protobase/schema/internal";
+import { sentryVitePlugin } from "@sentry/vite-plugin";
+//#region src/build/first-party-code.ts
+/**
+* Marks every script of a browser build as the app's own (see `firstPartyCodeKey`), with the error SDK's bundler
+* plugin and nothing else of it: no release, no source map upload and no telemetry. Silent, since it still warns that
+* it has no token to create the release it is told not to create.
+*/
+const firstPartyCode = () => sentryVitePlugin({
+	applicationKey: firstPartyCodeKey,
+	telemetry: false,
+	silent: true,
+	sourcemaps: { disable: true },
+	release: {
+		inject: false,
+		create: false,
+		finalize: false,
+		setCommits: false
+	}
+});
+//#endregion
+export { firstPartyCode };

package/dist/build/plugin-build.js

@@ -6,6 +6,7 @@ import { bundledImports } from "../project/bundled-imports.js";
 import { sharedModules } from "../project/shared-modules.js";
 import { pluginFieldTypes } from "./plugin-fields.js";
 import { layerPluginUtilities } from "./plugin-styles.js";
+import { firstPartyCode } from "./first-party-code.js";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import path from "node:path";
@@ -120,7 +121,8 @@ const buildPlugin = async ({ pluginDir, outDir, name, projectDir, ignore = [], s
 			pluginStyles(styles, styleCode(pluginDir, target.theme, [outDir, ...ignore])),
 			react(),
 			tailwindcss(),
-			layeredStyles()
+			layeredStyles(),
+			firstPartyCode()
 		],
 		worker: { rolldownOptions: { output: { sourcemapDebugIds: sourceMaps } } },
 		build: {

package/dist/build/shell.js

@@ -2,6 +2,7 @@ import { readPackageJson } from "./packages/package-dir.js";
 import { adminAppDir, uiEntry, uiPackageDir } from "../project/admin-app.js";
 import { projectUiPlugin } from "../project/project-ui.js";
 import { sharedModulesPlugin } from "../project/shared-modules.js";
+import { firstPartyCode } from "./first-party-code.js";
 import { pinnedNative } from "../mobile/pinned-packages.js";
 import { faviconLink } from "../project/favicon-link.js";
 import { themeLink } from "../project/theme-link.js";
@@ -69,7 +70,8 @@ const buildShell = async (outDir, sourceMapsDir) => {
 			faviconLink(),
 			serviceWorker(),
 			react(),
-			tailwindcss()
+			tailwindcss(),
+			firstPartyCode()
 		],
 		worker: { rolldownOptions: { output: { sourcemapDebugIds: sourceMaps } } },
 		build: {

package/dist/cli/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.66.5";
+var version = "0.66.7";
 //#endregion
 export { version };

package/dist/dev/server-package.js

@@ -6,6 +6,12 @@ import { fileURLToPath } from "node:url";
 const server = "@protobase/server";
 const supplied = [...new Set(hostModuleIds.map((id) => packageName(id)))];
 const cliDir = fileURLToPath(new URL("../..", import.meta.url));
+/** The CLI's own copies of the packages the serve runtime supplies, as a bundled project gets them. */
+const cliPackages = (ownDir = cliDir) => ({
+	from: "cli",
+	root: ownDir,
+	dedupe: supplied
+});
 /**
 * Where the API of `protobase dev` gets @protobase/server: from the project's node_modules when the project is locked,
 * so one that is not installed fails as any missing package does; otherwise, bundled, the CLI's own, with the other
@@ -17,11 +23,7 @@ const serverPackage = (projectDir, ownDir = cliDir) => {
 		root: projectDir,
 		dedupe: [server]
 	};
-	return {
-		from: "cli",
-		root: ownDir,
-		dedupe: supplied
-	};
+	return cliPackages(ownDir);
 };
 //#endregion
-export { serverPackage };
+export { cliPackages, serverPackage };

package/dist/doctor/built-in-models.js

@@ -0,0 +1,26 @@
+import { builtInResources, configExports, webhooksModule } from "@protobase/server/config-exports";
+//#region src/doctor/built-in-models.ts
+/**
+* The resources and views Protobase adds to an app by what its config enables, as the API serves them: the webhook ones
+* of `webhooks`, then Failed jobs, Activity and Comments by what the app's resources use. Doctor checks them as it checks
+* the app's own.
+*/
+const builtInModels = (config, models) => {
+	const webhooks = config.webhooks ? configExports(webhooksModule(config.webhooks)) : {
+		resources: [],
+		views: []
+	};
+	const webhookModels = webhooks.resources.map((resource) => resource.toModel());
+	const added = builtInResources({
+		models: [...webhookModels, ...models],
+		jobs: Object.keys(config.jobs).length > 0,
+		notifications: config.notifications !== void 0,
+		...config.events && { events: config.events }
+	});
+	return {
+		models: [...webhookModels, ...added.resources.map((resource) => resource.toModel())],
+		views: [...webhooks.views, ...added.views].map((view) => view.toModel())
+	};
+};
+//#endregion
+export { builtInModels };

package/dist/doctor/run.js

@@ -1,7 +1,9 @@
+import { loadSourceConfig } from "../config/source-config.js";
 import { connect } from "../db/connect.js";
 import { introspect } from "../db/introspect.js";
 import { loadDataConfig } from "../project/load-data-config.js";
 import { readOnlyDb } from "../db/read-only-db.js";
+import { builtInModels } from "./built-in-models.js";
 import { checkResource } from "./check.js";
 import { indexIssues } from "./index-issues.js";
 import { readShapes } from "./read-shapes.js";
@@ -15,12 +17,17 @@ const format = (issue) => `  ${issue.severity.padEnd(7)} ${issue.resource}: ${is
 const runDoctor = async (options, out) => {
 	if (!existsSync(path.join(options.configDir, "index.ts"))) throw new Error(`No config in ${options.configDir}: write it with \`protobase scaffold\`, or pass --config <dir>`);
 	const config = await loadDataConfig(options.configDir, options.projectDir);
-	const { models } = config;
-	if (models.length === 0) throw new Error(`No resources exported from ${options.configDir}/index.ts`);
+	if (config.models.length === 0) throw new Error(`No resources exported from ${options.configDir}/index.ts`);
+	const builtIn = builtInModels(await loadSourceConfig(options.projectDir, { command: "tool" }), config.models);
+	const models = [...builtIn.models, ...config.models];
 	const sql = connect(options.url);
 	const tables = await introspect(sql, { views: true }).finally(() => sql.end());
 	const db = readOnlyDb(options.url);
-	const shapes = readShapes(config);
+	const shapes = readShapes({
+		models,
+		views: [...builtIn.views, ...config.views],
+		pages: config.pages
+	});
 	const indexes = await Promise.all(models.map(async (model) => indexIssues(model, await tableIndexes(db, model), shapes))).finally(() => db.destroy());
 	const issues = models.flatMap((model, i) => [
 		...checkResource(model, tables),
@@ -30,7 +37,7 @@ const runDoctor = async (options, out) => {
 	]);
 	for (const issue of issues) out(format(issue));
 	const errors = issues.filter((i) => i.severity === "error").length;
-	out(`Checked ${models.length} resources: ${errors} errors, ${issues.length - errors} warnings.\n`);
+	out(`Checked ${builtIn.models.length > 0 ? `${config.models.length} resources and ${builtIn.models.length} built-in ones` : `${models.length} resources`}: ${errors} errors, ${issues.length - errors} warnings.\n`);
 	return {
 		errors,
 		warnings: issues.length - errors

package/dist/mobile/android-signing.js

@@ -12,6 +12,13 @@ const signingNames = new Set(androidSigningVariables);
 const isSigningVariable = (key) => signingNames.has(key.toUpperCase());
 /** `env` without the signing variables, in any letter case. */
 const withoutAndroidSigning = (env) => Object.fromEntries(Object.entries(env).filter(([key]) => !isSigningVariable(key)));
+/**
+* Deletes from `env`, in place, every variable named `PROTOBASE_ANDROID_*` in any letter case: wider than the four, so
+* no such variable is left for the project's code to find, while Gradle, which reads the four by name, gets them apart.
+*/
+const dropAndroidSigning = (env) => {
+	for (const key of Object.keys(env)) if (key.toUpperCase().startsWith("PROTOBASE_ANDROID_")) delete env[key];
+};
 const isFile = (file) => {
 	try {
 		return statSync(file).isFile();
@@ -50,4 +57,4 @@ const withReleaseSigning = (gradle) => {
 	return gradle.replace(releaseAnchor, `${signingConfig}${releaseAnchor}            signingConfig signingConfigs.release\n`);
 };
 //#endregion
-export { androidSigning, androidSigningVariables, withReleaseSigning, withoutAndroidSigning };
+export { androidSigning, androidSigningVariables, dropAndroidSigning, withReleaseSigning, withoutAndroidSigning };

package/dist/mobile/load-project.js

@@ -1,14 +1,17 @@
 import { loadNearestEnvFile } from "../dev/env.js";
 import { loadSourceConfig } from "../config/source-config.js";
+import { dropAndroidSigning } from "./android-signing.js";
 import { appNameOver } from "@protobase/server";
 //#region src/mobile/load-project.ts
 /**
 * What a mobile build needs of the project in `dir`, merged as `protobase dev` merges it after the configs of
 * `extensions`: its mobile section, unchecked, and with sign-in on the app's URL, its tokens' issuer, and its name.
-* The project's .env is loaded first, as other commands do; nothing but the configs runs.
+* The project's .env is loaded first, as other commands do, and no `PROTOBASE_ANDROID_*` variable is left in the
+* environment; nothing but the configs runs.
 */
 const loadMobileProject = async (dir, extensions) => {
 	loadNearestEnvFile(dir);
+	dropAndroidSigning(process.env);
 	const { mobile, auth, url, name } = await loadSourceConfig(dir, {
 		command: "tool",
 		extensions

package/dist/project/cli-modules.js

@@ -0,0 +1,30 @@
+import { cliTypePaths } from "./project-types.js";
+import { fileURLToPath } from "node:url";
+//#region src/project/cli-modules.ts
+const cliDir = fileURLToPath(new URL("../..", import.meta.url));
+/** Every entry point of the @protobase packages the CLI carries, such as `@protobase/server/pdf`. */
+const cliProtobaseIds = () => Object.keys(cliTypePaths()).filter((id) => id.startsWith("@protobase/"));
+/**
+* Under Bun, makes every later import of an entry point of the @protobase packages load the CLI's own copy, whatever
+* the importer installed (Bun's virtual modules). Each loads when it is first imported, so the CLI loads nothing it did
+* not already load or the project does not import. Only the @protobase packages: a virtual module that loads lazily
+* cannot be `require`d, as the CLI requires React. Bun only: under Node the project's files load through Vite's module
+* runner, which resolves them from the CLI itself. Each build calls it again, which Bun takes: a plugin of the same name
+* registered again replaces nothing it needs and throws nothing.
+*/
+const provideCliModules = () => {
+	const bun = globalThis.Bun;
+	if (!bun) throw new Error("provideCliModules runs under Bun only");
+	const ids = cliProtobaseIds();
+	bun.plugin({
+		name: "protobase-cli-modules",
+		setup: (build) => {
+			for (const id of ids) build.module(id, async () => ({
+				exports: await import(bun.resolveSync(id, cliDir)),
+				loader: "object"
+			}));
+		}
+	});
+};
+//#endregion
+export { cliProtobaseIds, provideCliModules };

package/dist/project/import-project-file.js

@@ -3,10 +3,9 @@ import { writeProjectTypes } from "./project-types.js";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/project/import-project-file.ts
-const runnerImport = async (file, projectDir, plugins = []) => {
+const runnerImport = async (file, projectDir, resolution, plugins = []) => {
 	await writeProjectTypes(projectDir);
 	const vite = await import("vite");
-	const resolution = serverPackage(projectDir);
 	const packages = resolution.from === "cli" ? {
 		root: resolution.root,
 		resolve: { dedupe: resolution.dedupe }
@@ -23,29 +22,30 @@ const inPackage = (file) => file.split(path.sep).includes("node_modules");
 const bunLoads = (projectDir) => process.versions.bun !== void 0 && serverPackage(projectDir).from === "project";
 /**
 * Imports one of the files of the project in `projectDir`, TypeScript: Bun loads it itself, Node through Vite's module
-* runner, or a package's file as it is. A bundled project's file always goes through the runner. `protobase dev` loads
-* this module through Vite, which leaves these imports of a path as they are.
+* runner, or a package's file as it is. A bundled project's file always goes through the runner. `resolution` says whose
+* packages the runner resolves, by default as `serverPackage` says. `protobase dev` loads this module through Vite,
+* which leaves these imports of a path as they are.
 */
-const importProjectFile = async (file, projectDir) => inPackage(file) ? import(
+const importProjectFile = async (file, projectDir, resolution = serverPackage(projectDir)) => inPackage(file) ? import(
 	/* @vite-ignore */
 	pathToFileURL(file).href
 ) : bunLoads(projectDir) ? import(
 	/* @vite-ignore */
 	file
-) : runnerImport(file, projectDir);
+) : runnerImport(file, projectDir, resolution);
 /**
 * Imports several of the project's files in order, so that the modules they share are loaded once. Bun's module cache
 * does that itself; Vite's runner gets them as the imports of one module, which need not exist, beside the first file.
 */
-const importProjectFiles = async (files, projectDir) => {
+const importProjectFiles = async (files, projectDir, resolution = serverPackage(projectDir)) => {
 	if (bunLoads(projectDir) || files.length === 1) {
 		const modules = [];
-		for (const file of files) modules.push(await importProjectFile(file, projectDir));
+		for (const file of files) modules.push(await importProjectFile(file, projectDir, resolution));
 		return modules;
 	}
 	const id = path.join(path.dirname(files[0]), "protobase-project-files.js");
 	const code = [...files.map((file, i) => `import * as m${i} from ${JSON.stringify(file)}`), `export const modules = [${files.map((_, i) => `m${i}`).join(", ")}]`].join("\n");
-	return (await runnerImport(id, projectDir, [{
+	return (await runnerImport(id, projectDir, resolution, [{
 		name: "protobase-project-files",
 		resolveId: (source) => source === id ? `\0${id}` : void 0,
 		load: (source) => source === `\0${id}` ? code : void 0

package/dist/project/pool-wait.js

@@ -1,20 +1,24 @@
 import { ConnectionsBusy, poolWaitMs } from "@protobase/server";
 //#region src/project/pool-wait.ts
 /**
-* The pool's `connect`, where a query that finds every connection in use and waits `poolWaitMs` for one (the pool's
-* own `connectionTimeoutMillis`) fails with `ConnectionsBusy`, so a saturated app answers at once rather than queue
-* requests behind slow ones. The pool tells its timeout by no code, so a failure counts as one when every connection
-* was in use as the query asked; any other failure is the pool's own.
+* The pool's `connect`, where a query that finds every connection in use and waits `poolWaitMs` for one fails with
+* `ConnectionsBusy`, so a saturated app answers at once rather than queue requests behind slow ones. A query that finds
+* a connection free, or room for a new one, waits as long as the pool lets a new connection take to open, such as while
+* a database that scaled to zero wakes. The pool still hands a query that gave up the connection it waited for, which
+* goes straight back.
 */
 const connectOrBusy = (pool) => async () => {
 	const max = pool.options.max ?? 10;
-	const full = pool.totalCount >= max && pool.idleCount === 0;
-	try {
-		return await pool.connect();
-	} catch (error) {
-		if (full && !pool.ending) throw new ConnectionsBusy(max, poolWaitMs, { cause: error });
-		throw error;
-	}
+	if (!(pool.totalCount >= max && pool.idleCount === 0)) return pool.connect();
+	const connecting = pool.connect();
+	let timer;
+	const gaveUp = new Promise((resolve) => {
+		timer = setTimeout(() => resolve("gave up"), poolWaitMs);
+	});
+	const first = await Promise.race([connecting, gaveUp]).finally(() => clearTimeout(timer));
+	if (first !== "gave up") return first;
+	connecting.then((client) => client.release(), () => {});
+	throw new ConnectionsBusy(max, poolWaitMs);
 };
 //#endregion
 export { connectOrBusy };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/cli",
-  "version": "0.66.5",
+  "version": "0.66.7",
   "description": "The protobase command: scaffold, doctor, dev, build and serve a Protobase project.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,14 +43,15 @@
   "dependencies": {
     "@better-auth/core": "^1.7.12",
     "@hono/node-server": "^2.1.3",
-    "@protobase/config": "0.66.5",
-    "@protobase/layout": "0.66.5",
-    "@protobase/query": "0.66.5",
-    "@protobase/schema": "0.66.5",
-    "@protobase/server": "0.66.5",
-    "@protobase/ui": "0.66.5",
+    "@protobase/config": "0.66.7",
+    "@protobase/layout": "0.66.7",
+    "@protobase/query": "0.66.7",
+    "@protobase/schema": "0.66.7",
+    "@protobase/server": "0.66.7",
+    "@protobase/ui": "0.66.7",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
+    "@sentry/vite-plugin": "^11.10.0",
     "@tailwindcss/vite": "^4.3.3",
     "@vitejs/plugin-react": "^6.1.2",
     "aip-parsers": "^1.0.0",

package/skills/protobase/references/features/history-comments-and-live-updates.md

@@ -12,5 +12,6 @@ The changes of each record, comments on it, and pages that refresh as records ch
 - [Comment moderation](../reference/comments.md#moderation): Admins find and delete comments across the app.
 - [Live updates](../reference/live.md#what-a-page-hears): Open lists and record pages refresh within seconds when a record changes, including changes made outside the API.
 - [Change stream](../reference/live.md#the-stream): Apps follow record changes over a stream that catches up after a reconnect.
+- [Polling, then a socket](../reference/live.md#polling-then-a-socket): Apps and Node scripts poll for changes first and switch to a WebSocket after 30 seconds, or at once, falling back to polling while the socket is down.
 - [Presence](../reference/channels.md#presence) (beta): Apps see who else has a record open and what each of them tracks, such as online or away, for whoever may read the record.
 - [Broadcasts](../reference/channels.md#broadcasts) (beta): Apps on a record send each other short-lived events, such as typing, which are never stored, as JSON or as bytes, such as a chunk of audio or a drawing stroke; the app's own code sends them too, from an API function, over HTTP or [from SQL](../reference/channels.md#from-sql) with `channels.send()`.

package/skills/protobase/references/features/sign-in-and-accounts.md

@@ -11,6 +11,7 @@ Sign-in methods, users, roles, organizations and tokens.
 - [Existing users table](../reference/auth.md#an-existing-users-table): Sign-in can use the users table another system keeps in the same database.
 - [Users page](../reference/auth.md#users-page): Admins find people, set roles, block them, add accounts and invite people by email.
 - [Password reset](../reference/auth.md#password-reset): People reset a forgotten password through an emailed link.
+- [Password changes](../reference/auth.md#name-password-and-devices): Changing the password signs out every other device and MCP client, and emails the account that its password changed. Guesses at the current password are limited for each account.
 - [Leaked passwords](../reference/auth.md#leaked-passwords): New passwords that appear in a known data breach are refused, when the app turns the check on.
 - [Emailed sign-in codes](../reference/auth.md#emailed-sign-in-codes): People sign in with a code sent to their email. An address with no account is emailed that it has none, so the person tries the one they signed up with. An app can have the sign-in page lead with the code and put the password behind "Use a password".
 - [Changing the address](../reference/auth.md#changing-the-address): People move their account to a new email address from the account page, once they enter the code sent there.

package/skills/protobase/references/features/start-a-project.md

@@ -19,7 +19,8 @@ Start a new app, or an admin over an existing Postgres database, and keep the co
 - [Scaffold from a database](../reference/cli.md#scaffold): Reads your Postgres tables and writes the data config for them, with field types, keys, relations, enums, soft delete, tenants and search filled in, and with `--ui` a first view of each.
 - [Safe re-scaffolding](../reference/cli.md#re-running): Running scaffold again adds only the columns that are not declared yet and leaves your own config code as it is.
 - [Schema drift report](../reference/cli.md#drift-report): After each scaffold, lists declared fields whose column is gone, whose type changed or whose enum values differ, with a suggested fix.
-- [Doctor](../reference/cli.md#doctor): Checks every resource and view against the database, including reads that lack an index, and prints the fix for each problem.
+- [Doctor](../reference/cli.md#doctor): Checks every resource and view against the database, the ones Protobase adds such as webhook subscriptions included, with the reads that lack an index, and prints the fix for each problem.
 - [Admin without a view](../guides/table-to-admin.md#1-the-table-as-it-is): A table with an empty view already gives a working admin with every column, sorting, paging, a record page and a New button.
 - [Agent skills](../reference/cli.md#skill): `protobase skill install` writes agent skills that match the installed version into the project, for the coding agents that work on it.
 - [Docs as Markdown](../getting-started.md#docs-as-markdown): Every docs page is also Markdown at its address plus `.md`, for coding agents and chat assistants.
+- [llms.txt](../getting-started.md#docs-as-markdown): The docs site serves `/llms.txt`, which links every page's Markdown, and the protobase agent skill at `/skills/protobase/SKILL.md`, for chat assistants.

package/skills/protobase/references/getting-started.md

@@ -78,6 +78,8 @@ For a Postgres database you already have, `npm create protobase <database-url>`
 
 Every page of these docs is also Markdown at its address plus `.md`: `https://docs.protobase.net/reference/cli/` is also `https://docs.protobase.net/reference/cli.md`. The code a page shows from example files is written out in it, and its live demos are left out, so a coding agent or a chat assistant reads the page whole. In a project, [`protobase skill install`](reference/cli.md#skill) gives coding agents the docs of the installed version.
 
+A chat assistant starts from [`/llms.txt`](https://docs.protobase.net/llms.txt), which links every page's Markdown and the protobase agent skill of the latest release at [`/skills/protobase/SKILL.md`](https://docs.protobase.net/skills/protobase/SKILL.md), with its references beside it.
+
 The rest of this page works in a clone of this repository, on its example apps in `tests/apps`.
 
 ## Setup

package/skills/protobase/references/guides/mobile-app.md

@@ -44,7 +44,7 @@ With a mobile section, the API answers the app's origins, `capacitor://localhost
 Signing in works in the app as on the web, with nothing more to set up:
 
 - Emailed codes, passwords and the second step of two-factor authentication work. <gap>Passkeys do not work in the app yet.</gap> <gap>Sign-in with another provider does not work in the app yet.</gap>
-- The app calls `/api/auth` through the device's native HTTP, naming its Capacitor origin. With a mobile section, sign-in trusts the Capacitor origin a request names, for that request only, without CORS.
+- The app calls `/api/auth` through the device's native HTTP, naming its Capacitor origin. With a mobile section, sign-in trusts the Capacitor origin a request names, for that request only, without CORS. A POST from a Capacitor origin must send a JSON body: any other is refused with 415, as only a page in the app sends one.
 - The session lives in the device's cookie store, so it survives reloads, updates and relaunches. On iOS, signing in or out within about a second of killing the app may be lost.
 - <gap>"Forgot password?" is not offered in the app, as the emailed link cannot lead back into it.</gap>
 - Page script cannot reach the session cookie, on iOS and Android alike: Capacitor's `CapacitorHttp`, `CapacitorCookies` and `WebView` plugins are refused to it, and so are the app's local file routes. A plugin that reads files for its JavaScript, such as `@capacitor/filesystem`, could still hand the cookie over.
@@ -118,7 +118,7 @@ Use it as the upload key with Play App Signing. Set these variables in your shel
 
 Only Gradle gets them, for the length of the build: npm, its install scripts and Capacitor never do. The build needs the Android SDK and JDK 21.
 
-**iOS**, on a Mac with Xcode: `--team` is your Apple Developer team id, shown in your account's membership details. Xcode signs with the certificates and profiles of the account you added in its settings. For manual signing, pass `--certificate <name>` and `--profile <name>` too. If automatic signing finds no profile for a new app, run `protobase mobile open ios`, pick the team in Signing & Capabilities and archive once from Xcode (Product, Archive), which creates the profile; then build again.
+**iOS**, on a Mac with Xcode: `--team` is your Apple Developer team id, shown in your account's membership details. Xcode signs with the certificates and profiles of the account you added in its settings. For manual signing, pass `--certificate <name>` and `--profile <name>` too. <gap>Manual signing cannot use a certificate or profile name that holds `<`, `>` or `&` because writing the escaped export options is not implemented.</gap> If automatic signing finds no profile for a new app, run `protobase mobile open ios`, pick the team in Signing & Capabilities and archive once from Xcode (Product, Archive), which creates the profile; then build again.
 
 ## 7. Live updates
 

package/skills/protobase/references/reference/api.md

@@ -201,7 +201,7 @@ The API sends no CORS headers until it has something to allow: other websites in
 ## Safety
 
 - Every request runs in a transaction with `SET LOCAL statement_timeout` (`statementTimeoutMs`, default 1 s), so a slow query fails where it runs instead of holding a connection that other requests wait for. List, search, get, histogram, series, map and seek transactions are read-only. A query that runs longer is stopped: a `504` `statement-timeout` that names the request, its limit and the ways out, such as `GET /api/v1/orders ran a query longer than 1 s, so the database stopped it. Make the query faster, such as with an index or a narrower filter, or move the work into a function or job with longQueries: true, whose queries may run up to 30 s.` It goes to the app's error hook (`hooks/error.ts`, `createAdmin`'s `options.onUnhandledError`) and the [error tracker](#error-reporting) like a `500`. A read that needs longer has no way to opt out: give it an index, or move it into a [function](../guides/api-functions.md#long-queries) or [job](jobs.md) with `longQueries`.
-- Under `protobase dev` and `serve`, a request waits at most 2 seconds for a free database connection. When every connection stays busy that long, it is a `503` `connections-busy` with `Retry-After: 1` that names the request, reported the same way, rather than a request that hangs behind slow ones.
+- Under `protobase dev` and `serve`, a request waits at most 2 seconds for a free database connection. When every connection stays busy that long, it is a `503` `connections-busy` with `Retry-After: 1` that names the request, reported the same way, rather than a request that hangs behind slow ones. A request that finds room for a new connection waits up to 30 seconds for it to open, such as while a database that scaled to zero wakes.
 - **Scan guard**: a list, `:search`, `:seek`, `:map` page, card photos, `:facets` and `:aggregate` read only columns an index serves, so they stay cheap however many rows match. The server reads each table's valid indexes from the catalog once, then checks every column the caller's filter, the role's row filter, the sort's first field, a facet's or an aggregate's grouped field and a [`read` parent](access.md#records-that-belong-to-another)'s relation read, and the columns of the parent's own row filter against the parent's table:
   - Comparisons, `in`, null checks, sorts and facets need a btree index with the column as a key, every key before it pinned by the query: by `=` or `in` in the filter (outside `OR` and `NOT`), by the tenant or by soft delete. `(for_sale, status, published_at desc)` serves `for_sale = true AND status = "available"` sorted by `published_at desc`, but not `status` alone. `=` on text may use a pg_trgm index instead.
   - Patterns (`name = "*port*"`), `regex()`, `similar()` and `search()` need a pg_trgm (GIN or GiST) index on each column they read, a `digitsEnd` search field one on its digits; JSON `field:value` needs a GIN index.
@@ -235,6 +235,6 @@ export default defineConfig({
 ```
 
 - **Server:** every `500` with the request it failed, and every `504 statement-timeout` and `503 connections-busy` with the request it names, under `dev`, `serve` and the runtime, besides the default export of `hooks/error.ts` or the console. Under `serve`, the runtime and `worker`, an uncaught exception or unhandled rejection too, which then still ends the process with exit code 1.
-- **Admin app:** uncaught errors and the errors of components that fail to draw. `/api/meta` names the DSN to every signed-in caller, as a browser app always shows its own.
+- **Admin app:** uncaught errors and the errors of components that fail to draw. `/api/meta` names the DSN to every signed-in caller, as a browser app always shows its own. Only the app's own errors are sent: `build`, `build-shell` and `build-plugin` mark every script they write as the app's, and an error none of whose stack frames is in a marked script, such as one raised by a browser extension or a script the browser injects, is dropped. Under `dev`, whose scripts are not built, every error is sent. <gap>An error raised only inside a plugin built by an earlier `build-plugin` cannot be reported because marking a plugin's scripts when the app loads them is not implemented; build the plugin again.</gap>
 - Errors only, with no performance tracing. Before an event leaves, the values of authorization headers, cookies, passwords, tokens and other credentials, in fields and in URLs, are replaced by `[Filtered]`.
 - `environment` names the deployment in the tracker; without it the tracker's default, `production`. `errorReporting: false` turns reporting off whatever the environment says. A DSN that is no `http(s)` URL with a key and a project id stops startup.

package/skills/protobase/references/reference/auth.md

@@ -262,15 +262,19 @@ The signed-in person changes their own name and password, and signs out their ot
 | Client | Endpoint |
 | --- | --- |
 | `updateName(name)` | `POST /api/auth/update-user` with `{ name }` |
-| `changePassword(current, next, signOutOthers)` | `POST /api/auth/change-password` with `{ currentPassword, newPassword, revokeOtherSessions }`, for an account that has a password (a wrong one is `INVALID_PASSWORD`) |
+| `changePassword(current, next)` | `POST /api/auth/change-password` with `{ currentPassword, newPassword }`, for an account that has a password (a wrong one is `INVALID_PASSWORD`) |
 | `setPassword(next)` | `POST /api/auth/account/set-password` with `{ newPassword }`, for an account without a password, such as one that signs in with [emailed codes](#emailed-sign-in-codes) or [GitHub](#sign-in-with-github); one that has a password already is `PASSWORD_ALREADY_SET` |
 | `sessions()` | `GET /api/auth/list-sessions`: the devices signed in now, each `{ token, current, userAgent?, ipAddress?, createdAt, updatedAt, expiresAt, staff? }`, with `current` for this one and `staff` for a [staff session](#staff-sign-in) |
 | `revokeSession(token)` | `POST /api/auth/revoke-session` with `{ token }`: signs out that device |
 | `revokeOtherSessions()` | `POST /api/auth/revoke-other-sessions`: signs out every device but this one |
 
-Signing out a device, or a new password with `signOutOthers`, stops that device's API token at its next request (see [When a token stops working](#when-a-token-stops-working)); this device stays signed in. A first password with `setPassword` signs out no device and disconnects no [MCP client](#oauth-for-mcp-clients); it needs 12 characters like any other, is limited to 5 per minute and client, and is refused while the [sign-in policy](#sign-in-policy) turns passwords off (`403`). A [staff session](#staff-sign-in) cannot change or set the password or sign out the other devices (`STAFF_CANNOT_CHANGE_SIGN_IN`).
+Signing out a device stops that device's API token at its next request (see [When a token stops working](#when-a-token-stops-working)); this device stays signed in. A password change always signs out every other device, whatever `revokeOtherSessions` says, and disconnects the account's [MCP clients](#oauth-for-mcp-clients); this device gets a new session and stays signed in. A first password with `setPassword` signs out no device and disconnects no [MCP client](#oauth-for-mcp-clients); it needs 12 characters like any other, is limited to 5 per minute and client, and is refused while the [sign-in policy](#sign-in-policy) turns passwords off (`403`). A [staff session](#staff-sign-in) cannot change or set the password or sign out the other devices (`STAFF_CANNOT_CHANGE_SIGN_IN`).
 
-On the [account page](#account-page), the `Password` block does both: with a password, it asks for the current one, the new one twice, and whether to sign out the other devices; without one, it sets the first, and nobody is signed out. While the sign-in policy turns passwords off, or in a staff session, it only says so.
+When the app has mail, the account's address is emailed that its password changed, with a link to choose a new one if it was not them: after a change, a first password, a [reset](#password-reset), an admin setting it, and a new password through the [endpoints for supabase-js](#supabase-js-and-supabasessr).
+
+Checks of the signed-in account's current password are limited to 5 a minute for each account, on top of the limit for each client: changing the password, deleting the account, turning [two-factor authentication](#two-factor-authentication) on or off, its authenticator link and new backup codes, and `POST /api/auth/verify-password`. Every check counts, a right one too; one over the limit is refused with `429` (`TOO_MANY_PASSWORD_CHECKS`, with `X-Retry-After` in seconds), so a stolen session cannot guess the password from many addresses. <gap>The current-password limit cannot be shared between server instances, each of which counts on its own, because a shared store for it is not implemented.</gap>
+
+On the [account page](#account-page), the `Password` block does both: with a password, it asks for the current one and the new one twice, and says the other devices are signed out; without one, it sets the first, and nobody is signed out. While the sign-in policy turns passwords off, or in a staff session, it only says so.
 
 The [account page](#account-page)'s Devices tab lists the sessions with this one first and marked, a Sign out on each other one and Sign out of all other devices. It names each by its browser and system from the user agent, and a staff session by the operator alone, such as "Protobase staff" with when it signed in and until when, never the staff member.
 
@@ -704,7 +708,7 @@ An app moving from Supabase keeps its `supabase.auth` calls and its `@supabase/s
   - The sign-in must start at `/api/sb/auth/v1/authorize` in the same browser: `/api/sb/auth/v1/callback` hands a code or a session only at the end of a provider sign-in started there.
   - The browser keeps no Protobase session afterwards: the app holds its own.
   - A wildcard pattern in `auth.trustedOrigins` still trusts every host it matches with the sign-in code, so list only hosts you control.
-- Addresses are proved with the emailed 6-digit code, never a link. `signUp({ email, password, options: { data } })` needs [open sign-up](#open-sign-up) and mails a sign-up code; `verifyOtp({ email, token, type: 'signup' })` makes the account, with `data` in the [user metadata column](#an-existing-users-table), and signs in. Until then there is no account and `signUp` answers no user. `resetPasswordForEmail` mails a sign-in code; `verifyOtp` with `type: 'recovery'` signs in, and `updateUser({ password })` sets the new password.
+- Addresses are proved with the emailed 6-digit code, never a link. `signUp({ email, password, options: { data } })` needs [open sign-up](#open-sign-up) and mails a sign-up code; `verifyOtp({ email, token, type: 'signup' })` makes the account, with `data` in the [user metadata column](#an-existing-users-table), and signs in. Until then there is no account and `signUp` answers no user. `resetPasswordForEmail` mails a sign-in code; `verifyOtp` with `type: 'recovery'` signs in, and `updateUser({ password })` sets the new password. Every new password through `updateUser` signs out the user's other sessions and [MCP clients](#oauth-for-mcp-clients), and emails the address when the app has mail.
 - The access token is ES256, valid for an hour, with Supabase's claims: `sub`, `role: authenticated`, `aud: authenticated`, `email`, `app_metadata`, `user_metadata`, `aal`, `session_id`, issued by `<url>/api/sb/auth/v1`. Its keys are at `/api/sb/auth/v1/.well-known/jwks.json`. It is apart from the EdDSA token of [Tokens and roles](#tokens-and-roles): neither is accepted for the other.
 - The refresh token is the Better Auth session's token. Each refresh gives the session a new one, so a refresh token works once, and signing out, a ban or a revoked session ends it.
 - `email_confirmed_at` is the time the address was confirmed, in the user table's `email_confirmed_at` column. An account verified before that column existed has none.
@@ -749,7 +753,7 @@ auth: { mcp: { path: '/api/mcp', connectPage: '/-/connect' } }
 - Someone who has not set up what the sign-in policy requires is sent to the setup page first. Staff signed in as a person cannot allow a client, nor disconnect one. An account whose address is not verified cannot connect a client until it signs in once with an emailed code: a provider sign-up whose provider did not vouch for the address, or a password account created before Protobase created accounts verified. With password-only sign-in, or without mail, it cannot.
 - The connect page shows the client's name as the client's own claim, who published it for a client with an https id, where the code goes (a website by its host, an app on this computer by its port, or an app on the device by its whole address), and the signed-in address. It cannot be used inside another site's frame, and Allow takes a click only once the page has been in front for half a second. `protobase serve` and `protobase dev` send `X-Frame-Options: DENY` and `Content-Security-Policy: frame-ancestors 'none'` with every page of the UI; a host that serves `public/` itself should send them too.
 - The account page lists the clients a person allowed, under Connected apps, and disconnects any one: its consent is forgotten and its tokens revoked, access tokens already issued included, so it has to ask again. A client published at a URL has one id for everyone, so two copies of it allowed on one account with the same role show as one entry, and disconnecting it disconnects both.
-- Signing out everywhere, signing out the other devices, a password change that signs out the other devices, a password reset, an admin ending the person's sessions, banning them, setting their password or marking their address unverified, and `protobase users disable` disconnect every client and forget which were allowed, so each has to ask again; enabling a disabled user brings none back. Through the [endpoints for supabase-js](#supabase-js-and-supabasessr) the same holds for signing out with the `global` or `others` scope and for every new password set with `PUT /user`, since a password reset ends there too. Signing out of one browser, or a session expiring, disconnects nothing.
+- Signing out everywhere, signing out the other devices, a password change, a password reset, an admin ending the person's sessions, banning them, setting their password or marking their address unverified, and `protobase users disable` disconnect every client and forget which were allowed, so each has to ask again; enabling a disabled user brings none back. Through the [endpoints for supabase-js](#supabase-js-and-supabasessr) the same holds for signing out with the `global` or `others` scope and for every new password set with `PUT /user`, since a password reset ends there too. Signing out of one browser, or a session expiring, disconnects nothing.
 - A refresh token presented again after it was rotated, outside the provider's 30-second window for a retried request, is taken for stolen: that client is disconnected for the person, its access tokens stop at the next request, and it has to ask again. Their other clients keep working.
 
 ## Several origins

package/skills/protobase/references/reference/cli.md

@@ -107,7 +107,7 @@ protobase doctor [connection string | --env VAR] [--config <dir>]
 
 The URL comes as for [`scaffold`](#scaffold): the connection string, the variable `--env` names, or `DATABASE_URL`, each also read from the nearest `.env`.
 
-Imports `config/index.ts` and the views of `config/*/ui.ts`, as the config module has them by convention, and checks every exported resource against the database:
+Imports `config/index.ts` and the views of `config/*/ui.ts`, as the config module has them by convention, and checks every exported resource against the database, with the resources Protobase adds by what `protobase.config.ts` (read with `command: 'tool'`) and the resources enable: the [webhook](webhooks.md#subscriptions-in-the-admin-app) ones of `webhooks`, Failed jobs, [Activity](history.md) and [Comments](comments.md). The tables [`migration`](#migration) writes for those have every index their reads need, so after the project's migrations they pass:
 
 - error: missing table or column, field type that does not fit the column (a file field needs a text column), table without a usable key, configured key not backed by a unique index, `.openExisting()` fields that are not the columns of a unique index, relation to a resource the config does not declare
 - error: a read the [scan guard](api.md#safety) refuses, because no index serves a column it filters, sorts, searches or counts by. Doctor reads each table's indexes from the catalog, as the server does, and judges with the scan guard's own rule every read the API takes and the app makes: a filter on each `.filterable()` field, a sort by each `.sortable()` one, `search()` over the search fields, a role's own records (`.owner()`) and the names a relation shows; each view's list in its order and with the filter it opens with, its filter widgets and their counts, its chart, its map, board, calendar and timeline, its card photos, its order by hand, its related sections, galleries and charts, its named lists, its recent records and a saved search's new records; and each block of a [composed page](layouts.md) that lists records, and each `Chart` block's grouped and split fields. Each error is an index to add, with every request that needs it and where it comes from:
@@ -388,7 +388,7 @@ Serves the API of a bundle from `protobase build` and owns the process around it
 | Variable | |
 | --- | --- |
 | `DATABASE_URL` | the API's pool (Kysely over `pg`, 10 connections) |
-| `PROTOBASE_DB_CONNECTIONS` | the connections that pool opens, such as the database's limit for the app; default 10. Sign-in's store shares them. [API functions](../guides/api-functions.md) and [jobs](jobs.md) hold at most one less, so a long import leaves a connection to page and API requests; those with [`longQueries`](../guides/api-functions.md#long-queries) take theirs from one more connection, kept for them. A query waits at most 2 seconds for a free connection, then fails with `503 connections-busy` ([Safety](api.md#safety)) |
+| `PROTOBASE_DB_CONNECTIONS` | the connections that pool opens, such as the database's limit for the app; default 10. Sign-in's store shares them. [API functions](../guides/api-functions.md) and [jobs](jobs.md) hold at most one less, so a long import leaves a connection to page and API requests; those with [`longQueries`](../guides/api-functions.md#long-queries) take theirs from one more connection, kept for them. A query waits at most 2 seconds for a free connection, then fails with `503 connections-busy` ([Safety](api.md#safety)); a new connection may take up to 30 seconds to open, such as while a database that scaled to zero wakes |
 | `PORT` | default 8787 |
 | `REQUEST_LOG` | `true` logs every request; default `false` |
 | `PROTOBASE_SMTP_URL` | the SMTP server for password-reset mail, emailed sign-in and two-factor codes and the app's own [email](email.md), credential included: `smtp://user:password@host:587` (STARTTLS when offered) or `smtps://...:465`; without it they are off ([Password reset](auth.md#password-reset), [Emailed sign-in codes](auth.md#emailed-sign-in-codes)) |
@@ -610,7 +610,7 @@ Builds the project in the current directory as an iOS or Android app with Capaci
 - `run` runs the app on `--target`, or asks for one. On iOS, `--team` writes the Apple team id into the generated project and builds it once with xcodebuild allowed to create the development profile and register the device, `--target` or the one connected device, before Capacitor runs it there. With `--live` it opens `protobase dev` on `localhost:--port` instead of its own files. `open` opens the native project in Xcode or Android Studio.
 - `build` makes a signed release, an `.aab` (Android) or `.ipa` (iOS), and copies it to `--out`, which ignores itself in git when the command creates it, as `<appId>-<version>-<build number>`. Android signs through Gradle with the keystore, alias and passwords in `PROTOBASE_ANDROID_KEYSTORE`, `PROTOBASE_ANDROID_KEY_ALIAS`, `PROTOBASE_ANDROID_KEYSTORE_PASSWORD` and `PROTOBASE_ANDROID_KEY_PASSWORD`; iOS runs Capacitor's build with `--team`, and `--certificate` with `--profile` for manual signing.
 - A release calls an https server that is not this machine, and `--app-version` (one to three numbers) and `--build-number` (1 to 2100000000) are required.
-- npm and Capacitor get the CLI's environment without any variable named in the current directory's `.env*` files, nor the four `PROTOBASE_ANDROID_*` signing variables, which only Gradle gets, and with `CI=true`, which keeps Capacitor's telemetry off.
+- npm and Capacitor get the CLI's environment without any variable named in the current directory's `.env*` files, nor the four `PROTOBASE_ANDROID_*` signing variables, which only Gradle gets, and with `CI=true`, which keeps Capacitor's telemetry off. The project's config, its extensions' configs and the web build run inside the CLI with no `PROTOBASE_ANDROID_*` variable left in its environment, even one the project's `.env` sets.
 - It prints the workspace, the API origin and the native fingerprint, which the app also sends in its user agent as `ProtobaseNative/<fingerprint>`: a hash of the native packages `@protobase/mobile` pins, at their versions, its own native contract, and the section's `plugins`, at the versions they give. A [mobile release](#mobile-releases) runs only on a binary of its own fingerprint. A Protobase release that pins the same native packages and keeps the same native contract keeps it; raise a plugin's version when the app's files start using a newer native feature of it, which changes it.
 - The app's files carry the live updater's manifest of them, so an update downloads only the files that changed.
 - With `mobile.publicKey`, the Android and iOS app get the [live updater](#the-live-updater), unless `--live` is given, the app's files name no build time, or the API is neither https nor http to this machine; it prints a note why when it leaves it out.

package/skills/protobase/references/reference/comments.md

@@ -64,7 +64,7 @@ Once a resource takes comments, admins get **Comments** (the built-in resource `
 
 ## The table
 
-[`protobase migration`](cli.md#migration) adds the schema `comments` with the table `comments.comments`; apply it with the project's other migrations. `protobase dev` and `protobase serve` do not start while a resource has comments and the table is missing. A deleted record's comments stay in the table.
+[`protobase migration`](cli.md#migration) adds the schema `comments` with the table `comments.comments`; apply it with the project's other migrations. It has an index for each column the Comments list filters on, and the next migration adds one an earlier version's table lacks. `protobase dev` and `protobase serve` do not start while a resource has comments and the table or one of its indexes is missing. A deleted record's comments stay in the table.
 
 | Column | |
 | --- | --- |

package/skills/protobase/references/reference/history.md

@@ -71,7 +71,7 @@ Once a resource has history, admins get **Activity** (the built-in resource `rec
 
 ## The table
 
-[`protobase migration`](cli.md#migration) adds the table `changes.history` to the `changes` schema of the event capture (renamed with `events: { schema }`), and the capture triggers of each resource with history; apply it with the project's other migrations. `protobase dev` and `protobase serve` do not start while the table or a trigger is missing. A resource that drops `.history()` loses its triggers, unless it has events, at the next migration; its changes stay in the table.
+[`protobase migration`](cli.md#migration) adds the table `changes.history` to the `changes` schema of the event capture (renamed with `events: { schema }`), and the capture triggers of each resource with history; apply it with the project's other migrations. It has an index for each column the Activity list filters on, and the next migration adds one an earlier version's table lacks. `protobase dev` and `protobase serve` do not start while the table, one of its indexes or a trigger is missing. A resource that drops `.history()` loses its triggers, unless it has events, at the next migration; its changes stay in the table.
 
 | Column | |
 | --- | --- |

package/skills/protobase/references/reference/layouts.md

@@ -69,7 +69,7 @@ A `RecordCard` (its first match) and each card of a `CardRow` hold a **record**.
 | `status`, `plan.name` | A field of the record around it, through relations. |
 | `invoices.count` | How many `invoices` the user can see (an exact count from the list API). |
 
-Comparisons, `AND`, `OR`, `NOT` and parentheses work. <gap>A condition cannot call functions such as `now()`, as they are not supported.</gap> A field that is missing or that the user cannot read makes the comparison false, and a `Show` that names a resource or field the user cannot see is left out of their page.
+Comparisons, `AND`, `OR`, `NOT`, parentheses, `isNull(field)` and `in(field, "a", "b")` work. <gap>A condition cannot call other functions, such as `now()`, because their evaluation is not implemented.</gap> A field that is missing or that the user cannot read makes the comparison false, and a `Show` that names a resource or field the user cannot see is left out of their page.
 
 Record pages take the same conditions in the `when` of `l.section`, `l.related` and `l.sidebar`; see [Form and read view](ui-config.md#form-and-read-view).
 

package/skills/protobase/references/reference/live.md

@@ -43,6 +43,10 @@ It is live data, not multiplayer editing: two people editing the same record sti
 
 Connecting again with `?after=<cursor>` catches up on what was missed while disconnected. [`client.live({ onChanges, onResync })`](client.md) of `@protobase/client` follows the stream and connects again by itself, as the app does. However many callers of one client follow it, they share one stream, so a page with many live views holds one connection, which matters under HTTP/1.1, where a browser opens at most six to a host.
 
+## Polling, then a socket
+
+`pollThenSocket({ poll, onError, socket, onMessage, pollMs?, switchAfterMs?, socketFirst? })` of `@protobase/client`, in the browser and on Node, keeps up with anything that changes, until the function it returns is called. It calls `poll` at once and again `pollMs` (5 seconds) after each call ends, also after one that rejected, whose error goes to `onError`, and after `switchAfterMs` (30 seconds) opens the WebSocket `socket()` returns, such as `() => new WebSocket(url)`. Once the socket is open, polling stops: `poll` runs once more, for what changed before the socket opened, and `onMessage` gets each message's data. When the socket closes, or never opens, it polls again at once and opens a new socket `switchAfterMs` later. Polling goes on while a socket connects, so nothing waits on it. A short visit thus never opens a socket; `socketFirst: true` opens one at once instead, for a process that stays, and polls only while it is down.
+
 Who is on a record's page and what they send each other, which no change of a record says, goes over the record's [channel](channels.md).
 
 ## The table

package/skills/protobase/references/reference/mcp.md

@@ -100,7 +100,7 @@ export default defineConfig({ auth: { mcp: true }, mcpEndpoint: { writes: true }
 | --- | --- |
 | `create_record` | Creates a record of a resource from `data`, field names to values, and returns its key and ETag with the fields it wrote, see [What a write returns](#what-a-write-returns). |
 | `update_record` | Changes the fields in `data` of one record by its key, and returns its key and new ETag with the fields it set. With the `etag` that `get_record` gave, it fails when someone changed the record since. It does not set the field a soft delete sets: a delete goes through `delete_record`. |
-| `delete_record` | Deletes one record by its key and the `etag` that `get_record` gave, and fails when someone changed the record since. A resource with a [soft delete](data-config.md) keeps the record, deleted; any other loses it for good. |
+| `delete_record` | Deletes one record by its key. With the `etag` that `get_record` gave, it fails when someone changed the record since; without one, or with `*`, it deletes the record whatever its version. A resource with a [soft delete](data-config.md) keeps the record, deleted; any other loses it for good. |
 | `batch_write` | Creates, updates and deletes records across resources in one transaction, see [Batch writes](#batch-writes). |
 
 Each write goes through the REST API as the person: their role's access rules, `validate`, write hooks, events and webhooks apply, so the client can do only what the person may do in the app.

package/skills/protobase/references/reference/versioning.md

@@ -49,6 +49,7 @@ Every commit message follows [Conventional Commits](https://www.conventionalcomm
 3. The tag is pushed, and the GitHub release of the tag gets the notes.
 4. Beside the checks, a pack job takes the tag `bun run release --dry-run` predicts, and `scripts/stamp-version.mjs` writes its version into every `package.json` and `bun.lock` in the runner, never committed. `scripts/publish.mjs --pack --out` then builds every package to `dist` and packs it with Bun (the private `@protobase/presets` is not published). Once the tag is pushed, npm, under Node, publishes those tarballs with [trusted publishing](https://docs.npmjs.com/trusted-publishers) and provenance (`scripts/publish.mjs --from`); there is no npm token, and only the publish job holds the identity token it needs. A tag other than the version the tarballs were stamped with fails the publish before anything is uploaded, and a run that cut no release packs and publishes nothing.
 5. Once npm serves the packages, the tag's version is written into the `package.json` files the same way, and `bun run images:context <image>` writes each image's build context at the tag from them, and the images are built natively for `linux/amd64` and `linux/arm64` and pushed to GitHub's registry as `ghcr.io/prototeamhq/protobase:<version>` and `ghcr.io/prototeamhq/protobase-dev:<version>` (see [Deploy](../guides/deploy.md#images)). A release whose publish failed has no images.
+6. Once npm serves the packages, `scripts/bump-repos/main.ts` starts the `protobase-bump.yml` workflow, with the release's version, of each repository the `PROTOBASE_BUMP_REPOS` secret lists, using the `PROTOBASE_BUMP_TOKEN` secret; an unset or empty list bumps nothing. Each listed repository owns that workflow, with a `version` input: it moves the repository's `@protobase` packages to the release in a pull request of its own, which merges itself once its CI is green and otherwise stays open for a fix. A repository that cannot be started within a minute fails the job after the others were started, and nothing else waits on it.
 
 When `main` moved on while the checks ran, the run of the newer push releases both. `bun run release --dry-run` prints the next version and its notes without tagging anything.
 
@@ -61,11 +62,11 @@ Where a project's `package.json` lists the `@protobase` packages decides whose c
 | `package.json` | Mode | Copies used by `dev`, `build` and `protobase run` | The bundle's `protobase` |
 | --- | --- | --- | --- |
 | `@protobase/*` in `devDependencies` | bundled (what the presets write) | the CLI's own | the CLI's version |
-| `@protobase/*` in `dependencies` | locked | the project's installed copies | the installed version |
+| `@protobase/*` in `dependencies` | locked | the project's installed copies, but the build reads the config with the CLI's own | the installed version |
 | no `@protobase/*`, or no `package.json` | bundled | the CLI's own | the CLI's version |
 
 - **Bundled.** Nothing of Protobase has to be installed: a `protobase.config.ts` alone is a project. The CLI that runs, installed globally or as the project's dev dependency, supplies every `@protobase` package and every package the serve runtime supplies to a bundle (`kysely`, `pg`, `react`, ...), whatever the project installed: to `dev`'s API and page, to the build, to [`protobase run`](cli.md#run) and, through [`protobase types`](cli.md#types), to the editor. Installing a newer CLI that the specifier holds updates the app with no change to its files or lockfile: dev and the next build use it, and the bundle names its version. `@types/react` and `@types/node` stay the project's own dev dependencies, since the CLI carries no types for them.
-- **Locked.** Move every `@protobase` package to `dependencies` at one exact version, and install. Dev, the build and scripts use the installed copies, and the bundle names that version, so a host serves exactly it. A CLI installed elsewhere hands a locked project over to the `@protobase/cli` it installed (see [CLI](cli.md)). The version moves only when the specifier and the lockfile do.
+- **Locked.** Move every `@protobase` package to `dependencies` at one exact version, and install. Dev and scripts use the installed copies, and the bundle names that version, so a host serves exactly it. The build reads the config with the building CLI's own `@protobase` packages, as a serve runtime supplies its own to the bundle, so it loads one copy of each. A CLI installed elsewhere hands a locked project over to the `@protobase/cli` it installed (see [CLI](cli.md)). The version moves only when the specifier and the lockfile do.
 
 Packages the runtime supplies, such as React, may be listed for their types, in either mode: in a bundle the runtime's copy runs, whichever the project installed. `dependencies` holds the packages the project's own code uses at runtime.
 

package/skills/protobase/references/reference/webhooks.md

@@ -116,6 +116,8 @@ It adds two pages, over a `webhooks` schema that [`protobase migration`](cli.md#
 - **Webhook subscriptions** (`webhook_subscriptions`, the table `webhooks.subscriptions`): a name, the events (`orders.created orders.large`, or `orders.*`), the URL, a filter, extra headers, full or thin payload, and whether it is enabled. The server sets the tenant and the owner, the person who made it, and makes the secret, which only a [reveal](api.md#sensitive-fields-and-audit) shows. Saving checks the events and the filter against the resources, and refuses a URL whose host is a private, loopback or link-local address.
 - **Webhook deliveries** (`webhook_deliveries`, a view over the delivery jobs): the deliveries that wait for their next try or failed for good, with their last error. A delivery leaves the list once it succeeds.
 
+The migration gives the subscriptions table an index for each sort, filter and search of its list, and creates the `pg_trgm` extension the search's indexes need (`create extension if not exists pg_trgm`, a trusted extension since Postgres 13, so any role that may create in the database can). A database that has an earlier version's schema gets the indexes from the next `protobase migration`; the server does not start until it is applied.
+
 Both are scoped to the tenant like any resource with `.tenant()`, and their access decides who may do what: `webhook_subscriptions.create`, `webhook_deliveries.update` and so on, as for the app's own resources. A role's wildcard over resources, such as `*.read`, grants none of them: their URLs and secrets let whoever reads them call the receivers, so with roles only admins (`*`) and roles that [name them](access.md#resources-that-need-named-grants) manage webhook subscriptions.
 
 A subscription made here **delivers as its owner**, with the role they act with now in its tenant (the [active role](auth.md#active-role) they last chose, else their first): only records and fields it may read. Letting people make subscriptions therefore grants them nothing they could not read already. The roles are read from the app's sign-in; a project that signs people in otherwise exports its own, `async ({ id, tenant }) => [...]`, as the default of `webhooks/owner-roles.ts`.