@protobase/server 0.14.4 → 0.14.5

package/dist/check-views.js

@@ -1,6 +1,7 @@
 import { relatedErrors } from "./view-related.js";
 import { cardPhotosErrors } from "./view-card-photos.js";
 import { cardFavoriteErrors, favoriteOwnerErrors } from "./view-card-favorite.js";
+import { saveSearchErrors, searchesOfErrors } from "./view-saved-search.js";
 import { mapDisplayErrors, mapErrors } from "./view-map.js";
 import { addressErrors, addressPlaceholders, appHrefError, displayFields, fieldRefsIn, hrefPlaceholders } from "@protobase/schema/internal";
 //#region src/check-views.ts
@@ -75,7 +76,8 @@ const listOfErrors = (model, name, models) => {
 * Fails at startup when a view uses a sensitive field where it would show empty, a display or custom section names a
 * field the resource does not have, labels or colours values its enum does not have, shows a field with a field type of
 * `fieldTypes` (each with the storage types it shows) that does not show it,
-* has a related section, a cards display's photos or favorite button or a `listOf` that do not fit the resources, cards
+* has a related section, a cards display's photos or favorite button, a `listOf`, a "Save search" button or a
+* `searchesOf` that do not fit the resources, cards
 * displays of one list that name different photos, a map that cannot show the
 * record's position or a map display that cannot find the records in its view, or a link to an address the app does not have.
 */
@@ -89,6 +91,7 @@ const checkViews = (registry, views, pages = [], fieldTypes = {}) => {
 		const photos = [...(view.list?.displays ?? []).flatMap((display) => display.kind === "cards" && display.photos ? cardPhotosErrors(display.photos, view.resource, models).map((error) => `display "${display.name}" photos: ${error}`) : []), ...sharedPhotosErrors(view)];
 		const favorites = (view.list?.displays ?? []).flatMap((display) => display.kind === "cards" && display.favorite ? [...cardFavoriteErrors(display.favorite, view.resource, models), ...favoriteOwnerErrors(display.favorite, models)].map((error) => `display "${display.name}" favorite: ${error}`) : []);
 		const listOf = view.listOf === void 0 ? [] : listOfErrors(model, view.listOf, models).map((error) => `listOf: ${error}`);
+		const searches = [...view.saveSearch ? saveSearchErrors(view.saveSearch, view.resource, models, views).map((error) => `saveSearch: ${error}`) : [], ...view.searchesOf ? searchesOfErrors(view.searchesOf, view.resource, models).map((error) => `searchesOf: ${error}`) : []];
 		const maps = [...view.layout.flatMap((item) => item.kind === "map" ? mapErrors(item, model).map((error) => `map "${item.title}": ${error}`) : []), ...(view.list?.displays ?? []).flatMap((display) => display.kind === "map" ? mapDisplayErrors(display, model).map((error) => `display "${display.name}": ${error}`) : [])];
 		return [
 			...sensitiveErrors(view, model),
@@ -100,6 +103,7 @@ const checkViews = (registry, views, pages = [], fieldTypes = {}) => {
 			...photos,
 			...favorites,
 			...listOf,
+			...searches,
 			...maps,
 			...linkErrors(view, model, models, pageNames)
 		].map((problem) => `View "${view.resource}": ${problem}`);

package/dist/index.d.ts

@@ -78,7 +78,8 @@ import { FileRef, formatUri, variantPath } from "./files/uri.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
 import { defineJob, isJobDefinition, jobDefinitions } from "./jobs/define-job.js";
 import { FatalJobError } from "./jobs/run-job.js";
+import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail } from "./mail/define-email.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapOptions, type MemberInput, MissingCredentials, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapOptions, type MemberInput, MissingCredentials, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/index.js

@@ -60,6 +60,7 @@ import { requireEnv } from "./functions/require-env.js";
 import { storeFile } from "./files/store-file.js";
 import { createFileCleanup } from "./files/file-cleanup.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
+import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/jobs/job-types.d.ts

@@ -14,7 +14,7 @@ export type JobContext = {
   };
   /** Aborted when the job's timeout passes, or when the worker shuts down and its grace period ends. */
   signal: AbortSignal;
-  /** Sends plain-text mail through the app's SMTP server (`PROTOBASE_SMTP_URL`, `PROTOBASE_MAIL_FROM`); `undefined` when the app has no mail. */
+  /** Sends mail through the app's SMTP server (`PROTOBASE_SMTP_URL`, `PROTOBASE_MAIL_FROM`); `undefined` when the app has no mail. */
   mail?: Mailer;
 };
 export type JobOptions<Payload> = {

package/dist/mail/define-email.d.ts

@@ -0,0 +1,39 @@
+import { Mailer } from "./smtp-mailer.js";
+//#region src/mail/define-email.d.ts
+export type EmailOptions<Data extends object> = {
+  /** Names the email in errors, such as `welcome` or `listing-alert`. */
+  name: string;
+  /** The subject line, or how to make it from the email's data. */
+  subject: string | ((data: Data) => string);
+  /**
+   * The message as a React component of the email's data, such as one built from React Email's components (`react-email`).
+   * It is rendered to the HTML part, and the plain-text part is made from that HTML.
+   */
+  component: EmailComponent<Data>;
+};
+/** A function component of the email's data, as JSX writes one; typed here so the server's own types need no React. */
+export type EmailComponent<Data> = (props: Data) => unknown;
+/** An email as `render` gives it: the subject and both parts of the body. */
+export type RenderedEmail = {
+  subject: string;
+  html: string;
+  text: string;
+};
+export type EmailTemplate<Data extends object> = {
+  readonly name: string;
+  readonly options: EmailOptions<Data>;
+  /** Renders the email for `data`, without sending it: for a preview, a test, or a mailer of your own. */
+  render(data: Data): Promise<RenderedEmail>;
+  /**
+   * Renders the email for `data` and sends it to `to`: through `mailer` when given, such as a job's `context.mail`,
+   * otherwise through the app's SMTP server (`PROTOBASE_SMTP_URL`, `PROTOBASE_MAIL_FROM`). Rejects when mail is off
+   * or the server refuses the message.
+   */
+  send(to: string, data: Data, mailer?: Mailer): Promise<void>;
+};
+/**
+ * An email the app sends, with typed data: its subject and a React component for its body. Protobase renders it to
+ * HTML with React Email's renderer, makes the plain-text part from that, and sends both through the app's mail.
+ */
+export declare const defineEmail: <Data extends object>(options: EmailOptions<Data>) => EmailTemplate<Data>;
+//#endregion

package/dist/mail/define-email.js

@@ -0,0 +1,42 @@
+import { mailFromVariable, smtpUrlVariable } from "./mail-settings.js";
+import { platformMailer } from "./platform-mailer.js";
+//#region src/mail/define-email.ts
+/** React and React Email's renderer, loaded on the first email rendered, so an app that sends none never loads them. */
+const loadRenderer = async () => {
+	const [{ createElement }, { render, toPlainText }] = await Promise.all([import("react"), import("@react-email/render")]);
+	return {
+		createElement,
+		render,
+		toPlainText
+	};
+};
+/**
+* An email the app sends, with typed data: its subject and a React component for its body. Protobase renders it to
+* HTML with React Email's renderer, makes the plain-text part from that, and sends both through the app's mail.
+*/
+const defineEmail = (options) => {
+	const render = async (data) => {
+		const renderer = await loadRenderer();
+		const html = await renderer.render(renderer.createElement(options.component, data));
+		return {
+			subject: typeof options.subject === "function" ? options.subject(data) : options.subject,
+			html,
+			text: renderer.toPlainText(html)
+		};
+	};
+	const send = async (to, data, mailer = platformMailer()) => {
+		if (!mailer) throw new Error(`Email "${options.name}" cannot be sent: mail is off; set ${smtpUrlVariable} and ${mailFromVariable}`);
+		await mailer.send({
+			to,
+			...await render(data)
+		});
+	};
+	return {
+		name: options.name,
+		options,
+		render,
+		send
+	};
+};
+//#endregion
+export { defineEmail };

package/dist/mail/smtp-mailer.d.ts

@@ -2,7 +2,10 @@
 export type MailMessage = {
   to: string;
   subject: string;
+  /** The plain-text body, which clients that show no HTML show instead. */
   text: string;
+  /** The HTML body, sent beside `text` as the alternative clients show when they can. */
+  html?: string;
 };
 /** Sends one message; rejects when the server refuses it. */
 export type Mailer = {

package/dist/mail/smtp-mailer.js

@@ -1,6 +1,6 @@
 //#region src/mail/smtp-mailer.ts
 /**
-* Plain-text mail over SMTP with Nodemailer: the most used Node SMTP client, maintained, with no dependencies of its
+* Mail over SMTP with Nodemailer: the most used Node SMTP client, maintained, with no dependencies of its
 * own. It is loaded on the first message, so `@protobase/server` itself stays free of Node's network modules.
 *
 * The client greets the server (EHLO) with the sender's domain, the app's own mail name, instead of what the container

package/dist/view-access.js

@@ -1,6 +1,7 @@
 import { relatedErrors } from "./view-related.js";
 import { cardPhotosErrors } from "./view-card-photos.js";
 import { cardFavoriteErrors } from "./view-card-favorite.js";
+import { searchesOfFor } from "./view-saved-search.js";
 import { resolveFieldPath } from "@protobase/layout";
 import { addressErrors, hrefPlaceholders, navRecentErrors, pruneByShape, shapes, tableDisplay } from "@protobase/schema/internal";
 //#region src/view-access.ts
@@ -169,14 +170,17 @@ const viewShape = (resource, model, models, prompted) => shapes.object({
 	saveFeedback: shapes.data,
 	actions: shapes.list(actionShape(model, models)),
 	listOf: shapes.field,
-	signIn: shapes.data
+	signIn: shapes.data,
+	saveSearch: shapes.map((search) => prompted.has(search.resource) || models[search.resource] ? search : void 0),
+	searchesOf: shapes.map((searches) => searchesOfFor(searches, resource, models))
 });
 /**
 * The view with every reference to a field the caller cannot read removed: list columns, sort, search and displays,
 * field hints, filter widgets, record sections, maps and custom components' props, the chart, title and search result, the
 * actions that set or read one, and the sidebar's `recent` group. Nothing in it may name a hidden field. Related sections
-* and links are checked against `models`, the caller's view of every resource, and so are cards' favorite buttons,
-* which stay for a visitor when their resource is one of `prompted`, those that ask the visitor to sign in.
+* and links are checked against `models`, the caller's view of every resource, and so are `searchesOf`, cards' favorite
+* buttons and the "Save search" button; the buttons stay for a visitor when their resource is one of `prompted`, those
+* that ask the visitor to sign in.
 */
 const pruneView = (view, model, models, prompted = /* @__PURE__ */ new Set()) => {
 	const pruned = pruneByShape(view, viewShape(view.resource, model, models, prompted), (name) => Object.hasOwn(model.fields, name));

package/dist/view-saved-search.js

@@ -0,0 +1,49 @@
+//#region src/view-saved-search.ts
+const writable = (model, role, name) => name === void 0 || !model.fields[name]?.readOnly ? [] : [`${role} "${name}" is read-only, so a search cannot be saved or changed`];
+/**
+* What is wrong with a view's `searchesOf` on `resource`, against the app's models: the searched resource is there and
+* its `unseen.field` a filterable timestamp or date, the searches are each user's own, and the fields a save or a control
+* writes are writable.
+*/
+const searchesOfErrors = (searches, resource, models) => {
+	const own = models[resource];
+	const target = models[searches.resource];
+	if (!own || !target) return [`unknown resource "${own ? searches.resource : resource}"`];
+	const seen = searches.unseen && Object.hasOwn(target.fields, searches.unseen.field) ? target.fields[searches.unseen.field] : void 0;
+	return [
+		...own.owner === void 0 ? [`${resource} has no owner, so its searches are not each user's own`] : [],
+		...writable(own, "filter", searches.filter),
+		...writable(own, "name", searches.name),
+		...writable(own, "unseen.seenAt", searches.unseen?.seenAt),
+		...(searches.controls ?? []).flatMap((name) => writable(own, "control", name)),
+		...searches.unseen && !seen ? [`unseen.field: unknown field "${searches.unseen.field}" on ${target.name}`] : [],
+		...seen && !(seen.filterable && (seen.type === "timestamp" || seen.type === "date")) ? [`unseen.field "${seen.name}" on ${target.name} is not a filterable timestamp or date`] : []
+	];
+};
+/** What is wrong with a list page's "Save search" button on `resource`: a view of the searches' resource lists searches of it. */
+const saveSearchErrors = (search, resource, models, views) => {
+	if (!models[search.resource]) return [`unknown resource "${search.resource}"`];
+	return views.some((view) => view.resource === search.resource && view.searchesOf?.resource === resource) ? [] : [`no view of ${search.resource} has searchesOf("${resource}"), so a saved search would be listed nowhere`];
+};
+/**
+* The view's `searchesOf` as one caller may use it, against their models: gone when they cannot list the searched
+* resource or read the filter, the name and the controls narrowed to those they can write, and `unseen` kept while they
+* can write `seenAt` and filter by `field`.
+*/
+const searchesOfFor = (searches, resource, models) => {
+	const own = models[resource];
+	const target = models[searches.resource];
+	if (!own || !target || !Object.hasOwn(own.fields, searches.filter)) return void 0;
+	const canWrite = (name) => Object.hasOwn(own.fields, name) && !own.fields[name].readOnly;
+	const { name, controls, unseen, ...rest } = searches;
+	const kept = controls?.filter(canWrite);
+	const seenKept = unseen && canWrite(unseen.seenAt) && target.fields[unseen.field]?.filterable ? unseen : void 0;
+	return {
+		...rest,
+		...name !== void 0 && canWrite(name) && { name },
+		...kept && kept.length > 0 && { controls: kept },
+		...seenKept && { unseen: seenKept }
+	};
+};
+//#endregion
+export { saveSearchErrors, searchesOfErrors, searchesOfFor };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.14.4",
+  "version": "0.14.5",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,9 +30,10 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.14.4",
-    "@protobase/query": "0.14.4",
-    "@protobase/schema": "0.14.4",
+    "@protobase/layout": "0.14.5",
+    "@protobase/query": "0.14.5",
+    "@protobase/schema": "0.14.5",
+    "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",
     "@simplewebauthn/server": "^13.3.1",
@@ -45,6 +46,8 @@
     "kysely": "^0.29.6",
     "nodemailer": "^10.0.16",
     "pg-boss": "12.37.1",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
     "thumbhash": "^0.1.1",
     "zod": "^4.6.5"
   },