@protobase/server 0.14.4 → 0.14.6

package/dist/changes/event-code-error.js

@@ -0,0 +1,14 @@
+//#region src/changes/event-code-error.ts
+/**
+* An error the app's code threw while a change was dispatched: an event's `match` or filter, a subscription's `when`, or
+* an access rule of the roles it delivers as. Dispatch keeps the change as failed and moves on; any other error, such
+* as the database's, fails the whole dispatch, which is retried.
+*/
+var EventCodeError = class extends Error {
+	name = "EventCodeError";
+	constructor(what, error) {
+		super(`${what} threw: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+	}
+};
+//#endregion
+export { EventCodeError };

package/dist/changes/match-events.js

@@ -1,3 +1,4 @@
+import { EventCodeError } from "./event-code-error.js";
 import { evaluateFilter } from "@protobase/schema";
 import { checkEventFilter } from "@protobase/schema/internal";
 //#region src/changes/match-events.ts
@@ -39,7 +40,13 @@ const eventTest = (model, event, match) => {
 		if (!match) throw new Error(`Resource "${model.name}": event "${event.name}" has no match function`);
 		tests.push((change) => match(contextOf(change)));
 	}
-	return (change) => tests.every((test) => test(change));
+	return (change) => {
+		try {
+			return tests.every((test) => test(change));
+		} catch (error) {
+			throw new EventCodeError(`Event ${event.name} on ${change.resource} ${change.key}`, error);
+		}
+	};
 };
 /**
 * The names of the resource's events a change raises, in declaration order. The filters are checked once, here; `matches`

package/dist/check-views.js

@@ -1,6 +1,7 @@
 import { relatedErrors } from "./view-related.js";
 import { cardPhotosErrors } from "./view-card-photos.js";
 import { cardFavoriteErrors, favoriteOwnerErrors } from "./view-card-favorite.js";
+import { saveSearchErrors, searchesOfErrors } from "./view-saved-search.js";
 import { mapDisplayErrors, mapErrors } from "./view-map.js";
 import { addressErrors, addressPlaceholders, appHrefError, displayFields, fieldRefsIn, hrefPlaceholders } from "@protobase/schema/internal";
 //#region src/check-views.ts
@@ -75,7 +76,8 @@ const listOfErrors = (model, name, models) => {
 * Fails at startup when a view uses a sensitive field where it would show empty, a display or custom section names a
 * field the resource does not have, labels or colours values its enum does not have, shows a field with a field type of
 * `fieldTypes` (each with the storage types it shows) that does not show it,
-* has a related section, a cards display's photos or favorite button or a `listOf` that do not fit the resources, cards
+* has a related section, a cards display's photos or favorite button, a `listOf`, a "Save search" button or a
+* `searchesOf` that do not fit the resources, cards
 * displays of one list that name different photos, a map that cannot show the
 * record's position or a map display that cannot find the records in its view, or a link to an address the app does not have.
 */
@@ -89,6 +91,7 @@ const checkViews = (registry, views, pages = [], fieldTypes = {}) => {
 		const photos = [...(view.list?.displays ?? []).flatMap((display) => display.kind === "cards" && display.photos ? cardPhotosErrors(display.photos, view.resource, models).map((error) => `display "${display.name}" photos: ${error}`) : []), ...sharedPhotosErrors(view)];
 		const favorites = (view.list?.displays ?? []).flatMap((display) => display.kind === "cards" && display.favorite ? [...cardFavoriteErrors(display.favorite, view.resource, models), ...favoriteOwnerErrors(display.favorite, models)].map((error) => `display "${display.name}" favorite: ${error}`) : []);
 		const listOf = view.listOf === void 0 ? [] : listOfErrors(model, view.listOf, models).map((error) => `listOf: ${error}`);
+		const searches = [...view.saveSearch ? saveSearchErrors(view.saveSearch, view.resource, models, views).map((error) => `saveSearch: ${error}`) : [], ...view.searchesOf ? searchesOfErrors(view.searchesOf, view.resource, models).map((error) => `searchesOf: ${error}`) : []];
 		const maps = [...view.layout.flatMap((item) => item.kind === "map" ? mapErrors(item, model).map((error) => `map "${item.title}": ${error}`) : []), ...(view.list?.displays ?? []).flatMap((display) => display.kind === "map" ? mapDisplayErrors(display, model).map((error) => `display "${display.name}": ${error}`) : [])];
 		return [
 			...sensitiveErrors(view, model),
@@ -100,6 +103,7 @@ const checkViews = (registry, views, pages = [], fieldTypes = {}) => {
 			...photos,
 			...favorites,
 			...listOf,
+			...searches,
 			...maps,
 			...linkErrors(view, model, models, pageNames)
 		].map((problem) => `View "${view.resource}": ${problem}`);

package/dist/index.d.ts

@@ -78,7 +78,8 @@ import { FileRef, formatUri, variantPath } from "./files/uri.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
 import { defineJob, isJobDefinition, jobDefinitions } from "./jobs/define-job.js";
 import { FatalJobError } from "./jobs/run-job.js";
+import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail } from "./mail/define-email.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapOptions, type MemberInput, MissingCredentials, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapOptions, type MemberInput, MissingCredentials, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/index.js

@@ -60,6 +60,7 @@ import { requireEnv } from "./functions/require-env.js";
 import { storeFile } from "./files/store-file.js";
 import { createFileCleanup } from "./files/file-cleanup.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
+import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/jobs/job-types.d.ts

@@ -14,7 +14,7 @@ export type JobContext = {
   };
   /** Aborted when the job's timeout passes, or when the worker shuts down and its grace period ends. */
   signal: AbortSignal;
-  /** Sends plain-text mail through the app's SMTP server (`PROTOBASE_SMTP_URL`, `PROTOBASE_MAIL_FROM`); `undefined` when the app has no mail. */
+  /** Sends mail through the app's SMTP server (`PROTOBASE_SMTP_URL`, `PROTOBASE_MAIL_FROM`); `undefined` when the app has no mail. */
   mail?: Mailer;
 };
 export type JobOptions<Payload> = {

package/dist/mail/define-email.d.ts

@@ -0,0 +1,39 @@
+import { Mailer } from "./smtp-mailer.js";
+//#region src/mail/define-email.d.ts
+export type EmailOptions<Data extends object> = {
+  /** Names the email in errors, such as `welcome` or `listing-alert`. */
+  name: string;
+  /** The subject line, or how to make it from the email's data. */
+  subject: string | ((data: Data) => string);
+  /**
+   * The message as a React component of the email's data, such as one built from React Email's components (`react-email`).
+   * It is rendered to the HTML part, and the plain-text part is made from that HTML.
+   */
+  component: EmailComponent<Data>;
+};
+/** A function component of the email's data, as JSX writes one; typed here so the server's own types need no React. */
+export type EmailComponent<Data> = (props: Data) => unknown;
+/** An email as `render` gives it: the subject and both parts of the body. */
+export type RenderedEmail = {
+  subject: string;
+  html: string;
+  text: string;
+};
+export type EmailTemplate<Data extends object> = {
+  readonly name: string;
+  readonly options: EmailOptions<Data>;
+  /** Renders the email for `data`, without sending it: for a preview, a test, or a mailer of your own. */
+  render(data: Data): Promise<RenderedEmail>;
+  /**
+   * Renders the email for `data` and sends it to `to`: through `mailer` when given, such as a job's `context.mail`,
+   * otherwise through the app's SMTP server (`PROTOBASE_SMTP_URL`, `PROTOBASE_MAIL_FROM`). Rejects when mail is off
+   * or the server refuses the message.
+   */
+  send(to: string, data: Data, mailer?: Mailer): Promise<void>;
+};
+/**
+ * An email the app sends, with typed data: its subject and a React component for its body. Protobase renders it to
+ * HTML with React Email's renderer, makes the plain-text part from that, and sends both through the app's mail.
+ */
+export declare const defineEmail: <Data extends object>(options: EmailOptions<Data>) => EmailTemplate<Data>;
+//#endregion

package/dist/mail/define-email.js

@@ -0,0 +1,42 @@
+import { mailFromVariable, smtpUrlVariable } from "./mail-settings.js";
+import { platformMailer } from "./platform-mailer.js";
+//#region src/mail/define-email.ts
+/** React and React Email's renderer, loaded on the first email rendered, so an app that sends none never loads them. */
+const loadRenderer = async () => {
+	const [{ createElement }, { render, toPlainText }] = await Promise.all([import("react"), import("@react-email/render")]);
+	return {
+		createElement,
+		render,
+		toPlainText
+	};
+};
+/**
+* An email the app sends, with typed data: its subject and a React component for its body. Protobase renders it to
+* HTML with React Email's renderer, makes the plain-text part from that, and sends both through the app's mail.
+*/
+const defineEmail = (options) => {
+	const render = async (data) => {
+		const renderer = await loadRenderer();
+		const html = await renderer.render(renderer.createElement(options.component, data));
+		return {
+			subject: typeof options.subject === "function" ? options.subject(data) : options.subject,
+			html,
+			text: renderer.toPlainText(html)
+		};
+	};
+	const send = async (to, data, mailer = platformMailer()) => {
+		if (!mailer) throw new Error(`Email "${options.name}" cannot be sent: mail is off; set ${smtpUrlVariable} and ${mailFromVariable}`);
+		await mailer.send({
+			to,
+			...await render(data)
+		});
+	};
+	return {
+		name: options.name,
+		options,
+		render,
+		send
+	};
+};
+//#endregion
+export { defineEmail };

package/dist/mail/smtp-mailer.d.ts

@@ -2,7 +2,10 @@
 export type MailMessage = {
   to: string;
   subject: string;
+  /** The plain-text body, which clients that show no HTML show instead. */
   text: string;
+  /** The HTML body, sent beside `text` as the alternative clients show when they can. */
+  html?: string;
 };
 /** Sends one message; rejects when the server refuses it. */
 export type Mailer = {

package/dist/mail/smtp-mailer.js

@@ -1,6 +1,6 @@
 //#region src/mail/smtp-mailer.ts
 /**
-* Plain-text mail over SMTP with Nodemailer: the most used Node SMTP client, maintained, with no dependencies of its
+* Mail over SMTP with Nodemailer: the most used Node SMTP client, maintained, with no dependencies of its
 * own. It is loaded on the first message, so `@protobase/server` itself stays free of Node's network modules.
 *
 * The client greets the server (EHLO) with the sender's domain, the app's own mail name, instead of what the container

package/dist/view-access.js

@@ -1,6 +1,7 @@
 import { relatedErrors } from "./view-related.js";
 import { cardPhotosErrors } from "./view-card-photos.js";
 import { cardFavoriteErrors } from "./view-card-favorite.js";
+import { searchesOfFor } from "./view-saved-search.js";
 import { resolveFieldPath } from "@protobase/layout";
 import { addressErrors, hrefPlaceholders, navRecentErrors, pruneByShape, shapes, tableDisplay } from "@protobase/schema/internal";
 //#region src/view-access.ts
@@ -169,14 +170,17 @@ const viewShape = (resource, model, models, prompted) => shapes.object({
 	saveFeedback: shapes.data,
 	actions: shapes.list(actionShape(model, models)),
 	listOf: shapes.field,
-	signIn: shapes.data
+	signIn: shapes.data,
+	saveSearch: shapes.map((search) => prompted.has(search.resource) || models[search.resource] ? search : void 0),
+	searchesOf: shapes.map((searches) => searchesOfFor(searches, resource, models))
 });
 /**
 * The view with every reference to a field the caller cannot read removed: list columns, sort, search and displays,
 * field hints, filter widgets, record sections, maps and custom components' props, the chart, title and search result, the
 * actions that set or read one, and the sidebar's `recent` group. Nothing in it may name a hidden field. Related sections
-* and links are checked against `models`, the caller's view of every resource, and so are cards' favorite buttons,
-* which stay for a visitor when their resource is one of `prompted`, those that ask the visitor to sign in.
+* and links are checked against `models`, the caller's view of every resource, and so are `searchesOf`, cards' favorite
+* buttons and the "Save search" button; the buttons stay for a visitor when their resource is one of `prompted`, those
+* that ask the visitor to sign in.
 */
 const pruneView = (view, model, models, prompted = /* @__PURE__ */ new Set()) => {
 	const pruned = pruneByShape(view, viewShape(view.resource, model, models, prompted), (name) => Object.hasOwn(model.fields, name));

package/dist/view-saved-search.js

@@ -0,0 +1,49 @@
+//#region src/view-saved-search.ts
+const writable = (model, role, name) => name === void 0 || !model.fields[name]?.readOnly ? [] : [`${role} "${name}" is read-only, so a search cannot be saved or changed`];
+/**
+* What is wrong with a view's `searchesOf` on `resource`, against the app's models: the searched resource is there and
+* its `unseen.field` a filterable timestamp or date, the searches are each user's own, and the fields a save or a control
+* writes are writable.
+*/
+const searchesOfErrors = (searches, resource, models) => {
+	const own = models[resource];
+	const target = models[searches.resource];
+	if (!own || !target) return [`unknown resource "${own ? searches.resource : resource}"`];
+	const seen = searches.unseen && Object.hasOwn(target.fields, searches.unseen.field) ? target.fields[searches.unseen.field] : void 0;
+	return [
+		...own.owner === void 0 ? [`${resource} has no owner, so its searches are not each user's own`] : [],
+		...writable(own, "filter", searches.filter),
+		...writable(own, "name", searches.name),
+		...writable(own, "unseen.seenAt", searches.unseen?.seenAt),
+		...(searches.controls ?? []).flatMap((name) => writable(own, "control", name)),
+		...searches.unseen && !seen ? [`unseen.field: unknown field "${searches.unseen.field}" on ${target.name}`] : [],
+		...seen && !(seen.filterable && (seen.type === "timestamp" || seen.type === "date")) ? [`unseen.field "${seen.name}" on ${target.name} is not a filterable timestamp or date`] : []
+	];
+};
+/** What is wrong with a list page's "Save search" button on `resource`: a view of the searches' resource lists searches of it. */
+const saveSearchErrors = (search, resource, models, views) => {
+	if (!models[search.resource]) return [`unknown resource "${search.resource}"`];
+	return views.some((view) => view.resource === search.resource && view.searchesOf?.resource === resource) ? [] : [`no view of ${search.resource} has searchesOf("${resource}"), so a saved search would be listed nowhere`];
+};
+/**
+* The view's `searchesOf` as one caller may use it, against their models: gone when they cannot list the searched
+* resource or read the filter, the name and the controls narrowed to those they can write, and `unseen` kept while they
+* can write `seenAt` and filter by `field`.
+*/
+const searchesOfFor = (searches, resource, models) => {
+	const own = models[resource];
+	const target = models[searches.resource];
+	if (!own || !target || !Object.hasOwn(own.fields, searches.filter)) return void 0;
+	const canWrite = (name) => Object.hasOwn(own.fields, name) && !own.fields[name].readOnly;
+	const { name, controls, unseen, ...rest } = searches;
+	const kept = controls?.filter(canWrite);
+	const seenKept = unseen && canWrite(unseen.seenAt) && target.fields[unseen.field]?.filterable ? unseen : void 0;
+	return {
+		...rest,
+		...name !== void 0 && canWrite(name) && { name },
+		...kept && kept.length > 0 && { controls: kept },
+		...seenKept && { unseen: seenKept }
+	};
+};
+//#endregion
+export { saveSearchErrors, searchesOfErrors, searchesOfFor };

package/dist/webhooks/route-events.js

@@ -1,3 +1,4 @@
+import { EventCodeError } from "../changes/event-code-error.js";
 import { eventPatternMatches } from "./subscription.js";
 import { evaluateFilter } from "@protobase/schema";
 import { checkEventFilter } from "@protobase/schema/internal";
@@ -48,7 +49,12 @@ const subscriptionRouter = (subscriptions, models) => {
 		if (options.enabled === false) return false;
 		if (options.tenant !== void 0 && String(options.tenant) !== String(change.tenant)) return false;
 		const filter = filters.get(`${subscription.name}\0${change.resource}`);
-		return !filter || evaluateFilter(filter, change.after ?? change.before) === true;
+		if (!filter) return true;
+		try {
+			return evaluateFilter(filter, change.after ?? change.before) === true;
+		} catch (error) {
+			throw new EventCodeError(`The when of subscription "${subscription.name}" on ${change.resource} ${change.key}`, error);
+		}
 	};
 	return (change, events) => subscriptions.flatMap((subscription) => {
 		if (!passes(subscription, change)) return [];

package/dist/webhooks/subscriber-view.js

@@ -1,4 +1,5 @@
 import { requestAccess } from "../request-access.js";
+import { EventCodeError } from "../changes/event-code-error.js";
 import { checkRecord, evaluateFilter } from "@protobase/schema";
 //#region src/webhooks/subscriber-view.ts
 /**
@@ -64,8 +65,14 @@ const subscriberEvents = (deps) => {
 		if (!entry) throw new Error(`Not implemented: a change of "${change.resource}", which is no resource of the app`);
 		const cacheKey = `${subscription.name}\0${change.resource}`;
 		if (!accesses.has(cacheKey)) accesses.set(cacheKey, requestAccess(deps, entry, session));
-		const access = await accesses.get(cacheKey);
-		if (!await mayRead(access, change.after ?? change.before)) return void 0;
+		const readable = async () => {
+			const access = await accesses.get(cacheKey);
+			return await mayRead(access, change.after ?? change.before) ? access : void 0;
+		};
+		const access = await readable().catch((error) => {
+			throw new EventCodeError(`The access check of subscription "${subscription.name}" on ${change.resource} ${change.key}`, error);
+		});
+		if (!access) return void 0;
 		return subscriptionEvent(change, event, {
 			fields: Object.keys(access.readable.fields),
 			thin

package/dist/webhooks/webhooks.js

@@ -1,5 +1,6 @@
 import { dispatchJobName } from "../changes/capture-sql.js";
 import { coalesce } from "../changes/coalesce.js";
+import { EventCodeError } from "../changes/event-code-error.js";
 import { eventMatcher } from "../changes/match-events.js";
 import { deleteOutbox, readOutbox } from "../changes/outbox.js";
 import { resourceChange } from "../changes/resource-change.js";
@@ -41,6 +42,9 @@ const deliveryGroup = ({ subscription, change }) => `${subscription.name}:${chan
 *   time: it turns the committed outbox rows into events, makes the first try of every unordered delivery itself,
 *   queues the failures and the ordered deliveries, and deletes the rows in that same transaction. A process that dies
 *   before that commits leaves the rows, and the job's retry delivers them again, under the same `webhook-id`.
+* - `webhooks.dispatch-change`, one change whose app code threw in dispatch: an event's `match` or filter, a
+*   subscription's `when`, or an access rule of its roles. Kept as failed, so dispatch moves on to later changes; a
+*   retry after the fix queues the change's deliveries. Any other error fails the whole dispatch, which is retried.
 * - `webhooks.deliver`, one try of an unordered delivery; a failure queues the next try on the Standard Webhooks
 *   schedule, or Retry-After, and the last one is kept as failed.
 * - `webhooks.deliver-ordered`, the ordered deliveries of one dispatch for one subscription and record, retried with
@@ -138,20 +142,54 @@ const createWebhooks = ({ deps, subscriptions, functions, schema, log, table })
 			}
 		}
 	});
-	const deliveriesOf = async (changes, db) => {
+	const changeDeliveries = async (db) => {
 		const route = subscriptionRouter(await current(db), models);
 		const eventOf = subscriberEvents(deps);
-		const deliveries = [];
-		for (const change of changes) for (const { subscription, event } of route(change, matchers.get(change.resource)(change))) {
-			const shaped = await eventOf(subscription, change, event);
-			if (shaped) deliveries.push({
-				subscription,
-				event: shaped,
-				change
-			});
+		return async (change) => {
+			const deliveries = [];
+			for (const { subscription, event } of route(change, matchers.get(change.resource)(change))) {
+				const shaped = await eventOf(subscription, change, event);
+				if (shaped) deliveries.push({
+					subscription,
+					event: shaped,
+					change
+				});
+			}
+			return deliveries;
+		};
+	};
+	const queueOrdered = async (db, deliveries) => {
+		const groups = /* @__PURE__ */ new Map();
+		for (const delivery of deliveries.filter(({ subscription }) => subscription.options.ordered)) {
+			const group = deliveryGroup(delivery);
+			const payload = groups.get(group) ?? {
+				subscription: delivery.subscription.name,
+				events: []
+			};
+			payload.events.push(delivery.event);
+			groups.set(group, payload);
 		}
-		return deliveries;
+		for (const [group, payload] of groups) await deliverOrdered.enqueue(db, payload, { group });
 	};
+	const dispatchChange = defineJob({
+		name: "webhooks.dispatch-change",
+		maxAttempts: 1,
+		timeout: "5 minutes",
+		run: async ({ change }, { db }) => {
+			const deliveries = await (await changeDeliveries(db))(change);
+			await db.transaction().execute(async (trx) => {
+				for (const { subscription, event } of deliveries.filter(({ subscription }) => !subscription.options.ordered)) {
+					const payload = {
+						subscription: subscription.name,
+						event,
+						attempt: 1
+					};
+					await deliver.enqueue(trx, payload, { key: deliveryKey(payload) });
+				}
+				await queueOrdered(trx, deliveries);
+			});
+		}
+	});
 	const dispatchBatch = async (db, signal) => {
 		const rows = await readOutbox(db, schema, models, batchSize);
 		if (rows.length === 0) return 0;
@@ -159,7 +197,18 @@ const createWebhooks = ({ deps, subscriptions, functions, schema, log, table })
 			const entry = deps.registry.find(change.resource);
 			return entry ? [resourceChange(entry.model, change)] : [];
 		});
-		const deliveries = await deliveriesOf(changes, db);
+		const deliveriesOf = await changeDeliveries(db);
+		const deliveries = [];
+		const failures = [];
+		for (const change of changes) try {
+			deliveries.push(...await deliveriesOf(change));
+		} catch (error) {
+			if (!(error instanceof EventCodeError)) throw error;
+			failures.push({
+				change,
+				error
+			});
+		}
 		const now = deliveries.filter(({ subscription }) => !subscription.options.ordered);
 		const results = await mapLimit(now, parallelAttempts, ({ subscription, event }) => attempt(subscription, event, db, 1, signal));
 		await db.transaction().execute(async (trx) => {
@@ -179,20 +228,12 @@ const createWebhooks = ({ deps, subscriptions, functions, schema, log, table })
 					delay
 				});
 			}
-			const groups = /* @__PURE__ */ new Map();
-			for (const delivery of deliveries.filter(({ subscription }) => subscription.options.ordered)) {
-				const group = deliveryGroup(delivery);
-				const payload = groups.get(group) ?? {
-					subscription: delivery.subscription.name,
-					events: []
-				};
-				payload.events.push(delivery.event);
-				groups.set(group, payload);
-			}
-			for (const [group, payload] of groups) await deliverOrdered.enqueue(trx, payload, { group });
+			await queueOrdered(trx, deliveries);
+			for (const { change } of failures) await dispatchChange.enqueue(trx, { change });
 			await deleteOutbox(trx, schema, rows.map((row) => row.id));
 		});
 		for (const [index, { subscription, event }] of now.entries()) report(subscription.name, event, 1, results[index]);
+		for (const { error } of failures) log(`events kept as failed (webhooks.dispatch-change): ${error.message}`);
 		return rows.length;
 	};
 	const dispatch = defineJob({
@@ -223,6 +264,7 @@ const createWebhooks = ({ deps, subscriptions, functions, schema, log, table })
 	});
 	return { jobs: [
 		dispatch,
+		dispatchChange,
 		deliver,
 		deliverOrdered,
 		...table ? [sendTest] : [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.14.4",
+  "version": "0.14.6",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,9 +30,10 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.14.4",
-    "@protobase/query": "0.14.4",
-    "@protobase/schema": "0.14.4",
+    "@protobase/layout": "0.14.6",
+    "@protobase/query": "0.14.6",
+    "@protobase/schema": "0.14.6",
+    "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",
     "@simplewebauthn/server": "^13.3.1",
@@ -45,6 +46,8 @@
     "kysely": "^0.29.6",
     "nodemailer": "^10.0.16",
     "pg-boss": "12.37.1",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
     "thumbhash": "^0.1.1",
     "zod": "^4.6.5"
   },