@protobase/server 0.25.12 → 0.26.0

package/dist/gotrue/session-json.js

@@ -0,0 +1,34 @@
+import { goTrueAudience } from "./keys.js";
+import { appMetadata, userMetadata } from "./user-json.js";
+//#region src/gotrue/session-json.ts
+/** How long an access token works, in seconds: an hour, as Supabase's do by default. */
+const accessTokenSeconds = 3600;
+/**
+* The claims of a signed-in user's access token, Supabase's: `role` is the database role, `authenticated`, never the
+* user's roles in the app, which Protobase's own tokens carry. `aal1`, as nobody signs in with a second factor here.
+*/
+const accessClaims = ({ user, accounts, sessionId, issuer, now }) => ({
+	iss: issuer,
+	sub: user.id,
+	aud: goTrueAudience,
+	iat: now,
+	exp: now + accessTokenSeconds,
+	email: user.email,
+	app_metadata: appMetadata(accounts),
+	user_metadata: userMetadata(user.metadata),
+	role: "authenticated",
+	aal: "aal1",
+	session_id: sessionId,
+	is_anonymous: false
+});
+/** The session GoTrue answers a sign-in or a refresh with. */
+const goTrueSession = ({ accessToken, refreshToken, issuedAt, user }) => ({
+	access_token: accessToken,
+	token_type: "bearer",
+	expires_in: accessTokenSeconds,
+	expires_at: issuedAt + accessTokenSeconds,
+	refresh_token: refreshToken,
+	user
+});
+//#endregion
+export { accessClaims, accessTokenSeconds, goTrueSession };

package/dist/gotrue/sessions-plugin.js

@@ -0,0 +1,83 @@
+import { goTrueAlgorithm } from "./keys.js";
+import { tokenRefusal } from "../better-auth/policy-plugin.js";
+import { goTrueUser } from "./user-json.js";
+import { accessClaims, goTrueSession } from "./session-json.js";
+import * as z$1 from "zod";
+import { APIError, createAuthEndpoint } from "better-auth/api";
+import { createJwk, signJWT } from "better-auth/plugins";
+import { generateRandomString } from "better-auth/crypto";
+//#region src/gotrue/sessions-plugin.ts
+const refreshTokenNotFound = () => new APIError("BAD_REQUEST", {
+	code: "REFRESH_TOKEN_NOT_FOUND",
+	message: "Invalid Refresh Token: Refresh Token Not Found"
+});
+/**
+* The sessions of the GoTrue-compatible endpoints, which are Better Auth's own: a session's token is the refresh token,
+* so signing out anywhere, a ban or a revoked session ends it, and refreshing gives the session a new token, so each
+* refresh token works once. Server-side endpoints only, for `goTrueRoutes`.
+*/
+const goTrueSessionsPlugin = ({ issuer, jwt, policy }) => {
+	let primaryKeyMade = false;
+	const makePrimaryKey = async (ctx) => {
+		if (primaryKeyMade) return;
+		if (!(await ctx.context.adapter.findMany({ model: "jwks" })).some((key) => key.alg === null || key.alg === void 0 || key.alg === "EdDSA")) await createJwk(ctx, jwt);
+		primaryKeyMade = true;
+	};
+	const sessionOf = async (ctx, sessionToken) => {
+		const found = await ctx.context.internalAdapter.findSession(sessionToken);
+		if (!found) throw refreshTokenNotFound();
+		const user = found.user;
+		const refusal = await tokenRefusal(ctx.context, user, policy);
+		if (refusal) throw new APIError("FORBIDDEN", refusal);
+		const accounts = await ctx.context.internalAdapter.findAccounts(user.id);
+		const now = Math.floor(Date.now() / 1e3);
+		await makePrimaryKey(ctx);
+		const accessToken = await signJWT(ctx, {
+			options: jwt,
+			payload: accessClaims({
+				user,
+				accounts,
+				sessionId: found.session.id,
+				issuer,
+				now
+			}),
+			signingAlgorithm: goTrueAlgorithm
+		});
+		return goTrueSession({
+			accessToken,
+			refreshToken: sessionToken,
+			issuedAt: now,
+			user: goTrueUser(user, accounts)
+		});
+	};
+	return {
+		id: "protobase-gotrue-sessions",
+		endpoints: {
+			/** The GoTrue session of the Better Auth session with `sessionToken`: an access token for it, and the token to refresh it with. */
+			goTrueSession: createAuthEndpoint.serverOnly({
+				method: "POST",
+				body: z$1.object({ sessionToken: z$1.string().min(1) })
+			}, async (ctx) => ctx.json(await sessionOf(ctx, ctx.body.sessionToken))),
+			/**
+			* Refreshes the session whose token is `refreshToken`: gives it a new token and a new lifetime, and answers its
+			* GoTrue session. Of two refreshes with the same token, only one finds it.
+			*/
+			goTrueRefresh: createAuthEndpoint.serverOnly({
+				method: "POST",
+				body: z$1.object({ refreshToken: z$1.string().min(1) })
+			}, async (ctx) => {
+				const { internalAdapter, sessionConfig } = ctx.context;
+				const found = await internalAdapter.findSession(ctx.body.refreshToken);
+				if (!found || new Date(found.session.expiresAt) <= /* @__PURE__ */ new Date()) throw refreshTokenNotFound();
+				const token = generateRandomString(32);
+				if (!await internalAdapter.updateSession(ctx.body.refreshToken, {
+					token,
+					expiresAt: new Date(Date.now() + sessionConfig.expiresIn * 1e3)
+				})) throw refreshTokenNotFound();
+				return ctx.json(await sessionOf(ctx, token));
+			})
+		}
+	};
+};
+//#endregion
+export { goTrueSessionsPlugin };

package/dist/gotrue/token-route.js

@@ -0,0 +1,42 @@
+import { GoTrueError } from "./errors.js";
+import { callBetterAuth, signedInToken } from "./forward.js";
+import { address, readBody } from "./request-body.js";
+import { takeAuthCode } from "./auth-codes.js";
+import { Hono } from "hono";
+import * as z$1 from "zod";
+//#region src/gotrue/token-route.ts
+const passwordGrant = z$1.object({
+	email: address,
+	password: z$1.string().min(1)
+});
+const refreshGrant = z$1.object({ refresh_token: z$1.string().min(1) });
+const pkceGrant = z$1.object({
+	auth_code: z$1.string().min(1),
+	code_verifier: z$1.string().min(1)
+});
+/**
+* `POST /token?grant_type=…`: a session for a password (`password`, through Better Auth's own sign-in, with its rate
+* limit and sign-in policy), for the refresh token of one (`refresh_token`), or for the code a provider's sign-in
+* handed back with its PKCE verifier (`pkce`).
+*/
+const tokenRoute = ({ auth, context, sessionOf }) => new Hono().post("/token", async (c) => {
+	const grant = c.req.query("grant_type");
+	if (grant === "password") {
+		const { json } = await callBetterAuth(auth, c.req.raw, "/sign-in/email", await readBody(c.req.raw, passwordGrant));
+		return c.json(await sessionOf(signedInToken(json)));
+	}
+	if (grant === "refresh_token") {
+		const { refresh_token } = await readBody(c.req.raw, refreshGrant);
+		return c.json(await auth.api.goTrueRefresh({ body: { refreshToken: refresh_token } }));
+	}
+	if (grant === "pkce") {
+		const { auth_code, code_verifier } = await readBody(c.req.raw, pkceGrant);
+		const ctx = await context();
+		const userId = await takeAuthCode(ctx, auth_code, code_verifier);
+		const session = await ctx.internalAdapter.createSession(userId);
+		return c.json(await sessionOf(session.token));
+	}
+	throw new GoTrueError(400, "unsupported_grant_type", "Supported grant types are password, refresh_token and pkce");
+});
+//#endregion
+export { tokenRoute };

package/dist/gotrue/user-json.js

@@ -0,0 +1,46 @@
+//#region src/gotrue/user-json.ts
+const iso = (value) => new Date(value).toISOString();
+const providerName = (providerId) => providerId === "credential" ? "email" : providerId;
+const byAge = (accounts) => [...accounts].sort((a, b) => new Date(a.createdAt).getTime() - new Date(b.createdAt).getTime());
+/** `app_metadata`: the provider the user first signed in with, and every one they can. */
+const appMetadata = (accounts) => {
+	const providers = [...new Set(byAge(accounts).map((account) => providerName(account.providerId)))];
+	return providers.length === 0 ? {} : {
+		provider: providers[0],
+		providers
+	};
+};
+/** `user_metadata`: the user metadata column's object, read as the store returns JSON; empty without one. */
+const userMetadata = (metadata) => {
+	const value = typeof metadata === "string" ? JSON.parse(metadata) : metadata;
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+};
+/** The GoTrue user object of `user`. `confirmed_at` is the address's confirmation, as phones are not offered. */
+const goTrueUser = (user, accounts) => {
+	const confirmedAt = user.emailConfirmedAt ? iso(user.emailConfirmedAt) : void 0;
+	return {
+		id: user.id,
+		aud: "authenticated",
+		role: "authenticated",
+		email: user.email,
+		...confirmedAt && {
+			email_confirmed_at: confirmedAt,
+			confirmed_at: confirmedAt
+		},
+		app_metadata: appMetadata(accounts),
+		user_metadata: userMetadata(user.metadata),
+		identities: byAge(accounts).map((account) => ({
+			identity_id: account.id,
+			id: account.accountId,
+			user_id: account.userId,
+			provider: providerName(account.providerId),
+			created_at: iso(account.createdAt),
+			updated_at: iso(account.updatedAt)
+		})),
+		created_at: iso(user.createdAt),
+		updated_at: iso(user.updatedAt),
+		is_anonymous: false
+	};
+};
+//#endregion
+export { appMetadata, goTrueUser, userMetadata };

package/dist/gotrue/user-routes.js

@@ -0,0 +1,99 @@
+import { effectiveSignInPolicy } from "../better-auth/sign-in-policy.js";
+import { readSignInPolicy } from "../better-auth/policy-store.js";
+import { goTrueUser, userMetadata } from "./user-json.js";
+import { checkNewAccountPassword } from "../better-auth/new-account-password.js";
+import { GoTrueError } from "./errors.js";
+import { readBody } from "./request-body.js";
+import { accessClaimsOf } from "./bearer.js";
+import { goTrueTokens } from "./access-tokens.js";
+import { Hono } from "hono";
+import * as z$1 from "zod";
+//#region src/gotrue/user-routes.ts
+const updateBody = z$1.object({
+	email: z$1.string().optional(),
+	password: z$1.string().optional(),
+	data: z$1.record(z$1.string(), z$1.unknown()).optional()
+});
+const logoutScopes = [
+	"global",
+	"local",
+	"others"
+];
+/**
+* The signed-in user's own endpoints, with their access token: `GET /user`, `PUT /user` for a new password or metadata,
+* and `POST /logout`. A token whose session has ended, by signing out or a ban, is GoTrue's `session_not_found`.
+*/
+const userRoutes = ({ auth, context }) => {
+	const claimsOf = accessClaimsOf(goTrueTokens({ auth }));
+	const signedIn = async (request) => {
+		const claims = await claimsOf(request);
+		const ctx = await context();
+		const user = await ctx.adapter.findOne({
+			model: "session",
+			where: [{
+				field: "id",
+				value: claims.session_id
+			}]
+		}) ? await ctx.internalAdapter.findUserById(claims.sub) : null;
+		if (!user) throw new GoTrueError(403, "session_not_found", "Session from session_id claim in JWT does not exist");
+		return {
+			claims,
+			user,
+			ctx
+		};
+	};
+	const userJson = async ({ user, ctx }) => goTrueUser(user, await ctx.internalAdapter.findAccounts(user.id));
+	const signOut = async (claims, scope) => {
+		const { adapter } = await context();
+		const others = {
+			field: "id",
+			value: claims.session_id,
+			operator: "ne"
+		};
+		const where = scope === "local" ? [{
+			field: "id",
+			value: claims.session_id
+		}] : [{
+			field: "userId",
+			value: claims.sub
+		}, ...scope === "others" ? [others] : []];
+		await adapter.deleteMany({
+			model: "session",
+			where
+		});
+	};
+	return new Hono().get("/user", async (c) => c.json(await userJson(await signedIn(c.req.raw)))).put("/user", async (c) => {
+		const { email, password, data } = await readBody(c.req.raw, updateBody);
+		const found = await signedIn(c.req.raw);
+		const { user, ctx } = found;
+		if (email !== void 0 && email.trim().toLowerCase() !== user.email) throw new GoTrueError(422, "email_change_not_allowed", "Changing the email address is not offered");
+		if (data !== void 0 && !auth.userMetadata) throw new GoTrueError(400, "validation_failed", "This app keeps no user metadata: leave data out");
+		if (password !== void 0) {
+			checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(ctx.adapter)).policy, { mail: auth.mail }), password);
+			const hash = await ctx.password.hash(password);
+			if (await ctx.internalAdapter.findCredentialAccount(user.id)) await ctx.internalAdapter.updatePassword(user.id, hash);
+			else await ctx.internalAdapter.linkAccount({
+				userId: user.id,
+				providerId: "credential",
+				accountId: user.id,
+				password: hash
+			});
+		}
+		const merged = data && Object.fromEntries(Object.entries({
+			...userMetadata(user.metadata),
+			...data
+		}).filter(([, value]) => value !== null));
+		const updated = merged ? await ctx.internalAdapter.updateUser(user.id, { metadata: merged }) : user;
+		return c.json(await userJson({
+			...found,
+			user: updated
+		}));
+	}).post("/logout", async (c) => {
+		const scope = c.req.query("scope") ?? "global";
+		if (!logoutScopes.includes(scope)) throw new GoTrueError(400, "validation_failed", "scope must be global, local or others");
+		await signOut(await claimsOf(c.req.raw), scope);
+		return c.body(null, 204);
+	});
+};
+//#endregion
+export { userRoutes };

package/dist/index.d.ts

@@ -32,6 +32,7 @@ import { RecordKeyInput, ToolRecord, ToolRecords } from "./assistant/records.js"
 import { FunctionRecords, ListParams, RecordPage } from "./functions/records.js";
 import { ApiFunction, CorsOptions, FunctionApp, FunctionCaller, FunctionContext, FunctionHandler, FunctionOptions, FunctionSource, ProtectedFunctionOptions, PublicFunctionContext, PublicFunctionHandler, PublicFunctionOptions, defineFunction } from "./functions/define-function.js";
 import { CorsOrigins } from "./api-cors.js";
+import { ApiKeys, ApiKeysOptions, apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
 import { ConversationRecord, ConversationStore } from "./assistant/conversation-store.js";
 import { Conversation, ConversationsOptions, conversationKey, createConversations } from "./assistant/conversations.js";
 import { ApprovalAnswer, ApprovalRequest, requestApproval } from "./assistant/approval.js";
@@ -46,7 +47,6 @@ import { checkViewQueries } from "./check-view-queries.js";
 import { ProjectConfig, defineConfig, mergeConfig } from "./project-config.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { JwtOptions, JwtVerifyOptions, jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
-import { ApiKeys, ApiKeysOptions, apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
 import { Caller, CallerOptions, apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { HttpProblem, MissingCredentials, badRequest, forbidden, notFound, unauthorized } from "./problem.js";
 import { TrustedApp, withTrustedApps } from "./better-auth/app-tokens.js";

package/dist/index.js

@@ -17,11 +17,16 @@ import { withCacheBreakpoints } from "./assistant/cache-breakpoints.js";
 import { runTurn } from "./assistant/turn.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { webauthnPath } from "./better-auth/origins.js";
-import { readOperatorSettings } from "./better-auth/operator-provider.js";
+import { apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
+import { apiKeyCaller } from "./api-keys/resolve-caller.js";
+import { jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
+import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
+import { readOperatorSettings } from "./better-auth/operator-provider.js";
 import { readPlatformSignIn } from "./better-auth/platform-sign-in.js";
-import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { createAuth, normalizeRoles } from "./better-auth/create-auth.js";
+import { withTrustedApps } from "./better-auth/app-tokens.js";
+import { betterAuthAuthenticator, betterAuthTokens } from "./better-auth/authenticator.js";
 import { addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
 import { createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
@@ -49,11 +54,6 @@ import { handleDroppedConnections } from "./dropped-connections.js";
 import { configExports } from "./resource-source.js";
 import { checkViewQueries } from "./check-view-queries.js";
 import { defineConfig, mergeConfig } from "./project-config.js";
-import { jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
-import { apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
-import { apiKeyCaller } from "./api-keys/resolve-caller.js";
-import { withTrustedApps } from "./better-auth/app-tokens.js";
-import { betterAuthAuthenticator, betterAuthTokens } from "./better-auth/authenticator.js";
 import { issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
 import { checkComputed, computedMigration } from "./computed/computed-schema.js";

package/dist/live/notices-sql.js

@@ -22,7 +22,8 @@ const noticeOf = (row) => ({
 	resource: row.resource,
 	key: row.record_key,
 	operation: row.operation,
-	tenant: row.tenant_id
+	tenant: row.tenant_id,
+	at: row.at
 });
 const tableOf = (schema) => sql.raw(`${quoteIdent(schema)}."notices"`);
 /**
@@ -47,7 +48,8 @@ const writeNotices = async (db, schema, changes) => {
 const lastNotice = async (db, schema) => (await sql`select coalesce(max("id"), 0)::text as id from ${tableOf(schema)}`.execute(db)).rows[0].id;
 /** At most `limit` notices after `after`, in order. */
 const noticesAfter = async (db, schema, after, limit) => {
-	const { rows } = await sql`select "id"::text as id, "resource", "record_key", "tenant_id", "operation" from ${tableOf(schema)}
+	const { rows } = await sql`select "id"::text as id, "resource", "record_key", "tenant_id", "operation",
+      to_char("at" at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') as at from ${tableOf(schema)}
     where "id" > ${after}::bigint order by "id" limit ${limit}`.execute(db);
 	return rows.map(noticeOf);
 };

package/dist/realtime/change-checker.js

@@ -0,0 +1,102 @@
+import { readTransaction } from "../transactions.js";
+import { quoteIdent, tableSql } from "../changes/capture-sql.js";
+import { callerSettings } from "../rest/caller-settings.js";
+import { filterSql } from "./change-filter.js";
+import { decodeKey, encodeKey } from "@protobase/schema/internal";
+import { sql } from "kysely";
+//#region src/realtime/change-checker.ts
+const keyColumns = (entry) => entry.model.primaryKey.map((name) => entry.model.fields[name].column);
+const keyRows = (entry, keys) => {
+	const columns = keyColumns(entry);
+	return JSON.stringify(keys.map((key) => {
+		const decoded = decodeKey(key, entry.keyTypes);
+		const parts = Array.isArray(decoded) ? decoded : [decoded];
+		return Object.fromEntries(columns.map((column, index) => [column, parts[index]]));
+	}));
+};
+const listed = (alias, columns) => sql.raw(columns.map((column) => `${alias}.${quoteIdent(column)}`).join(", "));
+const keyTexts = (alias, entry) => sql.raw(keyColumns(entry).map((column, index) => `${alias}.${quoteIdent(column)}::text as "k${index}"`).join(", "));
+const filterColumns = (alias, filters) => filters.length === 0 ? sql`` : sql`, ${sql.join(filters.map((conditions, index) => sql`${filterSql(alias, conditions)} as ${sql.ref(`f${index}`)}`))}`;
+const seen = (entry, filters, rows) => new Map(rows.map((row) => [encodeKey(keyColumns(entry).map((_, index) => row[`k${index}`])), {
+	record: row.record ?? {},
+	oldRecord: row.old_record,
+	matches: filters.map((_, index) => row[`f${index}`] === true)
+}]));
+/**
+* Checks which changes callers may see, for every group in one read-only transaction: per group it sets the role and
+* claims as `/rest/v1` does, then reads the current rows by key, so the table's RLS policies decide, and evaluates
+* each filter in Postgres, as the column's type compares. The transaction holds one pooled connection only while it
+* runs. A group whose check fails is checked again in a transaction of its own, so it costs only its own callers the
+* batch.
+*/
+const changeChecker = ({ db, statementTimeoutMs, report }) => {
+	const columnCache = /* @__PURE__ */ new Map();
+	const columnsOf = async (trx, entry, role) => {
+		const cached = columnCache.get(`${entry.name}\0${role}`);
+		if (cached) return cached;
+		const { rows } = await sql`select a.attname as name, t.typname as type from pg_attribute a join pg_type t on t.oid = a.atttypid
+      where a.attrelid = to_regclass(${tableSql(entry.model)}) and a.attnum > 0 and not a.attisdropped and has_column_privilege(a.attrelid, a.attnum, 'SELECT')
+      order by a.attnum`.execute(trx);
+		columnCache.set(`${entry.name}\0${role}`, rows);
+		return rows;
+	};
+	const view = async (trx, role, check) => {
+		const columns = await columnsOf(trx, check.entry, role);
+		const names = columns.map((column) => column.name);
+		if (!keyColumns(check.entry).every((column) => names.includes(column))) return {
+			columns,
+			rows: /* @__PURE__ */ new Map(),
+			deleted: /* @__PURE__ */ new Map()
+		};
+		const table = sql.raw(tableSql(check.entry.model));
+		const key = listed("t", keyColumns(check.entry));
+		const rows = check.keys.length === 0 ? [] : (await sql`select ${keyTexts("t", check.entry)}, (select to_jsonb(v) from (select ${listed("t", names)}) v) as record,
+              (select to_jsonb(v) from (select ${key}) v) as old_record${filterColumns("t", check.filters)}
+              from ${table} t where (${key}) in (select ${listed("k", keyColumns(check.entry))} from jsonb_populate_recordset(null::${table}, ${keyRows(check.entry, check.keys)}::jsonb) k)`.execute(trx)).rows;
+		const deleted = check.deleted.length === 0 ? [] : (await sql`select ${keyTexts("k", check.entry)}, (select to_jsonb(v) from (select ${listed("k", keyColumns(check.entry))}) v) as old_record${filterColumns("k", check.filters)}
+              from jsonb_populate_recordset(null::${table}, ${keyRows(check.entry, check.deleted)}::jsonb) k`.execute(trx)).rows;
+		return {
+			columns,
+			rows: seen(check.entry, check.filters, rows),
+			deleted: seen(check.entry, check.filters, deleted)
+		};
+	};
+	const checkGroups = (groups) => readTransaction(db, statementTimeoutMs, async (trx) => {
+		const views = [];
+		for (const group of groups) {
+			const settings = {
+				role: "none",
+				"request.jwt.claim.sub": "",
+				...callerSettings(group.caller)
+			};
+			await sql`select ${sql.join(Object.entries(settings).map(([name, value]) => sql`set_config(${name}, ${value}, true)`))}`.execute(trx);
+			const role = group.caller.role === "app" ? "app" : group.caller.role;
+			const resources = [];
+			for (const check of group.resources) resources.push(await view(trx, role, check));
+			views.push(resources);
+		}
+		return views;
+	});
+	const nothing = (group) => group.resources.map(() => ({
+		columns: [],
+		rows: /* @__PURE__ */ new Map(),
+		deleted: /* @__PURE__ */ new Map()
+	}));
+	return async (groups) => {
+		if (groups.length === 0) return [];
+		return checkGroups(groups).catch(async (error) => {
+			if (groups.length === 1) {
+				report(error);
+				return [nothing(groups[0])];
+			}
+			const views = [];
+			for (const group of groups) views.push(await checkGroups([group]).then((checked) => checked[0], (failed) => {
+				report(failed);
+				return nothing(group);
+			}));
+			return views;
+		});
+	};
+};
+//#endregion
+export { changeChecker };

package/dist/realtime/change-filter.js

@@ -0,0 +1,106 @@
+import { quoteIdent } from "../changes/capture-sql.js";
+import { sql } from "kysely";
+//#region src/realtime/change-filter.ts
+/** The operators of a `postgres_changes` filter, as Supabase Realtime takes them, and the SQL each is. */
+const operators = {
+	eq: "=",
+	neq: "<>",
+	lt: "<",
+	lte: "<=",
+	gt: ">",
+	gte: ">=",
+	in: "= any",
+	like: "like",
+	ilike: "ilike",
+	match: "~",
+	imatch: "~*",
+	is: "is",
+	isdistinct: "is distinct from"
+};
+const isOperator = (name) => Object.hasOwn(operators, name);
+const isKeyword = /* @__PURE__ */ new Set([
+	"null",
+	"true",
+	"false",
+	"unknown"
+]);
+const segments = (filter) => {
+	const parts = [];
+	let current = "";
+	let depth = 0;
+	let quoted = false;
+	for (let index = 0; index < filter.length; index++) {
+		const char = filter[index];
+		if (quoted && char === "\\") {
+			current += char + (filter[++index] ?? "");
+			continue;
+		}
+		if (char === "\"" && (quoted || [
+			".",
+			"(",
+			","
+		].includes(current.at(-1) ?? ","))) quoted = !quoted;
+		else if (!quoted && char === "(") depth++;
+		else if (!quoted && char === ")") depth = Math.max(0, depth - 1);
+		else if (!quoted && depth === 0 && char === ",") {
+			parts.push(current);
+			current = "";
+			continue;
+		}
+		current += char;
+	}
+	return [...parts, current];
+};
+const unquote = (value) => {
+	if (!value.startsWith("\"") || !value.endsWith("\"") || value.length < 2) return value;
+	return value.slice(1, -1).replace(/\\(.)/g, "$1");
+};
+const condition = (segment) => {
+	const trimmed = segment.trim();
+	if (trimmed === "") return "filter must not contain empty segments (check for extra commas)";
+	const equals = trimmed.indexOf("=");
+	if (equals < 1) return `invalid filter "${trimmed}": use column=operator.value`;
+	const column = trimmed.slice(0, equals);
+	let rest = trimmed.slice(equals + 1);
+	const negate = rest.startsWith("not.");
+	if (negate) rest = rest.slice(4);
+	const dot = rest.indexOf(".");
+	if (dot < 0) return `invalid filter "${trimmed}": use column=operator.value`;
+	const operator = rest.slice(0, dot);
+	const value = rest.slice(dot + 1);
+	if (!isOperator(operator)) return `invalid filter "${trimmed}": unknown operator "${operator}"`;
+	if (operator === "in") {
+		if (!value.startsWith("(") || !value.endsWith(")")) return "`in` filter value must be wrapped by parentheses";
+		return {
+			column,
+			operator,
+			value: `{${value.slice(1, -1)}}`,
+			negate
+		};
+	}
+	if (operator === "is" && !isKeyword.has(value)) return "invalid value for is filter: must be null, true, false, or unknown";
+	return {
+		column,
+		operator,
+		value: unquote(value),
+		negate
+	};
+};
+/** The conditions of a filter, all of which a row must meet; an error message for one Supabase refuses too. */
+const parseFilter = (filter) => {
+	if (filter === void 0 || filter.trim() === "") return [];
+	const parsed = segments(filter.trim()).map(condition);
+	return parsed.find((item) => typeof item === "string") ?? parsed;
+};
+const conditionSql = (alias, { column, operator, value, negate }) => {
+	const target = sql.raw(`${alias}.${quoteIdent(column)}`);
+	const test = operator === "is" ? sql`${target} is ${sql.raw(value)}` : operator === "in" ? sql`${target} = any(${value})` : sql`${target} ${sql.raw(operators[operator])} ${value}`;
+	return negate ? sql`not (${test})` : test;
+};
+/**
+* Whether the row `alias` meets every condition, as a boolean that is never null: a condition Postgres answers with
+* null, such as one on a null column, is not met, as on Supabase.
+*/
+const filterSql = (alias, conditions) => conditions.length === 0 ? sql`true` : sql`coalesce(${sql.join(conditions.map((item) => conditionSql(alias, item)), sql` and `)}, false)`;
+//#endregion
+export { filterSql, parseFilter };