@protobase/server 0.34.3 → 0.36.0

package/dist/index.d.ts

@@ -62,6 +62,7 @@ import { passwordLength } from "./better-auth/new-account-password.js";
 import { isOAuthWellKnownPath, oauthWellKnownPaths, webauthnPath } from "./better-auth/origins.js";
 import { goTruePath } from "./gotrue/keys.js";
 import { supabasePath } from "./supabase-paths.js";
+import { realtimeLimits } from "./realtime/realtime-limits.js";
 import { defaultAppName } from "./app-name.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
 import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
@@ -111,4 +112,4 @@ import { isSchedule } from "./jobs/schedule.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, realtimeLimits, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/index.js

@@ -21,6 +21,7 @@ import { isOAuthWellKnownPath, oauthWellKnownPaths, webauthnPath } from "./bette
 import { apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
 import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
+import { realtimeLimits } from "./realtime/realtime-limits.js";
 import { objectKey } from "./storage/object-key.js";
 import { defaultAppName } from "./app-name.js";
 import { supabasePath } from "./supabase-paths.js";
@@ -82,4 +83,4 @@ import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/p
 import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, realtimeLimits, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/realtime/broadcast-hub.js

@@ -1,10 +1,14 @@
+import { fixedWindows } from "./fixed-window.js";
+import { realtimeLimits } from "./realtime-limits.js";
 //#region src/realtime/broadcast-hub.ts
 /**
 * The channels of a process by topic, which hear each other's broadcasts in-process: a cloud app runs as one process,
-* so channels of other processes are not reached.
+* so channels of other processes are not reached. A topic takes `realtimeLimits.topicBroadcastsPerSecond`, whoever sends
+* them; its window is kept here, so a topic left empty and joined again does not start a new one.
 */
-const broadcastHub = () => {
+const broadcastHub = ({ now = () => Date.now() } = {}) => {
 	const topics = /* @__PURE__ */ new Map();
+	const rate = fixedWindows(realtimeLimits.topicBroadcastsPerSecond, 1e3, now);
 	return {
 		/** Puts the member on the topic until the returned function takes it off. */
 		join: (topic, member) => {
@@ -15,9 +19,14 @@ const broadcastHub = () => {
 				if (members.size === 0 && topics.get(topic) === members) topics.delete(topic);
 			};
 		},
-		/** Sends a broadcast to the topic's members, the sender only when it hears its own. */
+		/**
+		* Sends a broadcast to the topic's members, the sender only when it hears its own. `false`, sending nothing, when the
+		* topic has taken its broadcasts for this second.
+		*/
 		send: (topic, from, event, payload) => {
+			if (!rate(topic)) return false;
 			for (const member of topics.get(topic) ?? []) if (member !== from || member.self) member.receive(event, payload);
+			return true;
 		}
 	};
 };

package/dist/realtime/buffered-amount.js

@@ -0,0 +1,14 @@
+//#region src/realtime/buffered-amount.ts
+const isObject = (value) => typeof value === "object" && value !== null;
+/**
+* The bytes a WebSocket of npm `ws` was sent and has not written out, or `undefined` for any other raw socket. Only one
+* that has the sender and socket that `ws`'s `bufferedAmount` counts is taken: Bun's own `ws` shim has a
+* `bufferedAmount` too, but it stays 0 however much waits.
+*/
+const bufferedOf = (raw) => {
+	if (!isObject(raw) || !isObject(raw._sender) || !isObject(raw._socket)) return void 0;
+	const amount = raw.bufferedAmount;
+	return typeof amount === "number" && Number.isFinite(amount) ? amount : void 0;
+};
+//#endregion
+export { bufferedOf };

package/dist/realtime/fixed-window.js

@@ -0,0 +1,28 @@
+//#region src/realtime/fixed-window.ts
+/**
+* At most `max` takes per key in a fixed window of `windowMs`, which all keys share: it starts at the first take after
+* the last one ended, and then every count starts over, so memory follows the keys of the current window. A refused take
+* does not count. Returns whether one more take for the key fits.
+*/
+const fixedWindows = (max, windowMs, now = () => Date.now()) => {
+	let start = -Infinity;
+	let counts = /* @__PURE__ */ new Map();
+	return (key) => {
+		const at = now();
+		if (at - start >= windowMs) {
+			start = at;
+			counts = /* @__PURE__ */ new Map();
+		}
+		const count = counts.get(key) ?? 0;
+		if (count >= max) return false;
+		counts.set(key, count + 1);
+		return true;
+	};
+};
+/** `fixedWindows` for one key. */
+const fixedWindow = (max, windowMs, now = () => Date.now()) => {
+	const take = fixedWindows(max, windowMs, now);
+	return () => take("");
+};
+//#endregion
+export { fixedWindow, fixedWindows };

package/dist/realtime/realtime-limits.d.ts

@@ -0,0 +1,29 @@
+//#region src/realtime/realtime-limits.d.ts
+/**
+ * What one socket and one topic of `/api/sb/realtime/v1` may do, near Supabase Realtime's own limits so an app within
+ * its Free plan works as before. Each value names its Supabase setting, or says it has none.
+ */
+export declare const realtimeLimits: {
+  /** A whole frame: the Free plan's 256 KB broadcast payload, with room for the envelope. */
+  maxFrameBytes: number;
+  /** Broadcast and presence pushes per socket (`TENANT_MAX_EVENTS_PER_SECOND`). */
+  eventsPerSecond: number;
+  /** `phx_join`s per socket (`TENANT_MAX_JOINS_PER_SECOND`). */
+  joinsPerSecond: number;
+  /** Broadcasts into one topic, every socket's together; no counterpart. */
+  topicBroadcastsPerSecond: number;
+  /** Presence pushes per socket and topic in a window (`CLIENT_PRESENCE_MAX_CALLS`). */
+  presencePerWindow: number;
+  /** `CLIENT_PRESENCE_WINDOW_MS`. */
+  presenceWindowMs: number;
+  /** The JSON of one tracked meta, in bytes. */
+  maxPresenceBytes: number;
+  /** Channels joined at once per socket (`TENANT_MAX_CHANNELS_PER_CLIENT`). */
+  channelsPerSocket: number;
+  /** Output sent to a client that it has not read yet; no counterpart. */
+  maxUnsentBytes: number;
+  /** Input waiting to be handled, such as behind a token check; no counterpart. */
+  maxQueuedMessages: number;
+  maxQueuedBytes: number;
+};
+//#endregion

package/dist/realtime/realtime-limits.js

@@ -0,0 +1,30 @@
+//#region src/realtime/realtime-limits.ts
+/**
+* What one socket and one topic of `/api/sb/realtime/v1` may do, near Supabase Realtime's own limits so an app within
+* its Free plan works as before. Each value names its Supabase setting, or says it has none.
+*/
+const realtimeLimits = {
+	/** A whole frame: the Free plan's 256 KB broadcast payload, with room for the envelope. */
+	maxFrameBytes: 262144,
+	/** Broadcast and presence pushes per socket (`TENANT_MAX_EVENTS_PER_SECOND`). */
+	eventsPerSecond: 100,
+	/** `phx_join`s per socket (`TENANT_MAX_JOINS_PER_SECOND`). */
+	joinsPerSecond: 100,
+	/** Broadcasts into one topic, every socket's together; no counterpart. */
+	topicBroadcastsPerSecond: 100,
+	/** Presence pushes per socket and topic in a window (`CLIENT_PRESENCE_MAX_CALLS`). */
+	presencePerWindow: 5,
+	/** `CLIENT_PRESENCE_WINDOW_MS`. */
+	presenceWindowMs: 3e4,
+	/** The JSON of one tracked meta, in bytes. */
+	maxPresenceBytes: 1e4,
+	/** Channels joined at once per socket (`TENANT_MAX_CHANNELS_PER_CLIENT`). */
+	channelsPerSocket: 100,
+	/** Output sent to a client that it has not read yet; no counterpart. */
+	maxUnsentBytes: 4194304,
+	/** Input waiting to be handled, such as behind a token check; no counterpart. */
+	maxQueuedMessages: 300,
+	maxQueuedBytes: 4194304
+};
+//#endregion
+export { realtimeLimits };

package/dist/realtime/realtime-routes.js

@@ -1,5 +1,6 @@
 import { HttpProblem } from "../problem.js";
 import { broadcastHub } from "./broadcast-hub.js";
+import { bufferedOf } from "./buffered-amount.js";
 import { vsnOf } from "./phoenix-message.js";
 import { presenceHub } from "./presence-hub.js";
 import { realtimeSocket } from "./realtime-socket.js";
@@ -12,7 +13,8 @@ const keyRequest = (apikey, token) => new Request("http://realtime.invalid/", {
 /**
 * `GET /api/sb/realtime/v1/websocket?apikey=…&vsn=…`: Supabase Realtime's socket, for `postgres_changes` of the live
 * resources, and broadcasts and presence between the sockets of this process (see `realtimeSocket`). A missing or wrong
-* key is refused before the upgrade, with 401.
+* key is refused before the upgrade, with 401. A socket whose raw socket is not one of npm `ws`, such as Bun's own `ws`
+* shim's, is closed at once with 1011, since its unsent bytes cannot be counted (`realtimeLimits.maxUnsentBytes`).
 */
 const realtimeRoutes = ({ upgradeWebSocket, caller, live, hub, report }) => {
 	const app = new Hono();
@@ -29,10 +31,15 @@ const realtimeRoutes = ({ upgradeWebSocket, caller, live, hub, report }) => {
 		let socket;
 		return {
 			onOpen: (_event, ws) => {
+				if (bufferedOf(ws.raw) === void 0) {
+					report(/* @__PURE__ */ new Error("Not implemented: realtime needs WebSockets of npm ws, which count unsent bytes; on Bun, load npm ws by its path rather than Bun's ws shim, or run on Node"));
+					return ws.close(1011);
+				}
 				socket = realtimeSocket({
 					vsn: vsnOf(c.req.query("vsn")),
 					send: (frame) => ws.send(frame),
-					close: () => ws.close(),
+					buffered: () => bufferedOf(ws.raw),
+					close: (code) => ws.close(code),
 					resolve: (token) => caller(keyRequest(apikey, token)),
 					live,
 					hub,
@@ -42,9 +49,8 @@ const realtimeRoutes = ({ upgradeWebSocket, caller, live, hub, report }) => {
 					report
 				});
 			},
-			onMessage: (event) => {
-				if (typeof event.data === "string" || event.data instanceof ArrayBuffer) socket?.message(event.data);
-			},
+			onMessage: (event) => socket?.message(event.data),
+			onError: () => socket?.closed(),
 			onClose: () => socket?.closed()
 		};
 	}));

package/dist/realtime/realtime-socket.js

@@ -1,11 +1,23 @@
 import { HttpProblem } from "../problem.js";
 import { parseBindings } from "./postgres-changes.js";
+import { fixedWindow, fixedWindows } from "./fixed-window.js";
+import { realtimeLimits } from "./realtime-limits.js";
 import { decodeMessage, encodeMessage, reply } from "./phoenix-message.js";
 import { decodeBroadcastPush, encodeBroadcast, fitsFrame } from "./broadcast-frame.js";
 import { randomUUID } from "node:crypto";
+import { Buffer } from "node:buffer";
 //#region src/realtime/realtime-socket.ts
 const tokenOf = (payload) => typeof payload.access_token === "string" && payload.access_token !== "" ? payload.access_token : void 0;
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const messageTooBig = 1009;
+const policyViolation = 1008;
+const frameBytes = (frame) => {
+	if (typeof frame === "string") return Buffer.byteLength(frame);
+	if (frame instanceof ArrayBuffer || ArrayBuffer.isView(frame)) return frame.byteLength;
+	if (frame instanceof Blob) return frame.size;
+	return NaN;
+};
+const tooFast = "Too many messages per second";
 const refusal = (error) => {
 	if (error instanceof HttpProblem && error.status === 401) return error.detail;
 	throw error;
@@ -15,12 +27,42 @@ const refusal = (error) => {
 * `postgres_changes` bindings and an access token, token refreshes on an open channel, broadcasts with their `self`
 * and `ack` options, presence tracking, and leaves. A channel's token ends it when it expires, unless a newer one came
 * first. Messages are handled one at a time, in order. Private channels are refused for now.
+*
+* It holds a client to `realtimeLimits`: a push over a rate, a channel over the cap or a presence meta too big gets an
+* error reply where Supabase would close the channel, and is not relayed. Rates count per socket, presence per socket
+* and topic, so leaving and joining again does not reset them; the broadcast hub counts each topic's. The socket is
+* closed, 1009, for a frame over the size cap, and 1008 when its client leaves too much unread or sends too much while
+* earlier messages wait. A close, the client's or the server's, leaves every channel, a join still checking its token
+* included, and drops whatever is still queued.
 */
-const realtimeSocket = ({ vsn, send, close, resolve, live, hub, broadcasts, presences, nextId, report, idleMs = 6e4, now = Date.now }) => {
+const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, broadcasts, presences, nextId, report, idleMs = 6e4, now = Date.now }) => {
 	const channels = /* @__PURE__ */ new Map();
 	let queue = Promise.resolve();
+	let queuedMessages = 0;
+	let queuedBytes = 0;
 	let idle;
-	const push = (message) => send(encodeMessage(vsn, message));
+	let open = true;
+	const events = fixedWindow(realtimeLimits.eventsPerSecond, 1e3, now);
+	const joins = fixedWindow(realtimeLimits.joinsPerSecond, 1e3, now);
+	const presenceRate = fixedWindows(realtimeLimits.presencePerWindow, realtimeLimits.presenceWindowMs, now);
+	const leaveAll = () => {
+		open = false;
+		clearTimeout(idle);
+		for (const topic of [...channels.keys()]) leave(topic);
+	};
+	const shut = (code) => {
+		if (!open) return;
+		open = false;
+		clearTimeout(idle);
+		close(code);
+		Promise.resolve().then(leaveAll).catch(report);
+	};
+	const deliver = (frame) => {
+		if (!open) return;
+		if (!(buffered() <= realtimeLimits.maxUnsentBytes)) return shut(policyViolation);
+		send(frame);
+	};
+	const push = (message) => deliver(encodeMessage(vsn, message));
 	const toChannel = (topic, channel, event, payload) => push({
 		joinRef: channel.joinRef,
 		ref: null,
@@ -29,7 +71,7 @@ const realtimeSocket = ({ vsn, send, close, resolve, live, hub, broadcasts, pres
 		payload
 	});
 	const hear = (topic, channel, event, payload) => {
-		if (vsn === "2.0.0") return send(encodeBroadcast(topic, event, payload));
+		if (vsn === "2.0.0") return deliver(encodeBroadcast(topic, event, payload));
 		if (payload instanceof ArrayBuffer) return;
 		toChannel(topic, channel, "broadcast", {
 			type: "broadcast",
@@ -62,12 +104,16 @@ const realtimeSocket = ({ vsn, send, close, resolve, live, hub, broadcasts, pres
 		channel.expiry = setTimeout(() => end(topic, "Token has expired"), Math.max(0, exp * 1e3 - now()));
 	};
 	const join = async (message) => {
+		if (!joins()) return push(reply(message, "error", { reason: "ClientJoinRateLimitReached: Too many joins per second" }));
+		if (!fitsFrame(message.topic)) return push(reply(message, "error", { reason: "A topic is at most 255 bytes" }));
+		if (!channels.has(message.topic) && channels.size >= realtimeLimits.channelsPerSocket) return push(reply(message, "error", { reason: "ChannelRateLimitReached: Too many channels" }));
 		leave(message.topic);
 		const config = isRecord(message.payload.config) ? message.payload.config : {};
 		if (config.private === true) return push(reply(message, "error", { reason: "Not implemented: private channels" }));
 		const broadcast = isRecord(config.broadcast) ? config.broadcast : {};
 		const presence = isRecord(config.presence) ? config.presence : {};
 		const caller = await resolve(tokenOf(message.payload)).catch(refusal);
+		if (!open) return;
 		if (typeof caller === "string") return push(reply(message, "error", { reason: caller }));
 		const parsed = parseBindings(config.postgres_changes, live, nextId);
 		if (typeof parsed === "string") return push(reply(message, "error", { reason: parsed }));
@@ -122,19 +168,24 @@ const realtimeSocket = ({ vsn, send, close, resolve, live, hub, broadcasts, pres
 	};
 	const sendBroadcast = (message, channel) => {
 		const { event, payload } = message.payload;
+		if (!events()) return push(reply(message, "error", { reason: tooFast }));
 		if (typeof event !== "string") return push(reply(message, "error", { reason: "A broadcast needs an event" }));
 		if (!fitsFrame(message.topic) || !fitsFrame(event)) return push(reply(message, "error", { reason: "A broadcast topic and event are at most 255 bytes each" }));
-		broadcasts.send(message.topic, channel.member, event, payload);
+		if (!broadcasts.send(message.topic, channel.member, event, payload)) return push(reply(message, "error", { reason: `${tooFast} on this topic` }));
 		if (channel.ack) push(reply(message, "ok", {}));
 	};
 	const updatePresence = (message, channel) => {
 		const { event, payload } = message.payload;
+		if (!events()) return push(reply(message, "error", { reason: tooFast }));
+		if (!presenceRate(message.topic)) return push(reply(message, "error", { reason: "Client presence rate limit exceeded" }));
+		if (event === "track" && isRecord(payload) && Buffer.byteLength(JSON.stringify(payload)) > realtimeLimits.maxPresenceBytes) return push(reply(message, "error", { reason: "Track message size exceeded" }));
 		if (event === "track" && isRecord(payload)) channel.presence.track(payload);
 		else if (event === "untrack") channel.presence.untrack();
 		else return push(reply(message, "error", { reason: "A presence message tracks an object or untracks" }));
 		push(reply(message, "ok", {}));
 	};
 	const handle = async (message) => {
+		if (!open) return;
 		if (message.topic === "phoenix") {
 			if (message.event === "heartbeat") push(reply(message, "ok", {}));
 			return;
@@ -160,25 +211,35 @@ const realtimeSocket = ({ vsn, send, close, resolve, live, hub, broadcasts, pres
 	};
 	const stayAwake = () => {
 		clearTimeout(idle);
-		idle = setTimeout(close, idleMs);
+		idle = setTimeout(() => shut(), idleMs);
 	};
 	stayAwake();
+	const fail = (error) => {
+		report(error);
+		shut();
+	};
 	return {
-		/** Handles a frame after those before it: text, or binary for a broadcast. */
+		/**
+		* Handles a frame after those before it: text, or an `ArrayBuffer` for a broadcast. Another kind is ignored, or
+		* closes the socket as too big when its size is unknown.
+		*/
 		message: (frame) => {
+			if (!open) return;
+			const size = frameBytes(frame);
+			if (!(size <= realtimeLimits.maxFrameBytes)) return shut(messageTooBig);
 			stayAwake();
-			const message = typeof frame === "string" ? decodeMessage(vsn, frame) : decodeBroadcastPush(frame);
+			const message = typeof frame === "string" ? decodeMessage(vsn, frame) : frame instanceof ArrayBuffer ? decodeBroadcastPush(frame) : void 0;
 			if (!message) return;
-			queue = queue.then(() => handle(message)).catch((error) => {
-				report(error);
-				close();
+			queuedMessages += 1;
+			queuedBytes += size;
+			if (queuedMessages > realtimeLimits.maxQueuedMessages || queuedBytes > realtimeLimits.maxQueuedBytes) return shut(policyViolation);
+			queue = queue.then(() => handle(message)).catch(fail).finally(() => {
+				queuedMessages -= 1;
+				queuedBytes -= size;
 			});
 		},
 		/** Ends every channel of a socket that closed. */
-		closed: () => {
-			clearTimeout(idle);
-			for (const topic of [...channels.keys()]) leave(topic);
-		}
+		closed: leaveAll
 	};
 };
 //#endregion

package/dist/webhooks/subscriber-view.js

@@ -40,20 +40,30 @@ const subscriptionEvent = (change, event, { fields, thin = false } = {}) => ({
 		transaction: change.transaction
 	}
 });
-const withUnknownEncrypted = (model, record) => {
-	const fields = Object.values(model.fields).filter((field) => field.encrypted);
-	if (fields.length === 0) return record;
+const withUnknownFields = (model, record) => {
+	const fields = Object.values(model.fields).filter((field) => field.sensitive || !Object.hasOwn(record, field.name));
 	const unknown = { ...record };
+	const read = [];
+	const error = (name) => {
+		const field = model.fields[name];
+		return /* @__PURE__ */ new Error(`a subscription's access check cannot tell whether the ${field.sensitive ? "sensitive field" : "field"} "${name}" is set${field.sensitive ? "" : ", which the captured change does not hold"}`);
+	};
 	for (const field of fields) Object.defineProperty(unknown, field.name, {
 		enumerable: true,
 		get: () => {
-			throw new Error(`a subscription's access check cannot tell whether the encrypted field "${field.name}" is set`);
+			read.push(field.name);
+			throw error(field.name);
 		}
 	});
-	return unknown;
+	const check = () => {
+		if (read.length > 0) throw error(read[0]);
+	};
+	return {
+		record: unknown,
+		check
+	};
 };
-const mayRead = async (access, captured) => {
-	const record = withUnknownEncrypted(access.full, captured);
+const decide = async (access, record) => {
 	const { resolved, session, entry } = access;
 	if (!resolved.operations.read) return false;
 	if (resolved.rowFilter.read && evaluateFilter(resolved.rowFilter.read, record) !== true) return false;
@@ -64,6 +74,12 @@ const mayRead = async (access, captured) => {
 	};
 	return checkRecord(entry.source, context, "read", record, void 0, access.deps.accessOptions);
 };
+const mayRead = async (access, captured) => {
+	const { record, check } = withUnknownFields(access.full, captured);
+	const allowed = await decide(access, record);
+	check();
+	return allowed;
+};
 /**
 * Builds each subscriber's event, under the access rules of the session it delivers as, resolved once per subscription
 * and resource: `undefined` when it may not read the record, after the change or before a delete.

package/dist/webhooks/webhooks.js

@@ -47,7 +47,9 @@ const deliveryGroup = ({ subscription, change }) => `${subscription.name}:${chan
 *   before that commits leaves the rows, and the job's retry delivers them again, under the same `webhook-id`.
 * - `webhooks.dispatch-change`, one change whose app code threw in dispatch: an event's `match` or filter, a
 *   subscription's `when`, or an access rule of its roles. Kept as failed, so dispatch moves on to later changes; a
-*   retry after the fix queues the change's deliveries. Any other error fails the whole dispatch, which is retried.
+*   retry after the fix queues the change's deliveries. An access rule's failure keeps the change for that subscription
+*   only: the others still receive it, and the retry delivers to that subscription alone. Any other error fails the
+*   whole dispatch, which is retried.
 * - `webhooks.deliver`, one try of an unordered delivery; a failure queues the next try on the Standard Webhooks
 *   schedule, or Retry-After, and the last one is kept as failed.
 * - `webhooks.deliver-ordered`, the ordered deliveries of one dispatch for one subscription and record, retried with
@@ -148,17 +150,32 @@ const createWebhooks = ({ deps, subscriptions, functions, schema, log, table })
 	const changeDeliveries = async (db) => {
 		const route = subscriptionRouter(await current(db), models);
 		const eventOf = subscriberEvents(deps);
-		return async (change) => {
+		return async (change, only) => {
+			const routes = route(change, matchers.get(change.resource)(change)).filter(({ subscription }) => only === void 0 || subscription.name === only);
 			const deliveries = [];
-			for (const { subscription, event } of route(change, matchers.get(change.resource)(change))) {
-				const shaped = await eventOf(subscription, change, event);
+			const failures = [];
+			const failed = /* @__PURE__ */ new Set();
+			for (const { subscription, event } of routes) {
+				if (failed.has(subscription.name)) continue;
+				const shaped = await eventOf(subscription, change, event).catch((error) => {
+					if (!(error instanceof EventCodeError)) throw error;
+					failed.add(subscription.name);
+					failures.push({
+						change,
+						subscription: subscription.name,
+						error
+					});
+				});
 				if (shaped) deliveries.push({
 					subscription,
 					event: shaped,
 					change
 				});
 			}
-			return deliveries;
+			return {
+				deliveries: deliveries.filter(({ subscription }) => !failed.has(subscription.name)),
+				failures
+			};
 		};
 	};
 	const queueOrdered = async (db, deliveries) => {
@@ -178,8 +195,9 @@ const createWebhooks = ({ deps, subscriptions, functions, schema, log, table })
 		name: "webhooks.dispatch-change",
 		maxAttempts: 1,
 		timeout: "5 minutes",
-		run: async ({ change }, { db }) => {
-			const deliveries = await (await changeDeliveries(db))(change);
+		run: async ({ change, subscription: only }, { db }) => {
+			const { deliveries, failures } = await (await changeDeliveries(db))(change, only);
+			if (only !== void 0 && failures.length > 0) throw failures[0].error;
 			await db.transaction().execute(async (trx) => {
 				for (const { subscription, event } of deliveries.filter(({ subscription }) => !subscription.options.ordered)) {
 					const payload = {
@@ -190,6 +208,10 @@ const createWebhooks = ({ deps, subscriptions, functions, schema, log, table })
 					await deliver.enqueue(trx, payload, { key: deliveryKey(payload) });
 				}
 				await queueOrdered(trx, deliveries);
+				for (const { subscription } of failures) await dispatchChange.enqueue(trx, {
+					change,
+					subscription
+				});
 			});
 		}
 	});
@@ -204,7 +226,9 @@ const createWebhooks = ({ deps, subscriptions, functions, schema, log, table })
 		const deliveries = [];
 		const failures = [];
 		for (const change of changes) try {
-			deliveries.push(...await deliveriesOf(change));
+			const routed = await deliveriesOf(change);
+			deliveries.push(...routed.deliveries);
+			failures.push(...routed.failures);
 		} catch (error) {
 			if (!(error instanceof EventCodeError)) throw error;
 			failures.push({
@@ -232,7 +256,10 @@ const createWebhooks = ({ deps, subscriptions, functions, schema, log, table })
 				});
 			}
 			await queueOrdered(trx, deliveries);
-			for (const { change } of failures) await dispatchChange.enqueue(trx, { change });
+			for (const { change, subscription } of failures) await dispatchChange.enqueue(trx, {
+				change,
+				...subscription !== void 0 && { subscription }
+			});
 			await writeHistory(trx, schema, changes.filter((change) => deps.registry.find(change.resource)?.model.history));
 			await writeNotices(trx, schema, changes.filter((change) => deps.registry.find(change.resource)?.model.live));
 			await deleteOutbox(trx, schema, rows.map((row) => row.id));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.34.3",
+  "version": "0.36.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -35,9 +35,9 @@
     "@better-auth/oauth-provider": "^1.7.12",
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
-    "@protobase/layout": "0.34.3",
-    "@protobase/query": "0.34.3",
-    "@protobase/schema": "0.34.3",
+    "@protobase/layout": "0.36.0",
+    "@protobase/query": "0.36.0",
+    "@protobase/schema": "0.36.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",