@protobase/server 0.51.2 → 0.52.0

package/dist/index.js

@@ -25,6 +25,8 @@ import { apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js"
 import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
 import { realtimeLimits } from "./realtime/realtime-limits.js";
+import { relayed } from "./realtime/relay/realtime-options.js";
+import { backgroundSettled, waitUntil } from "./functions/wait-until.js";
 import { objectKey } from "./storage/object-key.js";
 import { appNameOver, defaultAppName, shownAppName } from "./app-name.js";
 import { supabasePath } from "./supabase-paths.js";
@@ -36,20 +38,22 @@ import { readOperatorSettings } from "./better-auth/operator-provider.js";
 import { readPlatformSignIn } from "./better-auth/platform-sign-in.js";
 import { normalizeRoles } from "./better-auth/create-auth.js";
 import { mcpApprovals } from "./mcp/mcp-approval-store.js";
+import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
+import { checkComments, commentsMigration } from "./comments/comments-sql.js";
 import { mcpToolContext } from "./mcp/mcp-context.js";
 import { mcpGate, sessionOf } from "./mcp/mcp-gate.js";
 import { mcpHandler } from "./mcp/mcp-handler.js";
 import { mcpRoutes } from "./mcp/mcp-routes.js";
 import { mcpServer } from "./mcp/mcp-server.js";
+import { countRecordsTool } from "./assistant/count-records-tool.js";
 import { getRecordTool, listRecordsTool, listResourcesTool, readRecordTools } from "./assistant/record-tools.js";
 import { deleteRecordTool } from "./assistant/delete-record-tool.js";
 import { createRecordTool, updateRecordTool, writeRecordTools } from "./assistant/write-record-tools.js";
 import { batchWriteTool } from "./assistant/batch-write-tool.js";
+import { addCommentTool, commentTools, listCommentsTool } from "./assistant/comment-tools.js";
 import { mcpTools } from "./mcp/mcp-tools.js";
 import { addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
 import { createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
-import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
-import { checkComments, commentsMigration } from "./comments/comments-sql.js";
 import { coalesce } from "./changes/coalesce.js";
 import { eventMatcher } from "./changes/match-events.js";
 import { parseColumns, readOutbox } from "./changes/outbox.js";
@@ -87,6 +91,7 @@ import { checkSourceNames, sourceOptions, sourcesFor, sourcesVariable } from "./
 import { renderVariant, thumbHash } from "./files/images.js";
 import { pngIcons } from "./web-app/app-icons.js";
 import { webManifestPath } from "./web-app/web-manifest-route.js";
+import { mcpIcons } from "./web-app/mcp-icons.js";
 import { createAdmin } from "./create-admin.js";
 import { handleDroppedConnections } from "./dropped-connections.js";
 import { poolWaitMs, readDbConnections } from "./app-pool.js";
@@ -101,6 +106,7 @@ import { authStoreTables } from "./better-auth/auth-tables.js";
 import { checkResourcesOutsideAuthStore } from "./better-auth/store/resources-outside.js";
 import { checkComputed, computedMigration } from "./computed/computed-schema.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
+import { checkRealtimeRelay, realtimeRelayMigration } from "./realtime/relay/relay-schema.js";
 import { checkAi } from "./ai/check-ai.js";
 import { checkNotificationsSchema, notificationsMigration } from "./notifications/schema.js";
 import { sendNotification } from "./notifications/send-notification.js";
@@ -111,7 +117,6 @@ import { functionApp } from "./functions/function-app.js";
 import { readJson } from "./functions/read-json.js";
 import { verifySignature, verifyStandardWebhook } from "./functions/verify-signature.js";
 import { requireEnv } from "./functions/require-env.js";
-import { backgroundSettled, waitUntil } from "./functions/wait-until.js";
 import { storeFile } from "./files/store-file.js";
 import { createFileCleanup } from "./files/file-cleanup.js";
 import { createEncryptionTools } from "./encryption/tools.js";
@@ -123,4 +128,4 @@ import { jobsDrainApp } from "./jobs/drain-route.js";
 import { composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, NotificationSendError, PushMessageError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkResourcesOutsideAuthStore, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, NotificationSendError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, relayed, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/jobs/run-job.d.ts

@@ -1,7 +1,7 @@
 import "../notifications/send-input.js";
 import "./job-types.js";
-import "pg-boss";
 import { Db } from "@protobase/query";
+import "pg-boss";
 //#region src/jobs/run-job.d.ts
 /** Thrown from a job's `run`, it fails the job now: the attempts it has left are not used. */
 export declare class FatalJobError extends Error {

package/dist/list-photos.js

@@ -1,10 +1,10 @@
 import { badRequest } from "./problem.js";
 import { checkedSort } from "./filter-input.js";
 import { requestAccess } from "./request-access.js";
-import { readTransaction } from "./transactions.js";
+import { readScope } from "./read-scope.js";
 import { exposeRow } from "./rows.js";
+import { readTransaction } from "./transactions.js";
 import { presentFiles } from "./files/present.js";
-import { readScope } from "./read-scope.js";
 import { cardPhotosErrors } from "./view-card-photos.js";
 import { cardPhotoLimit } from "@protobase/schema/internal";
 import { checkFilter, createWhere } from "@protobase/schema";

package/dist/list-service.js

@@ -1,14 +1,14 @@
 import { checkedFilter, checkedSort } from "./filter-input.js";
 import { requestAccess, requireOperation } from "./request-access.js";
+import { readScope } from "./read-scope.js";
+import { exposeRow, pickFields } from "./rows.js";
+import { labelRequests, relatedLabels } from "./related-labels.js";
 import { readTransaction } from "./transactions.js";
+import { deletedRows, listParams, pageSizeOf, parseParams, seekParams, selectedFields } from "./params.js";
 import { etagAlias } from "./sql-parts.js";
 import { etagOf } from "./etag.js";
-import { exposeRow, pickFields } from "./rows.js";
 import { presentFiles } from "./files/present.js";
-import { deletedRows, listParams, pageSizeOf, parseParams, seekParams, selectedFields } from "./params.js";
-import { readScope } from "./read-scope.js";
 import { rowPermissions } from "./row-permissions.js";
-import { labelRequests, relatedLabels } from "./related-labels.js";
 import { photosRequest, recordPhotos } from "./list-photos.js";
 import { countUpTo, estimateCount, listQuery, seekToPosition } from "@protobase/query";
 //#region src/list-service.ts
@@ -102,11 +102,11 @@ const listRecords = async (deps, entry, session, input, maxFilterLength, jump =
 			next_page_token: result.page.nextCursor ?? "",
 			...position !== void 0 && { prev_page_token: result.page.prevCursor ?? "" },
 			total_size_estimate: result.estimate,
-			...result.counted !== void 0 && result.counted <= exactCountLimit && { total_size: result.counted },
+			...result.counted !== void 0 && result.counted <= 1e4 && { total_size: result.counted },
 			...result.labels && { labels: result.labels },
 			...included && { photos: included.photos }
 		}
 	};
 };
 //#endregion
-export { listRecords };
+export { exactCountLimit, listRecords };

package/dist/map-service.js

@@ -1,9 +1,9 @@
 import { checkedFilter } from "./filter-input.js";
 import { requestAccess, requireOperation } from "./request-access.js";
-import { readTransaction } from "./transactions.js";
-import { parseParams, selectedFields } from "./params.js";
 import { readScope } from "./read-scope.js";
 import { labelRequests } from "./related-labels.js";
+import { readTransaction } from "./transactions.js";
+import { parseParams, selectedFields } from "./params.js";
 import { photosRequest } from "./list-photos.js";
 import { listRecords } from "./list-service.js";
 import { z } from "zod";

package/dist/mcp/mcp-context.d.ts

@@ -5,9 +5,12 @@ import { Meta } from "../meta.js";
 import { Locale } from "@protobase/schema/internal";
 //#region src/mcp/mcp-context.d.ts
 /**
- * What tools get over MCP for `session`: its records and the resources it may read, under its access rules, and
- * `locale`, the language its approvals are asked in. Nothing shows beside a tool's result, and `mcpServer` gives each
- * call its own `approve`.
+ * What tools get over MCP for `session`: its records, their comments and the resources it may read, under its access
+ * rules, and `locale`, the language its approvals are asked in. `requestURL` is the MCP request's. Nothing shows beside
+ * a tool's result, and `mcpServer` gives each call its own `approve`.
  */
-export declare const mcpToolContext: (deps: Deps, meta: Pick<Meta, "forCaller">, session: Session, locale?: Locale) => Omit<ToolContext, "approve">;
+export declare const mcpToolContext: (deps: Deps, meta: Pick<Meta, "forCaller">, session: Session, { locale, requestURL }: {
+  locale?: Locale;
+  requestURL: string;
+}) => Omit<ToolContext, "approve">;
 //#endregion

package/dist/mcp/mcp-context.js

@@ -1,15 +1,17 @@
 import { assistantRecords } from "../assistant/records.js";
 import { readableResources } from "../assistant/readable-resources.js";
+import { toolComments } from "../comments/tool-comments.js";
 //#region src/mcp/mcp-context.ts
 /**
-* What tools get over MCP for `session`: its records and the resources it may read, under its access rules, and
-* `locale`, the language its approvals are asked in. Nothing shows beside a tool's result, and `mcpServer` gives each
-* call its own `approve`.
+* What tools get over MCP for `session`: its records, their comments and the resources it may read, under its access
+* rules, and `locale`, the language its approvals are asked in. `requestURL` is the MCP request's. Nothing shows beside
+* a tool's result, and `mcpServer` gives each call its own `approve`.
 */
-const mcpToolContext = (deps, meta, session, locale) => ({
+const mcpToolContext = (deps, meta, session, { locale, requestURL }) => ({
 	session,
 	...locale && { locale },
 	records: assistantRecords(deps, session),
+	comments: toolComments(deps, session, requestURL),
 	resources: () => readableResources(meta, session),
 	show: () => {}
 });

package/dist/mcp/mcp-server.d.ts

@@ -1,13 +1,14 @@
 import { AssistantTool, ToolContext } from "../assistant/tools.js";
 import { McpApprovals } from "./mcp-approval-store.js";
-import { McpServer } from "@modelcontextprotocol/server";
+import { Icon, McpServer } from "@modelcontextprotocol/server";
 //#region src/mcp/mcp-server.d.ts
 export type McpServerInput = {
-  /** The name, version and title the server tells clients when they connect. */
+  /** The name, version, title and icons the server tells clients when they connect, each icon an absolute URL. */
   info: {
     name: string;
     version: string;
     title?: string;
+    icons?: Icon[];
   };
   tools: AssistantTool[];
   /** What each tool gets as its context, for the caller of the request; `approve` comes from each call's own answers. */

package/dist/mcp/mcp-tools.d.ts

@@ -13,6 +13,11 @@ export type McpToolsInput = {
    * `rolesWithoutApproval`.
    */
   writes: McpWrites;
+  /**
+   * The resources whose records take comments: offers `list_comments` on them, and `add_comment` with writes on, on
+   * those of them that `writes` lists when it lists some. None by default.
+   */
+  commented?: string[];
 };
-export declare const mcpTools: ({ db, sql, writes }: McpToolsInput) => (session: Session) => AssistantTool[];
+export declare const mcpTools: ({ db, sql, writes, commented }: McpToolsInput) => (session: Session) => AssistantTool[];
 //#endregion

package/dist/mcp/mcp-tools.js

@@ -3,19 +3,23 @@ import { readOnlyQueryTool } from "../assistant/query-tools.js";
 import { readRecordTools } from "../assistant/record-tools.js";
 import { writeRecordTools } from "../assistant/write-record-tools.js";
 import { batchWriteTool } from "../assistant/batch-write-tool.js";
+import { commentTools } from "../assistant/comment-tools.js";
 //#region src/mcp/mcp-tools.ts
 /**
-* The default MCP tools for a caller: the record tools, the write tools when `writes` is on, and read-only SQL when `sql`
-* is on and the caller sees the assistant.
+* The default MCP tools for a caller: the record tools, the write tools when `writes` is on, the comment tools when a
+* resource takes comments, and read-only SQL when `sql` is on and the caller sees the assistant.
 */
 const writeTools = (input) => [...writeRecordTools(input), batchWriteTool(input)];
-const mcpTools = ({ db, sql, writes }) => {
+const mcpTools = ({ db, sql, writes, commented = [] }) => {
 	const read = readRecordTools();
-	const write = writes === false ? [] : writeTools(writes === true || !writes.resources ? {} : { resources: writes.resources });
+	const limits = writes === false ? false : writes === true || !writes.resources ? {} : { resources: writes.resources };
+	const write = limits === false ? [] : writeTools(limits);
+	const comments = commentTools({ commented }, limits);
 	const query = sql ? [readOnlyQueryTool(db)] : [];
 	return (session) => [
 		...read,
 		...write,
+		...comments,
 		...seesAssistant(session.user.roles) ? query : []
 	];
 };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.51.2";
+var version = "0.52.0";
 //#endregion
 export { version };

package/dist/read-service.js

@@ -1,10 +1,10 @@
 import { notFound } from "./problem.js";
 import { requestAccess, requireOperation, visibleFields, writableFields } from "./request-access.js";
-import { readTransaction } from "./transactions.js";
 import { pickFields } from "./rows.js";
+import { readTransaction } from "./transactions.js";
+import { deletedRows } from "./params.js";
 import { fetchReadable } from "./fetch-readable.js";
 import { presentFiles } from "./files/present.js";
-import { deletedRows } from "./params.js";
 import { rowPermissions } from "./row-permissions.js";
 //#region src/read-service.ts
 /**

package/dist/realtime/broadcast-api.js

@@ -17,7 +17,7 @@ const parsedJson = async (c) => {
 /**
 * `POST /api/broadcast` and `POST /api/broadcast/:topic/events/:event`, Supabase Realtime's broadcast API, which
 * supabase-js's `send()` on a channel that has not joined and `httpSend()` call: they send to the channels joined on a
-* topic in this process, as a broadcast sent on the socket, under the same topic rate. A request is admitted by the
+* topic, as a broadcast sent on the socket, under the same topic rate. A request is admitted by the
 * app's key and the token in its bearer, as the socket is, and its body is at most a socket's frame. A private message
 * reaches private channels only, and only when the caller may send broadcasts on its topic by the policies on
 * `realtime.messages`: the batch drops one it may not, as Supabase does, and the single message is refused with 403.
@@ -47,7 +47,7 @@ const broadcastApi = ({ caller, broadcasts, access, report }) => {
 	app.post("/", admitted, limited, async (c) => {
 		if (typeOf(c) !== "application/json") throw broadcastProblem(415, "json-only", "Unsupported Media Type", "Send the messages as application/json");
 		const publications = await allowed(c.var.caller, batchOf(await parsedJson(c)));
-		if (!broadcasts.publish(publications)) throw tooFast();
+		if (!await broadcasts.publish(publications)) throw tooFast();
 		return c.body(null, 202);
 	});
 	app.post("/:topic/events/:event", admitted, limited, async (c) => {
@@ -57,7 +57,7 @@ const broadcastApi = ({ caller, broadcasts, access, report }) => {
 		if (type === "application/json" && (typeof payload !== "object" || payload === null || Array.isArray(payload))) throw broadcastProblem(422, "invalid-broadcast", "Unprocessable Content", "Payload must be a JSON object");
 		const publication = publicationOf(c.req.param("topic"), c.req.param("event"), payload, c.req.query("private") === "true");
 		if ((await allowed(c.var.caller, [publication])).length === 0) throw broadcastProblem(403, "unauthorized", "Forbidden", "Unauthorized");
-		if (!broadcasts.publish([publication])) throw tooFast();
+		if (!await broadcasts.publish([publication])) throw tooFast();
 		return c.body(null, 202);
 	});
 	return app;

package/dist/realtime/broadcast-frame.js

@@ -46,25 +46,33 @@ const decodeBroadcastPush = (frame) => {
 const fitsFrame = (text) => encoder.encode(text).length <= 255;
 /**
 * A broadcast as the binary frame realtime-js reads: kind, topic, user event and metadata lengths, encoding, fields,
-* payload. A payload is JSON, or the bytes of a binary broadcast.
+* metadata as JSON, payload. A payload is JSON, or the bytes of a binary broadcast.
 */
-const encodeBroadcast = (topic, event, payload) => {
+const encodeBroadcast = (topic, event, payload, meta) => {
 	const topicBytes = encoder.encode(topic);
 	const eventBytes = encoder.encode(event);
+	const metaBytes = encoder.encode(meta === void 0 ? "" : JSON.stringify(meta));
 	const binary = payload instanceof ArrayBuffer;
 	const body = binary ? new Uint8Array(payload) : encoder.encode(JSON.stringify(payload ?? {}));
-	if (topicBytes.length > 255 || eventBytes.length > 255) throw new Error("A broadcast topic and event are at most 255 bytes each");
-	const frame = new Uint8Array(5 + topicBytes.length + eventBytes.length + body.length);
+	if (topicBytes.length > 255 || eventBytes.length > 255 || metaBytes.length > 255) throw new Error("A broadcast topic, event and metadata are at most 255 bytes each");
+	const frame = new Uint8Array(5 + topicBytes.length + eventBytes.length + metaBytes.length + body.length);
 	frame.set([
 		userBroadcast,
 		topicBytes.length,
 		eventBytes.length,
-		0,
+		metaBytes.length,
 		binary ? binaryEncoding : jsonEncoding
 	]);
-	frame.set(topicBytes, 5);
-	frame.set(eventBytes, 5 + topicBytes.length);
-	frame.set(body, 5 + topicBytes.length + eventBytes.length);
+	let offset = 5;
+	for (const part of [
+		topicBytes,
+		eventBytes,
+		metaBytes,
+		body
+	]) {
+		frame.set(part, offset);
+		offset += part.length;
+	}
 	return frame.buffer;
 };
 //#endregion

package/dist/realtime/broadcast-hub.js

@@ -1,9 +1,9 @@
-import { realtimeLimits } from "./realtime-limits.js";
 import { fixedWindows } from "./fixed-window.js";
+import { realtimeLimits } from "./realtime-limits.js";
 //#region src/realtime/broadcast-hub.ts
 /**
-* The channels of a process by topic, which hear each other's broadcasts in-process: a cloud app runs as one process,
-* so channels of other processes are not reached. Private and public channels of a topic do not hear each other, as on
+* The channels of a process by topic, which hear each other's broadcasts in-process; with several processes,
+* `relayedHubs` carries them between them through this hub's `deliver`. Private and public channels of a topic do not hear each other, as on
 * Supabase, so a public channel cannot reach past the policies of a private one. A topic takes `realtimeLimits.topicBroadcastsPerSecond`, whoever sends
 * them; its window is kept here, so a topic left empty and joined again does not start a new one.
 */
@@ -12,6 +12,10 @@ const broadcastHub = ({ now = () => Date.now() } = {}) => {
 	const privateTopics = /* @__PURE__ */ new Map();
 	const topicsOf = (isPrivate) => isPrivate ? privateTopics : publicTopics;
 	const rate = fixedWindows(realtimeLimits.topicBroadcastsPerSecond, 1e3, now);
+	/** Sends a broadcast to the topic's members, whatever the rate, but not to `from` unless it hears its own. */
+	const deliver = (publication, from) => {
+		for (const member of topicsOf(publication.private).get(publication.topic) ?? []) if (member !== from || member.self) member.receive(publication.event, publication.payload, publication.meta);
+	};
 	return {
 		/** Puts the member on the topic until the returned function takes it off. */
 		join: (topic, member) => {
@@ -29,7 +33,12 @@ const broadcastHub = ({ now = () => Date.now() } = {}) => {
 		*/
 		send: (topic, from, event, payload) => {
 			if (!rate(topic)) return false;
-			for (const member of topicsOf(from.private).get(topic) ?? []) if (member !== from || member.self) member.receive(event, payload);
+			deliver({
+				topic,
+				event,
+				payload,
+				private: from.private
+			}, from);
 			return true;
 		},
 		/**
@@ -40,9 +49,10 @@ const broadcastHub = ({ now = () => Date.now() } = {}) => {
 			const takes = /* @__PURE__ */ new Map();
 			for (const { topic } of publications) takes.set(topic, (takes.get(topic) ?? 0) + 1);
 			if (!rate.all(takes)) return false;
-			for (const publication of publications) for (const member of topicsOf(publication.private).get(publication.topic) ?? []) member.receive(publication.event, publication.payload);
+			for (const publication of publications) deliver(publication);
 			return true;
-		}
+		},
+		deliver
 	};
 };
 //#endregion

package/dist/realtime/broadcast-request.js

@@ -1,6 +1,6 @@
 import { HttpProblem } from "../problem.js";
-import { fitsFrame } from "./broadcast-frame.js";
 import { realtimeLimits } from "./realtime-limits.js";
+import { fitsFrame } from "./broadcast-frame.js";
 //#region src/realtime/broadcast-request.ts
 /** A refused broadcast request; `message` too, which realtime-js's `httpSend` reads as the error. */
 const broadcastProblem = (status, slug, title, detail) => new HttpProblem(status, slug, title, detail, { message: detail });

package/dist/realtime/change-checker.js

@@ -1,5 +1,5 @@
-import { quoteIdent, tableSql } from "../changes/capture-sql.js";
 import { readTransaction } from "../transactions.js";
+import { quoteIdent, tableSql } from "../changes/capture-sql.js";
 import { callerSettings } from "../rest/caller-settings.js";
 import { filterSql } from "./change-filter.js";
 import { decodeKey, encodeKey } from "@protobase/schema/internal";

package/dist/realtime/channel-access.js

@@ -1,5 +1,5 @@
-import { isDatabaseError } from "../error-handler.js";
 import { writeTransaction } from "../transactions.js";
+import { isDatabaseError } from "../error-handler.js";
 import { callerSettings } from "../rest/caller-settings.js";
 import { sql } from "kysely";
 import { randomUUID } from "node:crypto";

package/dist/realtime/database-broadcasts.js

@@ -0,0 +1,83 @@
+import { writeTransaction } from "../transactions.js";
+import { realtimeLimits } from "./realtime-limits.js";
+import { fitsFrame } from "./broadcast-frame.js";
+import { sql } from "kysely";
+import { Buffer } from "node:buffer";
+//#region src/realtime/database-broadcasts.ts
+/** Messages taken in one transaction at most. */
+const batchSize = 1e3;
+/**
+* The message as the channels joined on its topic hear it, with its id as `meta`, as Supabase sends it; `undefined` for
+* one Supabase would skip, or whose topic or event does not fit a frame or whose payload is over a frame.
+*/
+const publicationOfRow = (row) => {
+	if (row.topic === null || row.event === null || row.payload === null || row.private === null) return void 0;
+	const topic = `realtime:${row.topic}`;
+	if (!fitsFrame(topic) || !fitsFrame(row.event)) return void 0;
+	if (Buffer.byteLength(JSON.stringify(row.payload)) > realtimeLimits.maxFrameBytes) return void 0;
+	return {
+		topic,
+		event: row.event,
+		payload: row.payload,
+		private: row.private,
+		meta: { id: row.id }
+	};
+};
+const takeMessages = (db, statementTimeoutMs) => writeTransaction(db, statementTimeoutMs, async (trx) => {
+	const { rows } = await sql`with taken as (
+        delete from realtime.messages where id in (
+          select id from realtime.messages where extension = 'broadcast' order by inserted_at limit ${batchSize} for update skip locked
+        ) returning id, topic, event, payload, private, inserted_at
+      )
+      select id::text as id, topic, event, payload, private from taken order by inserted_at`.execute(trx);
+	return rows;
+});
+const tableExists = async (db) => (await sql`select to_regclass('realtime.messages') is not null as found`.execute(db)).rows[0].found;
+/**
+* Supabase's broadcast from the database: `realtime.send()` and `realtime.broadcast_changes()` insert a message into
+* `realtime.messages` in the caller's transaction, so only a committed one is seen, and while a socket of this process
+* is open the table is read every `intervalMs`, its messages taken out of it and sent to the channels joined on their
+* topics, the private or the public ones, under the topic's broadcast rate. A message nobody hears is dropped, as on
+* Supabase: the first read when a socket opens takes those sent while none was. A database without
+* `realtime.messages` sends nothing, and is checked again at each read.
+*/
+const databaseBroadcasts = ({ db, statementTimeoutMs, broadcasts, intervalMs = 1e3, report }) => {
+	let followers = 0;
+	let running = false;
+	const read = async () => {
+		if (!await tableExists(db)) return;
+		for (;;) {
+			const rows = await takeMessages(db, statementTimeoutMs);
+			for (const row of rows) {
+				const publication = publicationOfRow(row);
+				if (publication) await broadcasts.publish([publication]);
+			}
+			if (rows.length < batchSize) return;
+		}
+	};
+	const tick = async () => {
+		if (followers === 0) {
+			running = false;
+			return;
+		}
+		await read().catch(report);
+		setTimeout(() => void tick(), intervalMs);
+	};
+	return { 
+	/** Reads the table from now on, until the returned function is called; once for each call, however often. */
+follow: () => {
+		followers += 1;
+		if (!running) {
+			running = true;
+			tick();
+		}
+		let followed = true;
+		return () => {
+			if (!followed) return;
+			followed = false;
+			followers -= 1;
+		};
+	} };
+};
+//#endregion
+export { databaseBroadcasts, publicationOfRow };

package/dist/realtime/presence-hub.js

@@ -4,58 +4,93 @@ const stateOf = (tracked) => {
 	for (const [key, meta] of tracked) (state[key] ??= { metas: [] }).metas.push(meta);
 	return state;
 };
+const alone = {
+	state: () => [],
+	changed: () => {},
+	ready: async () => {}
+};
 /**
 * The presences of a process by topic, in-process like broadcasts: each joined channel tracks at most one, under its
 * key, and channels that listen hear every join and leave on their topic, their own included, as Phoenix Presence
-* sends them. Tracking again replaces the presence: a leave of the old one and a join of the new. Refs count up, unique
-* in the process. Private and public channels of a topic do not see each other, as with broadcasts.
+* sends them. Tracking again replaces the presence: a leave of the old one and a join of the new. Refs count up after
+* `refPrefix`, unique in the process. Private and public channels of a topic do not see each other, as with broadcasts.
+* With `remote`, a topic's state holds the other processes' presences too, each change goes to them, and `hear` tells
+* the channels theirs.
 */
-const presenceHub = () => {
+const presenceHub = ({ refPrefix = "", remote = alone } = {}) => {
 	const publicTopics = /* @__PURE__ */ new Map();
 	const privateTopics = /* @__PURE__ */ new Map();
 	let lastRef = 0;
+	const topicsOf = (isPrivate) => isPrivate ? privateTopics : publicTopics;
 	const tell = (members, diff) => {
 		for (const member of members.keys()) if (member.listens) member.receive(diff);
 	};
-	return { 
-	/** Puts the member on the topic, with what it may do there until it leaves. */
-join: (topic, member) => {
-		const topics = member.private ? privateTopics : publicTopics;
-		const members = topics.get(topic) ?? /* @__PURE__ */ new Map();
-		topics.set(topic, members.set(member, void 0));
-		const untrack = () => {
-			const old = members.get(member);
-			if (!old) return;
-			members.set(member, void 0);
-			tell(members, {
-				joins: {},
-				leaves: stateOf([[member.key, old]])
-			});
-		};
-		return {
-			/** The topic's presences now, for `presence_state`. */
-			state: () => stateOf([...members].flatMap(([{ key }, meta]) => meta ? [[key, meta]] : [])),
-			track: (payload) => {
+	return {
+		/** Puts the member on the topic, with what it may do there until it leaves. */
+		join: (topic, member) => {
+			const topics = topicsOf(member.private);
+			const members = topics.get(topic) ?? /* @__PURE__ */ new Map();
+			topics.set(topic, members.set(member, void 0));
+			const untrack = () => {
 				const old = members.get(member);
-				const meta = {
-					...payload,
-					phx_ref: String(++lastRef),
-					...old && { phx_ref_prev: old.phx_ref }
-				};
-				members.set(member, meta);
+				if (!old) return;
+				members.set(member, void 0);
 				tell(members, {
-					joins: stateOf([[member.key, meta]]),
-					leaves: old ? stateOf([[member.key, old]]) : {}
+					joins: {},
+					leaves: stateOf([[member.key, old]])
+				});
+				remote.changed({
+					topic,
+					private: member.private,
+					key: member.key,
+					left: old
 				});
-			},
-			untrack,
-			leave: () => {
-				untrack();
-				members.delete(member);
-				if (members.size === 0 && topics.get(topic) === members) topics.delete(topic);
-			}
-		};
-	} };
+			};
+			return {
+				/** The topic's presences now, for `presence_state`. */
+				state: () => stateOf([...[...members].flatMap(([{ key }, meta]) => meta ? [[key, meta]] : []), ...remote.state(topic, member.private)]),
+				track: (payload) => {
+					const old = members.get(member);
+					const meta = {
+						...payload,
+						phx_ref: `${refPrefix}${++lastRef}`,
+						...old && { phx_ref_prev: old.phx_ref }
+					};
+					members.set(member, meta);
+					tell(members, {
+						joins: stateOf([[member.key, meta]]),
+						leaves: old ? stateOf([[member.key, old]]) : {}
+					});
+					remote.changed({
+						topic,
+						private: member.private,
+						key: member.key,
+						joined: meta,
+						...old && { left: old }
+					});
+				},
+				untrack,
+				leave: () => {
+					untrack();
+					members.delete(member);
+					if (members.size === 0 && topics.get(topic) === members) topics.delete(topic);
+				}
+			};
+		},
+		/** Tells the topic's listening channels a diff of another process's presences. */
+		hear: (topic, isPrivate, diff) => {
+			const members = topicsOf(isPrivate).get(topic);
+			if (members) tell(members, diff);
+		},
+		/** Every presence this process's channels track. */
+		tracked: () => [true, false].flatMap((isPrivate) => [...topicsOf(isPrivate)].flatMap(([topic, members]) => [...members].flatMap(([{ key }, meta]) => meta ? [{
+			topic,
+			private: isPrivate,
+			key,
+			meta
+		}] : []))),
+		ready: remote.ready
+	};
 };
 //#endregion
 export { presenceHub };