@protobase/server 0.51.3 → 0.52.1

package/dist/index.js

@@ -25,6 +25,8 @@ import { apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js"
 import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
 import { realtimeLimits } from "./realtime/realtime-limits.js";
+import { relayed } from "./realtime/relay/realtime-options.js";
+import { backgroundSettled, waitUntil } from "./functions/wait-until.js";
 import { objectKey } from "./storage/object-key.js";
 import { appNameOver, defaultAppName, shownAppName } from "./app-name.js";
 import { supabasePath } from "./supabase-paths.js";
@@ -36,20 +38,22 @@ import { readOperatorSettings } from "./better-auth/operator-provider.js";
 import { readPlatformSignIn } from "./better-auth/platform-sign-in.js";
 import { normalizeRoles } from "./better-auth/create-auth.js";
 import { mcpApprovals } from "./mcp/mcp-approval-store.js";
+import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
+import { checkComments, commentsMigration } from "./comments/comments-sql.js";
 import { mcpToolContext } from "./mcp/mcp-context.js";
 import { mcpGate, sessionOf } from "./mcp/mcp-gate.js";
 import { mcpHandler } from "./mcp/mcp-handler.js";
 import { mcpRoutes } from "./mcp/mcp-routes.js";
 import { mcpServer } from "./mcp/mcp-server.js";
+import { countRecordsTool } from "./assistant/count-records-tool.js";
 import { getRecordTool, listRecordsTool, listResourcesTool, readRecordTools } from "./assistant/record-tools.js";
 import { deleteRecordTool } from "./assistant/delete-record-tool.js";
 import { createRecordTool, updateRecordTool, writeRecordTools } from "./assistant/write-record-tools.js";
 import { batchWriteTool } from "./assistant/batch-write-tool.js";
+import { addCommentTool, commentTools, listCommentsTool } from "./assistant/comment-tools.js";
 import { mcpTools } from "./mcp/mcp-tools.js";
 import { addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
 import { createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
-import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
-import { checkComments, commentsMigration } from "./comments/comments-sql.js";
 import { coalesce } from "./changes/coalesce.js";
 import { eventMatcher } from "./changes/match-events.js";
 import { parseColumns, readOutbox } from "./changes/outbox.js";
@@ -87,6 +91,7 @@ import { checkSourceNames, sourceOptions, sourcesFor, sourcesVariable } from "./
 import { renderVariant, thumbHash } from "./files/images.js";
 import { pngIcons } from "./web-app/app-icons.js";
 import { webManifestPath } from "./web-app/web-manifest-route.js";
+import { mcpIcons } from "./web-app/mcp-icons.js";
 import { createAdmin } from "./create-admin.js";
 import { handleDroppedConnections } from "./dropped-connections.js";
 import { poolWaitMs, readDbConnections } from "./app-pool.js";
@@ -101,6 +106,7 @@ import { authStoreTables } from "./better-auth/auth-tables.js";
 import { checkResourcesOutsideAuthStore } from "./better-auth/store/resources-outside.js";
 import { checkComputed, computedMigration } from "./computed/computed-schema.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
+import { checkRealtimeRelay, realtimeRelayMigration } from "./realtime/relay/relay-schema.js";
 import { checkAi } from "./ai/check-ai.js";
 import { checkNotificationsSchema, notificationsMigration } from "./notifications/schema.js";
 import { sendNotification } from "./notifications/send-notification.js";
@@ -111,7 +117,6 @@ import { functionApp } from "./functions/function-app.js";
 import { readJson } from "./functions/read-json.js";
 import { verifySignature, verifyStandardWebhook } from "./functions/verify-signature.js";
 import { requireEnv } from "./functions/require-env.js";
-import { backgroundSettled, waitUntil } from "./functions/wait-until.js";
 import { storeFile } from "./files/store-file.js";
 import { createFileCleanup } from "./files/file-cleanup.js";
 import { createEncryptionTools } from "./encryption/tools.js";
@@ -123,4 +128,4 @@ import { jobsDrainApp } from "./jobs/drain-route.js";
 import { composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, NotificationSendError, PushMessageError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkResourcesOutsideAuthStore, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, NotificationSendError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, relayed, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/jobs/run-job.d.ts

@@ -1,7 +1,7 @@
 import "../notifications/send-input.js";
 import "./job-types.js";
-import "pg-boss";
 import { Db } from "@protobase/query";
+import "pg-boss";
 //#region src/jobs/run-job.d.ts
 /** Thrown from a job's `run`, it fails the job now: the attempts it has left are not used. */
 export declare class FatalJobError extends Error {

package/dist/list-photos.js

@@ -1,10 +1,10 @@
 import { badRequest } from "./problem.js";
 import { checkedSort } from "./filter-input.js";
 import { requestAccess } from "./request-access.js";
-import { readTransaction } from "./transactions.js";
+import { readScope } from "./read-scope.js";
 import { exposeRow } from "./rows.js";
+import { readTransaction } from "./transactions.js";
 import { presentFiles } from "./files/present.js";
-import { readScope } from "./read-scope.js";
 import { cardPhotosErrors } from "./view-card-photos.js";
 import { cardPhotoLimit } from "@protobase/schema/internal";
 import { checkFilter, createWhere } from "@protobase/schema";

package/dist/list-service.js

@@ -1,14 +1,14 @@
 import { checkedFilter, checkedSort } from "./filter-input.js";
 import { requestAccess, requireOperation } from "./request-access.js";
+import { readScope } from "./read-scope.js";
+import { exposeRow, pickFields } from "./rows.js";
+import { labelRequests, relatedLabels } from "./related-labels.js";
 import { readTransaction } from "./transactions.js";
+import { deletedRows, listParams, pageSizeOf, parseParams, seekParams, selectedFields } from "./params.js";
 import { etagAlias } from "./sql-parts.js";
 import { etagOf } from "./etag.js";
-import { exposeRow, pickFields } from "./rows.js";
 import { presentFiles } from "./files/present.js";
-import { deletedRows, listParams, pageSizeOf, parseParams, seekParams, selectedFields } from "./params.js";
-import { readScope } from "./read-scope.js";
 import { rowPermissions } from "./row-permissions.js";
-import { labelRequests, relatedLabels } from "./related-labels.js";
 import { photosRequest, recordPhotos } from "./list-photos.js";
 import { countUpTo, estimateCount, listQuery, seekToPosition } from "@protobase/query";
 //#region src/list-service.ts
@@ -102,11 +102,11 @@ const listRecords = async (deps, entry, session, input, maxFilterLength, jump =
 			next_page_token: result.page.nextCursor ?? "",
 			...position !== void 0 && { prev_page_token: result.page.prevCursor ?? "" },
 			total_size_estimate: result.estimate,
-			...result.counted !== void 0 && result.counted <= exactCountLimit && { total_size: result.counted },
+			...result.counted !== void 0 && result.counted <= 1e4 && { total_size: result.counted },
 			...result.labels && { labels: result.labels },
 			...included && { photos: included.photos }
 		}
 	};
 };
 //#endregion
-export { listRecords };
+export { exactCountLimit, listRecords };

package/dist/map-service.js

@@ -1,9 +1,9 @@
 import { checkedFilter } from "./filter-input.js";
 import { requestAccess, requireOperation } from "./request-access.js";
-import { readTransaction } from "./transactions.js";
-import { parseParams, selectedFields } from "./params.js";
 import { readScope } from "./read-scope.js";
 import { labelRequests } from "./related-labels.js";
+import { readTransaction } from "./transactions.js";
+import { parseParams, selectedFields } from "./params.js";
 import { photosRequest } from "./list-photos.js";
 import { listRecords } from "./list-service.js";
 import { z } from "zod";

package/dist/mcp/mcp-context.d.ts

@@ -5,9 +5,12 @@ import { Meta } from "../meta.js";
 import { Locale } from "@protobase/schema/internal";
 //#region src/mcp/mcp-context.d.ts
 /**
- * What tools get over MCP for `session`: its records and the resources it may read, under its access rules, and
- * `locale`, the language its approvals are asked in. Nothing shows beside a tool's result, and `mcpServer` gives each
- * call its own `approve`.
+ * What tools get over MCP for `session`: its records, their comments and the resources it may read, under its access
+ * rules, and `locale`, the language its approvals are asked in. `requestURL` is the MCP request's. Nothing shows beside
+ * a tool's result, and `mcpServer` gives each call its own `approve`.
  */
-export declare const mcpToolContext: (deps: Deps, meta: Pick<Meta, "forCaller">, session: Session, locale?: Locale) => Omit<ToolContext, "approve">;
+export declare const mcpToolContext: (deps: Deps, meta: Pick<Meta, "forCaller">, session: Session, { locale, requestURL }: {
+  locale?: Locale;
+  requestURL: string;
+}) => Omit<ToolContext, "approve">;
 //#endregion

package/dist/mcp/mcp-context.js

@@ -1,15 +1,17 @@
 import { assistantRecords } from "../assistant/records.js";
 import { readableResources } from "../assistant/readable-resources.js";
+import { toolComments } from "../comments/tool-comments.js";
 //#region src/mcp/mcp-context.ts
 /**
-* What tools get over MCP for `session`: its records and the resources it may read, under its access rules, and
-* `locale`, the language its approvals are asked in. Nothing shows beside a tool's result, and `mcpServer` gives each
-* call its own `approve`.
+* What tools get over MCP for `session`: its records, their comments and the resources it may read, under its access
+* rules, and `locale`, the language its approvals are asked in. `requestURL` is the MCP request's. Nothing shows beside
+* a tool's result, and `mcpServer` gives each call its own `approve`.
 */
-const mcpToolContext = (deps, meta, session, locale) => ({
+const mcpToolContext = (deps, meta, session, { locale, requestURL }) => ({
 	session,
 	...locale && { locale },
 	records: assistantRecords(deps, session),
+	comments: toolComments(deps, session, requestURL),
 	resources: () => readableResources(meta, session),
 	show: () => {}
 });

package/dist/mcp/mcp-server.d.ts

@@ -1,13 +1,14 @@
 import { AssistantTool, ToolContext } from "../assistant/tools.js";
 import { McpApprovals } from "./mcp-approval-store.js";
-import { McpServer } from "@modelcontextprotocol/server";
+import { Icon, McpServer } from "@modelcontextprotocol/server";
 //#region src/mcp/mcp-server.d.ts
 export type McpServerInput = {
-  /** The name, version and title the server tells clients when they connect. */
+  /** The name, version, title and icons the server tells clients when they connect, each icon an absolute URL. */
   info: {
     name: string;
     version: string;
     title?: string;
+    icons?: Icon[];
   };
   tools: AssistantTool[];
   /** What each tool gets as its context, for the caller of the request; `approve` comes from each call's own answers. */

package/dist/mcp/mcp-tools.d.ts

@@ -13,6 +13,11 @@ export type McpToolsInput = {
    * `rolesWithoutApproval`.
    */
   writes: McpWrites;
+  /**
+   * The resources whose records take comments: offers `list_comments` on them, and `add_comment` with writes on, on
+   * those of them that `writes` lists when it lists some. None by default.
+   */
+  commented?: string[];
 };
-export declare const mcpTools: ({ db, sql, writes }: McpToolsInput) => (session: Session) => AssistantTool[];
+export declare const mcpTools: ({ db, sql, writes, commented }: McpToolsInput) => (session: Session) => AssistantTool[];
 //#endregion

package/dist/mcp/mcp-tools.js

@@ -3,19 +3,23 @@ import { readOnlyQueryTool } from "../assistant/query-tools.js";
 import { readRecordTools } from "../assistant/record-tools.js";
 import { writeRecordTools } from "../assistant/write-record-tools.js";
 import { batchWriteTool } from "../assistant/batch-write-tool.js";
+import { commentTools } from "../assistant/comment-tools.js";
 //#region src/mcp/mcp-tools.ts
 /**
-* The default MCP tools for a caller: the record tools, the write tools when `writes` is on, and read-only SQL when `sql`
-* is on and the caller sees the assistant.
+* The default MCP tools for a caller: the record tools, the write tools when `writes` is on, the comment tools when a
+* resource takes comments, and read-only SQL when `sql` is on and the caller sees the assistant.
 */
 const writeTools = (input) => [...writeRecordTools(input), batchWriteTool(input)];
-const mcpTools = ({ db, sql, writes }) => {
+const mcpTools = ({ db, sql, writes, commented = [] }) => {
 	const read = readRecordTools();
-	const write = writes === false ? [] : writeTools(writes === true || !writes.resources ? {} : { resources: writes.resources });
+	const limits = writes === false ? false : writes === true || !writes.resources ? {} : { resources: writes.resources };
+	const write = limits === false ? [] : writeTools(limits);
+	const comments = commentTools({ commented }, limits);
 	const query = sql ? [readOnlyQueryTool(db)] : [];
 	return (session) => [
 		...read,
 		...write,
+		...comments,
 		...seesAssistant(session.user.roles) ? query : []
 	];
 };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.51.3";
+var version = "0.52.1";
 //#endregion
 export { version };

package/dist/read-service.js

@@ -1,10 +1,10 @@
 import { notFound } from "./problem.js";
 import { requestAccess, requireOperation, visibleFields, writableFields } from "./request-access.js";
-import { readTransaction } from "./transactions.js";
 import { pickFields } from "./rows.js";
+import { readTransaction } from "./transactions.js";
+import { deletedRows } from "./params.js";
 import { fetchReadable } from "./fetch-readable.js";
 import { presentFiles } from "./files/present.js";
-import { deletedRows } from "./params.js";
 import { rowPermissions } from "./row-permissions.js";
 //#region src/read-service.ts
 /**

package/dist/realtime/broadcast-api.js

@@ -17,7 +17,7 @@ const parsedJson = async (c) => {
 /**
 * `POST /api/broadcast` and `POST /api/broadcast/:topic/events/:event`, Supabase Realtime's broadcast API, which
 * supabase-js's `send()` on a channel that has not joined and `httpSend()` call: they send to the channels joined on a
-* topic in this process, as a broadcast sent on the socket, under the same topic rate. A request is admitted by the
+* topic, as a broadcast sent on the socket, under the same topic rate. A request is admitted by the
 * app's key and the token in its bearer, as the socket is, and its body is at most a socket's frame. A private message
 * reaches private channels only, and only when the caller may send broadcasts on its topic by the policies on
 * `realtime.messages`: the batch drops one it may not, as Supabase does, and the single message is refused with 403.
@@ -47,7 +47,7 @@ const broadcastApi = ({ caller, broadcasts, access, report }) => {
 	app.post("/", admitted, limited, async (c) => {
 		if (typeOf(c) !== "application/json") throw broadcastProblem(415, "json-only", "Unsupported Media Type", "Send the messages as application/json");
 		const publications = await allowed(c.var.caller, batchOf(await parsedJson(c)));
-		if (!broadcasts.publish(publications)) throw tooFast();
+		if (!await broadcasts.publish(publications)) throw tooFast();
 		return c.body(null, 202);
 	});
 	app.post("/:topic/events/:event", admitted, limited, async (c) => {
@@ -57,7 +57,7 @@ const broadcastApi = ({ caller, broadcasts, access, report }) => {
 		if (type === "application/json" && (typeof payload !== "object" || payload === null || Array.isArray(payload))) throw broadcastProblem(422, "invalid-broadcast", "Unprocessable Content", "Payload must be a JSON object");
 		const publication = publicationOf(c.req.param("topic"), c.req.param("event"), payload, c.req.query("private") === "true");
 		if ((await allowed(c.var.caller, [publication])).length === 0) throw broadcastProblem(403, "unauthorized", "Forbidden", "Unauthorized");
-		if (!broadcasts.publish([publication])) throw tooFast();
+		if (!await broadcasts.publish([publication])) throw tooFast();
 		return c.body(null, 202);
 	});
 	return app;

package/dist/realtime/broadcast-hub.js

@@ -2,8 +2,8 @@ import { fixedWindows } from "./fixed-window.js";
 import { realtimeLimits } from "./realtime-limits.js";
 //#region src/realtime/broadcast-hub.ts
 /**
-* The channels of a process by topic, which hear each other's broadcasts in-process: a cloud app runs as one process,
-* so channels of other processes are not reached. Private and public channels of a topic do not hear each other, as on
+* The channels of a process by topic, which hear each other's broadcasts in-process; with several processes,
+* `relayedHubs` carries them between them through this hub's `deliver`. Private and public channels of a topic do not hear each other, as on
 * Supabase, so a public channel cannot reach past the policies of a private one. A topic takes `realtimeLimits.topicBroadcastsPerSecond`, whoever sends
 * them; its window is kept here, so a topic left empty and joined again does not start a new one.
 */
@@ -12,6 +12,10 @@ const broadcastHub = ({ now = () => Date.now() } = {}) => {
 	const privateTopics = /* @__PURE__ */ new Map();
 	const topicsOf = (isPrivate) => isPrivate ? privateTopics : publicTopics;
 	const rate = fixedWindows(realtimeLimits.topicBroadcastsPerSecond, 1e3, now);
+	/** Sends a broadcast to the topic's members, whatever the rate, but not to `from` unless it hears its own. */
+	const deliver = (publication, from) => {
+		for (const member of topicsOf(publication.private).get(publication.topic) ?? []) if (member !== from || member.self) member.receive(publication.event, publication.payload, publication.meta);
+	};
 	return {
 		/** Puts the member on the topic until the returned function takes it off. */
 		join: (topic, member) => {
@@ -29,7 +33,12 @@ const broadcastHub = ({ now = () => Date.now() } = {}) => {
 		*/
 		send: (topic, from, event, payload) => {
 			if (!rate(topic)) return false;
-			for (const member of topicsOf(from.private).get(topic) ?? []) if (member !== from || member.self) member.receive(event, payload);
+			deliver({
+				topic,
+				event,
+				payload,
+				private: from.private
+			}, from);
 			return true;
 		},
 		/**
@@ -40,9 +49,10 @@ const broadcastHub = ({ now = () => Date.now() } = {}) => {
 			const takes = /* @__PURE__ */ new Map();
 			for (const { topic } of publications) takes.set(topic, (takes.get(topic) ?? 0) + 1);
 			if (!rate.all(takes)) return false;
-			for (const publication of publications) for (const member of topicsOf(publication.private).get(publication.topic) ?? []) member.receive(publication.event, publication.payload, publication.meta);
+			for (const publication of publications) deliver(publication);
 			return true;
-		}
+		},
+		deliver
 	};
 };
 //#endregion

package/dist/realtime/change-checker.js

@@ -1,5 +1,5 @@
-import { quoteIdent, tableSql } from "../changes/capture-sql.js";
 import { readTransaction } from "../transactions.js";
+import { quoteIdent, tableSql } from "../changes/capture-sql.js";
 import { callerSettings } from "../rest/caller-settings.js";
 import { filterSql } from "./change-filter.js";
 import { decodeKey, encodeKey } from "@protobase/schema/internal";

package/dist/realtime/channel-access.js

@@ -1,5 +1,5 @@
-import { isDatabaseError } from "../error-handler.js";
 import { writeTransaction } from "../transactions.js";
+import { isDatabaseError } from "../error-handler.js";
 import { callerSettings } from "../rest/caller-settings.js";
 import { sql } from "kysely";
 import { randomUUID } from "node:crypto";

package/dist/realtime/database-broadcasts.js

@@ -50,7 +50,7 @@ const databaseBroadcasts = ({ db, statementTimeoutMs, broadcasts, intervalMs = 1
 			const rows = await takeMessages(db, statementTimeoutMs);
 			for (const row of rows) {
 				const publication = publicationOfRow(row);
-				if (publication) broadcasts.publish([publication]);
+				if (publication) await broadcasts.publish([publication]);
 			}
 			if (rows.length < batchSize) return;
 		}

package/dist/realtime/presence-hub.js

@@ -4,58 +4,93 @@ const stateOf = (tracked) => {
 	for (const [key, meta] of tracked) (state[key] ??= { metas: [] }).metas.push(meta);
 	return state;
 };
+const alone = {
+	state: () => [],
+	changed: () => {},
+	ready: async () => {}
+};
 /**
 * The presences of a process by topic, in-process like broadcasts: each joined channel tracks at most one, under its
 * key, and channels that listen hear every join and leave on their topic, their own included, as Phoenix Presence
-* sends them. Tracking again replaces the presence: a leave of the old one and a join of the new. Refs count up, unique
-* in the process. Private and public channels of a topic do not see each other, as with broadcasts.
+* sends them. Tracking again replaces the presence: a leave of the old one and a join of the new. Refs count up after
+* `refPrefix`, unique in the process. Private and public channels of a topic do not see each other, as with broadcasts.
+* With `remote`, a topic's state holds the other processes' presences too, each change goes to them, and `hear` tells
+* the channels theirs.
 */
-const presenceHub = () => {
+const presenceHub = ({ refPrefix = "", remote = alone } = {}) => {
 	const publicTopics = /* @__PURE__ */ new Map();
 	const privateTopics = /* @__PURE__ */ new Map();
 	let lastRef = 0;
+	const topicsOf = (isPrivate) => isPrivate ? privateTopics : publicTopics;
 	const tell = (members, diff) => {
 		for (const member of members.keys()) if (member.listens) member.receive(diff);
 	};
-	return { 
-	/** Puts the member on the topic, with what it may do there until it leaves. */
-join: (topic, member) => {
-		const topics = member.private ? privateTopics : publicTopics;
-		const members = topics.get(topic) ?? /* @__PURE__ */ new Map();
-		topics.set(topic, members.set(member, void 0));
-		const untrack = () => {
-			const old = members.get(member);
-			if (!old) return;
-			members.set(member, void 0);
-			tell(members, {
-				joins: {},
-				leaves: stateOf([[member.key, old]])
-			});
-		};
-		return {
-			/** The topic's presences now, for `presence_state`. */
-			state: () => stateOf([...members].flatMap(([{ key }, meta]) => meta ? [[key, meta]] : [])),
-			track: (payload) => {
+	return {
+		/** Puts the member on the topic, with what it may do there until it leaves. */
+		join: (topic, member) => {
+			const topics = topicsOf(member.private);
+			const members = topics.get(topic) ?? /* @__PURE__ */ new Map();
+			topics.set(topic, members.set(member, void 0));
+			const untrack = () => {
 				const old = members.get(member);
-				const meta = {
-					...payload,
-					phx_ref: String(++lastRef),
-					...old && { phx_ref_prev: old.phx_ref }
-				};
-				members.set(member, meta);
+				if (!old) return;
+				members.set(member, void 0);
 				tell(members, {
-					joins: stateOf([[member.key, meta]]),
-					leaves: old ? stateOf([[member.key, old]]) : {}
+					joins: {},
+					leaves: stateOf([[member.key, old]])
+				});
+				remote.changed({
+					topic,
+					private: member.private,
+					key: member.key,
+					left: old
 				});
-			},
-			untrack,
-			leave: () => {
-				untrack();
-				members.delete(member);
-				if (members.size === 0 && topics.get(topic) === members) topics.delete(topic);
-			}
-		};
-	} };
+			};
+			return {
+				/** The topic's presences now, for `presence_state`. */
+				state: () => stateOf([...[...members].flatMap(([{ key }, meta]) => meta ? [[key, meta]] : []), ...remote.state(topic, member.private)]),
+				track: (payload) => {
+					const old = members.get(member);
+					const meta = {
+						...payload,
+						phx_ref: `${refPrefix}${++lastRef}`,
+						...old && { phx_ref_prev: old.phx_ref }
+					};
+					members.set(member, meta);
+					tell(members, {
+						joins: stateOf([[member.key, meta]]),
+						leaves: old ? stateOf([[member.key, old]]) : {}
+					});
+					remote.changed({
+						topic,
+						private: member.private,
+						key: member.key,
+						joined: meta,
+						...old && { left: old }
+					});
+				},
+				untrack,
+				leave: () => {
+					untrack();
+					members.delete(member);
+					if (members.size === 0 && topics.get(topic) === members) topics.delete(topic);
+				}
+			};
+		},
+		/** Tells the topic's listening channels a diff of another process's presences. */
+		hear: (topic, isPrivate, diff) => {
+			const members = topicsOf(isPrivate).get(topic);
+			if (members) tell(members, diff);
+		},
+		/** Every presence this process's channels track. */
+		tracked: () => [true, false].flatMap((isPrivate) => [...topicsOf(isPrivate)].flatMap(([topic, members]) => [...members].flatMap(([{ key }, meta]) => meta ? [{
+			topic,
+			private: isPrivate,
+			key,
+			meta
+		}] : []))),
+		ready: remote.ready
+	};
 };
 //#endregion
 export { presenceHub };

package/dist/realtime/realtime-app.js

@@ -3,15 +3,31 @@ import { changeChecker } from "./change-checker.js";
 import { changeHub } from "./change-hub.js";
 import { channelAccess } from "./channel-access.js";
 import { databaseBroadcasts } from "./database-broadcasts.js";
+import { presenceHub } from "./presence-hub.js";
 import { realtimeRoutes } from "./realtime-routes.js";
+import { relayed } from "./relay/realtime-options.js";
+import { relayedHubs } from "./relay/relayed-hubs.js";
 //#region src/realtime/realtime-app.ts
+const hubsOf = (deps, options, report) => {
+	if (relayed(options)) return relayedHubs({
+		db: deps.db,
+		statementTimeoutMs: deps.statementTimeoutMs,
+		report
+	});
+	return {
+		broadcasts: broadcastHub(),
+		presences: presenceHub(),
+		follow: () => () => {}
+	};
+};
 /**
 * `/api/sb/realtime/v1`: the `postgres_changes` of the live resources, each checked under the subscriber's role, claims and
-* the tables' RLS policies before it is sent, and broadcasts and presence between the channels of the process, on a
+* the tables' RLS policies before it is sent, and broadcasts and presence between the channels on a topic, of this
+* process or, with `processes: 'many'`, of every process serving the app, on a
 * private channel as the policies on `realtime.messages` allow, and the broadcasts the database sends with
 * `realtime.send()`.
 */
-const realtimeApp = ({ deps, feed, upgradeWebSocket, caller, report }) => {
+const realtimeApp = ({ deps, feed, upgradeWebSocket, caller, report, options }) => {
 	const live = deps.registry.entries.filter((entry) => entry.model.live);
 	const check = changeChecker({
 		db: deps.db,
@@ -28,7 +44,7 @@ const realtimeApp = ({ deps, feed, upgradeWebSocket, caller, report }) => {
 		db: deps.db,
 		statementTimeoutMs: deps.statementTimeoutMs
 	});
-	const broadcasts = broadcastHub();
+	const { broadcasts, presences, follow } = hubsOf(deps, options, report);
 	const database = databaseBroadcasts({
 		db: deps.db,
 		statementTimeoutMs: deps.statementTimeoutMs,
@@ -41,7 +57,15 @@ const realtimeApp = ({ deps, feed, upgradeWebSocket, caller, report }) => {
 		live,
 		hub,
 		broadcasts,
-		database,
+		presences,
+		database: { follow: () => {
+			const unfollowRelay = follow();
+			const unfollowDatabase = database.follow();
+			return () => {
+				unfollowDatabase();
+				unfollowRelay();
+			};
+		} },
 		access,
 		report
 	});

package/dist/realtime/realtime-routes.js

@@ -2,7 +2,6 @@ import { HttpProblem } from "../problem.js";
 import { broadcastApi } from "./broadcast-api.js";
 import { bufferedOf } from "./buffered-amount.js";
 import { vsnOf } from "./phoenix-message.js";
-import { presenceHub } from "./presence-hub.js";
 import { realtimeSocket } from "./realtime-socket.js";
 import { Hono } from "hono";
 //#region src/realtime/realtime-routes.ts
@@ -12,15 +11,14 @@ const keyRequest = (apikey, token) => new Request("http://realtime.invalid/", {
 } });
 /**
 * `GET /api/sb/realtime/v1/websocket?apikey=…&vsn=…`: Supabase Realtime's socket, for `postgres_changes` of the live
-* resources, and broadcasts and presence between the sockets of this process (see `realtimeSocket`). A missing or wrong
+* resources, and broadcasts and presence between the channels on a topic (see `realtimeSocket`). A missing or wrong
 * key is refused before the upgrade, with 401. A socket whose raw socket is not one of npm `ws`, such as Bun's own `ws`
 * shim's, is closed at once with 1011, since its unsent bytes cannot be counted (`realtimeLimits.maxUnsentBytes`).
 * `POST /api/sb/realtime/v1/api/broadcast` sends to the same channels without a socket (see `broadcastApi`), and so
 * does the database (see `databaseBroadcasts`).
 */
-const realtimeRoutes = ({ upgradeWebSocket, caller, live, hub, broadcasts, database, access, report }) => {
+const realtimeRoutes = ({ upgradeWebSocket, caller, live, hub, broadcasts, presences, database, access, report }) => {
 	const app = new Hono();
-	const presences = presenceHub();
 	let lastId = 0;
 	const nextId = () => ++lastId;
 	app.route("/api/broadcast", broadcastApi({
@@ -38,8 +36,8 @@ const realtimeRoutes = ({ upgradeWebSocket, caller, live, hub, broadcasts, datab
 		let socket;
 		let unfollow = () => {};
 		const closed = () => {
-			unfollow();
 			socket?.closed();
+			unfollow();
 		};
 		return {
 			onOpen: (_event, ws) => {

package/dist/realtime/realtime-socket.js

@@ -123,6 +123,8 @@ const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, broadc
 		const refused = await gate.authorize(caller);
 		if (!open) return;
 		if (refused) return push(reply(message, "error", { reason: `Unauthorized: ${readRefusalText(message.topic, refused)}` }));
+		await presences.ready();
+		if (!open) return;
 		const parsed = parseBindings(config.postgres_changes, live, nextId);
 		if (typeof parsed === "string") return push(reply(message, "error", { reason: parsed }));
 		const { topic } = message;
@@ -189,7 +191,7 @@ const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, broadc
 		const allowed = await channel.gate.mayWrite(channel.caller, "broadcast");
 		if (channels.get(message.topic) !== channel) return;
 		if (!allowed) return push(reply(message, "error", { error: "unauthorized" }));
-		if (!broadcasts.send(message.topic, channel.member, event, payload)) return push(reply(message, "error", { reason: `${tooFast} on this topic` }));
+		if (!await broadcasts.send(message.topic, channel.member, event, payload)) return push(reply(message, "error", { reason: `${tooFast} on this topic` }));
 		if (channel.ack) push(reply(message, "ok", {}));
 	};
 	const updatePresence = async (message, channel) => {