@protobase/server 0.58.7 → 0.59.0

package/dist/assistant/query-runner/query-runner.d.ts

@@ -6,16 +6,21 @@ export type TableName = {
   schema?: string;
   name: string;
 };
+/** The tables the role must never read: these, and every table in `schemas`, whatever its name. */
+export type GuardedTables = {
+  tables: readonly TableName[];
+  schemas: readonly string[];
+};
 /**
  * The SQL that makes the role the assistant's read-only queries run as, and its runner, and grants it exactly the
  * resources' tables, never an auth table; `undefined` when the database is current.
  */
-export declare const queryRunnerMigration: (db: Db, models: readonly ResourceModel[], authTables: readonly TableName[]) => Promise<string | undefined>;
+export declare const queryRunnerMigration: (db: Db, models: readonly ResourceModel[], authTables: GuardedTables) => Promise<string | undefined>;
 /**
  * Refuses to go on while the runner of the assistant's read-only queries is missing or out of date, or runs as a role
  * that is not weaker than the app's: the app's role itself or one it is a member of, a superuser, a login role, or one
  * that can read an auth table, or while the role may call a security-definer function that runs as a role able to
  * read one. It checks the owner's privileges, not its name, so a database cloned under another name still passes. A resource added since the last migration is not checked: Postgres refuses to read its table until then.
  */
-export declare const checkQueryRunner: (db: Db, authTables: readonly TableName[]) => Promise<void>;
+export declare const checkQueryRunner: (db: Db, authTables: GuardedTables) => Promise<void>;
 //#endregion

package/dist/assistant/query-runner/query-runner.js

@@ -8,6 +8,8 @@ const quoted = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
 const regclassText = ({ schema, name }) => schema ? `${quoted(schema)}.${quoted(name)}` : quoted(name);
 const roleSql = sql.raw(queryRoleSql);
 const rowsOf = async (db, query) => (await query.execute(db)).rows;
+const guardedRelations = ({ tables, schemas }) => sql`select c.oid, c.relnamespace from pg_class c join pg_namespace n on n.oid = c.relnamespace
+    where c.oid in (select to_regclass(t.name) from unnest(${tables.map(regclassText)}::text[]) as t(name)) or n.nspname = any(${[...schemas]}::text[])`;
 const resolved = (db, tables) => rowsOf(db, sql`select n.nspname as schema, c.relname as name from unnest(${tables.map(regclassText)}::text[]) with ordinality as t(name, n)
       join pg_class c on c.oid = to_regclass(t.name) join pg_namespace n on n.oid = c.relnamespace order by t.n`);
 const readRunner = async (db) => {
@@ -27,7 +29,8 @@ const readQueryRunner = async (db, models, authTables) => {
 		role,
 		runner: await readRunner(db),
 		resources: await resolved(db, models.map((model) => model.table)),
-		authTables: await resolved(db, authTables),
+		authTables: await resolved(db, authTables.tables),
+		guardedSchemas: [...authTables.schemas],
 		granted: {
 			tables,
 			schemas: schemas.map((found) => found.schema)
@@ -39,10 +42,11 @@ const readQueryRunner = async (db, models, authTables) => {
 * resources' tables, never an auth table; `undefined` when the database is current.
 */
 const queryRunnerMigration = async (db, models, authTables) => {
-	const { role, runner, resources, authTables: auth, granted } = await readQueryRunner(db, models, authTables);
+	const { role, runner, resources, authTables: auth, guardedSchemas, granted } = await readQueryRunner(db, models, authTables);
 	const plan = plannedGrants({
 		resources,
 		authTables: auth,
+		guardedSchemas,
 		granted
 	});
 	return role.exists && runner?.source === runnerBody && runner.definer && runner.owner === role.name && !runner.executable && plan.grants.length === 0 && plan.revokes.length === 0 ? void 0 : queryRunnerSql(plan);
@@ -53,7 +57,7 @@ const leakingFunctions = (db, authTables) => rowsOf(db, sql`with runner as (sele
       from pg_proc p join pg_namespace n on n.oid = p.pronamespace, runner
       where p.prosecdef and p.prorettype <> 'trigger'::regtype and p.proowner <> runner.role
         and has_schema_privilege(runner.role, p.pronamespace, 'USAGE') and has_function_privilege(runner.role, p.oid, 'EXECUTE')
-        and exists (select from unnest(${authTables.map(regclassText)}::text[]) as t(name) join pg_class c on c.oid = to_regclass(t.name)
+        and exists (select from (${guardedRelations(authTables)}) c
           where has_schema_privilege(p.proowner, c.relnamespace, 'USAGE') and has_any_column_privilege(p.proowner, c.oid, 'SELECT'))
       order by 1`);
 /**
@@ -65,7 +69,7 @@ const leakingFunctions = (db, authTables) => rowsOf(db, sql`with runner as (sele
 const checkQueryRunner = async (db, authTables) => {
 	const [runner] = await rowsOf(db, sql`select p.prosrc as source, p.prosecdef as definer,
       (o.rolsuper or o.rolcanlogin or pg_has_role(p.proowner, current_user, 'MEMBER')) as strong,
-      exists (select from unnest(${authTables.map(regclassText)}::text[]) as t(name) join pg_class c on c.oid = to_regclass(t.name)
+      exists (select from (${guardedRelations(authTables)}) c
         where has_schema_privilege(p.proowner, c.relnamespace, 'USAGE') and has_any_column_privilege(p.proowner, c.oid, 'SELECT')) as reads_auth
       from pg_proc p join pg_roles o on o.oid = p.proowner where p.oid = to_regprocedure(${queryRunnerSignature})`);
 	if (!runner || !runner.definer || runner.source !== runnerBody) throw refusal("is missing");

package/dist/assistant/query-runner/runner-plan.js

@@ -3,11 +3,11 @@ const same = (a, b) => a.schema === b.schema && a.name === b.name;
 const unique = (items, equal) => items.filter((item, index) => items.findIndex((other) => equal(item, other)) === index);
 /**
 * What the query role must be given and what taken back so that it reads exactly the resources' tables, never an auth
-* table, with usage on the schemas those are in. `resources` and `authTables` are the tables that exist, `granted`
-* what the role holds now.
+* table nor any table of a guarded schema, with usage on the schemas those are in. `resources` and `authTables` are the
+* tables that exist, `granted` what the role holds now.
 */
-const plannedGrants = ({ resources, authTables, granted }) => {
-	const tables = unique(resources.filter((table) => !authTables.some((auth) => same(table, auth))), same);
+const plannedGrants = ({ resources, authTables, guardedSchemas, granted }) => {
+	const tables = unique(resources.filter((table) => !guardedSchemas.includes(table.schema) && !authTables.some((auth) => same(table, auth))), same);
 	const schemas = [...new Set(tables.map((table) => table.schema))];
 	return {
 		grants: [...schemas.filter((schema) => !granted.schemas.includes(schema)).map((schema) => ({

package/dist/better-auth/auth-settings.d.ts

@@ -8823,6 +8823,7 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
       schema: string;
       table: string;
     } | undefined;
+    guardedSchemas: string[];
   };
   socialProviders: string[];
   appName: string;

package/dist/better-auth/auth-tables.d.ts

@@ -1,12 +1,19 @@
 import { AdminAuth } from "./create-auth.js";
 //#region src/better-auth/auth-tables.d.ts
+/** A table as config names it: the search path decides when it names no schema. */
+export type TableName = {
+  schema?: string;
+  name: string;
+};
+/** The tables the assistant's queries and the app's resources must never read: these, and every table in `schemas`. */
+export type AuthStoreTables = {
+  tables: TableName[];
+  schemas: string[];
+};
 /**
  * The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and
- * `storeTableNames`, and with `users.keyTable` the table under the user view too, such as Supabase's `auth.users`,
- * whose password hashes the view leaves out but the table holds.
+ * `storeTableNames`, with `users.keyTable` the table under the user view too, such as Supabase's `auth.users`, whose
+ * password hashes the view leaves out but the table holds, and every table of `users.guardedSchemas`.
  */
-export declare const authStoreTables: (auth: AdminAuth) => {
-  schema: string | undefined;
-  name: string;
-}[];
+export declare const authStoreTables: (auth: AdminAuth) => AuthStoreTables;
 //#endregion

package/dist/better-auth/auth-tables.js

@@ -3,8 +3,8 @@ import { storeTableNames } from "./store/table-names.js";
 //#region src/better-auth/auth-tables.ts
 /**
 * The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and
-* `storeTableNames`, and with `users.keyTable` the table under the user view too, such as Supabase's `auth.users`,
-* whose password hashes the view leaves out but the table holds.
+* `storeTableNames`, with `users.keyTable` the table under the user view too, such as Supabase's `auth.users`, whose
+* password hashes the view leaves out but the table holds, and every table of `users.guardedSchemas`.
 */
 const authStoreTables = (auth) => {
 	const { schema, users } = storeNames(auth);
@@ -12,10 +12,13 @@ const authStoreTables = (auth) => {
 		schema,
 		name
 	}));
-	return users.keyTable ? [...own, {
-		schema: users.keyTable.schema,
-		name: users.keyTable.table
-	}] : own;
+	return {
+		tables: users.keyTable ? [...own, {
+			schema: users.keyTable.schema,
+			name: users.keyTable.table
+		}] : own,
+		schemas: users.guardedSchemas
+	};
 };
 //#endregion
 export { authStoreTables };

package/dist/better-auth/create-auth.d.ts

@@ -8962,6 +8962,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
       schema: string;
       table: string;
     } | undefined;
+    guardedSchemas: string[];
   };
   socialProviders: string[];
   /** The app's name it signs in and mails as: `PROTOBASE_APP_NAME`, else `appName`, else `Protobase`. */

package/dist/better-auth/store/resources-outside.d.ts

@@ -2,6 +2,9 @@ import { AdminAuth } from "../create-auth.js";
 import { ResourceModel } from "@protobase/schema";
 import { Kysely } from "kysely";
 //#region src/better-auth/store/resources-outside.d.ts
-/** Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations. */
+/**
+ * Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations,
+ * or any table of a guarded schema (`users.guardedSchemas`), by the schema the catalogue finds the table in.
+ */
 export declare const checkResourcesOutsideAuthStore: (db: Kysely<any>, models: readonly ResourceModel[], auth: AdminAuth) => Promise<void>;
 //#endregion

package/dist/better-auth/store/resources-outside.js

@@ -6,12 +6,17 @@ const quoted = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
 const resolve = async (db, tables) => (await sql`select t.n::int as n, ns.nspname as schema, c.relname as name, current_database() as database
       from unnest(${tables.map(({ schema, name }) => schema ? `${quoted(schema)}.${quoted(name)}` : quoted(name))}::text[]) with ordinality as t(name, n)
       join pg_class c on c.oid = to_regclass(t.name) join pg_namespace ns on ns.oid = c.relnamespace order by t.n`.execute(db)).rows;
-/** Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations. */
+/**
+* Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations,
+* or any table of a guarded schema (`users.guardedSchemas`), by the schema the catalogue finds the table in.
+*/
 const checkResourcesOutsideAuthStore = async (db, models, auth) => {
 	if (models.length === 0) return;
-	const store = await resolve(storeDb(auth), authStoreTables(auth));
+	const { tables, schemas } = authStoreTables(auth);
+	const store = await resolve(storeDb(auth), tables);
 	const same = (a, b) => a.database === b.database && a.schema === b.schema && a.name === b.name;
-	const over = (await resolve(db, models.map((model) => model.table))).filter((table) => store.some((own) => same(own, table)));
+	const guarded = (table) => schemas.includes(table.schema) || store.some((own) => same(own, table));
+	const over = (await resolve(db, models.map((model) => model.table))).filter(guarded);
 	if (over.length === 0) return;
 	const named = over.map((table) => `${models[table.n - 1].name} (${table.schema}.${table.name})`).join(", ");
 	throw new Error(`Resources over the auth store's tables, which hold password hashes, sessions and tokens: ${named}. Remove them from the config; the auth store is read through Better Auth alone.`);

package/dist/better-auth/user-table.d.ts

@@ -37,5 +37,11 @@ export type UserTableOptions = {
     schema: string;
     table: string;
   };
+  /**
+   * Schemas the other system that made the user table keeps its sign-in data in, such as `['auth']` for Supabase Auth's
+   * identities, sessions, refresh tokens and two-factor secrets: every table in them, today's or one added later,
+   * counts among the store's tables. Name only a schema that holds none of the app's own tables.
+   */
+  guardedSchemas?: string[];
 };
 //#endregion

package/dist/better-auth/user-table.js

@@ -17,7 +17,7 @@ const userFields = {
 	last_organization_id: "lastOrganizationId"
 };
 /** The user table's names, from `auth.users` option; unknown columns are an error. */
-const userTable = ({ table = "user", columns = {}, metadata, keyTable } = {}) => {
+const userTable = ({ table = "user", columns = {}, metadata, keyTable, guardedSchemas = [] } = {}) => {
 	const unknown = Object.keys(columns).find((name) => !(name in userFields));
 	if (unknown !== void 0) throw new Error(`users.columns names "${unknown}", which is not a column of the user table: ${Object.keys(userFields).join(", ")}`);
 	const column = (name) => columns[name] ?? name;
@@ -26,7 +26,8 @@ const userTable = ({ table = "user", columns = {}, metadata, keyTable } = {}) =>
 		column,
 		fieldNames: Object.fromEntries(Object.entries(userFields).map(([name, field]) => [field, column(name)])),
 		metadata,
-		keyTable
+		keyTable,
+		guardedSchemas
 	};
 };
 /** Better Auth's `user` option: the table and its core columns. */

package/dist/channels/channel-bounds.js

@@ -0,0 +1,17 @@
+//#region src/channels/channel-bounds.ts
+/**
+* The bounds of `/api/channels` that its limits (`realtimeLimits`, the same as `/api/sb/realtime/v1`'s) do not give,
+* each no looser than its counterpart there.
+*/
+const channelBounds = {
+	/** How often the client says it is there; `@protobase/client` sends a ping this often. */
+	pingMs: 5e3,
+	/** How long a connection may stay silent before it is closed and its presences leave: 60 s on `/api/sb/realtime/v1`. */
+	idleMs: 12e3,
+	/** How often a connection's session, and its read access to each channel's record, are checked again. */
+	recheckMs: 1e4,
+	/** How long a send trusts the last check that the caller may read the record. */
+	readCacheMs: 5e3
+};
+//#endregion
+export { channelBounds };

package/dist/channels/channel-name.d.ts

@@ -0,0 +1 @@
+import "../registry.js";

package/dist/channels/channel-name.js

@@ -0,0 +1,30 @@
+import { fitsFrame } from "../realtime/broadcast-frame.js";
+import { decodeKey, encodeKey } from "@protobase/schema/internal";
+//#region src/channels/channel-name.ts
+/**
+* The record `resource` and `key` name, with the key's own text in the name, so `01` and `1` of an integer key name
+* one channel. `undefined` for a resource the app does not have or a key that is not one of its keys, which a join
+* refuses as it refuses a record the caller may not read; `'too-long'` for a name over 255 bytes.
+*/
+const channelRecord = (registry, resource, key) => {
+	const entry = registry.find(resource);
+	if (!entry) return;
+	const parsed = decodedKey(entry, key);
+	if (!parsed) return;
+	const name = `${resource}/${encodeKey(parsed)}`;
+	return fitsFrame(name) ? {
+		entry,
+		key: parsed,
+		name
+	} : "too-long";
+};
+const decodedKey = (entry, key) => {
+	try {
+		const decoded = decodeKey(key, entry.keyTypes);
+		return Array.isArray(decoded) ? decoded : [decoded];
+	} catch {
+		return;
+	}
+};
+//#endregion
+export { channelRecord };

package/dist/channels/channel-protocol.js

@@ -0,0 +1,33 @@
+//#region src/channels/channel-protocol.ts
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const text = (value) => typeof value === "string";
+/** The message a text frame carries, or `undefined` for one that is not JSON or not a message. */
+const decodeClientMessage = (frame) => {
+	const message = parsed(frame);
+	if (!isRecord(message)) return;
+	if (message.ref !== void 0 && !text(message.ref)) return;
+	const { type } = message;
+	if (type === "ping") return { type };
+	if (type === "token") return text(message.token) ? {
+		type,
+		token: message.token
+	} : void 0;
+	if (type === "join") return text(message.resource) && text(message.key) ? message : void 0;
+	if (!text(message.channel)) return;
+	if (type === "leave" || type === "untrack") return message;
+	if (type === "track") return "state" in message ? message : void 0;
+	if (type !== "send" || !text(message.event) || !("payload" in message)) return;
+	if (message.self !== void 0 && typeof message.self !== "boolean") return;
+	if (message.ack !== void 0 && typeof message.ack !== "boolean") return;
+	return message;
+};
+const parsed = (frame) => {
+	try {
+		return JSON.parse(frame);
+	} catch (error) {
+		if (error instanceof SyntaxError) return;
+		throw error;
+	}
+};
+//#endregion
+export { decodeClientMessage };

package/dist/channels/channel-refusals.js

@@ -0,0 +1,26 @@
+import { realtimeLimits } from "../realtime/realtime-limits.js";
+//#region src/channels/channel-refusals.ts
+const refusal = (code, message) => ({
+	code,
+	message
+});
+/**
+* Every refusal of `/api/channels`. A record the caller may not read is refused as one that does not exist, so a
+* channel never tells which records there are.
+*/
+const channelRefusals = {
+	notFound: refusal("not-found", "There is no such record"),
+	invalidMessage: refusal("invalid-message", "Send a JSON text frame of a ping, token, join, leave, track, untrack or send"),
+	notJoined: refusal("not-joined", "Join the channel first"),
+	alreadyJoined: refusal("already-joined", "This connection has joined the channel already"),
+	nameTooLong: refusal("name-too-long", "A channel name, its resource, a slash and its key, is at most 255 bytes"),
+	eventTooLong: refusal("event-too-long", "An event name is at most 255 bytes"),
+	tooManyJoins: refusal("too-many-joins", `Too many joins: at most ${realtimeLimits.joinsPerSecond} a second`),
+	tooManyChannels: refusal("too-many-channels", `Too many channels: at most ${realtimeLimits.channelsPerSocket} at once on a connection`),
+	tooManyMessages: refusal("too-many-messages", `Too many messages: at most ${realtimeLimits.eventsPerSecond} broadcasts and presence updates a second`),
+	channelTooBusy: refusal("channel-too-busy", `Too many broadcasts on this channel: at most ${realtimeLimits.topicBroadcastsPerSecond} a second, every sender's together`),
+	tooManyPresenceUpdates: refusal("too-many-presence-updates", `Too many presence updates: at most ${realtimeLimits.presencePerWindow} every ${realtimeLimits.presenceWindowMs / 1e3} seconds on a channel`),
+	presenceTooLarge: refusal("presence-too-large", `A tracked state is at most ${realtimeLimits.maxPresenceBytes} bytes of JSON`)
+};
+//#endregion
+export { channelRefusals };

package/dist/channels/channel-routes.js

@@ -0,0 +1,98 @@
+import { HttpProblem, notFound } from "../problem.js";
+import { realtimeLimits } from "../realtime/realtime-limits.js";
+import { bufferedOf } from "../realtime/buffered-amount.js";
+import { channelRecord } from "./channel-name.js";
+import { broadcastRecord, publishTo } from "./channel-sender.js";
+import { channelSocket } from "./channel-socket.js";
+import { recordReadable } from "./record-readable.js";
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+//#region src/channels/channel-routes.ts
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const bearerOf = (request) => request.headers.get("sec-websocket-protocol")?.split(",").map((part) => part.trim()).find((part) => part.startsWith("bearer."))?.slice(7);
+const withBearer = (request, token) => {
+	if (token === void 0 || request.headers.has("authorization")) return request;
+	const headers = new Headers(request.headers);
+	headers.set("authorization", `Bearer ${token}`);
+	return new Request(request, { headers });
+};
+const invalidBody = () => new HttpProblem(422, "invalid-broadcast", "Unprocessable Content", "Send { \"event\": \"…\", \"payload\": … } as application/json");
+/**
+* `GET /channels`, a WebSocket of channels named by records (see `channelSocket`), refused before the upgrade like
+* any request its caller cannot make. `POST /channels/:resource/:key/broadcast` sends one broadcast without a socket,
+* as the caller, when they may read the record.
+*/
+const channelRoutes = ({ deps, upgradeWebSocket, authenticate, authenticateUpgrade, onError, hubs, follow, report }) => {
+	const app = new Hono();
+	app.onError(onError);
+	const readable = (session, record) => recordReadable(deps, session, record);
+	app.get("/channels", async (c, next) => {
+		c.set("session", await authenticateUpgrade(withBearer(c.req.raw, bearerOf(c.req.raw))));
+		await next();
+	}, upgradeWebSocket((c) => {
+		const request = c.req.raw;
+		const opened = bearerOf(request);
+		let socket;
+		let unfollow = () => {};
+		const closed = () => {
+			socket?.closed();
+			unfollow();
+		};
+		return {
+			onOpen: (_event, ws) => {
+				if (bufferedOf(ws.raw) === void 0) {
+					report(/* @__PURE__ */ new Error("Not implemented: channels need WebSockets of npm ws, which count unsent bytes; on Bun, load npm ws by its path rather than Bun's ws shim, or run on Node"));
+					return ws.close(1011);
+				}
+				unfollow = follow();
+				socket = channelSocket({
+					send: (frame) => ws.send(frame),
+					buffered: () => bufferedOf(ws.raw),
+					close: (code) => ws.close(code),
+					session: c.get("session"),
+					reauthenticate: async (token) => authenticateUpgrade(withBearer(request, token ?? opened)),
+					record: (resource, key) => channelRecord(deps.registry, resource, key),
+					readable,
+					broadcasts: hubs.broadcasts,
+					presences: hubs.presences,
+					report
+				});
+			},
+			onMessage: (event) => socket?.message(event.data),
+			onError: closed,
+			onClose: closed
+		};
+	}));
+	app.post("/channels/:resource/:key/broadcast", async (c, next) => {
+		c.set("session", await authenticate(c.req.raw));
+		await next();
+	}, bodyLimit({
+		maxSize: realtimeLimits.maxFrameBytes,
+		onError: () => {
+			throw new HttpProblem(413, "too-large", "Payload Too Large", `A broadcast request is at most ${realtimeLimits.maxFrameBytes} bytes`);
+		}
+	}), async (c) => {
+		const body = await c.req.json().catch((error) => {
+			if (error instanceof SyntaxError) throw invalidBody();
+			throw error;
+		});
+		if (!isRecord(body) || typeof body.event !== "string" || !("payload" in body)) throw invalidBody();
+		const message = {
+			resource: c.req.param("resource"),
+			key: c.req.param("key"),
+			event: body.event,
+			payload: body.payload
+		};
+		const record = broadcastRecord(deps.registry, message);
+		const session = c.get("session");
+		if (!await recordReadable(deps, session, record)) throw notFound("There is no such record");
+		await publishTo(hubs.broadcasts, record, message.event, {
+			user: session.anonymous ? null : session.user.id,
+			payload: message.payload
+		});
+		return c.body(null, 202);
+	});
+	return app;
+};
+//#endregion
+export { channelRoutes };

package/dist/channels/channel-sender.d.ts

@@ -0,0 +1,20 @@
+import "../registry.js";
+import "./channel-name.js";
+//#region src/channels/channel-sender.d.ts
+/** A broadcast to the channel of a record, from outside a connection. */
+export type ChannelBroadcast = {
+  resource: string;
+  key: string;
+  event: string;
+  payload: unknown;
+};
+/** What the app's own code broadcasts to record channels with, such as a function's `channels`. */
+export type ChannelSender = {
+  /**
+   * Sends to every connection on the record's channel, of every process, as from the server (`server: true`, no
+   * user); nothing is stored, so with nobody on it, it reaches nobody. Rejects with a 404 problem for a record name
+   * the app does not have, 422 for an event over 255 bytes or a payload over a frame, 429 over the channel's rate.
+   */
+  broadcast: (message: ChannelBroadcast) => Promise<void>;
+};
+//#endregion

package/dist/channels/channel-sender.js

@@ -0,0 +1,39 @@
+import { HttpProblem, notFound } from "../problem.js";
+import { fitsFrame } from "../realtime/broadcast-frame.js";
+import { realtimeLimits } from "../realtime/realtime-limits.js";
+import { channelRecord } from "./channel-name.js";
+import { channelRefusals } from "./channel-refusals.js";
+import { Buffer } from "node:buffer";
+//#region src/channels/channel-sender.ts
+const invalid = (refusal) => new HttpProblem(422, refusal.code, "Unprocessable Content", refusal.message);
+/** The record a broadcast names, its event and payload checked, or a problem. */
+const broadcastRecord = (registry, { resource, key, event, payload }) => {
+	const found = channelRecord(registry, resource, key);
+	if (found === "too-long") throw invalid(channelRefusals.nameTooLong);
+	if (!found) throw notFound(channelRefusals.notFound.message);
+	if (!fitsFrame(event)) throw invalid(channelRefusals.eventTooLong);
+	const json = JSON.stringify(payload);
+	if (json === void 0 || Buffer.byteLength(json) > realtimeLimits.maxFrameBytes) throw invalid({
+		code: "invalid-payload",
+		message: `A payload is JSON of at most ${realtimeLimits.maxFrameBytes} bytes`
+	});
+	return found;
+};
+/** Publishes a checked broadcast, refused with 429 when the channel took its broadcasts for this second. */
+const publishTo = async (broadcasts, record, event, sent) => {
+	if (await broadcasts.publish([{
+		topic: record.name,
+		event,
+		payload: sent,
+		private: false
+	}])) return;
+	throw new HttpProblem(429, channelRefusals.channelTooBusy.code, "Too Many Requests", channelRefusals.channelTooBusy.message);
+};
+/** The server's own sender over the record channels' hub. */
+const channelSender = (registry, broadcasts) => ({ broadcast: async (message) => publishTo(broadcasts, broadcastRecord(registry, message), message.event, {
+	user: null,
+	server: true,
+	payload: message.payload
+}) });
+//#endregion
+export { broadcastRecord, channelSender, publishTo };