@protobase/server 0.58.8 → 0.59.0

package/dist/channels/channel-bounds.js

@@ -0,0 +1,17 @@
+//#region src/channels/channel-bounds.ts
+/**
+* The bounds of `/api/channels` that its limits (`realtimeLimits`, the same as `/api/sb/realtime/v1`'s) do not give,
+* each no looser than its counterpart there.
+*/
+const channelBounds = {
+	/** How often the client says it is there; `@protobase/client` sends a ping this often. */
+	pingMs: 5e3,
+	/** How long a connection may stay silent before it is closed and its presences leave: 60 s on `/api/sb/realtime/v1`. */
+	idleMs: 12e3,
+	/** How often a connection's session, and its read access to each channel's record, are checked again. */
+	recheckMs: 1e4,
+	/** How long a send trusts the last check that the caller may read the record. */
+	readCacheMs: 5e3
+};
+//#endregion
+export { channelBounds };

package/dist/channels/channel-name.d.ts

@@ -0,0 +1 @@
+import "../registry.js";

package/dist/channels/channel-name.js

@@ -0,0 +1,30 @@
+import { fitsFrame } from "../realtime/broadcast-frame.js";
+import { decodeKey, encodeKey } from "@protobase/schema/internal";
+//#region src/channels/channel-name.ts
+/**
+* The record `resource` and `key` name, with the key's own text in the name, so `01` and `1` of an integer key name
+* one channel. `undefined` for a resource the app does not have or a key that is not one of its keys, which a join
+* refuses as it refuses a record the caller may not read; `'too-long'` for a name over 255 bytes.
+*/
+const channelRecord = (registry, resource, key) => {
+	const entry = registry.find(resource);
+	if (!entry) return;
+	const parsed = decodedKey(entry, key);
+	if (!parsed) return;
+	const name = `${resource}/${encodeKey(parsed)}`;
+	return fitsFrame(name) ? {
+		entry,
+		key: parsed,
+		name
+	} : "too-long";
+};
+const decodedKey = (entry, key) => {
+	try {
+		const decoded = decodeKey(key, entry.keyTypes);
+		return Array.isArray(decoded) ? decoded : [decoded];
+	} catch {
+		return;
+	}
+};
+//#endregion
+export { channelRecord };

package/dist/channels/channel-protocol.js

@@ -0,0 +1,33 @@
+//#region src/channels/channel-protocol.ts
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const text = (value) => typeof value === "string";
+/** The message a text frame carries, or `undefined` for one that is not JSON or not a message. */
+const decodeClientMessage = (frame) => {
+	const message = parsed(frame);
+	if (!isRecord(message)) return;
+	if (message.ref !== void 0 && !text(message.ref)) return;
+	const { type } = message;
+	if (type === "ping") return { type };
+	if (type === "token") return text(message.token) ? {
+		type,
+		token: message.token
+	} : void 0;
+	if (type === "join") return text(message.resource) && text(message.key) ? message : void 0;
+	if (!text(message.channel)) return;
+	if (type === "leave" || type === "untrack") return message;
+	if (type === "track") return "state" in message ? message : void 0;
+	if (type !== "send" || !text(message.event) || !("payload" in message)) return;
+	if (message.self !== void 0 && typeof message.self !== "boolean") return;
+	if (message.ack !== void 0 && typeof message.ack !== "boolean") return;
+	return message;
+};
+const parsed = (frame) => {
+	try {
+		return JSON.parse(frame);
+	} catch (error) {
+		if (error instanceof SyntaxError) return;
+		throw error;
+	}
+};
+//#endregion
+export { decodeClientMessage };

package/dist/channels/channel-refusals.js

@@ -0,0 +1,26 @@
+import { realtimeLimits } from "../realtime/realtime-limits.js";
+//#region src/channels/channel-refusals.ts
+const refusal = (code, message) => ({
+	code,
+	message
+});
+/**
+* Every refusal of `/api/channels`. A record the caller may not read is refused as one that does not exist, so a
+* channel never tells which records there are.
+*/
+const channelRefusals = {
+	notFound: refusal("not-found", "There is no such record"),
+	invalidMessage: refusal("invalid-message", "Send a JSON text frame of a ping, token, join, leave, track, untrack or send"),
+	notJoined: refusal("not-joined", "Join the channel first"),
+	alreadyJoined: refusal("already-joined", "This connection has joined the channel already"),
+	nameTooLong: refusal("name-too-long", "A channel name, its resource, a slash and its key, is at most 255 bytes"),
+	eventTooLong: refusal("event-too-long", "An event name is at most 255 bytes"),
+	tooManyJoins: refusal("too-many-joins", `Too many joins: at most ${realtimeLimits.joinsPerSecond} a second`),
+	tooManyChannels: refusal("too-many-channels", `Too many channels: at most ${realtimeLimits.channelsPerSocket} at once on a connection`),
+	tooManyMessages: refusal("too-many-messages", `Too many messages: at most ${realtimeLimits.eventsPerSecond} broadcasts and presence updates a second`),
+	channelTooBusy: refusal("channel-too-busy", `Too many broadcasts on this channel: at most ${realtimeLimits.topicBroadcastsPerSecond} a second, every sender's together`),
+	tooManyPresenceUpdates: refusal("too-many-presence-updates", `Too many presence updates: at most ${realtimeLimits.presencePerWindow} every ${realtimeLimits.presenceWindowMs / 1e3} seconds on a channel`),
+	presenceTooLarge: refusal("presence-too-large", `A tracked state is at most ${realtimeLimits.maxPresenceBytes} bytes of JSON`)
+};
+//#endregion
+export { channelRefusals };

package/dist/channels/channel-routes.js

@@ -0,0 +1,98 @@
+import { HttpProblem, notFound } from "../problem.js";
+import { realtimeLimits } from "../realtime/realtime-limits.js";
+import { bufferedOf } from "../realtime/buffered-amount.js";
+import { channelRecord } from "./channel-name.js";
+import { broadcastRecord, publishTo } from "./channel-sender.js";
+import { channelSocket } from "./channel-socket.js";
+import { recordReadable } from "./record-readable.js";
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+//#region src/channels/channel-routes.ts
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const bearerOf = (request) => request.headers.get("sec-websocket-protocol")?.split(",").map((part) => part.trim()).find((part) => part.startsWith("bearer."))?.slice(7);
+const withBearer = (request, token) => {
+	if (token === void 0 || request.headers.has("authorization")) return request;
+	const headers = new Headers(request.headers);
+	headers.set("authorization", `Bearer ${token}`);
+	return new Request(request, { headers });
+};
+const invalidBody = () => new HttpProblem(422, "invalid-broadcast", "Unprocessable Content", "Send { \"event\": \"…\", \"payload\": … } as application/json");
+/**
+* `GET /channels`, a WebSocket of channels named by records (see `channelSocket`), refused before the upgrade like
+* any request its caller cannot make. `POST /channels/:resource/:key/broadcast` sends one broadcast without a socket,
+* as the caller, when they may read the record.
+*/
+const channelRoutes = ({ deps, upgradeWebSocket, authenticate, authenticateUpgrade, onError, hubs, follow, report }) => {
+	const app = new Hono();
+	app.onError(onError);
+	const readable = (session, record) => recordReadable(deps, session, record);
+	app.get("/channels", async (c, next) => {
+		c.set("session", await authenticateUpgrade(withBearer(c.req.raw, bearerOf(c.req.raw))));
+		await next();
+	}, upgradeWebSocket((c) => {
+		const request = c.req.raw;
+		const opened = bearerOf(request);
+		let socket;
+		let unfollow = () => {};
+		const closed = () => {
+			socket?.closed();
+			unfollow();
+		};
+		return {
+			onOpen: (_event, ws) => {
+				if (bufferedOf(ws.raw) === void 0) {
+					report(/* @__PURE__ */ new Error("Not implemented: channels need WebSockets of npm ws, which count unsent bytes; on Bun, load npm ws by its path rather than Bun's ws shim, or run on Node"));
+					return ws.close(1011);
+				}
+				unfollow = follow();
+				socket = channelSocket({
+					send: (frame) => ws.send(frame),
+					buffered: () => bufferedOf(ws.raw),
+					close: (code) => ws.close(code),
+					session: c.get("session"),
+					reauthenticate: async (token) => authenticateUpgrade(withBearer(request, token ?? opened)),
+					record: (resource, key) => channelRecord(deps.registry, resource, key),
+					readable,
+					broadcasts: hubs.broadcasts,
+					presences: hubs.presences,
+					report
+				});
+			},
+			onMessage: (event) => socket?.message(event.data),
+			onError: closed,
+			onClose: closed
+		};
+	}));
+	app.post("/channels/:resource/:key/broadcast", async (c, next) => {
+		c.set("session", await authenticate(c.req.raw));
+		await next();
+	}, bodyLimit({
+		maxSize: realtimeLimits.maxFrameBytes,
+		onError: () => {
+			throw new HttpProblem(413, "too-large", "Payload Too Large", `A broadcast request is at most ${realtimeLimits.maxFrameBytes} bytes`);
+		}
+	}), async (c) => {
+		const body = await c.req.json().catch((error) => {
+			if (error instanceof SyntaxError) throw invalidBody();
+			throw error;
+		});
+		if (!isRecord(body) || typeof body.event !== "string" || !("payload" in body)) throw invalidBody();
+		const message = {
+			resource: c.req.param("resource"),
+			key: c.req.param("key"),
+			event: body.event,
+			payload: body.payload
+		};
+		const record = broadcastRecord(deps.registry, message);
+		const session = c.get("session");
+		if (!await recordReadable(deps, session, record)) throw notFound("There is no such record");
+		await publishTo(hubs.broadcasts, record, message.event, {
+			user: session.anonymous ? null : session.user.id,
+			payload: message.payload
+		});
+		return c.body(null, 202);
+	});
+	return app;
+};
+//#endregion
+export { channelRoutes };

package/dist/channels/channel-sender.d.ts

@@ -0,0 +1,20 @@
+import "../registry.js";
+import "./channel-name.js";
+//#region src/channels/channel-sender.d.ts
+/** A broadcast to the channel of a record, from outside a connection. */
+export type ChannelBroadcast = {
+  resource: string;
+  key: string;
+  event: string;
+  payload: unknown;
+};
+/** What the app's own code broadcasts to record channels with, such as a function's `channels`. */
+export type ChannelSender = {
+  /**
+   * Sends to every connection on the record's channel, of every process, as from the server (`server: true`, no
+   * user); nothing is stored, so with nobody on it, it reaches nobody. Rejects with a 404 problem for a record name
+   * the app does not have, 422 for an event over 255 bytes or a payload over a frame, 429 over the channel's rate.
+   */
+  broadcast: (message: ChannelBroadcast) => Promise<void>;
+};
+//#endregion

package/dist/channels/channel-sender.js

@@ -0,0 +1,39 @@
+import { HttpProblem, notFound } from "../problem.js";
+import { fitsFrame } from "../realtime/broadcast-frame.js";
+import { realtimeLimits } from "../realtime/realtime-limits.js";
+import { channelRecord } from "./channel-name.js";
+import { channelRefusals } from "./channel-refusals.js";
+import { Buffer } from "node:buffer";
+//#region src/channels/channel-sender.ts
+const invalid = (refusal) => new HttpProblem(422, refusal.code, "Unprocessable Content", refusal.message);
+/** The record a broadcast names, its event and payload checked, or a problem. */
+const broadcastRecord = (registry, { resource, key, event, payload }) => {
+	const found = channelRecord(registry, resource, key);
+	if (found === "too-long") throw invalid(channelRefusals.nameTooLong);
+	if (!found) throw notFound(channelRefusals.notFound.message);
+	if (!fitsFrame(event)) throw invalid(channelRefusals.eventTooLong);
+	const json = JSON.stringify(payload);
+	if (json === void 0 || Buffer.byteLength(json) > realtimeLimits.maxFrameBytes) throw invalid({
+		code: "invalid-payload",
+		message: `A payload is JSON of at most ${realtimeLimits.maxFrameBytes} bytes`
+	});
+	return found;
+};
+/** Publishes a checked broadcast, refused with 429 when the channel took its broadcasts for this second. */
+const publishTo = async (broadcasts, record, event, sent) => {
+	if (await broadcasts.publish([{
+		topic: record.name,
+		event,
+		payload: sent,
+		private: false
+	}])) return;
+	throw new HttpProblem(429, channelRefusals.channelTooBusy.code, "Too Many Requests", channelRefusals.channelTooBusy.message);
+};
+/** The server's own sender over the record channels' hub. */
+const channelSender = (registry, broadcasts) => ({ broadcast: async (message) => publishTo(broadcasts, broadcastRecord(registry, message), message.event, {
+	user: null,
+	server: true,
+	payload: message.payload
+}) });
+//#endregion
+export { broadcastRecord, channelSender, publishTo };

package/dist/channels/channel-socket.js

@@ -0,0 +1,253 @@
+import { fitsFrame } from "../realtime/broadcast-frame.js";
+import { realtimeLimits } from "../realtime/realtime-limits.js";
+import { fixedWindow, fixedWindows } from "../realtime/fixed-window.js";
+import { channelRefusals } from "./channel-refusals.js";
+import { channelBounds } from "./channel-bounds.js";
+import { decodeClientMessage } from "./channel-protocol.js";
+import { entriesOf, entryDiff } from "./presence-entries.js";
+import { senderOf } from "./sent.js";
+import { randomUUID } from "node:crypto";
+import { Buffer } from "node:buffer";
+//#region src/channels/channel-socket.ts
+const messageTooBig = 1009;
+const policyViolation = 1008;
+const frameBytes = (frame) => {
+	if (typeof frame === "string") return Buffer.byteLength(frame);
+	if (frame instanceof ArrayBuffer || ArrayBuffer.isView(frame)) return frame.byteLength;
+	if (frame instanceof Blob) return frame.size;
+	return NaN;
+};
+const userOf = (session) => session.anonymous ? null : session.user.id;
+/**
+* One WebSocket of `/api/channels`: channels named by records, which a caller joins only while it may read the record,
+* with presence and broadcasts between the connections on each. Messages are handled one at a time, in order. Every
+* presence and broadcast carries the session's user, never one the client names. The session and each channel's read
+* access are checked again every `channelBounds.recheckMs`, and a send or track trusts the last check for
+* `channelBounds.readCacheMs`: a channel whose record the caller may no longer read is closed, and a session that signs
+* in nobody, or someone else, closes the socket. A socket silent for `channelBounds.idleMs` is closed, and a close
+* leaves every channel, its presences with it. The limits are `realtimeLimits`, as on `/api/sb/realtime/v1`.
+*/
+const channelSocket = ({ send, buffered, close, session: first, reauthenticate, record, readable, broadcasts, presences, report, now = Date.now }) => {
+	const channels = /* @__PURE__ */ new Map();
+	let session = first;
+	let token;
+	let queue = Promise.resolve();
+	let queuedMessages = 0;
+	let queuedBytes = 0;
+	let idle;
+	let open = true;
+	const events = fixedWindow(realtimeLimits.eventsPerSecond, 1e3, now);
+	const joins = fixedWindow(realtimeLimits.joinsPerSecond, 1e3, now);
+	const presenceRate = fixedWindows(realtimeLimits.presencePerWindow, realtimeLimits.presenceWindowMs, now);
+	const leaveAll = () => {
+		open = false;
+		clearTimeout(idle);
+		clearInterval(recheck);
+		for (const name of [...channels.keys()]) leave(name);
+	};
+	const shut = (code) => {
+		if (!open) return;
+		open = false;
+		clearTimeout(idle);
+		clearInterval(recheck);
+		close(code);
+		Promise.resolve().then(leaveAll).catch(report);
+	};
+	const push = (message) => {
+		if (!open) return;
+		if (!(buffered() <= realtimeLimits.maxUnsentBytes)) return shut(policyViolation);
+		send(JSON.stringify(message));
+	};
+	const ok = (ref, channel) => {
+		if (ref === void 0) return;
+		push({
+			type: "reply",
+			ref,
+			ok: true,
+			...channel !== void 0 && { channel }
+		});
+	};
+	const refuse = (ref, error) => {
+		if (ref === void 0) return push({
+			type: "error",
+			error
+		});
+		push({
+			type: "reply",
+			ref,
+			ok: false,
+			error
+		});
+	};
+	const leave = (name) => {
+		channels.get(name)?.remove();
+		channels.delete(name);
+	};
+	const end = (name, error) => {
+		if (!channels.has(name)) return;
+		leave(name);
+		push({
+			type: "closed",
+			channel: name,
+			error
+		});
+	};
+	const join = async (message) => {
+		if (!joins()) return refuse(message.ref, channelRefusals.tooManyJoins);
+		const found = record(message.resource, message.key);
+		if (found === "too-long") return refuse(message.ref, channelRefusals.nameTooLong);
+		if (found && channels.has(found.name)) return refuse(message.ref, channelRefusals.alreadyJoined);
+		if (channels.size >= realtimeLimits.channelsPerSocket) return refuse(message.ref, channelRefusals.tooManyChannels);
+		if (!found || !await readable(session, found)) return refuse(message.ref, channelRefusals.notFound);
+		await presences.ready();
+		if (!open || channels.has(found.name)) return;
+		const { name } = found;
+		const member = {
+			self: false,
+			private: false,
+			receive: (event, payload) => hear(name, event, payload)
+		};
+		const seat = presences.join(name, {
+			key: randomUUID(),
+			private: false,
+			listens: true,
+			receive: (diff) => push({
+				type: "presence_diff",
+				channel: name,
+				...entryDiff(diff)
+			})
+		});
+		const offBroadcast = broadcasts.join(name, member);
+		channels.set(name, {
+			record: found,
+			member,
+			seat,
+			checkedAt: now(),
+			remove: () => (offBroadcast(), seat.leave())
+		});
+		ok(message.ref, name);
+		push({
+			type: "presence",
+			channel: name,
+			entries: entriesOf(seat.state())
+		});
+	};
+	const hear = (name, event, sent) => {
+		if (!channels.has(name)) return;
+		push({
+			type: "broadcast",
+			channel: name,
+			event,
+			payload: sent.payload,
+			...senderOf(sent)
+		});
+	};
+	const stillReadable = async (name, channel) => {
+		if (now() - channel.checkedAt < channelBounds.readCacheMs) return true;
+		const allowed = await readable(session, channel.record);
+		if (channels.get(name) !== channel) return false;
+		if (!allowed) {
+			end(name, channelRefusals.notFound);
+			return false;
+		}
+		channel.checkedAt = now();
+		return true;
+	};
+	const sendBroadcast = async (message, channel) => {
+		if (!events()) return refuse(message.ref, channelRefusals.tooManyMessages);
+		if (!fitsFrame(message.event)) return refuse(message.ref, channelRefusals.eventTooLong);
+		if (!await stillReadable(message.channel, channel)) return refuse(message.ref, channelRefusals.notFound);
+		const sent = {
+			user: userOf(session),
+			payload: message.payload
+		};
+		if (!await broadcasts.send(message.channel, channel.member, message.event, sent)) return refuse(message.ref, channelRefusals.channelTooBusy);
+		if (message.self === true) hear(message.channel, message.event, sent);
+		if (message.ack === true) ok(message.ref);
+	};
+	const updatePresence = async (message, channel) => {
+		if (!events()) return refuse(message.ref, channelRefusals.tooManyMessages);
+		if (!presenceRate(message.channel)) return refuse(message.ref, channelRefusals.tooManyPresenceUpdates);
+		if (message.type === "untrack") {
+			channel.seat.untrack();
+			return ok(message.ref);
+		}
+		if (Buffer.byteLength(JSON.stringify(message.state) ?? "") > realtimeLimits.maxPresenceBytes) return refuse(message.ref, channelRefusals.presenceTooLarge);
+		if (!await stillReadable(message.channel, channel)) return refuse(message.ref, channelRefusals.notFound);
+		channel.seat.track({
+			user: userOf(session),
+			state: message.state
+		});
+		ok(message.ref);
+	};
+	const handle = async (message) => {
+		if (!open) return;
+		if (message.type === "ping") return push({ type: "pong" });
+		if (message.type === "token") {
+			token = message.token;
+			return;
+		}
+		if (message.type === "join") return join(message);
+		const channel = channels.get(message.channel);
+		if (!channel) return refuse(message.ref, channelRefusals.notJoined);
+		if (message.type === "send") return sendBroadcast(message, channel);
+		if (message.type === "track" || message.type === "untrack") return updatePresence(message, channel);
+		leave(message.channel);
+		ok(message.ref);
+	};
+	const checkAgain = async () => {
+		const again = await reauthenticate(token).then((next) => next, () => void 0);
+		if (!open) return;
+		if (!again || userOf(again) !== userOf(session)) return shut(policyViolation);
+		session = again;
+		for (const [name, channel] of [...channels]) {
+			const allowed = await readable(session, channel.record);
+			if (channels.get(name) !== channel) continue;
+			if (!allowed) end(name, channelRefusals.notFound);
+			else channel.checkedAt = now();
+		}
+	};
+	let rechecking = false;
+	const recheck = setInterval(() => {
+		if (rechecking || !open) return;
+		rechecking = true;
+		checkAgain().catch(fail).finally(() => rechecking = false);
+	}, channelBounds.recheckMs);
+	const stayAwake = () => {
+		clearTimeout(idle);
+		idle = setTimeout(() => shut(), channelBounds.idleMs);
+	};
+	stayAwake();
+	const fail = (error) => {
+		report(error);
+		shut();
+	};
+	return {
+		/**
+		* Handles a text frame after those before it; a binary one, or one that is not a message, gets an error. A frame
+		* over the size cap, or of a kind whose size is unknown, closes the socket.
+		*/
+		message: (frame) => {
+			if (!open) return;
+			const size = frameBytes(frame);
+			if (!(size <= realtimeLimits.maxFrameBytes)) return shut(messageTooBig);
+			stayAwake();
+			const message = typeof frame === "string" ? decodeClientMessage(frame) : void 0;
+			if (!message) return push({
+				type: "error",
+				error: channelRefusals.invalidMessage
+			});
+			queuedMessages += 1;
+			queuedBytes += size;
+			if (queuedMessages > realtimeLimits.maxQueuedMessages || queuedBytes > realtimeLimits.maxQueuedBytes) return shut(policyViolation);
+			queue = queue.then(() => handle(message)).catch(fail).finally(() => {
+				queuedMessages -= 1;
+				queuedBytes -= size;
+			});
+		},
+		/** Ends every channel of a socket that closed. */
+		closed: leaveAll
+	};
+};
+//#endregion
+export { channelSocket };

package/dist/channels/presence-entries.js

@@ -0,0 +1,24 @@
+//#region src/channels/presence-entries.ts
+/** The hub's presences as entries: each key is one connection on the channel, so it holds one presence at most. */
+const entriesOf = (state) => Object.entries(state).flatMap(([id, { metas }]) => metas.map(({ user, state: tracked }) => ({
+	id,
+	user,
+	state: tracked
+})));
+/**
+* A hub diff as joins, updates and leaves: a key that left and joined in one diff tracked again, an update. A key
+* that joins without the leave of its old state, as from another process whose leave this one never saw, is a join.
+*/
+const entryDiff = (diff) => {
+	const joined = entriesOf(diff.joins);
+	const left = entriesOf(diff.leaves);
+	const joinedIds = new Set(joined.map((entry) => entry.id));
+	const leftIds = new Set(left.map((entry) => entry.id));
+	return {
+		joins: joined.filter((entry) => !leftIds.has(entry.id)),
+		updates: joined.filter((entry) => leftIds.has(entry.id)),
+		leaves: left.filter((entry) => !joinedIds.has(entry.id))
+	};
+};
+//#endregion
+export { entriesOf, entryDiff };

package/dist/channels/record-readable.js

@@ -0,0 +1,28 @@
+import { HttpProblem } from "../problem.js";
+import { requestAccess } from "../request-access.js";
+import { readTransaction } from "../transactions.js";
+import { fetchReadable } from "../fetch-readable.js";
+//#region src/channels/record-readable.ts
+const refusedStatuses = /* @__PURE__ */ new Set([
+	401,
+	403,
+	404
+]);
+/**
+* Whether the caller may read the record, as `GET /api/<resource>/<key>` decides it: the resource's read access, the
+* tenant, the row filter, the parents read and a record-level read rule. A soft-deleted record is not readable.
+*/
+const recordReadable = async (deps, session, { entry, key }) => {
+	const read = async () => {
+		const access = await requestAccess(deps, entry, session);
+		if (!access.resolved.operations.read) return false;
+		const primary = access.full.fields[access.full.primaryKey[0]];
+		return await readTransaction(deps.db, deps.statementTimeoutMs, (trx) => fetchReadable(trx, access, key, "hide", { fields: [primary] })) !== void 0;
+	};
+	return read().catch((error) => {
+		if (error instanceof HttpProblem && refusedStatuses.has(error.status)) return false;
+		throw error;
+	});
+};
+//#endregion
+export { recordReadable };

package/dist/channels/sent.js

@@ -0,0 +1,8 @@
+//#region src/channels/sent.ts
+/** The sender as a broadcast message names it. */
+const senderOf = (sent) => ({
+	user: sent.user,
+	...sent.server && { server: true }
+});
+//#endregion
+export { senderOf };

package/dist/create-admin.js

@@ -16,8 +16,11 @@ import { apiCors, readCorsOrigins, withMobileOrigins } from "./api-cors.js";
 import { apiKeySettings } from "./api-keys/api-key-settings.js";
 import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { jwtVerifier } from "./auth/jwt.js";
-import { relayed } from "./realtime/relay/realtime-options.js";
 import { realtimeApp } from "./realtime/realtime-app.js";
+import { relayed } from "./realtime/relay/realtime-options.js";
+import { realtimeHubs } from "./realtime/realtime-hubs.js";
+import { channelSender } from "./channels/channel-sender.js";
+import { channelRoutes } from "./channels/channel-routes.js";
 import { startRealtimePrune } from "./realtime/realtime-prune.js";
 import { restRoutes } from "./rest/rest-routes.js";
 import { storageRoutes } from "./storage/storage-routes.js";
@@ -376,6 +379,8 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		}
 	});
 	const decryptField = fieldDecrypter(deps);
+	const hubs = realtimeHubs(deps, realtime, report);
+	const channels = channelSender(registry, hubs.records.broadcasts);
 	app.route("/", functionRoutes({
 		basePath: `${systemPath}/functions`,
 		functions: apiFunctions,
@@ -383,6 +388,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		access: deps.accessOptions,
 		db,
 		records: (session) => callerRecords(deps, session),
+		channels,
 		decryptField,
 		onError,
 		wake: () => wakeDispatch(deps),
@@ -391,6 +397,19 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		...calls && { calls },
 		report
 	}));
+	if (upgradeWebSocket) {
+		const visitors = (caller) => withAnonymous(caller, options.roles);
+		app.route(systemPath || "/", channelRoutes({
+			deps,
+			upgradeWebSocket,
+			authenticate: visitors(authenticate),
+			authenticateUpgrade: visitors(upgradeAuthenticate),
+			onError,
+			hubs: hubs.records,
+			follow: hubs.follow,
+			report
+		}));
+	}
 	const verifyGoTrue = auth ? jwtVerifier(goTrueTokens({ auth })) : () => Promise.reject(unauthorized("This app signs no user tokens"));
 	app.route("/", supabaseFunctionRoutes({
 		functions: apiFunctions,
@@ -435,7 +454,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			upgradeWebSocket,
 			caller,
 			report,
-			...realtime && { options: realtime }
+			hubs
 		}));
 		if (files?.storage) {
 			const storage = {
@@ -462,6 +481,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		deps,
 		subscriptions,
 		functions: apiFunctions,
+		channels,
 		schema: changes,
 		log: (line) => console.log(line),
 		...table && { table }

package/dist/functions/define-function.d.ts

@@ -3,6 +3,7 @@ import { Session } from "../types.js";
 import { Caller } from "../api-keys/resolve-caller.js";
 import { SocketEvents } from "./function-socket.js";
 import { CallsAccess } from "../calls/calls-access.js";
+import { ChannelSender } from "../channels/channel-sender.js";
 import { FunctionRecords } from "./records.js";
 import { Capability } from "@protobase/schema";
 import { Db } from "@protobase/query";
@@ -13,6 +14,8 @@ export type PublicFunctionContext = {
   name: string;
   /** The database itself, with no access rules, row filters or tenant scope: privileged work only. */
   db: Db;
+  /** Broadcasts to the channel of a record, as the server, to whoever is on it (see `/api/channels`). */
+  channels: ChannelSender;
   /** The caller, through the app's own `authenticate`: rejects with a 401 problem when the request carries no valid token. */
   caller: () => Promise<FunctionCaller>;
   /**

package/dist/functions/routes.js

@@ -24,7 +24,7 @@ const isUpgrade = (request) => request.headers.get("upgrade")?.toLowerCase() ===
 * A function may answer an upgrade with a socket, only once it returned. While it is open, its caller is checked again
 * every minute: a protected function's always, a public one's once `caller()` resolved.
 */
-const functionRoutes = ({ basePath, functions, authenticate, access, db, records, decryptField, onError, wake, upgradeWebSocket, upgradeAuthenticate = authenticate, calls: callsOptions, report }) => {
+const functionRoutes = ({ basePath, functions, authenticate, access, db, records, channels, decryptField, onError, wake, upgradeWebSocket, upgradeAuthenticate = authenticate, calls: callsOptions, report }) => {
 	const calls = callsAccess(callsOptions);
 	const app = new Hono().basePath(basePath);
 	app.onError(onError);
@@ -68,6 +68,7 @@ const functionRoutes = ({ basePath, functions, authenticate, access, db, records
 				const context = {
 					name,
 					db,
+					channels,
 					caller: resolveCaller,
 					acceptWebSocket: acceptor.accept,
 					calls
@@ -95,6 +96,7 @@ const functionRoutes = ({ basePath, functions, authenticate, access, db, records
 			const context = {
 				name,
 				db,
+				channels,
 				...caller,
 				caller: async () => caller,
 				decryptField: decryptField(reader),

package/dist/index.d.ts

@@ -32,6 +32,7 @@ import { FunctionSocket, SocketEvents } from "./functions/function-socket.js";
 import { CallMember } from "./calls/call-member.js";
 import { CallsAccess } from "./calls/calls-access.js";
 import { ResourceSource, configExports } from "./resource-source.js";
+import { ChannelBroadcast, ChannelSender } from "./channels/channel-sender.js";
 import { ErrorReportingOptions, ErrorReportingSettings, errorReportingSettings, errorReportingVariable } from "./error-reporting/error-reporting-settings.js";
 import { ChatMessage, ChatTextPart, Completion, CompletionOptions, ModelError, ModelSettings, ReasoningDetail, ReasoningEffort, ToolCall, ToolSpec, streamChatCompletion } from "./assistant/chat-completions.js";
 import { CleanupEntry, CleanupSchedule, ScheduledDelete, storageCleanupSchedule } from "./files/cleanup-schedule.js";
@@ -174,4 +175,4 @@ import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/ru
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, normalizeRoles } from "./better-auth/create-auth.js";
-export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.58.8";
+var version = "0.59.0";
 //#endregion
 export { version };

package/dist/realtime/broadcast-hub.js

@@ -1,5 +1,5 @@
-import { fixedWindows } from "./fixed-window.js";
 import { realtimeLimits } from "./realtime-limits.js";
+import { fixedWindows } from "./fixed-window.js";
 //#region src/realtime/broadcast-hub.ts
 /**
 * The channels of a process by topic, which hear each other's broadcasts in-process; with several processes,

package/dist/realtime/broadcast-request.js

@@ -1,6 +1,6 @@
 import { HttpProblem } from "../problem.js";
-import { realtimeLimits } from "./realtime-limits.js";
 import { fitsFrame } from "./broadcast-frame.js";
+import { realtimeLimits } from "./realtime-limits.js";
 //#region src/realtime/broadcast-request.ts
 /** A refused broadcast request; `message` too, which realtime-js's `httpSend` reads as the error. */
 const broadcastProblem = (status, slug, title, detail) => new HttpProblem(status, slug, title, detail, { message: detail });

package/dist/realtime/database-broadcasts.js

@@ -1,6 +1,6 @@
 import { writeTransaction } from "../transactions.js";
-import { realtimeLimits } from "./realtime-limits.js";
 import { fitsFrame } from "./broadcast-frame.js";
+import { realtimeLimits } from "./realtime-limits.js";
 import { sql } from "kysely";
 import { Buffer } from "node:buffer";
 //#region src/realtime/database-broadcasts.ts

package/dist/realtime/realtime-app.js

@@ -1,26 +1,10 @@
-import { broadcastHub } from "./broadcast-hub.js";
 import { changeChecker } from "./change-checker.js";
 import { changeHub } from "./change-hub.js";
 import { channelAccess } from "./channel-access.js";
 import { filterCheck } from "./filter-check.js";
 import { databaseBroadcasts } from "./database-broadcasts.js";
-import { presenceHub } from "./presence-hub.js";
 import { realtimeRoutes } from "./realtime-routes.js";
-import { relayed } from "./relay/realtime-options.js";
-import { relayedHubs } from "./relay/relayed-hubs.js";
 //#region src/realtime/realtime-app.ts
-const hubsOf = (deps, options, report) => {
-	if (relayed(options)) return relayedHubs({
-		db: deps.db,
-		statementTimeoutMs: deps.statementTimeoutMs,
-		report
-	});
-	return {
-		broadcasts: broadcastHub(),
-		presences: presenceHub(),
-		follow: () => () => {}
-	};
-};
 /**
 * `/api/sb/realtime/v1`: the `postgres_changes` of the live resources, each checked under the subscriber's role, claims and
 * the tables' RLS policies before it is sent, and broadcasts and presence between the channels on a topic, of this
@@ -28,7 +12,7 @@ const hubsOf = (deps, options, report) => {
 * private channel as the policies on `realtime.messages` allow, and the broadcasts the database sends with
 * `realtime.send()`.
 */
-const realtimeApp = ({ deps, feed, upgradeWebSocket, caller, report, options }) => {
+const realtimeApp = ({ deps, feed, upgradeWebSocket, caller, report, hubs }) => {
 	const live = deps.registry.entries.filter((entry) => entry.model.live);
 	const check = changeChecker({
 		db: deps.db,
@@ -49,7 +33,7 @@ const realtimeApp = ({ deps, feed, upgradeWebSocket, caller, report, options })
 		db: deps.db,
 		statementTimeoutMs: deps.statementTimeoutMs
 	});
-	const { broadcasts, presences, follow } = hubsOf(deps, options, report);
+	const { topics: { broadcasts, presences }, follow } = hubs;
 	const database = databaseBroadcasts({
 		db: deps.db,
 		statementTimeoutMs: deps.statementTimeoutMs,

package/dist/realtime/realtime-hubs.js

@@ -0,0 +1,30 @@
+import { broadcastHub } from "./broadcast-hub.js";
+import { presenceHub } from "./presence-hub.js";
+import { relayed } from "./relay/realtime-options.js";
+import { relayedHubs } from "./relay/relayed-hubs.js";
+//#region src/realtime/realtime-hubs.ts
+/**
+* The broadcast and presence hubs of a process: those of the topic channels of `/api/sb/realtime/v1`, and apart from
+* them those of the record channels of `/api/channels`, so neither hears the other. With `processes: 'many'` both go
+* through the one relay, which `follow` reads while a socket of either is open.
+*/
+const realtimeHubs = (deps, options, report) => {
+	if (relayed(options)) return relayedHubs({
+		db: deps.db,
+		statementTimeoutMs: deps.statementTimeoutMs,
+		report
+	});
+	return {
+		topics: {
+			broadcasts: broadcastHub(),
+			presences: presenceHub()
+		},
+		records: {
+			broadcasts: broadcastHub(),
+			presences: presenceHub()
+		},
+		follow: () => () => {}
+	};
+};
+//#endregion
+export { realtimeHubs };

package/dist/realtime/realtime-socket.js

@@ -1,12 +1,12 @@
 import { HttpProblem } from "../problem.js";
-import { fixedWindow, fixedWindows } from "./fixed-window.js";
-import { realtimeLimits } from "./realtime-limits.js";
 import { callerSettings } from "../rest/caller-settings.js";
 import { parseBindings } from "./postgres-changes.js";
 import "./filter-check.js";
 import { decodeBroadcastPush, encodeBroadcast, fitsFrame } from "./broadcast-frame.js";
+import { realtimeLimits } from "./realtime-limits.js";
 import { decodeMessage, encodeMessage, reply } from "./phoenix-message.js";
 import { privateGate, publicGate, readRefusalText } from "./channel-gate.js";
+import { fixedWindow, fixedWindows } from "./fixed-window.js";
 import { randomUUID } from "node:crypto";
 import { Buffer } from "node:buffer";
 //#region src/realtime/realtime-socket.ts

package/dist/realtime/relay/realtime-options.d.ts

@@ -1,5 +1,5 @@
 //#region src/realtime/relay/realtime-options.d.ts
-/** How `/api/sb/realtime/v1` is served (`realtime` in `protobase.config.ts`). */
+/** How `/api/channels` and `/api/sb/realtime/v1` are served (`realtime` in `protobase.config.ts`). */
 export type RealtimeOptions = {
   /**
    * `'one'`, the default, when one process serves the app: broadcasts and presence go between its channels in memory.

package/dist/realtime/relay/realtime-relay.js

@@ -95,9 +95,9 @@ const realtimeRelay = ({ db, statementTimeoutMs, heard, loaded, tracked, report,
 		/** Resolves once the other processes' presences are read, or their snapshot failed. */
 		ready: () => run?.ready ?? Promise.resolve(),
 		/** Counts and adds the broadcasts as frames, all of them or, over a topic's rate, none: `false` then. */
-		broadcast: (publications) => admitBroadcasts(db, statementTimeoutMs, self, publications),
+		broadcast: (space, publications) => admitBroadcasts(db, statementTimeoutMs, self, space, publications),
 		/** Writes a change of this process's presences, after those before it. */
-		changed: (change) => void inTurn(() => writePresence(db, self, change))
+		changed: (space, change) => void inTurn(() => writePresence(db, self, space, change))
 	};
 };
 //#endregion

package/dist/realtime/relay/relay-frame-sql.js

@@ -12,7 +12,7 @@ const jsonOf = (payload) => payload instanceof ArrayBuffer ? null : JSON.stringi
 * Counts the broadcasts into each topic's second, every process's together, and adds them as frames, all of them or,
 * when a topic would take more than its broadcasts for this second, none: `false` then.
 */
-const admitBroadcasts = async (db, statementTimeoutMs, self, publications) => {
+const admitBroadcasts = async (db, statementTimeoutMs, self, space, publications) => {
 	if (publications.length === 0) return true;
 	const takes = /* @__PURE__ */ new Map();
 	for (const { topic } of publications) takes.set(topic, (takes.get(topic) ?? 0) + 1);
@@ -24,8 +24,8 @@ const admitBroadcasts = async (db, statementTimeoutMs, self, publications) => {
         where r.second <> excluded.second or r.count + excluded.count <= ${realtimeLimits.topicBroadcastsPerSecond}
       returning topic`.execute(trx);
 		if (rows.length < takes.size) throw new Refused();
-		await sql`insert into realtime_relay.frames (process, kind, topic, private, event, payload, bytes, meta)
-      select ${self}::uuid, 'broadcast', topic, private, event, payload::json, decode(bytes, 'base64'), meta::json
+		await sql`insert into realtime_relay.frames (process, kind, space, topic, private, event, payload, bytes, meta)
+      select ${self}::uuid, 'broadcast', ${space}::text, topic, private, event, payload::json, decode(bytes, 'base64'), meta::json
       from unnest(${publications.map((p) => p.topic)}::text[], ${publications.map((p) => p.private)}::boolean[], ${publications.map((p) => p.event)}::text[],
         ${publications.map((p) => jsonOf(p.payload))}::text[], ${publications.map((p) => bytesOf(p.payload))}::text[], ${publications.map((p) => p.meta ? JSON.stringify(p.meta) : null)}::text[])
         with ordinality as f(topic, private, event, payload, bytes, meta, position)
@@ -38,8 +38,10 @@ const admitBroadcasts = async (db, statementTimeoutMs, self, publications) => {
 };
 const frameOf = (row) => {
 	const id = BigInt(row.id);
+	const { space } = row;
 	if (row.kind === "presence") return {
 		id,
+		space,
 		kind: "presence",
 		topic: row.topic,
 		private: row.private,
@@ -48,6 +50,7 @@ const frameOf = (row) => {
 	const payload = row.bytes ? new Uint8Array(row.bytes).buffer : row.payload;
 	return {
 		id,
+		space,
 		kind: "broadcast",
 		publication: {
 			topic: row.topic,
@@ -63,7 +66,7 @@ const frameOf = (row) => {
 * other processes' frames, to deliver.
 */
 const readFrames = async (db, self, after, gaps) => {
-	const { rows } = await sql`select id::text as id, process = ${self}::uuid as own, kind, topic, private, event,
+	const { rows } = await sql`select id::text as id, process = ${self}::uuid as own, kind, space, topic, private, event,
       case when process <> ${self}::uuid then payload end as payload, case when process <> ${self}::uuid then bytes end as bytes, meta
     from realtime_relay.frames where id > ${String(after)}::bigint or id = any(${gaps.map(String)}::bigint[])
     order by id limit ${frameBatch}`.execute(db);

package/dist/realtime/relay/relay-presence-sql.js

@@ -12,23 +12,23 @@ const joinFrame = sql.raw(`json_build_object('joins', json_build_object(key, jso
 * Keeps the change in `presences` and adds its frame, in one statement: a leave alone is sent only when the presence
 * was there, as a process that was taken for stopped had its presences removed already.
 */
-const writePresence = async (db, self, change) => {
+const writePresence = async (db, self, space, change) => {
 	const ref = change.joined?.phx_ref ?? null;
 	await sql`with gone as (delete from realtime_relay.presences where process = ${self}::uuid and ref = ${change.left?.phx_ref ?? null}::text returning ref),
-      added as (insert into realtime_relay.presences (process, ref, topic, private, key, meta)
-        select ${self}::uuid, ${ref}::text, ${change.topic}::text, ${change.private}::boolean, ${change.key}::text, ${JSON.stringify(change.joined ?? null)}::json where ${ref}::text is not null)
-    insert into realtime_relay.frames (process, kind, topic, private, payload)
-    select ${self}::uuid, 'presence', ${change.topic}::text, ${change.private}::boolean, ${JSON.stringify(diffOf(change))}::json
+      added as (insert into realtime_relay.presences (process, ref, space, topic, private, key, meta)
+        select ${self}::uuid, ${ref}::text, ${space}::text, ${change.topic}::text, ${change.private}::boolean, ${change.key}::text, ${JSON.stringify(change.joined ?? null)}::json where ${ref}::text is not null)
+    insert into realtime_relay.frames (process, kind, space, topic, private, payload)
+    select ${self}::uuid, 'presence', ${space}::text, ${change.topic}::text, ${change.private}::boolean, ${JSON.stringify(diffOf(change))}::json
     where ${ref}::text is not null or exists (select from gone)`.execute(db);
 };
 /** Adds the presences back, with their joins, for a process that was taken for stopped while it was not. */
 const restorePresences = async (db, self, tracked) => {
 	if (tracked.length === 0) return;
-	await sql`with added as (insert into realtime_relay.presences (process, ref, topic, private, key, meta)
-        select ${self}::uuid, ref, topic, private, key, meta::json from unnest(${tracked.map((t) => t.meta.phx_ref)}::text[], ${tracked.map((t) => t.topic)}::text[],
-          ${tracked.map((t) => t.private)}::boolean[], ${tracked.map((t) => t.key)}::text[], ${tracked.map((t) => JSON.stringify(t.meta))}::text[]) as t(ref, topic, private, key, meta)
-        on conflict do nothing returning process, topic, private, key, meta)
-    insert into realtime_relay.frames (process, kind, topic, private, payload) select process, 'presence', topic, private, ${joinFrame} from added`.execute(db);
+	await sql`with added as (insert into realtime_relay.presences (process, ref, space, topic, private, key, meta)
+        select ${self}::uuid, ref, space, topic, private, key, meta::json from unnest(${tracked.map((t) => t.meta.phx_ref)}::text[], ${tracked.map((t) => t.space)}::text[], ${tracked.map((t) => t.topic)}::text[],
+          ${tracked.map((t) => t.private)}::boolean[], ${tracked.map((t) => t.key)}::text[], ${tracked.map((t) => JSON.stringify(t.meta))}::text[]) as t(ref, space, topic, private, key, meta)
+        on conflict do nothing returning process, space, topic, private, key, meta)
+    insert into realtime_relay.frames (process, kind, space, topic, private, payload) select process, 'presence', space, topic, private, ${joinFrame} from added`.execute(db);
 };
 /**
 * Marks this process as running, by the database's clock: `true` when its row was not there, as at its start or once
@@ -41,8 +41,8 @@ const beat = async (db, self) => {
 };
 const retire = (db, dead) => sql`with dead as (delete from realtime_relay.processes where ${dead} returning id),
       gone as (delete from realtime_relay.presences p where p.process in (select id from dead) or not exists (select from realtime_relay.processes q where q.id = p.process)
-        returning process, topic, private, key, meta)
-    insert into realtime_relay.frames (process, kind, topic, private, payload) select process, 'presence', topic, private, ${leaveFrame} from gone`.execute(db);
+        returning process, space, topic, private, key, meta)
+    insert into realtime_relay.frames (process, kind, space, topic, private, payload) select process, 'presence', space, topic, private, ${leaveFrame} from gone`.execute(db);
 /** Removes the processes that have not beaten for `staleSeconds`, and their presences. */
 const retireStale = async (db, staleSeconds) => {
 	await retire(db, sql`seen_at < now() - make_interval(secs => ${staleSeconds})`);
@@ -57,7 +57,7 @@ const retireSelf = async (db, self) => {
 */
 const presenceSnapshot = (db, statementTimeoutMs, self) => db.transaction().setIsolationLevel("repeatable read").execute(async (trx) => {
 	await sql`select set_config('statement_timeout', ${String(statementTimeoutMs)}, true)`.execute(trx);
-	const presences = await sql`select topic, private, key, meta from realtime_relay.presences where process <> ${self}::uuid`.execute(trx);
+	const presences = await sql`select space, topic, private, key, meta from realtime_relay.presences where process <> ${self}::uuid`.execute(trx);
 	const newest = await sql`select coalesce(max(id), 0)::text as id from realtime_relay.frames`.execute(trx);
 	const recent = await sql`select id::text as id from realtime_relay.frames
       where id >= (select min(id) from realtime_relay.frames where at > now() - interval '2 seconds') order by id`.execute(trx);

package/dist/realtime/relay/relay-schema-sql.js

@@ -8,8 +8,12 @@ const relayTables = [
 	"processes",
 	"rates"
 ];
+/** The tables with a `space` column, which a relay schema written before it lacks. */
+const spacedTables = ["frames", "presences"];
 /**
 * - `frames`: what a process sends, a broadcast or a presence diff, read by the others and pruned after a minute.
+* - `space` in `frames` and `presences`: the channels they are of (`RelaySpace`), `topics` for a row written without
+*   one, as by a process of a version before the record channels.
 * - `presences`: what each process's channels track, which a process that starts reads.
 * - `processes`: each process's last heartbeat; a process silent too long has its presences removed.
 * - `rates`: each topic's broadcasts in the current second, every process's together.
@@ -22,6 +26,7 @@ create table if not exists ${relaySchema}.frames (
   kind text not null check (kind in ('broadcast', 'presence')),
   topic text not null,
   private boolean not null,
+  space text not null default 'topics' check (space in ('topics', 'records')),
   event text,
   payload json,
   bytes bytea,
@@ -41,6 +46,7 @@ create table if not exists ${relaySchema}.presences (
   ref text not null,
   topic text not null,
   private boolean not null,
+  space text not null default 'topics' check (space in ('topics', 'records')),
   key text not null,
   meta json not null,
   primary key (process, ref)
@@ -50,6 +56,9 @@ create table if not exists ${relaySchema}.rates (
   topic text primary key,
   second bigint not null,
   count integer not null
-);`;
+);
+
+-- A relay schema written before the record channels gets the column too.
+${spacedTables.map((table) => `alter table ${relaySchema}.${table} add column if not exists space text not null default 'topics' check (space in ('topics', 'records'));`).join("\n")}`;
 //#endregion
-export { relaySchema, relaySchemaSql, relayTables };
+export { relaySchema, relaySchemaSql, relayTables, spacedTables };

package/dist/realtime/relay/relay-schema.d.ts

@@ -1,7 +1,7 @@
 import { Db } from "@protobase/query";
 //#region src/realtime/relay/relay-schema.d.ts
 /** The SQL that adds the `realtime_relay` schema `realtime: { processes: 'many' }` needs; `undefined` when it is there. */
-export declare const realtimeRelayMigration: (db: Db) => Promise<"create schema if not exists realtime_relay;\n\ncreate table if not exists realtime_relay.frames (\n  id bigint generated always as identity primary key,\n  process uuid not null,\n  kind text not null check (kind in ('broadcast', 'presence')),\n  topic text not null,\n  private boolean not null,\n  event text,\n  payload json,\n  bytes bytea,\n  meta json,\n  at timestamptz not null default now()\n);\n\ncreate index if not exists frames_at on realtime_relay.frames (at);\n\ncreate table if not exists realtime_relay.processes (\n  id uuid primary key,\n  seen_at timestamptz not null default now()\n);\n\ncreate table if not exists realtime_relay.presences (\n  process uuid not null,\n  ref text not null,\n  topic text not null,\n  private boolean not null,\n  key text not null,\n  meta json not null,\n  primary key (process, ref)\n);\n\ncreate table if not exists realtime_relay.rates (\n  topic text primary key,\n  second bigint not null,\n  count integer not null\n);" | undefined>;
+export declare const realtimeRelayMigration: (db: Db) => Promise<string | undefined>;
 /** Refuses to go on while the `realtime_relay` schema is missing; the project's migrations add it. */
 export declare const checkRealtimeRelay: (db: Db) => Promise<void>;
 //#endregion

package/dist/realtime/relay/relay-schema.js

@@ -1,11 +1,13 @@
 import { migrationCommand } from "../../changes/capture-schema.js";
-import { relaySchema, relaySchemaSql, relayTables } from "./relay-schema-sql.js";
+import { relaySchema, relaySchemaSql, relayTables, spacedTables } from "./relay-schema-sql.js";
 import { sql } from "kysely";
 //#region src/realtime/relay/relay-schema.ts
 const relayCurrent = async (db) => {
 	const names = relayTables.map((table) => `${relaySchema}.${table}`);
 	const { rows } = await sql`select bool_and(to_regclass(name) is not null) as found from unnest(${names}::text[]) as name`.execute(db);
-	return rows[0].found;
+	if (!rows[0].found) return false;
+	return (await sql`select count(*)::int as count from information_schema.columns
+    where table_schema = ${relaySchema} and table_name = any(${[...spacedTables]}::text[]) and column_name = 'space'`.execute(db)).rows[0].count === spacedTables.length;
 };
 /** The SQL that adds the `realtime_relay` schema `realtime: { processes: 'many' }` needs; `undefined` when it is there. */
 const realtimeRelayMigration = async (db) => await relayCurrent(db) ? void 0 : relaySchemaSql;

package/dist/realtime/relay/relayed-hubs.js

@@ -4,56 +4,79 @@ import { presenceReplica } from "./presence-replica.js";
 import { realtimeRelay } from "./realtime-relay.js";
 //#region src/realtime/relay/relayed-hubs.ts
 /**
-* The broadcast and presence hubs of `realtime: { processes: 'many' }`: this process's channels in memory, as with one
-* process, and every broadcast and presence change written to the relay for the other processes, whose own reach the
-* channels here as the relay reads them. A topic's private and public channels stay apart across processes too. A
-* broadcast reaches this process's channels once the relay admitted it under the topic's rate. `follow` reads the
-* relay while a socket is open.
+* The broadcast and presence hubs of `realtime: { processes: 'many' }`, one pair for each space (`RelaySpace`): this
+* process's channels in memory, as with one process, and every broadcast and presence change written to the relay for
+* the other processes, whose own reach the channels here as the relay reads them, in the space they were sent in. A
+* topic's private and public channels stay apart across processes too. A broadcast reaches this process's channels
+* once the relay admitted it under the topic's rate. `follow` reads the relay while a socket is open.
 */
 const relayedHubs = ({ db, statementTimeoutMs, report }) => {
-	const local = broadcastHub();
-	const replica = presenceReplica();
+	const spaces = /* @__PURE__ */ new Map();
 	const relay = realtimeRelay({
 		db,
 		statementTimeoutMs,
 		report,
 		heard: (frame) => {
-			if (frame.kind === "broadcast") return local.deliver(frame.publication);
-			const diff = replica.apply(frame.topic, frame.private, frame.diff);
-			if (diff) presences.hear(frame.topic, frame.private, diff);
+			const space = spaces.get(frame.space);
+			if (!space) return;
+			if (frame.kind === "broadcast") return space.local.deliver(frame.publication);
+			const diff = space.replica.apply(frame.topic, frame.private, frame.diff);
+			if (diff) space.presences.hear(frame.topic, frame.private, diff);
 		},
-		loaded: replica.load,
-		tracked: () => presences.tracked()
-	});
-	const presences = presenceHub({
-		refPrefix: `${relay.id}:`,
-		remote: {
-			state: replica.state,
-			changed: relay.changed,
-			ready: relay.ready
-		}
+		loaded: (tracked) => {
+			for (const [name, space] of spaces) space.replica.load(tracked.filter((presence) => presence.space === name));
+		},
+		tracked: () => [...spaces].flatMap(([name, space]) => space.presences.tracked().map((presence) => ({
+			space: name,
+			...presence
+		})))
 	});
-	return {
-		broadcasts: {
-			join: local.join,
-			send: async (topic, from, event, payload) => {
-				const publication = {
-					topic,
-					event,
-					payload,
-					private: from.private
-				};
-				if (!await relay.broadcast([publication])) return false;
-				local.deliver(publication, from);
-				return true;
-			},
-			publish: async (publications) => {
-				if (!await relay.broadcast(publications)) return false;
-				for (const publication of publications) local.deliver(publication);
-				return true;
+	const spaceOf = (name) => {
+		const local = broadcastHub();
+		const replica = presenceReplica();
+		return {
+			local,
+			replica,
+			presences: presenceHub({
+				refPrefix: `${relay.id}:`,
+				remote: {
+					state: replica.state,
+					changed: (change) => relay.changed(name, change),
+					ready: relay.ready
+				}
+			}),
+			broadcasts: {
+				join: local.join,
+				send: async (topic, from, event, payload) => {
+					const publication = {
+						topic,
+						event,
+						payload,
+						private: from.private
+					};
+					if (!await relay.broadcast(name, [publication])) return false;
+					local.deliver(publication, from);
+					return true;
+				},
+				publish: async (publications) => {
+					if (!await relay.broadcast(name, publications)) return false;
+					for (const publication of publications) local.deliver(publication);
+					return true;
+				}
 			}
-		},
-		presences,
+		};
+	};
+	for (const name of ["topics", "records"]) spaces.set(name, spaceOf(name));
+	const hubsOf = (name) => {
+		const { broadcasts, presences } = spaces.get(name);
+		return {
+			broadcasts,
+			presences
+		};
+	};
+	return {
+		topics: hubsOf("topics"),
+		records: hubsOf("records"),
 		follow: relay.follow
 	};
 };

package/dist/webhooks/attempt.js

@@ -53,6 +53,7 @@ const callFunction = async (name, subscription, event, options, context, signal)
 	const functionContext = {
 		name,
 		db: context.db,
+		channels: context.channels,
 		caller: async () => caller,
 		acceptWebSocket,
 		calls: { join: async () => acceptWebSocket() }

package/dist/webhooks/webhooks.js

@@ -60,7 +60,7 @@ const deliveryGroup = ({ subscription, change }) => `${subscription.name}:${chan
 *
 * No jobs without a resource with events or history; the subscriptions must name declared events.
 */
-const createWebhooks = ({ deps, subscriptions, functions, schema, log, table }) => {
+const createWebhooks = ({ deps, subscriptions, functions, channels, schema, log, table }) => {
 	const entries = deps.registry.entries;
 	const models = entries.map((entry) => entry.model);
 	const problems = subscriptionProblems(subscriptions, models, Object.keys(functions));
@@ -82,6 +82,7 @@ const createWebhooks = ({ deps, subscriptions, functions, schema, log, table })
 			db,
 			functions,
 			records,
+			channels,
 			attempt: tried,
 			signal,
 			...checkUrl && { checkUrl }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.58.8",
+  "version": "0.59.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -42,9 +42,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.58.8",
-    "@protobase/query": "0.58.8",
-    "@protobase/schema": "0.58.8",
+    "@protobase/layout": "0.59.0",
+    "@protobase/query": "0.59.0",
+    "@protobase/schema": "0.59.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",