@protobase/server 0.7.0 → 0.8.1

package/dist/better-auth/organizations/organization-plugin.js

@@ -0,0 +1,128 @@
+import "./role-definitions.js";
+import { checkAppRoleChange, effectiveRoles, globalRoles, parseAppRoles } from "./app-roles.js";
+import { findMember } from "./store.js";
+import { invitationEmail } from "./invitation-mail.js";
+import { invitationLink, invitationToken } from "./invitation-token.js";
+import { APIError } from "better-auth/api";
+import { organization } from "better-auth/plugins/organization";
+//#region src/better-auth/organizations/organization-plugin.ts
+/** The snake_case names of the organization plugin's tables and columns, with the app roles of members and invitations. */
+const organizationNames = {
+	organization: { fields: { createdAt: "created_at" } },
+	member: {
+		fields: {
+			organizationId: "organization_id",
+			userId: "user_id",
+			createdAt: "created_at"
+		},
+		additionalFields: { appRoles: {
+			type: "string[]",
+			required: false,
+			defaultValue: [],
+			input: false,
+			fieldName: "app_roles"
+		} }
+	},
+	invitation: {
+		fields: {
+			organizationId: "organization_id",
+			inviterId: "inviter_id",
+			expiresAt: "expires_at",
+			createdAt: "created_at"
+		},
+		additionalFields: { appRoles: {
+			type: "string[]",
+			required: false,
+			defaultValue: [],
+			input: true,
+			fieldName: "app_roles"
+		} }
+	},
+	session: { fields: { activeOrganizationId: "active_organization_id" } }
+};
+/** Runs Protobase's hook, then the project's, with the same data; data either returns is merged, the project's last. */
+const mergeHooks = (own, project = {}) => {
+	const keys = /* @__PURE__ */ new Set([...Object.keys(own), ...Object.keys(project)]);
+	return Object.fromEntries([...keys].map((key) => {
+		const first = own[key];
+		const second = project[key];
+		if (!first || !second) return [key, first ?? second];
+		const both = async (...args) => {
+			const data = {
+				...(await first(...args))?.data,
+				...(await second(...args))?.data
+			};
+			return Object.keys(data).length > 0 ? { data } : void 0;
+		};
+		return [key, both];
+	}));
+};
+/**
+* Better Auth's organization plugin as Protobase uses it: organization roles `owner`, `admin` and `member` with Better
+* Auth's own access control, app roles on members and invitations, ids from `generateId`, creators holding
+* `creatorAppRoles`, invitations checked against what the inviter may give and mailed with a signed link, and the
+* project's hooks after Protobase's.
+*/
+const organizationPlugin = ({ resolved, secret, mailer, context }) => {
+	const { definitions } = resolved;
+	const own = {
+		beforeCreateOrganization: async () => ({ data: { id: await resolved.generateId() } }),
+		beforeAddMember: async ({ member }) => member.role === "owner" && member.appRoles === void 0 ? { data: { appRoles: resolved.creatorAppRoles } } : void 0,
+		afterCreateOrganization: async ({ organization, member }) => {
+			await resolved.options.onCreated?.({
+				organization,
+				member: {
+					...member,
+					appRoles: parseAppRoles(member.appRoles)
+				}
+			});
+		},
+		beforeCreateInvitation: async ({ invitation, inviter }) => {
+			const membership = await findMember((await context()).adapter, {
+				organizationId: invitation.organizationId,
+				userId: inviter.id
+			});
+			const held = effectiveRoles(globalRoles(inviter.role), membership?.appRoles);
+			const refusal = checkAppRoleChange({
+				held,
+				before: [],
+				after: parseAppRoles(invitation.appRoles),
+				definitions
+			});
+			if (refusal) throw new APIError(refusal.status, {
+				code: refusal.code,
+				message: refusal.message
+			});
+		},
+		afterRemoveMember: async ({ member, user }) => {
+			if (globalRoles(user.role).length > 0) return;
+			const { internalAdapter } = await context();
+			for (const session of await internalAdapter.listSessions(member.userId)) if (session.activeOrganizationId === member.organizationId) await internalAdapter.updateSession(session.token, { activeOrganizationId: null });
+		},
+		beforeDeleteOrganization: async ({ organization }) => {
+			await resolved.options.beforeDelete?.(organization);
+		}
+	};
+	return organization({
+		creatorRole: "owner",
+		allowUserToCreateOrganization: (user) => resolved.create === "everyone" || globalRoles(user.role).includes("admin"),
+		invitationExpiresIn: resolved.invitationExpiresIn,
+		membershipLimit: resolved.membershipLimit,
+		requireEmailVerificationOnInvitation: true,
+		cancelPendingInvitationsOnReInvite: true,
+		schema: organizationNames,
+		...mailer && { sendInvitationEmail: async ({ invitation, organization, inviter }) => {
+			const token = await invitationToken(secret, invitation);
+			await mailer.send(invitationEmail({
+				to: invitation.email,
+				inviter: inviter.user.name || inviter.user.email,
+				organization: organization.name,
+				url: invitationLink(resolved.invitationUrl, token),
+				expiresAt: invitation.expiresAt
+			}));
+		} },
+		organizationHooks: mergeHooks(own, resolved.options.hooks)
+	});
+};
+//#endregion
+export { organizationNames, organizationPlugin };

package/dist/better-auth/organizations/protobase-plugin.js

@@ -0,0 +1,21 @@
+import { invitationEndpoints, invitationLinkHook } from "./invitation-endpoints.js";
+import { memberEndpoints } from "./member-endpoints.js";
+//#region src/better-auth/organizations/protobase-plugin.ts
+/**
+* Protobase's endpoints beside Better Auth's organization plugin: invitation links that also make accounts, app roles,
+* handing ownership over, and finding organizations for people with a global role. Without a mailer, whoever invites
+* gets the link in the answer.
+*/
+const protobaseOrganizationPlugin = ({ resolved, mail }) => ({
+	id: "protobase-organizations",
+	endpoints: {
+		...invitationEndpoints({
+			resolved,
+			mail
+		}),
+		...memberEndpoints({ resolved })
+	},
+	hooks: { after: mail ? [] : [invitationLinkHook(resolved)] }
+});
+//#endregion
+export { protobaseOrganizationPlugin };

package/dist/better-auth/organizations/role-definitions.d.ts

@@ -0,0 +1,15 @@
+//#region src/better-auth/organizations/role-definitions.d.ts
+/** A role: its label, or its label and the other roles its holders may also give (see `grantableRoles`). */
+export type RoleDefinition = string | {
+  label: string;
+  grants?: string[];
+};
+/** The roles of an app: names only, or each with its definition. */
+export type RolesInput = string[] | Record<string, RoleDefinition>;
+export type RoleDefinitions = {
+  /** `admin` first, then the others in the order given. */
+  names: string[];
+  labels: Record<string, string>;
+  grants: Record<string, string[]>;
+};
+//#endregion

package/dist/better-auth/organizations/role-definitions.js

@@ -0,0 +1,56 @@
+//#region src/better-auth/organizations/role-definitions.ts
+const roleName = /^[a-z][a-z0-9_-]*$/;
+/** The superuser: holds every role in every organization. */
+const superuserRole = "admin";
+/** The admin plugin's role for an account without a global role; in organization mode it grants nothing. */
+const noGlobalRole = "user";
+const organizationRoleNames = ["owner", "member"];
+const builtInLabels = {
+	[superuserRole]: "Superuser",
+	[noGlobalRole]: "No global role"
+};
+const entriesOf = (input) => Array.isArray(input) ? input.map((name) => [name, void 0]) : Object.entries(input);
+/**
+* The roles with `admin` first (added when missing), their labels and grants. With `organizations`, every role needs a
+* label (`admin` and `user` have one built in), `user` is always there, as the role of an account without a global
+* role, and `owner` and `member` are refused, since they name organization roles.
+*/
+const roleDefinitions = (input = ["admin", "user"], { organizations = false } = {}) => {
+	const entries = entriesOf(input);
+	const bad = entries.find(([name]) => !roleName.test(name));
+	if (bad) throw new Error(`Invalid role "${bad[0]}": use lowercase letters, digits, "_" or "-"`);
+	const given = new Map(entries);
+	const names = [
+		superuserRole,
+		...new Set(entries.map(([name]) => name).filter((name) => name !== superuserRole)),
+		...organizations && !given.has("user") ? [noGlobalRole] : []
+	];
+	const labels = {};
+	const grants = {};
+	for (const name of names) {
+		const definition = given.get(name);
+		const label = typeof definition === "string" ? definition : definition?.label ?? builtInLabels[name];
+		if (label !== void 0) labels[name] = label;
+		grants[name] = typeof definition === "object" ? definition.grants ?? [] : [];
+		const unknown = grants[name].find((granted) => !names.includes(granted));
+		if (unknown !== void 0) throw new Error(`Role "${name}" grants "${unknown}", which is not one of the roles: ${names.join(", ")}`);
+	}
+	if (!organizations) return {
+		names,
+		labels,
+		grants
+	};
+	const reserved = names.find((name) => organizationRoleNames.includes(name));
+	if (reserved) throw new Error(`Role "${reserved}" names an organization role; choose another name`);
+	const unlabelled = names.find((name) => labels[name] === void 0);
+	if (unlabelled) throw new Error(`Role "${unlabelled}" needs a label: with organizations, roles are given as { name: 'Label' }`);
+	return {
+		names,
+		labels,
+		grants
+	};
+};
+/** The roles a member of an organization can hold there: every role but the superuser's and the placeholder. */
+const membershipRoles = ({ names }) => names.filter((name) => name !== "admin" && name !== "user");
+//#endregion
+export { membershipRoles, noGlobalRole, roleDefinitions, superuserRole };

package/dist/better-auth/organizations/session-organization.js

@@ -0,0 +1,68 @@
+import { globalRoles } from "./app-roles.js";
+import { initialOrganization } from "./active-organization.js";
+import { findMember, findOrganization, membershipsOf, organizationRoleOf, summaries } from "./store.js";
+//#region src/better-auth/organizations/session-organization.ts
+/** The user field that keeps the organization someone last worked in, for their next sign-in. */
+const lastOrganizationField = { lastOrganizationId: {
+	type: "string",
+	required: false,
+	input: false,
+	fieldName: "last_organization_id"
+} };
+/** Whether someone may work in an organization: a member, or holding a global role, which enters every one. */
+const mayEnter = async (adapter, user, organizationId) => {
+	if (await findMember(adapter, {
+		organizationId,
+		userId: user.id
+	})) return true;
+	return globalRoles(user.role).length > 0 && await findOrganization(adapter, organizationId) !== null;
+};
+/**
+* The token's organization claims for a session: `org`, the active organization, while the person may still work in
+* it; for a member also `org_role`, their organization role, and `app_roles`, their app roles there. Read when the
+* token is issued, so a removed member or a changed role shows within the token's lifetime.
+*/
+const organizationClaims = async (adapter, user, activeOrganizationId) => {
+	if (!activeOrganizationId) return {};
+	const member = await findMember(adapter, {
+		organizationId: activeOrganizationId,
+		userId: user.id
+	});
+	if (member) return {
+		org: activeOrganizationId,
+		org_role: organizationRoleOf(member),
+		app_roles: member.appRoles
+	};
+	if (await mayEnter(adapter, user, activeOrganizationId)) return { org: activeOrganizationId };
+	return {};
+};
+/**
+* Better Auth's session hooks for organizations: a new session starts in the organization the person last worked in
+* (`initialOrganization`), and a session's change of organization is kept on the user as the next one's start.
+*/
+const sessionOrganizationHooks = (context) => ({
+	create: { before: async (session) => {
+		const { adapter, internalAdapter } = await context();
+		const user = await internalAdapter.findUserById(session.userId);
+		if (!user) return;
+		const last = user.lastOrganizationId;
+		const activeOrganizationId = initialOrganization({
+			memberships: summaries(await membershipsOf(adapter, user.id)),
+			last,
+			entersAny: globalRoles(user.role).length > 0,
+			lastExists: Boolean(last) && await findOrganization(adapter, last) !== null
+		});
+		return activeOrganizationId ? { data: {
+			...session,
+			activeOrganizationId
+		} } : void 0;
+	} },
+	update: { after: async (session) => {
+		if (!session.activeOrganizationId) return;
+		const { internalAdapter } = await context();
+		const user = await internalAdapter.findUserById(session.userId);
+		if (user && user.lastOrganizationId !== session.activeOrganizationId) await internalAdapter.updateUser(session.userId, { lastOrganizationId: session.activeOrganizationId });
+	} }
+});
+//#endregion
+export { lastOrganizationField, mayEnter, organizationClaims, sessionOrganizationHooks };

package/dist/better-auth/organizations/store.d.ts

@@ -0,0 +1,19 @@
+import { createAuthMiddleware } from "better-auth/api";
+//#region src/better-auth/organizations/store.d.ts
+export type OrganizationRole = 'owner' | 'admin' | 'member';
+export type StoredMember = {
+  id: string;
+  organizationId: string;
+  userId: string;
+  role: string;
+  appRoles: string[];
+  createdAt: Date;
+};
+export type StoredOrganization = {
+  id: string;
+  name: string;
+  slug: string;
+  logo?: string | null;
+  createdAt: Date;
+};
+//#endregion

package/dist/better-auth/organizations/store.js

@@ -0,0 +1,73 @@
+import { parseAppRoles } from "./app-roles.js";
+//#region src/better-auth/organizations/store.ts
+/** Better Auth's `findMany` returns 100 rows unless told otherwise; these lists are read whole. */
+const everyRow = 1e5;
+const memberOf = (row) => ({
+	...row,
+	appRoles: parseAppRoles(row.appRoles)
+});
+/** Better Auth stores several organization roles comma separated; Protobase gives each member one. */
+const organizationRoleOf = (member) => {
+	const roles = member.role.split(",").map((name) => name.trim());
+	return roles.includes("owner") ? "owner" : roles.includes("admin") ? "admin" : "member";
+};
+const findMember = async (adapter, where) => {
+	const row = await adapter.findOne({
+		model: "member",
+		where: [{
+			field: "organizationId",
+			value: where.organizationId
+		}, {
+			field: "userId",
+			value: where.userId
+		}]
+	});
+	return row ? memberOf(row) : void 0;
+};
+const findMemberById = async (adapter, id) => {
+	const row = await adapter.findOne({
+		model: "member",
+		where: [{
+			field: "id",
+			value: id
+		}]
+	});
+	return row ? memberOf(row) : void 0;
+};
+const membershipsOf = async (adapter, userId) => (await adapter.findMany({
+	model: "member",
+	where: [{
+		field: "userId",
+		value: userId
+	}],
+	limit: everyRow
+})).map(memberOf);
+const membersOf = async (adapter, organizationId) => (await adapter.findMany({
+	model: "member",
+	where: [{
+		field: "organizationId",
+		value: organizationId
+	}],
+	limit: everyRow
+})).map(memberOf);
+const findOrganization = (adapter, id) => adapter.findOne({
+	model: "organization",
+	where: [{
+		field: "id",
+		value: id
+	}]
+});
+const summaries = (members) => members.map(({ organizationId, createdAt }) => ({
+	organizationId,
+	createdAt
+}));
+const setAppRoles = (adapter, memberId, appRoles) => adapter.update({
+	model: "member",
+	where: [{
+		field: "id",
+		value: memberId
+	}],
+	update: { appRoles: [...appRoles] }
+});
+//#endregion
+export { everyRow, findMember, findMemberById, findOrganization, membersOf, membershipsOf, organizationRoleOf, setAppRoles, summaries };

package/dist/better-auth/staff-checks.js

@@ -51,7 +51,11 @@ const accountChanges = [
 	"/passkey/generate-register-options",
 	"/passkey/verify-registration",
 	"/passkey/update-passkey",
-	"/passkey/delete-passkey"
+	"/passkey/delete-passkey",
+	"/invitation/accept",
+	"/organization/leave",
+	"/organization/transfer-ownership",
+	"/organization/delete"
 ];
 const staffCannotChange = {
 	code: "STAFF_CANNOT_CHANGE_SIGN_IN",

package/dist/better-auth/staff-sign-in-endpoints.js

@@ -6,8 +6,8 @@ import { policyRefusal, staffSignInPath } from "./sign-in-enforcement.js";
 import { staffSignInEmail } from "./sign-in-mail.js";
 import { logStaffSignIn } from "./staff-log.js";
 import { APIError, createAuthEndpoint } from "better-auth/api";
-import * as z$1 from "zod";
 import { expireCookie, setSessionCookie } from "better-auth/cookies";
+import * as z$1 from "zod";
 //#region src/better-auth/staff-sign-in-endpoints.ts
 const startLifetimeMs = 6e5;
 const stateCookie = "staff_state";

package/dist/better-auth/status-route.js

@@ -1,3 +1,4 @@
+import { membershipRoles } from "./organizations/role-definitions.js";
 import { effectiveSignInPolicy } from "./sign-in-policy.js";
 import { readSignInPolicy } from "./policy-store.js";
 import { hasUsers } from "./users.js";
@@ -8,8 +9,9 @@ import { Hono } from "hono";
 * `signInMethods`, the ways to sign in the sign-in policy leaves on (`password`, `emailCode`, `passkey`), so it offers
 * only those; `passwordReset` when reset mail can be sent and passwords are on, so it offers "Forgot password?" only
 * then; the ids of the `socialProviders` people can sign in with, so it offers "Continue with GitHub" when `github` is
-* one; `platformSignIn`, the id and name of the platform's provider when it is one of them; and `staffSignIn`, the
-* operator provider's name, when staff can sign in as people.
+* one; `platformSignIn`, the id and name of the platform's provider when it is one of them; `staffSignIn`, the
+* operator provider's name, when staff can sign in as people; and with organizations, who may create them and the roles
+* with their labels, `membership` for those a member can hold, and the roles each one's holders may also give.
 */
 const statusRoute = (auth) => {
 	const app = new Hono();
@@ -31,7 +33,16 @@ const statusRoute = (auth) => {
 			passwordReset: auth.passwordReset && policy.password === "allowed",
 			socialProviders,
 			...platformSignIn && { platformSignIn },
-			...staffSignIn && { staffSignIn }
+			...staffSignIn && { staffSignIn },
+			...auth.organizations && { organizations: {
+				create: auth.organizations.create,
+				roles: auth.roleDefinitions.names.map((name) => ({
+					name,
+					label: auth.roleDefinitions.labels[name] ?? name,
+					membership: membershipRoles(auth.roleDefinitions).includes(name),
+					grants: auth.roleDefinitions.grants[name] ?? []
+				}))
+			} }
 		});
 	});
 	return app;

package/dist/better-auth/users.d.ts

@@ -28,7 +28,8 @@ export declare const hasUsers: (auth: AdminAuth) => Promise<boolean>;
  * Creates a user directly in the admin store. Host side only (no HTTP route creates accounts while the store is empty):
  * the first user is always an `admin`, later ones get `role` (default `user`). The address counts as verified, so the
  * user can also sign in with an emailed code. `accounts` link the user to sign-in providers up front, so a provider
- * signs them in by its own id whatever address it reports; one that signs in another user already is refused.
+ * signs them in by its own id whatever address it reports; one that signs in another user already is refused. With
+ * organizations, the first user also owns every organization without members, such as those an app's seed made.
  */
 export declare const createUser: (auth: AdminAuth, input: NewUser) => Promise<{
   id: string;

package/dist/better-auth/users.js

@@ -1,4 +1,5 @@
 import { parseRoles } from "./parse-roles.js";
+import { ownOrganizationsWithoutMembers } from "./organizations/host.js";
 //#region src/better-auth/users.ts
 /** The roles this auth instance allows, `admin` first. */
 const roleChoices = (auth) => [...auth.roles];
@@ -21,7 +22,8 @@ const checkAccounts = async (auth, accounts) => {
 * Creates a user directly in the admin store. Host side only (no HTTP route creates accounts while the store is empty):
 * the first user is always an `admin`, later ones get `role` (default `user`). The address counts as verified, so the
 * user can also sign in with an emailed code. `accounts` link the user to sign-in providers up front, so a provider
-* signs them in by its own id whatever address it reports; one that signs in another user already is refused.
+* signs them in by its own id whatever address it reports; one that signs in another user already is refused. With
+* organizations, the first user also owns every organization without members, such as those an app's seed made.
 */
 const createUser = async (auth, input) => {
 	const first = !await hasUsers(auth);
@@ -41,6 +43,7 @@ const createUser = async (auth, input) => {
 		userId: user.id,
 		...account
 	});
+	if (first && auth.organizations) await ownOrganizationsWithoutMembers(auth, user.id);
 	return {
 		id: user.id,
 		email: user.email,

package/dist/changes/actor.js

@@ -0,0 +1,12 @@
+//#region src/changes/actor.ts
+/** The setting a write transaction sets so the change capture records who wrote, when a resource has events. */
+const actorSettings = (deps, session) => {
+	if (!deps.actorSetting) return {};
+	const actor = {
+		id: session.user.id,
+		roles: session.user.roles
+	};
+	return { [deps.actorSetting]: JSON.stringify(actor) };
+};
+//#endregion
+export { actorSettings };

package/dist/changes/capture-plan.js

@@ -0,0 +1,62 @@
+import { captureBody, captureFunctionSql, createTriggerSql, dropTriggerSql, outboxSql, quoteIdent, resourceTriggers, tableSql } from "./capture-sql.js";
+//#region src/changes/capture-plan.ts
+const sameTrigger = (found, wanted) => found.type === wanted.type && found.args.length === wanted.args.length && found.args.every((arg, index) => arg === wanted.args[index]);
+const tableOf = (state, model) => {
+	const table = state.tables[model.name];
+	if (!table) throw new Error(`The table ${tableSql(model)} of resource "${model.name}" does not exist`);
+	return table;
+};
+/**
+* Compares the database with the resources that declare events. Fails on what it cannot change safely: a missing
+* table, two resources with events on one table, or a trigger of the same name that calls another function.
+*/
+const capturePlan = (schema, models, state) => {
+	const withEvents = models.filter((model) => (model.events ?? []).length > 0);
+	const capture = state.capture;
+	const current = capture !== void 0 && capture.definer && capture.source === captureBody(schema);
+	const wanted = withEvents.flatMap((model) => resourceTriggers(model).map((trigger) => ({
+		model,
+		trigger,
+		table: tableOf(state, model)
+	})));
+	const tables = /* @__PURE__ */ new Map();
+	for (const { model, table } of wanted) {
+		const other = tables.get(table);
+		if (other && other !== model.name) throw new Error(`Not implemented: resources "${other}" and "${model.name}" both have events on table ${tableSql(model)}; declare them on one`);
+		tables.set(table, model.name);
+	}
+	const create = wanted.filter(({ model, trigger, table }) => {
+		const found = state.triggers.find((candidate) => candidate.table === table && candidate.name === trigger.name);
+		if (found && found.function !== capture?.oid) throw new Error(`Table ${tableSql(model)} has a trigger "${trigger.name}" of its own; rename it, since events need that name`);
+		return !found || !sameTrigger(found, trigger);
+	});
+	const drop = state.triggers.filter((found) => found.function === capture?.oid).filter((found) => !wanted.some(({ trigger, table }) => table === found.table && trigger.name === found.name));
+	return {
+		setup: withEvents.length > 0 && (!state.outbox || !current),
+		create: create.map(({ model, trigger }) => ({
+			model,
+			trigger
+		})),
+		drop: drop.map(({ name, tableSql }) => ({
+			name,
+			tableSql
+		}))
+	};
+};
+/** The plan as SQL statements, each made to apply over what exists already; `undefined` when there is nothing to do. */
+const planSql = (schema, plan) => {
+	const statements = [
+		...plan.setup ? [
+			`create schema if not exists ${quoteIdent(schema)}`,
+			outboxSql(schema),
+			captureFunctionSql(schema)
+		] : [],
+		...plan.drop.map(({ name, tableSql }) => dropTriggerSql(name, tableSql)),
+		...plan.create.flatMap(({ model, trigger }) => [dropTriggerSql(trigger.name, tableSql(model)), createTriggerSql(schema, trigger, tableSql(model))])
+	];
+	return statements.length === 0 ? void 0 : `${statements.join(";\n\n")};`;
+};
+/** The resources whose changes would not be captured as the config declares: what a server refuses to start with. */
+const uncaptured = (plan, models) => plan.setup ? models.filter((model) => (model.events ?? []).length > 0).map((model) => model.name) : [...new Set(plan.create.map(({ model }) => model.name))];
+//#endregion
+export { capturePlan, planSql, uncaptured };

package/dist/changes/capture-schema.d.ts

@@ -0,0 +1,18 @@
+import { EventsOptions } from "./events-options.js";
+import { ResourceModel } from "@protobase/schema";
+import { Db } from "@protobase/query";
+//#region src/changes/capture-schema.d.ts
+/** The command that writes what the config needs as a migration file of the project. */
+export declare const migrationCommand = "protobase migration";
+/**
+ * The SQL that brings the database to the capture the resources' events need: the schema with the outbox and
+ * `capture()`, and a trigger pair per resource with events, recreated when its fields changed; triggers of resources
+ * without events any more are dropped. `undefined` when the database is current. Tables are never dropped.
+ */
+export declare const changesMigration: (db: Db, models: readonly ResourceModel[], options?: EventsOptions) => Promise<string | undefined>;
+/**
+ * Refuses to go on while a resource's events would not be captured as declared: a missing or out-of-date schema, or
+ * trigger. The server never changes the schema itself: the project's migrations do, before the new version serves.
+ */
+export declare const checkChanges: (db: Db, models: readonly ResourceModel[], options?: EventsOptions) => Promise<void>;
+//#endregion

package/dist/changes/capture-schema.js

@@ -0,0 +1,65 @@
+import { changesSchema } from "./events-options.js";
+import { quoteIdent, tableSql } from "./capture-sql.js";
+import { capturePlan, planSql, uncaptured } from "./capture-plan.js";
+import { sql } from "kysely";
+//#region src/changes/capture-schema.ts
+/** The command that writes what the config needs as a migration file of the project. */
+const migrationCommand = "protobase migration";
+const triggerArgs = (hex) => {
+	const bytes = new Uint8Array((hex.match(/../g) ?? []).map((pair) => parseInt(pair, 16)));
+	return new TextDecoder().decode(bytes).split("\0").slice(0, -1);
+};
+const rowsOf = async (db, query) => (await query.execute(db)).rows;
+const readCaptureState = async (db, schema, models) => {
+	const [outbox] = await rowsOf(db, sql`select to_regclass(${`${quoteIdent(schema)}."outbox"`}) is not null as found`);
+	const [capture] = await rowsOf(db, sql`select p.oid::text as oid, p.prosrc as source, p.prosecdef as definer from pg_proc p join pg_namespace n on n.oid = p.pronamespace where n.nspname = ${schema} and p.proname = 'capture' and p.pronargs = 0`);
+	const tables = {};
+	for (const model of models) {
+		const [found] = await rowsOf(db, sql`select to_regclass(${tableSql(model)})::oid::text as oid`);
+		tables[model.name] = found?.oid ?? null;
+	}
+	const oids = Object.values(tables).filter((oid) => oid !== null);
+	const triggers = await rowsOf(db, sql`select t.tgrelid::text as "table", format('%I.%I', ns.nspname, c.relname) as "tableSql", t.tgname as name,
+      t.tgfoid::text as "function", t.tgtype::int as type, encode(t.tgargs, 'hex') as args
+      from pg_trigger t join pg_class c on c.oid = t.tgrelid join pg_namespace ns on ns.oid = c.relnamespace
+      where not t.tgisinternal and (t.tgfoid::text = ${capture?.oid ?? ""} or t.tgrelid::text = any(${oids}::text[]))`);
+	return {
+		outbox: outbox?.found ?? false,
+		...capture && { capture },
+		triggers: triggers.map((trigger) => ({
+			...trigger,
+			args: triggerArgs(trigger.args)
+		})),
+		tables
+	};
+};
+const plan = async (db, models, options) => {
+	const schema = changesSchema(options);
+	const withEvents = models.filter((model) => (model.events ?? []).length > 0);
+	return {
+		schema,
+		plan: capturePlan(schema, models, await readCaptureState(db, schema, withEvents))
+	};
+};
+/**
+* The SQL that brings the database to the capture the resources' events need: the schema with the outbox and
+* `capture()`, and a trigger pair per resource with events, recreated when its fields changed; triggers of resources
+* without events any more are dropped. `undefined` when the database is current. Tables are never dropped.
+*/
+const changesMigration = async (db, models, options) => {
+	const { schema, plan: found } = await plan(db, models, options);
+	return planSql(schema, found);
+};
+/**
+* Refuses to go on while a resource's events would not be captured as declared: a missing or out-of-date schema, or
+* trigger. The server never changes the schema itself: the project's migrations do, before the new version serves.
+*/
+const checkChanges = async (db, models, options) => {
+	if (!models.some((model) => model.events)) return;
+	const { plan: found } = await plan(db, models, options);
+	const missing = uncaptured(found, models);
+	if (missing.length === 0) return;
+	throw new Error(`The changes of ${missing.join(", ")} are not captured as their events need: their triggers or the changes schema are missing or out of date. Write the change as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
+};
+//#endregion
+export { changesMigration, checkChanges, migrationCommand };