@protobase/server 0.8.1 → 0.9.0

package/dist/jobs/schema.d.ts

@@ -0,0 +1,15 @@
+import { Db } from "@protobase/query";
+//#region src/jobs/schema.d.ts
+/** The schema the job queue lives in: pg-boss's tables and Protobase's functions. */
+export declare const jobsSchema = "jobs";
+/**
+ * The SQL that brings the jobs schema to what this version of Protobase runs: pg-boss's own construction plan when it
+ * is missing, or its migration plan from the version installed, then Protobase's functions. `undefined` when current.
+ */
+export declare const jobsSchemaMigration: (db: Db) => Promise<string | undefined>;
+/**
+ * Refuses to go on while the jobs schema is missing or not the version this Protobase runs. The server never creates
+ * or migrates it: the project's migrations do, before the new version serves.
+ */
+export declare const checkJobsSchema: (db: Db) => Promise<void>;
+//#endregion

package/dist/jobs/schema.js

@@ -0,0 +1,63 @@
+import { functionNames, functionsComment, functionsSql } from "./functions-sql.js";
+import { CompiledQuery } from "kysely";
+import { getConstructionPlans, getMigrationPlans } from "pg-boss";
+//#region src/jobs/schema.ts
+/** The schema the job queue lives in: pg-boss's tables and Protobase's functions. */
+const jobsSchema = "jobs";
+/** The command that writes what the database lacks as the project's next migration. */
+const migrationCommand = "protobase migration";
+/**
+* A pg-boss plan as a migration the project applies in its own transaction: without its BEGIN and COMMIT, without the
+* timeouts it sets for that transaction, which would hold for the project's later migrations too, and with index
+* builds that are not `CONCURRENTLY`, which Postgres refuses in a transaction. Migrations run while nothing else
+* writes, so a plain index build only costs a lock nobody waits on.
+*/
+const migrationStatements = (plan) => {
+	const match = /^\s*BEGIN;\n\s*SET LOCAL lock_timeout = \d+;\n\s*SET LOCAL idle_in_transaction_session_timeout = \d+;\n([\s\S]*?)\n\s*COMMIT;\n?([\s\S]*)$/.exec(plan);
+	if (!match) throw new Error(`Unexpected pg-boss plan:\n${plan.slice(0, 200)}`);
+	return `${match[1].trim()}\n${match[2]}`.replace(/\b(CREATE (?:UNIQUE )?INDEX|DROP INDEX|REINDEX INDEX) CONCURRENTLY\b/gi, "$1").trim();
+};
+const rows = async (db, text, parameters = []) => (await db.executeQuery(CompiledQuery.raw(text, parameters))).rows;
+/** What the database holds of the jobs schema: pg-boss's version, when installed, and whether Protobase's functions are current. */
+const readJobsSchema = async (db) => {
+	const [{ installed }] = await rows(db, `select to_regclass('${jobsSchema}.version') is not null as installed`);
+	if (!installed) return {
+		pgBoss: void 0,
+		functionsCurrent: false
+	};
+	const [version] = await rows(db, `select version from ${jobsSchema}.version`);
+	const functions = await rows(db, `select p.proname as name, obj_description(p.oid, 'pg_proc') as comment from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace where n.nspname = $1 and p.proname = any($2)`, [jobsSchema, functionNames]);
+	const functionsCurrent = functionNames.every((name) => functions.some((found) => found.name === name && found.comment === functionsComment));
+	return {
+		pgBoss: version === void 0 ? void 0 : Number(version.version),
+		functionsCurrent
+	};
+};
+const newer = (version) => /* @__PURE__ */ new Error(`The jobs schema is at pg-boss schema version ${version}, newer than the 45 this version of Protobase runs; upgrade Protobase`);
+/**
+* The SQL that brings the jobs schema to what this version of Protobase runs: pg-boss's own construction plan when it
+* is missing, or its migration plan from the version installed, then Protobase's functions. `undefined` when current.
+*/
+const jobsSchemaMigration = async (db) => {
+	const { pgBoss, functionsCurrent } = await readJobsSchema(db);
+	if (pgBoss !== void 0 && pgBoss > 45) throw newer(pgBoss);
+	if (pgBoss === 45 && functionsCurrent) return void 0;
+	const parts = [];
+	if (pgBoss === void 0) parts.push(migrationStatements(getConstructionPlans(jobsSchema)));
+	else if (pgBoss < 45) parts.push(migrationStatements(getMigrationPlans(jobsSchema, pgBoss)));
+	parts.push(functionsSql(jobsSchema));
+	return parts.join("\n\n");
+};
+/**
+* Refuses to go on while the jobs schema is missing or not the version this Protobase runs. The server never creates
+* or migrates it: the project's migrations do, before the new version serves.
+*/
+const checkJobsSchema = async (db) => {
+	const { pgBoss, functionsCurrent } = await readJobsSchema(db);
+	if (pgBoss !== void 0 && pgBoss > 45) throw newer(pgBoss);
+	if (pgBoss === 45 && functionsCurrent) return;
+	throw new Error(`The jobs schema is ${pgBoss === void 0 ? "missing" : "behind this version of Protobase"}. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
+};
+//#endregion
+export { checkJobsSchema, jobsSchema, jobsSchemaMigration, migrationCommand, migrationStatements, readJobsSchema };

package/dist/project-config.d.ts

@@ -1,7 +1,8 @@
 import { AdminAuth } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
-import { FilesOptions } from "./files/options.js";
 import { Authenticator } from "./types.js";
+import { WebhooksOptions } from "./webhooks/table/options.js";
+import { FilesOptions } from "./files/options.js";
 import { FunctionSource } from "./functions/define-function.js";
 import { AdminOptions } from "./admin-options.js";
 import { Db } from "@protobase/query";
@@ -24,13 +25,17 @@ export type ProjectConfig = {
   files?: FilesOptions;
   /** Where the changes that resources' events are raised from are captured (see `EventsOptions`). */
   events?: EventsOptions;
+  /** Webhook subscriptions made in the admin app; set by `extends: [webhooks()]` (see `WebhooksOptions`). */
+  webhooks?: WebhooksOptions;
+  /** The module of the app's jobs, e.g. `import * as jobs from './config/jobs'`: every `defineJob` it exports. */
+  jobs?: Record<string, unknown>;
   options?: AdminOptions;
 };
 /** Typed identity, for `export default defineConfig({ extends: [...], config, auth, ... })` in `protobase.config.ts`. */
 export declare const defineConfig: (config: ProjectConfig) => ProjectConfig;
 /**
  * One config from several, each after the ones it `extends`, the last being the app's own. Named things are all kept:
- * resources, views and pages of the config modules, functions, assistant tools, file providers; one name defined by two configs is an error naming
+ * resources, views and pages of the config modules, functions, jobs, assistant tools, file providers; one name defined by two configs is an error naming
  * both. Write hooks run in the same order. Every other value is the last config's that sets it, so the app's own wins.
  */
 export declare const mergeConfig: (...configs: ProjectConfig[]) => ProjectConfig;

package/dist/project-config.js

@@ -1,3 +1,5 @@
+import { jobDefinitions } from "./jobs/define-job.js";
+import { isSubscription } from "./webhooks/subscription.js";
 import { isPageDefinition } from "@protobase/layout";
 //#region src/project-config.ts
 /** Typed identity, for `export default defineConfig({ extends: [...], config, auth, ... })` in `protobase.config.ts`. */
@@ -40,6 +42,11 @@ const mergedModule = (named) => {
 		value,
 		label
 	})));
+	checkUnique("The subscription", exports.filter(({ value }) => isSubscription(value)).map(({ value, label }) => ({
+		name: value.name,
+		value,
+		label
+	})));
 	const menus = values.filter(({ value }) => typeof value?.toUserMenuModel === "function");
 	if (new Set(menus.map(({ value }) => value)).size > 1) throw new Error(`Only one config may export a user menu; ${menus.map(({ label }) => label).join(" and ")} each do`);
 	const module = {};
@@ -104,6 +111,16 @@ const mergedFiles = (named) => {
 		...secret !== void 0 && { secret }
 	};
 };
+const mergedJobs = (named) => {
+	const all = named.flatMap(({ config, label }) => jobDefinitions(config.jobs ?? {}).map((value) => ({
+		name: value.name,
+		value,
+		label
+	})));
+	if (all.length === 0) return void 0;
+	checkUnique("The job", all);
+	return Object.fromEntries(all.map(({ name, value }) => [name, value]));
+};
 const mergedOptions = (named) => {
 	const all = named.flatMap(({ config }) => config.options ? [config.options] : []);
 	if (all.length === 0) return void 0;
@@ -117,20 +134,22 @@ const mergedOptions = (named) => {
 };
 /**
 * One config from several, each after the ones it `extends`, the last being the app's own. Named things are all kept:
-* resources, views and pages of the config modules, functions, assistant tools, file providers; one name defined by two configs is an error naming
+* resources, views and pages of the config modules, functions, jobs, assistant tools, file providers; one name defined by two configs is an error naming
 * both. Write hooks run in the same order. Every other value is the last config's that sets it, so the app's own wins.
 */
 const mergeConfig = (...configs) => {
 	const named = configs.flatMap((config, index) => flatten(config, config.name ?? `config ${index + 1}`));
-	const { db, authenticate, auth, events } = lastSet(named.map(({ config }) => ({
+	const { db, authenticate, auth, events, webhooks } = lastSet(named.map(({ config }) => ({
 		db: config.db,
 		authenticate: config.authenticate,
 		auth: config.auth,
-		events: config.events
+		events: config.events,
+		webhooks: config.webhooks
 	})));
 	const module = mergedModule(named);
 	const functions = mergedFunctions(named);
 	const files = mergedFiles(named);
+	const jobs = mergedJobs(named);
 	const options = mergedOptions(named);
 	const name = configs.at(-1)?.name;
 	return {
@@ -142,6 +161,8 @@ const mergeConfig = (...configs) => {
 		...functions && { functions },
 		...files && { files },
 		...events && { events },
+		...webhooks && { webhooks },
+		...jobs && { jobs },
 		...options && { options }
 	};
 };

package/dist/resource-source.d.ts

@@ -1,5 +1,7 @@
+import { SubscriptionDefinition } from "./webhooks/subscription.js";
+import "./index.js";
 import { PageDefinition } from "@protobase/layout";
-import { AccessSource, FileProcessor, UserMenuSource, ViewModel } from "@protobase/schema";
+import { AccessSource, EventMatch, FileProcessor, UserMenuSource, ViewModel } from "@protobase/schema";
 import { z } from "zod";
 //#region src/resource-source.d.ts
 type FieldSource = {
@@ -22,10 +24,12 @@ export type ResourceSource = AccessSource & {
     message: string;
   }> | undefined)[];
   recordSchema(): z.ZodType;
+  /** The code predicates of its events, by event name. */
+  eventMatches?(): Record<string, EventMatch<any>>;
 };
 /**
- * Splits a config module (`import * as config from './config'`) into its resources, views, pages and, when it exports
- * one `userMenu(...)`, the user menu.
+ * Splits a config module (`import * as config from './config'`) into its resources, views, pages, subscriptions and,
+ * when it exports one `userMenu(...)`, the user menu.
  */
 export declare const configExports: (module: Record<string, unknown>) => {
   userMenu?: UserMenuSource | undefined;
@@ -34,5 +38,6 @@ export declare const configExports: (module: Record<string, unknown>) => {
     toModel(): ViewModel;
   }>;
   pages: PageDefinition[];
+  subscriptions: SubscriptionDefinition[];
 };
 //#endregion

package/dist/resource-source.js

@@ -1,13 +1,15 @@
+import { isSubscription } from "./webhooks/subscription.js";
 import { isPageDefinition } from "@protobase/layout";
 //#region src/resource-source.ts
 /**
-* Splits a config module (`import * as config from './config'`) into its resources, views, pages and, when it exports
-* one `userMenu(...)`, the user menu.
+* Splits a config module (`import * as config from './config'`) into its resources, views, pages, subscriptions and,
+* when it exports one `userMenu(...)`, the user menu.
 */
 const configExports = (module) => {
 	const values = Object.values(module);
 	const pages = values.filter(isPageDefinition);
-	const others = values.filter((value) => !isPageDefinition(value));
+	const subscriptions = [...new Set(values.filter(isSubscription))];
+	const others = values.filter((value) => !isPageDefinition(value) && !isSubscription(value));
 	const buildable = others.filter((value) => typeof value?.toModel === "function");
 	const menus = others.filter((value) => typeof value?.toUserMenuModel === "function");
 	if (menus.length > 1) throw new Error(`The config module exports ${menus.length} user menus; export one userMenu(...)`);
@@ -15,6 +17,7 @@ const configExports = (module) => {
 		resources: buildable.filter((value) => typeof value.recordSchema === "function"),
 		views: buildable.filter((value) => typeof value.recordSchema !== "function"),
 		pages,
+		subscriptions,
 		...menus[0] && { userMenu: menus[0] }
 	};
 };

package/dist/types.d.ts

@@ -1,3 +1,4 @@
+import { JobDefinition } from "./jobs/job-types.js";
 import { Hono } from "hono";
 import { PageModel } from "@protobase/layout";
 import { ResourceModel, ViewModel } from "@protobase/schema";
@@ -88,5 +89,8 @@ export type ViewSource = {
 export type PageSource = {
   toModel(): PageModel;
 };
-export type Admin = Hono<AdminEnv>;
+/** The admin API, and the jobs it needs a worker to run: the delivery of resource events. */
+export type Admin = Hono<AdminEnv> & {
+  jobs: JobDefinition[];
+};
 //#endregion

package/dist/webhooks/attempt.js

@@ -0,0 +1,91 @@
+import { invokeFunction } from "../functions/define-function.js";
+import { retryAfterMs } from "./retry-schedule.js";
+import { standardWebhookHeaders } from "./standard-webhooks.js";
+import { subscriberSession } from "./subscriber-view.js";
+//#region src/webhooks/attempt.ts
+/** How long a receiver has to answer. */
+const attemptTimeoutMs = 15e3;
+const excerpt = async (response) => (await response.text()).slice(0, 200);
+const resultOf = async (response) => {
+	if (response.status >= 200 && response.status < 300) return {
+		ok: true,
+		status: response.status
+	};
+	const body = await excerpt(response);
+	const wait = retryAfterMs(response.headers.get("retry-after"));
+	return {
+		ok: false,
+		status: response.status,
+		error: `${response.status}${body ? `: ${body}` : ""}`,
+		...wait !== void 0 && { retryAfterMs: wait },
+		final: response.status === 410
+	};
+};
+const request = async (url, event, options, signal) => {
+	const body = JSON.stringify(options.body ? options.body(event) : event);
+	const signed = await standardWebhookHeaders(event.id, Math.floor(Date.now() / 1e3), body, options.secret);
+	return new Request(url, {
+		method: "POST",
+		headers: {
+			...options.headers,
+			...signed,
+			"content-type": "application/json"
+		},
+		body,
+		redirect: "manual",
+		signal
+	});
+};
+const callFunction = async (name, subscription, event, options, context, signal) => {
+	const fn = context.functions[name];
+	if (!fn) throw new Error(`The app has no function "${name}"`);
+	const session = subscriberSession(subscription) ?? { user: {
+		id: `subscription:${subscription.name}`,
+		roles: []
+	} };
+	const caller = {
+		session,
+		records: context.records(session)
+	};
+	const functionContext = {
+		name,
+		db: context.db,
+		caller: async () => caller
+	};
+	return invokeFunction(name, fn, await request("http://protobase.internal/", event, options, signal), fn.options.public ? functionContext : {
+		...functionContext,
+		...caller
+	});
+};
+const failure = (error) => ({
+	ok: false,
+	error: error instanceof Error ? error.message : String(error),
+	final: false
+});
+/** One try of one event to one subscription's target, within `attemptTimeoutMs`. It never throws. */
+const attemptDelivery = async (subscription, event, context) => {
+	const signal = AbortSignal.any([context.signal, AbortSignal.timeout(attemptTimeoutMs)]);
+	const { options } = subscription;
+	try {
+		if ("run" in options) {
+			await options.run(event, {
+				db: context.db,
+				attempt: context.attempt,
+				signal
+			});
+			return { ok: true };
+		}
+		if ("function" in options) return await resultOf(await callFunction(options.function, subscription, event, options, context, signal));
+		const blocked = await context.checkUrl?.(options.url);
+		if (blocked) return {
+			ok: false,
+			error: blocked,
+			final: true
+		};
+		return await resultOf(await fetch(await request(options.url, event, options, signal)));
+	} catch (error) {
+		return failure(error);
+	}
+};
+//#endregion
+export { attemptDelivery, attemptTimeoutMs };

package/dist/webhooks/retry-schedule.js

@@ -0,0 +1,40 @@
+//#region src/webhooks/retry-schedule.ts
+const second = 1e3;
+const minute = 60 * second;
+const hour = 60 * minute;
+/**
+* The waits before each retry, as Standard Webhooks recommends: 5 s, 5 m, 30 m, 2 h, 5 h, 10 h, 14 h, 20 h and 24 h,
+* about three days in all, so a delivery has 10 tries.
+*/
+const retryDelays = [
+	5 * second,
+	5 * minute,
+	30 * minute,
+	2 * hour,
+	5 * hour,
+	10 * hour,
+	14 * hour,
+	20 * hour,
+	24 * hour
+];
+const maxTries = retryDelays.length + 1;
+/**
+* How long to wait before the try after `tried` failed ones: the schedule with up to 10% jitter, or longer when the
+* receiver asked with Retry-After, up to a day. `undefined` once the tries are used up.
+*/
+const nextRetryDelay = (tried, retryAfterMs, random = Math.random) => {
+	const scheduled = retryDelays[tried - 1];
+	if (scheduled === void 0) return void 0;
+	const jittered = Math.round(scheduled * (1 + (random() * 2 - 1) * .1));
+	return Math.min(Math.max(jittered, retryAfterMs ?? 0), 24 * hour);
+};
+/** A Retry-After header in milliseconds from `now`: seconds, or an HTTP date. */
+const retryAfterMs = (header, now = Date.now()) => {
+	if (header === null) return void 0;
+	const text = header.trim();
+	if (/^\d+$/.test(text)) return Number(text) * second;
+	const at = Date.parse(text);
+	return Number.isNaN(at) ? void 0 : Math.max(0, at - now);
+};
+//#endregion
+export { maxTries, nextRetryDelay, retryAfterMs, retryDelays };

package/dist/webhooks/route-events.js

@@ -0,0 +1,61 @@
+import { eventPatternMatches } from "./subscription.js";
+import { checkEventFilter, evaluateFilter } from "@protobase/schema";
+//#region src/webhooks/route-events.ts
+const declaredEvents = (models) => models.flatMap((model) => (model.events ?? []).map((event) => ({
+	model,
+	name: event.name
+})));
+const coveredModels = (subscription, models) => {
+	const events = declaredEvents(models).filter(({ name }) => subscription.options.events.some((pattern) => eventPatternMatches(pattern, name)));
+	return [...new Set(events.map(({ model }) => model))];
+};
+/**
+* What is wrong with the subscriptions, given the resources and the app's API functions: a pattern that names no
+* declared event, a `when` that does not check against a resource it covers, a missing function or URL, roles left
+* empty. Disabled subscriptions are checked too, except for their URL.
+*/
+const subscriptionProblems = (subscriptions, models, functions) => subscriptions.flatMap((subscription) => {
+	const { name, options } = subscription;
+	const declared = declaredEvents(models).map((event) => event.name);
+	return [
+		...options.events.filter((pattern) => !declared.some((event) => eventPatternMatches(pattern, event))).map((pattern) => `"${pattern}" matches no declared event`),
+		...options.when === void 0 ? [] : coveredModels(subscription, models).flatMap((model) => {
+			const { problem } = checkEventFilter(model, options.when);
+			return problem ? [`when ${problem} on ${model.name}`] : [];
+		}),
+		..."function" in options && !functions.includes(options.function) ? [`calls the function "${options.function}", which the app does not have`] : [],
+		..."url" in options && options.enabled !== false && !options.url ? ["has an empty url; is its environment variable set?"] : [],
+		...options.as && options.as.roles.length === 0 ? ["delivers as no roles"] : []
+	].map((problem) => `Subscription "${name}" ${problem}`);
+});
+/**
+* Which subscriptions take which of a change's events: enabled, naming the event, of the change's tenant when they set
+* one, and passing their `when` on the record after the change (before it, for a delete). Filters are checked once,
+* here; run `subscriptionProblems` first.
+*/
+const subscriptionRouter = (subscriptions, models) => {
+	const filters = /* @__PURE__ */ new Map();
+	for (const subscription of subscriptions) {
+		if (subscription.options.when === void 0) continue;
+		for (const model of coveredModels(subscription, models)) {
+			const { filter } = checkEventFilter(model, subscription.options.when);
+			if (filter) filters.set(`${subscription.name}\0${model.name}`, filter);
+		}
+	}
+	const passes = (subscription, change) => {
+		const { options } = subscription;
+		if (options.enabled === false) return false;
+		if (options.tenant !== void 0 && String(options.tenant) !== String(change.tenant)) return false;
+		const filter = filters.get(`${subscription.name}\0${change.resource}`);
+		return !filter || evaluateFilter(filter, change.after ?? change.before) === true;
+	};
+	return (change, events) => subscriptions.flatMap((subscription) => {
+		if (!passes(subscription, change)) return [];
+		return events.filter((event) => subscription.options.events.some((pattern) => eventPatternMatches(pattern, event))).map((event) => ({
+			subscription,
+			event
+		}));
+	});
+};
+//#endregion
+export { subscriptionProblems, subscriptionRouter };

package/dist/webhooks/standard-webhooks.d.ts

@@ -0,0 +1,4 @@
+//#region src/webhooks/standard-webhooks.d.ts
+/** A new signing secret, `whsec_` and 32 random bytes in base64. */
+export declare const newWebhookSecret: () => string;
+//#endregion

package/dist/webhooks/standard-webhooks.js

@@ -0,0 +1,36 @@
+//#region src/webhooks/standard-webhooks.ts
+const base64 = (bytes) => btoa(String.fromCharCode(...bytes));
+const secretKey = (secret) => {
+	const text = secret.replace(/^whsec_/, "");
+	if (!/^[A-Za-z0-9+/]+={0,2}$/.test(text)) throw new Error("A webhook secret is `whsec_` and base64");
+	return Uint8Array.from(atob(text), (char) => char.charCodeAt(0));
+};
+/** A new signing secret, `whsec_` and 32 random bytes in base64. */
+const newWebhookSecret = () => `whsec_${base64(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)))}`;
+const sign = async (secret, content) => {
+	const key = await crypto.subtle.importKey("raw", secretKey(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return `v1,${base64(new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(content))))}`;
+};
+/**
+* The Standard Webhooks headers of one request (https://www.standardwebhooks.com): its id, its time in seconds and,
+* with a secret, the HMAC-SHA256 of `id.timestamp.body` as `v1,<base64>`; with several, one signature per secret,
+* separated by spaces, as during a rotation.
+*/
+const standardWebhookHeaders = async (id, timestamp, body, secret) => {
+	const headers = {
+		"webhook-id": id,
+		"webhook-timestamp": String(timestamp)
+	};
+	const secrets = secret === void 0 ? [] : [secret].flat();
+	if (secrets.length === 0) return headers;
+	const signatures = await Promise.all(secrets.map((each) => sign(each, `${id}.${timestamp}.${body}`)));
+	return {
+		...headers,
+		"webhook-signature": signatures.join(" ")
+	};
+};
+//#endregion
+export { newWebhookSecret, standardWebhookHeaders };

package/dist/webhooks/subscriber-view.js

@@ -0,0 +1,76 @@
+import { requestAccess } from "../request-access.js";
+import { checkRecord, evaluateFilter } from "@protobase/schema";
+//#region src/webhooks/subscriber-view.ts
+/**
+* The session a subscription delivers as, or `undefined` for the system: every record, every field but sensitive ones.
+* Its tenant is the change's, typed as the app's, when the subscription has one.
+*/
+const subscriberSession = ({ name, options }, change) => {
+	if (!options.as) return void 0;
+	const tenant = options.tenant === void 0 ? void 0 : change?.tenant ?? options.tenant;
+	return {
+		user: {
+			id: `subscription:${name}`,
+			roles: options.as.roles
+		},
+		...tenant !== void 0 && {
+			tenant,
+			organization: { id: tenant }
+		}
+	};
+};
+const pick = (record, fields) => fields ? Object.fromEntries(Object.entries(record).filter(([name]) => fields.includes(name))) : record;
+/** A change's event as a subscriber sees it: only `fields` of its records (all without), none at all when `thin`. */
+const subscriptionEvent = (change, event, { fields, thin = false } = {}) => ({
+	id: `evt_${change.sequence}_${event.slice(event.indexOf(".") + 1)}`,
+	type: event,
+	timestamp: change.at,
+	data: {
+		resource: change.resource,
+		operation: change.operation,
+		key: change.key,
+		sequence: change.sequence,
+		...!thin && change.after && { after: pick(change.after, fields) },
+		...!thin && change.before && { before: pick(change.before, fields) },
+		changed: fields ? change.changed.filter((name) => fields.includes(name)) : change.changed,
+		...change.tenant !== void 0 && { tenant: change.tenant },
+		actor: change.actor,
+		source: change.source,
+		transaction: change.transaction
+	}
+});
+const mayRead = async (access, record) => {
+	const { resolved, session, entry } = access;
+	if (!resolved.operations.read) return false;
+	if (resolved.rowFilter.read && evaluateFilter(resolved.rowFilter.read, record) !== true) return false;
+	if (!resolved.recordChecks.includes("read")) return true;
+	const context = {
+		user: session.user,
+		...session.organization && { organization: session.organization }
+	};
+	return checkRecord(entry.source, context, "read", record, void 0, access.deps.accessOptions);
+};
+/**
+* Builds each subscriber's event, under the access rules of the session it delivers as, resolved once per subscription
+* and resource: `undefined` when it may not read the record, after the change or before a delete.
+*/
+const subscriberEvents = (deps) => {
+	const accesses = /* @__PURE__ */ new Map();
+	return async (subscription, change, event) => {
+		const thin = subscription.options.payload === "thin";
+		const session = subscriberSession(subscription, change);
+		if (!session) return subscriptionEvent(change, event, { thin });
+		const entry = deps.registry.find(change.resource);
+		if (!entry) throw new Error(`Not implemented: a change of "${change.resource}", which is no resource of the app`);
+		const cacheKey = `${subscription.name}\0${change.resource}`;
+		if (!accesses.has(cacheKey)) accesses.set(cacheKey, requestAccess(deps, entry, session));
+		const access = await accesses.get(cacheKey);
+		if (!await mayRead(access, change.after ?? change.before)) return void 0;
+		return subscriptionEvent(change, event, {
+			fields: Object.keys(access.readable.fields),
+			thin
+		});
+	};
+};
+//#endregion
+export { subscriberEvents, subscriberSession, subscriptionEvent };

package/dist/webhooks/subscription.d.ts

@@ -0,0 +1,92 @@
+import { Row, TenantValue } from "../types.js";
+import { EventActor, EventOperation } from "@protobase/schema";
+import { Db } from "@protobase/query";
+//#region src/webhooks/subscription.d.ts
+/** What happened, as a receiver gets it in the `data` of an event. Records use field names, as the API shows them. */
+export type EventData = {
+  resource: string;
+  operation: EventOperation;
+  /** The record's key as its URL has it. */
+  key: string;
+  /** Grows with every change of a record, so a receiver can drop an event older than one it has. */
+  sequence: string;
+  after?: Row;
+  before?: Row;
+  changed: string[];
+  tenant?: TenantValue;
+  actor: EventActor | null;
+  source: 'api' | 'database';
+  transaction: string;
+};
+/** One event as it is delivered: the body of a URL or function target, and what a `run` handler gets. */
+export type SubscriptionEvent = {
+  /** The same on every retry and resend: the receiver's idempotency key (`webhook-id`). */
+  id: string;
+  type: string;
+  /** When the change's transaction started, ISO 8601. */
+  timestamp: string;
+  data: EventData;
+  /** Sent by Send test event: made up from a current record, not raised by a change. */
+  test?: true;
+};
+/** What a `run` handler gets beside the event. */
+export type RunContext = {
+  db: Db;
+  /** 1 for the first try. */
+  attempt: number;
+  signal: AbortSignal;
+};
+/** What every subscription may set beside its target. */
+export type SubscriptionCommon = {
+  /** Event names, such as `orders.created`, `orders.*` for every event of a resource, or `*` for all of them. */
+  events: string[];
+  /** A filter on the record, after the change or before a delete, in the language of access rules. */
+  when?: string;
+  /**
+   * Who the subscription delivers as: it gets only the records and fields these roles may read. Without it, every record
+   * and every field but the sensitive ones.
+   */
+  as?: {
+    roles: string[];
+  };
+  /** Only events of records of this tenant (organization). */
+  tenant?: TenantValue;
+  /** `thin` leaves the records out: a receiver reads them through the API. Default `full`. */
+  payload?: 'full' | 'thin';
+  /** One delivery at a time per record, in order; a failing one holds back the record's next. Default false. */
+  ordered?: boolean;
+  /** Default true. */
+  enabled?: boolean;
+};
+/** How a URL or function target is called: a POST of the event as JSON, signed with Standard Webhooks headers. */
+export type SentOptions = {
+  /** Signs the requests (`whsec_` and base64, as `verifyStandardWebhook` takes it); unsigned without one. Several sign during a rotation. */
+  secret?: string | string[];
+  headers?: Record<string, string>;
+  /** The body sent instead of the event, such as Slack's `{ text }`. */
+  body?: (event: SubscriptionEvent) => unknown;
+};
+export type UrlTarget = {
+  url: string | undefined;
+} & SentOptions;
+/** An API function of the app, `/api/functions/<name>`, called in this process. */
+export type FunctionTarget = {
+  function: string;
+} & SentOptions;
+/** Code run for each event; it throws to have the event retried. Config only. */
+export type RunTarget = {
+  run: (event: SubscriptionEvent, context: RunContext) => Promise<void> | void;
+};
+export type SubscriptionOptions = SubscriptionCommon & (UrlTarget | FunctionTarget | RunTarget);
+export type SubscriptionDefinition = {
+  readonly kind: 'subscription';
+  readonly name: string;
+  readonly options: SubscriptionOptions;
+};
+/**
+ * Delivers the events it names, as they happen: export it from the config module like a resource. The URL usually
+ * comes from the environment (`url: process.env.SLACK_WEBHOOK`); the server refuses to start while an enabled one is
+ * empty.
+ */
+export declare const subscription: (name: string, options: SubscriptionOptions) => SubscriptionDefinition;
+//#endregion