@protobase/server 0.8.2 → 0.10.0

package/dist/jobs/runtime.js

@@ -1,5 +1,5 @@
-import { jobsSchema } from "./schema.js";
 import { clearCurrentJobs, setCurrentJobs } from "./current.js";
+import { jobsSchema } from "./schema.js";
 import "./schedule.js";
 import { runJob, validatePayload } from "./run-job.js";
 import { jobsDatabase } from "./database.js";
@@ -81,8 +81,10 @@ const startJobs = async ({ db, jobs, work = true, pollSeconds = 2, shutdownSecon
 		const checked = await validatePayload(definition, payload);
 		if ("invalid" in checked) throw new Error(checked.invalid);
 		const data = checked.value ?? null;
+		const orderedId = definition.options.ordered ? (await sql`select uuidv7() as id`.execute(target)).rows[0].id : void 0;
 		const send = {
 			...sendOptions(definition.options, options),
+			...orderedId !== void 0 && { id: orderedId },
 			db: jobsDatabase(target)
 		};
 		const keyed = async (key) => {
@@ -98,10 +100,7 @@ const startJobs = async ({ db, jobs, work = true, pollSeconds = 2, shutdownSecon
 		};
 		const id = options.key === void 0 ? await boss.send(name, data, send) : await keyed(options.key);
 		if (!id) throw new Error(`Job "${name}" was not enqueued`);
-		if (!target.isTransaction) {
-			const worker = workers.get(name);
-			if (worker) boss.notifyWorker(worker.id);
-		}
+		if (!target.isTransaction) wake(name);
 		return id;
 	};
 	const nextDue = async () => (await sql`select ${sql.id(jobsSchema, "next_due")}() as due`.execute(db)).rows[0].due;
@@ -129,9 +128,14 @@ const startJobs = async ({ db, jobs, work = true, pollSeconds = 2, shutdownSecon
 			await new Promise((resolve) => setTimeout(resolve, 100));
 		}
 	};
+	const wake = (name) => {
+		const worker = workers.get(name);
+		if (worker) boss.notifyWorker(worker.id);
+	};
 	const runtime = {
 		works: work,
 		enqueue,
+		wake,
 		update,
 		drain,
 		nextDue,

package/dist/meta.js

@@ -1,16 +1,17 @@
 import { seesAssistant } from "./assistant/assistant-settings.js";
 import { sha256Hex, stableJson } from "./hash.js";
 import { requestAccess } from "./request-access.js";
+import { activeRole } from "./active-role.js";
 import { seesRuntime } from "./runtime/runtime-settings.js";
 import { pruneView } from "./view-access.js";
 import { prunePage } from "@protobase/layout";
-import { pickView } from "@protobase/schema";
+import { bottomBarFor, pickView } from "@protobase/schema";
 //#region src/meta.ts
 const modelsHash = (deps) => sha256Hex(stableJson(deps.registry.entries.map((entry) => entry.model))).then((hash) => hash.slice(0, 32));
 /**
 * `/meta` as one caller sees it: the resources they can do anything with, each as the restricted model (hidden fields
 * absent, `readOnly` unless writable), the view for their roles with hidden fields pruned, what they may do, and the
-* user menu without the resources they cannot see.
+* user menu and their bottom bar without the resources they cannot see.
 * The ETag hashes all of it, so it differs per user and per roles.
 */
 const createMeta = (deps) => {
@@ -32,6 +33,8 @@ const createMeta = (deps) => {
 		};
 		const pages = deps.pages.flatMap((page) => prunePage(page, session.user.roles, callerAccess) ?? []);
 		const shown = (item) => item.kind === "link" || (item.kind === "resource" ? visible.some((access) => access.entry.name === item.resource) : pages.some((page) => page.name === item.page));
+		const bar = bottomBarFor(deps.bottomBars, activeRole(session));
+		const barItems = bar?.items.filter(shown) ?? [];
 		const body = {
 			resources: visible.map((access) => access.readable),
 			views,
@@ -48,6 +51,10 @@ const createMeta = (deps) => {
 				].filter((op) => resolved.operations[op] && (resolved.recordChecks.includes(op) || resolved.rowFilter[op] !== void 0))
 			}])),
 			...deps.userMenu && { userMenu: { items: deps.userMenu.items.filter(shown) } },
+			...bar && barItems.length > 0 && { bottomBar: {
+				label: bar.label,
+				items: barItems
+			} },
 			...deps.assistant && seesAssistant(session.user.roles) && { assistant: { url: deps.assistant } },
 			...deps.runtime && seesRuntime(session.user.roles) && { runtime: { url: deps.runtime } }
 		};

package/dist/openapi/components.js

@@ -64,7 +64,7 @@ const parameters = {
 	orderBy: {
 		name: "order_by",
 		in: "query",
-		description: "Comma separated sortable fields, each with an optional `desc`, as in [AIP-132](https://google.aip.dev/132#ordering): `createdAt desc, number`. The primary key breaks ties.",
+		description: "Comma separated sortable fields, each with an optional `desc`, as in [AIP-132](https://google.aip.dev/132#ordering): `created_at desc, number`. The primary key breaks ties.",
 		schema: { type: "string" }
 	},
 	pageSize: {

package/dist/openapi/document.js

@@ -2,20 +2,22 @@ import { batchSchemas, errorResponses, parameters, problemSchema, searchBody } f
 import { resourcePaths } from "./resource-paths.js";
 import { resourceSchemas } from "./schemas.js";
 //#region src/openapi/document.ts
+const resourcesServer = (basePath) => basePath.slice(basePath.lastIndexOf("/") + 1);
+const systemServer = ".";
 /** The OpenAPI 3.1 document for one caller, generated from the resource models they may see and their zod record schemas. */
-const openApiDocument = (accesses, basePath, systemPath) => ({
+const openApiDocument = (accesses, basePath) => ({
 	openapi: "3.1.0",
 	info: {
 		title: "Protobase API",
 		version: "1.0.0",
 		description: "Admin API for an existing Postgres database. Follows Google's API design conventions ([AIP](https://google.aip.dev)) and reports errors as RFC 9457 `application/problem+json`."
 	},
-	servers: [{ url: basePath }],
+	servers: [{ url: resourcesServer(basePath) }],
 	security: [{ bearer: [] }],
 	tags: accesses.map(({ entry }) => ({ name: entry.name })),
 	paths: {
 		"/meta": {
-			servers: [{ url: systemPath || "/" }],
+			servers: [{ url: systemServer }],
 			get: {
 				operationId: "get_meta",
 				summary: "Resource and view models",
@@ -27,8 +29,8 @@ const openApiDocument = (accesses, basePath, systemPath) => ({
 				}
 			}
 		},
-		[`/${basePath.slice(basePath.lastIndexOf("/") + 1)}:batchWrite`]: {
-			servers: [{ url: basePath.slice(0, basePath.lastIndexOf("/")) || "/" }],
+		[`/${resourcesServer(basePath)}:batchWrite`]: {
+			servers: [{ url: systemServer }],
 			post: {
 				operationId: "batch_write",
 				summary: "Write many records in one transaction",

package/dist/openapi/naming.js

@@ -1,4 +1,5 @@
 //#region src/openapi/naming.ts
-const pascal = (name) => name.charAt(0).toUpperCase() + name.slice(1);
+/** A component name from a resource name: `stock_moves` and `stockMoves` both become `StockMoves`. */
+const pascal = (name) => name.split("_").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
 //#endregion
 export { pascal };

package/dist/project-config.d.ts

@@ -1,7 +1,8 @@
 import { AdminAuth } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
-import { FilesOptions } from "./files/options.js";
 import { Authenticator } from "./types.js";
+import { WebhooksOptions } from "./webhooks/table/options.js";
+import { FilesOptions } from "./files/options.js";
 import { FunctionSource } from "./functions/define-function.js";
 import { AdminOptions } from "./admin-options.js";
 import { Db } from "@protobase/query";
@@ -24,6 +25,8 @@ export type ProjectConfig = {
   files?: FilesOptions;
   /** Where the changes that resources' events are raised from are captured (see `EventsOptions`). */
   events?: EventsOptions;
+  /** Webhook subscriptions made in the admin app; set by `extends: [webhooks()]` (see `WebhooksOptions`). */
+  webhooks?: WebhooksOptions;
   /** The module of the app's jobs, e.g. `import * as jobs from './config/jobs'`: every `defineJob` it exports. */
   jobs?: Record<string, unknown>;
   options?: AdminOptions;

package/dist/project-config.js

@@ -1,4 +1,5 @@
 import { jobDefinitions } from "./jobs/define-job.js";
+import { isSubscription } from "./webhooks/subscription.js";
 import { isPageDefinition } from "@protobase/layout";
 //#region src/project-config.ts
 /** Typed identity, for `export default defineConfig({ extends: [...], config, auth, ... })` in `protobase.config.ts`. */
@@ -41,6 +42,11 @@ const mergedModule = (named) => {
 		value,
 		label
 	})));
+	checkUnique("The subscription", exports.filter(({ value }) => isSubscription(value)).map(({ value, label }) => ({
+		name: value.name,
+		value,
+		label
+	})));
 	const menus = values.filter(({ value }) => typeof value?.toUserMenuModel === "function");
 	if (new Set(menus.map(({ value }) => value)).size > 1) throw new Error(`Only one config may export a user menu; ${menus.map(({ label }) => label).join(" and ")} each do`);
 	const module = {};
@@ -133,11 +139,12 @@ const mergedOptions = (named) => {
 */
 const mergeConfig = (...configs) => {
 	const named = configs.flatMap((config, index) => flatten(config, config.name ?? `config ${index + 1}`));
-	const { db, authenticate, auth, events } = lastSet(named.map(({ config }) => ({
+	const { db, authenticate, auth, events, webhooks } = lastSet(named.map(({ config }) => ({
 		db: config.db,
 		authenticate: config.authenticate,
 		auth: config.auth,
-		events: config.events
+		events: config.events,
+		webhooks: config.webhooks
 	})));
 	const module = mergedModule(named);
 	const functions = mergedFunctions(named);
@@ -154,6 +161,7 @@ const mergeConfig = (...configs) => {
 		...functions && { functions },
 		...files && { files },
 		...events && { events },
+		...webhooks && { webhooks },
 		...jobs && { jobs },
 		...options && { options }
 	};

package/dist/resource-source.d.ts

@@ -1,5 +1,7 @@
+import { SubscriptionDefinition } from "./webhooks/subscription.js";
+import "./index.js";
 import { PageDefinition } from "@protobase/layout";
-import { AccessSource, FileProcessor, UserMenuSource, ViewModel } from "@protobase/schema";
+import { AccessSource, BottomBarSource, EventMatch, FileProcessor, UserMenuSource, ViewModel } from "@protobase/schema";
 import { z } from "zod";
 //#region src/resource-source.d.ts
 type FieldSource = {
@@ -22,10 +24,12 @@ export type ResourceSource = AccessSource & {
     message: string;
   }> | undefined)[];
   recordSchema(): z.ZodType;
+  /** The code predicates of its events, by event name. */
+  eventMatches?(): Record<string, EventMatch<any>>;
 };
 /**
- * Splits a config module (`import * as config from './config'`) into its resources, views, pages and, when it exports
- * one `userMenu(...)`, the user menu.
+ * Splits a config module (`import * as config from './config'`) into its resources, views, pages, subscriptions and,
+ * when it exports one `userMenu(...)`, the user menu, and its `bottomBar(...)` exports in order.
  */
 export declare const configExports: (module: Record<string, unknown>) => {
   userMenu?: UserMenuSource | undefined;
@@ -34,5 +38,7 @@ export declare const configExports: (module: Record<string, unknown>) => {
     toModel(): ViewModel;
   }>;
   pages: PageDefinition[];
+  subscriptions: SubscriptionDefinition[];
+  bottomBars: BottomBarSource[];
 };
 //#endregion

package/dist/resource-source.js

@@ -1,20 +1,25 @@
+import { isSubscription } from "./webhooks/subscription.js";
 import { isPageDefinition } from "@protobase/layout";
 //#region src/resource-source.ts
 /**
-* Splits a config module (`import * as config from './config'`) into its resources, views, pages and, when it exports
-* one `userMenu(...)`, the user menu.
+* Splits a config module (`import * as config from './config'`) into its resources, views, pages, subscriptions and,
+* when it exports one `userMenu(...)`, the user menu, and its `bottomBar(...)` exports in order.
 */
 const configExports = (module) => {
 	const values = Object.values(module);
 	const pages = values.filter(isPageDefinition);
-	const others = values.filter((value) => !isPageDefinition(value));
+	const subscriptions = [...new Set(values.filter(isSubscription))];
+	const others = values.filter((value) => !isPageDefinition(value) && !isSubscription(value));
 	const buildable = others.filter((value) => typeof value?.toModel === "function");
 	const menus = others.filter((value) => typeof value?.toUserMenuModel === "function");
+	const bottomBars = [...new Set(others.filter((value) => typeof value?.toBottomBarModel === "function"))];
 	if (menus.length > 1) throw new Error(`The config module exports ${menus.length} user menus; export one userMenu(...)`);
 	return {
 		resources: buildable.filter((value) => typeof value.recordSchema === "function"),
 		views: buildable.filter((value) => typeof value.recordSchema !== "function"),
 		pages,
+		subscriptions,
+		bottomBars,
 		...menus[0] && { userMenu: menus[0] }
 	};
 };

package/dist/routes/docs.js

@@ -8,10 +8,10 @@ const docsRoutes = (deps) => {
 	const app = new Hono();
 	app.get("/openapi.json", async (c) => {
 		const visible = (await Promise.all(deps.registry.entries.map((entry) => requestAccess(deps, entry, c.get("session"))))).filter((access) => Object.values(access.resolved.operations).some(Boolean));
-		return c.json(openApiDocument(visible, deps.basePath, deps.systemPath));
+		return c.json(openApiDocument(visible, deps.basePath));
 	});
 	app.get("/docs", Scalar({
-		url: `${deps.systemPath}/openapi.json`,
+		url: "openapi.json",
 		pageTitle: "Protobase API"
 	}));
 	return app;

package/dist/types.d.ts

@@ -1,3 +1,4 @@
+import { JobDefinition } from "./jobs/job-types.js";
 import { Hono } from "hono";
 import { PageModel } from "@protobase/layout";
 import { ResourceModel, ViewModel } from "@protobase/schema";
@@ -88,5 +89,8 @@ export type ViewSource = {
 export type PageSource = {
   toModel(): PageModel;
 };
-export type Admin = Hono<AdminEnv>;
+/** The admin API, and the jobs it needs a worker to run: the delivery of resource events. */
+export type Admin = Hono<AdminEnv> & {
+  jobs: JobDefinition[];
+};
 //#endregion

package/dist/webhooks/attempt.js

@@ -0,0 +1,91 @@
+import { invokeFunction } from "../functions/define-function.js";
+import { retryAfterMs } from "./retry-schedule.js";
+import { standardWebhookHeaders } from "./standard-webhooks.js";
+import { subscriberSession } from "./subscriber-view.js";
+//#region src/webhooks/attempt.ts
+/** How long a receiver has to answer. */
+const attemptTimeoutMs = 15e3;
+const excerpt = async (response) => (await response.text()).slice(0, 200);
+const resultOf = async (response) => {
+	if (response.status >= 200 && response.status < 300) return {
+		ok: true,
+		status: response.status
+	};
+	const body = await excerpt(response);
+	const wait = retryAfterMs(response.headers.get("retry-after"));
+	return {
+		ok: false,
+		status: response.status,
+		error: `${response.status}${body ? `: ${body}` : ""}`,
+		...wait !== void 0 && { retryAfterMs: wait },
+		final: response.status === 410
+	};
+};
+const request = async (url, event, options, signal) => {
+	const body = JSON.stringify(options.body ? options.body(event) : event);
+	const signed = await standardWebhookHeaders(event.id, Math.floor(Date.now() / 1e3), body, options.secret);
+	return new Request(url, {
+		method: "POST",
+		headers: {
+			...options.headers,
+			...signed,
+			"content-type": "application/json"
+		},
+		body,
+		redirect: "manual",
+		signal
+	});
+};
+const callFunction = async (name, subscription, event, options, context, signal) => {
+	const fn = context.functions[name];
+	if (!fn) throw new Error(`The app has no function "${name}"`);
+	const session = subscriberSession(subscription) ?? { user: {
+		id: `subscription:${subscription.name}`,
+		roles: []
+	} };
+	const caller = {
+		session,
+		records: context.records(session)
+	};
+	const functionContext = {
+		name,
+		db: context.db,
+		caller: async () => caller
+	};
+	return invokeFunction(name, fn, await request("http://protobase.internal/", event, options, signal), fn.options.public ? functionContext : {
+		...functionContext,
+		...caller
+	});
+};
+const failure = (error) => ({
+	ok: false,
+	error: error instanceof Error ? error.message : String(error),
+	final: false
+});
+/** One try of one event to one subscription's target, within `attemptTimeoutMs`. It never throws. */
+const attemptDelivery = async (subscription, event, context) => {
+	const signal = AbortSignal.any([context.signal, AbortSignal.timeout(attemptTimeoutMs)]);
+	const { options } = subscription;
+	try {
+		if ("run" in options) {
+			await options.run(event, {
+				db: context.db,
+				attempt: context.attempt,
+				signal
+			});
+			return { ok: true };
+		}
+		if ("function" in options) return await resultOf(await callFunction(options.function, subscription, event, options, context, signal));
+		const blocked = await context.checkUrl?.(options.url);
+		if (blocked) return {
+			ok: false,
+			error: blocked,
+			final: true
+		};
+		return await resultOf(await fetch(await request(options.url, event, options, signal)));
+	} catch (error) {
+		return failure(error);
+	}
+};
+//#endregion
+export { attemptDelivery, attemptTimeoutMs };

package/dist/webhooks/retry-schedule.js

@@ -0,0 +1,40 @@
+//#region src/webhooks/retry-schedule.ts
+const second = 1e3;
+const minute = 60 * second;
+const hour = 60 * minute;
+/**
+* The waits before each retry, as Standard Webhooks recommends: 5 s, 5 m, 30 m, 2 h, 5 h, 10 h, 14 h, 20 h and 24 h,
+* about three days in all, so a delivery has 10 tries.
+*/
+const retryDelays = [
+	5 * second,
+	5 * minute,
+	30 * minute,
+	2 * hour,
+	5 * hour,
+	10 * hour,
+	14 * hour,
+	20 * hour,
+	24 * hour
+];
+const maxTries = retryDelays.length + 1;
+/**
+* How long to wait before the try after `tried` failed ones: the schedule with up to 10% jitter, or longer when the
+* receiver asked with Retry-After, up to a day. `undefined` once the tries are used up.
+*/
+const nextRetryDelay = (tried, retryAfterMs, random = Math.random) => {
+	const scheduled = retryDelays[tried - 1];
+	if (scheduled === void 0) return void 0;
+	const jittered = Math.round(scheduled * (1 + (random() * 2 - 1) * .1));
+	return Math.min(Math.max(jittered, retryAfterMs ?? 0), 24 * hour);
+};
+/** A Retry-After header in milliseconds from `now`: seconds, or an HTTP date. */
+const retryAfterMs = (header, now = Date.now()) => {
+	if (header === null) return void 0;
+	const text = header.trim();
+	if (/^\d+$/.test(text)) return Number(text) * second;
+	const at = Date.parse(text);
+	return Number.isNaN(at) ? void 0 : Math.max(0, at - now);
+};
+//#endregion
+export { maxTries, nextRetryDelay, retryAfterMs, retryDelays };

package/dist/webhooks/route-events.js

@@ -0,0 +1,61 @@
+import { eventPatternMatches } from "./subscription.js";
+import { checkEventFilter, evaluateFilter } from "@protobase/schema";
+//#region src/webhooks/route-events.ts
+const declaredEvents = (models) => models.flatMap((model) => (model.events ?? []).map((event) => ({
+	model,
+	name: event.name
+})));
+const coveredModels = (subscription, models) => {
+	const events = declaredEvents(models).filter(({ name }) => subscription.options.events.some((pattern) => eventPatternMatches(pattern, name)));
+	return [...new Set(events.map(({ model }) => model))];
+};
+/**
+* What is wrong with the subscriptions, given the resources and the app's API functions: a pattern that names no
+* declared event, a `when` that does not check against a resource it covers, a missing function or URL, roles left
+* empty. Disabled subscriptions are checked too, except for their URL.
+*/
+const subscriptionProblems = (subscriptions, models, functions) => subscriptions.flatMap((subscription) => {
+	const { name, options } = subscription;
+	const declared = declaredEvents(models).map((event) => event.name);
+	return [
+		...options.events.filter((pattern) => !declared.some((event) => eventPatternMatches(pattern, event))).map((pattern) => `"${pattern}" matches no declared event`),
+		...options.when === void 0 ? [] : coveredModels(subscription, models).flatMap((model) => {
+			const { problem } = checkEventFilter(model, options.when);
+			return problem ? [`when ${problem} on ${model.name}`] : [];
+		}),
+		..."function" in options && !functions.includes(options.function) ? [`calls the function "${options.function}", which the app does not have`] : [],
+		..."url" in options && options.enabled !== false && !options.url ? ["has an empty url; is its environment variable set?"] : [],
+		...options.as && options.as.roles.length === 0 ? ["delivers as no roles"] : []
+	].map((problem) => `Subscription "${name}" ${problem}`);
+});
+/**
+* Which subscriptions take which of a change's events: enabled, naming the event, of the change's tenant when they set
+* one, and passing their `when` on the record after the change (before it, for a delete). Filters are checked once,
+* here; run `subscriptionProblems` first.
+*/
+const subscriptionRouter = (subscriptions, models) => {
+	const filters = /* @__PURE__ */ new Map();
+	for (const subscription of subscriptions) {
+		if (subscription.options.when === void 0) continue;
+		for (const model of coveredModels(subscription, models)) {
+			const { filter } = checkEventFilter(model, subscription.options.when);
+			if (filter) filters.set(`${subscription.name}\0${model.name}`, filter);
+		}
+	}
+	const passes = (subscription, change) => {
+		const { options } = subscription;
+		if (options.enabled === false) return false;
+		if (options.tenant !== void 0 && String(options.tenant) !== String(change.tenant)) return false;
+		const filter = filters.get(`${subscription.name}\0${change.resource}`);
+		return !filter || evaluateFilter(filter, change.after ?? change.before) === true;
+	};
+	return (change, events) => subscriptions.flatMap((subscription) => {
+		if (!passes(subscription, change)) return [];
+		return events.filter((event) => subscription.options.events.some((pattern) => eventPatternMatches(pattern, event))).map((event) => ({
+			subscription,
+			event
+		}));
+	});
+};
+//#endregion
+export { subscriptionProblems, subscriptionRouter };

package/dist/webhooks/standard-webhooks.d.ts

@@ -0,0 +1,4 @@
+//#region src/webhooks/standard-webhooks.d.ts
+/** A new signing secret, `whsec_` and 32 random bytes in base64. */
+export declare const newWebhookSecret: () => string;
+//#endregion

package/dist/webhooks/standard-webhooks.js

@@ -0,0 +1,36 @@
+//#region src/webhooks/standard-webhooks.ts
+const base64 = (bytes) => btoa(String.fromCharCode(...bytes));
+const secretKey = (secret) => {
+	const text = secret.replace(/^whsec_/, "");
+	if (!/^[A-Za-z0-9+/]+={0,2}$/.test(text)) throw new Error("A webhook secret is `whsec_` and base64");
+	return Uint8Array.from(atob(text), (char) => char.charCodeAt(0));
+};
+/** A new signing secret, `whsec_` and 32 random bytes in base64. */
+const newWebhookSecret = () => `whsec_${base64(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)))}`;
+const sign = async (secret, content) => {
+	const key = await crypto.subtle.importKey("raw", secretKey(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return `v1,${base64(new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(content))))}`;
+};
+/**
+* The Standard Webhooks headers of one request (https://www.standardwebhooks.com): its id, its time in seconds and,
+* with a secret, the HMAC-SHA256 of `id.timestamp.body` as `v1,<base64>`; with several, one signature per secret,
+* separated by spaces, as during a rotation.
+*/
+const standardWebhookHeaders = async (id, timestamp, body, secret) => {
+	const headers = {
+		"webhook-id": id,
+		"webhook-timestamp": String(timestamp)
+	};
+	const secrets = secret === void 0 ? [] : [secret].flat();
+	if (secrets.length === 0) return headers;
+	const signatures = await Promise.all(secrets.map((each) => sign(each, `${id}.${timestamp}.${body}`)));
+	return {
+		...headers,
+		"webhook-signature": signatures.join(" ")
+	};
+};
+//#endregion
+export { newWebhookSecret, standardWebhookHeaders };

package/dist/webhooks/subscriber-view.js

@@ -0,0 +1,76 @@
+import { requestAccess } from "../request-access.js";
+import { checkRecord, evaluateFilter } from "@protobase/schema";
+//#region src/webhooks/subscriber-view.ts
+/**
+* The session a subscription delivers as, or `undefined` for the system: every record, every field but sensitive ones.
+* Its tenant is the change's, typed as the app's, when the subscription has one.
+*/
+const subscriberSession = ({ name, options }, change) => {
+	if (!options.as) return void 0;
+	const tenant = options.tenant === void 0 ? void 0 : change?.tenant ?? options.tenant;
+	return {
+		user: {
+			id: `subscription:${name}`,
+			roles: options.as.roles
+		},
+		...tenant !== void 0 && {
+			tenant,
+			organization: { id: tenant }
+		}
+	};
+};
+const pick = (record, fields) => fields ? Object.fromEntries(Object.entries(record).filter(([name]) => fields.includes(name))) : record;
+/** A change's event as a subscriber sees it: only `fields` of its records (all without), none at all when `thin`. */
+const subscriptionEvent = (change, event, { fields, thin = false } = {}) => ({
+	id: `evt_${change.sequence}_${event.slice(event.indexOf(".") + 1)}`,
+	type: event,
+	timestamp: change.at,
+	data: {
+		resource: change.resource,
+		operation: change.operation,
+		key: change.key,
+		sequence: change.sequence,
+		...!thin && change.after && { after: pick(change.after, fields) },
+		...!thin && change.before && { before: pick(change.before, fields) },
+		changed: fields ? change.changed.filter((name) => fields.includes(name)) : change.changed,
+		...change.tenant !== void 0 && { tenant: change.tenant },
+		actor: change.actor,
+		source: change.source,
+		transaction: change.transaction
+	}
+});
+const mayRead = async (access, record) => {
+	const { resolved, session, entry } = access;
+	if (!resolved.operations.read) return false;
+	if (resolved.rowFilter.read && evaluateFilter(resolved.rowFilter.read, record) !== true) return false;
+	if (!resolved.recordChecks.includes("read")) return true;
+	const context = {
+		user: session.user,
+		...session.organization && { organization: session.organization }
+	};
+	return checkRecord(entry.source, context, "read", record, void 0, access.deps.accessOptions);
+};
+/**
+* Builds each subscriber's event, under the access rules of the session it delivers as, resolved once per subscription
+* and resource: `undefined` when it may not read the record, after the change or before a delete.
+*/
+const subscriberEvents = (deps) => {
+	const accesses = /* @__PURE__ */ new Map();
+	return async (subscription, change, event) => {
+		const thin = subscription.options.payload === "thin";
+		const session = subscriberSession(subscription, change);
+		if (!session) return subscriptionEvent(change, event, { thin });
+		const entry = deps.registry.find(change.resource);
+		if (!entry) throw new Error(`Not implemented: a change of "${change.resource}", which is no resource of the app`);
+		const cacheKey = `${subscription.name}\0${change.resource}`;
+		if (!accesses.has(cacheKey)) accesses.set(cacheKey, requestAccess(deps, entry, session));
+		const access = await accesses.get(cacheKey);
+		if (!await mayRead(access, change.after ?? change.before)) return void 0;
+		return subscriptionEvent(change, event, {
+			fields: Object.keys(access.readable.fields),
+			thin
+		});
+	};
+};
+//#endregion
+export { subscriberEvents, subscriberSession, subscriptionEvent };