@rebasepro/server 0.23.0 → 0.24.1-canary.g56af4a4

package/dist/schema-editor-routes-BFf3i8jm.js

@@ -0,0 +1,136 @@
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import "./src-CatHFUym.js";
+import { i as isCollectionPatch, n as collectionPatchProblems } from "./collection_patch-BRu-BvDv.js";
+import { r as errorHandler, t as ApiError } from "./errors-D6_y86c5.js";
+import { AstSchemaEditor } from "./ast-schema-editor-CSdL0iCk.js";
+import { Hono } from "hono";
+import { z } from "zod";
+//#region src/schema-edit/source-editor.ts
+/**
+* The process's editor of the collection source files, one edit at a time.
+*
+* Two routers rewrite those files: the source-only editor
+* (`/api/schema-editor/*`) and live schema editing's `/apply`. Both go through
+* this one {@link AstSchemaEditor}, so the ts-morph project over the
+* collections directory is parsed once per process rather than once per
+* apply — 180–250 ms of blocked event loop at 200 collection files, on every
+* save. The editor re-reads the disk at the start of each edit
+* (`syncWithDisk`): a file changed since — by the IDE, by a commit being put
+* back — is refreshed, a new one is added, a deleted one is dropped.
+*
+* One project cannot take two edits at once. An edit holds unsaved changes in
+* memory across `await project.save()`, and a second edit arriving meanwhile
+* would refresh those files from disk under it, or save them with its own.
+* So every edit, from either router, waits in one queue for the edits before
+* it to settle — a refused one included — and anything an edit does with the
+* files it wrote (reading them back for a commit) belongs inside the same
+* {@link run}, before the next edit can touch them.
+*/
+var SchemaSourceEditor = class {
+	editor;
+	settled = Promise.resolve();
+	constructor(editor) {
+		this.editor = editor;
+	}
+	/** Run `edit` once every edit queued before it has finished. */
+	run(edit) {
+		const result = this.settled.then(() => edit(this.editor));
+		this.settled = result.then(() => void 0, () => void 0);
+		return result;
+	}
+};
+//#endregion
+//#region src/api/schema-editor-routes.ts
+/**
+* Rewriting collection source from the admin panel.
+*
+* Every refusal in `AstSchemaEditor` is written for the person who will read it
+* — "Collection X has no file at …", "Relation Y has no target collection. Pick
+* one before saving." — and every one of them was a plain `Error`, which
+* `errorHandler` treats as an unexpected failure: 500, and a body that says
+* "Internal Server Error". The messages never left the server. They are 400s
+* now, so the panel can show what it was told.
+*/
+function refusalsAsBadRequest(run) {
+	return run().catch((error) => {
+		if (error instanceof ApiError) throw error;
+		throw ApiError.badRequest(error instanceof Error ? error.message : String(error), "SCHEMA_EDIT_REFUSED");
+	});
+}
+/** The identifier half of every payload here, checked once. */
+var collectionIdSchema = z.string().min(1, "`collectionId` is required");
+var propertyKeySchema = z.string().min(1, "`propertyKey` is required");
+var propertySaveSchema = z.object({
+	collectionId: collectionIdSchema,
+	propertyKey: propertyKeySchema,
+	propertyConfig: z.record(z.string(), z.unknown())
+});
+var propertyDeleteSchema = z.object({
+	collectionId: collectionIdSchema,
+	propertyKey: propertyKeySchema
+});
+var collectionSaveSchema = z.object({
+	collectionId: collectionIdSchema,
+	collectionData: z.record(z.string(), z.unknown()).optional(),
+	/** What changed about an existing collection — see `collection_patch.ts`. */
+	patch: z.array(z.unknown()).optional(),
+	partial: z.boolean().optional()
+}).refine((save) => save.collectionData === void 0 !== (save.patch === void 0), { message: "send `patch` (what changed) or `collectionData` (a new collection), not both" });
+var collectionDeleteSchema = z.object({ collectionId: collectionIdSchema });
+/** Parse a body against a schema, or 400 naming the field. */
+async function body(c, schema) {
+	const raw = await c.req.json().catch(() => void 0);
+	const parsed = schema.safeParse(raw);
+	if (!parsed.success) throw ApiError.badRequest(parsed.error.issues.map((i) => `${i.path.join(".") || "body"}: ${i.message}`).join("; "), "INVALID_INPUT");
+	return parsed.data;
+}
+/**
+* The editor for `collectionsDir`: one per process, shared by these routes
+* and live schema editing's `/apply`. See {@link SchemaSourceEditor}.
+*
+* Here rather than beside the class because building it loads `ts-morph`, an
+* optional peer dependency this module is imported to probe for.
+*/
+function createSchemaSourceEditor(collectionsDir) {
+	return new SchemaSourceEditor(new AstSchemaEditor(collectionsDir));
+}
+function createSchemaEditorRoutes(source) {
+	const router = new Hono();
+	router.onError(errorHandler);
+	router.post("/property/save", async (c) => {
+		const { collectionId, propertyKey, propertyConfig } = await body(c, propertySaveSchema);
+		await refusalsAsBadRequest(() => source.run((editor) => editor.saveProperty(collectionId, propertyKey, propertyConfig)));
+		return c.json({ success: true });
+	});
+	router.post("/property/delete", async (c) => {
+		const { collectionId, propertyKey } = await body(c, propertyDeleteSchema);
+		await refusalsAsBadRequest(() => source.run((editor) => editor.deleteProperty(collectionId, propertyKey)));
+		return c.json({ success: true });
+	});
+	/**
+	* `partial: true` means "this payload is what changed", not "this is the
+	* collection". Without it a one-key patch — which is what adding a column
+	* posts — is read as a whole-collection save and deletes everything it does
+	* not mention, `securityRules` included. Absent, it defaults to a full save,
+	* so an older panel keeps the behaviour it was written against.
+	*/
+	router.post("/collection/save", async (c) => {
+		const { collectionId, collectionData, patch, partial } = await body(c, collectionSaveSchema);
+		if (patch !== void 0 && !isCollectionPatch(patch)) throw ApiError.badRequest(collectionPatchProblems(patch).join(" "), "INVALID_INPUT");
+		await refusalsAsBadRequest(() => source.run((editor) => patch ? editor.applyPatch(collectionId, patch) : editor.saveCollection(collectionId, collectionData ?? {}, { partial: partial === true })));
+		return c.json({ success: true });
+	});
+	router.post("/collection/delete", async (c) => {
+		const { collectionId } = await body(c, collectionDeleteSchema);
+		await refusalsAsBadRequest(() => source.run((editor) => editor.deleteCollection(collectionId)));
+		return c.json({ success: true });
+	});
+	return router;
+}
+//#endregion
+export { createSchemaEditorRoutes, createSchemaSourceEditor };
+
+//# sourceMappingURL=schema-editor-routes-BFf3i8jm.js.map

package/dist/schema-editor-routes-BFf3i8jm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-editor-routes-BFf3i8jm.js","names":[],"sources":["../src/schema-edit/source-editor.ts","../src/api/schema-editor-routes.ts"],"sourcesContent":["import type { AstSchemaEditor } from \"../api/ast-schema-editor\";\n\n/**\n * The process's editor of the collection source files, one edit at a time.\n *\n * Two routers rewrite those files: the source-only editor\n * (`/api/schema-editor/*`) and live schema editing's `/apply`. Both go through\n * this one {@link AstSchemaEditor}, so the ts-morph project over the\n * collections directory is parsed once per process rather than once per\n * apply — 180–250 ms of blocked event loop at 200 collection files, on every\n * save. The editor re-reads the disk at the start of each edit\n * (`syncWithDisk`): a file changed since — by the IDE, by a commit being put\n * back — is refreshed, a new one is added, a deleted one is dropped.\n *\n * One project cannot take two edits at once. An edit holds unsaved changes in\n * memory across `await project.save()`, and a second edit arriving meanwhile\n * would refresh those files from disk under it, or save them with its own.\n * So every edit, from either router, waits in one queue for the edits before\n * it to settle — a refused one included — and anything an edit does with the\n * files it wrote (reading them back for a commit) belongs inside the same\n * {@link run}, before the next edit can touch them.\n */\nexport class SchemaSourceEditor {\n    private settled: Promise<unknown> = Promise.resolve();\n\n    constructor(private readonly editor: AstSchemaEditor) {\n    }\n\n    /** Run `edit` once every edit queued before it has finished. */\n    run<T>(edit: (editor: AstSchemaEditor) => Promise<T>): Promise<T> {\n        const result = this.settled.then(() => edit(this.editor));\n        this.settled = result.then(() => undefined, () => undefined);\n        return result;\n    }\n}\n","import { Hono } from \"hono\";\nimport { z } from \"zod\";\nimport { collectionPatchProblems, isCollectionPatch } from \"@rebasepro/types\";\nimport { AstSchemaEditor } from \"./ast-schema-editor\";\nimport { SchemaSourceEditor } from \"../schema-edit/source-editor\";\nimport { ApiError, errorHandler } from \"./errors\";\nimport { HonoEnv } from \"./types\";\n\n/**\n * Rewriting collection source from the admin panel.\n *\n * Every refusal in `AstSchemaEditor` is written for the person who will read it\n * — \"Collection X has no file at …\", \"Relation Y has no target collection. Pick\n * one before saving.\" — and every one of them was a plain `Error`, which\n * `errorHandler` treats as an unexpected failure: 500, and a body that says\n * \"Internal Server Error\". The messages never left the server. They are 400s\n * now, so the panel can show what it was told.\n */\nfunction refusalsAsBadRequest<T>(run: () => Promise<T>): Promise<T> {\n    return run().catch((error: unknown) => {\n        if (error instanceof ApiError) throw error;\n        throw ApiError.badRequest(\n            error instanceof Error ? error.message : String(error),\n            \"SCHEMA_EDIT_REFUSED\"\n        );\n    });\n}\n\n/** The identifier half of every payload here, checked once. */\nconst collectionIdSchema = z.string().min(1, \"`collectionId` is required\");\nconst propertyKeySchema = z.string().min(1, \"`propertyKey` is required\");\n\nconst propertySaveSchema = z.object({\n    collectionId: collectionIdSchema,\n    propertyKey: propertyKeySchema,\n    propertyConfig: z.record(z.string(), z.unknown())\n});\nconst propertyDeleteSchema = z.object({\n    collectionId: collectionIdSchema,\n    propertyKey: propertyKeySchema\n});\nconst collectionSaveSchema = z.object({\n    collectionId: collectionIdSchema,\n    collectionData: z.record(z.string(), z.unknown()).optional(),\n    /** What changed about an existing collection — see `collection_patch.ts`. */\n    patch: z.array(z.unknown()).optional(),\n    partial: z.boolean().optional()\n}).refine(\n    save => (save.collectionData === undefined) !== (save.patch === undefined),\n    { message: \"send `patch` (what changed) or `collectionData` (a new collection), not both\" }\n);\nconst collectionDeleteSchema = z.object({\n    collectionId: collectionIdSchema\n});\n\n/** Parse a body against a schema, or 400 naming the field. */\nasync function body<S extends z.ZodType>(c: { req: { json: () => Promise<unknown> } }, schema: S): Promise<z.infer<S>> {\n    const raw = await c.req.json().catch(() => undefined);\n    const parsed = schema.safeParse(raw);\n    if (!parsed.success) {\n        throw ApiError.badRequest(\n            parsed.error.issues.map(i => `${i.path.join(\".\") || \"body\"}: ${i.message}`).join(\"; \"),\n            \"INVALID_INPUT\"\n        );\n    }\n    return parsed.data;\n}\n\n/**\n * The editor for `collectionsDir`: one per process, shared by these routes\n * and live schema editing's `/apply`. See {@link SchemaSourceEditor}.\n *\n * Here rather than beside the class because building it loads `ts-morph`, an\n * optional peer dependency this module is imported to probe for.\n */\nexport function createSchemaSourceEditor(collectionsDir: string): SchemaSourceEditor {\n    return new SchemaSourceEditor(new AstSchemaEditor(collectionsDir));\n}\n\nexport function createSchemaEditorRoutes(source: SchemaSourceEditor): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    router.onError(errorHandler);\n\n    router.post(\"/property/save\", async (c) => {\n        const { collectionId, propertyKey, propertyConfig } = await body(c, propertySaveSchema);\n        await refusalsAsBadRequest(() => source.run(editor => editor.saveProperty(collectionId, propertyKey, propertyConfig)));\n        return c.json({ success: true });\n    });\n\n    router.post(\"/property/delete\", async (c) => {\n        const { collectionId, propertyKey } = await body(c, propertyDeleteSchema);\n        await refusalsAsBadRequest(() => source.run(editor => editor.deleteProperty(collectionId, propertyKey)));\n        return c.json({ success: true });\n    });\n\n    /**\n     * `partial: true` means \"this payload is what changed\", not \"this is the\n     * collection\". Without it a one-key patch — which is what adding a column\n     * posts — is read as a whole-collection save and deletes everything it does\n     * not mention, `securityRules` included. Absent, it defaults to a full save,\n     * so an older panel keeps the behaviour it was written against.\n     */\n    router.post(\"/collection/save\", async (c) => {\n        const { collectionId, collectionData, patch, partial } = await body(c, collectionSaveSchema);\n        if (patch !== undefined && !isCollectionPatch(patch)) {\n            throw ApiError.badRequest(collectionPatchProblems(patch).join(\" \"), \"INVALID_INPUT\");\n        }\n        await refusalsAsBadRequest(() => source.run(editor => patch\n            ? editor.applyPatch(collectionId, patch)\n            : editor.saveCollection(collectionId, collectionData ?? {}, { partial: partial === true })));\n        return c.json({ success: true });\n    });\n\n    router.post(\"/collection/delete\", async (c) => {\n        const { collectionId } = await body(c, collectionDeleteSchema);\n        await refusalsAsBadRequest(() => source.run(editor => editor.deleteCollection(collectionId)));\n        return c.json({ success: true });\n    });\n\n    return router;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,IAAa,qBAAb,MAAgC;CAGC;CAF7B,UAAoC,QAAQ,QAAQ;CAEpD,YAAY,QAA0C;EAAzB,KAAA,SAAA;CAC7B;;CAGA,IAAO,MAA2D;EAC9D,MAAM,SAAS,KAAK,QAAQ,WAAW,KAAK,KAAK,MAAM,CAAC;EACxD,KAAK,UAAU,OAAO,WAAW,KAAA,SAAiB,KAAA,CAAS;EAC3D,OAAO;CACX;AACJ;;;;;;;;;;;;;AChBA,SAAS,qBAAwB,KAAmC;CAChE,OAAO,IAAI,CAAC,CAAC,OAAO,UAAmB;EACnC,IAAI,iBAAiB,UAAU,MAAM;EACrC,MAAM,SAAS,WACX,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACrD,qBACJ;CACJ,CAAC;AACL;;AAGA,IAAM,qBAAqB,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG,4BAA4B;AACzE,IAAM,oBAAoB,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG,2BAA2B;AAEvE,IAAM,qBAAqB,EAAE,OAAO;CAChC,cAAc;CACd,aAAa;CACb,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AACpD,CAAC;AACD,IAAM,uBAAuB,EAAE,OAAO;CAClC,cAAc;CACd,aAAa;AACjB,CAAC;AACD,IAAM,uBAAuB,EAAE,OAAO;CAClC,cAAc;CACd,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;;CAE3D,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;CACrC,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS;AAClC,CAAC,CAAC,CAAC,QACC,SAAS,KAAK,mBAAmB,KAAA,OAAgB,KAAK,UAAU,KAAA,IAChE,EAAE,SAAS,+EAA+E,CAC9F;AACA,IAAM,yBAAyB,EAAE,OAAO,EACpC,cAAc,mBAClB,CAAC;;AAGD,eAAe,KAA0B,GAA8C,QAAgC;CACnH,MAAM,MAAM,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;CACpD,MAAM,SAAS,OAAO,UAAU,GAAG;CACnC,IAAI,CAAC,OAAO,SACR,MAAM,SAAS,WACX,OAAO,MAAM,OAAO,KAAI,MAAK,GAAG,EAAE,KAAK,KAAK,GAAG,KAAK,OAAO,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,IAAI,GACrF,eACJ;CAEJ,OAAO,OAAO;AAClB;;;;;;;;AASA,SAAgB,yBAAyB,gBAA4C;CACjF,OAAO,IAAI,mBAAmB,IAAI,gBAAgB,cAAc,CAAC;AACrE;AAEA,SAAgB,yBAAyB,QAA2C;CAChF,MAAM,SAAS,IAAI,KAAc;CACjC,OAAO,QAAQ,YAAY;CAE3B,OAAO,KAAK,kBAAkB,OAAO,MAAM;EACvC,MAAM,EAAE,cAAc,aAAa,mBAAmB,MAAM,KAAK,GAAG,kBAAkB;EACtF,MAAM,2BAA2B,OAAO,KAAI,WAAU,OAAO,aAAa,cAAc,aAAa,cAAc,CAAC,CAAC;EACrH,OAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;CACnC,CAAC;CAED,OAAO,KAAK,oBAAoB,OAAO,MAAM;EACzC,MAAM,EAAE,cAAc,gBAAgB,MAAM,KAAK,GAAG,oBAAoB;EACxE,MAAM,2BAA2B,OAAO,KAAI,WAAU,OAAO,eAAe,cAAc,WAAW,CAAC,CAAC;EACvG,OAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;CACnC,CAAC;;;;;;;;CASD,OAAO,KAAK,oBAAoB,OAAO,MAAM;EACzC,MAAM,EAAE,cAAc,gBAAgB,OAAO,YAAY,MAAM,KAAK,GAAG,oBAAoB;EAC3F,IAAI,UAAU,KAAA,KAAa,CAAC,kBAAkB,KAAK,GAC/C,MAAM,SAAS,WAAW,wBAAwB,KAAK,CAAC,CAAC,KAAK,GAAG,GAAG,eAAe;EAEvF,MAAM,2BAA2B,OAAO,KAAI,WAAU,QAChD,OAAO,WAAW,cAAc,KAAK,IACrC,OAAO,eAAe,cAAc,kBAAkB,CAAC,GAAG,EAAE,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC;EAC/F,OAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;CACnC,CAAC;CAED,OAAO,KAAK,sBAAsB,OAAO,MAAM;EAC3C,MAAM,EAAE,iBAAiB,MAAM,KAAK,GAAG,sBAAsB;EAC7D,MAAM,2BAA2B,OAAO,KAAI,WAAU,OAAO,iBAAiB,YAAY,CAAC,CAAC;EAC5F,OAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;CACnC,CAAC;CAED,OAAO;AACX"}

package/dist/serve-spa.d.ts

@@ -53,7 +53,65 @@ export interface ServeSPAConfig {
      * generator emitted a real file per route.
      */
     spa?: boolean;
+    /**
+     * Whether this app answers a request under `basePath` at all (default:
+     * every one).
+     *
+     * For apps told apart by hostname as well as by path, which `excludePaths`
+     * cannot express: two apps can both be rooted at "/", one on
+     * `admin.example.com` and one on every other hostname, and no list of paths
+     * says which of them a request belongs to. The caller, which sees every
+     * app, decides; each mount asks. A request this returns `false` for passes
+     * through everything the mount registers — assets, caching, compression and
+     * the fallback alike — as if the mount were not there, because an app that
+     * declined the fallback but still served its files would answer the other
+     * app's hostname with its own `/assets/*`.
+     */
+    owns?: (request: StaticAppRequest) => boolean;
+}
+/** What {@link ServeSPAConfig.owns} is asked about. */
+export interface StaticAppRequest {
+    /**
+     * The `Host` the request named, exactly as sent: any case, and possibly
+     * with a port or a trailing dot. The request URL's host when the header is
+     * absent, as it is on a request built in-process.
+     *
+     * Never `X-Forwarded-Host`. The proxy in front of the runtime passes the
+     * original `Host` through, and a forwarded header is one any client can
+     * write — reading it would let a request for the site choose the admin.
+     */
+    host: string;
+    /** The request path, as routed. */
+    path: string;
 }
+/**
+ * Is `requestPath` the path `prefix`, or something beneath it?
+ *
+ * Segment-aware on purpose. A plain `startsWith` reads "/api" as excluding
+ * "/apidocs", and "/admin" as excluding "/administrators" — both ordinary
+ * client-side routes of the app rooted at "/", both then answered with a 404
+ * because the SPA fallback declined them and nothing else claims the path.
+ * `apiBasePath` is always in the exclusion list, so this reached single-app
+ * setups too, not just the multi-app ones the list was added for.
+ *
+ * Exported because deciding which app owns a request asks the same question of
+ * each app's own path, and two readings of "under" would disagree at exactly
+ * the boundary this exists for.
+ */
+export declare function isUnderPath(requestPath: string, prefix: string): boolean;
+/**
+ * The paths of the apps nested inside the one at `basePath` — what its SPA
+ * fallback must leave to them, as `excludePaths`.
+ *
+ * Only those beneath it. Every other app's path used to be excluded, ancestors
+ * included, and an app at `/admin/beta` beside one at `/admin` then declined
+ * every deep link it had: each is under "/admin". The enclosing app declined
+ * them too, as it should, and a URL two apps were mounted for answered 404. An
+ * ancestor's path can never be right here — anything that reaches this app's
+ * fallback is under it — and an unrelated app's path can never match, so the
+ * apps beneath are the whole list.
+ */
+export declare function nestedAppPaths(basePath: string, otherPaths: readonly string[]): string[];
 /**
  * Serve a Single Page Application from an Hono app.
  *

package/dist/services/outbound-post.d.ts

@@ -0,0 +1,50 @@
+import { type AddressJudge, type OutboundUrlGuardOptions } from "./outbound-url-guard.js";
+/**
+ * How the webhook dispatcher sends a POST to a destination that came from data.
+ *
+ * On Node, through an http(s) Agent whose `lookup` is the destination guard's
+ * ({@link guardedLookup}): the name is resolved once per new connection, every
+ * address it answers with is judged, and the socket connects to an address
+ * that was. It used to be validate-then-fetch — a `dns.lookup` per delivery
+ * attempt on the libuv threadpool, and then a second resolution inside `fetch`
+ * that the guard never saw, so a TTL-0 name that flipped between the two
+ * could still land on a blocked address. Keep-alive connections are reused, so
+ * a steady stream of deliveries to one receiver resolves its name about once.
+ *
+ * With `allowPrivateNetworks` there is nothing to judge, and on a runtime
+ * without `node:http` there is no Agent to hand a resolver to: both send with
+ * `fetch`, after {@link assertAllowedOutboundUrl}, as before.
+ *
+ * Internal to the server.
+ */
+/** What the dispatcher reads of a response, from either transport. */
+export interface OutboundResponse {
+    status: number;
+    header(name: string): string | null;
+    /** The body as a stream, so a reader can stop at a cap and cancel the rest. */
+    body: ReadableStream<Uint8Array> | null;
+    text(): Promise<string>;
+}
+export interface OutboundPostInit {
+    headers: Record<string, string>;
+    body: string;
+    /** Aborts the request — and the response body, while it is being read. */
+    signal: AbortSignal;
+}
+/**
+ * POST `body` to `rawUrl`, never following a redirect: a redirect would send
+ * the POST — signature and all — somewhere the guard never judged.
+ *
+ * @throws BlockedUrlError when the guard refuses the destination.
+ */
+export type OutboundPost = (rawUrl: string, init: OutboundPostInit) => Promise<OutboundResponse>;
+export declare function createOutboundPost(options?: OutboundUrlGuardOptions): OutboundPost;
+/** Validate-then-fetch: the path for `allowPrivateNetworks`, and for a runtime without `node:http`. */
+export declare function createFetchPost(options?: OutboundUrlGuardOptions): OutboundPost;
+/**
+ * The guarded Node transport, or `undefined` on a runtime without
+ * `node:http`. Loaded on use, like the guard's own resolver, so that this
+ * module imports on a runtime that has neither. `judge` is for tests that
+ * need a receiver on loopback.
+ */
+export declare function createNodePost(options?: OutboundUrlGuardOptions, judge?: AddressJudge): Promise<OutboundPost | undefined>;

package/dist/services/outbound-url-guard.d.ts

@@ -1,3 +1,4 @@
+import type { LookupFunction } from "node:net";
 /**
  * Refusal to send a request to a destination the guard does not allow.
  *
@@ -29,6 +30,8 @@ export interface OutboundUrlGuardOptions {
  * outbound call whose destination comes from data.
  */
 export declare function blockedAddressReason(address: string): string | null;
+/** Why an address may not be connected to, or `null`: {@link blockedAddressReason}. */
+export type AddressJudge = (address: string) => string | null;
 /**
  * Resolve and validate a destination before anything connects to it.
  *
@@ -40,14 +43,40 @@ export declare function blockedAddressReason(address: string): string | null;
  * Known limit: this is validate-then-fetch. Between the lookup here and the
  * connection the runtime makes there is a second resolution this code does not
  * see, so a TTL-0 name that flips between answers can still land on a blocked
- * address. Closing that needs the socket pinned to the address checked here,
- * which Node's global `fetch` does not expose without an undici dispatcher.
- * The redirect policy in {@link WebhookDispatcher} closes the much wider
- * version of the same hole — a receiver that simply *points* at the internal
- * address.
+ * address. On Node the webhook dispatcher does not use this: it checks the
+ * address it connects to, through {@link guardedLookup}. This is the check for
+ * a runtime whose `fetch` cannot be handed a resolver.
  *
  * @throws BlockedUrlError when the destination is not allowed. DNS failures
  * are rethrown as they are, so callers can tell "never send this" from
  * "could not send this right now".
  */
 export declare function assertAllowedOutboundUrl(rawUrl: string, options?: OutboundUrlGuardOptions): Promise<URL>;
+/**
+ * Every check of {@link assertAllowedOutboundUrl} but the lookup, for a
+ * connection that resolves the name through {@link guardedLookup}. The scheme,
+ * the internal names and an address written into the URL are judged here —
+ * a connection to a literal address asks no resolver, so nothing else would.
+ *
+ * Internal to the server: not exported from the package.
+ */
+export declare function assertAllowedBeforeConnecting(rawUrl: string, options?: OutboundUrlGuardOptions): URL;
+/**
+ * A `dns.lookup` for an http(s) Agent that refuses to connect anywhere the
+ * guard would not send: it resolves the name, judges *every* address it got,
+ * and hands the connection only addresses it judged — so the address checked
+ * is the address connected to. Validate-then-fetch resolves twice, and a
+ * name whose TTL-0 record flips between the two lookups lands on whatever the
+ * second one says.
+ *
+ * Called once per new connection, not per request: a keep-alive connection
+ * is to an address already judged. Nothing is cached — an "allowed" verdict
+ * that outlived its lookup would be the rebinding window again.
+ *
+ * Fails with {@link BlockedUrlError}, which the connection reports as its
+ * error; a resolver failure is reported as itself.
+ *
+ * Internal to the server: not exported from the package. `judge` is for the
+ * tests that need a receiver on loopback; nothing else passes one.
+ */
+export declare function guardedLookup(options?: OutboundUrlGuardOptions, judge?: AddressJudge): LookupFunction;

package/dist/services/routed-realtime-service.d.ts

@@ -15,6 +15,22 @@ interface ClientMessage {
 export interface WsRealtimeService extends RealtimeProvider {
     addClient(clientId: string, ws: unknown): void;
     handleClientMessage(clientId: string, message: ClientMessage, authContext?: unknown): Promise<void> | void;
+    /**
+     * Re-judge everything a socket holds open as the identity it signed in
+     * as — called on every `AUTHENTICATE`, a token refresh included.
+     *
+     * Required, because the socket calls it. It was added to the Postgres
+     * service and the socket and not here, the bootstrapper cast the composite
+     * to the service, and every sign-in on a multi-source project answered
+     * INTERNAL_ERROR. `routed-realtime-service-forwarding.test.ts` reads this
+     * interface and the socket's calls so it cannot happen twice.
+     */
+    rescopeClient(clientId: string, authContext: unknown): Promise<void>;
+    /**
+     * What the client opted into when it opened the socket (`?rebase_caps=`).
+     * Optional: a provider that sends nothing depending on one ignores them.
+     */
+    setClientOptIns?(clientId: string, optIns: ReadonlySet<string>): void;
     /**
      * Whether this provider actually implements channels, presence and
      * broadcast. Declared by the provider rather than inferred, because the

package/dist/services/webhook-service.d.ts

@@ -23,6 +23,11 @@ export interface WebhookDeliveryResult {
     statusCode: number;
     responseBody: string;
     success: boolean;
+    /**
+     * The attempt this result is from, counting from 1. `0` for a delivery
+     * refused before any attempt: an in-process queue that was full, with
+     * `statusCode: 0` and `responseBody: "queue full"`.
+     */
     attemptNumber: number;
 }
 export interface WebhookDispatcherOptions {
@@ -48,7 +53,8 @@ export interface WebhookDispatcherOptions {
      */
     onDelivery?: (result: WebhookDeliveryResult) => void;
     /**
-     * Hostname resolver used by the destination guard. Defaults to
+     * Hostname resolver used by the destination guard — once per new
+     * connection, and its answer is where the connection goes. Defaults to
      * `dns.lookup`; injected by tests so a unit suite never asks a resolver.
      */
     lookup?: (hostname: string) => Promise<string[]>;
@@ -61,27 +67,48 @@ export interface WebhookDispatcherOptions {
      */
     jobQueue?: JobQueueClient;
 }
+/**
+ * What a delivery queued as a job carries: the webhook's id — never its
+ * secret — and the delivery id every attempt sends, so a receiver can
+ * deduplicate the queue's at-least-once retries. Rows queued before the id was
+ * stored have none; the job's own id stands in for it.
+ */
+export interface QueuedWebhookDelivery {
+    webhookId: string;
+    event: string;
+    payload: Record<string, unknown>;
+    deliveryId?: string;
+}
 export declare class WebhookDispatcher {
     private webhooks;
+    /** Attempts per in-process delivery, the first included. */
     private maxRetries;
+    /**
+     * The wait before each attempt after the first: 1 s before the second, 5 s
+     * before the third. One per retry — a third entry here was never reached.
+     */
     private retryDelays;
     private readonly options;
     private readonly timeoutMs;
-    private queue;
-    private draining;
+    /** In-process deliveries, one lane per webhook id. A lane is removed when it empties. */
+    private lanes;
+    /** Sends one attempt, through the destination guard — see `outbound-post.ts`. */
+    private readonly post;
     constructor(options?: WebhookDispatcherOptions);
     /** Register webhooks to watch */
     setWebhooks(webhooks: WebhookConfig[]): void;
     /**
      * Called when a entity changes — checks if any webhook matches, and awaits
-     * every delivery, retries included.
+     * every delivery, retries included. The matching webhooks are delivered to
+     * at the same time, so the wait is the slowest receiver's, not the sum of
+     * all of them; the results come back in webhook order either way.
      *
      * **Do not await this inside a collection callback.** `afterSave` and
      * `afterDelete` run inside the write's Postgres transaction, so awaiting a
      * delivery here holds a pooled connection and the row's locks for as long
-     * as the receiver takes to answer — up to ~36s across three attempts, per
-     * matching webhook. Use {@link enqueueEntityChange} there; this method is
-     * for a custom function or a job that wants the results.
+     * as the slowest receiver takes to answer — up to ~36s across three
+     * attempts. Use {@link enqueueEntityChange} there; this method is for a
+     * custom function or a job that wants the results.
      */
     onEntityChange(table: string, event: "INSERT" | "UPDATE" | "DELETE", id: string, entity: Record<string, unknown> | null, previousEntity?: Record<string, unknown> | null): Promise<WebhookDeliveryResult[]>;
     /**
@@ -108,6 +135,20 @@ export declare class WebhookDispatcher {
      */
     enqueueEntityChange(table: string, event: "INSERT" | "UPDATE" | "DELETE", id: string, entity: Record<string, unknown> | null, previousEntity?: Record<string, unknown> | null): void;
     private dispatchDeliveries;
+    /**
+     * Append each delivery to its webhook's lane, starting the lane if it is
+     * idle. Deliveries to one webhook keep their order; deliveries to
+     * different webhooks no longer wait for each other — one serial queue for
+     * every webhook meant a receiver that refused connections held every
+     * other receiver six seconds per queued event.
+     */
+    private enqueueInProcess;
+    /**
+     * Turn a delivery away from a full lane, and say so: through `onDelivery`
+     * for each one — the hook a caller of {@link enqueueEntityChange} already
+     * watches for failures — and in the server log once per burst.
+     */
+    private refuse;
     /**
      * Deliver one queued job, as the worker runs it.
      *
@@ -116,22 +157,33 @@ export declare class WebhookDispatcher {
      * of three job attempts is nine deliveries and about two minutes of holding
      * a worker slot — and only the queue's retries survive a restart, which is
      * the whole reason for moving.
+     *
+     * Pass the job context as the second argument —
+     * `ctx => dispatcher.deliverQueuedJob(ctx.payload, ctx)` — so each attempt
+     * sends its real `X-Webhook-Attempt`, and a row queued without a delivery
+     * id still sends the same `X-Webhook-Delivery` on every retry (the job's
+     * id). Without it, every attempt says it is the first.
      */
-    deliverQueuedJob(job: {
-        webhookId: string;
-        event: string;
-        payload: Record<string, unknown>;
+    deliverQueuedJob(job: QueuedWebhookDelivery, context?: {
+        id?: string;
+        attempt?: number;
     }): Promise<void>;
     /**
      * Wait for every queued delivery to finish. For graceful shutdown, and for
      * tests that need to observe what {@link enqueueEntityChange} sent.
      *
+     * `timeoutMs` bounds the wait: a receiver that is down costs each of its
+     * queued deliveries up to ~36 seconds of retries, which a shutdown cannot
+     * always afford. Resolves `true` when everything finished, `false` when
+     * the budget ran out first — those deliveries carry on in the background
+     * for as long as the process does. Without it, waits however long the
+     * deliveries take.
+     *
      * In-process deliveries only — with a `jobQueue` configured there is
      * nothing here to wait for, because the deliveries are rows.
      */
-    flush(): Promise<void>;
-    private startDraining;
-    private drainQueue;
+    flush(timeoutMs?: number): Promise<boolean>;
+    private drainLane;
     /** The payload each matching webhook gets for this change. */
     private buildDeliveries;
     private deliverWithRetry;