@protobase/server 0.67.5 → 0.67.7

package/dist/better-auth/authenticator.js

@@ -47,11 +47,18 @@ const betterAuthAuthenticator = (options) => {
 		const verify = async (request) => {
 			const { payload, session } = await sessions(request);
 			if (!auth) return session;
-			const signIn = await standing(await auth.$context, payload, session);
-			return signIn ? {
+			const { signIn, organizationRole } = await standing(await auth.$context, payload, session);
+			const withRole = organizationRole && session.tenant !== void 0 ? {
 				...session,
-				signIn
+				organization: {
+					id: session.tenant,
+					role: organizationRole
+				}
 			} : session;
+			return signIn ? {
+				...withRole,
+				signIn
+			} : withRole;
 		};
 		if (!organizations) return verify;
 		return async (request) => {
@@ -65,7 +72,10 @@ const betterAuthAuthenticator = (options) => {
 			return {
 				...session,
 				user,
-				...session.tenant !== void 0 && { organization: { id: session.tenant } },
+				...session.tenant !== void 0 && { organization: {
+					id: session.tenant,
+					...session.organization?.role && { role: session.organization.role }
+				} },
 				...across
 			};
 		};
@@ -81,7 +91,8 @@ const betterAuthAuthenticator = (options) => {
 			issuedAt: payload.iat
 		});
 		const { sessionId: _, ...claims } = tokenClaims(payload, session.user.roles, organizations ? session.tenant : void 0);
-		await checkUserStanding(context, claims, organizations);
+		const organizationRole = await checkUserStanding(context, claims, organizations);
+		return organizationRole ? { organizationRole } : {};
 	};
 	return Object.assign(withTrustedApps(own, issuer, options.apps ?? []), { forAudience: (audience) => sessionOf({
 		audience,

package/dist/better-auth/token-standing.js

@@ -2,7 +2,7 @@ import { unauthorized } from "../problem.js";
 import { noGlobalRole } from "./organizations/role-definitions.js";
 import { parseRoles } from "./parse-roles.js";
 import { effectiveRoles, globalRoles } from "./organizations/app-roles.js";
-import { findMember, findOrganization } from "./organizations/store.js";
+import { findMember, findOrganization, organizationRoleOf } from "./organizations/store.js";
 import { isStaffSession } from "./staff-checks.js";
 import { strongSignInAt } from "./strong-sign-ins.js";
 //#region src/better-auth/token-standing.ts
@@ -23,20 +23,24 @@ const tokenClaims = (payload, roles, tenant) => ({
 const revoked = () => unauthorized("The bearer token was revoked: get a new one");
 const bannedNow = (user, now) => Boolean(user.banned) && (!user.banExpires || user.banExpires > now);
 const heldWhere = async ({ adapter }, user, organizations, organizationId) => {
-	if (!organizations) return parseRoles(user.role);
+	if (!organizations) return { roles: parseRoles(user.role) };
 	const global = globalRoles(user.role);
-	if (!organizationId) return global;
+	if (!organizationId) return { roles: global };
 	const member = await findMember(adapter, {
 		organizationId,
 		userId: user.id
 	});
-	if (member) return effectiveRoles(global, member.appRoles);
-	return global.length > 0 && await findOrganization(adapter, organizationId) !== null ? global : void 0;
+	if (member) return {
+		roles: effectiveRoles(global, member.appRoles),
+		organizationRole: organizationRoleOf(member)
+	};
+	return global.length > 0 && await findOrganization(adapter, organizationId) !== null ? { roles: global } : void 0;
 };
 /**
 * Whether a token's user still stands, read from the store: they exist and are not banned, and each role the token
 * carries is one they still hold where it works. The part of `checkTokenStanding` an MCP access token gets, whose
-* grant outlives the browser session that made it.
+* grant outlives the browser session that made it. Answers their organization role where the token works, as the
+* store holds it now, `undefined` for someone who is no member there.
 */
 const checkUserStanding = async (context, claims, organizations, now = /* @__PURE__ */ new Date()) => {
 	const user = await context.adapter.findOne({
@@ -48,14 +52,16 @@ const checkUserStanding = async (context, claims, organizations, now = /* @__PUR
 	});
 	if (!user || bannedNow(user, now)) throw revoked();
 	const held = await heldWhere(context, user, organizations, claims.organizationId);
-	if (!held || claims.roles.some((role) => !held.includes(role))) throw revoked();
+	if (!held || claims.roles.some((role) => !held.roles.includes(role))) throw revoked();
+	return held.organizationRole;
 };
 /**
 * Whether a token still stands, read from the store on every request: its session is not signed out or expired, and
 * its user still stands (`checkUserStanding`). A token that fails is a 401, so the client asks its session for a new
 * one, which carries the roles as they are now or is refused. Answers the sign-in the token's session stands for
 * (`signInOf`), `undefined` for a token without one; the user's own one also reads, when asked, when it last proved a
-* passkey or a second step (`strongSignInAt`).
+* passkey or a second step (`strongSignInAt`). Answers it with the user's organization role where the token works
+* (`checkUserStanding`).
 */
 const checkTokenStanding = async (context, claims, organizations, now = /* @__PURE__ */ new Date()) => {
 	const session = claims.sessionId === void 0 ? void 0 : await context.adapter.findOne({
@@ -66,12 +72,18 @@ const checkTokenStanding = async (context, claims, organizations, now = /* @__PU
 		}]
 	});
 	if (claims.sessionId !== void 0 && (!session || session.userId !== claims.userId || session.expiresAt <= now)) throw revoked();
-	await checkUserStanding(context, claims, organizations, now);
+	const organizationRole = await checkUserStanding(context, claims, organizations, now);
 	const signIn = session ? signInOf(session, claims.sessionId) : void 0;
-	if (!signIn || signIn.staff) return signIn;
+	if (!signIn || signIn.staff) return {
+		signIn,
+		...organizationRole && { organizationRole }
+	};
 	return {
-		...signIn,
-		strongAt: () => strongSignInAt(context.internalAdapter, claims.sessionId)
+		signIn: {
+			...signIn,
+			strongAt: () => strongSignInAt(context.internalAdapter, claims.sessionId)
+		},
+		...organizationRole && { organizationRole }
 	};
 };
 //#endregion

package/dist/create-admin.d.ts

@@ -27,8 +27,13 @@ import { UpgradeWebSocket } from "hono/ws";
 export type CreateAdminInput = {
   resources: ResourceSource[];
   views?: ViewSource[];
-  /** The tables users add, from their definitions (`userTableResources`): one a resource here or a built-in names is left out with a warning. */
-  userTables?: UserTableSources;
+  /**
+   * The tables users add, from their definitions (`userTableResources`): one a resource here or a built-in names is left
+   * out with a warning. `organizations`, by default whether `auth` has them, keeps each definition in its organization.
+   */
+  userTables?: UserTableSources & {
+    organizations?: boolean;
+  };
   /** The `userMenu(...)` export of the config module: pages under the signed-in user in the sidebar. */
   userMenu?: UserMenuSource;
   /** The `bottomBar(...)` exports of the config module, in order: tabs on phones for the roles each names. */

package/dist/create-admin.js

@@ -138,7 +138,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 		notifications: notifications !== void 0,
 		...events && { events }
 	});
-	const served = adminUserTables(userTables, [...appModels, ...builtIn.resources.map((resource) => resource.toModel())].map((model) => model.name), options.roles !== void 0);
+	const served = adminUserTables(userTables, [...appModels, ...builtIn.resources.map((resource) => resource.toModel())].map((model) => model.name), options.roles !== void 0, userTables?.organizations ?? Boolean(auth?.organizations));
 	for (const warning of served.warnings) console.warn(warning);
 	const resources = [
 		...appResources,

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.67.5";
+var version = "0.67.7";
 //#endregion
 export { version };

package/dist/types.d.ts

@@ -11,9 +11,13 @@ export type User = {
   id: string | number;
   roles: string[];
 };
-/** The organization a request works in, with organizations on: the same value as `tenant`. */
+/**
+ * The organization a request works in, with organizations on: the same value as `tenant`, and the caller's organization
+ * role there, read from the store for this request; absent for someone who is no member there.
+ */
 export type SessionOrganization = {
   id: TenantValue;
+  role?: 'owner' | 'admin' | 'member';
 };
 /** A tenant the person is a member of, with the roles they act with there. */
 export type Membership = {

package/dist/user-tables/admin-user-tables.js

@@ -5,9 +5,10 @@ import { servedUserTables } from "./served-user-tables.js";
 /**
 * What the tables users add bring to the admin, with `userTables` on: the resources over their definitions, through
 * which they are created, each user table a name in code (`codeNames`, the app's and Protobase's) does not take, and the
-* hook that creates their tables and columns. Without `tables`, nothing.
+* hook that creates their tables and columns. Without `tables`, nothing. With `organizations`, each definition belongs
+* to the organization it was made in (`definitionsResources`).
 */
-const adminUserTables = (tables, codeNames, roles) => {
+const adminUserTables = (tables, codeNames, roles, organizations = false) => {
 	if (!tables) return {
 		resources: [],
 		views: [],
@@ -16,7 +17,8 @@ const adminUserTables = (tables, codeNames, roles) => {
 	};
 	const definitions = definitionsResources({
 		roles,
-		taken: codeNames
+		taken: codeNames,
+		organizations
 	});
 	const served = servedUserTables(tables, [
 		...codeNames,

package/dist/user-tables/check-definition.js

@@ -1,10 +1,10 @@
-import { definitionColumnTypes, definitionFieldTypes, isUserTableName, userTablesSchema } from "./names.js";
+import { definitionColumnTypes, definitionFieldTypes, isUserTableName, organizationColumn, userTablesSchema } from "./names.js";
 //#region src/user-tables/check-definition.ts
 const reservedFields = ["id", "etag"];
 const isFieldType = (type) => definitionFieldTypes.includes(type);
-const fieldProblem = (field, columns) => {
+const fieldProblem = (field, columns, organization) => {
 	if (!isUserTableName(field.name)) return `the field name ${JSON.stringify(field.name)} is not lowercase letters, digits and "_", starting with a letter, at most 63 bytes`;
-	if (reservedFields.includes(field.name)) return `the field name "${field.name}" is reserved`;
+	if (reservedFields.includes(field.name) || organization && field.name === "organization_id") return `the field name "${field.name}" is reserved`;
 	if (!isFieldType(field.type)) return `the field "${field.name}" has the type ${JSON.stringify(field.type)}, which is not one of ${definitionFieldTypes.join(", ")}`;
 	if (field.type === "decimal" && (field.precision === null || field.scale === null)) return `the decimal field "${field.name}" has no precision and scale`;
 	const column = columns.get(field.name);
@@ -15,7 +15,8 @@ const fieldProblem = (field, columns) => {
 /**
 * The definition checked against the user tables schema, or the first thing wrong with it: every name a safe
 * identifier, every type one of the eight, its table there with an `id bigint` primary key and a column of the right
-* type for each field, and its title a text field of it.
+* type for each field, and its title a text field of it. An organization's table also has its `organization_id text
+* not null` column, which `.tenant` scopes its records by.
 */
 const checkDefinition = (definition, tables) => {
 	const problem = (text) => ({ problem: `The user table ${JSON.stringify(definition.name)} is not served: ${text}.` });
@@ -24,11 +25,14 @@ const checkDefinition = (definition, tables) => {
 	if (!columns) return problem(`the table ${userTablesSchema}.${definition.name} does not exist`);
 	const id = columns.get("id");
 	if (!id || id.type !== "bigint" || !id.key) return problem(`${userTablesSchema}.${definition.name} has no "id" bigint primary key`);
+	const organization = definition.organization_id !== null;
+	const tenant = columns.get(organizationColumn);
+	if (organization && (!tenant || tenant.type !== "text" || !tenant.notNull)) return problem(`${userTablesSchema}.${definition.name} has no "${organizationColumn}" text NOT NULL column for its organization`);
 	const seen = /* @__PURE__ */ new Set();
 	for (const field of definition.fields) {
 		if (seen.has(field.name)) return problem(`the field "${field.name}" is defined twice`);
 		seen.add(field.name);
-		const found = fieldProblem(field, columns);
+		const found = fieldProblem(field, columns, organization);
 		if (found) return problem(found);
 	}
 	const title = definition.fields.find((field) => field.name === definition.title_field);

package/dist/user-tables/definition-resource.d.ts

@@ -6,6 +6,7 @@ export declare const maxTextLength = 500;
 /**
  * The resource and view of a checked definition over `user_tables.<name>`, with the indexes its table has (none before
  * they are read): built with the schema builders, so it is checked, accessed and guarded as a resource of the config.
+ * An organization's table is a `.tenant` resource over its `organization_id`.
  */
 export declare const definitionResource: (definition: CheckedDefinition, indexes?: TableIndexes) => {
   resource: import("@protobase/schema").ResourceBuilder<any, import("@protobase/schema").Ref<string, unknown>>;

package/dist/user-tables/definition-resource.js

@@ -1,4 +1,5 @@
-import { userTablesSchema } from "./names.js";
+import { organizationColumn, userTablesSchema } from "./names.js";
+import { organizationAdminsOf } from "./organization-access.js";
 import { f, resource, view } from "@protobase/schema";
 import { indexServes } from "@protobase/query";
 //#region src/user-tables/definition-resource.ts
@@ -31,6 +32,7 @@ const fieldOf = (field, indexes) => {
 /**
 * The resource and view of a checked definition over `user_tables.<name>`, with the indexes its table has (none before
 * they are read): built with the schema builders, so it is checked, accessed and guarded as a resource of the config.
+* An organization's table is a `.tenant` resource over its `organization_id`.
 */
 const definitionResource = (definition, indexes = {
 	kind: "table",
@@ -38,15 +40,22 @@ const definitionResource = (definition, indexes = {
 }) => {
 	const key = f.bigint().readOnly().dbDefault();
 	const keyed = served(indexes, "id", "btree") ? key.filterable().sortable() : key;
-	const fields = Object.fromEntries([["id", keyed], ...definition.fields.map((field) => [field.name, fieldOf(field, indexes)])]);
+	const organization = definition.organization_id === null ? [] : [[organizationColumn, f.text()]];
+	const fields = Object.fromEntries([
+		["id", keyed],
+		...organization,
+		...definition.fields.map((field) => [field.name, fieldOf(field, indexes)])
+	]);
 	const title = definition.fields.find((field) => field.name === definition.title_field);
-	const base = resource(definition.name).table(`${userTablesSchema}.${definition.name}`).fields(fields).primaryKey((r) => r.id).explicitGrants().access({
-		list: admins,
-		read: admins,
-		create: admins,
-		update: admins,
-		delete: admins
+	const who = definition.organization_id === null ? admins : organizationAdminsOf(definition.organization_id);
+	const accessed = resource(definition.name).table(`${userTablesSchema}.${definition.name}`).fields(fields).primaryKey((r) => r.id).explicitGrants().access({
+		list: who,
+		read: who,
+		create: who,
+		update: who,
+		delete: who
 	});
+	const base = definition.organization_id === null ? accessed : accessed.tenant((r) => r[organizationColumn]);
 	const searchable = title && served(indexes, title.name, "trigram") ? base.search((r) => [r[title.name]]) : base;
 	const labelled = view(definition.name).names({
 		singular: definition.singular_label,

package/dist/user-tables/definitions-hook.js

@@ -4,7 +4,7 @@ import { checkDefinition } from "./check-definition.js";
 import { definitionResource } from "./definition-resource.js";
 import "./definitions-resources.js";
 import { readDefinitions, readUserTableColumns } from "./read-definitions.js";
-import { createTableSql, fieldSql, trigramIndexSql } from "./table-ddl.js";
+import { createOrganizationTableSql, createTableSql, fieldSql, trigramIndexSql } from "./table-ddl.js";
 import { indexServes, tableIndexes } from "@protobase/query";
 import { sql } from "kysely";
 //#region src/user-tables/definitions-hook.ts
@@ -15,8 +15,9 @@ const refuse = (field, message) => badRequest("invalid-record", `The request bod
 }] });
 const tablesTable = sql.table(`${definitionsSchema}.tables`);
 const raiseVersion = (trx, tableId) => sql`update ${tablesTable} set version = version + 1 where id = ${tableId}`.execute(trx);
-const lockedTable = async (trx, tableId) => {
-	const { rows } = await sql`select name, title_field from ${tablesTable} where id = ${tableId} for update`.execute(trx);
+const lockedTable = async (trx, tableId, organizationId) => {
+	const { rows } = await sql`select table_name as name from ${tablesTable} where id = ${tableId} and tenant_key = coalesce(${organizationId ?? null}::text, '-') for update`.execute(trx);
+	if (!rows[0]) throw refuse("table_id", "There is no such table");
 	return rows[0];
 };
 const builtDefinition = async (trx, tableId) => {
@@ -33,13 +34,14 @@ const builtDefinition = async (trx, tableId) => {
 };
 const createTable = async (trx, table) => {
 	if (table.title_field != null) throw refuse("title_field", "Set the title field once its field is added");
-	const { rows } = await sql`select to_regclass(format('%I.%I', ${userTablesSchema}::text, ${table.name}::text)) is not null as found`.execute(trx);
-	if (rows[0].found) throw refuse("name", `The database already has a table "${table.name}" for the tables users add`);
-	await createTableSql(table.name).execute(trx);
+	const { rows } = await sql`select to_regclass(format('%I.%I', ${userTablesSchema}::text, ${table.table_name}::text)) is not null as found`.execute(trx);
+	if (rows[0].found) throw refuse("name", `The database already has a table "${table.table_name}" for the tables users add`);
+	const statements = table.organization_id == null ? [createTableSql(table.table_name)] : createOrganizationTableSql(table.table_name);
+	for (const statement of statements) await statement.execute(trx);
 	await builtDefinition(trx, table.id);
 };
 const addField = async (trx, field, taken) => {
-	const table = await lockedTable(trx, field.table_id);
+	const table = await lockedTable(trx, field.table_id, field.organization_id);
 	if (taken.includes(table.name)) throw refuse("table_id", `"${table.name}" is a resource in the app's code now, which owns its fields`);
 	const { rows } = await sql`select exists (select from pg_attribute a join pg_class c on c.oid = a.attrelid join pg_namespace n on n.oid = c.relnamespace
     where n.nspname = ${userTablesSchema} and c.relname = ${table.name} and a.attname = ${field.name} and a.attnum > 0 and not a.attisdropped) as found`.execute(trx);

package/dist/user-tables/definitions-resources.js

@@ -1,4 +1,5 @@
-import { definitionFieldTypes, definitionsSchema, nameProblem } from "./names.js";
+import { definitionFieldTypes, definitionsSchema, nameProblem, organizationColumn } from "./names.js";
+import { organizationAdmins } from "./organization-access.js";
 import { f, resource } from "@protobase/schema";
 //#region src/user-tables/definitions-resources.ts
 /** The names of the resources over the definitions: a table users add takes neither. */
@@ -7,13 +8,20 @@ const fieldsResourceName = "user_table_fields";
 const admins = ({ user }) => user?.roles?.includes("admin") ?? false;
 const never = () => false;
 const createOnly = { update: never };
-const accessOf = (roles) => roles ? { delete: never } : {
+const accessOf = (roles, organizations) => organizations ? {
+	list: organizationAdmins,
+	read: organizationAdmins,
+	create: organizationAdmins,
+	update: organizationAdmins,
+	delete: never
+} : roles ? { delete: never } : {
 	list: admins,
 	read: admins,
 	create: admins,
 	update: admins,
 	delete: never
 };
+const withOrganization = (source, organizations) => organizations ? source.tenant((r) => r[organizationColumn]) : source;
 const issue = (field, problem) => problem ? [{
 	field,
 	message: problem
@@ -22,32 +30,43 @@ const issue = (field, problem) => problem ? [{
 * The definitions of the tables users add, as resources: a table at `/user_tables/<id>`, each of its fields at
 * `/user_table_fields/<table_id>,<name>`. Writing one creates its table or column in the database, in the same
 * transaction (`definitionsHook`). `taken` holds the names of the app's resources and those Protobase adds, which a
-* new table may not have.
+* new table may not have. With `organizations`, each belongs to the organization it was made in and only that one's
+* owners and admins reach it; its table is `t<id>_<name>` (`table_name`), so the name is free in every organization.
 */
-const definitionsResources = ({ roles, taken }) => {
+const definitionsResources = ({ roles, taken, organizations = false }) => {
+	const organization = organizations ? { [organizationColumn]: f.text() } : {};
+	const nameIssue = (name) => {
+		if (organizations) return nameProblem(name, "table", 42);
+		return nameProblem(name, "table") ?? (taken.includes(name) || ["user_tables", "user_table_fields"].includes(name) ? `"${name}" is the name of a resource of the app` : void 0);
+	};
+	const tables = resource(tablesResourceName).table(`${definitionsSchema}.tables`).fields({
+		id: f.bigint().readOnly().dbDefault().filterable().sortable(),
+		name: f.text().access(createOnly).filterable().sortable(),
+		singular_label: f.text().max(200),
+		plural_label: f.text().max(200),
+		title_field: f.text().optional(),
+		version: f.bigint().readOnly().dbDefault(),
+		table_name: f.text().readOnly().dbDefault(),
+		...organization
+	}).primaryKey((r) => r.id).explicitGrants().access(accessOf(roles, organizations)).validate((table) => [...issue("name", nameIssue(table.name)), ...issue("title_field", table.title_field ? nameProblem(table.title_field, "field") : void 0)]);
+	const fields = resource(fieldsResourceName).table(`${definitionsSchema}.fields`).fields({
+		table_id: f.relation(tablesResourceName).access(createOnly).filterable(),
+		name: f.text().access(createOnly),
+		label: f.text().max(200),
+		type: f.enum(definitionFieldTypes).access(createOnly),
+		required: f.boolean().default(false).access(createOnly),
+		position: f.integer().sortable(),
+		precision: f.integer().optional().access(createOnly),
+		scale: f.integer().optional().access(createOnly),
+		...organization
+	}).primaryKey((r) => [r.table_id, r.name]).explicitGrants().access(accessOf(roles, organizations)).validate((field) => [
+		...issue("name", nameProblem(field.name, "field")),
+		...issue("required", field.required ? "A field users add is optional: the records already there have no value for it" : void 0),
+		...field.type === "decimal" ? [...issue("precision", field.precision == null || field.precision < 1 || field.precision > 1e3 ? "A decimal needs a precision from 1 to 1000" : void 0), ...issue("scale", field.scale == null || field.scale < 0 || field.precision != null && field.scale > field.precision ? "A decimal needs a scale from 0 to its precision" : void 0)] : [...issue("precision", field.precision == null ? void 0 : "Only a decimal has a precision"), ...issue("scale", field.scale == null ? void 0 : "Only a decimal has a scale")]
+	]);
 	return {
-		tables: resource(tablesResourceName).table(`${definitionsSchema}.tables`).fields({
-			id: f.bigint().readOnly().dbDefault().filterable().sortable(),
-			name: f.text().access(createOnly).filterable().sortable(),
-			singular_label: f.text().max(200),
-			plural_label: f.text().max(200),
-			title_field: f.text().optional(),
-			version: f.bigint().readOnly().dbDefault()
-		}).primaryKey((r) => r.id).explicitGrants().access(accessOf(roles)).validate((table) => [...issue("name", nameProblem(table.name, "table") ?? (taken.includes(table.name) || ["user_tables", "user_table_fields"].includes(table.name) ? `"${table.name}" is the name of a resource of the app` : void 0)), ...issue("title_field", table.title_field ? nameProblem(table.title_field, "field") : void 0)]),
-		fields: resource(fieldsResourceName).table(`${definitionsSchema}.fields`).fields({
-			table_id: f.relation(tablesResourceName).access(createOnly).filterable(),
-			name: f.text().access(createOnly),
-			label: f.text().max(200),
-			type: f.enum(definitionFieldTypes).access(createOnly),
-			required: f.boolean().default(false).access(createOnly),
-			position: f.integer().sortable(),
-			precision: f.integer().optional().access(createOnly),
-			scale: f.integer().optional().access(createOnly)
-		}).primaryKey((r) => [r.table_id, r.name]).explicitGrants().access(accessOf(roles)).validate((field) => [
-			...issue("name", nameProblem(field.name, "field")),
-			...issue("required", field.required ? "A field users add is optional: the records already there have no value for it" : void 0),
-			...field.type === "decimal" ? [...issue("precision", field.precision == null || field.precision < 1 || field.precision > 1e3 ? "A decimal needs a precision from 1 to 1000" : void 0), ...issue("scale", field.scale == null || field.scale < 0 || field.precision != null && field.scale > field.precision ? "A decimal needs a scale from 0 to its precision" : void 0)] : [...issue("precision", field.precision == null ? void 0 : "Only a decimal has a precision"), ...issue("scale", field.scale == null ? void 0 : "Only a decimal has a scale")]
-		])
+		tables: withOrganization(tables, organizations),
+		fields: withOrganization(fields, organizations)
 	};
 };
 //#endregion

package/dist/user-tables/names.js

@@ -19,13 +19,19 @@ const definitionColumnTypes = {
 };
 const definitionFieldTypes = Object.keys(definitionColumnTypes);
 const isUserTableName = (name) => userTableName.test(name) && new TextEncoder().encode(name).length <= 63;
-/** The names a field never takes: the key's, and the API's for the record version. */
-const reservedFieldNames = ["id", "etag"];
-/** What is wrong with a name a table or field users add is given, or `undefined` when it may have it. */
-const nameProblem = (name, kind) => {
-	if (typeof name !== "string" || !isUserTableName(name)) return "Use lowercase letters, digits and \"_\", starting with a letter, at most 63 bytes";
+/** The column that holds the organization of each record of a table users add with organizations, and of each definition. */
+const organizationColumn = "organization_id";
+/** The names a field never takes: the key's, the API's for the record version, and the organization's. */
+const reservedFieldNames = [
+	"id",
+	"etag",
+	organizationColumn
+];
+/** What is wrong with a name a table or field users add is given, or `undefined` when it may have it; `maxBytes` defaults to 63. */
+const nameProblem = (name, kind, maxBytes = 63) => {
+	if (typeof name !== "string" || !isUserTableName(name) || new TextEncoder().encode(name).length > maxBytes) return `Use lowercase letters, digits and "_", starting with a letter, at most ${maxBytes} bytes`;
 	if (reservedWords.has(name)) return `"${name}" is a word SQL reserves`;
 	if (kind === "field" && reservedFieldNames.includes(name)) return `"${name}" is the name of a field every table has`;
 };
 //#endregion
-export { definitionColumnTypes, definitionFieldTypes, definitionsSchema, isUserTableName, nameProblem, reservedFieldNames, userTableName, userTablesSchema };
+export { definitionColumnTypes, definitionFieldTypes, definitionsSchema, isUserTableName, nameProblem, organizationColumn, reservedFieldNames, userTableName, userTablesSchema };

package/dist/user-tables/organization-access.js

@@ -0,0 +1,14 @@
+//#region src/user-tables/organization-access.ts
+/**
+* The organization's owners and admins, as the auth store holds their membership for this request, and superusers
+* working in it: no one without an organization, so a session that names none reaches nothing.
+*/
+const organizationAdmins = ({ user, organization }) => {
+	if (!organization) return false;
+	if (user?.roles?.includes("admin")) return true;
+	return organization.role === "owner" || organization.role === "admin";
+};
+/** `organizationAdmins` of the one organization `organizationId`, the one a table users add belongs to. */
+const organizationAdminsOf = (organizationId) => (context) => context.organization !== void 0 && String(context.organization.id) === organizationId && organizationAdmins(context);
+//#endregion
+export { organizationAdmins, organizationAdminsOf };

package/dist/user-tables/owned-definitions.d.ts

@@ -4,9 +4,10 @@ import { Db } from "@protobase/query";
 /** The user tables a resource in code owns, as `protobase eject` writes one: over `user_tables.<name>`, with that name. */
 export declare const ownedTableNames: (models: readonly ResourceModel[]) => string[];
 /**
- * The delete of the definitions of the user tables a resource in code owns, with their fields; their tables and rows
- * stay. `undefined` when no such definition is left. `protobase migration` writes it once the code that owns them has
- * deployed, so a definition goes in a later deploy than the one that stopped reading it.
+ * The delete of the definitions of the user tables a resource in code owns, with their fields, matched on the table
+ * they serve, so an organization's table of the same name stays; their tables and rows stay. `undefined` when no such
+ * definition is left. `protobase migration` writes it once the code that owns them has deployed, so a definition goes
+ * in a later deploy than the one that stopped reading it.
  */
 export declare const ownedDefinitionsMigration: (db: Db, models: readonly ResourceModel[]) => Promise<string | undefined>;
 //#endregion

package/dist/user-tables/owned-definitions.js

@@ -5,18 +5,19 @@ import { sql } from "kysely";
 const ownedTableNames = (models) => models.filter((model) => model.table.schema === "user_tables" && model.table.name === model.name).map((model) => model.name);
 const literal = (text) => `'${text.replaceAll("'", "''")}'`;
 /**
-* The delete of the definitions of the user tables a resource in code owns, with their fields; their tables and rows
-* stay. `undefined` when no such definition is left. `protobase migration` writes it once the code that owns them has
-* deployed, so a definition goes in a later deploy than the one that stopped reading it.
+* The delete of the definitions of the user tables a resource in code owns, with their fields, matched on the table
+* they serve, so an organization's table of the same name stays; their tables and rows stay. `undefined` when no such
+* definition is left. `protobase migration` writes it once the code that owns them has deployed, so a definition goes
+* in a later deploy than the one that stopped reading it.
 */
 const ownedDefinitionsMigration = async (db, models) => {
 	const owned = ownedTableNames(models);
 	if (owned.length === 0) return;
 	const { rows: found } = await sql`select to_regclass(${`${definitionsSchema}.tables`}) is not null as found`.execute(db);
 	if (!found[0].found) return;
-	const { rows } = await sql`select name from ${sql.table(`${definitionsSchema}.tables`)} where name = any(${owned}) order by name`.execute(db);
+	const { rows } = await sql`select table_name as name from ${sql.table(`${definitionsSchema}.tables`)} where table_name = any(${owned}) order by table_name`.execute(db);
 	if (rows.length === 0) return;
-	return `delete from ${definitionsSchema}.tables where name in (${rows.map((row) => literal(row.name)).join(", ")});`;
+	return `delete from ${definitionsSchema}.tables where table_name in (${rows.map((row) => literal(row.name)).join(", ")});`;
 };
 //#endregion
 export { ownedDefinitionsMigration, ownedTableNames };

package/dist/user-tables/read-definitions.d.ts

@@ -9,10 +9,15 @@ export type StoredField = {
   precision: number | null;
   scale: number | null;
 };
-/** A stored definition of a table users add, as its rows hold it, with its fields in order. */
+/**
+ * A stored definition of a table users add, as its rows hold it, with its fields in order. `name` is its table's name in
+ * the user tables schema and its resource's (`table_name`); `organization_id` the organization it belongs to, `null`
+ * without organizations.
+ */
 export type StoredDefinition = {
   id: string;
   name: string;
+  organization_id: string | null;
   singular_label: string;
   plural_label: string;
   title_field: string | null;

package/dist/user-tables/read-definitions.js

@@ -3,7 +3,7 @@ import { sql } from "kysely";
 //#region src/user-tables/read-definitions.ts
 /** The stored definitions, by id, each with its fields by position. */
 const readDefinitions = async (db) => {
-	const { rows } = await sql`select t.id::text as id, t.name, t.singular_label, t.plural_label, t.title_field, t.version::text as version,
+	const { rows } = await sql`select t.id::text as id, t.table_name as name, t.organization_id, t.singular_label, t.plural_label, t.title_field, t.version::text as version,
       coalesce((select json_agg(json_build_object('name', f.name, 'label', f.label, 'type', f.type, 'required', f.required, 'precision', f.precision, 'scale', f.scale) order by f.position, f.name)
         from ${sql.table(`${definitionsSchema}.fields`)} f where f.table_id = t.id), '[]') as fields
     from ${sql.table(`${definitionsSchema}.tables`)} t order by t.id`.execute(db);

package/dist/user-tables/schema-sql.js

@@ -1,20 +1,39 @@
 import { definitionFieldTypes, definitionsSchema, userTableName, userTablesSchema } from "./names.js";
 //#region src/user-tables/schema-sql.ts
 const nameCheck = (column) => `check (${column} ~ '${userTableName.source}' and octet_length(${column}) <= 63)`;
-/** The table of definitions: one row per table users add, its labels and a version, 1 when added, that each change of it raises. */
+/**
+* The table of definitions: one row per table users add, its labels and a version, 1 when added, that each change of it
+* raises. With organizations a definition belongs to the one it was made in (`organization_id`), and its table is named
+* `t<id>_<name>`, so two organizations can each have a table of one name; without, the table is the name. `table_name`
+* is the table's name in the user tables schema and the name of its resource.
+*/
 const tablesSql = () => `create table ${definitionsSchema}.tables (
   id bigint generated always as identity primary key,
-  name text not null unique ${nameCheck("name")},
+  name text not null ${nameCheck("name")},
+  organization_id text,
   singular_label text not null,
   plural_label text not null,
   title_field text ${nameCheck("title_field")},
-  version bigint not null default 1 check (version > 0)
+  version bigint not null default 1 check (version > 0),
+  ${tableNameColumn},
+  ${tenantKeyColumn},
+  unique (id, tenant_key)
 )`;
+const tableNameColumn = `table_name text not null unique generated always as (case when organization_id is null then name else 't' || id || '_' || name end) stored ${nameCheck("table_name")}`;
+const tenantKeyColumn = "tenant_key text not null generated always as (coalesce(organization_id, '-')) stored";
+/** A name is unique among the definitions of one organization, or of the app without organizations. */
+const nameIndexesSql = () => [`create unique index tables_name_key on ${definitionsSchema}.tables (name) where organization_id is null`, `create unique index tables_organization_name_key on ${definitionsSchema}.tables (organization_id, name) where organization_id is not null`];
 /** Gives a definitions table made before new definitions started at version 1 that default. */
 const versionDefaultSql = () => `alter table ${definitionsSchema}.tables alter column version set default 1`;
-/** The fields of each definition, in order, each with its label and type; a decimal names its precision and scale. */
+/**
+* The fields of each definition, in order, each with its label and type; a decimal names its precision and scale. A
+* field belongs to its table's organization: the foreign key compares both, so no field reaches another organization's
+* table, or one of none.
+*/
 const fieldsSql = () => `create table ${definitionsSchema}.fields (
-  table_id bigint not null references ${definitionsSchema}.tables (id) on delete cascade,
+  table_id bigint not null,
+  organization_id text,
+  ${tenantKeyColumn},
   name text not null ${nameCheck("name")} check (name not in ('id', 'etag')),
   label text not null,
   type text not null check (type in (${definitionFieldTypes.map((type) => `'${type}'`).join(", ")})),
@@ -23,8 +42,20 @@ const fieldsSql = () => `create table ${definitionsSchema}.fields (
   precision integer check (precision between 1 and 1000),
   scale integer check (scale between 0 and precision),
   primary key (table_id, name),
+  foreign key (table_id, tenant_key) references ${definitionsSchema}.tables (id, tenant_key) on delete cascade,
   check ((type = 'decimal') = (precision is not null and scale is not null))
 )`;
+/**
+* Brings a definitions table made before organizations to the shape of `tablesSql`: a name unique per organization and
+* the served name.
+*/
+const organizationsSql = () => [
+	`alter table ${definitionsSchema}.tables add column organization_id text, add column ${tableNameColumn}, add column ${tenantKeyColumn}, add unique (id, tenant_key)`,
+	`alter table ${definitionsSchema}.tables drop constraint tables_name_key`,
+	...nameIndexesSql()
+];
+/** Ties the fields made before organizations to their table's organization, as `fieldsSql` does. */
+const fieldsOrganizationSql = () => `alter table ${definitionsSchema}.fields add column organization_id text, add column ${tenantKeyColumn}, add foreign key (table_id, tenant_key) references ${definitionsSchema}.tables (id, tenant_key) on delete cascade`;
 const schemasSql = () => [
 	"create extension if not exists pg_trgm",
 	`create schema if not exists ${definitionsSchema}`,
@@ -34,4 +65,4 @@ const schemasSql = () => [
 	`grant usage, create on schema ${userTablesSchema} to current_user`
 ];
 //#endregion
-export { fieldsSql, schemasSql, tablesSql, versionDefaultSql };
+export { fieldsOrganizationSql, fieldsSql, nameIndexesSql, organizationsSql, schemasSql, tablesSql, versionDefaultSql };

package/dist/user-tables/schema.d.ts

@@ -2,7 +2,8 @@ import { Db } from "@protobase/query";
 //#region src/user-tables/schema.d.ts
 /**
  * The SQL that adds what user tables need: pg_trgm, the definitions schema with its `tables` and `fields`, and the
- * schema the tables themselves live in. `undefined` when current. Nothing is dropped.
+ * schema the tables themselves live in. `undefined` when current. Nothing is dropped but the unique constraint on a
+ * definition's name, which a name unique per organization replaces.
  */
 export declare const userTablesMigration: (db: Db) => Promise<string | undefined>;
 /** Refuses to go on while the schemas of user tables are missing; the project's migrations add them. */

package/dist/user-tables/schema.js

@@ -1,12 +1,14 @@
 import { migrationCommand } from "../changes/capture-schema.js";
 import { definitionsSchema, userTablesSchema } from "./names.js";
-import { fieldsSql, schemasSql, tablesSql, versionDefaultSql } from "./schema-sql.js";
+import { fieldsOrganizationSql, fieldsSql, nameIndexesSql, organizationsSql, schemasSql, tablesSql, versionDefaultSql } from "./schema-sql.js";
 import { sql } from "kysely";
 //#region src/user-tables/schema.ts
+const current = (found) => found.tables && found.versionDefault && found.organizations && found.fields && found.data && found.trgm;
 const readUserTablesSchema = async (db) => {
 	const { rows } = await sql`select
     to_regclass(${`${definitionsSchema}.tables`}) is not null as tables,
     exists (select from information_schema.columns where table_schema = ${definitionsSchema} and table_name = 'tables' and column_name = 'version' and column_default is not null) as "versionDefault",
+    exists (select from information_schema.columns where table_schema = ${definitionsSchema} and table_name = 'tables' and column_name = 'table_name') as organizations,
     to_regclass(${`${definitionsSchema}.fields`}) is not null as fields,
     exists (select from pg_namespace where nspname = ${userTablesSchema}) as data,
     exists (select from pg_extension where extname = 'pg_trgm') as trgm`.execute(db);
@@ -14,22 +16,25 @@ const readUserTablesSchema = async (db) => {
 };
 /**
 * The SQL that adds what user tables need: pg_trgm, the definitions schema with its `tables` and `fields`, and the
-* schema the tables themselves live in. `undefined` when current. Nothing is dropped.
+* schema the tables themselves live in. `undefined` when current. Nothing is dropped but the unique constraint on a
+* definition's name, which a name unique per organization replaces.
 */
 const userTablesMigration = async (db) => {
 	const found = await readUserTablesSchema(db);
-	if (found.tables && found.versionDefault && found.fields && found.data && found.trgm) return void 0;
+	if (current(found)) return void 0;
+	const tables = found.tables ? [...found.versionDefault ? [] : [versionDefaultSql()], ...found.organizations ? [] : organizationsSql()] : [tablesSql(), ...nameIndexesSql()];
+	const fields = found.fields ? found.tables && !found.organizations ? [fieldsOrganizationSql()] : [] : [fieldsSql()];
 	return `${[
 		...schemasSql(),
-		...found.tables ? found.versionDefault ? [] : [versionDefaultSql()] : [tablesSql()],
-		...found.fields ? [] : [fieldsSql()]
+		...tables,
+		...fields
 	].join(";\n\n")};`;
 };
 /** Refuses to go on while the schemas of user tables are missing; the project's migrations add them. */
 const checkUserTablesSchema = async (db) => {
 	const found = await readUserTablesSchema(db);
-	if (found.tables && found.versionDefault && found.fields && found.data && found.trgm) return;
-	throw new Error(`The ${definitionsSchema} or ${userTablesSchema} schema, the default of a definition's version, or pg_trgm, is missing, and userTables keeps the tables users add there. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
+	if (current(found)) return;
+	throw new Error(`The ${definitionsSchema} or ${userTablesSchema} schema, the default of a definition's version, a definition's organization, or pg_trgm, is missing, and userTables keeps the tables users add there. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
 };
 //#endregion
 export { checkUserTablesSchema, userTablesMigration };

package/dist/user-tables/table-ddl.js

@@ -1,4 +1,4 @@
-import { nameProblem, userTablesSchema } from "./names.js";
+import { nameProblem, organizationColumn, userTablesSchema } from "./names.js";
 import { sql } from "kysely";
 //#region src/user-tables/table-ddl.ts
 const checkedName = (name, kind) => {
@@ -41,6 +41,11 @@ const indexKind = (type) => {
 };
 /** The new table, with its key alone: its fields are added as columns. */
 const createTableSql = (table) => sql`create table ${tableId(table)} (id bigint generated always as identity primary key)`;
+/**
+* The new table of an organization: its key, and the organization of each record, which `.tenant` sets and every query
+* filters by, with the index that filter reads.
+*/
+const createOrganizationTableSql = (table) => [sql`create table ${tableId(table)} (id bigint generated always as identity primary key, ${sql.id(organizationColumn)} text not null)`, sql`create index on ${tableId(table)} (${sql.id(organizationColumn)})`];
 /** The field's column: nullable and without a default, so the records already there read it as empty. */
 const addColumnSql = (table, field) => sql`alter table ${tableId(table)} add column ${sql.id(checkedName(field.name, "field"))} ${columnType(field)}`;
 const btreeSql = (table, column) => sql`create index on ${tableId(table)} (${sql.id(checkedName(column, "field"))})`;
@@ -53,4 +58,4 @@ const fieldSql = (table, field) => {
 	return [addColumnSql(table, field), ...index];
 };
 //#endregion
-export { addColumnSql, createTableSql, fieldSql, indexKind, trigramIndexSql };
+export { addColumnSql, createOrganizationTableSql, createTableSql, fieldSql, indexKind, trigramIndexSql };

package/dist/webhooks/attempt.js

@@ -2,15 +2,22 @@ import { invokeFunction } from "../functions/define-function.js";
 import { retryAfterMs } from "./retry-schedule.js";
 import { standardWebhookHeaders } from "./standard-webhooks.js";
 import { subscriberSession } from "./subscriber-view.js";
+import { AddressRefusedError, pinnedRequest } from "./table/pinned-request.js";
+import { readLimited } from "./table/read-limited.js";
 //#region src/webhooks/attempt.ts
 /** How long a receiver has to answer. */
 const attemptTimeoutMs = 15e3;
-const excerpt = async (response) => (await response.text()).slice(0, 200);
+/** How much of a failing answer is read; the rest is cancelled. */
+const excerptBytes = 4096;
+const excerpt = async (response) => new TextDecoder().decode(await readLimited(response, excerptBytes)).slice(0, 200);
 const resultOf = async (response) => {
-	if (response.status >= 200 && response.status < 300) return {
-		ok: true,
-		status: response.status
-	};
+	if (response.status >= 200 && response.status < 300) {
+		await response.body?.cancel();
+		return {
+			ok: true,
+			status: response.status
+		};
+	}
 	const body = await excerpt(response);
 	const wait = retryAfterMs(response.headers.get("retry-after"));
 	return {
@@ -21,20 +28,19 @@ const resultOf = async (response) => {
 		final: response.status === 410
 	};
 };
-const request = async (url, event, options, signal) => {
+const delivery = async (event, options, signal) => {
 	const body = JSON.stringify(options.body ? options.body(event) : event);
 	const signed = await standardWebhookHeaders(event.id, Math.floor(Date.now() / 1e3), body, options.secret);
-	return new Request(url, {
+	return {
 		method: "POST",
-		headers: {
+		headers: new Headers({
 			...options.headers,
 			...signed,
 			"content-type": "application/json"
-		},
+		}),
 		body,
-		redirect: "manual",
 		signal
-	});
+	};
 };
 const callFunction = async (name, subscription, event, options, context, signal) => {
 	const fn = context.functions[name];
@@ -63,7 +69,7 @@ const callFunction = async (name, subscription, event, options, context, signal)
 			of: noCalls
 		}
 	};
-	return invokeFunction(name, fn, await request("http://protobase.internal/", event, options, signal), fn.options.public ? functionContext : {
+	return invokeFunction(name, fn, new Request("http://protobase.internal/", await delivery(event, options, signal)), fn.options.public ? functionContext : {
 		...functionContext,
 		...caller
 	});
@@ -71,7 +77,7 @@ const callFunction = async (name, subscription, event, options, context, signal)
 const failure = (error) => ({
 	ok: false,
 	error: error instanceof Error ? error.message : String(error),
-	final: false
+	final: error instanceof AddressRefusedError
 });
 /** One try of one event to one subscription's target, within `attemptTimeoutMs`. It never throws. */
 const attemptDelivery = async (subscription, event, context) => {
@@ -87,16 +93,14 @@ const attemptDelivery = async (subscription, event, context) => {
 			return { ok: true };
 		}
 		if ("function" in options) return await resultOf(await callFunction(options.function, subscription, event, options, context, signal));
-		const blocked = await context.checkUrl?.(options.url);
-		if (blocked) return {
-			ok: false,
-			error: blocked,
-			final: true
+		const pinned = {
+			allowPrivateAddresses: context.allowPrivateAddresses,
+			...context.resolve && { resolve: context.resolve }
 		};
-		return await resultOf(await fetch(await request(options.url, event, options, signal)));
+		return await resultOf(await pinnedRequest(options.url, await delivery(event, options, signal), pinned));
 	} catch (error) {
 		return failure(error);
 	}
 };
 //#endregion
-export { attemptDelivery, attemptTimeoutMs };
+export { attemptDelivery, attemptTimeoutMs, excerptBytes };

package/dist/webhooks/table/address-check.js

@@ -6,21 +6,52 @@ const privateV4 = (address) => {
 	const [a, b] = v4(address);
 	return a === 0 || a === 10 || a === 127 || a >= 224 || a === 100 && b >= 64 && b < 128 || a === 169 && b === 254 || a === 172 && b >= 16 && b < 32 || a === 192 && b === 168;
 };
+const v6Groups = (address) => {
+	const halves = address.toLowerCase().replace(/%.*$/, "").replace(/(\d+)\.(\d+)\.(\d+)\.(\d+)$/, (_, a, b, c, d) => `${(+a << 8 | +b).toString(16)}:${(+c << 8 | +d).toString(16)}`).split("::");
+	if (halves.length > 2) return;
+	const groups = (half) => half ? half.split(":") : [];
+	const head = groups(halves[0]);
+	const tail = groups(halves[1]);
+	const zeros = halves.length === 2 ? 8 - head.length - tail.length : 0;
+	const all = [
+		...head,
+		...Array(Math.max(zeros, 0)).fill("0"),
+		...tail
+	];
+	if (all.length !== 8 || !all.every((group) => /^[0-9a-f]{1,4}$/.test(group))) return;
+	return all.map((group) => parseInt(group, 16));
+};
+const embeddedV4 = (high, low) => privateV4(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
 const privateV6 = (address) => {
-	const lower = address.toLowerCase();
-	const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower);
-	if (mapped) return privateV4(mapped[1]);
-	return lower === "::" || lower === "::1" || /^f[cd]/.test(lower) || /^fe[89ab]/.test(lower) || /^ff/.test(lower);
+	const g = v6Groups(address);
+	if (!g) return true;
+	const zeroUpTo = (end) => g.slice(0, end).every((group) => group === 0);
+	if (zeroUpTo(5) && (g[5] === 0 || g[5] === 65535)) return embeddedV4(g[6], g[7]);
+	if (zeroUpTo(4) && g[4] === 65535 && g[5] === 0) return embeddedV4(g[6], g[7]);
+	if (g[0] === 100 && g[1] === 65435) return g.slice(2, 6).every((group) => group === 0) ? embeddedV4(g[6], g[7]) : true;
+	if (g[0] === 8194) return embeddedV4(g[1], g[2]);
+	return (g[0] & 65024) === 64512 || (g[0] & 65408) === 65152 || g[0] >> 8 === 255;
+};
+/**
+* Whether an IP address is one a webhook must not reach: the server's own host or network. Anything that is not an IP
+* address is refused too, so no unknown form gets through.
+*/
+const isPrivateAddress = (address) => {
+	const family = isIP(address);
+	if (family === 4) return privateV4(address);
+	if (family === 6) return privateV6(address);
+	return true;
 };
-/** Whether an IP address is one a webhook must not reach: the server's own host or network. */
-const isPrivateAddress = (address) => isIP(address) === 4 ? privateV4(address) : privateV6(address);
 /**
 * What is wrong with a URL whose host is, or resolves to, a private, loopback or link-local address, so a subscription someone
-* makes in the admin app cannot reach the server's own network. The address is resolved again when the request is
-* sent, so a host that answers differently the second time still gets through: a firewall rule is the stronger guard.
+* makes in the admin app cannot reach the server's own network. It gives the early error when a subscription is saved;
+* each delivery checks again in `pinnedRequest` and connects to the very address it checked, so a host that answers
+* differently later cannot steer it elsewhere.
 */
 const checkWebhookUrl = async (url) => {
-	const host = new URL(url).hostname.replace(/^\[|\]$/g, "");
+	const target = new URL(url);
+	if (target.protocol !== "http:" && target.protocol !== "https:") return `${target.protocol} URLs are not sent to; webhooks use http or https`;
+	const host = target.hostname.replace(/^\[|\]$/g, "");
 	const blocked = (isIP(host) ? [host] : (await lookup(host, { all: true })).map((entry) => entry.address)).find(isPrivateAddress);
 	return blocked ? `${host} is a private address (${blocked}); webhooks reach public addresses only` : void 0;
 };

package/dist/webhooks/table/pinned-request.js

@@ -0,0 +1,84 @@
+import { isPrivateAddress } from "./address-check.js";
+import { lookup } from "node:dns/promises";
+import { request } from "node:http";
+import { request as request$1 } from "node:https";
+import { isIP } from "node:net";
+import { Readable } from "node:stream";
+//#region src/webhooks/table/pinned-request.ts
+/** The system resolver, every address of the host. */
+const resolveHost = async (host) => (await lookup(host, { all: true })).map((entry) => entry.address);
+/** A request refused before it was sent, for its URL's scheme or address. The message names the host, never the URL. */
+var AddressRefusedError = class extends Error {};
+const noLookup = (_host, _options, callback) => callback(/* @__PURE__ */ new Error("A pinned request resolves no host"), "", 4);
+const resolveWithin = (resolve, host, signal) => {
+	signal?.throwIfAborted();
+	if (!signal) return resolve(host);
+	return Promise.race([resolve(host), new Promise((_, reject) => signal.addEventListener("abort", () => reject(signal.reason), { once: true }))]);
+};
+const checkedAddresses = async (host, options, signal) => {
+	const addresses = isIP(host) ? [host] : await resolveWithin(options.resolve ?? resolveHost, host, signal);
+	if (addresses.length === 0) throw new AddressRefusedError(`${host} resolves to no address`);
+	if (addresses.find((address) => typeof address !== "string" || isIP(address) === 0) !== void 0) throw new AddressRefusedError(`${host} resolves to something that is not an IP address`);
+	const blocked = options.allowPrivateAddresses ? void 0 : addresses.find(isPrivateAddress);
+	if (blocked !== void 0) throw new AddressRefusedError(`${host} is a private address (${blocked}); requests reach public addresses only`);
+	return addresses;
+};
+const nullBodyStatuses = /* @__PURE__ */ new Set([
+	204,
+	205,
+	304
+]);
+const toResponse = (message, status) => {
+	const headers = new Headers();
+	for (let index = 0; index < message.rawHeaders.length; index += 2) headers.append(message.rawHeaders[index], message.rawHeaders[index + 1]);
+	if (nullBodyStatuses.has(status)) {
+		message.resume();
+		return new Response(null, {
+			status,
+			headers
+		});
+	}
+	return new Response(Readable.toWeb(message), {
+		status,
+		headers
+	});
+};
+/**
+* An http(s) request to a URL someone else chose, which reaches only the address it checked. It resolves the host once,
+* refuses it unless every address is public (or `allowPrivateAddresses`), and connects to the first one, with the host
+* name as the `Host` header and as the TLS server name the certificate is checked against. A redirect is returned as
+* it is and never followed: a caller that follows one calls this again with its URL, so the new host is checked too.
+*/
+const pinnedRequest = async (url, init, options = {}) => {
+	const target = new URL(url);
+	if (target.protocol !== "http:" && target.protocol !== "https:") throw new AddressRefusedError(`${target.protocol} URLs are not requested; use http or https`);
+	const host = target.hostname.replace(/^\[|\]$/g, "");
+	const address = (await checkedAddresses(host, options, init.signal))[0];
+	const headers = Object.fromEntries(new Headers(init.headers));
+	if (init.body !== void 0) headers["content-length"] = String(Buffer.byteLength(init.body));
+	headers.host = target.host;
+	const send = target.protocol === "https:" ? request$1 : request;
+	return new Promise((resolve, reject) => {
+		const request = send({
+			host: address,
+			family: isIP(address),
+			port: target.port || (target.protocol === "https:" ? 443 : 80),
+			path: `${target.pathname}${target.search}`,
+			method: init.method,
+			headers,
+			lookup: noLookup,
+			...isIP(host) === 0 && { servername: host },
+			...options.ca && { ca: options.ca },
+			...init.signal && { signal: init.signal }
+		}, (message) => {
+			const status = message.statusCode ?? 0;
+			if (status >= 200 && status <= 599) return resolve(toResponse(message, status));
+			message.destroy();
+			reject(/* @__PURE__ */ new Error(`${host} answered with status ${status}`));
+		});
+		request.on("error", reject);
+		request.end(init.body);
+	});
+};
+//#endregion
+export { AddressRefusedError, pinnedRequest, resolveHost };

package/dist/webhooks/table/read-limited.js

@@ -0,0 +1,18 @@
+//#region src/webhooks/table/read-limited.ts
+/** Reads at most `limit` bytes of a response body, then cancels the rest, so a sender that never stops writing costs no more. */
+const readLimited = async (response, limit) => {
+	const reader = response.body?.getReader();
+	if (!reader) return /* @__PURE__ */ new Uint8Array();
+	const chunks = [];
+	let read = 0;
+	while (read < limit) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		chunks.push(value);
+		read += value.length;
+	}
+	await reader.cancel();
+	return Buffer.concat(chunks).subarray(0, limit);
+};
+//#endregion
+export { readLimited };

package/dist/webhooks/table/webhook-table.js

@@ -1,11 +1,11 @@
 import { betterAuthOwnerRoles } from "./owner-roles.js";
-import { webhooksSchema } from "./options.js";
 import { checkWebhookUrl } from "./address-check.js";
+import { webhooksSchema } from "./options.js";
 import { tableSubscriptions } from "./table-subscriptions.js";
 //#region src/webhooks/table/webhook-table.ts
 /**
 * What `createAdmin` needs for the subscriptions of `webhooks`: the table, the owners' current roles (from Better Auth
-* unless the options say otherwise) and, unless allowed, the check that keeps URLs off private addresses.
+* unless the options say otherwise) and, unless allowed, the save-time check that keeps URLs off private addresses.
 */
 const webhookTable = (options, auth) => {
 	const ownerRoles = options.ownerRoles ?? (auth && betterAuthOwnerRoles(auth));
@@ -16,6 +16,7 @@ const webhookTable = (options, auth) => {
 			ownerRoles,
 			deliveryLog: Boolean(options.deliveryLog)
 		}),
+		allowPrivateAddresses: Boolean(options.allowPrivateAddresses),
 		...!options.allowPrivateAddresses && { checkUrl: checkWebhookUrl }
 	};
 };

package/dist/webhooks/webhooks.js

@@ -77,7 +77,7 @@ const createWebhooks = ({ deps, subscriptions, functions, channels, schema, log,
 	const attempt = async (subscription, event, db, tried, signal) => {
 		const id = tableId(subscription);
 		const started = performance.now();
-		const checkUrl = id === void 0 ? void 0 : table?.checkUrl;
+		const allowPrivateAddresses = id === void 0 || Boolean(table?.allowPrivateAddresses);
 		const result = await attemptDelivery(subscription, event, {
 			db,
 			functions,
@@ -85,7 +85,7 @@ const createWebhooks = ({ deps, subscriptions, functions, channels, schema, log,
 			channels,
 			attempt: tried,
 			signal,
-			...checkUrl && { checkUrl }
+			allowPrivateAddresses
 		});
 		if (id !== void 0) await table.subscriptions.record(db, id, event, tried, result, performance.now() - started);
 		return result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.67.5",
+  "version": "0.67.7",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,9 +44,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.67.5",
-    "@protobase/query": "0.67.5",
-    "@protobase/schema": "0.67.5",
+    "@protobase/layout": "0.67.7",
+    "@protobase/query": "0.67.7",
+    "@protobase/schema": "0.67.7",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",