@happyvertical/smrt-core 0.51.10 → 0.51.14

package/agents/change-feed.md

@@ -17,6 +17,88 @@ Adapter-agnostic change-observation spine (`src/change-feed.ts`) — the server
 - Retention: `pruneChangeFeed(db, { maxAgeMs?, maxRows?, dryRun? })` — scheduled since #2375 by `runRetentionSweep()` (30-day default), so nothing needs to call it directly; `dryRun` counts the same predicate instead of deleting. Pruning deletes oldest-first and always retains the newest entry (a non-empty feed is never emptied), which is what makes pruned-cursor detection provable. The age bound is a **prefix** bound — everything below the oldest entry still inside the window — because `created_at` and `seq` are not co-monotonic (writer clocks skew, and a staged entry carries its stage-time stamp into a later-assigned sequence); deleting by timestamp alone could punch a hole in the middle of the retained run, where `since < floor - 1` cannot see it and keeps caught-up consumers polling normally. Raw-SQL writes are invisible to the feed (same documented gap as the #1499 cache); `bumpChangeFeed(db, { table, rowId? })` is the manual escape hatch.
 
 
+## Credential-bearing tables are never disclosed (#2937)
+
+`src/change-feed-sensitivity.ts` is a leaf module (it imports nothing, so
+`change-feed.ts`, `change-signals.ts` and the registry can all consult it
+without a cycle) holding the tables whose **row id or payload is a secret**. A
+table joins it two ways: by name, via the baseline
+`CHANGE_FEED_CREDENTIAL_TABLES` (`sessions`, `users_cli_auth_requests`,
+`users_magic_link_tokens`, `magic_link_tokens`, `api_keys`,
+`nostr_identities`), or because a class declared `@smrt({ sensitive: true })`
+and registration pushed its resolved table name across
+(`declareChangeFeedSensitiveTable`, called from both the decorator and the
+manifest-stub registration paths). Both are needed: the declaration is the
+package's own contract but only binds in a process where that package
+registered, while the name baseline is all the read path has when serving a
+database another process writes. The set is **monotonic** — `sensitive: false`
+is not an opt-out and nothing removes a name — so a consumer whose domain
+table is named `sessions` loses feed coverage for it and must rename it via
+`@smrt({ tableName })`.
+
+`isChangeFeedObservableTable()` ANDs the sensitivity check with
+`CHANGE_FEED_EXCLUDED_TABLES`, and the refusal is enforced at four points, not
+one: the interceptor write path; `appendChange`/`appendChanges`, the lowest
+write API, so `bumpChangeFeed()` and any other escape hatch are covered (a
+refused append returns `null`, indistinguishable from a staged one);
+`deliverLocally` in `change-signals.ts`, which also catches a signal broadcast
+by a peer replica running an older build; and **`getChangesSince()`**. The
+read-side refusal is what makes upgrading sufficient — rows an earlier version
+already wrote stay in the log but are never served. A caller-named sensitive
+table is dropped from the `tables` filter rather than erroring, so nothing
+confirms the table exists, and a request naming *only* sensitive tables gets
+an empty page rather than an unfiltered one. Filtered rows never hold the
+cursor back: an exhaustive page still advances to the served horizon.
+
+`pruneChangeFeed()` additionally deletes sensitive rows below the horizon on
+every sweep, ahead of either retention bound, so credentials do not sit at rest
+for the retention window. That deletes from the middle of the retained run,
+which the age bound goes to lengths to avoid — permissible only because these
+rows are unservable on every read path, so no page ever contained them and no
+cursor can fall into the gap. It **does** move `floor`, and usually will: a
+session is created before the first domain write and re-saved on every request,
+so the lowest retained sequences are typically credential rows. `floor` is read
+live (`MIN(seq)`) on every `getChangesSince` and never cached, so the only
+consequence is that a cursor below the new floor is answered `resyncRequired`
+and refetches — including a `since=0` client on a never-pruned feed. Extra
+resyncs, never a missed change. The horizon does not move, because the newest
+entry is retained even when it is sensitive; that preserves "a non-empty feed
+is never emptied" and means one credential row can linger until the next write
+moves the horizon past it.
+
+Because a non-observable table appends nothing, it also has no ETag source:
+`getTableVersion()` would pin at whatever an older build last wrote and then
+fall back to the global horizon, which moves only on unrelated traffic — so a
+conditional GET could answer `304` for a revoked API key or a rotated session.
+`getTableVersion()` therefore returns a deliberately **unrepeatable** value for
+such a table — 48 bits of `crypto` randomness per call, not a per-process
+counter, because two replicas' clock-seeded counters drift through each other
+and the ETag carries no per-process entropy — so no *concrete* `If-None-Match`
+can match and every such read is a full 200. It is the single point every ETag
+path goes through (the runtime `APIGenerator`, the generated
+`conditionalVersionedRead`, and route files an older generator already
+emitted), so no call site needs a special case. A wildcard `If-None-Match: *`
+still 304s; the read paths evaluate it only after the payload is built, so it
+distinguishes nothing an unconditional request would not.
+
+Registration derives the declared name from config and manifest; the writer uses
+`instance.tableName`, which resolves through the STI base's schema and then the
+class's own. Where those two derivations disagree the declaration lands on a
+name nothing writes under, and the real table keeps appending. STI is *not* such
+a case today — `@smrt()` already resolves an STI child to its base's table, so a
+child declaring `sensitive` declares `<base>` (verified) — but the manifest-stub
+and manifest-merge paths derive the name differently again, so registration
+declares every candidate name. The authoritative check is at the write path:
+`isChangeFeedSensitiveWrite()` asks the registry about the instance's own class
+through a resolver hook on the leaf module (so `change-feed.ts` never imports
+the registry), sees the exact name being recorded with no derivation to keep in
+sync, and declares it — closing the read path and signal bus for that table.
+
+Scope note: the generated `_changes`/`_events` routes still gate on an
+authenticated principal only — there is no per-table permission check, and
+tenant scoping (`getTenantScopedChangesSince`, fail-closed) remains the sole
+row-level filter for ordinary tables.
+
 ## Compatible bulk mutations (#2818)
 
 `appendChanges(db, entries)` validates all inputs before writing and returns one

package/agents/generators.md

@@ -229,7 +229,7 @@ Generated reads (`list`/`get`) on the REST and SvelteKit generators support cond
 ## Generated dev-plane route (#2782)
 
 `src/vite-plugin/dev-plane-route.ts` emits `<routesDir>/_dev/[...tool]/+server.ts`
-only when `sveltekit.devPlaneRoute.enabled === true` and
+only when `svelteKit.devPlaneRoute.enabled === true` and
 `@happyvertical/smrt-dev-mcp/dev-plane` resolves from the consumer (same
 resolvability guard as `_resources`). The route is dev-only (`$app/environment`
 `dev`, else 404), refuses to start without `SMRT_DEV_MCP_TOKEN` (503), and
@@ -237,3 +237,5 @@ delegates everything else to `createDevPlane`, passing `getSmrtConfig(...).db`
 from the generated `$lib/server/smrt` so the plane shares the app's connection.
 Core never imports smrt-dev-mcp; only the generated file does, at consumer
 runtime. The route carries the auto-generated header so the sweep owns it.
+
+Generated SvelteKit write routes (#2977) call `requireRoutePermission(locals, action)` after `requireRouteAuth`: CRUD writes need `<collection>.create|update|delete` and mutating custom actions `<collection>.<method>` in the session permission snapshot on `locals`, else 403 (fail-closed; `api.public: true` stays open, `tenantContext.superAdminBypass` skips). See `packages/users/agents/permissions.md`.

package/agents/schema-paths.md

@@ -275,13 +275,30 @@ and always reports what it will not touch:
   way to add uniqueness there; the bundled DuckDB 1.4.x resolves
   `ON CONFLICT (col)` through that index (the old #12684 limitation the DuckDB
   strategy's `requiresInlineUnique()` note describes no longer reproduces —
-  the #2369 DuckDB test pins the upsert), older DuckDB builds may not. A required column with no default is enforced only on an empty table;
-  on a populated one it is added nullable and the `NOT NULL` is reported as a
-  manual follow-up on every engine.
+  the #2369 DuckDB test pins the upsert), older DuckDB builds may not. A required column with no default is enforced inline only on an empty
+  table. On a populated one it needs a per-row `backfill` (#3008,
+  `ColumnDefinition.backfill` from `@field({ backfill })`): PostgreSQL/DuckDB
+  run `ADD COLUMN` (nullable) → `UPDATE … SET col = (backfill) WHERE col IS
+  NULL` → `SET DEFAULT` (deferred, if declared) → `SET NOT NULL` → the unique
+  index; SQLite adds it through the table rebuild (`sqliteBackfillPlaceholderSql`
+  → `planSqliteTableRebuilds` appends `"col" TYPE NOT NULL` and copies
+  `(backfill)`), one rebuild per table for every such column. The differ first
+  probes `WHERE (backfill) IS NULL` on the live rows. With no default and no
+  backfill, or with a backfill that yields NULL or will not evaluate, the
+  column is **not added**: a manual `alter_column` (`mismatch.actual ===
+  REQUIRED_COLUMN_NOT_ADDED`) names table and column, and `compareTable`
+  withholds `add_index`/`add_foreign_key` changes on it. The same backfill
+  repairs nullability drift (an existing nullable column holding NULLs).
+  A backfill for a single-column unique target is also probed for duplicate
+  values and refused by name. Partial unique indexes are exempt from that
+  probe only where `supportsPartialIndexes()` holds (SQLite/PostgreSQL);
+  DuckDB/JSON build them as full indexes, so they are probed there (#3015).
+  DuckDB refuses `ALTER COLUMN` while any index depends on the table, so its
+  `SET NOT NULL` is bracketed by `DROP INDEX`/recreate from `duckdb_indexes().sql`.
 - **SQLite** has no `ALTER COLUMN`: nullability/default alterations are manual
-  (comment SQL → `db:migrate` exit 1). The SQLite rebuild consumes
-  only `type_upgrade` placeholders today; extending it to rewrite constraints
-  would lift this.
+  (comment SQL → `db:migrate` exit 1), except a NOT NULL tightening with a
+  declared `backfill`, which the rebuild performs (`COALESCE(col, backfill)`
+  in the copy). The rebuild otherwise consumes `type_upgrade` placeholders.
 - Defaults compare through `canonicalizeDefault()`, which folds engine
   renderings (`'x'::text`, `CAST('t' AS BOOLEAN)`, `CURRENT_TIMESTAMP` vs
   `now()`) by manifest type; an unclassifiable rendering skips the comparison

package/dist/change-feed-sensitivity.d.ts

@@ -0,0 +1,155 @@
+/**
+ * Credential-bearing tables the change feed must never disclose (issue #2937).
+ *
+ * The feed records `{table, rowId, operation, tenantId}` for every observable
+ * table, and the generated `/_changes` and `/_events` routes gate on nothing
+ * but the presence of an authenticated principal — there is no per-table
+ * permission check. That is fine for domain data, which is what the routes are
+ * for, and a disclosure for any table whose **row id is itself a credential**.
+ *
+ * `@happyvertical/smrt-users`' `Session` is exactly that: `createSession()`
+ * returns the row id, that value is the `sid` cookie and the `accessToken`
+ * `TerminalAuthService` hands a device, and `loadSessionContext()` re-saves the
+ * row on every authenticated request — so every live session id was being
+ * rewritten into the feed continuously, where the lowest-privileged
+ * authenticated caller could read it and replay it.
+ *
+ * ## The rule
+ *
+ * A table is *sensitive* when it is named by {@link CHANGE_FEED_CREDENTIAL_TABLES}
+ * or when some registered class declared `@smrt({ sensitive: true })` for it.
+ * Sensitive tables are not observable: they are refused on the write path, on
+ * the live-signal path, and — because an earlier build already wrote their ids
+ * into existing databases — on the **read** path, so upgrading is sufficient
+ * and no operator has to purge anything by hand.
+ *
+ * ## Why both a declared marker and a baseline list
+ *
+ * The declared marker is the contract a package uses to make its own claim, and
+ * it travels with the class through the scanner, the manifest and the registry.
+ * It is not sufficient on its own, because it only takes effect in a process
+ * where the owning package actually registered: a worker that loaded only core,
+ * a replica still running yesterday's `smrt-users`, or a read-only handle
+ * serving `/_changes` for a database some other process writes. The baseline
+ * list is what makes the rule hold in those processes too — it is a property of
+ * the *name*, which is all the read path has.
+ *
+ * The set is therefore **monotonic**: names are added and never removed, and
+ * nothing here can be turned off by configuration. A consumer whose own domain
+ * table is named `sessions` or `api_keys` loses change-feed coverage for it;
+ * that is the deliberate direction to fail in, and the fix is to name the table
+ * something else (`@smrt({ tableName })`), not to weaken the rule.
+ *
+ * This module is a leaf on purpose — it imports nothing — so both
+ * `change-feed.ts` and `change-signals.ts` can consult it, and the registry can
+ * populate it at registration time, without an import cycle.
+ *
+ * ## Why the set lives on `globalThis`
+ *
+ * For the same reason `ObjectRegistry` does (see `packages/core/AGENTS.md`):
+ * this is a process-wide append-only registry written by one module (class
+ * registration) and read by others (the feed writer, the feed reader, the
+ * signal bus). A dev server's HMR reload, or a build that resolves two copies
+ * of `@happyvertical/smrt-core` (hoisting mismatch, dual ESM/CJS entry,
+ * bundler duplication), gives this file two module instances — and a
+ * module-scope `Set` would then take a class's declaration in one instance
+ * while the guards read the other's. The baseline names survive that, because
+ * every instance re-seeds them from the same static array; a
+ * **consumer-declared** table would not, and it would fail open silently, with
+ * nothing logged. One shared `globalThis` slot removes the divergence.
+ */
+declare global {
+    var __smrtChangeFeedSensitiveTables: Set<string> | undefined;
+}
+/**
+ * Framework tables whose row id or stored payload is secret, by name.
+ *
+ * Audited for #2937 across `@happyvertical/smrt-users` and
+ * `@happyvertical/smrt-profiles`:
+ *
+ * - `sessions` — the row **id is the bearer credential** (`sid` cookie value,
+ *   terminal-auth `accessToken`).
+ * - `users_cli_auth_requests` — device-code state: a plaintext `userCode` an
+ *   approver can exchange, a `deviceCodeHash`, and the `sessionId` minted on
+ *   approval.
+ * - `users_magic_link_tokens` / `magic_link_tokens` — the replay-protection
+ *   nonce and the login-token hash a `verify()` looks up by.
+ * - `api_keys` — the API-key store (`keyHash`, `keyPrefix`, scopes).
+ * - `nostr_identities` — custodial private-key material (AES-256-GCM
+ *   ciphertext, IV and auth tag).
+ * - `secrets` / `tenant_keys` (`@happyvertical/smrt-secrets`) — tenant secret
+ *   ciphertext and the wrapped per-tenant data-encryption keys.
+ *
+ * The feed never carries column values, so for the hash-bearing tables what
+ * this withholds is the row id and the write timing — an enumeration handle
+ * onto a credential row, and a side channel that says when a credential was
+ * issued, used or rotated. Neither belongs on a route every authenticated
+ * principal can call.
+ */
+export declare const CHANGE_FEED_CREDENTIAL_TABLES: readonly string[];
+/**
+ * Mark `tableName` credential-bearing for the rest of the process.
+ *
+ * Called from class registration for every class declaring
+ * `@smrt({ sensitive: true })`. Idempotent, and deliberately one-way: a later
+ * registration of the same table under a different config cannot un-mark it,
+ * because a re-registration racing a read must not open the table back up.
+ */
+export declare function declareChangeFeedSensitiveTable(tableName: string): void;
+/** Whether `tableName` is credential-bearing and must never reach the feed. */
+export declare function isChangeFeedSensitiveTable(tableName: string): boolean;
+/**
+ * Every sensitive table name, sorted.
+ *
+ * Used by the read path to build its exclusion predicate, and by diagnostics
+ * that need to explain why a table reports no changes.
+ */
+export declare function getChangeFeedSensitiveTables(): string[];
+/**
+ * Resolves whether the class that produced an instance declared itself
+ * sensitive. Supplied by the registry; see
+ * {@link setChangeFeedSensitiveClassResolver}.
+ */
+export type ChangeFeedSensitiveClassResolver = (ctor: unknown) => boolean;
+/**
+ * Register the registry's class-level `sensitive` lookup (dependency
+ * inversion, exactly like the DispatchBus tenant resolver).
+ *
+ * ## Why the write path needs this and not just the name set
+ *
+ * Declaring by name at registration time assumes the name a class *declares*
+ * is the name its rows are *recorded* under. Registration derives that name
+ * from config and manifest, while the writer uses `instance.tableName`, which
+ * resolves through the STI base's schema and then the class's own. Those
+ * derivations are separate code, and where they disagree the declaration lands
+ * on a name nothing writes under while the real table keeps appending — a
+ * silent fail-open for exactly the consumer-declared tables the marker exists
+ * to protect.
+ *
+ * Measured, for the record: STI is **not** such a case today. `@smrt()`
+ * resolves an STI child to its base's table at registration, so a child
+ * declaring `sensitive: true` already declares `<base>` — verified against a
+ * real STI pair. The manifest-stub and manifest-merge paths derive the name
+ * differently again (`decoratorConfig` versus `objectDef.schema.tableName`),
+ * and registration now declares every candidate name to cover them.
+ *
+ * That list of candidates is still a list of guesses about someone else's
+ * derivation. This resolver is the authoritative check: the write path holds
+ * the instance, so it knows both the class and the exact `tableName` about to
+ * be recorded, with no derivation to keep in sync. It declares that name on the
+ * way past, which closes the read path and the signal bus for the same table.
+ *
+ * Kept in this leaf module so `change-feed.ts` never imports the registry —
+ * `class.ts` already imports `change-feed.ts`, so the reverse edge would be a
+ * cycle.
+ */
+export declare function setChangeFeedSensitiveClassResolver(resolver: ChangeFeedSensitiveClassResolver | undefined): void;
+/**
+ * Whether `tableName`, about to be recorded for an instance of `constructor`,
+ * is credential-bearing — by name, or because the class declared it.
+ *
+ * A class-declared hit also adds `tableName` to the set, so the read path and
+ * the signal bus refuse the same table from then on.
+ */
+export declare function isChangeFeedSensitiveWrite(tableName: string, ctor: unknown): boolean;
+//# sourceMappingURL=change-feed-sensitivity.d.ts.map

package/dist/change-feed-sensitivity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-feed-sensitivity.d.ts","sourceRoot":"","sources":["../src/change-feed-sensitivity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,CAAC,MAAM,CAAC;IAEb,IAAI,+BAA+B,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAS1D,CAAC;AAoBF;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAIvE;AAED,+EAA+E;AAC/E,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,IAAI,MAAM,EAAE,CAEvD;AAED;;;;GAIG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;AAI1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,gCAAgC,GAAG,SAAS,GACrD,IAAI,CAEN;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,GACZ,OAAO,CAcT"}

package/dist/change-feed-sensitivity.js

@@ -0,0 +1,139 @@
+//#region src/change-feed-sensitivity.ts
+/**
+* Framework tables whose row id or stored payload is secret, by name.
+*
+* Audited for #2937 across `@happyvertical/smrt-users` and
+* `@happyvertical/smrt-profiles`:
+*
+* - `sessions` — the row **id is the bearer credential** (`sid` cookie value,
+*   terminal-auth `accessToken`).
+* - `users_cli_auth_requests` — device-code state: a plaintext `userCode` an
+*   approver can exchange, a `deviceCodeHash`, and the `sessionId` minted on
+*   approval.
+* - `users_magic_link_tokens` / `magic_link_tokens` — the replay-protection
+*   nonce and the login-token hash a `verify()` looks up by.
+* - `api_keys` — the API-key store (`keyHash`, `keyPrefix`, scopes).
+* - `nostr_identities` — custodial private-key material (AES-256-GCM
+*   ciphertext, IV and auth tag).
+* - `secrets` / `tenant_keys` (`@happyvertical/smrt-secrets`) — tenant secret
+*   ciphertext and the wrapped per-tenant data-encryption keys.
+*
+* The feed never carries column values, so for the hash-bearing tables what
+* this withholds is the row id and the write timing — an enumeration handle
+* onto a credential row, and a side channel that says when a credential was
+* issued, used or rotated. Neither belongs on a route every authenticated
+* principal can call.
+*/
+var CHANGE_FEED_CREDENTIAL_TABLES = [
+	"sessions",
+	"users_cli_auth_requests",
+	"users_magic_link_tokens",
+	"magic_link_tokens",
+	"api_keys",
+	"nostr_identities",
+	"secrets",
+	"tenant_keys"
+];
+/**
+* The process-wide sensitive-table set, shared across every module instance.
+*
+* Seeded with the baseline on first access. A second module instance reaching
+* the already-created set re-adds the baseline names, which is a no-op for a
+* `Set` and keeps the invariant that the baseline is always present even if a
+* future edit changes the array.
+*/
+function sensitiveTableSet() {
+	let set = globalThis.__smrtChangeFeedSensitiveTables;
+	if (!set) {
+		set = /* @__PURE__ */ new Set();
+		globalThis.__smrtChangeFeedSensitiveTables = set;
+	}
+	for (const table of CHANGE_FEED_CREDENTIAL_TABLES) set.add(table);
+	return set;
+}
+/**
+* Mark `tableName` credential-bearing for the rest of the process.
+*
+* Called from class registration for every class declaring
+* `@smrt({ sensitive: true })`. Idempotent, and deliberately one-way: a later
+* registration of the same table under a different config cannot un-mark it,
+* because a re-registration racing a read must not open the table back up.
+*/
+function declareChangeFeedSensitiveTable(tableName) {
+	const name = tableName?.trim();
+	if (!name) return;
+	sensitiveTableSet().add(name);
+}
+/** Whether `tableName` is credential-bearing and must never reach the feed. */
+function isChangeFeedSensitiveTable(tableName) {
+	return Boolean(tableName) && sensitiveTableSet().has(tableName);
+}
+/**
+* Every sensitive table name, sorted.
+*
+* Used by the read path to build its exclusion predicate, and by diagnostics
+* that need to explain why a table reports no changes.
+*/
+function getChangeFeedSensitiveTables() {
+	return [...sensitiveTableSet()].sort();
+}
+var sensitiveClassResolver;
+/**
+* Register the registry's class-level `sensitive` lookup (dependency
+* inversion, exactly like the DispatchBus tenant resolver).
+*
+* ## Why the write path needs this and not just the name set
+*
+* Declaring by name at registration time assumes the name a class *declares*
+* is the name its rows are *recorded* under. Registration derives that name
+* from config and manifest, while the writer uses `instance.tableName`, which
+* resolves through the STI base's schema and then the class's own. Those
+* derivations are separate code, and where they disagree the declaration lands
+* on a name nothing writes under while the real table keeps appending — a
+* silent fail-open for exactly the consumer-declared tables the marker exists
+* to protect.
+*
+* Measured, for the record: STI is **not** such a case today. `@smrt()`
+* resolves an STI child to its base's table at registration, so a child
+* declaring `sensitive: true` already declares `<base>` — verified against a
+* real STI pair. The manifest-stub and manifest-merge paths derive the name
+* differently again (`decoratorConfig` versus `objectDef.schema.tableName`),
+* and registration now declares every candidate name to cover them.
+*
+* That list of candidates is still a list of guesses about someone else's
+* derivation. This resolver is the authoritative check: the write path holds
+* the instance, so it knows both the class and the exact `tableName` about to
+* be recorded, with no derivation to keep in sync. It declares that name on the
+* way past, which closes the read path and the signal bus for the same table.
+*
+* Kept in this leaf module so `change-feed.ts` never imports the registry —
+* `class.ts` already imports `change-feed.ts`, so the reverse edge would be a
+* cycle.
+*/
+function setChangeFeedSensitiveClassResolver(resolver) {
+	sensitiveClassResolver = resolver;
+}
+/**
+* Whether `tableName`, about to be recorded for an instance of `constructor`,
+* is credential-bearing — by name, or because the class declared it.
+*
+* A class-declared hit also adds `tableName` to the set, so the read path and
+* the signal bus refuse the same table from then on.
+*/
+function isChangeFeedSensitiveWrite(tableName, ctor) {
+	if (isChangeFeedSensitiveTable(tableName)) return true;
+	if (!ctor || !sensitiveClassResolver) return false;
+	let declared = false;
+	try {
+		declared = sensitiveClassResolver(ctor) === true;
+	} catch {
+		return false;
+	}
+	if (!declared) return false;
+	declareChangeFeedSensitiveTable(tableName);
+	return true;
+}
+//#endregion
+export { CHANGE_FEED_CREDENTIAL_TABLES, declareChangeFeedSensitiveTable, getChangeFeedSensitiveTables, isChangeFeedSensitiveTable, isChangeFeedSensitiveWrite, setChangeFeedSensitiveClassResolver };
+
+//# sourceMappingURL=change-feed-sensitivity.js.map

package/dist/change-feed-sensitivity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-feed-sensitivity.js","names":[],"sources":["../src/change-feed-sensitivity.ts"],"sourcesContent":["/**\n * Credential-bearing tables the change feed must never disclose (issue #2937).\n *\n * The feed records `{table, rowId, operation, tenantId}` for every observable\n * table, and the generated `/_changes` and `/_events` routes gate on nothing\n * but the presence of an authenticated principal — there is no per-table\n * permission check. That is fine for domain data, which is what the routes are\n * for, and a disclosure for any table whose **row id is itself a credential**.\n *\n * `@happyvertical/smrt-users`' `Session` is exactly that: `createSession()`\n * returns the row id, that value is the `sid` cookie and the `accessToken`\n * `TerminalAuthService` hands a device, and `loadSessionContext()` re-saves the\n * row on every authenticated request — so every live session id was being\n * rewritten into the feed continuously, where the lowest-privileged\n * authenticated caller could read it and replay it.\n *\n * ## The rule\n *\n * A table is *sensitive* when it is named by {@link CHANGE_FEED_CREDENTIAL_TABLES}\n * or when some registered class declared `@smrt({ sensitive: true })` for it.\n * Sensitive tables are not observable: they are refused on the write path, on\n * the live-signal path, and — because an earlier build already wrote their ids\n * into existing databases — on the **read** path, so upgrading is sufficient\n * and no operator has to purge anything by hand.\n *\n * ## Why both a declared marker and a baseline list\n *\n * The declared marker is the contract a package uses to make its own claim, and\n * it travels with the class through the scanner, the manifest and the registry.\n * It is not sufficient on its own, because it only takes effect in a process\n * where the owning package actually registered: a worker that loaded only core,\n * a replica still running yesterday's `smrt-users`, or a read-only handle\n * serving `/_changes` for a database some other process writes. The baseline\n * list is what makes the rule hold in those processes too — it is a property of\n * the *name*, which is all the read path has.\n *\n * The set is therefore **monotonic**: names are added and never removed, and\n * nothing here can be turned off by configuration. A consumer whose own domain\n * table is named `sessions` or `api_keys` loses change-feed coverage for it;\n * that is the deliberate direction to fail in, and the fix is to name the table\n * something else (`@smrt({ tableName })`), not to weaken the rule.\n *\n * This module is a leaf on purpose — it imports nothing — so both\n * `change-feed.ts` and `change-signals.ts` can consult it, and the registry can\n * populate it at registration time, without an import cycle.\n *\n * ## Why the set lives on `globalThis`\n *\n * For the same reason `ObjectRegistry` does (see `packages/core/AGENTS.md`):\n * this is a process-wide append-only registry written by one module (class\n * registration) and read by others (the feed writer, the feed reader, the\n * signal bus). A dev server's HMR reload, or a build that resolves two copies\n * of `@happyvertical/smrt-core` (hoisting mismatch, dual ESM/CJS entry,\n * bundler duplication), gives this file two module instances — and a\n * module-scope `Set` would then take a class's declaration in one instance\n * while the guards read the other's. The baseline names survive that, because\n * every instance re-seeds them from the same static array; a\n * **consumer-declared** table would not, and it would fail open silently, with\n * nothing logged. One shared `globalThis` slot removes the divergence.\n */\n\ndeclare global {\n  // eslint-disable-next-line no-var\n  var __smrtChangeFeedSensitiveTables: Set<string> | undefined;\n}\n\n/**\n * Framework tables whose row id or stored payload is secret, by name.\n *\n * Audited for #2937 across `@happyvertical/smrt-users` and\n * `@happyvertical/smrt-profiles`:\n *\n * - `sessions` — the row **id is the bearer credential** (`sid` cookie value,\n *   terminal-auth `accessToken`).\n * - `users_cli_auth_requests` — device-code state: a plaintext `userCode` an\n *   approver can exchange, a `deviceCodeHash`, and the `sessionId` minted on\n *   approval.\n * - `users_magic_link_tokens` / `magic_link_tokens` — the replay-protection\n *   nonce and the login-token hash a `verify()` looks up by.\n * - `api_keys` — the API-key store (`keyHash`, `keyPrefix`, scopes).\n * - `nostr_identities` — custodial private-key material (AES-256-GCM\n *   ciphertext, IV and auth tag).\n * - `secrets` / `tenant_keys` (`@happyvertical/smrt-secrets`) — tenant secret\n *   ciphertext and the wrapped per-tenant data-encryption keys.\n *\n * The feed never carries column values, so for the hash-bearing tables what\n * this withholds is the row id and the write timing — an enumeration handle\n * onto a credential row, and a side channel that says when a credential was\n * issued, used or rotated. Neither belongs on a route every authenticated\n * principal can call.\n */\nexport const CHANGE_FEED_CREDENTIAL_TABLES: readonly string[] = [\n  'sessions',\n  'users_cli_auth_requests',\n  'users_magic_link_tokens',\n  'magic_link_tokens',\n  'api_keys',\n  'nostr_identities',\n  'secrets',\n  'tenant_keys',\n];\n\n/**\n * The process-wide sensitive-table set, shared across every module instance.\n *\n * Seeded with the baseline on first access. A second module instance reaching\n * the already-created set re-adds the baseline names, which is a no-op for a\n * `Set` and keeps the invariant that the baseline is always present even if a\n * future edit changes the array.\n */\nfunction sensitiveTableSet(): Set<string> {\n  let set = globalThis.__smrtChangeFeedSensitiveTables;\n  if (!set) {\n    set = new Set<string>();\n    globalThis.__smrtChangeFeedSensitiveTables = set;\n  }\n  for (const table of CHANGE_FEED_CREDENTIAL_TABLES) set.add(table);\n  return set;\n}\n\n/**\n * Mark `tableName` credential-bearing for the rest of the process.\n *\n * Called from class registration for every class declaring\n * `@smrt({ sensitive: true })`. Idempotent, and deliberately one-way: a later\n * registration of the same table under a different config cannot un-mark it,\n * because a re-registration racing a read must not open the table back up.\n */\nexport function declareChangeFeedSensitiveTable(tableName: string): void {\n  const name = tableName?.trim();\n  if (!name) return;\n  sensitiveTableSet().add(name);\n}\n\n/** Whether `tableName` is credential-bearing and must never reach the feed. */\nexport function isChangeFeedSensitiveTable(tableName: string): boolean {\n  return Boolean(tableName) && sensitiveTableSet().has(tableName);\n}\n\n/**\n * Every sensitive table name, sorted.\n *\n * Used by the read path to build its exclusion predicate, and by diagnostics\n * that need to explain why a table reports no changes.\n */\nexport function getChangeFeedSensitiveTables(): string[] {\n  return [...sensitiveTableSet()].sort();\n}\n\n/**\n * Resolves whether the class that produced an instance declared itself\n * sensitive. Supplied by the registry; see\n * {@link setChangeFeedSensitiveClassResolver}.\n */\nexport type ChangeFeedSensitiveClassResolver = (ctor: unknown) => boolean;\n\nlet sensitiveClassResolver: ChangeFeedSensitiveClassResolver | undefined;\n\n/**\n * Register the registry's class-level `sensitive` lookup (dependency\n * inversion, exactly like the DispatchBus tenant resolver).\n *\n * ## Why the write path needs this and not just the name set\n *\n * Declaring by name at registration time assumes the name a class *declares*\n * is the name its rows are *recorded* under. Registration derives that name\n * from config and manifest, while the writer uses `instance.tableName`, which\n * resolves through the STI base's schema and then the class's own. Those\n * derivations are separate code, and where they disagree the declaration lands\n * on a name nothing writes under while the real table keeps appending — a\n * silent fail-open for exactly the consumer-declared tables the marker exists\n * to protect.\n *\n * Measured, for the record: STI is **not** such a case today. `@smrt()`\n * resolves an STI child to its base's table at registration, so a child\n * declaring `sensitive: true` already declares `<base>` — verified against a\n * real STI pair. The manifest-stub and manifest-merge paths derive the name\n * differently again (`decoratorConfig` versus `objectDef.schema.tableName`),\n * and registration now declares every candidate name to cover them.\n *\n * That list of candidates is still a list of guesses about someone else's\n * derivation. This resolver is the authoritative check: the write path holds\n * the instance, so it knows both the class and the exact `tableName` about to\n * be recorded, with no derivation to keep in sync. It declares that name on the\n * way past, which closes the read path and the signal bus for the same table.\n *\n * Kept in this leaf module so `change-feed.ts` never imports the registry —\n * `class.ts` already imports `change-feed.ts`, so the reverse edge would be a\n * cycle.\n */\nexport function setChangeFeedSensitiveClassResolver(\n  resolver: ChangeFeedSensitiveClassResolver | undefined,\n): void {\n  sensitiveClassResolver = resolver;\n}\n\n/**\n * Whether `tableName`, about to be recorded for an instance of `constructor`,\n * is credential-bearing — by name, or because the class declared it.\n *\n * A class-declared hit also adds `tableName` to the set, so the read path and\n * the signal bus refuse the same table from then on.\n */\nexport function isChangeFeedSensitiveWrite(\n  tableName: string,\n  ctor: unknown,\n): boolean {\n  if (isChangeFeedSensitiveTable(tableName)) return true;\n  if (!ctor || !sensitiveClassResolver) return false;\n  let declared = false;\n  try {\n    declared = sensitiveClassResolver(ctor) === true;\n  } catch {\n    // A resolver failure must never fail the user's write; the name set still\n    // covers every framework credential table.\n    return false;\n  }\n  if (!declared) return false;\n  declareChangeFeedSensitiveTable(tableName);\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA2FA,IAAa,gCAAmD;CAC9D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;;AAUA,SAAS,oBAAiC;CACxC,IAAI,MAAM,WAAW;CACrB,IAAI,CAAC,KAAK;EACR,sBAAM,IAAI,IAAY;EACtB,WAAW,kCAAkC;CAC/C;CACA,KAAK,MAAM,SAAS,+BAA+B,IAAI,IAAI,KAAK;CAChE,OAAO;AACT;;;;;;;;;AAUA,SAAgB,gCAAgC,WAAyB;CACvE,MAAM,OAAO,WAAW,KAAK;CAC7B,IAAI,CAAC,MAAM;CACX,kBAAkB,CAAC,CAAC,IAAI,IAAI;AAC9B;;AAGA,SAAgB,2BAA2B,WAA4B;CACrE,OAAO,QAAQ,SAAS,KAAK,kBAAkB,CAAC,CAAC,IAAI,SAAS;AAChE;;;;;;;AAQA,SAAgB,+BAAyC;CACvD,OAAO,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,KAAK;AACvC;AASA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCJ,SAAgB,oCACd,UACM;CACN,yBAAyB;AAC3B;;;;;;;;AASA,SAAgB,2BACd,WACA,MACS;CACT,IAAI,2BAA2B,SAAS,GAAG,OAAO;CAClD,IAAI,CAAC,QAAQ,CAAC,wBAAwB,OAAO;CAC7C,IAAI,WAAW;CACf,IAAI;EACF,WAAW,uBAAuB,IAAI,MAAM;CAC9C,QAAQ;EAGN,OAAO;CACT;CACA,IAAI,CAAC,UAAU,OAAO;CACtB,gCAAgC,SAAS;CACzC,OAAO;AACT"}

package/dist/change-feed.d.ts

@@ -16,13 +16,24 @@ export declare const CHANGE_FEED_TABLE = "_smrt_changes";
  * the feed's own table so it can never observe itself), the model-backed
  * operational plumbing ({@link FRAMEWORK_OPERATIONAL_TABLES}), and the retired
  * system tables that may still exist on older databases.
+ *
+ * Credential-bearing *application* tables are excluded separately, because
+ * that set grows at registration time rather than being fixed at module load
+ * — see {@link isChangeFeedSensitiveTable} and `change-feed-sensitivity.ts`
+ * (#2937).
  */
 export declare const CHANGE_FEED_EXCLUDED_TABLES: ReadonlySet<string>;
 /**
  * Whether framework writes to `tableName` are recorded in the change feed.
  *
+ * Two reasons a table is not observable: it is framework bookkeeping
+ * ({@link CHANGE_FEED_EXCLUDED_TABLES}), or it is credential-bearing
+ * ({@link isChangeFeedSensitiveTable}, #2937). The second is evaluated live
+ * rather than folded into the frozen set above, because a class declaring
+ * `@smrt({ sensitive: true })` registers after this module loads.
+ *
  * Exported so tooling and tests can reason about feed coverage without
- * re-deriving the rule. See {@link CHANGE_FEED_EXCLUDED_TABLES}.
+ * re-deriving the rule.
  */
 export declare function isChangeFeedObservableTable(tableName: string): boolean;
 /** Interceptor name of the framework's change-feed writer. */
@@ -227,15 +238,6 @@ export declare function ensureChangeFeedTable(db: DatabaseInterface): Promise<vo
  * handle from interleaving inside a manual SAVEPOINT scope.
  */
 export declare function appendChange(db: DatabaseInterface, input: AppendChangeInput): Promise<number | null>;
-/**
- * Append a mutation batch with one feed row per input entry.
- *
- * The batch is deliberately one statement per supported dialect.  In
- * particular, PostgreSQL enters the existing append helper from one
- * framework-owned function call, so a caller transaction still stages every
- * entry, preserves rollback/failure isolation, and never waits on the feed
- * head.  Direct batches allocate contiguous sequences in input order.
- */
 export declare function appendChanges(db: DatabaseInterface, inputs: AppendChangeBatch): Promise<Array<number | null>>;
 /**
  * Sequence change-feed entries staged inside caller-managed transactions
@@ -374,6 +376,31 @@ export declare function getTenantScopedChangesSince(db: DatabaseInterface, optio
  * high-water mark that survives pruning would remove even that cost; it is a
  * deliberate follow-up, out of scope for this slice.
  *
+ * ## Tables the feed does not observe (#2937)
+ *
+ * The whole contract above — "any write to the table appends a new sequence
+ * strictly greater than every previously-observed value" — rests on the table
+ * being recorded at all. For a credential-bearing table it is not, so there is
+ * no version to compute: the value would pin at whatever an older build last
+ * wrote, then fall back to the global horizon, which only moves when some
+ * *other* table writes. A client revalidating with `If-None-Match` would be
+ * answered `304` for a revoked API key, a rotated session or a changed
+ * identity, and stay stale until unrelated traffic happened to bump the
+ * horizon — a silent stale read of security state.
+ *
+ * Such a table therefore gets a deliberately **unrepeatable** value, so every
+ * ETag derived from it is fresh and no *concrete* `If-None-Match` can match.
+ * Those reads cost a full response every time, which is the correct trade for
+ * a credential store, and the caller needs no special case: this is the one
+ * place every ETag path (the runtime `APIGenerator`, the generated SvelteKit
+ * `conditionalVersionedRead`, and route files already emitted by an older
+ * generator) goes through.
+ *
+ * A wildcard `If-None-Match: *` still yields `304`, and deliberately so: the
+ * read paths evaluate it only *after* the payload is built, so it distinguishes
+ * nothing beyond 200-versus-404 — which an unconditional request reveals too —
+ * and it carries no stale representation.
+ *
  * Idempotently ensures the feed table exists first, so it is safe to call from
  * a read route on a raw handle that has never been written to.
  */

package/dist/change-feed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change-feed.d.ts","sourceRoot":"","sources":["../src/change-feed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkIG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAS5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuB9C,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAQ1D,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B,qBAAqB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE7D,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,yFAAyF;IACzF,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8DAA8D;IAC9D,SAAS,EAAE,eAAe,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;;OAWG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gDAAgD;IAChD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,SAAS,iBAAiB,EAAE,CAAC;AAE7D,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,OAAQ,CAAC;AAiUvC;;;;;;;;;;;GAWG;AACH,wBAAsB,sCAAsC,CAC1D,EAAE,EAAE,iBAAiB,EACrB,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACd,GACL,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,+BAA+B,CACnD,EAAE,EAAE,iBAAiB,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,iBAAiB,GACpB,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiIxB;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,EAAE,EAAE,iBAAiB,EACrB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAsG/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,eAAe,CAAC,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAE5E;AAyRD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAGf;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,cAAc,CAAC,CAiJzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,GAC3C,OAAO,CAAC,cAAc,CAAC,CAMzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CA8CjB;AA4BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAyF7B;AA4BD,eAAO,MAAM,6BAA6B,gCAAgC,CAAC;AAW3E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CA4D/C;AAED,uDAAuD;AACvD,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAiED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,SAAS;IAAE,QAAQ,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,EAAE,GACvE,OAAO,CAAC,IAAI,CAAC,CA0Df;AAED,gFAAgF;AAChF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,UAAU,EACpB,SAAS,GAAE,eAA0B,GACpC,OAAO,CAAC,IAAI,CAAC,CAEf;AA8DD;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAS9C"}
+{"version":3,"file":"change-feed.d.ts","sourceRoot":"","sources":["../src/change-feed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkIG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAc5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuB9C,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAQ1D,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAMtE;AAED,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B,qBAAqB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE7D,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,yFAAyF;IACzF,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8DAA8D;IAC9D,SAAS,EAAE,eAAe,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;;OAWG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gDAAgD;IAChD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,SAAS,iBAAiB,EAAE,CAAC;AAE7D,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,OAAQ,CAAC;AAiUvC;;;;;;;;;;;GAWG;AACH,wBAAsB,sCAAsC,CAC1D,EAAE,EAAE,iBAAiB,EACrB,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACd,GACL,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,+BAA+B,CACnD,EAAE,EAAE,iBAAiB,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,iBAAiB,GACpB,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyIxB;AA+BD,wBAAsB,aAAa,CACjC,EAAE,EAAE,iBAAiB,EACrB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CA6H/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,eAAe,CAAC,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAE5E;AAyRD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAGf;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,cAAc,CAAC,CA8KzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,GAC3C,OAAO,CAAC,cAAc,CAAC,CAMzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAgEjB;AA6CD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA8J7B;AA4BD,eAAO,MAAM,6BAA6B,gCAAgC,CAAC;AAW3E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CA4D/C;AAED,uDAAuD;AACvD,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAwED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,SAAS;IAAE,QAAQ,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,EAAE,GACvE,OAAO,CAAC,IAAI,CAAC,CA6Df;AAED,gFAAgF;AAChF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,UAAU,EACpB,SAAS,GAAE,eAA0B,GACpC,OAAO,CAAC,IAAI,CAAC,CAEf;AA8DD;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAS9C"}