@happyvertical/smrt-core 0.51.28 → 0.51.32

package/dist/change-feed-authz.d.ts

@@ -0,0 +1,141 @@
+import { DatabaseInterface } from '@happyvertical/sql';
+import { ChangeFeedPage, GetChangesOptions } from './change-feed.js';
+/**
+ * Minimal shape shared by a durable {@link ChangeFeedEntry} (`change-feed.ts`)
+ * and a live `ChangeSignal` (`change-signals.ts`) — both carry exactly
+ * table/row/operation/tenant/seq and nothing else observable, so one
+ * visibility hook covers catch-up entries and live signals alike.
+ */
+export interface ChangeFeedVisibilityEntry {
+    table: string;
+    rowId: string | null;
+    operation: string;
+    tenantId: string | null;
+    seq: number;
+}
+/**
+ * The requesting principal's context, common to both hooks. `locals` is
+ * SvelteKit's `event.locals`, or `undefined` on the REST transport (which has
+ * no `locals` concept). `request` is the SvelteKit route's `event.request`,
+ * or the REST route's `authMiddleware`-processed `Request` — a
+ * REST-hosting consumer identifies the principal from `request`, since
+ * `locals` is never populated there. Every generated route supplies
+ * `request`; it is optional only so a low-level unit test can omit it.
+ */
+export interface ChangeFeedRequestContext {
+    locals: unknown;
+    request?: Request;
+}
+/** Input to the table-level {@link ChangeFeedTableAuthorizer} hook. */
+export interface ChangeFeedTableAuthorizationRequest extends ChangeFeedRequestContext {
+    /**
+     * The client's `?tables=` filter, or `undefined` when it named none (the
+     * unrestricted default). On `_events`, which has no `?tables=` param, this
+     * is always `undefined` — the hook's answer alone bounds what the
+     * connection may ever see.
+     */
+    tables: string[] | undefined;
+}
+/**
+ * Table-level change-feed authorization hook (#3020). Returns the tables the
+ * requester may read from the feed at all; a table it does not name is denied
+ * regardless of the client's own `?tables=` filter. Register with
+ * {@link setChangeFeedAuthorizer}.
+ */
+export type ChangeFeedTableAuthorizer = (request: ChangeFeedTableAuthorizationRequest) => string[] | Promise<string[]>;
+/** Input to the row-level {@link ChangeFeedEntryVisibility} hook. */
+export interface ChangeFeedEntryVisibilityRequest extends ChangeFeedRequestContext {
+    entry: ChangeFeedVisibilityEntry;
+}
+/**
+ * Row-level change-feed visibility hook (#3020), for scope narrower than a
+ * whole table (a station sees only its own rows). Register with
+ * {@link setChangeFeedEntryVisibility}.
+ */
+export type ChangeFeedEntryVisibility = (request: ChangeFeedEntryVisibilityRequest) => boolean | Promise<boolean>;
+declare global {
+    var __smrtChangeFeedTableAuthorizer: ChangeFeedTableAuthorizer | undefined;
+    var __smrtChangeFeedEntryVisibility: ChangeFeedEntryVisibility | undefined;
+}
+/**
+ * Register the table-level change-feed authorization hook used by both
+ * generated routes. `undefined` clears it, restoring the pre-#3020 default
+ * (tenant-scoped only, no per-table check).
+ */
+export declare function setChangeFeedAuthorizer(authorizeChangeFeed: ChangeFeedTableAuthorizer | undefined): void;
+/**
+ * Register the row-level change-feed visibility hook used by both generated
+ * routes. `undefined` clears it (every table-authorized row is visible).
+ */
+export declare function setChangeFeedEntryVisibility(isChangeFeedEntryVisible: ChangeFeedEntryVisibility | undefined): void;
+/** Whether a table authorizer is currently registered. */
+export declare function hasChangeFeedTableAuthorizerHook(): boolean;
+/** Whether a row visibility hook is currently registered. */
+export declare function hasChangeFeedEntryVisibilityHook(): boolean;
+/**
+ * Whether a resolved allow-list means "match no tables" (an explicit empty
+ * array — every table was denied or no hook answer was authorized) as
+ * opposed to `undefined` (no hook registered — unchanged "no filter"
+ * default). Callers pass this through to `getChangesSince`'s
+ * `denyAllTables` option rather than an empty `tables` array — see the
+ * module docs' "Cursor correctness" section for why.
+ */
+export declare function isChangeFeedDenyAll(tables: string[] | undefined): boolean;
+/**
+ * Resolve the tables a request may read from the feed: the registered
+ * {@link ChangeFeedTableAuthorizer}'s answer intersected with the client's
+ * own `?tables=` filter (never widened by it). Returns `requestedTables`
+ * unchanged when no hook is registered — the unmodified default behavior —
+ * EXCEPT that an explicit empty `requestedTables` (`tables: []`) is
+ * normalized to `undefined`: `getChangesSince` (and this module's own
+ * {@link isChangeFeedDenyAll}) treat an omitted filter and an empty one as
+ * equivalent "no filter", so with no hook registered to actually narrow
+ * anything, a client-sent `tables: []` must stay a no-op rather than being
+ * read as "deny every table" (#3020 Copilot follow-up).
+ *
+ * Once a hook is registered, the result is always an explicit array (possibly
+ * empty): a throwing or malformed hook fails closed to `[]` (logged, never
+ * surfaced as a 5xx — see module docs). A returned table name that is not
+ * {@link isValidChangeFeedTableName} (at minimum: contains a NUL byte, or is
+ * empty) is treated the same way — the hook's own answer must never be able
+ * to reach the database with an unusable value.
+ */
+export declare function resolveAuthorizedChangeFeedTables(ctx: ChangeFeedRequestContext, requestedTables: string[] | undefined): Promise<string[] | undefined>;
+/**
+ * Whether `entry` is visible to the requester under the registered
+ * {@link ChangeFeedEntryVisibility} hook. `true` (visible) when no hook is
+ * registered — the unmodified default. A throwing or non-boolean hook fails
+ * closed to `false` (hidden), never falls back to visible.
+ */
+export declare function isChangeFeedEntryVisible(ctx: ChangeFeedRequestContext, entry: ChangeFeedVisibilityEntry): Promise<boolean>;
+/**
+ * {@link isChangeFeedEntryVisible}, applied to a page of entries in order.
+ * Returns `entries` unchanged (same array reference) when no hook is
+ * registered.
+ */
+export declare function filterVisibleChangeFeedEntries<T extends ChangeFeedVisibilityEntry>(ctx: ChangeFeedRequestContext, entries: readonly T[]): Promise<T[]>;
+interface AuthorizedChangesInput extends Omit<GetChangesOptions, 'tables' | 'denyAllTables'>, ChangeFeedRequestContext {
+    tables?: string[];
+}
+/**
+ * {@link getChangesSince}, additionally applying the registered table and
+ * row-level authorization hooks (#3020). Used where the tenant filter (if
+ * any) is resolved by the caller rather than the active DispatchBus context —
+ * the `_events` catch-up replay (both transports), which captures its tenant
+ * scope once at connection open, and the REST `_changes` route, which has no
+ * DispatchBus tenant context of its own to resolve.
+ */
+export declare function getAuthorizedChangesSince(db: DatabaseInterface, options: AuthorizedChangesInput): Promise<ChangeFeedPage>;
+/**
+ * {@link getTenantScopedChangesSince}, additionally applying the registered
+ * table and row-level authorization hooks (#3020). This is what the
+ * generated SvelteKit `_changes` route calls.
+ *
+ * Table authorization narrows `tables` BEFORE the query runs (a denied table
+ * is never queried, let alone returned); row visibility filters the fetched
+ * page's `changes` AFTER. Neither touches `cursor`/`resyncRequired`/
+ * `resyncCursor` — see the module docs' "Cursor correctness" section.
+ */
+export declare function getAuthorizedTenantScopedChangesSince(db: DatabaseInterface, options: Omit<AuthorizedChangesInput, 'tenantId'>): Promise<ChangeFeedPage>;
+export {};
+//# sourceMappingURL=change-feed-authz.d.ts.map

package/dist/change-feed-authz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-feed-authz.d.ts","sourceRoot":"","sources":["../src/change-feed-authz.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,iBAAiB,EAGvB,MAAM,kBAAkB,CAAC;AAI1B;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,uEAAuE;AACvE,MAAM,WAAW,mCACf,SAAQ,wBAAwB;IAChC;;;;;OAKG;IACH,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG,CACtC,OAAO,EAAE,mCAAmC,KACzC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAElC,qEAAqE;AACrE,MAAM,WAAW,gCACf,SAAQ,wBAAwB;IAChC,KAAK,EAAE,yBAAyB,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG,CACtC,OAAO,EAAE,gCAAgC,KACtC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,OAAO,CAAC,MAAM,CAAC;IAEb,IAAI,+BAA+B,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAE3E,IAAI,+BAA+B,EAAE,yBAAyB,GAAG,SAAS,CAAC;CAC5E;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,mBAAmB,EAAE,yBAAyB,GAAG,SAAS,GACzD,IAAI,CAEN;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,wBAAwB,EAAE,yBAAyB,GAAG,SAAS,GAC9D,IAAI,CAEN;AAED,0DAA0D;AAC1D,wBAAgB,gCAAgC,IAAI,OAAO,CAE1D;AAED,6DAA6D;AAC7D,wBAAgB,gCAAgC,IAAI,OAAO,CAE1D;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAEzE;AAeD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,iCAAiC,CACrD,GAAG,EAAE,wBAAwB,EAC7B,eAAe,EAAE,MAAM,EAAE,GAAG,SAAS,GACpC,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAiC/B;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,wBAAwB,EAC7B,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,CAClD,CAAC,SAAS,yBAAyB,EACnC,GAAG,EAAE,wBAAwB,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CASpE;AAED,UAAU,sBACR,SAAQ,IAAI,CAAC,iBAAiB,EAAE,QAAQ,GAAG,eAAe,CAAC,EACzD,wBAAwB;IAC1B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AA8BD;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,cAAc,CAAC,CAYzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,qCAAqC,CACzD,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,IAAI,CAAC,sBAAsB,EAAE,UAAU,CAAC,GAChD,OAAO,CAAC,cAAc,CAAC,CAYzB"}

package/dist/change-feed-authz.js

@@ -0,0 +1,260 @@
+import { getChangesSince, getTenantScopedChangesSince } from "./change-feed.js";
+import { createLogger } from "@happyvertical/logger";
+//#region src/change-feed-authz.ts
+/**
+* Change-feed table/row authorization seam (issue #3020).
+*
+* The generated `_changes`/`_events` routes authorize on "an authenticated
+* principal" plus tenant scope (`getTenantScopedChangesSince`,
+* `resolveDispatchTenantScope`) — see `change-feed-sensitivity.ts`'s scope
+* note. That is enough to keep one tenant from seeing another's rows, but it
+* cannot express "table X is readable by some principals of the tenant but
+* not others" or "principal P only sees their own rows of table X" (a
+* bay-tablet station versus the back office). `?tables=` was a client-chosen
+* filter, never enforcement: a table the client did not ask for was withheld
+* only because it did not ask, not because it could not have.
+*
+* This module is the consumer-supplied seam that closes that gap, evaluated
+* identically by **every** transport — the generated SvelteKit `_changes`/
+* `_events` routes AND the runtime REST generator's `_changes`/`_events`
+* (`generators/changes-route.ts`, `generators/events-route.ts`) — so no
+* transport can leak what another denies. Two independent hooks,
+* dependency-inverted onto `globalThis` exactly like
+* {@link resolveDispatchTenantScope} (`dispatch/tenant-resolver.ts`) so a
+* consumer app registers them once — wherever it already calls
+* `enableTenancy()`, or its `hooks.server.ts` — with **no change to the
+* generated "DO NOT EDIT" route files' imports**:
+*
+* - `authorizeChangeFeed({ locals, request, tables }) => allowedTables` —
+*   table-level. Its result is INTERSECTED with the client's `?tables=`
+*   filter (never unioned): a table the hook does not name is never queried,
+*   let alone returned, regardless of what the client asked for.
+* - `isChangeFeedEntryVisible({ locals, request, entry }) => boolean` —
+*   row-level, for scope narrower than a whole table (a station sees only its
+*   own rows). Applied per entry, after the table-level filter, before
+*   anything is serialized to the client — including a live `_events` signal,
+*   which never carries a payload but still carries the row id and write
+*   timing the row hook exists to withhold.
+*
+* ## `locals` vs. `request`
+*
+* SvelteKit routes pass both `event.locals` and `event.request`. The REST
+* generator has no `locals` concept, so it passes `locals: undefined` and the
+* `authMiddleware`-processed `Request` (whatever properties/headers the
+* middleware attached) as `request` — a REST-hosting consumer identifies the
+* principal from `request`, not `locals`. Every real caller supplies
+* `request`; it is typed optional only so a low-level unit test can omit it.
+*
+* Both hooks are optional and independent. When neither is registered, every
+* transport behaves exactly as before (#1540 posture — authenticated +
+* tenant scoped only, no per-table or per-row check): every call in this
+* module is a synchronous no-op pass-through until a consumer opts in.
+*
+* ## Fail-closed
+*
+* A hook that throws, or returns something other than the documented shape,
+* is treated as authorizing nothing for that call — the same posture
+* {@link resolveDispatchTenantScope} takes for a throwing tenant resolver
+* (fail closed rather than fail the request), and the same *shape* of answer
+* (200, empty `changes`, cursor still advances) the change-feed sensitivity
+* filter (#2937) already gives a request naming only tables it may not see.
+* A 5xx here would tell a caller its own hook is broken, which is
+* indistinguishable from "your hook denied me" from the caller's side and
+* would leak that distinction; the contract that matters — never an
+* unfiltered feed — holds identically either way.
+*
+* ## Cursor correctness
+*
+* Every filter here narrows the *returned* `changes` array; nothing here ever
+* touches `cursor`/`resyncRequired`/`resyncCursor`. This mirrors #2937's
+* sensitivity filter (`change-feed.ts`, "Filters ... affect which rows are
+* returned, never how the cursor advances") and for the same reason: a
+* client must advance past a denied entry without re-polling it forever, and
+* the entry's row id/timing must never be inferable from a cursor that stalls
+* on it. Table denial is implemented via `getChangesSince`'s explicit
+* `denyAllTables` option rather than an empty `tables` array —
+* `getChangesSince` treats an omitted/empty `tables` as "no filter", so an
+* empty array would (perversely) widen the read to everything, and an
+* earlier version of this module instead passed a guaranteed-no-match
+* sentinel table name through the ordinary `table_name IN (...)` path; that
+* broke on PostgreSQL, which rejects a NUL byte in a text parameter, turning
+* a denied request into a 500 instead of the required 200 empty page. A
+* `denyAllTables` request skips the `IN (...)` clause entirely — no
+* synthesized value ever reaches the driver — while still running the same
+* horizon/pruned-cursor computation any other filter does, so the cursor
+* still advances correctly; it just matches zero rows.
+*/
+var logger = createLogger({ level: "info" });
+/**
+* Register the table-level change-feed authorization hook used by both
+* generated routes. `undefined` clears it, restoring the pre-#3020 default
+* (tenant-scoped only, no per-table check).
+*/
+function setChangeFeedAuthorizer(authorizeChangeFeed) {
+	globalThis.__smrtChangeFeedTableAuthorizer = authorizeChangeFeed;
+}
+/**
+* Register the row-level change-feed visibility hook used by both generated
+* routes. `undefined` clears it (every table-authorized row is visible).
+*/
+function setChangeFeedEntryVisibility(isChangeFeedEntryVisible) {
+	globalThis.__smrtChangeFeedEntryVisibility = isChangeFeedEntryVisible;
+}
+/** Whether a table authorizer is currently registered. */
+function hasChangeFeedTableAuthorizerHook() {
+	return globalThis.__smrtChangeFeedTableAuthorizer !== void 0;
+}
+/** Whether a row visibility hook is currently registered. */
+function hasChangeFeedEntryVisibilityHook() {
+	return globalThis.__smrtChangeFeedEntryVisibility !== void 0;
+}
+/**
+* Whether a resolved allow-list means "match no tables" (an explicit empty
+* array — every table was denied or no hook answer was authorized) as
+* opposed to `undefined` (no hook registered — unchanged "no filter"
+* default). Callers pass this through to `getChangesSince`'s
+* `denyAllTables` option rather than an empty `tables` array — see the
+* module docs' "Cursor correctness" section for why.
+*/
+function isChangeFeedDenyAll(tables) {
+	return tables !== void 0 && tables.length === 0;
+}
+/**
+* Whether `name` is a usable change-feed table name: a non-empty string
+* containing no NUL byte. A NUL byte is PostgreSQL's hard failure mode — it
+* rejects one outright in a text parameter — so a hook returning one would
+* otherwise reach the ordinary `table_name IN (...)` clause (built from the
+* hook's OWN answer, not a client-supplied value) and turn a legitimate
+* authorization decision into a 500 instead of the documented fail-closed
+* 200/empty contract. An empty string is equally never a real table name.
+*/
+function isValidChangeFeedTableName(name) {
+	return name.length > 0 && !name.includes("\0");
+}
+/**
+* Resolve the tables a request may read from the feed: the registered
+* {@link ChangeFeedTableAuthorizer}'s answer intersected with the client's
+* own `?tables=` filter (never widened by it). Returns `requestedTables`
+* unchanged when no hook is registered — the unmodified default behavior —
+* EXCEPT that an explicit empty `requestedTables` (`tables: []`) is
+* normalized to `undefined`: `getChangesSince` (and this module's own
+* {@link isChangeFeedDenyAll}) treat an omitted filter and an empty one as
+* equivalent "no filter", so with no hook registered to actually narrow
+* anything, a client-sent `tables: []` must stay a no-op rather than being
+* read as "deny every table" (#3020 Copilot follow-up).
+*
+* Once a hook is registered, the result is always an explicit array (possibly
+* empty): a throwing or malformed hook fails closed to `[]` (logged, never
+* surfaced as a 5xx — see module docs). A returned table name that is not
+* {@link isValidChangeFeedTableName} (at minimum: contains a NUL byte, or is
+* empty) is treated the same way — the hook's own answer must never be able
+* to reach the database with an unusable value.
+*/
+async function resolveAuthorizedChangeFeedTables(ctx, requestedTables) {
+	const authorizer = globalThis.__smrtChangeFeedTableAuthorizer;
+	if (!authorizer) return requestedTables && requestedTables.length === 0 ? void 0 : requestedTables;
+	let allowed;
+	try {
+		const result = await authorizer({
+			...ctx,
+			tables: requestedTables
+		});
+		if (!Array.isArray(result) || result.some((t) => typeof t !== "string" || !isValidChangeFeedTableName(t))) {
+			logger.error("authorizeChangeFeed() returned a non-string-array or invalid table name; failing closed to no tables");
+			return [];
+		}
+		allowed = result;
+	} catch (error) {
+		logger.error("authorizeChangeFeed() threw; failing closed to no tables", { error: error instanceof Error ? error.message : String(error) });
+		return [];
+	}
+	if (!requestedTables || requestedTables.length === 0) return allowed;
+	const allowedSet = new Set(allowed);
+	return requestedTables.filter((table) => allowedSet.has(table));
+}
+/**
+* Whether `entry` is visible to the requester under the registered
+* {@link ChangeFeedEntryVisibility} hook. `true` (visible) when no hook is
+* registered — the unmodified default. A throwing or non-boolean hook fails
+* closed to `false` (hidden), never falls back to visible.
+*/
+async function isChangeFeedEntryVisible(ctx, entry) {
+	const predicate = globalThis.__smrtChangeFeedEntryVisibility;
+	if (!predicate) return true;
+	try {
+		return await predicate({
+			...ctx,
+			entry
+		}) === true;
+	} catch (error) {
+		logger.error("isChangeFeedEntryVisible() threw; failing closed to hidden", { error: error instanceof Error ? error.message : String(error) });
+		return false;
+	}
+}
+/**
+* {@link isChangeFeedEntryVisible}, applied to a page of entries in order.
+* Returns `entries` unchanged (same array reference) when no hook is
+* registered.
+*/
+async function filterVisibleChangeFeedEntries(ctx, entries) {
+	if (entries.length === 0 || !globalThis.__smrtChangeFeedEntryVisibility) return entries;
+	const visible = [];
+	for (const entry of entries) if (await isChangeFeedEntryVisible(ctx, entry)) visible.push(entry);
+	return visible;
+}
+/** Shared implementation behind {@link getAuthorizedChangesSince} and {@link getAuthorizedTenantScopedChangesSince}. */
+async function readAuthorized(ctx, requestedTables, read) {
+	const effectiveTables = await resolveAuthorizedChangeFeedTables(ctx, requestedTables);
+	const denyAllTables = isChangeFeedDenyAll(effectiveTables);
+	const page = await read(denyAllTables ? void 0 : effectiveTables, denyAllTables);
+	if (page.changes.length === 0) return page;
+	const visibleChanges = await filterVisibleChangeFeedEntries(ctx, page.changes);
+	return visibleChanges.length === page.changes.length ? page : {
+		...page,
+		changes: visibleChanges
+	};
+}
+/**
+* {@link getChangesSince}, additionally applying the registered table and
+* row-level authorization hooks (#3020). Used where the tenant filter (if
+* any) is resolved by the caller rather than the active DispatchBus context —
+* the `_events` catch-up replay (both transports), which captures its tenant
+* scope once at connection open, and the REST `_changes` route, which has no
+* DispatchBus tenant context of its own to resolve.
+*/
+async function getAuthorizedChangesSince(db, options) {
+	const { locals, request, tables, ...rest } = options;
+	return readAuthorized({
+		locals,
+		request
+	}, tables, (effectiveTables, denyAllTables) => getChangesSince(db, {
+		...rest,
+		tables: effectiveTables,
+		denyAllTables
+	}));
+}
+/**
+* {@link getTenantScopedChangesSince}, additionally applying the registered
+* table and row-level authorization hooks (#3020). This is what the
+* generated SvelteKit `_changes` route calls.
+*
+* Table authorization narrows `tables` BEFORE the query runs (a denied table
+* is never queried, let alone returned); row visibility filters the fetched
+* page's `changes` AFTER. Neither touches `cursor`/`resyncRequired`/
+* `resyncCursor` — see the module docs' "Cursor correctness" section.
+*/
+async function getAuthorizedTenantScopedChangesSince(db, options) {
+	const { locals, request, tables, ...rest } = options;
+	return readAuthorized({
+		locals,
+		request
+	}, tables, (effectiveTables, denyAllTables) => getTenantScopedChangesSince(db, {
+		...rest,
+		tables: effectiveTables,
+		denyAllTables
+	}));
+}
+//#endregion
+export { filterVisibleChangeFeedEntries, getAuthorizedChangesSince, getAuthorizedTenantScopedChangesSince, hasChangeFeedEntryVisibilityHook, hasChangeFeedTableAuthorizerHook, isChangeFeedDenyAll, isChangeFeedEntryVisible, resolveAuthorizedChangeFeedTables, setChangeFeedAuthorizer, setChangeFeedEntryVisibility };
+
+//# sourceMappingURL=change-feed-authz.js.map

package/dist/change-feed-authz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-feed-authz.js","names":[],"sources":["../src/change-feed-authz.ts"],"sourcesContent":["/**\n * Change-feed table/row authorization seam (issue #3020).\n *\n * The generated `_changes`/`_events` routes authorize on \"an authenticated\n * principal\" plus tenant scope (`getTenantScopedChangesSince`,\n * `resolveDispatchTenantScope`) — see `change-feed-sensitivity.ts`'s scope\n * note. That is enough to keep one tenant from seeing another's rows, but it\n * cannot express \"table X is readable by some principals of the tenant but\n * not others\" or \"principal P only sees their own rows of table X\" (a\n * bay-tablet station versus the back office). `?tables=` was a client-chosen\n * filter, never enforcement: a table the client did not ask for was withheld\n * only because it did not ask, not because it could not have.\n *\n * This module is the consumer-supplied seam that closes that gap, evaluated\n * identically by **every** transport — the generated SvelteKit `_changes`/\n * `_events` routes AND the runtime REST generator's `_changes`/`_events`\n * (`generators/changes-route.ts`, `generators/events-route.ts`) — so no\n * transport can leak what another denies. Two independent hooks,\n * dependency-inverted onto `globalThis` exactly like\n * {@link resolveDispatchTenantScope} (`dispatch/tenant-resolver.ts`) so a\n * consumer app registers them once — wherever it already calls\n * `enableTenancy()`, or its `hooks.server.ts` — with **no change to the\n * generated \"DO NOT EDIT\" route files' imports**:\n *\n * - `authorizeChangeFeed({ locals, request, tables }) => allowedTables` —\n *   table-level. Its result is INTERSECTED with the client's `?tables=`\n *   filter (never unioned): a table the hook does not name is never queried,\n *   let alone returned, regardless of what the client asked for.\n * - `isChangeFeedEntryVisible({ locals, request, entry }) => boolean` —\n *   row-level, for scope narrower than a whole table (a station sees only its\n *   own rows). Applied per entry, after the table-level filter, before\n *   anything is serialized to the client — including a live `_events` signal,\n *   which never carries a payload but still carries the row id and write\n *   timing the row hook exists to withhold.\n *\n * ## `locals` vs. `request`\n *\n * SvelteKit routes pass both `event.locals` and `event.request`. The REST\n * generator has no `locals` concept, so it passes `locals: undefined` and the\n * `authMiddleware`-processed `Request` (whatever properties/headers the\n * middleware attached) as `request` — a REST-hosting consumer identifies the\n * principal from `request`, not `locals`. Every real caller supplies\n * `request`; it is typed optional only so a low-level unit test can omit it.\n *\n * Both hooks are optional and independent. When neither is registered, every\n * transport behaves exactly as before (#1540 posture — authenticated +\n * tenant scoped only, no per-table or per-row check): every call in this\n * module is a synchronous no-op pass-through until a consumer opts in.\n *\n * ## Fail-closed\n *\n * A hook that throws, or returns something other than the documented shape,\n * is treated as authorizing nothing for that call — the same posture\n * {@link resolveDispatchTenantScope} takes for a throwing tenant resolver\n * (fail closed rather than fail the request), and the same *shape* of answer\n * (200, empty `changes`, cursor still advances) the change-feed sensitivity\n * filter (#2937) already gives a request naming only tables it may not see.\n * A 5xx here would tell a caller its own hook is broken, which is\n * indistinguishable from \"your hook denied me\" from the caller's side and\n * would leak that distinction; the contract that matters — never an\n * unfiltered feed — holds identically either way.\n *\n * ## Cursor correctness\n *\n * Every filter here narrows the *returned* `changes` array; nothing here ever\n * touches `cursor`/`resyncRequired`/`resyncCursor`. This mirrors #2937's\n * sensitivity filter (`change-feed.ts`, \"Filters ... affect which rows are\n * returned, never how the cursor advances\") and for the same reason: a\n * client must advance past a denied entry without re-polling it forever, and\n * the entry's row id/timing must never be inferable from a cursor that stalls\n * on it. Table denial is implemented via `getChangesSince`'s explicit\n * `denyAllTables` option rather than an empty `tables` array —\n * `getChangesSince` treats an omitted/empty `tables` as \"no filter\", so an\n * empty array would (perversely) widen the read to everything, and an\n * earlier version of this module instead passed a guaranteed-no-match\n * sentinel table name through the ordinary `table_name IN (...)` path; that\n * broke on PostgreSQL, which rejects a NUL byte in a text parameter, turning\n * a denied request into a 500 instead of the required 200 empty page. A\n * `denyAllTables` request skips the `IN (...)` clause entirely — no\n * synthesized value ever reaches the driver — while still running the same\n * horizon/pruned-cursor computation any other filter does, so the cursor\n * still advances correctly; it just matches zero rows.\n */\n\nimport { createLogger } from '@happyvertical/logger';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport {\n  type ChangeFeedPage,\n  type GetChangesOptions,\n  getChangesSince,\n  getTenantScopedChangesSince,\n} from './change-feed.js';\n\nconst logger = createLogger({ level: 'info' });\n\n/**\n * Minimal shape shared by a durable {@link ChangeFeedEntry} (`change-feed.ts`)\n * and a live `ChangeSignal` (`change-signals.ts`) — both carry exactly\n * table/row/operation/tenant/seq and nothing else observable, so one\n * visibility hook covers catch-up entries and live signals alike.\n */\nexport interface ChangeFeedVisibilityEntry {\n  table: string;\n  rowId: string | null;\n  operation: string;\n  tenantId: string | null;\n  seq: number;\n}\n\n/**\n * The requesting principal's context, common to both hooks. `locals` is\n * SvelteKit's `event.locals`, or `undefined` on the REST transport (which has\n * no `locals` concept). `request` is the SvelteKit route's `event.request`,\n * or the REST route's `authMiddleware`-processed `Request` — a\n * REST-hosting consumer identifies the principal from `request`, since\n * `locals` is never populated there. Every generated route supplies\n * `request`; it is optional only so a low-level unit test can omit it.\n */\nexport interface ChangeFeedRequestContext {\n  locals: unknown;\n  request?: Request;\n}\n\n/** Input to the table-level {@link ChangeFeedTableAuthorizer} hook. */\nexport interface ChangeFeedTableAuthorizationRequest\n  extends ChangeFeedRequestContext {\n  /**\n   * The client's `?tables=` filter, or `undefined` when it named none (the\n   * unrestricted default). On `_events`, which has no `?tables=` param, this\n   * is always `undefined` — the hook's answer alone bounds what the\n   * connection may ever see.\n   */\n  tables: string[] | undefined;\n}\n\n/**\n * Table-level change-feed authorization hook (#3020). Returns the tables the\n * requester may read from the feed at all; a table it does not name is denied\n * regardless of the client's own `?tables=` filter. Register with\n * {@link setChangeFeedAuthorizer}.\n */\nexport type ChangeFeedTableAuthorizer = (\n  request: ChangeFeedTableAuthorizationRequest,\n) => string[] | Promise<string[]>;\n\n/** Input to the row-level {@link ChangeFeedEntryVisibility} hook. */\nexport interface ChangeFeedEntryVisibilityRequest\n  extends ChangeFeedRequestContext {\n  entry: ChangeFeedVisibilityEntry;\n}\n\n/**\n * Row-level change-feed visibility hook (#3020), for scope narrower than a\n * whole table (a station sees only its own rows). Register with\n * {@link setChangeFeedEntryVisibility}.\n */\nexport type ChangeFeedEntryVisibility = (\n  request: ChangeFeedEntryVisibilityRequest,\n) => boolean | Promise<boolean>;\n\ndeclare global {\n  // eslint-disable-next-line no-var\n  var __smrtChangeFeedTableAuthorizer: ChangeFeedTableAuthorizer | undefined;\n  // eslint-disable-next-line no-var\n  var __smrtChangeFeedEntryVisibility: ChangeFeedEntryVisibility | undefined;\n}\n\n/**\n * Register the table-level change-feed authorization hook used by both\n * generated routes. `undefined` clears it, restoring the pre-#3020 default\n * (tenant-scoped only, no per-table check).\n */\nexport function setChangeFeedAuthorizer(\n  authorizeChangeFeed: ChangeFeedTableAuthorizer | undefined,\n): void {\n  globalThis.__smrtChangeFeedTableAuthorizer = authorizeChangeFeed;\n}\n\n/**\n * Register the row-level change-feed visibility hook used by both generated\n * routes. `undefined` clears it (every table-authorized row is visible).\n */\nexport function setChangeFeedEntryVisibility(\n  isChangeFeedEntryVisible: ChangeFeedEntryVisibility | undefined,\n): void {\n  globalThis.__smrtChangeFeedEntryVisibility = isChangeFeedEntryVisible;\n}\n\n/** Whether a table authorizer is currently registered. */\nexport function hasChangeFeedTableAuthorizerHook(): boolean {\n  return globalThis.__smrtChangeFeedTableAuthorizer !== undefined;\n}\n\n/** Whether a row visibility hook is currently registered. */\nexport function hasChangeFeedEntryVisibilityHook(): boolean {\n  return globalThis.__smrtChangeFeedEntryVisibility !== undefined;\n}\n\n/**\n * Whether a resolved allow-list means \"match no tables\" (an explicit empty\n * array — every table was denied or no hook answer was authorized) as\n * opposed to `undefined` (no hook registered — unchanged \"no filter\"\n * default). Callers pass this through to `getChangesSince`'s\n * `denyAllTables` option rather than an empty `tables` array — see the\n * module docs' \"Cursor correctness\" section for why.\n */\nexport function isChangeFeedDenyAll(tables: string[] | undefined): boolean {\n  return tables !== undefined && tables.length === 0;\n}\n\n/**\n * Whether `name` is a usable change-feed table name: a non-empty string\n * containing no NUL byte. A NUL byte is PostgreSQL's hard failure mode — it\n * rejects one outright in a text parameter — so a hook returning one would\n * otherwise reach the ordinary `table_name IN (...)` clause (built from the\n * hook's OWN answer, not a client-supplied value) and turn a legitimate\n * authorization decision into a 500 instead of the documented fail-closed\n * 200/empty contract. An empty string is equally never a real table name.\n */\nfunction isValidChangeFeedTableName(name: string): boolean {\n  return name.length > 0 && !name.includes('\\u0000');\n}\n\n/**\n * Resolve the tables a request may read from the feed: the registered\n * {@link ChangeFeedTableAuthorizer}'s answer intersected with the client's\n * own `?tables=` filter (never widened by it). Returns `requestedTables`\n * unchanged when no hook is registered — the unmodified default behavior —\n * EXCEPT that an explicit empty `requestedTables` (`tables: []`) is\n * normalized to `undefined`: `getChangesSince` (and this module's own\n * {@link isChangeFeedDenyAll}) treat an omitted filter and an empty one as\n * equivalent \"no filter\", so with no hook registered to actually narrow\n * anything, a client-sent `tables: []` must stay a no-op rather than being\n * read as \"deny every table\" (#3020 Copilot follow-up).\n *\n * Once a hook is registered, the result is always an explicit array (possibly\n * empty): a throwing or malformed hook fails closed to `[]` (logged, never\n * surfaced as a 5xx — see module docs). A returned table name that is not\n * {@link isValidChangeFeedTableName} (at minimum: contains a NUL byte, or is\n * empty) is treated the same way — the hook's own answer must never be able\n * to reach the database with an unusable value.\n */\nexport async function resolveAuthorizedChangeFeedTables(\n  ctx: ChangeFeedRequestContext,\n  requestedTables: string[] | undefined,\n): Promise<string[] | undefined> {\n  const authorizer = globalThis.__smrtChangeFeedTableAuthorizer;\n  if (!authorizer) {\n    return requestedTables && requestedTables.length === 0\n      ? undefined\n      : requestedTables;\n  }\n\n  let allowed: string[];\n  try {\n    const result = await authorizer({ ...ctx, tables: requestedTables });\n    if (\n      !Array.isArray(result) ||\n      result.some(\n        (t) => typeof t !== 'string' || !isValidChangeFeedTableName(t),\n      )\n    ) {\n      logger.error(\n        'authorizeChangeFeed() returned a non-string-array or invalid table name; failing closed to no tables',\n      );\n      return [];\n    }\n    allowed = result;\n  } catch (error) {\n    logger.error('authorizeChangeFeed() threw; failing closed to no tables', {\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return [];\n  }\n\n  if (!requestedTables || requestedTables.length === 0) return allowed;\n  const allowedSet = new Set(allowed);\n  return requestedTables.filter((table) => allowedSet.has(table));\n}\n\n/**\n * Whether `entry` is visible to the requester under the registered\n * {@link ChangeFeedEntryVisibility} hook. `true` (visible) when no hook is\n * registered — the unmodified default. A throwing or non-boolean hook fails\n * closed to `false` (hidden), never falls back to visible.\n */\nexport async function isChangeFeedEntryVisible(\n  ctx: ChangeFeedRequestContext,\n  entry: ChangeFeedVisibilityEntry,\n): Promise<boolean> {\n  const predicate = globalThis.__smrtChangeFeedEntryVisibility;\n  if (!predicate) return true;\n  try {\n    return (await predicate({ ...ctx, entry })) === true;\n  } catch (error) {\n    logger.error('isChangeFeedEntryVisible() threw; failing closed to hidden', {\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return false;\n  }\n}\n\n/**\n * {@link isChangeFeedEntryVisible}, applied to a page of entries in order.\n * Returns `entries` unchanged (same array reference) when no hook is\n * registered.\n */\nexport async function filterVisibleChangeFeedEntries<\n  T extends ChangeFeedVisibilityEntry,\n>(ctx: ChangeFeedRequestContext, entries: readonly T[]): Promise<T[]> {\n  if (entries.length === 0 || !globalThis.__smrtChangeFeedEntryVisibility) {\n    return entries as T[];\n  }\n  const visible: T[] = [];\n  for (const entry of entries) {\n    if (await isChangeFeedEntryVisible(ctx, entry)) visible.push(entry);\n  }\n  return visible;\n}\n\ninterface AuthorizedChangesInput\n  extends Omit<GetChangesOptions, 'tables' | 'denyAllTables'>,\n    ChangeFeedRequestContext {\n  tables?: string[];\n}\n\n/** Shared implementation behind {@link getAuthorizedChangesSince} and {@link getAuthorizedTenantScopedChangesSince}. */\nasync function readAuthorized(\n  ctx: ChangeFeedRequestContext,\n  requestedTables: string[] | undefined,\n  read: (\n    tables: string[] | undefined,\n    denyAllTables: boolean,\n  ) => Promise<ChangeFeedPage>,\n): Promise<ChangeFeedPage> {\n  const effectiveTables = await resolveAuthorizedChangeFeedTables(\n    ctx,\n    requestedTables,\n  );\n  const denyAllTables = isChangeFeedDenyAll(effectiveTables);\n  const page = await read(\n    denyAllTables ? undefined : effectiveTables,\n    denyAllTables,\n  );\n  if (page.changes.length === 0) return page;\n  const visibleChanges = await filterVisibleChangeFeedEntries(\n    ctx,\n    page.changes,\n  );\n  return visibleChanges.length === page.changes.length\n    ? page\n    : { ...page, changes: visibleChanges };\n}\n\n/**\n * {@link getChangesSince}, additionally applying the registered table and\n * row-level authorization hooks (#3020). Used where the tenant filter (if\n * any) is resolved by the caller rather than the active DispatchBus context —\n * the `_events` catch-up replay (both transports), which captures its tenant\n * scope once at connection open, and the REST `_changes` route, which has no\n * DispatchBus tenant context of its own to resolve.\n */\nexport async function getAuthorizedChangesSince(\n  db: DatabaseInterface,\n  options: AuthorizedChangesInput,\n): Promise<ChangeFeedPage> {\n  const { locals, request, tables, ...rest } = options;\n  return readAuthorized(\n    { locals, request },\n    tables,\n    (effectiveTables, denyAllTables) =>\n      getChangesSince(db, {\n        ...rest,\n        tables: effectiveTables,\n        denyAllTables,\n      }),\n  );\n}\n\n/**\n * {@link getTenantScopedChangesSince}, additionally applying the registered\n * table and row-level authorization hooks (#3020). This is what the\n * generated SvelteKit `_changes` route calls.\n *\n * Table authorization narrows `tables` BEFORE the query runs (a denied table\n * is never queried, let alone returned); row visibility filters the fetched\n * page's `changes` AFTER. Neither touches `cursor`/`resyncRequired`/\n * `resyncCursor` — see the module docs' \"Cursor correctness\" section.\n */\nexport async function getAuthorizedTenantScopedChangesSince(\n  db: DatabaseInterface,\n  options: Omit<AuthorizedChangesInput, 'tenantId'>,\n): Promise<ChangeFeedPage> {\n  const { locals, request, tables, ...rest } = options;\n  return readAuthorized(\n    { locals, request },\n    tables,\n    (effectiveTables, denyAllTables) =>\n      getTenantScopedChangesSince(db, {\n        ...rest,\n        tables: effectiveTables,\n        denyAllTables,\n      }),\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6FA,IAAM,SAAS,aAAa,EAAE,OAAO,OAAO,CAAC;;;;;;AA+E7C,SAAgB,wBACd,qBACM;CACN,WAAW,kCAAkC;AAC/C;;;;;AAMA,SAAgB,6BACd,0BACM;CACN,WAAW,kCAAkC;AAC/C;;AAGA,SAAgB,mCAA4C;CAC1D,OAAO,WAAW,oCAAoC,KAAA;AACxD;;AAGA,SAAgB,mCAA4C;CAC1D,OAAO,WAAW,oCAAoC,KAAA;AACxD;;;;;;;;;AAUA,SAAgB,oBAAoB,QAAuC;CACzE,OAAO,WAAW,KAAA,KAAa,OAAO,WAAW;AACnD;;;;;;;;;;AAWA,SAAS,2BAA2B,MAAuB;CACzD,OAAO,KAAK,SAAS,KAAK,CAAC,KAAK,SAAS,IAAQ;AACnD;;;;;;;;;;;;;;;;;;;;AAqBA,eAAsB,kCACpB,KACA,iBAC+B;CAC/B,MAAM,aAAa,WAAW;CAC9B,IAAI,CAAC,YACH,OAAO,mBAAmB,gBAAgB,WAAW,IACjD,KAAA,IACA;CAGN,IAAI;CACJ,IAAI;EACF,MAAM,SAAS,MAAM,WAAW;GAAE,GAAG;GAAK,QAAQ;EAAgB,CAAC;EACnE,IACE,CAAC,MAAM,QAAQ,MAAM,KACrB,OAAO,MACJ,MAAM,OAAO,MAAM,YAAY,CAAC,2BAA2B,CAAC,CAC/D,GACA;GACA,OAAO,MACL,sGACF;GACA,OAAO,CAAC;EACV;EACA,UAAU;CACZ,SAAS,OAAO;EACd,OAAO,MAAM,4DAA4D,EACvE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;EACD,OAAO,CAAC;CACV;CAEA,IAAI,CAAC,mBAAmB,gBAAgB,WAAW,GAAG,OAAO;CAC7D,MAAM,aAAa,IAAI,IAAI,OAAO;CAClC,OAAO,gBAAgB,QAAQ,UAAU,WAAW,IAAI,KAAK,CAAC;AAChE;;;;;;;AAQA,eAAsB,yBACpB,KACA,OACkB;CAClB,MAAM,YAAY,WAAW;CAC7B,IAAI,CAAC,WAAW,OAAO;CACvB,IAAI;EACF,OAAQ,MAAM,UAAU;GAAE,GAAG;GAAK;EAAM,CAAC,MAAO;CAClD,SAAS,OAAO;EACd,OAAO,MAAM,8DAA8D,EACzE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;EACD,OAAO;CACT;AACF;;;;;;AAOA,eAAsB,+BAEpB,KAA+B,SAAqC;CACpE,IAAI,QAAQ,WAAW,KAAK,CAAC,WAAW,iCACtC,OAAO;CAET,MAAM,UAAe,CAAC;CACtB,KAAK,MAAM,SAAS,SAClB,IAAI,MAAM,yBAAyB,KAAK,KAAK,GAAG,QAAQ,KAAK,KAAK;CAEpE,OAAO;AACT;;AASA,eAAe,eACb,KACA,iBACA,MAIyB;CACzB,MAAM,kBAAkB,MAAM,kCAC5B,KACA,eACF;CACA,MAAM,gBAAgB,oBAAoB,eAAe;CACzD,MAAM,OAAO,MAAM,KACjB,gBAAgB,KAAA,IAAY,iBAC5B,aACF;CACA,IAAI,KAAK,QAAQ,WAAW,GAAG,OAAO;CACtC,MAAM,iBAAiB,MAAM,+BAC3B,KACA,KAAK,OACP;CACA,OAAO,eAAe,WAAW,KAAK,QAAQ,SAC1C,OACA;EAAE,GAAG;EAAM,SAAS;CAAe;AACzC;;;;;;;;;AAUA,eAAsB,0BACpB,IACA,SACyB;CACzB,MAAM,EAAE,QAAQ,SAAS,QAAQ,GAAG,SAAS;CAC7C,OAAO,eACL;EAAE;EAAQ;CAAQ,GAClB,SACC,iBAAiB,kBAChB,gBAAgB,IAAI;EAClB,GAAG;EACH,QAAQ;EACR;CACF,CAAC,CACL;AACF;;;;;;;;;;;AAYA,eAAsB,sCACpB,IACA,SACyB;CACzB,MAAM,EAAE,QAAQ,SAAS,QAAQ,GAAG,SAAS;CAC7C,OAAO,eACL;EAAE;EAAQ;CAAQ,GAClB,SACC,iBAAiB,kBAChB,4BAA4B,IAAI;EAC9B,GAAG;EACH,QAAQ;EACR;CACF,CAAC,CACL;AACF"}

package/dist/change-feed.d.ts

@@ -87,6 +87,21 @@ export interface GetChangesOptions {
     drain?: boolean;
     /** Restrict to these physical table names. Empty/omitted → all tables. */
     tables?: string[];
+    /**
+     * Explicit deny-all: match no tables regardless of {@link tables}, while
+     * still computing `cursor`/`resyncRequired`/`resyncCursor` exactly as a
+     * query that matched zero rows would (the same horizon/pruned-cursor
+     * detection that runs for any other filter). Distinct from an
+     * omitted/empty `tables` array, which means "no filter" (all tables) — so
+     * a caller that has resolved "the requester may read nothing" must set
+     * this rather than pass `tables: []`.
+     *
+     * Used by `change-feed-authz.ts`'s consumer table-authorization seam
+     * (#3020) so a denied `_changes`/`_events` request never reaches the
+     * `table_name IN (...)` clause with a synthesized value — see that
+     * module's docs.
+     */
+    denyAllTables?: boolean;
     /**
      * Tenant visibility filter:
      * - omitted/`undefined` → no tenant filter (all rows).

package/dist/change-feed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change-feed.d.ts","sourceRoot":"","sources":["../src/change-feed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkIG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAc5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuB9C,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAQ1D,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAMtE;AAED,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B,qBAAqB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE7D,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,yFAAyF;IACzF,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8DAA8D;IAC9D,SAAS,EAAE,eAAe,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;;OAWG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gDAAgD;IAChD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,SAAS,iBAAiB,EAAE,CAAC;AAE7D,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,OAAQ,CAAC;AAoVvC;;;;;;;;;;;GAWG;AACH,wBAAsB,sCAAsC,CAC1D,EAAE,EAAE,iBAAiB,EACrB,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACd,GACL,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,+BAA+B,CACnD,EAAE,EAAE,iBAAiB,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,iBAAiB,GACpB,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA0IxB;AA+BD,wBAAsB,aAAa,CACjC,EAAE,EAAE,iBAAiB,EACrB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CA8H/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,eAAe,CAAC,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAE5E;AAgSD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAGf;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,cAAc,CAAC,CA8KzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,GAC3C,OAAO,CAAC,cAAc,CAAC,CAMzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAgEjB;AA6CD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA8J7B;AA4BD,eAAO,MAAM,6BAA6B,gCAAgC,CAAC;AAW3E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CA4D/C;AAED,uDAAuD;AACvD,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAwED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,SAAS;IAAE,QAAQ,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,EAAE,GACvE,OAAO,CAAC,IAAI,CAAC,CA6Df;AAED,gFAAgF;AAChF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,UAAU,EACpB,SAAS,GAAE,eAA0B,GACpC,OAAO,CAAC,IAAI,CAAC,CAEf;AA8DD;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAS9C"}
+{"version":3,"file":"change-feed.d.ts","sourceRoot":"","sources":["../src/change-feed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkIG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAc5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuB9C,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAQ1D,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAMtE;AAED,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B,qBAAqB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE7D,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,yFAAyF;IACzF,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8DAA8D;IAC9D,SAAS,EAAE,eAAe,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;;OAWG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gDAAgD;IAChD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,SAAS,iBAAiB,EAAE,CAAC;AAE7D,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,OAAQ,CAAC;AAoVvC;;;;;;;;;;;GAWG;AACH,wBAAsB,sCAAsC,CAC1D,EAAE,EAAE,iBAAiB,EACrB,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACd,GACL,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,+BAA+B,CACnD,EAAE,EAAE,iBAAiB,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,iBAAiB,GACpB,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA0IxB;AA+BD,wBAAsB,aAAa,CACjC,EAAE,EAAE,iBAAiB,EACrB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CA8H/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,eAAe,CAAC,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAE5E;AAgSD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAGf;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,cAAc,CAAC,CAwLzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,GAC3C,OAAO,CAAC,cAAc,CAAC,CAMzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAgEjB;AA6CD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA8J7B;AA4BD,eAAO,MAAM,6BAA6B,gCAAgC,CAAC;AAW3E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CA4D/C;AAED,uDAAuD;AACvD,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAwED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,SAAS;IAAE,QAAQ,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,EAAE,GACvE,OAAO,CAAC,IAAI,CAAC,CA6Df;AAED,gFAAgF;AAChF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,UAAU,EACpB,SAAS,GAAE,eAA0B,GACpC,OAAO,CAAC,IAAI,CAAC,CAEf;AA8DD;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAS9C"}

package/dist/change-feed.js

@@ -961,6 +961,10 @@ async function getChangesSince(db, options) {
 	params.push(since);
 	conditions.push(`seq <= ${next()}`);
 	params.push(servedHorizon);
+	if (options.denyAllTables) return {
+		changes: [],
+		cursor: servedHorizon
+	};
 	const tables = options.tables?.filter((table) => table.trim().length > 0).filter((table) => !isChangeFeedSensitiveTable(table.trim()));
 	if (tables && tables.length > 0) {
 		conditions.push(`table_name IN (${tables.map(() => next()).join(", ")})`);