@mistriwork/engine 0.0.0-stage → 1.0.0-rc.10

package/dist/server/evidence.js

@@ -0,0 +1,323 @@
+/**
+ * Evidence: capturing what a caller handed in as frozen plain data, and
+ * failing closed when it cannot be trusted.
+ *
+ * It lived in `src/server/tenant/` because tenancy is where it was first
+ * needed, and 27 modules outside tenancy ended up importing tenancy for it —
+ * `auth/`, `app/`, `cli/`, `commands/` and every non-tenant `api/` file — which
+ * made a folder boundary unreadable: almost every arrow into tenant/ was this
+ * one file. Nothing in it is tenant-specific. It stays under `src/server/`
+ * rather than `src/shared/` because it reads `node:util/types` and the
+ * adapters' outcome error, neither of which the client may carry.
+ *
+ * The names are unchanged, tenant spelling and all: they are what the refusal
+ * path reads as, and renaming them would have made one mechanical move into a
+ * diff nobody could review.
+ */
+import { isProxy, isUint8Array } from 'node:util/types';
+import { TransactionOutcomeUnknown } from '../adapters/adapter.js';
+import { PoolBusy } from '../adapters/poolMetrics.js';
+import { Refusal, recordRefusalCause, refusalCause } from '../shared/refusal.js';
+import { isCapturedScopeCatalog } from '../shared/scopeCatalog.js';
+import { keepBreakdownsAgainst } from '../shared/breakdown.js';
+import { isRowScopeSnapshot } from '../shared/rowScope.js';
+import { carryServerRequest } from './serverRequests.js';
+/** Private admission errors reveal neither membership existence nor provider data. */
+export class TenantContextError extends Error {
+    code = 'tenant_context_unavailable';
+    constructor() {
+        super('The tenant context could not be verified.');
+        this.name = 'TenantContextError';
+    }
+}
+/* The recorded reason behind every opaque refusal lives with the refusal
+   class itself (shared/refusal.ts), so an adapter's scope check records one
+   the same way a tenant denial does. */
+export { recordRefusalCause, refusalCause, refusalHeadline, refusalReasons, refusalReasonsBelow } from '../shared/refusal.js';
+export const denyTenant = (cause) => {
+    throw recordRefusalCause(new TenantContextError(), cause);
+};
+/** The database could not answer, so authority was never decided: not a
+ * refusal. Still a TenantContextError — every consumer that denies on one
+ * still denies — and carries no `cause`, so no driver text travels with it
+ * (the driver's error is recorded for the operator, as any refusal's is).
+ * Only an owner that answers a caller tells the two apart (503, not 403). */
+export class TenantUnavailableError extends TenantContextError {
+    code = 'tenant_temporarily_unavailable';
+}
+const NETWORK = new Set(['ECONNREFUSED', 'ECONNRESET', 'EPIPE', 'ETIMEDOUT', 'EHOSTUNREACH', 'ENETUNREACH', 'ENOTFOUND', 'EAI_AGAIN']);
+/* Recognized positively. Every refusal in the tenant path is a
+   TenantContextError, and anything unrecognized denies, so a new failure
+   shape can only ever be answered as a refusal, never as a fault that hides
+   one. */
+export function databaseFault(error) {
+    if (error instanceof TenantUnavailableError)
+        return true;
+    if (error instanceof TenantContextError || !(error instanceof Error))
+        return false;
+    if (error instanceof TransactionOutcomeUnknown)
+        return true;
+    /* A pool that would not lend a connection in time (poolMetrics.ts): nothing
+       was leased, so nothing was asked. Under load this is the commonest fault
+       there is, and answered as a denial it told a person their tenant context
+       was gone because the server was busy (a field report: 403s on reads at
+       twelve users on half a core). */
+    if (error instanceof PoolBusy)
+        return true;
+    // A check refused because the engine could not answer (the SQLite catalog
+    // scan): the cause, one level deep and itself a raw driver error, decides.
+    if (error instanceof Refusal)
+        return !(error.cause instanceof Refusal) && databaseFault(error.cause);
+    const { code, severity } = error;
+    // node:sqlite: busy, locked, I/O, a missing or unreadable file.
+    if (code === 'ERR_SQLITE_ERROR')
+        return true;
+    if (typeof code === 'string' && NETWORK.has(code))
+        return true;
+    /* An integrity rule the database enforced (class 23: a key already taken, a
+       reference to nothing, a required value, a check) is the database answering,
+       and refusing: permanent for that write, and never a reason to try again.
+       Counted as unanswered, a duplicate key was told "try again" with a
+       Retry-After (a live load test). Every write route answers it as the refusal
+       it is (constraints.ts writeRefusalStatus). A data exception (class 22) stays
+       below on purpose: on a tenant read it is a filter value its column cannot
+       hold, and a denial there would end the person's context; a write route
+       recognizes it before asking this (tenantWriteFault.ts). */
+    if (typeof severity === 'string' && typeof code === 'string' && code.startsWith('23'))
+        return false;
+    // pg's DatabaseError: a server-reported SQLSTATE (a terminated backend, a
+    // database refusing connections, a cancelled or timed-out statement).
+    if (typeof severity === 'string' && typeof code === 'string' && /^[0-9A-Z]{5}$/.test(code))
+        return true;
+    // pg's own connection errors, and this pool's, carry no code.
+    return /^(?:Connection terminated|Client has encountered a connection error|Client was closed|timeout exceeded when trying to connect|Observed PostgreSQL checkout is unavailable|Postgres connection manager is closed)/.test(error.message);
+}
+/** The request's own fault, said to the caller as that, not as the context's
+ * denial: no record this context reads has the key (`not_found`, the same for
+ * one that is missing and one that is another tenant's), or a read that cannot
+ * be answered as asked (`invalid_read`). The context read and decided
+ * nothing to its detriment, and revalidates before this is let out
+ * (tenantReadRuntime.ts), so the session that asked keeps going. It carries
+ * no data: its words are fixed here. */
+export class TenantRequestFault extends Error {
+    status;
+    code;
+    constructor(status, code) {
+        super(code === 'not_found' ? 'No such record.' : 'This read cannot be answered.');
+        this.status = status;
+        this.code = code;
+        this.name = 'TenantRequestFault';
+    }
+}
+/**
+ * Whether the database not answering is what failed, under however many
+ * refusals and failures it was recorded: a tenant write's failure is
+ * value-free on purpose and keeps what failed beneath it, and a read that
+ * waited on that write (an inbox's mail) refuses with it as its cause. Read
+ * positively, as `databaseFault` is, and a denial anywhere on the way down
+ * stays a denial: it decided something, whatever lies beneath it.
+ */
+export function databaseUnanswered(error) {
+    let at = error;
+    for (let depth = 0; at !== null && typeof at === 'object' && depth < 16; depth++) {
+        if (databaseFault(at))
+            return true;
+        if (at instanceof TenantContextError)
+            return false;
+        at = refusalCause(at) ?? (at instanceof Error ? at.cause : undefined);
+    }
+    return false;
+}
+/** Deny, unless the cause is the database failing to answer: then the tenant
+ * context is unavailable. Fails closed either way. */
+export const denyTenantFor = (cause) => {
+    throw recordRefusalCause(databaseUnanswered(cause) ? new TenantUnavailableError() : new TenantContextError(), cause);
+};
+const capturedData = new WeakMap();
+/* A scope catalog (shared/scopeCatalog.ts) is detached, validated and deeply
+   frozen plain data too; its cost is measured once, without copying it. So is
+   a row scope snapshotRowScope made (shared/rowScope.ts): a tenant read hands
+   its request's scope through several captures, and each copied it whole. */
+const catalogCosts = new WeakMap();
+function catalogCost(value) {
+    let cost = catalogCosts.get(value);
+    if (cost)
+        return cost;
+    cost = { nodes: 0, characters: 0, depth: 0 };
+    const walk = (node, depth) => {
+        cost.nodes++;
+        if (depth > cost.depth)
+            cost.depth = depth;
+        if (typeof node === 'string')
+            cost.characters += node.length;
+        else if (node && typeof node === 'object')
+            for (const key of Object.keys(node)) {
+                if (!Array.isArray(node))
+                    cost.characters += key.length;
+                walk(node[key], depth + 1);
+            }
+    };
+    walk(value, 0);
+    catalogCosts.set(value, cost);
+    return cost;
+}
+/* A caller's value frozen all the way down — every object and array in it frozen as given, plain data with no
+   accessor (a copy refuses one) and no proxy — is one nothing can change either: freezing cannot be undone, and a
+   frozen object's values cannot be swapped. A policy's row scope is such a constant (`Object.freeze({ lead: true,
+   … })`), handed back on every request and copied afresh by each, so every request's scope was new data and nothing
+   keyed by it was ever found again (tenantReadScope.ts). Its capture is kept with it, and reused as a captured value
+   is: same object, same cost charged. */
+const frozenCaptures = new WeakMap();
+/** Test-only: how many objects and arrays captures have copied, as opposed to reused. */
+export const captureCounters = { copied: 0 };
+/** Whether a value is one captureTenantData froze all the way down, or a
+ * captured scope catalog: data that cannot change for as long as it lives, so
+ * an answer derived from it alone may be kept with it (a WeakMap keyed by it)
+ * and is gone when it is. A reload captures new values and starts afresh. */
+export function isCapturedTenantData(value) {
+    return value !== null && typeof value === 'object' && (capturedData.has(value) || isCapturedScopeCatalog(value));
+}
+/* A breakdown compiled against such a catalog is kept with it (breakdown.ts compileBreakdown): a served tenant
+   catalog is one, and an enter compiles each of its breakdowns against it for the access check and the SQL pane. */
+keepBreakdownsAgainst(isCapturedTenantData);
+/** Server evidence is data, never getters, proxies, thenables or inherited grants. */
+export function captureTenantData(input) {
+    /* A capture handed back whole is itself, within every bound by having been
+       made within them: answered before the walk's state is set up, since a
+       request hands the same evidence through dozens of these. */
+    if (input !== null && typeof input === 'object' && capturedData.has(input))
+        return carryServerRequest(input, input);
+    let nodes = 0, characters = 0, reach = 0, bytes = 0, 
+    /* Objects copied that were not frozen as given: a subtree with none is the caller's constant. */
+    thawed = 0;
+    const reuse = (value, depth) => {
+        const cost = capturedData.get(value) ??
+            (isCapturedScopeCatalog(value) || isRowScopeSnapshot(value) ? catalogCost(value) : undefined);
+        if (!cost)
+            return undefined;
+        // Exactly the counts a fresh copy of this value would have added.
+        if ((nodes += cost.nodes) > 262_144 || depth + cost.depth > 24 || (characters += cost.characters) > 16_777_216)
+            return denyTenant();
+        if (depth + cost.depth > reach)
+            reach = depth + cost.depth;
+        return value;
+    };
+    const copy = (value, depth = 0) => {
+        if (value !== null && typeof value === 'object' && !isProxy(value)) {
+            const kept = reuse(frozenCaptures.get(value) ?? value, depth);
+            if (kept !== undefined)
+                return kept;
+        }
+        if (++nodes > 262_144 || depth > 24)
+            return denyTenant();
+        if (depth > reach)
+            reach = depth;
+        if (value === undefined || value === null || typeof value === 'boolean')
+            return value;
+        if (typeof value === 'number')
+            return Number.isFinite(value) ? value : denyTenant();
+        if (typeof value === 'string') {
+            if ((characters += value.length) > 16_777_216)
+                return denyTenant();
+            return value;
+        }
+        if (typeof value !== 'object' || isProxy(value))
+            return denyTenant();
+        /* A file's bytes (a file resource's content column, read or written): a
+           genuine byte array, copied, so nothing the caller still holds changes
+           what was captured. Counted against the same budget as text. */
+        if (isUint8Array(value)) {
+            const copied = Buffer.from(value);
+            bytes++;
+            if ((characters += copied.byteLength) > 16_777_216)
+                return denyTenant();
+            return copied;
+        }
+        const array = Array.isArray(value), prototype = Object.getPrototypeOf(value);
+        if (array ? prototype !== Array.prototype : prototype !== null && prototype !== Object.prototype)
+            return denyTenant();
+        const keys = Reflect.ownKeys(value);
+        if (keys.length > 65_537)
+            return denyTenant();
+        captureCounters.copied++;
+        const before = { nodes: nodes - 1, characters, reach, bytes, thawed };
+        // Counted after `before`: the value itself must have been frozen too, not only what it holds.
+        if (!Object.isFrozen(value))
+            thawed++;
+        reach = depth;
+        let result;
+        if (array) {
+            const length = Object.getOwnPropertyDescriptor(value, 'length')?.value;
+            if (!Number.isInteger(length) || length > 65_536 || keys.length !== length + 1)
+                return denyTenant();
+            result = Object.freeze(Array.from({ length }, (_, index) => {
+                const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+                if (!descriptor?.enumerable || !('value' in descriptor))
+                    return denyTenant();
+                return copy(descriptor.value, depth + 1);
+            }));
+        }
+        else {
+            const record = Object.create(null);
+            for (const key of keys) {
+                if (typeof key !== 'string' || (characters += key.length) > 16_777_216)
+                    return denyTenant();
+                const descriptor = Object.getOwnPropertyDescriptor(value, key);
+                if (!descriptor?.enumerable || !('value' in descriptor))
+                    return denyTenant();
+                record[key] = copy(descriptor.value, depth + 1);
+            }
+            result = Object.freeze(record);
+        }
+        if (bytes === before.bytes) {
+            capturedData.set(result, {
+                nodes: nodes - before.nodes,
+                characters: characters - before.characters,
+                depth: reach - depth,
+            });
+            if (thawed === before.thawed)
+                frozenCaptures.set(value, result);
+        }
+        reach = Math.max(reach, before.reach);
+        return result;
+    };
+    try {
+        // A request the server built for a file's own columns stays the server's through the copy (serverRequests.ts).
+        return carryServerRequest(input, copy(input));
+    }
+    catch {
+        return denyTenant();
+    }
+}
+export function tenantRecord(value, fields) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || (fields && Object.keys(value).some((key) => !fields.includes(key))))
+        denyTenant();
+}
+export function tenantIdentifier(value, maximum = 256) {
+    if (typeof value !== 'string' || !value.length || value.length > maximum || value !== value.trim() || /\p{Cc}/u.test(value))
+        denyTenant();
+}
+/** Trusted callbacks are captured without invoking configuration accessors. */
+export function tenantOptions(input, fields) {
+    if (!input || typeof input !== 'object' || isProxy(input) || Array.isArray(input))
+        return denyTenant();
+    const prototype = Object.getPrototypeOf(input);
+    if (prototype !== null && prototype !== Object.prototype)
+        return denyTenant();
+    const result = Object.create(null);
+    const keys = Reflect.ownKeys(input);
+    /* The refusal names the key it did not expect: a loader that grows a key
+       (an App's pageFiles did) otherwise stops every tenant start with only
+       "the tenant context could not be verified". Recorded for the operator's
+       reader alone, and cut short, since the key is the caller's text. */
+    const unknown = keys.find((key) => typeof key !== 'string' || !fields.includes(key));
+    if (unknown !== undefined)
+        return denyTenant(`"${String(unknown).slice(0, 64)}" is not a key this takes; it takes ${fields.join(', ')}.`);
+    for (const key of keys) {
+        const descriptor = Object.getOwnPropertyDescriptor(input, key);
+        if (!descriptor?.enumerable || !('value' in descriptor))
+            return denyTenant();
+        result[key] = descriptor.value;
+    }
+    return result;
+}

package/dist/server/hiddenColumns.d.ts

@@ -0,0 +1,32 @@
+/**
+ * A connection that never hands out some of its columns.
+ *
+ * `"hidden": { "account": ["password_hash"], "*": ["*_token"] }` in
+ * tablewalk.json keeps those columns from everything served over the
+ * connection: the Workbench, MCP, and every App on it. It is enforced where
+ * `"rows": false` is (shapeonly.ts), by wrapping the adapter before the
+ * registry stores it, so a feature added later inherits the boundary instead
+ * of having to remember it.
+ *
+ * The checks are the App grants' own (resourceChecks in columnGrants.ts):
+ * the catalog is served without the columns, so a query, a view, a filter or
+ * a sort that names one is refused as naming a column that is not there, and
+ * a read that names no columns gets the visible ones, never `SELECT *`.
+ * Raw SQL is refused outright: a statement cannot be column-redacted
+ * honestly. The strongest form of this boundary is still the database's own:
+ * a role without SELECT on those columns, which no tablewalk bug can undo.
+ */
+import { type Adapter } from '../adapters/adapter.js';
+import { type DatabaseSchema } from '../shared/schema.js';
+/** Table (id, bare name or "*") → column names, `*` a wildcard within a name. As written in tablewalk.json. */
+export type HiddenColumnRules = Readonly<Record<string, readonly string[]>>;
+/** The rules as the config file must spell them, refused with the file's own words otherwise. */
+export declare function parseHiddenColumns(raw: unknown, where: string): HiddenColumnRules;
+/** The catalog as served: the columns gone, and every edge, index and list naming one. */
+export declare function withoutHiddenColumns(schema: DatabaseSchema, rules: HiddenColumnRules, name: string): DatabaseSchema;
+/**
+ * The same adapter with the rules' columns cut from every answer and refused
+ * in every question. Methods are copied, not proxied, so an optional one the
+ * adapter lacks stays absent (shapeonly.ts says why).
+ */
+export declare function hideColumns(adapter: Adapter, name: string, rules: HiddenColumnRules, introspected: DatabaseSchema): Adapter;

package/dist/server/hiddenColumns.js

@@ -0,0 +1,238 @@
+/**
+ * A connection that never hands out some of its columns.
+ *
+ * `"hidden": { "account": ["password_hash"], "*": ["*_token"] }` in
+ * tablewalk.json keeps those columns from everything served over the
+ * connection: the Workbench, MCP, and every App on it. It is enforced where
+ * `"rows": false` is (shapeonly.ts), by wrapping the adapter before the
+ * registry stores it, so a feature added later inherits the boundary instead
+ * of having to remember it.
+ *
+ * The checks are the App grants' own (resourceChecks in columnGrants.ts):
+ * the catalog is served without the columns, so a query, a view, a filter or
+ * a sort that names one is refused as naming a column that is not there, and
+ * a read that names no columns gets the visible ones, never `SELECT *`.
+ * Raw SQL is refused outright: a statement cannot be column-redacted
+ * honestly. The strongest form of this boundary is still the database's own:
+ * a role without SELECT on those columns, which no tablewalk bug can undo.
+ */
+import { Refusal } from '../adapters/adapter.js';
+import { CONNECTION_HIDDEN } from '../shared/schema.js';
+import { AppAccessDenied, accessibleSchema, authorizeColumnWrites, resourceChecks } from './columnGrants.js';
+import { lendWriteView } from '../adapters/storeHost.js';
+import { configFileName } from './product.js';
+/** The rules as the config file must spell them, refused with the file's own words otherwise. */
+export function parseHiddenColumns(raw, where) {
+    const shape = `"hidden" must be an object of table → column names, like { "account": ["password_hash"], "*": ["*_token"] }`;
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw) || !Object.keys(raw).length)
+        throw new Error(`${where}: ${shape}.`);
+    for (const [table, columns] of Object.entries(raw)) {
+        if (!table.trim() ||
+            !Array.isArray(columns) ||
+            !columns.length ||
+            columns.some((column) => typeof column !== 'string' || !column.trim() || /^\*+$/.test(column.trim()))) {
+            throw new Error(`${where}: "hidden" for "${table}" is not a list of column names (a "*" matches within a name, never a whole table). ${shape}.`);
+        }
+    }
+    return raw;
+}
+const matcher = (pattern) => new RegExp(`^${pattern
+    .trim()
+    .split('*')
+    .map((part) => part.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
+    .join('.*')}$`, 'i');
+/** Each table's cut columns under the rules, by table id; a primary key is refused, since every link to a record carries it. */
+function hiddenByTable(schema, rules, name) {
+    const patterns = Object.entries(rules).map(([table, columns]) => ({ table, columns: columns.map(matcher) }));
+    const cuts = new Map();
+    for (const table of schema.tables) {
+        const applying = patterns.filter((rule) => rule.table === '*' || rule.table === table.id || rule.table === table.name);
+        const cut = table.columns.filter((column) => applying.some((rule) => rule.columns.some((pattern) => pattern.test(column.name))));
+        const key = cut.find((column) => column.primaryKey);
+        if (key) {
+            throw new Error(`"${name}" has "hidden" covering ${table.id}.${key.name}, part of a primary key: every link to a record carries it. ` +
+                `Narrow the pattern in your ${configFileName()}.`);
+        }
+        if (cut.length)
+            cuts.set(table.id, new Set(cut.map((column) => column.name)));
+    }
+    return cuts;
+}
+/** Every table read and written as the connection allows, minus the cut columns, as one grant. */
+function grantOf(schema, cuts) {
+    const all = new Set(schema.tables.map((table) => table.id));
+    return {
+        readable: all,
+        writable: all,
+        fields: new Map([...cuts].map(([id, cut]) => {
+            const visible = schema.tables
+                .find((table) => table.id === id)
+                .columns.map((column) => column.name)
+                .filter((column) => !cut.has(column));
+            return [id, { read: new Set(visible), write: new Set(visible) }];
+        })),
+    };
+}
+/** The catalog as served: the columns gone, and every edge, index and list naming one. */
+export function withoutHiddenColumns(schema, rules, name) {
+    const cuts = hiddenByTable(schema, rules, name);
+    if (!cuts.size)
+        return schema;
+    const pruned = accessibleSchema(schema, grantOf(schema, cuts));
+    const keep = (id, columns) => columns?.filter((column) => !cuts.get(id)?.has(column));
+    return {
+        ...pruned,
+        tables: pruned.tables.map((table) => {
+            // accessibleSchema narrows `deletable` where a field map exists; a connection's deletes stay its own to judge.
+            const original = schema.tables.find((item) => item.id === table.id);
+            const { deletable: _deletable, ...rest } = table;
+            // Likewise each column's `writable`: the grant says nothing about writes here.
+            const columns = table.columns.map((column) => {
+                const { writable: _writable, ...said } = column;
+                const was = original.columns.find((item) => item.name === column.name);
+                return was.writable !== undefined ? { ...said, writable: was.writable } : said;
+            });
+            const cut = cuts.get(table.id);
+            return {
+                ...rest,
+                columns,
+                ...(cut ? { [CONNECTION_HIDDEN]: [...cut] } : {}),
+                ...(original.deletable !== undefined ? { deletable: original.deletable } : {}),
+                ...(table.filterable ? { filterable: keep(table.id, table.filterable) } : {}),
+                ...(table.sortable ? { sortable: keep(table.id, table.sortable) } : {}),
+            };
+        }),
+    };
+}
+/**
+ * The same adapter with the rules' columns cut from every answer and refused
+ * in every question. Methods are copied, not proxied, so an optional one the
+ * adapter lacks stays absent (shapeonly.ts says why).
+ */
+export function hideColumns(adapter, name, rules, introspected) {
+    const refused = (what) => new Refusal(`"${name}" hides columns ("hidden" in your ${configFileName()}): ${what}. ` +
+        'The hidden columns are not in its catalog, so nothing can ask for them.');
+    let full = introspected;
+    let cuts = hiddenByTable(full, rules, name);
+    let checks = resourceChecks(full, grantOf(full, cuts));
+    const refresh = (schema) => {
+        full = schema;
+        cuts = hiddenByTable(full, rules, name);
+        checks = resourceChecks(full, grantOf(full, cuts));
+    };
+    /* A grant's refusal is deliberately opaque to an App's reader; here the
+       person asking owns the config, so it says which boundary answered. */
+    const checked = (check) => {
+        try {
+            return check();
+        }
+        catch (error) {
+            if (error instanceof AppAccessDenied)
+                throw refused('this request names a hidden column, or would return one');
+            throw error;
+        }
+    };
+    const from = (key) => {
+        const method = adapter[key];
+        return typeof method === 'function' ? method.bind(adapter) : undefined;
+    };
+    const authorized = (tx) => {
+        const inner = authorizeColumnWrites(full, grantOf(full, cuts), tx);
+        const guard = (run) => (...args) => {
+            try {
+                return run(...args).catch((error) => {
+                    throw error instanceof AppAccessDenied ? refused('this write names a hidden column, or would return or remove one') : error;
+                });
+            }
+            catch (error) {
+                return Promise.reject(error instanceof AppAccessDenied ? refused('this write names a hidden column, or would return or remove one') : error);
+            }
+        };
+        return {
+            ...(inner.lockRecord ? { lockRecord: guard(inner.lockRecord) } : {}),
+            query: guard(inner.query),
+            count: guard(inner.count),
+            insert: guard(inner.insert),
+            update: guard(inner.update),
+            remove: guard(inner.remove),
+            ...(inner.tell ? { tell: guard(inner.tell) } : {}),
+        };
+    };
+    const reads = (bound) => ({
+        query: (request) => bound.query(checked(() => checks.queryFor(request))),
+        count: (table, filter, limit) => bound.count(table, checked(() => checks.filterFor(table, filter)), limit),
+        runView: (view, offset) => bound.runView(checked(() => checks.viewFor(view)), offset),
+        countView: (view, limit) => bound.countView(checked(() => checks.viewFor(view)), limit),
+        runBreakdown: (def, offset) => bound.runBreakdown(checked(() => checks.breakdownFor(def)), offset),
+        countBreakdown: (def, limit) => bound.countBreakdown(checked(() => checks.breakdownFor(def)), limit),
+    });
+    const wrapped = Object.create(Object.getPrototypeOf(adapter));
+    Object.assign(wrapped, adapter);
+    wrapped.close = from('close');
+    wrapped.introspect = async () => {
+        refresh(await adapter.introspect());
+        return withoutHiddenColumns(full, rules, name);
+    };
+    if (adapter.poolStats)
+        wrapped.poolStats = from('poolStats');
+    if (adapter.privileges)
+        wrapped.privileges = from('privileges');
+    if (adapter.estimateCount)
+        wrapped.estimateCount = from('estimateCount');
+    wrapped.query = async (request) => adapter.query(checked(() => checks.queryFor(request)));
+    wrapped.count = async (table, filter, limit) => adapter.count(table, checked(() => checks.filterFor(table, filter)), limit);
+    if (adapter.countEach)
+        wrapped.countEach = async (items, limit) => adapter.countEach(checked(() => items.map((item) => ({ table: item.table, filter: checks.filterFor(item.table, item.filter) }))), limit);
+    if (adapter.runView)
+        wrapped.runView = async (view, offset) => adapter.runView(checked(() => checks.viewFor(view)), offset);
+    if (adapter.countView)
+        wrapped.countView = async (view, limit) => adapter.countView(checked(() => checks.viewFor(view)), limit);
+    if (adapter.runBreakdown)
+        wrapped.runBreakdown = async (def, offset) => adapter.runBreakdown(checked(() => checks.breakdownFor(def)), offset);
+    if (adapter.countBreakdown)
+        wrapped.countBreakdown = async (def, limit) => adapter.countBreakdown(checked(() => checks.breakdownFor(def)), limit);
+    if (adapter.scopeReads)
+        wrapped.scopeReads = async (scope) => reads(await adapter.scopeReads(scope));
+    /* Raw SQL can name any column, in any spelling, through any function: no
+       honest redaction exists for it. EXPLAIN is refused with it, since a plan
+       can be asked to run the statement. */
+    if (adapter.runSql)
+        wrapped.runSql = async () => {
+            throw refused('raw SQL is refused, because a statement can name any column. Remove "hidden" to run SQL here, or connect as a database role without SELECT on those columns');
+        };
+    if (adapter.explainSql)
+        wrapped.explainSql = async () => {
+            throw refused('explaining raw SQL is refused with running it');
+        };
+    // A table's DDL spells out every column, the hidden ones too.
+    if (adapter.ddl)
+        wrapped.ddl = async (table) => (cuts.has(table) ? undefined : adapter.ddl(table));
+    /* Profile keeps its numbers for the columns that are served. */
+    if (adapter.profile)
+        wrapped.profile = async (table, limits) => {
+            const result = await adapter.profile(table, limits);
+            const cut = cuts.get(table);
+            return cut ? { ...result, columns: result.columns.filter((column) => !cut.has(column.column)) } : result;
+        };
+    /* Writes are judged by the same grant: a hidden column is never written,
+       and an insert's stored row comes back without it. A delete removes every
+       column, the hidden ones too, and journals them for Undo, so it is
+       refused on a table with hidden columns. */
+    if (adapter.insert)
+        wrapped.insert = (request) => authorized(adapter).insert(request);
+    if (adapter.update)
+        wrapped.update = (request) => authorized(adapter).update(request);
+    if (adapter.remove)
+        wrapped.remove = (request) => authorized(adapter).remove(request);
+    if (adapter.transaction)
+        wrapped.transaction = (run) => adapter.transaction((tx) => run(authorized(tx)));
+    if (adapter.scopeTransaction)
+        wrapped.scopeTransaction = (scope, run) => adapter.scopeTransaction(scope, (tx, catalog) => run(authorized(tx), withoutHiddenColumns(catalog, rules, name)));
+    /* The command journal runs its work under the same grant and catalog. */
+    lendWriteView(wrapped, {
+        over: adapter,
+        records: (records) => authorized(records),
+        catalog: (catalog) => withoutHiddenColumns(catalog, rules, name),
+    });
+    return wrapped;
+}

package/dist/server/http/baselineHeaders.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The headers every answer carries, set before anything is routed so a reply
+ * that names its own (a mail link's `no-referrer`) still wins: `writeHead`'s
+ * headers override what `setHeader` put first.
+ *
+ * - `Referrer-Policy: strict-origin-when-cross-origin`: an address under a
+ *   record (`/compass/leads/127?search=…`) leaves this origin as the origin
+ *   alone, and never over plain http.
+ * - `Permissions-Policy`: no page here uses a camera, a microphone, a
+ *   location or a payment sheet, so none is granted — to a component, or to
+ *   whatever frames or is framed.
+ * - `Strict-Transport-Security`, only on an answer that arrived over https
+ *   (trust.ts `arrivedOverHttps`): the socket's own TLS, an https public
+ *   address, or a proxy this server trusts saying it forwarded https. A
+ *   plain-http server (a laptop, a loopback dev server) never pins its name
+ *   to https.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type ProxyRange } from './trust.js';
+export declare const REFERRER_POLICY = "strict-origin-when-cross-origin";
+export declare const PERMISSIONS_POLICY: string;
+/** A year, and the names under this one: the time browsers ask of a name kept on https. */
+export declare const STRICT_TRANSPORT = "max-age=31536000; includeSubDomains";
+export declare function setBaselineHeaders(req: Pick<IncomingMessage, 'headers' | 'socket'>, res: ServerResponse, trustedProxies?: readonly ProxyRange[]): void;

package/dist/server/http/baselineHeaders.js

@@ -0,0 +1,12 @@
+import { arrivedOverHttps } from './trust.js';
+export const REFERRER_POLICY = 'strict-origin-when-cross-origin';
+export const PERMISSIONS_POLICY = 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), bluetooth=(), hid=(), midi=(), ' +
+    'magnetometer=(), gyroscope=(), accelerometer=(), display-capture=(), browsing-topics=()';
+/** A year, and the names under this one: the time browsers ask of a name kept on https. */
+export const STRICT_TRANSPORT = 'max-age=31536000; includeSubDomains';
+export function setBaselineHeaders(req, res, trustedProxies = []) {
+    res.setHeader('referrer-policy', REFERRER_POLICY);
+    res.setHeader('permissions-policy', PERMISSIONS_POLICY);
+    if (arrivedOverHttps(req, trustedProxies))
+        res.setHeader('strict-transport-security', STRICT_TRANSPORT);
+}

package/dist/server/http/captured.d.ts

@@ -0,0 +1,35 @@
+/**
+ * A reply held in memory: what a route sends when it answers a request made
+ * inside another (recordCompose.ts). The route is the same code an HTTP
+ * request reaches — the same grants, row scope and hidden columns — and
+ * writes through `send` as ever; only the bytes stop here instead of on a
+ * socket. Just enough of ServerResponse for the reply helpers (reply.ts) and
+ * the routes that set a header on the way.
+ */
+import { EventEmitter } from 'node:events';
+import type { OutgoingHttpHeaders, ServerResponse } from 'node:http';
+export declare class CapturedReply extends EventEmitter {
+    statusCode: number;
+    headersSent: boolean;
+    writableEnded: boolean;
+    destroyed: boolean;
+    /** No request: nothing is compressed, and the whole reply is one JSON body. */
+    readonly req: undefined;
+    private readonly headers;
+    private chunks;
+    setHeader(name: string, value: number | string | readonly string[]): this;
+    getHeader(name: string): string | number | readonly string[] | undefined;
+    hasHeader(name: string): boolean;
+    removeHeader(name: string): void;
+    writeHead(status: number, headers?: OutgoingHttpHeaders): this;
+    write(chunk: Buffer | string): boolean;
+    end(chunk?: Buffer | string): this;
+    destroy(): this;
+    /** As the route answered: its status and its JSON, or undefined when it sent nothing. */
+    answer(): {
+        status: number;
+        body: unknown;
+    } | undefined;
+    /** Typed as the response the routes take. */
+    asResponse(): ServerResponse;
+}