memhouse 0.16.0 → 0.18.0

package/memhouse/house/house.js

@@ -1,9 +1,8 @@
 // The house.
 //
-// A house is a ClickHouse DATABASE — any database, named whatever its people name it
-// (`polat`, `team_a`, even `default`). Its rooms are three plain tables: `sessions`,
-// `messages`, `tool_calls`. Everyone in the house writes into the SAME tables, each with
-// their own credential, and two columns say who and where every row came from:
+// A house is a ClickHouse DATABASE, `mem` by default. Its rooms are tables — `sessions`,
+// `messages`, `tool_calls` — one set per member, named for them, and two columns say who
+// and where every row came from:
 //
 //   user_id  String MATERIALIZED currentUser()   — stamped by the server, unforgeable by
 //                                                  clients (async_insert is pinned to 0
@@ -12,19 +11,30 @@
 //   host     LowCardinality(String)              — the machine's fingerprint, minted once
 //                                                  per install (../host.js)
 //
-// That pair IS the provenance model. Alice and Bob point their shippers at `team_a` and
-// both write; `WHERE user_id = 'alice'` is one person, `WHERE host = '…'` is one machine.
-// The model is collaborative — housemates trust each other with the house — and the
-// boundary between houses is the database: joining someone's ClickHouse takes a database
-// and a credential (`GRANT ALL ON team_a.* TO alice`), nothing else, because ALL on your
-// own database reaches nothing outside it.
+// That pair IS the provenance model.
 //
-// THIS REPLACES THE PER-MEMBER LAYOUT. Rooms were `sessions_<member>` with per-member
-// grants, Merge rooms for team reads, and isolation between members of one database.
-// All of it is gone: suffixed names made every client resolve its room names first (and
-// `FROM messages` a documented trap), the Merge rooms existed only to undo the
-// splitting, and per-member isolation inside a shared house solved an adversarial
-// problem the product does not have. Separate houses isolate; one house shares.
+// ONE LAYOUT. A house is a database — `mem` unless somebody has a reason — and every
+// member's rooms in it carry the member's name: `mem.alice_messages`, `mem.polat_messages`.
+// A member holds one grant, on the wildcard `mem.<name>_*`, and nothing else in the
+// database. That is the whole access model, and roomNames() below is the only place a
+// table name is produced.
+//
+//   alone on a laptop        mem.polat_*            a house of one
+//   a team on one server     mem.polat_*, mem.alice_*
+//   an agency on a kernel    the same, in the kernel's `mem`
+//
+// Nobody ever holds ALL ON <db>.*. That grant is dynamic — it covers rooms created later —
+// and it is what turned two members in one database into a leak: either could read and
+// re-grant the other's transcripts, measured. The wildcard reaches nothing outside the
+// member's own name: measured, a member cannot create, read, list or re-grant a
+// housemate's rooms, and can read their own grant back with SHOW GRANTS in one line.
+//
+// THIS FILE HAS SAID THREE OTHER THINGS. Shared tables with row policies (0.4.0: policies
+// are permissive and OR'd, a catch-all fails open). Suffixed per-member rooms with Merge
+// rooms over them (0.8.0: removed because clients had to resolve names first and
+// isolation "solved a problem the product did not have" — the second half was wrong).
+// Then a house per member with `ALL ON db.*`, plus a prefixed variant beside it, plus the
+// machinery to keep the two from meeting. All three were special cases of this one.
 //
 // `sessions_v` IS A SAVED QUERY, NOT AN OBJECT — substituted into the same `FROM … AS c`
 // position a view name would occupy, running under the caller's own credential. It was
@@ -38,7 +48,11 @@ const ROOM_TYPES = ['sessions', 'messages', 'tool_calls'];
  * them, the shipper's guards do not require them, and a member who cannot create them
  * still ships normally.
  */
-const META_TYPES = ['house_meta', 'house_events'];
+// `<member>_meta` / `<member>_events` since the one-layout: every row in them is about ONE
+// member (their schema version, their machines, their last ship, their shares), so the old
+// `house_` prefix named the wrong unit. A pre-one-layout house still has `house_meta` /
+// `house_events`; the shipper's legacy guard names the rename.
+const META_TYPES = ['meta', 'events'];
 
 /**
  * What generation of the schema a house is at. Bumped only when existing rooms have to be
@@ -75,7 +89,7 @@ const SUPPORTED_SCHEMAS = [2];
 
 /**
  * The floor a house may set under its writers, recorded by `memhouse migrate` in
- * house_meta['min_writer_schema']. Today it equals SCHEMA_VERSION; a future
+ * meta['min_writer_schema']. Today it equals SCHEMA_VERSION; a future
  * back-compatible generation can hold it one step lower for a grace window.
  */
 const MIN_WRITER_SCHEMA = 2;
@@ -233,15 +247,19 @@ const ROOM_MATERIALIZED = {
   tool_calls: ['user_id'],
 };
 
-function currentParse(table, epochSource = table) {
+function currentParse(table, epochSource = table, physical = null) {
+  // `table` names the ROOM (for the materialized-column lookup); `physical` is what goes
+  // into the FROM, which differs whenever a prefix is in play.
   const extra = (ROOM_MATERIALIZED[table] || ['user_id']).join(', ');
+  const from = physical || table;
+  const epochFrom = physical ? physical.replace(new RegExp(`${table}$`), epochSource) : epochSource;
   return `(
     SELECT *, ${extra}
-    FROM ${table} FINAL
+    FROM ${from} FINAL
     WHERE origin != 'ship'
        OR (session_id, user_id, epoch) IN (
             SELECT session_id, user_id, max(epoch)
-            FROM ${epochSource}
+            FROM ${epochFrom}
             WHERE origin = 'ship'
             GROUP BY session_id, user_id)
   )`;
@@ -302,24 +320,54 @@ const READ_SETTINGS = { final: 1, join_use_nulls: 1 };
  * name it produces. See ship.js's delete, which must BIND the user rather than call
  * currentUser() inside a mutation, where it is not evaluated in the caller's context.
  */
+/**
+ * The table a room type lands in. THE naming rule, and the only copy of it.
+ *
+ * ONE LAYOUT. Every member's rooms carry the member's own name: `mem.alice_messages`,
+ * and `mem.polat_messages` even when polat is the only one in there. A house with one
+ * member is a house of one, not a different kind of house — so there is no second case
+ * here, no prefix to configure, and nothing for an invite file to carry.
+ *
+ * Depends on nothing but the member, so a caller holding only a config can name a table
+ * without a server round-trip. That matters: when the rule lived only inside roomNames(),
+ * callers that could not afford `SELECT currentUser()` spelled tables by hand instead —
+ * eight of them, all swallowing the error — and a house silently had no metadata plane.
+ */
+function physicalRoom(type, user) {
+  if (!user) throw new Error(`physicalRoom(${type}): a room belongs to a member, and none was given`);
+  return `${user}_${type}`;
+}
+
+/** The wildcard every grant to a member is scoped to: `<member>_*`. */
+function roomPattern(user) {
+  if (!user) throw new Error('roomPattern: a member is required');
+  return `${user}_*`;
+}
+
 function roomNames(user) {
-  const out = { member: user, user };
+  if (!user) throw new Error('roomNames: a member is required');
+  const out = { member: user, user, pattern: roomPattern(user) };
+  // Every room name in the codebase comes from physicalRoom() above — through this
+  // function where a caller has the rooms, directly where it has only a member name.
+  const phys = (t) => physicalRoom(t, user);
+  out.physical = {};
+  for (const t of [...ROOM_TYPES, ...META_TYPES]) out.physical[t] = phys(t);
   // The raw table names — for INSERT, for DDL, and for the shipper's own bookkeeping
   // reads, which have to see every epoch to decide which one to write next.
-  for (const t of ROOM_TYPES) out[`${t}_raw`] = t;
+  for (const t of ROOM_TYPES) out[`${t}_raw`] = phys(t);
   // What everything else gets. `sessions` is unfiltered: it is one metadata row per
   // session by construction, latest-wins, and carries no epoch anyone may read.
-  out.sessions = 'sessions';
-  out.messages = currentParse('messages');
+  out.sessions = phys('sessions');
+  out.messages = currentParse('messages', 'messages', phys('messages'));
   // tool_calls takes its epoch from MESSAGES, not from itself. A parse that produces
   // messages but NO tool calls is ordinary — a compaction can remove every assistant turn
   // that called something — and it writes zero rows into this room at the new epoch. Asked
   // for its own max(epoch), the room would answer with the SUPERSEDED epoch and serve the
   // old parse's tool calls beside the new parse's messages. Both rooms are written by the
   // same pass at the same epoch, so messages is the authority for both.
-  out.tool_calls = currentParse('tool_calls', 'messages');
+  out.tool_calls = currentParse('tool_calls', 'messages', phys('tool_calls'));
   // The house's own record of itself — plain names, nothing to filter.
-  for (const t of META_TYPES) { out[t] = t; out[`${t}_raw`] = t; }
+  for (const t of META_TYPES) { out[t] = phys(t); out[`${t}_raw`] = phys(t); }
   out.sessions_v = sessionsRollup(out);
   return out;
 }
@@ -337,7 +385,42 @@ async function resolveRooms(client) {
   return roomNames(await currentUser(client));
 }
 
+/**
+ * The text-index DDL for servers before the tokenizer grammar changed. 25.8 spells a
+ * tokenizer as a quoted name with options — `text(tokenizer = 'ngram', ngram_size = 3)`,
+ * `text(tokenizer = 'default')` — and rejects the function form with "Expected literal";
+ * 26.x spells it as a function — `ngrams(3)`, `splitByNonAlpha` — and rejects the quoted
+ * names as "Unknown tokenizer". Neither parses the other. The template carries the
+ * current grammar; this rewrites a statement to the older one when a server refuses it.
+ * `default` in the old grammar is the non-alphanumeric splitter, which is what
+ * `splitByNonAlpha` names in the new one, so the indexes built are the same.
+ */
+function legacyTextIndexDialect(sql) {
+  return sql
+    .replace(/TYPE text\(tokenizer = ngrams\((\d+)\)\)/g, "TYPE text(tokenizer = 'ngram', ngram_size = $1)")
+    .replace(/TYPE text\(tokenizer = splitByNonAlpha\)/g, "TYPE text(tokenizer = 'default')");
+}
+
+/**
+ * Which text-index grammar a server speaks, from `SELECT version()`. Measured on real
+ * builds: 25.8 and 25.9 want the quoted-name form, 25.10 onwards the function form, and
+ * each rejects the other. Anything unparseable is treated as current; the shipper still
+ * falls back on a grammar refusal, so a wrong guess costs one round-trip, not the install.
+ */
+function textIndexDialectFor(version) {
+  const m = /^(\d+)\.(\d+)/.exec(String(version || '').trim());
+  if (!m) return 'modern';
+  const major = Number(m[1]); const minor = Number(m[2]);
+  return (major < 25 || (major === 25 && minor < 10)) ? 'legacy' : 'modern';
+}
+
+/** True when a server's refusal is the grammar, not a privilege or a real mistake. */
+function isTextIndexGrammarRefusal(message) {
+  return /Expected literal|supports only 'default'|Unknown tokenizer/.test(String(message || ''));
+}
+
 module.exports = {
+  physicalRoom, roomPattern, legacyTextIndexDialect, isTextIndexGrammarRefusal, textIndexDialectFor,
   ROOM_TYPES, META_TYPES, SCHEMA_VERSION, SUPPORTED_SCHEMAS, MIN_WRITER_SCHEMA,
   MIGRATIONS, ROOM_KEYS, keyProblem,
   READ_SETTINGS, MEMBER_PIN,

package/memhouse/house/migrate.js

@@ -39,8 +39,8 @@
 //   the old table until the rename; a late-writes pass copies anything newer than the
 //   snapshot, and ReplacingMergeTree makes that idempotent.
 //
-//   EVERYTHING IS RECORDED. One house_events pending row before work, applied/failed
-//   after, per object; schema_version in house_meta only after a migration completes.
+//   EVERYTHING IS RECORDED. One events pending row before work, applied/failed
+//   after, per object; schema_version in meta only after a migration completes.
 
 const fs = require('fs');
 const path = require('path');
@@ -59,7 +59,7 @@ const { ROOM_TYPES, keyProblem, createStatement } = require('./house');
  *   toVersion  the SCHEMA_VERSION a house is at once this has run
  *   detect(q, ctx)        -> what still needs doing (any truthy non-empty value), or
  *                            null/[] when the house is already past this migration.
- *                            THE ROOMS ARE THE TRUTH, never house_meta: a hand-migrated
+ *                            THE ROOMS ARE THE TRUTH, never meta: a hand-migrated
  *                            house has no record, and a restored backup can carry a
  *                            record newer than its tables.
  *   plan(found)           -> lines of human text for the confirm prompt
@@ -81,7 +81,7 @@ function listMigrations() {
   const seen = new Set();
   let lastVersion = 0;
   for (const m of out) {
-    // The id is spliced into SQL (house_events predicates) and into kept-table suffixes.
+    // The id is spliced into SQL (events predicates) and into kept-table suffixes.
     // It is repo-controlled, but "repo-controlled" is one compromised dependency away
     // from "attacker-controlled" — validate like any other identifier.
     if (!/^[a-z0-9][a-z0-9-]*$/.test(m.id)) throw new Error(`migration id '${m.id}' must match [a-z0-9-]+`);
@@ -116,7 +116,7 @@ async function detectPending(q, ctx, { component = null } = {}) {
  * Refuse when another actor's run is unfinished. An `applied` newer than the last
  * `pending` means done; a dangling `pending` means someone is (or was) mid-copy, and two
  * concurrent rebuilds of one room end with one of them renaming the other's work.
- * Best-effort: a house without house_events cannot answer, and that is not a reason to
+ * Best-effort: a house without events cannot answer, and that is not a reason to
  * block the migration that will create it.
  */
 async function unfinishedBy(q, ctx, migrationId) {
@@ -124,7 +124,8 @@ async function unfinishedBy(q, ctx, migrationId) {
     const rows = await q.rows(
       `SELECT argMax(status, event_at) AS status, argMax(actor, event_at) AS actor,
               formatDateTime(max(event_at), '%Y-%m-%d %H:%i') AS at
-       FROM house_events WHERE kind = 'migration' AND id = '${migrationId}'`);
+       FROM ${(ctx.rooms && ctx.rooms.physical && ctx.rooms.physical.events) || 'events'}
+       WHERE kind = 'migration' AND id = '${migrationId}'`);
     const r = rows[0];
     if (r && r.status === 'pending' && r.actor && r.actor !== ctx.member) return r;
   } catch { /* no events table yet */ }

package/memhouse/house/relocate.js

@@ -12,8 +12,8 @@
 // not insertable even with insert_allow_materialized_columns.
 const DERIVED = ['text_ngram', 'text_word'];
 
-// house_meta keys that are DURABLE facts of the house — worth carrying to the new host.
-// Everything else in house_meta is a per-host heartbeat (client_version, client_schema,
+// meta keys that are DURABLE facts of the house — worth carrying to the new host.
+// Everything else in meta is a per-host heartbeat (client_version, client_schema,
 // last_ship:<writer>) that the new shipper rewrites for itself on its first run; carrying
 // a stale one would misreport which machine last shipped until that run lands.
 function isDurableMetaKey(key) {

package/memhouse/house/schema.sql.tpl

@@ -154,10 +154,10 @@ ORDER BY (session_id, user_id, origin, epoch, idx);
 -- authoritative and always current, and a mirror of them would be a second truth that
 -- goes stale. What is recorded is what those cannot say: intent, sequence, outcome.
 
-CREATE TABLE IF NOT EXISTS house_meta
+CREATE TABLE IF NOT EXISTS meta
 (
     -- House-wide keys only ('schema_version', 'house_created_at'). Anything per-member
-    -- or per-machine belongs in house_events, which is append-only — this room is
+    -- or per-machine belongs in events, which is append-only — this room is
     -- latest-wins, so two members writing one key would overwrite each other.
     key String,
     value String,
@@ -168,7 +168,7 @@ CREATE TABLE IF NOT EXISTS house_meta
 ENGINE = ReplacingMergeTree(updated_at)
 ORDER BY (key);
 
-CREATE TABLE IF NOT EXISTS house_events
+CREATE TABLE IF NOT EXISTS events
 (
     event_at DateTime64(3, 'UTC') DEFAULT now64(3),
     -- 'migration' — a room rebuild, one row per transition (pending → applied|failed)

package/memhouse/provision.js

@@ -0,0 +1,100 @@
+// Provisioning a member — THE plan, whether memhouse executes it or a DBA does.
+//
+// There used to be three copies of this: the live path (adminBootstrap), the printed one
+// (--print-sql), and install --admin-user. They drifted, and the printed copy handed a
+// non-admin the one configuration the live path refuses — found in a drill, not by a
+// test. A plan that is data cannot drift from itself: the live path executes it,
+// --print-sql prints it, and the unit tests assert on it.
+//
+// The plan is a member and a database, and its centre is one statement:
+//
+//   GRANT <room privileges> ON <db>.<member>_* TO <member> WITH GRANT OPTION
+//
+// A wildcard on the member's own name. It covers rooms that do not exist yet, so the
+// member's shipper creates their rooms itself, a schema rebuild can CREATE and EXCHANGE
+// inside the pattern, and a share can name the whole set or one table. It reaches nothing
+// outside the pattern — measured on 26.7: a member cannot create, read, list, drop or
+// re-grant a housemate's rooms — and a colleague can read it back with SHOW GRANTS in one
+// line, which is the property the whole product rests on.
+//
+// Nobody is ever granted ALL ON <db>.*. That grant is dynamic (it covers rooms created
+// later), and it is what turned two members in one database into a leak.
+
+const { MEMBER_PIN, assertUsableName, roomPattern } = require('./house/house');
+
+/**
+ * What a member may do inside their own pattern. Each entry earns its place:
+ *   SELECT, INSERT           the shipper writes, everything else reads
+ *   ALTER, OPTIMIZE          ensureSchema adds columns in place; doctor compacts
+ *   CREATE TABLE, DROP TABLE their own rooms on first ship; a rebuild on migrate
+ *   ROW POLICY *             `share --only` scopes a grantee to a project or a session
+ */
+const ROOM_PRIVILEGES = [
+  'SELECT', 'INSERT', 'ALTER', 'OPTIMIZE',
+  'CREATE TABLE', 'DROP TABLE',
+  'CREATE ROW POLICY', 'ALTER ROW POLICY', 'DROP ROW POLICY', 'SHOW ROW POLICIES',
+];
+
+function roomGrant(db, member) {
+  return `GRANT ${ROOM_PRIVILEGES.join(', ')} ON ${db}.${roomPattern(member)} TO ${member} WITH GRANT OPTION`;
+}
+
+function sqlString(v) {
+  return `'${String(v).replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
+}
+
+/**
+ * The statements that make `member` a member of house `db`, in order.
+ *
+ * `optional` marks steps that need ACCESS MANAGEMENT the admin may not hold. The live
+ * path skips those on refusal and says what the member loses; a refused required step
+ * aborts. `password` may be null for a member that already exists (an invite re-run, an
+ * install against an account the DBA made) — then the CREATE USER step is omitted and the
+ * rest still applies.
+ *
+ * @returns {Array<{sql:string, why:string, optional:boolean}>}
+ */
+function plan({ db, member, password = null }) {
+  assertUsableName(db, 'house');
+  assertUsableName(member, 'member');
+  const steps = [
+    { sql: `CREATE DATABASE IF NOT EXISTS ${db}`, why: 'the house', optional: false },
+  ];
+  if (password !== null) {
+    steps.push({ sql: `CREATE USER IF NOT EXISTS ${member} IDENTIFIED BY ${sqlString(password)}`, why: 'the member', optional: false });
+  }
+  steps.push(
+    { sql: roomGrant(db, member), why: `their rooms — ${db}.${roomPattern(member)} — and nothing else in the house`, optional: false },
+    { sql: `ALTER USER ${member} ADD SETTING ${MEMBER_PIN}`, why: 'user_id is stamped on every row; an async insert would skip the stamp', optional: false },
+    { sql: `GRANT ALTER USER ON ${member} TO ${member}`, why: '`memhouse passwd` without an admin (their own account only)', optional: true },
+    { sql: `GRANT SHOW USERS ON *.* TO ${member}`, why: 'see who to share with — names only, never data', optional: true },
+    { sql: `GRANT REMOTE ON *.* TO ${member}`, why: '`memhouse relocate` pulls the old house over remoteSecure()', optional: true },
+  );
+  return steps;
+}
+
+/**
+ * The plan as SQL a person runs — clickhouse-client, the play UI, curl. One statement per
+ * line so it can be split on ';' by anything, comments above each saying why.
+ */
+function render(steps, { db, member }) {
+  const out = [
+    `-- memhouse: make '${member}' a member of house '${db}'.`,
+    '-- Run as a user with ACCESS MANAGEMENT (a stock \'default\' with access_management=1 will do).',
+    '--',
+    `-- One grant, on ${db}.${roomPattern(member)}: their rooms and nothing else in the database.`,
+    '-- Housemates keep their own rooms beside these and cannot read them. Do NOT widen it to',
+    `-- ${db}.* — that reaches every housemate's rooms, present and future.`,
+    '--',
+    `-- Their rooms are created by their own first \`memhouse ship\`; nothing to pre-build.`,
+    '',
+  ];
+  for (const s of steps) {
+    out.push(`-- ${s.why}${s.optional ? '  (optional: needs ACCESS MANAGEMENT; skip if refused)' : ''}`);
+    out.push(`${s.sql};`);
+    out.push('');
+  }
+  return out.join('\n');
+}
+
+module.exports = { ROOM_PRIVILEGES, roomGrant, plan, render };

package/memhouse/share.js

@@ -0,0 +1,64 @@
+/**
+ * `memhouse share <user> [--only <scope>] [--revoke]` / `memhouse share --list`
+ *
+ * Full share is one statement: GRANT SELECT on the house. Partial share adds a ROW
+ * POLICY per room, so the grantee reads only the rows the scope allows.
+ *
+ * Why no permissive catch-all policy for everyone else, which is the obvious design:
+ * row policies are OR'd, so a `USING 1 TO ALL EXCEPT alice` policy silently overrides
+ * the NEXT scoped grantee's filter — measured, bob saw all 22,500 rows instead of his
+ * 1,860. It fails OPEN and it fails quietly. ClickHouse already answers this correctly
+ * through `users_without_row_policies_can_read_rows`: a reader with no policy on a table
+ * still sees every row. Verified against a non-superuser member owning its own house —
+ * owner and full-share grantees were both unaffected while a third user was scoped.
+ *
+ * That setting is server config, not a query setting, and its default has moved between
+ * versions. So `probePermissive()` measures the behaviour before the first policy is
+ * created rather than assuming it, and refuses when the server would blindfold everyone.
+ */
+
+/** Columns a scope may filter on, and the column each room spells time with. */
+const SCOPE_COLUMNS = {
+  session: { column: () => 'session_id', quote: true },
+  project: { column: () => 'project', quote: true },
+  folder: { column: () => 'folder', quote: true },
+  host: { column: () => 'host', quote: true },
+  source: { column: () => 'source', quote: true },
+  // `sessions` has no `ts`; its clock is `created_at`. One literal predicate cannot span
+  // the rooms, so time scopes render per room.
+  since: { column: (room) => (room === 'sessions' ? 'created_at' : 'ts'), op: '>=' },
+  until: { column: (room) => (room === 'sessions' ? 'created_at' : 'ts'), op: '<' },
+};
+
+/** `project=memhouse,since=2026-01-01` -> [{key, value}], rejecting anything unknown. */
+function parseScope(raw) {
+  const out = [];
+  for (const part of String(raw).split(',').map((s) => s.trim()).filter(Boolean)) {
+    const m = /^([a-z_]+)\s*=\s*(.+)$/.exec(part);
+    if (!m) throw new Error(`scope "${part}" is not <key>=<value>`);
+    const key = m[1].toLowerCase();
+    if (!SCOPE_COLUMNS[key]) {
+      throw new Error(`unknown scope key "${key}" — try: ${Object.keys(SCOPE_COLUMNS).join(', ')}`);
+    }
+    out.push({ key, value: m[2].trim() });
+  }
+  if (!out.length) throw new Error('--only was given nothing to scope on');
+  return out;
+}
+
+/** The WHERE-shaped predicate for one room. Values are escaped, never interpolated raw. */
+function scopePredicate(scope, room, sqlStr) {
+  return scope.map(({ key, value }) => {
+    const spec = SCOPE_COLUMNS[key];
+    const col = spec.column(room);
+    if (spec.op) return `${col} ${spec.op} parseDateTimeBestEffort(${sqlStr(value)})`;
+    return `${col} = ${sqlStr(value)}`;
+  }).join(' AND ');
+}
+
+/** Policy name for a grantee's room — predictable, so revoke can find every one. */
+function policyName(user, room) {
+  return `mh_share_${user}_${room}`;
+}
+
+module.exports = { SCOPE_COLUMNS, parseScope, scopePredicate, policyName };