@rocicorp/zero 0.25.0-canary.7 → 0.25.0-canary.8

package/out/zero/src/zero-cache-dev.js.map

@@ -1 +1 @@
-{"version":3,"file":"zero-cache-dev.js","sourceRoot":"","sources":["../../../src/zero-cache-dev.ts"],"names":[],"mappings":";AAEA,OAAO,4BAA4B,CAAC;AAEpC,OAAO,EAAC,QAAQ,EAAC,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAC,KAAK,EAAC,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAC,KAAK,EAAoB,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAC,gBAAgB,EAAC,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAC,oBAAoB,EAAC,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,CAAC,MAAM,4BAA4B,CAAC;AAChD,OAAO,EACL,mBAAmB,EACnB,WAAW,GACZ,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAC,wBAAwB,EAAC,MAAM,6CAA6C,CAAC;AAErF,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAC1D,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,SAAS,WAAW,CAAC,YAAsC;IACzD,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,EAAC,OAAO,EAAE,OAAO,EAAC,GAAG,QAAQ,EAAE,CAAC;IACtC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,kDAAkD;IAClD,0DAA0D;IAC1D,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,EAAC,MAAM,EAAC,GAAG,oBAAoB,CACnC;QACE,MAAM,EAAE;YACN,IAAI,EAAE;gBACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;gBAC3B,IAAI,EAAE;oBACJ,6DAA6D;oBAC7D,2DAA2D;iBAC5D;gBACD,KAAK,EAAE,GAAG;aACX;SACF;QACD,GAAG,WAAW;KACf,EACD;QACE,aAAa,EAAE,mBAAmB;QAClC,wEAAwE;QACxE,YAAY,EAAE,IAAI,EAAE,sCAAsC;KAC3D,CACF,CAAC;IAEF,MAAM,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEpC,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE;QACxC,EAAE,CAAC,KAAK,EAAE,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC;QACtD,EAAE,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,MAAM,EAAC,GAAG,EAAE,oBAAoB,EAAC,GAAG,oBAAoB,CACtD,wBAAwB,EACxB;QACE,aAAa,EAAE,mBAAmB;QAClC,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;KACvB,CACF,CAAC;IACF,MAAM,EAAC,GAAG,EAAE,YAAY,EAAC,GAAG,oBAAoB,CAAC,WAAW,EAAE;QAC5D,aAAa,EAAE,mBAAmB;QAClC,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;KACvB,CAAC,CAAC;IAEH,IAAI,kBAA4C,CAAC;IACjD,IAAI,gBAA0C,CAAC;IAE/C,gEAAgE;IAChE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,iBAAiB;QAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAClC,EAAE,CAAC,IAAI,EAAE,CACP,uCAAuC,MAAM,CAAC,QAAQ,CAAC,IAAI,WAAW,CACvE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,kBAAkB,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,WAAW,CAAC,kBAAkB,CAAC,CAAC;QACtC,kBAAkB,GAAG,SAAS,CAAC;QAE/B,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,uBAAuB,GAAG,CAAC,CAAC;QACjD,kBAAkB,GAAG,KAAK,CAAC,uBAAuB,EAAE,EAAE,EAAE;YACtD,GAAG,EAAE,EAAC,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,oBAAoB,EAAC;YAC9C,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QAEH,MAAM,EAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAC,GAAG,QAAQ,EAAU,CAAC;QACpD,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,uBAAuB,0BAA0B,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,EAAE,CAAC,KAAK,EAAE,CAAC,qCAAqC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,gBAAgB,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAC;QACpC,gBAAgB,GAAG,SAAS,CAAC;QAE7B,EAAE,CAAC,IAAI,EAAE,CACP,WAAW,eAAe,6BAA6B,MAAM,CAAC,IAAI,IAAI,CACvE,CAAC;QACF,MAAM,GAAG,GAAsB;YAC7B,sEAAsE;YACtE,sCAAsC;YACtC,CAAC,uBAAuB,CAAC,EAAE,GAAG;YAC9B,CAAC,oBAAoB,CAAC,EAAE,GAAG;YAC3B,CAAC,yBAAyB,CAAC,EAAE,GAAG;YAEhC,wCAAwC;YACxC,8DAA8D;YAC9D,CAAC,UAAU,CAAC,EAAE,aAAa;YAE3B,4DAA4D;YAC5D,GAAG,OAAO,CAAC,GAAG;YACd,GAAG,YAAY;SAChB,CAAC;QACF,gBAAgB,GAAG,KAAK,CAAC,eAAe,EAAE,EAAE,EAAE;YAC5C,GAAG;YACH,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QACH,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YAC/B,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,eAAe,mBAAmB,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,kCAAkC;QAC/C,IAAI,MAAM,iBAAiB,EAAE,EAAE,CAAC;YAC9B,MAAM,cAAc,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,kCAAkC,EAAE,CAAC;QAE3C,yBAAyB;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YACxC,aAAa,EAAE,IAAI;YACnB,gBAAgB,EAAE,EAAC,kBAAkB,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAC;SAC/D,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE;YAC9B,EAAE,CAAC,IAAI,EAAE,CAAC,YAAY,MAAM,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC;YACpD,MAAM,iBAAiB,EAAE,CAAC;QAC5B,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACnC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,IAAI,EAAE,CAAC"}
+{"version":3,"file":"zero-cache-dev.js","sources":["../../../src/zero-cache-dev.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport '../../shared/src/dotenv.ts';\n\nimport {resolver} from '@rocicorp/resolver';\nimport {watch} from 'chokidar';\nimport {spawn, type ChildProcess} from 'node:child_process';\nimport {createLogContext} from '../../shared/src/logging.ts';\nimport {parseOptionsAdvanced} from '../../shared/src/options.ts';\nimport * as v from '../../shared/src/valita.ts';\nimport {\n  ZERO_ENV_VAR_PREFIX,\n  zeroOptions,\n} from '../../zero-cache/src/config/zero-config.ts';\nimport {deployPermissionsOptions} from '../../zero-cache/src/scripts/permissions.ts';\n\nconst deployPermissionsScript = 'zero-deploy-permissions';\nconst zeroCacheScript = 'zero-cache';\n\nfunction killProcess(childProcess: ChildProcess | undefined) {\n  if (!childProcess || childProcess.exitCode !== null) {\n    return Promise.resolve();\n  }\n  const {resolve, promise} = resolver();\n  childProcess.on('exit', resolve);\n  // Use SIGQUIT in particular since this will cause\n  // a fast zero-cache shutdown instead of a graceful drain.\n  childProcess.kill('SIGQUIT');\n  return promise;\n}\n\nasync function main() {\n  const {config} = parseOptionsAdvanced(\n    {\n      schema: {\n        path: {\n          type: v.string().optional(),\n          desc: [\n            'Relative path to the file containing the schema definition.',\n            'The file must have a default export of type SchemaConfig.',\n          ],\n          alias: 'p',\n        },\n      },\n      ...zeroOptions,\n    },\n    {\n      envNamePrefix: ZERO_ENV_VAR_PREFIX,\n      // TODO: This may no longer be necessary since multi-tenant was removed.\n      allowPartial: true, // required by server/runner/config.ts\n    },\n  );\n\n  const lc = createLogContext(config);\n\n  process.on('unhandledRejection', reason => {\n    lc.error?.('Unexpected unhandled rejection.', reason);\n    lc.error?.('Exiting');\n    process.exit(-1);\n  });\n\n  // Parse options for each subprocess to get environment variables\n  const {env: deployPermissionsEnv} = parseOptionsAdvanced(\n    deployPermissionsOptions,\n    {\n      envNamePrefix: ZERO_ENV_VAR_PREFIX,\n      allowUnknown: true,\n      includeDefaults: false,\n    },\n  );\n  const {env: zeroCacheEnv} = parseOptionsAdvanced(zeroOptions, {\n    envNamePrefix: ZERO_ENV_VAR_PREFIX,\n    allowUnknown: true,\n    includeDefaults: false,\n  });\n\n  let permissionsProcess: ChildProcess | undefined;\n  let zeroCacheProcess: ChildProcess | undefined;\n\n  // Ensure child processes are killed when the main process exits\n  process.on('exit', () => {\n    permissionsProcess?.kill('SIGQUIT');\n    zeroCacheProcess?.kill('SIGQUIT');\n  });\n\n  async function deployPermissions(): Promise<boolean> {\n    if (config.upstream.type !== 'pg') {\n      lc.warn?.(\n        `Skipping permissions deployment for ${config.upstream.type} upstream`,\n      );\n      return true;\n    }\n    permissionsProcess?.removeAllListeners('exit');\n    await killProcess(permissionsProcess);\n    permissionsProcess = undefined;\n\n    lc.info?.(`Running ${deployPermissionsScript}.`);\n    permissionsProcess = spawn(deployPermissionsScript, [], {\n      env: {...process.env, ...deployPermissionsEnv},\n      stdio: 'inherit',\n      shell: true,\n    });\n\n    const {promise: code, resolve} = resolver<number>();\n    permissionsProcess.on('exit', resolve);\n    if ((await code) === 0) {\n      lc.info?.(`${deployPermissionsScript} completed successfully.`);\n      return true;\n    }\n    lc.error?.(`Failed to deploy permissions from ${config.schema.path}.`);\n    return false;\n  }\n\n  async function startZeroCache() {\n    zeroCacheProcess?.removeAllListeners('exit');\n    await killProcess(zeroCacheProcess);\n    zeroCacheProcess = undefined;\n\n    lc.info?.(\n      `Running ${zeroCacheScript} at\\n\\n\\thttp://localhost:${config.port}\\n`,\n    );\n    const env: NodeJS.ProcessEnv = {\n      // Set some low defaults so as to use fewer resources and not trip up,\n      // e.g. developers sharing a database.\n      ['ZERO_NUM_SYNC_WORKERS']: '3',\n      ['ZERO_CVR_MAX_CONNS']: '6',\n      ['ZERO_UPSTREAM_MAX_CONNS']: '6',\n\n      // Default NODE_ENV to development mode.\n      // @ts-ignore NODE_ENV is not always set. Please ignore error.\n      ['NODE_ENV']: 'development',\n\n      // But let the developer override any of these dev defaults.\n      ...process.env,\n      ...zeroCacheEnv,\n    };\n    zeroCacheProcess = spawn(zeroCacheScript, [], {\n      env,\n      stdio: 'inherit',\n      shell: true,\n    });\n    zeroCacheProcess.on('exit', () => {\n      lc.error?.(`${zeroCacheScript} exited. Exiting.`);\n      process.exit(-1);\n    });\n  }\n\n  async function deployPermissionsAndStartZeroCache() {\n    if (await deployPermissions()) {\n      await startZeroCache();\n    }\n  }\n\n  if (config.schema.path) {\n    await deployPermissionsAndStartZeroCache();\n\n    // Watch for file changes\n    const watcher = watch(config.schema.path, {\n      ignoreInitial: true,\n      awaitWriteFinish: {stabilityThreshold: 500, pollInterval: 100},\n    });\n    const onFileChange = async () => {\n      lc.info?.(`Detected ${config.schema.path} change.`);\n      await deployPermissions();\n    };\n    watcher.on('add', onFileChange);\n    watcher.on('change', onFileChange);\n    watcher.on('unlink', onFileChange);\n  } else {\n    await startZeroCache();\n  }\n}\n\nvoid main();\n"],"names":["v.string"],"mappings":";;;;;;;;;;;AAgBA,MAAM,0BAA0B;AAChC,MAAM,kBAAkB;AAExB,SAAS,YAAY,cAAwC;AAC3D,MAAI,CAAC,gBAAgB,aAAa,aAAa,MAAM;AACnD,WAAO,QAAQ,QAAA;AAAA,EACjB;AACA,QAAM,EAAC,SAAS,QAAA,IAAW,SAAA;AAC3B,eAAa,GAAG,QAAQ,OAAO;AAG/B,eAAa,KAAK,SAAS;AAC3B,SAAO;AACT;AAEA,eAAe,OAAO;AACpB,QAAM,EAAC,WAAU;AAAA,IACf;AAAA,MACE,QAAQ;AAAA,QACN,MAAM;AAAA,UACJ,MAAMA,OAAE,EAAS,SAAA;AAAA,UACjB,MAAM;AAAA,YACJ;AAAA,YACA;AAAA,UAAA;AAAA,UAEF,OAAO;AAAA,QAAA;AAAA,MACT;AAAA,MAEF,GAAG;AAAA,IAAA;AAAA,IAEL;AAAA,MACE,eAAe;AAAA;AAAA,MAEf,cAAc;AAAA;AAAA,IAAA;AAAA,EAChB;AAGF,QAAM,KAAK,iBAAiB,MAAM;AAElC,UAAQ,GAAG,sBAAsB,CAAA,WAAU;AACzC,OAAG,QAAQ,mCAAmC,MAAM;AACpD,OAAG,QAAQ,SAAS;AACpB,YAAQ,KAAK,EAAE;AAAA,EACjB,CAAC;AAGD,QAAM,EAAC,KAAK,qBAAA,IAAwB;AAAA,IAClC;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,cAAc;AAAA,MACd,iBAAiB;AAAA,IAAA;AAAA,EACnB;AAEF,QAAM,EAAC,KAAK,iBAAgB,qBAAqB,aAAa;AAAA,IAC5D,eAAe;AAAA,IACf,cAAc;AAAA,IACd,iBAAiB;AAAA,EAAA,CAClB;AAED,MAAI;AACJ,MAAI;AAGJ,UAAQ,GAAG,QAAQ,MAAM;AACvB,wBAAoB,KAAK,SAAS;AAClC,sBAAkB,KAAK,SAAS;AAAA,EAClC,CAAC;AAED,iBAAe,oBAAsC;AACnD,QAAI,OAAO,SAAS,SAAS,MAAM;AACjC,SAAG;AAAA,QACD,uCAAuC,OAAO,SAAS,IAAI;AAAA,MAAA;AAE7D,aAAO;AAAA,IACT;AACA,wBAAoB,mBAAmB,MAAM;AAC7C,UAAM,YAAY,kBAAkB;AACpC,yBAAqB;AAErB,OAAG,OAAO,WAAW,uBAAuB,GAAG;AAC/C,yBAAqB,MAAM,yBAAyB,IAAI;AAAA,MACtD,KAAK,EAAC,GAAG,QAAQ,KAAK,GAAG,qBAAA;AAAA,MACzB,OAAO;AAAA,MACP,OAAO;AAAA,IAAA,CACR;AAED,UAAM,EAAC,SAAS,MAAM,QAAA,IAAW,SAAA;AACjC,uBAAmB,GAAG,QAAQ,OAAO;AACrC,QAAK,MAAM,SAAU,GAAG;AACtB,SAAG,OAAO,GAAG,uBAAuB,0BAA0B;AAC9D,aAAO;AAAA,IACT;AACA,OAAG,QAAQ,qCAAqC,OAAO,OAAO,IAAI,GAAG;AACrE,WAAO;AAAA,EACT;AAEA,iBAAe,iBAAiB;AAC9B,sBAAkB,mBAAmB,MAAM;AAC3C,UAAM,YAAY,gBAAgB;AAClC,uBAAmB;AAEnB,OAAG;AAAA,MACD,WAAW,eAAe;AAAA;AAAA,oBAA6B,OAAO,IAAI;AAAA;AAAA,IAAA;AAEpE,UAAM,MAAyB;AAAA;AAAA;AAAA,MAG7B,CAAC,uBAAuB,GAAG;AAAA,MAC3B,CAAC,oBAAoB,GAAG;AAAA,MACxB,CAAC,yBAAyB,GAAG;AAAA;AAAA;AAAA,MAI7B,CAAC,UAAU,GAAG;AAAA;AAAA,MAGd,GAAG,QAAQ;AAAA,MACX,GAAG;AAAA,IAAA;AAEL,uBAAmB,MAAM,iBAAiB,IAAI;AAAA,MAC5C;AAAA,MACA,OAAO;AAAA,MACP,OAAO;AAAA,IAAA,CACR;AACD,qBAAiB,GAAG,QAAQ,MAAM;AAChC,SAAG,QAAQ,GAAG,eAAe,mBAAmB;AAChD,cAAQ,KAAK,EAAE;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,iBAAe,qCAAqC;AAClD,QAAI,MAAM,qBAAqB;AAC7B,YAAM,eAAA;AAAA,IACR;AAAA,EACF;AAEA,MAAI,OAAO,OAAO,MAAM;AACtB,UAAM,mCAAA;AAGN,UAAM,UAAU,MAAM,OAAO,OAAO,MAAM;AAAA,MACxC,eAAe;AAAA,MACf,kBAAkB,EAAC,oBAAoB,KAAK,cAAc,IAAA;AAAA,IAAG,CAC9D;AACD,UAAM,eAAe,YAAY;AAC/B,SAAG,OAAO,YAAY,OAAO,OAAO,IAAI,UAAU;AAClD,YAAM,kBAAA;AAAA,IACR;AACA,YAAQ,GAAG,OAAO,YAAY;AAC9B,YAAQ,GAAG,UAAU,YAAY;AACjC,YAAQ,GAAG,UAAU,YAAY;AAAA,EACnC,OAAO;AACL,UAAM,eAAA;AAAA,EACR;AACF;AAEA,KAAK,KAAA;"}

package/out/zero/src/zero-out.js

@@ -2,12 +2,12 @@
 import "../../shared/src/dotenv.js";
 import { createLogContext } from "../../shared/src/logging.js";
 import { parseOptions } from "../../shared/src/options.js";
-import { ZERO_ENV_VAR_PREFIX as envNamePrefix } from "../../zero-cache/src/config/zero-config.js";
-import { decommissionOptions, decommissionZero, } from "../../zero-cache/src/scripts/decommission.js";
+import { ZERO_ENV_VAR_PREFIX } from "../../zero-cache/src/config/zero-config.js";
+import { decommissionOptions, decommissionZero } from "../../zero-cache/src/scripts/decommission.js";
 async function main() {
-    const config = parseOptions(decommissionOptions, { envNamePrefix });
-    const lc = createLogContext(config);
-    await decommissionZero(lc, config);
+  const config = parseOptions(decommissionOptions, { envNamePrefix: ZERO_ENV_VAR_PREFIX });
+  const lc = createLogContext(config);
+  await decommissionZero(lc, config);
 }
 void main();
-//# sourceMappingURL=zero-out.js.map
+//# sourceMappingURL=zero-out.js.map

package/out/zero/src/zero-out.js.map

@@ -1 +1 @@
-{"version":3,"file":"zero-out.js","sourceRoot":"","sources":["../../../src/zero-out.ts"],"names":[],"mappings":";AAEA,OAAO,4BAA4B,CAAC;AAEpC,OAAO,EAAC,gBAAgB,EAAC,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAC,YAAY,EAAC,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAC,mBAAmB,IAAI,aAAa,EAAC,MAAM,4CAA4C,CAAC;AAChG,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,8CAA8C,CAAC;AAEtD,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,YAAY,CAAC,mBAAmB,EAAE,EAAC,aAAa,EAAC,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,IAAI,EAAE,CAAC"}
+{"version":3,"file":"zero-out.js","sources":["../../../src/zero-out.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport '../../shared/src/dotenv.ts';\n\nimport {createLogContext} from '../../shared/src/logging.ts';\nimport {parseOptions} from '../../shared/src/options.ts';\nimport {ZERO_ENV_VAR_PREFIX as envNamePrefix} from '../../zero-cache/src/config/zero-config.ts';\nimport {\n  decommissionOptions,\n  decommissionZero,\n} from '../../zero-cache/src/scripts/decommission.ts';\n\nasync function main() {\n  const config = parseOptions(decommissionOptions, {envNamePrefix});\n  const lc = createLogContext(config);\n  await decommissionZero(lc, config);\n}\n\nvoid main();\n"],"names":["envNamePrefix"],"mappings":";;;;;;AAYA,eAAe,OAAO;AACpB,QAAM,SAAS,aAAa,qBAAqB,EAAA,eAACA,qBAAc;AAChE,QAAM,KAAK,iBAAiB,MAAM;AAClC,QAAM,iBAAiB,IAAI,MAAM;AACnC;AAEA,KAAK,KAAA;"}

package/out/zero/src/zero.js

@@ -0,0 +1,55 @@
+import { getDefaultPuller } from "../../replicache/src/get-default-puller.js";
+import { IDBNotFoundError } from "../../replicache/src/kv/idb-store.js";
+import { makeIDBName } from "../../replicache/src/make-idb-name.js";
+import { dropAllDatabases, dropDatabase } from "../../replicache/src/persist/collect-idb-databases.js";
+import { TransactionClosedError } from "../../replicache/src/transaction-closed-error.js";
+import { ApplicationError } from "../../zero-protocol/src/application-error.js";
+import { transformRequestMessageSchema, transformResponseMessageSchema } from "../../zero-protocol/src/custom-queries.js";
+import { relationships } from "../../zero-schema/src/builder/relationship-builder.js";
+import { createSchema } from "../../zero-schema/src/builder/schema-builder.js";
+import { boolean, enumeration, json, number, string, table } from "../../zero-schema/src/builder/table-builder.js";
+import { ANYONE_CAN, ANYONE_CAN_DO_ANYTHING, NOBODY_CAN, definePermissions } from "../../zero-schema/src/permissions.js";
+import { applyChange } from "../../zql/src/ivm/view-apply-change.js";
+import { defineQuery, defineQueryWithContextType, isQueryDefinition } from "../../zql/src/query/define-query.js";
+import { escapeLike } from "../../zql/src/query/escape-like.js";
+import { createBuilder, syncedQuery, syncedQueryWithContext, withValidation } from "../../zql/src/query/named.js";
+import { bindingsForZero, registerZeroDelegate } from "../../zero-client/src/client/bindings.js";
+import * as updateNeededReasonTypeEnum from "../../zero-client/src/client/update-needed-reason-type-enum.js";
+import { Zero } from "../../zero-client/src/client/zero.js";
+export {
+  ANYONE_CAN,
+  ANYONE_CAN_DO_ANYTHING,
+  ApplicationError,
+  IDBNotFoundError,
+  NOBODY_CAN,
+  TransactionClosedError,
+  updateNeededReasonTypeEnum as UpdateNeededReasonType,
+  Zero,
+  applyChange,
+  bindingsForZero,
+  boolean,
+  createBuilder,
+  createSchema,
+  definePermissions,
+  defineQuery,
+  defineQueryWithContextType,
+  dropAllDatabases,
+  dropDatabase,
+  enumeration,
+  escapeLike,
+  getDefaultPuller,
+  isQueryDefinition,
+  json,
+  makeIDBName,
+  number,
+  registerZeroDelegate,
+  relationships,
+  string,
+  syncedQuery,
+  syncedQueryWithContext,
+  table,
+  transformRequestMessageSchema,
+  transformResponseMessageSchema,
+  withValidation
+};
+//# sourceMappingURL=zero.js.map

package/out/zero/src/zero.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zero.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;"}

package/out/zero/src/zqlite.js

@@ -1,3 +1,11 @@
-// oxlint-disable-next-line no-restricted-imports
-export * from "../../zqlite/src/mod.js";
-//# sourceMappingURL=zqlite.js.map
+import { defaultFormat } from "../../zero-types/src/format.js";
+import { QueryImpl } from "../../zql/src/query/query-impl.js";
+import { Database } from "../../zqlite/src/db.js";
+import { QueryDelegateImpl } from "../../zqlite/src/query-delegate.js";
+export {
+  Database,
+  QueryDelegateImpl as QueryDelegate,
+  QueryImpl,
+  defaultFormat
+};
+//# sourceMappingURL=zqlite.js.map

package/out/zero/src/zqlite.js.map

@@ -1 +1 @@
-{"version":3,"file":"zqlite.js","sourceRoot":"","sources":["../../../src/zqlite.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"zqlite.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;"}

package/out/zero-cache/src/auth/jwt.js

@@ -1,49 +1,44 @@
-import { createRemoteJWKSet, jwtVerify, } from 'jose';
-import { exportJWK, generateKeyPair } from 'jose';
-export async function createJwkPair() {
-    const { publicKey, privateKey } = await generateKeyPair('PS256');
-    const privateJwk = await exportJWK(privateKey);
-    const publicJwk = await exportJWK(publicKey);
-    privateJwk.kid = 'key-2024-001';
-    privateJwk.use = 'sig';
-    privateJwk.alg = 'PS256';
-    publicJwk.kid = privateJwk.kid;
-    publicJwk.use = privateJwk.use;
-    publicJwk.alg = privateJwk.alg;
-    return { privateJwk, publicJwk };
-}
+import { jwtVerify, createRemoteJWKSet } from "jose";
 let remoteKeyset;
 function getRemoteKeyset(jwksUrl) {
-    if (remoteKeyset === undefined) {
-        remoteKeyset = createRemoteJWKSet(new URL(jwksUrl));
-    }
-    return remoteKeyset;
+  if (remoteKeyset === void 0) {
+    remoteKeyset = createRemoteJWKSet(new URL(jwksUrl));
+  }
+  return remoteKeyset;
 }
-export const tokenConfigOptions = (config) => {
-    const tokenOptions = ['jwk', 'secret', 'jwksUrl'].filter(key => config[key] !== undefined);
-    return tokenOptions;
+const tokenConfigOptions = (config) => {
+  const tokenOptions = ["jwk", "secret", "jwksUrl"].filter(
+    (key) => config[key] !== void 0
+  );
+  return tokenOptions;
 };
-export async function verifyToken(config, token, verifyOptions) {
-    if (config.jwk !== undefined) {
-        return verifyTokenImpl(token, loadJwk(config.jwk), verifyOptions);
-    }
-    if (config.secret !== undefined) {
-        return verifyTokenImpl(token, loadSecret(config.secret), verifyOptions);
-    }
-    if (config.jwksUrl !== undefined) {
-        const remoteKeyset = getRemoteKeyset(config.jwksUrl);
-        return (await jwtVerify(token, remoteKeyset, verifyOptions)).payload;
-    }
-    throw new Error('verifyToken was called but no auth options (one of: jwk, secret, jwksUrl) were configured.');
+async function verifyToken(config, token, verifyOptions) {
+  if (config.jwk !== void 0) {
+    return verifyTokenImpl(token, loadJwk(config.jwk), verifyOptions);
+  }
+  if (config.secret !== void 0) {
+    return verifyTokenImpl(token, loadSecret(config.secret), verifyOptions);
+  }
+  if (config.jwksUrl !== void 0) {
+    const remoteKeyset2 = getRemoteKeyset(config.jwksUrl);
+    return (await jwtVerify(token, remoteKeyset2, verifyOptions)).payload;
+  }
+  throw new Error(
+    "verifyToken was called but no auth options (one of: jwk, secret, jwksUrl) were configured."
+  );
 }
 function loadJwk(jwkString) {
-    return JSON.parse(jwkString);
+  return JSON.parse(jwkString);
 }
 function loadSecret(secret) {
-    return new TextEncoder().encode(secret);
+  return new TextEncoder().encode(secret);
 }
 async function verifyTokenImpl(token, verifyKey, verifyOptions) {
-    const { payload } = await jwtVerify(token, verifyKey, verifyOptions);
-    return payload;
+  const { payload } = await jwtVerify(token, verifyKey, verifyOptions);
+  return payload;
 }
-//# sourceMappingURL=jwt.js.map
+export {
+  tokenConfigOptions,
+  verifyToken
+};
+//# sourceMappingURL=jwt.js.map

package/out/zero-cache/src/auth/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,GAKV,MAAM,MAAM,CAAC;AAEd,OAAO,EAAC,SAAS,EAAE,eAAe,EAAC,MAAM,MAAM,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,EAAC,SAAS,EAAE,UAAU,EAAC,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAE/D,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAE7C,UAAU,CAAC,GAAG,GAAG,cAAc,CAAC;IAChC,UAAU,CAAC,GAAG,GAAG,KAAK,CAAC;IACvB,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC;IAEzB,SAAS,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC/B,SAAS,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC/B,SAAS,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAE/B,OAAO,EAAC,UAAU,EAAE,SAAS,EAAC,CAAC;AACjC,CAAC;AAED,IAAI,YAA+D,CAAC;AACpE,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,YAAY,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAkB,EAAE,EAAE;IACvD,MAAM,YAAY,GAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAW,CAAC,MAAM,CACjE,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CACjC,CAAC;IAEF,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAkB,EAClB,KAAa,EACb,aAA0C;IAE1C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,SAAiB;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAQ,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAAa,EACb,SAAqC,EACrC,aAA0C;IAE1C,MAAM,EAAC,OAAO,EAAC,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IAEnE,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"jwt.js","sources":["../../../../../zero-cache/src/auth/jwt.ts"],"sourcesContent":["import {\n  createRemoteJWKSet,\n  jwtVerify,\n  type JWK,\n  type JWTClaimVerificationOptions,\n  type JWTPayload,\n  type KeyLike,\n} from 'jose';\nimport type {AuthConfig} from '../config/zero-config.ts';\nimport {exportJWK, generateKeyPair} from 'jose';\n\nexport async function createJwkPair() {\n  const {publicKey, privateKey} = await generateKeyPair('PS256');\n\n  const privateJwk = await exportJWK(privateKey);\n  const publicJwk = await exportJWK(publicKey);\n\n  privateJwk.kid = 'key-2024-001';\n  privateJwk.use = 'sig';\n  privateJwk.alg = 'PS256';\n\n  publicJwk.kid = privateJwk.kid;\n  publicJwk.use = privateJwk.use;\n  publicJwk.alg = privateJwk.alg;\n\n  return {privateJwk, publicJwk};\n}\n\nlet remoteKeyset: ReturnType<typeof createRemoteJWKSet> | undefined;\nfunction getRemoteKeyset(jwksUrl: string) {\n  if (remoteKeyset === undefined) {\n    remoteKeyset = createRemoteJWKSet(new URL(jwksUrl));\n  }\n\n  return remoteKeyset;\n}\n\nexport const tokenConfigOptions = (config: AuthConfig) => {\n  const tokenOptions = (['jwk', 'secret', 'jwksUrl'] as const).filter(\n    key => config[key] !== undefined,\n  );\n\n  return tokenOptions;\n};\n\nexport async function verifyToken(\n  config: AuthConfig,\n  token: string,\n  verifyOptions: JWTClaimVerificationOptions,\n): Promise<JWTPayload> {\n  if (config.jwk !== undefined) {\n    return verifyTokenImpl(token, loadJwk(config.jwk), verifyOptions);\n  }\n\n  if (config.secret !== undefined) {\n    return verifyTokenImpl(token, loadSecret(config.secret), verifyOptions);\n  }\n\n  if (config.jwksUrl !== undefined) {\n    const remoteKeyset = getRemoteKeyset(config.jwksUrl);\n    return (await jwtVerify(token, remoteKeyset, verifyOptions)).payload;\n  }\n\n  throw new Error(\n    'verifyToken was called but no auth options (one of: jwk, secret, jwksUrl) were configured.',\n  );\n}\n\nfunction loadJwk(jwkString: string) {\n  return JSON.parse(jwkString) as JWK;\n}\n\nfunction loadSecret(secret: string) {\n  return new TextEncoder().encode(secret);\n}\n\nasync function verifyTokenImpl(\n  token: string,\n  verifyKey: Uint8Array | KeyLike | JWK,\n  verifyOptions: JWTClaimVerificationOptions,\n): Promise<JWTPayload> {\n  const {payload} = await jwtVerify(token, verifyKey, verifyOptions);\n\n  return payload;\n}\n"],"names":["remoteKeyset"],"mappings":";AA4BA,IAAI;AACJ,SAAS,gBAAgB,SAAiB;AACxC,MAAI,iBAAiB,QAAW;AAC9B,mBAAe,mBAAmB,IAAI,IAAI,OAAO,CAAC;AAAA,EACpD;AAEA,SAAO;AACT;AAEO,MAAM,qBAAqB,CAAC,WAAuB;AACxD,QAAM,eAAgB,CAAC,OAAO,UAAU,SAAS,EAAY;AAAA,IAC3D,CAAA,QAAO,OAAO,GAAG,MAAM;AAAA,EAAA;AAGzB,SAAO;AACT;AAEA,eAAsB,YACpB,QACA,OACA,eACqB;AACrB,MAAI,OAAO,QAAQ,QAAW;AAC5B,WAAO,gBAAgB,OAAO,QAAQ,OAAO,GAAG,GAAG,aAAa;AAAA,EAClE;AAEA,MAAI,OAAO,WAAW,QAAW;AAC/B,WAAO,gBAAgB,OAAO,WAAW,OAAO,MAAM,GAAG,aAAa;AAAA,EACxE;AAEA,MAAI,OAAO,YAAY,QAAW;AAChC,UAAMA,gBAAe,gBAAgB,OAAO,OAAO;AACnD,YAAQ,MAAM,UAAU,OAAOA,eAAc,aAAa,GAAG;AAAA,EAC/D;AAEA,QAAM,IAAI;AAAA,IACR;AAAA,EAAA;AAEJ;AAEA,SAAS,QAAQ,WAAmB;AAClC,SAAO,KAAK,MAAM,SAAS;AAC7B;AAEA,SAAS,WAAW,QAAgB;AAClC,SAAO,IAAI,YAAA,EAAc,OAAO,MAAM;AACxC;AAEA,eAAe,gBACb,OACA,WACA,eACqB;AACrB,QAAM,EAAC,QAAA,IAAW,MAAM,UAAU,OAAO,WAAW,aAAa;AAEjE,SAAO;AACT;"}

package/out/zero-cache/src/auth/load-permissions.js

@@ -1,50 +1,66 @@
-import * as v from "../../../shared/src/valita.js";
-import { permissionsConfigSchema, } from "../../../zero-schema/src/compiled-permissions.js";
+import { parse } from "../../../shared/src/valita.js";
+import { permissionsConfigSchema } from "../../../zero-schema/src/compiled-permissions.js";
 import { computeZqlSpecs } from "../db/lite-tables.js";
 import { elide } from "../types/strings.js";
-export function loadPermissions(lc, replica, appID) {
-    const { permissions, hash } = replica.get(`SELECT permissions, hash FROM "${appID}.permissions"`);
-    if (permissions === null) {
-        const appIDFlag = appID === 'zero' ? '' : ` --app-id=${appID}`;
-        lc.warn?.(`\n\n\n` +
-            `No upstream permissions deployed.\n` +
-            `Run 'npx zero-deploy-permissions${appIDFlag}' to enforce permissions.` +
-            `\n\n\n`);
-        return { permissions, hash: null };
-    }
-    let obj;
-    let parsed;
-    try {
-        obj = JSON.parse(permissions);
-        parsed = v.parse(obj, permissionsConfigSchema);
-    }
-    catch (e) {
-        // TODO: Plumb the --server-version and include in error message.
-        throw new Error(`Could not parse upstream permissions: ` +
-            `'${elide(String(permissions), 100)}'.\n` +
-            `This may happen if Permissions with a new internal format are ` +
-            `deployed before the supporting server has been fully rolled out.`, { cause: e });
-    }
-    return { permissions: parsed, hash };
+function loadPermissions(lc, replica, appID) {
+  const { permissions, hash } = replica.get(
+    `SELECT permissions, hash FROM "${appID}.permissions"`
+  );
+  if (permissions === null) {
+    const appIDFlag = appID === "zero" ? "" : ` --app-id=${appID}`;
+    lc.warn?.(
+      `
+
+
+No upstream permissions deployed.
+Run 'npx zero-deploy-permissions${appIDFlag}' to enforce permissions.
+
+
+`
+    );
+    return { permissions, hash: null };
+  }
+  let obj;
+  let parsed;
+  try {
+    obj = JSON.parse(permissions);
+    parsed = parse(obj, permissionsConfigSchema);
+  } catch (e) {
+    throw new Error(
+      `Could not parse upstream permissions: '${elide(String(permissions), 100)}'.
+This may happen if Permissions with a new internal format are deployed before the supporting server has been fully rolled out.`,
+      { cause: e }
+    );
+  }
+  return { permissions: parsed, hash };
 }
-export function reloadPermissionsIfChanged(lc, replica, appID, current) {
-    if (current === null) {
-        return { permissions: loadPermissions(lc, replica, appID), changed: true };
-    }
-    const { hash } = replica.get(`SELECT hash FROM "${appID}.permissions"`);
-    return hash === current.hash
-        ? { permissions: current, changed: false }
-        : { permissions: loadPermissions(lc, replica, appID), changed: true };
+function reloadPermissionsIfChanged(lc, replica, appID, current) {
+  if (current === null) {
+    return { permissions: loadPermissions(lc, replica, appID), changed: true };
+  }
+  const { hash } = replica.get(`SELECT hash FROM "${appID}.permissions"`);
+  return hash === current.hash ? { permissions: current, changed: false } : { permissions: loadPermissions(lc, replica, appID), changed: true };
 }
-export function getSchema(lc, replica) {
-    const specs = computeZqlSpecs(lc, replica);
-    const tables = Object.fromEntries([...specs.values()].map(table => {
-        const { tableSpec: { name, primaryKey }, zqlSpec: columns, } = table;
-        return [name, { name, columns, primaryKey }];
-    }));
-    return {
-        tables,
-        relationships: {}, // relationships are already denormalized in ASTs
-    };
+function getSchema(lc, replica) {
+  const specs = computeZqlSpecs(lc, replica);
+  const tables = Object.fromEntries(
+    [...specs.values()].map((table) => {
+      const {
+        tableSpec: { name, primaryKey },
+        zqlSpec: columns
+      } = table;
+      return [name, { name, columns, primaryKey }];
+    })
+  );
+  return {
+    tables,
+    relationships: {}
+    // relationships are already denormalized in ASTs
+  };
 }
-//# sourceMappingURL=load-permissions.js.map
+export {
+  getSchema,
+  loadPermissions,
+  reloadPermissionsIfChanged
+};
+//# sourceMappingURL=load-permissions.js.map

package/out/zero-cache/src/auth/load-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"load-permissions.js","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/load-permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AACnD,OAAO,EACL,uBAAuB,GAExB,MAAM,kDAAkD,CAAC;AAI1D,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAC,KAAK,EAAC,MAAM,qBAAqB,CAAC;AAO1C,MAAM,UAAU,eAAe,CAC7B,EAAc,EACd,OAAwB,EACxB,KAAa;IAEb,MAAM,EAAC,WAAW,EAAE,IAAI,EAAC,GAAG,OAAO,CAAC,GAAG,CACrC,kCAAkC,KAAK,eAAe,CACvD,CAAC;IACF,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,EAAE,CAAC;QAC/D,EAAE,CAAC,IAAI,EAAE,CACP,QAAQ;YACN,qCAAqC;YACrC,mCAAmC,SAAS,2BAA2B;YACvE,QAAQ,CACX,CAAC;QACF,OAAO,EAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAC,CAAC;IACnC,CAAC;IACD,IAAI,GAAG,CAAC;IACR,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9B,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,iEAAiE;QACjE,MAAM,IAAI,KAAK,CACb,wCAAwC;YACtC,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM;YACzC,gEAAgE;YAChE,kEAAkE,EACpE,EAAC,KAAK,EAAE,CAAC,EAAC,CACX,CAAC;IACJ,CAAC;IACD,OAAO,EAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,EAAc,EACd,OAAwB,EACxB,KAAa,EACb,OAAiC;IAEjC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAC,WAAW,EAAE,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;IAC3E,CAAC;IACD,MAAM,EAAC,IAAI,EAAC,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,eAAe,CAAC,CAAC;IACtE,OAAO,IAAI,KAAK,OAAO,CAAC,IAAI;QAC1B,CAAC,CAAC,EAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAC;QACxC,CAAC,CAAC,EAAC,WAAW,EAAE,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAc,EAAE,OAAiB;IACzD,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QAC9B,MAAM,EACJ,SAAS,EAAE,EAAC,IAAI,EAAE,UAAU,EAAC,EAC7B,OAAO,EAAE,OAAO,GACjB,GAAG,KAAK,CAAC;QACV,OAAO,CAAC,IAAI,EAAE,EAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAuB,CAAC,CAAC;IACnE,CAAC,CAAC,CACH,CAAC;IACF,OAAO;QACL,MAAM;QACN,aAAa,EAAE,EAAE,EAAE,iDAAiD;KACrE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"load-permissions.js","sources":["../../../../../zero-cache/src/auth/load-permissions.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport * as v from '../../../shared/src/valita.ts';\nimport {\n  permissionsConfigSchema,\n  type PermissionsConfig,\n} from '../../../zero-schema/src/compiled-permissions.ts';\nimport type {TableSchema} from '../../../zero-schema/src/table-schema.ts';\nimport type {Schema} from '../../../zero-types/src/schema.ts';\nimport type {Database} from '../../../zqlite/src/db.ts';\nimport {computeZqlSpecs} from '../db/lite-tables.ts';\nimport type {StatementRunner} from '../db/statements.ts';\nimport {elide} from '../types/strings.ts';\n\nexport type LoadedPermissions = {\n  permissions: PermissionsConfig | null;\n  hash: string | null;\n};\n\nexport function loadPermissions(\n  lc: LogContext,\n  replica: StatementRunner,\n  appID: string,\n): LoadedPermissions {\n  const {permissions, hash} = replica.get(\n    `SELECT permissions, hash FROM \"${appID}.permissions\"`,\n  );\n  if (permissions === null) {\n    const appIDFlag = appID === 'zero' ? '' : ` --app-id=${appID}`;\n    lc.warn?.(\n      `\\n\\n\\n` +\n        `No upstream permissions deployed.\\n` +\n        `Run 'npx zero-deploy-permissions${appIDFlag}' to enforce permissions.` +\n        `\\n\\n\\n`,\n    );\n    return {permissions, hash: null};\n  }\n  let obj;\n  let parsed;\n  try {\n    obj = JSON.parse(permissions);\n    parsed = v.parse(obj, permissionsConfigSchema);\n  } catch (e) {\n    // TODO: Plumb the --server-version and include in error message.\n    throw new Error(\n      `Could not parse upstream permissions: ` +\n        `'${elide(String(permissions), 100)}'.\\n` +\n        `This may happen if Permissions with a new internal format are ` +\n        `deployed before the supporting server has been fully rolled out.`,\n      {cause: e},\n    );\n  }\n  return {permissions: parsed, hash};\n}\n\nexport function reloadPermissionsIfChanged(\n  lc: LogContext,\n  replica: StatementRunner,\n  appID: string,\n  current: LoadedPermissions | null,\n): {permissions: LoadedPermissions; changed: boolean} {\n  if (current === null) {\n    return {permissions: loadPermissions(lc, replica, appID), changed: true};\n  }\n  const {hash} = replica.get(`SELECT hash FROM \"${appID}.permissions\"`);\n  return hash === current.hash\n    ? {permissions: current, changed: false}\n    : {permissions: loadPermissions(lc, replica, appID), changed: true};\n}\n\nexport function getSchema(lc: LogContext, replica: Database): Schema {\n  const specs = computeZqlSpecs(lc, replica);\n  const tables = Object.fromEntries(\n    [...specs.values()].map(table => {\n      const {\n        tableSpec: {name, primaryKey},\n        zqlSpec: columns,\n      } = table;\n      return [name, {name, columns, primaryKey} satisfies TableSchema];\n    }),\n  );\n  return {\n    tables,\n    relationships: {}, // relationships are already denormalized in ASTs\n  };\n}\n"],"names":["v.parse"],"mappings":";;;;AAkBO,SAAS,gBACd,IACA,SACA,OACmB;AACnB,QAAM,EAAC,aAAa,KAAA,IAAQ,QAAQ;AAAA,IAClC,kCAAkC,KAAK;AAAA,EAAA;AAEzC,MAAI,gBAAgB,MAAM;AACxB,UAAM,YAAY,UAAU,SAAS,KAAK,aAAa,KAAK;AAC5D,OAAG;AAAA,MACD;AAAA;AAAA;AAAA;AAAA,kCAEqC,SAAS;AAAA;AAAA;AAAA;AAAA,IAAA;AAGhD,WAAO,EAAC,aAAa,MAAM,KAAA;AAAA,EAC7B;AACA,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,WAAW;AAC5B,aAASA,MAAQ,KAAK,uBAAuB;AAAA,EAC/C,SAAS,GAAG;AAEV,UAAM,IAAI;AAAA,MACR,0CACM,MAAM,OAAO,WAAW,GAAG,GAAG,CAAC;AAAA;AAAA,MAGrC,EAAC,OAAO,EAAA;AAAA,IAAC;AAAA,EAEb;AACA,SAAO,EAAC,aAAa,QAAQ,KAAA;AAC/B;AAEO,SAAS,2BACd,IACA,SACA,OACA,SACoD;AACpD,MAAI,YAAY,MAAM;AACpB,WAAO,EAAC,aAAa,gBAAgB,IAAI,SAAS,KAAK,GAAG,SAAS,KAAA;AAAA,EACrE;AACA,QAAM,EAAC,KAAA,IAAQ,QAAQ,IAAI,qBAAqB,KAAK,eAAe;AACpE,SAAO,SAAS,QAAQ,OACpB,EAAC,aAAa,SAAS,SAAS,MAAA,IAChC,EAAC,aAAa,gBAAgB,IAAI,SAAS,KAAK,GAAG,SAAS,KAAA;AAClE;AAEO,SAAS,UAAU,IAAgB,SAA2B;AACnE,QAAM,QAAQ,gBAAgB,IAAI,OAAO;AACzC,QAAM,SAAS,OAAO;AAAA,IACpB,CAAC,GAAG,MAAM,QAAQ,EAAE,IAAI,CAAA,UAAS;AAC/B,YAAM;AAAA,QACJ,WAAW,EAAC,MAAM,WAAA;AAAA,QAClB,SAAS;AAAA,MAAA,IACP;AACJ,aAAO,CAAC,MAAM,EAAC,MAAM,SAAS,YAAiC;AAAA,IACjE,CAAC;AAAA,EAAA;AAEH,SAAO;AAAA,IACL;AAAA,IACA,eAAe,CAAA;AAAA;AAAA,EAAC;AAEpB;"}

package/out/zero-cache/src/auth/read-authorizer.js

@@ -1,104 +1,92 @@
 import { hashOfAST } from "../../../zero-protocol/src/query-hash.js";
 import { bindStaticParameters } from "../../../zql/src/builder/builder.js";
 import { simplifyCondition } from "../../../zql/src/query/expression.js";
-/**
- * Adds permission rules to the given query so it only returns rows that the
- * user is allowed to read.
- *
- * If the returned query is `undefined` that means that user cannot run
- * the query at all. This is only the case if we can infer that all rows
- * would be excluded without running the query.
- * E.g., the user is trying to query a table that is not readable.
- */
-export function transformAndHashQuery(lc, id, query, permissionRules, authData, internalQuery) {
-    const transformed = internalQuery
-        ? query // application permissions do not apply to internal queries
-        : transformQuery(lc, query, permissionRules, authData);
-    return {
-        id,
-        transformedAst: transformed,
-        transformationHash: hashOfAST(transformed),
-    };
+function transformAndHashQuery(lc, id, query, permissionRules, authData, internalQuery) {
+  const transformed = internalQuery ? query : transformQuery(lc, query, permissionRules, authData);
+  return {
+    id,
+    transformedAst: transformed,
+    transformationHash: hashOfAST(transformed)
+  };
 }
-/**
- * For a given AST, apply the read-auth rules and bind static auth data.
- */
-export function transformQuery(lc, query, permissionRules, authData) {
-    const queryWithPermissions = transformQueryInternal(lc, query, permissionRules);
-    return bindStaticParameters(queryWithPermissions, {
-        authData: authData,
-    });
+function transformQuery(lc, query, permissionRules, authData) {
+  const queryWithPermissions = transformQueryInternal(
+    lc,
+    query,
+    permissionRules
+  );
+  return bindStaticParameters(queryWithPermissions, {
+    authData
+  });
 }
 function transformQueryInternal(lc, query, permissionRules) {
-    let rowSelectRules = permissionRules.tables[query.table]?.row?.select;
-    if (!rowSelectRules || rowSelectRules.length === 0) {
-        // If there are no rules, we default to not allowing any rows to be selected.
-        lc.warn?.("No permission rules found for table '" +
-            query.table +
-            "'. No rows will be returned. Use ANYONE_CAN to allow all users to access all rows.");
-        rowSelectRules = [
-            [
-                'allow',
-                {
-                    type: 'or',
-                    conditions: [],
-                },
-            ],
-        ];
-    }
-    const updatedWhere = addRulesToWhere(query.where
-        ? transformCondition(lc, query.where, permissionRules)
-        : undefined, rowSelectRules);
-    return {
-        ...query,
-        where: simplifyCondition(updatedWhere),
-        related: query.related?.map(sq => {
-            const subquery = transformQueryInternal(lc, sq.subquery, permissionRules);
-            return {
-                ...sq,
-                subquery,
-            };
-        }),
-    };
+  let rowSelectRules = permissionRules.tables[query.table]?.row?.select;
+  if (!rowSelectRules || rowSelectRules.length === 0) {
+    lc.warn?.(
+      "No permission rules found for table '" + query.table + "'. No rows will be returned. Use ANYONE_CAN to allow all users to access all rows."
+    );
+    rowSelectRules = [
+      [
+        "allow",
+        {
+          type: "or",
+          conditions: []
+        }
+      ]
+    ];
+  }
+  const updatedWhere = addRulesToWhere(
+    query.where ? transformCondition(lc, query.where, permissionRules) : void 0,
+    rowSelectRules
+  );
+  return {
+    ...query,
+    where: simplifyCondition(updatedWhere),
+    related: query.related?.map((sq) => {
+      const subquery = transformQueryInternal(lc, sq.subquery, permissionRules);
+      return {
+        ...sq,
+        subquery
+      };
+    })
+  };
 }
 function addRulesToWhere(where, rowSelectRules) {
-    return {
-        type: 'and',
-        conditions: [
-            ...(where ? [where] : []),
-            {
-                type: 'or',
-                conditions: rowSelectRules.map(([_, condition]) => condition),
-            },
-        ],
-    };
+  return {
+    type: "and",
+    conditions: [
+      ...where ? [where] : [],
+      {
+        type: "or",
+        conditions: rowSelectRules.map(([_, condition]) => condition)
+      }
+    ]
+  };
 }
-// We must augment conditions so we do not provide an oracle to users.
-// E.g.,
-// `issue.whereExists('secret', s => s.where('value', 'sdf'))`
-// Not applying read policies to subqueries in the where position
-// would allow users to infer the existence of rows, and their contents,
-// that they cannot read.
 function transformCondition(lc, cond, auth) {
-    switch (cond.type) {
-        case 'simple':
-            return cond;
-        case 'and':
-        case 'or':
-            return {
-                ...cond,
-                conditions: cond.conditions.map(c => transformCondition(lc, c, auth)),
-            };
-        case 'correlatedSubquery': {
-            const query = transformQueryInternal(lc, cond.related.subquery, auth);
-            return {
-                ...cond,
-                related: {
-                    ...cond.related,
-                    subquery: query,
-                },
-            };
+  switch (cond.type) {
+    case "simple":
+      return cond;
+    case "and":
+    case "or":
+      return {
+        ...cond,
+        conditions: cond.conditions.map((c) => transformCondition(lc, c, auth))
+      };
+    case "correlatedSubquery": {
+      const query = transformQueryInternal(lc, cond.related.subquery, auth);
+      return {
+        ...cond,
+        related: {
+          ...cond.related,
+          subquery: query
         }
+      };
     }
+  }
 }
-//# sourceMappingURL=read-authorizer.js.map
+export {
+  transformAndHashQuery,
+  transformQuery
+};
+//# sourceMappingURL=read-authorizer.js.map