@rocicorp/zero 0.25.0-canary.9 → 0.25.1

package/out/zero/src/pg.js

@@ -1,13 +1,14 @@
 import { ApplicationError, isApplicationError, wrapWithApplicationError } from "../../zero-protocol/src/application-error.js";
-import { customMutatorKey, splitMutatorKey } from "../../zql/src/mutate/custom.js";
-import { TransactionImpl, makeSchemaCRUD, makeServerTransaction } from "../../zero-server/src/custom.js";
-import { OutOfOrderMutation, getMutation, handleMutationRequest } from "../../zero-server/src/process-mutations.js";
+import { customMutatorKey } from "../../zql/src/mutate/custom.js";
+import { CRUDMutatorFactory, TransactionImpl, makeSchemaCRUD, makeServerTransaction } from "../../zero-server/src/custom.js";
+import { OutOfOrderMutation, getMutation, handleMutateRequest, handleMutationRequest } from "../../zero-server/src/process-mutations.js";
 import { PushProcessor } from "../../zero-server/src/push-processor.js";
-import { handleGetQueriesRequest, handleTransformRequest } from "../../zero-server/src/queries/process-queries.js";
+import { handleGetQueriesRequest, handleQueryRequest, handleTransformRequest } from "../../zero-server/src/queries/process-queries.js";
 import { ZQLDatabase } from "../../zero-server/src/zql-database.js";
 import { PostgresJSConnection, PostgresJsTransactionInternal, zeroPostgresJS } from "../../zero-server/src/adapters/postgresjs.js";
 export {
   ApplicationError,
+  CRUDMutatorFactory,
   OutOfOrderMutation,
   PostgresJSConnection,
   PostgresJsTransactionInternal,
@@ -17,12 +18,13 @@ export {
   customMutatorKey,
   getMutation,
   handleGetQueriesRequest,
+  handleMutateRequest,
   handleMutationRequest,
+  handleQueryRequest,
   handleTransformRequest,
   isApplicationError,
   makeSchemaCRUD,
   makeServerTransaction,
-  splitMutatorKey,
   wrapWithApplicationError,
   zeroPostgresJS
 };

package/out/zero/src/react.js

@@ -1,17 +1,15 @@
-import { ZeroInspector } from "../../zero-react/src/components/zero-inspector.js";
+import { useConnectionState } from "../../zero-react/src/use-connection-state.js";
 import { useQuery, useSuspenseQuery } from "../../zero-react/src/use-query.js";
-import { useZeroConnectionState } from "../../zero-react/src/use-zero-connection-state.js";
 import { useZeroOnline } from "../../zero-react/src/use-zero-online.js";
 import { ZeroContext, ZeroProvider, createUseZero, useZero } from "../../zero-react/src/zero-provider.js";
 export {
   ZeroContext,
-  ZeroInspector,
   ZeroProvider,
   createUseZero,
+  useConnectionState,
   useQuery,
   useSuspenseQuery,
   useZero,
-  useZeroConnectionState,
   useZeroOnline
 };
 //# sourceMappingURL=react.js.map

package/out/zero/src/react.js.map

@@ -1 +1 @@
-{"version":3,"file":"react.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;"}
+{"version":3,"file":"react.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;"}

package/out/zero/src/server.js

@@ -1,12 +1,13 @@
 import { ApplicationError, isApplicationError, wrapWithApplicationError } from "../../zero-protocol/src/application-error.js";
-import { customMutatorKey, splitMutatorKey } from "../../zql/src/mutate/custom.js";
-import { TransactionImpl, makeSchemaCRUD, makeServerTransaction } from "../../zero-server/src/custom.js";
-import { OutOfOrderMutation, getMutation, handleMutationRequest } from "../../zero-server/src/process-mutations.js";
+import { customMutatorKey } from "../../zql/src/mutate/custom.js";
+import { CRUDMutatorFactory, TransactionImpl, makeSchemaCRUD, makeServerTransaction } from "../../zero-server/src/custom.js";
+import { OutOfOrderMutation, getMutation, handleMutateRequest, handleMutationRequest } from "../../zero-server/src/process-mutations.js";
 import { PushProcessor } from "../../zero-server/src/push-processor.js";
-import { handleGetQueriesRequest, handleTransformRequest } from "../../zero-server/src/queries/process-queries.js";
+import { handleGetQueriesRequest, handleQueryRequest, handleTransformRequest } from "../../zero-server/src/queries/process-queries.js";
 import { ZQLDatabase } from "../../zero-server/src/zql-database.js";
 export {
   ApplicationError,
+  CRUDMutatorFactory,
   OutOfOrderMutation,
   PushProcessor,
   TransactionImpl,
@@ -14,12 +15,13 @@ export {
   customMutatorKey,
   getMutation,
   handleGetQueriesRequest,
+  handleMutateRequest,
   handleMutationRequest,
+  handleQueryRequest,
   handleTransformRequest,
   isApplicationError,
   makeSchemaCRUD,
   makeServerTransaction,
-  splitMutatorKey,
   wrapWithApplicationError
 };
 //# sourceMappingURL=server.js.map

package/out/zero/src/solid.js

@@ -1,5 +1,5 @@
+import { useConnectionState } from "../../zero-solid/src/use-connection-state.js";
 import { createQuery, useQuery } from "../../zero-solid/src/use-query.js";
-import { useZeroConnectionState } from "../../zero-solid/src/use-zero-connection-state.js";
 import { useZeroOnline } from "../../zero-solid/src/use-zero-online.js";
 import { ZeroProvider, createUseZero, createZero, useZero } from "../../zero-solid/src/use-zero.js";
 export {
@@ -7,9 +7,9 @@ export {
   createQuery,
   createUseZero,
   createZero,
+  useConnectionState,
   useQuery,
   useZero,
-  useZeroConnectionState,
   useZeroOnline
 };
 //# sourceMappingURL=solid.js.map

package/out/zero/src/zero-cache-dev.js

@@ -26,11 +26,11 @@ async function main() {
       schema: {
         path: {
           type: string().optional(),
-          desc: [
-            "Relative path to the file containing the schema definition.",
-            "The file must have a default export of type SchemaConfig."
-          ],
-          alias: "p"
+          desc: ["Relative path to the file containing permissions."],
+          alias: "p",
+          deprecated: [
+            "Permissions are deprecated and will be removed in an upcoming release. See: https://zero.rocicorp.dev/docs/auth."
+          ]
         }
       },
       ...zeroOptions
@@ -131,6 +131,12 @@ async function main() {
     }
   }
   if (config.schema.path) {
+    if (config.query.url && config.mutate.url) {
+      lc.error?.(
+        "Cannot use -p/--path/ZERO_SCHEMA_PATH flag when using ZERO_MUTATE_URL and ZERO_QUERY_URL."
+      );
+      process.exit(-1);
+    }
     await deployPermissionsAndStartZeroCache();
     const watcher = watch(config.schema.path, {
       ignoreInitial: true,

package/out/zero/src/zero-cache-dev.js.map

@@ -1 +1 @@
-{"version":3,"file":"zero-cache-dev.js","sources":["../../../src/zero-cache-dev.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport '../../shared/src/dotenv.ts';\n\nimport {resolver} from '@rocicorp/resolver';\nimport {watch} from 'chokidar';\nimport {spawn, type ChildProcess} from 'node:child_process';\nimport {createLogContext} from '../../shared/src/logging.ts';\nimport {parseOptionsAdvanced} from '../../shared/src/options.ts';\nimport * as v from '../../shared/src/valita.ts';\nimport {\n  ZERO_ENV_VAR_PREFIX,\n  zeroOptions,\n} from '../../zero-cache/src/config/zero-config.ts';\nimport {deployPermissionsOptions} from '../../zero-cache/src/scripts/permissions.ts';\n\nconst deployPermissionsScript = 'zero-deploy-permissions';\nconst zeroCacheScript = 'zero-cache';\n\nfunction killProcess(childProcess: ChildProcess | undefined) {\n  if (!childProcess || childProcess.exitCode !== null) {\n    return Promise.resolve();\n  }\n  const {resolve, promise} = resolver();\n  childProcess.on('exit', resolve);\n  // Use SIGQUIT in particular since this will cause\n  // a fast zero-cache shutdown instead of a graceful drain.\n  childProcess.kill('SIGQUIT');\n  return promise;\n}\n\nasync function main() {\n  const {config} = parseOptionsAdvanced(\n    {\n      schema: {\n        path: {\n          type: v.string().optional(),\n          desc: [\n            'Relative path to the file containing the schema definition.',\n            'The file must have a default export of type SchemaConfig.',\n          ],\n          alias: 'p',\n        },\n      },\n      ...zeroOptions,\n    },\n    {\n      envNamePrefix: ZERO_ENV_VAR_PREFIX,\n      // TODO: This may no longer be necessary since multi-tenant was removed.\n      allowPartial: true, // required by server/runner/config.ts\n    },\n  );\n\n  const lc = createLogContext(config);\n\n  process.on('unhandledRejection', reason => {\n    lc.error?.('Unexpected unhandled rejection.', reason);\n    lc.error?.('Exiting');\n    process.exit(-1);\n  });\n\n  // Parse options for each subprocess to get environment variables\n  const {env: deployPermissionsEnv} = parseOptionsAdvanced(\n    deployPermissionsOptions,\n    {\n      envNamePrefix: ZERO_ENV_VAR_PREFIX,\n      allowUnknown: true,\n      includeDefaults: false,\n    },\n  );\n  const {env: zeroCacheEnv} = parseOptionsAdvanced(zeroOptions, {\n    envNamePrefix: ZERO_ENV_VAR_PREFIX,\n    allowUnknown: true,\n    includeDefaults: false,\n  });\n\n  let permissionsProcess: ChildProcess | undefined;\n  let zeroCacheProcess: ChildProcess | undefined;\n\n  // Ensure child processes are killed when the main process exits\n  process.on('exit', () => {\n    permissionsProcess?.kill('SIGQUIT');\n    zeroCacheProcess?.kill('SIGQUIT');\n  });\n\n  async function deployPermissions(): Promise<boolean> {\n    if (config.upstream.type !== 'pg') {\n      lc.warn?.(\n        `Skipping permissions deployment for ${config.upstream.type} upstream`,\n      );\n      return true;\n    }\n    permissionsProcess?.removeAllListeners('exit');\n    await killProcess(permissionsProcess);\n    permissionsProcess = undefined;\n\n    lc.info?.(`Running ${deployPermissionsScript}.`);\n    permissionsProcess = spawn(deployPermissionsScript, [], {\n      env: {...process.env, ...deployPermissionsEnv},\n      stdio: 'inherit',\n      shell: true,\n    });\n\n    const {promise: code, resolve} = resolver<number>();\n    permissionsProcess.on('exit', resolve);\n    if ((await code) === 0) {\n      lc.info?.(`${deployPermissionsScript} completed successfully.`);\n      return true;\n    }\n    lc.error?.(`Failed to deploy permissions from ${config.schema.path}.`);\n    return false;\n  }\n\n  async function startZeroCache() {\n    zeroCacheProcess?.removeAllListeners('exit');\n    await killProcess(zeroCacheProcess);\n    zeroCacheProcess = undefined;\n\n    lc.info?.(\n      `Running ${zeroCacheScript} at\\n\\n\\thttp://localhost:${config.port}\\n`,\n    );\n    const env: NodeJS.ProcessEnv = {\n      // Set some low defaults so as to use fewer resources and not trip up,\n      // e.g. developers sharing a database.\n      ['ZERO_NUM_SYNC_WORKERS']: '3',\n      ['ZERO_CVR_MAX_CONNS']: '6',\n      ['ZERO_UPSTREAM_MAX_CONNS']: '6',\n\n      // Default NODE_ENV to development mode.\n      // @ts-ignore NODE_ENV is not always set. Please ignore error.\n      ['NODE_ENV']: 'development',\n\n      // But let the developer override any of these dev defaults.\n      ...process.env,\n      ...zeroCacheEnv,\n    };\n    zeroCacheProcess = spawn(zeroCacheScript, [], {\n      env,\n      stdio: 'inherit',\n      shell: true,\n    });\n    zeroCacheProcess.on('exit', () => {\n      lc.error?.(`${zeroCacheScript} exited. Exiting.`);\n      process.exit(-1);\n    });\n  }\n\n  async function deployPermissionsAndStartZeroCache() {\n    if (await deployPermissions()) {\n      await startZeroCache();\n    }\n  }\n\n  if (config.schema.path) {\n    await deployPermissionsAndStartZeroCache();\n\n    // Watch for file changes\n    const watcher = watch(config.schema.path, {\n      ignoreInitial: true,\n      awaitWriteFinish: {stabilityThreshold: 500, pollInterval: 100},\n    });\n    const onFileChange = async () => {\n      lc.info?.(`Detected ${config.schema.path} change.`);\n      await deployPermissions();\n    };\n    watcher.on('add', onFileChange);\n    watcher.on('change', onFileChange);\n    watcher.on('unlink', onFileChange);\n  } else {\n    await startZeroCache();\n  }\n}\n\nvoid main();\n"],"names":["v.string"],"mappings":";;;;;;;;;;;AAgBA,MAAM,0BAA0B;AAChC,MAAM,kBAAkB;AAExB,SAAS,YAAY,cAAwC;AAC3D,MAAI,CAAC,gBAAgB,aAAa,aAAa,MAAM;AACnD,WAAO,QAAQ,QAAA;AAAA,EACjB;AACA,QAAM,EAAC,SAAS,QAAA,IAAW,SAAA;AAC3B,eAAa,GAAG,QAAQ,OAAO;AAG/B,eAAa,KAAK,SAAS;AAC3B,SAAO;AACT;AAEA,eAAe,OAAO;AACpB,QAAM,EAAC,WAAU;AAAA,IACf;AAAA,MACE,QAAQ;AAAA,QACN,MAAM;AAAA,UACJ,MAAMA,OAAE,EAAS,SAAA;AAAA,UACjB,MAAM;AAAA,YACJ;AAAA,YACA;AAAA,UAAA;AAAA,UAEF,OAAO;AAAA,QAAA;AAAA,MACT;AAAA,MAEF,GAAG;AAAA,IAAA;AAAA,IAEL;AAAA,MACE,eAAe;AAAA;AAAA,MAEf,cAAc;AAAA;AAAA,IAAA;AAAA,EAChB;AAGF,QAAM,KAAK,iBAAiB,MAAM;AAElC,UAAQ,GAAG,sBAAsB,CAAA,WAAU;AACzC,OAAG,QAAQ,mCAAmC,MAAM;AACpD,OAAG,QAAQ,SAAS;AACpB,YAAQ,KAAK,EAAE;AAAA,EACjB,CAAC;AAGD,QAAM,EAAC,KAAK,qBAAA,IAAwB;AAAA,IAClC;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,cAAc;AAAA,MACd,iBAAiB;AAAA,IAAA;AAAA,EACnB;AAEF,QAAM,EAAC,KAAK,iBAAgB,qBAAqB,aAAa;AAAA,IAC5D,eAAe;AAAA,IACf,cAAc;AAAA,IACd,iBAAiB;AAAA,EAAA,CAClB;AAED,MAAI;AACJ,MAAI;AAGJ,UAAQ,GAAG,QAAQ,MAAM;AACvB,wBAAoB,KAAK,SAAS;AAClC,sBAAkB,KAAK,SAAS;AAAA,EAClC,CAAC;AAED,iBAAe,oBAAsC;AACnD,QAAI,OAAO,SAAS,SAAS,MAAM;AACjC,SAAG;AAAA,QACD,uCAAuC,OAAO,SAAS,IAAI;AAAA,MAAA;AAE7D,aAAO;AAAA,IACT;AACA,wBAAoB,mBAAmB,MAAM;AAC7C,UAAM,YAAY,kBAAkB;AACpC,yBAAqB;AAErB,OAAG,OAAO,WAAW,uBAAuB,GAAG;AAC/C,yBAAqB,MAAM,yBAAyB,IAAI;AAAA,MACtD,KAAK,EAAC,GAAG,QAAQ,KAAK,GAAG,qBAAA;AAAA,MACzB,OAAO;AAAA,MACP,OAAO;AAAA,IAAA,CACR;AAED,UAAM,EAAC,SAAS,MAAM,QAAA,IAAW,SAAA;AACjC,uBAAmB,GAAG,QAAQ,OAAO;AACrC,QAAK,MAAM,SAAU,GAAG;AACtB,SAAG,OAAO,GAAG,uBAAuB,0BAA0B;AAC9D,aAAO;AAAA,IACT;AACA,OAAG,QAAQ,qCAAqC,OAAO,OAAO,IAAI,GAAG;AACrE,WAAO;AAAA,EACT;AAEA,iBAAe,iBAAiB;AAC9B,sBAAkB,mBAAmB,MAAM;AAC3C,UAAM,YAAY,gBAAgB;AAClC,uBAAmB;AAEnB,OAAG;AAAA,MACD,WAAW,eAAe;AAAA;AAAA,oBAA6B,OAAO,IAAI;AAAA;AAAA,IAAA;AAEpE,UAAM,MAAyB;AAAA;AAAA;AAAA,MAG7B,CAAC,uBAAuB,GAAG;AAAA,MAC3B,CAAC,oBAAoB,GAAG;AAAA,MACxB,CAAC,yBAAyB,GAAG;AAAA;AAAA;AAAA,MAI7B,CAAC,UAAU,GAAG;AAAA;AAAA,MAGd,GAAG,QAAQ;AAAA,MACX,GAAG;AAAA,IAAA;AAEL,uBAAmB,MAAM,iBAAiB,IAAI;AAAA,MAC5C;AAAA,MACA,OAAO;AAAA,MACP,OAAO;AAAA,IAAA,CACR;AACD,qBAAiB,GAAG,QAAQ,MAAM;AAChC,SAAG,QAAQ,GAAG,eAAe,mBAAmB;AAChD,cAAQ,KAAK,EAAE;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,iBAAe,qCAAqC;AAClD,QAAI,MAAM,qBAAqB;AAC7B,YAAM,eAAA;AAAA,IACR;AAAA,EACF;AAEA,MAAI,OAAO,OAAO,MAAM;AACtB,UAAM,mCAAA;AAGN,UAAM,UAAU,MAAM,OAAO,OAAO,MAAM;AAAA,MACxC,eAAe;AAAA,MACf,kBAAkB,EAAC,oBAAoB,KAAK,cAAc,IAAA;AAAA,IAAG,CAC9D;AACD,UAAM,eAAe,YAAY;AAC/B,SAAG,OAAO,YAAY,OAAO,OAAO,IAAI,UAAU;AAClD,YAAM,kBAAA;AAAA,IACR;AACA,YAAQ,GAAG,OAAO,YAAY;AAC9B,YAAQ,GAAG,UAAU,YAAY;AACjC,YAAQ,GAAG,UAAU,YAAY;AAAA,EACnC,OAAO;AACL,UAAM,eAAA;AAAA,EACR;AACF;AAEA,KAAK,KAAA;"}
+{"version":3,"file":"zero-cache-dev.js","sources":["../../../src/zero-cache-dev.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport '../../shared/src/dotenv.ts';\n\nimport {resolver} from '@rocicorp/resolver';\nimport {watch} from 'chokidar';\nimport {spawn, type ChildProcess} from 'node:child_process';\nimport {createLogContext} from '../../shared/src/logging.ts';\nimport {parseOptionsAdvanced} from '../../shared/src/options.ts';\nimport * as v from '../../shared/src/valita.ts';\nimport {\n  ZERO_ENV_VAR_PREFIX,\n  zeroOptions,\n} from '../../zero-cache/src/config/zero-config.ts';\nimport {deployPermissionsOptions} from '../../zero-cache/src/scripts/permissions.ts';\n\nconst deployPermissionsScript = 'zero-deploy-permissions';\nconst zeroCacheScript = 'zero-cache';\n\nfunction killProcess(childProcess: ChildProcess | undefined) {\n  if (!childProcess || childProcess.exitCode !== null) {\n    return Promise.resolve();\n  }\n  const {resolve, promise} = resolver();\n  childProcess.on('exit', resolve);\n  // Use SIGQUIT in particular since this will cause\n  // a fast zero-cache shutdown instead of a graceful drain.\n  childProcess.kill('SIGQUIT');\n  return promise;\n}\n\nasync function main() {\n  const {config} = parseOptionsAdvanced(\n    {\n      schema: {\n        path: {\n          type: v.string().optional(),\n          desc: ['Relative path to the file containing permissions.'],\n          alias: 'p',\n          deprecated: [\n            'Permissions are deprecated and will be removed in an upcoming release. See: https://zero.rocicorp.dev/docs/auth.',\n          ],\n        },\n      },\n      ...zeroOptions,\n    },\n    {\n      envNamePrefix: ZERO_ENV_VAR_PREFIX,\n      // TODO: This may no longer be necessary since multi-tenant was removed.\n      allowPartial: true, // required by server/runner/config.ts\n    },\n  );\n\n  const lc = createLogContext(config);\n\n  process.on('unhandledRejection', reason => {\n    lc.error?.('Unexpected unhandled rejection.', reason);\n    lc.error?.('Exiting');\n    process.exit(-1);\n  });\n\n  // Parse options for each subprocess to get environment variables\n  const {env: deployPermissionsEnv} = parseOptionsAdvanced(\n    deployPermissionsOptions,\n    {\n      envNamePrefix: ZERO_ENV_VAR_PREFIX,\n      allowUnknown: true,\n      includeDefaults: false,\n    },\n  );\n  const {env: zeroCacheEnv} = parseOptionsAdvanced(zeroOptions, {\n    envNamePrefix: ZERO_ENV_VAR_PREFIX,\n    allowUnknown: true,\n    includeDefaults: false,\n  });\n\n  let permissionsProcess: ChildProcess | undefined;\n  let zeroCacheProcess: ChildProcess | undefined;\n\n  // Ensure child processes are killed when the main process exits\n  process.on('exit', () => {\n    permissionsProcess?.kill('SIGQUIT');\n    zeroCacheProcess?.kill('SIGQUIT');\n  });\n\n  async function deployPermissions(): Promise<boolean> {\n    if (config.upstream.type !== 'pg') {\n      lc.warn?.(\n        `Skipping permissions deployment for ${config.upstream.type} upstream`,\n      );\n      return true;\n    }\n    permissionsProcess?.removeAllListeners('exit');\n    await killProcess(permissionsProcess);\n    permissionsProcess = undefined;\n\n    lc.info?.(`Running ${deployPermissionsScript}.`);\n    permissionsProcess = spawn(deployPermissionsScript, [], {\n      env: {...process.env, ...deployPermissionsEnv},\n      stdio: 'inherit',\n      shell: true,\n    });\n\n    const {promise: code, resolve} = resolver<number>();\n    permissionsProcess.on('exit', resolve);\n    if ((await code) === 0) {\n      lc.info?.(`${deployPermissionsScript} completed successfully.`);\n      return true;\n    }\n    lc.error?.(`Failed to deploy permissions from ${config.schema.path}.`);\n    return false;\n  }\n\n  async function startZeroCache() {\n    zeroCacheProcess?.removeAllListeners('exit');\n    await killProcess(zeroCacheProcess);\n    zeroCacheProcess = undefined;\n\n    lc.info?.(\n      `Running ${zeroCacheScript} at\\n\\n\\thttp://localhost:${config.port}\\n`,\n    );\n    const env: NodeJS.ProcessEnv = {\n      // Set some low defaults so as to use fewer resources and not trip up,\n      // e.g. developers sharing a database.\n      ['ZERO_NUM_SYNC_WORKERS']: '3',\n      ['ZERO_CVR_MAX_CONNS']: '6',\n      ['ZERO_UPSTREAM_MAX_CONNS']: '6',\n\n      // Default NODE_ENV to development mode.\n      // @ts-ignore NODE_ENV is not always set. Please ignore error.\n      ['NODE_ENV']: 'development',\n\n      // But let the developer override any of these dev defaults.\n      ...process.env,\n      ...zeroCacheEnv,\n    };\n    zeroCacheProcess = spawn(zeroCacheScript, [], {\n      env,\n      stdio: 'inherit',\n      shell: true,\n    });\n    zeroCacheProcess.on('exit', () => {\n      lc.error?.(`${zeroCacheScript} exited. Exiting.`);\n      process.exit(-1);\n    });\n  }\n\n  async function deployPermissionsAndStartZeroCache() {\n    if (await deployPermissions()) {\n      await startZeroCache();\n    }\n  }\n\n  if (config.schema.path) {\n    if (config.query.url && config.mutate.url) {\n      lc.error?.(\n        'Cannot use -p/--path/ZERO_SCHEMA_PATH flag when using ZERO_MUTATE_URL and ZERO_QUERY_URL.',\n      );\n      process.exit(-1);\n    }\n\n    await deployPermissionsAndStartZeroCache();\n\n    // Watch for file changes\n    const watcher = watch(config.schema.path, {\n      ignoreInitial: true,\n      awaitWriteFinish: {stabilityThreshold: 500, pollInterval: 100},\n    });\n    const onFileChange = async () => {\n      lc.info?.(`Detected ${config.schema.path} change.`);\n      await deployPermissions();\n    };\n    watcher.on('add', onFileChange);\n    watcher.on('change', onFileChange);\n    watcher.on('unlink', onFileChange);\n  } else {\n    await startZeroCache();\n  }\n}\n\nvoid main();\n"],"names":["v.string"],"mappings":";;;;;;;;;;;AAgBA,MAAM,0BAA0B;AAChC,MAAM,kBAAkB;AAExB,SAAS,YAAY,cAAwC;AAC3D,MAAI,CAAC,gBAAgB,aAAa,aAAa,MAAM;AACnD,WAAO,QAAQ,QAAA;AAAA,EACjB;AACA,QAAM,EAAC,SAAS,QAAA,IAAW,SAAA;AAC3B,eAAa,GAAG,QAAQ,OAAO;AAG/B,eAAa,KAAK,SAAS;AAC3B,SAAO;AACT;AAEA,eAAe,OAAO;AACpB,QAAM,EAAC,WAAU;AAAA,IACf;AAAA,MACE,QAAQ;AAAA,QACN,MAAM;AAAA,UACJ,MAAMA,OAAE,EAAS,SAAA;AAAA,UACjB,MAAM,CAAC,mDAAmD;AAAA,UAC1D,OAAO;AAAA,UACP,YAAY;AAAA,YACV;AAAA,UAAA;AAAA,QACF;AAAA,MACF;AAAA,MAEF,GAAG;AAAA,IAAA;AAAA,IAEL;AAAA,MACE,eAAe;AAAA;AAAA,MAEf,cAAc;AAAA;AAAA,IAAA;AAAA,EAChB;AAGF,QAAM,KAAK,iBAAiB,MAAM;AAElC,UAAQ,GAAG,sBAAsB,CAAA,WAAU;AACzC,OAAG,QAAQ,mCAAmC,MAAM;AACpD,OAAG,QAAQ,SAAS;AACpB,YAAQ,KAAK,EAAE;AAAA,EACjB,CAAC;AAGD,QAAM,EAAC,KAAK,qBAAA,IAAwB;AAAA,IAClC;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,cAAc;AAAA,MACd,iBAAiB;AAAA,IAAA;AAAA,EACnB;AAEF,QAAM,EAAC,KAAK,iBAAgB,qBAAqB,aAAa;AAAA,IAC5D,eAAe;AAAA,IACf,cAAc;AAAA,IACd,iBAAiB;AAAA,EAAA,CAClB;AAED,MAAI;AACJ,MAAI;AAGJ,UAAQ,GAAG,QAAQ,MAAM;AACvB,wBAAoB,KAAK,SAAS;AAClC,sBAAkB,KAAK,SAAS;AAAA,EAClC,CAAC;AAED,iBAAe,oBAAsC;AACnD,QAAI,OAAO,SAAS,SAAS,MAAM;AACjC,SAAG;AAAA,QACD,uCAAuC,OAAO,SAAS,IAAI;AAAA,MAAA;AAE7D,aAAO;AAAA,IACT;AACA,wBAAoB,mBAAmB,MAAM;AAC7C,UAAM,YAAY,kBAAkB;AACpC,yBAAqB;AAErB,OAAG,OAAO,WAAW,uBAAuB,GAAG;AAC/C,yBAAqB,MAAM,yBAAyB,IAAI;AAAA,MACtD,KAAK,EAAC,GAAG,QAAQ,KAAK,GAAG,qBAAA;AAAA,MACzB,OAAO;AAAA,MACP,OAAO;AAAA,IAAA,CACR;AAED,UAAM,EAAC,SAAS,MAAM,QAAA,IAAW,SAAA;AACjC,uBAAmB,GAAG,QAAQ,OAAO;AACrC,QAAK,MAAM,SAAU,GAAG;AACtB,SAAG,OAAO,GAAG,uBAAuB,0BAA0B;AAC9D,aAAO;AAAA,IACT;AACA,OAAG,QAAQ,qCAAqC,OAAO,OAAO,IAAI,GAAG;AACrE,WAAO;AAAA,EACT;AAEA,iBAAe,iBAAiB;AAC9B,sBAAkB,mBAAmB,MAAM;AAC3C,UAAM,YAAY,gBAAgB;AAClC,uBAAmB;AAEnB,OAAG;AAAA,MACD,WAAW,eAAe;AAAA;AAAA,oBAA6B,OAAO,IAAI;AAAA;AAAA,IAAA;AAEpE,UAAM,MAAyB;AAAA;AAAA;AAAA,MAG7B,CAAC,uBAAuB,GAAG;AAAA,MAC3B,CAAC,oBAAoB,GAAG;AAAA,MACxB,CAAC,yBAAyB,GAAG;AAAA;AAAA;AAAA,MAI7B,CAAC,UAAU,GAAG;AAAA;AAAA,MAGd,GAAG,QAAQ;AAAA,MACX,GAAG;AAAA,IAAA;AAEL,uBAAmB,MAAM,iBAAiB,IAAI;AAAA,MAC5C;AAAA,MACA,OAAO;AAAA,MACP,OAAO;AAAA,IAAA,CACR;AACD,qBAAiB,GAAG,QAAQ,MAAM;AAChC,SAAG,QAAQ,GAAG,eAAe,mBAAmB;AAChD,cAAQ,KAAK,EAAE;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,iBAAe,qCAAqC;AAClD,QAAI,MAAM,qBAAqB;AAC7B,YAAM,eAAA;AAAA,IACR;AAAA,EACF;AAEA,MAAI,OAAO,OAAO,MAAM;AACtB,QAAI,OAAO,MAAM,OAAO,OAAO,OAAO,KAAK;AACzC,SAAG;AAAA,QACD;AAAA,MAAA;AAEF,cAAQ,KAAK,EAAE;AAAA,IACjB;AAEA,UAAM,mCAAA;AAGN,UAAM,UAAU,MAAM,OAAO,OAAO,MAAM;AAAA,MACxC,eAAe;AAAA,MACf,kBAAkB,EAAC,oBAAoB,KAAK,cAAc,IAAA;AAAA,IAAG,CAC9D;AACD,UAAM,eAAe,YAAY;AAC/B,SAAG,OAAO,YAAY,OAAO,OAAO,IAAI,UAAU;AAClD,YAAM,kBAAA;AAAA,IACR;AACA,YAAQ,GAAG,OAAO,YAAY;AAC9B,YAAQ,GAAG,UAAU,YAAY;AACjC,YAAQ,GAAG,UAAU,YAAY;AAAA,EACnC,OAAO;AACL,UAAM,eAAA;AAAA,EACR;AACF;AAEA,KAAK,KAAA;"}

package/out/zero/src/zero.js

@@ -9,27 +9,26 @@ import { relationships } from "../../zero-schema/src/builder/relationship-builde
 import { createSchema } from "../../zero-schema/src/builder/schema-builder.js";
 import { boolean, enumeration, json, number, string, table } from "../../zero-schema/src/builder/table-builder.js";
 import { ANYONE_CAN, ANYONE_CAN_DO_ANYTHING, NOBODY_CAN, definePermissions } from "../../zero-schema/src/permissions.js";
-import { applyChange } from "../../zql/src/ivm/view-apply-change.js";
 import { defineMutators, defineMutatorsWithType, getMutator, isMutatorRegistry, mustGetMutator } from "../../zql/src/mutate/mutator-registry.js";
 import { defineMutator, defineMutatorWithType, isMutator, isMutatorDefinition } from "../../zql/src/mutate/mutator.js";
 import { createBuilder } from "../../zql/src/query/create-builder.js";
 import { escapeLike } from "../../zql/src/query/escape-like.js";
 import { syncedQuery, syncedQueryWithContext, withValidation } from "../../zql/src/query/named.js";
-import { defineQueries, defineQueriesWithType, defineQuery, defineQueryWithType, getQuery, isQueryDefinition, mustGetQuery } from "../../zql/src/query/query-registry.js";
-import { bindingsForZero, registerZeroDelegate } from "../../zero-client/src/client/bindings.js";
+import { defineQueries, defineQueriesWithType, defineQuery, defineQueryWithType, getQuery, isQuery, isQueryDefinition, isQueryRegistry, mustGetQuery } from "../../zql/src/query/query-registry.js";
+import "../../zero-protocol/src/ast.js";
+import * as connectionStatusEnum from "../../zero-client/src/client/connection-status-enum.js";
 import * as updateNeededReasonTypeEnum from "../../zero-client/src/client/update-needed-reason-type-enum.js";
 import { Zero } from "../../zero-client/src/client/zero.js";
 export {
   ANYONE_CAN,
   ANYONE_CAN_DO_ANYTHING,
   ApplicationError,
+  connectionStatusEnum as ConnectionStatus,
   IDBNotFoundError,
   NOBODY_CAN,
   TransactionClosedError,
   updateNeededReasonTypeEnum as UpdateNeededReasonType,
   Zero,
-  applyChange,
-  bindingsForZero,
   boolean,
   createBuilder,
   createSchema,
@@ -52,13 +51,14 @@ export {
   isMutator,
   isMutatorDefinition,
   isMutatorRegistry,
+  isQuery,
   isQueryDefinition,
+  isQueryRegistry,
   json,
   makeIDBName,
   mustGetMutator,
   mustGetQuery,
   number,
-  registerZeroDelegate,
   relationships,
   string,
   syncedQuery,

package/out/zero-cache/src/auth/read-authorizer.d.ts

@@ -1,7 +1,7 @@
+import type { LogContext } from '@rocicorp/logger';
 import type { JWTPayload } from 'jose';
 import type { AST } from '../../../zero-protocol/src/ast.ts';
 import type { PermissionsConfig } from '../../../zero-schema/src/compiled-permissions.ts';
-import type { LogContext } from '@rocicorp/logger';
 export type TransformedAndHashed = {
     id: string;
     transformedAst: AST;

package/out/zero-cache/src/auth/read-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-authorizer.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/read-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAGrC,OAAO,KAAK,EAAC,GAAG,EAAY,MAAM,mCAAmC,CAAC;AACtE,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,kDAAkD,CAAC;AAExF,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAGjD,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,GAAG,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AACF;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,GAAG,EACV,eAAe,EAAE,iBAAiB,EAClC,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,aAAa,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GACxC,oBAAoB,CAStB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,GAAG,EACV,eAAe,EAAE,iBAAiB,EAClC,QAAQ,EAAE,UAAU,GAAG,SAAS,GAC/B,GAAG,CASL"}
+{"version":3,"file":"read-authorizer.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/read-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAErC,OAAO,KAAK,EAAC,GAAG,EAAY,MAAM,mCAAmC,CAAC;AAEtE,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,kDAAkD,CAAC;AAIxF,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,GAAG,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AACF;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,GAAG,EACV,eAAe,EAAE,iBAAiB,EAClC,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,aAAa,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GACxC,oBAAoB,CAStB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,GAAG,EACV,eAAe,EAAE,iBAAiB,EAClC,QAAQ,EAAE,UAAU,GAAG,SAAS,GAC/B,GAAG,CASL"}

package/out/zero-cache/src/auth/read-authorizer.js

@@ -20,7 +20,7 @@ function transformQuery(lc, query, permissionRules, authData) {
   });
 }
 function transformQueryInternal(lc, query, permissionRules) {
-  let rowSelectRules = permissionRules.tables[query.table]?.row?.select;
+  let rowSelectRules = permissionRules?.tables?.[query.table]?.row?.select;
   if (!rowSelectRules || rowSelectRules.length === 0) {
     lc.warn?.(
       "No permission rules found for table '" + query.table + "'. No rows will be returned. Use ANYONE_CAN to allow all users to access all rows."

package/out/zero-cache/src/auth/read-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-authorizer.js","sources":["../../../../../zero-cache/src/auth/read-authorizer.ts"],"sourcesContent":["import type {JWTPayload} from 'jose';\nimport type {JSONValue} from '../../../shared/src/json.ts';\nimport {hashOfAST} from '../../../zero-protocol/src/query-hash.ts';\nimport type {AST, Condition} from '../../../zero-protocol/src/ast.ts';\nimport type {PermissionsConfig} from '../../../zero-schema/src/compiled-permissions.ts';\nimport {bindStaticParameters} from '../../../zql/src/builder/builder.ts';\nimport type {LogContext} from '@rocicorp/logger';\nimport {simplifyCondition} from '../../../zql/src/query/expression.ts';\n\nexport type TransformedAndHashed = {\n  id: string;\n  transformedAst: AST;\n  transformationHash: string;\n};\n/**\n * Adds permission rules to the given query so it only returns rows that the\n * user is allowed to read.\n *\n * If the returned query is `undefined` that means that user cannot run\n * the query at all. This is only the case if we can infer that all rows\n * would be excluded without running the query.\n * E.g., the user is trying to query a table that is not readable.\n */\nexport function transformAndHashQuery(\n  lc: LogContext,\n  id: string,\n  query: AST,\n  permissionRules: PermissionsConfig,\n  authData: JWTPayload | undefined,\n  internalQuery: boolean | null | undefined,\n): TransformedAndHashed {\n  const transformed = internalQuery\n    ? query // application permissions do not apply to internal queries\n    : transformQuery(lc, query, permissionRules, authData);\n  return {\n    id,\n    transformedAst: transformed,\n    transformationHash: hashOfAST(transformed),\n  };\n}\n\n/**\n * For a given AST, apply the read-auth rules and bind static auth data.\n */\nexport function transformQuery(\n  lc: LogContext,\n  query: AST,\n  permissionRules: PermissionsConfig,\n  authData: JWTPayload | undefined,\n): AST {\n  const queryWithPermissions = transformQueryInternal(\n    lc,\n    query,\n    permissionRules,\n  );\n  return bindStaticParameters(queryWithPermissions, {\n    authData: authData as Record<string, JSONValue>,\n  });\n}\n\nfunction transformQueryInternal(\n  lc: LogContext,\n  query: AST,\n  permissionRules: PermissionsConfig,\n): AST {\n  let rowSelectRules = permissionRules.tables[query.table]?.row?.select;\n\n  if (!rowSelectRules || rowSelectRules.length === 0) {\n    // If there are no rules, we default to not allowing any rows to be selected.\n    lc.warn?.(\n      \"No permission rules found for table '\" +\n        query.table +\n        \"'. No rows will be returned. Use ANYONE_CAN to allow all users to access all rows.\",\n    );\n    rowSelectRules = [\n      [\n        'allow',\n        {\n          type: 'or',\n          conditions: [],\n        },\n      ],\n    ];\n  }\n\n  const updatedWhere = addRulesToWhere(\n    query.where\n      ? transformCondition(lc, query.where, permissionRules)\n      : undefined,\n    rowSelectRules,\n  );\n  return {\n    ...query,\n    where: simplifyCondition(updatedWhere),\n    related: query.related?.map(sq => {\n      const subquery = transformQueryInternal(lc, sq.subquery, permissionRules);\n      return {\n        ...sq,\n        subquery,\n      };\n    }),\n  };\n}\n\nfunction addRulesToWhere(\n  where: Condition | undefined,\n  rowSelectRules: ['allow', Condition][],\n): Condition {\n  return {\n    type: 'and',\n    conditions: [\n      ...(where ? [where] : []),\n      {\n        type: 'or',\n        conditions: rowSelectRules.map(([_, condition]) => condition),\n      },\n    ],\n  };\n}\n\n// We must augment conditions so we do not provide an oracle to users.\n// E.g.,\n// `issue.whereExists('secret', s => s.where('value', 'sdf'))`\n// Not applying read policies to subqueries in the where position\n// would allow users to infer the existence of rows, and their contents,\n// that they cannot read.\nfunction transformCondition(\n  lc: LogContext,\n  cond: Condition,\n  auth: PermissionsConfig,\n): Condition {\n  switch (cond.type) {\n    case 'simple':\n      return cond;\n    case 'and':\n    case 'or':\n      return {\n        ...cond,\n        conditions: cond.conditions.map(c => transformCondition(lc, c, auth)),\n      };\n    case 'correlatedSubquery': {\n      const query = transformQueryInternal(lc, cond.related.subquery, auth);\n      return {\n        ...cond,\n        related: {\n          ...cond.related,\n          subquery: query,\n        },\n      };\n    }\n  }\n}\n"],"names":[],"mappings":";;;AAuBO,SAAS,sBACd,IACA,IACA,OACA,iBACA,UACA,eACsB;AACtB,QAAM,cAAc,gBAChB,QACA,eAAe,IAAI,OAAO,iBAAiB,QAAQ;AACvD,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB;AAAA,IAChB,oBAAoB,UAAU,WAAW;AAAA,EAAA;AAE7C;AAKO,SAAS,eACd,IACA,OACA,iBACA,UACK;AACL,QAAM,uBAAuB;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF,SAAO,qBAAqB,sBAAsB;AAAA,IAChD;AAAA,EAAA,CACD;AACH;AAEA,SAAS,uBACP,IACA,OACA,iBACK;AACL,MAAI,iBAAiB,gBAAgB,OAAO,MAAM,KAAK,GAAG,KAAK;AAE/D,MAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG;AAElD,OAAG;AAAA,MACD,0CACE,MAAM,QACN;AAAA,IAAA;AAEJ,qBAAiB;AAAA,MACf;AAAA,QACE;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,YAAY,CAAA;AAAA,QAAC;AAAA,MACf;AAAA,IACF;AAAA,EAEJ;AAEA,QAAM,eAAe;AAAA,IACnB,MAAM,QACF,mBAAmB,IAAI,MAAM,OAAO,eAAe,IACnD;AAAA,IACJ;AAAA,EAAA;AAEF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,kBAAkB,YAAY;AAAA,IACrC,SAAS,MAAM,SAAS,IAAI,CAAA,OAAM;AAChC,YAAM,WAAW,uBAAuB,IAAI,GAAG,UAAU,eAAe;AACxE,aAAO;AAAA,QACL,GAAG;AAAA,QACH;AAAA,MAAA;AAAA,IAEJ,CAAC;AAAA,EAAA;AAEL;AAEA,SAAS,gBACP,OACA,gBACW;AACX,SAAO;AAAA,IACL,MAAM;AAAA,IACN,YAAY;AAAA,MACV,GAAI,QAAQ,CAAC,KAAK,IAAI,CAAA;AAAA,MACtB;AAAA,QACE,MAAM;AAAA,QACN,YAAY,eAAe,IAAI,CAAC,CAAC,GAAG,SAAS,MAAM,SAAS;AAAA,MAAA;AAAA,IAC9D;AAAA,EACF;AAEJ;AAQA,SAAS,mBACP,IACA,MACA,MACW;AACX,UAAQ,KAAK,MAAA;AAAA,IACX,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,QACL,GAAG;AAAA,QACH,YAAY,KAAK,WAAW,IAAI,OAAK,mBAAmB,IAAI,GAAG,IAAI,CAAC;AAAA,MAAA;AAAA,IAExE,KAAK,sBAAsB;AACzB,YAAM,QAAQ,uBAAuB,IAAI,KAAK,QAAQ,UAAU,IAAI;AACpE,aAAO;AAAA,QACL,GAAG;AAAA,QACH,SAAS;AAAA,UACP,GAAG,KAAK;AAAA,UACR,UAAU;AAAA,QAAA;AAAA,MACZ;AAAA,IAEJ;AAAA,EAAA;AAEJ;"}
+{"version":3,"file":"read-authorizer.js","sources":["../../../../../zero-cache/src/auth/read-authorizer.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport type {JSONValue} from '../../../shared/src/json.ts';\nimport type {AST, Condition} from '../../../zero-protocol/src/ast.ts';\nimport {hashOfAST} from '../../../zero-protocol/src/query-hash.ts';\nimport type {PermissionsConfig} from '../../../zero-schema/src/compiled-permissions.ts';\nimport {bindStaticParameters} from '../../../zql/src/builder/builder.ts';\nimport {simplifyCondition} from '../../../zql/src/query/expression.ts';\n\nexport type TransformedAndHashed = {\n  id: string;\n  transformedAst: AST;\n  transformationHash: string;\n};\n/**\n * Adds permission rules to the given query so it only returns rows that the\n * user is allowed to read.\n *\n * If the returned query is `undefined` that means that user cannot run\n * the query at all. This is only the case if we can infer that all rows\n * would be excluded without running the query.\n * E.g., the user is trying to query a table that is not readable.\n */\nexport function transformAndHashQuery(\n  lc: LogContext,\n  id: string,\n  query: AST,\n  permissionRules: PermissionsConfig,\n  authData: JWTPayload | undefined,\n  internalQuery: boolean | null | undefined,\n): TransformedAndHashed {\n  const transformed = internalQuery\n    ? query // application permissions do not apply to internal queries\n    : transformQuery(lc, query, permissionRules, authData);\n  return {\n    id,\n    transformedAst: transformed,\n    transformationHash: hashOfAST(transformed),\n  };\n}\n\n/**\n * For a given AST, apply the read-auth rules and bind static auth data.\n */\nexport function transformQuery(\n  lc: LogContext,\n  query: AST,\n  permissionRules: PermissionsConfig,\n  authData: JWTPayload | undefined,\n): AST {\n  const queryWithPermissions = transformQueryInternal(\n    lc,\n    query,\n    permissionRules,\n  );\n  return bindStaticParameters(queryWithPermissions, {\n    authData: authData as Record<string, JSONValue>,\n  });\n}\n\nfunction transformQueryInternal(\n  lc: LogContext,\n  query: AST,\n  permissionRules: PermissionsConfig,\n): AST {\n  let rowSelectRules = permissionRules?.tables?.[query.table]?.row?.select;\n\n  if (!rowSelectRules || rowSelectRules.length === 0) {\n    // If there are no rules, we default to not allowing any rows to be selected.\n    lc.warn?.(\n      \"No permission rules found for table '\" +\n        query.table +\n        \"'. No rows will be returned. Use ANYONE_CAN to allow all users to access all rows.\",\n    );\n    rowSelectRules = [\n      [\n        'allow',\n        {\n          type: 'or',\n          conditions: [],\n        },\n      ],\n    ];\n  }\n\n  const updatedWhere = addRulesToWhere(\n    query.where\n      ? transformCondition(lc, query.where, permissionRules)\n      : undefined,\n    rowSelectRules,\n  );\n  return {\n    ...query,\n    where: simplifyCondition(updatedWhere),\n    related: query.related?.map(sq => {\n      const subquery = transformQueryInternal(lc, sq.subquery, permissionRules);\n      return {\n        ...sq,\n        subquery,\n      };\n    }),\n  };\n}\n\nfunction addRulesToWhere(\n  where: Condition | undefined,\n  rowSelectRules: ['allow', Condition][],\n): Condition {\n  return {\n    type: 'and',\n    conditions: [\n      ...(where ? [where] : []),\n      {\n        type: 'or',\n        conditions: rowSelectRules.map(([_, condition]) => condition),\n      },\n    ],\n  };\n}\n\n// We must augment conditions so we do not provide an oracle to users.\n// E.g.,\n// `issue.whereExists('secret', s => s.where('value', 'sdf'))`\n// Not applying read policies to subqueries in the where position\n// would allow users to infer the existence of rows, and their contents,\n// that they cannot read.\nfunction transformCondition(\n  lc: LogContext,\n  cond: Condition,\n  auth: PermissionsConfig,\n): Condition {\n  switch (cond.type) {\n    case 'simple':\n      return cond;\n    case 'and':\n    case 'or':\n      return {\n        ...cond,\n        conditions: cond.conditions.map(c => transformCondition(lc, c, auth)),\n      };\n    case 'correlatedSubquery': {\n      const query = transformQueryInternal(lc, cond.related.subquery, auth);\n      return {\n        ...cond,\n        related: {\n          ...cond.related,\n          subquery: query,\n        },\n      };\n    }\n  }\n}\n"],"names":[],"mappings":";;;AAuBO,SAAS,sBACd,IACA,IACA,OACA,iBACA,UACA,eACsB;AACtB,QAAM,cAAc,gBAChB,QACA,eAAe,IAAI,OAAO,iBAAiB,QAAQ;AACvD,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB;AAAA,IAChB,oBAAoB,UAAU,WAAW;AAAA,EAAA;AAE7C;AAKO,SAAS,eACd,IACA,OACA,iBACA,UACK;AACL,QAAM,uBAAuB;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF,SAAO,qBAAqB,sBAAsB;AAAA,IAChD;AAAA,EAAA,CACD;AACH;AAEA,SAAS,uBACP,IACA,OACA,iBACK;AACL,MAAI,iBAAiB,iBAAiB,SAAS,MAAM,KAAK,GAAG,KAAK;AAElE,MAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG;AAElD,OAAG;AAAA,MACD,0CACE,MAAM,QACN;AAAA,IAAA;AAEJ,qBAAiB;AAAA,MACf;AAAA,QACE;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,YAAY,CAAA;AAAA,QAAC;AAAA,MACf;AAAA,IACF;AAAA,EAEJ;AAEA,QAAM,eAAe;AAAA,IACnB,MAAM,QACF,mBAAmB,IAAI,MAAM,OAAO,eAAe,IACnD;AAAA,IACJ;AAAA,EAAA;AAEF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,kBAAkB,YAAY;AAAA,IACrC,SAAS,MAAM,SAAS,IAAI,CAAA,OAAM;AAChC,YAAM,WAAW,uBAAuB,IAAI,GAAG,UAAU,eAAe;AACxE,aAAO;AAAA,QACL,GAAG;AAAA,QACH;AAAA,MAAA;AAAA,IAEJ,CAAC;AAAA,EAAA;AAEL;AAEA,SAAS,gBACP,OACA,gBACW;AACX,SAAO;AAAA,IACL,MAAM;AAAA,IACN,YAAY;AAAA,MACV,GAAI,QAAQ,CAAC,KAAK,IAAI,CAAA;AAAA,MACtB;AAAA,QACE,MAAM;AAAA,QACN,YAAY,eAAe,IAAI,CAAC,CAAC,GAAG,SAAS,MAAM,SAAS;AAAA,MAAA;AAAA,IAC9D;AAAA,EACF;AAEJ;AAQA,SAAS,mBACP,IACA,MACA,MACW;AACX,UAAQ,KAAK,MAAA;AAAA,IACX,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,QACL,GAAG;AAAA,QACH,YAAY,KAAK,WAAW,IAAI,OAAK,mBAAmB,IAAI,GAAG,IAAI,CAAC;AAAA,MAAA;AAAA,IAExE,KAAK,sBAAsB;AACzB,YAAM,QAAQ,uBAAuB,IAAI,KAAK,QAAQ,UAAU,IAAI;AACpE,aAAO;AAAA,QACL,GAAG;AAAA,QACH,SAAS;AAAA,UACP,GAAG,KAAK;AAAA,UACR,UAAU;AAAA,QAAA;AAAA,MACZ;AAAA,IAEJ;AAAA,EAAA;AAEJ;"}

package/out/zero-cache/src/auth/write-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-authorizer.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/write-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAUrC,OAAO,KAAK,EACV,MAAM,EAIN,QAAQ,EACT,MAAM,oCAAoC,CAAC;AAc5C,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,2BAA2B,CAAC;AAMxD,OAAO,KAAK,EAAY,UAAU,EAAC,MAAM,0BAA0B,CAAC;AAapE,MAAM,WAAW,eAAe;IAC9B,cAAc,CACZ,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAC/B,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,eAAe,CACb,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAC/B,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,iBAAiB,IAAI,IAAI,CAAC;IAC1B,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;CAC1D;AAED,qBAAa,mBAAoB,YAAW,eAAe;;gBAevD,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,QAAQ,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,eAAe;IAqBpC,iBAAiB;IASjB,OAAO;IAID,cAAc,CAClB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IAsB5B,eAAe,CACnB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IA6DlC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;CA4UzD"}
+{"version":3,"file":"write-authorizer.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/write-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAUrC,OAAO,KAAK,EACV,MAAM,EAIN,QAAQ,EACT,MAAM,oCAAoC,CAAC;AAa5C,OAAO,KAAK,EAEV,eAAe,EAChB,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,2BAA2B,CAAC;AAMxD,OAAO,KAAK,EAAY,UAAU,EAAC,MAAM,0BAA0B,CAAC;AAapE,MAAM,WAAW,eAAe;IAC9B,cAAc,CACZ,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAC/B,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,eAAe,CACb,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAC/B,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,iBAAiB,IAAI,IAAI,CAAC;IAC1B,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;CAC1D;AAED,qBAAa,mBAAoB,YAAW,eAAe;;gBAevD,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,QAAQ,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,eAAe;IAqBpC,iBAAiB;IASjB,OAAO;IAID,cAAc,CAClB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IAsB5B,eAAe,CACnB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IAmElC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;CA4UzD"}

package/out/zero-cache/src/auth/write-authorizer.js

@@ -3,8 +3,10 @@ import { must } from "../../../shared/src/must.js";
 import { parse } from "../../../shared/src/valita.js";
 import { primaryKeyValueSchema } from "../../../zero-protocol/src/primary-key.js";
 import { bindStaticParameters, buildPipeline } from "../../../zql/src/builder/builder.js";
+import { consume } from "../../../zql/src/ivm/stream.js";
 import { simplifyCondition } from "../../../zql/src/query/expression.js";
-import { staticQuery, asStaticQuery } from "../../../zql/src/query/static-query.js";
+import { asQueryInternals } from "../../../zql/src/query/query-internals.js";
+import { newStaticQuery } from "../../../zql/src/query/static-query.js";
 import { sql, compile } from "../../../zqlite/src/internal/sql.js";
 import { TableSource, fromSQLiteTypes } from "../../../zqlite/src/table-source.js";
 import { computeZqlSpecs } from "../db/lite-tables.js";
@@ -80,10 +82,12 @@ class WriteAuthorizerImpl {
         const source = this.#getSource(op.tableName);
         switch (op.op) {
           case "insert": {
-            source.push({
-              type: "add",
-              row: op.value
-            });
+            consume(
+              source.push({
+                type: "add",
+                row: op.value
+              })
+            );
             break;
           }
           // TODO(mlaw): what if someone updates the same thing twice?
@@ -92,18 +96,22 @@ class WriteAuthorizerImpl {
           // next requirePreMutationRow will just return the row that was
           // pushed in.
           case "update": {
-            source.push({
-              type: "edit",
-              oldRow: this.#requirePreMutationRow(op),
-              row: op.value
-            });
+            consume(
+              source.push({
+                type: "edit",
+                oldRow: this.#requirePreMutationRow(op),
+                row: op.value
+              })
+            );
             break;
           }
           case "delete": {
-            source.push({
-              type: "remove",
-              row: this.#requirePreMutationRow(op)
-            });
+            consume(
+              source.push({
+                type: "remove",
+                row: this.#requirePreMutationRow(op)
+              })
+            );
             break;
           }
         }
@@ -240,9 +248,9 @@ class WriteAuthorizerImpl {
    * All steps must allow for the operation to be allowed.
    */
   async #canDo(phase, action, authData, op) {
-    const rules = must(this.#loadedPermissions).permissions?.tables[op.tableName];
+    const rules = must(this.#loadedPermissions)?.permissions?.tables?.[op.tableName];
     const rowPolicies = rules?.row;
-    let rowQuery = staticQuery(this.#schema, op.tableName);
+    let rowQuery = newStaticQuery(this.#schema, op.tableName);
     const primaryKeyValues = this.#getPrimaryKey(op.tableName, op.value);
     for (const pk in primaryKeyValues) {
       rowQuery = rowQuery.where(pk, "=", primaryKeyValues[pk]);
@@ -375,7 +383,7 @@ class WriteAuthorizerImpl {
     if (policy.length === 0) {
       return false;
     }
-    let rowQueryAst = asStaticQuery(rowQuery).ast;
+    let rowQueryAst = asQueryInternals(rowQuery).ast;
     rowQueryAst = bindStaticParameters(
       {
         ...rowQueryAst,

package/out/zero-cache/src/auth/write-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"write-authorizer.js","sources":["../../../../../zero-cache/src/auth/write-authorizer.ts"],"sourcesContent":["import type {SQLQuery} from '@databases/sql';\nimport type {MaybePromise} from '@opentelemetry/resources';\nimport type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport {assert} from '../../../shared/src/asserts.ts';\nimport type {JSONValue, ReadonlyJSONValue} from '../../../shared/src/json.ts';\nimport {must} from '../../../shared/src/must.ts';\nimport * as v from '../../../shared/src/valita.ts';\nimport type {Condition} from '../../../zero-protocol/src/ast.ts';\nimport {\n  primaryKeyValueSchema,\n  type PrimaryKeyValue,\n} from '../../../zero-protocol/src/primary-key.ts';\nimport type {\n  CRUDOp,\n  DeleteOp,\n  InsertOp,\n  UpdateOp,\n  UpsertOp,\n} from '../../../zero-protocol/src/push.ts';\nimport type {Policy} from '../../../zero-schema/src/compiled-permissions.ts';\nimport type {Schema} from '../../../zero-types/src/schema.ts';\nimport type {BuilderDelegate} from '../../../zql/src/builder/builder.ts';\nimport {\n  bindStaticParameters,\n  buildPipeline,\n} from '../../../zql/src/builder/builder.ts';\nimport {simplifyCondition} from '../../../zql/src/query/expression.ts';\nimport type {Query} from '../../../zql/src/query/query.ts';\nimport {\n  asStaticQuery,\n  staticQuery,\n} from '../../../zql/src/query/static-query.ts';\nimport type {\n  DatabaseStorage,\n  ClientGroupStorage,\n} from '../../../zqlite/src/database-storage.ts';\nimport type {Database} from '../../../zqlite/src/db.ts';\nimport {compile, sql} from '../../../zqlite/src/internal/sql.ts';\nimport {\n  fromSQLiteTypes,\n  TableSource,\n} from '../../../zqlite/src/table-source.ts';\nimport type {LogConfig, ZeroConfig} from '../config/zero-config.ts';\nimport {computeZqlSpecs} from '../db/lite-tables.ts';\nimport type {LiteAndZqlSpec} from '../db/specs.ts';\nimport {StatementRunner} from '../db/statements.ts';\nimport {mapLiteDataTypeToZqlSchemaValue} from '../types/lite.ts';\nimport {\n  getSchema,\n  reloadPermissionsIfChanged,\n  type LoadedPermissions,\n} from './load-permissions.ts';\n\ntype Phase = 'preMutation' | 'postMutation';\n\nexport interface WriteAuthorizer {\n  canPreMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ): Promise<boolean>;\n  canPostMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ): Promise<boolean>;\n  reloadPermissions(): void;\n  normalizeOps(ops: CRUDOp[]): Exclude<CRUDOp, UpsertOp>[];\n}\n\nexport class WriteAuthorizerImpl implements WriteAuthorizer {\n  readonly #schema: Schema;\n  readonly #replica: Database;\n  readonly #builderDelegate: BuilderDelegate;\n  readonly #tableSpecs: Map<string, LiteAndZqlSpec>;\n  readonly #tables = new Map<string, TableSource>();\n  readonly #statementRunner: StatementRunner;\n  readonly #lc: LogContext;\n  readonly #appID: string;\n  readonly #logConfig: LogConfig;\n  readonly #cgStorage: ClientGroupStorage;\n\n  #loadedPermissions: LoadedPermissions | null = null;\n\n  constructor(\n    lc: LogContext,\n    config: ZeroConfig,\n    replica: Database,\n    appID: string,\n    cgID: string,\n    writeAuthzStorage: DatabaseStorage,\n  ) {\n    this.#appID = appID;\n    this.#lc = lc.withContext('class', 'WriteAuthorizerImpl');\n    this.#logConfig = config.log;\n    this.#schema = getSchema(this.#lc, replica);\n    this.#replica = replica;\n    this.#cgStorage = writeAuthzStorage.createClientGroupStorage(cgID);\n    this.#builderDelegate = {\n      getSource: name => this.#getSource(name),\n      createStorage: () => this.#cgStorage.createStorage(),\n      decorateSourceInput: input => input,\n      decorateInput: input => input,\n      addEdge() {},\n      decorateFilterInput: input => input,\n    };\n    this.#tableSpecs = computeZqlSpecs(this.#lc, replica);\n    this.#statementRunner = new StatementRunner(replica);\n    this.reloadPermissions();\n  }\n\n  reloadPermissions() {\n    this.#loadedPermissions = reloadPermissionsIfChanged(\n      this.#lc,\n      this.#statementRunner,\n      this.#appID,\n      this.#loadedPermissions,\n    ).permissions;\n  }\n\n  destroy() {\n    this.#cgStorage.destroy();\n  }\n\n  async canPreMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ) {\n    for (const op of ops) {\n      switch (op.op) {\n        case 'insert':\n          // insert does not run pre-mutation checks\n          break;\n        case 'update':\n          if (!(await this.#canUpdate('preMutation', authData, op))) {\n            return false;\n          }\n          break;\n        case 'delete':\n          if (!(await this.#canDelete('preMutation', authData, op))) {\n            return false;\n          }\n          break;\n      }\n    }\n    return true;\n  }\n\n  async canPostMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ) {\n    this.#statementRunner.beginConcurrent();\n    try {\n      for (const op of ops) {\n        const source = this.#getSource(op.tableName);\n        switch (op.op) {\n          case 'insert': {\n            source.push({\n              type: 'add',\n              row: op.value,\n            });\n            break;\n          }\n          // TODO(mlaw): what if someone updates the same thing twice?\n          // TODO(aa): It seems like it will just work? source.push()\n          // is going to push the row into the table source, and then the\n          // next requirePreMutationRow will just return the row that was\n          // pushed in.\n          case 'update': {\n            source.push({\n              type: 'edit',\n              oldRow: this.#requirePreMutationRow(op),\n              row: op.value,\n            });\n            break;\n          }\n          case 'delete': {\n            source.push({\n              type: 'remove',\n              row: this.#requirePreMutationRow(op),\n            });\n            break;\n          }\n        }\n      }\n\n      for (const op of ops) {\n        switch (op.op) {\n          case 'insert':\n            if (!(await this.#canInsert('postMutation', authData, op))) {\n              return false;\n            }\n            break;\n          case 'update':\n            if (!(await this.#canUpdate('postMutation', authData, op))) {\n              return false;\n            }\n            break;\n          case 'delete':\n            // delete does not run post-mutation checks.\n            break;\n        }\n      }\n    } finally {\n      this.#statementRunner.rollback();\n    }\n\n    return true;\n  }\n\n  normalizeOps(ops: CRUDOp[]): Exclude<CRUDOp, UpsertOp>[] {\n    return ops.map(op => {\n      if (op.op === 'upsert') {\n        const preMutationRow = this.#getPreMutationRow(op);\n        if (preMutationRow) {\n          return {\n            op: 'update',\n            tableName: op.tableName,\n            primaryKey: op.primaryKey,\n            value: op.value,\n          };\n        }\n        return {\n          op: 'insert',\n          tableName: op.tableName,\n          primaryKey: op.primaryKey,\n          value: op.value,\n        };\n      }\n      return op;\n    });\n  }\n\n  #canInsert(phase: Phase, authData: JWTPayload | undefined, op: InsertOp) {\n    return this.#timedCanDo(phase, 'insert', authData, op);\n  }\n\n  #canUpdate(phase: Phase, authData: JWTPayload | undefined, op: UpdateOp) {\n    return this.#timedCanDo(phase, 'update', authData, op);\n  }\n\n  #canDelete(phase: Phase, authData: JWTPayload | undefined, op: DeleteOp) {\n    return this.#timedCanDo(phase, 'delete', authData, op);\n  }\n\n  /**\n   * Gets schema-defined primary key and validates that operation contains required PK values.\n   *\n   * @returns Record where keys are column names and values are client-provided values\n   * @throws Error if operation value is missing required primary key columns\n   */\n  #getPrimaryKey(\n    tableName: string,\n    opValue: Record<string, ReadonlyJSONValue | undefined>,\n  ): Record<string, ReadonlyJSONValue> {\n    const tableSpec = this.#tableSpecs.get(tableName);\n    if (!tableSpec) {\n      throw new Error(`Table ${tableName} not found`);\n    }\n    const columns = tableSpec.tableSpec.primaryKey;\n\n    // Extract primary key values from operation value and validate they exist\n    const values: Record<string, ReadonlyJSONValue> = {};\n    for (const col of columns) {\n      const val = opValue[col];\n      if (val === undefined) {\n        throw new Error(\n          `Primary key column '${col}' is missing from operation value for table ${tableName}`,\n        );\n      }\n      values[col] = val;\n    }\n\n    return values;\n  }\n\n  #getSource(tableName: string) {\n    let source = this.#tables.get(tableName);\n    if (source) {\n      return source;\n    }\n    const tableSpec = this.#tableSpecs.get(tableName);\n    if (!tableSpec) {\n      throw new Error(`Table ${tableName} not found`);\n    }\n    const {columns, primaryKey} = tableSpec.tableSpec;\n    assert(primaryKey.length);\n    source = new TableSource(\n      this.#lc,\n      this.#logConfig,\n      this.#replica,\n      tableName,\n      Object.fromEntries(\n        Object.entries(columns).map(([name, {dataType}]) => [\n          name,\n          mapLiteDataTypeToZqlSchemaValue(dataType),\n        ]),\n      ),\n      [primaryKey[0], ...primaryKey.slice(1)],\n    );\n    this.#tables.set(tableName, source);\n\n    return source;\n  }\n\n  async #timedCanDo<A extends keyof ActionOpMap>(\n    phase: Phase,\n    action: A,\n    authData: JWTPayload | undefined,\n    op: ActionOpMap[A],\n  ) {\n    const start = performance.now();\n    try {\n      const ret = await this.#canDo(phase, action, authData, op);\n      return ret;\n    } finally {\n      this.#lc.info?.(\n        'action:',\n        action,\n        'duration:',\n        performance.now() - start,\n        'tableName:',\n        op.tableName,\n        'primaryKey:',\n        op.primaryKey,\n      );\n    }\n  }\n\n  /**\n   * Evaluation order is from static to dynamic, broad to specific.\n   * table -> column -> row -> cell.\n   *\n   * If any step fails, the entire operation is denied.\n   *\n   * That is, table rules supersede column rules, which supersede row rules,\n   *\n   * All steps must allow for the operation to be allowed.\n   */\n  async #canDo<A extends keyof ActionOpMap>(\n    phase: Phase,\n    action: A,\n    authData: JWTPayload | undefined,\n    op: ActionOpMap[A],\n  ) {\n    const rules = must(this.#loadedPermissions).permissions?.tables[\n      op.tableName\n    ];\n    const rowPolicies = rules?.row;\n    let rowQuery = staticQuery(this.#schema, op.tableName);\n\n    const primaryKeyValues = this.#getPrimaryKey(op.tableName, op.value);\n\n    for (const pk in primaryKeyValues) {\n      rowQuery = rowQuery.where(pk, '=', primaryKeyValues[pk]);\n    }\n\n    let applicableRowPolicy: Policy | undefined;\n    switch (action) {\n      case 'insert':\n        if (phase === 'postMutation') {\n          applicableRowPolicy = rowPolicies?.insert;\n        }\n        break;\n      case 'update':\n        if (phase === 'preMutation') {\n          applicableRowPolicy = rowPolicies?.update?.preMutation;\n        } else if (phase === 'postMutation') {\n          applicableRowPolicy = rowPolicies?.update?.postMutation;\n        }\n        break;\n      case 'delete':\n        if (phase === 'preMutation') {\n          applicableRowPolicy = rowPolicies?.delete;\n        }\n        break;\n    }\n\n    const cellPolicies = rules?.cell;\n    const applicableCellPolicies: Policy[] = [];\n    if (cellPolicies) {\n      for (const [column, policy] of Object.entries(cellPolicies)) {\n        if (action === 'update' && op.value[column] === undefined) {\n          // If the cell is not being updated, we do not need to check\n          // the cell rules.\n          continue;\n        }\n        switch (action) {\n          case 'insert':\n            if (policy.insert && phase === 'postMutation') {\n              applicableCellPolicies.push(policy.insert);\n            }\n            break;\n          case 'update':\n            if (phase === 'preMutation' && policy.update?.preMutation) {\n              applicableCellPolicies.push(policy.update.preMutation);\n            }\n            if (phase === 'postMutation' && policy.update?.postMutation) {\n              applicableCellPolicies.push(policy.update.postMutation);\n            }\n            break;\n          case 'delete':\n            if (policy.delete && phase === 'preMutation') {\n              applicableCellPolicies.push(policy.delete);\n            }\n            break;\n        }\n      }\n    }\n\n    if (\n      !(await this.#passesPolicyGroup(\n        applicableRowPolicy,\n        applicableCellPolicies,\n        authData,\n        rowQuery,\n      ))\n    ) {\n      this.#lc.warn?.(\n        `Permission check failed for ${JSON.stringify(\n          op,\n        )}, action ${action}, phase ${phase}, authData: ${JSON.stringify(\n          authData,\n        )}, rowPolicies: ${JSON.stringify(\n          applicableRowPolicy,\n        )}, cellPolicies: ${JSON.stringify(applicableCellPolicies)}`,\n      );\n      return false;\n    }\n\n    return true;\n  }\n\n  #getPreMutationRow(op: UpsertOp | UpdateOp | DeleteOp) {\n    const {value} = op;\n\n    const primaryKeyValues = this.#getPrimaryKey(op.tableName, value);\n\n    const spec = this.#tableSpecs.get(op.tableName);\n    if (!spec) {\n      throw new Error(`Table ${op.tableName} not found`);\n    }\n\n    const conditions: SQLQuery[] = [];\n    const values: PrimaryKeyValue[] = [];\n    for (const pk in primaryKeyValues) {\n      conditions.push(sql`${sql.ident(pk)}=?`);\n      values.push(v.parse(primaryKeyValues[pk], primaryKeyValueSchema));\n    }\n\n    const ret = this.#statementRunner.get(\n      compile(\n        sql`SELECT ${sql.join(\n          Object.keys(spec.zqlSpec).map(c => sql.ident(c)),\n          sql`,`,\n        )} FROM ${sql.ident(op.tableName)} WHERE ${sql.join(\n          conditions,\n          sql` AND `,\n        )}`,\n      ),\n      ...values,\n    );\n    if (ret === undefined) {\n      return ret;\n    }\n    return fromSQLiteTypes(spec.zqlSpec, ret, op.tableName);\n  }\n\n  #requirePreMutationRow(op: UpdateOp | DeleteOp) {\n    const ret = this.#getPreMutationRow(op);\n    assert(\n      ret !== undefined,\n      () => `Pre-mutation row not found for ${JSON.stringify(op.value)}`,\n    );\n    return ret;\n  }\n\n  async #passesPolicyGroup(\n    applicableRowPolicy: Policy | undefined,\n    applicableCellPolicies: Policy[],\n    authData: JWTPayload | undefined,\n    rowQuery: Query<Schema, string>,\n  ) {\n    if (!(await this.#passesPolicy(applicableRowPolicy, authData, rowQuery))) {\n      return false;\n    }\n\n    for (const policy of applicableCellPolicies) {\n      if (!(await this.#passesPolicy(policy, authData, rowQuery))) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  /**\n   * Defaults to *false* if the policy is empty. At least one rule has to pass\n   * for the policy to pass.\n   */\n  #passesPolicy(\n    policy: Policy | undefined,\n    authData: JWTPayload | undefined,\n    rowQuery: Query<Schema, string>,\n  ): MaybePromise<boolean> {\n    if (policy === undefined) {\n      return false;\n    }\n    if (policy.length === 0) {\n      return false;\n    }\n    let rowQueryAst = asStaticQuery(rowQuery).ast;\n    rowQueryAst = bindStaticParameters(\n      {\n        ...rowQueryAst,\n        where: updateWhere(rowQueryAst.where, policy),\n      },\n      {\n        authData: authData as Record<string, JSONValue>,\n        preMutationRow: undefined,\n      },\n    );\n\n    // call the compiler directly\n    // run the sql against upstream.\n    // remove the collecting into json? just need to know if a row comes back.\n\n    const input = buildPipeline(rowQueryAst, this.#builderDelegate, 'query-id');\n    try {\n      const res = input.fetch({});\n      for (const _ of res) {\n        // if any row is returned at all, the\n        // rule passes.\n        return true;\n      }\n    } finally {\n      input.destroy();\n    }\n\n    // no rows returned by any rules? The policy fails.\n    return false;\n  }\n}\n\nfunction updateWhere(where: Condition | undefined, policy: Policy) {\n  assert(where, 'A where condition must exist for RowQuery');\n\n  return simplifyCondition({\n    type: 'and',\n    conditions: [\n      where,\n      {\n        type: 'or',\n        conditions: policy.map(([action, rule]) => {\n          assert(action);\n          return rule;\n        }),\n      },\n    ],\n  });\n}\n\ntype ActionOpMap = {\n  insert: InsertOp;\n  update: UpdateOp;\n  delete: DeleteOp;\n};\n"],"names":["v.parse"],"mappings":";;;;;;;;;;;;;AAqEO,MAAM,oBAA+C;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,8BAAc,IAAA;AAAA,EACd;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,qBAA+C;AAAA,EAE/C,YACE,IACA,QACA,SACA,OACA,MACA,mBACA;AACA,SAAK,SAAS;AACd,SAAK,MAAM,GAAG,YAAY,SAAS,qBAAqB;AACxD,SAAK,aAAa,OAAO;AACzB,SAAK,UAAU,UAAU,KAAK,KAAK,OAAO;AAC1C,SAAK,WAAW;AAChB,SAAK,aAAa,kBAAkB,yBAAyB,IAAI;AACjE,SAAK,mBAAmB;AAAA,MACtB,WAAW,CAAA,SAAQ,KAAK,WAAW,IAAI;AAAA,MACvC,eAAe,MAAM,KAAK,WAAW,cAAA;AAAA,MACrC,qBAAqB,CAAA,UAAS;AAAA,MAC9B,eAAe,CAAA,UAAS;AAAA,MACxB,UAAU;AAAA,MAAC;AAAA,MACX,qBAAqB,CAAA,UAAS;AAAA,IAAA;AAEhC,SAAK,cAAc,gBAAgB,KAAK,KAAK,OAAO;AACpD,SAAK,mBAAmB,IAAI,gBAAgB,OAAO;AACnD,SAAK,kBAAA;AAAA,EACP;AAAA,EAEA,oBAAoB;AAClB,SAAK,qBAAqB;AAAA,MACxB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IAAA,EACL;AAAA,EACJ;AAAA,EAEA,UAAU;AACR,SAAK,WAAW,QAAA;AAAA,EAClB;AAAA,EAEA,MAAM,eACJ,UACA,KACA;AACA,eAAW,MAAM,KAAK;AACpB,cAAQ,GAAG,IAAA;AAAA,QACT,KAAK;AAEH;AAAA,QACF,KAAK;AACH,cAAI,CAAE,MAAM,KAAK,WAAW,eAAe,UAAU,EAAE,GAAI;AACzD,mBAAO;AAAA,UACT;AACA;AAAA,QACF,KAAK;AACH,cAAI,CAAE,MAAM,KAAK,WAAW,eAAe,UAAU,EAAE,GAAI;AACzD,mBAAO;AAAA,UACT;AACA;AAAA,MAAA;AAAA,IAEN;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBACJ,UACA,KACA;AACA,SAAK,iBAAiB,gBAAA;AACtB,QAAI;AACF,iBAAW,MAAM,KAAK;AACpB,cAAM,SAAS,KAAK,WAAW,GAAG,SAAS;AAC3C,gBAAQ,GAAG,IAAA;AAAA,UACT,KAAK,UAAU;AACb,mBAAO,KAAK;AAAA,cACV,MAAM;AAAA,cACN,KAAK,GAAG;AAAA,YAAA,CACT;AACD;AAAA,UACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMA,KAAK,UAAU;AACb,mBAAO,KAAK;AAAA,cACV,MAAM;AAAA,cACN,QAAQ,KAAK,uBAAuB,EAAE;AAAA,cACtC,KAAK,GAAG;AAAA,YAAA,CACT;AACD;AAAA,UACF;AAAA,UACA,KAAK,UAAU;AACb,mBAAO,KAAK;AAAA,cACV,MAAM;AAAA,cACN,KAAK,KAAK,uBAAuB,EAAE;AAAA,YAAA,CACpC;AACD;AAAA,UACF;AAAA,QAAA;AAAA,MAEJ;AAEA,iBAAW,MAAM,KAAK;AACpB,gBAAQ,GAAG,IAAA;AAAA,UACT,KAAK;AACH,gBAAI,CAAE,MAAM,KAAK,WAAW,gBAAgB,UAAU,EAAE,GAAI;AAC1D,qBAAO;AAAA,YACT;AACA;AAAA,UACF,KAAK;AACH,gBAAI,CAAE,MAAM,KAAK,WAAW,gBAAgB,UAAU,EAAE,GAAI;AAC1D,qBAAO;AAAA,YACT;AACA;AAAA,UACF,KAAK;AAEH;AAAA,QAAA;AAAA,MAEN;AAAA,IACF,UAAA;AACE,WAAK,iBAAiB,SAAA;AAAA,IACxB;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,aAAa,KAA4C;AACvD,WAAO,IAAI,IAAI,CAAA,OAAM;AACnB,UAAI,GAAG,OAAO,UAAU;AACtB,cAAM,iBAAiB,KAAK,mBAAmB,EAAE;AACjD,YAAI,gBAAgB;AAClB,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,WAAW,GAAG;AAAA,YACd,YAAY,GAAG;AAAA,YACf,OAAO,GAAG;AAAA,UAAA;AAAA,QAEd;AACA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,WAAW,GAAG;AAAA,UACd,YAAY,GAAG;AAAA,UACf,OAAO,GAAG;AAAA,QAAA;AAAA,MAEd;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,OAAc,UAAkC,IAAc;AACvE,WAAO,KAAK,YAAY,OAAO,UAAU,UAAU,EAAE;AAAA,EACvD;AAAA,EAEA,WAAW,OAAc,UAAkC,IAAc;AACvE,WAAO,KAAK,YAAY,OAAO,UAAU,UAAU,EAAE;AAAA,EACvD;AAAA,EAEA,WAAW,OAAc,UAAkC,IAAc;AACvE,WAAO,KAAK,YAAY,OAAO,UAAU,UAAU,EAAE;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eACE,WACA,SACmC;AACnC,UAAM,YAAY,KAAK,YAAY,IAAI,SAAS;AAChD,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,MAAM,SAAS,SAAS,YAAY;AAAA,IAChD;AACA,UAAM,UAAU,UAAU,UAAU;AAGpC,UAAM,SAA4C,CAAA;AAClD,eAAW,OAAO,SAAS;AACzB,YAAM,MAAM,QAAQ,GAAG;AACvB,UAAI,QAAQ,QAAW;AACrB,cAAM,IAAI;AAAA,UACR,uBAAuB,GAAG,+CAA+C,SAAS;AAAA,QAAA;AAAA,MAEtF;AACA,aAAO,GAAG,IAAI;AAAA,IAChB;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,WAAW,WAAmB;AAC5B,QAAI,SAAS,KAAK,QAAQ,IAAI,SAAS;AACvC,QAAI,QAAQ;AACV,aAAO;AAAA,IACT;AACA,UAAM,YAAY,KAAK,YAAY,IAAI,SAAS;AAChD,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,MAAM,SAAS,SAAS,YAAY;AAAA,IAChD;AACA,UAAM,EAAC,SAAS,WAAA,IAAc,UAAU;AACxC,WAAO,WAAW,MAAM;AACxB,aAAS,IAAI;AAAA,MACX,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA,OAAO;AAAA,QACL,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,EAAC,SAAA,CAAS,MAAM;AAAA,UAClD;AAAA,UACA,gCAAgC,QAAQ;AAAA,QAAA,CACzC;AAAA,MAAA;AAAA,MAEH,CAAC,WAAW,CAAC,GAAG,GAAG,WAAW,MAAM,CAAC,CAAC;AAAA,IAAA;AAExC,SAAK,QAAQ,IAAI,WAAW,MAAM;AAElC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YACJ,OACA,QACA,UACA,IACA;AACA,UAAM,QAAQ,YAAY,IAAA;AAC1B,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,OAAO,OAAO,QAAQ,UAAU,EAAE;AACzD,aAAO;AAAA,IACT,UAAA;AACE,WAAK,IAAI;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB;AAAA,QACA,GAAG;AAAA,QACH;AAAA,QACA,GAAG;AAAA,MAAA;AAAA,IAEP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,OACJ,OACA,QACA,UACA,IACA;AACA,UAAM,QAAQ,KAAK,KAAK,kBAAkB,EAAE,aAAa,OACvD,GAAG,SACL;AACA,UAAM,cAAc,OAAO;AAC3B,QAAI,WAAW,YAAY,KAAK,SAAS,GAAG,SAAS;AAErD,UAAM,mBAAmB,KAAK,eAAe,GAAG,WAAW,GAAG,KAAK;AAEnE,eAAW,MAAM,kBAAkB;AACjC,iBAAW,SAAS,MAAM,IAAI,KAAK,iBAAiB,EAAE,CAAC;AAAA,IACzD;AAEA,QAAI;AACJ,YAAQ,QAAA;AAAA,MACN,KAAK;AACH,YAAI,UAAU,gBAAgB;AAC5B,gCAAsB,aAAa;AAAA,QACrC;AACA;AAAA,MACF,KAAK;AACH,YAAI,UAAU,eAAe;AAC3B,gCAAsB,aAAa,QAAQ;AAAA,QAC7C,WAAW,UAAU,gBAAgB;AACnC,gCAAsB,aAAa,QAAQ;AAAA,QAC7C;AACA;AAAA,MACF,KAAK;AACH,YAAI,UAAU,eAAe;AAC3B,gCAAsB,aAAa;AAAA,QACrC;AACA;AAAA,IAAA;AAGJ,UAAM,eAAe,OAAO;AAC5B,UAAM,yBAAmC,CAAA;AACzC,QAAI,cAAc;AAChB,iBAAW,CAAC,QAAQ,MAAM,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC3D,YAAI,WAAW,YAAY,GAAG,MAAM,MAAM,MAAM,QAAW;AAGzD;AAAA,QACF;AACA,gBAAQ,QAAA;AAAA,UACN,KAAK;AACH,gBAAI,OAAO,UAAU,UAAU,gBAAgB;AAC7C,qCAAuB,KAAK,OAAO,MAAM;AAAA,YAC3C;AACA;AAAA,UACF,KAAK;AACH,gBAAI,UAAU,iBAAiB,OAAO,QAAQ,aAAa;AACzD,qCAAuB,KAAK,OAAO,OAAO,WAAW;AAAA,YACvD;AACA,gBAAI,UAAU,kBAAkB,OAAO,QAAQ,cAAc;AAC3D,qCAAuB,KAAK,OAAO,OAAO,YAAY;AAAA,YACxD;AACA;AAAA,UACF,KAAK;AACH,gBAAI,OAAO,UAAU,UAAU,eAAe;AAC5C,qCAAuB,KAAK,OAAO,MAAM;AAAA,YAC3C;AACA;AAAA,QAAA;AAAA,MAEN;AAAA,IACF;AAEA,QACE,CAAE,MAAM,KAAK;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA,GAEF;AACA,WAAK,IAAI;AAAA,QACP,+BAA+B,KAAK;AAAA,UAClC;AAAA,QAAA,CACD,YAAY,MAAM,WAAW,KAAK,eAAe,KAAK;AAAA,UACrD;AAAA,QAAA,CACD,kBAAkB,KAAK;AAAA,UACtB;AAAA,QAAA,CACD,mBAAmB,KAAK,UAAU,sBAAsB,CAAC;AAAA,MAAA;AAE5D,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,mBAAmB,IAAoC;AACrD,UAAM,EAAC,UAAS;AAEhB,UAAM,mBAAmB,KAAK,eAAe,GAAG,WAAW,KAAK;AAEhE,UAAM,OAAO,KAAK,YAAY,IAAI,GAAG,SAAS;AAC9C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,SAAS,GAAG,SAAS,YAAY;AAAA,IACnD;AAEA,UAAM,aAAyB,CAAA;AAC/B,UAAM,SAA4B,CAAA;AAClC,eAAW,MAAM,kBAAkB;AACjC,iBAAW,KAAK,MAAM,IAAI,MAAM,EAAE,CAAC,IAAI;AACvC,aAAO,KAAKA,MAAQ,iBAAiB,EAAE,GAAG,qBAAqB,CAAC;AAAA,IAClE;AAEA,UAAM,MAAM,KAAK,iBAAiB;AAAA,MAChC;AAAA,QACE,aAAa,IAAI;AAAA,UACf,OAAO,KAAK,KAAK,OAAO,EAAE,IAAI,CAAA,MAAK,IAAI,MAAM,CAAC,CAAC;AAAA,UAC/C;AAAA,QAAA,CACD,SAAS,IAAI,MAAM,GAAG,SAAS,CAAC,UAAU,IAAI;AAAA,UAC7C;AAAA,UACA;AAAA,QAAA,CACD;AAAA,MAAA;AAAA,MAEH,GAAG;AAAA,IAAA;AAEL,QAAI,QAAQ,QAAW;AACrB,aAAO;AAAA,IACT;AACA,WAAO,gBAAgB,KAAK,SAAS,KAAK,GAAG,SAAS;AAAA,EACxD;AAAA,EAEA,uBAAuB,IAAyB;AAC9C,UAAM,MAAM,KAAK,mBAAmB,EAAE;AACtC;AAAA,MACE,QAAQ;AAAA,MACR,MAAM,kCAAkC,KAAK,UAAU,GAAG,KAAK,CAAC;AAAA,IAAA;AAElE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,mBACJ,qBACA,wBACA,UACA,UACA;AACA,QAAI,CAAE,MAAM,KAAK,cAAc,qBAAqB,UAAU,QAAQ,GAAI;AACxE,aAAO;AAAA,IACT;AAEA,eAAW,UAAU,wBAAwB;AAC3C,UAAI,CAAE,MAAM,KAAK,cAAc,QAAQ,UAAU,QAAQ,GAAI;AAC3D,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cACE,QACA,UACA,UACuB;AACvB,QAAI,WAAW,QAAW;AACxB,aAAO;AAAA,IACT;AACA,QAAI,OAAO,WAAW,GAAG;AACvB,aAAO;AAAA,IACT;AACA,QAAI,cAAc,cAAc,QAAQ,EAAE;AAC1C,kBAAc;AAAA,MACZ;AAAA,QACE,GAAG;AAAA,QACH,OAAO,YAAY,YAAY,OAAO,MAAM;AAAA,MAAA;AAAA,MAE9C;AAAA,QACE;AAAA,QACA,gBAAgB;AAAA,MAAA;AAAA,IAClB;AAOF,UAAM,QAAQ,cAAc,aAAa,KAAK,kBAAkB,UAAU;AAC1E,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,EAAE;AAC1B,iBAAW,KAAK,KAAK;AAGnB,eAAO;AAAA,MACT;AAAA,IACF,UAAA;AACE,YAAM,QAAA;AAAA,IACR;AAGA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,YAAY,OAA8B,QAAgB;AACjE,SAAO,OAAO,2CAA2C;AAEzD,SAAO,kBAAkB;AAAA,IACvB,MAAM;AAAA,IACN,YAAY;AAAA,MACV;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,YAAY,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,MAAM;AACzC,iBAAO,MAAM;AACb,iBAAO;AAAA,QACT,CAAC;AAAA,MAAA;AAAA,IACH;AAAA,EACF,CACD;AACH;"}
+{"version":3,"file":"write-authorizer.js","sources":["../../../../../zero-cache/src/auth/write-authorizer.ts"],"sourcesContent":["import type {SQLQuery} from '@databases/sql';\nimport type {MaybePromise} from '@opentelemetry/resources';\nimport type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport {assert} from '../../../shared/src/asserts.ts';\nimport type {JSONValue, ReadonlyJSONValue} from '../../../shared/src/json.ts';\nimport {must} from '../../../shared/src/must.ts';\nimport * as v from '../../../shared/src/valita.ts';\nimport type {Condition} from '../../../zero-protocol/src/ast.ts';\nimport {\n  primaryKeyValueSchema,\n  type PrimaryKeyValue,\n} from '../../../zero-protocol/src/primary-key.ts';\nimport type {\n  CRUDOp,\n  DeleteOp,\n  InsertOp,\n  UpdateOp,\n  UpsertOp,\n} from '../../../zero-protocol/src/push.ts';\nimport type {Policy} from '../../../zero-schema/src/compiled-permissions.ts';\nimport type {Schema} from '../../../zero-types/src/schema.ts';\nimport type {BuilderDelegate} from '../../../zql/src/builder/builder.ts';\nimport {\n  bindStaticParameters,\n  buildPipeline,\n} from '../../../zql/src/builder/builder.ts';\nimport {consume} from '../../../zql/src/ivm/stream.ts';\nimport {simplifyCondition} from '../../../zql/src/query/expression.ts';\nimport {asQueryInternals} from '../../../zql/src/query/query-internals.ts';\nimport type {Query} from '../../../zql/src/query/query.ts';\nimport {newStaticQuery} from '../../../zql/src/query/static-query.ts';\nimport type {\n  ClientGroupStorage,\n  DatabaseStorage,\n} from '../../../zqlite/src/database-storage.ts';\nimport type {Database} from '../../../zqlite/src/db.ts';\nimport {compile, sql} from '../../../zqlite/src/internal/sql.ts';\nimport {\n  fromSQLiteTypes,\n  TableSource,\n} from '../../../zqlite/src/table-source.ts';\nimport type {LogConfig, ZeroConfig} from '../config/zero-config.ts';\nimport {computeZqlSpecs} from '../db/lite-tables.ts';\nimport type {LiteAndZqlSpec} from '../db/specs.ts';\nimport {StatementRunner} from '../db/statements.ts';\nimport {mapLiteDataTypeToZqlSchemaValue} from '../types/lite.ts';\nimport {\n  getSchema,\n  reloadPermissionsIfChanged,\n  type LoadedPermissions,\n} from './load-permissions.ts';\n\ntype Phase = 'preMutation' | 'postMutation';\n\nexport interface WriteAuthorizer {\n  canPreMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ): Promise<boolean>;\n  canPostMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ): Promise<boolean>;\n  reloadPermissions(): void;\n  normalizeOps(ops: CRUDOp[]): Exclude<CRUDOp, UpsertOp>[];\n}\n\nexport class WriteAuthorizerImpl implements WriteAuthorizer {\n  readonly #schema: Schema;\n  readonly #replica: Database;\n  readonly #builderDelegate: BuilderDelegate;\n  readonly #tableSpecs: Map<string, LiteAndZqlSpec>;\n  readonly #tables = new Map<string, TableSource>();\n  readonly #statementRunner: StatementRunner;\n  readonly #lc: LogContext;\n  readonly #appID: string;\n  readonly #logConfig: LogConfig;\n  readonly #cgStorage: ClientGroupStorage;\n\n  #loadedPermissions: LoadedPermissions | null = null;\n\n  constructor(\n    lc: LogContext,\n    config: ZeroConfig,\n    replica: Database,\n    appID: string,\n    cgID: string,\n    writeAuthzStorage: DatabaseStorage,\n  ) {\n    this.#appID = appID;\n    this.#lc = lc.withContext('class', 'WriteAuthorizerImpl');\n    this.#logConfig = config.log;\n    this.#schema = getSchema(this.#lc, replica);\n    this.#replica = replica;\n    this.#cgStorage = writeAuthzStorage.createClientGroupStorage(cgID);\n    this.#builderDelegate = {\n      getSource: name => this.#getSource(name),\n      createStorage: () => this.#cgStorage.createStorage(),\n      decorateSourceInput: input => input,\n      decorateInput: input => input,\n      addEdge() {},\n      decorateFilterInput: input => input,\n    };\n    this.#tableSpecs = computeZqlSpecs(this.#lc, replica);\n    this.#statementRunner = new StatementRunner(replica);\n    this.reloadPermissions();\n  }\n\n  reloadPermissions() {\n    this.#loadedPermissions = reloadPermissionsIfChanged(\n      this.#lc,\n      this.#statementRunner,\n      this.#appID,\n      this.#loadedPermissions,\n    ).permissions;\n  }\n\n  destroy() {\n    this.#cgStorage.destroy();\n  }\n\n  async canPreMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ) {\n    for (const op of ops) {\n      switch (op.op) {\n        case 'insert':\n          // insert does not run pre-mutation checks\n          break;\n        case 'update':\n          if (!(await this.#canUpdate('preMutation', authData, op))) {\n            return false;\n          }\n          break;\n        case 'delete':\n          if (!(await this.#canDelete('preMutation', authData, op))) {\n            return false;\n          }\n          break;\n      }\n    }\n    return true;\n  }\n\n  async canPostMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ) {\n    this.#statementRunner.beginConcurrent();\n    try {\n      for (const op of ops) {\n        const source = this.#getSource(op.tableName);\n        switch (op.op) {\n          case 'insert': {\n            consume(\n              source.push({\n                type: 'add',\n                row: op.value,\n              }),\n            );\n            break;\n          }\n          // TODO(mlaw): what if someone updates the same thing twice?\n          // TODO(aa): It seems like it will just work? source.push()\n          // is going to push the row into the table source, and then the\n          // next requirePreMutationRow will just return the row that was\n          // pushed in.\n          case 'update': {\n            consume(\n              source.push({\n                type: 'edit',\n                oldRow: this.#requirePreMutationRow(op),\n                row: op.value,\n              }),\n            );\n            break;\n          }\n          case 'delete': {\n            consume(\n              source.push({\n                type: 'remove',\n                row: this.#requirePreMutationRow(op),\n              }),\n            );\n            break;\n          }\n        }\n      }\n\n      for (const op of ops) {\n        switch (op.op) {\n          case 'insert':\n            if (!(await this.#canInsert('postMutation', authData, op))) {\n              return false;\n            }\n            break;\n          case 'update':\n            if (!(await this.#canUpdate('postMutation', authData, op))) {\n              return false;\n            }\n            break;\n          case 'delete':\n            // delete does not run post-mutation checks.\n            break;\n        }\n      }\n    } finally {\n      this.#statementRunner.rollback();\n    }\n\n    return true;\n  }\n\n  normalizeOps(ops: CRUDOp[]): Exclude<CRUDOp, UpsertOp>[] {\n    return ops.map(op => {\n      if (op.op === 'upsert') {\n        const preMutationRow = this.#getPreMutationRow(op);\n        if (preMutationRow) {\n          return {\n            op: 'update',\n            tableName: op.tableName,\n            primaryKey: op.primaryKey,\n            value: op.value,\n          };\n        }\n        return {\n          op: 'insert',\n          tableName: op.tableName,\n          primaryKey: op.primaryKey,\n          value: op.value,\n        };\n      }\n      return op;\n    });\n  }\n\n  #canInsert(phase: Phase, authData: JWTPayload | undefined, op: InsertOp) {\n    return this.#timedCanDo(phase, 'insert', authData, op);\n  }\n\n  #canUpdate(phase: Phase, authData: JWTPayload | undefined, op: UpdateOp) {\n    return this.#timedCanDo(phase, 'update', authData, op);\n  }\n\n  #canDelete(phase: Phase, authData: JWTPayload | undefined, op: DeleteOp) {\n    return this.#timedCanDo(phase, 'delete', authData, op);\n  }\n\n  /**\n   * Gets schema-defined primary key and validates that operation contains required PK values.\n   *\n   * @returns Record where keys are column names and values are client-provided values\n   * @throws Error if operation value is missing required primary key columns\n   */\n  #getPrimaryKey(\n    tableName: string,\n    opValue: Record<string, ReadonlyJSONValue | undefined>,\n  ): Record<string, ReadonlyJSONValue> {\n    const tableSpec = this.#tableSpecs.get(tableName);\n    if (!tableSpec) {\n      throw new Error(`Table ${tableName} not found`);\n    }\n    const columns = tableSpec.tableSpec.primaryKey;\n\n    // Extract primary key values from operation value and validate they exist\n    const values: Record<string, ReadonlyJSONValue> = {};\n    for (const col of columns) {\n      const val = opValue[col];\n      if (val === undefined) {\n        throw new Error(\n          `Primary key column '${col}' is missing from operation value for table ${tableName}`,\n        );\n      }\n      values[col] = val;\n    }\n\n    return values;\n  }\n\n  #getSource(tableName: string) {\n    let source = this.#tables.get(tableName);\n    if (source) {\n      return source;\n    }\n    const tableSpec = this.#tableSpecs.get(tableName);\n    if (!tableSpec) {\n      throw new Error(`Table ${tableName} not found`);\n    }\n    const {columns, primaryKey} = tableSpec.tableSpec;\n    assert(primaryKey.length);\n    source = new TableSource(\n      this.#lc,\n      this.#logConfig,\n      this.#replica,\n      tableName,\n      Object.fromEntries(\n        Object.entries(columns).map(([name, {dataType}]) => [\n          name,\n          mapLiteDataTypeToZqlSchemaValue(dataType),\n        ]),\n      ),\n      [primaryKey[0], ...primaryKey.slice(1)],\n    );\n    this.#tables.set(tableName, source);\n\n    return source;\n  }\n\n  async #timedCanDo<A extends keyof ActionOpMap>(\n    phase: Phase,\n    action: A,\n    authData: JWTPayload | undefined,\n    op: ActionOpMap[A],\n  ) {\n    const start = performance.now();\n    try {\n      const ret = await this.#canDo(phase, action, authData, op);\n      return ret;\n    } finally {\n      this.#lc.info?.(\n        'action:',\n        action,\n        'duration:',\n        performance.now() - start,\n        'tableName:',\n        op.tableName,\n        'primaryKey:',\n        op.primaryKey,\n      );\n    }\n  }\n\n  /**\n   * Evaluation order is from static to dynamic, broad to specific.\n   * table -> column -> row -> cell.\n   *\n   * If any step fails, the entire operation is denied.\n   *\n   * That is, table rules supersede column rules, which supersede row rules,\n   *\n   * All steps must allow for the operation to be allowed.\n   */\n  async #canDo<A extends keyof ActionOpMap>(\n    phase: Phase,\n    action: A,\n    authData: JWTPayload | undefined,\n    op: ActionOpMap[A],\n  ) {\n    const rules = must(this.#loadedPermissions)?.permissions?.tables?.[\n      op.tableName\n    ];\n    const rowPolicies = rules?.row;\n    let rowQuery = newStaticQuery(this.#schema, op.tableName);\n\n    const primaryKeyValues = this.#getPrimaryKey(op.tableName, op.value);\n\n    for (const pk in primaryKeyValues) {\n      rowQuery = rowQuery.where(pk, '=', primaryKeyValues[pk]);\n    }\n\n    let applicableRowPolicy: Policy | undefined;\n    switch (action) {\n      case 'insert':\n        if (phase === 'postMutation') {\n          applicableRowPolicy = rowPolicies?.insert;\n        }\n        break;\n      case 'update':\n        if (phase === 'preMutation') {\n          applicableRowPolicy = rowPolicies?.update?.preMutation;\n        } else if (phase === 'postMutation') {\n          applicableRowPolicy = rowPolicies?.update?.postMutation;\n        }\n        break;\n      case 'delete':\n        if (phase === 'preMutation') {\n          applicableRowPolicy = rowPolicies?.delete;\n        }\n        break;\n    }\n\n    const cellPolicies = rules?.cell;\n    const applicableCellPolicies: Policy[] = [];\n    if (cellPolicies) {\n      for (const [column, policy] of Object.entries(cellPolicies)) {\n        if (action === 'update' && op.value[column] === undefined) {\n          // If the cell is not being updated, we do not need to check\n          // the cell rules.\n          continue;\n        }\n        switch (action) {\n          case 'insert':\n            if (policy.insert && phase === 'postMutation') {\n              applicableCellPolicies.push(policy.insert);\n            }\n            break;\n          case 'update':\n            if (phase === 'preMutation' && policy.update?.preMutation) {\n              applicableCellPolicies.push(policy.update.preMutation);\n            }\n            if (phase === 'postMutation' && policy.update?.postMutation) {\n              applicableCellPolicies.push(policy.update.postMutation);\n            }\n            break;\n          case 'delete':\n            if (policy.delete && phase === 'preMutation') {\n              applicableCellPolicies.push(policy.delete);\n            }\n            break;\n        }\n      }\n    }\n\n    if (\n      !(await this.#passesPolicyGroup(\n        applicableRowPolicy,\n        applicableCellPolicies,\n        authData,\n        rowQuery,\n      ))\n    ) {\n      this.#lc.warn?.(\n        `Permission check failed for ${JSON.stringify(\n          op,\n        )}, action ${action}, phase ${phase}, authData: ${JSON.stringify(\n          authData,\n        )}, rowPolicies: ${JSON.stringify(\n          applicableRowPolicy,\n        )}, cellPolicies: ${JSON.stringify(applicableCellPolicies)}`,\n      );\n      return false;\n    }\n\n    return true;\n  }\n\n  #getPreMutationRow(op: UpsertOp | UpdateOp | DeleteOp) {\n    const {value} = op;\n\n    const primaryKeyValues = this.#getPrimaryKey(op.tableName, value);\n\n    const spec = this.#tableSpecs.get(op.tableName);\n    if (!spec) {\n      throw new Error(`Table ${op.tableName} not found`);\n    }\n\n    const conditions: SQLQuery[] = [];\n    const values: PrimaryKeyValue[] = [];\n    for (const pk in primaryKeyValues) {\n      conditions.push(sql`${sql.ident(pk)}=?`);\n      values.push(v.parse(primaryKeyValues[pk], primaryKeyValueSchema));\n    }\n\n    const ret = this.#statementRunner.get(\n      compile(\n        sql`SELECT ${sql.join(\n          Object.keys(spec.zqlSpec).map(c => sql.ident(c)),\n          sql`,`,\n        )} FROM ${sql.ident(op.tableName)} WHERE ${sql.join(\n          conditions,\n          sql` AND `,\n        )}`,\n      ),\n      ...values,\n    );\n    if (ret === undefined) {\n      return ret;\n    }\n    return fromSQLiteTypes(spec.zqlSpec, ret, op.tableName);\n  }\n\n  #requirePreMutationRow(op: UpdateOp | DeleteOp) {\n    const ret = this.#getPreMutationRow(op);\n    assert(\n      ret !== undefined,\n      () => `Pre-mutation row not found for ${JSON.stringify(op.value)}`,\n    );\n    return ret;\n  }\n\n  async #passesPolicyGroup(\n    applicableRowPolicy: Policy | undefined,\n    applicableCellPolicies: Policy[],\n    authData: JWTPayload | undefined,\n    rowQuery: Query<string, Schema>,\n  ) {\n    if (!(await this.#passesPolicy(applicableRowPolicy, authData, rowQuery))) {\n      return false;\n    }\n\n    for (const policy of applicableCellPolicies) {\n      if (!(await this.#passesPolicy(policy, authData, rowQuery))) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  /**\n   * Defaults to *false* if the policy is empty. At least one rule has to pass\n   * for the policy to pass.\n   */\n  #passesPolicy(\n    policy: Policy | undefined,\n    authData: JWTPayload | undefined,\n    rowQuery: Query<string, Schema>,\n  ): MaybePromise<boolean> {\n    if (policy === undefined) {\n      return false;\n    }\n    if (policy.length === 0) {\n      return false;\n    }\n    let rowQueryAst = asQueryInternals(rowQuery).ast;\n    rowQueryAst = bindStaticParameters(\n      {\n        ...rowQueryAst,\n        where: updateWhere(rowQueryAst.where, policy),\n      },\n      {\n        authData: authData as Record<string, JSONValue>,\n        preMutationRow: undefined,\n      },\n    );\n\n    // call the compiler directly\n    // run the sql against upstream.\n    // remove the collecting into json? just need to know if a row comes back.\n\n    const input = buildPipeline(rowQueryAst, this.#builderDelegate, 'query-id');\n    try {\n      const res = input.fetch({});\n      for (const _ of res) {\n        // if any row is returned at all, the\n        // rule passes.\n        return true;\n      }\n    } finally {\n      input.destroy();\n    }\n\n    // no rows returned by any rules? The policy fails.\n    return false;\n  }\n}\n\nfunction updateWhere(where: Condition | undefined, policy: Policy) {\n  assert(where, 'A where condition must exist for RowQuery');\n\n  return simplifyCondition({\n    type: 'and',\n    conditions: [\n      where,\n      {\n        type: 'or',\n        conditions: policy.map(([action, rule]) => {\n          assert(action);\n          return rule;\n        }),\n      },\n    ],\n  });\n}\n\ntype ActionOpMap = {\n  insert: InsertOp;\n  update: UpdateOp;\n  delete: DeleteOp;\n};\n"],"names":["v.parse"],"mappings":";;;;;;;;;;;;;;;AAoEO,MAAM,oBAA+C;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,8BAAc,IAAA;AAAA,EACd;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,qBAA+C;AAAA,EAE/C,YACE,IACA,QACA,SACA,OACA,MACA,mBACA;AACA,SAAK,SAAS;AACd,SAAK,MAAM,GAAG,YAAY,SAAS,qBAAqB;AACxD,SAAK,aAAa,OAAO;AACzB,SAAK,UAAU,UAAU,KAAK,KAAK,OAAO;AAC1C,SAAK,WAAW;AAChB,SAAK,aAAa,kBAAkB,yBAAyB,IAAI;AACjE,SAAK,mBAAmB;AAAA,MACtB,WAAW,CAAA,SAAQ,KAAK,WAAW,IAAI;AAAA,MACvC,eAAe,MAAM,KAAK,WAAW,cAAA;AAAA,MACrC,qBAAqB,CAAA,UAAS;AAAA,MAC9B,eAAe,CAAA,UAAS;AAAA,MACxB,UAAU;AAAA,MAAC;AAAA,MACX,qBAAqB,CAAA,UAAS;AAAA,IAAA;AAEhC,SAAK,cAAc,gBAAgB,KAAK,KAAK,OAAO;AACpD,SAAK,mBAAmB,IAAI,gBAAgB,OAAO;AACnD,SAAK,kBAAA;AAAA,EACP;AAAA,EAEA,oBAAoB;AAClB,SAAK,qBAAqB;AAAA,MACxB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IAAA,EACL;AAAA,EACJ;AAAA,EAEA,UAAU;AACR,SAAK,WAAW,QAAA;AAAA,EAClB;AAAA,EAEA,MAAM,eACJ,UACA,KACA;AACA,eAAW,MAAM,KAAK;AACpB,cAAQ,GAAG,IAAA;AAAA,QACT,KAAK;AAEH;AAAA,QACF,KAAK;AACH,cAAI,CAAE,MAAM,KAAK,WAAW,eAAe,UAAU,EAAE,GAAI;AACzD,mBAAO;AAAA,UACT;AACA;AAAA,QACF,KAAK;AACH,cAAI,CAAE,MAAM,KAAK,WAAW,eAAe,UAAU,EAAE,GAAI;AACzD,mBAAO;AAAA,UACT;AACA;AAAA,MAAA;AAAA,IAEN;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBACJ,UACA,KACA;AACA,SAAK,iBAAiB,gBAAA;AACtB,QAAI;AACF,iBAAW,MAAM,KAAK;AACpB,cAAM,SAAS,KAAK,WAAW,GAAG,SAAS;AAC3C,gBAAQ,GAAG,IAAA;AAAA,UACT,KAAK,UAAU;AACb;AAAA,cACE,OAAO,KAAK;AAAA,gBACV,MAAM;AAAA,gBACN,KAAK,GAAG;AAAA,cAAA,CACT;AAAA,YAAA;AAEH;AAAA,UACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMA,KAAK,UAAU;AACb;AAAA,cACE,OAAO,KAAK;AAAA,gBACV,MAAM;AAAA,gBACN,QAAQ,KAAK,uBAAuB,EAAE;AAAA,gBACtC,KAAK,GAAG;AAAA,cAAA,CACT;AAAA,YAAA;AAEH;AAAA,UACF;AAAA,UACA,KAAK,UAAU;AACb;AAAA,cACE,OAAO,KAAK;AAAA,gBACV,MAAM;AAAA,gBACN,KAAK,KAAK,uBAAuB,EAAE;AAAA,cAAA,CACpC;AAAA,YAAA;AAEH;AAAA,UACF;AAAA,QAAA;AAAA,MAEJ;AAEA,iBAAW,MAAM,KAAK;AACpB,gBAAQ,GAAG,IAAA;AAAA,UACT,KAAK;AACH,gBAAI,CAAE,MAAM,KAAK,WAAW,gBAAgB,UAAU,EAAE,GAAI;AAC1D,qBAAO;AAAA,YACT;AACA;AAAA,UACF,KAAK;AACH,gBAAI,CAAE,MAAM,KAAK,WAAW,gBAAgB,UAAU,EAAE,GAAI;AAC1D,qBAAO;AAAA,YACT;AACA;AAAA,UACF,KAAK;AAEH;AAAA,QAAA;AAAA,MAEN;AAAA,IACF,UAAA;AACE,WAAK,iBAAiB,SAAA;AAAA,IACxB;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,aAAa,KAA4C;AACvD,WAAO,IAAI,IAAI,CAAA,OAAM;AACnB,UAAI,GAAG,OAAO,UAAU;AACtB,cAAM,iBAAiB,KAAK,mBAAmB,EAAE;AACjD,YAAI,gBAAgB;AAClB,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,WAAW,GAAG;AAAA,YACd,YAAY,GAAG;AAAA,YACf,OAAO,GAAG;AAAA,UAAA;AAAA,QAEd;AACA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,WAAW,GAAG;AAAA,UACd,YAAY,GAAG;AAAA,UACf,OAAO,GAAG;AAAA,QAAA;AAAA,MAEd;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,OAAc,UAAkC,IAAc;AACvE,WAAO,KAAK,YAAY,OAAO,UAAU,UAAU,EAAE;AAAA,EACvD;AAAA,EAEA,WAAW,OAAc,UAAkC,IAAc;AACvE,WAAO,KAAK,YAAY,OAAO,UAAU,UAAU,EAAE;AAAA,EACvD;AAAA,EAEA,WAAW,OAAc,UAAkC,IAAc;AACvE,WAAO,KAAK,YAAY,OAAO,UAAU,UAAU,EAAE;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eACE,WACA,SACmC;AACnC,UAAM,YAAY,KAAK,YAAY,IAAI,SAAS;AAChD,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,MAAM,SAAS,SAAS,YAAY;AAAA,IAChD;AACA,UAAM,UAAU,UAAU,UAAU;AAGpC,UAAM,SAA4C,CAAA;AAClD,eAAW,OAAO,SAAS;AACzB,YAAM,MAAM,QAAQ,GAAG;AACvB,UAAI,QAAQ,QAAW;AACrB,cAAM,IAAI;AAAA,UACR,uBAAuB,GAAG,+CAA+C,SAAS;AAAA,QAAA;AAAA,MAEtF;AACA,aAAO,GAAG,IAAI;AAAA,IAChB;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,WAAW,WAAmB;AAC5B,QAAI,SAAS,KAAK,QAAQ,IAAI,SAAS;AACvC,QAAI,QAAQ;AACV,aAAO;AAAA,IACT;AACA,UAAM,YAAY,KAAK,YAAY,IAAI,SAAS;AAChD,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,MAAM,SAAS,SAAS,YAAY;AAAA,IAChD;AACA,UAAM,EAAC,SAAS,WAAA,IAAc,UAAU;AACxC,WAAO,WAAW,MAAM;AACxB,aAAS,IAAI;AAAA,MACX,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA,OAAO;AAAA,QACL,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,EAAC,SAAA,CAAS,MAAM;AAAA,UAClD;AAAA,UACA,gCAAgC,QAAQ;AAAA,QAAA,CACzC;AAAA,MAAA;AAAA,MAEH,CAAC,WAAW,CAAC,GAAG,GAAG,WAAW,MAAM,CAAC,CAAC;AAAA,IAAA;AAExC,SAAK,QAAQ,IAAI,WAAW,MAAM;AAElC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YACJ,OACA,QACA,UACA,IACA;AACA,UAAM,QAAQ,YAAY,IAAA;AAC1B,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,OAAO,OAAO,QAAQ,UAAU,EAAE;AACzD,aAAO;AAAA,IACT,UAAA;AACE,WAAK,IAAI;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB;AAAA,QACA,GAAG;AAAA,QACH;AAAA,QACA,GAAG;AAAA,MAAA;AAAA,IAEP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,OACJ,OACA,QACA,UACA,IACA;AACA,UAAM,QAAQ,KAAK,KAAK,kBAAkB,GAAG,aAAa,SACxD,GAAG,SACL;AACA,UAAM,cAAc,OAAO;AAC3B,QAAI,WAAW,eAAe,KAAK,SAAS,GAAG,SAAS;AAExD,UAAM,mBAAmB,KAAK,eAAe,GAAG,WAAW,GAAG,KAAK;AAEnE,eAAW,MAAM,kBAAkB;AACjC,iBAAW,SAAS,MAAM,IAAI,KAAK,iBAAiB,EAAE,CAAC;AAAA,IACzD;AAEA,QAAI;AACJ,YAAQ,QAAA;AAAA,MACN,KAAK;AACH,YAAI,UAAU,gBAAgB;AAC5B,gCAAsB,aAAa;AAAA,QACrC;AACA;AAAA,MACF,KAAK;AACH,YAAI,UAAU,eAAe;AAC3B,gCAAsB,aAAa,QAAQ;AAAA,QAC7C,WAAW,UAAU,gBAAgB;AACnC,gCAAsB,aAAa,QAAQ;AAAA,QAC7C;AACA;AAAA,MACF,KAAK;AACH,YAAI,UAAU,eAAe;AAC3B,gCAAsB,aAAa;AAAA,QACrC;AACA;AAAA,IAAA;AAGJ,UAAM,eAAe,OAAO;AAC5B,UAAM,yBAAmC,CAAA;AACzC,QAAI,cAAc;AAChB,iBAAW,CAAC,QAAQ,MAAM,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC3D,YAAI,WAAW,YAAY,GAAG,MAAM,MAAM,MAAM,QAAW;AAGzD;AAAA,QACF;AACA,gBAAQ,QAAA;AAAA,UACN,KAAK;AACH,gBAAI,OAAO,UAAU,UAAU,gBAAgB;AAC7C,qCAAuB,KAAK,OAAO,MAAM;AAAA,YAC3C;AACA;AAAA,UACF,KAAK;AACH,gBAAI,UAAU,iBAAiB,OAAO,QAAQ,aAAa;AACzD,qCAAuB,KAAK,OAAO,OAAO,WAAW;AAAA,YACvD;AACA,gBAAI,UAAU,kBAAkB,OAAO,QAAQ,cAAc;AAC3D,qCAAuB,KAAK,OAAO,OAAO,YAAY;AAAA,YACxD;AACA;AAAA,UACF,KAAK;AACH,gBAAI,OAAO,UAAU,UAAU,eAAe;AAC5C,qCAAuB,KAAK,OAAO,MAAM;AAAA,YAC3C;AACA;AAAA,QAAA;AAAA,MAEN;AAAA,IACF;AAEA,QACE,CAAE,MAAM,KAAK;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA,GAEF;AACA,WAAK,IAAI;AAAA,QACP,+BAA+B,KAAK;AAAA,UAClC;AAAA,QAAA,CACD,YAAY,MAAM,WAAW,KAAK,eAAe,KAAK;AAAA,UACrD;AAAA,QAAA,CACD,kBAAkB,KAAK;AAAA,UACtB;AAAA,QAAA,CACD,mBAAmB,KAAK,UAAU,sBAAsB,CAAC;AAAA,MAAA;AAE5D,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,mBAAmB,IAAoC;AACrD,UAAM,EAAC,UAAS;AAEhB,UAAM,mBAAmB,KAAK,eAAe,GAAG,WAAW,KAAK;AAEhE,UAAM,OAAO,KAAK,YAAY,IAAI,GAAG,SAAS;AAC9C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,SAAS,GAAG,SAAS,YAAY;AAAA,IACnD;AAEA,UAAM,aAAyB,CAAA;AAC/B,UAAM,SAA4B,CAAA;AAClC,eAAW,MAAM,kBAAkB;AACjC,iBAAW,KAAK,MAAM,IAAI,MAAM,EAAE,CAAC,IAAI;AACvC,aAAO,KAAKA,MAAQ,iBAAiB,EAAE,GAAG,qBAAqB,CAAC;AAAA,IAClE;AAEA,UAAM,MAAM,KAAK,iBAAiB;AAAA,MAChC;AAAA,QACE,aAAa,IAAI;AAAA,UACf,OAAO,KAAK,KAAK,OAAO,EAAE,IAAI,CAAA,MAAK,IAAI,MAAM,CAAC,CAAC;AAAA,UAC/C;AAAA,QAAA,CACD,SAAS,IAAI,MAAM,GAAG,SAAS,CAAC,UAAU,IAAI;AAAA,UAC7C;AAAA,UACA;AAAA,QAAA,CACD;AAAA,MAAA;AAAA,MAEH,GAAG;AAAA,IAAA;AAEL,QAAI,QAAQ,QAAW;AACrB,aAAO;AAAA,IACT;AACA,WAAO,gBAAgB,KAAK,SAAS,KAAK,GAAG,SAAS;AAAA,EACxD;AAAA,EAEA,uBAAuB,IAAyB;AAC9C,UAAM,MAAM,KAAK,mBAAmB,EAAE;AACtC;AAAA,MACE,QAAQ;AAAA,MACR,MAAM,kCAAkC,KAAK,UAAU,GAAG,KAAK,CAAC;AAAA,IAAA;AAElE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,mBACJ,qBACA,wBACA,UACA,UACA;AACA,QAAI,CAAE,MAAM,KAAK,cAAc,qBAAqB,UAAU,QAAQ,GAAI;AACxE,aAAO;AAAA,IACT;AAEA,eAAW,UAAU,wBAAwB;AAC3C,UAAI,CAAE,MAAM,KAAK,cAAc,QAAQ,UAAU,QAAQ,GAAI;AAC3D,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cACE,QACA,UACA,UACuB;AACvB,QAAI,WAAW,QAAW;AACxB,aAAO;AAAA,IACT;AACA,QAAI,OAAO,WAAW,GAAG;AACvB,aAAO;AAAA,IACT;AACA,QAAI,cAAc,iBAAiB,QAAQ,EAAE;AAC7C,kBAAc;AAAA,MACZ;AAAA,QACE,GAAG;AAAA,QACH,OAAO,YAAY,YAAY,OAAO,MAAM;AAAA,MAAA;AAAA,MAE9C;AAAA,QACE;AAAA,QACA,gBAAgB;AAAA,MAAA;AAAA,IAClB;AAOF,UAAM,QAAQ,cAAc,aAAa,KAAK,kBAAkB,UAAU;AAC1E,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,EAAE;AAC1B,iBAAW,KAAK,KAAK;AAGnB,eAAO;AAAA,MACT;AAAA,IACF,UAAA;AACE,YAAM,QAAA;AAAA,IACR;AAGA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,YAAY,OAA8B,QAAgB;AACjE,SAAO,OAAO,2CAA2C;AAEzD,SAAO,kBAAkB;AAAA,IACvB,MAAM;AAAA,IACN,YAAY;AAAA,MACV;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,YAAY,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,MAAM;AACzC,iBAAO,MAAM;AACb,iBAAO;AAAA,QACT,CAAC;AAAA,MAAA;AAAA,IACH;AAAA,EACF,CACD;AACH;"}