@rocicorp/zero 1.10.0-canary.2 → 1.10.0-canary.20

package/out/shared/src/hash.js

@@ -1,16 +1,111 @@
-import { xxHash32 } from "js-xxhash";
 //#region ../shared/src/hash.ts
-var h32 = (s) => xxHash32(s, 0);
-var h64 = (s) => hash(s, 2);
-var h128 = (s) => hash(s, 4);
+var h32 = (s) => {
+	digest(s, 1);
+	return digests[0];
+};
+var h64 = (s) => wide(s, 2);
+var h128 = (s) => wide(s, 4);
+var PRIME32_1 = 2654435761;
+var PRIME32_2 = 2246822519;
+var PRIME32_3 = 3266489917;
+var PRIME32_4 = 668265263;
+var PRIME32_5 = 374761393;
+var MAX_WORDS = 4;
+var accs = new Int32Array(MAX_WORDS);
+var stripes = new Int32Array(MAX_WORDS * 4);
+var digests = new Uint32Array(MAX_WORDS);
+var encoder;
+function round(acc, lane) {
+	const laneN0 = lane & 65535;
+	const laneN1 = lane >>> 16;
+	acc = acc + (laneN0 * PRIME32_2 + (laneN1 * PRIME32_2 << 16)) & 4294967295;
+	acc = acc << 13 | acc >>> 19;
+	return (acc & 65535) * PRIME32_1 + ((acc >>> 16) * PRIME32_1 << 16) & 4294967295;
+}
+/**
+* xxHash32 over the UTF-8 bytes of `str` under seeds `0..words-1`, leaving the
+* digests in `digests[0..words)`.
+*
+* A seed only changes the initial accumulator values, so every word digests the
+* same input lanes. This walks the bytes once, advancing all `words` sets of
+* accumulators per lane, and UTF-8 encodes the string once. The result is
+* identical to `words` separate `xxHash32(str, i)` calls — which is what this
+* used to delegate to, and what `hash.test.ts` checks it still matches.
+*/
+function digest(str, words) {
+	const b = (encoder ??= new TextEncoder()).encode(str);
+	const len = b.length;
+	for (let w = 0; w < words; w++) accs[w] = w + PRIME32_5 & 4294967295;
+	let offset = 0;
+	if (len >= 16) {
+		for (let w = 0; w < words; w++) {
+			const base = w << 2;
+			stripes[base] = w + PRIME32_1 + PRIME32_2 & 4294967295;
+			stripes[base + 1] = w + PRIME32_2 & 4294967295;
+			stripes[base + 2] = w;
+			stripes[base + 3] = w - PRIME32_1 & 4294967295;
+		}
+		const limit = len - 16;
+		for (; offset <= limit; offset += 16) {
+			const l0 = b[offset] | b[offset + 1] << 8 | b[offset + 2] << 16 | b[offset + 3] << 24;
+			const l1 = b[offset + 4] | b[offset + 5] << 8 | b[offset + 6] << 16 | b[offset + 7] << 24;
+			const l2 = b[offset + 8] | b[offset + 9] << 8 | b[offset + 10] << 16 | b[offset + 11] << 24;
+			const l3 = b[offset + 12] | b[offset + 13] << 8 | b[offset + 14] << 16 | b[offset + 15] << 24;
+			for (let w = 0; w < words; w++) {
+				const base = w << 2;
+				stripes[base] = round(stripes[base], l0);
+				stripes[base + 1] = round(stripes[base + 1], l1);
+				stripes[base + 2] = round(stripes[base + 2], l2);
+				stripes[base + 3] = round(stripes[base + 3], l3);
+			}
+		}
+		for (let w = 0; w < words; w++) {
+			const base = w << 2;
+			const s0 = stripes[base];
+			const s1 = stripes[base + 1];
+			const s2 = stripes[base + 2];
+			const s3 = stripes[base + 3];
+			accs[w] = (s0 << 1 | s0 >>> 31) + (s1 << 7 | s1 >>> 25) + (s2 << 12 | s2 >>> 20) + (s3 << 18 | s3 >>> 14) & 4294967295;
+		}
+	}
+	for (let w = 0; w < words; w++) accs[w] = accs[w] + len & 4294967295;
+	const limit4 = len - 4;
+	for (; offset <= limit4; offset += 4) {
+		const laneN0 = b[offset] + (b[offset + 1] << 8);
+		const laneN1 = b[offset + 2] + (b[offset + 3] << 8);
+		const laneP = laneN0 * PRIME32_3 + (laneN1 * PRIME32_3 << 16);
+		for (let w = 0; w < words; w++) {
+			let acc = accs[w] + laneP & 4294967295;
+			acc = acc << 17 | acc >>> 15;
+			accs[w] = (acc & 65535) * PRIME32_4 + ((acc >>> 16) * PRIME32_4 << 16) & 4294967295;
+		}
+	}
+	for (; offset < len; ++offset) {
+		const lane = b[offset];
+		for (let w = 0; w < words; w++) {
+			let acc = accs[w] + lane * PRIME32_5;
+			acc = acc << 11 | acc >>> 21;
+			accs[w] = (acc & 65535) * PRIME32_1 + ((acc >>> 16) * PRIME32_1 << 16) & 4294967295;
+		}
+	}
+	for (let w = 0; w < words; w++) {
+		let acc = accs[w];
+		acc = acc ^ acc >>> 15;
+		acc = ((acc & 65535) * PRIME32_2 & 4294967295) + ((acc >>> 16) * PRIME32_2 << 16);
+		acc = acc ^ acc >>> 13;
+		acc = ((acc & 65535) * PRIME32_3 & 4294967295) + ((acc >>> 16) * PRIME32_3 << 16);
+		digests[w] = acc ^ acc >>> 16;
+	}
+}
 /**
-* xxHash32 only computes 32-bit values. Run it n times with different seeds to
-* get a larger hash with better collision resistance.
+* A hash wider than 32 bits, folding `words` digests together highest seed
+* first.
 */
-function hash(str, words) {
-	let hash = 0n;
-	for (let i = 0; i < words; i++) hash = (hash << 32n) + BigInt(xxHash32(str, i));
-	return hash;
+function wide(str, words) {
+	digest(str, words);
+	let result = 0n;
+	for (let w = 0; w < words; w++) result = (result << 32n) + BigInt(digests[w]);
+	return result;
 }
 //#endregion
 export { h128, h32, h64 };

package/out/shared/src/hash.js.map

@@ -1 +1 @@
-{"version":3,"file":"hash.js","names":[],"sources":["../../../../shared/src/hash.ts"],"sourcesContent":["import {xxHash32} from 'js-xxhash';\n\nexport const h32 = (s: string) => xxHash32(s, 0);\nexport const h64 = (s: string) => hash(s, 2);\nexport const h128 = (s: string) => hash(s, 4);\n\n/**\n * xxHash32 only computes 32-bit values. Run it n times with different seeds to\n * get a larger hash with better collision resistance.\n */\nfunction hash(str: string, words: number): bigint {\n  let hash = 0n;\n  for (let i = 0; i < words; i++) {\n    hash = (hash << 32n) + BigInt(xxHash32(str, i));\n  }\n  return hash;\n}\n"],"mappings":";;AAEA,IAAa,OAAO,MAAc,SAAS,GAAG,CAAC;AAC/C,IAAa,OAAO,MAAc,KAAK,GAAG,CAAC;AAC3C,IAAa,QAAQ,MAAc,KAAK,GAAG,CAAC;;;;;AAM5C,SAAS,KAAK,KAAa,OAAuB;CAChD,IAAI,OAAO;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,KACzB,QAAQ,QAAQ,OAAO,OAAO,SAAS,KAAK,CAAC,CAAC;CAEhD,OAAO;AACT"}
+{"version":3,"file":"hash.js","names":[],"sources":["../../../../shared/src/hash.ts"],"sourcesContent":["export const h32 = (s: string) => {\n  digest(s, 1);\n  return digests[0];\n};\nexport const h64 = (s: string) => wide(s, 2);\nexport const h128 = (s: string) => wide(s, 4);\n\nconst PRIME32_1 = 2654435761;\nconst PRIME32_2 = 2246822519;\nconst PRIME32_3 = 3266489917;\nconst PRIME32_4 = 668265263;\nconst PRIME32_5 = 374761393;\n\nconst MAX_WORDS = 4;\n\n// `digest` is synchronous and does not recurse, so these can be reused across\n// calls instead of allocated per call.\nconst accs = new Int32Array(MAX_WORDS);\nconst stripes = new Int32Array(MAX_WORDS * 4);\nconst digests = new Uint32Array(MAX_WORDS);\nlet encoder: TextEncoder | undefined;\n\nfunction round(acc: number, lane: number): number {\n  const laneN0 = lane & 0xffff;\n  const laneN1 = lane >>> 16;\n  acc =\n    (acc + (laneN0 * PRIME32_2 + ((laneN1 * PRIME32_2) << 16))) & 0xffffffff;\n  acc = (acc << 13) | (acc >>> 19);\n  return (\n    ((acc & 0xffff) * PRIME32_1 + (((acc >>> 16) * PRIME32_1) << 16)) &\n    0xffffffff\n  );\n}\n\n/**\n * xxHash32 over the UTF-8 bytes of `str` under seeds `0..words-1`, leaving the\n * digests in `digests[0..words)`.\n *\n * A seed only changes the initial accumulator values, so every word digests the\n * same input lanes. This walks the bytes once, advancing all `words` sets of\n * accumulators per lane, and UTF-8 encodes the string once. The result is\n * identical to `words` separate `xxHash32(str, i)` calls — which is what this\n * used to delegate to, and what `hash.test.ts` checks it still matches.\n */\nfunction digest(str: string, words: number): void {\n  const b = (encoder ??= new TextEncoder()).encode(str);\n  const len = b.length;\n\n  for (let w = 0; w < words; w++) {\n    accs[w] = (w + PRIME32_5) & 0xffffffff;\n  }\n\n  let offset = 0;\n\n  /*\n      Step 2. Process stripes\n      A stripe is a contiguous segment of 16 bytes, evenly divided into 4 lanes\n      of 4 bytes each, each lane updating its own accumulator. Inputs shorter\n      than a stripe skip straight to step 4 with a single accumulator.\n  */\n  if (len >= 16) {\n    for (let w = 0; w < words; w++) {\n      const base = w << 2;\n      stripes[base] = (w + PRIME32_1 + PRIME32_2) & 0xffffffff;\n      stripes[base + 1] = (w + PRIME32_2) & 0xffffffff;\n      stripes[base + 2] = w;\n      stripes[base + 3] = (w - PRIME32_1) & 0xffffffff;\n    }\n\n    const limit = len - 16;\n    for (; offset <= limit; offset += 16) {\n      const l0 =\n        b[offset] |\n        (b[offset + 1] << 8) |\n        (b[offset + 2] << 16) |\n        (b[offset + 3] << 24);\n      const l1 =\n        b[offset + 4] |\n        (b[offset + 5] << 8) |\n        (b[offset + 6] << 16) |\n        (b[offset + 7] << 24);\n      const l2 =\n        b[offset + 8] |\n        (b[offset + 9] << 8) |\n        (b[offset + 10] << 16) |\n        (b[offset + 11] << 24);\n      const l3 =\n        b[offset + 12] |\n        (b[offset + 13] << 8) |\n        (b[offset + 14] << 16) |\n        (b[offset + 15] << 24);\n      for (let w = 0; w < words; w++) {\n        const base = w << 2;\n        stripes[base] = round(stripes[base], l0);\n        stripes[base + 1] = round(stripes[base + 1], l1);\n        stripes[base + 2] = round(stripes[base + 2], l2);\n        stripes[base + 3] = round(stripes[base + 3], l3);\n      }\n    }\n\n    /*\n        Step 3. Accumulator convergence\n        acc = (acc1 <<< 1) + (acc2 <<< 7) + (acc3 <<< 12) + (acc4 <<< 18);\n    */\n    for (let w = 0; w < words; w++) {\n      const base = w << 2;\n      const s0 = stripes[base];\n      const s1 = stripes[base + 1];\n      const s2 = stripes[base + 2];\n      const s3 = stripes[base + 3];\n      accs[w] =\n        (((s0 << 1) | (s0 >>> 31)) +\n          ((s1 << 7) | (s1 >>> 25)) +\n          ((s2 << 12) | (s2 >>> 20)) +\n          ((s3 << 18) | (s3 >>> 14))) &\n        0xffffffff;\n    }\n  }\n\n  // Step 4. Add input length.\n  for (let w = 0; w < words; w++) {\n    accs[w] = (accs[w] + len) & 0xffffffff;\n  }\n\n  // Step 5. Consume the remaining input, 4 bytes at a time and then 1 at a time.\n  const limit4 = len - 4;\n  for (; offset <= limit4; offset += 4) {\n    const laneN0 = b[offset] + (b[offset + 1] << 8);\n    const laneN1 = b[offset + 2] + (b[offset + 3] << 8);\n    const laneP = laneN0 * PRIME32_3 + ((laneN1 * PRIME32_3) << 16);\n    for (let w = 0; w < words; w++) {\n      let acc = (accs[w] + laneP) & 0xffffffff;\n      acc = (acc << 17) | (acc >>> 15);\n      accs[w] =\n        ((acc & 0xffff) * PRIME32_4 + (((acc >>> 16) * PRIME32_4) << 16)) &\n        0xffffffff;\n    }\n  }\n\n  for (; offset < len; ++offset) {\n    const lane = b[offset];\n    for (let w = 0; w < words; w++) {\n      let acc = accs[w] + lane * PRIME32_5;\n      acc = (acc << 11) | (acc >>> 21);\n      accs[w] =\n        ((acc & 0xffff) * PRIME32_1 + (((acc >>> 16) * PRIME32_1) << 16)) &\n        0xffffffff;\n    }\n  }\n\n  // Step 6. Final mix (avalanche). The Uint32Array store turns any negatives\n  // back into a positive number.\n  for (let w = 0; w < words; w++) {\n    let acc = accs[w];\n    acc = acc ^ (acc >>> 15);\n    acc =\n      (((acc & 0xffff) * PRIME32_2) & 0xffffffff) +\n      (((acc >>> 16) * PRIME32_2) << 16);\n    acc = acc ^ (acc >>> 13);\n    acc =\n      (((acc & 0xffff) * PRIME32_3) & 0xffffffff) +\n      (((acc >>> 16) * PRIME32_3) << 16);\n    digests[w] = acc ^ (acc >>> 16);\n  }\n}\n\n/**\n * A hash wider than 32 bits, folding `words` digests together highest seed\n * first.\n */\nfunction wide(str: string, words: number): bigint {\n  digest(str, words);\n  let result = 0n;\n  for (let w = 0; w < words; w++) {\n    result = (result << 32n) + BigInt(digests[w]);\n  }\n  return result;\n}\n"],"mappings":";AAAA,IAAa,OAAO,MAAc;CAChC,OAAO,GAAG,CAAC;CACX,OAAO,QAAQ;AACjB;AACA,IAAa,OAAO,MAAc,KAAK,GAAG,CAAC;AAC3C,IAAa,QAAQ,MAAc,KAAK,GAAG,CAAC;AAE5C,IAAM,YAAY;AAClB,IAAM,YAAY;AAClB,IAAM,YAAY;AAClB,IAAM,YAAY;AAClB,IAAM,YAAY;AAElB,IAAM,YAAY;AAIlB,IAAM,OAAO,IAAI,WAAW,SAAS;AACrC,IAAM,UAAU,IAAI,WAAW,YAAY,CAAC;AAC5C,IAAM,UAAU,IAAI,YAAY,SAAS;AACzC,IAAI;AAEJ,SAAS,MAAM,KAAa,MAAsB;CAChD,MAAM,SAAS,OAAO;CACtB,MAAM,SAAS,SAAS;CACxB,MACG,OAAO,SAAS,aAAc,SAAS,aAAc,OAAQ;CAChE,MAAO,OAAO,KAAO,QAAQ;CAC7B,QACI,MAAM,SAAU,cAAe,QAAQ,MAAM,aAAc,MAC7D;AAEJ;;;;;;;;;;;AAYA,SAAS,OAAO,KAAa,OAAqB;CAChD,MAAM,KAAK,YAAY,IAAI,YAAY,GAAG,OAAO,GAAG;CACpD,MAAM,MAAM,EAAE;CAEd,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,KACzB,KAAK,KAAM,IAAI,YAAa;CAG9B,IAAI,SAAS;CAQb,IAAI,OAAO,IAAI;EACb,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,KAAK;GAC9B,MAAM,OAAO,KAAK;GAClB,QAAQ,QAAS,IAAI,YAAY,YAAa;GAC9C,QAAQ,OAAO,KAAM,IAAI,YAAa;GACtC,QAAQ,OAAO,KAAK;GACpB,QAAQ,OAAO,KAAM,IAAI,YAAa;EACxC;EAEA,MAAM,QAAQ,MAAM;EACpB,OAAO,UAAU,OAAO,UAAU,IAAI;GACpC,MAAM,KACJ,EAAE,UACD,EAAE,SAAS,MAAM,IACjB,EAAE,SAAS,MAAM,KACjB,EAAE,SAAS,MAAM;GACpB,MAAM,KACJ,EAAE,SAAS,KACV,EAAE,SAAS,MAAM,IACjB,EAAE,SAAS,MAAM,KACjB,EAAE,SAAS,MAAM;GACpB,MAAM,KACJ,EAAE,SAAS,KACV,EAAE,SAAS,MAAM,IACjB,EAAE,SAAS,OAAO,KAClB,EAAE,SAAS,OAAO;GACrB,MAAM,KACJ,EAAE,SAAS,MACV,EAAE,SAAS,OAAO,IAClB,EAAE,SAAS,OAAO,KAClB,EAAE,SAAS,OAAO;GACrB,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,KAAK;IAC9B,MAAM,OAAO,KAAK;IAClB,QAAQ,QAAQ,MAAM,QAAQ,OAAO,EAAE;IACvC,QAAQ,OAAO,KAAK,MAAM,QAAQ,OAAO,IAAI,EAAE;IAC/C,QAAQ,OAAO,KAAK,MAAM,QAAQ,OAAO,IAAI,EAAE;IAC/C,QAAQ,OAAO,KAAK,MAAM,QAAQ,OAAO,IAAI,EAAE;GACjD;EACF;EAMA,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,KAAK;GAC9B,MAAM,OAAO,KAAK;GAClB,MAAM,KAAK,QAAQ;GACnB,MAAM,KAAK,QAAQ,OAAO;GAC1B,MAAM,KAAK,QAAQ,OAAO;GAC1B,MAAM,KAAK,QAAQ,OAAO;GAC1B,KAAK,MACA,MAAM,IAAM,OAAO,OAClB,MAAM,IAAM,OAAO,OACnB,MAAM,KAAO,OAAO,OACpB,MAAM,KAAO,OAAO,MACxB;EACJ;CACF;CAGA,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,KACzB,KAAK,KAAM,KAAK,KAAK,MAAO;CAI9B,MAAM,SAAS,MAAM;CACrB,OAAO,UAAU,QAAQ,UAAU,GAAG;EACpC,MAAM,SAAS,EAAE,WAAW,EAAE,SAAS,MAAM;EAC7C,MAAM,SAAS,EAAE,SAAS,MAAM,EAAE,SAAS,MAAM;EACjD,MAAM,QAAQ,SAAS,aAAc,SAAS,aAAc;EAC5D,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,KAAK;GAC9B,IAAI,MAAO,KAAK,KAAK,QAAS;GAC9B,MAAO,OAAO,KAAO,QAAQ;GAC7B,KAAK,MACD,MAAM,SAAU,cAAe,QAAQ,MAAM,aAAc,MAC7D;EACJ;CACF;CAEA,OAAO,SAAS,KAAK,EAAE,QAAQ;EAC7B,MAAM,OAAO,EAAE;EACf,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,KAAK;GAC9B,IAAI,MAAM,KAAK,KAAK,OAAO;GAC3B,MAAO,OAAO,KAAO,QAAQ;GAC7B,KAAK,MACD,MAAM,SAAU,cAAe,QAAQ,MAAM,aAAc,MAC7D;EACJ;CACF;CAIA,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,KAAK;EAC9B,IAAI,MAAM,KAAK;EACf,MAAM,MAAO,QAAQ;EACrB,QACK,MAAM,SAAU,YAAa,gBAC7B,QAAQ,MAAM,aAAc;EACjC,MAAM,MAAO,QAAQ;EACrB,QACK,MAAM,SAAU,YAAa,gBAC7B,QAAQ,MAAM,aAAc;EACjC,QAAQ,KAAK,MAAO,QAAQ;CAC9B;AACF;;;;;AAMA,SAAS,KAAK,KAAa,OAAuB;CAChD,OAAO,KAAK,KAAK;CACjB,IAAI,SAAS;CACb,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,KACzB,UAAU,UAAU,OAAO,OAAO,QAAQ,EAAE;CAE9C,OAAO;AACT"}

package/out/shared/src/map.d.ts

@@ -1,5 +1,10 @@
-declare function getOrInsertNative<K, V>(map: Map<K, V>, key: K, defaultValue: V): V;
-declare function getOrInsertComputedNative<K, V>(map: Map<K, V>, key: K, compute: (key: K) => V): V;
+/**
+ * A value that {@link Map.get} can distinguish from a missing entry.  `undefined`
+ * is excluded because these helpers use `get() !== undefined` to detect absence.
+ */
+type Defined = {} | null;
+declare function getOrInsertNative<K, V extends Defined>(map: Map<K, V>, key: K, defaultValue: V): V;
+declare function getOrInsertComputedNative<K, V extends Defined>(map: Map<K, V>, key: K, compute: (key: K) => V): V;
 export declare const getOrInsert: typeof getOrInsertNative;
 export declare const getOrInsertComputed: typeof getOrInsertComputedNative;
 export {};

package/out/shared/src/map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"map.d.ts","sourceRoot":"","sources":["../../../../shared/src/map.ts"],"names":[],"mappings":"AA4CA,iBAAS,iBAAiB,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,CAE3E;AAED,iBAAS,yBAAyB,CAAC,CAAC,EAAE,CAAC,EACrC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EACd,GAAG,EAAE,CAAC,EACN,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GACrB,CAAC,CAEH;AAED,eAAO,MAAM,WAAW,0BAED,CAAC;AAExB,eAAO,MAAM,mBAAmB,kCAED,CAAC"}
+{"version":3,"file":"map.d.ts","sourceRoot":"","sources":["../../../../shared/src/map.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,KAAK,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC;AAkDzB,iBAAS,iBAAiB,CAAC,CAAC,EAAE,CAAC,SAAS,OAAO,EAC7C,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EACd,GAAG,EAAE,CAAC,EACN,YAAY,EAAE,CAAC,GACd,CAAC,CAEH;AAED,iBAAS,yBAAyB,CAAC,CAAC,EAAE,CAAC,SAAS,OAAO,EACrD,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EACd,GAAG,EAAE,CAAC,EACN,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GACrB,CAAC,CAEH;AAED,eAAO,MAAM,WAAW,0BAED,CAAC;AAExB,eAAO,MAAM,mBAAmB,kCAED,CAAC"}

package/out/shared/src/map.js.map

@@ -1 +1 @@
-{"version":3,"file":"map.js","names":[],"sources":["../../../../shared/src/map.ts"],"sourcesContent":["const nativeSupport =\n  typeof (Map.prototype as unknown as MapES2026<unknown, unknown>)\n    .getOrInsert === 'function';\n\ninterface MapES2026<K, V> {\n  getOrInsert(key: K, defaultValue: V): V;\n  getOrInsertComputed(key: K, compute: (key: K) => V): V;\n}\n\n/**\n * Returns the value for {@link key} in {@link map}.  If no mapping exists,\n * inserts {@link defaultValue} and returns it.\n *\n * Mirrors the ES2026 `Map.prototype.getOrInsert` proposal.\n */\nfunction getOrInsertPolyfill<K, V>(map: Map<K, V>, key: K, defaultValue: V): V {\n  const existing = map.get(key);\n  if (existing !== undefined) {\n    return existing;\n  }\n  map.set(key, defaultValue);\n  return defaultValue;\n}\n\n/**\n * Returns the value for {@link key} in {@link map}.  If no mapping exists,\n * calls {@link compute} with the key, inserts the result, and returns it.\n *\n * Mirrors the ES2026 `Map.prototype.getOrInsertComputed` proposal.\n */\nfunction getOrInsertComputedPolyfill<K, V>(\n  map: Map<K, V>,\n  key: K,\n  compute: (key: K) => V,\n): V {\n  const existing = map.get(key);\n  if (existing !== undefined) {\n    return existing;\n  }\n  const value = compute(key);\n  map.set(key, value);\n  return value;\n}\n\nfunction getOrInsertNative<K, V>(map: Map<K, V>, key: K, defaultValue: V): V {\n  return (map as unknown as MapES2026<K, V>).getOrInsert(key, defaultValue);\n}\n\nfunction getOrInsertComputedNative<K, V>(\n  map: Map<K, V>,\n  key: K,\n  compute: (key: K) => V,\n): V {\n  return (map as unknown as MapES2026<K, V>).getOrInsertComputed(key, compute);\n}\n\nexport const getOrInsert = nativeSupport\n  ? getOrInsertNative\n  : getOrInsertPolyfill;\n\nexport const getOrInsertComputed = nativeSupport\n  ? getOrInsertComputedNative\n  : getOrInsertComputedPolyfill;\n"],"mappings":";AAAA,IAAM,gBACJ,OAAQ,IAAI,UACT,gBAAgB;;;;;;;AAarB,SAAS,oBAA0B,KAAgB,KAAQ,cAAoB;CAC7E,MAAM,WAAW,IAAI,IAAI,GAAG;CAC5B,IAAI,aAAa,KAAA,GACf,OAAO;CAET,IAAI,IAAI,KAAK,YAAY;CACzB,OAAO;AACT;;;;;;;AAQA,SAAS,4BACP,KACA,KACA,SACG;CACH,MAAM,WAAW,IAAI,IAAI,GAAG;CAC5B,IAAI,aAAa,KAAA,GACf,OAAO;CAET,MAAM,QAAQ,QAAQ,GAAG;CACzB,IAAI,IAAI,KAAK,KAAK;CAClB,OAAO;AACT;AAEA,SAAS,kBAAwB,KAAgB,KAAQ,cAAoB;CAC3E,OAAQ,IAAmC,YAAY,KAAK,YAAY;AAC1E;AAEA,SAAS,0BACP,KACA,KACA,SACG;CACH,OAAQ,IAAmC,oBAAoB,KAAK,OAAO;AAC7E;AAEA,IAAa,cAAc,gBACvB,oBACA;AAEJ,IAAa,sBAAsB,gBAC/B,4BACA"}
+{"version":3,"file":"map.js","names":[],"sources":["../../../../shared/src/map.ts"],"sourcesContent":["/**\n * A value that {@link Map.get} can distinguish from a missing entry.  `undefined`\n * is excluded because these helpers use `get() !== undefined` to detect absence.\n */\ntype Defined = {} | null;\n\nconst nativeSupport =\n  typeof (Map.prototype as unknown as MapES2026<unknown, Defined>)\n    .getOrInsert === 'function';\n\ninterface MapES2026<K, V> {\n  getOrInsert(key: K, defaultValue: V): V;\n  getOrInsertComputed(key: K, compute: (key: K) => V): V;\n}\n\n/**\n * Returns the value for {@link key} in {@link map}.  If no mapping exists,\n * inserts {@link defaultValue} and returns it.\n *\n * Mirrors the ES2026 `Map.prototype.getOrInsert` proposal.\n */\nfunction getOrInsertPolyfill<K, V extends Defined>(\n  map: Map<K, V>,\n  key: K,\n  defaultValue: V,\n): V {\n  const existing = map.get(key);\n  if (existing !== undefined) {\n    return existing;\n  }\n  map.set(key, defaultValue);\n  return defaultValue;\n}\n\n/**\n * Returns the value for {@link key} in {@link map}.  If no mapping exists,\n * calls {@link compute} with the key, inserts the result, and returns it.\n *\n * Mirrors the ES2026 `Map.prototype.getOrInsertComputed` proposal.\n */\nfunction getOrInsertComputedPolyfill<K, V extends Defined>(\n  map: Map<K, V>,\n  key: K,\n  compute: (key: K) => V,\n): V {\n  const existing = map.get(key);\n  if (existing !== undefined) {\n    return existing;\n  }\n  const value = compute(key);\n  map.set(key, value);\n  return value;\n}\n\nfunction getOrInsertNative<K, V extends Defined>(\n  map: Map<K, V>,\n  key: K,\n  defaultValue: V,\n): V {\n  return (map as unknown as MapES2026<K, V>).getOrInsert(key, defaultValue);\n}\n\nfunction getOrInsertComputedNative<K, V extends Defined>(\n  map: Map<K, V>,\n  key: K,\n  compute: (key: K) => V,\n): V {\n  return (map as unknown as MapES2026<K, V>).getOrInsertComputed(key, compute);\n}\n\nexport const getOrInsert = nativeSupport\n  ? getOrInsertNative\n  : getOrInsertPolyfill;\n\nexport const getOrInsertComputed = nativeSupport\n  ? getOrInsertComputedNative\n  : getOrInsertComputedPolyfill;\n"],"mappings":";AAMA,IAAM,gBACJ,OAAQ,IAAI,UACT,gBAAgB;;;;;;;AAarB,SAAS,oBACP,KACA,KACA,cACG;CACH,MAAM,WAAW,IAAI,IAAI,GAAG;CAC5B,IAAI,aAAa,KAAA,GACf,OAAO;CAET,IAAI,IAAI,KAAK,YAAY;CACzB,OAAO;AACT;;;;;;;AAQA,SAAS,4BACP,KACA,KACA,SACG;CACH,MAAM,WAAW,IAAI,IAAI,GAAG;CAC5B,IAAI,aAAa,KAAA,GACf,OAAO;CAET,MAAM,QAAQ,QAAQ,GAAG;CACzB,IAAI,IAAI,KAAK,KAAK;CAClB,OAAO;AACT;AAEA,SAAS,kBACP,KACA,KACA,cACG;CACH,OAAQ,IAAmC,YAAY,KAAK,YAAY;AAC1E;AAEA,SAAS,0BACP,KACA,KACA,SACG;CACH,OAAQ,IAAmC,oBAAoB,KAAK,OAAO;AAC7E;AAEA,IAAa,cAAc,gBACvB,oBACA;AAEJ,IAAa,sBAAsB,gBAC/B,4BACA"}

package/out/shared/src/promise-race.d.ts

@@ -13,5 +13,19 @@ type PromiseRaceResult<T extends Record<string, PromiseLike<unknown>>> = {
  * @throws An error if the record is empty or if a promise is rejected.
  */
 export declare function promiseRace<T extends Record<string, PromiseLike<unknown>>>(promises: T): Promise<PromiseRaceResult<T> & {}>;
+/**
+ * A memory-safe way to race a short-lived `Promise` with one or more
+ * long-leved `AbortSignal`s. This works around the unsafe practice
+ * of racing a short-lived promise (e.g. in a loop) with a long-lived one,
+ * which results in accumulating memory via `then` callbacks on the latter:
+ *
+ * https://github.com/nodejs/node/issues/17469
+ *
+ * The safe way to race a short-lived, expected-to-complete Promise against a
+ * long-lived termination signal is to control the latter via an
+ * {@link AbortController} and race the former against the signal of the
+ * latter.
+ */
+export declare function promiseOrAbort<T>(shortLived: Promise<T>, ...longLived: AbortSignal[]): Promise<T>;
 export {};
 //# sourceMappingURL=promise-race.d.ts.map

package/out/shared/src/promise-race.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"promise-race.d.ts","sourceRoot":"","sources":["../../../../shared/src/promise-race.ts"],"names":[],"mappings":"AAAA,KAAK,iBAAiB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI;KACtE,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG;QAC/B,GAAG,EAAE,CAAC,CAAC;QACP,MAAM,EAAE,WAAW,CAAC;QACpB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvB;CACF,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAc5B;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,EAC9C,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAYjD"}
+{"version":3,"file":"promise-race.d.ts","sourceRoot":"","sources":["../../../../shared/src/promise-race.ts"],"names":[],"mappings":"AAEA,KAAK,iBAAiB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI;KACtE,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG;QAC/B,GAAG,EAAE,CAAC,CAAC;QACP,MAAM,EAAE,WAAW,CAAC;QACpB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvB;CACF,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAc5B;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,EAC9C,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAYjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,CAAC,EACpC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,EACtB,GAAG,SAAS,EAAE,WAAW,EAAE,GAC1B,OAAO,CAAC,CAAC,CAAC,CAoBZ"}

package/out/shared/src/promise-race.js

@@ -1,3 +1,4 @@
+import { resolver } from "@rocicorp/resolver";
 //#region ../shared/src/promise-race.ts
 var NO_PROMISES_MESSAGE = "No promises to race";
 var wrapPromise = (key, promise) => Promise.resolve(promise).then((result) => ({
@@ -18,7 +19,37 @@ async function promiseRace(promises) {
 	const wrapped = keys.map((key) => wrapPromise(key, promises[key]));
 	return await Promise.race(wrapped);
 }
+/**
+* A memory-safe way to race a short-lived `Promise` with one or more
+* long-leved `AbortSignal`s. This works around the unsafe practice
+* of racing a short-lived promise (e.g. in a loop) with a long-lived one,
+* which results in accumulating memory via `then` callbacks on the latter:
+*
+* https://github.com/nodejs/node/issues/17469
+*
+* The safe way to race a short-lived, expected-to-complete Promise against a
+* long-lived termination signal is to control the latter via an
+* {@link AbortController} and race the former against the signal of the
+* latter.
+*/
+async function promiseOrAbort(shortLived, ...longLived) {
+	const promises = [];
+	const cleanup = [];
+	for (const signal of longLived) if (signal.aborted) promises.push(Promise.reject(signal.reason));
+	else {
+		const { promise, reject } = resolver();
+		const handler = () => reject(signal.reason);
+		signal.addEventListener("abort", handler);
+		cleanup.push(() => signal.removeEventListener("abort", handler));
+		promises.push(promise);
+	}
+	try {
+		return await Promise.race([shortLived, ...promises]);
+	} finally {
+		cleanup.forEach((fn) => fn());
+	}
+}
 //#endregion
-export { promiseRace };
+export { promiseOrAbort, promiseRace };
 
 //# sourceMappingURL=promise-race.js.map

package/out/shared/src/promise-race.js.map

@@ -1 +1 @@
-{"version":3,"file":"promise-race.js","names":[],"sources":["../../../../shared/src/promise-race.ts"],"sourcesContent":["type PromiseRaceResult<T extends Record<string, PromiseLike<unknown>>> = {\n  [K in Extract<keyof T, string>]: {\n    key: K;\n    status: 'fulfilled';\n    result: Awaited<T[K]>;\n  };\n}[Extract<keyof T, string>];\n\nconst NO_PROMISES_MESSAGE = 'No promises to race';\n\nconst wrapPromise = <K extends string, V>(\n  key: K,\n  promise: PromiseLike<V>,\n): Promise<{key: K; status: 'fulfilled'; result: V}> =>\n  Promise.resolve(promise).then(result => ({\n    key,\n    status: 'fulfilled' as const,\n    result,\n  }));\n\n/**\n * Race a record of promises and resolve with the first resolved entry.\n *\n * @param promises Record of promises to race.\n * @returns Promise resolving to a discriminated union of key/result pairs.\n * @throws An error if the record is empty or if a promise is rejected.\n */\nexport async function promiseRace<\n  T extends Record<string, PromiseLike<unknown>>,\n>(promises: T): Promise<PromiseRaceResult<T> & {}> {\n  const keys = Object.keys(promises) as Array<Extract<keyof T, string>>;\n\n  if (keys.length === 0) {\n    throw new Error(NO_PROMISES_MESSAGE);\n  }\n\n  const wrapped = keys.map(key =>\n    wrapPromise(key, promises[key] as PromiseLike<Awaited<T[typeof key]>>),\n  );\n\n  return await Promise.race(wrapped);\n}\n"],"mappings":";AAQA,IAAM,sBAAsB;AAE5B,IAAM,eACJ,KACA,YAEA,QAAQ,QAAQ,OAAO,EAAE,MAAK,YAAW;CACvC;CACA,QAAQ;CACR;AACF,EAAE;;;;;;;;AASJ,eAAsB,YAEpB,UAAiD;CACjD,MAAM,OAAO,OAAO,KAAK,QAAQ;CAEjC,IAAI,KAAK,WAAW,GAClB,MAAM,IAAI,MAAM,mBAAmB;CAGrC,MAAM,UAAU,KAAK,KAAI,QACvB,YAAY,KAAK,SAAS,IAA2C,CACvE;CAEA,OAAO,MAAM,QAAQ,KAAK,OAAO;AACnC"}
+{"version":3,"file":"promise-race.js","names":[],"sources":["../../../../shared/src/promise-race.ts"],"sourcesContent":["import {resolver} from '@rocicorp/resolver';\n\ntype PromiseRaceResult<T extends Record<string, PromiseLike<unknown>>> = {\n  [K in Extract<keyof T, string>]: {\n    key: K;\n    status: 'fulfilled';\n    result: Awaited<T[K]>;\n  };\n}[Extract<keyof T, string>];\n\nconst NO_PROMISES_MESSAGE = 'No promises to race';\n\nconst wrapPromise = <K extends string, V>(\n  key: K,\n  promise: PromiseLike<V>,\n): Promise<{key: K; status: 'fulfilled'; result: V}> =>\n  Promise.resolve(promise).then(result => ({\n    key,\n    status: 'fulfilled' as const,\n    result,\n  }));\n\n/**\n * Race a record of promises and resolve with the first resolved entry.\n *\n * @param promises Record of promises to race.\n * @returns Promise resolving to a discriminated union of key/result pairs.\n * @throws An error if the record is empty or if a promise is rejected.\n */\nexport async function promiseRace<\n  T extends Record<string, PromiseLike<unknown>>,\n>(promises: T): Promise<PromiseRaceResult<T> & {}> {\n  const keys = Object.keys(promises) as Array<Extract<keyof T, string>>;\n\n  if (keys.length === 0) {\n    throw new Error(NO_PROMISES_MESSAGE);\n  }\n\n  const wrapped = keys.map(key =>\n    wrapPromise(key, promises[key] as PromiseLike<Awaited<T[typeof key]>>),\n  );\n\n  return await Promise.race(wrapped);\n}\n\n/**\n * A memory-safe way to race a short-lived `Promise` with one or more\n * long-leved `AbortSignal`s. This works around the unsafe practice\n * of racing a short-lived promise (e.g. in a loop) with a long-lived one,\n * which results in accumulating memory via `then` callbacks on the latter:\n *\n * https://github.com/nodejs/node/issues/17469\n *\n * The safe way to race a short-lived, expected-to-complete Promise against a\n * long-lived termination signal is to control the latter via an\n * {@link AbortController} and race the former against the signal of the\n * latter.\n */\nexport async function promiseOrAbort<T>(\n  shortLived: Promise<T>,\n  ...longLived: AbortSignal[]\n): Promise<T> {\n  const promises: Promise<T>[] = [];\n  const cleanup: (() => void)[] = [];\n  for (const signal of longLived) {\n    if (signal.aborted) {\n      promises.push(Promise.reject(signal.reason));\n    } else {\n      const {promise, reject} = resolver<T>();\n      const handler = () => reject(signal.reason);\n      signal.addEventListener('abort', handler);\n      cleanup.push(() => signal.removeEventListener('abort', handler));\n      promises.push(promise);\n    }\n  }\n\n  try {\n    return await Promise.race([shortLived, ...promises]);\n  } finally {\n    cleanup.forEach(fn => fn());\n  }\n}\n"],"mappings":";;AAUA,IAAM,sBAAsB;AAE5B,IAAM,eACJ,KACA,YAEA,QAAQ,QAAQ,OAAO,EAAE,MAAK,YAAW;CACvC;CACA,QAAQ;CACR;AACF,EAAE;;;;;;;;AASJ,eAAsB,YAEpB,UAAiD;CACjD,MAAM,OAAO,OAAO,KAAK,QAAQ;CAEjC,IAAI,KAAK,WAAW,GAClB,MAAM,IAAI,MAAM,mBAAmB;CAGrC,MAAM,UAAU,KAAK,KAAI,QACvB,YAAY,KAAK,SAAS,IAA2C,CACvE;CAEA,OAAO,MAAM,QAAQ,KAAK,OAAO;AACnC;;;;;;;;;;;;;;AAeA,eAAsB,eACpB,YACA,GAAG,WACS;CACZ,MAAM,WAAyB,CAAC;CAChC,MAAM,UAA0B,CAAC;CACjC,KAAK,MAAM,UAAU,WACnB,IAAI,OAAO,SACT,SAAS,KAAK,QAAQ,OAAO,OAAO,MAAM,CAAC;MACtC;EACL,MAAM,EAAC,SAAS,WAAU,SAAY;EACtC,MAAM,gBAAgB,OAAO,OAAO,MAAM;EAC1C,OAAO,iBAAiB,SAAS,OAAO;EACxC,QAAQ,WAAW,OAAO,oBAAoB,SAAS,OAAO,CAAC;EAC/D,SAAS,KAAK,OAAO;CACvB;CAGF,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC;CACrD,UAAU;EACR,QAAQ,SAAQ,OAAM,GAAG,CAAC;CAC5B;AACF"}

package/out/zero/package.js

@@ -1,6 +1,6 @@
 var package_default = {
 	name: "@rocicorp/zero",
-	version: "1.10.0-canary.2",
+	version: "1.10.0-canary.20",
 	description: "Zero is a web framework for serverless web development.",
 	homepage: "https://zero.rocicorp.dev",
 	bugs: { "url": "https://bugs.rocicorp.dev" },
@@ -146,13 +146,12 @@ var package_default = {
 		"cloudevents": "^10.0.0",
 		"command-line-args": "^6.0.1",
 		"command-line-usage": "^7.0.3",
-		"compare-utf8": "^0.2.0",
+		"compare-utf8": "^0.2.3",
 		"defu": "^6.1.4",
 		"eventemitter3": "^5.0.1",
 		"fastify": "^5.0.0",
 		"is-in-subnet": "^4.0.1",
 		"jose": "^5.9.3",
-		"js-xxhash": "^4.0.0",
 		"json-custom-numbers": "^3.1.1",
 		"kasi": "^1.1.0",
 		"nanoid": "^5.1.2",

package/out/zero/package.js.map

@@ -1 +1 @@
-{"version":3,"file":"package.js","names":[],"sources":["../../package.json"],"sourcesContent":["{\n  \"name\": \"@rocicorp/zero\",\n  \"version\": \"1.10.0-canary.2\",\n  \"description\": \"Zero is a web framework for serverless web development.\",\n  \"homepage\": \"https://zero.rocicorp.dev\",\n  \"bugs\": {\n    \"url\": \"https://bugs.rocicorp.dev\"\n  },\n  \"license\": \"Apache-2.0\",\n  \"author\": \"Rocicorp, Inc.\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/rocicorp/mono.git\",\n    \"directory\": \"packages/zero\"\n  },\n  \"bin\": {\n    \"analyze-query\": \"./out/zero/src/analyze-query.js\",\n    \"ast-to-zql\": \"./out/zero/src/ast-to-zql.js\",\n    \"transform-query\": \"./out/zero/src/transform-query.js\",\n    \"zero-build-schema\": \"./out/zero/src/build-schema.js\",\n    \"zero-cache\": \"./out/zero/src/cli.js\",\n    \"zero-cache-dev\": \"./out/zero/src/zero-cache-dev.js\",\n    \"zero-deploy-permissions\": \"./out/zero/src/deploy-permissions.js\",\n    \"zero-out\": \"./out/zero/src/zero-out.js\"\n  },\n  \"files\": [\n    \"out\",\n    \"!*.tsbuildinfo\"\n  ],\n  \"type\": \"module\",\n  \"main\": \"out/zero/src/zero.js\",\n  \"module\": \"out/zero/src/zero.js\",\n  \"types\": \"out/zero/src/zero.d.ts\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./out/zero/src/zero.d.ts\",\n      \"default\": \"./out/zero/src/zero.js\"\n    },\n    \"./analyze\": {\n      \"types\": \"./out/zero/src/analyze.d.ts\",\n      \"default\": \"./out/zero/src/analyze.js\"\n    },\n    \"./bindings\": {\n      \"types\": \"./out/zero/src/bindings.d.ts\",\n      \"default\": \"./out/zero/src/bindings.js\"\n    },\n    \"./change-protocol/v0\": {\n      \"types\": \"./out/zero/src/change-protocol/v0.d.ts\",\n      \"default\": \"./out/zero/src/change-protocol/v0.js\"\n    },\n    \"./expo-sqlite\": {\n      \"types\": \"./out/zero/src/expo-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/expo-sqlite.js\"\n    },\n    \"./op-sqlite\": {\n      \"types\": \"./out/zero/src/op-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/op-sqlite.js\"\n    },\n    \"./pg\": {\n      \"types\": \"./out/zero/src/pg.d.ts\",\n      \"default\": \"./out/zero/src/pg.js\"\n    },\n    \"./react\": {\n      \"types\": \"./out/zero/src/react.d.ts\",\n      \"default\": \"./out/zero/src/react.js\"\n    },\n    \"./react-native\": {\n      \"types\": \"./out/zero/src/react-native.d.ts\",\n      \"default\": \"./out/zero/src/react-native.js\"\n    },\n    \"./server\": {\n      \"types\": \"./out/zero/src/server.d.ts\",\n      \"default\": \"./out/zero/src/server.js\"\n    },\n    \"./server/adapters/drizzle\": {\n      \"types\": \"./out/zero/src/adapters/drizzle.d.ts\",\n      \"default\": \"./out/zero/src/adapters/drizzle.js\"\n    },\n    \"./server/adapters/kysely\": {\n      \"types\": \"./out/zero/src/adapters/kysely.d.ts\",\n      \"default\": \"./out/zero/src/adapters/kysely.js\"\n    },\n    \"./server/adapters/prisma\": {\n      \"types\": \"./out/zero/src/adapters/prisma.d.ts\",\n      \"default\": \"./out/zero/src/adapters/prisma.js\"\n    },\n    \"./server/adapters/pg\": {\n      \"types\": \"./out/zero/src/adapters/pg.d.ts\",\n      \"default\": \"./out/zero/src/adapters/pg.js\"\n    },\n    \"./server/adapters/postgresjs\": {\n      \"types\": \"./out/zero/src/adapters/postgresjs.d.ts\",\n      \"default\": \"./out/zero/src/adapters/postgresjs.js\"\n    },\n    \"./solid\": {\n      \"types\": \"./out/zero/src/solid.d.ts\",\n      \"default\": \"./out/zero/src/solid.js\"\n    },\n    \"./sqlite\": {\n      \"types\": \"./out/zero/src/sqlite.d.ts\",\n      \"default\": \"./out/zero/src/sqlite.js\"\n    },\n    \"./zqlite\": {\n      \"types\": \"./out/zero/src/zqlite.d.ts\",\n      \"default\": \"./out/zero/src/zqlite.js\"\n    }\n  },\n  \"scripts\": {\n    \"build\": \"node --experimental-strip-types --no-warnings tool/build.ts\",\n    \"build:watch\": \"node --experimental-strip-types --no-warnings tool/build.ts --watch\",\n    \"check-types\": \"tsc -p tsconfig.client.json && tsc -p tsconfig.server.json\",\n    \"check-types:client:watch\": \"tsc -p tsconfig.client.json --watch\",\n    \"check-types:server:watch\": \"tsc -p tsconfig.server.json --watch\",\n    \"format\": \"oxfmt .\",\n    \"check-format\": \"oxfmt --check .\",\n    \"lint\": \"oxlint --quiet --config ../../oxlint.config.ts src/\",\n    \"docs\": \"node --experimental-strip-types --no-warnings tool/generate-docs.ts\",\n    \"docs:server\": \"node --watch --experimental-strip-types --no-warnings tool/generate-docs.ts --server\",\n    \"fmt\": \"oxfmt .\",\n    \"check-fmt\": \"oxfmt --check .\"\n  },\n  \"dependencies\": {\n    \"@badrap/valita\": \"0.3.11\",\n    \"@databases/escape-identifier\": \"^1.0.3\",\n    \"@databases/sql\": \"^3.3.0\",\n    \"@dotenvx/dotenvx\": \"^1.39.0\",\n    \"@drdgvhbh/postgres-error-codes\": \"^0.0.6\",\n    \"@fastify/cors\": \"^10.0.0\",\n    \"@fastify/websocket\": \"^11.0.0\",\n    \"@google-cloud/precise-date\": \"^4.0.0\",\n    \"@opentelemetry/api\": \"^1.9.0\",\n    \"@opentelemetry/api-logs\": \"^0.218.0\",\n    \"@opentelemetry/auto-instrumentations-node\": \"^0.76.0\",\n    \"@opentelemetry/exporter-metrics-otlp-http\": \"^0.218.0\",\n    \"@opentelemetry/resources\": \"^2.7.1\",\n    \"@opentelemetry/sdk-metrics\": \"^2.7.1\",\n    \"@opentelemetry/sdk-node\": \"^0.218.0\",\n    \"@opentelemetry/sdk-trace-node\": \"^2.7.1\",\n    \"@opentelemetry/semantic-conventions\": \"^1.41.1\",\n    \"@postgresql-typed/oids\": \"^0.2.0\",\n    \"@rocicorp/lock\": \"^1.0.4\",\n    \"@rocicorp/logger\": \"^6.1.0\",\n    \"@rocicorp/resolver\": \"^1.0.2\",\n    \"@rocicorp/zero-sqlite3\": \"^1.1.4\",\n    \"@standard-schema/spec\": \"^1.0.0\",\n    \"@types/basic-auth\": \"^1.1.8\",\n    \"@types/ws\": \"^8.5.12\",\n    \"basic-auth\": \"^2.0.1\",\n    \"chalk-template\": \"^1.1.0\",\n    \"chokidar\": \"^4.0.1\",\n    \"cloudevents\": \"^10.0.0\",\n    \"command-line-args\": \"^6.0.1\",\n    \"command-line-usage\": \"^7.0.3\",\n    \"compare-utf8\": \"^0.2.0\",\n    \"defu\": \"^6.1.4\",\n    \"eventemitter3\": \"^5.0.1\",\n    \"fastify\": \"^5.0.0\",\n    \"is-in-subnet\": \"^4.0.1\",\n    \"jose\": \"^5.9.3\",\n    \"js-xxhash\": \"^4.0.0\",\n    \"json-custom-numbers\": \"^3.1.1\",\n    \"kasi\": \"^1.1.0\",\n    \"nanoid\": \"^5.1.2\",\n    \"oxfmt\": \"^0.45.0\",\n    \"parse-prometheus-text-format\": \"^1.1.1\",\n    \"pg-format\": \"npm:pg-format-fix@^1.0.5\",\n    \"postgres\": \"3.4.7\",\n    \"semver\": \"^7.5.4\",\n    \"url-pattern\": \"^1.0.3\",\n    \"urlpattern-polyfill\": \"^10.1.0\",\n    \"ws\": \"^8.18.1\"\n  },\n  \"devDependencies\": {\n    \"@op-engineering/op-sqlite\": \">=15\",\n    \"@vitest/runner\": \"^4.1.6\",\n    \"analyze-query\": \"workspace:*\",\n    \"ast-to-zql\": \"workspace:*\",\n    \"expo-sqlite\": \">=15\",\n    \"oxc-parser\": \"^0.129.0\",\n    \"replicache\": \"workspace:*\",\n    \"shared\": \"workspace:*\",\n    \"syncpack\": \"^14.3.0\",\n    \"typedoc\": \"^0.28.17\",\n    \"typedoc-plugin-markdown\": \"^4.10.0\",\n    \"typescript\": \"~6.0.2\",\n    \"vite\": \"^8.0.13\",\n    \"vitest\": \"^4.1.6\",\n    \"zero-cache\": \"workspace:*\",\n    \"zero-client\": \"workspace:*\",\n    \"zero-pg\": \"workspace:*\",\n    \"zero-react\": \"workspace:*\",\n    \"zero-server\": \"workspace:*\",\n    \"zero-solid\": \"workspace:*\",\n    \"zqlite\": \"workspace:*\"\n  },\n  \"engines\": {\n    \"node\": \">=22\"\n  },\n  \"packageManager\": \"pnpm@11.11.0\"\n}\n"],"mappings":""}
+{"version":3,"file":"package.js","names":[],"sources":["../../package.json"],"sourcesContent":["{\n  \"name\": \"@rocicorp/zero\",\n  \"version\": \"1.10.0-canary.20\",\n  \"description\": \"Zero is a web framework for serverless web development.\",\n  \"homepage\": \"https://zero.rocicorp.dev\",\n  \"bugs\": {\n    \"url\": \"https://bugs.rocicorp.dev\"\n  },\n  \"license\": \"Apache-2.0\",\n  \"author\": \"Rocicorp, Inc.\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/rocicorp/mono.git\",\n    \"directory\": \"packages/zero\"\n  },\n  \"bin\": {\n    \"analyze-query\": \"./out/zero/src/analyze-query.js\",\n    \"ast-to-zql\": \"./out/zero/src/ast-to-zql.js\",\n    \"transform-query\": \"./out/zero/src/transform-query.js\",\n    \"zero-build-schema\": \"./out/zero/src/build-schema.js\",\n    \"zero-cache\": \"./out/zero/src/cli.js\",\n    \"zero-cache-dev\": \"./out/zero/src/zero-cache-dev.js\",\n    \"zero-deploy-permissions\": \"./out/zero/src/deploy-permissions.js\",\n    \"zero-out\": \"./out/zero/src/zero-out.js\"\n  },\n  \"files\": [\n    \"out\",\n    \"!*.tsbuildinfo\"\n  ],\n  \"type\": \"module\",\n  \"main\": \"out/zero/src/zero.js\",\n  \"module\": \"out/zero/src/zero.js\",\n  \"types\": \"out/zero/src/zero.d.ts\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./out/zero/src/zero.d.ts\",\n      \"default\": \"./out/zero/src/zero.js\"\n    },\n    \"./analyze\": {\n      \"types\": \"./out/zero/src/analyze.d.ts\",\n      \"default\": \"./out/zero/src/analyze.js\"\n    },\n    \"./bindings\": {\n      \"types\": \"./out/zero/src/bindings.d.ts\",\n      \"default\": \"./out/zero/src/bindings.js\"\n    },\n    \"./change-protocol/v0\": {\n      \"types\": \"./out/zero/src/change-protocol/v0.d.ts\",\n      \"default\": \"./out/zero/src/change-protocol/v0.js\"\n    },\n    \"./expo-sqlite\": {\n      \"types\": \"./out/zero/src/expo-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/expo-sqlite.js\"\n    },\n    \"./op-sqlite\": {\n      \"types\": \"./out/zero/src/op-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/op-sqlite.js\"\n    },\n    \"./pg\": {\n      \"types\": \"./out/zero/src/pg.d.ts\",\n      \"default\": \"./out/zero/src/pg.js\"\n    },\n    \"./react\": {\n      \"types\": \"./out/zero/src/react.d.ts\",\n      \"default\": \"./out/zero/src/react.js\"\n    },\n    \"./react-native\": {\n      \"types\": \"./out/zero/src/react-native.d.ts\",\n      \"default\": \"./out/zero/src/react-native.js\"\n    },\n    \"./server\": {\n      \"types\": \"./out/zero/src/server.d.ts\",\n      \"default\": \"./out/zero/src/server.js\"\n    },\n    \"./server/adapters/drizzle\": {\n      \"types\": \"./out/zero/src/adapters/drizzle.d.ts\",\n      \"default\": \"./out/zero/src/adapters/drizzle.js\"\n    },\n    \"./server/adapters/kysely\": {\n      \"types\": \"./out/zero/src/adapters/kysely.d.ts\",\n      \"default\": \"./out/zero/src/adapters/kysely.js\"\n    },\n    \"./server/adapters/prisma\": {\n      \"types\": \"./out/zero/src/adapters/prisma.d.ts\",\n      \"default\": \"./out/zero/src/adapters/prisma.js\"\n    },\n    \"./server/adapters/pg\": {\n      \"types\": \"./out/zero/src/adapters/pg.d.ts\",\n      \"default\": \"./out/zero/src/adapters/pg.js\"\n    },\n    \"./server/adapters/postgresjs\": {\n      \"types\": \"./out/zero/src/adapters/postgresjs.d.ts\",\n      \"default\": \"./out/zero/src/adapters/postgresjs.js\"\n    },\n    \"./solid\": {\n      \"types\": \"./out/zero/src/solid.d.ts\",\n      \"default\": \"./out/zero/src/solid.js\"\n    },\n    \"./sqlite\": {\n      \"types\": \"./out/zero/src/sqlite.d.ts\",\n      \"default\": \"./out/zero/src/sqlite.js\"\n    },\n    \"./zqlite\": {\n      \"types\": \"./out/zero/src/zqlite.d.ts\",\n      \"default\": \"./out/zero/src/zqlite.js\"\n    }\n  },\n  \"scripts\": {\n    \"build\": \"node --experimental-strip-types --no-warnings tool/build.ts\",\n    \"build:watch\": \"node --experimental-strip-types --no-warnings tool/build.ts --watch\",\n    \"check-types\": \"tsc -p tsconfig.client.json && tsc -p tsconfig.server.json\",\n    \"check-types:client:watch\": \"tsc -p tsconfig.client.json --watch\",\n    \"check-types:server:watch\": \"tsc -p tsconfig.server.json --watch\",\n    \"format\": \"oxfmt .\",\n    \"check-format\": \"oxfmt --check .\",\n    \"lint\": \"oxlint --quiet --config ../../oxlint.config.ts src/\",\n    \"docs\": \"node --experimental-strip-types --no-warnings tool/generate-docs.ts\",\n    \"docs:server\": \"node --watch --experimental-strip-types --no-warnings tool/generate-docs.ts --server\",\n    \"fmt\": \"oxfmt .\",\n    \"check-fmt\": \"oxfmt --check .\"\n  },\n  \"dependencies\": {\n    \"@badrap/valita\": \"0.3.11\",\n    \"@databases/escape-identifier\": \"^1.0.3\",\n    \"@databases/sql\": \"^3.3.0\",\n    \"@dotenvx/dotenvx\": \"^1.39.0\",\n    \"@drdgvhbh/postgres-error-codes\": \"^0.0.6\",\n    \"@fastify/cors\": \"^10.0.0\",\n    \"@fastify/websocket\": \"^11.0.0\",\n    \"@google-cloud/precise-date\": \"^4.0.0\",\n    \"@opentelemetry/api\": \"^1.9.0\",\n    \"@opentelemetry/api-logs\": \"^0.218.0\",\n    \"@opentelemetry/auto-instrumentations-node\": \"^0.76.0\",\n    \"@opentelemetry/exporter-metrics-otlp-http\": \"^0.218.0\",\n    \"@opentelemetry/resources\": \"^2.7.1\",\n    \"@opentelemetry/sdk-metrics\": \"^2.7.1\",\n    \"@opentelemetry/sdk-node\": \"^0.218.0\",\n    \"@opentelemetry/sdk-trace-node\": \"^2.7.1\",\n    \"@opentelemetry/semantic-conventions\": \"^1.41.1\",\n    \"@postgresql-typed/oids\": \"^0.2.0\",\n    \"@rocicorp/lock\": \"^1.0.4\",\n    \"@rocicorp/logger\": \"^6.1.0\",\n    \"@rocicorp/resolver\": \"^1.0.2\",\n    \"@rocicorp/zero-sqlite3\": \"^1.1.4\",\n    \"@standard-schema/spec\": \"^1.0.0\",\n    \"@types/basic-auth\": \"^1.1.8\",\n    \"@types/ws\": \"^8.5.12\",\n    \"basic-auth\": \"^2.0.1\",\n    \"chalk-template\": \"^1.1.0\",\n    \"chokidar\": \"^4.0.1\",\n    \"cloudevents\": \"^10.0.0\",\n    \"command-line-args\": \"^6.0.1\",\n    \"command-line-usage\": \"^7.0.3\",\n    \"compare-utf8\": \"^0.2.3\",\n    \"defu\": \"^6.1.4\",\n    \"eventemitter3\": \"^5.0.1\",\n    \"fastify\": \"^5.0.0\",\n    \"is-in-subnet\": \"^4.0.1\",\n    \"jose\": \"^5.9.3\",\n    \"json-custom-numbers\": \"^3.1.1\",\n    \"kasi\": \"^1.1.0\",\n    \"nanoid\": \"^5.1.2\",\n    \"oxfmt\": \"^0.45.0\",\n    \"parse-prometheus-text-format\": \"^1.1.1\",\n    \"pg-format\": \"npm:pg-format-fix@^1.0.5\",\n    \"postgres\": \"3.4.7\",\n    \"semver\": \"^7.5.4\",\n    \"url-pattern\": \"^1.0.3\",\n    \"urlpattern-polyfill\": \"^10.1.0\",\n    \"ws\": \"^8.18.1\"\n  },\n  \"devDependencies\": {\n    \"@op-engineering/op-sqlite\": \">=15\",\n    \"@vitest/runner\": \"^4.1.6\",\n    \"analyze-query\": \"workspace:*\",\n    \"ast-to-zql\": \"workspace:*\",\n    \"expo-sqlite\": \">=15\",\n    \"oxc-parser\": \"^0.129.0\",\n    \"replicache\": \"workspace:*\",\n    \"shared\": \"workspace:*\",\n    \"syncpack\": \"^14.3.0\",\n    \"typedoc\": \"^0.28.17\",\n    \"typedoc-plugin-markdown\": \"^4.10.0\",\n    \"typescript\": \"~6.0.2\",\n    \"vite\": \"^8.0.13\",\n    \"vitest\": \"^4.1.6\",\n    \"zero-cache\": \"workspace:*\",\n    \"zero-client\": \"workspace:*\",\n    \"zero-pg\": \"workspace:*\",\n    \"zero-react\": \"workspace:*\",\n    \"zero-server\": \"workspace:*\",\n    \"zero-solid\": \"workspace:*\",\n    \"zqlite\": \"workspace:*\"\n  },\n  \"engines\": {\n    \"node\": \">=22\"\n  },\n  \"packageManager\": \"pnpm@11.11.0\"\n}\n"],"mappings":""}

package/out/zero-cache/src/auth/write-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-authorizer.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/write-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAMrC,OAAO,KAAK,EACV,MAAM,EAIN,QAAQ,EACT,MAAM,wCAAwC,CAAC;AAsBhD,OAAO,KAAK,EAEV,eAAe,EAChB,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,2BAA2B,CAAC;AAMxD,OAAO,KAAK,EAAY,UAAU,EAAC,MAAM,0BAA0B,CAAC;AAapE,MAAM,WAAW,eAAe;IAC9B,cAAc,CACZ,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAC/B,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,eAAe,CACb,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAC/B,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,iBAAiB,IAAI,IAAI,CAAC;IAC1B,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;IAEzD;;;OAGG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACzC;AAED,qBAAa,mBAAoB,YAAW,eAAe;;gBAgBvD,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,QAAQ,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,eAAe;IAwBpC,iBAAiB;IAUjB,OAAO;IAID,cAAc,CAClB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IAsB5B,eAAe,CACnB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IA0ElC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IAuBxD,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI;CAgUxC"}
+{"version":3,"file":"write-authorizer.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/write-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAMrC,OAAO,KAAK,EACV,MAAM,EAIN,QAAQ,EACT,MAAM,wCAAwC,CAAC;AAsBhD,OAAO,KAAK,EAEV,eAAe,EAChB,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,2BAA2B,CAAC;AAMxD,OAAO,KAAK,EAAY,UAAU,EAAC,MAAM,0BAA0B,CAAC;AAapE,MAAM,WAAW,eAAe;IAC9B,cAAc,CACZ,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAC/B,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,eAAe,CACb,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAC/B,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,iBAAiB,IAAI,IAAI,CAAC;IAC1B,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;IAEzD;;;OAGG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACzC;AAED,qBAAa,mBAAoB,YAAW,eAAe;;gBAgBvD,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,QAAQ,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,eAAe;IAwBpC,iBAAiB;IAUjB,OAAO;IAID,cAAc,CAClB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IAsB5B,eAAe,CACnB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IA0ElC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IAuBxD,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI;CAkUxC"}

package/out/zero-cache/src/auth/write-authorizer.js

@@ -225,7 +225,14 @@ var WriteAuthorizerImpl = class {
 			}
 		}
 		if (!await this.#passesPolicyGroup(applicableRowPolicy, applicableCellPolicies, authData, rowQuery)) {
-			this.#lc.warn?.(`Permission check failed for ${JSON.stringify(op)}, action ${action}, phase ${phase}, authData: ${JSON.stringify(authData)}, rowPolicies: ${JSON.stringify(applicableRowPolicy)}, cellPolicies: ${JSON.stringify(applicableCellPolicies)}`);
+			this.#lc.warn?.("Permission check failed", {
+				action,
+				phase,
+				tableName: op.tableName,
+				columns: Object.keys(op.value),
+				rowPolicy: applicableRowPolicy !== void 0,
+				cellPolicyCount: applicableCellPolicies.length
+			});
 			return false;
 		}
 		return true;

package/out/zero-cache/src/auth/write-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"write-authorizer.js","names":["#schema","#replica","#builderDelegate","#tableSpecs","#tables","#statementRunner","#lc","#appID","#logConfig","#cgStorage","#config","#getSource","#loadedPermissions","#canUpdate","#canDelete","#requirePreMutationRow","#canInsert","#getPreMutationRow","#timedCanDo","#canDo","#getPrimaryKey","#passesPolicyGroup","#passesPolicy"],"sources":["../../../../../zero-cache/src/auth/write-authorizer.ts"],"sourcesContent":["import type {SQLQuery} from '@databases/sql';\nimport type {MaybePromise} from '@opentelemetry/resources';\nimport type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport {assert} from '../../../shared/src/asserts.ts';\nimport type {JSONValue, ReadonlyJSONValue} from '../../../shared/src/json.ts';\nimport {must} from '../../../shared/src/must.ts';\nimport * as v from '../../../shared/src/valita.ts';\nimport type {Condition} from '../../../zero-protocol/src/ast.ts';\nimport type {\n  CRUDOp,\n  DeleteOp,\n  InsertOp,\n  UpdateOp,\n  UpsertOp,\n} from '../../../zero-protocol/src/mutation.ts';\nimport {\n  primaryKeyValueSchema,\n  type PrimaryKeyValue,\n} from '../../../zero-protocol/src/primary-key.ts';\nimport type {Policy} from '../../../zero-schema/src/compiled-permissions.ts';\nimport type {Schema} from '../../../zero-types/src/schema.ts';\nimport type {BuilderDelegate} from '../../../zql/src/builder/builder.ts';\nimport {\n  bindStaticParameters,\n  buildPipeline,\n} from '../../../zql/src/builder/builder.ts';\nimport {\n  makeSourceChangeAdd,\n  makeSourceChangeEdit,\n  makeSourceChangeRemove,\n} from '../../../zql/src/ivm/source.ts';\nimport {consume} from '../../../zql/src/ivm/stream.ts';\nimport {simplifyCondition} from '../../../zql/src/query/expression.ts';\nimport {asQueryInternals} from '../../../zql/src/query/query-internals.ts';\nimport type {Query} from '../../../zql/src/query/query.ts';\nimport {newStaticQuery} from '../../../zql/src/query/static-query.ts';\nimport type {\n  ClientGroupStorage,\n  DatabaseStorage,\n} from '../../../zqlite/src/database-storage.ts';\nimport type {Database} from '../../../zqlite/src/db.ts';\nimport {compile, sql} from '../../../zqlite/src/internal/sql.ts';\nimport {\n  fromSQLiteTypes,\n  TableSource,\n} from '../../../zqlite/src/table-source.ts';\nimport type {LogConfig, ZeroConfig} from '../config/zero-config.ts';\nimport {computeZqlSpecs} from '../db/lite-tables.ts';\nimport type {LiteAndZqlSpec} from '../db/specs.ts';\nimport {StatementRunner} from '../db/statements.ts';\nimport {mapLiteDataTypeToZqlSchemaValue} from '../types/lite.ts';\nimport {\n  getSchema,\n  reloadPermissionsIfChanged,\n  type LoadedPermissions,\n} from './load-permissions.ts';\n\ntype Phase = 'preMutation' | 'postMutation';\n\nexport interface WriteAuthorizer {\n  canPreMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ): Promise<boolean>;\n  canPostMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ): Promise<boolean>;\n  reloadPermissions(): void;\n  normalizeOps(ops: CRUDOp[]): Exclude<CRUDOp, UpsertOp>[];\n\n  /**\n   * Validates that all table names in the operations exist in the schema.\n   * @throws Error if any table name is invalid\n   */\n  validateTableNames(ops: CRUDOp[]): void;\n}\n\nexport class WriteAuthorizerImpl implements WriteAuthorizer {\n  readonly #schema: Schema;\n  readonly #replica: Database;\n  readonly #builderDelegate: BuilderDelegate;\n  readonly #tableSpecs: Map<string, LiteAndZqlSpec>;\n  readonly #tables = new Map<string, TableSource>();\n  readonly #statementRunner: StatementRunner;\n  readonly #lc: LogContext;\n  readonly #appID: string;\n  readonly #logConfig: LogConfig;\n  readonly #cgStorage: ClientGroupStorage;\n  readonly #config: ZeroConfig;\n\n  #loadedPermissions: LoadedPermissions | null = null;\n\n  constructor(\n    lc: LogContext,\n    config: ZeroConfig,\n    replica: Database,\n    appID: string,\n    cgID: string,\n    writeAuthzStorage: DatabaseStorage,\n  ) {\n    this.#appID = appID;\n    this.#config = config;\n    this.#lc = lc.withContext('class', 'WriteAuthorizerImpl');\n    this.#logConfig = config.log;\n    this.#schema = getSchema(this.#lc, replica);\n    this.#replica = replica;\n    this.#cgStorage = writeAuthzStorage.createClientGroupStorage(cgID);\n    this.#builderDelegate = {\n      getSource: name => this.#getSource(name),\n      createStorage: () => this.#cgStorage.createStorage(),\n      decorateSourceInput: input => input,\n      decorateInput: input => input,\n      addEdge() {},\n      decorateFilterInput: input => input,\n    };\n    this.#tableSpecs = computeZqlSpecs(this.#lc, replica, {\n      includeBackfillingColumns: false,\n    });\n    this.#statementRunner = new StatementRunner(replica);\n    this.reloadPermissions();\n  }\n\n  reloadPermissions() {\n    this.#loadedPermissions = reloadPermissionsIfChanged(\n      this.#lc,\n      this.#statementRunner,\n      this.#appID,\n      this.#loadedPermissions,\n      this.#config,\n    ).permissions;\n  }\n\n  destroy() {\n    this.#cgStorage.destroy();\n  }\n\n  async canPreMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ) {\n    for (const op of ops) {\n      switch (op.op) {\n        case 'insert':\n          // insert does not run pre-mutation checks\n          break;\n        case 'update':\n          if (!(await this.#canUpdate('preMutation', authData, op))) {\n            return false;\n          }\n          break;\n        case 'delete':\n          if (!(await this.#canDelete('preMutation', authData, op))) {\n            return false;\n          }\n          break;\n      }\n    }\n    return true;\n  }\n\n  async canPostMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ) {\n    this.#statementRunner.beginConcurrent();\n    let opError: unknown;\n    try {\n      for (const op of ops) {\n        const source = this.#getSource(op.tableName);\n        switch (op.op) {\n          case 'insert': {\n            consume(source.push(makeSourceChangeAdd(op.value)));\n            break;\n          }\n          // TODO(mlaw): what if someone updates the same thing twice?\n          // TODO(aa): It seems like it will just work? source.push()\n          // is going to push the row into the table source, and then the\n          // next requirePreMutationRow will just return the row that was\n          // pushed in.\n          case 'update': {\n            consume(\n              source.push(\n                makeSourceChangeEdit(op.value, this.#requirePreMutationRow(op)),\n              ),\n            );\n            break;\n          }\n          case 'delete': {\n            consume(\n              source.push(\n                makeSourceChangeRemove(this.#requirePreMutationRow(op)),\n              ),\n            );\n            break;\n          }\n        }\n      }\n\n      for (const op of ops) {\n        switch (op.op) {\n          case 'insert':\n            if (!(await this.#canInsert('postMutation', authData, op))) {\n              return false;\n            }\n            break;\n          case 'update':\n            if (!(await this.#canUpdate('postMutation', authData, op))) {\n              return false;\n            }\n            break;\n          case 'delete':\n            // delete does not run post-mutation checks.\n            break;\n        }\n      }\n    } catch (e) {\n      opError = e;\n      throw e;\n    } finally {\n      try {\n        this.#statementRunner.rollback();\n      } catch (rollbackError) {\n        if (opError !== undefined) {\n          const combinedError = new Error(\n            `canPostMutation failed and rollback also failed: operation error = ${String(opError)}; rollback error = ${String(rollbackError)}`,\n          );\n          combinedError.cause = opError;\n          throw combinedError;\n        }\n        throw rollbackError;\n      }\n    }\n\n    return true;\n  }\n\n  normalizeOps(ops: CRUDOp[]): Exclude<CRUDOp, UpsertOp>[] {\n    return ops.map(op => {\n      if (op.op === 'upsert') {\n        const preMutationRow = this.#getPreMutationRow(op);\n        if (preMutationRow) {\n          return {\n            op: 'update',\n            tableName: op.tableName,\n            primaryKey: op.primaryKey,\n            value: op.value,\n          };\n        }\n        return {\n          op: 'insert',\n          tableName: op.tableName,\n          primaryKey: op.primaryKey,\n          value: op.value,\n        };\n      }\n      return op;\n    });\n  }\n\n  validateTableNames(ops: CRUDOp[]): void {\n    for (const op of ops) {\n      if (!this.#tableSpecs.has(op.tableName)) {\n        throw new Error(`Table '${op.tableName}' is not a valid table.`);\n      }\n    }\n  }\n\n  #canInsert(phase: Phase, authData: JWTPayload | undefined, op: InsertOp) {\n    return this.#timedCanDo(phase, 'insert', authData, op);\n  }\n\n  #canUpdate(phase: Phase, authData: JWTPayload | undefined, op: UpdateOp) {\n    return this.#timedCanDo(phase, 'update', authData, op);\n  }\n\n  #canDelete(phase: Phase, authData: JWTPayload | undefined, op: DeleteOp) {\n    return this.#timedCanDo(phase, 'delete', authData, op);\n  }\n\n  /**\n   * Gets schema-defined primary key and validates that operation contains required PK values.\n   *\n   * @returns Record where keys are column names and values are client-provided values\n   * @throws Error if operation value is missing required primary key columns\n   */\n  #getPrimaryKey(\n    tableName: string,\n    opValue: Record<string, ReadonlyJSONValue | undefined>,\n  ): Record<string, ReadonlyJSONValue> {\n    const tableSpec = this.#tableSpecs.get(tableName);\n    if (!tableSpec) {\n      throw new Error(`Table ${tableName} not found`);\n    }\n    const columns = tableSpec.tableSpec.primaryKey;\n\n    // Extract primary key values from operation value and validate they exist\n    const values: Record<string, ReadonlyJSONValue> = {};\n    for (const col of columns) {\n      const val = opValue[col];\n      if (val === undefined) {\n        throw new Error(\n          `Primary key column '${col}' is missing from operation value for table ${tableName}`,\n        );\n      }\n      values[col] = val;\n    }\n\n    return values;\n  }\n\n  #getSource(tableName: string) {\n    let source = this.#tables.get(tableName);\n    if (source) {\n      return source;\n    }\n    const tableSpec = this.#tableSpecs.get(tableName);\n    if (!tableSpec) {\n      throw new Error(`Table ${tableName} not found`);\n    }\n    const {columns, primaryKey} = tableSpec.tableSpec;\n    assert(\n      primaryKey.length,\n      () => `Table ${tableName} must have a primary key`,\n    );\n    source = new TableSource(\n      this.#lc,\n      this.#logConfig,\n      this.#replica,\n      tableName,\n      Object.fromEntries(\n        Object.entries(columns).map(([name, {dataType}]) => [\n          name,\n          mapLiteDataTypeToZqlSchemaValue(dataType),\n        ]),\n      ),\n      [primaryKey[0], ...primaryKey.slice(1)],\n    );\n    this.#tables.set(tableName, source);\n\n    return source;\n  }\n\n  async #timedCanDo<A extends keyof ActionOpMap>(\n    phase: Phase,\n    action: A,\n    authData: JWTPayload | undefined,\n    op: ActionOpMap[A],\n  ) {\n    const start = performance.now();\n    try {\n      const ret = await this.#canDo(phase, action, authData, op);\n      return ret;\n    } finally {\n      this.#lc.info?.(\n        'action:',\n        action,\n        'duration:',\n        performance.now() - start,\n        'tableName:',\n        op.tableName,\n        'primaryKey:',\n        op.primaryKey,\n      );\n    }\n  }\n\n  /**\n   * Evaluation order is from static to dynamic, broad to specific.\n   * table -> column -> row -> cell.\n   *\n   * If any step fails, the entire operation is denied.\n   *\n   * That is, table rules supersede column rules, which supersede row rules,\n   *\n   * All steps must allow for the operation to be allowed.\n   */\n  async #canDo<A extends keyof ActionOpMap>(\n    phase: Phase,\n    action: A,\n    authData: JWTPayload | undefined,\n    op: ActionOpMap[A],\n  ) {\n    const rules = must(this.#loadedPermissions)?.permissions?.tables?.[\n      op.tableName\n    ];\n    const rowPolicies = rules?.row;\n    let rowQuery = newStaticQuery(this.#schema, op.tableName);\n\n    const primaryKeyValues = this.#getPrimaryKey(op.tableName, op.value);\n\n    for (const pk in primaryKeyValues) {\n      rowQuery = rowQuery.where(pk, '=', primaryKeyValues[pk]);\n    }\n\n    let applicableRowPolicy: Policy | undefined;\n    switch (action) {\n      case 'insert':\n        if (phase === 'postMutation') {\n          applicableRowPolicy = rowPolicies?.insert;\n        }\n        break;\n      case 'update':\n        if (phase === 'preMutation') {\n          applicableRowPolicy = rowPolicies?.update?.preMutation;\n        } else if (phase === 'postMutation') {\n          applicableRowPolicy = rowPolicies?.update?.postMutation;\n        }\n        break;\n      case 'delete':\n        if (phase === 'preMutation') {\n          applicableRowPolicy = rowPolicies?.delete;\n        }\n        break;\n    }\n\n    const cellPolicies = rules?.cell;\n    const applicableCellPolicies: Policy[] = [];\n    if (cellPolicies) {\n      for (const [column, policy] of Object.entries(cellPolicies)) {\n        if (action === 'update' && op.value[column] === undefined) {\n          // If the cell is not being updated, we do not need to check\n          // the cell rules.\n          continue;\n        }\n        switch (action) {\n          case 'insert':\n            if (policy.insert && phase === 'postMutation') {\n              applicableCellPolicies.push(policy.insert);\n            }\n            break;\n          case 'update':\n            if (phase === 'preMutation' && policy.update?.preMutation) {\n              applicableCellPolicies.push(policy.update.preMutation);\n            }\n            if (phase === 'postMutation' && policy.update?.postMutation) {\n              applicableCellPolicies.push(policy.update.postMutation);\n            }\n            break;\n          case 'delete':\n            if (policy.delete && phase === 'preMutation') {\n              applicableCellPolicies.push(policy.delete);\n            }\n            break;\n        }\n      }\n    }\n\n    if (\n      !(await this.#passesPolicyGroup(\n        applicableRowPolicy,\n        applicableCellPolicies,\n        authData,\n        rowQuery,\n      ))\n    ) {\n      this.#lc.warn?.(\n        `Permission check failed for ${JSON.stringify(\n          op,\n        )}, action ${action}, phase ${phase}, authData: ${JSON.stringify(\n          authData,\n        )}, rowPolicies: ${JSON.stringify(\n          applicableRowPolicy,\n        )}, cellPolicies: ${JSON.stringify(applicableCellPolicies)}`,\n      );\n      return false;\n    }\n\n    return true;\n  }\n\n  #getPreMutationRow(op: UpsertOp | UpdateOp | DeleteOp) {\n    const {value} = op;\n\n    const primaryKeyValues = this.#getPrimaryKey(op.tableName, value);\n\n    const spec = this.#tableSpecs.get(op.tableName);\n    if (!spec) {\n      throw new Error(`Table ${op.tableName} not found`);\n    }\n\n    const conditions: SQLQuery[] = [];\n    const values: PrimaryKeyValue[] = [];\n    for (const pk in primaryKeyValues) {\n      conditions.push(sql`${sql.ident(pk)}=?`);\n      values.push(v.parse(primaryKeyValues[pk], primaryKeyValueSchema));\n    }\n\n    const ret = this.#statementRunner.get(\n      compile(\n        sql`SELECT ${sql.join(\n          Object.keys(spec.zqlSpec).map(c => sql.ident(c)),\n          sql`,`,\n        )} FROM ${sql.ident(op.tableName)} WHERE ${sql.join(\n          conditions,\n          sql` AND `,\n        )}`,\n      ),\n      ...values,\n    );\n    if (ret === undefined) {\n      return ret;\n    }\n    return fromSQLiteTypes(spec.zqlSpec, ret, op.tableName);\n  }\n\n  #requirePreMutationRow(op: UpdateOp | DeleteOp) {\n    const ret = this.#getPreMutationRow(op);\n    assert(\n      ret !== undefined,\n      () => `Pre-mutation row not found for ${JSON.stringify(op.value)}`,\n    );\n    return ret;\n  }\n\n  async #passesPolicyGroup(\n    applicableRowPolicy: Policy | undefined,\n    applicableCellPolicies: Policy[],\n    authData: JWTPayload | undefined,\n    rowQuery: Query<string, Schema>,\n  ) {\n    if (!(await this.#passesPolicy(applicableRowPolicy, authData, rowQuery))) {\n      return false;\n    }\n\n    for (const policy of applicableCellPolicies) {\n      if (!(await this.#passesPolicy(policy, authData, rowQuery))) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  /**\n   * Defaults to *false* if the policy is empty. At least one rule has to pass\n   * for the policy to pass.\n   */\n  #passesPolicy(\n    policy: Policy | undefined,\n    authData: JWTPayload | undefined,\n    rowQuery: Query<string, Schema>,\n  ): MaybePromise<boolean> {\n    if (policy === undefined) {\n      return false;\n    }\n    if (policy.length === 0) {\n      return false;\n    }\n    let rowQueryAst = asQueryInternals(rowQuery).ast;\n    rowQueryAst = bindStaticParameters(\n      {\n        ...rowQueryAst,\n        where: updateWhere(rowQueryAst.where, policy),\n      },\n      {\n        authData: authData as Record<string, JSONValue>,\n        preMutationRow: undefined,\n      },\n    );\n\n    // call the compiler directly\n    // run the sql against upstream.\n    // remove the collecting into json? just need to know if a row comes back.\n\n    const input = buildPipeline(rowQueryAst, this.#builderDelegate, 'query-id');\n    try {\n      const res = input.fetch({});\n      for (const _ of res) {\n        // if any row is returned at all, the\n        // rule passes.\n        return true;\n      }\n    } finally {\n      input.destroy();\n    }\n\n    // no rows returned by any rules? The policy fails.\n    return false;\n  }\n}\n\nfunction updateWhere(where: Condition | undefined, policy: Policy) {\n  assert(where, 'A where condition must exist for RowQuery');\n\n  return simplifyCondition({\n    type: 'and',\n    conditions: [\n      where,\n      {\n        type: 'or',\n        conditions: policy.map(([action, rule]) => {\n          assert(action, 'action must be defined in policy');\n          return rule;\n        }),\n      },\n    ],\n  });\n}\n\ntype ActionOpMap = {\n  insert: InsertOp;\n  update: UpdateOp;\n  delete: DeleteOp;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AA+EA,IAAa,sBAAb,MAA4D;CAC1D;CACA;CACA;CACA;CACA,0BAAmB,IAAI,IAAyB;CAChD;CACA;CACA;CACA;CACA;CACA;CAEA,qBAA+C;CAE/C,YACE,IACA,QACA,SACA,OACA,MACA,mBACA;EACA,KAAKO,SAAS;EACd,KAAKG,UAAU;EACf,KAAKJ,MAAM,GAAG,YAAY,SAAS,qBAAqB;EACxD,KAAKE,aAAa,OAAO;EACzB,KAAKR,UAAU,UAAU,KAAKM,KAAK,OAAO;EAC1C,KAAKL,WAAW;EAChB,KAAKQ,aAAa,kBAAkB,yBAAyB,IAAI;EACjE,KAAKP,mBAAmB;GACtB,YAAW,SAAQ,KAAKS,WAAW,IAAI;GACvC,qBAAqB,KAAKF,WAAW,cAAc;GACnD,sBAAqB,UAAS;GAC9B,gBAAe,UAAS;GACxB,UAAU,CAAC;GACX,sBAAqB,UAAS;EAChC;EACA,KAAKN,cAAc,gBAAgB,KAAKG,KAAK,SAAS,EACpD,2BAA2B,MAC7B,CAAC;EACD,KAAKD,mBAAmB,IAAI,gBAAgB,OAAO;EACnD,KAAK,kBAAkB;CACzB;CAEA,oBAAoB;EAClB,KAAKO,qBAAqB,2BACxB,KAAKN,KACL,KAAKD,kBACL,KAAKE,QACL,KAAKK,oBACL,KAAKF,OACP,EAAE;CACJ;CAEA,UAAU;EACR,KAAKD,WAAW,QAAQ;CAC1B;CAEA,MAAM,eACJ,UACA,KACA;EACA,KAAK,MAAM,MAAM,KACf,QAAQ,GAAG,IAAX;GACE,KAAK,UAEH;GACF,KAAK;IACH,IAAI,CAAE,MAAM,KAAKI,WAAW,eAAe,UAAU,EAAE,GACrD,OAAO;IAET;GACF,KAAK;IACH,IAAI,CAAE,MAAM,KAAKC,WAAW,eAAe,UAAU,EAAE,GACrD,OAAO;IAET;EACJ;EAEF,OAAO;CACT;CAEA,MAAM,gBACJ,UACA,KACA;EACA,KAAKT,iBAAiB,gBAAgB;EACtC,IAAI;EACJ,IAAI;GACF,KAAK,MAAM,MAAM,KAAK;IACpB,MAAM,SAAS,KAAKM,WAAW,GAAG,SAAS;IAC3C,QAAQ,GAAG,IAAX;KACE,KAAK;MACH,QAAQ,OAAO,KAAK,oBAAoB,GAAG,KAAK,CAAC,CAAC;MAClD;KAOF,KAAK;MACH,QACE,OAAO,KACL,qBAAqB,GAAG,OAAO,KAAKI,uBAAuB,EAAE,CAAC,CAChE,CACF;MACA;KAEF,KAAK;MACH,QACE,OAAO,KACL,uBAAuB,KAAKA,uBAAuB,EAAE,CAAC,CACxD,CACF;MACA;IAEJ;GACF;GAEA,KAAK,MAAM,MAAM,KACf,QAAQ,GAAG,IAAX;IACE,KAAK;KACH,IAAI,CAAE,MAAM,KAAKC,WAAW,gBAAgB,UAAU,EAAE,GACtD,OAAO;KAET;IACF,KAAK;KACH,IAAI,CAAE,MAAM,KAAKH,WAAW,gBAAgB,UAAU,EAAE,GACtD,OAAO;KAET;IACF,KAAK,UAEH;GACJ;EAEJ,SAAS,GAAG;GACV,UAAU;GACV,MAAM;EACR,UAAU;GACR,IAAI;IACF,KAAKR,iBAAiB,SAAS;GACjC,SAAS,eAAe;IACtB,IAAI,YAAY,KAAA,GAAW;KACzB,MAAM,gCAAgB,IAAI,MACxB,sEAAsE,OAAO,OAAO,EAAE,qBAAqB,OAAO,aAAa,GACjI;KACA,cAAc,QAAQ;KACtB,MAAM;IACR;IACA,MAAM;GACR;EACF;EAEA,OAAO;CACT;CAEA,aAAa,KAA4C;EACvD,OAAO,IAAI,KAAI,OAAM;GACnB,IAAI,GAAG,OAAO,UAAU;IAEtB,IADuB,KAAKY,mBAAmB,EAC3C,GACF,OAAO;KACL,IAAI;KACJ,WAAW,GAAG;KACd,YAAY,GAAG;KACf,OAAO,GAAG;IACZ;IAEF,OAAO;KACL,IAAI;KACJ,WAAW,GAAG;KACd,YAAY,GAAG;KACf,OAAO,GAAG;IACZ;GACF;GACA,OAAO;EACT,CAAC;CACH;CAEA,mBAAmB,KAAqB;EACtC,KAAK,MAAM,MAAM,KACf,IAAI,CAAC,KAAKd,YAAY,IAAI,GAAG,SAAS,GACpC,MAAM,IAAI,MAAM,UAAU,GAAG,UAAU,wBAAwB;CAGrE;CAEA,WAAW,OAAc,UAAkC,IAAc;EACvE,OAAO,KAAKe,YAAY,OAAO,UAAU,UAAU,EAAE;CACvD;CAEA,WAAW,OAAc,UAAkC,IAAc;EACvE,OAAO,KAAKA,YAAY,OAAO,UAAU,UAAU,EAAE;CACvD;CAEA,WAAW,OAAc,UAAkC,IAAc;EACvE,OAAO,KAAKA,YAAY,OAAO,UAAU,UAAU,EAAE;CACvD;;;;;;;CAQA,eACE,WACA,SACmC;EACnC,MAAM,YAAY,KAAKf,YAAY,IAAI,SAAS;EAChD,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,SAAS,UAAU,WAAW;EAEhD,MAAM,UAAU,UAAU,UAAU;EAGpC,MAAM,SAA4C,CAAC;EACnD,KAAK,MAAM,OAAO,SAAS;GACzB,MAAM,MAAM,QAAQ;GACpB,IAAI,QAAQ,KAAA,GACV,MAAM,IAAI,MACR,uBAAuB,IAAI,8CAA8C,WAC3E;GAEF,OAAO,OAAO;EAChB;EAEA,OAAO;CACT;CAEA,WAAW,WAAmB;EAC5B,IAAI,SAAS,KAAKC,QAAQ,IAAI,SAAS;EACvC,IAAI,QACF,OAAO;EAET,MAAM,YAAY,KAAKD,YAAY,IAAI,SAAS;EAChD,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,SAAS,UAAU,WAAW;EAEhD,MAAM,EAAC,SAAS,eAAc,UAAU;EACxC,OACE,WAAW,cACL,SAAS,UAAU,yBAC3B;EACA,SAAS,IAAI,YACX,KAAKG,KACL,KAAKE,YACL,KAAKP,UACL,WACA,OAAO,YACL,OAAO,QAAQ,OAAO,EAAE,KAAK,CAAC,MAAM,EAAC,gBAAe,CAClD,MACA,gCAAgC,QAAQ,CAC1C,CAAC,CACH,GACA,CAAC,WAAW,IAAI,GAAG,WAAW,MAAM,CAAC,CAAC,CACxC;EACA,KAAKG,QAAQ,IAAI,WAAW,MAAM;EAElC,OAAO;CACT;CAEA,MAAMc,YACJ,OACA,QACA,UACA,IACA;EACA,MAAM,QAAQ,YAAY,IAAI;EAC9B,IAAI;GAEF,OAAO,MADW,KAAKC,OAAO,OAAO,QAAQ,UAAU,EAAE;EAE3D,UAAU;GACR,KAAKb,IAAI,OACP,WACA,QACA,aACA,YAAY,IAAI,IAAI,OACpB,cACA,GAAG,WACH,eACA,GAAG,UACL;EACF;CACF;;;;;;;;;;;CAYA,MAAMa,OACJ,OACA,QACA,UACA,IACA;EACA,MAAM,QAAQ,KAAK,KAAKP,kBAAkB,GAAG,aAAa,SACxD,GAAG;EAEL,MAAM,cAAc,OAAO;EAC3B,IAAI,WAAW,eAAe,KAAKZ,SAAS,GAAG,SAAS;EAExD,MAAM,mBAAmB,KAAKoB,eAAe,GAAG,WAAW,GAAG,KAAK;EAEnE,KAAK,MAAM,MAAM,kBACf,WAAW,SAAS,MAAM,IAAI,KAAK,iBAAiB,GAAG;EAGzD,IAAI;EACJ,QAAQ,QAAR;GACE,KAAK;IACH,IAAI,UAAU,gBACZ,sBAAsB,aAAa;IAErC;GACF,KAAK;IACH,IAAI,UAAU,eACZ,sBAAsB,aAAa,QAAQ;SACtC,IAAI,UAAU,gBACnB,sBAAsB,aAAa,QAAQ;IAE7C;GACF,KAAK;IACH,IAAI,UAAU,eACZ,sBAAsB,aAAa;IAErC;EACJ;EAEA,MAAM,eAAe,OAAO;EAC5B,MAAM,yBAAmC,CAAC;EAC1C,IAAI,cACF,KAAK,MAAM,CAAC,QAAQ,WAAW,OAAO,QAAQ,YAAY,GAAG;GAC3D,IAAI,WAAW,YAAY,GAAG,MAAM,YAAY,KAAA,GAG9C;GAEF,QAAQ,QAAR;IACE,KAAK;KACH,IAAI,OAAO,UAAU,UAAU,gBAC7B,uBAAuB,KAAK,OAAO,MAAM;KAE3C;IACF,KAAK;KACH,IAAI,UAAU,iBAAiB,OAAO,QAAQ,aAC5C,uBAAuB,KAAK,OAAO,OAAO,WAAW;KAEvD,IAAI,UAAU,kBAAkB,OAAO,QAAQ,cAC7C,uBAAuB,KAAK,OAAO,OAAO,YAAY;KAExD;IACF,KAAK;KACH,IAAI,OAAO,UAAU,UAAU,eAC7B,uBAAuB,KAAK,OAAO,MAAM;KAE3C;GACJ;EACF;EAGF,IACE,CAAE,MAAM,KAAKC,mBACX,qBACA,wBACA,UACA,QACF,GACA;GACA,KAAKf,IAAI,OACP,+BAA+B,KAAK,UAClC,EACF,EAAE,WAAW,OAAO,UAAU,MAAM,cAAc,KAAK,UACrD,QACF,EAAE,iBAAiB,KAAK,UACtB,mBACF,EAAE,kBAAkB,KAAK,UAAU,sBAAsB,GAC3D;GACA,OAAO;EACT;EAEA,OAAO;CACT;CAEA,mBAAmB,IAAoC;EACrD,MAAM,EAAC,UAAS;EAEhB,MAAM,mBAAmB,KAAKc,eAAe,GAAG,WAAW,KAAK;EAEhE,MAAM,OAAO,KAAKjB,YAAY,IAAI,GAAG,SAAS;EAC9C,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,SAAS,GAAG,UAAU,WAAW;EAGnD,MAAM,aAAyB,CAAC;EAChC,MAAM,SAA4B,CAAC;EACnC,KAAK,MAAM,MAAM,kBAAkB;GACjC,WAAW,KAAK,GAAG,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG;GACvC,OAAO,KAAK,MAAQ,iBAAiB,KAAK,qBAAqB,CAAC;EAClE;EAEA,MAAM,MAAM,KAAKE,iBAAiB,IAChC,QACE,GAAG,UAAU,IAAI,KACf,OAAO,KAAK,KAAK,OAAO,EAAE,KAAI,MAAK,IAAI,MAAM,CAAC,CAAC,GAC/C,GAAG,GACL,EAAE,QAAQ,IAAI,MAAM,GAAG,SAAS,EAAE,SAAS,IAAI,KAC7C,YACA,GAAG,OACL,GACF,GACA,GAAG,MACL;EACA,IAAI,QAAQ,KAAA,GACV,OAAO;EAET,OAAO,gBAAgB,KAAK,SAAS,KAAK,GAAG,SAAS;CACxD;CAEA,uBAAuB,IAAyB;EAC9C,MAAM,MAAM,KAAKY,mBAAmB,EAAE;EACtC,OACE,QAAQ,KAAA,SACF,kCAAkC,KAAK,UAAU,GAAG,KAAK,GACjE;EACA,OAAO;CACT;CAEA,MAAMI,mBACJ,qBACA,wBACA,UACA,UACA;EACA,IAAI,CAAE,MAAM,KAAKC,cAAc,qBAAqB,UAAU,QAAQ,GACpE,OAAO;EAGT,KAAK,MAAM,UAAU,wBACnB,IAAI,CAAE,MAAM,KAAKA,cAAc,QAAQ,UAAU,QAAQ,GACvD,OAAO;EAIX,OAAO;CACT;;;;;CAMA,cACE,QACA,UACA,UACuB;EACvB,IAAI,WAAW,KAAA,GACb,OAAO;EAET,IAAI,OAAO,WAAW,GACpB,OAAO;EAET,IAAI,cAAc,iBAAiB,QAAQ,EAAE;EAC7C,cAAc,qBACZ;GACE,GAAG;GACH,OAAO,YAAY,YAAY,OAAO,MAAM;EAC9C,GACA;GACY;GACV,gBAAgB,KAAA;EAClB,CACF;EAMA,MAAM,QAAQ,cAAc,aAAa,KAAKpB,kBAAkB,UAAU;EAC1E,IAAI;GACF,MAAM,MAAM,MAAM,MAAM,CAAC,CAAC;GAC1B,KAAK,MAAM,KAAK,KAGd,OAAO;EAEX,UAAU;GACR,MAAM,QAAQ;EAChB;EAGA,OAAO;CACT;AACF;AAEA,SAAS,YAAY,OAA8B,QAAgB;CACjE,OAAO,OAAO,2CAA2C;CAEzD,OAAO,kBAAkB;EACvB,MAAM;EACN,YAAY,CACV,OACA;GACE,MAAM;GACN,YAAY,OAAO,KAAK,CAAC,QAAQ,UAAU;IACzC,OAAO,QAAQ,kCAAkC;IACjD,OAAO;GACT,CAAC;EACH,CACF;CACF,CAAC;AACH"}
+{"version":3,"file":"write-authorizer.js","names":["#schema","#replica","#builderDelegate","#tableSpecs","#tables","#statementRunner","#lc","#appID","#logConfig","#cgStorage","#config","#getSource","#loadedPermissions","#canUpdate","#canDelete","#requirePreMutationRow","#canInsert","#getPreMutationRow","#timedCanDo","#canDo","#getPrimaryKey","#passesPolicyGroup","#passesPolicy"],"sources":["../../../../../zero-cache/src/auth/write-authorizer.ts"],"sourcesContent":["import type {SQLQuery} from '@databases/sql';\nimport type {MaybePromise} from '@opentelemetry/resources';\nimport type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport {assert} from '../../../shared/src/asserts.ts';\nimport type {JSONValue, ReadonlyJSONValue} from '../../../shared/src/json.ts';\nimport {must} from '../../../shared/src/must.ts';\nimport * as v from '../../../shared/src/valita.ts';\nimport type {Condition} from '../../../zero-protocol/src/ast.ts';\nimport type {\n  CRUDOp,\n  DeleteOp,\n  InsertOp,\n  UpdateOp,\n  UpsertOp,\n} from '../../../zero-protocol/src/mutation.ts';\nimport {\n  primaryKeyValueSchema,\n  type PrimaryKeyValue,\n} from '../../../zero-protocol/src/primary-key.ts';\nimport type {Policy} from '../../../zero-schema/src/compiled-permissions.ts';\nimport type {Schema} from '../../../zero-types/src/schema.ts';\nimport type {BuilderDelegate} from '../../../zql/src/builder/builder.ts';\nimport {\n  bindStaticParameters,\n  buildPipeline,\n} from '../../../zql/src/builder/builder.ts';\nimport {\n  makeSourceChangeAdd,\n  makeSourceChangeEdit,\n  makeSourceChangeRemove,\n} from '../../../zql/src/ivm/source.ts';\nimport {consume} from '../../../zql/src/ivm/stream.ts';\nimport {simplifyCondition} from '../../../zql/src/query/expression.ts';\nimport {asQueryInternals} from '../../../zql/src/query/query-internals.ts';\nimport type {Query} from '../../../zql/src/query/query.ts';\nimport {newStaticQuery} from '../../../zql/src/query/static-query.ts';\nimport type {\n  ClientGroupStorage,\n  DatabaseStorage,\n} from '../../../zqlite/src/database-storage.ts';\nimport type {Database} from '../../../zqlite/src/db.ts';\nimport {compile, sql} from '../../../zqlite/src/internal/sql.ts';\nimport {\n  fromSQLiteTypes,\n  TableSource,\n} from '../../../zqlite/src/table-source.ts';\nimport type {LogConfig, ZeroConfig} from '../config/zero-config.ts';\nimport {computeZqlSpecs} from '../db/lite-tables.ts';\nimport type {LiteAndZqlSpec} from '../db/specs.ts';\nimport {StatementRunner} from '../db/statements.ts';\nimport {mapLiteDataTypeToZqlSchemaValue} from '../types/lite.ts';\nimport {\n  getSchema,\n  reloadPermissionsIfChanged,\n  type LoadedPermissions,\n} from './load-permissions.ts';\n\ntype Phase = 'preMutation' | 'postMutation';\n\nexport interface WriteAuthorizer {\n  canPreMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ): Promise<boolean>;\n  canPostMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ): Promise<boolean>;\n  reloadPermissions(): void;\n  normalizeOps(ops: CRUDOp[]): Exclude<CRUDOp, UpsertOp>[];\n\n  /**\n   * Validates that all table names in the operations exist in the schema.\n   * @throws Error if any table name is invalid\n   */\n  validateTableNames(ops: CRUDOp[]): void;\n}\n\nexport class WriteAuthorizerImpl implements WriteAuthorizer {\n  readonly #schema: Schema;\n  readonly #replica: Database;\n  readonly #builderDelegate: BuilderDelegate;\n  readonly #tableSpecs: Map<string, LiteAndZqlSpec>;\n  readonly #tables = new Map<string, TableSource>();\n  readonly #statementRunner: StatementRunner;\n  readonly #lc: LogContext;\n  readonly #appID: string;\n  readonly #logConfig: LogConfig;\n  readonly #cgStorage: ClientGroupStorage;\n  readonly #config: ZeroConfig;\n\n  #loadedPermissions: LoadedPermissions | null = null;\n\n  constructor(\n    lc: LogContext,\n    config: ZeroConfig,\n    replica: Database,\n    appID: string,\n    cgID: string,\n    writeAuthzStorage: DatabaseStorage,\n  ) {\n    this.#appID = appID;\n    this.#config = config;\n    this.#lc = lc.withContext('class', 'WriteAuthorizerImpl');\n    this.#logConfig = config.log;\n    this.#schema = getSchema(this.#lc, replica);\n    this.#replica = replica;\n    this.#cgStorage = writeAuthzStorage.createClientGroupStorage(cgID);\n    this.#builderDelegate = {\n      getSource: name => this.#getSource(name),\n      createStorage: () => this.#cgStorage.createStorage(),\n      decorateSourceInput: input => input,\n      decorateInput: input => input,\n      addEdge() {},\n      decorateFilterInput: input => input,\n    };\n    this.#tableSpecs = computeZqlSpecs(this.#lc, replica, {\n      includeBackfillingColumns: false,\n    });\n    this.#statementRunner = new StatementRunner(replica);\n    this.reloadPermissions();\n  }\n\n  reloadPermissions() {\n    this.#loadedPermissions = reloadPermissionsIfChanged(\n      this.#lc,\n      this.#statementRunner,\n      this.#appID,\n      this.#loadedPermissions,\n      this.#config,\n    ).permissions;\n  }\n\n  destroy() {\n    this.#cgStorage.destroy();\n  }\n\n  async canPreMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ) {\n    for (const op of ops) {\n      switch (op.op) {\n        case 'insert':\n          // insert does not run pre-mutation checks\n          break;\n        case 'update':\n          if (!(await this.#canUpdate('preMutation', authData, op))) {\n            return false;\n          }\n          break;\n        case 'delete':\n          if (!(await this.#canDelete('preMutation', authData, op))) {\n            return false;\n          }\n          break;\n      }\n    }\n    return true;\n  }\n\n  async canPostMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ) {\n    this.#statementRunner.beginConcurrent();\n    let opError: unknown;\n    try {\n      for (const op of ops) {\n        const source = this.#getSource(op.tableName);\n        switch (op.op) {\n          case 'insert': {\n            consume(source.push(makeSourceChangeAdd(op.value)));\n            break;\n          }\n          // TODO(mlaw): what if someone updates the same thing twice?\n          // TODO(aa): It seems like it will just work? source.push()\n          // is going to push the row into the table source, and then the\n          // next requirePreMutationRow will just return the row that was\n          // pushed in.\n          case 'update': {\n            consume(\n              source.push(\n                makeSourceChangeEdit(op.value, this.#requirePreMutationRow(op)),\n              ),\n            );\n            break;\n          }\n          case 'delete': {\n            consume(\n              source.push(\n                makeSourceChangeRemove(this.#requirePreMutationRow(op)),\n              ),\n            );\n            break;\n          }\n        }\n      }\n\n      for (const op of ops) {\n        switch (op.op) {\n          case 'insert':\n            if (!(await this.#canInsert('postMutation', authData, op))) {\n              return false;\n            }\n            break;\n          case 'update':\n            if (!(await this.#canUpdate('postMutation', authData, op))) {\n              return false;\n            }\n            break;\n          case 'delete':\n            // delete does not run post-mutation checks.\n            break;\n        }\n      }\n    } catch (e) {\n      opError = e;\n      throw e;\n    } finally {\n      try {\n        this.#statementRunner.rollback();\n      } catch (rollbackError) {\n        if (opError !== undefined) {\n          const combinedError = new Error(\n            `canPostMutation failed and rollback also failed: operation error = ${String(opError)}; rollback error = ${String(rollbackError)}`,\n          );\n          combinedError.cause = opError;\n          throw combinedError;\n        }\n        throw rollbackError;\n      }\n    }\n\n    return true;\n  }\n\n  normalizeOps(ops: CRUDOp[]): Exclude<CRUDOp, UpsertOp>[] {\n    return ops.map(op => {\n      if (op.op === 'upsert') {\n        const preMutationRow = this.#getPreMutationRow(op);\n        if (preMutationRow) {\n          return {\n            op: 'update',\n            tableName: op.tableName,\n            primaryKey: op.primaryKey,\n            value: op.value,\n          };\n        }\n        return {\n          op: 'insert',\n          tableName: op.tableName,\n          primaryKey: op.primaryKey,\n          value: op.value,\n        };\n      }\n      return op;\n    });\n  }\n\n  validateTableNames(ops: CRUDOp[]): void {\n    for (const op of ops) {\n      if (!this.#tableSpecs.has(op.tableName)) {\n        throw new Error(`Table '${op.tableName}' is not a valid table.`);\n      }\n    }\n  }\n\n  #canInsert(phase: Phase, authData: JWTPayload | undefined, op: InsertOp) {\n    return this.#timedCanDo(phase, 'insert', authData, op);\n  }\n\n  #canUpdate(phase: Phase, authData: JWTPayload | undefined, op: UpdateOp) {\n    return this.#timedCanDo(phase, 'update', authData, op);\n  }\n\n  #canDelete(phase: Phase, authData: JWTPayload | undefined, op: DeleteOp) {\n    return this.#timedCanDo(phase, 'delete', authData, op);\n  }\n\n  /**\n   * Gets schema-defined primary key and validates that operation contains required PK values.\n   *\n   * @returns Record where keys are column names and values are client-provided values\n   * @throws Error if operation value is missing required primary key columns\n   */\n  #getPrimaryKey(\n    tableName: string,\n    opValue: Record<string, ReadonlyJSONValue | undefined>,\n  ): Record<string, ReadonlyJSONValue> {\n    const tableSpec = this.#tableSpecs.get(tableName);\n    if (!tableSpec) {\n      throw new Error(`Table ${tableName} not found`);\n    }\n    const columns = tableSpec.tableSpec.primaryKey;\n\n    // Extract primary key values from operation value and validate they exist\n    const values: Record<string, ReadonlyJSONValue> = {};\n    for (const col of columns) {\n      const val = opValue[col];\n      if (val === undefined) {\n        throw new Error(\n          `Primary key column '${col}' is missing from operation value for table ${tableName}`,\n        );\n      }\n      values[col] = val;\n    }\n\n    return values;\n  }\n\n  #getSource(tableName: string) {\n    let source = this.#tables.get(tableName);\n    if (source) {\n      return source;\n    }\n    const tableSpec = this.#tableSpecs.get(tableName);\n    if (!tableSpec) {\n      throw new Error(`Table ${tableName} not found`);\n    }\n    const {columns, primaryKey} = tableSpec.tableSpec;\n    assert(\n      primaryKey.length,\n      () => `Table ${tableName} must have a primary key`,\n    );\n    source = new TableSource(\n      this.#lc,\n      this.#logConfig,\n      this.#replica,\n      tableName,\n      Object.fromEntries(\n        Object.entries(columns).map(([name, {dataType}]) => [\n          name,\n          mapLiteDataTypeToZqlSchemaValue(dataType),\n        ]),\n      ),\n      [primaryKey[0], ...primaryKey.slice(1)],\n    );\n    this.#tables.set(tableName, source);\n\n    return source;\n  }\n\n  async #timedCanDo<A extends keyof ActionOpMap>(\n    phase: Phase,\n    action: A,\n    authData: JWTPayload | undefined,\n    op: ActionOpMap[A],\n  ) {\n    const start = performance.now();\n    try {\n      const ret = await this.#canDo(phase, action, authData, op);\n      return ret;\n    } finally {\n      this.#lc.info?.(\n        'action:',\n        action,\n        'duration:',\n        performance.now() - start,\n        'tableName:',\n        op.tableName,\n        'primaryKey:',\n        op.primaryKey,\n      );\n    }\n  }\n\n  /**\n   * Evaluation order is from static to dynamic, broad to specific.\n   * table -> column -> row -> cell.\n   *\n   * If any step fails, the entire operation is denied.\n   *\n   * That is, table rules supersede column rules, which supersede row rules,\n   *\n   * All steps must allow for the operation to be allowed.\n   */\n  async #canDo<A extends keyof ActionOpMap>(\n    phase: Phase,\n    action: A,\n    authData: JWTPayload | undefined,\n    op: ActionOpMap[A],\n  ) {\n    const rules = must(this.#loadedPermissions)?.permissions?.tables?.[\n      op.tableName\n    ];\n    const rowPolicies = rules?.row;\n    let rowQuery = newStaticQuery(this.#schema, op.tableName);\n\n    const primaryKeyValues = this.#getPrimaryKey(op.tableName, op.value);\n\n    for (const pk in primaryKeyValues) {\n      rowQuery = rowQuery.where(pk, '=', primaryKeyValues[pk]);\n    }\n\n    let applicableRowPolicy: Policy | undefined;\n    switch (action) {\n      case 'insert':\n        if (phase === 'postMutation') {\n          applicableRowPolicy = rowPolicies?.insert;\n        }\n        break;\n      case 'update':\n        if (phase === 'preMutation') {\n          applicableRowPolicy = rowPolicies?.update?.preMutation;\n        } else if (phase === 'postMutation') {\n          applicableRowPolicy = rowPolicies?.update?.postMutation;\n        }\n        break;\n      case 'delete':\n        if (phase === 'preMutation') {\n          applicableRowPolicy = rowPolicies?.delete;\n        }\n        break;\n    }\n\n    const cellPolicies = rules?.cell;\n    const applicableCellPolicies: Policy[] = [];\n    if (cellPolicies) {\n      for (const [column, policy] of Object.entries(cellPolicies)) {\n        if (action === 'update' && op.value[column] === undefined) {\n          // If the cell is not being updated, we do not need to check\n          // the cell rules.\n          continue;\n        }\n        switch (action) {\n          case 'insert':\n            if (policy.insert && phase === 'postMutation') {\n              applicableCellPolicies.push(policy.insert);\n            }\n            break;\n          case 'update':\n            if (phase === 'preMutation' && policy.update?.preMutation) {\n              applicableCellPolicies.push(policy.update.preMutation);\n            }\n            if (phase === 'postMutation' && policy.update?.postMutation) {\n              applicableCellPolicies.push(policy.update.postMutation);\n            }\n            break;\n          case 'delete':\n            if (policy.delete && phase === 'preMutation') {\n              applicableCellPolicies.push(policy.delete);\n            }\n            break;\n        }\n      }\n    }\n\n    if (\n      !(await this.#passesPolicyGroup(\n        applicableRowPolicy,\n        applicableCellPolicies,\n        authData,\n        rowQuery,\n      ))\n    ) {\n      // `op.value` is the row being written and `authData` is the decoded\n      // JWT payload, so neither can go into the log. Column names and policy\n      // counts are enough to debug a failed permission check.\n      this.#lc.warn?.('Permission check failed', {\n        action,\n        phase,\n        tableName: op.tableName,\n        columns: Object.keys(op.value),\n        rowPolicy: applicableRowPolicy !== undefined,\n        cellPolicyCount: applicableCellPolicies.length,\n      });\n      return false;\n    }\n\n    return true;\n  }\n\n  #getPreMutationRow(op: UpsertOp | UpdateOp | DeleteOp) {\n    const {value} = op;\n\n    const primaryKeyValues = this.#getPrimaryKey(op.tableName, value);\n\n    const spec = this.#tableSpecs.get(op.tableName);\n    if (!spec) {\n      throw new Error(`Table ${op.tableName} not found`);\n    }\n\n    const conditions: SQLQuery[] = [];\n    const values: PrimaryKeyValue[] = [];\n    for (const pk in primaryKeyValues) {\n      conditions.push(sql`${sql.ident(pk)}=?`);\n      values.push(v.parse(primaryKeyValues[pk], primaryKeyValueSchema));\n    }\n\n    const ret = this.#statementRunner.get(\n      compile(\n        sql`SELECT ${sql.join(\n          Object.keys(spec.zqlSpec).map(c => sql.ident(c)),\n          sql`,`,\n        )} FROM ${sql.ident(op.tableName)} WHERE ${sql.join(\n          conditions,\n          sql` AND `,\n        )}`,\n      ),\n      ...values,\n    );\n    if (ret === undefined) {\n      return ret;\n    }\n    return fromSQLiteTypes(spec.zqlSpec, ret, op.tableName);\n  }\n\n  #requirePreMutationRow(op: UpdateOp | DeleteOp) {\n    const ret = this.#getPreMutationRow(op);\n    assert(\n      ret !== undefined,\n      () => `Pre-mutation row not found for ${JSON.stringify(op.value)}`,\n    );\n    return ret;\n  }\n\n  async #passesPolicyGroup(\n    applicableRowPolicy: Policy | undefined,\n    applicableCellPolicies: Policy[],\n    authData: JWTPayload | undefined,\n    rowQuery: Query<string, Schema>,\n  ) {\n    if (!(await this.#passesPolicy(applicableRowPolicy, authData, rowQuery))) {\n      return false;\n    }\n\n    for (const policy of applicableCellPolicies) {\n      if (!(await this.#passesPolicy(policy, authData, rowQuery))) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  /**\n   * Defaults to *false* if the policy is empty. At least one rule has to pass\n   * for the policy to pass.\n   */\n  #passesPolicy(\n    policy: Policy | undefined,\n    authData: JWTPayload | undefined,\n    rowQuery: Query<string, Schema>,\n  ): MaybePromise<boolean> {\n    if (policy === undefined) {\n      return false;\n    }\n    if (policy.length === 0) {\n      return false;\n    }\n    let rowQueryAst = asQueryInternals(rowQuery).ast;\n    rowQueryAst = bindStaticParameters(\n      {\n        ...rowQueryAst,\n        where: updateWhere(rowQueryAst.where, policy),\n      },\n      {\n        authData: authData as Record<string, JSONValue>,\n        preMutationRow: undefined,\n      },\n    );\n\n    // call the compiler directly\n    // run the sql against upstream.\n    // remove the collecting into json? just need to know if a row comes back.\n\n    const input = buildPipeline(rowQueryAst, this.#builderDelegate, 'query-id');\n    try {\n      const res = input.fetch({});\n      for (const _ of res) {\n        // if any row is returned at all, the\n        // rule passes.\n        return true;\n      }\n    } finally {\n      input.destroy();\n    }\n\n    // no rows returned by any rules? The policy fails.\n    return false;\n  }\n}\n\nfunction updateWhere(where: Condition | undefined, policy: Policy) {\n  assert(where, 'A where condition must exist for RowQuery');\n\n  return simplifyCondition({\n    type: 'and',\n    conditions: [\n      where,\n      {\n        type: 'or',\n        conditions: policy.map(([action, rule]) => {\n          assert(action, 'action must be defined in policy');\n          return rule;\n        }),\n      },\n    ],\n  });\n}\n\ntype ActionOpMap = {\n  insert: InsertOp;\n  update: UpdateOp;\n  delete: DeleteOp;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AA+EA,IAAa,sBAAb,MAA4D;CAC1D;CACA;CACA;CACA;CACA,0BAAmB,IAAI,IAAyB;CAChD;CACA;CACA;CACA;CACA;CACA;CAEA,qBAA+C;CAE/C,YACE,IACA,QACA,SACA,OACA,MACA,mBACA;EACA,KAAKO,SAAS;EACd,KAAKG,UAAU;EACf,KAAKJ,MAAM,GAAG,YAAY,SAAS,qBAAqB;EACxD,KAAKE,aAAa,OAAO;EACzB,KAAKR,UAAU,UAAU,KAAKM,KAAK,OAAO;EAC1C,KAAKL,WAAW;EAChB,KAAKQ,aAAa,kBAAkB,yBAAyB,IAAI;EACjE,KAAKP,mBAAmB;GACtB,YAAW,SAAQ,KAAKS,WAAW,IAAI;GACvC,qBAAqB,KAAKF,WAAW,cAAc;GACnD,sBAAqB,UAAS;GAC9B,gBAAe,UAAS;GACxB,UAAU,CAAC;GACX,sBAAqB,UAAS;EAChC;EACA,KAAKN,cAAc,gBAAgB,KAAKG,KAAK,SAAS,EACpD,2BAA2B,MAC7B,CAAC;EACD,KAAKD,mBAAmB,IAAI,gBAAgB,OAAO;EACnD,KAAK,kBAAkB;CACzB;CAEA,oBAAoB;EAClB,KAAKO,qBAAqB,2BACxB,KAAKN,KACL,KAAKD,kBACL,KAAKE,QACL,KAAKK,oBACL,KAAKF,OACP,EAAE;CACJ;CAEA,UAAU;EACR,KAAKD,WAAW,QAAQ;CAC1B;CAEA,MAAM,eACJ,UACA,KACA;EACA,KAAK,MAAM,MAAM,KACf,QAAQ,GAAG,IAAX;GACE,KAAK,UAEH;GACF,KAAK;IACH,IAAI,CAAE,MAAM,KAAKI,WAAW,eAAe,UAAU,EAAE,GACrD,OAAO;IAET;GACF,KAAK;IACH,IAAI,CAAE,MAAM,KAAKC,WAAW,eAAe,UAAU,EAAE,GACrD,OAAO;IAET;EACJ;EAEF,OAAO;CACT;CAEA,MAAM,gBACJ,UACA,KACA;EACA,KAAKT,iBAAiB,gBAAgB;EACtC,IAAI;EACJ,IAAI;GACF,KAAK,MAAM,MAAM,KAAK;IACpB,MAAM,SAAS,KAAKM,WAAW,GAAG,SAAS;IAC3C,QAAQ,GAAG,IAAX;KACE,KAAK;MACH,QAAQ,OAAO,KAAK,oBAAoB,GAAG,KAAK,CAAC,CAAC;MAClD;KAOF,KAAK;MACH,QACE,OAAO,KACL,qBAAqB,GAAG,OAAO,KAAKI,uBAAuB,EAAE,CAAC,CAChE,CACF;MACA;KAEF,KAAK;MACH,QACE,OAAO,KACL,uBAAuB,KAAKA,uBAAuB,EAAE,CAAC,CACxD,CACF;MACA;IAEJ;GACF;GAEA,KAAK,MAAM,MAAM,KACf,QAAQ,GAAG,IAAX;IACE,KAAK;KACH,IAAI,CAAE,MAAM,KAAKC,WAAW,gBAAgB,UAAU,EAAE,GACtD,OAAO;KAET;IACF,KAAK;KACH,IAAI,CAAE,MAAM,KAAKH,WAAW,gBAAgB,UAAU,EAAE,GACtD,OAAO;KAET;IACF,KAAK,UAEH;GACJ;EAEJ,SAAS,GAAG;GACV,UAAU;GACV,MAAM;EACR,UAAU;GACR,IAAI;IACF,KAAKR,iBAAiB,SAAS;GACjC,SAAS,eAAe;IACtB,IAAI,YAAY,KAAA,GAAW;KACzB,MAAM,gCAAgB,IAAI,MACxB,sEAAsE,OAAO,OAAO,EAAE,qBAAqB,OAAO,aAAa,GACjI;KACA,cAAc,QAAQ;KACtB,MAAM;IACR;IACA,MAAM;GACR;EACF;EAEA,OAAO;CACT;CAEA,aAAa,KAA4C;EACvD,OAAO,IAAI,KAAI,OAAM;GACnB,IAAI,GAAG,OAAO,UAAU;IAEtB,IADuB,KAAKY,mBAAmB,EAC3C,GACF,OAAO;KACL,IAAI;KACJ,WAAW,GAAG;KACd,YAAY,GAAG;KACf,OAAO,GAAG;IACZ;IAEF,OAAO;KACL,IAAI;KACJ,WAAW,GAAG;KACd,YAAY,GAAG;KACf,OAAO,GAAG;IACZ;GACF;GACA,OAAO;EACT,CAAC;CACH;CAEA,mBAAmB,KAAqB;EACtC,KAAK,MAAM,MAAM,KACf,IAAI,CAAC,KAAKd,YAAY,IAAI,GAAG,SAAS,GACpC,MAAM,IAAI,MAAM,UAAU,GAAG,UAAU,wBAAwB;CAGrE;CAEA,WAAW,OAAc,UAAkC,IAAc;EACvE,OAAO,KAAKe,YAAY,OAAO,UAAU,UAAU,EAAE;CACvD;CAEA,WAAW,OAAc,UAAkC,IAAc;EACvE,OAAO,KAAKA,YAAY,OAAO,UAAU,UAAU,EAAE;CACvD;CAEA,WAAW,OAAc,UAAkC,IAAc;EACvE,OAAO,KAAKA,YAAY,OAAO,UAAU,UAAU,EAAE;CACvD;;;;;;;CAQA,eACE,WACA,SACmC;EACnC,MAAM,YAAY,KAAKf,YAAY,IAAI,SAAS;EAChD,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,SAAS,UAAU,WAAW;EAEhD,MAAM,UAAU,UAAU,UAAU;EAGpC,MAAM,SAA4C,CAAC;EACnD,KAAK,MAAM,OAAO,SAAS;GACzB,MAAM,MAAM,QAAQ;GACpB,IAAI,QAAQ,KAAA,GACV,MAAM,IAAI,MACR,uBAAuB,IAAI,8CAA8C,WAC3E;GAEF,OAAO,OAAO;EAChB;EAEA,OAAO;CACT;CAEA,WAAW,WAAmB;EAC5B,IAAI,SAAS,KAAKC,QAAQ,IAAI,SAAS;EACvC,IAAI,QACF,OAAO;EAET,MAAM,YAAY,KAAKD,YAAY,IAAI,SAAS;EAChD,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,SAAS,UAAU,WAAW;EAEhD,MAAM,EAAC,SAAS,eAAc,UAAU;EACxC,OACE,WAAW,cACL,SAAS,UAAU,yBAC3B;EACA,SAAS,IAAI,YACX,KAAKG,KACL,KAAKE,YACL,KAAKP,UACL,WACA,OAAO,YACL,OAAO,QAAQ,OAAO,EAAE,KAAK,CAAC,MAAM,EAAC,gBAAe,CAClD,MACA,gCAAgC,QAAQ,CAC1C,CAAC,CACH,GACA,CAAC,WAAW,IAAI,GAAG,WAAW,MAAM,CAAC,CAAC,CACxC;EACA,KAAKG,QAAQ,IAAI,WAAW,MAAM;EAElC,OAAO;CACT;CAEA,MAAMc,YACJ,OACA,QACA,UACA,IACA;EACA,MAAM,QAAQ,YAAY,IAAI;EAC9B,IAAI;GAEF,OAAO,MADW,KAAKC,OAAO,OAAO,QAAQ,UAAU,EAAE;EAE3D,UAAU;GACR,KAAKb,IAAI,OACP,WACA,QACA,aACA,YAAY,IAAI,IAAI,OACpB,cACA,GAAG,WACH,eACA,GAAG,UACL;EACF;CACF;;;;;;;;;;;CAYA,MAAMa,OACJ,OACA,QACA,UACA,IACA;EACA,MAAM,QAAQ,KAAK,KAAKP,kBAAkB,GAAG,aAAa,SACxD,GAAG;EAEL,MAAM,cAAc,OAAO;EAC3B,IAAI,WAAW,eAAe,KAAKZ,SAAS,GAAG,SAAS;EAExD,MAAM,mBAAmB,KAAKoB,eAAe,GAAG,WAAW,GAAG,KAAK;EAEnE,KAAK,MAAM,MAAM,kBACf,WAAW,SAAS,MAAM,IAAI,KAAK,iBAAiB,GAAG;EAGzD,IAAI;EACJ,QAAQ,QAAR;GACE,KAAK;IACH,IAAI,UAAU,gBACZ,sBAAsB,aAAa;IAErC;GACF,KAAK;IACH,IAAI,UAAU,eACZ,sBAAsB,aAAa,QAAQ;SACtC,IAAI,UAAU,gBACnB,sBAAsB,aAAa,QAAQ;IAE7C;GACF,KAAK;IACH,IAAI,UAAU,eACZ,sBAAsB,aAAa;IAErC;EACJ;EAEA,MAAM,eAAe,OAAO;EAC5B,MAAM,yBAAmC,CAAC;EAC1C,IAAI,cACF,KAAK,MAAM,CAAC,QAAQ,WAAW,OAAO,QAAQ,YAAY,GAAG;GAC3D,IAAI,WAAW,YAAY,GAAG,MAAM,YAAY,KAAA,GAG9C;GAEF,QAAQ,QAAR;IACE,KAAK;KACH,IAAI,OAAO,UAAU,UAAU,gBAC7B,uBAAuB,KAAK,OAAO,MAAM;KAE3C;IACF,KAAK;KACH,IAAI,UAAU,iBAAiB,OAAO,QAAQ,aAC5C,uBAAuB,KAAK,OAAO,OAAO,WAAW;KAEvD,IAAI,UAAU,kBAAkB,OAAO,QAAQ,cAC7C,uBAAuB,KAAK,OAAO,OAAO,YAAY;KAExD;IACF,KAAK;KACH,IAAI,OAAO,UAAU,UAAU,eAC7B,uBAAuB,KAAK,OAAO,MAAM;KAE3C;GACJ;EACF;EAGF,IACE,CAAE,MAAM,KAAKC,mBACX,qBACA,wBACA,UACA,QACF,GACA;GAIA,KAAKf,IAAI,OAAO,2BAA2B;IACzC;IACA;IACA,WAAW,GAAG;IACd,SAAS,OAAO,KAAK,GAAG,KAAK;IAC7B,WAAW,wBAAwB,KAAA;IACnC,iBAAiB,uBAAuB;GAC1C,CAAC;GACD,OAAO;EACT;EAEA,OAAO;CACT;CAEA,mBAAmB,IAAoC;EACrD,MAAM,EAAC,UAAS;EAEhB,MAAM,mBAAmB,KAAKc,eAAe,GAAG,WAAW,KAAK;EAEhE,MAAM,OAAO,KAAKjB,YAAY,IAAI,GAAG,SAAS;EAC9C,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,SAAS,GAAG,UAAU,WAAW;EAGnD,MAAM,aAAyB,CAAC;EAChC,MAAM,SAA4B,CAAC;EACnC,KAAK,MAAM,MAAM,kBAAkB;GACjC,WAAW,KAAK,GAAG,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG;GACvC,OAAO,KAAK,MAAQ,iBAAiB,KAAK,qBAAqB,CAAC;EAClE;EAEA,MAAM,MAAM,KAAKE,iBAAiB,IAChC,QACE,GAAG,UAAU,IAAI,KACf,OAAO,KAAK,KAAK,OAAO,EAAE,KAAI,MAAK,IAAI,MAAM,CAAC,CAAC,GAC/C,GAAG,GACL,EAAE,QAAQ,IAAI,MAAM,GAAG,SAAS,EAAE,SAAS,IAAI,KAC7C,YACA,GAAG,OACL,GACF,GACA,GAAG,MACL;EACA,IAAI,QAAQ,KAAA,GACV,OAAO;EAET,OAAO,gBAAgB,KAAK,SAAS,KAAK,GAAG,SAAS;CACxD;CAEA,uBAAuB,IAAyB;EAC9C,MAAM,MAAM,KAAKY,mBAAmB,EAAE;EACtC,OACE,QAAQ,KAAA,SACF,kCAAkC,KAAK,UAAU,GAAG,KAAK,GACjE;EACA,OAAO;CACT;CAEA,MAAMI,mBACJ,qBACA,wBACA,UACA,UACA;EACA,IAAI,CAAE,MAAM,KAAKC,cAAc,qBAAqB,UAAU,QAAQ,GACpE,OAAO;EAGT,KAAK,MAAM,UAAU,wBACnB,IAAI,CAAE,MAAM,KAAKA,cAAc,QAAQ,UAAU,QAAQ,GACvD,OAAO;EAIX,OAAO;CACT;;;;;CAMA,cACE,QACA,UACA,UACuB;EACvB,IAAI,WAAW,KAAA,GACb,OAAO;EAET,IAAI,OAAO,WAAW,GACpB,OAAO;EAET,IAAI,cAAc,iBAAiB,QAAQ,EAAE;EAC7C,cAAc,qBACZ;GACE,GAAG;GACH,OAAO,YAAY,YAAY,OAAO,MAAM;EAC9C,GACA;GACY;GACV,gBAAgB,KAAA;EAClB,CACF;EAMA,MAAM,QAAQ,cAAc,aAAa,KAAKpB,kBAAkB,UAAU;EAC1E,IAAI;GACF,MAAM,MAAM,MAAM,MAAM,CAAC,CAAC;GAC1B,KAAK,MAAM,KAAK,KAGd,OAAO;EAEX,UAAU;GACR,MAAM,QAAQ;EAChB;EAGA,OAAO;CACT;AACF;AAEA,SAAS,YAAY,OAA8B,QAAgB;CACjE,OAAO,OAAO,2CAA2C;CAEzD,OAAO,kBAAkB;EACvB,MAAM;EACN,YAAY,CACV,OACA;GACE,MAAM;GACN,YAAY,OAAO,KAAK,CAAC,QAAQ,UAAU;IACzC,OAAO,QAAQ,kCAAkC;IACjD,OAAO;GACT,CAAC;EACH,CACF;CACF,CAAC;AACH"}

package/out/zero-cache/src/config/normalize.d.ts

@@ -20,6 +20,11 @@ export type NormalizedZeroConfig = ZeroConfig & {
 };
 export type LitestreamConfig = NormalizedZeroConfig['litestream'];
 export declare function isDevelopmentMode(): boolean;
+/**
+ * Whether this process tree runs the change-streamer, as opposed to connecting
+ * to one that another task runs.
+ */
+export declare function runsChangeStreamer(config: ZeroConfig): boolean;
 export declare function assertNormalized(config: ZeroConfig): asserts config is NormalizedZeroConfig;
 /**
  * Normalizes the parsed `config` by setting defaults from the environment

package/out/zero-cache/src/config/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/config/normalize.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAIjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,qEAAqE;AACrE,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE;QACd,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,MAAM,EAAE;QACN,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,GAAG,EAAE;QACH,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;AAElE,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AASD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,MAAM,IAAI,oBAAoB,CAuDxC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,aAAa,CAAC,EAAE,MAAM,GACrB,oBAAoB,CA8EtB"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/config/normalize.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAIjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,qEAAqE;AACrE,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE;QACd,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,MAAM,EAAE;QACN,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,GAAG,EAAE;QACH,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;AAElE,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AASD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAG9D;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,MAAM,IAAI,oBAAoB,CAwFxC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,aAAa,CAAC,EAAE,MAAM,GACrB,oBAAoB,CA8EtB"}

package/out/zero-cache/src/config/normalize.js

@@ -10,13 +10,25 @@ function isRunningInECS() {
 	return process.env.ECS_CONTAINER_METADATA_URI_V4 !== void 0;
 }
 var DEFAULT_ECS_KEEPALIVE_TIMEOUT_MS = 2e4;
+/**
+* Whether this process tree runs the change-streamer, as opposed to connecting
+* to one that another task runs.
+*/
+function runsChangeStreamer(config) {
+	const { mode, uri } = config.changeStreamer;
+	return mode === "dedicated" && uri === void 0;
+}
 function assertNormalized(config) {
 	assert(config.taskID, "missing --task-id");
 	assert(config.changeStreamer.port, "missing --change-streamer-port");
 	assert(config.changeStreamer.address, "missing --change-streamer-address");
-	const { sqliteChangeLogMode, sqliteChangeLogReadPercent, sqliteChangeLogRetentionMs, sqliteChangeLogReadBatchRows, sqliteChangeLogPurgeBatchRows, sqliteChangeLogBarrierTimeoutMs } = config.changeStreamer;
+	const { sqliteChangeLogMode, sqliteChangeLogReadPercent, sqliteChangeLogColdReadPercent, sqliteChangeLogComparePercent, sqliteChangeLogRetentionMs, sqliteChangeLogReadBatchRows, sqliteChangeLogPurgeBatchRows, sqliteChangeLogBarrierTimeoutMs } = config.changeStreamer;
 	assert(Number.isSafeInteger(sqliteChangeLogReadPercent) && sqliteChangeLogReadPercent >= 0 && sqliteChangeLogReadPercent <= 100, "--change-streamer-sqlite-change-log-read-percent must be an integer between 0 and 100");
+	assert(Number.isSafeInteger(sqliteChangeLogColdReadPercent) && sqliteChangeLogColdReadPercent >= 0 && sqliteChangeLogColdReadPercent <= 100, "--change-streamer-sqlite-change-log-cold-read-percent must be an integer between 0 and 100");
+	assert(Number.isSafeInteger(sqliteChangeLogComparePercent) && sqliteChangeLogComparePercent >= 0 && sqliteChangeLogComparePercent <= 100, "--change-streamer-sqlite-change-log-compare-percent must be an integer between 0 and 100");
 	assert(sqliteChangeLogMode === "serve" || sqliteChangeLogReadPercent === 0, "--change-streamer-sqlite-change-log-read-percent must be 0 unless --change-streamer-sqlite-change-log-mode=serve");
+	assert(sqliteChangeLogMode === "serve" || sqliteChangeLogColdReadPercent === 0, "--change-streamer-sqlite-change-log-cold-read-percent must be 0 unless --change-streamer-sqlite-change-log-mode=serve");
+	assert(sqliteChangeLogReadPercent > 0 || sqliteChangeLogColdReadPercent === 0, "--change-streamer-sqlite-change-log-cold-read-percent must be 0 when --change-streamer-sqlite-change-log-read-percent is 0");
 	for (const [flag, value] of [
 		["retention-ms", sqliteChangeLogRetentionMs],
 		["read-batch-rows", sqliteChangeLogReadBatchRows],
@@ -25,7 +37,8 @@ function assertNormalized(config) {
 	]) assert(Number.isSafeInteger(value) && value > 0, `--change-streamer-sqlite-change-log-${flag} must be a positive integer`);
 	assert(config.litestream.port, "missing --litestream-port");
 	assert(!config.litestream.backupUsingV5 || config.litestream.restoreUsingV5, "--litestream-backup-using-v5 requires --litestream-restore-using-v5");
-	assert(!config.litestream.backupURL || config.litestream.executableV5 || !(config.litestream.restoreUsingV5 || config.litestream.backupUsingV5), "--litestream-restore-using-v5 and --litestream-backup-using-v5 require --litestream-executable to be specified");
+	assert(!config.litestream.backupURL || config.litestream.executableV5 || !(config.litestream.restoreUsingV5 || config.litestream.backupUsingV5), "--litestream-restore-using-v5 and --litestream-backup-using-v5 require --litestream-executable-v5 to be specified");
+	assert(!config.litestream.backupURL || !config.litestream.backupUsingV5 || config.litestream.vfsQueryExecutable, "--litestream-backup-using-v5 requires --litestream-vfs-query-executable to be specified");
 	assert(config.change.db, "missing --change-db");
 	assert(config.cvr.db, "missing --cvr-db");
 	assertNotUndefined(config.numSyncWorkers, "missing --num-sync-workers");
@@ -103,6 +116,6 @@ function normalizeZeroConfig(lc, config, env, defaultTaskID) {
 	};
 }
 //#endregion
-export { assertNormalized, isDevelopmentMode, normalizeZeroConfig };
+export { assertNormalized, isDevelopmentMode, normalizeZeroConfig, runsChangeStreamer };
 
 //# sourceMappingURL=normalize.js.map