@rocicorp/zero 1.11.3 → 1.11.5

package/out/replicache/src/sync/request-id.js

@@ -1,10 +1,10 @@
-import { getNonCryptoRandomValues } from "../../../shared/src/random-values.js";
+import { getRandomValues } from "../../../shared/src/random-values.js";
 //#region ../replicache/src/sync/request-id.ts
 var sessionID = "";
 function getSessionID() {
 	if (sessionID === "") {
 		const buf = /* @__PURE__ */ new Uint8Array(4);
-		getNonCryptoRandomValues(buf);
+		getRandomValues(buf);
 		sessionID = Array.from(buf, (x) => x.toString(16)).join("");
 	}
 	return sessionID;

package/out/replicache/src/sync/request-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-id.js","names":[],"sources":["../../../../../replicache/src/sync/request-id.ts"],"sourcesContent":["import {getNonCryptoRandomValues} from '../../../shared/src/random-values.ts';\nimport type {ClientID} from './ids.ts';\n\nlet sessionID = '';\nfunction getSessionID() {\n  if (sessionID === '') {\n    const buf = new Uint8Array(4);\n    getNonCryptoRandomValues(buf);\n    sessionID = Array.from(buf, x => x.toString(16)).join('');\n  }\n  return sessionID;\n}\n\nconst REQUEST_COUNTERS: Map<string, number> = new Map();\n\n/**\n * Returns a new requestID of the form <client ID>-<session ID>-<request\n * count>. The request count enables one to find the request following or\n * preceding a given request. The sessionid scopes the request count, ensuring\n * the requestID is probabilistically unique across restarts (which is good\n * enough).\n */\nexport function newRequestID(clientID: ClientID): string {\n  const counter = REQUEST_COUNTERS.get(clientID) ?? 0;\n  REQUEST_COUNTERS.set(clientID, counter + 1);\n  return `${clientID}-${getSessionID()}-${counter}`;\n}\n"],"mappings":";;AAGA,IAAI,YAAY;AAChB,SAAS,eAAe;CACtB,IAAI,cAAc,IAAI;EACpB,MAAM,sBAAM,IAAI,WAAW,CAAC;EAC5B,yBAAyB,GAAG;EAC5B,YAAY,MAAM,KAAK,MAAK,MAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE;CAC1D;CACA,OAAO;AACT;AAEA,IAAM,mCAAwC,IAAI,IAAI;;;;;;;;AAStD,SAAgB,aAAa,UAA4B;CACvD,MAAM,UAAU,iBAAiB,IAAI,QAAQ,KAAK;CAClD,iBAAiB,IAAI,UAAU,UAAU,CAAC;CAC1C,OAAO,GAAG,SAAS,GAAG,aAAa,EAAE,GAAG;AAC1C"}
+{"version":3,"file":"request-id.js","names":[],"sources":["../../../../../replicache/src/sync/request-id.ts"],"sourcesContent":["import {getRandomValues} from '../../../shared/src/random-values.ts';\nimport type {ClientID} from './ids.ts';\n\nlet sessionID = '';\nfunction getSessionID() {\n  if (sessionID === '') {\n    const buf = new Uint8Array(4);\n    getRandomValues(buf);\n    sessionID = Array.from(buf, x => x.toString(16)).join('');\n  }\n  return sessionID;\n}\n\nconst REQUEST_COUNTERS: Map<string, number> = new Map();\n\n/**\n * Returns a new requestID of the form <client ID>-<session ID>-<request\n * count>. The request count enables one to find the request following or\n * preceding a given request. The sessionid scopes the request count, ensuring\n * the requestID is probabilistically unique across restarts (which is good\n * enough).\n */\nexport function newRequestID(clientID: ClientID): string {\n  const counter = REQUEST_COUNTERS.get(clientID) ?? 0;\n  REQUEST_COUNTERS.set(clientID, counter + 1);\n  return `${clientID}-${getSessionID()}-${counter}`;\n}\n"],"mappings":";;AAGA,IAAI,YAAY;AAChB,SAAS,eAAe;CACtB,IAAI,cAAc,IAAI;EACpB,MAAM,sBAAM,IAAI,WAAW,CAAC;EAC5B,gBAAgB,GAAG;EACnB,YAAY,MAAM,KAAK,MAAK,MAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE;CAC1D;CACA,OAAO;AACT;AAEA,IAAM,mCAAwC,IAAI,IAAI;;;;;;;;AAStD,SAAgB,aAAa,UAA4B;CACvD,MAAM,UAAU,iBAAiB,IAAI,QAAQ,KAAK;CAClD,iBAAiB,IAAI,UAAU,UAAU,CAAC;CAC1C,OAAO,GAAG,SAAS,GAAG,aAAa,EAAE,GAAG;AAC1C"}

package/out/shared/src/bigint-json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bigint-json.d.ts","sourceRoot":"","sources":["../../../../shared/src/bigint-json.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAYjC,MAAM,MAAM,SAAS,GACjB,IAAI,GACJ,MAAM,GACN,MAAM,GACN,MAAM,GACN,OAAO,GACP,SAAS,SAAS,EAAE,GACpB,UAAU,CAAC;AAEf,MAAM,MAAM,UAAU,GAAG;IAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;CAAC,CAAC;AAE1E,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAY5C,CAAC;AAEH,eAAO,MAAM,gBAAgB,6CAAwC,CAAC;AAEtE;;;GAGG;AACH,wBAAgB,KAAK,CACnB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,GAC3C,SAAS,CAEX;AAOD;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,OAAO,EACZ,QAAQ,CAAC,EACL,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GACnB,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,GAC1C,IAAI,EACR,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,UAGzB;AAED,eAAO,MAAM,UAAU;;;CAGb,CAAC"}
+{"version":3,"file":"bigint-json.d.ts","sourceRoot":"","sources":["../../../../shared/src/bigint-json.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAYjC,MAAM,MAAM,SAAS,GACjB,IAAI,GACJ,MAAM,GACN,MAAM,GACN,MAAM,GACN,OAAO,GACP,SAAS,SAAS,EAAE,GACpB,UAAU,CAAC;AAEf,MAAM,MAAM,UAAU,GAAG;IAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;CAAC,CAAC;AAE1E,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAY5C,CAAC;AAEH,eAAO,MAAM,gBAAgB,6CAAwC,CAAC;AAEtE;;;GAGG;AACH,wBAAgB,KAAK,CACnB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,GAC3C,SAAS,CAEX;AAcD;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,OAAO,EACZ,QAAQ,CAAC,EACL,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GACnB,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,GAC1C,IAAI,EACR,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,UAGzB;AAED,eAAO,MAAM,UAAU;;;CAGb,CAAC"}

package/out/shared/src/bigint-json.js

@@ -26,6 +26,7 @@ function parse$1(str, reviver) {
 }
 function customSerializer(_, v, type) {
 	if (type === "bigint") return v.toString();
+	if (type === "number" && Number.isInteger(v) && !Number.isSafeInteger(v)) return v.toExponential();
 }
 /**
 * Stringifies objects to JSON, supporting objects containing bigint values.

package/out/shared/src/bigint-json.js.map

@@ -1 +1 @@
-{"version":3,"file":"bigint-json.js","names":["v","v.readonly","parse","customParse","stringify","customStringify"],"sources":["../../../../shared/src/bigint-json.ts"],"sourcesContent":["/**\n * Background for using `json-custom-numbers`:\n *\n * https://neon.tech/blog/parsing-json-from-postgres-in-js\n */\nimport {\n  parse as customParse,\n  stringify as customStringify,\n} from 'json-custom-numbers';\nimport * as v from './valita.ts';\n\nfunction numberParser(_: unknown, v: string) {\n  const n = +v;\n  if (n >= Number.MIN_SAFE_INTEGER && n <= Number.MAX_SAFE_INTEGER) return n;\n  if (v.includes('.') || v.includes('e') || v.includes('E')) {\n    return n;\n  }\n  return BigInt(v);\n}\n\n// Variant of postgres.JSONValue adapted to include bigints\nexport type JSONValue =\n  | null\n  | string\n  | number\n  | bigint\n  | boolean\n  | readonly JSONValue[]\n  | JSONObject;\n\nexport type JSONObject = {readonly [prop: string]: JSONValue | undefined};\n\nexport const jsonValueSchema: v.Type<JSONValue> = v.lazy(() => {\n  const jsonObjectSchema = v.readonly(v.record(jsonValueSchema));\n\n  return v.union(\n    v.null(),\n    v.string(),\n    v.number(),\n    v.bigint(),\n    v.boolean(),\n    v.readonly(v.array(jsonValueSchema)),\n    jsonObjectSchema,\n  );\n});\n\nexport const jsonObjectSchema = v.readonly(v.record(jsonValueSchema));\n\n/**\n * Parses JSON strings that may contain arbitrarily large integers. Integers\n * larger than {@link Number.MAX_SAFE_INTEGER} are deserialized as a `bigint`.\n */\nexport function parse(\n  str: string,\n  reviver?: (k: string, v: unknown) => unknown,\n): JSONValue {\n  return customParse(str, reviver, numberParser);\n}\n\n// oxlint-disable-next-line @typescript-eslint/no-explicit-any\nfunction customSerializer(_: string, v: any, type: string) {\n  if (type === 'bigint') return v.toString();\n}\n\n/**\n * Stringifies objects to JSON, supporting objects containing bigint values.\n * Note that the resulting JSON string may not be deserializable by\n * all environments, but it is supported by Postgres. The string should be\n * deserialized with the corresponding {@link parse} method that will represent\n * large numbers as bigints. From there it is up to the application to suitably\n * handle bigints passed to downstream logic.\n */\nexport function stringify(\n  obj: unknown,\n  replacer?:\n    | (string | number)[]\n    | ((key: string, value: unknown) => unknown)\n    | null,\n  indent?: string | number,\n) {\n  return customStringify(obj, replacer, indent, customSerializer);\n}\n\nexport const BigIntJSON = {\n  parse,\n  stringify,\n} as const;\n"],"mappings":";;;;;;;;AAWA,SAAS,aAAa,GAAY,GAAW;CAC3C,MAAM,IAAI,CAAC;CACX,IAAI,KAAK,OAAO,oBAAoB,KAAK,OAAO,kBAAkB,OAAO;CACzE,IAAI,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,GACtD,OAAO;CAET,OAAO,OAAO,CAAC;AACjB;AAcA,IAAa,kBAAqCA,eAAE,WAAW;CAC7D,MAAM,mBAAmBC,SAAWD,eAAE,OAAO,eAAe,CAAC;CAE7D,OAAOA,eAAE,MACPA,eAAE,KAAK,GACPA,eAAE,OAAO,GACTA,eAAE,OAAO,GACTA,eAAE,OAAO,GACTA,eAAE,QAAQ,GACVC,SAAWD,eAAE,MAAM,eAAe,CAAC,GACnC,gBACF;AACF,CAAC;AAED,IAAa,mBAAmBC,SAAWD,eAAE,OAAO,eAAe,CAAC;;;;;AAMpE,SAAgBE,QACd,KACA,SACW;CACX,OAAOC,MAAY,KAAK,SAAS,YAAY;AAC/C;AAGA,SAAS,iBAAiB,GAAW,GAAQ,MAAc;CACzD,IAAI,SAAS,UAAU,OAAO,EAAE,SAAS;AAC3C;;;;;;;;;AAUA,SAAgBC,YACd,KACA,UAIA,QACA;CACA,OAAOC,UAAgB,KAAK,UAAU,QAAQ,gBAAgB;AAChE;AAEA,IAAa,aAAa;CACxB,OAAA;CACA,WAAA;AACF"}
+{"version":3,"file":"bigint-json.js","names":["v","v.readonly","parse","customParse","stringify","customStringify"],"sources":["../../../../shared/src/bigint-json.ts"],"sourcesContent":["/**\n * Background for using `json-custom-numbers`:\n *\n * https://neon.tech/blog/parsing-json-from-postgres-in-js\n */\nimport {\n  parse as customParse,\n  stringify as customStringify,\n} from 'json-custom-numbers';\nimport * as v from './valita.ts';\n\nfunction numberParser(_: unknown, v: string) {\n  const n = +v;\n  if (n >= Number.MIN_SAFE_INTEGER && n <= Number.MAX_SAFE_INTEGER) return n;\n  if (v.includes('.') || v.includes('e') || v.includes('E')) {\n    return n;\n  }\n  return BigInt(v);\n}\n\n// Variant of postgres.JSONValue adapted to include bigints\nexport type JSONValue =\n  | null\n  | string\n  | number\n  | bigint\n  | boolean\n  | readonly JSONValue[]\n  | JSONObject;\n\nexport type JSONObject = {readonly [prop: string]: JSONValue | undefined};\n\nexport const jsonValueSchema: v.Type<JSONValue> = v.lazy(() => {\n  const jsonObjectSchema = v.readonly(v.record(jsonValueSchema));\n\n  return v.union(\n    v.null(),\n    v.string(),\n    v.number(),\n    v.bigint(),\n    v.boolean(),\n    v.readonly(v.array(jsonValueSchema)),\n    jsonObjectSchema,\n  );\n});\n\nexport const jsonObjectSchema = v.readonly(v.record(jsonValueSchema));\n\n/**\n * Parses JSON strings that may contain arbitrarily large integers. Integers\n * larger than {@link Number.MAX_SAFE_INTEGER} are deserialized as a `bigint`.\n */\nexport function parse(\n  str: string,\n  reviver?: (k: string, v: unknown) => unknown,\n): JSONValue {\n  return customParse(str, reviver, numberParser);\n}\n\n// oxlint-disable-next-line @typescript-eslint/no-explicit-any\nfunction customSerializer(_: string, v: any, type: string) {\n  if (type === 'bigint') return v.toString();\n  // An integer beyond the safe range is a rounded double if it is a number, so\n  // it is written in a form that parse() keeps as a number. As digits it would\n  // come back as a bigint, and not even the same value, since a double prints\n  // only the digits that identify it: 2^62 is 4611686018427388000.\n  if (type === 'number' && Number.isInteger(v) && !Number.isSafeInteger(v)) {\n    return v.toExponential();\n  }\n}\n\n/**\n * Stringifies objects to JSON, supporting objects containing bigint values.\n * Note that the resulting JSON string may not be deserializable by\n * all environments, but it is supported by Postgres. The string should be\n * deserialized with the corresponding {@link parse} method that will represent\n * large numbers as bigints. From there it is up to the application to suitably\n * handle bigints passed to downstream logic.\n */\nexport function stringify(\n  obj: unknown,\n  replacer?:\n    | (string | number)[]\n    | ((key: string, value: unknown) => unknown)\n    | null,\n  indent?: string | number,\n) {\n  return customStringify(obj, replacer, indent, customSerializer);\n}\n\nexport const BigIntJSON = {\n  parse,\n  stringify,\n} as const;\n"],"mappings":";;;;;;;;AAWA,SAAS,aAAa,GAAY,GAAW;CAC3C,MAAM,IAAI,CAAC;CACX,IAAI,KAAK,OAAO,oBAAoB,KAAK,OAAO,kBAAkB,OAAO;CACzE,IAAI,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,GACtD,OAAO;CAET,OAAO,OAAO,CAAC;AACjB;AAcA,IAAa,kBAAqCA,eAAE,WAAW;CAC7D,MAAM,mBAAmBC,SAAWD,eAAE,OAAO,eAAe,CAAC;CAE7D,OAAOA,eAAE,MACPA,eAAE,KAAK,GACPA,eAAE,OAAO,GACTA,eAAE,OAAO,GACTA,eAAE,OAAO,GACTA,eAAE,QAAQ,GACVC,SAAWD,eAAE,MAAM,eAAe,CAAC,GACnC,gBACF;AACF,CAAC;AAED,IAAa,mBAAmBC,SAAWD,eAAE,OAAO,eAAe,CAAC;;;;;AAMpE,SAAgBE,QACd,KACA,SACW;CACX,OAAOC,MAAY,KAAK,SAAS,YAAY;AAC/C;AAGA,SAAS,iBAAiB,GAAW,GAAQ,MAAc;CACzD,IAAI,SAAS,UAAU,OAAO,EAAE,SAAS;CAKzC,IAAI,SAAS,YAAY,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,GACrE,OAAO,EAAE,cAAc;AAE3B;;;;;;;;;AAUA,SAAgBC,YACd,KACA,UAIA,QACA;CACA,OAAOC,UAAgB,KAAK,UAAU,QAAQ,gBAAgB;AAChE;AAEA,IAAa,aAAa;CACxB,OAAA;CACA,WAAA;AACF"}

package/out/shared/src/headers.d.ts

@@ -0,0 +1,12 @@
+export declare function encodeHeaderValue(value: string): string;
+export declare function decodeHeaderValue(encoded: string): string;
+/**
+ * Returns the token of an `Authorization: Bearer <token>` header value, or
+ * `undefined` if there is no value or it uses another scheme.
+ */
+export declare function getBearerToken(authorization: string | undefined): string | undefined;
+/**
+ * Formats `token` as the value of an `Authorization: Bearer <token>` header.
+ */
+export declare function bearerAuthorization(token: string): string;
+//# sourceMappingURL=headers.d.ts.map

package/out/shared/src/headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../../../../shared/src/headers.ts"],"names":[],"mappings":"AAAA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWvD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzD;AAQD;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,MAAM,GAAG,SAAS,CAIpB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/out/shared/src/headers.js

@@ -0,0 +1,20 @@
+//#region ../shared/src/headers.ts
+var BEARER_PREFIX = "Bearer ";
+var BEARER_PATTERN = /^bearer +(.*)$/i;
+/**
+* Returns the token of an `Authorization: Bearer <token>` header value, or
+* `undefined` if there is no value or it uses another scheme.
+*/
+function getBearerToken(authorization) {
+	return authorization === void 0 ? void 0 : BEARER_PATTERN.exec(authorization)?.[1];
+}
+/**
+* Formats `token` as the value of an `Authorization: Bearer <token>` header.
+*/
+function bearerAuthorization(token) {
+	return BEARER_PREFIX + token;
+}
+//#endregion
+export { bearerAuthorization, getBearerToken };
+
+//# sourceMappingURL=headers.js.map

package/out/shared/src/headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.js","names":[],"sources":["../../../../shared/src/headers.ts"],"sourcesContent":["export function encodeHeaderValue(value: string): string {\n  // encodeURIComponent escapes the following chars which are allowed\n  // in header values.\n  // : ; , / \" ? { } [ ] @ < > = + # $ & ` | ^ space and %\n  // Unescape all of them expect %, to make the encoded value smaller and more\n  // readable.  Do not unescape % as that would break decoding of the\n  // percent decoding done by encodeURIComponent.\n  return encodeURIComponent(value).replace(\n    /%(3A|3B|2C|2F|22|3F|7B|7D|5B|5D|40|3C|3E|3D|2B|23|24|26|60|7C|5E|20)/g,\n    (_, hex) => String.fromCharCode(parseInt(hex, 16)),\n  );\n}\n\nexport function decodeHeaderValue(encoded: string): string {\n  return decodeURIComponent(encoded);\n}\n\nconst BEARER_PREFIX = 'Bearer ';\n\n// RFC 9110: the scheme is case-insensitive and is followed by one or more\n// spaces.\nconst BEARER_PATTERN = /^bearer +(.*)$/i;\n\n/**\n * Returns the token of an `Authorization: Bearer <token>` header value, or\n * `undefined` if there is no value or it uses another scheme.\n */\nexport function getBearerToken(\n  authorization: string | undefined,\n): string | undefined {\n  return authorization === undefined\n    ? undefined\n    : BEARER_PATTERN.exec(authorization)?.[1];\n}\n\n/**\n * Formats `token` as the value of an `Authorization: Bearer <token>` header.\n */\nexport function bearerAuthorization(token: string): string {\n  return BEARER_PREFIX + token;\n}\n"],"mappings":";AAiBA,IAAM,gBAAgB;AAItB,IAAM,iBAAiB;;;;;AAMvB,SAAgB,eACd,eACoB;CACpB,OAAO,kBAAkB,KAAA,IACrB,KAAA,IACA,eAAe,KAAK,aAAa,CAAC,GAAG;AAC3C;;;;AAKA,SAAgB,oBAAoB,OAAuB;CACzD,OAAO,gBAAgB;AACzB"}

package/out/shared/src/random-uint64.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"random-uint64.d.ts","sourceRoot":"","sources":["../../../../shared/src/random-uint64.ts"],"names":[],"mappings":"AAAA,wBAAgB,YAAY,IAAI,MAAM,CAOrC"}
+{"version":3,"file":"random-uint64.d.ts","sourceRoot":"","sources":["../../../../shared/src/random-uint64.ts"],"names":[],"mappings":"AAEA,wBAAgB,YAAY,IAAI,MAAM,CAKrC"}

package/out/shared/src/random-uint64.js

@@ -1,7 +1,7 @@
+import { getRandomValues } from "./random-values.js";
 //#region ../shared/src/random-uint64.ts
 function randomUint64() {
-	const high = Math.floor(Math.random() * 4294967295);
-	const low = Math.floor(Math.random() * 4294967295);
+	const [high, low] = getRandomValues(/* @__PURE__ */ new Uint32Array(2));
 	return BigInt(high) << 32n | BigInt(low);
 }
 //#endregion

package/out/shared/src/random-uint64.js.map

@@ -1 +1 @@
-{"version":3,"file":"random-uint64.js","names":[],"sources":["../../../../shared/src/random-uint64.ts"],"sourcesContent":["export function randomUint64(): bigint {\n  // Generate two random 32-bit unsigned integers using Math.random()\n  const high = Math.floor(Math.random() * 0xffffffff); // High 32 bits\n  const low = Math.floor(Math.random() * 0xffffffff); // Low 32 bits\n\n  // Combine the high and low parts to form a 64-bit unsigned integer\n  return (BigInt(high) << 32n) | BigInt(low);\n}\n"],"mappings":";AAAA,SAAgB,eAAuB;CAErC,MAAM,OAAO,KAAK,MAAM,KAAK,OAAO,IAAI,UAAU;CAClD,MAAM,MAAM,KAAK,MAAM,KAAK,OAAO,IAAI,UAAU;CAGjD,OAAQ,OAAO,IAAI,KAAK,MAAO,OAAO,GAAG;AAC3C"}
+{"version":3,"file":"random-uint64.js","names":[],"sources":["../../../../shared/src/random-uint64.ts"],"sourcesContent":["import {getRandomValues} from './random-values.ts';\n\nexport function randomUint64(): bigint {\n  // Two random 32-bit words rather than a BigUint64Array, which Hermes did\n  // not have as of September 2024. The result is the same either way.\n  const [high, low] = getRandomValues(new Uint32Array(2));\n  return (BigInt(high) << 32n) | BigInt(low);\n}\n"],"mappings":";;AAEA,SAAgB,eAAuB;CAGrC,MAAM,CAAC,MAAM,OAAO,gCAAgB,IAAI,YAAY,CAAC,CAAC;CACtD,OAAQ,OAAO,IAAI,KAAK,MAAO,OAAO,GAAG;AAC3C"}

package/out/shared/src/random-values.d.ts

@@ -1,3 +1,16 @@
-export declare function getNonCryptoRandomValues(array: Uint8Array): Uint8Array<ArrayBufferLike>;
+/**
+ * Fills `array` with random values. Uses `crypto.getRandomValues` when the
+ * runtime provides it and falls back to `Math.random` otherwise, logging a
+ * warning the first time the fallback is used.
+ *
+ * React Native's Hermes engine has no WebCrypto, so apps running there should
+ * install a polyfill such as `react-native-get-random-values` or `expo-crypto`
+ * before creating IDs.
+ *
+ * The `crypto` global is looked up on every call rather than at module load:
+ * some runtimes (e.g. Cloudflare Workers) only allow generating random values
+ * while handling a request.
+ */
+export declare function getRandomValues<T extends Uint8Array<ArrayBuffer> | Uint32Array<ArrayBuffer>>(array: T): T;
 export declare function randomCharacters(length: number): string;
 //# sourceMappingURL=random-values.d.ts.map

package/out/shared/src/random-values.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"random-values.d.ts","sourceRoot":"","sources":["../../../../shared/src/random-values.ts"],"names":[],"mappings":"AAAA,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,UAAU,+BAWzD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,UAW9C"}
+{"version":3,"file":"random-values.d.ts","sourceRoot":"","sources":["../../../../shared/src/random-values.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,CAAC,SAAS,UAAU,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,EAC5D,KAAK,EAAE,CAAC,GAAG,CAAC,CAmBb;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,UAW9C"}

package/out/shared/src/random-values.js

@@ -1,7 +1,27 @@
 //#region ../shared/src/random-values.ts
-function getNonCryptoRandomValues(array) {
-	if (array === null) throw new TypeError("array cannot be null");
-	for (let i = 0; i < array.length; i++) array[i] = Math.floor(Math.random() * 256);
+var warnedAboutFallback = false;
+/**
+* Fills `array` with random values. Uses `crypto.getRandomValues` when the
+* runtime provides it and falls back to `Math.random` otherwise, logging a
+* warning the first time the fallback is used.
+*
+* React Native's Hermes engine has no WebCrypto, so apps running there should
+* install a polyfill such as `react-native-get-random-values` or `expo-crypto`
+* before creating IDs.
+*
+* The `crypto` global is looked up on every call rather than at module load:
+* some runtimes (e.g. Cloudflare Workers) only allow generating random values
+* while handling a request.
+*/
+function getRandomValues(array) {
+	const { crypto } = globalThis;
+	if (typeof crypto?.getRandomValues === "function") return crypto.getRandomValues(array);
+	if (!warnedAboutFallback) {
+		warnedAboutFallback = true;
+		console.warn("crypto.getRandomValues is not available; falling back to Math.random for IDs. On React Native, install react-native-get-random-values or expo-crypto.");
+	}
+	const max = 2 ** (array.BYTES_PER_ELEMENT * 8);
+	for (let i = 0; i < array.length; i++) array[i] = Math.floor(Math.random() * max);
 	return array;
 }
 function randomCharacters(length) {
@@ -16,6 +36,6 @@ function randomCharacters(length) {
 	return result;
 }
 //#endregion
-export { getNonCryptoRandomValues, randomCharacters };
+export { getRandomValues, randomCharacters };
 
 //# sourceMappingURL=random-values.js.map

package/out/shared/src/random-values.js.map

@@ -1 +1 @@
-{"version":3,"file":"random-values.js","names":[],"sources":["../../../../shared/src/random-values.ts"],"sourcesContent":["export function getNonCryptoRandomValues(array: Uint8Array) {\n  if (array === null) {\n    throw new TypeError('array cannot be null');\n  }\n\n  // Fill the array with random values\n  for (let i = 0; i < array.length; i++) {\n    array[i] = Math.floor(Math.random() * 256); // Random byte (0-255)\n  }\n\n  return array;\n}\n\nexport function randomCharacters(length: number) {\n  let result = '';\n  const characters =\n    'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';\n  const charactersLength = characters.length;\n  let counter = 0;\n  while (counter < length) {\n    result += characters.charAt(Math.floor(Math.random() * charactersLength));\n    counter += 1;\n  }\n  return result;\n}\n"],"mappings":";AAAA,SAAgB,yBAAyB,OAAmB;CAC1D,IAAI,UAAU,MACZ,MAAM,IAAI,UAAU,sBAAsB;CAI5C,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAChC,MAAM,KAAK,KAAK,MAAM,KAAK,OAAO,IAAI,GAAG;CAG3C,OAAO;AACT;AAEA,SAAgB,iBAAiB,QAAgB;CAC/C,IAAI,SAAS;CACb,MAAM,aACJ;CACF,MAAM,mBAAmB;CACzB,IAAI,UAAU;CACd,OAAO,UAAU,QAAQ;EACvB,UAAU,WAAW,OAAO,KAAK,MAAM,KAAK,OAAO,IAAI,gBAAgB,CAAC;EACxE,WAAW;CACb;CACA,OAAO;AACT"}
+{"version":3,"file":"random-values.js","names":[],"sources":["../../../../shared/src/random-values.ts"],"sourcesContent":["let warnedAboutFallback = false;\n\n/**\n * Fills `array` with random values. Uses `crypto.getRandomValues` when the\n * runtime provides it and falls back to `Math.random` otherwise, logging a\n * warning the first time the fallback is used.\n *\n * React Native's Hermes engine has no WebCrypto, so apps running there should\n * install a polyfill such as `react-native-get-random-values` or `expo-crypto`\n * before creating IDs.\n *\n * The `crypto` global is looked up on every call rather than at module load:\n * some runtimes (e.g. Cloudflare Workers) only allow generating random values\n * while handling a request.\n */\nexport function getRandomValues<\n  T extends Uint8Array<ArrayBuffer> | Uint32Array<ArrayBuffer>,\n>(array: T): T {\n  const {crypto} = globalThis;\n  if (typeof crypto?.getRandomValues === 'function') {\n    return crypto.getRandomValues(array);\n  }\n\n  if (!warnedAboutFallback) {\n    warnedAboutFallback = true;\n    // oxlint-disable-next-line no-console\n    console.warn(\n      'crypto.getRandomValues is not available; falling back to Math.random for IDs. ' +\n        'On React Native, install react-native-get-random-values or expo-crypto.',\n    );\n  }\n  const max = 2 ** (array.BYTES_PER_ELEMENT * 8);\n  for (let i = 0; i < array.length; i++) {\n    array[i] = Math.floor(Math.random() * max);\n  }\n  return array;\n}\n\nexport function randomCharacters(length: number) {\n  let result = '';\n  const characters =\n    'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';\n  const charactersLength = characters.length;\n  let counter = 0;\n  while (counter < length) {\n    result += characters.charAt(Math.floor(Math.random() * charactersLength));\n    counter += 1;\n  }\n  return result;\n}\n"],"mappings":";AAAA,IAAI,sBAAsB;;;;;;;;;;;;;;AAe1B,SAAgB,gBAEd,OAAa;CACb,MAAM,EAAC,WAAU;CACjB,IAAI,OAAO,QAAQ,oBAAoB,YACrC,OAAO,OAAO,gBAAgB,KAAK;CAGrC,IAAI,CAAC,qBAAqB;EACxB,sBAAsB;EAEtB,QAAQ,KACN,uJAEF;CACF;CACA,MAAM,MAAM,MAAM,MAAM,oBAAoB;CAC5C,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAChC,MAAM,KAAK,KAAK,MAAM,KAAK,OAAO,IAAI,GAAG;CAE3C,OAAO;AACT;AAEA,SAAgB,iBAAiB,QAAgB;CAC/C,IAAI,SAAS;CACb,MAAM,aACJ;CACF,MAAM,mBAAmB;CACzB,IAAI,UAAU;CACd,OAAO,UAAU,QAAQ;EACvB,UAAU,WAAW,OAAO,KAAK,MAAM,KAAK,OAAO,IAAI,gBAAgB,CAAC;EACxE,WAAW;CACb;CACA,OAAO;AACT"}

package/out/zero/package.js

@@ -1,6 +1,6 @@
 //#region package.json
 var name = "@rocicorp/zero";
-var version = "1.11.3";
+var version = "1.11.5";
 var description = "Zero is a web framework for serverless web development.";
 var homepage = "https://zero.rocicorp.dev";
 var bugs = { "url": "https://bugs.rocicorp.dev" };

package/out/zero/package.js.map

@@ -1 +1 @@
-{"version":3,"file":"package.js","names":[],"sources":["../../package.json"],"sourcesContent":["{\n  \"name\": \"@rocicorp/zero\",\n  \"version\": \"1.11.3\",\n  \"description\": \"Zero is a web framework for serverless web development.\",\n  \"homepage\": \"https://zero.rocicorp.dev\",\n  \"bugs\": {\n    \"url\": \"https://bugs.rocicorp.dev\"\n  },\n  \"license\": \"Apache-2.0\",\n  \"author\": \"Rocicorp, Inc.\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/rocicorp/mono.git\",\n    \"directory\": \"packages/zero\"\n  },\n  \"bin\": {\n    \"analyze-query\": \"./out/zero/src/analyze-query.js\",\n    \"ast-to-zql\": \"./out/zero/src/ast-to-zql.js\",\n    \"transform-query\": \"./out/zero/src/transform-query.js\",\n    \"zero-build-schema\": \"./out/zero/src/build-schema.js\",\n    \"zero-cache\": \"./out/zero/src/cli.js\",\n    \"zero-cache-dev\": \"./out/zero/src/zero-cache-dev.js\",\n    \"zero-deploy-permissions\": \"./out/zero/src/deploy-permissions.js\",\n    \"zero-out\": \"./out/zero/src/zero-out.js\"\n  },\n  \"files\": [\n    \"out\",\n    \"!*.tsbuildinfo\"\n  ],\n  \"type\": \"module\",\n  \"main\": \"out/zero/src/zero.js\",\n  \"module\": \"out/zero/src/zero.js\",\n  \"types\": \"out/zero/src/zero.d.ts\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./out/zero/src/zero.d.ts\",\n      \"default\": \"./out/zero/src/zero.js\"\n    },\n    \"./analyze\": {\n      \"types\": \"./out/zero/src/analyze.d.ts\",\n      \"default\": \"./out/zero/src/analyze.js\"\n    },\n    \"./bindings\": {\n      \"types\": \"./out/zero/src/bindings.d.ts\",\n      \"default\": \"./out/zero/src/bindings.js\"\n    },\n    \"./change-protocol/v0\": {\n      \"types\": \"./out/zero/src/change-protocol/v0.d.ts\",\n      \"default\": \"./out/zero/src/change-protocol/v0.js\"\n    },\n    \"./expo-sqlite\": {\n      \"types\": \"./out/zero/src/expo-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/expo-sqlite.js\"\n    },\n    \"./op-sqlite\": {\n      \"types\": \"./out/zero/src/op-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/op-sqlite.js\"\n    },\n    \"./pg\": {\n      \"types\": \"./out/zero/src/pg.d.ts\",\n      \"default\": \"./out/zero/src/pg.js\"\n    },\n    \"./react\": {\n      \"types\": \"./out/zero/src/react.d.ts\",\n      \"default\": \"./out/zero/src/react.js\"\n    },\n    \"./react-native\": {\n      \"types\": \"./out/zero/src/react-native.d.ts\",\n      \"default\": \"./out/zero/src/react-native.js\"\n    },\n    \"./server\": {\n      \"types\": \"./out/zero/src/server.d.ts\",\n      \"default\": \"./out/zero/src/server.js\"\n    },\n    \"./server/adapters/drizzle\": {\n      \"types\": \"./out/zero/src/adapters/drizzle.d.ts\",\n      \"default\": \"./out/zero/src/adapters/drizzle.js\"\n    },\n    \"./server/adapters/kysely\": {\n      \"types\": \"./out/zero/src/adapters/kysely.d.ts\",\n      \"default\": \"./out/zero/src/adapters/kysely.js\"\n    },\n    \"./server/adapters/prisma\": {\n      \"types\": \"./out/zero/src/adapters/prisma.d.ts\",\n      \"default\": \"./out/zero/src/adapters/prisma.js\"\n    },\n    \"./server/adapters/pg\": {\n      \"types\": \"./out/zero/src/adapters/pg.d.ts\",\n      \"default\": \"./out/zero/src/adapters/pg.js\"\n    },\n    \"./server/adapters/postgresjs\": {\n      \"types\": \"./out/zero/src/adapters/postgresjs.d.ts\",\n      \"default\": \"./out/zero/src/adapters/postgresjs.js\"\n    },\n    \"./solid\": {\n      \"types\": \"./out/zero/src/solid.d.ts\",\n      \"default\": \"./out/zero/src/solid.js\"\n    },\n    \"./sqlite\": {\n      \"types\": \"./out/zero/src/sqlite.d.ts\",\n      \"default\": \"./out/zero/src/sqlite.js\"\n    },\n    \"./zqlite\": {\n      \"types\": \"./out/zero/src/zqlite.d.ts\",\n      \"default\": \"./out/zero/src/zqlite.js\"\n    }\n  },\n  \"scripts\": {\n    \"build\": \"node --experimental-strip-types --no-warnings tool/build.ts\",\n    \"build:watch\": \"node --experimental-strip-types --no-warnings tool/build.ts --watch\",\n    \"check-types\": \"tsc -p tsconfig.client.json && tsc -p tsconfig.server.json\",\n    \"check-types:client:watch\": \"tsc -p tsconfig.client.json --watch\",\n    \"check-types:server:watch\": \"tsc -p tsconfig.server.json --watch\",\n    \"format\": \"oxfmt .\",\n    \"check-format\": \"oxfmt --check .\",\n    \"lint\": \"oxlint --quiet --config ../../oxlint.config.ts src/\",\n    \"docs\": \"node --experimental-strip-types --no-warnings tool/generate-docs.ts\",\n    \"docs:server\": \"node --watch --experimental-strip-types --no-warnings tool/generate-docs.ts --server\",\n    \"fmt\": \"oxfmt .\",\n    \"check-fmt\": \"oxfmt --check .\"\n  },\n  \"dependencies\": {\n    \"@badrap/valita\": \"0.5.5\",\n    \"@databases/escape-identifier\": \"^1.0.3\",\n    \"@databases/sql\": \"^3.3.0\",\n    \"@dotenvx/dotenvx\": \"^1.39.0\",\n    \"@drdgvhbh/postgres-error-codes\": \"^0.0.6\",\n    \"@fastify/cors\": \"^10.0.0\",\n    \"@fastify/websocket\": \"^11.0.0\",\n    \"@google-cloud/precise-date\": \"^4.0.0\",\n    \"@opentelemetry/api\": \"1.9.1\",\n    \"@opentelemetry/api-logs\": \"0.223.0\",\n    \"@opentelemetry/auto-instrumentations-node\": \"0.81.2\",\n    \"@opentelemetry/exporter-metrics-otlp-http\": \"0.223.0\",\n    \"@opentelemetry/resources\": \"2.12.0\",\n    \"@opentelemetry/sdk-metrics\": \"2.12.0\",\n    \"@opentelemetry/sdk-node\": \"0.223.0\",\n    \"@opentelemetry/sdk-trace-node\": \"2.12.0\",\n    \"@opentelemetry/semantic-conventions\": \"1.43.0\",\n    \"@postgresql-typed/oids\": \"^0.2.0\",\n    \"@rocicorp/lock\": \"^1.0.4\",\n    \"@rocicorp/logger\": \"^6.1.0\",\n    \"@rocicorp/resolver\": \"^1.0.2\",\n    \"@rocicorp/zero-sqlite3\": \"^1.1.5\",\n    \"@standard-schema/spec\": \"^1.0.0\",\n    \"@types/basic-auth\": \"^1.1.8\",\n    \"@types/ws\": \"^8.5.12\",\n    \"basic-auth\": \"^2.0.1\",\n    \"chalk-template\": \"^1.1.0\",\n    \"chokidar\": \"^4.0.1\",\n    \"cloudevents\": \"^10.0.0\",\n    \"command-line-args\": \"^6.0.1\",\n    \"command-line-usage\": \"^7.0.3\",\n    \"compare-utf8\": \"^0.2.3\",\n    \"defu\": \"^6.1.4\",\n    \"eventemitter3\": \"^5.0.1\",\n    \"fastify\": \"^5.12.7\",\n    \"is-in-subnet\": \"^4.0.1\",\n    \"jose\": \"^5.9.3\",\n    \"json-custom-numbers\": \"^3.1.1\",\n    \"kasi\": \"^1.1.0\",\n    \"nanoid\": \"^5.1.16\",\n    \"oxfmt\": \"^0.65.0\",\n    \"parse-prometheus-text-format\": \"^1.1.1\",\n    \"pg-format\": \"npm:pg-format-fix@^1.0.5\",\n    \"postgres\": \"3.4.7\",\n    \"semver\": \"^7.5.4\",\n    \"url-pattern\": \"^1.0.3\",\n    \"urlpattern-polyfill\": \"^10.1.0\",\n    \"ws\": \"^8.22.0\"\n  },\n  \"devDependencies\": {\n    \"@op-engineering/op-sqlite\": \">=15\",\n    \"analyze-query\": \"workspace:*\",\n    \"ast-to-zql\": \"workspace:*\",\n    \"expo\": \"^58.0.14\",\n    \"expo-sqlite\": \">=15\",\n    \"oxc-parser\": \"^0.129.0\",\n    \"react-native\": \"^0.88.0\",\n    \"replicache\": \"workspace:*\",\n    \"shared\": \"workspace:*\",\n    \"syncpack\": \"^14.3.0\",\n    \"typedoc\": \"^0.28.17\",\n    \"typescript\": \"~7.0.2\",\n    \"vite\": \"^8.3.4\",\n    \"vitest\": \"^5.0.0\",\n    \"zero-cache\": \"workspace:*\",\n    \"zero-client\": \"workspace:*\",\n    \"zero-pg\": \"workspace:*\",\n    \"zero-react\": \"workspace:*\",\n    \"zero-server\": \"workspace:*\",\n    \"zero-solid\": \"workspace:*\",\n    \"zqlite\": \"workspace:*\"\n  },\n  \"engines\": {\n    \"node\": \">=22\"\n  },\n  \"packageManager\": \"pnpm@11.11.0\"\n}\n"],"mappings":""}
+{"version":3,"file":"package.js","names":[],"sources":["../../package.json"],"sourcesContent":["{\n  \"name\": \"@rocicorp/zero\",\n  \"version\": \"1.11.5\",\n  \"description\": \"Zero is a web framework for serverless web development.\",\n  \"homepage\": \"https://zero.rocicorp.dev\",\n  \"bugs\": {\n    \"url\": \"https://bugs.rocicorp.dev\"\n  },\n  \"license\": \"Apache-2.0\",\n  \"author\": \"Rocicorp, Inc.\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/rocicorp/mono.git\",\n    \"directory\": \"packages/zero\"\n  },\n  \"bin\": {\n    \"analyze-query\": \"./out/zero/src/analyze-query.js\",\n    \"ast-to-zql\": \"./out/zero/src/ast-to-zql.js\",\n    \"transform-query\": \"./out/zero/src/transform-query.js\",\n    \"zero-build-schema\": \"./out/zero/src/build-schema.js\",\n    \"zero-cache\": \"./out/zero/src/cli.js\",\n    \"zero-cache-dev\": \"./out/zero/src/zero-cache-dev.js\",\n    \"zero-deploy-permissions\": \"./out/zero/src/deploy-permissions.js\",\n    \"zero-out\": \"./out/zero/src/zero-out.js\"\n  },\n  \"files\": [\n    \"out\",\n    \"!*.tsbuildinfo\"\n  ],\n  \"type\": \"module\",\n  \"main\": \"out/zero/src/zero.js\",\n  \"module\": \"out/zero/src/zero.js\",\n  \"types\": \"out/zero/src/zero.d.ts\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./out/zero/src/zero.d.ts\",\n      \"default\": \"./out/zero/src/zero.js\"\n    },\n    \"./analyze\": {\n      \"types\": \"./out/zero/src/analyze.d.ts\",\n      \"default\": \"./out/zero/src/analyze.js\"\n    },\n    \"./bindings\": {\n      \"types\": \"./out/zero/src/bindings.d.ts\",\n      \"default\": \"./out/zero/src/bindings.js\"\n    },\n    \"./change-protocol/v0\": {\n      \"types\": \"./out/zero/src/change-protocol/v0.d.ts\",\n      \"default\": \"./out/zero/src/change-protocol/v0.js\"\n    },\n    \"./expo-sqlite\": {\n      \"types\": \"./out/zero/src/expo-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/expo-sqlite.js\"\n    },\n    \"./op-sqlite\": {\n      \"types\": \"./out/zero/src/op-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/op-sqlite.js\"\n    },\n    \"./pg\": {\n      \"types\": \"./out/zero/src/pg.d.ts\",\n      \"default\": \"./out/zero/src/pg.js\"\n    },\n    \"./react\": {\n      \"types\": \"./out/zero/src/react.d.ts\",\n      \"default\": \"./out/zero/src/react.js\"\n    },\n    \"./react-native\": {\n      \"types\": \"./out/zero/src/react-native.d.ts\",\n      \"default\": \"./out/zero/src/react-native.js\"\n    },\n    \"./server\": {\n      \"types\": \"./out/zero/src/server.d.ts\",\n      \"default\": \"./out/zero/src/server.js\"\n    },\n    \"./server/adapters/drizzle\": {\n      \"types\": \"./out/zero/src/adapters/drizzle.d.ts\",\n      \"default\": \"./out/zero/src/adapters/drizzle.js\"\n    },\n    \"./server/adapters/kysely\": {\n      \"types\": \"./out/zero/src/adapters/kysely.d.ts\",\n      \"default\": \"./out/zero/src/adapters/kysely.js\"\n    },\n    \"./server/adapters/prisma\": {\n      \"types\": \"./out/zero/src/adapters/prisma.d.ts\",\n      \"default\": \"./out/zero/src/adapters/prisma.js\"\n    },\n    \"./server/adapters/pg\": {\n      \"types\": \"./out/zero/src/adapters/pg.d.ts\",\n      \"default\": \"./out/zero/src/adapters/pg.js\"\n    },\n    \"./server/adapters/postgresjs\": {\n      \"types\": \"./out/zero/src/adapters/postgresjs.d.ts\",\n      \"default\": \"./out/zero/src/adapters/postgresjs.js\"\n    },\n    \"./solid\": {\n      \"types\": \"./out/zero/src/solid.d.ts\",\n      \"default\": \"./out/zero/src/solid.js\"\n    },\n    \"./sqlite\": {\n      \"types\": \"./out/zero/src/sqlite.d.ts\",\n      \"default\": \"./out/zero/src/sqlite.js\"\n    },\n    \"./zqlite\": {\n      \"types\": \"./out/zero/src/zqlite.d.ts\",\n      \"default\": \"./out/zero/src/zqlite.js\"\n    }\n  },\n  \"scripts\": {\n    \"build\": \"node --experimental-strip-types --no-warnings tool/build.ts\",\n    \"build:watch\": \"node --experimental-strip-types --no-warnings tool/build.ts --watch\",\n    \"check-types\": \"tsc -p tsconfig.client.json && tsc -p tsconfig.server.json\",\n    \"check-types:client:watch\": \"tsc -p tsconfig.client.json --watch\",\n    \"check-types:server:watch\": \"tsc -p tsconfig.server.json --watch\",\n    \"format\": \"oxfmt .\",\n    \"check-format\": \"oxfmt --check .\",\n    \"lint\": \"oxlint --quiet --config ../../oxlint.config.ts src/\",\n    \"docs\": \"node --experimental-strip-types --no-warnings tool/generate-docs.ts\",\n    \"docs:server\": \"node --watch --experimental-strip-types --no-warnings tool/generate-docs.ts --server\",\n    \"fmt\": \"oxfmt .\",\n    \"check-fmt\": \"oxfmt --check .\"\n  },\n  \"dependencies\": {\n    \"@badrap/valita\": \"0.5.5\",\n    \"@databases/escape-identifier\": \"^1.0.3\",\n    \"@databases/sql\": \"^3.3.0\",\n    \"@dotenvx/dotenvx\": \"^1.39.0\",\n    \"@drdgvhbh/postgres-error-codes\": \"^0.0.6\",\n    \"@fastify/cors\": \"^10.0.0\",\n    \"@fastify/websocket\": \"^11.0.0\",\n    \"@google-cloud/precise-date\": \"^4.0.0\",\n    \"@opentelemetry/api\": \"1.9.1\",\n    \"@opentelemetry/api-logs\": \"0.223.0\",\n    \"@opentelemetry/auto-instrumentations-node\": \"0.81.2\",\n    \"@opentelemetry/exporter-metrics-otlp-http\": \"0.223.0\",\n    \"@opentelemetry/resources\": \"2.12.0\",\n    \"@opentelemetry/sdk-metrics\": \"2.12.0\",\n    \"@opentelemetry/sdk-node\": \"0.223.0\",\n    \"@opentelemetry/sdk-trace-node\": \"2.12.0\",\n    \"@opentelemetry/semantic-conventions\": \"1.43.0\",\n    \"@postgresql-typed/oids\": \"^0.2.0\",\n    \"@rocicorp/lock\": \"^1.0.4\",\n    \"@rocicorp/logger\": \"^6.1.0\",\n    \"@rocicorp/resolver\": \"^1.0.2\",\n    \"@rocicorp/zero-sqlite3\": \"^1.1.5\",\n    \"@standard-schema/spec\": \"^1.0.0\",\n    \"@types/basic-auth\": \"^1.1.8\",\n    \"@types/ws\": \"^8.5.12\",\n    \"basic-auth\": \"^2.0.1\",\n    \"chalk-template\": \"^1.1.0\",\n    \"chokidar\": \"^4.0.1\",\n    \"cloudevents\": \"^10.0.0\",\n    \"command-line-args\": \"^6.0.1\",\n    \"command-line-usage\": \"^7.0.3\",\n    \"compare-utf8\": \"^0.2.3\",\n    \"defu\": \"^6.1.4\",\n    \"eventemitter3\": \"^5.0.1\",\n    \"fastify\": \"^5.12.7\",\n    \"is-in-subnet\": \"^4.0.1\",\n    \"jose\": \"^5.9.3\",\n    \"json-custom-numbers\": \"^3.1.1\",\n    \"kasi\": \"^1.1.0\",\n    \"nanoid\": \"^5.1.16\",\n    \"oxfmt\": \"^0.65.0\",\n    \"parse-prometheus-text-format\": \"^1.1.1\",\n    \"pg-format\": \"npm:pg-format-fix@^1.0.5\",\n    \"postgres\": \"3.4.7\",\n    \"semver\": \"^7.5.4\",\n    \"url-pattern\": \"^1.0.3\",\n    \"urlpattern-polyfill\": \"^10.1.0\",\n    \"ws\": \"^8.22.0\"\n  },\n  \"devDependencies\": {\n    \"@op-engineering/op-sqlite\": \">=15\",\n    \"analyze-query\": \"workspace:*\",\n    \"ast-to-zql\": \"workspace:*\",\n    \"expo\": \"^58.0.14\",\n    \"expo-sqlite\": \">=15\",\n    \"oxc-parser\": \"^0.129.0\",\n    \"react-native\": \"^0.88.0\",\n    \"replicache\": \"workspace:*\",\n    \"shared\": \"workspace:*\",\n    \"syncpack\": \"^14.3.0\",\n    \"typedoc\": \"^0.28.17\",\n    \"typescript\": \"~7.0.2\",\n    \"vite\": \"^8.3.4\",\n    \"vitest\": \"^5.0.0\",\n    \"zero-cache\": \"workspace:*\",\n    \"zero-client\": \"workspace:*\",\n    \"zero-pg\": \"workspace:*\",\n    \"zero-react\": \"workspace:*\",\n    \"zero-server\": \"workspace:*\",\n    \"zero-solid\": \"workspace:*\",\n    \"zqlite\": \"workspace:*\"\n  },\n  \"engines\": {\n    \"node\": \">=22\"\n  },\n  \"packageManager\": \"pnpm@11.11.0\"\n}\n"],"mappings":""}

package/out/zero-cache/src/auth/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAIrC,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,oCAAoC,CAAC;AAElE,yCAAyC;AACzC,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,OAAO,CAAC;AAExC,MAAM,MAAM,iBAAiB,GAAG,CAC9B,KAAK,EAAE,MAAM,EACb,GAAG,EAAE;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,KACvC,OAAO,CAAC,OAAO,CAAC,CAAC;AAMtB,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,IAAI,GAAG,SAAS,WAQlE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,UAAU,EACd,YAAY,EAAE,IAAI,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,GAC/C,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAoE3B;AAED,gEAAgE;AAChE,wBAAgB,SAAS,CACvB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,IAAI,GAAG,SAAS,EAC/B,QAAQ,EAAE,IAAI,GAAG,SAAS,GAAG,IAAI,oBAgFlC;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,OAAO,GAAG,EAAE,IAAI,SAAS,GAAG,SAAS,CAgCxE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAIrC,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,oCAAoC,CAAC;AAElE,yCAAyC;AACzC,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,OAAO,CAAC;AAExC,MAAM,MAAM,iBAAiB,GAAG,CAC9B,KAAK,EAAE,MAAM,EACb,GAAG,EAAE;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,KACvC,OAAO,CAAC,OAAO,CAAC,CAAC;AAMtB,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,IAAI,GAAG,SAAS,WAQlE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,UAAU,EACd,YAAY,EAAE,IAAI,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,GAC/C,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CA8E3B;AAED,gEAAgE;AAChE,wBAAgB,SAAS,CACvB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,IAAI,GAAG,SAAS,EAC/B,QAAQ,EAAE,IAAI,GAAG,SAAS,GAAG,IAAI,oBAgFlC;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,OAAO,GAAG,EAAE,IAAI,SAAS,GAAG,SAAS,CAgCxE"}

package/out/zero-cache/src/auth/auth.js

@@ -25,6 +25,11 @@ async function resolveAuth(lc, previousAuth, userID, wireAuth, validateLegacyJWT
 			origin: ZeroCache
 		});
 		if (!hasProvidedAuth) {
+			if (validateLegacyJWT !== void 0 && userID !== null) throw new ProtocolError({
+				kind: Unauthorized,
+				message: "No token provided. A connection with a userID requires a token when JWT verification is configured.",
+				origin: ZeroCache
+			});
 			lc.debug?.(`Cleared auth`);
 			return;
 		}

package/out/zero-cache/src/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":["ErrorKind.Unauthorized","ErrorOrigin.ZeroCache","ErrorKind.AuthInvalidated"],"sources":["../../../../../zero-cache/src/auth/auth.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport {ErrorKind} from '../../../zero-protocol/src/error-kind.ts';\nimport {ErrorOrigin} from '../../../zero-protocol/src/error-origin.ts';\nimport {ErrorReason} from '../../../zero-protocol/src/error-reason.ts';\nimport {\n  isProtocolError,\n  ProtocolError,\n  type ErrorBody,\n} from '../../../zero-protocol/src/error.ts';\nimport type {PushError} from '../../../zero-protocol/src/push.ts';\n\n/** @deprecated JWT auth is deprecated */\nexport type JWTAuth = {\n  readonly type: 'jwt';\n  readonly raw: string;\n  readonly decoded: JWTPayload;\n};\n\nexport type OpaqueAuth = {\n  readonly type: 'opaque';\n  readonly raw: string;\n};\n\nexport type Auth = OpaqueAuth | JWTAuth;\n\nexport type ValidateLegacyJWT = (\n  token: string,\n  ctx: {readonly userID: string | undefined},\n) => Promise<JWTAuth>;\n\nfunction isProvidedAuth(wireAuth: string | undefined): wireAuth is string {\n  return wireAuth !== undefined && wireAuth !== '';\n}\n\nexport function authEquals(a: Auth | undefined, b: Auth | undefined) {\n  if (a === b) {\n    return true;\n  }\n  if (!a || !b) {\n    return false;\n  }\n  return a.type === b.type && a.raw === b.raw;\n}\n\n/**\n * Resolves one auth snapshot transition without binding it to a client group.\n */\nexport async function resolveAuth(\n  lc: LogContext,\n  previousAuth: Auth | undefined,\n  userID: string | null,\n  wireAuth: string | undefined,\n  validateLegacyJWT: ValidateLegacyJWT | undefined,\n): Promise<Auth | undefined> {\n  try {\n    const hasProvidedAuth = isProvidedAuth(wireAuth);\n\n    if (previousAuth) {\n      lc.debug?.(`Attempting to update auth from previous value`);\n    } else {\n      lc.debug?.(`Attempting to initialize auth`);\n    }\n\n    if (!hasProvidedAuth && previousAuth) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (!hasProvidedAuth) {\n      lc.debug?.(`Cleared auth`);\n      return undefined;\n    }\n\n    if (userID === null) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message: 'Authenticated connections require a userID.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (validateLegacyJWT !== undefined) {\n      const verifiedToken = await validateLegacyJWT(wireAuth, {userID});\n      const nextAuth = pickToken(lc, previousAuth, verifiedToken);\n      lc.debug?.(`Updated auth with JWT`);\n      return nextAuth;\n    }\n\n    if (previousAuth?.type === 'jwt') {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'Token type cannot change from JWT to opaque. Connections are pinned to a single token type.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (previousAuth?.type === 'opaque' && previousAuth.raw === wireAuth) {\n      lc.debug?.(`Opaque auth unchanged, reusing previous snapshot`);\n      return previousAuth;\n    }\n\n    lc.debug?.(`Updated auth with opaque token`);\n    return {\n      type: 'opaque',\n      raw: wireAuth,\n    };\n  } catch (e) {\n    if (isProtocolError(e)) {\n      throw e;\n    }\n    throw new ProtocolError({\n      kind: ErrorKind.AuthInvalidated,\n      message: `Failed to decode auth token: ${String(e)}`,\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n}\n\n/** @deprecated used only in old JWT validation/rotation auth */\nexport function pickToken(\n  lc: LogContext,\n  previousToken: Auth | undefined,\n  newToken: Auth | undefined | null,\n) {\n  if (newToken === null) {\n    return undefined;\n  }\n\n  if (\n    previousToken?.type &&\n    newToken?.type &&\n    previousToken?.type !== newToken?.type\n  ) {\n    throw new ProtocolError({\n      kind: ErrorKind.Unauthorized,\n      message:\n        'Token type cannot change. Client groups are pinned to a single token type.',\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n\n  if (previousToken === undefined) {\n    lc.debug?.(`No previous token, using new token`);\n    return newToken;\n  }\n\n  if (newToken?.type === 'opaque') {\n    return newToken;\n  }\n\n  if (previousToken.type === 'opaque') {\n    throw new ProtocolError({\n      kind: ErrorKind.Unauthorized,\n      message:\n        'Token type cannot change from opaque to JWT. Client groups are pinned to a single token type.',\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n\n  if (newToken) {\n    if (previousToken.decoded.sub !== newToken.decoded.sub) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'The user id in the new token does not match the previous token. Client groups are pinned to a single user.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (previousToken.decoded.iat === undefined) {\n      lc.debug?.(`No issued at time for the existing token, using new token`);\n      // No issued at time for the existing token? We take the most recently received token.\n      return newToken;\n    }\n\n    if (newToken.decoded.iat === undefined) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'The new token does not have an issued at time but the prior token does. Tokens for a client group must either all have issued at times or all not have issued at times',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    // The new token is newer, so we take it.\n    if (previousToken.decoded.iat < newToken.decoded.iat) {\n      lc.debug?.(`New token is newer, using it`);\n      return newToken;\n    }\n\n    // if the new token is older or the same, we keep the existing token.\n    lc.debug?.(`New token is older or the same, using existing token`);\n    return previousToken;\n  }\n\n  // previousToken !== undefined but newToken is undefined\n  throw new ProtocolError({\n    kind: ErrorKind.Unauthorized,\n    message:\n      'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n    origin: ErrorOrigin.ZeroCache,\n  });\n}\n\nexport function isAuthErrorBody(ex: unknown): ex is ErrorBody | PushError {\n  if (typeof ex !== 'object' || ex === null) {\n    return false;\n  }\n\n  if ('error' in ex) {\n    return (\n      ex.error === 'http' &&\n      'status' in ex &&\n      (ex.status === 401 || ex.status === 403)\n    );\n  }\n\n  if (!('kind' in ex)) {\n    return false;\n  }\n\n  if (\n    ex.kind === ErrorKind.AuthInvalidated ||\n    ex.kind === ErrorKind.Unauthorized\n  ) {\n    return true;\n  }\n\n  return (\n    (ex.kind === ErrorKind.PushFailed ||\n      ex.kind === ErrorKind.TransformFailed) &&\n    'reason' in ex &&\n    ex.reason === ErrorReason.HTTP &&\n    'status' in ex &&\n    (ex.status === 401 || ex.status === 403)\n  );\n}\n"],"mappings":";;;;;AA+BA,SAAS,eAAe,UAAkD;CACxE,OAAO,aAAa,KAAA,KAAa,aAAa;AAChD;AAEA,SAAgB,WAAW,GAAqB,GAAqB;CACnE,IAAI,MAAM,GACR,OAAO;CAET,IAAI,CAAC,KAAK,CAAC,GACT,OAAO;CAET,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;AAC1C;;;;AAKA,eAAsB,YACpB,IACA,cACA,QACA,UACA,mBAC2B;CAC3B,IAAI;EACF,MAAM,kBAAkB,eAAe,QAAQ;EAE/C,IAAI,cACF,GAAG,QAAQ,+CAA+C;OAE1D,GAAG,QAAQ,+BAA+B;EAG5C,IAAI,CAAC,mBAAmB,cACtB,MAAM,IAAI,cAAc;GACtB,MAAMA;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAGH,IAAI,CAAC,iBAAiB;GACpB,GAAG,QAAQ,cAAc;GACzB;EACF;EAEA,IAAI,WAAW,MACb,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SAAS;GACT,QAAQC;EACV,CAAC;EAGH,IAAI,sBAAsB,KAAA,GAAW;GAEnC,MAAM,WAAW,UAAU,IAAI,cAAc,MADjB,kBAAkB,UAAU,EAAC,OAAM,CAAC,CACN;GAC1D,GAAG,QAAQ,uBAAuB;GAClC,OAAO;EACT;EAEA,IAAI,cAAc,SAAS,OACzB,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAGH,IAAI,cAAc,SAAS,YAAY,aAAa,QAAQ,UAAU;GACpE,GAAG,QAAQ,kDAAkD;GAC7D,OAAO;EACT;EAEA,GAAG,QAAQ,gCAAgC;EAC3C,OAAO;GACL,MAAM;GACN,KAAK;EACP;CACF,SAAS,GAAG;EACV,IAAI,gBAAgB,CAAC,GACnB,MAAM;EAER,MAAM,IAAI,cAAc;GACtB,MAAMC;GACN,SAAS,gCAAgC,OAAO,CAAC;GACjD,QAAQD;EACV,CAAC;CACH;AACF;;AAGA,SAAgB,UACd,IACA,eACA,UACA;CACA,IAAI,aAAa,MACf;CAGF,IACE,eAAe,QACf,UAAU,QACV,eAAe,SAAS,UAAU,MAElC,MAAM,IAAI,cAAc;EACtB,MAAMD;EACN,SACE;EACF,QAAQC;CACV,CAAC;CAGH,IAAI,kBAAkB,KAAA,GAAW;EAC/B,GAAG,QAAQ,oCAAoC;EAC/C,OAAO;CACT;CAEA,IAAI,UAAU,SAAS,UACrB,OAAO;CAGT,IAAI,cAAc,SAAS,UACzB,MAAM,IAAI,cAAc;EACtB,MAAMD;EACN,SACE;EACF,QAAQC;CACV,CAAC;CAGH,IAAI,UAAU;EACZ,IAAI,cAAc,QAAQ,QAAQ,SAAS,QAAQ,KACjD,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAGH,IAAI,cAAc,QAAQ,QAAQ,KAAA,GAAW;GAC3C,GAAG,QAAQ,2DAA2D;GAEtE,OAAO;EACT;EAEA,IAAI,SAAS,QAAQ,QAAQ,KAAA,GAC3B,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAIH,IAAI,cAAc,QAAQ,MAAM,SAAS,QAAQ,KAAK;GACpD,GAAG,QAAQ,8BAA8B;GACzC,OAAO;EACT;EAGA,GAAG,QAAQ,sDAAsD;EACjE,OAAO;CACT;CAGA,MAAM,IAAI,cAAc;EACtB,MAAMD;EACN,SACE;EACF,QAAQC;CACV,CAAC;AACH;AAEA,SAAgB,gBAAgB,IAA0C;CACxE,IAAI,OAAO,OAAO,YAAY,OAAO,MACnC,OAAO;CAGT,IAAI,WAAW,IACb,OACE,GAAG,UAAU,UACb,YAAY,OACX,GAAG,WAAW,OAAO,GAAG,WAAW;CAIxC,IAAI,EAAE,UAAU,KACd,OAAO;CAGT,IACE,GAAG,SAAS,qBACZ,GAAG,SAAS,gBAEZ,OAAO;CAGT,QACG,GAAG,SAAS,gBACX,GAAG,SAAS,sBACd,YAAY,MACZ,GAAG,WAAW,UACd,YAAY,OACX,GAAG,WAAW,OAAO,GAAG,WAAW;AAExC"}
+{"version":3,"file":"auth.js","names":["ErrorKind.Unauthorized","ErrorOrigin.ZeroCache","ErrorKind.AuthInvalidated"],"sources":["../../../../../zero-cache/src/auth/auth.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport {ErrorKind} from '../../../zero-protocol/src/error-kind.ts';\nimport {ErrorOrigin} from '../../../zero-protocol/src/error-origin.ts';\nimport {ErrorReason} from '../../../zero-protocol/src/error-reason.ts';\nimport {\n  isProtocolError,\n  ProtocolError,\n  type ErrorBody,\n} from '../../../zero-protocol/src/error.ts';\nimport type {PushError} from '../../../zero-protocol/src/push.ts';\n\n/** @deprecated JWT auth is deprecated */\nexport type JWTAuth = {\n  readonly type: 'jwt';\n  readonly raw: string;\n  readonly decoded: JWTPayload;\n};\n\nexport type OpaqueAuth = {\n  readonly type: 'opaque';\n  readonly raw: string;\n};\n\nexport type Auth = OpaqueAuth | JWTAuth;\n\nexport type ValidateLegacyJWT = (\n  token: string,\n  ctx: {readonly userID: string | undefined},\n) => Promise<JWTAuth>;\n\nfunction isProvidedAuth(wireAuth: string | undefined): wireAuth is string {\n  return wireAuth !== undefined && wireAuth !== '';\n}\n\nexport function authEquals(a: Auth | undefined, b: Auth | undefined) {\n  if (a === b) {\n    return true;\n  }\n  if (!a || !b) {\n    return false;\n  }\n  return a.type === b.type && a.raw === b.raw;\n}\n\n/**\n * Resolves one auth snapshot transition without binding it to a client group.\n */\nexport async function resolveAuth(\n  lc: LogContext,\n  previousAuth: Auth | undefined,\n  userID: string | null,\n  wireAuth: string | undefined,\n  validateLegacyJWT: ValidateLegacyJWT | undefined,\n): Promise<Auth | undefined> {\n  try {\n    const hasProvidedAuth = isProvidedAuth(wireAuth);\n\n    if (previousAuth) {\n      lc.debug?.(`Attempting to update auth from previous value`);\n    } else {\n      lc.debug?.(`Attempting to initialize auth`);\n    }\n\n    if (!hasProvidedAuth && previousAuth) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (!hasProvidedAuth) {\n      // With JWT verification configured, the token is the only thing that\n      // ties a connection to its userID. A logged-out connection omits both.\n      if (validateLegacyJWT !== undefined && userID !== null) {\n        throw new ProtocolError({\n          kind: ErrorKind.Unauthorized,\n          message:\n            'No token provided. A connection with a userID requires a token when JWT verification is configured.',\n          origin: ErrorOrigin.ZeroCache,\n        });\n      }\n      lc.debug?.(`Cleared auth`);\n      return undefined;\n    }\n\n    if (userID === null) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message: 'Authenticated connections require a userID.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (validateLegacyJWT !== undefined) {\n      const verifiedToken = await validateLegacyJWT(wireAuth, {userID});\n      const nextAuth = pickToken(lc, previousAuth, verifiedToken);\n      lc.debug?.(`Updated auth with JWT`);\n      return nextAuth;\n    }\n\n    if (previousAuth?.type === 'jwt') {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'Token type cannot change from JWT to opaque. Connections are pinned to a single token type.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (previousAuth?.type === 'opaque' && previousAuth.raw === wireAuth) {\n      lc.debug?.(`Opaque auth unchanged, reusing previous snapshot`);\n      return previousAuth;\n    }\n\n    lc.debug?.(`Updated auth with opaque token`);\n    return {\n      type: 'opaque',\n      raw: wireAuth,\n    };\n  } catch (e) {\n    if (isProtocolError(e)) {\n      throw e;\n    }\n    throw new ProtocolError({\n      kind: ErrorKind.AuthInvalidated,\n      message: `Failed to decode auth token: ${String(e)}`,\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n}\n\n/** @deprecated used only in old JWT validation/rotation auth */\nexport function pickToken(\n  lc: LogContext,\n  previousToken: Auth | undefined,\n  newToken: Auth | undefined | null,\n) {\n  if (newToken === null) {\n    return undefined;\n  }\n\n  if (\n    previousToken?.type &&\n    newToken?.type &&\n    previousToken?.type !== newToken?.type\n  ) {\n    throw new ProtocolError({\n      kind: ErrorKind.Unauthorized,\n      message:\n        'Token type cannot change. Client groups are pinned to a single token type.',\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n\n  if (previousToken === undefined) {\n    lc.debug?.(`No previous token, using new token`);\n    return newToken;\n  }\n\n  if (newToken?.type === 'opaque') {\n    return newToken;\n  }\n\n  if (previousToken.type === 'opaque') {\n    throw new ProtocolError({\n      kind: ErrorKind.Unauthorized,\n      message:\n        'Token type cannot change from opaque to JWT. Client groups are pinned to a single token type.',\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n\n  if (newToken) {\n    if (previousToken.decoded.sub !== newToken.decoded.sub) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'The user id in the new token does not match the previous token. Client groups are pinned to a single user.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (previousToken.decoded.iat === undefined) {\n      lc.debug?.(`No issued at time for the existing token, using new token`);\n      // No issued at time for the existing token? We take the most recently received token.\n      return newToken;\n    }\n\n    if (newToken.decoded.iat === undefined) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'The new token does not have an issued at time but the prior token does. Tokens for a client group must either all have issued at times or all not have issued at times',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    // The new token is newer, so we take it.\n    if (previousToken.decoded.iat < newToken.decoded.iat) {\n      lc.debug?.(`New token is newer, using it`);\n      return newToken;\n    }\n\n    // if the new token is older or the same, we keep the existing token.\n    lc.debug?.(`New token is older or the same, using existing token`);\n    return previousToken;\n  }\n\n  // previousToken !== undefined but newToken is undefined\n  throw new ProtocolError({\n    kind: ErrorKind.Unauthorized,\n    message:\n      'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n    origin: ErrorOrigin.ZeroCache,\n  });\n}\n\nexport function isAuthErrorBody(ex: unknown): ex is ErrorBody | PushError {\n  if (typeof ex !== 'object' || ex === null) {\n    return false;\n  }\n\n  if ('error' in ex) {\n    return (\n      ex.error === 'http' &&\n      'status' in ex &&\n      (ex.status === 401 || ex.status === 403)\n    );\n  }\n\n  if (!('kind' in ex)) {\n    return false;\n  }\n\n  if (\n    ex.kind === ErrorKind.AuthInvalidated ||\n    ex.kind === ErrorKind.Unauthorized\n  ) {\n    return true;\n  }\n\n  return (\n    (ex.kind === ErrorKind.PushFailed ||\n      ex.kind === ErrorKind.TransformFailed) &&\n    'reason' in ex &&\n    ex.reason === ErrorReason.HTTP &&\n    'status' in ex &&\n    (ex.status === 401 || ex.status === 403)\n  );\n}\n"],"mappings":";;;;;AA+BA,SAAS,eAAe,UAAkD;CACxE,OAAO,aAAa,KAAA,KAAa,aAAa;AAChD;AAEA,SAAgB,WAAW,GAAqB,GAAqB;CACnE,IAAI,MAAM,GACR,OAAO;CAET,IAAI,CAAC,KAAK,CAAC,GACT,OAAO;CAET,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;AAC1C;;;;AAKA,eAAsB,YACpB,IACA,cACA,QACA,UACA,mBAC2B;CAC3B,IAAI;EACF,MAAM,kBAAkB,eAAe,QAAQ;EAE/C,IAAI,cACF,GAAG,QAAQ,+CAA+C;OAE1D,GAAG,QAAQ,+BAA+B;EAG5C,IAAI,CAAC,mBAAmB,cACtB,MAAM,IAAI,cAAc;GACtB,MAAMA;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAGH,IAAI,CAAC,iBAAiB;GAGpB,IAAI,sBAAsB,KAAA,KAAa,WAAW,MAChD,MAAM,IAAI,cAAc;IACtB,MAAMD;IACN,SACE;IACF,QAAQC;GACV,CAAC;GAEH,GAAG,QAAQ,cAAc;GACzB;EACF;EAEA,IAAI,WAAW,MACb,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SAAS;GACT,QAAQC;EACV,CAAC;EAGH,IAAI,sBAAsB,KAAA,GAAW;GAEnC,MAAM,WAAW,UAAU,IAAI,cAAc,MADjB,kBAAkB,UAAU,EAAC,OAAM,CAAC,CACN;GAC1D,GAAG,QAAQ,uBAAuB;GAClC,OAAO;EACT;EAEA,IAAI,cAAc,SAAS,OACzB,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAGH,IAAI,cAAc,SAAS,YAAY,aAAa,QAAQ,UAAU;GACpE,GAAG,QAAQ,kDAAkD;GAC7D,OAAO;EACT;EAEA,GAAG,QAAQ,gCAAgC;EAC3C,OAAO;GACL,MAAM;GACN,KAAK;EACP;CACF,SAAS,GAAG;EACV,IAAI,gBAAgB,CAAC,GACnB,MAAM;EAER,MAAM,IAAI,cAAc;GACtB,MAAMC;GACN,SAAS,gCAAgC,OAAO,CAAC;GACjD,QAAQD;EACV,CAAC;CACH;AACF;;AAGA,SAAgB,UACd,IACA,eACA,UACA;CACA,IAAI,aAAa,MACf;CAGF,IACE,eAAe,QACf,UAAU,QACV,eAAe,SAAS,UAAU,MAElC,MAAM,IAAI,cAAc;EACtB,MAAMD;EACN,SACE;EACF,QAAQC;CACV,CAAC;CAGH,IAAI,kBAAkB,KAAA,GAAW;EAC/B,GAAG,QAAQ,oCAAoC;EAC/C,OAAO;CACT;CAEA,IAAI,UAAU,SAAS,UACrB,OAAO;CAGT,IAAI,cAAc,SAAS,UACzB,MAAM,IAAI,cAAc;EACtB,MAAMD;EACN,SACE;EACF,QAAQC;CACV,CAAC;CAGH,IAAI,UAAU;EACZ,IAAI,cAAc,QAAQ,QAAQ,SAAS,QAAQ,KACjD,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAGH,IAAI,cAAc,QAAQ,QAAQ,KAAA,GAAW;GAC3C,GAAG,QAAQ,2DAA2D;GAEtE,OAAO;EACT;EAEA,IAAI,SAAS,QAAQ,QAAQ,KAAA,GAC3B,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAIH,IAAI,cAAc,QAAQ,MAAM,SAAS,QAAQ,KAAK;GACpD,GAAG,QAAQ,8BAA8B;GACzC,OAAO;EACT;EAGA,GAAG,QAAQ,sDAAsD;EACjE,OAAO;CACT;CAGA,MAAM,IAAI,cAAc;EACtB,MAAMD;EACN,SACE;EACF,QAAQC;CACV,CAAC;AACH;AAEA,SAAgB,gBAAgB,IAA0C;CACxE,IAAI,OAAO,OAAO,YAAY,OAAO,MACnC,OAAO;CAGT,IAAI,WAAW,IACb,OACE,GAAG,UAAU,UACb,YAAY,OACX,GAAG,WAAW,OAAO,GAAG,WAAW;CAIxC,IAAI,EAAE,UAAU,KACd,OAAO;CAGT,IACE,GAAG,SAAS,qBACZ,GAAG,SAAS,gBAEZ,OAAO;CAGT,QACG,GAAG,SAAS,gBACX,GAAG,SAAS,sBACd,YAAY,MACZ,GAAG,WAAW,UACd,YAAY,OACX,GAAG,WAAW,OAAO,GAAG,WAAW;AAExC"}

package/out/zero-cache/src/config/zero-config.d.ts

@@ -84,6 +84,10 @@ declare const authOptions: {
         type: v.Type<number>;
         desc: string[];
     };
+    requireServerUserID: {
+        type: v.Type<boolean>;
+        desc: string[];
+    };
 };
 export type AuthConfig = Config<typeof authOptions>;
 /** @deprecated used only by legacy JWT verification helpers */
@@ -479,6 +483,10 @@ export declare const zeroOptions: {
             type: v.Type<number>;
             desc: string[];
         };
+        requireServerUserID: {
+            type: v.Type<boolean>;
+            desc: string[];
+        };
     };
     port: {
         type: v.Type<number>;
@@ -497,6 +505,10 @@ export declare const zeroOptions: {
             type: v.Optional<string>;
             desc: string[];
         };
+        secret: {
+            type: v.Optional<string>;
+            desc: string[];
+        };
         /** @deprecated */
         mode: {
             type: v.Type<"dedicated" | "discover">;
@@ -633,6 +645,10 @@ export declare const zeroOptions: {
         type: v.Optional<string>;
         desc: string[];
     };
+    enableHeapz: {
+        type: v.Type<boolean>;
+        desc: string[];
+    };
     websocketCompression: {
         type: v.Type<boolean>;
         desc: string[];
@@ -849,5 +865,10 @@ export declare function isAdminPasswordValid(lc: LogContext, config: Pick<Normal
  * documents as withheld.
  */
 export declare function getOperatorAccess(lc: LogContext, config: Pick<NormalizedZeroConfig, 'adminPassword' | 'operatorPassword'>, password: string | undefined): AdminAccess | undefined;
+/**
+ * Compares `password` with `expected` in constant time. Returns `false` when
+ * no `expected` password is configured.
+ */
+export declare function passwordMatches(password: string | undefined, expected: string | undefined): boolean;
 export declare function resetWarnOnceState(): void;
 //# sourceMappingURL=zero-config.d.ts.map

package/out/zero-cache/src/config/zero-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zero-config.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/config/zero-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AAUnD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAC,SAAS,EAAC,MAAM,kCAAkC,CAAC;AAEhE,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,eAAO,MAAM,UAAU;IACrB,EAAE;QACA,IAAI;QAIJ,IAAI;;IAuBN,YAAY;QACV,IAAI;QACJ,IAAI;;CAgBP,CAAC;AAEF,eAAO,MAAM,YAAY;IACvB,EAAE;QACA,IAAI;QASJ,MAAM;;IAGR,GAAG;QACD,IAAI;QACJ,IAAI;QAMJ,MAAM;;CAET,CAAC;AAEF,QAAA,MAAM,cAAc;IAClB,IAAI;QACF,IAAI;QACJ,IAAI;;IAON,mBAAmB;QACjB,IAAI;QACJ,IAAI;;CAOP,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAE3D,QAAA,MAAM,oBAAoB;IACxB,GAAG;QACD,IAAI;QACJ,IAAI;;IAKN,QAAQ;QACN,IAAI;QACJ,IAAI;;CAIP,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5D,QAAA,MAAM,WAAW;IACf,GAAG;QACD,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,OAAO;QACL,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,MAAM;QACJ,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,MAAM;QACJ,IAAI;QACJ,IAAI;QAIJ,UAAU;;IAIZ,QAAQ;QACN,IAAI;QACJ,IAAI;QAIJ,UAAU;;IAIZ,yBAAyB;QACvB,IAAI;QACJ,IAAI;;IAKN,0BAA0B;QACxB,IAAI;QACJ,IAAI;;CAKP,CAAC;AA0HF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAEpD,+DAA+D;AAC/D,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,UAAU,EACV,KAAK,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CACrD,CAAC;AAKF,eAAO,MAAM,WAAW;;QAEpB,EAAE;YACA,IAAI;YACJ,IAAI;;QAMN,IAAI;YACF,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,QAAQ;YACN,IAAI;YACJ,IAAI;;QAWN,iBAAiB;YACf,IAAI;YACJ,MAAM;;QAGR,yBAAyB;YACvB,IAAI;YACJ,IAAI;;QAYN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAuBN,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YAiBJ,MAAM;;QAGR,iCAAiC;YAC/B,IAAI;YACJ,IAAI;YAUJ,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAeJ,MAAM;;QAMR,sBAAsB;YACpB,IAAI;YACJ,MAAM;;QAGR,wBAAwB;YACtB,IAAI;YACJ,IAAI;;;IAqBR,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAGlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAKhB,IAAI;QACJ,IAAI;;;QAQJ,IAAI;QACJ,IAAI;;;QAQJ,EAAE;YACA,IAAI;YACJ,IAAI;;QAON,QAAQ;YACN,IAAI;YACJ,IAAI;;QASN,iBAAiB;YACf,IAAI;YACJ,MAAM;;QAGR,yCAAyC;YACvC,IAAI;YACJ,IAAI;;QAUN,uCAAuC;YACrC,IAAI;YACJ,IAAI;;QAON,iCAAiC;YAC/B,IAAI;YACJ,IAAI;;;;QAWN,IAAI;QACJ,IAAI;;;QAQJ,IAAI;QACJ,IAAI;QAIJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QASJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;QAeJ,MAAM;;;QAIN,IAAI;QAOJ,IAAI;QAaJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QAkBJ,MAAM;;;QAIN,IAAI;QAgBJ,IAAI;QAMJ,MAAM;;;QAIN,IAAI;QAIJ,IAAI;QAKJ,MAAM;;;QAIN,IAAI;QAIJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QASJ,IAAI;QAOJ,IAAI;;;QAYJ,IAAI;QAOJ,IAAI;;;QAYJ,EAAE;YACA,IAAI;YACJ,IAAI;;QAON,kBAAkB;QAClB,QAAQ;YACN,IAAI;YACJ,UAAU;YAIV,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,YAAY;YACV,IAAI;YAOJ,IAAI;YAQJ,MAAM;;;;;YA5wBR,IAAI;YACJ,IAAI;;;YAQJ,IAAI;YACJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YArFJ,IAAI;YAIJ,IAAI;;;YAwBJ,IAAI;YACJ,IAAI;;;;;YAoBJ,IAAI;YASJ,MAAM;;;YAIN,IAAI;YACJ,IAAI;YAMJ,MAAM;;;;;YA+CN,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAIJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAIJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;;;YAMJ,IAAI;YACJ,IAAI;;;;QA2rBJ,IAAI;QACJ,IAAI;;;QAIJ,IAAI;QACJ,IAAI;;;QAcJ,IAAI;QACJ,IAAI;;;QAoBJ,GAAG;YACD,IAAI;YACJ,IAAI;;QAQN,kBAAkB;QAClB,IAAI;YACF,IAAI;YACJ,UAAU;;QASZ,IAAI;YACF,IAAI;YACJ,IAAI;;QASN,kBAAkB;QAClB,OAAO;YACL,IAAI;YACJ,UAAU;YAGV,MAAM;;QAGR,kBAAkB;QAClB,QAAQ;YACN,IAAI;YACJ,UAAU;YAGV,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YASJ,MAAM;;QAGR,cAAc;YACZ,IAAI;YACJ,IAAI;;QASN,mBAAmB;YACjB,IAAI;YAGJ,IAAI;YAIJ,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAKJ,MAAM;;QAGR,0BAA0B;YACxB,IAAI;YACJ,IAAI;YAGJ,MAAM;;QAGR,8BAA8B;YAC5B,IAAI;YACJ,IAAI;YAQJ,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YAIJ,MAAM;;QAGR,0BAA0B;YACxB,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,4BAA4B;YAC1B,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,+BAA+B;YAC7B,IAAI;YACJ,IAAI;YAQJ,MAAM;;QAGR,+BAA+B;YAC7B,IAAI;YACJ,IAAI;;QAsBN,qCAAqC;YACnC,IAAI;YACJ,IAAI;;QA0BN,2CAA2C;YACzC,IAAI;YACJ,IAAI;;QAyBN,+BAA+B;YAC7B,IAAI;YACJ,IAAI;;;;QAkBN,IAAI;QACJ,IAAI;;;;YA/iCJ,IAAI;YACJ,IAAI;;;YAMJ,IAAI;YACJ,IAAI;;;;QAmjCJ,IAAI;QACJ,IAAI;;;QASJ,IAAI;QACJ,IAAI;;;QAgBJ,gBAAgB;YACd,IAAI;YACJ,IAAI;;QAoBN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAaN,mBAAmB;YACjB,IAAI;YACJ,IAAI;;;;QAWN,IAAI;QACJ,IAAI;;;QAYJ,IAAI;QACJ,IAAI;;;QAsBJ,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;;;QAYJ,IAAI;QACJ,IAAI;;;QASJ,UAAU;YACR,IAAI;YACJ,IAAI;;QAON,YAAY;YACV,IAAI;YACJ,IAAI;;QASN,cAAc;YACZ,IAAI;YACJ,IAAI;;QAON,aAAa;YACX,IAAI;YACJ,IAAI;;QAoBN,UAAU;YACR,IAAI;YACJ,MAAM;YACN,IAAI;;QAYN,UAAU;YACR,IAAI;YACJ,IAAI;;QAWN,YAAY;YACV,IAAI;YAGJ,IAAI;;QAWN,QAAQ;YACN,IAAI;;QAKN,SAAS;YACP,IAAI;YACJ,IAAI;;QAON,iBAAiB;YACf,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,QAAQ;YACN,IAAI;YACJ,IAAI;;QAMN,MAAM;YACJ,IAAI;YACJ,IAAI;;QAON,IAAI;YACF,IAAI;YACJ,IAAI;;QAQN,qBAAqB;YACnB,IAAI;YACJ,IAAI;;QAUN,sBAAsB;YACpB,IAAI;YACJ,UAAU;YACV,MAAM;;QAGR,sBAAsB;YACpB,IAAI;YACJ,IAAI;;QAUN,0BAA0B;YACxB,IAAI;YACJ,IAAI;;QAqBN,YAAY;YACV,IAAI;YACJ,IAAI;;QAgBN,gCAAgC;YAC9B,IAAI;YACJ,IAAI;;QAYN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAiBN,gCAAgC;YAC9B,IAAI;YACJ,IAAI;;QAcN,kBAAkB;YAChB,IAAI;YACJ,IAAI;;QAMN,oBAAoB;YAClB,IAAI;YACJ,IAAI;;QAQN,aAAa;YACX,IAAI;YACJ,IAAI;;;;QASN,IAAI;QACJ,IAAI;;;QAMJ,gBAAgB;YACd,IAAI;YACJ,IAAI;;QASN,WAAW;YACT,IAAI;YACJ,MAAM;YACN,IAAI;;QAMN,QAAQ;YACN,IAAI;YACJ,IAAI;;;;QASN,OAAO;YACL,IAAI;YACJ,IAAI;;QASN,aAAa;YACX,IAAI;YACJ,IAAI;;QASN,UAAU;YACR,IAAI;YACJ,IAAI;;QAON,eAAe;YACb,IAAI;YACJ,IAAI;;;IAOR,kBAAkB;;QAEhB,IAAI;QACJ,UAAU;QAKV,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;;;QAIJ,IAAI;QACJ,IAAI;;;QASJ,OAAO;YACL,IAAI;YACJ,IAAI;;QAYN,qBAAqB;YACnB,IAAI;YACJ,IAAI;;;CAST,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAIpD,wBAAgB,aAAa,CAC3B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,UAAU,CAaZ;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,GAAG,cAAc,CAAM,GAC9D,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAUzB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,oBAAoB,CAItB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,GAAG,SAAS,GACpD,MAAM,CAER;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,EACnD,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAET;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,GAAG,kBAAkB,CAAC,EACxE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,WAAW,GAAG,SAAS,CAEzB;AAgFD,wBAAgB,kBAAkB,SAEjC"}
+{"version":3,"file":"zero-config.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/config/zero-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AAUnD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAC,SAAS,EAAC,MAAM,kCAAkC,CAAC;AAEhE,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,eAAO,MAAM,UAAU;IACrB,EAAE;QACA,IAAI;QAIJ,IAAI;;IAuBN,YAAY;QACV,IAAI;QACJ,IAAI;;CAgBP,CAAC;AAEF,eAAO,MAAM,YAAY;IACvB,EAAE;QACA,IAAI;QASJ,MAAM;;IAGR,GAAG;QACD,IAAI;QACJ,IAAI;QAMJ,MAAM;;CAET,CAAC;AAEF,QAAA,MAAM,cAAc;IAClB,IAAI;QACF,IAAI;QACJ,IAAI;;IAON,mBAAmB;QACjB,IAAI;QACJ,IAAI;;CAOP,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAE3D,QAAA,MAAM,oBAAoB;IACxB,GAAG;QACD,IAAI;QACJ,IAAI;;IAKN,QAAQ;QACN,IAAI;QACJ,IAAI;;CAIP,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5D,QAAA,MAAM,WAAW;IACf,GAAG;QACD,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,OAAO;QACL,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,MAAM;QACJ,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,MAAM;QACJ,IAAI;QACJ,IAAI;QAIJ,UAAU;;IAIZ,QAAQ;QACN,IAAI;QACJ,IAAI;QAIJ,UAAU;;IAIZ,yBAAyB;QACvB,IAAI;QACJ,IAAI;;IAKN,0BAA0B;QACxB,IAAI;QACJ,IAAI;;IAKN,mBAAmB;QACjB,IAAI;QACJ,IAAI;;CAQP,CAAC;AA0HF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAEpD,+DAA+D;AAC/D,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,UAAU,EACV,KAAK,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CACrD,CAAC;AAKF,eAAO,MAAM,WAAW;;QAEpB,EAAE;YACA,IAAI;YACJ,IAAI;;QAMN,IAAI;YACF,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,QAAQ;YACN,IAAI;YACJ,IAAI;;QAWN,iBAAiB;YACf,IAAI;YACJ,MAAM;;QAGR,yBAAyB;YACvB,IAAI;YACJ,IAAI;;QAYN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAuBN,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YAiBJ,MAAM;;QAGR,iCAAiC;YAC/B,IAAI;YACJ,IAAI;YAUJ,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAeJ,MAAM;;QAMR,sBAAsB;YACpB,IAAI;YACJ,MAAM;;QAGR,wBAAwB;YACtB,IAAI;YACJ,IAAI;;;IAqBR,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAGlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAKhB,IAAI;QACJ,IAAI;;;QAQJ,IAAI;QACJ,IAAI;;;QAQJ,EAAE;YACA,IAAI;YACJ,IAAI;;QAON,QAAQ;YACN,IAAI;YACJ,IAAI;;QASN,iBAAiB;YACf,IAAI;YACJ,MAAM;;QAGR,yCAAyC;YACvC,IAAI;YACJ,IAAI;;QAUN,uCAAuC;YACrC,IAAI;YACJ,IAAI;;QAON,iCAAiC;YAC/B,IAAI;YACJ,IAAI;;;;QAWN,IAAI;QACJ,IAAI;;;QAQJ,IAAI;QACJ,IAAI;QAIJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QASJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;QAeJ,MAAM;;;QAIN,IAAI;QAOJ,IAAI;QAaJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QAkBJ,MAAM;;;QAIN,IAAI;QAgBJ,IAAI;QAMJ,MAAM;;;QAIN,IAAI;QAIJ,IAAI;QAKJ,MAAM;;;QAIN,IAAI;QAIJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QASJ,IAAI;QAOJ,IAAI;;;QAYJ,IAAI;QAOJ,IAAI;;;QAYJ,EAAE;YACA,IAAI;YACJ,IAAI;;QAON,kBAAkB;QAClB,QAAQ;YACN,IAAI;YACJ,UAAU;YAIV,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,YAAY;YACV,IAAI;YAOJ,IAAI;YAQJ,MAAM;;;;;YAtxBR,IAAI;YACJ,IAAI;;;YAQJ,IAAI;YACJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YArFJ,IAAI;YAIJ,IAAI;;;YAwBJ,IAAI;YACJ,IAAI;;;;;YAoBJ,IAAI;YASJ,MAAM;;;YAIN,IAAI;YACJ,IAAI;YAMJ,MAAM;;;;;YA+CN,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAIJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAIJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;;;YAMJ,IAAI;YACJ,IAAI;;;YAMJ,IAAI;YACJ,IAAI;;;;QA8rBJ,IAAI;QACJ,IAAI;;;QAIJ,IAAI;QACJ,IAAI;;;QAcJ,IAAI;QACJ,IAAI;;;QAoBJ,GAAG;YACD,IAAI;YACJ,IAAI;;QAQN,MAAM;YACJ,IAAI;YACJ,IAAI;;QAgBN,kBAAkB;QAClB,IAAI;YACF,IAAI;YACJ,UAAU;;QASZ,IAAI;YACF,IAAI;YACJ,IAAI;;QASN,kBAAkB;QAClB,OAAO;YACL,IAAI;YACJ,UAAU;YAGV,MAAM;;QAGR,kBAAkB;QAClB,QAAQ;YACN,IAAI;YACJ,UAAU;YAGV,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YASJ,MAAM;;QAGR,cAAc;YACZ,IAAI;YACJ,IAAI;;QASN,mBAAmB;YACjB,IAAI;YAGJ,IAAI;YAIJ,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAKJ,MAAM;;QAGR,0BAA0B;YACxB,IAAI;YACJ,IAAI;YAGJ,MAAM;;QAGR,8BAA8B;YAC5B,IAAI;YACJ,IAAI;YAQJ,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YAIJ,MAAM;;QAGR,0BAA0B;YACxB,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,4BAA4B;YAC1B,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,+BAA+B;YAC7B,IAAI;YACJ,IAAI;YAQJ,MAAM;;QAGR,+BAA+B;YAC7B,IAAI;YACJ,IAAI;;QAsBN,qCAAqC;YACnC,IAAI;YACJ,IAAI;;QA0BN,2CAA2C;YACzC,IAAI;YACJ,IAAI;;QAyBN,+BAA+B;YAC7B,IAAI;YACJ,IAAI;;;;QAkBN,IAAI;QACJ,IAAI;;;;YA3kCJ,IAAI;YACJ,IAAI;;;YAMJ,IAAI;YACJ,IAAI;;;;QA+kCJ,IAAI;QACJ,IAAI;;;QASJ,IAAI;QACJ,IAAI;;;QAgBJ,gBAAgB;YACd,IAAI;YACJ,IAAI;;QAoBN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAaN,mBAAmB;YACjB,IAAI;YACJ,IAAI;;;;QAWN,IAAI;QACJ,IAAI;;;QAYJ,IAAI;QACJ,IAAI;;;QAsBJ,IAAI;QACJ,IAAI;;;QAUJ,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;;;QAYJ,IAAI;QACJ,IAAI;;;QASJ,UAAU;YACR,IAAI;YACJ,IAAI;;QAON,YAAY;YACV,IAAI;YACJ,IAAI;;QASN,cAAc;YACZ,IAAI;YACJ,IAAI;;QAON,aAAa;YACX,IAAI;YACJ,IAAI;;QAoBN,UAAU;YACR,IAAI;YACJ,MAAM;YACN,IAAI;;QAYN,UAAU;YACR,IAAI;YACJ,IAAI;;QAWN,YAAY;YACV,IAAI;YAGJ,IAAI;;QAWN,QAAQ;YACN,IAAI;;QAKN,SAAS;YACP,IAAI;YACJ,IAAI;;QAON,iBAAiB;YACf,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,QAAQ;YACN,IAAI;YACJ,IAAI;;QAMN,MAAM;YACJ,IAAI;YACJ,IAAI;;QAON,IAAI;YACF,IAAI;YACJ,IAAI;;QAQN,qBAAqB;YACnB,IAAI;YACJ,IAAI;;QAUN,sBAAsB;YACpB,IAAI;YACJ,UAAU;YACV,MAAM;;QAGR,sBAAsB;YACpB,IAAI;YACJ,IAAI;;QAUN,0BAA0B;YACxB,IAAI;YACJ,IAAI;;QAqBN,YAAY;YACV,IAAI;YACJ,IAAI;;QAgBN,gCAAgC;YAC9B,IAAI;YACJ,IAAI;;QAYN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAiBN,gCAAgC;YAC9B,IAAI;YACJ,IAAI;;QAcN,kBAAkB;YAChB,IAAI;YACJ,IAAI;;QAMN,oBAAoB;YAClB,IAAI;YACJ,IAAI;;QAQN,aAAa;YACX,IAAI;YACJ,IAAI;;;;QASN,IAAI;QACJ,IAAI;;;QAMJ,gBAAgB;YACd,IAAI;YACJ,IAAI;;QASN,WAAW;YACT,IAAI;YACJ,MAAM;YACN,IAAI;;QAMN,QAAQ;YACN,IAAI;YACJ,IAAI;;;;QASN,OAAO;YACL,IAAI;YACJ,IAAI;;QASN,aAAa;YACX,IAAI;YACJ,IAAI;;QASN,UAAU;YACR,IAAI;YACJ,IAAI;;QAON,eAAe;YACb,IAAI;YACJ,IAAI;;;IAOR,kBAAkB;;QAEhB,IAAI;QACJ,UAAU;QAKV,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;;;QAIJ,IAAI;QACJ,IAAI;;;QASJ,OAAO;YACL,IAAI;YACJ,IAAI;;QAYN,qBAAqB;YACnB,IAAI;YACJ,IAAI;;;CAST,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAIpD,wBAAgB,aAAa,CAC3B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,UAAU,CAaZ;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,GAAG,cAAc,CAAM,GAC9D,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAUzB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,oBAAoB,CAItB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,GAAG,SAAS,GACpD,MAAM,CAER;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,EACnD,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAET;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,GAAG,kBAAkB,CAAC,EACxE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,WAAW,GAAG,SAAS,CAEzB;AAgDD;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAST;AAgBD,wBAAgB,kBAAkB,SAEjC"}

package/out/zero-cache/src/config/zero-config.js

@@ -7,7 +7,7 @@ import { singleProcessMode } from "../types/processes.js";
 import { ALLOWED_APP_ID_CHARACTERS, INVALID_APP_ID_MESSAGE } from "../types/shards.js";
 import { DEFAULT_PREFERRED_PREFIXES } from "./network.js";
 import { assertNormalized, isDevelopmentMode } from "./normalize.js";
-import { timingSafeEqual } from "node:crypto";
+import { createHash, timingSafeEqual } from "node:crypto";
 //#region ../zero-cache/src/config/zero-config.ts
 /**
 * These types represent the _compiled_ config whereas `define-config` types represent the _source_ config.
@@ -137,6 +137,16 @@ var authOptions = {
 	retransformIntervalSeconds: {
 		type: valita_exports.number().optional(() => 300),
 		desc: [`The interval in seconds between periodic shared /query retransform work for a client group.`, `If unset, periodic shared retransform is disabled.`]
+	},
+	requireServerUserID: {
+		type: valita_exports.boolean().optional(() => false),
+		desc: [
+			`Refuse a connection that claims a userID when the API server's answer to`,
+			`/query or /mutate does not include a userID, unless a legacy JWT verified`,
+			`it. Without this, zero-cache trusts the userID the client claims and logs`,
+			`a warning. Turn it on once your API server returns the userID ({bold null}`,
+			`for logged-out callers).`
+		]
 	}
 };
 var makeDeprecationMessage = (flag) => `Use {bold ${flagToEnv(ZERO_ENV_VAR_PREFIX, flag)}} (or {bold --${flag}}) instead.`;
@@ -727,6 +737,23 @@ var zeroOptions = {
 				`on port 4849.`
 			]
 		},
+		secret: {
+			type: valita_exports.string().optional(),
+			desc: [
+				`A shared secret that authenticates {bold view-syncers} to the {bold change-streamer}.`,
+				`View-syncers present it when connecting to the {bold replication-manager}, which`,
+				`refuses replication connections that do not present it. Set it to the same value`,
+				`on the replication-manager and on every view-syncer.`,
+				``,
+				`In a single-node configuration zero-cache generates a secret for its own workers,`,
+				`so no value is needed. In a multi-node configuration it should always be set: while`,
+				`it is unset, the replication-manager accepts replication connections from anything`,
+				`that can reach its {bold change-streamer-port}, and logs a warning on startup.`,
+				``,
+				`For a rolling upgrade, set the secret on the view-syncers before setting it on the`,
+				`replication-manager, as a replication-manager without a secret accepts both.`
+			]
+		},
 		/** @deprecated */
 		mode: {
 			type: literalUnion("dedicated", "discover").optional(() => "dedicated"),
@@ -1054,6 +1081,16 @@ var zeroOptions = {
 			`If it is the same as the {bold admin-password}, it grants admin access.`
 		]
 	},
+	enableHeapz: {
+		type: valita_exports.boolean().optional(() => true),
+		desc: [
+			`Serves heap snapshots of the zero-cache process at {bold /heapz} to the`,
+			`{bold admin-password}. A heap snapshot contains everything the process`,
+			`holds in memory, including the auth tokens, cookies and API keys of`,
+			`connected clients. Set this to {bold false} to turn the endpoint off`,
+			`while keeping the other diagnostic endpoints and the inspector.`
+		]
+	},
 	websocketCompression: {
 		type: valita_exports.boolean().optional(() => false),
 		desc: [
@@ -1544,15 +1581,16 @@ function getAccess(lc, { adminPassword }, operatorPassword, password) {
 	}
 	lc.warn?.(operatorPassword ? "Invalid admin or operator password" : "Invalid admin password");
 }
+/**
+* Compares `password` with `expected` in constant time. Returns `false` when
+* no `expected` password is configured.
+*/
 function passwordMatches(password, expected) {
 	if (!expected) return false;
-	const passwordBuffer = Buffer.from(password ?? "");
-	const expectedBuffer = Buffer.from(expected);
-	if (passwordBuffer.length !== expectedBuffer.length) {
-		timingSafeEqual(expectedBuffer, expectedBuffer);
-		return false;
-	}
-	return timingSafeEqual(passwordBuffer, expectedBuffer);
+	return timingSafeEqual(sha256(password ?? ""), sha256(expected));
+}
+function sha256(value) {
+	return createHash("sha256").update(value).digest();
 }
 var hasWarned = false;
 function warnOnce(lc, msg) {
@@ -1562,6 +1600,6 @@ function warnOnce(lc, msg) {
 	}
 }
 //#endregion
-export { ZERO_ENV_VAR_PREFIX, appOptions, getLogConfig, getNormalizedZeroConfig, getOperatorAccess, getServerVersion, getZeroConfig, isAdminPasswordValid, shardOptions, zeroOptions };
+export { ZERO_ENV_VAR_PREFIX, appOptions, getLogConfig, getNormalizedZeroConfig, getOperatorAccess, getServerVersion, getZeroConfig, isAdminPasswordValid, passwordMatches, shardOptions, zeroOptions };
 
 //# sourceMappingURL=zero-config.js.map