@rocicorp/zero 1.12.0-canary.11 → 1.12.0-canary.13

package/out/shared/src/random-values.js

@@ -1,9 +1,43 @@
 //#region ../shared/src/random-values.ts
-function getNonCryptoRandomValues(array) {
-	if (array === null) throw new TypeError("array cannot be null");
-	for (let i = 0; i < array.length; i++) array[i] = Math.floor(Math.random() * 256);
+var warnedAboutFallback = false;
+/**
+* Fills `array` with random values. Uses `crypto.getRandomValues` when the
+* runtime provides it, then the native `ExpoCrypto` module when running in an
+* Expo app, and falls back to `Math.random` otherwise, logging a warning the
+* first time the fallback is used.
+*
+* React Native's Hermes engine has no WebCrypto. Expo installs its native
+* modules on `globalThis.expo.modules`, and `ExpoCrypto` is there in Expo Go
+* and in any app that has `expo-crypto` installed, even if the app never
+* imports it. Other React Native apps should import a polyfill such as
+* `react-native-get-random-values` before creating IDs.
+*
+* The globals are looked up on every call rather than at module load: some
+* runtimes (e.g. Cloudflare Workers) only allow generating random values
+* while handling a request.
+*/
+function getRandomValues(array) {
+	const { crypto } = globalThis;
+	if (typeof crypto?.getRandomValues === "function") return crypto.getRandomValues(array);
+	if (getRandomValuesFromExpo(array)) return array;
+	if (!warnedAboutFallback) {
+		warnedAboutFallback = true;
+		console.warn("crypto.getRandomValues is not available; falling back to Math.random for IDs. On React Native, install expo-crypto or import react-native-get-random-values.");
+	}
+	const max = 2 ** (array.BYTES_PER_ELEMENT * 8);
+	for (let i = 0; i < array.length; i++) array[i] = Math.floor(Math.random() * max);
 	return array;
 }
+function getRandomValuesFromExpo(array) {
+	try {
+		const expoCrypto = globalThis.expo?.modules?.ExpoCrypto;
+		if (typeof expoCrypto?.getRandomValues === "function") {
+			expoCrypto.getRandomValues(array);
+			return true;
+		}
+	} catch {}
+	return false;
+}
 function randomCharacters(length) {
 	let result = "";
 	const characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
@@ -16,6 +50,6 @@ function randomCharacters(length) {
 	return result;
 }
 //#endregion
-export { getNonCryptoRandomValues, randomCharacters };
+export { getRandomValues, randomCharacters };
 
 //# sourceMappingURL=random-values.js.map

package/out/shared/src/random-values.js.map

@@ -1 +1 @@
-{"version":3,"file":"random-values.js","names":[],"sources":["../../../../shared/src/random-values.ts"],"sourcesContent":["export function getNonCryptoRandomValues(array: Uint8Array) {\n  if (array === null) {\n    throw new TypeError('array cannot be null');\n  }\n\n  // Fill the array with random values\n  for (let i = 0; i < array.length; i++) {\n    array[i] = Math.floor(Math.random() * 256); // Random byte (0-255)\n  }\n\n  return array;\n}\n\nexport function randomCharacters(length: number) {\n  let result = '';\n  const characters =\n    'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';\n  const charactersLength = characters.length;\n  let counter = 0;\n  while (counter < length) {\n    result += characters.charAt(Math.floor(Math.random() * charactersLength));\n    counter += 1;\n  }\n  return result;\n}\n"],"mappings":";AAAA,SAAgB,yBAAyB,OAAmB;CAC1D,IAAI,UAAU,MACZ,MAAM,IAAI,UAAU,sBAAsB;CAI5C,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAChC,MAAM,KAAK,KAAK,MAAM,KAAK,OAAO,IAAI,GAAG;CAG3C,OAAO;AACT;AAEA,SAAgB,iBAAiB,QAAgB;CAC/C,IAAI,SAAS;CACb,MAAM,aACJ;CACF,MAAM,mBAAmB;CACzB,IAAI,UAAU;CACd,OAAO,UAAU,QAAQ;EACvB,UAAU,WAAW,OAAO,KAAK,MAAM,KAAK,OAAO,IAAI,gBAAgB,CAAC;EACxE,WAAW;CACb;CACA,OAAO;AACT"}
+{"version":3,"file":"random-values.js","names":[],"sources":["../../../../shared/src/random-values.ts"],"sourcesContent":["let warnedAboutFallback = false;\n\ntype RandomArray = Uint8Array<ArrayBuffer> | Uint32Array<ArrayBuffer>;\n\ntype ExpoGlobal = {\n  expo?:\n    | {\n        modules?:\n          | {\n              ExpoCrypto?:\n                | {getRandomValues?: ((array: RandomArray) => void) | undefined}\n                | undefined;\n            }\n          | undefined;\n      }\n    | undefined;\n};\n\n/**\n * Fills `array` with random values. Uses `crypto.getRandomValues` when the\n * runtime provides it, then the native `ExpoCrypto` module when running in an\n * Expo app, and falls back to `Math.random` otherwise, logging a warning the\n * first time the fallback is used.\n *\n * React Native's Hermes engine has no WebCrypto. Expo installs its native\n * modules on `globalThis.expo.modules`, and `ExpoCrypto` is there in Expo Go\n * and in any app that has `expo-crypto` installed, even if the app never\n * imports it. Other React Native apps should import a polyfill such as\n * `react-native-get-random-values` before creating IDs.\n *\n * The globals are looked up on every call rather than at module load: some\n * runtimes (e.g. Cloudflare Workers) only allow generating random values\n * while handling a request.\n */\nexport function getRandomValues<T extends RandomArray>(array: T): T {\n  const {crypto} = globalThis;\n  if (typeof crypto?.getRandomValues === 'function') {\n    return crypto.getRandomValues(array);\n  }\n\n  if (getRandomValuesFromExpo(array)) {\n    return array;\n  }\n\n  if (!warnedAboutFallback) {\n    warnedAboutFallback = true;\n    // oxlint-disable-next-line no-console\n    console.warn(\n      'crypto.getRandomValues is not available; falling back to Math.random for IDs. ' +\n        'On React Native, install expo-crypto or import react-native-get-random-values.',\n    );\n  }\n  const max = 2 ** (array.BYTES_PER_ELEMENT * 8);\n  for (let i = 0; i < array.length; i++) {\n    array[i] = Math.floor(Math.random() * max);\n  }\n  return array;\n}\n\nfunction getRandomValuesFromExpo(array: RandomArray): boolean {\n  try {\n    const expoCrypto = (globalThis as ExpoGlobal).expo?.modules?.ExpoCrypto;\n    if (typeof expoCrypto?.getRandomValues === 'function') {\n      expoCrypto.getRandomValues(array);\n      return true;\n    }\n  } catch {\n    // Loading a native module can throw (Expo's own lookup guards against\n    // this too). Use the fallback.\n  }\n  return false;\n}\n\nexport function randomCharacters(length: number) {\n  let result = '';\n  const characters =\n    'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';\n  const charactersLength = characters.length;\n  let counter = 0;\n  while (counter < length) {\n    result += characters.charAt(Math.floor(Math.random() * charactersLength));\n    counter += 1;\n  }\n  return result;\n}\n"],"mappings":";AAAA,IAAI,sBAAsB;;;;;;;;;;;;;;;;;AAkC1B,SAAgB,gBAAuC,OAAa;CAClE,MAAM,EAAC,WAAU;CACjB,IAAI,OAAO,QAAQ,oBAAoB,YACrC,OAAO,OAAO,gBAAgB,KAAK;CAGrC,IAAI,wBAAwB,KAAK,GAC/B,OAAO;CAGT,IAAI,CAAC,qBAAqB;EACxB,sBAAsB;EAEtB,QAAQ,KACN,8JAEF;CACF;CACA,MAAM,MAAM,MAAM,MAAM,oBAAoB;CAC5C,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAChC,MAAM,KAAK,KAAK,MAAM,KAAK,OAAO,IAAI,GAAG;CAE3C,OAAO;AACT;AAEA,SAAS,wBAAwB,OAA6B;CAC5D,IAAI;EACF,MAAM,aAAc,WAA0B,MAAM,SAAS;EAC7D,IAAI,OAAO,YAAY,oBAAoB,YAAY;GACrD,WAAW,gBAAgB,KAAK;GAChC,OAAO;EACT;CACF,QAAQ,CAGR;CACA,OAAO;AACT;AAEA,SAAgB,iBAAiB,QAAgB;CAC/C,IAAI,SAAS;CACb,MAAM,aACJ;CACF,MAAM,mBAAmB;CACzB,IAAI,UAAU;CACd,OAAO,UAAU,QAAQ;EACvB,UAAU,WAAW,OAAO,KAAK,MAAM,KAAK,OAAO,IAAI,gBAAgB,CAAC;EACxE,WAAW;CACb;CACA,OAAO;AACT"}

package/out/shared/src/tuple-map.d.ts

@@ -0,0 +1,22 @@
+/**
+ * A map whose keys are tuples. Two keys are the same if they have the same
+ * length and their elements are the same, as a {@link Map} compares keys. No
+ * key is serialized, so the elements can be objects, compared by identity.
+ *
+ * Keys of different lengths can be mixed: a key and a prefix of it are
+ * different keys.
+ *
+ * The values cannot be `undefined`, which is how a missing entry is told
+ * apart.
+ */
+export declare class TupleMap<K extends readonly unknown[], V extends {} | null> {
+    #private;
+    get(key: K): V | undefined;
+    set(key: K, value: V): this;
+    /**
+     * Returns the value for {@link key}. If there is none, calls
+     * {@link compute} with the key, inserts the result and returns it.
+     */
+    getOrInsertComputed(key: K, compute: (key: K) => V): V;
+}
+//# sourceMappingURL=tuple-map.d.ts.map

package/out/shared/src/tuple-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tuple-map.d.ts","sourceRoot":"","sources":["../../../../shared/src/tuple-map.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;GAUG;AACH,qBAAa,QAAQ,CAAC,CAAC,SAAS,SAAS,OAAO,EAAE,EAAE,CAAC,SAAS,EAAE,GAAG,IAAI;;IAGrE,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,SAAS,CASzB;IAED,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAG1B;IAED;;;OAGG;IACH,mBAAmB,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAOrD;CASF"}

package/out/shared/src/tuple-map.js

@@ -0,0 +1,48 @@
+import { getOrInsertComputed } from "./map.js";
+//#region ../shared/src/tuple-map.ts
+var newNode = () => [void 0, /* @__PURE__ */ new Map()];
+/**
+* A map whose keys are tuples. Two keys are the same if they have the same
+* length and their elements are the same, as a {@link Map} compares keys. No
+* key is serialized, so the elements can be objects, compared by identity.
+*
+* Keys of different lengths can be mixed: a key and a prefix of it are
+* different keys.
+*
+* The values cannot be `undefined`, which is how a missing entry is told
+* apart.
+*/
+var TupleMap = class {
+	#root = newNode();
+	get(key) {
+		let node = this.#root;
+		for (const element of key) {
+			node = node[1].get(element);
+			if (node === void 0) return;
+		}
+		return node[0];
+	}
+	set(key, value) {
+		this.#node(key)[0] = value;
+		return this;
+	}
+	/**
+	* Returns the value for {@link key}. If there is none, calls
+	* {@link compute} with the key, inserts the result and returns it.
+	*/
+	getOrInsertComputed(key, compute) {
+		const node = this.#node(key);
+		let value = node[0];
+		if (value === void 0) value = node[0] = compute(key);
+		return value;
+	}
+	#node(key) {
+		let node = this.#root;
+		for (const element of key) node = getOrInsertComputed(node[1], element, newNode);
+		return node;
+	}
+};
+//#endregion
+export { TupleMap };
+
+//# sourceMappingURL=tuple-map.js.map

package/out/shared/src/tuple-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tuple-map.js","names":[],"sources":["../../../../shared/src/tuple-map.ts"],"sourcesContent":["import {getOrInsertComputed} from './map.ts';\n\n/** The value for the key that ends at this node, and the longer keys. */\ntype Node<V> = [value: V | undefined, children: Map<unknown, Node<V>>];\n\nconst newNode = <V>(): Node<V> => [undefined, new Map()];\n\n/**\n * A map whose keys are tuples. Two keys are the same if they have the same\n * length and their elements are the same, as a {@link Map} compares keys. No\n * key is serialized, so the elements can be objects, compared by identity.\n *\n * Keys of different lengths can be mixed: a key and a prefix of it are\n * different keys.\n *\n * The values cannot be `undefined`, which is how a missing entry is told\n * apart.\n */\nexport class TupleMap<K extends readonly unknown[], V extends {} | null> {\n  readonly #root: Node<V> = newNode();\n\n  get(key: K): V | undefined {\n    let node: Node<V> | undefined = this.#root;\n    for (const element of key) {\n      node = node[1].get(element);\n      if (node === undefined) {\n        return undefined;\n      }\n    }\n    return node[0];\n  }\n\n  set(key: K, value: V): this {\n    this.#node(key)[0] = value;\n    return this;\n  }\n\n  /**\n   * Returns the value for {@link key}. If there is none, calls\n   * {@link compute} with the key, inserts the result and returns it.\n   */\n  getOrInsertComputed(key: K, compute: (key: K) => V): V {\n    const node = this.#node(key);\n    let value = node[0];\n    if (value === undefined) {\n      value = node[0] = compute(key);\n    }\n    return value;\n  }\n\n  #node(key: K): Node<V> {\n    let node = this.#root;\n    for (const element of key) {\n      node = getOrInsertComputed(node[1], element, newNode<V>);\n    }\n    return node;\n  }\n}\n"],"mappings":";;AAKA,IAAM,gBAA4B,CAAC,KAAA,mBAAW,IAAI,IAAI,CAAC;;;;;;;;;;;;AAavD,IAAa,WAAb,MAAyE;CACvE,QAA0B,QAAQ;CAElC,IAAI,KAAuB;EACzB,IAAI,OAA4B,KAAK;EACrC,KAAK,MAAM,WAAW,KAAK;GACzB,OAAO,KAAK,EAAE,CAAC,IAAI,OAAO;GAC1B,IAAI,SAAS,KAAA,GACX;EAEJ;EACA,OAAO,KAAK;CACd;CAEA,IAAI,KAAQ,OAAgB;EAC1B,KAAK,MAAM,GAAG,CAAC,CAAC,KAAK;EACrB,OAAO;CACT;;;;;CAMA,oBAAoB,KAAQ,SAA2B;EACrD,MAAM,OAAO,KAAK,MAAM,GAAG;EAC3B,IAAI,QAAQ,KAAK;EACjB,IAAI,UAAU,KAAA,GACZ,QAAQ,KAAK,KAAK,QAAQ,GAAG;EAE/B,OAAO;CACT;CAEA,MAAM,KAAiB;EACrB,IAAI,OAAO,KAAK;EAChB,KAAK,MAAM,WAAW,KACpB,OAAO,oBAAoB,KAAK,IAAI,SAAS,OAAU;EAEzD,OAAO;CACT;AACF"}

package/out/zero/package.js

@@ -1,6 +1,6 @@
 //#region package.json
 var name = "@rocicorp/zero";
-var version = "1.12.0-canary.11";
+var version = "1.12.0-canary.13";
 var description = "Zero is a web framework for serverless web development.";
 var homepage = "https://zero.rocicorp.dev";
 var bugs = { "url": "https://bugs.rocicorp.dev" };

package/out/zero/package.js.map

@@ -1 +1 @@
-{"version":3,"file":"package.js","names":[],"sources":["../../package.json"],"sourcesContent":["{\n  \"name\": \"@rocicorp/zero\",\n  \"version\": \"1.12.0-canary.11\",\n  \"description\": \"Zero is a web framework for serverless web development.\",\n  \"homepage\": \"https://zero.rocicorp.dev\",\n  \"bugs\": {\n    \"url\": \"https://bugs.rocicorp.dev\"\n  },\n  \"license\": \"Apache-2.0\",\n  \"author\": \"Rocicorp, Inc.\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/rocicorp/mono.git\",\n    \"directory\": \"packages/zero\"\n  },\n  \"bin\": {\n    \"ast-to-zql\": \"./out/zero/src/ast-to-zql.js\",\n    \"transform-query\": \"./out/zero/src/transform-query.js\",\n    \"zero-build-schema\": \"./out/zero/src/build-schema.js\",\n    \"zero-cache\": \"./out/zero/src/cli.js\",\n    \"zero-cache-dev\": \"./out/zero/src/zero-cache-dev.js\",\n    \"zero-deploy-permissions\": \"./out/zero/src/deploy-permissions.js\",\n    \"zero-out\": \"./out/zero/src/zero-out.js\"\n  },\n  \"files\": [\n    \"out\",\n    \"!*.tsbuildinfo\"\n  ],\n  \"type\": \"module\",\n  \"main\": \"out/zero/src/zero.js\",\n  \"module\": \"out/zero/src/zero.js\",\n  \"types\": \"out/zero/src/zero.d.ts\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./out/zero/src/zero.d.ts\",\n      \"default\": \"./out/zero/src/zero.js\"\n    },\n    \"./analyze\": {\n      \"types\": \"./out/zero/src/analyze.d.ts\",\n      \"default\": \"./out/zero/src/analyze.js\"\n    },\n    \"./bindings\": {\n      \"types\": \"./out/zero/src/bindings.d.ts\",\n      \"default\": \"./out/zero/src/bindings.js\"\n    },\n    \"./change-protocol/v0\": {\n      \"types\": \"./out/zero/src/change-protocol/v0.d.ts\",\n      \"default\": \"./out/zero/src/change-protocol/v0.js\"\n    },\n    \"./expo-sqlite\": {\n      \"types\": \"./out/zero/src/expo-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/expo-sqlite.js\"\n    },\n    \"./op-sqlite\": {\n      \"types\": \"./out/zero/src/op-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/op-sqlite.js\"\n    },\n    \"./pg\": {\n      \"types\": \"./out/zero/src/pg.d.ts\",\n      \"default\": \"./out/zero/src/pg.js\"\n    },\n    \"./react\": {\n      \"types\": \"./out/zero/src/react.d.ts\",\n      \"default\": \"./out/zero/src/react.js\"\n    },\n    \"./react-native\": {\n      \"types\": \"./out/zero/src/react-native.d.ts\",\n      \"default\": \"./out/zero/src/react-native.js\"\n    },\n    \"./server\": {\n      \"types\": \"./out/zero/src/server.d.ts\",\n      \"default\": \"./out/zero/src/server.js\"\n    },\n    \"./server/adapters/drizzle\": {\n      \"types\": \"./out/zero/src/adapters/drizzle.d.ts\",\n      \"default\": \"./out/zero/src/adapters/drizzle.js\"\n    },\n    \"./server/adapters/kysely\": {\n      \"types\": \"./out/zero/src/adapters/kysely.d.ts\",\n      \"default\": \"./out/zero/src/adapters/kysely.js\"\n    },\n    \"./server/adapters/prisma\": {\n      \"types\": \"./out/zero/src/adapters/prisma.d.ts\",\n      \"default\": \"./out/zero/src/adapters/prisma.js\"\n    },\n    \"./server/adapters/pg\": {\n      \"types\": \"./out/zero/src/adapters/pg.d.ts\",\n      \"default\": \"./out/zero/src/adapters/pg.js\"\n    },\n    \"./server/adapters/postgresjs\": {\n      \"types\": \"./out/zero/src/adapters/postgresjs.d.ts\",\n      \"default\": \"./out/zero/src/adapters/postgresjs.js\"\n    },\n    \"./solid\": {\n      \"types\": \"./out/zero/src/solid.d.ts\",\n      \"default\": \"./out/zero/src/solid.js\"\n    },\n    \"./sqlite\": {\n      \"types\": \"./out/zero/src/sqlite.d.ts\",\n      \"default\": \"./out/zero/src/sqlite.js\"\n    },\n    \"./zqlite\": {\n      \"types\": \"./out/zero/src/zqlite.d.ts\",\n      \"default\": \"./out/zero/src/zqlite.js\"\n    }\n  },\n  \"scripts\": {\n    \"build\": \"node --experimental-strip-types --no-warnings tool/build.ts\",\n    \"build:watch\": \"node --experimental-strip-types --no-warnings tool/build.ts --watch\",\n    \"check-types\": \"tsc -p tsconfig.client.json && tsc -p tsconfig.server.json\",\n    \"check-types:client:watch\": \"tsc -p tsconfig.client.json --watch\",\n    \"check-types:server:watch\": \"tsc -p tsconfig.server.json --watch\",\n    \"format\": \"oxfmt .\",\n    \"check-format\": \"oxfmt --check .\",\n    \"lint\": \"oxlint --quiet --config ../../oxlint.config.ts src/\",\n    \"docs\": \"node --experimental-strip-types --no-warnings tool/generate-docs.ts\",\n    \"docs:server\": \"node --watch --experimental-strip-types --no-warnings tool/generate-docs.ts --server\",\n    \"fmt\": \"oxfmt .\",\n    \"check-fmt\": \"oxfmt --check .\"\n  },\n  \"dependencies\": {\n    \"@badrap/valita\": \"0.5.5\",\n    \"@databases/escape-identifier\": \"^1.0.3\",\n    \"@databases/sql\": \"^3.3.0\",\n    \"@dotenvx/dotenvx\": \"^1.66.0\",\n    \"@drdgvhbh/postgres-error-codes\": \"^0.0.6\",\n    \"@fastify/cors\": \"^10.1.0\",\n    \"@fastify/websocket\": \"^11.2.0\",\n    \"@google-cloud/precise-date\": \"^4.0.0\",\n    \"@opentelemetry/api\": \"1.9.1\",\n    \"@opentelemetry/api-logs\": \"0.223.0\",\n    \"@opentelemetry/auto-instrumentations-node\": \"0.81.2\",\n    \"@opentelemetry/exporter-metrics-otlp-http\": \"0.223.0\",\n    \"@opentelemetry/resources\": \"2.12.0\",\n    \"@opentelemetry/sdk-metrics\": \"2.12.0\",\n    \"@opentelemetry/sdk-node\": \"0.223.0\",\n    \"@opentelemetry/sdk-trace-node\": \"2.12.0\",\n    \"@opentelemetry/semantic-conventions\": \"1.43.0\",\n    \"@postgresql-typed/oids\": \"^0.2.0\",\n    \"@rocicorp/lock\": \"^2.0.1\",\n    \"@rocicorp/logger\": \"^6.1.0\",\n    \"@rocicorp/zero-sqlite3\": \"^1.1.7\",\n    \"@standard-schema/spec\": \"^1.1.0\",\n    \"@types/basic-auth\": \"^1.1.8\",\n    \"@types/ws\": \"^8.18.1\",\n    \"basic-auth\": \"^2.0.1\",\n    \"chalk-template\": \"^1.1.2\",\n    \"chokidar\": \"^4.0.3\",\n    \"cloudevents\": \"^10.0.0\",\n    \"command-line-args\": \"^6.0.2\",\n    \"command-line-usage\": \"^7.0.4\",\n    \"compare-utf8\": \"^0.2.3\",\n    \"defu\": \"^6.1.7\",\n    \"eventemitter3\": \"^5.0.4\",\n    \"fastify\": \"^5.12.7\",\n    \"is-in-subnet\": \"^4.0.1\",\n    \"jose\": \"^5.10.0\",\n    \"json-custom-numbers\": \"^3.1.1\",\n    \"kasi\": \"^1.1.2\",\n    \"nanoid\": \"^5.1.16\",\n    \"oxc-parser\": \"^0.129.0\",\n    \"oxfmt\": \"^0.74.0\",\n    \"parse-prometheus-text-format\": \"^1.1.1\",\n    \"pg-format\": \"npm:pg-format-fix@^1.0.5\",\n    \"postgres\": \"3.4.7\",\n    \"semver\": \"^7.8.0\",\n    \"url-pattern\": \"^1.0.3\",\n    \"urlpattern-polyfill\": \"^10.1.0\",\n    \"ws\": \"^8.22.0\"\n  },\n  \"devDependencies\": {\n    \"@op-engineering/op-sqlite\": \"^18.2.5\",\n    \"analyze-query\": \"workspace:*\",\n    \"ast-to-zql\": \"workspace:*\",\n    \"expo\": \"^58.0.14\",\n    \"expo-sqlite\": \"^58.0.13\",\n    \"react-native\": \"^0.88.0\",\n    \"replicache\": \"workspace:*\",\n    \"shared\": \"workspace:*\",\n    \"syncpack\": \"^14.3.1\",\n    \"typedoc\": \"^0.28.19\",\n    \"typescript\": \"~7.0.2\",\n    \"vite\": \"^8.3.4\",\n    \"vitest\": \"^5.0.5\",\n    \"zero-cache\": \"workspace:*\",\n    \"zero-client\": \"workspace:*\",\n    \"zero-pg\": \"workspace:*\",\n    \"zero-react\": \"workspace:*\",\n    \"zero-server\": \"workspace:*\",\n    \"zero-solid\": \"workspace:*\",\n    \"zqlite\": \"workspace:*\"\n  },\n  \"engines\": {\n    \"node\": \">=22\"\n  },\n  \"packageManager\": \"pnpm@11.11.0\"\n}\n"],"mappings":""}
+{"version":3,"file":"package.js","names":[],"sources":["../../package.json"],"sourcesContent":["{\n  \"name\": \"@rocicorp/zero\",\n  \"version\": \"1.12.0-canary.13\",\n  \"description\": \"Zero is a web framework for serverless web development.\",\n  \"homepage\": \"https://zero.rocicorp.dev\",\n  \"bugs\": {\n    \"url\": \"https://bugs.rocicorp.dev\"\n  },\n  \"license\": \"Apache-2.0\",\n  \"author\": \"Rocicorp, Inc.\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/rocicorp/mono.git\",\n    \"directory\": \"packages/zero\"\n  },\n  \"bin\": {\n    \"ast-to-zql\": \"./out/zero/src/ast-to-zql.js\",\n    \"transform-query\": \"./out/zero/src/transform-query.js\",\n    \"zero-build-schema\": \"./out/zero/src/build-schema.js\",\n    \"zero-cache\": \"./out/zero/src/cli.js\",\n    \"zero-cache-dev\": \"./out/zero/src/zero-cache-dev.js\",\n    \"zero-deploy-permissions\": \"./out/zero/src/deploy-permissions.js\",\n    \"zero-out\": \"./out/zero/src/zero-out.js\"\n  },\n  \"files\": [\n    \"out\",\n    \"!*.tsbuildinfo\"\n  ],\n  \"type\": \"module\",\n  \"main\": \"out/zero/src/zero.js\",\n  \"module\": \"out/zero/src/zero.js\",\n  \"types\": \"out/zero/src/zero.d.ts\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./out/zero/src/zero.d.ts\",\n      \"default\": \"./out/zero/src/zero.js\"\n    },\n    \"./analyze\": {\n      \"types\": \"./out/zero/src/analyze.d.ts\",\n      \"default\": \"./out/zero/src/analyze.js\"\n    },\n    \"./bindings\": {\n      \"types\": \"./out/zero/src/bindings.d.ts\",\n      \"default\": \"./out/zero/src/bindings.js\"\n    },\n    \"./change-protocol/v0\": {\n      \"types\": \"./out/zero/src/change-protocol/v0.d.ts\",\n      \"default\": \"./out/zero/src/change-protocol/v0.js\"\n    },\n    \"./expo-sqlite\": {\n      \"types\": \"./out/zero/src/expo-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/expo-sqlite.js\"\n    },\n    \"./op-sqlite\": {\n      \"types\": \"./out/zero/src/op-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/op-sqlite.js\"\n    },\n    \"./pg\": {\n      \"types\": \"./out/zero/src/pg.d.ts\",\n      \"default\": \"./out/zero/src/pg.js\"\n    },\n    \"./react\": {\n      \"types\": \"./out/zero/src/react.d.ts\",\n      \"default\": \"./out/zero/src/react.js\"\n    },\n    \"./react-native\": {\n      \"types\": \"./out/zero/src/react-native.d.ts\",\n      \"default\": \"./out/zero/src/react-native.js\"\n    },\n    \"./server\": {\n      \"types\": \"./out/zero/src/server.d.ts\",\n      \"default\": \"./out/zero/src/server.js\"\n    },\n    \"./server/adapters/drizzle\": {\n      \"types\": \"./out/zero/src/adapters/drizzle.d.ts\",\n      \"default\": \"./out/zero/src/adapters/drizzle.js\"\n    },\n    \"./server/adapters/kysely\": {\n      \"types\": \"./out/zero/src/adapters/kysely.d.ts\",\n      \"default\": \"./out/zero/src/adapters/kysely.js\"\n    },\n    \"./server/adapters/prisma\": {\n      \"types\": \"./out/zero/src/adapters/prisma.d.ts\",\n      \"default\": \"./out/zero/src/adapters/prisma.js\"\n    },\n    \"./server/adapters/pg\": {\n      \"types\": \"./out/zero/src/adapters/pg.d.ts\",\n      \"default\": \"./out/zero/src/adapters/pg.js\"\n    },\n    \"./server/adapters/postgresjs\": {\n      \"types\": \"./out/zero/src/adapters/postgresjs.d.ts\",\n      \"default\": \"./out/zero/src/adapters/postgresjs.js\"\n    },\n    \"./solid\": {\n      \"types\": \"./out/zero/src/solid.d.ts\",\n      \"default\": \"./out/zero/src/solid.js\"\n    },\n    \"./sqlite\": {\n      \"types\": \"./out/zero/src/sqlite.d.ts\",\n      \"default\": \"./out/zero/src/sqlite.js\"\n    },\n    \"./zqlite\": {\n      \"types\": \"./out/zero/src/zqlite.d.ts\",\n      \"default\": \"./out/zero/src/zqlite.js\"\n    }\n  },\n  \"scripts\": {\n    \"build\": \"node --experimental-strip-types --no-warnings tool/build.ts\",\n    \"build:watch\": \"node --experimental-strip-types --no-warnings tool/build.ts --watch\",\n    \"check-types\": \"tsc -p tsconfig.client.json && tsc -p tsconfig.server.json\",\n    \"check-types:client:watch\": \"tsc -p tsconfig.client.json --watch\",\n    \"check-types:server:watch\": \"tsc -p tsconfig.server.json --watch\",\n    \"format\": \"oxfmt .\",\n    \"check-format\": \"oxfmt --check .\",\n    \"lint\": \"oxlint --quiet --config ../../oxlint.config.ts src/\",\n    \"docs\": \"node --experimental-strip-types --no-warnings tool/generate-docs.ts\",\n    \"docs:server\": \"node --watch --experimental-strip-types --no-warnings tool/generate-docs.ts --server\",\n    \"fmt\": \"oxfmt .\",\n    \"check-fmt\": \"oxfmt --check .\"\n  },\n  \"dependencies\": {\n    \"@badrap/valita\": \"0.5.5\",\n    \"@databases/escape-identifier\": \"^1.0.3\",\n    \"@databases/sql\": \"^3.3.0\",\n    \"@dotenvx/dotenvx\": \"^1.66.0\",\n    \"@drdgvhbh/postgres-error-codes\": \"^0.0.6\",\n    \"@fastify/cors\": \"^10.1.0\",\n    \"@fastify/websocket\": \"^11.2.0\",\n    \"@google-cloud/precise-date\": \"^4.0.0\",\n    \"@opentelemetry/api\": \"1.9.1\",\n    \"@opentelemetry/api-logs\": \"0.223.0\",\n    \"@opentelemetry/auto-instrumentations-node\": \"0.81.2\",\n    \"@opentelemetry/exporter-metrics-otlp-http\": \"0.223.0\",\n    \"@opentelemetry/resources\": \"2.12.0\",\n    \"@opentelemetry/sdk-metrics\": \"2.12.0\",\n    \"@opentelemetry/sdk-node\": \"0.223.0\",\n    \"@opentelemetry/sdk-trace-node\": \"2.12.0\",\n    \"@opentelemetry/semantic-conventions\": \"1.43.0\",\n    \"@postgresql-typed/oids\": \"^0.2.0\",\n    \"@rocicorp/lock\": \"^2.0.1\",\n    \"@rocicorp/logger\": \"^6.1.0\",\n    \"@rocicorp/zero-sqlite3\": \"^1.1.7\",\n    \"@standard-schema/spec\": \"^1.1.0\",\n    \"@types/basic-auth\": \"^1.1.8\",\n    \"@types/ws\": \"^8.18.1\",\n    \"basic-auth\": \"^2.0.1\",\n    \"chalk-template\": \"^1.1.2\",\n    \"chokidar\": \"^4.0.3\",\n    \"cloudevents\": \"^10.0.0\",\n    \"command-line-args\": \"^6.0.2\",\n    \"command-line-usage\": \"^7.0.4\",\n    \"compare-utf8\": \"^0.2.3\",\n    \"defu\": \"^6.1.7\",\n    \"eventemitter3\": \"^5.0.4\",\n    \"fastify\": \"^5.12.7\",\n    \"is-in-subnet\": \"^4.0.1\",\n    \"jose\": \"^5.10.0\",\n    \"json-custom-numbers\": \"^3.1.1\",\n    \"kasi\": \"^1.1.2\",\n    \"nanoid\": \"^5.1.16\",\n    \"oxc-parser\": \"^0.129.0\",\n    \"oxfmt\": \"^0.74.0\",\n    \"parse-prometheus-text-format\": \"^1.1.1\",\n    \"pg-format\": \"npm:pg-format-fix@^1.0.5\",\n    \"postgres\": \"3.4.7\",\n    \"semver\": \"^7.8.0\",\n    \"url-pattern\": \"^1.0.3\",\n    \"urlpattern-polyfill\": \"^10.1.0\",\n    \"ws\": \"^8.22.0\"\n  },\n  \"devDependencies\": {\n    \"@op-engineering/op-sqlite\": \"^18.2.5\",\n    \"analyze-query\": \"workspace:*\",\n    \"ast-to-zql\": \"workspace:*\",\n    \"expo\": \"^58.0.14\",\n    \"expo-sqlite\": \"^58.0.13\",\n    \"react-native\": \"^0.88.0\",\n    \"replicache\": \"workspace:*\",\n    \"shared\": \"workspace:*\",\n    \"syncpack\": \"^14.3.1\",\n    \"typedoc\": \"^0.28.19\",\n    \"typescript\": \"~7.0.2\",\n    \"vite\": \"^8.3.4\",\n    \"vitest\": \"^5.0.5\",\n    \"zero-cache\": \"workspace:*\",\n    \"zero-client\": \"workspace:*\",\n    \"zero-pg\": \"workspace:*\",\n    \"zero-react\": \"workspace:*\",\n    \"zero-server\": \"workspace:*\",\n    \"zero-solid\": \"workspace:*\",\n    \"zqlite\": \"workspace:*\"\n  },\n  \"engines\": {\n    \"node\": \">=22\"\n  },\n  \"packageManager\": \"pnpm@11.11.0\"\n}\n"],"mappings":""}

package/out/zero-cache/src/auth/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAIrC,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,oCAAoC,CAAC;AAElE,yCAAyC;AACzC,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,OAAO,CAAC;AAExC,MAAM,MAAM,iBAAiB,GAAG,CAC9B,KAAK,EAAE,MAAM,EACb,GAAG,EAAE;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,KACvC,OAAO,CAAC,OAAO,CAAC,CAAC;AAMtB,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,IAAI,GAAG,SAAS,WAQlE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,UAAU,EACd,YAAY,EAAE,IAAI,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,GAC/C,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAoE3B;AAED,gEAAgE;AAChE,wBAAgB,SAAS,CACvB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,IAAI,GAAG,SAAS,EAC/B,QAAQ,EAAE,IAAI,GAAG,SAAS,GAAG,IAAI,oBAgFlC;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,OAAO,GAAG,EAAE,IAAI,SAAS,GAAG,SAAS,CAgCxE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAIrC,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,oCAAoC,CAAC;AAElE,yCAAyC;AACzC,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,OAAO,CAAC;AAExC,MAAM,MAAM,iBAAiB,GAAG,CAC9B,KAAK,EAAE,MAAM,EACb,GAAG,EAAE;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,KACvC,OAAO,CAAC,OAAO,CAAC,CAAC;AAMtB,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,IAAI,GAAG,SAAS,WAQlE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,UAAU,EACd,YAAY,EAAE,IAAI,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,GAC/C,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CA8E3B;AAED,gEAAgE;AAChE,wBAAgB,SAAS,CACvB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,IAAI,GAAG,SAAS,EAC/B,QAAQ,EAAE,IAAI,GAAG,SAAS,GAAG,IAAI,oBAgFlC;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,OAAO,GAAG,EAAE,IAAI,SAAS,GAAG,SAAS,CAgCxE"}

package/out/zero-cache/src/auth/auth.js

@@ -25,6 +25,11 @@ async function resolveAuth(lc, previousAuth, userID, wireAuth, validateLegacyJWT
 			origin: ZeroCache
 		});
 		if (!hasProvidedAuth) {
+			if (validateLegacyJWT !== void 0 && userID !== null) throw new ProtocolError({
+				kind: Unauthorized,
+				message: "No token provided. A connection with a userID requires a token when JWT verification is configured.",
+				origin: ZeroCache
+			});
 			lc.debug?.(`Cleared auth`);
 			return;
 		}

package/out/zero-cache/src/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":["ErrorKind.Unauthorized","ErrorOrigin.ZeroCache","ErrorKind.AuthInvalidated"],"sources":["../../../../../zero-cache/src/auth/auth.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport {ErrorKind} from '../../../zero-protocol/src/error-kind.ts';\nimport {ErrorOrigin} from '../../../zero-protocol/src/error-origin.ts';\nimport {ErrorReason} from '../../../zero-protocol/src/error-reason.ts';\nimport {\n  isProtocolError,\n  ProtocolError,\n  type ErrorBody,\n} from '../../../zero-protocol/src/error.ts';\nimport type {PushError} from '../../../zero-protocol/src/push.ts';\n\n/** @deprecated JWT auth is deprecated */\nexport type JWTAuth = {\n  readonly type: 'jwt';\n  readonly raw: string;\n  readonly decoded: JWTPayload;\n};\n\nexport type OpaqueAuth = {\n  readonly type: 'opaque';\n  readonly raw: string;\n};\n\nexport type Auth = OpaqueAuth | JWTAuth;\n\nexport type ValidateLegacyJWT = (\n  token: string,\n  ctx: {readonly userID: string | undefined},\n) => Promise<JWTAuth>;\n\nfunction isProvidedAuth(wireAuth: string | undefined): wireAuth is string {\n  return wireAuth !== undefined && wireAuth !== '';\n}\n\nexport function authEquals(a: Auth | undefined, b: Auth | undefined) {\n  if (a === b) {\n    return true;\n  }\n  if (!a || !b) {\n    return false;\n  }\n  return a.type === b.type && a.raw === b.raw;\n}\n\n/**\n * Resolves one auth snapshot transition without binding it to a client group.\n */\nexport async function resolveAuth(\n  lc: LogContext,\n  previousAuth: Auth | undefined,\n  userID: string | null,\n  wireAuth: string | undefined,\n  validateLegacyJWT: ValidateLegacyJWT | undefined,\n): Promise<Auth | undefined> {\n  try {\n    const hasProvidedAuth = isProvidedAuth(wireAuth);\n\n    if (previousAuth) {\n      lc.debug?.(`Attempting to update auth from previous value`);\n    } else {\n      lc.debug?.(`Attempting to initialize auth`);\n    }\n\n    if (!hasProvidedAuth && previousAuth) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (!hasProvidedAuth) {\n      lc.debug?.(`Cleared auth`);\n      return undefined;\n    }\n\n    if (userID === null) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message: 'Authenticated connections require a userID.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (validateLegacyJWT !== undefined) {\n      const verifiedToken = await validateLegacyJWT(wireAuth, {userID});\n      const nextAuth = pickToken(lc, previousAuth, verifiedToken);\n      lc.debug?.(`Updated auth with JWT`);\n      return nextAuth;\n    }\n\n    if (previousAuth?.type === 'jwt') {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'Token type cannot change from JWT to opaque. Connections are pinned to a single token type.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (previousAuth?.type === 'opaque' && previousAuth.raw === wireAuth) {\n      lc.debug?.(`Opaque auth unchanged, reusing previous snapshot`);\n      return previousAuth;\n    }\n\n    lc.debug?.(`Updated auth with opaque token`);\n    return {\n      type: 'opaque',\n      raw: wireAuth,\n    };\n  } catch (e) {\n    if (isProtocolError(e)) {\n      throw e;\n    }\n    throw new ProtocolError({\n      kind: ErrorKind.AuthInvalidated,\n      message: `Failed to decode auth token: ${String(e)}`,\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n}\n\n/** @deprecated used only in old JWT validation/rotation auth */\nexport function pickToken(\n  lc: LogContext,\n  previousToken: Auth | undefined,\n  newToken: Auth | undefined | null,\n) {\n  if (newToken === null) {\n    return undefined;\n  }\n\n  if (\n    previousToken?.type &&\n    newToken?.type &&\n    previousToken?.type !== newToken?.type\n  ) {\n    throw new ProtocolError({\n      kind: ErrorKind.Unauthorized,\n      message:\n        'Token type cannot change. Client groups are pinned to a single token type.',\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n\n  if (previousToken === undefined) {\n    lc.debug?.(`No previous token, using new token`);\n    return newToken;\n  }\n\n  if (newToken?.type === 'opaque') {\n    return newToken;\n  }\n\n  if (previousToken.type === 'opaque') {\n    throw new ProtocolError({\n      kind: ErrorKind.Unauthorized,\n      message:\n        'Token type cannot change from opaque to JWT. Client groups are pinned to a single token type.',\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n\n  if (newToken) {\n    if (previousToken.decoded.sub !== newToken.decoded.sub) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'The user id in the new token does not match the previous token. Client groups are pinned to a single user.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (previousToken.decoded.iat === undefined) {\n      lc.debug?.(`No issued at time for the existing token, using new token`);\n      // No issued at time for the existing token? We take the most recently received token.\n      return newToken;\n    }\n\n    if (newToken.decoded.iat === undefined) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'The new token does not have an issued at time but the prior token does. Tokens for a client group must either all have issued at times or all not have issued at times',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    // The new token is newer, so we take it.\n    if (previousToken.decoded.iat < newToken.decoded.iat) {\n      lc.debug?.(`New token is newer, using it`);\n      return newToken;\n    }\n\n    // if the new token is older or the same, we keep the existing token.\n    lc.debug?.(`New token is older or the same, using existing token`);\n    return previousToken;\n  }\n\n  // previousToken !== undefined but newToken is undefined\n  throw new ProtocolError({\n    kind: ErrorKind.Unauthorized,\n    message:\n      'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n    origin: ErrorOrigin.ZeroCache,\n  });\n}\n\nexport function isAuthErrorBody(ex: unknown): ex is ErrorBody | PushError {\n  if (typeof ex !== 'object' || ex === null) {\n    return false;\n  }\n\n  if ('error' in ex) {\n    return (\n      ex.error === 'http' &&\n      'status' in ex &&\n      (ex.status === 401 || ex.status === 403)\n    );\n  }\n\n  if (!('kind' in ex)) {\n    return false;\n  }\n\n  if (\n    ex.kind === ErrorKind.AuthInvalidated ||\n    ex.kind === ErrorKind.Unauthorized\n  ) {\n    return true;\n  }\n\n  return (\n    (ex.kind === ErrorKind.PushFailed ||\n      ex.kind === ErrorKind.TransformFailed) &&\n    'reason' in ex &&\n    ex.reason === ErrorReason.HTTP &&\n    'status' in ex &&\n    (ex.status === 401 || ex.status === 403)\n  );\n}\n"],"mappings":";;;;;AA+BA,SAAS,eAAe,UAAkD;CACxE,OAAO,aAAa,KAAA,KAAa,aAAa;AAChD;AAEA,SAAgB,WAAW,GAAqB,GAAqB;CACnE,IAAI,MAAM,GACR,OAAO;CAET,IAAI,CAAC,KAAK,CAAC,GACT,OAAO;CAET,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;AAC1C;;;;AAKA,eAAsB,YACpB,IACA,cACA,QACA,UACA,mBAC2B;CAC3B,IAAI;EACF,MAAM,kBAAkB,eAAe,QAAQ;EAE/C,IAAI,cACF,GAAG,QAAQ,+CAA+C;OAE1D,GAAG,QAAQ,+BAA+B;EAG5C,IAAI,CAAC,mBAAmB,cACtB,MAAM,IAAI,cAAc;GACtB,MAAMA;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAGH,IAAI,CAAC,iBAAiB;GACpB,GAAG,QAAQ,cAAc;GACzB;EACF;EAEA,IAAI,WAAW,MACb,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SAAS;GACT,QAAQC;EACV,CAAC;EAGH,IAAI,sBAAsB,KAAA,GAAW;GAEnC,MAAM,WAAW,UAAU,IAAI,cAAc,MADjB,kBAAkB,UAAU,EAAC,OAAM,CAAC,CACN;GAC1D,GAAG,QAAQ,uBAAuB;GAClC,OAAO;EACT;EAEA,IAAI,cAAc,SAAS,OACzB,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAGH,IAAI,cAAc,SAAS,YAAY,aAAa,QAAQ,UAAU;GACpE,GAAG,QAAQ,kDAAkD;GAC7D,OAAO;EACT;EAEA,GAAG,QAAQ,gCAAgC;EAC3C,OAAO;GACL,MAAM;GACN,KAAK;EACP;CACF,SAAS,GAAG;EACV,IAAI,gBAAgB,CAAC,GACnB,MAAM;EAER,MAAM,IAAI,cAAc;GACtB,MAAMC;GACN,SAAS,gCAAgC,OAAO,CAAC;GACjD,QAAQD;EACV,CAAC;CACH;AACF;;AAGA,SAAgB,UACd,IACA,eACA,UACA;CACA,IAAI,aAAa,MACf;CAGF,IACE,eAAe,QACf,UAAU,QACV,eAAe,SAAS,UAAU,MAElC,MAAM,IAAI,cAAc;EACtB,MAAMD;EACN,SACE;EACF,QAAQC;CACV,CAAC;CAGH,IAAI,kBAAkB,KAAA,GAAW;EAC/B,GAAG,QAAQ,oCAAoC;EAC/C,OAAO;CACT;CAEA,IAAI,UAAU,SAAS,UACrB,OAAO;CAGT,IAAI,cAAc,SAAS,UACzB,MAAM,IAAI,cAAc;EACtB,MAAMD;EACN,SACE;EACF,QAAQC;CACV,CAAC;CAGH,IAAI,UAAU;EACZ,IAAI,cAAc,QAAQ,QAAQ,SAAS,QAAQ,KACjD,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAGH,IAAI,cAAc,QAAQ,QAAQ,KAAA,GAAW;GAC3C,GAAG,QAAQ,2DAA2D;GAEtE,OAAO;EACT;EAEA,IAAI,SAAS,QAAQ,QAAQ,KAAA,GAC3B,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAIH,IAAI,cAAc,QAAQ,MAAM,SAAS,QAAQ,KAAK;GACpD,GAAG,QAAQ,8BAA8B;GACzC,OAAO;EACT;EAGA,GAAG,QAAQ,sDAAsD;EACjE,OAAO;CACT;CAGA,MAAM,IAAI,cAAc;EACtB,MAAMD;EACN,SACE;EACF,QAAQC;CACV,CAAC;AACH;AAEA,SAAgB,gBAAgB,IAA0C;CACxE,IAAI,OAAO,OAAO,YAAY,OAAO,MACnC,OAAO;CAGT,IAAI,WAAW,IACb,OACE,GAAG,UAAU,UACb,YAAY,OACX,GAAG,WAAW,OAAO,GAAG,WAAW;CAIxC,IAAI,EAAE,UAAU,KACd,OAAO;CAGT,IACE,GAAG,SAAS,qBACZ,GAAG,SAAS,gBAEZ,OAAO;CAGT,QACG,GAAG,SAAS,gBACX,GAAG,SAAS,sBACd,YAAY,MACZ,GAAG,WAAW,UACd,YAAY,OACX,GAAG,WAAW,OAAO,GAAG,WAAW;AAExC"}
+{"version":3,"file":"auth.js","names":["ErrorKind.Unauthorized","ErrorOrigin.ZeroCache","ErrorKind.AuthInvalidated"],"sources":["../../../../../zero-cache/src/auth/auth.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport {ErrorKind} from '../../../zero-protocol/src/error-kind.ts';\nimport {ErrorOrigin} from '../../../zero-protocol/src/error-origin.ts';\nimport {ErrorReason} from '../../../zero-protocol/src/error-reason.ts';\nimport {\n  isProtocolError,\n  ProtocolError,\n  type ErrorBody,\n} from '../../../zero-protocol/src/error.ts';\nimport type {PushError} from '../../../zero-protocol/src/push.ts';\n\n/** @deprecated JWT auth is deprecated */\nexport type JWTAuth = {\n  readonly type: 'jwt';\n  readonly raw: string;\n  readonly decoded: JWTPayload;\n};\n\nexport type OpaqueAuth = {\n  readonly type: 'opaque';\n  readonly raw: string;\n};\n\nexport type Auth = OpaqueAuth | JWTAuth;\n\nexport type ValidateLegacyJWT = (\n  token: string,\n  ctx: {readonly userID: string | undefined},\n) => Promise<JWTAuth>;\n\nfunction isProvidedAuth(wireAuth: string | undefined): wireAuth is string {\n  return wireAuth !== undefined && wireAuth !== '';\n}\n\nexport function authEquals(a: Auth | undefined, b: Auth | undefined) {\n  if (a === b) {\n    return true;\n  }\n  if (!a || !b) {\n    return false;\n  }\n  return a.type === b.type && a.raw === b.raw;\n}\n\n/**\n * Resolves one auth snapshot transition without binding it to a client group.\n */\nexport async function resolveAuth(\n  lc: LogContext,\n  previousAuth: Auth | undefined,\n  userID: string | null,\n  wireAuth: string | undefined,\n  validateLegacyJWT: ValidateLegacyJWT | undefined,\n): Promise<Auth | undefined> {\n  try {\n    const hasProvidedAuth = isProvidedAuth(wireAuth);\n\n    if (previousAuth) {\n      lc.debug?.(`Attempting to update auth from previous value`);\n    } else {\n      lc.debug?.(`Attempting to initialize auth`);\n    }\n\n    if (!hasProvidedAuth && previousAuth) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (!hasProvidedAuth) {\n      // With JWT verification configured, the token is the only thing that\n      // ties a connection to its userID. A logged-out connection omits both.\n      if (validateLegacyJWT !== undefined && userID !== null) {\n        throw new ProtocolError({\n          kind: ErrorKind.Unauthorized,\n          message:\n            'No token provided. A connection with a userID requires a token when JWT verification is configured.',\n          origin: ErrorOrigin.ZeroCache,\n        });\n      }\n      lc.debug?.(`Cleared auth`);\n      return undefined;\n    }\n\n    if (userID === null) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message: 'Authenticated connections require a userID.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (validateLegacyJWT !== undefined) {\n      const verifiedToken = await validateLegacyJWT(wireAuth, {userID});\n      const nextAuth = pickToken(lc, previousAuth, verifiedToken);\n      lc.debug?.(`Updated auth with JWT`);\n      return nextAuth;\n    }\n\n    if (previousAuth?.type === 'jwt') {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'Token type cannot change from JWT to opaque. Connections are pinned to a single token type.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (previousAuth?.type === 'opaque' && previousAuth.raw === wireAuth) {\n      lc.debug?.(`Opaque auth unchanged, reusing previous snapshot`);\n      return previousAuth;\n    }\n\n    lc.debug?.(`Updated auth with opaque token`);\n    return {\n      type: 'opaque',\n      raw: wireAuth,\n    };\n  } catch (e) {\n    if (isProtocolError(e)) {\n      throw e;\n    }\n    throw new ProtocolError({\n      kind: ErrorKind.AuthInvalidated,\n      message: `Failed to decode auth token: ${String(e)}`,\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n}\n\n/** @deprecated used only in old JWT validation/rotation auth */\nexport function pickToken(\n  lc: LogContext,\n  previousToken: Auth | undefined,\n  newToken: Auth | undefined | null,\n) {\n  if (newToken === null) {\n    return undefined;\n  }\n\n  if (\n    previousToken?.type &&\n    newToken?.type &&\n    previousToken?.type !== newToken?.type\n  ) {\n    throw new ProtocolError({\n      kind: ErrorKind.Unauthorized,\n      message:\n        'Token type cannot change. Client groups are pinned to a single token type.',\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n\n  if (previousToken === undefined) {\n    lc.debug?.(`No previous token, using new token`);\n    return newToken;\n  }\n\n  if (newToken?.type === 'opaque') {\n    return newToken;\n  }\n\n  if (previousToken.type === 'opaque') {\n    throw new ProtocolError({\n      kind: ErrorKind.Unauthorized,\n      message:\n        'Token type cannot change from opaque to JWT. Client groups are pinned to a single token type.',\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n\n  if (newToken) {\n    if (previousToken.decoded.sub !== newToken.decoded.sub) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'The user id in the new token does not match the previous token. Client groups are pinned to a single user.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (previousToken.decoded.iat === undefined) {\n      lc.debug?.(`No issued at time for the existing token, using new token`);\n      // No issued at time for the existing token? We take the most recently received token.\n      return newToken;\n    }\n\n    if (newToken.decoded.iat === undefined) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'The new token does not have an issued at time but the prior token does. Tokens for a client group must either all have issued at times or all not have issued at times',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    // The new token is newer, so we take it.\n    if (previousToken.decoded.iat < newToken.decoded.iat) {\n      lc.debug?.(`New token is newer, using it`);\n      return newToken;\n    }\n\n    // if the new token is older or the same, we keep the existing token.\n    lc.debug?.(`New token is older or the same, using existing token`);\n    return previousToken;\n  }\n\n  // previousToken !== undefined but newToken is undefined\n  throw new ProtocolError({\n    kind: ErrorKind.Unauthorized,\n    message:\n      'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n    origin: ErrorOrigin.ZeroCache,\n  });\n}\n\nexport function isAuthErrorBody(ex: unknown): ex is ErrorBody | PushError {\n  if (typeof ex !== 'object' || ex === null) {\n    return false;\n  }\n\n  if ('error' in ex) {\n    return (\n      ex.error === 'http' &&\n      'status' in ex &&\n      (ex.status === 401 || ex.status === 403)\n    );\n  }\n\n  if (!('kind' in ex)) {\n    return false;\n  }\n\n  if (\n    ex.kind === ErrorKind.AuthInvalidated ||\n    ex.kind === ErrorKind.Unauthorized\n  ) {\n    return true;\n  }\n\n  return (\n    (ex.kind === ErrorKind.PushFailed ||\n      ex.kind === ErrorKind.TransformFailed) &&\n    'reason' in ex &&\n    ex.reason === ErrorReason.HTTP &&\n    'status' in ex &&\n    (ex.status === 401 || ex.status === 403)\n  );\n}\n"],"mappings":";;;;;AA+BA,SAAS,eAAe,UAAkD;CACxE,OAAO,aAAa,KAAA,KAAa,aAAa;AAChD;AAEA,SAAgB,WAAW,GAAqB,GAAqB;CACnE,IAAI,MAAM,GACR,OAAO;CAET,IAAI,CAAC,KAAK,CAAC,GACT,OAAO;CAET,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;AAC1C;;;;AAKA,eAAsB,YACpB,IACA,cACA,QACA,UACA,mBAC2B;CAC3B,IAAI;EACF,MAAM,kBAAkB,eAAe,QAAQ;EAE/C,IAAI,cACF,GAAG,QAAQ,+CAA+C;OAE1D,GAAG,QAAQ,+BAA+B;EAG5C,IAAI,CAAC,mBAAmB,cACtB,MAAM,IAAI,cAAc;GACtB,MAAMA;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAGH,IAAI,CAAC,iBAAiB;GAGpB,IAAI,sBAAsB,KAAA,KAAa,WAAW,MAChD,MAAM,IAAI,cAAc;IACtB,MAAMD;IACN,SACE;IACF,QAAQC;GACV,CAAC;GAEH,GAAG,QAAQ,cAAc;GACzB;EACF;EAEA,IAAI,WAAW,MACb,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SAAS;GACT,QAAQC;EACV,CAAC;EAGH,IAAI,sBAAsB,KAAA,GAAW;GAEnC,MAAM,WAAW,UAAU,IAAI,cAAc,MADjB,kBAAkB,UAAU,EAAC,OAAM,CAAC,CACN;GAC1D,GAAG,QAAQ,uBAAuB;GAClC,OAAO;EACT;EAEA,IAAI,cAAc,SAAS,OACzB,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAGH,IAAI,cAAc,SAAS,YAAY,aAAa,QAAQ,UAAU;GACpE,GAAG,QAAQ,kDAAkD;GAC7D,OAAO;EACT;EAEA,GAAG,QAAQ,gCAAgC;EAC3C,OAAO;GACL,MAAM;GACN,KAAK;EACP;CACF,SAAS,GAAG;EACV,IAAI,gBAAgB,CAAC,GACnB,MAAM;EAER,MAAM,IAAI,cAAc;GACtB,MAAMC;GACN,SAAS,gCAAgC,OAAO,CAAC;GACjD,QAAQD;EACV,CAAC;CACH;AACF;;AAGA,SAAgB,UACd,IACA,eACA,UACA;CACA,IAAI,aAAa,MACf;CAGF,IACE,eAAe,QACf,UAAU,QACV,eAAe,SAAS,UAAU,MAElC,MAAM,IAAI,cAAc;EACtB,MAAMD;EACN,SACE;EACF,QAAQC;CACV,CAAC;CAGH,IAAI,kBAAkB,KAAA,GAAW;EAC/B,GAAG,QAAQ,oCAAoC;EAC/C,OAAO;CACT;CAEA,IAAI,UAAU,SAAS,UACrB,OAAO;CAGT,IAAI,cAAc,SAAS,UACzB,MAAM,IAAI,cAAc;EACtB,MAAMD;EACN,SACE;EACF,QAAQC;CACV,CAAC;CAGH,IAAI,UAAU;EACZ,IAAI,cAAc,QAAQ,QAAQ,SAAS,QAAQ,KACjD,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAGH,IAAI,cAAc,QAAQ,QAAQ,KAAA,GAAW;GAC3C,GAAG,QAAQ,2DAA2D;GAEtE,OAAO;EACT;EAEA,IAAI,SAAS,QAAQ,QAAQ,KAAA,GAC3B,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAIH,IAAI,cAAc,QAAQ,MAAM,SAAS,QAAQ,KAAK;GACpD,GAAG,QAAQ,8BAA8B;GACzC,OAAO;EACT;EAGA,GAAG,QAAQ,sDAAsD;EACjE,OAAO;CACT;CAGA,MAAM,IAAI,cAAc;EACtB,MAAMD;EACN,SACE;EACF,QAAQC;CACV,CAAC;AACH;AAEA,SAAgB,gBAAgB,IAA0C;CACxE,IAAI,OAAO,OAAO,YAAY,OAAO,MACnC,OAAO;CAGT,IAAI,WAAW,IACb,OACE,GAAG,UAAU,UACb,YAAY,OACX,GAAG,WAAW,OAAO,GAAG,WAAW;CAIxC,IAAI,EAAE,UAAU,KACd,OAAO;CAGT,IACE,GAAG,SAAS,qBACZ,GAAG,SAAS,gBAEZ,OAAO;CAGT,QACG,GAAG,SAAS,gBACX,GAAG,SAAS,sBACd,YAAY,MACZ,GAAG,WAAW,UACd,YAAY,OACX,GAAG,WAAW,OAAO,GAAG,WAAW;AAExC"}

package/out/zero-cache/src/config/zero-config.d.ts

@@ -73,6 +73,10 @@ declare const authOptions: {
         type: v.Type<number>;
         desc: string[];
     };
+    requireServerUserID: {
+        type: v.Type<boolean>;
+        desc: string[];
+    };
 };
 export type AuthConfig = Config<typeof authOptions>;
 /** @deprecated used only by legacy JWT verification helpers */
@@ -468,6 +472,10 @@ export declare const zeroOptions: {
             type: v.Type<number>;
             desc: string[];
         };
+        requireServerUserID: {
+            type: v.Type<boolean>;
+            desc: string[];
+        };
     };
     port: {
         type: v.Type<number>;
@@ -504,6 +512,10 @@ export declare const zeroOptions: {
             type: v.Optional<string>;
             desc: string[];
         };
+        secret: {
+            type: v.Optional<string>;
+            desc: string[];
+        };
         /** @deprecated */
         mode: {
             type: v.Type<"dedicated" | "discover">;
@@ -640,6 +652,10 @@ export declare const zeroOptions: {
         type: v.Optional<string>;
         desc: string[];
     };
+    enableHeapz: {
+        type: v.Type<boolean>;
+        desc: string[];
+    };
     websocketCompression: {
         type: v.Type<boolean>;
         desc: string[];
@@ -861,5 +877,10 @@ export declare function isAdminPasswordValid(lc: LogContext, config: Pick<Normal
  * documents as withheld.
  */
 export declare function getOperatorAccess(lc: LogContext, config: Pick<NormalizedZeroConfig, 'adminPassword' | 'operatorPassword'>, password: string | undefined): AdminAccess | undefined;
+/**
+ * Compares `password` with `expected` in constant time. Returns `false` when
+ * no `expected` password is configured.
+ */
+export declare function passwordMatches(password: string | undefined, expected: string | undefined): boolean;
 export declare function resetWarnOnceState(): void;
 //# sourceMappingURL=zero-config.d.ts.map

package/out/zero-cache/src/config/zero-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zero-config.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/config/zero-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AAUnD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAC,SAAS,EAAC,MAAM,kCAAkC,CAAC;AAEhE,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAK3C,eAAO,MAAM,UAAU;IACrB,EAAE;QACA,IAAI;QAIJ,IAAI;;IAuBN,YAAY;QACV,IAAI;QACJ,IAAI;;CAgBP,CAAC;AAEF,eAAO,MAAM,YAAY;IACvB,EAAE;QACA,IAAI;QASJ,MAAM;;IAGR,GAAG;QACD,IAAI;QACJ,IAAI;QAMJ,MAAM;;CAET,CAAC;AAEF,QAAA,MAAM,cAAc;IAClB,IAAI;QACF,IAAI;QACJ,IAAI;;IAON,mBAAmB;QACjB,IAAI;QACJ,IAAI;;CAOP,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAkB3D,QAAA,MAAM,WAAW;IACf,GAAG;QACD,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,OAAO;QACL,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,MAAM;QACJ,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,MAAM;QACJ,IAAI;QACJ,IAAI;QAIJ,UAAU;;IAIZ,QAAQ;QACN,IAAI;QACJ,IAAI;QAIJ,UAAU;;IAIZ,yBAAyB;QACvB,IAAI;QACJ,IAAI;;IAKN,0BAA0B;QACxB,IAAI;QACJ,IAAI;;CAKP,CAAC;AA0HF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAEpD,+DAA+D;AAC/D,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,UAAU,EACV,KAAK,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CACrD,CAAC;AAKF,eAAO,MAAM,WAAW;;QAEpB,EAAE;YACA,IAAI;YACJ,IAAI;;QAMN,IAAI;YACF,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,QAAQ;YACN,IAAI;YACJ,IAAI;;QAWN,iBAAiB;YACf,IAAI;YACJ,MAAM;;QAGR,yBAAyB;YACvB,IAAI;YACJ,IAAI;;QAYN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAuBN,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YAiBJ,MAAM;;QAGR,iCAAiC;YAC/B,IAAI;YACJ,IAAI;YAUJ,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAeJ,MAAM;;QAMR,sBAAsB;YACpB,IAAI;YACJ,MAAM;;QAGR,wBAAwB;YACtB,IAAI;YACJ,IAAI;;;IAqBR,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAGlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAKhB,IAAI;QACJ,IAAI;;;QAQJ,IAAI;QACJ,IAAI;;;QAQJ,EAAE;YACA,IAAI;YACJ,IAAI;;QAON,QAAQ;YACN,IAAI;YACJ,IAAI;;QASN,iBAAiB;YACf,IAAI;YACJ,MAAM;;QAGR,yCAAyC;YACvC,IAAI;YACJ,IAAI;;QAUN,uCAAuC;YACrC,IAAI;YACJ,IAAI;;QAON,iCAAiC;YAC/B,IAAI;YACJ,IAAI;;;;QAWN,IAAI;QACJ,IAAI;;;QAQJ,IAAI;QACJ,IAAI;QAIJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QASJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;QAeJ,MAAM;;;QAIN,IAAI;QAOJ,IAAI;QAaJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QAkBJ,MAAM;;;QAIN,IAAI;QAgBJ,IAAI;QAMJ,MAAM;;;QAIN,IAAI;QAIJ,IAAI;QAKJ,MAAM;;;QAIN,IAAI;QAIJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QASJ,IAAI;QAOJ,IAAI;;;QAYJ,IAAI;QAOJ,IAAI;;;QAYJ,EAAE;YACA,IAAI;YACJ,IAAI;;QASN,kBAAkB;QAClB,QAAQ;YACN,IAAI;YACJ,UAAU;YAIV,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,YAAY;YACV,IAAI;YAOJ,IAAI;YAQJ,MAAM;;;;;YA5wBR,IAAI;YACJ,IAAI;;;YAQJ,IAAI;YACJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YArFJ,IAAI;YAIJ,IAAI;;;YAwBJ,IAAI;YACJ,IAAI;;;;;YAoBJ,IAAI;YASJ,MAAM;;;YAIN,IAAI;YACJ,IAAI;YAMJ,MAAM;;;;;YA6CN,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAIJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAIJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;;;YAMJ,IAAI;YACJ,IAAI;;;;QA6rBJ,IAAI;QACJ,IAAI;;;QAIJ,IAAI;YACF,IAAI;YAIJ,IAAI;;QAQN,IAAI;YACF,IAAI;YAOJ,IAAI;;QAEN,MAAM;YACJ,IAAI;YAOJ,IAAI;;;;QAQN,IAAI;QACJ,IAAI;;;QAcJ,IAAI;QACJ,IAAI;;;QAaJ,IAAI;QACJ,IAAI;;;QAoBJ,GAAG;YACD,IAAI;YACJ,IAAI;;QAQN,kBAAkB;QAClB,IAAI;YACF,IAAI;YACJ,UAAU;;QASZ,IAAI;YACF,IAAI;YACJ,IAAI;;QASN,kBAAkB;QAClB,OAAO;YACL,IAAI;YACJ,UAAU;YAGV,MAAM;;QAGR,kBAAkB;QAClB,QAAQ;YACN,IAAI;YACJ,UAAU;YAGV,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YASJ,MAAM;;QAGR,cAAc;YACZ,IAAI;YACJ,IAAI;;QASN,mBAAmB;YACjB,IAAI;YAGJ,IAAI;YAIJ,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,0BAA0B;YACxB,IAAI;YACJ,IAAI;YAGJ,MAAM;;QAGR,8BAA8B;YAC5B,IAAI;YACJ,IAAI;YAQJ,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YAIJ,MAAM;;QAGR,0BAA0B;YACxB,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,4BAA4B;YAC1B,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,+BAA+B;YAC7B,IAAI;YACJ,IAAI;YAQJ,MAAM;;QAGR,+BAA+B;YAC7B,IAAI;YACJ,IAAI;;QAsBN,qCAAqC;YACnC,IAAI;YACJ,IAAI;;QA0BN,2CAA2C;YACzC,IAAI;YACJ,IAAI;;QAyBN,+BAA+B;YAC7B,IAAI;YACJ,IAAI;;;;QAkBN,IAAI;QACJ,IAAI;;;;YArmCJ,IAAI;YACJ,IAAI;;;YAMJ,IAAI;YACJ,IAAI;;;;QAymCJ,IAAI;QACJ,IAAI;;;QASJ,IAAI;QACJ,IAAI;;;QAgBJ,gBAAgB;YACd,IAAI;YACJ,IAAI;;QAoBN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAaN,mBAAmB;YACjB,IAAI;YACJ,IAAI;;;;QAWN,IAAI;QACJ,IAAI;;;QAYJ,IAAI;QACJ,IAAI;;;QAsBJ,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;;;QAYJ,IAAI;QACJ,IAAI;;;QASJ,UAAU;YACR,IAAI;YACJ,IAAI;;QAON,YAAY;YACV,IAAI;YACJ,IAAI;;QASN,cAAc;YACZ,IAAI;YACJ,IAAI;;QAON,aAAa;YACX,IAAI;YACJ,IAAI;;QAoBN,UAAU;YACR,IAAI;YACJ,MAAM;YACN,IAAI;;QAYN,UAAU;YACR,IAAI;YACJ,IAAI;;QAWN,YAAY;YACV,IAAI;YAGJ,IAAI;;QAWN,QAAQ;YACN,IAAI;;QAKN,SAAS;YACP,IAAI;YACJ,IAAI;;QAON,iBAAiB;YACf,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,QAAQ;YACN,IAAI;YACJ,IAAI;;QAMN,MAAM;YACJ,IAAI;YACJ,IAAI;;QAON,IAAI;YACF,IAAI;YACJ,IAAI;;QAQN,qBAAqB;YACnB,IAAI;YACJ,IAAI;;QAUN,sBAAsB;YACpB,IAAI;YACJ,UAAU;YACV,MAAM;;QAGR,sBAAsB;YACpB,IAAI;YACJ,IAAI;;QAUN,0BAA0B;YACxB,IAAI;YACJ,IAAI;;QAqBN,YAAY;YACV,IAAI;YACJ,IAAI;;QAgBN,gCAAgC;YAC9B,IAAI;YACJ,IAAI;;QAYN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAiBN,gCAAgC;YAC9B,IAAI;YACJ,IAAI;;QAcN,kBAAkB;YAChB,IAAI;YACJ,IAAI;;QAMN,oBAAoB;YAClB,IAAI;YACJ,IAAI;;QAQN,aAAa;YACX,IAAI;YACJ,IAAI;;;;QASN,IAAI;QACJ,IAAI;;;QAMJ,IAAI;QAIJ,IAAI;QAOJ,MAAM;;;QAIN,gBAAgB;YACd,IAAI;YACJ,IAAI;;QASN,WAAW;YACT,IAAI;YACJ,MAAM;YACN,IAAI;;QAMN,QAAQ;YACN,IAAI;YACJ,IAAI;;;;QASN,OAAO;YACL,IAAI;YACJ,IAAI;;QASN,aAAa;YACX,IAAI;YACJ,IAAI;;QASN,UAAU;YACR,IAAI;YACJ,IAAI;;QAON,eAAe;YACb,IAAI;YACJ,IAAI;;;IAOR,kBAAkB;;QAEhB,IAAI;QACJ,UAAU;QAKV,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;;;QAIJ,IAAI;QACJ,IAAI;;;QASJ,OAAO;YACL,IAAI;YACJ,IAAI;;QAYN,qBAAqB;YACnB,IAAI;YACJ,IAAI;;;CAST,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAIpD,wBAAgB,aAAa,CAC3B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,UAAU,CAaZ;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,GAAG,cAAc,CAAM,GAC9D,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAUzB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,oBAAoB,CAItB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,GAAG,SAAS,GACpD,MAAM,CAER;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,EACnD,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAET;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,GAAG,kBAAkB,CAAC,EACxE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,WAAW,GAAG,SAAS,CAEzB;AAgFD,wBAAgB,kBAAkB,SAEjC"}
+{"version":3,"file":"zero-config.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/config/zero-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AAUnD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAC,SAAS,EAAC,MAAM,kCAAkC,CAAC;AAEhE,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAK3C,eAAO,MAAM,UAAU;IACrB,EAAE;QACA,IAAI;QAIJ,IAAI;;IAuBN,YAAY;QACV,IAAI;QACJ,IAAI;;CAgBP,CAAC;AAEF,eAAO,MAAM,YAAY;IACvB,EAAE;QACA,IAAI;QASJ,MAAM;;IAGR,GAAG;QACD,IAAI;QACJ,IAAI;QAMJ,MAAM;;CAET,CAAC;AAEF,QAAA,MAAM,cAAc;IAClB,IAAI;QACF,IAAI;QACJ,IAAI;;IAON,mBAAmB;QACjB,IAAI;QACJ,IAAI;;CAOP,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAkB3D,QAAA,MAAM,WAAW;IACf,GAAG;QACD,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,OAAO;QACL,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,MAAM;QACJ,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,MAAM;QACJ,IAAI;QACJ,IAAI;QAIJ,UAAU;;IAIZ,QAAQ;QACN,IAAI;QACJ,IAAI;QAIJ,UAAU;;IAIZ,yBAAyB;QACvB,IAAI;QACJ,IAAI;;IAKN,0BAA0B;QACxB,IAAI;QACJ,IAAI;;IAKN,mBAAmB;QACjB,IAAI;QACJ,IAAI;;CAQP,CAAC;AA0HF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAEpD,+DAA+D;AAC/D,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,UAAU,EACV,KAAK,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CACrD,CAAC;AAKF,eAAO,MAAM,WAAW;;QAEpB,EAAE;YACA,IAAI;YACJ,IAAI;;QAMN,IAAI;YACF,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,QAAQ;YACN,IAAI;YACJ,IAAI;;QAWN,iBAAiB;YACf,IAAI;YACJ,MAAM;;QAGR,yBAAyB;YACvB,IAAI;YACJ,IAAI;;QAYN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAuBN,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YAiBJ,MAAM;;QAGR,iCAAiC;YAC/B,IAAI;YACJ,IAAI;YAUJ,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAeJ,MAAM;;QAMR,sBAAsB;YACpB,IAAI;YACJ,MAAM;;QAGR,wBAAwB;YACtB,IAAI;YACJ,IAAI;;;IAqBR,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAGlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAKhB,IAAI;QACJ,IAAI;;;QAQJ,IAAI;QACJ,IAAI;;;QAQJ,EAAE;YACA,IAAI;YACJ,IAAI;;QAON,QAAQ;YACN,IAAI;YACJ,IAAI;;QASN,iBAAiB;YACf,IAAI;YACJ,MAAM;;QAGR,yCAAyC;YACvC,IAAI;YACJ,IAAI;;QAUN,uCAAuC;YACrC,IAAI;YACJ,IAAI;;QAON,iCAAiC;YAC/B,IAAI;YACJ,IAAI;;;;QAWN,IAAI;QACJ,IAAI;;;QAQJ,IAAI;QACJ,IAAI;QAIJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QASJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;QAeJ,MAAM;;;QAIN,IAAI;QAOJ,IAAI;QAaJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QAkBJ,MAAM;;;QAIN,IAAI;QAgBJ,IAAI;QAMJ,MAAM;;;QAIN,IAAI;QAIJ,IAAI;QAKJ,MAAM;;;QAIN,IAAI;QAIJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QASJ,IAAI;QAOJ,IAAI;;;QAYJ,IAAI;QAOJ,IAAI;;;QAYJ,EAAE;YACA,IAAI;YACJ,IAAI;;QASN,kBAAkB;QAClB,QAAQ;YACN,IAAI;YACJ,UAAU;YAIV,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,YAAY;YACV,IAAI;YAOJ,IAAI;YAQJ,MAAM;;;;;YAtxBR,IAAI;YACJ,IAAI;;;YAQJ,IAAI;YACJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YArFJ,IAAI;YAIJ,IAAI;;;YAwBJ,IAAI;YACJ,IAAI;;;;;YAoBJ,IAAI;YASJ,MAAM;;;YAIN,IAAI;YACJ,IAAI;YAMJ,MAAM;;;;;YA6CN,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAIJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAIJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;;;YAMJ,IAAI;YACJ,IAAI;;;YAMJ,IAAI;YACJ,IAAI;;;;QAgsBJ,IAAI;QACJ,IAAI;;;QAIJ,IAAI;YACF,IAAI;YAIJ,IAAI;;QAQN,IAAI;YACF,IAAI;YAOJ,IAAI;;QAEN,MAAM;YACJ,IAAI;YAOJ,IAAI;;;;QAQN,IAAI;QACJ,IAAI;;;QAcJ,IAAI;QACJ,IAAI;;;QAaJ,IAAI;QACJ,IAAI;;;QAoBJ,GAAG;YACD,IAAI;YACJ,IAAI;;QAQN,MAAM;YACJ,IAAI;YACJ,IAAI;;QAgBN,kBAAkB;QAClB,IAAI;YACF,IAAI;YACJ,UAAU;;QASZ,IAAI;YACF,IAAI;YACJ,IAAI;;QASN,kBAAkB;QAClB,OAAO;YACL,IAAI;YACJ,UAAU;YAGV,MAAM;;QAGR,kBAAkB;QAClB,QAAQ;YACN,IAAI;YACJ,UAAU;YAGV,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YASJ,MAAM;;QAGR,cAAc;YACZ,IAAI;YACJ,IAAI;;QASN,mBAAmB;YACjB,IAAI;YAGJ,IAAI;YAIJ,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,0BAA0B;YACxB,IAAI;YACJ,IAAI;YAGJ,MAAM;;QAGR,8BAA8B;YAC5B,IAAI;YACJ,IAAI;YAQJ,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YAIJ,MAAM;;QAGR,0BAA0B;YACxB,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,4BAA4B;YAC1B,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,+BAA+B;YAC7B,IAAI;YACJ,IAAI;YAQJ,MAAM;;QAGR,+BAA+B;YAC7B,IAAI;YACJ,IAAI;;QAsBN,qCAAqC;YACnC,IAAI;YACJ,IAAI;;QA0BN,2CAA2C;YACzC,IAAI;YACJ,IAAI;;QAyBN,+BAA+B;YAC7B,IAAI;YACJ,IAAI;;;;QAkBN,IAAI;QACJ,IAAI;;;;YAjoCJ,IAAI;YACJ,IAAI;;;YAMJ,IAAI;YACJ,IAAI;;;;QAqoCJ,IAAI;QACJ,IAAI;;;QASJ,IAAI;QACJ,IAAI;;;QAgBJ,gBAAgB;YACd,IAAI;YACJ,IAAI;;QAoBN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAaN,mBAAmB;YACjB,IAAI;YACJ,IAAI;;;;QAWN,IAAI;QACJ,IAAI;;;QAYJ,IAAI;QACJ,IAAI;;;QAsBJ,IAAI;QACJ,IAAI;;;QAUJ,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;;;QAYJ,IAAI;QACJ,IAAI;;;QASJ,UAAU;YACR,IAAI;YACJ,IAAI;;QAON,YAAY;YACV,IAAI;YACJ,IAAI;;QASN,cAAc;YACZ,IAAI;YACJ,IAAI;;QAON,aAAa;YACX,IAAI;YACJ,IAAI;;QAoBN,UAAU;YACR,IAAI;YACJ,MAAM;YACN,IAAI;;QAYN,UAAU;YACR,IAAI;YACJ,IAAI;;QAWN,YAAY;YACV,IAAI;YAGJ,IAAI;;QAWN,QAAQ;YACN,IAAI;;QAKN,SAAS;YACP,IAAI;YACJ,IAAI;;QAON,iBAAiB;YACf,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,QAAQ;YACN,IAAI;YACJ,IAAI;;QAMN,MAAM;YACJ,IAAI;YACJ,IAAI;;QAON,IAAI;YACF,IAAI;YACJ,IAAI;;QAQN,qBAAqB;YACnB,IAAI;YACJ,IAAI;;QAUN,sBAAsB;YACpB,IAAI;YACJ,UAAU;YACV,MAAM;;QAGR,sBAAsB;YACpB,IAAI;YACJ,IAAI;;QAUN,0BAA0B;YACxB,IAAI;YACJ,IAAI;;QAqBN,YAAY;YACV,IAAI;YACJ,IAAI;;QAgBN,gCAAgC;YAC9B,IAAI;YACJ,IAAI;;QAYN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAiBN,gCAAgC;YAC9B,IAAI;YACJ,IAAI;;QAcN,kBAAkB;YAChB,IAAI;YACJ,IAAI;;QAMN,oBAAoB;YAClB,IAAI;YACJ,IAAI;;QAQN,aAAa;YACX,IAAI;YACJ,IAAI;;;;QASN,IAAI;QACJ,IAAI;;;QAMJ,IAAI;QAIJ,IAAI;QAOJ,MAAM;;;QAIN,gBAAgB;YACd,IAAI;YACJ,IAAI;;QASN,WAAW;YACT,IAAI;YACJ,MAAM;YACN,IAAI;;QAMN,QAAQ;YACN,IAAI;YACJ,IAAI;;;;QASN,OAAO;YACL,IAAI;YACJ,IAAI;;QASN,aAAa;YACX,IAAI;YACJ,IAAI;;QASN,UAAU;YACR,IAAI;YACJ,IAAI;;QAON,eAAe;YACb,IAAI;YACJ,IAAI;;;IAOR,kBAAkB;;QAEhB,IAAI;QACJ,UAAU;QAKV,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;;;QAIJ,IAAI;QACJ,IAAI;;;QASJ,OAAO;YACL,IAAI;YACJ,IAAI;;QAYN,qBAAqB;YACnB,IAAI;YACJ,IAAI;;;CAST,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAIpD,wBAAgB,aAAa,CAC3B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,UAAU,CAaZ;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,GAAG,cAAc,CAAM,GAC9D,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAUzB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,oBAAoB,CAItB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,GAAG,SAAS,GACpD,MAAM,CAER;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,EACnD,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAET;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,GAAG,kBAAkB,CAAC,EACxE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,WAAW,GAAG,SAAS,CAEzB;AAgDD;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAST;AAgBD,wBAAgB,kBAAkB,SAEjC"}

package/out/zero-cache/src/config/zero-config.js

@@ -7,7 +7,7 @@ import { singleProcessMode } from "../types/processes.js";
 import { ALLOWED_APP_ID_CHARACTERS, INVALID_APP_ID_MESSAGE } from "../types/shards.js";
 import { DEFAULT_PREFERRED_PREFIXES } from "./network.js";
 import { assertNormalized, isDevelopmentMode } from "./normalize.js";
-import { timingSafeEqual } from "node:crypto";
+import { createHash, timingSafeEqual } from "node:crypto";
 //#region ../zero-cache/src/config/zero-config.ts
 /**
 * These types represent the _compiled_ config whereas `define-config` types represent the _source_ config.
@@ -140,6 +140,16 @@ var authOptions = {
 	retransformIntervalSeconds: {
 		type: valita_exports.number().optional(() => 300),
 		desc: [`The interval in seconds between periodic shared /query retransform work for a client group.`, `If unset, periodic shared retransform is disabled.`]
+	},
+	requireServerUserID: {
+		type: valita_exports.boolean().optional(() => false),
+		desc: [
+			`Refuse a connection that claims a userID when the API server's answer to`,
+			`/query or /mutate does not include a userID, unless a legacy JWT verified`,
+			`it. Without this, zero-cache trusts the userID the client claims and logs`,
+			`a warning. Turn it on once your API server returns the userID ({bold null}`,
+			`for logged-out callers).`
+		]
 	}
 };
 var makeDeprecationMessage = (flag) => `Use {bold ${flagToEnv(ZERO_ENV_VAR_PREFIX, flag)}} (or {bold --${flag}}) instead.`;
@@ -765,6 +775,23 @@ var zeroOptions = {
 				`on port 4849.`
 			]
 		},
+		secret: {
+			type: valita_exports.string().optional(),
+			desc: [
+				`A shared secret that authenticates {bold view-syncers} to the {bold change-streamer}.`,
+				`View-syncers present it when connecting to the {bold replication-manager}, which`,
+				`refuses replication connections that do not present it. Set it to the same value`,
+				`on the replication-manager and on every view-syncer.`,
+				``,
+				`In a single-node configuration zero-cache generates a secret for its own workers,`,
+				`so no value is needed. In a multi-node configuration it should always be set: while`,
+				`it is unset, the replication-manager accepts replication connections from anything`,
+				`that can reach its {bold change-streamer-port}, and logs a warning on startup.`,
+				``,
+				`For a rolling upgrade, set the secret on the view-syncers before setting it on the`,
+				`replication-manager, as a replication-manager without a secret accepts both.`
+			]
+		},
 		/** @deprecated */
 		mode: {
 			type: literalUnion("dedicated", "discover").optional(() => "dedicated"),
@@ -1093,6 +1120,16 @@ var zeroOptions = {
 			`If it is the same as the {bold admin-password}, it grants admin access.`
 		]
 	},
+	enableHeapz: {
+		type: valita_exports.boolean().optional(() => true),
+		desc: [
+			`Serves heap snapshots of the zero-cache process at {bold /heapz} to the`,
+			`{bold admin-password}. A heap snapshot contains everything the process`,
+			`holds in memory, including the auth tokens, cookies and API keys of`,
+			`connected clients. Set this to {bold false} to turn the endpoint off`,
+			`while keeping the other diagnostic endpoints and the inspector.`
+		]
+	},
 	websocketCompression: {
 		type: valita_exports.boolean().optional(() => false),
 		desc: [
@@ -1594,15 +1631,16 @@ function getAccess(lc, { adminPassword }, operatorPassword, password) {
 	}
 	lc.warn?.(operatorPassword ? "Invalid admin or operator password" : "Invalid admin password");
 }
+/**
+* Compares `password` with `expected` in constant time. Returns `false` when
+* no `expected` password is configured.
+*/
 function passwordMatches(password, expected) {
 	if (!expected) return false;
-	const passwordBuffer = Buffer.from(password ?? "");
-	const expectedBuffer = Buffer.from(expected);
-	if (passwordBuffer.length !== expectedBuffer.length) {
-		timingSafeEqual(expectedBuffer, expectedBuffer);
-		return false;
-	}
-	return timingSafeEqual(passwordBuffer, expectedBuffer);
+	return timingSafeEqual(sha256(password ?? ""), sha256(expected));
+}
+function sha256(value) {
+	return createHash("sha256").update(value).digest();
 }
 var hasWarned = false;
 function warnOnce(lc, msg) {
@@ -1612,6 +1650,6 @@ function warnOnce(lc, msg) {
 	}
 }
 //#endregion
-export { ZERO_ENV_VAR_PREFIX, appOptions, getLogConfig, getNormalizedZeroConfig, getOperatorAccess, getServerVersion, getZeroConfig, isAdminPasswordValid, shardOptions, zeroOptions };
+export { ZERO_ENV_VAR_PREFIX, appOptions, getLogConfig, getNormalizedZeroConfig, getOperatorAccess, getServerVersion, getZeroConfig, isAdminPasswordValid, passwordMatches, shardOptions, zeroOptions };
 
 //# sourceMappingURL=zero-config.js.map