@rocicorp/zero 1.12.0-canary.3 → 1.12.0-canary.4

package/out/zero-cache/src/auth/auth.js

@@ -115,6 +115,6 @@ function isAuthErrorBody(ex) {
 	return (ex.kind === "PushFailed" || ex.kind === "TransformFailed") && "reason" in ex && ex.reason === "http" && "status" in ex && (ex.status === 401 || ex.status === 403);
 }
 //#endregion
-export { authEquals, isAuthErrorBody, resolveAuth };
+export { authEquals, isAuthErrorBody, pickToken, resolveAuth };
 
 //# sourceMappingURL=auth.js.map

package/out/zero-cache/src/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":[],"sources":["../../../../../zero-cache/src/auth/auth.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport {ErrorKind} from '../../../zero-protocol/src/error-kind.ts';\nimport {ErrorOrigin} from '../../../zero-protocol/src/error-origin.ts';\nimport {ErrorReason} from '../../../zero-protocol/src/error-reason.ts';\nimport {\n  isProtocolError,\n  ProtocolError,\n  type ErrorBody,\n} from '../../../zero-protocol/src/error.ts';\nimport type {PushError} from '../../../zero-protocol/src/push.ts';\n\n/** @deprecated JWT auth is deprecated */\nexport type JWTAuth = {\n  readonly type: 'jwt';\n  readonly raw: string;\n  readonly decoded: JWTPayload;\n};\n\nexport type OpaqueAuth = {\n  readonly type: 'opaque';\n  readonly raw: string;\n};\n\nexport type Auth = OpaqueAuth | JWTAuth;\n\nexport type ValidateLegacyJWT = (\n  token: string,\n  ctx: {readonly userID: string | undefined},\n) => Promise<JWTAuth>;\n\nfunction isProvidedAuth(wireAuth: string | undefined): wireAuth is string {\n  return wireAuth !== undefined && wireAuth !== '';\n}\n\nexport function authEquals(a: Auth | undefined, b: Auth | undefined) {\n  if (a === b) {\n    return true;\n  }\n  if (!a || !b) {\n    return false;\n  }\n  return a.type === b.type && a.raw === b.raw;\n}\n\n/**\n * Resolves one auth snapshot transition without binding it to a client group.\n */\nexport async function resolveAuth(\n  lc: LogContext,\n  previousAuth: Auth | undefined,\n  userID: string | null,\n  wireAuth: string | undefined,\n  validateLegacyJWT: ValidateLegacyJWT | undefined,\n): Promise<Auth | undefined> {\n  try {\n    const hasProvidedAuth = isProvidedAuth(wireAuth);\n\n    if (previousAuth) {\n      lc.debug?.(`Attempting to update auth from previous value`);\n    } else {\n      lc.debug?.(`Attempting to initialize auth`);\n    }\n\n    if (!hasProvidedAuth && previousAuth) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (!hasProvidedAuth) {\n      lc.debug?.(`Cleared auth`);\n      return undefined;\n    }\n\n    if (userID === null) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message: 'Authenticated connections require a userID.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (validateLegacyJWT !== undefined) {\n      const verifiedToken = await validateLegacyJWT(wireAuth, {userID});\n      const nextAuth = pickToken(lc, previousAuth, verifiedToken);\n      lc.debug?.(`Updated auth with JWT`);\n      return nextAuth;\n    }\n\n    if (previousAuth?.type === 'jwt') {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'Token type cannot change from JWT to opaque. Connections are pinned to a single token type.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (previousAuth?.type === 'opaque' && previousAuth.raw === wireAuth) {\n      lc.debug?.(`Opaque auth unchanged, reusing previous snapshot`);\n      return previousAuth;\n    }\n\n    lc.debug?.(`Updated auth with opaque token`);\n    return {\n      type: 'opaque',\n      raw: wireAuth,\n    };\n  } catch (e) {\n    if (isProtocolError(e)) {\n      throw e;\n    }\n    throw new ProtocolError({\n      kind: ErrorKind.AuthInvalidated,\n      message: `Failed to decode auth token: ${String(e)}`,\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n}\n\n/** @deprecated used only in old JWT validation/rotation auth */\nexport function pickToken(\n  lc: LogContext,\n  previousToken: Auth | undefined,\n  newToken: Auth | undefined | null,\n) {\n  if (newToken === null) {\n    return undefined;\n  }\n\n  if (\n    previousToken?.type &&\n    newToken?.type &&\n    previousToken?.type !== newToken?.type\n  ) {\n    throw new ProtocolError({\n      kind: ErrorKind.Unauthorized,\n      message:\n        'Token type cannot change. Client groups are pinned to a single token type.',\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n\n  if (previousToken === undefined) {\n    lc.debug?.(`No previous token, using new token`);\n    return newToken;\n  }\n\n  if (newToken?.type === 'opaque') {\n    return newToken;\n  }\n\n  if (previousToken.type === 'opaque') {\n    throw new ProtocolError({\n      kind: ErrorKind.Unauthorized,\n      message:\n        'Token type cannot change from opaque to JWT. Client groups are pinned to a single token type.',\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n\n  if (newToken) {\n    if (previousToken.decoded.sub !== newToken.decoded.sub) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'The user id in the new token does not match the previous token. Client groups are pinned to a single user.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (previousToken.decoded.iat === undefined) {\n      lc.debug?.(`No issued at time for the existing token, using new token`);\n      // No issued at time for the existing token? We take the most recently received token.\n      return newToken;\n    }\n\n    if (newToken.decoded.iat === undefined) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'The new token does not have an issued at time but the prior token does. Tokens for a client group must either all have issued at times or all not have issued at times',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    // The new token is newer, so we take it.\n    if (previousToken.decoded.iat < newToken.decoded.iat) {\n      lc.debug?.(`New token is newer, using it`);\n      return newToken;\n    }\n\n    // if the new token is older or the same, we keep the existing token.\n    lc.debug?.(`New token is older or the same, using existing token`);\n    return previousToken;\n  }\n\n  // previousToken !== undefined but newToken is undefined\n  throw new ProtocolError({\n    kind: ErrorKind.Unauthorized,\n    message:\n      'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n    origin: ErrorOrigin.ZeroCache,\n  });\n}\n\nexport function isAuthErrorBody(ex: unknown): ex is ErrorBody | PushError {\n  if (typeof ex !== 'object' || ex === null) {\n    return false;\n  }\n\n  if ('error' in ex) {\n    return (\n      ex.error === 'http' &&\n      'status' in ex &&\n      (ex.status === 401 || ex.status === 403)\n    );\n  }\n\n  if (!('kind' in ex)) {\n    return false;\n  }\n\n  if (\n    ex.kind === ErrorKind.AuthInvalidated ||\n    ex.kind === ErrorKind.Unauthorized\n  ) {\n    return true;\n  }\n\n  return (\n    (ex.kind === ErrorKind.PushFailed ||\n      ex.kind === ErrorKind.TransformFailed) &&\n    'reason' in ex &&\n    ex.reason === ErrorReason.HTTP &&\n    'status' in ex &&\n    (ex.status === 401 || ex.status === 403)\n  );\n}\n"],"mappings":";;;;;AA+BA,SAAS,eAAe,UAAkD;CACxE,OAAO,aAAa,KAAA,KAAa,aAAa;AAChD;AAEA,SAAgB,WAAW,GAAqB,GAAqB;CACnE,IAAI,MAAM,GACR,OAAO;CAET,IAAI,CAAC,KAAK,CAAC,GACT,OAAO;CAET,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;AAC1C;;;;AAKA,eAAsB,YACpB,IACA,cACA,QACA,UACA,mBAC2B;CAC3B,IAAI;EACF,MAAM,kBAAkB,eAAe,QAAQ;EAE/C,IAAI,cACF,GAAG,QAAQ,+CAA+C;OAE1D,GAAG,QAAQ,+BAA+B;EAG5C,IAAI,CAAC,mBAAmB,cACtB,MAAM,IAAI,cAAc;GACtB,MAAM;GACN,SACE;GACF,QAAQ;EACV,CAAC;EAGH,IAAI,CAAC,iBAAiB;GACpB,GAAG,QAAQ,cAAc;GACzB;EACF;EAEA,IAAI,WAAW,MACb,MAAM,IAAI,cAAc;GACtB,MAAM;GACN,SAAS;GACT,QAAQ;EACV,CAAC;EAGH,IAAI,sBAAsB,KAAA,GAAW;GAEnC,MAAM,WAAW,UAAU,IAAI,cAAc,MADjB,kBAAkB,UAAU,EAAC,OAAM,CAAC,CACN;GAC1D,GAAG,QAAQ,uBAAuB;GAClC,OAAO;EACT;EAEA,IAAI,cAAc,SAAS,OACzB,MAAM,IAAI,cAAc;GACtB,MAAM;GACN,SACE;GACF,QAAQ;EACV,CAAC;EAGH,IAAI,cAAc,SAAS,YAAY,aAAa,QAAQ,UAAU;GACpE,GAAG,QAAQ,kDAAkD;GAC7D,OAAO;EACT;EAEA,GAAG,QAAQ,gCAAgC;EAC3C,OAAO;GACL,MAAM;GACN,KAAK;EACP;CACF,SAAS,GAAG;EACV,IAAI,gBAAgB,CAAC,GACnB,MAAM;EAER,MAAM,IAAI,cAAc;GACtB,MAAM;GACN,SAAS,gCAAgC,OAAO,CAAC;GACjD,QAAQ;EACV,CAAC;CACH;AACF;;AAGA,SAAgB,UACd,IACA,eACA,UACA;CACA,IAAI,aAAa,MACf;CAGF,IACE,eAAe,QACf,UAAU,QACV,eAAe,SAAS,UAAU,MAElC,MAAM,IAAI,cAAc;EACtB,MAAM;EACN,SACE;EACF,QAAQ;CACV,CAAC;CAGH,IAAI,kBAAkB,KAAA,GAAW;EAC/B,GAAG,QAAQ,oCAAoC;EAC/C,OAAO;CACT;CAEA,IAAI,UAAU,SAAS,UACrB,OAAO;CAGT,IAAI,cAAc,SAAS,UACzB,MAAM,IAAI,cAAc;EACtB,MAAM;EACN,SACE;EACF,QAAQ;CACV,CAAC;CAGH,IAAI,UAAU;EACZ,IAAI,cAAc,QAAQ,QAAQ,SAAS,QAAQ,KACjD,MAAM,IAAI,cAAc;GACtB,MAAM;GACN,SACE;GACF,QAAQ;EACV,CAAC;EAGH,IAAI,cAAc,QAAQ,QAAQ,KAAA,GAAW;GAC3C,GAAG,QAAQ,2DAA2D;GAEtE,OAAO;EACT;EAEA,IAAI,SAAS,QAAQ,QAAQ,KAAA,GAC3B,MAAM,IAAI,cAAc;GACtB,MAAM;GACN,SACE;GACF,QAAQ;EACV,CAAC;EAIH,IAAI,cAAc,QAAQ,MAAM,SAAS,QAAQ,KAAK;GACpD,GAAG,QAAQ,8BAA8B;GACzC,OAAO;EACT;EAGA,GAAG,QAAQ,sDAAsD;EACjE,OAAO;CACT;CAGA,MAAM,IAAI,cAAc;EACtB,MAAM;EACN,SACE;EACF,QAAQ;CACV,CAAC;AACH;AAEA,SAAgB,gBAAgB,IAA0C;CACxE,IAAI,OAAO,OAAO,YAAY,OAAO,MACnC,OAAO;CAGT,IAAI,WAAW,IACb,OACE,GAAG,UAAU,UACb,YAAY,OACX,GAAG,WAAW,OAAO,GAAG,WAAW;CAIxC,IAAI,EAAE,UAAU,KACd,OAAO;CAGT,IACE,GAAG,SAAS,qBACZ,GAAG,SAAS,gBAEZ,OAAO;CAGT,QACG,GAAG,SAAS,gBACX,GAAG,SAAS,sBACd,YAAY,MACZ,GAAG,WAAW,UACd,YAAY,OACX,GAAG,WAAW,OAAO,GAAG,WAAW;AAExC"}
+{"version":3,"file":"auth.js","names":["ErrorKind.Unauthorized","ErrorOrigin.ZeroCache","ErrorKind.AuthInvalidated"],"sources":["../../../../../zero-cache/src/auth/auth.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport {ErrorKind} from '../../../zero-protocol/src/error-kind.ts';\nimport {ErrorOrigin} from '../../../zero-protocol/src/error-origin.ts';\nimport {ErrorReason} from '../../../zero-protocol/src/error-reason.ts';\nimport {\n  isProtocolError,\n  ProtocolError,\n  type ErrorBody,\n} from '../../../zero-protocol/src/error.ts';\nimport type {PushError} from '../../../zero-protocol/src/push.ts';\n\n/** @deprecated JWT auth is deprecated */\nexport type JWTAuth = {\n  readonly type: 'jwt';\n  readonly raw: string;\n  readonly decoded: JWTPayload;\n};\n\nexport type OpaqueAuth = {\n  readonly type: 'opaque';\n  readonly raw: string;\n};\n\nexport type Auth = OpaqueAuth | JWTAuth;\n\nexport type ValidateLegacyJWT = (\n  token: string,\n  ctx: {readonly userID: string | undefined},\n) => Promise<JWTAuth>;\n\nfunction isProvidedAuth(wireAuth: string | undefined): wireAuth is string {\n  return wireAuth !== undefined && wireAuth !== '';\n}\n\nexport function authEquals(a: Auth | undefined, b: Auth | undefined) {\n  if (a === b) {\n    return true;\n  }\n  if (!a || !b) {\n    return false;\n  }\n  return a.type === b.type && a.raw === b.raw;\n}\n\n/**\n * Resolves one auth snapshot transition without binding it to a client group.\n */\nexport async function resolveAuth(\n  lc: LogContext,\n  previousAuth: Auth | undefined,\n  userID: string | null,\n  wireAuth: string | undefined,\n  validateLegacyJWT: ValidateLegacyJWT | undefined,\n): Promise<Auth | undefined> {\n  try {\n    const hasProvidedAuth = isProvidedAuth(wireAuth);\n\n    if (previousAuth) {\n      lc.debug?.(`Attempting to update auth from previous value`);\n    } else {\n      lc.debug?.(`Attempting to initialize auth`);\n    }\n\n    if (!hasProvidedAuth && previousAuth) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (!hasProvidedAuth) {\n      lc.debug?.(`Cleared auth`);\n      return undefined;\n    }\n\n    if (userID === null) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message: 'Authenticated connections require a userID.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (validateLegacyJWT !== undefined) {\n      const verifiedToken = await validateLegacyJWT(wireAuth, {userID});\n      const nextAuth = pickToken(lc, previousAuth, verifiedToken);\n      lc.debug?.(`Updated auth with JWT`);\n      return nextAuth;\n    }\n\n    if (previousAuth?.type === 'jwt') {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'Token type cannot change from JWT to opaque. Connections are pinned to a single token type.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (previousAuth?.type === 'opaque' && previousAuth.raw === wireAuth) {\n      lc.debug?.(`Opaque auth unchanged, reusing previous snapshot`);\n      return previousAuth;\n    }\n\n    lc.debug?.(`Updated auth with opaque token`);\n    return {\n      type: 'opaque',\n      raw: wireAuth,\n    };\n  } catch (e) {\n    if (isProtocolError(e)) {\n      throw e;\n    }\n    throw new ProtocolError({\n      kind: ErrorKind.AuthInvalidated,\n      message: `Failed to decode auth token: ${String(e)}`,\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n}\n\n/** @deprecated used only in old JWT validation/rotation auth */\nexport function pickToken(\n  lc: LogContext,\n  previousToken: Auth | undefined,\n  newToken: Auth | undefined | null,\n) {\n  if (newToken === null) {\n    return undefined;\n  }\n\n  if (\n    previousToken?.type &&\n    newToken?.type &&\n    previousToken?.type !== newToken?.type\n  ) {\n    throw new ProtocolError({\n      kind: ErrorKind.Unauthorized,\n      message:\n        'Token type cannot change. Client groups are pinned to a single token type.',\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n\n  if (previousToken === undefined) {\n    lc.debug?.(`No previous token, using new token`);\n    return newToken;\n  }\n\n  if (newToken?.type === 'opaque') {\n    return newToken;\n  }\n\n  if (previousToken.type === 'opaque') {\n    throw new ProtocolError({\n      kind: ErrorKind.Unauthorized,\n      message:\n        'Token type cannot change from opaque to JWT. Client groups are pinned to a single token type.',\n      origin: ErrorOrigin.ZeroCache,\n    });\n  }\n\n  if (newToken) {\n    if (previousToken.decoded.sub !== newToken.decoded.sub) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'The user id in the new token does not match the previous token. Client groups are pinned to a single user.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    if (previousToken.decoded.iat === undefined) {\n      lc.debug?.(`No issued at time for the existing token, using new token`);\n      // No issued at time for the existing token? We take the most recently received token.\n      return newToken;\n    }\n\n    if (newToken.decoded.iat === undefined) {\n      throw new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'The new token does not have an issued at time but the prior token does. Tokens for a client group must either all have issued at times or all not have issued at times',\n        origin: ErrorOrigin.ZeroCache,\n      });\n    }\n\n    // The new token is newer, so we take it.\n    if (previousToken.decoded.iat < newToken.decoded.iat) {\n      lc.debug?.(`New token is newer, using it`);\n      return newToken;\n    }\n\n    // if the new token is older or the same, we keep the existing token.\n    lc.debug?.(`New token is older or the same, using existing token`);\n    return previousToken;\n  }\n\n  // previousToken !== undefined but newToken is undefined\n  throw new ProtocolError({\n    kind: ErrorKind.Unauthorized,\n    message:\n      'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n    origin: ErrorOrigin.ZeroCache,\n  });\n}\n\nexport function isAuthErrorBody(ex: unknown): ex is ErrorBody | PushError {\n  if (typeof ex !== 'object' || ex === null) {\n    return false;\n  }\n\n  if ('error' in ex) {\n    return (\n      ex.error === 'http' &&\n      'status' in ex &&\n      (ex.status === 401 || ex.status === 403)\n    );\n  }\n\n  if (!('kind' in ex)) {\n    return false;\n  }\n\n  if (\n    ex.kind === ErrorKind.AuthInvalidated ||\n    ex.kind === ErrorKind.Unauthorized\n  ) {\n    return true;\n  }\n\n  return (\n    (ex.kind === ErrorKind.PushFailed ||\n      ex.kind === ErrorKind.TransformFailed) &&\n    'reason' in ex &&\n    ex.reason === ErrorReason.HTTP &&\n    'status' in ex &&\n    (ex.status === 401 || ex.status === 403)\n  );\n}\n"],"mappings":";;;;;AA+BA,SAAS,eAAe,UAAkD;CACxE,OAAO,aAAa,KAAA,KAAa,aAAa;AAChD;AAEA,SAAgB,WAAW,GAAqB,GAAqB;CACnE,IAAI,MAAM,GACR,OAAO;CAET,IAAI,CAAC,KAAK,CAAC,GACT,OAAO;CAET,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;AAC1C;;;;AAKA,eAAsB,YACpB,IACA,cACA,QACA,UACA,mBAC2B;CAC3B,IAAI;EACF,MAAM,kBAAkB,eAAe,QAAQ;EAE/C,IAAI,cACF,GAAG,QAAQ,+CAA+C;OAE1D,GAAG,QAAQ,+BAA+B;EAG5C,IAAI,CAAC,mBAAmB,cACtB,MAAM,IAAI,cAAc;GACtB,MAAMA;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAGH,IAAI,CAAC,iBAAiB;GACpB,GAAG,QAAQ,cAAc;GACzB;EACF;EAEA,IAAI,WAAW,MACb,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SAAS;GACT,QAAQC;EACV,CAAC;EAGH,IAAI,sBAAsB,KAAA,GAAW;GAEnC,MAAM,WAAW,UAAU,IAAI,cAAc,MADjB,kBAAkB,UAAU,EAAC,OAAM,CAAC,CACN;GAC1D,GAAG,QAAQ,uBAAuB;GAClC,OAAO;EACT;EAEA,IAAI,cAAc,SAAS,OACzB,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAGH,IAAI,cAAc,SAAS,YAAY,aAAa,QAAQ,UAAU;GACpE,GAAG,QAAQ,kDAAkD;GAC7D,OAAO;EACT;EAEA,GAAG,QAAQ,gCAAgC;EAC3C,OAAO;GACL,MAAM;GACN,KAAK;EACP;CACF,SAAS,GAAG;EACV,IAAI,gBAAgB,CAAC,GACnB,MAAM;EAER,MAAM,IAAI,cAAc;GACtB,MAAMC;GACN,SAAS,gCAAgC,OAAO,CAAC;GACjD,QAAQD;EACV,CAAC;CACH;AACF;;AAGA,SAAgB,UACd,IACA,eACA,UACA;CACA,IAAI,aAAa,MACf;CAGF,IACE,eAAe,QACf,UAAU,QACV,eAAe,SAAS,UAAU,MAElC,MAAM,IAAI,cAAc;EACtB,MAAMD;EACN,SACE;EACF,QAAQC;CACV,CAAC;CAGH,IAAI,kBAAkB,KAAA,GAAW;EAC/B,GAAG,QAAQ,oCAAoC;EAC/C,OAAO;CACT;CAEA,IAAI,UAAU,SAAS,UACrB,OAAO;CAGT,IAAI,cAAc,SAAS,UACzB,MAAM,IAAI,cAAc;EACtB,MAAMD;EACN,SACE;EACF,QAAQC;CACV,CAAC;CAGH,IAAI,UAAU;EACZ,IAAI,cAAc,QAAQ,QAAQ,SAAS,QAAQ,KACjD,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAGH,IAAI,cAAc,QAAQ,QAAQ,KAAA,GAAW;GAC3C,GAAG,QAAQ,2DAA2D;GAEtE,OAAO;EACT;EAEA,IAAI,SAAS,QAAQ,QAAQ,KAAA,GAC3B,MAAM,IAAI,cAAc;GACtB,MAAMD;GACN,SACE;GACF,QAAQC;EACV,CAAC;EAIH,IAAI,cAAc,QAAQ,MAAM,SAAS,QAAQ,KAAK;GACpD,GAAG,QAAQ,8BAA8B;GACzC,OAAO;EACT;EAGA,GAAG,QAAQ,sDAAsD;EACjE,OAAO;CACT;CAGA,MAAM,IAAI,cAAc;EACtB,MAAMD;EACN,SACE;EACF,QAAQC;CACV,CAAC;AACH;AAEA,SAAgB,gBAAgB,IAA0C;CACxE,IAAI,OAAO,OAAO,YAAY,OAAO,MACnC,OAAO;CAGT,IAAI,WAAW,IACb,OACE,GAAG,UAAU,UACb,YAAY,OACX,GAAG,WAAW,OAAO,GAAG,WAAW;CAIxC,IAAI,EAAE,UAAU,KACd,OAAO;CAGT,IACE,GAAG,SAAS,qBACZ,GAAG,SAAS,gBAEZ,OAAO;CAGT,QACG,GAAG,SAAS,gBACX,GAAG,SAAS,sBACd,YAAY,MACZ,GAAG,WAAW,UACd,YAAY,OACX,GAAG,WAAW,OAAO,GAAG,WAAW;AAExC"}

package/out/zero-cache/src/auth/jwt.js

@@ -17,7 +17,10 @@ var tokenConfigOptions = (config) => {
 async function verifyToken(config, token, verifyOptions) {
 	if (config.jwk !== void 0) return verifyTokenImpl(token, loadJwk(config.jwk), verifyOptions);
 	if (config.secret !== void 0) return verifyTokenImpl(token, loadSecret(config.secret), verifyOptions);
-	if (config.jwksUrl !== void 0) return (await jwtVerify(token, getRemoteKeyset(config.jwksUrl), verifyOptions)).payload;
+	if (config.jwksUrl !== void 0) {
+		const remoteKeyset = getRemoteKeyset(config.jwksUrl);
+		return (await jwtVerify(token, remoteKeyset, verifyOptions)).payload;
+	}
 	throw new Error("verifyToken was called but no auth options (one of: jwk, secret, jwksUrl) were configured.");
 }
 function loadJwk(jwkString) {

package/out/zero-cache/src/auth/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","names":[],"sources":["../../../../../zero-cache/src/auth/jwt.ts"],"sourcesContent":["import {\n  createRemoteJWKSet,\n  exportJWK,\n  generateKeyPair,\n  jwtVerify,\n  type JWK,\n  type JWTClaimVerificationOptions,\n  type JWTPayload,\n  type KeyLike,\n} from 'jose';\nimport type {LegacyJWTAuthConfig} from '../config/zero-config.ts';\n\n/** @deprecated */\nexport async function createJwkPair() {\n  const {publicKey, privateKey} = await generateKeyPair('PS256');\n\n  const privateJwk = await exportJWK(privateKey);\n  const publicJwk = await exportJWK(publicKey);\n\n  privateJwk.kid = 'key-2024-001';\n  privateJwk.use = 'sig';\n  privateJwk.alg = 'PS256';\n\n  publicJwk.kid = privateJwk.kid;\n  publicJwk.use = privateJwk.use;\n  publicJwk.alg = privateJwk.alg;\n\n  return {privateJwk, publicJwk};\n}\n\nlet remoteKeyset: ReturnType<typeof createRemoteJWKSet> | undefined;\nfunction getRemoteKeyset(jwksUrl: string) {\n  if (remoteKeyset === undefined) {\n    remoteKeyset = createRemoteJWKSet(new URL(jwksUrl));\n  }\n\n  return remoteKeyset;\n}\n\n/** @deprecated */\nexport const tokenConfigOptions = (config: LegacyJWTAuthConfig) => {\n  const tokenOptions = (['jwk', 'secret', 'jwksUrl'] as const).filter(\n    key => config[key] !== undefined,\n  );\n\n  return tokenOptions;\n};\n\n/** @deprecated */\nexport async function verifyToken(\n  config: LegacyJWTAuthConfig,\n  token: string,\n  verifyOptions: JWTClaimVerificationOptions,\n): Promise<JWTPayload> {\n  if (config.jwk !== undefined) {\n    return verifyTokenImpl(token, loadJwk(config.jwk), verifyOptions);\n  }\n\n  if (config.secret !== undefined) {\n    return verifyTokenImpl(token, loadSecret(config.secret), verifyOptions);\n  }\n\n  if (config.jwksUrl !== undefined) {\n    const remoteKeyset = getRemoteKeyset(config.jwksUrl);\n    return (await jwtVerify(token, remoteKeyset, verifyOptions)).payload;\n  }\n\n  throw new Error(\n    'verifyToken was called but no auth options (one of: jwk, secret, jwksUrl) were configured.',\n  );\n}\n\nfunction loadJwk(jwkString: string) {\n  return JSON.parse(jwkString) as JWK;\n}\n\nfunction loadSecret(secret: string) {\n  return new TextEncoder().encode(secret);\n}\n\nasync function verifyTokenImpl(\n  token: string,\n  verifyKey: Uint8Array | KeyLike | JWK,\n  verifyOptions: JWTClaimVerificationOptions,\n): Promise<JWTPayload> {\n  const {payload} = await jwtVerify(token, verifyKey, verifyOptions);\n\n  return payload;\n}\n"],"mappings":";;AA8BA,IAAI;AACJ,SAAS,gBAAgB,SAAiB;CACxC,IAAI,iBAAiB,KAAA,GACnB,eAAe,mBAAmB,IAAI,IAAI,OAAO,CAAC;CAGpD,OAAO;AACT;;AAGA,IAAa,sBAAsB,WAAgC;CAKjE,OAJsB;EAAC;EAAO;EAAU;CAAS,EAAY,QAC3D,QAAO,OAAO,SAAS,KAAA,CAGlB;AACT;;AAGA,eAAsB,YACpB,QACA,OACA,eACqB;CACrB,IAAI,OAAO,QAAQ,KAAA,GACjB,OAAO,gBAAgB,OAAO,QAAQ,OAAO,GAAG,GAAG,aAAa;CAGlE,IAAI,OAAO,WAAW,KAAA,GACpB,OAAO,gBAAgB,OAAO,WAAW,OAAO,MAAM,GAAG,aAAa;CAGxE,IAAI,OAAO,YAAY,KAAA,GAErB,QAAQ,MAAM,UAAU,OADH,gBAAgB,OAAO,OACb,GAAc,aAAa,GAAG;CAG/D,MAAM,IAAI,MACR,4FACF;AACF;AAEA,SAAS,QAAQ,WAAmB;CAClC,OAAO,KAAK,MAAM,SAAS;AAC7B;AAEA,SAAS,WAAW,QAAgB;CAClC,OAAO,IAAI,YAAY,EAAE,OAAO,MAAM;AACxC;AAEA,eAAe,gBACb,OACA,WACA,eACqB;CACrB,MAAM,EAAC,YAAW,MAAM,UAAU,OAAO,WAAW,aAAa;CAEjE,OAAO;AACT"}
+{"version":3,"file":"jwt.js","names":[],"sources":["../../../../../zero-cache/src/auth/jwt.ts"],"sourcesContent":["import {\n  createRemoteJWKSet,\n  exportJWK,\n  generateKeyPair,\n  jwtVerify,\n  type JWK,\n  type JWTClaimVerificationOptions,\n  type JWTPayload,\n  type KeyLike,\n} from 'jose';\nimport type {LegacyJWTAuthConfig} from '../config/zero-config.ts';\n\n/** @deprecated */\nexport async function createJwkPair() {\n  const {publicKey, privateKey} = await generateKeyPair('PS256');\n\n  const privateJwk = await exportJWK(privateKey);\n  const publicJwk = await exportJWK(publicKey);\n\n  privateJwk.kid = 'key-2024-001';\n  privateJwk.use = 'sig';\n  privateJwk.alg = 'PS256';\n\n  publicJwk.kid = privateJwk.kid;\n  publicJwk.use = privateJwk.use;\n  publicJwk.alg = privateJwk.alg;\n\n  return {privateJwk, publicJwk};\n}\n\nlet remoteKeyset: ReturnType<typeof createRemoteJWKSet> | undefined;\nfunction getRemoteKeyset(jwksUrl: string) {\n  if (remoteKeyset === undefined) {\n    remoteKeyset = createRemoteJWKSet(new URL(jwksUrl));\n  }\n\n  return remoteKeyset;\n}\n\n/** @deprecated */\nexport const tokenConfigOptions = (config: LegacyJWTAuthConfig) => {\n  const tokenOptions = (['jwk', 'secret', 'jwksUrl'] as const).filter(\n    key => config[key] !== undefined,\n  );\n\n  return tokenOptions;\n};\n\n/** @deprecated */\nexport async function verifyToken(\n  config: LegacyJWTAuthConfig,\n  token: string,\n  verifyOptions: JWTClaimVerificationOptions,\n): Promise<JWTPayload> {\n  if (config.jwk !== undefined) {\n    return verifyTokenImpl(token, loadJwk(config.jwk), verifyOptions);\n  }\n\n  if (config.secret !== undefined) {\n    return verifyTokenImpl(token, loadSecret(config.secret), verifyOptions);\n  }\n\n  if (config.jwksUrl !== undefined) {\n    const remoteKeyset = getRemoteKeyset(config.jwksUrl);\n    return (await jwtVerify(token, remoteKeyset, verifyOptions)).payload;\n  }\n\n  throw new Error(\n    'verifyToken was called but no auth options (one of: jwk, secret, jwksUrl) were configured.',\n  );\n}\n\nfunction loadJwk(jwkString: string) {\n  return JSON.parse(jwkString) as JWK;\n}\n\nfunction loadSecret(secret: string) {\n  return new TextEncoder().encode(secret);\n}\n\nasync function verifyTokenImpl(\n  token: string,\n  verifyKey: Uint8Array | KeyLike | JWK,\n  verifyOptions: JWTClaimVerificationOptions,\n): Promise<JWTPayload> {\n  const {payload} = await jwtVerify(token, verifyKey, verifyOptions);\n\n  return payload;\n}\n"],"mappings":";;AA8BA,IAAI;AACJ,SAAS,gBAAgB,SAAiB;CACxC,IAAI,iBAAiB,KAAA,GACnB,eAAe,mBAAmB,IAAI,IAAI,OAAO,CAAC;CAGpD,OAAO;AACT;;AAGA,IAAa,sBAAsB,WAAgC;CAKjE,OAJsB;EAAC;EAAO;EAAU;CAAS,CAAC,CAAW,QAC3D,QAAO,OAAO,SAAS,KAAA,CAGlB;AACT;;AAGA,eAAsB,YACpB,QACA,OACA,eACqB;CACrB,IAAI,OAAO,QAAQ,KAAA,GACjB,OAAO,gBAAgB,OAAO,QAAQ,OAAO,GAAG,GAAG,aAAa;CAGlE,IAAI,OAAO,WAAW,KAAA,GACpB,OAAO,gBAAgB,OAAO,WAAW,OAAO,MAAM,GAAG,aAAa;CAGxE,IAAI,OAAO,YAAY,KAAA,GAAW;EAChC,MAAM,eAAe,gBAAgB,OAAO,OAAO;EACnD,QAAQ,MAAM,UAAU,OAAO,cAAc,aAAa,EAAA,CAAG;CAC/D;CAEA,MAAM,IAAI,MACR,4FACF;AACF;AAEA,SAAS,QAAQ,WAAmB;CAClC,OAAO,KAAK,MAAM,SAAS;AAC7B;AAEA,SAAS,WAAW,QAAgB;CAClC,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM;AACxC;AAEA,eAAe,gBACb,OACA,WACA,eACqB;CACrB,MAAM,EAAC,YAAW,MAAM,UAAU,OAAO,WAAW,aAAa;CAEjE,OAAO;AACT"}

package/out/zero-cache/src/auth/load-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"load-permissions.js","names":[],"sources":["../../../../../zero-cache/src/auth/load-permissions.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport * as v from '../../../shared/src/valita.ts';\nimport {\n  permissionsConfigSchema,\n  type PermissionsConfig,\n} from '../../../zero-schema/src/compiled-permissions.ts';\nimport type {TableSchema} from '../../../zero-schema/src/table-schema.ts';\nimport type {Schema} from '../../../zero-types/src/schema.ts';\nimport type {Database} from '../../../zqlite/src/db.ts';\nimport type {ZeroConfig} from '../config/zero-config.ts';\nimport {computeZqlSpecs} from '../db/lite-tables.ts';\nimport type {StatementRunner} from '../db/statements.ts';\nimport {elide} from '../types/strings.ts';\n\nexport type LoadedPermissions = {\n  permissions: PermissionsConfig | null;\n  hash: string | null;\n};\n\nexport function loadPermissions(\n  lc: LogContext,\n  replica: StatementRunner,\n  appID: string,\n  config?: ZeroConfig,\n): LoadedPermissions {\n  const {permissions, hash} = replica.get(\n    `SELECT permissions, hash FROM \"${appID}.permissions\"`,\n  );\n  if (permissions === null) {\n    const hasCustomEndpoints =\n      config !== undefined &&\n      (config.push?.url !== undefined || config.mutate?.url !== undefined) &&\n      (config.query?.url !== undefined || config.getQueries?.url !== undefined);\n\n    if (!hasCustomEndpoints) {\n      const appIDFlag = appID === 'zero' ? '' : ` --app-id=${appID}`;\n      lc.warn?.(\n        `\\n\\n\\n` +\n          `No upstream permissions deployed.\\n` +\n          `Run 'npx zero-deploy-permissions${appIDFlag}' to enforce permissions.` +\n          `\\n\\n\\n`,\n      );\n    }\n    return {permissions, hash: null};\n  }\n  let obj;\n  let parsed;\n  try {\n    obj = JSON.parse(permissions);\n    parsed = v.parse(obj, permissionsConfigSchema);\n  } catch (e) {\n    // TODO: Plumb the --server-version and include in error message.\n    throw new Error(\n      `Could not parse upstream permissions: ` +\n        `'${elide(String(permissions), 100)}'.\\n` +\n        `This may happen if Permissions with a new internal format are ` +\n        `deployed before the supporting server has been fully rolled out.`,\n      {cause: e},\n    );\n  }\n  return {permissions: parsed, hash};\n}\n\nexport function reloadPermissionsIfChanged(\n  lc: LogContext,\n  replica: StatementRunner,\n  appID: string,\n  current: LoadedPermissions | null,\n  config?: ZeroConfig,\n): {permissions: LoadedPermissions; changed: boolean} {\n  if (current === null) {\n    return {\n      permissions: loadPermissions(lc, replica, appID, config),\n      changed: true,\n    };\n  }\n  const {hash} = replica.get(`SELECT hash FROM \"${appID}.permissions\"`);\n  return hash === current.hash\n    ? {permissions: current, changed: false}\n    : {permissions: loadPermissions(lc, replica, appID, config), changed: true};\n}\n\nexport function getSchema(lc: LogContext, replica: Database): Schema {\n  const specs = computeZqlSpecs(lc, replica, {\n    includeBackfillingColumns: false,\n  });\n  const tables = Object.fromEntries(\n    Array.from(specs.values(), table => {\n      const {\n        tableSpec: {name, primaryKey},\n        zqlSpec: columns,\n      } = table;\n      return [name, {name, columns, primaryKey} satisfies TableSchema];\n    }),\n  );\n  return {\n    tables,\n    relationships: {}, // relationships are already denormalized in ASTs\n  };\n}\n"],"mappings":";;;;;AAmBA,SAAgB,gBACd,IACA,SACA,OACA,QACmB;CACnB,MAAM,EAAC,aAAa,SAAQ,QAAQ,IAClC,kCAAkC,MAAM,cAC1C;CACA,IAAI,gBAAgB,MAAM;EAMxB,IAAI,EAJF,WAAW,KAAA,MACV,OAAO,MAAM,QAAQ,KAAA,KAAa,OAAO,QAAQ,QAAQ,KAAA,OACzD,OAAO,OAAO,QAAQ,KAAA,KAAa,OAAO,YAAY,QAAQ,KAAA,KAExC;GACvB,MAAM,YAAY,UAAU,SAAS,KAAK,aAAa;GACvD,GAAG,OACD;;;;kCAEqC,UAAU,gCAEjD;EACF;EACA,OAAO;GAAC;GAAa,MAAM;EAAI;CACjC;CACA,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,MAAM,WAAW;EAC5B,SAAS,MAAQ,KAAK,uBAAuB;CAC/C,SAAS,GAAG;EAEV,MAAM,IAAI,MACR,0CACM,MAAM,OAAO,WAAW,GAAG,GAAG,EAAE,qIAGtC,EAAC,OAAO,EAAC,CACX;CACF;CACA,OAAO;EAAC,aAAa;EAAQ;CAAI;AACnC;AAEA,SAAgB,2BACd,IACA,SACA,OACA,SACA,QACoD;CACpD,IAAI,YAAY,MACd,OAAO;EACL,aAAa,gBAAgB,IAAI,SAAS,OAAO,MAAM;EACvD,SAAS;CACX;CAEF,MAAM,EAAC,SAAQ,QAAQ,IAAI,qBAAqB,MAAM,cAAc;CACpE,OAAO,SAAS,QAAQ,OACpB;EAAC,aAAa;EAAS,SAAS;CAAK,IACrC;EAAC,aAAa,gBAAgB,IAAI,SAAS,OAAO,MAAM;EAAG,SAAS;CAAI;AAC9E;AAEA,SAAgB,UAAU,IAAgB,SAA2B;CACnE,MAAM,QAAQ,gBAAgB,IAAI,SAAS,EACzC,2BAA2B,MAC7B,CAAC;CAUD,OAAO;EACL,QAVa,OAAO,YACpB,MAAM,KAAK,MAAM,OAAO,IAAG,UAAS;GAClC,MAAM,EACJ,WAAW,EAAC,MAAM,cAClB,SAAS,YACP;GACJ,OAAO,CAAC,MAAM;IAAC;IAAM;IAAS;GAAU,CAAuB;EACjE,CAAC,CAGD;EACA,eAAe,CAAC;CAClB;AACF"}
+{"version":3,"file":"load-permissions.js","names":["v.parse"],"sources":["../../../../../zero-cache/src/auth/load-permissions.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport * as v from '../../../shared/src/valita.ts';\nimport {\n  permissionsConfigSchema,\n  type PermissionsConfig,\n} from '../../../zero-schema/src/compiled-permissions.ts';\nimport type {TableSchema} from '../../../zero-schema/src/table-schema.ts';\nimport type {Schema} from '../../../zero-types/src/schema.ts';\nimport type {Database} from '../../../zqlite/src/db.ts';\nimport type {ZeroConfig} from '../config/zero-config.ts';\nimport {computeZqlSpecs} from '../db/lite-tables.ts';\nimport type {StatementRunner} from '../db/statements.ts';\nimport {elide} from '../types/strings.ts';\n\nexport type LoadedPermissions = {\n  permissions: PermissionsConfig | null;\n  hash: string | null;\n};\n\nexport function loadPermissions(\n  lc: LogContext,\n  replica: StatementRunner,\n  appID: string,\n  config?: ZeroConfig,\n): LoadedPermissions {\n  const {permissions, hash} = replica.get(\n    `SELECT permissions, hash FROM \"${appID}.permissions\"`,\n  );\n  if (permissions === null) {\n    const hasCustomEndpoints =\n      config !== undefined &&\n      (config.push?.url !== undefined || config.mutate?.url !== undefined) &&\n      (config.query?.url !== undefined || config.getQueries?.url !== undefined);\n\n    if (!hasCustomEndpoints) {\n      const appIDFlag = appID === 'zero' ? '' : ` --app-id=${appID}`;\n      lc.warn?.(\n        `\\n\\n\\n` +\n          `No upstream permissions deployed.\\n` +\n          `Run 'npx zero-deploy-permissions${appIDFlag}' to enforce permissions.` +\n          `\\n\\n\\n`,\n      );\n    }\n    return {permissions, hash: null};\n  }\n  let obj;\n  let parsed;\n  try {\n    obj = JSON.parse(permissions);\n    parsed = v.parse(obj, permissionsConfigSchema);\n  } catch (e) {\n    // TODO: Plumb the --server-version and include in error message.\n    throw new Error(\n      `Could not parse upstream permissions: ` +\n        `'${elide(String(permissions), 100)}'.\\n` +\n        `This may happen if Permissions with a new internal format are ` +\n        `deployed before the supporting server has been fully rolled out.`,\n      {cause: e},\n    );\n  }\n  return {permissions: parsed, hash};\n}\n\nexport function reloadPermissionsIfChanged(\n  lc: LogContext,\n  replica: StatementRunner,\n  appID: string,\n  current: LoadedPermissions | null,\n  config?: ZeroConfig,\n): {permissions: LoadedPermissions; changed: boolean} {\n  if (current === null) {\n    return {\n      permissions: loadPermissions(lc, replica, appID, config),\n      changed: true,\n    };\n  }\n  const {hash} = replica.get(`SELECT hash FROM \"${appID}.permissions\"`);\n  return hash === current.hash\n    ? {permissions: current, changed: false}\n    : {permissions: loadPermissions(lc, replica, appID, config), changed: true};\n}\n\nexport function getSchema(lc: LogContext, replica: Database): Schema {\n  const specs = computeZqlSpecs(lc, replica, {\n    includeBackfillingColumns: false,\n  });\n  const tables = Object.fromEntries(\n    Array.from(specs.values(), table => {\n      const {\n        tableSpec: {name, primaryKey},\n        zqlSpec: columns,\n      } = table;\n      return [name, {name, columns, primaryKey} satisfies TableSchema];\n    }),\n  );\n  return {\n    tables,\n    relationships: {}, // relationships are already denormalized in ASTs\n  };\n}\n"],"mappings":";;;;;AAmBA,SAAgB,gBACd,IACA,SACA,OACA,QACmB;CACnB,MAAM,EAAC,aAAa,SAAQ,QAAQ,IAClC,kCAAkC,MAAM,cAC1C;CACA,IAAI,gBAAgB,MAAM;EAMxB,IAAI,EAJF,WAAW,KAAA,MACV,OAAO,MAAM,QAAQ,KAAA,KAAa,OAAO,QAAQ,QAAQ,KAAA,OACzD,OAAO,OAAO,QAAQ,KAAA,KAAa,OAAO,YAAY,QAAQ,KAAA,KAExC;GACvB,MAAM,YAAY,UAAU,SAAS,KAAK,aAAa;GACvD,GAAG,OACD;;;;kCAEqC,UAAU,gCAEjD;EACF;EACA,OAAO;GAAC;GAAa,MAAM;EAAI;CACjC;CACA,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,MAAM,WAAW;EAC5B,SAASA,MAAQ,KAAK,uBAAuB;CAC/C,SAAS,GAAG;EAEV,MAAM,IAAI,MACR,0CACM,MAAM,OAAO,WAAW,GAAG,GAAG,EAAE,qIAGtC,EAAC,OAAO,EAAC,CACX;CACF;CACA,OAAO;EAAC,aAAa;EAAQ;CAAI;AACnC;AAEA,SAAgB,2BACd,IACA,SACA,OACA,SACA,QACoD;CACpD,IAAI,YAAY,MACd,OAAO;EACL,aAAa,gBAAgB,IAAI,SAAS,OAAO,MAAM;EACvD,SAAS;CACX;CAEF,MAAM,EAAC,SAAQ,QAAQ,IAAI,qBAAqB,MAAM,cAAc;CACpE,OAAO,SAAS,QAAQ,OACpB;EAAC,aAAa;EAAS,SAAS;CAAK,IACrC;EAAC,aAAa,gBAAgB,IAAI,SAAS,OAAO,MAAM;EAAG,SAAS;CAAI;AAC9E;AAEA,SAAgB,UAAU,IAAgB,SAA2B;CACnE,MAAM,QAAQ,gBAAgB,IAAI,SAAS,EACzC,2BAA2B,MAC7B,CAAC;CAUD,OAAO;EACL,QAVa,OAAO,YACpB,MAAM,KAAK,MAAM,OAAO,IAAG,UAAS;GAClC,MAAM,EACJ,WAAW,EAAC,MAAM,cAClB,SAAS,YACP;GACJ,OAAO,CAAC,MAAM;IAAC;IAAM;IAAS;GAAU,CAAuB;EACjE,CAAC,CAGD;EACA,eAAe,CAAC;CAClB;AACF"}

package/out/zero-cache/src/auth/read-authorizer.js

@@ -23,7 +23,8 @@ function transformAndHashQuery(lc, id, query, permissionRules, auth, internalQue
 * For a given AST, apply the read-auth rules and bind static auth data.
 */
 function transformQuery(lc, query, permissionRules, auth) {
-	return bindStaticParameters(transformQueryInternal(lc, query, permissionRules), { authData: auth ? auth.decoded : {} });
+	const queryWithPermissions = transformQueryInternal(lc, query, permissionRules);
+	return bindStaticParameters(queryWithPermissions, { authData: auth ? auth.decoded : {} });
 }
 function transformQueryInternal(lc, query, permissionRules) {
 	let rowSelectRules = permissionRules?.tables?.[query.table]?.row?.select;
@@ -77,6 +78,6 @@ function transformCondition(lc, cond, auth) {
 	}
 }
 //#endregion
-export { transformAndHashQuery };
+export { transformAndHashQuery, transformQuery };
 
 //# sourceMappingURL=read-authorizer.js.map

package/out/zero-cache/src/auth/read-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-authorizer.js","names":[],"sources":["../../../../../zero-cache/src/auth/read-authorizer.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {JSONValue} from '../../../shared/src/json.ts';\nimport type {AST, Condition} from '../../../zero-protocol/src/ast.ts';\nimport {hashOfAST} from '../../../zero-protocol/src/query-hash.ts';\nimport type {PermissionsConfig} from '../../../zero-schema/src/compiled-permissions.ts';\nimport {bindStaticParameters} from '../../../zql/src/builder/builder.ts';\nimport {simplifyCondition} from '../../../zql/src/query/expression.ts';\nimport type {JWTAuth} from './auth.ts';\n\nexport type TransformedAndHashed = {\n  id: string;\n  transformedAst: AST;\n  transformationHash: string;\n};\n/**\n * Adds permission rules to the given query so it only returns rows that the\n * user is allowed to read.\n *\n * If the returned query is `undefined` that means that user cannot run\n * the query at all. This is only the case if we can infer that all rows\n * would be excluded without running the query.\n * E.g., the user is trying to query a table that is not readable.\n */\nexport function transformAndHashQuery(\n  lc: LogContext,\n  id: string,\n  query: AST,\n  permissionRules: PermissionsConfig,\n  auth: JWTAuth | undefined,\n  internalQuery: boolean | null | undefined,\n): TransformedAndHashed {\n  const transformed = internalQuery\n    ? query // application permissions do not apply to internal queries\n    : transformQuery(lc, query, permissionRules, auth);\n  return {\n    id,\n    transformedAst: transformed,\n    transformationHash: hashOfAST(transformed),\n  };\n}\n\n/**\n * For a given AST, apply the read-auth rules and bind static auth data.\n */\nexport function transformQuery(\n  lc: LogContext,\n  query: AST,\n  permissionRules: PermissionsConfig,\n  auth: JWTAuth | undefined,\n): AST {\n  const queryWithPermissions = transformQueryInternal(\n    lc,\n    query,\n    permissionRules,\n  );\n  return bindStaticParameters(queryWithPermissions, {\n    authData: auth ? (auth.decoded as Record<string, JSONValue>) : {},\n  });\n}\n\nfunction transformQueryInternal(\n  lc: LogContext,\n  query: AST,\n  permissionRules: PermissionsConfig,\n): AST {\n  let rowSelectRules = permissionRules?.tables?.[query.table]?.row?.select;\n\n  if (!rowSelectRules || rowSelectRules.length === 0) {\n    // If there are no rules, we default to not allowing any rows to be selected.\n    lc.warn?.(\n      \"No permission rules found for table '\" +\n        query.table +\n        \"'. No rows will be returned. Use ANYONE_CAN to allow all users to access all rows.\",\n    );\n    rowSelectRules = [\n      [\n        'allow',\n        {\n          type: 'or',\n          conditions: [],\n        },\n      ],\n    ];\n  }\n\n  const updatedWhere = addRulesToWhere(\n    query.where\n      ? transformCondition(lc, query.where, permissionRules)\n      : undefined,\n    rowSelectRules,\n  );\n  return {\n    ...query,\n    where: simplifyCondition(updatedWhere),\n    related: query.related?.map(sq => {\n      const subquery = transformQueryInternal(lc, sq.subquery, permissionRules);\n      return {\n        ...sq,\n        subquery,\n      };\n    }),\n  };\n}\n\nfunction addRulesToWhere(\n  where: Condition | undefined,\n  rowSelectRules: ['allow', Condition][],\n): Condition {\n  return {\n    type: 'and',\n    conditions: [\n      ...(where ? [where] : []),\n      {\n        type: 'or',\n        conditions: rowSelectRules.map(([_, condition]) => condition),\n      },\n    ],\n  };\n}\n\n// We must augment conditions so we do not provide an oracle to users.\n// E.g.,\n// `issue.whereExists('secret', s => s.where('value', 'sdf'))`\n// Not applying read policies to subqueries in the where position\n// would allow users to infer the existence of rows, and their contents,\n// that they cannot read.\nfunction transformCondition(\n  lc: LogContext,\n  cond: Condition,\n  auth: PermissionsConfig,\n): Condition {\n  switch (cond.type) {\n    case 'simple':\n      return cond;\n    case 'and':\n    case 'or':\n      return {\n        ...cond,\n        conditions: cond.conditions.map(c => transformCondition(lc, c, auth)),\n      };\n    case 'correlatedSubquery': {\n      const query = transformQueryInternal(lc, cond.related.subquery, auth);\n      return {\n        ...cond,\n        related: {\n          ...cond.related,\n          subquery: query,\n        },\n      };\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,SAAgB,sBACd,IACA,IACA,OACA,iBACA,MACA,eACsB;CACtB,MAAM,cAAc,gBAChB,QACA,eAAe,IAAI,OAAO,iBAAiB,IAAI;CACnD,OAAO;EACL;EACA,gBAAgB;EAChB,oBAAoB,UAAU,WAAW;CAC3C;AACF;;;;AAKA,SAAgB,eACd,IACA,OACA,iBACA,MACK;CAML,OAAO,qBALsB,uBAC3B,IACA,OACA,eAE0B,GAAsB,EAChD,UAAU,OAAQ,KAAK,UAAwC,CAAC,EAClE,CAAC;AACH;AAEA,SAAS,uBACP,IACA,OACA,iBACK;CACL,IAAI,iBAAiB,iBAAiB,SAAS,MAAM,QAAQ,KAAK;CAElE,IAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG;EAElD,GAAG,OACD,0CACE,MAAM,QACN,oFACJ;EACA,iBAAiB,CACf,CACE,SACA;GACE,MAAM;GACN,YAAY,CAAC;EACf,CACF,CACF;CACF;CAEA,MAAM,eAAe,gBACnB,MAAM,QACF,mBAAmB,IAAI,MAAM,OAAO,eAAe,IACnD,KAAA,GACJ,cACF;CACA,OAAO;EACL,GAAG;EACH,OAAO,kBAAkB,YAAY;EACrC,SAAS,MAAM,SAAS,KAAI,OAAM;GAChC,MAAM,WAAW,uBAAuB,IAAI,GAAG,UAAU,eAAe;GACxE,OAAO;IACL,GAAG;IACH;GACF;EACF,CAAC;CACH;AACF;AAEA,SAAS,gBACP,OACA,gBACW;CACX,OAAO;EACL,MAAM;EACN,YAAY,CACV,GAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,GACvB;GACE,MAAM;GACN,YAAY,eAAe,KAAK,CAAC,GAAG,eAAe,SAAS;EAC9D,CACF;CACF;AACF;AAQA,SAAS,mBACP,IACA,MACA,MACW;CACX,QAAQ,KAAK,MAAb;EACE,KAAK,UACH,OAAO;EACT,KAAK;EACL,KAAK,MACH,OAAO;GACL,GAAG;GACH,YAAY,KAAK,WAAW,KAAI,MAAK,mBAAmB,IAAI,GAAG,IAAI,CAAC;EACtE;EACF,KAAK,sBAAsB;GACzB,MAAM,QAAQ,uBAAuB,IAAI,KAAK,QAAQ,UAAU,IAAI;GACpE,OAAO;IACL,GAAG;IACH,SAAS;KACP,GAAG,KAAK;KACR,UAAU;IACZ;GACF;EACF;CACF;AACF"}
+{"version":3,"file":"read-authorizer.js","names":[],"sources":["../../../../../zero-cache/src/auth/read-authorizer.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {JSONValue} from '../../../shared/src/json.ts';\nimport type {AST, Condition} from '../../../zero-protocol/src/ast.ts';\nimport {hashOfAST} from '../../../zero-protocol/src/query-hash.ts';\nimport type {PermissionsConfig} from '../../../zero-schema/src/compiled-permissions.ts';\nimport {bindStaticParameters} from '../../../zql/src/builder/builder.ts';\nimport {simplifyCondition} from '../../../zql/src/query/expression.ts';\nimport type {JWTAuth} from './auth.ts';\n\nexport type TransformedAndHashed = {\n  id: string;\n  transformedAst: AST;\n  transformationHash: string;\n};\n/**\n * Adds permission rules to the given query so it only returns rows that the\n * user is allowed to read.\n *\n * If the returned query is `undefined` that means that user cannot run\n * the query at all. This is only the case if we can infer that all rows\n * would be excluded without running the query.\n * E.g., the user is trying to query a table that is not readable.\n */\nexport function transformAndHashQuery(\n  lc: LogContext,\n  id: string,\n  query: AST,\n  permissionRules: PermissionsConfig,\n  auth: JWTAuth | undefined,\n  internalQuery: boolean | null | undefined,\n): TransformedAndHashed {\n  const transformed = internalQuery\n    ? query // application permissions do not apply to internal queries\n    : transformQuery(lc, query, permissionRules, auth);\n  return {\n    id,\n    transformedAst: transformed,\n    transformationHash: hashOfAST(transformed),\n  };\n}\n\n/**\n * For a given AST, apply the read-auth rules and bind static auth data.\n */\nexport function transformQuery(\n  lc: LogContext,\n  query: AST,\n  permissionRules: PermissionsConfig,\n  auth: JWTAuth | undefined,\n): AST {\n  const queryWithPermissions = transformQueryInternal(\n    lc,\n    query,\n    permissionRules,\n  );\n  return bindStaticParameters(queryWithPermissions, {\n    authData: auth ? (auth.decoded as Record<string, JSONValue>) : {},\n  });\n}\n\nfunction transformQueryInternal(\n  lc: LogContext,\n  query: AST,\n  permissionRules: PermissionsConfig,\n): AST {\n  let rowSelectRules = permissionRules?.tables?.[query.table]?.row?.select;\n\n  if (!rowSelectRules || rowSelectRules.length === 0) {\n    // If there are no rules, we default to not allowing any rows to be selected.\n    lc.warn?.(\n      \"No permission rules found for table '\" +\n        query.table +\n        \"'. No rows will be returned. Use ANYONE_CAN to allow all users to access all rows.\",\n    );\n    rowSelectRules = [\n      [\n        'allow',\n        {\n          type: 'or',\n          conditions: [],\n        },\n      ],\n    ];\n  }\n\n  const updatedWhere = addRulesToWhere(\n    query.where\n      ? transformCondition(lc, query.where, permissionRules)\n      : undefined,\n    rowSelectRules,\n  );\n  return {\n    ...query,\n    where: simplifyCondition(updatedWhere),\n    related: query.related?.map(sq => {\n      const subquery = transformQueryInternal(lc, sq.subquery, permissionRules);\n      return {\n        ...sq,\n        subquery,\n      };\n    }),\n  };\n}\n\nfunction addRulesToWhere(\n  where: Condition | undefined,\n  rowSelectRules: ['allow', Condition][],\n): Condition {\n  return {\n    type: 'and',\n    conditions: [\n      ...(where ? [where] : []),\n      {\n        type: 'or',\n        conditions: rowSelectRules.map(([_, condition]) => condition),\n      },\n    ],\n  };\n}\n\n// We must augment conditions so we do not provide an oracle to users.\n// E.g.,\n// `issue.whereExists('secret', s => s.where('value', 'sdf'))`\n// Not applying read policies to subqueries in the where position\n// would allow users to infer the existence of rows, and their contents,\n// that they cannot read.\nfunction transformCondition(\n  lc: LogContext,\n  cond: Condition,\n  auth: PermissionsConfig,\n): Condition {\n  switch (cond.type) {\n    case 'simple':\n      return cond;\n    case 'and':\n    case 'or':\n      return {\n        ...cond,\n        conditions: cond.conditions.map(c => transformCondition(lc, c, auth)),\n      };\n    case 'correlatedSubquery': {\n      const query = transformQueryInternal(lc, cond.related.subquery, auth);\n      return {\n        ...cond,\n        related: {\n          ...cond.related,\n          subquery: query,\n        },\n      };\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,SAAgB,sBACd,IACA,IACA,OACA,iBACA,MACA,eACsB;CACtB,MAAM,cAAc,gBAChB,QACA,eAAe,IAAI,OAAO,iBAAiB,IAAI;CACnD,OAAO;EACL;EACA,gBAAgB;EAChB,oBAAoB,UAAU,WAAW;CAC3C;AACF;;;;AAKA,SAAgB,eACd,IACA,OACA,iBACA,MACK;CACL,MAAM,uBAAuB,uBAC3B,IACA,OACA,eACF;CACA,OAAO,qBAAqB,sBAAsB,EAChD,UAAU,OAAQ,KAAK,UAAwC,CAAC,EAClE,CAAC;AACH;AAEA,SAAS,uBACP,IACA,OACA,iBACK;CACL,IAAI,iBAAiB,iBAAiB,SAAS,MAAM,MAAM,EAAE,KAAK;CAElE,IAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG;EAElD,GAAG,OACD,0CACE,MAAM,QACN,oFACJ;EACA,iBAAiB,CACf,CACE,SACA;GACE,MAAM;GACN,YAAY,CAAC;EACf,CACF,CACF;CACF;CAEA,MAAM,eAAe,gBACnB,MAAM,QACF,mBAAmB,IAAI,MAAM,OAAO,eAAe,IACnD,KAAA,GACJ,cACF;CACA,OAAO;EACL,GAAG;EACH,OAAO,kBAAkB,YAAY;EACrC,SAAS,MAAM,SAAS,KAAI,OAAM;GAChC,MAAM,WAAW,uBAAuB,IAAI,GAAG,UAAU,eAAe;GACxE,OAAO;IACL,GAAG;IACH;GACF;EACF,CAAC;CACH;AACF;AAEA,SAAS,gBACP,OACA,gBACW;CACX,OAAO;EACL,MAAM;EACN,YAAY,CACV,GAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,GACvB;GACE,MAAM;GACN,YAAY,eAAe,KAAK,CAAC,GAAG,eAAe,SAAS;EAC9D,CACF;CACF;AACF;AAQA,SAAS,mBACP,IACA,MACA,MACW;CACX,QAAQ,KAAK,MAAb;EACE,KAAK,UACH,OAAO;EACT,KAAK;EACL,KAAK,MACH,OAAO;GACL,GAAG;GACH,YAAY,KAAK,WAAW,KAAI,MAAK,mBAAmB,IAAI,GAAG,IAAI,CAAC;EACtE;EACF,KAAK,sBAAsB;GACzB,MAAM,QAAQ,uBAAuB,IAAI,KAAK,QAAQ,UAAU,IAAI;GACpE,OAAO;IACL,GAAG;IACH,SAAS;KACP,GAAG,KAAK;KACR,UAAU;IACZ;GACF;EACF;CACF;AACF"}

package/out/zero-cache/src/auth/write-authorizer.js

@@ -61,9 +61,7 @@ var WriteAuthorizerImpl = class {
 			case "update":
 				if (!await this.#canUpdate("preMutation", authData, op)) return false;
 				break;
-			case "delete":
-				if (!await this.#canDelete("preMutation", authData, op)) return false;
-				break;
+			case "delete": if (!await this.#canDelete("preMutation", authData, op)) return false;
 		}
 		return true;
 	}
@@ -80,19 +78,14 @@ var WriteAuthorizerImpl = class {
 					case "update":
 						consume(source.push(makeSourceChangeEdit(op.value, this.#requirePreMutationRow(op))));
 						break;
-					case "delete":
-						consume(source.push(makeSourceChangeRemove(this.#requirePreMutationRow(op))));
-						break;
+					case "delete": consume(source.push(makeSourceChangeRemove(this.#requirePreMutationRow(op))));
 				}
 			}
 			for (const op of ops) switch (op.op) {
 				case "insert":
 					if (!await this.#canInsert("postMutation", authData, op)) return false;
 					break;
-				case "update":
-					if (!await this.#canUpdate("postMutation", authData, op)) return false;
-					break;
-				case "delete": break;
+				case "update": if (!await this.#canUpdate("postMutation", authData, op)) return false;
 			}
 		} catch (e) {
 			opError = e;
@@ -204,9 +197,7 @@ var WriteAuthorizerImpl = class {
 				if (phase === "preMutation") applicableRowPolicy = rowPolicies?.update?.preMutation;
 				else if (phase === "postMutation") applicableRowPolicy = rowPolicies?.update?.postMutation;
 				break;
-			case "delete":
-				if (phase === "preMutation") applicableRowPolicy = rowPolicies?.delete;
-				break;
+			case "delete": if (phase === "preMutation") applicableRowPolicy = rowPolicies?.delete;
 		}
 		const cellPolicies = rules?.cell;
 		const applicableCellPolicies = [];
@@ -220,9 +211,7 @@ var WriteAuthorizerImpl = class {
 					if (phase === "preMutation" && policy.update?.preMutation) applicableCellPolicies.push(policy.update.preMutation);
 					if (phase === "postMutation" && policy.update?.postMutation) applicableCellPolicies.push(policy.update.postMutation);
 					break;
-				case "delete":
-					if (policy.delete && phase === "preMutation") applicableCellPolicies.push(policy.delete);
-					break;
+				case "delete": if (policy.delete && phase === "preMutation") applicableCellPolicies.push(policy.delete);
 			}
 		}
 		if (!await this.#passesPolicyGroup(applicableRowPolicy, applicableCellPolicies, authData, rowQuery)) {

package/out/zero-cache/src/auth/write-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"write-authorizer.js","names":["#schema","#replica","#builderDelegate","#tableSpecs","#tables","#statementRunner","#lc","#appID","#logConfig","#cgStorage","#config","#getSource","#loadedPermissions","#canUpdate","#canDelete","#requirePreMutationRow","#canInsert","#getPreMutationRow","#timedCanDo","#canDo","#getPrimaryKey","#passesPolicyGroup","#passesPolicy"],"sources":["../../../../../zero-cache/src/auth/write-authorizer.ts"],"sourcesContent":["import type {SQLQuery} from '@databases/sql';\nimport type {MaybePromise} from '@opentelemetry/resources';\nimport type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport {assert} from '../../../shared/src/asserts.ts';\nimport type {JSONValue, ReadonlyJSONValue} from '../../../shared/src/json.ts';\nimport {must} from '../../../shared/src/must.ts';\nimport * as v from '../../../shared/src/valita.ts';\nimport type {Condition} from '../../../zero-protocol/src/ast.ts';\nimport type {\n  CRUDOp,\n  DeleteOp,\n  InsertOp,\n  UpdateOp,\n  UpsertOp,\n} from '../../../zero-protocol/src/mutation.ts';\nimport {\n  primaryKeyValueSchema,\n  type PrimaryKeyValue,\n} from '../../../zero-protocol/src/primary-key.ts';\nimport type {Policy} from '../../../zero-schema/src/compiled-permissions.ts';\nimport type {Schema} from '../../../zero-types/src/schema.ts';\nimport type {BuilderDelegate} from '../../../zql/src/builder/builder.ts';\nimport {\n  bindStaticParameters,\n  buildPipeline,\n} from '../../../zql/src/builder/builder.ts';\nimport {\n  makeSourceChangeAdd,\n  makeSourceChangeEdit,\n  makeSourceChangeRemove,\n} from '../../../zql/src/ivm/source.ts';\nimport {consume} from '../../../zql/src/ivm/stream.ts';\nimport {simplifyCondition} from '../../../zql/src/query/expression.ts';\nimport {asQueryInternals} from '../../../zql/src/query/query-internals.ts';\nimport type {Query} from '../../../zql/src/query/query.ts';\nimport {newStaticQuery} from '../../../zql/src/query/static-query.ts';\nimport type {\n  ClientGroupStorage,\n  DatabaseStorage,\n} from '../../../zqlite/src/database-storage.ts';\nimport type {Database} from '../../../zqlite/src/db.ts';\nimport {compile, sql} from '../../../zqlite/src/internal/sql.ts';\nimport {\n  fromSQLiteTypes,\n  TableSource,\n} from '../../../zqlite/src/table-source.ts';\nimport type {LogConfig, ZeroConfig} from '../config/zero-config.ts';\nimport {computeZqlSpecs} from '../db/lite-tables.ts';\nimport type {LiteAndZqlSpec} from '../db/specs.ts';\nimport {StatementRunner} from '../db/statements.ts';\nimport {mapLiteDataTypeToZqlSchemaValue} from '../types/lite.ts';\nimport {\n  getSchema,\n  reloadPermissionsIfChanged,\n  type LoadedPermissions,\n} from './load-permissions.ts';\n\ntype Phase = 'preMutation' | 'postMutation';\n\nexport interface WriteAuthorizer {\n  canPreMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ): Promise<boolean>;\n  canPostMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ): Promise<boolean>;\n  reloadPermissions(): void;\n  normalizeOps(ops: CRUDOp[]): Exclude<CRUDOp, UpsertOp>[];\n\n  /**\n   * Validates that all table names in the operations exist in the schema.\n   * @throws Error if any table name is invalid\n   */\n  validateTableNames(ops: CRUDOp[]): void;\n}\n\nexport class WriteAuthorizerImpl implements WriteAuthorizer {\n  readonly #schema: Schema;\n  readonly #replica: Database;\n  readonly #builderDelegate: BuilderDelegate;\n  readonly #tableSpecs: Map<string, LiteAndZqlSpec>;\n  readonly #tables = new Map<string, TableSource>();\n  readonly #statementRunner: StatementRunner;\n  readonly #lc: LogContext;\n  readonly #appID: string;\n  readonly #logConfig: LogConfig;\n  readonly #cgStorage: ClientGroupStorage;\n  readonly #config: ZeroConfig;\n\n  #loadedPermissions: LoadedPermissions | null = null;\n\n  constructor(\n    lc: LogContext,\n    config: ZeroConfig,\n    replica: Database,\n    appID: string,\n    cgID: string,\n    writeAuthzStorage: DatabaseStorage,\n  ) {\n    this.#appID = appID;\n    this.#config = config;\n    this.#lc = lc.withContext('class', 'WriteAuthorizerImpl');\n    this.#logConfig = config.log;\n    this.#schema = getSchema(this.#lc, replica);\n    this.#replica = replica;\n    this.#cgStorage = writeAuthzStorage.createClientGroupStorage(cgID);\n    this.#builderDelegate = {\n      disableCorrelatedPredicatePushdown:\n        config.enableCorrelatedPredicatePushdown === false,\n      getSource: name => this.#getSource(name),\n      createStorage: () => this.#cgStorage.createStorage(),\n      decorateSourceInput: input => input,\n      decorateInput: input => input,\n      addEdge() {},\n      decorateFilterInput: input => input,\n    };\n    this.#tableSpecs = computeZqlSpecs(this.#lc, replica, {\n      includeBackfillingColumns: false,\n    });\n    this.#statementRunner = new StatementRunner(replica);\n    this.reloadPermissions();\n  }\n\n  reloadPermissions() {\n    this.#loadedPermissions = reloadPermissionsIfChanged(\n      this.#lc,\n      this.#statementRunner,\n      this.#appID,\n      this.#loadedPermissions,\n      this.#config,\n    ).permissions;\n  }\n\n  destroy() {\n    this.#cgStorage.destroy();\n  }\n\n  async canPreMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ) {\n    for (const op of ops) {\n      switch (op.op) {\n        case 'insert':\n          // insert does not run pre-mutation checks\n          break;\n        case 'update':\n          if (!(await this.#canUpdate('preMutation', authData, op))) {\n            return false;\n          }\n          break;\n        case 'delete':\n          if (!(await this.#canDelete('preMutation', authData, op))) {\n            return false;\n          }\n          break;\n      }\n    }\n    return true;\n  }\n\n  async canPostMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ) {\n    this.#statementRunner.beginConcurrent();\n    let opError: unknown;\n    try {\n      for (const op of ops) {\n        const source = this.#getSource(op.tableName);\n        switch (op.op) {\n          case 'insert': {\n            consume(source.push(makeSourceChangeAdd(op.value)));\n            break;\n          }\n          // TODO(mlaw): what if someone updates the same thing twice?\n          // TODO(aa): It seems like it will just work? source.push()\n          // is going to push the row into the table source, and then the\n          // next requirePreMutationRow will just return the row that was\n          // pushed in.\n          case 'update': {\n            consume(\n              source.push(\n                makeSourceChangeEdit(op.value, this.#requirePreMutationRow(op)),\n              ),\n            );\n            break;\n          }\n          case 'delete': {\n            consume(\n              source.push(\n                makeSourceChangeRemove(this.#requirePreMutationRow(op)),\n              ),\n            );\n            break;\n          }\n        }\n      }\n\n      for (const op of ops) {\n        switch (op.op) {\n          case 'insert':\n            if (!(await this.#canInsert('postMutation', authData, op))) {\n              return false;\n            }\n            break;\n          case 'update':\n            if (!(await this.#canUpdate('postMutation', authData, op))) {\n              return false;\n            }\n            break;\n          case 'delete':\n            // delete does not run post-mutation checks.\n            break;\n        }\n      }\n    } catch (e) {\n      opError = e;\n      throw e;\n    } finally {\n      try {\n        this.#statementRunner.rollback();\n      } catch (rollbackError) {\n        if (opError !== undefined) {\n          const combinedError = new Error(\n            `canPostMutation failed and rollback also failed: operation error = ${String(opError)}; rollback error = ${String(rollbackError)}`,\n          );\n          combinedError.cause = opError;\n          throw combinedError;\n        }\n        throw rollbackError;\n      }\n    }\n\n    return true;\n  }\n\n  normalizeOps(ops: CRUDOp[]): Exclude<CRUDOp, UpsertOp>[] {\n    return ops.map(op => {\n      if (op.op === 'upsert') {\n        const preMutationRow = this.#getPreMutationRow(op);\n        if (preMutationRow) {\n          return {\n            op: 'update',\n            tableName: op.tableName,\n            primaryKey: op.primaryKey,\n            value: op.value,\n          };\n        }\n        return {\n          op: 'insert',\n          tableName: op.tableName,\n          primaryKey: op.primaryKey,\n          value: op.value,\n        };\n      }\n      return op;\n    });\n  }\n\n  validateTableNames(ops: CRUDOp[]): void {\n    for (const op of ops) {\n      if (!this.#tableSpecs.has(op.tableName)) {\n        throw new Error(`Table '${op.tableName}' is not a valid table.`);\n      }\n    }\n  }\n\n  #canInsert(phase: Phase, authData: JWTPayload | undefined, op: InsertOp) {\n    return this.#timedCanDo(phase, 'insert', authData, op);\n  }\n\n  #canUpdate(phase: Phase, authData: JWTPayload | undefined, op: UpdateOp) {\n    return this.#timedCanDo(phase, 'update', authData, op);\n  }\n\n  #canDelete(phase: Phase, authData: JWTPayload | undefined, op: DeleteOp) {\n    return this.#timedCanDo(phase, 'delete', authData, op);\n  }\n\n  /**\n   * Gets schema-defined primary key and validates that operation contains required PK values.\n   *\n   * @returns Record where keys are column names and values are client-provided values\n   * @throws Error if operation value is missing required primary key columns\n   */\n  #getPrimaryKey(\n    tableName: string,\n    opValue: Record<string, ReadonlyJSONValue | undefined>,\n  ): Record<string, ReadonlyJSONValue> {\n    const tableSpec = this.#tableSpecs.get(tableName);\n    if (!tableSpec) {\n      throw new Error(`Table ${tableName} not found`);\n    }\n    const columns = tableSpec.tableSpec.primaryKey;\n\n    // Extract primary key values from operation value and validate they exist\n    const values: Record<string, ReadonlyJSONValue> = {};\n    for (const col of columns) {\n      const val = opValue[col];\n      if (val === undefined) {\n        throw new Error(\n          `Primary key column '${col}' is missing from operation value for table ${tableName}`,\n        );\n      }\n      values[col] = val;\n    }\n\n    return values;\n  }\n\n  #getSource(tableName: string) {\n    let source = this.#tables.get(tableName);\n    if (source) {\n      return source;\n    }\n    const tableSpec = this.#tableSpecs.get(tableName);\n    if (!tableSpec) {\n      throw new Error(`Table ${tableName} not found`);\n    }\n    const {columns, primaryKey} = tableSpec.tableSpec;\n    assert(\n      primaryKey.length,\n      () => `Table ${tableName} must have a primary key`,\n    );\n    source = new TableSource(\n      this.#lc,\n      this.#logConfig,\n      this.#replica,\n      tableName,\n      Object.fromEntries(\n        Object.entries(columns).map(([name, {dataType}]) => [\n          name,\n          mapLiteDataTypeToZqlSchemaValue(dataType),\n        ]),\n      ),\n      [primaryKey[0], ...primaryKey.slice(1)],\n    );\n    this.#tables.set(tableName, source);\n\n    return source;\n  }\n\n  async #timedCanDo<A extends keyof ActionOpMap>(\n    phase: Phase,\n    action: A,\n    authData: JWTPayload | undefined,\n    op: ActionOpMap[A],\n  ) {\n    const start = performance.now();\n    try {\n      const ret = await this.#canDo(phase, action, authData, op);\n      return ret;\n    } finally {\n      this.#lc.info?.(\n        'action:',\n        action,\n        'duration:',\n        performance.now() - start,\n        'tableName:',\n        op.tableName,\n        'primaryKey:',\n        op.primaryKey,\n      );\n    }\n  }\n\n  /**\n   * Evaluation order is from static to dynamic, broad to specific.\n   * table -> column -> row -> cell.\n   *\n   * If any step fails, the entire operation is denied.\n   *\n   * That is, table rules supersede column rules, which supersede row rules,\n   *\n   * All steps must allow for the operation to be allowed.\n   */\n  async #canDo<A extends keyof ActionOpMap>(\n    phase: Phase,\n    action: A,\n    authData: JWTPayload | undefined,\n    op: ActionOpMap[A],\n  ) {\n    const rules = must(this.#loadedPermissions)?.permissions?.tables?.[\n      op.tableName\n    ];\n    const rowPolicies = rules?.row;\n    let rowQuery = newStaticQuery(this.#schema, op.tableName);\n\n    const primaryKeyValues = this.#getPrimaryKey(op.tableName, op.value);\n\n    for (const pk in primaryKeyValues) {\n      rowQuery = rowQuery.where(pk, '=', primaryKeyValues[pk]);\n    }\n\n    let applicableRowPolicy: Policy | undefined;\n    switch (action) {\n      case 'insert':\n        if (phase === 'postMutation') {\n          applicableRowPolicy = rowPolicies?.insert;\n        }\n        break;\n      case 'update':\n        if (phase === 'preMutation') {\n          applicableRowPolicy = rowPolicies?.update?.preMutation;\n        } else if (phase === 'postMutation') {\n          applicableRowPolicy = rowPolicies?.update?.postMutation;\n        }\n        break;\n      case 'delete':\n        if (phase === 'preMutation') {\n          applicableRowPolicy = rowPolicies?.delete;\n        }\n        break;\n    }\n\n    const cellPolicies = rules?.cell;\n    const applicableCellPolicies: Policy[] = [];\n    if (cellPolicies) {\n      for (const [column, policy] of Object.entries(cellPolicies)) {\n        if (action === 'update' && op.value[column] === undefined) {\n          // If the cell is not being updated, we do not need to check\n          // the cell rules.\n          continue;\n        }\n        switch (action) {\n          case 'insert':\n            if (policy.insert && phase === 'postMutation') {\n              applicableCellPolicies.push(policy.insert);\n            }\n            break;\n          case 'update':\n            if (phase === 'preMutation' && policy.update?.preMutation) {\n              applicableCellPolicies.push(policy.update.preMutation);\n            }\n            if (phase === 'postMutation' && policy.update?.postMutation) {\n              applicableCellPolicies.push(policy.update.postMutation);\n            }\n            break;\n          case 'delete':\n            if (policy.delete && phase === 'preMutation') {\n              applicableCellPolicies.push(policy.delete);\n            }\n            break;\n        }\n      }\n    }\n\n    if (\n      !(await this.#passesPolicyGroup(\n        applicableRowPolicy,\n        applicableCellPolicies,\n        authData,\n        rowQuery,\n      ))\n    ) {\n      // `op.value` is the row being written and `authData` is the decoded\n      // JWT payload, so neither can go into the log. Column names and policy\n      // counts are enough to debug a failed permission check.\n      this.#lc.warn?.('Permission check failed', {\n        action,\n        phase,\n        tableName: op.tableName,\n        columns: Object.keys(op.value),\n        rowPolicy: applicableRowPolicy !== undefined,\n        cellPolicyCount: applicableCellPolicies.length,\n      });\n      return false;\n    }\n\n    return true;\n  }\n\n  #getPreMutationRow(op: UpsertOp | UpdateOp | DeleteOp) {\n    const {value} = op;\n\n    const primaryKeyValues = this.#getPrimaryKey(op.tableName, value);\n\n    const spec = this.#tableSpecs.get(op.tableName);\n    if (!spec) {\n      throw new Error(`Table ${op.tableName} not found`);\n    }\n\n    const conditions: SQLQuery[] = [];\n    const values: PrimaryKeyValue[] = [];\n    for (const pk in primaryKeyValues) {\n      conditions.push(sql`${sql.ident(pk)}=?`);\n      values.push(v.parse(primaryKeyValues[pk], primaryKeyValueSchema));\n    }\n\n    const ret = this.#statementRunner.get(\n      compile(\n        sql`SELECT ${sql.join(\n          Object.keys(spec.zqlSpec).map(c => sql.ident(c)),\n          sql`,`,\n        )} FROM ${sql.ident(op.tableName)} WHERE ${sql.join(\n          conditions,\n          sql` AND `,\n        )}`,\n      ),\n      ...values,\n    );\n    if (ret === undefined) {\n      return ret;\n    }\n    return fromSQLiteTypes(spec.zqlSpec, ret, op.tableName);\n  }\n\n  #requirePreMutationRow(op: UpdateOp | DeleteOp) {\n    const ret = this.#getPreMutationRow(op);\n    assert(\n      ret !== undefined,\n      () => `Pre-mutation row not found for ${JSON.stringify(op.value)}`,\n    );\n    return ret;\n  }\n\n  async #passesPolicyGroup(\n    applicableRowPolicy: Policy | undefined,\n    applicableCellPolicies: Policy[],\n    authData: JWTPayload | undefined,\n    rowQuery: Query<string, Schema>,\n  ) {\n    if (!(await this.#passesPolicy(applicableRowPolicy, authData, rowQuery))) {\n      return false;\n    }\n\n    for (const policy of applicableCellPolicies) {\n      if (!(await this.#passesPolicy(policy, authData, rowQuery))) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  /**\n   * Defaults to *false* if the policy is empty. At least one rule has to pass\n   * for the policy to pass.\n   */\n  #passesPolicy(\n    policy: Policy | undefined,\n    authData: JWTPayload | undefined,\n    rowQuery: Query<string, Schema>,\n  ): MaybePromise<boolean> {\n    if (policy === undefined) {\n      return false;\n    }\n    if (policy.length === 0) {\n      return false;\n    }\n    let rowQueryAst = asQueryInternals(rowQuery).ast;\n    rowQueryAst = bindStaticParameters(\n      {\n        ...rowQueryAst,\n        where: updateWhere(rowQueryAst.where, policy),\n      },\n      {\n        authData: authData as Record<string, JSONValue>,\n        preMutationRow: undefined,\n      },\n    );\n\n    // call the compiler directly\n    // run the sql against upstream.\n    // remove the collecting into json? just need to know if a row comes back.\n\n    const input = buildPipeline(rowQueryAst, this.#builderDelegate, 'query-id');\n    try {\n      const res = input.fetch({});\n      for (const _ of res) {\n        // if any row is returned at all, the\n        // rule passes.\n        return true;\n      }\n    } finally {\n      input.destroy();\n    }\n\n    // no rows returned by any rules? The policy fails.\n    return false;\n  }\n}\n\nfunction updateWhere(where: Condition | undefined, policy: Policy) {\n  assert(where, 'A where condition must exist for RowQuery');\n\n  return simplifyCondition({\n    type: 'and',\n    conditions: [\n      where,\n      {\n        type: 'or',\n        conditions: policy.map(([action, rule]) => {\n          assert(action, 'action must be defined in policy');\n          return rule;\n        }),\n      },\n    ],\n  });\n}\n\ntype ActionOpMap = {\n  insert: InsertOp;\n  update: UpdateOp;\n  delete: DeleteOp;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AA+EA,IAAa,sBAAb,MAA4D;CAC1D;CACA;CACA;CACA;CACA,0BAAmB,IAAI,IAAyB;CAChD;CACA;CACA;CACA;CACA;CACA;CAEA,qBAA+C;CAE/C,YACE,IACA,QACA,SACA,OACA,MACA,mBACA;EACA,KAAKO,SAAS;EACd,KAAKG,UAAU;EACf,KAAKJ,MAAM,GAAG,YAAY,SAAS,qBAAqB;EACxD,KAAKE,aAAa,OAAO;EACzB,KAAKR,UAAU,UAAU,KAAKM,KAAK,OAAO;EAC1C,KAAKL,WAAW;EAChB,KAAKQ,aAAa,kBAAkB,yBAAyB,IAAI;EACjE,KAAKP,mBAAmB;GACtB,oCACE,OAAO,sCAAsC;GAC/C,YAAW,SAAQ,KAAKS,WAAW,IAAI;GACvC,qBAAqB,KAAKF,WAAW,cAAc;GACnD,sBAAqB,UAAS;GAC9B,gBAAe,UAAS;GACxB,UAAU,CAAC;GACX,sBAAqB,UAAS;EAChC;EACA,KAAKN,cAAc,gBAAgB,KAAKG,KAAK,SAAS,EACpD,2BAA2B,MAC7B,CAAC;EACD,KAAKD,mBAAmB,IAAI,gBAAgB,OAAO;EACnD,KAAK,kBAAkB;CACzB;CAEA,oBAAoB;EAClB,KAAKO,qBAAqB,2BACxB,KAAKN,KACL,KAAKD,kBACL,KAAKE,QACL,KAAKK,oBACL,KAAKF,OACP,EAAE;CACJ;CAEA,UAAU;EACR,KAAKD,WAAW,QAAQ;CAC1B;CAEA,MAAM,eACJ,UACA,KACA;EACA,KAAK,MAAM,MAAM,KACf,QAAQ,GAAG,IAAX;GACE,KAAK,UAEH;GACF,KAAK;IACH,IAAI,CAAE,MAAM,KAAKI,WAAW,eAAe,UAAU,EAAE,GACrD,OAAO;IAET;GACF,KAAK;IACH,IAAI,CAAE,MAAM,KAAKC,WAAW,eAAe,UAAU,EAAE,GACrD,OAAO;IAET;EACJ;EAEF,OAAO;CACT;CAEA,MAAM,gBACJ,UACA,KACA;EACA,KAAKT,iBAAiB,gBAAgB;EACtC,IAAI;EACJ,IAAI;GACF,KAAK,MAAM,MAAM,KAAK;IACpB,MAAM,SAAS,KAAKM,WAAW,GAAG,SAAS;IAC3C,QAAQ,GAAG,IAAX;KACE,KAAK;MACH,QAAQ,OAAO,KAAK,oBAAoB,GAAG,KAAK,CAAC,CAAC;MAClD;KAOF,KAAK;MACH,QACE,OAAO,KACL,qBAAqB,GAAG,OAAO,KAAKI,uBAAuB,EAAE,CAAC,CAChE,CACF;MACA;KAEF,KAAK;MACH,QACE,OAAO,KACL,uBAAuB,KAAKA,uBAAuB,EAAE,CAAC,CACxD,CACF;MACA;IAEJ;GACF;GAEA,KAAK,MAAM,MAAM,KACf,QAAQ,GAAG,IAAX;IACE,KAAK;KACH,IAAI,CAAE,MAAM,KAAKC,WAAW,gBAAgB,UAAU,EAAE,GACtD,OAAO;KAET;IACF,KAAK;KACH,IAAI,CAAE,MAAM,KAAKH,WAAW,gBAAgB,UAAU,EAAE,GACtD,OAAO;KAET;IACF,KAAK,UAEH;GACJ;EAEJ,SAAS,GAAG;GACV,UAAU;GACV,MAAM;EACR,UAAU;GACR,IAAI;IACF,KAAKR,iBAAiB,SAAS;GACjC,SAAS,eAAe;IACtB,IAAI,YAAY,KAAA,GAAW;KACzB,MAAM,gCAAgB,IAAI,MACxB,sEAAsE,OAAO,OAAO,EAAE,qBAAqB,OAAO,aAAa,GACjI;KACA,cAAc,QAAQ;KACtB,MAAM;IACR;IACA,MAAM;GACR;EACF;EAEA,OAAO;CACT;CAEA,aAAa,KAA4C;EACvD,OAAO,IAAI,KAAI,OAAM;GACnB,IAAI,GAAG,OAAO,UAAU;IAEtB,IADuB,KAAKY,mBAAmB,EAC3C,GACF,OAAO;KACL,IAAI;KACJ,WAAW,GAAG;KACd,YAAY,GAAG;KACf,OAAO,GAAG;IACZ;IAEF,OAAO;KACL,IAAI;KACJ,WAAW,GAAG;KACd,YAAY,GAAG;KACf,OAAO,GAAG;IACZ;GACF;GACA,OAAO;EACT,CAAC;CACH;CAEA,mBAAmB,KAAqB;EACtC,KAAK,MAAM,MAAM,KACf,IAAI,CAAC,KAAKd,YAAY,IAAI,GAAG,SAAS,GACpC,MAAM,IAAI,MAAM,UAAU,GAAG,UAAU,wBAAwB;CAGrE;CAEA,WAAW,OAAc,UAAkC,IAAc;EACvE,OAAO,KAAKe,YAAY,OAAO,UAAU,UAAU,EAAE;CACvD;CAEA,WAAW,OAAc,UAAkC,IAAc;EACvE,OAAO,KAAKA,YAAY,OAAO,UAAU,UAAU,EAAE;CACvD;CAEA,WAAW,OAAc,UAAkC,IAAc;EACvE,OAAO,KAAKA,YAAY,OAAO,UAAU,UAAU,EAAE;CACvD;;;;;;;CAQA,eACE,WACA,SACmC;EACnC,MAAM,YAAY,KAAKf,YAAY,IAAI,SAAS;EAChD,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,SAAS,UAAU,WAAW;EAEhD,MAAM,UAAU,UAAU,UAAU;EAGpC,MAAM,SAA4C,CAAC;EACnD,KAAK,MAAM,OAAO,SAAS;GACzB,MAAM,MAAM,QAAQ;GACpB,IAAI,QAAQ,KAAA,GACV,MAAM,IAAI,MACR,uBAAuB,IAAI,8CAA8C,WAC3E;GAEF,OAAO,OAAO;EAChB;EAEA,OAAO;CACT;CAEA,WAAW,WAAmB;EAC5B,IAAI,SAAS,KAAKC,QAAQ,IAAI,SAAS;EACvC,IAAI,QACF,OAAO;EAET,MAAM,YAAY,KAAKD,YAAY,IAAI,SAAS;EAChD,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,SAAS,UAAU,WAAW;EAEhD,MAAM,EAAC,SAAS,eAAc,UAAU;EACxC,OACE,WAAW,cACL,SAAS,UAAU,yBAC3B;EACA,SAAS,IAAI,YACX,KAAKG,KACL,KAAKE,YACL,KAAKP,UACL,WACA,OAAO,YACL,OAAO,QAAQ,OAAO,EAAE,KAAK,CAAC,MAAM,EAAC,gBAAe,CAClD,MACA,gCAAgC,QAAQ,CAC1C,CAAC,CACH,GACA,CAAC,WAAW,IAAI,GAAG,WAAW,MAAM,CAAC,CAAC,CACxC;EACA,KAAKG,QAAQ,IAAI,WAAW,MAAM;EAElC,OAAO;CACT;CAEA,MAAMc,YACJ,OACA,QACA,UACA,IACA;EACA,MAAM,QAAQ,YAAY,IAAI;EAC9B,IAAI;GAEF,OAAO,MADW,KAAKC,OAAO,OAAO,QAAQ,UAAU,EAAE;EAE3D,UAAU;GACR,KAAKb,IAAI,OACP,WACA,QACA,aACA,YAAY,IAAI,IAAI,OACpB,cACA,GAAG,WACH,eACA,GAAG,UACL;EACF;CACF;;;;;;;;;;;CAYA,MAAMa,OACJ,OACA,QACA,UACA,IACA;EACA,MAAM,QAAQ,KAAK,KAAKP,kBAAkB,GAAG,aAAa,SACxD,GAAG;EAEL,MAAM,cAAc,OAAO;EAC3B,IAAI,WAAW,eAAe,KAAKZ,SAAS,GAAG,SAAS;EAExD,MAAM,mBAAmB,KAAKoB,eAAe,GAAG,WAAW,GAAG,KAAK;EAEnE,KAAK,MAAM,MAAM,kBACf,WAAW,SAAS,MAAM,IAAI,KAAK,iBAAiB,GAAG;EAGzD,IAAI;EACJ,QAAQ,QAAR;GACE,KAAK;IACH,IAAI,UAAU,gBACZ,sBAAsB,aAAa;IAErC;GACF,KAAK;IACH,IAAI,UAAU,eACZ,sBAAsB,aAAa,QAAQ;SACtC,IAAI,UAAU,gBACnB,sBAAsB,aAAa,QAAQ;IAE7C;GACF,KAAK;IACH,IAAI,UAAU,eACZ,sBAAsB,aAAa;IAErC;EACJ;EAEA,MAAM,eAAe,OAAO;EAC5B,MAAM,yBAAmC,CAAC;EAC1C,IAAI,cACF,KAAK,MAAM,CAAC,QAAQ,WAAW,OAAO,QAAQ,YAAY,GAAG;GAC3D,IAAI,WAAW,YAAY,GAAG,MAAM,YAAY,KAAA,GAG9C;GAEF,QAAQ,QAAR;IACE,KAAK;KACH,IAAI,OAAO,UAAU,UAAU,gBAC7B,uBAAuB,KAAK,OAAO,MAAM;KAE3C;IACF,KAAK;KACH,IAAI,UAAU,iBAAiB,OAAO,QAAQ,aAC5C,uBAAuB,KAAK,OAAO,OAAO,WAAW;KAEvD,IAAI,UAAU,kBAAkB,OAAO,QAAQ,cAC7C,uBAAuB,KAAK,OAAO,OAAO,YAAY;KAExD;IACF,KAAK;KACH,IAAI,OAAO,UAAU,UAAU,eAC7B,uBAAuB,KAAK,OAAO,MAAM;KAE3C;GACJ;EACF;EAGF,IACE,CAAE,MAAM,KAAKC,mBACX,qBACA,wBACA,UACA,QACF,GACA;GAIA,KAAKf,IAAI,OAAO,2BAA2B;IACzC;IACA;IACA,WAAW,GAAG;IACd,SAAS,OAAO,KAAK,GAAG,KAAK;IAC7B,WAAW,wBAAwB,KAAA;IACnC,iBAAiB,uBAAuB;GAC1C,CAAC;GACD,OAAO;EACT;EAEA,OAAO;CACT;CAEA,mBAAmB,IAAoC;EACrD,MAAM,EAAC,UAAS;EAEhB,MAAM,mBAAmB,KAAKc,eAAe,GAAG,WAAW,KAAK;EAEhE,MAAM,OAAO,KAAKjB,YAAY,IAAI,GAAG,SAAS;EAC9C,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,SAAS,GAAG,UAAU,WAAW;EAGnD,MAAM,aAAyB,CAAC;EAChC,MAAM,SAA4B,CAAC;EACnC,KAAK,MAAM,MAAM,kBAAkB;GACjC,WAAW,KAAK,GAAG,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG;GACvC,OAAO,KAAK,MAAQ,iBAAiB,KAAK,qBAAqB,CAAC;EAClE;EAEA,MAAM,MAAM,KAAKE,iBAAiB,IAChC,QACE,GAAG,UAAU,IAAI,KACf,OAAO,KAAK,KAAK,OAAO,EAAE,KAAI,MAAK,IAAI,MAAM,CAAC,CAAC,GAC/C,GAAG,GACL,EAAE,QAAQ,IAAI,MAAM,GAAG,SAAS,EAAE,SAAS,IAAI,KAC7C,YACA,GAAG,OACL,GACF,GACA,GAAG,MACL;EACA,IAAI,QAAQ,KAAA,GACV,OAAO;EAET,OAAO,gBAAgB,KAAK,SAAS,KAAK,GAAG,SAAS;CACxD;CAEA,uBAAuB,IAAyB;EAC9C,MAAM,MAAM,KAAKY,mBAAmB,EAAE;EACtC,OACE,QAAQ,KAAA,SACF,kCAAkC,KAAK,UAAU,GAAG,KAAK,GACjE;EACA,OAAO;CACT;CAEA,MAAMI,mBACJ,qBACA,wBACA,UACA,UACA;EACA,IAAI,CAAE,MAAM,KAAKC,cAAc,qBAAqB,UAAU,QAAQ,GACpE,OAAO;EAGT,KAAK,MAAM,UAAU,wBACnB,IAAI,CAAE,MAAM,KAAKA,cAAc,QAAQ,UAAU,QAAQ,GACvD,OAAO;EAIX,OAAO;CACT;;;;;CAMA,cACE,QACA,UACA,UACuB;EACvB,IAAI,WAAW,KAAA,GACb,OAAO;EAET,IAAI,OAAO,WAAW,GACpB,OAAO;EAET,IAAI,cAAc,iBAAiB,QAAQ,EAAE;EAC7C,cAAc,qBACZ;GACE,GAAG;GACH,OAAO,YAAY,YAAY,OAAO,MAAM;EAC9C,GACA;GACY;GACV,gBAAgB,KAAA;EAClB,CACF;EAMA,MAAM,QAAQ,cAAc,aAAa,KAAKpB,kBAAkB,UAAU;EAC1E,IAAI;GACF,MAAM,MAAM,MAAM,MAAM,CAAC,CAAC;GAC1B,KAAK,MAAM,KAAK,KAGd,OAAO;EAEX,UAAU;GACR,MAAM,QAAQ;EAChB;EAGA,OAAO;CACT;AACF;AAEA,SAAS,YAAY,OAA8B,QAAgB;CACjE,OAAO,OAAO,2CAA2C;CAEzD,OAAO,kBAAkB;EACvB,MAAM;EACN,YAAY,CACV,OACA;GACE,MAAM;GACN,YAAY,OAAO,KAAK,CAAC,QAAQ,UAAU;IACzC,OAAO,QAAQ,kCAAkC;IACjD,OAAO;GACT,CAAC;EACH,CACF;CACF,CAAC;AACH"}
+{"version":3,"file":"write-authorizer.js","names":["v.parse"],"sources":["../../../../../zero-cache/src/auth/write-authorizer.ts"],"sourcesContent":["import type {SQLQuery} from '@databases/sql';\nimport type {MaybePromise} from '@opentelemetry/resources';\nimport type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport {assert} from '../../../shared/src/asserts.ts';\nimport type {JSONValue, ReadonlyJSONValue} from '../../../shared/src/json.ts';\nimport {must} from '../../../shared/src/must.ts';\nimport * as v from '../../../shared/src/valita.ts';\nimport type {Condition} from '../../../zero-protocol/src/ast.ts';\nimport type {\n  CRUDOp,\n  DeleteOp,\n  InsertOp,\n  UpdateOp,\n  UpsertOp,\n} from '../../../zero-protocol/src/mutation.ts';\nimport {\n  primaryKeyValueSchema,\n  type PrimaryKeyValue,\n} from '../../../zero-protocol/src/primary-key.ts';\nimport type {Policy} from '../../../zero-schema/src/compiled-permissions.ts';\nimport type {Schema} from '../../../zero-types/src/schema.ts';\nimport type {BuilderDelegate} from '../../../zql/src/builder/builder.ts';\nimport {\n  bindStaticParameters,\n  buildPipeline,\n} from '../../../zql/src/builder/builder.ts';\nimport {\n  makeSourceChangeAdd,\n  makeSourceChangeEdit,\n  makeSourceChangeRemove,\n} from '../../../zql/src/ivm/source.ts';\nimport {consume} from '../../../zql/src/ivm/stream.ts';\nimport {simplifyCondition} from '../../../zql/src/query/expression.ts';\nimport {asQueryInternals} from '../../../zql/src/query/query-internals.ts';\nimport type {Query} from '../../../zql/src/query/query.ts';\nimport {newStaticQuery} from '../../../zql/src/query/static-query.ts';\nimport type {\n  ClientGroupStorage,\n  DatabaseStorage,\n} from '../../../zqlite/src/database-storage.ts';\nimport type {Database} from '../../../zqlite/src/db.ts';\nimport {compile, sql} from '../../../zqlite/src/internal/sql.ts';\nimport {\n  fromSQLiteTypes,\n  TableSource,\n} from '../../../zqlite/src/table-source.ts';\nimport type {LogConfig, ZeroConfig} from '../config/zero-config.ts';\nimport {computeZqlSpecs} from '../db/lite-tables.ts';\nimport type {LiteAndZqlSpec} from '../db/specs.ts';\nimport {StatementRunner} from '../db/statements.ts';\nimport {mapLiteDataTypeToZqlSchemaValue} from '../types/lite.ts';\nimport {\n  getSchema,\n  reloadPermissionsIfChanged,\n  type LoadedPermissions,\n} from './load-permissions.ts';\n\ntype Phase = 'preMutation' | 'postMutation';\n\nexport interface WriteAuthorizer {\n  canPreMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ): Promise<boolean>;\n  canPostMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ): Promise<boolean>;\n  reloadPermissions(): void;\n  normalizeOps(ops: CRUDOp[]): Exclude<CRUDOp, UpsertOp>[];\n\n  /**\n   * Validates that all table names in the operations exist in the schema.\n   * @throws Error if any table name is invalid\n   */\n  validateTableNames(ops: CRUDOp[]): void;\n}\n\nexport class WriteAuthorizerImpl implements WriteAuthorizer {\n  readonly #schema: Schema;\n  readonly #replica: Database;\n  readonly #builderDelegate: BuilderDelegate;\n  readonly #tableSpecs: Map<string, LiteAndZqlSpec>;\n  readonly #tables = new Map<string, TableSource>();\n  readonly #statementRunner: StatementRunner;\n  readonly #lc: LogContext;\n  readonly #appID: string;\n  readonly #logConfig: LogConfig;\n  readonly #cgStorage: ClientGroupStorage;\n  readonly #config: ZeroConfig;\n\n  #loadedPermissions: LoadedPermissions | null = null;\n\n  constructor(\n    lc: LogContext,\n    config: ZeroConfig,\n    replica: Database,\n    appID: string,\n    cgID: string,\n    writeAuthzStorage: DatabaseStorage,\n  ) {\n    this.#appID = appID;\n    this.#config = config;\n    this.#lc = lc.withContext('class', 'WriteAuthorizerImpl');\n    this.#logConfig = config.log;\n    this.#schema = getSchema(this.#lc, replica);\n    this.#replica = replica;\n    this.#cgStorage = writeAuthzStorage.createClientGroupStorage(cgID);\n    this.#builderDelegate = {\n      disableCorrelatedPredicatePushdown:\n        config.enableCorrelatedPredicatePushdown === false,\n      getSource: name => this.#getSource(name),\n      createStorage: () => this.#cgStorage.createStorage(),\n      decorateSourceInput: input => input,\n      decorateInput: input => input,\n      addEdge() {},\n      decorateFilterInput: input => input,\n    };\n    this.#tableSpecs = computeZqlSpecs(this.#lc, replica, {\n      includeBackfillingColumns: false,\n    });\n    this.#statementRunner = new StatementRunner(replica);\n    this.reloadPermissions();\n  }\n\n  reloadPermissions() {\n    this.#loadedPermissions = reloadPermissionsIfChanged(\n      this.#lc,\n      this.#statementRunner,\n      this.#appID,\n      this.#loadedPermissions,\n      this.#config,\n    ).permissions;\n  }\n\n  destroy() {\n    this.#cgStorage.destroy();\n  }\n\n  async canPreMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ) {\n    for (const op of ops) {\n      switch (op.op) {\n        case 'insert':\n          // insert does not run pre-mutation checks\n          break;\n        case 'update':\n          if (!(await this.#canUpdate('preMutation', authData, op))) {\n            return false;\n          }\n          break;\n        case 'delete':\n          if (!(await this.#canDelete('preMutation', authData, op))) {\n            return false;\n          }\n          break;\n      }\n    }\n    return true;\n  }\n\n  async canPostMutation(\n    authData: JWTPayload | undefined,\n    ops: Exclude<CRUDOp, UpsertOp>[],\n  ) {\n    this.#statementRunner.beginConcurrent();\n    let opError: unknown;\n    try {\n      for (const op of ops) {\n        const source = this.#getSource(op.tableName);\n        switch (op.op) {\n          case 'insert': {\n            consume(source.push(makeSourceChangeAdd(op.value)));\n            break;\n          }\n          // TODO(mlaw): what if someone updates the same thing twice?\n          // TODO(aa): It seems like it will just work? source.push()\n          // is going to push the row into the table source, and then the\n          // next requirePreMutationRow will just return the row that was\n          // pushed in.\n          case 'update': {\n            consume(\n              source.push(\n                makeSourceChangeEdit(op.value, this.#requirePreMutationRow(op)),\n              ),\n            );\n            break;\n          }\n          case 'delete': {\n            consume(\n              source.push(\n                makeSourceChangeRemove(this.#requirePreMutationRow(op)),\n              ),\n            );\n            break;\n          }\n        }\n      }\n\n      for (const op of ops) {\n        switch (op.op) {\n          case 'insert':\n            if (!(await this.#canInsert('postMutation', authData, op))) {\n              return false;\n            }\n            break;\n          case 'update':\n            if (!(await this.#canUpdate('postMutation', authData, op))) {\n              return false;\n            }\n            break;\n          case 'delete':\n            // delete does not run post-mutation checks.\n            break;\n        }\n      }\n    } catch (e) {\n      opError = e;\n      throw e;\n    } finally {\n      try {\n        this.#statementRunner.rollback();\n      } catch (rollbackError) {\n        if (opError !== undefined) {\n          const combinedError = new Error(\n            `canPostMutation failed and rollback also failed: operation error = ${String(opError)}; rollback error = ${String(rollbackError)}`,\n          );\n          combinedError.cause = opError;\n          throw combinedError;\n        }\n        throw rollbackError;\n      }\n    }\n\n    return true;\n  }\n\n  normalizeOps(ops: CRUDOp[]): Exclude<CRUDOp, UpsertOp>[] {\n    return ops.map(op => {\n      if (op.op === 'upsert') {\n        const preMutationRow = this.#getPreMutationRow(op);\n        if (preMutationRow) {\n          return {\n            op: 'update',\n            tableName: op.tableName,\n            primaryKey: op.primaryKey,\n            value: op.value,\n          };\n        }\n        return {\n          op: 'insert',\n          tableName: op.tableName,\n          primaryKey: op.primaryKey,\n          value: op.value,\n        };\n      }\n      return op;\n    });\n  }\n\n  validateTableNames(ops: CRUDOp[]): void {\n    for (const op of ops) {\n      if (!this.#tableSpecs.has(op.tableName)) {\n        throw new Error(`Table '${op.tableName}' is not a valid table.`);\n      }\n    }\n  }\n\n  #canInsert(phase: Phase, authData: JWTPayload | undefined, op: InsertOp) {\n    return this.#timedCanDo(phase, 'insert', authData, op);\n  }\n\n  #canUpdate(phase: Phase, authData: JWTPayload | undefined, op: UpdateOp) {\n    return this.#timedCanDo(phase, 'update', authData, op);\n  }\n\n  #canDelete(phase: Phase, authData: JWTPayload | undefined, op: DeleteOp) {\n    return this.#timedCanDo(phase, 'delete', authData, op);\n  }\n\n  /**\n   * Gets schema-defined primary key and validates that operation contains required PK values.\n   *\n   * @returns Record where keys are column names and values are client-provided values\n   * @throws Error if operation value is missing required primary key columns\n   */\n  #getPrimaryKey(\n    tableName: string,\n    opValue: Record<string, ReadonlyJSONValue | undefined>,\n  ): Record<string, ReadonlyJSONValue> {\n    const tableSpec = this.#tableSpecs.get(tableName);\n    if (!tableSpec) {\n      throw new Error(`Table ${tableName} not found`);\n    }\n    const columns = tableSpec.tableSpec.primaryKey;\n\n    // Extract primary key values from operation value and validate they exist\n    const values: Record<string, ReadonlyJSONValue> = {};\n    for (const col of columns) {\n      const val = opValue[col];\n      if (val === undefined) {\n        throw new Error(\n          `Primary key column '${col}' is missing from operation value for table ${tableName}`,\n        );\n      }\n      values[col] = val;\n    }\n\n    return values;\n  }\n\n  #getSource(tableName: string) {\n    let source = this.#tables.get(tableName);\n    if (source) {\n      return source;\n    }\n    const tableSpec = this.#tableSpecs.get(tableName);\n    if (!tableSpec) {\n      throw new Error(`Table ${tableName} not found`);\n    }\n    const {columns, primaryKey} = tableSpec.tableSpec;\n    assert(\n      primaryKey.length,\n      () => `Table ${tableName} must have a primary key`,\n    );\n    source = new TableSource(\n      this.#lc,\n      this.#logConfig,\n      this.#replica,\n      tableName,\n      Object.fromEntries(\n        Object.entries(columns).map(([name, {dataType}]) => [\n          name,\n          mapLiteDataTypeToZqlSchemaValue(dataType),\n        ]),\n      ),\n      [primaryKey[0], ...primaryKey.slice(1)],\n    );\n    this.#tables.set(tableName, source);\n\n    return source;\n  }\n\n  async #timedCanDo<A extends keyof ActionOpMap>(\n    phase: Phase,\n    action: A,\n    authData: JWTPayload | undefined,\n    op: ActionOpMap[A],\n  ) {\n    const start = performance.now();\n    try {\n      const ret = await this.#canDo(phase, action, authData, op);\n      return ret;\n    } finally {\n      this.#lc.info?.(\n        'action:',\n        action,\n        'duration:',\n        performance.now() - start,\n        'tableName:',\n        op.tableName,\n        'primaryKey:',\n        op.primaryKey,\n      );\n    }\n  }\n\n  /**\n   * Evaluation order is from static to dynamic, broad to specific.\n   * table -> column -> row -> cell.\n   *\n   * If any step fails, the entire operation is denied.\n   *\n   * That is, table rules supersede column rules, which supersede row rules,\n   *\n   * All steps must allow for the operation to be allowed.\n   */\n  async #canDo<A extends keyof ActionOpMap>(\n    phase: Phase,\n    action: A,\n    authData: JWTPayload | undefined,\n    op: ActionOpMap[A],\n  ) {\n    const rules = must(this.#loadedPermissions)?.permissions?.tables?.[\n      op.tableName\n    ];\n    const rowPolicies = rules?.row;\n    let rowQuery = newStaticQuery(this.#schema, op.tableName);\n\n    const primaryKeyValues = this.#getPrimaryKey(op.tableName, op.value);\n\n    for (const pk in primaryKeyValues) {\n      rowQuery = rowQuery.where(pk, '=', primaryKeyValues[pk]);\n    }\n\n    let applicableRowPolicy: Policy | undefined;\n    switch (action) {\n      case 'insert':\n        if (phase === 'postMutation') {\n          applicableRowPolicy = rowPolicies?.insert;\n        }\n        break;\n      case 'update':\n        if (phase === 'preMutation') {\n          applicableRowPolicy = rowPolicies?.update?.preMutation;\n        } else if (phase === 'postMutation') {\n          applicableRowPolicy = rowPolicies?.update?.postMutation;\n        }\n        break;\n      case 'delete':\n        if (phase === 'preMutation') {\n          applicableRowPolicy = rowPolicies?.delete;\n        }\n        break;\n    }\n\n    const cellPolicies = rules?.cell;\n    const applicableCellPolicies: Policy[] = [];\n    if (cellPolicies) {\n      for (const [column, policy] of Object.entries(cellPolicies)) {\n        if (action === 'update' && op.value[column] === undefined) {\n          // If the cell is not being updated, we do not need to check\n          // the cell rules.\n          continue;\n        }\n        switch (action) {\n          case 'insert':\n            if (policy.insert && phase === 'postMutation') {\n              applicableCellPolicies.push(policy.insert);\n            }\n            break;\n          case 'update':\n            if (phase === 'preMutation' && policy.update?.preMutation) {\n              applicableCellPolicies.push(policy.update.preMutation);\n            }\n            if (phase === 'postMutation' && policy.update?.postMutation) {\n              applicableCellPolicies.push(policy.update.postMutation);\n            }\n            break;\n          case 'delete':\n            if (policy.delete && phase === 'preMutation') {\n              applicableCellPolicies.push(policy.delete);\n            }\n            break;\n        }\n      }\n    }\n\n    if (\n      !(await this.#passesPolicyGroup(\n        applicableRowPolicy,\n        applicableCellPolicies,\n        authData,\n        rowQuery,\n      ))\n    ) {\n      // `op.value` is the row being written and `authData` is the decoded\n      // JWT payload, so neither can go into the log. Column names and policy\n      // counts are enough to debug a failed permission check.\n      this.#lc.warn?.('Permission check failed', {\n        action,\n        phase,\n        tableName: op.tableName,\n        columns: Object.keys(op.value),\n        rowPolicy: applicableRowPolicy !== undefined,\n        cellPolicyCount: applicableCellPolicies.length,\n      });\n      return false;\n    }\n\n    return true;\n  }\n\n  #getPreMutationRow(op: UpsertOp | UpdateOp | DeleteOp) {\n    const {value} = op;\n\n    const primaryKeyValues = this.#getPrimaryKey(op.tableName, value);\n\n    const spec = this.#tableSpecs.get(op.tableName);\n    if (!spec) {\n      throw new Error(`Table ${op.tableName} not found`);\n    }\n\n    const conditions: SQLQuery[] = [];\n    const values: PrimaryKeyValue[] = [];\n    for (const pk in primaryKeyValues) {\n      conditions.push(sql`${sql.ident(pk)}=?`);\n      values.push(v.parse(primaryKeyValues[pk], primaryKeyValueSchema));\n    }\n\n    const ret = this.#statementRunner.get(\n      compile(\n        sql`SELECT ${sql.join(\n          Object.keys(spec.zqlSpec).map(c => sql.ident(c)),\n          sql`,`,\n        )} FROM ${sql.ident(op.tableName)} WHERE ${sql.join(\n          conditions,\n          sql` AND `,\n        )}`,\n      ),\n      ...values,\n    );\n    if (ret === undefined) {\n      return ret;\n    }\n    return fromSQLiteTypes(spec.zqlSpec, ret, op.tableName);\n  }\n\n  #requirePreMutationRow(op: UpdateOp | DeleteOp) {\n    const ret = this.#getPreMutationRow(op);\n    assert(\n      ret !== undefined,\n      () => `Pre-mutation row not found for ${JSON.stringify(op.value)}`,\n    );\n    return ret;\n  }\n\n  async #passesPolicyGroup(\n    applicableRowPolicy: Policy | undefined,\n    applicableCellPolicies: Policy[],\n    authData: JWTPayload | undefined,\n    rowQuery: Query<string, Schema>,\n  ) {\n    if (!(await this.#passesPolicy(applicableRowPolicy, authData, rowQuery))) {\n      return false;\n    }\n\n    for (const policy of applicableCellPolicies) {\n      if (!(await this.#passesPolicy(policy, authData, rowQuery))) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  /**\n   * Defaults to *false* if the policy is empty. At least one rule has to pass\n   * for the policy to pass.\n   */\n  #passesPolicy(\n    policy: Policy | undefined,\n    authData: JWTPayload | undefined,\n    rowQuery: Query<string, Schema>,\n  ): MaybePromise<boolean> {\n    if (policy === undefined) {\n      return false;\n    }\n    if (policy.length === 0) {\n      return false;\n    }\n    let rowQueryAst = asQueryInternals(rowQuery).ast;\n    rowQueryAst = bindStaticParameters(\n      {\n        ...rowQueryAst,\n        where: updateWhere(rowQueryAst.where, policy),\n      },\n      {\n        authData: authData as Record<string, JSONValue>,\n        preMutationRow: undefined,\n      },\n    );\n\n    // call the compiler directly\n    // run the sql against upstream.\n    // remove the collecting into json? just need to know if a row comes back.\n\n    const input = buildPipeline(rowQueryAst, this.#builderDelegate, 'query-id');\n    try {\n      const res = input.fetch({});\n      for (const _ of res) {\n        // if any row is returned at all, the\n        // rule passes.\n        return true;\n      }\n    } finally {\n      input.destroy();\n    }\n\n    // no rows returned by any rules? The policy fails.\n    return false;\n  }\n}\n\nfunction updateWhere(where: Condition | undefined, policy: Policy) {\n  assert(where, 'A where condition must exist for RowQuery');\n\n  return simplifyCondition({\n    type: 'and',\n    conditions: [\n      where,\n      {\n        type: 'or',\n        conditions: policy.map(([action, rule]) => {\n          assert(action, 'action must be defined in policy');\n          return rule;\n        }),\n      },\n    ],\n  });\n}\n\ntype ActionOpMap = {\n  insert: InsertOp;\n  update: UpdateOp;\n  delete: DeleteOp;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AA+EA,IAAa,sBAAb,MAA4D;CAC1D;CACA;CACA;CACA;CACA,0BAAmB,IAAI,IAAyB;CAChD;CACA;CACA;CACA;CACA;CACA;CAEA,qBAA+C;CAE/C,YACE,IACA,QACA,SACA,OACA,MACA,mBACA;EACA,KAAK,SAAS;EACd,KAAK,UAAU;EACf,KAAK,MAAM,GAAG,YAAY,SAAS,qBAAqB;EACxD,KAAK,aAAa,OAAO;EACzB,KAAK,UAAU,UAAU,KAAK,KAAK,OAAO;EAC1C,KAAK,WAAW;EAChB,KAAK,aAAa,kBAAkB,yBAAyB,IAAI;EACjE,KAAK,mBAAmB;GACtB,oCACE,OAAO,sCAAsC;GAC/C,YAAW,SAAQ,KAAK,WAAW,IAAI;GACvC,qBAAqB,KAAK,WAAW,cAAc;GACnD,sBAAqB,UAAS;GAC9B,gBAAe,UAAS;GACxB,UAAU,CAAC;GACX,sBAAqB,UAAS;EAChC;EACA,KAAK,cAAc,gBAAgB,KAAK,KAAK,SAAS,EACpD,2BAA2B,MAC7B,CAAC;EACD,KAAK,mBAAmB,IAAI,gBAAgB,OAAO;EACnD,KAAK,kBAAkB;CACzB;CAEA,oBAAoB;EAClB,KAAK,qBAAqB,2BACxB,KAAK,KACL,KAAK,kBACL,KAAK,QACL,KAAK,oBACL,KAAK,OACP,CAAC,CAAC;CACJ;CAEA,UAAU;EACR,KAAK,WAAW,QAAQ;CAC1B;CAEA,MAAM,eACJ,UACA,KACA;EACA,KAAK,MAAM,MAAM,KACf,QAAQ,GAAG,IAAX;GACE,KAAK,UAEH;GACF,KAAK;IACH,IAAI,CAAE,MAAM,KAAK,WAAW,eAAe,UAAU,EAAE,GACrD,OAAO;IAET;GACF,KAAK,UACH,IAAI,CAAE,MAAM,KAAK,WAAW,eAAe,UAAU,EAAE,GACrD,OAAO;EAGb;EAEF,OAAO;CACT;CAEA,MAAM,gBACJ,UACA,KACA;EACA,KAAK,iBAAiB,gBAAgB;EACtC,IAAI;EACJ,IAAI;GACF,KAAK,MAAM,MAAM,KAAK;IACpB,MAAM,SAAS,KAAK,WAAW,GAAG,SAAS;IAC3C,QAAQ,GAAG,IAAX;KACE,KAAK;MACH,QAAQ,OAAO,KAAK,oBAAoB,GAAG,KAAK,CAAC,CAAC;MAClD;KAOF,KAAK;MACH,QACE,OAAO,KACL,qBAAqB,GAAG,OAAO,KAAK,uBAAuB,EAAE,CAAC,CAChE,CACF;MACA;KAEF,KAAK,UACH,QACE,OAAO,KACL,uBAAuB,KAAK,uBAAuB,EAAE,CAAC,CACxD,CACF;IAGJ;GACF;GAEA,KAAK,MAAM,MAAM,KACf,QAAQ,GAAG,IAAX;IACE,KAAK;KACH,IAAI,CAAE,MAAM,KAAK,WAAW,gBAAgB,UAAU,EAAE,GACtD,OAAO;KAET;IACF,KAAK,UACH,IAAI,CAAE,MAAM,KAAK,WAAW,gBAAgB,UAAU,EAAE,GACtD,OAAO;GAMb;EAEJ,SAAS,GAAG;GACV,UAAU;GACV,MAAM;EACR,UAAU;GACR,IAAI;IACF,KAAK,iBAAiB,SAAS;GACjC,SAAS,eAAe;IACtB,IAAI,YAAY,KAAA,GAAW;KACzB,MAAM,gCAAgB,IAAI,MACxB,sEAAsE,OAAO,OAAO,EAAE,qBAAqB,OAAO,aAAa,GACjI;KACA,cAAc,QAAQ;KACtB,MAAM;IACR;IACA,MAAM;GACR;EACF;EAEA,OAAO;CACT;CAEA,aAAa,KAA4C;EACvD,OAAO,IAAI,KAAI,OAAM;GACnB,IAAI,GAAG,OAAO,UAAU;IAEtB,IADuB,KAAK,mBAAmB,EAC3C,GACF,OAAO;KACL,IAAI;KACJ,WAAW,GAAG;KACd,YAAY,GAAG;KACf,OAAO,GAAG;IACZ;IAEF,OAAO;KACL,IAAI;KACJ,WAAW,GAAG;KACd,YAAY,GAAG;KACf,OAAO,GAAG;IACZ;GACF;GACA,OAAO;EACT,CAAC;CACH;CAEA,mBAAmB,KAAqB;EACtC,KAAK,MAAM,MAAM,KACf,IAAI,CAAC,KAAK,YAAY,IAAI,GAAG,SAAS,GACpC,MAAM,IAAI,MAAM,UAAU,GAAG,UAAU,wBAAwB;CAGrE;CAEA,WAAW,OAAc,UAAkC,IAAc;EACvE,OAAO,KAAK,YAAY,OAAO,UAAU,UAAU,EAAE;CACvD;CAEA,WAAW,OAAc,UAAkC,IAAc;EACvE,OAAO,KAAK,YAAY,OAAO,UAAU,UAAU,EAAE;CACvD;CAEA,WAAW,OAAc,UAAkC,IAAc;EACvE,OAAO,KAAK,YAAY,OAAO,UAAU,UAAU,EAAE;CACvD;;;;;;;CAQA,eACE,WACA,SACmC;EACnC,MAAM,YAAY,KAAK,YAAY,IAAI,SAAS;EAChD,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,SAAS,UAAU,WAAW;EAEhD,MAAM,UAAU,UAAU,UAAU;EAGpC,MAAM,SAA4C,CAAC;EACnD,KAAK,MAAM,OAAO,SAAS;GACzB,MAAM,MAAM,QAAQ;GACpB,IAAI,QAAQ,KAAA,GACV,MAAM,IAAI,MACR,uBAAuB,IAAI,8CAA8C,WAC3E;GAEF,OAAO,OAAO;EAChB;EAEA,OAAO;CACT;CAEA,WAAW,WAAmB;EAC5B,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS;EACvC,IAAI,QACF,OAAO;EAET,MAAM,YAAY,KAAK,YAAY,IAAI,SAAS;EAChD,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,SAAS,UAAU,WAAW;EAEhD,MAAM,EAAC,SAAS,eAAc,UAAU;EACxC,OACE,WAAW,cACL,SAAS,UAAU,yBAC3B;EACA,SAAS,IAAI,YACX,KAAK,KACL,KAAK,YACL,KAAK,UACL,WACA,OAAO,YACL,OAAO,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,EAAC,gBAAe,CAClD,MACA,gCAAgC,QAAQ,CAC1C,CAAC,CACH,GACA,CAAC,WAAW,IAAI,GAAG,WAAW,MAAM,CAAC,CAAC,CACxC;EACA,KAAK,QAAQ,IAAI,WAAW,MAAM;EAElC,OAAO;CACT;CAEA,MAAM,YACJ,OACA,QACA,UACA,IACA;EACA,MAAM,QAAQ,YAAY,IAAI;EAC9B,IAAI;GAEF,OAAO,MADW,KAAK,OAAO,OAAO,QAAQ,UAAU,EAAE;EAE3D,UAAU;GACR,KAAK,IAAI,OACP,WACA,QACA,aACA,YAAY,IAAI,IAAI,OACpB,cACA,GAAG,WACH,eACA,GAAG,UACL;EACF;CACF;;;;;;;;;;;CAYA,MAAM,OACJ,OACA,QACA,UACA,IACA;EACA,MAAM,QAAQ,KAAK,KAAK,kBAAkB,CAAC,EAAE,aAAa,SACxD,GAAG;EAEL,MAAM,cAAc,OAAO;EAC3B,IAAI,WAAW,eAAe,KAAK,SAAS,GAAG,SAAS;EAExD,MAAM,mBAAmB,KAAK,eAAe,GAAG,WAAW,GAAG,KAAK;EAEnE,KAAK,MAAM,MAAM,kBACf,WAAW,SAAS,MAAM,IAAI,KAAK,iBAAiB,GAAG;EAGzD,IAAI;EACJ,QAAQ,QAAR;GACE,KAAK;IACH,IAAI,UAAU,gBACZ,sBAAsB,aAAa;IAErC;GACF,KAAK;IACH,IAAI,UAAU,eACZ,sBAAsB,aAAa,QAAQ;SACtC,IAAI,UAAU,gBACnB,sBAAsB,aAAa,QAAQ;IAE7C;GACF,KAAK,UACH,IAAI,UAAU,eACZ,sBAAsB,aAAa;EAGzC;EAEA,MAAM,eAAe,OAAO;EAC5B,MAAM,yBAAmC,CAAC;EAC1C,IAAI,cACF,KAAK,MAAM,CAAC,QAAQ,WAAW,OAAO,QAAQ,YAAY,GAAG;GAC3D,IAAI,WAAW,YAAY,GAAG,MAAM,YAAY,KAAA,GAG9C;GAEF,QAAQ,QAAR;IACE,KAAK;KACH,IAAI,OAAO,UAAU,UAAU,gBAC7B,uBAAuB,KAAK,OAAO,MAAM;KAE3C;IACF,KAAK;KACH,IAAI,UAAU,iBAAiB,OAAO,QAAQ,aAC5C,uBAAuB,KAAK,OAAO,OAAO,WAAW;KAEvD,IAAI,UAAU,kBAAkB,OAAO,QAAQ,cAC7C,uBAAuB,KAAK,OAAO,OAAO,YAAY;KAExD;IACF,KAAK,UACH,IAAI,OAAO,UAAU,UAAU,eAC7B,uBAAuB,KAAK,OAAO,MAAM;GAG/C;EACF;EAGF,IACE,CAAE,MAAM,KAAK,mBACX,qBACA,wBACA,UACA,QACF,GACA;GAIA,KAAK,IAAI,OAAO,2BAA2B;IACzC;IACA;IACA,WAAW,GAAG;IACd,SAAS,OAAO,KAAK,GAAG,KAAK;IAC7B,WAAW,wBAAwB,KAAA;IACnC,iBAAiB,uBAAuB;GAC1C,CAAC;GACD,OAAO;EACT;EAEA,OAAO;CACT;CAEA,mBAAmB,IAAoC;EACrD,MAAM,EAAC,UAAS;EAEhB,MAAM,mBAAmB,KAAK,eAAe,GAAG,WAAW,KAAK;EAEhE,MAAM,OAAO,KAAK,YAAY,IAAI,GAAG,SAAS;EAC9C,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,SAAS,GAAG,UAAU,WAAW;EAGnD,MAAM,aAAyB,CAAC;EAChC,MAAM,SAA4B,CAAC;EACnC,KAAK,MAAM,MAAM,kBAAkB;GACjC,WAAW,KAAK,GAAG,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG;GACvC,OAAO,KAAKA,MAAQ,iBAAiB,KAAK,qBAAqB,CAAC;EAClE;EAEA,MAAM,MAAM,KAAK,iBAAiB,IAChC,QACE,GAAG,UAAU,IAAI,KACf,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,KAAI,MAAK,IAAI,MAAM,CAAC,CAAC,GAC/C,GAAG,GACL,EAAE,QAAQ,IAAI,MAAM,GAAG,SAAS,EAAE,SAAS,IAAI,KAC7C,YACA,GAAG,OACL,GACF,GACA,GAAG,MACL;EACA,IAAI,QAAQ,KAAA,GACV,OAAO;EAET,OAAO,gBAAgB,KAAK,SAAS,KAAK,GAAG,SAAS;CACxD;CAEA,uBAAuB,IAAyB;EAC9C,MAAM,MAAM,KAAK,mBAAmB,EAAE;EACtC,OACE,QAAQ,KAAA,SACF,kCAAkC,KAAK,UAAU,GAAG,KAAK,GACjE;EACA,OAAO;CACT;CAEA,MAAM,mBACJ,qBACA,wBACA,UACA,UACA;EACA,IAAI,CAAE,MAAM,KAAK,cAAc,qBAAqB,UAAU,QAAQ,GACpE,OAAO;EAGT,KAAK,MAAM,UAAU,wBACnB,IAAI,CAAE,MAAM,KAAK,cAAc,QAAQ,UAAU,QAAQ,GACvD,OAAO;EAIX,OAAO;CACT;;;;;CAMA,cACE,QACA,UACA,UACuB;EACvB,IAAI,WAAW,KAAA,GACb,OAAO;EAET,IAAI,OAAO,WAAW,GACpB,OAAO;EAET,IAAI,cAAc,iBAAiB,QAAQ,CAAC,CAAC;EAC7C,cAAc,qBACZ;GACE,GAAG;GACH,OAAO,YAAY,YAAY,OAAO,MAAM;EAC9C,GACA;GACY;GACV,gBAAgB,KAAA;EAClB,CACF;EAMA,MAAM,QAAQ,cAAc,aAAa,KAAK,kBAAkB,UAAU;EAC1E,IAAI;GACF,MAAM,MAAM,MAAM,MAAM,CAAC,CAAC;GAC1B,KAAK,MAAM,KAAK,KAGd,OAAO;EAEX,UAAU;GACR,MAAM,QAAQ;EAChB;EAGA,OAAO;CACT;AACF;AAEA,SAAS,YAAY,OAA8B,QAAgB;CACjE,OAAO,OAAO,2CAA2C;CAEzD,OAAO,kBAAkB;EACvB,MAAM;EACN,YAAY,CACV,OACA;GACE,MAAM;GACN,YAAY,OAAO,KAAK,CAAC,QAAQ,UAAU;IACzC,OAAO,QAAQ,kCAAkC;IACjD,OAAO;GACT,CAAC;EACH,CACF;CACF,CAAC;AACH"}

package/out/zero-cache/src/config/network.js

@@ -32,6 +32,6 @@ function getPreferredIp(interfaces, preferredPrefixes) {
 	return sorted[0].family === "IPv4" ? sorted[0].address : `[${sorted[0].address}]`;
 }
 //#endregion
-export { DEFAULT_PREFERRED_PREFIXES, getHostIp };
+export { DEFAULT_PREFERRED_PREFIXES, getHostIp, getPreferredIp };
 
 //# sourceMappingURL=network.js.map

package/out/zero-cache/src/config/network.js.map

@@ -1 +1 @@
-{"version":3,"file":"network.js","names":[],"sources":["../../../../../zero-cache/src/config/network.ts"],"sourcesContent":["import {networkInterfaces, type NetworkInterfaceInfo} from 'os';\nimport type {LogContext} from '@rocicorp/logger';\nimport {isIPv6, isPrivate, isReserved} from 'is-in-subnet';\n\nexport const DEFAULT_PREFERRED_PREFIXES = [\n  'eth', // linux\n  'en', // macbooks\n] as const;\n\nexport function getHostIp(\n  lc?: LogContext,\n  preferredPrefixes: readonly string[] = DEFAULT_PREFERRED_PREFIXES,\n) {\n  const interfaces = networkInterfaces();\n  const preferred = getPreferredIp(interfaces, preferredPrefixes);\n  lc?.info?.(`network interfaces`, {preferred, interfaces});\n  return preferred;\n}\n\nexport function getPreferredIp(\n  interfaces: NodeJS.Dict<NetworkInterfaceInfo[]>,\n  preferredPrefixes: readonly string[],\n) {\n  const rank = ({name}: {name: string}) => {\n    for (let i = 0; i < preferredPrefixes.length; i++) {\n      if (name.startsWith(preferredPrefixes[i])) {\n        return i;\n      }\n    }\n    return Number.MAX_SAFE_INTEGER;\n  };\n\n  const sorted = Object.entries(interfaces)\n    .flatMap(([name, infos]) => (infos ?? []).map(info => ({...info, name})))\n    .sort((a, b) => {\n      const ap =\n        (isIPv6(a.address) && isPrivate(a.address)) || isReserved(a.address);\n      const bp =\n        (isIPv6(b.address) && isPrivate(b.address)) || isReserved(b.address);\n      if (ap !== bp) {\n        // Avoid link-local, site-local, or otherwise private addresses\n        return ap ? 1 : -1;\n      }\n      if (a.internal !== b.internal) {\n        // Prefer non-internal addresses.\n        return a.internal ? 1 : -1;\n      }\n      if (a.family !== b.family) {\n        // Prefer IPv4.\n        return a.family === 'IPv4' ? -1 : 1;\n      }\n      const rankA = rank(a);\n      const rankB = rank(b);\n      if (rankA !== rankB) {\n        return rankA - rankB;\n      }\n      // arbitrary\n      return a.address.localeCompare(b.address);\n    });\n\n  // Enclose IPv6 addresses in square brackets for use in a URL.\n  const preferred =\n    sorted[0].family === 'IPv4' ? sorted[0].address : `[${sorted[0].address}]`;\n  return preferred;\n}\n"],"mappings":";;;AAIA,IAAa,6BAA6B,CACxC,OACA,IACF;AAEA,SAAgB,UACd,IACA,oBAAuC,4BACvC;CACA,MAAM,aAAa,kBAAkB;CACrC,MAAM,YAAY,eAAe,YAAY,iBAAiB;CAC9D,IAAI,OAAO,sBAAsB;EAAC;EAAW;CAAU,CAAC;CACxD,OAAO;AACT;AAEA,SAAgB,eACd,YACA,mBACA;CACA,MAAM,QAAQ,EAAC,WAA0B;EACvC,KAAK,IAAI,IAAI,GAAG,IAAI,kBAAkB,QAAQ,KAC5C,IAAI,KAAK,WAAW,kBAAkB,EAAE,GACtC,OAAO;EAGX,OAAO,OAAO;CAChB;CAEA,MAAM,SAAS,OAAO,QAAQ,UAAU,EACrC,SAAS,CAAC,MAAM,YAAY,SAAS,CAAC,GAAG,KAAI,UAAS;EAAC,GAAG;EAAM;CAAI,EAAE,CAAC,EACvE,MAAM,GAAG,MAAM;EACd,MAAM,KACH,OAAO,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO,KAAM,WAAW,EAAE,OAAO;EAGrE,IAAI,QADD,OAAO,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO,KAAM,WAAW,EAAE,OAAO,IAGnE,OAAO,KAAK,IAAI;EAElB,IAAI,EAAE,aAAa,EAAE,UAEnB,OAAO,EAAE,WAAW,IAAI;EAE1B,IAAI,EAAE,WAAW,EAAE,QAEjB,OAAO,EAAE,WAAW,SAAS,KAAK;EAEpC,MAAM,QAAQ,KAAK,CAAC;EACpB,MAAM,QAAQ,KAAK,CAAC;EACpB,IAAI,UAAU,OACZ,OAAO,QAAQ;EAGjB,OAAO,EAAE,QAAQ,cAAc,EAAE,OAAO;CAC1C,CAAC;CAKH,OADE,OAAO,GAAG,WAAW,SAAS,OAAO,GAAG,UAAU,IAAI,OAAO,GAAG,QAAQ;AAE5E"}
+{"version":3,"file":"network.js","names":[],"sources":["../../../../../zero-cache/src/config/network.ts"],"sourcesContent":["import {networkInterfaces, type NetworkInterfaceInfo} from 'os';\nimport type {LogContext} from '@rocicorp/logger';\nimport {isIPv6, isPrivate, isReserved} from 'is-in-subnet';\n\nexport const DEFAULT_PREFERRED_PREFIXES = [\n  'eth', // linux\n  'en', // macbooks\n] as const;\n\nexport function getHostIp(\n  lc?: LogContext,\n  preferredPrefixes: readonly string[] = DEFAULT_PREFERRED_PREFIXES,\n) {\n  const interfaces = networkInterfaces();\n  const preferred = getPreferredIp(interfaces, preferredPrefixes);\n  lc?.info?.(`network interfaces`, {preferred, interfaces});\n  return preferred;\n}\n\nexport function getPreferredIp(\n  interfaces: NodeJS.Dict<NetworkInterfaceInfo[]>,\n  preferredPrefixes: readonly string[],\n) {\n  const rank = ({name}: {name: string}) => {\n    for (let i = 0; i < preferredPrefixes.length; i++) {\n      if (name.startsWith(preferredPrefixes[i])) {\n        return i;\n      }\n    }\n    return Number.MAX_SAFE_INTEGER;\n  };\n\n  const sorted = Object.entries(interfaces)\n    .flatMap(([name, infos]) => (infos ?? []).map(info => ({...info, name})))\n    .sort((a, b) => {\n      const ap =\n        (isIPv6(a.address) && isPrivate(a.address)) || isReserved(a.address);\n      const bp =\n        (isIPv6(b.address) && isPrivate(b.address)) || isReserved(b.address);\n      if (ap !== bp) {\n        // Avoid link-local, site-local, or otherwise private addresses\n        return ap ? 1 : -1;\n      }\n      if (a.internal !== b.internal) {\n        // Prefer non-internal addresses.\n        return a.internal ? 1 : -1;\n      }\n      if (a.family !== b.family) {\n        // Prefer IPv4.\n        return a.family === 'IPv4' ? -1 : 1;\n      }\n      const rankA = rank(a);\n      const rankB = rank(b);\n      if (rankA !== rankB) {\n        return rankA - rankB;\n      }\n      // arbitrary\n      return a.address.localeCompare(b.address);\n    });\n\n  // Enclose IPv6 addresses in square brackets for use in a URL.\n  const preferred =\n    sorted[0].family === 'IPv4' ? sorted[0].address : `[${sorted[0].address}]`;\n  return preferred;\n}\n"],"mappings":";;;AAIA,IAAa,6BAA6B,CACxC,OACA,IACF;AAEA,SAAgB,UACd,IACA,oBAAuC,4BACvC;CACA,MAAM,aAAa,kBAAkB;CACrC,MAAM,YAAY,eAAe,YAAY,iBAAiB;CAC9D,IAAI,OAAO,sBAAsB;EAAC;EAAW;CAAU,CAAC;CACxD,OAAO;AACT;AAEA,SAAgB,eACd,YACA,mBACA;CACA,MAAM,QAAQ,EAAC,WAA0B;EACvC,KAAK,IAAI,IAAI,GAAG,IAAI,kBAAkB,QAAQ,KAC5C,IAAI,KAAK,WAAW,kBAAkB,EAAE,GACtC,OAAO;EAGX,OAAO,OAAO;CAChB;CAEA,MAAM,SAAS,OAAO,QAAQ,UAAU,CAAC,CACtC,SAAS,CAAC,MAAM,YAAY,SAAS,CAAC,EAAA,CAAG,KAAI,UAAS;EAAC,GAAG;EAAM;CAAI,EAAE,CAAC,CAAC,CACxE,MAAM,GAAG,MAAM;EACd,MAAM,KACH,OAAO,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO,KAAM,WAAW,EAAE,OAAO;EAGrE,IAAI,QADD,OAAO,EAAE,OAAO,KAAK,UAAU,EAAE,OAAO,KAAM,WAAW,EAAE,OAAO,IAGnE,OAAO,KAAK,IAAI;EAElB,IAAI,EAAE,aAAa,EAAE,UAEnB,OAAO,EAAE,WAAW,IAAI;EAE1B,IAAI,EAAE,WAAW,EAAE,QAEjB,OAAO,EAAE,WAAW,SAAS,KAAK;EAEpC,MAAM,QAAQ,KAAK,CAAC;EACpB,MAAM,QAAQ,KAAK,CAAC;EACpB,IAAI,UAAU,OACZ,OAAO,QAAQ;EAGjB,OAAO,EAAE,QAAQ,cAAc,EAAE,OAAO;CAC1C,CAAC;CAKH,OADE,OAAO,EAAE,CAAC,WAAW,SAAS,OAAO,EAAE,CAAC,UAAU,IAAI,OAAO,EAAE,CAAC,QAAQ;AAE5E"}

package/out/zero-cache/src/config/server-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-context.js","names":[],"sources":["../../../../../zero-cache/src/config/server-context.ts"],"sourcesContent":["import {hostname} from 'node:os';\nimport {getHostIp} from './network.ts';\nimport type {NormalizedZeroConfig} from './normalize.ts';\n\nexport type ServerContext = {\n  appID: string;\n  taskID: string;\n  hostIP: string;\n  hostname: string;\n  timestamp: string;\n\n  [platformVar: string]: string | undefined;\n};\n\n/**\n * Runtime and environment information useful for recording and identifying\n * the origin of certain actions such as initial sync and logical replication\n * takeovers.\n */\nexport function getServerContext(config: NormalizedZeroConfig): ServerContext {\n  const context: ServerContext = {\n    appID: config.app.id,\n    taskID: config.taskID,\n    hostIP: getHostIp(),\n    hostname: hostname(),\n    timestamp: new Date().toISOString(),\n\n    // Platform-specific environment variables\n    flyAppName: process.env.FLY_APP_NAME,\n    flyMachineID: process.env.FLY_MACHINE_ID,\n\n    railwayProjectID: process.env.RAILWAY_PROJECT_ID,\n    railwayProjectName: process.env.RAILWAY_PROJECT_NAME,\n    railwayEnvironmentID: process.env.RAILWAY_ENVIRONMENT_ID,\n    railwayEnvironmentName: process.env.RAILWAY_ENVIRONMENT_NAME,\n    railwayServiceID: process.env.RAILWAY_SERVICE_ID,\n    railwayServiceName: process.env.RAILWAY_SERVICE_NAME,\n    railwayDeploymentID: process.env.RAILWAY_DEPLOYMENT_ID,\n\n    gcpProject:\n      process.env.GOOGLE_CLOUD_PROJECT ??\n      process.env.GCP_PROJECT ??\n      process.env.GCLOUD_PROJECT,\n\n    coolifyDomainName: process.env.COOLIFY_FQDN,\n    coolifyContainerName: process.env.COOLIFY_CONTAINER_NAME,\n\n    azureEnvName: process.env.AZURE_ENV_NAME,\n  };\n\n  // Remove keys with undefined values\n  return Object.fromEntries(\n    Object.entries(context).filter(([_, v]) => v !== undefined),\n  ) as ServerContext;\n}\n"],"mappings":";;;;;;;;AAmBA,SAAgB,iBAAiB,QAA6C;CAC5E,MAAM,UAAyB;EAC7B,OAAO,OAAO,IAAI;EAClB,QAAQ,OAAO;EACf,QAAQ,UAAU;EAClB,UAAU,SAAS;EACnB,4BAAW,IAAI,KAAK,GAAE,YAAY;EAGlC,YAAY,QAAQ,IAAI;EACxB,cAAc,QAAQ,IAAI;EAE1B,kBAAkB,QAAQ,IAAI;EAC9B,oBAAoB,QAAQ,IAAI;EAChC,sBAAsB,QAAQ,IAAI;EAClC,wBAAwB,QAAQ,IAAI;EACpC,kBAAkB,QAAQ,IAAI;EAC9B,oBAAoB,QAAQ,IAAI;EAChC,qBAAqB,QAAQ,IAAI;EAEjC,YACE,QAAQ,IAAI,wBACZ,QAAQ,IAAI,eACZ,QAAQ,IAAI;EAEd,mBAAmB,QAAQ,IAAI;EAC/B,sBAAsB,QAAQ,IAAI;EAElC,cAAc,QAAQ,IAAI;CAC5B;CAGA,OAAO,OAAO,YACZ,OAAO,QAAQ,OAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,MAAM,KAAA,CAAS,CAC5D;AACF"}
+{"version":3,"file":"server-context.js","names":[],"sources":["../../../../../zero-cache/src/config/server-context.ts"],"sourcesContent":["import {hostname} from 'node:os';\nimport {getHostIp} from './network.ts';\nimport type {NormalizedZeroConfig} from './normalize.ts';\n\nexport type ServerContext = {\n  appID: string;\n  taskID: string;\n  hostIP: string;\n  hostname: string;\n  timestamp: string;\n\n  [platformVar: string]: string | undefined;\n};\n\n/**\n * Runtime and environment information useful for recording and identifying\n * the origin of certain actions such as initial sync and logical replication\n * takeovers.\n */\nexport function getServerContext(config: NormalizedZeroConfig): ServerContext {\n  const context: ServerContext = {\n    appID: config.app.id,\n    taskID: config.taskID,\n    hostIP: getHostIp(),\n    hostname: hostname(),\n    timestamp: new Date().toISOString(),\n\n    // Platform-specific environment variables\n    flyAppName: process.env.FLY_APP_NAME,\n    flyMachineID: process.env.FLY_MACHINE_ID,\n\n    railwayProjectID: process.env.RAILWAY_PROJECT_ID,\n    railwayProjectName: process.env.RAILWAY_PROJECT_NAME,\n    railwayEnvironmentID: process.env.RAILWAY_ENVIRONMENT_ID,\n    railwayEnvironmentName: process.env.RAILWAY_ENVIRONMENT_NAME,\n    railwayServiceID: process.env.RAILWAY_SERVICE_ID,\n    railwayServiceName: process.env.RAILWAY_SERVICE_NAME,\n    railwayDeploymentID: process.env.RAILWAY_DEPLOYMENT_ID,\n\n    gcpProject:\n      process.env.GOOGLE_CLOUD_PROJECT ??\n      process.env.GCP_PROJECT ??\n      process.env.GCLOUD_PROJECT,\n\n    coolifyDomainName: process.env.COOLIFY_FQDN,\n    coolifyContainerName: process.env.COOLIFY_CONTAINER_NAME,\n\n    azureEnvName: process.env.AZURE_ENV_NAME,\n  };\n\n  // Remove keys with undefined values\n  return Object.fromEntries(\n    Object.entries(context).filter(([_, v]) => v !== undefined),\n  ) as ServerContext;\n}\n"],"mappings":";;;;;;;;AAmBA,SAAgB,iBAAiB,QAA6C;CAC5E,MAAM,UAAyB;EAC7B,OAAO,OAAO,IAAI;EAClB,QAAQ,OAAO;EACf,QAAQ,UAAU;EAClB,UAAU,SAAS;EACnB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAGlC,YAAY,QAAQ,IAAI;EACxB,cAAc,QAAQ,IAAI;EAE1B,kBAAkB,QAAQ,IAAI;EAC9B,oBAAoB,QAAQ,IAAI;EAChC,sBAAsB,QAAQ,IAAI;EAClC,wBAAwB,QAAQ,IAAI;EACpC,kBAAkB,QAAQ,IAAI;EAC9B,oBAAoB,QAAQ,IAAI;EAChC,qBAAqB,QAAQ,IAAI;EAEjC,YACE,QAAQ,IAAI,wBACZ,QAAQ,IAAI,eACZ,QAAQ,IAAI;EAEd,mBAAmB,QAAQ,IAAI;EAC/B,sBAAsB,QAAQ,IAAI;EAElC,cAAc,QAAQ,IAAI;CAC5B;CAGA,OAAO,OAAO,YACZ,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,OAAO,MAAM,KAAA,CAAS,CAC5D;AACF"}

package/out/zero-cache/src/config/zero-config.d.ts

@@ -749,6 +749,11 @@ export declare const zeroOptions: {
         type: v.Optional<string>;
         desc: string[];
     };
+    operatorStorageHeapProportion: {
+        type: v.Type<number>;
+        desc: string[];
+        hidden: boolean;
+    };
     initialSync: {
         tableCopyWorkers: {
             type: v.Type<number>;

package/out/zero-cache/src/config/zero-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zero-config.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/config/zero-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AAUnD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAC,SAAS,EAAC,MAAM,kCAAkC,CAAC;AAEhE,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,eAAO,MAAM,UAAU;IACrB,EAAE;QACA,IAAI;QAIJ,IAAI;;IAuBN,YAAY;QACV,IAAI;QACJ,IAAI;;CAgBP,CAAC;AAEF,eAAO,MAAM,YAAY;IACvB,EAAE;QACA,IAAI;QASJ,MAAM;;IAGR,GAAG;QACD,IAAI;QACJ,IAAI;QAMJ,MAAM;;CAET,CAAC;AAEF,QAAA,MAAM,cAAc;IAClB,IAAI;QACF,IAAI;QACJ,IAAI;;IAON,mBAAmB;QACjB,IAAI;QACJ,IAAI;;CAOP,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAE3D,QAAA,MAAM,oBAAoB;IACxB,GAAG;QACD,IAAI;QACJ,IAAI;;IAKN,QAAQ;QACN,IAAI;QACJ,IAAI;;CAIP,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5D,QAAA,MAAM,WAAW;IACf,GAAG;QACD,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,OAAO;QACL,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,MAAM;QACJ,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,MAAM;QACJ,IAAI;QACJ,IAAI;QAIJ,UAAU;;IAIZ,QAAQ;QACN,IAAI;QACJ,IAAI;QAIJ,UAAU;;IAIZ,yBAAyB;QACvB,IAAI;QACJ,IAAI;;IAKN,0BAA0B;QACxB,IAAI;QACJ,IAAI;;CAKP,CAAC;AA0HF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAEpD,+DAA+D;AAC/D,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,UAAU,EACV,KAAK,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CACrD,CAAC;AAKF,eAAO,MAAM,WAAW;;QAEpB,EAAE;YACA,IAAI;YACJ,IAAI;;QAMN,IAAI;YACF,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,QAAQ;YACN,IAAI;YACJ,IAAI;;QAWN,iBAAiB;YACf,IAAI;YACJ,MAAM;;QAGR,yBAAyB;YACvB,IAAI;YACJ,IAAI;;QAYN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAuBN,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YAiBJ,MAAM;;QAGR,iCAAiC;YAC/B,IAAI;YACJ,IAAI;YAUJ,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAeJ,MAAM;;QAMR,sBAAsB;YACpB,IAAI;YACJ,MAAM;;QAGR,wBAAwB;YACtB,IAAI;YACJ,IAAI;;;IAqBR,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAGlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAKhB,IAAI;QACJ,IAAI;;;QAQJ,IAAI;QACJ,IAAI;;;QAQJ,EAAE;YACA,IAAI;YACJ,IAAI;;QAON,QAAQ;YACN,IAAI;YACJ,IAAI;;QASN,iBAAiB;YACf,IAAI;YACJ,MAAM;;QAGR,yCAAyC;YACvC,IAAI;YACJ,IAAI;;QAUN,uCAAuC;YACrC,IAAI;YACJ,IAAI;;QAON,iCAAiC;YAC/B,IAAI;YACJ,IAAI;;;;QAWN,IAAI;QACJ,IAAI;;;QAQJ,IAAI;QACJ,IAAI;QAIJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QASJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;QAeJ,MAAM;;;QAIN,IAAI;QAOJ,IAAI;QAaJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QAkBJ,MAAM;;;QAIN,IAAI;QAgBJ,IAAI;QAMJ,MAAM;;;QAIN,IAAI;QAIJ,IAAI;QAKJ,MAAM;;;QAIN,IAAI;QAIJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QASJ,IAAI;QAOJ,IAAI;;;QAYJ,IAAI;QAOJ,IAAI;;;QAYJ,EAAE;YACA,IAAI;YACJ,IAAI;;QASN,kBAAkB;QAClB,QAAQ;YACN,IAAI;YACJ,UAAU;YAIV,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,YAAY;YACV,IAAI;YAOJ,IAAI;YAQJ,MAAM;;;;;YA9wBR,IAAI;YACJ,IAAI;;;YAQJ,IAAI;YACJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YArFJ,IAAI;YAIJ,IAAI;;;YAwBJ,IAAI;YACJ,IAAI;;;;;YAoBJ,IAAI;YASJ,MAAM;;;YAIN,IAAI;YACJ,IAAI;YAMJ,MAAM;;;;;YA+CN,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAIJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAIJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;;;YAMJ,IAAI;YACJ,IAAI;;;;QA6rBJ,IAAI;QACJ,IAAI;;;QAIJ,IAAI;QACJ,IAAI;;;QAcJ,IAAI;QACJ,IAAI;;;QAoBJ,GAAG;YACD,IAAI;YACJ,IAAI;;QAQN,kBAAkB;QAClB,IAAI;YACF,IAAI;YACJ,UAAU;;QASZ,IAAI;YACF,IAAI;YACJ,IAAI;;QASN,kBAAkB;QAClB,OAAO;YACL,IAAI;YACJ,UAAU;YAGV,MAAM;;QAGR,kBAAkB;QAClB,QAAQ;YACN,IAAI;YACJ,UAAU;YAGV,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YASJ,MAAM;;QAGR,cAAc;YACZ,IAAI;YACJ,IAAI;;QASN,mBAAmB;YACjB,IAAI;YAGJ,IAAI;YAIJ,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,0BAA0B;YACxB,IAAI;YACJ,IAAI;YAGJ,MAAM;;QAGR,8BAA8B;YAC5B,IAAI;YACJ,IAAI;YAQJ,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YAIJ,MAAM;;QAGR,0BAA0B;YACxB,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,4BAA4B;YAC1B,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,+BAA+B;YAC7B,IAAI;YACJ,IAAI;YAQJ,MAAM;;QAGR,+BAA+B;YAC7B,IAAI;YACJ,IAAI;;QAsBN,qCAAqC;YACnC,IAAI;YACJ,IAAI;;QA0BN,2CAA2C;YACzC,IAAI;YACJ,IAAI;;QAyBN,+BAA+B;YAC7B,IAAI;YACJ,IAAI;;;;QAkBN,IAAI;QACJ,IAAI;;;;YAljCJ,IAAI;YACJ,IAAI;;;YAMJ,IAAI;YACJ,IAAI;;;;QAsjCJ,IAAI;QACJ,IAAI;;;QASJ,IAAI;QACJ,IAAI;;;QAgBJ,gBAAgB;YACd,IAAI;YACJ,IAAI;;QAoBN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAaN,mBAAmB;YACjB,IAAI;YACJ,IAAI;;;;QAWN,IAAI;QACJ,IAAI;;;QAYJ,IAAI;QACJ,IAAI;;;QAsBJ,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;;;QAYJ,IAAI;QACJ,IAAI;;;QASJ,UAAU;YACR,IAAI;YACJ,IAAI;;QAON,YAAY;YACV,IAAI;YACJ,IAAI;;QASN,cAAc;YACZ,IAAI;YACJ,IAAI;;QAON,aAAa;YACX,IAAI;YACJ,IAAI;;QAoBN,UAAU;YACR,IAAI;YACJ,MAAM;YACN,IAAI;;QAYN,UAAU;YACR,IAAI;YACJ,IAAI;;QAWN,YAAY;YACV,IAAI;YAGJ,IAAI;;QAWN,QAAQ;YACN,IAAI;;QAKN,SAAS;YACP,IAAI;YACJ,IAAI;;QAON,iBAAiB;YACf,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,QAAQ;YACN,IAAI;YACJ,IAAI;;QAMN,MAAM;YACJ,IAAI;YACJ,IAAI;;QAON,IAAI;YACF,IAAI;YACJ,IAAI;;QAQN,qBAAqB;YACnB,IAAI;YACJ,IAAI;;QAUN,sBAAsB;YACpB,IAAI;YACJ,UAAU;YACV,MAAM;;QAGR,sBAAsB;YACpB,IAAI;YACJ,IAAI;;QAUN,0BAA0B;YACxB,IAAI;YACJ,IAAI;;QAqBN,YAAY;YACV,IAAI;YACJ,IAAI;;QAgBN,gCAAgC;YAC9B,IAAI;YACJ,IAAI;;QAYN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAiBN,gCAAgC;YAC9B,IAAI;YACJ,IAAI;;QAcN,kBAAkB;YAChB,IAAI;YACJ,IAAI;;QAMN,oBAAoB;YAClB,IAAI;YACJ,IAAI;;QAQN,aAAa;YACX,IAAI;YACJ,IAAI;;;;QASN,IAAI;QACJ,IAAI;;;QAMJ,gBAAgB;YACd,IAAI;YACJ,IAAI;;QASN,WAAW;YACT,IAAI;YACJ,MAAM;YACN,IAAI;;QAMN,QAAQ;YACN,IAAI;YACJ,IAAI;;;;QASN,OAAO;YACL,IAAI;YACJ,IAAI;;QASN,aAAa;YACX,IAAI;YACJ,IAAI;;QASN,UAAU;YACR,IAAI;YACJ,IAAI;;QAON,eAAe;YACb,IAAI;YACJ,IAAI;;;IAOR,kBAAkB;;QAEhB,IAAI;QACJ,UAAU;QAKV,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;;;QAIJ,IAAI;QACJ,IAAI;;;QASJ,OAAO;YACL,IAAI;YACJ,IAAI;;QAYN,qBAAqB;YACnB,IAAI;YACJ,IAAI;;;CAST,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAIpD,wBAAgB,aAAa,CAC3B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,UAAU,CAaZ;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,GAAG,cAAc,CAAM,GAC9D,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAUzB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,oBAAoB,CAItB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,GAAG,SAAS,GACpD,MAAM,CAER;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,EACnD,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAET;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,GAAG,kBAAkB,CAAC,EACxE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,WAAW,GAAG,SAAS,CAEzB;AAgFD,wBAAgB,kBAAkB,SAEjC"}
+{"version":3,"file":"zero-config.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/config/zero-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AAUnD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAC,SAAS,EAAC,MAAM,kCAAkC,CAAC;AAEhE,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,eAAO,MAAM,UAAU;IACrB,EAAE;QACA,IAAI;QAIJ,IAAI;;IAuBN,YAAY;QACV,IAAI;QACJ,IAAI;;CAgBP,CAAC;AAEF,eAAO,MAAM,YAAY;IACvB,EAAE;QACA,IAAI;QASJ,MAAM;;IAGR,GAAG;QACD,IAAI;QACJ,IAAI;QAMJ,MAAM;;CAET,CAAC;AAEF,QAAA,MAAM,cAAc;IAClB,IAAI;QACF,IAAI;QACJ,IAAI;;IAON,mBAAmB;QACjB,IAAI;QACJ,IAAI;;CAOP,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAE3D,QAAA,MAAM,oBAAoB;IACxB,GAAG;QACD,IAAI;QACJ,IAAI;;IAKN,QAAQ;QACN,IAAI;QACJ,IAAI;;CAIP,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5D,QAAA,MAAM,WAAW;IACf,GAAG;QACD,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,OAAO;QACL,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,MAAM;QACJ,IAAI;QACJ,IAAI;QAGJ,UAAU;;IAIZ,MAAM;QACJ,IAAI;QACJ,IAAI;QAIJ,UAAU;;IAIZ,QAAQ;QACN,IAAI;QACJ,IAAI;QAIJ,UAAU;;IAIZ,yBAAyB;QACvB,IAAI;QACJ,IAAI;;IAKN,0BAA0B;QACxB,IAAI;QACJ,IAAI;;CAKP,CAAC;AA0HF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAEpD,+DAA+D;AAC/D,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,UAAU,EACV,KAAK,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CACrD,CAAC;AAKF,eAAO,MAAM,WAAW;;QAEpB,EAAE;YACA,IAAI;YACJ,IAAI;;QAMN,IAAI;YACF,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,QAAQ;YACN,IAAI;YACJ,IAAI;;QAWN,iBAAiB;YACf,IAAI;YACJ,MAAM;;QAGR,yBAAyB;YACvB,IAAI;YACJ,IAAI;;QAYN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAuBN,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YAiBJ,MAAM;;QAGR,iCAAiC;YAC/B,IAAI;YACJ,IAAI;YAUJ,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAeJ,MAAM;;QAMR,sBAAsB;YACpB,IAAI;YACJ,MAAM;;QAGR,wBAAwB;YACtB,IAAI;YACJ,IAAI;;;IAqBR,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAGlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAKhB,IAAI;QACJ,IAAI;;;QAQJ,IAAI;QACJ,IAAI;;;QAQJ,EAAE;YACA,IAAI;YACJ,IAAI;;QAON,QAAQ;YACN,IAAI;YACJ,IAAI;;QASN,iBAAiB;YACf,IAAI;YACJ,MAAM;;QAGR,yCAAyC;YACvC,IAAI;YACJ,IAAI;;QAUN,uCAAuC;YACrC,IAAI;YACJ,IAAI;;QAON,iCAAiC;YAC/B,IAAI;YACJ,IAAI;;;;QAWN,IAAI;QACJ,IAAI;;;QAQJ,IAAI;QACJ,IAAI;QAIJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QASJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;QAeJ,MAAM;;;QAIN,IAAI;QAOJ,IAAI;QAaJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;QAkBJ,MAAM;;;QAIN,IAAI;QAgBJ,IAAI;QAMJ,MAAM;;;QAIN,IAAI;QAIJ,IAAI;QAKJ,MAAM;;;QAIN,IAAI;QAIJ,IAAI;QAOJ,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QASJ,IAAI;QAOJ,IAAI;;;QAYJ,IAAI;QAOJ,IAAI;;;QAYJ,EAAE;YACA,IAAI;YACJ,IAAI;;QASN,kBAAkB;QAClB,QAAQ;YACN,IAAI;YACJ,UAAU;YAIV,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,YAAY;YACV,IAAI;YAOJ,IAAI;YAQJ,MAAM;;;;;YA9wBR,IAAI;YACJ,IAAI;;;YAQJ,IAAI;YACJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YArFJ,IAAI;YAIJ,IAAI;;;YAwBJ,IAAI;YACJ,IAAI;;;;;YAoBJ,IAAI;YASJ,MAAM;;;YAIN,IAAI;YACJ,IAAI;YAMJ,MAAM;;;;;YA+CN,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAGJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAIJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;YAIJ,UAAU;;;YAKV,IAAI;YACJ,IAAI;;;YAMJ,IAAI;YACJ,IAAI;;;;QA6rBJ,IAAI;QACJ,IAAI;;;QAIJ,IAAI;QACJ,IAAI;;;QAcJ,IAAI;QACJ,IAAI;;;QAoBJ,GAAG;YACD,IAAI;YACJ,IAAI;;QAQN,kBAAkB;QAClB,IAAI;YACF,IAAI;YACJ,UAAU;;QASZ,IAAI;YACF,IAAI;YACJ,IAAI;;QASN,kBAAkB;QAClB,OAAO;YACL,IAAI;YACJ,UAAU;YAGV,MAAM;;QAGR,kBAAkB;QAClB,QAAQ;YACN,IAAI;YACJ,UAAU;YAGV,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YASJ,MAAM;;QAGR,cAAc;YACZ,IAAI;YACJ,IAAI;;QASN,mBAAmB;YACjB,IAAI;YAGJ,IAAI;YAIJ,MAAM;;QAGR,kBAAkB;YAChB,IAAI;YACJ,IAAI;YAMJ,MAAM;;QAGR,0BAA0B;YACxB,IAAI;YACJ,IAAI;YAGJ,MAAM;;QAGR,8BAA8B;YAC5B,IAAI;YACJ,IAAI;YAQJ,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YAIJ,MAAM;;QAGR,0BAA0B;YACxB,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,4BAA4B;YAC1B,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,6BAA6B;YAC3B,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,+BAA+B;YAC7B,IAAI;YACJ,IAAI;YAQJ,MAAM;;QAGR,+BAA+B;YAC7B,IAAI;YACJ,IAAI;;QAsBN,qCAAqC;YACnC,IAAI;YACJ,IAAI;;QA0BN,2CAA2C;YACzC,IAAI;YACJ,IAAI;;QAyBN,+BAA+B;YAC7B,IAAI;YACJ,IAAI;;;;QAkBN,IAAI;QACJ,IAAI;;;;YAljCJ,IAAI;YACJ,IAAI;;;YAMJ,IAAI;YACJ,IAAI;;;;QAsjCJ,IAAI;QACJ,IAAI;;;QASJ,IAAI;QACJ,IAAI;;;QAgBJ,gBAAgB;YACd,IAAI;YACJ,IAAI;;QAoBN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAaN,mBAAmB;YACjB,IAAI;YACJ,IAAI;;;;QAWN,IAAI;QACJ,IAAI;;;QAYJ,IAAI;QACJ,IAAI;;;QAsBJ,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;;;QAYJ,IAAI;QACJ,IAAI;;;QASJ,UAAU;YACR,IAAI;YACJ,IAAI;;QAON,YAAY;YACV,IAAI;YACJ,IAAI;;QASN,cAAc;YACZ,IAAI;YACJ,IAAI;;QAON,aAAa;YACX,IAAI;YACJ,IAAI;;QAoBN,UAAU;YACR,IAAI;YACJ,MAAM;YACN,IAAI;;QAYN,UAAU;YACR,IAAI;YACJ,IAAI;;QAWN,YAAY;YACV,IAAI;YAGJ,IAAI;;QAWN,QAAQ;YACN,IAAI;;QAKN,SAAS;YACP,IAAI;YACJ,IAAI;;QAON,iBAAiB;YACf,IAAI;YACJ,IAAI;YACJ,MAAM;;QAGR,QAAQ;YACN,IAAI;YACJ,IAAI;;QAMN,MAAM;YACJ,IAAI;YACJ,IAAI;;QAON,IAAI;YACF,IAAI;YACJ,IAAI;;QAQN,qBAAqB;YACnB,IAAI;YACJ,IAAI;;QAUN,sBAAsB;YACpB,IAAI;YACJ,UAAU;YACV,MAAM;;QAGR,sBAAsB;YACpB,IAAI;YACJ,IAAI;;QAUN,0BAA0B;YACxB,IAAI;YACJ,IAAI;;QAqBN,YAAY;YACV,IAAI;YACJ,IAAI;;QAgBN,gCAAgC;YAC9B,IAAI;YACJ,IAAI;;QAYN,2BAA2B;YACzB,IAAI;YACJ,IAAI;;QAiBN,gCAAgC;YAC9B,IAAI;YACJ,IAAI;;QAcN,kBAAkB;YAChB,IAAI;YACJ,IAAI;;QAMN,oBAAoB;YAClB,IAAI;YACJ,IAAI;;QAQN,aAAa;YACX,IAAI;YACJ,IAAI;;;;QASN,IAAI;QACJ,IAAI;;;QAMJ,IAAI;QAIJ,IAAI;QAOJ,MAAM;;;QAIN,gBAAgB;YACd,IAAI;YACJ,IAAI;;QASN,WAAW;YACT,IAAI;YACJ,MAAM;YACN,IAAI;;QAMN,QAAQ;YACN,IAAI;YACJ,IAAI;;;;QASN,OAAO;YACL,IAAI;YACJ,IAAI;;QASN,aAAa;YACX,IAAI;YACJ,IAAI;;QASN,UAAU;YACR,IAAI;YACJ,IAAI;;QAON,eAAe;YACb,IAAI;YACJ,IAAI;;;IAOR,kBAAkB;;QAEhB,IAAI;QACJ,UAAU;QAKV,MAAM;;;QAIN,IAAI;QACJ,IAAI;;;QAWJ,IAAI;QACJ,IAAI;;;QAIJ,IAAI;QACJ,IAAI;;;QASJ,OAAO;YACL,IAAI;YACJ,IAAI;;QAYN,qBAAqB;YACnB,IAAI;YACJ,IAAI;;;CAST,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAIpD,wBAAgB,aAAa,CAC3B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,UAAU,CAaZ;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,GAAG,cAAc,CAAM,GAC9D,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAUzB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,oBAAoB,CAItB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,GAAG,SAAS,GACpD,MAAM,CAER;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,EACnD,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAET;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,GAAG,kBAAkB,CAAC,EACxE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,WAAW,GAAG,SAAS,CAEzB;AAgFD,wBAAgB,kBAAkB,SAEjC"}

package/out/zero-cache/src/config/zero-config.js

@@ -1081,7 +1081,7 @@ var zeroOptions = {
 		]
 	},
 	websocketMaxPayloadBytes: {
-		type: valita_exports.number().optional(() => 10 * 1024 * 1024),
+		type: valita_exports.number().optional(() => 10485760),
 		desc: [
 			"Maximum size of incoming WebSocket messages in bytes.",
 			"",
@@ -1336,7 +1336,7 @@ var zeroOptions = {
 			]
 		},
 		multipartSize: {
-			type: valita_exports.number().optional(() => 16 * 1024 * 1024),
+			type: valita_exports.number().optional(() => 16777216),
 			desc: [
 				`The size of each part when uploading or downloading the snapshot with`,
 				`{bold --multipart-concurrency}. Note that up to {bold concurrency * size}`,
@@ -1348,6 +1348,17 @@ var zeroOptions = {
 		type: valita_exports.string().optional(),
 		desc: [`tmp directory for IVM operator storage. Leave unset to use os.tmpdir()`]
 	},
+	operatorStorageHeapProportion: {
+		type: valita_exports.number().assert((value) => value >= 0 && value <= 1, "must be between 0 and 1").optional(() => .1),
+		desc: [
+			`The proportion of {bold --max-old-space-size} that the IVM operators`,
+			`of the client groups of one sync worker may keep in memory. Past it,`,
+			`the least recently used operators spill their state to the SQLite`,
+			`operator storage in {bold storageDBTmpDir}. 0 keeps all operator state`,
+			`in SQLite.`
+		],
+		hidden: true
+	},
 	initialSync: {
 		tableCopyWorkers: {
 			type: valita_exports.number().optional(() => 5),