@rocicorp/zero 1.2.0 → 1.3.0-canary.0

package/out/zero-cache/src/workers/syncer-ws-message-handler.js

@@ -3,36 +3,43 @@ import { InvalidPush } from "../../../zero-protocol/src/error-kind-enum.js";
 import { ZeroCache } from "../../../zero-protocol/src/error-origin-enum.js";
 import { startAsyncSpan, startSpan } from "../../../otel/src/span.js";
 import { version } from "../../../otel/src/version.js";
+import "../services/view-syncer/connection-context-manager.js";
 import "../services/view-syncer/view-syncer.js";
 import { Lock } from "@rocicorp/lock";
-import { trace } from "@opentelemetry/api";
+import { ROOT_CONTEXT, context, propagation, trace } from "@opentelemetry/api";
 //#region ../zero-cache/src/workers/syncer-ws-message-handler.ts
 var tracer = trace.getTracer("syncer-ws-server", version);
+/**
+* Wraps a function in an OTEL context extracted from a W3C traceparent header.
+* This enables distributed tracing from the client through zero-cache to
+* the user's API server.
+*/
+function withTraceparent(traceparent, fn) {
+	if (!traceparent) return fn();
+	const extracted = propagation.extract(ROOT_CONTEXT, { traceparent });
+	return context.with(extracted, fn);
+}
 var SyncerWsMessageHandler = class {
 	#viewSyncer;
 	#mutagen;
 	#mutationLock;
 	#lc;
 	#clientGroupID;
-	#syncContext;
+	#connectionSelector;
+	#contextManager;
 	#pusher;
-	constructor(lc, connectParams, viewSyncer, mutagen, pusher) {
-		const { clientGroupID, clientID, profileID, wsID, baseCookie, protocolVersion, httpCookie, origin, userID } = connectParams;
+	constructor(lc, connectParams, contextManager, viewSyncer, mutagen, pusher) {
+		const { clientGroupID, clientID, wsID } = connectParams;
 		this.#viewSyncer = viewSyncer;
 		this.#mutagen = mutagen;
+		this.#contextManager = contextManager;
 		this.#mutationLock = new Lock();
 		this.#lc = lc.withContext("connection").withContext("clientID", clientID).withContext("clientGroupID", clientGroupID).withContext("wsID", wsID);
 		this.#clientGroupID = clientGroupID;
 		this.#pusher = pusher;
-		this.#syncContext = {
+		this.#connectionSelector = {
 			clientID,
-			profileID,
-			wsID,
-			baseCookie,
-			protocolVersion,
-			httpCookie,
-			origin,
-			userID
+			wsID
 		};
 	}
 	async handleMessage(msg) {
@@ -46,8 +53,8 @@ var SyncerWsMessageHandler = class {
 			case "pull":
 				lc.error?.("Pull is not supported by Zero");
 				break;
-			case "push": return startAsyncSpan(tracer, "connection.push", async () => {
-				const { clientGroupID, mutations, auth: pushAuth } = msg[1];
+			case "push": return withTraceparent(msg[1].traceparent, () => startAsyncSpan(tracer, "connection.push", async () => {
+				const { clientGroupID, mutations } = msg[1];
 				if (clientGroupID !== this.#clientGroupID) return [{
 					type: "fatal",
 					error: {
@@ -56,18 +63,33 @@ var SyncerWsMessageHandler = class {
 						origin: ZeroCache
 					}
 				}];
-				if (pushAuth) await viewSyncer.updateAuth(this.#syncContext, ["updateAuth", { auth: pushAuth }]);
 				if (mutations.length === 0) return [{ type: "ok" }];
 				if (mutations[0].type === "custom") {
-					assert(this.#pusher, "A ZERO_MUTATE_URL must be set in order to process custom mutations.");
-					return [this.#pusher.enqueuePush(this.#syncContext.clientID, msg[1], viewSyncer.auth?.raw, this.#syncContext.httpCookie, this.#syncContext.origin)];
+					if (!this.#pusher) return [{
+						type: "fatal",
+						error: {
+							kind: InvalidPush,
+							message: "A ZERO_MUTATE_URL must be set in order to process custom mutations.",
+							origin: ZeroCache
+						}
+					}];
+					return [this.#pusher.enqueuePush(this.#connectionSelector, msg[1])];
 				}
-				const auth = viewSyncer.auth;
+				const mutagen = this.#mutagen;
+				if (!mutagen) return [{
+					type: "fatal",
+					error: {
+						kind: InvalidPush,
+						message: `Support for legacy CRUD mutations is disabled`,
+						origin: ZeroCache
+					}
+				}];
+				const auth = this.#contextManager.mustGetConnectionContext(this.#connectionSelector).auth;
 				assert(auth?.type !== "opaque", "Only JWT auth is supported for CRUD mutations");
 				return [await this.#mutationLock.withLock(async () => {
 					const errors = [];
 					for (const mutation of mutations) {
-						const maybeError = await this.#mutagen.processMutation(mutation, auth?.decoded, this.#pusher !== void 0);
+						const maybeError = await mutagen.processMutation(mutation, auth?.decoded, this.#pusher !== void 0);
 						if (maybeError !== void 0) errors.push({
 							kind: maybeError[0],
 							message: maybeError[1],
@@ -80,39 +102,43 @@ var SyncerWsMessageHandler = class {
 					};
 					return { type: "ok" };
 				})];
-			});
+			}));
 			case "changeDesiredQueries":
-				await startAsyncSpan(tracer, "connection.changeDesiredQueries", () => viewSyncer.changeDesiredQueries(this.#syncContext, msg));
+				await withTraceparent(msg[1].traceparent, () => startAsyncSpan(tracer, "connection.changeDesiredQueries", () => viewSyncer.changeDesiredQueries(this.#connectionSelector, msg)));
 				break;
 			case "updateAuth":
 				await startAsyncSpan(tracer, "connection.updateAuth", async () => {
-					await viewSyncer.updateAuth(this.#syncContext, msg);
+					const initialConnection = this.#contextManager.mustGetConnectionContext(this.#connectionSelector);
+					const authRevisionChanged = (await this.#contextManager.updateAuth(this.#connectionSelector, msg[1])).revision !== initialConnection.revision;
+					await viewSyncer.updateAuth(this.#connectionSelector, msg, authRevisionChanged);
 				});
 				break;
 			case "deleteClients": {
-				const deletedClientIDs = await startAsyncSpan(tracer, "connection.deleteClients", () => viewSyncer.deleteClients(this.#syncContext, msg));
-				if (this.#pusher && deletedClientIDs.length > 0) await this.#pusher.deleteClientMutations(deletedClientIDs);
+				const deletedClientIDs = await startAsyncSpan(tracer, "connection.deleteClients", () => viewSyncer.deleteClients(this.#connectionSelector, msg));
+				if (this.#pusher && deletedClientIDs.length > 0) await this.#pusher.deleteClientMutations(this.#connectionSelector, deletedClientIDs);
 				break;
 			}
-			case "initConnection": {
-				const ret = [{
-					type: "stream",
-					source: "viewSyncer",
-					stream: startSpan(tracer, "connection.initConnection", () => viewSyncer.initConnection(this.#syncContext, msg))
-				}];
-				if (this.#pusher) ret.push({
-					type: "stream",
-					source: "pusher",
-					stream: this.#pusher.initConnection(this.#syncContext.clientID, this.#syncContext.wsID, msg[1].userPushURL, msg[1].userPushHeaders, () => viewSyncer.clearAuth())
+			case "initConnection":
+				this.#contextManager.initConnection(this.#connectionSelector, msg[1]);
+				return withTraceparent(msg[1].traceparent, () => {
+					const ret = [{
+						type: "stream",
+						source: "viewSyncer",
+						stream: startSpan(tracer, "connection.initConnection", () => viewSyncer.initConnection(this.#connectionSelector, msg))
+					}];
+					if (this.#pusher) ret.push({
+						type: "stream",
+						source: "pusher",
+						stream: this.#pusher.initConnection(this.#connectionSelector)
+					});
+					return ret;
 				});
-				return ret;
-			}
 			case "closeConnection": break;
 			case "inspect":
-				await startAsyncSpan(tracer, "connection.inspect", () => viewSyncer.inspect(this.#syncContext, msg));
+				await startAsyncSpan(tracer, "connection.inspect", () => viewSyncer.inspect(this.#connectionSelector, msg));
 				break;
 			case "ackMutationResponses":
-				if (this.#pusher) await this.#pusher.ackMutationResponses(msg[1]);
+				if (this.#pusher) await this.#pusher.ackMutationResponses(this.#connectionSelector, msg[1]);
 				break;
 			default: unreachable(msgType);
 		}

package/out/zero-cache/src/workers/syncer-ws-message-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"syncer-ws-message-handler.js","names":["#viewSyncer","#mutagen","#mutationLock","#lc","#clientGroupID","#syncContext","#pusher"],"sources":["../../../../../zero-cache/src/workers/syncer-ws-message-handler.ts"],"sourcesContent":["import {trace} from '@opentelemetry/api';\nimport {Lock} from '@rocicorp/lock';\nimport type {LogContext} from '@rocicorp/logger';\nimport {startAsyncSpan, startSpan} from '../../../otel/src/span.ts';\nimport {version} from '../../../otel/src/version.ts';\nimport {assert, unreachable} from '../../../shared/src/asserts.ts';\nimport {ErrorKind} from '../../../zero-protocol/src/error-kind.ts';\nimport {ErrorOrigin} from '../../../zero-protocol/src/error-origin.ts';\nimport type {ErrorBody} from '../../../zero-protocol/src/error.ts';\nimport type {Upstream} from '../../../zero-protocol/src/up.ts';\nimport type {Mutagen} from '../services/mutagen/mutagen.ts';\nimport type {Pusher} from '../services/mutagen/pusher.ts';\nimport {\n  type SyncContext,\n  type ViewSyncer,\n} from '../services/view-syncer/view-syncer.ts';\nimport type {ConnectParams} from './connect-params.ts';\nimport type {HandlerResult, MessageHandler} from './connection.ts';\n\nconst tracer = trace.getTracer('syncer-ws-server', version);\n\nexport class SyncerWsMessageHandler implements MessageHandler {\n  readonly #viewSyncer: ViewSyncer;\n  readonly #mutagen: Mutagen;\n  readonly #mutationLock: Lock;\n  readonly #lc: LogContext;\n  readonly #clientGroupID: string;\n  readonly #syncContext: SyncContext;\n  readonly #pusher: Pusher | undefined;\n\n  constructor(\n    lc: LogContext,\n    connectParams: ConnectParams,\n    viewSyncer: ViewSyncer,\n    mutagen: Mutagen,\n    pusher: Pusher | undefined,\n  ) {\n    const {\n      clientGroupID,\n      clientID,\n      profileID,\n      wsID,\n      baseCookie,\n      protocolVersion,\n      httpCookie,\n      origin,\n      userID,\n    } = connectParams;\n    this.#viewSyncer = viewSyncer;\n    this.#mutagen = mutagen;\n    this.#mutationLock = new Lock();\n    this.#lc = lc\n      .withContext('connection')\n      .withContext('clientID', clientID)\n      .withContext('clientGroupID', clientGroupID)\n      .withContext('wsID', wsID);\n    this.#clientGroupID = clientGroupID;\n    this.#pusher = pusher;\n    this.#syncContext = {\n      clientID,\n      profileID,\n      wsID,\n      baseCookie,\n      protocolVersion,\n      httpCookie,\n      origin,\n      userID,\n    };\n  }\n\n  async handleMessage(msg: Upstream): Promise<HandlerResult[]> {\n    const lc = this.#lc;\n    const msgType = msg[0];\n    const viewSyncer = this.#viewSyncer;\n    switch (msgType) {\n      case 'ping':\n        lc.error?.('Ping is not supported at this layer by Zero');\n        break;\n      case 'pull':\n        lc.error?.('Pull is not supported by Zero');\n        break;\n      case 'push': {\n        return startAsyncSpan<HandlerResult[]>(\n          tracer,\n          'connection.push',\n          async () => {\n            const {clientGroupID, mutations, auth: pushAuth} = msg[1];\n            if (clientGroupID !== this.#clientGroupID) {\n              return [\n                {\n                  type: 'fatal',\n                  error: {\n                    kind: ErrorKind.InvalidPush,\n                    message:\n                      `clientGroupID in mutation \"${clientGroupID}\" does not match ` +\n                      `clientGroupID of connection \"${this.#clientGroupID}`,\n                    origin: ErrorOrigin.ZeroCache,\n                  },\n                } satisfies HandlerResult,\n              ];\n            }\n\n            // for backwards compatibility, if the push contains auth, we update it\n            if (pushAuth) {\n              await viewSyncer.updateAuth(this.#syncContext, [\n                'updateAuth',\n                {auth: pushAuth},\n              ]);\n            }\n\n            if (mutations.length === 0) {\n              return [\n                {\n                  type: 'ok',\n                },\n              ];\n            }\n\n            // The client only ever sends 1 mutation per push.\n            // #pusher will throw if it sees a CRUD mutation.\n            // #mutagen will throw if it see a custom mutation.\n            if (mutations[0].type === 'custom') {\n              assert(\n                this.#pusher,\n                'A ZERO_MUTATE_URL must be set in order to process custom mutations.',\n              );\n              return [\n                this.#pusher.enqueuePush(\n                  this.#syncContext.clientID,\n                  msg[1],\n                  viewSyncer.auth?.raw,\n                  this.#syncContext.httpCookie,\n                  this.#syncContext.origin,\n                ),\n              ];\n            }\n\n            const auth = viewSyncer.auth;\n            assert(\n              auth?.type !== 'opaque',\n              'Only JWT auth is supported for CRUD mutations',\n            );\n\n            // Hold a connection-level lock while processing mutations so that:\n            // 1. Mutations are processed in the order in which they are received and\n            // 2. A single view syncer connection cannot hog multiple upstream connections.\n            const ret = await this.#mutationLock.withLock(async () => {\n              const errors: ErrorBody[] = [];\n              for (const mutation of mutations) {\n                const maybeError = await this.#mutagen.processMutation(\n                  mutation,\n                  auth?.decoded,\n                  this.#pusher !== undefined,\n                );\n                if (maybeError !== undefined) {\n                  errors.push({\n                    kind: maybeError[0],\n                    message: maybeError[1],\n                    origin: ErrorOrigin.ZeroCache,\n                  });\n                }\n              }\n              if (errors.length > 0) {\n                return {type: 'transient', errors} satisfies HandlerResult;\n              }\n              return {type: 'ok'} satisfies HandlerResult;\n            });\n            return [ret];\n          },\n        );\n      }\n      case 'changeDesiredQueries':\n        await startAsyncSpan(tracer, 'connection.changeDesiredQueries', () =>\n          viewSyncer.changeDesiredQueries(this.#syncContext, msg),\n        );\n        break;\n      case 'updateAuth':\n        await startAsyncSpan(tracer, 'connection.updateAuth', async () => {\n          await viewSyncer.updateAuth(this.#syncContext, msg);\n        });\n        break;\n      case 'deleteClients': {\n        const deletedClientIDs = await startAsyncSpan(\n          tracer,\n          'connection.deleteClients',\n          () => viewSyncer.deleteClients(this.#syncContext, msg),\n        );\n        if (this.#pusher && deletedClientIDs.length > 0) {\n          await this.#pusher.deleteClientMutations(deletedClientIDs);\n        }\n        break;\n      }\n      case 'initConnection': {\n        const ret: HandlerResult[] = [\n          {\n            type: 'stream',\n            source: 'viewSyncer',\n            stream: startSpan(tracer, 'connection.initConnection', () =>\n              viewSyncer.initConnection(this.#syncContext, msg),\n            ),\n          },\n        ];\n\n        // Given we support both CRUD and Custom mutators,\n        // we do not initialize the `pusher` unless the user has opted\n        // into custom mutations. We detect that by checking\n        // if the pushURL has been set.\n        if (this.#pusher) {\n          ret.push({\n            type: 'stream',\n            source: 'pusher',\n            stream: this.#pusher.initConnection(\n              this.#syncContext.clientID,\n              this.#syncContext.wsID,\n              msg[1].userPushURL,\n              msg[1].userPushHeaders,\n              () => viewSyncer.clearAuth(),\n            ),\n          });\n        }\n\n        return ret;\n      }\n      case 'closeConnection':\n        // This message is deprecated and no longer used.\n        break;\n\n      case 'inspect':\n        await startAsyncSpan(tracer, 'connection.inspect', () =>\n          viewSyncer.inspect(this.#syncContext, msg),\n        );\n        break;\n\n      case 'ackMutationResponses':\n        if (this.#pusher) {\n          await this.#pusher.ackMutationResponses(msg[1]);\n        }\n        break;\n\n      default:\n        unreachable(msgType);\n    }\n\n    return [{type: 'ok'}];\n  }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAM,SAAS,MAAM,UAAU,oBAAoB,QAAQ;AAE3D,IAAa,yBAAb,MAA8D;CAC5D;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YACE,IACA,eACA,YACA,SACA,QACA;EACA,MAAM,EACJ,eACA,UACA,WACA,MACA,YACA,iBACA,YACA,QACA,WACE;AACJ,QAAA,aAAmB;AACnB,QAAA,UAAgB;AAChB,QAAA,eAAqB,IAAI,MAAM;AAC/B,QAAA,KAAW,GACR,YAAY,aAAa,CACzB,YAAY,YAAY,SAAS,CACjC,YAAY,iBAAiB,cAAc,CAC3C,YAAY,QAAQ,KAAK;AAC5B,QAAA,gBAAsB;AACtB,QAAA,SAAe;AACf,QAAA,cAAoB;GAClB;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACD;;CAGH,MAAM,cAAc,KAAyC;EAC3D,MAAM,KAAK,MAAA;EACX,MAAM,UAAU,IAAI;EACpB,MAAM,aAAa,MAAA;AACnB,UAAQ,SAAR;GACE,KAAK;AACH,OAAG,QAAQ,8CAA8C;AACzD;GACF,KAAK;AACH,OAAG,QAAQ,gCAAgC;AAC3C;GACF,KAAK,OACH,QAAO,eACL,QACA,mBACA,YAAY;IACV,MAAM,EAAC,eAAe,WAAW,MAAM,aAAY,IAAI;AACvD,QAAI,kBAAkB,MAAA,cACpB,QAAO,CACL;KACE,MAAM;KACN,OAAO;MACL,MAAM;MACN,SACE,8BAA8B,cAAc,gDACZ,MAAA;MAClC,QAAQ;MACT;KACF,CACF;AAIH,QAAI,SACF,OAAM,WAAW,WAAW,MAAA,aAAmB,CAC7C,cACA,EAAC,MAAM,UAAS,CACjB,CAAC;AAGJ,QAAI,UAAU,WAAW,EACvB,QAAO,CACL,EACE,MAAM,MACP,CACF;AAMH,QAAI,UAAU,GAAG,SAAS,UAAU;AAClC,YACE,MAAA,QACA,sEACD;AACD,YAAO,CACL,MAAA,OAAa,YACX,MAAA,YAAkB,UAClB,IAAI,IACJ,WAAW,MAAM,KACjB,MAAA,YAAkB,YAClB,MAAA,YAAkB,OACnB,CACF;;IAGH,MAAM,OAAO,WAAW;AACxB,WACE,MAAM,SAAS,UACf,gDACD;AA0BD,WAAO,CArBK,MAAM,MAAA,aAAmB,SAAS,YAAY;KACxD,MAAM,SAAsB,EAAE;AAC9B,UAAK,MAAM,YAAY,WAAW;MAChC,MAAM,aAAa,MAAM,MAAA,QAAc,gBACrC,UACA,MAAM,SACN,MAAA,WAAiB,KAAA,EAClB;AACD,UAAI,eAAe,KAAA,EACjB,QAAO,KAAK;OACV,MAAM,WAAW;OACjB,SAAS,WAAW;OACpB,QAAQ;OACT,CAAC;;AAGN,SAAI,OAAO,SAAS,EAClB,QAAO;MAAC,MAAM;MAAa;MAAO;AAEpC,YAAO,EAAC,MAAM,MAAK;MACnB,CACU;KAEf;GAEH,KAAK;AACH,UAAM,eAAe,QAAQ,yCAC3B,WAAW,qBAAqB,MAAA,aAAmB,IAAI,CACxD;AACD;GACF,KAAK;AACH,UAAM,eAAe,QAAQ,yBAAyB,YAAY;AAChE,WAAM,WAAW,WAAW,MAAA,aAAmB,IAAI;MACnD;AACF;GACF,KAAK,iBAAiB;IACpB,MAAM,mBAAmB,MAAM,eAC7B,QACA,kCACM,WAAW,cAAc,MAAA,aAAmB,IAAI,CACvD;AACD,QAAI,MAAA,UAAgB,iBAAiB,SAAS,EAC5C,OAAM,MAAA,OAAa,sBAAsB,iBAAiB;AAE5D;;GAEF,KAAK,kBAAkB;IACrB,MAAM,MAAuB,CAC3B;KACE,MAAM;KACN,QAAQ;KACR,QAAQ,UAAU,QAAQ,mCACxB,WAAW,eAAe,MAAA,aAAmB,IAAI,CAClD;KACF,CACF;AAMD,QAAI,MAAA,OACF,KAAI,KAAK;KACP,MAAM;KACN,QAAQ;KACR,QAAQ,MAAA,OAAa,eACnB,MAAA,YAAkB,UAClB,MAAA,YAAkB,MAClB,IAAI,GAAG,aACP,IAAI,GAAG,uBACD,WAAW,WAAW,CAC7B;KACF,CAAC;AAGJ,WAAO;;GAET,KAAK,kBAEH;GAEF,KAAK;AACH,UAAM,eAAe,QAAQ,4BAC3B,WAAW,QAAQ,MAAA,aAAmB,IAAI,CAC3C;AACD;GAEF,KAAK;AACH,QAAI,MAAA,OACF,OAAM,MAAA,OAAa,qBAAqB,IAAI,GAAG;AAEjD;GAEF,QACE,aAAY,QAAQ;;AAGxB,SAAO,CAAC,EAAC,MAAM,MAAK,CAAC"}
+{"version":3,"file":"syncer-ws-message-handler.js","names":["#viewSyncer","#mutagen","#mutationLock","#lc","#clientGroupID","#connectionSelector","#contextManager","#pusher"],"sources":["../../../../../zero-cache/src/workers/syncer-ws-message-handler.ts"],"sourcesContent":["import {ROOT_CONTEXT, context, propagation, trace} from '@opentelemetry/api';\nimport {Lock} from '@rocicorp/lock';\nimport type {LogContext} from '@rocicorp/logger';\nimport {startAsyncSpan, startSpan} from '../../../otel/src/span.ts';\nimport {version} from '../../../otel/src/version.ts';\nimport {assert, unreachable} from '../../../shared/src/asserts.ts';\nimport {ErrorKind} from '../../../zero-protocol/src/error-kind.ts';\nimport {ErrorOrigin} from '../../../zero-protocol/src/error-origin.ts';\nimport type {ErrorBody} from '../../../zero-protocol/src/error.ts';\nimport type {Upstream} from '../../../zero-protocol/src/up.ts';\nimport type {Mutagen} from '../services/mutagen/mutagen.ts';\nimport type {Pusher} from '../services/mutagen/pusher.ts';\nimport {\n  type ConnectionContextManager,\n  type ConnectionSelector,\n} from '../services/view-syncer/connection-context-manager.ts';\nimport {type ViewSyncer} from '../services/view-syncer/view-syncer.ts';\nimport type {ConnectParams} from './connect-params.ts';\nimport type {HandlerResult, MessageHandler} from './connection.ts';\n\nconst tracer = trace.getTracer('syncer-ws-server', version);\n\n/**\n * Wraps a function in an OTEL context extracted from a W3C traceparent header.\n * This enables distributed tracing from the client through zero-cache to\n * the user's API server.\n */\nfunction withTraceparent<T>(traceparent: string | undefined, fn: () => T): T {\n  if (!traceparent) {\n    return fn();\n  }\n  const extracted = propagation.extract(ROOT_CONTEXT, {traceparent});\n  return context.with(extracted, fn);\n}\n\nexport class SyncerWsMessageHandler implements MessageHandler {\n  readonly #viewSyncer: ViewSyncer;\n  readonly #mutagen: Mutagen | undefined;\n  readonly #mutationLock: Lock;\n  readonly #lc: LogContext;\n  readonly #clientGroupID: string;\n  readonly #connectionSelector: ConnectionSelector;\n  readonly #contextManager: ConnectionContextManager;\n  readonly #pusher: Pusher | undefined;\n\n  constructor(\n    lc: LogContext,\n    connectParams: ConnectParams,\n    contextManager: ConnectionContextManager,\n    viewSyncer: ViewSyncer,\n    mutagen: Mutagen | undefined,\n    pusher: Pusher | undefined,\n  ) {\n    const {clientGroupID, clientID, wsID} = connectParams;\n    this.#viewSyncer = viewSyncer;\n    this.#mutagen = mutagen;\n    this.#contextManager = contextManager;\n    this.#mutationLock = new Lock();\n    this.#lc = lc\n      .withContext('connection')\n      .withContext('clientID', clientID)\n      .withContext('clientGroupID', clientGroupID)\n      .withContext('wsID', wsID);\n    this.#clientGroupID = clientGroupID;\n    this.#pusher = pusher;\n    this.#connectionSelector = {\n      clientID,\n      wsID,\n    };\n  }\n\n  async handleMessage(msg: Upstream): Promise<HandlerResult[]> {\n    const lc = this.#lc;\n    const msgType = msg[0];\n    const viewSyncer = this.#viewSyncer;\n    switch (msgType) {\n      case 'ping':\n        lc.error?.('Ping is not supported at this layer by Zero');\n        break;\n      case 'pull':\n        lc.error?.('Pull is not supported by Zero');\n        break;\n      case 'push': {\n        return withTraceparent(msg[1].traceparent, () =>\n          startAsyncSpan<HandlerResult[]>(\n            tracer,\n            'connection.push',\n            async () => {\n              const {clientGroupID, mutations} = msg[1];\n              if (clientGroupID !== this.#clientGroupID) {\n                return [\n                  {\n                    type: 'fatal',\n                    error: {\n                      kind: ErrorKind.InvalidPush,\n                      message:\n                        `clientGroupID in mutation \"${clientGroupID}\" does not match ` +\n                        `clientGroupID of connection \"${this.#clientGroupID}`,\n                      origin: ErrorOrigin.ZeroCache,\n                    },\n                  } satisfies HandlerResult,\n                ];\n              }\n\n              if (mutations.length === 0) {\n                return [\n                  {\n                    type: 'ok',\n                  },\n                ];\n              }\n\n              // The client only ever sends 1 mutation per push.\n              // #pusher will throw if it sees a CRUD mutation.\n              // #mutagen will throw if it see a custom mutation.\n              if (mutations[0].type === 'custom') {\n                if (!this.#pusher) {\n                  return [\n                    {\n                      type: 'fatal',\n                      error: {\n                        kind: ErrorKind.InvalidPush,\n                        message:\n                          'A ZERO_MUTATE_URL must be set in order to process custom mutations.',\n                        origin: ErrorOrigin.ZeroCache,\n                      },\n                    } satisfies HandlerResult,\n                  ];\n                }\n                return [\n                  this.#pusher.enqueuePush(this.#connectionSelector, msg[1]),\n                ];\n              }\n\n              const mutagen = this.#mutagen;\n              if (!mutagen) {\n                return [\n                  {\n                    type: 'fatal',\n                    error: {\n                      kind: ErrorKind.InvalidPush,\n                      message: `Support for legacy CRUD mutations is disabled`,\n                      origin: ErrorOrigin.ZeroCache,\n                    },\n                  } satisfies HandlerResult,\n                ];\n              }\n\n              const auth = this.#contextManager.mustGetConnectionContext(\n                this.#connectionSelector,\n              ).auth;\n              assert(\n                auth?.type !== 'opaque',\n                'Only JWT auth is supported for CRUD mutations',\n              );\n\n              // Hold a connection-level lock while processing mutations so that:\n              // 1. Mutations are processed in the order in which they are received and\n              // 2. A single view syncer connection cannot hog multiple upstream connections.\n              const ret = await this.#mutationLock.withLock(async () => {\n                const errors: ErrorBody[] = [];\n                for (const mutation of mutations) {\n                  const maybeError = await mutagen.processMutation(\n                    mutation,\n                    auth?.decoded,\n                    this.#pusher !== undefined,\n                  );\n                  if (maybeError !== undefined) {\n                    errors.push({\n                      kind: maybeError[0],\n                      message: maybeError[1],\n                      origin: ErrorOrigin.ZeroCache,\n                    });\n                  }\n                }\n                if (errors.length > 0) {\n                  return {type: 'transient', errors} satisfies HandlerResult;\n                }\n                return {type: 'ok'} satisfies HandlerResult;\n              });\n              return [ret];\n            },\n          ),\n        );\n      }\n      case 'changeDesiredQueries':\n        await withTraceparent(msg[1].traceparent, () =>\n          startAsyncSpan(tracer, 'connection.changeDesiredQueries', () =>\n            viewSyncer.changeDesiredQueries(this.#connectionSelector, msg),\n          ),\n        );\n        break;\n      case 'updateAuth':\n        await startAsyncSpan(tracer, 'connection.updateAuth', async () => {\n          const initialConnection =\n            this.#contextManager.mustGetConnectionContext(\n              this.#connectionSelector,\n            );\n          const updatedConnection = await this.#contextManager.updateAuth(\n            this.#connectionSelector,\n            msg[1],\n          );\n          const authRevisionChanged =\n            updatedConnection.revision !== initialConnection.revision;\n\n          await viewSyncer.updateAuth(\n            this.#connectionSelector,\n            msg,\n            authRevisionChanged,\n          );\n        });\n        break;\n      case 'deleteClients': {\n        const deletedClientIDs = await startAsyncSpan(\n          tracer,\n          'connection.deleteClients',\n          () => viewSyncer.deleteClients(this.#connectionSelector, msg),\n        );\n        if (this.#pusher && deletedClientIDs.length > 0) {\n          await this.#pusher.deleteClientMutations(\n            this.#connectionSelector,\n            deletedClientIDs,\n          );\n        }\n        break;\n      }\n      case 'initConnection': {\n        this.#contextManager.initConnection(this.#connectionSelector, msg[1]);\n        return withTraceparent(msg[1].traceparent, () => {\n          const ret: HandlerResult[] = [\n            {\n              type: 'stream',\n              source: 'viewSyncer',\n              stream: startSpan(tracer, 'connection.initConnection', () =>\n                viewSyncer.initConnection(this.#connectionSelector, msg),\n              ),\n            },\n          ];\n\n          // Given we support both CRUD and Custom mutators,\n          // we do not initialize the `pusher` unless the user has opted\n          // into custom mutations. We detect that by checking\n          // if the pushURL has been set.\n          if (this.#pusher) {\n            ret.push({\n              type: 'stream',\n              source: 'pusher',\n              stream: this.#pusher.initConnection(this.#connectionSelector),\n            });\n          }\n\n          return ret;\n        });\n      }\n      case 'closeConnection':\n        // This message is deprecated and no longer used.\n        break;\n\n      case 'inspect':\n        await startAsyncSpan(tracer, 'connection.inspect', () =>\n          viewSyncer.inspect(this.#connectionSelector, msg),\n        );\n        break;\n\n      case 'ackMutationResponses':\n        if (this.#pusher) {\n          await this.#pusher.ackMutationResponses(\n            this.#connectionSelector,\n            msg[1],\n          );\n        }\n        break;\n\n      default:\n        unreachable(msgType);\n    }\n\n    return [{type: 'ok'}];\n  }\n}\n"],"mappings":";;;;;;;;;;AAoBA,IAAM,SAAS,MAAM,UAAU,oBAAoB,QAAQ;;;;;;AAO3D,SAAS,gBAAmB,aAAiC,IAAgB;AAC3E,KAAI,CAAC,YACH,QAAO,IAAI;CAEb,MAAM,YAAY,YAAY,QAAQ,cAAc,EAAC,aAAY,CAAC;AAClE,QAAO,QAAQ,KAAK,WAAW,GAAG;;AAGpC,IAAa,yBAAb,MAA8D;CAC5D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YACE,IACA,eACA,gBACA,YACA,SACA,QACA;EACA,MAAM,EAAC,eAAe,UAAU,SAAQ;AACxC,QAAA,aAAmB;AACnB,QAAA,UAAgB;AAChB,QAAA,iBAAuB;AACvB,QAAA,eAAqB,IAAI,MAAM;AAC/B,QAAA,KAAW,GACR,YAAY,aAAa,CACzB,YAAY,YAAY,SAAS,CACjC,YAAY,iBAAiB,cAAc,CAC3C,YAAY,QAAQ,KAAK;AAC5B,QAAA,gBAAsB;AACtB,QAAA,SAAe;AACf,QAAA,qBAA2B;GACzB;GACA;GACD;;CAGH,MAAM,cAAc,KAAyC;EAC3D,MAAM,KAAK,MAAA;EACX,MAAM,UAAU,IAAI;EACpB,MAAM,aAAa,MAAA;AACnB,UAAQ,SAAR;GACE,KAAK;AACH,OAAG,QAAQ,8CAA8C;AACzD;GACF,KAAK;AACH,OAAG,QAAQ,gCAAgC;AAC3C;GACF,KAAK,OACH,QAAO,gBAAgB,IAAI,GAAG,mBAC5B,eACE,QACA,mBACA,YAAY;IACV,MAAM,EAAC,eAAe,cAAa,IAAI;AACvC,QAAI,kBAAkB,MAAA,cACpB,QAAO,CACL;KACE,MAAM;KACN,OAAO;MACL,MAAM;MACN,SACE,8BAA8B,cAAc,gDACZ,MAAA;MAClC,QAAQ;MACT;KACF,CACF;AAGH,QAAI,UAAU,WAAW,EACvB,QAAO,CACL,EACE,MAAM,MACP,CACF;AAMH,QAAI,UAAU,GAAG,SAAS,UAAU;AAClC,SAAI,CAAC,MAAA,OACH,QAAO,CACL;MACE,MAAM;MACN,OAAO;OACL,MAAM;OACN,SACE;OACF,QAAQ;OACT;MACF,CACF;AAEH,YAAO,CACL,MAAA,OAAa,YAAY,MAAA,oBAA0B,IAAI,GAAG,CAC3D;;IAGH,MAAM,UAAU,MAAA;AAChB,QAAI,CAAC,QACH,QAAO,CACL;KACE,MAAM;KACN,OAAO;MACL,MAAM;MACN,SAAS;MACT,QAAQ;MACT;KACF,CACF;IAGH,MAAM,OAAO,MAAA,eAAqB,yBAChC,MAAA,mBACD,CAAC;AACF,WACE,MAAM,SAAS,UACf,gDACD;AA0BD,WAAO,CArBK,MAAM,MAAA,aAAmB,SAAS,YAAY;KACxD,MAAM,SAAsB,EAAE;AAC9B,UAAK,MAAM,YAAY,WAAW;MAChC,MAAM,aAAa,MAAM,QAAQ,gBAC/B,UACA,MAAM,SACN,MAAA,WAAiB,KAAA,EAClB;AACD,UAAI,eAAe,KAAA,EACjB,QAAO,KAAK;OACV,MAAM,WAAW;OACjB,SAAS,WAAW;OACpB,QAAQ;OACT,CAAC;;AAGN,SAAI,OAAO,SAAS,EAClB,QAAO;MAAC,MAAM;MAAa;MAAO;AAEpC,YAAO,EAAC,MAAM,MAAK;MACnB,CACU;KAEf,CACF;GAEH,KAAK;AACH,UAAM,gBAAgB,IAAI,GAAG,mBAC3B,eAAe,QAAQ,yCACrB,WAAW,qBAAqB,MAAA,oBAA0B,IAAI,CAC/D,CACF;AACD;GACF,KAAK;AACH,UAAM,eAAe,QAAQ,yBAAyB,YAAY;KAChE,MAAM,oBACJ,MAAA,eAAqB,yBACnB,MAAA,mBACD;KAKH,MAAM,uBAJoB,MAAM,MAAA,eAAqB,WACnD,MAAA,oBACA,IAAI,GACL,EAEmB,aAAa,kBAAkB;AAEnD,WAAM,WAAW,WACf,MAAA,oBACA,KACA,oBACD;MACD;AACF;GACF,KAAK,iBAAiB;IACpB,MAAM,mBAAmB,MAAM,eAC7B,QACA,kCACM,WAAW,cAAc,MAAA,oBAA0B,IAAI,CAC9D;AACD,QAAI,MAAA,UAAgB,iBAAiB,SAAS,EAC5C,OAAM,MAAA,OAAa,sBACjB,MAAA,oBACA,iBACD;AAEH;;GAEF,KAAK;AACH,UAAA,eAAqB,eAAe,MAAA,oBAA0B,IAAI,GAAG;AACrE,WAAO,gBAAgB,IAAI,GAAG,mBAAmB;KAC/C,MAAM,MAAuB,CAC3B;MACE,MAAM;MACN,QAAQ;MACR,QAAQ,UAAU,QAAQ,mCACxB,WAAW,eAAe,MAAA,oBAA0B,IAAI,CACzD;MACF,CACF;AAMD,SAAI,MAAA,OACF,KAAI,KAAK;MACP,MAAM;MACN,QAAQ;MACR,QAAQ,MAAA,OAAa,eAAe,MAAA,mBAAyB;MAC9D,CAAC;AAGJ,YAAO;MACP;GAEJ,KAAK,kBAEH;GAEF,KAAK;AACH,UAAM,eAAe,QAAQ,4BAC3B,WAAW,QAAQ,MAAA,oBAA0B,IAAI,CAClD;AACD;GAEF,KAAK;AACH,QAAI,MAAA,OACF,OAAM,MAAA,OAAa,qBACjB,MAAA,oBACA,IAAI,GACL;AAEH;GAEF,QACE,aAAY,QAAQ;;AAGxB,SAAO,CAAC,EAAC,MAAM,MAAK,CAAC"}

package/out/zero-cache/src/workers/syncer.d.ts

@@ -6,6 +6,7 @@ import type { Mutagen } from '../services/mutagen/mutagen.ts';
 import type { Pusher } from '../services/mutagen/pusher.ts';
 import type { ReplicaState } from '../services/replicator/replicator.ts';
 import type { ActivityBasedService, Service, SingletonService } from '../services/service.ts';
+import type { ConnectionContextManager } from '../services/view-syncer/connection-context-manager.ts';
 import { DrainCoordinator } from '../services/view-syncer/drain-coordinator.ts';
 import type { ViewSyncer } from '../services/view-syncer/view-syncer.ts';
 import type { Worker } from '../types/processes.ts';
@@ -23,7 +24,7 @@ export type SyncerWorkerData = {
 export declare class Syncer implements SingletonService {
     #private;
     readonly id: string;
-    constructor(lc: LogContext, config: ZeroConfig, viewSyncerFactory: (id: string, sub: Subscription<ReplicaState>, drainCoordinator: DrainCoordinator, validateLegacyJWT: ValidateLegacyJWT | undefined) => ViewSyncer & ActivityBasedService, mutagenFactory: (id: string) => Mutagen & Service, pusherFactory: ((id: string) => Pusher & Service) | undefined, parent: Worker);
+    constructor(lc: LogContext, config: ZeroConfig, viewSyncerFactory: (id: string, sub: Subscription<ReplicaState>, drainCoordinator: DrainCoordinator) => ViewSyncer & ActivityBasedService, mutagenFactory: ((id: string) => Mutagen & Service) | undefined, pusherFactory: ((id: string, contextManager: ConnectionContextManager) => Pusher & Service) | undefined, parent: Worker, validateLegacyJWT: ValidateLegacyJWT | undefined);
     run(): Promise<void>;
     /**
      * Graceful shutdown involves shutting down view syncers one at a time, pausing

package/out/zero-cache/src/workers/syncer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"syncer.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/workers/syncer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAGjD,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAC,KAAK,iBAAiB,EAAC,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAC,KAAK,UAAU,EAAC,MAAM,0BAA0B,CAAC;AAMzD,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,+BAA+B,CAAC;AAC1D,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,sCAAsC,CAAC;AAEvE,OAAO,KAAK,EACV,oBAAoB,EACpB,OAAO,EACP,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAC,gBAAgB,EAAC,MAAM,8CAA8C,CAAC;AAC9E,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,wCAAwC,CAAC;AACvE,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,uBAAuB,CAAC;AAClD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAO3D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,cAAc,EAAE,WAAW,CAAC;CAC7B,CAAC;AA4BF;;;;;;GAMG;AACH,qBAAa,MAAO,YAAW,gBAAgB;;IAC7C,QAAQ,CAAC,EAAE,SAAmB;gBAa5B,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,UAAU,EAClB,iBAAiB,EAAE,CACjB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,YAAY,CAAC,YAAY,CAAC,EAC/B,gBAAgB,EAAE,gBAAgB,EAClC,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,KAC7C,UAAU,GAAG,oBAAoB,EACtC,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,EACjD,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,GAAG,SAAS,EAC7D,MAAM,EAAE,MAAM;IA4IhB,GAAG;IAIH;;;;;OAKG;IACG,KAAK;IAqBX,IAAI;CA4BL"}
+{"version":3,"file":"syncer.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/workers/syncer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAGjD,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,qBAAqB,CAAC;AASrD,OAAO,EAAyB,KAAK,iBAAiB,EAAC,MAAM,iBAAiB,CAAC;AAE/E,OAAO,EAAC,KAAK,UAAU,EAAC,MAAM,0BAA0B,CAAC;AAOzD,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,+BAA+B,CAAC;AAC1D,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,sCAAsC,CAAC;AAEvE,OAAO,KAAK,EACV,oBAAoB,EACpB,OAAO,EACP,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,uDAAuD,CAAC;AACpG,OAAO,EAAC,gBAAgB,EAAC,MAAM,8CAA8C,CAAC;AAC9E,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,wCAAwC,CAAC;AACvE,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,uBAAuB,CAAC;AAClD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAO3D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,cAAc,EAAE,WAAW,CAAC;CAC7B,CAAC;AA4BF;;;;;;GAMG;AACH,qBAAa,MAAO,YAAW,gBAAgB;;IAC7C,QAAQ,CAAC,EAAE,SAAmB;gBAc5B,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,UAAU,EAClB,iBAAiB,EAAE,CACjB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,YAAY,CAAC,YAAY,CAAC,EAC/B,gBAAgB,EAAE,gBAAgB,KAC/B,UAAU,GAAG,oBAAoB,EACtC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,GAAG,SAAS,EAC/D,aAAa,EACT,CAAC,CACC,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,wBAAwB,KACrC,MAAM,GAAG,OAAO,CAAC,GACtB,SAAS,EACb,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,iBAAiB,GAAG,SAAS;IAsOlD,GAAG;IAIH;;;;;OAKG;IACG,KAAK;IAqBX,IAAI;CAKL"}

package/out/zero-cache/src/workers/syncer.js

@@ -1,10 +1,14 @@
 import { promiseVoid } from "../../../shared/src/resolved-promises.js";
+import { Unauthorized } from "../../../zero-protocol/src/error-kind-enum.js";
+import { ZeroCache } from "../../../zero-protocol/src/error-origin-enum.js";
+import { ProtocolError, isProtocolError } from "../../../zero-protocol/src/error.js";
 import "../config/zero-config.js";
 import { installWebSocketReceiver } from "../types/websocket-handoff.js";
+import { getOrCreateGauge } from "../observability/metrics.js";
 import { createNotifierFrom, subscribeTo } from "./replicator.js";
 import { recordConnectionAttempted, recordConnectionSuccess, setActiveClientGroupsGetter } from "../server/anonymous-otel-start.js";
-import "../auth/auth.js";
-import { tokenConfigOptions, verifyToken } from "../auth/jwt.js";
+import { resolveAuth } from "../auth/auth.js";
+import { tokenConfigOptions } from "../auth/jwt.js";
 import { ServiceRunner } from "../services/runner.js";
 import { DrainCoordinator } from "../services/view-syncer/drain-coordinator.js";
 import { Connection, sendError } from "./connection.js";
@@ -47,34 +51,72 @@ var Syncer = class {
 	#wss;
 	#stopped = resolver();
 	#config;
-	constructor(lc, config, viewSyncerFactory, mutagenFactory, pusherFactory, parent) {
+	#validateLegacyJWT;
+	constructor(lc, config, viewSyncerFactory, mutagenFactory, pusherFactory, parent, validateLegacyJWT) {
 		this.#config = config;
+		this.#validateLegacyJWT = validateLegacyJWT;
 		const notifier = createNotifierFrom(lc, parent);
 		subscribeTo(lc, parent);
 		this.#lc = lc;
-		this.#viewSyncers = new ServiceRunner(lc, (id) => viewSyncerFactory(id, notifier.subscribe(), this.#drainCoordinator, this.#validateLegacyJWT()), (v) => v.keepalive());
-		this.#mutagens = new ServiceRunner(lc, mutagenFactory, (m) => m.hasRefs());
-		if (pusherFactory) this.#pushers = new ServiceRunner(lc, pusherFactory, (p) => p.hasRefs());
+		this.#viewSyncers = new ServiceRunner(lc, (id) => viewSyncerFactory(id, notifier.subscribe(), this.#drainCoordinator), (v) => v.keepalive());
+		if (mutagenFactory) this.#mutagens = new ServiceRunner(lc, mutagenFactory, (m) => m.hasRefs());
+		if (pusherFactory) this.#pushers = new ServiceRunner(lc, (id) => pusherFactory(id, this.#viewSyncers.getService(id).contextManager), (p) => p.hasRefs());
 		this.#parent = parent;
 		this.#wss = new WebSocketServer(getWebSocketServerOptions(config));
 		installWebSocketReceiver(lc, this.#wss, this.#createConnection, this.#parent);
 		setActiveClientGroupsGetter(() => this.#viewSyncers.size);
+		getOrCreateGauge("sync", "active-client-groups", "Number of active client groups").addCallback((result) => result.observe(this.#viewSyncers.size));
+		getOrCreateGauge("sync", "queries", "Active queries (pipelines) across all client groups").addCallback((result) => {
+			let total = 0;
+			for (const vs of this.#viewSyncers.getServices()) total += vs.queryCount;
+			result.observe(total);
+		});
+		getOrCreateGauge("sync", "rows", "Tracked rows across all client groups").addCallback((result) => {
+			let total = 0;
+			for (const vs of this.#viewSyncers.getServices()) total += vs.rowCount;
+			result.observe(total);
+		});
 	}
 	#createConnection = async (ws, params) => {
 		this.#lc.debug?.("creating connection", params.clientGroupID, params.clientID);
 		recordConnectionAttempted();
 		const { clientID, clientGroupID, auth, userID } = params;
-		if (auth !== void 0 && auth !== "") {
+		const hasProvidedAuth = auth !== void 0 && auth !== "";
+		if (hasProvidedAuth) {
 			const tokenOptions = tokenConfigOptions(this.#config.auth ?? {});
 			const hasPushOrMutate = this.#config?.push?.url !== void 0 || this.#config?.mutate?.url !== void 0;
 			const hasQueries = this.#config?.query?.url !== void 0 || this.#config?.getQueries?.url !== void 0;
 			if (!(tokenOptions.length === 1) && !(hasPushOrMutate && hasQueries)) throw new Error("Exactly one of jwk, secret, or jwksUrl must be set in order to verify tokens but actually the following were set: " + JSON.stringify(tokenOptions) + ". You may also set both ZERO_MUTATE_URL and ZERO_QUERY_URL to enable custom mutations and queries without passing token verification options.");
 		}
+		let initialAuth;
+		try {
+			initialAuth = await resolveAuth(this.#lc.withContext("clientGroupID", clientGroupID).withContext("clientID", clientID), void 0, userID, auth, this.#validateLegacyJWT);
+		} catch (e) {
+			if (isProtocolError(e)) {
+				this.#lc.warn?.("Rejecting sync connection during initial auth resolution", {
+					clientGroupID,
+					clientID,
+					userID,
+					hasProvidedAuth,
+					errorKind: e.message
+				});
+				sendError(this.#lc, ws, e.errorBody);
+				ws.close(3e3, e.errorBody.message);
+				return;
+			}
+			throw e;
+		}
 		const viewSyncer = this.#viewSyncers.getService(clientGroupID);
-		const authResult = await viewSyncer.initAuthSession(userID, auth);
-		if (!authResult.ok) {
-			sendError(this.#lc, ws, authResult.error);
-			ws.close(3e3, authResult.error.message);
+		const contextManager = viewSyncer.contextManager;
+		const group = contextManager.getGroupState();
+		if (group.validated && group.userID !== userID) {
+			const error = new ProtocolError({
+				kind: Unauthorized,
+				message: "Client groups are pinned to a single userID. Connection userID does not match existing client group userID.",
+				origin: ZeroCache
+			});
+			sendError(this.#lc, ws, error.errorBody);
+			ws.close(3e3, error.message);
 			return;
 		}
 		const existing = this.#connections.get(clientID);
@@ -82,19 +124,31 @@ var Syncer = class {
 			this.#lc.debug?.(`client ${clientID} already connected, closing existing connection`);
 			existing.close(`replaced by ${params.wsID}`);
 		}
-		const mutagen = this.#mutagens.getService(clientGroupID);
+		contextManager.registerConnection({
+			clientID,
+			wsID: params.wsID
+		}, params, initialAuth);
+		const mutagen = this.#mutagens?.getService(clientGroupID);
 		const pusher = this.#pushers?.getService(clientGroupID);
-		mutagen.ref();
+		mutagen?.ref();
 		pusher?.ref();
 		let connection;
 		try {
-			connection = new Connection(this.#lc, params, ws, new SyncerWsMessageHandler(this.#lc, params, viewSyncer, mutagen, pusher), () => {
+			connection = new Connection(this.#lc, params, ws, new SyncerWsMessageHandler(this.#lc, params, contextManager, viewSyncer, mutagen, pusher), () => {
+				contextManager.closeConnection({
+					clientID,
+					wsID: params.wsID
+				});
 				if (this.#connections.get(clientID) === connection) this.#connections.delete(clientID);
-				mutagen.unref();
+				mutagen?.unref();
 				pusher?.unref();
 			});
 		} catch (e) {
-			mutagen.unref();
+			contextManager.closeConnection({
+				clientID,
+				wsID: params.wsID
+			});
+			mutagen?.unref();
 			pusher?.unref();
 			throw e;
 		}
@@ -133,21 +187,6 @@ var Syncer = class {
 		this.#stopped.resolve();
 		return promiseVoid;
 	}
-	/** @deprecated used in JWT validation */
-	#validateLegacyJWT() {
-		if (tokenConfigOptions(this.#config.auth ?? {}).length !== 1) return;
-		return async (token, { userID }) => {
-			return {
-				type: "jwt",
-				raw: token,
-				decoded: await verifyToken(this.#config.auth, token, {
-					subject: userID,
-					...this.#config.auth?.issuer && { issuer: this.#config.auth.issuer },
-					...this.#config.auth?.audience && { audience: this.#config.auth.audience }
-				})
-			};
-		};
-	}
 };
 //#endregion
 export { Syncer };

package/out/zero-cache/src/workers/syncer.js.map

@@ -1 +1 @@
-{"version":3,"file":"syncer.js","names":["#lc","#viewSyncers","#mutagens","#pushers","#connections","#drainCoordinator","#parent","#wss","#stopped","#config","#validateLegacyJWT","#createConnection"],"sources":["../../../../../zero-cache/src/workers/syncer.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {resolver} from '@rocicorp/resolver';\nimport {pid} from 'node:process';\nimport type {MessagePort} from 'node:worker_threads';\nimport {WebSocketServer, type ServerOptions, type WebSocket} from 'ws';\nimport {promiseVoid} from '../../../shared/src/resolved-promises.ts';\nimport {type ValidateLegacyJWT} from '../auth/auth.ts';\nimport {tokenConfigOptions, verifyToken} from '../auth/jwt.ts';\nimport {type ZeroConfig} from '../config/zero-config.ts';\nimport {\n  recordConnectionAttempted,\n  recordConnectionSuccess,\n  setActiveClientGroupsGetter,\n} from '../server/anonymous-otel-start.ts';\nimport type {Mutagen} from '../services/mutagen/mutagen.ts';\nimport type {Pusher} from '../services/mutagen/pusher.ts';\nimport type {ReplicaState} from '../services/replicator/replicator.ts';\nimport {ServiceRunner} from '../services/runner.ts';\nimport type {\n  ActivityBasedService,\n  Service,\n  SingletonService,\n} from '../services/service.ts';\nimport {DrainCoordinator} from '../services/view-syncer/drain-coordinator.ts';\nimport type {ViewSyncer} from '../services/view-syncer/view-syncer.ts';\nimport type {Worker} from '../types/processes.ts';\nimport type {Subscription} from '../types/subscription.ts';\nimport {installWebSocketReceiver} from '../types/websocket-handoff.ts';\nimport type {ConnectParams} from './connect-params.ts';\nimport {Connection, sendError} from './connection.ts';\nimport {createNotifierFrom, subscribeTo} from './replicator.ts';\nimport {SyncerWsMessageHandler} from './syncer-ws-message-handler.ts';\n\nexport type SyncerWorkerData = {\n  replicatorPort: MessagePort;\n};\n\nfunction getWebSocketServerOptions(config: ZeroConfig): ServerOptions {\n  const options: ServerOptions = {\n    noServer: true,\n    maxPayload: config.websocketMaxPayloadBytes,\n  };\n\n  if (config.websocketCompression) {\n    options.perMessageDeflate = true;\n\n    if (config.websocketCompressionOptions) {\n      try {\n        const compressionOptions = JSON.parse(\n          config.websocketCompressionOptions,\n        );\n        options.perMessageDeflate = compressionOptions;\n      } catch (e) {\n        throw new Error(\n          `Failed to parse ZERO_WEBSOCKET_COMPRESSION_OPTIONS: ${String(e)}. Expected valid JSON.`,\n        );\n      }\n    }\n  }\n\n  return options;\n}\n\n/**\n * The Syncer worker receives websocket handoffs for \"/sync\" connections\n * from the Dispatcher in the main thread, and creates websocket\n * {@link Connection}s with a corresponding {@link ViewSyncer}, {@link Mutagen},\n * and {@link Subscription} to version notifications from the Replicator\n * worker.\n */\nexport class Syncer implements SingletonService {\n  readonly id = `syncer-${pid}`;\n  readonly #lc: LogContext;\n  readonly #viewSyncers: ServiceRunner<ViewSyncer & ActivityBasedService>;\n  readonly #mutagens: ServiceRunner<Mutagen & Service>;\n  readonly #pushers: ServiceRunner<Pusher & Service> | undefined;\n  readonly #connections = new Map<string, Connection>();\n  readonly #drainCoordinator = new DrainCoordinator();\n  readonly #parent: Worker;\n  readonly #wss: WebSocketServer;\n  readonly #stopped = resolver();\n  readonly #config: ZeroConfig;\n\n  constructor(\n    lc: LogContext,\n    config: ZeroConfig,\n    viewSyncerFactory: (\n      id: string,\n      sub: Subscription<ReplicaState>,\n      drainCoordinator: DrainCoordinator,\n      validateLegacyJWT: ValidateLegacyJWT | undefined,\n    ) => ViewSyncer & ActivityBasedService,\n    mutagenFactory: (id: string) => Mutagen & Service,\n    pusherFactory: ((id: string) => Pusher & Service) | undefined,\n    parent: Worker,\n  ) {\n    this.#config = config;\n    // Relays notifications from the parent thread subscription\n    // to ViewSyncers within this thread.\n    const notifier = createNotifierFrom(lc, parent);\n    subscribeTo(lc, parent);\n\n    this.#lc = lc;\n    this.#viewSyncers = new ServiceRunner(\n      lc,\n      id =>\n        viewSyncerFactory(\n          id,\n          notifier.subscribe(),\n          this.#drainCoordinator,\n          this.#validateLegacyJWT(),\n        ),\n      v => v.keepalive(),\n    );\n    this.#mutagens = new ServiceRunner(lc, mutagenFactory, m => m.hasRefs());\n    if (pusherFactory) {\n      this.#pushers = new ServiceRunner(lc, pusherFactory, p => p.hasRefs());\n    }\n    this.#parent = parent;\n    this.#wss = new WebSocketServer(getWebSocketServerOptions(config));\n\n    installWebSocketReceiver(\n      lc,\n      this.#wss,\n      this.#createConnection,\n      this.#parent,\n    );\n\n    setActiveClientGroupsGetter(() => this.#viewSyncers.size);\n  }\n\n  readonly #createConnection = async (ws: WebSocket, params: ConnectParams) => {\n    this.#lc.debug?.(\n      'creating connection',\n      params.clientGroupID,\n      params.clientID,\n    );\n    recordConnectionAttempted();\n    const {clientID, clientGroupID, auth, userID} = params;\n    const hasProvidedAuth = auth !== undefined && auth !== '';\n\n    if (hasProvidedAuth) {\n      const tokenOptions = tokenConfigOptions(this.#config.auth ?? {});\n\n      const hasPushOrMutate =\n        this.#config?.push?.url !== undefined ||\n        this.#config?.mutate?.url !== undefined;\n      const hasQueries =\n        this.#config?.query?.url !== undefined ||\n        this.#config?.getQueries?.url !== undefined;\n\n      // must either have one of the token options set or have custom mutations & queries enabled\n      const hasExactlyOneTokenOption = tokenOptions.length === 1;\n      const hasCustomEndpoints = hasPushOrMutate && hasQueries;\n      if (!hasExactlyOneTokenOption && !hasCustomEndpoints) {\n        throw new Error(\n          'Exactly one of jwk, secret, or jwksUrl must be set in order to verify tokens but actually the following were set: ' +\n            JSON.stringify(tokenOptions) +\n            '. You may also set both ZERO_MUTATE_URL and ZERO_QUERY_URL to enable custom mutations and queries without passing token verification options.',\n        );\n      }\n    }\n\n    const viewSyncer = this.#viewSyncers.getService(clientGroupID);\n\n    // Verify JWT BEFORE touching existing connections - prevents unauthenticated\n    // attackers from force-disconnecting legitimate users via DoS\n    const authResult = await viewSyncer.initAuthSession(userID, auth);\n    if (!authResult.ok) {\n      sendError(this.#lc, ws, authResult.error);\n      ws.close(3000, authResult.error.message);\n      return;\n    }\n\n    // Only check for and close existing connections AFTER auth is validated\n    const existing = this.#connections.get(clientID);\n    if (existing) {\n      this.#lc.debug?.(\n        `client ${clientID} already connected, closing existing connection`,\n      );\n      existing.close(`replaced by ${params.wsID}`);\n    }\n\n    const mutagen = this.#mutagens.getService(clientGroupID);\n    const pusher = this.#pushers?.getService(clientGroupID);\n    // a new connection is using the mutagen and pusher. Bump their ref counts.\n    mutagen.ref();\n    pusher?.ref();\n\n    let connection: Connection;\n    try {\n      connection = new Connection(\n        this.#lc,\n        params,\n        ws,\n        new SyncerWsMessageHandler(\n          this.#lc,\n          params,\n          viewSyncer,\n          mutagen,\n          pusher,\n        ),\n        () => {\n          if (this.#connections.get(clientID) === connection) {\n            this.#connections.delete(clientID);\n          }\n          // Connection is closed. We can unref the mutagen and pusher.\n          // If their ref counts are zero, they will stop themselves and set themselves invalid.\n          mutagen.unref();\n          pusher?.unref();\n        },\n      );\n    } catch (e) {\n      mutagen.unref();\n      pusher?.unref();\n      throw e;\n    }\n\n    this.#connections.set(clientID, connection);\n\n    connection.init() && recordConnectionSuccess();\n\n    if (params.initConnectionMsg) {\n      this.#lc.debug?.(\n        'handling init connection message from sec header',\n        params.clientGroupID,\n        params.clientID,\n      );\n      await connection.handleInitConnection(\n        JSON.stringify(params.initConnectionMsg),\n      );\n    }\n  };\n\n  run() {\n    return this.#stopped.promise;\n  }\n\n  /**\n   * Graceful shutdown involves shutting down view syncers one at a time, pausing\n   * for the duration of view syncer's hydration between each one. This paces the\n   * disconnects to avoid creating a backlog of hydrations in the receiving server\n   * when the clients reconnect.\n   */\n  async drain() {\n    const start = Date.now();\n    this.#lc.info?.(`draining ${this.#viewSyncers.size} view-syncers`);\n\n    this.#drainCoordinator.drainNextIn(0);\n\n    while (this.#viewSyncers.size) {\n      await this.#drainCoordinator.forceDrainTimeout;\n\n      // Pick an arbitrary view syncer to force drain.\n      for (const vs of this.#viewSyncers.getServices()) {\n        this.#lc.debug?.(`draining view-syncer ${vs.id} (forced)`);\n        // When this drain or an elective drain completes, the forceDrainTimeout will\n        // resolve after the next drain interval.\n        void vs.stop();\n        break;\n      }\n    }\n    this.#lc.info?.(`finished draining (${Date.now() - start} ms)`);\n  }\n\n  stop() {\n    this.#wss.close();\n    this.#stopped.resolve();\n    return promiseVoid;\n  }\n\n  /** @deprecated used in JWT validation */\n  #validateLegacyJWT(): ValidateLegacyJWT | undefined {\n    const tokenOptions = tokenConfigOptions(this.#config.auth ?? {});\n    if (tokenOptions.length !== 1) {\n      return undefined;\n    }\n\n    return async (token, {userID}) => {\n      const decoded = await verifyToken(this.#config.auth, token, {\n        subject: userID,\n        ...(this.#config.auth?.issuer && {issuer: this.#config.auth.issuer}),\n        ...(this.#config.auth?.audience && {\n          audience: this.#config.auth.audience,\n        }),\n      });\n      return {\n        type: 'jwt',\n        raw: token,\n        decoded,\n      };\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAqCA,SAAS,0BAA0B,QAAmC;CACpE,MAAM,UAAyB;EAC7B,UAAU;EACV,YAAY,OAAO;EACpB;AAED,KAAI,OAAO,sBAAsB;AAC/B,UAAQ,oBAAoB;AAE5B,MAAI,OAAO,4BACT,KAAI;AAIF,WAAQ,oBAHmB,KAAK,MAC9B,OAAO,4BACR;WAEM,GAAG;AACV,SAAM,IAAI,MACR,uDAAuD,OAAO,EAAE,CAAC,wBAClE;;;AAKP,QAAO;;;;;;;;;AAUT,IAAa,SAAb,MAAgD;CAC9C,KAAc,UAAU;CACxB;CACA;CACA;CACA;CACA,+BAAwB,IAAI,KAAyB;CACrD,oBAA6B,IAAI,kBAAkB;CACnD;CACA;CACA,WAAoB,UAAU;CAC9B;CAEA,YACE,IACA,QACA,mBAMA,gBACA,eACA,QACA;AACA,QAAA,SAAe;EAGf,MAAM,WAAW,mBAAmB,IAAI,OAAO;AAC/C,cAAY,IAAI,OAAO;AAEvB,QAAA,KAAW;AACX,QAAA,cAAoB,IAAI,cACtB,KACA,OACE,kBACE,IACA,SAAS,WAAW,EACpB,MAAA,kBACA,MAAA,mBAAyB,CAC1B,GACH,MAAK,EAAE,WAAW,CACnB;AACD,QAAA,WAAiB,IAAI,cAAc,IAAI,iBAAgB,MAAK,EAAE,SAAS,CAAC;AACxE,MAAI,cACF,OAAA,UAAgB,IAAI,cAAc,IAAI,gBAAe,MAAK,EAAE,SAAS,CAAC;AAExE,QAAA,SAAe;AACf,QAAA,MAAY,IAAI,gBAAgB,0BAA0B,OAAO,CAAC;AAElE,2BACE,IACA,MAAA,KACA,MAAA,kBACA,MAAA,OACD;AAED,oCAAkC,MAAA,YAAkB,KAAK;;CAG3D,oBAA6B,OAAO,IAAe,WAA0B;AAC3E,QAAA,GAAS,QACP,uBACA,OAAO,eACP,OAAO,SACR;AACD,6BAA2B;EAC3B,MAAM,EAAC,UAAU,eAAe,MAAM,WAAU;AAGhD,MAFwB,SAAS,KAAA,KAAa,SAAS,IAElC;GACnB,MAAM,eAAe,mBAAmB,MAAA,OAAa,QAAQ,EAAE,CAAC;GAEhE,MAAM,kBACJ,MAAA,QAAc,MAAM,QAAQ,KAAA,KAC5B,MAAA,QAAc,QAAQ,QAAQ,KAAA;GAChC,MAAM,aACJ,MAAA,QAAc,OAAO,QAAQ,KAAA,KAC7B,MAAA,QAAc,YAAY,QAAQ,KAAA;AAKpC,OAAI,EAF6B,aAAa,WAAW,MAExB,EADN,mBAAmB,YAE5C,OAAM,IAAI,MACR,uHACE,KAAK,UAAU,aAAa,GAC5B,gJACH;;EAIL,MAAM,aAAa,MAAA,YAAkB,WAAW,cAAc;EAI9D,MAAM,aAAa,MAAM,WAAW,gBAAgB,QAAQ,KAAK;AACjE,MAAI,CAAC,WAAW,IAAI;AAClB,aAAU,MAAA,IAAU,IAAI,WAAW,MAAM;AACzC,MAAG,MAAM,KAAM,WAAW,MAAM,QAAQ;AACxC;;EAIF,MAAM,WAAW,MAAA,YAAkB,IAAI,SAAS;AAChD,MAAI,UAAU;AACZ,SAAA,GAAS,QACP,UAAU,SAAS,iDACpB;AACD,YAAS,MAAM,eAAe,OAAO,OAAO;;EAG9C,MAAM,UAAU,MAAA,SAAe,WAAW,cAAc;EACxD,MAAM,SAAS,MAAA,SAAe,WAAW,cAAc;AAEvD,UAAQ,KAAK;AACb,UAAQ,KAAK;EAEb,IAAI;AACJ,MAAI;AACF,gBAAa,IAAI,WACf,MAAA,IACA,QACA,IACA,IAAI,uBACF,MAAA,IACA,QACA,YACA,SACA,OACD,QACK;AACJ,QAAI,MAAA,YAAkB,IAAI,SAAS,KAAK,WACtC,OAAA,YAAkB,OAAO,SAAS;AAIpC,YAAQ,OAAO;AACf,YAAQ,OAAO;KAElB;WACM,GAAG;AACV,WAAQ,OAAO;AACf,WAAQ,OAAO;AACf,SAAM;;AAGR,QAAA,YAAkB,IAAI,UAAU,WAAW;AAE3C,aAAW,MAAM,IAAI,yBAAyB;AAE9C,MAAI,OAAO,mBAAmB;AAC5B,SAAA,GAAS,QACP,oDACA,OAAO,eACP,OAAO,SACR;AACD,SAAM,WAAW,qBACf,KAAK,UAAU,OAAO,kBAAkB,CACzC;;;CAIL,MAAM;AACJ,SAAO,MAAA,QAAc;;;;;;;;CASvB,MAAM,QAAQ;EACZ,MAAM,QAAQ,KAAK,KAAK;AACxB,QAAA,GAAS,OAAO,YAAY,MAAA,YAAkB,KAAK,eAAe;AAElE,QAAA,iBAAuB,YAAY,EAAE;AAErC,SAAO,MAAA,YAAkB,MAAM;AAC7B,SAAM,MAAA,iBAAuB;AAG7B,QAAK,MAAM,MAAM,MAAA,YAAkB,aAAa,EAAE;AAChD,UAAA,GAAS,QAAQ,wBAAwB,GAAG,GAAG,WAAW;AAGrD,OAAG,MAAM;AACd;;;AAGJ,QAAA,GAAS,OAAO,sBAAsB,KAAK,KAAK,GAAG,MAAM,MAAM;;CAGjE,OAAO;AACL,QAAA,IAAU,OAAO;AACjB,QAAA,QAAc,SAAS;AACvB,SAAO;;;CAIT,qBAAoD;AAElD,MADqB,mBAAmB,MAAA,OAAa,QAAQ,EAAE,CAAC,CAC/C,WAAW,EAC1B;AAGF,SAAO,OAAO,OAAO,EAAC,aAAY;AAQhC,UAAO;IACL,MAAM;IACN,KAAK;IACL,SAVc,MAAM,YAAY,MAAA,OAAa,MAAM,OAAO;KAC1D,SAAS;KACT,GAAI,MAAA,OAAa,MAAM,UAAU,EAAC,QAAQ,MAAA,OAAa,KAAK,QAAO;KACnE,GAAI,MAAA,OAAa,MAAM,YAAY,EACjC,UAAU,MAAA,OAAa,KAAK,UAC7B;KACF,CAAC;IAKD"}
+{"version":3,"file":"syncer.js","names":["#lc","#viewSyncers","#mutagens","#pushers","#connections","#drainCoordinator","#parent","#wss","#stopped","#config","#validateLegacyJWT","#createConnection"],"sources":["../../../../../zero-cache/src/workers/syncer.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {resolver} from '@rocicorp/resolver';\nimport {pid} from 'node:process';\nimport type {MessagePort} from 'node:worker_threads';\nimport {WebSocketServer, type ServerOptions, type WebSocket} from 'ws';\nimport {promiseVoid} from '../../../shared/src/resolved-promises.ts';\nimport {ErrorKind} from '../../../zero-protocol/src/error-kind.ts';\nimport {ErrorOrigin} from '../../../zero-protocol/src/error-origin.ts';\nimport {\n  isProtocolError,\n  ProtocolError,\n} from '../../../zero-protocol/src/error.ts';\nimport {resolveAuth, type Auth, type ValidateLegacyJWT} from '../auth/auth.ts';\nimport {tokenConfigOptions} from '../auth/jwt.ts';\nimport {type ZeroConfig} from '../config/zero-config.ts';\nimport {\n  recordConnectionAttempted,\n  recordConnectionSuccess,\n  setActiveClientGroupsGetter,\n} from '../server/anonymous-otel-start.ts';\nimport {getOrCreateGauge} from '../observability/metrics.ts';\nimport type {Mutagen} from '../services/mutagen/mutagen.ts';\nimport type {Pusher} from '../services/mutagen/pusher.ts';\nimport type {ReplicaState} from '../services/replicator/replicator.ts';\nimport {ServiceRunner} from '../services/runner.ts';\nimport type {\n  ActivityBasedService,\n  Service,\n  SingletonService,\n} from '../services/service.ts';\nimport type {ConnectionContextManager} from '../services/view-syncer/connection-context-manager.ts';\nimport {DrainCoordinator} from '../services/view-syncer/drain-coordinator.ts';\nimport type {ViewSyncer} from '../services/view-syncer/view-syncer.ts';\nimport type {Worker} from '../types/processes.ts';\nimport type {Subscription} from '../types/subscription.ts';\nimport {installWebSocketReceiver} from '../types/websocket-handoff.ts';\nimport type {ConnectParams} from './connect-params.ts';\nimport {Connection, sendError} from './connection.ts';\nimport {createNotifierFrom, subscribeTo} from './replicator.ts';\nimport {SyncerWsMessageHandler} from './syncer-ws-message-handler.ts';\n\nexport type SyncerWorkerData = {\n  replicatorPort: MessagePort;\n};\n\nfunction getWebSocketServerOptions(config: ZeroConfig): ServerOptions {\n  const options: ServerOptions = {\n    noServer: true,\n    maxPayload: config.websocketMaxPayloadBytes,\n  };\n\n  if (config.websocketCompression) {\n    options.perMessageDeflate = true;\n\n    if (config.websocketCompressionOptions) {\n      try {\n        const compressionOptions = JSON.parse(\n          config.websocketCompressionOptions,\n        );\n        options.perMessageDeflate = compressionOptions;\n      } catch (e) {\n        throw new Error(\n          `Failed to parse ZERO_WEBSOCKET_COMPRESSION_OPTIONS: ${String(e)}. Expected valid JSON.`,\n        );\n      }\n    }\n  }\n\n  return options;\n}\n\n/**\n * The Syncer worker receives websocket handoffs for \"/sync\" connections\n * from the Dispatcher in the main thread, and creates websocket\n * {@link Connection}s with a corresponding {@link ViewSyncer}, {@link Mutagen},\n * and {@link Subscription} to version notifications from the Replicator\n * worker.\n */\nexport class Syncer implements SingletonService {\n  readonly id = `syncer-${pid}`;\n  readonly #lc: LogContext;\n  readonly #viewSyncers: ServiceRunner<ViewSyncer & ActivityBasedService>;\n  readonly #mutagens: ServiceRunner<Mutagen & Service> | undefined;\n  readonly #pushers: ServiceRunner<Pusher & Service> | undefined;\n  readonly #connections = new Map<string, Connection>();\n  readonly #drainCoordinator = new DrainCoordinator();\n  readonly #parent: Worker;\n  readonly #wss: WebSocketServer;\n  readonly #stopped = resolver();\n  readonly #config: ZeroConfig;\n  readonly #validateLegacyJWT: ValidateLegacyJWT | undefined;\n\n  constructor(\n    lc: LogContext,\n    config: ZeroConfig,\n    viewSyncerFactory: (\n      id: string,\n      sub: Subscription<ReplicaState>,\n      drainCoordinator: DrainCoordinator,\n    ) => ViewSyncer & ActivityBasedService,\n    mutagenFactory: ((id: string) => Mutagen & Service) | undefined,\n    pusherFactory:\n      | ((\n          id: string,\n          contextManager: ConnectionContextManager,\n        ) => Pusher & Service)\n      | undefined,\n    parent: Worker,\n    validateLegacyJWT: ValidateLegacyJWT | undefined,\n  ) {\n    this.#config = config;\n    this.#validateLegacyJWT = validateLegacyJWT;\n    // Relays notifications from the parent thread subscription\n    // to ViewSyncers within this thread.\n    const notifier = createNotifierFrom(lc, parent);\n    subscribeTo(lc, parent);\n\n    this.#lc = lc;\n    this.#viewSyncers = new ServiceRunner(\n      lc,\n      id => viewSyncerFactory(id, notifier.subscribe(), this.#drainCoordinator),\n      v => v.keepalive(),\n    );\n    if (mutagenFactory) {\n      this.#mutagens = new ServiceRunner(lc, mutagenFactory, m => m.hasRefs());\n    }\n    if (pusherFactory) {\n      this.#pushers = new ServiceRunner(\n        lc,\n        id =>\n          pusherFactory(id, this.#viewSyncers.getService(id).contextManager),\n        p => p.hasRefs(),\n      );\n    }\n    this.#parent = parent;\n    this.#wss = new WebSocketServer(getWebSocketServerOptions(config));\n\n    installWebSocketReceiver(\n      lc,\n      this.#wss,\n      this.#createConnection,\n      this.#parent,\n    );\n\n    setActiveClientGroupsGetter(() => this.#viewSyncers.size);\n\n    getOrCreateGauge(\n      'sync',\n      'active-client-groups',\n      'Number of active client groups',\n    ).addCallback(result => result.observe(this.#viewSyncers.size));\n\n    getOrCreateGauge(\n      'sync',\n      'queries',\n      'Active queries (pipelines) across all client groups',\n    ).addCallback(result => {\n      let total = 0;\n      for (const vs of this.#viewSyncers.getServices()) {\n        total += vs.queryCount;\n      }\n      result.observe(total);\n    });\n\n    getOrCreateGauge(\n      'sync',\n      'rows',\n      'Tracked rows across all client groups',\n    ).addCallback(result => {\n      let total = 0;\n      for (const vs of this.#viewSyncers.getServices()) {\n        total += vs.rowCount;\n      }\n      result.observe(total);\n    });\n  }\n\n  readonly #createConnection = async (ws: WebSocket, params: ConnectParams) => {\n    this.#lc.debug?.(\n      'creating connection',\n      params.clientGroupID,\n      params.clientID,\n    );\n    recordConnectionAttempted();\n    const {clientID, clientGroupID, auth, userID} = params;\n    const hasProvidedAuth = auth !== undefined && auth !== '';\n\n    if (hasProvidedAuth) {\n      const tokenOptions = tokenConfigOptions(this.#config.auth ?? {});\n\n      const hasPushOrMutate =\n        this.#config?.push?.url !== undefined ||\n        this.#config?.mutate?.url !== undefined;\n      const hasQueries =\n        this.#config?.query?.url !== undefined ||\n        this.#config?.getQueries?.url !== undefined;\n\n      // must either have one of the token options set or have custom mutations & queries enabled\n      const hasExactlyOneTokenOption = tokenOptions.length === 1;\n      const hasCustomEndpoints = hasPushOrMutate && hasQueries;\n      if (!hasExactlyOneTokenOption && !hasCustomEndpoints) {\n        throw new Error(\n          'Exactly one of jwk, secret, or jwksUrl must be set in order to verify tokens but actually the following were set: ' +\n            JSON.stringify(tokenOptions) +\n            '. You may also set both ZERO_MUTATE_URL and ZERO_QUERY_URL to enable custom mutations and queries without passing token verification options.',\n        );\n      }\n    }\n\n    let initialAuth: Auth | undefined;\n\n    // Verify JWT BEFORE touching existing connections - prevents unauthenticated\n    // attackers from force-disconnecting legitimate users via DoS.\n    try {\n      initialAuth = await resolveAuth(\n        this.#lc\n          .withContext('clientGroupID', clientGroupID)\n          .withContext('clientID', clientID),\n        // no previous auth, since this is a new connection, and resolveAuth is\n        // connection scoped, not client group scoped\n        undefined,\n        userID,\n        auth,\n        this.#validateLegacyJWT,\n      );\n    } catch (e) {\n      if (isProtocolError(e)) {\n        this.#lc.warn?.(\n          'Rejecting sync connection during initial auth resolution',\n          {\n            clientGroupID,\n            clientID,\n            userID,\n            hasProvidedAuth,\n            errorKind: e.message,\n          },\n        );\n        sendError(this.#lc, ws, e.errorBody);\n        ws.close(3000, e.errorBody.message);\n        return;\n      }\n      throw e;\n    }\n\n    const viewSyncer = this.#viewSyncers.getService(clientGroupID);\n    const contextManager = viewSyncer.contextManager;\n    const group = contextManager.getGroupState();\n\n    // TODO(0xcadams): we only check for user ID mismatch here if the group is\n    // already validated. This prevents wrong-user reconnects from evicting a\n    // healthy connection, but it does not protect against same-user reconnects\n    // with an invalid opaque token. The long-term fix is to keep the replacement\n    // connection pending until its auth is fully validated, and only then replace\n    // the existing socket.\n    if (group.validated && group.userID !== userID) {\n      const error = new ProtocolError({\n        kind: ErrorKind.Unauthorized,\n        message:\n          'Client groups are pinned to a single userID. Connection userID does not match existing client group userID.',\n        origin: ErrorOrigin.ZeroCache,\n      });\n      sendError(this.#lc, ws, error.errorBody);\n      ws.close(3000, error.message);\n      return;\n    }\n\n    // Check for and close existing connections AFTER auth is validated\n    const existing = this.#connections.get(clientID);\n    if (existing) {\n      this.#lc.debug?.(\n        `client ${clientID} already connected, closing existing connection`,\n      );\n      existing.close(`replaced by ${params.wsID}`);\n    }\n\n    contextManager.registerConnection(\n      {clientID, wsID: params.wsID},\n      params,\n      initialAuth,\n    );\n\n    const mutagen = this.#mutagens?.getService(clientGroupID);\n    const pusher = this.#pushers?.getService(clientGroupID);\n    // a new connection is using the mutagen and pusher. Bump their ref counts.\n    mutagen?.ref();\n    pusher?.ref();\n\n    let connection: Connection;\n    try {\n      connection = new Connection(\n        this.#lc,\n        params,\n        ws,\n        new SyncerWsMessageHandler(\n          this.#lc,\n          params,\n          contextManager,\n          viewSyncer,\n          mutagen,\n          pusher,\n        ),\n        () => {\n          contextManager.closeConnection({\n            clientID,\n            wsID: params.wsID,\n          });\n          if (this.#connections.get(clientID) === connection) {\n            this.#connections.delete(clientID);\n          }\n          // Connection is closed. We can unref the mutagen and pusher.\n          // If their ref counts are zero, they will stop themselves and set themselves invalid.\n          mutagen?.unref();\n          pusher?.unref();\n        },\n      );\n    } catch (e) {\n      contextManager.closeConnection({clientID, wsID: params.wsID});\n      mutagen?.unref();\n      pusher?.unref();\n      throw e;\n    }\n\n    this.#connections.set(clientID, connection);\n\n    connection.init() && recordConnectionSuccess();\n\n    if (params.initConnectionMsg) {\n      this.#lc.debug?.(\n        'handling init connection message from sec header',\n        params.clientGroupID,\n        params.clientID,\n      );\n      await connection.handleInitConnection(\n        JSON.stringify(params.initConnectionMsg),\n      );\n    }\n  };\n\n  run() {\n    return this.#stopped.promise;\n  }\n\n  /**\n   * Graceful shutdown involves shutting down view syncers one at a time, pausing\n   * for the duration of view syncer's hydration between each one. This paces the\n   * disconnects to avoid creating a backlog of hydrations in the receiving server\n   * when the clients reconnect.\n   */\n  async drain() {\n    const start = Date.now();\n    this.#lc.info?.(`draining ${this.#viewSyncers.size} view-syncers`);\n\n    this.#drainCoordinator.drainNextIn(0);\n\n    while (this.#viewSyncers.size) {\n      await this.#drainCoordinator.forceDrainTimeout;\n\n      // Pick an arbitrary view syncer to force drain.\n      for (const vs of this.#viewSyncers.getServices()) {\n        this.#lc.debug?.(`draining view-syncer ${vs.id} (forced)`);\n        // When this drain or an elective drain completes, the forceDrainTimeout will\n        // resolve after the next drain interval.\n        void vs.stop();\n        break;\n      }\n    }\n    this.#lc.info?.(`finished draining (${Date.now() - start} ms)`);\n  }\n\n  stop() {\n    this.#wss.close();\n    this.#stopped.resolve();\n    return promiseVoid;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA6CA,SAAS,0BAA0B,QAAmC;CACpE,MAAM,UAAyB;EAC7B,UAAU;EACV,YAAY,OAAO;EACpB;AAED,KAAI,OAAO,sBAAsB;AAC/B,UAAQ,oBAAoB;AAE5B,MAAI,OAAO,4BACT,KAAI;AAIF,WAAQ,oBAHmB,KAAK,MAC9B,OAAO,4BACR;WAEM,GAAG;AACV,SAAM,IAAI,MACR,uDAAuD,OAAO,EAAE,CAAC,wBAClE;;;AAKP,QAAO;;;;;;;;;AAUT,IAAa,SAAb,MAAgD;CAC9C,KAAc,UAAU;CACxB;CACA;CACA;CACA;CACA,+BAAwB,IAAI,KAAyB;CACrD,oBAA6B,IAAI,kBAAkB;CACnD;CACA;CACA,WAAoB,UAAU;CAC9B;CACA;CAEA,YACE,IACA,QACA,mBAKA,gBACA,eAMA,QACA,mBACA;AACA,QAAA,SAAe;AACf,QAAA,oBAA0B;EAG1B,MAAM,WAAW,mBAAmB,IAAI,OAAO;AAC/C,cAAY,IAAI,OAAO;AAEvB,QAAA,KAAW;AACX,QAAA,cAAoB,IAAI,cACtB,KACA,OAAM,kBAAkB,IAAI,SAAS,WAAW,EAAE,MAAA,iBAAuB,GACzE,MAAK,EAAE,WAAW,CACnB;AACD,MAAI,eACF,OAAA,WAAiB,IAAI,cAAc,IAAI,iBAAgB,MAAK,EAAE,SAAS,CAAC;AAE1E,MAAI,cACF,OAAA,UAAgB,IAAI,cAClB,KACA,OACE,cAAc,IAAI,MAAA,YAAkB,WAAW,GAAG,CAAC,eAAe,GACpE,MAAK,EAAE,SAAS,CACjB;AAEH,QAAA,SAAe;AACf,QAAA,MAAY,IAAI,gBAAgB,0BAA0B,OAAO,CAAC;AAElE,2BACE,IACA,MAAA,KACA,MAAA,kBACA,MAAA,OACD;AAED,oCAAkC,MAAA,YAAkB,KAAK;AAEzD,mBACE,QACA,wBACA,iCACD,CAAC,aAAY,WAAU,OAAO,QAAQ,MAAA,YAAkB,KAAK,CAAC;AAE/D,mBACE,QACA,WACA,sDACD,CAAC,aAAY,WAAU;GACtB,IAAI,QAAQ;AACZ,QAAK,MAAM,MAAM,MAAA,YAAkB,aAAa,CAC9C,UAAS,GAAG;AAEd,UAAO,QAAQ,MAAM;IACrB;AAEF,mBACE,QACA,QACA,wCACD,CAAC,aAAY,WAAU;GACtB,IAAI,QAAQ;AACZ,QAAK,MAAM,MAAM,MAAA,YAAkB,aAAa,CAC9C,UAAS,GAAG;AAEd,UAAO,QAAQ,MAAM;IACrB;;CAGJ,oBAA6B,OAAO,IAAe,WAA0B;AAC3E,QAAA,GAAS,QACP,uBACA,OAAO,eACP,OAAO,SACR;AACD,6BAA2B;EAC3B,MAAM,EAAC,UAAU,eAAe,MAAM,WAAU;EAChD,MAAM,kBAAkB,SAAS,KAAA,KAAa,SAAS;AAEvD,MAAI,iBAAiB;GACnB,MAAM,eAAe,mBAAmB,MAAA,OAAa,QAAQ,EAAE,CAAC;GAEhE,MAAM,kBACJ,MAAA,QAAc,MAAM,QAAQ,KAAA,KAC5B,MAAA,QAAc,QAAQ,QAAQ,KAAA;GAChC,MAAM,aACJ,MAAA,QAAc,OAAO,QAAQ,KAAA,KAC7B,MAAA,QAAc,YAAY,QAAQ,KAAA;AAKpC,OAAI,EAF6B,aAAa,WAAW,MAExB,EADN,mBAAmB,YAE5C,OAAM,IAAI,MACR,uHACE,KAAK,UAAU,aAAa,GAC5B,gJACH;;EAIL,IAAI;AAIJ,MAAI;AACF,iBAAc,MAAM,YAClB,MAAA,GACG,YAAY,iBAAiB,cAAc,CAC3C,YAAY,YAAY,SAAS,EAGpC,KAAA,GACA,QACA,MACA,MAAA,kBACD;WACM,GAAG;AACV,OAAI,gBAAgB,EAAE,EAAE;AACtB,UAAA,GAAS,OACP,4DACA;KACE;KACA;KACA;KACA;KACA,WAAW,EAAE;KACd,CACF;AACD,cAAU,MAAA,IAAU,IAAI,EAAE,UAAU;AACpC,OAAG,MAAM,KAAM,EAAE,UAAU,QAAQ;AACnC;;AAEF,SAAM;;EAGR,MAAM,aAAa,MAAA,YAAkB,WAAW,cAAc;EAC9D,MAAM,iBAAiB,WAAW;EAClC,MAAM,QAAQ,eAAe,eAAe;AAQ5C,MAAI,MAAM,aAAa,MAAM,WAAW,QAAQ;GAC9C,MAAM,QAAQ,IAAI,cAAc;IAC9B,MAAM;IACN,SACE;IACF,QAAQ;IACT,CAAC;AACF,aAAU,MAAA,IAAU,IAAI,MAAM,UAAU;AACxC,MAAG,MAAM,KAAM,MAAM,QAAQ;AAC7B;;EAIF,MAAM,WAAW,MAAA,YAAkB,IAAI,SAAS;AAChD,MAAI,UAAU;AACZ,SAAA,GAAS,QACP,UAAU,SAAS,iDACpB;AACD,YAAS,MAAM,eAAe,OAAO,OAAO;;AAG9C,iBAAe,mBACb;GAAC;GAAU,MAAM,OAAO;GAAK,EAC7B,QACA,YACD;EAED,MAAM,UAAU,MAAA,UAAgB,WAAW,cAAc;EACzD,MAAM,SAAS,MAAA,SAAe,WAAW,cAAc;AAEvD,WAAS,KAAK;AACd,UAAQ,KAAK;EAEb,IAAI;AACJ,MAAI;AACF,gBAAa,IAAI,WACf,MAAA,IACA,QACA,IACA,IAAI,uBACF,MAAA,IACA,QACA,gBACA,YACA,SACA,OACD,QACK;AACJ,mBAAe,gBAAgB;KAC7B;KACA,MAAM,OAAO;KACd,CAAC;AACF,QAAI,MAAA,YAAkB,IAAI,SAAS,KAAK,WACtC,OAAA,YAAkB,OAAO,SAAS;AAIpC,aAAS,OAAO;AAChB,YAAQ,OAAO;KAElB;WACM,GAAG;AACV,kBAAe,gBAAgB;IAAC;IAAU,MAAM,OAAO;IAAK,CAAC;AAC7D,YAAS,OAAO;AAChB,WAAQ,OAAO;AACf,SAAM;;AAGR,QAAA,YAAkB,IAAI,UAAU,WAAW;AAE3C,aAAW,MAAM,IAAI,yBAAyB;AAE9C,MAAI,OAAO,mBAAmB;AAC5B,SAAA,GAAS,QACP,oDACA,OAAO,eACP,OAAO,SACR;AACD,SAAM,WAAW,qBACf,KAAK,UAAU,OAAO,kBAAkB,CACzC;;;CAIL,MAAM;AACJ,SAAO,MAAA,QAAc;;;;;;;;CASvB,MAAM,QAAQ;EACZ,MAAM,QAAQ,KAAK,KAAK;AACxB,QAAA,GAAS,OAAO,YAAY,MAAA,YAAkB,KAAK,eAAe;AAElE,QAAA,iBAAuB,YAAY,EAAE;AAErC,SAAO,MAAA,YAAkB,MAAM;AAC7B,SAAM,MAAA,iBAAuB;AAG7B,QAAK,MAAM,MAAM,MAAA,YAAkB,aAAa,EAAE;AAChD,UAAA,GAAS,QAAQ,wBAAwB,GAAG,GAAG,WAAW;AAGrD,OAAG,MAAM;AACd;;;AAGJ,QAAA,GAAS,OAAO,sBAAsB,KAAK,KAAK,GAAG,MAAM,MAAM;;CAGjE,OAAO;AACL,QAAA,IAAU,OAAO;AACjB,QAAA,QAAc,SAAS;AACvB,SAAO"}

package/out/zero-client/src/client/connection.d.ts

@@ -69,23 +69,23 @@ export interface Connection {
      * Resumes the connection from a terminal state.
      *
      * If called when not in a terminal state, this method does nothing.
+     * To clear existing auth credentials, create a new Zero instance with `auth` omitted.
      *
      * @param opts - Optional connection options
      * @param opts.auth - Token to use for authentication. If provided, this overrides
      *                    the stored auth credential for this connection attempt.
-     *                    If `null` or `undefined`, the stored auth credential is cleared.
      * @returns A promise that resolves once the connection state has transitioned to connecting.
      */
     connect(opts?: {
-        auth: string | null | undefined;
+        auth: string;
     }): Promise<void>;
 }
 export declare class ConnectionImpl implements Connection {
     #private;
-    constructor(connectionManager: ConnectionManager, lc: LogContext, setAuth: (auth: string | null | undefined) => void);
+    constructor(connectionManager: ConnectionManager, lc: LogContext, setAuth: (auth: string) => void);
     get state(): Source<ConnectionState>;
     connect(opts?: {
-        auth: string | null | undefined;
+        auth: string;
     }): Promise<void>;
 }
 export declare class ConnectionSource extends Subscribable<ConnectionState> implements Source<ConnectionState> {

package/out/zero-client/src/client/connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../../../zero-client/src/client/connection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAC,YAAY,EAAC,MAAM,qCAAqC,CAAC;AAGjE,OAAO,KAAK,EACV,iBAAiB,EAElB,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;CACnB,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EACF;QACE,IAAI,EAAE,QAAQ,CAAC;QACf,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GACD;QACE,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GACD;QACE,IAAI,EAAE,YAAY,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACP,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GACD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEN,MAAM,WAAW,MAAM,CAAC,CAAC;IACvB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAEpB;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAExC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,IAAI,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,qBAAa,cAAe,YAAW,UAAU;;gBAO7C,iBAAiB,EAAE,iBAAiB,EACpC,EAAE,EAAE,UAAU,EACd,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,KAAK,IAAI;IAQpD,IAAI,KAAK,IAAI,MAAM,CAAC,eAAe,CAAC,CAEnC;IAEK,OAAO,CAAC,IAAI,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAwCvE;AAED,qBAAa,gBACX,SAAQ,YAAY,CAAC,eAAe,CACpC,YAAW,MAAM,CAAC,eAAe,CAAC;;gBAItB,iBAAiB,EAAE,iBAAiB;IAchD,IAAI,OAAO,IAAI,eAAe,CAE7B;CA0DF"}
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../../../zero-client/src/client/connection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAC,YAAY,EAAC,MAAM,qCAAqC,CAAC;AAGjE,OAAO,KAAK,EACV,iBAAiB,EAElB,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;CACnB,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EACF;QACE,IAAI,EAAE,QAAQ,CAAC;QACf,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GACD;QACE,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GACD;QACE,IAAI,EAAE,YAAY,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACP,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GACD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEN,MAAM,WAAW,MAAM,CAAC,CAAC;IACvB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAEpB;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAExC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,IAAI,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,qBAAa,cAAe,YAAW,UAAU;;gBAO7C,iBAAiB,EAAE,iBAAiB,EACpC,EAAE,EAAE,UAAU,EACd,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI;IAQjC,IAAI,KAAK,IAAI,MAAM,CAAC,eAAe,CAAC,CAEnC;IAEK,OAAO,CAAC,IAAI,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAwCpD;AAED,qBAAa,gBACX,SAAQ,YAAY,CAAC,eAAe,CACpC,YAAW,MAAM,CAAC,eAAe,CAAC;;gBAItB,iBAAiB,EAAE,iBAAiB;IAchD,IAAI,OAAO,IAAI,eAAe,CAE7B;CA0DF"}

package/out/zero-client/src/client/connection.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection.js","names":["#connectionManager","#lc","#source","#setAuth","#state","#mapConnectionManagerState"],"sources":["../../../../../zero-client/src/client/connection.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {unreachable} from '../../../shared/src/asserts.ts';\nimport {Subscribable} from '../../../shared/src/subscribable.ts';\nimport {ErrorKind} from '../../../zero-protocol/src/error-kind.ts';\nimport {ClientErrorKind} from './client-error-kind.ts';\nimport type {\n  ConnectionManager,\n  ConnectionManagerState,\n} from './connection-manager.ts';\nimport {ConnectionStatus} from './connection-status.ts';\n\n/**\n * The current connection state of the Zero instance. One of the following states:\n *\n * - `connecting`: The client is actively trying to connect every 5 seconds.\n * - `disconnected`: The client is now in an \"offline\" state. It will continue\n *   to try to connect every 5 seconds.\n * - `connected`: The client has opened a successful connection to the server.\n * - `needs-auth`: Authentication is invalid or expired. No connection retries will be made\n *   until the host application calls `connect()`.\n * - `error`: A fatal error occurred. No connection retries will be made until the host\n *   application calls `connect()` again.\n * - `closed`: The client was shut down (for example via `zero.close()`). This is\n *   a terminal state, and a new Zero instance must be created to reconnect.\n */\nexport type ConnectionState =\n  | {\n      name: 'disconnected';\n      reason: string;\n    }\n  | {\n      name: 'connecting';\n      reason?: string;\n    }\n  | {\n      name: 'connected';\n    }\n  | {\n      name: 'needs-auth';\n      reason:\n        | {\n            type: 'mutate';\n            status: 401 | 403;\n            body?: string;\n          }\n        | {\n            type: 'query';\n            status: 401 | 403;\n            body?: string;\n          }\n        | {\n            type: 'zero-cache';\n            reason: string;\n          };\n    }\n  | {\n      name: 'error';\n      reason: string;\n    }\n  | {\n      name: 'closed';\n      reason: string;\n    };\n\nexport interface Source<T> {\n  /**\n   * The current state value.\n   */\n  readonly current: T;\n\n  /**\n   * Subscribe to state changes.\n   *\n   * @param listener - Called when the state changes with the new state value.\n   * @returns A function to unsubscribe from state changes.\n   */\n  subscribe(listener: (state: T) => void): () => void;\n}\n\n/**\n * Connection API for managing Zero's connection lifecycle.\n */\nexport interface Connection {\n  /**\n   * The current connection state as a subscribable value.\n   */\n  readonly state: Source<ConnectionState>;\n\n  /**\n   * Resumes the connection from a terminal state.\n   *\n   * If called when not in a terminal state, this method does nothing.\n   *\n   * @param opts - Optional connection options\n   * @param opts.auth - Token to use for authentication. If provided, this overrides\n   *                    the stored auth credential for this connection attempt.\n   *                    If `null` or `undefined`, the stored auth credential is cleared.\n   * @returns A promise that resolves once the connection state has transitioned to connecting.\n   */\n  connect(opts?: {auth: string | null | undefined}): Promise<void>;\n}\n\nexport class ConnectionImpl implements Connection {\n  readonly #connectionManager: ConnectionManager;\n  readonly #lc: LogContext;\n  readonly #source: ConnectionSource;\n  readonly #setAuth: (auth: string | null | undefined) => void;\n\n  constructor(\n    connectionManager: ConnectionManager,\n    lc: LogContext,\n    setAuth: (auth: string | null | undefined) => void,\n  ) {\n    this.#connectionManager = connectionManager;\n    this.#lc = lc;\n    this.#source = new ConnectionSource(connectionManager);\n    this.#setAuth = setAuth;\n  }\n\n  get state(): Source<ConnectionState> {\n    return this.#source;\n  }\n\n  async connect(opts?: {auth: string | null | undefined}): Promise<void> {\n    const lc = this.#lc.withContext('connect');\n\n    if (opts && 'auth' in opts) {\n      lc.debug?.('Updating auth credential from connect()');\n      this.#setAuth(opts.auth);\n    }\n\n    // if the connection is disconnected due to a missing cacheURL, we don't allow a reconnect\n    if (\n      this.#connectionManager.state.name === ConnectionStatus.Disconnected &&\n      this.#connectionManager.state.reason.kind ===\n        ClientErrorKind.NoSocketOrigin\n    ) {\n      lc.error?.(\n        'connect() called but the connection is disconnected due to a missing cacheURL. No reconnect will be attempted.',\n      );\n      return;\n    }\n\n    // only allow connect() to be called from a terminal state\n    if (!this.#connectionManager.isInTerminalState()) {\n      lc.debug?.(\n        'connect() called but not in a terminal state. Current state:',\n        this.#connectionManager.state.name,\n      );\n      return;\n    }\n\n    lc.info?.(\n      `Resuming connection from state: ${this.#connectionManager.state.name}`,\n    );\n\n    this.#connectionManager.requestConnect();\n    if (this.#connectionManager.state.name === ConnectionStatus.Connecting) {\n      return;\n    }\n\n    await this.#connectionManager.waitForStateChange();\n  }\n}\n\nexport class ConnectionSource\n  extends Subscribable<ConnectionState>\n  implements Source<ConnectionState>\n{\n  #state: ConnectionState;\n\n  constructor(connectionManager: ConnectionManager) {\n    super();\n    this.#state = this.#mapConnectionManagerState(connectionManager.state);\n\n    // Subscribe to ConnectionManager immediately to keep #state in sync.\n    // This ensures `current` always returns the correct state, even if\n    // external code hasn't subscribed yet (fixes race condition where\n    // connection completes before React subscribes).\n    connectionManager.subscribe(state => {\n      this.#state = this.#mapConnectionManagerState(state);\n      this.notify(this.#state);\n    });\n  }\n\n  get current(): ConnectionState {\n    return this.#state;\n  }\n\n  #mapConnectionManagerState(state: ConnectionManagerState): ConnectionState {\n    switch (state.name) {\n      case ConnectionStatus.Closed:\n        return {\n          name: 'closed',\n          reason: state.reason.message,\n        };\n      case ConnectionStatus.Connected:\n        return {\n          name: 'connected',\n        };\n      case ConnectionStatus.Connecting:\n        return {\n          name: 'connecting',\n          ...(state.reason?.message ? {reason: state.reason.message} : {}),\n        };\n      case ConnectionStatus.Disconnected:\n        return {\n          name: 'disconnected',\n          reason: state.reason.message,\n        };\n      case ConnectionStatus.Error:\n        return {\n          name: 'error',\n          reason: state.reason.message,\n        };\n      case ConnectionStatus.NeedsAuth:\n        return {\n          name: 'needs-auth',\n          reason:\n            state.reason.errorBody.kind === ErrorKind.PushFailed\n              ? {\n                  type: 'mutate',\n                  status: state.reason.errorBody.status,\n                  ...(state.reason.errorBody.bodyPreview\n                    ? {body: state.reason.errorBody.bodyPreview}\n                    : {}),\n                }\n              : state.reason.errorBody.kind === ErrorKind.TransformFailed\n                ? {\n                    type: 'query',\n                    status: state.reason.errorBody.status,\n                    ...(state.reason.errorBody.bodyPreview\n                      ? {body: state.reason.errorBody.bodyPreview}\n                      : {}),\n                  }\n                : {\n                    type: 'zero-cache',\n                    reason: state.reason.message,\n                  },\n        };\n\n      default:\n        unreachable(state);\n    }\n  }\n}\n"],"mappings":";;;;;;AAsGA,IAAa,iBAAb,MAAkD;CAChD;CACA;CACA;CACA;CAEA,YACE,mBACA,IACA,SACA;AACA,QAAA,oBAA0B;AAC1B,QAAA,KAAW;AACX,QAAA,SAAe,IAAI,iBAAiB,kBAAkB;AACtD,QAAA,UAAgB;;CAGlB,IAAI,QAAiC;AACnC,SAAO,MAAA;;CAGT,MAAM,QAAQ,MAAyD;EACrE,MAAM,KAAK,MAAA,GAAS,YAAY,UAAU;AAE1C,MAAI,QAAQ,UAAU,MAAM;AAC1B,MAAG,QAAQ,0CAA0C;AACrD,SAAA,QAAc,KAAK,KAAK;;AAI1B,MACE,MAAA,kBAAwB,MAAM,SAAS,kBACvC,MAAA,kBAAwB,MAAM,OAAO,SACnC,kBACF;AACA,MAAG,QACD,iHACD;AACD;;AAIF,MAAI,CAAC,MAAA,kBAAwB,mBAAmB,EAAE;AAChD,MAAG,QACD,gEACA,MAAA,kBAAwB,MAAM,KAC/B;AACD;;AAGF,KAAG,OACD,mCAAmC,MAAA,kBAAwB,MAAM,OAClE;AAED,QAAA,kBAAwB,gBAAgB;AACxC,MAAI,MAAA,kBAAwB,MAAM,SAAS,aACzC;AAGF,QAAM,MAAA,kBAAwB,oBAAoB;;;AAItD,IAAa,mBAAb,cACU,aAEV;CACE;CAEA,YAAY,mBAAsC;AAChD,SAAO;AACP,QAAA,QAAc,MAAA,0BAAgC,kBAAkB,MAAM;AAMtE,oBAAkB,WAAU,UAAS;AACnC,SAAA,QAAc,MAAA,0BAAgC,MAAM;AACpD,QAAK,OAAO,MAAA,MAAY;IACxB;;CAGJ,IAAI,UAA2B;AAC7B,SAAO,MAAA;;CAGT,2BAA2B,OAAgD;AACzE,UAAQ,MAAM,MAAd;GACE,KAAK,OACH,QAAO;IACL,MAAM;IACN,QAAQ,MAAM,OAAO;IACtB;GACH,KAAK,UACH,QAAO,EACL,MAAM,aACP;GACH,KAAK,WACH,QAAO;IACL,MAAM;IACN,GAAI,MAAM,QAAQ,UAAU,EAAC,QAAQ,MAAM,OAAO,SAAQ,GAAG,EAAE;IAChE;GACH,KAAK,aACH,QAAO;IACL,MAAM;IACN,QAAQ,MAAM,OAAO;IACtB;GACH,KAAK,MACH,QAAO;IACL,MAAM;IACN,QAAQ,MAAM,OAAO;IACtB;GACH,KAAK,UACH,QAAO;IACL,MAAM;IACN,QACE,MAAM,OAAO,UAAU,SAAS,eAC5B;KACE,MAAM;KACN,QAAQ,MAAM,OAAO,UAAU;KAC/B,GAAI,MAAM,OAAO,UAAU,cACvB,EAAC,MAAM,MAAM,OAAO,UAAU,aAAY,GAC1C,EAAE;KACP,GACD,MAAM,OAAO,UAAU,SAAS,oBAC9B;KACE,MAAM;KACN,QAAQ,MAAM,OAAO,UAAU;KAC/B,GAAI,MAAM,OAAO,UAAU,cACvB,EAAC,MAAM,MAAM,OAAO,UAAU,aAAY,GAC1C,EAAE;KACP,GACD;KACE,MAAM;KACN,QAAQ,MAAM,OAAO;KACtB;IACV;GAEH,QACE,aAAY,MAAM"}
+{"version":3,"file":"connection.js","names":["#connectionManager","#lc","#source","#setAuth","#state","#mapConnectionManagerState"],"sources":["../../../../../zero-client/src/client/connection.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {unreachable} from '../../../shared/src/asserts.ts';\nimport {Subscribable} from '../../../shared/src/subscribable.ts';\nimport {ErrorKind} from '../../../zero-protocol/src/error-kind.ts';\nimport {ClientErrorKind} from './client-error-kind.ts';\nimport type {\n  ConnectionManager,\n  ConnectionManagerState,\n} from './connection-manager.ts';\nimport {ConnectionStatus} from './connection-status.ts';\n\n/**\n * The current connection state of the Zero instance. One of the following states:\n *\n * - `connecting`: The client is actively trying to connect every 5 seconds.\n * - `disconnected`: The client is now in an \"offline\" state. It will continue\n *   to try to connect every 5 seconds.\n * - `connected`: The client has opened a successful connection to the server.\n * - `needs-auth`: Authentication is invalid or expired. No connection retries will be made\n *   until the host application calls `connect()`.\n * - `error`: A fatal error occurred. No connection retries will be made until the host\n *   application calls `connect()` again.\n * - `closed`: The client was shut down (for example via `zero.close()`). This is\n *   a terminal state, and a new Zero instance must be created to reconnect.\n */\nexport type ConnectionState =\n  | {\n      name: 'disconnected';\n      reason: string;\n    }\n  | {\n      name: 'connecting';\n      reason?: string;\n    }\n  | {\n      name: 'connected';\n    }\n  | {\n      name: 'needs-auth';\n      reason:\n        | {\n            type: 'mutate';\n            status: 401 | 403;\n            body?: string;\n          }\n        | {\n            type: 'query';\n            status: 401 | 403;\n            body?: string;\n          }\n        | {\n            type: 'zero-cache';\n            reason: string;\n          };\n    }\n  | {\n      name: 'error';\n      reason: string;\n    }\n  | {\n      name: 'closed';\n      reason: string;\n    };\n\nexport interface Source<T> {\n  /**\n   * The current state value.\n   */\n  readonly current: T;\n\n  /**\n   * Subscribe to state changes.\n   *\n   * @param listener - Called when the state changes with the new state value.\n   * @returns A function to unsubscribe from state changes.\n   */\n  subscribe(listener: (state: T) => void): () => void;\n}\n\n/**\n * Connection API for managing Zero's connection lifecycle.\n */\nexport interface Connection {\n  /**\n   * The current connection state as a subscribable value.\n   */\n  readonly state: Source<ConnectionState>;\n\n  /**\n   * Resumes the connection from a terminal state.\n   *\n   * If called when not in a terminal state, this method does nothing.\n   * To clear existing auth credentials, create a new Zero instance with `auth` omitted.\n   *\n   * @param opts - Optional connection options\n   * @param opts.auth - Token to use for authentication. If provided, this overrides\n   *                    the stored auth credential for this connection attempt.\n   * @returns A promise that resolves once the connection state has transitioned to connecting.\n   */\n  connect(opts?: {auth: string}): Promise<void>;\n}\n\nexport class ConnectionImpl implements Connection {\n  readonly #connectionManager: ConnectionManager;\n  readonly #lc: LogContext;\n  readonly #source: ConnectionSource;\n  readonly #setAuth: (auth: string) => void;\n\n  constructor(\n    connectionManager: ConnectionManager,\n    lc: LogContext,\n    setAuth: (auth: string) => void,\n  ) {\n    this.#connectionManager = connectionManager;\n    this.#lc = lc;\n    this.#source = new ConnectionSource(connectionManager);\n    this.#setAuth = setAuth;\n  }\n\n  get state(): Source<ConnectionState> {\n    return this.#source;\n  }\n\n  async connect(opts?: {auth: string}): Promise<void> {\n    const lc = this.#lc.withContext('connect');\n\n    if (opts && 'auth' in opts) {\n      lc.debug?.('Updating auth credential from connect()');\n      this.#setAuth(opts.auth);\n    }\n\n    // if the connection is disconnected due to a missing cacheURL, we don't allow a reconnect\n    if (\n      this.#connectionManager.state.name === ConnectionStatus.Disconnected &&\n      this.#connectionManager.state.reason.kind ===\n        ClientErrorKind.NoSocketOrigin\n    ) {\n      lc.error?.(\n        'connect() called but the connection is disconnected due to a missing cacheURL. No reconnect will be attempted.',\n      );\n      return;\n    }\n\n    // only allow connect() to be called from a terminal state\n    if (!this.#connectionManager.isInTerminalState()) {\n      lc.debug?.(\n        'connect() called but not in a terminal state. Current state:',\n        this.#connectionManager.state.name,\n      );\n      return;\n    }\n\n    lc.info?.(\n      `Resuming connection from state: ${this.#connectionManager.state.name}`,\n    );\n\n    this.#connectionManager.requestConnect();\n    if (this.#connectionManager.state.name === ConnectionStatus.Connecting) {\n      return;\n    }\n\n    await this.#connectionManager.waitForStateChange();\n  }\n}\n\nexport class ConnectionSource\n  extends Subscribable<ConnectionState>\n  implements Source<ConnectionState>\n{\n  #state: ConnectionState;\n\n  constructor(connectionManager: ConnectionManager) {\n    super();\n    this.#state = this.#mapConnectionManagerState(connectionManager.state);\n\n    // Subscribe to ConnectionManager immediately to keep #state in sync.\n    // This ensures `current` always returns the correct state, even if\n    // external code hasn't subscribed yet (fixes race condition where\n    // connection completes before React subscribes).\n    connectionManager.subscribe(state => {\n      this.#state = this.#mapConnectionManagerState(state);\n      this.notify(this.#state);\n    });\n  }\n\n  get current(): ConnectionState {\n    return this.#state;\n  }\n\n  #mapConnectionManagerState(state: ConnectionManagerState): ConnectionState {\n    switch (state.name) {\n      case ConnectionStatus.Closed:\n        return {\n          name: 'closed',\n          reason: state.reason.message,\n        };\n      case ConnectionStatus.Connected:\n        return {\n          name: 'connected',\n        };\n      case ConnectionStatus.Connecting:\n        return {\n          name: 'connecting',\n          ...(state.reason?.message ? {reason: state.reason.message} : {}),\n        };\n      case ConnectionStatus.Disconnected:\n        return {\n          name: 'disconnected',\n          reason: state.reason.message,\n        };\n      case ConnectionStatus.Error:\n        return {\n          name: 'error',\n          reason: state.reason.message,\n        };\n      case ConnectionStatus.NeedsAuth:\n        return {\n          name: 'needs-auth',\n          reason:\n            state.reason.errorBody.kind === ErrorKind.PushFailed\n              ? {\n                  type: 'mutate',\n                  status: state.reason.errorBody.status,\n                  ...(state.reason.errorBody.bodyPreview\n                    ? {body: state.reason.errorBody.bodyPreview}\n                    : {}),\n                }\n              : state.reason.errorBody.kind === ErrorKind.TransformFailed\n                ? {\n                    type: 'query',\n                    status: state.reason.errorBody.status,\n                    ...(state.reason.errorBody.bodyPreview\n                      ? {body: state.reason.errorBody.bodyPreview}\n                      : {}),\n                  }\n                : {\n                    type: 'zero-cache',\n                    reason: state.reason.message,\n                  },\n        };\n\n      default:\n        unreachable(state);\n    }\n  }\n}\n"],"mappings":";;;;;;AAsGA,IAAa,iBAAb,MAAkD;CAChD;CACA;CACA;CACA;CAEA,YACE,mBACA,IACA,SACA;AACA,QAAA,oBAA0B;AAC1B,QAAA,KAAW;AACX,QAAA,SAAe,IAAI,iBAAiB,kBAAkB;AACtD,QAAA,UAAgB;;CAGlB,IAAI,QAAiC;AACnC,SAAO,MAAA;;CAGT,MAAM,QAAQ,MAAsC;EAClD,MAAM,KAAK,MAAA,GAAS,YAAY,UAAU;AAE1C,MAAI,QAAQ,UAAU,MAAM;AAC1B,MAAG,QAAQ,0CAA0C;AACrD,SAAA,QAAc,KAAK,KAAK;;AAI1B,MACE,MAAA,kBAAwB,MAAM,SAAS,kBACvC,MAAA,kBAAwB,MAAM,OAAO,SACnC,kBACF;AACA,MAAG,QACD,iHACD;AACD;;AAIF,MAAI,CAAC,MAAA,kBAAwB,mBAAmB,EAAE;AAChD,MAAG,QACD,gEACA,MAAA,kBAAwB,MAAM,KAC/B;AACD;;AAGF,KAAG,OACD,mCAAmC,MAAA,kBAAwB,MAAM,OAClE;AAED,QAAA,kBAAwB,gBAAgB;AACxC,MAAI,MAAA,kBAAwB,MAAM,SAAS,aACzC;AAGF,QAAM,MAAA,kBAAwB,oBAAoB;;;AAItD,IAAa,mBAAb,cACU,aAEV;CACE;CAEA,YAAY,mBAAsC;AAChD,SAAO;AACP,QAAA,QAAc,MAAA,0BAAgC,kBAAkB,MAAM;AAMtE,oBAAkB,WAAU,UAAS;AACnC,SAAA,QAAc,MAAA,0BAAgC,MAAM;AACpD,QAAK,OAAO,MAAA,MAAY;IACxB;;CAGJ,IAAI,UAA2B;AAC7B,SAAO,MAAA;;CAGT,2BAA2B,OAAgD;AACzE,UAAQ,MAAM,MAAd;GACE,KAAK,OACH,QAAO;IACL,MAAM;IACN,QAAQ,MAAM,OAAO;IACtB;GACH,KAAK,UACH,QAAO,EACL,MAAM,aACP;GACH,KAAK,WACH,QAAO;IACL,MAAM;IACN,GAAI,MAAM,QAAQ,UAAU,EAAC,QAAQ,MAAM,OAAO,SAAQ,GAAG,EAAE;IAChE;GACH,KAAK,aACH,QAAO;IACL,MAAM;IACN,QAAQ,MAAM,OAAO;IACtB;GACH,KAAK,MACH,QAAO;IACL,MAAM;IACN,QAAQ,MAAM,OAAO;IACtB;GACH,KAAK,UACH,QAAO;IACL,MAAM;IACN,QACE,MAAM,OAAO,UAAU,SAAS,eAC5B;KACE,MAAM;KACN,QAAQ,MAAM,OAAO,UAAU;KAC/B,GAAI,MAAM,OAAO,UAAU,cACvB,EAAC,MAAM,MAAM,OAAO,UAAU,aAAY,GAC1C,EAAE;KACP,GACD,MAAM,OAAO,UAAU,SAAS,oBAC9B;KACE,MAAM;KACN,QAAQ,MAAM,OAAO,UAAU;KAC/B,GAAI,MAAM,OAAO,UAAU,cACvB,EAAC,MAAM,MAAM,OAAO,UAAU,aAAY,GAC1C,EAAE;KACP,GACD;KACE,MAAM;KACN,QAAQ,MAAM,OAAO;KACtB;IACV;GAEH,QACE,aAAY,MAAM"}

package/out/zero-client/src/client/http-string.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-string.d.ts","sourceRoot":"","sources":["../../../../../zero-client/src/client/http-string.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,UAAU,GAAG,OAAO,EAAE,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;AAEvD,MAAM,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;AAEnD,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,QAAQ,CAEpD;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,QAAQ,GAAG,UAAU,CAEtD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,CAEvE;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,QAAQ,CAEnE;AAED,wBAAgB,UAAU,CAAC,CAAC,SAAS,UAAU,GAAG,QAAQ,EACxD,GAAG,EAAE,CAAC,EACN,QAAQ,EAAE,IAAI,MAAM,EAAE,GACrB,CAAC,CAEH"}
+{"version":3,"file":"http-string.d.ts","sourceRoot":"","sources":["../../../../../zero-client/src/client/http-string.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,UAAU,GAAG,OAAO,EAAE,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;AAEvD,MAAM,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;AAEnD,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,QAAQ,CAEpD;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,QAAQ,GAAG,UAAU,CAEtD;AAID,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,CAEvE;AAID,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,QAAQ,CAEnE;AAED,wBAAgB,UAAU,CAAC,CAAC,SAAS,UAAU,GAAG,QAAQ,EACxD,GAAG,EAAE,CAAC,EACN,QAAQ,EAAE,IAAI,MAAM,EAAE,GACrB,CAAC,CAEH"}

package/out/zero-client/src/client/http-string.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-string.js","names":[],"sources":["../../../../../zero-client/src/client/http-string.ts"],"sourcesContent":["import {assert} from '../../../shared/src/asserts.ts';\n\nexport type HTTPString = `http${'' | 's'}://${string}`;\n\nexport type WSString = `ws${'' | 's'}://${string}`;\n\nexport function toWSString(url: HTTPString): WSString {\n  return ('ws' + url.slice(4)) as WSString;\n}\n\nexport function toHTTPString(url: WSString): HTTPString {\n  return ('http' + url.slice(2)) as HTTPString;\n}\n\nexport function assertHTTPString(url: string): asserts url is HTTPString {\n  assert(/^https?:\\/\\//.test(url), () => `Expected HTTP(S) URL, got \"${url}\"`);\n}\n\nexport function assertWSString(url: string): asserts url is WSString {\n  assert(/^wss?:\\/\\//.test(url), () => `Expected WS(S) URL, got \"${url}\"`);\n}\n\nexport function appendPath<T extends HTTPString | WSString>(\n  url: T,\n  toAppend: `/${string}`,\n): T {\n  return (url + (url.endsWith('/') ? toAppend.substring(1) : toAppend)) as T;\n}\n"],"mappings":";AAMA,SAAgB,WAAW,KAA2B;AACpD,QAAQ,OAAO,IAAI,MAAM,EAAE;;AAe7B,SAAgB,WACd,KACA,UACG;AACH,QAAQ,OAAO,IAAI,SAAS,IAAI,GAAG,SAAS,UAAU,EAAE,GAAG"}
+{"version":3,"file":"http-string.js","names":[],"sources":["../../../../../zero-client/src/client/http-string.ts"],"sourcesContent":["import {assert} from '../../../shared/src/asserts.ts';\n\nexport type HTTPString = `http${'' | 's'}://${string}`;\n\nexport type WSString = `ws${'' | 's'}://${string}`;\n\nexport function toWSString(url: HTTPString): WSString {\n  return ('ws' + url.slice(4)) as WSString;\n}\n\nexport function toHTTPString(url: WSString): HTTPString {\n  return ('http' + url.slice(2)) as HTTPString;\n}\n\nconst httpsRe = /^https?:\\/\\//;\n\nexport function assertHTTPString(url: string): asserts url is HTTPString {\n  assert(httpsRe.test(url), () => `Expected HTTP(S) URL, got \"${url}\"`);\n}\n\nconst wssRe = /^wss?:\\/\\//;\n\nexport function assertWSString(url: string): asserts url is WSString {\n  assert(wssRe.test(url), () => `Expected WS(S) URL, got \"${url}\"`);\n}\n\nexport function appendPath<T extends HTTPString | WSString>(\n  url: T,\n  toAppend: `/${string}`,\n): T {\n  return (url + (url.endsWith('/') ? toAppend.substring(1) : toAppend)) as T;\n}\n"],"mappings":";AAMA,SAAgB,WAAW,KAA2B;AACpD,QAAQ,OAAO,IAAI,MAAM,EAAE;;AAmB7B,SAAgB,WACd,KACA,UACG;AACH,QAAQ,OAAO,IAAI,SAAS,IAAI,GAAG,SAAS,UAAU,EAAE,GAAG"}

package/out/zero-client/src/client/metrics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../../../../zero-client/src/client/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,8BAA8B,CAAC;AAE/D,OAAO,EAGL,KAAK,SAAS,EAEf,MAAM,YAAY,CAAC;AAOpB,eAAO,MAAM,qBAAqB,QAAa,CAAC;AAEhD,eAAO,MAAM,kBAAkB,OAAQ,CAAC;AASxC,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,2CAEzD;AAYD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAcnE;AAED,KAAK,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,CAAC,IAAI,CAAC,CAAC;AAEjE,MAAM,MAAM,oBAAoB,GAAG;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,eAAe,CAAC;IAC1B,EAAE,EAAE,UAAU,CAAC;CAChB,CAAC;AAEF;;;GAGG;AACH,qBAAa,aAAa;;gBAOZ,IAAI,EAAE,oBAAoB;IAiCtC,QAAQ,CAAC,eAAe,QAEtB;IAMF,QAAQ,CAAC,gBAAgB,QAKvB;IAqCF,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM;IAOlE,gCAAgC;IAmBhC,eAAe,CAAC,MAAM,EAAE,SAAS;IAOjC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAM;IAIvB,KAAK;IA4BX,IAAI;CAaL;AAMD,6DAA6D;AAC7D,MAAM,MAAM,MAAM,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AACF;;;;;GAKG;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAMvC,KAAK,SAAS,GAAG;IACf,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC,GAAG,SAAS,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,qBAAa,KAAM,YAAW,SAAS;;gBAIzB,IAAI,EAAE,MAAM;IAIxB,GAAG,CAAC,KAAK,EAAE,MAAM;IAIjB,GAAG;IAIH,KAAK;IAIL,KAAK;;;;CASN;AAMD;;;;;;;;;;;;GAYG;AACH,qBAAa,KAAM,YAAW,SAAS;;gBAKzB,MAAM,EAAE,MAAM,EAAE,YAAY,UAAQ;IAKhD,GAAG,CAAC,KAAK,EAAE,MAAM;IAIjB,GAAG;IAIH,KAAK;IAIL,KAAK;;;;CAYN"}
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../../../../zero-client/src/client/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,8BAA8B,CAAC;AAE/D,OAAO,EAGL,KAAK,SAAS,EAEf,MAAM,YAAY,CAAC;AAOpB,eAAO,MAAM,qBAAqB,QAAa,CAAC;AAEhD,eAAO,MAAM,kBAAkB,OAAQ,CAAC;AASxC,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,2CAEzD;AAWD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAcnE;AAED,KAAK,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,CAAC,IAAI,CAAC,CAAC;AAEjE,MAAM,MAAM,oBAAoB,GAAG;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,eAAe,CAAC;IAC1B,EAAE,EAAE,UAAU,CAAC;CAChB,CAAC;AAEF;;;GAGG;AACH,qBAAa,aAAa;;gBAOZ,IAAI,EAAE,oBAAoB;IAiCtC,QAAQ,CAAC,eAAe,QAEtB;IAMF,QAAQ,CAAC,gBAAgB,QAKvB;IAqCF,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM;IAOlE,gCAAgC;IAmBhC,eAAe,CAAC,MAAM,EAAE,SAAS;IAOjC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAM;IAIvB,KAAK;IA4BX,IAAI;CAaL;AAMD,6DAA6D;AAC7D,MAAM,MAAM,MAAM,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AACF;;;;;GAKG;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAMvC,KAAK,SAAS,GAAG;IACf,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC,GAAG,SAAS,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,qBAAa,KAAM,YAAW,SAAS;;gBAIzB,IAAI,EAAE,MAAM;IAIxB,GAAG,CAAC,KAAK,EAAE,MAAM;IAIjB,GAAG;IAIH,KAAK;IAIL,KAAK;;;;CASN;AAMD;;;;;;;;;;;;GAYG;AACH,qBAAa,KAAM,YAAW,SAAS;;gBAKzB,MAAM,EAAE,MAAM,EAAE,YAAY,UAAQ;IAKhD,GAAG,CAAC,KAAK,EAAE,MAAM;IAIjB,GAAG;IAIH,KAAK;IAIL,KAAK;;;;CAYN"}