npm - @rocicorp/zero - Versions diffs - 1.2.0 → 1.3.0-canary.1 - Mend

@rocicorp/zero 1.2.0 → 1.3.0-canary.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (303) hide show

package/out/zero/package.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"package.js","names":[],"sources":["../../package.json"],"sourcesContent":["{\n \"name\": \"@rocicorp/zero\",\n \"version\": \"1.2.0\",\n \"description\": \"Zero is a web framework for serverless web development.\",\n \"author\": \"Rocicorp, Inc.\",\n \"repository\": {\n \"type\": \"git\",\n \"url\": \"git+https://github.com/rocicorp/mono.git\",\n \"directory\": \"packages/zero\"\n },\n \"license\": \"Apache-2.0\",\n \"homepage\": \"https://zero.rocicorp.dev\",\n \"bugs\": {\n \"url\": \"https://bugs.rocicorp.dev\"\n },\n \"scripts\": {\n \"build\": \"node --experimental-strip-types --no-warnings tool/build.ts\",\n \"build:watch\": \"node --experimental-strip-types --no-warnings tool/build.ts --watch\",\n \"check-types\": \"tsc -p tsconfig.client.json && tsc -p tsconfig.server.json\",\n \"check-types:client:watch\": \"tsc -p tsconfig.client.json --watch\",\n \"check-types:server:watch\": \"tsc -p tsconfig.server.json --watch\",\n \"format\": \"oxfmt .\",\n \"check-format\": \"oxfmt --check .\",\n \"lint\": \"oxlint --type-aware src/\",\n \"docs\": \"node --experimental-strip-types --no-warnings tool/generate-docs.ts\",\n \"docs:server\": \"node --watch --experimental-strip-types --no-warnings tool/generate-docs.ts --server\"\n },\n \"dependencies\": {\n \"@badrap/valita\": \"0.3.11\",\n \"@databases/escape-identifier\": \"^1.0.3\",\n \"@databases/sql\": \"^3.3.0\",\n \"@dotenvx/dotenvx\": \"^1.39.0\",\n \"@drdgvhbh/postgres-error-codes\": \"^0.0.6\",\n \"@fastify/cors\": \"^10.0.0\",\n \"@fastify/websocket\": \"^11.0.0\",\n \"@google-cloud/precise-date\": \"^4.0.0\",\n \"@opentelemetry/api\": \"^1.9.0\",\n \"@opentelemetry/api-logs\": \"^0.203.0\",\n \"@opentelemetry/auto-instrumentations-node\": \"^0.62.0\",\n \"@opentelemetry/exporter-metrics-otlp-http\": \"^0.203.0\",\n \"@opentelemetry/resources\": \"^2.0.1\",\n \"@opentelemetry/sdk-metrics\": \"^2.0.1\",\n \"@opentelemetry/sdk-node\": \"^0.203.0\",\n \"@opentelemetry/sdk-trace-node\": \"^2.0.1\",\n \"@postgresql-typed/oids\": \"^0.2.0\",\n \"@rocicorp/lock\": \"^1.0.4\",\n \"@rocicorp/logger\": \"^5.4.0\",\n \"@rocicorp/resolver\": \"^1.0.2\",\n \"@rocicorp/zero-sqlite3\": \"^1.0.15\",\n \"@standard-schema/spec\": \"^1.0.0\",\n \"@types/basic-auth\": \"^1.1.8\",\n \"@types/ws\": \"^8.5.12\",\n \"basic-auth\": \"^2.0.1\",\n \"chalk~~\": \"^5.3.0\",\n \"chalk~~-template\": \"^1.1.0\",\n \"chokidar\": \"^4.0.1\",\n \"cloudevents\": \"^10.0.0\",\n \"command-line-args\": \"^6.0.1\",\n \"command-line-usage\": \"^7.0.3\",\n \"compare-utf8\": \"^0.2.0\",\n \"defu\": \"^6.1.4\",\n \"eventemitter3\": \"^5.0.1\",\n \"fastify\": \"^5.0.0\",\n \"is-in-subnet\": \"^4.0.1\",\n \"jose\": \"^5.9.3\",\n \"js-xxhash\": \"^4.0.0\",\n \"json-custom-numbers\": \"^3.1.1\",\n \"kasi\": \"^1.1.0\",\n \"nanoid\": \"^5.1.2\",\n \"oxfmt\": \"^0.43.0\",\n \"parse-prometheus-text-format\": \"^1.1.1\",\n \"pg-format\": \"npm:pg-format-fix@^1.0.5\",\n \"postgres\": \"3.4.7\",\n \"semver\": \"^7.5.4\",\n \"tsx\": \"^4.21.0\",\n \"url-pattern\": \"^1.0.3\",\n \"urlpattern-polyfill\": \"^10.1.0\",\n \"ws\": \"^8.18.1\"\n },\n \"devDependencies\": {\n \"@op-engineering/op-sqlite\": \">=15\",\n \"@vitest/runner\": \"4.1.2\",\n \"analyze-query\": \"0.0.0\",\n \"ast-to-zql\": \"0.0.0\",\n \"expo-sqlite\": \">=15\",\n \"replicache\": \"15.2.1\",\n \"shared\": \"0.0.0\",\n \"syncpack\": \"^14.2.1\",\n \"typedoc\": \"^0.28.17\",\n \"typedoc-plugin-markdown\": \"^4.10.0\",\n \"typescript\": \"~5.9.3\",\n \"vite\": \"8.0.3\",\n \"vitest\": \"4.1.2\",\n \"zero-cache\": \"0.0.0\",\n \"zero-client\": \"0.0.0\",\n \"zero-pg\": \"0.0.0\",\n \"zero-protocol\": \"0.0.0\",\n \"zero-react\": \"0.0.0\",\n \"zero-server\": \"0.0.0\",\n \"zero-solid\": \"0.0.0\",\n \"zqlite\": \"0.0.0\"\n },\n \"peerDependencies\": {\n \"@op-engineering/op-sqlite\": \">=15\",\n \"expo-sqlite\": \">=15\"\n },\n \"peerDependenciesMeta\": {\n \"expo-sqlite\": {\n \"optional\": true\n },\n \"@op-engineering/op-sqlite\": {\n \"optional\": true\n }\n },\n \"type\": \"module\",\n \"main\": \"out/zero/src/zero.js\",\n \"module\": \"out/zero/src/zero.js\",\n \"types\": \"out/zero/src/zero.d.ts\",\n \"exports\": {\n \".\": {\n \"types\": \"./out/zero/src/zero.d.ts\",\n \"default\": \"./out/zero/src/zero.js\"\n },\n \"./bindings\": {\n \"types\": \"./out/zero/src/bindings.d.ts\",\n \"default\": \"./out/zero/src/bindings.js\"\n },\n \"./change-protocol/v0\": {\n \"types\": \"./out/zero/src/change-protocol/v0.d.ts\",\n \"default\": \"./out/zero/src/change-protocol/v0.js\"\n },\n \"./expo-sqlite\": {\n \"types\": \"./out/zero/src/expo-sqlite.d.ts\",\n \"default\": \"./out/zero/src/expo-sqlite.js\"\n },\n \"./op-sqlite\": {\n \"types\": \"./out/zero/src/op-sqlite.d.ts\",\n \"default\": \"./out/zero/src/op-sqlite.js\"\n },\n \"./pg\": {\n \"types\": \"./out/zero/src/pg.d.ts\",\n \"default\": \"./out/zero/src/pg.js\"\n },\n \"./react\": {\n \"types\": \"./out/zero/src/react.d.ts\",\n \"default\": \"./out/zero/src/react.js\"\n },\n \"./react-native\": {\n \"types\": \"./out/zero/src/react-native.d.ts\",\n \"default\": \"./out/zero/src/react-native.js\"\n },\n \"./server\": {\n \"types\": \"./out/zero/src/server.d.ts\",\n \"default\": \"./out/zero/src/server.js\"\n },\n \"./server/adapters/drizzle\": {\n \"types\": \"./out/zero/src/adapters/drizzle.d.ts\",\n \"default\": \"./out/zero/src/adapters/drizzle.js\"\n },\n \"./server/adapters/prisma\": {\n \"types\": \"./out/zero/src/adapters/prisma.d.ts\",\n \"default\": \"./out/zero/src/adapters/prisma.js\"\n },\n \"./server/adapters/pg\": {\n \"types\": \"./out/zero/src/adapters/pg.d.ts\",\n \"default\": \"./out/zero/src/adapters/pg.js\"\n },\n \"./server/adapters/postgresjs\": {\n \"types\": \"./out/zero/src/adapters/postgresjs.d.ts\",\n \"default\": \"./out/zero/src/adapters/postgresjs.js\"\n },\n \"./solid\": {\n \"types\": \"./out/zero/src/solid.d.ts\",\n \"default\": \"./out/zero/src/solid.js\"\n },\n \"./sqlite\": {\n \"types\": \"./out/zero/src/sqlite.d.ts\",\n \"default\": \"./out/zero/src/sqlite.js\"\n },\n \"./zqlite\": {\n \"types\": \"./out/zero/src/zqlite.d.ts\",\n \"default\": \"./out/zero/src/zqlite.js\"\n }\n },\n \"bin\": {\n \"zero-build-schema\": \"./out/zero/src/build-schema.js\",\n \"zero-cache\": \"./out/zero/src/cli.js\",\n \"zero-cache-dev\": \"./out/zero/src/zero-cache-dev.js\",\n \"zero-deploy-permissions\": \"./out/zero/src/deploy-permissions.js\",\n \"zero-out\": \"./out/zero/src/zero-out.js\",\n \"ast-to-zql\": \"./out/zero/src/ast-to-zql.js\",\n \"analyze-query\": \"./out/zero/src/analyze-query.js\",\n \"transform-query\": \"./out/zero/src/transform-query.js\"\n },\n \"engines\": {\n \"node\": \">=22\"\n },\n \"files\": [\n \"out\",\n \"!*.tsbuildinfo\"\n ]\n}"],"mappings":""}
1	+ {"version":3,"file":"package.js","names":[],"sources":["../../package.json"],"sourcesContent":["{\n \"name\": \"@rocicorp/zero\",\n \"version\": \"1.3.0-canary.1\",\n \"description\": \"Zero is a web framework for serverless web development.\",\n \"author\": \"Rocicorp, Inc.\",\n \"repository\": {\n \"type\": \"git\",\n \"url\": \"git+https://github.com/rocicorp/mono.git\",\n \"directory\": \"packages/zero\"\n },\n \"license\": \"Apache-2.0\",\n \"homepage\": \"https://zero.rocicorp.dev\",\n \"bugs\": {\n \"url\": \"https://bugs.rocicorp.dev\"\n },\n \"scripts\": {\n \"build\": \"node --experimental-strip-types --no-warnings tool/build.ts\",\n \"build:watch\": \"node --experimental-strip-types --no-warnings tool/build.ts --watch\",\n \"check-types\": \"tsc -p tsconfig.client.json && tsc -p tsconfig.server.json\",\n \"check-types:client:watch\": \"tsc -p tsconfig.client.json --watch\",\n \"check-types:server:watch\": \"tsc -p tsconfig.server.json --watch\",\n \"format\": \"oxfmt .\",\n \"check-format\": \"oxfmt --check .\",\n \"lint\": \"oxlint --type-aware src/\",\n \"docs\": \"node --experimental-strip-types --no-warnings tool/generate-docs.ts\",\n \"docs:server\": \"node --watch --experimental-strip-types --no-warnings tool/generate-docs.ts --server\"\n },\n \"dependencies\": {\n \"@badrap/valita\": \"0.3.11\",\n \"@databases/escape-identifier\": \"^1.0.3\",\n \"@databases/sql\": \"^3.3.0\",\n \"@dotenvx/dotenvx\": \"^1.39.0\",\n \"@drdgvhbh/postgres-error-codes\": \"^0.0.6\",\n \"@fastify/cors\": \"^10.0.0\",\n \"@fastify/websocket\": \"^11.0.0\",\n \"@google-cloud/precise-date\": \"^4.0.0\",\n \"@opentelemetry/api\": \"^1.9.0\",\n \"@opentelemetry/api-logs\": \"^0.203.0\",\n \"@opentelemetry/auto-instrumentations-node\": \"^0.62.0\",\n \"@opentelemetry/exporter-metrics-otlp-http\": \"^0.203.0\",\n \"@opentelemetry/resources\": \"^2.0.1\",\n \"@opentelemetry/sdk-metrics\": \"^2.0.1\",\n \"@opentelemetry/sdk-node\": \"^0.203.0\",\n \"@opentelemetry/sdk-trace-node\": \"^2.0.1\",\n \"@postgresql-typed/oids\": \"^0.2.0\",\n \"@rocicorp/lock\": \"^1.0.4\",\n \"@rocicorp/logger\": \"^5.4.0\",\n \"@rocicorp/resolver\": \"^1.0.2\",\n \"@rocicorp/zero-sqlite3\": \"^1.0.15\",\n \"@standard-schema/spec\": \"^1.0.0\",\n \"@types/basic-auth\": \"^1.1.8\",\n \"@types/ws\": \"^8.5.12\",\n \"basic-auth\": \"^2.0.1\",\n \"chalk-template\": \"^1.1.0\",\n \"chokidar\": \"^4.0.1\",\n \"cloudevents\": \"^10.0.0\",\n \"command-line-args\": \"^6.0.1\",\n \"command-line-usage\": \"^7.0.3\",\n \"compare-utf8\": \"^0.2.0\",\n \"defu\": \"^6.1.4\",\n \"eventemitter3\": \"^5.0.1\",\n \"fastify\": \"^5.0.0\",\n \"is-in-subnet\": \"^4.0.1\",\n \"jose\": \"^5.9.3\",\n \"js-xxhash\": \"^4.0.0\",\n \"json-custom-numbers\": \"^3.1.1\",\n \"kasi\": \"^1.1.0\",\n \"nanoid\": \"^5.1.2\",\n \"oxfmt\": \"^0.44.0\",\n \"parse-prometheus-text-format\": \"^1.1.1\",\n \"pg-format\": \"npm:pg-format-fix@^1.0.5\",\n \"postgres\": \"3.4.7\",\n \"semver\": \"^7.5.4\",\n \"tsx\": \"^4.21.0\",\n \"url-pattern\": \"^1.0.3\",\n \"urlpattern-polyfill\": \"^10.1.0\",\n \"ws\": \"^8.18.1\"\n },\n \"devDependencies\": {\n \"@op-engineering/op-sqlite\": \">=15\",\n \"@vitest/runner\": \"4.1.3\",\n \"analyze-query\": \"0.0.0\",\n \"ast-to-zql\": \"0.0.0\",\n \"expo-sqlite\": \">=15\",\n \"replicache\": \"15.2.1\",\n \"shared\": \"0.0.0\",\n \"syncpack\": \"^14.3.0\",\n \"typedoc\": \"^0.28.17\",\n \"typedoc-plugin-markdown\": \"^4.10.0\",\n \"typescript\": \"~6.0.2\",\n \"vite\": \"8.0.3\",\n \"vitest\": \"4.1.3\",\n \"zero-cache\": \"0.0.0\",\n \"zero-client\": \"0.0.0\",\n \"zero-pg\": \"0.0.0\",\n \"zero-protocol\": \"0.0.0\",\n \"zero-react\": \"0.0.0\",\n \"zero-server\": \"0.0.0\",\n \"zero-solid\": \"0.0.0\",\n \"zqlite\": \"0.0.0\"\n },\n \"peerDependencies\": {\n \"@op-engineering/op-sqlite\": \">=15\",\n \"expo-sqlite\": \">=15\"\n },\n \"peerDependenciesMeta\": {\n \"expo-sqlite\": {\n \"optional\": true\n },\n \"@op-engineering/op-sqlite\": {\n \"optional\": true\n }\n },\n \"type\": \"module\",\n \"main\": \"out/zero/src/zero.js\",\n \"module\": \"out/zero/src/zero.js\",\n \"types\": \"out/zero/src/zero.d.ts\",\n \"exports\": {\n \".\": {\n \"types\": \"./out/zero/src/zero.d.ts\",\n \"default\": \"./out/zero/src/zero.js\"\n },\n \"./bindings\": {\n \"types\": \"./out/zero/src/bindings.d.ts\",\n \"default\": \"./out/zero/src/bindings.js\"\n },\n \"./change-protocol/v0\": {\n \"types\": \"./out/zero/src/change-protocol/v0.d.ts\",\n \"default\": \"./out/zero/src/change-protocol/v0.js\"\n },\n \"./expo-sqlite\": {\n \"types\": \"./out/zero/src/expo-sqlite.d.ts\",\n \"default\": \"./out/zero/src/expo-sqlite.js\"\n },\n \"./op-sqlite\": {\n \"types\": \"./out/zero/src/op-sqlite.d.ts\",\n \"default\": \"./out/zero/src/op-sqlite.js\"\n },\n \"./pg\": {\n \"types\": \"./out/zero/src/pg.d.ts\",\n \"default\": \"./out/zero/src/pg.js\"\n },\n \"./react\": {\n \"types\": \"./out/zero/src/react.d.ts\",\n \"default\": \"./out/zero/src/react.js\"\n },\n \"./react-native\": {\n \"types\": \"./out/zero/src/react-native.d.ts\",\n \"default\": \"./out/zero/src/react-native.js\"\n },\n \"./server\": {\n \"types\": \"./out/zero/src/server.d.ts\",\n \"default\": \"./out/zero/src/server.js\"\n },\n \"./server/adapters/drizzle\": {\n \"types\": \"./out/zero/src/adapters/drizzle.d.ts\",\n \"default\": \"./out/zero/src/adapters/drizzle.js\"\n },\n \"./server/adapters/prisma\": {\n \"types\": \"./out/zero/src/adapters/prisma.d.ts\",\n \"default\": \"./out/zero/src/adapters/prisma.js\"\n },\n \"./server/adapters/pg\": {\n \"types\": \"./out/zero/src/adapters/pg.d.ts\",\n \"default\": \"./out/zero/src/adapters/pg.js\"\n },\n \"./server/adapters/postgresjs\": {\n \"types\": \"./out/zero/src/adapters/postgresjs.d.ts\",\n \"default\": \"./out/zero/src/adapters/postgresjs.js\"\n },\n \"./solid\": {\n \"types\": \"./out/zero/src/solid.d.ts\",\n \"default\": \"./out/zero/src/solid.js\"\n },\n \"./sqlite\": {\n \"types\": \"./out/zero/src/sqlite.d.ts\",\n \"default\": \"./out/zero/src/sqlite.js\"\n },\n \"./zqlite\": {\n \"types\": \"./out/zero/src/zqlite.d.ts\",\n \"default\": \"./out/zero/src/zqlite.js\"\n }\n },\n \"bin\": {\n \"zero-build-schema\": \"./out/zero/src/build-schema.js\",\n \"zero-cache\": \"./out/zero/src/cli.js\",\n \"zero-cache-dev\": \"./out/zero/src/zero-cache-dev.js\",\n \"zero-deploy-permissions\": \"./out/zero/src/deploy-permissions.js\",\n \"zero-out\": \"./out/zero/src/zero-out.js\",\n \"ast-to-zql\": \"./out/zero/src/ast-to-zql.js\",\n \"analyze-query\": \"./out/zero/src/analyze-query.js\",\n \"transform-query\": \"./out/zero/src/transform-query.js\"\n },\n \"engines\": {\n \"node\": \">=22\"\n },\n \"files\": [\n \"out\",\n \"!*.tsbuildinfo\"\n ]\n}"],"mappings":""}

package/out/zero/src/pg.js CHANGED Viewed

@@ -1,8 +1,8 @@
 import { ApplicationError, isApplicationError } from "../../zero-protocol/src/application-error.js";
 import { CRUDMutatorFactory, makeSchemaCRUD } from "../../zero-server/src/custom.js";
 import { executePostgresQuery } from "../../zero-server/src/pg-query-executor.js";
-import { OutOfOrderMutation, getMutation, handleMutateRequest, handleMutationRequest } from "../../zero-server/src/process-mutations.js";
 import { PushProcessor } from "../../zero-server/src/push-processor.js";
+import { OutOfOrderMutation, getMutation, handleMutateRequest, handleMutationRequest } from "../../zero-server/src/process-mutations.js";
 import { handleGetQueriesRequest, handleQueryRequest, handleTransformRequest } from "../../zero-server/src/queries/process-queries.js";
 import { ZQLDatabase } from "../../zero-server/src/zql-database.js";
 import { PostgresJSConnection, PostgresJsTransactionInternal, zeroPostgresJS } from "../../zero-server/src/adapters/postgresjs.js";

package/out/zero/src/server.js CHANGED Viewed

@@ -1,8 +1,8 @@
 import { ApplicationError, isApplicationError } from "../../zero-protocol/src/application-error.js";
 import { CRUDMutatorFactory, makeSchemaCRUD } from "../../zero-server/src/custom.js";
 import { executePostgresQuery } from "../../zero-server/src/pg-query-executor.js";
-import { OutOfOrderMutation, getMutation, handleMutateRequest, handleMutationRequest } from "../../zero-server/src/process-mutations.js";
 import { PushProcessor } from "../../zero-server/src/push-processor.js";
+import { OutOfOrderMutation, getMutation, handleMutateRequest, handleMutationRequest } from "../../zero-server/src/process-mutations.js";
 import { handleGetQueriesRequest, handleQueryRequest, handleTransformRequest } from "../../zero-server/src/queries/process-queries.js";
 import { ZQLDatabase } from "../../zero-server/src/zql-database.js";
 import "../../zero-server/src/mod.js";

package/out/zero-cache/src/auth/auth.d.ts CHANGED Viewed

@@ -1,6 +1,7 @@
 import type { LogContext } from '@rocicorp/logger';
 import type { JWTPayload } from 'jose';
 import { type ErrorBody } from '../../../zero-protocol/src/error.ts';
+import type { PushError } from '../../../zero-protocol/src/push.ts';
 /** @deprecated JWT auth is deprecated */
 export type JWTAuth = {
     readonly type: 'jwt';
@@ -12,34 +13,15 @@ export type OpaqueAuth = {
     readonly raw: string;
 };
 export type Auth = OpaqueAuth | JWTAuth;
-export interface AuthSession {
-    /** Update the auth session with a new userID and token from the client */
-    update(userID: string, wireAuth: string | undefined): Promise<AuthUpdateResult>;
-    /** The revision of the auth state */
-    get revision(): number;
-    /** The auth state for the session */
-    get auth(): Auth | undefined;
-    /** Clear the auth session, removing any stored auth and allowing a new userID to be bound on the next update. */
-    clear(): void;
-}
-export type AuthUpdateResult = {
-    readonly ok: true;
-} | {
-    readonly ok: false;
-    readonly error: ErrorBody;
-};
 export type ValidateLegacyJWT = (token: string, ctx: {
-    readonly userID: string;
+    readonly userID: string | undefined;
 }) => Promise<JWTAuth>;
-export declare class AuthSessionImpl implements AuthSession {
-    #private;
-    readonly id: string;
-    constructor(lc: LogContext, clientGroupID: string, validateLegacyJWT: ValidateLegacyJWT | undefined);
-    get auth(): Auth | undefined;
-    get revision(): number;
-    clear(): void;
-    update(userID: string, wireAuth: string | undefined): Promise<AuthUpdateResult>;
-}
+export declare function authEquals(a: Auth | undefined, b: Auth | undefined): boolean;
+/**
+ * Resolves one auth snapshot transition without binding it to a client group.
+ */
+export declare function resolveAuth(lc: LogContext, previousAuth: Auth | undefined, userID: string | undefined, wireAuth: string | undefined, validateLegacyJWT: ValidateLegacyJWT | undefined): Promise<Auth | undefined>;
 /** @deprecated used only in old JWT validation/rotation auth */
 export declare function pickToken(lc: LogContext, previousToken: Auth | undefined, newToken: Auth | undefined | null): Auth | undefined;
+export declare function isAuthErrorBody(ex: unknown): ex is ErrorBody | PushError;
 //# sourceMappingURL=auth.d.ts.map

package/out/zero-cache/src/auth/auth.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAGrC,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,qCAAqC,CAAC;AAE7C,yCAAyC;AACzC,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,OAAO,CAAC;AAExC,MAAM,~~WAAW~~,~~WAAW;IAC1B~~,~~0EAA0E;IAC1E~~,~~MAAM~~,~~CACJ~~,~~MAAM,~~EAAE,MAAM,~~EACd~~,~~QAAQ~~,EAAE~~,MAAM,GAAG,SAAS,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CAAC~~;~~IAE7B~~,~~qCAAqC;IACrC,IAAI,~~QAAQ,~~IAAI~~,MAAM,~~CAAC;IAEvB~~,~~qCAAqC;IACrC~~,~~IAAI,IAAI,IAAI,IAAI,~~GAAG,SAAS,CAAC~~;IAE7B~~,~~iHAAiH;IACjH~~,~~KAAK~~,~~IAAI,IAAI,~~CAAC~~;CACf;AAED~~,~~MAAM~~,~~MAAM,gBAAgB,GACxB;IACE,QAAQ,~~CAAC,~~EAAE,EAAE,IAAI,~~CAAC;~~CACnB~~,~~GACD;IACE~~,~~QAAQ~~,CAAC,~~EAAE,EAAE,KAAK,~~CAAC~~;IACnB~~,~~QAAQ,CAAC,KAAK,~~EAAE,~~SAAS~~,~~CAAC;CAC3B,CAAC;AAEN,MAAM,MAAM,iBAAiB,~~GAAG,~~CAC9B~~,~~KAAK,~~EAAE,~~MAAM,EACb,GAAG,EAAE;IAAC,QAAQ,~~CAAC,~~MAAM,~~EAAE,~~MAAM~~,~~CAAA;CAAC~~,~~KAC3B~~,~~OAAO,CAAC,OAAO,CAAC,CAAC~~;~~AAgBtB~~,~~qBAAa~~,~~eAAgB,YAAW,~~WAAW~~;;IACjD~~,~~QAAQ~~,~~CAAC,~~EAAE,EAAE,~~MAAM,CAAC;gBAQlB,EAAE,EAAE,~~UAAU,EACd,~~aAAa~~,EAAE,~~MAAM~~,~~EACrB,iBAAiB,EAAE,iBAAiB,~~GAAG,SAAS~~;IAOlD~~,~~IAAI~~,~~IAAI~~,~~IAAI~~,~~IAAI~~,GAAG,SAAS,~~CAE3B;IAED~~,~~IAAI,~~QAAQ,~~IAAI~~,MAAM,~~CAErB;IAED~~,~~KAAK~~,~~IAAI~~,~~IAAI;IAWP~~,~~MAAM~~,~~CACV~~,~~MAAM~~,~~EAAE~~,~~MAAM~~,~~EACd~~,~~QAAQ~~,~~EAAE~~,~~MAAM,~~GAAG,SAAS,~~GAC3B,OAAO,~~CAAC,~~gBAAgB,CAAC~~;~~CAoF7B;~~AAED,gEAAgE;AAChE,wBAAgB,SAAS,CACvB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,IAAI,GAAG,SAAS,EAC/B,QAAQ,EAAE,IAAI,GAAG,SAAS,GAAG,IAAI,oBAgFlC"}
1	+ {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAGrC,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,oCAAoC,CAAC;AAElE,yCAAyC;AACzC,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,OAAO,CAAC;AAExC,MAAM,MAAM,iBAAiB,GAAG,CAC9B,KAAK,EAAE,MAAM,EACb,GAAG,EAAE;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,KACvC,OAAO,CAAC,OAAO,CAAC,CAAC;AAMtB,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,IAAI,GAAG,SAAS,WAQlE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,UAAU,EACd,YAAY,EAAE,IAAI,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,GAC/C,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAoE3B;AAED,gEAAgE;AAChE,wBAAgB,SAAS,CACvB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,IAAI,GAAG,SAAS,EAC/B,QAAQ,EAAE,IAAI,GAAG,SAAS,GAAG,IAAI,oBAgFlC;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,OAAO,GAAG,EAAE,IAAI,SAAS,GAAG,SAAS,CAgCxE"}

package/out/zero-cache/src/auth/auth.js CHANGED Viewed

@@ -1,5 +1,6 @@
 import { AuthInvalidated, Unauthorized } from "../../../zero-protocol/src/error-kind-enum.js";
 import { ZeroCache } from "../../../zero-protocol/src/error-origin-enum.js";
+import "../../../zero-protocol/src/error-reason-enum.js";
 import { ProtocolError, isProtocolError } from "../../../zero-protocol/src/error.js";
 //#region ../zero-cache/src/auth/auth.ts
 function isProvidedAuth(wireAuth) {
@@ -10,89 +11,56 @@ function authEquals(a, b) {
 	if (!a || !b) return false;
 	return a.type === b.type && a.raw === b.raw;
 }
-var AuthSessionImpl = class {
-	id;
-	#lc;
-	#validateLegacyJWT;
-	#auth = void 0;
-	#boundUserID;
-	#revision = 0;
-	constructor(lc, clientGroupID, validateLegacyJWT) {
-		this.id = clientGroupID;
-		this.#lc = lc;
-		this.#validateLegacyJWT = validateLegacyJWT;
-	}
-	get auth() {
-		return this.#auth;
-	}
-	get revision() {
-		return this.#revision;
-	}
-	clear() {
-		this.#lc.withContext("boundUserID", this.#boundUserID ?? "unknown").debug?.(`Clearing auth session`);
-		this.#auth = void 0;
-		this.#boundUserID = void 0;
-		this.#revision = 0;
-	}
-	async update(userID, wireAuth) {
-		try {
-			const lc = this.#lc.withContext("newUserID", userID);
-			if (this.#boundUserID && this.#boundUserID !== userID) return {
-				ok: false,
-				error: {
-					kind: Unauthorized,
-					message: "Client groups are pinned to a single user. Connection userID does not match existing client group userID.",
-					origin: ZeroCache
-				}
-			};
-			const previousAuth = this.#auth;
-			const hasProvidedAuth = isProvidedAuth(wireAuth);
-			let nextAuth = previousAuth;
-			if (previousAuth) lc.debug?.(`Attempting to update auth from previous value`);
-			else lc.debug?.(`Attempting to initialize auth`);
-			if (!hasProvidedAuth && previousAuth) return {
-				ok: false,
-				error: {
-					kind: Unauthorized,
-					message: "No token provided. An unauthenticated client cannot connect to an authenticated client group.",
-					origin: ZeroCache
-				}
-			};
-			if (!hasProvidedAuth) {
-				nextAuth = void 0;
-				lc.debug?.(`Cleared auth`);
-			} else if (this.#validateLegacyJWT !== void 0) {
-				const verifiedToken = await this.#validateLegacyJWT(wireAuth, { userID });
-				nextAuth = pickToken(this.#lc, this.#auth, verifiedToken);
-				lc.debug?.(`Updated auth with JWT`);
-			} else {
-				if (this.#auth?.type === "jwt") throw new Error("Cannot change auth type from legacy to opaque token");
-				nextAuth = {
-					type: "opaque",
-					raw: wireAuth
-				};
-				lc.debug?.(`Updated auth with opaque token`);
-			}
-			this.#auth = nextAuth;
-			this.#boundUserID ??= userID;
-			if (!authEquals(previousAuth, nextAuth)) this.#revision++;
-		} catch (e) {
-			if (isProtocolError(e)) return {
-				ok: false,
-				error: e.errorBody
-			};
-			return {
-				ok: false,
-				error: {
-					kind: AuthInvalidated,
-					message: `Failed to decode auth token: ${String(e)}`,
-					origin: ZeroCache
-				}
-			};
+/**
+* Resolves one auth snapshot transition without binding it to a client group.
+*/
+async function resolveAuth(lc, previousAuth, userID, wireAuth, validateLegacyJWT) {
+	try {
+		const hasProvidedAuth = isProvidedAuth(wireAuth);
+		if (previousAuth) lc.debug?.(`Attempting to update auth from previous value`);
+		else lc.debug?.(`Attempting to initialize auth`);
+		if (!hasProvidedAuth && previousAuth) throw new ProtocolError({
+			kind: Unauthorized,
+			message: "No token provided. An unauthenticated client cannot connect to an authenticated client group.",
+			origin: ZeroCache
+		});
+		if (!hasProvidedAuth) {
+			lc.debug?.(`Cleared auth`);
+			return;
 		}
-		return { ok: true };
+		if (userID === void 0) throw new ProtocolError({
+			kind: Unauthorized,
+			message: "Authenticated connections require a userID.",
+			origin: ZeroCache
+		});
+		if (validateLegacyJWT !== void 0) {
+			const nextAuth = pickToken(lc, previousAuth, await validateLegacyJWT(wireAuth, { userID }));
+			lc.debug?.(`Updated auth with JWT`);
+			return nextAuth;
+		}
+		if (previousAuth?.type === "jwt") throw new ProtocolError({
+			kind: Unauthorized,
+			message: "Token type cannot change from JWT to opaque. Connections are pinned to a single token type.",
+			origin: ZeroCache
+		});
+		if (previousAuth?.type === "opaque" && previousAuth.raw === wireAuth) {
+			lc.debug?.(`Opaque auth unchanged, reusing previous snapshot`);
+			return previousAuth;
+		}
+		lc.debug?.(`Updated auth with opaque token`);
+		return {
+			type: "opaque",
+			raw: wireAuth
+		};
+	} catch (e) {
+		if (isProtocolError(e)) throw e;
+		throw new ProtocolError({
+			kind: AuthInvalidated,
+			message: `Failed to decode auth token: ${String(e)}`,
+			origin: ZeroCache
+		});
 	}
-};
+}
 /** @deprecated used only in old JWT validation/rotation auth */
 function pickToken(lc, previousToken, newToken) {
 	if (newToken === null) return;
@@ -139,7 +107,14 @@ function pickToken(lc, previousToken, newToken) {
 		origin: ZeroCache
 	});
 }
+function isAuthErrorBody(ex) {
+	if (typeof ex !== "object" || ex === null) return false;
+	if ("error" in ex) return ex.error === "http" && "status" in ex && (ex.status === 401 || ex.status === 403);
+	if (!("kind" in ex)) return false;
+	if (ex.kind === "AuthInvalidated" || ex.kind === "Unauthorized") return true;
+	return (ex.kind === "PushFailed" || ex.kind === "TransformFailed") && "reason" in ex && ex.reason === "http" && "status" in ex && (ex.status === 401 || ex.status === 403);
+}
 //#endregion
-export { AuthSessionImpl };
+export { authEquals, isAuthErrorBody, resolveAuth };
 //# sourceMappingURL=auth.js.map

package/out/zero-cache/src/auth/auth.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth.js","names":["#lc","#validateLegacyJWT","#auth","#revision","#boundUserID"],"sources":["../../../../../zero-cache/src/auth/auth.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport {ErrorKind} from '../../../zero-protocol/src/error-kind.ts';\nimport {ErrorOrigin} from '../../../zero-protocol/src/error-origin.ts';\nimport {\n isProtocolError,\n ProtocolError,\n type ErrorBody,\n} from '../../../zero-protocol/src/error.ts';\n\n/** @deprecated JWT auth is deprecated /\nexport type JWTAuth = {\n readonly type: 'jwt';\n readonly raw: string;\n readonly decoded: JWTPayload;\n};\n\nexport type OpaqueAuth = {\n readonly type: 'opaque';\n readonly raw: string;\n};\n\nexport type Auth = OpaqueAuth \| JWTAuth;\n\nexport interface AuthSession {\n /* Update the auth session with a new userID and token from the client /\n update(\n userID: string,\n wireAuth: string \| undefined,\n ): Promise<AuthUpdateResult>;\n\n /* The revision of the auth state /\n get revision(): number;\n\n /* The auth state for the session /\n get auth(): Auth \| undefined;\n\n /* Clear the auth session, removing any stored auth and allowing a new userID to be bound on the next update. /\n clear(): void;\n}\n\nexport type AuthUpdateResult =\n \| {\n readonly ok: true;\n }\n \| {\n readonly ok: false;\n readonly error: ErrorBody;\n };\n\nexport type ValidateLegacyJWT = (\n token: string,\n ctx: {readonly userID: string},\n) => Promise<JWTAuth>;\n\nfunction isProvidedAuth(wireAuth: string \| undefined): wireAuth is string {\n return wireAuth !== undefined && wireAuth !== '';\n}\n\nfunction authEquals(a: Auth \| null \| undefined, b: Auth \| null \| undefined) {\n if (a === b) {\n return true;\n }\n if (!a \|\| !b) {\n return false;\n }\n return a.type === b.type && a.raw === b.raw;\n}\n\nexport class AuthSessionImpl implements AuthSession {\n readonly id: string;\n readonly #lc: LogContext;\n readonly #validateLegacyJWT: ValidateLegacyJWT \| undefined;\n #auth: Auth \| undefined = undefined;\n #boundUserID: string \| undefined;\n #revision = 0;\n\n constructor(\n lc: LogContext,\n clientGroupID: string,\n validateLegacyJWT: ValidateLegacyJWT \| undefined,\n ) {\n this.id = clientGroupID;\n this.#lc = lc;\n this.#validateLegacyJWT = validateLegacyJWT;\n }\n\n get auth(): Auth \| undefined {\n return this.#auth;\n }\n\n get revision(): number {\n return this.#revision;\n }\n\n clear(): void {\n const lc = this.#lc.withContext(\n 'boundUserID',\n this.#boundUserID ?? 'unknown',\n );\n lc.debug?.(`Clearing auth session`);\n this.#auth = undefined;\n this.#boundUserID = undefined;\n this.#revision = 0;\n }\n\n async update(\n userID: string,\n wireAuth: string \| undefined,\n ): Promise<AuthUpdateResult> {\n try {\n const lc = this.#lc.withContext('newUserID', userID);\n\n // check if the auth update is trying to change the bound userID for this client group\n if (this.#boundUserID && this.#boundUserID !== userID) {\n return {\n ok: false,\n error: {\n kind: ErrorKind.Unauthorized,\n message:\n 'Client groups are pinned to a single user. Connection userID does not match existing client group userID.',\n origin: ErrorOrigin.ZeroCache,\n },\n };\n }\n\n const previousAuth = this.#auth;\n const hasProvidedAuth = isProvidedAuth(wireAuth);\n let nextAuth = previousAuth;\n\n if (previousAuth) {\n lc.debug?.(`Attempting to update auth from previous value`);\n } else {\n lc.debug?.(`Attempting to initialize auth`);\n }\n\n if (!hasProvidedAuth && previousAuth) {\n return {\n ok: false,\n error: {\n kind: ErrorKind.Unauthorized,\n message:\n 'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n origin: ErrorOrigin.ZeroCache,\n },\n };\n }\n\n if (!hasProvidedAuth) {\n nextAuth = undefined;\n lc.debug?.(`Cleared auth`);\n } else if (this.#validateLegacyJWT !== undefined) {\n const verifiedToken = await this.#validateLegacyJWT(wireAuth, {userID});\n nextAuth = pickToken(this.#lc, this.#auth, verifiedToken);\n lc.debug?.(`Updated auth with JWT`);\n } else {\n if (this.#auth?.type === 'jwt') {\n throw new Error(\n 'Cannot change auth type from legacy to opaque token',\n );\n }\n nextAuth = {\n type: 'opaque',\n raw: wireAuth,\n };\n lc.debug?.(`Updated auth with opaque token`);\n }\n\n this.#auth = nextAuth;\n this.#boundUserID ??= userID;\n\n if (!authEquals(previousAuth, nextAuth)) {\n this.#revision++;\n }\n } catch (e) {\n if (isProtocolError(e)) {\n return {\n ok: false,\n error: e.errorBody,\n };\n }\n return {\n ok: false,\n error: {\n kind: ErrorKind.AuthInvalidated,\n message: `Failed to decode auth token: ${String(e)}`,\n origin: ErrorOrigin.ZeroCache,\n },\n };\n }\n\n return {ok: true};\n }\n}\n\n/* @deprecated used only in old JWT validation/rotation auth */\nexport function pickToken(\n lc: LogContext,\n previousToken: Auth \| undefined,\n newToken: Auth \| undefined \| null,\n) {\n if (newToken === null) {\n return undefined;\n }\n\n if (\n previousToken?.type &&\n newToken?.type &&\n previousToken?.type !== newToken?.type\n ) {\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'Token type cannot change. Client groups are pinned to a single token type.',\n origin: ErrorOrigin.ZeroCache,\n });\n }\n\n if (previousToken === undefined) {\n lc.debug?.(`No previous token, using new token`);\n return newToken;\n }\n\n if (newToken?.type === 'opaque') {\n return newToken;\n }\n\n if (previousToken.type === 'opaque') {\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'Token type cannot change from opaque to JWT. Client groups are pinned to a single token type.',\n origin: ErrorOrigin.ZeroCache,\n });\n }\n\n if (newToken) {\n if (previousToken.decoded.sub !== newToken.decoded.sub) {\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'The user id in the new token does not match the previous token. Client groups are pinned to a single user.',\n origin: ErrorOrigin.ZeroCache,\n });\n }\n\n if (previousToken.decoded.iat === undefined) {\n lc.debug?.(`No issued at time for the existing token, using new token`);\n // No issued at time for the existing token? We take the most recently received token.\n return newToken;\n }\n\n if (newToken.decoded.iat === undefined) {\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'The new token does not have an issued at time but the prior token does. Tokens for a client group must either all have issued at times or all not have issued at times',\n origin: ErrorOrigin.ZeroCache,\n });\n }\n\n // The new token is newer, so we take it.\n if (previousToken.decoded.iat < newToken.decoded.iat) {\n lc.debug?.(`New token is newer, using it`);\n return newToken;\n }\n\n // if the new token is older or the same, we keep the existing token.\n lc.debug?.(`New token is older or the same, using existing token`);\n return previousToken;\n }\n\n // previousToken !== undefined but newToken is undefined\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n origin: ErrorOrigin.ZeroCache,\n });\n}\n"],"mappings":";;;;AAuDA,SAAS,eAAe,UAAkD;AACxE,QAAO,aAAa,KAAA,KAAa,aAAa;;AAGhD,SAAS,WAAW,GAA4B,GAA4B;AAC1E,KAAI,MAAM,EACR,QAAO;AAET,KAAI,CAAC,KAAK,CAAC,EACT,QAAO;AAET,QAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;;AAG1C,IAAa,kBAAb,MAAoD;CAClD;CACA;CACA;CACA,QAA0B,KAAA;CAC1B;CACA,YAAY;CAEZ,YACE,IACA,eACA,mBACA;AACA,OAAK,KAAK;AACV,QAAA,KAAW;AACX,QAAA,oBAA0B;;CAG5B,IAAI,OAAyB;AAC3B,SAAO,MAAA;;CAGT,IAAI,WAAmB;AACrB,SAAO,MAAA;;CAGT,QAAc;AACD,QAAA,GAAS,YAClB,eACA,MAAA,eAAqB,UACtB,CACE,QAAQ,wBAAwB;AACnC,QAAA,OAAa,KAAA;AACb,QAAA,cAAoB,KAAA;AACpB,QAAA,WAAiB;;CAGnB,MAAM,OACJ,QACA,UAC2B;AAC3B,MAAI;GACF,MAAM,KAAK,MAAA,GAAS,YAAY,aAAa,OAAO;AAGpD,OAAI,MAAA,eAAqB,MAAA,gBAAsB,OAC7C,QAAO;IACL,IAAI;IACJ,OAAO;KACL,MAAM;KACN,SACE;KACF,QAAQ;KACT;IACF;GAGH,MAAM,eAAe,MAAA;GACrB,MAAM,kBAAkB,eAAe,SAAS;GAChD,IAAI,WAAW;AAEf,OAAI,aACF,IAAG,QAAQ,gDAAgD;OAE3D,IAAG,QAAQ,gCAAgC;AAG7C,OAAI,CAAC,mBAAmB,aACtB,QAAO;IACL,IAAI;IACJ,OAAO;KACL,MAAM;KACN,SACE;KACF,QAAQ;KACT;IACF;AAGH,OAAI,CAAC,iBAAiB;AACpB,eAAW,KAAA;AACX,OAAG,QAAQ,eAAe;cACjB,MAAA,sBAA4B,KAAA,GAAW;IAChD,MAAM,gBAAgB,MAAM,MAAA,kBAAwB,UAAU,EAAC,QAAO,CAAC;AACvE,eAAW,UAAU,MAAA,IAAU,MAAA,MAAY,cAAc;AACzD,OAAG,QAAQ,wBAAwB;UAC9B;AACL,QAAI,MAAA,MAAY,SAAS,MACvB,OAAM,IAAI,MACR,sDACD;AAEH,eAAW;KACT,MAAM;KACN,KAAK;KACN;AACD,OAAG,QAAQ,iCAAiC;;AAG9C,SAAA,OAAa;AACb,SAAA,gBAAsB;AAEtB,OAAI,CAAC,WAAW,cAAc,SAAS,CACrC,OAAA;WAEK,GAAG;AACV,OAAI,gBAAgB,EAAE,CACpB,QAAO;IACL,IAAI;IACJ,OAAO,EAAE;IACV;AAEH,UAAO;IACL,IAAI;IACJ,OAAO;KACL,MAAM;KACN,SAAS,gCAAgC,OAAO,EAAE;KAClD,QAAQ;KACT;IACF;;AAGH,SAAO,EAAC,IAAI,MAAK;;;;AAKrB,SAAgB,UACd,IACA,eACA,UACA;AACA,KAAI,aAAa,KACf;AAGF,KACE,eAAe,QACf,UAAU,QACV,eAAe,SAAS,UAAU,KAElC,OAAM,IAAI,cAAc;EACtB,MAAM;EACN,SACE;EACF,QAAQ;EACT,CAAC;AAGJ,KAAI,kBAAkB,KAAA,GAAW;AAC/B,KAAG,QAAQ,qCAAqC;AAChD,SAAO;;AAGT,KAAI,UAAU,SAAS,SACrB,QAAO;AAGT,KAAI,cAAc,SAAS,SACzB,OAAM,IAAI,cAAc;EACtB,MAAM;EACN,SACE;EACF,QAAQ;EACT,CAAC;AAGJ,KAAI,UAAU;AACZ,MAAI,cAAc,QAAQ,QAAQ,SAAS,QAAQ,IACjD,OAAM,IAAI,cAAc;GACtB,MAAM;GACN,SACE;GACF,QAAQ;GACT,CAAC;AAGJ,MAAI,cAAc,QAAQ,QAAQ,KAAA,GAAW;AAC3C,MAAG,QAAQ,4DAA4D;AAEvE,UAAO;;AAGT,MAAI,SAAS,QAAQ,QAAQ,KAAA,EAC3B,OAAM,IAAI,cAAc;GACtB,MAAM;GACN,SACE;GACF,QAAQ;GACT,CAAC;AAIJ,MAAI,cAAc,QAAQ,MAAM,SAAS,QAAQ,KAAK;AACpD,MAAG,QAAQ,+BAA+B;AAC1C,UAAO;;AAIT,KAAG,QAAQ,uDAAuD;AAClE,SAAO;;AAIT,OAAM,IAAI,cAAc;EACtB,MAAM;EACN,SACE;EACF,QAAQ;EACT,CAAC"}
1	+ {"version":3,"file":"auth.js","names":[],"sources":["../../../../../zero-cache/src/auth/auth.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport {ErrorKind} from '../../../zero-protocol/src/error-kind.ts';\nimport {ErrorOrigin} from '../../../zero-protocol/src/error-origin.ts';\nimport {\n isProtocolError,\n ProtocolError,\n type ErrorBody,\n} from '../../../zero-protocol/src/error.ts';\nimport {ErrorReason} from '../../../zero-protocol/src/error-reason.ts';\nimport type {PushError} from '../../../zero-protocol/src/push.ts';\n\n/** @deprecated JWT auth is deprecated /\nexport type JWTAuth = {\n readonly type: 'jwt';\n readonly raw: string;\n readonly decoded: JWTPayload;\n};\n\nexport type OpaqueAuth = {\n readonly type: 'opaque';\n readonly raw: string;\n};\n\nexport type Auth = OpaqueAuth \| JWTAuth;\n\nexport type ValidateLegacyJWT = (\n token: string,\n ctx: {readonly userID: string \| undefined},\n) => Promise<JWTAuth>;\n\nfunction isProvidedAuth(wireAuth: string \| undefined): wireAuth is string {\n return wireAuth !== undefined && wireAuth !== '';\n}\n\nexport function authEquals(a: Auth \| undefined, b: Auth \| undefined) {\n if (a === b) {\n return true;\n }\n if (!a \|\| !b) {\n return false;\n }\n return a.type === b.type && a.raw === b.raw;\n}\n\n/\n Resolves one auth snapshot transition without binding it to a client group.\n /\nexport async function resolveAuth(\n lc: LogContext,\n previousAuth: Auth \| undefined,\n userID: string \| undefined,\n wireAuth: string \| undefined,\n validateLegacyJWT: ValidateLegacyJWT \| undefined,\n): Promise<Auth \| undefined> {\n try {\n const hasProvidedAuth = isProvidedAuth(wireAuth);\n\n if (previousAuth) {\n lc.debug?.(`Attempting to update auth from previous value`);\n } else {\n lc.debug?.(`Attempting to initialize auth`);\n }\n\n if (!hasProvidedAuth && previousAuth) {\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n origin: ErrorOrigin.ZeroCache,\n });\n }\n\n if (!hasProvidedAuth) {\n lc.debug?.(`Cleared auth`);\n return undefined;\n }\n\n if (userID === undefined) {\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message: 'Authenticated connections require a userID.',\n origin: ErrorOrigin.ZeroCache,\n });\n }\n\n if (validateLegacyJWT !== undefined) {\n const verifiedToken = await validateLegacyJWT(wireAuth, {userID});\n const nextAuth = pickToken(lc, previousAuth, verifiedToken);\n lc.debug?.(`Updated auth with JWT`);\n return nextAuth;\n }\n\n if (previousAuth?.type === 'jwt') {\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'Token type cannot change from JWT to opaque. Connections are pinned to a single token type.',\n origin: ErrorOrigin.ZeroCache,\n });\n }\n\n if (previousAuth?.type === 'opaque' && previousAuth.raw === wireAuth) {\n lc.debug?.(`Opaque auth unchanged, reusing previous snapshot`);\n return previousAuth;\n }\n\n lc.debug?.(`Updated auth with opaque token`);\n return {\n type: 'opaque',\n raw: wireAuth,\n };\n } catch (e) {\n if (isProtocolError(e)) {\n throw e;\n }\n throw new ProtocolError({\n kind: ErrorKind.AuthInvalidated,\n message: `Failed to decode auth token: ${String(e)}`,\n origin: ErrorOrigin.ZeroCache,\n });\n }\n}\n\n/* @deprecated used only in old JWT validation/rotation auth */\nexport function pickToken(\n lc: LogContext,\n previousToken: Auth \| undefined,\n newToken: Auth \| undefined \| null,\n) {\n if (newToken === null) {\n return undefined;\n }\n\n if (\n previousToken?.type &&\n newToken?.type &&\n previousToken?.type !== newToken?.type\n ) {\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'Token type cannot change. Client groups are pinned to a single token type.',\n origin: ErrorOrigin.ZeroCache,\n });\n }\n\n if (previousToken === undefined) {\n lc.debug?.(`No previous token, using new token`);\n return newToken;\n }\n\n if (newToken?.type === 'opaque') {\n return newToken;\n }\n\n if (previousToken.type === 'opaque') {\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'Token type cannot change from opaque to JWT. Client groups are pinned to a single token type.',\n origin: ErrorOrigin.ZeroCache,\n });\n }\n\n if (newToken) {\n if (previousToken.decoded.sub !== newToken.decoded.sub) {\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'The user id in the new token does not match the previous token. Client groups are pinned to a single user.',\n origin: ErrorOrigin.ZeroCache,\n });\n }\n\n if (previousToken.decoded.iat === undefined) {\n lc.debug?.(`No issued at time for the existing token, using new token`);\n // No issued at time for the existing token? We take the most recently received token.\n return newToken;\n }\n\n if (newToken.decoded.iat === undefined) {\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'The new token does not have an issued at time but the prior token does. Tokens for a client group must either all have issued at times or all not have issued at times',\n origin: ErrorOrigin.ZeroCache,\n });\n }\n\n // The new token is newer, so we take it.\n if (previousToken.decoded.iat < newToken.decoded.iat) {\n lc.debug?.(`New token is newer, using it`);\n return newToken;\n }\n\n // if the new token is older or the same, we keep the existing token.\n lc.debug?.(`New token is older or the same, using existing token`);\n return previousToken;\n }\n\n // previousToken !== undefined but newToken is undefined\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n origin: ErrorOrigin.ZeroCache,\n });\n}\n\nexport function isAuthErrorBody(ex: unknown): ex is ErrorBody \| PushError {\n if (typeof ex !== 'object' \|\| ex === null) {\n return false;\n }\n\n if ('error' in ex) {\n return (\n ex.error === 'http' &&\n 'status' in ex &&\n (ex.status === 401 \|\| ex.status === 403)\n );\n }\n\n if (!('kind' in ex)) {\n return false;\n }\n\n if (\n ex.kind === ErrorKind.AuthInvalidated \|\|\n ex.kind === ErrorKind.Unauthorized\n ) {\n return true;\n }\n\n return (\n (ex.kind === ErrorKind.PushFailed \|\|\n ex.kind === ErrorKind.TransformFailed) &&\n 'reason' in ex &&\n ex.reason === ErrorReason.HTTP &&\n 'status' in ex &&\n (ex.status === 401 \|\| ex.status === 403)\n );\n}\n"],"mappings":";;;;;AA+BA,SAAS,eAAe,UAAkD;AACxE,QAAO,aAAa,KAAA,KAAa,aAAa;;AAGhD,SAAgB,WAAW,GAAqB,GAAqB;AACnE,KAAI,MAAM,EACR,QAAO;AAET,KAAI,CAAC,KAAK,CAAC,EACT,QAAO;AAET,QAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;;;;;AAM1C,eAAsB,YACpB,IACA,cACA,QACA,UACA,mBAC2B;AAC3B,KAAI;EACF,MAAM,kBAAkB,eAAe,SAAS;AAEhD,MAAI,aACF,IAAG,QAAQ,gDAAgD;MAE3D,IAAG,QAAQ,gCAAgC;AAG7C,MAAI,CAAC,mBAAmB,aACtB,OAAM,IAAI,cAAc;GACtB,MAAM;GACN,SACE;GACF,QAAQ;GACT,CAAC;AAGJ,MAAI,CAAC,iBAAiB;AACpB,MAAG,QAAQ,eAAe;AAC1B;;AAGF,MAAI,WAAW,KAAA,EACb,OAAM,IAAI,cAAc;GACtB,MAAM;GACN,SAAS;GACT,QAAQ;GACT,CAAC;AAGJ,MAAI,sBAAsB,KAAA,GAAW;GAEnC,MAAM,WAAW,UAAU,IAAI,cADT,MAAM,kBAAkB,UAAU,EAAC,QAAO,CAAC,CACN;AAC3D,MAAG,QAAQ,wBAAwB;AACnC,UAAO;;AAGT,MAAI,cAAc,SAAS,MACzB,OAAM,IAAI,cAAc;GACtB,MAAM;GACN,SACE;GACF,QAAQ;GACT,CAAC;AAGJ,MAAI,cAAc,SAAS,YAAY,aAAa,QAAQ,UAAU;AACpE,MAAG,QAAQ,mDAAmD;AAC9D,UAAO;;AAGT,KAAG,QAAQ,iCAAiC;AAC5C,SAAO;GACL,MAAM;GACN,KAAK;GACN;UACM,GAAG;AACV,MAAI,gBAAgB,EAAE,CACpB,OAAM;AAER,QAAM,IAAI,cAAc;GACtB,MAAM;GACN,SAAS,gCAAgC,OAAO,EAAE;GAClD,QAAQ;GACT,CAAC;;;;AAKN,SAAgB,UACd,IACA,eACA,UACA;AACA,KAAI,aAAa,KACf;AAGF,KACE,eAAe,QACf,UAAU,QACV,eAAe,SAAS,UAAU,KAElC,OAAM,IAAI,cAAc;EACtB,MAAM;EACN,SACE;EACF,QAAQ;EACT,CAAC;AAGJ,KAAI,kBAAkB,KAAA,GAAW;AAC/B,KAAG,QAAQ,qCAAqC;AAChD,SAAO;;AAGT,KAAI,UAAU,SAAS,SACrB,QAAO;AAGT,KAAI,cAAc,SAAS,SACzB,OAAM,IAAI,cAAc;EACtB,MAAM;EACN,SACE;EACF,QAAQ;EACT,CAAC;AAGJ,KAAI,UAAU;AACZ,MAAI,cAAc,QAAQ,QAAQ,SAAS,QAAQ,IACjD,OAAM,IAAI,cAAc;GACtB,MAAM;GACN,SACE;GACF,QAAQ;GACT,CAAC;AAGJ,MAAI,cAAc,QAAQ,QAAQ,KAAA,GAAW;AAC3C,MAAG,QAAQ,4DAA4D;AAEvE,UAAO;;AAGT,MAAI,SAAS,QAAQ,QAAQ,KAAA,EAC3B,OAAM,IAAI,cAAc;GACtB,MAAM;GACN,SACE;GACF,QAAQ;GACT,CAAC;AAIJ,MAAI,cAAc,QAAQ,MAAM,SAAS,QAAQ,KAAK;AACpD,MAAG,QAAQ,+BAA+B;AAC1C,UAAO;;AAIT,KAAG,QAAQ,uDAAuD;AAClE,SAAO;;AAIT,OAAM,IAAI,cAAc;EACtB,MAAM;EACN,SACE;EACF,QAAQ;EACT,CAAC;;AAGJ,SAAgB,gBAAgB,IAA0C;AACxE,KAAI,OAAO,OAAO,YAAY,OAAO,KACnC,QAAO;AAGT,KAAI,WAAW,GACb,QACE,GAAG,UAAU,UACb,YAAY,OACX,GAAG,WAAW,OAAO,GAAG,WAAW;AAIxC,KAAI,EAAE,UAAU,IACd,QAAO;AAGT,KACE,GAAG,SAAS,qBACZ,GAAG,SAAS,eAEZ,QAAO;AAGT,SACG,GAAG,SAAS,gBACX,GAAG,SAAS,sBACd,YAAY,MACZ,GAAG,WAAW,UACd,YAAY,OACX,GAAG,WAAW,OAAO,GAAG,WAAW"}

package/out/zero-cache/src/auth/jwt.d.ts CHANGED Viewed

@@ -1,12 +1,12 @@
 import { type JWK, type JWTClaimVerificationOptions, type JWTPayload } from 'jose';
-import type { AuthConfig } from '../config/zero-config.ts';
+import type { LegacyJWTAuthConfig } from '../config/zero-config.ts';
 /** @deprecated */
 export declare function createJwkPair(): Promise<{
     privateJwk: JWK;
     publicJwk: JWK;
 }>;
 /** @deprecated */
-export declare const tokenConfigOptions: (config: AuthConfig) => ("jwk" | "jwksUrl" | "secret")[];
+export declare const tokenConfigOptions: (config: LegacyJWTAuthConfig) => ("jwk" | "jwksUrl" | "secret")[];
 /** @deprecated */
-export declare function verifyToken(config: AuthConfig, token: string, verifyOptions: JWTClaimVerificationOptions): Promise<JWTPayload>;
+export declare function verifyToken(config: LegacyJWTAuthConfig, token: string, verifyOptions: JWTClaimVerificationOptions): Promise<JWTPayload>;
 //# sourceMappingURL=jwt.d.ts.map

package/out/zero-cache/src/auth/jwt.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,GAAG,EACR,KAAK,2BAA2B,EAChC,KAAK,UAAU,EAEhB,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EAAC,~~UAAU~~,EAAC,MAAM,0BAA0B,CAAC;~~AAEzD~~,kBAAkB;AAClB,wBAAsB,aAAa;;;GAelC;AAWD,kBAAkB;AAClB,eAAO,MAAM,kBAAkB,GAAI,QAAQ,~~UAAU~~,~~qCAMpD~~,CAAC;AAEF,kBAAkB;AAClB,wBAAsB,WAAW,CAC/B,MAAM,EAAE,~~UAAU~~,~~EAClB~~,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,2BAA2B,GACzC,OAAO,CAAC,UAAU,CAAC,CAiBrB"}
1	+ {"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,GAAG,EACR,KAAK,2BAA2B,EAChC,KAAK,UAAU,EAEhB,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,0BAA0B,CAAC;AAElE,kBAAkB;AAClB,wBAAsB,aAAa;;;GAelC;AAWD,kBAAkB;AAClB,eAAO,MAAM,kBAAkB,GAAI,QAAQ,mBAAmB,qCAM7D,CAAC;AAEF,kBAAkB;AAClB,wBAAsB,WAAW,CAC/B,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,2BAA2B,GACzC,OAAO,CAAC,UAAU,CAAC,CAiBrB"}

package/out/zero-cache/src/auth/jwt.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"jwt.js","names":[],"sources":["../../../../../zero-cache/src/auth/jwt.ts"],"sourcesContent":["import {\n createRemoteJWKSet,\n exportJWK,\n generateKeyPair,\n jwtVerify,\n type JWK,\n type JWTClaimVerificationOptions,\n type JWTPayload,\n type KeyLike,\n} from 'jose';\nimport type {~~AuthConfig~~} from '../config/zero-config.ts';\n\n/** @deprecated /\nexport async function createJwkPair() {\n const {publicKey, privateKey} = await generateKeyPair('PS256');\n\n const privateJwk = await exportJWK(privateKey);\n const publicJwk = await exportJWK(publicKey);\n\n privateJwk.kid = 'key-2024-001';\n privateJwk.use = 'sig';\n privateJwk.alg = 'PS256';\n\n publicJwk.kid = privateJwk.kid;\n publicJwk.use = privateJwk.use;\n publicJwk.alg = privateJwk.alg;\n\n return {privateJwk, publicJwk};\n}\n\nlet remoteKeyset: ReturnType<typeof createRemoteJWKSet> \| undefined;\nfunction getRemoteKeyset(jwksUrl: string) {\n if (remoteKeyset === undefined) {\n remoteKeyset = createRemoteJWKSet(new URL(jwksUrl));\n }\n\n return remoteKeyset;\n}\n\n/* @deprecated /\nexport const tokenConfigOptions = (config: ~~AuthConfig~~) => {\n const tokenOptions = (['jwk', 'secret', 'jwksUrl'] as const).filter(\n key => config[key] !== undefined,\n );\n\n return tokenOptions;\n};\n\n/* @deprecated */\nexport async function verifyToken(\n config: ~~AuthConfig~~,\n token: string,\n verifyOptions: JWTClaimVerificationOptions,\n): Promise<JWTPayload> {\n if (config.jwk !== undefined) {\n return verifyTokenImpl(token, loadJwk(config.jwk), verifyOptions);\n }\n\n if (config.secret !== undefined) {\n return verifyTokenImpl(token, loadSecret(config.secret), verifyOptions);\n }\n\n if (config.jwksUrl !== undefined) {\n const remoteKeyset = getRemoteKeyset(config.jwksUrl);\n return (await jwtVerify(token, remoteKeyset, verifyOptions)).payload;\n }\n\n throw new Error(\n 'verifyToken was called but no auth options (one of: jwk, secret, jwksUrl) were configured.',\n );\n}\n\nfunction loadJwk(jwkString: string) {\n return JSON.parse(jwkString) as JWK;\n}\n\nfunction loadSecret(secret: string) {\n return new TextEncoder().encode(secret);\n}\n\nasync function verifyTokenImpl(\n token: string,\n verifyKey: Uint8Array \| KeyLike \| JWK,\n verifyOptions: JWTClaimVerificationOptions,\n): Promise<JWTPayload> {\n const {payload} = await jwtVerify(token, verifyKey, verifyOptions);\n\n return payload;\n}\n"],"mappings":";;AA8BA,IAAI;AACJ,SAAS,gBAAgB,SAAiB;AACxC,KAAI,iBAAiB,KAAA,EACnB,gBAAe,mBAAmB,IAAI,IAAI,QAAQ,CAAC;AAGrD,QAAO;;;AAIT,IAAa,sBAAsB,~~WAAuB~~;~~AAKxD~~,QAJsB;EAAC;EAAO;EAAU;EAAU,CAAW,QAC3D,QAAO,OAAO,SAAS,KAAA,EACxB;;;AAMH,eAAsB,YACpB,QACA,OACA,eACqB;AACrB,KAAI,OAAO,QAAQ,KAAA,EACjB,QAAO,gBAAgB,OAAO,QAAQ,OAAO,IAAI,EAAE,cAAc;AAGnE,KAAI,OAAO,WAAW,KAAA,EACpB,QAAO,gBAAgB,OAAO,WAAW,OAAO,OAAO,EAAE,cAAc;AAGzE,KAAI,OAAO,YAAY,KAAA,EAErB,SAAQ,MAAM,UAAU,OADH,gBAAgB,OAAO,QAAQ,EACP,cAAc,EAAE;AAG/D,OAAM,IAAI,MACR,6FACD;;AAGH,SAAS,QAAQ,WAAmB;AAClC,QAAO,KAAK,MAAM,UAAU;;AAG9B,SAAS,WAAW,QAAgB;AAClC,QAAO,IAAI,aAAa,CAAC,OAAO,OAAO;;AAGzC,eAAe,gBACb,OACA,WACA,eACqB;CACrB,MAAM,EAAC,YAAW,MAAM,UAAU,OAAO,WAAW,cAAc;AAElE,QAAO"}
1	+ {"version":3,"file":"jwt.js","names":[],"sources":["../../../../../zero-cache/src/auth/jwt.ts"],"sourcesContent":["import {\n createRemoteJWKSet,\n exportJWK,\n generateKeyPair,\n jwtVerify,\n type JWK,\n type JWTClaimVerificationOptions,\n type JWTPayload,\n type KeyLike,\n} from 'jose';\nimport type {LegacyJWTAuthConfig} from '../config/zero-config.ts';\n\n/** @deprecated /\nexport async function createJwkPair() {\n const {publicKey, privateKey} = await generateKeyPair('PS256');\n\n const privateJwk = await exportJWK(privateKey);\n const publicJwk = await exportJWK(publicKey);\n\n privateJwk.kid = 'key-2024-001';\n privateJwk.use = 'sig';\n privateJwk.alg = 'PS256';\n\n publicJwk.kid = privateJwk.kid;\n publicJwk.use = privateJwk.use;\n publicJwk.alg = privateJwk.alg;\n\n return {privateJwk, publicJwk};\n}\n\nlet remoteKeyset: ReturnType<typeof createRemoteJWKSet> \| undefined;\nfunction getRemoteKeyset(jwksUrl: string) {\n if (remoteKeyset === undefined) {\n remoteKeyset = createRemoteJWKSet(new URL(jwksUrl));\n }\n\n return remoteKeyset;\n}\n\n/* @deprecated /\nexport const tokenConfigOptions = (config: LegacyJWTAuthConfig) => {\n const tokenOptions = (['jwk', 'secret', 'jwksUrl'] as const).filter(\n key => config[key] !== undefined,\n );\n\n return tokenOptions;\n};\n\n/* @deprecated */\nexport async function verifyToken(\n config: LegacyJWTAuthConfig,\n token: string,\n verifyOptions: JWTClaimVerificationOptions,\n): Promise<JWTPayload> {\n if (config.jwk !== undefined) {\n return verifyTokenImpl(token, loadJwk(config.jwk), verifyOptions);\n }\n\n if (config.secret !== undefined) {\n return verifyTokenImpl(token, loadSecret(config.secret), verifyOptions);\n }\n\n if (config.jwksUrl !== undefined) {\n const remoteKeyset = getRemoteKeyset(config.jwksUrl);\n return (await jwtVerify(token, remoteKeyset, verifyOptions)).payload;\n }\n\n throw new Error(\n 'verifyToken was called but no auth options (one of: jwk, secret, jwksUrl) were configured.',\n );\n}\n\nfunction loadJwk(jwkString: string) {\n return JSON.parse(jwkString) as JWK;\n}\n\nfunction loadSecret(secret: string) {\n return new TextEncoder().encode(secret);\n}\n\nasync function verifyTokenImpl(\n token: string,\n verifyKey: Uint8Array \| KeyLike \| JWK,\n verifyOptions: JWTClaimVerificationOptions,\n): Promise<JWTPayload> {\n const {payload} = await jwtVerify(token, verifyKey, verifyOptions);\n\n return payload;\n}\n"],"mappings":";;AA8BA,IAAI;AACJ,SAAS,gBAAgB,SAAiB;AACxC,KAAI,iBAAiB,KAAA,EACnB,gBAAe,mBAAmB,IAAI,IAAI,QAAQ,CAAC;AAGrD,QAAO;;;AAIT,IAAa,sBAAsB,WAAgC;AAKjE,QAJsB;EAAC;EAAO;EAAU;EAAU,CAAW,QAC3D,QAAO,OAAO,SAAS,KAAA,EACxB;;;AAMH,eAAsB,YACpB,QACA,OACA,eACqB;AACrB,KAAI,OAAO,QAAQ,KAAA,EACjB,QAAO,gBAAgB,OAAO,QAAQ,OAAO,IAAI,EAAE,cAAc;AAGnE,KAAI,OAAO,WAAW,KAAA,EACpB,QAAO,gBAAgB,OAAO,WAAW,OAAO,OAAO,EAAE,cAAc;AAGzE,KAAI,OAAO,YAAY,KAAA,EAErB,SAAQ,MAAM,UAAU,OADH,gBAAgB,OAAO,QAAQ,EACP,cAAc,EAAE;AAG/D,OAAM,IAAI,MACR,6FACD;;AAGH,SAAS,QAAQ,WAAmB;AAClC,QAAO,KAAK,MAAM,UAAU;;AAG9B,SAAS,WAAW,QAAgB;AAClC,QAAO,IAAI,aAAa,CAAC,OAAO,OAAO;;AAGzC,eAAe,gBACb,OACA,WACA,eACqB;CACrB,MAAM,EAAC,YAAW,MAAM,UAAU,OAAO,WAAW,cAAc;AAElE,QAAO"}

package/out/zero-cache/src/auth/load-permissions.js CHANGED Viewed

@@ -49,7 +49,7 @@ function reloadPermissionsIfChanged(lc, replica, appID, current, config) {
 function getSchema(lc, replica) {
 	const specs = computeZqlSpecs(lc, replica, { includeBackfillingColumns: false });
 	return {
-		tables: Object.fromEntries([...specs.values()].map((table) => {
+		tables: Object.fromEntries(Array.from(specs.values(), (table) => {
 			const { tableSpec: { name, primaryKey }, zqlSpec: columns } = table;
 			return [name, {
 				name,

package/out/zero-cache/src/auth/load-permissions.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"load-permissions.js","names":[],"sources":["../../../../../zero-cache/src/auth/load-permissions.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport * as v from '../../../shared/src/valita.ts';\nimport {\n permissionsConfigSchema,\n type PermissionsConfig,\n} from '../../../zero-schema/src/compiled-permissions.ts';\nimport type {TableSchema} from '../../../zero-schema/src/table-schema.ts';\nimport type {Schema} from '../../../zero-types/src/schema.ts';\nimport type {Database} from '../../../zqlite/src/db.ts';\nimport type {ZeroConfig} from '../config/zero-config.ts';\nimport {computeZqlSpecs} from '../db/lite-tables.ts';\nimport type {StatementRunner} from '../db/statements.ts';\nimport {elide} from '../types/strings.ts';\n\nexport type LoadedPermissions = {\n permissions: PermissionsConfig \| null;\n hash: string \| null;\n};\n\nexport function loadPermissions(\n lc: LogContext,\n replica: StatementRunner,\n appID: string,\n config?: ZeroConfig,\n): LoadedPermissions {\n const {permissions, hash} = replica.get(\n `SELECT permissions, hash FROM \"${appID}.permissions\"`,\n );\n if (permissions === null) {\n const hasCustomEndpoints =\n config !== undefined &&\n (config.push?.url !== undefined \|\| config.mutate?.url !== undefined) &&\n (config.query?.url !== undefined \|\| config.getQueries?.url !== undefined);\n\n if (!hasCustomEndpoints) {\n const appIDFlag = appID === 'zero' ? '' : ` --app-id=${appID}`;\n lc.warn?.(\n `\\n\\n\\n` +\n `No upstream permissions deployed.\\n` +\n `Run 'npx zero-deploy-permissions${appIDFlag}' to enforce permissions.` +\n `\\n\\n\\n`,\n );\n }\n return {permissions, hash: null};\n }\n let obj;\n let parsed;\n try {\n obj = JSON.parse(permissions);\n parsed = v.parse(obj, permissionsConfigSchema);\n } catch (e) {\n // TODO: Plumb the --server-version and include in error message.\n throw new Error(\n `Could not parse upstream permissions: ` +\n `'${elide(String(permissions), 100)}'.\\n` +\n `This may happen if Permissions with a new internal format are ` +\n `deployed before the supporting server has been fully rolled out.`,\n {cause: e},\n );\n }\n return {permissions: parsed, hash};\n}\n\nexport function reloadPermissionsIfChanged(\n lc: LogContext,\n replica: StatementRunner,\n appID: string,\n current: LoadedPermissions \| null,\n config?: ZeroConfig,\n): {permissions: LoadedPermissions; changed: boolean} {\n if (current === null) {\n return {\n permissions: loadPermissions(lc, replica, appID, config),\n changed: true,\n };\n }\n const {hash} = replica.get(`SELECT hash FROM \"${appID}.permissions\"`);\n return hash === current.hash\n ? {permissions: current, changed: false}\n : {permissions: loadPermissions(lc, replica, appID, config), changed: true};\n}\n\nexport function getSchema(lc: LogContext, replica: Database): Schema {\n const specs = computeZqlSpecs(lc, replica, {\n includeBackfillingColumns: false,\n });\n const tables = Object.fromEntries(\n ~~[...~~specs.values()~~].map(~~table => {\n const {\n tableSpec: {name, primaryKey},\n zqlSpec: columns,\n } = table;\n return [name, {name, columns, primaryKey} satisfies TableSchema];\n }),\n );\n return {\n tables,\n relationships: {}, // relationships are already denormalized in ASTs\n };\n}\n"],"mappings":";;;;;AAmBA,SAAgB,gBACd,IACA,SACA,OACA,QACmB;CACnB,MAAM,EAAC,aAAa,SAAQ,QAAQ,IAClC,kCAAkC,MAAM,eACzC;AACD,KAAI,gBAAgB,MAAM;AAMxB,MAAI,EAJF,WAAW,KAAA,MACV,OAAO,MAAM,QAAQ,KAAA,KAAa,OAAO,QAAQ,QAAQ,KAAA,OACzD,OAAO,OAAO,QAAQ,KAAA,KAAa,OAAO,YAAY,QAAQ,KAAA,KAExC;GACvB,MAAM,YAAY,UAAU,SAAS,KAAK,aAAa;AACvD,MAAG,OACD;;;;kCAEqC,UAAU,iCAEhD;;AAEH,SAAO;GAAC;GAAa,MAAM;GAAK;;CAElC,IAAI;CACJ,IAAI;AACJ,KAAI;AACF,QAAM,KAAK,MAAM,YAAY;AAC7B,WAAS,MAAQ,KAAK,wBAAwB;UACvC,GAAG;AAEV,QAAM,IAAI,MACR,0CACM,MAAM,OAAO,YAAY,EAAE,IAAI,CAAC,qIAGtC,EAAC,OAAO,GAAE,CACX;;AAEH,QAAO;EAAC,aAAa;EAAQ;EAAK;;AAGpC,SAAgB,2BACd,IACA,SACA,OACA,SACA,QACoD;AACpD,KAAI,YAAY,KACd,QAAO;EACL,aAAa,gBAAgB,IAAI,SAAS,OAAO,OAAO;EACxD,SAAS;EACV;CAEH,MAAM,EAAC,SAAQ,QAAQ,IAAI,qBAAqB,MAAM,eAAe;AACrE,QAAO,SAAS,QAAQ,OACpB;EAAC,aAAa;EAAS,SAAS;EAAM,GACtC;EAAC,aAAa,gBAAgB,IAAI,SAAS,OAAO,OAAO;EAAE,SAAS;EAAK;;AAG/E,SAAgB,UAAU,IAAgB,SAA2B;CACnE,MAAM,QAAQ,gBAAgB,IAAI,SAAS,EACzC,2BAA2B,OAC5B,CAAC;AAUF,QAAO;EACL,QAVa,OAAO,YACpB,~~CAAC~~,~~GAAG~~,MAAM,QAAQ,~~CAAC~~,~~CAAC,KAAI,~~UAAS;~~GAC/B~~,MAAM,EACJ,WAAW,EAAC,MAAM,cAClB,SAAS,YACP;AACJ,UAAO,CAAC,MAAM;IAAC;IAAM;IAAS;IAAW,CAAuB;IAChE,CACH;EAGC,eAAe,EAAE;EAClB"}
1	+ {"version":3,"file":"load-permissions.js","names":[],"sources":["../../../../../zero-cache/src/auth/load-permissions.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport * as v from '../../../shared/src/valita.ts';\nimport {\n permissionsConfigSchema,\n type PermissionsConfig,\n} from '../../../zero-schema/src/compiled-permissions.ts';\nimport type {TableSchema} from '../../../zero-schema/src/table-schema.ts';\nimport type {Schema} from '../../../zero-types/src/schema.ts';\nimport type {Database} from '../../../zqlite/src/db.ts';\nimport type {ZeroConfig} from '../config/zero-config.ts';\nimport {computeZqlSpecs} from '../db/lite-tables.ts';\nimport type {StatementRunner} from '../db/statements.ts';\nimport {elide} from '../types/strings.ts';\n\nexport type LoadedPermissions = {\n permissions: PermissionsConfig \| null;\n hash: string \| null;\n};\n\nexport function loadPermissions(\n lc: LogContext,\n replica: StatementRunner,\n appID: string,\n config?: ZeroConfig,\n): LoadedPermissions {\n const {permissions, hash} = replica.get(\n `SELECT permissions, hash FROM \"${appID}.permissions\"`,\n );\n if (permissions === null) {\n const hasCustomEndpoints =\n config !== undefined &&\n (config.push?.url !== undefined \|\| config.mutate?.url !== undefined) &&\n (config.query?.url !== undefined \|\| config.getQueries?.url !== undefined);\n\n if (!hasCustomEndpoints) {\n const appIDFlag = appID === 'zero' ? '' : ` --app-id=${appID}`;\n lc.warn?.(\n `\\n\\n\\n` +\n `No upstream permissions deployed.\\n` +\n `Run 'npx zero-deploy-permissions${appIDFlag}' to enforce permissions.` +\n `\\n\\n\\n`,\n );\n }\n return {permissions, hash: null};\n }\n let obj;\n let parsed;\n try {\n obj = JSON.parse(permissions);\n parsed = v.parse(obj, permissionsConfigSchema);\n } catch (e) {\n // TODO: Plumb the --server-version and include in error message.\n throw new Error(\n `Could not parse upstream permissions: ` +\n `'${elide(String(permissions), 100)}'.\\n` +\n `This may happen if Permissions with a new internal format are ` +\n `deployed before the supporting server has been fully rolled out.`,\n {cause: e},\n );\n }\n return {permissions: parsed, hash};\n}\n\nexport function reloadPermissionsIfChanged(\n lc: LogContext,\n replica: StatementRunner,\n appID: string,\n current: LoadedPermissions \| null,\n config?: ZeroConfig,\n): {permissions: LoadedPermissions; changed: boolean} {\n if (current === null) {\n return {\n permissions: loadPermissions(lc, replica, appID, config),\n changed: true,\n };\n }\n const {hash} = replica.get(`SELECT hash FROM \"${appID}.permissions\"`);\n return hash === current.hash\n ? {permissions: current, changed: false}\n : {permissions: loadPermissions(lc, replica, appID, config), changed: true};\n}\n\nexport function getSchema(lc: LogContext, replica: Database): Schema {\n const specs = computeZqlSpecs(lc, replica, {\n includeBackfillingColumns: false,\n });\n const tables = Object.fromEntries(\n Array.from(specs.values(), table => {\n const {\n tableSpec: {name, primaryKey},\n zqlSpec: columns,\n } = table;\n return [name, {name, columns, primaryKey} satisfies TableSchema];\n }),\n );\n return {\n tables,\n relationships: {}, // relationships are already denormalized in ASTs\n };\n}\n"],"mappings":";;;;;AAmBA,SAAgB,gBACd,IACA,SACA,OACA,QACmB;CACnB,MAAM,EAAC,aAAa,SAAQ,QAAQ,IAClC,kCAAkC,MAAM,eACzC;AACD,KAAI,gBAAgB,MAAM;AAMxB,MAAI,EAJF,WAAW,KAAA,MACV,OAAO,MAAM,QAAQ,KAAA,KAAa,OAAO,QAAQ,QAAQ,KAAA,OACzD,OAAO,OAAO,QAAQ,KAAA,KAAa,OAAO,YAAY,QAAQ,KAAA,KAExC;GACvB,MAAM,YAAY,UAAU,SAAS,KAAK,aAAa;AACvD,MAAG,OACD;;;;kCAEqC,UAAU,iCAEhD;;AAEH,SAAO;GAAC;GAAa,MAAM;GAAK;;CAElC,IAAI;CACJ,IAAI;AACJ,KAAI;AACF,QAAM,KAAK,MAAM,YAAY;AAC7B,WAAS,MAAQ,KAAK,wBAAwB;UACvC,GAAG;AAEV,QAAM,IAAI,MACR,0CACM,MAAM,OAAO,YAAY,EAAE,IAAI,CAAC,qIAGtC,EAAC,OAAO,GAAE,CACX;;AAEH,QAAO;EAAC,aAAa;EAAQ;EAAK;;AAGpC,SAAgB,2BACd,IACA,SACA,OACA,SACA,QACoD;AACpD,KAAI,YAAY,KACd,QAAO;EACL,aAAa,gBAAgB,IAAI,SAAS,OAAO,OAAO;EACxD,SAAS;EACV;CAEH,MAAM,EAAC,SAAQ,QAAQ,IAAI,qBAAqB,MAAM,eAAe;AACrE,QAAO,SAAS,QAAQ,OACpB;EAAC,aAAa;EAAS,SAAS;EAAM,GACtC;EAAC,aAAa,gBAAgB,IAAI,SAAS,OAAO,OAAO;EAAE,SAAS;EAAK;;AAG/E,SAAgB,UAAU,IAAgB,SAA2B;CACnE,MAAM,QAAQ,gBAAgB,IAAI,SAAS,EACzC,2BAA2B,OAC5B,CAAC;AAUF,QAAO;EACL,QAVa,OAAO,YACpB,MAAM,KAAK,MAAM,QAAQ,GAAE,UAAS;GAClC,MAAM,EACJ,WAAW,EAAC,MAAM,cAClB,SAAS,YACP;AACJ,UAAO,CAAC,MAAM;IAAC;IAAM;IAAS;IAAW,CAAuB;IAChE,CACH;EAGC,eAAe,EAAE;EAClB"}

package/out/zero-cache/src/config/zero-config.d.ts CHANGED Viewed

@@ -76,9 +76,18 @@ declare const authOptions: {
         desc: string[];
         deprecated: string[];
     };
+    revalidateIntervalSeconds: {
+        type: v.Optional<number>;
+        desc: string[];
+    };
+    retransformIntervalSeconds: {
+        type: v.Optional<number>;
+        desc: string[];
+    };
 };
-/** @deprecated */
 export type AuthConfig = Config<typeof authOptions>;
+/** @deprecated used only by legacy JWT verification helpers */
+export type LegacyJWTAuthConfig = Pick<AuthConfig, 'jwk' | 'jwksUrl' | 'secret' | 'issuer' | 'audience'>;
 export declare const zeroOptions: {
     upstream: {
         db: {
@@ -98,6 +107,10 @@ export declare const zeroOptions: {
             type: v.Optional<number>;
             hidden: boolean;
         };
+        pgReplicationSlotFailover: {
+            type: v.Optional<boolean>;
+            desc: string[];
+        };
     };
     /** @deprecated */
     push: {
@@ -189,6 +202,10 @@ export declare const zeroOptions: {
             desc: string[];
         };
     };
+    enableCrudMutations: {
+        type: v.Type<boolean>;
+        desc: string[];
+    };
     cvr: {
         db: {
             type: v.Optional<string>;
@@ -287,7 +304,6 @@ export declare const zeroOptions: {
             hidden: boolean;
         };
     };
-    /** @deprecated */
     auth: {
         jwk: {
             type: v.Optional<string>;
@@ -314,6 +330,14 @@ export declare const zeroOptions: {
             desc: string[];
             deprecated: string[];
         };
+        revalidateIntervalSeconds: {
+            type: v.Optional<number>;
+            desc: string[];
+        };
+        retransformIntervalSeconds: {
+            type: v.Optional<number>;
+            desc: string[];
+        };
     };
     port: {
         type: v.Type<number>;
@@ -411,6 +435,14 @@ export declare const zeroOptions: {
             type: v.Optional<string>;
             desc: string[];
         };
+        executableV5: {
+            type: v.Optional<string>;
+            desc: string[];
+        };
+        restoreUsingV5: {
+            type: v.Type<boolean>;
+            desc: string[];
+        };
         configPath: {
             type: v.Type<string>;
             desc: string[];
@@ -477,6 +509,10 @@ export declare const zeroOptions: {
             hidden: boolean;
             desc: string[];
         };
+        textCopy: {
+            type: v.Type<boolean>;
+            desc: string[];
+        };
     };
     /** @deprecated */
     targetClientRowCount: {

package/out/zero-cache/src/config/zero-config.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"zero-config.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/config/zero-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AAUnD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAC,SAAS,EAAC,MAAM,kCAAkC,CAAC;AAEhE,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,eAAO,MAAM,UAAU;;;;;;;;;CA+CtB,CAAC;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;CAwBxB,CAAC;AAEF,QAAA,MAAM,cAAc;;;;;;;;;CAmBnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAE3D,QAAA,MAAM,oBAAoB;;;;;;;;;CAczB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5D,QAAA,MAAM,WAAW~~;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDhB~~,CAAC;AAuGF,~~kBAAkB;AAClB,~~MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;~~AAKpD~~,eAAO,MAAM,WAAW~~;;;;;;;;;;;;;;;;;;;;IAwCtB~~,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAGlB,kBAAkB~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuHlB~~,kBAAkB~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA6ChB,kBAAkB~~;;;;;;QASlB,kBAAkB~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4UpB~~,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgEnB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAIpD,wBAAgB,aAAa,CAC3B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,UAAU,CAaZ;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,oBAAoB,CAItB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,GAAG,SAAS,GACpD,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,EACnD,QAAQ,EAAE,MAAM,GAAG,SAAS,WAwC7B;AAYD,wBAAgB,kBAAkB,SAEjC"}
1	+ {"version":3,"file":"zero-config.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/config/zero-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AAUnD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAC,SAAS,EAAC,MAAM,kCAAkC,CAAC;AAEhE,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,eAAO,MAAM,UAAU;;;;;;;;;CA+CtB,CAAC;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;CAwBxB,CAAC;AAEF,QAAA,MAAM,cAAc;;;;;;;;;CAmBnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAE3D,QAAA,MAAM,oBAAoB;;;;;;;;;CAczB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5D,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8DhB,CAAC;AAuGF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAEpD,+DAA+D;AAC/D,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,UAAU,EACV,KAAK,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CACrD,CAAC;AAKF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;IAsDtB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAGlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4KhB,kBAAkB;;;;;;QASlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2WpB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgEnB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAIpD,wBAAgB,aAAa,CAC3B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,UAAU,CAaZ;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,oBAAoB,CAItB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,GAAG,SAAS,GACpD,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,EACnD,QAAQ,EAAE,MAAM,GAAG,SAAS,WAwC7B;AAYD,wBAAgB,kBAAkB,SAEjC"}

package/out/zero-cache/src/config/zero-config.js CHANGED Viewed

@@ -126,6 +126,14 @@ var authOptions = {
 		type: valita_exports.string().optional(),
 		desc: [`Expected audience ({bold aud} claim) for JWT validation.`, `If set, tokens with a different or missing audience will be rejected.`],
 		deprecated: [`Use cookie-based authentication or an auth token instead - see https://zero.rocicorp.dev/docs/auth.`]
+	},
+	revalidateIntervalSeconds: {
+		type: valita_exports.number().optional(),
+		desc: [`The interval in seconds between periodic /query auth revalidation for validated connections.`, `If unset, periodic auth revalidation is disabled.`]
+	},
+	retransformIntervalSeconds: {
+		type: valita_exports.number().optional(),
+		desc: [`The interval in seconds between periodic shared /query retransform work for a client group.`, `If unset, periodic shared retransform is disabled.`]
 	}
 };
 var makeDeprecationMessage = (flag) => `Use {bold ${flagToEnv(ZERO_ENV_VAR_PREFIX, flag)}} (or {bold --${flag}}) instead.`;
@@ -236,12 +244,33 @@ var zeroOptions = {
 		maxConnsPerWorker: {
 			type: valita_exports.number().optional(),
 			hidden: true
+		},
+		pgReplicationSlotFailover: {
+			type: valita_exports.boolean().optional(),
+			desc: [
+				`For upstream Postgres versions 17+, creates replication slots with the`,
+				`{bold failover} parameter set to {bold true} to enable slot synchronization`,
+				`and failover. Note that additional Postgres-level configuration is necessary`,
+				`when enabling this option. For details, see:`,
+				``,
+				`https://www.postgresql.org/docs/current/logicaldecoding-explanation.html#LOGICALDECODING-REPLICATION-SLOTS-SYNCHRONIZATION`,
+				``,
+				`(Note that this option has no effect for Postgres versions before 17.)`
+			]
 		}
 	},
 	push: pushOptions,
 	mutate: mutateOptions,
 	getQueries: getQueriesOptions,
 	query: queryOptions,
+	enableCrudMutations: {
+		type: valita_exports.boolean().default(true),
+		desc: [
+			`Enables support for legacy CRUD mutations. When this is {bold false}, no connections`,
+			`are made from view-syncers to the upstream db, and push messages with CRUD mutations`,
+			`result in an InvalidPush response.`
+		]
+	},
 	cvr: {
 		db: {
 			type: valita_exports.string().optional(),
@@ -544,7 +573,25 @@ var zeroOptions = {
 	litestream: {
 		executable: {
 			type: valita_exports.string().optional(),
-			desc: [`Path to the {bold litestream} executable.`]
+			desc: [
+				`Path to the {bold litestream} executable. This must be built from the`,
+				`{bold rocicorp/litestream} fork. Support for the official binary at v0.5.x`,
+				`is planned.`
+			]
+		},
+		executableV5: {
+			type: valita_exports.string().optional(),
+			desc: [
+				`The v0.5.x litestream executable which is used for restoring the backup`,
+				`backup when {bold ZERO_LITESTREAM_RESTORE_USING_V5} is specified.`,
+				`litestream v0.5.8+ can restore from both v0.3.x and v0.5.x backup formats,`,
+				`affording forwards compatibility with a future zero-cache`,
+				`version that will use litestream v0.5.x to backup the replica.`
+			]
+		},
+		restoreUsingV5: {
+			type: valita_exports.boolean().default(false),
+			desc: [`Restores the backup using the {bold ZERO_LITESTREAM_EXECUTABLE_V5} if specified.`]
 		},
 		configPath: {
 			type: valita_exports.string().default("./src/services/litestream/config.yml"),
@@ -661,6 +708,14 @@ var zeroOptions = {
 			type: valita_exports.boolean().optional(),
 			hidden: true,
 			desc: [`Takes a cpu profile during the copy phase initial-sync, storing it as a JSON file`, `initial-copy.cpuprofile in the tmp directory.`]
+		},
+		textCopy: {
+			type: valita_exports.boolean().default(false),
+			desc: [
+				`Use text-format COPY instead of binary COPY for the initial sync.`,
+				`This is slower but can work around issues with binary encoding of`,
+				`certain data types.`
+			]
 		}
 	},
 	targetClientRowCount: {