on-zero 0.0.87 → 0.0.88

package/dist/esm/where.js

@@ -1,8 +1,12 @@
 import { isServer } from "./constants";
 import { getQueryOrMutatorAuthData } from "./helpers/getQueryOrMutatorAuthData";
+let _evaluatingPermission = !1;
+function setEvaluatingPermission(value) {
+  _evaluatingPermission = value;
+}
 function where(a, b, isServerOnly = !1) {
   const whereFn = b || a, wrappedWhereFn = ((a2, b2 = getQueryOrMutatorAuthData()) => {
-    if (!isServer && isServerOnly)
+    if (!isServer && isServerOnly && !_evaluatingPermission)
       return a2.and();
     const result = whereFn(a2, b2);
     return typeof result == "boolean" ? result ? a2.cmpLit(0, "=", 0) : a2.cmpLit(1, "=", 0) : result;
@@ -19,6 +23,7 @@ function getRawWhere(where2) {
 export {
   getRawWhere,
   getWhereTableName,
+  setEvaluatingPermission,
   where
 };
 //# sourceMappingURL=where.js.map

package/dist/esm/where.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../src/where.ts"],
-  "mappings": "AAAA,SAAS,gBAAgB;AACzB,SAAS,iCAAiC;AAenC,SAAS,MACd,GACA,GACA,eAAe,IACc;AAC7B,QAAM,UAAW,KAAK,GAEhB,kBAAkB,CACtBA,IACAC,KAAI,0BAA0B,MAC3B;AACH,QAAI,CAAC,YAAY;AAEf,aAAOD,GAAE,IAAI;AAGf,UAAM,SAAS,QAAQA,IAAGC,EAAC;AAC3B,WAAI,OAAO,UAAW,YAChB,SACKD,GAAE,OAAO,GAAG,KAAK,CAAC,IAElBA,GAAE,OAAO,GAAG,KAAK,CAAC,IAGtB;AAAA,EACT;AAGA,4BAAmB,IAAI,gBAAgB,OAAO,GAE1C,KACF,kBAAkB,IAAI,gBAAgB,CAAU,GAG3C;AACT;AAIA,MAAM,oBAAoB,oBAAI,QAA0B,GAClD,qBAAqB,oBAAI,QAAsB;AAE9C,SAAS,kBAAkBE,QAAc;AAC9C,SAAO,kBAAkB,IAAIA,MAAK;AACpC;AAGO,SAAS,YAAYA,QAAiC;AAC3D,SAAO,mBAAmB,IAAIA,MAAK;AACrC;",
+  "mappings": "AAAA,SAAS,gBAAgB;AACzB,SAAS,iCAAiC;AAO1C,IAAI,wBAAwB;AAErB,SAAS,wBAAwB,OAAgB;AACtD,0BAAwB;AAC1B;AAYO,SAAS,MACd,GACA,GACA,eAAe,IACc;AAC7B,QAAM,UAAW,KAAK,GAEhB,kBAAkB,CACtBA,IACAC,KAAI,0BAA0B,MAC3B;AACH,QAAI,CAAC,YAAY,gBAAgB,CAAC;AAEhC,aAAOD,GAAE,IAAI;AAGf,UAAM,SAAS,QAAQA,IAAGC,EAAC;AAC3B,WAAI,OAAO,UAAW,YAChB,SACKD,GAAE,OAAO,GAAG,KAAK,CAAC,IAElBA,GAAE,OAAO,GAAG,KAAK,CAAC,IAGtB;AAAA,EACT;AAGA,4BAAmB,IAAI,gBAAgB,OAAO,GAE1C,KACF,kBAAkB,IAAI,gBAAgB,CAAU,GAG3C;AACT;AAIA,MAAM,oBAAoB,oBAAI,QAA0B,GAClD,qBAAqB,oBAAI,QAAsB;AAE9C,SAAS,kBAAkBE,QAAc;AAC9C,SAAO,kBAAkB,IAAIA,MAAK;AACpC;AAGO,SAAS,YAAYA,QAAiC;AAC3D,SAAO,mBAAmB,IAAIA,MAAK;AACrC;",
   "names": ["a", "b", "where"]
 }

package/dist/esm/where.mjs

@@ -1,9 +1,13 @@
 import { isServer } from "./constants.mjs";
 import { getQueryOrMutatorAuthData } from "./helpers/getQueryOrMutatorAuthData.mjs";
+let _evaluatingPermission = !1;
+function setEvaluatingPermission(value) {
+  _evaluatingPermission = value;
+}
 function where(a, b, isServerOnly = !1) {
   const whereFn = b || a,
     wrappedWhereFn = (a2, b2 = getQueryOrMutatorAuthData()) => {
-      if (!isServer && isServerOnly) return a2.and();
+      if (!isServer && isServerOnly && !_evaluatingPermission) return a2.and();
       const result = whereFn(a2, b2);
       return typeof result == "boolean" ? result ? a2.cmpLit(0, "=", 0) : a2.cmpLit(1, "=", 0) : result;
     };
@@ -17,5 +21,5 @@ function getWhereTableName(where2) {
 function getRawWhere(where2) {
   return WhereRawBuilderMap.get(where2);
 }
-export { getRawWhere, getWhereTableName, where };
+export { getRawWhere, getWhereTableName, setEvaluatingPermission, where };
 //# sourceMappingURL=where.mjs.map

package/dist/esm/where.mjs.map

@@ -1 +1 @@
-{"version":3,"names":["isServer","getQueryOrMutatorAuthData","where","a","b","isServerOnly","whereFn","wrappedWhereFn","a2","b2","and","result","cmpLit","WhereRawBuilderMap","set","WhereTableNameMap","WeakMap","getWhereTableName","where2","get","getRawWhere"],"sources":["../../src/where.ts"],"sourcesContent":[null],"mappings":"AAAA,SAASA,QAAA,QAAgB;AACzB,SAASC,yBAAA,QAAiC;AAenC,SAASC,MACdC,CAAA,EACAC,CAAA,EACAC,YAAA,GAAe,IACc;EAC7B,MAAMC,OAAA,GAAWF,CAAA,IAAKD,CAAA;IAEhBI,cAAA,GAAkBA,CACtBC,EAAA,EACAC,EAAA,GAAIR,yBAAA,CAA0B,MAC3B;MACH,IAAI,CAACD,QAAA,IAAYK,YAAA,EAEf,OAAOG,EAAA,CAAEE,GAAA,CAAI;MAGf,MAAMC,MAAA,GAASL,OAAA,CAAQE,EAAA,EAAGC,EAAC;MAC3B,OAAI,OAAOE,MAAA,IAAW,YAChBA,MAAA,GACKH,EAAA,CAAEI,MAAA,CAAO,GAAG,KAAK,CAAC,IAElBJ,EAAA,CAAEI,MAAA,CAAO,GAAG,KAAK,CAAC,IAGtBD,MAAA;IACT;EAGA,OAAAE,kBAAA,CAAmBC,GAAA,CAAIP,cAAA,EAAgBD,OAAO,GAE1CF,CAAA,IACFW,iBAAA,CAAkBD,GAAA,CAAIP,cAAA,EAAgBJ,CAAU,GAG3CI,cAAA;AACT;AAIA,MAAMQ,iBAAA,GAAoB,mBAAIC,OAAA,CAA0B;EAClDH,kBAAA,GAAqB,mBAAIG,OAAA,CAAsB;AAE9C,SAASC,kBAAkBC,MAAA,EAAc;EAC9C,OAAOH,iBAAA,CAAkBI,GAAA,CAAID,MAAK;AACpC;AAGO,SAASE,YAAYF,MAAA,EAAiC;EAC3D,OAAOL,kBAAA,CAAmBM,GAAA,CAAID,MAAK;AACrC","ignoreList":[]}
+{"version":3,"names":["isServer","getQueryOrMutatorAuthData","_evaluatingPermission","setEvaluatingPermission","value","where","a","b","isServerOnly","whereFn","wrappedWhereFn","a2","b2","and","result","cmpLit","WhereRawBuilderMap","set","WhereTableNameMap","WeakMap","getWhereTableName","where2","get","getRawWhere"],"sources":["../../src/where.ts"],"sourcesContent":[null],"mappings":"AAAA,SAASA,QAAA,QAAgB;AACzB,SAASC,yBAAA,QAAiC;AAO1C,IAAIC,qBAAA,GAAwB;AAErB,SAASC,wBAAwBC,KAAA,EAAgB;EACtDF,qBAAA,GAAwBE,KAAA;AAC1B;AAYO,SAASC,MACdC,CAAA,EACAC,CAAA,EACAC,YAAA,GAAe,IACc;EAC7B,MAAMC,OAAA,GAAWF,CAAA,IAAKD,CAAA;IAEhBI,cAAA,GAAkBA,CACtBC,EAAA,EACAC,EAAA,GAAIX,yBAAA,CAA0B,MAC3B;MACH,IAAI,CAACD,QAAA,IAAYQ,YAAA,IAAgB,CAACN,qBAAA,EAEhC,OAAOS,EAAA,CAAEE,GAAA,CAAI;MAGf,MAAMC,MAAA,GAASL,OAAA,CAAQE,EAAA,EAAGC,EAAC;MAC3B,OAAI,OAAOE,MAAA,IAAW,YAChBA,MAAA,GACKH,EAAA,CAAEI,MAAA,CAAO,GAAG,KAAK,CAAC,IAElBJ,EAAA,CAAEI,MAAA,CAAO,GAAG,KAAK,CAAC,IAGtBD,MAAA;IACT;EAGA,OAAAE,kBAAA,CAAmBC,GAAA,CAAIP,cAAA,EAAgBD,OAAO,GAE1CF,CAAA,IACFW,iBAAA,CAAkBD,GAAA,CAAIP,cAAA,EAAgBJ,CAAU,GAG3CI,cAAA;AACT;AAIA,MAAMQ,iBAAA,GAAoB,mBAAIC,OAAA,CAA0B;EAClDH,kBAAA,GAAqB,mBAAIG,OAAA,CAAsB;AAE9C,SAASC,kBAAkBC,MAAA,EAAc;EAC9C,OAAOH,iBAAA,CAAkBI,GAAA,CAAID,MAAK;AACpC;AAGO,SAASE,YAAYF,MAAA,EAAiC;EAC3D,OAAOL,kBAAA,CAAmBM,GAAA,CAAID,MAAK;AACrC","ignoreList":[]}

package/dist/esm/where.native.js

@@ -1,11 +1,15 @@
 import { isServer } from "./constants.native.js";
 import { getQueryOrMutatorAuthData } from "./helpers/getQueryOrMutatorAuthData.native.js";
+var _evaluatingPermission = !1;
+function setEvaluatingPermission(value) {
+  _evaluatingPermission = value;
+}
 function where(a, b) {
   var isServerOnly = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : !1,
     whereFn = b || a,
     wrappedWhereFn = function (a2) {
       var _$b = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : getQueryOrMutatorAuthData();
-      if (!isServer && isServerOnly) return a2.and();
+      if (!isServer && isServerOnly && !_evaluatingPermission) return a2.and();
       var result = whereFn(a2, _$b);
       return typeof result == "boolean" ? result ? a2.cmpLit(0, "=", 0) : a2.cmpLit(1, "=", 0) : result;
     };
@@ -19,5 +23,5 @@ function getWhereTableName(where2) {
 function getRawWhere(where2) {
   return WhereRawBuilderMap.get(where2);
 }
-export { getRawWhere, getWhereTableName, where };
+export { getRawWhere, getWhereTableName, setEvaluatingPermission, where };
 //# sourceMappingURL=where.native.js.map

package/dist/esm/where.native.js.map

@@ -1 +1 @@
-{"version":3,"names":["isServer","getQueryOrMutatorAuthData","where","a","b","isServerOnly","arguments","length","whereFn","wrappedWhereFn","a2","_$b","and","result","cmpLit","WhereRawBuilderMap","set","WhereTableNameMap","WeakMap","getWhereTableName","where2","get","getRawWhere"],"sources":["../../src/where.ts"],"sourcesContent":[null],"mappings":"AAAA,SAASA,QAAA,QAAgB;AACzB,SAASC,yBAAA,QAAiC;AAenC,SAASC,MACdC,CAAA,EACAC,CAAA,EACA;EAEA,IAAAC,YAAiB,GAAAC,SAEX,CAAAC,MAAA,QACJD,SACI,iBAAAA,SAA0B,MAC3B;IAAAE,OAAA,GAAAJ,CAAA,IAAAD,CAAA;IAAAM,cAAA,YAAAA,CAAAC,EAAA;MACH,IAAIC,GAAC,GAAAL,SAAY,CAAAC,MAAA,QAAAD,SAAA,iBAAAA,SAAA,MAAAL,yBAAA;MAEf,KAAAD,QAAS,IAAIK,YAAA,EAGf,OAAMK,EAAA,CAAAE,GAAS;MACf,IAAAC,MAAI,GAAAL,OAAO,CAAAE,EAAA,EAAWC,GAAA;MAQxB,cAAAE,MAAA,gBAAAA,MAAA,GAAAH,EAAA,CAAAI,MAAA,cAAAJ,EAAA,CAAAI,MAAA,cAAAD,MAAA;IAGA;EAOF,OAAAE,kBAAA,CAAAC,GAAA,CAAAP,cAAA,EAAAD,OAAA,GAAAJ,CAAA,IAAAa,iBAAA,CAAAD,GAAA,CAAAP,cAAA,EAAAN,CAAA,GAAAM,cAAA;AAIA;AAGO,IAAAQ,iBAAS,kBAAgC,IAAAC,OAAA;EAAAH,kBAAA,sBAAAG,OAAA;AAC9C,SAAOC,kBAAkBC,MAAI;EAC/B,OAAAH,iBAAA,CAAAI,GAAA,CAAAD,MAAA;AAGO;AACL,SAAOE,YAAAF,MAAA,EAAmB;EAC5B,OAAAL,kBAAA,CAAAM,GAAA,CAAAD,MAAA","ignoreList":[]}
+{"version":3,"names":["isServer","getQueryOrMutatorAuthData","_evaluatingPermission","setEvaluatingPermission","value","where","a","b","isServerOnly","arguments","length","whereFn","wrappedWhereFn","a2","_$b","and","result","cmpLit","WhereRawBuilderMap","set","WhereTableNameMap","WeakMap","getWhereTableName","where2","get","getRawWhere"],"sources":["../../src/where.ts"],"sourcesContent":[null],"mappings":"AAAA,SAASA,QAAA,QAAgB;AACzB,SAASC,yBAAA,QAAiC;AAO1C,IAAIC,qBAAA,GAAwB;AAErB,SAASC,wBAAwBC,KAAA,EAAgB;EACtDF,qBAAA,GAAwBE,KAAA;AAC1B;AAYO,SAASC,MACdC,CAAA,EACAC,CAAA,EACA;EAEA,IAAAC,YAAiB,GAAAC,SAEX,CAAAC,MAAA,QACJD,SACI,iBAAAA,SAA0B,MAC3B;IAAAE,OAAA,GAAAJ,CAAA,IAAAD,CAAA;IAAAM,cAAA,YAAAA,CAAAC,EAAA;MACH,IAAIC,GAAC,GAAAL,SAAY,CAAAC,MAAA,QAAiBD,SAAA,iBAAAA,SAAA,MAAAR,yBAAA;MAEhC,KAAAD,QAAS,IAAIQ,YAAA,KAAAN,qBAAA,EAGf,OAAMW,EAAA,CAAAE,GAAS;MACf,IAAAC,MAAI,GAAAL,OAAO,CAAAE,EAAA,EAAWC,GAAA;MAQxB,cAAAE,MAAA,gBAAAA,MAAA,GAAAH,EAAA,CAAAI,MAAA,cAAAJ,EAAA,CAAAI,MAAA,cAAAD,MAAA;IAGA;EAOF,OAAAE,kBAAA,CAAAC,GAAA,CAAAP,cAAA,EAAAD,OAAA,GAAAJ,CAAA,IAAAa,iBAAA,CAAAD,GAAA,CAAAP,cAAA,EAAAN,CAAA,GAAAM,cAAA;AAIA;AAGO,IAAAQ,iBAAS,kBAAgC,IAAAC,OAAA;EAAAH,kBAAA,sBAAAG,OAAA;AAC9C,SAAOC,kBAAkBC,MAAI;EAC/B,OAAAH,iBAAA,CAAAI,GAAA,CAAAD,MAAA;AAGO;AACL,SAAOE,YAAAF,MAAA,EAAmB;EAC5B,OAAAL,kBAAA,CAAAM,GAAA,CAAAD,MAAA","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "on-zero",
-  "version": "0.0.87",
+  "version": "0.0.88",
   "description": "A typed layer over @rocicorp/zero with queries, mutations, and permissions",
   "sideEffects": false,
   "source": "src/index.ts",

package/src/createZeroClient.tsx

@@ -15,12 +15,12 @@ import { createPermissions } from './createPermissions'
 import { createUseQuery } from './createUseQuery'
 import { createMutators } from './helpers/createMutators'
 import { getQueryOrMutatorAuthData } from './helpers/getQueryOrMutatorAuthData'
-import { getMutationsPermissions } from './modelRegistry'
+import { getAllMutationsPermissions, getMutationsPermissions } from './modelRegistry'
 import { registerQuery } from './queryRegistry'
 import { resolveQuery, type PlainQueryFn } from './resolveQuery'
 import { setCustomQueries } from './run'
 import { setAuthData, setSchema } from './state'
-import { getRawWhere } from './where'
+import { getRawWhere, setEvaluatingPermission } from './where'
 import { setRunner } from './zeroRunner'
 import { zql } from './zql'
 
@@ -31,6 +31,12 @@ type PreloadOptions = { ttl?: 'always' | 'never' | number | undefined }
 
 export type GroupedQueries = Record<string, Record<string, (...args: any[]) => any>>
 
+// controls how usePermission behaves before the server responds:
+//  - 'optimistic': evaluate the permission query on the client (default)
+//  - 'optimistic-deny': return false until server confirms
+//  - 'optimistic-allow': return true until server confirms
+export type PermissionStrategy = 'optimistic' | 'optimistic-deny' | 'optimistic-allow'
+
 export function createZeroClient<
   Schema extends ZeroSchema,
   Models extends GenericModels,
@@ -38,10 +44,12 @@ export function createZeroClient<
   schema,
   models,
   groupedQueries,
+  permissionStrategy = 'optimistic',
 }: {
   schema: Schema
   models: Models
   groupedQueries: GroupedQueries
+  permissionStrategy?: PermissionStrategy
 }) {
   type ZeroMutators = GetZeroMutators<Models>
   type ZeroInstance = Zero<Schema, ZeroMutators>
@@ -74,41 +82,74 @@ export function createZeroClient<
     }
   }
 
-  // register permission.check synced query
-  // client: evaluates raw permission condition for optimistic result (zero caches via materialization)
+  // register per-model permission queries so each table gets its own materialized view
+  // client: evaluates raw permission condition for optimistic result
   // server: evaluates real permission condition authoritatively
-  const permissionCheckFn = (args: {
-    table: string
-    objOrId: string | Record<string, any>
-  }) => {
-    const perm = getMutationsPermissions(args.table)
-    const base = (zql as any)[args.table]
+  const permissionCheckFns: Record<
+    string,
+    (args: { objOrId: string | Record<string, any> }) => any
+  > = {}
 
-    // when objOrId is missing, return a query that matches nothing
-    if (!args.objOrId) {
-      return base.where((eb: any) => eb.cmpLit(true, '=', false)).one()
-    }
+  const createPermissionCheckFn = (table: string) => {
+    const fn = (args: { objOrId: string | Record<string, any> }) => {
+      const perm = getMutationsPermissions(table)
+      const base = (zql as any)[table]
 
-    // use the raw (unwrapped) builder so serverWhere conditions actually evaluate on client
-    // this gives us optimistic permission results — zero caches via its materialized views
-    const rawPerm = perm ? getRawWhere(perm) || perm : perm
-
-    return base
-      .where((eb: any) => {
-        return permissionsHelpers.buildPermissionQuery(
-          getQueryOrMutatorAuthData(),
-          eb,
-          rawPerm || ((e: any) => e.and()),
-          args.objOrId,
-          args.table
-        )
-      })
-      .one()
+      if (!args.objOrId) {
+        return base.where((eb: any) => eb.cmpLit(true, '=', false)).one()
+      }
+
+      if (permissionStrategy === 'optimistic') {
+        // unwrap serverWhere so conditions actually evaluate on client
+        // set flag so nested serverWhere calls also bypass the client no-op
+        const rawPerm = perm ? getRawWhere(perm) || perm : perm
+        return base
+          .where((eb: any) => {
+            setEvaluatingPermission(true)
+            try {
+              return permissionsHelpers.buildPermissionQuery(
+                getQueryOrMutatorAuthData(),
+                eb,
+                rawPerm || ((e: any) => e.and()),
+                args.objOrId,
+                table
+              )
+            } finally {
+              setEvaluatingPermission(false)
+            }
+          })
+          .one()
+      }
+
+      if (permissionStrategy === 'optimistic-deny') {
+        // client query always returns false, server corrects authoritatively
+        return base.where((eb: any) => eb.cmpLit(true, '=', false)).one()
+      }
+
+      // optimistic-allow: pass wrapped perm directly
+      // serverWhere is a no-op on client → eb.and() → always true → row exists check
+      // server evaluates real condition and corrects authoritatively
+      return base
+        .where((eb: any) => {
+          return permissionsHelpers.buildPermissionQuery(
+            getQueryOrMutatorAuthData(),
+            eb,
+            perm || ((e: any) => e.and()),
+            args.objOrId,
+            table
+          )
+        })
+        .one()
+    }
+    permissionCheckFns[table] = fn
+    registerQuery(fn, `permission.${table}`)
+    return fn
   }
 
-  registerQuery(permissionCheckFn, 'permission.check')
-  wrappedNamespaces['permission'] = {
-    check: defineQuery(({ args }: any) => permissionCheckFn(args)),
+  wrappedNamespaces['permission'] = {}
+  for (const [table] of getAllMutationsPermissions()) {
+    const fn = createPermissionCheckFn(table)
+    wrappedNamespaces['permission'][table] = defineQuery(({ args }: any) => fn(args))
   }
 
   // create the single shared CustomQuery registry
@@ -143,8 +184,8 @@ export function createZeroClient<
     customQueries,
   })
 
-  // permission check uses a synced query so server is authoritative
-  // client is optimistic (serverWhere is no-op), server evaluates real condition
+  // permission check uses a per-model synced query so server is authoritative
+  // permissionStrategy controls client behavior before server responds
   function usePermission(
     table: TableName | (string & {}),
     objOrId: string | Partial<Row<any>> | undefined,
@@ -152,11 +193,13 @@ export function createZeroClient<
     debug = false
   ): boolean | null {
     const disabled = use(DisabledContext)
+    const tableStr = table as string
+    const checkFn = permissionCheckFns[tableStr]
 
     const [data, status] = useQuery(
-      permissionCheckFn as any,
-      { table: table as string, objOrId: objOrId as any },
-      { enabled: Boolean(!disabled && enabled && objOrId) }
+      checkFn as any,
+      { objOrId: objOrId as any },
+      { enabled: Boolean(!disabled && enabled && objOrId && checkFn) }
     )
 
     if (debug) {

package/src/createZeroServer.ts

@@ -132,10 +132,10 @@ export function createZeroServer<
 
     const response = await zeroHandleQueryRequest(
       (name, args) => {
-        // permission.check is registered by on-zero at runtime, not in the user's query registry
-        if (name === 'permission.check') {
-          const { table, objOrId } = args as {
-            table: string
+        // per-model permission queries registered by on-zero at runtime
+        if (name.startsWith('permission.')) {
+          const table = name.slice('permission.'.length)
+          const { objOrId } = args as {
             objOrId: string | Record<string, any>
           }
           const perm = getMutationsPermissions(table)

package/src/modelRegistry.ts

@@ -9,3 +9,7 @@ export function setMutationsPermissions(tableName: string, permissions: Where) {
 export function getMutationsPermissions(tableName: string): Where | undefined {
   return mutationsToPermissionsRegistry.get(tableName)
 }
+
+export function getAllMutationsPermissions(): Map<string, Where> {
+  return mutationsToPermissionsRegistry
+}

package/src/where.ts

@@ -4,6 +4,14 @@ import { getQueryOrMutatorAuthData } from './helpers/getQueryOrMutatorAuthData'
 import type { TableName, Where } from './types'
 import type { Condition, ExpressionBuilder } from '@rocicorp/zero'
 
+// when true, serverWhere bypasses the client no-op so nested serverWhere
+// calls inside permission builders actually evaluate on the client
+let _evaluatingPermission = false
+
+export function setEvaluatingPermission(value: boolean) {
+  _evaluatingPermission = value
+}
+
 export function where<Table extends TableName, Builder extends Where<Table>>(
   tableName: Table,
   builder: Builder,
@@ -25,7 +33,7 @@ export function where<Table extends TableName, Builder extends Where<Table>>(
     a: ExpressionBuilder<any, any>,
     b = getQueryOrMutatorAuthData()
   ) => {
-    if (!isServer && isServerOnly) {
+    if (!isServer && isServerOnly && !_evaluatingPermission) {
       // on client (web or native) where conditions always pass
       return a.and()
     }

package/types/createZeroClient.d.ts

@@ -6,10 +6,12 @@ type PreloadOptions = {
     ttl?: 'always' | 'never' | number | undefined;
 };
 export type GroupedQueries = Record<string, Record<string, (...args: any[]) => any>>;
-export declare function createZeroClient<Schema extends ZeroSchema, Models extends GenericModels>({ schema, models, groupedQueries, }: {
+export type PermissionStrategy = 'optimistic' | 'optimistic-deny' | 'optimistic-allow';
+export declare function createZeroClient<Schema extends ZeroSchema, Models extends GenericModels>({ schema, models, groupedQueries, permissionStrategy, }: {
     schema: Schema;
     models: Models;
     groupedQueries: GroupedQueries;
+    permissionStrategy?: PermissionStrategy;
 }): {
     zeroEvents: import("@take-out/helpers").Emitter<ZeroEvent | null>;
     ProvideZero: ({ children, authData: authDataIn, disable, ...props }: Omit<ZeroOptions<Schema, GetZeroMutators<Models>>, "schema" | "mutators"> & {

package/types/createZeroClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createZeroClient.d.ts","sourceRoot":"","sources":["../src/createZeroClient.tsx"],"names":[],"mappings":"AAGA,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,OAAO,CAAA;AAQd,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAOhE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAClF,OAAO,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEzF,KAAK,cAAc,GAAG;IAAE,GAAG,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAA;CAAE,CAAA;AAEvE,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;AAEpF,wBAAgB,gBAAgB,CAC9B,MAAM,SAAS,UAAU,EACzB,MAAM,SAAS,aAAa,EAC5B,EACA,MAAM,EACN,MAAM,EACN,cAAc,GACf,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,cAAc,CAAA;CAC/B;;yEAsII,IAAI,CAAC,WAAW,CAAC,MAAM,0BAAe,EAAE,QAAQ,GAAG,UAAU,CAAC,GAAG;QAClE,QAAQ,EAAE,SAAS,CAAA;QACnB,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAA;QAC1B,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB;;2BAlCQ,yJAAY,CAAC,MAAM,GAAG,EAAE,CAAC,WACvB,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,yCAG9C,OAAO,GAAG,IAAI;;;SAwHA,IAAI,EAAE,MAAM,SAAS,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,OAAO,MACxE,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,UAC9C,IAAI,YACF,cAAc,GACvB;YAAE,OAAO,EAAE,MAAM,IAAI,CAAC;YAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;SAAE;SAClC,MAAM,SAAS,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,OAAO,MAClE,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,YAC5C,cAAc,GACvB;YAAE,OAAO,EAAE,MAAM,IAAI,CAAC;YAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;SAAE;;EAuBpD"}
+{"version":3,"file":"createZeroClient.d.ts","sourceRoot":"","sources":["../src/createZeroClient.tsx"],"names":[],"mappings":"AAGA,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,OAAO,CAAA;AAQd,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAOhE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAClF,OAAO,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEzF,KAAK,cAAc,GAAG;IAAE,GAAG,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAA;CAAE,CAAA;AAEvE,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;AAMpF,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,iBAAiB,GAAG,kBAAkB,CAAA;AAEtF,wBAAgB,gBAAgB,CAC9B,MAAM,SAAS,UAAU,EACzB,MAAM,SAAS,aAAa,EAC5B,EACA,MAAM,EACN,MAAM,EACN,cAAc,EACd,kBAAiC,GAClC,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,cAAc,CAAA;IAC9B,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CACxC;;yEAyKI,IAAI,CAAC,WAAW,CAAC,MAAM,0BAAe,EAAE,QAAQ,GAAG,UAAU,CAAC,GAAG;QAClE,QAAQ,EAAE,SAAS,CAAA;QACnB,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAA;QAC1B,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB;;2BApCQ,yJAAY,CAAC,MAAM,GAAG,EAAE,CAAC,WACvB,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,yCAG9C,OAAO,GAAG,IAAI;;;SA0HA,IAAI,EAAE,MAAM,SAAS,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,OAAO,MACxE,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,UAC9C,IAAI,YACF,cAAc,GACvB;YAAE,OAAO,EAAE,MAAM,IAAI,CAAC;YAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;SAAE;SAClC,MAAM,SAAS,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,OAAO,MAClE,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,YAC5C,cAAc,GACvB;YAAE,OAAO,EAAE,MAAM,IAAI,CAAC;YAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;SAAE;;EAuBpD"}

package/types/modelRegistry.d.ts

@@ -1,4 +1,5 @@
 import { Where } from './types';
 export declare function setMutationsPermissions(tableName: string, permissions: Where): void;
 export declare function getMutationsPermissions(tableName: string): Where | undefined;
+export declare function getAllMutationsPermissions(): Map<string, Where>;
 //# sourceMappingURL=modelRegistry.d.ts.map

package/types/modelRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modelRegistry.d.ts","sourceRoot":"","sources":["../src/modelRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAI/B,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,QAE5E;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAE5E"}
+{"version":3,"file":"modelRegistry.d.ts","sourceRoot":"","sources":["../src/modelRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAI/B,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,QAE5E;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAE5E;AAED,wBAAgB,0BAA0B,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAE/D"}

package/types/where.d.ts

@@ -1,5 +1,6 @@
 import type { TableName, Where } from './types';
 import type { Condition } from '@rocicorp/zero';
+export declare function setEvaluatingPermission(value: boolean): void;
 export declare function where<Table extends TableName, Builder extends Where<Table>>(tableName: Table, builder: Builder, isServerOnly?: boolean): Where<Table, Condition>;
 export declare function where<Table extends TableName, Builder extends Where = Where<Table>>(builder: Builder): Where<Table, Condition>;
 export declare function getWhereTableName(where: Where): string | undefined;

package/types/where.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"where.d.ts","sourceRoot":"","sources":["../src/where.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAqB,MAAM,gBAAgB,CAAA;AAElE,wBAAgB,KAAK,CAAC,KAAK,SAAS,SAAS,EAAE,OAAO,SAAS,KAAK,CAAC,KAAK,CAAC,EACzE,SAAS,EAAE,KAAK,EAChB,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,OAAO,GACrB,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;AAE1B,wBAAgB,KAAK,CAAC,KAAK,SAAS,SAAS,EAAE,OAAO,SAAS,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EACjF,OAAO,EAAE,OAAO,GACf,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;AA4C1B,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,sBAE7C;AAGD,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,SAAS,CAE3D"}
+{"version":3,"file":"where.d.ts","sourceRoot":"","sources":["../src/where.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAqB,MAAM,gBAAgB,CAAA;AAMlE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,QAErD;AAED,wBAAgB,KAAK,CAAC,KAAK,SAAS,SAAS,EAAE,OAAO,SAAS,KAAK,CAAC,KAAK,CAAC,EACzE,SAAS,EAAE,KAAK,EAChB,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,OAAO,GACrB,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;AAE1B,wBAAgB,KAAK,CAAC,KAAK,SAAS,SAAS,EAAE,OAAO,SAAS,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EACjF,OAAO,EAAE,OAAO,GACf,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;AA4C1B,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,sBAE7C;AAGD,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,SAAS,CAE3D"}