over-zero 0.0.0 → 0.0.2

package/dist/esm/mutations.mjs

@@ -0,0 +1,27 @@
+function mutations(table, permissions, mutations2) {
+  if (permissions) {
+    const tableName = table.schema.name,
+      createCRUDMutation = action => async (ctx, obj) => {
+        const runServerPermissionCheck = async () => {
+          ctx.didCanPermissionsRun || process.env.VITE_ENVIRONMENT === "ssr" && (await ctx.can(permissions, action, obj));
+        };
+        action !== "insert" && (await runServerPermissionCheck());
+        const existing = mutations2?.[action];
+        existing ? await existing(ctx, obj) : await ctx.tx.mutate[tableName][action](obj), action === "insert" && (await runServerPermissionCheck());
+      },
+      crudMutations = {
+        insert: createCRUDMutation("insert"),
+        update: createCRUDMutation("update"),
+        delete: createCRUDMutation("delete"),
+        upsert: createCRUDMutation("upsert")
+      };
+    return {
+      ...mutations2,
+      // overwrite regular mutations but call them if they are defined by user
+      ...crudMutations
+    };
+  }
+  return table;
+}
+export { mutations };
+//# sourceMappingURL=mutations.mjs.map

package/dist/esm/mutations.mjs.map

@@ -0,0 +1 @@
+{"version":3,"names":["mutations","table","permissions","mutations2","tableName","schema","name","createCRUDMutation","action","ctx","obj","runServerPermissionCheck","didCanPermissionsRun","process","env","VITE_ENVIRONMENT","can","existing","tx","mutate","crudMutations","insert","update","delete","upsert"],"sources":["../../src/mutations.ts"],"sourcesContent":[null],"mappings":"AAoEO,SAASA,UAGdC,KAAA,EAA0BC,WAAA,EAAqBC,UAAA,EAAkC;EACjF,IAAID,WAAA,EAAa;IACf,MAAME,SAAA,GAAaH,KAAA,CAAgBI,MAAA,CAAOC,IAAA;MAEpCC,kBAAA,GAAsBC,MAAA,IACnB,OAAOC,GAAA,EAAqBC,GAAA,KAAa;QAS9C,MAAMC,wBAAA,GAA2B,MAAAA,CAAA,KAAY;UACvCF,GAAA,CAAIG,oBAAA,IAMJC,OAAA,CAAQC,GAAA,CAAIC,gBAAA,KAAqB,UACnC,MAAMN,GAAA,CAAIO,GAAA,CAAId,WAAA,EAAaM,MAAA,EAAQE,GAAG;QAE1C;QAEIF,MAAA,KAAW,aACb,MAAMG,wBAAA,CAAyB;QAIjC,MAAMM,QAAA,GAAWd,UAAA,GAAYK,MAAM;QAE/BS,QAAA,GACF,MAAMA,QAAA,CAASR,GAAA,EAAKC,GAAG,IAGvB,MAAMD,GAAA,CAAIS,EAAA,CAAGC,MAAA,CAAOf,SAAsB,EAAGI,MAAM,EAAEE,GAAG,GAGtDF,MAAA,KAAW,aACb,MAAMG,wBAAA,CAAyB;MAEnC;MAGIS,aAAA,GAAoC;QACxCC,MAAA,EAAQd,kBAAA,CAAmB,QAAQ;QACnCe,MAAA,EAAQf,kBAAA,CAAmB,QAAQ;QACnCgB,MAAA,EAAQhB,kBAAA,CAAmB,QAAQ;QACnCiB,MAAA,EAAQjB,kBAAA,CAAmB,QAAQ;MACrC;IAEA,OAAO;MACL,GAAGJ,UAAA;MAAA;MAEH,GAAGiB;IACL;EACF;EAGA,OAAOnB,KAAA;AACT","ignoreList":[]}

package/dist/esm/mutations.native.js

@@ -0,0 +1,29 @@
+function mutations(table, permissions, mutations2) {
+  if (permissions) {
+    var tableName = table.schema.name,
+      createCRUDMutation = function (action) {
+        return async function (ctx, obj) {
+          var runServerPermissionCheck = async function () {
+            ctx.didCanPermissionsRun || process.env.VITE_ENVIRONMENT === "ssr" && (await ctx.can(permissions, action, obj));
+          };
+          action !== "insert" && (await runServerPermissionCheck());
+          var existing = mutations2?.[action];
+          existing ? await existing(ctx, obj) : await ctx.tx.mutate[tableName][action](obj), action === "insert" && (await runServerPermissionCheck());
+        };
+      },
+      crudMutations = {
+        insert: createCRUDMutation("insert"),
+        update: createCRUDMutation("update"),
+        delete: createCRUDMutation("delete"),
+        upsert: createCRUDMutation("upsert")
+      };
+    return {
+      ...mutations2,
+      // overwrite regular mutations but call them if they are defined by user
+      ...crudMutations
+    };
+  }
+  return table;
+}
+export { mutations };
+//# sourceMappingURL=mutations.native.js.map

package/dist/esm/mutations.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["mutations","table","permissions","mutations2","tableName","schema","name","createCRUDMutation","action","ctx","obj","runServerPermissionCheck","didCanPermissionsRun","process","env","VITE_ENVIRONMENT","can","existing","tx","mutate","crudMutations","insert","update","delete","upsert"],"sources":["../../src/mutations.ts"],"sourcesContent":[null],"mappings":"AAoEO,SAASA,UAGdC,KAAA,EAA0BC,WAAA,EAAqBC,UAAA,EAAkC;EACjF,IAAID,WAAA,EAAa;IACf,IAAAE,SAAM,GAAAH,KAAa,CAAAI,MAAgB,CAAAC,IAAO;MAAAC,kBAEpC,YAAAA,CAAsBC,MACnB;QASL,OAAM,gBAAAC,GAAA,EAAAC,GAAA;UACA,IAAIC,wBAMJ,kBAAAA,CAAA,EAAY;YAGlBF,GAAA,CAAAG,oBAAA,IAAAC,OAAA,CAAAC,GAAA,CAAAC,gBAAA,qBAAAN,GAAA,CAAAO,GAAA,CAAAd,WAAA,EAAAM,MAAA,EAAAE,GAAA;UAEI;UAKJF,MAAM,aAAW,WAAYG,wBAAM;UAE/B,IAAAM,QACF,GAAMd,UAAS,GAAAK,MAAQ;UAYvBS,QAAA,SAAoCA,QAAA,CAAAR,GAAA,EAAAC,GAAA,UAAAD,GAAA,CAAAS,EAAA,CAAAC,MAAA,CAAAf,SAAA,EAAAI,MAAA,EAAAE,GAAA,GAAAF,MAAA,wBAAAG,wBAAA;QACxC;MAAmC;MACnCS,aAAQ;QACRC,MAAA,EAAQd,kBAAA,CAAmB,QAAQ;QACnCe,MAAA,EAAQf,kBAAA,CAAmB,QAAQ;QACrCgB,MAAA,EAAAhB,kBAAA;QAEAiB,MAAO,EAAAjB,kBAAA;MAAA;IACF;MAEH,GAAGJ,UAAA;MACL;MACF,GAAAiB;IAGA;EACF","ignoreList":[]}

package/dist/esm/server.js

@@ -0,0 +1,2 @@
+export * from "./createZeroServer";
+//# sourceMappingURL=server.js.map

package/dist/esm/server.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../src/server.ts"],
+  "mappings": "AAAA,cAAc;",
+  "names": []
+}

package/dist/esm/server.mjs

@@ -0,0 +1,2 @@
+export * from "./createZeroServer.mjs";
+//# sourceMappingURL=server.mjs.map

package/dist/esm/server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sources":["../../src/server.ts"],"sourcesContent":[null],"mappings":"AAAA,cAAc","ignoreList":[]}

package/dist/esm/server.native.js

@@ -0,0 +1,2 @@
+export * from "./createZeroServer.native.js";
+//# sourceMappingURL=server.native.js.map

package/dist/esm/server.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sources":["../../src/server.ts"],"sourcesContent":[null],"mappings":"AAAA,cAAc","ignoreList":[]}

package/dist/esm/where.js

@@ -0,0 +1,12 @@
+function where(a, b) {
+  return b && WhereTableNameMap.set(b, a), b || a;
+}
+const WhereTableNameMap = /* @__PURE__ */ new WeakMap();
+function getWhereTableName(where2) {
+  return WhereTableNameMap.get(where2);
+}
+export {
+  getWhereTableName,
+  where
+};
+//# sourceMappingURL=where.js.map

package/dist/esm/where.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../src/where.ts"],
+  "mappings": "AAWO,SAAS,MACd,GACA,GACS;AACT,SAAI,KACF,kBAAkB,IAAI,GAAG,CAAU,GAE7B,KAAK;AACf;AAIA,MAAM,oBAAoB,oBAAI,QAA0B;AAEjD,SAAS,kBAAkBA,QAAc;AAC9C,SAAO,kBAAkB,IAAIA,MAAK;AACpC;",
+  "names": ["where"]
+}

package/dist/esm/where.mjs

@@ -0,0 +1,9 @@
+function where(a, b) {
+  return b && WhereTableNameMap.set(b, a), b || a;
+}
+const WhereTableNameMap = /* @__PURE__ */new WeakMap();
+function getWhereTableName(where2) {
+  return WhereTableNameMap.get(where2);
+}
+export { getWhereTableName, where };
+//# sourceMappingURL=where.mjs.map

package/dist/esm/where.mjs.map

@@ -0,0 +1 @@
+{"version":3,"names":["where","a","b","WhereTableNameMap","set","WeakMap","getWhereTableName","where2","get"],"sources":["../../src/where.ts"],"sourcesContent":[null],"mappings":"AAWO,SAASA,MACdC,CAAA,EACAC,CAAA,EACS;EACT,OAAIA,CAAA,IACFC,iBAAA,CAAkBC,GAAA,CAAIF,CAAA,EAAGD,CAAU,GAE7BC,CAAA,IAAKD,CAAA;AACf;AAIA,MAAME,iBAAA,GAAoB,mBAAIE,OAAA,CAA0B;AAEjD,SAASC,kBAAkBC,MAAA,EAAc;EAC9C,OAAOJ,iBAAA,CAAkBK,GAAA,CAAID,MAAK;AACpC","ignoreList":[]}

package/dist/esm/where.native.js

@@ -0,0 +1,9 @@
+function where(a, b) {
+  return b && WhereTableNameMap.set(b, a), b || a;
+}
+var WhereTableNameMap = /* @__PURE__ */new WeakMap();
+function getWhereTableName(where2) {
+  return WhereTableNameMap.get(where2);
+}
+export { getWhereTableName, where };
+//# sourceMappingURL=where.native.js.map

package/dist/esm/where.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["where","a","b","WhereTableNameMap","set","WeakMap","getWhereTableName","where2","get"],"sources":["../../src/where.ts"],"sourcesContent":[null],"mappings":"AAWO,SAASA,MACdC,CAAA,EACAC,CAAA,EACS;EACT,OAAIA,CAAA,IACFC,iBAAA,CAAkBC,GAAA,CAAIF,CAAA,EAAGD,CAAU,GAE7BC,CAAA,IAAKD,CAAA;AACf;AAIA,IAAAE,iBAAM,kBAAoB,IAAAE,OAAI;AAEvB,SAASC,kBAAkBC,MAAA,EAAc;EAC9C,OAAOJ,iBAAA,CAAkBK,GAAA,CAAID,MAAK;AACpC","ignoreList":[]}

package/package.json

@@ -1,19 +1,20 @@
 {
   "name": "over-zero",
-  "version": "0.0.0",
+  "version": "0.0.2",
   "sideEffects": false,
   "source": "src/index.ts",
-  "types": "./types/index.d.ts",
   "main": "dist/cjs",
   "module": "dist/esm",
+  "type": "module",
+  "types": "./src/index.ts",
   "files": [
     "src",
     "types",
     "dist"
   ],
   "scripts": {
-    "build": "tamagui-build",
-    "watch": "tamagui-build --watch",
+    "build": "tamagui-build --skip-types",
+    "watch": "tamagui-build --skip-types --watch",
     "lint": "biome check src",
     "lint:fix": "biome check --write src",
     "clean": "tamagui-build clean",
@@ -26,14 +27,19 @@
         "import": "./dist/esm/index.native.js",
         "require": "./dist/cjs/index.native.js"
       },
-      "types": "./types/index.d.ts",
+      "types": "./src/index.ts",
       "import": "./dist/esm/index.mjs",
       "require": "./dist/cjs/index.cjs",
       "default": "./dist/cjs/index.native.js"
+    },
+    "./server": {
+      "types": "./src/server.ts",
+      "import": "./dist/esm/server.mjs",
+      "require": "./dist/cjs/server.cjs"
     }
   },
   "dependencies": {
-    "@vxrn/helpers": "workspace:*"
+    "@vxrn/helpers": "0.0.0"
   },
   "peerDependencies": {
     "@rocicorp/zero": "*",

package/src/createPermissions.ts

@@ -2,66 +2,26 @@ import type {
   Condition,
   ExpressionBuilder,
   Query,
-  Transaction,
   Schema as ZeroSchema,
 } from '@rocicorp/zero'
 import { ANYONE_CAN, definePermissions } from '@rocicorp/zero'
 import { ensure, EnsureError, objectEntries } from '@vxrn/helpers'
-import type { AuthData } from 'start/types'
-// import { models } from '~/data/models'
-// import { objectEntries } from '~/helpers/types/object'
+import { runWithContext } from './helpers/context'
 import { prettyFormatZeroQuery } from './helpers/prettyFormatZeroQuery'
-import type { MutatorContext, Where } from './types'
+import type { AuthData, MutatorContext, TableName, Transaction, Where } from './types'
+import { getWhereTableName } from './where'
 
-// TODO this will go away soon if we can get a good sync queries setup
-
-export function createPermissions<Schema extends ZeroSchema, TableName extends string>({
+export function createPermissions<Schema extends ZeroSchema>({
+  environment,
   schema,
+  models,
   getContext,
 }: {
+  environment: 'client' | 'server'
   schema: Schema
+  models: any
   getContext: () => MutatorContext
 }) {
-  runEnvironmentSafetyCheck()
-
-  // we don't want flickers as you move around and these queries are re-run
-  // and things generally aren't changing with permissions rapidly, so lets
-  // cache the last results and use that when first rendering, they will
-  // always update once the query resolves
-
-  // Where defaults to letting you return basically anything because we want to allow it to be usable
-  // flexibly, one example is for permissions where you can return an Object with multiple wheres as values
-  // for example, PermissionsWhere below
-
-  function where<Table extends TableName, Builder extends Where = Where<Table>>(
-    tableName: Table,
-    builder: Builder
-  ): Builder
-
-  function where<Table extends TableName, Builder extends Where = Where<Table>>(
-    builder: Builder
-  ): Builder
-
-  function where<Table extends TableName, Builder extends Where = Where<Table>>(
-    a: Table | Builder,
-    b?: Builder
-  ): Builder {
-    if (b) {
-      WhereTableNameMap.set(b, a as Table)
-    }
-    return (b || a) as any
-  }
-
-  // permissions where:
-
-  const WhereTableNameMap = new WeakMap<Where, TableName>()
-
-  function getWhereTableName(where: Where) {
-    return WhereTableNameMap.get(where)
-  }
-
-  // example of a custom where we use for permissions
-
   type PermissionPresetActions =
     | 'read'
     | 'write'
@@ -105,6 +65,11 @@ export function createPermissions<Schema extends ZeroSchema, TableName extends s
     }
 
     const tableSchema = schema.tables[tableName]
+
+    if (!tableSchema) {
+      throw new Error(`No schema?`)
+    }
+
     const primaryKeys = tableSchema.primaryKey
     const permissionQueryBuilder = permissionWhere(eb, authData)
     const fallbackAction = fallbackActions[action]
@@ -145,8 +110,8 @@ export function createPermissions<Schema extends ZeroSchema, TableName extends s
       throw new Error(`Must use where('table') style where to pass to can()`)
     }
 
-    // on client we always allow!
-    if (process.env.VITE_ENVIRONMENT === 'ssr') {
+    // on client we always allow! we only check on server (like zero does)
+    if (environment === 'server') {
       await ensurePermission(
         ctx.tx,
         ctx.authData,
@@ -159,13 +124,11 @@ export function createPermissions<Schema extends ZeroSchema, TableName extends s
     }
   }
 
-  type TX = Transaction<Schema>
-
   async function ensurePermission<
     PW extends PermissionsWhere,
     Action extends keyof ReturnType<PW>,
   >(
-    tx: TX,
+    tx: Transaction,
     authData: AuthData | null,
     tableName: TableName,
     where: Where,
@@ -179,6 +142,7 @@ export function createPermissions<Schema extends ZeroSchema, TableName extends s
 
     const action = String(actionIn)
     const name = `${tableName}.${action}`
+    // @ts-expect-error TODO its the right type but need to figure out better way to get TableName
     const queryBase = tx.query[tableName] as Query<any, any>
     let query: Query<any, any, any> | null = null
 
@@ -250,32 +214,8 @@ export function createPermissions<Schema extends ZeroSchema, TableName extends s
   })
 
   return {
-    where,
     can,
     buildPermissionQuery,
     readPermissions,
   }
 }
-
-// this is just so we have some assurance that we aren't skipping permissions
-// checks due to bad VITE_ENVIRONMENT variable
-function runEnvironmentSafetyCheck() {
-  if (typeof document !== 'undefined') {
-    // web!
-  } else if (typeof navigator !== 'undefined' && navigator.product === 'ReactNative') {
-    // react-native!
-  } else {
-    // server!
-    if (process.env.VITE_ENVIRONMENT !== 'ssr') {
-      console.error(`❌❌❌❌
-
-ERROR: VITE_ENVIRONMENT is not set to "ssr" on server, which means permissions checks won't run when they should
-This is makes Zero entirely insecure and needs to be fixed immediately.
-
-This is likely a One framework issue, unless the user Vite config is overwriting the value.
-One automatically sets this value.
-        
-        `)
-    }
-  }
-}

package/src/createZeroClient.tsx

@@ -1,45 +1,47 @@
-import type { Row, ZeroOptions, Schema as ZeroSchema } from '@rocicorp/zero'
+import type { Row, Zero, ZeroOptions, Schema as ZeroSchema } from '@rocicorp/zero'
 import { useZero, ZeroProvider, useQuery as zeroUseQuery } from '@rocicorp/zero/react'
-import { createLocalStorage, mapObject } from '@vxrn/helpers'
+import { createEmitter, createLocalStorage, mapObject } from '@vxrn/helpers'
 import { createContext, use, useMemo, type ReactNode } from 'react'
 import { createPermissions } from './createPermissions'
 import { context } from './helpers/context'
 import { createMutators } from './helpers/createMutators'
 import { prettyFormatZeroQuery } from './helpers/prettyFormatZeroQuery'
 import { useZeroDebug } from './helpers/useZeroDebug'
-import { zeroEmitter } from './helpers/zeroEmitter'
-import type { AuthData } from './types'
-
-export function createZero<Schema extends ZeroSchema>({
-  schema,
-  models,
-  disable,
-}: {
-  schema: Schema
-  models: any
-  disable?: boolean
-}) {
-  // TODO
-  type TableName = string
-  type Mutators = any // typeof mutators
-  type ZeroInstance = ReturnType<typeof useZero<Schema, Mutators>>
+
+import type { AuthData, GenericModels, GetZeroMutators, ZeroEvent } from './types'
+
+export function createZeroClient<
+  Schema extends ZeroSchema,
+  Models extends GenericModels,
+>({ schema, models, disable }: { schema: Schema; models: Models; disable?: boolean }) {
+  type ZeroMutators = GetZeroMutators<Models>
+  type ZeroInstance = Zero<Schema, ZeroMutators>
+  type TableName = keyof ZeroInstance['query']
 
   const modelPermissions = mapObject(models, (val) => val.permissions) as {
-    [K in keyof typeof models]: (typeof models)[K]['permissions']
+    [K in TableName]: K extends keyof Models ? Models[K]['permissions'] : never
   }
 
-  const permissionsHelpers = createPermissions<Schema, TableName>({
+  const permissionsHelpers = createPermissions<Schema>({
     schema,
+    models,
     getContext: context,
+    environment: 'client',
   })
 
   const permissionCache = createLocalStorage<string, boolean>('permissions-cache', {
     storageLimit: 24,
   })
 
-  const AuthDataContext = createContext<AuthData>(null)
+  const zeroEvents = createEmitter<ZeroEvent | null>('zero', null)
+
+  const AuthDataContext = createContext<AuthData>({} as AuthData)
   const useAuthData = () => use(AuthDataContext)
 
+  // we don't want flickers as you move around and these queries are re-run
+  // and things generally aren't changing with permissions rapidly, so lets
+  // cache the last results and use that when first rendering, they will
+  // always update once the query resolves
   function usePermission<
     K extends TableName,
     Action extends 'insert' | 'update' | 'delete' | 'select',
@@ -51,7 +53,7 @@ export function createZero<Schema extends ZeroSchema>({
     debug = false
   ): boolean | null {
     // we fallback to just table.action, to avoid flickers for now
-    const keyBase = `${table}${action}`
+    const keyBase = `${String(table)}${action}`
     const key = `${keyBase}${typeof objOrId === 'string' ? objOrId : JSON.stringify(objOrId)}`
     const cacheVal = permissionCache.get(key) ?? permissionCache.get(keyBase)
     const authData = useAuthData()
@@ -127,7 +129,7 @@ export function createZero<Schema extends ZeroSchema>({
     children,
     authData,
     ...props
-  }: Omit<ZeroOptions<Schema, Mutators>, 'schema' | 'mutators'> & {
+  }: Omit<ZeroOptions<Schema, ZeroMutators>, 'schema' | 'mutators'> & {
     children: ReactNode
     authData?: any
   }) => {
@@ -148,10 +150,10 @@ export function createZero<Schema extends ZeroSchema>({
       <AuthDataContext.Provider value={authData}>
         <ZeroProvider
           schema={schema}
-          kvStore={'mem'}
+          kvStore="mem"
           onError={(error) => {
             console.error(`Zero Error:`, error)
-            zeroEmitter.emit({
+            zeroEvents.emit({
               type: 'error',
               message: error,
             })
@@ -167,7 +169,7 @@ export function createZero<Schema extends ZeroSchema>({
   }
 
   const SetZeroInstance = () => {
-    const zero = useZero<Schema, Mutators>()
+    const zero = useZero<Schema, ZeroMutators>()
 
     // TODO last hack zero wants us to use useZero but its a big migration
     // and has some downsides (global zero import leads to simpler code)
@@ -183,6 +185,7 @@ export function createZero<Schema extends ZeroSchema>({
   }
 
   return {
+    zeroEvents,
     ProvideZero,
     useQuery,
     usePermission,

package/src/createZeroServer.ts

@@ -1,46 +1,33 @@
 import type { Schema as ZeroSchema } from '@rocicorp/zero'
 import type { TransactionProviderInput } from '@rocicorp/zero/pg'
-import { PostgresJSConnection } from '@rocicorp/zero/pg'
+import { PostgresJSConnection, PushProcessor } from '@rocicorp/zero/pg'
 import { ZQLDatabase } from '@rocicorp/zero/server'
-import postgres from 'postgres'
-// import { context, isInZeroMutation } from 'src/context'
-import type { AuthData } from './types'
-// import { type Mutators, createMutators } from '~/data/helpers/createMutators'
-// import { schema } from '~/data/schema'
-// import { createServerActions } from '~/data/server/createServerActions'
-// import type { TX } from '~/data/types'
-import { PushProcessor } from '@rocicorp/zero/pg'
 import { assertString, randomId } from '@vxrn/helpers'
+import postgres from 'postgres'
+import { createPermissions } from './createPermissions'
+import { context, isInZeroMutation } from './helpers/context'
 import { createMutators } from './helpers/createMutators'
-// import type { Endpoint } from 'one'
-// import type { AuthData } from 'start/data'
-// import { getAuthHeader, NotAuthenticatedError } from '~/auth/validateAuthHeader'
-// import { randomId } from '@vxrn/helpers'
-// import { createMutators } from '~/data/helpers/createMutators'
-// import { createServerActions } from '~/data/server/createServerActions'
-// import { GenericTransaction } from './types'
-
-// this sets up custom server-side mutators
-// see: https://zero.rocicorp.dev/docs/custom-mutators
+import type {
+  AsyncAction,
+  AuthData,
+  GenericModels,
+  GetZeroMutators,
+  Transaction,
+} from './types'
 
 export function createZeroServer<
   Schema extends ZeroSchema,
-  ServerActions extends Record<string, any>,
+  Models extends GenericModels,
+  ServerActions extends Record<string, unknown>,
 >({
   createServerActions,
   schema,
   models,
-  disable,
 }: {
   schema: Schema
-  models: any
-  createServerActions: (authData: AuthData | null) => ServerActions
-  disable?: boolean
+  models: Models
+  createServerActions: () => ServerActions
 }) {
-  // TODO
-  type TX = any
-  type Mutators = any
-
   const dbString = assertString(process.env.ZERO_UPSTREAM_DB)
 
   const zeroServerDatabase = new ZQLDatabase(
@@ -48,6 +35,13 @@ export function createZeroServer<
     schema
   )
 
+  const permissions = createPermissions<Schema>({
+    environment: 'server',
+    schema,
+    models,
+    getContext: context,
+  })
+
   const processor = new PushProcessor(zeroServerDatabase)
 
   const handleMutationRequest = async ({
@@ -55,22 +49,24 @@ export function createZeroServer<
     request,
     skipAsyncTasks,
   }: {
-    authData: AuthData
+    authData: AuthData | null
     request: Request
     skipAsyncTasks?: boolean
   }) => {
     // since mutations do DB work in transaction, avoid any async tasks during
-    const asyncTasks: Array<() => Promise<void>> = []
+    const asyncTasks: AsyncAction[] = []
+
+    const mutators = createMutators({
+      asyncTasks,
+      can: permissions.can,
+      createServerActions,
+      environment: 'server',
+      models,
+      authData,
+    })
 
-    const response = await processor.process(
-      createMutators({
-        environment: 'server',
-        asyncTasks,
-        authData,
-        createServerActions,
-      }),
-      request
-    )
+    // @ts-expect-error TODO regressed moving into package
+    const response = await processor.process(mutators, request)
 
     // now finish
     if (!skipAsyncTasks && asyncTasks.length) {
@@ -92,12 +88,13 @@ export function createZeroServer<
   }
 
   const serverMutate = async (
-    run: (tx: TX, mutators: Mutators) => Promise<void>,
+    run: (tx: Transaction, mutators: GetZeroMutators<Models>) => Promise<void>,
     authData?: Pick<AuthData, 'email' | 'id'> & Partial<AuthData>
   ) => {
     const asyncTasks: Array<() => Promise<void>> = []
 
     const mutators = createMutators({
+      models,
       environment: 'server',
       asyncTasks,
       authData: {
@@ -107,6 +104,7 @@ export function createZeroServer<
         ...authData,
       },
       createServerActions,
+      can: permissions.can,
     })
 
     await serverTransaction(async (tx) => {
@@ -129,15 +127,17 @@ export function createZeroServer<
   }
 
   async function serverTransaction<
-    CB extends (tx: TX) => Promise<any>,
-    Returns extends CB extends (tx: TX) => Promise<infer X> ? X : never,
+    CB extends (tx: Transaction) => Promise<any>,
+    Returns extends CB extends (tx: Transaction) => Promise<infer X> ? X : never,
   >(query: CB): Promise<Returns> {
     try {
       if (isInZeroMutation()) {
         const { tx } = context()
         return await query(tx)
       }
-      return (await zeroServerDatabase.transaction(query, dummyTransactionInput)) as any
+      // @ts-expect-error TODO regressed moving into package
+      const output = await zeroServerDatabase.transaction(query, dummyTransactionInput)
+      return output as any
     } catch (err) {
       console.error(`Error running serverTransaction(): ${err}`)
       throw err