@rocicorp/zero 0.25.0 → 0.26.0-canary.0

package/out/zero-cache/src/scripts/deploy-permissions.js

@@ -1,151 +1,164 @@
 import "../../../shared/src/dotenv.js";
-import { writeFile } from 'node:fs/promises';
-import { ident as id, literal } from 'pg-format';
-import { colorConsole, createLogContext } from "../../../shared/src/logging.js";
+import { writeFile } from "node:fs/promises";
+import { ident, literal } from "pg-format";
+import { createLogContext, colorConsole } from "../../../shared/src/logging.js";
 import { parseOptions } from "../../../shared/src/options.js";
 import { difference } from "../../../shared/src/set-utils.js";
 import { mapCondition } from "../../../zero-protocol/src/ast.js";
-import {} from "../../../zero-schema/src/compiled-permissions.js";
+import "../../../zero-schema/src/compiled-permissions.js";
 import { validator } from "../../../zero-schema/src/name-mapper.js";
 import { ZERO_ENV_VAR_PREFIX } from "../config/zero-config.js";
 import { getPublicationInfo } from "../services/change-source/pg/schema/published.js";
-import { ensureGlobalTables, SHARD_CONFIG_TABLE, } from "../services/change-source/pg/schema/shard.js";
+import { ensureGlobalTables, SHARD_CONFIG_TABLE } from "../services/change-source/pg/schema/shard.js";
 import { liteTableName } from "../types/names.js";
 import { pgClient } from "../types/pg.js";
-import { appSchema, getShardID, upstreamSchema } from "../types/shards.js";
-import { deployPermissionsOptions, loadSchemaAndPermissions, } from "./permissions.js";
+import { getShardID, appSchema, upstreamSchema } from "../types/shards.js";
+import { deployPermissionsOptions, loadSchemaAndPermissions } from "./permissions.js";
 const config = parseOptions(deployPermissionsOptions, {
-    argv: process.argv.slice(2),
-    envNamePrefix: ZERO_ENV_VAR_PREFIX,
+  argv: process.argv.slice(2),
+  envNamePrefix: ZERO_ENV_VAR_PREFIX
 });
 const shard = getShardID(config);
 const app = appSchema(shard);
 const lc = createLogContext(config);
 async function validatePermissions(db, permissions) {
-    const schema = upstreamSchema(shard);
-    // Check if the shardConfig table has been initialized.
-    const result = await db `
+  const schema = upstreamSchema(shard);
+  const result = await db`
     SELECT relname FROM pg_class
       JOIN pg_namespace ON relnamespace = pg_namespace.oid
       WHERE nspname = ${schema} AND relname = ${SHARD_CONFIG_TABLE}`;
-    if (result.length === 0) {
-        colorConsole.warn(`zero-cache has not yet initialized the upstream database.\n` +
-            `Deploying ${app} permissions without validating against published tables/columns.`);
-        return;
-    }
-    // Get the publications for the shard
-    const config = await db `
-    SELECT publications FROM ${db(schema + '.' + SHARD_CONFIG_TABLE)}
+  if (result.length === 0) {
+    colorConsole.warn(
+      `zero-cache has not yet initialized the upstream database.
+Deploying ${app} permissions without validating against published tables/columns.`
+    );
+    return;
+  }
+  const config2 = await db`
+    SELECT publications FROM ${db(schema + "." + SHARD_CONFIG_TABLE)}
   `;
-    if (config.length === 0) {
-        colorConsole.warn(`zero-cache has not yet initialized the upstream database.\n` +
-            `Deploying ${app} permissions without validating against published tables/columns.`);
-        return;
-    }
-    colorConsole.info(`Validating permissions against tables and columns published for "${app}".`);
-    const [{ publications: shardPublications }] = config;
-    const { tables, publications } = await getPublicationInfo(db, shardPublications);
-    const pubnames = publications.map(p => p.pubname);
-    const missing = difference(new Set(shardPublications), new Set(pubnames));
-    if (missing.size) {
-        colorConsole.warn(`Upstream is missing expected publications "${[...missing]}".\n` +
-            `You may need to re-initialize your replica.\n` +
-            `Deploying ${app} permissions without validating against published tables/columns.`);
-        return;
-    }
-    const tablesToColumns = new Map(tables.map(t => [liteTableName(t), Object.keys(t.columns)]));
-    const validate = validator(tablesToColumns);
-    try {
-        for (const [table, perms] of Object.entries(permissions.tables)) {
-            const validateRule = ([_, cond]) => {
-                mapCondition(cond, table, validate);
-            };
-            const validateAsset = (asset) => {
-                asset?.select?.forEach(validateRule);
-                asset?.delete?.forEach(validateRule);
-                asset?.insert?.forEach(validateRule);
-                asset?.update?.preMutation?.forEach(validateRule);
-                asset?.update?.postMutation?.forEach(validateRule);
-            };
-            validateAsset(perms.row);
-            if (perms.cell) {
-                Object.values(perms.cell).forEach(validateAsset);
-            }
-        }
-    }
-    catch (e) {
-        failWithMessage(String(e));
+  if (config2.length === 0) {
+    colorConsole.warn(
+      `zero-cache has not yet initialized the upstream database.
+Deploying ${app} permissions without validating against published tables/columns.`
+    );
+    return;
+  }
+  colorConsole.info(
+    `Validating permissions against tables and columns published for "${app}".`
+  );
+  const [{ publications: shardPublications }] = config2;
+  const { tables, publications } = await getPublicationInfo(
+    db,
+    shardPublications
+  );
+  const pubnames = publications.map((p) => p.pubname);
+  const missing = difference(new Set(shardPublications), new Set(pubnames));
+  if (missing.size) {
+    colorConsole.warn(
+      `Upstream is missing expected publications "${[...missing]}".
+You may need to re-initialize your replica.
+Deploying ${app} permissions without validating against published tables/columns.`
+    );
+    return;
+  }
+  const tablesToColumns = new Map(
+    tables.map((t) => [liteTableName(t), Object.keys(t.columns)])
+  );
+  const validate = validator(tablesToColumns);
+  try {
+    for (const [table, perms] of Object.entries(permissions?.tables ?? {})) {
+      const validateRule = ([_, cond]) => {
+        mapCondition(cond, table, validate);
+      };
+      const validateAsset = (asset) => {
+        asset?.select?.forEach(validateRule);
+        asset?.delete?.forEach(validateRule);
+        asset?.insert?.forEach(validateRule);
+        asset?.update?.preMutation?.forEach(validateRule);
+        asset?.update?.postMutation?.forEach(validateRule);
+      };
+      validateAsset(perms.row);
+      if (perms.cell) {
+        Object.values(perms.cell).forEach(validateAsset);
+      }
     }
+  } catch (e) {
+    failWithMessage(String(e));
+  }
 }
 function failWithMessage(msg) {
-    colorConsole.error(msg);
-    colorConsole.info('\nUse --force to deploy at your own risk.\n');
-    process.exit(-1);
+  colorConsole.error(msg);
+  colorConsole.info("\nUse --force to deploy at your own risk.\n");
+  process.exit(-1);
 }
 async function deployPermissions(upstreamURI, permissions, force) {
-    const db = pgClient(lc, upstreamURI);
-    const { host, port } = db.options;
-    colorConsole.debug(`Connecting to upstream@${host}:${port}`);
-    try {
-        await ensureGlobalTables(db, shard);
-        const { hash, changed } = await db.begin(async (tx) => {
-            if (force) {
-                colorConsole.warn(`--force specified. Skipping validation.`);
-            }
-            else {
-                await validatePermissions(tx, permissions);
-            }
-            const { appID } = shard;
-            colorConsole.info(`Deploying permissions for --app-id "${appID}" to upstream@${db.options.host}`);
-            const [{ hash: beforeHash }] = await tx `
+  const db = pgClient(lc, upstreamURI);
+  const { host, port } = db.options;
+  colorConsole.debug(`Connecting to upstream@${host}:${port}`);
+  try {
+    await ensureGlobalTables(db, shard);
+    const { hash, changed } = await db.begin(async (tx) => {
+      if (force) {
+        colorConsole.warn(`--force specified. Skipping validation.`);
+      } else {
+        await validatePermissions(tx, permissions);
+      }
+      const { appID } = shard;
+      colorConsole.info(
+        `Deploying permissions for --app-id "${appID}" to upstream@${db.options.host}`
+      );
+      const [{ hash: beforeHash }] = await tx`
         SELECT hash from ${tx(app)}.permissions`;
-            const [{ hash }] = await tx `
+      const [{ hash: hash2 }] = await tx`
         UPDATE ${tx(app)}.permissions SET ${db({ permissions })} RETURNING hash`;
-            return { hash: hash.substring(0, 7), changed: beforeHash !== hash };
-        });
-        if (changed) {
-            colorConsole.info(`Deployed new permissions (hash=${hash})`);
-        }
-        else {
-            colorConsole.info(`Permissions unchanged (hash=${hash})`);
-        }
-    }
-    finally {
-        await db.end();
+      return { hash: hash2.substring(0, 7), changed: beforeHash !== hash2 };
+    });
+    if (changed) {
+      colorConsole.info(`Deployed new permissions (hash=${hash})`);
+    } else {
+      colorConsole.info(`Permissions unchanged (hash=${hash})`);
     }
+  } finally {
+    await db.end();
+  }
 }
 async function writePermissionsFile(perms, file, format) {
-    const contents = format === 'sql'
-        ? `UPDATE ${id(app)}.permissions SET permissions = ${literal(JSON.stringify(perms))};`
-        : JSON.stringify(perms, null, format === 'pretty' ? 2 : 0);
-    await writeFile(file, contents);
-    colorConsole.info(`Wrote ${format} permissions to ${config.output.file}`);
+  const contents = format === "sql" ? `UPDATE ${ident(app)}.permissions SET permissions = ${literal(
+    JSON.stringify(perms)
+  )};` : JSON.stringify(perms, null, format === "pretty" ? 2 : 0);
+  await writeFile(file, contents);
+  colorConsole.info(`Wrote ${format} permissions to ${config.output.file}`);
 }
 const ret = await loadSchemaAndPermissions(config.schema.path, true);
-if (!ret) {
-    colorConsole.warn(`No schema found at ${config.schema.path}, so could not deploy ` +
-        `permissions. Replicating data, but no tables will be syncable. ` +
-        `Create a schema file with permissions to be able to sync data.`);
-}
-else {
-    const { permissions } = ret;
-    if (config.output.file) {
-        await writePermissionsFile(permissions, config.output.file, config.output.format);
-    }
-    else if (config.upstream.type !== 'pg') {
-        colorConsole.warn(`Permissions deployment is not supported for ${config.upstream.type} upstreams`);
-        process.exit(-1);
-    }
-    else if (config.upstream.db) {
-        await deployPermissions(config.upstream.db, permissions, config.force);
-    }
-    else {
-        colorConsole.error(`No --output-file or --upstream-db specified`);
-        // Shows the usage text.
-        parseOptions(deployPermissionsOptions, {
-            argv: ['--help'],
-            envNamePrefix: ZERO_ENV_VAR_PREFIX,
-        });
-    }
+if (!ret || Object.keys(ret?.permissions ?? {}).length === 0) {
+  colorConsole.warn(
+    `No permissions found at ${config.schema.path}, so could not deploy permissions. Replicating data, but no tables will be syncable. Create a schema file with permissions to be able to sync data.`
+  );
+} else {
+  colorConsole.warn(
+    `Permissions are deprecated and will be removed in an upcoming release. See: https://zero.rocicorp.dev/docs/auth.`
+  );
+  const { permissions } = ret;
+  if (config.output.file) {
+    await writePermissionsFile(
+      permissions,
+      config.output.file,
+      config.output.format
+    );
+  } else if (config.upstream.type !== "pg") {
+    colorConsole.warn(
+      `Permissions deployment is not supported for ${config.upstream.type} upstreams`
+    );
+    process.exit(-1);
+  } else if (config.upstream.db) {
+    await deployPermissions(config.upstream.db, permissions, config.force);
+  } else {
+    colorConsole.error(`No --output-file or --upstream-db specified`);
+    parseOptions(deployPermissionsOptions, {
+      argv: ["--help"],
+      envNamePrefix: ZERO_ENV_VAR_PREFIX
+    });
+  }
 }
-//# sourceMappingURL=deploy-permissions.js.map
+//# sourceMappingURL=deploy-permissions.js.map

package/out/zero-cache/src/scripts/deploy-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-permissions.js","sourceRoot":"","sources":["../../../../../zero-cache/src/scripts/deploy-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,+BAA+B,CAAC;AAEvC,OAAO,EAAC,SAAS,EAAC,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAC,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAC,YAAY,EAAE,gBAAgB,EAAC,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAC,YAAY,EAAC,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAC,UAAU,EAAC,MAAM,kCAAkC,CAAC;AAC5D,OAAO,EAAC,YAAY,EAAC,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAIN,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAC,SAAS,EAAC,MAAM,yCAAyC,CAAC;AAClE,OAAO,EAAC,mBAAmB,EAAC,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAC,kBAAkB,EAAC,MAAM,kDAAkD,CAAC;AACpF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAC,aAAa,EAAC,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAC,QAAQ,EAAkB,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAC,SAAS,EAAE,UAAU,EAAE,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACzE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,GAAG,YAAY,CAAC,wBAAwB,EAAE;IACpD,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,mBAAmB;CACnC,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;AACjC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;AAE7B,MAAM,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAEpC,KAAK,UAAU,mBAAmB,CAChC,EAAc,EACd,WAA8B;IAE9B,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAErC,uDAAuD;IACvD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAA;;;wBAGD,MAAM,kBAAkB,kBAAkB,EAAE,CAAC;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,YAAY,CAAC,IAAI,CACf,6DAA6D;YAC3D,aAAa,GAAG,mEAAmE,CACtF,CAAC;QACF,OAAO;IACT,CAAC;IAED,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,EAAE,CAA4B;+BACtB,EAAE,CAAC,MAAM,GAAG,GAAG,GAAG,kBAAkB,CAAC;GACjE,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,YAAY,CAAC,IAAI,CACf,6DAA6D;YAC3D,aAAa,GAAG,mEAAmE,CACtF,CAAC;QACF,OAAO;IACT,CAAC;IACD,YAAY,CAAC,IAAI,CACf,oEAAoE,GAAG,IAAI,CAC5E,CAAC;IAEF,MAAM,CAAC,EAAC,YAAY,EAAE,iBAAiB,EAAC,CAAC,GAAG,MAAM,CAAC;IACnD,MAAM,EAAC,MAAM,EAAE,YAAY,EAAC,GAAG,MAAM,kBAAkB,CACrD,EAAE,EACF,iBAAiB,CAClB,CAAC;IACF,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,YAAY,CAAC,IAAI,CACf,8CAA8C,CAAC,GAAG,OAAO,CAAC,MAAM;YAC9D,+CAA+C;YAC/C,aAAa,GAAG,mEAAmE,CACtF,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAC5D,CAAC;IACF,MAAM,QAAQ,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAO,EAAE,EAAE;gBACvC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACtC,CAAC,CAAC;YACF,MAAM,aAAa,GAAG,CAAC,KAAmC,EAAE,EAAE;gBAC5D,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;gBACrC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;gBACrC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;gBACrC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;gBAClD,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YACrD,CAAC,CAAC;YACF,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,YAAY,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,WAAmB,EACnB,WAA8B,EAC9B,KAAc;IAEd,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACrC,MAAM,EAAC,IAAI,EAAE,IAAI,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IAChC,YAAY,CAAC,KAAK,CAAC,0BAA0B,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAEpC,MAAM,EAAC,IAAI,EAAE,OAAO,EAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;YAChD,IAAI,KAAK,EAAE,CAAC;gBACV,YAAY,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,MAAM,mBAAmB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;YAC7C,CAAC;YAED,MAAM,EAAC,KAAK,EAAC,GAAG,KAAK,CAAC;YACtB,YAAY,CAAC,IAAI,CACf,uCAAuC,KAAK,iBAAiB,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAC/E,CAAC;YACF,MAAM,CAAC,EAAC,IAAI,EAAE,UAAU,EAAC,CAAC,GAAG,MAAM,EAAE,CAAkB;2BAClC,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC;YAC3C,MAAM,CAAC,EAAC,IAAI,EAAC,CAAC,GAAG,MAAM,EAAE,CAAkB;iBAChC,EAAE,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,EAAC,WAAW,EAAC,CAAC,iBAAiB,CAAC;YAEzE,OAAO,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,EAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,EAAE,CAAC;YACZ,YAAY,CAAC,IAAI,CAAC,kCAAkC,IAAI,GAAG,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,+BAA+B,IAAI,GAAG,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAwB,EACxB,IAAY,EACZ,MAAiC;IAEjC,MAAM,QAAQ,GACZ,MAAM,KAAK,KAAK;QACd,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,kCAAkC,OAAO,CACxD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CACtB,GAAG;QACN,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChC,YAAY,CAAC,IAAI,CAAC,SAAS,MAAM,mBAAmB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrE,IAAI,CAAC,GAAG,EAAE,CAAC;IACT,YAAY,CAAC,IAAI,CACf,sBAAsB,MAAM,CAAC,MAAM,CAAC,IAAI,wBAAwB;QAC9D,iEAAiE;QACjE,gEAAgE,CACnE,CAAC;AACJ,CAAC;KAAM,CAAC;IACN,MAAM,EAAC,WAAW,EAAC,GAAG,GAAG,CAAC;IAC1B,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,oBAAoB,CACxB,WAAW,EACX,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,MAAM,CAAC,MAAM,CAAC,MAAM,CACrB,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzC,YAAY,CAAC,IAAI,CACf,+CAA+C,MAAM,CAAC,QAAQ,CAAC,IAAI,YAAY,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAClE,wBAAwB;QACxB,YAAY,CAAC,wBAAwB,EAAE;YACrC,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,aAAa,EAAE,mBAAmB;SACnC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
+{"version":3,"file":"deploy-permissions.js","sources":["../../../../../zero-cache/src/scripts/deploy-permissions.ts"],"sourcesContent":["import '../../../shared/src/dotenv.ts';\n\nimport {writeFile} from 'node:fs/promises';\nimport {ident as id, literal} from 'pg-format';\nimport {colorConsole, createLogContext} from '../../../shared/src/logging.ts';\nimport {parseOptions} from '../../../shared/src/options.ts';\nimport {difference} from '../../../shared/src/set-utils.ts';\nimport {mapCondition} from '../../../zero-protocol/src/ast.ts';\nimport {\n  type AssetPermissions,\n  type PermissionsConfig,\n  type Rule,\n} from '../../../zero-schema/src/compiled-permissions.ts';\nimport {validator} from '../../../zero-schema/src/name-mapper.ts';\nimport {ZERO_ENV_VAR_PREFIX} from '../config/zero-config.ts';\nimport {getPublicationInfo} from '../services/change-source/pg/schema/published.ts';\nimport {\n  ensureGlobalTables,\n  SHARD_CONFIG_TABLE,\n} from '../services/change-source/pg/schema/shard.ts';\nimport {liteTableName} from '../types/names.ts';\nimport {pgClient, type PostgresDB} from '../types/pg.ts';\nimport {appSchema, getShardID, upstreamSchema} from '../types/shards.ts';\nimport {\n  deployPermissionsOptions,\n  loadSchemaAndPermissions,\n} from './permissions.ts';\n\nconst config = parseOptions(deployPermissionsOptions, {\n  argv: process.argv.slice(2),\n  envNamePrefix: ZERO_ENV_VAR_PREFIX,\n});\n\nconst shard = getShardID(config);\nconst app = appSchema(shard);\n\nconst lc = createLogContext(config);\n\nasync function validatePermissions(\n  db: PostgresDB,\n  permissions: PermissionsConfig,\n) {\n  const schema = upstreamSchema(shard);\n\n  // Check if the shardConfig table has been initialized.\n  const result = await db`\n    SELECT relname FROM pg_class\n      JOIN pg_namespace ON relnamespace = pg_namespace.oid\n      WHERE nspname = ${schema} AND relname = ${SHARD_CONFIG_TABLE}`;\n  if (result.length === 0) {\n    colorConsole.warn(\n      `zero-cache has not yet initialized the upstream database.\\n` +\n        `Deploying ${app} permissions without validating against published tables/columns.`,\n    );\n    return;\n  }\n\n  // Get the publications for the shard\n  const config = await db<{publications: string[]}[]>`\n    SELECT publications FROM ${db(schema + '.' + SHARD_CONFIG_TABLE)}\n  `;\n  if (config.length === 0) {\n    colorConsole.warn(\n      `zero-cache has not yet initialized the upstream database.\\n` +\n        `Deploying ${app} permissions without validating against published tables/columns.`,\n    );\n    return;\n  }\n  colorConsole.info(\n    `Validating permissions against tables and columns published for \"${app}\".`,\n  );\n\n  const [{publications: shardPublications}] = config;\n  const {tables, publications} = await getPublicationInfo(\n    db,\n    shardPublications,\n  );\n  const pubnames = publications.map(p => p.pubname);\n  const missing = difference(new Set(shardPublications), new Set(pubnames));\n  if (missing.size) {\n    colorConsole.warn(\n      `Upstream is missing expected publications \"${[...missing]}\".\\n` +\n        `You may need to re-initialize your replica.\\n` +\n        `Deploying ${app} permissions without validating against published tables/columns.`,\n    );\n    return;\n  }\n  const tablesToColumns = new Map(\n    tables.map(t => [liteTableName(t), Object.keys(t.columns)]),\n  );\n  const validate = validator(tablesToColumns);\n  try {\n    for (const [table, perms] of Object.entries(permissions?.tables ?? {})) {\n      const validateRule = ([_, cond]: Rule) => {\n        mapCondition(cond, table, validate);\n      };\n      const validateAsset = (asset: AssetPermissions | undefined) => {\n        asset?.select?.forEach(validateRule);\n        asset?.delete?.forEach(validateRule);\n        asset?.insert?.forEach(validateRule);\n        asset?.update?.preMutation?.forEach(validateRule);\n        asset?.update?.postMutation?.forEach(validateRule);\n      };\n      validateAsset(perms.row);\n      if (perms.cell) {\n        Object.values(perms.cell).forEach(validateAsset);\n      }\n    }\n  } catch (e) {\n    failWithMessage(String(e));\n  }\n}\n\nfunction failWithMessage(msg: string) {\n  colorConsole.error(msg);\n  colorConsole.info('\\nUse --force to deploy at your own risk.\\n');\n  process.exit(-1);\n}\n\nasync function deployPermissions(\n  upstreamURI: string,\n  permissions: PermissionsConfig,\n  force: boolean,\n) {\n  const db = pgClient(lc, upstreamURI);\n  const {host, port} = db.options;\n  colorConsole.debug(`Connecting to upstream@${host}:${port}`);\n  try {\n    await ensureGlobalTables(db, shard);\n\n    const {hash, changed} = await db.begin(async tx => {\n      if (force) {\n        colorConsole.warn(`--force specified. Skipping validation.`);\n      } else {\n        await validatePermissions(tx, permissions);\n      }\n\n      const {appID} = shard;\n      colorConsole.info(\n        `Deploying permissions for --app-id \"${appID}\" to upstream@${db.options.host}`,\n      );\n      const [{hash: beforeHash}] = await tx<{hash: string}[]>`\n        SELECT hash from ${tx(app)}.permissions`;\n      const [{hash}] = await tx<{hash: string}[]>`\n        UPDATE ${tx(app)}.permissions SET ${db({permissions})} RETURNING hash`;\n\n      return {hash: hash.substring(0, 7), changed: beforeHash !== hash};\n    });\n    if (changed) {\n      colorConsole.info(`Deployed new permissions (hash=${hash})`);\n    } else {\n      colorConsole.info(`Permissions unchanged (hash=${hash})`);\n    }\n  } finally {\n    await db.end();\n  }\n}\n\nasync function writePermissionsFile(\n  perms: PermissionsConfig,\n  file: string,\n  format: 'sql' | 'json' | 'pretty',\n) {\n  const contents =\n    format === 'sql'\n      ? `UPDATE ${id(app)}.permissions SET permissions = ${literal(\n          JSON.stringify(perms),\n        )};`\n      : JSON.stringify(perms, null, format === 'pretty' ? 2 : 0);\n  await writeFile(file, contents);\n  colorConsole.info(`Wrote ${format} permissions to ${config.output.file}`);\n}\n\nconst ret = await loadSchemaAndPermissions(config.schema.path, true);\nif (!ret || Object.keys(ret?.permissions ?? {}).length === 0) {\n  colorConsole.warn(\n    `No permissions found at ${config.schema.path}, so could not deploy ` +\n      `permissions. Replicating data, but no tables will be syncable. ` +\n      `Create a schema file with permissions to be able to sync data.`,\n  );\n} else {\n  colorConsole.warn(\n    `Permissions are deprecated and will be removed in an upcoming release. See: https://zero.rocicorp.dev/docs/auth.`,\n  );\n\n  const {permissions} = ret;\n  if (config.output.file) {\n    await writePermissionsFile(\n      permissions,\n      config.output.file,\n      config.output.format,\n    );\n  } else if (config.upstream.type !== 'pg') {\n    colorConsole.warn(\n      `Permissions deployment is not supported for ${config.upstream.type} upstreams`,\n    );\n    process.exit(-1);\n  } else if (config.upstream.db) {\n    await deployPermissions(config.upstream.db, permissions, config.force);\n  } else {\n    colorConsole.error(`No --output-file or --upstream-db specified`);\n    // Shows the usage text.\n    parseOptions(deployPermissionsOptions, {\n      argv: ['--help'],\n      envNamePrefix: ZERO_ENV_VAR_PREFIX,\n    });\n  }\n}\n"],"names":["config","hash","id"],"mappings":";;;;;;;;;;;;;;;;AA4BA,MAAM,SAAS,aAAa,0BAA0B;AAAA,EACpD,MAAM,QAAQ,KAAK,MAAM,CAAC;AAAA,EAC1B,eAAe;AACjB,CAAC;AAED,MAAM,QAAQ,WAAW,MAAM;AAC/B,MAAM,MAAM,UAAU,KAAK;AAE3B,MAAM,KAAK,iBAAiB,MAAM;AAElC,eAAe,oBACb,IACA,aACA;AACA,QAAM,SAAS,eAAe,KAAK;AAGnC,QAAM,SAAS,MAAM;AAAA;AAAA;AAAA,wBAGC,MAAM,kBAAkB,kBAAkB;AAChE,MAAI,OAAO,WAAW,GAAG;AACvB,iBAAa;AAAA,MACX;AAAA,YACe,GAAG;AAAA,IAAA;AAEpB;AAAA,EACF;AAGA,QAAMA,UAAS,MAAM;AAAA,+BACQ,GAAG,SAAS,MAAM,kBAAkB,CAAC;AAAA;AAElE,MAAIA,QAAO,WAAW,GAAG;AACvB,iBAAa;AAAA,MACX;AAAA,YACe,GAAG;AAAA,IAAA;AAEpB;AAAA,EACF;AACA,eAAa;AAAA,IACX,oEAAoE,GAAG;AAAA,EAAA;AAGzE,QAAM,CAAC,EAAC,cAAc,kBAAA,CAAkB,IAAIA;AAC5C,QAAM,EAAC,QAAQ,aAAA,IAAgB,MAAM;AAAA,IACnC;AAAA,IACA;AAAA,EAAA;AAEF,QAAM,WAAW,aAAa,IAAI,CAAA,MAAK,EAAE,OAAO;AAChD,QAAM,UAAU,WAAW,IAAI,IAAI,iBAAiB,GAAG,IAAI,IAAI,QAAQ,CAAC;AACxE,MAAI,QAAQ,MAAM;AAChB,iBAAa;AAAA,MACX,8CAA8C,CAAC,GAAG,OAAO,CAAC;AAAA;AAAA,YAE3C,GAAG;AAAA,IAAA;AAEpB;AAAA,EACF;AACA,QAAM,kBAAkB,IAAI;AAAA,IAC1B,OAAO,IAAI,CAAA,MAAK,CAAC,cAAc,CAAC,GAAG,OAAO,KAAK,EAAE,OAAO,CAAC,CAAC;AAAA,EAAA;AAE5D,QAAM,WAAW,UAAU,eAAe;AAC1C,MAAI;AACF,eAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,aAAa,UAAU,CAAA,CAAE,GAAG;AACtE,YAAM,eAAe,CAAC,CAAC,GAAG,IAAI,MAAY;AACxC,qBAAa,MAAM,OAAO,QAAQ;AAAA,MACpC;AACA,YAAM,gBAAgB,CAAC,UAAwC;AAC7D,eAAO,QAAQ,QAAQ,YAAY;AACnC,eAAO,QAAQ,QAAQ,YAAY;AACnC,eAAO,QAAQ,QAAQ,YAAY;AACnC,eAAO,QAAQ,aAAa,QAAQ,YAAY;AAChD,eAAO,QAAQ,cAAc,QAAQ,YAAY;AAAA,MACnD;AACA,oBAAc,MAAM,GAAG;AACvB,UAAI,MAAM,MAAM;AACd,eAAO,OAAO,MAAM,IAAI,EAAE,QAAQ,aAAa;AAAA,MACjD;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AACV,oBAAgB,OAAO,CAAC,CAAC;AAAA,EAC3B;AACF;AAEA,SAAS,gBAAgB,KAAa;AACpC,eAAa,MAAM,GAAG;AACtB,eAAa,KAAK,6CAA6C;AAC/D,UAAQ,KAAK,EAAE;AACjB;AAEA,eAAe,kBACb,aACA,aACA,OACA;AACA,QAAM,KAAK,SAAS,IAAI,WAAW;AACnC,QAAM,EAAC,MAAM,KAAA,IAAQ,GAAG;AACxB,eAAa,MAAM,0BAA0B,IAAI,IAAI,IAAI,EAAE;AAC3D,MAAI;AACF,UAAM,mBAAmB,IAAI,KAAK;AAElC,UAAM,EAAC,MAAM,QAAA,IAAW,MAAM,GAAG,MAAM,OAAM,OAAM;AACjD,UAAI,OAAO;AACT,qBAAa,KAAK,yCAAyC;AAAA,MAC7D,OAAO;AACL,cAAM,oBAAoB,IAAI,WAAW;AAAA,MAC3C;AAEA,YAAM,EAAC,UAAS;AAChB,mBAAa;AAAA,QACX,uCAAuC,KAAK,iBAAiB,GAAG,QAAQ,IAAI;AAAA,MAAA;AAE9E,YAAM,CAAC,EAAC,MAAM,WAAA,CAAW,IAAI,MAAM;AAAA,2BACd,GAAG,GAAG,CAAC;AAC5B,YAAM,CAAC,EAAC,MAAAC,MAAAA,CAAK,IAAI,MAAM;AAAA,iBACZ,GAAG,GAAG,CAAC,oBAAoB,GAAG,EAAC,YAAA,CAAY,CAAC;AAEvD,aAAO,EAAC,MAAMA,MAAK,UAAU,GAAG,CAAC,GAAG,SAAS,eAAeA,MAAAA;AAAAA,IAC9D,CAAC;AACD,QAAI,SAAS;AACX,mBAAa,KAAK,kCAAkC,IAAI,GAAG;AAAA,IAC7D,OAAO;AACL,mBAAa,KAAK,+BAA+B,IAAI,GAAG;AAAA,IAC1D;AAAA,EACF,UAAA;AACE,UAAM,GAAG,IAAA;AAAA,EACX;AACF;AAEA,eAAe,qBACb,OACA,MACA,QACA;AACA,QAAM,WACJ,WAAW,QACP,UAAUC,MAAG,GAAG,CAAC,kCAAkC;AAAA,IACjD,KAAK,UAAU,KAAK;AAAA,EAAA,CACrB,MACD,KAAK,UAAU,OAAO,MAAM,WAAW,WAAW,IAAI,CAAC;AAC7D,QAAM,UAAU,MAAM,QAAQ;AAC9B,eAAa,KAAK,SAAS,MAAM,mBAAmB,OAAO,OAAO,IAAI,EAAE;AAC1E;AAEA,MAAM,MAAM,MAAM,yBAAyB,OAAO,OAAO,MAAM,IAAI;AACnE,IAAI,CAAC,OAAO,OAAO,KAAK,KAAK,eAAe,CAAA,CAAE,EAAE,WAAW,GAAG;AAC5D,eAAa;AAAA,IACX,2BAA2B,OAAO,OAAO,IAAI;AAAA,EAAA;AAIjD,OAAO;AACL,eAAa;AAAA,IACX;AAAA,EAAA;AAGF,QAAM,EAAC,gBAAe;AACtB,MAAI,OAAO,OAAO,MAAM;AACtB,UAAM;AAAA,MACJ;AAAA,MACA,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAAA;AAAA,EAElB,WAAW,OAAO,SAAS,SAAS,MAAM;AACxC,iBAAa;AAAA,MACX,+CAA+C,OAAO,SAAS,IAAI;AAAA,IAAA;AAErE,YAAQ,KAAK,EAAE;AAAA,EACjB,WAAW,OAAO,SAAS,IAAI;AAC7B,UAAM,kBAAkB,OAAO,SAAS,IAAI,aAAa,OAAO,KAAK;AAAA,EACvE,OAAO;AACL,iBAAa,MAAM,6CAA6C;AAEhE,iBAAa,0BAA0B;AAAA,MACrC,MAAM,CAAC,QAAQ;AAAA,MACf,eAAe;AAAA,IAAA,CAChB;AAAA,EACH;AACF;"}

package/out/zero-cache/src/scripts/permissions.d.ts

@@ -1,6 +1,6 @@
 import * as v from '../../../shared/src/valita.ts';
-import type { Schema } from '../../../zero-schema/src/builder/schema-builder.ts';
 import { type PermissionsConfig } from '../../../zero-schema/src/compiled-permissions.ts';
+import type { Schema } from '../../../zero-types/src/schema.ts';
 export declare const deployPermissionsOptions: {
     schema: {
         path: {

package/out/zero-cache/src/scripts/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/scripts/permissions.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AACnD,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,oDAAoD,CAAC;AAC/E,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,kDAAkD,CAAC;AAK1D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyDpC,CAAC;AAEF,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,IAAI,GACjB,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,iBAAiB,CAAA;CAAC,GAAG,SAAS,CAAC,CAAC;AACzE,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,KAAK,GACnB,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,iBAAiB,CAAA;CAAC,CAAC,CAAC"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/scripts/permissions.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AACnD,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,kDAAkD,CAAC;AAE1D,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,mCAAmC,CAAC;AAG9D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsDpC,CAAC;AAEF,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,IAAI,GACjB,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,iBAAiB,CAAA;CAAC,GAAG,SAAS,CAAC,CAAC;AACzE,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,KAAK,GACnB,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,iBAAiB,CAAA;CAAC,CAAC,CAAC"}

package/out/zero-cache/src/scripts/permissions.js

@@ -1,108 +1,114 @@
-import { basename, dirname, join, relative, resolve, sep } from 'node:path';
-import { existsSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { tsImport } from 'tsx/esm/api';
+import { existsSync } from "node:fs";
+import { dirname, resolve, relative, join, basename, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { tsImport } from "tsx/esm/api";
 import { logOptions } from "../../../otel/src/log-options.js";
-import * as v from "../../../shared/src/valita.js";
-import { permissionsConfigSchema, } from "../../../zero-schema/src/compiled-permissions.js";
-import { isSchemaConfig } from "../../../zero-schema/src/schema-config.js";
-import { appOptions, shardOptions, zeroOptions } from "../config/zero-config.js";
 import { colorConsole } from "../../../shared/src/logging.js";
-export const deployPermissionsOptions = {
-    schema: {
-        path: {
-            type: v.string().default('schema.ts'),
-            desc: [
-                'Relative path to the file containing the schema definition.',
-                'The file must have a default export of type SchemaConfig.',
-            ],
-            alias: 'p',
-        },
-    },
-    upstream: {
-        db: {
-            type: v.string().optional(),
-            desc: [
-                `The upstream Postgres database to deploy permissions to.`,
-                `This is ignored if an {bold output-file} is specified.`,
-            ],
-        },
-        type: zeroOptions.upstream.type,
-    },
-    app: { id: appOptions.id },
-    shard: shardOptions,
-    log: logOptions,
-    output: {
-        file: {
-            type: v.string().optional(),
-            desc: [
-                `Outputs the permissions to a file with the requested {bold output-format}.`,
-            ],
-        },
-        format: {
-            type: v.literalUnion('sql', 'json', 'pretty').default('sql'),
-            desc: [
-                `The desired format of the output file.`,
-                ``,
-                `A {bold sql} file can be executed via "psql -f <file.sql>", or "\\\\i <file.sql>"`,
-                `from within the psql console, or copied and pasted into a migration script.`,
-                ``,
-                `The {bold json} and {bold pretty} formats are available for non-pg backends`,
-                `and general debugging.`,
-            ],
-        },
+import { literalUnion, parse } from "../../../shared/src/valita.js";
+import { permissionsConfigSchema } from "../../../zero-schema/src/compiled-permissions.js";
+import { isSchemaConfig } from "../../../zero-schema/src/schema-config.js";
+import { shardOptions, appOptions, zeroOptions } from "../config/zero-config.js";
+import { boolean, string } from "@badrap/valita";
+const deployPermissionsOptions = {
+  schema: {
+    path: {
+      type: string().default("schema.ts"),
+      desc: ["Relative path to the file containing the schema definition."],
+      alias: "p"
+    }
+  },
+  upstream: {
+    db: {
+      type: string().optional(),
+      desc: [
+        `The upstream Postgres database to deploy permissions to.`,
+        `This is ignored if an {bold output-file} is specified.`
+      ]
     },
-    force: {
-        type: v.boolean().default(false),
-        desc: [`Deploy to upstream without validation. Use at your own risk.`],
-        alias: 'f',
+    type: zeroOptions.upstream.type
+  },
+  app: { id: appOptions.id },
+  shard: shardOptions,
+  log: logOptions,
+  output: {
+    file: {
+      type: string().optional(),
+      desc: [
+        `Outputs the permissions to a file with the requested {bold output-format}.`
+      ]
     },
-};
-export async function loadSchemaAndPermissions(schemaPath, allowMissing) {
-    const typeModuleErrorMessage = () => `\n\nYou may need to add \` "type": "module" \` to the package.json file for ${schemaPath}.\n`;
-    colorConsole.info(`Loading permissions from ${schemaPath}`);
-    const dir = dirname(fileURLToPath(import.meta.url));
-    const absoluteSchemaPath = resolve(schemaPath);
-    const relativeDir = relative(dir, dirname(absoluteSchemaPath));
-    let relativePath = join(
-    // tsImport expects the relativePath to be a path and not just a filename.
-    relativeDir.length ? relativeDir : `.${sep}`, basename(absoluteSchemaPath));
-    // tsImport doesn't expect to receive slashes in the Windows format when running
-    // on Windows. They need to be converted to *nix format.
-    relativePath = relativePath.replace(/\\/g, '/');
-    if (!existsSync(absoluteSchemaPath)) {
-        if (allowMissing) {
-            return undefined;
-        }
-        colorConsole.error(`Schema file ${schemaPath} does not exist.`);
-        process.exit(1);
+    format: {
+      type: literalUnion("sql", "json", "pretty").default("sql"),
+      desc: [
+        `The desired format of the output file.`,
+        ``,
+        `A {bold sql} file can be executed via "psql -f <file.sql>", or "\\\\i <file.sql>"`,
+        `from within the psql console, or copied and pasted into a migration script.`,
+        ``,
+        `The {bold json} and {bold pretty} formats are available for non-pg backends`,
+        `and general debugging.`
+      ]
     }
-    let module;
-    try {
-        module = await tsImport(relativePath, import.meta.url);
-    }
-    catch (e) {
-        colorConsole.error(`Failed to load zero schema from ${absoluteSchemaPath}` +
-            typeModuleErrorMessage());
-        throw e;
-    }
-    if (!isSchemaConfig(module)) {
-        colorConsole.error(`Schema file ${schemaPath} must export [schema] and [permissions].` +
-            typeModuleErrorMessage());
-        process.exit(1);
-    }
-    try {
-        const schemaConfig = module;
-        const perms = await schemaConfig.permissions;
-        const { schema } = schemaConfig;
-        return {
-            schema,
-            permissions: v.parse(perms, permissionsConfigSchema),
-        };
+  },
+  force: {
+    type: boolean().default(false),
+    desc: [`Deploy to upstream without validation. Use at your own risk.`],
+    alias: "f"
+  }
+};
+async function loadSchemaAndPermissions(schemaPath, allowMissing) {
+  const typeModuleErrorMessage = () => `
+
+You may need to add \` "type": "module" \` to the package.json file for ${schemaPath}.
+`;
+  colorConsole.info(`Loading schema from ${schemaPath}`);
+  const dir = dirname(fileURLToPath(import.meta.url));
+  const absoluteSchemaPath = resolve(schemaPath);
+  const relativeDir = relative(dir, dirname(absoluteSchemaPath));
+  let relativePath = relativeDir.length && relativeDir !== "." ? join(relativeDir, basename(absoluteSchemaPath)) : `.${sep}${basename(absoluteSchemaPath)}`;
+  relativePath = relativePath.replace(/\\/g, "/");
+  if (!existsSync(absoluteSchemaPath)) {
+    if (allowMissing) {
+      return void 0;
     }
-    catch (e) {
-        colorConsole.error(`Failed to parse Permissions object`);
-        throw e;
+    colorConsole.error(`Schema file ${schemaPath} does not exist.`);
+    process.exit(1);
+  }
+  let module;
+  try {
+    module = await tsImport(relativePath, import.meta.url);
+  } catch (e) {
+    colorConsole.error(
+      `Failed to load zero schema from ${absoluteSchemaPath}` + typeModuleErrorMessage()
+    );
+    throw e;
+  }
+  if (!isSchemaConfig(module)) {
+    colorConsole.error(
+      `Schema file ${schemaPath} must export [schema].` + typeModuleErrorMessage()
+    );
+    process.exit(1);
+  }
+  try {
+    const schemaConfig = module;
+    const perms = await schemaConfig.permissions;
+    const { schema } = schemaConfig;
+    if (perms) {
+      colorConsole.warn?.(
+        "Permissions are deprecated and will be removed in an upcoming release. See: https://zero.rocicorp.dev/docs/auth."
+      );
     }
+    return {
+      schema,
+      permissions: parse(perms ?? {}, permissionsConfigSchema)
+    };
+  } catch (e) {
+    colorConsole.error(`Failed to parse Permissions object`);
+    throw e;
+  }
 }
-//# sourceMappingURL=permissions.js.map
+export {
+  deployPermissionsOptions,
+  loadSchemaAndPermissions
+};
+//# sourceMappingURL=permissions.js.map

package/out/zero-cache/src/scripts/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../../../zero-cache/src/scripts/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAC,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAC,UAAU,EAAC,MAAM,SAAS,CAAC;AACnC,OAAO,EAAC,aAAa,EAAC,MAAM,UAAU,CAAC;AACvC,OAAO,EAAC,QAAQ,EAAC,MAAM,aAAa,CAAC;AACrC,OAAO,EAAC,UAAU,EAAC,MAAM,kCAAkC,CAAC;AAC5D,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AAEnD,OAAO,EACL,uBAAuB,GAExB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAC,cAAc,EAAC,MAAM,2CAA2C,CAAC;AACzE,OAAO,EAAC,UAAU,EAAE,YAAY,EAAE,WAAW,EAAC,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAC,YAAY,EAAC,MAAM,gCAAgC,CAAC;AAE5D,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;YACrC,IAAI,EAAE;gBACJ,6DAA6D;gBAC7D,2DAA2D;aAC5D;YACD,KAAK,EAAE,GAAG;SACX;KACF;IAED,QAAQ,EAAE;QACR,EAAE,EAAE;YACF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,IAAI,EAAE;gBACJ,0DAA0D;gBAC1D,wDAAwD;aACzD;SACF;QAED,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,IAAI;KAChC;IAED,GAAG,EAAE,EAAC,EAAE,EAAE,UAAU,CAAC,EAAE,EAAC;IAExB,KAAK,EAAE,YAAY;IAEnB,GAAG,EAAE,UAAU;IAEf,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,IAAI,EAAE;gBACJ,4EAA4E;aAC7E;SACF;QAED,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;YAC5D,IAAI,EAAE;gBACJ,wCAAwC;gBACxC,EAAE;gBACF,mFAAmF;gBACnF,6EAA6E;gBAC7E,EAAE;gBACF,6EAA6E;gBAC7E,wBAAwB;aACzB;SACF;KACF;IAED,KAAK,EAAE;QACL,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,CAAC,8DAA8D,CAAC;QACtE,KAAK,EAAE,GAAG;KACX;CACF,CAAC;AAUF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAAkB,EAClB,YAAiC;IAEjC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CAClC,+EAA+E,UAAU,KAAK,CAAC;IAEjG,YAAY,CAAC,IAAI,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC/D,IAAI,YAAY,GAAG,IAAI;IACrB,0EAA0E;IAC1E,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAC5C,QAAQ,CAAC,kBAAkB,CAAC,CAC7B,CAAC;IAEF,gFAAgF;IAChF,wDAAwD;IACxD,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEhD,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpC,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,YAAY,CAAC,KAAK,CAAC,eAAe,UAAU,kBAAkB,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,YAAY,CAAC,KAAK,CAChB,mCAAmC,kBAAkB,EAAE;YACrD,sBAAsB,EAAE,CAC3B,CAAC;QACF,MAAM,CAAC,CAAC;IACV,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,YAAY,CAAC,KAAK,CAChB,eAAe,UAAU,0CAA0C;YACjE,sBAAsB,EAAE,CAC3B,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,CAAC;QAC5B,MAAM,KAAK,GACT,MAAO,YAAY,CAAC,WAA2C,CAAC;QAClE,MAAM,EAAC,MAAM,EAAC,GAAG,YAAY,CAAC;QAC9B,OAAO;YACL,MAAM;YACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,uBAAuB,CAAC;SACrD,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,YAAY,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACzD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC"}
+{"version":3,"file":"permissions.js","sources":["../../../../../zero-cache/src/scripts/permissions.ts"],"sourcesContent":["import {existsSync} from 'node:fs';\nimport {basename, dirname, join, relative, resolve, sep} from 'node:path';\nimport {fileURLToPath} from 'node:url';\nimport {tsImport} from 'tsx/esm/api';\nimport {logOptions} from '../../../otel/src/log-options.ts';\nimport {colorConsole} from '../../../shared/src/logging.ts';\nimport * as v from '../../../shared/src/valita.ts';\nimport {\n  permissionsConfigSchema,\n  type PermissionsConfig,\n} from '../../../zero-schema/src/compiled-permissions.ts';\nimport {isSchemaConfig} from '../../../zero-schema/src/schema-config.ts';\nimport type {Schema} from '../../../zero-types/src/schema.ts';\nimport {appOptions, shardOptions, zeroOptions} from '../config/zero-config.ts';\n\nexport const deployPermissionsOptions = {\n  schema: {\n    path: {\n      type: v.string().default('schema.ts'),\n      desc: ['Relative path to the file containing the schema definition.'],\n      alias: 'p',\n    },\n  },\n\n  upstream: {\n    db: {\n      type: v.string().optional(),\n      desc: [\n        `The upstream Postgres database to deploy permissions to.`,\n        `This is ignored if an {bold output-file} is specified.`,\n      ],\n    },\n\n    type: zeroOptions.upstream.type,\n  },\n\n  app: {id: appOptions.id},\n\n  shard: shardOptions,\n\n  log: logOptions,\n\n  output: {\n    file: {\n      type: v.string().optional(),\n      desc: [\n        `Outputs the permissions to a file with the requested {bold output-format}.`,\n      ],\n    },\n\n    format: {\n      type: v.literalUnion('sql', 'json', 'pretty').default('sql'),\n      desc: [\n        `The desired format of the output file.`,\n        ``,\n        `A {bold sql} file can be executed via \"psql -f <file.sql>\", or \"\\\\\\\\i <file.sql>\"`,\n        `from within the psql console, or copied and pasted into a migration script.`,\n        ``,\n        `The {bold json} and {bold pretty} formats are available for non-pg backends`,\n        `and general debugging.`,\n      ],\n    },\n  },\n\n  force: {\n    type: v.boolean().default(false),\n    desc: [`Deploy to upstream without validation. Use at your own risk.`],\n    alias: 'f',\n  },\n};\n\nexport async function loadSchemaAndPermissions(\n  schemaPath: string,\n  allowMissing: true,\n): Promise<{schema: Schema; permissions: PermissionsConfig} | undefined>;\nexport async function loadSchemaAndPermissions(\n  schemaPath: string,\n  allowMissing?: false,\n): Promise<{schema: Schema; permissions: PermissionsConfig}>;\nexport async function loadSchemaAndPermissions(\n  schemaPath: string,\n  allowMissing: boolean | undefined,\n): Promise<{schema: Schema; permissions: PermissionsConfig} | undefined> {\n  const typeModuleErrorMessage = () =>\n    `\\n\\nYou may need to add \\` \"type\": \"module\" \\` to the package.json file for ${schemaPath}.\\n`;\n\n  colorConsole.info(`Loading schema from ${schemaPath}`);\n\n  const dir = dirname(fileURLToPath(import.meta.url));\n  const absoluteSchemaPath = resolve(schemaPath);\n  const relativeDir = relative(dir, dirname(absoluteSchemaPath));\n  let relativePath =\n    relativeDir.length && relativeDir !== '.'\n      ? join(relativeDir, basename(absoluteSchemaPath))\n      : `.${sep}${basename(absoluteSchemaPath)}`;\n\n  // tsImport doesn't expect to receive slashes in the Windows format when running\n  // on Windows. They need to be converted to *nix format.\n  relativePath = relativePath.replace(/\\\\/g, '/');\n\n  if (!existsSync(absoluteSchemaPath)) {\n    if (allowMissing) {\n      return undefined;\n    }\n    colorConsole.error(`Schema file ${schemaPath} does not exist.`);\n    process.exit(1);\n  }\n\n  let module;\n  try {\n    module = await tsImport(relativePath, import.meta.url);\n  } catch (e) {\n    colorConsole.error(\n      `Failed to load zero schema from ${absoluteSchemaPath}` +\n        typeModuleErrorMessage(),\n    );\n    throw e;\n  }\n\n  if (!isSchemaConfig(module)) {\n    colorConsole.error(\n      `Schema file ${schemaPath} must export [schema].` +\n        typeModuleErrorMessage(),\n    );\n    process.exit(1);\n  }\n  try {\n    const schemaConfig = module;\n    const perms =\n      await (schemaConfig.permissions as unknown as Promise<unknown>);\n    const {schema} = schemaConfig;\n\n    if (perms) {\n      colorConsole.warn?.(\n        'Permissions are deprecated and will be removed in an upcoming release. See: https://zero.rocicorp.dev/docs/auth.',\n      );\n    }\n\n    return {\n      schema,\n      permissions: v.parse(perms ?? {}, permissionsConfigSchema),\n    };\n  } catch (e) {\n    colorConsole.error(`Failed to parse Permissions object`);\n    throw e;\n  }\n}\n"],"names":["v.string","v.literalUnion","v.boolean","v.parse"],"mappings":";;;;;;;;;;;AAeO,MAAM,2BAA2B;AAAA,EACtC,QAAQ;AAAA,IACN,MAAM;AAAA,MACJ,MAAMA,OAAE,EAAS,QAAQ,WAAW;AAAA,MACpC,MAAM,CAAC,6DAA6D;AAAA,MACpE,OAAO;AAAA,IAAA;AAAA,EACT;AAAA,EAGF,UAAU;AAAA,IACR,IAAI;AAAA,MACF,MAAMA,OAAE,EAAS,SAAA;AAAA,MACjB,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,MAAA;AAAA,IACF;AAAA,IAGF,MAAM,YAAY,SAAS;AAAA,EAAA;AAAA,EAG7B,KAAK,EAAC,IAAI,WAAW,GAAA;AAAA,EAErB,OAAO;AAAA,EAEP,KAAK;AAAA,EAEL,QAAQ;AAAA,IACN,MAAM;AAAA,MACJ,MAAMA,OAAE,EAAS,SAAA;AAAA,MACjB,MAAM;AAAA,QACJ;AAAA,MAAA;AAAA,IACF;AAAA,IAGF,QAAQ;AAAA,MACN,MAAMC,aAAe,OAAO,QAAQ,QAAQ,EAAE,QAAQ,KAAK;AAAA,MAC3D,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IACF;AAAA,EACF;AAAA,EAGF,OAAO;AAAA,IACL,MAAMC,QAAE,EAAU,QAAQ,KAAK;AAAA,IAC/B,MAAM,CAAC,8DAA8D;AAAA,IACrE,OAAO;AAAA,EAAA;AAEX;AAUA,eAAsB,yBACpB,YACA,cACuE;AACvE,QAAM,yBAAyB,MAC7B;AAAA;AAAA,0EAA+E,UAAU;AAAA;AAE3F,eAAa,KAAK,uBAAuB,UAAU,EAAE;AAErD,QAAM,MAAM,QAAQ,cAAc,YAAY,GAAG,CAAC;AAClD,QAAM,qBAAqB,QAAQ,UAAU;AAC7C,QAAM,cAAc,SAAS,KAAK,QAAQ,kBAAkB,CAAC;AAC7D,MAAI,eACF,YAAY,UAAU,gBAAgB,MAClC,KAAK,aAAa,SAAS,kBAAkB,CAAC,IAC9C,IAAI,GAAG,GAAG,SAAS,kBAAkB,CAAC;AAI5C,iBAAe,aAAa,QAAQ,OAAO,GAAG;AAE9C,MAAI,CAAC,WAAW,kBAAkB,GAAG;AACnC,QAAI,cAAc;AAChB,aAAO;AAAA,IACT;AACA,iBAAa,MAAM,eAAe,UAAU,kBAAkB;AAC9D,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,SAAS,cAAc,YAAY,GAAG;AAAA,EACvD,SAAS,GAAG;AACV,iBAAa;AAAA,MACX,mCAAmC,kBAAkB,KACnD,uBAAA;AAAA,IAAuB;AAE3B,UAAM;AAAA,EACR;AAEA,MAAI,CAAC,eAAe,MAAM,GAAG;AAC3B,iBAAa;AAAA,MACX,eAAe,UAAU,2BACvB,uBAAA;AAAA,IAAuB;AAE3B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI;AACF,UAAM,eAAe;AACrB,UAAM,QACJ,MAAO,aAAa;AACtB,UAAM,EAAC,WAAU;AAEjB,QAAI,OAAO;AACT,mBAAa;AAAA,QACX;AAAA,MAAA;AAAA,IAEJ;AAEA,WAAO;AAAA,MACL;AAAA,MACA,aAAaC,MAAQ,SAAS,CAAA,GAAI,uBAAuB;AAAA,IAAA;AAAA,EAE7D,SAAS,GAAG;AACV,iBAAa,MAAM,oCAAoC;AACvD,UAAM;AAAA,EACR;AACF;"}

package/out/zero-cache/src/server/anonymous-otel-start.d.ts

@@ -1,5 +1,14 @@
 import type { LogContext } from '@rocicorp/logger';
 import { type ZeroConfig } from '../config/zero-config.js';
+export type ActiveUsers = {
+    active_users_last_day: number;
+    users_1da: number;
+    users_7da: number;
+    users_30da: number;
+    users_1da_legacy: number;
+    users_7da_legacy: number;
+    users_30da_legacy: number;
+};
 export declare const startAnonymousTelemetry: (lc?: LogContext, config?: ZeroConfig) => void;
 export declare const recordMutation: (type: "crud" | "custom", count?: number) => void;
 export declare const recordQuery: (type: "crud" | "custom", count?: number) => void;
@@ -7,6 +16,6 @@ export declare const recordRowsSynced: (count: number) => void;
 export declare const recordConnectionSuccess: () => void;
 export declare const recordConnectionAttempted: () => void;
 export declare const setActiveClientGroupsGetter: (getter: () => number) => void;
-export declare const setActiveUsersGetter: (getter: () => number) => void;
+export declare const setActiveUsersGetter: (getter: () => ActiveUsers) => void;
 export declare const shutdownAnonymousTelemetry: () => void;
 //# sourceMappingURL=anonymous-otel-start.d.ts.map