@rocicorp/zero 0.26.1 → 0.26.2-canary.4

package/out/zero-cache/src/scripts/decommission.js

@@ -1,55 +1,50 @@
 import { logOptions } from "../../../otel/src/log-options.js";
-import { zeroOptions, shardOptions, appOptions } from "../config/zero-config.js";
-import { decommissionShard } from "../services/change-source/pg/decommission.js";
+import { cdcSchema, cvrSchema, getShardID } from "../types/shards.js";
+import { appOptions, shardOptions, zeroOptions } from "../config/zero-config.js";
 import { pgClient } from "../types/pg.js";
-import { getShardID, cvrSchema, cdcSchema } from "../types/shards.js";
 import { id } from "../types/sql.js";
-const decommissionOptions = {
-  app: {
-    id: appOptions.id
-  },
-  shard: {
-    num: shardOptions.num
-  },
-  upstream: {
-    db: zeroOptions.upstream.db,
-    type: zeroOptions.upstream.type
-  },
-  cvr: {
-    db: zeroOptions.cvr.db
-  },
-  change: {
-    db: zeroOptions.change.db
-  },
-  log: { level: logOptions.level, format: logOptions.format }
+import { decommissionShard } from "../services/change-source/pg/decommission.js";
+//#region ../zero-cache/src/scripts/decommission.ts
+var decommissionOptions = {
+	app: { id: appOptions.id },
+	shard: { num: shardOptions.num },
+	upstream: {
+		db: zeroOptions.upstream.db,
+		type: zeroOptions.upstream.type
+	},
+	cvr: { db: zeroOptions.cvr.db },
+	change: { db: zeroOptions.change.db },
+	log: {
+		level: logOptions.level,
+		format: logOptions.format
+	}
 };
 async function decommissionZero(lc, cfg) {
-  const { app, shard } = cfg;
-  const shardID = getShardID(cfg);
-  lc.info?.(`Decommissioning app "${app.id}"`);
-  if (cfg.upstream.type === "pg") {
-    const upstream = pgClient(lc, cfg.upstream.db);
-    await decommissionShard(lc, upstream, app.id, shard.num);
-    lc.debug?.(`Cleaning up upstream metadata from ${hostPort(upstream)}`);
-    await upstream.unsafe(`DROP SCHEMA IF EXISTS ${id(app.id)} CASCADE`);
-    await upstream.end();
-  }
-  const cvr = pgClient(lc, cfg.cvr.db ?? cfg.upstream.db);
-  lc.debug?.(`Cleaning up cvc data from ${hostPort(cvr)}`);
-  await cvr.unsafe(`DROP SCHEMA IF EXISTS ${id(cvrSchema(shardID))} CASCADE`);
-  await cvr.end();
-  const cdc = pgClient(lc, cfg.change.db ?? cfg.upstream.db);
-  lc.debug?.(`Cleaning up cdc data from ${hostPort(cdc)}`);
-  await cdc.unsafe(`DROP SCHEMA IF EXISTS ${id(cdcSchema(shardID))} CASCADE`);
-  await cdc.end();
-  lc.info?.(`App "${app.id}" decommissioned`);
+	const { app, shard } = cfg;
+	const shardID = getShardID(cfg);
+	lc.info?.(`Decommissioning app "${app.id}"`);
+	if (cfg.upstream.type === "pg") {
+		const upstream = pgClient(lc, cfg.upstream.db);
+		await decommissionShard(lc, upstream, app.id, shard.num);
+		lc.debug?.(`Cleaning up upstream metadata from ${hostPort(upstream)}`);
+		await upstream.unsafe(`DROP SCHEMA IF EXISTS ${id(app.id)} CASCADE`);
+		await upstream.end();
+	}
+	const cvr = pgClient(lc, cfg.cvr.db ?? cfg.upstream.db);
+	lc.debug?.(`Cleaning up cvc data from ${hostPort(cvr)}`);
+	await cvr.unsafe(`DROP SCHEMA IF EXISTS ${id(cvrSchema(shardID))} CASCADE`);
+	await cvr.end();
+	const cdc = pgClient(lc, cfg.change.db ?? cfg.upstream.db);
+	lc.debug?.(`Cleaning up cdc data from ${hostPort(cdc)}`);
+	await cdc.unsafe(`DROP SCHEMA IF EXISTS ${id(cdcSchema(shardID))} CASCADE`);
+	await cdc.end();
+	lc.info?.(`App "${app.id}" decommissioned`);
 }
 function hostPort(db) {
-  const { host, port } = db.options;
-  return `${host.join(",")}:${port?.at(0) ?? 5432}`;
+	const { host, port } = db.options;
+	return `${host.join(",")}:${port?.at(0) ?? 5432}`;
 }
-export {
-  decommissionOptions,
-  decommissionZero
-};
-//# sourceMappingURL=decommission.js.map
+//#endregion
+export { decommissionOptions, decommissionZero };
+
+//# sourceMappingURL=decommission.js.map

package/out/zero-cache/src/scripts/decommission.js.map

@@ -1 +1 @@
-{"version":3,"file":"decommission.js","sources":["../../../../../zero-cache/src/scripts/decommission.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {logOptions} from '../../../otel/src/log-options.ts';\nimport type {Config} from '../../../shared/src/options.ts';\nimport {appOptions, shardOptions, zeroOptions} from '../config/zero-config.ts';\nimport {decommissionShard} from '../services/change-source/pg/decommission.ts';\nimport {pgClient, type PostgresDB} from '../types/pg.ts';\nimport {cdcSchema, cvrSchema, getShardID} from '../types/shards.ts';\nimport {id} from '../types/sql.ts';\n\nexport const decommissionOptions = {\n  app: {\n    id: appOptions.id,\n  },\n\n  shard: {\n    num: shardOptions.num,\n  },\n\n  upstream: {\n    db: zeroOptions.upstream.db,\n    type: zeroOptions.upstream.type,\n  },\n\n  cvr: {\n    db: zeroOptions.cvr.db,\n  },\n\n  change: {\n    db: zeroOptions.change.db,\n  },\n\n  log: {level: logOptions.level, format: logOptions.format},\n};\n\nexport type DecommissionConfig = Config<typeof decommissionOptions>;\n\nexport async function decommissionZero(\n  lc: LogContext,\n  cfg: DecommissionConfig,\n) {\n  const {app, shard} = cfg;\n  const shardID = getShardID(cfg);\n  lc.info?.(`Decommissioning app \"${app.id}\"`);\n\n  if (cfg.upstream.type === 'pg') {\n    const upstream = pgClient(lc, cfg.upstream.db);\n    await decommissionShard(lc, upstream, app.id, shard.num);\n\n    lc.debug?.(`Cleaning up upstream metadata from ${hostPort(upstream)}`);\n    await upstream.unsafe(`DROP SCHEMA IF EXISTS ${id(app.id)} CASCADE`);\n    await upstream.end();\n  }\n\n  const cvr = pgClient(lc, cfg.cvr.db ?? cfg.upstream.db);\n  lc.debug?.(`Cleaning up cvc data from ${hostPort(cvr)}`);\n  await cvr.unsafe(`DROP SCHEMA IF EXISTS ${id(cvrSchema(shardID))} CASCADE`);\n  await cvr.end();\n\n  const cdc = pgClient(lc, cfg.change.db ?? cfg.upstream.db);\n  lc.debug?.(`Cleaning up cdc data from ${hostPort(cdc)}`);\n  await cdc.unsafe(`DROP SCHEMA IF EXISTS ${id(cdcSchema(shardID))} CASCADE`);\n  await cdc.end();\n\n  lc.info?.(`App \"${app.id}\" decommissioned`);\n}\n\nfunction hostPort(db: PostgresDB) {\n  const {host, port} = db.options;\n  return `${host.join(',')}:${port?.at(0) ?? 5432}`;\n}\n"],"names":[],"mappings":";;;;;;AASO,MAAM,sBAAsB;AAAA,EACjC,KAAK;AAAA,IACH,IAAI,WAAW;AAAA,EAAA;AAAA,EAGjB,OAAO;AAAA,IACL,KAAK,aAAa;AAAA,EAAA;AAAA,EAGpB,UAAU;AAAA,IACR,IAAI,YAAY,SAAS;AAAA,IACzB,MAAM,YAAY,SAAS;AAAA,EAAA;AAAA,EAG7B,KAAK;AAAA,IACH,IAAI,YAAY,IAAI;AAAA,EAAA;AAAA,EAGtB,QAAQ;AAAA,IACN,IAAI,YAAY,OAAO;AAAA,EAAA;AAAA,EAGzB,KAAK,EAAC,OAAO,WAAW,OAAO,QAAQ,WAAW,OAAA;AACpD;AAIA,eAAsB,iBACpB,IACA,KACA;AACA,QAAM,EAAC,KAAK,MAAA,IAAS;AACrB,QAAM,UAAU,WAAW,GAAG;AAC9B,KAAG,OAAO,wBAAwB,IAAI,EAAE,GAAG;AAE3C,MAAI,IAAI,SAAS,SAAS,MAAM;AAC9B,UAAM,WAAW,SAAS,IAAI,IAAI,SAAS,EAAE;AAC7C,UAAM,kBAAkB,IAAI,UAAU,IAAI,IAAI,MAAM,GAAG;AAEvD,OAAG,QAAQ,sCAAsC,SAAS,QAAQ,CAAC,EAAE;AACrE,UAAM,SAAS,OAAO,yBAAyB,GAAG,IAAI,EAAE,CAAC,UAAU;AACnE,UAAM,SAAS,IAAA;AAAA,EACjB;AAEA,QAAM,MAAM,SAAS,IAAI,IAAI,IAAI,MAAM,IAAI,SAAS,EAAE;AACtD,KAAG,QAAQ,6BAA6B,SAAS,GAAG,CAAC,EAAE;AACvD,QAAM,IAAI,OAAO,yBAAyB,GAAG,UAAU,OAAO,CAAC,CAAC,UAAU;AAC1E,QAAM,IAAI,IAAA;AAEV,QAAM,MAAM,SAAS,IAAI,IAAI,OAAO,MAAM,IAAI,SAAS,EAAE;AACzD,KAAG,QAAQ,6BAA6B,SAAS,GAAG,CAAC,EAAE;AACvD,QAAM,IAAI,OAAO,yBAAyB,GAAG,UAAU,OAAO,CAAC,CAAC,UAAU;AAC1E,QAAM,IAAI,IAAA;AAEV,KAAG,OAAO,QAAQ,IAAI,EAAE,kBAAkB;AAC5C;AAEA,SAAS,SAAS,IAAgB;AAChC,QAAM,EAAC,MAAM,KAAA,IAAQ,GAAG;AACxB,SAAO,GAAG,KAAK,KAAK,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,KAAK,IAAI;AACjD;"}
+{"version":3,"file":"decommission.js","names":[],"sources":["../../../../../zero-cache/src/scripts/decommission.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {logOptions} from '../../../otel/src/log-options.ts';\nimport type {Config} from '../../../shared/src/options.ts';\nimport {appOptions, shardOptions, zeroOptions} from '../config/zero-config.ts';\nimport {decommissionShard} from '../services/change-source/pg/decommission.ts';\nimport {pgClient, type PostgresDB} from '../types/pg.ts';\nimport {cdcSchema, cvrSchema, getShardID} from '../types/shards.ts';\nimport {id} from '../types/sql.ts';\n\nexport const decommissionOptions = {\n  app: {\n    id: appOptions.id,\n  },\n\n  shard: {\n    num: shardOptions.num,\n  },\n\n  upstream: {\n    db: zeroOptions.upstream.db,\n    type: zeroOptions.upstream.type,\n  },\n\n  cvr: {\n    db: zeroOptions.cvr.db,\n  },\n\n  change: {\n    db: zeroOptions.change.db,\n  },\n\n  log: {level: logOptions.level, format: logOptions.format},\n};\n\nexport type DecommissionConfig = Config<typeof decommissionOptions>;\n\nexport async function decommissionZero(\n  lc: LogContext,\n  cfg: DecommissionConfig,\n) {\n  const {app, shard} = cfg;\n  const shardID = getShardID(cfg);\n  lc.info?.(`Decommissioning app \"${app.id}\"`);\n\n  if (cfg.upstream.type === 'pg') {\n    const upstream = pgClient(lc, cfg.upstream.db);\n    await decommissionShard(lc, upstream, app.id, shard.num);\n\n    lc.debug?.(`Cleaning up upstream metadata from ${hostPort(upstream)}`);\n    await upstream.unsafe(`DROP SCHEMA IF EXISTS ${id(app.id)} CASCADE`);\n    await upstream.end();\n  }\n\n  const cvr = pgClient(lc, cfg.cvr.db ?? cfg.upstream.db);\n  lc.debug?.(`Cleaning up cvc data from ${hostPort(cvr)}`);\n  await cvr.unsafe(`DROP SCHEMA IF EXISTS ${id(cvrSchema(shardID))} CASCADE`);\n  await cvr.end();\n\n  const cdc = pgClient(lc, cfg.change.db ?? cfg.upstream.db);\n  lc.debug?.(`Cleaning up cdc data from ${hostPort(cdc)}`);\n  await cdc.unsafe(`DROP SCHEMA IF EXISTS ${id(cdcSchema(shardID))} CASCADE`);\n  await cdc.end();\n\n  lc.info?.(`App \"${app.id}\" decommissioned`);\n}\n\nfunction hostPort(db: PostgresDB) {\n  const {host, port} = db.options;\n  return `${host.join(',')}:${port?.at(0) ?? 5432}`;\n}\n"],"mappings":";;;;;;;AASA,IAAa,sBAAsB;CACjC,KAAK,EACH,IAAI,WAAW,IAChB;CAED,OAAO,EACL,KAAK,aAAa,KACnB;CAED,UAAU;EACR,IAAI,YAAY,SAAS;EACzB,MAAM,YAAY,SAAS;EAC5B;CAED,KAAK,EACH,IAAI,YAAY,IAAI,IACrB;CAED,QAAQ,EACN,IAAI,YAAY,OAAO,IACxB;CAED,KAAK;EAAC,OAAO,WAAW;EAAO,QAAQ,WAAW;EAAO;CAC1D;AAID,eAAsB,iBACpB,IACA,KACA;CACA,MAAM,EAAC,KAAK,UAAS;CACrB,MAAM,UAAU,WAAW,IAAI;AAC/B,IAAG,OAAO,wBAAwB,IAAI,GAAG,GAAG;AAE5C,KAAI,IAAI,SAAS,SAAS,MAAM;EAC9B,MAAM,WAAW,SAAS,IAAI,IAAI,SAAS,GAAG;AAC9C,QAAM,kBAAkB,IAAI,UAAU,IAAI,IAAI,MAAM,IAAI;AAExD,KAAG,QAAQ,sCAAsC,SAAS,SAAS,GAAG;AACtE,QAAM,SAAS,OAAO,yBAAyB,GAAG,IAAI,GAAG,CAAC,UAAU;AACpE,QAAM,SAAS,KAAK;;CAGtB,MAAM,MAAM,SAAS,IAAI,IAAI,IAAI,MAAM,IAAI,SAAS,GAAG;AACvD,IAAG,QAAQ,6BAA6B,SAAS,IAAI,GAAG;AACxD,OAAM,IAAI,OAAO,yBAAyB,GAAG,UAAU,QAAQ,CAAC,CAAC,UAAU;AAC3E,OAAM,IAAI,KAAK;CAEf,MAAM,MAAM,SAAS,IAAI,IAAI,OAAO,MAAM,IAAI,SAAS,GAAG;AAC1D,IAAG,QAAQ,6BAA6B,SAAS,IAAI,GAAG;AACxD,OAAM,IAAI,OAAO,yBAAyB,GAAG,UAAU,QAAQ,CAAC,CAAC,UAAU;AAC3E,OAAM,IAAI,KAAK;AAEf,IAAG,OAAO,QAAQ,IAAI,GAAG,kBAAkB;;AAG7C,SAAS,SAAS,IAAgB;CAChC,MAAM,EAAC,MAAM,SAAQ,GAAG;AACxB,QAAO,GAAG,KAAK,KAAK,IAAI,CAAC,GAAG,MAAM,GAAG,EAAE,IAAI"}

package/out/zero-cache/src/scripts/deploy-permissions.js

@@ -1,165 +1,127 @@
-import "../../../shared/src/dotenv.js";
-import { writeFile } from "node:fs/promises";
-import { ident, literal } from "pg-format";
-import { createLogContext, colorConsole } from "../../../shared/src/logging.js";
-import { parseOptions } from "../../../shared/src/options.js";
-import { difference } from "../../../shared/src/set-utils.js";
 import { mapCondition } from "../../../zero-protocol/src/ast.js";
-import "../../../zero-schema/src/compiled-permissions.js";
 import { validator } from "../../../zero-schema/src/name-mapper.js";
+import { difference } from "../../../shared/src/set-utils.js";
+import "../../../shared/src/dotenv.js";
+import { parseOptions } from "../../../shared/src/options.js";
+import { appSchema, getShardID, upstreamSchema } from "../types/shards.js";
 import { ZERO_ENV_VAR_PREFIX } from "../config/zero-config.js";
-import { runTx } from "../db/run-transaction.js";
-import { getPublicationInfo } from "../services/change-source/pg/schema/published.js";
-import { ensureGlobalTables, SHARD_CONFIG_TABLE } from "../services/change-source/pg/schema/shard.js";
-import { liteTableName } from "../types/names.js";
+import { colorConsole, createLogContext } from "../../../shared/src/logging.js";
 import { pgClient } from "../types/pg.js";
-import { getShardID, appSchema, upstreamSchema } from "../types/shards.js";
+import { liteTableName } from "../types/names.js";
+import "../../../zero-schema/src/compiled-permissions.js";
 import { deployPermissionsOptions, loadSchemaAndPermissions } from "./permissions.js";
-const config = parseOptions(deployPermissionsOptions, {
-  argv: process.argv.slice(2),
-  envNamePrefix: ZERO_ENV_VAR_PREFIX
+import { runTx } from "../db/run-transaction.js";
+import { getPublicationInfo } from "../services/change-source/pg/schema/published.js";
+import { SHARD_CONFIG_TABLE, ensureGlobalTables } from "../services/change-source/pg/schema/shard.js";
+import { writeFile } from "node:fs/promises";
+import { ident, literal } from "pg-format";
+//#region ../zero-cache/src/scripts/deploy-permissions.ts
+var config = parseOptions(deployPermissionsOptions, {
+	argv: process.argv.slice(2),
+	envNamePrefix: ZERO_ENV_VAR_PREFIX
 });
-const shard = getShardID(config);
-const app = appSchema(shard);
-const lc = createLogContext(config);
+var shard = getShardID(config);
+var app = appSchema(shard);
+var lc = createLogContext(config);
 async function validatePermissions(db, permissions) {
-  const schema = upstreamSchema(shard);
-  const result = await db`
+	const schema = upstreamSchema(shard);
+	if ((await db`
     SELECT relname FROM pg_class
       JOIN pg_namespace ON relnamespace = pg_namespace.oid
-      WHERE nspname = ${schema} AND relname = ${SHARD_CONFIG_TABLE}`;
-  if (result.length === 0) {
-    colorConsole.warn(
-      `zero-cache has not yet initialized the upstream database.
-Deploying ${app} permissions without validating against published tables/columns.`
-    );
-    return;
-  }
-  const config2 = await db`
+      WHERE nspname = ${schema} AND relname = ${"shardConfig"}`).length === 0) {
+		colorConsole.warn(`zero-cache has not yet initialized the upstream database.\nDeploying ${app} permissions without validating against published tables/columns.`);
+		return;
+	}
+	const config = await db`
     SELECT publications FROM ${db(schema + "." + SHARD_CONFIG_TABLE)}
   `;
-  if (config2.length === 0) {
-    colorConsole.warn(
-      `zero-cache has not yet initialized the upstream database.
-Deploying ${app} permissions without validating against published tables/columns.`
-    );
-    return;
-  }
-  colorConsole.info(
-    `Validating permissions against tables and columns published for "${app}".`
-  );
-  const [{ publications: shardPublications }] = config2;
-  const { tables, publications } = await getPublicationInfo(
-    db,
-    shardPublications
-  );
-  const pubnames = publications.map((p) => p.pubname);
-  const missing = difference(new Set(shardPublications), new Set(pubnames));
-  if (missing.size) {
-    colorConsole.warn(
-      `Upstream is missing expected publications "${[...missing]}".
-You may need to re-initialize your replica.
-Deploying ${app} permissions without validating against published tables/columns.`
-    );
-    return;
-  }
-  const tablesToColumns = new Map(
-    tables.map((t) => [liteTableName(t), Object.keys(t.columns)])
-  );
-  const validate = validator(tablesToColumns);
-  try {
-    for (const [table, perms] of Object.entries(permissions?.tables ?? {})) {
-      const validateRule = ([_, cond]) => {
-        mapCondition(cond, table, validate);
-      };
-      const validateAsset = (asset) => {
-        asset?.select?.forEach(validateRule);
-        asset?.delete?.forEach(validateRule);
-        asset?.insert?.forEach(validateRule);
-        asset?.update?.preMutation?.forEach(validateRule);
-        asset?.update?.postMutation?.forEach(validateRule);
-      };
-      validateAsset(perms.row);
-      if (perms.cell) {
-        Object.values(perms.cell).forEach(validateAsset);
-      }
-    }
-  } catch (e) {
-    failWithMessage(String(e));
-  }
+	if (config.length === 0) {
+		colorConsole.warn(`zero-cache has not yet initialized the upstream database.\nDeploying ${app} permissions without validating against published tables/columns.`);
+		return;
+	}
+	colorConsole.info(`Validating permissions against tables and columns published for "${app}".`);
+	const [{ publications: shardPublications }] = config;
+	const { tables, publications } = await getPublicationInfo(db, shardPublications);
+	const pubnames = publications.map((p) => p.pubname);
+	const missing = difference(new Set(shardPublications), new Set(pubnames));
+	if (missing.size) {
+		colorConsole.warn(`Upstream is missing expected publications "${[...missing]}".\nYou may need to re-initialize your replica.\nDeploying ${app} permissions without validating against published tables/columns.`);
+		return;
+	}
+	const validate = validator(new Map(tables.map((t) => [liteTableName(t), Object.keys(t.columns)])));
+	try {
+		for (const [table, perms] of Object.entries(permissions?.tables ?? {})) {
+			const validateRule = ([_, cond]) => {
+				mapCondition(cond, table, validate);
+			};
+			const validateAsset = (asset) => {
+				asset?.select?.forEach(validateRule);
+				asset?.delete?.forEach(validateRule);
+				asset?.insert?.forEach(validateRule);
+				asset?.update?.preMutation?.forEach(validateRule);
+				asset?.update?.postMutation?.forEach(validateRule);
+			};
+			validateAsset(perms.row);
+			if (perms.cell) Object.values(perms.cell).forEach(validateAsset);
+		}
+	} catch (e) {
+		failWithMessage(String(e));
+	}
 }
 function failWithMessage(msg) {
-  colorConsole.error(msg);
-  colorConsole.info("\nUse --force to deploy at your own risk.\n");
-  process.exit(-1);
+	colorConsole.error(msg);
+	colorConsole.info("\nUse --force to deploy at your own risk.\n");
+	process.exit(-1);
 }
 async function deployPermissions(upstreamURI, permissions, force) {
-  const db = pgClient(lc, upstreamURI);
-  const { host, port } = db.options;
-  colorConsole.debug(`Connecting to upstream@${host}:${port}`);
-  try {
-    await ensureGlobalTables(db, shard);
-    const { hash, changed } = await runTx(db, async (tx) => {
-      if (force) {
-        colorConsole.warn(`--force specified. Skipping validation.`);
-      } else {
-        await validatePermissions(tx, permissions);
-      }
-      const { appID } = shard;
-      colorConsole.info(
-        `Deploying permissions for --app-id "${appID}" to upstream@${db.options.host}`
-      );
-      const [{ hash: beforeHash }] = await tx`
+	const db = pgClient(lc, upstreamURI);
+	const { host, port } = db.options;
+	colorConsole.debug(`Connecting to upstream@${host}:${port}`);
+	try {
+		await ensureGlobalTables(db, shard);
+		const { hash, changed } = await runTx(db, async (tx) => {
+			if (force) colorConsole.warn(`--force specified. Skipping validation.`);
+			else await validatePermissions(tx, permissions);
+			const { appID } = shard;
+			colorConsole.info(`Deploying permissions for --app-id "${appID}" to upstream@${db.options.host}`);
+			const [{ hash: beforeHash }] = await tx`
         SELECT hash from ${tx(app)}.permissions`;
-      const [{ hash: hash2 }] = await tx`
+			const [{ hash }] = await tx`
         UPDATE ${tx(app)}.permissions SET ${db({ permissions })} RETURNING hash`;
-      return { hash: hash2.substring(0, 7), changed: beforeHash !== hash2 };
-    });
-    if (changed) {
-      colorConsole.info(`Deployed new permissions (hash=${hash})`);
-    } else {
-      colorConsole.info(`Permissions unchanged (hash=${hash})`);
-    }
-  } finally {
-    await db.end();
-  }
+			return {
+				hash: hash.substring(0, 7),
+				changed: beforeHash !== hash
+			};
+		});
+		if (changed) colorConsole.info(`Deployed new permissions (hash=${hash})`);
+		else colorConsole.info(`Permissions unchanged (hash=${hash})`);
+	} finally {
+		await db.end();
+	}
 }
 async function writePermissionsFile(perms, file, format) {
-  const contents = format === "sql" ? `UPDATE ${ident(app)}.permissions SET permissions = ${literal(
-    JSON.stringify(perms)
-  )};` : JSON.stringify(perms, null, format === "pretty" ? 2 : 0);
-  await writeFile(file, contents);
-  colorConsole.info(`Wrote ${format} permissions to ${config.output.file}`);
+	await writeFile(file, format === "sql" ? `UPDATE ${ident(app)}.permissions SET permissions = ${literal(JSON.stringify(perms))};` : JSON.stringify(perms, null, format === "pretty" ? 2 : 0));
+	colorConsole.info(`Wrote ${format} permissions to ${config.output.file}`);
 }
-const ret = await loadSchemaAndPermissions(config.schema.path, true);
-if (!ret || Object.keys(ret?.permissions ?? {}).length === 0) {
-  colorConsole.warn(
-    `No permissions found at ${config.schema.path}, so could not deploy permissions. Replicating data, but no tables will be syncable. Create a schema file with permissions to be able to sync data.`
-  );
-} else {
-  colorConsole.warn(
-    `Permissions are deprecated and will be removed in an upcoming release. See: https://zero.rocicorp.dev/docs/auth.`
-  );
-  const { permissions } = ret;
-  if (config.output.file) {
-    await writePermissionsFile(
-      permissions,
-      config.output.file,
-      config.output.format
-    );
-  } else if (config.upstream.type !== "pg") {
-    colorConsole.warn(
-      `Permissions deployment is not supported for ${config.upstream.type} upstreams`
-    );
-    process.exit(-1);
-  } else if (config.upstream.db) {
-    await deployPermissions(config.upstream.db, permissions, config.force);
-  } else {
-    colorConsole.error(`No --output-file or --upstream-db specified`);
-    parseOptions(deployPermissionsOptions, {
-      argv: ["--help"],
-      envNamePrefix: ZERO_ENV_VAR_PREFIX
-    });
-  }
+var ret = await loadSchemaAndPermissions(config.schema.path, true);
+if (!ret || Object.keys(ret?.permissions ?? {}).length === 0) colorConsole.warn(`No permissions found at ${config.schema.path}, so could not deploy permissions. Replicating data, but no tables will be syncable. Create a schema file with permissions to be able to sync data.`);
+else {
+	colorConsole.warn(`Permissions are deprecated and will be removed in an upcoming release. See: https://zero.rocicorp.dev/docs/auth.`);
+	const { permissions } = ret;
+	if (config.output.file) await writePermissionsFile(permissions, config.output.file, config.output.format);
+	else if (config.upstream.type !== "pg") {
+		colorConsole.warn(`Permissions deployment is not supported for ${config.upstream.type} upstreams`);
+		process.exit(-1);
+	} else if (config.upstream.db) await deployPermissions(config.upstream.db, permissions, config.force);
+	else {
+		colorConsole.error(`No --output-file or --upstream-db specified`);
+		parseOptions(deployPermissionsOptions, {
+			argv: ["--help"],
+			envNamePrefix: ZERO_ENV_VAR_PREFIX
+		});
+	}
 }
-//# sourceMappingURL=deploy-permissions.js.map
+//#endregion
+export {};
+
+//# sourceMappingURL=deploy-permissions.js.map

package/out/zero-cache/src/scripts/deploy-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-permissions.js","sources":["../../../../../zero-cache/src/scripts/deploy-permissions.ts"],"sourcesContent":["import '../../../shared/src/dotenv.ts';\n\nimport {writeFile} from 'node:fs/promises';\nimport {ident as id, literal} from 'pg-format';\nimport {colorConsole, createLogContext} from '../../../shared/src/logging.ts';\nimport {parseOptions} from '../../../shared/src/options.ts';\nimport {difference} from '../../../shared/src/set-utils.ts';\nimport {mapCondition} from '../../../zero-protocol/src/ast.ts';\nimport {\n  type AssetPermissions,\n  type PermissionsConfig,\n  type Rule,\n} from '../../../zero-schema/src/compiled-permissions.ts';\nimport {validator} from '../../../zero-schema/src/name-mapper.ts';\nimport {ZERO_ENV_VAR_PREFIX} from '../config/zero-config.ts';\nimport {runTx} from '../db/run-transaction.ts';\nimport {getPublicationInfo} from '../services/change-source/pg/schema/published.ts';\nimport {\n  ensureGlobalTables,\n  SHARD_CONFIG_TABLE,\n} from '../services/change-source/pg/schema/shard.ts';\nimport {liteTableName} from '../types/names.ts';\nimport {pgClient, type PostgresDB} from '../types/pg.ts';\nimport {appSchema, getShardID, upstreamSchema} from '../types/shards.ts';\nimport {\n  deployPermissionsOptions,\n  loadSchemaAndPermissions,\n} from './permissions.ts';\n\nconst config = parseOptions(deployPermissionsOptions, {\n  argv: process.argv.slice(2),\n  envNamePrefix: ZERO_ENV_VAR_PREFIX,\n});\n\nconst shard = getShardID(config);\nconst app = appSchema(shard);\n\nconst lc = createLogContext(config);\n\nasync function validatePermissions(\n  db: PostgresDB,\n  permissions: PermissionsConfig,\n) {\n  const schema = upstreamSchema(shard);\n\n  // Check if the shardConfig table has been initialized.\n  const result = await db`\n    SELECT relname FROM pg_class\n      JOIN pg_namespace ON relnamespace = pg_namespace.oid\n      WHERE nspname = ${schema} AND relname = ${SHARD_CONFIG_TABLE}`;\n  if (result.length === 0) {\n    colorConsole.warn(\n      `zero-cache has not yet initialized the upstream database.\\n` +\n        `Deploying ${app} permissions without validating against published tables/columns.`,\n    );\n    return;\n  }\n\n  // Get the publications for the shard\n  const config = await db<{publications: string[]}[]>`\n    SELECT publications FROM ${db(schema + '.' + SHARD_CONFIG_TABLE)}\n  `;\n  if (config.length === 0) {\n    colorConsole.warn(\n      `zero-cache has not yet initialized the upstream database.\\n` +\n        `Deploying ${app} permissions without validating against published tables/columns.`,\n    );\n    return;\n  }\n  colorConsole.info(\n    `Validating permissions against tables and columns published for \"${app}\".`,\n  );\n\n  const [{publications: shardPublications}] = config;\n  const {tables, publications} = await getPublicationInfo(\n    db,\n    shardPublications,\n  );\n  const pubnames = publications.map(p => p.pubname);\n  const missing = difference(new Set(shardPublications), new Set(pubnames));\n  if (missing.size) {\n    colorConsole.warn(\n      `Upstream is missing expected publications \"${[...missing]}\".\\n` +\n        `You may need to re-initialize your replica.\\n` +\n        `Deploying ${app} permissions without validating against published tables/columns.`,\n    );\n    return;\n  }\n  const tablesToColumns = new Map(\n    tables.map(t => [liteTableName(t), Object.keys(t.columns)]),\n  );\n  const validate = validator(tablesToColumns);\n  try {\n    for (const [table, perms] of Object.entries(permissions?.tables ?? {})) {\n      const validateRule = ([_, cond]: Rule) => {\n        mapCondition(cond, table, validate);\n      };\n      const validateAsset = (asset: AssetPermissions | undefined) => {\n        asset?.select?.forEach(validateRule);\n        asset?.delete?.forEach(validateRule);\n        asset?.insert?.forEach(validateRule);\n        asset?.update?.preMutation?.forEach(validateRule);\n        asset?.update?.postMutation?.forEach(validateRule);\n      };\n      validateAsset(perms.row);\n      if (perms.cell) {\n        Object.values(perms.cell).forEach(validateAsset);\n      }\n    }\n  } catch (e) {\n    failWithMessage(String(e));\n  }\n}\n\nfunction failWithMessage(msg: string) {\n  colorConsole.error(msg);\n  colorConsole.info('\\nUse --force to deploy at your own risk.\\n');\n  process.exit(-1);\n}\n\nasync function deployPermissions(\n  upstreamURI: string,\n  permissions: PermissionsConfig,\n  force: boolean,\n) {\n  const db = pgClient(lc, upstreamURI);\n  const {host, port} = db.options;\n  colorConsole.debug(`Connecting to upstream@${host}:${port}`);\n  try {\n    await ensureGlobalTables(db, shard);\n\n    const {hash, changed} = await runTx(db, async tx => {\n      if (force) {\n        colorConsole.warn(`--force specified. Skipping validation.`);\n      } else {\n        await validatePermissions(tx, permissions);\n      }\n\n      const {appID} = shard;\n      colorConsole.info(\n        `Deploying permissions for --app-id \"${appID}\" to upstream@${db.options.host}`,\n      );\n      const [{hash: beforeHash}] = await tx<{hash: string}[]>`\n        SELECT hash from ${tx(app)}.permissions`;\n      const [{hash}] = await tx<{hash: string}[]>`\n        UPDATE ${tx(app)}.permissions SET ${db({permissions})} RETURNING hash`;\n\n      return {hash: hash.substring(0, 7), changed: beforeHash !== hash};\n    });\n    if (changed) {\n      colorConsole.info(`Deployed new permissions (hash=${hash})`);\n    } else {\n      colorConsole.info(`Permissions unchanged (hash=${hash})`);\n    }\n  } finally {\n    await db.end();\n  }\n}\n\nasync function writePermissionsFile(\n  perms: PermissionsConfig,\n  file: string,\n  format: 'sql' | 'json' | 'pretty',\n) {\n  const contents =\n    format === 'sql'\n      ? `UPDATE ${id(app)}.permissions SET permissions = ${literal(\n          JSON.stringify(perms),\n        )};`\n      : JSON.stringify(perms, null, format === 'pretty' ? 2 : 0);\n  await writeFile(file, contents);\n  colorConsole.info(`Wrote ${format} permissions to ${config.output.file}`);\n}\n\nconst ret = await loadSchemaAndPermissions(config.schema.path, true);\nif (!ret || Object.keys(ret?.permissions ?? {}).length === 0) {\n  colorConsole.warn(\n    `No permissions found at ${config.schema.path}, so could not deploy ` +\n      `permissions. Replicating data, but no tables will be syncable. ` +\n      `Create a schema file with permissions to be able to sync data.`,\n  );\n} else {\n  colorConsole.warn(\n    `Permissions are deprecated and will be removed in an upcoming release. See: https://zero.rocicorp.dev/docs/auth.`,\n  );\n\n  const {permissions} = ret;\n  if (config.output.file) {\n    await writePermissionsFile(\n      permissions,\n      config.output.file,\n      config.output.format,\n    );\n  } else if (config.upstream.type !== 'pg') {\n    colorConsole.warn(\n      `Permissions deployment is not supported for ${config.upstream.type} upstreams`,\n    );\n    process.exit(-1);\n  } else if (config.upstream.db) {\n    await deployPermissions(config.upstream.db, permissions, config.force);\n  } else {\n    colorConsole.error(`No --output-file or --upstream-db specified`);\n    // Shows the usage text.\n    parseOptions(deployPermissionsOptions, {\n      argv: ['--help'],\n      envNamePrefix: ZERO_ENV_VAR_PREFIX,\n    });\n  }\n}\n"],"names":["config","hash","id"],"mappings":";;;;;;;;;;;;;;;;;AA6BA,MAAM,SAAS,aAAa,0BAA0B;AAAA,EACpD,MAAM,QAAQ,KAAK,MAAM,CAAC;AAAA,EAC1B,eAAe;AACjB,CAAC;AAED,MAAM,QAAQ,WAAW,MAAM;AAC/B,MAAM,MAAM,UAAU,KAAK;AAE3B,MAAM,KAAK,iBAAiB,MAAM;AAElC,eAAe,oBACb,IACA,aACA;AACA,QAAM,SAAS,eAAe,KAAK;AAGnC,QAAM,SAAS,MAAM;AAAA;AAAA;AAAA,wBAGC,MAAM,kBAAkB,kBAAkB;AAChE,MAAI,OAAO,WAAW,GAAG;AACvB,iBAAa;AAAA,MACX;AAAA,YACe,GAAG;AAAA,IAAA;AAEpB;AAAA,EACF;AAGA,QAAMA,UAAS,MAAM;AAAA,+BACQ,GAAG,SAAS,MAAM,kBAAkB,CAAC;AAAA;AAElE,MAAIA,QAAO,WAAW,GAAG;AACvB,iBAAa;AAAA,MACX;AAAA,YACe,GAAG;AAAA,IAAA;AAEpB;AAAA,EACF;AACA,eAAa;AAAA,IACX,oEAAoE,GAAG;AAAA,EAAA;AAGzE,QAAM,CAAC,EAAC,cAAc,kBAAA,CAAkB,IAAIA;AAC5C,QAAM,EAAC,QAAQ,aAAA,IAAgB,MAAM;AAAA,IACnC;AAAA,IACA;AAAA,EAAA;AAEF,QAAM,WAAW,aAAa,IAAI,CAAA,MAAK,EAAE,OAAO;AAChD,QAAM,UAAU,WAAW,IAAI,IAAI,iBAAiB,GAAG,IAAI,IAAI,QAAQ,CAAC;AACxE,MAAI,QAAQ,MAAM;AAChB,iBAAa;AAAA,MACX,8CAA8C,CAAC,GAAG,OAAO,CAAC;AAAA;AAAA,YAE3C,GAAG;AAAA,IAAA;AAEpB;AAAA,EACF;AACA,QAAM,kBAAkB,IAAI;AAAA,IAC1B,OAAO,IAAI,CAAA,MAAK,CAAC,cAAc,CAAC,GAAG,OAAO,KAAK,EAAE,OAAO,CAAC,CAAC;AAAA,EAAA;AAE5D,QAAM,WAAW,UAAU,eAAe;AAC1C,MAAI;AACF,eAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,aAAa,UAAU,CAAA,CAAE,GAAG;AACtE,YAAM,eAAe,CAAC,CAAC,GAAG,IAAI,MAAY;AACxC,qBAAa,MAAM,OAAO,QAAQ;AAAA,MACpC;AACA,YAAM,gBAAgB,CAAC,UAAwC;AAC7D,eAAO,QAAQ,QAAQ,YAAY;AACnC,eAAO,QAAQ,QAAQ,YAAY;AACnC,eAAO,QAAQ,QAAQ,YAAY;AACnC,eAAO,QAAQ,aAAa,QAAQ,YAAY;AAChD,eAAO,QAAQ,cAAc,QAAQ,YAAY;AAAA,MACnD;AACA,oBAAc,MAAM,GAAG;AACvB,UAAI,MAAM,MAAM;AACd,eAAO,OAAO,MAAM,IAAI,EAAE,QAAQ,aAAa;AAAA,MACjD;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AACV,oBAAgB,OAAO,CAAC,CAAC;AAAA,EAC3B;AACF;AAEA,SAAS,gBAAgB,KAAa;AACpC,eAAa,MAAM,GAAG;AACtB,eAAa,KAAK,6CAA6C;AAC/D,UAAQ,KAAK,EAAE;AACjB;AAEA,eAAe,kBACb,aACA,aACA,OACA;AACA,QAAM,KAAK,SAAS,IAAI,WAAW;AACnC,QAAM,EAAC,MAAM,KAAA,IAAQ,GAAG;AACxB,eAAa,MAAM,0BAA0B,IAAI,IAAI,IAAI,EAAE;AAC3D,MAAI;AACF,UAAM,mBAAmB,IAAI,KAAK;AAElC,UAAM,EAAC,MAAM,QAAA,IAAW,MAAM,MAAM,IAAI,OAAM,OAAM;AAClD,UAAI,OAAO;AACT,qBAAa,KAAK,yCAAyC;AAAA,MAC7D,OAAO;AACL,cAAM,oBAAoB,IAAI,WAAW;AAAA,MAC3C;AAEA,YAAM,EAAC,UAAS;AAChB,mBAAa;AAAA,QACX,uCAAuC,KAAK,iBAAiB,GAAG,QAAQ,IAAI;AAAA,MAAA;AAE9E,YAAM,CAAC,EAAC,MAAM,WAAA,CAAW,IAAI,MAAM;AAAA,2BACd,GAAG,GAAG,CAAC;AAC5B,YAAM,CAAC,EAAC,MAAAC,MAAAA,CAAK,IAAI,MAAM;AAAA,iBACZ,GAAG,GAAG,CAAC,oBAAoB,GAAG,EAAC,YAAA,CAAY,CAAC;AAEvD,aAAO,EAAC,MAAMA,MAAK,UAAU,GAAG,CAAC,GAAG,SAAS,eAAeA,MAAAA;AAAAA,IAC9D,CAAC;AACD,QAAI,SAAS;AACX,mBAAa,KAAK,kCAAkC,IAAI,GAAG;AAAA,IAC7D,OAAO;AACL,mBAAa,KAAK,+BAA+B,IAAI,GAAG;AAAA,IAC1D;AAAA,EACF,UAAA;AACE,UAAM,GAAG,IAAA;AAAA,EACX;AACF;AAEA,eAAe,qBACb,OACA,MACA,QACA;AACA,QAAM,WACJ,WAAW,QACP,UAAUC,MAAG,GAAG,CAAC,kCAAkC;AAAA,IACjD,KAAK,UAAU,KAAK;AAAA,EAAA,CACrB,MACD,KAAK,UAAU,OAAO,MAAM,WAAW,WAAW,IAAI,CAAC;AAC7D,QAAM,UAAU,MAAM,QAAQ;AAC9B,eAAa,KAAK,SAAS,MAAM,mBAAmB,OAAO,OAAO,IAAI,EAAE;AAC1E;AAEA,MAAM,MAAM,MAAM,yBAAyB,OAAO,OAAO,MAAM,IAAI;AACnE,IAAI,CAAC,OAAO,OAAO,KAAK,KAAK,eAAe,CAAA,CAAE,EAAE,WAAW,GAAG;AAC5D,eAAa;AAAA,IACX,2BAA2B,OAAO,OAAO,IAAI;AAAA,EAAA;AAIjD,OAAO;AACL,eAAa;AAAA,IACX;AAAA,EAAA;AAGF,QAAM,EAAC,gBAAe;AACtB,MAAI,OAAO,OAAO,MAAM;AACtB,UAAM;AAAA,MACJ;AAAA,MACA,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAAA;AAAA,EAElB,WAAW,OAAO,SAAS,SAAS,MAAM;AACxC,iBAAa;AAAA,MACX,+CAA+C,OAAO,SAAS,IAAI;AAAA,IAAA;AAErE,YAAQ,KAAK,EAAE;AAAA,EACjB,WAAW,OAAO,SAAS,IAAI;AAC7B,UAAM,kBAAkB,OAAO,SAAS,IAAI,aAAa,OAAO,KAAK;AAAA,EACvE,OAAO;AACL,iBAAa,MAAM,6CAA6C;AAEhE,iBAAa,0BAA0B;AAAA,MACrC,MAAM,CAAC,QAAQ;AAAA,MACf,eAAe;AAAA,IAAA,CAChB;AAAA,EACH;AACF;"}
+{"version":3,"file":"deploy-permissions.js","names":[],"sources":["../../../../../zero-cache/src/scripts/deploy-permissions.ts"],"sourcesContent":["import '../../../shared/src/dotenv.ts';\n\nimport {writeFile} from 'node:fs/promises';\nimport {ident as id, literal} from 'pg-format';\nimport {colorConsole, createLogContext} from '../../../shared/src/logging.ts';\nimport {parseOptions} from '../../../shared/src/options.ts';\nimport {difference} from '../../../shared/src/set-utils.ts';\nimport {mapCondition} from '../../../zero-protocol/src/ast.ts';\nimport {\n  type AssetPermissions,\n  type PermissionsConfig,\n  type Rule,\n} from '../../../zero-schema/src/compiled-permissions.ts';\nimport {validator} from '../../../zero-schema/src/name-mapper.ts';\nimport {ZERO_ENV_VAR_PREFIX} from '../config/zero-config.ts';\nimport {runTx} from '../db/run-transaction.ts';\nimport {getPublicationInfo} from '../services/change-source/pg/schema/published.ts';\nimport {\n  ensureGlobalTables,\n  SHARD_CONFIG_TABLE,\n} from '../services/change-source/pg/schema/shard.ts';\nimport {liteTableName} from '../types/names.ts';\nimport {pgClient, type PostgresDB} from '../types/pg.ts';\nimport {appSchema, getShardID, upstreamSchema} from '../types/shards.ts';\nimport {\n  deployPermissionsOptions,\n  loadSchemaAndPermissions,\n} from './permissions.ts';\n\nconst config = parseOptions(deployPermissionsOptions, {\n  argv: process.argv.slice(2),\n  envNamePrefix: ZERO_ENV_VAR_PREFIX,\n});\n\nconst shard = getShardID(config);\nconst app = appSchema(shard);\n\nconst lc = createLogContext(config);\n\nasync function validatePermissions(\n  db: PostgresDB,\n  permissions: PermissionsConfig,\n) {\n  const schema = upstreamSchema(shard);\n\n  // Check if the shardConfig table has been initialized.\n  const result = await db`\n    SELECT relname FROM pg_class\n      JOIN pg_namespace ON relnamespace = pg_namespace.oid\n      WHERE nspname = ${schema} AND relname = ${SHARD_CONFIG_TABLE}`;\n  if (result.length === 0) {\n    colorConsole.warn(\n      `zero-cache has not yet initialized the upstream database.\\n` +\n        `Deploying ${app} permissions without validating against published tables/columns.`,\n    );\n    return;\n  }\n\n  // Get the publications for the shard\n  const config = await db<{publications: string[]}[]>`\n    SELECT publications FROM ${db(schema + '.' + SHARD_CONFIG_TABLE)}\n  `;\n  if (config.length === 0) {\n    colorConsole.warn(\n      `zero-cache has not yet initialized the upstream database.\\n` +\n        `Deploying ${app} permissions without validating against published tables/columns.`,\n    );\n    return;\n  }\n  colorConsole.info(\n    `Validating permissions against tables and columns published for \"${app}\".`,\n  );\n\n  const [{publications: shardPublications}] = config;\n  const {tables, publications} = await getPublicationInfo(\n    db,\n    shardPublications,\n  );\n  const pubnames = publications.map(p => p.pubname);\n  const missing = difference(new Set(shardPublications), new Set(pubnames));\n  if (missing.size) {\n    colorConsole.warn(\n      `Upstream is missing expected publications \"${[...missing]}\".\\n` +\n        `You may need to re-initialize your replica.\\n` +\n        `Deploying ${app} permissions without validating against published tables/columns.`,\n    );\n    return;\n  }\n  const tablesToColumns = new Map(\n    tables.map(t => [liteTableName(t), Object.keys(t.columns)]),\n  );\n  const validate = validator(tablesToColumns);\n  try {\n    for (const [table, perms] of Object.entries(permissions?.tables ?? {})) {\n      const validateRule = ([_, cond]: Rule) => {\n        mapCondition(cond, table, validate);\n      };\n      const validateAsset = (asset: AssetPermissions | undefined) => {\n        asset?.select?.forEach(validateRule);\n        asset?.delete?.forEach(validateRule);\n        asset?.insert?.forEach(validateRule);\n        asset?.update?.preMutation?.forEach(validateRule);\n        asset?.update?.postMutation?.forEach(validateRule);\n      };\n      validateAsset(perms.row);\n      if (perms.cell) {\n        Object.values(perms.cell).forEach(validateAsset);\n      }\n    }\n  } catch (e) {\n    failWithMessage(String(e));\n  }\n}\n\nfunction failWithMessage(msg: string) {\n  colorConsole.error(msg);\n  colorConsole.info('\\nUse --force to deploy at your own risk.\\n');\n  process.exit(-1);\n}\n\nasync function deployPermissions(\n  upstreamURI: string,\n  permissions: PermissionsConfig,\n  force: boolean,\n) {\n  const db = pgClient(lc, upstreamURI);\n  const {host, port} = db.options;\n  colorConsole.debug(`Connecting to upstream@${host}:${port}`);\n  try {\n    await ensureGlobalTables(db, shard);\n\n    const {hash, changed} = await runTx(db, async tx => {\n      if (force) {\n        colorConsole.warn(`--force specified. Skipping validation.`);\n      } else {\n        await validatePermissions(tx, permissions);\n      }\n\n      const {appID} = shard;\n      colorConsole.info(\n        `Deploying permissions for --app-id \"${appID}\" to upstream@${db.options.host}`,\n      );\n      const [{hash: beforeHash}] = await tx<{hash: string}[]>`\n        SELECT hash from ${tx(app)}.permissions`;\n      const [{hash}] = await tx<{hash: string}[]>`\n        UPDATE ${tx(app)}.permissions SET ${db({permissions})} RETURNING hash`;\n\n      return {hash: hash.substring(0, 7), changed: beforeHash !== hash};\n    });\n    if (changed) {\n      colorConsole.info(`Deployed new permissions (hash=${hash})`);\n    } else {\n      colorConsole.info(`Permissions unchanged (hash=${hash})`);\n    }\n  } finally {\n    await db.end();\n  }\n}\n\nasync function writePermissionsFile(\n  perms: PermissionsConfig,\n  file: string,\n  format: 'sql' | 'json' | 'pretty',\n) {\n  const contents =\n    format === 'sql'\n      ? `UPDATE ${id(app)}.permissions SET permissions = ${literal(\n          JSON.stringify(perms),\n        )};`\n      : JSON.stringify(perms, null, format === 'pretty' ? 2 : 0);\n  await writeFile(file, contents);\n  colorConsole.info(`Wrote ${format} permissions to ${config.output.file}`);\n}\n\nconst ret = await loadSchemaAndPermissions(config.schema.path, true);\nif (!ret || Object.keys(ret?.permissions ?? {}).length === 0) {\n  colorConsole.warn(\n    `No permissions found at ${config.schema.path}, so could not deploy ` +\n      `permissions. Replicating data, but no tables will be syncable. ` +\n      `Create a schema file with permissions to be able to sync data.`,\n  );\n} else {\n  colorConsole.warn(\n    `Permissions are deprecated and will be removed in an upcoming release. See: https://zero.rocicorp.dev/docs/auth.`,\n  );\n\n  const {permissions} = ret;\n  if (config.output.file) {\n    await writePermissionsFile(\n      permissions,\n      config.output.file,\n      config.output.format,\n    );\n  } else if (config.upstream.type !== 'pg') {\n    colorConsole.warn(\n      `Permissions deployment is not supported for ${config.upstream.type} upstreams`,\n    );\n    process.exit(-1);\n  } else if (config.upstream.db) {\n    await deployPermissions(config.upstream.db, permissions, config.force);\n  } else {\n    colorConsole.error(`No --output-file or --upstream-db specified`);\n    // Shows the usage text.\n    parseOptions(deployPermissionsOptions, {\n      argv: ['--help'],\n      envNamePrefix: ZERO_ENV_VAR_PREFIX,\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA6BA,IAAM,SAAS,aAAa,0BAA0B;CACpD,MAAM,QAAQ,KAAK,MAAM,EAAE;CAC3B,eAAe;CAChB,CAAC;AAEF,IAAM,QAAQ,WAAW,OAAO;AAChC,IAAM,MAAM,UAAU,MAAM;AAE5B,IAAM,KAAK,iBAAiB,OAAO;AAEnC,eAAe,oBACb,IACA,aACA;CACA,MAAM,SAAS,eAAe,MAAM;AAOpC,MAJe,MAAM,EAAE;;;wBAGD,OAAO,iBAAA,iBAClB,WAAW,GAAG;AACvB,eAAa,KACX,wEACe,IAAI,mEACpB;AACD;;CAIF,MAAM,SAAS,MAAM,EAA8B;+BACtB,GAAG,SAAS,MAAM,mBAAmB,CAAC;;AAEnE,KAAI,OAAO,WAAW,GAAG;AACvB,eAAa,KACX,wEACe,IAAI,mEACpB;AACD;;AAEF,cAAa,KACX,oEAAoE,IAAI,IACzE;CAED,MAAM,CAAC,EAAC,cAAc,uBAAsB;CAC5C,MAAM,EAAC,QAAQ,iBAAgB,MAAM,mBACnC,IACA,kBACD;CACD,MAAM,WAAW,aAAa,KAAI,MAAK,EAAE,QAAQ;CACjD,MAAM,UAAU,WAAW,IAAI,IAAI,kBAAkB,EAAE,IAAI,IAAI,SAAS,CAAC;AACzE,KAAI,QAAQ,MAAM;AAChB,eAAa,KACX,8CAA8C,CAAC,GAAG,QAAQ,CAAC,6DAE5C,IAAI,mEACpB;AACD;;CAKF,MAAM,WAAW,UAHO,IAAI,IAC1B,OAAO,KAAI,MAAK,CAAC,cAAc,EAAE,EAAE,OAAO,KAAK,EAAE,QAAQ,CAAC,CAAC,CAC5D,CAC0C;AAC3C,KAAI;AACF,OAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,aAAa,UAAU,EAAE,CAAC,EAAE;GACtE,MAAM,gBAAgB,CAAC,GAAG,UAAgB;AACxC,iBAAa,MAAM,OAAO,SAAS;;GAErC,MAAM,iBAAiB,UAAwC;AAC7D,WAAO,QAAQ,QAAQ,aAAa;AACpC,WAAO,QAAQ,QAAQ,aAAa;AACpC,WAAO,QAAQ,QAAQ,aAAa;AACpC,WAAO,QAAQ,aAAa,QAAQ,aAAa;AACjD,WAAO,QAAQ,cAAc,QAAQ,aAAa;;AAEpD,iBAAc,MAAM,IAAI;AACxB,OAAI,MAAM,KACR,QAAO,OAAO,MAAM,KAAK,CAAC,QAAQ,cAAc;;UAG7C,GAAG;AACV,kBAAgB,OAAO,EAAE,CAAC;;;AAI9B,SAAS,gBAAgB,KAAa;AACpC,cAAa,MAAM,IAAI;AACvB,cAAa,KAAK,8CAA8C;AAChE,SAAQ,KAAK,GAAG;;AAGlB,eAAe,kBACb,aACA,aACA,OACA;CACA,MAAM,KAAK,SAAS,IAAI,YAAY;CACpC,MAAM,EAAC,MAAM,SAAQ,GAAG;AACxB,cAAa,MAAM,0BAA0B,KAAK,GAAG,OAAO;AAC5D,KAAI;AACF,QAAM,mBAAmB,IAAI,MAAM;EAEnC,MAAM,EAAC,MAAM,YAAW,MAAM,MAAM,IAAI,OAAM,OAAM;AAClD,OAAI,MACF,cAAa,KAAK,0CAA0C;OAE5D,OAAM,oBAAoB,IAAI,YAAY;GAG5C,MAAM,EAAC,UAAS;AAChB,gBAAa,KACX,uCAAuC,MAAM,gBAAgB,GAAG,QAAQ,OACzE;GACD,MAAM,CAAC,EAAC,MAAM,gBAAe,MAAM,EAAoB;2BAClC,GAAG,IAAI,CAAC;GAC7B,MAAM,CAAC,EAAC,UAAS,MAAM,EAAoB;iBAChC,GAAG,IAAI,CAAC,mBAAmB,GAAG,EAAC,aAAY,CAAC,CAAC;AAExD,UAAO;IAAC,MAAM,KAAK,UAAU,GAAG,EAAE;IAAE,SAAS,eAAe;IAAK;IACjE;AACF,MAAI,QACF,cAAa,KAAK,kCAAkC,KAAK,GAAG;MAE5D,cAAa,KAAK,+BAA+B,KAAK,GAAG;WAEnD;AACR,QAAM,GAAG,KAAK;;;AAIlB,eAAe,qBACb,OACA,MACA,QACA;AAOA,OAAM,UAAU,MALd,WAAW,QACP,UAAU,MAAG,IAAI,CAAC,iCAAiC,QACjD,KAAK,UAAU,MAAM,CACtB,CAAC,KACF,KAAK,UAAU,OAAO,MAAM,WAAW,WAAW,IAAI,EAAE,CAC/B;AAC/B,cAAa,KAAK,SAAS,OAAO,kBAAkB,OAAO,OAAO,OAAO;;AAG3E,IAAM,MAAM,MAAM,yBAAyB,OAAO,OAAO,MAAM,KAAK;AACpE,IAAI,CAAC,OAAO,OAAO,KAAK,KAAK,eAAe,EAAE,CAAC,CAAC,WAAW,EACzD,cAAa,KACX,2BAA2B,OAAO,OAAO,KAAK,qJAG/C;KACI;AACL,cAAa,KACX,mHACD;CAED,MAAM,EAAC,gBAAe;AACtB,KAAI,OAAO,OAAO,KAChB,OAAM,qBACJ,aACA,OAAO,OAAO,MACd,OAAO,OAAO,OACf;UACQ,OAAO,SAAS,SAAS,MAAM;AACxC,eAAa,KACX,+CAA+C,OAAO,SAAS,KAAK,YACrE;AACD,UAAQ,KAAK,GAAG;YACP,OAAO,SAAS,GACzB,OAAM,kBAAkB,OAAO,SAAS,IAAI,aAAa,OAAO,MAAM;MACjE;AACL,eAAa,MAAM,8CAA8C;AAEjE,eAAa,0BAA0B;GACrC,MAAM,CAAC,SAAS;GAChB,eAAe;GAChB,CAAC"}