@wbce/projen-d9 0.0.27 → 0.1.0

package/API.md

@@ -60,6 +60,7 @@ new D9Project(options: D9ProjectOptions)
 | <code><a href="#@wbce/projen-d9.D9Project.renderWorkflowSetup">renderWorkflowSetup</a></code> | Returns the set of workflow steps which should be executed to bootstrap a workflow. |
 | <code><a href="#@wbce/projen-d9.D9Project.setScript">setScript</a></code> | Replaces the contents of an npm package.json script. |
 | <code><a href="#@wbce/projen-d9.D9Project.addExtension">addExtension</a></code> | *No description.* |
+| <code><a href="#@wbce/projen-d9.D9Project.configurePlumbing">configurePlumbing</a></code> | *No description.* |
 
 ---
 
@@ -625,6 +626,18 @@ public addExtension(name: string, extensionTypes: D9ExtensionType[], options?: A
 
 ---
 
+##### `configurePlumbing` <a name="configurePlumbing" id="@wbce/projen-d9.D9Project.configurePlumbing"></a>
+
+```typescript
+public configurePlumbing(options: PlumbingOptions): void
+```
+
+###### `options`<sup>Required</sup> <a name="options" id="@wbce/projen-d9.D9Project.configurePlumbing.parameter.options"></a>
+
+- *Type:* <a href="#@wbce/projen-d9.PlumbingOptions">PlumbingOptions</a>
+
+---
+
 #### Static Functions <a name="Static Functions" id="Static Functions"></a>
 
 | **Name** | **Description** |
@@ -759,11 +772,10 @@ When given a project, this it the project itself.
 | <code><a href="#@wbce/projen-d9.D9Project.property.release">release</a></code> | <code>projen.release.Release</code> | Release management. |
 | <code><a href="#@wbce/projen-d9.D9Project.property.upgradeWorkflow">upgradeWorkflow</a></code> | <code>projen.javascript.UpgradeDependencies</code> | The upgrade workflow. |
 | <code><a href="#@wbce/projen-d9.D9Project.property.githubConfig">githubConfig</a></code> | <code>@wbce/projen-shared.GitHubConfig</code> | *No description.* |
-| <code><a href="#@wbce/projen-d9.D9Project.property.applySchemaTask">applySchemaTask</a></code> | <code>projen.Task</code> | *No description.* |
 | <code><a href="#@wbce/projen-d9.D9Project.property.buildExtensionTask">buildExtensionTask</a></code> | <code>projen.Task</code> | *No description.* |
 | <code><a href="#@wbce/projen-d9.D9Project.property.cacheService">cacheService</a></code> | <code>projen.DockerComposeService</code> | *No description.* |
+| <code><a href="#@wbce/projen-d9.D9Project.property.d9Service">d9Service</a></code> | <code>projen.DockerComposeService</code> | *No description.* |
 | <code><a href="#@wbce/projen-d9.D9Project.property.databaseService">databaseService</a></code> | <code>projen.DockerComposeService</code> | *No description.* |
-| <code><a href="#@wbce/projen-d9.D9Project.property.directusService">directusService</a></code> | <code>projen.DockerComposeService</code> | *No description.* |
 | <code><a href="#@wbce/projen-d9.D9Project.property.dockerComposeFile">dockerComposeFile</a></code> | <code>projen.DockerCompose</code> | *No description.* |
 | <code><a href="#@wbce/projen-d9.D9Project.property.dockerfile">dockerfile</a></code> | <code>@wbce/projen-shared.Dockerfile</code> | *No description.* |
 | <code><a href="#@wbce/projen-d9.D9Project.property.extensionFolder">extensionFolder</a></code> | <code>string</code> | *No description.* |
@@ -1431,16 +1443,6 @@ public readonly githubConfig: GitHubConfig;
 
 ---
 
-##### `applySchemaTask`<sup>Required</sup> <a name="applySchemaTask" id="@wbce/projen-d9.D9Project.property.applySchemaTask"></a>
-
-```typescript
-public readonly applySchemaTask: Task;
-```
-
-- *Type:* projen.Task
-
----
-
 ##### `buildExtensionTask`<sup>Required</sup> <a name="buildExtensionTask" id="@wbce/projen-d9.D9Project.property.buildExtensionTask"></a>
 
 ```typescript
@@ -1461,20 +1463,20 @@ public readonly cacheService: DockerComposeService;
 
 ---
 
-##### `databaseService`<sup>Required</sup> <a name="databaseService" id="@wbce/projen-d9.D9Project.property.databaseService"></a>
+##### `d9Service`<sup>Required</sup> <a name="d9Service" id="@wbce/projen-d9.D9Project.property.d9Service"></a>
 
 ```typescript
-public readonly databaseService: DockerComposeService;
+public readonly d9Service: DockerComposeService;
 ```
 
 - *Type:* projen.DockerComposeService
 
 ---
 
-##### `directusService`<sup>Required</sup> <a name="directusService" id="@wbce/projen-d9.D9Project.property.directusService"></a>
+##### `databaseService`<sup>Required</sup> <a name="databaseService" id="@wbce/projen-d9.D9Project.property.databaseService"></a>
 
 ```typescript
-public readonly directusService: DockerComposeService;
+public readonly databaseService: DockerComposeService;
 ```
 
 - *Type:* projen.DockerComposeService
@@ -1602,6 +1604,7 @@ new DirectusProject(options: D9ProjectOptions)
 | <code><a href="#@wbce/projen-d9.DirectusProject.renderWorkflowSetup">renderWorkflowSetup</a></code> | Returns the set of workflow steps which should be executed to bootstrap a workflow. |
 | <code><a href="#@wbce/projen-d9.DirectusProject.setScript">setScript</a></code> | Replaces the contents of an npm package.json script. |
 | <code><a href="#@wbce/projen-d9.DirectusProject.addExtension">addExtension</a></code> | *No description.* |
+| <code><a href="#@wbce/projen-d9.DirectusProject.configurePlumbing">configurePlumbing</a></code> | *No description.* |
 
 ---
 
@@ -2167,6 +2170,18 @@ public addExtension(name: string, extensionTypes: D9ExtensionType[], options?: A
 
 ---
 
+##### ~~`configurePlumbing`~~ <a name="configurePlumbing" id="@wbce/projen-d9.DirectusProject.configurePlumbing"></a>
+
+```typescript
+public configurePlumbing(options: PlumbingOptions): void
+```
+
+###### `options`<sup>Required</sup> <a name="options" id="@wbce/projen-d9.DirectusProject.configurePlumbing.parameter.options"></a>
+
+- *Type:* <a href="#@wbce/projen-d9.PlumbingOptions">PlumbingOptions</a>
+
+---
+
 #### Static Functions <a name="Static Functions" id="Static Functions"></a>
 
 | **Name** | **Description** |
@@ -2301,11 +2316,10 @@ When given a project, this it the project itself.
 | <code><a href="#@wbce/projen-d9.DirectusProject.property.release">release</a></code> | <code>projen.release.Release</code> | Release management. |
 | <code><a href="#@wbce/projen-d9.DirectusProject.property.upgradeWorkflow">upgradeWorkflow</a></code> | <code>projen.javascript.UpgradeDependencies</code> | The upgrade workflow. |
 | <code><a href="#@wbce/projen-d9.DirectusProject.property.githubConfig">githubConfig</a></code> | <code>@wbce/projen-shared.GitHubConfig</code> | *No description.* |
-| <code><a href="#@wbce/projen-d9.DirectusProject.property.applySchemaTask">applySchemaTask</a></code> | <code>projen.Task</code> | *No description.* |
 | <code><a href="#@wbce/projen-d9.DirectusProject.property.buildExtensionTask">buildExtensionTask</a></code> | <code>projen.Task</code> | *No description.* |
 | <code><a href="#@wbce/projen-d9.DirectusProject.property.cacheService">cacheService</a></code> | <code>projen.DockerComposeService</code> | *No description.* |
+| <code><a href="#@wbce/projen-d9.DirectusProject.property.d9Service">d9Service</a></code> | <code>projen.DockerComposeService</code> | *No description.* |
 | <code><a href="#@wbce/projen-d9.DirectusProject.property.databaseService">databaseService</a></code> | <code>projen.DockerComposeService</code> | *No description.* |
-| <code><a href="#@wbce/projen-d9.DirectusProject.property.directusService">directusService</a></code> | <code>projen.DockerComposeService</code> | *No description.* |
 | <code><a href="#@wbce/projen-d9.DirectusProject.property.dockerComposeFile">dockerComposeFile</a></code> | <code>projen.DockerCompose</code> | *No description.* |
 | <code><a href="#@wbce/projen-d9.DirectusProject.property.dockerfile">dockerfile</a></code> | <code>@wbce/projen-shared.Dockerfile</code> | *No description.* |
 | <code><a href="#@wbce/projen-d9.DirectusProject.property.extensionFolder">extensionFolder</a></code> | <code>string</code> | *No description.* |
@@ -3071,18 +3085,6 @@ public readonly githubConfig: GitHubConfig;
 
 ---
 
-##### ~~`applySchemaTask`~~<sup>Required</sup> <a name="applySchemaTask" id="@wbce/projen-d9.DirectusProject.property.applySchemaTask"></a>
-
-- *Deprecated:* Use {@link D9Project } instead. The package was renamed to `@wbce/projen-d9` to reflect that it targets the d9 fork, not upstream Directus.
-
-```typescript
-public readonly applySchemaTask: Task;
-```
-
-- *Type:* projen.Task
-
----
-
 ##### ~~`buildExtensionTask`~~<sup>Required</sup> <a name="buildExtensionTask" id="@wbce/projen-d9.DirectusProject.property.buildExtensionTask"></a>
 
 - *Deprecated:* Use {@link D9Project } instead. The package was renamed to `@wbce/projen-d9` to reflect that it targets the d9 fork, not upstream Directus.
@@ -3107,24 +3109,24 @@ public readonly cacheService: DockerComposeService;
 
 ---
 
-##### ~~`databaseService`~~<sup>Required</sup> <a name="databaseService" id="@wbce/projen-d9.DirectusProject.property.databaseService"></a>
+##### ~~`d9Service`~~<sup>Required</sup> <a name="d9Service" id="@wbce/projen-d9.DirectusProject.property.d9Service"></a>
 
 - *Deprecated:* Use {@link D9Project } instead. The package was renamed to `@wbce/projen-d9` to reflect that it targets the d9 fork, not upstream Directus.
 
 ```typescript
-public readonly databaseService: DockerComposeService;
+public readonly d9Service: DockerComposeService;
 ```
 
 - *Type:* projen.DockerComposeService
 
 ---
 
-##### ~~`directusService`~~<sup>Required</sup> <a name="directusService" id="@wbce/projen-d9.DirectusProject.property.directusService"></a>
+##### ~~`databaseService`~~<sup>Required</sup> <a name="databaseService" id="@wbce/projen-d9.DirectusProject.property.databaseService"></a>
 
 - *Deprecated:* Use {@link D9Project } instead. The package was renamed to `@wbce/projen-d9` to reflect that it targets the d9 fork, not upstream Directus.
 
 ```typescript
-public readonly directusService: DockerComposeService;
+public readonly databaseService: DockerComposeService;
 ```
 
 - *Type:* projen.DockerComposeService
@@ -8426,6 +8428,73 @@ public readonly packageVersions: PackageVersions;
 
 ---
 
+### IntermediateStorageOptions <a name="IntermediateStorageOptions" id="@wbce/projen-d9.IntermediateStorageOptions"></a>
+
+Storage shared between environments, used by `d9-plumbing save` and `d9-plumbing apply-schema` to transfer files.
+
+#### Initializer <a name="Initializer" id="@wbce/projen-d9.IntermediateStorageOptions.Initializer"></a>
+
+```typescript
+import { IntermediateStorageOptions } from '@wbce/projen-d9'
+
+const intermediateStorageOptions: IntermediateStorageOptions = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@wbce/projen-d9.IntermediateStorageOptions.property.driver">driver</a></code> | <code>string</code> | The storage driver: s3, gcs, azure, local or cloudinary. |
+| <code><a href="#@wbce/projen-d9.IntermediateStorageOptions.property.options">options</a></code> | <code>{[ key: string ]: string}</code> | Non-secret driver options (root, bucket, region, endpoint...). |
+| <code><a href="#@wbce/projen-d9.IntermediateStorageOptions.property.secretEnv">secretEnv</a></code> | <code>{[ key: string ]: string}</code> | Secret driver options, mapping each option name to the name of the environment variable holding its value. |
+
+---
+
+##### `driver`<sup>Required</sup> <a name="driver" id="@wbce/projen-d9.IntermediateStorageOptions.property.driver"></a>
+
+```typescript
+public readonly driver: string;
+```
+
+- *Type:* string
+
+The storage driver: s3, gcs, azure, local or cloudinary.
+
+---
+
+##### `options`<sup>Optional</sup> <a name="options" id="@wbce/projen-d9.IntermediateStorageOptions.property.options"></a>
+
+```typescript
+public readonly options: {[ key: string ]: string};
+```
+
+- *Type:* {[ key: string ]: string}
+
+Non-secret driver options (root, bucket, region, endpoint...).
+
+---
+
+##### `secretEnv`<sup>Optional</sup> <a name="secretEnv" id="@wbce/projen-d9.IntermediateStorageOptions.property.secretEnv"></a>
+
+```typescript
+public readonly secretEnv: {[ key: string ]: string};
+```
+
+- *Type:* {[ key: string ]: string}
+
+Secret driver options, mapping each option name to the name of the environment variable holding its value.
+
+Only the variable name is written to `d9-plumbing.json`, never the value: it is read from the environment (or `.env`) at runtime.
+
+---
+
+*Example*
+
+```typescript
+{ key: 'S3_ACCESS_KEY_ID_ENV_VAR', secret: 'S3_SECRET_ACCESS_KEY_ENV_VAR' } // the `secret` option is read from $S3_SECRET_ACCESS_KEY_ENV_VAR
+```
+
+
 ### PackageVersions <a name="PackageVersions" id="@wbce/projen-d9.PackageVersions"></a>
 
 #### Initializer <a name="Initializer" id="@wbce/projen-d9.PackageVersions.Initializer"></a>
@@ -8440,7 +8509,7 @@ const packageVersions: PackageVersions = { ... }
 
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
-| <code><a href="#@wbce/projen-d9.PackageVersions.property.atlas">atlas</a></code> | <code>string</code> | The version of. |
+| <code><a href="#@wbce/projen-d9.PackageVersions.property.atlas">atlas</a></code> | <code>string</code> | The version of the Atlas binary downloaded by d9-plumbing. |
 | <code><a href="#@wbce/projen-d9.PackageVersions.property.d9">d9</a></code> | <code>string</code> | *No description.* |
 
 ---
@@ -8452,9 +8521,9 @@ public readonly atlas: string;
 ```
 
 - *Type:* string
-- *Default:* "0.32.0"
+- *Default:* "1.3.3"
 
-The version of.
+The version of the Atlas binary downloaded by d9-plumbing.
 
 ---
 
@@ -8468,5 +8537,52 @@ public readonly d9: string;
 
 ---
 
+### PlumbingOptions <a name="PlumbingOptions" id="@wbce/projen-d9.PlumbingOptions"></a>
+
+Configuration of the d9-plumbing CLI, written to `d9-plumbing.json`.
+
+#### Initializer <a name="Initializer" id="@wbce/projen-d9.PlumbingOptions.Initializer"></a>
+
+```typescript
+import { PlumbingOptions } from '@wbce/projen-d9'
+
+const plumbingOptions: PlumbingOptions = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@wbce/projen-d9.PlumbingOptions.property.intermediateStorage">intermediateStorage</a></code> | <code><a href="#@wbce/projen-d9.IntermediateStorageOptions">IntermediateStorageOptions</a></code> | Storage shared between environments. |
+| <code><a href="#@wbce/projen-d9.PlumbingOptions.property.logLevel">logLevel</a></code> | <code>string</code> | Default log level of the CLI, overridden by the LOG_LEVEL environment variable. |
+
+---
+
+##### `intermediateStorage`<sup>Optional</sup> <a name="intermediateStorage" id="@wbce/projen-d9.PlumbingOptions.property.intermediateStorage"></a>
+
+```typescript
+public readonly intermediateStorage: IntermediateStorageOptions;
+```
+
+- *Type:* <a href="#@wbce/projen-d9.IntermediateStorageOptions">IntermediateStorageOptions</a>
+- *Default:* none, the intermediate storage is configured with INTERMEDIATE_STORAGE_* variables or flags
+
+Storage shared between environments.
+
+---
+
+##### `logLevel`<sup>Optional</sup> <a name="logLevel" id="@wbce/projen-d9.PlumbingOptions.property.logLevel"></a>
+
+```typescript
+public readonly logLevel: string;
+```
+
+- *Type:* string
+- *Default:* "debug"
+
+Default log level of the CLI, overridden by the LOG_LEVEL environment variable.
+
+---
+
 
 

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @wbce/projen-directus
 
+## 0.1.0
+
+### Minor Changes
+
+- 266e601: Add the `d9-to-cedar` and `cedar-to-d9` CLI commands, porting the Cedar permission
+  translation validated in app-api2. `d9-to-cedar` generates one folder of Cedar policies per
+  role from `directus_permissions.csv`; `cedar-to-d9` merges them back into the CSV and runs
+  as part of `apply-schema` whenever a `./permissions` folder is present.
+
+### Patch Changes
+
+- b5f28f4: new save schema command
+
+## 0.0.28
+
+### Patch Changes
+
+- Updated dependencies [e348f46]
+  - @wbce/projen-d9-extension@0.0.15
+
 ## 0.0.27
 
 ### Patch Changes

package/README.md

@@ -2,6 +2,7 @@
 
 Projen template for [d9](https://github.com/LaWebcapsule/d9) projects (fork of Directus v9). Scaffolds a local development setup with Docker Compose (Postgres + Redis), extension management, and GitHub workflows — then produces a Docker image you can deploy to any environment.
 
+The generated stack (Docker Compose, first run) and `d9-plumbing` assume PostgreSQL as the d9 database; extensions, the Dockerfile and the GitHub workflows do not depend on it. Support for other databases may be added in the future.
 
 Companion package: [`@wbce/projen-d9-extension`](../directus-extension) for authoring extensions.
 
@@ -61,10 +62,16 @@ Extensions live under `./plugins/` (configurable via `extensionsFolderName`) and
 | Task | Description |
 | --- | --- |
 | `first-run` | Boot the stack, create admin, start d9 |
-| `run` | Start d9 (`docker compose up directus`) |
+| `run` | Start d9 (`docker compose up d9`) |
 | `build-extensions` | Install and build all extensions |
 | `create-an-admin` | Create the default admin user |
 
+## d9-plumbing CLI
+
+The package ships the `d9-plumbing` CLI to save a d9 instance (schema, data, files, Cedar permissions) into the repository and apply it to other environments. See [docs/D9-plumbing.md](./docs/D9-plumbing.md).
+
+`d9-plumbing` currently supports PostgreSQL only. Support for other databases may be added in the future.
+
 ## What gets generated
 
 - `docker-compose.yml` — d9, Postgres (PostGIS), Redis with healthchecks
@@ -77,6 +84,6 @@ Extensions live under `./plugins/` (configurable via `extensionsFolderName`) and
 See [API.md](./API.md) for the full `D9ProjectOptions` reference. Highlights:
 
 - `extensionsFolderName` — folder for extension packages (default: `plugins`)
-- `packageVersions.d9` — version of `@wbce-d9/directus9` (default: `12.0.1`)
-- `packageVersions.atlas` — version of `@ariga/atlas` (default: `0.32.0`)
+- `packageVersions.d9` — version of `@wbce-d9/directus9` (default: `12.0.15`)
+- `packageVersions.atlas` — version of the Atlas Community Edition binary (Apache 2.0) that `d9-plumbing` downloads from release.ariga.io on first use, cached in `node_modules/.cache/d9-plumbing` (default: `1.3.3`)
 - `githubConfig` — `GitHubConfigOptions` or `false` to disable

package/docs/D9-plumbing.md

@@ -0,0 +1,189 @@
+# d9-plumbing
+
+`d9-plumbing` is the CLI shipped with `@wbce/projen-d9`. It saves the state of a d9 instance (schema, configuration data, files, permissions) into the repository and applies it to another instance.
+
+Run it from the root of the d9 project, either directly or through the generated projen task:
+
+```sh
+npx d9-plumbing <command> [options]
+npx projen d9-plumbing <command> [options]
+npx d9-plumbing --help              # list commands
+npx d9-plumbing <command> --help    # list the options of a command
+```
+
+It works with the following files of the project:
+
+| Path | Content |
+| --- | --- |
+| `sql/schema.sql` | Database schema, dumped with Atlas |
+| `sql/data/*.csv` | Content of the d9 configuration tables |
+| `sql/tables_to_dump.txt` | Optional, extra tables to dump (one per line) |
+| `sql/tables_not_to_dump.txt` | Optional, tables never to dump (one per line) |
+| `permissions/<Role>/*.cedar` | Permissions as Cedar policies, generated from `sql/data/directus_permissions.csv` |
+| `d9-plumbing.json` | CLI configuration, generated by projen |
+
+## Configuration
+
+The d9 environment (`.env`, environment variables) is read through `@wbce-d9/api`, resolved from the d9 project, so the CLI uses the same configuration as d9 itself.
+
+### Database
+
+| Flag | Fallback |
+| --- | --- |
+| `--host <host>` | `DB_HOST` |
+| `--user <user>` | `DB_USER` |
+| `--password <password>` | `DB_PASSWORD` |
+| `--database <database>` | `DB_DATABASE` |
+| `--ssl` | `DB_SSL`, or any nested `DB_SSL__*` key (Directus syntax, e.g. `DB_SSL__REJECT_UNAUTHORIZED`) |
+
+### Current storage
+
+The storage of the d9 instance: the first location of `STORAGE_LOCATIONS`, configured by `STORAGE_<LOCATION>_*`. Each entry can be overridden with the repeatable `--storage-config key=value` flag (nested keys use dots, e.g. `--storage-config driver=s3 --storage-config bucket=my-bucket`).
+
+### Intermediate storage
+
+A storage shared between environments, used to transfer the files referenced by `sql/data/directus_files.csv`. It is resolved from, by increasing priority:
+
+1. `intermediateStorage` in `d9-plumbing.json` (`driver`, `options`, and `secretEnv` which maps an option to the name of the environment variable holding its value). Set it with `project.configurePlumbing({ intermediateStorage })` in `.projenrc`, e.g. `secretEnv: { secret: 'S3_SECRET_ACCESS_KEY_ENV_VAR' }` sets the `secret` option to the value of `$S3_SECRET_ACCESS_KEY_ENV_VAR` at runtime.
+2. `INTERMEDIATE_STORAGE_*` environment variables (e.g. `INTERMEDIATE_STORAGE_DRIVER=s3`).
+3. The repeatable `--intermediate-storage-config key=value` flag.
+
+`save`, `apply-schema` and `first-import` skip the file sync when no intermediate storage is configured, or when it is disabled with `--no-files` or `SKIP_FILE_SYNC=true`.
+
+### Logging
+
+The log level is `LOG_LEVEL`, else `logLevel` in `d9-plumbing.json` (`project.configurePlumbing({ logLevel })`), else `debug`.
+
+### Atlas
+
+The schema is dumped and diffed with [Atlas](https://atlasgo.io/) Community Edition. The binary is downloaded from release.ariga.io on first use and cached in `node_modules/.cache/d9-plumbing`. Its version is set by `packageVersions.atlas`.
+
+## Commands
+
+### `save`
+
+Saves the current d9 into the repository, then pushes its files to the intermediate storage.
+
+1. Dumps the schema into `sql/schema.sql`.
+2. Empties `sql/data` and dumps one CSV per table: every `directus_*` table except `directus_users`, `directus_sessions`, `directus_revisions`, `directus_activity` and `directus_presets`, plus the tables of `sql/tables_to_dump.txt`, minus those of `sql/tables_not_to_dump.txt`. Columns referencing a user are replaced by a fixed CI user. `directus_files` and `directus_folders` are limited to the `d9-plumbing-common` folder and its subfolders.
+3. Regenerates the Cedar policies in `permissions/` (see [`d9-to-cedar`](#d9-to-cedar)).
+4. Pushes the files to the intermediate storage (see [`push-files`](#push-files--pull-files)), unless the [file sync is skipped](#intermediate-storage).
+
+Options: [database](#database), [storage](#current-storage), [intermediate storage](#intermediate-storage), `--no-cedar` to skip step 3, `--no-files` to skip step 4.
+
+```sh
+npx d9-plumbing save
+```
+
+### `apply-schema`
+
+Applies the saved state of the repository to the current d9.
+
+1. Checks that the current d9 has no unsaved changes (see [`check-unsaved`](#check-unsaved)).
+2. Pulls the files from the intermediate storage, unless the [file sync is skipped](#intermediate-storage).
+3. Applies the SQL snapshot and imports the reference tables.
+
+Once done, purge the d9 cache (`POST /utils/cache/clear`) so the new schema, and permissions when `CACHE_ENABLED` is set, are taken into account. Restart d9 if flows, operations or webhooks changed.
+
+Options: [database](#database), [storage](#current-storage), [intermediate storage](#intermediate-storage), and:
+
+| Option | Description |
+| --- | --- |
+| `--last-save <commit>` | Commit of the last save of this environment, required |
+| `--no-last-save` | Skip the unsaved changes check (asks for confirmation) |
+| `--yes` | Do not ask for confirmation |
+| `--no-files` | Skip step 2 |
+
+```sh
+npx d9-plumbing apply-schema --last-save 1b3387a
+```
+
+### `first-import`
+
+Initializes an empty d9 database: applies the snapshot, then pulls the files if an intermediate storage is configured. Does nothing if the database already contains `directus_*` tables. Called by the `first-run` task (`npx projen first-run`).
+
+Options: [database](#database), [storage](#current-storage), [intermediate storage](#intermediate-storage), `--no-files` to skip the file sync.
+
+```sh
+npx d9-plumbing first-import --host localhost --user d9 --password d9 --database d9
+```
+
+### `check-unsaved`
+
+Fails if the current d9 differs from the state saved at `--last-save`. It compares the result of a fresh save with the `sql/` folder of the `--last-save` commit. Run by `apply-schema` before applying anything.
+
+Options: [database](#database), `--last-save <commit>`, `--no-last-save`, `--yes` (see [`apply-schema`](#apply-schema)).
+
+```sh
+npx d9-plumbing check-unsaved --last-save 1b3387a
+```
+
+### `push-files` / `pull-files`
+
+Syncs the files listed in `sql/data/directus_files.csv` from the current storage to the intermediate storage (`push-files`), or the other way (`pull-files`). Run by `save` and `apply-schema`.
+
+Only the files of the d9 folder named `d9-plumbing-common` and its subfolders are saved and transferred: `save` dumps only those rows of `directus_files` and `directus_folders`, so everything else stays local to its environment. Put the files shared by all environments (logos, default images...) in `d9-plumbing-common`.
+
+Options: [storage](#current-storage), [intermediate storage](#intermediate-storage).
+
+```sh
+npx d9-plumbing push-files
+```
+
+### `d9-to-cedar`
+
+Deletes the permissions folder and regenerates it from `directus_permissions.csv` and `directus_roles.csv`. Each role gets a folder with:
+
+- `authorize.cedar` — which actions the role can do on which collections, with their filters,
+- `check-fields.cedar` — the fields allowed per action,
+- `validate.cedar` — the validation rules.
+
+Policies sharing the same conditions are grouped into a single `action in [...]` policy. Permissions without a role are in the `Public` folder. Run by `save`.
+
+| Option | Default | Description |
+| --- | --- | --- |
+| `--permissions <path>` | `./permissions` | Cedar policies folder |
+| `--sql <path>` | `./sql/data` | CSV folder |
+
+### `cedar-to-d9`
+
+The reverse of `d9-to-cedar`: reads the Cedar policies and merges them into `directus_permissions.csv`. The `permissions`, `fields` and `validation` columns are rewritten; the other columns (`id`, `role`, `presets`) are kept from the existing CSV. A (role, collection, action) added in Cedar creates a row, one removed from Cedar deletes its row. Every role folder must match a role of `directus_roles.csv` (except `Public`).
+
+| Option | Default | Description |
+| --- | --- | --- |
+| `--permissions <path>` | `./permissions` | Cedar policies folder |
+| `--sql <path>` | `./sql/data` | CSV folder |
+| `--output <path>` | `<sql>/directus_permissions.csv` | Output CSV |
+
+### `sync`
+
+Not implemented yet.
+
+## Workflows
+
+### Promote changes to another environment
+
+1. Make the changes in d9 on the source environment (usually local).
+2. `npx d9-plumbing save`, commit `sql/` and `permissions/`, merge.
+3. On the target environment, from the merged commit: `npx d9-plumbing apply-schema --last-save <commit of the last save of the target>`. If the target has changes that were never saved, the command fails: run `save` there first, commit and merge, then retry.
+4. Purge the d9 cache of the target.
+
+### Modify a permission with Cedar
+
+1. Edit the policies in `permissions/<Role>/*.cedar`.
+2. Write them back into the CSV:
+
+   ```sh
+   npx d9-plumbing cedar-to-d9
+   ```
+
+3. Review the result with `git diff sql/data/directus_permissions.csv`.
+4. Apply it to the local d9. The local database has not changed since the last commit, so use `HEAD` as the last save:
+
+   ```sh
+   npx d9-plumbing apply-schema --last-save HEAD
+   ```
+
+5. Purge the d9 cache and check the permissions in d9.
+6. Optionally run `npx d9-plumbing d9-to-cedar` to normalize the Cedar files (grouping, ordering) as the next `save` will.
+7. Commit the `.cedar` files and the CSV together, then promote them as above.

package/lib/cli/atlas.d.ts

@@ -0,0 +1,10 @@
+export declare const DEFAULT_ATLAS_VERSION = "1.3.3";
+/**
+ * Name of the Atlas release file, e.g. atlas-community-linux-amd64-v1.3.3
+ */
+export declare function atlasFileName(version: string, platform?: string, arch?: string): string;
+/**
+ * Downloads the Atlas Community Edition binary (Apache 2.0) in the version configured in d9-plumbing.json and returns its path.
+ * The binary is cached in node_modules/.cache/d9-plumbing.
+ */
+export declare function ensureAtlas(): Promise<string>;

package/lib/cli/atlas.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_ATLAS_VERSION = void 0;
+exports.atlasFileName = atlasFileName;
+exports.ensureAtlas = ensureAtlas;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const logger_1 = require("./logger");
+const plumbing_config_1 = require("./plumbing-config");
+exports.DEFAULT_ATLAS_VERSION = '1.3.3';
+const RELEASE_SERVER = 'https://release.ariga.io/atlas';
+// resolved at startup: check-unsaved changes the cwd to a worktree without node_modules
+const CACHE_DIR = (0, path_1.resolve)('./node_modules/.cache/d9-plumbing');
+const PLATFORMS = { darwin: 'darwin', linux: 'linux' };
+const ARCHS = { x64: 'amd64', arm64: 'arm64' };
+/**
+ * Name of the Atlas release file, e.g. atlas-community-linux-amd64-v1.3.3
+ */
+function atlasFileName(version, platform = process.platform, arch = process.arch) {
+    const os = PLATFORMS[platform];
+    const cpu = ARCHS[arch];
+    if (!os || !cpu) {
+        throw new Error(`atlas is not available for ${platform}-${arch} (supported: darwin/linux, x64/arm64)`);
+    }
+    return `atlas-community-${os}-${cpu}-v${version}`;
+}
+async function download(url) {
+    const response = await fetch(url);
+    if (!response.ok) {
+        throw new Error(`failed to download ${url}: ${response.status} ${response.statusText}`);
+    }
+    return Buffer.from(await response.arrayBuffer());
+}
+/**
+ * Downloads the Atlas Community Edition binary (Apache 2.0) in the version configured in d9-plumbing.json and returns its path.
+ * The binary is cached in node_modules/.cache/d9-plumbing.
+ */
+async function ensureAtlas() {
+    const config = (0, plumbing_config_1.readPlumbingConfig)();
+    const fileName = atlasFileName(config.atlasVersion ?? exports.DEFAULT_ATLAS_VERSION);
+    const binPath = (0, path_1.join)(CACHE_DIR, fileName);
+    if ((0, fs_1.existsSync)(binPath)) {
+        return binPath;
+    }
+    logger_1.logger.info(`Downloading ${fileName}`);
+    const [binary, checksumFile] = await Promise.all([
+        download(`${RELEASE_SERVER}/${fileName}`),
+        download(`${RELEASE_SERVER}/${fileName}.sha256`),
+    ]);
+    const expected = checksumFile.toString().trim().split(/\s+/)[0];
+    const actual = (0, crypto_1.createHash)('sha256').update(binary).digest('hex');
+    if (actual !== expected) {
+        throw new Error(`checksum mismatch for ${fileName}: expected ${expected}, got ${actual}`);
+    }
+    await (0, promises_1.mkdir)(CACHE_DIR, { recursive: true });
+    // written then renamed, so an interrupted download never leaves a broken binary in the cache
+    const tmpPath = `${binPath}.tmp`;
+    await (0, promises_1.writeFile)(tmpPath, binary);
+    await (0, promises_1.chmod)(tmpPath, 0o755);
+    await (0, promises_1.rename)(tmpPath, binPath);
+    return binPath;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXRsYXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2xpL2F0bGFzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQW1CQSxzQ0FPQztBQWNELGtDQTBCQztBQWxFRCxtQ0FBb0M7QUFDcEMsMkJBQWdDO0FBQ2hDLDBDQUE4RDtBQUM5RCwrQkFBcUM7QUFDckMscUNBQWtDO0FBQ2xDLHVEQUF1RDtBQUUxQyxRQUFBLHFCQUFxQixHQUFHLE9BQU8sQ0FBQztBQUU3QyxNQUFNLGNBQWMsR0FBRyxnQ0FBZ0MsQ0FBQztBQUN4RCx3RkFBd0Y7QUFDeEYsTUFBTSxTQUFTLEdBQUcsSUFBQSxjQUFPLEVBQUMsbUNBQW1DLENBQUMsQ0FBQztBQUUvRCxNQUFNLFNBQVMsR0FBMkIsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUMvRSxNQUFNLEtBQUssR0FBMkIsRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUV2RTs7R0FFRztBQUNILFNBQWdCLGFBQWEsQ0FBQyxPQUFlLEVBQUUsV0FBbUIsT0FBTyxDQUFDLFFBQVEsRUFBRSxPQUFlLE9BQU8sQ0FBQyxJQUFJO0lBQzdHLE1BQU0sRUFBRSxHQUFHLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUMvQixNQUFNLEdBQUcsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDeEIsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ2hCLE1BQU0sSUFBSSxLQUFLLENBQUMsOEJBQThCLFFBQVEsSUFBSSxJQUFJLHVDQUF1QyxDQUFDLENBQUM7SUFDekcsQ0FBQztJQUNELE9BQU8sbUJBQW1CLEVBQUUsSUFBSSxHQUFHLEtBQUssT0FBTyxFQUFFLENBQUM7QUFDcEQsQ0FBQztBQUVELEtBQUssVUFBVSxRQUFRLENBQUMsR0FBVztJQUNqQyxNQUFNLFFBQVEsR0FBRyxNQUFNLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNsQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsRUFBRSxDQUFDO1FBQ2pCLE1BQU0sSUFBSSxLQUFLLENBQUMsc0JBQXNCLEdBQUcsS0FBSyxRQUFRLENBQUMsTUFBTSxJQUFJLFFBQVEsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO0lBQzFGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxRQUFRLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQztBQUNuRCxDQUFDO0FBRUQ7OztHQUdHO0FBQ0ksS0FBSyxVQUFVLFdBQVc7SUFDL0IsTUFBTSxNQUFNLEdBQUcsSUFBQSxvQ0FBa0IsR0FBRSxDQUFDO0lBQ3BDLE1BQU0sUUFBUSxHQUFHLGFBQWEsQ0FBQyxNQUFNLENBQUMsWUFBWSxJQUFJLDZCQUFxQixDQUFDLENBQUM7SUFDN0UsTUFBTSxPQUFPLEdBQUcsSUFBQSxXQUFJLEVBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQzFDLElBQUksSUFBQSxlQUFVLEVBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUN4QixPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRUQsZUFBTSxDQUFDLElBQUksQ0FBQyxlQUFlLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDdkMsTUFBTSxDQUFDLE1BQU0sRUFBRSxZQUFZLENBQUMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUM7UUFDL0MsUUFBUSxDQUFDLEdBQUcsY0FBYyxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQ3pDLFFBQVEsQ0FBQyxHQUFHLGNBQWMsSUFBSSxRQUFRLFNBQVMsQ0FBQztLQUNqRCxDQUFDLENBQUM7SUFDSCxNQUFNLFFBQVEsR0FBRyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2hFLE1BQU0sTUFBTSxHQUFHLElBQUEsbUJBQVUsRUFBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2pFLElBQUksTUFBTSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ3hCLE1BQU0sSUFBSSxLQUFLLENBQUMseUJBQXlCLFFBQVEsY0FBYyxRQUFRLFNBQVMsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUM1RixDQUFDO0lBRUQsTUFBTSxJQUFBLGdCQUFLLEVBQUMsU0FBUyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDNUMsNkZBQTZGO0lBQzdGLE1BQU0sT0FBTyxHQUFHLEdBQUcsT0FBTyxNQUFNLENBQUM7SUFDakMsTUFBTSxJQUFBLG9CQUFTLEVBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ2pDLE1BQU0sSUFBQSxnQkFBSyxFQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQztJQUM1QixNQUFNLElBQUEsaUJBQU0sRUFBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDL0IsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGNyZWF0ZUhhc2ggfSBmcm9tICdjcnlwdG8nO1xuaW1wb3J0IHsgZXhpc3RzU3luYyB9IGZyb20gJ2ZzJztcbmltcG9ydCB7IGNobW9kLCBta2RpciwgcmVuYW1lLCB3cml0ZUZpbGUgfSBmcm9tICdmcy9wcm9taXNlcyc7XG5pbXBvcnQgeyBqb2luLCByZXNvbHZlIH0gZnJvbSAncGF0aCc7XG5pbXBvcnQgeyBsb2dnZXIgfSBmcm9tICcuL2xvZ2dlcic7XG5pbXBvcnQgeyByZWFkUGx1bWJpbmdDb25maWcgfSBmcm9tICcuL3BsdW1iaW5nLWNvbmZpZyc7XG5cbmV4cG9ydCBjb25zdCBERUZBVUxUX0FUTEFTX1ZFUlNJT04gPSAnMS4zLjMnO1xuXG5jb25zdCBSRUxFQVNFX1NFUlZFUiA9ICdodHRwczovL3JlbGVhc2UuYXJpZ2EuaW8vYXRsYXMnO1xuLy8gcmVzb2x2ZWQgYXQgc3RhcnR1cDogY2hlY2stdW5zYXZlZCBjaGFuZ2VzIHRoZSBjd2QgdG8gYSB3b3JrdHJlZSB3aXRob3V0IG5vZGVfbW9kdWxlc1xuY29uc3QgQ0FDSEVfRElSID0gcmVzb2x2ZSgnLi9ub2RlX21vZHVsZXMvLmNhY2hlL2Q5LXBsdW1iaW5nJyk7XG5cbmNvbnN0IFBMQVRGT1JNUzogUmVjb3JkPHN0cmluZywgc3RyaW5nPiA9IHsgZGFyd2luOiAnZGFyd2luJywgbGludXg6ICdsaW51eCcgfTtcbmNvbnN0IEFSQ0hTOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+ID0geyB4NjQ6ICdhbWQ2NCcsIGFybTY0OiAnYXJtNjQnIH07XG5cbi8qKlxuICogTmFtZSBvZiB0aGUgQXRsYXMgcmVsZWFzZSBmaWxlLCBlLmcuIGF0bGFzLWNvbW11bml0eS1saW51eC1hbWQ2NC12MS4zLjNcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGF0bGFzRmlsZU5hbWUodmVyc2lvbjogc3RyaW5nLCBwbGF0Zm9ybTogc3RyaW5nID0gcHJvY2Vzcy5wbGF0Zm9ybSwgYXJjaDogc3RyaW5nID0gcHJvY2Vzcy5hcmNoKSB7XG4gIGNvbnN0IG9zID0gUExBVEZPUk1TW3BsYXRmb3JtXTtcbiAgY29uc3QgY3B1ID0gQVJDSFNbYXJjaF07XG4gIGlmICghb3MgfHwgIWNwdSkge1xuICAgIHRocm93IG5ldyBFcnJvcihgYXRsYXMgaXMgbm90IGF2YWlsYWJsZSBmb3IgJHtwbGF0Zm9ybX0tJHthcmNofSAoc3VwcG9ydGVkOiBkYXJ3aW4vbGludXgsIHg2NC9hcm02NClgKTtcbiAgfVxuICByZXR1cm4gYGF0bGFzLWNvbW11bml0eS0ke29zfS0ke2NwdX0tdiR7dmVyc2lvbn1gO1xufVxuXG5hc3luYyBmdW5jdGlvbiBkb3dubG9hZCh1cmw6IHN0cmluZykge1xuICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGZldGNoKHVybCk7XG4gIGlmICghcmVzcG9uc2Uub2spIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoYGZhaWxlZCB0byBkb3dubG9hZCAke3VybH06ICR7cmVzcG9uc2Uuc3RhdHVzfSAke3Jlc3BvbnNlLnN0YXR1c1RleHR9YCk7XG4gIH1cbiAgcmV0dXJuIEJ1ZmZlci5mcm9tKGF3YWl0IHJlc3BvbnNlLmFycmF5QnVmZmVyKCkpO1xufVxuXG4vKipcbiAqIERvd25sb2FkcyB0aGUgQXRsYXMgQ29tbXVuaXR5IEVkaXRpb24gYmluYXJ5IChBcGFjaGUgMi4wKSBpbiB0aGUgdmVyc2lvbiBjb25maWd1cmVkIGluIGQ5LXBsdW1iaW5nLmpzb24gYW5kIHJldHVybnMgaXRzIHBhdGguXG4gKiBUaGUgYmluYXJ5IGlzIGNhY2hlZCBpbiBub2RlX21vZHVsZXMvLmNhY2hlL2Q5LXBsdW1iaW5nLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZW5zdXJlQXRsYXMoKTogUHJvbWlzZTxzdHJpbmc+IHtcbiAgY29uc3QgY29uZmlnID0gcmVhZFBsdW1iaW5nQ29uZmlnKCk7XG4gIGNvbnN0IGZpbGVOYW1lID0gYXRsYXNGaWxlTmFtZShjb25maWcuYXRsYXNWZXJzaW9uID8/IERFRkFVTFRfQVRMQVNfVkVSU0lPTik7XG4gIGNvbnN0IGJpblBhdGggPSBqb2luKENBQ0hFX0RJUiwgZmlsZU5hbWUpO1xuICBpZiAoZXhpc3RzU3luYyhiaW5QYXRoKSkge1xuICAgIHJldHVybiBiaW5QYXRoO1xuICB9XG5cbiAgbG9nZ2VyLmluZm8oYERvd25sb2FkaW5nICR7ZmlsZU5hbWV9YCk7XG4gIGNvbnN0IFtiaW5hcnksIGNoZWNrc3VtRmlsZV0gPSBhd2FpdCBQcm9taXNlLmFsbChbXG4gICAgZG93bmxvYWQoYCR7UkVMRUFTRV9TRVJWRVJ9LyR7ZmlsZU5hbWV9YCksXG4gICAgZG93bmxvYWQoYCR7UkVMRUFTRV9TRVJWRVJ9LyR7ZmlsZU5hbWV9LnNoYTI1NmApLFxuICBdKTtcbiAgY29uc3QgZXhwZWN0ZWQgPSBjaGVja3N1bUZpbGUudG9TdHJpbmcoKS50cmltKCkuc3BsaXQoL1xccysvKVswXTtcbiAgY29uc3QgYWN0dWFsID0gY3JlYXRlSGFzaCgnc2hhMjU2JykudXBkYXRlKGJpbmFyeSkuZGlnZXN0KCdoZXgnKTtcbiAgaWYgKGFjdHVhbCAhPT0gZXhwZWN0ZWQpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoYGNoZWNrc3VtIG1pc21hdGNoIGZvciAke2ZpbGVOYW1lfTogZXhwZWN0ZWQgJHtleHBlY3RlZH0sIGdvdCAke2FjdHVhbH1gKTtcbiAgfVxuXG4gIGF3YWl0IG1rZGlyKENBQ0hFX0RJUiwgeyByZWN1cnNpdmU6IHRydWUgfSk7XG4gIC8vIHdyaXR0ZW4gdGhlbiByZW5hbWVkLCBzbyBhbiBpbnRlcnJ1cHRlZCBkb3dubG9hZCBuZXZlciBsZWF2ZXMgYSBicm9rZW4gYmluYXJ5IGluIHRoZSBjYWNoZVxuICBjb25zdCB0bXBQYXRoID0gYCR7YmluUGF0aH0udG1wYDtcbiAgYXdhaXQgd3JpdGVGaWxlKHRtcFBhdGgsIGJpbmFyeSk7XG4gIGF3YWl0IGNobW9kKHRtcFBhdGgsIDBvNzU1KTtcbiAgYXdhaXQgcmVuYW1lKHRtcFBhdGgsIGJpblBhdGgpO1xuICByZXR1cm4gYmluUGF0aDtcbn1cbiJdfQ==