@boject/cli 0.0.1-rc.1

package/dist/vendor/contentBundleTypes.ts

@@ -0,0 +1,115 @@
+// VENDORED from apps/cms/scripts/content-bundle/types.ts.
+// The CLI is published standalone and cannot import from apps/cms/.
+// Keep this file in sync when the canonical version changes.
+//
+// This is a PARTIAL vendor by design — the canonical defines additional
+// types (`OnConflict`, `EntryImportPlan`, `EntryImportSummary`,
+// `EntryImportPlanResult`) used by the importer's planner that the CLI
+// does not consume. Do not add them here unless the CLI starts needing
+// them. The drift test (`tests/unit/vendorDrift.test.ts`) intentionally
+// omits this pair because a byte-identical check would fail on the
+// import-source rewrites and the missing types.
+//
+// Types that MUST stay structurally in sync with the canonical:
+//   BundleFieldOptions, BundleField, BundleContentType,
+//   BundleEntryVersion, BundleEntry, Bundle, BundleMode,
+//   ValidationError, ConflictErrorKind, ConflictError,
+//   ValidationResult, ImportResult, and the BUNDLE_VERSION constant.
+
+import type { FieldTypeName } from './fieldTypes.js';
+import type { ContentStatusName } from './contentStatus.js';
+
+// Coupling rule: bumping BUNDLE_VERSION is a breaking change to the bundle
+// format and MUST coincide with a CLI semver-major release. The reverse
+// does not hold — a CLI major may ship without a bundle version bump.
+// See docs/superpowers/specs/2026-05-28-bundle-format-versioning-and-migrations-design.md
+// (internal repo) for the full versioning policy.
+//
+// History: V2 was redefined in #205 to require `entryKey` on every entry.
+// The version number was not bumped at that time (clean cutover — no real
+// v1/v2 entry-bearing bundles existed outside this repo). The defensive
+// v1 entry-shape fallback was removed in #32.
+export const BUNDLE_VERSION = 2;
+
+export type BundleFieldOptions = {
+  choices?: string[];
+  targetContentTypeIds?: string[] | null[];
+  targetContentTypeIdentifiers?: string[];
+  [key: string]: unknown;
+};
+
+export interface BundleField {
+  id: string | null;
+  identifier: string;
+  name: string;
+  type: FieldTypeName;
+  required: boolean;
+  unique?: boolean;
+  order: number;
+  options: BundleFieldOptions | null;
+}
+
+export interface BundleContentType {
+  id: string | null;
+  identifier: string;
+  name: string;
+  description: string | null;
+  fields: BundleField[];
+}
+
+export interface BundleEntryVersion {
+  status: ContentStatusName;
+  data: Record<string, unknown>;
+  publishedAt: string | null;
+}
+
+export interface BundleEntry {
+  id: string | null;
+  contentTypeId: string | null;
+  contentTypeIdentifier: string;
+  entryTitle: string;
+  entryKey: string;
+  slug: string | null;
+  versions: BundleEntryVersion[];
+}
+
+export interface Bundle {
+  version: number;
+  exportedAt: string;
+  portable: boolean;
+  contentTypes?: BundleContentType[];
+  entries?: BundleEntry[];
+}
+
+export type BundleMode = 'schema' | 'entries' | 'all';
+
+export interface ValidationError {
+  path: string;
+  message: string;
+}
+
+export type ConflictErrorKind =
+  | 'contentType.identifier'
+  | 'contentType.id'
+  | 'field.id'
+  | 'entry.id'
+  | 'entry.slug'
+  | 'entry.entryTitle';
+
+export interface ConflictError {
+  kind: ConflictErrorKind;
+  identifier: string;
+  existingId?: string;
+}
+
+export interface ValidationResult {
+  ok: boolean;
+  errors: ValidationError[];
+}
+
+export interface ImportResult {
+  contentTypesCreated: number;
+  entriesCreated: number;
+  entriesUpdated: number;
+  entriesSkipped: number;
+}

package/dist/vendor/contentStatus.ts

@@ -0,0 +1,30 @@
+// Canonical registry of content entry statuses. Mirrors the `ContentStatus`
+// enum in apps/cms/prisma/schema/base.prisma so that resolvers, validators,
+// API handlers, GraphQL types, and tests all read from one source. Pure module
+// (zero Nuxt / Prisma deps) so it ships unchanged into packages/boject-cli
+// via vendor copy — keep packages/boject-cli/src/vendor/contentStatus.ts in sync.
+
+export const CONTENT_STATUSES = {
+  DRAFT: 'DRAFT',
+  PUBLISHED: 'PUBLISHED',
+  CHANGED: 'CHANGED',
+  ARCHIVED: 'ARCHIVED',
+} as const;
+
+export const CONTENT_STATUS_NAMES = Object.values(CONTENT_STATUSES);
+
+export type ContentStatusName =
+  (typeof CONTENT_STATUSES)[keyof typeof CONTENT_STATUSES];
+
+export const CONTENT_STATUSES_SET: ReadonlySet<ContentStatusName> = new Set(
+  CONTENT_STATUS_NAMES
+);
+
+export function isContentStatusName(
+  value: unknown
+): value is ContentStatusName {
+  return (
+    typeof value === 'string' &&
+    CONTENT_STATUSES_SET.has(value as ContentStatusName)
+  );
+}

package/dist/vendor/fieldTypes.ts

@@ -0,0 +1,57 @@
+// Canonical registry of dynamic content type field types. Mirrors the
+// `FieldType` enum in apps/cms/prisma/schema/contentType.prisma so that
+// validators, UI dropdowns, and tests all read from one source. Pure module
+// (zero Nuxt / Prisma deps) so it ships unchanged into packages/boject-cli
+// via vendor copy — keep packages/boject-cli/src/vendor/fieldTypes.ts in sync.
+
+export const FIELD_TYPES = {
+  ENTRY_TITLE: 'ENTRY_TITLE',
+  SLUG: 'SLUG',
+  TEXT: 'TEXT',
+  TEXTAREA: 'TEXTAREA',
+  NUMBER: 'NUMBER',
+  BOOLEAN: 'BOOLEAN',
+  DATETIME: 'DATETIME',
+  SELECT: 'SELECT',
+  RICHTEXT: 'RICHTEXT',
+  RELATION: 'RELATION',
+  MULTIRELATION: 'MULTIRELATION',
+  IMAGE: 'IMAGE',
+} as const;
+
+export const FIELD_TYPE_NAMES = Object.values(FIELD_TYPES);
+
+export type FieldTypeName = (typeof FIELD_TYPES)[keyof typeof FIELD_TYPES];
+
+export const FIELD_TYPES_SET: ReadonlySet<FieldTypeName> = new Set(
+  FIELD_TYPE_NAMES
+);
+
+export function isFieldTypeName(value: unknown): value is FieldTypeName {
+  return (
+    typeof value === 'string' && FIELD_TYPES_SET.has(value as FieldTypeName)
+  );
+}
+
+export const FIELD_TYPE_LABELS: Record<FieldTypeName, string> = {
+  ENTRY_TITLE: 'Entry Title',
+  SLUG: 'Slug',
+  TEXT: 'Text',
+  TEXTAREA: 'Textarea',
+  NUMBER: 'Number',
+  BOOLEAN: 'Boolean',
+  DATETIME: 'Date/Time',
+  SELECT: 'Select',
+  RICHTEXT: 'Rich Text',
+  RELATION: 'Relation',
+  MULTIRELATION: 'Multi Relation',
+  IMAGE: 'Image',
+};
+
+export const FIELD_TYPE_OPTIONS: Array<{
+  label: string;
+  value: FieldTypeName;
+}> = FIELD_TYPE_NAMES.map((value) => ({
+  label: FIELD_TYPE_LABELS[value],
+  value,
+}));

package/dist/vendor/perf/lib/auth-k6.ts

@@ -0,0 +1,14 @@
+import { loadK6Config } from './config-k6.ts';
+
+export function apiKeyHeaders(): Record<string, string> {
+  const cfg = loadK6Config();
+  if (!cfg.apiKey) {
+    throw new Error(
+      'PERF_API_KEY not set. Run: pnpm prisma:seed:perf and export PERF_API_KEY=boject_perf_key_for_load_tests_only'
+    );
+  }
+  return {
+    Authorization: `Bearer ${cfg.apiKey}`,
+    'Content-Type': 'application/json',
+  };
+}

package/dist/vendor/perf/lib/config-k6.ts

@@ -0,0 +1,21 @@
+// k6 runtime (goja VM). Reads `__ENV` — no process.env, no node_modules.
+
+export interface PerfK6Config {
+  baseUrl: string;
+  apiKey: string | undefined;
+  adminEmail: string;
+  adminPassword: string;
+}
+
+export function loadK6Config(): PerfK6Config {
+  const baseUrl = (__ENV.PERF_BASE_URL || 'http://localhost:4000').replace(
+    /\/$/,
+    ''
+  );
+  return {
+    baseUrl,
+    apiKey: __ENV.PERF_API_KEY || undefined,
+    adminEmail: __ENV.PERF_ADMIN_EMAIL || 'admin@example.com',
+    adminPassword: __ENV.PERF_ADMIN_PASSWORD || 'password',
+  };
+}

package/dist/vendor/perf/lib/metrics-k6.ts

@@ -0,0 +1,9 @@
+import { Trend, Counter } from 'k6/metrics';
+
+export const drainLatency = new Trend('perf_drain_page_ms', true);
+export const drainWallClock = new Trend('perf_drain_total_ms', true);
+export const crudCreateLatency = new Trend('perf_crud_create_ms', true);
+export const crudReadLatency = new Trend('perf_crud_read_ms', true);
+export const crudDeleteLatency = new Trend('perf_crud_delete_ms', true);
+export const intentional429s = new Counter('perf_intentional_429');
+export const unexpectedErrors = new Counter('perf_unexpected_errors');

package/dist/vendor/perf/lib/pg-sampler.ts

@@ -0,0 +1,236 @@
+import { Client } from 'pg';
+import { spawn } from 'node:child_process';
+import { appendFileSync, mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+export interface Sample {
+  timestamp: Date;
+  total: number;
+  active: number;
+  idle: number;
+  cpuPercent: number;
+  memMb: number;
+}
+
+export interface SampleOpts {
+  query: (sql: string) => Promise<{
+    rows: Array<{ total: string; active: string; idle: string }>;
+  }>;
+  dockerStats: () => Promise<{ cpu_percent: number; mem_mb: number }>;
+}
+
+export async function sampleOnce(opts: SampleOpts): Promise<Sample> {
+  const [pgResult, docker] = await Promise.all([
+    opts.query(
+      `SELECT COUNT(*) AS total,
+              COUNT(*) FILTER (WHERE state = 'active') AS active,
+              COUNT(*) FILTER (WHERE state = 'idle') AS idle
+       FROM pg_stat_activity
+       WHERE datname = current_database()`
+    ),
+    opts.dockerStats(),
+  ]);
+  const row = pgResult.rows[0]!;
+  return {
+    timestamp: new Date(),
+    total: Number(row.total),
+    active: Number(row.active),
+    idle: Number(row.idle),
+    cpuPercent: docker.cpu_percent,
+    memMb: docker.mem_mb,
+  };
+}
+
+export function formatCsvRow(s: Sample): string {
+  return [
+    s.timestamp.toISOString(),
+    s.total,
+    s.active,
+    s.idle,
+    s.cpuPercent,
+    s.memMb,
+  ].join(',');
+}
+
+export const CSV_HEADER = 'timestamp,total,active,idle,cpu_percent,mem_mb';
+
+// Container name varies with the docker compose project name (defaults to the
+// repo directory) and the compose service name (`db` in docker-compose.yml).
+// The default below matches `pnpm db:up` in this repo; override via env when
+// running against a different deployment.
+const DEFAULT_CONTAINER = 'boject-cms-db-1';
+
+// Pure parser extracted so the regex/JSON behaviour is unit-testable
+// without spawning docker. Currently only matches `MiB` — non-MiB units
+// (KiB / GiB) yield mem_mb=0; the test suite documents this.
+export function parseDockerStatsJson(line: string): {
+  cpu_percent: number;
+  mem_mb: number;
+} {
+  const j = JSON.parse(line.trim()) as {
+    CPUPerc: string;
+    MemUsage: string;
+  };
+  const cpu = Number(j.CPUPerc.replace('%', '').trim());
+  const memMatch = j.MemUsage.match(/([\d.]+)\s*MiB/);
+  const mem = memMatch ? Number(memMatch[1]) : 0;
+  return { cpu_percent: cpu, mem_mb: mem };
+}
+
+async function dockerStatsDefault(): Promise<{
+  cpu_percent: number;
+  mem_mb: number;
+}> {
+  const container = process.env.PERF_SAMPLER_CONTAINER ?? DEFAULT_CONTAINER;
+  return new Promise((resolve, reject) => {
+    const child = spawn('docker', [
+      'stats',
+      '--no-stream',
+      '--format',
+      '{{json .}}',
+      container,
+    ]);
+    let buf = '';
+    let errBuf = '';
+    child.stdout.on('data', (d) => {
+      buf += d.toString();
+    });
+    child.stderr.on('data', (d) => {
+      errBuf += d.toString();
+    });
+    child.on('close', (code) => {
+      if (code !== 0) {
+        console.error(
+          `[pg-sampler] docker stats ${container} exited ${code}: ${errBuf.trim()}`
+        );
+        return resolve({ cpu_percent: 0, mem_mb: 0 });
+      }
+      try {
+        resolve(parseDockerStatsJson(buf));
+      } catch (err) {
+        reject(err);
+      }
+    });
+  });
+}
+
+// Fixed-cadence scheduler: the Nth sample is anchored at
+// `startedAt + N * intervalMs`. Returns the ms to sleep before that tick.
+// Returns 0 when work overran the slot — the caller should sample again
+// immediately rather than padding `intervalMs` on top of every overrun
+// (which would let drift accumulate).
+export function nextTickDelay(opts: {
+  startedAt: number;
+  tickIndex: number;
+  intervalMs: number;
+  now: number;
+}): number {
+  return Math.max(
+    0,
+    opts.startedAt + opts.tickIndex * opts.intervalMs - opts.now
+  );
+}
+
+export function parseIntervalMs(raw: string | undefined): number {
+  const n = Number(raw ?? '5000');
+  if (!Number.isFinite(n) || n <= 0) {
+    throw new Error(
+      `Invalid PERF_SAMPLER_INTERVAL_MS=${JSON.stringify(raw)} — expected a positive number of milliseconds`
+    );
+  }
+  return n;
+}
+
+async function main(): Promise<void> {
+  const outPath = process.env.PERF_SAMPLER_OUT ?? 'pg-samples.csv';
+  const intervalMs = parseIntervalMs(process.env.PERF_SAMPLER_INTERVAL_MS);
+  // `||` not `??`: docker-compose's `${PERF_DATABASE_URL:-}` passthrough sets
+  // the var to '' inside the container when the host has it unset; `??`
+  // would treat '' as a valid value and pg would reject the empty connection
+  // string. `||` falls back on unset AND empty.
+  const databaseUrl =
+    process.env.PERF_DATABASE_URL ||
+    'postgresql://boject:boject@localhost:5432/boject_perf';
+  mkdirSync(dirname(outPath), { recursive: true });
+  appendFileSync(outPath, CSV_HEADER + '\n');
+
+  const client = new Client({ connectionString: databaseUrl });
+  await client.connect();
+
+  // Cooperative shutdown: SIGINT/SIGTERM flips `running` and aborts the
+  // current sleep so Ctrl+C is responsive even between samples. The loop
+  // exits naturally; client.end() runs in the finally block exactly once.
+  let running = true;
+  let sleepAbort: AbortController | null = null;
+  const stop = (): void => {
+    running = false;
+    sleepAbort?.abort();
+  };
+  process.on('SIGINT', stop);
+  process.on('SIGTERM', stop);
+
+  const startedAt = Date.now();
+  let tickIndex = 0;
+
+  try {
+    while (running) {
+      try {
+        const sample = await sampleOnce({
+          query: (sql) => client.query(sql),
+          dockerStats: dockerStatsDefault,
+        });
+        appendFileSync(outPath, formatCsvRow(sample) + '\n');
+      } catch (err) {
+        // Suppress fallout from the in-flight query racing the signal —
+        // those errors are expected during graceful shutdown.
+        if (running) {
+          console.error('[pg-sampler]', err);
+        }
+      }
+      if (!running) break;
+      tickIndex++;
+      const sleepFor = nextTickDelay({
+        startedAt,
+        tickIndex,
+        intervalMs,
+        now: Date.now(),
+      });
+      sleepAbort = new AbortController();
+      const ac = sleepAbort;
+      await new Promise<void>((resolve) => {
+        const t = setTimeout(resolve, sleepFor);
+        ac.signal.addEventListener('abort', () => {
+          clearTimeout(t);
+          resolve();
+        });
+      });
+      sleepAbort = null;
+    }
+  } finally {
+    await client.end();
+  }
+}
+
+// CLI entry — pathToFileURL handles symlinks, spaces in paths, and
+// platform path separators. The naked `file://${argv[1]}` form silently
+// no-ops in those cases.
+//
+// Also gate on the entry's basename: when this module is bundled into
+// the @boject/cli `dist/index.js`, `import.meta.url` is rewritten to the
+// bundle's URL, which equals argv[1] for every CLI invocation — making
+// the original conditional fire on `boject upgrade`, `boject schema *`,
+// etc. The basename check pins auto-run to literal pg-sampler entry.
+function isPgSamplerEntry(): boolean {
+  if (!process.argv[1]) return false;
+  if (import.meta.url !== pathToFileURL(process.argv[1]).href) return false;
+  const entryName = process.argv[1].split(/[\\/]/).pop() ?? '';
+  return /^pg-sampler\.(?:ts|js|mjs|cjs)$/i.test(entryName);
+}
+
+if (isPgSamplerEntry()) {
+  main().catch((err: unknown) => {
+    console.error('[pg-sampler] fatal', err);
+    process.exit(1);
+  });
+}

package/dist/vendor/perf/scenarios/graphql-flat.ts

@@ -0,0 +1,97 @@
+// Scenario 1B — GraphQL flat-RPS ramp.
+// Drives the cms's GraphQL endpoint at increasing arrival rates to find
+// the failure point. PERF_QUERY_SHAPE selects a query template:
+//   - bare: small projection, no joins
+//   - filtered: with a DATETIME filter (exercises JSONB index path)
+//   - relation: includes a RELATION (exercises sub-resolver)
+// Requires the perf DB seeded and PERF_API_KEY exported.
+//
+// Content-type identifiers default to the internal PerfArticle/Author
+// fixture so `pnpm perf:sweep` keeps working unchanged. The CLI
+// (#126) overrides them via PERF_LIST_FIELD / PERF_FILTER_FIELD /
+// PERF_RELATION_FIELD when running against an operator's schema.
+import http from 'k6/http';
+import { check } from 'k6';
+import { loadK6Config } from '../lib/config-k6.ts';
+import { apiKeyHeaders } from '../lib/auth-k6.ts';
+
+const QUERY_SHAPE = __ENV.PERF_QUERY_SHAPE ?? 'bare';
+const LIST_FIELD = __ENV.PERF_LIST_FIELD ?? 'perfArticleList';
+const FILTER_FIELD = __ENV.PERF_FILTER_FIELD ?? 'publishDate';
+const RELATION_FIELD = __ENV.PERF_RELATION_FIELD ?? 'author';
+
+// Power-user intensity overrides. PERF_TARGET_RPS sets the peak; the
+// default 6-stage ramp scales proportionally from it. PERF_STAGES (a
+// CSV of integer RPS targets) overrides the ramp wholesale. With no
+// overrides the produced ramp is [50, 100, 250, 500, 1000, 2000] —
+// byte-equivalent to the previous hardcoded values.
+const TARGET_RPS = Number(__ENV.PERF_TARGET_RPS ?? '2000');
+const STAGE_DURATION = '30s';
+
+function parseStages(): Array<{ target: number; duration: string }> {
+  const raw = __ENV.PERF_STAGES;
+  if (raw) {
+    return raw.split(',').map((s) => ({
+      target: Number(s.trim()),
+      duration: STAGE_DURATION,
+    }));
+  }
+  const ramp = [
+    Math.round(TARGET_RPS * 0.025),
+    Math.round(TARGET_RPS * 0.05),
+    Math.round(TARGET_RPS * 0.125),
+    Math.round(TARGET_RPS * 0.25),
+    Math.round(TARGET_RPS * 0.5),
+    TARGET_RPS,
+  ];
+  return ramp.map((target) => ({ target, duration: STAGE_DURATION }));
+}
+
+const STAGES = parseStages();
+
+const QUERIES: Record<string, string> = {
+  bare: `query Items { ${LIST_FIELD}(first: 100) { edges { node { id } } } }`,
+  filtered: `query Items { ${LIST_FIELD}(first: 100, where: { ${FILTER_FIELD}: { gt: "2020-01-01T00:00:00Z" } }) { edges { node { id } } } }`,
+  relation: `query Items { ${LIST_FIELD}(first: 100) { edges { node { id ${RELATION_FIELD} { id } } } } }`,
+};
+
+export const options = {
+  scenarios: {
+    flat: {
+      executor: 'ramping-arrival-rate',
+      startRate: STAGES[0]?.target ?? 50,
+      timeUnit: '1s',
+      preAllocatedVUs: 50,
+      maxVUs: 500,
+      stages: STAGES,
+    },
+  },
+  thresholds: {
+    http_req_failed: ['rate<0.05'],
+    http_req_duration: ['p(99)<5000'],
+    dropped_iterations: ['count<100'],
+  },
+  tags: { shape: QUERY_SHAPE },
+};
+
+export default function flat() {
+  const cfg = loadK6Config();
+  const headers = apiKeyHeaders();
+  const query = QUERIES[QUERY_SHAPE];
+  if (!query) {
+    throw new Error(
+      `Unknown PERF_QUERY_SHAPE: ${QUERY_SHAPE}. Valid: ${Object.keys(
+        QUERIES
+      ).join(', ')}`
+    );
+  }
+
+  const res = http.post(
+    `${cfg.baseUrl}/api/graphql`,
+    JSON.stringify({ query }),
+    { headers, tags: { shape: QUERY_SHAPE } }
+  );
+  check(res, {
+    '2xx': (r) => r.status >= 200 && r.status < 300,
+  });
+}

package/dist/vendor/perf/scenarios/graphql-sitemap.ts

@@ -0,0 +1,99 @@
+// Scenario 1A — GraphQL cursor-paginated sitemap drain.
+// Each VU drains every entry of the chosen content type via {camelName}List.
+// PERF_VUS scales concurrent read load, NOT parallel partitioning.
+// Requires the perf DB pre-seeded (`pnpm perf:seed --size=N`) and the
+// perf API key present (`pnpm prisma:seed:perf` once per fresh DB).
+//
+// PERF_LIST_FIELD overrides the list field name (default
+// `perfArticleList` keeps the internal harness unchanged). The CLI
+// (#126) sets this to the operator's content-type list field.
+import http, { type RefinedResponse, type ResponseType } from 'k6/http';
+import { check, fail } from 'k6';
+import { loadK6Config } from '../lib/config-k6.ts';
+import { apiKeyHeaders } from '../lib/auth-k6.ts';
+import { drainLatency, drainWallClock } from '../lib/metrics-k6.ts';
+
+const PAGE_SIZE = Number(__ENV.PERF_PAGE_SIZE ?? '100');
+const VUS = Number(__ENV.PERF_VUS ?? '1');
+const LIST_FIELD = __ENV.PERF_LIST_FIELD ?? 'perfArticleList';
+
+export const options = {
+  scenarios: {
+    sitemap: {
+      executor: 'per-vu-iterations',
+      vus: VUS,
+      iterations: 1,
+      maxDuration: '10m',
+    },
+  },
+  thresholds: {
+    http_req_failed: ['rate<0.01'],
+    perf_drain_page_ms: ['p(99)<2000'],
+  },
+  tags: {
+    scenario: 'sitemap',
+    page_size: String(PAGE_SIZE),
+    vus: String(VUS),
+  },
+};
+
+const QUERY = `
+  query Items($first: Int!, $after: String) {
+    ${LIST_FIELD}(first: $first, after: $after) {
+      edges { node { id } cursor }
+      pageInfo { endCursor hasNextPage }
+    }
+  }
+`;
+
+export default function sitemap() {
+  const cfg = loadK6Config();
+  const headers = apiKeyHeaders();
+
+  let cursor: string | null = null;
+  let pages = 0;
+  const start = Date.now();
+
+  while (true) {
+    const res: RefinedResponse<ResponseType | undefined> = http.post(
+      `${cfg.baseUrl}/api/graphql`,
+      JSON.stringify({
+        query: QUERY,
+        variables: { first: PAGE_SIZE, after: cursor },
+      }),
+      { headers, tags: { phase: 'drain' } }
+    );
+    const ok = check(res, {
+      'page 200': (r) => r.status === 200,
+      'has data': (r) => {
+        try {
+          const j = r.json() as {
+            data?: Record<string, { pageInfo?: unknown }>;
+          };
+          return Boolean(j.data?.[LIST_FIELD]?.pageInfo);
+        } catch {
+          return false;
+        }
+      },
+    });
+    if (!ok) fail(`GraphQL page request failed: ${res.status}`);
+    drainLatency.add(res.timings.duration);
+    const body = res.json() as {
+      data?: Record<
+        string,
+        { pageInfo?: { endCursor: string | null; hasNextPage: boolean } }
+      >;
+    };
+    const list = body.data?.[LIST_FIELD];
+    if (!list?.pageInfo) {
+      fail(`GraphQL response missing pageInfo for ${LIST_FIELD}`);
+    }
+    const page = list.pageInfo;
+    pages++;
+    if (!page.hasNextPage) break;
+    cursor = page.endCursor;
+  }
+
+  drainWallClock.add(Date.now() - start);
+  console.log(`sitemap VU drained ${pages} pages in ${Date.now() - start}ms`);
+}