@ddt-tools/cli 0.2.0 → 0.2.4

package/dist/publish-AYCRMCE2.js

@@ -0,0 +1,739 @@
+import {
+  attachRelatedOptions
+} from "./chunk-DL3V7UJ2.js";
+import {
+  addMappingFlags,
+  buildMappingFromOptions,
+  describeMapping
+} from "./chunk-2FT6HXKS.js";
+import "./chunk-DGUM43GV.js";
+
+// src/commands/publish.ts
+import { Command } from "commander";
+import { promises as fs } from "fs";
+import path from "path";
+import {
+  CompareEngine,
+  DatabricksExecutor,
+  PacSource,
+  ProjectSource,
+  ScriptGenerator,
+  ai,
+  aiPreflight,
+  approval,
+  buildDeployManifest,
+  buildExecutionPlan,
+  colorizeMigrationScript,
+  compileSlice,
+  createConnection,
+  defaultSafePlan,
+  executePlan,
+  getProfile,
+  lintSql,
+  loadProject,
+  mergeDeployOptions,
+  pac as pacNs,
+  pacFreshness,
+  protectedObjects,
+  queryExecution,
+  recordDeployChangelog,
+  renderHtmlReport,
+  resolveProfile,
+  safety,
+  testFramework,
+  validatePlan
+} from "@ddt-tools/core";
+function publishCommand() {
+  const cmd = new Command("publish");
+  cmd.description("Generate (and optionally apply) a migration script from source \u2192 target.").option(
+    "--source <path>",
+    "Source: .ddtproj or .ddtpac (the desired state). Required for a normal publish; omit only with --restore-from-snapshot."
+  ).option(
+    "--target <path>",
+    "Target: .ddtproj or .ddtpac (the current state). Required for a normal publish; omit only with --restore-from-snapshot."
+  ).option(
+    "--restore-from-snapshot <batchId>",
+    "Recovery mode: skip the compare step and emit DROP/CREATE \u2026 SHALLOW CLONE against the snapshot batch <batchId> from the registry. Dry-run by default; pass --apply --yes to execute. This is the command printed by TRUST.4's post-deploy-smoke + TRUST.8's restore-hint when a deploy fails \u2014 they tell the operator to run `ddt publish --restore-from-snapshot <id>`."
+  ).option(
+    "--snapshot-dir <path>",
+    "Snapshot registry directory used with --restore-from-snapshot.",
+    ".ddt/snapshots"
+  ).option(
+    "--out <path>",
+    "Write the generated SQL to this path (currently honored on the --restore-from-snapshot recovery path)."
+  ).option("--dry-run", "Print the migration script and safety assessment without applying.", true).option(
+    "--apply",
+    "Apply the migration against --connection. Requires --connection. Default false.",
+    false
+  ).option("--connection <name>", "Connection profile to apply against. Required with --apply.").option(
+    "--yes",
+    "Skip interactive confirmation when applying. Required with --apply (no TTY today).",
+    false
+  ).option("--variables <kv>", "Comma-separated KEY=VALUE pairs for $(VAR) substitution.").option("--ignore-case", "Compare object FQNs case-insensitively.", false).option(
+    "--no-rollback",
+    "Skip rollback on partial failure (leaves DIRTY state). Default rollback ON."
+  ).option(
+    "--require-reversible",
+    "Refuse before any DDL runs if any step lacks reverse SQL.",
+    false
+  ).option(
+    "--manifest <path>",
+    "Write a JSON deploy manifest (every step + status + duration + reverse SQL) to <path>. Audit-friendly."
+  ).option("--report-html <path>", "Write a self-contained HTML compare-report to <path>.").option(
+    "--no-lint",
+    "Skip the lint gate. Default: lint the generated script and refuse --apply on ERROR-severity findings."
+  ).option(
+    "--webhook <url>",
+    "POST a deploy-summary JSON to this URL after --apply completes. Or set $DDT_NOTIFY_WEBHOOK."
+  ).option(
+    "--profile <name>",
+    "Use the deploymentProfiles[<name>] overlay from --source (.ddtproj). Pulls profile.connection, profile.variables, profile.deployOptions on top of project defaults."
+  ).option(
+    "--changelog [catalog]",
+    "After --apply, append a row to <catalog>.__ddt.deploy_log on the workspace. Defaults catalog to the connection profile's default catalog. Liquibase-style audit table."
+  ).option(
+    "--no-slice",
+    "Disable the source's Project Slice (if it has one). Default: a sliced source partitions the diff automatically and target objects outside the slice are left untouched."
+  ).option(
+    "--query-tag <tag>",
+    "Tag attached to every executed statement so system.query.history can attribute the deploy. Prepended as `-- DDT-TAG: <tag>` comment. Defaults to 'ddt:<projectName>@<projectVersion>:<unix-ms>' when omitted."
+  ).option(
+    "--color <mode>",
+    "Color stdout: auto | always | never. Honors NO_COLOR / DDT_NO_COLOR env vars in auto mode.",
+    "auto"
+  ).option(
+    "--ai-preflight",
+    "Before --apply, ask AI to grade the operator's plain-language deploy description against the actual diff + safety findings. Blocks on 'mismatch' unless --confirm-after-preflight-mismatch is also passed.",
+    false
+  ).option(
+    "--ai-preflight-text <narrative>",
+    "Non-interactive form of --ai-preflight. Supplies the narrative directly instead of reading from stdin."
+  ).option(
+    "--strict-ai-preflight",
+    "Also block on 'partial' (not just 'mismatch'). Useful for production deploys.",
+    false
+  ).option(
+    "--confirm-after-preflight-mismatch",
+    "Proceed even when --ai-preflight returns a mismatch verdict. Acknowledges that the AI grader flagged a discrepancy.",
+    false
+  ).option(
+    "--require-approvals <n>",
+    "Multi-approver gate: refuse --apply until <n> distinct approvers have signed off via `ddt approval add <deploy-id> --as <user>`. Team-tier."
+  ).option(
+    "--approver <ids>",
+    "Comma-separated allow-list of approver IDs honoured by --require-approvals. Empty = any approver counts."
+  ).option(
+    "--deploy-id <id>",
+    "Stable deploy identifier paired with --require-approvals (default: <connection>:<catalog>.<schema>)."
+  ).option(
+    "--approvals-root <path>",
+    "Approvals directory (default: .ddt/approvals).",
+    path.join(".ddt", "approvals")
+  ).option(
+    "--allow-protected <fqns>",
+    "Comma-separated FQNs to exempt from the .ddt-protection.json gate. Repeatable.",
+    (val, prev) => [...prev, val],
+    []
+  ).option(
+    "--allow-all-protected",
+    "Bypass all protection gates defined in .ddt-protection.json. Use with care.",
+    false
+  ).option(
+    "--freshness <mode>",
+    "Pac age check: warn (log if stale, continue), strict (block if stale), skip (no check). Default warn.",
+    "warn"
+  ).option(
+    "--post-deploy-tests <project>",
+    "After a successful --apply, discover YAML tests under <project>/tests/ and run them against the same connection. Exits 2 on any blocking (error-severity) DQ failure. Emits POST_DEPLOY_DQ_FAILED hint with --manifest recipe when tests fail."
+  );
+  addMappingFlags(cmd);
+  cmd.action(async (opts) => {
+    if (opts.restoreFromSnapshot) {
+      await runRestoreFromSnapshot(opts);
+      return;
+    }
+    if (!opts.source || !opts.target) {
+      throw new Error(
+        "--source <path> and --target <path> are required (unless --restore-from-snapshot is given)."
+      );
+    }
+    const nameMapping = await buildMappingFromOptions(opts);
+    const sourcePath = String(opts.source);
+    const targetPath = String(opts.target);
+    const engine = new CompareEngine();
+    const src = sourcePath.endsWith(".ddtpac") ? new PacSource(sourcePath, "source") : new ProjectSource(sourcePath, "source");
+    const tgt = targetPath.endsWith(".ddtpac") ? new PacSource(targetPath, "target") : new ProjectSource(targetPath, "target");
+    let loadedSrcPac;
+    if (sourcePath.endsWith(".ddtpac")) {
+      loadedSrcPac = await pacNs.readPac(sourcePath);
+      const freshnessMode = opts.freshness ?? "warn";
+      if (freshnessMode !== "skip") {
+        const fr = pacFreshness.checkPacFreshness(loadedSrcPac.manifest.builtAt);
+        if (fr.status !== "fresh") {
+          const msg = pacFreshness.formatFreshnessWarning(fr, sourcePath);
+          if (freshnessMode === "strict") {
+            console.error(msg);
+            process.exitCode = 1;
+            return;
+          } else {
+            console.warn(msg);
+          }
+        }
+      }
+    }
+    let slice;
+    if (opts.slice !== false) {
+      if (sourcePath.endsWith(".ddtpac")) {
+        const srcPac = loadedSrcPac ?? await pacNs.readPac(sourcePath);
+        if (srcPac.manifest.slice) slice = compileSlice(srcPac.manifest.slice);
+      } else {
+        const loaded = await loadProject(sourcePath);
+        if (loaded.project.slice) slice = compileSlice(loaded.project.slice);
+      }
+    }
+    const result = await engine.compare(src, tgt, {
+      ignoreCase: !!opts.ignoreCase,
+      ...nameMapping ? { nameMapping } : {},
+      ...slice ? { sliceFilter: slice } : {}
+    });
+    const mappingSummary = describeMapping(nameMapping);
+    if (mappingSummary) console.log(`Mapping: ${mappingSummary}`);
+    if (slice) {
+      const outside = result.outsideScope?.length ?? 0;
+      const refs = result.referenced?.length ?? 0;
+      console.log(
+        `Slice active: ${result.objects.length} owned \xB7 ${outside} outside scope (untouched) \xB7 ${refs} referenced`
+      );
+    }
+    if (opts.reportHtml) {
+      const html = renderHtmlReport(result, {
+        title: `Publish ${result.source.label} \u2192 ${result.target.label}`,
+        safety: safety.assess(result)
+      });
+      const htmlPath = path.resolve(String(opts.reportHtml));
+      await fs.mkdir(path.dirname(htmlPath), { recursive: true });
+      await fs.writeFile(htmlPath, html, "utf8");
+      console.log(`Wrote HTML report \u2192 ${htmlPath}`);
+    }
+    let profileDeployment;
+    let profileVariables = {};
+    let profileConnection;
+    if (opts.profile) {
+      const profileName = String(opts.profile);
+      if (sourcePath.endsWith(".ddtpac")) {
+        const srcPac = loadedSrcPac ?? await pacNs.readPac(sourcePath);
+        const block = srcPac.manifest.deploymentProfiles?.[profileName];
+        if (!block) {
+          const available = Object.keys(srcPac.manifest.deploymentProfiles ?? {});
+          throw new Error(
+            `--profile ${profileName}: no deploymentProfile by that name in the pac manifest. ` + (available.length === 0 ? "The pac carries no deploymentProfiles (was it built before VARSYNTAX.2, or does the .ddtproj declare any?)." : `Available: ${available.join(", ")}.`)
+          );
+        }
+        if (block.variables) profileVariables = { ...block.variables };
+        if (block.connection) profileConnection = block.connection;
+        console.log(
+          `Profile:  ${profileName}${profileConnection ? ` (connection=${profileConnection})` : ""}`
+        );
+      } else {
+        const loaded = await loadProject(sourcePath);
+        const resolved = resolveProfile(loaded, profileName);
+        profileDeployment = resolved.deployment;
+        profileVariables = resolved.variables;
+        profileConnection = resolved.connection;
+        console.log(`Profile:  ${resolved.name} (connection=${resolved.connection})`);
+      }
+    }
+    const assessment = safety.assess(result);
+    const deployment = profileDeployment ?? mergeDeployOptions().deployment;
+    const variables = { ...profileVariables, ...parseVariables(opts.variables) ?? {} };
+    let ctxProjectName;
+    let ctxProjectVersion;
+    if (sourcePath.endsWith(".ddtpac")) {
+      const srcPac = loadedSrcPac ?? await pacNs.readPac(sourcePath);
+      ctxProjectName = srcPac.manifest.projectName;
+      ctxProjectVersion = srcPac.manifest.projectVersion;
+    } else {
+      try {
+        const loaded = await loadProject(sourcePath);
+        ctxProjectName = loaded.project.name;
+        ctxProjectVersion = loaded.project.version;
+      } catch {
+      }
+    }
+    const generateContext = {
+      ...opts.profile ? { profile: String(opts.profile) } : {},
+      ...ctxProjectName ? { projectName: ctxProjectName } : {},
+      ...ctxProjectVersion ? { projectVersion: ctxProjectVersion } : {}
+    };
+    const generator = new ScriptGenerator();
+    const script = generator.generate(result, {
+      variables,
+      deployment,
+      context: generateContext
+    });
+    const plan = defaultSafePlan(result);
+    const validated = validatePlan(result, plan);
+    const steps = buildExecutionPlan(result, validated, { deployment });
+    const protConfig = await protectedObjects.loadProtectionConfig(path.dirname(sourcePath));
+    if (protConfig) {
+      const ops = result.objects.filter((o) => o.kind !== "unchanged" && o.kind !== "added").map((o) => ({
+        fqn: o.identity.fqn,
+        objectType: String(o.identity.objectType),
+        kind: o.kind
+      }));
+      const allowedFqns = (opts.allowProtected ?? []).flatMap(
+        (s) => s.split(",").map((f) => f.trim())
+      );
+      const violations = protectedObjects.checkProtectedObjects(ops, protConfig, {
+        allowedFqns,
+        allowAll: Boolean(opts.allowAllProtected)
+      });
+      if (violations.length > 0) {
+        console.error(protectedObjects.formatProtectionViolations(violations));
+        process.exitCode = 1;
+        return;
+      }
+    }
+    printPlanReport(result.summary, script.summary, assessment, steps);
+    if (opts.apply) {
+      const connectionName = opts.connection ?? profileConnection;
+      if (!connectionName) {
+        throw new Error(
+          "--apply requires --connection <profile-name> or --profile <env> (supplies connection)."
+        );
+      }
+      if (!opts.yes) {
+        throw new Error(
+          "--apply requires --yes. The CLI does not currently prompt interactively. Pass --yes to confirm."
+        );
+      }
+      if (assessment.blocked) {
+        console.error(
+          `Refusing to apply: safety classifier blocked the deploy (${assessment.blockReason}).`
+        );
+        process.exitCode = 2;
+        return;
+      }
+      if (opts.requireApprovals !== void 0 && opts.requireApprovals !== false) {
+        const required = Number(opts.requireApprovals) || 0;
+        const allowed = opts.approver ? String(opts.approver).split(",").map((s) => s.trim()).filter(Boolean) : [];
+        const deployId = String(opts.deployId ?? `${connectionName}:default`);
+        const approvalsRoot = String(opts.approvalsRoot);
+        const file = await approval.readApprovalFile(approvalsRoot, deployId);
+        const outcome = approval.evaluateApprovalGate(
+          { deployId, required, allowedApprovers: allowed },
+          file.approvals
+        );
+        if (!outcome.satisfied) {
+          console.error(
+            "Approval gate blocked deploy: " + (outcome.blockReason ?? "gate not satisfied") + `. Record approvals with \`ddt approval add ${deployId} --as <user>\`.`
+          );
+          process.exitCode = 2;
+          return;
+        }
+        console.error(
+          `  approvals: ${outcome.satisfiedBy.length}/${required} (${outcome.satisfiedBy.join(", ")})`
+        );
+      }
+      if (opts.aiPreflight) {
+        const narrative = await readPreflightNarrative(opts.aiPreflightText);
+        if (!narrative) {
+          console.error(
+            "--ai-preflight needs a narrative. Provide it inline via --ai-preflight-text or via stdin."
+          );
+          process.exitCode = 2;
+          return;
+        }
+        console.log("Grading deploy narrative with AI...");
+        try {
+          const findings = [
+            ...assessment.unrecoverable.map((f) => ({
+              code: String(f.code),
+              fqn: f.fqn,
+              reason: f.reason
+            })),
+            ...assessment.destructive.map((f) => ({
+              code: String(f.code),
+              fqn: f.fqn,
+              reason: f.reason
+            })),
+            ...assessment.expensive.map((f) => ({
+              code: String(f.code),
+              fqn: f.fqn,
+              reason: f.reason
+            }))
+          ];
+          const compareSummary = `added ${result.summary.added}, modified ${result.summary.modified}, removed ${result.summary.removed}, unchanged ${result.summary.unchanged}`;
+          const verdict = await aiPreflight.gradePreflight(
+            {
+              narrative,
+              compareSummary,
+              safetyFindings: findings,
+              diffSampleDdl: script.sql,
+              target: `${result.target.label}@${connectionName ?? "unknown"}`
+            },
+            {
+              completeFn: async (prompt) => {
+                const r = await ai.complete([{ role: "user", content: prompt }], {
+                  feature: "ai-preflight"
+                });
+                return r.text;
+              }
+            }
+          );
+          console.log(`  preflight verdict: ${verdict.verdict}`);
+          if (verdict.reasoning) console.log(`  preflight reasoning: ${verdict.reasoning}`);
+          for (const d of verdict.discrepancies) console.log(`    \u2022 ${d}`);
+          const isBlocking = verdict.verdict === "mismatch" || opts.strictAiPreflight && verdict.verdict === "partial";
+          if (isBlocking && !opts.confirmAfterPreflightMismatch) {
+            console.error(
+              `Refusing to apply: AI preflight returned "${verdict.verdict}". Re-run with --confirm-after-preflight-mismatch to override, or revise the narrative.`
+            );
+            process.exitCode = 2;
+            return;
+          }
+          if (verdict.parseFailed) {
+            console.warn(
+              "  preflight verdict could not be parsed \u2014 continuing without a clean alignment signal."
+            );
+          }
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          console.error(
+            `--ai-preflight failed: ${msg}. Configure an AI provider via \`ddt ai status\` or omit --ai-preflight.`
+          );
+          process.exitCode = 2;
+          return;
+        }
+      }
+      if (opts.lint !== false) {
+        const lint = lintSql(script.sql);
+        if (lint.errorCount > 0) {
+          console.error("");
+          console.error(
+            `Refusing to apply: lint gate caught ${lint.errorCount} ERROR-severity finding(s).`
+          );
+          for (const f of lint.findings) {
+            if (f.severity !== "ERROR") continue;
+            console.error(`  ${f.rule} line ${f.line}: ${f.message}`);
+            if (f.suggestion) console.error(`    \u2192 ${f.suggestion}`);
+          }
+          console.error("");
+          console.error("Resolve the findings or re-run with --no-lint to override.");
+          process.exitCode = 2;
+          return;
+        }
+        if (lint.warningCount > 0) {
+          console.log(`Lint: ${lint.warningCount} warning(s) \u2014 proceeding.`);
+        }
+      }
+      const profile = await getProfile(String(connectionName));
+      const conn = createConnection(profile);
+      const queryTag = resolveQueryTag(
+        opts.queryTag,
+        sourcePath,
+        result.source.label,
+        ctxProjectName,
+        ctxProjectVersion
+      );
+      if (queryTag) console.log(`Query tag: ${queryTag}`);
+      try {
+        await conn.connect();
+        const executor = new DatabricksExecutor(conn, {
+          ...queryTag ? { queryTag } : {},
+          onStatement: (sql) => {
+            const head = sql.split("\n")[0]?.slice(0, 100) ?? "";
+            console.log(`  \u2192 ${head}${sql.length > 100 ? " \u2026" : ""}`);
+          }
+        });
+        console.log("");
+        console.log("--- APPLYING ---");
+        const report = await executePlan(steps, executor, {
+          rollbackOnFailure: opts.rollback !== false,
+          requireReversible: !!opts.requireReversible,
+          onStepStart: (step) => {
+            console.log(`\u25B6 ${step.objectType} ${step.fqn} \u2014 ${step.description}`);
+          },
+          onStepEnd: (r) => {
+            const tag = r.status === "SUCCESS" ? "\u2713" : r.status === "ROLLED_BACK" ? "\u21A9" : r.status === "FAILED" ? "\u2717" : r.status === "SKIPPED" ? "-" : "?";
+            console.log(
+              `  ${tag} ${r.status}${r.durationMs ? ` (${r.durationMs}ms)` : ""}${r.error ? `: ${r.error}` : ""}`
+            );
+          }
+        });
+        console.log("");
+        console.log("--- DEPLOYMENT REPORT ---");
+        console.log(`finalState: ${report.finalState}`);
+        if (report.failedStepId) console.log(`failedStepId: ${report.failedStepId}`);
+        if (report.preflightErrors?.length) {
+          console.log("preflightErrors:");
+          for (const e of report.preflightErrors) console.log(`  ${e}`);
+        }
+        const manifestJson = JSON.stringify(
+          buildDeployManifest(report, profile.auth.host),
+          null,
+          2
+        );
+        if (opts.manifest) {
+          const mPath = path.resolve(String(opts.manifest));
+          await fs.mkdir(path.dirname(mPath), { recursive: true });
+          await fs.writeFile(mPath, manifestJson + "\n", "utf8");
+          console.log(`Wrote deploy manifest \u2192 ${mPath}`);
+        }
+        if (opts.changelog) {
+          const catalog = opts.changelog === true ? void 0 : String(opts.changelog);
+          const r = await recordDeployChangelog(
+            conn,
+            report,
+            result.source,
+            result.target,
+            manifestJson,
+            "0.3.0",
+            catalog ? { catalog } : {}
+          );
+          if (r.ok) {
+            console.log(`Changelog: deploy_id=${r.entry.deployId} appended.`);
+          } else {
+            console.error(`Changelog write failed (deploy still completed): ${r.error}`);
+          }
+        }
+        const webhookUrl = opts.webhook ?? process.env["DDT_NOTIFY_WEBHOOK"];
+        if (webhookUrl) {
+          try {
+            await postWebhook(String(webhookUrl), {
+              workspaceHost: profile.auth.host,
+              source: result.source.label,
+              target: result.target.label,
+              finalState: report.finalState,
+              failedStepId: report.failedStepId,
+              stepsTotal: report.steps.length,
+              stepsSucceeded: report.steps.filter((s) => s.status === "SUCCESS").length,
+              stepsFailed: report.steps.filter((s) => s.status === "FAILED").length
+            });
+            console.log(`Webhook notified \u2192 ${webhookUrl}`);
+          } catch (err) {
+            console.error(
+              `Webhook POST failed (deploy still completed): ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+        }
+        if (report.finalState === "DIRTY") {
+          console.error(
+            "DIRTY: rollback could not complete. Manual intervention required \u2014 see report above."
+          );
+          process.exitCode = 1;
+        } else if (report.finalState !== "CLEAN_SUCCESS") {
+          process.exitCode = 1;
+        }
+        if (opts.postDeployTests && report.finalState === "CLEAN_SUCCESS") {
+          const projectRoot = path.resolve(String(opts.postDeployTests));
+          console.log("Running post-deploy DQ tests from " + projectRoot + "...");
+          const testFiles = await testFramework.discoverTests(projectRoot);
+          if (testFiles.length === 0) {
+            console.warn(
+              "  POST_DEPLOY_DQ: no tests found under " + projectRoot + "/tests/ \u2014 skipping."
+            );
+          } else {
+            const dqReport = await testFramework.runTestFiles(testFiles, conn);
+            process.stdout.write(testFramework.renderTextReport(dqReport));
+            if (dqReport.summary.blocking) {
+              console.error(
+                "POST_DEPLOY_DQ_FAILED: " + dqReport.summary.fail + " fail / " + dqReport.summary.error + " error." + (opts.manifest ? " Recover: `ddt revert --manifest " + String(opts.manifest) + "`" : " Inspect tests/ and re-run after fixing data issues.")
+              );
+              process.exitCode = 2;
+            } else {
+              console.log(
+                "  POST_DEPLOY_DQ: " + dqReport.summary.pass + "/" + dqReport.summary.total + " pass."
+              );
+            }
+          }
+        }
+      } finally {
+        await conn.disconnect();
+      }
+      return;
+    }
+    const colorMode = opts.color ?? "auto";
+    console.log("");
+    console.log("--- MIGRATION SCRIPT ---");
+    console.log(colorizeMigrationScript(script.sql, { mode: colorMode }));
+  });
+  attachRelatedOptions(cmd, [
+    "deployment.allowDropTable",
+    "deployment.allowDropColumn",
+    "deployment.allowUnrecoverableDrop",
+    "deployment.allowNarrowingTypes",
+    "deployment.allowTableRebuild",
+    "deployment.blockOnPossibleDataLoss",
+    "deployment.preserveTargetOnlyObjects"
+  ]);
+  return cmd;
+}
+function printPlanReport(diffSummary, scriptSummary, assessment, steps) {
+  console.log("--- COMPARE SUMMARY ---");
+  console.log(
+    `+${diffSummary.added} -${diffSummary.removed} ~${diffSummary.modified} =${diffSummary.unchanged}` + (scriptSummary.destructive ? ` (destructive=${scriptSummary.destructive})` : "") + (scriptSummary.refused ? ` (refused=${scriptSummary.refused})` : "")
+  );
+  console.log("");
+  console.log("--- SAFETY ASSESSMENT ---");
+  console.log(`unrecoverable=${assessment.unrecoverable.length}`);
+  console.log(`destructive=${assessment.destructive.length}`);
+  console.log(`expensive=${assessment.expensive.length}`);
+  console.log(`warnings=${assessment.warnings.length}`);
+  if (assessment.blocked) console.log(`BLOCKED: ${assessment.blockReason}`);
+  console.log("");
+  console.log("--- DEFAULT-SAFE PLAN ---");
+  const reversible = steps.filter((st) => st.reverseSql).length;
+  console.log(`${steps.length} step(s) planned (default-safe selection)`);
+  console.log(`${reversible} step(s) reversible \xB7 ${steps.length - reversible} irreversible`);
+}
+async function postWebhook(url, payload) {
+  const isSlackOrTeams = /hooks\.slack\.com|webhook\.office\.com/.test(url);
+  let body;
+  if (isSlackOrTeams) {
+    const summary = payload;
+    body = JSON.stringify({
+      text: `DDT publish \u2192 ${summary.target} \xB7 ${summary.finalState} \xB7 ${summary.stepsSucceeded}/${summary.stepsTotal} steps ok${summary.stepsFailed ? ` \xB7 ${summary.stepsFailed} failed` : ""}`
+    });
+  } else {
+    body = JSON.stringify(payload);
+  }
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body
+  });
+  if (!res.ok) {
+    throw new Error(`HTTP ${res.status} ${res.statusText}`);
+  }
+}
+function parseVariables(raw) {
+  if (!raw) return void 0;
+  const out = {};
+  for (const pair of String(raw).split(",")) {
+    const eq = pair.indexOf("=");
+    if (eq <= 0) continue;
+    const k = pair.slice(0, eq).trim();
+    const v = pair.slice(eq + 1).trim();
+    if (k.length > 0) out[k] = v;
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function resolveQueryTag(raw, sourcePath, sourceLabel, projectName, projectVersion) {
+  if (raw !== void 0) {
+    const s = String(raw).trim();
+    return s.length === 0 ? void 0 : s;
+  }
+  const fallback = sourcePath.endsWith(".ddtpac") ? path.basename(sourcePath, ".ddtpac") : sourceLabel;
+  const base = projectName ?? fallback;
+  const version = projectVersion ? `@${projectVersion}` : "";
+  return `ddt:${base}${version}:${Date.now()}`;
+}
+async function runRestoreFromSnapshot(opts) {
+  const batchId = String(opts.restoreFromSnapshot);
+  const registryDir = path.resolve(String(opts.snapshotDir ?? ".ddt/snapshots"));
+  let batch;
+  try {
+    batch = await safety.readSnapshotBatch(registryDir, batchId);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`Snapshot batch "${batchId}" not found in ${registryDir}: ${msg}`);
+    process.exitCode = 1;
+    return;
+  }
+  const sqlLines = safety.emitRestoreFromSnapshotSql(batch);
+  const sql = sqlLines.join("\n");
+  console.log(`Restoring from batch ${batch.batchId} (createdAt=${batch.createdAt})`);
+  console.log(
+    `  ${batch.entries.length} object(s) recorded; ${sqlLines.filter((l) => !l.startsWith("--")).length} statement(s) will run.`
+  );
+  if (opts.out) {
+    const out = path.resolve(String(opts.out));
+    await fs.mkdir(path.dirname(out), { recursive: true });
+    await fs.writeFile(out, sql + "\n", "utf8");
+    console.log(`Wrote restore SQL \u2192 ${out}`);
+  }
+  if (!opts.apply) {
+    const colorMode = opts.color ?? "auto";
+    process.stdout.write(colorizeMigrationScript(sql, { mode: colorMode }) + "\n");
+    return;
+  }
+  if (!opts.yes) {
+    console.error(
+      "--apply requires --yes (restore replaces target tables via DROP + SHALLOW CLONE)."
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (!opts.connection) {
+    console.error("--apply --restore-from-snapshot requires --connection <profile>.");
+    process.exitCode = 1;
+    return;
+  }
+  const profile = await getProfile(String(opts.connection));
+  const conn = createConnection(profile);
+  let executed = 0;
+  let failed = 0;
+  try {
+    await conn.connect();
+    for (const stmt of queryExecution.splitStatements(sql).map((s) => s.sql)) {
+      try {
+        await conn.executeRows(stmt);
+        executed += 1;
+        const head = stmt.split("\n")[0]?.slice(0, 100) ?? "";
+        console.log("  \u2192 " + head + (stmt.length > 100 ? " \u2026" : ""));
+      } catch (err) {
+        failed += 1;
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`  [restore ${batch.batchId}] ${msg}
+      ${stmt}`);
+      }
+    }
+  } finally {
+    await conn.disconnect();
+  }
+  if (failed === 0) {
+    console.log(`Restore complete. ${executed} statement(s) executed.`);
+  } else {
+    console.error(
+      `Restore finished with failures: ${executed} ok, ${failed} failed. Inspect the snapshot tables under ${registryDir} and recover by hand.`
+    );
+    process.exitCode = 1;
+  }
+}
+async function readPreflightNarrative(inlineText) {
+  if (typeof inlineText === "string" && inlineText.trim().length > 0) {
+    return inlineText.trim();
+  }
+  if (process.stdin.isTTY) {
+    process.stdout.write(
+      "\n--ai-preflight is active. In one paragraph, describe what you expect this deploy to do.\nEnd with an empty line (or Ctrl-D):\n> "
+    );
+  }
+  process.stdin.setEncoding("utf8");
+  let buffer = "";
+  await new Promise((resolve) => {
+    const onData = (chunk) => {
+      buffer += chunk;
+      if (/\n\s*\n/.test(buffer)) {
+        process.stdin.removeListener("data", onData);
+        process.stdin.removeListener("end", onEnd);
+        resolve();
+      }
+    };
+    const onEnd = () => {
+      process.stdin.removeListener("data", onData);
+      resolve();
+    };
+    process.stdin.on("data", onData);
+    process.stdin.on("end", onEnd);
+  });
+  const trimmed = buffer.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+export {
+  parseVariables,
+  publishCommand,
+  resolveQueryTag
+};
+//# sourceMappingURL=publish-AYCRMCE2.js.map