@gurulu/cli 0.4.7 → 1.0.0

package/dist/utils/ui.js

@@ -1,59 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.dim = exports.bold = exports.cyan = exports.yellow = exports.red = exports.green = void 0;
-exports.success = success;
-exports.error = error;
-exports.warn = warn;
-exports.info = info;
-exports.step = step;
-exports.banner = banner;
-exports.prompt = prompt;
-exports.promptSelect = promptSelect;
-const green = (s) => `\x1b[32m${s}\x1b[0m`;
-exports.green = green;
-const red = (s) => `\x1b[31m${s}\x1b[0m`;
-exports.red = red;
-const yellow = (s) => `\x1b[33m${s}\x1b[0m`;
-exports.yellow = yellow;
-const cyan = (s) => `\x1b[36m${s}\x1b[0m`;
-exports.cyan = cyan;
-const bold = (s) => `\x1b[1m${s}\x1b[0m`;
-exports.bold = bold;
-const dim = (s) => `\x1b[2m${s}\x1b[0m`;
-exports.dim = dim;
-function success(msg) { console.log(`${(0, exports.green)('\u2713')} ${msg}`); }
-function error(msg) { console.log(`${(0, exports.red)('\u2717')} ${msg}`); }
-function warn(msg) { console.log(`${(0, exports.yellow)('\u26A0')} ${msg}`); }
-function info(msg) { console.log(`${(0, exports.cyan)('\u2139')} ${msg}`); }
-function step(msg) { console.log(`  ${(0, exports.dim)('\u2192')} ${msg}`); }
-function banner() {
-    console.log('');
-    console.log((0, exports.bold)('  Gurulu.io'));
-    console.log((0, exports.dim)('  Autonomous Analytics Setup'));
-    console.log('');
-}
-function prompt(question) {
-    return new Promise((resolve) => {
-        const readline = require('readline');
-        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-        rl.question(question, (answer) => {
-            rl.close();
-            resolve(answer.trim());
-        });
-    });
-}
-function promptSelect(question, options) {
-    return new Promise((resolve) => {
-        options.forEach((opt, i) => {
-            console.log(`  ${(0, exports.dim)(`${i + 1}.`)} ${opt}`);
-        });
-        console.log('');
-        const readline = require('readline');
-        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-        rl.question(question, (answer) => {
-            rl.close();
-            const idx = parseInt(answer.trim(), 10) - 1;
-            resolve(idx >= 0 && idx < options.length ? idx : 0);
-        });
-    });
-}

package/scripts/README-gurulu-agentic-install.md

@@ -1,114 +0,0 @@
-# gurulu-agentic-install (Phase 14 B3 alpha)
-
-Takes a **gurulu-scan** JSON document (Phase 13 B2) and produces the 10
-`.gurulu/` artifacts consumed by the Phase 13 B1 runtime loader. This is the
-**alpha** — config-only, no source code edits and no SDK injection.
-
-## Pipeline
-
-```
-your repo
-   |
-   | node scripts/gurulu-scan.mjs .           (Phase 13 B2)
-   v
-scan-output.json
-   |
-   | node scripts/gurulu-agentic-install.mjs  (Phase 14 B3 — this tool)
-   v
-.gurulu/
-  install-plan.json
-  core-config.json
-  web.config.json
-  app.config.json
-  server-map.json
-  db-map.json
-  flow-seeds.json
-  milestone-rules.json
-  correlation-map.json
-  connectors.json
-   |
-   | src/lib/gurulu-config/loader.ts          (Phase 13 B1)
-   v
-Runtime ready
-```
-
-## Usage
-
-```bash
-# 1. Scan the target repo
-node scripts/gurulu-scan.mjs /path/to/repo --output scan.json --quiet
-
-# 2. Generate .gurulu/ artifacts
-node scripts/gurulu-agentic-install.mjs scan.json \
-  --site-id site_acme --tenant-id tnt_acme \
-  --output .gurulu
-
-# Optional: preview without writing
-node scripts/gurulu-agentic-install.mjs scan.json \
-  --site-id site_acme --tenant-id tnt_acme --dry-run
-
-# stdin input
-cat scan.json | node scripts/gurulu-agentic-install.mjs - \
-  --site-id site_acme --tenant-id tnt_acme
-```
-
-Flags:
-
-| flag            | purpose                                                       |
-| --------------- | ------------------------------------------------------------- |
-| `--site-id`     | stable site identifier (required)                             |
-| `--tenant-id`   | tenant identifier (required)                                  |
-| `--output`      | output directory (default `.gurulu/`)                         |
-| `--domains`     | comma-separated hosts for `install-plan.domains`              |
-| `--dry-run`     | validate + report without writing                             |
-| `--quiet`       | suppress non-error output                                     |
-
-## What the alpha does
-
-- Validates every generated artifact against
-  `schemas/gurulu/*.schema.json` (Phase 10 W4.1) before writing.
-  Atomic: on any validation error nothing is written.
-- Derives **business surfaces** from the scanner's `routes` + `mutations`
-  (signup / checkout / subscription / lead / onboarding) via keyword
-  heuristics.
-- Produces **route → flow** suggestions for `web.config.json`.
-- Produces **endpoint → event** suggestions for `server-map.json` (POST
-  verbs only).
-- Produces **table → event** suggestions for `db-map.json` from ORM
-  mutations (Prisma / Mongoose / Drizzle / raw SQL via the scanner).
-- Produces **flow seeds** and **milestone rules** per surface.
-- Produces a **correlation map** bridging client → server → db events.
-- Produces a **connectors** placeholder (empty — populated via dashboard).
-- Produces a mobile SDK **skeleton** (`app.config.json` with `ios`
-  defaults). Alpha does not auto-detect mobile platforms.
-
-## What the alpha does NOT do
-
-- No source code edits. The tool never touches application source.
-- No SDK install. It does not add dependencies or wire up imports.
-- No CRM / outbound connector setup (`connectors.json` stays empty).
-- No mobile platform detection.
-- No code patches — that's Phase 15.
-
-## Roadmap → full agentic install (Phase 15)
-
-1. Auto-add Web / iOS / Android SDK imports to the host repo.
-2. Auto-edit `layout.tsx` / `_app.tsx` / middleware to bootstrap the SDK.
-3. Emit per-route + per-mutation code patches (PR-ready diffs).
-4. Self-healing: re-scan on CI and update `.gurulu/` automatically.
-5. Auto-detect mobile platforms + populate `app.config.json` properly.
-6. Wire detected external services (Stripe / Shopify / Segment / HubSpot)
-   into `connectors.json`.
-
-## Implementation notes
-
-- Generator logic lives in `scripts/gurulu-agentic-install.lib.cjs` so it
-  can be `require()`'d from both the ESM CLI wrapper and ts-jest tests,
-  mirroring the layout of `scripts/gurulu-scan.lib.cjs`.
-- Validation uses `ajv@6.14.0` already installed at the repo root.
-- Every artifact is generated with sensible defaults when the scanner
-  supplies nothing (empty routes / mutations still yields a valid
-  bundle). `db-map.tables`, `flow-seeds.flows`, `milestone-rules.rules`
-  and `correlation-map.links` all have `minItems: 1` in their schemas;
-  the generator plants a placeholder entry rather than producing an
-  invalid document.

package/scripts/README-gurulu-scan.md

@@ -1,98 +0,0 @@
-# gurulu-scan — repo scanner spike (Phase 13 B2)
-
-`scripts/gurulu-scan.mjs` is a standalone Node script that scans any
-repository path and emits a JSON document shaped like
-[`install-plan.schema.json`](../schemas/gurulu/install-plan.schema.json). It is
-the precursor to a real agentic installer: for now it **only gathers signal**
-— it never writes code or touches the host repo.
-
-## Usage
-
-```bash
-# Print the plan to stdout
-node scripts/gurulu-scan.mjs <repo-path>
-
-# Write to a file
-node scripts/gurulu-scan.mjs <repo-path> --output /tmp/scan.json
-
-# Suppress progress logs (useful when piping)
-node scripts/gurulu-scan.mjs <repo-path> --quiet > /tmp/scan.json
-```
-
-Self-scan example:
-
-```bash
-node scripts/gurulu-scan.mjs . --quiet > /tmp/scan-self.json
-```
-
-## What it detects
-
-| Area | Signal | Notes |
-| --- | --- | --- |
-| Framework | `package.json` deps + devDeps | Next.js, Nest, Remix, SvelteKit, Astro, Fastify, Express, Vite + React, Vue |
-| ORM | deps + schema files | Prisma (`prisma/schema.prisma`), Drizzle (`drizzle.config.*`), TypeORM, Mongoose, Sequelize, Kysely |
-| Auth | deps | NextAuth, Clerk, Supabase (`+auth-helpers`), Firebase, Lucia, Passport, raw `jsonwebtoken` |
-| Routes | filesystem walk | Next.js **App Router** (`**/app/api/**/route.{ts,js}`) and **Pages Router** (`**/pages/api/**`). Methods inferred from exported handlers / `req.method` checks. |
-| Mutations | regex grep over `*.ts(x)`, `*.js(x)`, `*.mjs`, `*.cjs` | `prisma.<model>.{create,update,upsert,delete,...}`, `db.{insert,update,delete}(...)`, Mongoose `Model.{create,findOneAnd*,updateOne,...}`, raw `INSERT INTO / UPDATE / DELETE FROM` in template literals. De-duplicated and capped at 200 entries. |
-
-## Output shape
-
-```jsonc
-{
-  "site_id": null,
-  "domains": [],
-  "framework": { "name": "nextjs", "version": "14.2.35" },
-  "orm": { "name": "prisma", "schemaPath": "prisma/schema.prisma" },
-  "auth": { "name": "nextauth" },
-  "routes": [
-    { "path": "/api/users", "methods": ["GET", "POST"], "file": "app/api/users/route.ts" }
-  ],
-  "businessSurfaces": [],
-  "mutations": [
-    {
-      "file": "app/api/users/route.ts",
-      "line": 12,
-      "model": "user",
-      "operation": "create",
-      "snippet": "const user = await prisma.user.create({..."
-    }
-  ],
-  "scannedAt": "2026-04-13T12:34:56.000Z",
-  "scanVersion": "0.1.0"
-}
-```
-
-Conceptually mapped to
-[`schemas/gurulu/install-plan.schema.json`](../schemas/gurulu/install-plan.schema.json)
-— the scanner emits the signal a later stage will transform into the schema's
-`stack`, `surfaces` and `suggested_milestones`.
-
-## Known limitations (spike scope)
-
-- **No Express / Fastify / NestJS route detection.** Routes are returned as
-  `[]` with `routeDetectionNote: "detection_not_implemented_for_<framework>"`.
-  Handler introspection for imperative frameworks is a follow-up.
-- **Mutation regex is best-effort.** It only matches syntactic patterns — it
-  has no semantic understanding of the code. Renamed clients (e.g.
-  `const p = prismaClient; p.user.create(...)`) will be missed.
-- **No call-graph analysis.** Mutations are not mapped back to routes.
-- **No `businessSurfaces` inference.** That lives in a later work unit — the
-  field is always emitted as `[]` for now.
-- **`site_id` / `domains`** are null / empty — they are assigned by the
-  control plane, not discoverable locally.
-- **No bundler / monorepo awareness.** It assumes a single app rooted at the
-  provided path. `src/` is preferred as the walk root when present, otherwise
-  the repo root is used.
-
-## Implementation notes
-
-Detection logic lives in `scripts/gurulu-scan.lib.cjs` (CommonJS) so that the
-ESM `scripts/gurulu-scan.mjs` CLI wrapper and the ts-jest test suite
-(`tests/gurulu-scan.test.ts`) can share a single module. The `.mjs` file
-re-exports the library via `createRequire` and adds the CLI entry point.
-
-Run the test suite with:
-
-```bash
-npx jest tests/gurulu-scan.test.ts
-```

package/scripts/audit-cli-scopes.mjs

@@ -1,204 +0,0 @@
-#!/usr/bin/env node
-/**
- * Phase 20 W3 C2 — Scope audit script.
- *
- * Scans src/app/api/cli/** /route.ts for `requireCliAuth` calls, extracts
- * the scope strings, and validates them against the catalog in
- * src/lib/cli/scopes.ts. Fails with exit code 1 if any route uses an
- * unknown scope or any scoped surface is missing a required scope.
- *
- * Flags:
- *   --json              Emit JSON instead of the human table.
- *   --root <path>       Override repo root (default: script parent).
- *
- * Exit codes:
- *   0 — clean
- *   1 — unknown scope or missing requireCliAuth
- */
-
-import { promises as fs } from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-
-const argv = process.argv.slice(2);
-const jsonMode = argv.includes('--json');
-const rootArgIdx = argv.indexOf('--root');
-const repoRoot =
-  rootArgIdx >= 0 && argv[rootArgIdx + 1]
-    ? path.resolve(argv[rootArgIdx + 1])
-    : path.resolve(__dirname, '..');
-
-const SCOPES_FILE = path.join(repoRoot, 'src/lib/cli/scopes.ts');
-const ROUTES_ROOT = path.join(repoRoot, 'src/app/api/cli');
-
-// Routes that intentionally do not require CLI auth (public bootstrap
-// endpoints). Anything else missing requireCliAuth fails the audit.
-const UNAUTHED_ALLOWLIST = [
-  'verify-key/route.ts',
-  'device-link/start/route.ts',
-  'device-link/approve/route.ts',
-  'device-link/deny/route.ts',
-  'device-link/poll/route.ts',
-];
-
-async function loadScopeCatalog(file) {
-  const content = await fs.readFile(file, 'utf8');
-  const match = content.match(/CLI_SCOPES\s*=\s*\[([\s\S]*?)\]\s*as const/);
-  if (!match) {
-    throw new Error(`Cannot parse CLI_SCOPES from ${file}`);
-  }
-  const catalog = new Set();
-  const re = /'([^']+)'|"([^"]+)"/g;
-  let m;
-  while ((m = re.exec(match[1])) !== null) {
-    catalog.add(m[1] || m[2]);
-  }
-  return catalog;
-}
-
-async function walk(dir) {
-  const out = [];
-  let entries;
-  try {
-    entries = await fs.readdir(dir, { withFileTypes: true });
-  } catch (err) {
-    if (err.code === 'ENOENT') return out;
-    throw err;
-  }
-  for (const entry of entries) {
-    const full = path.join(dir, entry.name);
-    if (entry.isDirectory()) {
-      out.push(...(await walk(full)));
-    } else if (entry.isFile() && entry.name === 'route.ts') {
-      out.push(full);
-    }
-  }
-  return out;
-}
-
-function extractScopes(source) {
-  // Matches both:
-  //   requireCliAuth(req, { requiredScopes: ['a', 'b'] })
-  //   requireWriteAuth(req, { requiredScopes: ['a:write'] })  // Phase 20 W2
-  // Multiline-tolerant via the [\s\S] dotall trick.
-  const calls = [];
-  const callRe =
-    /require(?:CliAuth|WriteAuth)\s*\([\s\S]*?requiredScopes\s*:\s*\[([^\]]*)\][\s\S]*?\)/g;
-  let m;
-  while ((m = callRe.exec(source)) !== null) {
-    const inner = m[1];
-    const scopes = [];
-    const strRe = /'([^']+)'|"([^"]+)"/g;
-    let s;
-    while ((s = strRe.exec(inner)) !== null) {
-      scopes.push(s[1] || s[2]);
-    }
-    calls.push(scopes);
-  }
-  const usesAuth = /require(?:CliAuth|WriteAuth)\s*\(/.test(source);
-  const hasBareCall = usesAuth && calls.length === 0;
-  return { scopedCalls: calls, hasBareCall, usesAuth };
-}
-
-function relPath(repoRoot, full) {
-  return path.relative(repoRoot, full).split(path.sep).join('/');
-}
-
-function allowlistMatch(rel) {
-  return UNAUTHED_ALLOWLIST.some((suffix) => rel.endsWith(`api/cli/${suffix}`));
-}
-
-async function main() {
-  let catalog;
-  try {
-    catalog = await loadScopeCatalog(SCOPES_FILE);
-  } catch (err) {
-    console.error(err.message);
-    process.exit(1);
-  }
-
-  const files = await walk(ROUTES_ROOT);
-  const rows = [];
-  const errors = [];
-
-  for (const file of files) {
-    const rel = relPath(repoRoot, file);
-    const source = await fs.readFile(file, 'utf8');
-    const { scopedCalls, hasBareCall, usesAuth } = extractScopes(source);
-    const allScopes = scopedCalls.flat();
-    const unknown = allScopes.filter((s) => !catalog.has(s));
-    void hasBareCall;
-    const routePath = rel
-      .replace(/^src\/app\/api\//, '/api/')
-      .replace(/\/route\.ts$/, '')
-      .replace(/\[([^\]]+)\]/g, ':$1');
-
-    if (allowlistMatch(rel)) {
-      rows.push({ route: routePath, file: rel, scopes: [], status: 'public' });
-      continue;
-    }
-
-    if (scopedCalls.length === 0 && !usesAuth) {
-      errors.push({ file: rel, error: 'missing_requireCliAuth' });
-      rows.push({
-        route: routePath,
-        file: rel,
-        scopes: [],
-        status: 'missing_auth',
-      });
-      continue;
-    }
-
-    if (unknown.length > 0) {
-      errors.push({ file: rel, error: 'unknown_scope', scopes: unknown });
-    }
-    rows.push({
-      route: routePath,
-      file: rel,
-      scopes: allScopes,
-      status: unknown.length > 0 ? 'unknown_scope' : 'ok',
-    });
-  }
-
-  rows.sort((a, b) => a.route.localeCompare(b.route));
-
-  if (jsonMode) {
-    process.stdout.write(
-      JSON.stringify(
-        { routes: rows, errors, catalogSize: catalog.size },
-        null,
-        2,
-      ) + '\n',
-    );
-  } else {
-    const pad = (s, n) => s + ' '.repeat(Math.max(0, n - s.length));
-    process.stdout.write(
-      pad('ROUTE', 55) + pad('SCOPES', 45) + 'STATUS\n',
-    );
-    process.stdout.write('-'.repeat(110) + '\n');
-    for (const r of rows) {
-      process.stdout.write(
-        pad(r.route, 55) +
-          pad(r.scopes.join(',') || '-', 45) +
-          r.status +
-          '\n',
-      );
-    }
-    process.stdout.write(
-      `\n${rows.length} routes scanned, ${errors.length} errors.\n`,
-    );
-    for (const e of errors) {
-      process.stdout.write(`  ✗ ${e.file}: ${e.error} ${JSON.stringify(e.scopes || '')}\n`);
-    }
-  }
-
-  process.exit(errors.length > 0 ? 1 : 0);
-}
-
-main().catch((err) => {
-  console.error(err);
-  process.exit(1);
-});

package/scripts/backfill-tenant-id.mjs

@@ -1,172 +0,0 @@
-#!/usr/bin/env node
-/**
- * Phase 16 B2 — Backfill `tenant_id` on historical `events_raw` rows.
- *
- * For every site→tenant mapping in Prisma, issues one `ALTER TABLE ... UPDATE`
- * per monthly partition (`toYYYYMM(date)`), chunked so a single mutation never
- * has to scan the whole table. Dry-run by default — pass `--apply` to actually
- * execute the mutations.
- *
- * Usage:
- *   node scripts/backfill-tenant-id.mjs               # dry-run
- *   node scripts/backfill-tenant-id.mjs --apply       # real run
- *   node scripts/backfill-tenant-id.mjs --partition 202604  # single month
- *
- * Env:
- *   CLICKHOUSE_URL, CLICKHOUSE_DATABASE
- *   BACKFILL_FAKE_SITE_MAP=1  — use an injected fake map instead of Prisma
- *                                (used by tests / smoke tests).
- *
- * NOTE: intentionally NOT run in dev — this exists for ops to run once after
- * the tenant_id column was added, against historical rows where tenant_id is
- * empty/null. Do not invoke in CI.
- *
- * Phase 17 B1 update:
- *   The write path now stamps `tenant_id` natively on every new row via
- *   `src/lib/ingest/envelope-normalizer.ts` + `tenant-resolver.ts`. That
- *   means this backfill only needs to cover the historical window BEFORE
- *   Phase 17 B1 shipped — new ingests already land with tenant_id populated.
- *   If ops needs to re-run the backfill they can safely `--partition`-scope
- *   to the pre-cutover months only. See PHASE-17-ROADMAP.md §B1.
- */
-
-function parseArgs(argv) {
-  const args = { apply: false, partitions: null };
-  for (let i = 2; i < argv.length; i++) {
-    const a = argv[i];
-    if (a === '--apply') args.apply = true;
-    else if (a === '--partition') args.partitions = [argv[++i]];
-    else if (a === '--help' || a === '-h') args.help = true;
-  }
-  return args;
-}
-
-function printHelp() {
-  console.log(
-    `\nUsage: node scripts/backfill-tenant-id.mjs [--apply] [--partition YYYYMM]\n\n` +
-      `  --apply       Actually execute ALTER TABLE UPDATE. Default is dry-run.\n` +
-      `  --partition   Only process the given YYYYMM partition.\n`
-  );
-}
-
-async function clickhouseQuery(query, params = {}) {
-  const CLICKHOUSE_URL = process.env.CLICKHOUSE_URL || 'http://localhost:8123';
-  const CLICKHOUSE_DB = process.env.CLICKHOUSE_DATABASE || 'gurulu';
-  const url = new URL(CLICKHOUSE_URL);
-  url.searchParams.set('database', CLICKHOUSE_DB);
-  url.searchParams.set('default_format', 'JSON');
-  for (const [k, v] of Object.entries(params)) {
-    url.searchParams.set(`param_${k}`, String(v));
-  }
-  const res = await fetch(url.toString(), {
-    method: 'POST',
-    body: query,
-    headers: { 'Content-Type': 'text/plain' },
-  });
-  if (!res.ok) throw new Error(`ClickHouse error ${res.status}: ${await res.text()}`);
-  return res.json();
-}
-
-function escapeSql(s) {
-  return String(s).replace(/\\/g, '\\\\').replace(/'/g, "\\'");
-}
-
-/**
- * Resolve the site→tenant map.
- *
- * Exported for tests — tests pass `fakeMap` directly; the real CLI uses
- * Prisma unless BACKFILL_FAKE_SITE_MAP=1 (which makes the function return an
- * in-memory fixture so scripts/tests can smoke-test the query builder without
- * a DB).
- */
-export async function loadSiteTenantMap(fakeMap) {
-  if (fakeMap) return fakeMap;
-  if (process.env.BACKFILL_FAKE_SITE_MAP === '1') {
-    return {
-      'site-fake-1': 'tenant-fake-A',
-      'site-fake-2': 'tenant-fake-A',
-      'site-fake-3': 'tenant-fake-B',
-    };
-  }
-  const { PrismaClient } = await import('@prisma/client');
-  const prisma = new PrismaClient();
-  try {
-    const sites = await prisma.site.findMany({ select: { id: true, tenantId: true } });
-    const map = {};
-    for (const s of sites) map[s.id] = s.tenantId;
-    return map;
-  } finally {
-    await prisma.$disconnect();
-  }
-}
-
-/**
- * Discover the list of monthly partitions currently present in `events_raw`.
- *
- * Exported for tests — accepts an optional injected query function.
- */
-export async function discoverPartitions(queryFn = clickhouseQuery) {
-  const res = await queryFn(
-    `SELECT DISTINCT partition FROM system.parts WHERE table = 'events_raw' AND active ORDER BY partition`
-  );
-  return (res.data || []).map((r) => String(r.partition));
-}
-
-/**
- * Build the ALTER TABLE UPDATE SQL for one (partition, siteId→tenantId) chunk.
- *
- * Exported for tests.
- */
-export function buildBackfillSql(partition, siteId, tenantId) {
-  return (
-    `ALTER TABLE events_raw UPDATE tenant_id = '${escapeSql(tenantId)}' ` +
-    `WHERE site_id = '${escapeSql(siteId)}' ` +
-    `AND (tenant_id = '' OR tenant_id IS NULL) ` +
-    `AND toYYYYMM(date) = ${Number(partition)}`
-  );
-}
-
-async function main() {
-  const args = parseArgs(process.argv);
-  if (args.help) {
-    printHelp();
-    return;
-  }
-
-  const mode = args.apply ? 'APPLY' : 'DRY-RUN';
-  console.log(`[backfill] mode=${mode}`);
-
-  const siteMap = await loadSiteTenantMap();
-  const siteIds = Object.keys(siteMap);
-  console.log(`[backfill] loaded ${siteIds.length} site→tenant mappings`);
-
-  const partitions = args.partitions || (await discoverPartitions());
-  console.log(`[backfill] ${partitions.length} partitions to process`);
-
-  let totalChunks = 0;
-  for (const partition of partitions) {
-    for (const siteId of siteIds) {
-      const tenantId = siteMap[siteId];
-      if (!tenantId) continue;
-      totalChunks++;
-      const sql = buildBackfillSql(partition, siteId, tenantId);
-      if (args.apply) {
-        console.log(`[backfill] APPLY partition=${partition} site=${siteId}`);
-        await clickhouseQuery(sql);
-      } else {
-        console.log(`[backfill] DRY partition=${partition} site=${siteId}`);
-        console.log(`           ${sql}`);
-      }
-    }
-  }
-
-  console.log(`[backfill] done — ${totalChunks} chunks ${args.apply ? 'applied' : '(dry-run)'}`);
-}
-
-const isMain = import.meta.url === `file://${process.argv[1]}`;
-if (isMain) {
-  main().catch((err) => {
-    console.error('[backfill] fatal:', err);
-    process.exit(10);
-  });
-}