@mriekki/lean 0.0.0-stage → 0.1.0

package/assets/generated/deployment/src/lean_poc_deployment/sqlite_adapter_remote.py

@@ -0,0 +1,340 @@
+"""Remote Bash template for the SQLite persistence adapter."""
+
+REMOTE_SCRIPT = r'''#!/usr/bin/env bash
+set -Eeuo pipefail
+
+ACTION="$1"
+EXPECTED_RESERVATION_SHA="${2:-}"
+DEPLOY_USER="${3:-}"
+APP_ROOT="__APP_ROOT__"
+SQLITE_SCHEMA_VERSION="__SQLITE_SCHEMA_VERSION__"
+OWNER_B64="__OWNER_B64__"
+ENV_B64="__ENV_B64__"
+APP_B64="__APP_B64__"
+IMAGE_B64="__IMAGE_B64__"
+RUN_AS_B64="__RUN_AS_B64__"
+DB_FILE_B64="__DB_FILE_B64__"
+SOURCE_DB_B64="__SOURCE_DB_B64__"
+FIRST_INSTALL="__FIRST_INSTALL__"
+RESERVATION_SHA="__RESERVATION_SHA__"
+ENV_KEYS=(__ENV_KEYS__)
+ENV_VALUES=(__ENV_VALUES__)
+
+b64d() { printf '%s' "$1" | base64 --decode; }
+meta_value() {
+    local path="$1" key="$2"
+    [[ -f "$path" ]] || return 1
+    sed -n "s/^${key}=//p" "$path" | head -n1
+}
+valid_slug() { [[ "$1" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]]; }
+valid_repo() { [[ "$1" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; }
+valid_image() { [[ "$1" =~ ^[A-Za-z0-9][A-Za-z0-9._/:+-]*@sha256:[0-9a-f]{64}$ ]]; }
+valid_run_as() { [[ "$1" =~ ^[0-9]+(:[0-9]+)?$ ]]; }
+valid_db_file() { [[ "$1" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$ && "$1" != "." && "$1" != ".." ]]; }
+valid_env_key() { [[ "$1" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; }
+
+configure_registry_auth() {
+    [[ -n "$DEPLOY_USER" && "$DEPLOY_USER" =~ ^[A-Za-z_][A-Za-z0-9_.-]{0,31}$ ]] || {
+        echo "Deployment account is invalid." >&2; exit 42;
+    }
+    local home config dir_mode file_mode deploy_uid
+    home="$(getent passwd "$DEPLOY_USER" | cut -d: -f6)"
+    [[ -n "$home" && "$home" == /* ]] || { echo "Could not resolve deployment account home." >&2; exit 42; }
+    config="$home/.docker"
+    if [[ ! -e "$config/config.json" ]]; then return 0; fi
+    [[ -d "$config" && ! -L "$config" && -f "$config/config.json" && ! -L "$config/config.json" ]] || {
+        echo "Docker credential path is not a regular protected directory/file." >&2; exit 42;
+    }
+    dir_mode="$(stat -c '%a' "$config")"
+    file_mode="$(stat -c '%a' "$config/config.json")"
+    deploy_uid="$(id -u "$DEPLOY_USER")"
+    if (( (8#$dir_mode & 077) != 0 || (8#$file_mode & 077) != 0 )) ||
+       [[ "$(stat -c '%u' "$config")" != "$deploy_uid" || "$(stat -c '%u' "$config/config.json")" != "$deploy_uid" ]]; then
+        echo "Docker credentials must be owned by the deployment account and deny group/other access." >&2
+        exit 42
+    fi
+    export DOCKER_CONFIG="$config"
+}
+
+managed_runtime_info() {
+    local root state current file
+    root="$1"
+    state="$root/deployment.env"
+    MANAGED_CONTAINER=""
+    MANAGED_IMAGE=""
+    MANAGED_RUNNING=false
+    [[ -f "$state" && ! -L "$state" ]] || return 0
+    current="$(meta_value "$state" CURRENT_RELEASE || true)"
+    [[ -n "$current" ]] || { echo "Managed application state is malformed." >&2; exit 43; }
+    file="$root/releases/$current/release.env"
+    [[ -f "$file" && ! -L "$file" ]] || { echo "Managed application release metadata is missing." >&2; exit 43; }
+    MANAGED_CONTAINER="$(meta_value "$file" CONTAINER_NAME || true)"
+    MANAGED_IMAGE="$(meta_value "$file" IMAGE || true)"
+    [[ -n "$MANAGED_CONTAINER" && -n "$MANAGED_IMAGE" ]] || { echo "Managed application release metadata is malformed." >&2; exit 43; }
+    [[ "$(docker inspect --format '{{.State.Status}}' "$MANAGED_CONTAINER" 2>/dev/null || true)" == "running" ]] && MANAGED_RUNNING=true || true
+}
+
+inventory() {
+    local marker root owner env app run_as db_b64 db file present bytes backups running image count=0 sha
+    if [[ -d "$APP_ROOT" ]]; then
+        while IFS= read -r marker; do
+            [[ -n "$marker" ]] || continue
+            [[ ! -L "$marker" ]] || { echo "SQLite reservation marker must not be a symbolic link: $marker" >&2; exit 44; }
+            [[ "$(meta_value "$marker" ADAPTER || true)" == "sqlite" ]] || continue
+            owner="$(meta_value "$marker" OWNER_REPO || true)"
+            env="$(meta_value "$marker" ENVIRONMENT || true)"
+            app="$(meta_value "$marker" APP_SLUG || true)"
+            run_as="$(meta_value "$marker" RUN_AS || true)"
+            db_b64="$(meta_value "$marker" DATABASE_FILE_B64 || true)"
+            db="$(b64d "$db_b64")"
+            sha="$(meta_value "$marker" RESERVATION_SHA256 || true)"
+            [[ -n "$owner" && -n "$env" && -n "$app" && -n "$run_as" && -n "$db" && "$sha" =~ ^[0-9a-f]{64}$ ]] || {
+                echo "SQLite reservation marker is malformed: $marker" >&2; exit 44;
+            }
+            root="$(dirname "$marker")"
+            file="$root/data/$db"
+            present=false; bytes=0
+            if [[ -e "$file" ]]; then
+                [[ -f "$file" && ! -L "$file" ]] || { echo "Managed SQLite database is not a regular file: $file" >&2; exit 44; }
+                present=true
+                bytes="$(stat -c '%s' "$file")"
+            fi
+            backups=0
+            if [[ -d "$root/backups" && ! -L "$root/backups" ]]; then
+                backups="$(find "$root/backups" -maxdepth 1 -type f -printf '.' | wc -c)"
+            fi
+            managed_runtime_info "$root"
+            running="$MANAGED_RUNNING"; image="$MANAGED_IMAGE"
+            printf 'SQLITE\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
+                "$owner" "$env" "$app" "$run_as" "$db" "$sha" "$present" "$bytes" "$backups" "$running" "$image"
+            count=$((count + 1))
+        done < <(find "$APP_ROOT" -mindepth 3 -maxdepth 3 -type f -name persistence.env -print 2>/dev/null | sort)
+    fi
+    printf 'SUMMARY\tsqliteCount\t%s\n' "$count"
+}
+
+decode_spec() {
+    OWNER="$(b64d "$OWNER_B64")"
+    ENVIRONMENT="$(b64d "$ENV_B64")"
+    APP_SLUG="$(b64d "$APP_B64")"
+    IMAGE="$(b64d "$IMAGE_B64")"
+    RUN_AS="$(b64d "$RUN_AS_B64")"
+    DATABASE_FILE="$(b64d "$DB_FILE_B64")"
+    SOURCE_DATABASE="$(b64d "$SOURCE_DB_B64")"
+    valid_repo "$OWNER" || { echo "Invalid SQLite owner repository." >&2; exit 45; }
+    valid_slug "$ENVIRONMENT" || { echo "Invalid SQLite environment." >&2; exit 45; }
+    valid_slug "$APP_SLUG" || { echo "Invalid SQLite app slug." >&2; exit 45; }
+    valid_image "$IMAGE" || { echo "SQLite maintenance image is not an immutable digest reference." >&2; exit 45; }
+    valid_run_as "$RUN_AS" || { echo "Invalid SQLite runAs." >&2; exit 45; }
+    valid_db_file "$DATABASE_FILE" || { echo "Invalid SQLite database file name." >&2; exit 45; }
+    [[ "$RESERVATION_SHA" =~ ^[0-9a-f]{64}$ ]] || { echo "Invalid SQLite reservation fingerprint." >&2; exit 45; }
+    [[ "${#ENV_KEYS[@]}" -eq "${#ENV_VALUES[@]}" && "${#ENV_KEYS[@]}" -gt 0 ]] || { echo "Invalid SQLite maintenance environment payload." >&2; exit 45; }
+    local index key
+    for index in "${!ENV_KEYS[@]}"; do
+        key="$(b64d "${ENV_KEYS[$index]}")"
+        valid_env_key "$key" || { echo "Invalid SQLite maintenance environment key." >&2; exit 45; }
+    done
+}
+
+assert_marker() {
+    local marker="$1" expected="$2"
+    [[ -f "$marker" && ! -L "$marker" ]] || { echo "SQLite reservation is missing." >&2; exit 46; }
+    [[ "$(meta_value "$marker" ADAPTER || true)" == "sqlite" &&
+       "$(meta_value "$marker" OWNER_REPO || true)" == "$OWNER" &&
+       "$(meta_value "$marker" ENVIRONMENT || true)" == "$ENVIRONMENT" &&
+       "$(meta_value "$marker" APP_SLUG || true)" == "$APP_SLUG" &&
+       "$(meta_value "$marker" RUN_AS || true)" == "$RUN_AS" &&
+       "$(b64d "$(meta_value "$marker" DATABASE_FILE_B64 || true)")" == "$DATABASE_FILE" &&
+       "$(meta_value "$marker" RESERVATION_SHA256 || true)" == "$RESERVATION_SHA" ]] || {
+        echo "SQLite reservation ownership/configuration mismatch." >&2; exit 46;
+    }
+    [[ "$expected" != "NONE" && "$expected" == "$RESERVATION_SHA" ]] || {
+        echo "SQLite reservation changed after planning." >&2; exit 47;
+    }
+}
+
+write_marker() {
+    local marker tmp
+    marker="$1"
+    tmp="$marker.tmp.$$"
+    {
+        printf 'SCHEMA_VERSION=%s\n' "$SQLITE_SCHEMA_VERSION"
+        printf 'ADAPTER=sqlite\n'
+        printf 'OWNER_REPO=%s\n' "$OWNER"
+        printf 'ENVIRONMENT=%s\n' "$ENVIRONMENT"
+        printf 'APP_SLUG=%s\n' "$APP_SLUG"
+        printf 'RUN_AS=%s\n' "$RUN_AS"
+        printf 'DATABASE_FILE_B64=%s\n' "$DB_FILE_B64"
+        printf 'RESERVATION_SHA256=%s\n' "$RESERVATION_SHA"
+    } > "$tmp"
+    chmod 0600 "$tmp"
+    mv -f "$tmp" "$marker"
+}
+
+maintenance_args() {
+    local -n out_ref=$1
+    local index key value
+    out_ref=(docker run --rm --network none --user "$RUN_AS")
+    for index in "${!ENV_KEYS[@]}"; do
+        key="$(b64d "${ENV_KEYS[$index]}")"
+        value="$(b64d "${ENV_VALUES[$index]}")"
+        out_ref+=(--env "$key=$value")
+    done
+}
+
+run_backup() {
+    local source_dir="$1" backup_dir="$2" backup_name="$3"
+    local -a args
+    maintenance_args args
+    args+=(--mount "type=bind,src=$source_dir,dst=/data" --mount "type=bind,src=$backup_dir,dst=/backup" "$IMAGE" --backup --backup-path "/backup/$backup_name")
+    "${args[@]}"
+}
+
+run_check() {
+    local data_dir="$1"
+    local -a args
+    maintenance_args args
+    args+=(--mount "type=bind,src=$data_dir,dst=/data" "$IMAGE" --check-rollback-compatibility)
+    "${args[@]}"
+}
+
+run_migrate() {
+    local data_dir="$1"
+    local -a args
+    maintenance_args args
+    args+=(--mount "type=bind,src=$data_dir,dst=/data" "$IMAGE" --migrate)
+    [[ "$FIRST_INSTALL" == true ]] && args+=(--first-install)
+    "${args[@]}"
+}
+
+record_evidence() {
+    local root="$1" action="$2" outcome="$3" artifact="${4:-}" timestamp
+    timestamp="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
+    printf '{"timestamp":"%s","action":"%s","ownerRepo":"%s","environment":"%s","appSlug":"%s","image":"%s","databaseFile":"%s","reservationSha256":"%s","artifact":"%s","outcome":"%s"}\n' \
+        "$timestamp" "$action" "$OWNER" "$ENVIRONMENT" "$APP_SLUG" "$IMAGE" "$DATABASE_FILE" "$RESERVATION_SHA" "$artifact" "$outcome" >> "$root/sqlite-evidence.jsonl"
+    chmod 0600 "$root/sqlite-evidence.jsonl"
+}
+
+set_paths() {
+    ROOT="$APP_ROOT/$APP_SLUG/$ENVIRONMENT"
+    DATA="$ROOT/data"
+    BACKUPS="$ROOT/backups"
+    MARKER="$ROOT/persistence.env"
+    LOCK_FILE="/run/lock/lean-poc-app-$APP_SLUG--$ENVIRONMENT.lock"
+    for path in "$ROOT" "$DATA" "$BACKUPS" "$MARKER" "$ROOT/deployment.env" "$ROOT/sqlite-evidence.jsonl"; do
+        [[ ! -L "$path" ]] || { echo "SQLite managed path must not be a symbolic link: $path" >&2; exit 48; }
+    done
+}
+
+expected_ids() {
+    EXPECTED_UID="${RUN_AS%%:*}"
+    [[ "$RUN_AS" == *:* ]] && EXPECTED_GID="${RUN_AS#*:}" || EXPECTED_GID="$EXPECTED_UID"
+}
+
+create_reserved_dirs() {
+    expected_ids
+    install -d -m 0750 "$APP_ROOT" "$APP_ROOT/$APP_SLUG" "$ROOT"
+    if [[ ! -e "$DATA" ]]; then install -d -m 0750 -o "$EXPECTED_UID" -g "$EXPECTED_GID" "$DATA"; fi
+    if [[ ! -e "$BACKUPS" ]]; then install -d -m 0750 -o "$EXPECTED_UID" -g "$EXPECTED_GID" "$BACKUPS"; fi
+    verify_reserved_dirs
+}
+
+verify_reserved_dirs() {
+    expected_ids
+    [[ -d "$DATA" && ! -L "$DATA" && -d "$BACKUPS" && ! -L "$BACKUPS" ]] || {
+        echo "SQLite reserved data/backup directories are missing or invalid." >&2; exit 48;
+    }
+    [[ "$(stat -c '%u' "$DATA")" == "$EXPECTED_UID" && "$(stat -c '%g' "$DATA")" == "$EXPECTED_GID" &&
+       "$(stat -c '%u' "$BACKUPS")" == "$EXPECTED_UID" && "$(stat -c '%g' "$BACKUPS")" == "$EXPECTED_GID" ]] || {
+        echo "SQLite data/backup directory ownership does not match runAs." >&2; exit 48;
+    }
+}
+
+operate() {
+    decode_spec
+    configure_registry_auth
+    set_paths
+    exec 9>>"$LOCK_FILE"
+    flock -n 9 || { echo "Another app/persistence operation holds the lock for $APP_SLUG--$ENVIRONMENT." >&2; exit 75; }
+
+    local db="$DATA/$DATABASE_FILE" stamp backup_name source_real source_parent
+    managed_runtime_info "$ROOT"
+
+    case "$ACTION" in
+        import)
+            [[ "$EXPECTED_RESERVATION_SHA" == "NONE" && ! -e "$MARKER" ]] || { echo "SQLite import destination was reserved after planning." >&2; exit 47; }
+            [[ ! -e "$ROOT/deployment.env" ]] || { echo "SQLite import must occur before the first managed application deployment." >&2; exit 49; }
+            [[ ! -e "$db" ]] || { echo "SQLite import refuses to overwrite an existing destination database." >&2; exit 49; }
+            [[ "$SOURCE_DATABASE" == /srv/* && "$SOURCE_DATABASE" != "$APP_ROOT"/* ]] || { echo "SQLite import source must be outside the Kit app root under /srv." >&2; exit 49; }
+            source_real="$(realpath -e "$SOURCE_DATABASE" 2>/dev/null || true)"
+            [[ "$source_real" == "$SOURCE_DATABASE" && -f "$SOURCE_DATABASE" && ! -L "$SOURCE_DATABASE" ]] || { echo "SQLite import source must be an existing non-symlink regular file with no symlinked path components." >&2; exit 49; }
+            [[ "$(basename "$SOURCE_DATABASE")" == "$DATABASE_FILE" ]] || { echo "SQLite import source file name mismatch." >&2; exit 49; }
+            create_reserved_dirs
+            docker pull "$IMAGE" >/dev/null
+            source_parent="$(dirname "$SOURCE_DATABASE")"
+            run_backup "$source_parent" "$DATA" "$DATABASE_FILE"
+            run_check "$DATA"
+            write_marker "$MARKER"
+            record_evidence "$ROOT" import imported "$SOURCE_DATABASE"
+            printf 'SQLite import completed and verified: %s\n' "$db"
+            ;;
+        backup)
+            assert_marker "$MARKER" "$EXPECTED_RESERVATION_SHA"
+            verify_reserved_dirs
+            [[ -f "$db" && ! -L "$db" ]] || { echo "SQLite backup requires the reserved database file." >&2; exit 49; }
+            docker pull "$IMAGE" >/dev/null
+            stamp="$(date -u +'%Y%m%dT%H%M%SZ')"
+            backup_name="backup-$stamp-$DATABASE_FILE"
+            run_backup "$DATA" "$BACKUPS" "$backup_name"
+            record_evidence "$ROOT" backup backed-up "$backup_name"
+            printf 'SQLite verified backup created: %s\n' "$BACKUPS/$backup_name"
+            ;;
+        migrate)
+            if [[ "$FIRST_INSTALL" == true ]]; then
+                [[ "$EXPECTED_RESERVATION_SHA" == "NONE" && ! -e "$MARKER" ]] || { echo "First-install SQLite destination was reserved after planning." >&2; exit 47; }
+                [[ ! -e "$ROOT/deployment.env" && ! -e "$db" ]] || { echo "First-install SQLite migration requires no runtime state or database." >&2; exit 49; }
+                create_reserved_dirs
+                docker pull "$IMAGE" >/dev/null
+                run_migrate "$DATA"
+                run_check "$DATA"
+                write_marker "$MARKER"
+                record_evidence "$ROOT" migrate migrated-first-install ""
+                printf 'SQLite first-install migration completed and verified.\n'
+            else
+                assert_marker "$MARKER" "$EXPECTED_RESERVATION_SHA"
+                verify_reserved_dirs
+                [[ -f "$db" && ! -L "$db" ]] || { echo "SQLite migration requires the reserved database file." >&2; exit 49; }
+                docker pull "$IMAGE" >/dev/null
+                stamp="$(date -u +'%Y%m%dT%H%M%SZ')"
+                backup_name="pre-migrate-$stamp-$DATABASE_FILE"
+                run_backup "$DATA" "$BACKUPS" "$backup_name"
+                if [[ "$MANAGED_RUNNING" == true ]]; then docker stop "$MANAGED_CONTAINER" >/dev/null; fi
+                if ! run_migrate "$DATA"; then
+                    record_evidence "$ROOT" migrate failed "$backup_name"
+                    echo "SQLite migration failed; verified pre-migration backup is retained and managed runtime remains stopped." >&2
+                    exit 50
+                fi
+                run_check "$DATA"
+                record_evidence "$ROOT" migrate migrated "$backup_name"
+                printf 'SQLite migration completed; verified pre-migration backup: %s\n' "$BACKUPS/$backup_name"
+            fi
+            ;;
+        rollback-check)
+            assert_marker "$MARKER" "$EXPECTED_RESERVATION_SHA"
+            verify_reserved_dirs
+            [[ -f "$db" && ! -L "$db" ]] || { echo "SQLite rollback check requires the reserved database file." >&2; exit 49; }
+            docker pull "$IMAGE" >/dev/null
+            run_check "$DATA"
+            record_evidence "$ROOT" rollback-check compatible ""
+            printf 'SQLite rollback compatibility check passed for image %s.\n' "$IMAGE"
+            ;;
+        *) echo "Unsupported SQLite adapter action: $ACTION" >&2; exit 2 ;;
+    esac
+}
+
+case "$ACTION" in
+    inventory) inventory ;;
+    import|backup|migrate|rollback-check) operate ;;
+    *) echo "Unsupported SQLite adapter action: $ACTION" >&2; exit 2 ;;
+esac
+'''

package/assets/generated/deployment/src/lean_poc_deployment/sqlite_cli.py

@@ -0,0 +1,86 @@
+"""CLI for the SQLite persistence adapter."""
+from __future__ import annotations
+import argparse, json, sys
+from typing import Any
+from .errors import DeploymentKitError
+from .sqlite_adapter import authorization_phrase, apply_sqlite_operation, normalize_sqlite_request, plan_sqlite_operation, sqlite_inventory
+from .sqlite_import_recovery import (
+    apply_sqlite_import_recovery,
+    authorization_phrase as recovery_authorization_phrase,
+    plan_sqlite_import_recovery,
+)
+
+
+def _print(value: Any, *, as_json: bool) -> None:
+    if as_json:
+        print(json.dumps(value, indent=2, sort_keys=True)); return
+    if isinstance(value, dict):
+        for key, item in value.items():
+            print(f"{key}: {json.dumps(item, sort_keys=True) if isinstance(item,(dict,list)) else item}")
+    else: print(value)
+
+
+def _parse_env(items: list[str]) -> list[tuple[str,str]]:
+    out=[]
+    for item in items:
+        if '=' not in item: raise DeploymentKitError("--maintenance-env entries must use NAME=value form.")
+        out.append(tuple(item.split('=',1)))
+    return out
+
+
+def _confirm(args: argparse.Namespace, phrase: str, action: str) -> None:
+    if args.yes: return
+    if input(f"Type {phrase} to {action}: ").strip() != phrase:
+        raise DeploymentKitError(f"{action.capitalize()} was not authorized.")
+
+
+def _common(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument('name')
+    parser.add_argument('--owner-repo', required=True)
+    parser.add_argument('--environment', required=True)
+    parser.add_argument('--app-slug', required=True)
+    parser.add_argument('--image', required=True)
+    parser.add_argument('--maintenance-env', action='append', default=[], help='Non-secret image maintenance environment value in NAME=value form; repeat as needed')
+    parser.add_argument('--json', action='store_true')
+    parser.add_argument('--yes', action='store_true')
+
+
+def _import_args(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument('--run-as', required=True)
+    parser.add_argument('--database-file', required=True)
+    parser.add_argument('--source-database', required=True)
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser=argparse.ArgumentParser(prog='lean-poc-deploy sqlite')
+    sub=parser.add_subparsers(dest='command',required=True)
+    inv=sub.add_parser('inventory',help='Read SQLite persistence reservations without writes'); inv.add_argument('name'); inv.add_argument('--json',action='store_true')
+    imp=sub.add_parser('import',help='Import an existing SQLite DB via the exact image online-backup contract'); _common(imp); _import_args(imp)
+    recover=sub.add_parser('recover-import',help='Recover a verified failed import without overwriting or recopying the database'); _common(recover); _import_args(recover)
+    backup=sub.add_parser('backup',help='Create a verified SQLite backup with the exact image'); _common(backup)
+    migrate=sub.add_parser('migrate',help='Create required backup and run exact-image SQLite migration'); _common(migrate)
+    migrate.add_argument('--first-install',action='store_true'); migrate.add_argument('--run-as'); migrate.add_argument('--database-file')
+    check=sub.add_parser('rollback-check',help='Verify that an exact rollback image accepts the current SQLite state'); _common(check)
+    return parser
+
+
+def main(argv: list[str]|None=None) -> int:
+    args=build_parser().parse_args(argv)
+    try:
+        if args.command=='inventory': _print(sqlite_inventory(args.name),as_json=args.json); return 0
+        request=normalize_sqlite_request(owner_repo=args.owner_repo,environment=args.environment,app_slug=args.app_slug,image=args.image,
+            maintenance_environment=_parse_env(args.maintenance_env),run_as=getattr(args,'run_as',None),database_file=getattr(args,'database_file',None),
+            source_database=getattr(args,'source_database',None),first_install=getattr(args,'first_install',False))
+        if args.command=='recover-import':
+            plan=plan_sqlite_import_recovery(args.name,request)
+            _print({k:v for k,v in plan.items() if k!='request'},as_json=False)
+            phrase=recovery_authorization_phrase(plan)
+            _confirm(args,phrase,f"recover SQLite import for {plan['appSlug']} ({plan['environment']}) on target {args.name}")
+            _print(apply_sqlite_import_recovery(plan),as_json=args.json); return 0
+        plan=plan_sqlite_operation(args.name,args.command,request)
+        _print({k:v for k,v in plan.items() if k!='spec'},as_json=False)
+        phrase=authorization_phrase(plan)
+        _confirm(args,phrase,f"run SQLite {args.command} for {plan['appSlug']} ({plan['environment']}) on target {args.name}")
+        _print(apply_sqlite_operation(plan),as_json=args.json); return 0
+    except DeploymentKitError as error:
+        print(f"ERROR: {error}",file=sys.stderr); return 2