@sdt-tools/cli 0.2.0 → 0.2.5

package/dist/publish-Y2J56K4Y.js

@@ -0,0 +1,715 @@
+import {
+  addMappingFlags,
+  buildMappingFromOptions
+} from "./chunk-JP2EZLR5.js";
+import {
+  attachRelatedOptions
+} from "./chunk-EWXM4KJN.js";
+import {
+  logger
+} from "./chunk-VM2H4LAO.js";
+import "./chunk-DGUM43GV.js";
+
+// src/commands/publish.ts
+import path from "path";
+import { promises as fs } from "fs";
+import { Command } from "commander";
+import { readPac } from "@sdt-tools/core/pac";
+import {
+  CompareEngine,
+  LiveSource,
+  buildExecutionPlan,
+  defaultSafePlan,
+  validatePlan
+} from "@sdt-tools/core/compare";
+import {
+  ScriptGenerator,
+  SnowflakeExecutor,
+  buildDeployManifest,
+  executePlan,
+  resolveDeployScripts,
+  formatDeployScript,
+  colorizeMigrationScript,
+  splitStatements as coreSplitStatements
+} from "@sdt-tools/core/deploy";
+import { compileSlice, mergeDeployOptions } from "@sdt-tools/core/project";
+import {
+  ai,
+  aiPreflight,
+  approval,
+  pacFreshness,
+  protectedObjects,
+  safety,
+  license,
+  testFramework
+} from "@sdt-tools/core";
+import { executeDcmProjectDeploy, mapDcmResultToDeploymentReport } from "@sdt-tools/core/exporters";
+import { assessDcmCompatibility, formatDcmCompatibilityReport } from "@sdt-tools/core/safety";
+import { getProfile, SnowflakeConnection } from "@sdt-tools/core/connection";
+var ModelSource = class {
+  kind = "pac";
+  platform = "Snowflake";
+  label;
+  model;
+  constructor(label, model) {
+    this.label = label;
+    this.model = model;
+  }
+  async load() {
+    return this.model;
+  }
+};
+function splitStatements(sql) {
+  return coreSplitStatements(sql).map((s) => s.sql);
+}
+function publishCommand() {
+  const cmd = new Command("publish");
+  cmd.description(
+    "Compare a .sdtpac to a live Snowflake target and apply (or dry-run) the migration."
+  ).option(
+    "--pac <path>",
+    "Path to a built .sdtpac. Required for a normal publish; omit only with --restore-from-snapshot."
+  ).requiredOption("-c, --connection <profile>", "Connection profile name").option(
+    "--restore-from-snapshot <batchId>",
+    "Recovery mode: skip the compare step and emit ALTER TABLE \u2026 SWAP WITH against the snapshot batch <batchId> from the registry. Dry-run by default; pass --apply --yes to execute. This is the command printed by TRUST.4's post-deploy-smoke + TRUST.8's restore-hint when a deploy fails \u2014 they tell the operator to run `sdt publish --restore-from-snapshot <id>`."
+  ).option(
+    "--snapshot-dir <path>",
+    "Snapshot registry directory used with --restore-from-snapshot.",
+    ".sdt/snapshots"
+  ).option("--db <database>", "Target database (defaults to pac scope.database)").option("--schema <schema>", "Target schema (defaults to pac scope.schema)").option("--dry-run", "Print the migration script without executing it", false).option("--apply", "Execute the migration against the live target (gated by safety)", false).option("--out <path>", "Write the generated migration script to this path").option(
+    "--color <mode>",
+    "Color stdout: auto | always | never. Honors NO_COLOR / SDT_NO_COLOR env vars in auto mode.",
+    "auto"
+  ).option("--no-pre-scripts", "Skip pre-deploy scripts even if the pac configures them").option("--no-post-scripts", "Skip post-deploy scripts even if the pac configures them").option(
+    "--no-slice",
+    "Disable the pac's Project Slice (if it has one). Default: the slice baked into the pac is applied automatically and target objects outside the slice are left untouched."
+  ).option("--yes", "Confirm REQUIRE_YES_FLAG safety gate (required for --apply)", false).option(
+    "--confirm-production",
+    "Confirm REQUIRE_CONFIRM_PRODUCTION gate (required for prod-named profiles with destructive changes)",
+    false
+  ).option(
+    "--query-tag <tag>",
+    "Set Snowflake QUERY_TAG for this deploy (audit / observability). The CLI runs ALTER SESSION SET QUERY_TAG='<tag>' before any migration statement so QUERY_HISTORY can attribute the deploy. Defaults to 'sdt:<projectName>@<projectVersion>:<unix-ms>'."
+  ).option(
+    "--manifest <path>",
+    "After --apply, write a JSON deploy manifest (every step + status + duration + reverse SQL) to <path>. Replayable via `sdt revert --manifest <path>`."
+  ).option(
+    "--ai-preflight",
+    "Before --apply, ask AI to grade the operator's plain-language deploy description against the actual diff + safety findings. Blocks on 'mismatch' unless --confirm-after-preflight-mismatch is also passed.",
+    false
+  ).option(
+    "--ai-preflight-text <narrative>",
+    "Non-interactive form of --ai-preflight. Supplies the narrative directly instead of reading from stdin."
+  ).option(
+    "--strict-ai-preflight",
+    "Also block on 'partial' (not just 'mismatch'). Useful for production deploys.",
+    false
+  ).option(
+    "--confirm-after-preflight-mismatch",
+    "Proceed even when --ai-preflight returns a mismatch verdict. Acknowledges that the AI grader flagged a discrepancy.",
+    false
+  ).option(
+    "--require-approvals <n>",
+    "Multi-approver gate: refuse --apply until <n> distinct approvers have signed off via `sdt approval add <deploy-id> --as <user>`. Team-tier."
+  ).option(
+    "--approver <ids>",
+    "Comma-separated allow-list of approver IDs honoured by --require-approvals. Empty = any approver counts."
+  ).option(
+    "--deploy-id <id>",
+    "Stable deploy identifier paired with --require-approvals (default: <connection>:<db>.<schema>)."
+  ).option(
+    "--approvals-root <path>",
+    "Approvals directory (default: .sdt/approvals).",
+    path.join(".sdt", "approvals")
+  ).option(
+    "--allow-protected <fqns>",
+    "Comma-separated FQNs to allow despite .sdt-protection.json protection. Repeatable.",
+    (val, prev) => [...prev, val],
+    []
+  ).option(
+    "--allow-all-protected",
+    "Override all protection config entries (caution: disables DSR.4 guardrails).",
+    false
+  ).option(
+    "--freshness <mode>",
+    "Pac age check: warn (log if stale, continue), strict (block if stale), skip (no check). Default warn.",
+    "warn"
+  ).option(
+    "--post-deploy-tests <project>",
+    "After a successful --apply, discover YAML tests under <project>/tests/ and run them against the same connection. Exits 2 on any blocking (error-severity) DQ failure. Emits POST_DEPLOY_DQ_FAILED hint with --restore-from-snapshot recipe when tests fail."
+  ).option(
+    "--via-dcm <stage>",
+    "Enterprise: delegate execution to Snowflake DCM Projects. <stage> is the DCM project FQN (e.g. @MY_DB.PUBLIC.MY_STAGE/my_project). SDT runs its safety pre-flight and DCM compatibility check, then executes EXECUTE DCM PROJECT DEPLOY. DCM must have been populated via `sdt export --dcm` first."
+  ).option(
+    "--profile <name>",
+    "VARSYNTAX.2 \u2014 look up `deploymentProfiles[<name>].variables` from the pac manifest and substitute `$(VAR)` references in the generated migration script. Errors if the named profile is absent from the pac (e.g. pac built before VARSYNTAX.2, or profile not declared in .sdtproj). Distinct from `--connection`, which selects the Snowflake credential profile."
+  ).option(
+    "--variables <kv>",
+    "VARSYNTAX.2 \u2014 comma-separated KEY=VALUE pairs for `$(VAR)` substitution. Merged on top of `--profile <name>` variables (CLI values win on key collision)."
+  ).action(async (opts) => {
+    if (opts.apply && opts.dryRun) {
+      logger.error("--apply and --dry-run are mutually exclusive.");
+      process.exitCode = 1;
+      return;
+    }
+    if (opts.restoreFromSnapshot) {
+      await runRestoreFromSnapshot(opts);
+      return;
+    }
+    if (!opts.pac) {
+      logger.error("--pac <path> is required (unless --restore-from-snapshot is given).");
+      process.exitCode = 1;
+      return;
+    }
+    const pacPath = path.resolve(String(opts.pac));
+    const pac = await readPac(pacPath);
+    const freshnessMode = opts.freshness ?? "warn";
+    if (freshnessMode !== "skip") {
+      const fr = pacFreshness.checkPacFreshness(pac.manifest.builtAt);
+      if (fr.status !== "fresh") {
+        const msg = pacFreshness.formatFreshnessWarning(fr, pacPath);
+        if (freshnessMode === "strict") {
+          logger.error(msg);
+          process.exitCode = 1;
+          return;
+        } else {
+          logger.warn(msg);
+        }
+      }
+    }
+    const profileName = String(opts.connection);
+    const profile = await getProfile(profileName);
+    const conn = new SnowflakeConnection(profile);
+    const db = opts.db ? String(opts.db) : pac.manifest.scope.database;
+    const schema = opts.schema ? String(opts.schema) : pac.manifest.scope.schema;
+    const live = new LiveSource(conn, { database: db, schema });
+    const source = new ModelSource(pacPath, pac.model);
+    const baseline = pac.manifest.deployOptions;
+    const merged = mergeDeployOptions(baseline);
+    const isProd = safety.looksLikeProduction(profileName);
+    const resolved = {
+      ...merged,
+      deployment: safety.applyProductionSafetyFloor(merged.deployment, isProd)
+    };
+    if (isProd && merged.deployment.preDeployClone !== true) {
+      logger.info(
+        '  Profile "' + profileName + '" looks like production \u2014 forcing deployOptions.deployment.preDeployClone=true (safety floor).'
+      );
+    }
+    const preScripts = opts.preScripts === false ? [] : resolveDeployScripts(pac.source, resolved.deployment.preDeployScriptPatterns);
+    const postScripts = opts.postScripts === false ? [] : resolveDeployScripts(pac.source, resolved.deployment.postDeployScriptPatterns);
+    const nameMapping = await buildMappingFromOptions(opts);
+    const engine = new CompareEngine();
+    logger.step("Comparing pac to live...");
+    const sliceConfig = opts.slice === false ? void 0 : pac.manifest.slice;
+    const slice = sliceConfig ? compileSlice(sliceConfig) : void 0;
+    const result = await engine.compare(source, live, {
+      ...nameMapping ? { nameMapping } : {},
+      ...slice ? { sliceFilter: slice } : {}
+    });
+    if (slice) {
+      const outside = result.outsideScope?.length ?? 0;
+      const refs = result.referenced?.length ?? 0;
+      logger.info(
+        "  Slice active: " + result.objects.length + " owned \xB7 " + outside + " outside scope (untouched) \xB7 " + refs + " referenced"
+      );
+    }
+    logger.info(
+      "  +" + result.summary.added + " -" + result.summary.removed + " ~" + result.summary.modified + " =" + result.summary.unchanged
+    );
+    const protConfig = await protectedObjects.loadProtectionConfig(path.dirname(pacPath));
+    if (protConfig) {
+      const ops = result.objects.filter((o) => o.kind !== "unchanged" && o.kind !== "added").map((o) => ({
+        fqn: o.identity.fqn,
+        objectType: String(o.identity.objectType),
+        kind: o.kind
+      }));
+      const allowedFqns = (opts.allowProtected ?? []).flatMap(
+        (s) => s.split(",").map((f) => f.trim())
+      );
+      const violations = protectedObjects.checkProtectedObjects(ops, protConfig, {
+        allowedFqns,
+        allowAll: Boolean(opts.allowAllProtected)
+      });
+      if (violations.length > 0) {
+        logger.error(protectedObjects.formatProtectionViolations(violations));
+        process.exitCode = 1;
+        await conn.disconnect();
+        return;
+      }
+    }
+    const deploymentProfileName = opts.profile ? String(opts.profile) : void 0;
+    let publishVariables;
+    if (deploymentProfileName) {
+      const profileBlock = pac.manifest.deploymentProfiles?.[deploymentProfileName];
+      if (!profileBlock) {
+        const available = Object.keys(pac.manifest.deploymentProfiles ?? {});
+        logger.error(
+          `--profile ${deploymentProfileName}: no deploymentProfile by that name in the pac manifest. ` + (available.length === 0 ? "The pac carries no deploymentProfiles (was it built before VARSYNTAX.2, or does the .sdtproj declare any?)." : `Available: ${available.join(", ")}.`)
+        );
+        process.exitCode = 1;
+        await conn.disconnect();
+        return;
+      }
+      if (profileBlock.variables) publishVariables = { ...profileBlock.variables };
+    }
+    const cliVariables = parsePublishVariables(opts.variables);
+    if (cliVariables) {
+      publishVariables = { ...publishVariables ?? {}, ...cliVariables };
+    }
+    const gen = new ScriptGenerator();
+    const generateContext = {
+      projectName: pac.manifest.projectName,
+      projectVersion: pac.manifest.projectVersion,
+      ...deploymentProfileName ? { profile: deploymentProfileName } : {},
+      ...profile.auth?.username ? { user: profile.auth.username } : {}
+    };
+    const body = gen.generate(result, {
+      banner: "SDT publish: " + pac.manifest.projectName + " v" + pac.manifest.projectVersion,
+      deployment: resolved.deployment,
+      ...publishVariables ? { variables: publishVariables } : {},
+      context: generateContext
+    });
+    const sections = [];
+    if (preScripts.length > 0) {
+      sections.push("-- " + "=".repeat(68));
+      sections.push("-- PRE-DEPLOY (" + preScripts.length + " script(s))");
+      sections.push("-- " + "=".repeat(68));
+      for (const s of preScripts) sections.push(formatDeployScript(s, "pre"));
+    }
+    sections.push(body.sql);
+    if (postScripts.length > 0) {
+      sections.push("");
+      sections.push("-- " + "=".repeat(68));
+      sections.push("-- POST-DEPLOY (" + postScripts.length + " script(s))");
+      sections.push("-- " + "=".repeat(68));
+      for (const s of postScripts) sections.push(formatDeployScript(s, "post"));
+    }
+    const fullScript = sections.join("\n");
+    logger.info(
+      "  pre-deploy: " + preScripts.length + " script(s); post-deploy: " + postScripts.length + " script(s)"
+    );
+    if (opts.out) {
+      const out = path.resolve(String(opts.out));
+      await fs.mkdir(path.dirname(out), { recursive: true });
+      await fs.writeFile(out, fullScript);
+      logger.success("Wrote migration script to " + out);
+    }
+    if (opts.dryRun || !opts.apply) {
+      const colorMode = opts.color ?? "auto";
+      process.stdout.write(colorizeMigrationScript(fullScript, { mode: colorMode }) + "\n");
+      await conn.disconnect();
+      return;
+    }
+    const assessment = safety.assess(result, { deployment: resolved.deployment });
+    logger.info(
+      "  safety: " + assessment.unrecoverable.length + " unrecoverable, " + assessment.destructive.length + " destructive, " + assessment.expensive.length + " expensive, " + assessment.warnings.length + " warnings"
+    );
+    if (assessment.blocked) {
+      logger.error("Deploy refused: " + assessment.blockReason);
+      await conn.disconnect();
+      process.exitCode = 1;
+      return;
+    }
+    const satisfied = safety.satisfiedGates({
+      yes: Boolean(opts.yes),
+      confirmProduction: Boolean(opts.confirmProduction) || !safety.looksLikeProduction(profileName),
+      allowDropTable: resolved.deployment.allowDropTable,
+      allowDropColumn: resolved.deployment.allowDropColumn,
+      allowNarrowing: resolved.deployment.allowNarrowingTypes,
+      allowTableRebuild: resolved.deployment.allowTableRebuild,
+      allowUnrecoverableDrop: resolved.deployment.allowUnrecoverableDrop
+    });
+    const outstanding = safety.outstandingGates(assessment, satisfied);
+    if (outstanding.length > 0) {
+      logger.error(
+        "Outstanding safety gate(s): " + outstanding.join(", ") + ". Pass --yes / --confirm-production or set the matching deployOptions.deployment.* flag in the profile."
+      );
+      await conn.disconnect();
+      process.exitCode = 1;
+      return;
+    }
+    if (opts.requireApprovals !== void 0 && opts.requireApprovals !== false) {
+      const required = Number(opts.requireApprovals) || 0;
+      const allowed = opts.approver ? String(opts.approver).split(",").map((s) => s.trim()).filter(Boolean) : [];
+      const deployId = String(opts.deployId ?? `${profileName}:${db}.${schema}`);
+      const approvalsRoot = String(opts.approvalsRoot);
+      const file = await approval.readApprovalFile(approvalsRoot, deployId);
+      const outcome = approval.evaluateApprovalGate(
+        { deployId, required, allowedApprovers: allowed },
+        file.approvals
+      );
+      if (!outcome.satisfied) {
+        logger.error(
+          "Approval gate blocked deploy: " + (outcome.blockReason ?? "gate not satisfied") + `. Record approvals with \`sdt approval add ${deployId} --as <user>\`.`
+        );
+        await conn.disconnect();
+        process.exitCode = 1;
+        return;
+      }
+      logger.info(
+        `  approvals: ${outcome.satisfiedBy.length}/${required} (${outcome.satisfiedBy.join(", ")})`
+      );
+    }
+    if (opts.aiPreflight) {
+      const narrative = await readPreflightNarrative(opts.aiPreflightText);
+      if (!narrative) {
+        logger.error(
+          "--ai-preflight needs a narrative. Provide it inline via --ai-preflight-text or via stdin."
+        );
+        await conn.disconnect();
+        process.exitCode = 1;
+        return;
+      }
+      logger.step("Grading deploy narrative with AI...");
+      try {
+        const findings = [
+          ...assessment.unrecoverable.map((f) => ({
+            code: String(f.code),
+            fqn: f.fqn,
+            reason: f.reason
+          })),
+          ...assessment.destructive.map((f) => ({
+            code: String(f.code),
+            fqn: f.fqn,
+            reason: f.reason
+          })),
+          ...assessment.expensive.map((f) => ({
+            code: String(f.code),
+            fqn: f.fqn,
+            reason: f.reason
+          }))
+        ];
+        const compareSummary = `added ${result.summary.added}, modified ${result.summary.modified}, removed ${result.summary.removed}, unchanged ${result.summary.unchanged}`;
+        const verdict = await aiPreflight.gradePreflight(
+          {
+            narrative,
+            compareSummary,
+            safetyFindings: findings,
+            diffSampleDdl: fullScript,
+            target: `${db}.${schema}@${profileName}`
+          },
+          {
+            completeFn: async (prompt) => {
+              const r = await ai.complete([{ role: "user", content: prompt }], {
+                feature: "ai-preflight"
+              });
+              return r.text;
+            }
+          }
+        );
+        logger.info("  preflight verdict: " + verdict.verdict);
+        if (verdict.reasoning) logger.info("  preflight reasoning: " + verdict.reasoning);
+        for (const d of verdict.discrepancies) logger.info("    \u2022 " + d);
+        const isBlocking = verdict.verdict === "mismatch" || opts.strictAiPreflight && verdict.verdict === "partial";
+        if (isBlocking && !opts.confirmAfterPreflightMismatch) {
+          logger.error(
+            `Deploy refused: AI preflight returned "${verdict.verdict}". Re-run with --confirm-after-preflight-mismatch to override, or revise the narrative.`
+          );
+          await conn.disconnect();
+          process.exitCode = 1;
+          return;
+        }
+        if (verdict.parseFailed) {
+          logger.warn(
+            "  preflight verdict could not be parsed \u2014 continuing without a clean alignment signal."
+          );
+        }
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logger.error(
+          `--ai-preflight failed: ${msg}. Configure an AI provider via \`sdt ai status\` or omit --ai-preflight.`
+        );
+        await conn.disconnect();
+        process.exitCode = 1;
+        return;
+      }
+    }
+    if (opts.viaDcm) {
+      const dcmStage = String(opts.viaDcm);
+      const lic = await license.loadLicense();
+      const licCheck = license.checkProFeature(lic, "dcm-deploy");
+      if (licCheck.warning) logger.warn("[Enterprise] " + licCheck.warning);
+      const dcmCompatReport = assessDcmCompatibility(result);
+      if (dcmCompatReport.blocked) {
+        logger.error("--via-dcm blocked:\n" + formatDcmCompatibilityReport(dcmCompatReport));
+        await conn.disconnect();
+        process.exitCode = 1;
+        return;
+      }
+      if (dcmCompatReport.findings.length > 0) {
+        logger.warn(
+          "DCM compatibility warnings:\n" + formatDcmCompatibilityReport(dcmCompatReport)
+        );
+      }
+      if (opts.dryRun || !opts.apply) {
+        logger.info(
+          "DCM compatibility check passed (" + dcmCompatReport.findings.length + " warning(s)). Use --apply to execute via DCM."
+        );
+        await conn.disconnect();
+        return;
+      }
+      logger.step("Executing via DCM: EXECUTE DCM PROJECT " + dcmStage + " DEPLOY");
+      const dcmResult = await executeDcmProjectDeploy(conn, dcmStage);
+      const bodyReport2 = mapDcmResultToDeploymentReport(dcmResult);
+      if (dcmResult.overallStatus === "SUCCESS") {
+        logger.success(
+          "DCM deploy complete. " + dcmResult.objects.length + " object(s) processed."
+        );
+      } else {
+        logger.error(
+          "DCM deploy finished with failures: " + dcmResult.failures.length + " failed, " + dcmResult.objects.length + " total."
+        );
+        process.exitCode = 1;
+      }
+      if (opts.manifest) {
+        const m = buildDeployManifest(bodyReport2, profile.account);
+        const mPath = path.resolve(String(opts.manifest));
+        await fs.mkdir(path.dirname(mPath), { recursive: true });
+        await fs.writeFile(mPath, JSON.stringify(m, null, 2) + "\n", "utf8");
+        logger.success("Wrote deploy manifest \u2192 " + mPath);
+      }
+      await conn.disconnect();
+      return;
+    }
+    const queryTag = typeof opts.queryTag === "string" && opts.queryTag.length > 0 ? String(opts.queryTag) : `sdt:${pac.manifest.projectName}@${pac.manifest.projectVersion}:${Date.now()}`;
+    try {
+      await conn.query(`ALTER SESSION SET QUERY_TAG = '${queryTag.replace(/'/g, "''")}'`);
+      logger.info("  query_tag: " + queryTag);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      logger.error(
+        "Failed to set QUERY_TAG: " + msg + ". Continuing without tag \u2014 audit attribution will be missing."
+      );
+    }
+    logger.step("Applying migration...");
+    let executed = 0;
+    let failed = 0;
+    const runOne = async (sql, label) => {
+      const stmts = splitStatements(sql);
+      for (const stmt of stmts) {
+        try {
+          await conn.query(stmt);
+          executed += 1;
+        } catch (err) {
+          failed += 1;
+          const msg = err instanceof Error ? err.message : String(err);
+          logger.error("  [" + label + "] failed: " + msg + "\n      " + stmt);
+          return false;
+        }
+      }
+      return true;
+    };
+    let ok = true;
+    for (const s of preScripts) {
+      logger.info("  pre: " + s.path);
+      ok = await runOne(s.sql, "pre/" + s.path);
+      if (!ok) break;
+    }
+    let bodyReport;
+    if (ok) {
+      const plan = defaultSafePlan(result);
+      const validated = validatePlan(result, plan);
+      const steps = buildExecutionPlan(result, validated, {
+        deployment: resolved.deployment
+      });
+      if (steps.length > 0) {
+        const executor = new SnowflakeExecutor(conn, {
+          onStatement: (sql) => {
+            executed += 1;
+            const head = sql.split("\n")[0]?.slice(0, 100) ?? "";
+            logger.info("  \u2192 " + head + (sql.length > 100 ? " \u2026" : ""));
+          }
+        });
+        bodyReport = await executePlan(steps, executor, {
+          rollbackOnFailure: false,
+          onStepEnd: (r) => {
+            if (r.status === "FAILED") {
+              failed += 1;
+              logger.error(
+                "  [" + r.step.fqn + "] failed: " + (r.error ?? "unknown") + "\n      " + r.step.forwardSql
+              );
+            }
+          }
+        });
+        if (bodyReport.finalState !== "CLEAN_SUCCESS") ok = false;
+      }
+    }
+    if (ok) {
+      for (const s of postScripts) {
+        logger.info("  post: " + s.path);
+        ok = await runOne(s.sql, "post/" + s.path);
+        if (!ok) break;
+      }
+    }
+    if (opts.manifest && bodyReport) {
+      const m = buildDeployManifest(bodyReport, profile.account);
+      const mPath = path.resolve(String(opts.manifest));
+      await fs.mkdir(path.dirname(mPath), { recursive: true });
+      await fs.writeFile(mPath, JSON.stringify(m, null, 2) + "\n", "utf8");
+      logger.success("Wrote deploy manifest \u2192 " + mPath);
+    }
+    if (ok) {
+      logger.success("Deploy complete. " + executed + " statement(s) executed.");
+      if (opts.postDeployTests) {
+        const projectRoot = path.resolve(String(opts.postDeployTests));
+        logger.step("Running post-deploy DQ tests from " + projectRoot + "...");
+        const testFiles = await testFramework.discoverTests(projectRoot);
+        if (testFiles.length === 0) {
+          logger.warn(
+            "  POST_DEPLOY_DQ: no tests found under " + projectRoot + "/tests/ \u2014 skipping."
+          );
+        } else {
+          const report = await testFramework.runTestFiles(testFiles, conn);
+          process.stdout.write(testFramework.renderTextReport(report));
+          if (report.summary.blocking) {
+            logger.error(
+              "POST_DEPLOY_DQ_FAILED: " + report.summary.fail + " fail / " + report.summary.error + " error." + (opts.manifest ? " Recover: `sdt revert --manifest " + String(opts.manifest) + "`" : " Consider re-deploying prior version or using `sdt revert --manifest` if --manifest was used.")
+            );
+            process.exitCode = 2;
+          } else {
+            logger.success(
+              "  POST_DEPLOY_DQ: " + report.summary.pass + "/" + report.summary.total + " pass."
+            );
+          }
+        }
+      }
+    } else {
+      logger.error(
+        "Deploy aborted after " + executed + " statement(s); " + failed + " failure(s). Recover via UNDROP / clone-swap if preDeployClone was set."
+      );
+      process.exitCode = 1;
+    }
+    await conn.disconnect();
+  });
+  addMappingFlags(cmd);
+  attachRelatedOptions(cmd, [
+    "deployment.allowDropTable",
+    "deployment.allowDropColumn",
+    "deployment.allowUnrecoverableDrop",
+    "deployment.allowNarrowingTypes",
+    "deployment.preDeployClone",
+    "deployment.blockOnPossibleDataLoss",
+    "deployment.preserveTargetOnlyObjects"
+  ]);
+  return cmd;
+}
+async function runRestoreFromSnapshot(opts) {
+  const batchId = String(opts.restoreFromSnapshot);
+  const registryDir = path.resolve(String(opts.snapshotDir ?? ".sdt/snapshots"));
+  const profileName = String(opts.connection);
+  let batch;
+  try {
+    batch = await safety.readSnapshotBatch(registryDir, batchId);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    logger.error(`Snapshot batch "${batchId}" not found in ${registryDir}: ${msg}`);
+    process.exitCode = 1;
+    return;
+  }
+  const sqlLines = safety.emitRestoreFromSnapshotSql(batch);
+  const sql = sqlLines.join("\n");
+  logger.info(`Restoring from batch ${batch.batchId} (createdAt=${batch.createdAt})`);
+  logger.info(
+    `  ${batch.entries.length} object(s) recorded; ${sqlLines.filter((l) => !l.startsWith("--")).length} statement(s) will run.`
+  );
+  if (opts.out) {
+    const out = path.resolve(String(opts.out));
+    await fs.mkdir(path.dirname(out), { recursive: true });
+    await fs.writeFile(out, sql + "\n", "utf8");
+    logger.success(`Wrote restore SQL \u2192 ${out}`);
+  }
+  if (opts.dryRun || !opts.apply) {
+    const colorMode = opts.color ?? "auto";
+    process.stdout.write(colorizeMigrationScript(sql, { mode: colorMode }) + "\n");
+    return;
+  }
+  if (!opts.yes) {
+    logger.error("--apply requires --yes (restore replaces production tables via SWAP WITH).");
+    process.exitCode = 1;
+    return;
+  }
+  if (safety.looksLikeProduction(profileName) && !opts.confirmProduction) {
+    logger.error(
+      `Profile "${profileName}" looks like production \u2014 also pass --confirm-production to restore.`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const profile = await getProfile(profileName);
+  const conn = new SnowflakeConnection(profile);
+  let executed = 0;
+  let failed = 0;
+  try {
+    for (const stmt of coreSplitStatements(sql).map((s) => s.sql)) {
+      try {
+        await conn.query(stmt);
+        executed += 1;
+        const head = stmt.split("\n")[0]?.slice(0, 100) ?? "";
+        logger.info("  \u2192 " + head + (stmt.length > 100 ? " \u2026" : ""));
+      } catch (err) {
+        failed += 1;
+        const msg = err instanceof Error ? err.message : String(err);
+        logger.error(`  [restore ${batch.batchId}] ${msg}
+      ${stmt}`);
+      }
+    }
+  } finally {
+    await conn.disconnect();
+  }
+  if (failed === 0) {
+    logger.success(`Restore complete. ${executed} statement(s) executed.`);
+  } else {
+    logger.error(
+      `Restore finished with failures: ${executed} ok, ${failed} failed. Inspect the snapshot tables under ${registryDir} and recover by hand.`
+    );
+    process.exitCode = 1;
+  }
+}
+async function readPreflightNarrative(inlineText) {
+  if (typeof inlineText === "string" && inlineText.trim().length > 0) {
+    return inlineText.trim();
+  }
+  if (process.stdin.isTTY) {
+    process.stdout.write(
+      "\n--ai-preflight is active. In one paragraph, describe what you expect this deploy to do.\nEnd with an empty line (or Ctrl-D):\n> "
+    );
+  }
+  process.stdin.setEncoding("utf8");
+  let buffer = "";
+  await new Promise((resolve) => {
+    const onData = (chunk) => {
+      buffer += chunk;
+      if (/\n\s*\n/.test(buffer)) {
+        process.stdin.removeListener("data", onData);
+        process.stdin.removeListener("end", onEnd);
+        resolve();
+      }
+    };
+    const onEnd = () => {
+      process.stdin.removeListener("data", onData);
+      resolve();
+    };
+    process.stdin.on("data", onData);
+    process.stdin.on("end", onEnd);
+  });
+  const trimmed = buffer.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function parsePublishVariables(raw) {
+  if (!raw) return void 0;
+  const out = {};
+  for (const pair of String(raw).split(",")) {
+    const eq = pair.indexOf("=");
+    if (eq <= 0) continue;
+    const k = pair.slice(0, eq).trim();
+    const v = pair.slice(eq + 1).trim();
+    if (k.length > 0) out[k] = v;
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+export {
+  parsePublishVariables,
+  publishCommand
+};
+//# sourceMappingURL=publish-Y2J56K4Y.js.map