()
| 553 | }; |
| 554 | |
| 555 | const main = async (): Promise<void> => { |
| 556 | if (inputJson) { |
| 557 | const input = parseInputJson(inputJson); |
| 558 | writeDryRun( |
| 559 | filterInputByOrg( |
| 560 | { |
| 561 | ...input, |
| 562 | trafficLastTenant: trafficLastTenant ?? input.trafficLastTenant, |
| 563 | }, |
| 564 | orgFilter, |
| 565 | ), |
| 566 | ); |
| 567 | return; |
| 568 | } |
| 569 | if (!databaseUrl) { |
| 570 | throw new Error("Set DATABASE_URL or pass --input-json"); |
| 571 | } |
| 572 | const usesLocalDatabase = databaseUrl.includes("127.0.0.1") || databaseUrl.includes("localhost"); |
| 573 | const sql = postgres(databaseUrl, { |
| 574 | max: 1, |
| 575 | prepare: false, |
| 576 | ...(usesLocalDatabase ? {} : { ssl: "require" as const }), |
| 577 | }) as unknown as SqlClient; |
| 578 | try { |
| 579 | const input = filterInputByOrg( |
| 580 | await readDatabaseInput(sql, !apply, usesLocalDatabase ? "database" : "external"), |
| 581 | orgFilter, |
| 582 | ); |
| 583 | if (!apply) { |
| 584 | writeDryRun(input); |
| 585 | return; |
| 586 | } |
| 587 | // Orphan block/require_approval policies (a guardrail targeting a service |
| 588 | // the org never derived, e.g. a gmail send-block on a Search-Console-only |
| 589 | // org) retarget to every derived service as dormant rows rather than |
| 590 | // blocking apply. Approved by Rhys 2026-07-08; matches the boot rail. |
| 591 | const plan = planMigration({ ...input, orphanPolicyMode: "retarget_all" }); |
| 592 | const neverWiden = verifyPolicyRewriteNeverWidens(plan, input); |
| 593 | if (!neverWiden.ok) { |
| 594 | throw new Error( |
| 595 | `Policy rewrite failed coverage checks: widened=${neverWiden.widened.length}, narrowed=${neverWiden.narrowed.length}`, |
| 596 | ); |
| 597 | } |
| 598 | if ( |
| 599 | plan.summary.integrationsMissingSpecBlob > 0 || |
| 600 | plan.summary.integrationsMissingDefsBlob > 0 |
| 601 | ) { |
| 602 | throw new Error( |
| 603 | `Serving blob check failed: missing spec=${plan.summary.integrationsMissingSpecBlob}, missing defs=${plan.summary.integrationsMissingDefsBlob}`, |
| 604 | ); |
| 605 | } |
| 606 | const zeroOperationIntegrations = plan.orgs |
| 607 | .filter((org) => !org.completed && org.hardErrors.length === 0) |
| 608 | .flatMap((org) => org.integrations) |
| 609 | .filter( |
| 610 | (integration) => |
| 611 | integration.servingState.operationsToBuild === 0 && |
| 612 | !integration.servingState.expectedZeroOperations, |
no test coverage detected