@databricks-solutions/lakebase-scm-utils 0.2.43 → 0.2.45

package/dist/scripts/index.js

@@ -8650,16 +8650,33 @@ stdout: ${stdout}` : killed || signal ? `
 }
 async function runDatabricks(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault
-    });
+    if (opts.input !== void 0) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
+function execDatabricksWithStdin(argv, input, env, timeout) {
+  return new Promise((resolve2, reject) => {
+    const child = execFile("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        err.stdout = String(stdout ?? "");
+        err.stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve2(String(stdout ?? ""));
+    });
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(input);
+  });
+}
 function runDatabricksSync(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
   try {
@@ -9702,8 +9719,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.2.43".length > 0) {
-    cached = "0.2.43";
+  if ("0.2.45".length > 0) {
+    cached = "0.2.45";
     return cached;
   }
   cached = "unknown";
@@ -12969,8 +12986,20 @@ async function setupRunner(args) {
   if (needsConfig) {
     report("Registering runner with GitHub...");
     const regToken = await createRegistrationToken(args.fullRepoName);
-    cp4.execSync(
-      `./config.sh --url "https://github.com/${args.fullRepoName}" --token "${regToken}" --name "${name}" --labels self-hosted --unattended --replace`,
+    cp4.execFileSync(
+      "./config.sh",
+      [
+        "--url",
+        `https://github.com/${args.fullRepoName}`,
+        "--token",
+        regToken,
+        "--name",
+        name,
+        "--labels",
+        "self-hosted",
+        "--unattended",
+        "--replace"
+      ],
       { cwd: dir, timeout: KIT_TIMEOUTS.cliLong }
     );
   }
@@ -15992,1197 +16021,1289 @@ function pickRunUrl(pr) {
 
 // scripts/lakebase/scm-merge.ts
 init_esm_shims();
-async function reconcileTierToOrigin(args) {
-  const { cwd, tier } = args;
+
+// scripts/git/sync.ts
+init_esm_shims();
+async function currentBranchName(cwd) {
   try {
-    const head = await getCurrentBranch({ cwd });
-    if (head === tier) {
-      await exec2(`git pull --ff-only`, { cwd, timeout: 3e4 });
-    } else {
-      await exec2(`git fetch origin ${shellEscape2(`${tier}:${tier}`)}`, { cwd, timeout: 3e4 });
-    }
-    return null;
-  } catch (err) {
-    return `local reconcile of ${tier} to origin/${tier} failed: ${err instanceof Error ? err.message : String(err)}. Reconcile it by hand (git checkout ${tier} && git pull --ff-only).`;
+    return await exec2("git rev-parse --abbrev-ref HEAD", { cwd });
+  } catch {
+    return "";
   }
 }
-var ScmMergeError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "ScmMergeError";
-  }
-  code;
-};
-var DEFAULT_MIGRATE_TIMEOUT_MS = 30 * 60 * 1e3;
-var DEFAULT_MIGRATE_POLL_MS = 30 * 1e3;
-function defaultMigratePredicate(run, mergedAt) {
-  if (!run.createdAt) return false;
-  const created = Date.parse(run.createdAt);
-  if (!Number.isFinite(created)) return false;
-  if (run.event && run.event !== "push") return false;
-  return created >= mergedAt.getTime() - 5e3;
+async function push(args) {
+  await exec2("git push", { cwd: args.cwd });
 }
-function shaMigratePredicate(mergeCommitSha) {
-  return (run) => {
-    if (run.event && run.event !== "push") return false;
-    return !!run.headSha && run.headSha === mergeCommitSha;
-  };
+async function pull(args) {
+  await exec2("git pull", { cwd: args.cwd });
 }
-async function mergeFeature(args) {
-  const current = readWorkflowState(args.projectDir);
-  if (!current) {
-    throw new ScmMergeError(
-      "No SCM workflow state. wait-ci first.",
-      "no-state-file"
-    );
-  }
-  if (current.state !== "ci-green") {
-    throw new ScmMergeError(
-      `merge refuses state "${current.state}". Allowed predecessor: ci-green.`,
-      "bad-precondition"
-    );
+async function publishBranch(args) {
+  const remote = args.remote ?? "origin";
+  const branch = await currentBranchName(args.cwd);
+  if (!branch) throw new Error("No current branch");
+  await exec2(`git push -u ${remote} ${shq(branch)}`, {
+    cwd: args.cwd
+  });
+}
+async function pushCurrentBranchForPr(args) {
+  const remote = args.remote ?? "origin";
+  const branch = await currentBranchName(args.cwd);
+  if (!branch) throw new Error("No current branch");
+  const upstreamSet = await hasUpstream({ cwd: args.cwd });
+  if (!upstreamSet) {
+    await exec2(`git push -u ${remote} ${shq(branch)}`, {
+      cwd: args.cwd
+    });
+  } else {
+    await exec2("git push", { cwd: args.cwd });
   }
-  if (!current.pr_url) {
-    throw new ScmMergeError(
-      "ci-green row is missing pr_url; cannot resolve the PR to merge.",
-      "no-pr-url"
+}
+async function fetch2(args) {
+  const parts = ["git fetch"];
+  if (args.prune) parts.push("--prune");
+  if (args.all) parts.push("--all");
+  await exec2(parts.join(" "), { cwd: args.cwd });
+}
+async function pullFrom(args) {
+  await exec2(`git pull ${shq(args.remote)} ${shq(args.branch)}`, {
+    cwd: args.cwd
+  });
+}
+async function pushTo(args) {
+  await exec2(`git push ${shq(args.remote)} ${shq(args.branch)}`, {
+    cwd: args.cwd
+  });
+}
+async function sync(args) {
+  await exec2("git pull", { cwd: args.cwd });
+  await exec2("git push", { cwd: args.cwd });
+}
+
+// scripts/lakebase/workflow-drift.ts
+init_esm_shims();
+import * as fs29 from "fs";
+import * as path29 from "path";
+function findKitTemplatesDir(start) {
+  let dir = start;
+  for (let i = 0; i < 6; i++) {
+    const candidate = path29.join(
+      dir,
+      "templates",
+      "project",
+      "common",
+      ".github",
+      "workflows"
     );
+    if (fs29.existsSync(candidate)) return candidate;
+    const parent = path29.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
   }
-  if (!current.branch || !current.parent_branch) {
-    throw new ScmMergeError(
-      "ci-green row missing branch / parent_branch; refusing to merge.",
-      "bad-precondition"
-    );
+  throw new Error(
+    `Could not locate templates/project/common/.github/workflows/ relative to ${start}. Pass explicit kitDir.`
+  );
+}
+function unifiedDiff(name, projectContent, templateContent) {
+  if (projectContent === templateContent) return "";
+  const a = projectContent.split("\n");
+  const b = templateContent.split("\n");
+  const out = [`--- project/${name}`, `+++ template/${name}`];
+  const max = Math.max(a.length, b.length);
+  for (let i = 0; i < max; i++) {
+    const av = a[i];
+    const bv = b[i];
+    if (av === bv) continue;
+    if (av !== void 0) out.push(`-${i + 1}: ${av}`);
+    if (bv !== void 0) out.push(`+${i + 1}: ${bv}`);
   }
-  const ownerRepo = await getOwnerRepo(args.projectDir);
-  if (!ownerRepo) {
-    throw new ScmMergeError(
-      "No GitHub remote found at origin.",
-      "no-github-remote"
-    );
+  return out.join("\n");
+}
+function detectWorkflowDrift(args) {
+  const projectWorkflowsDir = path29.join(
+    args.projectDir,
+    ".github",
+    "workflows"
+  );
+  const here = path29.dirname(new URL(import.meta.url).pathname);
+  const kitWorkflowsDir = args.kitDir ? path29.join(
+    args.kitDir,
+    "templates",
+    "project",
+    "common",
+    ".github",
+    "workflows"
+  ) : findKitTemplatesDir(here);
+  const templateFiles = fs29.existsSync(kitWorkflowsDir) ? fs29.readdirSync(kitWorkflowsDir).filter((f) => f.endsWith(".yml")) : [];
+  const projectFiles = fs29.existsSync(projectWorkflowsDir) ? fs29.readdirSync(projectWorkflowsDir).filter((f) => f.endsWith(".yml")) : [];
+  const version = readKitVersion(kitWorkflowsDir);
+  const seen = /* @__PURE__ */ new Set();
+  const files = [];
+  for (const name of templateFiles) {
+    seen.add(name);
+    const projectPath2 = path29.join(projectWorkflowsDir, name);
+    const templatePath = path29.join(kitWorkflowsDir, name);
+    if (!fs29.existsSync(projectPath2)) {
+      files.push({ name, status: "missing" });
+      continue;
+    }
+    const projectContent = fs29.readFileSync(projectPath2, "utf8");
+    const templateContent = applyPlaceholders(fs29.readFileSync(templatePath, "utf8"), version);
+    if (projectContent === templateContent) {
+      files.push({ name, status: "unchanged" });
+    } else {
+      files.push({
+        name,
+        status: "drifted",
+        diff: unifiedDiff(name, projectContent, templateContent)
+      });
+    }
   }
-  const pullNumber = extractPullNumber(current.pr_url);
-  if (!pullNumber) {
-    throw new ScmMergeError(
-      `Could not extract PR number from URL: ${current.pr_url}`,
-      "bad-pr-url"
-    );
+  for (const name of projectFiles) {
+    if (seen.has(name)) continue;
+    files.push({ name, status: "extra" });
   }
-  const instance = args.instance ?? current.project_id;
-  const gitBase = await resolveGitBase(current.parent_branch, args.projectDir);
-  const wantMigrate = args.waitMigrate !== false;
-  let authVerified = false;
-  if (wantMigrate && args.verifyMigrateAuth) {
-    const probe = await args.verifyMigrateAuth();
-    if (!probe.ok) {
-      throw new ScmMergeError(
-        `Migrate-auth precondition failed: ${probe.detail ?? "the Databricks credential is not usable"}. Refusing to merge: the downstream migrate would promote git without applying the schema. Refresh your credential (databricks auth login), then re-run.`,
-        "migrate-auth"
-      );
-    }
-    authVerified = true;
+  const order = {
+    drifted: 0,
+    missing: 1,
+    extra: 2,
+    unchanged: 3
+  };
+  files.sort((a, b) => order[a.status] - order[b.status] || a.name.localeCompare(b.name));
+  const hasDrift = files.some((f) => f.status === "drifted" || f.status === "missing");
+  return {
+    overall: hasDrift ? "drift" : "ok",
+    files
+  };
+}
+function readKitVersion(kitWorkflowsDir) {
+  let dir = kitWorkflowsDir;
+  for (let i = 0; i < 5; i++) {
+    dir = path29.dirname(dir);
   }
-  let paired;
   try {
-    paired = await mergePairedPullRequest({
-      ownerRepo,
-      pullNumber,
-      lakebaseInstance: instance,
-      method: args.method ?? "squash"
-    });
-  } catch (err) {
-    throw new ScmMergeError(
-      `mergePairedPullRequest failed: ${err instanceof Error ? err.message : String(err)}`,
-      "merge-failed"
-    );
+    const raw = fs29.readFileSync(path29.join(dir, "package.json"), "utf-8");
+    const pkg = JSON.parse(raw);
+    return typeof pkg.version === "string" ? pkg.version : "unknown";
+  } catch {
+    return "unknown";
   }
-  const warnings = [...paired.warnings];
-  let localBranchDeleted = false;
-  let headAfter = current.branch;
-  if (!args.skipLocalCleanup) {
-    const switchTo = args.switchTo ?? gitBase;
-    const head = await getCurrentBranch({ cwd: args.projectDir });
-    if (head === current.branch) {
-      try {
-        await exec2(`git checkout ${shellEscape2(switchTo)}`, {
-          cwd: args.projectDir,
-          timeout: 1e4
-        });
-        headAfter = switchTo;
-        try {
-          await exec2(`git fetch origin ${shellEscape2(switchTo)}`, {
-            cwd: args.projectDir,
-            timeout: 3e4
-          });
-          await exec2(`git merge --ff-only ${shellEscape2(`origin/${switchTo}`)}`, {
-            cwd: args.projectDir,
-            timeout: 1e4
-          });
-        } catch (err) {
-          warnings.push(
-            `local fast-forward of ${switchTo} to origin/${switchTo} failed: ${err instanceof Error ? err.message : String(err)}. The PR merged remotely; your local ${switchTo} may be stale, run \`git pull --ff-only\`.`
-          );
-        }
-      } catch (err) {
-        warnings.push(
-          `git checkout ${switchTo} failed: ${err instanceof Error ? err.message : String(err)}. Local branch was NOT deleted.`
-        );
-      }
-    } else {
-      headAfter = head || current.branch;
-      const reconcileWarning = await reconcileTierToOrigin({ cwd: args.projectDir, tier: switchTo });
-      if (reconcileWarning) warnings.push(reconcileWarning);
-    }
-    if (headAfter !== current.branch) {
-      try {
-        await exec2(
-          `git branch -D ${shellEscape2(current.branch)}`,
-          { cwd: args.projectDir, timeout: 1e4 }
-        );
-        localBranchDeleted = true;
-      } catch (err) {
-        warnings.push(
-          `git branch -D ${current.branch} failed: ${err instanceof Error ? err.message : String(err)}.`
-        );
-      }
-    }
-  }
-  const nowFn = args.now ?? (() => /* @__PURE__ */ new Date());
-  const mergedAt = nowFn();
-  let next = {
-    ...current,
-    state: "merged",
-    merged_at: mergedAt.toISOString()
-  };
-  writeWorkflowState(args.projectDir, next);
-  let migrate;
-  const waitMigrate = args.waitMigrate !== false;
-  if (waitMigrate) {
-    const timeoutMs = args.migrateTimeoutMs ?? DEFAULT_MIGRATE_TIMEOUT_MS;
-    const pollMs = args.migratePollMs ?? DEFAULT_MIGRATE_POLL_MS;
-    const fetchRuns = args.fetchRuns ?? listWorkflowRuns;
-    const predicate = args.migrateRunPredicate ?? (paired.mergeCommitSha ? shaMigratePredicate(paired.mergeCommitSha) : defaultMigratePredicate);
-    const elapsedSinceMerge = nowFn().getTime() - mergedAt.getTime();
-    const remainingTimeoutMs = Math.max(0, timeoutMs - elapsedSinceMerge);
-    let polls = 0;
-    let matched;
-    let lastSeen;
-    try {
-      const result = await pollUntil({
-        timeoutMs: remainingTimeoutMs,
-        intervalMs: pollMs,
-        now: nowFn,
-        sleep: args.sleep,
-        probe: async () => {
-          const runs = await fetchRuns(ownerRepo, 20);
-          const candidates = runs.filter((r) => r.branch === gitBase).filter((r) => predicate(r, mergedAt));
-          if (candidates.length === 0) {
-            return { done: false };
-          }
-          candidates.sort(
-            (a, b) => Date.parse(b.createdAt ?? "0") - Date.parse(a.createdAt ?? "0")
-          );
-          lastSeen = candidates[0];
-          const status = (lastSeen.status ?? "").toLowerCase();
-          return status === "completed" ? { done: true, value: lastSeen } : { done: false };
-        }
-      });
-      polls = result.polls;
-      if (result.outcome === "done") {
-        matched = result.value;
-      }
-    } catch (err) {
-      warnings.push(
-        `Downstream migrate poll errored: ${err instanceof Error ? err.message : String(err)}. Treating as advisory.`
-      );
-    }
-    const applyLocalFallback = async (reason) => {
-      if (!args.localMigrateFallback) return false;
-      const r = await args.localMigrateFallback();
-      if (!r.ok) {
-        warnings.push(
-          `Local-migrate fallback FAILED after ${reason}: ${r.detail ?? "unknown error"}. git promoted but the parent schema is NOT applied (partial promotion); apply it manually.`
-        );
-        return false;
-      }
-      next = { ...next, migrate_completed_at: nowFn().toISOString() };
-      writeWorkflowState(args.projectDir, next);
-      migrate = { ...migrate ?? { waited: true, polls }, appliedLocally: true, authVerified };
-      warnings.push(
-        `Downstream migrate did not confirm (${reason}); applied the parent migrations LOCALLY instead. git and Lakebase schema are in sync${r.detail ? ` (${r.detail})` : ""}.`
-      );
-      return true;
-    };
-    if (matched) {
-      const runUrl = workflowRunUrl(ownerRepo, matched);
-      const conclusion = (matched.conclusion ?? "").toLowerCase();
-      migrate = {
-        waited: true,
-        runUrl,
-        conclusion,
-        polls,
-        authVerified
-      };
-      if (conclusion === "success") {
-        next = {
-          ...next,
-          migrate_run_url: runUrl,
-          migrate_completed_at: nowFn().toISOString()
-        };
-        writeWorkflowState(args.projectDir, next);
-      } else {
-        const applied = await applyLocalFallback(`the downstream migrate finished conclusion=${conclusion} (${runUrl})`);
-        if (!applied) {
-          throw new ScmMergeError(
-            `Downstream migrate workflow finished with conclusion=${conclusion}. Run ${runUrl} for details.`,
-            "migrate-failed"
-          );
-        }
-      }
-    } else {
-      const budgetSec = Math.round(
-        (args.migrateTimeoutMs ?? DEFAULT_MIGRATE_TIMEOUT_MS) / 1e3
-      );
-      const lastStatus = lastSeen?.status ?? "(no matching run)";
-      const timeoutFatal = args.migrateTimeoutFatal !== false;
-      if (timeoutFatal) {
-        migrate = { waited: true, polls, authVerified };
-        const applied = await applyLocalFallback(
-          `the downstream migrate did not complete within ${budgetSec}s (last seen: ${lastStatus})`
-        );
-        if (!applied) {
-          throw new ScmMergeError(
-            `Timed out after ${budgetSec}s waiting for the downstream migrate workflow on "${gitBase}". Last seen status: ${lastStatus}.`,
-            "migrate-timeout"
-          );
-        }
-      } else {
-        migrate = { waited: true, polls, timedOut: true, authVerified };
-        warnings.push(
-          `Downstream migrate workflow on "${gitBase}" was not confirmed within ${budgetSec}s (last seen status: ${lastStatus}). The PR merged and your local ${gitBase} is synced; the migrate run may still be pending or running. Confirm it later via the Actions tab or re-run with --wait-migrate.`
-        );
-      }
-    }
-  } else {
-    migrate = { waited: false, polls: 0 };
-  }
-  return {
-    state: next,
-    paired,
-    localBranchDeleted,
-    headAfter,
-    migrate,
-    warnings
-  };
-}
-function workflowRunUrl(ownerRepo, run) {
-  return `https://github.com/${ownerRepo}/actions/runs/${run.id}`;
-}
-function extractPullNumber(prUrl) {
-  const m = prUrl.match(/\/pull\/(\d+)(?:[\/?#].*)?$/);
-  if (!m) return void 0;
-  const n = Number.parseInt(m[1], 10);
-  return Number.isFinite(n) ? n : void 0;
 }
-function shellEscape2(s) {
-  return `'${s.replace(/'/g, "'\\''")}'`;
+function applyPlaceholders(content, version) {
+  return content.replace(/\{\{LAKEBASE_SCM_UTILS_VERSION\}\}/g, version);
 }
-
-// scripts/lakebase/scm-recover-orphans.ts
-init_esm_shims();
-
-// scripts/git/branches.ts
-init_esm_shims();
-async function currentBranchName(cwd) {
-  try {
-    return await exec2("git rev-parse --abbrev-ref HEAD", { cwd });
-  } catch {
-    return "";
-  }
+function applyCommandPlaceholders(content, version) {
+  return content.replace(/\$\{KIT_VERSION_AT_SCAFFOLD\}/g, version);
 }
-async function listLocalBranches(args) {
-  const { cwd } = args;
-  let raw;
-  try {
-    raw = await exec2(
-      'git branch --format="%(refname:short)|%(upstream:short)|%(upstream:track)"',
-      { cwd }
+var COMMAND_HOOK_FILE_PATTERN = /\.(pre|post)-hook\.md$/;
+function findKitCommandsDir(start) {
+  let dir = start;
+  for (let i = 0; i < 6; i++) {
+    const candidate = path29.join(
+      dir,
+      "templates",
+      "project",
+      "common",
+      ".claude",
+      "commands"
     );
-  } catch {
-    return [];
-  }
-  if (!raw) return [];
-  const current = await currentBranchName(cwd);
-  return raw.split("\n").filter(Boolean).map((line) => {
-    const [name, tracking, trackInfo] = line.split("|");
-    let ahead = 0;
-    let behind = 0;
-    if (trackInfo) {
-      const aheadMatch = trackInfo.match(/ahead (\d+)/);
-      const behindMatch = trackInfo.match(/behind (\d+)/);
-      if (aheadMatch) ahead = parseInt(aheadMatch[1], 10);
-      if (behindMatch) behind = parseInt(behindMatch[1], 10);
-    }
-    return {
-      name,
-      isCurrent: name === current,
-      isRemote: false,
-      tracking: tracking || void 0,
-      ahead,
-      behind
-    };
-  });
-}
-async function listRemoteBranches(args) {
-  const { cwd, remote = "origin" } = args;
-  try {
-    const localBranches = await listLocalBranches({ cwd });
-    const localNames = new Set(localBranches.map((b) => b.name));
-    const raw = await exec2(`git branch -r --format="%(refname:short)"`, {
-      cwd
-    });
-    if (!raw) return [];
-    const remotePrefix = `${remote}/`;
-    return raw.split("\n").filter(Boolean).filter((name) => !name.includes("HEAD")).map((name) => {
-      const shortName = name.startsWith(remotePrefix) ? name.slice(remotePrefix.length) : name;
-      return { fullName: name, shortName };
-    }).filter(({ shortName }) => !localNames.has(shortName)).map(({ fullName, shortName }) => ({
-      name: shortName,
-      isCurrent: false,
-      isRemote: true,
-      tracking: fullName
-    }));
-  } catch {
-    return [];
+    if (fs29.existsSync(candidate)) return candidate;
+    const parent = path29.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
   }
+  throw new Error(
+    `Could not locate templates/project/common/.claude/commands/ relative to ${start}. Pass explicit kitDir.`
+  );
 }
-async function hasRemoteBranch(args) {
-  const { cwd, branch, remote = "origin" } = args;
-  try {
-    const out = await exec2(
-      `git ls-remote --heads "${remote}" "${branch}"`,
-      { cwd }
-    );
-    return out.trim().length > 0;
-  } catch {
-    return false;
-  }
+function parsePinnedVersion(content) {
+  const m = content.match(/^\s*[*_>`\s]*pinned\s+to\s*:\s*[`*_]*([^\s`*_]+)[`*_]*\s*$/im);
+  return m ? m[1] : void 0;
 }
-
-// scripts/lakebase/scm-recover-orphans.ts
-var ScmRecoverError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "ScmRecoverError";
-  }
-  code;
-};
-var TIER_LEAFS = /* @__PURE__ */ new Set(["staging", "dev", "main", "master"]);
-async function recoverOrphans(args) {
-  if (!args.instance) {
-    throw new ScmRecoverError(
-      "Lakebase project id required (--instance / LAKEBASE_PROJECT_ID).",
-      "missing-instance"
-    );
-  }
-  const lakebaseBranches = await listBranches({ instance: args.instance });
-  const tierTopology = inferTierTopology(lakebaseBranches);
-  const lakebaseLeafs = new Set(
-    lakebaseBranches.map((b) => leafName2(b))
-  );
-  const defaultLeaf = leafName2(
-    lakebaseBranches.find((b) => b.isDefault === true)
-  );
-  const gitBranches = await listLocalBranches({ cwd: args.projectDir });
-  const orphans = [];
-  const skipped = [];
-  for (const gb of gitBranches) {
-    if (gb.isRemote) continue;
-    const name = gb.name;
-    if (TIER_LEAFS.has(name)) {
-      skipped.push({ gitBranch: name, reason: "tier branch" });
-      continue;
-    }
-    if (defaultLeaf && name === defaultLeaf) {
-      skipped.push({ gitBranch: name, reason: "default branch" });
-      continue;
-    }
-    const sanitized = sanitizeBranchName(name);
-    if (lakebaseLeafs.has(sanitized)) {
-      skipped.push({
-        gitBranch: name,
-        reason: `paired Lakebase branch "${sanitized}" exists`
-      });
+function detectCommandDrift(args) {
+  const projectCommandsDir = path29.join(args.projectDir, ".claude", "commands");
+  const here = path29.dirname(new URL(import.meta.url).pathname);
+  const kitCommandsDir = args.kitDir ? path29.join(args.kitDir, "templates", "project", "common", ".claude", "commands") : findKitCommandsDir(here);
+  const kitVersion = readKitVersionFromCommandsDir(kitCommandsDir);
+  const templateFiles = fs29.existsSync(kitCommandsDir) ? fs29.readdirSync(kitCommandsDir).filter((f) => f.endsWith(".md") && !COMMAND_HOOK_FILE_PATTERN.test(f)) : [];
+  const projectFiles = fs29.existsSync(projectCommandsDir) ? fs29.readdirSync(projectCommandsDir).filter((f) => f.endsWith(".md") && !COMMAND_HOOK_FILE_PATTERN.test(f)) : [];
+  const seen = /* @__PURE__ */ new Set();
+  const files = [];
+  for (const name of templateFiles) {
+    seen.add(name);
+    const projectPath2 = path29.join(projectCommandsDir, name);
+    const templatePath = path29.join(kitCommandsDir, name);
+    const templateRaw = fs29.readFileSync(templatePath, "utf8");
+    if (!fs29.existsSync(projectPath2)) {
+      files.push({ name, status: "missing", kit_version: kitVersion });
       continue;
     }
-    orphans.push({
-      gitBranch: name,
-      sanitized,
-      isCurrent: gb.isCurrent === true,
-      reason: name.startsWith("feature/") ? "feature/<slug> branch with no Lakebase pair" : `non-tier git branch "${name}" with no Lakebase pair`
-    });
-  }
-  const result = {
-    tierTopology,
-    orphans,
-    skipped,
-    claimed: []
-  };
-  if (!args.claim || orphans.length === 0) {
-    return result;
-  }
-  const parentBranch = parentForTopology(tierTopology, defaultLeaf);
-  const currentState = readWorkflowState(args.projectDir);
-  const candidates = args.onlyBranch ? orphans.filter((o) => o.gitBranch === args.onlyBranch) : orphans;
-  if (args.onlyBranch && candidates.length === 0) {
-    throw new ScmRecoverError(
-      `No orphan found for --only-branch ${args.onlyBranch}.`,
-      "claim-conflict"
-    );
-  }
-  const headOrphan = candidates.find((o) => o.isCurrent);
-  const stateTargetOrphan = headOrphan ?? candidates[0];
-  for (const orphan of candidates) {
-    try {
-      const paired = await createFeaturePairedBranch({
-        instance: args.instance,
-        branch: orphan.gitBranch,
-        parentBranch,
-        cwd: args.projectDir
-        // The git branch already exists on disk; the substrate primitive
-        // is idempotent on the git side (it'll checkout the existing
-        // branch rather than fail) but if the project is not on this
-        // branch, we want a no-op git side. Leaving the default true is
-        // OK: if the git branch already matches, the checkout is a
-        // no-op; if the branch isn't HEAD, the substrate switches to it
-        // which is what the user implicitly asked for by including the
-        // branch.
-      });
-      let stateUpdated = false;
-      if (orphan === stateTargetOrphan) {
-        const next = {
-          ...currentState ?? {
-            $schema: "./scm-workflow-state.schema.json",
-            version: 1,
-            state: "scaffold-complete",
-            tier_topology: tierTopology,
-            project_id: args.instance
-          },
-          state: "feature-claimed",
-          feature_id: orphan.gitBranch.replace(/^feature\//, ""),
-          branch: paired.gitBranch,
-          parent_branch: parentBranch,
-          lakebase_branch_uid: paired.branch.uid,
-          claimed_at: (args.now ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
-          pr_url: void 0,
-          pushed_at: void 0,
-          ci_run_url: void 0,
-          ci_green_at: void 0,
-          merged_at: void 0
-        };
-        writeWorkflowState(args.projectDir, next);
-        stateUpdated = true;
-        result.stateUpdatedFor = orphan.gitBranch;
-      }
-      result.claimed.push({
-        candidate: orphan,
-        lakebaseBranchUid: paired.branch.uid,
-        stateUpdated,
-        warnings: paired.warnings
+    const projectContent = fs29.readFileSync(projectPath2, "utf8");
+    const pinned = parsePinnedVersion(projectContent);
+    const versionForCompare = pinned ?? kitVersion;
+    const templateContent = applyCommandPlaceholders(templateRaw, versionForCompare);
+    if (projectContent === templateContent) {
+      files.push({
+        name,
+        status: "unchanged",
+        pinned_version: pinned,
+        kit_version: kitVersion
+      });
+    } else {
+      files.push({
+        name,
+        status: "drifted",
+        pinned_version: pinned,
+        kit_version: kitVersion,
+        diff: unifiedDiff(name, projectContent, templateContent)
       });
-    } catch (err) {
-      throw new ScmRecoverError(
-        `Substrate claim failed for ${orphan.gitBranch}: ${err instanceof Error ? err.message : String(err)}`,
-        "substrate-failure"
-      );
     }
   }
-  return result;
-}
-function leafName2(b) {
-  if (!b) return "";
-  return b.name.split("/").pop() ?? b.name;
-}
-function parentForTopology(t, defaultLeaf) {
-  if (t === 3) return "dev";
-  if (t === 2) return "staging";
-  return defaultLeaf || "main";
-}
-
-// scripts/lakebase/scm-doctor.ts
-init_esm_shims();
-import * as fs29 from "fs";
-import * as path29 from "path";
-var FEATURE_PREFIX = "feature/";
-var TIER_LEAFS2 = DEFAULT_PROTECTED_TIER_NAMES;
-function readEnv(projectDir) {
-  const envPath = path29.join(projectDir, ".env");
-  const out = /* @__PURE__ */ new Map();
-  if (!fs29.existsSync(envPath)) return out;
-  const lines = fs29.readFileSync(envPath, "utf8").split("\n");
-  for (const line of lines) {
-    const m = line.match(/^\s*([A-Z0-9_]+)\s*=\s*(.+?)\s*$/);
-    if (m) out.set(m[1], m[2].replace(/^["']|["']$/g, ""));
+  for (const name of projectFiles) {
+    if (seen.has(name)) continue;
+    files.push({ name, status: "extra", kit_version: kitVersion });
   }
-  return out;
+  const order = {
+    drifted: 0,
+    missing: 1,
+    extra: 2,
+    unchanged: 3
+  };
+  files.sort((a, b) => order[a.status] - order[b.status] || a.name.localeCompare(b.name));
+  const hasDrift = files.some((f) => f.status === "drifted" || f.status === "missing");
+  return { overall: hasDrift ? "drift" : "ok", files };
 }
-function leafOf2(b) {
-  return b.name.split("/").pop() ?? b.name;
+function readKitVersionFromCommandsDir(kitCommandsDir) {
+  let dir = kitCommandsDir;
+  for (let i = 0; i < 5; i++) {
+    dir = path29.dirname(dir);
+  }
+  try {
+    const raw = fs29.readFileSync(path29.join(dir, "package.json"), "utf-8");
+    const pkg = JSON.parse(raw);
+    return typeof pkg.version === "string" ? pkg.version : "unknown";
+  } catch {
+    return "unknown";
+  }
 }
-function worstOf(a, b) {
-  const order = ["ok", "warn", "fail"];
-  return order[Math.max(order.indexOf(a), order.indexOf(b))];
+function detectScaffoldedDrift(args) {
+  const workflows = detectWorkflowDrift(args);
+  const commands = detectCommandDrift(args);
+  return {
+    overall: workflows.overall === "drift" || commands.overall === "drift" ? "drift" : "ok",
+    workflows,
+    commands
+  };
 }
-async function runDoctor(args, deps = {}) {
-  const projectDir = args.projectDir;
-  const findings = [];
-  const env = readEnv(projectDir);
-  const instance = args.instance ?? env.get("LAKEBASE_PROJECT_ID");
-  const state = readWorkflowState(projectDir);
-  const workflowStatePresent = state !== null;
-  for (const stale of deps.findStaleBranches?.() ?? []) {
-    const where = stale.feature_id ? ` ${stale.feature_id}/${stale.story_id}` : "";
-    findings.push({
-      id: `stale-${stale.kind}`,
-      severity: "warn",
-      message: `Stale ${stale.kind}${where} "${stale.slug}"${stale.branch ? ` (branch ${stale.branch})` : ""}: ${stale.reason}.`,
-      suggestion: stale.kind === "experiment" ? `consort-experiment discard --feature ${stale.feature_id} --story ${stale.story_id} --slug ${stale.slug} --instance <id> --approver <you> --reason "doctor: stale experiment"` : "consort-spike teardown (or delete the spike's paired branch) once its learning has carried forward"
-    });
-  }
-  if (!workflowStatePresent) {
-    findings.push({
-      id: "no-state-file",
-      severity: "fail",
-      message: "No .lakebase/workflow-state.json. Either the project pre-dates the SCM workflow or scaffold did not seed it.",
-      suggestion: "lakebase-scm-adopt-state"
-    });
+function updateWorkflows(args) {
+  const projectWorkflowsDir = path29.join(
+    args.projectDir,
+    ".github",
+    "workflows"
+  );
+  const here = path29.dirname(new URL(import.meta.url).pathname);
+  const kitWorkflowsDir = args.kitDir ? path29.join(
+    args.kitDir,
+    "templates",
+    "project",
+    "common",
+    ".github",
+    "workflows"
+  ) : findKitTemplatesDir(here);
+  const substitute = args.substitute !== false;
+  const dryRun = args.dryRun === true;
+  const pruneExtras = args.pruneExtras === true;
+  const templateFiles = fs29.existsSync(kitWorkflowsDir) ? fs29.readdirSync(kitWorkflowsDir).filter((f) => f.endsWith(".yml")) : [];
+  const projectFiles = fs29.existsSync(projectWorkflowsDir) ? fs29.readdirSync(projectWorkflowsDir).filter((f) => f.endsWith(".yml")) : [];
+  if (!dryRun && templateFiles.length > 0 && !fs29.existsSync(projectWorkflowsDir)) {
+    fs29.mkdirSync(projectWorkflowsDir, { recursive: true });
   }
-  try {
-    const ownerRepo = await getOwnerRepo(projectDir);
-    if (ownerRepo) {
-      const enabled = await getActionsEnabled(ownerRepo);
-      if (enabled === false) {
-        findings.push({
-          id: "github-actions-disabled",
-          severity: "warn",
-          message: `GitHub Actions is disabled for ${ownerRepo}, so the kit's CI workflows (pr.yml / merge.yml) will never run , the PR branch's migrations, tests, and schema-diff comment are all skipped. This is commonly an org-level policy on EMU repos, which a repo admin cannot override.`,
-          suggestion: "Have an org owner enable Actions for this repo (repo Settings -> Actions -> General; if it says 'disabled by the organization', it must be enabled in the org's Actions policy). Until then, run the workflow steps locally: scripts/run-tests.sh against a Lakebase branch."
-        });
-      }
+  const version = substitute ? readKitVersion(kitWorkflowsDir) : "";
+  const seen = /* @__PURE__ */ new Set();
+  const files = [];
+  for (const name of templateFiles) {
+    seen.add(name);
+    const projectPath2 = path29.join(projectWorkflowsDir, name);
+    const templatePath = path29.join(kitWorkflowsDir, name);
+    const templateRaw = fs29.readFileSync(templatePath, "utf-8");
+    const desired = substitute ? applyPlaceholders(templateRaw, version) : templateRaw;
+    const existed = fs29.existsSync(projectPath2);
+    const current = existed ? fs29.readFileSync(projectPath2, "utf-8") : "";
+    let outcome;
+    if (!existed) {
+      outcome = "added";
+    } else if (current === desired) {
+      outcome = "unchanged";
+    } else {
+      outcome = "updated";
     }
-  } catch {
+    if (!dryRun && outcome !== "unchanged") {
+      fs29.writeFileSync(projectPath2, desired);
+    }
+    files.push({ name, outcome });
   }
-  for (const wf of ["pr.yml", "merge.yml"]) {
-    try {
-      const p = path29.join(projectDir, ".github", "workflows", wf);
-      if (!fs29.existsSync(p)) continue;
-      const body = fs29.readFileSync(p, "utf8");
-      if (/lakebase-scm-utils#v\d/.test(body)) {
-        findings.push({
-          id: "ci-workflow-substrate-pin",
-          severity: "warn",
-          message: `.github/workflows/${wf} hardcodes a substrate version pin (github:databricks-solutions/lakebase-scm-utils#v<ver>) instead of resolving .lakebase/scm-utils-ref at runtime, so bumping .lakebase/scm-utils-ref does NOT change the substrate CI actually runs.`,
-          suggestion: "Re-emit the workflows from the current substrate templates so they resolve SCM_UTILS_REF from .lakebase/scm-utils-ref at CI time (updateWorkflows in scripts/lakebase/workflow-drift.ts; lakebase-doctor reports this as workflow-drift). Until then a scm-utils-ref bump will not reach CI."
-        });
+  if (pruneExtras) {
+    for (const name of projectFiles) {
+      if (seen.has(name)) continue;
+      const projectPath2 = path29.join(projectWorkflowsDir, name);
+      if (!dryRun) {
+        fs29.unlinkSync(projectPath2);
       }
-    } catch {
+      files.push({ name, outcome: "removed" });
     }
   }
+  const order = {
+    added: 0,
+    updated: 1,
+    removed: 2,
+    unchanged: 3
+  };
+  files.sort((a, b) => order[a.outcome] - order[b.outcome] || a.name.localeCompare(b.name));
+  const changed = files.some((f) => f.outcome !== "unchanged");
+  return { files, changed };
+}
+
+// scripts/lakebase/scm-merge.ts
+async function reconcileTierToOrigin(args) {
+  const { cwd, tier } = args;
   try {
-    if (isGitTracked(projectDir, ".lakebase/workflow-state.json")) {
-      findings.push({
-        id: "scm-state-git-tracked",
-        severity: "warn",
-        message: ".lakebase/workflow-state.json (the per-working-tree SCM claim state) is git-tracked, so a branch checkout or `git reset --hard origin/<tier>` can restore a stale committed claim over the live one (the foreign-claim guard then refuses to drive until you abandon + reclaim).",
-        suggestion: "If a wrong-feature-claim refusal follows a checkout, run lakebase-scm-adopt-state (or abandon + reclaim) to re-establish the live claim. The kit-ref run pin (.lakebase/kit-ref.local) already protects the kit version from the same checkout revert."
-      });
+    const head = await getCurrentBranch({ cwd });
+    if (head === tier) {
+      await exec2(`git pull --ff-only`, { cwd, timeout: 3e4 });
+    } else {
+      await exec2(`git fetch origin ${shellEscape2(`${tier}:${tier}`)}`, { cwd, timeout: 3e4 });
     }
-  } catch {
+    return null;
+  } catch (err) {
+    return `local reconcile of ${tier} to origin/${tier} failed: ${err instanceof Error ? err.message : String(err)}. Reconcile it by hand (git checkout ${tier} && git pull --ff-only).`;
   }
-  if (!env.has("LAKEBASE_PROJECT_ID")) {
-    findings.push({
-      id: "env-missing-project-id",
-      severity: "fail",
-      message: ".env does not contain LAKEBASE_PROJECT_ID. The post-checkout hook will exit early; workflow CLIs will need an explicit --instance.",
-      suggestion: "Set LAKEBASE_PROJECT_ID=<your project id> in .env"
-    });
+}
+var ScmMergeError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "ScmMergeError";
+  }
+  code;
+};
+var DEFAULT_MIGRATE_TIMEOUT_MS = 30 * 60 * 1e3;
+var DEFAULT_MIGRATE_POLL_MS = 30 * 1e3;
+function defaultMigratePredicate(run, mergedAt) {
+  if (!run.createdAt) return false;
+  const created = Date.parse(run.createdAt);
+  if (!Number.isFinite(created)) return false;
+  if (run.event && run.event !== "push") return false;
+  return created >= mergedAt.getTime() - 5e3;
+}
+function shaMigratePredicate(mergeCommitSha) {
+  return (run) => {
+    if (run.event && run.event !== "push") return false;
+    return !!run.headSha && run.headSha === mergeCommitSha;
+  };
+}
+async function defaultRefreshPromoteWorkflows(projectDir) {
+  const drift = detectWorkflowDrift({ projectDir });
+  const touched = drift.files.filter((f) => f.status === "drifted").map((f) => f.name);
+  if (touched.length === 0) return { refreshed: false };
+  const result = updateWorkflows({ projectDir });
+  if (!result.changed) return { refreshed: false };
+  await exec2(`git add ${shellEscape2(".github/workflows")}`, { cwd: projectDir, timeout: 1e4 });
+  const staged = await exec2("git diff --cached --name-only -- .github/workflows", {
+    cwd: projectDir,
+    timeout: 1e4
+  });
+  if (!staged.trim()) return { refreshed: false };
+  await exec2(
+    `git commit -m ${shellEscape2(
+      "chore(ci): refresh scaffolded workflows to pinned substrate (promote uses apply-tier)"
+    )} -- .github/workflows`,
+    { cwd: projectDir, timeout: 15e3 }
+  );
+  await pushCurrentBranchForPr({ cwd: projectDir });
+  return { refreshed: true, detail: `refreshed + pushed ${touched.join(", ") || "workflow(s)"} onto the PR head` };
+}
+async function mergeFeature(args) {
+  const current = readWorkflowState(args.projectDir);
+  if (!current) {
+    throw new ScmMergeError(
+      "No SCM workflow state. wait-ci first.",
+      "no-state-file"
+    );
+  }
+  if (current.state !== "ci-green") {
+    throw new ScmMergeError(
+      `merge refuses state "${current.state}". Allowed predecessor: ci-green.`,
+      "bad-precondition"
+    );
+  }
+  if (!current.pr_url) {
+    throw new ScmMergeError(
+      "ci-green row is missing pr_url; cannot resolve the PR to merge.",
+      "no-pr-url"
+    );
+  }
+  if (!current.branch || !current.parent_branch) {
+    throw new ScmMergeError(
+      "ci-green row missing branch / parent_branch; refusing to merge.",
+      "bad-precondition"
+    );
+  }
+  const ownerRepo = await getOwnerRepo(args.projectDir);
+  if (!ownerRepo) {
+    throw new ScmMergeError(
+      "No GitHub remote found at origin.",
+      "no-github-remote"
+    );
+  }
+  const pullNumber = extractPullNumber(current.pr_url);
+  if (!pullNumber) {
+    throw new ScmMergeError(
+      `Could not extract PR number from URL: ${current.pr_url}`,
+      "bad-pr-url"
+    );
+  }
+  const instance = args.instance ?? current.project_id;
+  const gitBase = await resolveGitBase(current.parent_branch, args.projectDir);
+  const wantMigrate = args.waitMigrate !== false;
+  let authVerified = false;
+  if (wantMigrate && args.verifyMigrateAuth) {
+    const probe = await args.verifyMigrateAuth();
+    if (!probe.ok) {
+      throw new ScmMergeError(
+        `Migrate-auth precondition failed: ${probe.detail ?? "the Databricks credential is not usable"}. Refusing to merge: the downstream migrate would promote git without applying the schema. Refresh your credential (databricks auth login), then re-run.`,
+        "migrate-auth"
+      );
+    }
+    authVerified = true;
   }
-  if (!instance) {
-    return finalize({
-      projectDir,
-      workflowStatePresent,
-      state: state ?? void 0,
-      findings
-    });
+  const preflightNotes = [];
+  {
+    const refresh = args.refreshWorkflows ?? (() => defaultRefreshPromoteWorkflows(args.projectDir));
+    try {
+      const r = await refresh();
+      if (r.refreshed) {
+        preflightNotes.push(`Refreshed stale CI workflows before merge${r.detail ? ` (${r.detail})` : ""}.`);
+      }
+    } catch (err) {
+      preflightNotes.push(
+        `Workflow self-heal skipped (${err instanceof Error ? err.message : String(err)}); if the promote's migrate-target fails on the tier guard, refresh .github/workflows (merge.yml must call 'lakebase-schema-migrate apply-tier').`
+      );
+    }
   }
-  let lakebaseBranches = [];
+  let paired;
   try {
-    lakebaseBranches = await listBranches({ instance });
-  } catch (err) {
-    findings.push({
-      id: "lakebase-unreachable",
-      severity: "fail",
-      message: `Could not list Lakebase branches for instance ${instance}: ${err instanceof Error ? err.message : String(err)}`,
-      suggestion: "databricks auth login (or check DATABRICKS_CONFIG_PROFILE)."
-    });
-    return finalize({
-      projectDir,
-      workflowStatePresent,
-      state: state ?? void 0,
-      findings
-    });
-  }
-  const inferredTopology = inferTierTopology(lakebaseBranches);
-  if (state && state.tier_topology !== inferredTopology) {
-    findings.push({
-      id: "tier-topology-mismatch",
-      severity: "warn",
-      message: `workflow-state records tier_topology=${state.tier_topology}, but the Lakebase tier inventory suggests ${inferredTopology}.`,
-      suggestion: "lakebase-scm-adopt-state --force"
+    paired = await mergePairedPullRequest({
+      ownerRepo,
+      pullNumber,
+      lakebaseInstance: instance,
+      method: args.method ?? "squash"
     });
+  } catch (err) {
+    throw new ScmMergeError(
+      `mergePairedPullRequest failed: ${err instanceof Error ? err.message : String(err)}`,
+      "merge-failed"
+    );
   }
-  const headBranch = await getCurrentBranch({ cwd: projectDir });
-  if (state && state.state === "feature-claimed") {
-    if (state.branch && headBranch && headBranch !== state.branch) {
-      findings.push({
-        id: "head-branch-drift",
-        severity: "warn",
-        message: `workflow says feature-claimed for "${state.branch}", but HEAD is on "${headBranch}".`,
-        suggestion: `git checkout '${state.branch}'`
-      });
-    }
-    if (state.branch) {
-      const sanitized = sanitizeBranchName(state.branch);
-      let pair;
+  const warnings = [...preflightNotes, ...paired.warnings];
+  let localBranchDeleted = false;
+  let headAfter = current.branch;
+  if (!args.skipLocalCleanup) {
+    const switchTo = args.switchTo ?? gitBase;
+    const head = await getCurrentBranch({ cwd: args.projectDir });
+    if (head === current.branch) {
       try {
-        pair = await getBranchByName(sanitized, { instance });
-      } catch {
-        pair = void 0;
-      }
-      if (!pair) {
-        findings.push({
-          id: "lakebase-pair-missing",
-          severity: "fail",
-          message: `workflow says feature-claimed for "${state.branch}", but no Lakebase branch "${sanitized}" exists.`,
-          suggestion: `lakebase-scm-abandon-feature  # reset state; re-claim if needed`
-        });
-      } else if (state.lakebase_branch_uid && pair.uid !== state.lakebase_branch_uid) {
-        findings.push({
-          id: "lakebase-uid-drift",
-          severity: "warn",
-          message: `workflow records lakebase_branch_uid=${state.lakebase_branch_uid}, but the live branch reports ${pair.uid}.`,
-          suggestion: "lakebase-scm-adopt-state --force"
+        await exec2(`git checkout ${shellEscape2(switchTo)}`, {
+          cwd: args.projectDir,
+          timeout: 1e4
         });
+        headAfter = switchTo;
+        try {
+          await exec2(`git fetch origin ${shellEscape2(switchTo)}`, {
+            cwd: args.projectDir,
+            timeout: 3e4
+          });
+          await exec2(`git merge --ff-only ${shellEscape2(`origin/${switchTo}`)}`, {
+            cwd: args.projectDir,
+            timeout: 1e4
+          });
+        } catch (err) {
+          warnings.push(
+            `local fast-forward of ${switchTo} to origin/${switchTo} failed: ${err instanceof Error ? err.message : String(err)}. The PR merged remotely; your local ${switchTo} may be stale, run \`git pull --ff-only\`.`
+          );
+        }
+      } catch (err) {
+        warnings.push(
+          `git checkout ${switchTo} failed: ${err instanceof Error ? err.message : String(err)}. Local branch was NOT deleted.`
+        );
       }
+    } else {
+      headAfter = head || current.branch;
+      const reconcileWarning = await reconcileTierToOrigin({ cwd: args.projectDir, tier: switchTo });
+      if (reconcileWarning) warnings.push(reconcileWarning);
     }
-  }
-  if (state && state.state === "feature-claimed" && state.branch) {
-    const envBranchId = env.get("LAKEBASE_BRANCH_ID");
-    const sanitized = sanitizeBranchName(state.branch);
-    if (envBranchId && envBranchId !== sanitized) {
-      findings.push({
-        id: "env-branch-drift",
-        severity: "warn",
-        message: `.env LAKEBASE_BRANCH_ID=${envBranchId} but workflow says ${sanitized}. The post-checkout hook may not have run since the last branch switch.`,
-        suggestion: `git checkout '${state.branch}'  # re-fires post-checkout`
-      });
-    }
-  }
-  if (headBranch && !TIER_LEAFS2.has(headBranch) && headBranch.startsWith(FEATURE_PREFIX)) {
-    const sanitized = sanitizeBranchName(headBranch);
-    const paired = lakebaseBranches.some((b) => leafOf2(b) === sanitized);
-    if (!paired) {
-      findings.push({
-        id: "orphan-current-branch",
-        severity: "fail",
-        message: `Current git branch "${headBranch}" has no Lakebase pair (post-checkout fallback retired in phase C).`,
-        suggestion: `lakebase-scm-recover-orphans --claim --only-branch '${headBranch}'`
-      });
+    if (headAfter !== current.branch) {
+      try {
+        await exec2(
+          `git branch -D ${shellEscape2(current.branch)}`,
+          { cwd: args.projectDir, timeout: 1e4 }
+        );
+        localBranchDeleted = true;
+      } catch (err) {
+        warnings.push(
+          `git branch -D ${current.branch} failed: ${err instanceof Error ? err.message : String(err)}.`
+        );
+      }
     }
   }
-  try {
-    const heads = await collapseMigrationHeads({ projectDir, dryRun: true });
-    if (heads.headsBefore.length > 1) {
-      findings.push({
-        id: "multiple-migration-heads",
-        severity: "fail",
-        message: `Migrations have ${heads.headsBefore.length} heads (${heads.headsBefore.join(", ")}); a sibling-feature merge left them un-collapsed. \`upgrade head\` will refuse until they are unified.`,
-        suggestion: "lakebase-collapse-heads"
+  const nowFn = args.now ?? (() => /* @__PURE__ */ new Date());
+  const mergedAt = nowFn();
+  let next = {
+    ...current,
+    state: "merged",
+    merged_at: mergedAt.toISOString()
+  };
+  writeWorkflowState(args.projectDir, next);
+  let migrate;
+  const waitMigrate = args.waitMigrate !== false;
+  if (waitMigrate) {
+    const timeoutMs = args.migrateTimeoutMs ?? DEFAULT_MIGRATE_TIMEOUT_MS;
+    const pollMs = args.migratePollMs ?? DEFAULT_MIGRATE_POLL_MS;
+    const fetchRuns = args.fetchRuns ?? listWorkflowRuns;
+    const predicate = args.migrateRunPredicate ?? (paired.mergeCommitSha ? shaMigratePredicate(paired.mergeCommitSha) : defaultMigratePredicate);
+    const elapsedSinceMerge = nowFn().getTime() - mergedAt.getTime();
+    const remainingTimeoutMs = Math.max(0, timeoutMs - elapsedSinceMerge);
+    let polls = 0;
+    let matched;
+    let lastSeen;
+    try {
+      const result = await pollUntil({
+        timeoutMs: remainingTimeoutMs,
+        intervalMs: pollMs,
+        now: nowFn,
+        sleep: args.sleep,
+        probe: async () => {
+          const runs = await fetchRuns(ownerRepo, 20);
+          const candidates = runs.filter((r) => r.branch === gitBase).filter((r) => predicate(r, mergedAt));
+          if (candidates.length === 0) {
+            return { done: false };
+          }
+          candidates.sort(
+            (a, b) => Date.parse(b.createdAt ?? "0") - Date.parse(a.createdAt ?? "0")
+          );
+          lastSeen = candidates[0];
+          const status = (lastSeen.status ?? "").toLowerCase();
+          return status === "completed" ? { done: true, value: lastSeen } : { done: false };
+        }
       });
+      polls = result.polls;
+      if (result.outcome === "done") {
+        matched = result.value;
+      }
+    } catch (err) {
+      warnings.push(
+        `Downstream migrate poll errored: ${err instanceof Error ? err.message : String(err)}. Treating as advisory.`
+      );
     }
-  } catch {
-  }
-  if (instance && state?.branch) {
-    try {
-      const localIds = listSchemaMigrations({ projectDir }).map((m) => m.version);
-      let orphanRev = null;
-      try {
-        const status = await schemaMigrationStatus({ instance, branch: state.branch, projectDir });
-        if (dbRevisionOrphaned(status.current, localIds)) orphanRev = status.current ?? null;
-      } catch (e) {
-        orphanRev = parseAlembicMissingRevision(e instanceof Error ? e.message : String(e));
+    const applyLocalFallback = async (reason) => {
+      if (!args.localMigrateFallback) return false;
+      const r = await args.localMigrateFallback();
+      if (!r.ok) {
+        warnings.push(
+          `Local-migrate fallback FAILED after ${reason}: ${r.detail ?? "unknown error"}. git promoted but the parent schema is NOT applied (partial promotion); apply it manually.`
+        );
+        return false;
+      }
+      next = { ...next, migrate_completed_at: nowFn().toISOString() };
+      writeWorkflowState(args.projectDir, next);
+      migrate = { ...migrate ?? { waited: true, polls }, appliedLocally: true, authVerified };
+      warnings.push(
+        `Downstream migrate did not confirm (${reason}); applied the parent migrations LOCALLY instead. git and Lakebase schema are in sync${r.detail ? ` (${r.detail})` : ""}.`
+      );
+      return true;
+    };
+    if (matched) {
+      const runUrl = workflowRunUrl(ownerRepo, matched);
+      const conclusion = (matched.conclusion ?? "").toLowerCase();
+      migrate = {
+        waited: true,
+        runUrl,
+        conclusion,
+        polls,
+        authVerified
+      };
+      if (conclusion === "success") {
+        next = {
+          ...next,
+          migrate_run_url: runUrl,
+          migrate_completed_at: nowFn().toISOString()
+        };
+        writeWorkflowState(args.projectDir, next);
+      } else {
+        const applied = await applyLocalFallback(`the downstream migrate finished conclusion=${conclusion} (${runUrl})`);
+        if (!applied) {
+          throw new ScmMergeError(
+            `Downstream migrate workflow finished with conclusion=${conclusion}. Run ${runUrl} for details.`,
+            "migrate-failed"
+          );
+        }
       }
-      if (orphanRev) {
-        findings.push({
-          id: "db-ahead-of-code",
-          severity: "fail",
-          message: `The paired branch DB is AHEAD of code: applied revision '${orphanRev}' has no local migration file. An aborted build likely migrated this branch and a git reset removed the migration file; alembic accept/deploy/promote will fail "Can't locate revision".`,
-          suggestion: "reset the paired branch DB to the code head (downgrade/stamp + drop reset-created tables), or delete the branch and re-cut it clean from its tier"
-        });
+    } else {
+      const budgetSec = Math.round(
+        (args.migrateTimeoutMs ?? DEFAULT_MIGRATE_TIMEOUT_MS) / 1e3
+      );
+      const lastStatus = lastSeen?.status ?? "(no matching run)";
+      const timeoutFatal = args.migrateTimeoutFatal !== false;
+      if (timeoutFatal) {
+        migrate = { waited: true, polls, authVerified };
+        const applied = await applyLocalFallback(
+          `the downstream migrate did not complete within ${budgetSec}s (last seen: ${lastStatus})`
+        );
+        if (!applied) {
+          throw new ScmMergeError(
+            `Timed out after ${budgetSec}s waiting for the downstream migrate workflow on "${gitBase}". Last seen status: ${lastStatus}.`,
+            "migrate-timeout"
+          );
+        }
+      } else {
+        migrate = { waited: true, polls, timedOut: true, authVerified };
+        warnings.push(
+          `Downstream migrate workflow on "${gitBase}" was not confirmed within ${budgetSec}s (last seen status: ${lastStatus}). The PR merged and your local ${gitBase} is synced; the migrate run may still be pending or running. Confirm it later via the Actions tab or re-run with --wait-migrate.`
+        );
       }
-    } catch {
     }
+  } else {
+    migrate = { waited: false, polls: 0 };
   }
-  return finalize({
-    projectDir,
-    workflowStatePresent,
-    state: state ?? void 0,
-    inferredTierTopology: inferredTopology,
-    findings
-  });
+  return {
+    state: next,
+    paired,
+    localBranchDeleted,
+    headAfter,
+    migrate,
+    warnings
+  };
 }
-function finalize(report) {
-  let worst = "ok";
-  for (const f of report.findings) {
-    worst = worstOf(worst, f.severity);
-  }
-  return { ...report, worstSeverity: worst };
+function workflowRunUrl(ownerRepo, run) {
+  return `https://github.com/${ownerRepo}/actions/runs/${run.id}`;
 }
-var ScmDoctorFixError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "ScmDoctorFixError";
+function extractPullNumber(prUrl) {
+  const m = prUrl.match(/\/pull\/(\d+)(?:[\/?#].*)?$/);
+  if (!m) return void 0;
+  const n = Number.parseInt(m[1], 10);
+  return Number.isFinite(n) ? n : void 0;
+}
+function shellEscape2(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+
+// scripts/lakebase/scm-recover-orphans.ts
+init_esm_shims();
+
+// scripts/git/branches.ts
+init_esm_shims();
+async function currentBranchName2(cwd) {
+  try {
+    return await exec2("git rev-parse --abbrev-ref HEAD", { cwd });
+  } catch {
+    return "";
   }
-  code;
-};
-var FIXABLE_FINDING_IDS = [
-  "env-branch-drift",
-  "head-branch-drift",
-  "tier-topology-mismatch",
-  "orphan-current-branch",
-  "multiple-migration-heads",
-  "db-ahead-of-code"
-];
-async function fixFinding(args) {
-  if (!FIXABLE_FINDING_IDS.includes(args.findingId)) {
-    throw new ScmDoctorFixError(
-      `Finding "${args.findingId}" is not supported by --fix. Supported: ${FIXABLE_FINDING_IDS.join(", ")}.`,
-      "unsupported-finding"
+}
+async function listLocalBranches(args) {
+  const { cwd } = args;
+  let raw;
+  try {
+    raw = await exec2(
+      'git branch --format="%(refname:short)|%(upstream:short)|%(upstream:track)"',
+      { cwd }
     );
+  } catch {
+    return [];
   }
-  const report = args.report ?? await runDoctor({ projectDir: args.projectDir, instance: args.instance });
-  const present = report.findings.find((f) => f.id === args.findingId);
-  if (!present) {
-    throw new ScmDoctorFixError(
-      `Finding "${args.findingId}" is not present in the current report. Re-run lakebase-scm-doctor to see what needs fixing.`,
-      "finding-not-present"
-    );
+  if (!raw) return [];
+  const current = await currentBranchName2(cwd);
+  return raw.split("\n").filter(Boolean).map((line) => {
+    const [name, tracking, trackInfo] = line.split("|");
+    let ahead = 0;
+    let behind = 0;
+    if (trackInfo) {
+      const aheadMatch = trackInfo.match(/ahead (\d+)/);
+      const behindMatch = trackInfo.match(/behind (\d+)/);
+      if (aheadMatch) ahead = parseInt(aheadMatch[1], 10);
+      if (behindMatch) behind = parseInt(behindMatch[1], 10);
+    }
+    return {
+      name,
+      isCurrent: name === current,
+      isRemote: false,
+      tracking: tracking || void 0,
+      ahead,
+      behind
+    };
+  });
+}
+async function listRemoteBranches(args) {
+  const { cwd, remote = "origin" } = args;
+  try {
+    const localBranches = await listLocalBranches({ cwd });
+    const localNames = new Set(localBranches.map((b) => b.name));
+    const raw = await exec2(`git branch -r --format="%(refname:short)"`, {
+      cwd
+    });
+    if (!raw) return [];
+    const remotePrefix = `${remote}/`;
+    return raw.split("\n").filter(Boolean).filter((name) => !name.includes("HEAD")).map((name) => {
+      const shortName = name.startsWith(remotePrefix) ? name.slice(remotePrefix.length) : name;
+      return { fullName: name, shortName };
+    }).filter(({ shortName }) => !localNames.has(shortName)).map(({ fullName, shortName }) => ({
+      name: shortName,
+      isCurrent: false,
+      isRemote: true,
+      tracking: fullName
+    }));
+  } catch {
+    return [];
   }
-  let action = "";
+}
+async function hasRemoteBranch(args) {
+  const { cwd, branch, remote = "origin" } = args;
   try {
-    switch (args.findingId) {
-      case "env-branch-drift": {
-        const branch = report.state?.branch;
-        if (!branch) {
-          throw new ScmDoctorFixError(
-            "Cannot fix: workflow state has no branch field.",
-            "fix-failed"
-          );
-        }
-        const sanitized = sanitizeBranchName(branch);
-        const envFile = path29.join(args.projectDir, ".env");
-        updateEnvConnection({
-          envPath: envFile,
-          projectId: readEnvVar(envFile, "LAKEBASE_PROJECT_ID") ?? "",
-          branchId: sanitized,
-          username: readEnvVar(envFile, "DB_USERNAME") ?? "",
-          endpointHost: readEnvVar(envFile, "LAKEBASE_HOST")
-        });
-        action = `rewrote .env LAKEBASE_BRANCH_ID=${sanitized} (metadata only; the app mints its token at runtime)`;
-        break;
-      }
-      case "head-branch-drift": {
-        const branch = report.state?.branch;
-        if (!branch) {
-          throw new ScmDoctorFixError(
-            "Cannot fix: workflow state has no branch field.",
-            "fix-failed"
-          );
-        }
-        await exec2(`git checkout ${shellEscape3(branch)}`, {
-          cwd: args.projectDir,
-          timeout: 15e3
-        });
-        action = `git checkout ${branch} (re-fires post-checkout to resync HEAD)`;
-        break;
-      }
-      case "tier-topology-mismatch": {
-        const instance = args.instance ?? report.state?.project_id;
-        if (!instance) {
-          throw new ScmDoctorFixError(
-            "Cannot fix: missing Lakebase project id.",
-            "fix-failed"
-          );
-        }
-        await adoptScmState({
-          projectDir: args.projectDir,
-          instance,
-          force: true
-        });
-        action = `adopted state with --force to re-infer tier_topology`;
-        break;
-      }
-      case "orphan-current-branch": {
-        const instance = args.instance ?? report.state?.project_id;
-        if (!instance) {
-          throw new ScmDoctorFixError(
-            "Cannot fix: missing Lakebase project id.",
-            "fix-failed"
-          );
-        }
-        const headBranch = await getCurrentBranch({ cwd: args.projectDir });
-        if (!headBranch) {
-          throw new ScmDoctorFixError(
-            "Cannot fix: detached HEAD or no current branch.",
-            "fix-failed"
-          );
-        }
-        await recoverOrphans({
-          projectDir: args.projectDir,
-          instance,
-          claim: true,
-          onlyBranch: headBranch
-        });
-        action = `recovered orphan ${headBranch} via createFeaturePairedBranch`;
-        break;
-      }
-      case "multiple-migration-heads": {
-        const r = await collapseMigrationHeads({ projectDir: args.projectDir });
-        if (r.status !== "ok" || !r.mergeRevision) {
-          throw new ScmDoctorFixError(
-            `Expected to create a merge revision but got status="${r.status}".`,
-            "fix-failed"
-          );
-        }
-        action = `collapsed ${r.headsBefore.length} heads into merge revision ${r.mergeRevision} (commit it)`;
-        break;
-      }
-      case "db-ahead-of-code": {
-        const r = await abandonFeatureBranch({ projectDir: args.projectDir, instance: args.instance, force: true });
-        action = `abandoned the feature (deleted the polluted paired branch${r.lakebaseDeleted ? "" : " , Lakebase delete reported not-deleted"}) and reset state to '${r.state.state}'; re-claim to re-fork a clean branch from the tier`;
-        break;
-      }
+    const out = await exec2(
+      `git ls-remote --heads "${remote}" "${branch}"`,
+      { cwd }
+    );
+    return out.trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+
+// scripts/lakebase/scm-recover-orphans.ts
+var ScmRecoverError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "ScmRecoverError";
+  }
+  code;
+};
+var TIER_LEAFS = /* @__PURE__ */ new Set(["staging", "dev", "main", "master"]);
+async function recoverOrphans(args) {
+  if (!args.instance) {
+    throw new ScmRecoverError(
+      "Lakebase project id required (--instance / LAKEBASE_PROJECT_ID).",
+      "missing-instance"
+    );
+  }
+  const lakebaseBranches = await listBranches({ instance: args.instance });
+  const tierTopology = inferTierTopology(lakebaseBranches);
+  const lakebaseLeafs = new Set(
+    lakebaseBranches.map((b) => leafName2(b))
+  );
+  const defaultLeaf = leafName2(
+    lakebaseBranches.find((b) => b.isDefault === true)
+  );
+  const gitBranches = await listLocalBranches({ cwd: args.projectDir });
+  const orphans = [];
+  const skipped = [];
+  for (const gb of gitBranches) {
+    if (gb.isRemote) continue;
+    const name = gb.name;
+    if (TIER_LEAFS.has(name)) {
+      skipped.push({ gitBranch: name, reason: "tier branch" });
+      continue;
     }
-  } catch (err) {
-    if (err instanceof ScmDoctorFixError) throw err;
-    throw new ScmDoctorFixError(
-      `Remediation failed: ${err instanceof Error ? err.message : String(err)}`,
-      "fix-failed"
+    if (defaultLeaf && name === defaultLeaf) {
+      skipped.push({ gitBranch: name, reason: "default branch" });
+      continue;
+    }
+    const sanitized = sanitizeBranchName(name);
+    if (lakebaseLeafs.has(sanitized)) {
+      skipped.push({
+        gitBranch: name,
+        reason: `paired Lakebase branch "${sanitized}" exists`
+      });
+      continue;
+    }
+    orphans.push({
+      gitBranch: name,
+      sanitized,
+      isCurrent: gb.isCurrent === true,
+      reason: name.startsWith("feature/") ? "feature/<slug> branch with no Lakebase pair" : `non-tier git branch "${name}" with no Lakebase pair`
+    });
+  }
+  const result = {
+    tierTopology,
+    orphans,
+    skipped,
+    claimed: []
+  };
+  if (!args.claim || orphans.length === 0) {
+    return result;
+  }
+  const parentBranch = parentForTopology(tierTopology, defaultLeaf);
+  const currentState = readWorkflowState(args.projectDir);
+  const candidates = args.onlyBranch ? orphans.filter((o) => o.gitBranch === args.onlyBranch) : orphans;
+  if (args.onlyBranch && candidates.length === 0) {
+    throw new ScmRecoverError(
+      `No orphan found for --only-branch ${args.onlyBranch}.`,
+      "claim-conflict"
     );
   }
-  const postReport = await runDoctor({
-    projectDir: args.projectDir,
-    instance: args.instance
-  });
-  return { findingId: args.findingId, action, postReport };
+  const headOrphan = candidates.find((o) => o.isCurrent);
+  const stateTargetOrphan = headOrphan ?? candidates[0];
+  for (const orphan of candidates) {
+    try {
+      const paired = await createFeaturePairedBranch({
+        instance: args.instance,
+        branch: orphan.gitBranch,
+        parentBranch,
+        cwd: args.projectDir
+        // The git branch already exists on disk; the substrate primitive
+        // is idempotent on the git side (it'll checkout the existing
+        // branch rather than fail) but if the project is not on this
+        // branch, we want a no-op git side. Leaving the default true is
+        // OK: if the git branch already matches, the checkout is a
+        // no-op; if the branch isn't HEAD, the substrate switches to it
+        // which is what the user implicitly asked for by including the
+        // branch.
+      });
+      let stateUpdated = false;
+      if (orphan === stateTargetOrphan) {
+        const next = {
+          ...currentState ?? {
+            $schema: "./scm-workflow-state.schema.json",
+            version: 1,
+            state: "scaffold-complete",
+            tier_topology: tierTopology,
+            project_id: args.instance
+          },
+          state: "feature-claimed",
+          feature_id: orphan.gitBranch.replace(/^feature\//, ""),
+          branch: paired.gitBranch,
+          parent_branch: parentBranch,
+          lakebase_branch_uid: paired.branch.uid,
+          claimed_at: (args.now ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
+          pr_url: void 0,
+          pushed_at: void 0,
+          ci_run_url: void 0,
+          ci_green_at: void 0,
+          merged_at: void 0
+        };
+        writeWorkflowState(args.projectDir, next);
+        stateUpdated = true;
+        result.stateUpdatedFor = orphan.gitBranch;
+      }
+      result.claimed.push({
+        candidate: orphan,
+        lakebaseBranchUid: paired.branch.uid,
+        stateUpdated,
+        warnings: paired.warnings
+      });
+    } catch (err) {
+      throw new ScmRecoverError(
+        `Substrate claim failed for ${orphan.gitBranch}: ${err instanceof Error ? err.message : String(err)}`,
+        "substrate-failure"
+      );
+    }
+  }
+  return result;
 }
-function shellEscape3(s) {
-  return `'${s.replace(/'/g, "'\\''")}'`;
+function leafName2(b) {
+  if (!b) return "";
+  return b.name.split("/").pop() ?? b.name;
+}
+function parentForTopology(t, defaultLeaf) {
+  if (t === 3) return "dev";
+  if (t === 2) return "staging";
+  return defaultLeaf || "main";
 }
 
-// scripts/lakebase/doctor.ts
-init_esm_shims();
-import * as fs31 from "fs";
-import * as path31 from "path";
-import * as cp6 from "child_process";
-
-// scripts/lakebase/workflow-drift.ts
+// scripts/lakebase/scm-doctor.ts
 init_esm_shims();
 import * as fs30 from "fs";
 import * as path30 from "path";
-function findKitTemplatesDir(start) {
-  let dir = start;
-  for (let i = 0; i < 6; i++) {
-    const candidate = path30.join(
-      dir,
-      "templates",
-      "project",
-      "common",
-      ".github",
-      "workflows"
-    );
-    if (fs30.existsSync(candidate)) return candidate;
-    const parent = path30.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
+var FEATURE_PREFIX = "feature/";
+var TIER_LEAFS2 = DEFAULT_PROTECTED_TIER_NAMES;
+function readEnv(projectDir) {
+  const envPath = path30.join(projectDir, ".env");
+  const out = /* @__PURE__ */ new Map();
+  if (!fs30.existsSync(envPath)) return out;
+  const lines = fs30.readFileSync(envPath, "utf8").split("\n");
+  for (const line of lines) {
+    const m = line.match(/^\s*([A-Z0-9_]+)\s*=\s*(.+?)\s*$/);
+    if (m) out.set(m[1], m[2].replace(/^["']|["']$/g, ""));
   }
-  throw new Error(
-    `Could not locate templates/project/common/.github/workflows/ relative to ${start}. Pass explicit kitDir.`
-  );
+  return out;
 }
-function unifiedDiff(name, projectContent, templateContent) {
-  if (projectContent === templateContent) return "";
-  const a = projectContent.split("\n");
-  const b = templateContent.split("\n");
-  const out = [`--- project/${name}`, `+++ template/${name}`];
-  const max = Math.max(a.length, b.length);
-  for (let i = 0; i < max; i++) {
-    const av = a[i];
-    const bv = b[i];
-    if (av === bv) continue;
-    if (av !== void 0) out.push(`-${i + 1}: ${av}`);
-    if (bv !== void 0) out.push(`+${i + 1}: ${bv}`);
-  }
-  return out.join("\n");
+function leafOf2(b) {
+  return b.name.split("/").pop() ?? b.name;
 }
-function detectWorkflowDrift(args) {
-  const projectWorkflowsDir = path30.join(
-    args.projectDir,
-    ".github",
-    "workflows"
-  );
-  const here = path30.dirname(new URL(import.meta.url).pathname);
-  const kitWorkflowsDir = args.kitDir ? path30.join(
-    args.kitDir,
-    "templates",
-    "project",
-    "common",
-    ".github",
-    "workflows"
-  ) : findKitTemplatesDir(here);
-  const templateFiles = fs30.existsSync(kitWorkflowsDir) ? fs30.readdirSync(kitWorkflowsDir).filter((f) => f.endsWith(".yml")) : [];
-  const projectFiles = fs30.existsSync(projectWorkflowsDir) ? fs30.readdirSync(projectWorkflowsDir).filter((f) => f.endsWith(".yml")) : [];
-  const version = readKitVersion(kitWorkflowsDir);
-  const seen = /* @__PURE__ */ new Set();
-  const files = [];
-  for (const name of templateFiles) {
-    seen.add(name);
-    const projectPath2 = path30.join(projectWorkflowsDir, name);
-    const templatePath = path30.join(kitWorkflowsDir, name);
-    if (!fs30.existsSync(projectPath2)) {
-      files.push({ name, status: "missing" });
-      continue;
+function worstOf(a, b) {
+  const order = ["ok", "warn", "fail"];
+  return order[Math.max(order.indexOf(a), order.indexOf(b))];
+}
+async function runDoctor(args, deps = {}) {
+  const projectDir = args.projectDir;
+  const findings = [];
+  const env = readEnv(projectDir);
+  const instance = args.instance ?? env.get("LAKEBASE_PROJECT_ID");
+  const state = readWorkflowState(projectDir);
+  const workflowStatePresent = state !== null;
+  for (const stale of deps.findStaleBranches?.() ?? []) {
+    const where = stale.feature_id ? ` ${stale.feature_id}/${stale.story_id}` : "";
+    findings.push({
+      id: `stale-${stale.kind}`,
+      severity: "warn",
+      message: `Stale ${stale.kind}${where} "${stale.slug}"${stale.branch ? ` (branch ${stale.branch})` : ""}: ${stale.reason}.`,
+      suggestion: stale.kind === "experiment" ? `consort-experiment discard --feature ${stale.feature_id} --story ${stale.story_id} --slug ${stale.slug} --instance <id> --approver <you> --reason "doctor: stale experiment"` : "consort-spike teardown (or delete the spike's paired branch) once its learning has carried forward"
+    });
+  }
+  if (!workflowStatePresent) {
+    findings.push({
+      id: "no-state-file",
+      severity: "fail",
+      message: "No .lakebase/workflow-state.json. Either the project pre-dates the SCM workflow or scaffold did not seed it.",
+      suggestion: "lakebase-scm-adopt-state"
+    });
+  }
+  try {
+    const ownerRepo = await getOwnerRepo(projectDir);
+    if (ownerRepo) {
+      const enabled = await getActionsEnabled(ownerRepo);
+      if (enabled === false) {
+        findings.push({
+          id: "github-actions-disabled",
+          severity: "warn",
+          message: `GitHub Actions is disabled for ${ownerRepo}, so the kit's CI workflows (pr.yml / merge.yml) will never run , the PR branch's migrations, tests, and schema-diff comment are all skipped. This is commonly an org-level policy on EMU repos, which a repo admin cannot override.`,
+          suggestion: "Have an org owner enable Actions for this repo (repo Settings -> Actions -> General; if it says 'disabled by the organization', it must be enabled in the org's Actions policy). Until then, run the workflow steps locally: scripts/run-tests.sh against a Lakebase branch."
+        });
+      }
     }
-    const projectContent = fs30.readFileSync(projectPath2, "utf8");
-    const templateContent = applyPlaceholders(fs30.readFileSync(templatePath, "utf8"), version);
-    if (projectContent === templateContent) {
-      files.push({ name, status: "unchanged" });
-    } else {
-      files.push({
-        name,
-        status: "drifted",
-        diff: unifiedDiff(name, projectContent, templateContent)
+  } catch {
+  }
+  for (const wf of ["pr.yml", "merge.yml"]) {
+    try {
+      const p = path30.join(projectDir, ".github", "workflows", wf);
+      if (!fs30.existsSync(p)) continue;
+      const body = fs30.readFileSync(p, "utf8");
+      if (/lakebase-scm-utils#v\d/.test(body)) {
+        findings.push({
+          id: "ci-workflow-substrate-pin",
+          severity: "warn",
+          message: `.github/workflows/${wf} hardcodes a substrate version pin (github:databricks-solutions/lakebase-scm-utils#v<ver>) instead of resolving .lakebase/scm-utils-ref at runtime, so bumping .lakebase/scm-utils-ref does NOT change the substrate CI actually runs.`,
+          suggestion: "Re-emit the workflows from the current substrate templates so they resolve SCM_UTILS_REF from .lakebase/scm-utils-ref at CI time (updateWorkflows in scripts/lakebase/workflow-drift.ts; lakebase-doctor reports this as workflow-drift). Until then a scm-utils-ref bump will not reach CI."
+        });
+      }
+    } catch {
+    }
+  }
+  try {
+    if (isGitTracked(projectDir, ".lakebase/workflow-state.json")) {
+      findings.push({
+        id: "scm-state-git-tracked",
+        severity: "warn",
+        message: ".lakebase/workflow-state.json (the per-working-tree SCM claim state) is git-tracked, so a branch checkout or `git reset --hard origin/<tier>` can restore a stale committed claim over the live one (the foreign-claim guard then refuses to drive until you abandon + reclaim).",
+        suggestion: "If a wrong-feature-claim refusal follows a checkout, run lakebase-scm-adopt-state (or abandon + reclaim) to re-establish the live claim. The kit-ref run pin (.lakebase/kit-ref.local) already protects the kit version from the same checkout revert."
       });
     }
+  } catch {
   }
-  for (const name of projectFiles) {
-    if (seen.has(name)) continue;
-    files.push({ name, status: "extra" });
+  if (!env.has("LAKEBASE_PROJECT_ID")) {
+    findings.push({
+      id: "env-missing-project-id",
+      severity: "fail",
+      message: ".env does not contain LAKEBASE_PROJECT_ID. The post-checkout hook will exit early; workflow CLIs will need an explicit --instance.",
+      suggestion: "Set LAKEBASE_PROJECT_ID=<your project id> in .env"
+    });
   }
-  const order = {
-    drifted: 0,
-    missing: 1,
-    extra: 2,
-    unchanged: 3
-  };
-  files.sort((a, b) => order[a.status] - order[b.status] || a.name.localeCompare(b.name));
-  const hasDrift = files.some((f) => f.status === "drifted" || f.status === "missing");
-  return {
-    overall: hasDrift ? "drift" : "ok",
-    files
-  };
-}
-function readKitVersion(kitWorkflowsDir) {
-  let dir = kitWorkflowsDir;
-  for (let i = 0; i < 5; i++) {
-    dir = path30.dirname(dir);
+  if (!instance) {
+    return finalize({
+      projectDir,
+      workflowStatePresent,
+      state: state ?? void 0,
+      findings
+    });
   }
+  let lakebaseBranches = [];
   try {
-    const raw = fs30.readFileSync(path30.join(dir, "package.json"), "utf-8");
-    const pkg = JSON.parse(raw);
-    return typeof pkg.version === "string" ? pkg.version : "unknown";
-  } catch {
-    return "unknown";
+    lakebaseBranches = await listBranches({ instance });
+  } catch (err) {
+    findings.push({
+      id: "lakebase-unreachable",
+      severity: "fail",
+      message: `Could not list Lakebase branches for instance ${instance}: ${err instanceof Error ? err.message : String(err)}`,
+      suggestion: "databricks auth login (or check DATABRICKS_CONFIG_PROFILE)."
+    });
+    return finalize({
+      projectDir,
+      workflowStatePresent,
+      state: state ?? void 0,
+      findings
+    });
   }
-}
-function applyPlaceholders(content, version) {
-  return content.replace(/\{\{LAKEBASE_SCM_UTILS_VERSION\}\}/g, version);
-}
-function applyCommandPlaceholders(content, version) {
-  return content.replace(/\$\{KIT_VERSION_AT_SCAFFOLD\}/g, version);
-}
-var COMMAND_HOOK_FILE_PATTERN = /\.(pre|post)-hook\.md$/;
-function findKitCommandsDir(start) {
-  let dir = start;
-  for (let i = 0; i < 6; i++) {
-    const candidate = path30.join(
-      dir,
-      "templates",
-      "project",
-      "common",
-      ".claude",
-      "commands"
-    );
-    if (fs30.existsSync(candidate)) return candidate;
-    const parent = path30.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
+  const inferredTopology = inferTierTopology(lakebaseBranches);
+  if (state && state.tier_topology !== inferredTopology) {
+    findings.push({
+      id: "tier-topology-mismatch",
+      severity: "warn",
+      message: `workflow-state records tier_topology=${state.tier_topology}, but the Lakebase tier inventory suggests ${inferredTopology}.`,
+      suggestion: "lakebase-scm-adopt-state --force"
+    });
   }
-  throw new Error(
-    `Could not locate templates/project/common/.claude/commands/ relative to ${start}. Pass explicit kitDir.`
-  );
-}
-function parsePinnedVersion(content) {
-  const m = content.match(/^\s*[*_>`\s]*pinned\s+to\s*:\s*[`*_]*([^\s`*_]+)[`*_]*\s*$/im);
-  return m ? m[1] : void 0;
-}
-function detectCommandDrift(args) {
-  const projectCommandsDir = path30.join(args.projectDir, ".claude", "commands");
-  const here = path30.dirname(new URL(import.meta.url).pathname);
-  const kitCommandsDir = args.kitDir ? path30.join(args.kitDir, "templates", "project", "common", ".claude", "commands") : findKitCommandsDir(here);
-  const kitVersion = readKitVersionFromCommandsDir(kitCommandsDir);
-  const templateFiles = fs30.existsSync(kitCommandsDir) ? fs30.readdirSync(kitCommandsDir).filter((f) => f.endsWith(".md") && !COMMAND_HOOK_FILE_PATTERN.test(f)) : [];
-  const projectFiles = fs30.existsSync(projectCommandsDir) ? fs30.readdirSync(projectCommandsDir).filter((f) => f.endsWith(".md") && !COMMAND_HOOK_FILE_PATTERN.test(f)) : [];
-  const seen = /* @__PURE__ */ new Set();
-  const files = [];
-  for (const name of templateFiles) {
-    seen.add(name);
-    const projectPath2 = path30.join(projectCommandsDir, name);
-    const templatePath = path30.join(kitCommandsDir, name);
-    const templateRaw = fs30.readFileSync(templatePath, "utf8");
-    if (!fs30.existsSync(projectPath2)) {
-      files.push({ name, status: "missing", kit_version: kitVersion });
-      continue;
-    }
-    const projectContent = fs30.readFileSync(projectPath2, "utf8");
-    const pinned = parsePinnedVersion(projectContent);
-    const versionForCompare = pinned ?? kitVersion;
-    const templateContent = applyCommandPlaceholders(templateRaw, versionForCompare);
-    if (projectContent === templateContent) {
-      files.push({
-        name,
-        status: "unchanged",
-        pinned_version: pinned,
-        kit_version: kitVersion
-      });
-    } else {
-      files.push({
-        name,
-        status: "drifted",
-        pinned_version: pinned,
-        kit_version: kitVersion,
-        diff: unifiedDiff(name, projectContent, templateContent)
+  const headBranch = await getCurrentBranch({ cwd: projectDir });
+  if (state && state.state === "feature-claimed") {
+    if (state.branch && headBranch && headBranch !== state.branch) {
+      findings.push({
+        id: "head-branch-drift",
+        severity: "warn",
+        message: `workflow says feature-claimed for "${state.branch}", but HEAD is on "${headBranch}".`,
+        suggestion: `git checkout '${state.branch}'`
       });
     }
+    if (state.branch) {
+      const sanitized = sanitizeBranchName(state.branch);
+      let pair;
+      try {
+        pair = await getBranchByName(sanitized, { instance });
+      } catch {
+        pair = void 0;
+      }
+      if (!pair) {
+        findings.push({
+          id: "lakebase-pair-missing",
+          severity: "fail",
+          message: `workflow says feature-claimed for "${state.branch}", but no Lakebase branch "${sanitized}" exists.`,
+          suggestion: `lakebase-scm-abandon-feature  # reset state; re-claim if needed`
+        });
+      } else if (state.lakebase_branch_uid && pair.uid !== state.lakebase_branch_uid) {
+        findings.push({
+          id: "lakebase-uid-drift",
+          severity: "warn",
+          message: `workflow records lakebase_branch_uid=${state.lakebase_branch_uid}, but the live branch reports ${pair.uid}.`,
+          suggestion: "lakebase-scm-adopt-state --force"
+        });
+      }
+    }
   }
-  for (const name of projectFiles) {
-    if (seen.has(name)) continue;
-    files.push({ name, status: "extra", kit_version: kitVersion });
+  if (state && state.state === "feature-claimed" && state.branch) {
+    const envBranchId = env.get("LAKEBASE_BRANCH_ID");
+    const sanitized = sanitizeBranchName(state.branch);
+    if (envBranchId && envBranchId !== sanitized) {
+      findings.push({
+        id: "env-branch-drift",
+        severity: "warn",
+        message: `.env LAKEBASE_BRANCH_ID=${envBranchId} but workflow says ${sanitized}. The post-checkout hook may not have run since the last branch switch.`,
+        suggestion: `git checkout '${state.branch}'  # re-fires post-checkout`
+      });
+    }
   }
-  const order = {
-    drifted: 0,
-    missing: 1,
-    extra: 2,
-    unchanged: 3
-  };
-  files.sort((a, b) => order[a.status] - order[b.status] || a.name.localeCompare(b.name));
-  const hasDrift = files.some((f) => f.status === "drifted" || f.status === "missing");
-  return { overall: hasDrift ? "drift" : "ok", files };
-}
-function readKitVersionFromCommandsDir(kitCommandsDir) {
-  let dir = kitCommandsDir;
-  for (let i = 0; i < 5; i++) {
-    dir = path30.dirname(dir);
+  if (headBranch && !TIER_LEAFS2.has(headBranch) && headBranch.startsWith(FEATURE_PREFIX)) {
+    const sanitized = sanitizeBranchName(headBranch);
+    const paired = lakebaseBranches.some((b) => leafOf2(b) === sanitized);
+    if (!paired) {
+      findings.push({
+        id: "orphan-current-branch",
+        severity: "fail",
+        message: `Current git branch "${headBranch}" has no Lakebase pair (post-checkout fallback retired in phase C).`,
+        suggestion: `lakebase-scm-recover-orphans --claim --only-branch '${headBranch}'`
+      });
+    }
   }
   try {
-    const raw = fs30.readFileSync(path30.join(dir, "package.json"), "utf-8");
-    const pkg = JSON.parse(raw);
-    return typeof pkg.version === "string" ? pkg.version : "unknown";
+    const heads = await collapseMigrationHeads({ projectDir, dryRun: true });
+    if (heads.headsBefore.length > 1) {
+      findings.push({
+        id: "multiple-migration-heads",
+        severity: "fail",
+        message: `Migrations have ${heads.headsBefore.length} heads (${heads.headsBefore.join(", ")}); a sibling-feature merge left them un-collapsed. \`upgrade head\` will refuse until they are unified.`,
+        suggestion: "lakebase-collapse-heads"
+      });
+    }
   } catch {
-    return "unknown";
   }
+  if (instance && state?.branch) {
+    try {
+      const localIds = listSchemaMigrations({ projectDir }).map((m) => m.version);
+      let orphanRev = null;
+      try {
+        const status = await schemaMigrationStatus({ instance, branch: state.branch, projectDir });
+        if (dbRevisionOrphaned(status.current, localIds)) orphanRev = status.current ?? null;
+      } catch (e) {
+        orphanRev = parseAlembicMissingRevision(e instanceof Error ? e.message : String(e));
+      }
+      if (orphanRev) {
+        findings.push({
+          id: "db-ahead-of-code",
+          severity: "fail",
+          message: `The paired branch DB is AHEAD of code: applied revision '${orphanRev}' has no local migration file. An aborted build likely migrated this branch and a git reset removed the migration file; alembic accept/deploy/promote will fail "Can't locate revision".`,
+          suggestion: "reset the paired branch DB to the code head (downgrade/stamp + drop reset-created tables), or delete the branch and re-cut it clean from its tier"
+        });
+      }
+    } catch {
+    }
+  }
+  return finalize({
+    projectDir,
+    workflowStatePresent,
+    state: state ?? void 0,
+    inferredTierTopology: inferredTopology,
+    findings
+  });
 }
-function detectScaffoldedDrift(args) {
-  const workflows = detectWorkflowDrift(args);
-  const commands = detectCommandDrift(args);
-  return {
-    overall: workflows.overall === "drift" || commands.overall === "drift" ? "drift" : "ok",
-    workflows,
-    commands
-  };
+function finalize(report) {
+  let worst = "ok";
+  for (const f of report.findings) {
+    worst = worstOf(worst, f.severity);
+  }
+  return { ...report, worstSeverity: worst };
 }
-function updateWorkflows(args) {
-  const projectWorkflowsDir = path30.join(
-    args.projectDir,
-    ".github",
-    "workflows"
-  );
-  const here = path30.dirname(new URL(import.meta.url).pathname);
-  const kitWorkflowsDir = args.kitDir ? path30.join(
-    args.kitDir,
-    "templates",
-    "project",
-    "common",
-    ".github",
-    "workflows"
-  ) : findKitTemplatesDir(here);
-  const substitute = args.substitute !== false;
-  const dryRun = args.dryRun === true;
-  const pruneExtras = args.pruneExtras === true;
-  const templateFiles = fs30.existsSync(kitWorkflowsDir) ? fs30.readdirSync(kitWorkflowsDir).filter((f) => f.endsWith(".yml")) : [];
-  const projectFiles = fs30.existsSync(projectWorkflowsDir) ? fs30.readdirSync(projectWorkflowsDir).filter((f) => f.endsWith(".yml")) : [];
-  if (!dryRun && templateFiles.length > 0 && !fs30.existsSync(projectWorkflowsDir)) {
-    fs30.mkdirSync(projectWorkflowsDir, { recursive: true });
+var ScmDoctorFixError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "ScmDoctorFixError";
   }
-  const version = substitute ? readKitVersion(kitWorkflowsDir) : "";
-  const seen = /* @__PURE__ */ new Set();
-  const files = [];
-  for (const name of templateFiles) {
-    seen.add(name);
-    const projectPath2 = path30.join(projectWorkflowsDir, name);
-    const templatePath = path30.join(kitWorkflowsDir, name);
-    const templateRaw = fs30.readFileSync(templatePath, "utf-8");
-    const desired = substitute ? applyPlaceholders(templateRaw, version) : templateRaw;
-    const existed = fs30.existsSync(projectPath2);
-    const current = existed ? fs30.readFileSync(projectPath2, "utf-8") : "";
-    let outcome;
-    if (!existed) {
-      outcome = "added";
-    } else if (current === desired) {
-      outcome = "unchanged";
-    } else {
-      outcome = "updated";
-    }
-    if (!dryRun && outcome !== "unchanged") {
-      fs30.writeFileSync(projectPath2, desired);
-    }
-    files.push({ name, outcome });
+  code;
+};
+var FIXABLE_FINDING_IDS = [
+  "env-branch-drift",
+  "head-branch-drift",
+  "tier-topology-mismatch",
+  "orphan-current-branch",
+  "multiple-migration-heads",
+  "db-ahead-of-code"
+];
+async function fixFinding(args) {
+  if (!FIXABLE_FINDING_IDS.includes(args.findingId)) {
+    throw new ScmDoctorFixError(
+      `Finding "${args.findingId}" is not supported by --fix. Supported: ${FIXABLE_FINDING_IDS.join(", ")}.`,
+      "unsupported-finding"
+    );
   }
-  if (pruneExtras) {
-    for (const name of projectFiles) {
-      if (seen.has(name)) continue;
-      const projectPath2 = path30.join(projectWorkflowsDir, name);
-      if (!dryRun) {
-        fs30.unlinkSync(projectPath2);
+  const report = args.report ?? await runDoctor({ projectDir: args.projectDir, instance: args.instance });
+  const present = report.findings.find((f) => f.id === args.findingId);
+  if (!present) {
+    throw new ScmDoctorFixError(
+      `Finding "${args.findingId}" is not present in the current report. Re-run lakebase-scm-doctor to see what needs fixing.`,
+      "finding-not-present"
+    );
+  }
+  let action = "";
+  try {
+    switch (args.findingId) {
+      case "env-branch-drift": {
+        const branch = report.state?.branch;
+        if (!branch) {
+          throw new ScmDoctorFixError(
+            "Cannot fix: workflow state has no branch field.",
+            "fix-failed"
+          );
+        }
+        const sanitized = sanitizeBranchName(branch);
+        const envFile = path30.join(args.projectDir, ".env");
+        updateEnvConnection({
+          envPath: envFile,
+          projectId: readEnvVar(envFile, "LAKEBASE_PROJECT_ID") ?? "",
+          branchId: sanitized,
+          username: readEnvVar(envFile, "DB_USERNAME") ?? "",
+          endpointHost: readEnvVar(envFile, "LAKEBASE_HOST")
+        });
+        action = `rewrote .env LAKEBASE_BRANCH_ID=${sanitized} (metadata only; the app mints its token at runtime)`;
+        break;
+      }
+      case "head-branch-drift": {
+        const branch = report.state?.branch;
+        if (!branch) {
+          throw new ScmDoctorFixError(
+            "Cannot fix: workflow state has no branch field.",
+            "fix-failed"
+          );
+        }
+        await exec2(`git checkout ${shellEscape3(branch)}`, {
+          cwd: args.projectDir,
+          timeout: 15e3
+        });
+        action = `git checkout ${branch} (re-fires post-checkout to resync HEAD)`;
+        break;
+      }
+      case "tier-topology-mismatch": {
+        const instance = args.instance ?? report.state?.project_id;
+        if (!instance) {
+          throw new ScmDoctorFixError(
+            "Cannot fix: missing Lakebase project id.",
+            "fix-failed"
+          );
+        }
+        await adoptScmState({
+          projectDir: args.projectDir,
+          instance,
+          force: true
+        });
+        action = `adopted state with --force to re-infer tier_topology`;
+        break;
+      }
+      case "orphan-current-branch": {
+        const instance = args.instance ?? report.state?.project_id;
+        if (!instance) {
+          throw new ScmDoctorFixError(
+            "Cannot fix: missing Lakebase project id.",
+            "fix-failed"
+          );
+        }
+        const headBranch = await getCurrentBranch({ cwd: args.projectDir });
+        if (!headBranch) {
+          throw new ScmDoctorFixError(
+            "Cannot fix: detached HEAD or no current branch.",
+            "fix-failed"
+          );
+        }
+        await recoverOrphans({
+          projectDir: args.projectDir,
+          instance,
+          claim: true,
+          onlyBranch: headBranch
+        });
+        action = `recovered orphan ${headBranch} via createFeaturePairedBranch`;
+        break;
+      }
+      case "multiple-migration-heads": {
+        const r = await collapseMigrationHeads({ projectDir: args.projectDir });
+        if (r.status !== "ok" || !r.mergeRevision) {
+          throw new ScmDoctorFixError(
+            `Expected to create a merge revision but got status="${r.status}".`,
+            "fix-failed"
+          );
+        }
+        action = `collapsed ${r.headsBefore.length} heads into merge revision ${r.mergeRevision} (commit it)`;
+        break;
+      }
+      case "db-ahead-of-code": {
+        const r = await abandonFeatureBranch({ projectDir: args.projectDir, instance: args.instance, force: true });
+        action = `abandoned the feature (deleted the polluted paired branch${r.lakebaseDeleted ? "" : " , Lakebase delete reported not-deleted"}) and reset state to '${r.state.state}'; re-claim to re-fork a clean branch from the tier`;
+        break;
       }
-      files.push({ name, outcome: "removed" });
     }
+  } catch (err) {
+    if (err instanceof ScmDoctorFixError) throw err;
+    throw new ScmDoctorFixError(
+      `Remediation failed: ${err instanceof Error ? err.message : String(err)}`,
+      "fix-failed"
+    );
   }
-  const order = {
-    added: 0,
-    updated: 1,
-    removed: 2,
-    unchanged: 3
-  };
-  files.sort((a, b) => order[a.outcome] - order[b.outcome] || a.name.localeCompare(b.name));
-  const changed = files.some((f) => f.outcome !== "unchanged");
-  return { files, changed };
+  const postReport = await runDoctor({
+    projectDir: args.projectDir,
+    instance: args.instance
+  });
+  return { findingId: args.findingId, action, postReport };
+}
+function shellEscape3(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
 }
 
 // scripts/lakebase/doctor.ts
+init_esm_shims();
+import * as fs31 from "fs";
+import * as path31 from "path";
+import * as cp6 from "child_process";
 function readEnvFile(projectDir) {
   const envPath = path31.join(projectDir, ".env");
   if (!fs31.existsSync(envPath)) return {};
@@ -17615,7 +17736,7 @@ function checkWorkflowDrift(projectDir) {
       status: "warn",
       message: `Scaffolded workflows drift from kit: ${drifted} drifted, ${missing} missing`,
       detail: { files: report.files.map((f) => ({ name: f.name, status: f.status })) },
-      hint: "Inspect via the lakebase_workflow_drift MCP tool (or detectWorkflowDrift import). Refresh manually until updateWorkflows lands."
+      hint: "Refresh with updateWorkflows (or the lakebase_workflow_drift MCP tool). A stale merge.yml calling 'lakebase-schema-migrate apply' (not 'apply-tier') makes the promote's migrate-target fail on the tier guard; the scm-merge promote also self-heals drifted workflows onto the PR head before merging."
     };
   } catch (err) {
     return {
@@ -17726,9 +17847,10 @@ async function ensureLakebaseSecretAuth(args) {
   if (typeof pat !== "string" || !pat) {
     throw new Error("databricks tokens create returned no token_value");
   }
-  await runDatabricks(["secrets", "put-secret", scopeName, keyName, "--string-value", pat], {
+  await runDatabricks(["secrets", "put-secret", "--json", "@/dev/stdin"], {
     profile,
-    timeout: timeoutMs
+    timeout: timeoutMs,
+    input: JSON.stringify({ scope: scopeName, key: keyName, string_value: pat })
   });
   let aclGranted = false;
   if (servicePrincipalClientId) {
@@ -18090,63 +18212,6 @@ async function discardAllChanges(args) {
   await exec2("git clean -fd", { cwd: args.cwd });
 }
 
-// scripts/git/sync.ts
-init_esm_shims();
-async function currentBranchName2(cwd) {
-  try {
-    return await exec2("git rev-parse --abbrev-ref HEAD", { cwd });
-  } catch {
-    return "";
-  }
-}
-async function push(args) {
-  await exec2("git push", { cwd: args.cwd });
-}
-async function pull(args) {
-  await exec2("git pull", { cwd: args.cwd });
-}
-async function publishBranch(args) {
-  const remote = args.remote ?? "origin";
-  const branch = await currentBranchName2(args.cwd);
-  if (!branch) throw new Error("No current branch");
-  await exec2(`git push -u ${remote} ${shq(branch)}`, {
-    cwd: args.cwd
-  });
-}
-async function pushCurrentBranchForPr(args) {
-  const remote = args.remote ?? "origin";
-  const branch = await currentBranchName2(args.cwd);
-  if (!branch) throw new Error("No current branch");
-  const upstreamSet = await hasUpstream({ cwd: args.cwd });
-  if (!upstreamSet) {
-    await exec2(`git push -u ${remote} ${shq(branch)}`, {
-      cwd: args.cwd
-    });
-  } else {
-    await exec2("git push", { cwd: args.cwd });
-  }
-}
-async function fetch2(args) {
-  const parts = ["git fetch"];
-  if (args.prune) parts.push("--prune");
-  if (args.all) parts.push("--all");
-  await exec2(parts.join(" "), { cwd: args.cwd });
-}
-async function pullFrom(args) {
-  await exec2(`git pull ${shq(args.remote)} ${shq(args.branch)}`, {
-    cwd: args.cwd
-  });
-}
-async function pushTo(args) {
-  await exec2(`git push ${shq(args.remote)} ${shq(args.branch)}`, {
-    cwd: args.cwd
-  });
-}
-async function sync(args) {
-  await exec2("git pull", { cwd: args.cwd });
-  await exec2("git push", { cwd: args.cwd });
-}
-
 // scripts/git/branch-tag.ts
 init_esm_shims();
 var PROTECTED_BRANCHES = /* @__PURE__ */ new Set(["production", "main", "master"]);
@@ -18551,6 +18616,7 @@ export {
   createWorktree,
   cutBackup,
   databricksAuthPrereqMessage,
+  defaultRefreshPromoteWorkflows,
   delay,
   deleteAppEndpoint,
   deleteBranch,