@databricks-solutions/lakebase-scm-utils 0.2.44 → 0.2.45

package/dist/scripts/index.cjs

@@ -79021,6 +79021,7 @@ __export(scripts_exports, {
   createWorktree: () => createWorktree,
   cutBackup: () => cutBackup,
   databricksAuthPrereqMessage: () => databricksAuthPrereqMessage,
+  defaultRefreshPromoteWorkflows: () => defaultRefreshPromoteWorkflows,
   delay: () => delay,
   deleteAppEndpoint: () => deleteAppEndpoint,
   deleteBranch: () => deleteBranch,
@@ -88916,8 +88917,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.2.44".length > 0) {
-    cached = "0.2.44";
+  if ("0.2.45".length > 0) {
+    cached = "0.2.45";
     return cached;
   }
   cached = "unknown";
@@ -95218,123 +95219,500 @@ function pickRunUrl(pr) {
 
 // scripts/lakebase/scm-merge.ts
 init_cjs_shims();
-async function reconcileTierToOrigin(args) {
-  const { cwd, tier } = args;
+
+// scripts/git/sync.ts
+init_cjs_shims();
+async function currentBranchName(cwd) {
   try {
-    const head = await getCurrentBranch({ cwd });
-    if (head === tier) {
-      await exec2(`git pull --ff-only`, { cwd, timeout: 3e4 });
-    } else {
-      await exec2(`git fetch origin ${shellEscape2(`${tier}:${tier}`)}`, { cwd, timeout: 3e4 });
-    }
-    return null;
-  } catch (err) {
-    return `local reconcile of ${tier} to origin/${tier} failed: ${err instanceof Error ? err.message : String(err)}. Reconcile it by hand (git checkout ${tier} && git pull --ff-only).`;
+    return await exec2("git rev-parse --abbrev-ref HEAD", { cwd });
+  } catch {
+    return "";
   }
 }
-var ScmMergeError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "ScmMergeError";
-  }
-  code;
-};
-var DEFAULT_MIGRATE_TIMEOUT_MS = 30 * 60 * 1e3;
-var DEFAULT_MIGRATE_POLL_MS = 30 * 1e3;
-function defaultMigratePredicate(run, mergedAt) {
-  if (!run.createdAt) return false;
-  const created = Date.parse(run.createdAt);
-  if (!Number.isFinite(created)) return false;
-  if (run.event && run.event !== "push") return false;
-  return created >= mergedAt.getTime() - 5e3;
+async function push(args) {
+  await exec2("git push", { cwd: args.cwd });
 }
-function shaMigratePredicate(mergeCommitSha) {
-  return (run) => {
-    if (run.event && run.event !== "push") return false;
-    return !!run.headSha && run.headSha === mergeCommitSha;
-  };
+async function pull(args) {
+  await exec2("git pull", { cwd: args.cwd });
 }
-async function mergeFeature(args) {
-  const current = readWorkflowState(args.projectDir);
-  if (!current) {
-    throw new ScmMergeError(
-      "No SCM workflow state. wait-ci first.",
-      "no-state-file"
-    );
-  }
-  if (current.state !== "ci-green") {
-    throw new ScmMergeError(
-      `merge refuses state "${current.state}". Allowed predecessor: ci-green.`,
-      "bad-precondition"
-    );
+async function publishBranch(args) {
+  const remote = args.remote ?? "origin";
+  const branch = await currentBranchName(args.cwd);
+  if (!branch) throw new Error("No current branch");
+  await exec2(`git push -u ${remote} ${shq(branch)}`, {
+    cwd: args.cwd
+  });
+}
+async function pushCurrentBranchForPr(args) {
+  const remote = args.remote ?? "origin";
+  const branch = await currentBranchName(args.cwd);
+  if (!branch) throw new Error("No current branch");
+  const upstreamSet = await hasUpstream({ cwd: args.cwd });
+  if (!upstreamSet) {
+    await exec2(`git push -u ${remote} ${shq(branch)}`, {
+      cwd: args.cwd
+    });
+  } else {
+    await exec2("git push", { cwd: args.cwd });
   }
-  if (!current.pr_url) {
-    throw new ScmMergeError(
-      "ci-green row is missing pr_url; cannot resolve the PR to merge.",
-      "no-pr-url"
+}
+async function fetch3(args) {
+  const parts = ["git fetch"];
+  if (args.prune) parts.push("--prune");
+  if (args.all) parts.push("--all");
+  await exec2(parts.join(" "), { cwd: args.cwd });
+}
+async function pullFrom(args) {
+  await exec2(`git pull ${shq(args.remote)} ${shq(args.branch)}`, {
+    cwd: args.cwd
+  });
+}
+async function pushTo(args) {
+  await exec2(`git push ${shq(args.remote)} ${shq(args.branch)}`, {
+    cwd: args.cwd
+  });
+}
+async function sync(args) {
+  await exec2("git pull", { cwd: args.cwd });
+  await exec2("git push", { cwd: args.cwd });
+}
+
+// scripts/lakebase/workflow-drift.ts
+init_cjs_shims();
+var fs30 = __toESM(require("fs"), 1);
+var path28 = __toESM(require("path"), 1);
+function findKitTemplatesDir(start) {
+  let dir = start;
+  for (let i2 = 0; i2 < 6; i2++) {
+    const candidate = path28.join(
+      dir,
+      "templates",
+      "project",
+      "common",
+      ".github",
+      "workflows"
     );
+    if (fs30.existsSync(candidate)) return candidate;
+    const parent = path28.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
   }
-  if (!current.branch || !current.parent_branch) {
-    throw new ScmMergeError(
-      "ci-green row missing branch / parent_branch; refusing to merge.",
-      "bad-precondition"
-    );
+  throw new Error(
+    `Could not locate templates/project/common/.github/workflows/ relative to ${start}. Pass explicit kitDir.`
+  );
+}
+function unifiedDiff(name, projectContent, templateContent) {
+  if (projectContent === templateContent) return "";
+  const a = projectContent.split("\n");
+  const b = templateContent.split("\n");
+  const out = [`--- project/${name}`, `+++ template/${name}`];
+  const max = Math.max(a.length, b.length);
+  for (let i2 = 0; i2 < max; i2++) {
+    const av = a[i2];
+    const bv = b[i2];
+    if (av === bv) continue;
+    if (av !== void 0) out.push(`-${i2 + 1}: ${av}`);
+    if (bv !== void 0) out.push(`+${i2 + 1}: ${bv}`);
   }
-  const ownerRepo = await getOwnerRepo(args.projectDir);
-  if (!ownerRepo) {
-    throw new ScmMergeError(
-      "No GitHub remote found at origin.",
-      "no-github-remote"
-    );
+  return out.join("\n");
+}
+function detectWorkflowDrift(args) {
+  const projectWorkflowsDir = path28.join(
+    args.projectDir,
+    ".github",
+    "workflows"
+  );
+  const here = path28.dirname(new URL(importMetaUrl).pathname);
+  const kitWorkflowsDir = args.kitDir ? path28.join(
+    args.kitDir,
+    "templates",
+    "project",
+    "common",
+    ".github",
+    "workflows"
+  ) : findKitTemplatesDir(here);
+  const templateFiles = fs30.existsSync(kitWorkflowsDir) ? fs30.readdirSync(kitWorkflowsDir).filter((f3) => f3.endsWith(".yml")) : [];
+  const projectFiles = fs30.existsSync(projectWorkflowsDir) ? fs30.readdirSync(projectWorkflowsDir).filter((f3) => f3.endsWith(".yml")) : [];
+  const version = readKitVersion(kitWorkflowsDir);
+  const seen = /* @__PURE__ */ new Set();
+  const files = [];
+  for (const name of templateFiles) {
+    seen.add(name);
+    const projectPath2 = path28.join(projectWorkflowsDir, name);
+    const templatePath = path28.join(kitWorkflowsDir, name);
+    if (!fs30.existsSync(projectPath2)) {
+      files.push({ name, status: "missing" });
+      continue;
+    }
+    const projectContent = fs30.readFileSync(projectPath2, "utf8");
+    const templateContent = applyPlaceholders(fs30.readFileSync(templatePath, "utf8"), version);
+    if (projectContent === templateContent) {
+      files.push({ name, status: "unchanged" });
+    } else {
+      files.push({
+        name,
+        status: "drifted",
+        diff: unifiedDiff(name, projectContent, templateContent)
+      });
+    }
   }
-  const pullNumber = extractPullNumber(current.pr_url);
-  if (!pullNumber) {
-    throw new ScmMergeError(
-      `Could not extract PR number from URL: ${current.pr_url}`,
-      "bad-pr-url"
-    );
+  for (const name of projectFiles) {
+    if (seen.has(name)) continue;
+    files.push({ name, status: "extra" });
   }
-  const instance = args.instance ?? current.project_id;
-  const gitBase = await resolveGitBase(current.parent_branch, args.projectDir);
-  const wantMigrate = args.waitMigrate !== false;
-  let authVerified = false;
-  if (wantMigrate && args.verifyMigrateAuth) {
-    const probe = await args.verifyMigrateAuth();
-    if (!probe.ok) {
-      throw new ScmMergeError(
-        `Migrate-auth precondition failed: ${probe.detail ?? "the Databricks credential is not usable"}. Refusing to merge: the downstream migrate would promote git without applying the schema. Refresh your credential (databricks auth login), then re-run.`,
-        "migrate-auth"
-      );
-    }
-    authVerified = true;
+  const order = {
+    drifted: 0,
+    missing: 1,
+    extra: 2,
+    unchanged: 3
+  };
+  files.sort((a, b) => order[a.status] - order[b.status] || a.name.localeCompare(b.name));
+  const hasDrift = files.some((f3) => f3.status === "drifted" || f3.status === "missing");
+  return {
+    overall: hasDrift ? "drift" : "ok",
+    files
+  };
+}
+function readKitVersion(kitWorkflowsDir) {
+  let dir = kitWorkflowsDir;
+  for (let i2 = 0; i2 < 5; i2++) {
+    dir = path28.dirname(dir);
   }
-  let paired;
   try {
-    paired = await mergePairedPullRequest({
-      ownerRepo,
-      pullNumber,
-      lakebaseInstance: instance,
-      method: args.method ?? "squash"
-    });
-  } catch (err) {
-    throw new ScmMergeError(
-      `mergePairedPullRequest failed: ${err instanceof Error ? err.message : String(err)}`,
-      "merge-failed"
+    const raw = fs30.readFileSync(path28.join(dir, "package.json"), "utf-8");
+    const pkg = JSON.parse(raw);
+    return typeof pkg.version === "string" ? pkg.version : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function applyPlaceholders(content, version) {
+  return content.replace(/\{\{LAKEBASE_SCM_UTILS_VERSION\}\}/g, version);
+}
+function applyCommandPlaceholders(content, version) {
+  return content.replace(/\$\{KIT_VERSION_AT_SCAFFOLD\}/g, version);
+}
+var COMMAND_HOOK_FILE_PATTERN = /\.(pre|post)-hook\.md$/;
+function findKitCommandsDir(start) {
+  let dir = start;
+  for (let i2 = 0; i2 < 6; i2++) {
+    const candidate = path28.join(
+      dir,
+      "templates",
+      "project",
+      "common",
+      ".claude",
+      "commands"
     );
+    if (fs30.existsSync(candidate)) return candidate;
+    const parent = path28.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
   }
-  const warnings = [...paired.warnings];
-  let localBranchDeleted = false;
-  let headAfter = current.branch;
-  if (!args.skipLocalCleanup) {
-    const switchTo = args.switchTo ?? gitBase;
-    const head = await getCurrentBranch({ cwd: args.projectDir });
-    if (head === current.branch) {
-      try {
-        await exec2(`git checkout ${shellEscape2(switchTo)}`, {
-          cwd: args.projectDir,
-          timeout: 1e4
-        });
+  throw new Error(
+    `Could not locate templates/project/common/.claude/commands/ relative to ${start}. Pass explicit kitDir.`
+  );
+}
+function parsePinnedVersion(content) {
+  const m2 = content.match(/^\s*[*_>`\s]*pinned\s+to\s*:\s*[`*_]*([^\s`*_]+)[`*_]*\s*$/im);
+  return m2 ? m2[1] : void 0;
+}
+function detectCommandDrift(args) {
+  const projectCommandsDir = path28.join(args.projectDir, ".claude", "commands");
+  const here = path28.dirname(new URL(importMetaUrl).pathname);
+  const kitCommandsDir = args.kitDir ? path28.join(args.kitDir, "templates", "project", "common", ".claude", "commands") : findKitCommandsDir(here);
+  const kitVersion = readKitVersionFromCommandsDir(kitCommandsDir);
+  const templateFiles = fs30.existsSync(kitCommandsDir) ? fs30.readdirSync(kitCommandsDir).filter((f3) => f3.endsWith(".md") && !COMMAND_HOOK_FILE_PATTERN.test(f3)) : [];
+  const projectFiles = fs30.existsSync(projectCommandsDir) ? fs30.readdirSync(projectCommandsDir).filter((f3) => f3.endsWith(".md") && !COMMAND_HOOK_FILE_PATTERN.test(f3)) : [];
+  const seen = /* @__PURE__ */ new Set();
+  const files = [];
+  for (const name of templateFiles) {
+    seen.add(name);
+    const projectPath2 = path28.join(projectCommandsDir, name);
+    const templatePath = path28.join(kitCommandsDir, name);
+    const templateRaw = fs30.readFileSync(templatePath, "utf8");
+    if (!fs30.existsSync(projectPath2)) {
+      files.push({ name, status: "missing", kit_version: kitVersion });
+      continue;
+    }
+    const projectContent = fs30.readFileSync(projectPath2, "utf8");
+    const pinned = parsePinnedVersion(projectContent);
+    const versionForCompare = pinned ?? kitVersion;
+    const templateContent = applyCommandPlaceholders(templateRaw, versionForCompare);
+    if (projectContent === templateContent) {
+      files.push({
+        name,
+        status: "unchanged",
+        pinned_version: pinned,
+        kit_version: kitVersion
+      });
+    } else {
+      files.push({
+        name,
+        status: "drifted",
+        pinned_version: pinned,
+        kit_version: kitVersion,
+        diff: unifiedDiff(name, projectContent, templateContent)
+      });
+    }
+  }
+  for (const name of projectFiles) {
+    if (seen.has(name)) continue;
+    files.push({ name, status: "extra", kit_version: kitVersion });
+  }
+  const order = {
+    drifted: 0,
+    missing: 1,
+    extra: 2,
+    unchanged: 3
+  };
+  files.sort((a, b) => order[a.status] - order[b.status] || a.name.localeCompare(b.name));
+  const hasDrift = files.some((f3) => f3.status === "drifted" || f3.status === "missing");
+  return { overall: hasDrift ? "drift" : "ok", files };
+}
+function readKitVersionFromCommandsDir(kitCommandsDir) {
+  let dir = kitCommandsDir;
+  for (let i2 = 0; i2 < 5; i2++) {
+    dir = path28.dirname(dir);
+  }
+  try {
+    const raw = fs30.readFileSync(path28.join(dir, "package.json"), "utf-8");
+    const pkg = JSON.parse(raw);
+    return typeof pkg.version === "string" ? pkg.version : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function detectScaffoldedDrift(args) {
+  const workflows = detectWorkflowDrift(args);
+  const commands = detectCommandDrift(args);
+  return {
+    overall: workflows.overall === "drift" || commands.overall === "drift" ? "drift" : "ok",
+    workflows,
+    commands
+  };
+}
+function updateWorkflows(args) {
+  const projectWorkflowsDir = path28.join(
+    args.projectDir,
+    ".github",
+    "workflows"
+  );
+  const here = path28.dirname(new URL(importMetaUrl).pathname);
+  const kitWorkflowsDir = args.kitDir ? path28.join(
+    args.kitDir,
+    "templates",
+    "project",
+    "common",
+    ".github",
+    "workflows"
+  ) : findKitTemplatesDir(here);
+  const substitute = args.substitute !== false;
+  const dryRun = args.dryRun === true;
+  const pruneExtras = args.pruneExtras === true;
+  const templateFiles = fs30.existsSync(kitWorkflowsDir) ? fs30.readdirSync(kitWorkflowsDir).filter((f3) => f3.endsWith(".yml")) : [];
+  const projectFiles = fs30.existsSync(projectWorkflowsDir) ? fs30.readdirSync(projectWorkflowsDir).filter((f3) => f3.endsWith(".yml")) : [];
+  if (!dryRun && templateFiles.length > 0 && !fs30.existsSync(projectWorkflowsDir)) {
+    fs30.mkdirSync(projectWorkflowsDir, { recursive: true });
+  }
+  const version = substitute ? readKitVersion(kitWorkflowsDir) : "";
+  const seen = /* @__PURE__ */ new Set();
+  const files = [];
+  for (const name of templateFiles) {
+    seen.add(name);
+    const projectPath2 = path28.join(projectWorkflowsDir, name);
+    const templatePath = path28.join(kitWorkflowsDir, name);
+    const templateRaw = fs30.readFileSync(templatePath, "utf-8");
+    const desired = substitute ? applyPlaceholders(templateRaw, version) : templateRaw;
+    const existed = fs30.existsSync(projectPath2);
+    const current = existed ? fs30.readFileSync(projectPath2, "utf-8") : "";
+    let outcome;
+    if (!existed) {
+      outcome = "added";
+    } else if (current === desired) {
+      outcome = "unchanged";
+    } else {
+      outcome = "updated";
+    }
+    if (!dryRun && outcome !== "unchanged") {
+      fs30.writeFileSync(projectPath2, desired);
+    }
+    files.push({ name, outcome });
+  }
+  if (pruneExtras) {
+    for (const name of projectFiles) {
+      if (seen.has(name)) continue;
+      const projectPath2 = path28.join(projectWorkflowsDir, name);
+      if (!dryRun) {
+        fs30.unlinkSync(projectPath2);
+      }
+      files.push({ name, outcome: "removed" });
+    }
+  }
+  const order = {
+    added: 0,
+    updated: 1,
+    removed: 2,
+    unchanged: 3
+  };
+  files.sort((a, b) => order[a.outcome] - order[b.outcome] || a.name.localeCompare(b.name));
+  const changed = files.some((f3) => f3.outcome !== "unchanged");
+  return { files, changed };
+}
+
+// scripts/lakebase/scm-merge.ts
+async function reconcileTierToOrigin(args) {
+  const { cwd, tier } = args;
+  try {
+    const head = await getCurrentBranch({ cwd });
+    if (head === tier) {
+      await exec2(`git pull --ff-only`, { cwd, timeout: 3e4 });
+    } else {
+      await exec2(`git fetch origin ${shellEscape2(`${tier}:${tier}`)}`, { cwd, timeout: 3e4 });
+    }
+    return null;
+  } catch (err) {
+    return `local reconcile of ${tier} to origin/${tier} failed: ${err instanceof Error ? err.message : String(err)}. Reconcile it by hand (git checkout ${tier} && git pull --ff-only).`;
+  }
+}
+var ScmMergeError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "ScmMergeError";
+  }
+  code;
+};
+var DEFAULT_MIGRATE_TIMEOUT_MS = 30 * 60 * 1e3;
+var DEFAULT_MIGRATE_POLL_MS = 30 * 1e3;
+function defaultMigratePredicate(run, mergedAt) {
+  if (!run.createdAt) return false;
+  const created = Date.parse(run.createdAt);
+  if (!Number.isFinite(created)) return false;
+  if (run.event && run.event !== "push") return false;
+  return created >= mergedAt.getTime() - 5e3;
+}
+function shaMigratePredicate(mergeCommitSha) {
+  return (run) => {
+    if (run.event && run.event !== "push") return false;
+    return !!run.headSha && run.headSha === mergeCommitSha;
+  };
+}
+async function defaultRefreshPromoteWorkflows(projectDir) {
+  const drift = detectWorkflowDrift({ projectDir });
+  const touched = drift.files.filter((f3) => f3.status === "drifted").map((f3) => f3.name);
+  if (touched.length === 0) return { refreshed: false };
+  const result = updateWorkflows({ projectDir });
+  if (!result.changed) return { refreshed: false };
+  await exec2(`git add ${shellEscape2(".github/workflows")}`, { cwd: projectDir, timeout: 1e4 });
+  const staged = await exec2("git diff --cached --name-only -- .github/workflows", {
+    cwd: projectDir,
+    timeout: 1e4
+  });
+  if (!staged.trim()) return { refreshed: false };
+  await exec2(
+    `git commit -m ${shellEscape2(
+      "chore(ci): refresh scaffolded workflows to pinned substrate (promote uses apply-tier)"
+    )} -- .github/workflows`,
+    { cwd: projectDir, timeout: 15e3 }
+  );
+  await pushCurrentBranchForPr({ cwd: projectDir });
+  return { refreshed: true, detail: `refreshed + pushed ${touched.join(", ") || "workflow(s)"} onto the PR head` };
+}
+async function mergeFeature(args) {
+  const current = readWorkflowState(args.projectDir);
+  if (!current) {
+    throw new ScmMergeError(
+      "No SCM workflow state. wait-ci first.",
+      "no-state-file"
+    );
+  }
+  if (current.state !== "ci-green") {
+    throw new ScmMergeError(
+      `merge refuses state "${current.state}". Allowed predecessor: ci-green.`,
+      "bad-precondition"
+    );
+  }
+  if (!current.pr_url) {
+    throw new ScmMergeError(
+      "ci-green row is missing pr_url; cannot resolve the PR to merge.",
+      "no-pr-url"
+    );
+  }
+  if (!current.branch || !current.parent_branch) {
+    throw new ScmMergeError(
+      "ci-green row missing branch / parent_branch; refusing to merge.",
+      "bad-precondition"
+    );
+  }
+  const ownerRepo = await getOwnerRepo(args.projectDir);
+  if (!ownerRepo) {
+    throw new ScmMergeError(
+      "No GitHub remote found at origin.",
+      "no-github-remote"
+    );
+  }
+  const pullNumber = extractPullNumber(current.pr_url);
+  if (!pullNumber) {
+    throw new ScmMergeError(
+      `Could not extract PR number from URL: ${current.pr_url}`,
+      "bad-pr-url"
+    );
+  }
+  const instance = args.instance ?? current.project_id;
+  const gitBase = await resolveGitBase(current.parent_branch, args.projectDir);
+  const wantMigrate = args.waitMigrate !== false;
+  let authVerified = false;
+  if (wantMigrate && args.verifyMigrateAuth) {
+    const probe = await args.verifyMigrateAuth();
+    if (!probe.ok) {
+      throw new ScmMergeError(
+        `Migrate-auth precondition failed: ${probe.detail ?? "the Databricks credential is not usable"}. Refusing to merge: the downstream migrate would promote git without applying the schema. Refresh your credential (databricks auth login), then re-run.`,
+        "migrate-auth"
+      );
+    }
+    authVerified = true;
+  }
+  const preflightNotes = [];
+  {
+    const refresh = args.refreshWorkflows ?? (() => defaultRefreshPromoteWorkflows(args.projectDir));
+    try {
+      const r2 = await refresh();
+      if (r2.refreshed) {
+        preflightNotes.push(`Refreshed stale CI workflows before merge${r2.detail ? ` (${r2.detail})` : ""}.`);
+      }
+    } catch (err) {
+      preflightNotes.push(
+        `Workflow self-heal skipped (${err instanceof Error ? err.message : String(err)}); if the promote's migrate-target fails on the tier guard, refresh .github/workflows (merge.yml must call 'lakebase-schema-migrate apply-tier').`
+      );
+    }
+  }
+  let paired;
+  try {
+    paired = await mergePairedPullRequest({
+      ownerRepo,
+      pullNumber,
+      lakebaseInstance: instance,
+      method: args.method ?? "squash"
+    });
+  } catch (err) {
+    throw new ScmMergeError(
+      `mergePairedPullRequest failed: ${err instanceof Error ? err.message : String(err)}`,
+      "merge-failed"
+    );
+  }
+  const warnings = [...preflightNotes, ...paired.warnings];
+  let localBranchDeleted = false;
+  let headAfter = current.branch;
+  if (!args.skipLocalCleanup) {
+    const switchTo = args.switchTo ?? gitBase;
+    const head = await getCurrentBranch({ cwd: args.projectDir });
+    if (head === current.branch) {
+      try {
+        await exec2(`git checkout ${shellEscape2(switchTo)}`, {
+          cwd: args.projectDir,
+          timeout: 1e4
+        });
         headAfter = switchTo;
         try {
           await exec2(`git fetch origin ${shellEscape2(switchTo)}`, {
@@ -95520,7 +95898,7 @@ init_cjs_shims();
 
 // scripts/git/branches.ts
 init_cjs_shims();
-async function currentBranchName(cwd) {
+async function currentBranchName2(cwd) {
   try {
     return await exec2("git rev-parse --abbrev-ref HEAD", { cwd });
   } catch {
@@ -95539,7 +95917,7 @@ async function listLocalBranches(args) {
     return [];
   }
   if (!raw) return [];
-  const current = await currentBranchName(cwd);
+  const current = await currentBranchName2(cwd);
   return raw.split("\n").filter(Boolean).map((line) => {
     const [name, tracking, trackInfo] = line.split("|");
     let ahead = 0;
@@ -95739,15 +96117,15 @@ function parentForTopology(t2, defaultLeaf) {
 
 // scripts/lakebase/scm-doctor.ts
 init_cjs_shims();
-var fs30 = __toESM(require("fs"), 1);
-var path28 = __toESM(require("path"), 1);
+var fs31 = __toESM(require("fs"), 1);
+var path29 = __toESM(require("path"), 1);
 var FEATURE_PREFIX = "feature/";
 var TIER_LEAFS2 = DEFAULT_PROTECTED_TIER_NAMES;
 function readEnv(projectDir) {
-  const envPath = path28.join(projectDir, ".env");
+  const envPath = path29.join(projectDir, ".env");
   const out = /* @__PURE__ */ new Map();
-  if (!fs30.existsSync(envPath)) return out;
-  const lines = fs30.readFileSync(envPath, "utf8").split("\n");
+  if (!fs31.existsSync(envPath)) return out;
+  const lines = fs31.readFileSync(envPath, "utf8").split("\n");
   for (const line of lines) {
     const m2 = line.match(/^\s*([A-Z0-9_]+)\s*=\s*(.+?)\s*$/);
     if (m2) out.set(m2[1], m2[2].replace(/^["']|["']$/g, ""));
@@ -95793,622 +96171,337 @@ async function runDoctor(args, deps = {}) {
         findings.push({
           id: "github-actions-disabled",
           severity: "warn",
-          message: `GitHub Actions is disabled for ${ownerRepo}, so the kit's CI workflows (pr.yml / merge.yml) will never run , the PR branch's migrations, tests, and schema-diff comment are all skipped. This is commonly an org-level policy on EMU repos, which a repo admin cannot override.`,
-          suggestion: "Have an org owner enable Actions for this repo (repo Settings -> Actions -> General; if it says 'disabled by the organization', it must be enabled in the org's Actions policy). Until then, run the workflow steps locally: scripts/run-tests.sh against a Lakebase branch."
-        });
-      }
-    }
-  } catch {
-  }
-  for (const wf of ["pr.yml", "merge.yml"]) {
-    try {
-      const p = path28.join(projectDir, ".github", "workflows", wf);
-      if (!fs30.existsSync(p)) continue;
-      const body = fs30.readFileSync(p, "utf8");
-      if (/lakebase-scm-utils#v\d/.test(body)) {
-        findings.push({
-          id: "ci-workflow-substrate-pin",
-          severity: "warn",
-          message: `.github/workflows/${wf} hardcodes a substrate version pin (github:databricks-solutions/lakebase-scm-utils#v<ver>) instead of resolving .lakebase/scm-utils-ref at runtime, so bumping .lakebase/scm-utils-ref does NOT change the substrate CI actually runs.`,
-          suggestion: "Re-emit the workflows from the current substrate templates so they resolve SCM_UTILS_REF from .lakebase/scm-utils-ref at CI time (updateWorkflows in scripts/lakebase/workflow-drift.ts; lakebase-doctor reports this as workflow-drift). Until then a scm-utils-ref bump will not reach CI."
-        });
-      }
-    } catch {
-    }
-  }
-  try {
-    if (isGitTracked(projectDir, ".lakebase/workflow-state.json")) {
-      findings.push({
-        id: "scm-state-git-tracked",
-        severity: "warn",
-        message: ".lakebase/workflow-state.json (the per-working-tree SCM claim state) is git-tracked, so a branch checkout or `git reset --hard origin/<tier>` can restore a stale committed claim over the live one (the foreign-claim guard then refuses to drive until you abandon + reclaim).",
-        suggestion: "If a wrong-feature-claim refusal follows a checkout, run lakebase-scm-adopt-state (or abandon + reclaim) to re-establish the live claim. The kit-ref run pin (.lakebase/kit-ref.local) already protects the kit version from the same checkout revert."
-      });
-    }
-  } catch {
-  }
-  if (!env.has("LAKEBASE_PROJECT_ID")) {
-    findings.push({
-      id: "env-missing-project-id",
-      severity: "fail",
-      message: ".env does not contain LAKEBASE_PROJECT_ID. The post-checkout hook will exit early; workflow CLIs will need an explicit --instance.",
-      suggestion: "Set LAKEBASE_PROJECT_ID=<your project id> in .env"
-    });
-  }
-  if (!instance) {
-    return finalize({
-      projectDir,
-      workflowStatePresent,
-      state: state ?? void 0,
-      findings
-    });
-  }
-  let lakebaseBranches = [];
-  try {
-    lakebaseBranches = await listBranches({ instance });
-  } catch (err) {
-    findings.push({
-      id: "lakebase-unreachable",
-      severity: "fail",
-      message: `Could not list Lakebase branches for instance ${instance}: ${err instanceof Error ? err.message : String(err)}`,
-      suggestion: "databricks auth login (or check DATABRICKS_CONFIG_PROFILE)."
-    });
-    return finalize({
-      projectDir,
-      workflowStatePresent,
-      state: state ?? void 0,
-      findings
-    });
-  }
-  const inferredTopology = inferTierTopology(lakebaseBranches);
-  if (state && state.tier_topology !== inferredTopology) {
-    findings.push({
-      id: "tier-topology-mismatch",
-      severity: "warn",
-      message: `workflow-state records tier_topology=${state.tier_topology}, but the Lakebase tier inventory suggests ${inferredTopology}.`,
-      suggestion: "lakebase-scm-adopt-state --force"
-    });
-  }
-  const headBranch = await getCurrentBranch({ cwd: projectDir });
-  if (state && state.state === "feature-claimed") {
-    if (state.branch && headBranch && headBranch !== state.branch) {
-      findings.push({
-        id: "head-branch-drift",
-        severity: "warn",
-        message: `workflow says feature-claimed for "${state.branch}", but HEAD is on "${headBranch}".`,
-        suggestion: `git checkout '${state.branch}'`
-      });
-    }
-    if (state.branch) {
-      const sanitized = sanitizeBranchName(state.branch);
-      let pair;
-      try {
-        pair = await getBranchByName(sanitized, { instance });
-      } catch {
-        pair = void 0;
-      }
-      if (!pair) {
-        findings.push({
-          id: "lakebase-pair-missing",
-          severity: "fail",
-          message: `workflow says feature-claimed for "${state.branch}", but no Lakebase branch "${sanitized}" exists.`,
-          suggestion: `lakebase-scm-abandon-feature  # reset state; re-claim if needed`
-        });
-      } else if (state.lakebase_branch_uid && pair.uid !== state.lakebase_branch_uid) {
-        findings.push({
-          id: "lakebase-uid-drift",
-          severity: "warn",
-          message: `workflow records lakebase_branch_uid=${state.lakebase_branch_uid}, but the live branch reports ${pair.uid}.`,
-          suggestion: "lakebase-scm-adopt-state --force"
-        });
-      }
-    }
-  }
-  if (state && state.state === "feature-claimed" && state.branch) {
-    const envBranchId = env.get("LAKEBASE_BRANCH_ID");
-    const sanitized = sanitizeBranchName(state.branch);
-    if (envBranchId && envBranchId !== sanitized) {
-      findings.push({
-        id: "env-branch-drift",
-        severity: "warn",
-        message: `.env LAKEBASE_BRANCH_ID=${envBranchId} but workflow says ${sanitized}. The post-checkout hook may not have run since the last branch switch.`,
-        suggestion: `git checkout '${state.branch}'  # re-fires post-checkout`
-      });
-    }
-  }
-  if (headBranch && !TIER_LEAFS2.has(headBranch) && headBranch.startsWith(FEATURE_PREFIX)) {
-    const sanitized = sanitizeBranchName(headBranch);
-    const paired = lakebaseBranches.some((b) => leafOf2(b) === sanitized);
-    if (!paired) {
-      findings.push({
-        id: "orphan-current-branch",
-        severity: "fail",
-        message: `Current git branch "${headBranch}" has no Lakebase pair (post-checkout fallback retired in phase C).`,
-        suggestion: `lakebase-scm-recover-orphans --claim --only-branch '${headBranch}'`
-      });
-    }
-  }
-  try {
-    const heads = await collapseMigrationHeads({ projectDir, dryRun: true });
-    if (heads.headsBefore.length > 1) {
-      findings.push({
-        id: "multiple-migration-heads",
-        severity: "fail",
-        message: `Migrations have ${heads.headsBefore.length} heads (${heads.headsBefore.join(", ")}); a sibling-feature merge left them un-collapsed. \`upgrade head\` will refuse until they are unified.`,
-        suggestion: "lakebase-collapse-heads"
-      });
-    }
-  } catch {
-  }
-  if (instance && state?.branch) {
-    try {
-      const localIds = listSchemaMigrations({ projectDir }).map((m2) => m2.version);
-      let orphanRev = null;
-      try {
-        const status = await schemaMigrationStatus({ instance, branch: state.branch, projectDir });
-        if (dbRevisionOrphaned(status.current, localIds)) orphanRev = status.current ?? null;
-      } catch (e2) {
-        orphanRev = parseAlembicMissingRevision(e2 instanceof Error ? e2.message : String(e2));
-      }
-      if (orphanRev) {
-        findings.push({
-          id: "db-ahead-of-code",
-          severity: "fail",
-          message: `The paired branch DB is AHEAD of code: applied revision '${orphanRev}' has no local migration file. An aborted build likely migrated this branch and a git reset removed the migration file; alembic accept/deploy/promote will fail "Can't locate revision".`,
-          suggestion: "reset the paired branch DB to the code head (downgrade/stamp + drop reset-created tables), or delete the branch and re-cut it clean from its tier"
-        });
-      }
-    } catch {
-    }
-  }
-  return finalize({
-    projectDir,
-    workflowStatePresent,
-    state: state ?? void 0,
-    inferredTierTopology: inferredTopology,
-    findings
-  });
-}
-function finalize(report) {
-  let worst = "ok";
-  for (const f3 of report.findings) {
-    worst = worstOf(worst, f3.severity);
-  }
-  return { ...report, worstSeverity: worst };
-}
-var ScmDoctorFixError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "ScmDoctorFixError";
-  }
-  code;
-};
-var FIXABLE_FINDING_IDS = [
-  "env-branch-drift",
-  "head-branch-drift",
-  "tier-topology-mismatch",
-  "orphan-current-branch",
-  "multiple-migration-heads",
-  "db-ahead-of-code"
-];
-async function fixFinding(args) {
-  if (!FIXABLE_FINDING_IDS.includes(args.findingId)) {
-    throw new ScmDoctorFixError(
-      `Finding "${args.findingId}" is not supported by --fix. Supported: ${FIXABLE_FINDING_IDS.join(", ")}.`,
-      "unsupported-finding"
-    );
-  }
-  const report = args.report ?? await runDoctor({ projectDir: args.projectDir, instance: args.instance });
-  const present = report.findings.find((f3) => f3.id === args.findingId);
-  if (!present) {
-    throw new ScmDoctorFixError(
-      `Finding "${args.findingId}" is not present in the current report. Re-run lakebase-scm-doctor to see what needs fixing.`,
-      "finding-not-present"
-    );
-  }
-  let action = "";
-  try {
-    switch (args.findingId) {
-      case "env-branch-drift": {
-        const branch = report.state?.branch;
-        if (!branch) {
-          throw new ScmDoctorFixError(
-            "Cannot fix: workflow state has no branch field.",
-            "fix-failed"
-          );
-        }
-        const sanitized = sanitizeBranchName(branch);
-        const envFile = path28.join(args.projectDir, ".env");
-        updateEnvConnection({
-          envPath: envFile,
-          projectId: readEnvVar(envFile, "LAKEBASE_PROJECT_ID") ?? "",
-          branchId: sanitized,
-          username: readEnvVar(envFile, "DB_USERNAME") ?? "",
-          endpointHost: readEnvVar(envFile, "LAKEBASE_HOST")
-        });
-        action = `rewrote .env LAKEBASE_BRANCH_ID=${sanitized} (metadata only; the app mints its token at runtime)`;
-        break;
-      }
-      case "head-branch-drift": {
-        const branch = report.state?.branch;
-        if (!branch) {
-          throw new ScmDoctorFixError(
-            "Cannot fix: workflow state has no branch field.",
-            "fix-failed"
-          );
-        }
-        await exec2(`git checkout ${shellEscape3(branch)}`, {
-          cwd: args.projectDir,
-          timeout: 15e3
-        });
-        action = `git checkout ${branch} (re-fires post-checkout to resync HEAD)`;
-        break;
-      }
-      case "tier-topology-mismatch": {
-        const instance = args.instance ?? report.state?.project_id;
-        if (!instance) {
-          throw new ScmDoctorFixError(
-            "Cannot fix: missing Lakebase project id.",
-            "fix-failed"
-          );
-        }
-        await adoptScmState({
-          projectDir: args.projectDir,
-          instance,
-          force: true
-        });
-        action = `adopted state with --force to re-infer tier_topology`;
-        break;
-      }
-      case "orphan-current-branch": {
-        const instance = args.instance ?? report.state?.project_id;
-        if (!instance) {
-          throw new ScmDoctorFixError(
-            "Cannot fix: missing Lakebase project id.",
-            "fix-failed"
-          );
-        }
-        const headBranch = await getCurrentBranch({ cwd: args.projectDir });
-        if (!headBranch) {
-          throw new ScmDoctorFixError(
-            "Cannot fix: detached HEAD or no current branch.",
-            "fix-failed"
-          );
-        }
-        await recoverOrphans({
-          projectDir: args.projectDir,
-          instance,
-          claim: true,
-          onlyBranch: headBranch
-        });
-        action = `recovered orphan ${headBranch} via createFeaturePairedBranch`;
-        break;
-      }
-      case "multiple-migration-heads": {
-        const r2 = await collapseMigrationHeads({ projectDir: args.projectDir });
-        if (r2.status !== "ok" || !r2.mergeRevision) {
-          throw new ScmDoctorFixError(
-            `Expected to create a merge revision but got status="${r2.status}".`,
-            "fix-failed"
-          );
-        }
-        action = `collapsed ${r2.headsBefore.length} heads into merge revision ${r2.mergeRevision} (commit it)`;
-        break;
-      }
-      case "db-ahead-of-code": {
-        const r2 = await abandonFeatureBranch({ projectDir: args.projectDir, instance: args.instance, force: true });
-        action = `abandoned the feature (deleted the polluted paired branch${r2.lakebaseDeleted ? "" : " , Lakebase delete reported not-deleted"}) and reset state to '${r2.state.state}'; re-claim to re-fork a clean branch from the tier`;
-        break;
-      }
-    }
-  } catch (err) {
-    if (err instanceof ScmDoctorFixError) throw err;
-    throw new ScmDoctorFixError(
-      `Remediation failed: ${err instanceof Error ? err.message : String(err)}`,
-      "fix-failed"
-    );
-  }
-  const postReport = await runDoctor({
-    projectDir: args.projectDir,
-    instance: args.instance
-  });
-  return { findingId: args.findingId, action, postReport };
-}
-function shellEscape3(s2) {
-  return `'${s2.replace(/'/g, "'\\''")}'`;
-}
-
-// scripts/lakebase/doctor.ts
-init_cjs_shims();
-var fs32 = __toESM(require("fs"), 1);
-var path30 = __toESM(require("path"), 1);
-var cp6 = __toESM(require("child_process"), 1);
-
-// scripts/lakebase/workflow-drift.ts
-init_cjs_shims();
-var fs31 = __toESM(require("fs"), 1);
-var path29 = __toESM(require("path"), 1);
-function findKitTemplatesDir(start) {
-  let dir = start;
-  for (let i2 = 0; i2 < 6; i2++) {
-    const candidate = path29.join(
-      dir,
-      "templates",
-      "project",
-      "common",
-      ".github",
-      "workflows"
-    );
-    if (fs31.existsSync(candidate)) return candidate;
-    const parent = path29.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  throw new Error(
-    `Could not locate templates/project/common/.github/workflows/ relative to ${start}. Pass explicit kitDir.`
-  );
-}
-function unifiedDiff(name, projectContent, templateContent) {
-  if (projectContent === templateContent) return "";
-  const a = projectContent.split("\n");
-  const b = templateContent.split("\n");
-  const out = [`--- project/${name}`, `+++ template/${name}`];
-  const max = Math.max(a.length, b.length);
-  for (let i2 = 0; i2 < max; i2++) {
-    const av = a[i2];
-    const bv = b[i2];
-    if (av === bv) continue;
-    if (av !== void 0) out.push(`-${i2 + 1}: ${av}`);
-    if (bv !== void 0) out.push(`+${i2 + 1}: ${bv}`);
-  }
-  return out.join("\n");
-}
-function detectWorkflowDrift(args) {
-  const projectWorkflowsDir = path29.join(
-    args.projectDir,
-    ".github",
-    "workflows"
-  );
-  const here = path29.dirname(new URL(importMetaUrl).pathname);
-  const kitWorkflowsDir = args.kitDir ? path29.join(
-    args.kitDir,
-    "templates",
-    "project",
-    "common",
-    ".github",
-    "workflows"
-  ) : findKitTemplatesDir(here);
-  const templateFiles = fs31.existsSync(kitWorkflowsDir) ? fs31.readdirSync(kitWorkflowsDir).filter((f3) => f3.endsWith(".yml")) : [];
-  const projectFiles = fs31.existsSync(projectWorkflowsDir) ? fs31.readdirSync(projectWorkflowsDir).filter((f3) => f3.endsWith(".yml")) : [];
-  const version = readKitVersion(kitWorkflowsDir);
-  const seen = /* @__PURE__ */ new Set();
-  const files = [];
-  for (const name of templateFiles) {
-    seen.add(name);
-    const projectPath2 = path29.join(projectWorkflowsDir, name);
-    const templatePath = path29.join(kitWorkflowsDir, name);
-    if (!fs31.existsSync(projectPath2)) {
-      files.push({ name, status: "missing" });
-      continue;
+          message: `GitHub Actions is disabled for ${ownerRepo}, so the kit's CI workflows (pr.yml / merge.yml) will never run , the PR branch's migrations, tests, and schema-diff comment are all skipped. This is commonly an org-level policy on EMU repos, which a repo admin cannot override.`,
+          suggestion: "Have an org owner enable Actions for this repo (repo Settings -> Actions -> General; if it says 'disabled by the organization', it must be enabled in the org's Actions policy). Until then, run the workflow steps locally: scripts/run-tests.sh against a Lakebase branch."
+        });
+      }
     }
-    const projectContent = fs31.readFileSync(projectPath2, "utf8");
-    const templateContent = applyPlaceholders(fs31.readFileSync(templatePath, "utf8"), version);
-    if (projectContent === templateContent) {
-      files.push({ name, status: "unchanged" });
-    } else {
-      files.push({
-        name,
-        status: "drifted",
-        diff: unifiedDiff(name, projectContent, templateContent)
+  } catch {
+  }
+  for (const wf of ["pr.yml", "merge.yml"]) {
+    try {
+      const p = path29.join(projectDir, ".github", "workflows", wf);
+      if (!fs31.existsSync(p)) continue;
+      const body = fs31.readFileSync(p, "utf8");
+      if (/lakebase-scm-utils#v\d/.test(body)) {
+        findings.push({
+          id: "ci-workflow-substrate-pin",
+          severity: "warn",
+          message: `.github/workflows/${wf} hardcodes a substrate version pin (github:databricks-solutions/lakebase-scm-utils#v<ver>) instead of resolving .lakebase/scm-utils-ref at runtime, so bumping .lakebase/scm-utils-ref does NOT change the substrate CI actually runs.`,
+          suggestion: "Re-emit the workflows from the current substrate templates so they resolve SCM_UTILS_REF from .lakebase/scm-utils-ref at CI time (updateWorkflows in scripts/lakebase/workflow-drift.ts; lakebase-doctor reports this as workflow-drift). Until then a scm-utils-ref bump will not reach CI."
+        });
+      }
+    } catch {
+    }
+  }
+  try {
+    if (isGitTracked(projectDir, ".lakebase/workflow-state.json")) {
+      findings.push({
+        id: "scm-state-git-tracked",
+        severity: "warn",
+        message: ".lakebase/workflow-state.json (the per-working-tree SCM claim state) is git-tracked, so a branch checkout or `git reset --hard origin/<tier>` can restore a stale committed claim over the live one (the foreign-claim guard then refuses to drive until you abandon + reclaim).",
+        suggestion: "If a wrong-feature-claim refusal follows a checkout, run lakebase-scm-adopt-state (or abandon + reclaim) to re-establish the live claim. The kit-ref run pin (.lakebase/kit-ref.local) already protects the kit version from the same checkout revert."
       });
     }
+  } catch {
   }
-  for (const name of projectFiles) {
-    if (seen.has(name)) continue;
-    files.push({ name, status: "extra" });
+  if (!env.has("LAKEBASE_PROJECT_ID")) {
+    findings.push({
+      id: "env-missing-project-id",
+      severity: "fail",
+      message: ".env does not contain LAKEBASE_PROJECT_ID. The post-checkout hook will exit early; workflow CLIs will need an explicit --instance.",
+      suggestion: "Set LAKEBASE_PROJECT_ID=<your project id> in .env"
+    });
   }
-  const order = {
-    drifted: 0,
-    missing: 1,
-    extra: 2,
-    unchanged: 3
-  };
-  files.sort((a, b) => order[a.status] - order[b.status] || a.name.localeCompare(b.name));
-  const hasDrift = files.some((f3) => f3.status === "drifted" || f3.status === "missing");
-  return {
-    overall: hasDrift ? "drift" : "ok",
-    files
-  };
-}
-function readKitVersion(kitWorkflowsDir) {
-  let dir = kitWorkflowsDir;
-  for (let i2 = 0; i2 < 5; i2++) {
-    dir = path29.dirname(dir);
+  if (!instance) {
+    return finalize({
+      projectDir,
+      workflowStatePresent,
+      state: state ?? void 0,
+      findings
+    });
   }
+  let lakebaseBranches = [];
   try {
-    const raw = fs31.readFileSync(path29.join(dir, "package.json"), "utf-8");
-    const pkg = JSON.parse(raw);
-    return typeof pkg.version === "string" ? pkg.version : "unknown";
-  } catch {
-    return "unknown";
+    lakebaseBranches = await listBranches({ instance });
+  } catch (err) {
+    findings.push({
+      id: "lakebase-unreachable",
+      severity: "fail",
+      message: `Could not list Lakebase branches for instance ${instance}: ${err instanceof Error ? err.message : String(err)}`,
+      suggestion: "databricks auth login (or check DATABRICKS_CONFIG_PROFILE)."
+    });
+    return finalize({
+      projectDir,
+      workflowStatePresent,
+      state: state ?? void 0,
+      findings
+    });
   }
-}
-function applyPlaceholders(content, version) {
-  return content.replace(/\{\{LAKEBASE_SCM_UTILS_VERSION\}\}/g, version);
-}
-function applyCommandPlaceholders(content, version) {
-  return content.replace(/\$\{KIT_VERSION_AT_SCAFFOLD\}/g, version);
-}
-var COMMAND_HOOK_FILE_PATTERN = /\.(pre|post)-hook\.md$/;
-function findKitCommandsDir(start) {
-  let dir = start;
-  for (let i2 = 0; i2 < 6; i2++) {
-    const candidate = path29.join(
-      dir,
-      "templates",
-      "project",
-      "common",
-      ".claude",
-      "commands"
-    );
-    if (fs31.existsSync(candidate)) return candidate;
-    const parent = path29.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
+  const inferredTopology = inferTierTopology(lakebaseBranches);
+  if (state && state.tier_topology !== inferredTopology) {
+    findings.push({
+      id: "tier-topology-mismatch",
+      severity: "warn",
+      message: `workflow-state records tier_topology=${state.tier_topology}, but the Lakebase tier inventory suggests ${inferredTopology}.`,
+      suggestion: "lakebase-scm-adopt-state --force"
+    });
   }
-  throw new Error(
-    `Could not locate templates/project/common/.claude/commands/ relative to ${start}. Pass explicit kitDir.`
-  );
-}
-function parsePinnedVersion(content) {
-  const m2 = content.match(/^\s*[*_>`\s]*pinned\s+to\s*:\s*[`*_]*([^\s`*_]+)[`*_]*\s*$/im);
-  return m2 ? m2[1] : void 0;
-}
-function detectCommandDrift(args) {
-  const projectCommandsDir = path29.join(args.projectDir, ".claude", "commands");
-  const here = path29.dirname(new URL(importMetaUrl).pathname);
-  const kitCommandsDir = args.kitDir ? path29.join(args.kitDir, "templates", "project", "common", ".claude", "commands") : findKitCommandsDir(here);
-  const kitVersion = readKitVersionFromCommandsDir(kitCommandsDir);
-  const templateFiles = fs31.existsSync(kitCommandsDir) ? fs31.readdirSync(kitCommandsDir).filter((f3) => f3.endsWith(".md") && !COMMAND_HOOK_FILE_PATTERN.test(f3)) : [];
-  const projectFiles = fs31.existsSync(projectCommandsDir) ? fs31.readdirSync(projectCommandsDir).filter((f3) => f3.endsWith(".md") && !COMMAND_HOOK_FILE_PATTERN.test(f3)) : [];
-  const seen = /* @__PURE__ */ new Set();
-  const files = [];
-  for (const name of templateFiles) {
-    seen.add(name);
-    const projectPath2 = path29.join(projectCommandsDir, name);
-    const templatePath = path29.join(kitCommandsDir, name);
-    const templateRaw = fs31.readFileSync(templatePath, "utf8");
-    if (!fs31.existsSync(projectPath2)) {
-      files.push({ name, status: "missing", kit_version: kitVersion });
-      continue;
-    }
-    const projectContent = fs31.readFileSync(projectPath2, "utf8");
-    const pinned = parsePinnedVersion(projectContent);
-    const versionForCompare = pinned ?? kitVersion;
-    const templateContent = applyCommandPlaceholders(templateRaw, versionForCompare);
-    if (projectContent === templateContent) {
-      files.push({
-        name,
-        status: "unchanged",
-        pinned_version: pinned,
-        kit_version: kitVersion
-      });
-    } else {
-      files.push({
-        name,
-        status: "drifted",
-        pinned_version: pinned,
-        kit_version: kitVersion,
-        diff: unifiedDiff(name, projectContent, templateContent)
+  const headBranch = await getCurrentBranch({ cwd: projectDir });
+  if (state && state.state === "feature-claimed") {
+    if (state.branch && headBranch && headBranch !== state.branch) {
+      findings.push({
+        id: "head-branch-drift",
+        severity: "warn",
+        message: `workflow says feature-claimed for "${state.branch}", but HEAD is on "${headBranch}".`,
+        suggestion: `git checkout '${state.branch}'`
       });
     }
+    if (state.branch) {
+      const sanitized = sanitizeBranchName(state.branch);
+      let pair;
+      try {
+        pair = await getBranchByName(sanitized, { instance });
+      } catch {
+        pair = void 0;
+      }
+      if (!pair) {
+        findings.push({
+          id: "lakebase-pair-missing",
+          severity: "fail",
+          message: `workflow says feature-claimed for "${state.branch}", but no Lakebase branch "${sanitized}" exists.`,
+          suggestion: `lakebase-scm-abandon-feature  # reset state; re-claim if needed`
+        });
+      } else if (state.lakebase_branch_uid && pair.uid !== state.lakebase_branch_uid) {
+        findings.push({
+          id: "lakebase-uid-drift",
+          severity: "warn",
+          message: `workflow records lakebase_branch_uid=${state.lakebase_branch_uid}, but the live branch reports ${pair.uid}.`,
+          suggestion: "lakebase-scm-adopt-state --force"
+        });
+      }
+    }
   }
-  for (const name of projectFiles) {
-    if (seen.has(name)) continue;
-    files.push({ name, status: "extra", kit_version: kitVersion });
+  if (state && state.state === "feature-claimed" && state.branch) {
+    const envBranchId = env.get("LAKEBASE_BRANCH_ID");
+    const sanitized = sanitizeBranchName(state.branch);
+    if (envBranchId && envBranchId !== sanitized) {
+      findings.push({
+        id: "env-branch-drift",
+        severity: "warn",
+        message: `.env LAKEBASE_BRANCH_ID=${envBranchId} but workflow says ${sanitized}. The post-checkout hook may not have run since the last branch switch.`,
+        suggestion: `git checkout '${state.branch}'  # re-fires post-checkout`
+      });
+    }
   }
-  const order = {
-    drifted: 0,
-    missing: 1,
-    extra: 2,
-    unchanged: 3
-  };
-  files.sort((a, b) => order[a.status] - order[b.status] || a.name.localeCompare(b.name));
-  const hasDrift = files.some((f3) => f3.status === "drifted" || f3.status === "missing");
-  return { overall: hasDrift ? "drift" : "ok", files };
-}
-function readKitVersionFromCommandsDir(kitCommandsDir) {
-  let dir = kitCommandsDir;
-  for (let i2 = 0; i2 < 5; i2++) {
-    dir = path29.dirname(dir);
+  if (headBranch && !TIER_LEAFS2.has(headBranch) && headBranch.startsWith(FEATURE_PREFIX)) {
+    const sanitized = sanitizeBranchName(headBranch);
+    const paired = lakebaseBranches.some((b) => leafOf2(b) === sanitized);
+    if (!paired) {
+      findings.push({
+        id: "orphan-current-branch",
+        severity: "fail",
+        message: `Current git branch "${headBranch}" has no Lakebase pair (post-checkout fallback retired in phase C).`,
+        suggestion: `lakebase-scm-recover-orphans --claim --only-branch '${headBranch}'`
+      });
+    }
   }
   try {
-    const raw = fs31.readFileSync(path29.join(dir, "package.json"), "utf-8");
-    const pkg = JSON.parse(raw);
-    return typeof pkg.version === "string" ? pkg.version : "unknown";
+    const heads = await collapseMigrationHeads({ projectDir, dryRun: true });
+    if (heads.headsBefore.length > 1) {
+      findings.push({
+        id: "multiple-migration-heads",
+        severity: "fail",
+        message: `Migrations have ${heads.headsBefore.length} heads (${heads.headsBefore.join(", ")}); a sibling-feature merge left them un-collapsed. \`upgrade head\` will refuse until they are unified.`,
+        suggestion: "lakebase-collapse-heads"
+      });
+    }
   } catch {
-    return "unknown";
   }
+  if (instance && state?.branch) {
+    try {
+      const localIds = listSchemaMigrations({ projectDir }).map((m2) => m2.version);
+      let orphanRev = null;
+      try {
+        const status = await schemaMigrationStatus({ instance, branch: state.branch, projectDir });
+        if (dbRevisionOrphaned(status.current, localIds)) orphanRev = status.current ?? null;
+      } catch (e2) {
+        orphanRev = parseAlembicMissingRevision(e2 instanceof Error ? e2.message : String(e2));
+      }
+      if (orphanRev) {
+        findings.push({
+          id: "db-ahead-of-code",
+          severity: "fail",
+          message: `The paired branch DB is AHEAD of code: applied revision '${orphanRev}' has no local migration file. An aborted build likely migrated this branch and a git reset removed the migration file; alembic accept/deploy/promote will fail "Can't locate revision".`,
+          suggestion: "reset the paired branch DB to the code head (downgrade/stamp + drop reset-created tables), or delete the branch and re-cut it clean from its tier"
+        });
+      }
+    } catch {
+    }
+  }
+  return finalize({
+    projectDir,
+    workflowStatePresent,
+    state: state ?? void 0,
+    inferredTierTopology: inferredTopology,
+    findings
+  });
 }
-function detectScaffoldedDrift(args) {
-  const workflows = detectWorkflowDrift(args);
-  const commands = detectCommandDrift(args);
-  return {
-    overall: workflows.overall === "drift" || commands.overall === "drift" ? "drift" : "ok",
-    workflows,
-    commands
-  };
+function finalize(report) {
+  let worst = "ok";
+  for (const f3 of report.findings) {
+    worst = worstOf(worst, f3.severity);
+  }
+  return { ...report, worstSeverity: worst };
 }
-function updateWorkflows(args) {
-  const projectWorkflowsDir = path29.join(
-    args.projectDir,
-    ".github",
-    "workflows"
-  );
-  const here = path29.dirname(new URL(importMetaUrl).pathname);
-  const kitWorkflowsDir = args.kitDir ? path29.join(
-    args.kitDir,
-    "templates",
-    "project",
-    "common",
-    ".github",
-    "workflows"
-  ) : findKitTemplatesDir(here);
-  const substitute = args.substitute !== false;
-  const dryRun = args.dryRun === true;
-  const pruneExtras = args.pruneExtras === true;
-  const templateFiles = fs31.existsSync(kitWorkflowsDir) ? fs31.readdirSync(kitWorkflowsDir).filter((f3) => f3.endsWith(".yml")) : [];
-  const projectFiles = fs31.existsSync(projectWorkflowsDir) ? fs31.readdirSync(projectWorkflowsDir).filter((f3) => f3.endsWith(".yml")) : [];
-  if (!dryRun && templateFiles.length > 0 && !fs31.existsSync(projectWorkflowsDir)) {
-    fs31.mkdirSync(projectWorkflowsDir, { recursive: true });
+var ScmDoctorFixError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "ScmDoctorFixError";
   }
-  const version = substitute ? readKitVersion(kitWorkflowsDir) : "";
-  const seen = /* @__PURE__ */ new Set();
-  const files = [];
-  for (const name of templateFiles) {
-    seen.add(name);
-    const projectPath2 = path29.join(projectWorkflowsDir, name);
-    const templatePath = path29.join(kitWorkflowsDir, name);
-    const templateRaw = fs31.readFileSync(templatePath, "utf-8");
-    const desired = substitute ? applyPlaceholders(templateRaw, version) : templateRaw;
-    const existed = fs31.existsSync(projectPath2);
-    const current = existed ? fs31.readFileSync(projectPath2, "utf-8") : "";
-    let outcome;
-    if (!existed) {
-      outcome = "added";
-    } else if (current === desired) {
-      outcome = "unchanged";
-    } else {
-      outcome = "updated";
-    }
-    if (!dryRun && outcome !== "unchanged") {
-      fs31.writeFileSync(projectPath2, desired);
-    }
-    files.push({ name, outcome });
+  code;
+};
+var FIXABLE_FINDING_IDS = [
+  "env-branch-drift",
+  "head-branch-drift",
+  "tier-topology-mismatch",
+  "orphan-current-branch",
+  "multiple-migration-heads",
+  "db-ahead-of-code"
+];
+async function fixFinding(args) {
+  if (!FIXABLE_FINDING_IDS.includes(args.findingId)) {
+    throw new ScmDoctorFixError(
+      `Finding "${args.findingId}" is not supported by --fix. Supported: ${FIXABLE_FINDING_IDS.join(", ")}.`,
+      "unsupported-finding"
+    );
   }
-  if (pruneExtras) {
-    for (const name of projectFiles) {
-      if (seen.has(name)) continue;
-      const projectPath2 = path29.join(projectWorkflowsDir, name);
-      if (!dryRun) {
-        fs31.unlinkSync(projectPath2);
+  const report = args.report ?? await runDoctor({ projectDir: args.projectDir, instance: args.instance });
+  const present = report.findings.find((f3) => f3.id === args.findingId);
+  if (!present) {
+    throw new ScmDoctorFixError(
+      `Finding "${args.findingId}" is not present in the current report. Re-run lakebase-scm-doctor to see what needs fixing.`,
+      "finding-not-present"
+    );
+  }
+  let action = "";
+  try {
+    switch (args.findingId) {
+      case "env-branch-drift": {
+        const branch = report.state?.branch;
+        if (!branch) {
+          throw new ScmDoctorFixError(
+            "Cannot fix: workflow state has no branch field.",
+            "fix-failed"
+          );
+        }
+        const sanitized = sanitizeBranchName(branch);
+        const envFile = path29.join(args.projectDir, ".env");
+        updateEnvConnection({
+          envPath: envFile,
+          projectId: readEnvVar(envFile, "LAKEBASE_PROJECT_ID") ?? "",
+          branchId: sanitized,
+          username: readEnvVar(envFile, "DB_USERNAME") ?? "",
+          endpointHost: readEnvVar(envFile, "LAKEBASE_HOST")
+        });
+        action = `rewrote .env LAKEBASE_BRANCH_ID=${sanitized} (metadata only; the app mints its token at runtime)`;
+        break;
+      }
+      case "head-branch-drift": {
+        const branch = report.state?.branch;
+        if (!branch) {
+          throw new ScmDoctorFixError(
+            "Cannot fix: workflow state has no branch field.",
+            "fix-failed"
+          );
+        }
+        await exec2(`git checkout ${shellEscape3(branch)}`, {
+          cwd: args.projectDir,
+          timeout: 15e3
+        });
+        action = `git checkout ${branch} (re-fires post-checkout to resync HEAD)`;
+        break;
+      }
+      case "tier-topology-mismatch": {
+        const instance = args.instance ?? report.state?.project_id;
+        if (!instance) {
+          throw new ScmDoctorFixError(
+            "Cannot fix: missing Lakebase project id.",
+            "fix-failed"
+          );
+        }
+        await adoptScmState({
+          projectDir: args.projectDir,
+          instance,
+          force: true
+        });
+        action = `adopted state with --force to re-infer tier_topology`;
+        break;
+      }
+      case "orphan-current-branch": {
+        const instance = args.instance ?? report.state?.project_id;
+        if (!instance) {
+          throw new ScmDoctorFixError(
+            "Cannot fix: missing Lakebase project id.",
+            "fix-failed"
+          );
+        }
+        const headBranch = await getCurrentBranch({ cwd: args.projectDir });
+        if (!headBranch) {
+          throw new ScmDoctorFixError(
+            "Cannot fix: detached HEAD or no current branch.",
+            "fix-failed"
+          );
+        }
+        await recoverOrphans({
+          projectDir: args.projectDir,
+          instance,
+          claim: true,
+          onlyBranch: headBranch
+        });
+        action = `recovered orphan ${headBranch} via createFeaturePairedBranch`;
+        break;
+      }
+      case "multiple-migration-heads": {
+        const r2 = await collapseMigrationHeads({ projectDir: args.projectDir });
+        if (r2.status !== "ok" || !r2.mergeRevision) {
+          throw new ScmDoctorFixError(
+            `Expected to create a merge revision but got status="${r2.status}".`,
+            "fix-failed"
+          );
+        }
+        action = `collapsed ${r2.headsBefore.length} heads into merge revision ${r2.mergeRevision} (commit it)`;
+        break;
+      }
+      case "db-ahead-of-code": {
+        const r2 = await abandonFeatureBranch({ projectDir: args.projectDir, instance: args.instance, force: true });
+        action = `abandoned the feature (deleted the polluted paired branch${r2.lakebaseDeleted ? "" : " , Lakebase delete reported not-deleted"}) and reset state to '${r2.state.state}'; re-claim to re-fork a clean branch from the tier`;
+        break;
       }
-      files.push({ name, outcome: "removed" });
     }
+  } catch (err) {
+    if (err instanceof ScmDoctorFixError) throw err;
+    throw new ScmDoctorFixError(
+      `Remediation failed: ${err instanceof Error ? err.message : String(err)}`,
+      "fix-failed"
+    );
   }
-  const order = {
-    added: 0,
-    updated: 1,
-    removed: 2,
-    unchanged: 3
-  };
-  files.sort((a, b) => order[a.outcome] - order[b.outcome] || a.name.localeCompare(b.name));
-  const changed = files.some((f3) => f3.outcome !== "unchanged");
-  return { files, changed };
+  const postReport = await runDoctor({
+    projectDir: args.projectDir,
+    instance: args.instance
+  });
+  return { findingId: args.findingId, action, postReport };
+}
+function shellEscape3(s2) {
+  return `'${s2.replace(/'/g, "'\\''")}'`;
 }
 
 // scripts/lakebase/doctor.ts
+init_cjs_shims();
+var fs32 = __toESM(require("fs"), 1);
+var path30 = __toESM(require("path"), 1);
+var cp6 = __toESM(require("child_process"), 1);
 function readEnvFile(projectDir) {
   const envPath = path30.join(projectDir, ".env");
   if (!fs32.existsSync(envPath)) return {};
@@ -96841,7 +96934,7 @@ function checkWorkflowDrift(projectDir) {
       status: "warn",
       message: `Scaffolded workflows drift from kit: ${drifted} drifted, ${missing} missing`,
       detail: { files: report.files.map((f3) => ({ name: f3.name, status: f3.status })) },
-      hint: "Inspect via the lakebase_workflow_drift MCP tool (or detectWorkflowDrift import). Refresh manually until updateWorkflows lands."
+      hint: "Refresh with updateWorkflows (or the lakebase_workflow_drift MCP tool). A stale merge.yml calling 'lakebase-schema-migrate apply' (not 'apply-tier') makes the promote's migrate-target fail on the tier guard; the scm-merge promote also self-heals drifted workflows onto the PR head before merging."
     };
   } catch (err) {
     return {
@@ -97317,63 +97410,6 @@ async function discardAllChanges(args) {
   await exec2("git clean -fd", { cwd: args.cwd });
 }
 
-// scripts/git/sync.ts
-init_cjs_shims();
-async function currentBranchName2(cwd) {
-  try {
-    return await exec2("git rev-parse --abbrev-ref HEAD", { cwd });
-  } catch {
-    return "";
-  }
-}
-async function push(args) {
-  await exec2("git push", { cwd: args.cwd });
-}
-async function pull(args) {
-  await exec2("git pull", { cwd: args.cwd });
-}
-async function publishBranch(args) {
-  const remote = args.remote ?? "origin";
-  const branch = await currentBranchName2(args.cwd);
-  if (!branch) throw new Error("No current branch");
-  await exec2(`git push -u ${remote} ${shq(branch)}`, {
-    cwd: args.cwd
-  });
-}
-async function pushCurrentBranchForPr(args) {
-  const remote = args.remote ?? "origin";
-  const branch = await currentBranchName2(args.cwd);
-  if (!branch) throw new Error("No current branch");
-  const upstreamSet = await hasUpstream({ cwd: args.cwd });
-  if (!upstreamSet) {
-    await exec2(`git push -u ${remote} ${shq(branch)}`, {
-      cwd: args.cwd
-    });
-  } else {
-    await exec2("git push", { cwd: args.cwd });
-  }
-}
-async function fetch3(args) {
-  const parts = ["git fetch"];
-  if (args.prune) parts.push("--prune");
-  if (args.all) parts.push("--all");
-  await exec2(parts.join(" "), { cwd: args.cwd });
-}
-async function pullFrom(args) {
-  await exec2(`git pull ${shq(args.remote)} ${shq(args.branch)}`, {
-    cwd: args.cwd
-  });
-}
-async function pushTo(args) {
-  await exec2(`git push ${shq(args.remote)} ${shq(args.branch)}`, {
-    cwd: args.cwd
-  });
-}
-async function sync(args) {
-  await exec2("git pull", { cwd: args.cwd });
-  await exec2("git push", { cwd: args.cwd });
-}
-
 // scripts/git/branch-tag.ts
 init_cjs_shims();
 var PROTECTED_BRANCHES = /* @__PURE__ */ new Set(["production", "main", "master"]);
@@ -97779,6 +97815,7 @@ function withProxyEnv(base = {}) {
   createWorktree,
   cutBackup,
   databricksAuthPrereqMessage,
+  defaultRefreshPromoteWorkflows,
   delay,
   deleteAppEndpoint,
   deleteBranch,