@databricks-solutions/lakebase-scm-utils 0.3.10 → 0.3.11

package/dist/scripts/index.js

@@ -9770,8 +9770,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.10".length > 0) {
-    cached = "0.3.10";
+  if ("0.3.11".length > 0) {
+    cached = "0.3.11";
     return cached;
   }
   cached = "unknown";
@@ -11478,6 +11478,70 @@ async function checkGitHubWorkflowScope(probe = () => checkGitHubScopes(["workfl
     return { ok: true };
   }
 }
+async function checkGitHubPreflight(input) {
+  const warnings = [];
+  const hard = input.hardScopes ?? ["repo", "workflow"];
+  const advisory = input.advisoryScopes ?? ["delete_repo"];
+  const currentUserProbe = input.currentUser ?? getCurrentUser;
+  const scopesProbe = input.scopes ?? ((req) => checkGitHubScopes(req));
+  const repoExistsProbe = input.repoExists ?? repoExists;
+  let activeUser;
+  try {
+    activeUser = await currentUserProbe();
+  } catch (err) {
+    return {
+      ok: false,
+      warnings,
+      reason: `GitHub authentication failed: ${err instanceof Error ? err.message : String(err)}. Sign in with \`gh auth login\`, or set GITHUB_TOKEN to a valid token, then re-run.`
+    };
+  }
+  if (activeUser.toLowerCase() !== input.owner.toLowerCase()) {
+    warnings.push(
+      `Signed in to GitHub as "${activeUser}" but creating under "${input.owner}" (an org or another account); ensure "${activeUser}" can create repositories there.`
+    );
+  }
+  try {
+    const { granted, missing } = await scopesProbe([...hard, ...advisory]);
+    if (granted !== null) {
+      const missingHard = missing.filter((s) => hard.includes(s));
+      const missingAdvisory = missing.filter((s) => advisory.includes(s));
+      if (missingHard.length > 0) {
+        return {
+          ok: false,
+          warnings,
+          activeUser,
+          reason: `GitHub token missing required scope(s): ${missingHard.join(", ")} (grants [${granted.join(", ") || "none"}]). Fix: gh auth refresh -h github.com -s ${[...hard].join(",")}`
+        };
+      }
+      if (missingAdvisory.length > 0) {
+        warnings.push(
+          `GitHub token missing the ${missingAdvisory.join(", ")} scope \u2014 automatic rollback of the repo on a failed create is unavailable (you would delete it by hand). Grant it with: gh auth refresh -h github.com -s delete_repo`
+        );
+      }
+    } else {
+      warnings.push(
+        "GitHub token scopes are not visible (fine-grained PAT or App token); cannot pre-verify repo/workflow access , the create will surface any gap when it pushes."
+      );
+    }
+  } catch {
+    warnings.push("Could not read GitHub token scopes (probe error); skipping the scope pre-check.");
+  }
+  try {
+    if (await repoExistsProbe(`${input.owner}/${input.repoName}`)) {
+      return {
+        ok: false,
+        warnings,
+        activeUser,
+        reason: `GitHub repo "${input.owner}/${input.repoName}" already exists. Pick a different project name, or delete the existing repo first.`
+      };
+    }
+  } catch {
+    warnings.push(
+      `Could not check whether "${input.owner}/${input.repoName}" already exists (probe error); the create will fail clearly if it does.`
+    );
+  }
+  return { ok: true, warnings, activeUser };
+}
 function githubWorkflowScopePrereqMessage(reason) {
   return "The GitHub token lacks the `workflow` OAuth scope, required to push the project's `.github/workflows/*` CI files. (Without this check, scaffolding runs all the way to the final push, is rejected, and rolls back.) Grant the scope, then re-run:\n  - gh CLI:  gh auth refresh -h github.com -s workflow\n  - VS Code: re-sign in to GitHub and approve the workflow scope\n  - token:   set GITHUB_TOKEN to a PAT that includes the `workflow` scope" + (reason ? `
 (${reason})` : "");
@@ -11543,6 +11607,53 @@ async function withLakebaseRollback(opts, fn) {
     throw wrapped;
   }
 }
+function createRollbackLedger() {
+  const steps = [];
+  return {
+    register: (label, undo) => {
+      steps.push({ label, undo });
+    },
+    steps: () => steps
+  };
+}
+async function withCreateRollback(ledger, opts, fn) {
+  try {
+    return await fn();
+  } catch (err) {
+    const report = opts.report ?? (() => {
+    });
+    const steps = [...ledger.steps()].reverse();
+    const rolledBack = [];
+    const failed = [];
+    if (steps.length > 0) report(`Create failed; rolling back ${steps.length} created resource(s)...`);
+    for (const s of steps) {
+      try {
+        report(`  rolling back: ${s.label}`);
+        await s.undo();
+        rolledBack.push(s.label);
+      } catch (e) {
+        const m = e instanceof Error ? e.message : String(e);
+        if (/not.?found/i.test(m)) {
+          rolledBack.push(s.label);
+          continue;
+        }
+        failed.push(`${s.label} (${m})`);
+      }
+    }
+    const base = err instanceof Error ? err.message : String(err);
+    const parts = [];
+    if (rolledBack.length) parts.push(`rolled back: ${rolledBack.join(", ")}`);
+    if (failed.length) {
+      parts.push(
+        `COULD NOT roll back: ${failed.join("; ")} , clean these up by hand before retrying the same name`
+      );
+    }
+    const suffix = parts.length ? ` (${parts.join("; ")})` : "";
+    const wrapped = err instanceof Error ? err : new Error(base);
+    wrapped.message = `${base}${suffix}`;
+    throw wrapped;
+  }
+}
 
 // scripts/lakebase/create-project.ts
 init_esm_shims();
@@ -11611,26 +11722,38 @@ To finish:
   }
 };
 async function commitAndPush(args) {
-  await exec2("git add -A", { cwd: args.projectDir });
-  await exec2(`git commit -m ${JSON.stringify(args.message)}`, {
-    cwd: args.projectDir,
+  await commitInitial(args.projectDir, args.message);
+  if (args.push === false) return;
+  await pushInitial({ projectDir: args.projectDir, remote: args.remote, branch: args.branch });
+}
+async function commitInitial(projectDir, message) {
+  await exec2("git add -A", { cwd: projectDir });
+  await exec2(`git commit -m ${JSON.stringify(message)}`, {
+    cwd: projectDir,
     timeout: 3e4
   });
-  if (args.push === false) return;
+}
+async function pushInitial(args) {
   const remote = args.remote ?? "origin";
   const branch = args.branch ?? "main";
-  try {
-    await exec2(`git push -u ${remote} ${branch}`, {
-      cwd: args.projectDir,
-      timeout: 3e4
-    });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (/without `?workflow`? scope|workflow scope/i.test(msg)) {
-      throw new WorkflowScopeError(args.projectDir);
+  const attempts = Math.max(1, args.attempts ?? 1);
+  const sleep2 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const run = args.run ?? ((cmd, cwd) => exec2(cmd, { cwd, timeout: 3e4 }).then(() => void 0));
+  let lastErr;
+  for (let i = 1; i <= attempts; i++) {
+    try {
+      await run(`git push -u ${remote} ${branch}`, args.projectDir);
+      return;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/without `?workflow`? scope|workflow scope/i.test(msg)) {
+        throw new WorkflowScopeError(args.projectDir);
+      }
+      lastErr = err;
+      if (i < attempts) await sleep2(args.delayMs ?? 1500);
     }
-    throw err;
   }
+  throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
 }
 
 // scripts/lakebase/scaffold.ts
@@ -13813,64 +13936,72 @@ async function createProject(input, progress) {
     throw new Error(databricksAuthPrereqMessage(host, auth7.reason));
   }
   if (useGithub) {
-    report("Checking GitHub token scopes...");
-    const scope = await checkGitHubWorkflowScope();
-    if (!scope.ok) {
-      throw new Error(githubWorkflowScopePrereqMessage(scope.reason));
-    }
-  }
-  if (useGithub) {
-    report("Creating GitHub repository...", fullRepoName);
-    await createRepo(fullRepoName, {
-      private: input.privateRepo !== false,
-      description: `Lakebase project: ${input.projectName}`
-    });
-    report("Waiting for GitHub repo to be visible...", fullRepoName);
-    const probeDelays = [1e3, 2e3, 3e3, 5e3, 8e3];
-    let probeErr = "";
-    let visible = false;
-    for (const waitMs of probeDelays) {
-      try {
-        await getRepoFullName(fullRepoName);
-        visible = true;
-        break;
-      } catch (err) {
-        probeErr = err instanceof Error ? err.message : String(err);
-        await delay(waitMs);
-      }
-    }
-    if (!visible) {
-      let activeUser = "";
-      try {
-        activeUser = await getCurrentUser();
-      } catch {
-      }
-      const samlHint = /SAML|scope does not match|sso/i.test(probeErr) ? "\n\nThe error mentions SAML \u2013 re-sign in to GitHub and authorize SSO for this org." : "";
-      const userHint = activeUser && activeUser !== input.githubOwner ? `
+    report("Checking GitHub account + token requisites...");
+    const gh = await checkGitHubPreflight({ owner: input.githubOwner, repoName: input.projectName });
+    for (const w of gh.warnings) {
+      warnings.push(w);
+      report(`Note: ${w}`);
+    }
+    if (!gh.ok) throw new Error(gh.reason);
+  }
+  const rollback = createRollbackLedger();
+  return await withCreateRollback(
+    rollback,
+    { report },
+    async () => {
+      if (useGithub) {
+        report("Creating GitHub repository...", fullRepoName);
+        await createRepo(fullRepoName, {
+          private: input.privateRepo !== false,
+          description: `Lakebase project: ${input.projectName}`
+        });
+        rollback.register(`GitHub repo ${fullRepoName}`, () => deleteRepo(fullRepoName));
+        report("Waiting for GitHub repo to be visible...", fullRepoName);
+        const probeDelays = [1e3, 2e3, 3e3, 5e3, 8e3];
+        let probeErr = "";
+        let visible = false;
+        for (const waitMs of probeDelays) {
+          try {
+            await getRepoFullName(fullRepoName);
+            visible = true;
+            break;
+          } catch (err) {
+            probeErr = err instanceof Error ? err.message : String(err);
+            await delay(waitMs);
+          }
+        }
+        if (!visible) {
+          let activeUser = "";
+          try {
+            activeUser = await getCurrentUser();
+          } catch {
+          }
+          const samlHint = /SAML|scope does not match|sso/i.test(probeErr) ? "\n\nThe error mentions SAML \u2013 re-sign in to GitHub and authorize SSO for this org." : "";
+          const userHint = activeUser && activeUser !== input.githubOwner ? `
 
 Note: signed in as "${activeUser}", but the repo was created under "${input.githubOwner}".` : "";
-      throw new Error(
-        `GitHub repo "${fullRepoName}" was created but isn't visible after ~19s of polling.${samlHint}${userHint}
+          throw new Error(
+            `GitHub repo "${fullRepoName}" was created but isn't visible after ~19s of polling.${samlHint}${userHint}
 
 Last probe error:
   ${probeErr.split("\n")[0].slice(0, 200)}`
-      );
-    }
-    report("Cloning repository...", projectDir);
-    await cloneRepo({
-      repoUrl: `https://github.com/${fullRepoName}.git`,
-      parentDir: input.parentDir
-    });
-  } else {
-    report("Creating local project directory...", projectDir);
-    fs19.mkdirSync(projectDir, { recursive: true });
-    await gitInit(projectDir);
-  }
-  report("Creating Lakebase database (provisioning Postgres)...", lakebaseProjectId);
-  await createLakebaseProject({ projectId: lakebaseProjectId, host });
-  return await withLakebaseRollback(
-    { projectId: lakebaseProjectId, host, report },
-    async () => {
+          );
+        }
+        report("Cloning repository...", projectDir);
+        await cloneRepo({
+          repoUrl: `https://github.com/${fullRepoName}.git`,
+          parentDir: input.parentDir
+        });
+        rollback.register(`local project dir ${projectDir}`, () => fs19.rmSync(projectDir, { recursive: true, force: true }));
+      } else {
+        report("Creating local project directory...", projectDir);
+        fs19.mkdirSync(projectDir, { recursive: true });
+        await gitInit(projectDir);
+        rollback.register(`local project dir ${projectDir}`, () => fs19.rmSync(projectDir, { recursive: true, force: true }));
+      }
+      report("Creating Lakebase database (provisioning Postgres)...", lakebaseProjectId);
+      await createLakebaseProject({ projectId: lakebaseProjectId, host });
+      rollback.register(`Lakebase project ${lakebaseProjectId}`, () => deleteLakebaseProject({ projectId: lakebaseProjectId, host }));
       report("Resolving database endpoint...");
       const defaultBranchId = await getDefaultBranchId({
         projectId: lakebaseProjectId,
@@ -13954,6 +14085,10 @@ Last probe error:
             projectName: input.projectName,
             report: (m) => report(m)
           });
+          rollback.register(
+            `self-hosted runner ${input.projectName}`,
+            () => removeRunner({ fullRepoName, projectName: input.projectName })
+          );
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
           warnings.push(`Runner setup failed: ${msg}`);
@@ -14022,6 +14157,16 @@ Last probe error:
           "The Consort toolkit downloads on first use , run `./scripts/lk --refresh`, or just your first `./scripts/lk` command, and it installs then."
         );
       }
+      if (enableSftdd && useGithub) {
+        report("Warming the Consort toolkit (so the first push doesn't cold-download mid-hook)...");
+        let warm = warmAndVerifyKit(projectDir);
+        if (!warm.ok) warm = warmAndVerifyKit(projectDir);
+        if (!warm.ok) {
+          const m = kitWarmWarning(projectDir, warm.reason);
+          warnings.push(m);
+          report(`Note: ${m}`);
+        }
+      }
       const langLabels = {
         java: "Java/Spring Boot",
         kotlin: "Kotlin/Spring Boot",
@@ -14042,12 +14187,25 @@ Last probe error:
         }
       }
       report("Creating initial commit...");
-      await commitAndPush({
-        projectDir,
-        message: `Initial project scaffold (${langLabel} + Lakebase)`,
-        push: useGithub
-      });
-      if (tiers === 2 || tiers === 3) {
+      await commitInitial(projectDir, `Initial project scaffold (${langLabel} + Lakebase)`);
+      let pushLanded = !useGithub;
+      if (useGithub) {
+        try {
+          await pushInitial({ projectDir, attempts: 2 });
+          pushLanded = true;
+        } catch (err) {
+          if (err instanceof WorkflowScopeError) throw err;
+          const msg = err instanceof Error ? err.message : String(err);
+          const m = `Provisioning is complete, but the initial push did not land after a retry: ${msg}. The project on disk is fine , finish it with: cd ${projectDir} && git push -u origin main`;
+          warnings.push(m);
+          report(`WARNING: ${m}`);
+        }
+      }
+      if ((tiers === 2 || tiers === 3) && !pushLanded) {
+        const m = `INCOMPLETE TIERS: you requested ${tiers} tiers, but the initial push hasn't landed, so the tier branches can't fork off origin yet. After you finish the push (above), cut them with \`./scripts/lk lakebase-cut-tier --name staging --fork-from main\`${tiers === 3 ? " and `--name dev --fork-from staging`" : ""}.`;
+        warnings.push(m);
+        report(`WARNING: ${m}`);
+      } else if (tiers === 2 || tiers === 3) {
         report(`Cutting staging tier (tiers=${tiers}) via createLongRunningBranch...`);
         try {
           await createLongRunningBranch({
@@ -14098,7 +14256,7 @@ Last probe error:
         warnings
       };
     }
-    // end withLakebaseRollback closure
+    // end withCreateRollback closure
   );
 }
 
@@ -19487,6 +19645,7 @@ export {
   catalogExists,
   catalogExplorerUrl,
   checkDatabricksAuth,
+  checkGitHubPreflight,
   checkGitHubScopes,
   checkGitHubWorkflowScope,
   checkoutBranch,
@@ -19504,6 +19663,7 @@ export {
   commitAllSignedOff,
   commitAmend,
   commitAndPush,
+  commitInitial,
   commitSignedOff,
   compileMigrationPattern,
   connectionApplicationName,
@@ -19518,6 +19678,7 @@ export {
   createPullRequest,
   createRegistrationToken,
   createRepo,
+  createRollbackLedger,
   createTag,
   createTestPairedBranch,
   createUatPairedBranch,
@@ -19701,6 +19862,7 @@ export {
   push,
   pushCurrentBranchForPr,
   pushFailureHint,
+  pushInitial,
   pushTo,
   queryBranchSchema,
   queryBranchTables,
@@ -19790,6 +19952,7 @@ export {
   waitForBranchReady,
   waitForCi,
   warmAndVerifyKit,
+  withCreateRollback,
   withLakebaseRollback,
   withProxyEnv,
   workflowStateFileExists,

package/dist/scripts/lakebase/ci-resolve-branch.cli.cjs

@@ -79662,8 +79662,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.10".length > 0) {
-    cached = "0.3.10";
+  if ("0.3.11".length > 0) {
+    cached = "0.3.11";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/ci-resolve-branch.cli.js

@@ -754,8 +754,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.10".length > 0) {
-    cached = "0.3.10";
+  if ("0.3.11".length > 0) {
+    cached = "0.3.11";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/collapse-heads.cli.cjs

@@ -79290,8 +79290,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.10".length > 0) {
-    cached = "0.3.10";
+  if ("0.3.11".length > 0) {
+    cached = "0.3.11";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/collapse-heads.cli.js

@@ -393,8 +393,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.10".length > 0) {
-    cached = "0.3.10";
+  if ("0.3.11".length > 0) {
+    cached = "0.3.11";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/detect-language.cli.cjs

@@ -79290,8 +79290,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.10".length > 0) {
-    cached = "0.3.10";
+  if ("0.3.11".length > 0) {
+    cached = "0.3.11";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/detect-language.cli.js

@@ -393,8 +393,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.10".length > 0) {
-    cached = "0.3.10";
+  if ("0.3.11".length > 0) {
+    cached = "0.3.11";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/doctor.cli.cjs

@@ -80800,8 +80800,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.10".length > 0) {
-    cached = "0.3.10";
+  if ("0.3.11".length > 0) {
+    cached = "0.3.11";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/doctor.cli.js

@@ -1959,8 +1959,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.10".length > 0) {
-    cached = "0.3.10";
+  if ("0.3.11".length > 0) {
+    cached = "0.3.11";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/get-connection.cli.cjs

@@ -79285,8 +79285,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.10".length > 0) {
-    cached = "0.3.10";
+  if ("0.3.11".length > 0) {
+    cached = "0.3.11";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/get-connection.cli.js

@@ -389,8 +389,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.10".length > 0) {
-    cached = "0.3.10";
+  if ("0.3.11".length > 0) {
+    cached = "0.3.11";
     return cached;
   }
   cached = "unknown";