@databricks-solutions/lakebase-scm-utils 0.3.3 → 0.3.5

package/dist/scripts/github/index.cjs

@@ -1466,6 +1466,7 @@ __export(github_exports, {
   GitHubRepoError: () => GitHubRepoError,
   GitHubRunnerError: () => GitHubRunnerError,
   GitHubSecretsError: () => GitHubSecretsError,
+  checkGitHubScopes: () => checkGitHubScopes,
   createPullRequest: () => createPullRequest,
   createRegistrationToken: () => createRegistrationToken,
   createRepo: () => createRepo,
@@ -8136,6 +8137,18 @@ async function getCurrentUser() {
     wrap(err, "GitHub authentication failed");
   }
 }
+async function checkGitHubScopes(required = GITHUB_SCOPES) {
+  try {
+    const ctx = await newContext();
+    const res = await ctx.octokit.rest.users.getAuthenticated();
+    const header = res.headers["x-oauth-scopes"];
+    if (header === void 0 || header === null) return { granted: null, missing: [] };
+    const granted = String(header).split(",").map((s) => s.trim()).filter(Boolean);
+    return { granted, missing: required.filter((s) => !granted.includes(s)) };
+  } catch (err) {
+    wrap(err, "GitHub scope check failed");
+  }
+}
 async function createRepo(name, opts = {}) {
   try {
     const ctx = await newContext();
@@ -9065,6 +9078,7 @@ async function mergePairedPullRequest(args) {
   GitHubRepoError,
   GitHubRunnerError,
   GitHubSecretsError,
+  checkGitHubScopes,
   createPullRequest,
   createRegistrationToken,
   createRepo,

package/dist/scripts/github/index.d.cts

@@ -55,6 +55,24 @@ declare class GitHubRepoError extends Error {
 }
 /** Returns the GitHub login of the currently authenticated user. */
 declare function getCurrentUser(): Promise<string>;
+interface GitHubScopeStatus {
+    /** Granted OAuth scopes, or null when the token exposes NONE — a fine-grained
+     *  PAT or GitHub App token carries no OAuth scope header; its permissions
+     *  aren't a scope set, so callers MUST treat null as "unknown", never a miss. */
+    granted: string[] | null;
+    /** Required scopes absent from `granted` (empty when `granted` is null). */
+    missing: string[];
+}
+/**
+ * Read the authenticated token's granted OAuth scopes from the GitHub API
+ * `x-oauth-scopes` response header and diff them against `required`. A classic
+ * OAuth/PAT token returns a (possibly empty) comma-separated header; a
+ * fine-grained PAT / GitHub App token omits it entirely → `granted: null`.
+ * Reading your own user needs no special scope, so this succeeds for any VALID
+ * token regardless of scopes (and throws, like the other ops, on a bad token /
+ * network error — callers decide whether that is blocking).
+ */
+declare function checkGitHubScopes(required?: readonly string[]): Promise<GitHubScopeStatus>;
 interface CreateRepoOptions {
     /** Make the repo private. Default: true. */
     private?: boolean;
@@ -127,4 +145,4 @@ declare function setRepoSecrets(ownerRepo: string, secrets: Record<string, strin
 /** List configured secret names (returns empty array on any error). */
 declare function listSecretNames(ownerRepo: string): Promise<string[]>;
 
-export { type CreateRepoOptions, GITHUB_SCOPES, type GitHubAuthDiagnosis, type GitHubAuthSource, GitHubRepoError, GitHubRunnerError, GitHubSecretsError, type RepoRunner, type VsCodeSessionOptions, createRegistrationToken, createRepo, deleteRepo, deleteRunner, diagnoseGitHubAuth, getActionsEnabled, getCurrentUser, getRepoFullName, getRunnerIdByName, getRunnerStatus, listRepoRunners, listSecretNames, repoExists, resolveGitHubToken, setRepoSecret, setRepoSecrets, tryGhAuthToken, tryVsCodeSession };
+export { type CreateRepoOptions, GITHUB_SCOPES, type GitHubAuthDiagnosis, type GitHubAuthSource, GitHubRepoError, GitHubRunnerError, type GitHubScopeStatus, GitHubSecretsError, type RepoRunner, type VsCodeSessionOptions, checkGitHubScopes, createRegistrationToken, createRepo, deleteRepo, deleteRunner, diagnoseGitHubAuth, getActionsEnabled, getCurrentUser, getRepoFullName, getRunnerIdByName, getRunnerStatus, listRepoRunners, listSecretNames, repoExists, resolveGitHubToken, setRepoSecret, setRepoSecrets, tryGhAuthToken, tryVsCodeSession };

package/dist/scripts/github/index.d.ts

@@ -55,6 +55,24 @@ declare class GitHubRepoError extends Error {
 }
 /** Returns the GitHub login of the currently authenticated user. */
 declare function getCurrentUser(): Promise<string>;
+interface GitHubScopeStatus {
+    /** Granted OAuth scopes, or null when the token exposes NONE — a fine-grained
+     *  PAT or GitHub App token carries no OAuth scope header; its permissions
+     *  aren't a scope set, so callers MUST treat null as "unknown", never a miss. */
+    granted: string[] | null;
+    /** Required scopes absent from `granted` (empty when `granted` is null). */
+    missing: string[];
+}
+/**
+ * Read the authenticated token's granted OAuth scopes from the GitHub API
+ * `x-oauth-scopes` response header and diff them against `required`. A classic
+ * OAuth/PAT token returns a (possibly empty) comma-separated header; a
+ * fine-grained PAT / GitHub App token omits it entirely → `granted: null`.
+ * Reading your own user needs no special scope, so this succeeds for any VALID
+ * token regardless of scopes (and throws, like the other ops, on a bad token /
+ * network error — callers decide whether that is blocking).
+ */
+declare function checkGitHubScopes(required?: readonly string[]): Promise<GitHubScopeStatus>;
 interface CreateRepoOptions {
     /** Make the repo private. Default: true. */
     private?: boolean;
@@ -127,4 +145,4 @@ declare function setRepoSecrets(ownerRepo: string, secrets: Record<string, strin
 /** List configured secret names (returns empty array on any error). */
 declare function listSecretNames(ownerRepo: string): Promise<string[]>;
 
-export { type CreateRepoOptions, GITHUB_SCOPES, type GitHubAuthDiagnosis, type GitHubAuthSource, GitHubRepoError, GitHubRunnerError, GitHubSecretsError, type RepoRunner, type VsCodeSessionOptions, createRegistrationToken, createRepo, deleteRepo, deleteRunner, diagnoseGitHubAuth, getActionsEnabled, getCurrentUser, getRepoFullName, getRunnerIdByName, getRunnerStatus, listRepoRunners, listSecretNames, repoExists, resolveGitHubToken, setRepoSecret, setRepoSecrets, tryGhAuthToken, tryVsCodeSession };
+export { type CreateRepoOptions, GITHUB_SCOPES, type GitHubAuthDiagnosis, type GitHubAuthSource, GitHubRepoError, GitHubRunnerError, type GitHubScopeStatus, GitHubSecretsError, type RepoRunner, type VsCodeSessionOptions, checkGitHubScopes, createRegistrationToken, createRepo, deleteRepo, deleteRunner, diagnoseGitHubAuth, getActionsEnabled, getCurrentUser, getRepoFullName, getRunnerIdByName, getRunnerStatus, listRepoRunners, listSecretNames, repoExists, resolveGitHubToken, setRepoSecret, setRepoSecrets, tryGhAuthToken, tryVsCodeSession };

package/dist/scripts/github/index.js

@@ -8095,6 +8095,18 @@ async function getCurrentUser() {
     wrap(err, "GitHub authentication failed");
   }
 }
+async function checkGitHubScopes(required = GITHUB_SCOPES) {
+  try {
+    const ctx = await newContext();
+    const res = await ctx.octokit.rest.users.getAuthenticated();
+    const header = res.headers["x-oauth-scopes"];
+    if (header === void 0 || header === null) return { granted: null, missing: [] };
+    const granted = String(header).split(",").map((s) => s.trim()).filter(Boolean);
+    return { granted, missing: required.filter((s) => !granted.includes(s)) };
+  } catch (err) {
+    wrap(err, "GitHub scope check failed");
+  }
+}
 async function createRepo(name, opts = {}) {
   try {
     const ctx = await newContext();
@@ -9023,6 +9035,7 @@ export {
   GitHubRepoError,
   GitHubRunnerError,
   GitHubSecretsError,
+  checkGitHubScopes,
   createPullRequest,
   createRegistrationToken,
   createRepo,

package/dist/scripts/index.cjs

@@ -78995,6 +78995,8 @@ __export(scripts_exports, {
   catalogExists: () => catalogExists,
   catalogExplorerUrl: () => catalogExplorerUrl,
   checkDatabricksAuth: () => checkDatabricksAuth,
+  checkGitHubScopes: () => checkGitHubScopes,
+  checkGitHubWorkflowScope: () => checkGitHubWorkflowScope,
   checkoutBranch: () => checkoutBranch,
   checkoutDetached: () => checkoutDetached,
   checkoutPaired: () => checkoutPaired,
@@ -79139,6 +79141,7 @@ __export(scripts_exports, {
   getTargetNames: () => getTargetNames,
   gitBranchExists: () => gitBranchExists,
   gitInit: () => gitInit,
+  githubWorkflowScopePrereqMessage: () => githubWorkflowScopePrereqMessage,
   grantLakebasePermission: () => grantLakebasePermission,
   grantUcCatalogPermission: () => grantUcCatalogPermission,
   hasDotnetMarker: () => hasDotnetMarker,
@@ -85947,6 +85950,18 @@ async function getCurrentUser() {
     wrap(err, "GitHub authentication failed");
   }
 }
+async function checkGitHubScopes(required = GITHUB_SCOPES) {
+  try {
+    const ctx = await newContext();
+    const res = await ctx.octokit.rest.users.getAuthenticated();
+    const header = res.headers["x-oauth-scopes"];
+    if (header === void 0 || header === null) return { granted: null, missing: [] };
+    const granted = String(header).split(",").map((s2) => s2.trim()).filter(Boolean);
+    return { granted, missing: required.filter((s2) => !granted.includes(s2)) };
+  } catch (err) {
+    wrap(err, "GitHub scope check failed");
+  }
+}
 async function createRepo(name, opts = {}) {
   try {
     const ctx = await newContext();
@@ -88943,8 +88958,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.3".length > 0) {
-    cached = "0.3.3";
+  if ("0.3.5".length > 0) {
+    cached = "0.3.5";
     return cached;
   }
   cached = "unknown";
@@ -90637,6 +90652,22 @@ async function checkDatabricksAuth(host, run = (args) => runDatabricks(args, { h
     return { ok: false, reason: lastLines(e2.stderr, 2) || e2.message || "databricks auth token failed" };
   }
 }
+async function checkGitHubWorkflowScope(probe = () => checkGitHubScopes(["workflow"])) {
+  try {
+    const { granted, missing } = await probe();
+    if (granted === null) return { ok: true };
+    if (missing.includes("workflow")) {
+      return { ok: false, reason: `token grants [${granted.join(", ") || "none"}] but not \`workflow\`` };
+    }
+    return { ok: true };
+  } catch {
+    return { ok: true };
+  }
+}
+function githubWorkflowScopePrereqMessage(reason) {
+  return "The GitHub token lacks the `workflow` OAuth scope, required to push the project's `.github/workflows/*` CI files. (Without this check, scaffolding runs all the way to the final push, is rejected, and rolls back.) Grant the scope, then re-run:\n  - gh CLI:  gh auth refresh -h github.com -s workflow\n  - VS Code: re-sign in to GitHub and approve the workflow scope\n  - token:   set GITHUB_TOKEN to a PAT that includes the `workflow` scope" + (reason ? `
+(${reason})` : "");
+}
 function databricksAuthPrereqMessage(host, reason) {
   const hostFlag = host ? ` --host ${host.replace(/\/+$/, "")}` : "";
   return `Databricks authentication is required before creating a project. Run: databricks auth login${hostFlag}` + (reason ? `
@@ -92956,6 +92987,13 @@ async function createProject(input, progress) {
   if (!auth7.ok) {
     throw new Error(databricksAuthPrereqMessage(host, auth7.reason));
   }
+  if (useGithub) {
+    report("Checking GitHub token scopes...");
+    const scope = await checkGitHubWorkflowScope();
+    if (!scope.ok) {
+      throw new Error(githubWorkflowScopePrereqMessage(scope.reason));
+    }
+  }
   if (useGithub) {
     report("Creating GitHub repository...", fullRepoName);
     await createRepo(fullRepoName, {
@@ -97694,6 +97732,40 @@ async function checkGitRemote(projectDir) {
     };
   }
 }
+async function checkGitHubTokenScope(probe = () => checkGitHubScopes(["workflow"])) {
+  try {
+    const { granted, missing } = await probe();
+    if (granted === null) {
+      return {
+        name: "github-token-scope",
+        status: "skip",
+        message: "GitHub token scopes not visible (fine-grained PAT / App token) - `workflow` scope unverified"
+      };
+    }
+    if (missing.includes("workflow")) {
+      return {
+        name: "github-token-scope",
+        status: "fail",
+        message: "GitHub token lacks the `workflow` scope - pushes touching .github/workflows/* will be rejected",
+        detail: { granted },
+        hint: "Grant it with `gh auth refresh -h github.com -s workflow`, re-sign in to GitHub in VS Code and approve the workflow scope, or set GITHUB_TOKEN to a PAT that includes `workflow`."
+      };
+    }
+    return {
+      name: "github-token-scope",
+      status: "ok",
+      message: "GitHub token has the `workflow` scope",
+      detail: { granted }
+    };
+  } catch (err) {
+    return {
+      name: "github-token-scope",
+      status: "skip",
+      message: "GitHub token scope check skipped (no token resolved, or GitHub unreachable)",
+      detail: { error: err.message }
+    };
+  }
+}
 function checkLanguage(projectDir) {
   try {
     const lang = detectLanguage(projectDir);
@@ -97803,6 +97875,7 @@ async function runDoctor2(args = {}) {
     host
   );
   const gitRemote = await checkGitRemote(projectDir);
+  const githubTokenScope = await checkGitHubTokenScope();
   const language = checkLanguage(projectDir);
   const hooks = checkHooks(projectDir);
   const workflowDrift = checkWorkflowDrift(projectDir);
@@ -97824,6 +97897,7 @@ async function runDoctor2(args = {}) {
     configProfile,
     lakebaseProject,
     gitRemote,
+    githubTokenScope,
     language,
     hooks,
     workflowDrift
@@ -98571,6 +98645,8 @@ function isCliEntry(importMetaUrl2) {
   catalogExists,
   catalogExplorerUrl,
   checkDatabricksAuth,
+  checkGitHubScopes,
+  checkGitHubWorkflowScope,
   checkoutBranch,
   checkoutDetached,
   checkoutPaired,
@@ -98715,6 +98791,7 @@ function isCliEntry(importMetaUrl2) {
   getTargetNames,
   gitBranchExists,
   gitInit,
+  githubWorkflowScopePrereqMessage,
   grantLakebasePermission,
   grantUcCatalogPermission,
   hasDotnetMarker,

package/dist/scripts/index.d.cts

@@ -1,6 +1,6 @@
-export { CreateRepoOptions, GITHUB_SCOPES, GitHubAuthDiagnosis, GitHubAuthSource, GitHubRepoError, GitHubRunnerError, GitHubSecretsError, RepoRunner, VsCodeSessionOptions, createRegistrationToken, createRepo, deleteRepo, deleteRunner, diagnoseGitHubAuth, getActionsEnabled, getCurrentUser, getRepoFullName, getRunnerIdByName, getRunnerStatus, listRepoRunners, listSecretNames, repoExists, resolveGitHubToken, setRepoSecret, setRepoSecrets, tryGhAuthToken, tryVsCodeSession } from './github/index.cjs';
+export { CreateRepoOptions, GITHUB_SCOPES, GitHubAuthDiagnosis, GitHubAuthSource, GitHubRepoError, GitHubRunnerError, GitHubScopeStatus, GitHubSecretsError, RepoRunner, VsCodeSessionOptions, checkGitHubScopes, createRegistrationToken, createRepo, deleteRepo, deleteRunner, diagnoseGitHubAuth, getActionsEnabled, getCurrentUser, getRepoFullName, getRunnerIdByName, getRunnerStatus, listRepoRunners, listSecretNames, repoExists, resolveGitHubToken, setRepoSecret, setRepoSecrets, tryGhAuthToken, tryVsCodeSession } from './github/index.cjs';
 export { C as CreatePullRequestArgs, F as FastForwardBranchArgs, G as GitHubPullRequestError, M as MergePairedPullRequestArgs, a as MergePairedPullRequestResult, b as MergePullRequestArgs, c as MergePullRequestResult, P as PullRequestCheck, d as PullRequestFile, e as PullRequestInfo, f as PullRequestReview, W as WorkflowRunSummary, g as createPullRequest, h as fastForwardBranch, i as getPullRequest, j as getPullRequestComments, k as getPullRequestFiles, l as getPullRequestReviews, m as listIssueComments, n as listWorkflowRuns, o as mergePairedPullRequest, p as mergePullRequest } from '../pr-e-E4aP4j.cjs';
-export { AbandonFeatureArgs, AbandonFeatureResult, AddE2eToRunTestsScriptArgs, AddE2eToRunTestsScriptResult, AddInfraToPackageJsonArgs, AddInfraToPackageJsonResult, AddInfraToRunTestsScriptArgs, AddInfraToRunTestsScriptResult, AddPlaywrightToPackageJsonArgs, AddPlaywrightToPackageJsonResult, AddPythonE2eDepsArgs, AddPythonE2eDepsResult, AdoptLakebaseProjectArgs, AdoptLakebaseProjectResult, AdoptStateArgs, AdoptStateResult, AppServicePrincipal, AppliedSchemaMigration, ApplySchemaMigrationsArgs, ApplySchemaMigrationsResult, BranchLookupOpts, BranchMetadata, CONVENTION_TIER_DEFAULTS, CatalogExistsArgs, CheckoutMode, CheckoutPairedArgs, CheckoutPairedResult, ClaimFeatureBranchArgs, ClaimFeatureBranchResult, ClaimedOrphan, ClientFramework, CommandDriftReport, CommandFileEntry, CommandFileStatus, ConnectionArgs, ConsortSetupHooks, CreateBranchArgs, CreateConventionBranchArgs, CreateConventionPairedBranchArgs, CreateLongRunningBranchArgs, CreateLongRunningBranchResult, CreatePairedBranchArgs, CreatePairedBranchResult, CreateProjectArgs, CreateProjectResult, CutBackupArgs, CutBackupResult, DEFAULT_PROTECTED_TIER_NAMES, DOTNET_EFCORE_DEFAULTS, DOTNET_FLYWAY_DIR, DatabricksProfile, DeleteAppEndpointArgs, DeleteAppEndpointResult, DeleteBranchArgs, DeletePairedBranchArgs, DeletePairedBranchResult, DeployClaudeCommandsOptions, DeployClaudeCommandsResult, DeployEnvExampleArgs, DeployLanguageProjectArgs, DeploySpringStarterArgs, DeployTarget, DeployTargetsConfig, DetectCommandDriftArgs, DetectScaffoldedDriftArgs, DetectWorkflowDriftArgs, DoctorArgs, DoctorFinding, DoctorReport, DoctorSeverity, DotnetMigrationTool, DsnArgs, DsnResult, EF_DESIGN_PACKAGE, EfCoreProject, EnableE2eForProjectArgs, EnableE2eForProjectResult, EnableInfraForProjectArgs, EnableInfraForProjectResult, EndpointInfo, EnsureAppEndpointArgs, EnsureAppEndpointResult, EnsureEndpointArgs, EnsureLakebaseSecretAuthArgs, EnsureLakebaseSecretAuthResult, EnsureProfilePinnedArgs, EnsureProfilePinnedResult, EnsureSchemaAndVolumeArgs, EnsureSchemaAndVolumeResult, FIXABLE_FINDING_IDS, FixFindingArgs, FixFindingResult, FixableFindingId, GateInvariant, GateStatus, GenerateAppYamlOptions, GenerateMavenProjectOptions, GetAppEndpointArgs, GetAppEndpointResult, GetAppServicePrincipalArgs, GetCiAppEndpointArgs, GetCiAppEndpointResult, GetConnectionArgs, GetCredentialArgs, GetEndpointArgs, GetSchemaDiffArgs, GrantLakebasePermissionArgs, GrantLakebasePermissionResult, GrantUcCatalogPermissionArgs, GrantUcCatalogPermissionResult, HealthDoctorReport, HookVerification, InfraCheckResult, InfraSuiteResult, InitWorkflowStateArgs, InitializrMetadata, InitializrNetworkError, InitializrParseError, InstallPlaywrightArgs, InstallPlaywrightOptions, InstallPlaywrightResult, LakebaseBranchError, LakebaseBranchInfo, LakebaseBranchTtlTooLongError, LakebasePermissionLevel, LakebaseProjectArgs, LakebaseProjectError, LakebaseProjectInfo, LakebaseProjectMetadata, ListSchemaMigrationsArgs, MAVEN_FLYWAY_DIR, MIGRATION_DEFAULTS, MergeArgs, MergePairedArgs, MergePairedResult, MergeResult, MigrationDefaults, MigrationLanguage, MigrationLayout, ModifiedSchemaObject, NODE_E2E_TEMPLATE_FILES, OrphanCandidate, PLAYWRIGHT_TEMPLATE_FILES, PLAYWRIGHT_TEST_VERSION_RANGE, PYTEST_BDD_VERSION_RANGE, PYTEST_PLAYWRIGHT_VERSION_RANGE, PYTHON_E2E_TEMPLATE_FILES, PendingSchemaMigration, PoolArgs, PreflightResult, PreparePrArgs, PreparePrResult, ProgressCallback, ProjectLanguage, PropagateCredentialsArgs, PropagateCredentialsResult, ProtectedBranchCommitError, QueryBranchSchemaArgs, RecoverOrphansArgs, RecoverOrphansResult, ReleaseArgs, ReleaseResult, RemoveRunnerArgs, ResolveDatabricksHostArgs, ResolveMigrationLayoutArgs, RollbackDeployArgs, RollbackDeployResult, RollbackOptions, RollbackSchemaMigrationArgs, RollbackSchemaMigrationResult, RunDoctorDeps, RunInfraSuiteArgs, RunPlaywrightInstallArgs, RunPlaywrightInstallResult, RunnerInfo, RunnerReportFn, RunnerType, SCM_STATES, STATE_FILE_REL, ScaffoldAllArgs, ScaffoldOptions, ScaffoldReportFn, ScaffoldStaticAllArgs, ScaffoldStaticAllResult, ScaffoldedDriftReport, SchemaColumn, SchemaDiffResult, SchemaMigrationError, SchemaMigrationFile, SchemaMigrationLanguage, SchemaMigrationStatusArgs, SchemaMigrationStatusResult, SchemaMigrationToolName, SchemaObject, SchemaQueryRow, ScmAbandonError, ScmAdoptError, ScmClaimError, ScmDoctorFixError, ScmMergeError, ScmPreparePrError, ScmRecoverError, ScmState, ScmWaitCiError, ScmWorkflowState, SetupRunnerArgs, SftddSetupHooks, SpringInitializrClient, SpringJvmLanguage, StaleBranchFinding, SyncEnvArgs, SyncEnvResult, TableSchema, TierTopology, TryCreateCatalogArgs, TryCreateCatalogResult, UcCatalogPermission, UpdateEnvConnectionArgs, UpdateWorkflowsArgs, UpdateWorkflowsResult, UploadDirectoryArgs, UploadDirectoryResult, ValidateAppOptions, ValidateAppResult, ValidationError, ValidationResult, WaitCiArgs, WaitCiResult, WaitForBranchAuthReadyArgs, WaitForBranchReadyArgs, WorkflowDriftReport, WorkflowFileStatus, WorkflowFileUpdate, WorkflowStatus, WorkflowUpdateOutcome, WorkflowVerification, WriteEnvFileArgs, WritePlaywrightTemplatesArgs, WritePlaywrightTemplatesResult, _testMakeBrownfieldFixture, abandonFeatureBranch, addE2eToRunTestsScript, addInfraToPackageJson, addInfraToRunTestsScript, addPlaywrightToPackageJson, adoptLakebaseProject, adoptScmState, applySchemaMigrations, assertAdoptionPreflight, assertCleanForFork, assertCommitTargetNotProtected, assertCreatedProjectReady, buildPostgresUrl, buildSchemaQuery, cacheProjectRetention, catalogExists, catalogExplorerUrl, checkDatabricksAuth, checkoutPaired, claimFeatureBranch, clearRetentionCache, compileMigrationPattern, connectionApplicationName, createBranch, createFeaturePairedBranch, createLakebaseProject, createLongRunningBranch, createPairedBranch, createPerfPairedBranch, createProject, createTestPairedBranch, createUatPairedBranch, cutBackup, databricksAuthPrereqMessage, defaultRefreshPromoteWorkflows, deleteAppEndpoint, deleteBranch, deleteLakebaseProject, deletePairedBranch, deleteProjectArgs, deployClaudeAgents, deployClaudeCommands, deployClaudeSettings, deployClaudeSkills, deployClientProject, deployDeployTargets, deployEnv, deployEnvExample, deployGitignore, deployLanguageProject, deployScripts, deploySpringStarter, deployVscodeSettings, deployWorkflows, deriveCiAppName, describeGates, detectCommandDrift, detectLanguage, detectLanguageAt, detectScaffoldedDrift, detectWorkflowDrift, dirIsEmpty, enableE2eForProject, enableInfraForProject, endpointPath, ensureAppEndpoint, ensureCachedArchive, ensureEndpoint, ensureLakebaseSecretAuth, ensureProfilePinned, ensurePythonBddDeps, ensurePythonE2eDeps, ensureSchemaAndVolume, extractPullNumber, featureBranchName, findCsprojFiles, findDefaultBranchName, findEfCoreProject, findHistoryRetentionDuration, fixFinding, flywayMigrationsDir, formatJUnit, formatSchemaDiffAsMarkdown, generateAppYaml, getAppEndpoint, getAppServicePrincipal, getBranchByName, getCachedProjectRetention, getCiAppEndpoint, getConnection, getCredential, getDefaultBranch, getDefaultBranchId, getDefaultBranchName, getEndpoint, getProjectInfo, getProjectRetentionDuration, getRunnerInfo, getSchemaDiff, getTargetNames, grantLakebasePermission, grantUcCatalogPermission, hasDotnetMarker, inferTierTopology, initWorkflowState, installHooks, installPlaywright, isAllSchemas, isDotnetFlywayProject, isDotnetProject, isForeignFeatureClaim, isGitTracked, isLongRunningTierBranch, isLtsJavaVersion, isPrereleaseBootVersion, isRunning, isTier, isTtlTooLongError, kitWarmWarning, listAppDeployments, listBranches, listSchemaMigrations, mergeFeature, mergePaired, minLakebaseTtl, mintCredential, normalizeHost, normalizeTierName, parseHostFromAuthDescribe, parseLakebaseTtl, parseTargetsYaml, patchWorkflowsForRunnerType, preparePr, projectPath, propagateCredentials, protectedTierNamesFromEnv, pushFailureHint, queryBranchSchema, queryBranchTables, readEnvVar, readTargets, readWorkflowState, reconcilePromoteRunState, reconcileTierToOrigin, recoverOrphans, release, removeRunner, resolveBranchId, resolveBranchPath, resolveCurrentUser, resolveDatabricksHost, resolveEndpointHost, resolveFeatureStartPoint, resolveJavaHome, resolveLatestBootVersion, resolveLatestLtsJavaVersion, resolveMigrationLanguage, resolveMigrationLayout, resolveParentBranch, resolveProfileForHost, resolveProfileForHostSync, resolveProtectedTierNames, rollbackDeploy, rollbackSchemaMigration, runDoctor, runHealthDoctor, runInfraSuite, runPlaywrightInstall, runnerDir, runnerName, sanitizeFeatureSlug, scaffoldAll, scaffoldStaticAll, schemaMigrationStatus, schemaObjectName, selectProfileForHost, setupRunner, stateFilePath, stopRunner, substituteScmUtilsVersion, substrateVersion, syncEnvToCurrentBranch, tierBranchNames, toolForLanguage, tryCreateCatalog, updateEnvConnection, updateWorkflows, uploadDirectory, validateApp, validateCreateInputs, validateWorkflowState, verifyHooks, verifyProject, verifyWorkflows, waitForBranchAuthReady, waitForBranchReady, waitForCi, warmAndVerifyKit, withLakebaseRollback, workflowStateFileExists, writeEnvFile, writePlaywrightTemplates, writeTargets, writeWorkflowState } from './lakebase/index.cjs';
+export { AbandonFeatureArgs, AbandonFeatureResult, AddE2eToRunTestsScriptArgs, AddE2eToRunTestsScriptResult, AddInfraToPackageJsonArgs, AddInfraToPackageJsonResult, AddInfraToRunTestsScriptArgs, AddInfraToRunTestsScriptResult, AddPlaywrightToPackageJsonArgs, AddPlaywrightToPackageJsonResult, AddPythonE2eDepsArgs, AddPythonE2eDepsResult, AdoptLakebaseProjectArgs, AdoptLakebaseProjectResult, AdoptStateArgs, AdoptStateResult, AppServicePrincipal, AppliedSchemaMigration, ApplySchemaMigrationsArgs, ApplySchemaMigrationsResult, BranchLookupOpts, BranchMetadata, CONVENTION_TIER_DEFAULTS, CatalogExistsArgs, CheckoutMode, CheckoutPairedArgs, CheckoutPairedResult, ClaimFeatureBranchArgs, ClaimFeatureBranchResult, ClaimedOrphan, ClientFramework, CommandDriftReport, CommandFileEntry, CommandFileStatus, ConnectionArgs, ConsortSetupHooks, CreateBranchArgs, CreateConventionBranchArgs, CreateConventionPairedBranchArgs, CreateLongRunningBranchArgs, CreateLongRunningBranchResult, CreatePairedBranchArgs, CreatePairedBranchResult, CreateProjectArgs, CreateProjectResult, CutBackupArgs, CutBackupResult, DEFAULT_PROTECTED_TIER_NAMES, DOTNET_EFCORE_DEFAULTS, DOTNET_FLYWAY_DIR, DatabricksProfile, DeleteAppEndpointArgs, DeleteAppEndpointResult, DeleteBranchArgs, DeletePairedBranchArgs, DeletePairedBranchResult, DeployClaudeCommandsOptions, DeployClaudeCommandsResult, DeployEnvExampleArgs, DeployLanguageProjectArgs, DeploySpringStarterArgs, DeployTarget, DeployTargetsConfig, DetectCommandDriftArgs, DetectScaffoldedDriftArgs, DetectWorkflowDriftArgs, DoctorArgs, DoctorFinding, DoctorReport, DoctorSeverity, DotnetMigrationTool, DsnArgs, DsnResult, EF_DESIGN_PACKAGE, EfCoreProject, EnableE2eForProjectArgs, EnableE2eForProjectResult, EnableInfraForProjectArgs, EnableInfraForProjectResult, EndpointInfo, EnsureAppEndpointArgs, EnsureAppEndpointResult, EnsureEndpointArgs, EnsureLakebaseSecretAuthArgs, EnsureLakebaseSecretAuthResult, EnsureProfilePinnedArgs, EnsureProfilePinnedResult, EnsureSchemaAndVolumeArgs, EnsureSchemaAndVolumeResult, FIXABLE_FINDING_IDS, FixFindingArgs, FixFindingResult, FixableFindingId, GateInvariant, GateStatus, GenerateAppYamlOptions, GenerateMavenProjectOptions, GetAppEndpointArgs, GetAppEndpointResult, GetAppServicePrincipalArgs, GetCiAppEndpointArgs, GetCiAppEndpointResult, GetConnectionArgs, GetCredentialArgs, GetEndpointArgs, GetSchemaDiffArgs, GrantLakebasePermissionArgs, GrantLakebasePermissionResult, GrantUcCatalogPermissionArgs, GrantUcCatalogPermissionResult, HealthDoctorReport, HookVerification, InfraCheckResult, InfraSuiteResult, InitWorkflowStateArgs, InitializrMetadata, InitializrNetworkError, InitializrParseError, InstallPlaywrightArgs, InstallPlaywrightOptions, InstallPlaywrightResult, LakebaseBranchError, LakebaseBranchInfo, LakebaseBranchTtlTooLongError, LakebasePermissionLevel, LakebaseProjectArgs, LakebaseProjectError, LakebaseProjectInfo, LakebaseProjectMetadata, ListSchemaMigrationsArgs, MAVEN_FLYWAY_DIR, MIGRATION_DEFAULTS, MergeArgs, MergePairedArgs, MergePairedResult, MergeResult, MigrationDefaults, MigrationLanguage, MigrationLayout, ModifiedSchemaObject, NODE_E2E_TEMPLATE_FILES, OrphanCandidate, PLAYWRIGHT_TEMPLATE_FILES, PLAYWRIGHT_TEST_VERSION_RANGE, PYTEST_BDD_VERSION_RANGE, PYTEST_PLAYWRIGHT_VERSION_RANGE, PYTHON_E2E_TEMPLATE_FILES, PendingSchemaMigration, PoolArgs, PreflightResult, PreparePrArgs, PreparePrResult, ProgressCallback, ProjectLanguage, PropagateCredentialsArgs, PropagateCredentialsResult, ProtectedBranchCommitError, QueryBranchSchemaArgs, RecoverOrphansArgs, RecoverOrphansResult, ReleaseArgs, ReleaseResult, RemoveRunnerArgs, ResolveDatabricksHostArgs, ResolveMigrationLayoutArgs, RollbackDeployArgs, RollbackDeployResult, RollbackOptions, RollbackSchemaMigrationArgs, RollbackSchemaMigrationResult, RunDoctorDeps, RunInfraSuiteArgs, RunPlaywrightInstallArgs, RunPlaywrightInstallResult, RunnerInfo, RunnerReportFn, RunnerType, SCM_STATES, STATE_FILE_REL, ScaffoldAllArgs, ScaffoldOptions, ScaffoldReportFn, ScaffoldStaticAllArgs, ScaffoldStaticAllResult, ScaffoldedDriftReport, SchemaColumn, SchemaDiffResult, SchemaMigrationError, SchemaMigrationFile, SchemaMigrationLanguage, SchemaMigrationStatusArgs, SchemaMigrationStatusResult, SchemaMigrationToolName, SchemaObject, SchemaQueryRow, ScmAbandonError, ScmAdoptError, ScmClaimError, ScmDoctorFixError, ScmMergeError, ScmPreparePrError, ScmRecoverError, ScmState, ScmWaitCiError, ScmWorkflowState, SetupRunnerArgs, SftddSetupHooks, SpringInitializrClient, SpringJvmLanguage, StaleBranchFinding, SyncEnvArgs, SyncEnvResult, TableSchema, TierTopology, TryCreateCatalogArgs, TryCreateCatalogResult, UcCatalogPermission, UpdateEnvConnectionArgs, UpdateWorkflowsArgs, UpdateWorkflowsResult, UploadDirectoryArgs, UploadDirectoryResult, ValidateAppOptions, ValidateAppResult, ValidationError, ValidationResult, WaitCiArgs, WaitCiResult, WaitForBranchAuthReadyArgs, WaitForBranchReadyArgs, WorkflowDriftReport, WorkflowFileStatus, WorkflowFileUpdate, WorkflowStatus, WorkflowUpdateOutcome, WorkflowVerification, WriteEnvFileArgs, WritePlaywrightTemplatesArgs, WritePlaywrightTemplatesResult, _testMakeBrownfieldFixture, abandonFeatureBranch, addE2eToRunTestsScript, addInfraToPackageJson, addInfraToRunTestsScript, addPlaywrightToPackageJson, adoptLakebaseProject, adoptScmState, applySchemaMigrations, assertAdoptionPreflight, assertCleanForFork, assertCommitTargetNotProtected, assertCreatedProjectReady, buildPostgresUrl, buildSchemaQuery, cacheProjectRetention, catalogExists, catalogExplorerUrl, checkDatabricksAuth, checkGitHubWorkflowScope, checkoutPaired, claimFeatureBranch, clearRetentionCache, compileMigrationPattern, connectionApplicationName, createBranch, createFeaturePairedBranch, createLakebaseProject, createLongRunningBranch, createPairedBranch, createPerfPairedBranch, createProject, createTestPairedBranch, createUatPairedBranch, cutBackup, databricksAuthPrereqMessage, defaultRefreshPromoteWorkflows, deleteAppEndpoint, deleteBranch, deleteLakebaseProject, deletePairedBranch, deleteProjectArgs, deployClaudeAgents, deployClaudeCommands, deployClaudeSettings, deployClaudeSkills, deployClientProject, deployDeployTargets, deployEnv, deployEnvExample, deployGitignore, deployLanguageProject, deployScripts, deploySpringStarter, deployVscodeSettings, deployWorkflows, deriveCiAppName, describeGates, detectCommandDrift, detectLanguage, detectLanguageAt, detectScaffoldedDrift, detectWorkflowDrift, dirIsEmpty, enableE2eForProject, enableInfraForProject, endpointPath, ensureAppEndpoint, ensureCachedArchive, ensureEndpoint, ensureLakebaseSecretAuth, ensureProfilePinned, ensurePythonBddDeps, ensurePythonE2eDeps, ensureSchemaAndVolume, extractPullNumber, featureBranchName, findCsprojFiles, findDefaultBranchName, findEfCoreProject, findHistoryRetentionDuration, fixFinding, flywayMigrationsDir, formatJUnit, formatSchemaDiffAsMarkdown, generateAppYaml, getAppEndpoint, getAppServicePrincipal, getBranchByName, getCachedProjectRetention, getCiAppEndpoint, getConnection, getCredential, getDefaultBranch, getDefaultBranchId, getDefaultBranchName, getEndpoint, getProjectInfo, getProjectRetentionDuration, getRunnerInfo, getSchemaDiff, getTargetNames, githubWorkflowScopePrereqMessage, grantLakebasePermission, grantUcCatalogPermission, hasDotnetMarker, inferTierTopology, initWorkflowState, installHooks, installPlaywright, isAllSchemas, isDotnetFlywayProject, isDotnetProject, isForeignFeatureClaim, isGitTracked, isLongRunningTierBranch, isLtsJavaVersion, isPrereleaseBootVersion, isRunning, isTier, isTtlTooLongError, kitWarmWarning, listAppDeployments, listBranches, listSchemaMigrations, mergeFeature, mergePaired, minLakebaseTtl, mintCredential, normalizeHost, normalizeTierName, parseHostFromAuthDescribe, parseLakebaseTtl, parseTargetsYaml, patchWorkflowsForRunnerType, preparePr, projectPath, propagateCredentials, protectedTierNamesFromEnv, pushFailureHint, queryBranchSchema, queryBranchTables, readEnvVar, readTargets, readWorkflowState, reconcilePromoteRunState, reconcileTierToOrigin, recoverOrphans, release, removeRunner, resolveBranchId, resolveBranchPath, resolveCurrentUser, resolveDatabricksHost, resolveEndpointHost, resolveFeatureStartPoint, resolveJavaHome, resolveLatestBootVersion, resolveLatestLtsJavaVersion, resolveMigrationLanguage, resolveMigrationLayout, resolveParentBranch, resolveProfileForHost, resolveProfileForHostSync, resolveProtectedTierNames, rollbackDeploy, rollbackSchemaMigration, runDoctor, runHealthDoctor, runInfraSuite, runPlaywrightInstall, runnerDir, runnerName, sanitizeFeatureSlug, scaffoldAll, scaffoldStaticAll, schemaMigrationStatus, schemaObjectName, selectProfileForHost, setupRunner, stateFilePath, stopRunner, substituteScmUtilsVersion, substrateVersion, syncEnvToCurrentBranch, tierBranchNames, toolForLanguage, tryCreateCatalog, updateEnvConnection, updateWorkflows, uploadDirectory, validateApp, validateCreateInputs, validateWorkflowState, verifyHooks, verifyProject, verifyWorkflows, waitForBranchAuthReady, waitForBranchReady, waitForCi, warmAndVerifyKit, withLakebaseRollback, workflowStateFileExists, writeEnvFile, writePlaywrightTemplates, writeTargets, writeWorkflowState } from './lakebase/index.cjs';
 export { AddRemoteArgs, AheadBehind, AmendArgs, BranchesAtCommitArgs, CheckoutBranchArgs, CloneRepoArgs, CommitAllArgs, CommitAndPushArgs, CommitArgs, CommitFilesArgs, CreateTagArgs, CreateWorktreeArgs, CwdOnlyArgs, DeleteLocalBranchArgs, DeleteRemoteBranchArgs, DeleteRemoteTagArgs, DeleteTagArgs, DiffFilesArgs, DiscardAllChangesArgs, FetchArgs, FileChangeShort, GetFileAtRefArgs, GetMergeBaseArgs, GitBranchInfo, HasRemoteBranchArgs, IsDirtyArgs, ListLocalBranchesArgs, ListMigrationsOnBranchArgs, ListRemoteBranchesArgs, LogRawArgs, MergeBranchArgs, MergeCommit, NearestParent, OutgoingIncomingArgs, ProtectedBranchError, PublishBranchArgs, PullFromArgs, PushCurrentBranchForPrArgs, PushToArgs, RebaseBranchArgs, RecentMergesArgs, RemoveRemoteArgs, RemoveWorktreeArgs, RenameBranchArgs, ResolveNearestParentArgs, ShaArgs, StashIndexArgs, StashWithMessageArgs, UndoLastCommitArgs, WorkflowScopeError, abortRebase, addRemote, checkoutBranch, checkoutDetached, cherryPick, cloneRepo, commit, commitAll, commitAllIfChanged, commitAllSignedOff, commitAmend, commitAndPush, commitSignedOff, createTag, createWorktree, deleteLocalBranch, deleteRemoteBranch, deleteRemoteTag, deleteTag, discardAllChanges, fetch, getAheadBehind, getBranchesAtCommit, getCommitFiles, getCurrentBranch, getDiffFiles, getFileAtRef, getGitHubUrl, getIncomingCommits, getLogRaw, getLogShortstat, getMergeBase, getNearestParentName, getOutgoingCommits, getOwnerRepo, getRecentMerges, getRepoRoot, gitBranchExists, gitInit, hasRemoteBranch, hasUpstream, isDirty, isRebasing, listLocalBranches, listMigrationsOnBranch, listRemoteBranches, listRemotes, listTags, listWorktrees, mergeBranch, publishBranch, pull, pullFrom, pullRebase, push, pushCurrentBranchForPr, pushTo, rebaseBranch, removeRemote, removeWorktree, renameBranch, resolveDefaultBranch, resolveNearestParent, revert, stash, stashApply, stashDrop, stashDropAll, stashIncludeUntracked, stashList, stashPop, stashStaged, sync, undoLastCommit } from './git/index.cjs';
 export { CopyDirSubstitutedArgs, LAKEBASE_BRANCH_NAME_MAX, OwnerRepo, PROXY_ENV_KEYS, PollProbeDone, PollProbePending, PollProbeResult, PollUntilArgs, PollUntilDoneResult, PollUntilResult, PollUntilTimeoutResult, copyDirSubstituted, delay, extractZipToDir, formatOwnerRepo, isCliEntry, parseOwnerRepo, patchPomForLakebase, pollUntil, pollUntilDefined, proxyEnvSubset, sanitizeArtifactId, sanitizeBranchName, withProxyEnv } from './util/index.cjs';
 export { C as CwdOnly, E as ExecOptions, e as exec, s as shq } from '../exec-CwxSWhlz.cjs';

package/dist/scripts/index.d.ts

@@ -1,6 +1,6 @@
-export { CreateRepoOptions, GITHUB_SCOPES, GitHubAuthDiagnosis, GitHubAuthSource, GitHubRepoError, GitHubRunnerError, GitHubSecretsError, RepoRunner, VsCodeSessionOptions, createRegistrationToken, createRepo, deleteRepo, deleteRunner, diagnoseGitHubAuth, getActionsEnabled, getCurrentUser, getRepoFullName, getRunnerIdByName, getRunnerStatus, listRepoRunners, listSecretNames, repoExists, resolveGitHubToken, setRepoSecret, setRepoSecrets, tryGhAuthToken, tryVsCodeSession } from './github/index.js';
+export { CreateRepoOptions, GITHUB_SCOPES, GitHubAuthDiagnosis, GitHubAuthSource, GitHubRepoError, GitHubRunnerError, GitHubScopeStatus, GitHubSecretsError, RepoRunner, VsCodeSessionOptions, checkGitHubScopes, createRegistrationToken, createRepo, deleteRepo, deleteRunner, diagnoseGitHubAuth, getActionsEnabled, getCurrentUser, getRepoFullName, getRunnerIdByName, getRunnerStatus, listRepoRunners, listSecretNames, repoExists, resolveGitHubToken, setRepoSecret, setRepoSecrets, tryGhAuthToken, tryVsCodeSession } from './github/index.js';
 export { C as CreatePullRequestArgs, F as FastForwardBranchArgs, G as GitHubPullRequestError, M as MergePairedPullRequestArgs, a as MergePairedPullRequestResult, b as MergePullRequestArgs, c as MergePullRequestResult, P as PullRequestCheck, d as PullRequestFile, e as PullRequestInfo, f as PullRequestReview, W as WorkflowRunSummary, g as createPullRequest, h as fastForwardBranch, i as getPullRequest, j as getPullRequestComments, k as getPullRequestFiles, l as getPullRequestReviews, m as listIssueComments, n as listWorkflowRuns, o as mergePairedPullRequest, p as mergePullRequest } from '../pr-e-E4aP4j.js';
-export { AbandonFeatureArgs, AbandonFeatureResult, AddE2eToRunTestsScriptArgs, AddE2eToRunTestsScriptResult, AddInfraToPackageJsonArgs, AddInfraToPackageJsonResult, AddInfraToRunTestsScriptArgs, AddInfraToRunTestsScriptResult, AddPlaywrightToPackageJsonArgs, AddPlaywrightToPackageJsonResult, AddPythonE2eDepsArgs, AddPythonE2eDepsResult, AdoptLakebaseProjectArgs, AdoptLakebaseProjectResult, AdoptStateArgs, AdoptStateResult, AppServicePrincipal, AppliedSchemaMigration, ApplySchemaMigrationsArgs, ApplySchemaMigrationsResult, BranchLookupOpts, BranchMetadata, CONVENTION_TIER_DEFAULTS, CatalogExistsArgs, CheckoutMode, CheckoutPairedArgs, CheckoutPairedResult, ClaimFeatureBranchArgs, ClaimFeatureBranchResult, ClaimedOrphan, ClientFramework, CommandDriftReport, CommandFileEntry, CommandFileStatus, ConnectionArgs, ConsortSetupHooks, CreateBranchArgs, CreateConventionBranchArgs, CreateConventionPairedBranchArgs, CreateLongRunningBranchArgs, CreateLongRunningBranchResult, CreatePairedBranchArgs, CreatePairedBranchResult, CreateProjectArgs, CreateProjectResult, CutBackupArgs, CutBackupResult, DEFAULT_PROTECTED_TIER_NAMES, DOTNET_EFCORE_DEFAULTS, DOTNET_FLYWAY_DIR, DatabricksProfile, DeleteAppEndpointArgs, DeleteAppEndpointResult, DeleteBranchArgs, DeletePairedBranchArgs, DeletePairedBranchResult, DeployClaudeCommandsOptions, DeployClaudeCommandsResult, DeployEnvExampleArgs, DeployLanguageProjectArgs, DeploySpringStarterArgs, DeployTarget, DeployTargetsConfig, DetectCommandDriftArgs, DetectScaffoldedDriftArgs, DetectWorkflowDriftArgs, DoctorArgs, DoctorFinding, DoctorReport, DoctorSeverity, DotnetMigrationTool, DsnArgs, DsnResult, EF_DESIGN_PACKAGE, EfCoreProject, EnableE2eForProjectArgs, EnableE2eForProjectResult, EnableInfraForProjectArgs, EnableInfraForProjectResult, EndpointInfo, EnsureAppEndpointArgs, EnsureAppEndpointResult, EnsureEndpointArgs, EnsureLakebaseSecretAuthArgs, EnsureLakebaseSecretAuthResult, EnsureProfilePinnedArgs, EnsureProfilePinnedResult, EnsureSchemaAndVolumeArgs, EnsureSchemaAndVolumeResult, FIXABLE_FINDING_IDS, FixFindingArgs, FixFindingResult, FixableFindingId, GateInvariant, GateStatus, GenerateAppYamlOptions, GenerateMavenProjectOptions, GetAppEndpointArgs, GetAppEndpointResult, GetAppServicePrincipalArgs, GetCiAppEndpointArgs, GetCiAppEndpointResult, GetConnectionArgs, GetCredentialArgs, GetEndpointArgs, GetSchemaDiffArgs, GrantLakebasePermissionArgs, GrantLakebasePermissionResult, GrantUcCatalogPermissionArgs, GrantUcCatalogPermissionResult, HealthDoctorReport, HookVerification, InfraCheckResult, InfraSuiteResult, InitWorkflowStateArgs, InitializrMetadata, InitializrNetworkError, InitializrParseError, InstallPlaywrightArgs, InstallPlaywrightOptions, InstallPlaywrightResult, LakebaseBranchError, LakebaseBranchInfo, LakebaseBranchTtlTooLongError, LakebasePermissionLevel, LakebaseProjectArgs, LakebaseProjectError, LakebaseProjectInfo, LakebaseProjectMetadata, ListSchemaMigrationsArgs, MAVEN_FLYWAY_DIR, MIGRATION_DEFAULTS, MergeArgs, MergePairedArgs, MergePairedResult, MergeResult, MigrationDefaults, MigrationLanguage, MigrationLayout, ModifiedSchemaObject, NODE_E2E_TEMPLATE_FILES, OrphanCandidate, PLAYWRIGHT_TEMPLATE_FILES, PLAYWRIGHT_TEST_VERSION_RANGE, PYTEST_BDD_VERSION_RANGE, PYTEST_PLAYWRIGHT_VERSION_RANGE, PYTHON_E2E_TEMPLATE_FILES, PendingSchemaMigration, PoolArgs, PreflightResult, PreparePrArgs, PreparePrResult, ProgressCallback, ProjectLanguage, PropagateCredentialsArgs, PropagateCredentialsResult, ProtectedBranchCommitError, QueryBranchSchemaArgs, RecoverOrphansArgs, RecoverOrphansResult, ReleaseArgs, ReleaseResult, RemoveRunnerArgs, ResolveDatabricksHostArgs, ResolveMigrationLayoutArgs, RollbackDeployArgs, RollbackDeployResult, RollbackOptions, RollbackSchemaMigrationArgs, RollbackSchemaMigrationResult, RunDoctorDeps, RunInfraSuiteArgs, RunPlaywrightInstallArgs, RunPlaywrightInstallResult, RunnerInfo, RunnerReportFn, RunnerType, SCM_STATES, STATE_FILE_REL, ScaffoldAllArgs, ScaffoldOptions, ScaffoldReportFn, ScaffoldStaticAllArgs, ScaffoldStaticAllResult, ScaffoldedDriftReport, SchemaColumn, SchemaDiffResult, SchemaMigrationError, SchemaMigrationFile, SchemaMigrationLanguage, SchemaMigrationStatusArgs, SchemaMigrationStatusResult, SchemaMigrationToolName, SchemaObject, SchemaQueryRow, ScmAbandonError, ScmAdoptError, ScmClaimError, ScmDoctorFixError, ScmMergeError, ScmPreparePrError, ScmRecoverError, ScmState, ScmWaitCiError, ScmWorkflowState, SetupRunnerArgs, SftddSetupHooks, SpringInitializrClient, SpringJvmLanguage, StaleBranchFinding, SyncEnvArgs, SyncEnvResult, TableSchema, TierTopology, TryCreateCatalogArgs, TryCreateCatalogResult, UcCatalogPermission, UpdateEnvConnectionArgs, UpdateWorkflowsArgs, UpdateWorkflowsResult, UploadDirectoryArgs, UploadDirectoryResult, ValidateAppOptions, ValidateAppResult, ValidationError, ValidationResult, WaitCiArgs, WaitCiResult, WaitForBranchAuthReadyArgs, WaitForBranchReadyArgs, WorkflowDriftReport, WorkflowFileStatus, WorkflowFileUpdate, WorkflowStatus, WorkflowUpdateOutcome, WorkflowVerification, WriteEnvFileArgs, WritePlaywrightTemplatesArgs, WritePlaywrightTemplatesResult, _testMakeBrownfieldFixture, abandonFeatureBranch, addE2eToRunTestsScript, addInfraToPackageJson, addInfraToRunTestsScript, addPlaywrightToPackageJson, adoptLakebaseProject, adoptScmState, applySchemaMigrations, assertAdoptionPreflight, assertCleanForFork, assertCommitTargetNotProtected, assertCreatedProjectReady, buildPostgresUrl, buildSchemaQuery, cacheProjectRetention, catalogExists, catalogExplorerUrl, checkDatabricksAuth, checkoutPaired, claimFeatureBranch, clearRetentionCache, compileMigrationPattern, connectionApplicationName, createBranch, createFeaturePairedBranch, createLakebaseProject, createLongRunningBranch, createPairedBranch, createPerfPairedBranch, createProject, createTestPairedBranch, createUatPairedBranch, cutBackup, databricksAuthPrereqMessage, defaultRefreshPromoteWorkflows, deleteAppEndpoint, deleteBranch, deleteLakebaseProject, deletePairedBranch, deleteProjectArgs, deployClaudeAgents, deployClaudeCommands, deployClaudeSettings, deployClaudeSkills, deployClientProject, deployDeployTargets, deployEnv, deployEnvExample, deployGitignore, deployLanguageProject, deployScripts, deploySpringStarter, deployVscodeSettings, deployWorkflows, deriveCiAppName, describeGates, detectCommandDrift, detectLanguage, detectLanguageAt, detectScaffoldedDrift, detectWorkflowDrift, dirIsEmpty, enableE2eForProject, enableInfraForProject, endpointPath, ensureAppEndpoint, ensureCachedArchive, ensureEndpoint, ensureLakebaseSecretAuth, ensureProfilePinned, ensurePythonBddDeps, ensurePythonE2eDeps, ensureSchemaAndVolume, extractPullNumber, featureBranchName, findCsprojFiles, findDefaultBranchName, findEfCoreProject, findHistoryRetentionDuration, fixFinding, flywayMigrationsDir, formatJUnit, formatSchemaDiffAsMarkdown, generateAppYaml, getAppEndpoint, getAppServicePrincipal, getBranchByName, getCachedProjectRetention, getCiAppEndpoint, getConnection, getCredential, getDefaultBranch, getDefaultBranchId, getDefaultBranchName, getEndpoint, getProjectInfo, getProjectRetentionDuration, getRunnerInfo, getSchemaDiff, getTargetNames, grantLakebasePermission, grantUcCatalogPermission, hasDotnetMarker, inferTierTopology, initWorkflowState, installHooks, installPlaywright, isAllSchemas, isDotnetFlywayProject, isDotnetProject, isForeignFeatureClaim, isGitTracked, isLongRunningTierBranch, isLtsJavaVersion, isPrereleaseBootVersion, isRunning, isTier, isTtlTooLongError, kitWarmWarning, listAppDeployments, listBranches, listSchemaMigrations, mergeFeature, mergePaired, minLakebaseTtl, mintCredential, normalizeHost, normalizeTierName, parseHostFromAuthDescribe, parseLakebaseTtl, parseTargetsYaml, patchWorkflowsForRunnerType, preparePr, projectPath, propagateCredentials, protectedTierNamesFromEnv, pushFailureHint, queryBranchSchema, queryBranchTables, readEnvVar, readTargets, readWorkflowState, reconcilePromoteRunState, reconcileTierToOrigin, recoverOrphans, release, removeRunner, resolveBranchId, resolveBranchPath, resolveCurrentUser, resolveDatabricksHost, resolveEndpointHost, resolveFeatureStartPoint, resolveJavaHome, resolveLatestBootVersion, resolveLatestLtsJavaVersion, resolveMigrationLanguage, resolveMigrationLayout, resolveParentBranch, resolveProfileForHost, resolveProfileForHostSync, resolveProtectedTierNames, rollbackDeploy, rollbackSchemaMigration, runDoctor, runHealthDoctor, runInfraSuite, runPlaywrightInstall, runnerDir, runnerName, sanitizeFeatureSlug, scaffoldAll, scaffoldStaticAll, schemaMigrationStatus, schemaObjectName, selectProfileForHost, setupRunner, stateFilePath, stopRunner, substituteScmUtilsVersion, substrateVersion, syncEnvToCurrentBranch, tierBranchNames, toolForLanguage, tryCreateCatalog, updateEnvConnection, updateWorkflows, uploadDirectory, validateApp, validateCreateInputs, validateWorkflowState, verifyHooks, verifyProject, verifyWorkflows, waitForBranchAuthReady, waitForBranchReady, waitForCi, warmAndVerifyKit, withLakebaseRollback, workflowStateFileExists, writeEnvFile, writePlaywrightTemplates, writeTargets, writeWorkflowState } from './lakebase/index.js';
+export { AbandonFeatureArgs, AbandonFeatureResult, AddE2eToRunTestsScriptArgs, AddE2eToRunTestsScriptResult, AddInfraToPackageJsonArgs, AddInfraToPackageJsonResult, AddInfraToRunTestsScriptArgs, AddInfraToRunTestsScriptResult, AddPlaywrightToPackageJsonArgs, AddPlaywrightToPackageJsonResult, AddPythonE2eDepsArgs, AddPythonE2eDepsResult, AdoptLakebaseProjectArgs, AdoptLakebaseProjectResult, AdoptStateArgs, AdoptStateResult, AppServicePrincipal, AppliedSchemaMigration, ApplySchemaMigrationsArgs, ApplySchemaMigrationsResult, BranchLookupOpts, BranchMetadata, CONVENTION_TIER_DEFAULTS, CatalogExistsArgs, CheckoutMode, CheckoutPairedArgs, CheckoutPairedResult, ClaimFeatureBranchArgs, ClaimFeatureBranchResult, ClaimedOrphan, ClientFramework, CommandDriftReport, CommandFileEntry, CommandFileStatus, ConnectionArgs, ConsortSetupHooks, CreateBranchArgs, CreateConventionBranchArgs, CreateConventionPairedBranchArgs, CreateLongRunningBranchArgs, CreateLongRunningBranchResult, CreatePairedBranchArgs, CreatePairedBranchResult, CreateProjectArgs, CreateProjectResult, CutBackupArgs, CutBackupResult, DEFAULT_PROTECTED_TIER_NAMES, DOTNET_EFCORE_DEFAULTS, DOTNET_FLYWAY_DIR, DatabricksProfile, DeleteAppEndpointArgs, DeleteAppEndpointResult, DeleteBranchArgs, DeletePairedBranchArgs, DeletePairedBranchResult, DeployClaudeCommandsOptions, DeployClaudeCommandsResult, DeployEnvExampleArgs, DeployLanguageProjectArgs, DeploySpringStarterArgs, DeployTarget, DeployTargetsConfig, DetectCommandDriftArgs, DetectScaffoldedDriftArgs, DetectWorkflowDriftArgs, DoctorArgs, DoctorFinding, DoctorReport, DoctorSeverity, DotnetMigrationTool, DsnArgs, DsnResult, EF_DESIGN_PACKAGE, EfCoreProject, EnableE2eForProjectArgs, EnableE2eForProjectResult, EnableInfraForProjectArgs, EnableInfraForProjectResult, EndpointInfo, EnsureAppEndpointArgs, EnsureAppEndpointResult, EnsureEndpointArgs, EnsureLakebaseSecretAuthArgs, EnsureLakebaseSecretAuthResult, EnsureProfilePinnedArgs, EnsureProfilePinnedResult, EnsureSchemaAndVolumeArgs, EnsureSchemaAndVolumeResult, FIXABLE_FINDING_IDS, FixFindingArgs, FixFindingResult, FixableFindingId, GateInvariant, GateStatus, GenerateAppYamlOptions, GenerateMavenProjectOptions, GetAppEndpointArgs, GetAppEndpointResult, GetAppServicePrincipalArgs, GetCiAppEndpointArgs, GetCiAppEndpointResult, GetConnectionArgs, GetCredentialArgs, GetEndpointArgs, GetSchemaDiffArgs, GrantLakebasePermissionArgs, GrantLakebasePermissionResult, GrantUcCatalogPermissionArgs, GrantUcCatalogPermissionResult, HealthDoctorReport, HookVerification, InfraCheckResult, InfraSuiteResult, InitWorkflowStateArgs, InitializrMetadata, InitializrNetworkError, InitializrParseError, InstallPlaywrightArgs, InstallPlaywrightOptions, InstallPlaywrightResult, LakebaseBranchError, LakebaseBranchInfo, LakebaseBranchTtlTooLongError, LakebasePermissionLevel, LakebaseProjectArgs, LakebaseProjectError, LakebaseProjectInfo, LakebaseProjectMetadata, ListSchemaMigrationsArgs, MAVEN_FLYWAY_DIR, MIGRATION_DEFAULTS, MergeArgs, MergePairedArgs, MergePairedResult, MergeResult, MigrationDefaults, MigrationLanguage, MigrationLayout, ModifiedSchemaObject, NODE_E2E_TEMPLATE_FILES, OrphanCandidate, PLAYWRIGHT_TEMPLATE_FILES, PLAYWRIGHT_TEST_VERSION_RANGE, PYTEST_BDD_VERSION_RANGE, PYTEST_PLAYWRIGHT_VERSION_RANGE, PYTHON_E2E_TEMPLATE_FILES, PendingSchemaMigration, PoolArgs, PreflightResult, PreparePrArgs, PreparePrResult, ProgressCallback, ProjectLanguage, PropagateCredentialsArgs, PropagateCredentialsResult, ProtectedBranchCommitError, QueryBranchSchemaArgs, RecoverOrphansArgs, RecoverOrphansResult, ReleaseArgs, ReleaseResult, RemoveRunnerArgs, ResolveDatabricksHostArgs, ResolveMigrationLayoutArgs, RollbackDeployArgs, RollbackDeployResult, RollbackOptions, RollbackSchemaMigrationArgs, RollbackSchemaMigrationResult, RunDoctorDeps, RunInfraSuiteArgs, RunPlaywrightInstallArgs, RunPlaywrightInstallResult, RunnerInfo, RunnerReportFn, RunnerType, SCM_STATES, STATE_FILE_REL, ScaffoldAllArgs, ScaffoldOptions, ScaffoldReportFn, ScaffoldStaticAllArgs, ScaffoldStaticAllResult, ScaffoldedDriftReport, SchemaColumn, SchemaDiffResult, SchemaMigrationError, SchemaMigrationFile, SchemaMigrationLanguage, SchemaMigrationStatusArgs, SchemaMigrationStatusResult, SchemaMigrationToolName, SchemaObject, SchemaQueryRow, ScmAbandonError, ScmAdoptError, ScmClaimError, ScmDoctorFixError, ScmMergeError, ScmPreparePrError, ScmRecoverError, ScmState, ScmWaitCiError, ScmWorkflowState, SetupRunnerArgs, SftddSetupHooks, SpringInitializrClient, SpringJvmLanguage, StaleBranchFinding, SyncEnvArgs, SyncEnvResult, TableSchema, TierTopology, TryCreateCatalogArgs, TryCreateCatalogResult, UcCatalogPermission, UpdateEnvConnectionArgs, UpdateWorkflowsArgs, UpdateWorkflowsResult, UploadDirectoryArgs, UploadDirectoryResult, ValidateAppOptions, ValidateAppResult, ValidationError, ValidationResult, WaitCiArgs, WaitCiResult, WaitForBranchAuthReadyArgs, WaitForBranchReadyArgs, WorkflowDriftReport, WorkflowFileStatus, WorkflowFileUpdate, WorkflowStatus, WorkflowUpdateOutcome, WorkflowVerification, WriteEnvFileArgs, WritePlaywrightTemplatesArgs, WritePlaywrightTemplatesResult, _testMakeBrownfieldFixture, abandonFeatureBranch, addE2eToRunTestsScript, addInfraToPackageJson, addInfraToRunTestsScript, addPlaywrightToPackageJson, adoptLakebaseProject, adoptScmState, applySchemaMigrations, assertAdoptionPreflight, assertCleanForFork, assertCommitTargetNotProtected, assertCreatedProjectReady, buildPostgresUrl, buildSchemaQuery, cacheProjectRetention, catalogExists, catalogExplorerUrl, checkDatabricksAuth, checkGitHubWorkflowScope, checkoutPaired, claimFeatureBranch, clearRetentionCache, compileMigrationPattern, connectionApplicationName, createBranch, createFeaturePairedBranch, createLakebaseProject, createLongRunningBranch, createPairedBranch, createPerfPairedBranch, createProject, createTestPairedBranch, createUatPairedBranch, cutBackup, databricksAuthPrereqMessage, defaultRefreshPromoteWorkflows, deleteAppEndpoint, deleteBranch, deleteLakebaseProject, deletePairedBranch, deleteProjectArgs, deployClaudeAgents, deployClaudeCommands, deployClaudeSettings, deployClaudeSkills, deployClientProject, deployDeployTargets, deployEnv, deployEnvExample, deployGitignore, deployLanguageProject, deployScripts, deploySpringStarter, deployVscodeSettings, deployWorkflows, deriveCiAppName, describeGates, detectCommandDrift, detectLanguage, detectLanguageAt, detectScaffoldedDrift, detectWorkflowDrift, dirIsEmpty, enableE2eForProject, enableInfraForProject, endpointPath, ensureAppEndpoint, ensureCachedArchive, ensureEndpoint, ensureLakebaseSecretAuth, ensureProfilePinned, ensurePythonBddDeps, ensurePythonE2eDeps, ensureSchemaAndVolume, extractPullNumber, featureBranchName, findCsprojFiles, findDefaultBranchName, findEfCoreProject, findHistoryRetentionDuration, fixFinding, flywayMigrationsDir, formatJUnit, formatSchemaDiffAsMarkdown, generateAppYaml, getAppEndpoint, getAppServicePrincipal, getBranchByName, getCachedProjectRetention, getCiAppEndpoint, getConnection, getCredential, getDefaultBranch, getDefaultBranchId, getDefaultBranchName, getEndpoint, getProjectInfo, getProjectRetentionDuration, getRunnerInfo, getSchemaDiff, getTargetNames, githubWorkflowScopePrereqMessage, grantLakebasePermission, grantUcCatalogPermission, hasDotnetMarker, inferTierTopology, initWorkflowState, installHooks, installPlaywright, isAllSchemas, isDotnetFlywayProject, isDotnetProject, isForeignFeatureClaim, isGitTracked, isLongRunningTierBranch, isLtsJavaVersion, isPrereleaseBootVersion, isRunning, isTier, isTtlTooLongError, kitWarmWarning, listAppDeployments, listBranches, listSchemaMigrations, mergeFeature, mergePaired, minLakebaseTtl, mintCredential, normalizeHost, normalizeTierName, parseHostFromAuthDescribe, parseLakebaseTtl, parseTargetsYaml, patchWorkflowsForRunnerType, preparePr, projectPath, propagateCredentials, protectedTierNamesFromEnv, pushFailureHint, queryBranchSchema, queryBranchTables, readEnvVar, readTargets, readWorkflowState, reconcilePromoteRunState, reconcileTierToOrigin, recoverOrphans, release, removeRunner, resolveBranchId, resolveBranchPath, resolveCurrentUser, resolveDatabricksHost, resolveEndpointHost, resolveFeatureStartPoint, resolveJavaHome, resolveLatestBootVersion, resolveLatestLtsJavaVersion, resolveMigrationLanguage, resolveMigrationLayout, resolveParentBranch, resolveProfileForHost, resolveProfileForHostSync, resolveProtectedTierNames, rollbackDeploy, rollbackSchemaMigration, runDoctor, runHealthDoctor, runInfraSuite, runPlaywrightInstall, runnerDir, runnerName, sanitizeFeatureSlug, scaffoldAll, scaffoldStaticAll, schemaMigrationStatus, schemaObjectName, selectProfileForHost, setupRunner, stateFilePath, stopRunner, substituteScmUtilsVersion, substrateVersion, syncEnvToCurrentBranch, tierBranchNames, toolForLanguage, tryCreateCatalog, updateEnvConnection, updateWorkflows, uploadDirectory, validateApp, validateCreateInputs, validateWorkflowState, verifyHooks, verifyProject, verifyWorkflows, waitForBranchAuthReady, waitForBranchReady, waitForCi, warmAndVerifyKit, withLakebaseRollback, workflowStateFileExists, writeEnvFile, writePlaywrightTemplates, writeTargets, writeWorkflowState } from './lakebase/index.js';
 export { AddRemoteArgs, AheadBehind, AmendArgs, BranchesAtCommitArgs, CheckoutBranchArgs, CloneRepoArgs, CommitAllArgs, CommitAndPushArgs, CommitArgs, CommitFilesArgs, CreateTagArgs, CreateWorktreeArgs, CwdOnlyArgs, DeleteLocalBranchArgs, DeleteRemoteBranchArgs, DeleteRemoteTagArgs, DeleteTagArgs, DiffFilesArgs, DiscardAllChangesArgs, FetchArgs, FileChangeShort, GetFileAtRefArgs, GetMergeBaseArgs, GitBranchInfo, HasRemoteBranchArgs, IsDirtyArgs, ListLocalBranchesArgs, ListMigrationsOnBranchArgs, ListRemoteBranchesArgs, LogRawArgs, MergeBranchArgs, MergeCommit, NearestParent, OutgoingIncomingArgs, ProtectedBranchError, PublishBranchArgs, PullFromArgs, PushCurrentBranchForPrArgs, PushToArgs, RebaseBranchArgs, RecentMergesArgs, RemoveRemoteArgs, RemoveWorktreeArgs, RenameBranchArgs, ResolveNearestParentArgs, ShaArgs, StashIndexArgs, StashWithMessageArgs, UndoLastCommitArgs, WorkflowScopeError, abortRebase, addRemote, checkoutBranch, checkoutDetached, cherryPick, cloneRepo, commit, commitAll, commitAllIfChanged, commitAllSignedOff, commitAmend, commitAndPush, commitSignedOff, createTag, createWorktree, deleteLocalBranch, deleteRemoteBranch, deleteRemoteTag, deleteTag, discardAllChanges, fetch, getAheadBehind, getBranchesAtCommit, getCommitFiles, getCurrentBranch, getDiffFiles, getFileAtRef, getGitHubUrl, getIncomingCommits, getLogRaw, getLogShortstat, getMergeBase, getNearestParentName, getOutgoingCommits, getOwnerRepo, getRecentMerges, getRepoRoot, gitBranchExists, gitInit, hasRemoteBranch, hasUpstream, isDirty, isRebasing, listLocalBranches, listMigrationsOnBranch, listRemoteBranches, listRemotes, listTags, listWorktrees, mergeBranch, publishBranch, pull, pullFrom, pullRebase, push, pushCurrentBranchForPr, pushTo, rebaseBranch, removeRemote, removeWorktree, renameBranch, resolveDefaultBranch, resolveNearestParent, revert, stash, stashApply, stashDrop, stashDropAll, stashIncludeUntracked, stashList, stashPop, stashStaged, sync, undoLastCommit } from './git/index.js';
 export { CopyDirSubstitutedArgs, LAKEBASE_BRANCH_NAME_MAX, OwnerRepo, PROXY_ENV_KEYS, PollProbeDone, PollProbePending, PollProbeResult, PollUntilArgs, PollUntilDoneResult, PollUntilResult, PollUntilTimeoutResult, copyDirSubstituted, delay, extractZipToDir, formatOwnerRepo, isCliEntry, parseOwnerRepo, patchPomForLakebase, pollUntil, pollUntilDefined, proxyEnvSubset, sanitizeArtifactId, sanitizeBranchName, withProxyEnv } from './util/index.js';
 export { C as CwdOnly, E as ExecOptions, e as exec, s as shq } from '../exec-CwxSWhlz.js';

package/dist/scripts/index.js

@@ -8098,6 +8098,18 @@ async function getCurrentUser() {
     wrap(err, "GitHub authentication failed");
   }
 }
+async function checkGitHubScopes(required = GITHUB_SCOPES) {
+  try {
+    const ctx = await newContext();
+    const res = await ctx.octokit.rest.users.getAuthenticated();
+    const header = res.headers["x-oauth-scopes"];
+    if (header === void 0 || header === null) return { granted: null, missing: [] };
+    const granted = String(header).split(",").map((s) => s.trim()).filter(Boolean);
+    return { granted, missing: required.filter((s) => !granted.includes(s)) };
+  } catch (err) {
+    wrap(err, "GitHub scope check failed");
+  }
+}
 async function createRepo(name, opts = {}) {
   try {
     const ctx = await newContext();
@@ -9725,8 +9737,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.3".length > 0) {
-    cached = "0.3.3";
+  if ("0.3.5".length > 0) {
+    cached = "0.3.5";
     return cached;
   }
   cached = "unknown";
@@ -11419,6 +11431,22 @@ async function checkDatabricksAuth(host, run = (args) => runDatabricks(args, { h
     return { ok: false, reason: lastLines(e.stderr, 2) || e.message || "databricks auth token failed" };
   }
 }
+async function checkGitHubWorkflowScope(probe = () => checkGitHubScopes(["workflow"])) {
+  try {
+    const { granted, missing } = await probe();
+    if (granted === null) return { ok: true };
+    if (missing.includes("workflow")) {
+      return { ok: false, reason: `token grants [${granted.join(", ") || "none"}] but not \`workflow\`` };
+    }
+    return { ok: true };
+  } catch {
+    return { ok: true };
+  }
+}
+function githubWorkflowScopePrereqMessage(reason) {
+  return "The GitHub token lacks the `workflow` OAuth scope, required to push the project's `.github/workflows/*` CI files. (Without this check, scaffolding runs all the way to the final push, is rejected, and rolls back.) Grant the scope, then re-run:\n  - gh CLI:  gh auth refresh -h github.com -s workflow\n  - VS Code: re-sign in to GitHub and approve the workflow scope\n  - token:   set GITHUB_TOKEN to a PAT that includes the `workflow` scope" + (reason ? `
+(${reason})` : "");
+}
 function databricksAuthPrereqMessage(host, reason) {
   const hostFlag = host ? ` --host ${host.replace(/\/+$/, "")}` : "";
   return `Databricks authentication is required before creating a project. Run: databricks auth login${hostFlag}` + (reason ? `
@@ -13738,6 +13766,13 @@ async function createProject(input, progress) {
   if (!auth7.ok) {
     throw new Error(databricksAuthPrereqMessage(host, auth7.reason));
   }
+  if (useGithub) {
+    report("Checking GitHub token scopes...");
+    const scope = await checkGitHubWorkflowScope();
+    if (!scope.ok) {
+      throw new Error(githubWorkflowScopePrereqMessage(scope.reason));
+    }
+  }
   if (useGithub) {
     report("Creating GitHub repository...", fullRepoName);
     await createRepo(fullRepoName, {
@@ -18476,6 +18511,40 @@ async function checkGitRemote(projectDir) {
     };
   }
 }
+async function checkGitHubTokenScope(probe = () => checkGitHubScopes(["workflow"])) {
+  try {
+    const { granted, missing } = await probe();
+    if (granted === null) {
+      return {
+        name: "github-token-scope",
+        status: "skip",
+        message: "GitHub token scopes not visible (fine-grained PAT / App token) - `workflow` scope unverified"
+      };
+    }
+    if (missing.includes("workflow")) {
+      return {
+        name: "github-token-scope",
+        status: "fail",
+        message: "GitHub token lacks the `workflow` scope - pushes touching .github/workflows/* will be rejected",
+        detail: { granted },
+        hint: "Grant it with `gh auth refresh -h github.com -s workflow`, re-sign in to GitHub in VS Code and approve the workflow scope, or set GITHUB_TOKEN to a PAT that includes `workflow`."
+      };
+    }
+    return {
+      name: "github-token-scope",
+      status: "ok",
+      message: "GitHub token has the `workflow` scope",
+      detail: { granted }
+    };
+  } catch (err) {
+    return {
+      name: "github-token-scope",
+      status: "skip",
+      message: "GitHub token scope check skipped (no token resolved, or GitHub unreachable)",
+      detail: { error: err.message }
+    };
+  }
+}
 function checkLanguage(projectDir) {
   try {
     const lang = detectLanguage(projectDir);
@@ -18585,6 +18654,7 @@ async function runDoctor2(args = {}) {
     host
   );
   const gitRemote = await checkGitRemote(projectDir);
+  const githubTokenScope = await checkGitHubTokenScope();
   const language = checkLanguage(projectDir);
   const hooks = checkHooks(projectDir);
   const workflowDrift = checkWorkflowDrift(projectDir);
@@ -18606,6 +18676,7 @@ async function runDoctor2(args = {}) {
     configProfile,
     lakebaseProject,
     gitRemote,
+    githubTokenScope,
     language,
     hooks,
     workflowDrift
@@ -19352,6 +19423,8 @@ export {
   catalogExists,
   catalogExplorerUrl,
   checkDatabricksAuth,
+  checkGitHubScopes,
+  checkGitHubWorkflowScope,
   checkoutBranch,
   checkoutDetached,
   checkoutPaired,
@@ -19496,6 +19569,7 @@ export {
   getTargetNames,
   gitBranchExists,
   gitInit,
+  githubWorkflowScopePrereqMessage,
   grantLakebasePermission,
   grantUcCatalogPermission,
   hasDotnetMarker,

package/dist/scripts/lakebase/ci-resolve-branch.cli.cjs

@@ -79629,8 +79629,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.3".length > 0) {
-    cached = "0.3.3";
+  if ("0.3.5".length > 0) {
+    cached = "0.3.5";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/ci-resolve-branch.cli.js

@@ -721,8 +721,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.3".length > 0) {
-    cached = "0.3.3";
+  if ("0.3.5".length > 0) {
+    cached = "0.3.5";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/collapse-heads.cli.cjs

@@ -79290,8 +79290,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.3".length > 0) {
-    cached = "0.3.3";
+  if ("0.3.5".length > 0) {
+    cached = "0.3.5";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/collapse-heads.cli.js

@@ -393,8 +393,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.3".length > 0) {
-    cached = "0.3.3";
+  if ("0.3.5".length > 0) {
+    cached = "0.3.5";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/detect-language.cli.cjs

@@ -79290,8 +79290,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.3".length > 0) {
-    cached = "0.3.3";
+  if ("0.3.5".length > 0) {
+    cached = "0.3.5";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/detect-language.cli.js

@@ -393,8 +393,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.3.3".length > 0) {
-    cached = "0.3.3";
+  if ("0.3.5".length > 0) {
+    cached = "0.3.5";
     return cached;
   }
   cached = "unknown";