@tailor-platform/sdk 1.48.0 → 1.50.0

package/dist/{runtime-CNg0w27y.mjs → runtime-B2K6JW7V.mjs}

@@ -2,7 +2,7 @@
 import { t as db } from "./schema-C5QjYEc-.mjs";
 import { $ as FilterSchema, A as FunctionExecution_Status, B as AuthOAuth2Client_GrantType, C as TailorDBType_Permission_Operator, D as IdPLang, E as PipelineResolver_OperationType, F as AuthConnection_Type, H as AuthSCIMAttribute_Type, I as AuthHookPoint, J as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, K as TenantProviderConfig_TenantProviderType, L as AuthIDPConfig_AuthType, M as ExecutorJobStatus, N as ExecutorTargetType, O as IdPPermissionOperator, P as ExecutorTriggerType, Q as Condition_Operator, R as AuthInvokerSchema, S as TailorDBGQLPermission_Permit, T as TailorDBType_PermitAction, U as AuthSCIMAttribute_Uniqueness, V as AuthSCIMAttribute_Mutability, W as AuthSCIMConfig_AuthorizationType, X as Subgraph_ServiceType, Y as ApplicationSchemaUpdateAttemptStatus, Z as ConditionSchema, _ as WorkspacePlatformUserRole, a as fetchMachineUserToken, b as TailorDBGQLPermission_Action, d as initOperatorClient, et as PageDirection, g as OperatorService, h as userAgent, i as fetchAll, k as IdPPermissionPermit, m as resolveStaticWebsiteUrls, o as fetchPaged, p as platformBaseUrl, q as UserProfileProviderConfig_UserProfileProviderType, v as WorkflowExecution_Status, w as TailorDBType_Permission_Permit, x as TailorDBGQLPermission_Operator, y as WorkflowJobExecution_Status, z as AuthOAuth2Client_ClientType } from "./client-_kHh0Pip.mjs";
 import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-DTNAMYGy.mjs";
-import { C as loadConfigPath, O as writePlatformConfig, S as loadAccessToken, T as readPlatformConfig, _ as getDistDir, d as buildResolverOperationHookExpr, f as OAuth2ClientSchema, g as createBundleCache, h as loadFilesWithIgnores, m as stringifyFunction, n as generatePluginFilesIfNeeded, p as TailorDBTypeSchema, r as loadApplication, s as createExecutorService, t as defineApplication, u as buildExecutorArgsExpr, v as hashFile, w as loadWorkspaceId, y as loadConfig } from "./application-DUENhx4Y.mjs";
+import { C as loadConfigPath, O as writePlatformConfig, S as loadAccessToken, T as readPlatformConfig, _ as getDistDir, d as buildResolverOperationHookExpr, f as OAuth2ClientSchema, g as createBundleCache, h as loadFilesWithIgnores, m as stringifyFunction, n as generatePluginFilesIfNeeded, p as TailorDBTypeSchema, r as loadApplication, s as createExecutorService, t as defineApplication, u as buildExecutorArgsExpr, v as hashFile, w as loadWorkspaceId, y as loadConfig } from "./application-CZMzt9jL.mjs";
 import { t as multiline } from "./multiline-e3IpANmS.mjs";
 import { t as readPackageJson } from "./package-json-6Px8bDpG.mjs";
 import { n as isCLIError, t as createCLIError } from "./errors-pMPXghkO.mjs";
@@ -267,6 +267,38 @@ function isVerbose() {
 */
 const defineAppCommand = createDefineCommand();
 
+//#endregion
+//#region src/cli/shared/readonly-guard.ts
+/**
+* Throw a CLIError if the active profile has `readonly: true`.
+*
+* Resolves the active profile in this order:
+* 1. `opts.profile` (CLI flag)
+* 2. `process.env.TAILOR_PLATFORM_PROFILE`
+*
+* If neither is set, no profile is in scope so the call is allowed. This is
+* intentional: `TAILOR_PLATFORM_TOKEN` direct access (CI / machine user) and
+* `--workspace-id` without a profile are out-of-band paths whose authorization
+* is governed by the bearer token itself, not by the local profile flag.
+*
+* If the resolved profile cannot be found in the config, this function returns
+* silently and lets downstream loaders surface the not-found error.
+* @param opts - Options
+* @param opts.profile - Optional explicit profile name from command args
+*/
+async function assertWritable(opts) {
+	const profileName = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
+	if (!profileName) return;
+	const profile = (await readPlatformConfig()).profiles[profileName];
+	if (!profile || profile.readonly !== true) return;
+	throw createCLIError({
+		code: "PROFILE_READONLY",
+		message: `Profile "${profileName}" is read-only.`,
+		details: "This profile blocks platform-state mutations (apply, create/update/delete, deploy, etc.). Application-data operations remain available because their permissions are governed by the machine user.",
+		suggestion: `Use a different profile, unset TAILOR_PLATFORM_PROFILE, or run 'tailor-sdk profile update ${profileName} --permission write'.`
+	});
+}
+
 //#endregion
 //#region src/cli/commands/api/api-call.ts
 /**
@@ -568,6 +600,7 @@ Values already present in \`--body\` are never overridden. If a value cannot be
 		})
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		const methodName = extractMethodName(args.endpoint);
 		const method = getMethodDescriptor(methodName);
 		const parsedBody = parseBodyAsObject(args.body);
@@ -5763,6 +5796,20 @@ function formatBreakingChanges(breakingChanges) {
 	}
 	return lines.join("\n");
 }
+/**
+* Format warning changes for display
+* @param {WarningChangeInfo[]} warnings - Warning changes to format
+* @returns {string} Formatted warning changes string
+*/
+function formatWarnings(warnings) {
+	if (warnings.length === 0) return "";
+	const lines = ["Warning: data loss possible:", ""];
+	for (const w of warnings) {
+		const location = w.fieldName ? `${w.typeName}.${w.fieldName}` : w.typeName;
+		lines.push(`  - ${location}: ${w.reason}`);
+	}
+	return lines.join("\n");
+}
 const DIFF_CHANGE_LABELS = {
 	type_added: "type(s) added",
 	type_removed: "type(s) removed",
@@ -5823,15 +5870,37 @@ const MIGRATION_NUMBER_PATTERN = /^\d{4}$/;
 */
 const DEFAULT_DECIMAL_SCALE = 6;
 /**
-* Resolve the effective scale of a field for comparison purposes.
-* Decimal fields without an explicit scale are stored on the platform with the
-* default scale, so we normalize unset values to the default to avoid false drift.
-* @param {SnapshotFieldConfig} field - Field configuration
-* @returns {number | undefined} Effective scale, or undefined for non-decimal fields without scale
+* Normalize a snapshot field in place so the snapshot becomes the canonical
+* form for comparison. Currently fills in the platform default decimal scale
+* when omitted, which avoids false drift between local schemas (where scale
+* may be omitted) and the platform (which always materializes a scale).
+* @param {SnapshotFieldConfig} field - Field configuration to normalize
+*/
+function normalizeSnapshotField(field) {
+	if (field.type === "decimal" && field.scale === void 0) field.scale = 6;
+	if (field.fields) for (const nested of Object.values(field.fields)) normalizeSnapshotField(nested);
+}
+/**
+* Normalize a snapshot type in place to the canonical comparison shape.
+* Currently fills:
+*   - `pluralForm` via inflection when missing (legacy snapshots written
+*     before `pluralForm` became required may omit it)
+*   - per-field `scale` defaults via {@link normalizeSnapshotField}
+*
+* Idempotent — safe to call multiple times on the same input.
+* @param {TailorDBSnapshotType} type - Snapshot type to normalize
+*/
+function normalizeSnapshotType(type) {
+	if (!type.pluralForm) type.pluralForm = inflection.pluralize(type.name);
+	for (const field of Object.values(type.fields)) normalizeSnapshotField(field);
+}
+/**
+* Type guard: is the operand a field-reference (object) operand?
+* @param {SnapshotPermissionOperand} operand - Operand to test
+* @returns {boolean} True if operand is a field-ref (not a value operand)
 */
-function getEffectiveScale(field) {
-	if (field.scale !== void 0) return field.scale;
-	if (field.type === "decimal") return 6;
+function isSnapshotFieldRefOperand(operand) {
+	return typeof operand === "object" && operand !== null && !Array.isArray(operand);
 }
 /**
 * Validate that a migration number follows the expected format (4-digit number)
@@ -5922,6 +5991,7 @@ function createSnapshotFieldConfig(field) {
 		config.fields = {};
 		for (const [nestedName, nestedConfig] of Object.entries(field.config.fields)) config.fields[nestedName] = createSnapshotFieldConfigFromOperatorConfig(nestedConfig);
 	}
+	normalizeSnapshotField(config);
 	return config;
 }
 /**
@@ -5967,21 +6037,22 @@ function createSnapshotFieldConfigFromOperatorConfig(fieldConfig) {
 		config.fields = {};
 		for (const [nestedName, nestedConfig] of Object.entries(fieldConfig.fields)) config.fields[nestedName] = createSnapshotFieldConfigFromOperatorConfig(nestedConfig);
 	}
+	normalizeSnapshotField(config);
 	return config;
 }
 /**
 * Create a snapshot type from a parsed type
 * @param {TailorDBType} type - Parsed TailorDB type definition
-* @returns {SnapshotType} Snapshot type configuration
+* @returns {TailorDBSnapshotType} Snapshot type configuration
 */
 function createSnapshotType(type) {
 	const fields = {};
 	for (const [fieldName, field] of Object.entries(type.fields)) fields[fieldName] = createSnapshotFieldConfig(field);
 	const snapshotType = {
 		name: type.name,
+		pluralForm: type.pluralForm || inflection.pluralize(type.name),
 		fields
 	};
-	if (type.pluralForm) snapshotType.pluralForm = type.pluralForm;
 	if (type.description) snapshotType.description = type.description;
 	if (type.settings) {
 		snapshotType.settings = {};
@@ -6078,7 +6149,9 @@ function createSnapshotFromLocalTypes(types, namespace) {
 */
 function loadSnapshot(filePath) {
 	const content = fs$1.readFileSync(filePath, "utf-8");
-	return JSON.parse(content);
+	const snapshot = JSON.parse(content);
+	for (const type of Object.values(snapshot.types)) normalizeSnapshotType(type);
+	return snapshot;
 }
 /**
 * Load a migration diff from a file
@@ -6087,7 +6160,13 @@ function loadSnapshot(filePath) {
 */
 function loadDiff(filePath) {
 	const content = fs$1.readFileSync(filePath, "utf-8");
-	return JSON.parse(content);
+	const parsed = JSON.parse(content);
+	const warnings = parsed.warnings ?? [];
+	return {
+		...parsed,
+		warnings,
+		hasWarnings: warnings.length > 0
+	};
 }
 /**
 * Get all migration directories and their files, sorted by number
@@ -6350,7 +6429,7 @@ function areFieldsDifferent(oldField, newField) {
 		if (oldSerial.maxValue !== newSerial.maxValue) return true;
 		if ((oldSerial.format ?? "") !== (newSerial.format ?? "")) return true;
 	}
-	if (getEffectiveScale(oldField) !== getEffectiveScale(newField)) return true;
+	if (oldField.scale !== newField.scale) return true;
 	const oldFields = oldField.fields ?? {};
 	const newFields = newField.fields ?? {};
 	const oldFieldNames = Object.keys(oldFields);
@@ -6428,10 +6507,17 @@ function isBreakingFieldChange(typeName, fieldName, oldField, newField) {
 }
 function addChange(ctx, change, oldField, newField) {
 	ctx.changes.push(change);
-	if (change.fieldName) {
-		const breaking = isBreakingFieldChange(change.typeName, change.fieldName, oldField, newField);
-		if (breaking) ctx.breakingChanges.push(breaking);
+	if (!change.fieldName) return;
+	const breaking = isBreakingFieldChange(change.typeName, change.fieldName, oldField, newField);
+	if (breaking) {
+		ctx.breakingChanges.push(breaking);
+		return;
 	}
+	if (change.kind === "field_removed") ctx.warnings.push({
+		typeName: change.typeName,
+		fieldName: change.fieldName,
+		reason: "Field removed (existing data will be dropped in the post-migration phase)"
+	});
 }
 function compareTypeFields(ctx, typeName, prevType, currType) {
 	const prevFieldNames = new Set(Object.keys(prevType.fields));
@@ -6622,9 +6708,12 @@ function comparePermissions(ctx, typeName, oldRecordPerm, newRecordPerm, oldGqlP
 * @returns {MigrationDiff} Migration diff between snapshots
 */
 function compareSnapshots(previous, current) {
+	for (const type of Object.values(previous.types)) normalizeSnapshotType(type);
+	for (const type of Object.values(current.types)) normalizeSnapshotType(type);
 	const ctx = {
 		changes: [],
-		breakingChanges: []
+		breakingChanges: [],
+		warnings: []
 	};
 	const previousTypeNames = new Set(Object.keys(previous.types));
 	const currentTypeNames = new Set(Object.keys(current.types));
@@ -6633,11 +6722,17 @@ function compareSnapshots(previous, current) {
 		typeName,
 		after: current.types[typeName]
 	});
-	for (const typeName of previousTypeNames) if (!currentTypeNames.has(typeName)) ctx.changes.push({
-		kind: "type_removed",
-		typeName,
-		before: previous.types[typeName]
-	});
+	for (const typeName of previousTypeNames) if (!currentTypeNames.has(typeName)) {
+		ctx.changes.push({
+			kind: "type_removed",
+			typeName,
+			before: previous.types[typeName]
+		});
+		ctx.warnings.push({
+			typeName,
+			reason: "Type removed (all records of this type will be dropped in the post-migration phase)"
+		});
+	}
 	for (const typeName of currentTypeNames) {
 		if (!previousTypeNames.has(typeName)) continue;
 		const prevType = previous.types[typeName];
@@ -6656,18 +6751,29 @@ function compareSnapshots(previous, current) {
 		changes: ctx.changes,
 		hasBreakingChanges: ctx.breakingChanges.length > 0,
 		breakingChanges: ctx.breakingChanges,
+		hasWarnings: ctx.warnings.length > 0,
+		warnings: ctx.warnings,
 		requiresMigrationScript: ctx.breakingChanges.length > 0
 	};
 }
 /**
-* Compare local types with a snapshot and generate a diff
+* Compare a snapshot against canonical TailorDBSnapshotType-shaped local types.
+* Callers are expected to pre-convert TailorDBService.types to TailorDBSnapshotType via
+* `createSnapshotType`. As a safety net, `compareSnapshots` re-runs idempotent
+* normalization on both sides, so a caller that forgets will still get correct
+* comparisons (no silent false drift).
 * @param {SchemaSnapshot} snapshot - Schema snapshot to compare against
-* @param {Record<string, TailorDBType>} localTypes - Local type definitions
+* @param {Record<string, TailorDBSnapshotType>} localTypes - Local snapshot-shaped types
 * @param {string} namespace - Namespace for comparison
 * @returns {MigrationDiff} Migration diff
 */
 function compareLocalTypesWithSnapshot(snapshot, localTypes, namespace) {
-	return compareSnapshots(snapshot, createSnapshotFromLocalTypes(localTypes, namespace));
+	return compareSnapshots(snapshot, {
+		version: 1,
+		namespace,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		types: localTypes
+	});
 }
 /**
 * Validate migration files in a directory
@@ -6774,6 +6880,7 @@ function convertRemoteFieldsToSnapshot(remoteType) {
 			...remoteField.serial.format && { format: remoteField.serial.format }
 		};
 		if (remoteField.scale !== void 0) config.scale = remoteField.scale;
+		normalizeSnapshotField(config);
 		fields[fieldName] = config;
 	}
 	return fields;
@@ -6818,9 +6925,7 @@ function compareFields(typeName, fieldName, remoteField, snapshotField) {
 	const remoteVector = remoteField.vector ?? false;
 	const snapshotVector = snapshotField.vector ?? false;
 	if (remoteVector !== snapshotVector) differences.push(`vector: remote=${remoteVector}, expected=${snapshotVector}`);
-	const remoteScale = getEffectiveScale(remoteField);
-	const snapshotScale = getEffectiveScale(snapshotField);
-	if (remoteScale !== snapshotScale) differences.push(`scale: remote=${remoteScale}, expected=${snapshotScale}`);
+	if (remoteField.scale !== snapshotField.scale) differences.push(`scale: remote=${remoteField.scale}, expected=${snapshotField.scale}`);
 	if (differences.length > 0) return {
 		typeName,
 		kind: "field_mismatch",
@@ -6840,6 +6945,7 @@ const SYSTEM_FIELDS = new Set(["id"]);
 * @returns {SchemaDrift[]} List of drifts detected
 */
 function compareRemoteWithSnapshot(remoteTypes, snapshot) {
+	for (const type of Object.values(snapshot.types)) normalizeSnapshotType(type);
 	const drifts = [];
 	const remoteTypeMap = /* @__PURE__ */ new Map();
 	for (const remoteType of remoteTypes) remoteTypeMap.set(remoteType.name, remoteType);
@@ -6905,6 +7011,189 @@ function formatSchemaDrifts(drifts) {
 	return lines.join("\n");
 }
 
+//#endregion
+//#region src/cli/commands/tailordb/migrate/snapshot-manifest.ts
+/**
+* Convert a snapshot field config to proto format
+* @param {SnapshotFieldConfig} config - Snapshot field config
+* @returns {MessageInitShape<typeof TailorDBType_FieldConfigSchema>} Proto field config
+*/
+function convertFieldConfigToProto(config) {
+	const fieldEntry = {
+		type: config.type,
+		allowedValues: config.type === "enum" ? config.allowedValues?.map((v) => ({ ...v })) ?? [] : [],
+		description: config.description || "",
+		validate: toProtoSnapshotFieldValidate(config),
+		array: config.array ?? false,
+		index: config.index ?? false,
+		unique: config.unique ?? false,
+		foreignKey: config.foreignKey ?? false,
+		foreignKeyType: config.foreignKeyType,
+		foreignKeyField: config.foreignKeyField,
+		required: config.required ?? true,
+		vector: config.vector ?? false,
+		...toProtoSnapshotFieldHooks(config),
+		...config.serial && { serial: {
+			start: BigInt(config.serial.start),
+			...config.serial.maxValue !== void 0 && { maxValue: BigInt(config.serial.maxValue) },
+			...config.serial.format && { format: config.serial.format }
+		} },
+		...config.scale !== void 0 && { scale: config.scale }
+	};
+	if (config.type === "nested" && config.fields) fieldEntry.fields = processNestedFieldsFromSnapshot(config.fields);
+	return fieldEntry;
+}
+function toProtoSnapshotFieldValidate(config) {
+	return (config.validate ?? []).map((val) => ({
+		action: TailorDBType_PermitAction.DENY,
+		errorMessage: val.errorMessage || "",
+		...val.script && { script: { expr: val.script.expr ? `!${val.script.expr}` : "" } }
+	}));
+}
+function toProtoSnapshotFieldHooks(config) {
+	if (!config.hooks) return {};
+	return { hooks: {
+		create: config.hooks.create ? { expr: config.hooks.create.expr || "" } : void 0,
+		update: config.hooks.update ? { expr: config.hooks.update.expr || "" } : void 0
+	} };
+}
+/**
+* Process nested fields from snapshot format to proto format
+* @param {Record<string, SnapshotFieldConfig>} fields - Nested fields
+* @returns {Record<string, MessageInitShape<typeof TailorDBType_FieldConfigSchema>>} Proto nested fields
+*/
+function processNestedFieldsFromSnapshot(fields) {
+	const nestedFields = {};
+	for (const [fieldName, fieldConfig] of Object.entries(fields)) if (fieldConfig.type === "nested" && fieldConfig.fields) {
+		const deepNestedFields = processNestedFieldsFromSnapshot(fieldConfig.fields);
+		nestedFields[fieldName] = {
+			type: "nested",
+			allowedValues: fieldConfig.allowedValues?.map((v) => ({ ...v })) ?? [],
+			description: fieldConfig.description || "",
+			validate: toProtoSnapshotFieldValidate(fieldConfig),
+			required: fieldConfig.required ?? true,
+			array: fieldConfig.array ?? false,
+			index: false,
+			unique: false,
+			foreignKey: false,
+			vector: false,
+			...toProtoSnapshotFieldHooks(fieldConfig),
+			fields: deepNestedFields,
+			...fieldConfig.scale !== void 0 && { scale: fieldConfig.scale }
+		};
+	} else nestedFields[fieldName] = {
+		type: fieldConfig.type,
+		allowedValues: fieldConfig.type === "enum" ? fieldConfig.allowedValues?.map((v) => ({ ...v })) ?? [] : [],
+		description: fieldConfig.description || "",
+		validate: toProtoSnapshotFieldValidate(fieldConfig),
+		required: fieldConfig.required ?? true,
+		array: fieldConfig.array ?? false,
+		index: false,
+		unique: false,
+		foreignKey: false,
+		vector: false,
+		...toProtoSnapshotFieldHooks(fieldConfig),
+		...fieldConfig.serial && { serial: {
+			start: BigInt(fieldConfig.serial.start),
+			...fieldConfig.serial.maxValue !== void 0 && { maxValue: BigInt(fieldConfig.serial.maxValue) },
+			...fieldConfig.serial.format && { format: fieldConfig.serial.format }
+		} },
+		...fieldConfig.scale !== void 0 && { scale: fieldConfig.scale }
+	};
+	return nestedFields;
+}
+
+//#endregion
+//#region src/cli/commands/tailordb/migrate/pre-migration-schema.ts
+/**
+* Pre-migration field config adjustments
+*
+* The Pre-phase sends a "relaxed" version of the target schema so that
+* `migrate.ts` scripts can still operate on the previous shape of the data.
+* This module handles the field-level adjustments:
+*
+* - `field_removed`: re-insert the removed field so migrate.ts can read it
+*   (the physical drop happens in Post-phase).
+* - `field_added` with `required: true`: relax to `required: false`.
+* - `field_modified` optional→required, unique constraint added, enum
+*   value removed: keep the looser side until Post-phase.
+*
+* Type-level deletions (`type_removed`) are handled by the deploy flow,
+* which retains the type until Post-phase rather than via this module.
+*
+* Post-phase then sends the final schema, after migrate.ts has had a chance
+* to fix up data.
+*/
+/**
+* Diff change kinds that require pre-migration schema adjustments.
+*/
+const PRE_MIGRATION_FIELD_KINDS = new Set([
+	"field_added",
+	"field_modified",
+	"field_removed"
+]);
+/**
+* Build a map of field changes that require pre-migration schema adjustment.
+* @param {PendingMigration[]} pendingMigrations - Pending migrations to scan
+* @returns {PreMigrationChangesMap} Map of changes keyed by typeName/fieldName
+*/
+function buildPreMigrationChangesMap(pendingMigrations) {
+	const map = /* @__PURE__ */ new Map();
+	for (const migration of pendingMigrations) for (const change of migration.diff.changes) {
+		if (!PRE_MIGRATION_FIELD_KINDS.has(change.kind)) continue;
+		if (!change.fieldName) continue;
+		const perType = map.get(change.typeName) ?? /* @__PURE__ */ new Map();
+		perType.set(change.fieldName, change);
+		map.set(change.typeName, perType);
+	}
+	return map;
+}
+/**
+* Apply pre-migration schema adjustments to a single field map in place.
+*
+* The fields map is the proto-shape `TailorDBType.schema.fields` that will
+* be sent in the Pre-phase. We mutate it so that:
+*
+* - Removed fields are re-inserted using their pre-migration config.
+* - Newly added required fields are relaxed to optional.
+* - Modified fields keep the looser side of unique/required/enum.
+*
+* @param {Record<string, MessageInitShape<typeof TailorDBType_FieldConfigSchema>>} fields - Field map to adjust (mutated in place)
+* @param {Map<string, DiffChange>} typeChanges - Changes for this type, keyed by fieldName
+*/
+function applyPreMigrationFieldAdjustments(fields, typeChanges) {
+	for (const [fieldName, change] of typeChanges) {
+		if (change.kind === "field_removed") {
+			const before = change.before;
+			if (before) fields[fieldName] = convertFieldConfigToProto(before);
+			continue;
+		}
+		const field = fields[fieldName];
+		if (!field) continue;
+		const before = change.before;
+		const after = change.after;
+		if (change.kind === "field_added" && after?.required) {
+			field.required = false;
+			continue;
+		}
+		if (change.kind !== "field_modified") continue;
+		if (!before?.required && after?.required) field.required = false;
+		if (!(before?.unique ?? false) && (after?.unique ?? false)) field.unique = false;
+		if (before?.allowedValues && after?.allowedValues) {
+			const afterValues = new Set(after.allowedValues.map((v) => v.value));
+			if (before.allowedValues.filter((v) => !afterValues.has(v.value)).length > 0) {
+				const valueMap = /* @__PURE__ */ new Map();
+				for (const v of before.allowedValues) valueMap.set(v.value, v.description ?? "");
+				for (const v of after.allowedValues) if (!valueMap.has(v.value)) valueMap.set(v.value, v.description ?? "");
+				field.allowedValues = Array.from(valueMap.entries()).map(([value, description]) => ({
+					value,
+					description
+				}));
+			}
+		}
+	}
+}
+
 //#endregion
 //#region src/cli/commands/tailordb/migrate/bundler.ts
 /**
@@ -7283,13 +7572,15 @@ async function detectPendingMigrations(client, workspaceId, namespacesWithMigrat
 			if (!fs$1.existsSync(diffPath)) continue;
 			const diff = loadDiff(diffPath);
 			const scriptPath = getMigrationFilePath(migrationsDir, file.number, "migrate");
-			if (diff.requiresMigrationScript && !fs$1.existsSync(scriptPath)) {
+			const hasScript = fs$1.existsSync(scriptPath);
+			if (diff.requiresMigrationScript && !hasScript) {
 				logger.warn(`Migration ${namespace}/${file.number} requires a script but migrate.ts not found`);
 				continue;
 			}
 			pendingMigrations.push({
 				number: file.number,
 				scriptPath,
+				hasScript,
 				diffPath,
 				namespace,
 				migrationsDir,
@@ -7354,7 +7645,7 @@ async function updateMigrationLabel(client, workspaceId, namespace, migrationNum
 * @returns {Promise<void>}
 */
 async function executeMigrations(context, migrations) {
-	const migrationsWithScripts = migrations.filter((m) => m.diff.requiresMigrationScript);
+	const migrationsWithScripts = migrations.filter((m) => m.hasScript);
 	if (migrationsWithScripts.length === 0) return;
 	const migrationsByNamespace = groupMigrationsByNamespace(migrationsWithScripts);
 	for (const [namespace, namespaceMigrations] of migrationsByNamespace) {
@@ -7520,10 +7811,10 @@ function formatRemoteVerificationResults(results) {
 * Validate migration files and detect pending migrations
 * @param {OperatorClient} client - Operator client instance
 * @param {string} workspaceId - Workspace ID
-* @param {ReadonlyMap<string, Record<string, TailorDBType>>} typesByNamespace - Types by namespace
+* @param {ReadonlyMap<string, Record<string, TailorDBSnapshotType>>} typesByNamespace - Types by namespace
 * @param {LoadedConfig} config - Loaded application config (includes path)
 * @param {boolean} noSchemaCheck - Whether to skip schema diff check
-* @returns {Promise<PendingMigration[]>} List of pending migrations
+* @returns {Promise<ValidateAndDetectResult>} Pending migrations and namespaces that have migration directories configured
 */
 async function validateAndDetectMigrations(client, workspaceId, typesByNamespace, config, noSchemaCheck) {
 	const namespacesWithMigrations = getNamespacesWithMigrations(config, path.dirname(config.path));
@@ -7557,14 +7848,45 @@ async function validateAndDetectMigrations(client, workspaceId, typesByNamespace
 		pendingMigrations = await detectPendingMigrations(client, workspaceId, namespacesWithMigrations);
 		if (pendingMigrations.length > 0) {
 			logger.newline();
-			const withScripts = pendingMigrations.filter((m) => m.diff.requiresMigrationScript);
-			const withoutScripts = pendingMigrations.filter((m) => !m.diff.requiresMigrationScript);
+			const withScripts = pendingMigrations.filter((m) => m.hasScript);
+			const withoutScripts = pendingMigrations.filter((m) => !m.hasScript);
 			logger.info(`Applying ${pendingMigrations.length} migration(s):`);
 			if (withoutScripts.length > 0) logger.info(`  • ${withoutScripts.length} schema change(s) (applied automatically with schema deployment)`, { mode: "plain" });
 			if (withScripts.length > 0) logger.info(`  • ${withScripts.length} data migration(s) (requires migration script execution)`, { mode: "plain" });
 		}
 	}
-	return pendingMigrations;
+	return {
+		pendingMigrations,
+		namespacesWithMigrations
+	};
+}
+/**
+* Reconcile the on-remote migration label with the working tree's latest
+* migration number for each namespace.
+*
+* Used after a `--no-schema-check` apply: that flag skips the local/remote
+* snapshot drift checks, but if it also leaves the label untouched the remote
+* label can drift past the working tree's latest migration (e.g. when
+* checking out an older revision and re-deploying). A subsequent run would
+* then reconstruct the expected snapshot at a label that no longer exists in
+* the working tree, triggering a false drift error.
+*
+* Always force `label = working_tree_max` regardless of the previous label so
+* the invariant `label <= working_tree_max` is preserved.
+* @param client - Operator client instance
+* @param workspaceId - Workspace ID
+* @param namespacesWithMigrations - Namespaces that have migration directories configured
+*/
+async function reconcileMigrationLabels(client, workspaceId, namespacesWithMigrations) {
+	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
+		const targetVersion = getLatestMigrationNumber(migrationsDir);
+		const currentVersion = await getRemoteMigrationNumber(client, workspaceId, namespace);
+		await updateMigrationLabel(client, workspaceId, namespace, targetVersion);
+		if (currentVersion !== targetVersion) {
+			const from = currentVersion === null ? "<unset>" : formatMigrationNumber(currentVersion);
+			logger.info(`Migration label for namespace ${namespace} reconciled: ${from} → ${formatMigrationNumber(targetVersion)}.`);
+		}
+	}
 }
 /**
 * Build migration execution context for script-based migrations.
@@ -7596,25 +7918,23 @@ async function applyTailorDB(client, result, phase = "create-update") {
 	const { changeSet, context: migrationContext } = result;
 	if (phase === "create-update") {
 		const typesByNamespace = /* @__PURE__ */ new Map();
-		for (const tailordb of migrationContext.application.tailorDBServices) {
-			const types = tailordb.types;
-			if (types) typesByNamespace.set(tailordb.namespace, types);
-		}
-		const pendingMigrations = await validateAndDetectMigrations(client, migrationContext.workspaceId, typesByNamespace, migrationContext.config, migrationContext.noSchemaCheck);
+		for (const tailordb of migrationContext.tailorDBInputs) typesByNamespace.set(tailordb.namespace, tailordb.types);
+		const { pendingMigrations, namespacesWithMigrations } = await validateAndDetectMigrations(client, migrationContext.workspaceId, typesByNamespace, migrationContext.config, migrationContext.noSchemaCheck);
 		if (pendingMigrations.length > 0) {
 			processedTypes.reset();
 			deletedResources.reset();
+			migrationSnapshotCache.reset();
 			await executeServicesCreation(client, changeSet);
-			const migrationsRequiringScripts = pendingMigrations.filter((m) => m.diff.requiresMigrationScript);
+			const migrationsRequiringScripts = pendingMigrations.filter((m) => m.hasScript);
 			const migrationCtx = migrationsRequiringScripts.length > 0 ? buildMigrationContextForScripts(client, migrationContext, migrationsRequiringScripts) : void 0;
 			if (migrationsRequiringScripts.length > 0) {
 				logger.info(`Executing ${migrationsRequiringScripts.length} data migration(s)...`);
 				logger.newline();
 			}
 			for (const migration of pendingMigrations) {
-				await executeSingleMigrationPrePhase(client, changeSet, migration);
-				if (migration.diff.requiresMigrationScript && migrationCtx) await executeMigrations(migrationCtx, [migration]);
-				await executeSingleMigrationPostPhase(client, changeSet, migration);
+				await executeSingleMigrationPrePhase(client, changeSet, migration, migrationContext.tailorDBInputs, migrationContext.executorUsedTypes);
+				if (migration.hasScript && migrationCtx) await executeMigrations(migrationCtx, [migration]);
+				await executeSingleMigrationPostPhase(client, changeSet, migration, migrationContext.tailorDBInputs, migrationContext.executorUsedTypes);
 				await updateMigrationLabel(client, migrationContext.workspaceId, migration.namespace, migration.number);
 			}
 			if (migrationsRequiringScripts.length > 0) {
@@ -7640,6 +7960,7 @@ async function applyTailorDB(client, result, phase = "create-update") {
 			await Promise.all(changeSet.gqlPermission.deletes.map((del) => client.deleteTailorDBGQLPermission(del.request)));
 			await Promise.all(changeSet.type.deletes.map((del) => client.deleteTailorDBType(del.request)));
 		}
+		if (migrationContext.noSchemaCheck && namespacesWithMigrations.length > 0) await reconcileMigrationLabels(client, migrationContext.workspaceId, namespacesWithMigrations);
 	} else if (phase === "delete-resources") {
 		await Promise.all(changeSet.gqlPermission.deletes.map((del) => client.deleteTailorDBGQLPermission(del.request)));
 		await Promise.all(changeSet.type.deletes.map((del) => client.deleteTailorDBType(del.request)));
@@ -7659,49 +7980,6 @@ function handleOptionalToRequiredError(error, messages) {
 	throw error;
 }
 /**
-* Build a map of breaking field changes from pending migrations
-* @param {PendingMigration[]} pendingMigrations - Pending migrations
-* @returns {BreakingChangesMap} Map of breaking changes
-*/
-function buildBreakingChangesMap(pendingMigrations) {
-	const map = /* @__PURE__ */ new Map();
-	for (const migration of pendingMigrations) for (const change of migration.diff.changes) if (change.kind === "field_added" || change.kind === "field_modified" || change.kind === "field_removed") {
-		if (!change.fieldName) continue;
-		if (!map.has(change.typeName)) map.set(change.typeName, /* @__PURE__ */ new Map());
-		map.get(change.typeName).set(change.fieldName, change);
-	}
-	return map;
-}
-/**
-* Apply pre-migration schema adjustments to avoid breaking changes before scripts run.
-* @param fields - Field configs to adjust
-* @param typeChanges - Breaking changes for a type
-*/
-function applyPreMigrationFieldAdjustments(fields, typeChanges) {
-	for (const [fieldName, change] of typeChanges) {
-		const field = fields[fieldName];
-		if (!field) continue;
-		const before = change.before;
-		const after = change.after;
-		if (change.kind === "field_added" && after?.required) field.required = false;
-		if (change.kind !== "field_modified") continue;
-		if (!before?.required && after?.required) field.required = false;
-		if (!(before?.unique ?? false) && (after?.unique ?? false)) field.unique = false;
-		if (before?.allowedValues && after?.allowedValues) {
-			const afterValues = new Set(after.allowedValues.map((v) => v.value));
-			if (before.allowedValues.filter((v) => !afterValues.has(v.value)).length > 0) {
-				const valueMap = /* @__PURE__ */ new Map();
-				for (const v of before.allowedValues) valueMap.set(v.value, v.description ?? "");
-				for (const v of after.allowedValues) if (!valueMap.has(v.value)) valueMap.set(v.value, v.description ?? "");
-				field.allowedValues = Array.from(valueMap.entries()).map(([value, description]) => ({
-					value,
-					description
-				}));
-			}
-		}
-	}
-}
-/**
 * Get the set of type names affected by a migration
 * @param {PendingMigration} migration - Pending migration
 * @returns {Set<string>} Set of affected type names
@@ -7747,14 +8025,54 @@ const processedTypes = {
 	}
 };
 /**
+* Snapshot cache for per-migration schema lookups during a single apply run.
+*
+* Only the initial baseline `0000/schema.json` is stored on disk; later migrations
+* ship `diff.json` only. To get the schema state AFTER migration N we replay the
+* initial snapshot through all diffs up to N via `reconstructSnapshotFromMigrations`.
+* Results are memoized per (namespace, migration number) for the apply run.
+*/
+const migrationSnapshotCache = {
+	cache: /* @__PURE__ */ new Map(),
+	reset() {
+		this.cache.clear();
+	},
+	load(migration) {
+		const key = `${migration.namespace}/${migration.number}`;
+		let snapshot = this.cache.get(key);
+		if (!snapshot) {
+			const reconstructed = reconstructSnapshotFromMigrations(migration.migrationsDir, migration.number);
+			if (!reconstructed) throw new Error(`Cannot reconstruct snapshot for ${migration.namespace} migration ${migration.number}: no migrations found in ${migration.migrationsDir}`);
+			snapshot = reconstructed;
+			this.cache.set(key, snapshot);
+		}
+		return snapshot;
+	}
+};
+/**
+* Build the TailorDBType manifest for `typeName` from migration N's snapshot.
+* @param migration - The pending migration whose snapshot to consult
+* @param typeName - The type name to look up in the snapshot
+* @param tailorDBInputs - Deploy inputs, used to resolve namespace gqlOperations
+* @param executorUsedTypes - Types used by executors (drives publishRecordEvents default)
+* @returns The manifest, or undefined if `typeName` is not in that snapshot.
+*/
+function buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) {
+	const snapshotType = migrationSnapshotCache.load(migration).types[typeName];
+	if (!snapshotType) return void 0;
+	return generateTailorDBTypeManifest(snapshotType, executorUsedTypes, tailorDBInputs.find((i) => i.namespace === migration.namespace)?.config.gqlOperations);
+}
+/**
 * Execute pre-migration phase for a single migration
 * @param {OperatorClient} client - Operator client instance
 * @param {TailorDBChangeSet} changeSet - TailorDB change set
 * @param {PendingMigration} migration - Single pending migration
+* @param tailorDBInputs - Deploy inputs, used to resolve namespace gqlOperations for the snapshot
+* @param executorUsedTypes - Types used by executors (drives publishRecordEvents default)
 * @returns {Promise<void>} Promise that resolves when pre-migration phase completes
 */
-async function executeSingleMigrationPrePhase(client, changeSet, migration) {
-	const breakingChanges = buildBreakingChangesMap([migration]);
+async function executeSingleMigrationPrePhase(client, changeSet, migration, tailorDBInputs, executorUsedTypes) {
+	const preMigrationChanges = buildPreMigrationChangesMap([migration]);
 	const affectedTypes = getAffectedTypeNames(migration);
 	const createdBeforeMigration = new Set(processedTypes.created);
 	await Promise.all([
@@ -7763,11 +8081,13 @@ async function executeSingleMigrationPrePhase(client, changeSet, migration) {
 			return typeName && affectedTypes.has(typeName) && !createdBeforeMigration.has(typeName);
 		}).map((create) => {
 			const typeName = create.request.tailordbType?.name;
+			const snapshotType = typeName ? buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) : void 0;
+			if (!snapshotType) return void 0;
 			if (typeName) processedTypes.created.add(typeName);
-			const typeChanges = typeName ? breakingChanges.get(typeName) : void 0;
-			if (!typeChanges || typeChanges.size === 0) return client.createTailorDBType(create.request);
 			const clonedRequest = structuredClone(create.request);
-			if (clonedRequest.tailordbType?.schema?.fields) applyPreMigrationFieldAdjustments(clonedRequest.tailordbType.schema.fields, typeChanges);
+			clonedRequest.tailordbType = snapshotType;
+			const typeChanges = typeName ? preMigrationChanges.get(typeName) : void 0;
+			if (typeChanges && typeChanges.size > 0 && clonedRequest.tailordbType?.schema?.fields) applyPreMigrationFieldAdjustments(clonedRequest.tailordbType.schema.fields, typeChanges);
 			return client.createTailorDBType(clonedRequest);
 		}),
 		...changeSet.type.creates.filter((create) => {
@@ -7775,19 +8095,16 @@ async function executeSingleMigrationPrePhase(client, changeSet, migration) {
 			return typeName && affectedTypes.has(typeName) && createdBeforeMigration.has(typeName);
 		}).map((create) => {
 			const typeName = create.request.tailordbType?.name;
+			const snapshotType = typeName ? buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) : void 0;
+			if (!snapshotType) return void 0;
 			if (typeName) processedTypes.updated.add(typeName);
-			const typeChanges = typeName ? breakingChanges.get(typeName) : void 0;
-			if (!typeChanges || typeChanges.size === 0) return client.updateTailorDBType({
-				workspaceId: create.request.workspaceId,
-				namespaceName: create.request.namespaceName,
-				tailordbType: create.request.tailordbType
-			});
-			const clonedRequest = structuredClone(create.request);
-			if (clonedRequest.tailordbType?.schema?.fields) applyPreMigrationFieldAdjustments(clonedRequest.tailordbType.schema.fields, typeChanges);
+			const clonedTypeRequest = structuredClone(snapshotType);
+			const typeChanges = typeName ? preMigrationChanges.get(typeName) : void 0;
+			if (typeChanges && typeChanges.size > 0 && clonedTypeRequest.schema?.fields) applyPreMigrationFieldAdjustments(clonedTypeRequest.schema.fields, typeChanges);
 			return client.updateTailorDBType({
 				workspaceId: create.request.workspaceId,
 				namespaceName: create.request.namespaceName,
-				tailordbType: clonedRequest.tailordbType
+				tailordbType: clonedTypeRequest
 			});
 		}),
 		...changeSet.type.updates.filter((update) => {
@@ -7795,11 +8112,13 @@ async function executeSingleMigrationPrePhase(client, changeSet, migration) {
 			return typeName && affectedTypes.has(typeName);
 		}).map((update) => {
 			const typeName = update.request.tailordbType?.name;
+			const snapshotType = typeName ? buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) : void 0;
+			if (!snapshotType) return void 0;
 			if (typeName) processedTypes.updated.add(typeName);
-			const typeChanges = typeName ? breakingChanges.get(typeName) : void 0;
-			if (!typeChanges || typeChanges.size === 0) return client.updateTailorDBType(update.request);
 			const clonedRequest = structuredClone(update.request);
-			if (clonedRequest.tailordbType?.schema?.fields) applyPreMigrationFieldAdjustments(clonedRequest.tailordbType.schema.fields, typeChanges);
+			clonedRequest.tailordbType = snapshotType;
+			const typeChanges = typeName ? preMigrationChanges.get(typeName) : void 0;
+			if (typeChanges && typeChanges.size > 0 && clonedRequest.tailordbType?.schema?.fields) applyPreMigrationFieldAdjustments(clonedRequest.tailordbType.schema.fields, typeChanges);
 			return client.updateTailorDBType(clonedRequest);
 		})
 	]);
@@ -7836,24 +8155,40 @@ const deletedResources = {
 * @param {OperatorClient} client - Operator client instance
 * @param {TailorDBChangeSet} changeSet - TailorDB change set
 * @param {PendingMigration} migration - Single pending migration
+* @param tailorDBInputs - Deploy inputs, used to resolve namespace gqlOperations for the snapshot
+* @param executorUsedTypes - Types used by executors (drives publishRecordEvents default)
 * @returns {Promise<void>} Promise that resolves when post-migration phase completes
 */
-async function executeSingleMigrationPostPhase(client, changeSet, migration) {
-	const breakingChanges = buildBreakingChangesMap([migration]);
+async function executeSingleMigrationPostPhase(client, changeSet, migration, tailorDBInputs, executorUsedTypes) {
+	const preMigrationChanges = buildPreMigrationChangesMap([migration]);
 	const affectedTypes = getAffectedTypeNames(migration);
 	const deletedTypeNames = getDeletedTypeNames(migration);
 	try {
 		await Promise.all([...changeSet.type.creates.filter((create) => {
 			const typeName = create.request.tailordbType?.name;
-			return typeName && affectedTypes.has(typeName) && breakingChanges.has(typeName);
-		}).map((create) => client.updateTailorDBType({
-			workspaceId: create.request.workspaceId,
-			namespaceName: create.request.namespaceName,
-			tailordbType: create.request.tailordbType
-		})), ...changeSet.type.updates.filter((update) => {
+			return typeName && affectedTypes.has(typeName) && preMigrationChanges.has(typeName);
+		}).map((create) => {
+			const typeName = create.request.tailordbType?.name;
+			const snapshotType = typeName ? buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) : void 0;
+			if (!snapshotType) return void 0;
+			return client.updateTailorDBType({
+				workspaceId: create.request.workspaceId,
+				namespaceName: create.request.namespaceName,
+				tailordbType: snapshotType
+			});
+		}), ...changeSet.type.updates.filter((update) => {
 			const typeName = update.request.tailordbType?.name;
-			return typeName && affectedTypes.has(typeName) && breakingChanges.has(typeName);
-		}).map((update) => client.updateTailorDBType(update.request))]);
+			return typeName && affectedTypes.has(typeName) && preMigrationChanges.has(typeName);
+		}).map((update) => {
+			const typeName = update.request.tailordbType?.name;
+			const snapshotType = typeName ? buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) : void 0;
+			if (!snapshotType) return void 0;
+			return client.updateTailorDBType({
+				workspaceId: update.request.workspaceId,
+				namespaceName: update.request.namespaceName,
+				tailordbType: snapshotType
+			});
+		})]);
 	} catch (error) {
 		handleOptionalToRequiredError(error, ["This error occurred during post-migration phase. Please check your migration script.", "Ensure all existing records have values for fields being changed to required."]);
 	}
@@ -7882,21 +8217,32 @@ async function executeSingleMigrationPostPhase(client, changeSet, migration) {
 	}
 }
 /**
-* Plan TailorDB-related changes based on current and desired state.
-* @param context - Planning context
-* @returns Planned changes
+* Convert a runtime TailorDBService to the snapshot-shaped deploy input.
+* @param service - Loaded TailorDB service (after `loadTypes()`)
+* @returns The canonical snapshot-shaped deploy input for downstream plan/apply phases.
 */
+function toTailorDBDeployInput(service) {
+	const types = {};
+	for (const [typeName, type] of Object.entries(service.types)) types[typeName] = createSnapshotType(type);
+	return {
+		namespace: service.namespace,
+		config: service.config,
+		types
+	};
+}
 async function planTailorDB(context) {
 	const { client, workspaceId, application, forRemoval, config, noSchemaCheck, forceApplyAll = false } = context;
 	const tailordbs = [];
 	if (!forRemoval) for (const tailordb of application.tailorDBServices) {
 		await tailordb.loadTypes();
-		tailordbs.push(tailordb);
+		tailordbs.push(toTailorDBDeployInput(tailordb));
 	}
 	const executors = forRemoval ? [] : Object.values(await application.executorService?.loadExecutors() ?? {});
+	const executorUsedTypes = /* @__PURE__ */ new Set();
+	for (const executor of executors) if (executor.trigger.kind === "tailordb") executorUsedTypes.add(executor.trigger.typeName);
 	const { changeSet: serviceChangeSet, conflicts, unmanaged, resourceOwners } = await planServices(client, workspaceId, application.name, application.id, tailordbs);
 	const deletedServices = serviceChangeSet.deletes.map((del) => del.name);
-	const [typeChangeSet, gqlPermissionChangeSet] = await Promise.all([planTypes(client, workspaceId, tailordbs, executors, deletedServices, void 0, forceApplyAll), planGqlPermissions(client, workspaceId, tailordbs, deletedServices, forceApplyAll)]);
+	const [typeChangeSet, gqlPermissionChangeSet] = await Promise.all([planTypes(client, workspaceId, tailordbs, executorUsedTypes, deletedServices, void 0, forceApplyAll), planGqlPermissions(client, workspaceId, tailordbs, deletedServices, forceApplyAll)]);
 	return {
 		changeSet: {
 			service: serviceChangeSet,
@@ -7909,6 +8255,8 @@ async function planTailorDB(context) {
 		context: {
 			workspaceId,
 			application,
+			tailorDBInputs: tailordbs,
+			executorUsedTypes,
 			config,
 			noSchemaCheck: noSchemaCheck ?? false
 		}
@@ -8051,7 +8399,7 @@ async function planServices(client, workspaceId, appName, appId, tailordbs) {
 		resourceOwners
 	};
 }
-async function planTypes(client, workspaceId, tailordbs, executors, deletedServices, filteredTypesByNamespace, forceApplyAll = false) {
+async function planTypes(client, workspaceId, tailordbs, executorUsedTypes, deletedServices, filteredTypesByNamespace, forceApplyAll = false) {
 	const changeSet = createChangeSet("TailorDB types");
 	const fetchTypes = (namespaceName) => {
 		return fetchAll(async (pageToken, maxPageSize) => {
@@ -8069,8 +8417,6 @@ async function planTypes(client, workspaceId, tailordbs, executors, deletedServi
 			}
 		});
 	};
-	const executorUsedTypes = /* @__PURE__ */ new Set();
-	for (const executor of executors) if (executor.trigger.kind === "tailordb") executorUsedTypes.add(executor.trigger.typeName);
 	for (const tailordb of tailordbs) {
 		const types = filteredTypesByNamespace?.get(tailordb.namespace) ?? tailordb.types;
 		for (const typeName of Object.keys(types)) {
@@ -8201,8 +8547,8 @@ function isNumericLikeValue(value) {
 	return typeof value === "number" || typeof value === "bigint" || /^-?\d+$/.test(value);
 }
 /**
-* Generate a TailorDB type manifest from parsed type
-* @param {TailorDBType} type - Parsed TailorDB type
+* Generate a TailorDB type manifest from snapshot-shaped type
+* @param {TailorDBSnapshotType} type - Snapshot-shaped TailorDB type
 * @param {ReadonlySet<string>} executorUsedTypes - Set of types used by executors
 * @param {GqlOperations} [namespaceGqlOperations] - Default gqlOperations for the namespace (already normalized)
 * @returns {MessageInitShape<typeof TailorDBTypeSchema>} Type manifest
@@ -8229,7 +8575,7 @@ function generateTailorDBTypeManifest(type, executorUsedTypes, namespaceGqlOpera
 	};
 	const fields = {};
 	Object.keys(type.fields).filter((fieldName) => fieldName !== "id").forEach((fieldName) => {
-		const fieldConfig = type.fields[fieldName].config;
+		const fieldConfig = type.fields[fieldName];
 		const fieldType = fieldConfig.type;
 		const fieldEntry = {
 			type: fieldType,
@@ -8242,7 +8588,7 @@ function generateTailorDBTypeManifest(type, executorUsedTypes, namespaceGqlOpera
 			foreignKey: fieldConfig.foreignKey || false,
 			foreignKeyType: fieldConfig.foreignKeyType,
 			foreignKeyField: fieldConfig.foreignKeyField,
-			required: fieldConfig.required !== false,
+			required: fieldConfig.required,
 			vector: fieldConfig.vector || false,
 			...toProtoFieldHooks(fieldConfig),
 			...fieldConfig.serial && { serial: {
@@ -8256,14 +8602,14 @@ function generateTailorDBTypeManifest(type, executorUsedTypes, namespaceGqlOpera
 		fields[fieldName] = fieldEntry;
 	});
 	const relationships = {};
-	for (const [relationName, rel] of Object.entries(type.forwardRelationships)) relationships[relationName] = {
+	for (const [relationName, rel] of Object.entries(type.forwardRelationships ?? {})) relationships[relationName] = {
 		refType: rel.targetType,
 		refField: rel.sourceField,
 		srcField: rel.targetField,
 		array: rel.isArray,
 		description: rel.description
 	};
-	for (const [relationName, rel] of Object.entries(type.backwardRelationships)) relationships[relationName] = {
+	for (const [relationName, rel] of Object.entries(type.backwardRelationships ?? {})) relationships[relationName] = {
 		refType: rel.targetType,
 		refField: rel.targetField,
 		srcField: rel.sourceField,
@@ -8281,7 +8627,7 @@ function generateTailorDBTypeManifest(type, executorUsedTypes, namespaceGqlOpera
 	if (type.files) Object.entries(type.files).forEach(([key, description]) => {
 		files[key] = { description: description || "" };
 	});
-	const permission = type.permissions.record ? protoPermission(type.permissions.record) : {
+	const permission = type.permissions?.record ? protoPermission(type.permissions.record) : {
 		create: [],
 		read: [],
 		update: [],
@@ -8327,7 +8673,7 @@ function processNestedFields(fields) {
 				allowedValues: nestedFieldConfig.allowedValues || [],
 				description: nestedFieldConfig.description || "",
 				validate: toProtoFieldValidate(nestedFieldConfig),
-				required: nestedFieldConfig.required ?? true,
+				required: nestedFieldConfig.required,
 				array: nestedFieldConfig.array ?? false,
 				index: false,
 				unique: false,
@@ -8342,7 +8688,7 @@ function processNestedFields(fields) {
 			allowedValues: nestedType === "enum" ? nestedFieldConfig.allowedValues || [] : [],
 			description: nestedFieldConfig.description || "",
 			validate: toProtoFieldValidate(nestedFieldConfig),
-			required: nestedFieldConfig.required ?? true,
+			required: nestedFieldConfig.required,
 			array: nestedFieldConfig.array ?? false,
 			index: false,
 			unique: false,
@@ -8360,9 +8706,12 @@ function processNestedFields(fields) {
 	return nestedFields;
 }
 function protoPermission(permission) {
-	const ret = {};
-	for (const [key, policies] of Object.entries(permission)) ret[key] = policies.map((policy) => protoPolicy(policy));
-	return ret;
+	return {
+		create: permission.create.map((policy) => protoPolicy(policy)),
+		read: permission.read.map((policy) => protoPolicy(policy)),
+		update: permission.update.map((policy) => protoPolicy(policy)),
+		delete: permission.delete.map((policy) => protoPolicy(policy))
+	};
 }
 function protoPolicy(policy) {
 	let permit;
@@ -8414,23 +8763,25 @@ function protoCondition(condition) {
 	};
 }
 function protoOperand(operand) {
-	if (typeof operand === "object" && !Array.isArray(operand)) if ("user" in operand) return { kind: {
-		case: "userField",
-		value: operand.user
-	} };
-	else if ("record" in operand) return { kind: {
-		case: "recordField",
-		value: operand.record
-	} };
-	else if ("newRecord" in operand) return { kind: {
-		case: "newRecordField",
-		value: operand.newRecord
-	} };
-	else if ("oldRecord" in operand) return { kind: {
-		case: "oldRecordField",
-		value: operand.oldRecord
-	} };
-	else throw new Error(`Unknown operand: ${JSON.stringify(operand)}`);
+	if (isSnapshotFieldRefOperand(operand)) {
+		if ("user" in operand) return { kind: {
+			case: "userField",
+			value: operand.user
+		} };
+		if ("record" in operand) return { kind: {
+			case: "recordField",
+			value: operand.record
+		} };
+		if ("newRecord" in operand) return { kind: {
+			case: "newRecordField",
+			value: operand.newRecord
+		} };
+		if ("oldRecord" in operand) return { kind: {
+			case: "oldRecordField",
+			value: operand.oldRecord
+		} };
+		throw new Error(`Unknown field-ref operand shape: ${JSON.stringify(operand)}`);
+	}
 	return { kind: {
 		case: "value",
 		value: fromJson(ValueSchema, operand)
@@ -8462,7 +8813,7 @@ async function planGqlPermissions(client, workspaceId, tailordbs, deletedService
 		});
 		const types = tailordb.types;
 		for (const typeName of Object.keys(types)) {
-			const gqlPermission = types[typeName].permissions.gql;
+			const gqlPermission = types[typeName].permissions?.gql;
 			if (!gqlPermission) continue;
 			const desiredPermission = protoGqlPermission(gqlPermission);
 			const existingPermission = existingGqlPermissions.find((entry) => entry.typeName === typeName);
@@ -8596,11 +8947,12 @@ function protoGqlCondition(condition) {
 	};
 }
 function protoGqlOperand(operand) {
-	if (typeof operand === "object" && !Array.isArray(operand)) {
+	if (isSnapshotFieldRefOperand(operand)) {
 		if ("user" in operand) return { kind: {
 			case: "userField",
 			value: operand.user
 		} };
+		throw new Error(`Unsupported field-ref operand in GQL permission: ${JSON.stringify(operand)} — GQL permissions only support { user } field references`);
 	}
 	return { kind: {
 		case: "value",
@@ -8609,7 +8961,7 @@ function protoGqlOperand(operand) {
 }
 /**
 * Check if there are schema differences between migration snapshots and local definitions
-* @param {ReadonlyMap<string, Record<string, TailorDBType>>} typesByNamespace - Types by namespace
+* @param {ReadonlyMap<string, Record<string, TailorDBSnapshotType>>} typesByNamespace - Snapshot-shaped local types by namespace
 * @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migrations config
 * @returns {Promise<MigrationCheckResult[]>} Results for each namespace
 */
@@ -10957,6 +11309,7 @@ The \`--logs\` option displays logs from the downstream execution when available
 		})
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({
 			useProfile: true,
 			profile: args.profile
@@ -12463,6 +12816,7 @@ const createCommand$1 = defineAppCommand({
 		})
 	}).strict(),
 	run: async (args) => {
+		await assertWritable();
 		const folder = await createFolder({
 			organizationId: args["organization-id"],
 			parentFolderId: args["parent-folder-id"],
@@ -12501,6 +12855,7 @@ const deleteCommand$1 = defineAppCommand({
 		...confirmationArgs
 	}).strict(),
 	run: async (args) => {
+		await assertWritable();
 		const client = await initOperatorClient(await loadAccessToken());
 		let folderName;
 		try {
@@ -12651,6 +13006,7 @@ const updateCommand$2 = defineAppCommand({
 		})
 	}).strict(),
 	run: async (args) => {
+		await assertWritable();
 		const folder = await updateFolder({
 			organizationId: args["organization-id"],
 			folderId: args["folder-id"],
@@ -12876,6 +13232,7 @@ const updateCommand$1 = defineAppCommand({
 		})
 	}).strict(),
 	run: async (args) => {
+		await assertWritable();
 		const organization = await updateOrganization({
 			organizationId: args["organization-id"],
 			name: args.name
@@ -12980,6 +13337,7 @@ const removeCommand$1 = defineAppCommand({
 		...confirmationArgs
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		const { client, workspaceId, application, config } = await loadOptions$10({
 			workspaceId: args["workspace-id"],
 			profile: args.profile,
@@ -13253,7 +13611,7 @@ function generateEmptyDbTypes(namespace) {
 }
 /**
 * Generate table type definition from a snapshot type
-* @param {SnapshotType} type - Snapshot type
+* @param {TailorDBSnapshotType} type - Snapshot type
 * @param {BreakingChangeFieldInfo} breakingChangeFields - Breaking change field info
 * @returns {{ typeDef: string; usedTimestamp: boolean; usedColumnType: boolean }} Generated type and utility type usage
 */
@@ -13481,8 +13839,11 @@ function generateMigrationScript(diff) {
 	return `/**
  * Migration script for ${diff.namespace}
  *
- * This script handles data migration for breaking schema changes.
- * Edit this file to implement your data migration logic.
+ * This script runs between the Pre-migration and Post-migration phases of
+ * 'tailor-sdk deploy'. Use it to transform existing data so that the schema
+ * change can complete safely (for breaking changes, this is hard-required;
+ * for warning-tier changes it is optional). Edit this file to implement
+ * your data migration logic.
  *
  * The transaction is managed by the deploy command.
  * If any operation fails, all changes will be rolled back.
@@ -13643,7 +14004,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-BNkNt47b.mjs");
+	const { defineApplication } = await import("./application-v_E2W-Fz.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -13732,6 +14093,10 @@ async function generateDiffFromSnapshot(previousSnapshot, currentSnapshot, migra
 			logger.newline();
 		}
 	}
+	if (diff.hasWarnings) {
+		logger.newline();
+		logger.warn(formatWarnings(diff.warnings));
+	}
 	const result = await generateDiffFiles(diff, migrationsDir, getNextMigrationNumber(migrationsDir), previousSnapshot, options.name);
 	logger.success(`Generated migration ${styles.bold(result.migrationNumber.toString().padStart(4, "0"))}`);
 	logger.info(`  Diff file: ${result.diffFilePath}`);
@@ -13755,6 +14120,10 @@ async function generateDiffFromSnapshot(previousSnapshot, currentSnapshot, migra
 		} catch {
 			return;
 		}
+	} else if (diff.hasWarnings) {
+		logger.newline();
+		logger.log(`Data loss is possible for this migration but no script was generated. To add a custom migrate.ts, run:`);
+		logger.log(`  ${styles.bold(`tailor-sdk tailordb migration script ${result.migrationNumber.toString().padStart(4, "0")} --namespace ${diff.namespace}`)}`);
 	}
 }
 /**
@@ -13973,6 +14342,7 @@ const truncateCommand = defineAppCommand({
 		})
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		const types = args.types && args.types.length > 0 ? args.types : void 0;
 		await $truncate({
 			workspaceId: args["workspace-id"],
@@ -14355,9 +14725,11 @@ const createCommand = defineAppCommand({
 			alias: "p",
 			description: "Profile name to create"
 		}),
-		"profile-user": arg(z.string().optional(), { description: "User email for the profile (defaults to current user)" })
+		"profile-user": arg(z.string().optional(), { description: "User email for the profile (defaults to current user)" }),
+		permission: arg(z.enum(["write", "read"]).default("write"), { description: "Profile permission (requires --profile-name). 'read' blocks all write commands while the profile is active." })
 	}).strict(),
 	run: async (args) => {
+		await assertWritable();
 		const workspace = await createWorkspace({
 			name: args.name,
 			region: args.region,
@@ -14375,13 +14747,15 @@ const createCommand = defineAppCommand({
 			if (!config.users[profileUser]) throw new Error(`User "${profileUser}" not found.\nPlease verify your user name and login using 'tailor-sdk login' command.`);
 			config.profiles[profileName] = {
 				user: profileUser,
-				workspace_id: workspace.id
+				workspace_id: workspace.id,
+				...args.permission === "read" ? { readonly: true } : {}
 			};
 			writePlatformConfig(config);
 			profileInfo = {
 				name: profileName,
 				user: profileUser,
-				workspaceId: workspace.id
+				workspaceId: workspace.id,
+				permission: args.permission
 			};
 			if (!args.json) logger.success(`Profile "${profileName}" created successfully.`);
 		}
@@ -14432,6 +14806,7 @@ const deleteCommand = defineAppCommand({
 		...confirmationArgs
 	}).strict(),
 	run: async (args) => {
+		await assertWritable();
 		const { client, workspaceId } = await loadOptions$7({ workspaceId: args["workspace-id"] });
 		let workspace;
 		try {
@@ -14569,6 +14944,7 @@ const restoreCommand = defineAppCommand({
 		...confirmationArgs
 	}).strict(),
 	run: async (args) => {
+		await assertWritable();
 		const { client, workspaceId } = await loadOptions$5({ workspaceId: args["workspace-id"] });
 		if (!args.yes) {
 			if (await prompt.text({ message: `Are you sure you want to restore workspace "${workspaceId}"? (yes/no):` }) !== "yes") {
@@ -14661,6 +15037,7 @@ const inviteCommand = defineAppCommand({
 		})
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		await inviteUser({
 			workspaceId: args["workspace-id"],
 			profile: args.profile,
@@ -14774,6 +15151,7 @@ const removeCommand = defineAppCommand({
 		...confirmationArgs
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		if (!args.yes) {
 			if (await prompt.text({ message: `Are you sure you want to remove user "${args.email}" from the workspace? (yes/no):` }) !== "yes") {
 				logger.info("User removal cancelled.");
@@ -14838,6 +15216,7 @@ const updateCommand = defineAppCommand({
 		})
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		await updateUser({
 			workspaceId: args["workspace-id"],
 			profile: args.profile,
@@ -15791,5 +16170,5 @@ function isDeno() {
 }
 
 //#endregion
-export { deleteCommand$1 as $, getMigrationDirPath as $t, truncate as A, executionsCommand as At, updateOrganization as B, MIGRATION_LABEL_KEY as Bt, listCommand$2 as C, toPageDirection as Cn, jobsCommand as Ct, resumeWorkflow as D, startWorkflow as Dt, resumeCommand as E, startCommand as Et, showCommand as F, getCommand$6 as Ft, getCommand$1 as G, INITIAL_SCHEMA_NUMBER as Gt, treeCommand as H, bundleMigrationScript as Ht, logBetaWarning as I, getExecutor as It, updateFolder as J, compareLocalTypesWithSnapshot as Jt, getOrganization as K, MIGRATE_FILE_NAME as Kt, remove as L, deploy as Lt, generate as M, listWorkflowExecutions as Mt, generateCommand as N, functionExecutionStatusToString as Nt, listCommand$3 as O, getCommand$5 as Ot, show as P, formatKeyValueTable as Pt, getFolder as Q, getLatestMigrationNumber as Qt, removeCommand$1 as R, executeScript as Rt, listApps as S, paginationArgs as Sn, getExecutorJob as St, healthCommand as T, watchExecutorJob as Tt, listCommand$4 as U, DB_TYPES_FILE_NAME as Ut, organizationTree as V, parseMigrationLabelNumber as Vt, listOrganizations as W, DIFF_FILE_NAME as Wt, listFolders as X, createSnapshotFromLocalTypes as Xt, listCommand$5 as Y, compareSnapshots as Yt, getCommand$2 as Z, formatMigrationNumber as Zt, getWorkspace as _, commonArgs as _n, webhookCommand as _t, updateUser as a, reconstructSnapshotFromMigrations as an, getCommand$3 as at, createCommand as b, isVerbose as bn, listCommand$9 as bt, listCommand as c, hasChanges as cn, tokenCommand as ct, inviteUser as d, trnPrefix as dn, generate$1 as dt, getMigrationFilePath as en, deleteFolder as et, restoreCommand as f, generateUserTypes as fn, listCommand$8 as ft, getCommand as g, defineAppCommand as gn, listWebhookExecutors as gt, listWorkspaces as h, apiCall as hn, getFunctionRegistry as ht, updateCommand as i, loadDiff as in, listOAuth2Clients as it, truncateCommand as j, getWorkflowExecution as jt, listWorkflows as k, getWorkflow as kt, listUsers as l, getNamespacesWithMigrations as ln, listCommand$7 as lt, listCommand$1 as m, apiCommand as mn, getCommand$4 as mt, query as n, getNextMigrationNumber as nn, createFolder as nt, removeCommand as o, formatDiffSummary as on, getOAuth2Client as ot, restoreWorkspace as p, prompt as pn, listFunctionRegistries as pt, updateCommand$2 as q, SCHEMA_FILE_NAME as qt, queryCommand as r, isValidMigrationNumber as rn, listCommand$6 as rt, removeUser as s, formatMigrationDiff as sn, getMachineUserToken as st, isNativeTypeScriptRuntime as t, getMigrationFiles as tn, createCommand$1 as tt, inviteCommand as u, sdkNameLabelKey as un, listMachineUsers as ut, deleteCommand as v, confirmationArgs as vn, triggerCommand as vt, getAppHealth as w, workspaceArgs as wn, listExecutorJobs as wt, createWorkspace as x, pagedLogArgs as xn, listExecutors as xt, deleteWorkspace as y, deploymentArgs as yn, triggerExecutor as yt, updateCommand$1 as z, waitForExecution$1 as zt };
-//# sourceMappingURL=runtime-CNg0w27y.mjs.map
+export { listCommand$5 as $, compareSnapshots as $t, truncate as A, workspaceArgs as An, startCommand as At, logBetaWarning as B, getExecutor as Bt, listCommand$2 as C, configArg as Cn, triggerExecutor as Ct, resumeWorkflow as D, pagedLogArgs as Dn, jobsCommand as Dt, resumeCommand as E, isVerbose as En, getExecutorJob as Et, writeDbTypesFile as F, getWorkflowExecution as Ft, organizationTree as G, parseMigrationLabelNumber as Gt, removeCommand$1 as H, executeScript as Ht, getConfiguredEditorCommand as I, listWorkflowExecutions as It, listOrganizations as J, DIFF_FILE_NAME as Jt, treeCommand as K, bundleMigrationScript as Kt, openInConfiguredEditor as L, functionExecutionStatusToString as Lt, generate as M, getCommand$5 as Mt, generateCommand as N, getWorkflow as Nt, listCommand$3 as O, paginationArgs as On, listExecutorJobs as Ot, generateMigrationScript as P, executionsCommand as Pt, updateFolder as Q, compareLocalTypesWithSnapshot as Qt, show as R, formatKeyValueTable as Rt, listApps as S, commonArgs as Sn, triggerCommand as St, healthCommand as T, deploymentArgs as Tn, listExecutors as Tt, updateCommand$1 as U, waitForExecution$1 as Ut, remove as V, deploy as Vt, updateOrganization as W, MIGRATION_LABEL_KEY as Wt, getOrganization as X, MIGRATE_FILE_NAME as Xt, getCommand$1 as Y, INITIAL_SCHEMA_NUMBER as Yt, updateCommand$2 as Z, SCHEMA_FILE_NAME as Zt, getWorkspace as _, prompt as _n, listFunctionRegistries as _t, updateUser as a, getMigrationFiles as an, createCommand$1 as at, createCommand as b, assertWritable as bn, listWebhookExecutors as bt, listCommand as c, loadDiff as cn, listOAuth2Clients as ct, inviteUser as d, formatMigrationDiff as dn, getMachineUserToken as dt, createSnapshotFromLocalTypes as en, listFolders as et, restoreCommand as f, hasChanges as fn, tokenCommand as ft, getCommand as g, generateUserTypes as gn, listCommand$8 as gt, listWorkspaces as h, trnPrefix as hn, generate$1 as ht, updateCommand as i, getMigrationFilePath as in, deleteFolder as it, truncateCommand as j, startWorkflow as jt, listWorkflows as k, toPageDirection as kn, watchExecutorJob as kt, listUsers as l, reconstructSnapshotFromMigrations as ln, getCommand$3 as lt, listCommand$1 as m, sdkNameLabelKey as mn, listMachineUsers as mt, query as n, getLatestMigrationNumber as nn, getFolder as nt, removeCommand as o, getNextMigrationNumber as on, createFolder as ot, restoreWorkspace as p, getNamespacesWithMigrations as pn, listCommand$7 as pt, listCommand$4 as q, DB_TYPES_FILE_NAME as qt, queryCommand as r, getMigrationDirPath as rn, deleteCommand$1 as rt, removeUser as s, isValidMigrationNumber as sn, listCommand$6 as st, isNativeTypeScriptRuntime as t, formatMigrationNumber as tn, getCommand$2 as tt, inviteCommand as u, formatDiffSummary as un, getOAuth2Client as ut, deleteCommand as v, apiCommand as vn, getCommand$4 as vt, getAppHealth as w, confirmationArgs as wn, listCommand$9 as wt, createWorkspace as x, defineAppCommand as xn, webhookCommand as xt, deleteWorkspace as y, apiCall as yn, getFunctionRegistry as yt, showCommand as z, getCommand$6 as zt };
+//# sourceMappingURL=runtime-B2K6JW7V.mjs.map