@tailor-platform/sdk 1.48.0 → 1.50.0

package/dist/application-v_E2W-Fz.mjs

@@ -0,0 +1,4 @@
+
+import { n as generatePluginFilesIfNeeded, r as loadApplication, t as defineApplication } from "./application-CZMzt9jL.mjs";
+
+export { defineApplication };

package/dist/brand-D-d15jx3.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"brand-D-d15jx3.mjs","names":[],"sources":["../src/utils/brand.ts"],"sourcesContent":["// Symbol.for ensures the same symbol is returned across different ESM module instances,\n// avoiding identity mismatches when multiple copies of the SDK are loaded.\nexport const SDK_BRAND: unique symbol = Symbol.for(\"tailor-platform/sdk\");\n\nexport type SdkBrandKind =\n  | \"tailordb-type\"\n  | \"resolver\"\n  | \"executor\"\n  | \"workflow\"\n  | \"workflow-job\"\n  | \"wait-point\";\n\n/**\n * Adds a non-enumerable SDK brand symbol to the given object (in-place).\n * The brand stores the kind so service loaders can distinguish between\n * different SDK object types (e.g. a type loader skips executors).\n * @param value - The object to brand\n * @param kind - The kind of SDK object\n * @returns The same object with the brand applied\n */\nexport function brandValue<T extends object>(value: T, kind: SdkBrandKind): T {\n  Object.defineProperty(value, SDK_BRAND, {\n    value: kind,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  });\n  return value;\n}\n\n/**\n * Checks whether the given value has been branded by the SDK.\n * When kind is specified, only returns true if the brand matches that kind.\n * Accepts a single kind or an array of kinds for multi-kind matching.\n * @param value - The value to check\n * @param kind - Optional kind or kinds to match against\n * @returns True if the value has the SDK brand symbol (and matches kind if specified)\n */\nexport function isSdkBranded(\n  value: unknown,\n  kind?: SdkBrandKind | readonly SdkBrandKind[],\n): boolean {\n  if (value === null || typeof value !== \"object\" || !(SDK_BRAND in value)) return false;\n  const stored = (value as Record<symbol, unknown>)[SDK_BRAND];\n  // No kind filter → any brand matches. Legacy `true` brand → matches any kind.\n  return (\n    kind === undefined ||\n    stored === true ||\n    (Array.isArray(kind) ? kind.includes(stored as SdkBrandKind) : stored === kind)\n  );\n}\n"],"mappings":";;AAEA,MAAa,YAA2B,OAAO,IAAI,sBAAsB;;;;;;;;;AAkBzE,SAAgB,WAA6B,OAAU,MAAuB;CAC5E,OAAO,eAAe,OAAO,WAAW;EACtC,OAAO;EACP,YAAY;EACZ,cAAc;EACd,UAAU;EACX,CAAC;CACF,OAAO;;;;;;;;;;AAWT,SAAgB,aACd,OACA,MACS;CACT,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,EAAE,aAAa,QAAQ,OAAO;CACjF,MAAM,SAAU,MAAkC;CAElD,OACE,SAAS,UACT,WAAW,SACV,MAAM,QAAQ,KAAK,GAAG,KAAK,SAAS,OAAuB,GAAG,WAAW"}
+{"version":3,"file":"brand-D-d15jx3.mjs","names":[],"sources":["../src/utils/brand.ts"],"sourcesContent":["// Symbol.for ensures the same symbol is returned across different ESM module instances,\n// avoiding identity mismatches when multiple copies of the SDK are loaded.\nexport const SDK_BRAND: unique symbol = Symbol.for(\"tailor-platform/sdk\");\n\nexport type SdkBrandKind =\n  | \"tailordb-type\"\n  | \"resolver\"\n  | \"executor\"\n  | \"workflow\"\n  | \"workflow-job\"\n  | \"wait-point\";\n\n/**\n * Adds a non-enumerable SDK brand symbol to the given object (in-place).\n * The brand stores the kind so service loaders can distinguish between\n * different SDK object types (e.g. a type loader skips executors).\n * @param value - The object to brand\n * @param kind - The kind of SDK object\n * @returns The same object with the brand applied\n */\nexport function brandValue<T extends object>(value: T, kind: SdkBrandKind): T {\n  Object.defineProperty(value, SDK_BRAND, {\n    value: kind,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  });\n  return value;\n}\n\n/**\n * Checks whether the given value has been branded by the SDK.\n * When kind is specified, only returns true if the brand matches that kind.\n * Accepts a single kind or an array of kinds for multi-kind matching.\n * @param value - The value to check\n * @param kind - Optional kind or kinds to match against\n * @returns True if the value has the SDK brand symbol (and matches kind if specified)\n */\nexport function isSdkBranded(\n  value: unknown,\n  kind?: SdkBrandKind | readonly SdkBrandKind[],\n): boolean {\n  if (value === null || typeof value !== \"object\" || !(SDK_BRAND in value)) return false;\n  const stored = (value as Record<symbol, unknown>)[SDK_BRAND];\n  // No kind filter → any brand matches. Legacy `true` brand → matches any kind.\n  return (\n    kind === undefined ||\n    stored === true ||\n    (Array.isArray(kind) ? kind.includes(stored as SdkBrandKind) : stored === kind)\n  );\n}\n"],"mappings":";;AAEA,MAAa,YAA2B,OAAO,IAAI,qBAAqB;;;;;;;;;AAkBxE,SAAgB,WAA6B,OAAU,MAAuB;CAC5E,OAAO,eAAe,OAAO,WAAW;EACtC,OAAO;EACP,YAAY;EACZ,cAAc;EACd,UAAU;CACZ,CAAC;CACD,OAAO;AACT;;;;;;;;;AAUA,SAAgB,aACd,OACA,MACS;CACT,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,EAAE,aAAa,QAAQ,OAAO;CACjF,MAAM,SAAU,MAAkC;CAElD,OACE,SAAS,UACT,WAAW,SACV,MAAM,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAsB,IAAI,WAAW;AAE9E"}

package/dist/cli/index.mjs

@@ -2,8 +2,8 @@
 
 import { G as PATScope, R as AuthInvokerSchema, c as fetchUserInfo, d as initOperatorClient, h as userAgent, i as fetchAll, j as FunctionExecution_Type, n as closeConnectionPool, o as fetchPaged, s as fetchPlatformMachineUserToken, u as initOAuth2Client } from "../client-_kHh0Pip.mjs";
 import { n as logger, r as styles } from "../logger-DTNAMYGy.mjs";
-import { $ as deleteCommand$3, At as executionsCommand, C as listCommand$13, Cn as toPageDirection, Ct as jobsCommand, E as resumeCommand, Et as startCommand, F as showCommand, Ft as getCommand$1, G as getCommand$5, H as treeCommand, I as logBetaWarning, Lt as deploy, N as generateCommand$1, Nt as functionExecutionStatusToString, O as listCommand$12, Ot as getCommand$6, Pt as formatKeyValueTable, R as removeCommand$1, Rt as executeScript, Sn as paginationArgs, T as healthCommand, U as listCommand$11, Vt as parseMigrationLabelNumber, Y as listCommand$10, Z as getCommand$4, Zt as formatMigrationNumber, _n as commonArgs, _t as webhookCommand, at as getCommand$3, b as createCommand$4, bn as isVerbose, bt as listCommand$6, c as listCommand$14, ct as tokenCommand, dn as trnPrefix, dt as generate, en as getMigrationFilePath, f as restoreCommand, ft as listCommand$7, g as getCommand$7, gn as defineAppCommand, i as updateCommand$4, in as loadDiff, j as truncateCommand, ln as getNamespacesWithMigrations, lt as listCommand$8, m as listCommand$15, mn as apiCommand, mt as getCommand$2, o as removeCommand, pn as prompt, q as updateCommand$2, r as queryCommand, rn as isValidMigrationNumber, rt as listCommand$9, t as isNativeTypeScriptRuntime, tn as getMigrationFiles, tt as createCommand$3, u as inviteCommand, un as sdkNameLabelKey, v as deleteCommand$4, vn as confirmationArgs, vt as triggerCommand, wn as workspaceArgs, xn as pagedLogArgs, yn as deploymentArgs, z as updateCommand$3 } from "../runtime-CNg0w27y.mjs";
-import { D as saveUserTokens, E as resolveTokens, O as writePlatformConfig, S as loadAccessToken, T as readPlatformConfig, _ as getDistDir, a as WorkflowJobSchema, b as deleteUserTokens, c as ExecutorSchema, i as resolveInlineSourcemap, l as INVOKER_EXPR, o as ResolverSchema, w as loadWorkspaceId, x as fetchLatestToken, y as loadConfig } from "../application-DUENhx4Y.mjs";
+import { $ as listCommand$10, An as workspaceArgs, At as startCommand, B as logBetaWarning, C as listCommand$13, Cn as configArg, Dn as pagedLogArgs, Dt as jobsCommand, E as resumeCommand, En as isVerbose, F as writeDbTypesFile, Gt as parseMigrationLabelNumber, H as removeCommand$1, Ht as executeScript, I as getConfiguredEditorCommand, K as treeCommand, L as openInConfiguredEditor, Lt as functionExecutionStatusToString, Mt as getCommand$6, N as generateCommand$1, O as listCommand$12, On as paginationArgs, P as generateMigrationScript, Pt as executionsCommand, Rt as formatKeyValueTable, Sn as commonArgs, St as triggerCommand, T as healthCommand, Tn as deploymentArgs, U as updateCommand$3, Vt as deploy, Y as getCommand$5, Yt as INITIAL_SCHEMA_NUMBER, Z as updateCommand$2, _n as prompt, an as getMigrationFiles, at as createCommand$3, b as createCommand$4, bn as assertWritable, c as listCommand$14, cn as loadDiff, f as restoreCommand, ft as tokenCommand, g as getCommand$7, gt as listCommand$7, hn as trnPrefix, ht as generate, i as updateCommand$4, in as getMigrationFilePath, j as truncateCommand, kn as toPageDirection, ln as reconstructSnapshotFromMigrations, lt as getCommand$3, m as listCommand$15, mn as sdkNameLabelKey, o as removeCommand, pn as getNamespacesWithMigrations, pt as listCommand$8, q as listCommand$11, r as queryCommand, rt as deleteCommand$3, sn as isValidMigrationNumber, st as listCommand$9, t as isNativeTypeScriptRuntime, tn as formatMigrationNumber, tt as getCommand$4, u as inviteCommand, v as deleteCommand$4, vn as apiCommand, vt as getCommand$2, wn as confirmationArgs, wt as listCommand$6, xn as defineAppCommand, xt as webhookCommand, z as showCommand, zt as getCommand$1 } from "../runtime-B2K6JW7V.mjs";
+import { D as saveUserTokens, E as resolveTokens, O as writePlatformConfig, S as loadAccessToken, T as readPlatformConfig, _ as getDistDir, a as WorkflowJobSchema, b as deleteUserTokens, c as ExecutorSchema, i as resolveInlineSourcemap, l as INVOKER_EXPR, o as ResolverSchema, w as loadWorkspaceId, x as fetchLatestToken, y as loadConfig } from "../application-CZMzt9jL.mjs";
 import { t as multiline } from "../multiline-e3IpANmS.mjs";
 import { t as readPackageJson } from "../package-json-6Px8bDpG.mjs";
 import { n as isCLIError } from "../errors-pMPXghkO.mjs";
@@ -25,6 +25,7 @@ import * as crypto from "node:crypto";
 import * as http from "node:http";
 import open from "open";
 import * as rolldown from "rolldown";
+import * as fsPromises from "node:fs/promises";
 import { TraceMap, generatedPositionFor, originalPositionFor } from "@jridgewell/trace-mapping";
 import { spawn, spawnSync } from "node:child_process";
 import * as fs from "fs";
@@ -70,6 +71,7 @@ const authorizeAuthConnectionCommand = defineAppCommand({
 		"no-browser": z.boolean().optional().default(false).describe("Don't open browser automatically")
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({
 			useProfile: true,
 			profile: args.profile
@@ -221,6 +223,7 @@ const revokeAuthConnectionCommand = defineAppCommand({
 		...confirmationArgs
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({
 			useProfile: true,
 			profile: args.profile
@@ -388,6 +391,7 @@ const deployCommand$1 = defineAppCommand({
 		"clean-cache": arg(z.boolean().optional(), { description: "Clean the bundle cache before building" })
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		const { initTelemetry } = await import("../telemetry-C13VIFpT.mjs");
 		await initTelemetry();
 		await deploy({
@@ -1864,7 +1868,8 @@ const createCommand$2 = defineAppCommand({
 		"workspace-id": arg(z.string(), {
 			alias: "w",
 			description: "Workspace ID"
-		})
+		}),
+		permission: arg(z.enum(["write", "read"]).default("write"), { description: "Profile permission. 'read' blocks all write commands while the profile is active." })
 	}).strict(),
 	run: async (args) => {
 		const config = await readPlatformConfig();
@@ -1879,14 +1884,16 @@ const createCommand$2 = defineAppCommand({
 		})).find((ws) => ws.id === args["workspace-id"])) throw new Error(`Workspace "${args["workspace-id"]}" not found.`);
 		config.profiles[args.name] = {
 			user: args.user,
-			workspace_id: args["workspace-id"]
+			workspace_id: args["workspace-id"],
+			...args.permission === "read" ? { readonly: true } : {}
 		};
 		writePlatformConfig(config);
 		if (!args.json) logger.success(`Profile "${args.name}" created successfully.`);
 		const profileInfo = {
 			name: args.name,
 			user: args.user,
-			workspaceId: args["workspace-id"]
+			workspaceId: args["workspace-id"],
+			permission: args.permission
 		};
 		logger.out(profileInfo);
 	}
@@ -1929,7 +1936,8 @@ const listCommand$4 = defineAppCommand({
 		const profileInfos = profiles.map(([name, profile]) => ({
 			name,
 			user: profile.user,
-			workspaceId: profile.workspace_id
+			workspaceId: profile.workspace_id,
+			permission: profile.readonly === true ? "read" : "write"
 		}));
 		logger.out(profileInfos);
 	}
@@ -1952,33 +1960,39 @@ const updateCommand$1 = defineAppCommand({
 		"workspace-id": arg(z.string().optional(), {
 			alias: "w",
 			description: "New workspace ID"
-		})
+		}),
+		permission: arg(z.enum(["write", "read"]).optional(), { description: "Profile permission. 'read' blocks all write commands; 'write' lifts the restriction." })
 	}).strict(),
 	run: async (args) => {
 		const config = await readPlatformConfig();
 		if (!config.profiles[args.name]) throw new Error(`Profile "${args.name}" not found.`);
-		if (!args.user && !args["workspace-id"]) throw new Error("Please provide at least one property to update.");
+		if (!args.user && !args["workspace-id"] && args.permission === void 0) throw new Error("Please provide at least one property to update.");
 		const profile = config.profiles[args.name];
 		const oldUser = profile.user;
 		const newUser = args.user || oldUser;
 		const oldWorkspaceId = profile.workspace_id;
 		const newWorkspaceId = args["workspace-id"] || oldWorkspaceId;
-		const client = await initOperatorClient(await fetchLatestToken(config, newUser));
-		if (!(await fetchAll(async (pageToken, maxPageSize) => {
-			const { workspaces, nextPageToken } = await client.listWorkspaces({
-				pageToken,
-				pageSize: maxPageSize
-			});
-			return [workspaces, nextPageToken];
-		})).find((ws) => ws.id === newWorkspaceId)) throw new Error(`Workspace "${newWorkspaceId}" not found.`);
+		if (args.user !== void 0 || args["workspace-id"] !== void 0) {
+			const client = await initOperatorClient(await fetchLatestToken(config, newUser));
+			if (!(await fetchAll(async (pageToken, maxPageSize) => {
+				const { workspaces, nextPageToken } = await client.listWorkspaces({
+					pageToken,
+					pageSize: maxPageSize
+				});
+				return [workspaces, nextPageToken];
+			})).find((ws) => ws.id === newWorkspaceId)) throw new Error(`Workspace "${newWorkspaceId}" not found.`);
+		}
 		profile.user = newUser;
 		profile.workspace_id = newWorkspaceId;
+		if (args.permission === "read") profile.readonly = true;
+		else if (args.permission === "write") delete profile.readonly;
 		writePlatformConfig(config);
 		if (!args.json) logger.success(`Profile "${args.name}" updated successfully`);
 		const profileInfo = {
 			name: args.name,
 			user: newUser,
-			workspaceId: newWorkspaceId
+			workspaceId: newWorkspaceId,
+			permission: profile.readonly === true ? "read" : "write"
 		};
 		logger.out(profileInfo);
 	}
@@ -2092,6 +2106,7 @@ const createSecretCommand = defineAppCommand({
 		...confirmationArgs
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({
 			useProfile: true,
 			profile: args.profile
@@ -2144,6 +2159,7 @@ const deleteSecretCommand = defineAppCommand({
 		...confirmationArgs
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({
 			useProfile: true,
 			profile: args.profile
@@ -2252,6 +2268,7 @@ const updateSecretCommand = defineAppCommand({
 		...confirmationArgs
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({
 			useProfile: true,
 			profile: args.profile
@@ -2307,6 +2324,7 @@ const createCommand$1 = defineAppCommand({
 		...nameArgs
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({
 			useProfile: true,
 			profile: args.profile
@@ -2339,6 +2357,7 @@ const deleteCommand$1 = defineAppCommand({
 		...confirmationArgs
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({
 			useProfile: true,
 			profile: args.profile
@@ -2466,15 +2485,15 @@ var setup_bun_default = "- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019
 
 //#endregion
 //#region src/cli/commands/setup/github/setup-npm.yml
-var setup_npm_default = "- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0\n  with:\n    node-version-file: package.json\n    cache: npm\n- run: npm ci\n";
+var setup_npm_default = "- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n  with:\n    node-version-file: package.json\n    cache: npm\n- run: npm ci\n";
 
 //#endregion
 //#region src/cli/commands/setup/github/setup-pnpm.yml
-var setup_pnpm_default = "- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8\n- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0\n  with:\n    node-version-file: package.json\n    cache: pnpm\n- run: pnpm install --frozen-lockfile\n";
+var setup_pnpm_default = "- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8\n- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n  with:\n    node-version-file: package.json\n    cache: pnpm\n- run: pnpm install --frozen-lockfile\n";
 
 //#endregion
 //#region src/cli/commands/setup/github/setup-yarn.yml
-var setup_yarn_default = "- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0\n  with:\n    node-version-file: package.json\n    cache: yarn\n- run: yarn install --frozen-lockfile\n";
+var setup_yarn_default = "- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n  with:\n    node-version-file: package.json\n    cache: yarn\n- run: yarn install --frozen-lockfile\n";
 
 //#endregion
 //#region src/cli/commands/setup/github/template-deploy.ts
@@ -2698,7 +2717,7 @@ async function runSkillsInstaller(options) {
 //#endregion
 //#region src/cli/commands/skills/install.ts
 async function resolveBundledSkillsDir() {
-	return resolve(dirname(await resolvePackageJSON(import.meta.url)), "skills");
+	return resolve(dirname(await resolvePackageJSON(import.meta.url)), "agent-skills");
 }
 const DEFAULT_AGENT = "claude-code";
 const installCommand = defineAppCommand({
@@ -2908,6 +2927,7 @@ const deployCommand = defineAppCommand({
 		})
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		logger.info(`Deploying static website "${args.name}" from directory: ${args.dir}`);
 		const client = await initOperatorClient(await loadAccessToken({
 			useProfile: true,
@@ -3445,6 +3465,7 @@ const erdDeployCommand = defineAppCommand({
 		})
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		const { client, workspaceId, config } = await initErdContext(args);
 		const buildResults = await prepareErdBuilds({
 			client,
@@ -3551,6 +3572,91 @@ const erdCommand = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/cli/commands/tailordb/migrate/script.ts
+/**
+* Script command for TailorDB migrations
+*
+* Adds a `migrate.ts` (and supporting `db.ts`) template to an existing
+* migration directory. Useful for warning-tier changes where users may
+* want to write a custom data migration even though the change does not
+* automatically require one.
+*/
+/**
+* Add a migrate.ts template to an existing migration directory.
+* @param {ScriptOptions} options - Command options
+*/
+async function script(options) {
+	logBetaWarning("tailordb migration");
+	let migrationNumber;
+	if (isValidMigrationNumber(options.number)) migrationNumber = parseInt(options.number, 10);
+	else if (/^[1-9]\d*$/.test(options.number)) {
+		migrationNumber = parseInt(options.number, 10);
+		if (migrationNumber > 9999) throw new Error(`Migration number ${options.number} is out of range. Expected 1-9999.`);
+	} else throw new Error(`Invalid migration number format: ${options.number}. Expected 4-digit format (e.g., 0001) or integer 1-9999 (e.g., 1).`);
+	if (migrationNumber === 0) throw new Error(`Migration ${options.number} is the initial schema snapshot and cannot have a migration script.`);
+	const { config } = await loadConfig(options.configPath);
+	const namespacesWithMigrations = getNamespacesWithMigrations(config, path.dirname(config.path));
+	if (namespacesWithMigrations.length === 0) throw new Error("No TailorDB services with migrations configuration found");
+	const targetNamespace = resolveTargetNamespace(namespacesWithMigrations, options.namespace);
+	const { migrationsDir } = namespacesWithMigrations.find((ns) => ns.namespace === targetNamespace);
+	const diffPath = getMigrationFilePath(migrationsDir, migrationNumber, "diff");
+	if (!fs$1.existsSync(diffPath)) throw new Error(`Migration ${options.number} not found in ${migrationsDir}. Expected ${diffPath}.`);
+	const migratePath = getMigrationFilePath(migrationsDir, migrationNumber, "migrate");
+	if (fs$1.existsSync(migratePath)) throw new Error(`Migration script already exists at ${migratePath}.`);
+	const diff = loadDiff(diffPath);
+	const previousSnapshot = reconstructSnapshotFromMigrations(migrationsDir, migrationNumber - 1);
+	if (!previousSnapshot) throw new Error(`Could not reconstruct previous schema for migration ${options.number}. Make sure migration ${0} exists.`);
+	const scriptContent = generateMigrationScript(diff);
+	await fsPromises.writeFile(migratePath, scriptContent);
+	await writeDbTypesFile(previousSnapshot, migrationsDir, migrationNumber, diff);
+	logger.success(`Added migration script for migration ${styles.bold(options.number)} in namespace ${styles.bold(targetNamespace)}`);
+	logger.info(`  Migration script: ${migratePath}`);
+	logger.info(`  DB types: ${getMigrationFilePath(migrationsDir, migrationNumber, "db")}`);
+	logger.newline();
+	logger.log("Edit the script to implement your data migration logic.");
+	logger.log("It will be executed by 'tailor-sdk deploy' between Pre and Post phases.");
+	const editor = getConfiguredEditorCommand();
+	if (!editor) return;
+	logger.newline();
+	logger.info(`Opening ${path.basename(migratePath)} in ${editor}...`);
+	try {
+		await openInConfiguredEditor(migratePath);
+	} catch {
+		return;
+	}
+}
+function resolveTargetNamespace(namespacesWithMigrations, requested) {
+	if (requested) {
+		if (!namespacesWithMigrations.some((ns) => ns.namespace === requested)) throw new Error(`Namespace "${requested}" not found or does not have migrations configured`);
+		return requested;
+	}
+	if (namespacesWithMigrations.length === 1) return namespacesWithMigrations[0].namespace;
+	throw new Error(`Multiple TailorDB services found. Please specify namespace with --namespace flag: ${namespacesWithMigrations.map((ns) => ns.namespace).join(", ")}`);
+}
+const scriptCommand = defineAppCommand({
+	name: "script",
+	description: "Add a migration script (migrate.ts) template to an existing migration directory.",
+	args: z.object({
+		...configArg,
+		number: arg(z.string(), {
+			positional: true,
+			description: "Migration number to add a script to (e.g., 0001 or 1)"
+		}),
+		namespace: arg(z.string().optional(), {
+			alias: "n",
+			description: "Target TailorDB namespace (required if multiple namespaces exist)"
+		})
+	}).strict(),
+	run: async (args) => {
+		await script({
+			configPath: args.config,
+			number: args.number,
+			namespace: args.namespace
+		});
+	}
+});
+
 //#endregion
 //#region src/cli/commands/tailordb/migrate/set.ts
 /**
@@ -3641,6 +3747,7 @@ const setCommand = defineAppCommand({
 		})
 	}).strict(),
 	run: async (args) => {
+		await assertWritable({ profile: args.profile });
 		await set({
 			configPath: args.config,
 			number: args.number,
@@ -3729,14 +3836,16 @@ const statusCommand = defineAppCommand({
 *
 * Subcommands:
 * - generate: Generate migration files from schema differences
-* - set: Set migration checkpoint to a specific number
-* - status: Show migration status for TailorDB namespaces
+* - script:   Add a migrate.ts template to an existing migration
+* - set:      Set migration checkpoint to a specific number
+* - status:   Show migration status for TailorDB namespaces
 */
 const migrationCommand = defineCommand({
 	name: "migration",
 	description: "Manage TailorDB schema migrations.",
 	subCommands: {
 		generate: generateCommand$1,
+		script: scriptCommand,
 		set: setCommand,
 		status: statusCommand
 	}
@@ -3901,6 +4010,7 @@ const createCommand = defineAppCommand({
 		})
 	}).strict(),
 	run: async (args) => {
+		await assertWritable();
 		const config = await readPlatformConfig();
 		if (!config.current_user) throw new Error(multiline`
         No user logged in.
@@ -3927,6 +4037,7 @@ const deleteCommand = defineAppCommand({
 		description: "Token name"
 	}) }).strict(),
 	run: async (args) => {
+		await assertWritable();
 		const config = await readPlatformConfig();
 		if (!config.current_user) throw new Error(multiline`
         No user logged in.
@@ -3997,6 +4108,7 @@ const updateCommand = defineAppCommand({
 		})
 	}).strict(),
 	run: async (args) => {
+		await assertWritable();
 		const config = await readPlatformConfig();
 		if (!config.current_user) throw new Error(multiline`
         No user logged in.
@@ -4136,8 +4248,8 @@ const workspaceCommand = defineCommand({
 //#endregion
 //#region src/cli/index.ts
 if (!isNativeTypeScriptRuntime()) {
-	const { register } = await import("node:module");
-	register("tsx", import.meta.url, { data: {} });
+	const { register } = await import("tsx/esm/api");
+	register();
 }
 initCrashReporting();
 const packageJson = await readPackageJson();