@tailor-platform/sdk 1.84.0 → 1.85.0

package/dist/{register-typescript-runtime-BCvWR3HC.mjs → register-typescript-runtime-nG-n9lPw.mjs}

@@ -2,13 +2,13 @@ import { t as db } from "./schema-CYrle8JZ.mjs";
 import { $ as CreateAuthHookRequestSchema, B as IdPLang, Bt as Subgraph_ServiceType, C as CreateStaticWebsiteRequestSchema, Ct as AuthInvokerSchema, D as CreateSecretManagerSecretRequestSchema, Dt as AuthSCIMAttribute_Type, Et as AuthSCIMAttribute_Mutability, Ft as CreateApplicationRequestSchema, H as IdPPermissionPermit, Ht as UpdateAIGatewayRequestSchema, I as PipelineResolver_OperationType, It as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, Jt as FilterSchema, K as CreateExecutorExecutorRequestSchema, Kt as ConditionSchema, L as CreateIdPServiceRequestSchema, Lt as UpdateApplicationRequestSchema, M as CreatePipelineServiceRequestSchema, Mt as UserProfileProviderConfig_UserProfileProviderType, N as UpdatePipelineResolverRequestSchema, O as CreateSecretManagerVaultRequestSchema, Ot as AuthSCIMAttribute_Uniqueness, P as UpdatePipelineServiceRequestSchema, Q as CreateAuthConnectionRequestSchema, R as UpdateIdPServiceRequestSchema, S as AddCustomDomainRequestSchema, St as AuthIDPConfig_AuthType, Tt as AuthOAuth2Client_GrantType, U as FunctionExecution_Status, V as IdPPermissionOperator, Vt as CreateAIGatewayRequestSchema, X as ExecutorTargetType, Y as ExecutorJobStatus, Yt as PageDirection, Z as ExecutorTriggerType, _ as TailorDBGQLPermission_Permit, _t as UpdateUserProfileConfigRequestSchema, a as CreateWorkflowRequestSchema, at as CreateAuthServiceRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthConnection_Type, ct as UpdateAuthConnectionRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as UpdateAuthMachineUserRequestSchema, et as CreateAuthIDPConfigRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as UpdateAuthOAuth2ClientRequestSchema, g as TailorDBGQLPermission_Operator, gt as UpdateTenantConfigRequestSchema, h as TailorDBGQLPermission_Action, ht as UpdateAuthServiceRequestSchema, i as CreateWorkflowJobFunctionRequestSchema, it as CreateAuthSCIMResourceRequestSchema, j as CreatePipelineResolverRequestSchema, jt as TenantProviderConfig_TenantProviderType, k as UpdateSecretManagerSecretRequestSchema, kt as AuthSCIMConfig_AuthorizationType, l as WorkflowExecution_Status, lt as UpdateAuthHookRequestSchema, mt as UpdateAuthSCIMResourceRequestSchema, nt as CreateAuthOAuth2ClientRequestSchema, o as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as CreateTenantConfigRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as UpdateAuthSCIMConfigRequestSchema, q as UpdateExecutorExecutorRequestSchema, qt as Condition_Operator, r as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, rt as CreateAuthSCIMConfigRequestSchema, s as UpdateWorkflowRequestSchema, st as CreateUserProfileConfigRequestSchema, t as WorkspacePlatformUserRole, tt as CreateAuthMachineUserRequestSchema, u as WorkflowJobExecution_Status, ut as UpdateAuthIDPConfigRequestSchema, v as TailorDBTypeSchema, w as UpdateStaticWebsiteRequestSchema, wt as AuthOAuth2Client_ClientType, x as TailorDBType_PermitAction, xt as AuthHookPoint, y as TailorDBType_Permission_Operator, yt as AuthConnection_Status, zt as ApplicationSchemaUpdateAttemptStatus } from "./workspace_resource_pb-DXnO2AT-.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
 import { a as parseBoolean, i as symbols, n as logger, o as renderTable, r as styles, t as CIPromptError } from "./logger-CXQq9YIp.mjs";
-import { A as defaultPlatformBaseUrl, B as getPlatformBaseUrl, C as getPluginGenerationDependencies, D as hashContent, E as getDistDir, G as normalizeBaseUrl, H as initOperatorClient, J as byName, K as rememberPlatformConfigForToken, L as getConsoleBaseUrl, M as fetchAllTolerant, N as fetchMachineUserToken, O as hashFile, P as fetchPaged, R as getOAuth2ClientId, T as createBundleCache, U as isDefaultPlatform, V as initOAuth2Client, W as isNotFoundError, X as LOG_LEVELS, Y as createApplyLimiter, _ as stringifyFunction, d as buildExecutorArgsExpr, f as buildResolverOperationHookExpr, g as TailorDBTypeSchema$1, h as assertUniqueTailorDBTypeNamesWithExternal, i as resolverBundleKey, j as fetchAll, l as HTTP_METHODS, m as assertUniqueLocalTailorDBTypeNames, n as generatePluginFilesIfNeeded, o as WorkflowJobFunctionExecutionPolicySchema, q as resolveStaticWebsiteUrls, r as loadApplication, t as defineApplication, v as resolveTSConfigWithFallback, w as hasGenerationHooks, y as platformBundleDefinePlugin, z as getOrNull } from "./application-CnCljDwk.mjs";
+import { $ as LOG_LEVELS, A as hashContent, B as getConsoleBaseUrl, D as hasGenerationHooks, E as getPluginGenerationDependencies, F as fetchAllTolerant, G as initOperatorClient, H as getOrNull, I as fetchMachineUserToken, J as normalizeBaseUrl, K as isDefaultPlatform, L as fetchPaged, N as defaultPlatformBaseUrl, O as createBundleCache, P as fetchAll, Q as createApplyLimiter, T as createBundleLog, U as getPlatformBaseUrl, V as getOAuth2ClientId, W as initOAuth2Client, X as resolveStaticWebsiteUrls, Y as rememberPlatformConfigForToken, Z as byName, _ as stringifyFunction, b as resolveTSConfigWithFallback, d as buildExecutorArgsExpr, f as buildResolverOperationHookExpr, g as TailorDBTypeSchema$1, h as assertUniqueTailorDBTypeNamesWithExternal, i as resolverBundleKey, j as hashFile, k as getDistDir, l as HTTP_METHODS, m as assertUniqueLocalTailorDBTypeNames, n as generatePluginFilesIfNeeded, o as WorkflowJobFunctionExecutionPolicySchema, q as isNotFoundError, r as loadApplication, t as defineApplication, v as createGeneratedEntryResolverPlugin, x as platformBundleDefinePlugin, y as createTsconfigPathsPlugin } from "./application-m5tYtz0-.mjs";
 import { o as loadFilesWithIgnores, s as functionSchema, t as createExecutorService } from "./service-CPJWhTLn.mjs";
 import { n as enumConstantsPlugin, t as EnumConstantsGeneratorID } from "./enum-constants-j9QBF0cB.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { n as fileUtilsPlugin, t as FileUtilsGeneratorID } from "./file-utils-DcyIPFQh.mjs";
 import { n as kyselyTypePlugin, t as KyselyGeneratorID } from "./kysely-type-D-zflMGf.mjs";
-import { n as seedPlugin, t as SeedGeneratorID } from "./seed-DFFigL8V.mjs";
+import { n as seedPlugin, t as SeedGeneratorID } from "./seed-6eTFj-3Q.mjs";
 import { t as readPackageJson } from "./package-json-8b0O9TlX.mjs";
 import { t as userAgent } from "./user-agent-DX2Jnw0-.mjs";
 import { r as isCLIError, t as createCLIError } from "./errors-DVFS0AZk.mjs";
@@ -9544,6 +9544,283 @@ function handleOptionalToRequiredError(error, messages) {
 	throw error;
 }
 
+//#endregion
+//#region src/cli/commands/tailordb/migrate/schema-checks.ts
+/**
+* Schema validation checks shared between `deploy` and
+* `tailordb migration validate`.
+*
+* These checks are read-only: they compare local type definitions, the
+* migration snapshot history, and the remote schema without mutating any
+* state.
+*/
+/**
+* Convert a runtime TailorDBService to the snapshot-shaped deploy input.
+* @param service - Loaded TailorDB service (after `loadTypes()`)
+* @returns The canonical snapshot-shaped deploy input for downstream plan/apply phases.
+*/
+function toTailorDBDeployInput(service) {
+	const types = {};
+	for (const [typeName, type] of Object.entries(service.types)) types[typeName] = createSnapshotType(type);
+	return {
+		namespace: service.namespace,
+		config: service.config,
+		types
+	};
+}
+/**
+* Fetch all TailorDB types from remote for a namespace
+* @param {OperatorClient} client - Operator client instance
+* @param {string} workspaceId - Workspace ID
+* @param {string} namespace - TailorDB namespace
+* @returns {Promise<ProtoTailorDBType[]>} Remote TailorDB types
+*/
+async function fetchRemoteTypes(client, workspaceId, namespace) {
+	return fetchAllTolerant(async (pageToken, maxPageSize) => {
+		const { tailordbTypes, nextPageToken } = await client.listTailorDBTypes({
+			workspaceId,
+			namespaceName: namespace,
+			pageToken,
+			pageSize: maxPageSize
+		});
+		return [tailordbTypes, nextPageToken];
+	});
+}
+async function fetchRemoteGqlPermissions(client, workspaceId, namespace) {
+	return fetchAllTolerant(async (pageToken, maxPageSize) => {
+		const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
+			workspaceId,
+			namespaceName: namespace,
+			pageToken,
+			pageSize: maxPageSize
+		});
+		return [permissions, nextPageToken];
+	});
+}
+function definedWhenNotEmpty(value) {
+	return Object.keys(value).length > 0 ? value : void 0;
+}
+function namespaceConfig(config, tailorDBInputs, namespace) {
+	return tailorDBInputs.find((input) => input.namespace === namespace)?.config ?? config.db?.[namespace];
+}
+function namespaceGqlOperations(config, tailorDBInputs, namespace) {
+	return namespaceConfig(config, tailorDBInputs, namespace)?.gqlOperations;
+}
+const GQL_OPERATION_KEYS = [
+	"create",
+	"update",
+	"delete",
+	"read"
+];
+function configuredDisabledGqlOperations(operations) {
+	if (!operations) return void 0;
+	if (operations === "query") return {
+		create: false,
+		update: false,
+		delete: false
+	};
+	const disabled = {};
+	for (const key of GQL_OPERATION_KEYS) if (operations[key] === false) disabled[key] = false;
+	return definedWhenNotEmpty(disabled);
+}
+function appliedConfiguredDisabledGqlOperations(remoteDisabled, configuredDisabled) {
+	if (!remoteDisabled || !configuredDisabled) return void 0;
+	const disabled = {};
+	for (const key of GQL_OPERATION_KEYS) if (configuredDisabled[key] === false && remoteDisabled[key]) disabled[key] = false;
+	return definedWhenNotEmpty(disabled);
+}
+function deployComparableSnapshot(snapshot, remoteTypes, gqlOperations) {
+	const remoteTypesByName = new Map(remoteTypes.map((type) => [type.name, type]));
+	const configuredDisabled = configuredDisabledGqlOperations(gqlOperations);
+	const types = {};
+	for (const [typeName, type] of Object.entries(snapshot.types)) {
+		const settings = { ...type.settings };
+		const remoteSettings = remoteTypesByName.get(typeName)?.schema?.settings;
+		if (type.settings?.publishEvents === void 0 && remoteSettings?.publishRecordEvents) settings.publishEvents = true;
+		if (type.settings?.gqlOperations === void 0) {
+			const disabled = appliedConfiguredDisabledGqlOperations(remoteSettings?.disableGqlOperations, configuredDisabled);
+			if (disabled) settings.gqlOperations = disabled;
+		}
+		const comparableType = { ...type };
+		const comparableSettings = definedWhenNotEmpty(settings);
+		if (comparableSettings) comparableType.settings = comparableSettings;
+		else delete comparableType.settings;
+		types[typeName] = comparableType;
+	}
+	return {
+		...snapshot,
+		types
+	};
+}
+async function getRemoteMigrationNumberState(client, workspaceId, namespace) {
+	const trn = resourceTrn(workspaceId, "tailordb", namespace);
+	const metadata = await getOrNull(async () => {
+		const { metadata } = await client.getMetadata({ trn });
+		return metadata;
+	});
+	if (!metadata) return {
+		metadataExists: false,
+		number: null
+	};
+	const label = metadata.labels[MIGRATION_LABEL_KEY];
+	if (!label) return {
+		metadataExists: true,
+		number: null
+	};
+	return {
+		metadataExists: true,
+		number: parseMigrationLabelNumber(label)
+	};
+}
+/**
+* Get the current migration number from remote metadata
+* @param {OperatorClient} client - Operator client instance
+* @param {string} workspaceId - Workspace ID
+* @param {string} namespace - TailorDB namespace
+* @returns {Promise<number | null>} Current migration number, or null if no migration label exists
+*/
+async function getRemoteMigrationNumber(client, workspaceId, namespace) {
+	return (await getRemoteMigrationNumberState(client, workspaceId, namespace)).number;
+}
+/**
+* Verify remote schema matches the expected snapshot state
+* @param {OperatorClient} client - Operator client instance
+* @param {string} workspaceId - Workspace ID
+* @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migration config
+* @param {LoadedConfig} config - Loaded application config
+* @param {ReadonlyArray<TailorDBDeployInput>} tailorDBInputs - Deploy inputs for namespace defaults
+* @returns {Promise<RemoteSchemaVerificationResult[]>} Verification results per namespace
+*/
+async function verifyRemoteSchema(client, workspaceId, namespacesWithMigrations, config, tailorDBInputs) {
+	const results = [];
+	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
+		const { metadataExists, number: remoteMigrationNumber } = await getRemoteMigrationNumberState(client, workspaceId, namespace);
+		if (remoteMigrationNumber === null) {
+			results.push({
+				namespace,
+				remoteMigrationNumber: 0,
+				drifts: [],
+				hasDrift: false,
+				skipped: metadataExists ? "no_migration_label" : "not_deployed"
+			});
+			continue;
+		}
+		if (remoteMigrationNumber > getLatestMigrationNumber(migrationsDir)) {
+			results.push({
+				namespace,
+				remoteMigrationNumber,
+				drifts: [],
+				hasDrift: false,
+				checkpointMissingLocal: true
+			});
+			continue;
+		}
+		const expectedSnapshot = reconstructSnapshotFromMigrations(migrationsDir, remoteMigrationNumber);
+		if (!expectedSnapshot) {
+			results.push({
+				namespace,
+				remoteMigrationNumber,
+				drifts: [],
+				hasDrift: false,
+				skipped: "no_snapshot"
+			});
+			continue;
+		}
+		const [remoteTypes, remoteGqlPermissions] = await Promise.all([fetchRemoteTypes(client, workspaceId, namespace), fetchRemoteGqlPermissions(client, workspaceId, namespace)]);
+		const drifts = compareRemoteWithSnapshot(remoteTypes, deployComparableSnapshot(expectedSnapshot, remoteTypes, namespaceGqlOperations(config, tailorDBInputs, namespace)), remoteGqlPermissions);
+		results.push({
+			namespace,
+			remoteMigrationNumber,
+			drifts,
+			hasDrift: drifts.length > 0
+		});
+	}
+	return results;
+}
+/**
+* Log common causes of remote schema drift and how to resolve them
+*/
+function logRemoteDriftGuidance() {
+	logger.info("This may indicate:");
+	logger.info("  - Another developer applied different migrations", { mode: "plain" });
+	logger.info("  - Manual schema changes were made directly", { mode: "plain" });
+	logger.info("  - Migration history is out of sync", { mode: "plain" });
+	logger.newline();
+	logger.info("To resolve:");
+	logger.info("  - Run 'tailor-sdk tailordb migration status' to compare local vs remote.", { mode: "plain" });
+	logger.info("  - If remote is correct, update local types and run 'migration generate'.", { mode: "plain" });
+	logger.info("  - If local migration history is correct, run 'migration sync <N>' to overwrite remote.", { mode: "plain" });
+	logger.info("  - If only bookkeeping is stale, run 'migration set <N>'.", { mode: "plain" });
+}
+/**
+* Format remote schema verification results for display
+* @param {RemoteSchemaVerificationResult[]} results - Verification results
+* @returns {string} Formatted results string
+*/
+function formatRemoteVerificationResults(results) {
+	const lines = [];
+	for (const result of results) {
+		if (!result.hasDrift) continue;
+		lines.push(`Namespace: ${result.namespace}`);
+		lines.push(`  Remote migration: ${formatMigrationNumber(result.remoteMigrationNumber)}`);
+		lines.push(`  Differences:`);
+		lines.push(formatSchemaDrifts(result.drifts));
+		lines.push("");
+	}
+	return lines.join("\n");
+}
+/**
+* Check if there are schema differences between migration snapshots and local definitions
+* @param {ReadonlyMap<string, Record<string, TailorDBSnapshotType>>} typesByNamespace - Snapshot-shaped local types by namespace
+* @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migrations config
+* @returns {Promise<MigrationCheckResult[]>} Results for each namespace
+*/
+async function checkMigrationDiffs(typesByNamespace, namespacesWithMigrations) {
+	const results = [];
+	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
+		const localTypes = typesByNamespace.get(namespace);
+		if (!localTypes) continue;
+		const previousSnapshot = reconstructSnapshotFromMigrations(migrationsDir);
+		if (!previousSnapshot) {
+			results.push({
+				namespace,
+				migrationsDir,
+				hasDiff: true,
+				diff: void 0
+			});
+			continue;
+		}
+		const diff = compareLocalTypesWithSnapshot(previousSnapshot, localTypes, namespace);
+		results.push({
+			namespace,
+			migrationsDir,
+			hasDiff: hasChanges(diff),
+			diff: hasChanges(diff) ? diff : void 0
+		});
+	}
+	return results;
+}
+/**
+* Format migration check results for display
+* @param {MigrationCheckResult[]} results - Migration check results
+* @returns {string} Formatted results string
+*/
+function formatMigrationCheckResults(results) {
+	const lines = [];
+	for (const result of results) {
+		if (!result.hasDiff) continue;
+		lines.push(`Namespace: ${result.namespace}`);
+		if (!result.diff) lines.push("  No migration snapshot found. Run 'tailor-sdk tailordb migration generate' first.");
+		else {
+			lines.push(`  ${formatDiffSummary(result.diff)}`);
+			lines.push("");
+			lines.push(formatMigrationDiff(result.diff));
+		}
+		lines.push("");
+	}
+	return lines.join("\n");
+}
+
 //#endregion
 //#region src/cli/commands/tailordb/migrate/bundler.ts
 /**
@@ -9592,31 +9869,39 @@ async function bundleMigrationScript(sourceFile, namespace, migrationNumber, env
     }
   `;
 	fs$1.writeFileSync(entryPath, entryContent);
-	const tsconfig = await resolveTSConfigWithFallback(baseDir ?? path.dirname(absoluteSourcePath));
+	const projectDir = baseDir ?? path.dirname(absoluteSourcePath);
+	const tsconfig = await resolveTSConfigWithFallback(projectDir);
+	const bundleLog = createBundleLog({ tsconfig });
+	const result = await rolldown.build({
+		plugins: [
+			createGeneratedEntryResolverPlugin(entryPath, projectDir),
+			createTsconfigPathsPlugin(),
+			platformBundleDefinePlugin
+		],
+		input: entryPath,
+		write: false,
+		output: {
+			format: "esm",
+			sourcemap: false,
+			minify: false,
+			codeSplitting: false,
+			globals: { tailordb: "tailordb" }
+		},
+		external: ["tailordb"],
+		resolve: { conditionNames: ["node", "import"] },
+		tsconfig,
+		treeshake: {
+			moduleSideEffects: false,
+			annotations: true,
+			unknownGlobalSideEffects: false
+		},
+		...bundleLog.options
+	});
+	bundleLog.assertAllResolved();
 	return {
 		namespace,
 		migrationNumber,
-		bundledCode: (await rolldown.build({
-			plugins: [platformBundleDefinePlugin],
-			input: entryPath,
-			write: false,
-			output: {
-				format: "esm",
-				sourcemap: false,
-				minify: false,
-				codeSplitting: false,
-				globals: { tailordb: "tailordb" }
-			},
-			external: ["tailordb"],
-			resolve: { conditionNames: ["node", "import"] },
-			tsconfig,
-			treeshake: {
-				moduleSideEffects: false,
-				annotations: true,
-				unknownGlobalSideEffects: false
-			},
-			logLevel: "silent"
-		})).output[0].code
+		bundledCode: result.output[0].code
 	};
 }
 
@@ -10045,169 +10330,6 @@ function groupMigrationsByNamespace(migrations) {
 
 //#endregion
 //#region src/cli/commands/deploy/tailordb/index.ts
-/**
-* Fetch all TailorDB types from remote for a namespace
-* @param {OperatorClient} client - Operator client instance
-* @param {string} workspaceId - Workspace ID
-* @param {string} namespace - TailorDB namespace
-* @returns {Promise<ProtoTailorDBType[]>} Remote TailorDB types
-*/
-async function fetchRemoteTypes(client, workspaceId, namespace) {
-	return fetchAllTolerant(async (pageToken, maxPageSize) => {
-		const { tailordbTypes, nextPageToken } = await client.listTailorDBTypes({
-			workspaceId,
-			namespaceName: namespace,
-			pageToken,
-			pageSize: maxPageSize
-		});
-		return [tailordbTypes, nextPageToken];
-	});
-}
-async function fetchRemoteGqlPermissions(client, workspaceId, namespace) {
-	return fetchAllTolerant(async (pageToken, maxPageSize) => {
-		const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
-			workspaceId,
-			namespaceName: namespace,
-			pageToken,
-			pageSize: maxPageSize
-		});
-		return [permissions, nextPageToken];
-	});
-}
-function definedWhenNotEmpty(value) {
-	return Object.keys(value).length > 0 ? value : void 0;
-}
-function namespaceConfig(config, tailorDBInputs, namespace) {
-	return tailorDBInputs.find((input) => input.namespace === namespace)?.config ?? config.db?.[namespace];
-}
-function namespaceGqlOperations(config, tailorDBInputs, namespace) {
-	return namespaceConfig(config, tailorDBInputs, namespace)?.gqlOperations;
-}
-const GQL_OPERATION_KEYS = [
-	"create",
-	"update",
-	"delete",
-	"read"
-];
-function configuredDisabledGqlOperations(operations) {
-	if (!operations) return void 0;
-	if (operations === "query") return {
-		create: false,
-		update: false,
-		delete: false
-	};
-	const disabled = {};
-	for (const key of GQL_OPERATION_KEYS) if (operations[key] === false) disabled[key] = false;
-	return definedWhenNotEmpty(disabled);
-}
-function appliedConfiguredDisabledGqlOperations(remoteDisabled, configuredDisabled) {
-	if (!remoteDisabled || !configuredDisabled) return void 0;
-	const disabled = {};
-	for (const key of GQL_OPERATION_KEYS) if (configuredDisabled[key] === false && remoteDisabled[key]) disabled[key] = false;
-	return definedWhenNotEmpty(disabled);
-}
-function deployComparableSnapshot(snapshot, remoteTypes, gqlOperations) {
-	const remoteTypesByName = new Map(remoteTypes.map((type) => [type.name, type]));
-	const configuredDisabled = configuredDisabledGqlOperations(gqlOperations);
-	const types = {};
-	for (const [typeName, type] of Object.entries(snapshot.types)) {
-		const settings = { ...type.settings };
-		const remoteSettings = remoteTypesByName.get(typeName)?.schema?.settings;
-		if (type.settings?.publishEvents === void 0 && remoteSettings?.publishRecordEvents) settings.publishEvents = true;
-		if (type.settings?.gqlOperations === void 0) {
-			const disabled = appliedConfiguredDisabledGqlOperations(remoteSettings?.disableGqlOperations, configuredDisabled);
-			if (disabled) settings.gqlOperations = disabled;
-		}
-		const comparableType = { ...type };
-		const comparableSettings = definedWhenNotEmpty(settings);
-		if (comparableSettings) comparableType.settings = comparableSettings;
-		else delete comparableType.settings;
-		types[typeName] = comparableType;
-	}
-	return {
-		...snapshot,
-		types
-	};
-}
-/**
-* Get the current migration number from remote metadata
-* @param {OperatorClient} client - Operator client instance
-* @param {string} workspaceId - Workspace ID
-* @param {string} namespace - TailorDB namespace
-* @returns {Promise<number | null>} Current migration number, or null if no migration label exists
-*/
-async function getRemoteMigrationNumber(client, workspaceId, namespace) {
-	try {
-		const trn = resourceTrn(workspaceId, "tailordb", namespace);
-		const { metadata } = await client.getMetadata({ trn });
-		const label = metadata?.labels["sdk-migration"];
-		if (!label) return null;
-		const match = label.match(/^m(\d+)$/);
-		return match ? parseInt(assertDefined(match[1], "migration label capture group missing"), 10) : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Verify remote schema matches the expected snapshot state
-* @param {OperatorClient} client - Operator client instance
-* @param {string} workspaceId - Workspace ID
-* @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migration config
-* @param {LoadedConfig} config - Loaded application config
-* @param {ReadonlyArray<TailorDBDeployInput>} tailorDBInputs - Deploy inputs for namespace defaults
-* @returns {Promise<RemoteSchemaVerificationResult[]>} Verification results per namespace
-*/
-async function verifyRemoteSchema(client, workspaceId, namespacesWithMigrations, config, tailorDBInputs) {
-	const results = [];
-	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
-		const remoteMigrationNumber = await getRemoteMigrationNumber(client, workspaceId, namespace);
-		if (remoteMigrationNumber === null) {
-			results.push({
-				namespace,
-				remoteMigrationNumber: 0,
-				drifts: [],
-				hasDrift: false
-			});
-			continue;
-		}
-		const expectedSnapshot = reconstructSnapshotFromMigrations(migrationsDir, remoteMigrationNumber);
-		if (!expectedSnapshot) {
-			results.push({
-				namespace,
-				remoteMigrationNumber,
-				drifts: [],
-				hasDrift: false
-			});
-			continue;
-		}
-		const [remoteTypes, remoteGqlPermissions] = await Promise.all([fetchRemoteTypes(client, workspaceId, namespace), fetchRemoteGqlPermissions(client, workspaceId, namespace)]);
-		const drifts = compareRemoteWithSnapshot(remoteTypes, deployComparableSnapshot(expectedSnapshot, remoteTypes, namespaceGqlOperations(config, tailorDBInputs, namespace)), remoteGqlPermissions);
-		results.push({
-			namespace,
-			remoteMigrationNumber,
-			drifts,
-			hasDrift: drifts.length > 0
-		});
-	}
-	return results;
-}
-/**
-* Format remote schema verification results for display
-* @param {RemoteSchemaVerificationResult[]} results - Verification results
-* @returns {string} Formatted results string
-*/
-function formatRemoteVerificationResults(results) {
-	const lines = [];
-	for (const result of results) {
-		if (!result.hasDrift) continue;
-		lines.push(`Namespace: ${result.namespace}`);
-		lines.push(`  Remote migration: ${formatMigrationNumber(result.remoteMigrationNumber)}`);
-		lines.push(`  Differences:`);
-		lines.push(formatSchemaDrifts(result.drifts));
-		lines.push("");
-	}
-	return lines.join("\n");
-}
 const MIGRATION_FILE_KINDS = [
 	"schema",
 	"diff",
@@ -10266,20 +10388,19 @@ async function validateAndDetectMigrations(client, workspaceId, typesByNamespace
 				throw new Error("Schema migration check failed");
 			}
 			const remoteVerificationResults = await verifyRemoteSchema(client, workspaceId, namespacesWithMigrations, config, tailorDBInputs);
+			const missingCheckpointResults = remoteVerificationResults.filter((result) => result.checkpointMissingLocal);
+			if (missingCheckpointResults.length > 0) {
+				logger.error("Remote migration checkpoint is not in the local migration history:");
+				for (const result of missingCheckpointResults) logger.log(`  ${result.namespace}: ${formatMigrationNumber(result.remoteMigrationNumber)}`);
+				logger.newline();
+				logger.info("Pull the latest migration files, or run 'tailor-sdk tailordb migration status' to compare.");
+				throw new Error("Remote migration checkpoint verification failed");
+			}
 			if (remoteVerificationResults.some((r) => r.hasDrift)) {
 				logger.error("Remote schema drift detected:");
 				logger.log(formatRemoteVerificationResults(remoteVerificationResults));
 				logger.newline();
-				logger.info("This may indicate:");
-				logger.info("  - Another developer applied different migrations", { mode: "plain" });
-				logger.info("  - Manual schema changes were made directly", { mode: "plain" });
-				logger.info("  - Migration history is out of sync", { mode: "plain" });
-				logger.newline();
-				logger.info("To resolve:");
-				logger.info("  - Run 'tailor-sdk tailordb migration status' to compare local vs remote.", { mode: "plain" });
-				logger.info("  - If remote is correct, update local types and run 'migration generate'.", { mode: "plain" });
-				logger.info("  - If local migration history is correct, run 'migration sync <N>' to overwrite remote.", { mode: "plain" });
-				logger.info("  - If only bookkeeping is stale, run 'migration set <N>'.", { mode: "plain" });
+				logRemoteDriftGuidance();
 				logger.newline();
 				logger.info("Use '--no-schema-check' to skip this check (not recommended).");
 				throw new Error("Remote schema verification failed");
@@ -10317,7 +10438,7 @@ async function reconcileMigrationLabels(client, workspaceId, namespacesWithMigra
 	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
 		if (getMigrationFiles(migrationsDir).length === 0) continue;
 		const targetVersion = getLatestMigrationNumber(migrationsDir);
-		const currentVersion = await getRemoteMigrationNumber(client, workspaceId, namespace);
+		const currentVersion = await getRemoteMigrationNumber(client, workspaceId, namespace).catch(() => null);
 		if (currentVersion === targetVersion) continue;
 		await updateMigrationLabel(client, workspaceId, namespace, targetVersion);
 		const from = currentVersion === null ? "<unset>" : formatMigrationNumber(currentVersion);
@@ -10756,19 +10877,10 @@ async function rollbackSingleMigrationPrePhase(client, changeSet, migration, wor
 	}
 }
 /**
-* Convert a runtime TailorDBService to the snapshot-shaped deploy input.
-* @param service - Loaded TailorDB service (after `loadTypes()`)
-* @returns The canonical snapshot-shaped deploy input for downstream plan/apply phases.
+* Plan TailorDB-related changes based on current and desired state.
+* @param context - Planning context
+* @returns Planned changes
 */
-function toTailorDBDeployInput(service) {
-	const types = {};
-	for (const [typeName, type] of Object.entries(service.types)) types[typeName] = createSnapshotType(type);
-	return {
-		namespace: service.namespace,
-		config: service.config,
-		types
-	};
-}
 async function planTailorDB(context) {
 	const { client, workspaceId, application, forRemoval, config, noSchemaCheck, forceApplyAll = false } = context;
 	const tailordbs = [];
@@ -11156,57 +11268,6 @@ function normalizeComparableGqlPermission(permission) {
 		actions: (policy.actions ?? []).toSorted((left, right) => left - right)
 	})) };
 }
-/**
-* Check if there are schema differences between migration snapshots and local definitions
-* @param {ReadonlyMap<string, Record<string, TailorDBSnapshotType>>} typesByNamespace - Snapshot-shaped local types by namespace
-* @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migrations config
-* @returns {Promise<MigrationCheckResult[]>} Results for each namespace
-*/
-async function checkMigrationDiffs(typesByNamespace, namespacesWithMigrations) {
-	const results = [];
-	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
-		const localTypes = typesByNamespace.get(namespace);
-		if (!localTypes) continue;
-		const previousSnapshot = reconstructSnapshotFromMigrations(migrationsDir);
-		if (!previousSnapshot) {
-			results.push({
-				namespace,
-				migrationsDir,
-				hasDiff: true,
-				diff: void 0
-			});
-			continue;
-		}
-		const diff = compareLocalTypesWithSnapshot(previousSnapshot, localTypes, namespace);
-		results.push({
-			namespace,
-			migrationsDir,
-			hasDiff: hasChanges(diff),
-			diff: hasChanges(diff) ? diff : void 0
-		});
-	}
-	return results;
-}
-/**
-* Format migration check results for display
-* @param {MigrationCheckResult[]} results - Migration check results
-* @returns {string} Formatted results string
-*/
-function formatMigrationCheckResults(results) {
-	const lines = [];
-	for (const result of results) {
-		if (!result.hasDiff) continue;
-		lines.push(`Namespace: ${result.namespace}`);
-		if (!result.diff) lines.push("  No migration snapshot found. Run 'tailor-sdk tailordb migration generate' first.");
-		else {
-			lines.push(`  ${formatDiffSummary(result.diff)}`);
-			lines.push("");
-			lines.push(formatMigrationDiff(result.diff));
-		}
-		lines.push("");
-	}
-	return lines.join("\n");
-}
 
 //#endregion
 //#region src/cli/commands/deploy/workflow.ts
@@ -19344,7 +19405,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-5FOWIxFQ.mjs");
+	const { defineApplication } = await import("./application-C-zsrNjn.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -20558,8 +20619,13 @@ async function bundleQueryScript(engine, baseDir) {
 	const entryContent = engine === "sql" ? createSqlEntry() : createGqlEntry();
 	fs$1.writeFileSync(entryPath, entryContent);
 	const tsconfig = await resolveTSConfigWithFallback(baseDir);
-	return (await rolldown.build({
-		plugins: [platformBundleDefinePlugin],
+	const bundleLog = createBundleLog({ tsconfig });
+	const result = await rolldown.build({
+		plugins: [
+			createGeneratedEntryResolverPlugin(entryPath, baseDir),
+			createTsconfigPathsPlugin(),
+			platformBundleDefinePlugin
+		],
 		input: entryPath,
 		write: false,
 		output: {
@@ -20577,8 +20643,10 @@ async function bundleQueryScript(engine, baseDir) {
 			annotations: true,
 			unknownGlobalSideEffects: false
 		},
-		logLevel: "silent"
-	})).output[0].code;
+		...bundleLog.options
+	});
+	bundleLog.assertAllResolved();
+	return result.output[0].code;
 }
 
 //#endregion
@@ -21472,5 +21540,5 @@ async function registerTypeScriptRuntime(hookUrl) {
 }
 
 //#endregion
-export { listFolders as $, deploymentArgs as $n, handleOptionalToRequiredError as $t, generate as A, generateUserTypes as An, startCommand as At, remove as B, loadConsoleBaseUrl as Bn, deploy as Bt, waitWorkflowExecution as C, formatDiffSummary as Cn, listCommand$8 as Ct, listWorkflows as D, resourceTrn as Dn, jobsCommand as Dt, listCommand$2 as E, getNamespacesWithMigrations as En, getExecutorWaitFailureMessage as Et, openInConfiguredEditor as F, deleteUserTokens as Fn, getWorkflowExecution as Ft, treeCommand as G, readPlatformConfig as Gn, createWorkspace$1 as Gt, updateCommand$1 as H, loadStoredUserTokens as Hn, listCommand$9 as Ht, show as I, fetchLatestToken as In, listWorkflowExecutions as It, getCommand$1 as J, writePlatformConfig as Jn, ensureConfigId as Jt, listCommand$3 as K, resolveUserTokenKey as Kn, formatKeyValueTable as Kt, showCommand as L, hasAnyUserTokenEntry as Ln, functionExecutionStatusToString as Lt, generateMigrationScript as M, apiCall as Mn, getCommand$5 as Mt, writeDbTypesFile as N, assertWritable as Nn, getWorkflow as Nt, truncate as O, sdkNameLabelKey as On, listExecutorJobs as Ot, getConfiguredEditorCommand as P, loadConfig as Pn, executionsCommand as Pt, listCommand$4 as Q, confirmationArgs as Qn, MIGRATION_LABEL_KEY as Qt, extractOwnedNamespaces as R, hasUserTokenEntry as Rn, getCommand$6 as Rt, waitCommand as S, parseMigrationNumberArg as Sn, triggerExecutor as St, resumeWorkflow as T, hasChanges as Tn, getExecutorJob as Tt, updateOrganization as U, loadWorkspaceId as Un, listWorkspaces as Ut, removeCommand$1 as V, loadMachineUserName as Vn, deployFromCLI as Vt, organizationTree as W, platformConfigFromProfile as Wn, createCommand$1 as Wt, updateCommand$2 as X, commonArgs as Xn, waitForExecution as Xt, getOrganization as Y, defineAppCommand as Yn, executeScript as Yt, updateFolder as Z, configArg as Zn, bundleMigrationScript as Zt, deleteWorkspace as _, getNextMigrationNumber as _n, getCommand$4 as _t, updateUser as a, DIFF_FILE_NAME as an, toPageDirection as ar, createFolder as at, getAppHealth as b, reconstructSnapshotFromMigrations as bn, webhookCommand as bt, listCommand as c, SCHEMA_FILE_NAME as cn, getCommand$3 as ct, inviteUser as d, compareSnapshots as dn, tokenCommand as dt, parseMigrationLabelNumber as en, isVerbose as er, getCommand$2 as et, restoreCommand as f, createSnapshotFromLocalTypes as fn, listCommand$6 as ft, deleteCommand as g, getMigrationFiles as gn, listFunctionRegistries as gt, getWorkspace as h, getMigrationFilePath as hn, listCommand$7 as ht, updateCommand as i, DB_TYPES_FILE_NAME as in, resolveMachineUserInputSource as ir, createCommand as it, generateCommand as j, prompt as jn, startWorkflow as jt, truncateCommand as k, PluginManager as kn, watchExecutorJob as kt, listUsers as l, assertValidMigrationFiles as ln, getOAuth2Client as lt, getCommand as m, getMigrationDirPath as mn, generate$1 as mt, query as n, generateAllTypeManifestsFromSnapshot as nn, pagedLogArgs as nr, deleteCommand$1 as nt, removeCommand as o, INITIAL_SCHEMA_NUMBER as on, workspaceArgs as or, listCommand$5 as ot, restoreWorkspace as p, getLatestMigrationNumber as pn, listMachineUsers as pt, listOrganizations as q, saveUserTokens as qn, workspaceNameSchema as qt, queryCommand as r, protoGqlPermission as rn, paginationArgs as rr, deleteFolder as rt, removeUser as s, MIGRATE_FILE_NAME as sn, listOAuth2Clients as st, registerTypeScriptRuntime as t, compareSnapshotWithRemote as tn, multiConfigArg as tr, getFolder as tt, inviteCommand as u, compareLocalTypesWithSnapshot as un, getMachineUserToken as ut, listApps as v, isValidMigrationNumber as vn, getFunctionRegistry as vt, resumeCommand as w, formatMigrationDiff as wn, listExecutors as wt, healthCommand as x, formatMigrationNumber as xn, triggerCommand as xt, listCommand$1 as y, loadDiff as yn, listWebhookExecutors as yt, logBetaWarning as z, loadAccessToken as zn, getExecutor as zt };
-//# sourceMappingURL=register-typescript-runtime-BCvWR3HC.mjs.map
+export { listFolders as $, writePlatformConfig as $n, logRemoteDriftGuidance as $t, generate as A, hasChanges as An, startCommand as At, remove as B, deleteUserTokens as Bn, deploy as Bt, waitWorkflowExecution as C, isValidMigrationNumber as Cn, listCommand$8 as Ct, listWorkflows as D, parseMigrationNumberArg as Dn, jobsCommand as Dt, listCommand$2 as E, formatMigrationNumber as En, getExecutorWaitFailureMessage as Et, openInConfiguredEditor as F, generateUserTypes as Fn, getWorkflowExecution as Ft, treeCommand as G, loadConsoleBaseUrl as Gn, createWorkspace$1 as Gt, updateCommand$1 as H, hasAnyUserTokenEntry as Hn, listCommand$9 as Ht, show as I, prompt as In, listWorkflowExecutions as It, getCommand$1 as J, loadWorkspaceId as Jn, ensureConfigId as Jt, listCommand$3 as K, loadMachineUserName as Kn, formatKeyValueTable as Kt, showCommand as L, apiCall as Ln, functionExecutionStatusToString as Lt, generateMigrationScript as M, resourceTrn as Mn, getCommand$5 as Mt, writeDbTypesFile as N, sdkNameLabelKey as Nn, getWorkflow as Nt, truncate as O, formatDiffSummary as On, listExecutorJobs as Ot, getConfiguredEditorCommand as P, PluginManager as Pn, executionsCommand as Pt, listCommand$4 as Q, saveUserTokens as Qn, checkMigrationDiffs as Qt, extractOwnedNamespaces as R, assertWritable as Rn, getCommand$6 as Rt, waitCommand as S, getNextMigrationNumber as Sn, triggerExecutor as St, resumeWorkflow as T, reconstructSnapshotFromMigrations as Tn, getExecutorJob as Tt, updateOrganization as U, hasUserTokenEntry as Un, listWorkspaces as Ut, removeCommand$1 as V, fetchLatestToken as Vn, deployFromCLI as Vt, organizationTree as W, loadAccessToken as Wn, createCommand$1 as Wt, updateCommand$2 as X, readPlatformConfig as Xn, waitForExecution as Xt, getOrganization as Y, platformConfigFromProfile as Yn, executeScript as Yt, updateFolder as Z, resolveUserTokenKey as Zn, bundleMigrationScript as Zt, deleteWorkspace as _, formatSchemaDrifts as _n, getCommand$4 as _t, updateUser as a, compareSnapshotWithRemote as an, isVerbose as ar, createFolder as at, getAppHealth as b, getMigrationFilePath as bn, webhookCommand as bt, listCommand as c, DB_TYPES_FILE_NAME as cn, paginationArgs as cr, getCommand$3 as ct, inviteUser as d, MIGRATE_FILE_NAME as dn, workspaceArgs as dr, tokenCommand as dt, toTailorDBDeployInput as en, defineAppCommand as er, getCommand$2 as et, restoreCommand as f, SCHEMA_FILE_NAME as fn, listCommand$6 as ft, deleteCommand as g, createSnapshotFromLocalTypes as gn, listFunctionRegistries as gt, getWorkspace as h, compareSnapshots as hn, listCommand$7 as ht, updateCommand as i, parseMigrationLabelNumber as in, deploymentArgs as ir, createCommand as it, generateCommand as j, getNamespacesWithMigrations as jn, startWorkflow as jt, truncateCommand as k, formatMigrationDiff as kn, watchExecutorJob as kt, listUsers as l, DIFF_FILE_NAME as ln, resolveMachineUserInputSource as lr, getOAuth2Client as lt, getCommand as m, compareLocalTypesWithSnapshot as mn, generate$1 as mt, query as n, MIGRATION_LABEL_KEY as nn, configArg as nr, deleteCommand$1 as nt, removeCommand as o, generateAllTypeManifestsFromSnapshot as on, multiConfigArg as or, listCommand$5 as ot, restoreWorkspace as p, assertValidMigrationFiles as pn, listMachineUsers as pt, listOrganizations as q, loadStoredUserTokens as qn, workspaceNameSchema as qt, queryCommand as r, handleOptionalToRequiredError as rn, confirmationArgs as rr, deleteFolder as rt, removeUser as s, protoGqlPermission as sn, pagedLogArgs as sr, listOAuth2Clients as st, registerTypeScriptRuntime as t, verifyRemoteSchema as tn, commonArgs as tr, getFolder as tt, inviteCommand as u, INITIAL_SCHEMA_NUMBER as un, toPageDirection as ur, getMachineUserToken as ut, listApps as v, getLatestMigrationNumber as vn, getFunctionRegistry as vt, resumeCommand as w, loadDiff as wn, listExecutors as wt, healthCommand as x, getMigrationFiles as xn, triggerCommand as xt, listCommand$1 as y, getMigrationDirPath as yn, listWebhookExecutors as yt, logBetaWarning as z, loadConfig as zn, getExecutor as zt };
+//# sourceMappingURL=register-typescript-runtime-nG-n9lPw.mjs.map