@tailor-platform/sdk 2.0.0-next.10 → 2.0.0-next.11

package/dist/cli/main.mjs

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { r as parseInputFields } from "../schema--xYWRGfe.mjs";
-import { At as PATScope, Ct as AuthInvokerSchema, E as CustomDomainStatus, W as FunctionExecution_Type } from "../workspace_resource_pb-UGK1SSn_.mjs";
+import { At as PATScope, Ct as AuthInvokerSchema, E as CustomDomainStatus, W as FunctionExecution_Type } from "../workspace_resource_pb-DXnO2AT-.mjs";
 import { t as assertDefined } from "../assert-DBxo8jPo.mjs";
 import { n as logger, r as styles } from "../logger-CXQq9YIp.mjs";
-import { $n as removeLegacyUserAlias, $t as ensureConfigId, An as hasChanges, Bn as deleteUserTokens, C as healthCommand, Cn as isValidMigrationNumber, Dn as parseMigrationNumberArg, E as resumeCommand, En as formatMigrationNumber, Et as triggerCommand, F as writeDbTypesFile, Ft as startCommand, G as removeCommand$1, Gn as loadConfigPath, H as extractOwnedNamespaces, Hn as hasAnyUserTokenEntry, Ht as functionExecutionStatusToString, I as getConfiguredEditorCommand, In as prompt, Jn as loadPlatformClientConfig, K as updateCommand$3, Kn as loadConsoleBaseUrl, Kt as deployFromCLI, L as openInConfiguredEditor, Ln as apiCall, Lt as getCommand$6, Mn as resourceTrn, Mt as jobsCommand, N as generateCommand$1, Nn as sdkNameLabelKey, O as listCommand$14, Ot as listCommand$8, P as generateMigrationScript, Pn as PluginManager, Q as getCommand$5, Qn as readPlatformConfig, Qt as workspaceNameSchema, R as deployCommand$1, Rn as assertWritable, St as getCommand$2, Tn as reconstructSnapshotFromMigrations, Tt as webhookCommand, U as logBetaWarning, Un as hasUserTokenEntry, Ut as getCommand$1, V as showCommand, Vn as fetchLatestToken, Wn as loadAccessToken, X as listCommand$13, Xn as loadWorkspaceId, Y as treeCommand, Yn as loadStoredUserTokens, Yt as createCommand$4, Zn as platformConfigFromProfile, Zt as formatKeyValueTable, _n as createSnapshotFromLocalTypes, a as queryCommand, an as parseMigrationLabelNumber, ar as commonArgs, bn as getMigrationFilePath, bt as listCommand$9, c as removeCommand, cn as protoGqlPermission, cr as deploymentArgs, ct as createCommand$3, dn as INITIAL_SCHEMA_NUMBER, dr as pagedLogArgs, en as executeScript, er as resolveConfigUser, et as updateCommand$2, f as inviteCommand, fr as paginationArgs, ft as getCommand$3, g as getCommand$7, gt as listCommand$10, hn as compareLocalTypesWithSnapshot, hr as workspaceArgs, ht as tokenCommand$1, in as handleOptionalToRequiredError, ir as defineAppCommand, it as getCommand$4, j as truncateCommand, jn as getNamespacesWithMigrations, kn as formatMigrationDiff, lr as isVerbose, m as restoreCommand, mn as assertValidMigrationFiles, mr as toPageDirection, nr as saveUserTokens, nt as listCommand$12, o as updateCommand$4, on as compareSnapshotWithRemote, or as configArg, ot as deleteCommand$4, pr as resolveMachineUserInputSource, qn as loadMachineUserName, qt as listCommand$17, r as serializeError, rn as MIGRATION_LABEL_KEY, rr as writePlatformConfig, sn as generateAllTypeManifestsFromSnapshot, sr as confirmationArgs, t as registerTsHook, tr as resolveUserTokenKey, u as listCommand$16, ur as multiConfigArg, ut as listCommand$11, v as deleteCommand$5, vn as getLatestMigrationNumber, vt as generate, w as waitCommand, wn as loadDiff, x as listCommand$15, xn as getMigrationFiles, zn as loadConfig, zt as executionsCommand } from "../register-ts-hook-BAHMwxfG.mjs";
-import { A as defaultPlatformBaseUrl, B as getPlatformBaseUrl, E as getDistDir, F as fetchPlatformMachineUserToken, H as initOperatorClient, I as fetchUserInfo, M as fetchAllTolerant, P as fetchPaged, R as getOAuth2ClientId, S as resolveBundleLogLevel, U as isDefaultPlatform, V as initOAuth2Client, a as resolveInlineSourcemap, b as composeFunctionTreeshakeOptions, c as WorkflowJobSchema, d as INVOKER_EXPR, j as fetchAll, k as closeConnectionPool, l as ResolverSchema, m as buildResolverPermissionAndInputCheckExpr, v as resolveTSConfigWithFallback, x as createLogLevelTreeshakeOptions, y as platformBundleDefinePlugin, z as getOrNull } from "../application-miwiXtB4.mjs";
-import { i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-BNtPsK9Q.mjs";
+import { $n as hasUserTokenEntry, $t as ensureConfigId, An as loadDiff, Bn as sdkAppIdLabelKey, C as healthCommand, Cn as createSnapshotFromLocalTypes, Cr as resolveMachineUserInputSource, Dn as getMigrationFilePath, E as resumeCommand, Et as triggerCommand, F as writeDbTypesFile, Fn as formatMigrationDiff, Ft as startCommand, G as removeCommand$1, H as extractOwnedNamespaces, Hn as sdkVersionLabelKey, Ht as functionExecutionStatusToString, I as getConfiguredEditorCommand, In as hasChanges, Jn as assertWritable, K as updateCommand$3, Kn as prompt, Kt as deployFromCLI, L as openInConfiguredEditor, Ln as getNamespacesWithMigrations, Lt as getCommand$6, Mn as formatMigrationNumber, Mt as jobsCommand, N as generateCommand$1, Nn as parseMigrationNumberArg, O as listCommand$14, On as getMigrationFiles, Ot as listCommand$8, P as generateMigrationScript, Pn as formatDiffSummary, Q as getCommand$5, Qn as hasAnyUserTokenEntry, Qt as workspaceNameSchema, R as deployCommand$1, Rn as selectTargetNamespace, Sr as paginationArgs, St as getCommand$2, Tr as workspaceArgs, Tt as webhookCommand, U as logBetaWarning, Un as writeMetadataLabels, Ut as getCommand$1, V as showCommand, Vn as sdkNameLabelKey, Wn as PluginManager, X as listCommand$13, Xn as deleteUserTokens, Y as treeCommand, Yn as loadConfig, Yt as createCommand$4, Zn as fetchLatestToken, Zt as formatKeyValueTable, _r as confirmationArgs, a as queryCommand, an as toTailorDBDeployInput, ar as loadStoredUserTokens, bn as assertValidMigrationFiles, br as multiConfigArg, bt as listCommand$9, c as removeCommand, cn as handleOptionalToRequiredError, cr as readPlatformConfig, ct as createCommand$3, dn as compareSnapshotWithRemote, dr as resolveUserTokenKey, en as executeScript, er as loadAccessToken, et as updateCommand$2, f as inviteCommand, fn as generateAllTypeManifestsFromSnapshot, fr as saveUserTokens, ft as getCommand$3, g as getCommand$7, gn as INITIAL_SCHEMA_NUMBER, gr as configArg, gt as listCommand$10, hr as commonArgs, ht as tokenCommand$1, in as logRemoteDriftGuidance, ir as loadPlatformClientConfig, it as getCommand$4, j as truncateCommand, jn as reconstructSnapshotFromMigrations, ln as parseMigrationLabelNumber, lr as removeLegacyUserAlias, m as restoreCommand, mr as defineAppCommand, nr as loadConsoleBaseUrl, nt as listCommand$12, o as updateCommand$4, on as verifyRemoteSchema, or as loadWorkspaceId, ot as deleteCommand$4, pn as protoGqlPermission, pr as writePlatformConfig, qn as apiCall, qt as listCommand$17, r as serializeError, rn as checkMigrationDiffs, rr as loadMachineUserName, sn as MIGRATION_LABEL_KEY, sr as platformConfigFromProfile, t as registerTsHook, tr as loadConfigPath, u as listCommand$16, un as sanitizeMigrationLabel, ur as resolveConfigUser, ut as listCommand$11, v as deleteCommand$5, vr as deploymentArgs, vt as generate, w as waitCommand, wn as formatSchemaDrifts, wr as toPageDirection, x as listCommand$15, xn as compareLocalTypesWithSnapshot, xr as pagedLogArgs, yn as assertMigrationNumberExists, yr as isVerbose, zn as resourceTrn, zt as executionsCommand } from "../register-ts-hook-LYV7zH-e.mjs";
+import { C as createLogLevelTreeshakeOptions, F as fetchAllTolerant, G as initOperatorClient, H as getOrNull, K as isDefaultPlatform, L as fetchPaged, M as closeConnectionPool, N as defaultPlatformBaseUrl, P as fetchAll, R as fetchPlatformMachineUserToken, S as composeFunctionTreeshakeOptions, T as createBundleLog, U as getPlatformBaseUrl, V as getOAuth2ClientId, W as initOAuth2Client, a as resolveInlineSourcemap, b as resolveTSConfigWithFallback, c as WorkflowJobSchema, d as INVOKER_EXPR, h as assertUniqueLocalTailorDBTypeNames, k as getDistDir, l as ResolverSchema, m as buildResolverPermissionAndInputCheckExpr, v as createGeneratedEntryResolverPlugin, w as resolveBundleLogLevel, x as platformBundleDefinePlugin, y as createTsconfigPathsPlugin, z as fetchUserInfo } from "../application-CM6hKnSK.mjs";
+import { i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-k1xy_A5G.mjs";
 import { t as multiline } from "../multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "../package-json-8b0O9TlX.mjs";
 import { t as userAgent } from "../user-agent-Bgsszb5I.mjs";
 import { n as isCLIError, t as createCLIError } from "../errors-D7583Zz7.mjs";
-import { t as OperatorService } from "../service_pb-BwZRiNug.mjs";
+import { t as OperatorService } from "../service_pb-D5--My_M.mjs";
 import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-B5LqCTfF.mjs";
 import * as path from "pathe";
 import { dirname, resolve } from "pathe";
@@ -1697,22 +1697,29 @@ async function bundleForTestRun(options) {
 	const entryContent = generateEntry(detected, sourceFile, env, machineUser, workspaceId);
 	fs.writeFileSync(entryPath, entryContent);
 	const tsconfig = await resolveTSConfigWithFallback(baseDir);
+	const bundleLog = createBundleLog({ tsconfig });
+	const buildResult = await rolldown.build({
+		plugins: [
+			createGeneratedEntryResolverPlugin(entryPath, baseDir),
+			createTsconfigPathsPlugin(),
+			platformBundleDefinePlugin
+		],
+		input: entryPath,
+		write: false,
+		output: {
+			format: "esm",
+			sourcemap: inlineSourcemap ? "inline" : true,
+			minify: inlineSourcemap ? { mangle: { keepNames: true } } : true,
+			codeSplitting: false,
+			dir: process.cwd()
+		},
+		tsconfig,
+		treeshake: composeFunctionTreeshakeOptions([createLogLevelTreeshakeOptions(bundleLogLevel)]),
+		...bundleLog.options
+	});
+	bundleLog.assertAllResolved();
 	return {
-		bundledCode: (await rolldown.build({
-			plugins: [platformBundleDefinePlugin],
-			input: entryPath,
-			write: false,
-			output: {
-				format: "esm",
-				sourcemap: inlineSourcemap ? "inline" : true,
-				minify: inlineSourcemap ? { mangle: { keepNames: true } } : true,
-				codeSplitting: false,
-				dir: process.cwd()
-			},
-			tsconfig,
-			treeshake: composeFunctionTreeshakeOptions([createLogLevelTreeshakeOptions(bundleLogLevel)]),
-			logLevel: "silent"
-		})).output[0].code,
+		bundledCode: buildResult.output[0].code,
 		scriptName
 	};
 }
@@ -3378,17 +3385,26 @@ async function checkVaultManaged(params) {
 /**
 * Release ownership of a managed vault by removing SDK labels from metadata.
 * Call this after the user has confirmed they want to proceed with a CLI operation on a managed vault.
-* @param params - Client, TRN, and existing labels from checkVaultManaged result
+* The labels are read again at write time, so the caller does not pass the ones
+* `checkVaultManaged` saw: anything written since then is kept, and only the
+* ownership labels are removed.
+*
+* That includes the app id, which decides ownership on its own: leaving it
+* behind would keep the vault SDK-owned, and the next deploy of a config that
+* no longer declares it would delete the vault and every secret in it.
+* @param params - Client and TRN from the checkVaultManaged result
 * @param params.client - Operator client used to update vault metadata
 * @param params.trn - TRN of the vault resource
-* @param params.existingLabels - Existing metadata labels on the vault before release
 */
 async function releaseVaultOwnership(params) {
-	const { client, trn, existingLabels } = params;
-	const { [sdkNameLabelKey]: _, "sdk-version": __, ...remainingLabels } = existingLabels;
-	await client.setMetadata({
+	const { client, trn } = params;
+	await writeMetadataLabels(client, {
 		trn,
-		labels: remainingLabels
+		remove: [
+			sdkNameLabelKey,
+			sdkVersionLabelKey,
+			sdkAppIdLabelKey
+		]
 	});
 	logger.info("Config ownership has been removed from this vault. Remove it from defineSecretManager() in your config to prevent the next apply from re-claiming it.");
 }
@@ -5533,6 +5549,27 @@ const scriptCommand = defineAppCommand({
 	}
 });
 
+//#endregion
+//#region src/cli/commands/tailordb/migrate/remote-state.ts
+/**
+* Fetch the namespace's current migration number from its metadata labels.
+*
+* Only a namespace that has not been deployed yet reads as "no current
+* migration". Every other lookup failure must propagate: treating it as
+* unset would misreport a transient error as "no checkpoint", showing
+* every migration as pending to callers.
+* @param client - Operator client
+* @param trn - Namespace TRN
+* @returns Parsed current migration number, or null when unset or unparseable
+*/
+async function fetchRemoteMigrationNumber(client, trn) {
+	const label = (await getOrNull(async () => {
+		const { metadata } = await client.getMetadata({ trn });
+		return metadata;
+	}))?.labels[MIGRATION_LABEL_KEY];
+	return label ? parseMigrationLabelNumber(label) : null;
+}
+
 //#endregion
 //#region src/cli/commands/tailordb/migrate/set.ts
 /**
@@ -5541,41 +5578,23 @@ const scriptCommand = defineAppCommand({
 */
 async function set(options) {
 	logBetaWarning("tailordb migration");
-	const numberStr = options.number;
-	let migrationNumber;
-	if (isValidMigrationNumber(numberStr)) migrationNumber = parseInt(numberStr, 10);
-	else {
-		migrationNumber = parseInt(numberStr, 10);
-		if (isNaN(migrationNumber) || migrationNumber < 0) throw new Error(`Invalid migration number format: ${numberStr}. Expected 4-digit format (e.g., 0001) or integer (e.g., 1).`);
-	}
+	const migrationNumber = parseMigrationNumberArg(options.number);
 	const { config } = await loadConfig(options.configPath);
-	const namespacesWithMigrations = getNamespacesWithMigrations(config, path.dirname(config.path));
-	if (namespacesWithMigrations.length === 0) throw new Error("No TailorDB services with migrations configuration found");
-	let targetNamespace;
-	if (options.namespace) {
-		if (!namespacesWithMigrations.some((ns) => ns.namespace === options.namespace)) throw new Error(`Namespace "${options.namespace}" not found or does not have migrations configured`);
-		targetNamespace = options.namespace;
-	} else if (namespacesWithMigrations.length === 1) {
-		const [ns] = namespacesWithMigrations;
-		targetNamespace = assertDefined(ns, "namespace with migrations missing").namespace;
-	} else throw new Error(`Multiple TailorDB services found. Please specify namespace with --namespace flag: ${namespacesWithMigrations.map((ns) => ns.namespace).join(", ")}`);
+	const target = selectTargetNamespace(getNamespacesWithMigrations(config, path.dirname(config.path)), options.namespace);
+	const targetNamespace = target.namespace;
+	assertValidMigrationFiles(target.migrationsDir, targetNamespace);
+	assertMigrationNumberExists(target.migrationsDir, migrationNumber);
 	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
 	const trn = resourceTrn(await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
 	}), "tailordb", targetNamespace);
-	let currentMigration;
-	try {
-		const { metadata } = await client.getMetadata({ trn });
-		const label = metadata?.labels["sdk-migration"];
-		currentMigration = label ? parseMigrationLabelNumber(label) ?? 0 : 0;
-	} catch {
-		currentMigration = 0;
-	}
+	const current = await fetchRemoteMigrationNumber(client, trn);
+	const currentMigration = current ?? 0;
 	logger.newline();
 	logger.warn("This operation will change the migration checkpoint.");
 	logger.log(`Namespace: ${styles.bold(targetNamespace)}`);
-	logger.log(`Current migration: ${styles.bold(formatMigrationNumber(currentMigration))}`);
+	logger.log(`Current migration: ${current === null ? "<unset>" : styles.bold(formatMigrationNumber(current))}`);
 	logger.log(`New migration: ${styles.bold(formatMigrationNumber(migrationNumber))}`);
 	logger.newline();
 	if (migrationNumber < currentMigration) {
@@ -5595,20 +5614,18 @@ async function set(options) {
 		}
 		logger.newline();
 	}
-	const { metadata } = await client.getMetadata({ trn });
-	const existingLabels = metadata?.labels ?? {};
-	await client.setMetadata({
+	await writeMetadataLabels(client, {
 		trn,
-		labels: {
-			...existingLabels,
-			"sdk-migration": `m${formatMigrationNumber(migrationNumber)}`
-		}
+		labels: { [MIGRATION_LABEL_KEY]: sanitizeMigrationLabel(migrationNumber) }
 	});
 	logger.success(`Migration checkpoint set to ${styles.bold(formatMigrationNumber(migrationNumber))} for namespace ${styles.bold(targetNamespace)}`);
 }
 const setCommand = defineAppCommand({
 	name: "set",
 	description: "Set migration checkpoint to a specific number.",
+	notes: `The migration number must be a 4-digit value (e.g. \`0001\`) or a bare integer (e.g. \`1\`) within 0–9999, and must exist in the local migration history; \`0\` is always accepted as the baseline, provided the local history passes validation. A gapped history is rejected.
+
+Metadata lookup failures (authentication, permission, or network errors) are reported as errors; only a not-yet-deployed namespace is treated as having no checkpoint.`,
 	args: z.strictObject({
 		...deploymentArgs,
 		...confirmationArgs,
@@ -5636,6 +5653,9 @@ const setCommand = defineAppCommand({
 
 //#endregion
 //#region src/cli/commands/tailordb/migrate/status.ts
+function isStatusFailure(row) {
+	return row.status === "error";
+}
 async function collectMigrationStatuses(options) {
 	const { config } = await loadConfig(options.configPath);
 	const namespacesWithMigrations = getNamespacesWithMigrations(config, path.dirname(config.path));
@@ -5647,17 +5667,21 @@ async function collectMigrationStatuses(options) {
 		workspaceId: options.workspaceId,
 		profile: options.profile
 	});
-	const statuses = [];
+	const rows = [];
 	for (const { namespace, migrationsDir } of targetNamespaces) {
 		const trn = resourceTrn(workspaceId, "tailordb", namespace);
-		let currentMigration;
+		let current;
 		try {
-			const { metadata } = await client.getMetadata({ trn });
-			const label = metadata?.labels["sdk-migration"];
-			currentMigration = label ? parseMigrationLabelNumber(label) ?? 0 : 0;
-		} catch {
-			currentMigration = 0;
+			current = await fetchRemoteMigrationNumber(client, trn);
+		} catch (error) {
+			rows.push({
+				status: "error",
+				namespace,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			continue;
 		}
+		const currentMigration = current ?? 0;
 		const pendingMigrations = getMigrationFiles(migrationsDir).map((f) => f.number).filter((n, i, arr) => arr.indexOf(n) === i).toSorted((a, b) => a - b).filter((n) => n > currentMigration).map((num) => {
 			const diffPath = getMigrationFilePath(migrationsDir, num, "diff");
 			let description;
@@ -5670,23 +5694,28 @@ async function collectMigrationStatuses(options) {
 				...description ? { description } : {}
 			};
 		});
-		statuses.push({
+		rows.push({
+			status: "ok",
 			namespace,
 			currentMigration,
 			currentMigrationLabel: formatMigrationNumber(currentMigration),
 			pendingMigrations
 		});
 	}
-	return statuses;
+	return rows;
 }
-function printMigrationStatuses(statuses) {
-	for (const statusInfo of statuses) {
+function printMigrationStatuses(rows) {
+	for (const row of rows) {
 		logger.newline();
-		logger.info(`Namespace: ${styles.bold(statusInfo.namespace)}`);
-		logger.log(`  Current migration: ${styles.bold(statusInfo.currentMigrationLabel)}`);
-		if (statusInfo.pendingMigrations.length > 0) {
+		logger.info(`Namespace: ${styles.bold(row.namespace)}`);
+		if (isStatusFailure(row)) {
+			logger.error(`  Failed to read migration state: ${row.error}`);
+			continue;
+		}
+		logger.log(`  Current migration: ${styles.bold(row.currentMigrationLabel)}`);
+		if (row.pendingMigrations.length > 0) {
 			logger.log("  Pending migrations:");
-			for (const pending of statusInfo.pendingMigrations) if (pending.description) logger.log(`    - ${pending.label}: ${pending.description}`);
+			for (const pending of row.pendingMigrations) if (pending.description) logger.log(`    - ${pending.label}: ${pending.description}`);
 			else logger.log(`    - ${pending.label}`);
 		} else logger.log("  Pending migrations: (none)");
 	}
@@ -5698,16 +5727,19 @@ function printMigrationStatuses(statuses) {
 */
 async function status(options) {
 	logBetaWarning("tailordb migration");
-	const statuses = await collectMigrationStatuses(options);
-	if (options.json) {
-		logger.out(statuses);
-		return;
+	const rows = await collectMigrationStatuses(options);
+	if (options.json) logger.out(rows);
+	else printMigrationStatuses(rows);
+	const failures = rows.filter(isStatusFailure);
+	if (failures.length > 0) {
+		const namespaces = failures.map((f) => f.namespace).join(", ");
+		throw new Error(`Failed to read migration state for ${failures.length} namespace${failures.length === 1 ? "" : "s"}: ${namespaces}`);
 	}
-	printMigrationStatuses(statuses);
 }
 const statusCommand = defineAppCommand({
 	name: "status",
 	description: "Show the current migration status for TailorDB namespaces, including applied and pending migrations.",
+	notes: "Metadata lookup failures (authentication, permission, or network errors) are reported per namespace and make the command exit non-zero; only a not-yet-deployed namespace is treated as having no applied migrations.",
 	args: z.strictObject({
 		...deploymentArgs,
 		namespace: arg(z.string().optional(), {
@@ -5776,7 +5808,7 @@ async function fetchRemoteTypes(client, workspaceId, namespace) {
 async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	const { config, plugins } = loaded;
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-DArFTTJ9.mjs");
+	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-CXNaUNhv.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -5788,7 +5820,7 @@ async function assertMigrationsReproduceLocalTypes(loaded, target) {
 		await service.processNamespacePlugins();
 	}
 	const pluginExecutorFiles = generatePluginFilesIfNeeded(pluginManager, application.tailorDBServices, config.path);
-	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-D5jn05ZI.mjs")).createExecutorService({
+	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-M7OYziQP.mjs")).createExecutorService({
 		config: { files: [] },
 		baseDir: path.dirname(config.path)
 	}) : void 0);
@@ -5814,39 +5846,6 @@ async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	throw new Error("Refusing to sync: the migration history must reproduce the current local schema before it can be applied to the remote.");
 }
 /**
-* Fetch the namespace's metadata labels and current migration number.
-*
-* Only GetMetadata NotFound is treated as "metadata does not exist yet".
-* Any other failure aborts the sync (which has not mutated anything at this
-* point): the fetched labels are written back verbatim at the end, so
-* proceeding with empty labels after a transient error would wipe the
-* namespace's existing metadata.
-* @param client - Operator client
-* @param trn - Namespace TRN
-* @returns Existing labels and the parsed current migration number
-*/
-async function fetchRemoteMigrationState(client, trn) {
-	const labels = (await getOrNull(async () => {
-		const { metadata } = await client.getMetadata({ trn });
-		return metadata;
-	}))?.labels ?? {};
-	const label = labels[MIGRATION_LABEL_KEY];
-	return {
-		labels,
-		current: label ? parseMigrationLabelNumber(label) : null
-	};
-}
-function selectTargetNamespace(namespacesWithMigrations, requested) {
-	if (namespacesWithMigrations.length === 0) throw new Error("No TailorDB services with migrations configuration found");
-	if (requested) {
-		const found = namespacesWithMigrations.find((ns) => ns.namespace === requested);
-		if (!found) throw new Error(`Namespace "${requested}" not found or does not have migrations configured`);
-		return found;
-	}
-	if (namespacesWithMigrations.length > 1) throw new Error(`Multiple TailorDB services found. Please specify namespace with --namespace flag: ${namespacesWithMigrations.map((ns) => ns.namespace).join(", ")}`);
-	return assertDefined(namespacesWithMigrations[0], "namespace with migrations missing");
-}
-/**
 * Sync remote TailorDB schema to a specific migration snapshot.
 *
 * Reconstructs the schema state at `<number>` from `0000/schema.json` + diffs,
@@ -5868,8 +5867,7 @@ async function sync(options) {
 	const { config } = loaded;
 	const target = selectTargetNamespace(getNamespacesWithMigrations(config, path.dirname(config.path)), options.namespace);
 	assertValidMigrationFiles(target.migrationsDir, target.namespace);
-	const latest = getLatestMigrationNumber(target.migrationsDir);
-	if (targetVersion > latest) throw new Error(`Migration ${formatMigrationNumber(targetVersion)} does not exist in working tree (latest is ${formatMigrationNumber(latest)}).`);
+	const latest = assertMigrationNumberExists(target.migrationsDir, targetVersion);
 	const snapshot = reconstructSnapshotFromMigrations(target.migrationsDir, targetVersion);
 	if (!snapshot) throw new Error(`No initial schema snapshot found in ${target.migrationsDir}. Expected 0000/schema.json.`);
 	const manifestOptions = await assertMigrationsReproduceLocalTypes(loaded, target);
@@ -5879,7 +5877,7 @@ async function sync(options) {
 		profile: options.profile
 	});
 	const trn = resourceTrn(workspaceId, "tailordb", target.namespace);
-	const remoteState = await fetchRemoteMigrationState(client, trn);
+	const current = await fetchRemoteMigrationNumber(client, trn);
 	const remoteTypes = await fetchRemoteTypes(client, workspaceId, target.namespace);
 	const { creates, updates, deletes } = compareSnapshotWithRemote(snapshot, new Set(remoteTypes.map((t) => t.name)));
 	const remoteGqlPermissions = await fetchRemoteGqlPermissions(client, workspaceId, target.namespace);
@@ -5890,7 +5888,6 @@ async function sync(options) {
 	}] : []);
 	const desiredGqlPermissionTypes = new Set(desiredGqlPermissions.map((p) => p.typeName));
 	const gqlPermissionDeletes = remoteGqlPermissions.filter((p) => !desiredGqlPermissionTypes.has(p.typeName));
-	const current = remoteState.current;
 	logger.newline();
 	logger.info(`Namespace: ${styles.bold(target.namespace)}`);
 	logger.log(`  Current migration: ${current === null ? "<unset>" : styles.bold(formatMigrationNumber(current))}`);
@@ -5966,12 +5963,9 @@ async function sync(options) {
 		namespaceName: target.namespace,
 		tailordbTypeName: typeName
 	})));
-	await client.setMetadata({
+	await writeMetadataLabels(client, {
 		trn,
-		labels: {
-			...remoteState.labels,
-			[MIGRATION_LABEL_KEY]: `${"m"}${formatMigrationNumber(targetVersion)}`
-		}
+		labels: { [MIGRATION_LABEL_KEY]: sanitizeMigrationLabel(targetVersion) }
 	});
 	logger.success(`Synced namespace ${styles.bold(target.namespace)} to migration ${styles.bold(formatMigrationNumber(targetVersion))}.`);
 	if (targetVersion < latest) {
@@ -6007,6 +6001,204 @@ const syncCommand = defineAppCommand({
 	}
 });
 
+//#endregion
+//#region src/cli/commands/tailordb/migrate/validate.ts
+/**
+* Assert that every migration in the local history whose diff requires a data
+* migration script has a migrate.ts on disk or an explicit skip acknowledgment
+* @param {string} migrationsDir - Migrations directory path
+* @param {string} namespace - TailorDB namespace (for error messages)
+*/
+function assertRequiredMigrationScripts(migrationsDir, namespace) {
+	const missing = [];
+	for (const file of getMigrationFiles(migrationsDir)) {
+		if (file.type !== "diff") continue;
+		const diff = loadDiff(file.path);
+		if (!diff.requiresMigrationScript || diff.scriptSkipped) continue;
+		if (!fs.existsSync(getMigrationFilePath(migrationsDir, file.number, "migrate"))) missing.push(file.number);
+	}
+	if (missing.length > 0) throw new Error(`Migration(s) ${missing.map(formatMigrationNumber).join(", ")} in namespace "${namespace}" require a migration script but have no migrate.ts. Add one with 'tailor tailordb migration script <number>', or record that no script is needed with 'tailor tailordb migration script <number> --no-script --reason "..."'.`);
+}
+/**
+* Build per-namespace reports from the checks that completed
+* @param {BuildValidationReportsOptions} options - Completed validation results
+* @returns {NamespaceValidationReport[]} Validation reports per namespace
+*/
+function buildValidationReports(options) {
+	const { targetNamespaces, migrationFileErrors, localResults, remoteResults } = options;
+	return targetNamespaces.map((target) => {
+		const fileError = migrationFileErrors.get(target.namespace);
+		if (fileError !== void 0) return {
+			namespace: target.namespace,
+			valid: false,
+			migrationFiles: {
+				valid: false,
+				error: fileError
+			}
+		};
+		const local = assertDefined(localResults.find((result) => result.namespace === target.namespace), `local schema check result missing for namespace "${target.namespace}"`);
+		const localSchema = {
+			hasDiff: local.hasDiff,
+			...local.diff ? { diff: local.diff } : {}
+		};
+		if (remoteResults === void 0) return {
+			namespace: target.namespace,
+			valid: false,
+			migrationFiles: { valid: true },
+			localSchema,
+			remoteSchema: { skipped: "check_failed" }
+		};
+		const remote = assertDefined(remoteResults.find((result) => result.namespace === target.namespace), `remote schema check result missing for namespace "${target.namespace}"`);
+		const checkpointMissingLocal = remote.checkpointMissingLocal === true;
+		const remoteSchema = {
+			remoteMigrationNumber: remote.remoteMigrationNumber,
+			hasDrift: remote.hasDrift,
+			drifts: remote.drifts,
+			...remote.skipped ? { skipped: remote.skipped } : {},
+			...checkpointMissingLocal ? { checkpointMissingLocal: true } : {}
+		};
+		return {
+			namespace: target.namespace,
+			valid: !localSchema.hasDiff && !remoteSchema.hasDrift && !checkpointMissingLocal,
+			migrationFiles: { valid: true },
+			localSchema,
+			remoteSchema
+		};
+	});
+}
+/**
+* Run all migration validation checks and collect per-namespace reports
+* @param {ValidateOptions} options - Command options
+* @returns {Promise<CollectedValidationReports>} Validation reports and any remote error
+*/
+async function collectValidationReports(options) {
+	const { config, plugins } = await loadConfig(options.configPath);
+	const namespacesWithMigrations = getNamespacesWithMigrations(config, path.dirname(config.path));
+	if (namespacesWithMigrations.length === 0) throw new Error("No TailorDB services with migrations configuration found");
+	const targetNamespaces = options.namespace ? namespacesWithMigrations.filter((ns) => ns.namespace === options.namespace) : namespacesWithMigrations;
+	if (targetNamespaces.length === 0) throw new Error(`Namespace "${options.namespace}" not found or does not have migrations configured`);
+	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
+	const { defineApplication } = await import("../application-CXNaUNhv.mjs");
+	const application = defineApplication({
+		config,
+		pluginManager
+	});
+	for (const service of application.tailorDBServices) {
+		await service.loadTypes();
+		await service.processNamespacePlugins();
+	}
+	assertUniqueLocalTailorDBTypeNames({ tailorDBServices: application.tailorDBServices });
+	for (const { namespace } of targetNamespaces) if (!application.tailorDBServices.some((s) => s.namespace === namespace)) throw new Error(`No TailorDB service found for namespace "${namespace}"`);
+	const tailorDBInputs = application.tailorDBServices.map(toTailorDBDeployInput);
+	const typesByNamespace = new Map(tailorDBInputs.map((input) => [input.namespace, input.types]));
+	const migrationFileErrors = /* @__PURE__ */ new Map();
+	const checkableNamespaces = [];
+	for (const target of targetNamespaces) try {
+		assertValidMigrationFiles(target.migrationsDir, target.namespace);
+		reconstructSnapshotFromMigrations(target.migrationsDir);
+		assertRequiredMigrationScripts(target.migrationsDir, target.namespace);
+		checkableNamespaces.push(target);
+	} catch (error) {
+		migrationFileErrors.set(target.namespace, error instanceof Error ? error.message : String(error));
+	}
+	const localReportOptions = {
+		targetNamespaces,
+		migrationFileErrors,
+		localResults: await checkMigrationDiffs(typesByNamespace, checkableNamespaces)
+	};
+	if (checkableNamespaces.length === 0) return { reports: buildValidationReports(localReportOptions) };
+	let remoteResults;
+	try {
+		remoteResults = await verifyRemoteSchema(await initOperatorClient(await loadAccessToken({ profile: options.profile })), await loadWorkspaceId({
+			workspaceId: options.workspaceId,
+			profile: options.profile
+		}), checkableNamespaces, config, tailorDBInputs);
+	} catch (remoteError) {
+		return {
+			reports: buildValidationReports(localReportOptions),
+			remoteError
+		};
+	}
+	return { reports: buildValidationReports({
+		...localReportOptions,
+		remoteResults
+	}) };
+}
+function printValidationReports(reports) {
+	for (const report of reports) {
+		logger.newline();
+		logger.info(`Namespace: ${styles.bold(report.namespace)}`);
+		if (!report.migrationFiles.valid) {
+			logger.log(`  Migration files: ${styles.error("invalid")}`);
+			logger.log(`    ${report.migrationFiles.error}`);
+			continue;
+		}
+		logger.log(`  Migration files: ${styles.success("OK")}`);
+		const local = report.localSchema;
+		if (local?.hasDiff) if (local.diff) {
+			logger.log(`  Local schema: ${styles.error("changes not in migration files")}`);
+			logger.log(`    ${formatDiffSummary(local.diff)}`);
+			logger.log(formatMigrationDiff(local.diff));
+		} else logger.log(`  Local schema: ${styles.error("no migration snapshot found")}`);
+		else logger.log(`  Local schema: ${styles.success("OK")}`);
+		const remote = report.remoteSchema;
+		if (remote?.skipped === "check_failed") logger.log(`  Remote schema: ${styles.error("not checked")}`);
+		else if (remote?.checkpointMissingLocal) logger.log(`  Remote schema: ${styles.error(`remote migration ${formatMigrationNumber(remote.remoteMigrationNumber)} is not in the local migration history`)}`);
+		else if (remote?.hasDrift) {
+			logger.log(`  Remote schema: ${styles.error("drift detected")} (remote migration: ${formatMigrationNumber(remote.remoteMigrationNumber)})`);
+			logger.log(formatSchemaDrifts(remote.drifts));
+		} else if (remote?.skipped === "not_deployed") logger.log(`  Remote schema: ${styles.dim("skipped (namespace not deployed)")}`);
+		else if (remote?.skipped === "no_migration_label") logger.log(`  Remote schema: ${styles.dim("skipped (deployed namespace has no migration state)")}`);
+		else if (remote?.skipped === "no_snapshot") logger.log(`  Remote schema: ${styles.dim(`skipped (no local snapshot for remote migration ${formatMigrationNumber(remote.remoteMigrationNumber)})`)}`);
+		else if (remote) logger.log(`  Remote schema: ${styles.success("OK")} (remote migration: ${formatMigrationNumber(remote.remoteMigrationNumber)})`);
+	}
+	logger.newline();
+}
+function printResolutionHints(reports) {
+	if (reports.some((r) => r.localSchema?.hasDiff && !r.localSchema.diff)) logger.info("Run 'tailor tailordb migration generate' to create the initial snapshot.");
+	if (reports.some((r) => r.localSchema?.diff)) logger.info("Run 'tailor tailordb migration generate' to create migration files.");
+	if (reports.some((r) => r.remoteSchema?.checkpointMissingLocal)) logger.info("The remote migration checkpoint is ahead of the local history. Pull the latest migration files, or run 'tailor tailordb migration status' to compare.");
+	if (reports.some((r) => r.remoteSchema?.hasDrift)) logRemoteDriftGuidance();
+}
+/**
+* Validate migration files and schema state without deploying
+* @param {ValidateOptions} options - Command options
+*/
+async function validate(options) {
+	logBetaWarning("tailordb migration");
+	const collected = await collectValidationReports(options);
+	const { reports } = collected;
+	const invalidCount = reports.filter((r) => !r.valid).length;
+	if (options.json) logger.out(reports);
+	else {
+		printValidationReports(reports);
+		if (invalidCount === 0 && !("remoteError" in collected)) logger.success("All migration validation checks passed.");
+		else printResolutionHints(reports);
+	}
+	if ("remoteError" in collected) throw collected.remoteError;
+	if (invalidCount > 0) throw new Error(`Migration validation failed for ${invalidCount} namespace(s)`);
+}
+const validateCommand = defineAppCommand({
+	name: "validate",
+	description: "Validate the full migration history and detect schema drift (local types vs. migration snapshot, remote schema vs. migration checkpoint) without deploying. This includes the migration and schema-drift checks used by 'deploy' and exits with a non-zero code when issues are found.",
+	args: z.strictObject({
+		...deploymentArgs,
+		namespace: arg(z.string().optional(), {
+			alias: "n",
+			description: "Target TailorDB namespace (validates all namespaces if not specified)"
+		})
+	}),
+	run: async (args) => {
+		await validate({
+			configPath: args.config,
+			namespace: args.namespace,
+			workspaceId: args["workspace-id"],
+			profile: args.profile,
+			json: logger.jsonMode
+		});
+	}
+});
+
 //#endregion
 //#region src/cli/commands/tailordb/migrate/index.ts
 /**
@@ -6018,6 +6210,7 @@ const syncCommand = defineAppCommand({
 * - set:      Set migration checkpoint to a specific number
 * - status:   Show migration status for TailorDB namespaces
 * - sync:     Sync remote TailorDB schema to a specific migration snapshot
+* - validate: Validate migration files and detect schema drift without deploying
 */
 const migrationCommand = defineCommand({
 	name: "migration",
@@ -6027,7 +6220,8 @@ const migrationCommand = defineCommand({
 		script: scriptCommand,
 		set: setCommand,
 		status: statusCommand,
-		sync: syncCommand
+		sync: syncCommand,
+		validate: validateCommand
 	}
 });