@tailor-platform/sdk 2.0.1 → 2.2.0

package/dist/cli/main.mjs

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { r as parseInputFields } from "../schema--xYWRGfe.mjs";
-import { At as PATScope, Ct as AuthInvokerSchema, E as CustomDomainStatus, W as FunctionExecution_Type } from "../workspace_resource_pb-DXnO2AT-.mjs";
+import { At as PATScope, Ct as AuthInvokerSchema, E as CustomDomainStatus, Ft as CloneOperationStatus, W as FunctionExecution_Type } from "../workspace_resource_pb-HNIL_Vfj.mjs";
 import { t as assertDefined } from "../assert-DBxo8jPo.mjs";
-import { n as logger, r as styles } from "../logger-CXQq9YIp.mjs";
-import { $n as hasUserTokenEntry, $t as ensureConfigId, An as loadDiff, Bn as sdkAppIdLabelKey, C as healthCommand, Cn as createSnapshotFromLocalTypes, Cr as resolveMachineUserInputSource, Dn as getMigrationFilePath, E as resumeCommand, Et as triggerCommand, F as writeDbTypesFile, Fn as formatMigrationDiff, Ft as startCommand, G as removeCommand$1, H as extractOwnedNamespaces, Hn as sdkVersionLabelKey, Ht as functionExecutionStatusToString, I as getConfiguredEditorCommand, In as hasChanges, Jn as assertWritable, K as updateCommand$3, Kn as prompt, Kt as deployFromCLI, L as openInConfiguredEditor, Ln as getNamespacesWithMigrations, Lt as getCommand$6, Mn as formatMigrationNumber, Mt as jobsCommand, N as generateCommand$1, Nn as parseMigrationNumberArg, O as listCommand$14, On as getMigrationFiles, Ot as listCommand$8, P as generateMigrationScript, Pn as formatDiffSummary, Q as getCommand$5, Qn as hasAnyUserTokenEntry, Qt as workspaceNameSchema, R as deployCommand$1, Rn as selectTargetNamespace, Sr as paginationArgs, St as getCommand$2, Tr as workspaceArgs, Tt as webhookCommand, U as logBetaWarning, Un as writeMetadataLabels, Ut as getCommand$1, V as showCommand, Vn as sdkNameLabelKey, Wn as PluginManager, X as listCommand$13, Xn as deleteUserTokens, Y as treeCommand, Yn as loadConfig, Yt as createCommand$4, Zn as fetchLatestToken, Zt as formatKeyValueTable, _r as confirmationArgs, a as queryCommand, an as toTailorDBDeployInput, ar as loadStoredUserTokens, bn as assertValidMigrationFiles, br as multiConfigArg, bt as listCommand$9, c as removeCommand, cn as handleOptionalToRequiredError, cr as readPlatformConfig, ct as createCommand$3, dn as compareSnapshotWithRemote, dr as resolveUserTokenKey, en as executeScript, er as loadAccessToken, et as updateCommand$2, f as inviteCommand, fn as generateAllTypeManifestsFromSnapshot, fr as saveUserTokens, ft as getCommand$3, g as getCommand$7, gn as INITIAL_SCHEMA_NUMBER, gr as configArg, gt as listCommand$10, hr as commonArgs, ht as tokenCommand$1, in as logRemoteDriftGuidance, ir as loadPlatformClientConfig, it as getCommand$4, j as truncateCommand, jn as reconstructSnapshotFromMigrations, ln as parseMigrationLabelNumber, lr as removeLegacyUserAlias, m as restoreCommand, mr as defineAppCommand, nr as loadConsoleBaseUrl, nt as listCommand$12, o as updateCommand$4, on as verifyRemoteSchema, or as loadWorkspaceId, ot as deleteCommand$4, pn as protoGqlPermission, pr as writePlatformConfig, qn as apiCall, qt as listCommand$17, r as serializeError, rn as checkMigrationDiffs, rr as loadMachineUserName, sn as MIGRATION_LABEL_KEY, sr as platformConfigFromProfile, t as registerTsHook, tr as loadConfigPath, u as listCommand$16, un as sanitizeMigrationLabel, ur as resolveConfigUser, ut as listCommand$11, v as deleteCommand$5, vr as deploymentArgs, vt as generate, w as waitCommand, wn as formatSchemaDrifts, wr as toPageDirection, x as listCommand$15, xn as compareLocalTypesWithSnapshot, xr as pagedLogArgs, yn as assertMigrationNumberExists, yr as isVerbose, zn as resourceTrn, zt as executionsCommand } from "../register-ts-hook-LYV7zH-e.mjs";
-import { C as createLogLevelTreeshakeOptions, F as fetchAllTolerant, G as initOperatorClient, H as getOrNull, K as isDefaultPlatform, L as fetchPaged, M as closeConnectionPool, N as defaultPlatformBaseUrl, P as fetchAll, R as fetchPlatformMachineUserToken, S as composeFunctionTreeshakeOptions, T as createBundleLog, U as getPlatformBaseUrl, V as getOAuth2ClientId, W as initOAuth2Client, a as resolveInlineSourcemap, b as resolveTSConfigWithFallback, c as WorkflowJobSchema, d as INVOKER_EXPR, h as assertUniqueLocalTailorDBTypeNames, k as getDistDir, l as ResolverSchema, m as buildResolverPermissionAndInputCheckExpr, v as createGeneratedEntryResolverPlugin, w as resolveBundleLogLevel, x as platformBundleDefinePlugin, y as createTsconfigPathsPlugin, z as fetchUserInfo } from "../application-CM6hKnSK.mjs";
-import { i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-k1xy_A5G.mjs";
+import { n as logger, r as styles } from "../logger-DSdExfor.mjs";
+import { $ as treeCommand, $n as formatDiffSummary, An as MIGRATION_NUMBER_PATTERN, Ar as removeLegacyUserAlias, B as MIGRATION_REVIEW_REQUIRED_MARKER, Br as isVerbose, Bt as getCommand$6, C as healthCommand, Cn as captureFileState, Cr as loadConsoleBaseUrl, Ct as listCommand$9, Dr as loadWorkspaceId, E as resumeCommand, En as DIFF_FILE_NAME, Er as loadStoredUserTokens, F as chunkSeedData, Fn as compareLocalTypesWithSnapshot, Fr as defineAppCommand, Ft as jobsCommand, G as showCommand, Gn as loadSnapshot, Gr as toPageDirection, Gt as functionExecutionStatusToString, H as deployCommand$1, Hn as getMigrationFiles, Hr as pagedLogArgs, Ht as executionsCommand, I as bundleSeedScript, In as compareSnapshots, Ir as commonArgs, Jn as MIGRATION_HISTORY_LABEL_KEY, K as extractOwnedNamespaces, Kn as normalizeSchemaSnapshot, Kr as workspaceArgs, Kt as getCommand$1, Ln as createSnapshotFromLocalTypes, Lr as configArg, M as loadSeedContext, Mn as UnsupportedMigrationFileVersionError, Mr as resolveUserTokenKey, N as loadApplicationNamespaces, Nn as assertMigrationNumberExists, Nr as saveUserTokens, O as listCommand$14, On as MIGRATE_FILE_NAME, Or as platformConfigFromProfile, Ot as webhookCommand, Pn as assertValidMigrationFiles, Pr as writePlatformConfig, Qn as sanitizeMigrationLabel, Qt as listCommand$17, R as generateCommand$1, Rn as formatSchemaDrifts, Rr as confirmationArgs, Rt as startCommand, Sn as protoGqlPermission, Sr as loadConfigPath, St as generate, Tn as DB_TYPES_FILE_NAME, Tr as loadPlatformClientConfig, Tt as getCommand$2, Ur as paginationArgs, V as generateSchemaFile, Vn as getMigrationFilePath, Vr as multiConfigArg, Wn as loadDiff, Wr as resolveMachineUserInputSource, X as updateCommand$3, Xn as createMigrationHistoryId, Xt as deployMigrationTestBaseline, Y as removeCommand$1, Yn as MIGRATION_LABEL_KEY, Yt as deployFromCLI, Zn as handleOptionalToRequiredError, Zt as deployMigrationTestTarget, _n as verifyRemoteSchema, _r as deleteUserTokens, a as queryCommand, an as ensureConfigId, ar as sdkAppIdLabelKey, bn as compareSnapshotWithRemote, br as hasUserTokenEntry, bt as listCommand$10, c as removeCommand, cn as executeScript, cr as writeMetadataLabels, ct as getCommand$4, dn as bundleMigrationScript, dr as formatMigrationNumber, en as createCommand$4, er as formatMigrationDiff, et as listCommand$13, f as inviteCommand, fn as checkMigrationDiffs, fr as parseMigrationNumberArg, ft as createCommand$3, g as getCommand$7, gn as toTailorDBDeployInput, gr as loadConfig, gt as getCommand$3, hn as logRemoteDriftGuidance, hr as assertWritable, in as workspaceNameSchema, ir as resourceTrn, it as updateCommand$2, j as truncateCommand, jn as SCHEMA_FILE_NAME, jr as resolveConfigUser, jt as listCommand$8, kr as readPlatformConfig, kt as triggerCommand, lr as PluginManager, m as restoreCommand, mn as formatRemoteVerificationResults, mr as apiCall, mt as listCommand$11, nr as getNamespacesWithMigrations, nt as getCommand$5, o as updateCommand$4, on as getMigrationMachineUser, or as sdkNameLabelKey, ot as listCommand$12, pn as fetchRemoteSchemaSnapshot, pr as prompt, q as logBetaWarning, qn as reconstructSnapshotFromMigrations, r as serializeError, rn as formatKeyValueTable, rr as selectTargetNamespace, sn as updateMigrationLabel, sr as sdkVersionLabelKey, t as registerTsHook, tn as createValidatedWorkspaceWithClient, tr as hasChanges, u as listCommand$16, un as formatMigrationScriptCommand, ut as deleteCommand$4, v as deleteCommand$5, vn as fetchRemoteMigrationNumber, vr as fetchLatestToken, w as waitCommand, wn as captureMigrationFileState, wr as loadMachineUserName, x as listCommand$15, xn as generateAllTypeManifestsFromSnapshot, xr as loadAccessToken, yn as fetchRemoteMigrationState, yr as hasAnyUserTokenEntry, yt as tokenCommand$1, z as scriptCommand, zn as getLatestMigrationNumber, zr as deploymentArgs } from "../register-ts-hook-CTth1eqj.mjs";
+import { A as getDistDir, B as fetchUserInfo, C as composeFunctionTreeshakeOptions, E as createBundleLog, F as fetchAll, G as initOAuth2Client, H as getOAuth2ClientId, I as fetchAllTolerant, K as initOperatorClient, N as closeConnectionPool, P as defaultPlatformBaseUrl, R as fetchPaged, S as platformBundleDefinePlugin, T as resolveBundleLogLevel, U as getOrNull, W as getPlatformBaseUrl, a as resolveInlineSourcemap, b as createTsconfigPathsPlugin, c as WorkflowJobSchema, f as INVOKER_EXPR, g as assertUniqueLocalTailorDBTypeNames, h as buildResolverPermissionAndInputCheckExpr, l as resolveResolverDefaultPermissionForFile, q as isDefaultPlatform, u as ResolverSchema, w as createLogLevelTreeshakeOptions, x as resolveTSConfigWithFallback, y as createGeneratedEntryResolverPlugin, z as fetchPlatformMachineUserToken } from "../application-BpLeawBg.mjs";
+import { h as loadFilesWithIgnores, i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-goqlJJgA.mjs";
 import { t as multiline } from "../multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "../package-json-8b0O9TlX.mjs";
 import { t as userAgent } from "../user-agent-Bgsszb5I.mjs";
-import { n as isCLIError, t as createCLIError } from "../errors-D7583Zz7.mjs";
-import { t as OperatorService } from "../service_pb-D5--My_M.mjs";
-import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-B5LqCTfF.mjs";
+import { i as isCLIError, r as formatNextAction, t as createCLIError } from "../errors-CWj21238.mjs";
+import { t as OperatorService } from "../service_pb-BEWj1pOV.mjs";
+import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-CIIfLnoO.mjs";
 import * as path from "pathe";
 import { dirname, resolve } from "pathe";
 import { resolvePackageJSON } from "pkg-types";
@@ -27,7 +27,7 @@ import { pathToFileURL } from "node:url";
 import { generateCodeVerifier } from "@badgateway/oauth2-client";
 import { Code, ConnectError } from "@connectrpc/connect";
 import * as crypto from "node:crypto";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import * as http from "node:http";
 import open from "open";
 import * as rolldown from "rolldown";
@@ -1498,7 +1498,7 @@ function composeExecutionErrorString(error) {
 * @returns Formatted fallback string for display
 */
 function formatExecutionErrorFallback(error) {
-	const [headerLine, ...frameLines] = composeExecutionErrorString(error).split("\n");
+	const [headerLine = "", ...frameLines] = composeExecutionErrorString(error).split("\n");
 	return [`  ${styles.error(headerLine)}`, ...frameLines.map((line) => `  ${styles.dim(line)}`)].join("\n");
 }
 /**
@@ -1694,7 +1694,14 @@ async function bundleForTestRun(options) {
 	const baseName = `test-run--${detected.name}`;
 	const scriptName = `${baseName}.js`;
 	const entryPath = path.join(outputDir, `${baseName}.entry.js`);
-	const entryContent = generateEntry(detected, sourceFile, env, machineUser, workspaceId);
+	const entryContent = generateEntry({
+		detected,
+		sourceFile,
+		env,
+		machineUser,
+		workspaceId,
+		defaultPermission: options.defaultPermission
+	});
 	fs.writeFileSync(entryPath, entryContent);
 	const tsconfig = await resolveTSConfigWithFallback(baseDir);
 	const bundleLog = createBundleLog({ tsconfig });
@@ -1725,14 +1732,11 @@ async function bundleForTestRun(options) {
 }
 /**
 * Generate entry file content based on the detected function type.
-* @param detected - Detected function info
-* @param sourceFile - Absolute path to the source file
-* @param env - Environment variables for workflow job bundles
-* @param machineUser - Resolved machine user info
-* @param workspaceId - Workspace ID
+* @param options - Detected function info and the context embedded into the entry
 * @returns Entry file content string
 */
-function generateEntry(detected, sourceFile, env, machineUser, workspaceId) {
+function generateEntry(options) {
+	const { detected, sourceFile, env, machineUser, workspaceId, defaultPermission } = options;
 	const absoluteSourcePath = path.resolve(sourceFile);
 	switch (detected.type) {
 		case "plain":
@@ -1745,7 +1749,10 @@ function generateEntry(detected, sourceFile, env, machineUser, workspaceId) {
       `;
 		case "resolver": {
 			const principalExpr = buildMachinePrincipalExpr(machineUser, workspaceId);
-			const guardAndInputCheckExpr = buildResolverPermissionAndInputCheckExpr(detected.permission);
+			const guardAndInputCheckExpr = buildResolverPermissionAndInputCheckExpr({
+				permission: detected.permission,
+				defaultPermission
+			});
 			return multiline`
         import _internalResolver from "${absoluteSourcePath}";
         import { t } from "@tailor-platform/sdk";
@@ -2027,10 +2034,16 @@ When a \`.js\` file is provided, detection and bundling are skipped and the file
 				args.arg = void 0;
 			}
 			logger.info("Bundling...");
+			const baseDir = path.dirname(config.path);
 			({bundledCode, scriptName} = await bundleForTestRun({
 				detected,
 				sourceFile: filePath,
-				baseDir: path.dirname(config.path),
+				baseDir,
+				defaultPermission: detected.type === "resolver" ? resolveResolverDefaultPermissionForFile({
+					config: config.resolver,
+					filePath,
+					baseDir
+				}) : void 0,
 				env: config.env ?? {},
 				inlineSourcemap: config.inlineSourcemap,
 				logLevel: config.logLevel,
@@ -5412,164 +5425,219 @@ const staticwebsiteCommand = defineCommand({
 });
 
 //#endregion
-//#region src/cli/commands/tailordb/migrate/script.ts
-/**
-* Script command for TailorDB migrations
-*
-* Adds a `migrate.ts` (and supporting `db.ts`) template to an existing
-* migration directory. Useful for warning-tier changes where users may
-* want to write a custom data migration even though the change does not
-* automatically require one.
-*/
-/**
-* Record in diff.json that a migration requiring a script intentionally has none.
-* @param {MarkScriptSkippedOptions} options - Target migration and skip reason
-* @returns {ScriptSkippedInfo} The recorded acknowledgment
-*/
-function markMigrationScriptSkipped(options) {
-	const { migrationsDir, migrationNumber, reason } = options;
-	const label = formatMigrationNumber(migrationNumber);
-	const normalizedReason = reason.trim();
-	if (!normalizedReason) throw new Error("Migration script skip reason must not be empty.");
-	const diffPath = getMigrationFilePath(migrationsDir, migrationNumber, "diff");
-	if (!fs.existsSync(diffPath)) throw new Error(`Migration ${label} not found in ${migrationsDir}. Expected ${diffPath}.`);
-	const diff = loadDiff(diffPath);
-	if (!diff.requiresMigrationScript) throw new Error(`Migration ${label} does not require a migration script; nothing to skip.`);
-	if (diff.scriptSkipped) throw new Error(`Migration ${label} already has a script skip recorded (${diff.scriptSkipped.acknowledgedAt}: ${diff.scriptSkipped.reason}).`);
-	const migratePath = getMigrationFilePath(migrationsDir, migrationNumber, "migrate");
-	if (fs.existsSync(migratePath)) throw new Error(`Migration script exists at ${migratePath}. Delete migrate.ts first if this migration should run without a script.`);
-	const scriptSkipped = {
-		reason: normalizedReason,
-		acknowledgedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-	const raw = JSON.parse(fs.readFileSync(diffPath, "utf-8"));
-	raw.scriptSkipped = scriptSkipped;
-	fs.writeFileSync(diffPath, JSON.stringify(raw, null, 2));
-	return scriptSkipped;
-}
-/**
-* Remove a script skip acknowledgment after a real migration script is created.
-* @param diffPath - Migration diff file to update
-*/
-function clearMigrationScriptSkipped(diffPath) {
-	const raw = JSON.parse(fs.readFileSync(diffPath, "utf-8"));
-	if (!Object.hasOwn(raw, "scriptSkipped")) return;
-	delete raw.scriptSkipped;
-	fs.writeFileSync(diffPath, JSON.stringify(raw, null, 2));
+//#region src/cli/commands/tailordb/migrate/rebaseline.ts
+const MIGRATION_ARTIFACT_NAMES = /* @__PURE__ */ new Set([
+	SCHEMA_FILE_NAME,
+	DIFF_FILE_NAME,
+	MIGRATE_FILE_NAME,
+	DB_TYPES_FILE_NAME
+]);
+async function activateBaseline(migrationsDir, snapshot, namespace, rebaseline) {
+	const resolvedMigrationsDir = await fsPromises.realpath(migrationsDir);
+	const parentDir = path.dirname(resolvedMigrationsDir);
+	const baseName = path.basename(resolvedMigrationsDir);
+	const stagingDir = await fsPromises.mkdtemp(path.join(parentDir, `.${baseName}-rebaseline-`));
+	const backupDir = `${stagingDir}-previous`;
+	let movedLiveDirectory = false;
+	let activatedStagingDirectory = false;
+	try {
+		await fsPromises.cp(resolvedMigrationsDir, stagingDir, { recursive: true });
+		for (const entry of await fsPromises.readdir(stagingDir, { withFileTypes: true })) {
+			if (!entry.isDirectory() || !MIGRATION_NUMBER_PATTERN.test(entry.name)) continue;
+			const entryPath = path.join(stagingDir, entry.name);
+			if (!(await fsPromises.readdir(entryPath)).some((childName) => MIGRATION_ARTIFACT_NAMES.has(childName))) continue;
+			await fsPromises.rm(entryPath, {
+				recursive: true,
+				force: true
+			});
+		}
+		loadSnapshot((await generateSchemaFile({
+			...snapshot,
+			namespace,
+			version: 2,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			rebaseline
+		}, stagingDir, 0)).filePath);
+		await fsPromises.rename(resolvedMigrationsDir, backupDir);
+		movedLiveDirectory = true;
+		try {
+			await fsPromises.rename(stagingDir, resolvedMigrationsDir);
+			activatedStagingDirectory = true;
+		} catch (error) {
+			await fsPromises.rename(backupDir, resolvedMigrationsDir);
+			movedLiveDirectory = false;
+			throw error;
+		}
+		try {
+			await fsPromises.rm(backupDir, {
+				recursive: true,
+				force: true
+			});
+		} catch (error) {
+			logger.warn(`The previous migration directory remains at ${backupDir}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		movedLiveDirectory = false;
+	} finally {
+		if (fs.existsSync(stagingDir)) await fsPromises.rm(stagingDir, {
+			recursive: true,
+			force: true
+		});
+		if (!activatedStagingDirectory && movedLiveDirectory && fs.existsSync(backupDir)) await fsPromises.rename(backupDir, resolvedMigrationsDir);
+	}
 }
-/**
-* Add a migrate.ts template to an existing migration directory.
-* @param {ScriptOptions} options - Command options
-*/
-async function script(options) {
+async function rebaseline(options) {
 	logBetaWarning("tailordb migration");
-	const migrationNumber = parseMigrationNumberArg(options.number);
-	if (migrationNumber === 0) throw new Error(`Migration ${options.number} is the initial schema snapshot and cannot have a migration script.`);
-	const { config } = await loadConfig(options.configPath);
-	const namespacesWithMigrations = getNamespacesWithMigrations(config, path.dirname(config.path));
-	if (namespacesWithMigrations.length === 0) throw new Error("No TailorDB services with migrations configuration found");
-	const targetNamespace = resolveTargetNamespace(namespacesWithMigrations, options.namespace);
-	const { migrationsDir } = assertDefined(namespacesWithMigrations.find((ns) => ns.namespace === targetNamespace), "namespace with migrations not found");
-	if (options.noScript) {
-		const reason = options.reason?.trim();
-		if (!reason) throw new Error("--reason is required with --no-script.");
-		const scriptSkipped = markMigrationScriptSkipped({
-			migrationsDir,
-			migrationNumber,
-			reason
-		});
-		logger.success(`Recorded that migration ${styles.bold(options.number)} in namespace ${styles.bold(targetNamespace)} intentionally has no migration script`);
-		logger.info(`  Reason: ${scriptSkipped.reason}`);
-		logger.info(`  Diff file: ${getMigrationFilePath(migrationsDir, migrationNumber, "diff")}`);
-		return;
+	const { config, plugins } = await loadConfig(options.configPath);
+	const configDir = path.dirname(config.path);
+	const target = selectTargetNamespace(getNamespacesWithMigrations(config, configDir), options.namespace);
+	const generateCommand = formatNextAction({
+		command: "tailor",
+		args: [
+			"tailordb",
+			"migration",
+			"generate",
+			"--config",
+			config.path
+		]
+	});
+	assertValidMigrationFiles(target.migrationsDir, target.namespace);
+	const latestSnapshot = reconstructSnapshotFromMigrations(target.migrationsDir);
+	if (!latestSnapshot) throw new Error(`No migration history found for namespace "${target.namespace}". Run ${generateCommand} first.`);
+	const latestMigration = getLatestMigrationNumber(target.migrationsDir);
+	const currentHistoryId = reconstructSnapshotFromMigrations(target.migrationsDir, 0)?.rebaseline?.historyId ?? null;
+	const initialFileState = captureMigrationFileState([target])[target.namespace];
+	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
+	const { defineApplication } = await import("../application-BxLLiLsr.mjs");
+	const application = defineApplication({
+		config,
+		pluginManager
+	});
+	for (const service of application.tailorDBServices) {
+		await service.loadTypes();
+		await service.processNamespacePlugins();
 	}
-	if (options.reason !== void 0) throw new Error("--reason can only be used together with --no-script.");
-	const diffPath = getMigrationFilePath(migrationsDir, migrationNumber, "diff");
-	if (!fs.existsSync(diffPath)) throw new Error(`Migration ${options.number} not found in ${migrationsDir}. Expected ${diffPath}.`);
-	const migratePath = getMigrationFilePath(migrationsDir, migrationNumber, "migrate");
-	if (fs.existsSync(migratePath)) throw new Error(`Migration script already exists at ${migratePath}.`);
-	const diff = loadDiff(diffPath);
-	const previousSnapshot = reconstructSnapshotFromMigrations(migrationsDir, migrationNumber - 1);
-	if (!previousSnapshot) throw new Error(`Could not reconstruct previous schema for migration ${options.number}. Make sure migration ${0} exists.`);
-	const scriptContent = generateMigrationScript(diff);
-	await fsPromises.writeFile(migratePath, scriptContent);
-	await writeDbTypesFile(previousSnapshot, migrationsDir, migrationNumber, diff);
-	clearMigrationScriptSkipped(diffPath);
-	logger.success(`Added migration script for migration ${styles.bold(options.number)} in namespace ${styles.bold(targetNamespace)}`);
-	logger.info(`  Migration script: ${migratePath}`);
-	logger.info(`  DB types: ${getMigrationFilePath(migrationsDir, migrationNumber, "db")}`);
+	const targetService = application.tailorDBServices.find((service) => service.namespace === target.namespace);
+	if (!targetService) throw new Error(`No TailorDB service found for namespace "${target.namespace}"`);
+	const assertLocalTypesReady = () => {
+		const currentSnapshot = createSnapshotFromLocalTypes(targetService.types, target.namespace);
+		const localDiff = compareLocalTypesWithSnapshot(latestSnapshot, currentSnapshot.types, target.namespace);
+		if (hasChanges(localDiff)) {
+			logger.error(`Migration history does not reproduce the current local schema for namespace ${styles.bold(target.namespace)}:`);
+			logger.log(formatMigrationDiff(localDiff));
+			throw new Error(`Refusing to re-baseline: the migration history must reproduce the current local schema. Run ${generateCommand} first.`);
+		}
+	};
+	const localSourceFiles = () => [config.path, ...loadFilesWithIgnores(targetService.config, configDir)];
+	assertLocalTypesReady();
+	const initialLocalFileState = captureFileState(localSourceFiles());
+	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const workspaceId = await loadWorkspaceId({
+		workspaceId: options.workspaceId,
+		profile: options.profile
+	});
+	const remoteContextArgs = [
+		"--config",
+		config.path,
+		"--workspace-id",
+		workspaceId,
+		...options.profile ? ["--profile", options.profile] : []
+	];
+	const setBaselineCommand = formatNextAction({
+		command: "tailor",
+		args: [
+			"tailordb",
+			"migration",
+			"set",
+			"0",
+			"--namespace",
+			target.namespace,
+			...remoteContextArgs
+		]
+	});
+	const deployCommand = formatNextAction({
+		command: "tailor",
+		args: ["deploy", ...remoteContextArgs]
+	});
+	const assertConnectedWorkspaceReady = async (expectedHistoryId, phase) => {
+		const remoteState = await fetchRemoteMigrationState(client, resourceTrn(workspaceId, "tailordb", target.namespace));
+		const remoteMigration = remoteState.number;
+		if (remoteMigration !== latestMigration) {
+			const actual = remoteMigration === null ? "<unset>" : formatMigrationNumber(remoteMigration);
+			throw new Error(`The connected workspace must be at the latest migration ${formatMigrationNumber(latestMigration)} before re-baselining; current checkpoint is ${actual}.`);
+		}
+		if (remoteState.historyIdInvalid) throw new Error("Refusing to re-baseline: the connected workspace has an invalid migration history marker.");
+		if (remoteState.historyId !== expectedHistoryId) throw new Error(phase === "confirmation" ? "The connected workspace migration history changed while waiting for confirmation. Run the command again." : "Refusing to re-baseline: the connected workspace does not match the local migration history.");
+		const remoteResults = await verifyRemoteSchema(client, workspaceId, [target], config, [toTailorDBDeployInput(targetService)]);
+		const remoteResult = remoteResults[0];
+		if (!remoteResult || remoteResult.remoteMigrationNumber !== latestMigration || remoteResult.hasDrift || remoteResult.checkpointMissingLocal) {
+			if (remoteResult?.hasDrift) {
+				logger.error("Remote schema drift detected:");
+				logger.log(formatRemoteVerificationResults(remoteResults));
+			}
+			throw new Error("Refusing to re-baseline: the connected workspace remote schema must match the latest migration.");
+		}
+	};
+	await assertConnectedWorkspaceReady(currentHistoryId, "initial");
 	logger.newline();
-	logger.log("Edit the script to implement your data migration logic.");
-	logger.log("It will be executed by 'tailor deploy' between Pre and Post phases.");
-	const editor = getConfiguredEditorCommand();
-	if (!editor) return;
+	logger.warn(`This will replace the migration history for ${styles.bold(target.namespace)}.`);
+	logger.log(`  Latest migration: ${formatMigrationNumber(latestMigration)}`);
+	logger.log("  New history: 0000/schema.json only");
+	logger.log("  migrate.ts and db.ts files will disappear from the working tree.");
+	logger.log("  Committed migration files will remain in Git history. Preserve any uncommitted files before continuing.");
+	logger.log("  Every other environment must already be at the latest migration.");
+	logger.log("  The connected workspace checkpoint will be reset to 0000.");
 	logger.newline();
-	logger.info(`Opening ${path.basename(migratePath)} in ${editor}...`);
-	try {
-		await openInConfiguredEditor(migratePath);
-	} catch {
-		return;
-	}
-}
-function resolveTargetNamespace(namespacesWithMigrations, requested) {
-	if (requested) {
-		if (!namespacesWithMigrations.some((ns) => ns.namespace === requested)) throw new Error(`Namespace "${requested}" not found or does not have migrations configured`);
-		return requested;
+	if (!options.yes) {
+		if (!await prompt.confirm({
+			message: "Re-baseline this migration history and reset the connected workspace checkpoint?",
+			default: false
+		})) {
+			logger.info("Operation cancelled.");
+			return;
+		}
 	}
-	if (namespacesWithMigrations.length === 1) {
-		const [ns] = namespacesWithMigrations;
-		return assertDefined(ns, "namespace with migrations missing").namespace;
+	assertValidMigrationFiles(target.migrationsDir, target.namespace);
+	if (captureMigrationFileState([target])[target.namespace] !== initialFileState) throw new Error("Migration files changed while waiting for confirmation. Run the command again.");
+	if (captureFileState(localSourceFiles()) !== initialLocalFileState) throw new Error("Local TailorDB type or config files changed. Run the command again.");
+	assertLocalTypesReady();
+	await assertConnectedWorkspaceReady(currentHistoryId, "confirmation");
+	const rebaselineMarker = {
+		historyId: createMigrationHistoryId(),
+		replacedHistoryId: currentHistoryId,
+		replacedLatestMigration: latestMigration
+	};
+	await activateBaseline(target.migrationsDir, latestSnapshot, target.namespace, rebaselineMarker);
+	try {
+		await updateMigrationLabel(client, workspaceId, target.namespace, 0, rebaselineMarker.historyId);
+	} catch (error) {
+		throw new Error(`The local migration history was re-baselined, but the connected workspace checkpoint could not be updated. Run ${setBaselineCommand}, or run ${deployCommand} with schema checks enabled after resolving the connection error.`, { cause: error });
 	}
-	throw new Error(`Multiple TailorDB services found. Please specify namespace with --namespace flag: ${namespacesWithMigrations.map((ns) => ns.namespace).join(", ")}`);
+	logger.success(`Re-baselined ${styles.bold(target.namespace)} and reset the connected workspace checkpoint to 0000.`);
 }
-const scriptCommand = defineAppCommand({
-	name: "script",
-	description: "Add a migration script (migrate.ts) template to an existing migration directory, or record with --no-script that a migration intentionally has none.",
+const rebaselineCommand = defineAppCommand({
+	name: "rebaseline",
+	description: "Collapse the full migration history into a new 0000 baseline.",
+	notes: `Re-baselining removes migrations after 0000 from the working tree, records a new migration history ID, and resets the connected workspace checkpoint without changing its schema or data. Every environment must already have applied the latest migration before you run this command.`,
 	args: z.strictObject({
-		...configArg,
-		number: arg(z.string(), {
-			positional: true,
-			description: "Migration number to add a script to (e.g., 0001 or 1)"
-		}),
+		...deploymentArgs,
+		...confirmationArgs,
 		namespace: arg(z.string().optional(), {
 			alias: "n",
 			description: "Target TailorDB namespace (required if multiple namespaces exist)"
-		}),
-		"no-script": arg(z.boolean().optional(), { description: "Record that this migration intentionally runs without a migration script (requires --reason)" }),
-		reason: arg(z.string().optional(), { description: "Reason why no migration script is needed (used with --no-script)" })
+		})
 	}),
 	run: async (args) => {
-		await script({
+		await assertWritable({ profile: args.profile });
+		await rebaseline({
 			configPath: args.config,
-			number: args.number,
 			namespace: args.namespace,
-			noScript: args["no-script"],
-			reason: args.reason
+			yes: args.yes,
+			workspaceId: args["workspace-id"],
+			profile: args.profile
 		});
 	}
 });
 
-//#endregion
-//#region src/cli/commands/tailordb/migrate/remote-state.ts
-/**
-* Fetch the namespace's current migration number from its metadata labels.
-*
-* Only a namespace that has not been deployed yet reads as "no current
-* migration". Every other lookup failure must propagate: treating it as
-* unset would misreport a transient error as "no checkpoint", showing
-* every migration as pending to callers.
-* @param client - Operator client
-* @param trn - Namespace TRN
-* @returns Parsed current migration number, or null when unset or unparseable
-*/
-async function fetchRemoteMigrationNumber(client, trn) {
-	const label = (await getOrNull(async () => {
-		const { metadata } = await client.getMetadata({ trn });
-		return metadata;
-	}))?.labels[MIGRATION_LABEL_KEY];
-	return label ? parseMigrationLabelNumber(label) : null;
-}
-
 //#endregion
 //#region src/cli/commands/tailordb/migrate/set.ts
 /**
@@ -5584,18 +5652,24 @@ async function set(options) {
 	const targetNamespace = target.namespace;
 	assertValidMigrationFiles(target.migrationsDir, targetNamespace);
 	assertMigrationNumberExists(target.migrationsDir, migrationNumber);
+	const historyId = reconstructSnapshotFromMigrations(target.migrationsDir, 0)?.rebaseline?.historyId;
 	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
 	const trn = resourceTrn(await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
 	}), "tailordb", targetNamespace);
-	const current = await fetchRemoteMigrationNumber(client, trn);
+	const currentState = await fetchRemoteMigrationState(client, trn);
+	const current = currentState.number;
 	const currentMigration = current ?? 0;
+	const currentHistoryId = currentState.historyIdInvalid ? "<invalid>" : currentState.historyId ?? "<unset>";
+	const newHistoryId = historyId ?? "<unset>";
 	logger.newline();
-	logger.warn("This operation will change the migration checkpoint.");
+	logger.warn("This operation will change TailorDB migration state metadata.");
 	logger.log(`Namespace: ${styles.bold(targetNamespace)}`);
 	logger.log(`Current migration: ${current === null ? "<unset>" : styles.bold(formatMigrationNumber(current))}`);
 	logger.log(`New migration: ${styles.bold(formatMigrationNumber(migrationNumber))}`);
+	logger.log(`Current migration history ID: ${styles.bold(currentHistoryId)}`);
+	logger.log(`New migration history ID: ${styles.bold(newHistoryId)}`);
 	logger.newline();
 	if (migrationNumber < currentMigration) {
 		logger.warn(`Setting migration number backwards (${formatMigrationNumber(currentMigration)} → ${formatMigrationNumber(migrationNumber)}) will cause previous migrations to be re-executed on next apply.`);
@@ -5606,7 +5680,7 @@ async function set(options) {
 	}
 	if (!options.yes) {
 		if (!await prompt.confirm({
-			message: "Continue with migration checkpoint update?",
+			message: "Continue with migration checkpoint and history ID update?",
 			default: false
 		})) {
 			logger.info("Operation cancelled.");
@@ -5616,7 +5690,11 @@ async function set(options) {
 	}
 	await writeMetadataLabels(client, {
 		trn,
-		labels: { [MIGRATION_LABEL_KEY]: sanitizeMigrationLabel(migrationNumber) }
+		labels: {
+			[MIGRATION_LABEL_KEY]: sanitizeMigrationLabel(migrationNumber),
+			...historyId ? { [MIGRATION_HISTORY_LABEL_KEY]: historyId } : {}
+		},
+		remove: historyId ? void 0 : [MIGRATION_HISTORY_LABEL_KEY]
 	});
 	logger.success(`Migration checkpoint set to ${styles.bold(formatMigrationNumber(migrationNumber))} for namespace ${styles.bold(targetNamespace)}`);
 }
@@ -5662,17 +5740,67 @@ async function collectMigrationStatuses(options) {
 	if (namespacesWithMigrations.length === 0) throw new Error("No TailorDB services with migrations configuration found");
 	const targetNamespaces = options.namespace ? namespacesWithMigrations.filter((ns) => ns.namespace === options.namespace) : namespacesWithMigrations;
 	if (targetNamespaces.length === 0) throw new Error(`Namespace "${options.namespace}" not found or does not have migrations configured`);
+	const localStates = /* @__PURE__ */ new Map();
+	const localFailures = /* @__PURE__ */ new Map();
+	for (const { namespace, migrationsDir } of targetNamespaces) try {
+		const migrationFiles = getMigrationFiles(migrationsDir);
+		const descriptions = /* @__PURE__ */ new Map();
+		let historyId = null;
+		for (const file of migrationFiles) {
+			if (file.type === "schema") {
+				const snapshot = loadSnapshot(file.path);
+				if (file.number === 0) historyId = snapshot.rebaseline?.historyId ?? null;
+				continue;
+			}
+			try {
+				const diff = loadDiff(file.path);
+				if (diff.description) descriptions.set(file.number, diff.description);
+			} catch (error) {
+				if (error instanceof UnsupportedMigrationFileVersionError) throw error;
+			}
+		}
+		localStates.set(namespace, {
+			migrationFiles,
+			descriptions,
+			historyId
+		});
+	} catch (error) {
+		localFailures.set(namespace, error instanceof Error ? error.message : String(error));
+	}
+	if (localStates.size === 0) return targetNamespaces.map(({ namespace }) => ({
+		status: "error",
+		namespace,
+		error: localFailures.get(namespace) ?? "Failed to read local migration history."
+	}));
 	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
 	});
 	const rows = [];
-	for (const { namespace, migrationsDir } of targetNamespaces) {
+	for (const { namespace } of targetNamespaces) {
+		if (localFailures.has(namespace)) {
+			rows.push({
+				status: "error",
+				namespace,
+				error: localFailures.get(namespace) ?? "Failed to read local migration history."
+			});
+			continue;
+		}
+		const localState = localStates.get(namespace);
+		if (!localState) {
+			rows.push({
+				status: "error",
+				namespace,
+				error: "Failed to read local migration history."
+			});
+			continue;
+		}
+		const { migrationFiles, descriptions, historyId: localHistoryId } = localState;
 		const trn = resourceTrn(workspaceId, "tailordb", namespace);
-		let current;
+		let remoteState;
 		try {
-			current = await fetchRemoteMigrationNumber(client, trn);
+			remoteState = await fetchRemoteMigrationState(client, trn);
 		} catch (error) {
 			rows.push({
 				status: "error",
@@ -5681,19 +5809,28 @@ async function collectMigrationStatuses(options) {
 			});
 			continue;
 		}
-		const currentMigration = current ?? 0;
-		const pendingMigrations = getMigrationFiles(migrationsDir).map((f) => f.number).filter((n, i, arr) => arr.indexOf(n) === i).toSorted((a, b) => a - b).filter((n) => n > currentMigration).map((num) => {
-			const diffPath = getMigrationFilePath(migrationsDir, num, "diff");
-			let description;
-			if (fs.existsSync(diffPath)) try {
-				description = loadDiff(diffPath).description;
-			} catch {}
-			return {
-				number: num,
-				label: formatMigrationNumber(num),
-				...description ? { description } : {}
-			};
-		});
+		const currentMigration = remoteState.number ?? 0;
+		if (remoteState.historyIdInvalid) {
+			rows.push({
+				status: "error",
+				namespace,
+				error: "Remote migration history ID is invalid."
+			});
+			continue;
+		}
+		if ((remoteState.number !== null || remoteState.historyId !== null) && remoteState.historyId !== localHistoryId) {
+			rows.push({
+				status: "error",
+				namespace,
+				error: `Remote migration history ID ${remoteState.historyId ?? "<unset>"} does not match local migration history ID ${localHistoryId ?? "<unset>"}.`
+			});
+			continue;
+		}
+		const pendingMigrations = migrationFiles.map((f) => f.number).filter((n, i, arr) => arr.indexOf(n) === i).toSorted((a, b) => a - b).filter((n) => n > currentMigration).map((num) => ({
+			number: num,
+			label: formatMigrationNumber(num),
+			...descriptions.has(num) ? { description: descriptions.get(num) } : {}
+		}));
 		rows.push({
 			status: "ok",
 			namespace,
@@ -5709,7 +5846,7 @@ function printMigrationStatuses(rows) {
 		logger.newline();
 		logger.info(`Namespace: ${styles.bold(row.namespace)}`);
 		if (isStatusFailure(row)) {
-			logger.error(`  Failed to read migration state: ${row.error}`);
+			logger.error(`  Migration status error: ${row.error}`);
 			continue;
 		}
 		logger.log(`  Current migration: ${styles.bold(row.currentMigrationLabel)}`);
@@ -5733,13 +5870,13 @@ async function status(options) {
 	const failures = rows.filter(isStatusFailure);
 	if (failures.length > 0) {
 		const namespaces = failures.map((f) => f.namespace).join(", ");
-		throw new Error(`Failed to read migration state for ${failures.length} namespace${failures.length === 1 ? "" : "s"}: ${namespaces}`);
+		throw new Error(`Migration status check failed for ${failures.length} namespace${failures.length === 1 ? "" : "s"}: ${namespaces}`);
 	}
 }
 const statusCommand = defineAppCommand({
 	name: "status",
 	description: "Show the current migration status for TailorDB namespaces, including applied and pending migrations.",
-	notes: "Metadata lookup failures (authentication, permission, or network errors) are reported per namespace and make the command exit non-zero; only a not-yet-deployed namespace is treated as having no applied migrations.",
+	notes: "Every local migration file is checked for a compatible format version, and deployed migration history IDs must match the local baseline. Compatibility errors, history mismatches, and metadata lookup failures are reported per namespace and make the command exit non-zero; only a not-yet-deployed namespace is treated as having no applied migrations.",
 	args: z.strictObject({
 		...deploymentArgs,
 		namespace: arg(z.string().optional(), {
@@ -5808,7 +5945,7 @@ async function fetchRemoteTypes(client, workspaceId, namespace) {
 async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	const { config, plugins } = loaded;
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-CXNaUNhv.mjs");
+	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-BxLLiLsr.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -5820,7 +5957,7 @@ async function assertMigrationsReproduceLocalTypes(loaded, target) {
 		await service.processNamespacePlugins();
 	}
 	const pluginExecutorFiles = generatePluginFilesIfNeeded(pluginManager, application.tailorDBServices, config.path);
-	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-M7OYziQP.mjs")).createExecutorService({
+	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-_XmjSEGr.mjs")).createExecutorService({
 		config: { files: [] },
 		baseDir: path.dirname(config.path)
 	}) : void 0);
@@ -5965,7 +6102,11 @@ async function sync(options) {
 	})));
 	await writeMetadataLabels(client, {
 		trn,
-		labels: { [MIGRATION_LABEL_KEY]: sanitizeMigrationLabel(targetVersion) }
+		labels: {
+			[MIGRATION_LABEL_KEY]: sanitizeMigrationLabel(targetVersion),
+			...snapshot.rebaseline?.historyId ? { [MIGRATION_HISTORY_LABEL_KEY]: snapshot.rebaseline.historyId } : {}
+		},
+		remove: snapshot.rebaseline?.historyId ? void 0 : [MIGRATION_HISTORY_LABEL_KEY]
 	});
 	logger.success(`Synced namespace ${styles.bold(target.namespace)} to migration ${styles.bold(formatMigrationNumber(targetVersion))}.`);
 	if (targetVersion < latest) {
@@ -6001,23 +6142,634 @@ const syncCommand = defineAppCommand({
 	}
 });
 
+//#endregion
+//#region src/cli/commands/tailordb/migrate/test-runtime.ts
+const CLONE_POLL_INTERVAL = 1e3;
+const CLONE_TIMEOUT = 300 * 1e3;
+function delay(milliseconds) {
+	return milliseconds > 0 ? new Promise((resolve) => setTimeout(resolve, milliseconds)) : Promise.resolve();
+}
+function assertSeedDataDirectory(dataDir) {
+	let stats;
+	try {
+		stats = fs.statSync(dataDir);
+	} catch (error) {
+		if (error.code === "ENOENT") throw new Error(`Seed data directory not found: ${dataDir}. Run 'tailor generate' before testing migrations.`, { cause: error });
+		throw error;
+	}
+	if (!stats.isDirectory()) throw new Error(`Seed data path is not a directory: ${dataDir}`);
+}
+function assertAssertionScript(assertionPath) {
+	const resolvedPath = path.resolve(assertionPath);
+	let stats;
+	try {
+		stats = fs.statSync(resolvedPath);
+	} catch (error) {
+		if (error.code === "ENOENT") throw new Error(`Migration assertion script not found: ${resolvedPath}`, { cause: error });
+		throw error;
+	}
+	if (!stats.isFile()) throw new Error(`Migration assertion path is not a file: ${resolvedPath}`);
+}
+/**
+* Require a designated clone target to share the source workspace's region.
+* @param sourceRegion - Source workspace region
+* @param targetRegion - Target workspace region
+*/
+function assertCloneTargetRegion(sourceRegion, targetRegion) {
+	if (sourceRegion !== targetRegion) throw new Error(`Clone mode requires source and target workspaces in the same region (source: ${sourceRegion}, target: ${targetRegion}).`);
+}
+/**
+* Require the migration test target workspace to differ from the source workspace.
+* @param sourceWorkspaceId - Source workspace ID
+* @param targetWorkspaceId - Designated target workspace ID, if any
+*/
+function assertTargetWorkspaceDiffers(sourceWorkspaceId, targetWorkspaceId) {
+	if (targetWorkspaceId?.toLowerCase() === sourceWorkspaceId.toLowerCase()) throw new Error("The migration test target workspace must differ from the source workspace.");
+}
+/**
+* Resolve the namespace an assertion script runs against.
+* @param pendingNamespaces - Namespaces with pending migrations
+* @param assertionNamespace - Explicit namespace from `--assert-namespace`, if any
+* @returns Resolved assertion namespace
+*/
+function resolveAssertionNamespace(pendingNamespaces, assertionNamespace) {
+	const namespace = assertionNamespace ?? (pendingNamespaces.length === 1 ? pendingNamespaces[0] : void 0);
+	if (!namespace) throw new Error("--assert-namespace is required when pending migrations span multiple namespaces.");
+	if (!pendingNamespaces.includes(namespace)) throw new Error(`Assertion namespace "${namespace}" has no pending migrations.`);
+	return namespace;
+}
+/**
+* Build the schema overrides used before migration-test data is loaded.
+* @param options - Source workspace, local inputs, and migration baselines
+* @returns Schema snapshots keyed by namespace
+*/
+async function createMigrationTestBaselineSnapshots(options) {
+	const snapshots = new Map([...options.baselines].map(([namespace, baseline]) => [namespace, baseline.snapshot]));
+	if (options.dataMode !== "clone") return snapshots;
+	const unmigratedInputs = options.inputs.filter((input) => !snapshots.has(input.namespace));
+	const remoteSnapshots = await Promise.all(unmigratedInputs.map((input) => fetchRemoteSchemaSnapshot(options.client, options.workspaceId, input.namespace)));
+	unmigratedInputs.forEach((input, index) => {
+		snapshots.set(input.namespace, assertDefined(remoteSnapshots[index], `remote snapshot missing for "${input.namespace}"`));
+	});
+	return snapshots;
+}
+/**
+* Wait for an application-data clone operation to reach a terminal state.
+* @param client - Operator client
+* @param options - Clone operation identifiers and polling limits
+*/
+async function waitForCloneApplicationData(client, options) {
+	const pollInterval = options.pollInterval ?? CLONE_POLL_INTERVAL;
+	const timeout = options.timeout ?? CLONE_TIMEOUT;
+	const deadline = Date.now() + timeout;
+	while (Date.now() <= deadline) {
+		const operation = await client.getCloneApplicationDataOperation({
+			sourceWorkspaceId: options.sourceWorkspaceId,
+			targetWorkspaceId: options.targetWorkspaceId,
+			operationId: options.operationId
+		});
+		if (operation.status === CloneOperationStatus.COMPLETED) return;
+		if (operation.status === CloneOperationStatus.FAILED) throw new Error(`Application data clone failed: ${operation.errorMessage || "unknown platform error"}`);
+		if (operation.status !== CloneOperationStatus.PENDING && operation.status !== CloneOperationStatus.PROCESSING) throw new Error(`Application data clone returned unexpected status ${operation.status}.`);
+		await delay(pollInterval);
+	}
+	throw new Error(`Application data clone timed out after ${Math.round(timeout / 1e3)} seconds.`);
+}
+/**
+* Load generated JSONL seed rows for the types in a baseline snapshot.
+* @param dataDir - Directory containing `<Type>.jsonl` files
+* @param typeNames - Baseline type names to load
+* @param snapshot - Baseline schema used to remove fields introduced by pending migrations
+* @returns Seed rows keyed by type name
+*/
+function loadSnapshotSeedData(dataDir, typeNames, snapshot) {
+	const data = {};
+	for (const typeName of typeNames) {
+		const snapshotType = snapshot?.types[typeName];
+		const jsonlPath = path.join(dataDir, `${typeName}.jsonl`);
+		let content;
+		try {
+			content = fs.readFileSync(jsonlPath, "utf8").trim();
+		} catch (error) {
+			if (error.code === "ENOENT") {
+				data[typeName] = [];
+				continue;
+			}
+			throw error;
+		}
+		data[typeName] = content ? content.split("\n").map((line, index) => {
+			let value;
+			try {
+				value = JSON.parse(line);
+			} catch (error) {
+				throw new Error(`Invalid JSON in ${jsonlPath} at line ${index + 1}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+			}
+			if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`Invalid seed row in ${jsonlPath} at line ${index + 1}: expected a JSON object`);
+			const row = value;
+			return snapshotType ? projectSeedObject(row, snapshotType.fields, /* @__PURE__ */ new Set(["id"])) : row;
+		}) : [];
+	}
+	return data;
+}
+function projectSeedObject(value, fields, implicitFields = /* @__PURE__ */ new Set()) {
+	return Object.fromEntries(Object.entries(value).flatMap(([fieldName, fieldValue]) => {
+		const field = fields[fieldName];
+		if (!field) return implicitFields.has(fieldName) ? [[fieldName, fieldValue]] : [];
+		return [[fieldName, projectSeedValue(fieldValue, field)]];
+	}));
+}
+function projectSeedValue(value, field) {
+	const fields = field.fields;
+	if (!fields) return value;
+	if (field.array) {
+		if (!Array.isArray(value)) return value;
+		return value.map((entry) => isJsonObject(entry) ? projectSeedObject(entry, fields) : entry);
+	}
+	return isJsonObject(value) ? projectSeedObject(value, fields) : value;
+}
+function isJsonObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* Derive insertion order and self-referencing types from a baseline snapshot.
+* @param snapshot - Baseline schema snapshot
+* @returns Dependency-ordered type names and self-referencing types
+*/
+function sortSeedTypesForSnapshot(snapshot) {
+	const typeNames = Object.keys(snapshot.types);
+	const available = new Set(typeNames);
+	const dependencies = /* @__PURE__ */ new Map();
+	const selfRefTypes = [];
+	for (const [typeName, type] of Object.entries(snapshot.types)) {
+		const referenced = /* @__PURE__ */ new Set();
+		for (const field of Object.values(type.fields)) {
+			const target = field.foreignKeyType;
+			if (!target) continue;
+			if (target === typeName) selfRefTypes.push(typeName);
+			else if (available.has(target)) referenced.add(target);
+		}
+		dependencies.set(typeName, [...referenced]);
+	}
+	const visited = /* @__PURE__ */ new Set();
+	const order = [];
+	const visit = (typeName) => {
+		if (visited.has(typeName)) return;
+		visited.add(typeName);
+		for (const dependency of dependencies.get(typeName) ?? []) visit(dependency);
+		order.push(typeName);
+	};
+	for (const typeName of typeNames) visit(typeName);
+	return {
+		order,
+		selfRefTypes
+	};
+}
+function temporaryWorkspaceName() {
+	return `migration-test-${(/* @__PURE__ */ new Date()).toISOString().replace(/[-:T.Z]/g, "").slice(0, 14)}-${randomBytes(3).toString("hex")}`;
+}
+function stateOrThrow(state) {
+	return assertDefined(state, "migration test runtime was used before preparation");
+}
+/**
+* Require the source workspace to still match the prepared baselines.
+*
+* The source is verified during preparation, but the baseline deploy runs in
+* between; a source deploy in that window would make the clone diverge from
+* the already-deployed baseline schemas.
+* @param state - Prepared migration test runtime state
+* @param prepared - Baselines captured during preparation
+* @param sourceWorkspaceId - Source workspace ID
+*/
+async function assertSourceBaselineFresh(state, prepared, sourceWorkspaceId) {
+	const loaded = state.loaded;
+	const namespaces = getNamespacesWithMigrations(loaded.config, path.dirname(loaded.config.path));
+	const inputs = loaded.application.tailorDBServices.map(toTailorDBDeployInput);
+	const invalidRemote = (await verifyRemoteSchema(state.client, sourceWorkspaceId, namespaces, loaded.config, inputs)).find((check) => check.hasDrift || check.checkpointMissingLocal || check.checkpointRepair);
+	if (invalidRemote) throw new Error(`Source namespace "${invalidRemote.namespace}" changed after migration test preparation. Run the migration test again.`);
+	for (const namespace of namespaces) {
+		const baseline = prepared.baselines.get(namespace.namespace);
+		if (!baseline) continue;
+		const migrationNumber = await fetchRemoteMigrationNumber(state.client, resourceTrn(sourceWorkspaceId, "tailordb", namespace.namespace));
+		if (migrationNumber !== baseline.migrationNumber) throw new Error(`Source namespace "${namespace.namespace}" moved from migration ${baseline.migrationNumber} to ${migrationNumber ?? "none"} after migration test preparation. Run the migration test again.`);
+	}
+	const unmigratedInputs = inputs.filter((input) => !prepared.baselines.has(input.namespace));
+	for (const input of unmigratedInputs) {
+		const snapshot = prepared.baselineSnapshots.get(input.namespace);
+		if (!snapshot) continue;
+		if (compareSnapshots(snapshot, await fetchRemoteSchemaSnapshot(state.client, sourceWorkspaceId, input.namespace)).changes.length > 0) throw new Error(`Source namespace "${input.namespace}" schema changed after migration test preparation. Run the migration test again.`);
+	}
+}
+/**
+* Delete the target workspace's user profile config when one exists.
+*
+* A retained target may carry a user profile config referencing types the
+* baseline deploy replaces; deleting it up front lets the baseline's planAuth
+* see no existing config instead of reordering delete phases.
+* @param state - Prepared migration test runtime state
+* @param targetWorkspaceId - Target workspace ID
+*/
+async function deleteExistingUserProfileConfig(state, targetWorkspaceId) {
+	const auth = state.loaded.application.authService;
+	if (!auth) return;
+	const namespaceName = auth.config.name;
+	if (!await getOrNull(() => state.client.getUserProfileConfig({
+		workspaceId: targetWorkspaceId,
+		namespaceName
+	}))) return;
+	await state.client.deleteUserProfileConfig({
+		workspaceId: targetWorkspaceId,
+		namespaceName
+	});
+}
+function migrationConfig(loaded, namespace) {
+	return (loaded.config.db?.[namespace])?.migration;
+}
+function authExecutionContext(state, namespace, explicitMachineUser) {
+	const auth = state.loaded.application.authService;
+	if (!auth) throw new Error("Auth configuration is required to execute migration test scripts.");
+	const machineUserName = explicitMachineUser ?? getMigrationMachineUser(migrationConfig(state.loaded, namespace), auth.config.machineUsers ? Object.keys(auth.config.machineUsers) : void 0);
+	if (!machineUserName) throw new Error(`No machine user is available for namespace "${namespace}". Pass --machine-user or configure one in auth or db.${namespace}.migration.`);
+	return {
+		authNamespace: auth.config.name,
+		machineUserName
+	};
+}
+async function prepareMigrationTest(options) {
+	const loaded = await loadApplicationNamespaces({ configPath: options.configPath });
+	const configDir = path.dirname(loaded.config.path);
+	const namespaces = getNamespacesWithMigrations(loaded.config, configDir);
+	if (namespaces.length === 0) throw new Error("No TailorDB services with migrations configuration found.");
+	for (const namespace of namespaces) assertValidMigrationFiles(namespace.migrationsDir, namespace.namespace);
+	let seedContext;
+	if (options.data === "seed") {
+		seedContext = await loadSeedContext({ configPath: loaded.config.path });
+		assertSeedDataDirectory(path.join(seedContext.distPath, "data"));
+	}
+	if (options.assertionPath) assertAssertionScript(options.assertionPath);
+	const inputs = loaded.application.tailorDBServices.map(toTailorDBDeployInput);
+	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }), await loadPlatformClientConfig({ profile: options.profile }));
+	const sourceWorkspaceId = await loadWorkspaceId({
+		workspaceId: options.workspaceId,
+		profile: options.profile
+	});
+	assertTargetWorkspaceDiffers(sourceWorkspaceId, options.targetWorkspaceId);
+	const [workspaceResponse, applicationResponse, targetWorkspaceResponse] = await Promise.all([
+		client.getWorkspace({ workspaceId: sourceWorkspaceId }),
+		client.getApplication({
+			workspaceId: sourceWorkspaceId,
+			applicationName: loaded.config.name
+		}),
+		options.data === "clone" && options.targetWorkspaceId ? client.getWorkspace({ workspaceId: options.targetWorkspaceId }) : Promise.resolve(void 0)
+	]);
+	const sourceWorkspace = assertDefined(workspaceResponse.workspace, `source workspace "${sourceWorkspaceId}" not found`);
+	assertDefined(applicationResponse.application, `application "${loaded.config.name}" not found in source workspace`);
+	const designatedTarget = targetWorkspaceResponse ? assertDefined(targetWorkspaceResponse.workspace, `target workspace "${options.targetWorkspaceId}" not found`) : void 0;
+	const remoteChecks = await verifyRemoteSchema(client, sourceWorkspaceId, namespaces, loaded.config, inputs);
+	const invalidRemote = remoteChecks.find((check) => check.hasDrift || check.checkpointMissingLocal);
+	if (invalidRemote) throw new Error(`Source namespace "${invalidRemote.namespace}" does not match its migration checkpoint. Run 'tailor tailordb migration validate' first.`);
+	const pendingRepair = remoteChecks.find((check) => check.checkpointRepair);
+	if (pendingRepair) throw new Error(`Source namespace "${pendingRepair.namespace}" has a pending migration checkpoint repair. Run 'tailor deploy' against the source workspace first.`);
+	const baselines = /* @__PURE__ */ new Map();
+	const targetSnapshots = /* @__PURE__ */ new Map();
+	const pendingNamespaces = [];
+	for (const namespace of namespaces) {
+		const migrationNumber = await fetchRemoteMigrationNumber(client, resourceTrn(sourceWorkspaceId, "tailordb", namespace.namespace));
+		if (migrationNumber === null) throw new Error(`Source namespace "${namespace.namespace}" has no sdk-migration checkpoint. Deploy or set its migration checkpoint before testing.`);
+		const latest = getLatestMigrationNumber(namespace.migrationsDir);
+		if (migrationNumber > latest) throw new Error(`Source namespace "${namespace.namespace}" is at migration ${migrationNumber}, but the local history ends at ${latest}.`);
+		const snapshot = reconstructSnapshotFromMigrations(namespace.migrationsDir, migrationNumber);
+		if (!snapshot) throw new Error(`No migration baseline snapshot found for namespace "${namespace.namespace}".`);
+		baselines.set(namespace.namespace, {
+			migrationNumber,
+			snapshot,
+			historyId: snapshot.rebaseline?.historyId ?? null
+		});
+		const targetSnapshot = reconstructSnapshotFromMigrations(namespace.migrationsDir, latest);
+		if (!targetSnapshot) throw new Error(`No target migration snapshot found for namespace "${namespace.namespace}".`);
+		targetSnapshots.set(namespace.namespace, targetSnapshot);
+		if (migrationNumber < latest) pendingNamespaces.push(namespace.namespace);
+	}
+	if (pendingNamespaces.length === 0) throw new Error("No pending TailorDB migrations found in the source workspace.");
+	const baselineSnapshots = await createMigrationTestBaselineSnapshots({
+		client,
+		workspaceId: sourceWorkspaceId,
+		dataMode: options.data,
+		inputs,
+		baselines
+	});
+	const prepared = {
+		sourceWorkspaceId,
+		sourceApplicationName: loaded.config.name,
+		temporaryWorkspace: {
+			name: temporaryWorkspaceName(),
+			region: sourceWorkspace.region,
+			...sourceWorkspace.organizationId ? { organizationId: sourceWorkspace.organizationId } : {},
+			...sourceWorkspace.folderId ? { folderId: sourceWorkspace.folderId } : {}
+		},
+		baselines,
+		baselineSnapshots,
+		targetSnapshots,
+		pendingNamespaces,
+		...designatedTarget ? { designatedTarget: {
+			id: designatedTarget.id,
+			region: designatedTarget.region
+		} } : {}
+	};
+	return {
+		state: {
+			client,
+			loaded,
+			options,
+			...seedContext ? { seedContext } : {}
+		},
+		prepared
+	};
+}
+/**
+* Create the platform operations used by `tailordb migration test`.
+* @returns Migration test dependencies backed by the Operator API
+*/
+function createMigrationTestDependencies() {
+	let runtimeState;
+	return {
+		prepare: async (options) => {
+			const { state, prepared } = await prepareMigrationTest(options);
+			runtimeState = state;
+			return prepared;
+		},
+		createWorkspace: async (prepared) => {
+			const workspace = await createValidatedWorkspaceWithClient(stateOrThrow(runtimeState).client, prepared.temporaryWorkspace);
+			logger.info(`Created temporary workspace ${workspace.name} (${workspace.id}).`);
+			return {
+				id: workspace.id,
+				name: workspace.name
+			};
+		},
+		deployBaseline: async ({ prepared, targetWorkspaceId }) => {
+			const state = stateOrThrow(runtimeState);
+			await deleteExistingUserProfileConfig(state, targetWorkspaceId);
+			await deployMigrationTestBaseline({
+				configPath: state.loaded.config.path,
+				profile: state.options.profile,
+				workspaceId: targetWorkspaceId,
+				yes: true
+			}, prepared.baselines, prepared.baselineSnapshots);
+			for (const [namespace, baseline] of prepared.baselines) await updateMigrationLabel(state.client, targetWorkspaceId, namespace, baseline.migrationNumber, baseline.historyId ?? void 0);
+		},
+		seedData: async ({ prepared, targetWorkspaceId }) => {
+			const state = stateOrThrow(runtimeState);
+			const seedContext = assertDefined(state.seedContext, "seed context missing after migration test preparation");
+			const dataDir = path.join(seedContext.distPath, "data");
+			assertSeedDataDirectory(dataDir);
+			const seedSnapshots = new Map(state.loaded.application.tailorDBServices.map((service) => {
+				const baseline = prepared.baselines.get(service.namespace);
+				const input = toTailorDBDeployInput(service);
+				return [service.namespace, baseline?.snapshot ?? normalizeSchemaSnapshot({
+					version: 1,
+					namespace: service.namespace,
+					createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+					types: input.types
+				})];
+			}));
+			for (const [namespace, snapshot] of seedSnapshots) {
+				const { order, selfRefTypes } = sortSeedTypesForSnapshot(snapshot);
+				const data = loadSnapshotSeedData(dataDir, order, snapshot);
+				const typesWithData = order.filter((typeName) => (data[typeName]?.length ?? 0) > 0);
+				if (typesWithData.length === 0) continue;
+				const bundled = await bundleSeedScript(namespace, typesWithData, path.dirname(state.loaded.config.path));
+				const chunks = chunkSeedData({
+					data,
+					order,
+					codeByteSize: new TextEncoder().encode(bundled.bundledCode).length
+				});
+				const auth = authExecutionContext(state, namespace, state.options.machineUser ?? seedContext.machineUserName);
+				for (const chunk of chunks) {
+					const execution = await executeScript({
+						client: state.client,
+						workspaceId: targetWorkspaceId,
+						name: `migration-test-seed-${namespace}.ts`,
+						code: bundled.bundledCode,
+						arg: {
+							data: chunk.data,
+							order: chunk.order,
+							selfRefTypes,
+							upsert: false
+						},
+						invoker: {
+							namespace: auth.authNamespace,
+							machineUserName: auth.machineUserName
+						}
+					});
+					if (!execution.success) throw new Error(execution.error ?? `Seed execution failed for namespace "${namespace}".`);
+					if (JSON.parse(execution.result || "{}").success !== true) throw new Error(`Seed execution reported failure for namespace "${namespace}".`);
+				}
+			}
+		},
+		cloneData: async ({ prepared, sourceWorkspaceId, targetWorkspaceId, applicationName }) => {
+			const state = stateOrThrow(runtimeState);
+			await assertSourceBaselineFresh(state, prepared, sourceWorkspaceId);
+			logger.warn("Clone mode copies TailorDB records only; IdP users and file blobs are not copied.");
+			let operationId;
+			try {
+				operationId = (await state.client.cloneApplicationData({
+					sourceWorkspaceId,
+					sourceApplicationName: applicationName,
+					targetWorkspaceId,
+					targetApplicationName: applicationName
+				})).operationId;
+			} catch (error) {
+				if (error instanceof ConnectError && error.code === Code.Unimplemented) throw new Error("Application data clone is not enabled for this platform. Retry with '--data seed'.", { cause: error });
+				throw error;
+			}
+			if (!operationId) throw new Error("Application data clone returned no operation ID.");
+			await waitForCloneApplicationData(state.client, {
+				sourceWorkspaceId,
+				targetWorkspaceId,
+				operationId
+			});
+		},
+		deployMigrations: async ({ prepared, targetWorkspaceId }) => {
+			const state = stateOrThrow(runtimeState);
+			await deployMigrationTestTarget({
+				configPath: state.loaded.config.path,
+				profile: state.options.profile,
+				workspaceId: targetWorkspaceId,
+				yes: true
+			}, prepared.targetSnapshots);
+		},
+		runAssertion: async ({ prepared, targetWorkspaceId, assertionPath, assertionNamespace, machineUser }) => {
+			const state = stateOrThrow(runtimeState);
+			const namespace = resolveAssertionNamespace(prepared.pendingNamespaces, assertionNamespace);
+			const auth = authExecutionContext(state, namespace, machineUser);
+			const bundled = await bundleMigrationScript(assertionPath, namespace, 0, state.loaded.config.env ?? {}, path.dirname(state.loaded.config.path));
+			const execution = await executeScript({
+				client: state.client,
+				workspaceId: targetWorkspaceId,
+				name: `migration-test-assert-${namespace}.ts`,
+				code: bundled.bundledCode,
+				invoker: {
+					namespace: auth.authNamespace,
+					machineUserName: auth.machineUserName
+				}
+			});
+			if (!execution.success) throw new Error(execution.error ?? `Migration assertion failed for namespace "${namespace}".`);
+		},
+		deleteWorkspace: async (workspaceId) => {
+			await stateOrThrow(runtimeState).client.deleteWorkspace({ workspaceId });
+		}
+	};
+}
+
+//#endregion
+//#region src/cli/commands/tailordb/migrate/test.ts
+/**
+* Run pending migrations against an isolated target workspace.
+* @param options - Migration test options
+* @param dependencies - Runtime operations used by the migration test
+* @returns Migration test result
+*/
+async function runMigrationTest(options, dependencies = createMigrationTestDependencies()) {
+	if (options.targetWorkspaceId && !options.yes) throw new Error("--target-workspace-id requires --yes because the target may be overwritten.");
+	if (options.keep && options.targetWorkspaceId) throw new Error("--keep applies only to automatically created workspaces; a designated target is always retained.");
+	if (options.assertionNamespace && !options.assertionPath) throw new Error("--assert is required when --assert-namespace is provided.");
+	const prepared = await dependencies.prepare(options);
+	assertTargetWorkspaceDiffers(prepared.sourceWorkspaceId, options.targetWorkspaceId);
+	if (options.assertionPath) resolveAssertionNamespace(prepared.pendingNamespaces, options.assertionNamespace);
+	if (options.data === "clone" && options.targetWorkspaceId) {
+		const target = assertDefined(prepared.designatedTarget, "designated clone target was not loaded during preparation");
+		assertCloneTargetRegion(prepared.temporaryWorkspace.region, target.region);
+	}
+	const temporary = options.targetWorkspaceId === void 0;
+	const workspace = temporary ? await dependencies.createWorkspace(prepared) : {
+		id: assertDefined(options.targetWorkspaceId, "designated target workspace missing"),
+		name: void 0
+	};
+	let primaryError;
+	let failed = false;
+	let deleted = false;
+	try {
+		const target = {
+			prepared,
+			targetWorkspaceId: workspace.id
+		};
+		await dependencies.deployBaseline(target);
+		const dataTarget = {
+			...target,
+			sourceWorkspaceId: prepared.sourceWorkspaceId,
+			applicationName: prepared.sourceApplicationName
+		};
+		if (options.data === "clone") await dependencies.cloneData(dataTarget);
+		else await dependencies.seedData(dataTarget);
+		await dependencies.deployMigrations(target);
+		if (options.assertionPath) await dependencies.runAssertion({
+			...target,
+			assertionPath: options.assertionPath,
+			assertionNamespace: options.assertionNamespace,
+			machineUser: options.machineUser
+		});
+	} catch (error) {
+		primaryError = error;
+		failed = true;
+	}
+	if (temporary && options.keep) logger.info(`Keeping temporary workspace ${workspace.name ?? workspace.id}.`);
+	else if (temporary) try {
+		await dependencies.deleteWorkspace(workspace.id);
+		deleted = true;
+	} catch (cleanupError) {
+		if (!failed) throw new Error(`Failed to delete temporary workspace ${workspace.id}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`, { cause: cleanupError });
+		logger.warn(`Failed to delete temporary workspace ${workspace.id}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+	}
+	if (failed) throw primaryError;
+	return {
+		success: true,
+		workspaceId: workspace.id,
+		...workspace.name ? { workspaceName: workspace.name } : {},
+		temporary,
+		deleted,
+		data: options.data,
+		pendingNamespaces: prepared.pendingNamespaces
+	};
+}
+async function migrationTest(options) {
+	logBetaWarning("tailordb migration");
+	const result = await runMigrationTest(options);
+	if (options.json) {
+		logger.out(result);
+		return;
+	}
+	logger.success(`Pending migrations completed in workspace ${result.workspaceName ?? result.workspaceId}.`);
+}
+const testCommand = defineAppCommand({
+	name: "test",
+	description: "Test pending migrations with seed fixtures or cloned data in a temporary workspace.",
+	notes: "The source workspace is read-only. Without --target-workspace-id, the command creates a workspace in the source workspace's region and deletes it after success or failure; pass --keep to retain it for inspection. A designated target is retained and requires --yes. Clone mode copies TailorDB records only; it does not copy IdP users or file blobs.",
+	args: z.strictObject({
+		...deploymentArgs,
+		yes: arg(z.boolean().default(false), {
+			alias: "y",
+			description: "Acknowledge that a designated target workspace may be overwritten"
+		}),
+		data: arg(z.enum(["seed", "clone"]).default("seed"), { description: "Data source for the migration test (seed or clone)" }),
+		"target-workspace-id": arg(z.uuid().optional(), { description: "Existing throwaway workspace to retain after the test (requires --yes)" }),
+		keep: arg(z.boolean().default(false), { description: "Keep the automatically created workspace after the test" }),
+		assert: arg(z.string().optional(), {
+			description: "Path to a TypeScript assertion script to run after migrations",
+			completion: {
+				type: "file",
+				extensions: ["ts"]
+			}
+		}),
+		"assert-namespace": arg(z.string().optional(), { description: "TailorDB namespace exposed to the assertion script" }),
+		"machine-user": arg(z.string().optional(), { description: "Machine user for seed and assertion script execution" })
+	}),
+	run: async (args) => {
+		await assertWritable({ profile: args.profile });
+		await migrationTest({
+			configPath: args.config,
+			workspaceId: args["workspace-id"],
+			profile: args.profile,
+			data: args.data,
+			targetWorkspaceId: args["target-workspace-id"],
+			keep: args.keep,
+			assertionPath: args.assert,
+			assertionNamespace: args["assert-namespace"],
+			machineUser: args["machine-user"],
+			yes: args.yes,
+			json: logger.jsonMode
+		});
+	}
+});
+
 //#endregion
 //#region src/cli/commands/tailordb/migrate/validate.ts
 /**
-* Assert that every migration in the local history whose diff requires a data
-* migration script has a migrate.ts on disk or an explicit skip acknowledgment
+* Walk the local migration history once to assert that every required
+* migration script exists and generated normalization logic has been
+* reviewed, and to collect migrations with data-loss warnings that have
+* neither a migrate.ts nor a recorded --no-script acknowledgment
 * @param {string} migrationsDir - Migrations directory path
 * @param {string} namespace - TailorDB namespace (for error messages)
+* @returns {UnacknowledgedWarningMigration[]} Unacknowledged warning migrations in the local history
 */
-function assertRequiredMigrationScripts(migrationsDir, namespace) {
+function assertMigrationScriptsReady(migrationsDir, namespace) {
 	const missing = [];
+	const unreviewed = [];
+	const unacknowledgedWarnings = [];
 	for (const file of getMigrationFiles(migrationsDir)) {
 		if (file.type !== "diff") continue;
 		const diff = loadDiff(file.path);
-		if (!diff.requiresMigrationScript || diff.scriptSkipped) continue;
-		if (!fs.existsSync(getMigrationFilePath(migrationsDir, file.number, "migrate"))) missing.push(file.number);
+		const migrateFilePath = getMigrationFilePath(migrationsDir, file.number, "migrate");
+		const hasScript = fs.existsSync(migrateFilePath);
+		if (diff.requiresMigrationScript && !diff.scriptSkipped && !hasScript) missing.push(file.number);
+		if (hasScript && fs.readFileSync(migrateFilePath, "utf8").includes("TODO(tailor-migration-review)")) unreviewed.push(file.number);
+		if (diff.hasWarnings && !diff.scriptSkipped && !hasScript) unacknowledgedWarnings.push({
+			migrationNumber: file.number,
+			warnings: diff.warnings
+		});
 	}
 	if (missing.length > 0) throw new Error(`Migration(s) ${missing.map(formatMigrationNumber).join(", ")} in namespace "${namespace}" require a migration script but have no migrate.ts. Add one with 'tailor tailordb migration script <number>', or record that no script is needed with 'tailor tailordb migration script <number> --no-script --reason "..."'.`);
+	if (unreviewed.length > 0) throw new Error(`Migration(s) ${unreviewed.map(formatMigrationNumber).join(", ")} in namespace "${namespace}" contain generated normalization logic that still requires review in migrate.ts. Review each ${MIGRATION_REVIEW_REQUIRED_MARKER} marker, then remove the marker and its associated \`never\` annotation.`);
+	return unacknowledgedWarnings;
 }
 /**
 * Build per-namespace reports from the checks that completed
@@ -6025,7 +6777,7 @@ function assertRequiredMigrationScripts(migrationsDir, namespace) {
 * @returns {NamespaceValidationReport[]} Validation reports per namespace
 */
 function buildValidationReports(options) {
-	const { targetNamespaces, migrationFileErrors, localResults, remoteResults } = options;
+	const { targetNamespaces, migrationFileErrors, localResults, remoteResults, unacknowledgedWarnings } = options;
 	return targetNamespaces.map((target) => {
 		const fileError = migrationFileErrors.get(target.namespace);
 		if (fileError !== void 0) return {
@@ -6055,14 +6807,25 @@ function buildValidationReports(options) {
 			hasDrift: remote.hasDrift,
 			drifts: remote.drifts,
 			...remote.skipped ? { skipped: remote.skipped } : {},
-			...checkpointMissingLocal ? { checkpointMissingLocal: true } : {}
+			...checkpointMissingLocal ? { checkpointMissingLocal: true } : {},
+			...remote.checkpointRepair ? { checkpointRepair: remote.checkpointRepair } : {}
 		};
+		const candidates = unacknowledgedWarnings?.get(target.namespace);
+		let warningAcknowledgments;
+		if (candidates !== void 0) {
+			const missing = candidates.filter((candidate) => candidate.migrationNumber > remote.remoteMigrationNumber);
+			warningAcknowledgments = {
+				valid: missing.length === 0,
+				missing
+			};
+		}
 		return {
 			namespace: target.namespace,
-			valid: !localSchema.hasDiff && !remoteSchema.hasDrift && !checkpointMissingLocal,
+			valid: !localSchema.hasDiff && !remoteSchema.hasDrift && !checkpointMissingLocal && warningAcknowledgments?.valid !== false,
 			migrationFiles: { valid: true },
 			localSchema,
-			remoteSchema
+			remoteSchema,
+			...warningAcknowledgments ? { warningAcknowledgments } : {}
 		};
 	});
 }
@@ -6078,7 +6841,7 @@ async function collectValidationReports(options) {
 	const targetNamespaces = options.namespace ? namespacesWithMigrations.filter((ns) => ns.namespace === options.namespace) : namespacesWithMigrations;
 	if (targetNamespaces.length === 0) throw new Error(`Namespace "${options.namespace}" not found or does not have migrations configured`);
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication } = await import("../application-CXNaUNhv.mjs");
+	const { defineApplication } = await import("../application-BxLLiLsr.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -6093,10 +6856,12 @@ async function collectValidationReports(options) {
 	const typesByNamespace = new Map(tailorDBInputs.map((input) => [input.namespace, input.types]));
 	const migrationFileErrors = /* @__PURE__ */ new Map();
 	const checkableNamespaces = [];
+	const unacknowledgedWarnings = options.strict ? /* @__PURE__ */ new Map() : void 0;
 	for (const target of targetNamespaces) try {
 		assertValidMigrationFiles(target.migrationsDir, target.namespace);
 		reconstructSnapshotFromMigrations(target.migrationsDir);
-		assertRequiredMigrationScripts(target.migrationsDir, target.namespace);
+		const namespaceWarnings = assertMigrationScriptsReady(target.migrationsDir, target.namespace);
+		unacknowledgedWarnings?.set(target.namespace, namespaceWarnings);
 		checkableNamespaces.push(target);
 	} catch (error) {
 		migrationFileErrors.set(target.namespace, error instanceof Error ? error.message : String(error));
@@ -6104,7 +6869,8 @@ async function collectValidationReports(options) {
 	const localReportOptions = {
 		targetNamespaces,
 		migrationFileErrors,
-		localResults: await checkMigrationDiffs(typesByNamespace, checkableNamespaces)
+		localResults: await checkMigrationDiffs(typesByNamespace, checkableNamespaces),
+		...unacknowledgedWarnings ? { unacknowledgedWarnings } : {}
 	};
 	if (checkableNamespaces.length === 0) return { reports: buildValidationReports(localReportOptions) };
 	let remoteResults;
@@ -6143,6 +6909,7 @@ function printValidationReports(reports) {
 		else logger.log(`  Local schema: ${styles.success("OK")}`);
 		const remote = report.remoteSchema;
 		if (remote?.skipped === "check_failed") logger.log(`  Remote schema: ${styles.error("not checked")}`);
+		else if (remote?.checkpointRepair) logger.log(`  Remote schema: ${styles.success("OK")} (next deploy will reset the checkpoint to 0000 from ${formatMigrationNumber(remote.checkpointRepair.from)})`);
 		else if (remote?.checkpointMissingLocal) logger.log(`  Remote schema: ${styles.error(`remote migration ${formatMigrationNumber(remote.remoteMigrationNumber)} is not in the local migration history`)}`);
 		else if (remote?.hasDrift) {
 			logger.log(`  Remote schema: ${styles.error("drift detected")} (remote migration: ${formatMigrationNumber(remote.remoteMigrationNumber)})`);
@@ -6151,14 +6918,36 @@ function printValidationReports(reports) {
 		else if (remote?.skipped === "no_migration_label") logger.log(`  Remote schema: ${styles.dim("skipped (deployed namespace has no migration state)")}`);
 		else if (remote?.skipped === "no_snapshot") logger.log(`  Remote schema: ${styles.dim(`skipped (no local snapshot for remote migration ${formatMigrationNumber(remote.remoteMigrationNumber)})`)}`);
 		else if (remote) logger.log(`  Remote schema: ${styles.success("OK")} (remote migration: ${formatMigrationNumber(remote.remoteMigrationNumber)})`);
+		const acknowledgments = report.warningAcknowledgments;
+		if (acknowledgments) if (acknowledgments.valid) logger.log(`  Warning acknowledgments: ${styles.success("OK")}`);
+		else {
+			logger.log(`  Warning acknowledgments: ${styles.error("missing for pending migration(s) with possible data loss")}`);
+			for (const migration of acknowledgments.missing) {
+				const label = formatMigrationNumber(migration.migrationNumber);
+				for (const warning of migration.warnings) {
+					const field = warning.fieldName ? `.${warning.fieldName}` : "";
+					logger.log(`    ${label}: ${warning.typeName}${field}: ${warning.reason}`);
+				}
+			}
+		}
 	}
 	logger.newline();
 }
-function printResolutionHints(reports) {
+function printResolutionHints(reports, configPath) {
 	if (reports.some((r) => r.localSchema?.hasDiff && !r.localSchema.diff)) logger.info("Run 'tailor tailordb migration generate' to create the initial snapshot.");
 	if (reports.some((r) => r.localSchema?.diff)) logger.info("Run 'tailor tailordb migration generate' to create migration files.");
 	if (reports.some((r) => r.remoteSchema?.checkpointMissingLocal)) logger.info("The remote migration checkpoint is ahead of the local history. Pull the latest migration files, or run 'tailor tailordb migration status' to compare.");
 	if (reports.some((r) => r.remoteSchema?.hasDrift)) logRemoteDriftGuidance();
+	const missingAcknowledgments = reports.filter((r) => r.warningAcknowledgments && !r.warningAcknowledgments.valid);
+	if (missingAcknowledgments.length > 0) {
+		logger.info("For each migration listed, either add a data migration script with 'tailor tailordb migration script <number>' or record why none is needed:");
+		for (const report of missingAcknowledgments) for (const migration of report.warningAcknowledgments?.missing ?? []) logger.info(`  ${formatMigrationScriptCommand({
+			migrationNumber: migration.migrationNumber,
+			namespace: report.namespace,
+			configPath,
+			noScript: true
+		})}`, { mode: "plain" });
+	}
 }
 /**
 * Validate migration files and schema state without deploying
@@ -6173,20 +6962,21 @@ async function validate(options) {
 	else {
 		printValidationReports(reports);
 		if (invalidCount === 0 && !("remoteError" in collected)) logger.success("All migration validation checks passed.");
-		else printResolutionHints(reports);
+		else printResolutionHints(reports, options.configPath);
 	}
 	if ("remoteError" in collected) throw collected.remoteError;
 	if (invalidCount > 0) throw new Error(`Migration validation failed for ${invalidCount} namespace(s)`);
 }
 const validateCommand = defineAppCommand({
 	name: "validate",
-	description: "Validate the full migration history and detect schema drift (local types vs. migration snapshot, remote schema vs. migration checkpoint) without deploying. This includes the migration and schema-drift checks used by 'deploy' and exits with a non-zero code when issues are found.",
+	description: "Validate the full migration history, unreviewed generated migration scripts, and schema drift (local types vs. migration snapshot, remote schema vs. migration checkpoint) without deploying. This includes the migration and schema-drift checks used by 'deploy' and exits with a non-zero code when issues are found.",
 	args: z.strictObject({
 		...deploymentArgs,
 		namespace: arg(z.string().optional(), {
 			alias: "n",
 			description: "Target TailorDB namespace (validates all namespaces if not specified)"
-		})
+		}),
+		strict: arg(z.boolean().default(false), { description: "Also fail when a pending migration can drop data without an acknowledgment" })
 	}),
 	run: async (args) => {
 		await validate({
@@ -6194,7 +6984,8 @@ const validateCommand = defineAppCommand({
 			namespace: args.namespace,
 			workspaceId: args["workspace-id"],
 			profile: args.profile,
-			json: logger.jsonMode
+			json: logger.jsonMode,
+			strict: args.strict
 		});
 	}
 });
@@ -6206,10 +6997,12 @@ const validateCommand = defineAppCommand({
 *
 * Subcommands:
 * - generate: Generate migration files from schema differences
+* - rebaseline: Collapse the full migration history into a new baseline
 * - script:   Add a migrate.ts template to an existing migration
 * - set:      Set migration checkpoint to a specific number
 * - status:   Show migration status for TailorDB namespaces
 * - sync:     Sync remote TailorDB schema to a specific migration snapshot
+* - test:     Test pending migrations in an isolated workspace
 * - validate: Validate migration files and detect schema drift without deploying
 */
 const migrationCommand = defineCommand({
@@ -6217,10 +7010,12 @@ const migrationCommand = defineCommand({
 	description: "Manage TailorDB schema migrations.",
 	subCommands: {
 		generate: generateCommand$1,
+		rebaseline: rebaselineCommand,
 		script: scriptCommand,
 		set: setCommand,
 		status: statusCommand,
 		sync: syncCommand,
+		test: testCommand,
 		validate: validateCommand
 	}
 });
@@ -6256,7 +7051,7 @@ const upgradeCommand = defineAppCommand({
 	run: async (args) => {
 		const { initTelemetry } = await import("../telemetry-CkbkeJxl.mjs");
 		await initTelemetry();
-		const { upgrade } = await import("../service-B5WynBHQ.mjs");
+		const { upgrade } = await import("../service-CCwl3Avt.mjs");
 		await upgrade({
 			from: args.from,
 			dryRun: args["dry-run"],
@@ -6763,7 +7558,7 @@ runMain(mainCommand, {
 				if (isVerbose() && error.stack) logger.debug(`\nStack trace:\n${error.stack}`);
 			} else logger.error(`Unknown error: ${error}`);
 			if (!isCLIError(error) && (!(error instanceof Error) || error instanceof TypeError || error instanceof RangeError)) {
-				const { reportCrash } = await import("../crashreport-eI7ty7ok.mjs");
+				const { reportCrash } = await import("../crashreport-CINZ5dVN.mjs");
 				await reportCrash(error, "handledError");
 			}
 		}