@tailor-platform/sdk 2.3.0 → 2.4.0

package/dist/cli/main.mjs

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
-import { r as parseInputFields } from "../schema--xYWRGfe.mjs";
+import { r as parseInputFields } from "../schema-D4TC4BC3.mjs";
 import { At as PATScope, Ct as AuthInvokerSchema, E as CustomDomainStatus, Ft as CloneOperationStatus, W as FunctionExecution_Type } from "../workspace_resource_pb-HNIL_Vfj.mjs";
 import { t as assertDefined } from "../assert-DBxo8jPo.mjs";
-import { n as logger, r as styles } from "../logger-DSdExfor.mjs";
-import { $ as treeCommand, $n as sanitizeMigrationLabel, An as MIGRATION_FILE_NAMES, Ar as readPlatformConfig, B as MIGRATION_REVIEW_REQUIRED_MARKER, Bn as getLatestMigrationNumber, Br as deploymentArgs, Bt as getCommand$6, C as healthCommand, Cn as captureFileState, Cr as loadConfigPath, Ct as listCommand$9, Dr as loadStoredUserTokens, E as resumeCommand, Er as loadPlatformClientConfig, F as chunkSeedData, Fn as assertValidMigrationFiles, Fr as writePlatformConfig, Ft as jobsCommand, G as showCommand, Gn as loadDiff, Gr as resolveMachineUserInputSource, Gt as functionExecutionStatusToString, H as deployCommand$1, Hn as getMigrationFilePath, Hr as multiConfigArg, Ht as executionsCommand, I as bundleSeedScript, In as compareLocalTypesWithSnapshot, Ir as defineAppCommand, Jn as reconstructSnapshotFromMigrations, K as extractOwnedNamespaces, Kn as loadSnapshot, Kr as toPageDirection, Kt as getCommand$1, Ln as compareSnapshots, Lr as commonArgs, M as loadSeedContext, Mr as resolveConfigUser, N as loadApplicationNamespaces, Nn as UnsupportedMigrationFileVersionError, Nr as resolveUserTokenKey, O as listCommand$14, Or as loadWorkspaceId, Ot as webhookCommand, Pn as assertMigrationNumberExists, Pr as saveUserTokens, Qn as handleOptionalToRequiredError, Qt as listCommand$17, R as generateCommand$1, Rn as createSnapshotFromLocalTypes, Rr as configArg, Rt as startCommand, Sn as protoGqlPermission, Sr as loadAccessToken, St as generate, Tr as loadMachineUserName, Tt as getCommand$2, Un as getMigrationFiles, Ur as pagedLogArgs, V as generateSchemaFile, Vr as isVerbose, Wr as paginationArgs, X as updateCommand$3, Xn as MIGRATION_LABEL_KEY, Xt as deployMigrationTestBaseline, Y as removeCommand$1, Yn as MIGRATION_HISTORY_LABEL_KEY, Yt as deployFromCLI, Zn as createMigrationHistoryId, Zt as deployMigrationTestTarget, _n as verifyRemoteSchema, _r as loadConfig, a as queryCommand, an as ensureConfigId, ar as resourceTrn, bn as compareSnapshotWithRemote, br as hasAnyUserTokenEntry, bt as listCommand$10, c as removeCommand, cn as executeScript, cr as sdkVersionLabelKey, ct as getCommand$4, dn as bundleMigrationScript, en as createCommand$4, er as formatDiffSummary, et as listCommand$13, f as inviteCommand, fn as checkMigrationDiffs, fr as formatMigrationNumber, ft as createCommand$3, g as getCommand$7, gn as toTailorDBDeployInput, gr as assertWritable, gt as getCommand$3, hn as logRemoteDriftGuidance, hr as apiCall, in as workspaceNameSchema, ir as selectTargetNamespace, it as updateCommand$2, j as truncateCommand, jn as MIGRATION_NUMBER_PATTERN, jr as removeLegacyUserAlias, jt as listCommand$8, kr as platformConfigFromProfile, kt as triggerCommand, lr as writeMetadataLabels, m as restoreCommand, mn as formatRemoteVerificationResults, mr as prompt, mt as listCommand$11, nr as hasChanges, nt as getCommand$5, o as updateCommand$4, on as getMigrationMachineUser, or as sdkAppIdLabelKey, ot as listCommand$12, pn as fetchRemoteSchemaSnapshot, pr as parseMigrationNumberArg, q as logBetaWarning, qn as normalizeSchemaSnapshot, qr as workspaceArgs, r as serializeError, rn as formatKeyValueTable, rr as getNamespacesWithMigrations, sn as updateMigrationLabel, sr as sdkNameLabelKey, t as registerTsHook, tn as createValidatedWorkspaceWithClient, tr as formatMigrationDiff, u as listCommand$16, un as formatMigrationScriptCommand, ur as PluginManager, ut as deleteCommand$4, v as deleteCommand$5, vn as fetchRemoteMigrationNumber, vr as deleteUserTokens, w as waitCommand, wn as captureMigrationFileState, wr as loadConsoleBaseUrl, x as listCommand$15, xn as generateAllTypeManifestsFromSnapshot, xr as hasUserTokenEntry, yn as fetchRemoteMigrationState, yr as fetchLatestToken, yt as tokenCommand$1, z as scriptCommand, zn as formatSchemaDrifts, zr as confirmationArgs } from "../register-ts-hook-ClI226n2.mjs";
-import { B as fetchPaged, C as resolveTSConfigWithFallback, D as resolveBundleLogLevel, E as createLogLevelTreeshakeOptions, F as closeConnectionPool, G as getOrNull, H as fetchUserInfo, I as defaultPlatformBaseUrl, J as initOperatorClient, K as getPlatformBaseUrl, L as fetchAll, M as getDistDir, O as createBundleLog, R as fetchAllTolerant, S as createTsconfigPathsPlugin, T as composeFunctionTreeshakeOptions, V as fetchPlatformMachineUserToken, W as getOAuth2ClientId, Y as isDefaultPlatform, a as resolveInlineSourcemap, c as WorkflowJobSchema, f as INVOKER_EXPR, g as assertUniqueLocalTailorDBTypeNames, h as buildResolverPermissionAndInputCheckExpr, l as resolveResolverDefaultPermissionForFile, q as initOAuth2Client, u as ResolverSchema, w as platformBundleDefinePlugin, x as createGeneratedEntryResolverPlugin } from "../application-F-nl107y.mjs";
-import { h as loadFilesWithIgnores, i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-C_WpbKHu.mjs";
+import { n as logger, r as styles } from "../logger-D0bEznPv.mjs";
+import { $ as treeCommand, $n as sanitizeMigrationLabel, An as MIGRATION_FILE_NAMES, Ar as readPlatformConfig, B as MIGRATION_REVIEW_REQUIRED_MARKER, Bn as getLatestMigrationNumber, Br as deploymentArgs, Bt as getCommand$6, C as healthCommand, Cn as captureFileState, Cr as loadConfigPath, Ct as listCommand$9, Dr as loadStoredUserTokens, E as resumeCommand, Er as loadPlatformClientConfig, F as chunkSeedData, Fn as assertValidMigrationFiles, Fr as writePlatformConfig, Ft as jobsCommand, G as showCommand, Gn as loadDiff, Gr as resolveMachineUserInputSource, Gt as functionExecutionStatusToString, H as deployCommand$1, Hn as getMigrationFilePath, Hr as multiConfigArg, Ht as executionsCommand, I as bundleSeedScript, In as compareLocalTypesWithSnapshot, Ir as defineAppCommand, Jn as reconstructSnapshotFromMigrations, K as extractOwnedNamespaces, Kn as loadSnapshot, Kr as toPageDirection, Kt as getCommand$1, Ln as compareSnapshots, Lr as commonArgs, M as loadSeedContext, Mr as resolveConfigUser, N as loadApplicationNamespaces, Nn as UnsupportedMigrationFileVersionError, Nr as resolveUserTokenKey, O as listCommand$14, Or as loadWorkspaceId, Ot as webhookCommand, Pn as assertMigrationNumberExists, Pr as saveUserTokens, Qn as handleOptionalToRequiredError, Qt as listCommand$17, R as generateCommand$1, Rn as createSnapshotFromLocalTypes, Rr as configArg, Rt as startCommand, Sn as protoGqlPermission, Sr as loadAccessToken, St as generate, Tr as loadMachineUserName, Tt as getCommand$2, Un as getMigrationFiles, Ur as pagedLogArgs, V as generateSchemaFile, Vr as isVerbose, Wr as paginationArgs, X as updateCommand$3, Xn as MIGRATION_LABEL_KEY, Xt as deployMigrationTestBaseline, Y as removeCommand$1, Yn as MIGRATION_HISTORY_LABEL_KEY, Yt as deployFromCLI, Zn as createMigrationHistoryId, Zt as deployMigrationTestTarget, _n as verifyRemoteSchema, _r as loadConfig, a as queryCommand, an as ensureConfigId, ar as resourceTrn, bn as compareSnapshotWithRemote, br as hasAnyUserTokenEntry, bt as listCommand$10, c as removeCommand, cn as executeScript, cr as sdkVersionLabelKey, ct as getCommand$4, dn as bundleMigrationScript, en as createCommand$4, er as formatDiffSummary, et as listCommand$13, f as inviteCommand, fn as checkMigrationDiffs, fr as formatMigrationNumber, ft as createCommand$3, g as getCommand$7, gn as toTailorDBDeployInput, gr as assertWritable, gt as getCommand$3, hn as logRemoteDriftGuidance, hr as apiCall, in as workspaceNameSchema, ir as selectTargetNamespace, it as updateCommand$2, j as truncateCommand, jn as MIGRATION_NUMBER_PATTERN, jr as removeLegacyUserAlias, jt as listCommand$8, kr as platformConfigFromProfile, kt as triggerCommand, lr as writeMetadataLabels, m as restoreCommand, mn as formatRemoteVerificationResults, mr as prompt, mt as listCommand$11, nr as hasChanges, nt as getCommand$5, o as updateCommand$4, on as getMigrationMachineUser, or as sdkAppIdLabelKey, ot as listCommand$12, pn as fetchRemoteSchemaSnapshot, pr as parseMigrationNumberArg, q as logBetaWarning, qn as normalizeSchemaSnapshot, qr as workspaceArgs, r as serializeError, rn as formatKeyValueTable, rr as getNamespacesWithMigrations, sn as updateMigrationLabel, sr as sdkNameLabelKey, t as registerTsHook, tn as createValidatedWorkspaceWithClient, tr as formatMigrationDiff, u as listCommand$16, un as formatMigrationScriptCommand, ur as PluginManager, ut as deleteCommand$4, v as deleteCommand$5, vn as fetchRemoteMigrationNumber, vr as deleteUserTokens, w as waitCommand, wn as captureMigrationFileState, wr as loadConsoleBaseUrl, x as listCommand$15, xn as generateAllTypeManifestsFromSnapshot, xr as hasUserTokenEntry, yn as fetchRemoteMigrationState, yr as fetchLatestToken, yt as tokenCommand$1, z as scriptCommand, zn as formatSchemaDrifts, zr as confirmationArgs } from "../register-ts-hook-Vqjza10T.mjs";
+import { C as createTsconfigPathsPlugin, D as createLogLevelTreeshakeOptions, E as composeFunctionTreeshakeOptions, G as getOAuth2ClientId, H as fetchPlatformMachineUserToken, I as closeConnectionPool, J as initOAuth2Client, K as getOrNull, L as defaultPlatformBaseUrl, N as getDistDir, O as resolveBundleLogLevel, R as fetchAll, S as createGeneratedEntryResolverPlugin, T as platformBundleDefinePlugin, U as fetchUserInfo, V as fetchPaged, X as isDefaultPlatform, Y as initOperatorClient, _ as assertUniqueLocalTailorDBTypeNames, a as resolveInlineSourcemap, d as ResolverSchema, g as buildResolverPermissionAndInputCheckExpr, k as createBundleLog, l as WorkflowJobSchema, p as INVOKER_EXPR, q as getPlatformBaseUrl, u as resolveResolverDefaultPermissionForFile, w as resolveTSConfigWithFallback, z as fetchAllTolerant } from "../application-C8a0UJ-z.mjs";
+import { h as loadFilesWithIgnores, i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-2grcAOCJ.mjs";
 import { t as multiline } from "../multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "../package-json-8b0O9TlX.mjs";
 import { t as userAgent } from "../user-agent-Bgsszb5I.mjs";
-import { a as typeOnlyImportHint, i as isCLIError, r as formatNextAction, t as createCLIError } from "../errors-BVb6vYGy.mjs";
+import { a as typeOnlyImportHint, i as isCLIError, r as formatNextAction, t as createCLIError } from "../errors-Bxut5_Sy.mjs";
 import { t as OperatorService } from "../service_pb-BEWj1pOV.mjs";
-import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-CIIfLnoO.mjs";
+import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-Q0pDAlrj.mjs";
 import * as path from "pathe";
 import { dirname, resolve } from "pathe";
 import { resolvePackageJSON } from "pkg-types";
@@ -650,7 +650,8 @@ const authorizeAuthConnectionCommand = defineAppCommand({
 	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
@@ -713,7 +714,7 @@ const authorizeAuthConnectionCommand = defineAppCommand({
 			const timeout = setTimeout(() => {
 				server.close();
 				reject(/* @__PURE__ */ new Error("Authorization timeout exceeded (5 minutes)."));
-			}, 300 * 1e3);
+			}, 3e5);
 			server.on("close", () => {
 				clearTimeout(timeout);
 			});
@@ -751,7 +752,8 @@ const deleteAuthConnectionCommand = defineAppCommand({
 	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
@@ -798,7 +800,8 @@ const listAuthConnectionCommand = defineAppCommand({
 		...paginationArgs()
 	}),
 	run: async (args) => {
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
@@ -878,7 +881,8 @@ const revokeAuthConnectionCommand = defineAppCommand({
 	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
@@ -1196,7 +1200,7 @@ async function downloadFunctionScript(options) {
 //#region src/cli/shared/stack-trace.ts
 /**
 * Stack trace parsing, sourcemap-based source identification, and
-* formatted error display for the test-run command.
+* formatted error display for the function run command.
 *
 * The platform runtime automatically applies inline sourcemaps to V8
 * stack traces, so frame positions are already original source positions.
@@ -1246,7 +1250,8 @@ function extractInlineSourcemap(bundledCode) {
 	if (!match) return null;
 	try {
 		const decoded = Buffer.from(assertDefined(match[1], "sourcemap base64 data missing"), "base64").toString("utf-8");
-		return new TraceMap(JSON.parse(decoded));
+		const rawSourceMap = JSON.parse(decoded);
+		return new TraceMap(rawSourceMap);
 	} catch {
 		return null;
 	}
@@ -1396,7 +1401,7 @@ function formatMappedError(errorMessage, frames, traceMap, bundleDir) {
 }
 /**
 * Format an error string with sourcemap-based source locations.
-* This is the main entry point for test-run error display.
+* This is the main entry point for function run error display.
 *
 * The platform runtime applies inline sourcemaps automatically, so V8
 * stack frames already contain original source positions. This function
@@ -1510,7 +1515,8 @@ function formatExecutionErrorFallback(error) {
 */
 function formatExecutionError(error, bundledCode) {
 	if (bundledCode && error.stackTrace) {
-		const formatted = formatErrorWithSourcemap(composeExecutionErrorString(error), bundledCode, process.cwd());
+		const errorString = composeExecutionErrorString(error);
+		const formatted = formatErrorWithSourcemap(errorString, bundledCode, process.cwd());
 		if (formatted) return formatted;
 	}
 	return formatExecutionErrorFallback(error);
@@ -1576,7 +1582,7 @@ async function downloadScriptForMapping(options) {
 	const { client, workspaceId, scriptName, executionType, executionContentHash } = options;
 	const registryName = scriptNameToRegistryName(scriptName, executionType);
 	if (registryName == null) {
-		logger.debug(`Script "${scriptName}" is not a deployed registry script (e.g. test-run or seed); skipping sourcemap mapping.`);
+		logger.debug(`Script "${scriptName}" is not a deployed registry script (e.g. function run or seed); skipping sourcemap mapping.`);
 		return null;
 	}
 	if (executionContentHash === "") {
@@ -1598,7 +1604,7 @@ async function downloadScriptForMapping(options) {
 const logsCommand = defineAppCommand({
 	name: "logs",
 	description: "List or get function execution logs.",
-	notes: `When viewing a specific execution that failed, the command displays error details with the stack trace mapped back to your original source files (clickable file links and code snippets, matching \`function test-run\` output).
+	notes: `When viewing a specific execution that failed, the command displays error details with the stack trace mapped back to your original source files (clickable file links and code snippets, matching \`function run\` output).
 
 Stack traces are mapped only when the execution includes a content hash for the exact build that ran. If the content hash is missing or the build is no longer available, the command falls back to a plain-text error display.`,
 	examples: [
@@ -1628,7 +1634,8 @@ Stack traces are mapped only when the execution includes a content hash for the
 		})
 	}),
 	run: async (args) => {
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
@@ -1674,18 +1681,18 @@ Stack traces are mapped only when the execution includes a content hash for the
 //#endregion
 //#region src/cli/commands/function/bundle.ts
 /**
-* Bundler for function test-run command
+* Bundler for the function run command
 *
 * Bundles a single function file for execution via the TestExecScript API.
 * Generates an entry file based on the detected function type and bundles
 * with rolldown, following the same patterns as the existing bundlers.
 */
 /**
-* Bundle a function file for test-run execution via TestExecScript API.
+* Bundle a function file for `function run` execution via the TestExecScript API.
 * @param options - Bundle options
 * @returns Bundled code and script name
 */
-async function bundleForTestRun(options) {
+async function bundleForRun(options) {
 	const { detected, sourceFile, baseDir, env = {}, machineUser, workspaceId } = options;
 	const inlineSourcemap = resolveInlineSourcemap(options.inlineSourcemap);
 	const bundleLogLevel = resolveBundleLogLevel(options.logLevel);
@@ -1820,7 +1827,7 @@ function buildMachinePrincipalExpr(machineUser, workspaceId) {
 //#endregion
 //#region src/cli/commands/function/detect.ts
 /**
-* Function type detection for test-run command
+* Function type detection for the function run command
 *
 * Detects the function type (resolver, executor, workflow job, or plain function)
 * by dynamically importing the module and checking against known schemas.
@@ -1932,15 +1939,16 @@ function deriveNameFromPath(filePath) {
 }
 
 //#endregion
-//#region src/cli/commands/function/test-run.ts
+//#region src/cli/commands/function/run.ts
 /**
-* `tailor function test-run` command
+* `tailor function run` command
 *
 * Bundles and executes a function on the Tailor Platform server
 * without deploying (applying) the application.
 */
-const testRunCommand = defineAppCommand({
-	name: "test-run",
+const runFunctionCommand = defineAppCommand({
+	name: "run",
+	aliases: ["test-run"],
 	description: "Run a function on the Tailor Platform server without deploying.",
 	args: z.object({
 		...workspaceArgs,
@@ -1969,8 +1977,10 @@ const testRunCommand = defineAppCommand({
 	notes: `You can pass either a source file (\`.ts\`) or a pre-bundled file (\`.js\`).
 When a \`.js\` file is provided, detection and bundling are skipped and the file is executed as-is.
 
+\`test-run\` is a deprecated alias of this command and will be removed in v3.
+
 > [!WARNING]
-> Workflow job \`.start()\` calls do not work in test-run mode.
+> Workflow job \`.start()\` calls do not work in this mode.
 > Started jobs are not executed; only the target job's \`body\` function runs in isolation.`,
 	examples: [
 		{
@@ -1987,6 +1997,7 @@ When a \`.js\` file is provided, detection and bundling are skipped and the file
 		}
 	],
 	run: async (args) => {
+		if (invokedViaTestRunAlias(process.argv)) logger.warn("`tailor function test-run` is deprecated and will be removed in v3. Use `tailor function run` instead.");
 		const jsonOutput = logger.jsonMode;
 		const filePath = path.resolve(args.file);
 		if (!fs.existsSync(filePath)) throw new Error(`File not found: ${filePath}`);
@@ -1998,7 +2009,8 @@ When a \`.js\` file is provided, detection and bundling are skipped and the file
 			profile: args.profile,
 			authConfig: config.auth
 		});
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
@@ -2035,7 +2047,7 @@ When a \`.js\` file is provided, detection and bundling are skipped and the file
 			}
 			logger.info("Bundling...");
 			const baseDir = path.dirname(config.path);
-			({bundledCode, scriptName} = await bundleForTestRun({
+			({bundledCode, scriptName} = await bundleForRun({
 				detected,
 				sourceFile: filePath,
 				baseDir,
@@ -2107,6 +2119,16 @@ When a \`.js\` file is provided, detection and bundling are skipped and the file
 	}
 });
 /**
+* Detect whether the command was invoked through the deprecated `test-run`
+* alias. politty resolves aliases before dispatch, so the invoked name is only
+* observable from the raw argv.
+* @param argv - Process argv tokens
+* @returns true when the `test-run` alias follows the `function` subcommand
+*/
+function invokedViaTestRunAlias(argv) {
+	return argv.some((token, i) => token === "function" && argv[i + 1] === "test-run");
+}
+/**
 * Resolve auth namespace from config.
 * @param authConfig - Auth configuration from tailor.config.ts
 * @returns Resolved auth namespace
@@ -2181,7 +2203,7 @@ const functionCommand = defineCommand({
 		get: getCommand$2,
 		list: listCommand$9,
 		logs: logsCommand,
-		"test-run": testRunCommand
+		run: runFunctionCommand
 	},
 	async run() {
 		await runCommand(listCommand$9, []);
@@ -2352,7 +2374,7 @@ const startAuthServer = async (args = {}) => {
 		const timeout = setTimeout(() => {
 			server.close();
 			reject(/* @__PURE__ */ new Error("Login timeout exceeded"));
-		}, 300 * 1e3);
+		}, 3e5);
 		server.on("close", () => {
 			clearTimeout(timeout);
 		});
@@ -3097,7 +3119,7 @@ const createCommand$2 = defineAppCommand({
 		permission: arg(z.enum(["write", "read"]).default("write"), { description: "Profile permission. 'read' blocks all write commands while the profile is active." }),
 		"machine-user": arg(z.string().optional(), {
 			alias: "m",
-			description: "Default machine user name for application-data commands (query, workflow start, function test-run, machineuser token)."
+			description: "Default machine user name for application-data commands (query, workflow start, function run, machineuser token)."
 		}),
 		"machine-user-override": arg(z.enum(["allow", "deny"]).optional(), { description: "Whether the command line or TAILOR_PLATFORM_MACHINE_USER_NAME may override the profile's machine user. 'deny' requires --machine-user." }),
 		"platform-url": arg(z.url().optional(), {
@@ -3238,7 +3260,7 @@ const updateCommand$1 = defineAppCommand({
 		permission: arg(z.enum(["write", "read"]).optional(), { description: "Profile permission. 'read' blocks all write commands; 'write' lifts the restriction." }),
 		"machine-user": arg(z.string().optional(), {
 			alias: "m",
-			description: "Default machine user name for application-data commands (query, workflow start, function test-run, machineuser token). Pass an empty string to clear."
+			description: "Default machine user name for application-data commands (query, workflow start, function run, machineuser token). Pass an empty string to clear."
 		}),
 		"machine-user-override": arg(z.enum(["allow", "deny"]).optional(), { description: "Whether the command line or TAILOR_PLATFORM_MACHINE_USER_NAME may override the profile's machine user. 'deny' requires --machine-user; 'allow' lifts the restriction." }),
 		"platform-url": arg(z.union([z.url(), z.literal("")]).optional(), { description: "Platform API base URL for this profile. Pass an empty string to clear." }),
@@ -3287,16 +3309,24 @@ const updateCommand$1 = defineAppCommand({
 		profile.workspace_id = newWorkspaceId;
 		if (args.permission === "read") profile.readonly = true;
 		else if (args.permission === "write") delete profile.readonly;
-		if (args["machine-user"] !== void 0) if (args["machine-user"] === "") delete profile.machine_user;
-		else profile.machine_user = args["machine-user"];
+		if (args["machine-user"] !== void 0) {
+			if (args["machine-user"] === "") delete profile.machine_user;
+			else profile.machine_user = args["machine-user"];
+		}
 		if (args["machine-user-override"] === "deny") profile.machine_user_override = "deny";
 		else if (args["machine-user-override"] === "allow") delete profile.machine_user_override;
-		if (args["platform-url"] !== void 0) if (args["platform-url"] === "") delete profile.platform_url;
-		else profile.platform_url = args["platform-url"];
-		if (args["oauth2-client-id"] !== void 0) if (args["oauth2-client-id"] === "") delete profile.oauth2_client_id;
-		else profile.oauth2_client_id = args["oauth2-client-id"];
-		if (args["console-url"] !== void 0) if (args["console-url"] === "") delete profile.console_url;
-		else profile.console_url = args["console-url"];
+		if (args["platform-url"] !== void 0) {
+			if (args["platform-url"] === "") delete profile.platform_url;
+			else profile.platform_url = args["platform-url"];
+		}
+		if (args["oauth2-client-id"] !== void 0) {
+			if (args["oauth2-client-id"] === "") delete profile.oauth2_client_id;
+			else profile.oauth2_client_id = args["oauth2-client-id"];
+		}
+		if (args["console-url"] !== void 0) {
+			if (args["console-url"] === "") delete profile.console_url;
+			else profile.console_url = args["console-url"];
+		}
 		writePlatformConfig(config);
 		if (!args.json) logger.success(`Profile "${args.name}" updated successfully`);
 		const profileInfo = {
@@ -3434,7 +3464,8 @@ const createSecretCommand = defineAppCommand({
 	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
@@ -3484,7 +3515,8 @@ const deleteSecretCommand = defineAppCommand({
 	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
@@ -3533,7 +3565,8 @@ function secretInfo(secret) {
 * @returns List of secrets
 */
 async function secretList(options) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
@@ -3587,7 +3620,8 @@ const updateSecretCommand = defineAppCommand({
 	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
@@ -3640,7 +3674,8 @@ const createCommand$1 = defineAppCommand({
 	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
@@ -3670,7 +3705,8 @@ const deleteCommand$2 = defineAppCommand({
 	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
@@ -3715,7 +3751,8 @@ function vaultInfo(vault) {
 * @returns List of vaults
 */
 async function vaultList(options) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options?.profile }));
+	const accessToken = await loadAccessToken({ profile: options?.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options?.workspaceId,
 		profile: options?.profile
@@ -4547,7 +4584,8 @@ function decideAction(obj) {
 	}
 	if (!fileExists) return { action: "restore" };
 	if (currentContent !== null) {
-		if (hashContent(normalize ? normalize(currentContent) : currentContent) === existing.contentHash) return { action: "regenerate" };
+		const normalizedContent = normalize ? normalize(currentContent) : currentContent;
+		if (hashContent(normalizedContent) === existing.contentHash) return { action: "regenerate" };
 	}
 	if (force) return { action: "regenerate" };
 	return {
@@ -5379,7 +5417,8 @@ const domainGetCommand = defineAppCommand({
 		})
 	}),
 	run: async (args) => {
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
@@ -5419,7 +5458,8 @@ const domainListCommand = defineAppCommand({
 		})
 	}),
 	run: async (args) => {
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
@@ -5471,7 +5511,8 @@ const getCommand = defineAppCommand({
 		})
 	}),
 	run: async (args) => {
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
@@ -5506,7 +5547,8 @@ const getCommand = defineAppCommand({
 * @returns List of static websites
 */
 async function listStaticWebsites(options) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options?.profile }));
+	const accessToken = await loadAccessToken({ profile: options?.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options?.workspaceId,
 		profile: options?.profile
@@ -5597,13 +5639,15 @@ async function activateBaseline(migrationsDir, snapshot, namespace, rebaseline)
 				force: true
 			});
 		}
-		loadSnapshot((await generateSchemaFile({
+		const stagedSnapshot = {
 			...snapshot,
 			namespace,
 			version: 5,
 			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 			rebaseline
-		}, stagingDir, 0)).filePath);
+		};
+		const result = await generateSchemaFile(stagedSnapshot, stagingDir, 0);
+		loadSnapshot(result.filePath);
 		await fsPromises.rename(resolvedMigrationsDir, backupDir);
 		movedLiveDirectory = true;
 		try {
@@ -5653,7 +5697,7 @@ async function rebaseline(options) {
 	const currentHistoryId = reconstructSnapshotFromMigrations(target.migrationsDir, 0)?.rebaseline?.historyId ?? null;
 	const initialFileState = captureMigrationFileState([target])[target.namespace];
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication } = await import("../application-BZfk4HKm.mjs");
+	const { defineApplication } = await import("../application-D4zOiLLa.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -5676,7 +5720,8 @@ async function rebaseline(options) {
 	const localSourceFiles = () => [config.path, ...loadFilesWithIgnores(targetService.config, configDir)];
 	assertLocalTypesReady();
 	const initialLocalFileState = captureFileState(localSourceFiles());
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
@@ -5744,7 +5789,7 @@ async function rebaseline(options) {
 	}
 	assertValidMigrationFiles(target.migrationsDir, target.namespace);
 	if (captureMigrationFileState([target])[target.namespace] !== initialFileState) throw new Error("Migration files changed while waiting for confirmation. Run the command again.");
-	if (captureFileState(localSourceFiles()) !== initialLocalFileState) throw new Error("Local TailorDB type or config files changed. Run the command again.");
+	if (captureFileState(localSourceFiles()) !== initialLocalFileState) throw new Error("Local TailorDB table or config files changed. Run the command again.");
 	assertLocalTypesReady();
 	await assertConnectedWorkspaceReady(currentHistoryId, "confirmation");
 	const rebaselineMarker = {
@@ -5794,16 +5839,20 @@ async function set(options) {
 	logBetaWarning("tailordb migration");
 	const migrationNumber = parseMigrationNumberArg(options.number);
 	const { config } = await loadConfig(options.configPath);
-	const target = selectTargetNamespace(getNamespacesWithMigrations(config, path.dirname(config.path)), options.namespace);
+	const configDir = path.dirname(config.path);
+	const namespacesWithMigrations = getNamespacesWithMigrations(config, configDir);
+	const target = selectTargetNamespace(namespacesWithMigrations, options.namespace);
 	const targetNamespace = target.namespace;
 	assertValidMigrationFiles(target.migrationsDir, targetNamespace);
 	assertMigrationNumberExists(target.migrationsDir, migrationNumber);
 	const historyId = reconstructSnapshotFromMigrations(target.migrationsDir, 0)?.rebaseline?.historyId;
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
-	const trn = resourceTrn(await loadWorkspaceId({
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
+	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
-	}), "tailordb", targetNamespace);
+	});
+	const trn = resourceTrn(workspaceId, "tailordb", targetNamespace);
 	const currentState = await fetchRemoteMigrationState(client, trn);
 	const current = currentState.number;
 	const currentMigration = current ?? 0;
@@ -5882,7 +5931,8 @@ function isStatusFailure(row) {
 }
 async function collectMigrationStatuses(options) {
 	const { config } = await loadConfig(options.configPath);
-	const namespacesWithMigrations = getNamespacesWithMigrations(config, path.dirname(config.path));
+	const configDir = path.dirname(config.path);
+	const namespacesWithMigrations = getNamespacesWithMigrations(config, configDir);
 	if (namespacesWithMigrations.length === 0) throw new Error("No TailorDB services with migrations configuration found");
 	const targetNamespaces = options.namespace ? namespacesWithMigrations.filter((ns) => ns.namespace === options.namespace) : namespacesWithMigrations;
 	if (targetNamespaces.length === 0) throw new Error(`Namespace "${options.namespace}" not found or does not have migrations configured`);
@@ -5918,7 +5968,8 @@ async function collectMigrationStatuses(options) {
 		namespace,
 		error: localFailures.get(namespace) ?? "Failed to read local migration history."
 	}));
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
@@ -6091,7 +6142,7 @@ async function fetchRemoteTypes(client, workspaceId, namespace) {
 async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	const { config, plugins } = loaded;
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-BZfk4HKm.mjs");
+	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-D4zOiLLa.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -6103,7 +6154,7 @@ async function assertMigrationsReproduceLocalTypes(loaded, target) {
 		await service.processNamespacePlugins();
 	}
 	const pluginExecutorFiles = generatePluginFilesIfNeeded(pluginManager, application.tailorDBServices, config.path);
-	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-D1RCdzIL.mjs")).createExecutorService({
+	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-CaBPNDIZ.mjs")).createExecutorService({
 		config: { files: [] },
 		baseDir: path.dirname(config.path)
 	}) : void 0);
@@ -6117,14 +6168,15 @@ async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	};
 	const latestSnapshot = reconstructSnapshotFromMigrations(target.migrationsDir);
 	if (!latestSnapshot) return manifestOptions;
-	const diff = compareLocalTypesWithSnapshot(latestSnapshot, createSnapshotFromLocalTypes(tailordbService.types, target.namespace).tables, target.namespace);
+	const currentSnapshot = createSnapshotFromLocalTypes(tailordbService.types, target.namespace);
+	const diff = compareLocalTypesWithSnapshot(latestSnapshot, currentSnapshot.tables, target.namespace);
 	if (!hasChanges(diff)) return manifestOptions;
 	logger.error(`Migration history does not reproduce the current local schema for namespace ${styles.bold(target.namespace)}:`);
 	logger.log(formatMigrationDiff(diff));
 	logger.newline();
 	logger.info("This usually means one of the following:");
-	logger.info("  - Migration files were edited and replaying them no longer matches the type definitions — fix the migration files.", { mode: "plain" });
-	logger.info("  - Type definitions changed without a new migration — run 'tailor tailordb migration generate' first.", { mode: "plain" });
+	logger.info("  - Migration files were edited and replaying them no longer matches the table definitions — fix the migration files.", { mode: "plain" });
+	logger.info("  - Table definitions changed without a new migration — run 'tailor tailordb migration generate' first.", { mode: "plain" });
 	logger.newline();
 	throw new Error("Refusing to sync: the migration history must reproduce the current local schema before it can be applied to the remote.");
 }
@@ -6148,13 +6200,16 @@ async function sync(options) {
 	const targetVersion = parseMigrationNumberArg(options.number);
 	const loaded = await loadConfig(options.configPath);
 	const { config } = loaded;
-	const target = selectTargetNamespace(getNamespacesWithMigrations(config, path.dirname(config.path)), options.namespace);
+	const configDir = path.dirname(config.path);
+	const namespacesWithMigrations = getNamespacesWithMigrations(config, configDir);
+	const target = selectTargetNamespace(namespacesWithMigrations, options.namespace);
 	assertValidMigrationFiles(target.migrationsDir, target.namespace);
 	const latest = assertMigrationNumberExists(target.migrationsDir, targetVersion);
 	const snapshot = reconstructSnapshotFromMigrations(target.migrationsDir, targetVersion);
 	if (!snapshot) throw new Error(`No initial schema snapshot found in ${target.migrationsDir}. Expected 0000/schema.json.`);
 	const manifestOptions = await assertMigrationsReproduceLocalTypes(loaded, target);
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
@@ -6162,7 +6217,8 @@ async function sync(options) {
 	const trn = resourceTrn(workspaceId, "tailordb", target.namespace);
 	const current = await fetchRemoteMigrationNumber(client, trn);
 	const remoteTypes = await fetchRemoteTypes(client, workspaceId, target.namespace);
-	const { creates, updates, deletes } = compareSnapshotWithRemote(snapshot, new Set(remoteTypes.map((t) => t.name)));
+	const existingTypeNames = new Set(remoteTypes.map((t) => t.name));
+	const { creates, updates, deletes } = compareSnapshotWithRemote(snapshot, existingTypeNames);
 	const remoteGqlPermissions = await fetchRemoteGqlPermissions(client, workspaceId, target.namespace);
 	const remoteGqlPermissionTypes = new Set(remoteGqlPermissions.map((p) => p.typeName));
 	const desiredGqlPermissions = Object.entries(snapshot.tables).flatMap(([typeName, snapshotType]) => snapshotType.permissions?.gql ? [{
@@ -6175,16 +6231,16 @@ async function sync(options) {
 	logger.info(`Namespace: ${styles.bold(target.namespace)}`);
 	logger.log(`  Current migration: ${current === null ? "<unset>" : styles.bold(formatMigrationNumber(current))}`);
 	logger.log(`  Target migration: ${styles.bold(formatMigrationNumber(targetVersion))}`);
-	logger.log(`  Types to create: ${styles.bold(String(creates.length))}`);
-	logger.log(`  Types to update: ${styles.bold(String(updates.length))}`);
-	logger.log(`  Types to delete: ${styles.bold(String(deletes.length))}`);
+	logger.log(`  Tables to create: ${styles.bold(String(creates.length))}`);
+	logger.log(`  Tables to update: ${styles.bold(String(updates.length))}`);
+	logger.log(`  Tables to delete: ${styles.bold(String(deletes.length))}`);
 	logger.log(`  GQL permissions to set: ${styles.bold(String(desiredGqlPermissions.length))}`);
 	logger.log(`  GQL permissions to delete: ${styles.bold(String(gqlPermissionDeletes.length))}`);
 	logger.newline();
-	if (creates.length + updates.length + deletes.length + desiredGqlPermissions.length + gqlPermissionDeletes.length === 0) logger.info("No types to apply; only the migration label will be updated.");
+	if (creates.length + updates.length + deletes.length + desiredGqlPermissions.length + gqlPermissionDeletes.length === 0) logger.info("No tables to apply; only the migration label will be updated.");
 	else {
-		logger.warn("This operation will overwrite remote TailorDB types to match the selected snapshot.");
-		if (deletes.length > 0) logger.warn("Existing data in deleted types will be lost.");
+		logger.warn("This operation will overwrite remote TailorDB tables to match the selected snapshot.");
+		if (deletes.length > 0) logger.warn("Existing data in deleted tables will be lost.");
 		logger.newline();
 	}
 	logger.warn("Sync never runs migrate.ts scripts; it only applies the schema snapshot and moves the migration label.");
@@ -6209,7 +6265,7 @@ async function sync(options) {
 	const manifests = generateAllTypeManifestsFromSnapshot(snapshot, manifestOptions);
 	const manifestFor = (typeName) => {
 		const manifest = manifests.get(typeName);
-		if (!manifest) throw new Error(`Internal error: no manifest generated for type "${typeName}". No changes were applied.`);
+		if (!manifest) throw new Error(`Internal error: no manifest generated for table "${typeName}". No changes were applied.`);
 		return manifest;
 	};
 	const createManifests = creates.map((typeName) => manifestFor(typeName));
@@ -6291,7 +6347,7 @@ const syncCommand = defineAppCommand({
 //#endregion
 //#region src/cli/commands/tailordb/migrate/test-runtime.ts
 const CLONE_POLL_INTERVAL = 1e3;
-const CLONE_TIMEOUT = 300 * 1e3;
+const CLONE_TIMEOUT = 3e5;
 function delay(milliseconds) {
 	return milliseconds > 0 ? new Promise((resolve) => setTimeout(resolve, milliseconds)) : Promise.resolve();
 }
@@ -6502,7 +6558,8 @@ async function assertSourceBaselineFresh(state, prepared, sourceWorkspaceId) {
 	for (const input of unmigratedInputs) {
 		const snapshot = prepared.baselineSnapshots.get(input.namespace);
 		if (!snapshot) continue;
-		if (compareSnapshots(snapshot, await fetchRemoteSchemaSnapshot(state.client, sourceWorkspaceId, input.namespace)).changes.length > 0) throw new Error(`Source namespace "${input.namespace}" schema changed after migration test preparation. Run the migration test again.`);
+		const current = await fetchRemoteSchemaSnapshot(state.client, sourceWorkspaceId, input.namespace);
+		if (compareSnapshots(snapshot, current).changes.length > 0) throw new Error(`Source namespace "${input.namespace}" schema changed after migration test preparation. Run the migration test again.`);
 	}
 }
 /**
@@ -6553,7 +6610,9 @@ async function prepareMigrationTest(options) {
 	}
 	if (options.assertionPath) assertAssertionScript(options.assertionPath);
 	const inputs = loaded.application.tailorDBServices.map(toTailorDBDeployInput);
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }), await loadPlatformClientConfig({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const platformConfig = await loadPlatformClientConfig({ profile: options.profile });
+	const client = await initOperatorClient(accessToken, platformConfig);
 	const sourceWorkspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
@@ -6644,7 +6703,8 @@ function createMigrationTestDependencies() {
 			return prepared;
 		},
 		createWorkspace: async (prepared) => {
-			const workspace = await createValidatedWorkspaceWithClient(stateOrThrow(runtimeState).client, prepared.temporaryWorkspace);
+			const state = stateOrThrow(runtimeState);
+			const workspace = await createValidatedWorkspaceWithClient(state.client, prepared.temporaryWorkspace);
 			logger.info(`Created temporary workspace ${workspace.name} (${workspace.id}).`);
 			return {
 				id: workspace.id,
@@ -6995,12 +7055,13 @@ function buildValidationReports(options) {
 */
 async function collectValidationReports(options) {
 	const { config, plugins } = await loadConfig(options.configPath);
-	const namespacesWithMigrations = getNamespacesWithMigrations(config, path.dirname(config.path));
+	const configDir = path.dirname(config.path);
+	const namespacesWithMigrations = getNamespacesWithMigrations(config, configDir);
 	if (namespacesWithMigrations.length === 0) throw new Error("No TailorDB services with migrations configuration found");
 	const targetNamespaces = options.namespace ? namespacesWithMigrations.filter((ns) => ns.namespace === options.namespace) : namespacesWithMigrations;
 	if (targetNamespaces.length === 0) throw new Error(`Namespace "${options.namespace}" not found or does not have migrations configured`);
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication } = await import("../application-BZfk4HKm.mjs");
+	const { defineApplication } = await import("../application-D4zOiLLa.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -7034,10 +7095,13 @@ async function collectValidationReports(options) {
 	if (checkableNamespaces.length === 0) return { reports: buildValidationReports(localReportOptions) };
 	let remoteResults;
 	try {
-		remoteResults = await verifyRemoteSchema(await initOperatorClient(await loadAccessToken({ profile: options.profile })), await loadWorkspaceId({
+		const accessToken = await loadAccessToken({ profile: options.profile });
+		const client = await initOperatorClient(accessToken);
+		const workspaceId = await loadWorkspaceId({
 			workspaceId: options.workspaceId,
 			profile: options.profile
-		}), checkableNamespaces, config, tailorDBInputs);
+		});
+		remoteResults = await verifyRemoteSchema(client, workspaceId, checkableNamespaces, config, tailorDBInputs);
 	} catch (remoteError) {
 		return {
 			reports: buildValidationReports(localReportOptions),
@@ -7060,12 +7124,13 @@ function printValidationReports(reports) {
 		}
 		logger.log(`  Migration files: ${styles.success("OK")}`);
 		const local = report.localSchema;
-		if (local?.hasDiff) if (local.diff) {
-			logger.log(`  Local schema: ${styles.error("changes not in migration files")}`);
-			logger.log(`    ${formatDiffSummary(local.diff)}`);
-			logger.log(formatMigrationDiff(local.diff));
-		} else logger.log(`  Local schema: ${styles.error("no migration snapshot found")}`);
-		else logger.log(`  Local schema: ${styles.success("OK")}`);
+		if (local?.hasDiff) {
+			if (local.diff) {
+				logger.log(`  Local schema: ${styles.error("changes not in migration files")}`);
+				logger.log(`    ${formatDiffSummary(local.diff)}`);
+				logger.log(formatMigrationDiff(local.diff));
+			} else logger.log(`  Local schema: ${styles.error("no migration snapshot found")}`);
+		} else logger.log(`  Local schema: ${styles.success("OK")}`);
 		const remote = report.remoteSchema;
 		if (remote?.skipped === "check_failed") logger.log(`  Remote schema: ${styles.error("not checked")}`);
 		else if (remote?.checkpointRepair) logger.log(`  Remote schema: ${styles.success("OK")} (next deploy will reset the checkpoint to 0000 from ${formatMigrationNumber(remote.checkpointRepair.from)})`);
@@ -7078,14 +7143,16 @@ function printValidationReports(reports) {
 		else if (remote?.skipped === "no_snapshot") logger.log(`  Remote schema: ${styles.dim(`skipped (no local snapshot for remote migration ${formatMigrationNumber(remote.remoteMigrationNumber)})`)}`);
 		else if (remote) logger.log(`  Remote schema: ${styles.success("OK")} (remote migration: ${formatMigrationNumber(remote.remoteMigrationNumber)})`);
 		const acknowledgments = report.warningAcknowledgments;
-		if (acknowledgments) if (acknowledgments.valid) logger.log(`  Warning acknowledgments: ${styles.success("OK")}`);
-		else {
-			logger.log(`  Warning acknowledgments: ${styles.error("missing for pending migration(s) with possible data loss")}`);
-			for (const migration of acknowledgments.missing) {
-				const label = formatMigrationNumber(migration.migrationNumber);
-				for (const warning of migration.warnings) {
-					const field = warning.fieldName ? `.${warning.fieldName}` : "";
-					logger.log(`    ${label}: ${warning.tableName}${field}: ${warning.reason}`);
+		if (acknowledgments) {
+			if (acknowledgments.valid) logger.log(`  Warning acknowledgments: ${styles.success("OK")}`);
+			else {
+				logger.log(`  Warning acknowledgments: ${styles.error("missing for pending migration(s) with possible data loss")}`);
+				for (const migration of acknowledgments.missing) {
+					const label = formatMigrationNumber(migration.migrationNumber);
+					for (const warning of migration.warnings) {
+						const field = warning.fieldName ? `.${warning.fieldName}` : "";
+						logger.log(`    ${label}: ${warning.tableName}${field}: ${warning.reason}`);
+					}
 				}
 			}
 		}
@@ -7128,7 +7195,7 @@ async function validate(options) {
 }
 const validateCommand = defineAppCommand({
 	name: "validate",
-	description: "Validate the full migration history, unreviewed generated migration scripts, and schema drift (local types vs. migration snapshot, remote schema vs. migration checkpoint) without deploying. This includes the migration and schema-drift checks used by 'deploy' and exits with a non-zero code when issues are found.",
+	description: "Validate the full migration history, unreviewed generated migration scripts, and schema drift (local tables vs. migration snapshot, remote schema vs. migration checkpoint) without deploying. This includes the migration and schema-drift checks used by 'deploy' and exits with a non-zero code when issues are found.",
 	args: z.strictObject({
 		...deploymentArgs,
 		namespace: arg(z.string().optional(), {
@@ -7210,7 +7277,7 @@ const upgradeCommand = defineAppCommand({
 	run: async (args) => {
 		const { initTelemetry } = await import("../telemetry-CkbkeJxl.mjs");
 		await initTelemetry();
-		const { upgrade } = await import("../service-hZskxZmg.mjs");
+		const { upgrade } = await import("../service-LTfp03ZZ.mjs");
 		await upgrade({
 			from: args.from,
 			dryRun: args["dry-run"],
@@ -7623,7 +7690,8 @@ initCrashReporting();
 const packageJson = await readPackageJson();
 const cliName = Object.keys(packageJson.bin ?? {})[0] || "tailor";
 const packageName = packageJson.name ?? "@tailor-platform/sdk";
-const bundledSkillsDir = resolve(dirname(await resolvePackageJSON(import.meta.url)), "agent-skills");
+const packageJsonPath = await resolvePackageJSON(import.meta.url);
+const bundledSkillsDir = resolve(dirname(packageJsonPath), "agent-skills");
 function defaultSkillsRunToAdd(command) {
 	const add = (command.subCommands ?? {}).add;
 	return {
@@ -7719,7 +7787,7 @@ runMain(mainCommand, {
 				if (isVerbose() && error.stack) logger.debug(`\nStack trace:\n${error.stack}`);
 			} else logger.error(`Unknown error: ${error}`);
 			if (!isCLIError(error) && (!(error instanceof Error) || error instanceof TypeError || error instanceof RangeError)) {
-				const { reportCrash } = await import("../crashreport-CINZ5dVN.mjs");
+				const { reportCrash } = await import("../crashreport-Cd4TqfZq.mjs");
 				await reportCrash(error, "handledError");
 			}
 		}