@tailor-platform/sdk 1.14.1 → 1.15.0

package/dist/{update-2eb6jz9o.mjs → update-C_ZTRB63.mjs}

@@ -1,8 +1,7 @@
-import { t as isPluginGeneratedType } from "./types-r-ZratAg.mjs";
-import { t as db } from "./schema-BmKdDzr1.mjs";
-import { a as ExecutorSchema, c as stringifyFunction, d as logger, f as styles, i as createExecutorService, l as tailorUserMap, n as WorkflowJobSchema, o as OAuth2ClientSchema, p as symbols, r as WorkflowSchema, s as ResolverSchema, t as defineApplication, u as loadFilesWithIgnores } from "./application-DnWZVbDO.mjs";
+import { t as isPluginGeneratedType } from "./types-b-ig8nW_.mjs";
+import { t as db } from "./schema-DRYB-nzA.mjs";
+import { a as ExecutorSchema, c as functionSchema, d as loadFilesWithIgnores, f as logger, i as createExecutorService, l as stringifyFunction, m as symbols, n as WorkflowJobSchema, o as OAuth2ClientSchema, p as styles, r as WorkflowSchema, s as ResolverSchema, t as defineApplication, u as tailorUserMap } from "./application-DPunZ4lc.mjs";
 import { createRequire } from "node:module";
-import { cloneDeep } from "es-toolkit";
 import { arg, defineCommand, runCommand } from "politty";
 import { z } from "zod";
 import * as fs$2 from "node:fs";
@@ -29,6 +28,7 @@ import { glob } from "node:fs/promises";
 import * as rolldown from "rolldown";
 import { parseSync } from "oxc-parser";
 import { create, fromJson, toJson } from "@bufbuild/protobuf";
+import * as crypto from "node:crypto";
 import ora from "ora";
 import { setTimeout as setTimeout$1 } from "timers/promises";
 import { spawn } from "node:child_process";
@@ -522,7 +522,7 @@ const file_tailor_v1_function_registry = /* @__PURE__ */ fileDesc("CiF0YWlsb3Ivd
 /**
 * Describes the file tailor/v1/idp_resource.proto.
 */
-const file_tailor_v1_idp_resource = /* @__PURE__ */ fileDesc("Chx0YWlsb3IvdjEvaWRwX3Jlc291cmNlLnByb3RvEgl0YWlsb3IudjEi3gEKCklkUFNlcnZpY2USJwoJbmFtZXNwYWNlGAEgASgLMhQudGFpbG9yLnYxLk5hbWVzcGFjZRIVCg1hdXRob3JpemF0aW9uGAIgASgJEhkKDHByb3ZpZGVyX3VybBgDIAEoCUID4EEDEjYKEHVzZXJfYXV0aF9wb2xpY3kYBCABKAsyHC50YWlsb3IudjEuSWRQVXNlckF1dGhQb2xpY3kSIAoEbGFuZxgFIAEoDjISLnRhaWxvci52MS5JZFBMYW5nEhsKE3B1Ymxpc2hfdXNlcl9ldmVudHMYBiABKAgiTQoJSWRQQ2xpZW50EgwKBG5hbWUYASABKAkSFgoJY2xpZW50X2lkGAIgASgJQgPgQQMSGgoNY2xpZW50X3NlY3JldBgDIAEoCUID4EEDIrEIChFJZFBVc2VyQXV0aFBvbGljeRIgChh1c2Vfbm9uX2VtYWlsX2lkZW50aWZpZXIYASABKAgSIQoZYWxsb3dfc2VsZl9wYXNzd29yZF9yZXNldBgCIAEoCBIiChpwYXNzd29yZF9yZXF1aXJlX3VwcGVyY2FzZRgDIAEoCBIiChpwYXNzd29yZF9yZXF1aXJlX2xvd2VyY2FzZRgEIAEoCBIpCiFwYXNzd29yZF9yZXF1aXJlX25vbl9hbHBoYW51bWVyaWMYBSABKAgSIAoYcGFzc3dvcmRfcmVxdWlyZV9udW1lcmljGAYgASgIEqYBChNwYXNzd29yZF9taW5fbGVuZ3RoGAcgASgFQogBukiEAboBgAEKGXBhc3N3b3JkX21pbl9sZW5ndGhfcmFuZ2USO3Bhc3N3b3JkX21pbl9sZW5ndGggbXVzdCBiZSAwIChkZWZhdWx0KSBvciBiZXR3ZWVuIDYgYW5kIDMwGiZ0aGlzID09IDAgfHwgKHRoaXMgPj0gNiAmJiB0aGlzIDw9IDMwKRKqAQoTcGFzc3dvcmRfbWF4X2xlbmd0aBgIIAEoBUKMAbpIiAG6AYQBChlwYXNzd29yZF9tYXhfbGVuZ3RoX3JhbmdlEj1wYXNzd29yZF9tYXhfbGVuZ3RoIG11c3QgYmUgMCAoZGVmYXVsdCkgb3IgYmV0d2VlbiA2IGFuZCA0MDk2Gih0aGlzID09IDAgfHwgKHRoaXMgPj0gNiAmJiB0aGlzIDw9IDQwOTYpEi8KFWFsbG93ZWRfZW1haWxfZG9tYWlucxgJIAMoCUIQukgNkgEKEGQYASIEcgJoATq6A7pItgMa6gEKG3Bhc3N3b3JkX2xlbmd0aF9jb25zaXN0ZW5jeRJFcGFzc3dvcmRfbWluX2xlbmd0aCBtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byBwYXNzd29yZF9tYXhfbGVuZ3RoGoMBKHRoaXMucGFzc3dvcmRfbWluX2xlbmd0aCA9PSAwID8gNiA6IHRoaXMucGFzc3dvcmRfbWluX2xlbmd0aCkgPD0gKHRoaXMucGFzc3dvcmRfbWF4X2xlbmd0aCA9PSAwID8gNDA5NiA6IHRoaXMucGFzc3dvcmRfbWF4X2xlbmd0aCkaxgEKL2FsbG93ZWRfZW1haWxfZG9tYWluc19yZXF1aXJlc19lbWFpbF9pZGVudGlmaWVyEklhbGxvd2VkX2VtYWlsX2RvbWFpbnMgY2Fubm90IGJlIHNldCB3aGVuIHVzZV9ub25fZW1haWxfaWRlbnRpZmllciBpcyB0cnVlGkh0aGlzLmFsbG93ZWRfZW1haWxfZG9tYWlucy5zaXplKCkgPT0gMCB8fCAhdGhpcy51c2Vfbm9uX2VtYWlsX2lkZW50aWZpZXIqSAoHSWRQTGFuZxIZChVJRF9QX0xBTkdfVU5TUEVDSUZJRUQQABIQCgxJRF9QX0xBTkdfRU4QARIQCgxJRF9QX0xBTkdfSkEQAmIGcHJvdG8z", [
+const file_tailor_v1_idp_resource = /* @__PURE__ */ fileDesc("Chx0YWlsb3IvdjEvaWRwX3Jlc291cmNlLnByb3RvEgl0YWlsb3IudjEi3gEKCklkUFNlcnZpY2USJwoJbmFtZXNwYWNlGAEgASgLMhQudGFpbG9yLnYxLk5hbWVzcGFjZRIVCg1hdXRob3JpemF0aW9uGAIgASgJEhkKDHByb3ZpZGVyX3VybBgDIAEoCUID4EEDEjYKEHVzZXJfYXV0aF9wb2xpY3kYBCABKAsyHC50YWlsb3IudjEuSWRQVXNlckF1dGhQb2xpY3kSIAoEbGFuZxgFIAEoDjISLnRhaWxvci52MS5JZFBMYW5nEhsKE3B1Ymxpc2hfdXNlcl9ldmVudHMYBiABKAgiTQoJSWRQQ2xpZW50EgwKBG5hbWUYASABKAkSFgoJY2xpZW50X2lkGAIgASgJQgPgQQMSGgoNY2xpZW50X3NlY3JldBgDIAEoCUID4EEDIoYKChFJZFBVc2VyQXV0aFBvbGljeRIgChh1c2Vfbm9uX2VtYWlsX2lkZW50aWZpZXIYASABKAgSIQoZYWxsb3dfc2VsZl9wYXNzd29yZF9yZXNldBgCIAEoCBIiChpwYXNzd29yZF9yZXF1aXJlX3VwcGVyY2FzZRgDIAEoCBIiChpwYXNzd29yZF9yZXF1aXJlX2xvd2VyY2FzZRgEIAEoCBIpCiFwYXNzd29yZF9yZXF1aXJlX25vbl9hbHBoYW51bWVyaWMYBSABKAgSIAoYcGFzc3dvcmRfcmVxdWlyZV9udW1lcmljGAYgASgIEqYBChNwYXNzd29yZF9taW5fbGVuZ3RoGAcgASgFQogBukiEAboBgAEKGXBhc3N3b3JkX21pbl9sZW5ndGhfcmFuZ2USO3Bhc3N3b3JkX21pbl9sZW5ndGggbXVzdCBiZSAwIChkZWZhdWx0KSBvciBiZXR3ZWVuIDYgYW5kIDMwGiZ0aGlzID09IDAgfHwgKHRoaXMgPj0gNiAmJiB0aGlzIDw9IDMwKRKqAQoTcGFzc3dvcmRfbWF4X2xlbmd0aBgIIAEoBUKMAbpIiAG6AYQBChlwYXNzd29yZF9tYXhfbGVuZ3RoX3JhbmdlEj1wYXNzd29yZF9tYXhfbGVuZ3RoIG11c3QgYmUgMCAoZGVmYXVsdCkgb3IgYmV0d2VlbiA2IGFuZCA0MDk2Gih0aGlzID09IDAgfHwgKHRoaXMgPj0gNiAmJiB0aGlzIDw9IDQwOTYpEi8KFWFsbG93ZWRfZW1haWxfZG9tYWlucxgJIAMoCUIQukgNkgEKEGQYASIEcgJoARIaChJhbGxvd19nb29nbGVfb2F1dGgYCiABKAg68wS6SO8EGuoBChtwYXNzd29yZF9sZW5ndGhfY29uc2lzdGVuY3kSRXBhc3N3b3JkX21pbl9sZW5ndGggbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gcGFzc3dvcmRfbWF4X2xlbmd0aBqDASh0aGlzLnBhc3N3b3JkX21pbl9sZW5ndGggPT0gMCA/IDYgOiB0aGlzLnBhc3N3b3JkX21pbl9sZW5ndGgpIDw9ICh0aGlzLnBhc3N3b3JkX21heF9sZW5ndGggPT0gMCA/IDQwOTYgOiB0aGlzLnBhc3N3b3JkX21heF9sZW5ndGgpGsYBCi9hbGxvd2VkX2VtYWlsX2RvbWFpbnNfcmVxdWlyZXNfZW1haWxfaWRlbnRpZmllchJJYWxsb3dlZF9lbWFpbF9kb21haW5zIGNhbm5vdCBiZSBzZXQgd2hlbiB1c2Vfbm9uX2VtYWlsX2lkZW50aWZpZXIgaXMgdHJ1ZRpIdGhpcy5hbGxvd2VkX2VtYWlsX2RvbWFpbnMuc2l6ZSgpID09IDAgfHwgIXRoaXMudXNlX25vbl9lbWFpbF9pZGVudGlmaWVyGrYBCixhbGxvd19nb29nbGVfb2F1dGhfcmVxdWlyZXNfZW1haWxfaWRlbnRpZmllchJKYWxsb3dfZ29vZ2xlX29hdXRoIGNhbm5vdCBiZSBlbmFibGVkIHdoZW4gdXNlX25vbl9lbWFpbF9pZGVudGlmaWVyIGlzIHRydWUaOiF0aGlzLmFsbG93X2dvb2dsZV9vYXV0aCB8fCAhdGhpcy51c2Vfbm9uX2VtYWlsX2lkZW50aWZpZXIqSAoHSWRQTGFuZxIZChVJRF9QX0xBTkdfVU5TUEVDSUZJRUQQABIQCgxJRF9QX0xBTkdfRU4QARIQCgxJRF9QX0xBTkdfSkEQAmIGcHJvdG8z", [
 	file_buf_validate_validate,
 	file_google_api_field_behavior,
 	file_tailor_v1_resource
@@ -2685,159 +2685,21 @@ function createGeneratorConfigSchema(builtinGenerators$1) {
 
 //#endregion
 //#region src/parser/plugin-config/schema.ts
-const unauthenticatedTailorUser$1 = {
-	id: "00000000-0000-0000-0000-000000000000",
-	type: "",
-	workspaceId: "00000000-0000-0000-0000-000000000000",
-	attributes: null,
-	attributeList: []
-};
-const PluginGeneratedTypeSchema = z.object({
-	name: z.string(),
-	fields: z.record(z.string(), z.unknown())
-});
-const PluginGeneratedResolverSchema = z.object({
-	name: z.string(),
-	operation: z.enum(["query", "mutation"]),
-	inputFields: z.record(z.string(), z.unknown()).optional(),
-	outputFields: z.record(z.string(), z.unknown()),
-	body: z.string()
-});
-const PluginTriggerConfigSchema = z.object({
-	kind: z.enum([
-		"recordCreated",
-		"recordUpdated",
-		"recordDeleted",
-		"schedule",
-		"incomingWebhook"
-	]),
-	type: z.string().optional(),
-	schedule: z.string().optional()
-});
-const PluginOperationConfigSchema = z.object({
-	kind: z.enum([
-		"function",
-		"webhook",
-		"graphql",
-		"workflow"
-	]),
-	body: z.string().optional(),
-	url: z.string().optional(),
-	query: z.string().optional()
-});
-const PluginGeneratedExecutorSchema = z.object({
-	name: z.string(),
-	description: z.string().optional(),
-	trigger: PluginTriggerConfigSchema,
-	operation: PluginOperationConfigSchema
-});
-z.object({
-	types: z.array(PluginGeneratedTypeSchema).optional(),
-	resolvers: z.array(PluginGeneratedResolverSchema).optional(),
-	executors: z.array(PluginGeneratedExecutorSchema).optional()
-});
 const CustomPluginSchema = z.object({
 	id: z.string(),
 	description: z.string(),
 	importPath: z.string(),
-	configSchema: z.any().optional(),
-	pluginConfigSchema: z.any().optional(),
-	pluginConfig: z.any().optional(),
-	process: z.any().optional(),
-	processNamespace: z.any().optional()
-}).superRefine((plugin, ctx) => {
-	if (plugin.process && !plugin.configSchema) ctx.addIssue({
-		code: z.ZodIssueCode.custom,
-		message: "process requires configSchema to be defined.",
-		path: ["configSchema"]
-	});
+	pluginConfig: z.unknown().optional(),
+	processType: functionSchema.optional(),
+	processNamespace: functionSchema.optional(),
+	typeConfigRequired: z.union([z.boolean(), functionSchema]).optional()
 }).passthrough();
-const CustomPluginTupleSchema = z.tuple([CustomPluginSchema, z.unknown()]);
-/**
-* Type guard to check if a value is a PluginBase object
-* @param value - Value to check
-* @returns True if value is a PluginBase object
-*/
-function isPluginBase(value) {
-	return CustomPluginSchema.safeParse(value).success;
-}
-function normalizePluginConfigSchema(schema) {
-	const seen = /* @__PURE__ */ new Set();
-	const stack = [schema];
-	while (stack.length > 0) {
-		const field = stack.pop();
-		if (!field || seen.has(field)) continue;
-		seen.add(field);
-		const requiredExplicit = field._metadata.requiredExplicit === true;
-		field._metadata.required = requiredExplicit;
-		for (const nestedField of Object.values(field.fields)) stack.push(nestedField);
-	}
-	return schema;
-}
-function clonePluginConfigSchema(schema) {
-	return cloneDeep(schema);
-}
-function normalizePluginBase(plugin) {
-	let normalized = plugin;
-	if (normalized.configSchema) {
-		const clonedConfigSchema = clonePluginConfigSchema(normalized.configSchema);
-		normalizePluginConfigSchema(clonedConfigSchema);
-		normalized = {
-			...normalized,
-			configSchema: clonedConfigSchema
-		};
-	}
-	if (normalized.pluginConfigSchema) {
-		const pluginConfigSchema = clonePluginConfigSchema(normalized.pluginConfigSchema);
-		normalizePluginConfigSchema(pluginConfigSchema);
-		normalized = {
-			...normalized,
-			pluginConfigSchema
-		};
-		if (normalized.pluginConfig !== void 0) {
-			const validationErrors = validatePluginConfig$1(normalized.pluginConfig, pluginConfigSchema);
-			if (validationErrors.length > 0) {
-				const errorDetails = validationErrors.map((e) => e.field ? `${e.field}: ${e.message}` : e.message).join("; ");
-				throw new Error(`Invalid pluginConfig for plugin "${normalized.id}": ${errorDetails}`);
-			}
-		}
-	}
-	return normalized;
-}
-/**
-* Validate plugin config against its schema
-* @param config - The config object to validate
-* @param schema - The schema defining expected fields
-* @returns Array of validation errors (empty if valid)
-*/
-function validatePluginConfig$1(config, schema) {
-	const result = schema.parse({
-		value: config,
-		data: config,
-		user: unauthenticatedTailorUser$1
-	});
-	if ("issues" in result && result.issues) return result.issues.map((issue) => ({
-		field: Array.isArray(issue.path) ? issue.path.join(".") : "",
-		message: issue.message
-	}));
-	return [];
-}
 /**
 * Creates a PluginConfigSchema for custom plugins
-* @returns Plugin config schema that validates and transforms PluginBase instances
+* @returns Plugin config schema that validates and transforms Plugin instances
 */
 function createPluginConfigSchema() {
-	return z.union([CustomPluginSchema, CustomPluginTupleSchema]).transform((plugin) => {
-		if (Array.isArray(plugin)) {
-			const [first, options] = plugin;
-			if (isPluginBase(first)) return normalizePluginBase({
-				...first,
-				pluginConfig: options
-			});
-			throw new Error(`Invalid plugin configuration: expected PluginBase object`);
-		}
-		return normalizePluginBase(plugin);
-	}).brand("Plugin");
+	return CustomPluginSchema.transform((plugin) => plugin).brand("Plugin");
 }
 
 //#endregion
@@ -3367,32 +3229,6 @@ function createKyselyGenerator(options) {
 	};
 }
 
-//#endregion
-//#region src/cli/utils/plugin-import.ts
-/**
-* Collect base directories for resolving plugin import paths.
-* @param configPath - Path to tailor.config.ts
-* @returns Ordered list of base directories
-*/
-function getPluginImportBaseDirs(configPath) {
-	if (configPath) return [path.dirname(configPath)];
-	return [process.cwd()];
-}
-/**
-* Resolve a relative plugin import path against candidate base directories.
-* @param pluginImportPath - Relative plugin import path
-* @param baseDirs - Candidate base directories
-* @returns Absolute path if found, otherwise null
-*/
-function resolveRelativePluginImportPath(pluginImportPath, baseDirs) {
-	if (!pluginImportPath.startsWith(".")) return null;
-	for (const baseDir of baseDirs) {
-		const absolutePath = path.resolve(baseDir, pluginImportPath);
-		if (fs$2.existsSync(absolutePath)) return absolutePath;
-	}
-	return null;
-}
-
 //#endregion
 //#region src/cli/generator/builtin/seed/idp-user-processor.ts
 /**
@@ -3681,7 +3517,7 @@ function generateLinesDbSchemaFile(metadata, importPath) {
 function generateLinesDbSchemaFileWithPluginAPI(metadata, params) {
 	const { typeName, exportName, optionalFields, omitFields, foreignKeys, indexes, pluginSource } = metadata;
 	if (!pluginSource) throw new Error(`pluginSource is required for plugin-generated type "${typeName}"`);
-	const { pluginImportPath, originalImportPath } = params;
+	const { configImportPath, originalImportPath } = params;
 	const schemaTypeCode = ml`
     const schemaType = t.object({
       ...${exportName}.pickFields(${JSON.stringify(optionalFields)}, { optional: true }),
@@ -3690,13 +3526,15 @@ function generateLinesDbSchemaFileWithPluginAPI(metadata, params) {
     `;
 	const schemaOptionsCode = generateSchemaOptions(foreignKeys, indexes);
 	if (pluginSource.originalExportName && originalImportPath && pluginSource.generatedTypeKind) return ml`
+    import { join } from "node:path";
     import { t } from "@tailor-platform/sdk";
+    import { getGeneratedType } from "@tailor-platform/sdk/plugin";
     import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
     import { defineSchema } from "@toiroakr/lines-db";
-    import { getGeneratedType } from "${pluginImportPath}";
     import { ${pluginSource.originalExportName} } from "${originalImportPath}";
 
-    const ${exportName} = getGeneratedType(${pluginSource.originalExportName}, "${pluginSource.generatedTypeKind}");
+    const configPath = join(import.meta.dirname, "${configImportPath}");
+    const ${exportName} = await getGeneratedType(configPath, "${pluginSource.pluginId}", ${pluginSource.originalExportName}, "${pluginSource.generatedTypeKind}");
 
     ${schemaTypeCode}
 
@@ -3709,12 +3547,14 @@ function generateLinesDbSchemaFileWithPluginAPI(metadata, params) {
     `;
 	if (!pluginSource.generatedTypeKind) throw new Error(`Namespace plugin "${pluginSource.pluginId}" must provide generatedTypeKind for type "${typeName}"`);
 	return ml`
+    import { join } from "node:path";
     import { t } from "@tailor-platform/sdk";
+    import { getGeneratedType } from "@tailor-platform/sdk/plugin";
     import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
     import { defineSchema } from "@toiroakr/lines-db";
-    import { getGeneratedType } from "${pluginImportPath}";
 
-    const ${exportName} = getGeneratedType(null, "${pluginSource.generatedTypeKind}");
+    const configPath = join(import.meta.dirname, "${configImportPath}");
+    const ${exportName} = await getGeneratedType(configPath, "${pluginSource.pluginId}", null, "${pluginSource.generatedTypeKind}");
 
     ${schemaTypeCode}
 
@@ -4371,7 +4211,6 @@ function createSeedGenerator(options) {
 		processTailorDBNamespace: ({ types }) => types,
 		aggregate: ({ input, configPath }) => {
 			const files = [];
-			const pluginImportBaseDirs = getPluginImportBaseDirs(configPath);
 			const namespaceConfigs = [];
 			for (const nsResult of input.tailordb) {
 				if (!nsResult.types) continue;
@@ -4394,14 +4233,8 @@ function createSeedGenerator(options) {
 							const relativePath = path.relative(path.dirname(schemaOutputPath), linesDb.pluginSource.originalFilePath);
 							originalImportPath = relativePath.replace(/\.ts$/, "").startsWith(".") ? relativePath.replace(/\.ts$/, "") : `./${relativePath.replace(/\.ts$/, "")}`;
 						}
-						let pluginImportPath = linesDb.pluginSource.pluginImportPath;
-						if (pluginImportPath.startsWith("./") || pluginImportPath.startsWith("../")) {
-							const resolvedPluginPath = resolveRelativePluginImportPath(pluginImportPath, pluginImportBaseDirs) ?? path.resolve(pluginImportBaseDirs[0] ?? process.cwd(), pluginImportPath);
-							const relativePluginPath = path.relative(path.dirname(schemaOutputPath), resolvedPluginPath);
-							pluginImportPath = relativePluginPath.startsWith(".") ? relativePluginPath : `./${relativePluginPath}`;
-						}
 						const schemaContent = generateLinesDbSchemaFileWithPluginAPI(linesDb, {
-							pluginImportPath,
+							configImportPath: path.relative(path.dirname(schemaOutputPath), configPath),
 							originalImportPath
 						});
 						files.push({
@@ -4519,6 +4352,32 @@ async function loadConfig(configPath) {
 	};
 }
 
+//#endregion
+//#region src/cli/utils/plugin-import.ts
+/**
+* Collect base directories for resolving plugin import paths.
+* @param configPath - Path to tailor.config.ts
+* @returns Ordered list of base directories
+*/
+function getPluginImportBaseDirs(configPath) {
+	if (configPath) return [path.dirname(configPath)];
+	return [process.cwd()];
+}
+/**
+* Resolve a relative plugin import path against candidate base directories.
+* @param pluginImportPath - Relative plugin import path
+* @param baseDirs - Candidate base directories
+* @returns Absolute path if found, otherwise null
+*/
+function resolveRelativePluginImportPath(pluginImportPath, baseDirs) {
+	if (!pluginImportPath.startsWith(".")) return null;
+	for (const baseDir of baseDirs) {
+		const absolutePath = path.resolve(baseDir, pluginImportPath);
+		if (fs$2.existsSync(absolutePath)) return absolutePath;
+	}
+	return null;
+}
+
 //#endregion
 //#region src/parser/plugin-config/types.ts
 /**
@@ -5036,10 +4895,9 @@ function extractAttributesFromConfig(config) {
 * @param attributeMap - Attribute map configuration
 * @param attributeList - Attribute list configuration
 * @param env - Environment configuration
-* @param pluginConfigs - Plugin configuration entries for PluginConfigs interface
 * @returns Generated type definition source
 */
-function generateTypeDefinition(attributeMap, attributeList, env, pluginConfigs) {
+function generateTypeDefinition(attributeMap, attributeList, env) {
 	const mapFields = attributeMap ? Object.entries(attributeMap).map(([key, value]) => `    ${key}: ${value};`).join("\n") : "";
 	const mapBody = !attributeMap || Object.keys(attributeMap).length === 0 ? "{}" : `{
 ${mapFields}
@@ -5060,7 +4918,7 @@ declare module "@tailor-platform/sdk" {
   interface AttributeList ${listBody}
   interface Env ${!env || Object.keys(env).length === 0 ? "{}" : `{
 ${envFields}
-  }`}${pluginConfigs && pluginConfigs.length > 0 ? `\n${generatePluginConfigsDefinition(pluginConfigs)}` : ""}${pluginConfigs && pluginConfigs.length > 0 ? `\n${generatePluginMethodOverload(pluginConfigs)}` : ""}
+  }`}
 }
 
 export {};
@@ -5123,7 +4981,7 @@ function resolveTypeDefinitionPath(configPath) {
 * @returns Promise that resolves when types are generated
 */
 async function generateUserTypes(options) {
-	const { config, configPath, plugins } = options;
+	const { config, configPath } = options;
 	try {
 		const { attributeMap, attributeList } = extractAttributesFromConfig(config);
 		if (!attributeMap && !attributeList) logger.info("No attributes found in configuration", { mode: "plain" });
@@ -5131,14 +4989,7 @@ async function generateUserTypes(options) {
 		if (attributeList) logger.debug(`Extracted AttributeList: ${JSON.stringify(attributeList)}`);
 		const env = config.env;
 		if (env) logger.debug(`Extracted Env: ${JSON.stringify(env)}`);
-		const pluginConfigs = plugins?.filter((p) => p.configSchema !== void 0).map((p) => ({
-			id: p.id,
-			configSchema: p.configSchema,
-			configTypeTemplate: p.configTypeTemplate,
-			typeConfigRequired: isTypeConfigRequired(p)
-		}));
-		if (pluginConfigs && pluginConfigs.length > 0) logger.debug(`Extracted PluginConfigs: ${pluginConfigs.map((p) => p.id).join(", ")}`);
-		const typeDefContent = generateTypeDefinition(attributeMap, attributeList, env, pluginConfigs);
+		const typeDefContent = generateTypeDefinition(attributeMap, attributeList, env);
 		const outputPath = resolveTypeDefinitionPath(configPath);
 		fs$2.mkdirSync(path.dirname(outputPath), { recursive: true });
 		fs$2.writeFileSync(outputPath, typeDefContent);
@@ -5167,116 +5018,9 @@ function resolvePackageDirectory(startDir) {
 		return null;
 	}
 }
-/**
-* Convert a ConfigSchemaField to its TypeScript type string representation.
-* @param field - The field to convert
-* @param indent - Current indentation level
-* @returns TypeScript type string
-*/
-function fieldToTypeString(field, indent = 0) {
-	const indentStr = "  ".repeat(indent);
-	const metadata = field.metadata;
-	let baseType;
-	switch (field.type) {
-		case "string":
-		case "uuid":
-		case "date":
-		case "datetime":
-		case "time":
-			baseType = "string";
-			break;
-		case "integer":
-		case "float":
-			baseType = "number";
-			break;
-		case "boolean":
-			baseType = "boolean";
-			break;
-		case "enum":
-			if (metadata.allowedValues && metadata.allowedValues.length > 0) baseType = metadata.allowedValues.map((v) => `"${v.value}"`).join(" | ");
-			else baseType = "string";
-			break;
-		case "nested": {
-			const fieldEntries = Object.entries(field.fields);
-			if (fieldEntries.length === 0) baseType = "Record<string, unknown>";
-			else baseType = `{\n${fieldEntries.map(([name, nestedField]) => {
-				const nestedType = fieldToTypeString(nestedField, indent + 1);
-				return `${indentStr}  ${name}${!nestedField.metadata.required ? "?" : ""}: ${nestedType};`;
-			}).join("\n")}\n${indentStr}}`;
-			break;
-		}
-		default: baseType = "unknown";
-	}
-	if (metadata.array) baseType = `(${baseType})[]`;
-	return baseType;
-}
-function isTypeConfigRequired(plugin) {
-	const required = plugin.typeConfigRequired;
-	if (typeof required === "function") return required(plugin.pluginConfig);
-	return required === true;
-}
-/**
-* Generate PluginConfigs interface extension for user-defined.d.ts
-* @param plugins - Array of plugin configurations
-* @returns TypeScript interface extension string, or empty string if no plugins
-*/
-function generatePluginConfigsDefinition(plugins) {
-	if (plugins.length === 0) return "";
-	return `  interface PluginConfigs<Fields extends string> {
-${plugins.map((plugin) => {
-		const typeString = plugin.configTypeTemplate ?? fieldToTypeString(plugin.configSchema, 2);
-		const optionalMarker = plugin.typeConfigRequired ? "" : "?";
-		return `    "${plugin.id}"${optionalMarker}: ${typeString};`;
-	}).join("\n")}
-  }`;
-}
-/**
-* Generate TailorDBType.plugin() method overload for IDE completion.
-* This adds an overload that uses `keyof Fields` directly for field-aware types,
-* enabling IDE autocompletion for field names in plugin configs.
-* @param plugins - Array of plugin configurations
-* @returns TypeScript interface extension string
-*/
-function generatePluginMethodOverload(plugins) {
-	return `  // Overload for .plugin() method to enable IDE completion for field names
-  interface TailorDBType<Fields, User> {
-    plugin(config: {
-${plugins.map((plugin) => {
-		const typeString = (plugin.configTypeTemplate ?? fieldToTypeString(plugin.configSchema, 3)).replace(/\bFields\b/g, "keyof Fields & string");
-		const optionalMarker = plugin.typeConfigRequired ? "" : "?";
-		return `      "${plugin.id}"${optionalMarker}: ${typeString};`;
-	}).join("\n")}
-    }): this;
-  }`;
-}
 
 //#endregion
 //#region src/plugin/manager.ts
-const unauthenticatedTailorUser = {
-	id: "00000000-0000-0000-0000-000000000000",
-	type: "",
-	workspaceId: "00000000-0000-0000-0000-000000000000",
-	attributes: null,
-	attributeList: []
-};
-/**
-* Validate plugin config against its schema
-* @param config - The config object to validate
-* @param schema - The schema defining expected fields
-* @returns Array of validation errors (empty if valid)
-*/
-function validatePluginConfig(config, schema) {
-	const result = schema.parse({
-		value: config,
-		data: config,
-		user: unauthenticatedTailorUser
-	});
-	if ("issues" in result && result.issues) return result.issues.map((issue) => ({
-		field: Array.isArray(issue.path) ? issue.path.join(".") : "",
-		message: issue.message
-	}));
-	return [];
-}
 /**
 * Manages plugin registration and processing
 */
@@ -5305,29 +5049,19 @@ var PluginManager = class {
 			error: `Plugin "${context.pluginId}" not found`
 		};
 		const typeConfigRequired = plugin.typeConfigRequired;
-		if ((typeof typeConfigRequired === "function" ? typeConfigRequired(plugin.pluginConfig) : typeConfigRequired === true) && (context.config === void 0 || context.config === null)) return {
+		if ((typeof typeConfigRequired === "function" ? typeConfigRequired(plugin.pluginConfig) : typeConfigRequired === true) && (context.typeConfig === void 0 || context.typeConfig === null)) return {
 			success: false,
-			error: `Plugin "${plugin.id}" requires config, but none was provided for type "${context.type.name}".`
+			error: `Plugin "${plugin.id}" requires typeConfig, but none was provided for type "${context.type.name}".`
 		};
-		if (plugin.configSchema) {
-			const validationErrors = validatePluginConfig(context.config, plugin.configSchema);
-			if (validationErrors.length > 0) {
-				const errorDetails = validationErrors.map((e) => e.field ? `${e.field}: ${e.message}` : e.message).join("; ");
-				return {
-					success: false,
-					error: `Invalid config for plugin "${plugin.id}" on type "${context.type.name}": ${errorDetails}`
-				};
-			}
-		}
-		if (!plugin.process) return {
+		if (!plugin.processType) return {
 			success: false,
-			error: `Plugin "${plugin.id}" does not support type-attached processing (missing process method). Use processNamespace via definePlugins() instead.`
+			error: `Plugin "${plugin.id}" does not support type-attached processing (missing processType method). Use processNamespace via definePlugins() instead.`
 		};
 		let output;
 		try {
-			output = await plugin.process({
+			output = await plugin.processType({
 				type: context.type,
-				config: context.config,
+				typeConfig: context.typeConfig,
 				pluginConfig: plugin.pluginConfig,
 				namespace: context.namespace
 			});
@@ -5345,7 +5079,9 @@ var PluginManager = class {
 				pluginImportPath: importPath,
 				sourceTypeName: context.type.name,
 				kind,
-				type
+				type,
+				namespace: context.namespace,
+				pluginConfig: plugin.pluginConfig
 			});
 		}
 		if (output.executors && output.executors.length > 0) for (const executor of output.executors) this.generatedExecutors.push({
@@ -5363,35 +5099,16 @@ var PluginManager = class {
 	* Process namespace plugins that don't require a source type.
 	* This method is called once per namespace for plugins with processNamespace method.
 	* @param namespace - The target namespace for generated types
-	* @param types - TailorDB types in the namespace (after type-attached processing)
-	* @param generatedTypes - Plugin-generated types in the namespace
 	* @returns Array of results with plugin outputs and configs
 	*/
-	async processNamespacePlugins(namespace, types, generatedTypes) {
+	async processNamespacePlugins(namespace) {
 		const results = [];
 		for (const [pluginId, plugin] of this.plugins) {
 			if (!plugin.processNamespace) continue;
 			const config = plugin.pluginConfig;
-			if (plugin.pluginConfigSchema && config !== void 0) {
-				const validationErrors = validatePluginConfig(config, plugin.pluginConfigSchema);
-				if (validationErrors.length > 0) {
-					const errorDetails = validationErrors.map((e) => e.field ? `${e.field}: ${e.message}` : e.message).join("; ");
-					results.push({
-						pluginId,
-						config,
-						result: {
-							success: false,
-							error: `Invalid pluginConfig for plugin "${plugin.id}": ${errorDetails}`
-						}
-					});
-					continue;
-				}
-			}
 			const context = {
 				pluginConfig: config,
-				namespace,
-				types,
-				generatedTypes
+				namespace
 			};
 			let output;
 			try {
@@ -5429,7 +5146,9 @@ var PluginManager = class {
 						pluginImportPath: importPath,
 						sourceTypeName: "(namespace)",
 						kind,
-						type
+						type,
+						namespace,
+						pluginConfig: plugin.pluginConfig
 					});
 				}
 			}
@@ -5459,6 +5178,14 @@ var PluginManager = class {
 		return this.plugins.size;
 	}
 	/**
+	* Get a plugin by its ID
+	* @param pluginId - The plugin ID to look up
+	* @returns The plugin instance, or undefined if not found
+	*/
+	getPlugin(pluginId) {
+		return this.plugins.get(pluginId);
+	}
+	/**
 	* Get the import path for a plugin
 	* @param pluginId - The plugin ID to look up
 	* @returns The plugin's import path, or undefined if not found
@@ -6993,6 +6720,245 @@ async function confirmImportantResourceDeletion(resources, yes) {
     `);
 }
 
+//#endregion
+//#region src/cli/apply/services/function-registry.ts
+const CHUNK_SIZE = 64 * 1024;
+/**
+* Compute SHA-256 content hash for a script string.
+* @param content - Script content to hash
+* @returns Hex-encoded SHA-256 hash
+*/
+function computeContentHash(content) {
+	return crypto.createHash("sha256").update(content, "utf-8").digest("hex");
+}
+function functionRegistryTrn(workspaceId, name) {
+	return `trn:v1:workspace:${workspaceId}:function_registry:${name}`;
+}
+/**
+* Build a function registry name for a resolver.
+* @param namespace - Resolver namespace
+* @param resolverName - Resolver name
+* @returns Function registry name
+*/
+function resolverFunctionName(namespace, resolverName) {
+	return `resolver--${namespace}--${resolverName}`;
+}
+/**
+* Build a function registry name for an executor.
+* @param executorName - Executor name
+* @returns Function registry name
+*/
+function executorFunctionName(executorName) {
+	return `executor--${executorName}`;
+}
+/**
+* Build a function registry name for a workflow job.
+* @param jobName - Workflow job name
+* @returns Function registry name
+*/
+function workflowJobFunctionName(jobName) {
+	return `workflow--${jobName}`;
+}
+/**
+* Collect all function entries from bundled scripts for all services.
+* @param application - Application definition
+* @param workflowJobs - Collected workflow jobs from config
+* @returns Array of function entries to register
+*/
+function collectFunctionEntries(application, workflowJobs) {
+	const entries = [];
+	const distDir = getDistDir();
+	for (const app of application.applications) for (const pipeline of app.resolverServices) for (const resolver of Object.values(pipeline.getResolvers())) {
+		const scriptPath = path.join(distDir, "resolvers", `${resolver.name}.js`);
+		try {
+			const content = fs$2.readFileSync(scriptPath, "utf-8");
+			entries.push({
+				name: resolverFunctionName(pipeline.namespace, resolver.name),
+				scriptContent: content,
+				contentHash: computeContentHash(content),
+				description: `Resolver: ${pipeline.namespace}/${resolver.name}`
+			});
+		} catch {
+			logger.warn(`Function file not found: ${scriptPath}`);
+		}
+	}
+	if (application.executorService) {
+		const executors = application.executorService.getExecutors();
+		for (const executor of Object.values(executors)) if (executor.operation.kind === "function" || executor.operation.kind === "jobFunction") {
+			const scriptPath = path.join(distDir, "executors", `${executor.name}.js`);
+			try {
+				const content = fs$2.readFileSync(scriptPath, "utf-8");
+				entries.push({
+					name: executorFunctionName(executor.name),
+					scriptContent: content,
+					contentHash: computeContentHash(content),
+					description: `Executor: ${executor.name}`
+				});
+			} catch {
+				logger.warn(`Function file not found: ${scriptPath}`);
+			}
+		}
+	}
+	for (const job of workflowJobs) {
+		const scriptPath = path.join(distDir, "workflow-jobs", `${job.name}.js`);
+		try {
+			const content = fs$2.readFileSync(scriptPath, "utf-8");
+			entries.push({
+				name: workflowJobFunctionName(job.name),
+				scriptContent: content,
+				contentHash: computeContentHash(content),
+				description: `Workflow job: ${job.name}`
+			});
+		} catch {
+			logger.warn(`Function file not found: ${scriptPath}`);
+		}
+	}
+	return entries;
+}
+/**
+* Plan function registry changes based on current and desired state.
+* @param client - Operator client instance
+* @param workspaceId - Workspace ID
+* @param appName - Application name
+* @param entries - Desired function entries
+* @returns Planned changes
+*/
+async function planFunctionRegistry(client, workspaceId, appName, entries) {
+	const changeSet = createChangeSet("Function registry");
+	const conflicts = [];
+	const unmanaged = [];
+	const resourceOwners = /* @__PURE__ */ new Set();
+	const existingFunctions = await fetchAll(async (pageToken) => {
+		try {
+			const response = await client.listFunctionRegistries({
+				workspaceId,
+				pageToken
+			});
+			return [response.functions.map((f) => ({
+				name: f.name,
+				contentHash: f.contentHash
+			})), response.nextPageToken];
+		} catch (error) {
+			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
+			throw error;
+		}
+	});
+	const existingMap = {};
+	await Promise.all(existingFunctions.map(async (func) => {
+		const { metadata } = await client.getMetadata({ trn: functionRegistryTrn(workspaceId, func.name) });
+		existingMap[func.name] = {
+			resource: func,
+			label: metadata?.labels[sdkNameLabelKey]
+		};
+	}));
+	for (const entry of entries) {
+		const existing = existingMap[entry.name];
+		const metaRequest = await buildMetaRequest(functionRegistryTrn(workspaceId, entry.name), appName);
+		if (existing) {
+			if (!existing.label) unmanaged.push({
+				resourceType: "Function registry",
+				resourceName: entry.name
+			});
+			else if (existing.label !== appName) conflicts.push({
+				resourceType: "Function registry",
+				resourceName: entry.name,
+				currentOwner: existing.label
+			});
+			changeSet.updates.push({
+				name: entry.name,
+				entry,
+				metaRequest
+			});
+			delete existingMap[entry.name];
+		} else changeSet.creates.push({
+			name: entry.name,
+			entry,
+			metaRequest
+		});
+	}
+	for (const [name, existing] of Object.entries(existingMap)) {
+		if (!existing) continue;
+		const label = existing.label;
+		if (label && label !== appName) resourceOwners.add(label);
+		if (label === appName) changeSet.deletes.push({
+			name,
+			workspaceId
+		});
+	}
+	changeSet.print();
+	return {
+		changeSet,
+		conflicts,
+		unmanaged,
+		resourceOwners
+	};
+}
+/**
+* Upload a function script to the function registry using client streaming.
+* @param client - Operator client instance
+* @param workspaceId - Workspace ID
+* @param entry - Function entry to upload
+* @param isCreate - Whether this is a create (true) or update (false)
+*/
+async function uploadFunctionScript(client, workspaceId, entry, isCreate) {
+	const buffer = Buffer.from(entry.scriptContent, "utf-8");
+	const info = {
+		workspaceId,
+		name: entry.name,
+		description: entry.description,
+		sizeBytes: BigInt(buffer.length),
+		contentHash: entry.contentHash
+	};
+	if (isCreate) {
+		async function* createStream() {
+			yield { payload: {
+				case: "info",
+				value: info
+			} };
+			for (let i = 0; i < buffer.length; i += CHUNK_SIZE) yield { payload: {
+				case: "chunk",
+				value: buffer.subarray(i, Math.min(i + CHUNK_SIZE, buffer.length))
+			} };
+		}
+		await client.createFunctionRegistry(createStream());
+	} else {
+		async function* updateStream() {
+			yield { payload: {
+				case: "info",
+				value: info
+			} };
+			for (let i = 0; i < buffer.length; i += CHUNK_SIZE) yield { payload: {
+				case: "chunk",
+				value: buffer.subarray(i, Math.min(i + CHUNK_SIZE, buffer.length))
+			} };
+		}
+		await client.updateFunctionRegistry(updateStream());
+	}
+}
+/**
+* Apply function registry changes for the given phase.
+* @param client - Operator client instance
+* @param workspaceId
+* @param result - Planned function registry changes
+* @param phase - Apply phase
+*/
+async function applyFunctionRegistry(client, workspaceId, result, phase = "create-update") {
+	const { changeSet } = result;
+	if (phase === "create-update") {
+		for (const create$1 of changeSet.creates) {
+			await uploadFunctionScript(client, workspaceId, create$1.entry, true);
+			await client.setMetadata(create$1.metaRequest);
+		}
+		for (const update of changeSet.updates) {
+			await uploadFunctionScript(client, workspaceId, update.entry, false);
+			await client.setMetadata(update.metaRequest);
+		}
+	} else if (phase === "delete") await Promise.all(changeSet.deletes.map((del) => client.deleteFunctionRegistry({
+		workspaceId: del.workspaceId,
+		name: del.name
+	})));
+}
+
 //#endregion
 //#region src/cli/apply/services/executor.ts
 /**
@@ -7237,22 +7203,19 @@ function protoExecutor(appName, executor, env) {
 			} };
 			break;
 		case "function":
-		case "jobFunction": {
+		case "jobFunction":
 			if (target.kind === "function") targetType = ExecutorTargetType.FUNCTION;
 			else targetType = ExecutorTargetType.JOB_FUNCTION;
-			const scriptPath = path.join(getDistDir(), "executors", `${executor.name}.js`);
-			const script = fs$2.readFileSync(scriptPath, "utf-8");
 			targetConfig = { config: {
 				case: "function",
 				value: {
-					name: `${executor.name}__target`,
-					script,
+					name: "operation",
+					scriptRef: executorFunctionName(executor.name),
 					variables: { expr: argsExpr },
 					invoker: target.authInvoker ?? void 0
 				}
 			} };
 			break;
-		}
 		case "workflow":
 			targetType = ExecutorTargetType.WORKFLOW;
 			targetConfig = { config: {
@@ -7470,7 +7433,7 @@ async function planResolvers(client, workspaceId, pipelines, executors, deletedS
 				request: {
 					workspaceId,
 					namespaceName: pipeline.namespace,
-					pipelineResolver: processResolver(resolver, executorUsedResolvers, env)
+					pipelineResolver: processResolver(pipeline.namespace, resolver, executorUsedResolvers, env)
 				}
 			});
 			existingNameSet.delete(resolver.name);
@@ -7479,7 +7442,7 @@ async function planResolvers(client, workspaceId, pipelines, executors, deletedS
 			request: {
 				workspaceId,
 				namespaceName: pipeline.namespace,
-				pipelineResolver: processResolver(resolver, executorUsedResolvers, env)
+				pipelineResolver: processResolver(pipeline.namespace, resolver, executorUsedResolvers, env)
 			}
 		});
 		existingNameSet.forEach((name) => {
@@ -7505,20 +7468,13 @@ async function planResolvers(client, workspaceId, pipelines, executors, deletedS
 	});
 	return changeSet;
 }
-function processResolver(resolver, executorUsedResolvers, env) {
-	const functionPath = path.join(getDistDir(), "resolvers", `${resolver.name}.js`);
-	let functionCode = "";
-	try {
-		functionCode = fs$2.readFileSync(functionPath, "utf-8");
-	} catch {
-		logger.warn(`Function file not found: ${functionPath}`);
-	}
+function processResolver(namespace, resolver, executorUsedResolvers, env) {
 	const pipelines = [{
 		name: "body",
 		operationName: "body",
 		description: `${resolver.name} function body`,
 		operationType: PipelineResolver_OperationType.FUNCTION,
-		operationSource: functionCode,
+		operationSourceRef: resolverFunctionName(namespace, resolver.name),
 		operationHook: { expr: `({ ...context.pipeline, input: context.args, user: ${tailorUserMap}, env: ${JSON.stringify(env)} });` },
 		postScript: `args.body`
 	}];
@@ -8605,7 +8561,7 @@ function compareFiles(ctx, typeName, oldFiles, newFiles) {
 * Compare type-level relationships
 * @param {DiffContext} ctx - Diff context
 * @param {string} typeName - Type name
-* @param relationshipType
+* @param {"forward" | "backward"} relationshipType - Relationship direction to compare
 * @param {Record<string, SnapshotRelationship> | undefined} oldRelationships - Previous relationships
 * @param {Record<string, SnapshotRelationship> | undefined} newRelationships - Current relationships
 * @returns {void}
@@ -9998,11 +9954,7 @@ function generateTailorDBTypeManifest(type, executorUsedTypes, namespaceGqlOpera
 			type: fieldType,
 			allowedValues: fieldType === "enum" ? fieldConfig.allowedValues || [] : [],
 			description: fieldConfig.description || "",
-			validate: (fieldConfig.validate || []).map((val) => ({
-				action: TailorDBType_PermitAction.DENY,
-				errorMessage: val.errorMessage || "",
-				...val.script && { script: { expr: val.script.expr ? `!${val.script.expr}` : "" } }
-			})),
+			validate: toProtoFieldValidate(fieldConfig),
 			array: fieldConfig.array || false,
 			index: fieldConfig.index || false,
 			unique: fieldConfig.unique || false,
@@ -10011,10 +9963,7 @@ function generateTailorDBTypeManifest(type, executorUsedTypes, namespaceGqlOpera
 			foreignKeyField: fieldConfig.foreignKeyField,
 			required: fieldConfig.required !== false,
 			vector: fieldConfig.vector || false,
-			...fieldConfig.hooks && { hooks: {
-				create: fieldConfig.hooks?.create ? { expr: fieldConfig.hooks.create.expr || "" } : void 0,
-				update: fieldConfig.hooks?.update ? { expr: fieldConfig.hooks.update.expr || "" } : void 0
-			} },
+			...toProtoFieldHooks(fieldConfig),
 			...fieldConfig.serial && { serial: {
 				start: fieldConfig.serial.start,
 				...fieldConfig.serial.maxValue && { maxValue: fieldConfig.serial.maxValue },
@@ -10071,6 +10020,20 @@ function generateTailorDBTypeManifest(type, executorUsedTypes, namespaceGqlOpera
 		}
 	};
 }
+function toProtoFieldValidate(fieldConfig) {
+	return (fieldConfig.validate || []).map((val) => ({
+		action: TailorDBType_PermitAction.DENY,
+		errorMessage: val.errorMessage || "",
+		...val.script && { script: { expr: val.script.expr ? `!${val.script.expr}` : "" } }
+	}));
+}
+function toProtoFieldHooks(fieldConfig) {
+	if (!fieldConfig.hooks) return {};
+	return { hooks: {
+		create: fieldConfig.hooks.create ? { expr: fieldConfig.hooks.create.expr || "" } : void 0,
+		update: fieldConfig.hooks.update ? { expr: fieldConfig.hooks.update.expr || "" } : void 0
+	} };
+}
 function processNestedFields(fields) {
 	const nestedFields = {};
 	Object.entries(fields).forEach(([nestedFieldName, nestedFieldConfig]) => {
@@ -10081,26 +10044,28 @@ function processNestedFields(fields) {
 				type: "nested",
 				allowedValues: nestedFieldConfig.allowedValues || [],
 				description: nestedFieldConfig.description || "",
-				validate: [],
+				validate: toProtoFieldValidate(nestedFieldConfig),
 				required: nestedFieldConfig.required ?? true,
 				array: nestedFieldConfig.array ?? false,
 				index: false,
 				unique: false,
 				foreignKey: false,
 				vector: false,
+				...toProtoFieldHooks(nestedFieldConfig),
 				fields: deepNestedFields
 			};
 		} else nestedFields[nestedFieldName] = {
 			type: nestedType,
 			allowedValues: nestedType === "enum" ? nestedFieldConfig.allowedValues || [] : [],
 			description: nestedFieldConfig.description || "",
-			validate: [],
+			validate: toProtoFieldValidate(nestedFieldConfig),
 			required: nestedFieldConfig.required ?? true,
 			array: nestedFieldConfig.array ?? false,
 			index: false,
 			unique: false,
 			foreignKey: false,
 			vector: false,
+			...toProtoFieldHooks(nestedFieldConfig),
 			...nestedFieldConfig.serial && { serial: {
 				start: nestedFieldConfig.serial.start,
 				...nestedFieldConfig.serial.maxValue && { maxValue: nestedFieldConfig.serial.maxValue },
@@ -10459,7 +10424,7 @@ async function registerJobFunctions(client, changeSet, appName) {
 	const jobFunctionVersions = {};
 	const firstWorkflow = changeSet.creates[0] || changeSet.updates[0];
 	if (!firstWorkflow) return jobFunctionVersions;
-	const { workspaceId, scripts } = firstWorkflow;
+	const { workspaceId } = firstWorkflow;
 	const allUsedJobNames = /* @__PURE__ */ new Set();
 	for (const item of [...changeSet.creates, ...changeSet.updates]) for (const jobName of item.usedJobNames) allUsedJobNames.add(jobName);
 	const existingJobFunctions = await fetchAll(async (pageToken) => {
@@ -10471,16 +10436,14 @@ async function registerJobFunctions(client, changeSet, appName) {
 	});
 	const existingJobNamesSet = new Set(existingJobFunctions);
 	const results = await Promise.all(Array.from(allUsedJobNames).map(async (jobName) => {
-		const script = scripts.get(jobName);
-		if (!script) throw new Error(`No bundled script found for job "${jobName}". Please run "generate" command before "apply".`);
 		const response = existingJobNamesSet.has(jobName) ? await client.updateWorkflowJobFunction({
 			workspaceId,
 			jobFunctionName: jobName,
-			script
+			scriptRef: workflowJobFunctionName(jobName)
 		}) : await client.createWorkflowJobFunction({
 			workspaceId,
 			jobFunctionName: jobName,
-			script
+			scriptRef: workflowJobFunctionName(jobName)
 		});
 		await client.setMetadata(await buildMetaRequest(jobFunctionTrn(workspaceId, jobName), appName));
 		return {
@@ -10537,7 +10500,6 @@ async function planWorkflow(client, workspaceId, appName, workflows, mainJobDeps
 			label: metadata?.labels[sdkNameLabelKey]
 		};
 	}));
-	const allScripts = await loadWorkflowScripts();
 	for (const workflow of Object.values(workflows)) {
 		const existing = existingWorkflows[workflow.name];
 		const metaRequest = await buildMetaRequest(workflowTrn(workspaceId, workflow.name), appName);
@@ -10557,7 +10519,6 @@ async function planWorkflow(client, workspaceId, appName, workflows, mainJobDeps
 				name: workflow.name,
 				workspaceId,
 				workflow,
-				scripts: allScripts,
 				usedJobNames,
 				metaRequest
 			});
@@ -10566,7 +10527,6 @@ async function planWorkflow(client, workspaceId, appName, workflows, mainJobDeps
 			name: workflow.name,
 			workspaceId,
 			workflow,
-			scripts: allScripts,
 			usedJobNames,
 			metaRequest
 		});
@@ -10589,19 +10549,6 @@ async function planWorkflow(client, workspaceId, appName, workflows, mainJobDeps
 		appName
 	};
 }
-async function loadWorkflowScripts() {
-	const scripts = /* @__PURE__ */ new Map();
-	const jobsDir = path.join(getDistDir(), "workflow-jobs");
-	if (!fs$2.existsSync(jobsDir)) return scripts;
-	const files = fs$2.readdirSync(jobsDir);
-	for (const file of files) if (/^[^.]+\.js$/.test(file)) {
-		const jobName = file.replace(/\.js$/, "");
-		const scriptPath = path.join(jobsDir, file);
-		const script = fs$2.readFileSync(scriptPath, "utf-8");
-		scripts.set(jobName, script);
-	}
-	return scripts;
-}
 
 //#endregion
 //#region src/cli/apply/index.ts
@@ -10619,8 +10566,7 @@ async function apply(options) {
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
 	await generateUserTypes({
 		config,
-		configPath: config.path,
-		plugins
+		configPath: config.path
 	});
 	const application = defineApplication({
 		config,
@@ -10689,6 +10635,7 @@ async function apply(options) {
 	}
 	if (workflowResult) printLoadedWorkflows(workflowResult);
 	logger.newline();
+	const functionEntries = collectFunctionEntries(application, workflowResult?.jobs ?? []);
 	const ctx = {
 		client,
 		workspaceId,
@@ -10697,6 +10644,7 @@ async function apply(options) {
 		config,
 		noSchemaCheck: options?.noSchemaCheck
 	};
+	const functionRegistry = await planFunctionRegistry(client, workspaceId, application.name, functionEntries);
 	const tailorDB = await planTailorDB(ctx);
 	const staticWebsite = await planStaticWebsite(ctx);
 	const idp = await planIdP(ctx);
@@ -10706,6 +10654,7 @@ async function apply(options) {
 	const executor = await planExecutor(ctx);
 	const workflow = await planWorkflow(client, workspaceId, application.name, workflowResult?.workflows ?? {}, workflowBuildResult?.mainJobDeps ?? {});
 	const allConflicts = [
+		...functionRegistry.conflicts,
 		...tailorDB.conflicts,
 		...staticWebsite.conflicts,
 		...idp.conflicts,
@@ -10716,6 +10665,7 @@ async function apply(options) {
 	];
 	await confirmOwnerConflict(allConflicts, application.name, yes);
 	await confirmUnmanagedResources([
+		...functionRegistry.unmanaged,
 		...tailorDB.unmanaged,
 		...staticWebsite.unmanaged,
 		...idp.unmanaged,
@@ -10743,6 +10693,7 @@ async function apply(options) {
 	});
 	await confirmImportantResourceDeletion(importantDeletions, yes);
 	const resourceOwners = new Set([
+		...functionRegistry.resourceOwners,
 		...tailorDB.resourceOwners,
 		...staticWebsite.resourceOwners,
 		...idp.resourceOwners,
@@ -10763,6 +10714,7 @@ async function apply(options) {
 		logger.info("Dry run enabled. No changes applied.");
 		return;
 	}
+	await applyFunctionRegistry(client, workspaceId, functionRegistry, "create-update");
 	await applyStaticWebsite(client, staticWebsite, "create-update");
 	await applyIdP(client, idp, "create-update");
 	await applyAuth(client, auth, "create-update");
@@ -10782,6 +10734,7 @@ async function apply(options) {
 	await applyAuth(client, auth, "delete-services");
 	await applyIdP(client, idp, "delete-services");
 	await applyTailorDB(client, tailorDB, "delete-services");
+	await applyFunctionRegistry(client, workspaceId, functionRegistry, "delete");
 	logger.success("Successfully applied changes.");
 }
 async function buildPipeline(namespace, config, triggerContext) {
@@ -11717,32 +11670,11 @@ function getRunningJobs(execution) {
 function isTerminalStatus(status) {
 	return status === WorkflowExecution_Status.SUCCESS || status === WorkflowExecution_Status.FAILED || status === WorkflowExecution_Status.PENDING_RESUME;
 }
-/**
-* Start a workflow and return a handle to wait for completion.
-* @param options - Start options
-* @returns Start result with wait helper
-*/
-async function startWorkflow(options) {
-	const client = await initOperatorClient(await loadAccessToken({
-		useProfile: true,
-		profile: options.profile
-	}));
-	const workspaceId = loadWorkspaceId({
-		workspaceId: options.workspaceId,
-		profile: options.profile
-	});
-	const { config } = await loadConfig(options.configPath);
-	const { application } = await client.getApplication({
-		workspaceId,
-		applicationName: config.name
-	});
-	if (!application?.authNamespace) throw new Error(`Application ${config.name} does not have an auth configuration.`);
+async function startWorkflowCore(options) {
+	const { client, workspaceId, workflowName } = options;
 	try {
-		const workflow = await resolveWorkflow(client, workspaceId, options.name);
-		const authInvoker = create(AuthInvokerSchema, {
-			namespace: application.authNamespace,
-			machineUserName: options.machineUser
-		});
+		const workflow = await resolveWorkflow(client, workspaceId, workflowName);
+		const authInvoker = create(AuthInvokerSchema, options.authInvoker);
 		const arg$1 = options.arg === void 0 ? void 0 : typeof options.arg === "string" ? options.arg : JSON.stringify(options.arg);
 		const { executionId } = await client.testStartWorkflow({
 			workspaceId,
@@ -11762,10 +11694,54 @@ async function startWorkflow(options) {
 			})
 		};
 	} catch (error) {
-		if (error instanceof ConnectError && error.code === Code.NotFound) throw new Error(`Workflow '${options.name}' not found.`);
+		if (error instanceof ConnectError && error.code === Code.NotFound) throw new Error(`Workflow '${workflowName}' not found.`);
 		throw error;
 	}
 }
+async function startWorkflowByName(options) {
+	const client = await initOperatorClient(await loadAccessToken({
+		useProfile: true,
+		profile: options.profile
+	}));
+	const workspaceId = loadWorkspaceId({
+		workspaceId: options.workspaceId,
+		profile: options.profile
+	});
+	const { config } = await loadConfig(options.configPath);
+	const { application } = await client.getApplication({
+		workspaceId,
+		applicationName: config.name
+	});
+	if (!application?.authNamespace) throw new Error(`Application ${config.name} does not have an auth configuration.`);
+	return await startWorkflowCore({
+		client,
+		workspaceId,
+		workflowName: options.name,
+		authInvoker: {
+			namespace: application.authNamespace,
+			machineUserName: options.machineUser
+		},
+		arg: options.arg,
+		interval: options.interval
+	});
+}
+async function startWorkflow(options) {
+	if ("name" in options) return await startWorkflowByName(options);
+	return await startWorkflowCore({
+		client: await initOperatorClient(await loadAccessToken({
+			useProfile: true,
+			profile: options.profile
+		})),
+		workspaceId: loadWorkspaceId({
+			workspaceId: options.workspaceId,
+			profile: options.profile
+		}),
+		workflowName: options.workflow.name,
+		authInvoker: options.authInvoker,
+		arg: options.arg,
+		interval: options.interval
+	});
+}
 const startCommand = defineCommand({
 	name: "start",
 	description: "Start a workflow execution.",
@@ -11785,7 +11761,7 @@ const startCommand = defineCommand({
 		...waitArgs
 	}),
 	run: withCommonArgs(async (args) => {
-		const { executionId, wait } = await startWorkflow({
+		const { executionId, wait } = await startWorkflowByName({
 			name: args.name,
 			machineUser: args.machineuser,
 			arg: args.arg,
@@ -12276,12 +12252,7 @@ const headerArg = z.string().superRefine((val, ctx) => {
 		value: val.slice(colonIndex + 1).trim()
 	};
 }).refine((h) => h.key.length > 0, { message: "Header name cannot be empty" });
-/**
-* Trigger an executor and return the job ID.
-* @param options - Options for triggering executor
-* @returns Result containing the job ID if available
-*/
-async function triggerExecutor(options) {
+async function triggerExecutorByName(options) {
 	const client = await initOperatorClient(await loadAccessToken({
 		useProfile: true,
 		profile: options.profile
@@ -12302,6 +12273,16 @@ async function triggerExecutor(options) {
 		throw error;
 	}
 }
+async function triggerExecutor(options) {
+	if ("executorName" in options) return await triggerExecutorByName(options);
+	if (options.executor.trigger.kind !== "incomingWebhook" && options.payload !== void 0) throw new Error(`Executor '${options.executor.name}' has '${options.executor.trigger.kind}' trigger type. The payload is only available for 'incomingWebhook' trigger type.`);
+	return await triggerExecutorByName({
+		executorName: options.executor.name,
+		payload: options.payload,
+		workspaceId: options.workspaceId,
+		profile: options.profile
+	});
+}
 const triggerCommand = defineCommand({
 	name: "trigger",
 	description: "Trigger an executor manually.",
@@ -12395,7 +12376,7 @@ The \`--logs\` option displays logs from the downstream execution when available
 			body: body ?? {},
 			headers
 		};
-		const result = await triggerExecutor({
+		const result = await triggerExecutorByName({
 			executorName: args.executorName,
 			payload,
 			workspaceId: args["workspace-id"],
@@ -13238,8 +13219,7 @@ async function generate$1(options) {
 	const watch$1 = options?.watch ?? false;
 	await generateUserTypes({
 		config,
-		configPath: config.path,
-		plugins
+		configPath: config.path
 	});
 	const manager = createGenerationManager(config, generators, plugins, config.path);
 	await manager.generate(watch$1);
@@ -13581,7 +13561,8 @@ async function execRemove(client, workspaceId, application, config, confirm) {
 	const app = await planApplication(ctx);
 	const executor = await planExecutor(ctx);
 	const workflow = await planWorkflow(client, workspaceId, application.name, {}, {});
-	if (tailorDB.changeSet.service.deletes.length === 0 && staticWebsite.changeSet.deletes.length === 0 && idp.changeSet.service.deletes.length === 0 && auth.changeSet.service.deletes.length === 0 && pipeline.changeSet.service.deletes.length === 0 && app.deletes.length === 0 && executor.changeSet.deletes.length === 0 && workflow.changeSet.deletes.length === 0) return;
+	const functionRegistry = await planFunctionRegistry(client, workspaceId, application.name, []);
+	if (tailorDB.changeSet.service.deletes.length === 0 && staticWebsite.changeSet.deletes.length === 0 && idp.changeSet.service.deletes.length === 0 && auth.changeSet.service.deletes.length === 0 && pipeline.changeSet.service.deletes.length === 0 && app.deletes.length === 0 && executor.changeSet.deletes.length === 0 && workflow.changeSet.deletes.length === 0 && functionRegistry.changeSet.deletes.length === 0) return;
 	if (confirm) await confirm();
 	await applyWorkflow(client, workflow, "delete");
 	await applyExecutor(client, executor, "delete");
@@ -13595,6 +13576,7 @@ async function execRemove(client, workspaceId, application, config, confirm) {
 	await applyIdP(client, idp, "delete-services");
 	await applyTailorDB(client, tailorDB, "delete-resources");
 	await applyTailorDB(client, tailorDB, "delete-services");
+	await applyFunctionRegistry(client, workspaceId, functionRegistry, "delete");
 }
 /**
 * Remove all resources managed by the current application.
@@ -14216,7 +14198,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication: defineApplication$1 } = await import("./application-DM4zTgXU.mjs");
+	const { defineApplication: defineApplication$1 } = await import("./application-JwJ_-_PQ.mjs");
 	const application = defineApplication$1({
 		config,
 		pluginManager
@@ -15427,4 +15409,4 @@ const updateCommand = defineCommand({
 
 //#endregion
 export { jobsCommand as $, initOperatorClient as $t, generateCommand as A, getMigrationFiles as At, getMachineUserToken as B, generateUserTypes as Bt, resumeCommand as C, compareLocalTypesWithSnapshot as Ct, truncate as D, getLatestMigrationNumber as Dt, listWorkflows as E, formatMigrationNumber as Et, removeCommand$1 as F, formatDiffSummary as Ft, generateCommand$1 as G, fetchLatestToken as Gt, listCommand$5 as H, getDistDir as Ht, listCommand$4 as I, formatMigrationDiff as It, triggerCommand as J, readPlatformConfig as Jt, listWebhookExecutors as K, loadAccessToken as Kt, listOAuth2Clients as L, hasChanges as Lt, show as M, isValidMigrationNumber as Mt, showCommand as N, loadDiff as Nt, truncateCommand as O, getMigrationDirPath as Ot, remove as P, reconstructSnapshotFromMigrations as Pt, getExecutorJob as Q, initOAuth2Client as Qt, getCommand$1 as R, getNamespacesWithMigrations as Rt, healthCommand as S, SCHEMA_FILE_NAME as St, listCommand$3 as T, createSnapshotFromLocalTypes as Tt, listMachineUsers as U, apiCall as Ut, tokenCommand as V, loadConfig as Vt, generate$1 as W, apiCommand as Wt, listCommand$6 as X, fetchAll as Xt, triggerExecutor as Y, writePlatformConfig as Yt, listExecutors as Z, fetchUserInfo as Zt, createCommand as _, bundleMigrationScript as _t, listCommand as a, jsonArgs as an, getWorkflow as at, listCommand$2 as b, INITIAL_SCHEMA_NUMBER as bt, inviteUser as c, listWorkflowExecutions as ct, listCommand$1 as d, apply as dt, readPackageJson as en, listExecutorJobs as et, listWorkspaces as f, applyCommand as ft, deleteWorkspace as g, parseMigrationLabelNumber as gt, deleteCommand as h, MIGRATION_LABEL_KEY as ht, removeUser as i, deploymentArgs as in, getCommand$2 as it, logBetaWarning as j, getNextMigrationNumber as jt, generate as k, getMigrationFilePath as kt, restoreCommand as l, getCommand$3 as lt, getWorkspace as m, waitForExecution$1 as mt, updateUser as n, commonArgs as nn, startCommand as nt, listUsers as o, withCommonArgs as on, executionsCommand as ot, getCommand as p, executeScript as pt, webhookCommand as q, loadWorkspaceId as qt, removeCommand as r, confirmationArgs as rn, startWorkflow as rt, inviteCommand as s, workspaceArgs as sn, getWorkflowExecution as st, updateCommand as t, PATScope as tn, watchExecutorJob as tt, restoreWorkspace as u, getExecutor as ut, createWorkspace as v, DB_TYPES_FILE_NAME as vt, resumeWorkflow as w, compareSnapshots as wt, getAppHealth as x, MIGRATE_FILE_NAME as xt, listApps as y, DIFF_FILE_NAME as yt, getOAuth2Client as z, trnPrefix as zt };
-//# sourceMappingURL=update-2eb6jz9o.mjs.map
+//# sourceMappingURL=update-C_ZTRB63.mjs.map