@tailor-platform/sdk 1.21.0 → 1.22.0

package/dist/{update-9MTRN1UA.mjs → query-Bz2oDGhw.mjs}

@@ -1,11 +1,11 @@
-import { t as db } from "./schema-D5Cpd8fQ.mjs";
-import { $ as TenantProviderConfig_TenantProviderType, A as WorkflowJobExecution_Status, D as userAgent, E as resolveStaticWebsiteUrls, F as TailorDBType_Permission_Permit, G as AuthInvokerSchema, H as ExecutorTargetType, I as TailorDBType_PermitAction, J as AuthSCIMAttribute_Mutability, K as AuthOAuth2Client_ClientType, L as PipelineResolver_OperationType, M as TailorDBGQLPermission_Operator, N as TailorDBGQLPermission_Permit, O as WorkspacePlatformUserRole, P as TailorDBType_Permission_Operator, R as IdPLang, T as platformBaseUrl, U as ExecutorTriggerType, V as ExecutorJobStatus, W as AuthIDPConfig_AuthType, X as AuthSCIMAttribute_Uniqueness, Y as AuthSCIMAttribute_Type, Z as AuthSCIMConfig_AuthorizationType, _ as loadWorkspaceId, a as buildExecutorArgsExpr, at as PageDirection, b as fetchAll, c as OAuth2ClientSchema, ct as logger, d as getDistDir, et as UserProfileProviderConfig_UserProfileProviderType, f as hashFile, g as loadOrganizationId, h as loadFolderId, i as loadConfig, it as FilterSchema, j as TailorDBGQLPermission_Action, k as WorkflowExecution_Status, l as stringifyFunction, lt as styles, m as loadAccessToken, n as generatePluginFilesIfNeeded, nt as ConditionSchema, o as buildResolverOperationHookExpr, ot as ApplicationSchemaUpdateAttemptStatus, q as AuthOAuth2Client_GrantType, r as loadApplication, rt as Condition_Operator, s as createExecutorService, st as Subgraph_ServiceType, t as defineApplication, tt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, u as createBundleCache, ut as symbols, v as readPlatformConfig, w as initOperatorClient, x as fetchMachineUserToken, y as writePlatformConfig, z as FunctionExecution_Status } from "./application-CEv5c7TU.mjs";
-import { t as readPackageJson } from "./package-json-3H5gfhA4.mjs";
-import { r as withSpan } from "./telemetry-DuBhnd0X.mjs";
+import { t as db } from "./schema-Cjm-OvPF.mjs";
+import { $ as AuthSCIMAttribute_Mutability, A as platformBaseUrl, B as TailorDBType_Permission_Permit, C as readPlatformConfig, E as fetchMachineUserToken, F as WorkflowJobExecution_Status, H as PipelineResolver_OperationType, I as TailorDBGQLPermission_Action, J as ExecutorTriggerType, K as ExecutorJobStatus, L as TailorDBGQLPermission_Operator, M as userAgent, N as WorkspacePlatformUserRole, P as WorkflowExecution_Status, Q as AuthOAuth2Client_GrantType, R as TailorDBGQLPermission_Permit, S as loadWorkspaceId, T as fetchAll, U as IdPLang, V as TailorDBType_PermitAction, W as FunctionExecution_Status, X as AuthInvokerSchema, Y as AuthIDPConfig_AuthType, Z as AuthOAuth2Client_ClientType, _ as hashFile, a as loadConfig, at as UserProfileProviderConfig_UserProfileProviderType, b as loadFolderId, ct as Condition_Operator, d as TailorDBTypeSchema, dt as ApplicationSchemaUpdateAttemptStatus, et as AuthSCIMAttribute_Type, f as stringifyFunction, ft as Subgraph_ServiceType, g as getDistDir, h as createBundleCache, ht as symbols, it as TenantProviderConfig_TenantProviderType, j as resolveStaticWebsiteUrls, k as initOperatorClient, l as OAuth2ClientSchema, lt as FilterSchema, m as loadFilesWithIgnores, mt as styles, n as generatePluginFilesIfNeeded, nt as AuthSCIMConfig_AuthorizationType, ot as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, p as tailorUserMap, pt as logger, q as ExecutorTargetType, r as loadApplication, s as createExecutorService, st as ConditionSchema, t as defineApplication, tt as AuthSCIMAttribute_Uniqueness, ut as PageDirection, w as writePlatformConfig, x as loadOrganizationId, y as loadAccessToken, z as TailorDBType_Permission_Operator } from "./application-CTQe2HSB.mjs";
+import { t as readPackageJson } from "./package-json-iVBhE5Ef.mjs";
+import { r as withSpan } from "./telemetry-C46fds1l.mjs";
 import { createRequire } from "node:module";
 import { arg, defineCommand, runCommand } from "politty";
 import { z } from "zod";
-import * as fs$2 from "node:fs";
+import * as fs$1 from "node:fs";
 import { parseEnv } from "node:util";
 import * as path from "pathe";
 import chalk from "chalk";
@@ -17,19 +17,48 @@ import { resolveTSConfig } from "pkg-types";
 import { findUpSync } from "find-up-simple";
 import ml from "multiline-ts";
 import * as crypto from "node:crypto";
+import { pathToFileURL } from "node:url";
 import * as inflection from "inflection";
-import * as fs$1 from "node:fs/promises";
-import { glob } from "node:fs/promises";
 import * as rolldown from "rolldown";
+import * as fs from "node:fs/promises";
+import { glob } from "node:fs/promises";
 import { create, fromJson, toJson } from "@bufbuild/protobuf";
 import ora from "ora";
 import { setTimeout as setTimeout$1 } from "timers/promises";
 import { spawn } from "node:child_process";
 import { watch } from "chokidar";
 import * as madgeModule from "madge";
+import { astVisitor, parse, toSql } from "pgsql-ast-parser";
 
 //#region src/cli/shared/errors.ts
 /**
+* Format CLI error for output
+* @param error - CLIError instance to format
+* @returns Formatted error message
+*/
+function formatError(error) {
+	const parts = [chalk.red(`Error${error.code ? ` [${error.code}]` : ""}: ${error.message}`)];
+	if (error.details) parts.push(`\n  ${chalk.gray("Details:")} ${error.details}`);
+	if (error.suggestion) parts.push(`\n  ${chalk.cyan("Suggestion:")} ${error.suggestion}`);
+	if (error.command) parts.push(`\n  ${chalk.gray("Help:")} Run \`tailor-sdk ${error.command} --help\` for usage information.`);
+	return parts.join("");
+}
+/**
+* Create a CLI error with formatted output
+* @param options - Options to construct a CLIError
+* @returns Constructed CLIError instance
+*/
+function createCLIError(options) {
+	const error = new Error(options.message);
+	error.name = "CLIError";
+	error.code = options.code;
+	error.details = options.details;
+	error.suggestion = options.suggestion;
+	error.command = options.command;
+	error.format = () => formatError(error);
+	return error;
+}
+/**
 * Type guard to check if an error is a CLIError
 * @param error - Error to check
 * @returns True if the error is a CLIError
@@ -83,11 +112,11 @@ function loadEnvFiles(envFiles, envFilesIfExists) {
 	const load = (files, required) => {
 		for (const file of [files ?? []].flat()) {
 			const envPath = path.resolve(process.cwd(), file);
-			if (!fs$2.existsSync(envPath)) {
+			if (!fs$1.existsSync(envPath)) {
 				if (required) throw new Error(`Environment file not found: ${envPath}`);
 				continue;
 			}
-			const parsed = parseEnv(fs$2.readFileSync(envPath, "utf-8"));
+			const parsed = parseEnv(fs$1.readFileSync(envPath, "utf-8"));
 			for (const [key, value] of Object.entries(parsed)) {
 				if (originalEnvKeys.has(key)) continue;
 				process.env[key] = value;
@@ -107,9 +136,19 @@ function loadEnvFiles(envFiles, envFilesIfExists) {
 const commonArgs = {
 	"env-file": arg(z.string().optional(), {
 		alias: "e",
-		description: "Path to the environment file (error if not found)"
+		description: "Path to the environment file (error if not found)",
+		completion: {
+			type: "file",
+			matcher: [".env.*", ".env"]
+		}
+	}),
+	"env-file-if-exists": arg(z.string().optional(), {
+		description: "Path to the environment file (ignored if not found)",
+		completion: {
+			type: "file",
+			matcher: [".env.*", ".env"]
+		}
 	}),
-	"env-file-if-exists": arg(z.string().optional(), { description: "Path to the environment file (ignored if not found)" }),
 	verbose: arg(z.boolean().default(false), { description: "Enable verbose logging" })
 };
 /**
@@ -118,22 +157,32 @@ const commonArgs = {
 const workspaceArgs = {
 	"workspace-id": arg(z.string().optional(), {
 		alias: "w",
-		description: "Workspace ID"
+		description: "Workspace ID",
+		completion: { type: "none" }
 	}),
 	profile: arg(z.string().optional(), {
 		alias: "p",
-		description: "Workspace profile"
+		description: "Workspace profile",
+		completion: { type: "none" }
 	})
 };
 /**
+* Shared config arg for commands that accept a config file path
+*/
+const configArg = { config: arg(z.string().default("tailor.config.ts"), {
+	alias: "c",
+	description: "Path to SDK config file",
+	completion: {
+		type: "file",
+		extensions: ["ts"]
+	}
+}) };
+/**
 * Arguments for commands that interact with deployed resources (includes config)
 */
 const deploymentArgs = {
 	...workspaceArgs,
-	config: arg(z.string().default("tailor.config.ts"), {
-		alias: "c",
-		description: "Path to SDK config file"
-	})
+	...configArg
 };
 /**
 * Arguments for commands that require confirmation
@@ -162,7 +211,7 @@ const withCommonArgs = (handler) => async (args) => {
 	try {
 		if ("json" in args && typeof args.json === "boolean") logger.jsonMode = args.json;
 		loadEnvFiles(args["env-file"], args["env-file-if-exists"]);
-		const { initTelemetry } = await import("./telemetry-Dhzj9Ncm.mjs");
+		const { initTelemetry } = await import("./telemetry-BAxP8-PR.mjs");
 		await initTelemetry();
 		await handler(args);
 	} catch (error) {
@@ -175,7 +224,7 @@ const withCommonArgs = (handler) => async (args) => {
 		} else logger.error(`Unknown error: ${error}`);
 		process.exit(1);
 	} finally {
-		const { shutdownTelemetry } = await import("./telemetry-Dhzj9Ncm.mjs");
+		const { shutdownTelemetry } = await import("./telemetry-BAxP8-PR.mjs");
 		await shutdownTelemetry();
 	}
 	process.exit(0);
@@ -229,7 +278,7 @@ const apiCommand = defineCommand({
 			positional: true,
 			description: "API endpoint to call (e.g., 'GetApplication' or 'tailor.v1.OperatorService/GetApplication')"
 		})
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const result = await apiCall({
 			profile: args.profile,
@@ -283,7 +332,7 @@ function createCacheStore(config) {
 	}
 	function loadManifest() {
 		try {
-			const raw = fs$2.readFileSync(manifestPath(), "utf-8");
+			const raw = fs$1.readFileSync(manifestPath(), "utf-8");
 			const result = cacheManifestSchema.safeParse(JSON.parse(raw));
 			if (!result.success) {
 				cachedManifest = void 0;
@@ -310,15 +359,15 @@ function createCacheStore(config) {
 		return cachedManifest;
 	}
 	function saveManifest(manifest) {
-		fs$2.mkdirSync(config.cacheDir, { recursive: true });
+		fs$1.mkdirSync(config.cacheDir, { recursive: true });
 		const target = manifestPath();
 		const tmpFile = path.join(config.cacheDir, `.manifest.${process.pid}.tmp`);
 		try {
-			fs$2.writeFileSync(tmpFile, JSON.stringify(manifest, null, 2), "utf-8");
-			fs$2.renameSync(tmpFile, target);
+			fs$1.writeFileSync(tmpFile, JSON.stringify(manifest, null, 2), "utf-8");
+			fs$1.renameSync(tmpFile, target);
 		} catch (e) {
 			try {
-				fs$2.rmSync(tmpFile, { force: true });
+				fs$1.rmSync(tmpFile, { force: true });
 			} catch {}
 			throw e;
 		}
@@ -337,29 +386,29 @@ function createCacheStore(config) {
 	}
 	function storeBundleOutput(cacheKey, sourcePath) {
 		const dir = bundlesDir();
-		fs$2.mkdirSync(dir, { recursive: true });
-		fs$2.copyFileSync(sourcePath, bundlePath(cacheKey));
+		fs$1.mkdirSync(dir, { recursive: true });
+		fs$1.copyFileSync(sourcePath, bundlePath(cacheKey));
 		const mapSource = `${sourcePath}.map`;
 		const cachedMapPath = `${bundlePath(cacheKey)}.map`;
-		if (fs$2.existsSync(mapSource)) fs$2.copyFileSync(mapSource, cachedMapPath);
-		else fs$2.rmSync(cachedMapPath, { force: true });
+		if (fs$1.existsSync(mapSource)) fs$1.copyFileSync(mapSource, cachedMapPath);
+		else fs$1.rmSync(cachedMapPath, { force: true });
 	}
 	function restoreBundleOutput(cacheKey, targetPath) {
 		const cached = bundlePath(cacheKey);
 		const targetDir = path.dirname(targetPath);
-		fs$2.mkdirSync(targetDir, { recursive: true });
+		fs$1.mkdirSync(targetDir, { recursive: true });
 		try {
-			fs$2.copyFileSync(cached, targetPath);
+			fs$1.copyFileSync(cached, targetPath);
 		} catch (e) {
 			if (e.code === "ENOENT") return false;
 			throw e;
 		}
 		const cachedMap = `${cached}.map`;
-		if (fs$2.existsSync(cachedMap)) fs$2.copyFileSync(cachedMap, `${targetPath}.map`);
+		if (fs$1.existsSync(cachedMap)) fs$1.copyFileSync(cachedMap, `${targetPath}.map`);
 		return true;
 	}
 	function clean() {
-		fs$2.rmSync(config.cacheDir, {
+		fs$1.rmSync(config.cacheDir, {
 			recursive: true,
 			force: true
 		});
@@ -536,8 +585,8 @@ async function generateUserTypes(options) {
 		if (env) logger.debug(`Extracted Env: ${JSON.stringify(env)}`);
 		const typeDefContent = generateTypeDefinition(attributeMap, attributeList, env);
 		const outputPath = resolveTypeDefinitionPath(configPath);
-		fs$2.mkdirSync(path.dirname(outputPath), { recursive: true });
-		fs$2.writeFileSync(outputPath, typeDefContent);
+		fs$1.mkdirSync(path.dirname(outputPath), { recursive: true });
+		fs$1.writeFileSync(outputPath, typeDefContent);
 		const relativePath = path.relative(process.cwd(), outputPath);
 		logger.newline();
 		logger.success(`Generated type definitions: ${relativePath}`, { mode: "plain" });
@@ -552,7 +601,7 @@ function resolvePackageDirectory(startDir) {
 	while (true) {
 		const candidate = path.join(currentDir, "node_modules", "@tailor-platform", "sdk");
 		const packageJsonPath = path.join(candidate, "package.json");
-		if (fs$2.existsSync(packageJsonPath)) return candidate;
+		if (fs$1.existsSync(packageJsonPath)) return candidate;
 		if (currentDir === root) break;
 		currentDir = path.dirname(currentDir);
 	}
@@ -999,6 +1048,10 @@ async function planApplication(context) {
 		changeSet.print();
 		return changeSet;
 	}
+	if (application.subgraphs.length === 0) {
+		changeSet.print();
+		return changeSet;
+	}
 	let authNamespace;
 	let authIdpConfigName;
 	if (application.authService && application.authService.config) {
@@ -2352,6 +2405,73 @@ async function confirmImportantResourceDeletion(resources, yes) {
     `);
 }
 
+//#endregion
+//#region src/cli/shared/runtime-args.ts
+/**
+* Runtime args transformation for all services.
+*
+* Each service transforms server-side args/context into SDK-friendly format:
+* - Executor: server-side expression evaluated by platform before calling function
+* - Resolver: operationHook expression evaluated by platform before calling function
+*
+* The user field mapping (server → SDK) shared across services is defined in
+* `@/parser/service/tailordb` as `tailorUserMap`.
+*/
+/**
+* Actor field transformation expression.
+*
+* Transforms the server's actor object to match the SDK's TailorActor type:
+*   server `attributeMap`  → SDK `attributes`
+*   server `attributes`    → SDK `attributeList`
+*   other fields           → passed through
+*   null/undefined actor   → null
+*/
+const ACTOR_TRANSFORM_EXPR = "actor: args.actor ? (({ attributeMap, attributes: attrList, ...rest }) => ({ ...rest, attributes: attributeMap, attributeList: attrList }))(args.actor) : null";
+/**
+* Build the JavaScript expression that transforms server-format executor event
+* args into SDK-format args at runtime.
+*
+* The Tailor Platform server delivers event args with server-side field names.
+* The SDK exposes different field names to user code. This function produces a
+* JavaScript expression string that performs the mapping when evaluated
+* server-side.
+* @param triggerKind - The trigger kind discriminant from the parsed executor
+* @param env - Application env record to embed in the expression
+* @returns A JavaScript expression string, e.g. `({ ...args, ... })`
+*/
+function buildExecutorArgsExpr(triggerKind, env) {
+	const envExpr = `env: ${JSON.stringify(env)}`;
+	switch (triggerKind) {
+		case "schedule":
+		case "recordCreated":
+		case "recordUpdated":
+		case "recordDeleted":
+		case "idpUserCreated":
+		case "idpUserUpdated":
+		case "idpUserDeleted":
+		case "authAccessTokenIssued":
+		case "authAccessTokenRefreshed":
+		case "authAccessTokenRevoked": return `({ ...args, appNamespace: args.namespaceName, ${ACTOR_TRANSFORM_EXPR}, ${envExpr} })`;
+		case "resolverExecuted": return `({ ...args, appNamespace: args.namespaceName, ${ACTOR_TRANSFORM_EXPR}, success: !!args.succeeded, result: args.succeeded?.result.resolver, error: args.failed?.error, ${envExpr} })`;
+		case "incomingWebhook": return `({ ...args, appNamespace: args.namespaceName, rawBody: args.raw_body, ${envExpr} })`;
+		default: throw new Error(`Unknown trigger kind for args expression: ${triggerKind}`);
+	}
+}
+/**
+* Build the operationHook expression for resolver pipelines.
+*
+* Transforms server context to SDK resolver context:
+*   context.args        → input
+*   context.pipeline     → spread into result
+*   user (global var)    → TailorUser (via tailorUserMap: workspace_id→workspaceId, attribute_map→attributes, attributes→attributeList)
+*   env                 → injected as JSON
+* @param env - Application env record to embed in the expression
+* @returns A JavaScript expression string for the operationHook
+*/
+function buildResolverOperationHookExpr(env) {
+	return `({ ...context.pipeline, input: context.args, user: ${tailorUserMap}, env: ${JSON.stringify(env)} });`;
+}
+
 //#endregion
 //#region src/cli/commands/apply/function-registry.ts
 const CHUNK_SIZE = 64 * 1024;
@@ -2403,7 +2523,7 @@ function collectFunctionEntries(application, workflowJobs) {
 	for (const app of application.applications) for (const pipeline of app.resolverServices) for (const resolver of Object.values(pipeline.resolvers)) {
 		const scriptPath = path.join(distDir, "resolvers", `${resolver.name}.js`);
 		try {
-			const content = fs$2.readFileSync(scriptPath, "utf-8");
+			const content = fs$1.readFileSync(scriptPath, "utf-8");
 			entries.push({
 				name: resolverFunctionName(pipeline.namespace, resolver.name),
 				scriptContent: content,
@@ -2419,7 +2539,7 @@ function collectFunctionEntries(application, workflowJobs) {
 		for (const executor of Object.values(executors)) if (executor.operation.kind === "function" || executor.operation.kind === "jobFunction") {
 			const scriptPath = path.join(distDir, "executors", `${executor.name}.js`);
 			try {
-				const content = fs$2.readFileSync(scriptPath, "utf-8");
+				const content = fs$1.readFileSync(scriptPath, "utf-8");
 				entries.push({
 					name: executorFunctionName(executor.name),
 					scriptContent: content,
@@ -2434,7 +2554,7 @@ function collectFunctionEntries(application, workflowJobs) {
 	for (const job of workflowJobs) {
 		const scriptPath = path.join(distDir, "workflow-jobs", `${job.name}.js`);
 		try {
-			const content = fs$2.readFileSync(scriptPath, "utf-8");
+			const content = fs$1.readFileSync(scriptPath, "utf-8");
 			entries.push({
 				name: workflowJobFunctionName(job.name),
 				scriptContent: content,
@@ -3725,7 +3845,7 @@ function createSnapshotFromLocalTypes(types, namespace) {
 * @returns {SchemaSnapshot} Loaded schema snapshot
 */
 function loadSnapshot(filePath) {
-	const content = fs$2.readFileSync(filePath, "utf-8");
+	const content = fs$1.readFileSync(filePath, "utf-8");
 	return JSON.parse(content);
 }
 /**
@@ -3734,7 +3854,7 @@ function loadSnapshot(filePath) {
 * @returns {MigrationDiff} Loaded migration diff
 */
 function loadDiff(filePath) {
-	const content = fs$2.readFileSync(filePath, "utf-8");
+	const content = fs$1.readFileSync(filePath, "utf-8");
 	return JSON.parse(content);
 }
 /**
@@ -3743,8 +3863,8 @@ function loadDiff(filePath) {
 * @returns {Array<{number: number, type: "schema" | "diff", path: string}>} Migration files sorted by number
 */
 function getMigrationFiles(migrationsDir) {
-	if (!fs$2.existsSync(migrationsDir)) return [];
-	const entries = fs$2.readdirSync(migrationsDir, { withFileTypes: true });
+	if (!fs$1.existsSync(migrationsDir)) return [];
+	const entries = fs$1.readdirSync(migrationsDir, { withFileTypes: true });
 	const migrations = [];
 	for (const entry of entries) {
 		if (!entry.isDirectory()) continue;
@@ -3752,13 +3872,13 @@ function getMigrationFiles(migrationsDir) {
 		const num = parseInt(entry.name, 10);
 		const migrationDir = path.join(migrationsDir, entry.name);
 		const schemaPath = path.join(migrationDir, SCHEMA_FILE_NAME);
-		if (fs$2.existsSync(schemaPath)) migrations.push({
+		if (fs$1.existsSync(schemaPath)) migrations.push({
 			number: num,
 			type: "schema",
 			path: schemaPath
 		});
 		const diffPath = path.join(migrationDir, DIFF_FILE_NAME);
-		if (fs$2.existsSync(diffPath)) migrations.push({
+		if (fs$1.existsSync(diffPath)) migrations.push({
 			number: num,
 			type: "diff",
 			path: diffPath
@@ -4330,7 +4450,7 @@ function compareLocalTypesWithSnapshot(snapshot, localTypes, namespace) {
 */
 function validateMigrationFiles(migrationsDir) {
 	const errors = [];
-	if (!fs$2.existsSync(migrationsDir)) return errors;
+	if (!fs$1.existsSync(migrationsDir)) return errors;
 	const migrationFiles = getMigrationFiles(migrationsDir);
 	if (migrationFiles.length === 0) return errors;
 	const schemaFiles = [];
@@ -4573,7 +4693,7 @@ function formatSchemaDrifts(drifts) {
 */
 async function bundleMigrationScript(sourceFile, namespace, migrationNumber) {
 	const outputDir = path.resolve(getDistDir(), "migrations");
-	fs$2.mkdirSync(outputDir, { recursive: true });
+	fs$1.mkdirSync(outputDir, { recursive: true });
 	const entryPath = path.join(outputDir, `migration_${namespace}_${migrationNumber}.entry.js`);
 	const outputPath = path.join(outputDir, `migration_${namespace}_${migrationNumber}.js`);
 	const entryContent = ml`
@@ -4595,7 +4715,7 @@ async function bundleMigrationScript(sourceFile, namespace, migrationNumber) {
       return { success: true };
     }
   `;
-	fs$2.writeFileSync(entryPath, entryContent);
+	fs$1.writeFileSync(entryPath, entryContent);
 	let tsconfig;
 	try {
 		tsconfig = await resolveTSConfig();
@@ -4625,7 +4745,7 @@ async function bundleMigrationScript(sourceFile, namespace, migrationNumber) {
 	return {
 		namespace,
 		migrationNumber,
-		bundledCode: fs$2.readFileSync(outputPath, "utf-8")
+		bundledCode: fs$1.readFileSync(outputPath, "utf-8")
 	};
 }
 
@@ -4687,7 +4807,7 @@ async function waitForExecution$1(client, workspaceId, executionId, pollInterval
 			logs: execution.logs,
 			result: execution.result
 		};
-		await new Promise((resolve) => setTimeout(resolve, pollInterval));
+		await new Promise((resolve$1) => setTimeout(resolve$1, pollInterval));
 	}
 }
 /**
@@ -4702,28 +4822,26 @@ async function waitForExecution$1(client, workspaceId, executionId, pollInterval
 */
 async function executeScript(options) {
 	const { client, workspaceId, name, code, arg: arg$1, invoker, pollInterval } = options;
-	const executionId = (await client.testExecScript({
+	const response = await client.testExecScript({
 		workspaceId,
 		name,
 		code,
 		arg: arg$1 ?? JSON.stringify({}),
 		invoker
-	})).executionId;
+	});
+	const executionId = response.executionId;
 	const result = await waitForExecution$1(client, workspaceId, executionId, pollInterval);
 	if (result.status === FunctionExecution_Status.SUCCESS) return {
 		success: true,
 		logs: result.logs,
 		result: result.result
 	};
-	else {
-		const errorDetails = [result.logs, result.result].filter(Boolean).join("\n");
-		return {
-			success: false,
-			logs: result.logs,
-			result: result.result,
-			error: errorDetails || "Script execution failed with unknown error"
-		};
-	}
+	else return {
+		success: false,
+		logs: result.logs,
+		result: result.result || response.result,
+		error: result.result || response.result || "Script execution failed with unknown error"
+	};
 }
 
 //#endregion
@@ -4766,10 +4884,10 @@ async function detectPendingMigrations(client, workspaceId, namespacesWithMigrat
 		for (const file of migrationFiles) {
 			if (file.number <= currentMigration) continue;
 			const diffPath = getMigrationFilePath(migrationsDir, file.number, "diff");
-			if (!fs$2.existsSync(diffPath)) continue;
+			if (!fs$1.existsSync(diffPath)) continue;
 			const diff = loadDiff(diffPath);
 			const scriptPath = getMigrationFilePath(migrationsDir, file.number, "migrate");
-			if (diff.requiresMigrationScript && !fs$2.existsSync(scriptPath)) {
+			if (diff.requiresMigrationScript && !fs$1.existsSync(scriptPath)) {
 				logger.warn(`Migration ${namespace}/${file.number} requires a script but migrate.ts not found`);
 				continue;
 			}
@@ -6228,7 +6346,7 @@ async function apply(options) {
 			const packageJson = await readPackageJson();
 			const cacheDir = path.resolve(getDistDir(), "cache");
 			if (options?.cleanCache) {
-				fs$2.rmSync(cacheDir, {
+				fs$1.rmSync(cacheDir, {
 					recursive: true,
 					force: true
 				});
@@ -6718,7 +6836,7 @@ const getCommand$3 = defineCommand({
 		...jsonArgs,
 		...workspaceArgs,
 		...nameArgs$1
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const executor = await getExecutor({
 			name: args.name,
@@ -6921,7 +7039,7 @@ function toWorkflowExecutionInfo(execution) {
 //#endregion
 //#region src/cli/commands/workflow/executions.ts
 function sleep$1(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
+	return new Promise((resolve$1) => setTimeout(resolve$1, ms));
 }
 function formatTime$2(date) {
 	return date.toLocaleTimeString("en-US", { hour12: false });
@@ -7136,7 +7254,7 @@ const executionsCommand = defineCommand({
 		}),
 		...waitArgs,
 		logs: arg(z.boolean().default(false), { description: "Display job execution logs (detail mode only)" })
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		if (args.executionId) {
 			const interval = parseDuration(args.interval);
@@ -7205,7 +7323,7 @@ const getCommand$2 = defineCommand({
 		...jsonArgs,
 		...workspaceArgs,
 		...nameArgs
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const workflow = await getWorkflow({
 			name: args.name,
@@ -7219,7 +7337,7 @@ const getCommand$2 = defineCommand({
 //#endregion
 //#region src/cli/commands/workflow/start.ts
 function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
+	return new Promise((resolve$1) => setTimeout(resolve$1, ms));
 }
 function formatTime$1(date) {
 	return date.toLocaleTimeString("en-US", { hour12: false });
@@ -7391,7 +7509,7 @@ const startCommand = defineCommand({
 			description: "Workflow argument (JSON string)"
 		}),
 		...waitArgs
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const { executionId, wait } = await startWorkflowByName({
 			name: args.name,
@@ -7725,7 +7843,7 @@ const jobsCommand = defineCommand({
 			description: "Display function execution logs after completion (requires --wait)"
 		}),
 		limit: arg(positiveIntArg.optional(), { description: "Maximum number of jobs to list (default: 50, max: 1000) (list mode only)" })
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		if (args.jobId) {
 			if (args.wait) {
@@ -7829,7 +7947,7 @@ const listCommand$6 = defineCommand({
 		...commonArgs,
 		...jsonArgs,
 		...workspaceArgs
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const executors = await listExecutors({
 			workspaceId: args["workspace-id"],
@@ -7974,7 +8092,7 @@ The \`--logs\` option displays logs from the downstream execution when available
 			alias: "l",
 			description: "Display function execution logs after completion (requires --wait)"
 		})
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const client = await initOperatorClient(await loadAccessToken({
 			useProfile: true,
@@ -8104,7 +8222,7 @@ const listWebhookCommand = defineCommand({
 		...commonArgs,
 		...jsonArgs,
 		...workspaceArgs
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const executors = await listWebhookExecutors({
 			workspaceId: args["workspace-id"],
@@ -8532,7 +8650,7 @@ function createDependencyWatcher(options = {}) {
 function createGenerationManager(params) {
 	const { application, config, generators = [], pluginManager } = params;
 	const baseDir = path.join(getDistDir(), "generated");
-	fs$2.mkdirSync(baseDir, { recursive: true });
+	fs$1.mkdirSync(baseDir, { recursive: true });
 	const services = {
 		tailordb: {},
 		resolver: {},
@@ -8752,14 +8870,14 @@ function createGenerationManager(params) {
 	*/
 	async function writeGeneratedFiles(sourceId, result) {
 		await Promise.all(result.files.map(async (file) => {
-			fs$2.mkdirSync(path.dirname(file.path), { recursive: true });
-			return new Promise((resolve, reject) => {
-				if (file.skipIfExists && fs$2.existsSync(file.path)) {
+			fs$1.mkdirSync(path.dirname(file.path), { recursive: true });
+			return new Promise((resolve$1, reject) => {
+				if (file.skipIfExists && fs$1.existsSync(file.path)) {
 					const relativePath = path.relative(process.cwd(), file.path);
 					logger.debug(`${sourceId} | skip existing: ${relativePath}`);
-					return resolve();
+					return resolve$1();
 				}
-				fs$2.writeFile(file.path, file.content, (err) => {
+				fs$1.writeFile(file.path, file.content, (err) => {
 					if (err) {
 						const relativePath = path.relative(process.cwd(), file.path);
 						logger.error(`Error writing file ${styles.bold(relativePath)}`);
@@ -8768,15 +8886,15 @@ function createGenerationManager(params) {
 					} else {
 						const relativePath = path.relative(process.cwd(), file.path);
 						logger.log(`${sourceId} | generate: ${styles.success(relativePath)}`);
-						if (file.executable) fs$2.chmod(file.path, 493, (chmodErr) => {
+						if (file.executable) fs$1.chmod(file.path, 493, (chmodErr) => {
 							if (chmodErr) {
 								const relativePath$1 = path.relative(process.cwd(), file.path);
 								logger.error(`Error setting executable permission on ${styles.bold(relativePath$1)}`);
 								logger.error(String(chmodErr));
 								reject(chmodErr);
-							} else resolve();
+							} else resolve$1();
 						});
-						else resolve();
+						else resolve$1();
 					}
 				});
 			});
@@ -9040,7 +9158,7 @@ const listCommand$5 = defineCommand({
 		...commonArgs,
 		...jsonArgs,
 		...deploymentArgs
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const machineUsers = await listMachineUsers({
 			workspaceId: args["workspace-id"],
@@ -9102,7 +9220,7 @@ const tokenCommand = defineCommand({
 			positional: true,
 			description: "Machine user name"
 		})
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const token = await getMachineUserToken({
 			name: args.name,
@@ -9205,7 +9323,7 @@ const getCommand$1 = defineCommand({
 			positional: true,
 			description: "OAuth2 client name"
 		})
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const credentials = await getOAuth2Client({
 			name: args.name,
@@ -9256,7 +9374,7 @@ const listCommand$4 = defineCommand({
 		...commonArgs,
 		...jsonArgs,
 		...deploymentArgs
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const oauth2Clients = await listOAuth2Clients({
 			workspaceId: args["workspace-id"],
@@ -9269,7 +9387,7 @@ const listCommand$4 = defineCommand({
 
 //#endregion
 //#region src/cli/commands/remove.ts
-async function loadOptions$9(options) {
+async function loadOptions$10(options) {
 	const client = await initOperatorClient(await loadAccessToken({
 		useProfile: true,
 		profile: options?.profile
@@ -9325,7 +9443,7 @@ async function execRemove(client, workspaceId, application, config, confirm) {
 * @returns Promise that resolves when removal completes
 */
 async function remove(options) {
-	const { client, workspaceId, application, config } = await loadOptions$9(options);
+	const { client, workspaceId, application, config } = await loadOptions$10(options);
 	await execRemove(client, workspaceId, application, config);
 }
 const removeCommand$1 = defineCommand({
@@ -9335,9 +9453,9 @@ const removeCommand$1 = defineCommand({
 		...commonArgs,
 		...deploymentArgs,
 		...confirmationArgs
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
-		const { client, workspaceId, application, config } = await loadOptions$9({
+		const { client, workspaceId, application, config } = await loadOptions$10({
 			workspaceId: args["workspace-id"],
 			profile: args.profile,
 			configPath: args.config
@@ -9409,7 +9527,7 @@ const showCommand = defineCommand({
 		...commonArgs,
 		...jsonArgs,
 		...deploymentArgs
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const appInfo$1 = await show({
 			workspaceId: args["workspace-id"],
@@ -9670,7 +9788,7 @@ function generateFieldType(config, isOptionalToRequired, enumValueChange) {
 async function writeDbTypesFile(snapshot, migrationsDir, migrationNumber, diff) {
 	const content = generateDbTypesFromSnapshot(snapshot, diff);
 	const filePath = getMigrationFilePath(migrationsDir, migrationNumber, "db");
-	await fs$1.writeFile(filePath, content);
+	await fs.writeFile(filePath, content);
 	return filePath;
 }
 
@@ -9692,7 +9810,7 @@ async function writeDbTypesFile(snapshot, migrationsDir, migrationNumber, diff)
 */
 async function fileExists(filePath) {
 	try {
-		await fs$1.access(filePath);
+		await fs.access(filePath);
 		return true;
 	} catch {
 		return false;
@@ -9715,10 +9833,10 @@ async function ensureFileNotExists(filePath) {
 */
 async function generateSchemaFile(snapshot, migrationsDir, migrationNumber) {
 	const migrationDir = getMigrationDirPath(migrationsDir, migrationNumber);
-	await fs$1.mkdir(migrationDir, { recursive: true });
+	await fs.mkdir(migrationDir, { recursive: true });
 	const filePath = getMigrationFilePath(migrationsDir, migrationNumber, "schema");
 	await ensureFileNotExists(filePath);
-	await fs$1.writeFile(filePath, JSON.stringify(snapshot, null, 2));
+	await fs.writeFile(filePath, JSON.stringify(snapshot, null, 2));
 	return {
 		filePath,
 		migrationNumber
@@ -9735,7 +9853,7 @@ async function generateSchemaFile(snapshot, migrationsDir, migrationNumber) {
 */
 async function generateDiffFiles(diff, migrationsDir, migrationNumber, previousSnapshot, description) {
 	const migrationDir = getMigrationDirPath(migrationsDir, migrationNumber);
-	await fs$1.mkdir(migrationDir, { recursive: true });
+	await fs.mkdir(migrationDir, { recursive: true });
 	const diffFilePath = getMigrationFilePath(migrationsDir, migrationNumber, "diff");
 	const migrateFilePath = getMigrationFilePath(migrationsDir, migrationNumber, "migrate");
 	const dbTypesFilePath = getMigrationFilePath(migrationsDir, migrationNumber, "db");
@@ -9748,14 +9866,14 @@ async function generateDiffFiles(diff, migrationsDir, migrationNumber, previousS
 		...diff,
 		description
 	};
-	await fs$1.writeFile(diffFilePath, JSON.stringify(diff, null, 2));
+	await fs.writeFile(diffFilePath, JSON.stringify(diff, null, 2));
 	const result = {
 		diffFilePath,
 		migrationNumber
 	};
 	if (diff.requiresMigrationScript) {
 		const scriptContent = generateMigrationScript(diff);
-		await fs$1.writeFile(migrateFilePath, scriptContent);
+		await fs.writeFile(migrateFilePath, scriptContent);
 		result.migrateFilePath = migrateFilePath;
 		await writeDbTypesFile(previousSnapshot, migrationsDir, migrationNumber, diff);
 		result.dbTypesFilePath = dbTypesFilePath;
@@ -9890,7 +10008,7 @@ function generateChangeScript(change) {
 * @returns {Promise<void>}
 */
 async function handleInitOption(namespaces, skipConfirmation) {
-	const existingDirs = namespaces.filter(({ migrationsDir }) => fs$2.existsSync(migrationsDir));
+	const existingDirs = namespaces.filter(({ migrationsDir }) => fs$1.existsSync(migrationsDir));
 	if (existingDirs.length === 0) {
 		logger.info("No existing migration directories found.");
 		return;
@@ -9910,7 +10028,7 @@ async function handleInitOption(namespaces, skipConfirmation) {
 		logger.newline();
 	}
 	for (const { namespace, migrationsDir } of existingDirs) try {
-		await fs$1.rm(migrationsDir, {
+		await fs.rm(migrationsDir, {
 			recursive: true,
 			force: true
 		});
@@ -9940,7 +10058,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication: defineApplication$1 } = await import("./application-DiCzM9b0.mjs");
+	const { defineApplication: defineApplication$1 } = await import("./application-DdSu3baZ.mjs");
 	const application = defineApplication$1({
 		config,
 		pluginManager
@@ -10051,7 +10169,7 @@ async function openInEditor(filePath) {
 	const editor = process.env.EDITOR;
 	if (!editor) return;
 	try {
-		await fs$1.access(filePath);
+		await fs.access(filePath);
 	} catch {
 		return;
 	}
@@ -10062,9 +10180,9 @@ async function openInEditor(filePath) {
 		stdio: "inherit",
 		detached: false
 	});
-	await new Promise((resolve) => {
-		child.on("close", () => resolve());
-		child.on("error", () => resolve());
+	await new Promise((resolve$1) => {
+		child.on("close", () => resolve$1());
+		child.on("error", () => resolve$1());
 	});
 }
 /**
@@ -10076,16 +10194,13 @@ const generateCommand = defineCommand({
 	args: z.object({
 		...commonArgs,
 		...confirmationArgs,
-		config: arg(z.string().default("tailor.config.ts"), {
-			alias: "c",
-			description: "Path to SDK config file"
-		}),
+		...configArg,
 		name: arg(z.string().optional(), {
 			alias: "n",
 			description: "Optional description for the migration"
 		}),
 		init: arg(z.boolean().default(false), { description: "Delete existing migrations and start fresh" })
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		await generate({
 			configPath: args.config,
@@ -10096,6 +10211,63 @@ const generateCommand = defineCommand({
 	})
 });
 
+//#endregion
+//#region src/cli/shared/config.ts
+/**
+* Extracts all configured namespace names from loaded application config.
+* Currently namespaces are derived from the `db` section.
+* @param config - Loaded application configuration.
+* @returns Namespace names in insertion order.
+*/
+function extractAllNamespaces(config) {
+	const namespaces = /* @__PURE__ */ new Set();
+	if (config.db) for (const [namespaceName] of Object.entries(config.db)) namespaces.add(namespaceName);
+	return Array.from(namespaces);
+}
+
+//#endregion
+//#region src/cli/shared/tailordb-namespace.ts
+/**
+* Resolve TailorDB type names to namespace names.
+* @param args - Resolution inputs
+* @returns Type to namespace map for found types
+*/
+async function resolveTypeNamespaces(args) {
+	const requestedTypesByLowercase = /* @__PURE__ */ new Map();
+	for (const typeName of args.typeNames) {
+		const key = typeName.toLowerCase();
+		const existing = requestedTypesByLowercase.get(key);
+		if (existing) {
+			existing.push(typeName);
+			continue;
+		}
+		requestedTypesByLowercase.set(key, [typeName]);
+	}
+	const unresolvedTypes = new Set(args.typeNames);
+	const typeNamespaceMap = /* @__PURE__ */ new Map();
+	for (const namespace of args.namespaces) {
+		if (unresolvedTypes.size === 0) break;
+		try {
+			const { tailordbTypes } = await args.client.listTailorDBTypes({
+				workspaceId: args.workspaceId,
+				namespaceName: namespace
+			});
+			for (const type of tailordbTypes) {
+				const matchedRequestedTypes = requestedTypesByLowercase.get(type.name.toLowerCase());
+				if (!matchedRequestedTypes) continue;
+				for (const requestedTypeName of matchedRequestedTypes) {
+					if (typeNamespaceMap.has(requestedTypeName)) continue;
+					typeNamespaceMap.set(requestedTypeName, namespace);
+					unresolvedTypes.delete(requestedTypeName);
+				}
+			}
+		} catch {
+			continue;
+		}
+	}
+	return typeNamespaceMap;
+}
+
 //#endregion
 //#region src/cli/commands/tailordb/truncate.ts
 async function truncateSingleType(options, client) {
@@ -10113,25 +10285,6 @@ async function truncateNamespace(workspaceId, namespaceName, client) {
 	});
 	logger.success(`Truncated all types in namespace "${namespaceName}"`);
 }
-async function getAllNamespaces(configPath) {
-	const { config } = await loadConfig(configPath);
-	const namespaces = /* @__PURE__ */ new Set();
-	if (config.db) for (const [namespaceName] of Object.entries(config.db)) namespaces.add(namespaceName);
-	return Array.from(namespaces);
-}
-async function getTypeNamespace(workspaceId, typeName, client, configPath) {
-	const namespaces = await getAllNamespaces(configPath);
-	for (const namespace of namespaces) try {
-		const { tailordbTypes } = await client.listTailorDBTypes({
-			workspaceId,
-			namespaceName: namespace
-		});
-		if (tailordbTypes.some((type) => type.name === typeName)) return namespace;
-	} catch {
-		continue;
-	}
-	return null;
-}
 /**
 * Truncate TailorDB data based on the given options.
 * @param options - Truncate options (all, namespace, or types)
@@ -10162,7 +10315,8 @@ async function $truncate(options) {
 	].filter(Boolean).length;
 	if (optionCount === 0) throw new Error("Please specify one of: --all, --namespace <name>, or type names");
 	if (optionCount > 1) throw new Error("Options --all, --namespace, and type names are mutually exclusive. Please specify only one.");
-	const namespaces = await getAllNamespaces(options?.configPath);
+	const { config } = await loadConfig(options?.configPath);
+	const namespaces = extractAllNamespaces(config);
 	if (hasAll) {
 		if (namespaces.length === 0) {
 			logger.warn("No namespaces found in config file.");
@@ -10199,13 +10353,13 @@ async function $truncate(options) {
 	}
 	if (hasTypes && options?.types) {
 		const typeNames = options.types;
-		const typeNamespaceMap = /* @__PURE__ */ new Map();
-		const notFoundTypes = [];
-		for (const typeName of typeNames) {
-			const namespace = await getTypeNamespace(workspaceId, typeName, client, options.configPath);
-			if (namespace) typeNamespaceMap.set(typeName, namespace);
-			else notFoundTypes.push(typeName);
-		}
+		const typeNamespaceMap = await resolveTypeNamespaces({
+			workspaceId,
+			namespaces,
+			typeNames,
+			client
+		});
+		const notFoundTypes = typeNames.filter((typeName) => !typeNamespaceMap.has(typeName));
 		if (notFoundTypes.length > 0) throw new Error(`The following types were not found in any namespace: ${notFoundTypes.join(", ")}`);
 		if (!options.yes) {
 			const typeList = typeNames.join(", ");
@@ -10247,7 +10401,7 @@ const truncateCommand = defineCommand({
 			alias: "n",
 			description: "Truncate all tables in specified namespace"
 		})
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const types = args.types && args.types.length > 0 ? args.types : void 0;
 		await $truncate({
@@ -10294,7 +10448,7 @@ const listCommand$3 = defineCommand({
 		...commonArgs,
 		...jsonArgs,
 		...workspaceArgs
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const workflows = await listWorkflows({
 			workspaceId: args["workspace-id"],
@@ -10359,7 +10513,7 @@ const resumeCommand = defineCommand({
 			description: "Failed execution ID"
 		}),
 		...waitArgs
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const { executionId, wait } = await resumeWorkflow({
 			executionId: args.executionId,
@@ -10427,7 +10581,7 @@ const healthOptionsSchema = z.object({
 	profile: z.string().optional(),
 	name: z.string().min(1, { message: "name is required" })
 });
-async function loadOptions$8(options) {
+async function loadOptions$9(options) {
 	const result = healthOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(result.error.issues[0].message);
 	return {
@@ -10445,7 +10599,7 @@ async function loadOptions$8(options) {
 * @returns Application health information
 */
 async function getAppHealth(options) {
-	const { client, workspaceId, name } = await loadOptions$8(options);
+	const { client, workspaceId, name } = await loadOptions$9(options);
 	return appHealthInfo(name, await client.getApplicationSchemaHealth({
 		workspaceId,
 		applicationName: name
@@ -10462,7 +10616,7 @@ const healthCommand = defineCommand({
 			description: "Application name",
 			alias: "n"
 		})
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const health = await getAppHealth({
 			workspaceId: args["workspace-id"],
@@ -10485,7 +10639,7 @@ const listAppsOptionsSchema = z.object({
 	profile: z.string().optional(),
 	limit: z.coerce.number().int().positive().optional()
 });
-async function loadOptions$7(options) {
+async function loadOptions$8(options) {
 	const result = listAppsOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(result.error.issues[0].message);
 	return {
@@ -10503,7 +10657,7 @@ async function loadOptions$7(options) {
 * @returns List of applications
 */
 async function listApps(options) {
-	const { client, workspaceId, limit } = await loadOptions$7(options);
+	const { client, workspaceId, limit } = await loadOptions$8(options);
 	const hasLimit = limit !== void 0;
 	const results = [];
 	let pageToken = "";
@@ -10535,7 +10689,7 @@ const listCommand$2 = defineCommand({
 			alias: "l",
 			description: "Maximum number of applications to list"
 		})
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const apps = await listApps({
 			workspaceId: args["workspace-id"],
@@ -10640,7 +10794,7 @@ const createCommand = defineCommand({
 			description: "Profile name to create"
 		}),
 		"profile-user": arg(z.string().optional(), { description: "User email for the profile (defaults to current user)" })
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const workspace = await createWorkspace({
 			name: args.name,
@@ -10688,7 +10842,7 @@ const createCommand = defineCommand({
 //#endregion
 //#region src/cli/commands/workspace/delete.ts
 const deleteWorkspaceOptionsSchema = z.object({ workspaceId: z.uuid({ message: "workspace-id must be a valid UUID" }) });
-async function loadOptions$6(options) {
+async function loadOptions$7(options) {
 	const result = deleteWorkspaceOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(result.error.issues[0].message);
 	return {
@@ -10702,7 +10856,7 @@ async function loadOptions$6(options) {
 * @returns Promise that resolves when deletion completes
 */
 async function deleteWorkspace(options) {
-	const { client, workspaceId } = await loadOptions$6(options);
+	const { client, workspaceId } = await loadOptions$7(options);
 	await client.deleteWorkspace({ workspaceId });
 }
 const deleteCommand = defineCommand({
@@ -10715,9 +10869,9 @@ const deleteCommand = defineCommand({
 			description: "Workspace ID"
 		}),
 		...confirmationArgs
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
-		const { client, workspaceId } = await loadOptions$6({ workspaceId: args["workspace-id"] });
+		const { client, workspaceId } = await loadOptions$7({ workspaceId: args["workspace-id"] });
 		let workspace;
 		try {
 			workspace = await client.getWorkspace({ workspaceId });
@@ -10748,7 +10902,7 @@ const getWorkspaceOptionsSchema = z.object({
 	workspaceId: z.uuid({ message: "workspace-id must be a valid UUID" }).optional(),
 	profile: z.string().optional()
 });
-async function loadOptions$5(options) {
+async function loadOptions$6(options) {
 	const result = getWorkspaceOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(result.error.issues[0].message);
 	return {
@@ -10765,7 +10919,7 @@ async function loadOptions$5(options) {
 * @returns Workspace details
 */
 async function getWorkspace(options) {
-	const { client, workspaceId } = await loadOptions$5(options);
+	const { client, workspaceId } = await loadOptions$6(options);
 	const response = await client.getWorkspace({ workspaceId });
 	if (!response.workspace) throw new Error(`Workspace "${workspaceId}" not found.`);
 	return workspaceDetails(response.workspace);
@@ -10777,7 +10931,7 @@ const getCommand = defineCommand({
 		...commonArgs,
 		...jsonArgs,
 		...workspaceArgs
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const workspace = await getWorkspace({
 			workspaceId: args["workspace-id"],
@@ -10831,7 +10985,7 @@ const listCommand$1 = defineCommand({
 			alias: "l",
 			description: "Maximum number of workspaces to list"
 		})
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const workspaces = await listWorkspaces({ limit: args.limit });
 		logger.out(workspaces, { display: { updatedAt: null } });
@@ -10841,7 +10995,7 @@ const listCommand$1 = defineCommand({
 //#endregion
 //#region src/cli/commands/workspace/restore.ts
 const restoreWorkspaceOptionsSchema = z.object({ workspaceId: z.uuid({ message: "workspace-id must be a valid UUID" }) });
-async function loadOptions$4(options) {
+async function loadOptions$5(options) {
 	const result = restoreWorkspaceOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(result.error.issues[0].message);
 	return {
@@ -10855,7 +11009,7 @@ async function loadOptions$4(options) {
 * @returns Promise that resolves when restoration completes
 */
 async function restoreWorkspace(options) {
-	const { client, workspaceId } = await loadOptions$4(options);
+	const { client, workspaceId } = await loadOptions$5(options);
 	await client.restoreWorkspace({ workspaceId });
 }
 const restoreCommand = defineCommand({
@@ -10868,9 +11022,9 @@ const restoreCommand = defineCommand({
 			description: "Workspace ID"
 		}),
 		...confirmationArgs
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
-		const { client, workspaceId } = await loadOptions$4({ workspaceId: args["workspace-id"] });
+		const { client, workspaceId } = await loadOptions$5({ workspaceId: args["workspace-id"] });
 		if (!args.yes) {
 			if (await logger.prompt(`Are you sure you want to restore workspace "${workspaceId}"? (yes/no):`, { type: "text" }) !== "yes") {
 				logger.info("Workspace restoration cancelled.");
@@ -10921,7 +11075,7 @@ const inviteUserOptionsSchema = z.object({
 	email: z.email({ message: "email must be a valid email address" }),
 	role: z.enum(validRoles, { message: `role must be one of: ${validRoles.join(", ")}` })
 });
-async function loadOptions$3(options) {
+async function loadOptions$4(options) {
 	const result = inviteUserOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(result.error.issues[0].message);
 	return {
@@ -10940,7 +11094,7 @@ async function loadOptions$3(options) {
 * @returns Promise that resolves when invitation is sent
 */
 async function inviteUser(options) {
-	const { client, workspaceId, email, role } = await loadOptions$3(options);
+	const { client, workspaceId, email, role } = await loadOptions$4(options);
 	await client.inviteWorkspacePlatformUser({
 		workspaceId,
 		email,
@@ -10958,7 +11112,7 @@ const inviteCommand = defineCommand({
 			description: `Role to assign (${validRoles.join(", ")})`,
 			alias: "r"
 		})
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		await inviteUser({
 			workspaceId: args["workspace-id"],
@@ -10977,7 +11131,7 @@ const listUsersOptionsSchema = z.object({
 	profile: z.string().optional(),
 	limit: z.coerce.number().int().positive().optional()
 });
-async function loadOptions$2(options) {
+async function loadOptions$3(options) {
 	const result = listUsersOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(result.error.issues[0].message);
 	return {
@@ -10995,7 +11149,7 @@ async function loadOptions$2(options) {
 * @returns List of workspace users
 */
 async function listUsers(options) {
-	const { client, workspaceId, limit } = await loadOptions$2(options);
+	const { client, workspaceId, limit } = await loadOptions$3(options);
 	const hasLimit = limit !== void 0;
 	const results = [];
 	let pageToken = "";
@@ -11027,7 +11181,7 @@ const listCommand = defineCommand({
 			alias: "l",
 			description: "Maximum number of users to list"
 		})
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		const users = await listUsers({
 			workspaceId: args["workspace-id"],
@@ -11045,7 +11199,7 @@ const removeUserOptionsSchema = z.object({
 	profile: z.string().optional(),
 	email: z.string().email({ message: "email must be a valid email address" })
 });
-async function loadOptions$1(options) {
+async function loadOptions$2(options) {
 	const result = removeUserOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(result.error.issues[0].message);
 	return {
@@ -11063,7 +11217,7 @@ async function loadOptions$1(options) {
 * @returns Promise that resolves when removal completes
 */
 async function removeUser(options) {
-	const { client, workspaceId, email } = await loadOptions$1(options);
+	const { client, workspaceId, email } = await loadOptions$2(options);
 	await client.removeWorkspacePlatformUser({
 		workspaceId,
 		email
@@ -11077,7 +11231,7 @@ const removeCommand = defineCommand({
 		...workspaceArgs,
 		email: arg(z.email(), { description: "Email address of the user to remove" }),
 		...confirmationArgs
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		if (!args.yes) {
 			if (await logger.prompt(`Are you sure you want to remove user "${args.email}" from the workspace? (yes/no):`, { type: "text" }) !== "yes") {
@@ -11102,7 +11256,7 @@ const updateUserOptionsSchema = z.object({
 	email: z.string().email({ message: "email must be a valid email address" }),
 	role: z.enum(validRoles, { message: `role must be one of: ${validRoles.join(", ")}` })
 });
-async function loadOptions(options) {
+async function loadOptions$1(options) {
 	const result = updateUserOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(result.error.issues[0].message);
 	return {
@@ -11121,7 +11275,7 @@ async function loadOptions(options) {
 * @returns Promise that resolves when update completes
 */
 async function updateUser(options) {
-	const { client, workspaceId, email, role } = await loadOptions(options);
+	const { client, workspaceId, email, role } = await loadOptions$1(options);
 	await client.updateWorkspacePlatformUser({
 		workspaceId,
 		email,
@@ -11139,7 +11293,7 @@ const updateCommand = defineCommand({
 			description: `New role to assign (${validRoles.join(", ")})`,
 			alias: "r"
 		})
-	}),
+	}).strict(),
 	run: withCommonArgs(async (args) => {
 		await updateUser({
 			workspaceId: args["workspace-id"],
@@ -11152,5 +11306,592 @@ const updateCommand = defineCommand({
 });
 
 //#endregion
-export { listExecutorJobs as $, generateCommand as A, getMigrationFiles as At, getMachineUserToken as B, generateUserTypes as Bt, resumeCommand as C, compareLocalTypesWithSnapshot as Ct, truncate as D, getLatestMigrationNumber as Dt, listWorkflows as E, formatMigrationNumber as Et, removeCommand$1 as F, formatDiffSummary as Ft, listWebhookExecutors as G, deploymentArgs as Gt, listCommand$5 as H, apiCommand as Ht, listCommand$4 as I, formatMigrationDiff as It, triggerExecutor as J, workspaceArgs as Jt, webhookCommand as K, jsonArgs as Kt, listOAuth2Clients as L, hasChanges as Lt, show as M, isValidMigrationNumber as Mt, showCommand as N, loadDiff as Nt, truncateCommand as O, getMigrationDirPath as Ot, remove as P, reconstructSnapshotFromMigrations as Pt, jobsCommand as Q, getCommand$1 as R, getNamespacesWithMigrations as Rt, healthCommand as S, SCHEMA_FILE_NAME as St, listCommand$3 as T, createSnapshotFromLocalTypes as Tt, listMachineUsers as U, commonArgs as Ut, tokenCommand as V, apiCall as Vt, generate$1 as W, confirmationArgs as Wt, listExecutors as X, listCommand$6 as Y, getExecutorJob as Z, createCommand as _, bundleMigrationScript as _t, listCommand as a, executionsCommand as at, listCommand$2 as b, INITIAL_SCHEMA_NUMBER as bt, inviteUser as c, functionExecutionStatusToString as ct, listCommand$1 as d, getExecutor as dt, watchExecutorJob as et, listWorkspaces as f, apply as ft, deleteWorkspace as g, parseMigrationLabelNumber as gt, deleteCommand as h, MIGRATION_LABEL_KEY as ht, removeUser as i, getWorkflow as it, logBetaWarning as j, getNextMigrationNumber as jt, generate as k, getMigrationFilePath as kt, restoreCommand as l, formatKeyValueTable as lt, getWorkspace as m, waitForExecution$1 as mt, updateUser as n, startWorkflow as nt, listUsers as o, getWorkflowExecution as ot, getCommand as p, executeScript as pt, triggerCommand as q, withCommonArgs as qt, removeCommand as r, getCommand$2 as rt, inviteCommand as s, listWorkflowExecutions as st, updateCommand as t, startCommand as tt, restoreWorkspace as u, getCommand$3 as ut, createWorkspace as v, DB_TYPES_FILE_NAME as vt, resumeWorkflow as w, compareSnapshots as wt, getAppHealth as x, MIGRATE_FILE_NAME as xt, listApps as y, DIFF_FILE_NAME as yt, getOAuth2Client as z, trnPrefix as zt };
-//# sourceMappingURL=update-9MTRN1UA.mjs.map
+//#region src/cli/bundler/query/query-bundler.ts
+function createSqlEntry() {
+	return ml`
+    import { Kysely, sql } from "@tailor-platform/sdk/kysely";
+    import { TailordbDialect } from "@tailor-platform/function-kysely-tailordb";
+
+    type QueryInput = {
+      namespace: string;
+      queries: string[];
+    };
+
+    function getDB(namespace: string) {
+      const client = new tailordb.Client({ namespace });
+      return new Kysely<Record<string, Record<string, unknown>>>({
+        dialect: new TailordbDialect(client),
+      });
+    }
+
+    export async function main(input: QueryInput) {
+      const db = getDB(input.namespace);
+      const results = [];
+      for (const query of input.queries) {
+        const result = await sql.raw(query).execute(db);
+        const rows = result.rows ?? [];
+        results.push({ rows, rowCount: rows.length });
+      }
+      if (results.length === 1) {
+        return results[0];
+      }
+      return results;
+    }
+  `;
+}
+function createGqlEntry() {
+	return ml`
+    type QueryInput = {
+      endpoint: string;
+      accessToken: string;
+      query: string;
+    };
+
+    export async function main(input: QueryInput) {
+      const response = await fetch(input.endpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: \`Bearer \${input.accessToken}\`,
+        },
+        body: JSON.stringify({
+          query: input.query,
+        }),
+      });
+      if (!response.ok) {
+        let message = \`HTTP \${response.status}\`;
+        try {
+          const errorJson = await response.json();
+          if (errorJson && typeof errorJson === "object" && "message" in errorJson) {
+            message = String(errorJson.message);
+          }
+        } catch {
+          // Keep default HTTP status message when response body is not JSON.
+        }
+        throw new Error(\`GraphQL request failed: \${message}\`);
+      }
+
+      const json = await response.json();
+      return json;
+    }
+  `;
+}
+/**
+* Bundle a query executor script for TestExecScript.
+* @param engine - Query engine type
+* @returns Bundled code
+*/
+async function bundleQueryScript(engine) {
+	const outputDir = path.resolve(getDistDir(), "query");
+	fs$1.mkdirSync(outputDir, { recursive: true });
+	const entryPath = path.join(outputDir, `query_${engine}.entry.ts`);
+	const outputPath = path.join(outputDir, `query_${engine}.js`);
+	const entryContent = engine === "sql" ? createSqlEntry() : createGqlEntry();
+	fs$1.writeFileSync(entryPath, entryContent);
+	let tsconfig;
+	try {
+		tsconfig = await resolveTSConfig();
+	} catch {
+		tsconfig = void 0;
+	}
+	await rolldown.build(rolldown.defineConfig({
+		input: entryPath,
+		output: {
+			file: outputPath,
+			format: "esm",
+			sourcemap: false,
+			minify: false,
+			inlineDynamicImports: true,
+			globals: { tailordb: "tailordb" }
+		},
+		external: engine === "sql" ? ["tailordb"] : [],
+		resolve: { conditionNames: ["node", "import"] },
+		tsconfig,
+		treeshake: {
+			moduleSideEffects: false,
+			annotations: true,
+			unknownGlobalSideEffects: false
+		},
+		logLevel: "silent"
+	}));
+	return fs$1.readFileSync(outputPath, "utf-8");
+}
+
+//#endregion
+//#region src/cli/query/errors.ts
+function toErrorMessage(error) {
+	if (error instanceof Error) return error.message;
+	return String(error);
+}
+/**
+* Maps errors from query execution to user-friendly CLI errors with suggestions when possible.
+* @param args - The error and context information for mapping
+* @returns A CLIError with a user-friendly message
+*/
+function mapQueryExecutionError(args) {
+	const message = toErrorMessage(args.error);
+	if (message.includes("machine user does not exist")) return createCLIError({
+		code: "not_found",
+		message: `Machine user '${args.machineUser ?? "unknown"}' was not found.`,
+		suggestion: "Run `tailor-sdk machineuser list` and use an existing name."
+	});
+	if (args.engine === "sql" && message.includes("sqlaccess error: failed to fetch schema: query returned an unexpected number of rows")) return createCLIError({
+		code: "invalid_namespace",
+		message: `Failed to load TailorDB schema for namespace '${args.namespace}'.`,
+		suggestion: "Ensure the query references TailorDB types from a single namespace and re-apply if needed."
+	});
+	if (args.engine === "sql" && message.includes("sqlaccess error: failed to parse:")) {
+		const parserReason = message.split("sqlaccess error: failed to parse:").at(1)?.split("\n").at(0)?.trim();
+		return createCLIError({
+			code: "invalid_sql",
+			message: "SQL parse error.",
+			suggestion: parserReason ?? "The SQL query contains unsupported syntax."
+		});
+	}
+	return args.error instanceof Error ? args.error : new Error(message);
+}
+
+//#endregion
+//#region src/cli/query/sql-type-extractor.ts
+/**
+* Extract TailorDB type names from SQL query.
+* @param query - SQL query
+* @returns Type names referenced by query
+*/
+function extractTypeNamesFromSql(query$1) {
+	let statements;
+	try {
+		statements = parse(query$1);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		throw new Error(`SQL parse error: ${message}\nIf your table name is a reserved keyword (e.g. User), wrap it in double quotes: SELECT * FROM "User"`);
+	}
+	const typeNames = /* @__PURE__ */ new Set();
+	const visitor = astVisitor((mapper) => ({ tableRef: (tableRef) => {
+		typeNames.add(tableRef.name);
+		mapper.super().tableRef(tableRef);
+		return tableRef;
+	} }));
+	for (const statement of statements) visitor.statement(statement);
+	return [...typeNames];
+}
+function collectAliasMap(fromClauses) {
+	const aliasMap = /* @__PURE__ */ new Map();
+	for (const from of fromClauses) if (from.type === "table") {
+		const tableName = from.name.name;
+		const alias = from.name.alias ?? tableName;
+		aliasMap.set(alias, tableName);
+	}
+	return aliasMap;
+}
+/**
+* Extract the column template from a SQL query's SELECT clause.
+* Returns an ordered list of column slots representing explicit columns
+* and wildcard expansions with their resolved type names.
+*
+* Only inspects the top-level SELECT statement, not subqueries.
+* TailorDB's sqlaccess does not currently support subqueries in FROM clauses,
+* but we intentionally avoid recursing into nested SELECTs to prevent
+* false positives if the parser accepts such queries.
+* @param query - SQL query
+* @returns Column slots if wildcards are present, null otherwise
+*/
+function extractColumnTemplate(query$1) {
+	try {
+		const statements = parse(query$1);
+		for (const statement of statements) {
+			if (statement.type !== "select" || !statement.columns) continue;
+			const aliasMap = collectAliasMap(statement.from ?? []);
+			const slots = [];
+			let hasWildcard = false;
+			for (const column of statement.columns) if (column.expr.type === "ref" && column.expr.name === "*") {
+				hasWildcard = true;
+				if (column.expr.table) {
+					const typeName = aliasMap.get(column.expr.table.name);
+					slots.push({
+						type: "wildcard",
+						typeNames: typeName ? [typeName] : []
+					});
+				} else slots.push({
+					type: "wildcard",
+					typeNames: [...new Set(aliasMap.values())]
+				});
+			} else {
+				const name = column.alias?.name ?? (column.expr.type === "ref" ? column.expr.name : null);
+				if (name) slots.push({
+					type: "explicit",
+					name
+				});
+			}
+			return hasWildcard ? slots : null;
+		}
+		return null;
+	} catch {
+		return null;
+	}
+}
+
+//#endregion
+//#region src/cli/query/type-field-order.ts
+/**
+* Load field definition order for all TailorDB types in a namespace.
+* @param config - Loaded application configuration
+* @param namespace - TailorDB namespace name
+* @returns Map of type name to field names in definition order
+*/
+async function loadTypeFieldOrder(config, namespace) {
+	const fieldOrder = /* @__PURE__ */ new Map();
+	const dbConfig = config.db?.[namespace];
+	if (!dbConfig || !("files" in dbConfig) || dbConfig.files.length === 0) return fieldOrder;
+	const typeFiles = loadFilesWithIgnores(dbConfig);
+	await Promise.all(typeFiles.map(async (typeFile) => {
+		try {
+			const module = await import(pathToFileURL(typeFile).href);
+			for (const exportedValue of Object.values(module)) {
+				const result = TailorDBTypeSchema.safeParse(exportedValue);
+				if (!result.success) continue;
+				fieldOrder.set(result.data.name, Object.keys(result.data.fields));
+			}
+		} catch {}
+	}));
+	return fieldOrder;
+}
+
+//#endregion
+//#region src/cli/query/index.ts
+const queryEngineSchema = z.enum(["sql", "gql"]);
+const queryOptionsSchema = z.object({
+	workspaceId: z.string().optional(),
+	profile: z.string().optional(),
+	configPath: z.string().optional(),
+	engine: queryEngineSchema,
+	query: z.string(),
+	machineUser: z.string()
+});
+async function getNamespaceFromSqlQuery(workspaceId, query$1, client, namespaces) {
+	if (namespaces.length === 0) throw new Error("No namespaces found in configuration.");
+	if (namespaces.length === 1) return namespaces[0];
+	const typeNames = extractTypeNamesFromSql(query$1);
+	if (typeNames.length === 0) throw new Error(`Could not infer namespace from query. Detected namespaces: ${namespaces.join(", ")}.`);
+	const typeNamespaceMap = await resolveTypeNamespaces({
+		workspaceId,
+		namespaces,
+		typeNames,
+		client
+	});
+	const notFoundTypes = typeNames.filter((typeName) => !typeNamespaceMap.has(typeName));
+	if (notFoundTypes.length > 0) throw new Error(`Could not find namespace for types in query: ${notFoundTypes.join(", ")}.`);
+	const namespacesFromTypes = new Set(typeNamespaceMap.values());
+	if (namespacesFromTypes.size === 1) return [...namespacesFromTypes][0];
+	throw new Error(`Query references types from multiple namespaces: ${[...namespacesFromTypes].join(", ")}.`);
+}
+async function loadOptions(options) {
+	const result = queryOptionsSchema.safeParse(options);
+	if (!result.success) throw new Error(result.error.issues[0].message);
+	const client = await initOperatorClient(await loadAccessToken({
+		useProfile: true,
+		profile: result.data.profile
+	}));
+	const workspaceId = loadWorkspaceId({
+		workspaceId: result.data.workspaceId,
+		profile: result.data.profile
+	});
+	const { config } = await loadConfig(options.configPath);
+	const namespaces = extractAllNamespaces(config);
+	const { application } = await client.getApplication({
+		workspaceId,
+		applicationName: config.name
+	});
+	if (!application?.authNamespace) throw new Error(`Application ${config.name} does not have an auth configuration.`);
+	const { machineUser: machineUserResource } = await client.getAuthMachineUser({
+		workspaceId,
+		authNamespace: application.authNamespace,
+		name: result.data.machineUser
+	});
+	if (!machineUserResource) throw new Error(`Machine user ${result.data.machineUser} not found.`);
+	if (options.engine === "gql") return {
+		engine: options.engine,
+		client,
+		workspaceId,
+		config,
+		application,
+		machineUserResource
+	};
+	const namespace = await getNamespaceFromSqlQuery(workspaceId, result.data.query, client, namespaces);
+	return {
+		engine: options.engine,
+		client,
+		workspaceId,
+		config,
+		application,
+		machineUserResource,
+		namespace
+	};
+}
+async function sqlQuery(client, invoker, args) {
+	const queries = splitSqlStatements(args.query);
+	const executed = await executeScript({
+		client,
+		workspaceId: args.workspaceId,
+		name: `query-sql-${args.namespace}.js`,
+		code: args.bundledCode,
+		arg: JSON.stringify({
+			namespace: args.namespace,
+			queries
+		}),
+		invoker
+	});
+	if (!executed.success) throw new Error(executed.error);
+	return {
+		engine: "sql",
+		namespace: args.namespace,
+		query: args.query,
+		result: parseExecutionResult(executed.result)
+	};
+}
+async function gqlQuery(client, invoker, application, machineUser, args) {
+	const { access_token: accessToken } = await fetchMachineUserToken(application.url, machineUser.clientId, machineUser.clientSecret);
+	const executed = await executeScript({
+		client,
+		workspaceId: args.workspaceId,
+		name: `query-gql.js`,
+		code: args.bundledCode,
+		arg: JSON.stringify({
+			endpoint: `${application.url}/query`,
+			accessToken,
+			query: args.query
+		}),
+		invoker
+	});
+	if (!executed.success) throw new Error(executed.error);
+	return {
+		engine: "gql",
+		query: args.query,
+		result: parseExecutionResult(executed.result)
+	};
+}
+function parseExecutionResult(result) {
+	if (!result) return null;
+	try {
+		return JSON.parse(result);
+	} catch {
+		return result;
+	}
+}
+/**
+* Dispatch query execution.
+* @param options - Query command options
+* @returns Dispatch result
+*/
+async function query(options) {
+	const { client, workspaceId, config, application, machineUserResource, engine, namespace } = await loadOptions(options);
+	try {
+		const bundledCode = await bundleQueryScript(engine);
+		const invoker = create(AuthInvokerSchema, {
+			namespace: application.authNamespace,
+			machineUserName: machineUserResource.name
+		});
+		switch (engine) {
+			case "sql": return reorderSqlColumns(await sqlQuery(client, invoker, {
+				workspaceId,
+				namespace,
+				bundledCode,
+				query: options.query
+			}), config, namespace, options.query);
+			case "gql": return await gqlQuery(client, invoker, application, machineUserResource, {
+				workspaceId,
+				bundledCode,
+				query: options.query
+			});
+			default: throw new Error(`Unsupported query engine: ${engine}`);
+		}
+	} catch (error) {
+		throw mapQueryExecutionError({
+			error,
+			engine,
+			namespace,
+			machineUser: options.machineUser
+		});
+	}
+}
+/**
+* Execute SQL query directly.
+* @param options - Shared query options
+* @returns SQL query result
+*/
+async function querySql(options) {
+	const result = await query({
+		...options,
+		engine: "sql"
+	});
+	if (result.engine !== "sql") throw new Error(`Expected sql engine result but got: ${result.engine}`);
+	return result;
+}
+/**
+* Execute GraphQL query directly.
+* @param options - Shared query options
+* @returns GraphQL query result
+*/
+async function queryGql(options) {
+	const result = await query({
+		...options,
+		engine: "gql"
+	});
+	if (result.engine !== "gql") throw new Error(`Expected gql engine result but got: ${result.engine}`);
+	return result;
+}
+async function reorderSqlColumns(result, config, namespace, sqlQuery$1) {
+	if (!isSQLExecutionResult(result.result) || result.result.rows.length === 0) return result;
+	const template = extractColumnTemplate(sqlQuery$1);
+	if (!template) return result;
+	try {
+		const expectedOrder = buildExpectedColumnOrder(template, await loadTypeFieldOrder(config, namespace));
+		if (expectedOrder.length === 0) return result;
+		const orderedRows = result.result.rows.map((row) => reorderRowByTemplate(row, expectedOrder));
+		return {
+			...result,
+			result: {
+				...result.result,
+				rows: orderedRows
+			}
+		};
+	} catch {
+		return result;
+	}
+}
+const SYSTEM_FIELD_ORDER = ["id"];
+function buildExpectedColumnOrder(template, fieldOrder) {
+	const order = [];
+	for (const slot of template) if (slot.type === "explicit") order.push(slot.name);
+	else for (const typeName of slot.typeNames) {
+		order.push(...SYSTEM_FIELD_ORDER);
+		order.push(...fieldOrder.get(typeName) ?? []);
+	}
+	return order;
+}
+function reorderRowByTemplate(row, expectedOrder) {
+	const ordered = {};
+	const rowKeys = new Set(Object.keys(row));
+	const lowerToOriginal = /* @__PURE__ */ new Map();
+	for (const key of rowKeys) lowerToOriginal.set(key.toLowerCase(), key);
+	for (const key of expectedOrder) {
+		const original = lowerToOriginal.get(key.toLowerCase());
+		if (original != null && rowKeys.has(original)) {
+			ordered[original] = row[original];
+			rowKeys.delete(original);
+			lowerToOriginal.delete(key.toLowerCase());
+		}
+	}
+	for (const key of rowKeys) ordered[key] = row[key];
+	return ordered;
+}
+const queryCommand = defineCommand({
+	name: "query",
+	description: "Run SQL/GraphQL query.",
+	args: z.object({
+		...commonArgs,
+		...jsonArgs,
+		...deploymentArgs,
+		engine: arg(queryEngineSchema, { description: "Query engine (sql or gql)" }),
+		query: arg(z.string(), {
+			alias: "q",
+			description: "Query string to execute directly"
+		}),
+		machineuser: arg(z.string(), {
+			alias: "m",
+			description: "Machine user name for query execution"
+		})
+	}).strict(),
+	run: withCommonArgs(async (args) => {
+		const sharedOptions = {
+			workspaceId: args["workspace-id"],
+			profile: args.profile,
+			configPath: args.config,
+			query: args.query,
+			machineUser: args.machineuser
+		};
+		if (args.engine === "sql") {
+			printSqlResult(await querySql(sharedOptions), { json: args.json });
+			return;
+		}
+		printGqlResult(await queryGql(sharedOptions), { json: args.json });
+	})
+});
+function isSQLExecutionResult(value) {
+	if (!value || typeof value !== "object") return false;
+	const candidate = value;
+	return Array.isArray(candidate.rows) && typeof candidate.rowCount === "number";
+}
+function printSingleSqlResult(execResult, options = {}) {
+	if (execResult.rows.length === 0) {
+		if (options.json) {
+			logger.out({
+				results: [],
+				rowCount: 0
+			});
+			return;
+		}
+		logger.info("No rows returned.");
+		return;
+	}
+	if (options.json) {
+		logger.out({
+			results: execResult.rows,
+			rowCount: execResult.rowCount
+		});
+		return;
+	}
+	logger.out(execResult.rows, { showNull: true });
+	logger.out(`rows: ${execResult.rowCount}`);
+}
+function splitSqlStatements(query$1) {
+	try {
+		const statements = parse(query$1);
+		if (statements.length === 0) return [];
+		return statements.map((s) => toSql.statement(s));
+	} catch {
+		const trimmed = query$1.trim();
+		return trimmed.length > 0 ? [trimmed] : [];
+	}
+}
+function isSQLExecutionResultArray(value) {
+	return Array.isArray(value) && value.length > 0 && value.every(isSQLExecutionResult);
+}
+function printSqlResult(result, options = {}) {
+	if (isSQLExecutionResultArray(result.result)) {
+		if (options.json) {
+			logger.out(result.result.map((r) => ({
+				results: r.rows,
+				rowCount: r.rowCount
+			})));
+			return;
+		}
+		const queries = splitSqlStatements(result.query);
+		for (let i = 0; i < result.result.length; i++) {
+			if (i > 0) logger.log("");
+			logger.info(queries[i] ?? `Statement ${i + 1}`);
+			printSingleSqlResult(result.result[i], options);
+		}
+		return;
+	}
+	if (isSQLExecutionResult(result.result)) {
+		printSingleSqlResult(result.result, options);
+		return;
+	}
+	logger.out({
+		engine: result.engine,
+		query: result.query,
+		result: result.result
+	});
+}
+function printGqlResult(result, options = {}) {
+	if (options.json) {
+		logger.out({ result: result.result });
+		return;
+	}
+	logger.out(JSON.stringify(result.result, null, 2));
+}
+
+//#endregion
+export { getExecutorJob as $, truncateCommand as A, getMigrationDirPath as At, getCommand$1 as B, getNamespacesWithMigrations as Bt, getAppHealth as C, MIGRATE_FILE_NAME as Ct, listCommand$3 as D, createSnapshotFromLocalTypes as Dt, resumeWorkflow as E, compareSnapshots as Et, showCommand as F, loadDiff as Ft, listMachineUsers as G, commonArgs as Gt, getMachineUserToken as H, generateUserTypes as Ht, remove as I, reconstructSnapshotFromMigrations as It, webhookCommand as J, jsonArgs as Jt, generate$1 as K, confirmationArgs as Kt, removeCommand$1 as L, formatDiffSummary as Lt, generateCommand as M, getMigrationFiles as Mt, logBetaWarning as N, getNextMigrationNumber as Nt, listWorkflows as O, formatMigrationNumber as Ot, show as P, isValidMigrationNumber as Pt, listExecutors as Q, listCommand$4 as R, formatMigrationDiff as Rt, listCommand$2 as S, INITIAL_SCHEMA_NUMBER as St, resumeCommand as T, compareLocalTypesWithSnapshot as Tt, tokenCommand as U, apiCall as Ut, getOAuth2Client as V, trnPrefix as Vt, listCommand$5 as W, apiCommand as Wt, triggerExecutor as X, workspaceArgs as Xt, triggerCommand as Y, withCommonArgs as Yt, listCommand$6 as Z, deleteCommand as _, MIGRATION_LABEL_KEY as _t, removeCommand as a, getCommand$2 as at, createWorkspace as b, DB_TYPES_FILE_NAME as bt, listUsers as c, getWorkflowExecution as ct, restoreCommand as d, formatKeyValueTable as dt, jobsCommand as et, restoreWorkspace as f, getCommand$3 as ft, getWorkspace as g, waitForExecution$1 as gt, getCommand as h, executeScript as ht, updateUser as i, startWorkflow as it, generate as j, getMigrationFilePath as jt, truncate as k, getLatestMigrationNumber as kt, inviteCommand as l, listWorkflowExecutions as lt, listWorkspaces as m, apply as mt, queryCommand as n, watchExecutorJob as nt, removeUser as o, getWorkflow as ot, listCommand$1 as p, getExecutor as pt, listWebhookExecutors as q, deploymentArgs as qt, updateCommand as r, startCommand as rt, listCommand as s, executionsCommand as st, query as t, listExecutorJobs as tt, inviteUser as u, functionExecutionStatusToString as ut, deleteWorkspace as v, parseMigrationLabelNumber as vt, healthCommand as w, SCHEMA_FILE_NAME as wt, listApps as x, DIFF_FILE_NAME as xt, createCommand as y, bundleMigrationScript as yt, listOAuth2Clients as z, hasChanges as zt };
+//# sourceMappingURL=query-Bz2oDGhw.mjs.map