@tailor-platform/sdk 1.23.0 → 1.24.0

package/dist/{types--G4ilVmx.d.mts → plugin-CE-BZZgX.d.mts}

@@ -1,584 +1,485 @@
 import { z } from "zod";
-import { IsAny, NonEmptyObject } from "type-fest";
 import { StandardSchemaV1 } from "@standard-schema/spec";
+import { IsAny, NonEmptyObject } from "type-fest";
+
+//#region src/parser/generator-config/index.d.ts
 
-//#region src/parser/service/tailordb/relation.d.ts
-declare const relationTypes: {
-  readonly "1-1": "1-1";
-  readonly oneToOne: "1-1";
-  readonly "n-1": "n-1";
-  readonly manyToOne: "n-1";
-  readonly "N-1": "n-1";
-  readonly keyOnly: "keyOnly";
+declare const BaseGeneratorConfigSchema: z.ZodUnion<readonly [z.ZodTuple<[z.ZodLiteral<"@tailor-platform/kysely-type">, z.ZodObject<{
+  distPath: z.ZodString;
+}, z.core.$strip>], null>, z.ZodTuple<[z.ZodLiteral<"@tailor-platform/seed">, z.ZodObject<{
+  distPath: z.ZodString;
+  machineUserName: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], null>, z.ZodTuple<[z.ZodLiteral<"@tailor-platform/enum-constants">, z.ZodObject<{
+  distPath: z.ZodString;
+}, z.core.$strip>], null>, z.ZodTuple<[z.ZodLiteral<"@tailor-platform/file-utils">, z.ZodObject<{
+  distPath: z.ZodString;
+}, z.core.$strip>], null>, z.ZodObject<{
+  id: z.ZodString;
+  description: z.ZodString;
+  dependencies: z.ZodArray<z.ZodEnum<{
+    executor: "executor";
+    tailordb: "tailordb";
+    resolver: "resolver";
+  }>>;
+  processType: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
+  processResolver: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
+  processExecutor: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
+  processTailorDBNamespace: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
+  processResolverNamespace: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
+  aggregate: z.ZodFunction<z.core.$ZodFunctionArgs, z.ZodAny>;
+}, z.core.$strip>]>;
+//#endregion
+//#region src/types/auth.generated.d.ts
+type AuthInvoker = {
+  /** Auth namespace */
+  namespace: string;
+  /** Machine user name for authentication */
+  machineUserName: string;
+};
+type OIDC = {
+  /** Identity provider name */
+  name: string;
+  kind: "OIDC";
+  /** OAuth2 client ID */
+  clientID: string;
+  /** OAuth2 client secret */
+  clientSecret: {
+    vaultName: string;
+    secretKey: string;
+  };
+  /** OIDC provider URL */
+  providerURL: string;
+  /** OIDC issuer URL (defaults to providerURL) */
+  issuerURL?: string | undefined;
+  /** JWT claim to use as username */
+  usernameClaim?: string | undefined;
+};
+type SAML = {
+  /** Identity provider name */
+  name: string;
+  kind: "SAML";
+  /** Enable signing of SAML requests */
+  enableSignRequest: boolean;
+  /** URL to fetch SAML metadata (mutually exclusive with rawMetadata) */
+  metadataURL?: string | undefined;
+  /** Raw SAML metadata XML (mutually exclusive with metadataURL) */
+  rawMetadata?: string | undefined;
+};
+type IDToken = {
+  /** Identity provider name */
+  name: string;
+  kind: "IDToken";
+  /** ID token provider URL */
+  providerURL: string;
+  /** Client ID for ID token validation */
+  clientID: string;
+  /** ID token issuer URL */
+  issuerURL?: string | undefined;
+  /** JWT claim to use as username */
+  usernameClaim?: string | undefined;
+};
+type BuiltinIdP = {
+  /** Identity provider name */
+  name: string;
+  kind: "BuiltInIdP";
+  /** IdP namespace */
+  namespace: string;
+  /** OAuth2 client name in the IdP */
+  clientName: string;
+};
+type IdProvider = OIDC | SAML | IDToken | BuiltinIdP;
+type OAuth2ClientInput = {
+  /** Allowed redirect URIs */
+  redirectURIs: (`https://${string}` | `http://${string}` | `${string}:url` | `${string}:url/${string}`)[];
+  /** Client description */
+  description?: string | undefined;
+  /** Allowed OAuth2 grant types */
+  grantTypes?: ("authorization_code" | "refresh_token")[] | undefined;
+  /** OAuth2 client type */
+  clientType?: "confidential" | "public" | "browser" | undefined;
+  /** Access token lifetime in seconds (60-86400) */
+  accessTokenLifetimeSeconds?: number | undefined;
+  /** Refresh token lifetime in seconds (60-604800) */
+  refreshTokenLifetimeSeconds?: number | undefined;
+  /** Require DPoP (Demonstrating Proof-of-Possession) for token requests */
+  requireDpop?: boolean | undefined;
+};
+type OAuth2Client = {
+  /** Allowed OAuth2 grant types */
+  grantTypes: ("authorization_code" | "refresh_token")[];
+  /** Allowed redirect URIs */
+  redirectURIs: (`https://${string}` | `http://${string}` | `${string}:url` | `${string}:url/${string}`)[];
+  /** Access token lifetime in seconds (60-86400) */
+  accessTokenLifetimeSeconds: {
+    seconds: bigint;
+    nanos: number;
+  } | undefined;
+  /** Refresh token lifetime in seconds (60-604800) */
+  refreshTokenLifetimeSeconds: {
+    seconds: bigint;
+    nanos: number;
+  } | undefined;
+  /** Client description */
+  description?: string | undefined;
+  /** OAuth2 client type */
+  clientType?: "confidential" | "public" | "browser" | undefined;
+  /** Require DPoP (Demonstrating Proof-of-Possession) for token requests */
+  requireDpop?: boolean | undefined;
+};
+type SCIMAuthorization = {
+  /** SCIM authorization type */
+  type: "oauth2" | "bearer";
+  /** Bearer token secret (required for bearer type) */
+  bearerSecret?: {
+    vaultName: string;
+    secretKey: string;
+  } | undefined;
+};
+type SCIMAttribute = {
+  /** Attribute data type */
+  type: "string" | "number" | "boolean" | "datetime" | "complex";
+  /** Attribute name */
+  name: string;
+  /** Attribute description */
+  description?: string | undefined;
+  /** Attribute mutability */
+  mutability?: "readOnly" | "readWrite" | "writeOnly" | undefined;
+  /** Whether the attribute is required */
+  required?: boolean | undefined;
+  /** Whether the attribute can have multiple values */
+  multiValued?: boolean | undefined;
+  /** Uniqueness constraint */
+  uniqueness?: "none" | "server" | "global" | undefined;
+  /** List of canonical values */
+  canonicalValues?: string[] | null | undefined;
+  subAttributes?: SCIMAttribute[] | null | undefined;
+};
+type SCIMAttributeMapping = {
+  /** TailorDB field name to map to */
+  tailorDBField: string;
+  /** SCIM attribute path */
+  scimPath: string;
+};
+type SCIMResource = {
+  /** SCIM resource name */
+  name: string;
+  /** TailorDB namespace for the resource */
+  tailorDBNamespace: string;
+  /** TailorDB type name for the resource */
+  tailorDBType: string;
+  /** Core SCIM schema definition */
+  coreSchema: {
+    /** SCIM resource name */
+    name: string;
+    attributes: {
+      type: "string" | "number" | "boolean" | "datetime" | "complex";
+      /** SCIM resource name */
+      name: string;
+      description?: string | undefined;
+      mutability?: "readOnly" | "readWrite" | "writeOnly" | undefined;
+      required?: boolean | undefined;
+      multiValued?: boolean | undefined;
+      uniqueness?: "none" | "server" | "global" | undefined;
+      canonicalValues?: string[] | null | undefined;
+      subAttributes?: any[] | null | undefined;
+    }[];
+  };
+  /** Attribute mapping configuration */
+  attributeMapping: {
+    tailorDBField: string;
+    scimPath: string;
+  }[];
+};
+type SCIMConfig = {
+  /** Machine user name for SCIM operations */
+  machineUserName: string;
+  /** SCIM authorization configuration */
+  authorization: {
+    type: "oauth2" | "bearer";
+    bearerSecret?: {
+      vaultName: string;
+      secretKey: string;
+    } | undefined;
+  };
+  /** SCIM resource definitions */
+  resources: {
+    name: string;
+    tailorDBNamespace: string;
+    tailorDBType: string;
+    coreSchema: {
+      name: string;
+      attributes: {
+        type: "string" | "number" | "boolean" | "datetime" | "complex";
+        name: string;
+        description?: string | undefined;
+        mutability?: "readOnly" | "readWrite" | "writeOnly" | undefined;
+        required?: boolean | undefined;
+        multiValued?: boolean | undefined;
+        uniqueness?: "none" | "server" | "global" | undefined;
+        canonicalValues?: string[] | null | undefined;
+        subAttributes?: any[] | null | undefined;
+      }[];
+    };
+    attributeMapping: {
+      tailorDBField: string;
+      scimPath: string;
+    }[];
+  }[];
+};
+type TenantProvider = {
+  /** TailorDB namespace for the tenant type */
+  namespace: string;
+  /** TailorDB type name for tenants */
+  type: string;
+  /** Field used as the tenant signature */
+  signatureField: string;
 };
-type RelationType = keyof typeof relationTypes;
 //#endregion
-//#region src/parser/service/tailordb/schema.d.ts
-
-/**
- * Schema for TailorDB type settings.
- * Normalizes gqlOperations from alias ("query") to object format.
- */
-declare const TailorDBTypeSettingsSchema: z.ZodObject<{
-  pluralForm: z.ZodOptional<z.ZodString>;
-  aggregation: z.ZodOptional<z.ZodBoolean>;
-  bulkUpsert: z.ZodOptional<z.ZodBoolean>;
-  gqlOperations: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"query">, z.ZodObject<{
-    create: z.ZodOptional<z.ZodBoolean>;
-    update: z.ZodOptional<z.ZodBoolean>;
-    delete: z.ZodOptional<z.ZodBoolean>;
-    read: z.ZodOptional<z.ZodBoolean>;
-  }, z.core.$strip>]>, z.ZodTransform<GqlOperations, "query" | {
-    create?: boolean | undefined;
-    update?: boolean | undefined;
-    delete?: boolean | undefined;
-    read?: boolean | undefined;
-  }>>>;
-  publishEvents: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strip>;
-declare const RawPermissionsSchema: z.ZodObject<{
-  record: z.ZodOptional<z.ZodObject<{
-    create: z.ZodReadonly<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
-      conditions: z.ZodUnion<readonly [z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>, z.ZodEnum<{
-        in: "in";
-        "=": "=";
-        "!=": "!=";
-        "not in": "not in";
-        hasAny: "hasAny";
-        "not hasAny": "not hasAny";
-      }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>], null>>, z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>, z.ZodEnum<{
-        in: "in";
-        "=": "=";
-        "!=": "!=";
-        "not in": "not in";
-        hasAny: "hasAny";
-        "not hasAny": "not hasAny";
-      }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>], null>>>>]>;
-      description: z.ZodOptional<z.ZodString>;
-      permit: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$strip>, z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodEnum<{
-      in: "in";
-      "=": "=";
-      "!=": "!=";
-      "not in": "not in";
-      hasAny: "hasAny";
-      "not hasAny": "not hasAny";
-    }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>], null>>, z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodEnum<{
-      in: "in";
-      "=": "=";
-      "!=": "!=";
-      "not in": "not in";
-      hasAny: "hasAny";
-      "not hasAny": "not hasAny";
-    }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodBoolean], null>>, z.ZodReadonly<z.ZodArray<z.ZodUnion<readonly [z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodEnum<{
-      in: "in";
-      "=": "=";
-      "!=": "!=";
-      "not in": "not in";
-      hasAny: "hasAny";
-      "not hasAny": "not hasAny";
-    }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>], null>>, z.ZodBoolean]>>>]>>>;
-    read: z.ZodReadonly<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
-      conditions: z.ZodUnion<readonly [z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>, z.ZodEnum<{
-        in: "in";
-        "=": "=";
-        "!=": "!=";
-        "not in": "not in";
-        hasAny: "hasAny";
-        "not hasAny": "not hasAny";
-      }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>], null>>, z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>, z.ZodEnum<{
-        in: "in";
-        "=": "=";
-        "!=": "!=";
-        "not in": "not in";
-        hasAny: "hasAny";
-        "not hasAny": "not hasAny";
-      }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>], null>>>>]>;
-      description: z.ZodOptional<z.ZodString>;
-      permit: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$strip>, z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodEnum<{
-      in: "in";
-      "=": "=";
-      "!=": "!=";
-      "not in": "not in";
-      hasAny: "hasAny";
-      "not hasAny": "not hasAny";
-    }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>], null>>, z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodEnum<{
-      in: "in";
-      "=": "=";
-      "!=": "!=";
-      "not in": "not in";
-      hasAny: "hasAny";
-      "not hasAny": "not hasAny";
-    }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodBoolean], null>>, z.ZodReadonly<z.ZodArray<z.ZodUnion<readonly [z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodEnum<{
-      in: "in";
-      "=": "=";
-      "!=": "!=";
-      "not in": "not in";
-      hasAny: "hasAny";
-      "not hasAny": "not hasAny";
-    }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>], null>>, z.ZodBoolean]>>>]>>>;
-    update: z.ZodReadonly<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
-      conditions: z.ZodUnion<readonly [z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>, z.ZodEnum<{
-        in: "in";
-        "=": "=";
-        "!=": "!=";
-        "not in": "not in";
-        hasAny: "hasAny";
-        "not hasAny": "not hasAny";
-      }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>], null>>, z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>, z.ZodEnum<{
-        in: "in";
-        "=": "=";
-        "!=": "!=";
-        "not in": "not in";
-        hasAny: "hasAny";
-        "not hasAny": "not hasAny";
-      }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>], null>>>>]>;
-      description: z.ZodOptional<z.ZodString>;
-      permit: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$strip>, z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodEnum<{
-      in: "in";
-      "=": "=";
-      "!=": "!=";
-      "not in": "not in";
-      hasAny: "hasAny";
-      "not hasAny": "not hasAny";
-    }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>], null>>, z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodEnum<{
-      in: "in";
-      "=": "=";
-      "!=": "!=";
-      "not in": "not in";
-      hasAny: "hasAny";
-      "not hasAny": "not hasAny";
-    }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodBoolean], null>>, z.ZodReadonly<z.ZodArray<z.ZodUnion<readonly [z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodEnum<{
-      in: "in";
-      "=": "=";
-      "!=": "!=";
-      "not in": "not in";
-      hasAny: "hasAny";
-      "not hasAny": "not hasAny";
-    }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>], null>>, z.ZodBoolean]>>>]>>>;
-    delete: z.ZodReadonly<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
-      conditions: z.ZodUnion<readonly [z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>, z.ZodEnum<{
-        in: "in";
-        "=": "=";
-        "!=": "!=";
-        "not in": "not in";
-        hasAny: "hasAny";
-        "not hasAny": "not hasAny";
-      }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>], null>>, z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>, z.ZodEnum<{
-        in: "in";
-        "=": "=";
-        "!=": "!=";
-        "not in": "not in";
-        hasAny: "hasAny";
-        "not hasAny": "not hasAny";
-      }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-        user: z.ZodString;
-      }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-        record: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        oldRecord: z.ZodString;
-      }, z.core.$strip>, z.ZodObject<{
-        newRecord: z.ZodString;
-      }, z.core.$strip>]>], null>>>>]>;
-      description: z.ZodOptional<z.ZodString>;
-      permit: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$strip>, z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodEnum<{
-      in: "in";
-      "=": "=";
-      "!=": "!=";
-      "not in": "not in";
-      hasAny: "hasAny";
-      "not hasAny": "not hasAny";
-    }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>], null>>, z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodEnum<{
-      in: "in";
-      "=": "=";
-      "!=": "!=";
-      "not in": "not in";
-      hasAny: "hasAny";
-      "not hasAny": "not hasAny";
-    }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodBoolean], null>>, z.ZodReadonly<z.ZodArray<z.ZodUnion<readonly [z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>, z.ZodEnum<{
-      in: "in";
-      "=": "=";
-      "!=": "!=";
-      "not in": "not in";
-      hasAny: "hasAny";
-      "not hasAny": "not hasAny";
-    }>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodObject<{
-      record: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      oldRecord: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-      newRecord: z.ZodString;
-    }, z.core.$strip>]>], null>>, z.ZodBoolean]>>>]>>>;
-  }, z.core.$strip>>;
-  gql: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
-    conditions: z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodTuple<[z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>, z.ZodEnum<{
-      in: "in";
-      "=": "=";
-      "!=": "!=";
-      "not in": "not in";
-      hasAny: "hasAny";
-      "not hasAny": "not hasAny";
-    }>, z.ZodUnion<readonly [z.ZodObject<{
-      user: z.ZodString;
-    }, z.core.$strict>, z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodBoolean>]>], null>>>>;
-    actions: z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodReadonly<z.ZodArray<z.ZodEnum<{
-      create: "create";
-      delete: "delete";
-      update: "update";
-      read: "read";
-      aggregate: "aggregate";
-      bulkUpsert: "bulkUpsert";
-    }>>>]>;
-    permit: z.ZodOptional<z.ZodBoolean>;
-    description: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>>>>;
-}, z.core.$strip>;
-/**
- * Schema for TailorDB service configuration.
- * Normalizes gqlOperations from alias ("query") to object format.
- */
-declare const TailorDBServiceConfigSchema: z.ZodObject<{
-  files: z.ZodArray<z.ZodString>;
-  ignores: z.ZodOptional<z.ZodArray<z.ZodString>>;
-  erdSite: z.ZodOptional<z.ZodString>;
-  migration: z.ZodOptional<z.ZodObject<{
-    directory: z.ZodString;
-    machineUser: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>>;
-  gqlOperations: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"query">, z.ZodObject<{
-    create: z.ZodOptional<z.ZodBoolean>;
-    update: z.ZodOptional<z.ZodBoolean>;
-    delete: z.ZodOptional<z.ZodBoolean>;
-    read: z.ZodOptional<z.ZodBoolean>;
-  }, z.core.$strip>]>, z.ZodTransform<GqlOperations, "query" | {
-    create?: boolean | undefined;
-    update?: boolean | undefined;
-    delete?: boolean | undefined;
-    read?: boolean | undefined;
-  }>>>;
-}, z.core.$strip>;
-/**
- * Input type for TailorDB service configuration (before schema parsing).
- * gqlOperations accepts both alias ("query") and object format.
- */
-type TailorDBServiceConfigInput = z.input<typeof TailorDBServiceConfigSchema>;
-type TailorDBExternalConfig = {
-  external: true;
+//#region src/types/executor.generated.d.ts
+type RecordTrigger = {
+  /** Record event type */
+  kind: "recordCreated" | "recordUpdated" | "recordDeleted";
+  /** TailorDB type name to watch for events */
+  typeName: string;
+  /** Condition function to filter events */
+  condition?: Function | undefined;
 };
-type TailorDBServiceInput = {
-  [namespace: string]: TailorDBServiceConfigInput | TailorDBExternalConfig;
+type ResolverExecutedTrigger = {
+  kind: "resolverExecuted";
+  /** Name of the resolver to trigger on */
+  resolverName: string;
+  /** Condition function to filter events */
+  condition?: Function | undefined;
+};
+type ScheduleTriggerInput = {
+  kind: "schedule";
+  /** CRON expression for the schedule */
+  cron: string;
+  /** Timezone for the CRON schedule (default: UTC) */
+  timezone?: string | undefined;
+};
+type IncomingWebhookTrigger = {
+  kind: "incomingWebhook";
+};
+type IdpUserTrigger = {
+  /** IdP user event type */
+  kind: "idpUserCreated" | "idpUserUpdated" | "idpUserDeleted";
+};
+type AuthAccessTokenTrigger = {
+  /** Auth access token event type */
+  kind: "authAccessTokenIssued" | "authAccessTokenRefreshed" | "authAccessTokenRevoked";
+};
+type FunctionOperation = {
+  kind: "function" | "jobFunction";
+  /** Function implementation */
+  body: Function;
+  /** Auth invoker for the function execution */
+  authInvoker?: {
+    namespace: string;
+    machineUserName: string;
+  } | undefined;
+};
+type GqlOperation = {
+  kind: "graphql";
+  query: string;
+  /** Target application name for the GraphQL query */
+  appName?: string | undefined;
+  /** Function to compute GraphQL variables */
+  variables?: Function | undefined;
+  /** Auth invoker for the GraphQL execution */
+  authInvoker?: {
+    namespace: string;
+    machineUserName: string;
+  } | undefined;
+};
+type WebhookOperation = {
+  kind: "webhook";
+  /** Function returning the webhook URL */
+  url: Function;
+  /** Function to compute the request body */
+  requestBody?: Function | undefined;
+  /** HTTP headers for the webhook request */
+  headers?: {
+    [x: string]: string | {
+      vault: string;
+      key: string;
+    };
+  } | undefined;
+};
+type WorkflowOperation = {
+  kind: "workflow";
+  workflowName: string;
+  args?: Function | {
+    [x: string]: unknown;
+  } | undefined;
+  authInvoker?: {
+    namespace: string;
+    machineUserName: string;
+  } | undefined;
+};
+type ExecutorInput = {
+  /** Executor name */
+  name: string;
+  /** Event trigger configuration */
+  trigger: {
+    kind: "recordCreated" | "recordUpdated" | "recordDeleted";
+    typeName: string;
+    condition?: Function | undefined;
+  } | {
+    kind: "resolverExecuted";
+    resolverName: string;
+    condition?: Function | undefined;
+  } | {
+    kind: "schedule";
+    cron: string;
+    timezone?: string | undefined;
+  } | {
+    kind: "incomingWebhook";
+  } | {
+    kind: "idpUserCreated" | "idpUserUpdated" | "idpUserDeleted";
+  } | {
+    kind: "authAccessTokenIssued" | "authAccessTokenRefreshed" | "authAccessTokenRevoked";
+  };
+  /** Operation to execute when triggered */
+  operation: unknown;
+  /** Executor description */
+  description?: string | undefined;
+  /** Whether the executor is disabled */
+  disabled?: boolean | undefined;
+};
+type Executor = {
+  /** Executor name */
+  name: string;
+  /** Whether the executor is disabled */
+  disabled: boolean;
+  /** Event trigger configuration */
+  trigger: {
+    kind: "recordCreated" | "recordUpdated" | "recordDeleted";
+    typeName: string;
+    condition?: Function | undefined;
+  } | {
+    kind: "resolverExecuted";
+    resolverName: string;
+    condition?: Function | undefined;
+  } | {
+    kind: "schedule";
+    cron: string;
+    timezone: string;
+  } | {
+    kind: "incomingWebhook";
+  } | {
+    kind: "idpUserCreated" | "idpUserUpdated" | "idpUserDeleted";
+  } | {
+    kind: "authAccessTokenIssued" | "authAccessTokenRefreshed" | "authAccessTokenRevoked";
+  };
+  /** Operation to execute when triggered */
+  operation: {
+    kind: "workflow";
+    workflowName: string;
+    args?: Function | {
+      [x: string]: unknown;
+    } | undefined;
+    authInvoker?: {
+      namespace: string;
+      machineUserName: string;
+    } | undefined;
+  } | {
+    kind: "function" | "jobFunction";
+    body: Function;
+    authInvoker?: {
+      namespace: string;
+      machineUserName: string;
+    } | undefined;
+  } | {
+    kind: "graphql";
+    query: string;
+    appName?: string | undefined;
+    variables?: Function | undefined;
+    authInvoker?: {
+      namespace: string;
+      machineUserName: string;
+    } | undefined;
+  } | {
+    kind: "webhook";
+    url: Function;
+    requestBody?: Function | undefined;
+    headers?: {
+      [x: string]: string | {
+        vault: string;
+        key: string;
+      };
+    } | undefined;
+  };
+  /** Executor description */
+  description?: string | undefined;
+};
+//#endregion
+//#region src/types/generator-config.d.ts
+type GeneratorConfig = z.input<typeof BaseGeneratorConfigSchema>;
+//#endregion
+//#region src/types/resolver.generated.d.ts
+type TailorFieldInput = {
+  /** Field data type */
+  type: "string" | "boolean" | "uuid" | "integer" | "float" | "decimal" | "enum" | "date" | "datetime" | "time" | "nested";
+  /** Field metadata configuration */
+  metadata: {
+    required?: boolean | undefined;
+    array?: boolean | undefined;
+    description?: string | undefined;
+    allowedValues?: {
+      value: string;
+      description?: string | undefined;
+    }[] | undefined;
+    hooks?: {
+      create?: Function | undefined;
+      update?: Function | undefined;
+    } | undefined;
+    typeName?: string | undefined;
+  };
+  fields: {
+    [x: string]: TailorFieldInput;
+  };
+};
+type Resolver = {
+  /** GraphQL operation type (query or mutation) */
+  operation: "query" | "mutation";
+  /** Resolver name */
+  name: string;
+  /** Resolver implementation function */
+  body: Function;
+  /** Output field definition */
+  output: {
+    type: "string" | "boolean" | "date" | "enum" | "uuid" | "integer" | "float" | "decimal" | "datetime" | "time" | "nested";
+    metadata: {
+      required?: boolean | undefined;
+      array?: boolean | undefined;
+      /** Resolver description */
+      description?: string | undefined;
+      allowedValues?: {
+        value: string;
+        /** Resolver description */
+        description?: string | undefined;
+      }[] | undefined;
+      hooks?: {
+        create?: Function | undefined;
+        update?: Function | undefined;
+      } | undefined;
+      typeName?: string | undefined;
+    };
+    fields: {
+      [x: string]: any;
+    };
+  };
+  /** Resolver description */
+  description?: string | undefined;
+  /** Input field definitions */
+  input?: {
+    [x: string]: any;
+  } | undefined;
+  /** Enable publishing events from this resolver */
+  publishEvents?: boolean | undefined;
 };
+type ResolverInput = Resolver;
 //#endregion
 //#region src/configure/types/field.d.ts
 type AllowedValue = EnumValue;
@@ -622,34 +523,6 @@ type TailorUser = {
 /** Represents an unauthenticated user in the Tailor platform. */
 declare const unauthenticatedTailorUser: TailorUser;
 //#endregion
-//#region src/configure/types/actor.d.ts
-/** User type enum values from the Tailor Platform server. */
-type TailorActorType = "USER_TYPE_USER" | "USER_TYPE_MACHINE_USER" | "USER_TYPE_UNSPECIFIED";
-/** Represents an actor in event triggers. */
-type TailorActor = {
-  /** The ID of the workspace the user belongs to. */
-  workspaceId: string;
-  /** The ID of the user. */
-  userId: string;
-  /**
-   * A map of the user's attributes.
-   * Maps from server's `attributeMap` field.
-   */
-  attributes: InferredAttributeMap | null;
-  /**
-   * A list of the user's attributes.
-   * Maps from server's `attributes` field.
-   */
-  attributeList: InferredAttributeList;
-  /** The type of the user. */
-  userType: TailorActorType;
-};
-//#endregion
-//#region src/configure/types/env.d.ts
-interface Env {}
-/** Represents environment variables in the Tailor platform. */
-type TailorEnv = keyof Env extends never ? Record<string, string> : Env;
-//#endregion
 //#region src/configure/types/helpers.d.ts
 type Prettify<T> = { [K in keyof T as string extends K ? never : K]: T[K] } & {};
 type DeepWritable<T> = T extends Date | RegExp | Function ? T : T extends object ? { -readonly [P in keyof T]: DeepWritable<T[P]> } & {} : T;
@@ -671,122 +544,6 @@ type JsonCompatible<T> = T extends string | number | boolean | null | undefined
   toJSON: () => unknown;
 } ? never : { [K in keyof T]: JsonCompatible<T[K]> } : never;
 //#endregion
-//#region src/parser/service/resolver/schema.d.ts
-declare const QueryTypeSchema: z.ZodUnion<readonly [z.ZodLiteral<"query">, z.ZodLiteral<"mutation">]>;
-declare const TailorFieldSchema: z.ZodObject<{
-  type: z.ZodEnum<{
-    string: "string";
-    boolean: "boolean";
-    uuid: "uuid";
-    integer: "integer";
-    float: "float";
-    decimal: "decimal";
-    enum: "enum";
-    date: "date";
-    datetime: "datetime";
-    time: "time";
-    nested: "nested";
-  }>;
-  metadata: z.ZodObject<{
-    required: z.ZodOptional<z.ZodBoolean>;
-    array: z.ZodOptional<z.ZodBoolean>;
-    description: z.ZodOptional<z.ZodString>;
-    allowedValues: z.ZodOptional<z.ZodArray<z.ZodObject<{
-      value: z.ZodString;
-      description: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>>;
-    hooks: z.ZodOptional<z.ZodObject<{
-      create: z.ZodOptional<z.ZodCustom<Function, Function>>;
-      update: z.ZodOptional<z.ZodCustom<Function, Function>>;
-    }, z.core.$strip>>;
-    typeName: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>;
-  fields: z.ZodRecord<z.ZodString, z.ZodObject< /*elided*/any, z.core.$strip>>;
-}, z.core.$strip>;
-declare const ResolverSchema: z.ZodObject<{
-  operation: z.ZodUnion<readonly [z.ZodLiteral<"query">, z.ZodLiteral<"mutation">]>;
-  name: z.ZodString;
-  description: z.ZodOptional<z.ZodString>;
-  input: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-    type: z.ZodEnum<{
-      string: "string";
-      boolean: "boolean";
-      uuid: "uuid";
-      integer: "integer";
-      float: "float";
-      decimal: "decimal";
-      enum: "enum";
-      date: "date";
-      datetime: "datetime";
-      time: "time";
-      nested: "nested";
-    }>;
-    metadata: z.ZodObject<{
-      required: z.ZodOptional<z.ZodBoolean>;
-      array: z.ZodOptional<z.ZodBoolean>;
-      description: z.ZodOptional<z.ZodString>;
-      allowedValues: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        value: z.ZodString;
-        description: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>>>;
-      hooks: z.ZodOptional<z.ZodObject<{
-        create: z.ZodOptional<z.ZodCustom<Function, Function>>;
-        update: z.ZodOptional<z.ZodCustom<Function, Function>>;
-      }, z.core.$strip>>;
-      typeName: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>;
-    fields: z.ZodRecord<z.ZodString, z.ZodObject< /*elided*/any, z.core.$strip>>;
-  }, z.core.$strip>>>;
-  body: z.ZodCustom<Function, Function>;
-  output: z.ZodObject<{
-    type: z.ZodEnum<{
-      string: "string";
-      boolean: "boolean";
-      uuid: "uuid";
-      integer: "integer";
-      float: "float";
-      decimal: "decimal";
-      enum: "enum";
-      date: "date";
-      datetime: "datetime";
-      time: "time";
-      nested: "nested";
-    }>;
-    metadata: z.ZodObject<{
-      required: z.ZodOptional<z.ZodBoolean>;
-      array: z.ZodOptional<z.ZodBoolean>;
-      description: z.ZodOptional<z.ZodString>;
-      allowedValues: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        value: z.ZodString;
-        description: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>>>;
-      hooks: z.ZodOptional<z.ZodObject<{
-        create: z.ZodOptional<z.ZodCustom<Function, Function>>;
-        update: z.ZodOptional<z.ZodCustom<Function, Function>>;
-      }, z.core.$strip>>;
-      typeName: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>;
-    fields: z.ZodRecord<z.ZodString, z.ZodObject< /*elided*/any, z.core.$strip>>;
-  }, z.core.$strip>;
-  publishEvents: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strip>;
-//#endregion
-//#region src/parser/service/resolver/types.d.ts
-type TailorFieldInput = z.input<typeof TailorFieldSchema>;
-type QueryType = z.output<typeof QueryTypeSchema>;
-type ResolverInput = z.input<typeof ResolverSchema>;
-type Resolver = z.output<typeof ResolverSchema>;
-type ResolverServiceConfig = {
-  files: string[];
-  ignores?: string[];
-};
-type ResolverExternalConfig = {
-  external: true;
-};
-type ResolverServiceInput = {
-  [namespace: string]: ResolverServiceConfig | ResolverExternalConfig;
-};
-//#endregion
 //#region src/configure/types/type.d.ts
 type TailorAnyField = TailorField<any>;
 type FieldParseArgs = {
@@ -1062,6 +819,221 @@ declare const unsafeAllowAllTypePermission: TailorTypePermission;
  */
 declare const unsafeAllowAllGqlPermission: TailorTypeGqlPermission;
 //#endregion
+//#region src/types/tailordb.generated.d.ts
+/**
+ * Configuration for GraphQL operations on a TailorDB type.
+ * All operations are enabled by default (undefined or true = enabled, false = disabled).
+ */
+type GqlOperationsInput = "query" | {
+  create?: boolean | undefined;
+  update?: boolean | undefined;
+  delete?: boolean | undefined;
+  read?: boolean | undefined;
+};
+type TailorDBTypeParsedSettings = {
+  /** Custom plural form of the type name for GraphQL */
+  pluralForm?: string | undefined;
+  /** Enable aggregation queries for this type */
+  aggregation?: boolean | undefined;
+  /** Enable bulk upsert mutation for this type */
+  bulkUpsert?: boolean | undefined;
+  /** Configure GraphQL operations for this type. Use "query" for read-only mode, or an object for granular control. */
+  gqlOperations?: {
+    create?: boolean | undefined;
+    update?: boolean | undefined;
+    delete?: boolean | undefined;
+    read?: boolean | undefined;
+  } | undefined;
+  /**
+   * Enable publishing events for this type.
+   * When enabled, record creation/update/deletion events are published.
+   * If not specified, this is automatically set to true when an executor uses this type
+   * with recordCreated/recordUpdated/recordDeleted triggers. If explicitly set to false
+   * while an executor uses this type, an error will be thrown during apply.
+   */
+  publishEvents?: boolean | undefined;
+};
+type RawPermissions = {
+  record?: {
+    create: readonly (readonly (string | boolean | string[] | boolean[] | {
+      user: string;
+    } | {
+      record: string;
+    } | {
+      oldRecord: string;
+    } | {
+      newRecord: string;
+    })[] | readonly (boolean | readonly (string | boolean | string[] | boolean[] | {
+      user: string;
+    } | {
+      record: string;
+    } | {
+      oldRecord: string;
+    } | {
+      newRecord: string;
+    })[])[] | {
+      conditions: readonly (string | boolean | string[] | boolean[] | {
+        user: string;
+      } | {
+        record: string;
+      } | {
+        oldRecord: string;
+      } | {
+        newRecord: string;
+      })[] | readonly (readonly (string | boolean | string[] | boolean[] | {
+        user: string;
+      } | {
+        record: string;
+      } | {
+        oldRecord: string;
+      } | {
+        newRecord: string;
+      })[])[];
+      description?: string | undefined;
+      permit?: boolean | undefined;
+    })[];
+    read: readonly (readonly (string | boolean | string[] | boolean[] | {
+      user: string;
+    } | {
+      record: string;
+    } | {
+      oldRecord: string;
+    } | {
+      newRecord: string;
+    })[] | readonly (boolean | readonly (string | boolean | string[] | boolean[] | {
+      user: string;
+    } | {
+      record: string;
+    } | {
+      oldRecord: string;
+    } | {
+      newRecord: string;
+    })[])[] | {
+      conditions: readonly (string | boolean | string[] | boolean[] | {
+        user: string;
+      } | {
+        record: string;
+      } | {
+        oldRecord: string;
+      } | {
+        newRecord: string;
+      })[] | readonly (readonly (string | boolean | string[] | boolean[] | {
+        user: string;
+      } | {
+        record: string;
+      } | {
+        oldRecord: string;
+      } | {
+        newRecord: string;
+      })[])[];
+      description?: string | undefined;
+      permit?: boolean | undefined;
+    })[];
+    update: readonly (readonly (string | boolean | string[] | boolean[] | {
+      user: string;
+    } | {
+      record: string;
+    } | {
+      oldRecord: string;
+    } | {
+      newRecord: string;
+    })[] | readonly (boolean | readonly (string | boolean | string[] | boolean[] | {
+      user: string;
+    } | {
+      record: string;
+    } | {
+      oldRecord: string;
+    } | {
+      newRecord: string;
+    })[])[] | {
+      conditions: readonly (string | boolean | string[] | boolean[] | {
+        user: string;
+      } | {
+        record: string;
+      } | {
+        oldRecord: string;
+      } | {
+        newRecord: string;
+      })[] | readonly (readonly (string | boolean | string[] | boolean[] | {
+        user: string;
+      } | {
+        record: string;
+      } | {
+        oldRecord: string;
+      } | {
+        newRecord: string;
+      })[])[];
+      description?: string | undefined;
+      permit?: boolean | undefined;
+    })[];
+    delete: readonly (readonly (string | boolean | string[] | boolean[] | {
+      user: string;
+    } | {
+      record: string;
+    } | {
+      oldRecord: string;
+    } | {
+      newRecord: string;
+    })[] | readonly (boolean | readonly (string | boolean | string[] | boolean[] | {
+      user: string;
+    } | {
+      record: string;
+    } | {
+      oldRecord: string;
+    } | {
+      newRecord: string;
+    })[])[] | {
+      conditions: readonly (string | boolean | string[] | boolean[] | {
+        user: string;
+      } | {
+        record: string;
+      } | {
+        oldRecord: string;
+      } | {
+        newRecord: string;
+      })[] | readonly (readonly (string | boolean | string[] | boolean[] | {
+        user: string;
+      } | {
+        record: string;
+      } | {
+        oldRecord: string;
+      } | {
+        newRecord: string;
+      })[])[];
+      description?: string | undefined;
+      permit?: boolean | undefined;
+    })[];
+  } | undefined;
+  gql?: readonly {
+    conditions: readonly (readonly (string | boolean | string[] | boolean[] | {
+      user: string;
+    })[])[];
+    actions: "all" | readonly ("create" | "read" | "update" | "delete" | "aggregate" | "bulkUpsert")[];
+    permit?: boolean | undefined;
+    description?: string | undefined;
+  }[] | undefined;
+};
+type TailorDBServiceConfigInput = {
+  /** Glob patterns for TailorDB type definition files */
+  files: string[];
+  /** Glob patterns to exclude from type discovery */
+  ignores?: string[] | undefined;
+  /** URL for the ERD (Entity Relationship Diagram) site */
+  erdSite?: string | undefined;
+  /** Migration configuration */
+  migration?: {
+    directory: string;
+    machineUser?: string | undefined;
+  } | undefined;
+  /** Default GraphQL operations for all types in this service */
+  gqlOperations?: "query" | {
+    create?: boolean | undefined;
+    update?: boolean | undefined;
+    delete?: boolean | undefined;
+    read?: boolean | undefined;
+  } | undefined;
+};
+//#endregion
 //#region src/configure/services/tailordb/types.d.ts
 type SerialConfig<T extends "string" | "integer" = "string" | "integer"> = Prettify<{
   start: number;
@@ -1120,29 +1092,7 @@ type IndexDef<T extends {
   unique?: boolean;
   name?: string;
 };
-/**
- * Configuration for GraphQL operations on a TailorDB type.
- * All operations are enabled by default (undefined or true = enabled, false = disabled).
- */
-interface GqlOperations {
-  /** Enable create mutation (default: true) */
-  create?: boolean;
-  /** Enable update mutation (default: true) */
-  update?: boolean;
-  /** Enable delete mutation (default: true) */
-  delete?: boolean;
-  /** Enable read queries - get, list, aggregation (default: true) */
-  read?: boolean;
-}
-/**
- * Alias for common GqlOperations configurations.
- * - "query": Read-only mode - disables all mutations (create, update, delete)
- */
-type GqlOperationsAliasQuery = "query";
-/**
- * Configuration for GraphQL operations - either an alias string or detailed object.
- */
-type GqlOperationsConfig = GqlOperationsAliasQuery | GqlOperations;
+type GqlOperationsConfig = GqlOperationsInput;
 interface TypeFeatures {
   pluralForm?: string;
   aggregation?: true;
@@ -1159,979 +1109,24 @@ interface TypeFeatures {
   publishEvents?: boolean;
 }
 //#endregion
-//#region src/parser/generator-config/types.d.ts
-type GeneratorConfig = z.input<typeof BaseGeneratorConfigSchema>;
-//#endregion
-//#region src/parser/generator-config/index.d.ts
-declare const BaseGeneratorConfigSchema: z.ZodUnion<readonly [z.ZodTuple<[z.ZodLiteral<"@tailor-platform/kysely-type">, z.ZodObject<{
-  distPath: z.ZodString;
-}, z.core.$strip>], null>, z.ZodTuple<[z.ZodLiteral<"@tailor-platform/seed">, z.ZodObject<{
-  distPath: z.ZodString;
-  machineUserName: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>], null>, z.ZodTuple<[z.ZodLiteral<"@tailor-platform/enum-constants">, z.ZodObject<{
-  distPath: z.ZodString;
-}, z.core.$strip>], null>, z.ZodTuple<[z.ZodLiteral<"@tailor-platform/file-utils">, z.ZodObject<{
-  distPath: z.ZodString;
-}, z.core.$strip>], null>, z.ZodObject<{
-  id: z.ZodString;
-  description: z.ZodString;
-  dependencies: z.ZodArray<z.ZodEnum<{
-    executor: "executor";
-    tailordb: "tailordb";
-    resolver: "resolver";
-  }>>;
-  processType: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
-  processResolver: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
-  processExecutor: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
-  processTailorDBNamespace: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
-  processResolverNamespace: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
-  aggregate: z.ZodFunction<z.core.$ZodFunctionArgs, z.ZodAny>;
-}, z.core.$strip>]>;
-//#endregion
-//#region src/parser/service/auth/schema.d.ts
-declare const AuthInvokerSchema: z.ZodObject<{
-  namespace: z.ZodString;
-  machineUserName: z.ZodString;
-}, z.core.$strip>;
-declare const OIDCSchema: z.ZodObject<{
-  name: z.ZodString;
-  kind: z.ZodLiteral<"OIDC">;
-  clientID: z.ZodString;
-  clientSecret: z.ZodObject<{
-    vaultName: z.ZodString;
-    secretKey: z.ZodString;
-  }, z.core.$strip>;
-  providerURL: z.ZodString;
-  issuerURL: z.ZodOptional<z.ZodString>;
-  usernameClaim: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-declare const SAMLSchema: z.ZodObject<{
-  name: z.ZodString;
-  kind: z.ZodLiteral<"SAML">;
-  enableSignRequest: z.ZodDefault<z.ZodBoolean>;
-  metadataURL: z.ZodOptional<z.ZodString>;
-  rawMetadata: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-declare const IDTokenSchema: z.ZodObject<{
-  name: z.ZodString;
-  kind: z.ZodLiteral<"IDToken">;
-  providerURL: z.ZodString;
-  issuerURL: z.ZodOptional<z.ZodString>;
-  clientID: z.ZodString;
-  usernameClaim: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-declare const BuiltinIdPSchema: z.ZodObject<{
-  name: z.ZodString;
-  kind: z.ZodLiteral<"BuiltInIdP">;
-  namespace: z.ZodString;
-  clientName: z.ZodString;
-}, z.core.$strip>;
-declare const IdProviderSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-  name: z.ZodString;
-  kind: z.ZodLiteral<"OIDC">;
-  clientID: z.ZodString;
-  clientSecret: z.ZodObject<{
-    vaultName: z.ZodString;
-    secretKey: z.ZodString;
-  }, z.core.$strip>;
-  providerURL: z.ZodString;
-  issuerURL: z.ZodOptional<z.ZodString>;
-  usernameClaim: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>, z.ZodObject<{
-  name: z.ZodString;
-  kind: z.ZodLiteral<"SAML">;
-  enableSignRequest: z.ZodDefault<z.ZodBoolean>;
-  metadataURL: z.ZodOptional<z.ZodString>;
-  rawMetadata: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>, z.ZodObject<{
-  name: z.ZodString;
-  kind: z.ZodLiteral<"IDToken">;
-  providerURL: z.ZodString;
-  issuerURL: z.ZodOptional<z.ZodString>;
-  clientID: z.ZodString;
-  usernameClaim: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>, z.ZodObject<{
-  name: z.ZodString;
-  kind: z.ZodLiteral<"BuiltInIdP">;
-  namespace: z.ZodString;
-  clientName: z.ZodString;
-}, z.core.$strip>], "kind">;
-declare const OAuth2ClientGrantTypeSchema: z.ZodUnion<readonly [z.ZodLiteral<"authorization_code">, z.ZodLiteral<"refresh_token">]>;
-declare const OAuth2ClientSchema: z.ZodObject<{
-  description: z.ZodOptional<z.ZodString>;
-  grantTypes: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodLiteral<"authorization_code">, z.ZodLiteral<"refresh_token">]>>>;
-  redirectURIs: z.ZodArray<z.ZodUnion<readonly [z.ZodTemplateLiteral<`https://${string}`>, z.ZodTemplateLiteral<`http://${string}`>, z.ZodTemplateLiteral<`${string}:url`>, z.ZodTemplateLiteral<`${string}:url/${string}`>]>>;
-  clientType: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"confidential">, z.ZodLiteral<"public">, z.ZodLiteral<"browser">]>>;
-  accessTokenLifetimeSeconds: z.ZodPipe<z.ZodOptional<z.ZodNumber>, z.ZodTransform<{
-    seconds: bigint;
-    nanos: number;
-  } | undefined, number | undefined>>;
-  refreshTokenLifetimeSeconds: z.ZodPipe<z.ZodOptional<z.ZodNumber>, z.ZodTransform<{
-    seconds: bigint;
-    nanos: number;
-  } | undefined, number | undefined>>;
-  requireDpop: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strip>;
-declare const SCIMAuthorizationSchema: z.ZodObject<{
-  type: z.ZodUnion<readonly [z.ZodLiteral<"oauth2">, z.ZodLiteral<"bearer">]>;
-  bearerSecret: z.ZodOptional<z.ZodObject<{
-    vaultName: z.ZodString;
-    secretKey: z.ZodString;
-  }, z.core.$strip>>;
-}, z.core.$strip>;
-declare const SCIMAttributeTypeSchema: z.ZodUnion<readonly [z.ZodLiteral<"string">, z.ZodLiteral<"number">, z.ZodLiteral<"boolean">, z.ZodLiteral<"datetime">, z.ZodLiteral<"complex">]>;
-declare const SCIMAttributeSchema: z.ZodObject<{
-  type: z.ZodUnion<readonly [z.ZodLiteral<"string">, z.ZodLiteral<"number">, z.ZodLiteral<"boolean">, z.ZodLiteral<"datetime">, z.ZodLiteral<"complex">]>;
-  name: z.ZodString;
-  description: z.ZodOptional<z.ZodString>;
-  mutability: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"readOnly">, z.ZodLiteral<"readWrite">, z.ZodLiteral<"writeOnly">]>>;
-  required: z.ZodOptional<z.ZodBoolean>;
-  multiValued: z.ZodOptional<z.ZodBoolean>;
-  uniqueness: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"none">, z.ZodLiteral<"server">, z.ZodLiteral<"global">]>>;
-  canonicalValues: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
-  subAttributes: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject< /*elided*/any, z.core.$strip>>>>;
-}, z.core.$strip>;
-declare const SCIMAttributeMappingSchema: z.ZodObject<{
-  tailorDBField: z.ZodString;
-  scimPath: z.ZodString;
-}, z.core.$strip>;
-declare const SCIMResourceSchema: z.ZodObject<{
-  name: z.ZodString;
-  tailorDBNamespace: z.ZodString;
-  tailorDBType: z.ZodString;
-  coreSchema: z.ZodObject<{
-    name: z.ZodString;
-    attributes: z.ZodArray<z.ZodObject<{
-      type: z.ZodUnion<readonly [z.ZodLiteral<"string">, z.ZodLiteral<"number">, z.ZodLiteral<"boolean">, z.ZodLiteral<"datetime">, z.ZodLiteral<"complex">]>;
-      name: z.ZodString;
-      description: z.ZodOptional<z.ZodString>;
-      mutability: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"readOnly">, z.ZodLiteral<"readWrite">, z.ZodLiteral<"writeOnly">]>>;
-      required: z.ZodOptional<z.ZodBoolean>;
-      multiValued: z.ZodOptional<z.ZodBoolean>;
-      uniqueness: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"none">, z.ZodLiteral<"server">, z.ZodLiteral<"global">]>>;
-      canonicalValues: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
-      subAttributes: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject< /*elided*/any, z.core.$strip>>>>;
-    }, z.core.$strip>>;
-  }, z.core.$strip>;
-  attributeMapping: z.ZodArray<z.ZodObject<{
-    tailorDBField: z.ZodString;
-    scimPath: z.ZodString;
-  }, z.core.$strip>>;
-}, z.core.$strip>;
-declare const SCIMSchema: z.ZodObject<{
-  machineUserName: z.ZodString;
-  authorization: z.ZodObject<{
-    type: z.ZodUnion<readonly [z.ZodLiteral<"oauth2">, z.ZodLiteral<"bearer">]>;
-    bearerSecret: z.ZodOptional<z.ZodObject<{
-      vaultName: z.ZodString;
-      secretKey: z.ZodString;
-    }, z.core.$strip>>;
-  }, z.core.$strip>;
-  resources: z.ZodArray<z.ZodObject<{
-    name: z.ZodString;
-    tailorDBNamespace: z.ZodString;
-    tailorDBType: z.ZodString;
-    coreSchema: z.ZodObject<{
-      name: z.ZodString;
-      attributes: z.ZodArray<z.ZodObject<{
-        type: z.ZodUnion<readonly [z.ZodLiteral<"string">, z.ZodLiteral<"number">, z.ZodLiteral<"boolean">, z.ZodLiteral<"datetime">, z.ZodLiteral<"complex">]>;
-        name: z.ZodString;
-        description: z.ZodOptional<z.ZodString>;
-        mutability: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"readOnly">, z.ZodLiteral<"readWrite">, z.ZodLiteral<"writeOnly">]>>;
-        required: z.ZodOptional<z.ZodBoolean>;
-        multiValued: z.ZodOptional<z.ZodBoolean>;
-        uniqueness: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"none">, z.ZodLiteral<"server">, z.ZodLiteral<"global">]>>;
-        canonicalValues: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
-        subAttributes: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject< /*elided*/any, z.core.$strip>>>>;
-      }, z.core.$strip>>;
-    }, z.core.$strip>;
-    attributeMapping: z.ZodArray<z.ZodObject<{
-      tailorDBField: z.ZodString;
-      scimPath: z.ZodString;
-    }, z.core.$strip>>;
-  }, z.core.$strip>>;
-}, z.core.$strip>;
-declare const TenantProviderSchema: z.ZodObject<{
-  namespace: z.ZodString;
-  type: z.ZodString;
-  signatureField: z.ZodString;
-}, z.core.$strip>;
-//#endregion
-//#region src/parser/service/auth/types.d.ts
-type AuthInvoker = z.output<typeof AuthInvokerSchema>;
-type AuthInvokerWithName<M extends string> = Omit<AuthInvoker, "machineUserName"> & {
-  machineUserName: M;
-};
-type OIDC = z.output<typeof OIDCSchema>;
-type SAML = z.output<typeof SAMLSchema>;
-type IDToken = z.output<typeof IDTokenSchema>;
-type BuiltinIdP = z.output<typeof BuiltinIdPSchema>;
-type IdProviderConfig = z.output<typeof IdProviderSchema>;
-type OAuth2ClientGrantType = z.output<typeof OAuth2ClientGrantTypeSchema>;
-type OAuth2ClientInput = z.input<typeof OAuth2ClientSchema>;
-type SCIMAuthorization = z.output<typeof SCIMAuthorizationSchema>;
-type SCIMAttributeType = z.output<typeof SCIMAttributeTypeSchema>;
-type SCIMAttribute = z.output<typeof SCIMAttributeSchema>;
-type SCIMAttributeMapping = z.output<typeof SCIMAttributeMappingSchema>;
-type SCIMResource = z.output<typeof SCIMResourceSchema>;
-type SCIMConfig = z.output<typeof SCIMSchema>;
-type TenantProviderConfig = z.output<typeof TenantProviderSchema>;
-type ValueOperand = string | boolean | string[] | boolean[];
-type AuthAttributeValue = ValueOperand | null | undefined;
-type UserFieldKeys<User extends TailorDBInstance> = keyof output<User> & string;
-type FieldDefined<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = User["fields"][Key] extends {
-  _defined: infer Defined;
-} ? Defined : never;
-type FieldOutput<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = output<User>[Key];
-type FieldIsRequired<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = undefined extends FieldOutput<User, Key> ? false : true;
-type FieldIsOfType<User extends TailorDBInstance, Key extends UserFieldKeys<User>, Type extends string> = FieldDefined<User, Key> extends {
-  type: Type;
-} ? true : false;
-type FieldIsArray<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = FieldDefined<User, Key> extends {
-  array: true;
-} ? true : false;
-type FieldIsUnique<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = FieldDefined<User, Key> extends {
-  unique: true;
-} ? true : false;
-type FieldSupportsValueOperand<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = FieldOutput<User, Key> extends ValueOperand | null | undefined ? true : false;
-type UsernameFieldKey<User extends TailorDBInstance> = IsAny<User> extends true ? string : { [K in UserFieldKeys<User>]: FieldIsRequired<User, K> extends true ? FieldIsOfType<User, K, "string"> extends true ? FieldIsArray<User, K> extends true ? never : FieldIsUnique<User, K> extends true ? K : never : never : never }[UserFieldKeys<User>];
-type UserAttributeKey<User extends TailorDBInstance> = { [K in UserFieldKeys<User>]: K extends "id" ? never : FieldSupportsValueOperand<User, K> extends true ? FieldIsOfType<User, K, "datetime" | "date" | "time"> extends true ? never : K : never }[UserFieldKeys<User>];
-type UserAttributeListKey<User extends TailorDBInstance> = { [K in UserFieldKeys<User>]: K extends "id" ? never : FieldIsOfType<User, K, "uuid"> extends true ? FieldIsArray<User, K> extends true ? never : K : never }[UserFieldKeys<User>];
-type UserAttributeMap<User extends TailorDBInstance> = { [K in UserAttributeKey<User>]?: true };
-type DisallowExtraKeys<T, Allowed extends PropertyKey> = T & { [K in Exclude<keyof T, Allowed>]: never };
-type AttributeListValue<User extends TailorDBInstance, Key extends UserAttributeListKey<User>> = Key extends keyof output<User> ? output<User>[Key] : never;
-type AttributeListToTuple<User extends TailorDBInstance, AttributeList$1 extends readonly UserAttributeListKey<User>[]> = { [Index in keyof AttributeList$1]: AttributeList$1[Index] extends UserAttributeListKey<User> ? AttributeListValue<User, AttributeList$1[Index]> : never };
-type AttributeMapSelectedKeys<User extends TailorDBInstance, AttributeMap$1 extends UserAttributeMap<User>> = Extract<{ [K in keyof AttributeMap$1]-?: undefined extends AttributeMap$1[K] ? never : K }[keyof AttributeMap$1], UserAttributeKey<User>>;
-type UserProfile<User extends TailorDBInstance, AttributeMap$1 extends UserAttributeMap<User>, AttributeList$1 extends UserAttributeListKey<User>[]> = {
-  /**
-   * TailorDB namespace where the user type is defined.
-   *
-   * Usually auto-resolved, so you don't need to specify this.
-   * Required only when multiple TailorDBs exist and the type is in an external TailorDB.
-   */
-  namespace?: string;
-  type: User;
-  usernameField: UsernameFieldKey<User>;
-  attributes?: DisallowExtraKeys<AttributeMap$1, UserAttributeKey<User>>;
-  attributeList?: AttributeList$1;
-};
-type MachineUserAttributeFields = Record<string, TailorField<DefinedFieldMetadata, unknown, FieldMetadata, TailorFieldType>>;
-type TailorFieldOutputValue<Field> = Field extends TailorField<DefinedFieldMetadata, infer Output, FieldMetadata, TailorFieldType> ? Output : never;
-type MachineUserAttributeValues<Fields extends MachineUserAttributeFields> = { [K in keyof Fields]: TailorFieldOutputValue<Fields[K]> extends ValueOperand | null | undefined ? TailorFieldOutputValue<Fields[K]> : never };
-type MachineUserFromAttributes<Fields extends MachineUserAttributeFields> = (keyof Fields extends never ? {
-  attributes?: never;
-} : {
-  attributes: DisallowExtraKeys<MachineUserAttributeValues<Fields>, keyof Fields>;
-}) & {
-  attributeList?: string[];
-};
-type MachineUser<User extends TailorDBInstance, AttributeMap$1 extends UserAttributeMap<User> = UserAttributeMap<User>, AttributeList$1 extends UserAttributeListKey<User>[] = [], MachineUserAttributes extends MachineUserAttributeFields | undefined = undefined> = IsAny<MachineUserAttributes> extends true ? IsAny<User> extends true ? {
-  attributes: Record<string, AuthAttributeValue>;
-  attributeList?: string[];
-} : (AttributeMapSelectedKeys<User, AttributeMap$1> extends never ? {
-  attributes?: never;
-} : {
-  attributes: { [K in AttributeMapSelectedKeys<User, AttributeMap$1>]: K extends keyof output<User> ? output<User>[K] : never } & { [K in Exclude<keyof output<User>, AttributeMapSelectedKeys<User, AttributeMap$1>>]?: never };
-}) & ([] extends AttributeList$1 ? {
-  attributeList?: never;
-} : {
-  attributeList: AttributeListToTuple<User, AttributeList$1>;
-}) : [MachineUserAttributes] extends [MachineUserAttributeFields] ? MachineUserFromAttributes<MachineUserAttributes> : IsAny<User> extends true ? {
-  attributes: Record<string, AuthAttributeValue>;
-  attributeList?: string[];
-} : (AttributeMapSelectedKeys<User, AttributeMap$1> extends never ? {
-  attributes?: never;
-} : {
-  attributes: { [K in AttributeMapSelectedKeys<User, AttributeMap$1>]: K extends keyof output<User> ? output<User>[K] : never } & { [K in Exclude<keyof output<User>, AttributeMapSelectedKeys<User, AttributeMap$1>>]?: never };
-}) & ([] extends AttributeList$1 ? {
-  attributeList?: never;
-} : {
-  attributeList: AttributeListToTuple<User, AttributeList$1>;
-});
-type AuthServiceInput<User extends TailorDBInstance, AttributeMap$1 extends UserAttributeMap<User>, AttributeList$1 extends UserAttributeListKey<User>[], MachineUserNames extends string, MachineUserAttributes extends MachineUserAttributeFields | undefined = MachineUserAttributeFields | undefined> = {
-  userProfile?: UserProfile<User, AttributeMap$1, AttributeList$1>;
-  machineUserAttributes?: MachineUserAttributes;
-  machineUsers?: Record<MachineUserNames, MachineUser<User, AttributeMap$1, AttributeList$1, MachineUserAttributes>>;
-  oauth2Clients?: Record<string, OAuth2ClientInput>;
-  idProvider?: IdProviderConfig;
-  scim?: SCIMConfig;
-  tenantProvider?: TenantProviderConfig;
-  publishSessionEvents?: boolean;
-};
-declare const authDefinitionBrand: unique symbol;
-type AuthDefinitionBrand = {
-  readonly [authDefinitionBrand]: true;
-};
-type DefinedAuth<Name extends string, Config, MachineUserNames extends string> = Config & {
-  name: Name;
-  invoker<M extends MachineUserNames>(machineUser: M): AuthInvokerWithName<M>;
-} & AuthDefinitionBrand;
-type AuthExternalConfig = {
-  name: string;
-  external: true;
-};
-type AuthServiceInputLoose = AuthServiceInput<any, any, any, string, any>;
-type AuthOwnConfig = DefinedAuth<string, AuthServiceInputLoose, string>;
-type AuthConfig = AuthOwnConfig | AuthExternalConfig;
-//#endregion
-//#region src/parser/service/executor/schema.d.ts
-declare const RecordTriggerSchema: z.ZodObject<{
-  kind: z.ZodEnum<{
-    recordCreated: "recordCreated";
-    recordUpdated: "recordUpdated";
-    recordDeleted: "recordDeleted";
-  }>;
-  typeName: z.ZodString;
-  condition: z.ZodOptional<z.ZodCustom<Function, Function>>;
-}, z.core.$strip>;
-declare const ResolverExecutedTriggerSchema: z.ZodObject<{
-  kind: z.ZodLiteral<"resolverExecuted">;
-  resolverName: z.ZodString;
-  condition: z.ZodOptional<z.ZodCustom<Function, Function>>;
-}, z.core.$strip>;
-declare const ScheduleTriggerSchema: z.ZodObject<{
-  kind: z.ZodLiteral<"schedule">;
-  cron: z.ZodString;
-  timezone: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-}, z.core.$strip>;
-declare const IncomingWebhookTriggerSchema: z.ZodObject<{
-  kind: z.ZodLiteral<"incomingWebhook">;
-}, z.core.$strip>;
-declare const IdpUserTriggerSchema: z.ZodObject<{
-  kind: z.ZodEnum<{
-    idpUserCreated: "idpUserCreated";
-    idpUserUpdated: "idpUserUpdated";
-    idpUserDeleted: "idpUserDeleted";
-  }>;
-}, z.core.$strip>;
-declare const AuthAccessTokenTriggerSchema: z.ZodObject<{
-  kind: z.ZodEnum<{
-    authAccessTokenIssued: "authAccessTokenIssued";
-    authAccessTokenRefreshed: "authAccessTokenRefreshed";
-    authAccessTokenRevoked: "authAccessTokenRevoked";
-  }>;
-}, z.core.$strip>;
-declare const FunctionOperationSchema: z.ZodObject<{
-  kind: z.ZodEnum<{
-    function: "function";
-    jobFunction: "jobFunction";
-  }>;
-  body: z.ZodCustom<Function, Function>;
-  authInvoker: z.ZodOptional<z.ZodObject<{
-    namespace: z.ZodString;
-    machineUserName: z.ZodString;
-  }, z.core.$strip>>;
-}, z.core.$strip>;
-declare const GqlOperationSchema: z.ZodObject<{
-  kind: z.ZodLiteral<"graphql">;
-  appName: z.ZodOptional<z.ZodString>;
-  query: z.ZodPipe<z.ZodTransform<string, unknown>, z.ZodString>;
-  variables: z.ZodOptional<z.ZodCustom<Function, Function>>;
-  authInvoker: z.ZodOptional<z.ZodObject<{
-    namespace: z.ZodString;
-    machineUserName: z.ZodString;
-  }, z.core.$strip>>;
-}, z.core.$strip>;
-declare const WebhookOperationSchema: z.ZodObject<{
-  kind: z.ZodLiteral<"webhook">;
-  url: z.ZodCustom<Function, Function>;
-  requestBody: z.ZodOptional<z.ZodCustom<Function, Function>>;
-  headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-    vault: z.ZodString;
-    key: z.ZodString;
-  }, z.core.$strip>]>>>;
-}, z.core.$strip>;
-declare const WorkflowOperationSchema: z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
-  kind: z.ZodLiteral<"workflow">;
-  workflowName: z.ZodString;
-  args: z.ZodOptional<z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodUnknown>, z.ZodCustom<Function, Function>]>>;
-  authInvoker: z.ZodOptional<z.ZodObject<{
-    namespace: z.ZodString;
-    machineUserName: z.ZodString;
-  }, z.core.$strip>>;
-}, z.core.$strip>>;
-declare const ExecutorSchema: z.ZodObject<{
-  name: z.ZodString;
-  description: z.ZodOptional<z.ZodString>;
-  disabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-  trigger: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    kind: z.ZodEnum<{
-      recordCreated: "recordCreated";
-      recordUpdated: "recordUpdated";
-      recordDeleted: "recordDeleted";
-    }>;
-    typeName: z.ZodString;
-    condition: z.ZodOptional<z.ZodCustom<Function, Function>>;
-  }, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodLiteral<"resolverExecuted">;
-    resolverName: z.ZodString;
-    condition: z.ZodOptional<z.ZodCustom<Function, Function>>;
-  }, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodLiteral<"schedule">;
-    cron: z.ZodString;
-    timezone: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-  }, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodLiteral<"incomingWebhook">;
-  }, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodEnum<{
-      idpUserCreated: "idpUserCreated";
-      idpUserUpdated: "idpUserUpdated";
-      idpUserDeleted: "idpUserDeleted";
-    }>;
-  }, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodEnum<{
-      authAccessTokenIssued: "authAccessTokenIssued";
-      authAccessTokenRefreshed: "authAccessTokenRefreshed";
-      authAccessTokenRevoked: "authAccessTokenRevoked";
-    }>;
-  }, z.core.$strip>], "kind">;
-  operation: z.ZodUnion<readonly [z.ZodObject<{
-    kind: z.ZodEnum<{
-      function: "function";
-      jobFunction: "jobFunction";
-    }>;
-    body: z.ZodCustom<Function, Function>;
-    authInvoker: z.ZodOptional<z.ZodObject<{
-      namespace: z.ZodString;
-      machineUserName: z.ZodString;
-    }, z.core.$strip>>;
-  }, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodLiteral<"graphql">;
-    appName: z.ZodOptional<z.ZodString>;
-    query: z.ZodPipe<z.ZodTransform<string, unknown>, z.ZodString>;
-    variables: z.ZodOptional<z.ZodCustom<Function, Function>>;
-    authInvoker: z.ZodOptional<z.ZodObject<{
-      namespace: z.ZodString;
-      machineUserName: z.ZodString;
-    }, z.core.$strip>>;
-  }, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodLiteral<"webhook">;
-    url: z.ZodCustom<Function, Function>;
-    requestBody: z.ZodOptional<z.ZodCustom<Function, Function>>;
-    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-      vault: z.ZodString;
-      key: z.ZodString;
-    }, z.core.$strip>]>>>;
-  }, z.core.$strip>, z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
-    kind: z.ZodLiteral<"workflow">;
-    workflowName: z.ZodString;
-    args: z.ZodOptional<z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodUnknown>, z.ZodCustom<Function, Function>]>>;
-    authInvoker: z.ZodOptional<z.ZodObject<{
-      namespace: z.ZodString;
-      machineUserName: z.ZodString;
-    }, z.core.$strip>>;
-  }, z.core.$strip>>]>;
-}, z.core.$strip>;
-//#endregion
-//#region src/parser/service/executor/types.d.ts
-type RecordTrigger = z.infer<typeof RecordTriggerSchema>;
-type ResolverExecutedTrigger = z.infer<typeof ResolverExecutedTriggerSchema>;
-type ScheduleTriggerInput = z.input<typeof ScheduleTriggerSchema>;
-type IncomingWebhookTrigger = z.infer<typeof IncomingWebhookTriggerSchema>;
-type IdpUserTrigger = z.infer<typeof IdpUserTriggerSchema>;
-type AuthAccessTokenTrigger = z.infer<typeof AuthAccessTokenTriggerSchema>;
-type FunctionOperation = z.infer<typeof FunctionOperationSchema>;
-type GqlOperation = z.infer<typeof GqlOperationSchema>;
-type WebhookOperation = z.infer<typeof WebhookOperationSchema>;
-type WorkflowOperation = z.infer<typeof WorkflowOperationSchema>;
-type Executor = z.infer<typeof ExecutorSchema>;
-type ExecutorInput = z.input<typeof ExecutorSchema>;
-type ExecutorServiceConfig = {
-  files: string[];
-  ignores?: string[];
-};
-type ExecutorServiceInput = ExecutorServiceConfig;
-//#endregion
-//#region src/parser/plugin-config/generation-types.d.ts
-/**
- * A single generated file to write to disk.
- */
-interface GeneratedFile {
-  path: string;
-  content: string;
-  skipIfExists?: boolean;
-  executable?: boolean;
-}
-/**
- * Result returned by generation-time hooks.
- */
-interface GeneratorResult {
-  files: GeneratedFile[];
-  errors?: string[];
-}
-/**
- * Auth configuration available to generation-time hooks.
- */
-interface GeneratorAuthInput {
-  name: string;
-  userProfile?: {
-    typeName: string;
-    namespace: string;
-    usernameField: string;
-  };
-  machineUsers?: Record<string, {
-    attributes: Record<string, unknown>;
-  }>;
-  oauth2Clients?: Record<string, OAuth2ClientInput>;
-  idProvider?: IdProviderConfig;
-}
-/**
- * Namespace-level TailorDB data available to generation-time hooks.
- */
-interface TailorDBNamespaceData {
-  /** Namespace name */
-  namespace: string;
-  /** All TailorDB types in this namespace, keyed by type name */
-  types: Record<string, TailorDBType>;
-  /** Source info for each type (file path, export name, plugin info) */
-  sourceInfo: ReadonlyMap<string, TypeSourceInfoEntry>;
-  /** Plugin attachments configured on each type via .plugin() method */
-  pluginAttachments: ReadonlyMap<string, readonly PluginAttachment[]>;
-}
-/**
- * Namespace-level resolver data available to generation-time hooks.
- */
-interface ResolverNamespaceData {
-  /** Namespace name */
-  namespace: string;
-  /** All resolvers in this namespace, keyed by resolver name */
-  resolvers: Record<string, Resolver>;
-}
-/**
- * Context passed to plugin's onTailorDBReady hook.
- * Called after all TailorDB types are loaded and finalized.
- * @template PluginConfig - Plugin-level configuration type
- */
-interface TailorDBReadyContext<PluginConfig = unknown> {
-  /** All TailorDB namespaces with their types and metadata */
-  tailordb: TailorDBNamespaceData[];
-  /** Auth configuration */
-  auth?: GeneratorAuthInput;
-  /** Base directory for generated files */
-  baseDir: string;
-  /** Path to tailor.config.ts */
-  configPath: string;
-  /** Plugin-level configuration passed via definePlugins() */
-  pluginConfig: PluginConfig;
-}
-/**
- * Context passed to plugin's onResolverReady hook.
- * Called after all resolvers are loaded and finalized.
- * @template PluginConfig - Plugin-level configuration type
- */
-interface ResolverReadyContext<PluginConfig = unknown> {
-  /** All TailorDB namespaces with their types and metadata */
-  tailordb: TailorDBNamespaceData[];
-  /** All resolver namespaces with their resolvers */
-  resolvers: ResolverNamespaceData[];
-  /** Auth configuration */
-  auth?: GeneratorAuthInput;
-  /** Base directory for generated files */
-  baseDir: string;
-  /** Path to tailor.config.ts */
-  configPath: string;
-  /** Plugin-level configuration passed via definePlugins() */
-  pluginConfig: PluginConfig;
-}
-/**
- * Context passed to plugin's onExecutorReady hook.
- * Called after all executors are loaded and finalized.
- * @template PluginConfig - Plugin-level configuration type
- */
-interface ExecutorReadyContext<PluginConfig = unknown> {
-  /** All TailorDB namespaces with their types and metadata */
-  tailordb: TailorDBNamespaceData[];
-  /** All resolver namespaces with their resolvers */
-  resolvers: ResolverNamespaceData[];
-  /** All executors, keyed by executor name */
-  executors: Record<string, Executor>;
-  /** Auth configuration */
-  auth?: GeneratorAuthInput;
-  /** Base directory for generated files */
-  baseDir: string;
-  /** Path to tailor.config.ts */
-  configPath: string;
-  /** Plugin-level configuration passed via definePlugins() */
-  pluginConfig: PluginConfig;
-}
-//#endregion
-//#region src/parser/plugin-config/types.d.ts
-type TypeConfigRequired<PluginConfig = unknown> = boolean | ((pluginConfig: PluginConfig | undefined) => boolean);
-/**
- * Interface for plugin configuration mapping.
- * Extend this interface via declaration merging to add typed plugin configs.
- *
- * The `Fields` type parameter provides field names from the type being configured,
- * enabling type-safe field references in plugin configs.
- * @example
- * ```typescript
- * // In your plugin package or types file:
- * declare module "@tailor-platform/sdk" {
- *   interface PluginConfigs<Fields extends string> {
- *     "@my-company/i18n": {
- *       labels: Partial<Record<Fields, { ja: string; en: string }>>;
- *     };
- *   }
- * }
- * ```
- */
-interface PluginConfigs<Fields extends string = string> {}
-/**
- * Plugin attachment stored on TailorAnyDBType instances.
- * This is the configuration passed via `.plugin()` method.
- */
-interface PluginAttachment {
-  pluginId: string;
-  config: unknown;
-}
-/**
- * Context passed to plugin's process method
- */
-interface PluginProcessContext<TypeConfig = unknown, PluginConfig = unknown> {
-  /** The raw TailorDB type being processed */
-  type: TailorAnyDBType;
-  /** Per-type configuration passed via .plugin() method */
-  typeConfig: TypeConfig;
-  /** Plugin-level configuration passed via definePlugins() */
-  pluginConfig: PluginConfig;
-  /** Namespace of the TailorDB type */
-  namespace: string;
-}
-/**
- * Context passed to plugin's onNamespaceLoaded hook.
- * Used for plugins that operate on a namespace without requiring a source type.
- */
-interface PluginNamespaceProcessContext<PluginConfig = unknown> {
-  /** Plugin-level configuration passed via definePlugins() */
-  pluginConfig: PluginConfig;
-  /** Target namespace for generated types */
-  namespace: string;
-}
-/**
- * Interface representing a TailorDB type for plugin output.
- * This interface is satisfied by db.type() instances.
- */
-interface TailorDBTypeForPlugin {
-  /** The name of the type */
-  readonly name: string;
-  /** The field definitions */
-  readonly fields: Record<string, unknown>;
-}
-/**
- * Type generated by a plugin - use db.type() to create these.
- */
-type PluginGeneratedType = TailorDBTypeForPlugin;
-/**
- * Map of generated types keyed by kind identifier.
- * The kind is used to generate distinct TypeScript type files for each generated type.
- * @example
- * ```typescript
- * {
- *   request: changeRequest,
- *   step: changeStep,
- *   approval: changeApproval,
- * }
- * ```
- */
-type PluginGeneratedTypes = Record<string, PluginGeneratedType>;
-/**
- * Resolver definition generated by a plugin.
- * Fields can be TailorDB field instances or raw field definitions.
- */
-interface PluginGeneratedResolver {
-  name: string;
-  operation: "query" | "mutation";
-  inputFields?: Record<string, unknown>;
-  outputFields: Record<string, unknown>;
-  /** Function body code as string */
-  body: string;
-}
-/**
- * Record trigger configuration for plugin-generated executors
- */
-interface PluginRecordTriggerConfig {
-  kind: "recordCreated" | "recordUpdated" | "recordDeleted";
-  /** TailorDB type name for record triggers */
-  typeName: string;
-}
-/**
- * Schedule trigger configuration for plugin-generated executors
- */
-interface PluginScheduleTriggerConfig {
-  kind: "schedule";
-  /** Cron expression */
-  cron: string;
-  /** Timezone (defaults to UTC) */
-  timezone?: string;
-}
-/**
- * Incoming webhook trigger configuration for plugin-generated executors
- */
-interface PluginIncomingWebhookTriggerConfig {
-  kind: "incomingWebhook";
-}
-/**
- * Trigger configuration for plugin-generated executors
- */
-type PluginTriggerConfig = PluginRecordTriggerConfig | PluginScheduleTriggerConfig | PluginIncomingWebhookTriggerConfig;
-/**
- * Inject value types supported for plugin executor injection.
- * These values are serialized as const declarations in the generated file.
- */
-type PluginInjectValue = string | number | boolean | null;
-/**
- * Inject map for plugin executor.
- * Keys become const variable names in the generated file.
- */
-type PluginInjectMap = Record<string, PluginInjectValue>;
-/**
- * Function operation configuration for plugin-generated executors
- */
-interface PluginFunctionOperationConfig {
-  kind: "function";
-  /** Function body code as string */
-  body: string;
-  /**
-   * Variables to inject into the generated file scope.
-   * These become const declarations at the top of the generated file,
-   * allowing the function body to reference them.
-   * @example { namespace: "tailordb", historyTypeName: "CustomerHistory" }
-   */
-  inject?: PluginInjectMap;
-}
-/**
- * GraphQL operation configuration for plugin-generated executors
- */
-interface PluginGraphQLOperationConfig {
-  kind: "graphql";
-  /** GraphQL query string */
-  query: string;
-  /** App name for the GraphQL endpoint */
-  appName?: string;
-  /**
-   * Variables expression as a string function.
-   * Receives the executor args object and returns the variables object.
-   * @example "(args) => ({ input: { recordId: args.newRecord.id } })"
-   */
-  variables?: string;
-}
-/**
- * Webhook operation configuration for plugin-generated executors
- */
-interface PluginWebhookOperationConfig {
-  kind: "webhook";
-  /** Webhook URL */
-  url: string;
-}
-/**
- * Workflow operation configuration for plugin-generated executors
- */
-interface PluginWorkflowOperationConfig {
-  kind: "workflow";
-  /** Workflow name */
-  workflowName: string;
-}
-/**
- * Operation configuration for plugin-generated executors
- */
-type PluginOperationConfig = PluginFunctionOperationConfig | PluginGraphQLOperationConfig | PluginWebhookOperationConfig | PluginWorkflowOperationConfig;
-/**
- * Context value types for plugin executor context.
- * Supports primitive values and type references.
- */
-type PluginExecutorContextValue = TailorAnyDBType | string | number | boolean | null | undefined;
-/**
- * Base executor context that can include type references and other values.
- * Type objects (TailorAnyDBType) will be handled specially by the generator
- * to create appropriate import statements.
- *
- * Plugin authors should extend this interface for their specific context needs.
- */
-interface PluginExecutorContextBase {
-  /** Source type that the plugin is attached to. Null for namespace executors. */
-  sourceType: TailorAnyDBType | null;
-  /** TailorDB namespace for data operations */
-  namespace: string;
-}
-/**
- * Flexible executor context type that allows additional properties.
- * Used as the context type in PluginGeneratedExecutorWithFile.
- */
-type PluginExecutorContext = PluginExecutorContextBase & {
-  [key: string]: PluginExecutorContextValue;
-};
-/**
- * Module shape returned by plugin executor resolve().
- * The concrete context type is intentionally erased at this boundary.
- */
-interface PluginExecutorModule {
-  default: unknown;
-}
-/**
- * Executor definition with dynamic import reference (new format).
- * Used with withPluginContext for type-safe executor definitions in separate files.
- */
-interface PluginGeneratedExecutorWithFile<Ctx = PluginExecutorContext> {
-  /** Executor name (used for generated file name) */
-  name: string;
-  /**
-   * Resolver function for the executor module.
-   * Should return a dynamic import to the executor file.
-   * Relative import specifiers are resolved from the plugin's importPath base.
-   * @example `async () => await import("./executors/on-create")`
-   */
-  resolve: () => Promise<PluginExecutorModule>;
-  /**
-   * Context to pass to the executor factory.
-   * Can include TailorAnyDBType objects - these will be handled specially
-   * by the generator to create appropriate import statements.
-   */
-  context: Ctx;
-}
-/**
- * Executor definition generated by a plugin (legacy format).
- * @deprecated Use PluginGeneratedExecutorWithFile with withPluginContext instead.
- */
-interface PluginGeneratedExecutorLegacy {
-  name: string;
-  description?: string;
-  trigger: PluginTriggerConfig;
-  operation: PluginOperationConfig;
-}
-/**
- * Executor definition generated by a plugin.
- * Supports both legacy format (inline trigger/operation) and new format (executorFile/context).
- */
-type PluginGeneratedExecutor = PluginGeneratedExecutorWithFile | PluginGeneratedExecutorLegacy;
-/**
- * Extension options for modifying the source type
- */
-interface PluginExtends {
-  /**
-   * Fields to add to the source type.
-   * These fields will be merged into the original type's fields.
-   * Existing fields (from original definition or earlier plugins) take precedence.
-   */
-  fields?: Record<string, TailorAnyDBField>;
-}
-/**
- * Base output returned by a plugin's definition-time hooks.
- * Used by both onTypeLoaded and onNamespaceLoaded.
- */
-interface PluginOutput {
-  /**
-   * Additional TailorDB types to generate, keyed by kind identifier.
-   * The kind is used to generate distinct TypeScript type files.
-   * @example { request: changeRequest, step: changeStep }
-   */
-  types?: PluginGeneratedTypes;
-  /** Additional resolvers to generate */
-  resolvers?: PluginGeneratedResolver[];
-  /** Additional executors to generate */
-  executors?: PluginGeneratedExecutor[];
-}
-/**
- * Output returned by a plugin's onTypeLoaded hook.
- * Extends PluginOutput with the ability to add fields to the source type.
- */
-interface TypePluginOutput extends PluginOutput {
-  /** Extensions to apply to the source type */
-  extends?: PluginExtends;
-}
-/**
- * Output returned by a plugin's onNamespaceLoaded hook.
- * Alias for PluginOutput (namespace plugins cannot extend a source type).
- */
-type NamespacePluginOutput = PluginOutput;
-/**
- * Plugin interface that all plugins must implement.
- * Plugins can hook into two lifecycle phases:
- * - **Definition-time hooks** (`onTypeLoaded`, `onNamespaceLoaded`): Generate TailorDB types, resolvers, and executors
- * - **Generation-time hooks** (`onTailorDBReady`, `onResolverReady`, `onExecutorReady`): Process finalized artifacts and produce output files
- * @template TypeConfig - Type for per-type configuration passed via .plugin() method
- * @template PluginConfig - Type for plugin-level configuration passed via definePlugins()
- */
-interface Plugin<TypeConfig = unknown, PluginConfig = unknown> {
-  /** Unique identifier for the plugin */
-  readonly id: string;
-  /** Human-readable description of the plugin */
-  readonly description: string;
-  /**
-   * Import path for this plugin's public API.
-   * Used by code generators to create correct import statements
-   * (e.g., plugin executors and seed schema generation).
-   * Required when plugin has definition-time hooks (onTypeLoaded/onNamespaceLoaded).
-   * Optional for generation-only plugins.
-   */
-  readonly importPath?: string;
-  /**
-   * Controls whether per-type plugin config is required when attaching via .plugin().
-   * If a function is provided, it receives pluginConfig from definePlugins().
-   * Default is optional when not provided.
-   */
-  readonly typeConfigRequired?: TypeConfigRequired<PluginConfig>;
-  /**
-   * Plugin-level configuration passed via definePlugins().
-   * This config is stored when the plugin is registered and made available
-   * to all hook methods.
-   */
-  readonly pluginConfig?: PluginConfig;
-  /**
-   * Process a single TailorDB type and generate outputs.
-   * Called for each type that has this plugin attached via .plugin().
-   * @param context - Context containing the type, config, pluginConfig, and namespace
-   * @returns Plugin output with generated types, resolvers, and executors
-   */
-  onTypeLoaded?(context: PluginProcessContext<TypeConfig, PluginConfig>): TypePluginOutput | Promise<TypePluginOutput>;
-  /**
-   * Process plugin for a namespace without requiring a source type.
-   * Called once per namespace for plugins configured via definePlugins().
-   * Use this for plugins that generate types independently of user-defined types.
-   * @param context - Context containing the plugin config and namespace
-   * @returns Plugin output with generated types, resolvers, and executors
-   */
-  onNamespaceLoaded?(context: PluginNamespaceProcessContext<PluginConfig>): NamespacePluginOutput | Promise<NamespacePluginOutput>;
-  /**
-   * Called after all TailorDB types are loaded and finalized.
-   * Receives all TailorDB namespaces and their types.
-   * @param context - Context containing all TailorDB data, auth, and output paths
-   * @returns Generated files and optional errors
-   */
-  onTailorDBReady?(context: TailorDBReadyContext<PluginConfig>): GeneratorResult | Promise<GeneratorResult>;
-  /**
-   * Called after all resolvers are loaded and finalized.
-   * Receives all TailorDB data plus resolver data.
-   * @param context - Context containing TailorDB data, resolvers, auth, and output paths
-   * @returns Generated files and optional errors
-   */
-  onResolverReady?(context: ResolverReadyContext<PluginConfig>): GeneratorResult | Promise<GeneratorResult>;
-  /**
-   * Called after all executors are loaded and finalized.
-   * Receives all TailorDB data, resolver data, plus executor data.
-   * @param context - Context containing all service data, auth, and output paths
-   * @returns Generated files and optional errors
-   */
-  onExecutorReady?(context: ExecutorReadyContext<PluginConfig>): GeneratorResult | Promise<GeneratorResult>;
-}
-//#endregion
-//#region src/configure/services/tailordb/schema.d.ts
-interface RelationConfig<S extends RelationType, T extends TailorDBType$1> {
-  type: S;
-  toward: {
-    type: T;
-    as?: string;
-    key?: keyof T["fields"] & string;
-  };
-  backward?: string;
-}
-type RelationSelfConfig = {
-  type: RelationType;
-  toward: {
-    type: "self";
-    as?: string;
-    key?: string;
-  };
-  backward?: string;
+//#region src/configure/services/tailordb/schema.d.ts
+interface RelationConfig<S extends RelationType, T extends TailorDBType$1> {
+  type: S;
+  toward: {
+    type: T;
+    as?: string;
+    key?: keyof T["fields"] & string;
+  };
+  backward?: string;
+}
+type RelationSelfConfig = {
+  type: RelationType;
+  toward: {
+    type: "self";
+    as?: string;
+    key?: string;
+  };
+  backward?: string;
 };
 type TailorAnyDBField = TailorDBField<any, any>;
 type TailorAnyDBType = TailorDBType$1<any, any>;
@@ -2615,53 +1610,135 @@ declare const db: {
   };
 };
 //#endregion
-//#region src/parser/service/tailordb/types.d.ts
-/**
- * Source information for a user-defined TailorDB type.
- */
+//#region src/types/auth.d.ts
+type OAuth2ClientGrantType = OAuth2Client["grantTypes"][number];
+type SCIMAttributeType = SCIMAttribute["type"];
+type AuthInvokerWithName<M extends string> = Omit<AuthInvoker, "machineUserName"> & {
+  machineUserName: M;
+};
+type ValueOperand = string | boolean | string[] | boolean[];
+type AuthAttributeValue = ValueOperand | null | undefined;
+type UserFieldKeys<User extends TailorDBInstance> = keyof output<User> & string;
+type FieldDefined<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = User["fields"][Key] extends {
+  _defined: infer Defined;
+} ? Defined : never;
+type FieldOutput<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = output<User>[Key];
+type FieldIsRequired<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = undefined extends FieldOutput<User, Key> ? false : true;
+type FieldIsOfType<User extends TailorDBInstance, Key extends UserFieldKeys<User>, Type extends string> = FieldDefined<User, Key> extends {
+  type: Type;
+} ? true : false;
+type FieldIsArray<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = FieldDefined<User, Key> extends {
+  array: true;
+} ? true : false;
+type FieldIsUnique<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = FieldDefined<User, Key> extends {
+  unique: true;
+} ? true : false;
+type FieldSupportsValueOperand<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = FieldOutput<User, Key> extends ValueOperand | null | undefined ? true : false;
+type UsernameFieldKey<User extends TailorDBInstance> = IsAny<User> extends true ? string : { [K in UserFieldKeys<User>]: FieldIsRequired<User, K> extends true ? FieldIsOfType<User, K, "string"> extends true ? FieldIsArray<User, K> extends true ? never : FieldIsUnique<User, K> extends true ? K : never : never : never }[UserFieldKeys<User>];
+type UserAttributeKey<User extends TailorDBInstance> = { [K in UserFieldKeys<User>]: K extends "id" ? never : FieldSupportsValueOperand<User, K> extends true ? FieldIsOfType<User, K, "datetime" | "date" | "time"> extends true ? never : K : never }[UserFieldKeys<User>];
+type UserAttributeListKey<User extends TailorDBInstance> = { [K in UserFieldKeys<User>]: K extends "id" ? never : FieldIsOfType<User, K, "uuid"> extends true ? FieldIsArray<User, K> extends true ? never : K : never }[UserFieldKeys<User>];
+type UserAttributeMap<User extends TailorDBInstance> = { [K in UserAttributeKey<User>]?: true };
+type DisallowExtraKeys<T, Allowed extends PropertyKey> = T & { [K in Exclude<keyof T, Allowed>]: never };
+type AttributeListValue<User extends TailorDBInstance, Key extends UserAttributeListKey<User>> = Key extends keyof output<User> ? output<User>[Key] : never;
+type AttributeListToTuple<User extends TailorDBInstance, AttributeList$1 extends readonly UserAttributeListKey<User>[]> = { [Index in keyof AttributeList$1]: AttributeList$1[Index] extends UserAttributeListKey<User> ? AttributeListValue<User, AttributeList$1[Index]> : never };
+type AttributeMapSelectedKeys<User extends TailorDBInstance, AttributeMap$1 extends UserAttributeMap<User>> = Extract<{ [K in keyof AttributeMap$1]-?: undefined extends AttributeMap$1[K] ? never : K }[keyof AttributeMap$1], UserAttributeKey<User>>;
+type UserProfile<User extends TailorDBInstance, AttributeMap$1 extends UserAttributeMap<User>, AttributeList$1 extends UserAttributeListKey<User>[]> = {
+  /**
+   * TailorDB namespace where the user type is defined.
+   *
+   * Usually auto-resolved, so you don't need to specify this.
+   * Required only when multiple TailorDBs exist and the type is in an external TailorDB.
+   */
+  namespace?: string;
+  type: User;
+  usernameField: UsernameFieldKey<User>;
+  attributes?: DisallowExtraKeys<AttributeMap$1, UserAttributeKey<User>>;
+  attributeList?: AttributeList$1;
+};
+type MachineUserAttributeFields = Record<string, TailorField<DefinedFieldMetadata, unknown, FieldMetadata, TailorFieldType>>;
+type TailorFieldOutputValue<Field> = Field extends TailorField<DefinedFieldMetadata, infer Output, FieldMetadata, TailorFieldType> ? Output : never;
+type MachineUserAttributeValues<Fields extends MachineUserAttributeFields> = { [K in keyof Fields]: TailorFieldOutputValue<Fields[K]> extends ValueOperand | null | undefined ? TailorFieldOutputValue<Fields[K]> : never };
+type MachineUserFromAttributes<Fields extends MachineUserAttributeFields> = (keyof Fields extends never ? {
+  attributes?: never;
+} : {
+  attributes: DisallowExtraKeys<MachineUserAttributeValues<Fields>, keyof Fields>;
+}) & {
+  attributeList?: string[];
+};
+type MachineUser<User extends TailorDBInstance, AttributeMap$1 extends UserAttributeMap<User> = UserAttributeMap<User>, AttributeList$1 extends UserAttributeListKey<User>[] = [], MachineUserAttributes extends MachineUserAttributeFields | undefined = undefined> = IsAny<MachineUserAttributes> extends true ? IsAny<User> extends true ? {
+  attributes: Record<string, AuthAttributeValue>;
+  attributeList?: string[];
+} : (AttributeMapSelectedKeys<User, AttributeMap$1> extends never ? {
+  attributes?: never;
+} : {
+  attributes: { [K in AttributeMapSelectedKeys<User, AttributeMap$1>]: K extends keyof output<User> ? output<User>[K] : never } & { [K in Exclude<keyof output<User>, AttributeMapSelectedKeys<User, AttributeMap$1>>]?: never };
+}) & ([] extends AttributeList$1 ? {
+  attributeList?: never;
+} : {
+  attributeList: AttributeListToTuple<User, AttributeList$1>;
+}) : [MachineUserAttributes] extends [MachineUserAttributeFields] ? MachineUserFromAttributes<MachineUserAttributes> : IsAny<User> extends true ? {
+  attributes: Record<string, AuthAttributeValue>;
+  attributeList?: string[];
+} : (AttributeMapSelectedKeys<User, AttributeMap$1> extends never ? {
+  attributes?: never;
+} : {
+  attributes: { [K in AttributeMapSelectedKeys<User, AttributeMap$1>]: K extends keyof output<User> ? output<User>[K] : never } & { [K in Exclude<keyof output<User>, AttributeMapSelectedKeys<User, AttributeMap$1>>]?: never };
+}) & ([] extends AttributeList$1 ? {
+  attributeList?: never;
+} : {
+  attributeList: AttributeListToTuple<User, AttributeList$1>;
+});
+type AuthServiceInput<User extends TailorDBInstance, AttributeMap$1 extends UserAttributeMap<User>, AttributeList$1 extends UserAttributeListKey<User>[], MachineUserNames extends string, MachineUserAttributes extends MachineUserAttributeFields | undefined = MachineUserAttributeFields | undefined> = {
+  userProfile?: UserProfile<User, AttributeMap$1, AttributeList$1>;
+  machineUserAttributes?: MachineUserAttributes;
+  machineUsers?: Record<MachineUserNames, MachineUser<User, AttributeMap$1, AttributeList$1, MachineUserAttributes>>;
+  oauth2Clients?: Record<string, OAuth2ClientInput>;
+  idProvider?: IdProvider;
+  scim?: SCIMConfig;
+  tenantProvider?: TenantProvider;
+  publishSessionEvents?: boolean;
+};
+declare const authDefinitionBrand: unique symbol;
+type AuthDefinitionBrand = {
+  readonly [authDefinitionBrand]: true;
+};
+type DefinedAuth<Name extends string, Config, MachineUserNames extends string> = Config & {
+  name: Name;
+  invoker<M extends MachineUserNames>(machineUser: M): AuthInvokerWithName<M>;
+} & AuthDefinitionBrand;
+type AuthExternalConfig = {
+  name: string;
+  external: true;
+};
+type AuthServiceInputLoose = AuthServiceInput<any, any, any, string, any>;
+type AuthOwnConfig = DefinedAuth<string, AuthServiceInputLoose, string>;
+type AuthConfig = AuthOwnConfig | AuthExternalConfig;
+//#endregion
+//#region src/types/tailordb.d.ts
+type RelationType = "1-1" | "oneToOne" | "n-1" | "manyToOne" | "N-1" | "keyOnly";
+type TailorDBExternalConfig = {
+  external: true;
+};
+type TailorDBServiceInput = {
+  [namespace: string]: TailorDBServiceConfigInput | TailorDBExternalConfig;
+};
 interface UserDefinedTypeSource {
-  /** File path to import from */
   filePath: string;
-  /** Export name in the source file */
   exportName: string;
-  /** Not present for user-defined types */
   pluginId?: never;
 }
-/**
- * Source information for a plugin-generated TailorDB type.
- */
 interface PluginGeneratedTypeSource {
-  /** Not present for plugin-generated types */
   filePath?: never;
-  /** Export name of the generated type */
   exportName: string;
-  /** Plugin ID that generated this type */
   pluginId: string;
-  /** Plugin import path for code generators */
   pluginImportPath: string;
-  /** Original type's file path */
   originalFilePath: string;
-  /** Original type's export name */
   originalExportName: string;
-  /** Generated type kind for getGeneratedType() API (e.g., "request", "step") */
   generatedTypeKind?: string;
-  /** Plugin config used to generate this type */
   pluginConfig?: unknown;
-  /** Namespace where this type was generated */
   namespace?: string;
 }
-/**
- * Source information for a TailorDB type.
- * Discriminated union: use `pluginId` to distinguish between user-defined and plugin-generated types.
- */
 type TypeSourceInfoEntry = UserDefinedTypeSource | PluginGeneratedTypeSource;
-/**
- * Parsed and normalized settings for TailorDB type.
- * gqlOperations is normalized from alias to object format.
- * @public
- */
-type TailorDBTypeParsedSettings = z.output<typeof TailorDBTypeSettingsSchema>;
-type RawPermissions = z.output<typeof RawPermissionsSchema>;
 interface Script {
   expr: string;
 }
@@ -2677,13 +1754,8 @@ interface OperatorFieldHook {
   create?: Script;
   update?: Script;
 }
-/**
- * Raw relation config stored in configure layer, processed in parser layer.
- * This is the serialized form of RelationConfig from schema.ts where
- * the TailorDBType reference is replaced with the type name string.
- */
 interface RawRelationConfig {
-  type: RelationType;
+  type: "1-1" | "n-1" | "keyOnly" | "oneToOne" | "manyToOne" | "N-1";
   toward: {
     type: string;
     as?: string;
@@ -2767,9 +1839,6 @@ interface TailorDBTypeMetadata {
     unique?: boolean;
   }>;
 }
-/**
- * Parsed and normalized TailorDB field information
- */
 interface ParsedField {
   name: string;
   config: OperatorFieldConfig;
@@ -2781,9 +1850,6 @@ interface ParsedField {
     unique: boolean;
   };
 }
-/**
- * Parsed and normalized TailorDB relationship information
- */
 interface ParsedRelationship {
   name: string;
   targetType: string;
@@ -2792,9 +1858,6 @@ interface ParsedRelationship {
   isArray: boolean;
   description: string;
 }
-/**
- * Parsed and normalized TailorDB type information
- */
 interface TailorDBType {
   name: string;
   pluralForm: string;
@@ -2808,5 +1871,249 @@ interface TailorDBType {
   files?: TailorDBTypeMetadata["files"];
 }
 //#endregion
-export { OAuth2ClientGrantType as $, AuthAccessTokenTrigger as A, Resolver as At, ResolverExecutedTrigger as B, TailorActor as Bt, TypePluginOutput as C, FieldMetadata as Ct, ResolverReadyContext as D, TailorAnyField as Dt, ResolverNamespaceData as E, TailorFieldType as Et, FunctionOperation as F, InferFieldsOutput as Ft, AuthExternalConfig as G, AllowedValues as Gt, WebhookOperation as H, AttributeMap as Ht, GqlOperation as I, JsonCompatible as It, AuthServiceInput as J, AuthInvoker as K, AllowedValuesOutput as Kt, IdpUserTrigger as L, output as Lt, ExecutorInput as M, ResolverInput as Mt, ExecutorServiceConfig as N, ResolverServiceConfig as Nt, TailorDBNamespaceData as O, TailorField as Ot, ExecutorServiceInput as P, ResolverServiceInput as Pt, IdProviderConfig as Q, IncomingWebhookTrigger as R, Env as Rt, TailorDBTypeForPlugin as S, DefinedFieldMetadata as St, GeneratorResult as T, FieldOutput$1 as Tt, WorkflowOperation as U, TailorUser as Ut, ScheduleTriggerInput as V, AttributeList as Vt, AuthConfig as W, unauthenticatedTailorUser as Wt, DefinedAuth as X, BuiltinIdP as Y, IDToken as Z, PluginGeneratedResolver as _, TailorTypeGqlPermission as _t, TailorDBField as a, SCIMAttributeType as at, PluginOutput as b, unsafeAllowAllTypePermission as bt, db as c, SCIMResource as ct, PluginAttachment as d, UserAttributeListKey as dt, OAuth2ClientInput as et, PluginConfigs as f, UserAttributeMap as ft, PluginGeneratedExecutorWithFile as g, PermissionCondition as gt, PluginGeneratedExecutor as h, GeneratorConfig as ht, TailorAnyDBType as i, SCIMAttributeMapping as it, Executor as j, ResolverExternalConfig as jt, TailorDBReadyContext as k, QueryType as kt, NamespacePluginOutput as l, TenantProviderConfig as lt, PluginExecutorContextBase as m, ValueOperand as mt, TypeSourceInfoEntry as n, SAML as nt, TailorDBInstance as o, SCIMAuthorization as ot, PluginExecutorContext as p, UsernameFieldKey as pt, AuthOwnConfig as q, TailorDBServiceInput as qt, TailorAnyDBField as r, SCIMAttribute as rt, TailorDBType$1 as s, SCIMConfig as st, TailorDBType as t, OIDC as tt, Plugin as u, UserAttributeKey as ut, PluginGeneratedType as v, TailorTypePermission as vt, ExecutorReadyContext as w, FieldOptions as wt, PluginProcessContext as x, ArrayFieldOutput as xt, PluginNamespaceProcessContext as y, unsafeAllowAllGqlPermission as yt, RecordTrigger as z, TailorEnv as zt };
-//# sourceMappingURL=types--G4ilVmx.d.mts.map
+//#region src/types/plugin-generation.d.ts
+/**
+ * A single generated file to write to disk.
+ */
+interface GeneratedFile {
+  path: string;
+  content: string;
+  skipIfExists?: boolean;
+  executable?: boolean;
+}
+/**
+ * Result returned by generation-time hooks.
+ */
+interface GeneratorResult {
+  files: GeneratedFile[];
+  errors?: string[];
+}
+/**
+ * Auth configuration available to generation-time hooks.
+ */
+interface GeneratorAuthInput {
+  name: string;
+  userProfile?: {
+    typeName: string;
+    namespace: string;
+    usernameField: string;
+  };
+  machineUsers?: Record<string, {
+    attributes: Record<string, unknown>;
+  }>;
+  oauth2Clients?: Record<string, OAuth2ClientInput>;
+  idProvider?: IdProvider;
+}
+/**
+ * Namespace-level TailorDB data available to generation-time hooks.
+ */
+interface TailorDBNamespaceData {
+  /** Namespace name */
+  namespace: string;
+  /** All TailorDB types in this namespace, keyed by type name */
+  types: Record<string, TailorDBType>;
+  /** Source info for each type (file path, export name, plugin info) */
+  sourceInfo: ReadonlyMap<string, TypeSourceInfoEntry>;
+  /** Plugin attachments configured on each type via .plugin() method */
+  pluginAttachments: ReadonlyMap<string, readonly PluginAttachment[]>;
+}
+/**
+ * Namespace-level resolver data available to generation-time hooks.
+ */
+interface ResolverNamespaceData {
+  /** Namespace name */
+  namespace: string;
+  /** All resolvers in this namespace, keyed by resolver name */
+  resolvers: Record<string, Resolver>;
+}
+/**
+ * Context passed to plugin's onTailorDBReady hook.
+ * @template PluginConfig - Plugin-level configuration type
+ */
+interface TailorDBReadyContext<PluginConfig = unknown> {
+  /** All TailorDB namespaces with their types and metadata */
+  tailordb: TailorDBNamespaceData[];
+  /** Auth configuration */
+  auth?: GeneratorAuthInput;
+  /** Base directory for generated files */
+  baseDir: string;
+  /** Path to tailor.config.ts */
+  configPath: string;
+  /** Plugin-level configuration passed via definePlugins() */
+  pluginConfig: PluginConfig;
+}
+/**
+ * Context passed to plugin's onResolverReady hook.
+ * @template PluginConfig - Plugin-level configuration type
+ */
+interface ResolverReadyContext<PluginConfig = unknown> {
+  /** All TailorDB namespaces with their types and metadata */
+  tailordb: TailorDBNamespaceData[];
+  /** All resolver namespaces with their resolvers */
+  resolvers: ResolverNamespaceData[];
+  /** Auth configuration */
+  auth?: GeneratorAuthInput;
+  /** Base directory for generated files */
+  baseDir: string;
+  /** Path to tailor.config.ts */
+  configPath: string;
+  /** Plugin-level configuration passed via definePlugins() */
+  pluginConfig: PluginConfig;
+}
+/**
+ * Context passed to plugin's onExecutorReady hook.
+ * @template PluginConfig - Plugin-level configuration type
+ */
+interface ExecutorReadyContext<PluginConfig = unknown> {
+  /** All TailorDB namespaces with their types and metadata */
+  tailordb: TailorDBNamespaceData[];
+  /** All resolver namespaces with their resolvers */
+  resolvers: ResolverNamespaceData[];
+  /** All executors, keyed by executor name */
+  executors: Record<string, Executor>;
+  /** Auth configuration */
+  auth?: GeneratorAuthInput;
+  /** Base directory for generated files */
+  baseDir: string;
+  /** Path to tailor.config.ts */
+  configPath: string;
+  /** Plugin-level configuration passed via definePlugins() */
+  pluginConfig: PluginConfig;
+}
+//#endregion
+//#region src/types/plugin.d.ts
+type TypeConfigRequired<PluginConfig = unknown> = boolean | ((pluginConfig: PluginConfig | undefined) => boolean);
+/**
+ * Interface for plugin configuration mapping.
+ * Extend this interface via declaration merging to add typed plugin configs.
+ */
+interface PluginConfigs<Fields extends string = string> {}
+/**
+ * Plugin attachment stored on TailorAnyDBType instances.
+ */
+interface PluginAttachment {
+  pluginId: string;
+  config: unknown;
+}
+/**
+ * Context passed to plugin's process method
+ */
+interface PluginProcessContext<TypeConfig = unknown, PluginConfig = unknown> {
+  type: TailorAnyDBType;
+  typeConfig: TypeConfig;
+  pluginConfig: PluginConfig;
+  namespace: string;
+}
+/**
+ * Context passed to plugin's onNamespaceLoaded hook.
+ */
+interface PluginNamespaceProcessContext<PluginConfig = unknown> {
+  pluginConfig: PluginConfig;
+  namespace: string;
+}
+/**
+ * Interface representing a TailorDB type for plugin output.
+ */
+interface TailorDBTypeForPlugin {
+  readonly name: string;
+  readonly fields: Record<string, unknown>;
+}
+type PluginGeneratedType = TailorDBTypeForPlugin;
+type PluginGeneratedTypes = Record<string, PluginGeneratedType>;
+interface PluginGeneratedResolver {
+  name: string;
+  operation: "query" | "mutation";
+  inputFields?: Record<string, unknown>;
+  outputFields: Record<string, unknown>;
+  body: string;
+}
+interface PluginRecordTriggerConfig {
+  kind: "recordCreated" | "recordUpdated" | "recordDeleted";
+  typeName: string;
+}
+interface PluginScheduleTriggerConfig {
+  kind: "schedule";
+  cron: string;
+  timezone?: string;
+}
+interface PluginIncomingWebhookTriggerConfig {
+  kind: "incomingWebhook";
+}
+type PluginTriggerConfig = PluginRecordTriggerConfig | PluginScheduleTriggerConfig | PluginIncomingWebhookTriggerConfig;
+type PluginInjectValue = string | number | boolean | null;
+type PluginInjectMap = Record<string, PluginInjectValue>;
+interface PluginFunctionOperationConfig {
+  kind: "function";
+  body: string;
+  inject?: PluginInjectMap;
+}
+interface PluginGraphQLOperationConfig {
+  kind: "graphql";
+  query: string;
+  appName?: string;
+  variables?: string;
+}
+interface PluginWebhookOperationConfig {
+  kind: "webhook";
+  url: string;
+}
+interface PluginWorkflowOperationConfig {
+  kind: "workflow";
+  workflowName: string;
+}
+type PluginOperationConfig = PluginFunctionOperationConfig | PluginGraphQLOperationConfig | PluginWebhookOperationConfig | PluginWorkflowOperationConfig;
+type PluginExecutorContextValue = TailorAnyDBType | string | number | boolean | null | undefined;
+interface PluginExecutorContextBase {
+  sourceType: TailorAnyDBType | null;
+  namespace: string;
+}
+type PluginExecutorContext = PluginExecutorContextBase & {
+  [key: string]: PluginExecutorContextValue;
+};
+interface PluginExecutorModule {
+  default: unknown;
+}
+interface PluginGeneratedExecutorWithFile<Ctx = PluginExecutorContext> {
+  name: string;
+  resolve: () => Promise<PluginExecutorModule>;
+  context: Ctx;
+}
+interface PluginGeneratedExecutorLegacy {
+  name: string;
+  description?: string;
+  trigger: PluginTriggerConfig;
+  operation: PluginOperationConfig;
+}
+type PluginGeneratedExecutor = PluginGeneratedExecutorWithFile | PluginGeneratedExecutorLegacy;
+interface PluginExtends {
+  fields?: Record<string, TailorAnyDBField>;
+}
+interface PluginOutput {
+  types?: PluginGeneratedTypes;
+  resolvers?: PluginGeneratedResolver[];
+  executors?: PluginGeneratedExecutor[];
+}
+interface TypePluginOutput extends PluginOutput {
+  extends?: PluginExtends;
+}
+type NamespacePluginOutput = PluginOutput;
+/**
+ * Plugin interface that all plugins must implement.
+ * @template TypeConfig - Type for per-type configuration passed via .plugin() method
+ * @template PluginConfig - Type for plugin-level configuration passed via definePlugins()
+ */
+interface Plugin<TypeConfig = unknown, PluginConfig = unknown> {
+  readonly id: string;
+  readonly description: string;
+  readonly importPath?: string;
+  readonly typeConfigRequired?: TypeConfigRequired<PluginConfig>;
+  readonly pluginConfig?: PluginConfig;
+  onTypeLoaded?(context: PluginProcessContext<TypeConfig, PluginConfig>): TypePluginOutput | Promise<TypePluginOutput>;
+  onNamespaceLoaded?(context: PluginNamespaceProcessContext<PluginConfig>): NamespacePluginOutput | Promise<NamespacePluginOutput>;
+  onTailorDBReady?(context: TailorDBReadyContext<PluginConfig>): GeneratorResult | Promise<GeneratorResult>;
+  onResolverReady?(context: ResolverReadyContext<PluginConfig>): GeneratorResult | Promise<GeneratorResult>;
+  onExecutorReady?(context: ExecutorReadyContext<PluginConfig>): GeneratorResult | Promise<GeneratorResult>;
+}
+//#endregion
+export { TailorFieldType as $, OAuth2ClientGrantType as A, IDToken as At, TailorDBInstance as B, TenantProvider as Bt, TailorDBType as C, RecordTrigger as Ct, AuthOwnConfig as D, WorkflowOperation as Dt, AuthExternalConfig as E, WebhookOperation as Et, UsernameFieldKey as F, SCIMAttribute as Ft, TailorTypePermission as G, db as H, ValueOperand as I, SCIMAttributeMapping as It, ArrayFieldOutput as J, unsafeAllowAllGqlPermission as K, TailorAnyDBField as L, SCIMAuthorization as Lt, UserAttributeKey as M, OAuth2ClientInput as Mt, UserAttributeListKey as N, OIDC as Nt, AuthServiceInput as O, AuthInvoker as Ot, UserAttributeMap as P, SAML as Pt, FieldOutput$1 as Q, TailorAnyDBType as R, SCIMConfig as Rt, TailorDBServiceInput as S, IncomingWebhookTrigger as St, AuthConfig as T, ScheduleTriggerInput as Tt, PermissionCondition as U, TailorDBType$1 as V, TailorTypeGqlPermission as W, FieldMetadata as X, DefinedFieldMetadata as Y, FieldOptions as Z, GeneratorResult as _, Executor as _t, PluginExecutorContext as a, AttributeList as at, TailorDBNamespaceData as b, GqlOperation as bt, PluginGeneratedExecutorWithFile as c, InferredAttributeMap as ct, PluginNamespaceProcessContext as d, AllowedValues as dt, TailorAnyField as et, PluginOutput as f, AllowedValuesOutput as ft, ExecutorReadyContext as g, AuthAccessTokenTrigger as gt, TypePluginOutput as h, GeneratorConfig as ht, PluginConfigs as i, output as it, SCIMAttributeType as j, IdProvider as jt, DefinedAuth as k, BuiltinIdP as kt, PluginGeneratedResolver as l, TailorUser as lt, TailorDBTypeForPlugin as m, ResolverInput as mt, Plugin as n, InferFieldsOutput as nt, PluginExecutorContextBase as o, AttributeMap as ot, PluginProcessContext as p, Resolver as pt, unsafeAllowAllTypePermission as q, PluginAttachment as r, JsonCompatible as rt, PluginGeneratedExecutor as s, InferredAttributeList as st, NamespacePluginOutput as t, TailorField as tt, PluginGeneratedType as u, unauthenticatedTailorUser as ut, ResolverNamespaceData as v, ExecutorInput as vt, TypeSourceInfoEntry as w, ResolverExecutedTrigger as wt, TailorDBReadyContext as x, IdpUserTrigger as xt, ResolverReadyContext as y, FunctionOperation as yt, TailorDBField as z, SCIMResource as zt };
+//# sourceMappingURL=plugin-CE-BZZgX.d.mts.map