@tailor-platform/sdk 1.54.3 → 1.55.0

package/dist/{runtime-DpbAj_8a.mjs → runtime-BZsl7Mh9.mjs}

@@ -1,8 +1,8 @@
 
 import { t as db } from "./schema-DKsNhbav.mjs";
-import { $ as FilterSchema, A as FunctionExecution_Status, B as AuthOAuth2Client_GrantType, C as TailorDBType_Permission_Operator, D as IdPLang, E as PipelineResolver_OperationType, F as AuthConnection_Type, H as AuthSCIMAttribute_Type, I as AuthHookPoint, J as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, K as TenantProviderConfig_TenantProviderType, L as AuthIDPConfig_AuthType, M as ExecutorJobStatus, N as ExecutorTargetType, O as IdPPermissionOperator, P as ExecutorTriggerType, Q as Condition_Operator, R as AuthInvokerSchema, S as TailorDBGQLPermission_Permit, T as TailorDBType_PermitAction, U as AuthSCIMAttribute_Uniqueness, V as AuthSCIMAttribute_Mutability, W as AuthSCIMConfig_AuthorizationType, X as Subgraph_ServiceType, Y as ApplicationSchemaUpdateAttemptStatus, Z as ConditionSchema, _ as WorkspacePlatformUserRole, a as fetchMachineUserToken, b as TailorDBGQLPermission_Action, d as initOperatorClient, et as PageDirection, g as OperatorService, h as userAgent, i as fetchAll, k as IdPPermissionPermit, m as resolveStaticWebsiteUrls, o as fetchPaged, p as platformBaseUrl, q as UserProfileProviderConfig_UserProfileProviderType, v as WorkflowExecution_Status, w as TailorDBType_Permission_Permit, x as TailorDBGQLPermission_Operator, y as WorkflowJobExecution_Status, z as AuthOAuth2Client_ClientType } from "./client-CGO7gniI.mjs";
+import { $ as FilterSchema, A as FunctionExecution_Status, B as AuthOAuth2Client_GrantType, C as TailorDBType_Permission_Operator, D as IdPLang, E as PipelineResolver_OperationType, F as AuthConnection_Type, H as AuthSCIMAttribute_Type, I as AuthHookPoint, J as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, K as TenantProviderConfig_TenantProviderType, L as AuthIDPConfig_AuthType, M as ExecutorJobStatus, N as ExecutorTargetType, O as IdPPermissionOperator, P as ExecutorTriggerType, Q as Condition_Operator, R as AuthInvokerSchema, S as TailorDBGQLPermission_Permit, T as TailorDBType_PermitAction, U as AuthSCIMAttribute_Uniqueness, V as AuthSCIMAttribute_Mutability, W as AuthSCIMConfig_AuthorizationType, X as Subgraph_ServiceType, Y as ApplicationSchemaUpdateAttemptStatus, Z as ConditionSchema, _ as WorkspacePlatformUserRole, a as fetchMachineUserToken, b as TailorDBGQLPermission_Action, d as initOperatorClient, et as PageDirection, g as OperatorService, h as userAgent, i as fetchAll, k as IdPPermissionPermit, m as resolveStaticWebsiteUrls, o as fetchPaged, p as platformBaseUrl, q as UserProfileProviderConfig_UserProfileProviderType, v as WorkflowExecution_Status, w as TailorDBType_Permission_Permit, x as TailorDBGQLPermission_Operator, y as WorkflowJobExecution_Status, z as AuthOAuth2Client_ClientType } from "./client-DLPEPJ_s.mjs";
 import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-DpJyJvNz.mjs";
-import { C as loadConfigPath, O as writePlatformConfig, S as loadAccessToken, T as readPlatformConfig, _ as getDistDir, d as buildResolverOperationHookExpr, f as OAuth2ClientSchema, g as createBundleCache, h as loadFilesWithIgnores, m as stringifyFunction, n as generatePluginFilesIfNeeded, p as TailorDBTypeSchema, r as loadApplication, s as createExecutorService, t as defineApplication, u as buildExecutorArgsExpr, v as hashFile, w as loadWorkspaceId, y as loadConfig } from "./application-BfGje3iZ.mjs";
+import { C as loadAccessToken, E as readPlatformConfig, T as loadWorkspaceId, _ as createBundleCache, b as loadConfig, c as createExecutorService, d as buildExecutorArgsExpr, f as buildResolverOperationHookExpr, g as loadFilesWithIgnores, h as stringifyFunction, k as writePlatformConfig, m as TailorDBTypeSchema, n as generatePluginFilesIfNeeded, p as OAuth2ClientSchema, r as loadApplication, s as HTTP_METHODS, t as defineApplication, v as getDistDir, w as loadConfigPath, y as hashFile } from "./application-DzUlASfA.mjs";
 import { t as multiline } from "./multiline-Cf9ODpr1.mjs";
 import { t as readPackageJson } from "./package-json-DcQApfPQ.mjs";
 import { n as isCLIError, t as createCLIError } from "./errors-EsY4XO6O.mjs";
@@ -1608,10 +1608,14 @@ function createChangeSet(title) {
 		print: () => {
 			if (isEmpty()) return;
 			logger.log(styles.bold(`${title}:`));
-			creates.forEach((item) => logger.log(`  ${symbols.create} ${item.name}`));
-			deletes.forEach((item) => logger.log(`  ${symbols.delete} ${item.name}`));
-			updates.forEach((item) => logger.log(`  ${symbols.update} ${item.name}`));
-			replaces.forEach((item) => logger.log(`  ${symbols.replace} ${item.name}`));
+			const printItem = (symbol, item) => {
+				logger.log(`  ${symbol} ${item.name}`);
+				for (const detail of item.details ?? []) logger.log(`    ${detail}`);
+			};
+			creates.forEach((item) => printItem(symbols.create, item));
+			deletes.forEach((item) => printItem(symbols.delete, item));
+			updates.forEach((item) => printItem(symbols.update, item));
+			replaces.forEach((item) => printItem(symbols.replace, item));
 		}
 	};
 }
@@ -1799,6 +1803,17 @@ function normalizeSubgraphs(subgraphs) {
 		return left.serviceNamespace.localeCompare(right.serviceNamespace);
 	});
 }
+function normalizeHttpAdapters(httpAdapters) {
+	return [...httpAdapters ?? []].map((adapter) => ({
+		name: adapter.name ?? "",
+		pathPattern: adapter.pathPattern ?? "",
+		methods: sortStrings(adapter.methods),
+		inputScript: adapter.inputScript ?? "",
+		outputScript: adapter.outputScript ?? "",
+		enabled: adapter.enabled ?? true,
+		priority: adapter.priority ?? 0
+	})).sort((left, right) => left.name.localeCompare(right.name));
+}
 function toComparableApplication(input) {
 	return {
 		authNamespace: input.authNamespace,
@@ -1807,10 +1822,11 @@ function toComparableApplication(input) {
 		subgraphs: [...input.subgraphs],
 		allowedIpAddresses: sortStrings(input.allowedIpAddresses),
 		disableIntrospection: input.disableIntrospection,
-		disabled: input.disabled
+		disabled: input.disabled,
+		httpAdapters: [...input.httpAdapters]
 	};
 }
-function normalizeComparableApplication(application, authNamespace, authIdpConfigName, cors) {
+function normalizeComparableApplication(application, authNamespace, authIdpConfigName, cors, httpAdapters) {
 	return toComparableApplication({
 		authNamespace: authNamespace ?? "",
 		authIdpConfigName: authIdpConfigName ?? "",
@@ -1818,7 +1834,8 @@ function normalizeComparableApplication(application, authNamespace, authIdpConfi
 		subgraphs: normalizeSubgraphs(application.subgraphs.map((subgraph) => protoSubgraph(subgraph))),
 		allowedIpAddresses: application.config.allowedIpAddresses ?? [],
 		disableIntrospection: application.config.disableIntrospection ?? false,
-		disabled: false
+		disabled: false,
+		httpAdapters: normalizeHttpAdapters(httpAdapters)
 	});
 }
 function normalizeComparableExistingApplication(app) {
@@ -1829,7 +1846,8 @@ function normalizeComparableExistingApplication(app) {
 		subgraphs: normalizeSubgraphs(app.subgraphs),
 		allowedIpAddresses: app.allowedIpAddresses,
 		disableIntrospection: app.disableIntrospection,
-		disabled: app.disabled
+		disabled: app.disabled,
+		httpAdapters: normalizeHttpAdapters(app.httpAdapters)
 	});
 }
 function areApplicationsEqual(existing, desired) {
@@ -1838,9 +1856,10 @@ function areApplicationsEqual(existing, desired) {
 /**
 * Plan application changes based on current and desired state.
 * @param context - Planning context
+* @param httpAdapterBuildResult - Bundled HTTP adapter scripts to embed on the Application
 * @returns Planned changes
 */
-async function planApplication(context) {
+async function planApplication(context, httpAdapterBuildResult) {
 	const { client, workspaceId, application, forRemoval } = context;
 	const changeSet = createChangeSet("Applications");
 	const existingApplications = await fetchAll(async (pageToken, maxPageSize) => {
@@ -1902,7 +1921,8 @@ async function planApplication(context) {
 	});
 	const expectedLocalWebsites = new Set(application.staticWebsiteServices.map((website) => website.name));
 	const resolvedCors = await resolveStaticWebsiteUrls(client, workspaceId, application.config.cors, "CORS", { expectedLocalNames: expectedLocalWebsites });
-	const desired = normalizeComparableApplication(application, authNamespace, authIdpConfigName, resolvedCors);
+	const httpAdapters = buildHttpAdapters(application, httpAdapterBuildResult);
+	const desired = normalizeComparableApplication(application, authNamespace, authIdpConfigName, resolvedCors, httpAdapters);
 	const request = {
 		workspaceId,
 		applicationName: application.name,
@@ -1911,7 +1931,8 @@ async function planApplication(context) {
 		cors: application.config.cors,
 		subgraphs: application.subgraphs.map((subgraph) => protoSubgraph(subgraph)),
 		allowedIpAddresses: application.config.allowedIpAddresses,
-		disableIntrospection: application.config.disableIntrospection
+		disableIntrospection: application.config.disableIntrospection,
+		httpAdapters
 	};
 	const existing = existingApplications.find((app) => app.name === application.name);
 	if (application.id) {
@@ -1935,12 +1956,20 @@ async function planApplication(context) {
 			metaRequest
 		};
 		if (isOwnedByApp(labels, application.name, application.id) && hasMatchingSdkVersion(labels, metaRequest.labels) && areApplicationsEqual(existing, desired)) changeSet.unchanged.push(update);
-		else changeSet.updates.push(update);
-	} else changeSet.creates.push({
-		name: application.name,
-		request,
-		metaRequest
-	});
+		else {
+			const details = diffHttpAdapterDisplay(existing.httpAdapters, httpAdapters);
+			if (details.length > 0) update.details = details;
+			changeSet.updates.push(update);
+		}
+	} else {
+		const details = diffHttpAdapterDisplay(void 0, httpAdapters);
+		changeSet.creates.push({
+			name: application.name,
+			request,
+			metaRequest,
+			details: details.length > 0 ? details : void 0
+		});
+	}
 	return changeSet;
 }
 async function fetchAppLabels(client, workspaceId, appName) {
@@ -1952,6 +1981,59 @@ async function fetchAppLabels(client, workspaceId, appName) {
 		throw error;
 	}
 }
+/**
+* Build per-adapter diff lines for the application plan display. The platform
+* models HTTP adapters as an embedded Application field (no dedicated RPC), so
+* adapter changes surface as an Application update; these lines show which
+* adapter actually changed instead of just `~ <app>`.
+* @param existingAdapters - HTTP adapters currently deployed on the application
+* @param desiredAdapters - HTTP adapters built from the local config
+* @returns Indented diff lines (`+`/`~`/`-` per adapter), sorted by name
+*/
+function diffHttpAdapterDisplay(existingAdapters, desiredAdapters) {
+	const existingByName = new Map((existingAdapters ?? []).map((a) => [a.name ?? "", a]));
+	const desiredByName = new Map(desiredAdapters.map((a) => [a.name ?? "", a]));
+	const entries = [];
+	for (const [name, desired] of desiredByName) {
+		const existing = existingByName.get(name);
+		if (!existing) entries.push({
+			name,
+			symbol: symbols.create
+		});
+		else if (!areNormalizedEqual(normalizeHttpAdapters([existing])[0], normalizeHttpAdapters([desired])[0])) entries.push({
+			name,
+			symbol: symbols.update
+		});
+	}
+	for (const name of existingByName.keys()) if (!desiredByName.has(name)) entries.push({
+		name,
+		symbol: symbols.delete
+	});
+	return entries.sort((left, right) => left.name.localeCompare(right.name)).map((entry) => `${entry.symbol} ${entry.name} (httpAdapter)`);
+}
+function buildHttpAdapters(application, httpAdapterBuildResult) {
+	const adapters = application.httpAdapterService?.adapters ?? [];
+	if (adapters.length === 0) return [];
+	return adapters.map((loaded) => {
+		const inputScript = httpAdapterBuildResult?.bundledInputs.get(loaded.adapter.name);
+		if (!inputScript) throw new Error(`HTTP adapter "${loaded.adapter.name}" was loaded but no bundled input script is available`);
+		let outputScript = "";
+		if (loaded.hasOutput) {
+			const bundled = httpAdapterBuildResult?.bundledOutputs.get(loaded.adapter.name);
+			if (!bundled) throw new Error(`HTTP adapter "${loaded.adapter.name}" declares an output handler but no bundled output script is available`);
+			outputScript = bundled;
+		}
+		return {
+			name: loaded.adapter.name,
+			pathPattern: loaded.adapter.pathPattern,
+			methods: loaded.methods.map((m) => HTTP_METHODS[m]),
+			inputScript,
+			outputScript,
+			enabled: loaded.adapter.enabled,
+			priority: loaded.adapter.priority
+		};
+	});
+}
 function protoSubgraph(subgraph) {
 	let serviceType;
 	switch (subgraph.Type) {
@@ -4732,6 +4814,88 @@ function normalizeAuthInvoker(authInvoker, authNamespace, context) {
 	return authInvoker;
 }
 
+//#endregion
+//#region src/cli/commands/deploy/owned-resource.ts
+/**
+* Fetch a workspace-scoped resource list and attach SDK ownership metadata.
+* @template T
+* @param params - Resource fetch parameters
+* @param params.client - Operator client instance
+* @param params.workspaceId - Workspace ID
+* @param params.fetchPage - Function that fetches one resource page
+* @param params.getName - Function that extracts the resource name
+* @param params.getTrn - Function that builds the resource TRN
+* @returns Existing resources keyed by resource name, with SDK labels attached
+*/
+async function fetchExistingResourcesWithLabels(params) {
+	const { client, workspaceId, fetchPage, getName, getTrn } = params;
+	const withoutLabel = await fetchAll(async (pageToken, maxPageSize) => {
+		try {
+			return await fetchPage(pageToken, maxPageSize);
+		} catch (error) {
+			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
+			throw error;
+		}
+	});
+	const existingResources = {};
+	await Promise.all(withoutLabel.map(async (resource) => {
+		const name = getName(resource);
+		if (!name) return;
+		const { metadata } = await client.getMetadata({ trn: getTrn(workspaceId, name) });
+		existingResources[name] = {
+			resource,
+			label: metadata?.labels[sdkNameLabelKey],
+			allLabels: metadata?.labels
+		};
+	}));
+	return existingResources;
+}
+/**
+* Determine whether a same-named existing resource is managed by this app.
+* Records the user-facing confirmation data when ownership does not match.
+* @param params - Ownership classification inputs
+* @param params.labels - Existing resource labels
+* @param params.ownerLabel - Existing `sdk-name` label, when present
+* @param params.appName - Current application name
+* @param params.appId - Current application id, when present
+* @param params.resourceType - Resource kind for confirmation messages
+* @param params.resourceName - Resource name for confirmation messages
+* @param params.conflicts - Conflict accumulator
+* @param params.unmanaged - Unmanaged-resource accumulator
+* @returns True when the resource is owned by the current app
+*/
+function trackDesiredResourceOwnership(params) {
+	const { labels, ownerLabel, appName, appId, resourceType, resourceName, conflicts, unmanaged } = params;
+	const owned = isOwnedByApp(labels, appName, appId);
+	if (!owned) if (!ownerLabel) unmanaged.push({
+		resourceType,
+		resourceName
+	});
+	else conflicts.push({
+		resourceType,
+		resourceName,
+		currentOwner: ownerLabel
+	});
+	return owned;
+}
+/**
+* Determine whether a remote-only resource is still owned by this app.
+* Also records other SDK owners so renamed-empty applications can be handled.
+* @param params - Ownership classification inputs
+* @param params.labels - Existing resource labels
+* @param params.ownerLabel - Existing `sdk-name` label, when present
+* @param params.appName - Current application name
+* @param params.appId - Current application id, when present
+* @param params.resourceOwners - Other-owner accumulator
+* @returns True when the resource is owned by the current app
+*/
+function trackRemainingResourceOwner(params) {
+	const { labels, ownerLabel, appName, appId, resourceOwners } = params;
+	const owned = isOwnedByApp(labels, appName, appId);
+	if (ownerLabel && !owned) resourceOwners.add(ownerLabel);
+	return owned;
+}
+
 //#endregion
 //#region src/cli/commands/deploy/executor.ts
 /**
@@ -4766,28 +4930,20 @@ async function planExecutor(context) {
 	const conflicts = [];
 	const unmanaged = [];
 	const resourceOwners = /* @__PURE__ */ new Set();
-	const withoutLabel = await fetchAll(async (pageToken, maxPageSize) => {
-		try {
+	const existingExecutors = await fetchExistingResourcesWithLabels({
+		client,
+		workspaceId,
+		fetchPage: async (pageToken, pageSize) => {
 			const { executors, nextPageToken } = await client.listExecutorExecutors({
 				workspaceId,
 				pageToken,
-				pageSize: maxPageSize
+				pageSize
 			});
 			return [executors, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+		},
+		getName: (resource) => resource.name,
+		getTrn: trn$3
 	});
-	const existingExecutors = {};
-	await Promise.all(withoutLabel.map(async (resource) => {
-		const { metadata } = await client.getMetadata({ trn: trn$3(workspaceId, resource.name) });
-		existingExecutors[resource.name] = {
-			resource,
-			label: metadata?.labels[sdkNameLabelKey],
-			allLabels: metadata?.labels
-		};
-	}));
 	const executors = forRemoval ? {} : await application.executorService?.loadExecutors() ?? {};
 	for (const executor of Object.values(executors)) {
 		const existing = existingExecutors[executor.name];
@@ -4798,17 +4954,16 @@ async function planExecutor(context) {
 		});
 		const desiredExecutor = protoExecutor(application, executor);
 		if (existing) {
-			const owned = isOwnedByApp(existing.allLabels, application.name, application.id);
-			if (!owned) if (!existing.label) unmanaged.push({
-				resourceType: "Executor",
-				resourceName: executor.name
-			});
-			else conflicts.push({
+			if (trackDesiredResourceOwnership({
+				labels: existing.allLabels,
+				ownerLabel: existing.label,
+				appName: application.name,
+				appId: application.id,
 				resourceType: "Executor",
 				resourceName: executor.name,
-				currentOwner: existing.label
-			});
-			if (owned && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && areExecutorsEqual(existing.resource, desiredExecutor)) changeSet.unchanged.push({ name: executor.name });
+				conflicts,
+				unmanaged
+			}) && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && areExecutorsEqual(existing.resource, desiredExecutor)) changeSet.unchanged.push({ name: executor.name });
 			else changeSet.updates.push({
 				name: executor.name,
 				request: {
@@ -4830,9 +4985,13 @@ async function planExecutor(context) {
 	Object.entries(existingExecutors).forEach(([name]) => {
 		const entry = existingExecutors[name];
 		const label = entry?.label;
-		const owned = isOwnedByApp(entry?.allLabels, application.name, application.id);
-		if (label && !owned) resourceOwners.add(label);
-		if (owned) changeSet.deletes.push({
+		if (trackRemainingResourceOwner({
+			labels: entry?.allLabels,
+			ownerLabel: label,
+			appName: application.name,
+			appId: application.id,
+			resourceOwners
+		})) changeSet.deletes.push({
 			name,
 			request: {
 				workspaceId,
@@ -5779,28 +5938,20 @@ async function planStaticWebsite(context) {
 	const conflicts = [];
 	const unmanaged = [];
 	const resourceOwners = /* @__PURE__ */ new Set();
-	const withoutLabel = await fetchAll(async (pageToken, maxPageSize) => {
-		try {
+	const existingWebsites = await fetchExistingResourcesWithLabels({
+		client,
+		workspaceId,
+		fetchPage: async (pageToken, pageSize) => {
 			const { staticwebsites, nextPageToken } = await client.listStaticWebsites({
 				workspaceId,
 				pageToken,
-				pageSize: maxPageSize
+				pageSize
 			});
 			return [staticwebsites, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+		},
+		getName: (resource) => resource.name,
+		getTrn: trn$1
 	});
-	const existingWebsites = {};
-	await Promise.all(withoutLabel.map(async (resource) => {
-		const { metadata } = await client.getMetadata({ trn: trn$1(workspaceId, resource.name) });
-		existingWebsites[resource.name] = {
-			resource,
-			label: metadata?.labels[sdkNameLabelKey],
-			allLabels: metadata?.labels
-		};
-	}));
 	const staticWebsiteServices = forRemoval ? [] : application.staticWebsiteServices;
 	for (const websiteService of staticWebsiteServices) {
 		const config = websiteService;
@@ -5821,17 +5972,16 @@ async function planStaticWebsite(context) {
 			}
 		};
 		if (existing) {
-			const owned = isOwnedByApp(existing.allLabels, application.name, application.id);
-			if (!owned) if (!existing.label) unmanaged.push({
-				resourceType: "StaticWebsite",
-				resourceName: name
-			});
-			else conflicts.push({
+			if (trackDesiredResourceOwnership({
+				labels: existing.allLabels,
+				ownerLabel: existing.label,
+				appName: application.name,
+				appId: application.id,
 				resourceType: "StaticWebsite",
 				resourceName: name,
-				currentOwner: existing.label
-			});
-			if (owned && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && areStaticWebsitesEqual(existing.resource, desired)) changeSet.unchanged.push({ name });
+				conflicts,
+				unmanaged
+			}) && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && areStaticWebsitesEqual(existing.resource, desired)) changeSet.unchanged.push({ name });
 			else changeSet.updates.push({
 				name,
 				request,
@@ -5847,9 +5997,13 @@ async function planStaticWebsite(context) {
 	Object.entries(existingWebsites).forEach(([name]) => {
 		const entry = existingWebsites[name];
 		const label = entry?.label;
-		const owned = isOwnedByApp(entry?.allLabels, application.name, application.id);
-		if (label && !owned) resourceOwners.add(label);
-		if (owned) changeSet.deletes.push({
+		if (trackRemainingResourceOwner({
+			labels: entry?.allLabels,
+			ownerLabel: label,
+			appName: application.name,
+			appId: application.id,
+			resourceOwners
+		})) changeSet.deletes.push({
 			name,
 			request: {
 				workspaceId,
@@ -5939,19 +6093,11 @@ function formatDiffChange(change) {
 		case "type_removed": return `  - [Type] ${change.typeName} (removed)`;
 		case "type_modified": return `  ~ [Type] ${change.typeName}: ${change.reason}`;
 		case "field_added": {
-			const field = change.after;
-			const typeStr = formatFieldType(field);
+			const typeStr = formatFieldType(change.after);
 			return `  + ${change.fieldName}: ${typeStr}`;
 		}
-		case "field_removed": {
-			const field = change.before;
-			return `  - ${change.fieldName}: ${field.type}`;
-		}
-		case "field_modified": {
-			const before = change.before;
-			const after = change.after;
-			return `  ~ ${change.fieldName}: ${formatFieldModification(before, after)}`;
-		}
+		case "field_removed": return `  - ${change.fieldName}: ${change.before.type}`;
+		case "field_modified": return `  ~ ${change.fieldName}: ${formatFieldModification(change.before, change.after)}`;
 		case "index_added": return `  + [Index] ${change.indexName}`;
 		case "index_removed": return `  - [Index] ${change.indexName}`;
 		case "index_modified": return `  ~ [Index] ${change.indexName}: ${change.reason ?? "modified"}`;
@@ -5962,7 +6108,10 @@ function formatDiffChange(change) {
 		case "relationship_removed": return `  - [Relationship${change.relationshipType ? ` (${change.relationshipType})` : ""}] ${change.relationshipName}`;
 		case "relationship_modified": return `  ~ [Relationship${change.relationshipType ? ` (${change.relationshipType})` : ""}] ${change.relationshipName}: ${change.reason ?? "modified"}`;
 		case "permission_modified": return `  ~ [Permission] ${change.reason ?? "modified"}`;
-		default: return `  ? ${change.typeName}.${change.fieldName ?? ""}`;
+		default: {
+			const unknown = change;
+			return `  ? ${unknown.typeName}.${unknown.fieldName ?? ""}`;
+		}
 	}
 }
 /**
@@ -6066,6 +6215,28 @@ function formatDiffSummary(diff) {
 	return parts.length > 0 ? parts.join(", ") : "No changes";
 }
 
+//#endregion
+//#region src/cli/commands/tailordb/migrate/migration-number.ts
+/**
+* Format migration number as 4-digit string.
+* @param num - Migration number
+* @returns 4-digit padded string
+*/
+function formatMigrationNumber(num) {
+	return num.toString().padStart(4, "0");
+}
+
+//#endregion
+//#region src/cli/commands/tailordb/migrate/snapshot-types.ts
+/**
+* Type guard: is the operand a field-reference (object) operand?
+* @param {SnapshotPermissionOperand} operand - Operand to test
+* @returns {boolean} True if operand is a field-ref (not a value operand)
+*/
+function isSnapshotFieldRefOperand(operand) {
+	return typeof operand === "object" && operand !== null && !Array.isArray(operand);
+}
+
 //#endregion
 //#region src/cli/commands/tailordb/migrate/snapshot.ts
 /**
@@ -6121,14 +6292,6 @@ function normalizeSnapshotType(type) {
 	for (const field of Object.values(type.fields)) normalizeSnapshotField(field);
 }
 /**
-* Type guard: is the operand a field-reference (object) operand?
-* @param {SnapshotPermissionOperand} operand - Operand to test
-* @returns {boolean} True if operand is a field-ref (not a value operand)
-*/
-function isSnapshotFieldRefOperand(operand) {
-	return typeof operand === "object" && operand !== null && !Array.isArray(operand);
-}
-/**
 * Validate that a migration number follows the expected format (4-digit number)
 * @param {string} numberStr - Migration number string to validate
 * @returns {boolean} True if number matches expected format
@@ -6137,14 +6300,6 @@ function isValidMigrationNumber(numberStr) {
 	return MIGRATION_NUMBER_PATTERN.test(numberStr);
 }
 /**
-* Format migration number as 4-digit string
-* @param {number} num - Migration number
-* @returns {string} 4-digit padded string (e.g., "0001")
-*/
-function formatMigrationNumber(num) {
-	return num.toString().padStart(4, "0");
-}
-/**
 * Map of migration file types to their file names
 */
 const MIGRATION_FILE_NAMES = {
@@ -7359,6 +7514,15 @@ const PRE_MIGRATION_FIELD_KINDS = new Set([
 	"field_removed"
 ]);
 /**
+* Type guard: is the change a field-level change that needs pre-migration
+* schema adjustment?
+* @param {DiffChange} change - Diff change to test
+* @returns {boolean} True if the change is a field-level change
+*/
+function isPreMigrationFieldChange(change) {
+	return PRE_MIGRATION_FIELD_KINDS.has(change.kind);
+}
+/**
 * Build a map of field changes that require pre-migration schema adjustment.
 * @param {PendingMigration[]} pendingMigrations - Pending migrations to scan
 * @returns {PreMigrationChangesMap} Map of changes keyed by typeName/fieldName
@@ -7366,7 +7530,7 @@ const PRE_MIGRATION_FIELD_KINDS = new Set([
 function buildPreMigrationChangesMap(pendingMigrations) {
 	const map = /* @__PURE__ */ new Map();
 	for (const migration of pendingMigrations) for (const change of migration.diff.changes) {
-		if (!PRE_MIGRATION_FIELD_KINDS.has(change.kind)) continue;
+		if (!isPreMigrationFieldChange(change)) continue;
 		if (!change.fieldName) continue;
 		const perType = map.get(change.typeName) ?? /* @__PURE__ */ new Map();
 		perType.set(change.fieldName, change);
@@ -7385,24 +7549,21 @@ function buildPreMigrationChangesMap(pendingMigrations) {
 * - Modified fields keep the looser side of unique/required/enum.
 *
 * @param {Record<string, MessageInitShape<typeof TailorDBType_FieldConfigSchema>>} fields - Field map to adjust (mutated in place)
-* @param {Map<string, DiffChange>} typeChanges - Changes for this type, keyed by fieldName
+* @param {Map<string, FieldDiffChange>} typeChanges - Changes for this type, keyed by fieldName
 */
 function applyPreMigrationFieldAdjustments(fields, typeChanges) {
 	for (const [fieldName, change] of typeChanges) {
 		if (change.kind === "field_removed") {
-			const before = change.before;
-			if (before) fields[fieldName] = convertFieldConfigToProto(before);
+			if (change.before) fields[fieldName] = convertFieldConfigToProto(change.before);
 			continue;
 		}
 		const field = fields[fieldName];
 		if (!field) continue;
-		const before = change.before;
-		const after = change.after;
-		if (change.kind === "field_added" && after?.required) {
-			field.required = false;
+		if (change.kind === "field_added") {
+			if (change.after?.required) field.required = false;
 			continue;
 		}
-		if (change.kind !== "field_modified") continue;
+		const { before, after } = change;
 		if (!before?.required && after?.required) field.required = false;
 		if (!(before?.unique ?? false) && (after?.unique ?? false)) field.unique = false;
 		if (before?.allowedValues && after?.allowedValues) {
@@ -9403,23 +9564,20 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 	const unmanaged = [];
 	const resourceOwners = /* @__PURE__ */ new Set();
 	const unchangedWorkflowJobNames = /* @__PURE__ */ new Set();
-	const withoutLabel = await fetchAll(async (pageToken, maxPageSize) => {
-		const response = await client.listWorkflows({
-			workspaceId,
-			pageToken,
-			pageSize: maxPageSize
-		});
-		return [response.workflows, response.nextPageToken];
+	const existingWorkflows = await fetchExistingResourcesWithLabels({
+		client,
+		workspaceId,
+		fetchPage: async (pageToken, pageSize) => {
+			const response = await client.listWorkflows({
+				workspaceId,
+				pageToken,
+				pageSize
+			});
+			return [response.workflows, response.nextPageToken];
+		},
+		getName: (resource) => resource.name,
+		getTrn: workflowTrn$1
 	});
-	const existingWorkflows = {};
-	await Promise.all(withoutLabel.map(async (resource) => {
-		const { metadata } = await client.getMetadata({ trn: workflowTrn$1(workspaceId, resource.name) });
-		existingWorkflows[resource.name] = {
-			resource,
-			label: metadata?.labels[sdkNameLabelKey],
-			allLabels: metadata?.labels
-		};
-	}));
 	for (const workflow of Object.values(workflows)) {
 		const existing = existingWorkflows[workflow.name];
 		const metaRequest = await buildMetaRequest({
@@ -9430,17 +9588,16 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 		const usedJobNames = mainJobDeps[workflow.mainJob.name];
 		if (!usedJobNames) throw new Error(`Job "${workflow.mainJob.name}" (mainJob of workflow "${workflow.name}") was not found.\n\nPossible causes:\n  - The job is not exported as a named export\n  - The file containing the job is not included in workflow.files glob pattern\n\nSolution:\n  export const ${workflow.mainJob.name} = createWorkflowJob({ name: "${workflow.mainJob.name}", ... })`);
 		if (existing) {
-			const owned = isOwnedByApp(existing.allLabels, appName, appId);
-			if (!owned) if (!existing.label) unmanaged.push({
-				resourceType: "Workflow",
-				resourceName: workflow.name
-			});
-			else conflicts.push({
+			if (trackDesiredResourceOwnership({
+				labels: existing.allLabels,
+				ownerLabel: existing.label,
+				appName,
+				appId,
 				resourceType: "Workflow",
 				resourceName: workflow.name,
-				currentOwner: existing.label
-			});
-			if (owned && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && canTreatWorkflowAsUnchanged(existing.resource, workflow, usedJobNames, unchangedJobFunctions)) {
+				conflicts,
+				unmanaged
+			}) && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && canTreatWorkflowAsUnchanged(existing.resource, workflow, usedJobNames, unchangedJobFunctions)) {
 				changeSet.unchanged.push({ name: workflow.name });
 				for (const jobName of usedJobNames) unchangedWorkflowJobNames.add(jobName);
 			} else changeSet.updates.push({
@@ -9461,10 +9618,13 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 	}
 	Object.values(existingWorkflows).forEach((existing) => {
 		if (!existing) return;
-		const label = existing.label;
-		const owned = isOwnedByApp(existing.allLabels, appName, appId);
-		if (label && !owned) resourceOwners.add(label);
-		if (owned) changeSet.deletes.push({
+		if (trackRemainingResourceOwner({
+			labels: existing.allLabels,
+			ownerLabel: existing.label,
+			appName,
+			appId,
+			resourceOwners
+		})) changeSet.deletes.push({
 			name: existing.resource.name,
 			workspaceId,
 			workflowId: existing.resource.id,
@@ -9754,7 +9914,7 @@ function summarizePlanResults(results, displayEntries, serviceActions) {
 async function deploy(options) {
 	return withSpan("deploy", async (rootSpan) => {
 		rootSpan.setAttribute("deploy.dry_run", options?.dryRun ?? false);
-		const { config, application, workflowBuildResult, bundledScripts, buildOnly } = await withSpan("build", async () => {
+		const { config, application, workflowBuildResult, httpAdapterBuildResult, bundledScripts, buildOnly } = await withSpan("build", async () => {
 			const dryRun = options?.dryRun ?? false;
 			const buildOnly = options?.buildOnly ?? parseBoolean(process.env.TAILOR_PLATFORM_SDK_BUILD_ONLY) === true;
 			const { config, plugins } = await withSpan("build.loadConfig", async () => {
@@ -9791,6 +9951,7 @@ async function deploy(options) {
 			}));
 			let application;
 			let workflowBuildResult;
+			let httpAdapterBuildResult;
 			let bundledScripts;
 			try {
 				const result = await withSpan("build.loadApplication", () => loadApplication({
@@ -9800,6 +9961,7 @@ async function deploy(options) {
 				}));
 				application = result.application;
 				workflowBuildResult = result.workflowBuildResult;
+				httpAdapterBuildResult = result.httpAdapterBuildResult;
 				bundledScripts = result.bundledScripts;
 			} finally {
 				cacheManager.finalize();
@@ -9809,6 +9971,7 @@ async function deploy(options) {
 				plugins,
 				application,
 				workflowBuildResult,
+				httpAdapterBuildResult,
 				bundledScripts,
 				dryRun,
 				buildOnly
@@ -9850,7 +10013,7 @@ async function deploy(options) {
 				withSpan("plan.idp", () => planIdP(ctx)),
 				withSpan("plan.auth", () => planAuth(ctx)),
 				withSpan("plan.pipeline", () => planPipeline(ctx)),
-				withSpan("plan.application", () => planApplication(ctx)),
+				withSpan("plan.application", () => planApplication(ctx, httpAdapterBuildResult)),
 				withSpan("plan.executor", () => planExecutor(ctx)),
 				withSpan("plan.workflow", () => planWorkflow(client, workspaceId, application.name, application.id, workflowService?.workflows ?? {}, workflowBuildResult?.mainJobDeps ?? {}, unchangedWorkflowJobs)),
 				withSpan("plan.secretManager", () => planSecretManager(ctx))
@@ -13752,8 +13915,7 @@ function extractBreakingChangeFields(diff) {
 	const addedRequiredFields = /* @__PURE__ */ new Map();
 	const enumValueChanges = /* @__PURE__ */ new Map();
 	for (const change of diff.changes) if (change.kind === "field_modified" && change.fieldName) {
-		const before = change.before;
-		const after = change.after;
+		const { before, after } = change;
 		if (before && after && !before.required && after.required) {
 			if (!optionalToRequired.has(change.typeName)) optionalToRequired.set(change.typeName, /* @__PURE__ */ new Set());
 			optionalToRequired.get(change.typeName).add(change.fieldName);
@@ -13772,7 +13934,7 @@ function extractBreakingChangeFields(diff) {
 			}
 		}
 	} else if (change.kind === "field_added" && change.fieldName) {
-		const after = change.after;
+		const { after } = change;
 		if (after && after.required) {
 			if (!addedRequiredFields.has(change.typeName)) addedRequiredFields.set(change.typeName, /* @__PURE__ */ new Map());
 			addedRequiredFields.get(change.typeName).set(change.fieldName, after);
@@ -14127,8 +14289,7 @@ function generateChangeScript(change) {
 		return null;
 	}
 	if (change.kind !== "field_modified") return null;
-	const before = change.before;
-	const after = change.after;
+	const { before, after } = change;
 	if (!before.required && after.required) return `  // Set ${change.fieldName} for ${change.typeName} records where it is null
   await trx
     .updateTable("${change.typeName}")
@@ -14160,8 +14321,8 @@ function generateChangeScript(change) {
     }
   }`;
 	if (before.type === "enum" && after.type === "enum") {
-		const beforeValues = before.allowedValues ?? [];
-		const afterValues = after.allowedValues ?? [];
+		const beforeValues = (before.allowedValues ?? []).map((v) => v.value);
+		const afterValues = (after.allowedValues ?? []).map((v) => v.value);
 		const removedValues = beforeValues.filter((v) => !afterValues.includes(v));
 		if (removedValues.length > 0) {
 			const defaultValue = afterValues[0] ?? "NEW_VALUE";
@@ -14258,7 +14419,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-BsipSxp3.mjs");
+	const { defineApplication } = await import("./application-DM8q9GDI.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -15862,9 +16023,13 @@ async function loadTypeFieldOrder(config, namespace) {
 	return fieldOrder;
 }
 
+//#endregion
+//#region src/cli/query/types.ts
+const queryEngines = ["sql", "gql"];
+
 //#endregion
 //#region src/cli/query/index.ts
-const queryEngineSchema = z.enum(["sql", "gql"]);
+const queryEngineSchema = z.enum(queryEngines);
 const queryBaseOptionsSchema = z.object({
 	workspaceId: z.string().optional(),
 	profile: z.string().optional(),
@@ -16444,5 +16609,5 @@ function isDeno() {
 }
 
 //#endregion
-export { listCommand$5 as $, compareSnapshots as $t, truncate as A, workspaceArgs as An, startCommand as At, logBetaWarning as B, getExecutor as Bt, listCommand$2 as C, configArg as Cn, triggerExecutor as Ct, resumeWorkflow as D, pagedLogArgs as Dn, jobsCommand as Dt, resumeCommand as E, isVerbose as En, getExecutorJob as Et, writeDbTypesFile as F, getWorkflowExecution as Ft, organizationTree as G, parseMigrationLabelNumber as Gt, removeCommand$1 as H, executeScript as Ht, getConfiguredEditorCommand as I, listWorkflowExecutions as It, listOrganizations as J, DIFF_FILE_NAME as Jt, treeCommand as K, bundleMigrationScript as Kt, openInConfiguredEditor as L, functionExecutionStatusToString as Lt, generate as M, getCommand$5 as Mt, generateCommand as N, getWorkflow as Nt, listCommand$3 as O, paginationArgs as On, listExecutorJobs as Ot, generateMigrationScript as P, executionsCommand as Pt, updateFolder as Q, compareLocalTypesWithSnapshot as Qt, show as R, formatKeyValueTable as Rt, listApps as S, commonArgs as Sn, triggerCommand as St, healthCommand as T, deploymentArgs as Tn, listExecutors as Tt, updateCommand$1 as U, waitForExecution$1 as Ut, remove as V, deploy as Vt, updateOrganization as W, MIGRATION_LABEL_KEY as Wt, getOrganization as X, MIGRATE_FILE_NAME as Xt, getCommand$1 as Y, INITIAL_SCHEMA_NUMBER as Yt, updateCommand$2 as Z, SCHEMA_FILE_NAME as Zt, getWorkspace as _, prompt as _n, listFunctionRegistries as _t, updateUser as a, getMigrationFiles as an, createCommand$1 as at, createCommand as b, assertWritable as bn, listWebhookExecutors as bt, listCommand as c, loadDiff as cn, listOAuth2Clients as ct, inviteUser as d, formatMigrationDiff as dn, getMachineUserToken as dt, createSnapshotFromLocalTypes as en, listFolders as et, restoreCommand as f, hasChanges as fn, tokenCommand as ft, getCommand as g, generateUserTypes as gn, listCommand$8 as gt, listWorkspaces as h, trnPrefix as hn, generate$1 as ht, updateCommand as i, getMigrationFilePath as in, deleteFolder as it, truncateCommand as j, startWorkflow as jt, listWorkflows as k, toPageDirection as kn, watchExecutorJob as kt, listUsers as l, reconstructSnapshotFromMigrations as ln, getCommand$3 as lt, listCommand$1 as m, sdkNameLabelKey as mn, listMachineUsers as mt, query as n, getLatestMigrationNumber as nn, getFolder as nt, removeCommand as o, getNextMigrationNumber as on, createFolder as ot, restoreWorkspace as p, getNamespacesWithMigrations as pn, listCommand$7 as pt, listCommand$4 as q, DB_TYPES_FILE_NAME as qt, queryCommand as r, getMigrationDirPath as rn, deleteCommand$1 as rt, removeUser as s, isValidMigrationNumber as sn, listCommand$6 as st, isNativeTypeScriptRuntime as t, formatMigrationNumber as tn, getCommand$2 as tt, inviteCommand as u, formatDiffSummary as un, getOAuth2Client as ut, deleteCommand as v, apiCommand as vn, getCommand$4 as vt, getAppHealth as w, confirmationArgs as wn, listCommand$9 as wt, createWorkspace as x, defineAppCommand as xn, webhookCommand as xt, deleteWorkspace as y, apiCall as yn, getFunctionRegistry as yt, showCommand as z, getCommand$6 as zt };
-//# sourceMappingURL=runtime-DpbAj_8a.mjs.map
+export { listCommand$5 as $, compareSnapshots as $t, truncate as A, workspaceArgs as An, startCommand as At, logBetaWarning as B, getExecutor as Bt, listCommand$2 as C, configArg as Cn, triggerExecutor as Ct, resumeWorkflow as D, pagedLogArgs as Dn, jobsCommand as Dt, resumeCommand as E, isVerbose as En, getExecutorJob as Et, writeDbTypesFile as F, getWorkflowExecution as Ft, organizationTree as G, parseMigrationLabelNumber as Gt, removeCommand$1 as H, executeScript as Ht, getConfiguredEditorCommand as I, listWorkflowExecutions as It, listOrganizations as J, DIFF_FILE_NAME as Jt, treeCommand as K, bundleMigrationScript as Kt, openInConfiguredEditor as L, functionExecutionStatusToString as Lt, generate as M, getCommand$5 as Mt, generateCommand as N, getWorkflow as Nt, listCommand$3 as O, paginationArgs as On, listExecutorJobs as Ot, generateMigrationScript as P, executionsCommand as Pt, updateFolder as Q, compareLocalTypesWithSnapshot as Qt, show as R, formatKeyValueTable as Rt, listApps as S, commonArgs as Sn, triggerCommand as St, healthCommand as T, deploymentArgs as Tn, listExecutors as Tt, updateCommand$1 as U, waitForExecution$1 as Ut, remove as V, deploy as Vt, updateOrganization as W, MIGRATION_LABEL_KEY as Wt, getOrganization as X, MIGRATE_FILE_NAME as Xt, getCommand$1 as Y, INITIAL_SCHEMA_NUMBER as Yt, updateCommand$2 as Z, SCHEMA_FILE_NAME as Zt, getWorkspace as _, prompt as _n, listFunctionRegistries as _t, updateUser as a, getNextMigrationNumber as an, createCommand$1 as at, createCommand as b, assertWritable as bn, listWebhookExecutors as bt, listCommand as c, reconstructSnapshotFromMigrations as cn, listOAuth2Clients as ct, inviteUser as d, formatMigrationDiff as dn, getMachineUserToken as dt, createSnapshotFromLocalTypes as en, listFolders as et, restoreCommand as f, hasChanges as fn, tokenCommand as ft, getCommand as g, generateUserTypes as gn, listCommand$8 as gt, listWorkspaces as h, trnPrefix as hn, generate$1 as ht, updateCommand as i, getMigrationFiles as in, deleteFolder as it, truncateCommand as j, startWorkflow as jt, listWorkflows as k, toPageDirection as kn, watchExecutorJob as kt, listUsers as l, formatMigrationNumber as ln, getCommand$3 as lt, listCommand$1 as m, sdkNameLabelKey as mn, listMachineUsers as mt, query as n, getMigrationDirPath as nn, getFolder as nt, removeCommand as o, isValidMigrationNumber as on, createFolder as ot, restoreWorkspace as p, getNamespacesWithMigrations as pn, listCommand$7 as pt, listCommand$4 as q, DB_TYPES_FILE_NAME as qt, queryCommand as r, getMigrationFilePath as rn, deleteCommand$1 as rt, removeUser as s, loadDiff as sn, listCommand$6 as st, isNativeTypeScriptRuntime as t, getLatestMigrationNumber as tn, getCommand$2 as tt, inviteCommand as u, formatDiffSummary as un, getOAuth2Client as ut, deleteCommand as v, apiCommand as vn, getCommand$4 as vt, getAppHealth as w, confirmationArgs as wn, listCommand$9 as wt, createWorkspace as x, defineAppCommand as xn, webhookCommand as xt, deleteWorkspace as y, apiCall as yn, getFunctionRegistry as yt, showCommand as z, getCommand$6 as zt };
+//# sourceMappingURL=runtime-BZsl7Mh9.mjs.map