@tailor-platform/sdk 1.54.3 → 1.55.0

package/dist/cli/lib.d.mts

@@ -1,9 +1,10 @@
-import { N as TailorDBType, P as TypeSourceInfoEntry, Q as Resolver, _t as IdProvider, ct as IncomingWebhookTrigger, o as Plugin, rt as Executor, s as PluginAttachment, ut as ScheduleTriggerInput, vt as OAuth2ClientInput } from "../tailor-db-field-D0qg8s4U.mjs";
-import { r as AppConfig } from "../workflow.generated-CWi2rivQ.mjs";
-import { n as kyselyTypePlugin } from "../index-CyyoHrPK.mjs";
-import { n as enumConstantsPlugin } from "../index-qQYMbkT-.mjs";
-import { n as fileUtilsPlugin } from "../index-Cf1Lo_XT.mjs";
-import { n as seedPlugin } from "../index-DrYHpTja.mjs";
+import { _ as PluginAttachment, a as TypeSourceInfoEntry, i as TailorDBType } from "../tailordb-BlBGmQK-.mjs";
+import { i as AppConfig } from "../workflow.generated-CQg1_Ami.mjs";
+import { B as IdProvider, E as Executor, H as OAuth2ClientInput, N as ScheduleTriggerInput, j as IncomingWebhookTrigger, n as Plugin, x as Resolver } from "../plugin-BuE5ZOnW.mjs";
+import { n as kyselyTypePlugin } from "../index-S6-FtUpA.mjs";
+import { n as enumConstantsPlugin } from "../index-BE-fpxIo.mjs";
+import { n as fileUtilsPlugin } from "../index-cHqh66cF.mjs";
+import { n as seedPlugin } from "../index-D9xG-a6Y.mjs";
 import { z } from "zod";
 import { JsonObject, Message } from "@bufbuild/protobuf";
 import { GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
@@ -12,6 +13,17 @@ import { OAuth2Client } from "@badgateway/oauth2-client";
 import { Client } from "@connectrpc/connect";
 import { Jsonifiable } from "type-fest";
 
+//#region src/cli/commands/deploy/function-registry-types.d.ts
+/**
+ * In-memory bundled scripts organized by kind.
+ */
+type BundledScripts = {
+  resolvers: Map<string, string>;
+  executors: Map<string, string>;
+  workflowJobs: Map<string, string>;
+  authHooks: Map<string, string>;
+};
+//#endregion
 //#region ../tailor-proto/src/tailor/v1/workspace_resource_pb.d.ts
 /**
  * @generated from message tailor.v1.Organization
@@ -1986,6 +1998,238 @@ declare type GetOrganizationFolderAccessResponse = Message<"tailor.v1.GetOrganiz
  * Use `create(GetOrganizationFolderAccessResponseSchema)` to create a new message.
  */
 declare const GetOrganizationFolderAccessResponseSchema: GenMessage<GetOrganizationFolderAccessResponse>;
+/**
+ * @generated from message tailor.v1.OrganizationIPRestriction
+ */
+declare type OrganizationIPRestriction = Message<"tailor.v1.OrganizationIPRestriction"> & {
+  /**
+   * @generated from field: string organization_id = 1;
+   */
+  organizationId: string;
+  /**
+   * @generated from field: repeated string allowed_ip_addresses = 2;
+   */
+  allowedIpAddresses: string[];
+  /**
+   * @generated from field: google.protobuf.Timestamp created_at = 3;
+   */
+  createdAt?: Timestamp;
+  /**
+   * @generated from field: google.protobuf.Timestamp updated_at = 4;
+   */
+  updatedAt?: Timestamp;
+};
+/**
+ * @generated from message tailor.v1.OrganizationFolderIPRestriction
+ */
+declare type OrganizationFolderIPRestriction = Message<"tailor.v1.OrganizationFolderIPRestriction"> & {
+  /**
+   * @generated from field: string organization_id = 1;
+   */
+  organizationId: string;
+  /**
+   * @generated from field: string folder_id = 2;
+   */
+  folderId: string;
+  /**
+   * @generated from field: repeated string allowed_ip_addresses = 3;
+   */
+  allowedIpAddresses: string[];
+  /**
+   * @generated from field: google.protobuf.Timestamp created_at = 4;
+   */
+  createdAt?: Timestamp;
+  /**
+   * @generated from field: google.protobuf.Timestamp updated_at = 5;
+   */
+  updatedAt?: Timestamp;
+};
+/**
+ * @generated from message tailor.v1.UpsertOrganizationIPRestrictionRequest
+ */
+declare type UpsertOrganizationIPRestrictionRequest = Message<"tailor.v1.UpsertOrganizationIPRestrictionRequest"> & {
+  /**
+   * @generated from field: string organization_id = 1;
+   */
+  organizationId: string;
+  /**
+   * Must contain at least one entry. To remove the restriction entirely, call
+   * DeleteOrganizationIPRestriction — an empty list here is rejected so that
+   * "rule exists" and "non-empty allowlist" stay equivalent and Get's NotFound
+   * contract is unambiguous.
+   *
+   * @generated from field: repeated string allowed_ip_addresses = 2;
+   */
+  allowedIpAddresses: string[];
+};
+/**
+ * Describes the message tailor.v1.UpsertOrganizationIPRestrictionRequest.
+ * Use `create(UpsertOrganizationIPRestrictionRequestSchema)` to create a new message.
+ */
+declare const UpsertOrganizationIPRestrictionRequestSchema: GenMessage<UpsertOrganizationIPRestrictionRequest>;
+/**
+ * @generated from message tailor.v1.UpsertOrganizationIPRestrictionResponse
+ */
+declare type UpsertOrganizationIPRestrictionResponse = Message<"tailor.v1.UpsertOrganizationIPRestrictionResponse"> & {
+  /**
+   * @generated from field: tailor.v1.OrganizationIPRestriction organization_ip_restriction = 1;
+   */
+  organizationIpRestriction?: OrganizationIPRestriction;
+};
+/**
+ * Describes the message tailor.v1.UpsertOrganizationIPRestrictionResponse.
+ * Use `create(UpsertOrganizationIPRestrictionResponseSchema)` to create a new message.
+ */
+declare const UpsertOrganizationIPRestrictionResponseSchema: GenMessage<UpsertOrganizationIPRestrictionResponse>;
+/**
+ * @generated from message tailor.v1.GetOrganizationIPRestrictionRequest
+ */
+declare type GetOrganizationIPRestrictionRequest = Message<"tailor.v1.GetOrganizationIPRestrictionRequest"> & {
+  /**
+   * @generated from field: string organization_id = 1;
+   */
+  organizationId: string;
+};
+/**
+ * Describes the message tailor.v1.GetOrganizationIPRestrictionRequest.
+ * Use `create(GetOrganizationIPRestrictionRequestSchema)` to create a new message.
+ */
+declare const GetOrganizationIPRestrictionRequestSchema: GenMessage<GetOrganizationIPRestrictionRequest>;
+/**
+ * @generated from message tailor.v1.GetOrganizationIPRestrictionResponse
+ */
+declare type GetOrganizationIPRestrictionResponse = Message<"tailor.v1.GetOrganizationIPRestrictionResponse"> & {
+  /**
+   * @generated from field: tailor.v1.OrganizationIPRestriction organization_ip_restriction = 1;
+   */
+  organizationIpRestriction?: OrganizationIPRestriction;
+};
+/**
+ * Describes the message tailor.v1.GetOrganizationIPRestrictionResponse.
+ * Use `create(GetOrganizationIPRestrictionResponseSchema)` to create a new message.
+ */
+declare const GetOrganizationIPRestrictionResponseSchema: GenMessage<GetOrganizationIPRestrictionResponse>;
+/**
+ * @generated from message tailor.v1.DeleteOrganizationIPRestrictionRequest
+ */
+declare type DeleteOrganizationIPRestrictionRequest = Message<"tailor.v1.DeleteOrganizationIPRestrictionRequest"> & {
+  /**
+   * @generated from field: string organization_id = 1;
+   */
+  organizationId: string;
+};
+/**
+ * Describes the message tailor.v1.DeleteOrganizationIPRestrictionRequest.
+ * Use `create(DeleteOrganizationIPRestrictionRequestSchema)` to create a new message.
+ */
+declare const DeleteOrganizationIPRestrictionRequestSchema: GenMessage<DeleteOrganizationIPRestrictionRequest>;
+/**
+ * @generated from message tailor.v1.DeleteOrganizationIPRestrictionResponse
+ */
+declare type DeleteOrganizationIPRestrictionResponse = Message<"tailor.v1.DeleteOrganizationIPRestrictionResponse"> & {};
+/**
+ * Describes the message tailor.v1.DeleteOrganizationIPRestrictionResponse.
+ * Use `create(DeleteOrganizationIPRestrictionResponseSchema)` to create a new message.
+ */
+declare const DeleteOrganizationIPRestrictionResponseSchema: GenMessage<DeleteOrganizationIPRestrictionResponse>;
+/**
+ * @generated from message tailor.v1.UpsertOrganizationFolderIPRestrictionRequest
+ */
+declare type UpsertOrganizationFolderIPRestrictionRequest = Message<"tailor.v1.UpsertOrganizationFolderIPRestrictionRequest"> & {
+  /**
+   * @generated from field: string organization_id = 1;
+   */
+  organizationId: string;
+  /**
+   * @generated from field: string folder_id = 2;
+   */
+  folderId: string;
+  /**
+   * Must contain at least one entry; see UpsertOrganizationIPRestrictionRequest
+   * for rationale. Use DeleteOrganizationFolderIPRestriction to clear the rule.
+   *
+   * @generated from field: repeated string allowed_ip_addresses = 3;
+   */
+  allowedIpAddresses: string[];
+};
+/**
+ * Describes the message tailor.v1.UpsertOrganizationFolderIPRestrictionRequest.
+ * Use `create(UpsertOrganizationFolderIPRestrictionRequestSchema)` to create a new message.
+ */
+declare const UpsertOrganizationFolderIPRestrictionRequestSchema: GenMessage<UpsertOrganizationFolderIPRestrictionRequest>;
+/**
+ * @generated from message tailor.v1.UpsertOrganizationFolderIPRestrictionResponse
+ */
+declare type UpsertOrganizationFolderIPRestrictionResponse = Message<"tailor.v1.UpsertOrganizationFolderIPRestrictionResponse"> & {
+  /**
+   * @generated from field: tailor.v1.OrganizationFolderIPRestriction organization_folder_ip_restriction = 1;
+   */
+  organizationFolderIpRestriction?: OrganizationFolderIPRestriction;
+};
+/**
+ * Describes the message tailor.v1.UpsertOrganizationFolderIPRestrictionResponse.
+ * Use `create(UpsertOrganizationFolderIPRestrictionResponseSchema)` to create a new message.
+ */
+declare const UpsertOrganizationFolderIPRestrictionResponseSchema: GenMessage<UpsertOrganizationFolderIPRestrictionResponse>;
+/**
+ * @generated from message tailor.v1.GetOrganizationFolderIPRestrictionRequest
+ */
+declare type GetOrganizationFolderIPRestrictionRequest = Message<"tailor.v1.GetOrganizationFolderIPRestrictionRequest"> & {
+  /**
+   * @generated from field: string organization_id = 1;
+   */
+  organizationId: string;
+  /**
+   * @generated from field: string folder_id = 2;
+   */
+  folderId: string;
+};
+/**
+ * Describes the message tailor.v1.GetOrganizationFolderIPRestrictionRequest.
+ * Use `create(GetOrganizationFolderIPRestrictionRequestSchema)` to create a new message.
+ */
+declare const GetOrganizationFolderIPRestrictionRequestSchema: GenMessage<GetOrganizationFolderIPRestrictionRequest>;
+/**
+ * @generated from message tailor.v1.GetOrganizationFolderIPRestrictionResponse
+ */
+declare type GetOrganizationFolderIPRestrictionResponse = Message<"tailor.v1.GetOrganizationFolderIPRestrictionResponse"> & {
+  /**
+   * @generated from field: tailor.v1.OrganizationFolderIPRestriction organization_folder_ip_restriction = 1;
+   */
+  organizationFolderIpRestriction?: OrganizationFolderIPRestriction;
+};
+/**
+ * Describes the message tailor.v1.GetOrganizationFolderIPRestrictionResponse.
+ * Use `create(GetOrganizationFolderIPRestrictionResponseSchema)` to create a new message.
+ */
+declare const GetOrganizationFolderIPRestrictionResponseSchema: GenMessage<GetOrganizationFolderIPRestrictionResponse>;
+/**
+ * @generated from message tailor.v1.DeleteOrganizationFolderIPRestrictionRequest
+ */
+declare type DeleteOrganizationFolderIPRestrictionRequest = Message<"tailor.v1.DeleteOrganizationFolderIPRestrictionRequest"> & {
+  /**
+   * @generated from field: string organization_id = 1;
+   */
+  organizationId: string;
+  /**
+   * @generated from field: string folder_id = 2;
+   */
+  folderId: string;
+};
+/**
+ * Describes the message tailor.v1.DeleteOrganizationFolderIPRestrictionRequest.
+ * Use `create(DeleteOrganizationFolderIPRestrictionRequestSchema)` to create a new message.
+ */
+declare const DeleteOrganizationFolderIPRestrictionRequestSchema: GenMessage<DeleteOrganizationFolderIPRestrictionRequest>;
+/**
+ * @generated from message tailor.v1.DeleteOrganizationFolderIPRestrictionResponse
+ */
+declare type DeleteOrganizationFolderIPRestrictionResponse = Message<"tailor.v1.DeleteOrganizationFolderIPRestrictionResponse"> & {};
+/**
+ * Describes the message tailor.v1.DeleteOrganizationFolderIPRestrictionResponse.
+ * Use `create(DeleteOrganizationFolderIPRestrictionResponseSchema)` to create a new message.
+ */
+declare const DeleteOrganizationFolderIPRestrictionResponseSchema: GenMessage<DeleteOrganizationFolderIPRestrictionResponse>;
 /**
  * @generated from message tailor.v1.CreateOrganizationTeamRequest
  */
@@ -2374,11 +2618,11 @@ declare type GetPlatformAccountPlanResponse = Message<"tailor.v1.GetPlatformAcco
  */
 declare const GetPlatformAccountPlanResponseSchema: GenMessage<GetPlatformAccountPlanResponse>;
 //#endregion
-//#region ../tailor-proto/src/tailor/v1/gateway_filter_resource_pb.d.ts
+//#region ../tailor-proto/src/tailor/v1/http_adapter_resource_pb.d.ts
 /**
- * @generated from message tailor.v1.GatewayFilter
+ * @generated from message tailor.v1.HttpAdapter
  */
-declare type GatewayFilter = Message<"tailor.v1.GatewayFilter"> & {
+declare type HttpAdapter = Message<"tailor.v1.HttpAdapter"> & {
   /**
    * @generated from field: string name = 1;
    */
@@ -2392,15 +2636,15 @@ declare type GatewayFilter = Message<"tailor.v1.GatewayFilter"> & {
    */
   methods: string[];
   /**
-   * @generated from field: string input_filter_script = 4;
+   * @generated from field: string input_script = 4;
    */
-  inputFilterScript: string;
+  inputScript: string;
   /**
    * optional
    *
-   * @generated from field: string output_filter_script = 5;
+   * @generated from field: string output_script = 5;
    */
-  outputFilterScript: string;
+  outputScript: string;
   /**
    * @generated from field: bool enabled = 6;
    */
@@ -2483,9 +2727,9 @@ declare type Application = Message<"tailor.v1.Application"> & {
    */
   authIdpConfigName: string;
   /**
-   * @generated from field: repeated tailor.v1.GatewayFilter filters = 15;
+   * @generated from field: repeated tailor.v1.HttpAdapter http_adapters = 15;
    */
-  filters: GatewayFilter[];
+  httpAdapters: HttpAdapter[];
 };
 /**
  * @generated from message tailor.v1.ApplicationSchemaUpdateAttempt
@@ -2620,9 +2864,9 @@ declare type CreateApplicationRequest = Message<"tailor.v1.CreateApplicationRequ
    */
   disabled: boolean;
   /**
-   * @generated from field: repeated tailor.v1.GatewayFilter filters = 10;
+   * @generated from field: repeated tailor.v1.HttpAdapter http_adapters = 10;
    */
-  filters: GatewayFilter[];
+  httpAdapters: HttpAdapter[];
 };
 /**
  * Describes the message tailor.v1.CreateApplicationRequest.
@@ -2688,9 +2932,9 @@ declare type UpdateApplicationRequest = Message<"tailor.v1.UpdateApplicationRequ
    */
   disabled: boolean;
   /**
-   * @generated from field: repeated tailor.v1.GatewayFilter filters = 10;
+   * @generated from field: repeated tailor.v1.HttpAdapter http_adapters = 10;
    */
-  filters: GatewayFilter[];
+  httpAdapters: HttpAdapter[];
   /**
    * @generated from field: google.protobuf.FieldMask update_mask = 100;
    */
@@ -2965,6 +3209,14 @@ declare type TailorDBType_TypeConfig = Message<"tailor.v1.TailorDBType.TypeConfi
   files: {
     [key: string]: TailorDBType_FileConfig;
   };
+  /**
+   * @generated from field: optional tailor.v1.TailorDBType.TypeHook type_hook = 12;
+   */
+  typeHook?: TailorDBType_TypeHook;
+  /**
+   * @generated from field: optional tailor.v1.TailorDBType.TypeValidate type_validate = 13;
+   */
+  typeValidate?: TailorDBType_TypeValidate;
 };
 /**
  * @generated from message tailor.v1.TailorDBType.TypeSetting
@@ -3206,6 +3458,32 @@ declare type TailorDBType_FieldHook = Message<"tailor.v1.TailorDBType.FieldHook"
    */
   update?: Script;
 };
+/**
+ * @generated from message tailor.v1.TailorDBType.TypeHook
+ */
+declare type TailorDBType_TypeHook = Message<"tailor.v1.TailorDBType.TypeHook"> & {
+  /**
+   * @generated from field: tailor.v1.Script create = 1;
+   */
+  create?: Script;
+  /**
+   * @generated from field: tailor.v1.Script update = 2;
+   */
+  update?: Script;
+};
+/**
+ * @generated from message tailor.v1.TailorDBType.TypeValidate
+ */
+declare type TailorDBType_TypeValidate = Message<"tailor.v1.TailorDBType.TypeValidate"> & {
+  /**
+   * @generated from field: tailor.v1.Script create = 1;
+   */
+  create?: Script;
+  /**
+   * @generated from field: tailor.v1.Script update = 2;
+   */
+  update?: Script;
+};
 /**
  * @generated from message tailor.v1.TailorDBType.Serial
  */
@@ -11540,6 +11818,68 @@ declare type StaticWebsite = Message<"tailor.v1.StaticWebsite"> & {
    */
   url: string;
 };
+/**
+ * @generated from message tailor.v1.CustomDomain
+ */
+declare type CustomDomain = Message<"tailor.v1.CustomDomain"> & {
+  /**
+   * @generated from field: string domain = 1;
+   */
+  domain: string;
+  /**
+   * @generated from field: tailor.v1.CustomDomainStatus status = 2;
+   */
+  status: CustomDomainStatus;
+  /**
+   * @generated from field: string traffic_cname_target = 3;
+   */
+  trafficCnameTarget: string;
+  /**
+   * @generated from field: string certificate_cname_target = 4;
+   */
+  certificateCnameTarget: string;
+  /**
+   * @generated from field: string error_message = 5;
+   */
+  errorMessage: string;
+  /**
+   * @generated from field: google.protobuf.Timestamp created_at = 6;
+   */
+  createdAt?: Timestamp;
+  /**
+   * @generated from field: google.protobuf.Timestamp updated_at = 7;
+   */
+  updatedAt?: Timestamp;
+};
+/**
+ * @generated from enum tailor.v1.CustomDomainStatus
+ */
+declare enum CustomDomainStatus {
+  /**
+   * @generated from enum value: CUSTOM_DOMAIN_STATUS_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+  /**
+   * @generated from enum value: CUSTOM_DOMAIN_STATUS_PENDING = 1;
+   */
+  PENDING = 1,
+  /**
+   * @generated from enum value: CUSTOM_DOMAIN_STATUS_VERIFYING = 2;
+   */
+  VERIFYING = 2,
+  /**
+   * @generated from enum value: CUSTOM_DOMAIN_STATUS_CERT_ISSUED = 3;
+   */
+  CERT_ISSUED = 3,
+  /**
+   * @generated from enum value: CUSTOM_DOMAIN_STATUS_ACTIVE = 4;
+   */
+  ACTIVE = 4,
+  /**
+   * @generated from enum value: CUSTOM_DOMAIN_STATUS_FAILED = 5;
+   */
+  FAILED = 5
+}
 //#endregion
 //#region ../tailor-proto/src/tailor/v1/staticwebsite_pb.d.ts
 /**
@@ -11836,50 +12176,177 @@ declare type PublishDeploymentResponse = Message<"tailor.v1.PublishDeploymentRes
  * Use `create(PublishDeploymentResponseSchema)` to create a new message.
  */
 declare const PublishDeploymentResponseSchema: GenMessage<PublishDeploymentResponse>;
-//#endregion
-//#region ../tailor-proto/src/tailor/v1/workflow_resource_pb.d.ts
 /**
- * @generated from message tailor.v1.WorkflowJobFunction
+ * @generated from message tailor.v1.AddCustomDomainRequest
  */
-declare type WorkflowJobFunction = Message<"tailor.v1.WorkflowJobFunction"> & {
-  /**
-   * @generated from field: string id = 1;
-   */
-  id: string;
-  /**
-   * @generated from field: string name = 2;
-   */
-  name: string;
-  /**
-   * @generated from field: string script = 3;
-   */
-  script: string;
+declare type AddCustomDomainRequest = Message<"tailor.v1.AddCustomDomainRequest"> & {
   /**
-   * @generated from field: int64 version = 4;
+   * @generated from field: string workspace_id = 1;
    */
-  version: bigint;
+  workspaceId: string;
   /**
-   * @generated from field: google.protobuf.Timestamp created_at = 5;
+   * @generated from field: string static_website_name = 2;
    */
-  createdAt?: Timestamp;
+  staticWebsiteName: string;
   /**
-   * Reference to a function in the Function Registry
-   *
-   * @generated from field: optional string script_ref = 6;
+   * @generated from field: string domain = 3;
    */
-  scriptRef?: string;
+  domain: string;
 };
 /**
- * @generated from message tailor.v1.ConcurrencyPolicy
+ * Describes the message tailor.v1.AddCustomDomainRequest.
+ * Use `create(AddCustomDomainRequestSchema)` to create a new message.
  */
-declare type ConcurrencyPolicy = Message<"tailor.v1.ConcurrencyPolicy"> & {
+declare const AddCustomDomainRequestSchema: GenMessage<AddCustomDomainRequest>;
+/**
+ * @generated from message tailor.v1.AddCustomDomainResponse
+ */
+declare type AddCustomDomainResponse = Message<"tailor.v1.AddCustomDomainResponse"> & {
   /**
-   * @generated from field: int32 max_concurrent_executions = 1;
+   * @generated from field: tailor.v1.CustomDomain custom_domain = 1;
    */
-  maxConcurrentExecutions: number;
+  customDomain?: CustomDomain;
 };
 /**
- * @generated from message tailor.v1.RetryPolicy
+ * Describes the message tailor.v1.AddCustomDomainResponse.
+ * Use `create(AddCustomDomainResponseSchema)` to create a new message.
+ */
+declare const AddCustomDomainResponseSchema: GenMessage<AddCustomDomainResponse>;
+/**
+ * @generated from message tailor.v1.GetCustomDomainRequest
+ */
+declare type GetCustomDomainRequest = Message<"tailor.v1.GetCustomDomainRequest"> & {
+  /**
+   * @generated from field: string workspace_id = 1;
+   */
+  workspaceId: string;
+  /**
+   * @generated from field: string domain = 2;
+   */
+  domain: string;
+};
+/**
+ * Describes the message tailor.v1.GetCustomDomainRequest.
+ * Use `create(GetCustomDomainRequestSchema)` to create a new message.
+ */
+declare const GetCustomDomainRequestSchema: GenMessage<GetCustomDomainRequest>;
+/**
+ * @generated from message tailor.v1.GetCustomDomainResponse
+ */
+declare type GetCustomDomainResponse = Message<"tailor.v1.GetCustomDomainResponse"> & {
+  /**
+   * @generated from field: tailor.v1.CustomDomain custom_domain = 1;
+   */
+  customDomain?: CustomDomain;
+};
+/**
+ * Describes the message tailor.v1.GetCustomDomainResponse.
+ * Use `create(GetCustomDomainResponseSchema)` to create a new message.
+ */
+declare const GetCustomDomainResponseSchema: GenMessage<GetCustomDomainResponse>;
+/**
+ * @generated from message tailor.v1.ListCustomDomainsRequest
+ */
+declare type ListCustomDomainsRequest = Message<"tailor.v1.ListCustomDomainsRequest"> & {
+  /**
+   * @generated from field: string workspace_id = 1;
+   */
+  workspaceId: string;
+  /**
+   * @generated from field: string static_website_name = 2;
+   */
+  staticWebsiteName: string;
+};
+/**
+ * Describes the message tailor.v1.ListCustomDomainsRequest.
+ * Use `create(ListCustomDomainsRequestSchema)` to create a new message.
+ */
+declare const ListCustomDomainsRequestSchema: GenMessage<ListCustomDomainsRequest>;
+/**
+ * @generated from message tailor.v1.ListCustomDomainsResponse
+ */
+declare type ListCustomDomainsResponse = Message<"tailor.v1.ListCustomDomainsResponse"> & {
+  /**
+   * @generated from field: repeated tailor.v1.CustomDomain custom_domains = 1;
+   */
+  customDomains: CustomDomain[];
+};
+/**
+ * Describes the message tailor.v1.ListCustomDomainsResponse.
+ * Use `create(ListCustomDomainsResponseSchema)` to create a new message.
+ */
+declare const ListCustomDomainsResponseSchema: GenMessage<ListCustomDomainsResponse>;
+/**
+ * @generated from message tailor.v1.RemoveCustomDomainRequest
+ */
+declare type RemoveCustomDomainRequest = Message<"tailor.v1.RemoveCustomDomainRequest"> & {
+  /**
+   * @generated from field: string workspace_id = 1;
+   */
+  workspaceId: string;
+  /**
+   * @generated from field: string domain = 2;
+   */
+  domain: string;
+};
+/**
+ * Describes the message tailor.v1.RemoveCustomDomainRequest.
+ * Use `create(RemoveCustomDomainRequestSchema)` to create a new message.
+ */
+declare const RemoveCustomDomainRequestSchema: GenMessage<RemoveCustomDomainRequest>;
+/**
+ * @generated from message tailor.v1.RemoveCustomDomainResponse
+ */
+declare type RemoveCustomDomainResponse = Message<"tailor.v1.RemoveCustomDomainResponse"> & {};
+/**
+ * Describes the message tailor.v1.RemoveCustomDomainResponse.
+ * Use `create(RemoveCustomDomainResponseSchema)` to create a new message.
+ */
+declare const RemoveCustomDomainResponseSchema: GenMessage<RemoveCustomDomainResponse>;
+//#endregion
+//#region ../tailor-proto/src/tailor/v1/workflow_resource_pb.d.ts
+/**
+ * @generated from message tailor.v1.WorkflowJobFunction
+ */
+declare type WorkflowJobFunction = Message<"tailor.v1.WorkflowJobFunction"> & {
+  /**
+   * @generated from field: string id = 1;
+   */
+  id: string;
+  /**
+   * @generated from field: string name = 2;
+   */
+  name: string;
+  /**
+   * @generated from field: string script = 3;
+   */
+  script: string;
+  /**
+   * @generated from field: int64 version = 4;
+   */
+  version: bigint;
+  /**
+   * @generated from field: google.protobuf.Timestamp created_at = 5;
+   */
+  createdAt?: Timestamp;
+  /**
+   * Reference to a function in the Function Registry
+   *
+   * @generated from field: optional string script_ref = 6;
+   */
+  scriptRef?: string;
+};
+/**
+ * @generated from message tailor.v1.ConcurrencyPolicy
+ */
+declare type ConcurrencyPolicy = Message<"tailor.v1.ConcurrencyPolicy"> & {
+  /**
+   * @generated from field: int32 max_concurrent_executions = 1;
+   */
+  maxConcurrentExecutions: number;
+};
+/**
+ * @generated from message tailor.v1.RetryPolicy
  */
 declare type RetryPolicy = Message<"tailor.v1.RetryPolicy"> & {
   /**
@@ -11940,6 +12407,39 @@ declare type Workflow = Message<"tailor.v1.Workflow"> & {
    */
   concurrencyPolicy?: ConcurrencyPolicy;
 };
+/**
+ * WorkflowJobFunctionExecutionPolicy defines a runtime concurrency limit shared by
+ * any job function invocation that specifies a matching execution_policy_key in
+ * triggerJobFunction(). The same key can be referenced by multiple job functions
+ * across different workflows; they all share the same concurrency pool within the workspace.
+ *
+ * @generated from message tailor.v1.WorkflowJobFunctionExecutionPolicy
+ */
+declare type WorkflowJobFunctionExecutionPolicy = Message<"tailor.v1.WorkflowJobFunctionExecutionPolicy"> & {
+  /**
+   * @generated from field: string id = 1;
+   */
+  id: string;
+  /**
+   * @generated from field: string execution_policy_key = 2;
+   */
+  executionPolicyKey: string;
+  /**
+   * @generated from field: google.protobuf.Timestamp created_at = 3;
+   */
+  createdAt?: Timestamp;
+  /**
+   * @generated from field: google.protobuf.Timestamp updated_at = 4;
+   */
+  updatedAt?: Timestamp;
+  /**
+   * When unset, the policy registers the key as valid but applies no user-defined
+   * concurrency limit (platform hard limits still apply).
+   *
+   * @generated from field: optional tailor.v1.ConcurrencyPolicy concurrency_policy = 5;
+   */
+  concurrencyPolicy?: ConcurrencyPolicy;
+};
 /**
  * @generated from message tailor.v1.WorkflowJobExecution
  */
@@ -12671,6 +13171,217 @@ declare type TestResumeWorkflowResponse = Message<"tailor.v1.TestResumeWorkflowR
  * Use `create(TestResumeWorkflowResponseSchema)` to create a new message.
  */
 declare const TestResumeWorkflowResponseSchema: GenMessage<TestResumeWorkflowResponse>;
+/**
+ * @generated from message tailor.v1.CreateWorkflowJobFunctionExecutionPolicyRequest
+ */
+declare type CreateWorkflowJobFunctionExecutionPolicyRequest = Message<"tailor.v1.CreateWorkflowJobFunctionExecutionPolicyRequest"> & {
+  /**
+   * @generated from field: string workspace_id = 1;
+   */
+  workspaceId: string;
+  /**
+   * @generated from field: string execution_policy_key = 2;
+   */
+  executionPolicyKey: string;
+  /**
+   * @generated from field: optional tailor.v1.ConcurrencyPolicy concurrency_policy = 3;
+   */
+  concurrencyPolicy?: ConcurrencyPolicy;
+};
+/**
+ * Describes the message tailor.v1.CreateWorkflowJobFunctionExecutionPolicyRequest.
+ * Use `create(CreateWorkflowJobFunctionExecutionPolicyRequestSchema)` to create a new message.
+ */
+declare const CreateWorkflowJobFunctionExecutionPolicyRequestSchema: GenMessage<CreateWorkflowJobFunctionExecutionPolicyRequest>;
+/**
+ * @generated from message tailor.v1.CreateWorkflowJobFunctionExecutionPolicyResponse
+ */
+declare type CreateWorkflowJobFunctionExecutionPolicyResponse = Message<"tailor.v1.CreateWorkflowJobFunctionExecutionPolicyResponse"> & {
+  /**
+   * @generated from field: tailor.v1.WorkflowJobFunctionExecutionPolicy policy = 1;
+   */
+  policy?: WorkflowJobFunctionExecutionPolicy;
+};
+/**
+ * Describes the message tailor.v1.CreateWorkflowJobFunctionExecutionPolicyResponse.
+ * Use `create(CreateWorkflowJobFunctionExecutionPolicyResponseSchema)` to create a new message.
+ */
+declare const CreateWorkflowJobFunctionExecutionPolicyResponseSchema: GenMessage<CreateWorkflowJobFunctionExecutionPolicyResponse>;
+/**
+ * @generated from message tailor.v1.UpdateWorkflowJobFunctionExecutionPolicyRequest
+ */
+declare type UpdateWorkflowJobFunctionExecutionPolicyRequest = Message<"tailor.v1.UpdateWorkflowJobFunctionExecutionPolicyRequest"> & {
+  /**
+   * @generated from field: string workspace_id = 1;
+   */
+  workspaceId: string;
+  /**
+   * @generated from field: string execution_policy_key = 2;
+   */
+  executionPolicyKey: string;
+  /**
+   * @generated from field: optional tailor.v1.ConcurrencyPolicy concurrency_policy = 3;
+   */
+  concurrencyPolicy?: ConcurrencyPolicy;
+};
+/**
+ * Describes the message tailor.v1.UpdateWorkflowJobFunctionExecutionPolicyRequest.
+ * Use `create(UpdateWorkflowJobFunctionExecutionPolicyRequestSchema)` to create a new message.
+ */
+declare const UpdateWorkflowJobFunctionExecutionPolicyRequestSchema: GenMessage<UpdateWorkflowJobFunctionExecutionPolicyRequest>;
+/**
+ * @generated from message tailor.v1.UpdateWorkflowJobFunctionExecutionPolicyResponse
+ */
+declare type UpdateWorkflowJobFunctionExecutionPolicyResponse = Message<"tailor.v1.UpdateWorkflowJobFunctionExecutionPolicyResponse"> & {
+  /**
+   * @generated from field: tailor.v1.WorkflowJobFunctionExecutionPolicy policy = 1;
+   */
+  policy?: WorkflowJobFunctionExecutionPolicy;
+};
+/**
+ * Describes the message tailor.v1.UpdateWorkflowJobFunctionExecutionPolicyResponse.
+ * Use `create(UpdateWorkflowJobFunctionExecutionPolicyResponseSchema)` to create a new message.
+ */
+declare const UpdateWorkflowJobFunctionExecutionPolicyResponseSchema: GenMessage<UpdateWorkflowJobFunctionExecutionPolicyResponse>;
+/**
+ * @generated from message tailor.v1.DeleteWorkflowJobFunctionExecutionPolicyRequest
+ */
+declare type DeleteWorkflowJobFunctionExecutionPolicyRequest = Message<"tailor.v1.DeleteWorkflowJobFunctionExecutionPolicyRequest"> & {
+  /**
+   * @generated from field: string workspace_id = 1;
+   */
+  workspaceId: string;
+  /**
+   * @generated from field: string id = 2;
+   */
+  id: string;
+};
+/**
+ * Describes the message tailor.v1.DeleteWorkflowJobFunctionExecutionPolicyRequest.
+ * Use `create(DeleteWorkflowJobFunctionExecutionPolicyRequestSchema)` to create a new message.
+ */
+declare const DeleteWorkflowJobFunctionExecutionPolicyRequestSchema: GenMessage<DeleteWorkflowJobFunctionExecutionPolicyRequest>;
+/**
+ * @generated from message tailor.v1.DeleteWorkflowJobFunctionExecutionPolicyResponse
+ */
+declare type DeleteWorkflowJobFunctionExecutionPolicyResponse = Message<"tailor.v1.DeleteWorkflowJobFunctionExecutionPolicyResponse"> & {};
+/**
+ * Describes the message tailor.v1.DeleteWorkflowJobFunctionExecutionPolicyResponse.
+ * Use `create(DeleteWorkflowJobFunctionExecutionPolicyResponseSchema)` to create a new message.
+ */
+declare const DeleteWorkflowJobFunctionExecutionPolicyResponseSchema: GenMessage<DeleteWorkflowJobFunctionExecutionPolicyResponse>;
+/**
+ * @generated from message tailor.v1.GetWorkflowJobFunctionExecutionPolicyRequest
+ */
+declare type GetWorkflowJobFunctionExecutionPolicyRequest = Message<"tailor.v1.GetWorkflowJobFunctionExecutionPolicyRequest"> & {
+  /**
+   * @generated from field: string workspace_id = 1;
+   */
+  workspaceId: string;
+  /**
+   * @generated from field: string id = 2;
+   */
+  id: string;
+};
+/**
+ * Describes the message tailor.v1.GetWorkflowJobFunctionExecutionPolicyRequest.
+ * Use `create(GetWorkflowJobFunctionExecutionPolicyRequestSchema)` to create a new message.
+ */
+declare const GetWorkflowJobFunctionExecutionPolicyRequestSchema: GenMessage<GetWorkflowJobFunctionExecutionPolicyRequest>;
+/**
+ * @generated from message tailor.v1.GetWorkflowJobFunctionExecutionPolicyResponse
+ */
+declare type GetWorkflowJobFunctionExecutionPolicyResponse = Message<"tailor.v1.GetWorkflowJobFunctionExecutionPolicyResponse"> & {
+  /**
+   * @generated from field: tailor.v1.WorkflowJobFunctionExecutionPolicy policy = 1;
+   */
+  policy?: WorkflowJobFunctionExecutionPolicy;
+};
+/**
+ * Describes the message tailor.v1.GetWorkflowJobFunctionExecutionPolicyResponse.
+ * Use `create(GetWorkflowJobFunctionExecutionPolicyResponseSchema)` to create a new message.
+ */
+declare const GetWorkflowJobFunctionExecutionPolicyResponseSchema: GenMessage<GetWorkflowJobFunctionExecutionPolicyResponse>;
+/**
+ * @generated from message tailor.v1.GetWorkflowJobFunctionExecutionPolicyByKeyRequest
+ */
+declare type GetWorkflowJobFunctionExecutionPolicyByKeyRequest = Message<"tailor.v1.GetWorkflowJobFunctionExecutionPolicyByKeyRequest"> & {
+  /**
+   * @generated from field: string workspace_id = 1;
+   */
+  workspaceId: string;
+  /**
+   * @generated from field: string execution_policy_key = 2;
+   */
+  executionPolicyKey: string;
+};
+/**
+ * Describes the message tailor.v1.GetWorkflowJobFunctionExecutionPolicyByKeyRequest.
+ * Use `create(GetWorkflowJobFunctionExecutionPolicyByKeyRequestSchema)` to create a new message.
+ */
+declare const GetWorkflowJobFunctionExecutionPolicyByKeyRequestSchema: GenMessage<GetWorkflowJobFunctionExecutionPolicyByKeyRequest>;
+/**
+ * @generated from message tailor.v1.GetWorkflowJobFunctionExecutionPolicyByKeyResponse
+ */
+declare type GetWorkflowJobFunctionExecutionPolicyByKeyResponse = Message<"tailor.v1.GetWorkflowJobFunctionExecutionPolicyByKeyResponse"> & {
+  /**
+   * @generated from field: tailor.v1.WorkflowJobFunctionExecutionPolicy policy = 1;
+   */
+  policy?: WorkflowJobFunctionExecutionPolicy;
+};
+/**
+ * Describes the message tailor.v1.GetWorkflowJobFunctionExecutionPolicyByKeyResponse.
+ * Use `create(GetWorkflowJobFunctionExecutionPolicyByKeyResponseSchema)` to create a new message.
+ */
+declare const GetWorkflowJobFunctionExecutionPolicyByKeyResponseSchema: GenMessage<GetWorkflowJobFunctionExecutionPolicyByKeyResponse>;
+/**
+ * @generated from message tailor.v1.ListWorkflowJobFunctionExecutionPoliciesRequest
+ */
+declare type ListWorkflowJobFunctionExecutionPoliciesRequest = Message<"tailor.v1.ListWorkflowJobFunctionExecutionPoliciesRequest"> & {
+  /**
+   * @generated from field: string workspace_id = 1;
+   */
+  workspaceId: string;
+  /**
+   * @generated from field: string page_token = 2;
+   */
+  pageToken: string;
+  /**
+   * @generated from field: uint32 page_size = 3;
+   */
+  pageSize: number;
+  /**
+   * @generated from field: tailor.v1.PageDirection page_direction = 4;
+   */
+  pageDirection: PageDirection;
+};
+/**
+ * Describes the message tailor.v1.ListWorkflowJobFunctionExecutionPoliciesRequest.
+ * Use `create(ListWorkflowJobFunctionExecutionPoliciesRequestSchema)` to create a new message.
+ */
+declare const ListWorkflowJobFunctionExecutionPoliciesRequestSchema: GenMessage<ListWorkflowJobFunctionExecutionPoliciesRequest>;
+/**
+ * @generated from message tailor.v1.ListWorkflowJobFunctionExecutionPoliciesResponse
+ */
+declare type ListWorkflowJobFunctionExecutionPoliciesResponse = Message<"tailor.v1.ListWorkflowJobFunctionExecutionPoliciesResponse"> & {
+  /**
+   * @generated from field: repeated tailor.v1.WorkflowJobFunctionExecutionPolicy policies = 1;
+   */
+  policies: WorkflowJobFunctionExecutionPolicy[];
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+  /**
+   * @generated from field: int64 total_count = 3;
+   */
+  totalCount: bigint;
+};
+/**
+ * Describes the message tailor.v1.ListWorkflowJobFunctionExecutionPoliciesResponse.
+ * Use `create(ListWorkflowJobFunctionExecutionPoliciesResponseSchema)` to create a new message.
+ */
+declare const ListWorkflowJobFunctionExecutionPoliciesResponseSchema: GenMessage<ListWorkflowJobFunctionExecutionPoliciesResponse>;
 //#endregion
 //#region ../tailor-proto/src/tailor/v1/metadata_resource_pb.d.ts
 /**
@@ -13799,7 +14510,110 @@ declare const OperatorService: GenService<{
     output: typeof GetOrganizationFolderAccessResponseSchema;
   };
   /**
-   * CreateOrganizationTeam creates a team in an organization.
+   * UpsertOrganizationIPRestriction creates or replaces the IP allowlist
+   * applied to all inbound dataplane traffic for an organization.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid (malformed CIDR, private /
+   *   loopback / multicast address, etc.)
+   * - PermissionDenied: caller does not have permission on the organization
+   * - NotFound: organization does not exist or can not be accessed
+   *
+   * @generated from rpc tailor.v1.OperatorService.UpsertOrganizationIPRestriction
+   */
+  upsertOrganizationIPRestriction: {
+    methodKind: "unary";
+    input: typeof UpsertOrganizationIPRestrictionRequestSchema;
+    output: typeof UpsertOrganizationIPRestrictionResponseSchema;
+  };
+  /**
+   * GetOrganizationIPRestriction returns the current IP allowlist for an
+   * organization, or NotFound if no rule is configured.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid
+   * - PermissionDenied: caller does not have permission on the organization
+   * - NotFound: no IP restriction is configured for the organization
+   *
+   * @generated from rpc tailor.v1.OperatorService.GetOrganizationIPRestriction
+   */
+  getOrganizationIPRestriction: {
+    methodKind: "unary";
+    input: typeof GetOrganizationIPRestrictionRequestSchema;
+    output: typeof GetOrganizationIPRestrictionResponseSchema;
+  };
+  /**
+   * DeleteOrganizationIPRestriction removes the IP allowlist for an
+   * organization. NotFound is returned if no rule is configured.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid
+   * - PermissionDenied: caller does not have permission on the organization
+   * - NotFound: no IP restriction is configured for the organization
+   *
+   * @generated from rpc tailor.v1.OperatorService.DeleteOrganizationIPRestriction
+   */
+  deleteOrganizationIPRestriction: {
+    methodKind: "unary";
+    input: typeof DeleteOrganizationIPRestrictionRequestSchema;
+    output: typeof DeleteOrganizationIPRestrictionResponseSchema;
+  };
+  /**
+   * UpsertOrganizationFolderIPRestriction creates or replaces the IP
+   * allowlist applied to all inbound dataplane traffic for a folder.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid
+   * - PermissionDenied: caller does not have permission on the folder
+   * - NotFound: folder does not exist or can not be accessed
+   *
+   * @generated from rpc tailor.v1.OperatorService.UpsertOrganizationFolderIPRestriction
+   */
+  upsertOrganizationFolderIPRestriction: {
+    methodKind: "unary";
+    input: typeof UpsertOrganizationFolderIPRestrictionRequestSchema;
+    output: typeof UpsertOrganizationFolderIPRestrictionResponseSchema;
+  };
+  /**
+   * GetOrganizationFolderIPRestriction returns the current IP allowlist
+   * for a folder, or NotFound if no rule is configured.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid
+   * - PermissionDenied: caller does not have permission on the folder
+   * - NotFound: no IP restriction is configured for the folder
+   *
+   * @generated from rpc tailor.v1.OperatorService.GetOrganizationFolderIPRestriction
+   */
+  getOrganizationFolderIPRestriction: {
+    methodKind: "unary";
+    input: typeof GetOrganizationFolderIPRestrictionRequestSchema;
+    output: typeof GetOrganizationFolderIPRestrictionResponseSchema;
+  };
+  /**
+   * DeleteOrganizationFolderIPRestriction removes the IP allowlist for a
+   * folder. NotFound is returned if no rule is configured.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid
+   * - PermissionDenied: caller does not have permission on the folder
+   * - NotFound: no IP restriction is configured for the folder
+   *
+   * @generated from rpc tailor.v1.OperatorService.DeleteOrganizationFolderIPRestriction
+   */
+  deleteOrganizationFolderIPRestriction: {
+    methodKind: "unary";
+    input: typeof DeleteOrganizationFolderIPRestrictionRequestSchema;
+    output: typeof DeleteOrganizationFolderIPRestrictionResponseSchema;
+  };
+  /**
+   * CreateOrganizationTeam creates a team in an organization.
    *
    * [Errors]
    * - Unauthenticated: token is missing, expired, or invalid
@@ -15866,6 +16680,68 @@ declare const OperatorService: GenService<{
     input: typeof ListStaticWebsitesRequestSchema;
     output: typeof ListStaticWebsitesResponseSchema;
   };
+  /**
+   * AddCustomDomain registers a custom domain for a static website.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid
+   * - NotFound: static website does not exist
+   * - AlreadyExists: domain is already registered
+   * - ResourceExhausted: maximum number of custom domains reached
+   *
+   * @generated from rpc tailor.v1.OperatorService.AddCustomDomain
+   */
+  addCustomDomain: {
+    methodKind: "unary";
+    input: typeof AddCustomDomainRequestSchema;
+    output: typeof AddCustomDomainResponseSchema;
+  };
+  /**
+   * GetCustomDomain gets a custom domain.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid
+   * - NotFound: custom domain does not exist
+   *
+   * @generated from rpc tailor.v1.OperatorService.GetCustomDomain
+   */
+  getCustomDomain: {
+    methodKind: "unary";
+    input: typeof GetCustomDomainRequestSchema;
+    output: typeof GetCustomDomainResponseSchema;
+  };
+  /**
+   * ListCustomDomains lists custom domains for a static website.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid
+   * - NotFound: static website does not exist
+   *
+   * @generated from rpc tailor.v1.OperatorService.ListCustomDomains
+   */
+  listCustomDomains: {
+    methodKind: "unary";
+    input: typeof ListCustomDomainsRequestSchema;
+    output: typeof ListCustomDomainsResponseSchema;
+  };
+  /**
+   * RemoveCustomDomain removes a custom domain.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid
+   * - NotFound: custom domain does not exist
+   *
+   * @generated from rpc tailor.v1.OperatorService.RemoveCustomDomain
+   */
+  removeCustomDomain: {
+    methodKind: "unary";
+    input: typeof RemoveCustomDomainRequestSchema;
+    output: typeof RemoveCustomDomainResponseSchema;
+  };
   /**
    * CreateDeployment creates a new deployment.
    *
@@ -16134,6 +17010,95 @@ declare const OperatorService: GenService<{
     input: typeof TestResumeWorkflowRequestSchema;
     output: typeof TestResumeWorkflowResponseSchema;
   };
+  /**
+   * CreateWorkflowJobFunctionExecutionPolicy creates a new workflow job function execution policy.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid
+   * - AlreadyExists: policy already exists with the given execution_policy_key
+   *
+   * @generated from rpc tailor.v1.OperatorService.CreateWorkflowJobFunctionExecutionPolicy
+   */
+  createWorkflowJobFunctionExecutionPolicy: {
+    methodKind: "unary";
+    input: typeof CreateWorkflowJobFunctionExecutionPolicyRequestSchema;
+    output: typeof CreateWorkflowJobFunctionExecutionPolicyResponseSchema;
+  };
+  /**
+   * UpdateWorkflowJobFunctionExecutionPolicy updates a workflow job function execution policy.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid
+   * - NotFound: policy does not exist or can not be accessed
+   *
+   * @generated from rpc tailor.v1.OperatorService.UpdateWorkflowJobFunctionExecutionPolicy
+   */
+  updateWorkflowJobFunctionExecutionPolicy: {
+    methodKind: "unary";
+    input: typeof UpdateWorkflowJobFunctionExecutionPolicyRequestSchema;
+    output: typeof UpdateWorkflowJobFunctionExecutionPolicyResponseSchema;
+  };
+  /**
+   * DeleteWorkflowJobFunctionExecutionPolicy deletes a workflow job function execution policy.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid
+   * - NotFound: policy does not exist or can not be accessed
+   *
+   * @generated from rpc tailor.v1.OperatorService.DeleteWorkflowJobFunctionExecutionPolicy
+   */
+  deleteWorkflowJobFunctionExecutionPolicy: {
+    methodKind: "unary";
+    input: typeof DeleteWorkflowJobFunctionExecutionPolicyRequestSchema;
+    output: typeof DeleteWorkflowJobFunctionExecutionPolicyResponseSchema;
+  };
+  /**
+   * GetWorkflowJobFunctionExecutionPolicy returns a workflow job function execution policy.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid
+   * - NotFound: policy does not exist or can not be accessed
+   *
+   * @generated from rpc tailor.v1.OperatorService.GetWorkflowJobFunctionExecutionPolicy
+   */
+  getWorkflowJobFunctionExecutionPolicy: {
+    methodKind: "unary";
+    input: typeof GetWorkflowJobFunctionExecutionPolicyRequestSchema;
+    output: typeof GetWorkflowJobFunctionExecutionPolicyResponseSchema;
+  };
+  /**
+   * GetWorkflowJobFunctionExecutionPolicyByKey returns a workflow job function execution policy by its key.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid
+   * - NotFound: policy does not exist or can not be accessed
+   *
+   * @generated from rpc tailor.v1.OperatorService.GetWorkflowJobFunctionExecutionPolicyByKey
+   */
+  getWorkflowJobFunctionExecutionPolicyByKey: {
+    methodKind: "unary";
+    input: typeof GetWorkflowJobFunctionExecutionPolicyByKeyRequestSchema;
+    output: typeof GetWorkflowJobFunctionExecutionPolicyByKeyResponseSchema;
+  };
+  /**
+   * ListWorkflowJobFunctionExecutionPolicies returns workflow job function execution policies in a given workspace.
+   *
+   * [Errors]
+   * - Unauthenticated: token is missing, expired, or invalid
+   * - InvalidArgument: request is invalid
+   *
+   * @generated from rpc tailor.v1.OperatorService.ListWorkflowJobFunctionExecutionPolicies
+   */
+  listWorkflowJobFunctionExecutionPolicies: {
+    methodKind: "unary";
+    input: typeof ListWorkflowJobFunctionExecutionPoliciesRequestSchema;
+    output: typeof ListWorkflowJobFunctionExecutionPoliciesResponseSchema;
+  };
   /**
    * SetMetadata sets metadata labels for a resource.
    *
@@ -16609,6 +17574,36 @@ declare function initOperatorClient(accessToken: string): Promise<Client<import(
     input: typeof GetOrganizationFolderAccessRequestSchema;
     output: typeof GetOrganizationFolderAccessResponseSchema;
   };
+  upsertOrganizationIPRestriction: {
+    methodKind: "unary";
+    input: typeof UpsertOrganizationIPRestrictionRequestSchema;
+    output: typeof UpsertOrganizationIPRestrictionResponseSchema;
+  };
+  getOrganizationIPRestriction: {
+    methodKind: "unary";
+    input: typeof GetOrganizationIPRestrictionRequestSchema;
+    output: typeof GetOrganizationIPRestrictionResponseSchema;
+  };
+  deleteOrganizationIPRestriction: {
+    methodKind: "unary";
+    input: typeof DeleteOrganizationIPRestrictionRequestSchema;
+    output: typeof DeleteOrganizationIPRestrictionResponseSchema;
+  };
+  upsertOrganizationFolderIPRestriction: {
+    methodKind: "unary";
+    input: typeof UpsertOrganizationFolderIPRestrictionRequestSchema;
+    output: typeof UpsertOrganizationFolderIPRestrictionResponseSchema;
+  };
+  getOrganizationFolderIPRestriction: {
+    methodKind: "unary";
+    input: typeof GetOrganizationFolderIPRestrictionRequestSchema;
+    output: typeof GetOrganizationFolderIPRestrictionResponseSchema;
+  };
+  deleteOrganizationFolderIPRestriction: {
+    methodKind: "unary";
+    input: typeof DeleteOrganizationFolderIPRestrictionRequestSchema;
+    output: typeof DeleteOrganizationFolderIPRestrictionResponseSchema;
+  };
   createOrganizationTeam: {
     methodKind: "unary";
     input: typeof CreateOrganizationTeamRequestSchema;
@@ -17364,6 +18359,26 @@ declare function initOperatorClient(accessToken: string): Promise<Client<import(
     input: typeof ListStaticWebsitesRequestSchema;
     output: typeof ListStaticWebsitesResponseSchema;
   };
+  addCustomDomain: {
+    methodKind: "unary";
+    input: typeof AddCustomDomainRequestSchema;
+    output: typeof AddCustomDomainResponseSchema;
+  };
+  getCustomDomain: {
+    methodKind: "unary";
+    input: typeof GetCustomDomainRequestSchema;
+    output: typeof GetCustomDomainResponseSchema;
+  };
+  listCustomDomains: {
+    methodKind: "unary";
+    input: typeof ListCustomDomainsRequestSchema;
+    output: typeof ListCustomDomainsResponseSchema;
+  };
+  removeCustomDomain: {
+    methodKind: "unary";
+    input: typeof RemoveCustomDomainRequestSchema;
+    output: typeof RemoveCustomDomainResponseSchema;
+  };
   createDeployment: {
     methodKind: "unary";
     input: typeof CreateDeploymentRequestSchema;
@@ -17454,6 +18469,36 @@ declare function initOperatorClient(accessToken: string): Promise<Client<import(
     input: typeof TestResumeWorkflowRequestSchema;
     output: typeof TestResumeWorkflowResponseSchema;
   };
+  createWorkflowJobFunctionExecutionPolicy: {
+    methodKind: "unary";
+    input: typeof CreateWorkflowJobFunctionExecutionPolicyRequestSchema;
+    output: typeof CreateWorkflowJobFunctionExecutionPolicyResponseSchema;
+  };
+  updateWorkflowJobFunctionExecutionPolicy: {
+    methodKind: "unary";
+    input: typeof UpdateWorkflowJobFunctionExecutionPolicyRequestSchema;
+    output: typeof UpdateWorkflowJobFunctionExecutionPolicyResponseSchema;
+  };
+  deleteWorkflowJobFunctionExecutionPolicy: {
+    methodKind: "unary";
+    input: typeof DeleteWorkflowJobFunctionExecutionPolicyRequestSchema;
+    output: typeof DeleteWorkflowJobFunctionExecutionPolicyResponseSchema;
+  };
+  getWorkflowJobFunctionExecutionPolicy: {
+    methodKind: "unary";
+    input: typeof GetWorkflowJobFunctionExecutionPolicyRequestSchema;
+    output: typeof GetWorkflowJobFunctionExecutionPolicyResponseSchema;
+  };
+  getWorkflowJobFunctionExecutionPolicyByKey: {
+    methodKind: "unary";
+    input: typeof GetWorkflowJobFunctionExecutionPolicyByKeyRequestSchema;
+    output: typeof GetWorkflowJobFunctionExecutionPolicyByKeyResponseSchema;
+  };
+  listWorkflowJobFunctionExecutionPolicies: {
+    methodKind: "unary";
+    input: typeof ListWorkflowJobFunctionExecutionPoliciesRequestSchema;
+    output: typeof ListWorkflowJobFunctionExecutionPoliciesResponseSchema;
+  };
   setMetadata: {
     methodKind: "unary";
     input: typeof SetMetadataRequestSchema;
@@ -17580,136 +18625,15 @@ declare function loadConfig(configPath?: string): Promise<{
   plugins: Plugin[];
 }>;
 //#endregion
-//#region src/cli/commands/deploy/function-registry.d.ts
-/**
- * In-memory bundled scripts organized by kind.
- */
-type BundledScripts = {
-  resolvers: Map<string, string>;
-  executors: Map<string, string>;
-  workflowJobs: Map<string, string>;
-  authHooks: Map<string, string>;
-};
-//#endregion
-//#region src/cli/commands/tailordb/migrate/diff-calculator.d.ts
+//#region src/cli/commands/tailordb/migrate/snapshot-types.d.ts
 /**
- * Diff calculator and formatter for TailorDB schema migrations
+ * Schema snapshot data model for TailorDB migrations.
  *
- * This module provides utilities for formatting and displaying migration diffs.
- * The actual diff calculation is performed by snapshot.ts.
+ * Leaf module: these types describe the persisted snapshot format
+ * (XXXX/schema.json) and are shared by snapshot.ts (snapshot management)
+ * and diff-calculator.ts (diff types and formatting) without creating
+ * import cycles between them.
  */
-/**
- * Current schema snapshot format version
- */
-declare const SCHEMA_SNAPSHOT_VERSION: 1;
-/**
- * Change kind in migration diff
- */
-type DiffChangeKind = "type_added" | "type_removed" | "type_modified" | "field_added" | "field_removed" | "field_modified" | "index_added" | "index_removed" | "index_modified" | "file_added" | "file_removed" | "file_modified" | "relationship_added" | "relationship_removed" | "relationship_modified" | "permission_modified";
-/**
- * Single change in migration diff
- */
-interface DiffChange {
-  kind: DiffChangeKind;
-  typeName: string;
-  fieldName?: string;
-  /** Index name for index_* changes */
-  indexName?: string;
-  /** Relationship name for relationship_* changes */
-  relationshipName?: string;
-  /** Relationship type for relationship_* changes */
-  relationshipType?: "forward" | "backward";
-  before?: unknown;
-  after?: unknown;
-  reason?: string;
-}
-/**
- * Migration diff - changes between two schema versions
- * Stored as XXXX/diff.json (e.g., 0001/diff.json)
- */
-interface MigrationDiff {
-  /** Format version for future compatibility */
-  version: typeof SCHEMA_SNAPSHOT_VERSION;
-  namespace: string;
-  createdAt: string;
-  description?: string;
-  changes: DiffChange[];
-  /** Whether there are breaking changes (data loss or constraint violations possible) */
-  hasBreakingChanges: boolean;
-  /** List of breaking changes */
-  breakingChanges: BreakingChangeInfo[];
-  /** Whether there are non-breaking changes that may cause data loss (e.g. field/type removal) */
-  hasWarnings: boolean;
-  /** List of non-breaking warnings */
-  warnings: WarningChangeInfo[];
-  /** Whether a migration script is required to handle data migration */
-  requiresMigrationScript: boolean;
-}
-/**
- * Breaking change information in migration diff
- */
-interface BreakingChangeInfo {
-  typeName: string;
-  fieldName?: string;
-  reason: string;
-  /** If true, this change is not supported and migration generation will fail */
-  unsupported?: boolean;
-  /** If true, show 3-step migration instructions for this unsupported change */
-  showThreeStepHint?: boolean;
-}
-/**
- * Warning change information in migration diff.
- *
- * Warnings are non-breaking changes that may still cause data loss
- * (e.g. removing a field or type). Unlike breaking changes, a migration
- * script is not required, but writing one is recommended if you need to
- * preserve or transform data before the change applies.
- */
-interface WarningChangeInfo {
-  typeName: string;
-  fieldName?: string;
-  reason: string;
-}
-/**
- * Check if a migration diff has any changes
- * @param {MigrationDiff} diff - Migration diff to check
- * @returns {boolean} True if diff has changes
- */
-declare function hasChanges(diff: MigrationDiff): boolean;
-/**
- * Format a migration diff for display
- * @param {MigrationDiff} diff - Migration diff to format
- * @returns {string} Formatted diff string
- */
-declare function formatMigrationDiff(diff: MigrationDiff): string;
-/**
- * Format a summary of the migration diff
- * @param {MigrationDiff} diff - Migration diff to summarize
- * @returns {string} Formatted summary string
- */
-declare function formatDiffSummary(diff: MigrationDiff): string;
-//#endregion
-//#region src/cli/commands/tailordb/migrate/types.d.ts
-/**
- * Label key for storing migration state in TailorDB Service metadata
- */
-declare const MIGRATION_LABEL_KEY = "sdk-migration";
-//#endregion
-//#region src/cli/commands/tailordb/migrate/snapshot.d.ts
-/**
- * Initial schema migration number (0000)
- */
-declare const INITIAL_SCHEMA_NUMBER = 0;
-/**
- * Migration file names (used within migration directories)
- */
-declare const SCHEMA_FILE_NAME = "schema.json";
-/** File name for migration diff metadata. */
-declare const DIFF_FILE_NAME = "diff.json";
-/** File name for migration script. */
-declare const MIGRATE_FILE_NAME = "migrate.ts";
-/** File name for generated DB type definitions. */
-declare const DB_TYPES_FILE_NAME = "db.ts";
 /**
  * Hook configuration in schema snapshot
  */
@@ -17879,6 +18803,240 @@ interface TailorDBSnapshotType {
     gql?: SnapshotGqlPermission;
   };
 }
+//#endregion
+//#region src/cli/commands/tailordb/migrate/diff-calculator.d.ts
+/**
+ * Current schema snapshot format version
+ */
+declare const SCHEMA_SNAPSHOT_VERSION: 1;
+/**
+ * Properties shared by all diff change variants
+ */
+interface DiffChangeBase {
+  typeName: string;
+  reason?: string;
+}
+/**
+ * Type-level settings patch carried by legacy `type_modified` changes.
+ * Current SDK versions no longer produce this kind, but persisted
+ * diff.json files written by older versions may still contain it.
+ */
+interface TypeSettingsPatch {
+  indexes?: Record<string, SnapshotIndexConfig>;
+  files?: Record<string, string>;
+}
+/**
+ * Permission state carried by `permission_modified` changes.
+ */
+interface SnapshotPermissionState {
+  recordPermission?: SnapshotRecordPermission;
+  gqlPermission?: SnapshotGqlPermission;
+}
+/** A new type was added to the schema. */
+interface TypeAddedChange extends DiffChangeBase {
+  kind: "type_added";
+  after: TailorDBSnapshotType;
+}
+/** An existing type was removed from the schema. */
+interface TypeRemovedChange extends DiffChangeBase {
+  kind: "type_removed";
+  before: TailorDBSnapshotType;
+}
+/**
+ * Legacy type-level settings change. Kept for backward compatibility with
+ * diff.json files written by older SDK versions; `before`/`after` may be
+ * absent in those files, hence optional.
+ */
+interface TypeModifiedChange extends DiffChangeBase {
+  kind: "type_modified";
+  before?: TypeSettingsPatch;
+  after?: TypeSettingsPatch;
+}
+/** A field was added to a type. */
+interface FieldAddedChange extends DiffChangeBase {
+  kind: "field_added";
+  fieldName: string;
+  after: SnapshotFieldConfig;
+}
+/** A field was removed from a type. */
+interface FieldRemovedChange extends DiffChangeBase {
+  kind: "field_removed";
+  fieldName: string;
+  before: SnapshotFieldConfig;
+}
+/** A field configuration was modified. */
+interface FieldModifiedChange extends DiffChangeBase {
+  kind: "field_modified";
+  fieldName: string;
+  before: SnapshotFieldConfig;
+  after: SnapshotFieldConfig;
+}
+/** An index was added to a type. */
+interface IndexAddedChange extends DiffChangeBase {
+  kind: "index_added";
+  indexName: string;
+  after: SnapshotIndexConfig;
+}
+/** An index was removed from a type. */
+interface IndexRemovedChange extends DiffChangeBase {
+  kind: "index_removed";
+  indexName: string;
+  before: SnapshotIndexConfig;
+}
+/** An index configuration was modified. */
+interface IndexModifiedChange extends DiffChangeBase {
+  kind: "index_modified";
+  indexName: string;
+  before: SnapshotIndexConfig;
+  after: SnapshotIndexConfig;
+}
+/** A file field was added to a type. `before`/`after` hold the description. */
+interface FileAddedChange extends DiffChangeBase {
+  kind: "file_added";
+  fieldName: string;
+  after: string;
+}
+/** A file field was removed from a type. */
+interface FileRemovedChange extends DiffChangeBase {
+  kind: "file_removed";
+  fieldName: string;
+  before: string;
+}
+/** A file field description was modified. */
+interface FileModifiedChange extends DiffChangeBase {
+  kind: "file_modified";
+  fieldName: string;
+  before: string;
+  after: string;
+}
+/**
+ * A relationship was added to a type. `relationshipType` is optional for
+ * backward compatibility: diff.json files written by older SDK versions
+ * predate the field.
+ */
+interface RelationshipAddedChange extends DiffChangeBase {
+  kind: "relationship_added";
+  relationshipName: string;
+  relationshipType?: "forward" | "backward";
+  after: SnapshotRelationship;
+}
+/** A relationship was removed from a type. */
+interface RelationshipRemovedChange extends DiffChangeBase {
+  kind: "relationship_removed";
+  relationshipName: string;
+  relationshipType?: "forward" | "backward";
+  before: SnapshotRelationship;
+}
+/** A relationship configuration was modified. */
+interface RelationshipModifiedChange extends DiffChangeBase {
+  kind: "relationship_modified";
+  relationshipName: string;
+  relationshipType?: "forward" | "backward";
+  before: SnapshotRelationship;
+  after: SnapshotRelationship;
+}
+/**
+ * Type-level permissions were modified. `before`/`after` are optional for
+ * robustness against hand-edited or legacy diff.json files; consumers guard
+ * on their presence.
+ */
+interface PermissionModifiedChange extends DiffChangeBase {
+  kind: "permission_modified";
+  before?: SnapshotPermissionState;
+  after?: SnapshotPermissionState;
+}
+/**
+ * Single change in migration diff, discriminated by `kind` so that
+ * `before`/`after` are typed per change kind.
+ */
+type DiffChange = TypeAddedChange | TypeRemovedChange | TypeModifiedChange | FieldAddedChange | FieldRemovedChange | FieldModifiedChange | IndexAddedChange | IndexRemovedChange | IndexModifiedChange | FileAddedChange | FileRemovedChange | FileModifiedChange | RelationshipAddedChange | RelationshipRemovedChange | RelationshipModifiedChange | PermissionModifiedChange;
+/**
+ * Migration diff - changes between two schema versions
+ * Stored as XXXX/diff.json (e.g., 0001/diff.json)
+ */
+interface MigrationDiff {
+  /** Format version for future compatibility */
+  version: typeof SCHEMA_SNAPSHOT_VERSION;
+  namespace: string;
+  createdAt: string;
+  description?: string;
+  changes: DiffChange[];
+  /** Whether there are breaking changes (data loss or constraint violations possible) */
+  hasBreakingChanges: boolean;
+  /** List of breaking changes */
+  breakingChanges: BreakingChangeInfo[];
+  /** Whether there are non-breaking changes that may cause data loss (e.g. field/type removal) */
+  hasWarnings: boolean;
+  /** List of non-breaking warnings */
+  warnings: WarningChangeInfo[];
+  /** Whether a migration script is required to handle data migration */
+  requiresMigrationScript: boolean;
+}
+/**
+ * Breaking change information in migration diff
+ */
+interface BreakingChangeInfo {
+  typeName: string;
+  fieldName?: string;
+  reason: string;
+  /** If true, this change is not supported and migration generation will fail */
+  unsupported?: boolean;
+  /** If true, show 3-step migration instructions for this unsupported change */
+  showThreeStepHint?: boolean;
+}
+/**
+ * Warning change information in migration diff.
+ *
+ * Warnings are non-breaking changes that may still cause data loss
+ * (e.g. removing a field or type). Unlike breaking changes, a migration
+ * script is not required, but writing one is recommended if you need to
+ * preserve or transform data before the change applies.
+ */
+interface WarningChangeInfo {
+  typeName: string;
+  fieldName?: string;
+  reason: string;
+}
+/**
+ * Check if a migration diff has any changes
+ * @param {MigrationDiff} diff - Migration diff to check
+ * @returns {boolean} True if diff has changes
+ */
+declare function hasChanges(diff: MigrationDiff): boolean;
+/**
+ * Format a migration diff for display
+ * @param {MigrationDiff} diff - Migration diff to format
+ * @returns {string} Formatted diff string
+ */
+declare function formatMigrationDiff(diff: MigrationDiff): string;
+/**
+ * Format a summary of the migration diff
+ * @param {MigrationDiff} diff - Migration diff to summarize
+ * @returns {string} Formatted summary string
+ */
+declare function formatDiffSummary(diff: MigrationDiff): string;
+//#endregion
+//#region src/cli/commands/tailordb/migrate/types.d.ts
+/**
+ * Label key for storing migration state in TailorDB Service metadata
+ */
+declare const MIGRATION_LABEL_KEY = "sdk-migration";
+//#endregion
+//#region src/cli/commands/tailordb/migrate/snapshot.d.ts
+/**
+ * Initial schema migration number (0000)
+ */
+declare const INITIAL_SCHEMA_NUMBER = 0;
+/**
+ * Migration file names (used within migration directories)
+ */
+declare const SCHEMA_FILE_NAME = "schema.json";
+/** File name for migration diff metadata. */
+declare const DIFF_FILE_NAME = "diff.json";
+/** File name for migration script. */
+declare const MIGRATE_FILE_NAME = "migrate.ts";
+/** File name for generated DB type definitions. */
+declare const DB_TYPES_FILE_NAME = "db.ts";
 /**
  * Schema snapshot - full schema state at a point in time
  * Stored as XXXX/schema.json (e.g., 0000/schema.json for initial snapshot)