@tailor-platform/sdk 1.68.0 → 1.70.0

package/dist/{runtime-DxaBq6U8.mjs → runtime-CSY0eD4_.mjs}

@@ -1,9 +1,10 @@
 
-import { t as db } from "./schema-1msIhXwA.mjs";
-import { $ as WorkflowJobExecution_Status, $t as AuthHookPoint, A as loadMachineUserName, At as ExecutorJobStatus, Bt as CreateAuthServiceRequestSchema, Ct as IdPLang, Et as FunctionExecution_Status, F as writePlatformConfig, Ft as CreateAuthIDPConfigRequestSchema, G as resolveStaticWebsiteUrls, Gt as UpdateAuthMachineUserRequestSchema, Ht as CreateUserProfileConfigRequestSchema, It as CreateAuthMachineUserRequestSchema, J as WorkspacePlatformUserRole, Jt as UpdateAuthSCIMResourceRequestSchema, K as byName, Kt as UpdateAuthOAuth2ClientRequestSchema, L as fetchAll, Lt as CreateAuthOAuth2ClientRequestSchema, M as readPlatformConfig, Mt as ExecutorTriggerType, Nt as CreateAuthConnectionRequestSchema, O as loadAccessToken, Ot as CreateExecutorExecutorRequestSchema, Pt as CreateAuthHookRequestSchema, Q as WorkflowExecution_Status, Qt as AuthConnection_Type, R as fetchMachineUserToken, Rt as CreateAuthSCIMConfigRequestSchema, S as getDistDir, St as UpdateIdPServiceRequestSchema, T as loadConfig, Tt as IdPPermissionPermit, U as initOperatorClient, Ut as UpdateAuthHookRequestSchema, Vt as CreateTenantConfigRequestSchema, W as platformBaseUrl, Wt as UpdateAuthIDPConfigRequestSchema, X as CreateWorkflowRequestSchema, Xt as UpdateTenantConfigRequestSchema, Y as CreateWorkflowJobFunctionRequestSchema, Yt as UpdateAuthServiceRequestSchema, Z as UpdateWorkflowRequestSchema, Zt as UpdateUserProfileConfigRequestSchema, _n as Condition_Operator, _t as CreatePipelineServiceRequestSchema, an as AuthSCIMAttribute_Type, at as TailorDBGQLPermission_Permit, b as hasGenerationHooks, bt as PipelineResolver_OperationType, ct as TailorDBType_PermitAction, d as assertUniqueLocalTailorDBTypeNames, dn as CreateApplicationRequestSchema, dt as UpdateStaticWebsiteRequestSchema, en as AuthIDPConfig_AuthType, et as CreateTailorDBServiceRequestSchema, f as assertUniqueTailorDBTypeNamesWithExternal, fn as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, gn as ConditionSchema, gt as CreatePipelineResolverRequestSchema, h as platformBundleDefinePlugin, hn as Subgraph_ServiceType, ht as UpdateSecretManagerSecretRequestSchema, in as AuthSCIMAttribute_Mutability, it as TailorDBGQLPermission_Operator, j as loadWorkspaceId, jt as ExecutorTargetType, k as loadConfigPath, kt as UpdateExecutorExecutorRequestSchema, l as buildExecutorArgsExpr, ln as TenantProviderConfig_TenantProviderType, lt as AddCustomDomainRequestSchema, m as stringifyFunction, mn as ApplicationSchemaUpdateAttemptStatus, mt as CreateSecretManagerVaultRequestSchema, n as generatePluginFilesIfNeeded, nn as AuthOAuth2Client_ClientType, nt as UpdateTailorDBTypeRequestSchema, on as AuthSCIMAttribute_Uniqueness, ot as TailorDBType_Permission_Operator, p as TailorDBTypeSchema, pn as UpdateApplicationRequestSchema, pt as CreateSecretManagerSecretRequestSchema, q as OperatorService, qt as UpdateAuthSCIMConfigRequestSchema, r as loadApplication, rn as AuthOAuth2Client_GrantType, rt as TailorDBGQLPermission_Action, s as HTTP_METHODS, sn as AuthSCIMConfig_AuthorizationType, st as TailorDBType_Permission_Permit, t as defineApplication, tn as AuthInvokerSchema, tt as CreateTailorDBTypeRequestSchema, u as buildResolverOperationHookExpr, un as UserProfileProviderConfig_UserProfileProviderType, ut as CreateStaticWebsiteRequestSchema, vn as FilterSchema, vt as UpdatePipelineResolverRequestSchema, w as hashFile, wt as IdPPermissionOperator, x as createBundleCache, xt as CreateIdPServiceRequestSchema, y as getPluginGenerationDependencies, yn as PageDirection, yt as UpdatePipelineServiceRequestSchema, z as fetchPaged, zt as CreateAuthSCIMResourceRequestSchema } from "./application-WpWwTyk9.mjs";
+import { t as db } from "./schema-C4fkpWV_.mjs";
+import { $ as CreateUserProfileConfigRequestSchema, A as UpdatePipelineServiceRequestSchema, At as PageDirection, B as UpdateExecutorExecutorRequestSchema, Ct as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, D as CreatePipelineResolverRequestSchema, Dt as ConditionSchema, E as UpdateSecretManagerSecretRequestSchema, Et as Subgraph_ServiceType, F as IdPPermissionOperator, G as CreateAuthHookRequestSchema, H as ExecutorTargetType, I as IdPPermissionPermit, J as CreateAuthOAuth2ClientRequestSchema, K as CreateAuthIDPConfigRequestSchema, L as FunctionExecution_Status, M as CreateIdPServiceRequestSchema, N as UpdateIdPServiceRequestSchema, O as CreatePipelineServiceRequestSchema, Ot as Condition_Operator, P as IdPLang, Q as CreateTenantConfigRequestSchema, S as UpdateStaticWebsiteRequestSchema, St as CreateApplicationRequestSchema, T as CreateSecretManagerVaultRequestSchema, Tt as ApplicationSchemaUpdateAttemptStatus, U as ExecutorTriggerType, V as ExecutorJobStatus, W as CreateAuthConnectionRequestSchema, X as CreateAuthSCIMResourceRequestSchema, Y as CreateAuthSCIMConfigRequestSchema, Z as CreateAuthServiceRequestSchema, _ as TailorDBType_Permission_Operator, _t as AuthSCIMAttribute_Uniqueness, a as WorkspacePlatformUserRole, at as UpdateAuthSCIMResourceRequestSchema, b as AddCustomDomainRequestSchema, bt as TenantProviderConfig_TenantProviderType, c as UpdateWorkflowRequestSchema, ct as UpdateUserProfileConfigRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as AuthIDPConfig_AuthType, et as UpdateAuthHookRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as AuthInvokerSchema, g as TailorDBGQLPermission_Permit, gt as AuthSCIMAttribute_Type, h as TailorDBGQLPermission_Operator, ht as AuthSCIMAttribute_Mutability, it as UpdateAuthSCIMConfigRequestSchema, j as PipelineResolver_OperationType, k as UpdatePipelineResolverRequestSchema, kt as FilterSchema, l as WorkflowExecution_Status, lt as AuthConnection_Type, m as TailorDBGQLPermission_Action, mt as AuthOAuth2Client_GrantType, nt as UpdateAuthMachineUserRequestSchema, o as CreateWorkflowJobFunctionRequestSchema, ot as UpdateAuthServiceRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as AuthOAuth2Client_ClientType, q as CreateAuthMachineUserRequestSchema, rt as UpdateAuthOAuth2ClientRequestSchema, s as CreateWorkflowRequestSchema, st as UpdateTenantConfigRequestSchema, t as OperatorService, tt as UpdateAuthIDPConfigRequestSchema, u as WorkflowJobExecution_Status, ut as AuthHookPoint, v as TailorDBType_Permission_Permit, vt as AuthSCIMConfig_AuthorizationType, w as CreateSecretManagerSecretRequestSchema, wt as UpdateApplicationRequestSchema, x as CreateStaticWebsiteRequestSchema, xt as UserProfileProviderConfig_UserProfileProviderType, y as TailorDBType_PermitAction, z as CreateExecutorExecutorRequestSchema } from "./service_pb-DSNjrcbW.mjs";
 import { t as assertDefined } from "./assert-CKfwrmCV.mjs";
-import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-DpJyJvNz.mjs";
-import { o as loadFilesWithIgnores, t as createExecutorService } from "./service-wI3Hvrgx.mjs";
+import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-DKF-JsAK.mjs";
+import { $ as initOperatorClient, A as loadAccessToken, G as fetchMachineUserToken, I as loadWorkspaceId, K as fetchPaged, L as platformConfigFromProfile, N as loadMachineUserName, P as loadPlatformClientConfig, R as readPlatformConfig, S as getDistDir, T as loadConfig, V as writePlatformConfig, W as fetchAll, X as getOAuth2ClientId, Y as getConsoleBaseUrl, Z as getPlatformBaseUrl, b as hasGenerationHooks, d as assertUniqueLocalTailorDBTypeNames, et as isDefaultPlatform, f as assertUniqueTailorDBTypeNamesWithExternal, h as platformBundleDefinePlugin, j as loadConfigPath, k as hasUserTokenEntry, l as buildExecutorArgsExpr, m as stringifyFunction, n as generatePluginFilesIfNeeded, nt as byName, p as TailorDBTypeSchema, r as loadApplication, s as HTTP_METHODS, t as defineApplication, tt as resolveStaticWebsiteUrls, u as buildResolverOperationHookExpr, w as hashFile, x as createBundleCache, y as getPluginGenerationDependencies } from "./application-Df5_I83n.mjs";
+import { o as loadFilesWithIgnores, t as createExecutorService } from "./service-B2Jd9CxS.mjs";
 import { t as multiline } from "./multiline-Cf9ODpr1.mjs";
 import { t as readPackageJson } from "./package-json-DcQApfPQ.mjs";
 import { i as userAgent } from "./secret-file-eB3R3Fil.mjs";
@@ -309,6 +310,10 @@ async function assertWritable(opts) {
 
 //#endregion
 //#region src/cli/commands/api/api-call.ts
+function hasEnvAccessToken() {
+	const envToken = process.env.TAILOR_PLATFORM_TOKEN ?? process.env.TAILOR_TOKEN;
+	return Boolean(envToken);
+}
 /**
 * Call Tailor Platform API endpoints directly.
 * If the endpoint doesn't contain "/", it defaults to `tailor.v1.OperatorService/{endpoint}`.
@@ -317,10 +322,16 @@ async function assertWritable(opts) {
 */
 async function apiCall(options) {
 	const accessToken = await loadAccessToken({ profile: options.profile });
+	let platformConfig;
+	try {
+		platformConfig = await loadPlatformClientConfig({ profile: options.profile });
+	} catch (error) {
+		if (!hasEnvAccessToken()) throw error;
+	}
 	let endpointPath;
 	if (options.endpoint.includes("/")) endpointPath = options.endpoint;
 	else endpointPath = `tailor.v1.OperatorService/${options.endpoint}`;
-	const url = new URL(endpointPath, platformBaseUrl);
+	const url = new URL(endpointPath, getPlatformBaseUrl(platformConfig));
 	const response = await fetch(url.toString(), {
 		method: "POST",
 		headers: {
@@ -385,7 +396,7 @@ function nestedMessage(field) {
 function isWellKnownType(message) {
 	return message.typeName.startsWith("google.protobuf.");
 }
-const UNREPRESENTABLE_WELL_KNOWN_TYPES = new Set([
+const UNREPRESENTABLE_WELL_KNOWN_TYPES = /* @__PURE__ */ new Set([
 	"google.protobuf.Struct",
 	"google.protobuf.Value",
 	"google.protobuf.ListValue",
@@ -568,7 +579,7 @@ function fieldToJson(field, visited) {
 	return json;
 }
 function renderInspectJson(method) {
-	const visited = new Set([method.input]);
+	const visited = /* @__PURE__ */ new Set([method.input]);
 	return {
 		method: method.name,
 		input: {
@@ -599,7 +610,7 @@ function renderInspectText(method) {
 	const lines = [];
 	lines.push(`${method.name}`);
 	lines.push(`  request: ${method.input.typeName}`);
-	const visited = new Set([method.input]);
+	const visited = /* @__PURE__ */ new Set([method.input]);
 	for (const f of method.input.fields) lines.push(...renderFieldText(f, "    ", visited));
 	lines.push(`  response: ${method.output.typeName}`);
 	return lines.join("\n");
@@ -750,7 +761,7 @@ function normalizeBodyFieldKeys(body, fields) {
 	}
 	return changed;
 }
-const FORBIDDEN_SEGMENTS = new Set([
+const FORBIDDEN_SEGMENTS = /* @__PURE__ */ new Set([
 	"__proto__",
 	"constructor",
 	"prototype"
@@ -1593,7 +1604,7 @@ function copyMetadataToExtendedType(original, extended) {
 /**
 * Create a new ChangeSet for tracking resource changes.
 * @param title - Title for the change set
-* @returns Empty ChangeSet instance with isEmpty() and print() methods
+* @returns Empty ChangeSet instance with isEmpty() and lines() methods
 */
 function createChangeSet(title) {
 	const creates = [];
@@ -1610,17 +1621,16 @@ function createChangeSet(title) {
 		replaces,
 		unchanged,
 		isEmpty,
-		print: () => {
-			if (isEmpty()) return;
-			logger.log(styles.bold(`${title}:`));
-			const printItem = (symbol, item) => {
-				logger.log(`  ${symbol} ${item.name}`);
-				for (const detail of item.details ?? []) logger.log(`    ${detail}`);
-			};
-			creates.forEach((item) => printItem(symbols.create, item));
-			deletes.forEach((item) => printItem(symbols.delete, item));
-			updates.forEach((item) => printItem(symbols.update, item));
-			replaces.forEach((item) => printItem(symbols.replace, item));
+		lines: () => {
+			if (isEmpty()) return [];
+			const itemLines = (symbol) => (item) => [`  ${symbol} ${item.name}`, ...(item.details ?? []).map((d) => `    ${d}`)];
+			return [
+				styles.bold(`${title}:`),
+				...creates.flatMap(itemLines(symbols.create)),
+				...deletes.flatMap(itemLines(symbols.delete)),
+				...updates.flatMap(itemLines(symbols.update)),
+				...replaces.flatMap(itemLines(symbols.replace))
+			];
 		}
 	};
 }
@@ -1634,15 +1644,13 @@ function summarizeChangeSets(changeSets) {
 		create: 0,
 		update: 0,
 		delete: 0,
-		replace: 0,
-		unchanged: 0
+		replace: 0
 	};
 	for (const changeSet of changeSets) {
 		summary.create += changeSet.creates.length;
 		summary.update += changeSet.updates.length;
 		summary.delete += changeSet.deletes.length;
 		summary.replace += changeSet.replaces.length;
-		summary.unchanged += changeSet.unchanged.length;
 	}
 	return summary;
 }
@@ -3046,18 +3054,19 @@ function extractServiceActions(changeSet) {
 	];
 }
 /**
-* Print a titled section of grouped display entries, nesting by namespace.
+* Build display lines for a titled section of grouped entries, nesting by namespace.
 * Service-level changes are shown as the namespace header symbol.
 * Services without child entries are shown as flat entries.
 * @param title - Section title
-* @param entries - Entries to print (should NOT include service entries)
+* @param entries - Entries to render (should NOT include service entries)
 * @param serviceActions - Optional service-level actions to merge into namespace headers
+* @returns Lines ready for output; empty array when there is nothing to show
 */
-function printGroupedDisplaySection(title, entries, serviceActions) {
+function buildGroupedDisplayLines(title, entries, serviceActions) {
 	const serviceMap = /* @__PURE__ */ new Map();
 	if (serviceActions) for (const sa of serviceActions) serviceMap.set(sa.name, sa.action);
-	if (entries.length === 0 && serviceMap.size === 0) return;
-	logger.log(styles.bold(`${title}:`));
+	if (entries.length === 0 && serviceMap.size === 0) return [];
+	const out = [styles.bold(`${title}:`)];
 	const namespaceOrder = [];
 	const byNamespace = /* @__PURE__ */ new Map();
 	for (const entry of entries) {
@@ -3074,12 +3083,13 @@ function printGroupedDisplaySection(title, entries, serviceActions) {
 		if (ns) {
 			const svcAction = serviceMap.get(ns);
 			const prefix = svcAction ? `${ACTION_SYMBOLS[svcAction]} ` : "";
-			logger.log(`  ${prefix}${styles.bold(`${ns}:`)}`);
+			out.push(`  ${prefix}${styles.bold(`${ns}:`)}`);
 			printedServices.add(ns);
-			for (const entry of group) logger.log(`    ${formatGroupedDisplayLine(entry)}`);
-		} else for (const entry of group) logger.log(`  ${formatGroupedDisplayLine(entry)}`);
+			for (const entry of group) out.push(`    ${formatGroupedDisplayLine(entry)}`);
+		} else for (const entry of group) out.push(`  ${formatGroupedDisplayLine(entry)}`);
 	}
-	for (const [name, action] of serviceMap) if (!printedServices.has(name)) logger.log(`  ${ACTION_SYMBOLS[action]} ${name}`);
+	for (const [name, action] of serviceMap) if (!printedServices.has(name)) out.push(`  ${ACTION_SYMBOLS[action]} ${name}`);
+	return out;
 }
 
 //#endregion
@@ -3162,7 +3172,8 @@ function normalizeIdPPermission(permission) {
 		read: permission.read.map((p) => normalizeIdPActionPermission(p)),
 		update: permission.update.map((p) => normalizeIdPActionPermission(p)),
 		delete: permission.delete.map((p) => normalizeIdPActionPermission(p)),
-		sendPasswordResetEmail: permission.sendPasswordResetEmail.map((p) => normalizeIdPActionPermission(p))
+		sendPasswordResetEmail: (permission.sendPasswordResetEmail ?? []).map((p) => normalizeIdPActionPermission(p)),
+		unenrollMfa: (permission.unenrollMfa ?? []).map((p) => normalizeIdPActionPermission(p))
 	};
 }
 /**
@@ -3188,7 +3199,7 @@ function parseIdPPermission(rawPermission) {
 function findOmittedPermitRules(permission) {
 	if (!permission) return [];
 	const locations = [];
-	for (const action of Object.keys(permission)) permission[action].forEach((rule, index) => {
+	for (const action of Object.keys(permission)) permission[action]?.forEach((rule, index) => {
 		if (isObjectFormat(rule) && rule.permit === void 0) locations.push(`${String(action)}[${index}]`);
 	});
 	return locations;
@@ -3196,6 +3207,14 @@ function findOmittedPermitRules(permission) {
 
 //#endregion
 //#region src/cli/commands/deploy/idp.ts
+async function resolveServiceReturnOrigins(client, request) {
+	const policy = request.userAuthPolicy;
+	const originals = policy?.allowedReturnOrigins;
+	if (!policy || !originals?.length) return;
+	const resolved = await resolveStaticWebsiteUrls(client, assertDefined(request.workspaceId, "request missing workspaceId"), originals, `IdP service "${request.namespaceName ?? ""}" allowedReturnOrigins`);
+	if (resolved.length !== originals.length) throw new Error(`IdP service "${request.namespaceName ?? ""}" allowedReturnOrigins: ${originals.length - resolved.length} of ${originals.length} entries could not be resolved. Check that each "<name>:url" entry refers to a deployed static website.`);
+	policy.allowedReturnOrigins = resolved;
+}
 /**
 * Build the vault name for an IdP client.
 * @param namespaceName - IdP namespace name
@@ -3225,9 +3244,11 @@ async function applyIdP(client, result, phase = "create-update") {
 	const { changeSet } = result;
 	if (phase === "create-update") {
 		await Promise.all([...changeSet.service.creates.map(async (create) => {
+			await resolveServiceReturnOrigins(client, create.request);
 			await client.createIdPService(create.request);
 			await client.setMetadata(create.metaRequest);
 		}), ...changeSet.service.updates.map(async (update) => {
+			await resolveServiceReturnOrigins(client, update.request);
 			await client.updateIdPService(update.request);
 			await client.setMetadata(update.metaRequest);
 		})]);
@@ -3286,7 +3307,8 @@ async function applyIdP(client, result, phase = "create-update") {
 async function planIdP(context) {
 	const { client, workspaceId, application, forRemoval, forceApplyAll = false, idpUserTriggerTargets } = context;
 	const idps = forRemoval ? [] : application.idpServices;
-	const { changeSet: serviceChangeSet, conflicts, unmanaged, resourceOwners } = await planServices$3(client, workspaceId, application.name, application.id, idps, idpUserTriggerTargets ?? /* @__PURE__ */ new Set());
+	const expectedLocalWebsites = new Set(application.staticWebsiteServices.map((website) => website.name));
+	const { changeSet: serviceChangeSet, conflicts, unmanaged, resourceOwners } = await planServices$3(client, workspaceId, application.name, application.id, idps, idpUserTriggerTargets ?? /* @__PURE__ */ new Set(), expectedLocalWebsites);
 	return {
 		changeSet: {
 			service: serviceChangeSet,
@@ -3310,7 +3332,11 @@ function normalizeComparableUserAuthPolicy(policy) {
 		allowedEmailDomains: (policy?.allowedEmailDomains ?? []).toSorted(),
 		allowGoogleOauth: policy?.allowGoogleOauth ?? false,
 		disablePasswordAuth: policy?.disablePasswordAuth ?? false,
-		allowMicrosoftOauth: policy?.allowMicrosoftOauth ?? false
+		allowMicrosoftOauth: policy?.allowMicrosoftOauth ?? false,
+		enableMfa: policy?.enableMfa ?? false,
+		requireMfa: policy?.requireMfa ?? false,
+		allowedReturnOrigins: (policy?.allowedReturnOrigins ?? []).toSorted(),
+		mfaIssuer: policy?.mfaIssuer ?? ""
 	};
 }
 function normalizeComparableDisableGqlOperations(value) {
@@ -3319,7 +3345,9 @@ function normalizeComparableDisableGqlOperations(value) {
 		update: value?.update ?? false,
 		delete: value?.delete ?? false,
 		read: value?.read ?? false,
-		sendPasswordResetEmail: value?.sendPasswordResetEmail ?? false
+		sendPasswordResetEmail: value?.sendPasswordResetEmail ?? false,
+		requestMfaSettingsUrl: value?.requestMfaSettingsUrl ?? false,
+		unenrollMfa: value?.unenrollMfa ?? false
 	};
 }
 function normalizeComparableEmailConfig(value) {
@@ -3341,7 +3369,7 @@ function normalizeComparableIdPService(input) {
 }
 function normalizeComparablePermission(permission) {
 	if (!permission) return;
-	if (permission.create.length === 0 && permission.read.length === 0 && permission.update.length === 0 && permission.delete.length === 0 && permission.sendPasswordResetEmail.length === 0) return;
+	if (permission.create.length === 0 && permission.read.length === 0 && permission.update.length === 0 && permission.delete.length === 0 && permission.sendPasswordResetEmail.length === 0 && permission.unenrollMfa.length === 0) return;
 	const normalizePolicy = (policy) => ({
 		conditions: policy.conditions.map((c) => ({
 			left: c.left ? { kind: c.left.kind } : void 0,
@@ -3356,7 +3384,8 @@ function normalizeComparablePermission(permission) {
 		read: permission.read.map(normalizePolicy),
 		update: permission.update.map(normalizePolicy),
 		delete: permission.delete.map(normalizePolicy),
-		sendPasswordResetEmail: permission.sendPasswordResetEmail.map(normalizePolicy)
+		sendPasswordResetEmail: permission.sendPasswordResetEmail.map(normalizePolicy),
+		unenrollMfa: permission.unenrollMfa.map(normalizePolicy)
 	};
 }
 function areIdPServicesEqual(existing, desired) {
@@ -3370,7 +3399,7 @@ function areIdPServicesEqual(existing, desired) {
 		permission: normalizeComparablePermission(existing.permission)
 	}), desired);
 }
-async function planServices$3(client, workspaceId, appName, appId, idps, idpUserTriggerTargets) {
+async function planServices$3(client, workspaceId, appName, appId, idps, idpUserTriggerTargets, expectedLocalWebsites) {
 	const changeSet = createChangeSet("IdP services");
 	const conflicts = [];
 	const unmanaged = [];
@@ -3432,10 +3461,15 @@ async function planServices$3(client, workspaceId, appName, appId, idps, idpUser
 		if (omittedPermitLocations.length > 0) logger.warn(`IdP service "${namespaceName}" has permission rule(s) ${omittedPermitLocations.join(", ")} in object form without an explicit "permit"; they default to "deny". Set permit: true (allow) or permit: false (deny) to silence this warning.`);
 		const parsedPermission = parseIdPPermission(idp.permission);
 		const protoPermission = parsedPermission ? protoIdPPermission(parsedPermission) : void 0;
+		const resolvedReturnOrigins = await resolveStaticWebsiteUrls(client, workspaceId, userAuthPolicy?.allowedReturnOrigins ? [...userAuthPolicy.allowedReturnOrigins] : [], `IdP service "${namespaceName}" allowedReturnOrigins`, { expectedLocalNames: expectedLocalWebsites });
+		const userAuthPolicyForCompare = userAuthPolicy ? {
+			...userAuthPolicy,
+			allowedReturnOrigins: resolvedReturnOrigins
+		} : userAuthPolicy;
 		const desired = normalizeComparableIdPService({
 			authorization,
 			lang,
-			userAuthPolicy: normalizeComparableUserAuthPolicy(userAuthPolicy),
+			userAuthPolicy: normalizeComparableUserAuthPolicy(userAuthPolicyForCompare),
 			publishUserEvents,
 			disableGqlOperations: normalizeComparableDisableGqlOperations(convertGqlOperationsToDisable(idp.gqlOperations)),
 			emailConfig: normalizeComparableEmailConfig(emailConfig),
@@ -3577,7 +3611,9 @@ function convertGqlOperationsToDisable(gqlOperations) {
 		update: gqlOperations.update === false,
 		delete: gqlOperations.delete === false,
 		read: gqlOperations.read === false,
-		sendPasswordResetEmail: gqlOperations.sendPasswordResetEmail === false
+		sendPasswordResetEmail: gqlOperations.sendPasswordResetEmail === false,
+		requestMfaSettingsUrl: gqlOperations.requestMfaSettingsUrl === false,
+		unenrollMfa: gqlOperations.unenrollMfa === false
 	};
 }
 function protoIdPPermission(permission) {
@@ -3586,7 +3622,8 @@ function protoIdPPermission(permission) {
 		read: permission.read.map((p) => protoIdPPolicy(p)),
 		update: permission.update.map((p) => protoIdPPolicy(p)),
 		delete: permission.delete.map((p) => protoIdPPolicy(p)),
-		sendPasswordResetEmail: permission.sendPasswordResetEmail.map((p) => protoIdPPolicy(p))
+		sendPasswordResetEmail: permission.sendPasswordResetEmail.map((p) => protoIdPPolicy(p)),
+		unenrollMfa: permission.unenrollMfa.map((p) => protoIdPPolicy(p))
 	};
 }
 function protoIdPPolicy(policy) {
@@ -3757,7 +3794,7 @@ async function planAuth(context) {
 		},
 		conflicts: [...conflicts, ...connectionResult.conflicts],
 		unmanaged: [...unmanaged, ...connectionResult.unmanaged],
-		resourceOwners: new Set([...resourceOwners, ...connectionResult.resourceOwners])
+		resourceOwners: /* @__PURE__ */ new Set([...resourceOwners, ...connectionResult.resourceOwners])
 	};
 }
 async function planServices$2(client, workspaceId, appName, appId, auths, forceApplyAll = false) {
@@ -6976,7 +7013,7 @@ function createSnapshotFieldConfig(field) {
 }
 /**
 * Create a snapshot field config from an OperatorFieldConfig (for nested fields)
-* @param {import("@/parser/service/tailordb/types").OperatorFieldConfig} fieldConfig - Field configuration
+* @param {import("#/parser/service/tailordb/types").OperatorFieldConfig} fieldConfig - Field configuration
 * @returns {SnapshotFieldConfig} Snapshot field configuration
 */
 function createSnapshotFieldConfigFromOperatorConfig(fieldConfig) {
@@ -7826,7 +7863,7 @@ function validateMigrationFiles(migrationsDir) {
 		message: `Schema file found at migration ${formatMigrationNumber(num)}, but schema should only exist at ${formatMigrationNumber(0)}`,
 		migrationNumber: num
 	});
-	const allNumbers = [...new Set([...schemaFiles, ...diffFiles])].toSorted((a, b) => a - b);
+	const allNumbers = [.../* @__PURE__ */ new Set([...schemaFiles, ...diffFiles])].toSorted((a, b) => a - b);
 	if (allNumbers.length === 0) return errors;
 	for (const num of schemaFiles) if (num !== 0 && diffFiles.includes(num)) errors.push({
 		type: "duplicate",
@@ -7958,7 +7995,7 @@ function compareFields(typeName, fieldName, remoteField, snapshotField) {
 /**
 * System fields that are auto-generated and should be excluded from comparison
 */
-const SYSTEM_FIELDS = new Set(["id"]);
+const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["id"]);
 /**
 * Compare remote TailorDB types with a local snapshot
 * @param {ProtoTailorDBType[]} remoteTypes - Remote types from listParsedTailorDBTypes API
@@ -8486,7 +8523,7 @@ function protoGqlOperand(operand) {
 /**
 * Diff change kinds that require pre-migration schema adjustments.
 */
-const PRE_MIGRATION_FIELD_KINDS = new Set([
+const PRE_MIGRATION_FIELD_KINDS = /* @__PURE__ */ new Set([
 	"field_added",
 	"field_modified",
 	"field_removed"
@@ -9342,7 +9379,8 @@ async function applyTailorDB(client, result, phase = "create-update") {
 				await client.setMetadata(create.metaRequest);
 			}), ...changeSet.service.updates.map((update) => client.setMetadata(update.metaRequest))]);
 			try {
-				await Promise.all([...changeSet.type.creates.map((create) => client.createTailorDBType(create.request)), ...changeSet.type.updates.map((update) => client.updateTailorDBType(update.request))]);
+				for (const create of changeSet.type.creates) await client.createTailorDBType(create.request);
+				for (const update of changeSet.type.updates) await client.updateTailorDBType(update.request);
 			} catch (error) {
 				handleOptionalToRequiredError(error, ["Run 'tailor-sdk tailordb migration generate' to create migration files.", "Migration scripts allow you to handle existing data before applying the schema change."]);
 			}
@@ -9467,53 +9505,45 @@ async function executeSingleMigrationPrePhase(client, changeSet, migration, tail
 	const preMigrationChanges = buildPreMigrationChangesMap([migration]);
 	const affectedTypes = getAffectedTypeNames(migration);
 	const createdBeforeMigration = new Set(processedTypes.created);
-	await awaitAllSettledOrThrow([
-		...changeSet.type.creates.filter((create) => {
-			const typeName = create.request.tailordbType?.name;
-			return typeName && affectedTypes.has(typeName) && !createdBeforeMigration.has(typeName);
-		}).map((create) => {
-			const typeName = create.request.tailordbType?.name;
-			const snapshotType = typeName ? buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) : void 0;
-			if (!snapshotType) return void 0;
-			if (typeName) processedTypes.created.add(typeName);
-			const clonedRequest = structuredClone(create.request);
-			clonedRequest.tailordbType = snapshotType;
-			const typeChanges = typeName ? preMigrationChanges.get(typeName) : void 0;
-			if (typeChanges && typeChanges.size > 0 && clonedRequest.tailordbType.schema?.fields) applyPreMigrationFieldAdjustments(clonedRequest.tailordbType.schema.fields, typeChanges);
-			return client.createTailorDBType(clonedRequest);
-		}),
-		...changeSet.type.creates.filter((create) => {
-			const typeName = create.request.tailordbType?.name;
-			return typeName && affectedTypes.has(typeName) && createdBeforeMigration.has(typeName);
-		}).map((create) => {
-			const typeName = create.request.tailordbType?.name;
-			const snapshotType = typeName ? buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) : void 0;
-			if (!snapshotType) return void 0;
-			if (typeName) processedTypes.updated.add(typeName);
-			const clonedTypeRequest = structuredClone(snapshotType);
-			const typeChanges = typeName ? preMigrationChanges.get(typeName) : void 0;
-			if (typeChanges && typeChanges.size > 0 && clonedTypeRequest.schema?.fields) applyPreMigrationFieldAdjustments(clonedTypeRequest.schema.fields, typeChanges);
-			return client.updateTailorDBType({
-				workspaceId: create.request.workspaceId,
-				namespaceName: create.request.namespaceName,
-				tailordbType: clonedTypeRequest
-			});
-		}),
-		...changeSet.type.updates.filter((update) => {
-			const typeName = update.request.tailordbType?.name;
-			return typeName && affectedTypes.has(typeName);
-		}).map((update) => {
-			const typeName = update.request.tailordbType?.name;
-			const snapshotType = typeName ? buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) : void 0;
-			if (!snapshotType) return void 0;
-			if (typeName) processedTypes.updated.add(typeName);
-			const clonedRequest = structuredClone(update.request);
-			clonedRequest.tailordbType = snapshotType;
-			const typeChanges = typeName ? preMigrationChanges.get(typeName) : void 0;
-			if (typeChanges && typeChanges.size > 0 && clonedRequest.tailordbType.schema?.fields) applyPreMigrationFieldAdjustments(clonedRequest.tailordbType.schema.fields, typeChanges);
-			return client.updateTailorDBType(clonedRequest);
-		})
-	]);
+	for (const create of changeSet.type.creates) {
+		const typeName = create.request.tailordbType?.name;
+		if (!typeName || !affectedTypes.has(typeName) || createdBeforeMigration.has(typeName)) continue;
+		const snapshotType = buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes);
+		if (!snapshotType) continue;
+		const clonedRequest = structuredClone(create.request);
+		clonedRequest.tailordbType = snapshotType;
+		const typeChanges = preMigrationChanges.get(typeName);
+		if (typeChanges && typeChanges.size > 0 && clonedRequest.tailordbType.schema?.fields) applyPreMigrationFieldAdjustments(clonedRequest.tailordbType.schema.fields, typeChanges);
+		processedTypes.created.add(typeName);
+		await client.createTailorDBType(clonedRequest);
+	}
+	for (const create of changeSet.type.creates) {
+		const typeName = create.request.tailordbType?.name;
+		if (!typeName || !affectedTypes.has(typeName) || !createdBeforeMigration.has(typeName)) continue;
+		const snapshotType = buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes);
+		if (!snapshotType) continue;
+		const clonedTypeRequest = structuredClone(snapshotType);
+		const typeChanges = preMigrationChanges.get(typeName);
+		if (typeChanges && typeChanges.size > 0 && clonedTypeRequest.schema?.fields) applyPreMigrationFieldAdjustments(clonedTypeRequest.schema.fields, typeChanges);
+		processedTypes.updated.add(typeName);
+		await client.updateTailorDBType({
+			workspaceId: create.request.workspaceId,
+			namespaceName: create.request.namespaceName,
+			tailordbType: clonedTypeRequest
+		});
+	}
+	for (const update of changeSet.type.updates) {
+		const typeName = update.request.tailordbType?.name;
+		if (!typeName || !affectedTypes.has(typeName)) continue;
+		const snapshotType = buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes);
+		if (!snapshotType) continue;
+		const clonedRequest = structuredClone(update.request);
+		clonedRequest.tailordbType = snapshotType;
+		const typeChanges = preMigrationChanges.get(typeName);
+		if (typeChanges && typeChanges.size > 0 && clonedRequest.tailordbType.schema?.fields) applyPreMigrationFieldAdjustments(clonedRequest.tailordbType.schema.fields, typeChanges);
+		processedTypes.updated.add(typeName);
+		await client.updateTailorDBType(clonedRequest);
+	}
 	if (!processedTypes.gqlPermissionsProcessed.has(migration.namespace)) {
 		const gqlPermissionCreatesForNamespace = changeSet.gqlPermission.creates.filter((create) => create.request.namespaceName === migration.namespace);
 		const gqlPermissionUpdatesForNamespace = changeSet.gqlPermission.updates.filter((update) => update.request.namespaceName === migration.namespace);
@@ -9522,11 +9552,11 @@ async function executeSingleMigrationPrePhase(client, changeSet, migration, tail
 			const typeName = create.request.tailordbType?.name;
 			return create.request.namespaceName === migration.namespace && typeName && gqlPermissionTypeNames.has(typeName) && !processedTypes.created.has(typeName);
 		});
-		if (missingTypeCreates.length > 0) await awaitAllSettledOrThrow(missingTypeCreates.map((create) => {
+		if (missingTypeCreates.length > 0) for (const create of missingTypeCreates) {
 			const typeName = create.request.tailordbType?.name;
 			if (typeName) processedTypes.created.add(typeName);
-			return client.createTailorDBType(create.request);
-		}));
+			await client.createTailorDBType(create.request);
+		}
 		processedTypes.gqlPermissionsProcessed.add(migration.namespace);
 		await awaitAllSettledOrThrow([...gqlPermissionCreatesForNamespace.map((create) => client.createTailorDBGQLPermission(create.request)), ...gqlPermissionUpdatesForNamespace.map((update) => client.updateTailorDBGQLPermission(update.request))]);
 	}
@@ -9556,31 +9586,28 @@ async function executeSingleMigrationPostPhase(client, changeSet, migration, tai
 	const affectedTypes = getAffectedTypeNames(migration);
 	const deletedTypeNames = getDeletedTypeNames(migration);
 	try {
-		await Promise.all([...changeSet.type.creates.filter((create) => {
-			const typeName = create.request.tailordbType?.name;
-			return typeName && affectedTypes.has(typeName) && preMigrationChanges.has(typeName);
-		}).map((create) => {
+		for (const create of changeSet.type.creates) {
 			const typeName = create.request.tailordbType?.name;
-			const snapshotType = typeName ? buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) : void 0;
-			if (!snapshotType) return void 0;
-			return client.updateTailorDBType({
+			if (!typeName || !affectedTypes.has(typeName) || !preMigrationChanges.has(typeName)) continue;
+			const snapshotType = buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes);
+			if (!snapshotType) continue;
+			await client.updateTailorDBType({
 				workspaceId: create.request.workspaceId,
 				namespaceName: create.request.namespaceName,
 				tailordbType: snapshotType
 			});
-		}), ...changeSet.type.updates.filter((update) => {
-			const typeName = update.request.tailordbType?.name;
-			return typeName && affectedTypes.has(typeName) && preMigrationChanges.has(typeName);
-		}).map((update) => {
+		}
+		for (const update of changeSet.type.updates) {
 			const typeName = update.request.tailordbType?.name;
-			const snapshotType = typeName ? buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) : void 0;
-			if (!snapshotType) return void 0;
-			return client.updateTailorDBType({
+			if (!typeName || !affectedTypes.has(typeName) || !preMigrationChanges.has(typeName)) continue;
+			const snapshotType = buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes);
+			if (!snapshotType) continue;
+			await client.updateTailorDBType({
 				workspaceId: update.request.workspaceId,
 				namespaceName: update.request.namespaceName,
 				tailordbType: snapshotType
 			});
-		})]);
+		}
 	} catch (error) {
 		handleOptionalToRequiredError(error, ["This error occurred during post-migration phase. Please check your migration script.", "Ensure all existing records have values for fields being changed to required."]);
 	}
@@ -9629,7 +9656,7 @@ async function rollbackSingleMigrationPrePhase(client, changeSet, migration, wor
 		const name = update.request.tailordbType?.name;
 		if (update.request.namespaceName === migration.namespace && name) namespaceTypes.add(name);
 	}
-	const applied = new Set([...processedTypes.created, ...processedTypes.updated]);
+	const applied = /* @__PURE__ */ new Set([...processedTypes.created, ...processedTypes.updated]);
 	const rollbackTypes = new Set([...namespaceTypes].filter((name) => applied.has(name)));
 	if (rollbackTypes.size === 0) return;
 	const priorSnapshot = reconstructSnapshotFromMigrations(migration.migrationsDir, migration.number - 1);
@@ -9950,7 +9977,7 @@ const tailordbCompareKnownDefaults = {
 	* Proto bigint-backed values can round-trip as numbers locally and strings remotely.
 	* Canonicalize them to strings at compare time.
 	*/
-	numericStringPaths: new Set([
+	numericStringPaths: /* @__PURE__ */ new Set([
 		"schema.fields.*.serial.start",
 		"schema.fields.*.serial.maxValue",
 		"schema.settings.defaultQueryLimitSize",
@@ -10530,8 +10557,13 @@ function validateItems(params) {
 *
 * Collections not validated: idp client, tailorDB gqlPermission, functionRegistry — no
 * buf.validate annotations.
-* Application cors is excluded: static-website URL placeholders are resolved at apply time
-* and a bare cors array carries no constraint that would false-positive when omitted.
+* Application cors and IdP userAuthPolicy.allowedReturnOrigins receive special
+* handling: static-website URL placeholders are resolved at apply time, so the
+* relevant origin/URL constraints would false-positive on `<name>:url` entries
+* here. Application cors is dropped entirely (no other constraint to lose); IdP
+* `allowedReturnOrigins` substitutes placeholder entries with a dummy origin so
+* the per-item regex and the cross-field `enable_mfa requires ≥1 origin` rule
+* still get exercised on the rest of the payload.
 * Workflow jobFunctions map excluded: versions are registered at apply time (registerJobFunctions)
 * and the map field carries no min_items constraint. Job names are validated separately via
 * CreateWorkflowJobFunctionRequestSchema using usedJobNames from the workflow change set.
@@ -10583,8 +10615,25 @@ async function validatePlan(input) {
 	creates(CreateStaticWebsiteRequestSchema, "StaticWebsite", staticWebsite.changeSet.creates);
 	updates(UpdateStaticWebsiteRequestSchema, "StaticWebsite", staticWebsite.changeSet.updates);
 	creates(AddCustomDomainRequestSchema, "StaticWebsite custom domain", staticWebsite.customDomainChangeSet.creates);
-	creates(CreateIdPServiceRequestSchema, "IdP service", idp.changeSet.service.creates);
-	updates(UpdateIdPServiceRequestSchema, "IdP service", idp.changeSet.service.updates);
+	const placeholderOriginReplacement = "https://placeholder.invalid";
+	const substituteIdpReturnOrigins = (item) => {
+		const request = item.request;
+		const origins = request.userAuthPolicy?.allowedReturnOrigins;
+		if (!Array.isArray(origins) || origins.length === 0) return item;
+		const substituted = origins.map((origin) => typeof origin === "string" && /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]:url$/.test(origin) ? placeholderOriginReplacement : origin);
+		return {
+			...item,
+			request: {
+				...request,
+				userAuthPolicy: {
+					...request.userAuthPolicy,
+					allowedReturnOrigins: substituted
+				}
+			}
+		};
+	};
+	creates(CreateIdPServiceRequestSchema, "IdP service", idp.changeSet.service.creates.map(substituteIdpReturnOrigins));
+	updates(UpdateIdPServiceRequestSchema, "IdP service", idp.changeSet.service.updates.map(substituteIdpReturnOrigins));
 	const idpClientVaultItems = [...idp.changeSet.client.creates.map((c) => ({
 		clientName: c.request.client?.name ?? "",
 		namespaceName: c.request.namespaceName ?? "",
@@ -10775,7 +10824,15 @@ function computeRenamedAppDeletions(params) {
 	const { conflicts, resourceOwners, targetAppName } = params;
 	return [...new Set(conflicts.map((c) => c.currentOwner))].filter((owner) => !resourceOwners.has(owner) && owner !== targetAppName);
 }
-function printPlanResults(results) {
+/**
+* Format and output the plan results, then return a summary of change counts.
+* In JSON dry-run mode a JSON payload is written to stdout. In all other modes
+* the human-readable diff goes to stdout (dry-run) or stderr (apply).
+* @param results - Planned results across all services
+* @param opts - Output options (dry-run mode flag)
+* @returns Aggregated plan summary counts
+*/
+function printPlanResults(results, opts) {
 	const executorEntries = formatExecutorChangeEntries(results.executor.changeSet, buildPlannedExecutorsByName(results.executor.changeSet), results.functionRegistry.executorFunctionChanges);
 	const resolverEntries = formatResolverChangeEntries(results.pipeline.changeSet.resolver, results.functionRegistry.resolverFunctionChanges);
 	const workflowEntries = formatWorkflowChangeEntries(results.workflow.changeSet, results.functionRegistry.workflowJobChanges);
@@ -10800,41 +10857,142 @@ function printPlanResults(results) {
 		...formatChangeSetEntries(results.auth.changeSet.connection, ["connection"], namespaceOf)
 	];
 	const { otherChanges: otherFunctionRegistryChanges } = splitFunctionRegistryChanges(results.functionRegistry.changeSet);
-	printGroupedDisplaySection(results.functionRegistry.changeSet.title, formatChangeSetEntries(otherFunctionRegistryChanges));
 	const tailorDBServiceActions = extractServiceActions(results.tailorDB.changeSet.service);
 	const pipelineServiceActions = extractServiceActions(results.pipeline.changeSet.service);
 	const idpServiceActions = extractServiceActions(results.idp.changeSet.service);
 	const authServiceActions = extractServiceActions(results.auth.changeSet.service);
-	results.staticWebsite.changeSet.print();
-	results.staticWebsite.customDomainChangeSet.print();
-	results.aiGateway.changeSet.print();
-	results.app.print();
-	printGroupedDisplaySection("TailorDB", tailorDBEntries, tailorDBServiceActions);
-	printGroupedDisplaySection("Resolver", pipelineEntries, pipelineServiceActions);
-	printGroupedDisplaySection("Executor", executorEntries);
-	printGroupedDisplaySection("Workflow", workflowEntries);
-	printGroupedDisplaySection("IdP", idpEntries, idpServiceActions);
-	printGroupedDisplaySection("Auth", authEntries, authServiceActions);
-	results.secretManager.vaultChangeSet.print();
-	results.secretManager.secretChangeSet.print();
-	if (results.secretManager.skippedSecrets.length > 0) {
-		logger.log(styles.bold("Secret Manager secrets (skipped - no value provided):"));
-		for (const name of results.secretManager.skippedSecrets) logger.log(`  ${styles.dim("○")} ${name}`);
-	}
-	const summary = summarizePlanResults(results, [
+	const allDisplayEntries = [
 		...tailorDBEntries,
 		...pipelineEntries,
 		...executorEntries,
 		...workflowEntries,
 		...idpEntries,
 		...authEntries
-	], [
+	];
+	const summary = summarizePlanResults(results, allDisplayEntries, [
 		...tailorDBServiceActions,
 		...pipelineServiceActions,
 		...idpServiceActions,
 		...authServiceActions
 	]);
-	logger.log(formatPlanSummary(summary));
+	const allUnmanaged = [
+		...results.functionRegistry.unmanaged,
+		...results.tailorDB.unmanaged,
+		...results.staticWebsite.unmanaged,
+		...results.aiGateway.unmanaged,
+		...results.idp.unmanaged,
+		...results.auth.unmanaged,
+		...results.pipeline.unmanaged,
+		...results.executor.unmanaged,
+		...results.workflow.unmanaged,
+		...results.secretManager.unmanaged
+	];
+	const allConflicts = [
+		...results.functionRegistry.conflicts,
+		...results.tailorDB.conflicts,
+		...results.staticWebsite.conflicts,
+		...results.aiGateway.conflicts,
+		...results.idp.conflicts,
+		...results.auth.conflicts,
+		...results.pipeline.conflicts,
+		...results.executor.conflicts,
+		...results.workflow.conflicts,
+		...results.secretManager.conflicts
+	];
+	if (logger.jsonMode && opts?.dryRun) {
+		const changes = [
+			...allDisplayEntries,
+			...tailorDBServiceActions.map(({ action, name }) => ({
+				action,
+				name,
+				labels: ["tailorDB"],
+				namespace: void 0
+			})),
+			...pipelineServiceActions.map(({ action, name }) => ({
+				action,
+				name,
+				labels: ["pipeline"],
+				namespace: void 0
+			})),
+			...idpServiceActions.map(({ action, name }) => ({
+				action,
+				name,
+				labels: ["idp"],
+				namespace: void 0
+			})),
+			...authServiceActions.map(({ action, name }) => ({
+				action,
+				name,
+				labels: ["auth"],
+				namespace: void 0
+			})),
+			...formatChangeSetEntries(otherFunctionRegistryChanges),
+			...formatChangeSetEntries(results.staticWebsite.changeSet, ["staticWebsite"]),
+			...formatChangeSetEntries(results.staticWebsite.customDomainChangeSet, ["customDomain"]),
+			...formatChangeSetEntries(results.aiGateway.changeSet, ["aiGateway"]),
+			...formatChangeSetEntries(results.app, ["application"]),
+			...formatChangeSetEntries(results.secretManager.vaultChangeSet, ["vault"]),
+			...formatChangeSetEntries(results.secretManager.secretChangeSet, ["secret"])
+		].map(({ action, name, labels, namespace }) => ({
+			action,
+			name,
+			labels,
+			namespace
+		}));
+		const warnings = [...allUnmanaged.map(({ resourceType, resourceName }) => ({
+			type: "unmanaged",
+			resourceType,
+			name: resourceName
+		})), ...results.secretManager.skippedSecrets.map((name) => ({
+			type: "skippedSecret",
+			resourceType: "secret",
+			name
+		}))];
+		const conflicts = allConflicts.map(({ resourceType, resourceName, currentOwner }) => ({
+			resourceType,
+			name: resourceName,
+			currentOwner
+		}));
+		logger.out({
+			summary,
+			changes,
+			warnings,
+			conflicts
+		});
+		return summary;
+	}
+	const allLines = [
+		...buildGroupedDisplayLines(results.functionRegistry.changeSet.title, formatChangeSetEntries(otherFunctionRegistryChanges)),
+		...results.staticWebsite.changeSet.lines(),
+		...results.staticWebsite.customDomainChangeSet.lines(),
+		...results.aiGateway.changeSet.lines(),
+		...results.app.lines(),
+		...buildGroupedDisplayLines("TailorDB", tailorDBEntries, tailorDBServiceActions),
+		...buildGroupedDisplayLines("Resolver", pipelineEntries, pipelineServiceActions),
+		...buildGroupedDisplayLines("Executor", executorEntries),
+		...buildGroupedDisplayLines("Workflow", workflowEntries),
+		...buildGroupedDisplayLines("IdP", idpEntries, idpServiceActions),
+		...buildGroupedDisplayLines("Auth", authEntries, authServiceActions),
+		...results.secretManager.vaultChangeSet.lines(),
+		...results.secretManager.secretChangeSet.lines()
+	];
+	if (allUnmanaged.length > 0) {
+		allLines.push(styles.bold("Unmanaged resources (not in config):"));
+		for (const { resourceType, resourceName } of allUnmanaged) allLines.push(`  ${styles.warning("⚠")} ${styles.bold(resourceType)} "${resourceName}"`);
+	}
+	if (results.secretManager.skippedSecrets.length > 0) {
+		allLines.push(styles.bold("Secret Manager secrets (skipped - no value provided):"));
+		for (const name of results.secretManager.skippedSecrets) allLines.push(`  ${styles.dim("○")} ${name}`);
+	}
+	if (allConflicts.length > 0) {
+		allLines.push(styles.bold("Owner conflicts (will require confirmation on apply):"));
+		for (const { resourceType, resourceName, currentOwner } of allConflicts) allLines.push(`  ${styles.warning("!")} ${styles.bold(resourceType)} "${resourceName}" — owned by "${currentOwner}"`);
+	}
+	allLines.push(formatPlanSummary(summary));
+	const output = allLines.join("\n");
+	if (opts?.dryRun) logger.out(output);
+	else logger.log(output);
+	return summary;
 }
 /**
 * Summarize plan counts from display entries, service actions, and non-grouped changesets.
@@ -10848,8 +11006,7 @@ function summarizePlanResults(results, displayEntries, serviceActions) {
 		create: 0,
 		update: 0,
 		delete: 0,
-		replace: 0,
-		unchanged: 0
+		replace: 0
 	};
 	for (const entry of displayEntries) summary[entry.action] += 1;
 	for (const sa of serviceActions) summary[sa.action] += 1;
@@ -11065,7 +11222,7 @@ async function deploy(options) {
 			await confirmImportantResourceDeletion(importantDeletions, yes);
 			const emptyApps = computeRenamedAppDeletions({
 				conflicts: allConflicts,
-				resourceOwners: new Set([
+				resourceOwners: /* @__PURE__ */ new Set([
 					...functionRegistry.resourceOwners,
 					...tailorDB.resourceOwners,
 					...staticWebsite.resourceOwners,
@@ -11087,7 +11244,7 @@ async function deploy(options) {
 				}
 			});
 		});
-		printPlanResults({
+		const planSummary = printPlanResults({
 			functionRegistry,
 			tailorDB,
 			staticWebsite,
@@ -11099,7 +11256,7 @@ async function deploy(options) {
 			executor,
 			workflow,
 			secretManager
-		});
+		}, { dryRun: options?.dryRun });
 		if (options?.noValidate) logger.warn("Client-side validation skipped (--no-validate).");
 		else await validatePlan({
 			functionRegistry,
@@ -11152,7 +11309,11 @@ async function deploy(options) {
 			await applyTailorDB(client, tailorDB, "delete-services");
 		});
 		await withSpan("apply.cleanup", () => applyFunctionRegistry(client, workspaceId, functionRegistry, "delete"));
-		logger.success("Successfully applied changes.");
+		if (logger.jsonMode) logger.out({
+			summary: planSummary,
+			status: "applied"
+		});
+		else logger.success("Successfully applied changes.");
 	});
 }
 
@@ -15111,31 +15272,34 @@ async function execRemove(client, workspaceId, application, config, confirm) {
 	const workflow = await planWorkflow(client, workspaceId, application.name, application.id, {}, {});
 	const functionRegistry = await planFunctionRegistry(client, workspaceId, application.name, application.id, []);
 	const secretManager = await planSecretManager(ctx);
-	functionRegistry.changeSet.print();
-	staticWebsite.changeSet.print();
-	aiGateway.changeSet.print();
-	app.print();
-	tailorDB.changeSet.service.print();
-	tailorDB.changeSet.type.print();
-	tailorDB.changeSet.gqlPermission.print();
-	pipeline.changeSet.service.print();
-	pipeline.changeSet.resolver.print();
-	executor.changeSet.print();
-	workflow.changeSet.print();
-	idp.changeSet.service.print();
-	idp.changeSet.client.print();
-	auth.changeSet.service.print();
-	auth.changeSet.idpConfig.print();
-	auth.changeSet.userProfileConfig.print();
-	auth.changeSet.tenantConfig.print();
-	auth.changeSet.machineUser.print();
-	auth.changeSet.oauth2Client.print();
-	auth.changeSet.authHook.print();
-	auth.changeSet.scim.print();
-	auth.changeSet.scimResource.print();
-	auth.changeSet.connection.print();
-	secretManager.vaultChangeSet.print();
-	secretManager.secretChangeSet.print();
+	const removeLines = [
+		...functionRegistry.changeSet.lines(),
+		...staticWebsite.changeSet.lines(),
+		...aiGateway.changeSet.lines(),
+		...app.lines(),
+		...tailorDB.changeSet.service.lines(),
+		...tailorDB.changeSet.type.lines(),
+		...tailorDB.changeSet.gqlPermission.lines(),
+		...pipeline.changeSet.service.lines(),
+		...pipeline.changeSet.resolver.lines(),
+		...executor.changeSet.lines(),
+		...workflow.changeSet.lines(),
+		...idp.changeSet.service.lines(),
+		...idp.changeSet.client.lines(),
+		...auth.changeSet.service.lines(),
+		...auth.changeSet.idpConfig.lines(),
+		...auth.changeSet.userProfileConfig.lines(),
+		...auth.changeSet.tenantConfig.lines(),
+		...auth.changeSet.machineUser.lines(),
+		...auth.changeSet.oauth2Client.lines(),
+		...auth.changeSet.authHook.lines(),
+		...auth.changeSet.scim.lines(),
+		...auth.changeSet.scimResource.lines(),
+		...auth.changeSet.connection.lines(),
+		...secretManager.vaultChangeSet.lines(),
+		...secretManager.secretChangeSet.lines()
+	];
+	if (removeLines.length > 0) logger.log(removeLines.join("\n"));
 	if (tailorDB.changeSet.service.deletes.length === 0 && staticWebsite.changeSet.deletes.length === 0 && aiGateway.changeSet.deletes.length === 0 && idp.changeSet.service.deletes.length === 0 && auth.changeSet.service.deletes.length === 0 && pipeline.changeSet.service.deletes.length === 0 && app.deletes.length === 0 && executor.changeSet.deletes.length === 0 && workflow.changeSet.deletes.length === 0 && functionRegistry.changeSet.deletes.length === 0 && secretManager.vaultChangeSet.deletes.length === 0 && secretManager.secretChangeSet.deletes.length === 0) return;
 	if (confirm) await confirm();
 	await applyWorkflow(client, workflow, "delete");
@@ -15205,6 +15369,36 @@ function logBetaWarning(featureName) {
 	logger.newline();
 }
 
+//#endregion
+//#region src/cli/shared/config.ts
+/**
+* Extracts every namespace key declared under `config.db`, including those
+* declared with `{ external: true }`.
+* @param config - Loaded application configuration.
+* @returns Namespace names in insertion order.
+*/
+function extractAllNamespaces(config) {
+	const namespaces = /* @__PURE__ */ new Set();
+	if (config.db) for (const namespaceName of Object.keys(config.db)) namespaces.add(namespaceName);
+	return Array.from(namespaces);
+}
+/**
+* Extracts namespace keys under `config.db` that this app owns
+* (i.e. not declared with `{ external: true }`). Use this for destructive
+* operations like `tailordb truncate --all` to avoid touching namespaces
+* owned by other apps.
+* @param config - Loaded application configuration.
+* @returns Owned namespace names in insertion order.
+*/
+function extractOwnedNamespaces(config) {
+	const namespaces = /* @__PURE__ */ new Set();
+	if (config.db) for (const [namespaceName, nsConfig] of Object.entries(config.db)) {
+		if ("external" in nsConfig) continue;
+		namespaces.add(namespaceName);
+	}
+	return Array.from(namespaces);
+}
+
 //#endregion
 //#region src/cli/commands/workspace/transform.ts
 const workspaceInfo = (workspace, folderName) => {
@@ -15601,7 +15795,7 @@ function formatEnumUnion(values) {
 	return values.map((v) => `"${v}"`).join(" | ");
 }
 function generateEnumChangeColumnType(enumValueChange, config) {
-	const selectType = formatEnumUnion([...new Set([...enumValueChange.beforeValues, ...enumValueChange.afterValues])]);
+	const selectType = formatEnumUnion([.../* @__PURE__ */ new Set([...enumValueChange.beforeValues, ...enumValueChange.afterValues])]);
 	const afterType = formatEnumUnion(enumValueChange.afterValues);
 	if (config.array && !config.required) return `ColumnType<(${selectType})[] | null, (${afterType})[] | null, (${afterType})[] | null>`;
 	if (config.array) return `ColumnType<(${selectType})[], (${afterType})[], (${afterType})[]>`;
@@ -15928,7 +16122,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-Djeezk3m.mjs");
+	const { defineApplication } = await import("./application-BakHtldG.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -16072,36 +16266,6 @@ const generateCommand = defineAppCommand({
 	}
 });
 
-//#endregion
-//#region src/cli/shared/config.ts
-/**
-* Extracts every namespace key declared under `config.db`, including those
-* declared with `{ external: true }`.
-* @param config - Loaded application configuration.
-* @returns Namespace names in insertion order.
-*/
-function extractAllNamespaces(config) {
-	const namespaces = /* @__PURE__ */ new Set();
-	if (config.db) for (const namespaceName of Object.keys(config.db)) namespaces.add(namespaceName);
-	return Array.from(namespaces);
-}
-/**
-* Extracts namespace keys under `config.db` that this app owns
-* (i.e. not declared with `{ external: true }`). Use this for destructive
-* operations like `tailordb truncate --all` to avoid touching namespaces
-* owned by other apps.
-* @param config - Loaded application configuration.
-* @returns Owned namespace names in insertion order.
-*/
-function extractOwnedNamespaces(config) {
-	const namespaces = /* @__PURE__ */ new Set();
-	if (config.db) for (const [namespaceName, nsConfig] of Object.entries(config.db)) {
-		if ("external" in nsConfig) continue;
-		namespaces.add(namespaceName);
-	}
-	return Array.from(namespaces);
-}
-
 //#endregion
 //#region src/cli/shared/tailordb-namespace.ts
 /**
@@ -16692,6 +16856,15 @@ const validateRegion = async (region, client) => {
 	const availableRegions = await client.listAvailableWorkspaceRegions({});
 	if (!availableRegions.regions.includes(region)) throw new Error(`Region must be one of: ${availableRegions.regions.join(", ")}.`);
 };
+function profilePlatformSettings(platformConfig) {
+	const hasOAuth2ClientId = platformConfig?.oauth2ClientId || process.env.TAILOR_PLATFORM_OAUTH2_CLIENT_ID;
+	const hasConsoleUrl = platformConfig?.consoleUrl || process.env.TAILOR_PLATFORM_CONSOLE_URL;
+	return {
+		...isDefaultPlatform(platformConfig) ? {} : { platform_url: getPlatformBaseUrl(platformConfig) },
+		...hasOAuth2ClientId ? { oauth2_client_id: getOAuth2ClientId(platformConfig) } : {},
+		...hasConsoleUrl ? { console_url: getConsoleBaseUrl(platformConfig) } : {}
+	};
+}
 /**
 * Create a new workspace with the given options.
 * @param options - Workspace creation options
@@ -16746,6 +16919,23 @@ const createCommand = defineAppCommand({
 	}).strict(),
 	run: async (args) => {
 		await assertWritable();
+		const profileName = args["profile-name"];
+		let profileSetup;
+		if (profileName) {
+			const config = await readPlatformConfig();
+			if (config.profiles[profileName]) throw new Error(`Profile "${profileName}" already exists.`);
+			const activeProfileName = process.env.TAILOR_PLATFORM_PROFILE;
+			const activeProfileEntry = activeProfileName ? config.profiles[activeProfileName] : void 0;
+			const platformConfig = activeProfileEntry ? platformConfigFromProfile(activeProfileEntry) : void 0;
+			const profileUser = args["profile-user"] || activeProfileEntry?.user || config.current_user;
+			if (!profileUser) throw new Error("Current user not found. Please login or specify --profile-user to create a profile.");
+			if (!hasUserTokenEntry(config, profileUser, platformConfig)) throw new Error(`User "${profileUser}" not found.\nPlease verify your user name and login using 'tailor-sdk login' command.`);
+			profileSetup = {
+				name: profileName,
+				user: profileUser,
+				platformSettings: profilePlatformSettings(platformConfig)
+			};
+		}
 		const workspace = await createWorkspace({
 			name: args.name,
 			region: args.region,
@@ -16754,26 +16944,26 @@ const createCommand = defineAppCommand({
 			folderId: args["folder-id"]
 		});
 		let profileInfo;
-		const profileName = args["profile-name"];
-		if (profileName) {
+		if (profileSetup) {
 			const config = await readPlatformConfig();
-			if (config.profiles[profileName]) throw new Error(`Profile "${profileName}" already exists.`);
-			const profileUser = args["profile-user"] || config.current_user;
-			if (!profileUser) throw new Error("Current user not found. Please login or specify --profile-user to create a profile.");
-			if (!config.users[profileUser]) throw new Error(`User "${profileUser}" not found.\nPlease verify your user name and login using 'tailor-sdk login' command.`);
-			config.profiles[profileName] = {
-				user: profileUser,
+			const platformSettings = profileSetup.platformSettings;
+			config.profiles[profileSetup.name] = {
+				user: profileSetup.user,
 				workspace_id: workspace.id,
-				...args.permission === "read" ? { readonly: true } : {}
+				...args.permission === "read" ? { readonly: true } : {},
+				...platformSettings
 			};
 			writePlatformConfig(config);
 			profileInfo = {
-				name: profileName,
-				user: profileUser,
+				name: profileSetup.name,
+				user: profileSetup.user,
 				workspaceId: workspace.id,
-				permission: args.permission
+				permission: args.permission,
+				...platformSettings.platform_url ? { platformUrl: platformSettings.platform_url } : {},
+				...platformSettings.oauth2_client_id ? { oauth2ClientId: platformSettings.oauth2_client_id } : {},
+				...platformSettings.console_url ? { consoleUrl: platformSettings.console_url } : {}
 			};
-			if (!args.json) logger.success(`Profile "${profileName}" created successfully.`);
+			if (!args.json) logger.success(`Profile "${profileSetup.name}" created successfully.`);
 		}
 		if (!args.json) logger.success(`Workspace "${workspaceDisplayName(workspace)}" created successfully.`);
 		if (args.json && profileInfo) {
@@ -17862,7 +18052,7 @@ async function runRepl(options) {
 	const execute = await prepareQueryExecutor(options);
 	const historyPath = getReplHistoryPath(options.engine, options.profile, options.workspaceId);
 	const validate = createReplValidator(options.engine);
-	const { highlightSqlLine, highlightGraphqlLine, replTransform } = await import("./repl-editor-CJG3sz7A.mjs");
+	const { highlightSqlLine, highlightGraphqlLine, replTransform } = await import("./repl-editor-DD5YP5mt.mjs");
 	const highlight = options.engine === "sql" ? highlightSqlLine : highlightGraphqlLine;
 	const prompt = createPrompt({
 		prefix: "",
@@ -18196,5 +18386,5 @@ function isDeno() {
 }
 
 //#endregion
-export { updateCommand$2 as $, protoGqlPermission as $t, listCommand$3 as A, apiCall as An, jobsCommand as At, show as B, toPageDirection as Bn, functionExecutionStatusToString as Bt, listCommand$2 as C, ensureConfigId as Cn, webhookCommand as Ct, waitWorkflowExecution as D, generateUserTypes as Dn, listExecutors as Dt, waitCommand as E, PluginManager as En, listCommand$9 as Et, generateCommand as F, confirmationArgs as Fn, getCommand$5 as Ft, updateCommand$1 as G, executeScript as Gt, logBetaWarning as H, getCommand$6 as Ht, generateMigrationScript as I, deploymentArgs as In, getWorkflow as It, treeCommand as J, MIGRATION_LABEL_KEY as Jt, updateOrganization as K, waitForExecution as Kt, writeDbTypesFile as L, isVerbose as Ln, executionsCommand as Lt, truncate as M, defineAppCommand as Mn, watchExecutorJob as Mt, truncateCommand as N, commonArgs as Nn, startCommand as Nt, resumeCommand as O, prompt as On, getExecutorJob as Ot, generate as P, configArg as Pn, startWorkflow as Pt, getOrganization as Q, generateAllTypeManifestsFromSnapshot as Qt, getConfiguredEditorCommand as R, pagedLogArgs as Rn, getWorkflowExecution as Rt, listApps as S, getNamespacesWithMigrations as Sn, listWebhookExecutors as St, healthCommand as T, sdkNameLabelKey as Tn, triggerExecutor as Tt, remove as U, getExecutor as Ut, showCommand as V, workspaceArgs as Vn, formatKeyValueTable as Vt, removeCommand$1 as W, deploy as Wt, listOrganizations as X, parseMigrationLabelNumber as Xt, listCommand$4 as Y, handleOptionalToRequiredError as Yt, getCommand$1 as Z, compareSnapshotWithRemote as Zt, getWorkspace as _, formatMigrationNumber as _n, generate$1 as _t, updateUser as a, assertValidMigrationFiles as an, deleteCommand$1 as at, createCommand as b, formatMigrationDiff as bn, getCommand$4 as bt, listCommand as c, createSnapshotFromLocalTypes as cn, createFolder as ct, inviteUser as d, getMigrationFilePath as dn, getCommand$3 as dt, DB_TYPES_FILE_NAME as en, updateFolder as et, restoreCommand as f, getMigrationFiles as fn, getOAuth2Client as ft, getCommand as g, reconstructSnapshotFromMigrations as gn, listMachineUsers as gt, listWorkspaces as h, loadDiff as hn, listCommand$7 as ht, updateCommand as i, SCHEMA_FILE_NAME as in, getFolder as it, listWorkflows as j, assertWritable as jn, listExecutorJobs as jt, resumeWorkflow as k, apiCommand as kn, getExecutorWaitFailureMessage as kt, listUsers as l, getLatestMigrationNumber as ln, listCommand$6 as lt, listCommand$1 as m, isValidMigrationNumber as mn, tokenCommand as mt, query as n, INITIAL_SCHEMA_NUMBER as nn, listFolders as nt, removeCommand as o, compareLocalTypesWithSnapshot as on, deleteFolder as ot, restoreWorkspace as p, getNextMigrationNumber as pn, getMachineUserToken as pt, organizationTree as q, bundleMigrationScript as qt, queryCommand as r, MIGRATE_FILE_NAME as rn, getCommand$2 as rt, removeUser as s, compareSnapshots as sn, createCommand$1 as st, isNativeTypeScriptRuntime as t, DIFF_FILE_NAME as tn, listCommand$5 as tt, inviteCommand as u, getMigrationDirPath as un, listOAuth2Clients as ut, deleteCommand as v, parseMigrationNumberArg as vn, listCommand$8 as vt, getAppHealth as w, resourceTrn as wn, triggerCommand as wt, createWorkspace as x, hasChanges as xn, getFunctionRegistry as xt, deleteWorkspace as y, formatDiffSummary as yn, listFunctionRegistries as yt, openInConfiguredEditor as z, paginationArgs as zn, listWorkflowExecutions as zt };
-//# sourceMappingURL=runtime-DxaBq6U8.mjs.map
+export { getOrganization as $, generateAllTypeManifestsFromSnapshot as $t, listCommand$3 as A, apiCommand as An, getExecutorWaitFailureMessage as At, show as B, paginationArgs as Bn, listWorkflowExecutions as Bt, listCommand$2 as C, getNamespacesWithMigrations as Cn, listWebhookExecutors as Ct, waitWorkflowExecution as D, PluginManager as Dn, listCommand$9 as Dt, waitCommand as E, sdkNameLabelKey as En, triggerExecutor as Et, generateCommand as F, configArg as Fn, startWorkflow as Ft, removeCommand$1 as G, deploy as Gt, extractOwnedNamespaces as H, workspaceArgs as Hn, formatKeyValueTable as Ht, generateMigrationScript as I, confirmationArgs as In, getCommand$5 as It, organizationTree as J, bundleMigrationScript as Jt, updateCommand$1 as K, executeScript as Kt, writeDbTypesFile as L, deploymentArgs as Ln, getWorkflow as Lt, truncate as M, assertWritable as Mn, listExecutorJobs as Mt, truncateCommand as N, defineAppCommand as Nn, watchExecutorJob as Nt, resumeCommand as O, generateUserTypes as On, listExecutors as Ot, generate as P, commonArgs as Pn, startCommand as Pt, getCommand$1 as Q, compareSnapshotWithRemote as Qt, getConfiguredEditorCommand as R, isVerbose as Rn, executionsCommand as Rt, listApps as S, hasChanges as Sn, getFunctionRegistry as St, healthCommand as T, resourceTrn as Tn, triggerCommand as Tt, logBetaWarning as U, getCommand$6 as Ut, showCommand as V, toPageDirection as Vn, functionExecutionStatusToString as Vt, remove as W, getExecutor as Wt, listCommand$4 as X, handleOptionalToRequiredError as Xt, treeCommand as Y, MIGRATION_LABEL_KEY as Yt, listOrganizations as Z, parseMigrationLabelNumber as Zt, getWorkspace as _, reconstructSnapshotFromMigrations as _n, listMachineUsers as _t, updateUser as a, SCHEMA_FILE_NAME as an, getFolder as at, createCommand as b, formatDiffSummary as bn, listFunctionRegistries as bt, listCommand as c, compareSnapshots as cn, createCommand$1 as ct, inviteUser as d, getMigrationDirPath as dn, listOAuth2Clients as dt, protoGqlPermission as en, updateCommand$2 as et, restoreCommand as f, getMigrationFilePath as fn, getCommand$3 as ft, getCommand as g, loadDiff as gn, listCommand$7 as gt, listWorkspaces as h, isValidMigrationNumber as hn, tokenCommand as ht, updateCommand as i, MIGRATE_FILE_NAME as in, getCommand$2 as it, listWorkflows as j, apiCall as jn, jobsCommand as jt, resumeWorkflow as k, prompt as kn, getExecutorJob as kt, listUsers as l, createSnapshotFromLocalTypes as ln, createFolder as lt, listCommand$1 as m, getNextMigrationNumber as mn, getMachineUserToken as mt, query as n, DIFF_FILE_NAME as nn, listCommand$5 as nt, removeCommand as o, assertValidMigrationFiles as on, deleteCommand$1 as ot, restoreWorkspace as p, getMigrationFiles as pn, getOAuth2Client as pt, updateOrganization as q, waitForExecution as qt, queryCommand as r, INITIAL_SCHEMA_NUMBER as rn, listFolders as rt, removeUser as s, compareLocalTypesWithSnapshot as sn, deleteFolder as st, isNativeTypeScriptRuntime as t, DB_TYPES_FILE_NAME as tn, updateFolder as tt, inviteCommand as u, getLatestMigrationNumber as un, listCommand$6 as ut, deleteCommand as v, formatMigrationNumber as vn, generate$1 as vt, getAppHealth as w, ensureConfigId as wn, webhookCommand as wt, createWorkspace as x, formatMigrationDiff as xn, getCommand$4 as xt, deleteWorkspace as y, parseMigrationNumberArg as yn, listCommand$8 as yt, openInConfiguredEditor as z, pagedLogArgs as zn, getWorkflowExecution as zt };
+//# sourceMappingURL=runtime-CSY0eD4_.mjs.map