@tailor-platform/sdk 1.69.0 → 1.70.1

package/dist/{runtime-jowoN6qC.mjs → runtime-BpHVwifd.mjs}

@@ -1,9 +1,9 @@
 
-import { t as db } from "./schema-1msIhXwA.mjs";
-import { $ as CreateUserProfileConfigRequestSchema, A as UpdatePipelineServiceRequestSchema, At as PageDirection, B as UpdateExecutorExecutorRequestSchema, Ct as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, D as CreatePipelineResolverRequestSchema, Dt as ConditionSchema, E as UpdateSecretManagerSecretRequestSchema, Et as Subgraph_ServiceType, F as IdPPermissionOperator, G as CreateAuthHookRequestSchema, H as ExecutorTargetType, I as IdPPermissionPermit, J as CreateAuthOAuth2ClientRequestSchema, K as CreateAuthIDPConfigRequestSchema, L as FunctionExecution_Status, M as CreateIdPServiceRequestSchema, N as UpdateIdPServiceRequestSchema, O as CreatePipelineServiceRequestSchema, Ot as Condition_Operator, P as IdPLang, Q as CreateTenantConfigRequestSchema, S as UpdateStaticWebsiteRequestSchema, St as CreateApplicationRequestSchema, T as CreateSecretManagerVaultRequestSchema, Tt as ApplicationSchemaUpdateAttemptStatus, U as ExecutorTriggerType, V as ExecutorJobStatus, W as CreateAuthConnectionRequestSchema, X as CreateAuthSCIMResourceRequestSchema, Y as CreateAuthSCIMConfigRequestSchema, Z as CreateAuthServiceRequestSchema, _ as TailorDBType_Permission_Operator, _t as AuthSCIMAttribute_Uniqueness, a as WorkspacePlatformUserRole, at as UpdateAuthSCIMResourceRequestSchema, b as AddCustomDomainRequestSchema, bt as TenantProviderConfig_TenantProviderType, c as UpdateWorkflowRequestSchema, ct as UpdateUserProfileConfigRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as AuthIDPConfig_AuthType, et as UpdateAuthHookRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as AuthInvokerSchema, g as TailorDBGQLPermission_Permit, gt as AuthSCIMAttribute_Type, h as TailorDBGQLPermission_Operator, ht as AuthSCIMAttribute_Mutability, it as UpdateAuthSCIMConfigRequestSchema, j as PipelineResolver_OperationType, k as UpdatePipelineResolverRequestSchema, kt as FilterSchema, l as WorkflowExecution_Status, lt as AuthConnection_Type, m as TailorDBGQLPermission_Action, mt as AuthOAuth2Client_GrantType, nt as UpdateAuthMachineUserRequestSchema, o as CreateWorkflowJobFunctionRequestSchema, ot as UpdateAuthServiceRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as AuthOAuth2Client_ClientType, q as CreateAuthMachineUserRequestSchema, rt as UpdateAuthOAuth2ClientRequestSchema, s as CreateWorkflowRequestSchema, st as UpdateTenantConfigRequestSchema, t as OperatorService, tt as UpdateAuthIDPConfigRequestSchema, u as WorkflowJobExecution_Status, ut as AuthHookPoint, v as TailorDBType_Permission_Permit, vt as AuthSCIMConfig_AuthorizationType, w as CreateSecretManagerSecretRequestSchema, wt as UpdateApplicationRequestSchema, x as CreateStaticWebsiteRequestSchema, xt as UserProfileProviderConfig_UserProfileProviderType, y as TailorDBType_PermitAction, z as CreateExecutorExecutorRequestSchema } from "./service_pb-DSNjrcbW.mjs";
+import { t as db } from "./schema-C4fkpWV_.mjs";
+import { $ as CreateUserProfileConfigRequestSchema, A as UpdatePipelineServiceRequestSchema, At as Condition_Operator, B as UpdateExecutorExecutorRequestSchema, Ct as UserProfileProviderConfig_UserProfileProviderType, D as CreatePipelineResolverRequestSchema, Dt as ApplicationSchemaUpdateAttemptStatus, E as UpdateSecretManagerSecretRequestSchema, Et as UpdateApplicationRequestSchema, F as IdPPermissionOperator, G as CreateAuthHookRequestSchema, H as ExecutorTargetType, I as IdPPermissionPermit, J as CreateAuthOAuth2ClientRequestSchema, K as CreateAuthIDPConfigRequestSchema, L as FunctionExecution_Status, M as CreateIdPServiceRequestSchema, Mt as PageDirection, N as UpdateIdPServiceRequestSchema, O as CreatePipelineServiceRequestSchema, Ot as Subgraph_ServiceType, P as IdPLang, Q as CreateTenantConfigRequestSchema, S as UpdateStaticWebsiteRequestSchema, St as TenantProviderConfig_TenantProviderType, T as CreateSecretManagerVaultRequestSchema, Tt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, U as ExecutorTriggerType, V as ExecutorJobStatus, W as CreateAuthConnectionRequestSchema, X as CreateAuthSCIMResourceRequestSchema, Y as CreateAuthSCIMConfigRequestSchema, Z as CreateAuthServiceRequestSchema, _ as TailorDBType_Permission_Operator, _t as AuthSCIMAttribute_Mutability, a as WorkspacePlatformUserRole, at as UpdateAuthSCIMConfigRequestSchema, b as AddCustomDomainRequestSchema, bt as AuthSCIMConfig_AuthorizationType, c as UpdateWorkflowRequestSchema, ct as UpdateTenantConfigRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as AuthConnection_Type, et as UpdateAuthConnectionRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as AuthHookPoint, g as TailorDBGQLPermission_Permit, gt as AuthOAuth2Client_GrantType, h as TailorDBGQLPermission_Operator, ht as AuthOAuth2Client_ClientType, it as UpdateAuthOAuth2ClientRequestSchema, j as PipelineResolver_OperationType, jt as FilterSchema, k as UpdatePipelineResolverRequestSchema, kt as ConditionSchema, l as WorkflowExecution_Status, lt as UpdateUserProfileConfigRequestSchema, m as TailorDBGQLPermission_Action, mt as AuthInvokerSchema, nt as UpdateAuthIDPConfigRequestSchema, o as CreateWorkflowJobFunctionRequestSchema, ot as UpdateAuthSCIMResourceRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as AuthIDPConfig_AuthType, q as CreateAuthMachineUserRequestSchema, rt as UpdateAuthMachineUserRequestSchema, s as CreateWorkflowRequestSchema, st as UpdateAuthServiceRequestSchema, t as OperatorService, tt as UpdateAuthHookRequestSchema, u as WorkflowJobExecution_Status, ut as AuthConnection_Status, v as TailorDBType_Permission_Permit, vt as AuthSCIMAttribute_Type, w as CreateSecretManagerSecretRequestSchema, wt as CreateApplicationRequestSchema, x as CreateStaticWebsiteRequestSchema, y as TailorDBType_PermitAction, yt as AuthSCIMAttribute_Uniqueness, z as CreateExecutorExecutorRequestSchema } from "./service_pb-BsBR6yW5.mjs";
 import { t as assertDefined } from "./assert-CKfwrmCV.mjs";
 import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-DKF-JsAK.mjs";
-import { A as loadMachineUserName, F as writePlatformConfig, G as resolveStaticWebsiteUrls, K as byName, L as fetchAll, M as readPlatformConfig, O as loadAccessToken, R as fetchMachineUserToken, S as getDistDir, T as loadConfig, U as initOperatorClient, W as platformBaseUrl, b as hasGenerationHooks, d as assertUniqueLocalTailorDBTypeNames, f as assertUniqueTailorDBTypeNamesWithExternal, h as platformBundleDefinePlugin, j as loadWorkspaceId, k as loadConfigPath, l as buildExecutorArgsExpr, m as stringifyFunction, n as generatePluginFilesIfNeeded, p as TailorDBTypeSchema, r as loadApplication, s as HTTP_METHODS, t as defineApplication, u as buildResolverOperationHookExpr, w as hashFile, x as createBundleCache, y as getPluginGenerationDependencies, z as fetchPaged } from "./application-Cr-limKC.mjs";
+import { $ as initOperatorClient, A as loadAccessToken, G as fetchMachineUserToken, I as loadWorkspaceId, K as fetchPaged, L as platformConfigFromProfile, N as loadMachineUserName, P as loadPlatformClientConfig, R as readPlatformConfig, S as getDistDir, T as loadConfig, V as writePlatformConfig, W as fetchAll, X as getOAuth2ClientId, Y as getConsoleBaseUrl, Z as getPlatformBaseUrl, b as hasGenerationHooks, d as assertUniqueLocalTailorDBTypeNames, et as isDefaultPlatform, f as assertUniqueTailorDBTypeNamesWithExternal, h as platformBundleDefinePlugin, j as loadConfigPath, k as hasUserTokenEntry, l as buildExecutorArgsExpr, m as stringifyFunction, n as generatePluginFilesIfNeeded, nt as byName, p as TailorDBTypeSchema, r as loadApplication, s as HTTP_METHODS, t as defineApplication, tt as resolveStaticWebsiteUrls, u as buildResolverOperationHookExpr, w as hashFile, x as createBundleCache, y as getPluginGenerationDependencies } from "./application-DmjIKQ-a.mjs";
 import { o as loadFilesWithIgnores, t as createExecutorService } from "./service-B2Jd9CxS.mjs";
 import { t as multiline } from "./multiline-Cf9ODpr1.mjs";
 import { t as readPackageJson } from "./package-json-DcQApfPQ.mjs";
@@ -310,6 +310,10 @@ async function assertWritable(opts) {
 
 //#endregion
 //#region src/cli/commands/api/api-call.ts
+function hasEnvAccessToken() {
+	const envToken = process.env.TAILOR_PLATFORM_TOKEN ?? process.env.TAILOR_TOKEN;
+	return Boolean(envToken);
+}
 /**
 * Call Tailor Platform API endpoints directly.
 * If the endpoint doesn't contain "/", it defaults to `tailor.v1.OperatorService/{endpoint}`.
@@ -318,10 +322,16 @@ async function assertWritable(opts) {
 */
 async function apiCall(options) {
 	const accessToken = await loadAccessToken({ profile: options.profile });
+	let platformConfig;
+	try {
+		platformConfig = await loadPlatformClientConfig({ profile: options.profile });
+	} catch (error) {
+		if (!hasEnvAccessToken()) throw error;
+	}
 	let endpointPath;
 	if (options.endpoint.includes("/")) endpointPath = options.endpoint;
 	else endpointPath = `tailor.v1.OperatorService/${options.endpoint}`;
-	const url = new URL(endpointPath, platformBaseUrl);
+	const url = new URL(endpointPath, getPlatformBaseUrl(platformConfig));
 	const response = await fetch(url.toString(), {
 		method: "POST",
 		headers: {
@@ -1594,7 +1604,7 @@ function copyMetadataToExtendedType(original, extended) {
 /**
 * Create a new ChangeSet for tracking resource changes.
 * @param title - Title for the change set
-* @returns Empty ChangeSet instance with isEmpty() and print() methods
+* @returns Empty ChangeSet instance with isEmpty() and lines() methods
 */
 function createChangeSet(title) {
 	const creates = [];
@@ -1611,17 +1621,16 @@ function createChangeSet(title) {
 		replaces,
 		unchanged,
 		isEmpty,
-		print: () => {
-			if (isEmpty()) return;
-			logger.log(styles.bold(`${title}:`));
-			const printItem = (symbol, item) => {
-				logger.log(`  ${symbol} ${item.name}`);
-				for (const detail of item.details ?? []) logger.log(`    ${detail}`);
-			};
-			creates.forEach((item) => printItem(symbols.create, item));
-			deletes.forEach((item) => printItem(symbols.delete, item));
-			updates.forEach((item) => printItem(symbols.update, item));
-			replaces.forEach((item) => printItem(symbols.replace, item));
+		lines: () => {
+			if (isEmpty()) return [];
+			const itemLines = (symbol) => (item) => [`  ${symbol} ${item.name}`, ...(item.details ?? []).map((d) => `    ${d}`)];
+			return [
+				styles.bold(`${title}:`),
+				...creates.flatMap(itemLines(symbols.create)),
+				...deletes.flatMap(itemLines(symbols.delete)),
+				...updates.flatMap(itemLines(symbols.update)),
+				...replaces.flatMap(itemLines(symbols.replace))
+			];
 		}
 	};
 }
@@ -1635,15 +1644,13 @@ function summarizeChangeSets(changeSets) {
 		create: 0,
 		update: 0,
 		delete: 0,
-		replace: 0,
-		unchanged: 0
+		replace: 0
 	};
 	for (const changeSet of changeSets) {
 		summary.create += changeSet.creates.length;
 		summary.update += changeSet.updates.length;
 		summary.delete += changeSet.deletes.length;
 		summary.replace += changeSet.replaces.length;
-		summary.unchanged += changeSet.unchanged.length;
 	}
 	return summary;
 }
@@ -2353,21 +2360,28 @@ function buildConnectionRequest(workspaceId, name, config) {
 		}
 	};
 }
-function hashConnectionConfig(config) {
-	return hashValue(JSON.stringify({
-		type: config.type,
-		providerUrl: config.providerUrl,
-		issuerUrl: config.issuerUrl,
-		clientId: config.clientId,
-		clientSecret: config.clientSecret,
-		authUrl: config.authUrl ?? "",
-		tokenUrl: config.tokenUrl ?? ""
-	}));
-}
-function hasNonSecretFieldChanged(existing, desired) {
-	if (existing.config.case !== "oauth2") return true;
-	const oauth2 = existing.config.value;
-	return oauth2.providerUrl !== desired.providerUrl || oauth2.issuerUrl !== desired.issuerUrl || oauth2.clientId !== desired.clientId || oauth2.authUrl !== (desired.authUrl ?? "") || oauth2.tokenUrl !== (desired.tokenUrl ?? "");
+function buildUpdateMask(existing, desired, secretChanged) {
+	if (existing.config.case !== "oauth2") {
+		const paths = [
+			"type",
+			"oauth2.provider_url",
+			"oauth2.issuer_url",
+			"oauth2.client_id",
+			"oauth2.auth_url",
+			"oauth2.token_url"
+		];
+		if (desired.clientSecret) paths.push("oauth2.client_secret");
+		return { paths };
+	}
+	const paths = [];
+	const v = existing.config.value;
+	if (v.providerUrl !== desired.providerUrl) paths.push("oauth2.provider_url");
+	if (v.issuerUrl !== desired.issuerUrl) paths.push("oauth2.issuer_url");
+	if (v.clientId !== desired.clientId) paths.push("oauth2.client_id");
+	if (v.authUrl !== (desired.authUrl ?? "")) paths.push("oauth2.auth_url");
+	if (v.tokenUrl !== (desired.tokenUrl ?? "")) paths.push("oauth2.token_url");
+	if (secretChanged && desired.clientSecret) paths.push("oauth2.client_secret");
+	return { paths };
 }
 /**
 * Plan auth connection changes based on current and desired state.
@@ -2425,15 +2439,14 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 				resourceType: "Auth connection",
 				resourceName: name
 			});
-			const currentHash = hashConnectionConfig(config);
-			const storedHash = state.connections?.[name];
-			if (hasNonSecretFieldChanged(existing.resource, config) || currentHash !== storedHash) changeSet.replaces.push({
+			const secretChanged = hashValue(config.clientSecret) !== state.connections?.[name];
+			const updateMask = buildUpdateMask(existing.resource, config, secretChanged);
+			if (updateMask.paths.length > 0) changeSet.replaces.push({
 				name,
-				deleteRequest: {
-					workspaceId,
-					connectionName: name
+				updateRequest: {
+					...buildConnectionRequest(workspaceId, name, config),
+					updateMask
 				},
-				createRequest: buildConnectionRequest(workspaceId, name, config),
 				metaRequest
 			});
 			else if (!existing.label) changeSet.updates.push({
@@ -2470,21 +2483,6 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 		resourceOwners
 	};
 }
-function extractOAuth2Config(connection) {
-	if (!connection) return void 0;
-	const config = connection.config;
-	if (!config || config.case !== "oauth2") return void 0;
-	const v = config.value;
-	return {
-		type: "oauth2",
-		providerUrl: v.providerUrl ?? "",
-		issuerUrl: v.issuerUrl ?? "",
-		clientId: v.clientId ?? "",
-		clientSecret: v.clientSecret ?? "",
-		authUrl: v.authUrl || void 0,
-		tokenUrl: v.tokenUrl || void 0
-	};
-}
 /**
 * Apply auth connection changes for the given phase.
 * @param client - Operator client instance
@@ -2497,10 +2495,10 @@ async function applyAuthConnections(client, result, phase) {
 		await Promise.all(changeSet.creates.map(async (create) => {
 			await client.createAuthConnection(create.request);
 			await client.setMetadata(create.metaRequest);
+			logger.info(`Connection "${create.name}" was created. Authorize it with:\n  tailor-sdk authconnection authorize --name ${create.name}\nOr via the Console: tailor-sdk authconnection open`);
 		}));
 		for (const replace of changeSet.replaces) {
-			await client.deleteAuthConnection(replace.deleteRequest);
-			await client.createAuthConnection(replace.createRequest);
+			if ((await client.updateAuthConnection(replace.updateRequest)).connection?.status === AuthConnection_Status.UNAUTHORIZED) logger.warn(`Connection "${replace.name}" requires re-authorization. Authorize with:\n  tailor-sdk authconnection authorize --name ${replace.name}\nOr via the Console: tailor-sdk authconnection open`);
 			await client.setMetadata(replace.metaRequest);
 		}
 		await Promise.all(changeSet.updates.map(async (update) => {
@@ -2509,12 +2507,12 @@ async function applyAuthConnections(client, result, phase) {
 		const state = loadSecretsState();
 		if (!state.connections) state.connections = {};
 		for (const create of changeSet.creates) {
-			const oauth2 = extractOAuth2Config(create.request.connection);
-			if (oauth2) state.connections[create.name] = hashConnectionConfig(oauth2);
+			const conn = create.request.connection;
+			if (conn?.config?.case === "oauth2") state.connections[create.name] = hashValue(conn.config.value.clientSecret ?? "");
 		}
 		for (const replace of changeSet.replaces) {
-			const oauth2 = extractOAuth2Config(replace.createRequest.connection);
-			if (oauth2) state.connections[replace.name] = hashConnectionConfig(oauth2);
+			const conn = replace.updateRequest.connection;
+			if (conn?.config?.case === "oauth2" && replace.updateRequest.updateMask?.paths?.includes("oauth2.client_secret")) state.connections[replace.name] = hashValue(conn.config.value.clientSecret ?? "");
 		}
 		saveSecretsState(state);
 	} else {
@@ -3047,18 +3045,19 @@ function extractServiceActions(changeSet) {
 	];
 }
 /**
-* Print a titled section of grouped display entries, nesting by namespace.
+* Build display lines for a titled section of grouped entries, nesting by namespace.
 * Service-level changes are shown as the namespace header symbol.
 * Services without child entries are shown as flat entries.
 * @param title - Section title
-* @param entries - Entries to print (should NOT include service entries)
+* @param entries - Entries to render (should NOT include service entries)
 * @param serviceActions - Optional service-level actions to merge into namespace headers
+* @returns Lines ready for output; empty array when there is nothing to show
 */
-function printGroupedDisplaySection(title, entries, serviceActions) {
+function buildGroupedDisplayLines(title, entries, serviceActions) {
 	const serviceMap = /* @__PURE__ */ new Map();
 	if (serviceActions) for (const sa of serviceActions) serviceMap.set(sa.name, sa.action);
-	if (entries.length === 0 && serviceMap.size === 0) return;
-	logger.log(styles.bold(`${title}:`));
+	if (entries.length === 0 && serviceMap.size === 0) return [];
+	const out = [styles.bold(`${title}:`)];
 	const namespaceOrder = [];
 	const byNamespace = /* @__PURE__ */ new Map();
 	for (const entry of entries) {
@@ -3075,12 +3074,13 @@ function printGroupedDisplaySection(title, entries, serviceActions) {
 		if (ns) {
 			const svcAction = serviceMap.get(ns);
 			const prefix = svcAction ? `${ACTION_SYMBOLS[svcAction]} ` : "";
-			logger.log(`  ${prefix}${styles.bold(`${ns}:`)}`);
+			out.push(`  ${prefix}${styles.bold(`${ns}:`)}`);
 			printedServices.add(ns);
-			for (const entry of group) logger.log(`    ${formatGroupedDisplayLine(entry)}`);
-		} else for (const entry of group) logger.log(`  ${formatGroupedDisplayLine(entry)}`);
+			for (const entry of group) out.push(`    ${formatGroupedDisplayLine(entry)}`);
+		} else for (const entry of group) out.push(`  ${formatGroupedDisplayLine(entry)}`);
 	}
-	for (const [name, action] of serviceMap) if (!printedServices.has(name)) logger.log(`  ${ACTION_SYMBOLS[action]} ${name}`);
+	for (const [name, action] of serviceMap) if (!printedServices.has(name)) out.push(`  ${ACTION_SYMBOLS[action]} ${name}`);
+	return out;
 }
 
 //#endregion
@@ -6554,6 +6554,23 @@ function parseMigrationNumberArg(numberStr) {
 * All object schemas use `z.looseObject` so that unknown keys written
 * by newer CLI versions survive a load → save round-trip.
 */
+function snapshotRecordSchema(valueSchema) {
+	return z.custom((value) => typeof value === "object" && value !== null && !Array.isArray(value), { message: "Expected record" }).transform((value, ctx) => {
+		const record = Object.create(null);
+		for (const key of Object.keys(value)) {
+			const result = valueSchema.safeParse(value[key]);
+			if (!result.success) {
+				for (const issue of result.error.issues) ctx.addIssue({
+					...issue,
+					path: [key, ...issue.path]
+				});
+				continue;
+			}
+			record[key] = result.data;
+		}
+		return record;
+	});
+}
 const snapshotHookSchema = z.looseObject({ expr: z.string() });
 const snapshotValidationSchema = z.looseObject({
 	script: z.looseObject({ expr: z.string() }).optional(),
@@ -6587,7 +6604,7 @@ const snapshotFieldConfigSchema = z.looseObject({
 	validate: z.array(snapshotValidationSchema).optional(),
 	serial: snapshotSerialSchema.optional(),
 	scale: z.number().optional(),
-	fields: z.lazy(() => z.record(z.string(), snapshotFieldConfigSchema)).optional()
+	fields: z.lazy(() => snapshotRecordSchema(snapshotFieldConfigSchema)).optional()
 });
 const snapshotIndexConfigSchema = z.looseObject({
 	fields: z.array(z.string()),
@@ -6658,7 +6675,7 @@ const tailorDBSnapshotTypeSchema = z.looseObject({
 	name: z.string(),
 	pluralForm: z.string().optional(),
 	description: z.string().optional(),
-	fields: z.record(z.string(), snapshotFieldConfigSchema),
+	fields: snapshotRecordSchema(snapshotFieldConfigSchema),
 	settings: z.looseObject({
 		aggregation: z.boolean().optional(),
 		bulkUpsert: z.boolean().optional(),
@@ -6670,10 +6687,10 @@ const tailorDBSnapshotTypeSchema = z.looseObject({
 		}).optional(),
 		publishEvents: z.boolean().optional()
 	}).optional(),
-	indexes: z.record(z.string(), snapshotIndexConfigSchema).optional(),
-	files: z.record(z.string(), z.string()).optional(),
-	forwardRelationships: z.record(z.string(), snapshotRelationshipSchema).optional(),
-	backwardRelationships: z.record(z.string(), snapshotRelationshipSchema).optional(),
+	indexes: snapshotRecordSchema(snapshotIndexConfigSchema).optional(),
+	files: snapshotRecordSchema(z.string()).optional(),
+	forwardRelationships: snapshotRecordSchema(snapshotRelationshipSchema).optional(),
+	backwardRelationships: snapshotRecordSchema(snapshotRelationshipSchema).optional(),
 	permissions: z.looseObject({
 		record: snapshotRecordPermissionSchema.optional(),
 		gql: snapshotGqlPermissionSchema.optional()
@@ -6683,11 +6700,11 @@ const schemaSnapshotSchema = z.looseObject({
 	version: z.number(),
 	namespace: z.string(),
 	createdAt: z.string(),
-	types: z.record(z.string(), tailorDBSnapshotTypeSchema)
+	types: snapshotRecordSchema(tailorDBSnapshotTypeSchema)
 });
 const typeSettingsPatchSchema = z.looseObject({
-	indexes: z.record(z.string(), snapshotIndexConfigSchema).optional(),
-	files: z.record(z.string(), z.string()).optional()
+	indexes: snapshotRecordSchema(snapshotIndexConfigSchema).optional(),
+	files: snapshotRecordSchema(z.string()).optional()
 });
 const snapshotPermissionStateSchema = z.looseObject({
 	recordPermission: snapshotRecordPermissionSchema.optional(),
@@ -6893,16 +6910,26 @@ const MIGRATION_NUMBER_PATTERN = /^\d{4}$/;
 * Must stay in sync with the platform's default decimal scale.
 */
 const DEFAULT_DECIMAL_SCALE = 6;
+function createSnapshotRecord() {
+	return Object.create(null);
+}
+function copySnapshotRecord(record) {
+	const copy = createSnapshotRecord();
+	for (const [key, value] of Object.entries(record ?? {})) copy[key] = value;
+	return copy;
+}
 /**
 * Normalize a snapshot field in place so the snapshot becomes the canonical
 * form for comparison. Currently fills in the platform default decimal scale
 * when omitted, which avoids false drift between local schemas (where scale
 * may be omitted) and the platform (which always materializes a scale).
 * @param {SnapshotFieldConfig} field - Field configuration to normalize
+* @returns The same field object after normalization
 */
 function normalizeSnapshotField(field) {
 	if (field.type === "decimal" && field.scale === void 0) field.scale = 6;
 	if (field.fields) for (const nested of Object.values(field.fields)) normalizeSnapshotField(nested);
+	return field;
 }
 /**
 * Normalize a snapshot type in place to the canonical comparison shape.
@@ -6913,10 +6940,21 @@ function normalizeSnapshotField(field) {
 *
 * Idempotent — safe to call multiple times on the same input.
 * @param {TailorDBSnapshotType} type - Snapshot type to normalize
+* @returns The same snapshot type object after normalization
 */
 function normalizeSnapshotType(type) {
 	if (!type.pluralForm) type.pluralForm = inflection.pluralize(type.name);
 	for (const field of Object.values(type.fields)) normalizeSnapshotField(field);
+	return type;
+}
+/**
+* Normalize a schema snapshot in place to the canonical comparison shape.
+* @param {SchemaSnapshot} snapshot - Schema snapshot to normalize
+* @returns The same schema snapshot object branded as normalized
+*/
+function normalizeSchemaSnapshot(snapshot) {
+	for (const type of Object.values(snapshot.types)) normalizeSnapshotType(type);
+	return snapshot;
 }
 /**
 * Validate that a migration number follows the expected format (4-digit number)
@@ -7054,7 +7092,7 @@ function createSnapshotFieldConfigFromOperatorConfig(fieldConfig) {
 * @returns {TailorDBSnapshotType} Snapshot type configuration
 */
 function createSnapshotType(type) {
-	const fields = {};
+	const fields = createSnapshotRecord();
 	for (const [fieldName, field] of Object.entries(type.fields)) fields[fieldName] = createSnapshotFieldConfig(field);
 	const snapshotType = {
 		name: type.name,
@@ -7118,7 +7156,7 @@ function createSnapshotType(type) {
 			...policy.description && { description: policy.description }
 		}));
 	}
-	return snapshotType;
+	return normalizeSnapshotType(snapshotType);
 }
 /**
 * Convert an action permission to snapshot format
@@ -7136,22 +7174,22 @@ function convertActionPermission(permission) {
 * Create a schema snapshot from local type definitions
 * @param {Record<string, TailorDBType>} types - Local type definitions
 * @param {string} namespace - Namespace for the snapshot
-* @returns {SchemaSnapshot} Schema snapshot
+* @returns {NormalizedSchemaSnapshot} Normalized schema snapshot
 */
 function createSnapshotFromLocalTypes(types, namespace) {
-	const snapshotTypes = {};
+	const snapshotTypes = createSnapshotRecord();
 	for (const [typeName, type] of Object.entries(types)) snapshotTypes[typeName] = createSnapshotType(type);
-	return {
+	return normalizeSchemaSnapshot({
 		version: 1,
 		namespace,
 		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 		types: snapshotTypes
-	};
+	});
 }
 /**
 * Load a schema snapshot from a file
 * @param {string} filePath - Path to the snapshot file
-* @returns {SchemaSnapshot} Loaded schema snapshot
+* @returns {NormalizedSchemaSnapshot} Loaded normalized schema snapshot
 */
 function loadSnapshot(filePath) {
 	const content = fs$1.readFileSync(filePath, "utf-8");
@@ -7164,8 +7202,7 @@ function loadSnapshot(filePath) {
 	const result = schemaSnapshotSchema.safeParse(raw);
 	if (!result.success) throw new Error(`Invalid schema snapshot at ${filePath}: ${z.prettifyError(result.error)}`, { cause: result.error });
 	const snapshot = result.data;
-	for (const type of Object.values(snapshot.types)) normalizeSnapshotType(type);
-	return snapshot;
+	return normalizeSchemaSnapshot(snapshot);
 }
 /**
 * Load a migration diff from a file
@@ -7234,10 +7271,10 @@ function getNextMigrationNumber(migrationsDir) {
 * Apply a diff to a snapshot to get the resulting snapshot
 * @param {SchemaSnapshot} snapshot - Base snapshot to apply diff to
 * @param {MigrationDiff} diff - Diff to apply
-* @returns {SchemaSnapshot} Resulting snapshot after applying diff
+* @returns {NormalizedSchemaSnapshot} Normalized snapshot after applying diff
 */
 function applyDiffToSnapshot(snapshot, diff) {
-	const types = { ...snapshot.types };
+	const types = copySnapshotRecord(snapshot.types);
 	for (const change of diff.changes) switch (change.kind) {
 		case "type_added":
 			types[change.typeName] = change.after;
@@ -7260,19 +7297,21 @@ function applyDiffToSnapshot(snapshot, diff) {
 		case "field_added":
 		case "field_modified": {
 			const existing = types[change.typeName];
-			if (existing) types[change.typeName] = {
-				...existing,
-				fields: {
-					...existing.fields,
-					[change.fieldName]: change.after
-				}
-			};
+			if (existing) {
+				const fields = copySnapshotRecord(existing.fields);
+				fields[change.fieldName] = change.after;
+				types[change.typeName] = {
+					...existing,
+					fields
+				};
+			}
 			break;
 		}
 		case "field_removed": {
 			const existing = types[change.typeName];
 			if (existing) {
-				const { [change.fieldName]: _, ...remainingFields } = existing.fields;
+				const remainingFields = copySnapshotRecord(existing.fields);
+				delete remainingFields[change.fieldName];
 				types[change.typeName] = {
 					...existing,
 					fields: remainingFields
@@ -7283,19 +7322,21 @@ function applyDiffToSnapshot(snapshot, diff) {
 		case "index_added":
 		case "index_modified": {
 			const existing = types[change.typeName];
-			if (existing) types[change.typeName] = {
-				...existing,
-				indexes: {
-					...existing.indexes,
-					[change.indexName]: change.after
-				}
-			};
+			if (existing) {
+				const indexes = copySnapshotRecord(existing.indexes);
+				indexes[change.indexName] = change.after;
+				types[change.typeName] = {
+					...existing,
+					indexes
+				};
+			}
 			break;
 		}
 		case "index_removed": {
 			const existing = types[change.typeName];
 			if (existing && existing.indexes) {
-				const { [change.indexName]: _, ...remainingIndexes } = existing.indexes;
+				const remainingIndexes = copySnapshotRecord(existing.indexes);
+				delete remainingIndexes[change.indexName];
 				types[change.typeName] = {
 					...existing,
 					indexes: Object.keys(remainingIndexes).length > 0 ? remainingIndexes : void 0
@@ -7306,19 +7347,21 @@ function applyDiffToSnapshot(snapshot, diff) {
 		case "file_added":
 		case "file_modified": {
 			const existing = types[change.typeName];
-			if (existing) types[change.typeName] = {
-				...existing,
-				files: {
-					...existing.files,
-					[change.fieldName]: change.after
-				}
-			};
+			if (existing) {
+				const files = copySnapshotRecord(existing.files);
+				files[change.fieldName] = change.after;
+				types[change.typeName] = {
+					...existing,
+					files
+				};
+			}
 			break;
 		}
 		case "file_removed": {
 			const existing = types[change.typeName];
 			if (existing && existing.files) {
-				const { [change.fieldName]: _, ...remainingFiles } = existing.files;
+				const remainingFiles = copySnapshotRecord(existing.files);
+				delete remainingFiles[change.fieldName];
 				types[change.typeName] = {
 					...existing,
 					files: Object.keys(remainingFiles).length > 0 ? remainingFiles : void 0
@@ -7331,20 +7374,21 @@ function applyDiffToSnapshot(snapshot, diff) {
 			const existing = types[change.typeName];
 			if (existing) {
 				const rel = change.after;
-				if ((change.relationshipType ?? (existing.forwardRelationships?.[change.relationshipName] ? "forward" : existing.backwardRelationships?.[change.relationshipName] ? "backward" : "forward")) === "forward") types[change.typeName] = {
-					...existing,
-					forwardRelationships: {
-						...existing.forwardRelationships,
-						[change.relationshipName]: rel
-					}
-				};
-				else types[change.typeName] = {
-					...existing,
-					backwardRelationships: {
-						...existing.backwardRelationships,
-						[change.relationshipName]: rel
-					}
-				};
+				if ((change.relationshipType ?? (existing.forwardRelationships?.[change.relationshipName] ? "forward" : existing.backwardRelationships?.[change.relationshipName] ? "backward" : "forward")) === "forward") {
+					const forwardRelationships = copySnapshotRecord(existing.forwardRelationships);
+					forwardRelationships[change.relationshipName] = rel;
+					types[change.typeName] = {
+						...existing,
+						forwardRelationships
+					};
+				} else {
+					const backwardRelationships = copySnapshotRecord(existing.backwardRelationships);
+					backwardRelationships[change.relationshipName] = rel;
+					types[change.typeName] = {
+						...existing,
+						backwardRelationships
+					};
+				}
 			}
 			break;
 		}
@@ -7353,13 +7397,15 @@ function applyDiffToSnapshot(snapshot, diff) {
 			if (type) {
 				const targetType = change.relationshipType ?? (type.forwardRelationships?.[change.relationshipName] ? "forward" : type.backwardRelationships?.[change.relationshipName] ? "backward" : null);
 				if (targetType === "forward" && type.forwardRelationships?.[change.relationshipName]) {
-					const { [change.relationshipName]: _, ...remaining } = type.forwardRelationships;
+					const remaining = copySnapshotRecord(type.forwardRelationships);
+					delete remaining[change.relationshipName];
 					types[change.typeName] = {
 						...type,
 						forwardRelationships: Object.keys(remaining).length > 0 ? remaining : void 0
 					};
 				} else if (targetType === "backward" && type.backwardRelationships?.[change.relationshipName]) {
-					const { [change.relationshipName]: _, ...remaining } = type.backwardRelationships;
+					const remaining = copySnapshotRecord(type.backwardRelationships);
+					delete remaining[change.relationshipName];
 					types[change.typeName] = {
 						...type,
 						backwardRelationships: Object.keys(remaining).length > 0 ? remaining : void 0
@@ -7383,18 +7429,18 @@ function applyDiffToSnapshot(snapshot, diff) {
 			break;
 		}
 	}
-	return {
+	return normalizeSchemaSnapshot({
 		...snapshot,
 		types,
 		createdAt: diff.createdAt
-	};
+	});
 }
 /**
 * Reconstruct the latest schema snapshot from all migration files
 * Returns null if no migrations exist
 * @param {string} migrationsDir - Migrations directory path
 * @param {number} [maxVersion] - Optional maximum migration version to apply
-* @returns {SchemaSnapshot | null} Reconstructed snapshot or null if no migrations exist
+* @returns {NormalizedSchemaSnapshot | null} Reconstructed normalized snapshot or null if no migrations exist
 */
 function reconstructSnapshotFromMigrations(migrationsDir, maxVersion) {
 	const files = getMigrationFiles(migrationsDir);
@@ -7757,8 +7803,9 @@ function comparePermissions(ctx, typeName, oldRecordPerm, newRecordPerm, oldGqlP
 * @returns {MigrationDiff} Migration diff between snapshots
 */
 function compareSnapshots(previous, current) {
-	for (const type of Object.values(previous.types)) normalizeSnapshotType(type);
-	for (const type of Object.values(current.types)) normalizeSnapshotType(type);
+	return compareNormalizedSnapshots(normalizeSchemaSnapshot(previous), normalizeSchemaSnapshot(current));
+}
+function compareNormalizedSnapshots(previous, current) {
 	const ctx = {
 		changes: [],
 		breakingChanges: [],
@@ -7893,7 +7940,7 @@ function assertValidMigrationFiles(migrationsDir, namespace) {
 * @returns {Record<string, SnapshotFieldConfig>} Converted field configs
 */
 function convertRemoteFieldsToSnapshot(remoteType) {
-	const fields = {};
+	const fields = createSnapshotRecord();
 	const remoteFields = remoteType.schema?.fields ?? {};
 	for (const [fieldName, remoteField] of Object.entries(remoteFields)) {
 		const config = {
@@ -7929,11 +7976,35 @@ function convertRemoteFieldsToSnapshot(remoteType) {
 			...remoteField.serial.format && { format: remoteField.serial.format }
 		};
 		if (remoteField.scale !== void 0) config.scale = remoteField.scale;
-		normalizeSnapshotField(config);
 		fields[fieldName] = config;
 	}
 	return fields;
 }
+function convertRemoteTypeToSnapshot(remoteType) {
+	const snapshotType = {
+		name: remoteType.name,
+		pluralForm: remoteType.schema?.settings?.pluralForm || inflection.pluralize(remoteType.name),
+		fields: convertRemoteFieldsToSnapshot(remoteType)
+	};
+	if (remoteType.schema?.description) snapshotType.description = remoteType.schema.description;
+	return snapshotType;
+}
+/**
+* Convert remote TailorDB types into the normalized snapshot shape used by drift checks.
+* @param {ProtoTailorDBType[]} remoteTypes - Remote TailorDB types from the API
+* @param {string} namespace - Namespace for the reconstructed snapshot
+* @returns {NormalizedSchemaSnapshot} Normalized snapshot-shaped remote state
+*/
+function createSnapshotFromRemoteTypes(remoteTypes, namespace) {
+	const types = createSnapshotRecord();
+	for (const remoteType of remoteTypes) types[remoteType.name] = convertRemoteTypeToSnapshot(remoteType);
+	return normalizeSchemaSnapshot({
+		version: 1,
+		namespace,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		types
+	});
+}
 /**
 * Compare a single field between remote and snapshot
 * @param {string} typeName - Name of the type
@@ -7994,12 +8065,13 @@ const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["id"]);
 * @returns {SchemaDrift[]} List of drifts detected
 */
 function compareRemoteWithSnapshot(remoteTypes, snapshot) {
-	for (const type of Object.values(snapshot.types)) normalizeSnapshotType(type);
+	return compareNormalizedRemoteWithSnapshot(createSnapshotFromRemoteTypes(remoteTypes, snapshot.namespace), normalizeSchemaSnapshot(snapshot));
+}
+function compareNormalizedRemoteWithSnapshot(remoteSnapshot, snapshot) {
 	const drifts = [];
-	const remoteTypeMap = /* @__PURE__ */ new Map();
-	for (const remoteType of remoteTypes) remoteTypeMap.set(remoteType.name, remoteType);
+	const remoteTypeMap = new Map(Object.entries(remoteSnapshot.types));
 	const snapshotTypeNames = new Set(Object.keys(snapshot.types));
-	const remoteTypeNames = new Set(remoteTypeMap.keys());
+	const remoteTypeNames = new Set(Object.keys(remoteSnapshot.types));
 	for (const typeName of snapshotTypeNames) if (!remoteTypeNames.has(typeName)) drifts.push({
 		typeName,
 		kind: "type_missing_remote",
@@ -8014,7 +8086,7 @@ function compareRemoteWithSnapshot(remoteTypes, snapshot) {
 		if (!remoteTypeNames.has(typeName)) continue;
 		const remoteType = assertDefined(remoteTypeMap.get(typeName), `type "${typeName}" missing from remoteTypeMap`);
 		const snapshotType = assertDefined(snapshot.types[typeName], `type "${typeName}" missing from snapshot`);
-		const remoteFields = convertRemoteFieldsToSnapshot(remoteType);
+		const remoteFields = remoteType.fields;
 		const snapshotFields = snapshotType.fields;
 		const remoteFieldNames = new Set(Object.keys(remoteFields).filter((f) => !SYSTEM_FIELDS.has(f)));
 		const snapshotFieldNames = new Set(Object.keys(snapshotFields).filter((f) => !SYSTEM_FIELDS.has(f)));
@@ -9370,7 +9442,8 @@ async function applyTailorDB(client, result, phase = "create-update") {
 				await client.setMetadata(create.metaRequest);
 			}), ...changeSet.service.updates.map((update) => client.setMetadata(update.metaRequest))]);
 			try {
-				await Promise.all([...changeSet.type.creates.map((create) => client.createTailorDBType(create.request)), ...changeSet.type.updates.map((update) => client.updateTailorDBType(update.request))]);
+				for (const create of changeSet.type.creates) await client.createTailorDBType(create.request);
+				for (const update of changeSet.type.updates) await client.updateTailorDBType(update.request);
 			} catch (error) {
 				handleOptionalToRequiredError(error, ["Run 'tailor-sdk tailordb migration generate' to create migration files.", "Migration scripts allow you to handle existing data before applying the schema change."]);
 			}
@@ -9495,53 +9568,45 @@ async function executeSingleMigrationPrePhase(client, changeSet, migration, tail
 	const preMigrationChanges = buildPreMigrationChangesMap([migration]);
 	const affectedTypes = getAffectedTypeNames(migration);
 	const createdBeforeMigration = new Set(processedTypes.created);
-	await awaitAllSettledOrThrow([
-		...changeSet.type.creates.filter((create) => {
-			const typeName = create.request.tailordbType?.name;
-			return typeName && affectedTypes.has(typeName) && !createdBeforeMigration.has(typeName);
-		}).map((create) => {
-			const typeName = create.request.tailordbType?.name;
-			const snapshotType = typeName ? buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) : void 0;
-			if (!snapshotType) return void 0;
-			if (typeName) processedTypes.created.add(typeName);
-			const clonedRequest = structuredClone(create.request);
-			clonedRequest.tailordbType = snapshotType;
-			const typeChanges = typeName ? preMigrationChanges.get(typeName) : void 0;
-			if (typeChanges && typeChanges.size > 0 && clonedRequest.tailordbType.schema?.fields) applyPreMigrationFieldAdjustments(clonedRequest.tailordbType.schema.fields, typeChanges);
-			return client.createTailorDBType(clonedRequest);
-		}),
-		...changeSet.type.creates.filter((create) => {
-			const typeName = create.request.tailordbType?.name;
-			return typeName && affectedTypes.has(typeName) && createdBeforeMigration.has(typeName);
-		}).map((create) => {
-			const typeName = create.request.tailordbType?.name;
-			const snapshotType = typeName ? buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) : void 0;
-			if (!snapshotType) return void 0;
-			if (typeName) processedTypes.updated.add(typeName);
-			const clonedTypeRequest = structuredClone(snapshotType);
-			const typeChanges = typeName ? preMigrationChanges.get(typeName) : void 0;
-			if (typeChanges && typeChanges.size > 0 && clonedTypeRequest.schema?.fields) applyPreMigrationFieldAdjustments(clonedTypeRequest.schema.fields, typeChanges);
-			return client.updateTailorDBType({
-				workspaceId: create.request.workspaceId,
-				namespaceName: create.request.namespaceName,
-				tailordbType: clonedTypeRequest
-			});
-		}),
-		...changeSet.type.updates.filter((update) => {
-			const typeName = update.request.tailordbType?.name;
-			return typeName && affectedTypes.has(typeName);
-		}).map((update) => {
-			const typeName = update.request.tailordbType?.name;
-			const snapshotType = typeName ? buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) : void 0;
-			if (!snapshotType) return void 0;
-			if (typeName) processedTypes.updated.add(typeName);
-			const clonedRequest = structuredClone(update.request);
-			clonedRequest.tailordbType = snapshotType;
-			const typeChanges = typeName ? preMigrationChanges.get(typeName) : void 0;
-			if (typeChanges && typeChanges.size > 0 && clonedRequest.tailordbType.schema?.fields) applyPreMigrationFieldAdjustments(clonedRequest.tailordbType.schema.fields, typeChanges);
-			return client.updateTailorDBType(clonedRequest);
-		})
-	]);
+	for (const create of changeSet.type.creates) {
+		const typeName = create.request.tailordbType?.name;
+		if (!typeName || !affectedTypes.has(typeName) || createdBeforeMigration.has(typeName)) continue;
+		const snapshotType = buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes);
+		if (!snapshotType) continue;
+		const clonedRequest = structuredClone(create.request);
+		clonedRequest.tailordbType = snapshotType;
+		const typeChanges = preMigrationChanges.get(typeName);
+		if (typeChanges && typeChanges.size > 0 && clonedRequest.tailordbType.schema?.fields) applyPreMigrationFieldAdjustments(clonedRequest.tailordbType.schema.fields, typeChanges);
+		processedTypes.created.add(typeName);
+		await client.createTailorDBType(clonedRequest);
+	}
+	for (const create of changeSet.type.creates) {
+		const typeName = create.request.tailordbType?.name;
+		if (!typeName || !affectedTypes.has(typeName) || !createdBeforeMigration.has(typeName)) continue;
+		const snapshotType = buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes);
+		if (!snapshotType) continue;
+		const clonedTypeRequest = structuredClone(snapshotType);
+		const typeChanges = preMigrationChanges.get(typeName);
+		if (typeChanges && typeChanges.size > 0 && clonedTypeRequest.schema?.fields) applyPreMigrationFieldAdjustments(clonedTypeRequest.schema.fields, typeChanges);
+		processedTypes.updated.add(typeName);
+		await client.updateTailorDBType({
+			workspaceId: create.request.workspaceId,
+			namespaceName: create.request.namespaceName,
+			tailordbType: clonedTypeRequest
+		});
+	}
+	for (const update of changeSet.type.updates) {
+		const typeName = update.request.tailordbType?.name;
+		if (!typeName || !affectedTypes.has(typeName)) continue;
+		const snapshotType = buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes);
+		if (!snapshotType) continue;
+		const clonedRequest = structuredClone(update.request);
+		clonedRequest.tailordbType = snapshotType;
+		const typeChanges = preMigrationChanges.get(typeName);
+		if (typeChanges && typeChanges.size > 0 && clonedRequest.tailordbType.schema?.fields) applyPreMigrationFieldAdjustments(clonedRequest.tailordbType.schema.fields, typeChanges);
+		processedTypes.updated.add(typeName);
+		await client.updateTailorDBType(clonedRequest);
+	}
 	if (!processedTypes.gqlPermissionsProcessed.has(migration.namespace)) {
 		const gqlPermissionCreatesForNamespace = changeSet.gqlPermission.creates.filter((create) => create.request.namespaceName === migration.namespace);
 		const gqlPermissionUpdatesForNamespace = changeSet.gqlPermission.updates.filter((update) => update.request.namespaceName === migration.namespace);
@@ -9550,11 +9615,11 @@ async function executeSingleMigrationPrePhase(client, changeSet, migration, tail
 			const typeName = create.request.tailordbType?.name;
 			return create.request.namespaceName === migration.namespace && typeName && gqlPermissionTypeNames.has(typeName) && !processedTypes.created.has(typeName);
 		});
-		if (missingTypeCreates.length > 0) await awaitAllSettledOrThrow(missingTypeCreates.map((create) => {
+		if (missingTypeCreates.length > 0) for (const create of missingTypeCreates) {
 			const typeName = create.request.tailordbType?.name;
 			if (typeName) processedTypes.created.add(typeName);
-			return client.createTailorDBType(create.request);
-		}));
+			await client.createTailorDBType(create.request);
+		}
 		processedTypes.gqlPermissionsProcessed.add(migration.namespace);
 		await awaitAllSettledOrThrow([...gqlPermissionCreatesForNamespace.map((create) => client.createTailorDBGQLPermission(create.request)), ...gqlPermissionUpdatesForNamespace.map((update) => client.updateTailorDBGQLPermission(update.request))]);
 	}
@@ -9584,31 +9649,28 @@ async function executeSingleMigrationPostPhase(client, changeSet, migration, tai
 	const affectedTypes = getAffectedTypeNames(migration);
 	const deletedTypeNames = getDeletedTypeNames(migration);
 	try {
-		await Promise.all([...changeSet.type.creates.filter((create) => {
-			const typeName = create.request.tailordbType?.name;
-			return typeName && affectedTypes.has(typeName) && preMigrationChanges.has(typeName);
-		}).map((create) => {
+		for (const create of changeSet.type.creates) {
 			const typeName = create.request.tailordbType?.name;
-			const snapshotType = typeName ? buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) : void 0;
-			if (!snapshotType) return void 0;
-			return client.updateTailorDBType({
+			if (!typeName || !affectedTypes.has(typeName) || !preMigrationChanges.has(typeName)) continue;
+			const snapshotType = buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes);
+			if (!snapshotType) continue;
+			await client.updateTailorDBType({
 				workspaceId: create.request.workspaceId,
 				namespaceName: create.request.namespaceName,
 				tailordbType: snapshotType
 			});
-		}), ...changeSet.type.updates.filter((update) => {
-			const typeName = update.request.tailordbType?.name;
-			return typeName && affectedTypes.has(typeName) && preMigrationChanges.has(typeName);
-		}).map((update) => {
+		}
+		for (const update of changeSet.type.updates) {
 			const typeName = update.request.tailordbType?.name;
-			const snapshotType = typeName ? buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) : void 0;
-			if (!snapshotType) return void 0;
-			return client.updateTailorDBType({
+			if (!typeName || !affectedTypes.has(typeName) || !preMigrationChanges.has(typeName)) continue;
+			const snapshotType = buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes);
+			if (!snapshotType) continue;
+			await client.updateTailorDBType({
 				workspaceId: update.request.workspaceId,
 				namespaceName: update.request.namespaceName,
 				tailordbType: snapshotType
 			});
-		})]);
+		}
 	} catch (error) {
 		handleOptionalToRequiredError(error, ["This error occurred during post-migration phase. Please check your migration script.", "Ensure all existing records have values for fields being changed to required."]);
 	}
@@ -10265,11 +10327,11 @@ async function registerJobFunctions(client, changeSet, appName, appId, unchanged
 	const allUsedJobNames = /* @__PURE__ */ new Set();
 	unchangedWorkflowJobNames.forEach((jobName) => allUsedJobNames.add(jobName));
 	for (const item of [...changeSet.creates, ...changeSet.updates]) for (const jobName of item.usedJobNames) allUsedJobNames.add(jobName);
-	const existingJobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
+	const existingJobFunctions = await fetchAll(async (pageToken, _maxPageSize) => {
 		const response = await client.listWorkflowJobFunctions({
 			workspaceId,
 			pageToken,
-			pageSize: maxPageSize
+			pageSize: 100
 		});
 		return [response.jobFunctions.map((j) => j.name), response.nextPageToken];
 	});
@@ -10450,11 +10512,11 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 }
 async function planWorkflowJobFunctionDeletes(params) {
 	const { client, workspaceId, appName, appId, retainedWorkflowJobNames } = params;
-	const existingJobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
+	const existingJobFunctions = await fetchAll(async (pageToken, _maxPageSize) => {
 		const response = await client.listWorkflowJobFunctions({
 			workspaceId,
 			pageToken,
-			pageSize: maxPageSize
+			pageSize: 100
 		});
 		return [response.jobFunctions.map((jobFunction) => jobFunction.name), response.nextPageToken];
 	});
@@ -10610,6 +10672,17 @@ async function validatePlan(input) {
 			violations
 		});
 	}
+	function inPlaceReplaces(schema, kind, items) {
+		validateItems({
+			validator,
+			schema,
+			kind,
+			action: "replace",
+			items,
+			requestKey: "updateRequest",
+			violations
+		});
+	}
 	creates(CreateTailorDBServiceRequestSchema, "TailorDB service", tailorDB.changeSet.service.creates);
 	creates(CreateTailorDBTypeRequestSchema, "TailorDB type", tailorDB.changeSet.type.creates);
 	updates(UpdateTailorDBTypeRequestSchema, "TailorDB type", tailorDB.changeSet.type.updates);
@@ -10733,7 +10806,7 @@ async function validatePlan(input) {
 		}
 	})));
 	creates(CreateAuthConnectionRequestSchema, "Auth connection", auth.changeSet.connection.creates);
-	replaces(CreateAuthConnectionRequestSchema, "Auth connection", auth.changeSet.connection.replaces);
+	inPlaceReplaces(UpdateAuthConnectionRequestSchema, "Auth connection", auth.changeSet.connection.replaces);
 	if (violations.length === 0) return;
 	const resourceNames = new Set(violations.map((v) => `${v.kind}:${v.name}`));
 	logger.error(`Pre-flight validation found ${violations.length} violation(s) across ${resourceNames.size} resource(s):`);
@@ -10825,7 +10898,15 @@ function computeRenamedAppDeletions(params) {
 	const { conflicts, resourceOwners, targetAppName } = params;
 	return [...new Set(conflicts.map((c) => c.currentOwner))].filter((owner) => !resourceOwners.has(owner) && owner !== targetAppName);
 }
-function printPlanResults(results) {
+/**
+* Format and output the plan results, then return a summary of change counts.
+* In JSON dry-run mode a JSON payload is written to stdout. In all other modes
+* the human-readable diff goes to stdout (dry-run) or stderr (apply).
+* @param results - Planned results across all services
+* @param opts - Output options (dry-run mode flag)
+* @returns Aggregated plan summary counts
+*/
+function printPlanResults(results, opts) {
 	const executorEntries = formatExecutorChangeEntries(results.executor.changeSet, buildPlannedExecutorsByName(results.executor.changeSet), results.functionRegistry.executorFunctionChanges);
 	const resolverEntries = formatResolverChangeEntries(results.pipeline.changeSet.resolver, results.functionRegistry.resolverFunctionChanges);
 	const workflowEntries = formatWorkflowChangeEntries(results.workflow.changeSet, results.functionRegistry.workflowJobChanges);
@@ -10850,41 +10931,142 @@ function printPlanResults(results) {
 		...formatChangeSetEntries(results.auth.changeSet.connection, ["connection"], namespaceOf)
 	];
 	const { otherChanges: otherFunctionRegistryChanges } = splitFunctionRegistryChanges(results.functionRegistry.changeSet);
-	printGroupedDisplaySection(results.functionRegistry.changeSet.title, formatChangeSetEntries(otherFunctionRegistryChanges));
 	const tailorDBServiceActions = extractServiceActions(results.tailorDB.changeSet.service);
 	const pipelineServiceActions = extractServiceActions(results.pipeline.changeSet.service);
 	const idpServiceActions = extractServiceActions(results.idp.changeSet.service);
 	const authServiceActions = extractServiceActions(results.auth.changeSet.service);
-	results.staticWebsite.changeSet.print();
-	results.staticWebsite.customDomainChangeSet.print();
-	results.aiGateway.changeSet.print();
-	results.app.print();
-	printGroupedDisplaySection("TailorDB", tailorDBEntries, tailorDBServiceActions);
-	printGroupedDisplaySection("Resolver", pipelineEntries, pipelineServiceActions);
-	printGroupedDisplaySection("Executor", executorEntries);
-	printGroupedDisplaySection("Workflow", workflowEntries);
-	printGroupedDisplaySection("IdP", idpEntries, idpServiceActions);
-	printGroupedDisplaySection("Auth", authEntries, authServiceActions);
-	results.secretManager.vaultChangeSet.print();
-	results.secretManager.secretChangeSet.print();
-	if (results.secretManager.skippedSecrets.length > 0) {
-		logger.log(styles.bold("Secret Manager secrets (skipped - no value provided):"));
-		for (const name of results.secretManager.skippedSecrets) logger.log(`  ${styles.dim("○")} ${name}`);
-	}
-	const summary = summarizePlanResults(results, [
+	const allDisplayEntries = [
 		...tailorDBEntries,
 		...pipelineEntries,
 		...executorEntries,
 		...workflowEntries,
 		...idpEntries,
 		...authEntries
-	], [
+	];
+	const summary = summarizePlanResults(results, allDisplayEntries, [
 		...tailorDBServiceActions,
 		...pipelineServiceActions,
 		...idpServiceActions,
 		...authServiceActions
 	]);
-	logger.log(formatPlanSummary(summary));
+	const allUnmanaged = [
+		...results.functionRegistry.unmanaged,
+		...results.tailorDB.unmanaged,
+		...results.staticWebsite.unmanaged,
+		...results.aiGateway.unmanaged,
+		...results.idp.unmanaged,
+		...results.auth.unmanaged,
+		...results.pipeline.unmanaged,
+		...results.executor.unmanaged,
+		...results.workflow.unmanaged,
+		...results.secretManager.unmanaged
+	];
+	const allConflicts = [
+		...results.functionRegistry.conflicts,
+		...results.tailorDB.conflicts,
+		...results.staticWebsite.conflicts,
+		...results.aiGateway.conflicts,
+		...results.idp.conflicts,
+		...results.auth.conflicts,
+		...results.pipeline.conflicts,
+		...results.executor.conflicts,
+		...results.workflow.conflicts,
+		...results.secretManager.conflicts
+	];
+	if (logger.jsonMode && opts?.dryRun) {
+		const changes = [
+			...allDisplayEntries,
+			...tailorDBServiceActions.map(({ action, name }) => ({
+				action,
+				name,
+				labels: ["tailorDB"],
+				namespace: void 0
+			})),
+			...pipelineServiceActions.map(({ action, name }) => ({
+				action,
+				name,
+				labels: ["pipeline"],
+				namespace: void 0
+			})),
+			...idpServiceActions.map(({ action, name }) => ({
+				action,
+				name,
+				labels: ["idp"],
+				namespace: void 0
+			})),
+			...authServiceActions.map(({ action, name }) => ({
+				action,
+				name,
+				labels: ["auth"],
+				namespace: void 0
+			})),
+			...formatChangeSetEntries(otherFunctionRegistryChanges),
+			...formatChangeSetEntries(results.staticWebsite.changeSet, ["staticWebsite"]),
+			...formatChangeSetEntries(results.staticWebsite.customDomainChangeSet, ["customDomain"]),
+			...formatChangeSetEntries(results.aiGateway.changeSet, ["aiGateway"]),
+			...formatChangeSetEntries(results.app, ["application"]),
+			...formatChangeSetEntries(results.secretManager.vaultChangeSet, ["vault"]),
+			...formatChangeSetEntries(results.secretManager.secretChangeSet, ["secret"])
+		].map(({ action, name, labels, namespace }) => ({
+			action,
+			name,
+			labels,
+			namespace
+		}));
+		const warnings = [...allUnmanaged.map(({ resourceType, resourceName }) => ({
+			type: "unmanaged",
+			resourceType,
+			name: resourceName
+		})), ...results.secretManager.skippedSecrets.map((name) => ({
+			type: "skippedSecret",
+			resourceType: "secret",
+			name
+		}))];
+		const conflicts = allConflicts.map(({ resourceType, resourceName, currentOwner }) => ({
+			resourceType,
+			name: resourceName,
+			currentOwner
+		}));
+		logger.out({
+			summary,
+			changes,
+			warnings,
+			conflicts
+		});
+		return summary;
+	}
+	const allLines = [
+		...buildGroupedDisplayLines(results.functionRegistry.changeSet.title, formatChangeSetEntries(otherFunctionRegistryChanges)),
+		...results.staticWebsite.changeSet.lines(),
+		...results.staticWebsite.customDomainChangeSet.lines(),
+		...results.aiGateway.changeSet.lines(),
+		...results.app.lines(),
+		...buildGroupedDisplayLines("TailorDB", tailorDBEntries, tailorDBServiceActions),
+		...buildGroupedDisplayLines("Resolver", pipelineEntries, pipelineServiceActions),
+		...buildGroupedDisplayLines("Executor", executorEntries),
+		...buildGroupedDisplayLines("Workflow", workflowEntries),
+		...buildGroupedDisplayLines("IdP", idpEntries, idpServiceActions),
+		...buildGroupedDisplayLines("Auth", authEntries, authServiceActions),
+		...results.secretManager.vaultChangeSet.lines(),
+		...results.secretManager.secretChangeSet.lines()
+	];
+	if (allUnmanaged.length > 0) {
+		allLines.push(styles.bold("Unmanaged resources (not in config):"));
+		for (const { resourceType, resourceName } of allUnmanaged) allLines.push(`  ${styles.warning("⚠")} ${styles.bold(resourceType)} "${resourceName}"`);
+	}
+	if (results.secretManager.skippedSecrets.length > 0) {
+		allLines.push(styles.bold("Secret Manager secrets (skipped - no value provided):"));
+		for (const name of results.secretManager.skippedSecrets) allLines.push(`  ${styles.dim("○")} ${name}`);
+	}
+	if (allConflicts.length > 0) {
+		allLines.push(styles.bold("Owner conflicts (will require confirmation on apply):"));
+		for (const { resourceType, resourceName, currentOwner } of allConflicts) allLines.push(`  ${styles.warning("!")} ${styles.bold(resourceType)} "${resourceName}" — owned by "${currentOwner}"`);
+	}
+	allLines.push(formatPlanSummary(summary));
+	const output = allLines.join("\n");
+	if (opts?.dryRun) logger.out(output);
+	else logger.log(output);
+	return summary;
 }
 /**
 * Summarize plan counts from display entries, service actions, and non-grouped changesets.
@@ -10898,8 +11080,7 @@ function summarizePlanResults(results, displayEntries, serviceActions) {
 		create: 0,
 		update: 0,
 		delete: 0,
-		replace: 0,
-		unchanged: 0
+		replace: 0
 	};
 	for (const entry of displayEntries) summary[entry.action] += 1;
 	for (const sa of serviceActions) summary[sa.action] += 1;
@@ -11137,7 +11318,7 @@ async function deploy(options) {
 				}
 			});
 		});
-		printPlanResults({
+		const planSummary = printPlanResults({
 			functionRegistry,
 			tailorDB,
 			staticWebsite,
@@ -11149,7 +11330,7 @@ async function deploy(options) {
 			executor,
 			workflow,
 			secretManager
-		});
+		}, { dryRun: options?.dryRun });
 		if (options?.noValidate) logger.warn("Client-side validation skipped (--no-validate).");
 		else await validatePlan({
 			functionRegistry,
@@ -11202,7 +11383,11 @@ async function deploy(options) {
 			await applyTailorDB(client, tailorDB, "delete-services");
 		});
 		await withSpan("apply.cleanup", () => applyFunctionRegistry(client, workspaceId, functionRegistry, "delete"));
-		logger.success("Successfully applied changes.");
+		if (logger.jsonMode) logger.out({
+			summary: planSummary,
+			status: "applied"
+		});
+		else logger.success("Successfully applied changes.");
 	});
 }
 
@@ -15161,31 +15346,34 @@ async function execRemove(client, workspaceId, application, config, confirm) {
 	const workflow = await planWorkflow(client, workspaceId, application.name, application.id, {}, {});
 	const functionRegistry = await planFunctionRegistry(client, workspaceId, application.name, application.id, []);
 	const secretManager = await planSecretManager(ctx);
-	functionRegistry.changeSet.print();
-	staticWebsite.changeSet.print();
-	aiGateway.changeSet.print();
-	app.print();
-	tailorDB.changeSet.service.print();
-	tailorDB.changeSet.type.print();
-	tailorDB.changeSet.gqlPermission.print();
-	pipeline.changeSet.service.print();
-	pipeline.changeSet.resolver.print();
-	executor.changeSet.print();
-	workflow.changeSet.print();
-	idp.changeSet.service.print();
-	idp.changeSet.client.print();
-	auth.changeSet.service.print();
-	auth.changeSet.idpConfig.print();
-	auth.changeSet.userProfileConfig.print();
-	auth.changeSet.tenantConfig.print();
-	auth.changeSet.machineUser.print();
-	auth.changeSet.oauth2Client.print();
-	auth.changeSet.authHook.print();
-	auth.changeSet.scim.print();
-	auth.changeSet.scimResource.print();
-	auth.changeSet.connection.print();
-	secretManager.vaultChangeSet.print();
-	secretManager.secretChangeSet.print();
+	const removeLines = [
+		...functionRegistry.changeSet.lines(),
+		...staticWebsite.changeSet.lines(),
+		...aiGateway.changeSet.lines(),
+		...app.lines(),
+		...tailorDB.changeSet.service.lines(),
+		...tailorDB.changeSet.type.lines(),
+		...tailorDB.changeSet.gqlPermission.lines(),
+		...pipeline.changeSet.service.lines(),
+		...pipeline.changeSet.resolver.lines(),
+		...executor.changeSet.lines(),
+		...workflow.changeSet.lines(),
+		...idp.changeSet.service.lines(),
+		...idp.changeSet.client.lines(),
+		...auth.changeSet.service.lines(),
+		...auth.changeSet.idpConfig.lines(),
+		...auth.changeSet.userProfileConfig.lines(),
+		...auth.changeSet.tenantConfig.lines(),
+		...auth.changeSet.machineUser.lines(),
+		...auth.changeSet.oauth2Client.lines(),
+		...auth.changeSet.authHook.lines(),
+		...auth.changeSet.scim.lines(),
+		...auth.changeSet.scimResource.lines(),
+		...auth.changeSet.connection.lines(),
+		...secretManager.vaultChangeSet.lines(),
+		...secretManager.secretChangeSet.lines()
+	];
+	if (removeLines.length > 0) logger.log(removeLines.join("\n"));
 	if (tailorDB.changeSet.service.deletes.length === 0 && staticWebsite.changeSet.deletes.length === 0 && aiGateway.changeSet.deletes.length === 0 && idp.changeSet.service.deletes.length === 0 && auth.changeSet.service.deletes.length === 0 && pipeline.changeSet.service.deletes.length === 0 && app.deletes.length === 0 && executor.changeSet.deletes.length === 0 && workflow.changeSet.deletes.length === 0 && functionRegistry.changeSet.deletes.length === 0 && secretManager.vaultChangeSet.deletes.length === 0 && secretManager.secretChangeSet.deletes.length === 0) return;
 	if (confirm) await confirm();
 	await applyWorkflow(client, workflow, "delete");
@@ -15255,6 +15443,36 @@ function logBetaWarning(featureName) {
 	logger.newline();
 }
 
+//#endregion
+//#region src/cli/shared/config.ts
+/**
+* Extracts every namespace key declared under `config.db`, including those
+* declared with `{ external: true }`.
+* @param config - Loaded application configuration.
+* @returns Namespace names in insertion order.
+*/
+function extractAllNamespaces(config) {
+	const namespaces = /* @__PURE__ */ new Set();
+	if (config.db) for (const namespaceName of Object.keys(config.db)) namespaces.add(namespaceName);
+	return Array.from(namespaces);
+}
+/**
+* Extracts namespace keys under `config.db` that this app owns
+* (i.e. not declared with `{ external: true }`). Use this for destructive
+* operations like `tailordb truncate --all` to avoid touching namespaces
+* owned by other apps.
+* @param config - Loaded application configuration.
+* @returns Owned namespace names in insertion order.
+*/
+function extractOwnedNamespaces(config) {
+	const namespaces = /* @__PURE__ */ new Set();
+	if (config.db) for (const [namespaceName, nsConfig] of Object.entries(config.db)) {
+		if ("external" in nsConfig) continue;
+		namespaces.add(namespaceName);
+	}
+	return Array.from(namespaces);
+}
+
 //#endregion
 //#region src/cli/commands/workspace/transform.ts
 const workspaceInfo = (workspace, folderName) => {
@@ -15978,7 +16196,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-Br48NXBD.mjs");
+	const { defineApplication } = await import("./application-a_ApFuPh.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -16122,36 +16340,6 @@ const generateCommand = defineAppCommand({
 	}
 });
 
-//#endregion
-//#region src/cli/shared/config.ts
-/**
-* Extracts every namespace key declared under `config.db`, including those
-* declared with `{ external: true }`.
-* @param config - Loaded application configuration.
-* @returns Namespace names in insertion order.
-*/
-function extractAllNamespaces(config) {
-	const namespaces = /* @__PURE__ */ new Set();
-	if (config.db) for (const namespaceName of Object.keys(config.db)) namespaces.add(namespaceName);
-	return Array.from(namespaces);
-}
-/**
-* Extracts namespace keys under `config.db` that this app owns
-* (i.e. not declared with `{ external: true }`). Use this for destructive
-* operations like `tailordb truncate --all` to avoid touching namespaces
-* owned by other apps.
-* @param config - Loaded application configuration.
-* @returns Owned namespace names in insertion order.
-*/
-function extractOwnedNamespaces(config) {
-	const namespaces = /* @__PURE__ */ new Set();
-	if (config.db) for (const [namespaceName, nsConfig] of Object.entries(config.db)) {
-		if ("external" in nsConfig) continue;
-		namespaces.add(namespaceName);
-	}
-	return Array.from(namespaces);
-}
-
 //#endregion
 //#region src/cli/shared/tailordb-namespace.ts
 /**
@@ -16742,6 +16930,15 @@ const validateRegion = async (region, client) => {
 	const availableRegions = await client.listAvailableWorkspaceRegions({});
 	if (!availableRegions.regions.includes(region)) throw new Error(`Region must be one of: ${availableRegions.regions.join(", ")}.`);
 };
+function profilePlatformSettings(platformConfig) {
+	const hasOAuth2ClientId = platformConfig?.oauth2ClientId || process.env.TAILOR_PLATFORM_OAUTH2_CLIENT_ID;
+	const hasConsoleUrl = platformConfig?.consoleUrl || process.env.TAILOR_PLATFORM_CONSOLE_URL;
+	return {
+		...isDefaultPlatform(platformConfig) ? {} : { platform_url: getPlatformBaseUrl(platformConfig) },
+		...hasOAuth2ClientId ? { oauth2_client_id: getOAuth2ClientId(platformConfig) } : {},
+		...hasConsoleUrl ? { console_url: getConsoleBaseUrl(platformConfig) } : {}
+	};
+}
 /**
 * Create a new workspace with the given options.
 * @param options - Workspace creation options
@@ -16796,6 +16993,23 @@ const createCommand = defineAppCommand({
 	}).strict(),
 	run: async (args) => {
 		await assertWritable();
+		const profileName = args["profile-name"];
+		let profileSetup;
+		if (profileName) {
+			const config = await readPlatformConfig();
+			if (config.profiles[profileName]) throw new Error(`Profile "${profileName}" already exists.`);
+			const activeProfileName = process.env.TAILOR_PLATFORM_PROFILE;
+			const activeProfileEntry = activeProfileName ? config.profiles[activeProfileName] : void 0;
+			const platformConfig = activeProfileEntry ? platformConfigFromProfile(activeProfileEntry) : void 0;
+			const profileUser = args["profile-user"] || activeProfileEntry?.user || config.current_user;
+			if (!profileUser) throw new Error("Current user not found. Please login or specify --profile-user to create a profile.");
+			if (!hasUserTokenEntry(config, profileUser, platformConfig)) throw new Error(`User "${profileUser}" not found.\nPlease verify your user name and login using 'tailor-sdk login' command.`);
+			profileSetup = {
+				name: profileName,
+				user: profileUser,
+				platformSettings: profilePlatformSettings(platformConfig)
+			};
+		}
 		const workspace = await createWorkspace({
 			name: args.name,
 			region: args.region,
@@ -16804,26 +17018,26 @@ const createCommand = defineAppCommand({
 			folderId: args["folder-id"]
 		});
 		let profileInfo;
-		const profileName = args["profile-name"];
-		if (profileName) {
+		if (profileSetup) {
 			const config = await readPlatformConfig();
-			if (config.profiles[profileName]) throw new Error(`Profile "${profileName}" already exists.`);
-			const profileUser = args["profile-user"] || config.current_user;
-			if (!profileUser) throw new Error("Current user not found. Please login or specify --profile-user to create a profile.");
-			if (!config.users[profileUser]) throw new Error(`User "${profileUser}" not found.\nPlease verify your user name and login using 'tailor-sdk login' command.`);
-			config.profiles[profileName] = {
-				user: profileUser,
+			const platformSettings = profileSetup.platformSettings;
+			config.profiles[profileSetup.name] = {
+				user: profileSetup.user,
 				workspace_id: workspace.id,
-				...args.permission === "read" ? { readonly: true } : {}
+				...args.permission === "read" ? { readonly: true } : {},
+				...platformSettings
 			};
 			writePlatformConfig(config);
 			profileInfo = {
-				name: profileName,
-				user: profileUser,
+				name: profileSetup.name,
+				user: profileSetup.user,
 				workspaceId: workspace.id,
-				permission: args.permission
+				permission: args.permission,
+				...platformSettings.platform_url ? { platformUrl: platformSettings.platform_url } : {},
+				...platformSettings.oauth2_client_id ? { oauth2ClientId: platformSettings.oauth2_client_id } : {},
+				...platformSettings.console_url ? { consoleUrl: platformSettings.console_url } : {}
 			};
-			if (!args.json) logger.success(`Profile "${profileName}" created successfully.`);
+			if (!args.json) logger.success(`Profile "${profileSetup.name}" created successfully.`);
 		}
 		if (!args.json) logger.success(`Workspace "${workspaceDisplayName(workspace)}" created successfully.`);
 		if (args.json && profileInfo) {
@@ -18246,5 +18460,5 @@ function isDeno() {
 }
 
 //#endregion
-export { updateCommand$2 as $, protoGqlPermission as $t, listCommand$3 as A, apiCall as An, jobsCommand as At, show as B, toPageDirection as Bn, functionExecutionStatusToString as Bt, listCommand$2 as C, ensureConfigId as Cn, webhookCommand as Ct, waitWorkflowExecution as D, generateUserTypes as Dn, listExecutors as Dt, waitCommand as E, PluginManager as En, listCommand$9 as Et, generateCommand as F, confirmationArgs as Fn, getCommand$5 as Ft, updateCommand$1 as G, executeScript as Gt, logBetaWarning as H, getCommand$6 as Ht, generateMigrationScript as I, deploymentArgs as In, getWorkflow as It, treeCommand as J, MIGRATION_LABEL_KEY as Jt, updateOrganization as K, waitForExecution as Kt, writeDbTypesFile as L, isVerbose as Ln, executionsCommand as Lt, truncate as M, defineAppCommand as Mn, watchExecutorJob as Mt, truncateCommand as N, commonArgs as Nn, startCommand as Nt, resumeCommand as O, prompt as On, getExecutorJob as Ot, generate as P, configArg as Pn, startWorkflow as Pt, getOrganization as Q, generateAllTypeManifestsFromSnapshot as Qt, getConfiguredEditorCommand as R, pagedLogArgs as Rn, getWorkflowExecution as Rt, listApps as S, getNamespacesWithMigrations as Sn, listWebhookExecutors as St, healthCommand as T, sdkNameLabelKey as Tn, triggerExecutor as Tt, remove as U, getExecutor as Ut, showCommand as V, workspaceArgs as Vn, formatKeyValueTable as Vt, removeCommand$1 as W, deploy as Wt, listOrganizations as X, parseMigrationLabelNumber as Xt, listCommand$4 as Y, handleOptionalToRequiredError as Yt, getCommand$1 as Z, compareSnapshotWithRemote as Zt, getWorkspace as _, formatMigrationNumber as _n, generate$1 as _t, updateUser as a, assertValidMigrationFiles as an, deleteCommand$1 as at, createCommand as b, formatMigrationDiff as bn, getCommand$4 as bt, listCommand as c, createSnapshotFromLocalTypes as cn, createFolder as ct, inviteUser as d, getMigrationFilePath as dn, getCommand$3 as dt, DB_TYPES_FILE_NAME as en, updateFolder as et, restoreCommand as f, getMigrationFiles as fn, getOAuth2Client as ft, getCommand as g, reconstructSnapshotFromMigrations as gn, listMachineUsers as gt, listWorkspaces as h, loadDiff as hn, listCommand$7 as ht, updateCommand as i, SCHEMA_FILE_NAME as in, getFolder as it, listWorkflows as j, assertWritable as jn, listExecutorJobs as jt, resumeWorkflow as k, apiCommand as kn, getExecutorWaitFailureMessage as kt, listUsers as l, getLatestMigrationNumber as ln, listCommand$6 as lt, listCommand$1 as m, isValidMigrationNumber as mn, tokenCommand as mt, query as n, INITIAL_SCHEMA_NUMBER as nn, listFolders as nt, removeCommand as o, compareLocalTypesWithSnapshot as on, deleteFolder as ot, restoreWorkspace as p, getNextMigrationNumber as pn, getMachineUserToken as pt, organizationTree as q, bundleMigrationScript as qt, queryCommand as r, MIGRATE_FILE_NAME as rn, getCommand$2 as rt, removeUser as s, compareSnapshots as sn, createCommand$1 as st, isNativeTypeScriptRuntime as t, DIFF_FILE_NAME as tn, listCommand$5 as tt, inviteCommand as u, getMigrationDirPath as un, listOAuth2Clients as ut, deleteCommand as v, parseMigrationNumberArg as vn, listCommand$8 as vt, getAppHealth as w, resourceTrn as wn, triggerCommand as wt, createWorkspace as x, hasChanges as xn, getFunctionRegistry as xt, deleteWorkspace as y, formatDiffSummary as yn, listFunctionRegistries as yt, openInConfiguredEditor as z, paginationArgs as zn, listWorkflowExecutions as zt };
-//# sourceMappingURL=runtime-jowoN6qC.mjs.map
+export { getOrganization as $, generateAllTypeManifestsFromSnapshot as $t, listCommand$3 as A, apiCommand as An, getExecutorWaitFailureMessage as At, show as B, paginationArgs as Bn, listWorkflowExecutions as Bt, listCommand$2 as C, getNamespacesWithMigrations as Cn, listWebhookExecutors as Ct, waitWorkflowExecution as D, PluginManager as Dn, listCommand$9 as Dt, waitCommand as E, sdkNameLabelKey as En, triggerExecutor as Et, generateCommand as F, configArg as Fn, startWorkflow as Ft, removeCommand$1 as G, deploy as Gt, extractOwnedNamespaces as H, workspaceArgs as Hn, formatKeyValueTable as Ht, generateMigrationScript as I, confirmationArgs as In, getCommand$5 as It, organizationTree as J, bundleMigrationScript as Jt, updateCommand$1 as K, executeScript as Kt, writeDbTypesFile as L, deploymentArgs as Ln, getWorkflow as Lt, truncate as M, assertWritable as Mn, listExecutorJobs as Mt, truncateCommand as N, defineAppCommand as Nn, watchExecutorJob as Nt, resumeCommand as O, generateUserTypes as On, listExecutors as Ot, generate as P, commonArgs as Pn, startCommand as Pt, getCommand$1 as Q, compareSnapshotWithRemote as Qt, getConfiguredEditorCommand as R, isVerbose as Rn, executionsCommand as Rt, listApps as S, hasChanges as Sn, getFunctionRegistry as St, healthCommand as T, resourceTrn as Tn, triggerCommand as Tt, logBetaWarning as U, getCommand$6 as Ut, showCommand as V, toPageDirection as Vn, functionExecutionStatusToString as Vt, remove as W, getExecutor as Wt, listCommand$4 as X, handleOptionalToRequiredError as Xt, treeCommand as Y, MIGRATION_LABEL_KEY as Yt, listOrganizations as Z, parseMigrationLabelNumber as Zt, getWorkspace as _, reconstructSnapshotFromMigrations as _n, listMachineUsers as _t, updateUser as a, SCHEMA_FILE_NAME as an, getFolder as at, createCommand as b, formatDiffSummary as bn, listFunctionRegistries as bt, listCommand as c, compareSnapshots as cn, createCommand$1 as ct, inviteUser as d, getMigrationDirPath as dn, listOAuth2Clients as dt, protoGqlPermission as en, updateCommand$2 as et, restoreCommand as f, getMigrationFilePath as fn, getCommand$3 as ft, getCommand as g, loadDiff as gn, listCommand$7 as gt, listWorkspaces as h, isValidMigrationNumber as hn, tokenCommand as ht, updateCommand as i, MIGRATE_FILE_NAME as in, getCommand$2 as it, listWorkflows as j, apiCall as jn, jobsCommand as jt, resumeWorkflow as k, prompt as kn, getExecutorJob as kt, listUsers as l, createSnapshotFromLocalTypes as ln, createFolder as lt, listCommand$1 as m, getNextMigrationNumber as mn, getMachineUserToken as mt, query as n, DIFF_FILE_NAME as nn, listCommand$5 as nt, removeCommand as o, assertValidMigrationFiles as on, deleteCommand$1 as ot, restoreWorkspace as p, getMigrationFiles as pn, getOAuth2Client as pt, updateOrganization as q, waitForExecution as qt, queryCommand as r, INITIAL_SCHEMA_NUMBER as rn, listFolders as rt, removeUser as s, compareLocalTypesWithSnapshot as sn, deleteFolder as st, isNativeTypeScriptRuntime as t, DB_TYPES_FILE_NAME as tn, updateFolder as tt, inviteCommand as u, getLatestMigrationNumber as un, listCommand$6 as ut, deleteCommand as v, formatMigrationNumber as vn, generate$1 as vt, getAppHealth as w, ensureConfigId as wn, webhookCommand as wt, createWorkspace as x, formatMigrationDiff as xn, getCommand$4 as xt, deleteWorkspace as y, parseMigrationNumberArg as yn, listCommand$8 as yt, openInConfiguredEditor as z, pagedLogArgs as zn, getWorkflowExecution as zt };
+//# sourceMappingURL=runtime-BpHVwifd.mjs.map