@tailor-platform/sdk 1.70.0 → 1.71.0

package/dist/{runtime-CSY0eD4_.mjs → runtime-Cd375HD-.mjs}

@@ -1,9 +1,9 @@
 
 import { t as db } from "./schema-C4fkpWV_.mjs";
-import { $ as CreateUserProfileConfigRequestSchema, A as UpdatePipelineServiceRequestSchema, At as PageDirection, B as UpdateExecutorExecutorRequestSchema, Ct as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, D as CreatePipelineResolverRequestSchema, Dt as ConditionSchema, E as UpdateSecretManagerSecretRequestSchema, Et as Subgraph_ServiceType, F as IdPPermissionOperator, G as CreateAuthHookRequestSchema, H as ExecutorTargetType, I as IdPPermissionPermit, J as CreateAuthOAuth2ClientRequestSchema, K as CreateAuthIDPConfigRequestSchema, L as FunctionExecution_Status, M as CreateIdPServiceRequestSchema, N as UpdateIdPServiceRequestSchema, O as CreatePipelineServiceRequestSchema, Ot as Condition_Operator, P as IdPLang, Q as CreateTenantConfigRequestSchema, S as UpdateStaticWebsiteRequestSchema, St as CreateApplicationRequestSchema, T as CreateSecretManagerVaultRequestSchema, Tt as ApplicationSchemaUpdateAttemptStatus, U as ExecutorTriggerType, V as ExecutorJobStatus, W as CreateAuthConnectionRequestSchema, X as CreateAuthSCIMResourceRequestSchema, Y as CreateAuthSCIMConfigRequestSchema, Z as CreateAuthServiceRequestSchema, _ as TailorDBType_Permission_Operator, _t as AuthSCIMAttribute_Uniqueness, a as WorkspacePlatformUserRole, at as UpdateAuthSCIMResourceRequestSchema, b as AddCustomDomainRequestSchema, bt as TenantProviderConfig_TenantProviderType, c as UpdateWorkflowRequestSchema, ct as UpdateUserProfileConfigRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as AuthIDPConfig_AuthType, et as UpdateAuthHookRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as AuthInvokerSchema, g as TailorDBGQLPermission_Permit, gt as AuthSCIMAttribute_Type, h as TailorDBGQLPermission_Operator, ht as AuthSCIMAttribute_Mutability, it as UpdateAuthSCIMConfigRequestSchema, j as PipelineResolver_OperationType, k as UpdatePipelineResolverRequestSchema, kt as FilterSchema, l as WorkflowExecution_Status, lt as AuthConnection_Type, m as TailorDBGQLPermission_Action, mt as AuthOAuth2Client_GrantType, nt as UpdateAuthMachineUserRequestSchema, o as CreateWorkflowJobFunctionRequestSchema, ot as UpdateAuthServiceRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as AuthOAuth2Client_ClientType, q as CreateAuthMachineUserRequestSchema, rt as UpdateAuthOAuth2ClientRequestSchema, s as CreateWorkflowRequestSchema, st as UpdateTenantConfigRequestSchema, t as OperatorService, tt as UpdateAuthIDPConfigRequestSchema, u as WorkflowJobExecution_Status, ut as AuthHookPoint, v as TailorDBType_Permission_Permit, vt as AuthSCIMConfig_AuthorizationType, w as CreateSecretManagerSecretRequestSchema, wt as UpdateApplicationRequestSchema, x as CreateStaticWebsiteRequestSchema, xt as UserProfileProviderConfig_UserProfileProviderType, y as TailorDBType_PermitAction, z as CreateExecutorExecutorRequestSchema } from "./service_pb-DSNjrcbW.mjs";
+import { $ as CreateUserProfileConfigRequestSchema, A as UpdatePipelineServiceRequestSchema, At as Condition_Operator, B as UpdateExecutorExecutorRequestSchema, Ct as UserProfileProviderConfig_UserProfileProviderType, D as CreatePipelineResolverRequestSchema, Dt as ApplicationSchemaUpdateAttemptStatus, E as UpdateSecretManagerSecretRequestSchema, Et as UpdateApplicationRequestSchema, F as IdPPermissionOperator, G as CreateAuthHookRequestSchema, H as ExecutorTargetType, I as IdPPermissionPermit, J as CreateAuthOAuth2ClientRequestSchema, K as CreateAuthIDPConfigRequestSchema, L as FunctionExecution_Status, M as CreateIdPServiceRequestSchema, Mt as PageDirection, N as UpdateIdPServiceRequestSchema, O as CreatePipelineServiceRequestSchema, Ot as Subgraph_ServiceType, P as IdPLang, Q as CreateTenantConfigRequestSchema, S as UpdateStaticWebsiteRequestSchema, St as TenantProviderConfig_TenantProviderType, T as CreateSecretManagerVaultRequestSchema, Tt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, U as ExecutorTriggerType, V as ExecutorJobStatus, W as CreateAuthConnectionRequestSchema, X as CreateAuthSCIMResourceRequestSchema, Y as CreateAuthSCIMConfigRequestSchema, Z as CreateAuthServiceRequestSchema, _ as TailorDBType_Permission_Operator, _t as AuthSCIMAttribute_Mutability, a as WorkspacePlatformUserRole, at as UpdateAuthSCIMConfigRequestSchema, b as AddCustomDomainRequestSchema, bt as AuthSCIMConfig_AuthorizationType, c as UpdateWorkflowRequestSchema, ct as UpdateTenantConfigRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as AuthConnection_Type, et as UpdateAuthConnectionRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as AuthHookPoint, g as TailorDBGQLPermission_Permit, gt as AuthOAuth2Client_GrantType, h as TailorDBGQLPermission_Operator, ht as AuthOAuth2Client_ClientType, it as UpdateAuthOAuth2ClientRequestSchema, j as PipelineResolver_OperationType, jt as FilterSchema, k as UpdatePipelineResolverRequestSchema, kt as ConditionSchema, l as WorkflowExecution_Status, lt as UpdateUserProfileConfigRequestSchema, m as TailorDBGQLPermission_Action, mt as AuthInvokerSchema, nt as UpdateAuthIDPConfigRequestSchema, o as CreateWorkflowJobFunctionRequestSchema, ot as UpdateAuthSCIMResourceRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as AuthIDPConfig_AuthType, q as CreateAuthMachineUserRequestSchema, rt as UpdateAuthMachineUserRequestSchema, s as CreateWorkflowRequestSchema, st as UpdateAuthServiceRequestSchema, t as OperatorService, tt as UpdateAuthHookRequestSchema, u as WorkflowJobExecution_Status, ut as AuthConnection_Status, v as TailorDBType_Permission_Permit, vt as AuthSCIMAttribute_Type, w as CreateSecretManagerSecretRequestSchema, wt as CreateApplicationRequestSchema, x as CreateStaticWebsiteRequestSchema, y as TailorDBType_PermitAction, yt as AuthSCIMAttribute_Uniqueness, z as CreateExecutorExecutorRequestSchema } from "./service_pb-BsBR6yW5.mjs";
 import { t as assertDefined } from "./assert-CKfwrmCV.mjs";
 import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-DKF-JsAK.mjs";
-import { $ as initOperatorClient, A as loadAccessToken, G as fetchMachineUserToken, I as loadWorkspaceId, K as fetchPaged, L as platformConfigFromProfile, N as loadMachineUserName, P as loadPlatformClientConfig, R as readPlatformConfig, S as getDistDir, T as loadConfig, V as writePlatformConfig, W as fetchAll, X as getOAuth2ClientId, Y as getConsoleBaseUrl, Z as getPlatformBaseUrl, b as hasGenerationHooks, d as assertUniqueLocalTailorDBTypeNames, et as isDefaultPlatform, f as assertUniqueTailorDBTypeNamesWithExternal, h as platformBundleDefinePlugin, j as loadConfigPath, k as hasUserTokenEntry, l as buildExecutorArgsExpr, m as stringifyFunction, n as generatePluginFilesIfNeeded, nt as byName, p as TailorDBTypeSchema, r as loadApplication, s as HTTP_METHODS, t as defineApplication, tt as resolveStaticWebsiteUrls, u as buildResolverOperationHookExpr, w as hashFile, x as createBundleCache, y as getPluginGenerationDependencies } from "./application-Df5_I83n.mjs";
+import { $ as initOperatorClient, A as loadAccessToken, G as fetchMachineUserToken, I as loadWorkspaceId, K as fetchPaged, L as platformConfigFromProfile, N as loadMachineUserName, P as loadPlatformClientConfig, R as readPlatformConfig, S as getDistDir, T as loadConfig, V as writePlatformConfig, W as fetchAll, X as getOAuth2ClientId, Y as getConsoleBaseUrl, Z as getPlatformBaseUrl, b as hasGenerationHooks, d as assertUniqueLocalTailorDBTypeNames, et as isDefaultPlatform, f as assertUniqueTailorDBTypeNamesWithExternal, h as platformBundleDefinePlugin, j as loadConfigPath, k as hasUserTokenEntry, l as buildExecutorArgsExpr, m as stringifyFunction, n as generatePluginFilesIfNeeded, nt as byName, p as TailorDBTypeSchema, r as loadApplication, s as HTTP_METHODS, t as defineApplication, tt as resolveStaticWebsiteUrls, u as buildResolverOperationHookExpr, w as hashFile, x as createBundleCache, y as getPluginGenerationDependencies } from "./application-DmjIKQ-a.mjs";
 import { o as loadFilesWithIgnores, t as createExecutorService } from "./service-B2Jd9CxS.mjs";
 import { t as multiline } from "./multiline-Cf9ODpr1.mjs";
 import { t as readPackageJson } from "./package-json-DcQApfPQ.mjs";
@@ -1117,9 +1117,10 @@ function extractAttributesFromConfig(config) {
 * @param env - Environment configuration
 * @param machineUserNames - Registered machine user names (used to narrow `authInvoker` strings)
 * @param idpNames - Registered IdP names (used to narrow `idpUser*Trigger({ idp })` strings)
+* @param connectionNames - Registered auth connection names (used to narrow `getConnectionToken()` strings)
 * @returns Generated type definition source
 */
-function generateTypeDefinition(attributeMap, attributeList, env, machineUserNames, idpNames) {
+function generateTypeDefinition(attributeMap, attributeList, env, machineUserNames, idpNames, connectionNames) {
 	const mapFields = attributeMap ? Object.entries(attributeMap).map(([key, value]) => `    ${key}: ${value};`).join("\n") : "";
 	const mapBody = !attributeMap || Object.keys(attributeMap).length === 0 ? "{}" : `{
 ${mapFields}
@@ -1139,6 +1140,10 @@ ${envFields}
 ${machineUserFields}
   }`;
 	const idpNameFields = idpNames?.length ? idpNames.map((name) => `    ${isValidIdentifier(name) ? name : JSON.stringify(name)}: true;`).join("\n") : "";
+	const idpNameBody = !idpNames || idpNames.length === 0 ? "{}" : `{
+${idpNameFields}
+  }`;
+	const connectionNameFields = connectionNames?.length ? connectionNames.map((name) => `    ${isValidIdentifier(name) ? name : JSON.stringify(name)}: true;`).join("\n") : "";
 	return multiline`
 // This file is auto-generated by @tailor-platform/sdk
 // Do not edit this file manually
@@ -1149,8 +1154,9 @@ declare module "@tailor-platform/sdk" {
   interface AttributeList ${listBody}
   interface Env ${envBody}
   interface MachineUserNameRegistry ${machineUserBody}
-  interface IdpNameRegistry ${!idpNames || idpNames.length === 0 ? "{}" : `{
-${idpNameFields}
+  interface IdpNameRegistry ${idpNameBody}
+  interface ConnectionNameRegistry ${!connectionNames || connectionNames.length === 0 ? "{}" : `{
+${connectionNameFields}
   }`}
 }
 
@@ -1164,6 +1170,8 @@ function collectAttributesFromConfig(config) {
 	if (!auth || typeof auth !== "object") return idpNames ? { idpNames } : {};
 	const machineUsersObj = auth.machineUsers;
 	const machineUserNames = machineUsersObj && typeof machineUsersObj === "object" ? Object.keys(machineUsersObj) : void 0;
+	const connectionsObj = auth.connections;
+	const connectionNames = connectionsObj && typeof connectionsObj === "object" ? Object.keys(connectionsObj) : void 0;
 	const inferAttributeType = (field) => {
 		const type = field?.type;
 		const metadata = field?.metadata;
@@ -1186,14 +1194,16 @@ function collectAttributesFromConfig(config) {
 			}, {}) : void 0,
 			attributeList,
 			machineUserNames,
-			idpNames
+			idpNames,
+			connectionNames
 		};
 	}
 	if ("machineUserAttributes" in auth) {
 		const machineUserAttributes = auth.machineUserAttributes;
 		if (!machineUserAttributes) return {
 			machineUserNames,
-			idpNames
+			idpNames,
+			connectionNames
 		};
 		return {
 			attributeMap: Object.entries(machineUserAttributes).reduce((acc, [key, field]) => {
@@ -1201,12 +1211,14 @@ function collectAttributesFromConfig(config) {
 				return acc;
 			}, {}),
 			machineUserNames,
-			idpNames
+			idpNames,
+			connectionNames
 		};
 	}
 	return {
 		machineUserNames,
-		idpNames
+		idpNames,
+		connectionNames
 	};
 }
 /**
@@ -1231,15 +1243,16 @@ function resolveTypeDefinitionPath(configPath) {
 async function generateUserTypes(options) {
 	const { config, configPath } = options;
 	try {
-		const { attributeMap, attributeList, machineUserNames, idpNames } = extractAttributesFromConfig(config);
+		const { attributeMap, attributeList, machineUserNames, idpNames, connectionNames } = extractAttributesFromConfig(config);
 		if (!attributeMap && !attributeList) logger.info("No attributes found in configuration", { mode: "plain" });
 		if (attributeMap) logger.debug(`Extracted AttributeMap: ${JSON.stringify(attributeMap)}`);
 		if (attributeList) logger.debug(`Extracted AttributeList: ${JSON.stringify(attributeList)}`);
 		if (machineUserNames?.length) logger.debug(`Extracted MachineUserNames: ${JSON.stringify(machineUserNames)}`);
 		if (idpNames?.length) logger.debug(`Extracted IdpNames: ${JSON.stringify(idpNames)}`);
+		if (connectionNames?.length) logger.debug(`Extracted ConnectionNames: ${JSON.stringify(connectionNames)}`);
 		const env = config.env;
 		if (env) logger.debug(`Extracted Env: ${JSON.stringify(env)}`);
-		const typeDefContent = generateTypeDefinition(attributeMap, attributeList, env, machineUserNames, idpNames);
+		const typeDefContent = generateTypeDefinition(attributeMap, attributeList, env, machineUserNames, idpNames, connectionNames);
 		const outputPath = resolveTypeDefinitionPath(configPath);
 		fs$1.mkdirSync(path.dirname(outputPath), { recursive: true });
 		fs$1.writeFileSync(outputPath, typeDefContent);
@@ -2360,21 +2373,28 @@ function buildConnectionRequest(workspaceId, name, config) {
 		}
 	};
 }
-function hashConnectionConfig(config) {
-	return hashValue(JSON.stringify({
-		type: config.type,
-		providerUrl: config.providerUrl,
-		issuerUrl: config.issuerUrl,
-		clientId: config.clientId,
-		clientSecret: config.clientSecret,
-		authUrl: config.authUrl ?? "",
-		tokenUrl: config.tokenUrl ?? ""
-	}));
-}
-function hasNonSecretFieldChanged(existing, desired) {
-	if (existing.config.case !== "oauth2") return true;
-	const oauth2 = existing.config.value;
-	return oauth2.providerUrl !== desired.providerUrl || oauth2.issuerUrl !== desired.issuerUrl || oauth2.clientId !== desired.clientId || oauth2.authUrl !== (desired.authUrl ?? "") || oauth2.tokenUrl !== (desired.tokenUrl ?? "");
+function buildUpdateMask(existing, desired, secretChanged) {
+	if (existing.config.case !== "oauth2") {
+		const paths = [
+			"type",
+			"oauth2.provider_url",
+			"oauth2.issuer_url",
+			"oauth2.client_id",
+			"oauth2.auth_url",
+			"oauth2.token_url"
+		];
+		if (desired.clientSecret) paths.push("oauth2.client_secret");
+		return { paths };
+	}
+	const paths = [];
+	const v = existing.config.value;
+	if (v.providerUrl !== desired.providerUrl) paths.push("oauth2.provider_url");
+	if (v.issuerUrl !== desired.issuerUrl) paths.push("oauth2.issuer_url");
+	if (v.clientId !== desired.clientId) paths.push("oauth2.client_id");
+	if (v.authUrl !== (desired.authUrl ?? "")) paths.push("oauth2.auth_url");
+	if (v.tokenUrl !== (desired.tokenUrl ?? "")) paths.push("oauth2.token_url");
+	if (secretChanged && desired.clientSecret) paths.push("oauth2.client_secret");
+	return { paths };
 }
 /**
 * Plan auth connection changes based on current and desired state.
@@ -2432,15 +2452,14 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 				resourceType: "Auth connection",
 				resourceName: name
 			});
-			const currentHash = hashConnectionConfig(config);
-			const storedHash = state.connections?.[name];
-			if (hasNonSecretFieldChanged(existing.resource, config) || currentHash !== storedHash) changeSet.replaces.push({
+			const secretChanged = hashValue(config.clientSecret) !== state.connections?.[name];
+			const updateMask = buildUpdateMask(existing.resource, config, secretChanged);
+			if (updateMask.paths.length > 0) changeSet.replaces.push({
 				name,
-				deleteRequest: {
-					workspaceId,
-					connectionName: name
+				updateRequest: {
+					...buildConnectionRequest(workspaceId, name, config),
+					updateMask
 				},
-				createRequest: buildConnectionRequest(workspaceId, name, config),
 				metaRequest
 			});
 			else if (!existing.label) changeSet.updates.push({
@@ -2477,21 +2496,6 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 		resourceOwners
 	};
 }
-function extractOAuth2Config(connection) {
-	if (!connection) return void 0;
-	const config = connection.config;
-	if (!config || config.case !== "oauth2") return void 0;
-	const v = config.value;
-	return {
-		type: "oauth2",
-		providerUrl: v.providerUrl ?? "",
-		issuerUrl: v.issuerUrl ?? "",
-		clientId: v.clientId ?? "",
-		clientSecret: v.clientSecret ?? "",
-		authUrl: v.authUrl || void 0,
-		tokenUrl: v.tokenUrl || void 0
-	};
-}
 /**
 * Apply auth connection changes for the given phase.
 * @param client - Operator client instance
@@ -2504,10 +2508,10 @@ async function applyAuthConnections(client, result, phase) {
 		await Promise.all(changeSet.creates.map(async (create) => {
 			await client.createAuthConnection(create.request);
 			await client.setMetadata(create.metaRequest);
+			logger.info(`Connection "${create.name}" was created. Authorize it with:\n  tailor-sdk authconnection authorize --name ${create.name}\nOr via the Console: tailor-sdk authconnection open`);
 		}));
 		for (const replace of changeSet.replaces) {
-			await client.deleteAuthConnection(replace.deleteRequest);
-			await client.createAuthConnection(replace.createRequest);
+			if ((await client.updateAuthConnection(replace.updateRequest)).connection?.status === AuthConnection_Status.UNAUTHORIZED) logger.warn(`Connection "${replace.name}" requires re-authorization. Authorize with:\n  tailor-sdk authconnection authorize --name ${replace.name}\nOr via the Console: tailor-sdk authconnection open`);
 			await client.setMetadata(replace.metaRequest);
 		}
 		await Promise.all(changeSet.updates.map(async (update) => {
@@ -2516,12 +2520,12 @@ async function applyAuthConnections(client, result, phase) {
 		const state = loadSecretsState();
 		if (!state.connections) state.connections = {};
 		for (const create of changeSet.creates) {
-			const oauth2 = extractOAuth2Config(create.request.connection);
-			if (oauth2) state.connections[create.name] = hashConnectionConfig(oauth2);
+			const conn = create.request.connection;
+			if (conn?.config?.case === "oauth2") state.connections[create.name] = hashValue(conn.config.value.clientSecret ?? "");
 		}
 		for (const replace of changeSet.replaces) {
-			const oauth2 = extractOAuth2Config(replace.createRequest.connection);
-			if (oauth2) state.connections[replace.name] = hashConnectionConfig(oauth2);
+			const conn = replace.updateRequest.connection;
+			if (conn?.config?.case === "oauth2" && replace.updateRequest.updateMask?.paths?.includes("oauth2.client_secret")) state.connections[replace.name] = hashValue(conn.config.value.clientSecret ?? "");
 		}
 		saveSecretsState(state);
 	} else {
@@ -6563,6 +6567,23 @@ function parseMigrationNumberArg(numberStr) {
 * All object schemas use `z.looseObject` so that unknown keys written
 * by newer CLI versions survive a load → save round-trip.
 */
+function snapshotRecordSchema(valueSchema) {
+	return z.custom((value) => typeof value === "object" && value !== null && !Array.isArray(value), { message: "Expected record" }).transform((value, ctx) => {
+		const record = Object.create(null);
+		for (const key of Object.keys(value)) {
+			const result = valueSchema.safeParse(value[key]);
+			if (!result.success) {
+				for (const issue of result.error.issues) ctx.addIssue({
+					...issue,
+					path: [key, ...issue.path]
+				});
+				continue;
+			}
+			record[key] = result.data;
+		}
+		return record;
+	});
+}
 const snapshotHookSchema = z.looseObject({ expr: z.string() });
 const snapshotValidationSchema = z.looseObject({
 	script: z.looseObject({ expr: z.string() }).optional(),
@@ -6596,7 +6617,7 @@ const snapshotFieldConfigSchema = z.looseObject({
 	validate: z.array(snapshotValidationSchema).optional(),
 	serial: snapshotSerialSchema.optional(),
 	scale: z.number().optional(),
-	fields: z.lazy(() => z.record(z.string(), snapshotFieldConfigSchema)).optional()
+	fields: z.lazy(() => snapshotRecordSchema(snapshotFieldConfigSchema)).optional()
 });
 const snapshotIndexConfigSchema = z.looseObject({
 	fields: z.array(z.string()),
@@ -6667,7 +6688,7 @@ const tailorDBSnapshotTypeSchema = z.looseObject({
 	name: z.string(),
 	pluralForm: z.string().optional(),
 	description: z.string().optional(),
-	fields: z.record(z.string(), snapshotFieldConfigSchema),
+	fields: snapshotRecordSchema(snapshotFieldConfigSchema),
 	settings: z.looseObject({
 		aggregation: z.boolean().optional(),
 		bulkUpsert: z.boolean().optional(),
@@ -6679,10 +6700,10 @@ const tailorDBSnapshotTypeSchema = z.looseObject({
 		}).optional(),
 		publishEvents: z.boolean().optional()
 	}).optional(),
-	indexes: z.record(z.string(), snapshotIndexConfigSchema).optional(),
-	files: z.record(z.string(), z.string()).optional(),
-	forwardRelationships: z.record(z.string(), snapshotRelationshipSchema).optional(),
-	backwardRelationships: z.record(z.string(), snapshotRelationshipSchema).optional(),
+	indexes: snapshotRecordSchema(snapshotIndexConfigSchema).optional(),
+	files: snapshotRecordSchema(z.string()).optional(),
+	forwardRelationships: snapshotRecordSchema(snapshotRelationshipSchema).optional(),
+	backwardRelationships: snapshotRecordSchema(snapshotRelationshipSchema).optional(),
 	permissions: z.looseObject({
 		record: snapshotRecordPermissionSchema.optional(),
 		gql: snapshotGqlPermissionSchema.optional()
@@ -6692,11 +6713,11 @@ const schemaSnapshotSchema = z.looseObject({
 	version: z.number(),
 	namespace: z.string(),
 	createdAt: z.string(),
-	types: z.record(z.string(), tailorDBSnapshotTypeSchema)
+	types: snapshotRecordSchema(tailorDBSnapshotTypeSchema)
 });
 const typeSettingsPatchSchema = z.looseObject({
-	indexes: z.record(z.string(), snapshotIndexConfigSchema).optional(),
-	files: z.record(z.string(), z.string()).optional()
+	indexes: snapshotRecordSchema(snapshotIndexConfigSchema).optional(),
+	files: snapshotRecordSchema(z.string()).optional()
 });
 const snapshotPermissionStateSchema = z.looseObject({
 	recordPermission: snapshotRecordPermissionSchema.optional(),
@@ -6902,16 +6923,26 @@ const MIGRATION_NUMBER_PATTERN = /^\d{4}$/;
 * Must stay in sync with the platform's default decimal scale.
 */
 const DEFAULT_DECIMAL_SCALE = 6;
+function createSnapshotRecord() {
+	return Object.create(null);
+}
+function copySnapshotRecord(record) {
+	const copy = createSnapshotRecord();
+	for (const [key, value] of Object.entries(record ?? {})) copy[key] = value;
+	return copy;
+}
 /**
 * Normalize a snapshot field in place so the snapshot becomes the canonical
 * form for comparison. Currently fills in the platform default decimal scale
 * when omitted, which avoids false drift between local schemas (where scale
 * may be omitted) and the platform (which always materializes a scale).
 * @param {SnapshotFieldConfig} field - Field configuration to normalize
+* @returns The same field object after normalization
 */
 function normalizeSnapshotField(field) {
 	if (field.type === "decimal" && field.scale === void 0) field.scale = 6;
 	if (field.fields) for (const nested of Object.values(field.fields)) normalizeSnapshotField(nested);
+	return field;
 }
 /**
 * Normalize a snapshot type in place to the canonical comparison shape.
@@ -6922,10 +6953,21 @@ function normalizeSnapshotField(field) {
 *
 * Idempotent — safe to call multiple times on the same input.
 * @param {TailorDBSnapshotType} type - Snapshot type to normalize
+* @returns The same snapshot type object after normalization
 */
 function normalizeSnapshotType(type) {
 	if (!type.pluralForm) type.pluralForm = inflection.pluralize(type.name);
 	for (const field of Object.values(type.fields)) normalizeSnapshotField(field);
+	return type;
+}
+/**
+* Normalize a schema snapshot in place to the canonical comparison shape.
+* @param {SchemaSnapshot} snapshot - Schema snapshot to normalize
+* @returns The same schema snapshot object branded as normalized
+*/
+function normalizeSchemaSnapshot(snapshot) {
+	for (const type of Object.values(snapshot.types)) normalizeSnapshotType(type);
+	return snapshot;
 }
 /**
 * Validate that a migration number follows the expected format (4-digit number)
@@ -7063,7 +7105,7 @@ function createSnapshotFieldConfigFromOperatorConfig(fieldConfig) {
 * @returns {TailorDBSnapshotType} Snapshot type configuration
 */
 function createSnapshotType(type) {
-	const fields = {};
+	const fields = createSnapshotRecord();
 	for (const [fieldName, field] of Object.entries(type.fields)) fields[fieldName] = createSnapshotFieldConfig(field);
 	const snapshotType = {
 		name: type.name,
@@ -7127,7 +7169,7 @@ function createSnapshotType(type) {
 			...policy.description && { description: policy.description }
 		}));
 	}
-	return snapshotType;
+	return normalizeSnapshotType(snapshotType);
 }
 /**
 * Convert an action permission to snapshot format
@@ -7145,22 +7187,22 @@ function convertActionPermission(permission) {
 * Create a schema snapshot from local type definitions
 * @param {Record<string, TailorDBType>} types - Local type definitions
 * @param {string} namespace - Namespace for the snapshot
-* @returns {SchemaSnapshot} Schema snapshot
+* @returns {NormalizedSchemaSnapshot} Normalized schema snapshot
 */
 function createSnapshotFromLocalTypes(types, namespace) {
-	const snapshotTypes = {};
+	const snapshotTypes = createSnapshotRecord();
 	for (const [typeName, type] of Object.entries(types)) snapshotTypes[typeName] = createSnapshotType(type);
-	return {
+	return normalizeSchemaSnapshot({
 		version: 1,
 		namespace,
 		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 		types: snapshotTypes
-	};
+	});
 }
 /**
 * Load a schema snapshot from a file
 * @param {string} filePath - Path to the snapshot file
-* @returns {SchemaSnapshot} Loaded schema snapshot
+* @returns {NormalizedSchemaSnapshot} Loaded normalized schema snapshot
 */
 function loadSnapshot(filePath) {
 	const content = fs$1.readFileSync(filePath, "utf-8");
@@ -7173,8 +7215,7 @@ function loadSnapshot(filePath) {
 	const result = schemaSnapshotSchema.safeParse(raw);
 	if (!result.success) throw new Error(`Invalid schema snapshot at ${filePath}: ${z.prettifyError(result.error)}`, { cause: result.error });
 	const snapshot = result.data;
-	for (const type of Object.values(snapshot.types)) normalizeSnapshotType(type);
-	return snapshot;
+	return normalizeSchemaSnapshot(snapshot);
 }
 /**
 * Load a migration diff from a file
@@ -7243,10 +7284,10 @@ function getNextMigrationNumber(migrationsDir) {
 * Apply a diff to a snapshot to get the resulting snapshot
 * @param {SchemaSnapshot} snapshot - Base snapshot to apply diff to
 * @param {MigrationDiff} diff - Diff to apply
-* @returns {SchemaSnapshot} Resulting snapshot after applying diff
+* @returns {NormalizedSchemaSnapshot} Normalized snapshot after applying diff
 */
 function applyDiffToSnapshot(snapshot, diff) {
-	const types = { ...snapshot.types };
+	const types = copySnapshotRecord(snapshot.types);
 	for (const change of diff.changes) switch (change.kind) {
 		case "type_added":
 			types[change.typeName] = change.after;
@@ -7269,19 +7310,21 @@ function applyDiffToSnapshot(snapshot, diff) {
 		case "field_added":
 		case "field_modified": {
 			const existing = types[change.typeName];
-			if (existing) types[change.typeName] = {
-				...existing,
-				fields: {
-					...existing.fields,
-					[change.fieldName]: change.after
-				}
-			};
+			if (existing) {
+				const fields = copySnapshotRecord(existing.fields);
+				fields[change.fieldName] = change.after;
+				types[change.typeName] = {
+					...existing,
+					fields
+				};
+			}
 			break;
 		}
 		case "field_removed": {
 			const existing = types[change.typeName];
 			if (existing) {
-				const { [change.fieldName]: _, ...remainingFields } = existing.fields;
+				const remainingFields = copySnapshotRecord(existing.fields);
+				delete remainingFields[change.fieldName];
 				types[change.typeName] = {
 					...existing,
 					fields: remainingFields
@@ -7292,19 +7335,21 @@ function applyDiffToSnapshot(snapshot, diff) {
 		case "index_added":
 		case "index_modified": {
 			const existing = types[change.typeName];
-			if (existing) types[change.typeName] = {
-				...existing,
-				indexes: {
-					...existing.indexes,
-					[change.indexName]: change.after
-				}
-			};
+			if (existing) {
+				const indexes = copySnapshotRecord(existing.indexes);
+				indexes[change.indexName] = change.after;
+				types[change.typeName] = {
+					...existing,
+					indexes
+				};
+			}
 			break;
 		}
 		case "index_removed": {
 			const existing = types[change.typeName];
 			if (existing && existing.indexes) {
-				const { [change.indexName]: _, ...remainingIndexes } = existing.indexes;
+				const remainingIndexes = copySnapshotRecord(existing.indexes);
+				delete remainingIndexes[change.indexName];
 				types[change.typeName] = {
 					...existing,
 					indexes: Object.keys(remainingIndexes).length > 0 ? remainingIndexes : void 0
@@ -7315,19 +7360,21 @@ function applyDiffToSnapshot(snapshot, diff) {
 		case "file_added":
 		case "file_modified": {
 			const existing = types[change.typeName];
-			if (existing) types[change.typeName] = {
-				...existing,
-				files: {
-					...existing.files,
-					[change.fieldName]: change.after
-				}
-			};
+			if (existing) {
+				const files = copySnapshotRecord(existing.files);
+				files[change.fieldName] = change.after;
+				types[change.typeName] = {
+					...existing,
+					files
+				};
+			}
 			break;
 		}
 		case "file_removed": {
 			const existing = types[change.typeName];
 			if (existing && existing.files) {
-				const { [change.fieldName]: _, ...remainingFiles } = existing.files;
+				const remainingFiles = copySnapshotRecord(existing.files);
+				delete remainingFiles[change.fieldName];
 				types[change.typeName] = {
 					...existing,
 					files: Object.keys(remainingFiles).length > 0 ? remainingFiles : void 0
@@ -7340,20 +7387,21 @@ function applyDiffToSnapshot(snapshot, diff) {
 			const existing = types[change.typeName];
 			if (existing) {
 				const rel = change.after;
-				if ((change.relationshipType ?? (existing.forwardRelationships?.[change.relationshipName] ? "forward" : existing.backwardRelationships?.[change.relationshipName] ? "backward" : "forward")) === "forward") types[change.typeName] = {
-					...existing,
-					forwardRelationships: {
-						...existing.forwardRelationships,
-						[change.relationshipName]: rel
-					}
-				};
-				else types[change.typeName] = {
-					...existing,
-					backwardRelationships: {
-						...existing.backwardRelationships,
-						[change.relationshipName]: rel
-					}
-				};
+				if ((change.relationshipType ?? (existing.forwardRelationships?.[change.relationshipName] ? "forward" : existing.backwardRelationships?.[change.relationshipName] ? "backward" : "forward")) === "forward") {
+					const forwardRelationships = copySnapshotRecord(existing.forwardRelationships);
+					forwardRelationships[change.relationshipName] = rel;
+					types[change.typeName] = {
+						...existing,
+						forwardRelationships
+					};
+				} else {
+					const backwardRelationships = copySnapshotRecord(existing.backwardRelationships);
+					backwardRelationships[change.relationshipName] = rel;
+					types[change.typeName] = {
+						...existing,
+						backwardRelationships
+					};
+				}
 			}
 			break;
 		}
@@ -7362,13 +7410,15 @@ function applyDiffToSnapshot(snapshot, diff) {
 			if (type) {
 				const targetType = change.relationshipType ?? (type.forwardRelationships?.[change.relationshipName] ? "forward" : type.backwardRelationships?.[change.relationshipName] ? "backward" : null);
 				if (targetType === "forward" && type.forwardRelationships?.[change.relationshipName]) {
-					const { [change.relationshipName]: _, ...remaining } = type.forwardRelationships;
+					const remaining = copySnapshotRecord(type.forwardRelationships);
+					delete remaining[change.relationshipName];
 					types[change.typeName] = {
 						...type,
 						forwardRelationships: Object.keys(remaining).length > 0 ? remaining : void 0
 					};
 				} else if (targetType === "backward" && type.backwardRelationships?.[change.relationshipName]) {
-					const { [change.relationshipName]: _, ...remaining } = type.backwardRelationships;
+					const remaining = copySnapshotRecord(type.backwardRelationships);
+					delete remaining[change.relationshipName];
 					types[change.typeName] = {
 						...type,
 						backwardRelationships: Object.keys(remaining).length > 0 ? remaining : void 0
@@ -7392,18 +7442,18 @@ function applyDiffToSnapshot(snapshot, diff) {
 			break;
 		}
 	}
-	return {
+	return normalizeSchemaSnapshot({
 		...snapshot,
 		types,
 		createdAt: diff.createdAt
-	};
+	});
 }
 /**
 * Reconstruct the latest schema snapshot from all migration files
 * Returns null if no migrations exist
 * @param {string} migrationsDir - Migrations directory path
 * @param {number} [maxVersion] - Optional maximum migration version to apply
-* @returns {SchemaSnapshot | null} Reconstructed snapshot or null if no migrations exist
+* @returns {NormalizedSchemaSnapshot | null} Reconstructed normalized snapshot or null if no migrations exist
 */
 function reconstructSnapshotFromMigrations(migrationsDir, maxVersion) {
 	const files = getMigrationFiles(migrationsDir);
@@ -7766,8 +7816,9 @@ function comparePermissions(ctx, typeName, oldRecordPerm, newRecordPerm, oldGqlP
 * @returns {MigrationDiff} Migration diff between snapshots
 */
 function compareSnapshots(previous, current) {
-	for (const type of Object.values(previous.types)) normalizeSnapshotType(type);
-	for (const type of Object.values(current.types)) normalizeSnapshotType(type);
+	return compareNormalizedSnapshots(normalizeSchemaSnapshot(previous), normalizeSchemaSnapshot(current));
+}
+function compareNormalizedSnapshots(previous, current) {
 	const ctx = {
 		changes: [],
 		breakingChanges: [],
@@ -7902,7 +7953,7 @@ function assertValidMigrationFiles(migrationsDir, namespace) {
 * @returns {Record<string, SnapshotFieldConfig>} Converted field configs
 */
 function convertRemoteFieldsToSnapshot(remoteType) {
-	const fields = {};
+	const fields = createSnapshotRecord();
 	const remoteFields = remoteType.schema?.fields ?? {};
 	for (const [fieldName, remoteField] of Object.entries(remoteFields)) {
 		const config = {
@@ -7938,11 +7989,35 @@ function convertRemoteFieldsToSnapshot(remoteType) {
 			...remoteField.serial.format && { format: remoteField.serial.format }
 		};
 		if (remoteField.scale !== void 0) config.scale = remoteField.scale;
-		normalizeSnapshotField(config);
 		fields[fieldName] = config;
 	}
 	return fields;
 }
+function convertRemoteTypeToSnapshot(remoteType) {
+	const snapshotType = {
+		name: remoteType.name,
+		pluralForm: remoteType.schema?.settings?.pluralForm || inflection.pluralize(remoteType.name),
+		fields: convertRemoteFieldsToSnapshot(remoteType)
+	};
+	if (remoteType.schema?.description) snapshotType.description = remoteType.schema.description;
+	return snapshotType;
+}
+/**
+* Convert remote TailorDB types into the normalized snapshot shape used by drift checks.
+* @param {ProtoTailorDBType[]} remoteTypes - Remote TailorDB types from the API
+* @param {string} namespace - Namespace for the reconstructed snapshot
+* @returns {NormalizedSchemaSnapshot} Normalized snapshot-shaped remote state
+*/
+function createSnapshotFromRemoteTypes(remoteTypes, namespace) {
+	const types = createSnapshotRecord();
+	for (const remoteType of remoteTypes) types[remoteType.name] = convertRemoteTypeToSnapshot(remoteType);
+	return normalizeSchemaSnapshot({
+		version: 1,
+		namespace,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		types
+	});
+}
 /**
 * Compare a single field between remote and snapshot
 * @param {string} typeName - Name of the type
@@ -8003,12 +8078,13 @@ const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["id"]);
 * @returns {SchemaDrift[]} List of drifts detected
 */
 function compareRemoteWithSnapshot(remoteTypes, snapshot) {
-	for (const type of Object.values(snapshot.types)) normalizeSnapshotType(type);
+	return compareNormalizedRemoteWithSnapshot(createSnapshotFromRemoteTypes(remoteTypes, snapshot.namespace), normalizeSchemaSnapshot(snapshot));
+}
+function compareNormalizedRemoteWithSnapshot(remoteSnapshot, snapshot) {
 	const drifts = [];
-	const remoteTypeMap = /* @__PURE__ */ new Map();
-	for (const remoteType of remoteTypes) remoteTypeMap.set(remoteType.name, remoteType);
+	const remoteTypeMap = new Map(Object.entries(remoteSnapshot.types));
 	const snapshotTypeNames = new Set(Object.keys(snapshot.types));
-	const remoteTypeNames = new Set(remoteTypeMap.keys());
+	const remoteTypeNames = new Set(Object.keys(remoteSnapshot.types));
 	for (const typeName of snapshotTypeNames) if (!remoteTypeNames.has(typeName)) drifts.push({
 		typeName,
 		kind: "type_missing_remote",
@@ -8023,7 +8099,7 @@ function compareRemoteWithSnapshot(remoteTypes, snapshot) {
 		if (!remoteTypeNames.has(typeName)) continue;
 		const remoteType = assertDefined(remoteTypeMap.get(typeName), `type "${typeName}" missing from remoteTypeMap`);
 		const snapshotType = assertDefined(snapshot.types[typeName], `type "${typeName}" missing from snapshot`);
-		const remoteFields = convertRemoteFieldsToSnapshot(remoteType);
+		const remoteFields = remoteType.fields;
 		const snapshotFields = snapshotType.fields;
 		const remoteFieldNames = new Set(Object.keys(remoteFields).filter((f) => !SYSTEM_FIELDS.has(f)));
 		const snapshotFieldNames = new Set(Object.keys(snapshotFields).filter((f) => !SYSTEM_FIELDS.has(f)));
@@ -10264,11 +10340,11 @@ async function registerJobFunctions(client, changeSet, appName, appId, unchanged
 	const allUsedJobNames = /* @__PURE__ */ new Set();
 	unchangedWorkflowJobNames.forEach((jobName) => allUsedJobNames.add(jobName));
 	for (const item of [...changeSet.creates, ...changeSet.updates]) for (const jobName of item.usedJobNames) allUsedJobNames.add(jobName);
-	const existingJobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
+	const existingJobFunctions = await fetchAll(async (pageToken, _maxPageSize) => {
 		const response = await client.listWorkflowJobFunctions({
 			workspaceId,
 			pageToken,
-			pageSize: maxPageSize
+			pageSize: 100
 		});
 		return [response.jobFunctions.map((j) => j.name), response.nextPageToken];
 	});
@@ -10449,11 +10525,11 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 }
 async function planWorkflowJobFunctionDeletes(params) {
 	const { client, workspaceId, appName, appId, retainedWorkflowJobNames } = params;
-	const existingJobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
+	const existingJobFunctions = await fetchAll(async (pageToken, _maxPageSize) => {
 		const response = await client.listWorkflowJobFunctions({
 			workspaceId,
 			pageToken,
-			pageSize: maxPageSize
+			pageSize: 100
 		});
 		return [response.jobFunctions.map((jobFunction) => jobFunction.name), response.nextPageToken];
 	});
@@ -10609,6 +10685,17 @@ async function validatePlan(input) {
 			violations
 		});
 	}
+	function inPlaceReplaces(schema, kind, items) {
+		validateItems({
+			validator,
+			schema,
+			kind,
+			action: "replace",
+			items,
+			requestKey: "updateRequest",
+			violations
+		});
+	}
 	creates(CreateTailorDBServiceRequestSchema, "TailorDB service", tailorDB.changeSet.service.creates);
 	creates(CreateTailorDBTypeRequestSchema, "TailorDB type", tailorDB.changeSet.type.creates);
 	updates(UpdateTailorDBTypeRequestSchema, "TailorDB type", tailorDB.changeSet.type.updates);
@@ -10732,7 +10819,7 @@ async function validatePlan(input) {
 		}
 	})));
 	creates(CreateAuthConnectionRequestSchema, "Auth connection", auth.changeSet.connection.creates);
-	replaces(CreateAuthConnectionRequestSchema, "Auth connection", auth.changeSet.connection.replaces);
+	inPlaceReplaces(UpdateAuthConnectionRequestSchema, "Auth connection", auth.changeSet.connection.replaces);
 	if (violations.length === 0) return;
 	const resourceNames = new Set(violations.map((v) => `${v.kind}:${v.name}`));
 	logger.error(`Pre-flight validation found ${violations.length} violation(s) across ${resourceNames.size} resource(s):`);
@@ -16122,7 +16209,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-BakHtldG.mjs");
+	const { defineApplication } = await import("./application-a_ApFuPh.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -18387,4 +18474,4 @@ function isDeno() {
 
 //#endregion
 export { getOrganization as $, generateAllTypeManifestsFromSnapshot as $t, listCommand$3 as A, apiCommand as An, getExecutorWaitFailureMessage as At, show as B, paginationArgs as Bn, listWorkflowExecutions as Bt, listCommand$2 as C, getNamespacesWithMigrations as Cn, listWebhookExecutors as Ct, waitWorkflowExecution as D, PluginManager as Dn, listCommand$9 as Dt, waitCommand as E, sdkNameLabelKey as En, triggerExecutor as Et, generateCommand as F, configArg as Fn, startWorkflow as Ft, removeCommand$1 as G, deploy as Gt, extractOwnedNamespaces as H, workspaceArgs as Hn, formatKeyValueTable as Ht, generateMigrationScript as I, confirmationArgs as In, getCommand$5 as It, organizationTree as J, bundleMigrationScript as Jt, updateCommand$1 as K, executeScript as Kt, writeDbTypesFile as L, deploymentArgs as Ln, getWorkflow as Lt, truncate as M, assertWritable as Mn, listExecutorJobs as Mt, truncateCommand as N, defineAppCommand as Nn, watchExecutorJob as Nt, resumeCommand as O, generateUserTypes as On, listExecutors as Ot, generate as P, commonArgs as Pn, startCommand as Pt, getCommand$1 as Q, compareSnapshotWithRemote as Qt, getConfiguredEditorCommand as R, isVerbose as Rn, executionsCommand as Rt, listApps as S, hasChanges as Sn, getFunctionRegistry as St, healthCommand as T, resourceTrn as Tn, triggerCommand as Tt, logBetaWarning as U, getCommand$6 as Ut, showCommand as V, toPageDirection as Vn, functionExecutionStatusToString as Vt, remove as W, getExecutor as Wt, listCommand$4 as X, handleOptionalToRequiredError as Xt, treeCommand as Y, MIGRATION_LABEL_KEY as Yt, listOrganizations as Z, parseMigrationLabelNumber as Zt, getWorkspace as _, reconstructSnapshotFromMigrations as _n, listMachineUsers as _t, updateUser as a, SCHEMA_FILE_NAME as an, getFolder as at, createCommand as b, formatDiffSummary as bn, listFunctionRegistries as bt, listCommand as c, compareSnapshots as cn, createCommand$1 as ct, inviteUser as d, getMigrationDirPath as dn, listOAuth2Clients as dt, protoGqlPermission as en, updateCommand$2 as et, restoreCommand as f, getMigrationFilePath as fn, getCommand$3 as ft, getCommand as g, loadDiff as gn, listCommand$7 as gt, listWorkspaces as h, isValidMigrationNumber as hn, tokenCommand as ht, updateCommand as i, MIGRATE_FILE_NAME as in, getCommand$2 as it, listWorkflows as j, apiCall as jn, jobsCommand as jt, resumeWorkflow as k, prompt as kn, getExecutorJob as kt, listUsers as l, createSnapshotFromLocalTypes as ln, createFolder as lt, listCommand$1 as m, getNextMigrationNumber as mn, getMachineUserToken as mt, query as n, DIFF_FILE_NAME as nn, listCommand$5 as nt, removeCommand as o, assertValidMigrationFiles as on, deleteCommand$1 as ot, restoreWorkspace as p, getMigrationFiles as pn, getOAuth2Client as pt, updateOrganization as q, waitForExecution as qt, queryCommand as r, INITIAL_SCHEMA_NUMBER as rn, listFolders as rt, removeUser as s, compareLocalTypesWithSnapshot as sn, deleteFolder as st, isNativeTypeScriptRuntime as t, DB_TYPES_FILE_NAME as tn, updateFolder as tt, inviteCommand as u, getLatestMigrationNumber as un, listCommand$6 as ut, deleteCommand as v, formatMigrationNumber as vn, generate$1 as vt, getAppHealth as w, ensureConfigId as wn, webhookCommand as wt, createWorkspace as x, formatMigrationDiff as xn, getCommand$4 as xt, deleteWorkspace as y, parseMigrationNumberArg as yn, listCommand$8 as yt, openInConfiguredEditor as z, pagedLogArgs as zn, getWorkflowExecution as zt };
-//# sourceMappingURL=runtime-CSY0eD4_.mjs.map
+//# sourceMappingURL=runtime-Cd375HD-.mjs.map