@tailor-platform/sdk 1.72.0 → 1.73.1

package/dist/{runtime-Cd375HD-.mjs → runtime-B8O6JFS2.mjs}

@@ -1,15 +1,14 @@
-
-import { t as db } from "./schema-C4fkpWV_.mjs";
-import { $ as CreateUserProfileConfigRequestSchema, A as UpdatePipelineServiceRequestSchema, At as Condition_Operator, B as UpdateExecutorExecutorRequestSchema, Ct as UserProfileProviderConfig_UserProfileProviderType, D as CreatePipelineResolverRequestSchema, Dt as ApplicationSchemaUpdateAttemptStatus, E as UpdateSecretManagerSecretRequestSchema, Et as UpdateApplicationRequestSchema, F as IdPPermissionOperator, G as CreateAuthHookRequestSchema, H as ExecutorTargetType, I as IdPPermissionPermit, J as CreateAuthOAuth2ClientRequestSchema, K as CreateAuthIDPConfigRequestSchema, L as FunctionExecution_Status, M as CreateIdPServiceRequestSchema, Mt as PageDirection, N as UpdateIdPServiceRequestSchema, O as CreatePipelineServiceRequestSchema, Ot as Subgraph_ServiceType, P as IdPLang, Q as CreateTenantConfigRequestSchema, S as UpdateStaticWebsiteRequestSchema, St as TenantProviderConfig_TenantProviderType, T as CreateSecretManagerVaultRequestSchema, Tt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, U as ExecutorTriggerType, V as ExecutorJobStatus, W as CreateAuthConnectionRequestSchema, X as CreateAuthSCIMResourceRequestSchema, Y as CreateAuthSCIMConfigRequestSchema, Z as CreateAuthServiceRequestSchema, _ as TailorDBType_Permission_Operator, _t as AuthSCIMAttribute_Mutability, a as WorkspacePlatformUserRole, at as UpdateAuthSCIMConfigRequestSchema, b as AddCustomDomainRequestSchema, bt as AuthSCIMConfig_AuthorizationType, c as UpdateWorkflowRequestSchema, ct as UpdateTenantConfigRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as AuthConnection_Type, et as UpdateAuthConnectionRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as AuthHookPoint, g as TailorDBGQLPermission_Permit, gt as AuthOAuth2Client_GrantType, h as TailorDBGQLPermission_Operator, ht as AuthOAuth2Client_ClientType, it as UpdateAuthOAuth2ClientRequestSchema, j as PipelineResolver_OperationType, jt as FilterSchema, k as UpdatePipelineResolverRequestSchema, kt as ConditionSchema, l as WorkflowExecution_Status, lt as UpdateUserProfileConfigRequestSchema, m as TailorDBGQLPermission_Action, mt as AuthInvokerSchema, nt as UpdateAuthIDPConfigRequestSchema, o as CreateWorkflowJobFunctionRequestSchema, ot as UpdateAuthSCIMResourceRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as AuthIDPConfig_AuthType, q as CreateAuthMachineUserRequestSchema, rt as UpdateAuthMachineUserRequestSchema, s as CreateWorkflowRequestSchema, st as UpdateAuthServiceRequestSchema, t as OperatorService, tt as UpdateAuthHookRequestSchema, u as WorkflowJobExecution_Status, ut as AuthConnection_Status, v as TailorDBType_Permission_Permit, vt as AuthSCIMAttribute_Type, w as CreateSecretManagerSecretRequestSchema, wt as CreateApplicationRequestSchema, x as CreateStaticWebsiteRequestSchema, y as TailorDBType_PermitAction, yt as AuthSCIMAttribute_Uniqueness, z as CreateExecutorExecutorRequestSchema } from "./service_pb-BsBR6yW5.mjs";
-import { t as assertDefined } from "./assert-CKfwrmCV.mjs";
-import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-DKF-JsAK.mjs";
-import { $ as initOperatorClient, A as loadAccessToken, G as fetchMachineUserToken, I as loadWorkspaceId, K as fetchPaged, L as platformConfigFromProfile, N as loadMachineUserName, P as loadPlatformClientConfig, R as readPlatformConfig, S as getDistDir, T as loadConfig, V as writePlatformConfig, W as fetchAll, X as getOAuth2ClientId, Y as getConsoleBaseUrl, Z as getPlatformBaseUrl, b as hasGenerationHooks, d as assertUniqueLocalTailorDBTypeNames, et as isDefaultPlatform, f as assertUniqueTailorDBTypeNamesWithExternal, h as platformBundleDefinePlugin, j as loadConfigPath, k as hasUserTokenEntry, l as buildExecutorArgsExpr, m as stringifyFunction, n as generatePluginFilesIfNeeded, nt as byName, p as TailorDBTypeSchema, r as loadApplication, s as HTTP_METHODS, t as defineApplication, tt as resolveStaticWebsiteUrls, u as buildResolverOperationHookExpr, w as hashFile, x as createBundleCache, y as getPluginGenerationDependencies } from "./application-DmjIKQ-a.mjs";
-import { o as loadFilesWithIgnores, t as createExecutorService } from "./service-B2Jd9CxS.mjs";
-import { t as multiline } from "./multiline-Cf9ODpr1.mjs";
-import { t as readPackageJson } from "./package-json-DcQApfPQ.mjs";
-import { i as userAgent } from "./secret-file-eB3R3Fil.mjs";
-import { n as isCLIError, t as createCLIError } from "./errors-EsY4XO6O.mjs";
-import { r as withSpan } from "./telemetry-BQbbVo2t.mjs";
+import { t as db } from "./schema-DAdZSFOd.mjs";
+import { $ as CreateUserProfileConfigRequestSchema, A as UpdatePipelineServiceRequestSchema, At as Condition_Operator, B as UpdateExecutorExecutorRequestSchema, Ct as UserProfileProviderConfig_UserProfileProviderType, D as CreatePipelineResolverRequestSchema, Dt as ApplicationSchemaUpdateAttemptStatus, E as UpdateSecretManagerSecretRequestSchema, Et as UpdateApplicationRequestSchema, F as IdPPermissionOperator, G as CreateAuthHookRequestSchema, H as ExecutorTargetType, I as IdPPermissionPermit, J as CreateAuthOAuth2ClientRequestSchema, K as CreateAuthIDPConfigRequestSchema, L as FunctionExecution_Status, M as CreateIdPServiceRequestSchema, Mt as PageDirection, N as UpdateIdPServiceRequestSchema, O as CreatePipelineServiceRequestSchema, Ot as Subgraph_ServiceType, P as IdPLang, Q as CreateTenantConfigRequestSchema, S as UpdateStaticWebsiteRequestSchema, St as TenantProviderConfig_TenantProviderType, T as CreateSecretManagerVaultRequestSchema, Tt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, U as ExecutorTriggerType, V as ExecutorJobStatus, W as CreateAuthConnectionRequestSchema, X as CreateAuthSCIMResourceRequestSchema, Y as CreateAuthSCIMConfigRequestSchema, Z as CreateAuthServiceRequestSchema, _ as TailorDBType_Permission_Operator, _t as AuthSCIMAttribute_Mutability, a as WorkspacePlatformUserRole, at as UpdateAuthSCIMConfigRequestSchema, b as AddCustomDomainRequestSchema, bt as AuthSCIMConfig_AuthorizationType, c as UpdateWorkflowRequestSchema, ct as UpdateTenantConfigRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as AuthConnection_Type, et as UpdateAuthConnectionRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as AuthHookPoint, g as TailorDBGQLPermission_Permit, gt as AuthOAuth2Client_GrantType, h as TailorDBGQLPermission_Operator, ht as AuthOAuth2Client_ClientType, it as UpdateAuthOAuth2ClientRequestSchema, j as PipelineResolver_OperationType, jt as FilterSchema, k as UpdatePipelineResolverRequestSchema, kt as ConditionSchema, l as WorkflowExecution_Status, lt as UpdateUserProfileConfigRequestSchema, m as TailorDBGQLPermission_Action, mt as AuthInvokerSchema, nt as UpdateAuthIDPConfigRequestSchema, o as CreateWorkflowJobFunctionRequestSchema, ot as UpdateAuthSCIMResourceRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as AuthIDPConfig_AuthType, q as CreateAuthMachineUserRequestSchema, rt as UpdateAuthMachineUserRequestSchema, s as CreateWorkflowRequestSchema, st as UpdateAuthServiceRequestSchema, t as OperatorService, tt as UpdateAuthHookRequestSchema, u as WorkflowJobExecution_Status, ut as AuthConnection_Status, v as TailorDBType_Permission_Permit, vt as AuthSCIMAttribute_Type, w as CreateSecretManagerSecretRequestSchema, wt as CreateApplicationRequestSchema, x as CreateStaticWebsiteRequestSchema, y as TailorDBType_PermitAction, yt as AuthSCIMAttribute_Uniqueness, z as CreateExecutorExecutorRequestSchema } from "./service_pb-CIrhGwHk.mjs";
+import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
+import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-BEiZZ3qT.mjs";
+import { $ as initOperatorClient, A as loadAccessToken, G as fetchMachineUserToken, I as loadWorkspaceId, K as fetchPaged, L as platformConfigFromProfile, N as loadMachineUserName, P as loadPlatformClientConfig, R as readPlatformConfig, S as getDistDir, T as loadConfig, V as writePlatformConfig, W as fetchAll, X as getOAuth2ClientId, Y as getConsoleBaseUrl, Z as getPlatformBaseUrl, b as hasGenerationHooks, d as assertUniqueLocalTailorDBTypeNames, et as isDefaultPlatform, f as assertUniqueTailorDBTypeNamesWithExternal, h as platformBundleDefinePlugin, j as loadConfigPath, k as hasUserTokenEntry, l as buildExecutorArgsExpr, m as stringifyFunction, n as generatePluginFilesIfNeeded, nt as byName, p as TailorDBTypeSchema, r as loadApplication, s as HTTP_METHODS, t as defineApplication, tt as resolveStaticWebsiteUrls, u as buildResolverOperationHookExpr, w as hashFile, x as createBundleCache, y as getPluginGenerationDependencies } from "./application-Bb9NNp5m.mjs";
+import { o as loadFilesWithIgnores, t as createExecutorService } from "./service-DiEtAsvc.mjs";
+import { t as multiline } from "./multiline-sfHpTZZK.mjs";
+import { t as readPackageJson } from "./package-json-8b0O9TlX.mjs";
+import { i as userAgent } from "./secret-file-VSVGy1V0.mjs";
+import { n as isCLIError, t as createCLIError } from "./errors-Dtf2WPaW.mjs";
+import { r as withSpan } from "./telemetry-CdqJEzkj.mjs";
 import { arg, createDefineCommand, defineCommand, runCommand } from "politty";
 import { z } from "zod";
 import { ScalarType, create, fromJson, toJson } from "@bufbuild/protobuf";
@@ -1118,9 +1117,10 @@ function extractAttributesFromConfig(config) {
 * @param machineUserNames - Registered machine user names (used to narrow `authInvoker` strings)
 * @param idpNames - Registered IdP names (used to narrow `idpUser*Trigger({ idp })` strings)
 * @param connectionNames - Registered auth connection names (used to narrow `getConnectionToken()` strings)
+* @param aiGatewayNames - Registered AI Gateway names (used to narrow `aigateway.get()` strings)
 * @returns Generated type definition source
 */
-function generateTypeDefinition(attributeMap, attributeList, env, machineUserNames, idpNames, connectionNames) {
+function generateTypeDefinition(attributeMap, attributeList, env, machineUserNames, idpNames, connectionNames, aiGatewayNames) {
 	const mapFields = attributeMap ? Object.entries(attributeMap).map(([key, value]) => `    ${key}: ${value};`).join("\n") : "";
 	const mapBody = !attributeMap || Object.keys(attributeMap).length === 0 ? "{}" : `{
 ${mapFields}
@@ -1144,6 +1144,10 @@ ${machineUserFields}
 ${idpNameFields}
   }`;
 	const connectionNameFields = connectionNames?.length ? connectionNames.map((name) => `    ${isValidIdentifier(name) ? name : JSON.stringify(name)}: true;`).join("\n") : "";
+	const connectionNameBody = !connectionNames || connectionNames.length === 0 ? "{}" : `{
+${connectionNameFields}
+  }`;
+	const aiGatewayNameFields = aiGatewayNames?.length ? aiGatewayNames.map((name) => `    ${isValidIdentifier(name) ? name : JSON.stringify(name)}: true;`).join("\n") : "";
 	return multiline`
 // This file is auto-generated by @tailor-platform/sdk
 // Do not edit this file manually
@@ -1155,8 +1159,9 @@ declare module "@tailor-platform/sdk" {
   interface Env ${envBody}
   interface MachineUserNameRegistry ${machineUserBody}
   interface IdpNameRegistry ${idpNameBody}
-  interface ConnectionNameRegistry ${!connectionNames || connectionNames.length === 0 ? "{}" : `{
-${connectionNameFields}
+  interface ConnectionNameRegistry ${connectionNameBody}
+  interface AIGatewayNameRegistry ${!aiGatewayNames || aiGatewayNames.length === 0 ? "{}" : `{
+${aiGatewayNameFields}
   }`}
 }
 
@@ -1166,8 +1171,12 @@ export {};
 }
 function collectAttributesFromConfig(config) {
 	const idpNames = config.idp?.length ? [...new Set(config.idp.map((idp) => idp.name))] : void 0;
+	const aiGatewayNames = config.aiGateways?.length ? [...new Set(config.aiGateways.map((gateway) => gateway.name))] : void 0;
 	const auth = config.auth;
-	if (!auth || typeof auth !== "object") return idpNames ? { idpNames } : {};
+	if (!auth || typeof auth !== "object") return idpNames || aiGatewayNames ? {
+		idpNames,
+		aiGatewayNames
+	} : {};
 	const machineUsersObj = auth.machineUsers;
 	const machineUserNames = machineUsersObj && typeof machineUsersObj === "object" ? Object.keys(machineUsersObj) : void 0;
 	const connectionsObj = auth.connections;
@@ -1195,7 +1204,8 @@ function collectAttributesFromConfig(config) {
 			attributeList,
 			machineUserNames,
 			idpNames,
-			connectionNames
+			connectionNames,
+			aiGatewayNames
 		};
 	}
 	if ("machineUserAttributes" in auth) {
@@ -1203,7 +1213,8 @@ function collectAttributesFromConfig(config) {
 		if (!machineUserAttributes) return {
 			machineUserNames,
 			idpNames,
-			connectionNames
+			connectionNames,
+			aiGatewayNames
 		};
 		return {
 			attributeMap: Object.entries(machineUserAttributes).reduce((acc, [key, field]) => {
@@ -1212,13 +1223,15 @@ function collectAttributesFromConfig(config) {
 			}, {}),
 			machineUserNames,
 			idpNames,
-			connectionNames
+			connectionNames,
+			aiGatewayNames
 		};
 	}
 	return {
 		machineUserNames,
 		idpNames,
-		connectionNames
+		connectionNames,
+		aiGatewayNames
 	};
 }
 /**
@@ -1243,16 +1256,17 @@ function resolveTypeDefinitionPath(configPath) {
 async function generateUserTypes(options) {
 	const { config, configPath } = options;
 	try {
-		const { attributeMap, attributeList, machineUserNames, idpNames, connectionNames } = extractAttributesFromConfig(config);
+		const { attributeMap, attributeList, machineUserNames, idpNames, connectionNames, aiGatewayNames } = extractAttributesFromConfig(config);
 		if (!attributeMap && !attributeList) logger.info("No attributes found in configuration", { mode: "plain" });
 		if (attributeMap) logger.debug(`Extracted AttributeMap: ${JSON.stringify(attributeMap)}`);
 		if (attributeList) logger.debug(`Extracted AttributeList: ${JSON.stringify(attributeList)}`);
 		if (machineUserNames?.length) logger.debug(`Extracted MachineUserNames: ${JSON.stringify(machineUserNames)}`);
 		if (idpNames?.length) logger.debug(`Extracted IdpNames: ${JSON.stringify(idpNames)}`);
 		if (connectionNames?.length) logger.debug(`Extracted ConnectionNames: ${JSON.stringify(connectionNames)}`);
+		if (aiGatewayNames?.length) logger.debug(`Extracted AIGatewayNames: ${JSON.stringify(aiGatewayNames)}`);
 		const env = config.env;
 		if (env) logger.debug(`Extracted Env: ${JSON.stringify(env)}`);
-		const typeDefContent = generateTypeDefinition(attributeMap, attributeList, env, machineUserNames, idpNames, connectionNames);
+		const typeDefContent = generateTypeDefinition(attributeMap, attributeList, env, machineUserNames, idpNames, connectionNames, aiGatewayNames);
 		const outputPath = resolveTypeDefinitionPath(configPath);
 		fs$1.mkdirSync(path.dirname(outputPath), { recursive: true });
 		fs$1.writeFileSync(outputPath, typeDefContent);
@@ -1806,14 +1820,13 @@ async function buildMetaRequest(params) {
 * @template T
 * @param params - Resource fetch parameters
 * @param params.client - Operator client instance
-* @param params.workspaceId - Workspace ID
 * @param params.fetchPage - Function that fetches one resource page
 * @param params.getName - Function that extracts the resource name
 * @param params.getTrn - Function that builds the resource TRN
 * @returns Existing resources keyed by resource name, with SDK labels attached
 */
 async function fetchExistingResourcesWithLabels(params) {
-	const { client, workspaceId, fetchPage, getName, getTrn } = params;
+	const { client, fetchPage, getName, getTrn } = params;
 	const withoutLabel = await fetchAll(async (pageToken, maxPageSize) => {
 		try {
 			return await fetchPage(pageToken, maxPageSize);
@@ -1826,7 +1839,7 @@ async function fetchExistingResourcesWithLabels(params) {
 	await Promise.all(withoutLabel.map(async (resource) => {
 		const name = getName(resource);
 		if (!name) return;
-		const { metadata } = await client.getMetadata({ trn: getTrn(workspaceId, name) });
+		const { metadata } = await client.getMetadata({ trn: getTrn(name) });
 		existingResources[name] = {
 			resource,
 			label: metadata?.labels[sdkNameLabelKey],
@@ -1931,7 +1944,6 @@ async function planAIGateway(context) {
 	const resourceOwners = /* @__PURE__ */ new Set();
 	const existingGateways = await fetchExistingResourcesWithLabels({
 		client,
-		workspaceId,
 		fetchPage: async (pageToken, pageSize) => {
 			const { aigateways, nextPageToken } = await client.listAIGateways({
 				workspaceId,
@@ -1941,7 +1953,7 @@ async function planAIGateway(context) {
 			return [aigateways, nextPageToken];
 		},
 		getName: (resource) => resource.name,
-		getTrn: (workspaceId, name) => resourceTrn(workspaceId, "aigateway", name)
+		getTrn: (name) => resourceTrn(workspaceId, "aigateway", name)
 	});
 	const aiGatewayServices = forRemoval ? [] : application.aiGatewayServices;
 	const expectedLocalWebsites = new Set(application.staticWebsiteServices.map((website) => website.name));
@@ -2726,8 +2738,9 @@ async function planFunctionRegistry(client, workspaceId, appName, appId, entries
 	const conflicts = [];
 	const unmanaged = [];
 	const resourceOwners = /* @__PURE__ */ new Set();
-	const existingFunctions = await fetchAll(async (pageToken, maxPageSize) => {
-		try {
+	const existingMap = await fetchExistingResourcesWithLabels({
+		client,
+		fetchPage: async (pageToken, maxPageSize) => {
 			const response = await client.listFunctionRegistries({
 				workspaceId,
 				pageToken,
@@ -2737,20 +2750,10 @@ async function planFunctionRegistry(client, workspaceId, appName, appId, entries
 				name: f.name,
 				contentHash: f.contentHash
 			})), response.nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+		},
+		getName: (func) => func.name,
+		getTrn: (name) => resourceTrn(workspaceId, "function_registry", name)
 	});
-	const existingMap = {};
-	await Promise.all(existingFunctions.map(async (func) => {
-		const { metadata } = await client.getMetadata({ trn: resourceTrn(workspaceId, "function_registry", func.name) });
-		existingMap[func.name] = {
-			resource: func,
-			label: metadata?.labels[sdkNameLabelKey],
-			allLabels: metadata?.labels
-		};
-	}));
 	for (const entry of entries) {
 		const existing = existingMap[entry.name];
 		const metaRequest = await buildMetaRequest({
@@ -3408,29 +3411,19 @@ async function planServices$3(client, workspaceId, appName, appId, idps, idpUser
 	const conflicts = [];
 	const unmanaged = [];
 	const resourceOwners = /* @__PURE__ */ new Set();
-	const withoutLabel = await fetchAll(async (pageToken, maxPageSize) => {
-		try {
+	const existingServices = await fetchExistingResourcesWithLabels({
+		client,
+		fetchPage: async (pageToken, maxPageSize) => {
 			const { idpServices, nextPageToken } = await client.listIdPServices({
 				workspaceId,
 				pageToken,
 				pageSize: maxPageSize
 			});
 			return [idpServices, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+		},
+		getName: (resource) => resource.namespace?.name,
+		getTrn: (name) => resourceTrn(workspaceId, "idp", name)
 	});
-	const existingServices = {};
-	await Promise.all(withoutLabel.map(async (resource) => {
-		if (!resource.namespace?.name) return;
-		const { metadata } = await client.getMetadata({ trn: resourceTrn(workspaceId, "idp", resource.namespace.name) });
-		existingServices[resource.namespace.name] = {
-			resource,
-			label: metadata?.labels[sdkNameLabelKey],
-			allLabels: metadata?.labels
-		};
-	}));
 	for (const idp of idps) {
 		const namespaceName = idp.name;
 		const existing = existingServices[namespaceName];
@@ -3806,29 +3799,19 @@ async function planServices$2(client, workspaceId, appName, appId, auths, forceA
 	const conflicts = [];
 	const unmanaged = [];
 	const resourceOwners = /* @__PURE__ */ new Set();
-	const withoutLabel = await fetchAll(async (pageToken, maxPageSize) => {
-		try {
+	const existingServices = await fetchExistingResourcesWithLabels({
+		client,
+		fetchPage: async (pageToken, maxPageSize) => {
 			const { authServices, nextPageToken } = await client.listAuthServices({
 				workspaceId,
 				pageToken,
 				pageSize: maxPageSize
 			});
 			return [authServices, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+		},
+		getName: (resource) => resource.namespace?.name,
+		getTrn: (name) => resourceTrn(workspaceId, "auth", name)
 	});
-	const existingServices = {};
-	await Promise.all(withoutLabel.map(async (resource) => {
-		if (!resource.namespace?.name) return;
-		const { metadata } = await client.getMetadata({ trn: resourceTrn(workspaceId, "auth", resource.namespace.name) });
-		existingServices[resource.namespace.name] = {
-			resource,
-			label: metadata?.labels[sdkNameLabelKey],
-			allLabels: metadata?.labels
-		};
-	}));
 	for (const auth of auths) {
 		const { config } = auth;
 		const existing = existingServices[config.name];
@@ -5159,7 +5142,6 @@ async function planExecutor(context) {
 	const resourceOwners = /* @__PURE__ */ new Set();
 	const existingExecutors = await fetchExistingResourcesWithLabels({
 		client,
-		workspaceId,
 		fetchPage: async (pageToken, pageSize) => {
 			const { executors, nextPageToken } = await client.listExecutorExecutors({
 				workspaceId,
@@ -5169,7 +5151,7 @@ async function planExecutor(context) {
 			return [executors, nextPageToken];
 		},
 		getName: (resource) => resource.name,
-		getTrn: (workspaceId, name) => resourceTrn(workspaceId, "executor", name)
+		getTrn: (name) => resourceTrn(workspaceId, "executor", name)
 	});
 	const executors = forRemoval ? {} : await application.executorService?.loadExecutors() ?? {};
 	for (const executor of Object.values(executors)) {
@@ -5594,29 +5576,19 @@ async function planServices$1(client, workspaceId, appName, appId, pipelines) {
 	const conflicts = [];
 	const unmanaged = [];
 	const resourceOwners = /* @__PURE__ */ new Set();
-	const withoutLabel = await fetchAll(async (pageToken, maxPageSize) => {
-		try {
+	const existingServices = await fetchExistingResourcesWithLabels({
+		client,
+		fetchPage: async (pageToken, maxPageSize) => {
 			const { pipelineServices, nextPageToken } = await client.listPipelineServices({
 				workspaceId,
 				pageToken,
 				pageSize: maxPageSize
 			});
 			return [pipelineServices, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+		},
+		getName: (resource) => resource.namespace?.name,
+		getTrn: (name) => resourceTrn(workspaceId, "pipeline", name)
 	});
-	const existingServices = {};
-	await Promise.all(withoutLabel.map(async (resource) => {
-		if (!resource.namespace?.name) return;
-		const { metadata } = await client.getMetadata({ trn: resourceTrn(workspaceId, "pipeline", resource.namespace.name) });
-		existingServices[resource.namespace.name] = {
-			resource,
-			label: metadata?.labels[sdkNameLabelKey],
-			allLabels: metadata?.labels
-		};
-	}));
 	for (const pipeline of pipelines) {
 		const existing = existingServices[pipeline.namespace];
 		const metaRequest = await buildMetaRequest({
@@ -5929,28 +5901,19 @@ async function planSecretManager(context) {
 	const conflicts = [];
 	const unmanaged = [];
 	const resourceOwners = /* @__PURE__ */ new Set();
-	const existingVaultList = await fetchAll(async (pageToken, maxPageSize) => {
-		try {
+	const existingVaults = await fetchExistingResourcesWithLabels({
+		client,
+		fetchPage: async (pageToken, maxPageSize) => {
 			const { vaults, nextPageToken } = await client.listSecretManagerVaults({
 				workspaceId,
 				pageToken,
 				pageSize: maxPageSize
 			});
 			return [vaults, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+		},
+		getName: (resource) => resource.name,
+		getTrn: (name) => resourceTrn(workspaceId, "vault", name)
 	});
-	const existingVaults = {};
-	await Promise.all(existingVaultList.map(async (resource) => {
-		const { metadata } = await client.getMetadata({ trn: resourceTrn(workspaceId, "vault", resource.name) });
-		existingVaults[resource.name] = {
-			resource,
-			label: metadata?.labels[sdkNameLabelKey],
-			allLabels: metadata?.labels
-		};
-	}));
 	const state = loadSecretsState();
 	const skippedSecrets = [];
 	await Promise.all(secretVaults.map(async (vault) => {
@@ -6190,7 +6153,6 @@ async function planStaticWebsite(context) {
 	const resourceOwners = /* @__PURE__ */ new Set();
 	const existingWebsites = await fetchExistingResourcesWithLabels({
 		client,
-		workspaceId,
 		fetchPage: async (pageToken, pageSize) => {
 			const { staticwebsites, nextPageToken } = await client.listStaticWebsites({
 				workspaceId,
@@ -6200,7 +6162,7 @@ async function planStaticWebsite(context) {
 			return [staticwebsites, nextPageToken];
 		},
 		getName: (resource) => resource.name,
-		getTrn: (workspaceId, name) => resourceTrn(workspaceId, "staticwebsite", name)
+		getTrn: (name) => resourceTrn(workspaceId, "staticwebsite", name)
 	});
 	const ownedWebsiteNames = /* @__PURE__ */ new Set();
 	const staticWebsiteServices = forRemoval ? [] : application.staticWebsiteServices;
@@ -6403,6 +6365,7 @@ function formatDiffChange(change) {
 		case "type_added": return `  + [Type] ${change.typeName} (new type)`;
 		case "type_removed": return `  - [Type] ${change.typeName} (removed)`;
 		case "type_modified": return `  ~ [Type] ${change.typeName}: ${change.reason}`;
+		case "type_settings_modified": return `  ~ [Type Settings] ${change.typeName}: ${change.reason ?? "settings changed"}`;
 		case "field_added": {
 			const typeStr = formatFieldType(change.after);
 			return `  + ${change.fieldName}: ${typeStr}`;
@@ -6500,6 +6463,7 @@ const DIFF_CHANGE_LABELS = {
 	type_added: "type(s) added",
 	type_removed: "type(s) removed",
 	type_modified: "type(s) modified",
+	type_settings_modified: "type setting(s) modified",
 	field_added: "field(s) added",
 	field_removed: "field(s) removed",
 	field_modified: "field(s) modified",
@@ -6719,6 +6683,21 @@ const typeSettingsPatchSchema = z.looseObject({
 	indexes: snapshotRecordSchema(snapshotIndexConfigSchema).optional(),
 	files: snapshotRecordSchema(z.string()).optional()
 });
+const snapshotTypeSettingsStateSchema = z.looseObject({
+	description: z.string().optional(),
+	pluralForm: z.string(),
+	settings: z.looseObject({
+		aggregation: z.boolean().optional(),
+		bulkUpsert: z.boolean().optional(),
+		gqlOperations: z.looseObject({
+			create: z.boolean().optional(),
+			update: z.boolean().optional(),
+			delete: z.boolean().optional(),
+			read: z.boolean().optional()
+		}).optional(),
+		publishEvents: z.boolean().optional()
+	}).optional()
+});
 const snapshotPermissionStateSchema = z.looseObject({
 	recordPermission: snapshotRecordPermissionSchema.optional(),
 	gqlPermission: snapshotGqlPermissionSchema.optional()
@@ -6742,6 +6721,13 @@ const typeModifiedChangeSchema = z.looseObject({
 	before: typeSettingsPatchSchema.optional(),
 	after: typeSettingsPatchSchema.optional()
 });
+const typeSettingsModifiedChangeSchema = z.looseObject({
+	kind: z.literal("type_settings_modified"),
+	typeName: z.string(),
+	reason: z.string().optional(),
+	before: snapshotTypeSettingsStateSchema,
+	after: snapshotTypeSettingsStateSchema
+});
 const fieldAddedChangeSchema = z.looseObject({
 	kind: z.literal("field_added"),
 	typeName: z.string(),
@@ -6844,6 +6830,7 @@ const diffChangeSchema = z.discriminatedUnion("kind", [
 	typeAddedChangeSchema,
 	typeRemovedChangeSchema,
 	typeModifiedChangeSchema,
+	typeSettingsModifiedChangeSchema,
 	fieldAddedChangeSchema,
 	fieldRemovedChangeSchema,
 	fieldModifiedChangeSchema,
@@ -7307,6 +7294,16 @@ function applyDiffToSnapshot(snapshot, diff) {
 			}
 			break;
 		}
+		case "type_settings_modified": {
+			const existing = types[change.typeName];
+			if (existing) types[change.typeName] = {
+				...existing,
+				description: change.after.description,
+				pluralForm: change.after.pluralForm,
+				settings: change.after.settings ?? {}
+			};
+			break;
+		}
 		case "field_added":
 		case "field_modified": {
 			const existing = types[change.typeName];
@@ -7683,10 +7680,10 @@ function compareIndexes(ctx, typeName, oldIndexes, newIndexes) {
 		const oldIndex = assertDefined(assertDefined(oldIndexes, "oldIndexes is undefined when oldKeys has entry")[indexName], `index "${indexName}" missing from oldIndexes`);
 		const oldFieldsStr = JSON.stringify(oldIndex.fields.toSorted());
 		const newFieldsStr = JSON.stringify(newIndex.fields.toSorted());
-		if (oldFieldsStr !== newFieldsStr || oldIndex.unique !== newIndex.unique) {
+		if (oldFieldsStr !== newFieldsStr || (oldIndex.unique ?? false) !== (newIndex.unique ?? false)) {
 			const reasons = [];
 			if (oldFieldsStr !== newFieldsStr) reasons.push("fields changed");
-			if (oldIndex.unique !== newIndex.unique) reasons.push("unique constraint changed");
+			if ((oldIndex.unique ?? false) !== (newIndex.unique ?? false)) reasons.push("unique constraint changed");
 			ctx.changes.push({
 				kind: "index_modified",
 				typeName,
@@ -7766,6 +7763,7 @@ function compareRelationships(ctx, typeName, relationshipType, oldRelationships,
 		if (oldRel.targetField !== newRel.targetField) reasons.push("targetField changed");
 		if (oldRel.sourceField !== newRel.sourceField) reasons.push("sourceField changed");
 		if (oldRel.isArray !== newRel.isArray) reasons.push("isArray changed");
+		if (oldRel.description !== newRel.description) reasons.push("description changed");
 		if (reasons.length > 0) ctx.changes.push({
 			kind: "relationship_modified",
 			typeName,
@@ -7788,8 +7786,12 @@ function compareRelationships(ctx, typeName, relationshipType, oldRelationships,
 * @returns {void}
 */
 function comparePermissions(ctx, typeName, oldRecordPerm, newRecordPerm, oldGqlPerm, newGqlPerm) {
-	const recordPermChanged = JSON.stringify(oldRecordPerm ?? null) !== JSON.stringify(newRecordPerm ?? null);
-	const gqlPermChanged = JSON.stringify(oldGqlPerm ?? null) !== JSON.stringify(newGqlPerm ?? null);
+	const oldComparableRecordPerm = comparableRecordPermission(oldRecordPerm);
+	const newComparableRecordPerm = comparableRecordPermission(newRecordPerm);
+	const recordPermChanged = JSON.stringify(oldComparableRecordPerm ?? null) !== JSON.stringify(newComparableRecordPerm ?? null);
+	const oldComparableGqlPerm = comparableGqlPermission(oldGqlPerm);
+	const newComparableGqlPerm = comparableGqlPermission(newGqlPerm);
+	const gqlPermChanged = JSON.stringify(oldComparableGqlPerm ?? null) !== JSON.stringify(newComparableGqlPerm ?? null);
 	if (recordPermChanged || gqlPermChanged) {
 		const reasons = [];
 		if (recordPermChanged) reasons.push("record permission");
@@ -7799,16 +7801,95 @@ function comparePermissions(ctx, typeName, oldRecordPerm, newRecordPerm, oldGqlP
 			typeName,
 			reason: `${reasons.join(" and ")} changed`,
 			before: {
-				recordPermission: oldRecordPerm,
-				gqlPermission: oldGqlPerm
+				recordPermission: oldComparableRecordPerm,
+				gqlPermission: oldComparableGqlPerm
 			},
 			after: {
-				recordPermission: newRecordPerm,
-				gqlPermission: newGqlPerm
+				recordPermission: newComparableRecordPerm,
+				gqlPermission: newComparableGqlPerm
 			}
 		});
 	}
 }
+const GQL_ACTION_ORDER = {
+	all: 0,
+	create: 1,
+	read: 2,
+	update: 3,
+	delete: 4,
+	aggregate: 5,
+	bulkUpsert: 6
+};
+function sortByJson(items) {
+	return items.map((item) => [JSON.stringify(item), item]).toSorted(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([, item]) => item);
+}
+function comparableGqlPermission(permission) {
+	const policies = permission?.map((policy) => ({
+		...policy,
+		conditions: sortByJson(policy.conditions),
+		actions: policy.actions.toSorted((left, right) => GQL_ACTION_ORDER[left] - GQL_ACTION_ORDER[right])
+	}));
+	return policies && policies.length > 0 ? sortByJson(policies) : void 0;
+}
+function comparableRecordPermission(permission) {
+	if (!permission) return void 0;
+	if (!Object.values(permission).some((policies) => policies.length > 0)) return void 0;
+	return {
+		create: sortByJson(permission.create.map(canonicalActionPermission)),
+		read: sortByJson(permission.read.map(canonicalActionPermission)),
+		update: sortByJson(permission.update.map(canonicalActionPermission)),
+		delete: sortByJson(permission.delete.map(canonicalActionPermission))
+	};
+}
+function canonicalActionPermission(policy) {
+	return {
+		...policy,
+		conditions: sortByJson(policy.conditions)
+	};
+}
+function normalizeComparableGqlOperations(operations) {
+	if (!operations) return void 0;
+	return {
+		create: operations.create ?? true,
+		update: operations.update ?? true,
+		delete: operations.delete ?? true,
+		read: operations.read ?? true
+	};
+}
+function normalizeComparableSettings(settings) {
+	const normalized = {};
+	if (settings?.aggregation === true) normalized.aggregation = true;
+	if (settings?.bulkUpsert === true) normalized.bulkUpsert = true;
+	if (settings?.publishEvents === true) normalized.publishEvents = true;
+	const gqlOperations = normalizeComparableGqlOperations(settings?.gqlOperations);
+	if (gqlOperations) normalized.gqlOperations = gqlOperations;
+	return Object.keys(normalized).length > 0 ? normalized : void 0;
+}
+function typeSettingsState(description, pluralForm, settings) {
+	return {
+		...description ? { description } : {},
+		pluralForm,
+		...settings && { settings }
+	};
+}
+function comparableTypeSettings(type) {
+	return typeSettingsState(type.description, inflection.camelize(type.pluralForm, true), normalizeComparableSettings(type.settings));
+}
+function snapshotTypeSettingsState(type) {
+	return typeSettingsState(type.description, type.pluralForm, type.settings ?? {});
+}
+function compareTypeSettings(ctx, typeName, previous, current) {
+	const previousComparable = comparableTypeSettings(previous);
+	const currentComparable = comparableTypeSettings(current);
+	if (JSON.stringify(previousComparable) === JSON.stringify(currentComparable)) return;
+	ctx.changes.push({
+		kind: "type_settings_modified",
+		typeName,
+		reason: "settings changed",
+		before: snapshotTypeSettingsState(previous),
+		after: snapshotTypeSettingsState(current)
+	});
+}
 /**
 * Compare two snapshots and generate a diff
 * @param {SchemaSnapshot} previous - Previous schema snapshot
@@ -7846,6 +7927,7 @@ function compareNormalizedSnapshots(previous, current) {
 		if (!previousTypeNames.has(typeName)) continue;
 		const prevType = assertDefined(previous.types[typeName], `type "${typeName}" missing from previous snapshot`);
 		const currType = assertDefined(current.types[typeName], `type "${typeName}" missing from current snapshot`);
+		compareTypeSettings(ctx, typeName, prevType, currType);
 		compareTypeFields(ctx, typeName, prevType, currType);
 		compareIndexes(ctx, typeName, prevType.indexes, currType.indexes);
 		compareFiles(ctx, typeName, prevType.files, currType.files);
@@ -7947,6 +8029,49 @@ function assertValidMigrationFiles(migrationsDir, namespace) {
 		throw new Error(`Migration file validation failed for namespace "${namespace}":\n${errorMessages}`);
 	}
 }
+function convertRemoteFieldToSnapshot(remoteField) {
+	const config = {
+		type: remoteField.type,
+		required: remoteField.required
+	};
+	if (remoteField.array) config.array = true;
+	if (remoteField.index) config.index = true;
+	if (remoteField.unique) config.unique = true;
+	if (remoteField.foreignKey) {
+		config.foreignKey = true;
+		if (remoteField.foreignKeyType) config.foreignKeyType = remoteField.foreignKeyType;
+		if (remoteField.foreignKeyField) config.foreignKeyField = remoteField.foreignKeyField;
+	}
+	const allowedValues = remoteField.allowedValues;
+	if (allowedValues.length > 0) config.allowedValues = allowedValues.map((v) => ({
+		value: v.value,
+		...v.description && { description: v.description }
+	}));
+	if (remoteField.description) config.description = remoteField.description;
+	if (remoteField.vector) config.vector = true;
+	if (remoteField.hooks) {
+		config.hooks = {};
+		if (remoteField.hooks.create?.expr) config.hooks.create = { expr: remoteField.hooks.create.expr };
+		if (remoteField.hooks.update?.expr) config.hooks.update = { expr: remoteField.hooks.update.expr };
+	}
+	const validate = remoteField.validate;
+	if (validate.length > 0) config.validate = validate.map((v) => ({
+		script: { expr: convertRemoteValidateExpression(v.script?.expr ?? "", v.action) },
+		errorMessage: v.errorMessage ?? ""
+	}));
+	if (remoteField.serial) config.serial = {
+		start: Number(remoteField.serial.start),
+		...remoteField.serial.maxValue && { maxValue: Number(remoteField.serial.maxValue) },
+		...remoteField.serial.format && { format: remoteField.serial.format }
+	};
+	if (remoteField.scale !== void 0) config.scale = remoteField.scale;
+	const nestedFields = remoteField.fields;
+	if (Object.keys(nestedFields).length > 0) {
+		config.fields = createSnapshotRecord();
+		for (const [fieldName, nestedField] of Object.entries(nestedFields)) config.fields[fieldName] = convertRemoteFieldToSnapshot(nestedField);
+	}
+	return config;
+}
 /**
 * Convert remote ParsedTailorDBType to SnapshotFieldConfig for comparison
 * @param {ProtoTailorDBType} remoteType - Remote TailorDB type from API
@@ -7955,62 +8080,204 @@ function assertValidMigrationFiles(migrationsDir, namespace) {
 function convertRemoteFieldsToSnapshot(remoteType) {
 	const fields = createSnapshotRecord();
 	const remoteFields = remoteType.schema?.fields ?? {};
-	for (const [fieldName, remoteField] of Object.entries(remoteFields)) {
-		const config = {
-			type: remoteField.type,
-			required: remoteField.required
-		};
-		if (remoteField.array) config.array = true;
-		if (remoteField.index) config.index = true;
-		if (remoteField.unique) config.unique = true;
-		if (remoteField.foreignKey) {
-			config.foreignKey = true;
-			if (remoteField.foreignKeyType) config.foreignKeyType = remoteField.foreignKeyType;
-			if (remoteField.foreignKeyField) config.foreignKeyField = remoteField.foreignKeyField;
-		}
-		if (remoteField.allowedValues.length > 0) config.allowedValues = remoteField.allowedValues.map((v) => ({
-			value: v.value,
-			...v.description && { description: v.description }
-		}));
-		if (remoteField.description) config.description = remoteField.description;
-		if (remoteField.vector) config.vector = true;
-		if (remoteField.hooks) {
-			config.hooks = {};
-			if (remoteField.hooks.create?.expr) config.hooks.create = { expr: remoteField.hooks.create.expr };
-			if (remoteField.hooks.update?.expr) config.hooks.update = { expr: remoteField.hooks.update.expr };
-		}
-		if (remoteField.validate.length > 0) config.validate = remoteField.validate.map((v) => ({
-			script: { expr: v.script?.expr ?? "" },
-			errorMessage: v.errorMessage ?? ""
-		}));
-		if (remoteField.serial) config.serial = {
-			start: Number(remoteField.serial.start),
-			...remoteField.serial.maxValue && { maxValue: Number(remoteField.serial.maxValue) },
-			...remoteField.serial.format && { format: remoteField.serial.format }
+	for (const [fieldName, remoteField] of Object.entries(remoteFields)) fields[fieldName] = convertRemoteFieldToSnapshot(remoteField);
+	return fields;
+}
+function convertRemoteValidateExpression(expr, action) {
+	return action === TailorDBType_PermitAction.DENY && expr.startsWith("!") ? expr.slice(1) : expr;
+}
+function convertRemoteSettingsToSnapshot(remoteSettings, expectedSettings) {
+	const settings = {};
+	if (remoteSettings?.aggregation) settings.aggregation = true;
+	if (remoteSettings?.bulkUpsert) settings.bulkUpsert = true;
+	if (remoteSettings?.publishRecordEvents) settings.publishEvents = true;
+	const disabled = remoteSettings?.disableGqlOperations;
+	if (disabled) {
+		const hasDisabledOperation = disabled.create || disabled.update || disabled.delete || disabled.read;
+		if (expectedSettings?.gqlOperations !== void 0 || hasDisabledOperation) settings.gqlOperations = {
+			create: !disabled.create,
+			update: !disabled.update,
+			delete: !disabled.delete,
+			read: !disabled.read
 		};
-		if (remoteField.scale !== void 0) config.scale = remoteField.scale;
-		fields[fieldName] = config;
 	}
-	return fields;
+	return Object.keys(settings).length > 0 ? settings : void 0;
 }
-function convertRemoteTypeToSnapshot(remoteType) {
+function convertRemoteIndexesToSnapshot(remoteIndexes) {
+	const indexes = createSnapshotRecord();
+	for (const [indexName, indexConfig] of Object.entries(remoteIndexes ?? {})) indexes[indexName] = {
+		fields: indexConfig.fieldNames,
+		...indexConfig.unique && { unique: true }
+	};
+	return Object.keys(indexes).length > 0 ? indexes : void 0;
+}
+function convertRemoteFilesToSnapshot(remoteFiles) {
+	const files = createSnapshotRecord();
+	for (const [fileName, fileConfig] of Object.entries(remoteFiles ?? {})) files[fileName] = fileConfig.description || "";
+	return Object.keys(files).length > 0 ? files : void 0;
+}
+function convertRemoteRelationshipToSnapshot(relationship, direction) {
+	return direction === "forward" ? {
+		targetType: relationship.refType,
+		targetField: relationship.srcField,
+		sourceField: relationship.refField,
+		isArray: relationship.array,
+		description: relationship.description || ""
+	} : {
+		targetType: relationship.refType,
+		targetField: relationship.refField,
+		sourceField: relationship.srcField,
+		isArray: relationship.array,
+		description: relationship.description || ""
+	};
+}
+function remoteRelationshipMatchesExpectedDirection(relationship, expected, direction) {
+	const converted = convertRemoteRelationshipToSnapshot(relationship, direction);
+	return converted.targetType === expected.targetType && converted.targetField === expected.targetField && converted.sourceField === expected.sourceField && converted.isArray === expected.isArray;
+}
+function inferRemoteRelationshipDirection(relationshipName, relationship, expectedType) {
+	const expectedForward = expectedType?.forwardRelationships?.[relationshipName];
+	const expectedBackward = expectedType?.backwardRelationships?.[relationshipName];
+	if (expectedForward && !expectedBackward) return "forward";
+	if (expectedBackward && !expectedForward) return "backward";
+	if (expectedForward && remoteRelationshipMatchesExpectedDirection(relationship, expectedForward, "forward")) return "forward";
+	if (expectedBackward && remoteRelationshipMatchesExpectedDirection(relationship, expectedBackward, "backward")) return "backward";
+	return relationship.array ? "backward" : "forward";
+}
+function convertRemoteRelationshipsToSnapshot(remoteRelationships, expectedType) {
+	const forwardRelationships = createSnapshotRecord();
+	const backwardRelationships = createSnapshotRecord();
+	for (const [relationshipName, relationship] of Object.entries(remoteRelationships ?? {})) {
+		const direction = inferRemoteRelationshipDirection(relationshipName, relationship, expectedType);
+		if (direction === "forward") forwardRelationships[relationshipName] = convertRemoteRelationshipToSnapshot(relationship, direction);
+		else backwardRelationships[relationshipName] = convertRemoteRelationshipToSnapshot(relationship, direction);
+	}
+	return {
+		...Object.keys(forwardRelationships).length > 0 && { forwardRelationships },
+		...Object.keys(backwardRelationships).length > 0 && { backwardRelationships }
+	};
+}
+const REMOTE_PERMISSION_PERMITS = /* @__PURE__ */ new Map([[TailorDBType_Permission_Permit.ALLOW, "allow"], [TailorDBType_Permission_Permit.DENY, "deny"]]);
+const REMOTE_PERMISSION_OPERATORS = /* @__PURE__ */ new Map([
+	[TailorDBType_Permission_Operator.EQ, "eq"],
+	[TailorDBType_Permission_Operator.NE, "ne"],
+	[TailorDBType_Permission_Operator.IN, "in"],
+	[TailorDBType_Permission_Operator.NIN, "nin"],
+	[TailorDBType_Permission_Operator.HAS_ANY, "hasAny"],
+	[TailorDBType_Permission_Operator.NHAS_ANY, "nhasAny"]
+]);
+function convertRemotePermit(permit, source) {
+	const converted = REMOTE_PERMISSION_PERMITS.get(permit);
+	if (converted) return converted;
+	throw new Error(`Unsupported ${source} permission permit: ${permit}`);
+}
+function convertRemoteOperator(operator, source) {
+	const converted = REMOTE_PERMISSION_OPERATORS.get(operator);
+	if (converted) return converted;
+	throw new Error(`Unsupported ${source} permission operator: ${operator}`);
+}
+function convertRemoteValueOperand(operand) {
+	switch (operand?.kind.case) {
+		case "userField": return { user: operand.kind.value };
+		case "recordField": return { record: operand.kind.value };
+		case "oldRecordField": return { oldRecord: operand.kind.value };
+		case "newRecordField": return { newRecord: operand.kind.value };
+		case "value": return toJson(ValueSchema, operand.kind.value);
+		default: throw new Error("Unsupported permission operand");
+	}
+}
+function convertRemoteRecordCondition(condition) {
+	return [
+		convertRemoteValueOperand(condition.left),
+		convertRemoteOperator(condition.operator, "record"),
+		convertRemoteValueOperand(condition.right)
+	];
+}
+function convertRemoteGqlCondition(condition) {
+	return [
+		convertRemoteValueOperand(condition.left),
+		convertRemoteOperator(condition.operator, "GQL"),
+		convertRemoteValueOperand(condition.right)
+	];
+}
+function convertRemoteRecordPolicy(policy) {
+	return {
+		conditions: policy.conditions.map(convertRemoteRecordCondition),
+		permit: convertRemotePermit(policy.permit, "record"),
+		...policy.description && { description: policy.description }
+	};
+}
+function convertRemoteRecordPermissionToSnapshot(permission) {
+	const recordPermission = {
+		create: permission?.create.map(convertRemoteRecordPolicy) ?? [],
+		read: permission?.read.map(convertRemoteRecordPolicy) ?? [],
+		update: permission?.update.map(convertRemoteRecordPolicy) ?? [],
+		delete: permission?.delete.map(convertRemoteRecordPolicy) ?? []
+	};
+	return Object.values(recordPermission).some((policies) => policies.length > 0) ? recordPermission : void 0;
+}
+function convertRemoteGqlAction(action) {
+	switch (action) {
+		case TailorDBGQLPermission_Action.ALL: return "all";
+		case TailorDBGQLPermission_Action.CREATE: return "create";
+		case TailorDBGQLPermission_Action.READ: return "read";
+		case TailorDBGQLPermission_Action.UPDATE: return "update";
+		case TailorDBGQLPermission_Action.DELETE: return "delete";
+		case TailorDBGQLPermission_Action.AGGREGATE: return "aggregate";
+		case TailorDBGQLPermission_Action.BULK_UPSERT: return "bulkUpsert";
+		default: throw new Error(`Unsupported GQL permission action: ${action}`);
+	}
+}
+function convertRemoteGqlPermissionToSnapshot(permission) {
+	const policies = permission?.policies.map((policy) => ({
+		conditions: policy.conditions.map(convertRemoteGqlCondition),
+		actions: policy.actions.map(convertRemoteGqlAction),
+		permit: convertRemotePermit(policy.permit, "GQL"),
+		...policy.description && { description: policy.description }
+	})) ?? [];
+	return policies.length > 0 ? policies : void 0;
+}
+function convertRemoteTypeToSnapshot(remoteType, expectedType) {
+	const settings = convertRemoteSettingsToSnapshot(remoteType.schema?.settings, expectedType?.settings);
+	const relationships = convertRemoteRelationshipsToSnapshot(remoteType.schema?.relationships, expectedType);
+	const recordPermission = convertRemoteRecordPermissionToSnapshot(remoteType.schema?.permission);
 	const snapshotType = {
 		name: remoteType.name,
 		pluralForm: remoteType.schema?.settings?.pluralForm || inflection.pluralize(remoteType.name),
-		fields: convertRemoteFieldsToSnapshot(remoteType)
+		fields: convertRemoteFieldsToSnapshot(remoteType),
+		...settings && { settings },
+		...relationships
 	};
 	if (remoteType.schema?.description) snapshotType.description = remoteType.schema.description;
+	const indexes = convertRemoteIndexesToSnapshot(remoteType.schema?.indexes);
+	if (indexes) snapshotType.indexes = indexes;
+	const files = convertRemoteFilesToSnapshot(remoteType.schema?.files);
+	if (files) snapshotType.files = files;
+	if (recordPermission) snapshotType.permissions = { record: recordPermission };
 	return snapshotType;
 }
 /**
 * Convert remote TailorDB types into the normalized snapshot shape used by drift checks.
 * @param {ProtoTailorDBType[]} remoteTypes - Remote TailorDB types from the API
 * @param {string} namespace - Namespace for the reconstructed snapshot
+* @param {readonly RemoteGqlPermission[]} remoteGqlPermissions - Remote GQL permissions for the namespace
+* @param {SchemaSnapshot} expectedSnapshot - Optional snapshot used to disambiguate remote relationship direction
 * @returns {NormalizedSchemaSnapshot} Normalized snapshot-shaped remote state
 */
-function createSnapshotFromRemoteTypes(remoteTypes, namespace) {
+function createSnapshotFromRemoteTypes(remoteTypes, namespace, remoteGqlPermissions = [], expectedSnapshot) {
 	const types = createSnapshotRecord();
-	for (const remoteType of remoteTypes) types[remoteType.name] = convertRemoteTypeToSnapshot(remoteType);
+	for (const remoteType of remoteTypes) types[remoteType.name] = convertRemoteTypeToSnapshot(remoteType, expectedSnapshot?.types[remoteType.name]);
+	for (const permission of remoteGqlPermissions) {
+		const { typeName } = permission;
+		const snapshotType = types[typeName];
+		if (!snapshotType) continue;
+		const gqlPermission = convertRemoteGqlPermissionToSnapshot(permission.permission);
+		if (!gqlPermission) continue;
+		snapshotType.permissions = {
+			...snapshotType.permissions,
+			gql: gqlPermission
+		};
+	}
 	return normalizeSchemaSnapshot({
 		version: 1,
 		namespace,
@@ -8018,6 +8285,107 @@ function createSnapshotFromRemoteTypes(remoteTypes, namespace) {
 		types
 	});
 }
+function fieldDifferenceValue(value) {
+	if (value === void 0 || value === "") return "none";
+	return String(value);
+}
+function fieldDifferenceKey(prefix, key) {
+	return prefix ? `${prefix}.${key}` : key;
+}
+function addFieldDifference(differences, prefix, key, remoteValue, snapshotValue) {
+	if (remoteValue === snapshotValue) return;
+	differences.push(`${fieldDifferenceKey(prefix, key)}: remote=${fieldDifferenceValue(remoteValue)}, expected=${fieldDifferenceValue(snapshotValue)}`);
+}
+function addBooleanFieldDifference(differences, prefix, key, remoteField, snapshotField) {
+	addFieldDifference(differences, prefix, key, remoteField[key] ?? false, snapshotField[key] ?? false);
+}
+function addAllowedValuesDifferences(differences, prefix, remoteField, snapshotField) {
+	const remoteAllowed = remoteField.allowedValues ?? [];
+	const snapshotAllowed = snapshotField.allowedValues ?? [];
+	if (remoteAllowed.length !== snapshotAllowed.length) {
+		differences.push(`${fieldDifferenceKey(prefix, "allowedValues")} count: remote=${remoteAllowed.length}, expected=${snapshotAllowed.length}`);
+		return;
+	}
+	const snapshotAllowedValues = new Map(snapshotAllowed.map((v) => [v.value, v.description]));
+	for (const value of remoteAllowed) {
+		if (!snapshotAllowedValues.has(value.value)) {
+			differences.push(`${fieldDifferenceKey(prefix, "allowedValues")}: remote has '${value.value}' not in snapshot`);
+			return;
+		}
+		const snapshotDescription = snapshotAllowedValues.get(value.value);
+		if ((value.description ?? "") !== (snapshotDescription ?? "")) {
+			addFieldDifference(differences, prefix, `allowedValues.${value.value}.description`, value.description ?? "", snapshotDescription ?? "");
+			return;
+		}
+	}
+	const remoteAllowedValues = new Set(remoteAllowed.map((v) => v.value));
+	for (const value of snapshotAllowed) if (!remoteAllowedValues.has(value.value)) {
+		differences.push(`${fieldDifferenceKey(prefix, "allowedValues")}: snapshot has '${value.value}' not in remote`);
+		return;
+	}
+}
+function addHooksDifferences(differences, prefix, remoteField, snapshotField) {
+	addFieldDifference(differences, prefix, "hooks.create", remoteField.hooks?.create?.expr ?? "", snapshotField.hooks?.create?.expr ?? "");
+	addFieldDifference(differences, prefix, "hooks.update", remoteField.hooks?.update?.expr ?? "", snapshotField.hooks?.update?.expr ?? "");
+}
+function addValidationDifferences(differences, prefix, remoteField, snapshotField) {
+	const remoteValidate = remoteField.validate ?? [];
+	const snapshotValidate = snapshotField.validate ?? [];
+	if (remoteValidate.length !== snapshotValidate.length) differences.push(`${fieldDifferenceKey(prefix, "validate")} count: remote=${remoteValidate.length}, expected=${snapshotValidate.length}`);
+	const commonLength = Math.min(remoteValidate.length, snapshotValidate.length);
+	for (let index = 0; index < commonLength; index++) {
+		const remoteValidation = assertDefined(remoteValidate[index], `remoteValidate missing index ${index}`);
+		const snapshotValidation = assertDefined(snapshotValidate[index], `snapshotValidate missing index ${index}`);
+		addFieldDifference(differences, prefix, `validate[${index}].script`, remoteValidation.script?.expr ?? "", snapshotValidation.script?.expr ?? "");
+		addFieldDifference(differences, prefix, `validate[${index}].errorMessage`, remoteValidation.errorMessage, snapshotValidation.errorMessage);
+	}
+}
+function addSerialDifferences(differences, prefix, remoteField, snapshotField) {
+	addFieldDifference(differences, prefix, "serial.start", remoteField.serial?.start, snapshotField.serial?.start);
+	addFieldDifference(differences, prefix, "serial.maxValue", remoteField.serial?.maxValue, snapshotField.serial?.maxValue);
+	addFieldDifference(differences, prefix, "serial.format", remoteField.serial?.format ?? "", snapshotField.serial?.format ?? "");
+}
+function addNestedFieldDifferences(differences, prefix, remoteField, snapshotField) {
+	const remoteFields = remoteField.fields ?? {};
+	const snapshotFields = snapshotField.fields ?? {};
+	const remoteFieldNames = Object.keys(remoteFields);
+	const snapshotFieldNames = Object.keys(snapshotFields);
+	if (remoteFieldNames.length !== snapshotFieldNames.length) differences.push(`${fieldDifferenceKey(prefix, "fields")} count: remote=${remoteFieldNames.length}, expected=${snapshotFieldNames.length}`);
+	for (const fieldName of remoteFieldNames) {
+		const remoteNestedField = remoteFields[fieldName];
+		const snapshotNestedField = snapshotFields[fieldName];
+		const nestedPrefix = fieldDifferenceKey(prefix, `fields.${fieldName}`);
+		if (!snapshotNestedField) {
+			differences.push(`${nestedPrefix}: exists in remote but not snapshot`);
+			continue;
+		}
+		addFieldDifferences(differences, nestedPrefix, assertDefined(remoteNestedField, `remote field "${fieldName}" missing`), snapshotNestedField);
+	}
+	for (const fieldName of snapshotFieldNames) {
+		if (remoteFields[fieldName]) continue;
+		differences.push(`${fieldDifferenceKey(prefix, `fields.${fieldName}`)}: exists in snapshot but not remote`);
+	}
+}
+function addFieldDifferences(differences, prefix, remoteField, snapshotField) {
+	addFieldDifference(differences, prefix, "type", remoteField.type, snapshotField.type);
+	addFieldDifference(differences, prefix, "required", remoteField.required, snapshotField.required);
+	for (const key of [
+		"array",
+		"index",
+		"unique",
+		"foreignKey",
+		"vector"
+	]) addBooleanFieldDifference(differences, prefix, key, remoteField, snapshotField);
+	addFieldDifference(differences, prefix, "foreignKeyType", remoteField.foreignKeyType, snapshotField.foreignKeyType);
+	addFieldDifference(differences, prefix, "foreignKeyField", remoteField.foreignKeyField, snapshotField.foreignKeyField);
+	addFieldDifference(differences, prefix, "description", remoteField.description ?? "", snapshotField.description ?? "");
+	addAllowedValuesDifferences(differences, prefix, remoteField, snapshotField);
+	addHooksDifferences(differences, prefix, remoteField, snapshotField);
+	addValidationDifferences(differences, prefix, remoteField, snapshotField);
+	addSerialDifferences(differences, prefix, remoteField, snapshotField);
+	addFieldDifference(differences, prefix, "scale", remoteField.scale, snapshotField.scale);
+	addNestedFieldDifferences(differences, prefix, remoteField, snapshotField);
+}
 /**
 * Compare a single field between remote and snapshot
 * @param {string} typeName - Name of the type
@@ -8028,37 +8396,7 @@ function createSnapshotFromRemoteTypes(remoteTypes, namespace) {
 */
 function compareFields(typeName, fieldName, remoteField, snapshotField) {
 	const differences = [];
-	if (remoteField.type !== snapshotField.type) differences.push(`type: remote=${remoteField.type}, expected=${snapshotField.type}`);
-	if (remoteField.required !== snapshotField.required) differences.push(`required: remote=${remoteField.required}, expected=${snapshotField.required}`);
-	const remoteArray = remoteField.array ?? false;
-	const snapshotArray = snapshotField.array ?? false;
-	if (remoteArray !== snapshotArray) differences.push(`array: remote=${remoteArray}, expected=${snapshotArray}`);
-	const remoteUnique = remoteField.unique ?? false;
-	const snapshotUnique = snapshotField.unique ?? false;
-	if (remoteUnique !== snapshotUnique) differences.push(`unique: remote=${remoteUnique}, expected=${snapshotUnique}`);
-	const remoteFk = remoteField.foreignKey ?? false;
-	const snapshotFk = snapshotField.foreignKey ?? false;
-	if (remoteFk !== snapshotFk) differences.push(`foreignKey: remote=${remoteFk}, expected=${snapshotFk}`);
-	if (remoteField.foreignKeyType !== snapshotField.foreignKeyType) differences.push(`foreignKeyType: remote=${remoteField.foreignKeyType ?? "none"}, expected=${snapshotField.foreignKeyType ?? "none"}`);
-	const remoteAllowed = remoteField.allowedValues ?? [];
-	const snapshotAllowed = snapshotField.allowedValues ?? [];
-	const remoteAllowedValues = new Set(remoteAllowed.map((v) => v.value));
-	const snapshotAllowedValues = new Set(snapshotAllowed.map((v) => v.value));
-	if (remoteAllowedValues.size !== snapshotAllowedValues.size) differences.push(`allowedValues count: remote=${remoteAllowedValues.size}, expected=${snapshotAllowedValues.size}`);
-	else {
-		for (const v of remoteAllowedValues) if (!snapshotAllowedValues.has(v)) {
-			differences.push(`allowedValues: remote has '${v}' not in snapshot`);
-			break;
-		}
-		for (const v of snapshotAllowedValues) if (!remoteAllowedValues.has(v)) {
-			differences.push(`allowedValues: snapshot has '${v}' not in remote`);
-			break;
-		}
-	}
-	const remoteVector = remoteField.vector ?? false;
-	const snapshotVector = snapshotField.vector ?? false;
-	if (remoteVector !== snapshotVector) differences.push(`vector: remote=${remoteVector}, expected=${snapshotVector}`);
-	if (remoteField.scale !== snapshotField.scale) differences.push(`scale: remote=${remoteField.scale}, expected=${snapshotField.scale}`);
+	addFieldDifferences(differences, "", remoteField, snapshotField);
 	if (differences.length > 0) return {
 		typeName,
 		kind: "field_mismatch",
@@ -8075,53 +8413,136 @@ const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["id"]);
 * Compare remote TailorDB types with a local snapshot
 * @param {ProtoTailorDBType[]} remoteTypes - Remote types from listParsedTailorDBTypes API
 * @param {SchemaSnapshot} snapshot - Local schema snapshot
+* @param {readonly RemoteGqlPermission[]} remoteGqlPermissions - Remote GQL permissions for the namespace
 * @returns {SchemaDrift[]} List of drifts detected
 */
-function compareRemoteWithSnapshot(remoteTypes, snapshot) {
-	return compareNormalizedRemoteWithSnapshot(createSnapshotFromRemoteTypes(remoteTypes, snapshot.namespace), normalizeSchemaSnapshot(snapshot));
+function compareRemoteWithSnapshot(remoteTypes, snapshot, remoteGqlPermissions = []) {
+	return compareNormalizedRemoteWithSnapshot(createRemoteComparableSnapshot(createSnapshotFromRemoteTypes(remoteTypes, snapshot.namespace, remoteGqlPermissions, snapshot)), createRemoteComparableSnapshot(snapshot));
 }
-function compareNormalizedRemoteWithSnapshot(remoteSnapshot, snapshot) {
-	const drifts = [];
-	const remoteTypeMap = new Map(Object.entries(remoteSnapshot.types));
-	const snapshotTypeNames = new Set(Object.keys(snapshot.types));
-	const remoteTypeNames = new Set(Object.keys(remoteSnapshot.types));
-	for (const typeName of snapshotTypeNames) if (!remoteTypeNames.has(typeName)) drifts.push({
-		typeName,
-		kind: "type_missing_remote",
-		details: `Type '${typeName}' exists in snapshot but not in remote`
-	});
-	for (const typeName of remoteTypeNames) if (!snapshotTypeNames.has(typeName)) drifts.push({
-		typeName,
-		kind: "type_missing_local",
-		details: `Type '${typeName}' exists in remote but not in snapshot`
+function createRemoteComparableSnapshot(snapshot) {
+	const types = createSnapshotRecord();
+	for (const [typeName, type] of Object.entries(snapshot.types)) {
+		const fields = createSnapshotRecord();
+		for (const [fieldName, field] of Object.entries(type.fields)) {
+			if (SYSTEM_FIELDS.has(fieldName)) continue;
+			fields[fieldName] = field;
+		}
+		types[typeName] = {
+			...type,
+			fields
+		};
+	}
+	return normalizeSchemaSnapshot({
+		...snapshot,
+		types
 	});
-	for (const typeName of snapshotTypeNames) {
-		if (!remoteTypeNames.has(typeName)) continue;
-		const remoteType = assertDefined(remoteTypeMap.get(typeName), `type "${typeName}" missing from remoteTypeMap`);
-		const snapshotType = assertDefined(snapshot.types[typeName], `type "${typeName}" missing from snapshot`);
-		const remoteFields = remoteType.fields;
-		const snapshotFields = snapshotType.fields;
-		const remoteFieldNames = new Set(Object.keys(remoteFields).filter((f) => !SYSTEM_FIELDS.has(f)));
-		const snapshotFieldNames = new Set(Object.keys(snapshotFields).filter((f) => !SYSTEM_FIELDS.has(f)));
-		for (const fieldName of snapshotFieldNames) if (!remoteFieldNames.has(fieldName)) drifts.push({
-			typeName,
+}
+function fieldDriftFromChange(change) {
+	return compareFields(change.typeName, change.fieldName, change.before, change.after) ?? {
+		typeName: change.typeName,
+		kind: "field_mismatch",
+		fieldName: change.fieldName,
+		details: `Field '${change.fieldName}' differs between remote and snapshot`
+	};
+}
+function schemaDriftFromDiffChange(change) {
+	switch (change.kind) {
+		case "type_added": return {
+			typeName: change.typeName,
+			kind: "type_missing_remote",
+			details: `Type '${change.typeName}' exists in snapshot but not in remote`
+		};
+		case "type_removed": return {
+			typeName: change.typeName,
+			kind: "type_missing_local",
+			details: `Type '${change.typeName}' exists in remote but not in snapshot`
+		};
+		case "type_settings_modified":
+		case "type_modified": return {
+			typeName: change.typeName,
+			kind: "type_settings_mismatch",
+			details: change.reason ?? "Type settings differ between remote and snapshot"
+		};
+		case "field_added": return {
+			typeName: change.typeName,
 			kind: "field_missing_remote",
-			fieldName,
-			details: `Field '${fieldName}' exists in snapshot but not in remote`
-		});
-		for (const fieldName of remoteFieldNames) if (!snapshotFieldNames.has(fieldName)) drifts.push({
-			typeName,
+			fieldName: change.fieldName,
+			details: `Field '${change.fieldName}' exists in snapshot but not in remote`
+		};
+		case "field_removed": return {
+			typeName: change.typeName,
 			kind: "field_missing_local",
-			fieldName,
-			details: `Field '${fieldName}' exists in remote but not in snapshot`
-		});
-		for (const fieldName of snapshotFieldNames) {
-			if (!remoteFieldNames.has(fieldName)) continue;
-			const drift = compareFields(typeName, fieldName, assertDefined(remoteFields[fieldName], `field "${fieldName}" missing from remoteFields`), assertDefined(snapshotFields[fieldName], `field "${fieldName}" missing from snapshotFields`));
-			if (drift) drifts.push(drift);
-		}
+			fieldName: change.fieldName,
+			details: `Field '${change.fieldName}' exists in remote but not in snapshot`
+		};
+		case "field_modified": return fieldDriftFromChange(change);
+		case "index_added": return {
+			typeName: change.typeName,
+			kind: "index_missing_remote",
+			indexName: change.indexName,
+			details: `Index '${change.indexName}' exists in snapshot but not in remote`
+		};
+		case "index_removed": return {
+			typeName: change.typeName,
+			kind: "index_missing_local",
+			indexName: change.indexName,
+			details: `Index '${change.indexName}' exists in remote but not in snapshot`
+		};
+		case "index_modified": return {
+			typeName: change.typeName,
+			kind: "index_mismatch",
+			indexName: change.indexName,
+			details: change.reason ?? `Index '${change.indexName}' differs between remote and snapshot`
+		};
+		case "file_added": return {
+			typeName: change.typeName,
+			kind: "file_missing_remote",
+			fileName: change.fieldName,
+			details: `File '${change.fieldName}' exists in snapshot but not in remote`
+		};
+		case "file_removed": return {
+			typeName: change.typeName,
+			kind: "file_missing_local",
+			fileName: change.fieldName,
+			details: `File '${change.fieldName}' exists in remote but not in snapshot`
+		};
+		case "file_modified": return {
+			typeName: change.typeName,
+			kind: "file_mismatch",
+			fileName: change.fieldName,
+			details: change.reason ?? `File '${change.fieldName}' differs between remote and snapshot`
+		};
+		case "relationship_added": return {
+			typeName: change.typeName,
+			kind: "relationship_missing_remote",
+			relationshipName: change.relationshipName,
+			relationshipType: change.relationshipType,
+			details: `Relationship '${change.relationshipName}' exists in snapshot but not in remote`
+		};
+		case "relationship_removed": return {
+			typeName: change.typeName,
+			kind: "relationship_missing_local",
+			relationshipName: change.relationshipName,
+			relationshipType: change.relationshipType,
+			details: `Relationship '${change.relationshipName}' exists in remote but not in snapshot`
+		};
+		case "relationship_modified": return {
+			typeName: change.typeName,
+			kind: "relationship_mismatch",
+			relationshipName: change.relationshipName,
+			relationshipType: change.relationshipType,
+			details: change.reason ?? `Relationship '${change.relationshipName}' differs between remote and snapshot`
+		};
+		case "permission_modified": return {
+			typeName: change.typeName,
+			kind: "permission_mismatch",
+			details: change.reason ?? "Permissions differ between remote and snapshot"
+		};
+		default: throw new Error("Unsupported diff change");
 	}
-	return drifts;
+}
+function compareNormalizedRemoteWithSnapshot(remoteSnapshot, snapshot) {
+	return compareNormalizedSnapshots(remoteSnapshot, snapshot).changes.map(schemaDriftFromDiffChange);
 }
 /**
 * Format schema drifts for display
@@ -8140,7 +8561,12 @@ function formatSchemaDrifts(drifts) {
 	for (const [typeName, typeDrifts] of driftsByType) {
 		lines.push(`  Type '${typeName}':`);
 		for (const drift of typeDrifts) if (drift.fieldName) lines.push(`    - Field '${drift.fieldName}': ${drift.details}`);
-		else lines.push(`    - ${drift.details}`);
+		else if (drift.indexName) lines.push(`    - Index '${drift.indexName}': ${drift.details}`);
+		else if (drift.fileName) lines.push(`    - File '${drift.fileName}': ${drift.details}`);
+		else if (drift.relationshipName) {
+			const relationshipType = drift.relationshipType ? ` (${drift.relationshipType})` : "";
+			lines.push(`    - Relationship${relationshipType} '${drift.relationshipName}': ${drift.details}`);
+		} else lines.push(`    - ${drift.details}`);
 	}
 	return lines.join("\n");
 }
@@ -9229,6 +9655,77 @@ async function fetchRemoteTypes(client, workspaceId, namespace) {
 		}
 	});
 }
+async function fetchRemoteGqlPermissions(client, workspaceId, namespace) {
+	return fetchAll(async (pageToken, maxPageSize) => {
+		try {
+			const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
+				workspaceId,
+				namespaceName: namespace,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [permissions, nextPageToken];
+		} catch (error) {
+			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
+			throw error;
+		}
+	});
+}
+function definedWhenNotEmpty(value) {
+	return Object.keys(value).length > 0 ? value : void 0;
+}
+function namespaceConfig(config, tailorDBInputs, namespace) {
+	return tailorDBInputs.find((input) => input.namespace === namespace)?.config ?? config.db?.[namespace];
+}
+function namespaceGqlOperations(config, tailorDBInputs, namespace) {
+	return namespaceConfig(config, tailorDBInputs, namespace)?.gqlOperations;
+}
+const GQL_OPERATION_KEYS = [
+	"create",
+	"update",
+	"delete",
+	"read"
+];
+function configuredDisabledGqlOperations(operations) {
+	if (!operations) return void 0;
+	if (operations === "query") return {
+		create: false,
+		update: false,
+		delete: false
+	};
+	const disabled = {};
+	for (const key of GQL_OPERATION_KEYS) if (operations[key] === false) disabled[key] = false;
+	return definedWhenNotEmpty(disabled);
+}
+function appliedConfiguredDisabledGqlOperations(remoteDisabled, configuredDisabled) {
+	if (!remoteDisabled || !configuredDisabled) return void 0;
+	const disabled = {};
+	for (const key of GQL_OPERATION_KEYS) if (configuredDisabled[key] === false && remoteDisabled[key]) disabled[key] = false;
+	return definedWhenNotEmpty(disabled);
+}
+function deployComparableSnapshot(snapshot, remoteTypes, gqlOperations) {
+	const remoteTypesByName = new Map(remoteTypes.map((type) => [type.name, type]));
+	const configuredDisabled = configuredDisabledGqlOperations(gqlOperations);
+	const types = {};
+	for (const [typeName, type] of Object.entries(snapshot.types)) {
+		const settings = { ...type.settings };
+		const remoteSettings = remoteTypesByName.get(typeName)?.schema?.settings;
+		if (type.settings?.publishEvents === void 0 && remoteSettings?.publishRecordEvents) settings.publishEvents = true;
+		if (type.settings?.gqlOperations === void 0) {
+			const disabled = appliedConfiguredDisabledGqlOperations(remoteSettings?.disableGqlOperations, configuredDisabled);
+			if (disabled) settings.gqlOperations = disabled;
+		}
+		const comparableType = { ...type };
+		const comparableSettings = definedWhenNotEmpty(settings);
+		if (comparableSettings) comparableType.settings = comparableSettings;
+		else delete comparableType.settings;
+		types[typeName] = comparableType;
+	}
+	return {
+		...snapshot,
+		types
+	};
+}
 /**
 * Get the current migration number from remote metadata
 * @param {OperatorClient} client - Operator client instance
@@ -9253,9 +9750,11 @@ async function getRemoteMigrationNumber(client, workspaceId, namespace) {
 * @param {OperatorClient} client - Operator client instance
 * @param {string} workspaceId - Workspace ID
 * @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migration config
+* @param {LoadedConfig} config - Loaded application config
+* @param {ReadonlyArray<TailorDBDeployInput>} tailorDBInputs - Deploy inputs for namespace defaults
 * @returns {Promise<RemoteSchemaVerificationResult[]>} Verification results per namespace
 */
-async function verifyRemoteSchema(client, workspaceId, namespacesWithMigrations) {
+async function verifyRemoteSchema(client, workspaceId, namespacesWithMigrations, config, tailorDBInputs) {
 	const results = [];
 	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
 		const remoteMigrationNumber = await getRemoteMigrationNumber(client, workspaceId, namespace);
@@ -9278,7 +9777,8 @@ async function verifyRemoteSchema(client, workspaceId, namespacesWithMigrations)
 			});
 			continue;
 		}
-		const drifts = compareRemoteWithSnapshot(await fetchRemoteTypes(client, workspaceId, namespace), expectedSnapshot);
+		const [remoteTypes, remoteGqlPermissions] = await Promise.all([fetchRemoteTypes(client, workspaceId, namespace), fetchRemoteGqlPermissions(client, workspaceId, namespace)]);
+		const drifts = compareRemoteWithSnapshot(remoteTypes, deployComparableSnapshot(expectedSnapshot, remoteTypes, namespaceGqlOperations(config, tailorDBInputs, namespace)), remoteGqlPermissions);
 		results.push({
 			namespace,
 			remoteMigrationNumber,
@@ -9312,9 +9812,10 @@ function formatRemoteVerificationResults(results) {
 * @param {ReadonlyMap<string, Record<string, TailorDBSnapshotType>>} typesByNamespace - Types by namespace
 * @param {LoadedConfig} config - Loaded application config (includes path)
 * @param {boolean} noSchemaCheck - Whether to skip schema diff check
+* @param {ReadonlyArray<TailorDBDeployInput>} tailorDBInputs - Deploy inputs for namespace defaults
 * @returns {Promise<ValidateAndDetectResult>} Pending migrations and namespaces that have migration directories configured
 */
-async function validateAndDetectMigrations(client, workspaceId, typesByNamespace, config, noSchemaCheck) {
+async function validateAndDetectMigrations(client, workspaceId, typesByNamespace, config, noSchemaCheck, tailorDBInputs) {
 	const namespacesWithMigrations = getNamespacesWithMigrations(config, path.dirname(config.path));
 	let pendingMigrations = [];
 	if (namespacesWithMigrations.length > 0) {
@@ -9329,7 +9830,7 @@ async function validateAndDetectMigrations(client, workspaceId, typesByNamespace
 				logger.info("Or use '--no-schema-check' to skip this check.");
 				throw new Error("Schema migration check failed");
 			}
-			const remoteVerificationResults = await verifyRemoteSchema(client, workspaceId, namespacesWithMigrations);
+			const remoteVerificationResults = await verifyRemoteSchema(client, workspaceId, namespacesWithMigrations, config, tailorDBInputs);
 			if (remoteVerificationResults.some((r) => r.hasDrift)) {
 				logger.error("Remote schema drift detected:");
 				logger.log(formatRemoteVerificationResults(remoteVerificationResults));
@@ -9339,6 +9840,12 @@ async function validateAndDetectMigrations(client, workspaceId, typesByNamespace
 				logger.info("  - Manual schema changes were made directly", { mode: "plain" });
 				logger.info("  - Migration history is out of sync", { mode: "plain" });
 				logger.newline();
+				logger.info("To resolve:");
+				logger.info("  - Run 'tailor-sdk tailordb migration status' to compare local vs remote.", { mode: "plain" });
+				logger.info("  - If remote is correct, update local types and run 'migration generate'.", { mode: "plain" });
+				logger.info("  - If local migration history is correct, run 'migration sync <N>' to overwrite remote.", { mode: "plain" });
+				logger.info("  - If only bookkeeping is stale, run 'migration set <N>'.", { mode: "plain" });
+				logger.newline();
 				logger.info("Use '--no-schema-check' to skip this check (not recommended).");
 				throw new Error("Remote schema verification failed");
 			}
@@ -9413,7 +9920,7 @@ async function applyTailorDB(client, result, phase = "create-update") {
 	if (phase === "create-update") {
 		const typesByNamespace = /* @__PURE__ */ new Map();
 		for (const tailordb of migrationContext.tailorDBInputs) typesByNamespace.set(tailordb.namespace, tailordb.types);
-		const { pendingMigrations, namespacesWithMigrations } = await validateAndDetectMigrations(client, migrationContext.workspaceId, typesByNamespace, migrationContext.config, migrationContext.noSchemaCheck);
+		const { pendingMigrations, namespacesWithMigrations } = await validateAndDetectMigrations(client, migrationContext.workspaceId, typesByNamespace, migrationContext.config, migrationContext.noSchemaCheck, migrationContext.tailorDBInputs);
 		if (pendingMigrations.length > 0) {
 			processedTypes.reset();
 			deletedResources.reset();
@@ -9877,29 +10384,19 @@ async function planServices(client, workspaceId, appName, appId, tailordbs) {
 	const conflicts = [];
 	const unmanaged = [];
 	const resourceOwners = /* @__PURE__ */ new Set();
-	const withoutLabel = await fetchAll(async (pageToken, maxPageSize) => {
-		try {
+	const existingServices = await fetchExistingResourcesWithLabels({
+		client,
+		fetchPage: async (pageToken, maxPageSize) => {
 			const { tailordbServices, nextPageToken } = await client.listTailorDBServices({
 				workspaceId,
 				pageToken,
 				pageSize: maxPageSize
 			});
 			return [tailordbServices, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+		},
+		getName: (resource) => resource.namespace?.name,
+		getTrn: (name) => resourceTrn(workspaceId, "tailordb", name)
 	});
-	const existingServices = {};
-	await Promise.all(withoutLabel.map(async (resource) => {
-		if (!resource.namespace?.name) return;
-		const { metadata } = await client.getMetadata({ trn: resourceTrn(workspaceId, "tailordb", resource.namespace.name) });
-		existingServices[resource.namespace.name] = {
-			resource,
-			label: metadata?.labels[sdkNameLabelKey],
-			allLabels: metadata?.labels
-		};
-	}));
 	for (const tailordb of tailordbs) {
 		const existing = existingServices[tailordb.namespace];
 		const metaRequest = await buildMetaRequest({
@@ -10328,7 +10825,7 @@ function filterJobFunctionVersions(allVersions, usedJobNames) {
 * @param client - Operator client instance
 * @param changeSet - Workflow change set
 * @param appName - Application name
-* @param appId
+* @param appId - Application ID used for job function metadata when available
 * @param unchangedWorkflowJobNames - Job function names used by unchanged workflows
 * @returns Map of job function names to versions
 */
@@ -10414,7 +10911,7 @@ function buildWorkflowValidationShape(workspaceId, workflow) {
 * @param client - Operator client instance
 * @param workspaceId - Workspace ID
 * @param appName - Application name
-* @param appId
+* @param appId - Application ID used for workflow metadata when available
 * @param workflows - Parsed workflows
 * @param mainJobDeps - Main job dependencies by workflow
 * @param unchangedJobFunctions - Job functions already proven unchanged by function registry plan
@@ -10429,7 +10926,6 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 	const retainedWorkflowJobNames = /* @__PURE__ */ new Set();
 	const existingWorkflows = await fetchExistingResourcesWithLabels({
 		client,
-		workspaceId,
 		fetchPage: async (pageToken, pageSize) => {
 			const response = await client.listWorkflows({
 				workspaceId,
@@ -10439,7 +10935,7 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 			return [response.workflows, response.nextPageToken];
 		},
 		getName: (resource) => resource.name,
-		getTrn: (workspaceId, name) => resourceTrn(workspaceId, "workflow", name)
+		getTrn: (name) => resourceTrn(workspaceId, "workflow", name)
 	});
 	for (const workflow of Object.values(workflows)) {
 		const existing = existingWorkflows[workflow.name];
@@ -16209,7 +16705,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-a_ApFuPh.mjs");
+	const { defineApplication } = await import("./application-BXdCl6bp.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -18139,7 +18635,7 @@ async function runRepl(options) {
 	const execute = await prepareQueryExecutor(options);
 	const historyPath = getReplHistoryPath(options.engine, options.profile, options.workspaceId);
 	const validate = createReplValidator(options.engine);
-	const { highlightSqlLine, highlightGraphqlLine, replTransform } = await import("./repl-editor-DD5YP5mt.mjs");
+	const { highlightSqlLine, highlightGraphqlLine, replTransform } = await import("./repl-editor-BmQOyZJd.mjs");
 	const highlight = options.engine === "sql" ? highlightSqlLine : highlightGraphqlLine;
 	const prompt = createPrompt({
 		prefix: "",
@@ -18474,4 +18970,4 @@ function isDeno() {
 
 //#endregion
 export { getOrganization as $, generateAllTypeManifestsFromSnapshot as $t, listCommand$3 as A, apiCommand as An, getExecutorWaitFailureMessage as At, show as B, paginationArgs as Bn, listWorkflowExecutions as Bt, listCommand$2 as C, getNamespacesWithMigrations as Cn, listWebhookExecutors as Ct, waitWorkflowExecution as D, PluginManager as Dn, listCommand$9 as Dt, waitCommand as E, sdkNameLabelKey as En, triggerExecutor as Et, generateCommand as F, configArg as Fn, startWorkflow as Ft, removeCommand$1 as G, deploy as Gt, extractOwnedNamespaces as H, workspaceArgs as Hn, formatKeyValueTable as Ht, generateMigrationScript as I, confirmationArgs as In, getCommand$5 as It, organizationTree as J, bundleMigrationScript as Jt, updateCommand$1 as K, executeScript as Kt, writeDbTypesFile as L, deploymentArgs as Ln, getWorkflow as Lt, truncate as M, assertWritable as Mn, listExecutorJobs as Mt, truncateCommand as N, defineAppCommand as Nn, watchExecutorJob as Nt, resumeCommand as O, generateUserTypes as On, listExecutors as Ot, generate as P, commonArgs as Pn, startCommand as Pt, getCommand$1 as Q, compareSnapshotWithRemote as Qt, getConfiguredEditorCommand as R, isVerbose as Rn, executionsCommand as Rt, listApps as S, hasChanges as Sn, getFunctionRegistry as St, healthCommand as T, resourceTrn as Tn, triggerCommand as Tt, logBetaWarning as U, getCommand$6 as Ut, showCommand as V, toPageDirection as Vn, functionExecutionStatusToString as Vt, remove as W, getExecutor as Wt, listCommand$4 as X, handleOptionalToRequiredError as Xt, treeCommand as Y, MIGRATION_LABEL_KEY as Yt, listOrganizations as Z, parseMigrationLabelNumber as Zt, getWorkspace as _, reconstructSnapshotFromMigrations as _n, listMachineUsers as _t, updateUser as a, SCHEMA_FILE_NAME as an, getFolder as at, createCommand as b, formatDiffSummary as bn, listFunctionRegistries as bt, listCommand as c, compareSnapshots as cn, createCommand$1 as ct, inviteUser as d, getMigrationDirPath as dn, listOAuth2Clients as dt, protoGqlPermission as en, updateCommand$2 as et, restoreCommand as f, getMigrationFilePath as fn, getCommand$3 as ft, getCommand as g, loadDiff as gn, listCommand$7 as gt, listWorkspaces as h, isValidMigrationNumber as hn, tokenCommand as ht, updateCommand as i, MIGRATE_FILE_NAME as in, getCommand$2 as it, listWorkflows as j, apiCall as jn, jobsCommand as jt, resumeWorkflow as k, prompt as kn, getExecutorJob as kt, listUsers as l, createSnapshotFromLocalTypes as ln, createFolder as lt, listCommand$1 as m, getNextMigrationNumber as mn, getMachineUserToken as mt, query as n, DIFF_FILE_NAME as nn, listCommand$5 as nt, removeCommand as o, assertValidMigrationFiles as on, deleteCommand$1 as ot, restoreWorkspace as p, getMigrationFiles as pn, getOAuth2Client as pt, updateOrganization as q, waitForExecution as qt, queryCommand as r, INITIAL_SCHEMA_NUMBER as rn, listFolders as rt, removeUser as s, compareLocalTypesWithSnapshot as sn, deleteFolder as st, isNativeTypeScriptRuntime as t, DB_TYPES_FILE_NAME as tn, updateFolder as tt, inviteCommand as u, getLatestMigrationNumber as un, listCommand$6 as ut, deleteCommand as v, formatMigrationNumber as vn, generate$1 as vt, getAppHealth as w, ensureConfigId as wn, webhookCommand as wt, createWorkspace as x, formatMigrationDiff as xn, getCommand$4 as xt, deleteWorkspace as y, parseMigrationNumberArg as yn, listCommand$8 as yt, openInConfiguredEditor as z, pagedLogArgs as zn, getWorkflowExecution as zt };
-//# sourceMappingURL=runtime-Cd375HD-.mjs.map
+//# sourceMappingURL=runtime-B8O6JFS2.mjs.map