@tailor-platform/sdk 1.73.0 → 1.73.2

package/dist/{runtime-CEFC05qX.mjs → runtime-B8O6JFS2.mjs}

@@ -2,7 +2,7 @@ import { t as db } from "./schema-DAdZSFOd.mjs";
 import { $ as CreateUserProfileConfigRequestSchema, A as UpdatePipelineServiceRequestSchema, At as Condition_Operator, B as UpdateExecutorExecutorRequestSchema, Ct as UserProfileProviderConfig_UserProfileProviderType, D as CreatePipelineResolverRequestSchema, Dt as ApplicationSchemaUpdateAttemptStatus, E as UpdateSecretManagerSecretRequestSchema, Et as UpdateApplicationRequestSchema, F as IdPPermissionOperator, G as CreateAuthHookRequestSchema, H as ExecutorTargetType, I as IdPPermissionPermit, J as CreateAuthOAuth2ClientRequestSchema, K as CreateAuthIDPConfigRequestSchema, L as FunctionExecution_Status, M as CreateIdPServiceRequestSchema, Mt as PageDirection, N as UpdateIdPServiceRequestSchema, O as CreatePipelineServiceRequestSchema, Ot as Subgraph_ServiceType, P as IdPLang, Q as CreateTenantConfigRequestSchema, S as UpdateStaticWebsiteRequestSchema, St as TenantProviderConfig_TenantProviderType, T as CreateSecretManagerVaultRequestSchema, Tt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, U as ExecutorTriggerType, V as ExecutorJobStatus, W as CreateAuthConnectionRequestSchema, X as CreateAuthSCIMResourceRequestSchema, Y as CreateAuthSCIMConfigRequestSchema, Z as CreateAuthServiceRequestSchema, _ as TailorDBType_Permission_Operator, _t as AuthSCIMAttribute_Mutability, a as WorkspacePlatformUserRole, at as UpdateAuthSCIMConfigRequestSchema, b as AddCustomDomainRequestSchema, bt as AuthSCIMConfig_AuthorizationType, c as UpdateWorkflowRequestSchema, ct as UpdateTenantConfigRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as AuthConnection_Type, et as UpdateAuthConnectionRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as AuthHookPoint, g as TailorDBGQLPermission_Permit, gt as AuthOAuth2Client_GrantType, h as TailorDBGQLPermission_Operator, ht as AuthOAuth2Client_ClientType, it as UpdateAuthOAuth2ClientRequestSchema, j as PipelineResolver_OperationType, jt as FilterSchema, k as UpdatePipelineResolverRequestSchema, kt as ConditionSchema, l as WorkflowExecution_Status, lt as UpdateUserProfileConfigRequestSchema, m as TailorDBGQLPermission_Action, mt as AuthInvokerSchema, nt as UpdateAuthIDPConfigRequestSchema, o as CreateWorkflowJobFunctionRequestSchema, ot as UpdateAuthSCIMResourceRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as AuthIDPConfig_AuthType, q as CreateAuthMachineUserRequestSchema, rt as UpdateAuthMachineUserRequestSchema, s as CreateWorkflowRequestSchema, st as UpdateAuthServiceRequestSchema, t as OperatorService, tt as UpdateAuthHookRequestSchema, u as WorkflowJobExecution_Status, ut as AuthConnection_Status, v as TailorDBType_Permission_Permit, vt as AuthSCIMAttribute_Type, w as CreateSecretManagerSecretRequestSchema, wt as CreateApplicationRequestSchema, x as CreateStaticWebsiteRequestSchema, y as TailorDBType_PermitAction, yt as AuthSCIMAttribute_Uniqueness, z as CreateExecutorExecutorRequestSchema } from "./service_pb-CIrhGwHk.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
 import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-BEiZZ3qT.mjs";
-import { $ as initOperatorClient, A as loadAccessToken, G as fetchMachineUserToken, I as loadWorkspaceId, K as fetchPaged, L as platformConfigFromProfile, N as loadMachineUserName, P as loadPlatformClientConfig, R as readPlatformConfig, S as getDistDir, T as loadConfig, V as writePlatformConfig, W as fetchAll, X as getOAuth2ClientId, Y as getConsoleBaseUrl, Z as getPlatformBaseUrl, b as hasGenerationHooks, d as assertUniqueLocalTailorDBTypeNames, et as isDefaultPlatform, f as assertUniqueTailorDBTypeNamesWithExternal, h as platformBundleDefinePlugin, j as loadConfigPath, k as hasUserTokenEntry, l as buildExecutorArgsExpr, m as stringifyFunction, n as generatePluginFilesIfNeeded, nt as byName, p as TailorDBTypeSchema, r as loadApplication, s as HTTP_METHODS, t as defineApplication, tt as resolveStaticWebsiteUrls, u as buildResolverOperationHookExpr, w as hashFile, x as createBundleCache, y as getPluginGenerationDependencies } from "./application-Dxhdq_nu.mjs";
+import { $ as initOperatorClient, A as loadAccessToken, G as fetchMachineUserToken, I as loadWorkspaceId, K as fetchPaged, L as platformConfigFromProfile, N as loadMachineUserName, P as loadPlatformClientConfig, R as readPlatformConfig, S as getDistDir, T as loadConfig, V as writePlatformConfig, W as fetchAll, X as getOAuth2ClientId, Y as getConsoleBaseUrl, Z as getPlatformBaseUrl, b as hasGenerationHooks, d as assertUniqueLocalTailorDBTypeNames, et as isDefaultPlatform, f as assertUniqueTailorDBTypeNamesWithExternal, h as platformBundleDefinePlugin, j as loadConfigPath, k as hasUserTokenEntry, l as buildExecutorArgsExpr, m as stringifyFunction, n as generatePluginFilesIfNeeded, nt as byName, p as TailorDBTypeSchema, r as loadApplication, s as HTTP_METHODS, t as defineApplication, tt as resolveStaticWebsiteUrls, u as buildResolverOperationHookExpr, w as hashFile, x as createBundleCache, y as getPluginGenerationDependencies } from "./application-Bb9NNp5m.mjs";
 import { o as loadFilesWithIgnores, t as createExecutorService } from "./service-DiEtAsvc.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "./package-json-8b0O9TlX.mjs";
@@ -6365,6 +6365,7 @@ function formatDiffChange(change) {
 		case "type_added": return `  + [Type] ${change.typeName} (new type)`;
 		case "type_removed": return `  - [Type] ${change.typeName} (removed)`;
 		case "type_modified": return `  ~ [Type] ${change.typeName}: ${change.reason}`;
+		case "type_settings_modified": return `  ~ [Type Settings] ${change.typeName}: ${change.reason ?? "settings changed"}`;
 		case "field_added": {
 			const typeStr = formatFieldType(change.after);
 			return `  + ${change.fieldName}: ${typeStr}`;
@@ -6462,6 +6463,7 @@ const DIFF_CHANGE_LABELS = {
 	type_added: "type(s) added",
 	type_removed: "type(s) removed",
 	type_modified: "type(s) modified",
+	type_settings_modified: "type setting(s) modified",
 	field_added: "field(s) added",
 	field_removed: "field(s) removed",
 	field_modified: "field(s) modified",
@@ -6681,6 +6683,21 @@ const typeSettingsPatchSchema = z.looseObject({
 	indexes: snapshotRecordSchema(snapshotIndexConfigSchema).optional(),
 	files: snapshotRecordSchema(z.string()).optional()
 });
+const snapshotTypeSettingsStateSchema = z.looseObject({
+	description: z.string().optional(),
+	pluralForm: z.string(),
+	settings: z.looseObject({
+		aggregation: z.boolean().optional(),
+		bulkUpsert: z.boolean().optional(),
+		gqlOperations: z.looseObject({
+			create: z.boolean().optional(),
+			update: z.boolean().optional(),
+			delete: z.boolean().optional(),
+			read: z.boolean().optional()
+		}).optional(),
+		publishEvents: z.boolean().optional()
+	}).optional()
+});
 const snapshotPermissionStateSchema = z.looseObject({
 	recordPermission: snapshotRecordPermissionSchema.optional(),
 	gqlPermission: snapshotGqlPermissionSchema.optional()
@@ -6704,6 +6721,13 @@ const typeModifiedChangeSchema = z.looseObject({
 	before: typeSettingsPatchSchema.optional(),
 	after: typeSettingsPatchSchema.optional()
 });
+const typeSettingsModifiedChangeSchema = z.looseObject({
+	kind: z.literal("type_settings_modified"),
+	typeName: z.string(),
+	reason: z.string().optional(),
+	before: snapshotTypeSettingsStateSchema,
+	after: snapshotTypeSettingsStateSchema
+});
 const fieldAddedChangeSchema = z.looseObject({
 	kind: z.literal("field_added"),
 	typeName: z.string(),
@@ -6806,6 +6830,7 @@ const diffChangeSchema = z.discriminatedUnion("kind", [
 	typeAddedChangeSchema,
 	typeRemovedChangeSchema,
 	typeModifiedChangeSchema,
+	typeSettingsModifiedChangeSchema,
 	fieldAddedChangeSchema,
 	fieldRemovedChangeSchema,
 	fieldModifiedChangeSchema,
@@ -7269,6 +7294,16 @@ function applyDiffToSnapshot(snapshot, diff) {
 			}
 			break;
 		}
+		case "type_settings_modified": {
+			const existing = types[change.typeName];
+			if (existing) types[change.typeName] = {
+				...existing,
+				description: change.after.description,
+				pluralForm: change.after.pluralForm,
+				settings: change.after.settings ?? {}
+			};
+			break;
+		}
 		case "field_added":
 		case "field_modified": {
 			const existing = types[change.typeName];
@@ -7645,10 +7680,10 @@ function compareIndexes(ctx, typeName, oldIndexes, newIndexes) {
 		const oldIndex = assertDefined(assertDefined(oldIndexes, "oldIndexes is undefined when oldKeys has entry")[indexName], `index "${indexName}" missing from oldIndexes`);
 		const oldFieldsStr = JSON.stringify(oldIndex.fields.toSorted());
 		const newFieldsStr = JSON.stringify(newIndex.fields.toSorted());
-		if (oldFieldsStr !== newFieldsStr || oldIndex.unique !== newIndex.unique) {
+		if (oldFieldsStr !== newFieldsStr || (oldIndex.unique ?? false) !== (newIndex.unique ?? false)) {
 			const reasons = [];
 			if (oldFieldsStr !== newFieldsStr) reasons.push("fields changed");
-			if (oldIndex.unique !== newIndex.unique) reasons.push("unique constraint changed");
+			if ((oldIndex.unique ?? false) !== (newIndex.unique ?? false)) reasons.push("unique constraint changed");
 			ctx.changes.push({
 				kind: "index_modified",
 				typeName,
@@ -7728,6 +7763,7 @@ function compareRelationships(ctx, typeName, relationshipType, oldRelationships,
 		if (oldRel.targetField !== newRel.targetField) reasons.push("targetField changed");
 		if (oldRel.sourceField !== newRel.sourceField) reasons.push("sourceField changed");
 		if (oldRel.isArray !== newRel.isArray) reasons.push("isArray changed");
+		if (oldRel.description !== newRel.description) reasons.push("description changed");
 		if (reasons.length > 0) ctx.changes.push({
 			kind: "relationship_modified",
 			typeName,
@@ -7750,8 +7786,12 @@ function compareRelationships(ctx, typeName, relationshipType, oldRelationships,
 * @returns {void}
 */
 function comparePermissions(ctx, typeName, oldRecordPerm, newRecordPerm, oldGqlPerm, newGqlPerm) {
-	const recordPermChanged = JSON.stringify(oldRecordPerm ?? null) !== JSON.stringify(newRecordPerm ?? null);
-	const gqlPermChanged = JSON.stringify(oldGqlPerm ?? null) !== JSON.stringify(newGqlPerm ?? null);
+	const oldComparableRecordPerm = comparableRecordPermission(oldRecordPerm);
+	const newComparableRecordPerm = comparableRecordPermission(newRecordPerm);
+	const recordPermChanged = JSON.stringify(oldComparableRecordPerm ?? null) !== JSON.stringify(newComparableRecordPerm ?? null);
+	const oldComparableGqlPerm = comparableGqlPermission(oldGqlPerm);
+	const newComparableGqlPerm = comparableGqlPermission(newGqlPerm);
+	const gqlPermChanged = JSON.stringify(oldComparableGqlPerm ?? null) !== JSON.stringify(newComparableGqlPerm ?? null);
 	if (recordPermChanged || gqlPermChanged) {
 		const reasons = [];
 		if (recordPermChanged) reasons.push("record permission");
@@ -7761,16 +7801,95 @@ function comparePermissions(ctx, typeName, oldRecordPerm, newRecordPerm, oldGqlP
 			typeName,
 			reason: `${reasons.join(" and ")} changed`,
 			before: {
-				recordPermission: oldRecordPerm,
-				gqlPermission: oldGqlPerm
+				recordPermission: oldComparableRecordPerm,
+				gqlPermission: oldComparableGqlPerm
 			},
 			after: {
-				recordPermission: newRecordPerm,
-				gqlPermission: newGqlPerm
+				recordPermission: newComparableRecordPerm,
+				gqlPermission: newComparableGqlPerm
 			}
 		});
 	}
 }
+const GQL_ACTION_ORDER = {
+	all: 0,
+	create: 1,
+	read: 2,
+	update: 3,
+	delete: 4,
+	aggregate: 5,
+	bulkUpsert: 6
+};
+function sortByJson(items) {
+	return items.map((item) => [JSON.stringify(item), item]).toSorted(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([, item]) => item);
+}
+function comparableGqlPermission(permission) {
+	const policies = permission?.map((policy) => ({
+		...policy,
+		conditions: sortByJson(policy.conditions),
+		actions: policy.actions.toSorted((left, right) => GQL_ACTION_ORDER[left] - GQL_ACTION_ORDER[right])
+	}));
+	return policies && policies.length > 0 ? sortByJson(policies) : void 0;
+}
+function comparableRecordPermission(permission) {
+	if (!permission) return void 0;
+	if (!Object.values(permission).some((policies) => policies.length > 0)) return void 0;
+	return {
+		create: sortByJson(permission.create.map(canonicalActionPermission)),
+		read: sortByJson(permission.read.map(canonicalActionPermission)),
+		update: sortByJson(permission.update.map(canonicalActionPermission)),
+		delete: sortByJson(permission.delete.map(canonicalActionPermission))
+	};
+}
+function canonicalActionPermission(policy) {
+	return {
+		...policy,
+		conditions: sortByJson(policy.conditions)
+	};
+}
+function normalizeComparableGqlOperations(operations) {
+	if (!operations) return void 0;
+	return {
+		create: operations.create ?? true,
+		update: operations.update ?? true,
+		delete: operations.delete ?? true,
+		read: operations.read ?? true
+	};
+}
+function normalizeComparableSettings(settings) {
+	const normalized = {};
+	if (settings?.aggregation === true) normalized.aggregation = true;
+	if (settings?.bulkUpsert === true) normalized.bulkUpsert = true;
+	if (settings?.publishEvents === true) normalized.publishEvents = true;
+	const gqlOperations = normalizeComparableGqlOperations(settings?.gqlOperations);
+	if (gqlOperations) normalized.gqlOperations = gqlOperations;
+	return Object.keys(normalized).length > 0 ? normalized : void 0;
+}
+function typeSettingsState(description, pluralForm, settings) {
+	return {
+		...description ? { description } : {},
+		pluralForm,
+		...settings && { settings }
+	};
+}
+function comparableTypeSettings(type) {
+	return typeSettingsState(type.description, inflection.camelize(type.pluralForm, true), normalizeComparableSettings(type.settings));
+}
+function snapshotTypeSettingsState(type) {
+	return typeSettingsState(type.description, type.pluralForm, type.settings ?? {});
+}
+function compareTypeSettings(ctx, typeName, previous, current) {
+	const previousComparable = comparableTypeSettings(previous);
+	const currentComparable = comparableTypeSettings(current);
+	if (JSON.stringify(previousComparable) === JSON.stringify(currentComparable)) return;
+	ctx.changes.push({
+		kind: "type_settings_modified",
+		typeName,
+		reason: "settings changed",
+		before: snapshotTypeSettingsState(previous),
+		after: snapshotTypeSettingsState(current)
+	});
+}
 /**
 * Compare two snapshots and generate a diff
 * @param {SchemaSnapshot} previous - Previous schema snapshot
@@ -7808,6 +7927,7 @@ function compareNormalizedSnapshots(previous, current) {
 		if (!previousTypeNames.has(typeName)) continue;
 		const prevType = assertDefined(previous.types[typeName], `type "${typeName}" missing from previous snapshot`);
 		const currType = assertDefined(current.types[typeName], `type "${typeName}" missing from current snapshot`);
+		compareTypeSettings(ctx, typeName, prevType, currType);
 		compareTypeFields(ctx, typeName, prevType, currType);
 		compareIndexes(ctx, typeName, prevType.indexes, currType.indexes);
 		compareFiles(ctx, typeName, prevType.files, currType.files);
@@ -7909,6 +8029,49 @@ function assertValidMigrationFiles(migrationsDir, namespace) {
 		throw new Error(`Migration file validation failed for namespace "${namespace}":\n${errorMessages}`);
 	}
 }
+function convertRemoteFieldToSnapshot(remoteField) {
+	const config = {
+		type: remoteField.type,
+		required: remoteField.required
+	};
+	if (remoteField.array) config.array = true;
+	if (remoteField.index) config.index = true;
+	if (remoteField.unique) config.unique = true;
+	if (remoteField.foreignKey) {
+		config.foreignKey = true;
+		if (remoteField.foreignKeyType) config.foreignKeyType = remoteField.foreignKeyType;
+		if (remoteField.foreignKeyField) config.foreignKeyField = remoteField.foreignKeyField;
+	}
+	const allowedValues = remoteField.allowedValues;
+	if (allowedValues.length > 0) config.allowedValues = allowedValues.map((v) => ({
+		value: v.value,
+		...v.description && { description: v.description }
+	}));
+	if (remoteField.description) config.description = remoteField.description;
+	if (remoteField.vector) config.vector = true;
+	if (remoteField.hooks) {
+		config.hooks = {};
+		if (remoteField.hooks.create?.expr) config.hooks.create = { expr: remoteField.hooks.create.expr };
+		if (remoteField.hooks.update?.expr) config.hooks.update = { expr: remoteField.hooks.update.expr };
+	}
+	const validate = remoteField.validate;
+	if (validate.length > 0) config.validate = validate.map((v) => ({
+		script: { expr: convertRemoteValidateExpression(v.script?.expr ?? "", v.action) },
+		errorMessage: v.errorMessage ?? ""
+	}));
+	if (remoteField.serial) config.serial = {
+		start: Number(remoteField.serial.start),
+		...remoteField.serial.maxValue && { maxValue: Number(remoteField.serial.maxValue) },
+		...remoteField.serial.format && { format: remoteField.serial.format }
+	};
+	if (remoteField.scale !== void 0) config.scale = remoteField.scale;
+	const nestedFields = remoteField.fields;
+	if (Object.keys(nestedFields).length > 0) {
+		config.fields = createSnapshotRecord();
+		for (const [fieldName, nestedField] of Object.entries(nestedFields)) config.fields[fieldName] = convertRemoteFieldToSnapshot(nestedField);
+	}
+	return config;
+}
 /**
 * Convert remote ParsedTailorDBType to SnapshotFieldConfig for comparison
 * @param {ProtoTailorDBType} remoteType - Remote TailorDB type from API
@@ -7917,62 +8080,204 @@ function assertValidMigrationFiles(migrationsDir, namespace) {
 function convertRemoteFieldsToSnapshot(remoteType) {
 	const fields = createSnapshotRecord();
 	const remoteFields = remoteType.schema?.fields ?? {};
-	for (const [fieldName, remoteField] of Object.entries(remoteFields)) {
-		const config = {
-			type: remoteField.type,
-			required: remoteField.required
-		};
-		if (remoteField.array) config.array = true;
-		if (remoteField.index) config.index = true;
-		if (remoteField.unique) config.unique = true;
-		if (remoteField.foreignKey) {
-			config.foreignKey = true;
-			if (remoteField.foreignKeyType) config.foreignKeyType = remoteField.foreignKeyType;
-			if (remoteField.foreignKeyField) config.foreignKeyField = remoteField.foreignKeyField;
-		}
-		if (remoteField.allowedValues.length > 0) config.allowedValues = remoteField.allowedValues.map((v) => ({
-			value: v.value,
-			...v.description && { description: v.description }
-		}));
-		if (remoteField.description) config.description = remoteField.description;
-		if (remoteField.vector) config.vector = true;
-		if (remoteField.hooks) {
-			config.hooks = {};
-			if (remoteField.hooks.create?.expr) config.hooks.create = { expr: remoteField.hooks.create.expr };
-			if (remoteField.hooks.update?.expr) config.hooks.update = { expr: remoteField.hooks.update.expr };
-		}
-		if (remoteField.validate.length > 0) config.validate = remoteField.validate.map((v) => ({
-			script: { expr: v.script?.expr ?? "" },
-			errorMessage: v.errorMessage ?? ""
-		}));
-		if (remoteField.serial) config.serial = {
-			start: Number(remoteField.serial.start),
-			...remoteField.serial.maxValue && { maxValue: Number(remoteField.serial.maxValue) },
-			...remoteField.serial.format && { format: remoteField.serial.format }
+	for (const [fieldName, remoteField] of Object.entries(remoteFields)) fields[fieldName] = convertRemoteFieldToSnapshot(remoteField);
+	return fields;
+}
+function convertRemoteValidateExpression(expr, action) {
+	return action === TailorDBType_PermitAction.DENY && expr.startsWith("!") ? expr.slice(1) : expr;
+}
+function convertRemoteSettingsToSnapshot(remoteSettings, expectedSettings) {
+	const settings = {};
+	if (remoteSettings?.aggregation) settings.aggregation = true;
+	if (remoteSettings?.bulkUpsert) settings.bulkUpsert = true;
+	if (remoteSettings?.publishRecordEvents) settings.publishEvents = true;
+	const disabled = remoteSettings?.disableGqlOperations;
+	if (disabled) {
+		const hasDisabledOperation = disabled.create || disabled.update || disabled.delete || disabled.read;
+		if (expectedSettings?.gqlOperations !== void 0 || hasDisabledOperation) settings.gqlOperations = {
+			create: !disabled.create,
+			update: !disabled.update,
+			delete: !disabled.delete,
+			read: !disabled.read
 		};
-		if (remoteField.scale !== void 0) config.scale = remoteField.scale;
-		fields[fieldName] = config;
 	}
-	return fields;
+	return Object.keys(settings).length > 0 ? settings : void 0;
+}
+function convertRemoteIndexesToSnapshot(remoteIndexes) {
+	const indexes = createSnapshotRecord();
+	for (const [indexName, indexConfig] of Object.entries(remoteIndexes ?? {})) indexes[indexName] = {
+		fields: indexConfig.fieldNames,
+		...indexConfig.unique && { unique: true }
+	};
+	return Object.keys(indexes).length > 0 ? indexes : void 0;
+}
+function convertRemoteFilesToSnapshot(remoteFiles) {
+	const files = createSnapshotRecord();
+	for (const [fileName, fileConfig] of Object.entries(remoteFiles ?? {})) files[fileName] = fileConfig.description || "";
+	return Object.keys(files).length > 0 ? files : void 0;
+}
+function convertRemoteRelationshipToSnapshot(relationship, direction) {
+	return direction === "forward" ? {
+		targetType: relationship.refType,
+		targetField: relationship.srcField,
+		sourceField: relationship.refField,
+		isArray: relationship.array,
+		description: relationship.description || ""
+	} : {
+		targetType: relationship.refType,
+		targetField: relationship.refField,
+		sourceField: relationship.srcField,
+		isArray: relationship.array,
+		description: relationship.description || ""
+	};
+}
+function remoteRelationshipMatchesExpectedDirection(relationship, expected, direction) {
+	const converted = convertRemoteRelationshipToSnapshot(relationship, direction);
+	return converted.targetType === expected.targetType && converted.targetField === expected.targetField && converted.sourceField === expected.sourceField && converted.isArray === expected.isArray;
+}
+function inferRemoteRelationshipDirection(relationshipName, relationship, expectedType) {
+	const expectedForward = expectedType?.forwardRelationships?.[relationshipName];
+	const expectedBackward = expectedType?.backwardRelationships?.[relationshipName];
+	if (expectedForward && !expectedBackward) return "forward";
+	if (expectedBackward && !expectedForward) return "backward";
+	if (expectedForward && remoteRelationshipMatchesExpectedDirection(relationship, expectedForward, "forward")) return "forward";
+	if (expectedBackward && remoteRelationshipMatchesExpectedDirection(relationship, expectedBackward, "backward")) return "backward";
+	return relationship.array ? "backward" : "forward";
+}
+function convertRemoteRelationshipsToSnapshot(remoteRelationships, expectedType) {
+	const forwardRelationships = createSnapshotRecord();
+	const backwardRelationships = createSnapshotRecord();
+	for (const [relationshipName, relationship] of Object.entries(remoteRelationships ?? {})) {
+		const direction = inferRemoteRelationshipDirection(relationshipName, relationship, expectedType);
+		if (direction === "forward") forwardRelationships[relationshipName] = convertRemoteRelationshipToSnapshot(relationship, direction);
+		else backwardRelationships[relationshipName] = convertRemoteRelationshipToSnapshot(relationship, direction);
+	}
+	return {
+		...Object.keys(forwardRelationships).length > 0 && { forwardRelationships },
+		...Object.keys(backwardRelationships).length > 0 && { backwardRelationships }
+	};
 }
-function convertRemoteTypeToSnapshot(remoteType) {
+const REMOTE_PERMISSION_PERMITS = /* @__PURE__ */ new Map([[TailorDBType_Permission_Permit.ALLOW, "allow"], [TailorDBType_Permission_Permit.DENY, "deny"]]);
+const REMOTE_PERMISSION_OPERATORS = /* @__PURE__ */ new Map([
+	[TailorDBType_Permission_Operator.EQ, "eq"],
+	[TailorDBType_Permission_Operator.NE, "ne"],
+	[TailorDBType_Permission_Operator.IN, "in"],
+	[TailorDBType_Permission_Operator.NIN, "nin"],
+	[TailorDBType_Permission_Operator.HAS_ANY, "hasAny"],
+	[TailorDBType_Permission_Operator.NHAS_ANY, "nhasAny"]
+]);
+function convertRemotePermit(permit, source) {
+	const converted = REMOTE_PERMISSION_PERMITS.get(permit);
+	if (converted) return converted;
+	throw new Error(`Unsupported ${source} permission permit: ${permit}`);
+}
+function convertRemoteOperator(operator, source) {
+	const converted = REMOTE_PERMISSION_OPERATORS.get(operator);
+	if (converted) return converted;
+	throw new Error(`Unsupported ${source} permission operator: ${operator}`);
+}
+function convertRemoteValueOperand(operand) {
+	switch (operand?.kind.case) {
+		case "userField": return { user: operand.kind.value };
+		case "recordField": return { record: operand.kind.value };
+		case "oldRecordField": return { oldRecord: operand.kind.value };
+		case "newRecordField": return { newRecord: operand.kind.value };
+		case "value": return toJson(ValueSchema, operand.kind.value);
+		default: throw new Error("Unsupported permission operand");
+	}
+}
+function convertRemoteRecordCondition(condition) {
+	return [
+		convertRemoteValueOperand(condition.left),
+		convertRemoteOperator(condition.operator, "record"),
+		convertRemoteValueOperand(condition.right)
+	];
+}
+function convertRemoteGqlCondition(condition) {
+	return [
+		convertRemoteValueOperand(condition.left),
+		convertRemoteOperator(condition.operator, "GQL"),
+		convertRemoteValueOperand(condition.right)
+	];
+}
+function convertRemoteRecordPolicy(policy) {
+	return {
+		conditions: policy.conditions.map(convertRemoteRecordCondition),
+		permit: convertRemotePermit(policy.permit, "record"),
+		...policy.description && { description: policy.description }
+	};
+}
+function convertRemoteRecordPermissionToSnapshot(permission) {
+	const recordPermission = {
+		create: permission?.create.map(convertRemoteRecordPolicy) ?? [],
+		read: permission?.read.map(convertRemoteRecordPolicy) ?? [],
+		update: permission?.update.map(convertRemoteRecordPolicy) ?? [],
+		delete: permission?.delete.map(convertRemoteRecordPolicy) ?? []
+	};
+	return Object.values(recordPermission).some((policies) => policies.length > 0) ? recordPermission : void 0;
+}
+function convertRemoteGqlAction(action) {
+	switch (action) {
+		case TailorDBGQLPermission_Action.ALL: return "all";
+		case TailorDBGQLPermission_Action.CREATE: return "create";
+		case TailorDBGQLPermission_Action.READ: return "read";
+		case TailorDBGQLPermission_Action.UPDATE: return "update";
+		case TailorDBGQLPermission_Action.DELETE: return "delete";
+		case TailorDBGQLPermission_Action.AGGREGATE: return "aggregate";
+		case TailorDBGQLPermission_Action.BULK_UPSERT: return "bulkUpsert";
+		default: throw new Error(`Unsupported GQL permission action: ${action}`);
+	}
+}
+function convertRemoteGqlPermissionToSnapshot(permission) {
+	const policies = permission?.policies.map((policy) => ({
+		conditions: policy.conditions.map(convertRemoteGqlCondition),
+		actions: policy.actions.map(convertRemoteGqlAction),
+		permit: convertRemotePermit(policy.permit, "GQL"),
+		...policy.description && { description: policy.description }
+	})) ?? [];
+	return policies.length > 0 ? policies : void 0;
+}
+function convertRemoteTypeToSnapshot(remoteType, expectedType) {
+	const settings = convertRemoteSettingsToSnapshot(remoteType.schema?.settings, expectedType?.settings);
+	const relationships = convertRemoteRelationshipsToSnapshot(remoteType.schema?.relationships, expectedType);
+	const recordPermission = convertRemoteRecordPermissionToSnapshot(remoteType.schema?.permission);
 	const snapshotType = {
 		name: remoteType.name,
 		pluralForm: remoteType.schema?.settings?.pluralForm || inflection.pluralize(remoteType.name),
-		fields: convertRemoteFieldsToSnapshot(remoteType)
+		fields: convertRemoteFieldsToSnapshot(remoteType),
+		...settings && { settings },
+		...relationships
 	};
 	if (remoteType.schema?.description) snapshotType.description = remoteType.schema.description;
+	const indexes = convertRemoteIndexesToSnapshot(remoteType.schema?.indexes);
+	if (indexes) snapshotType.indexes = indexes;
+	const files = convertRemoteFilesToSnapshot(remoteType.schema?.files);
+	if (files) snapshotType.files = files;
+	if (recordPermission) snapshotType.permissions = { record: recordPermission };
 	return snapshotType;
 }
 /**
 * Convert remote TailorDB types into the normalized snapshot shape used by drift checks.
 * @param {ProtoTailorDBType[]} remoteTypes - Remote TailorDB types from the API
 * @param {string} namespace - Namespace for the reconstructed snapshot
+* @param {readonly RemoteGqlPermission[]} remoteGqlPermissions - Remote GQL permissions for the namespace
+* @param {SchemaSnapshot} expectedSnapshot - Optional snapshot used to disambiguate remote relationship direction
 * @returns {NormalizedSchemaSnapshot} Normalized snapshot-shaped remote state
 */
-function createSnapshotFromRemoteTypes(remoteTypes, namespace) {
+function createSnapshotFromRemoteTypes(remoteTypes, namespace, remoteGqlPermissions = [], expectedSnapshot) {
 	const types = createSnapshotRecord();
-	for (const remoteType of remoteTypes) types[remoteType.name] = convertRemoteTypeToSnapshot(remoteType);
+	for (const remoteType of remoteTypes) types[remoteType.name] = convertRemoteTypeToSnapshot(remoteType, expectedSnapshot?.types[remoteType.name]);
+	for (const permission of remoteGqlPermissions) {
+		const { typeName } = permission;
+		const snapshotType = types[typeName];
+		if (!snapshotType) continue;
+		const gqlPermission = convertRemoteGqlPermissionToSnapshot(permission.permission);
+		if (!gqlPermission) continue;
+		snapshotType.permissions = {
+			...snapshotType.permissions,
+			gql: gqlPermission
+		};
+	}
 	return normalizeSchemaSnapshot({
 		version: 1,
 		namespace,
@@ -7980,6 +8285,107 @@ function createSnapshotFromRemoteTypes(remoteTypes, namespace) {
 		types
 	});
 }
+function fieldDifferenceValue(value) {
+	if (value === void 0 || value === "") return "none";
+	return String(value);
+}
+function fieldDifferenceKey(prefix, key) {
+	return prefix ? `${prefix}.${key}` : key;
+}
+function addFieldDifference(differences, prefix, key, remoteValue, snapshotValue) {
+	if (remoteValue === snapshotValue) return;
+	differences.push(`${fieldDifferenceKey(prefix, key)}: remote=${fieldDifferenceValue(remoteValue)}, expected=${fieldDifferenceValue(snapshotValue)}`);
+}
+function addBooleanFieldDifference(differences, prefix, key, remoteField, snapshotField) {
+	addFieldDifference(differences, prefix, key, remoteField[key] ?? false, snapshotField[key] ?? false);
+}
+function addAllowedValuesDifferences(differences, prefix, remoteField, snapshotField) {
+	const remoteAllowed = remoteField.allowedValues ?? [];
+	const snapshotAllowed = snapshotField.allowedValues ?? [];
+	if (remoteAllowed.length !== snapshotAllowed.length) {
+		differences.push(`${fieldDifferenceKey(prefix, "allowedValues")} count: remote=${remoteAllowed.length}, expected=${snapshotAllowed.length}`);
+		return;
+	}
+	const snapshotAllowedValues = new Map(snapshotAllowed.map((v) => [v.value, v.description]));
+	for (const value of remoteAllowed) {
+		if (!snapshotAllowedValues.has(value.value)) {
+			differences.push(`${fieldDifferenceKey(prefix, "allowedValues")}: remote has '${value.value}' not in snapshot`);
+			return;
+		}
+		const snapshotDescription = snapshotAllowedValues.get(value.value);
+		if ((value.description ?? "") !== (snapshotDescription ?? "")) {
+			addFieldDifference(differences, prefix, `allowedValues.${value.value}.description`, value.description ?? "", snapshotDescription ?? "");
+			return;
+		}
+	}
+	const remoteAllowedValues = new Set(remoteAllowed.map((v) => v.value));
+	for (const value of snapshotAllowed) if (!remoteAllowedValues.has(value.value)) {
+		differences.push(`${fieldDifferenceKey(prefix, "allowedValues")}: snapshot has '${value.value}' not in remote`);
+		return;
+	}
+}
+function addHooksDifferences(differences, prefix, remoteField, snapshotField) {
+	addFieldDifference(differences, prefix, "hooks.create", remoteField.hooks?.create?.expr ?? "", snapshotField.hooks?.create?.expr ?? "");
+	addFieldDifference(differences, prefix, "hooks.update", remoteField.hooks?.update?.expr ?? "", snapshotField.hooks?.update?.expr ?? "");
+}
+function addValidationDifferences(differences, prefix, remoteField, snapshotField) {
+	const remoteValidate = remoteField.validate ?? [];
+	const snapshotValidate = snapshotField.validate ?? [];
+	if (remoteValidate.length !== snapshotValidate.length) differences.push(`${fieldDifferenceKey(prefix, "validate")} count: remote=${remoteValidate.length}, expected=${snapshotValidate.length}`);
+	const commonLength = Math.min(remoteValidate.length, snapshotValidate.length);
+	for (let index = 0; index < commonLength; index++) {
+		const remoteValidation = assertDefined(remoteValidate[index], `remoteValidate missing index ${index}`);
+		const snapshotValidation = assertDefined(snapshotValidate[index], `snapshotValidate missing index ${index}`);
+		addFieldDifference(differences, prefix, `validate[${index}].script`, remoteValidation.script?.expr ?? "", snapshotValidation.script?.expr ?? "");
+		addFieldDifference(differences, prefix, `validate[${index}].errorMessage`, remoteValidation.errorMessage, snapshotValidation.errorMessage);
+	}
+}
+function addSerialDifferences(differences, prefix, remoteField, snapshotField) {
+	addFieldDifference(differences, prefix, "serial.start", remoteField.serial?.start, snapshotField.serial?.start);
+	addFieldDifference(differences, prefix, "serial.maxValue", remoteField.serial?.maxValue, snapshotField.serial?.maxValue);
+	addFieldDifference(differences, prefix, "serial.format", remoteField.serial?.format ?? "", snapshotField.serial?.format ?? "");
+}
+function addNestedFieldDifferences(differences, prefix, remoteField, snapshotField) {
+	const remoteFields = remoteField.fields ?? {};
+	const snapshotFields = snapshotField.fields ?? {};
+	const remoteFieldNames = Object.keys(remoteFields);
+	const snapshotFieldNames = Object.keys(snapshotFields);
+	if (remoteFieldNames.length !== snapshotFieldNames.length) differences.push(`${fieldDifferenceKey(prefix, "fields")} count: remote=${remoteFieldNames.length}, expected=${snapshotFieldNames.length}`);
+	for (const fieldName of remoteFieldNames) {
+		const remoteNestedField = remoteFields[fieldName];
+		const snapshotNestedField = snapshotFields[fieldName];
+		const nestedPrefix = fieldDifferenceKey(prefix, `fields.${fieldName}`);
+		if (!snapshotNestedField) {
+			differences.push(`${nestedPrefix}: exists in remote but not snapshot`);
+			continue;
+		}
+		addFieldDifferences(differences, nestedPrefix, assertDefined(remoteNestedField, `remote field "${fieldName}" missing`), snapshotNestedField);
+	}
+	for (const fieldName of snapshotFieldNames) {
+		if (remoteFields[fieldName]) continue;
+		differences.push(`${fieldDifferenceKey(prefix, `fields.${fieldName}`)}: exists in snapshot but not remote`);
+	}
+}
+function addFieldDifferences(differences, prefix, remoteField, snapshotField) {
+	addFieldDifference(differences, prefix, "type", remoteField.type, snapshotField.type);
+	addFieldDifference(differences, prefix, "required", remoteField.required, snapshotField.required);
+	for (const key of [
+		"array",
+		"index",
+		"unique",
+		"foreignKey",
+		"vector"
+	]) addBooleanFieldDifference(differences, prefix, key, remoteField, snapshotField);
+	addFieldDifference(differences, prefix, "foreignKeyType", remoteField.foreignKeyType, snapshotField.foreignKeyType);
+	addFieldDifference(differences, prefix, "foreignKeyField", remoteField.foreignKeyField, snapshotField.foreignKeyField);
+	addFieldDifference(differences, prefix, "description", remoteField.description ?? "", snapshotField.description ?? "");
+	addAllowedValuesDifferences(differences, prefix, remoteField, snapshotField);
+	addHooksDifferences(differences, prefix, remoteField, snapshotField);
+	addValidationDifferences(differences, prefix, remoteField, snapshotField);
+	addSerialDifferences(differences, prefix, remoteField, snapshotField);
+	addFieldDifference(differences, prefix, "scale", remoteField.scale, snapshotField.scale);
+	addNestedFieldDifferences(differences, prefix, remoteField, snapshotField);
+}
 /**
 * Compare a single field between remote and snapshot
 * @param {string} typeName - Name of the type
@@ -7990,37 +8396,7 @@ function createSnapshotFromRemoteTypes(remoteTypes, namespace) {
 */
 function compareFields(typeName, fieldName, remoteField, snapshotField) {
 	const differences = [];
-	if (remoteField.type !== snapshotField.type) differences.push(`type: remote=${remoteField.type}, expected=${snapshotField.type}`);
-	if (remoteField.required !== snapshotField.required) differences.push(`required: remote=${remoteField.required}, expected=${snapshotField.required}`);
-	const remoteArray = remoteField.array ?? false;
-	const snapshotArray = snapshotField.array ?? false;
-	if (remoteArray !== snapshotArray) differences.push(`array: remote=${remoteArray}, expected=${snapshotArray}`);
-	const remoteUnique = remoteField.unique ?? false;
-	const snapshotUnique = snapshotField.unique ?? false;
-	if (remoteUnique !== snapshotUnique) differences.push(`unique: remote=${remoteUnique}, expected=${snapshotUnique}`);
-	const remoteFk = remoteField.foreignKey ?? false;
-	const snapshotFk = snapshotField.foreignKey ?? false;
-	if (remoteFk !== snapshotFk) differences.push(`foreignKey: remote=${remoteFk}, expected=${snapshotFk}`);
-	if (remoteField.foreignKeyType !== snapshotField.foreignKeyType) differences.push(`foreignKeyType: remote=${remoteField.foreignKeyType ?? "none"}, expected=${snapshotField.foreignKeyType ?? "none"}`);
-	const remoteAllowed = remoteField.allowedValues ?? [];
-	const snapshotAllowed = snapshotField.allowedValues ?? [];
-	const remoteAllowedValues = new Set(remoteAllowed.map((v) => v.value));
-	const snapshotAllowedValues = new Set(snapshotAllowed.map((v) => v.value));
-	if (remoteAllowedValues.size !== snapshotAllowedValues.size) differences.push(`allowedValues count: remote=${remoteAllowedValues.size}, expected=${snapshotAllowedValues.size}`);
-	else {
-		for (const v of remoteAllowedValues) if (!snapshotAllowedValues.has(v)) {
-			differences.push(`allowedValues: remote has '${v}' not in snapshot`);
-			break;
-		}
-		for (const v of snapshotAllowedValues) if (!remoteAllowedValues.has(v)) {
-			differences.push(`allowedValues: snapshot has '${v}' not in remote`);
-			break;
-		}
-	}
-	const remoteVector = remoteField.vector ?? false;
-	const snapshotVector = snapshotField.vector ?? false;
-	if (remoteVector !== snapshotVector) differences.push(`vector: remote=${remoteVector}, expected=${snapshotVector}`);
-	if (remoteField.scale !== snapshotField.scale) differences.push(`scale: remote=${remoteField.scale}, expected=${snapshotField.scale}`);
+	addFieldDifferences(differences, "", remoteField, snapshotField);
 	if (differences.length > 0) return {
 		typeName,
 		kind: "field_mismatch",
@@ -8037,53 +8413,136 @@ const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["id"]);
 * Compare remote TailorDB types with a local snapshot
 * @param {ProtoTailorDBType[]} remoteTypes - Remote types from listParsedTailorDBTypes API
 * @param {SchemaSnapshot} snapshot - Local schema snapshot
+* @param {readonly RemoteGqlPermission[]} remoteGqlPermissions - Remote GQL permissions for the namespace
 * @returns {SchemaDrift[]} List of drifts detected
 */
-function compareRemoteWithSnapshot(remoteTypes, snapshot) {
-	return compareNormalizedRemoteWithSnapshot(createSnapshotFromRemoteTypes(remoteTypes, snapshot.namespace), normalizeSchemaSnapshot(snapshot));
+function compareRemoteWithSnapshot(remoteTypes, snapshot, remoteGqlPermissions = []) {
+	return compareNormalizedRemoteWithSnapshot(createRemoteComparableSnapshot(createSnapshotFromRemoteTypes(remoteTypes, snapshot.namespace, remoteGqlPermissions, snapshot)), createRemoteComparableSnapshot(snapshot));
 }
-function compareNormalizedRemoteWithSnapshot(remoteSnapshot, snapshot) {
-	const drifts = [];
-	const remoteTypeMap = new Map(Object.entries(remoteSnapshot.types));
-	const snapshotTypeNames = new Set(Object.keys(snapshot.types));
-	const remoteTypeNames = new Set(Object.keys(remoteSnapshot.types));
-	for (const typeName of snapshotTypeNames) if (!remoteTypeNames.has(typeName)) drifts.push({
-		typeName,
-		kind: "type_missing_remote",
-		details: `Type '${typeName}' exists in snapshot but not in remote`
-	});
-	for (const typeName of remoteTypeNames) if (!snapshotTypeNames.has(typeName)) drifts.push({
-		typeName,
-		kind: "type_missing_local",
-		details: `Type '${typeName}' exists in remote but not in snapshot`
+function createRemoteComparableSnapshot(snapshot) {
+	const types = createSnapshotRecord();
+	for (const [typeName, type] of Object.entries(snapshot.types)) {
+		const fields = createSnapshotRecord();
+		for (const [fieldName, field] of Object.entries(type.fields)) {
+			if (SYSTEM_FIELDS.has(fieldName)) continue;
+			fields[fieldName] = field;
+		}
+		types[typeName] = {
+			...type,
+			fields
+		};
+	}
+	return normalizeSchemaSnapshot({
+		...snapshot,
+		types
 	});
-	for (const typeName of snapshotTypeNames) {
-		if (!remoteTypeNames.has(typeName)) continue;
-		const remoteType = assertDefined(remoteTypeMap.get(typeName), `type "${typeName}" missing from remoteTypeMap`);
-		const snapshotType = assertDefined(snapshot.types[typeName], `type "${typeName}" missing from snapshot`);
-		const remoteFields = remoteType.fields;
-		const snapshotFields = snapshotType.fields;
-		const remoteFieldNames = new Set(Object.keys(remoteFields).filter((f) => !SYSTEM_FIELDS.has(f)));
-		const snapshotFieldNames = new Set(Object.keys(snapshotFields).filter((f) => !SYSTEM_FIELDS.has(f)));
-		for (const fieldName of snapshotFieldNames) if (!remoteFieldNames.has(fieldName)) drifts.push({
-			typeName,
+}
+function fieldDriftFromChange(change) {
+	return compareFields(change.typeName, change.fieldName, change.before, change.after) ?? {
+		typeName: change.typeName,
+		kind: "field_mismatch",
+		fieldName: change.fieldName,
+		details: `Field '${change.fieldName}' differs between remote and snapshot`
+	};
+}
+function schemaDriftFromDiffChange(change) {
+	switch (change.kind) {
+		case "type_added": return {
+			typeName: change.typeName,
+			kind: "type_missing_remote",
+			details: `Type '${change.typeName}' exists in snapshot but not in remote`
+		};
+		case "type_removed": return {
+			typeName: change.typeName,
+			kind: "type_missing_local",
+			details: `Type '${change.typeName}' exists in remote but not in snapshot`
+		};
+		case "type_settings_modified":
+		case "type_modified": return {
+			typeName: change.typeName,
+			kind: "type_settings_mismatch",
+			details: change.reason ?? "Type settings differ between remote and snapshot"
+		};
+		case "field_added": return {
+			typeName: change.typeName,
 			kind: "field_missing_remote",
-			fieldName,
-			details: `Field '${fieldName}' exists in snapshot but not in remote`
-		});
-		for (const fieldName of remoteFieldNames) if (!snapshotFieldNames.has(fieldName)) drifts.push({
-			typeName,
+			fieldName: change.fieldName,
+			details: `Field '${change.fieldName}' exists in snapshot but not in remote`
+		};
+		case "field_removed": return {
+			typeName: change.typeName,
 			kind: "field_missing_local",
-			fieldName,
-			details: `Field '${fieldName}' exists in remote but not in snapshot`
-		});
-		for (const fieldName of snapshotFieldNames) {
-			if (!remoteFieldNames.has(fieldName)) continue;
-			const drift = compareFields(typeName, fieldName, assertDefined(remoteFields[fieldName], `field "${fieldName}" missing from remoteFields`), assertDefined(snapshotFields[fieldName], `field "${fieldName}" missing from snapshotFields`));
-			if (drift) drifts.push(drift);
-		}
+			fieldName: change.fieldName,
+			details: `Field '${change.fieldName}' exists in remote but not in snapshot`
+		};
+		case "field_modified": return fieldDriftFromChange(change);
+		case "index_added": return {
+			typeName: change.typeName,
+			kind: "index_missing_remote",
+			indexName: change.indexName,
+			details: `Index '${change.indexName}' exists in snapshot but not in remote`
+		};
+		case "index_removed": return {
+			typeName: change.typeName,
+			kind: "index_missing_local",
+			indexName: change.indexName,
+			details: `Index '${change.indexName}' exists in remote but not in snapshot`
+		};
+		case "index_modified": return {
+			typeName: change.typeName,
+			kind: "index_mismatch",
+			indexName: change.indexName,
+			details: change.reason ?? `Index '${change.indexName}' differs between remote and snapshot`
+		};
+		case "file_added": return {
+			typeName: change.typeName,
+			kind: "file_missing_remote",
+			fileName: change.fieldName,
+			details: `File '${change.fieldName}' exists in snapshot but not in remote`
+		};
+		case "file_removed": return {
+			typeName: change.typeName,
+			kind: "file_missing_local",
+			fileName: change.fieldName,
+			details: `File '${change.fieldName}' exists in remote but not in snapshot`
+		};
+		case "file_modified": return {
+			typeName: change.typeName,
+			kind: "file_mismatch",
+			fileName: change.fieldName,
+			details: change.reason ?? `File '${change.fieldName}' differs between remote and snapshot`
+		};
+		case "relationship_added": return {
+			typeName: change.typeName,
+			kind: "relationship_missing_remote",
+			relationshipName: change.relationshipName,
+			relationshipType: change.relationshipType,
+			details: `Relationship '${change.relationshipName}' exists in snapshot but not in remote`
+		};
+		case "relationship_removed": return {
+			typeName: change.typeName,
+			kind: "relationship_missing_local",
+			relationshipName: change.relationshipName,
+			relationshipType: change.relationshipType,
+			details: `Relationship '${change.relationshipName}' exists in remote but not in snapshot`
+		};
+		case "relationship_modified": return {
+			typeName: change.typeName,
+			kind: "relationship_mismatch",
+			relationshipName: change.relationshipName,
+			relationshipType: change.relationshipType,
+			details: change.reason ?? `Relationship '${change.relationshipName}' differs between remote and snapshot`
+		};
+		case "permission_modified": return {
+			typeName: change.typeName,
+			kind: "permission_mismatch",
+			details: change.reason ?? "Permissions differ between remote and snapshot"
+		};
+		default: throw new Error("Unsupported diff change");
 	}
-	return drifts;
+}
+function compareNormalizedRemoteWithSnapshot(remoteSnapshot, snapshot) {
+	return compareNormalizedSnapshots(remoteSnapshot, snapshot).changes.map(schemaDriftFromDiffChange);
 }
 /**
 * Format schema drifts for display
@@ -8102,7 +8561,12 @@ function formatSchemaDrifts(drifts) {
 	for (const [typeName, typeDrifts] of driftsByType) {
 		lines.push(`  Type '${typeName}':`);
 		for (const drift of typeDrifts) if (drift.fieldName) lines.push(`    - Field '${drift.fieldName}': ${drift.details}`);
-		else lines.push(`    - ${drift.details}`);
+		else if (drift.indexName) lines.push(`    - Index '${drift.indexName}': ${drift.details}`);
+		else if (drift.fileName) lines.push(`    - File '${drift.fileName}': ${drift.details}`);
+		else if (drift.relationshipName) {
+			const relationshipType = drift.relationshipType ? ` (${drift.relationshipType})` : "";
+			lines.push(`    - Relationship${relationshipType} '${drift.relationshipName}': ${drift.details}`);
+		} else lines.push(`    - ${drift.details}`);
 	}
 	return lines.join("\n");
 }
@@ -9191,6 +9655,77 @@ async function fetchRemoteTypes(client, workspaceId, namespace) {
 		}
 	});
 }
+async function fetchRemoteGqlPermissions(client, workspaceId, namespace) {
+	return fetchAll(async (pageToken, maxPageSize) => {
+		try {
+			const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
+				workspaceId,
+				namespaceName: namespace,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [permissions, nextPageToken];
+		} catch (error) {
+			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
+			throw error;
+		}
+	});
+}
+function definedWhenNotEmpty(value) {
+	return Object.keys(value).length > 0 ? value : void 0;
+}
+function namespaceConfig(config, tailorDBInputs, namespace) {
+	return tailorDBInputs.find((input) => input.namespace === namespace)?.config ?? config.db?.[namespace];
+}
+function namespaceGqlOperations(config, tailorDBInputs, namespace) {
+	return namespaceConfig(config, tailorDBInputs, namespace)?.gqlOperations;
+}
+const GQL_OPERATION_KEYS = [
+	"create",
+	"update",
+	"delete",
+	"read"
+];
+function configuredDisabledGqlOperations(operations) {
+	if (!operations) return void 0;
+	if (operations === "query") return {
+		create: false,
+		update: false,
+		delete: false
+	};
+	const disabled = {};
+	for (const key of GQL_OPERATION_KEYS) if (operations[key] === false) disabled[key] = false;
+	return definedWhenNotEmpty(disabled);
+}
+function appliedConfiguredDisabledGqlOperations(remoteDisabled, configuredDisabled) {
+	if (!remoteDisabled || !configuredDisabled) return void 0;
+	const disabled = {};
+	for (const key of GQL_OPERATION_KEYS) if (configuredDisabled[key] === false && remoteDisabled[key]) disabled[key] = false;
+	return definedWhenNotEmpty(disabled);
+}
+function deployComparableSnapshot(snapshot, remoteTypes, gqlOperations) {
+	const remoteTypesByName = new Map(remoteTypes.map((type) => [type.name, type]));
+	const configuredDisabled = configuredDisabledGqlOperations(gqlOperations);
+	const types = {};
+	for (const [typeName, type] of Object.entries(snapshot.types)) {
+		const settings = { ...type.settings };
+		const remoteSettings = remoteTypesByName.get(typeName)?.schema?.settings;
+		if (type.settings?.publishEvents === void 0 && remoteSettings?.publishRecordEvents) settings.publishEvents = true;
+		if (type.settings?.gqlOperations === void 0) {
+			const disabled = appliedConfiguredDisabledGqlOperations(remoteSettings?.disableGqlOperations, configuredDisabled);
+			if (disabled) settings.gqlOperations = disabled;
+		}
+		const comparableType = { ...type };
+		const comparableSettings = definedWhenNotEmpty(settings);
+		if (comparableSettings) comparableType.settings = comparableSettings;
+		else delete comparableType.settings;
+		types[typeName] = comparableType;
+	}
+	return {
+		...snapshot,
+		types
+	};
+}
 /**
 * Get the current migration number from remote metadata
 * @param {OperatorClient} client - Operator client instance
@@ -9215,9 +9750,11 @@ async function getRemoteMigrationNumber(client, workspaceId, namespace) {
 * @param {OperatorClient} client - Operator client instance
 * @param {string} workspaceId - Workspace ID
 * @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migration config
+* @param {LoadedConfig} config - Loaded application config
+* @param {ReadonlyArray<TailorDBDeployInput>} tailorDBInputs - Deploy inputs for namespace defaults
 * @returns {Promise<RemoteSchemaVerificationResult[]>} Verification results per namespace
 */
-async function verifyRemoteSchema(client, workspaceId, namespacesWithMigrations) {
+async function verifyRemoteSchema(client, workspaceId, namespacesWithMigrations, config, tailorDBInputs) {
 	const results = [];
 	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
 		const remoteMigrationNumber = await getRemoteMigrationNumber(client, workspaceId, namespace);
@@ -9240,7 +9777,8 @@ async function verifyRemoteSchema(client, workspaceId, namespacesWithMigrations)
 			});
 			continue;
 		}
-		const drifts = compareRemoteWithSnapshot(await fetchRemoteTypes(client, workspaceId, namespace), expectedSnapshot);
+		const [remoteTypes, remoteGqlPermissions] = await Promise.all([fetchRemoteTypes(client, workspaceId, namespace), fetchRemoteGqlPermissions(client, workspaceId, namespace)]);
+		const drifts = compareRemoteWithSnapshot(remoteTypes, deployComparableSnapshot(expectedSnapshot, remoteTypes, namespaceGqlOperations(config, tailorDBInputs, namespace)), remoteGqlPermissions);
 		results.push({
 			namespace,
 			remoteMigrationNumber,
@@ -9274,9 +9812,10 @@ function formatRemoteVerificationResults(results) {
 * @param {ReadonlyMap<string, Record<string, TailorDBSnapshotType>>} typesByNamespace - Types by namespace
 * @param {LoadedConfig} config - Loaded application config (includes path)
 * @param {boolean} noSchemaCheck - Whether to skip schema diff check
+* @param {ReadonlyArray<TailorDBDeployInput>} tailorDBInputs - Deploy inputs for namespace defaults
 * @returns {Promise<ValidateAndDetectResult>} Pending migrations and namespaces that have migration directories configured
 */
-async function validateAndDetectMigrations(client, workspaceId, typesByNamespace, config, noSchemaCheck) {
+async function validateAndDetectMigrations(client, workspaceId, typesByNamespace, config, noSchemaCheck, tailorDBInputs) {
 	const namespacesWithMigrations = getNamespacesWithMigrations(config, path.dirname(config.path));
 	let pendingMigrations = [];
 	if (namespacesWithMigrations.length > 0) {
@@ -9291,7 +9830,7 @@ async function validateAndDetectMigrations(client, workspaceId, typesByNamespace
 				logger.info("Or use '--no-schema-check' to skip this check.");
 				throw new Error("Schema migration check failed");
 			}
-			const remoteVerificationResults = await verifyRemoteSchema(client, workspaceId, namespacesWithMigrations);
+			const remoteVerificationResults = await verifyRemoteSchema(client, workspaceId, namespacesWithMigrations, config, tailorDBInputs);
 			if (remoteVerificationResults.some((r) => r.hasDrift)) {
 				logger.error("Remote schema drift detected:");
 				logger.log(formatRemoteVerificationResults(remoteVerificationResults));
@@ -9301,6 +9840,12 @@ async function validateAndDetectMigrations(client, workspaceId, typesByNamespace
 				logger.info("  - Manual schema changes were made directly", { mode: "plain" });
 				logger.info("  - Migration history is out of sync", { mode: "plain" });
 				logger.newline();
+				logger.info("To resolve:");
+				logger.info("  - Run 'tailor-sdk tailordb migration status' to compare local vs remote.", { mode: "plain" });
+				logger.info("  - If remote is correct, update local types and run 'migration generate'.", { mode: "plain" });
+				logger.info("  - If local migration history is correct, run 'migration sync <N>' to overwrite remote.", { mode: "plain" });
+				logger.info("  - If only bookkeeping is stale, run 'migration set <N>'.", { mode: "plain" });
+				logger.newline();
 				logger.info("Use '--no-schema-check' to skip this check (not recommended).");
 				throw new Error("Remote schema verification failed");
 			}
@@ -9375,7 +9920,7 @@ async function applyTailorDB(client, result, phase = "create-update") {
 	if (phase === "create-update") {
 		const typesByNamespace = /* @__PURE__ */ new Map();
 		for (const tailordb of migrationContext.tailorDBInputs) typesByNamespace.set(tailordb.namespace, tailordb.types);
-		const { pendingMigrations, namespacesWithMigrations } = await validateAndDetectMigrations(client, migrationContext.workspaceId, typesByNamespace, migrationContext.config, migrationContext.noSchemaCheck);
+		const { pendingMigrations, namespacesWithMigrations } = await validateAndDetectMigrations(client, migrationContext.workspaceId, typesByNamespace, migrationContext.config, migrationContext.noSchemaCheck, migrationContext.tailorDBInputs);
 		if (pendingMigrations.length > 0) {
 			processedTypes.reset();
 			deletedResources.reset();
@@ -10280,7 +10825,7 @@ function filterJobFunctionVersions(allVersions, usedJobNames) {
 * @param client - Operator client instance
 * @param changeSet - Workflow change set
 * @param appName - Application name
-* @param appId
+* @param appId - Application ID used for job function metadata when available
 * @param unchangedWorkflowJobNames - Job function names used by unchanged workflows
 * @returns Map of job function names to versions
 */
@@ -10366,7 +10911,7 @@ function buildWorkflowValidationShape(workspaceId, workflow) {
 * @param client - Operator client instance
 * @param workspaceId - Workspace ID
 * @param appName - Application name
-* @param appId
+* @param appId - Application ID used for workflow metadata when available
 * @param workflows - Parsed workflows
 * @param mainJobDeps - Main job dependencies by workflow
 * @param unchangedJobFunctions - Job functions already proven unchanged by function registry plan
@@ -16160,7 +16705,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-BhRnH42h.mjs");
+	const { defineApplication } = await import("./application-BXdCl6bp.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -18425,4 +18970,4 @@ function isDeno() {
 
 //#endregion
 export { getOrganization as $, generateAllTypeManifestsFromSnapshot as $t, listCommand$3 as A, apiCommand as An, getExecutorWaitFailureMessage as At, show as B, paginationArgs as Bn, listWorkflowExecutions as Bt, listCommand$2 as C, getNamespacesWithMigrations as Cn, listWebhookExecutors as Ct, waitWorkflowExecution as D, PluginManager as Dn, listCommand$9 as Dt, waitCommand as E, sdkNameLabelKey as En, triggerExecutor as Et, generateCommand as F, configArg as Fn, startWorkflow as Ft, removeCommand$1 as G, deploy as Gt, extractOwnedNamespaces as H, workspaceArgs as Hn, formatKeyValueTable as Ht, generateMigrationScript as I, confirmationArgs as In, getCommand$5 as It, organizationTree as J, bundleMigrationScript as Jt, updateCommand$1 as K, executeScript as Kt, writeDbTypesFile as L, deploymentArgs as Ln, getWorkflow as Lt, truncate as M, assertWritable as Mn, listExecutorJobs as Mt, truncateCommand as N, defineAppCommand as Nn, watchExecutorJob as Nt, resumeCommand as O, generateUserTypes as On, listExecutors as Ot, generate as P, commonArgs as Pn, startCommand as Pt, getCommand$1 as Q, compareSnapshotWithRemote as Qt, getConfiguredEditorCommand as R, isVerbose as Rn, executionsCommand as Rt, listApps as S, hasChanges as Sn, getFunctionRegistry as St, healthCommand as T, resourceTrn as Tn, triggerCommand as Tt, logBetaWarning as U, getCommand$6 as Ut, showCommand as V, toPageDirection as Vn, functionExecutionStatusToString as Vt, remove as W, getExecutor as Wt, listCommand$4 as X, handleOptionalToRequiredError as Xt, treeCommand as Y, MIGRATION_LABEL_KEY as Yt, listOrganizations as Z, parseMigrationLabelNumber as Zt, getWorkspace as _, reconstructSnapshotFromMigrations as _n, listMachineUsers as _t, updateUser as a, SCHEMA_FILE_NAME as an, getFolder as at, createCommand as b, formatDiffSummary as bn, listFunctionRegistries as bt, listCommand as c, compareSnapshots as cn, createCommand$1 as ct, inviteUser as d, getMigrationDirPath as dn, listOAuth2Clients as dt, protoGqlPermission as en, updateCommand$2 as et, restoreCommand as f, getMigrationFilePath as fn, getCommand$3 as ft, getCommand as g, loadDiff as gn, listCommand$7 as gt, listWorkspaces as h, isValidMigrationNumber as hn, tokenCommand as ht, updateCommand as i, MIGRATE_FILE_NAME as in, getCommand$2 as it, listWorkflows as j, apiCall as jn, jobsCommand as jt, resumeWorkflow as k, prompt as kn, getExecutorJob as kt, listUsers as l, createSnapshotFromLocalTypes as ln, createFolder as lt, listCommand$1 as m, getNextMigrationNumber as mn, getMachineUserToken as mt, query as n, DIFF_FILE_NAME as nn, listCommand$5 as nt, removeCommand as o, assertValidMigrationFiles as on, deleteCommand$1 as ot, restoreWorkspace as p, getMigrationFiles as pn, getOAuth2Client as pt, updateOrganization as q, waitForExecution as qt, queryCommand as r, INITIAL_SCHEMA_NUMBER as rn, listFolders as rt, removeUser as s, compareLocalTypesWithSnapshot as sn, deleteFolder as st, isNativeTypeScriptRuntime as t, DB_TYPES_FILE_NAME as tn, updateFolder as tt, inviteCommand as u, getLatestMigrationNumber as un, listCommand$6 as ut, deleteCommand as v, formatMigrationNumber as vn, generate$1 as vt, getAppHealth as w, ensureConfigId as wn, webhookCommand as wt, createWorkspace as x, formatMigrationDiff as xn, getCommand$4 as xt, deleteWorkspace as y, parseMigrationNumberArg as yn, listCommand$8 as yt, openInConfiguredEditor as z, pagedLogArgs as zn, getWorkflowExecution as zt };
-//# sourceMappingURL=runtime-CEFC05qX.mjs.map
+//# sourceMappingURL=runtime-B8O6JFS2.mjs.map