@tailor-platform/sdk 1.73.3 → 1.74.1

package/dist/{runtime-SxHHEzVb.mjs → runtime-DV1EnfMs.mjs}

@@ -1,9 +1,9 @@
-import { t as db } from "./schema-DAdZSFOd.mjs";
+import { t as db } from "./schema-Dl_y0m9e.mjs";
 import { $ as CreateUserProfileConfigRequestSchema, A as UpdatePipelineServiceRequestSchema, At as Condition_Operator, B as UpdateExecutorExecutorRequestSchema, Ct as UserProfileProviderConfig_UserProfileProviderType, D as CreatePipelineResolverRequestSchema, Dt as ApplicationSchemaUpdateAttemptStatus, E as UpdateSecretManagerSecretRequestSchema, Et as UpdateApplicationRequestSchema, F as IdPPermissionOperator, G as CreateAuthHookRequestSchema, H as ExecutorTargetType, I as IdPPermissionPermit, J as CreateAuthOAuth2ClientRequestSchema, K as CreateAuthIDPConfigRequestSchema, L as FunctionExecution_Status, M as CreateIdPServiceRequestSchema, Mt as PageDirection, N as UpdateIdPServiceRequestSchema, O as CreatePipelineServiceRequestSchema, Ot as Subgraph_ServiceType, P as IdPLang, Q as CreateTenantConfigRequestSchema, S as UpdateStaticWebsiteRequestSchema, St as TenantProviderConfig_TenantProviderType, T as CreateSecretManagerVaultRequestSchema, Tt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, U as ExecutorTriggerType, V as ExecutorJobStatus, W as CreateAuthConnectionRequestSchema, X as CreateAuthSCIMResourceRequestSchema, Y as CreateAuthSCIMConfigRequestSchema, Z as CreateAuthServiceRequestSchema, _ as TailorDBType_Permission_Operator, _t as AuthSCIMAttribute_Mutability, a as WorkspacePlatformUserRole, at as UpdateAuthSCIMConfigRequestSchema, b as AddCustomDomainRequestSchema, bt as AuthSCIMConfig_AuthorizationType, c as UpdateWorkflowRequestSchema, ct as UpdateTenantConfigRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as AuthConnection_Type, et as UpdateAuthConnectionRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as AuthHookPoint, g as TailorDBGQLPermission_Permit, gt as AuthOAuth2Client_GrantType, h as TailorDBGQLPermission_Operator, ht as AuthOAuth2Client_ClientType, it as UpdateAuthOAuth2ClientRequestSchema, j as PipelineResolver_OperationType, jt as FilterSchema, k as UpdatePipelineResolverRequestSchema, kt as ConditionSchema, l as WorkflowExecution_Status, lt as UpdateUserProfileConfigRequestSchema, m as TailorDBGQLPermission_Action, mt as AuthInvokerSchema, nt as UpdateAuthIDPConfigRequestSchema, o as CreateWorkflowJobFunctionRequestSchema, ot as UpdateAuthSCIMResourceRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as AuthIDPConfig_AuthType, q as CreateAuthMachineUserRequestSchema, rt as UpdateAuthMachineUserRequestSchema, s as CreateWorkflowRequestSchema, st as UpdateAuthServiceRequestSchema, t as OperatorService, tt as UpdateAuthHookRequestSchema, u as WorkflowJobExecution_Status, ut as AuthConnection_Status, v as TailorDBType_Permission_Permit, vt as AuthSCIMAttribute_Type, w as CreateSecretManagerSecretRequestSchema, wt as CreateApplicationRequestSchema, x as CreateStaticWebsiteRequestSchema, y as TailorDBType_PermitAction, yt as AuthSCIMAttribute_Uniqueness, z as CreateExecutorExecutorRequestSchema } from "./service_pb-CIrhGwHk.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
 import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-BEiZZ3qT.mjs";
-import { $ as initOperatorClient, A as loadAccessToken, G as fetchMachineUserToken, I as loadWorkspaceId, K as fetchPaged, L as platformConfigFromProfile, N as loadMachineUserName, P as loadPlatformClientConfig, R as readPlatformConfig, S as getDistDir, T as loadConfig, V as writePlatformConfig, W as fetchAll, X as getOAuth2ClientId, Y as getConsoleBaseUrl, Z as getPlatformBaseUrl, b as hasGenerationHooks, d as assertUniqueLocalTailorDBTypeNames, et as isDefaultPlatform, f as assertUniqueTailorDBTypeNamesWithExternal, h as platformBundleDefinePlugin, j as loadConfigPath, k as hasUserTokenEntry, l as buildExecutorArgsExpr, m as stringifyFunction, n as generatePluginFilesIfNeeded, nt as byName, p as TailorDBTypeSchema, r as loadApplication, s as HTTP_METHODS, t as defineApplication, tt as resolveStaticWebsiteUrls, u as buildResolverOperationHookExpr, w as hashFile, x as createBundleCache, y as getPluginGenerationDependencies } from "./application-DgTCDMZY.mjs";
-import { o as loadFilesWithIgnores, t as createExecutorService } from "./service-DiEtAsvc.mjs";
+import { $ as getOrNull, A as hasUserTokenEntry, C as getDistDir, E as loadConfig, F as loadPlatformClientConfig, G as fetchAll, H as writePlatformConfig, J as fetchPaged, K as fetchAllTolerant, L as loadWorkspaceId, M as loadConfigPath, P as loadMachineUserName, Q as getOAuth2ClientId, R as platformConfigFromProfile, S as createBundleCache, T as hashFile, Z as getConsoleBaseUrl, at as byName, b as getPluginGenerationDependencies, c as HTTP_METHODS, d as buildResolverOperationHookExpr, et as getPlatformBaseUrl, f as assertUniqueLocalTailorDBTypeNames, g as platformBundleDefinePlugin, h as stringifyFunction, i as resolverBundleKey, it as resolveStaticWebsiteUrls, j as loadAccessToken, m as TailorDBTypeSchema, n as generatePluginFilesIfNeeded, nt as initOperatorClient, p as assertUniqueTailorDBTypeNamesWithExternal, q as fetchMachineUserToken, r as loadApplication, rt as isDefaultPlatform, t as defineApplication, u as buildExecutorArgsExpr, w as hashContent, x as hasGenerationHooks, z as readPlatformConfig } from "./application-BsH6tkZC.mjs";
+import { o as loadFilesWithIgnores, t as createExecutorService } from "./service-BCRJ-3NV.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "./package-json-8b0O9TlX.mjs";
 import { i as userAgent } from "./secret-file-VSVGy1V0.mjs";
@@ -71,7 +71,9 @@ const durationArg = z.string().refine((val) => durationPattern.test(val), { mess
 */
 function parseDuration(duration) {
 	const match = assertDefined(duration.match(durationPattern), `invalid duration format: ${duration}`);
-	return parseInt(assertDefined(match[1], "duration digits group missing"), 10) * unitToMs[assertDefined(match[2], "duration unit group missing")];
+	const value = parseInt(assertDefined(match[1], "duration digits group missing"), 10);
+	const unit = assertDefined(match[2], "duration unit group missing");
+	return value * unitToMs[unit];
 }
 /**
 * Schema for positive integer validation (from string input)
@@ -197,6 +199,18 @@ const configArg = { config: arg(z.string().default("tailor.config.ts"), {
 	}
 }) };
 /**
+* Shared config arg for commands that accept one or more comma-separated config file paths
+*/
+const multiConfigArg = { config: arg(z.string().default("tailor.config.ts"), {
+	alias: "c",
+	description: "Path to SDK config file. Use comma-separated paths to deploy multiple apps together.",
+	env: "TAILOR_PLATFORM_SDK_CONFIG_PATH",
+	completion: {
+		type: "file",
+		extensions: ["ts"]
+	}
+}) };
+/**
 * Arguments for commands that interact with deployed resources (includes config)
 */
 const deploymentArgs = {
@@ -965,7 +979,7 @@ function createCacheStore(config) {
 		return path.join(config.cacheDir, BUNDLES_DIR);
 	}
 	function bundlePath(cacheKey) {
-		return path.join(bundlesDir(), `${cacheKey.replaceAll(":", "_")}.js`);
+		return path.join(bundlesDir(), `${hashContent(cacheKey)}.js`);
 	}
 	function loadManifest() {
 		try {
@@ -1085,12 +1099,20 @@ function createCacheManager(options) {
 		enabled: true,
 		bundleCache: createBundleCache(store),
 		finalize() {
-			const manifest = store.getCurrentManifest() ?? {
+			const currentManifest = store.getCurrentManifest() ?? {
 				version: 1,
 				sdkVersion: options.sdkVersion,
 				lockfileHash: options.lockfileHash,
 				entries: {}
 			};
+			const latestManifest = store.loadManifest();
+			const manifest = latestManifest?.sdkVersion === options.sdkVersion && latestManifest.lockfileHash === options.lockfileHash ? {
+				...latestManifest,
+				entries: {
+					...latestManifest.entries,
+					...currentManifest.entries
+				}
+			} : currentManifest;
 			manifest.sdkVersion = options.sdkVersion;
 			manifest.lockfileHash = options.lockfileHash;
 			store.saveManifest(manifest);
@@ -1827,14 +1849,7 @@ async function buildMetaRequest(params) {
 */
 async function fetchExistingResourcesWithLabels(params) {
 	const { client, fetchPage, getName, getTrn } = params;
-	const withoutLabel = await fetchAll(async (pageToken, maxPageSize) => {
-		try {
-			return await fetchPage(pageToken, maxPageSize);
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
-	});
+	const withoutLabel = await fetchAllTolerant(fetchPage);
 	const existingResources = {};
 	await Promise.all(withoutLabel.map(async (resource) => {
 		const name = getName(resource);
@@ -1894,6 +1909,207 @@ function trackRemainingResourceOwner(params) {
 	return owned;
 }
 
+//#endregion
+//#region src/cli/commands/deploy/staticwebsite.ts
+/**
+* Apply static website changes for the given phase.
+* @param client - Operator client instance
+* @param result - Planned static website changes
+* @param phase - Apply phase
+* @returns Promise that resolves when static websites are applied
+*/
+async function applyStaticWebsite(client, result, phase = "create-update") {
+	const { changeSet, customDomainChangeSet } = result;
+	if (phase === "create-update") {
+		await Promise.all([...changeSet.creates.map(async (create) => {
+			await client.createStaticWebsite(create.request);
+			await client.setMetadata(create.metaRequest);
+		}), ...changeSet.updates.map(async (update) => {
+			await client.updateStaticWebsite(update.request);
+			await client.setMetadata(update.metaRequest);
+		})]);
+		await Promise.all([...customDomainChangeSet.creates.map(async (add) => {
+			await client.addCustomDomain(add.request);
+			await client.setMetadata(add.metaRequest);
+		}), ...customDomainChangeSet.deletes.map((del) => client.removeCustomDomain(del.request))]);
+	} else await Promise.all(changeSet.deletes.map((del) => client.deleteStaticWebsite(del.request)));
+}
+function customDomainTrn(workspaceId, websiteName, domain) {
+	return `trn:v1:workspace:${workspaceId}:staticwebsite:${websiteName}:custom_domain:${domain}`;
+}
+function normalizeComparableStaticWebsiteShape(input) {
+	return {
+		description: input.description,
+		allowedIpAddresses: input.allowedIpAddresses.toSorted()
+	};
+}
+function normalizeComparableStaticWebsite(input) {
+	return normalizeComparableStaticWebsiteShape({
+		description: input.description || "",
+		allowedIpAddresses: [...input.allowedIpAddresses || []]
+	});
+}
+function areStaticWebsitesEqual(existing, desired) {
+	return areNormalizedEqual(normalizeComparableStaticWebsite(existing), normalizeComparableStaticWebsite(desired));
+}
+/**
+* Static website names expected to exist after this deploy run.
+* @param context - Planning context
+* @returns Names from the deploy-run scope when set, otherwise the application's own websites
+*/
+function expectedLocalStaticWebsiteNames(context) {
+	return context.expectedLocalStaticWebsiteNames ?? new Set(context.application.staticWebsiteServices.map((website) => website.name));
+}
+/**
+* Plan static website changes based on current and desired state.
+* @param context - Planning context
+* @returns Planned changes
+*/
+async function planStaticWebsite(context) {
+	const { client, workspaceId, application, forRemoval } = context;
+	const changeSet = createChangeSet("StaticWebsites");
+	const customDomainChangeSet = createChangeSet("CustomDomains");
+	const conflicts = [];
+	const unmanaged = [];
+	const resourceOwners = /* @__PURE__ */ new Set();
+	const existingWebsites = await fetchExistingResourcesWithLabels({
+		client,
+		fetchPage: async (pageToken, pageSize) => {
+			const { staticwebsites, nextPageToken } = await client.listStaticWebsites({
+				workspaceId,
+				pageToken,
+				pageSize
+			});
+			return [staticwebsites, nextPageToken];
+		},
+		getName: (resource) => resource.name,
+		getTrn: (name) => resourceTrn(workspaceId, "staticwebsite", name)
+	});
+	const ownedWebsiteNames = /* @__PURE__ */ new Set();
+	const staticWebsiteServices = forRemoval ? [] : application.staticWebsiteServices;
+	for (const websiteService of staticWebsiteServices) {
+		const config = websiteService;
+		const name = websiteService.name;
+		const existing = existingWebsites[name];
+		const metaRequest = await buildMetaRequest({
+			trn: resourceTrn(workspaceId, "staticwebsite", name),
+			appName: application.name,
+			appId: application.id
+		});
+		const desired = normalizeComparableStaticWebsite(config);
+		const request = {
+			workspaceId,
+			staticwebsite: {
+				name,
+				description: config.description || "",
+				allowedIpAddresses: config.allowedIpAddresses || []
+			}
+		};
+		if (existing) {
+			const owned = trackDesiredResourceOwnership({
+				labels: existing.allLabels,
+				ownerLabel: existing.label,
+				appName: application.name,
+				appId: application.id,
+				resourceType: "StaticWebsite",
+				resourceName: name,
+				conflicts,
+				unmanaged
+			});
+			if (owned && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && areStaticWebsitesEqual(existing.resource, desired)) changeSet.unchanged.push({ name });
+			else changeSet.updates.push({
+				name,
+				request,
+				metaRequest
+			});
+			if (owned) ownedWebsiteNames.add(name);
+			delete existingWebsites[name];
+		} else {
+			changeSet.creates.push({
+				name,
+				request,
+				metaRequest
+			});
+			ownedWebsiteNames.add(name);
+		}
+	}
+	Object.entries(existingWebsites).forEach(([name]) => {
+		const entry = existingWebsites[name];
+		const label = entry?.label;
+		if (trackRemainingResourceOwner({
+			labels: entry?.allLabels,
+			ownerLabel: label,
+			appName: application.name,
+			appId: application.id,
+			resourceOwners
+		})) changeSet.deletes.push({
+			name,
+			request: {
+				workspaceId,
+				name
+			}
+		});
+	});
+	const desiredDomainsByWebsite = /* @__PURE__ */ new Map();
+	for (const service of staticWebsiteServices) if (service.customDomains !== void 0 && ownedWebsiteNames.has(service.name)) desiredDomainsByWebsite.set(service.name, service.customDomains);
+	const existingDomainsByWebsite = /* @__PURE__ */ new Map();
+	const websitesToFetchDomains = [...ownedWebsiteNames].filter((name) => !changeSet.creates.some((c) => c.name === name));
+	await Promise.all(websitesToFetchDomains.map(async (name) => {
+		const domainsWithLabels = await getOrNull(async () => {
+			const { customDomains } = await client.listCustomDomains({
+				workspaceId,
+				staticWebsiteName: name
+			});
+			return await Promise.all(customDomains.map(async (d) => {
+				const { metadata } = await client.getMetadata({ trn: customDomainTrn(workspaceId, name, d.domain) });
+				return {
+					domain: d.domain,
+					allLabels: metadata?.labels
+				};
+			}));
+		});
+		if (domainsWithLabels) existingDomainsByWebsite.set(name, domainsWithLabels);
+	}));
+	for (const name of ownedWebsiteNames) {
+		const desired = new Set(desiredDomainsByWebsite.get(name) ?? []);
+		const existingDomains = existingDomainsByWebsite.get(name) ?? [];
+		const existingSet = new Set(existingDomains.map((d) => d.domain));
+		const sdkOwnedDomains = new Set(existingDomains.filter((d) => isOwnedByApp(d.allLabels, application.name, application.id)).map((d) => d.domain));
+		for (const domain of desired) if (!existingSet.has(domain)) {
+			const metaRequest = await buildMetaRequest({
+				trn: customDomainTrn(workspaceId, name, domain),
+				appName: application.name,
+				appId: application.id
+			});
+			customDomainChangeSet.creates.push({
+				name: domain,
+				request: {
+					workspaceId,
+					staticWebsiteName: name,
+					domain
+				},
+				metaRequest
+			});
+		} else customDomainChangeSet.unchanged.push({ name: domain });
+		if (desiredDomainsByWebsite.has(name)) {
+			for (const domain of sdkOwnedDomains) if (!desired.has(domain)) customDomainChangeSet.deletes.push({
+				name: domain,
+				request: {
+					workspaceId,
+					domain
+				}
+			});
+		}
+	}
+	return {
+		changeSet,
+		customDomainChangeSet,
+		conflicts,
+		unmanaged,
+		resourceOwners
+	};
+}
+
 //#endregion
 //#region src/cli/commands/deploy/aigateway.ts
 /**
@@ -1956,7 +2172,7 @@ async function planAIGateway(context) {
 		getTrn: (name) => resourceTrn(workspaceId, "aigateway", name)
 	});
 	const aiGatewayServices = forRemoval ? [] : application.aiGatewayServices;
-	const expectedLocalWebsites = new Set(application.staticWebsiteServices.map((website) => website.name));
+	const expectedLocalWebsites = expectedLocalStaticWebsiteNames(context);
 	for (const gatewayService of aiGatewayServices) {
 		const config = gatewayService;
 		const name = gatewayService.name;
@@ -2120,18 +2336,13 @@ function areApplicationsEqual(existing, desired) {
 async function planApplication(context, httpAdapterBuildResult) {
 	const { client, workspaceId, application, forRemoval } = context;
 	const changeSet = createChangeSet("Applications");
-	const existingApplications = await fetchAll(async (pageToken, maxPageSize) => {
-		try {
-			const { applications, nextPageToken } = await client.listApplications({
-				workspaceId,
-				pageToken,
-				pageSize: maxPageSize
-			});
-			return [applications, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+	const existingApplications = await fetchAllTolerant(async (pageToken, maxPageSize) => {
+		const { applications, nextPageToken } = await client.listApplications({
+			workspaceId,
+			pageToken,
+			pageSize: maxPageSize
+		});
+		return [applications, nextPageToken];
 	});
 	if (forRemoval) {
 		const candidates = application.id ? existingApplications : existingApplications.filter((app) => app.name === application.name);
@@ -2156,8 +2367,9 @@ async function planApplication(context, httpAdapterBuildResult) {
 		if (idProvider) authIdpConfigName = idProvider.name;
 	} else if (application.config.auth) {
 		authNamespace = application.config.auth.name;
-		const idpConfigs = await fetchAll(async (pageToken, maxPageSize) => {
-			try {
+		if (context.externalAuthIdpConfigNames?.has(authNamespace)) authIdpConfigName = context.externalAuthIdpConfigNames.get(authNamespace);
+		else {
+			const idpConfigs = await fetchAllTolerant(async (pageToken, maxPageSize) => {
 				const { idpConfigs, nextPageToken } = await client.listAuthIDPConfigs({
 					workspaceId,
 					namespaceName: assertDefined(authNamespace, "authNamespace must be set before listing IDP configs"),
@@ -2165,14 +2377,11 @@ async function planApplication(context, httpAdapterBuildResult) {
 					pageSize: maxPageSize
 				});
 				return [idpConfigs, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
+			});
+			if (idpConfigs.length > 0) {
+				const [firstConfig] = idpConfigs;
+				if (firstConfig) authIdpConfigName = firstConfig.name;
 			}
-		});
-		if (idpConfigs.length > 0) {
-			const [firstConfig] = idpConfigs;
-			if (firstConfig) authIdpConfigName = firstConfig.name;
 		}
 	}
 	const metaRequest = await buildMetaRequest({
@@ -2180,7 +2389,7 @@ async function planApplication(context, httpAdapterBuildResult) {
 		appName: application.name,
 		appId: application.id
 	});
-	const expectedLocalWebsites = new Set(application.staticWebsiteServices.map((website) => website.name));
+	const expectedLocalWebsites = expectedLocalStaticWebsiteNames(context);
 	const resolvedCors = await resolveStaticWebsiteUrls(client, workspaceId, application.config.cors, "CORS", { expectedLocalNames: expectedLocalWebsites });
 	const httpAdapters = buildHttpAdapters(application, httpAdapterBuildResult);
 	const desired = normalizeComparableApplication(application, authNamespace, authIdpConfigName, resolvedCors, httpAdapters);
@@ -2234,13 +2443,10 @@ async function planApplication(context, httpAdapterBuildResult) {
 	return changeSet;
 }
 async function fetchAppLabels(client, workspaceId, appName) {
-	try {
+	return (await getOrNull(async () => {
 		const { metadata } = await client.getMetadata({ trn: resourceTrn(workspaceId, "application", appName) });
-		return metadata?.labels;
-	} catch (error) {
-		if (error instanceof ConnectError && error.code === Code.NotFound) return;
-		throw error;
-	}
+		return metadata;
+	}))?.labels;
 }
 /**
 * Build per-adapter diff lines for the application plan display. The platform
@@ -2424,18 +2630,13 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 	const resourceOwners = /* @__PURE__ */ new Set();
 	const desiredConnections = {};
 	for (const auth of auths) for (const [name, config] of Object.entries(auth.connections)) desiredConnections[name] = config;
-	const existingList = await fetchAll(async (pageToken, maxPageSize) => {
-		try {
-			const { connections, nextPageToken } = await client.listAuthConnections({
-				workspaceId,
-				pageToken,
-				pageSize: maxPageSize
-			});
-			return [connections, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+	const existingList = await fetchAllTolerant(async (pageToken, maxPageSize) => {
+		const { connections, nextPageToken } = await client.listAuthConnections({
+			workspaceId,
+			pageToken,
+			pageSize: maxPageSize
+		});
+		return [connections, nextPageToken];
 	});
 	const existingConnections = {};
 	await Promise.all(existingList.map(async (resource) => {
@@ -2455,14 +2656,15 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 			appId
 		});
 		if (existing) {
-			if (!isOwnedByApp(existing.allLabels, appName, appId)) if (existing.label) conflicts.push({
+			trackDesiredResourceOwnership({
+				labels: existing.allLabels,
+				ownerLabel: existing.label,
+				appName,
+				appId,
 				resourceType: "Auth connection",
 				resourceName: name,
-				currentOwner: existing.label
-			});
-			else unmanaged.push({
-				resourceType: "Auth connection",
-				resourceName: name
+				conflicts,
+				unmanaged
 			});
 			const secretChanged = hashValue(config.clientSecret) !== state.connections?.[name];
 			const updateMask = buildUpdateMask(existing.resource, config, secretChanged);
@@ -2488,12 +2690,13 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 	}
 	for (const [name, entry] of Object.entries(existingConnections)) {
 		if (!entry) continue;
-		const owned = isOwnedByApp(entry.allLabels, appName, appId);
-		if (entry.label && !owned) {
-			resourceOwners.add(entry.label);
-			continue;
-		}
-		if (owned) changeSet.deletes.push({
+		if (trackRemainingResourceOwner({
+			labels: entry.allLabels,
+			ownerLabel: entry.label,
+			appName,
+			appId,
+			resourceOwners
+		})) changeSet.deletes.push({
 			name,
 			request: {
 				workspaceId,
@@ -2656,9 +2859,9 @@ function authHookFunctionName(authName, hookPoint) {
 function collectFunctionEntries(application, workflowJobs, bundledScripts) {
 	const entries = [];
 	for (const app of application.applications) for (const pipeline of app.resolverServices) for (const resolver of Object.values(pipeline.resolvers)) {
-		const content = bundledScripts.resolvers.get(resolver.name);
+		const content = bundledScripts.resolvers.get(resolverBundleKey(pipeline.namespace, resolver.name));
 		if (!content) {
-			logger.warn(`Bundled code not found for resolver: ${resolver.name}`);
+			logger.warn(`Bundled code not found for resolver: ${pipeline.namespace}/${resolver.name}`);
 			continue;
 		}
 		entries.push({
@@ -2762,15 +2965,15 @@ async function planFunctionRegistry(client, workspaceId, appName, appId, entries
 			appId
 		});
 		if (existing) {
-			const owned = isOwnedByApp(existing.allLabels, appName, appId);
-			if (!owned) if (!existing.label) unmanaged.push({
-				resourceType: "Function registry",
-				resourceName: entry.name
-			});
-			else conflicts.push({
+			const owned = trackDesiredResourceOwnership({
+				labels: existing.allLabels,
+				ownerLabel: existing.label,
+				appName,
+				appId,
 				resourceType: "Function registry",
 				resourceName: entry.name,
-				currentOwner: existing.label
+				conflicts,
+				unmanaged
 			});
 			if (existing.resource.contentHash === entry.contentHash && owned && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels)) changeSet.unchanged.push({ name: entry.name });
 			else changeSet.updates.push({
@@ -2787,10 +2990,13 @@ async function planFunctionRegistry(client, workspaceId, appName, appId, entries
 	}
 	for (const [name, existing] of Object.entries(existingMap)) {
 		if (!existing) continue;
-		const label = existing.label;
-		const owned = isOwnedByApp(existing.allLabels, appName, appId);
-		if (label && !owned) resourceOwners.add(label);
-		if (owned) changeSet.deletes.push({
+		if (trackRemainingResourceOwner({
+			labels: existing.allLabels,
+			ownerLabel: existing.label,
+			appName,
+			appId,
+			resourceOwners
+		})) changeSet.deletes.push({
 			name,
 			workspaceId
 		});
@@ -3276,15 +3482,12 @@ async function applyIdP(client, result, phase = "create-update") {
 		}), ...changeSet.client.updates.map(async (update) => {
 			const vaultName = idpClientVaultName(update.namespaceName, update.name);
 			const secretName = idpClientSecretName(update.namespaceName, update.name);
-			try {
-				await client.getSecretManagerVault({
+			if (await getOrNull(async () => {
+				return await client.getSecretManagerVault({
 					workspaceId: update.workspaceId,
 					secretmanagerVaultName: vaultName
 				});
-				return;
-			} catch (error) {
-				if (!(error instanceof ConnectError && error.code === Code.NotFound)) throw error;
-			}
+			})) return;
 			await client.createSecretManagerVault({
 				workspaceId: update.workspaceId,
 				secretmanagerVaultName: vaultName
@@ -3314,7 +3517,7 @@ async function applyIdP(client, result, phase = "create-update") {
 async function planIdP(context) {
 	const { client, workspaceId, application, forRemoval, forceApplyAll = false, idpUserTriggerTargets } = context;
 	const idps = forRemoval ? [] : application.idpServices;
-	const expectedLocalWebsites = new Set(application.staticWebsiteServices.map((website) => website.name));
+	const expectedLocalWebsites = expectedLocalStaticWebsiteNames(context);
 	const { changeSet: serviceChangeSet, conflicts, unmanaged, resourceOwners } = await planServices$3(client, workspaceId, application.name, application.id, idps, idpUserTriggerTargets ?? /* @__PURE__ */ new Set(), expectedLocalWebsites);
 	return {
 		changeSet: {
@@ -3484,17 +3687,16 @@ async function planServices$3(client, workspaceId, appName, appId, idps, idpUser
 			permission: protoPermission
 		};
 		if (existing) {
-			const owned = isOwnedByApp(existing.allLabels, appName, appId);
-			if (!owned) if (!existing.label) unmanaged.push({
-				resourceType: "IdP service",
-				resourceName: idp.name
-			});
-			else conflicts.push({
+			if (trackDesiredResourceOwnership({
+				labels: existing.allLabels,
+				ownerLabel: existing.label,
+				appName,
+				appId,
 				resourceType: "IdP service",
 				resourceName: idp.name,
-				currentOwner: existing.label
-			});
-			if (owned && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && areIdPServicesEqual(existing.resource, desired)) changeSet.unchanged.push({ name: namespaceName });
+				conflicts,
+				unmanaged
+			}) && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && areIdPServicesEqual(existing.resource, desired)) changeSet.unchanged.push({ name: namespaceName });
 			else changeSet.updates.push({
 				name: namespaceName,
 				request,
@@ -3509,10 +3711,13 @@ async function planServices$3(client, workspaceId, appName, appId, idps, idpUser
 	}
 	Object.entries(existingServices).forEach(([namespaceName]) => {
 		const entry = existingServices[namespaceName];
-		const label = entry?.label;
-		const owned = isOwnedByApp(entry?.allLabels, appName, appId);
-		if (label && !owned) resourceOwners.add(label);
-		if (owned) changeSet.deletes.push({
+		if (trackRemainingResourceOwner({
+			labels: entry?.allLabels,
+			ownerLabel: entry?.label,
+			appName,
+			appId,
+			resourceOwners
+		})) changeSet.deletes.push({
 			name: namespaceName,
 			request: {
 				workspaceId,
@@ -3530,19 +3735,14 @@ async function planServices$3(client, workspaceId, appName, appId, idps, idpUser
 async function planClients(client, workspaceId, idps, deletedServices, forceApplyAll = false) {
 	const changeSet = createChangeSet("IdP clients");
 	const fetchClients = (namespaceName) => {
-		return fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { clients, nextPageToken } = await client.listIdPClients({
-					workspaceId,
-					namespaceName,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [clients, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
+		return fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { clients, nextPageToken } = await client.listIdPClients({
+				workspaceId,
+				namespaceName,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [clients, nextPageToken];
 		});
 	};
 	const clientsByIdp = await Promise.all(idps.map((idp) => fetchClients(idp.name)));
@@ -3701,7 +3901,7 @@ function protoIdPOperand(operand) {
 */
 async function applyAuth(client, result, phase = "create-update") {
 	const { changeSet } = result;
-	if (phase === "create-update") {
+	const applyServices = async () => {
 		await Promise.all([...changeSet.service.creates.map(async (create) => {
 			await client.createAuthService(create.request);
 			await client.setMetadata(create.metaRequest);
@@ -3709,6 +3909,11 @@ async function applyAuth(client, result, phase = "create-update") {
 			await client.updateAuthService(update.request);
 			await client.setMetadata(update.metaRequest);
 		})]);
+	};
+	const applyMachineUsers = async () => {
+		await Promise.all([...changeSet.machineUser.creates.map((create) => client.createAuthMachineUser(create.request)), ...changeSet.machineUser.updates.map((update) => client.updateAuthMachineUser(update.request))]);
+	};
+	const applyCreateUpdateDependents = async () => {
 		await applyAuthConnections(client, { changeSet: changeSet.connection }, "create-update");
 		await Promise.all([...changeSet.idpConfig.creates.map(async (create) => {
 			if (create.idpConfig.kind === "BuiltInIdP") assertDefined(create.request.idpConfig, "request missing idpConfig").config = await protoBuiltinIdPConfig(client, assertDefined(create.request.workspaceId, "request missing workspaceId"), create.idpConfig);
@@ -3719,7 +3924,6 @@ async function applyAuth(client, result, phase = "create-update") {
 		})]);
 		await Promise.all([...changeSet.userProfileConfig.creates.map((create) => client.createUserProfileConfig(create.request)), ...changeSet.userProfileConfig.updates.map((update) => client.updateUserProfileConfig(update.request))]);
 		await Promise.all([...changeSet.tenantConfig.creates.map((create) => client.createTenantConfig(create.request)), ...changeSet.tenantConfig.updates.map((update) => client.updateTenantConfig(update.request))]);
-		await Promise.all([...changeSet.machineUser.creates.map((create) => client.createAuthMachineUser(create.request)), ...changeSet.machineUser.updates.map((update) => client.updateAuthMachineUser(update.request))]);
 		await Promise.all([...changeSet.authHook.creates.map((create) => client.createAuthHook(create.request)), ...changeSet.authHook.updates.map((update) => client.updateAuthHook(update.request))]);
 		await Promise.all([...changeSet.oauth2Client.creates.map(async (create) => {
 			const oauth2Client = assertDefined(create.request.oauth2Client, "request missing oauth2Client");
@@ -3738,7 +3942,13 @@ async function applyAuth(client, result, phase = "create-update") {
 		}
 		await Promise.all([...changeSet.scim.creates.map((create) => client.createAuthSCIMConfig(create.request)), ...changeSet.scim.updates.map((update) => client.updateAuthSCIMConfig(update.request))]);
 		await Promise.all([...changeSet.scimResource.creates.map((create) => client.createAuthSCIMResource(create.request)), ...changeSet.scimResource.updates.map((update) => client.updateAuthSCIMResource(update.request))]);
-	} else if (phase === "delete-resources") {
+	};
+	if (phase === "create-update-prerequisites" || phase === "create-update") {
+		await applyServices();
+		await applyMachineUsers();
+	}
+	if (phase === "create-update-dependents" || phase === "create-update") await applyCreateUpdateDependents();
+	if (phase === "delete-resources") {
 		await Promise.all(changeSet.scimResource.deletes.map((del) => client.deleteAuthSCIMResource(del.request)));
 		await Promise.all(changeSet.scim.deletes.map((del) => client.deleteAuthSCIMConfig(del.request)));
 		await Promise.all(changeSet.oauth2Client.deletes.map((del) => client.deleteAuthOAuth2Client(del.request)));
@@ -3748,7 +3958,7 @@ async function applyAuth(client, result, phase = "create-update") {
 		await Promise.all(changeSet.userProfileConfig.deletes.map((del) => client.deleteUserProfileConfig(del.request)));
 		await Promise.all(changeSet.idpConfig.deletes.map((del) => client.deleteAuthIDPConfig(del.request)));
 		await applyAuthConnections(client, { changeSet: changeSet.connection }, "delete-resources");
-	} else await Promise.all(changeSet.service.deletes.map((del) => client.deleteAuthService(del.request)));
+	} else if (phase === "delete-services") await Promise.all(changeSet.service.deletes.map((del) => client.deleteAuthService(del.request)));
 }
 /**
 * Plan auth-related changes based on current and desired state.
@@ -3764,7 +3974,7 @@ async function planAuth(context) {
 	}
 	const { changeSet: serviceChangeSet, conflicts, unmanaged, resourceOwners } = await planServices$2(client, workspaceId, application.name, application.id, auths, forceApplyAll);
 	const deletedServices = serviceChangeSet.deletes.map((del) => del.name);
-	const expectedLocalWebsites = new Set(application.staticWebsiteServices.map((website) => website.name));
+	const expectedLocalWebsites = expectedLocalStaticWebsiteNames(context);
 	const [idpConfigChangeSet, userProfileConfigChangeSet, tenantConfigChangeSet, machineUserChangeSet, authHookChangeSet, oauth2ClientChangeSet, scimChangeSet, scimResourceChangeSet, connectionResult] = await Promise.all([
 		planIdPConfigs(client, workspaceId, auths, deletedServices, forceApplyAll),
 		planUserProfileConfigs(client, workspaceId, auths, deletedServices, forceApplyAll),
@@ -3826,15 +4036,15 @@ async function planServices$2(client, workspaceId, appName, appId, auths, forceA
 			publishSessionEvents: config.publishSessionEvents
 		};
 		if (existing) {
-			const owned = isOwnedByApp(existing.allLabels, appName, appId);
-			if (!owned) if (!existing.label) unmanaged.push({
-				resourceType: "Auth service",
-				resourceName: config.name
-			});
-			else conflicts.push({
+			const owned = trackDesiredResourceOwnership({
+				labels: existing.allLabels,
+				ownerLabel: existing.label,
+				appName,
+				appId,
 				resourceType: "Auth service",
 				resourceName: config.name,
-				currentOwner: existing.label
+				conflicts,
+				unmanaged
 			});
 			if (!forceApplyAll && existing.resource.publishSessionEvents === (config.publishSessionEvents ?? false) && owned) changeSet.unchanged.push({ name: config.name });
 			else changeSet.updates.push({
@@ -3851,10 +4061,13 @@ async function planServices$2(client, workspaceId, appName, appId, auths, forceA
 	}
 	Object.entries(existingServices).forEach(([namespaceName]) => {
 		const entry = existingServices[namespaceName];
-		const label = entry?.label;
-		const owned = isOwnedByApp(entry?.allLabels, appName, appId);
-		if (label && !owned) resourceOwners.add(label);
-		if (owned) changeSet.deletes.push({
+		if (trackRemainingResourceOwner({
+			labels: entry?.allLabels,
+			ownerLabel: entry?.label,
+			appName,
+			appId,
+			resourceOwners
+		})) changeSet.deletes.push({
 			name: namespaceName,
 			request: {
 				workspaceId,
@@ -3872,19 +4085,14 @@ async function planServices$2(client, workspaceId, appName, appId, auths, forceA
 async function planIdPConfigs(client, workspaceId, auths, deletedServices, forceApplyAll = false) {
 	const changeSet = createChangeSet("Auth idpConfigs");
 	const fetchIdPConfigs = (namespaceName) => {
-		return fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { idpConfigs, nextPageToken } = await client.listAuthIDPConfigs({
-					workspaceId,
-					namespaceName,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [idpConfigs, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
+		return fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { idpConfigs, nextPageToken } = await client.listAuthIDPConfigs({
+				workspaceId,
+				namespaceName,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [idpConfigs, nextPageToken];
 		});
 	};
 	for (const authService of auths) {
@@ -4041,27 +4249,21 @@ async function protoBuiltinIdPConfig(client, workspaceId, builtinIdPConfig) {
 	return config;
 }
 async function tryProtoBuiltinIdPConfig(client, workspaceId, builtinIdPConfig) {
-	let idpService;
-	try {
-		idpService = await client.getIdPService({
+	const idpService = await getOrNull(async () => {
+		return await client.getIdPService({
 			workspaceId,
 			namespaceName: builtinIdPConfig.namespace
 		});
-	} catch (error) {
-		if (error instanceof ConnectError && error.code === Code.NotFound) return;
-		throw error;
-	}
-	let idpClient;
-	try {
-		idpClient = await client.getIdPClient({
+	});
+	if (!idpService) return void 0;
+	const idpClient = await getOrNull(async () => {
+		return await client.getIdPClient({
 			workspaceId,
 			namespaceName: builtinIdPConfig.namespace,
 			name: builtinIdPConfig.clientName
 		});
-	} catch (error) {
-		if (error instanceof ConnectError && error.code === Code.NotFound) return;
-		throw error;
-	}
+	});
+	if (!idpClient) return void 0;
 	const vaultName = idpClientVaultName(builtinIdPConfig.namespace, builtinIdPConfig.clientName);
 	const secretKey = idpClientSecretName(builtinIdPConfig.namespace, builtinIdPConfig.clientName);
 	return { config: {
@@ -4082,56 +4284,51 @@ async function planUserProfileConfigs(client, workspaceId, auths, deletedService
 	for (const auth of auths) {
 		const { config } = auth;
 		const name = `${config.name}-user-profile-config`;
-		try {
-			const { userProfileProviderConfig } = await client.getUserProfileConfig({
+		const existing = await getOrNull(async () => {
+			return await client.getUserProfileConfig({
 				workspaceId,
 				namespaceName: config.name
 			});
+		});
+		if (!existing) {
 			const userProfileForUpdate = auth.userProfile;
-			if (userProfileForUpdate) {
-				const desired = protoUserProfileConfig(userProfileForUpdate);
-				if (!forceApplyAll && areUserProfileConfigsEqual(userProfileProviderConfig ?? {}, desired)) changeSet.unchanged.push({ name });
-				else changeSet.updates.push({
-					name,
-					request: {
-						workspaceId,
-						namespaceName: config.name,
-						userProfileProviderConfig: desired
-					}
-				});
-			} else changeSet.deletes.push({
+			if (userProfileForUpdate) changeSet.creates.push({
 				name,
 				request: {
 					workspaceId,
-					namespaceName: config.name
+					namespaceName: config.name,
+					userProfileProviderConfig: protoUserProfileConfig(userProfileForUpdate)
 				}
 			});
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) {
-				const userProfileForCreate = auth.userProfile;
-				if (userProfileForCreate) changeSet.creates.push({
-					name,
-					request: {
-						workspaceId,
-						namespaceName: config.name,
-						userProfileProviderConfig: protoUserProfileConfig(userProfileForCreate)
-					}
-				});
-				continue;
-			}
-			throw error;
+			continue;
 		}
+		const userProfileForUpdate = auth.userProfile;
+		if (userProfileForUpdate) {
+			const desired = protoUserProfileConfig(userProfileForUpdate);
+			if (!forceApplyAll && areUserProfileConfigsEqual(existing.userProfileProviderConfig ?? {}, desired)) changeSet.unchanged.push({ name });
+			else changeSet.updates.push({
+				name,
+				request: {
+					workspaceId,
+					namespaceName: config.name,
+					userProfileProviderConfig: desired
+				}
+			});
+		} else changeSet.deletes.push({
+			name,
+			request: {
+				workspaceId,
+				namespaceName: config.name
+			}
+		});
 	}
 	for (const namespaceName of deletedServices) {
-		try {
-			await client.getUserProfileConfig({
+		if (!await getOrNull(async () => {
+			return await client.getUserProfileConfig({
 				workspaceId,
 				namespaceName
 			});
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) continue;
-			throw error;
-		}
+		})) continue;
 		changeSet.deletes.push({
 			name: `${namespaceName}-user-profile-config`,
 			request: {
@@ -4165,54 +4362,49 @@ async function planTenantConfigs(client, workspaceId, auths, deletedServices, fo
 	for (const auth of auths) {
 		const { config } = auth;
 		const name = `${config.name}-tenant-config`;
-		try {
-			const { tenantProviderConfig } = await client.getTenantConfig({
+		const existing = await getOrNull(async () => {
+			return await client.getTenantConfig({
 				workspaceId,
 				namespaceName: config.name
 			});
-			if (config.tenantProvider) {
-				const desired = protoTenantConfig(config.tenantProvider);
-				if (!forceApplyAll && areTenantProviderConfigsEqual(tenantProviderConfig, desired)) changeSet.unchanged.push({ name });
-				else changeSet.updates.push({
-					name,
-					request: {
-						workspaceId,
-						namespaceName: config.name,
-						tenantProviderConfig: desired
-					}
-				});
-			} else changeSet.deletes.push({
+		});
+		if (!existing) {
+			if (config.tenantProvider) changeSet.creates.push({
 				name,
 				request: {
 					workspaceId,
-					namespaceName: config.name
+					namespaceName: config.name,
+					tenantProviderConfig: protoTenantConfig(config.tenantProvider)
 				}
 			});
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) {
-				if (config.tenantProvider) changeSet.creates.push({
-					name,
-					request: {
-						workspaceId,
-						namespaceName: config.name,
-						tenantProviderConfig: protoTenantConfig(config.tenantProvider)
-					}
-				});
-				continue;
-			}
-			throw error;
+			continue;
 		}
+		if (config.tenantProvider) {
+			const desired = protoTenantConfig(config.tenantProvider);
+			if (!forceApplyAll && areTenantProviderConfigsEqual(existing.tenantProviderConfig, desired)) changeSet.unchanged.push({ name });
+			else changeSet.updates.push({
+				name,
+				request: {
+					workspaceId,
+					namespaceName: config.name,
+					tenantProviderConfig: desired
+				}
+			});
+		} else changeSet.deletes.push({
+			name,
+			request: {
+				workspaceId,
+				namespaceName: config.name
+			}
+		});
 	}
 	for (const namespaceName of deletedServices) {
-		try {
-			await client.getTenantConfig({
+		if (!await getOrNull(async () => {
+			return await client.getTenantConfig({
 				workspaceId,
 				namespaceName
 			});
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) continue;
-			throw error;
-		}
+		})) continue;
 		changeSet.deletes.push({
 			name: `${namespaceName}-tenant-config`,
 			request: {
@@ -4239,19 +4431,14 @@ function protoTenantConfig(tenantConfig) {
 async function planMachineUsers(client, workspaceId, auths, deletedServices, forceApplyAll = false) {
 	const changeSet = createChangeSet("Auth machineUsers");
 	const fetchMachineUsers = (authNamespace) => {
-		return fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { machineUsers, nextPageToken } = await client.listAuthMachineUsers({
-					workspaceId,
-					authNamespace,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [machineUsers, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
+		return fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { machineUsers, nextPageToken } = await client.listAuthMachineUsers({
+				workspaceId,
+				authNamespace,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [machineUsers, nextPageToken];
 		});
 	};
 	for (const auth of auths) {
@@ -4378,19 +4565,14 @@ function areOAuth2ClientsEqual(existing, desired) {
 async function planOAuth2Clients(client, workspaceId, auths, deletedServices, expectedLocalWebsites, forceApplyAll = false) {
 	const changeSet = createChangeSet("Auth oauth2Clients");
 	const fetchOAuth2Clients = (namespaceName) => {
-		return fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { oauth2Clients, nextPageToken } = await client.listAuthOAuth2Clients({
-					workspaceId,
-					namespaceName,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [oauth2Clients, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
+		return fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { oauth2Clients, nextPageToken } = await client.listAuthOAuth2Clients({
+				workspaceId,
+				namespaceName,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [oauth2Clients, nextPageToken];
 		});
 	};
 	for (const auth of auths) {
@@ -4507,26 +4689,21 @@ async function planSCIMConfigs(client, workspaceId, auths, deletedServices) {
 	for (const auth of auths) {
 		const { config } = auth;
 		const name = `${config.name}-scim-config`;
-		try {
-			await client.getAuthSCIMConfig({
+		if (!await getOrNull(async () => {
+			return await client.getAuthSCIMConfig({
 				workspaceId,
 				namespaceName: config.name
 			});
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) {
-				if (config.scim) changeSet.creates.push({
-					name,
-					request: {
-						workspaceId,
-						namespaceName: config.name,
-						scimConfig: protoSCIMConfig(config.scim)
-					}
-				});
-				continue;
-			}
-			throw error;
-		}
-		if (config.scim) changeSet.updates.push({
+		})) {
+			if (config.scim) changeSet.creates.push({
+				name,
+				request: {
+					workspaceId,
+					namespaceName: config.name,
+					scimConfig: protoSCIMConfig(config.scim)
+				}
+			});
+		} else if (config.scim) changeSet.updates.push({
 			name,
 			request: {
 				workspaceId,
@@ -4543,15 +4720,12 @@ async function planSCIMConfigs(client, workspaceId, auths, deletedServices) {
 		});
 	}
 	for (const namespaceName of deletedServices) {
-		try {
-			await client.getAuthSCIMConfig({
+		if (!await getOrNull(async () => {
+			return await client.getAuthSCIMConfig({
 				workspaceId,
 				namespaceName
 			});
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) continue;
-			throw error;
-		}
+		})) continue;
 		changeSet.deletes.push({
 			name: `${namespaceName}-scim-config`,
 			request: {
@@ -4588,16 +4762,13 @@ function protoSCIMConfig(scimConfig) {
 async function planSCIMResources(client, workspaceId, auths, deletedServices) {
 	const changeSet = createChangeSet("Auth scimResources");
 	const fetchSCIMResources = async (namespaceName) => {
-		try {
+		return await getOrNull(async () => {
 			const { scimResources } = await client.getAuthSCIMResources({
 				workspaceId,
 				namespaceName
 			});
 			return scimResources;
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [];
-			throw error;
-		}
+		}) ?? [];
 	};
 	for (const auth of auths) {
 		const { config } = auth;
@@ -4755,18 +4926,14 @@ async function planAuthHooks(client, workspaceId, auths, deletedServices, forceA
 	for (const auth of auths) {
 		const { config } = auth;
 		const beforeLogin = config.hooks?.beforeLogin;
-		let existingHook;
-		try {
+		const existingHook = await getOrNull(async () => {
 			const { hook } = await client.getAuthHook({
 				workspaceId,
 				namespaceName: config.name,
 				hookPoint: AuthHookPoint.BEFORE_LOGIN
 			});
-			existingHook = hook;
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) existingHook = void 0;
-			else throw error;
-		}
+			return hook;
+		});
 		if (beforeLogin) {
 			const hookRequest = {
 				workspaceId,
@@ -4798,291 +4965,23 @@ async function planAuthHooks(client, workspaceId, auths, deletedServices, forceA
 			}
 		});
 	}
-	for (const namespaceName of deletedServices) try {
-		await client.getAuthHook({
+	for (const namespaceName of deletedServices) if (await getOrNull(async () => {
+		return await client.getAuthHook({
 			workspaceId,
 			namespaceName,
 			hookPoint: AuthHookPoint.BEFORE_LOGIN
 		});
-		changeSet.deletes.push({
-			name: `${namespaceName}/before-login`,
-			request: {
-				workspaceId,
-				namespaceName,
-				hookPoint: AuthHookPoint.BEFORE_LOGIN
-			}
-		});
-	} catch (error) {
-		if (error instanceof ConnectError && error.code === Code.NotFound) {} else throw error;
-	}
+	})) changeSet.deletes.push({
+		name: `${namespaceName}/before-login`,
+		request: {
+			workspaceId,
+			namespaceName,
+			hookPoint: AuthHookPoint.BEFORE_LOGIN
+		}
+	});
 	return changeSet;
 }
 
-//#endregion
-//#region src/cli/commands/deploy/config-id-injector.ts
-const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function findDefineConfigCalls(node, results) {
-	if (!node || typeof node !== "object") return;
-	const n = node;
-	if (n.type === "CallExpression") {
-		const ce = n;
-		if (ce.callee.type === "Identifier" && ce.callee.name === "defineConfig") {
-			const arg = ce.arguments[0];
-			const configObj = arg && arg.type === "ObjectExpression" ? arg : null;
-			results.push({
-				callExpr: ce,
-				configObj
-			});
-		}
-	}
-	for (const key of Object.keys(n)) {
-		const child = n[key];
-		if (Array.isArray(child)) for (const c of child) findDefineConfigCalls(c, results);
-		else if (child && typeof child === "object") findDefineConfigCalls(child, results);
-	}
-}
-function findIdProperty(obj) {
-	for (const prop of obj.properties) {
-		if (prop.type !== "Property") continue;
-		if ((prop.key.type === "Identifier" ? prop.key.name : prop.key.type === "Literal" ? prop.key.value : null) === "id") return prop;
-	}
-	return null;
-}
-/**
-* Ensure `tailor.config.ts` has an `id` property on the `defineConfig({...})`
-* argument. Generates a UUID when missing and writes it back to the file.
-* Returns null when the file does not contain a `defineConfig()` call (e.g.
-* a wrapper that re-exports another config).
-* @param configPath - Absolute path to the config file
-* @returns Resolved id and whether it was newly injected, or null if skipped
-*/
-async function ensureConfigId(configPath) {
-	const source = await fs$1.promises.readFile(configPath, "utf-8");
-	const { program } = parseSync(configPath, source);
-	const calls = [];
-	findDefineConfigCalls(program, calls);
-	if (calls.length === 0) return null;
-	if (calls.length > 1) throw new Error(`Multiple defineConfig() calls found in ${configPath}. Only one is supported.`);
-	const { configObj } = assertDefined(calls[0], "defineConfig call site missing");
-	if (!configObj) throw new Error(`defineConfig() argument must be an inline object literal in ${configPath} so the SDK can manage the 'id' field.`);
-	const idProp = findIdProperty(configObj);
-	if (idProp) {
-		const value = idProp.value;
-		if (value.type !== "Literal") throw new Error(`'id' field in ${configPath} must be a string literal. To use this config for a separate app, delete it.`);
-		const literalValue = value.value;
-		if (typeof literalValue !== "string" || literalValue === "") throw new Error(`'id' field in ${configPath} must be a non-empty string literal. To use this config for a separate app, delete it.`);
-		if (!uuidRegex.test(literalValue)) throw new Error(`'id' field in ${configPath} must be a UUID. To use this config for a separate app, delete it.`);
-		return {
-			id: literalValue,
-			injected: false
-		};
-	}
-	const id = crypto.randomUUID();
-	const newSource = insertIdProperty(source, configObj, id);
-	await fs$1.promises.writeFile(configPath, newSource, "utf-8");
-	logger.info(`Generated app id and wrote to ${configPath}: ${id}`);
-	return {
-		id,
-		injected: true
-	};
-}
-/**
-* Read the resolved `defineConfig({...})` `id` from a config file without
-* mutating it. Returns null when the file has no inline `defineConfig()` call
-* (wrapper/re-export config), and `{ id: null }` when the call exists but has
-* no usable `id` property.
-* @param configPath - Absolute path to the config file
-* @returns The existing id (or null when absent), or null for wrapper configs
-*/
-async function readConfigId(configPath) {
-	const { program } = parseSync(configPath, await fs$1.promises.readFile(configPath, "utf-8"));
-	const calls = [];
-	findDefineConfigCalls(program, calls);
-	if (calls.length === 0) return null;
-	if (calls.length > 1) throw new Error(`Multiple defineConfig() calls found in ${configPath}. Only one is supported.`);
-	const { configObj } = assertDefined(calls[0], "defineConfig call site missing");
-	if (!configObj) throw new Error(`defineConfig() argument must be an inline object literal in ${configPath} so the SDK can manage the 'id' field.`);
-	const idProp = findIdProperty(configObj);
-	if (!idProp || idProp.value.type !== "Literal") return { id: null };
-	const value = idProp.value.value;
-	return { id: typeof value === "string" && value !== "" ? value : null };
-}
-/**
-* Read-only CI check: the config must already carry a valid app id.
-* Wrapper/re-export configs (no inline defineConfig call) are exempt,
-* mirroring the local behavior where {@link ensureConfigId} no-ops.
-* @param configPath - Absolute path to the config file
-*/
-async function assertConfigIdInCI(configPath) {
-	const result = await readConfigId(configPath);
-	if (result === null) return;
-	if (!result.id) throw new Error("tailor.config.ts is missing an 'id'. CI does not auto-generate one (each run would be treated as a separate app and break resource ownership). Run 'tailor-sdk setup' or 'tailor-sdk apply' locally and commit the injected id.");
-	if (!uuidRegex.test(result.id)) throw new Error(`'id' in ${configPath} must be a UUID. To use this config for a separate app, delete it.`);
-}
-/**
-* Ensure the config has an app id for a deploy run.
-*
-* Locally, the id is auto-injected when missing (via {@link ensureConfigId}).
-* In CI, the id is never auto-injected — a missing id is a hard error, because
-* generating one per run would create a fresh app each time and break resource
-* ownership. CI dry-runs (plan) perform the same check read-only, so a
-* forgotten id fails at PR time instead of at deploy. Ephemeral pipelines that
-* intentionally deploy a fresh app per run (such as e2e harnesses) can opt
-* back into injection with `TAILOR_PLATFORM_SDK_ALLOW_CI_ID_INJECTION=true`.
-* Local dry-run and build-only flows skip both injection and the check (no
-* on-disk side effects are expected, and build-only never talks to the
-* platform).
-* @param obj - Inputs
-* @param obj.configPath - Absolute path to the config file
-* @param obj.dryRun - Whether this is a dry-run
-* @param obj.buildOnly - Whether this is a build-only run
-*/
-async function ensureConfigIdForDeploy(obj) {
-	const { configPath, dryRun, buildOnly } = obj;
-	if (buildOnly) return;
-	const allowCIInjection = parseBoolean(process.env.TAILOR_PLATFORM_SDK_ALLOW_CI_ID_INJECTION) === true;
-	const strictCI = isCI && !allowCIInjection;
-	if (dryRun) {
-		if (strictCI) await assertConfigIdInCI(configPath);
-		return;
-	}
-	if (strictCI) {
-		await assertConfigIdInCI(configPath);
-		return;
-	}
-	await ensureConfigId(configPath);
-}
-const idComment = "// SDK-managed app id — do not edit, except when copying this config to a separate app.";
-function insertIdProperty(source, configObj, id) {
-	const idLiteral = `id: ${JSON.stringify(id)}`;
-	if (configObj.properties.length > 0) {
-		const firstProp = assertDefined(configObj.properties[0], "first property missing");
-		const lineStart = source.lastIndexOf("\n", firstProp.start - 1) + 1;
-		const indent = source.slice(lineStart, firstProp.start);
-		if (!/^[\t ]*$/.test(indent)) return source.slice(0, firstProp.start) + `${idLiteral}, ` + source.slice(firstProp.start);
-		const insertion = `${idComment}\n${indent}${idLiteral},\n${indent}`;
-		return source.slice(0, firstProp.start) + insertion + source.slice(firstProp.start);
-	}
-	const openBracePos = configObj.start + 1;
-	const braceLineStart = source.lastIndexOf("\n", configObj.start) + 1;
-	const baseIndent = source.slice(braceLineStart).match(/^[\t ]*/)?.[0] ?? "";
-	const innerIndent = `${baseIndent}  `;
-	const insertion = `\n${innerIndent}${idComment}\n${innerIndent}${idLiteral},\n${baseIndent}`;
-	return source.slice(0, openBracePos) + insertion + source.slice(openBracePos);
-}
-
-//#endregion
-//#region src/cli/commands/deploy/confirm.ts
-/**
-* Confirm reassignment of resources when owner conflicts are detected.
-* Splits into two scenarios: id regeneration (same sdk-name, different
-* sdk-app-id) and name mismatch (different sdk-name). Each gets its own
-* prompt because the user-facing meaning is different.
-* @param conflicts - Detected owner conflicts
-* @param appName - Target application name
-* @param yes - Whether to auto-confirm without prompting
-* @returns Promise that resolves when confirmation completes
-*/
-async function confirmOwnerConflict(conflicts, appName, yes) {
-	if (conflicts.length === 0) return;
-	const idRegenerated = conflicts.filter((c) => c.currentOwner === appName);
-	const nameMismatches = conflicts.filter((c) => c.currentOwner !== appName);
-	if (idRegenerated.length > 0) await confirmIdRegeneration(idRegenerated, appName, yes);
-	if (nameMismatches.length > 0) await confirmNameMismatch(nameMismatches, appName, yes);
-}
-async function confirmIdRegeneration(conflicts, appName, yes) {
-	logger.warn(`Application id was regenerated for "${appName}":`);
-	logger.log("  These resources still carry the previous id.");
-	logger.newline();
-	logger.log(`  ${styles.info("Resources")}:`);
-	for (const c of conflicts) logger.log(`    • ${styles.bold(c.resourceType)} ${styles.info(`"${c.resourceName}"`)}`);
-	if (yes) {
-		logger.success("Re-tagging resources with the new id (--yes flag specified)...", { mode: "plain" });
-		return;
-	}
-	if (!await prompt.confirm({
-		message: `Re-tag these resources with the new id for "${appName}"?\n${styles.dim("(The id in tailor.config.ts was removed since the previous deploy, so a new one was generated)")}`,
-		default: false
-	})) throw new Error(multiline`
-      Apply cancelled. Resources remain tagged with the previous id.
-      To override, run again and confirm, or use --yes flag.
-    `);
-}
-async function confirmNameMismatch(conflicts, appName, yes) {
-	const currentOwners = [...new Set(conflicts.map((c) => c.currentOwner))];
-	logger.warn("Application name mismatch detected:");
-	logger.log(`  ${styles.warning("Current application(s)")}: ${currentOwners.map((o) => styles.bold(`"${o}"`)).join(", ")}`);
-	logger.log(`  ${styles.success("New application")}:        ${styles.bold(`"${appName}"`)}`);
-	logger.newline();
-	logger.log(`  ${styles.info("Resources")}:`);
-	for (const c of conflicts) logger.log(`    • ${styles.bold(c.resourceType)} ${styles.info(`"${c.resourceName}"`)}`);
-	if (yes) {
-		logger.success("Updating resources (--yes flag specified)...", { mode: "plain" });
-		return;
-	}
-	const promptMessage = currentOwners.length === 1 ? `Update these resources to be managed by "${appName}"?\n${styles.dim("(Common when renaming your application)")}` : `Update these resources to be managed by "${appName}"?`;
-	if (!await prompt.confirm({
-		message: promptMessage,
-		default: false
-	})) throw new Error(multiline`
-      Apply cancelled. Resources remain managed by their current applications.
-      To override, run again and confirm, or use --yes flag.
-    `);
-}
-/**
-* Confirm allowing tailor-sdk to manage previously unmanaged resources.
-* @param resources - Unmanaged resources
-* @param appName - Target application name
-* @param yes - Whether to auto-confirm without prompting
-* @returns Promise that resolves when confirmation completes
-*/
-async function confirmUnmanagedResources(resources, appName, yes) {
-	if (resources.length === 0) return;
-	logger.warn("Existing resources not tracked by tailor-sdk were found:");
-	logger.log(`  ${styles.info("Resources")}:`);
-	for (const r of resources) logger.log(`    • ${styles.bold(r.resourceType)} ${styles.info(`"${r.resourceName}"`)}`);
-	logger.newline();
-	logger.log("  These resources may have been created by older SDK versions, Terraform, or CUE.");
-	logger.log("  To continue, confirm that tailor-sdk should manage them.");
-	logger.log("  If they are managed by another tool (e.g., Terraform), cancel and manage them there instead.");
-	if (yes) {
-		logger.success(`Adding to "${appName}" (--yes flag specified)...`, { mode: "plain" });
-		return;
-	}
-	if (!await prompt.confirm({
-		message: `Allow tailor-sdk to manage these resources for "${appName}"?`,
-		default: false
-	})) throw new Error(multiline`
-      Apply cancelled. Resources remain unmanaged.
-      To override, run again and confirm, or use --yes flag.
-    `);
-}
-/**
-* Confirm deletion of important resources.
-* @param resources - Resources scheduled for deletion
-* @param yes - Whether to auto-confirm without prompting
-* @returns Promise that resolves when confirmation completes
-*/
-async function confirmImportantResourceDeletion(resources, yes) {
-	if (resources.length === 0) return;
-	logger.warn("The following resources will be deleted:");
-	logger.log(`  ${styles.info("Resources")}:`);
-	for (const r of resources) logger.log(`    • ${styles.bold(r.resourceType)} ${styles.error(`"${r.resourceName}"`)}`);
-	logger.newline();
-	logger.log(styles.warning("  Deleting these resources will permanently remove all associated data."));
-	if (yes) {
-		logger.success("Deleting resources (--yes flag specified)...", { mode: "plain" });
-		return;
-	}
-	if (!await prompt.confirm({
-		message: "Are you sure you want to delete these resources?",
-		default: false
-	})) throw new Error(multiline`
-      Apply cancelled. Resources will not be deleted.
-      To override, run again and confirm, or use --yes flag.
-    `);
-}
-
 //#endregion
 //#region src/cli/commands/deploy/auth-invoker.ts
 /**
@@ -5161,7 +5060,7 @@ async function planExecutor(context) {
 			appName: application.name,
 			appId: application.id
 		});
-		const desiredExecutor = protoExecutor(application, executor);
+		const desiredExecutor = protoExecutor(context, executor);
 		if (existing) {
 			if (trackDesiredResourceOwnership({
 				labels: existing.allLabels,
@@ -5293,35 +5192,101 @@ function normalizeComparableExecutor(executor) {
 function areExecutorsEqual(existing, desired) {
 	return areNormalizedEqual(normalizeComparableExecutor(existing), normalizeComparableExecutor(desired));
 }
-function resolveTailorDBNamespace(application, typeName) {
-	for (const service of application.tailorDBServices) if (Object.hasOwn(service.types, typeName)) return service.namespace;
-	throw new Error(`TailorDB type "${typeName}" not found in any namespace. Available namespaces: ${application.tailorDBServices.map((s) => s.namespace).join(", ")}`);
+/**
+* Resolve a resource's namespace from same-run peer configs, throwing when the
+* name is claimed by more than one namespace in the deploy run.
+* @param sameRunNamespaces - Namespaces keyed by resource name across the deploy run
+* @param resourceName - Resource name to resolve
+* @param resourceLabel - Resource label used in error messages
+* @returns The owning namespace, or undefined when the name is unknown
+*/
+function resolveSameRunNamespace(sameRunNamespaces, resourceName, resourceLabel) {
+	if (!sameRunNamespaces?.has(resourceName)) return;
+	const namespace = sameRunNamespaces.get(resourceName);
+	if (!namespace) throw new Error(`${resourceLabel} "${resourceName}" is defined in multiple namespaces in this deploy run. Move the trigger to the application that owns it or use unique names.`);
+	return namespace;
+}
+/**
+* Find the local TailorDB namespace that declares the given type.
+* @param application - Loaded application
+* @param typeName - TailorDB type name to look up
+* @returns The declaring namespace, or undefined when no local service has it
+*/
+function findTailorDBNamespace(application, typeName) {
+	return application.tailorDBServices.find((service) => Object.hasOwn(service.types, typeName))?.namespace;
+}
+/**
+* Find the local resolver namespace that declares the given resolver.
+* @param application - Loaded application
+* @param resolverName - Resolver name to look up
+* @returns The declaring namespace, or undefined when no local service has it
+*/
+function findResolverNamespace(application, resolverName) {
+	return application.resolverServices.find((service) => Object.values(service.resolvers).some((resolver) => resolver.name === resolverName))?.namespace;
+}
+function resolveNamespace(params) {
+	const { resourceLabel, resourceName, localNamespaces, findLocalNamespace, sameRunNamespaces } = params;
+	const localNamespace = findLocalNamespace();
+	if (localNamespace !== void 0) return localNamespace;
+	const sameRunNamespace = resolveSameRunNamespace(sameRunNamespaces, resourceName, resourceLabel);
+	if (sameRunNamespace !== void 0) return sameRunNamespace;
+	const sameRunAvailableNamespaces = sameRunNamespaces ? [...new Set([...sameRunNamespaces.values()].filter((value) => value !== void 0))] : [];
+	const availableNamespaces = [...localNamespaces, ...sameRunAvailableNamespaces];
+	throw new Error(`${resourceLabel} "${resourceName}" not found in any namespace. Available namespaces: ${availableNamespaces.join(", ")}`);
+}
+function resolveTailorDBNamespace(application, typeName, sameRunNamespaces) {
+	return resolveNamespace({
+		resourceLabel: "TailorDB type",
+		resourceName: typeName,
+		localNamespaces: application.tailorDBServices.map((service) => service.namespace),
+		findLocalNamespace: () => findTailorDBNamespace(application, typeName),
+		sameRunNamespaces
+	});
 }
-function resolveResolverNamespace(application, resolverName) {
-	for (const service of application.resolverServices) if (Object.values(service.resolvers).some((r) => r.name === resolverName)) return service.namespace;
-	throw new Error(`Resolver "${resolverName}" not found in any namespace. Available namespaces: ${application.resolverServices.map((s) => s.namespace).join(", ")}`);
+function resolveResolverNamespace(application, resolverName, sameRunNamespaces) {
+	return resolveNamespace({
+		resourceLabel: "Resolver",
+		resourceName: resolverName,
+		localNamespaces: application.resolverServices.map((service) => service.namespace),
+		findLocalNamespace: () => findResolverNamespace(application, resolverName),
+		sameRunNamespaces
+	});
 }
-function resolveIdpNamespace(application, executorName, idpName) {
-	if (application.idpServices.length === 0) throw new Error(`Executor "${executorName}" uses an idpUser trigger but no IdP is configured.`);
+/**
+* Collect IdP names declared by the application, including external IdP
+* subgraphs.
+* @param application - Loaded application
+* @returns IdP names visible from the application config
+*/
+function collectApplicationIdpNames(application) {
+	const names = new Set(application.idpServices.map((idp) => idp.name));
+	for (const subgraph of application.subgraphs) if (subgraph.Type === "idp") names.add(subgraph.Name);
+	return names;
+}
+function resolveIdpNamespace(application, executorName, idpName, sameRunIdpNames) {
+	const localIdpNames = collectApplicationIdpNames(application);
 	if (idpName !== void 0) {
-		const found = application.idpServices.find((idp) => idp.name === idpName);
-		if (!found) {
-			const available = application.idpServices.map((idp) => idp.name).join(", ");
+		const candidateNames = sameRunIdpNames ?? localIdpNames;
+		if (!candidateNames.has(idpName)) {
+			const available = [...candidateNames].join(", ");
 			throw new Error(`Executor "${executorName}" specifies IdP "${idpName}" in its idpUser trigger, but no IdP with that name is configured. Available IdPs: ${available}`);
 		}
-		return found.name;
+		return idpName;
 	}
-	if (application.idpServices.length > 1) {
-		const available = application.idpServices.map((idp) => idp.name).join(", ");
+	if (localIdpNames.size === 0) throw new Error(`Executor "${executorName}" uses an idpUser trigger but no IdP is configured.`);
+	if (localIdpNames.size > 1) {
+		const available = [...localIdpNames].join(", ");
 		throw new Error(`Executor "${executorName}" uses an idpUser trigger but the project defines multiple IdPs (${available}). Specify which IdP to subscribe to via the trigger's "idp" option.`);
 	}
-	return assertDefined(application.idpServices[0], "idp service missing").name;
+	return assertDefined([...localIdpNames][0], "idp service missing");
 }
 function resolveAuthNamespace(application) {
-	if (!application.authService) throw new Error("No Auth service configured");
-	return application.authService.config.name;
+	const authNamespace = application.authService?.config.name ?? application.config.auth?.name;
+	if (!authNamespace) throw new Error("No Auth service configured");
+	return authNamespace;
 }
-function protoExecutor(application, executor) {
+function protoExecutor(context, executor) {
+	const { application } = context;
 	const appName = application.name;
 	const env = application.env;
 	const trigger = executor.trigger;
@@ -5351,7 +5316,7 @@ function protoExecutor(application, executor) {
 				case: "tailordb",
 				value: {
 					eventTypes: trigger.events,
-					namespaceName: resolveTailorDBNamespace(application, trigger.typeName),
+					namespaceName: resolveTailorDBNamespace(application, trigger.typeName, context.tailorDBTypeNamespaces),
 					typeName: trigger.typeName,
 					...trigger.condition ? { condition: { expr: `(${stringifyFunction(trigger.condition)})(${argsExpr})` } } : {}
 				}
@@ -5363,7 +5328,7 @@ function protoExecutor(application, executor) {
 				case: "pipeline",
 				value: {
 					eventTypes: ["pipeline.resolver.executed"],
-					namespaceName: resolveResolverNamespace(application, trigger.resolverName),
+					namespaceName: resolveResolverNamespace(application, trigger.resolverName, context.resolverNamespaces),
 					resolverName: trigger.resolverName,
 					...trigger.condition ? { condition: { expr: `(${stringifyFunction(trigger.condition)})(${argsExpr})` } } : {}
 				}
@@ -5385,7 +5350,7 @@ function protoExecutor(application, executor) {
 				case: "idp",
 				value: {
 					eventTypes: trigger.events,
-					namespaceName: resolveIdpNamespace(application, executor.name, trigger.idp)
+					namespaceName: resolveIdpNamespace(application, executor.name, trigger.idp, context.idpNames)
 				}
 			});
 			break;
@@ -5560,7 +5525,8 @@ async function planPipeline(context) {
 	}
 	const executors = forRemoval ? [] : Object.values(await application.executorService?.loadExecutors() ?? {});
 	const { changeSet: serviceChangeSet, conflicts, unmanaged, resourceOwners } = await planServices$1(client, workspaceId, application.name, application.id, pipelines);
-	const { changeSet: resolverChangeSet } = await planResolvers(client, workspaceId, pipelines, executors, serviceChangeSet.deletes.map((del) => del.name), application.env, application.authService?.config.name, forceApplyAll);
+	const deletedServices = serviceChangeSet.deletes.map((del) => del.name);
+	const { changeSet: resolverChangeSet } = await planResolvers(client, workspaceId, pipelines, executors, context.executorUsedResolvers ?? /* @__PURE__ */ new Set(), deletedServices, application.env, application.authService?.config.name, forceApplyAll);
 	return {
 		changeSet: {
 			service: serviceChangeSet,
@@ -5597,17 +5563,16 @@ async function planServices$1(client, workspaceId, appName, appId, pipelines) {
 			appId
 		});
 		if (existing) {
-			const owned = isOwnedByApp(existing.allLabels, appName, appId);
-			if (!owned) if (!existing.label) unmanaged.push({
-				resourceType: "Pipeline service",
-				resourceName: pipeline.namespace
-			});
-			else conflicts.push({
+			if (trackDesiredResourceOwnership({
+				labels: existing.allLabels,
+				ownerLabel: existing.label,
+				appName,
+				appId,
 				resourceType: "Pipeline service",
 				resourceName: pipeline.namespace,
-				currentOwner: existing.label
-			});
-			if (owned && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels)) changeSet.unchanged.push({ name: pipeline.namespace });
+				conflicts,
+				unmanaged
+			}) && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels)) changeSet.unchanged.push({ name: pipeline.namespace });
 			else changeSet.updates.push({
 				name: pipeline.namespace,
 				request: {
@@ -5628,10 +5593,13 @@ async function planServices$1(client, workspaceId, appName, appId, pipelines) {
 	}
 	Object.entries(existingServices).forEach(([namespaceName]) => {
 		const entry = existingServices[namespaceName];
-		const label = entry?.label;
-		const owned = isOwnedByApp(entry?.allLabels, appName, appId);
-		if (label && !owned) resourceOwners.add(label);
-		if (owned) changeSet.deletes.push({
+		if (trackRemainingResourceOwner({
+			labels: entry?.allLabels,
+			ownerLabel: entry?.label,
+			appName,
+			appId,
+			resourceOwners
+		})) changeSet.deletes.push({
 			name: namespaceName,
 			request: {
 				workspaceId,
@@ -5646,25 +5614,20 @@ async function planServices$1(client, workspaceId, appName, appId, pipelines) {
 		resourceOwners
 	};
 }
-async function planResolvers(client, workspaceId, pipelines, executors, deletedServices, env, authNamespace, forceApplyAll = false) {
+async function planResolvers(client, workspaceId, pipelines, executors, initialExecutorUsedResolvers, deletedServices, env, authNamespace, forceApplyAll = false) {
 	const changeSet = createChangeSet("Pipeline resolvers");
 	const fetchResolvers = (namespaceName) => {
-		return fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { pipelineResolvers, nextPageToken } = await client.listPipelineResolvers({
-					workspaceId,
-					namespaceName,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [pipelineResolvers, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
+		return fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { pipelineResolvers, nextPageToken } = await client.listPipelineResolvers({
+				workspaceId,
+				namespaceName,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [pipelineResolvers, nextPageToken];
 		});
 	};
-	const executorUsedResolvers = /* @__PURE__ */ new Set();
+	const executorUsedResolvers = new Set(initialExecutorUsedResolvers);
 	for (const executor of executors) if (executor.trigger.kind === "resolverExecuted") executorUsedResolvers.add(executor.trigger.resolverName);
 	for (const pipeline of pipelines) for (const resolver of Object.values(pipeline.resolvers)) if (executorUsedResolvers.has(resolver.name) && resolver.publishEvents === false) throw new Error(`Resolver "${resolver.name}" has publishEvents set to false, but it is used by an executor with a resolverExecuted trigger. Either remove the publishEvents: false setting or remove the executor trigger for this resolver.`);
 	for (const pipeline of pipelines) {
@@ -5844,453 +5807,249 @@ function protoFields(fields, baseName, isInput) {
 			description: field.metadata.description,
 			array: field.metadata.array ?? false,
 			required,
-			type
-		};
-	});
-}
-
-//#endregion
-//#region src/cli/commands/deploy/secret-manager.ts
-/**
-* Build the CreateSecretManagerVault request for a planned vault create.
-* @param create - Planned vault create
-* @returns Request init shape
-*/
-function vaultCreateRequest(create) {
-	return {
-		workspaceId: create.workspaceId,
-		secretmanagerVaultName: create.name
-	};
-}
-/**
-* Build the CreateSecretManagerSecret request for a planned secret create.
-* @param create - Planned secret create
-* @returns Request init shape
-*/
-function secretCreateRequest(create) {
-	return {
-		workspaceId: create.workspaceId,
-		secretmanagerVaultName: create.vaultName,
-		secretmanagerSecretName: create.secretName,
-		secretmanagerSecretValue: create.value
-	};
-}
-/**
-* Build the UpdateSecretManagerSecret request for a planned secret update.
-* @param update - Planned secret update
-* @returns Request init shape
-*/
-function secretUpdateRequest(update) {
-	return {
-		workspaceId: update.workspaceId,
-		secretmanagerVaultName: update.vaultName,
-		secretmanagerSecretName: update.secretName,
-		secretmanagerSecretValue: update.value
-	};
-}
-/**
-* Plan secret manager changes based on current and desired state.
-* @param context - Planning context
-* @returns Planned changes for vaults and secrets
-*/
-async function planSecretManager(context) {
-	const { client, workspaceId, application, forRemoval, forceApplyAll = false } = context;
-	const secretVaults = forRemoval ? [] : application.secrets;
-	const vaultChangeSet = createChangeSet("Secret Manager vaults");
-	const secretChangeSet = createChangeSet("Secret Manager secrets");
-	const conflicts = [];
-	const unmanaged = [];
-	const resourceOwners = /* @__PURE__ */ new Set();
-	const existingVaults = await fetchExistingResourcesWithLabels({
-		client,
-		fetchPage: async (pageToken, maxPageSize) => {
-			const { vaults, nextPageToken } = await client.listSecretManagerVaults({
-				workspaceId,
-				pageToken,
-				pageSize: maxPageSize
-			});
-			return [vaults, nextPageToken];
-		},
-		getName: (resource) => resource.name,
-		getTrn: (name) => resourceTrn(workspaceId, "vault", name)
-	});
-	const state = loadSecretsState();
-	const skippedSecrets = [];
-	await Promise.all(secretVaults.map(async (vault) => {
-		const vaultName = vault.vaultName;
-		const existing = existingVaults[vaultName];
-		if (existing) {
-			const metaRequest = await buildMetaRequest({
-				trn: resourceTrn(workspaceId, "vault", vaultName),
-				appName: application.name,
-				appId: application.id
-			});
-			const owned = isOwnedByApp(existing.allLabels, application.name, application.id);
-			if (!owned) if (!existing.label) unmanaged.push({
-				resourceType: "Secret Manager vault",
-				resourceName: vaultName
-			});
-			else conflicts.push({
-				resourceType: "Secret Manager vault",
-				resourceName: vaultName,
-				currentOwner: existing.label
-			});
-			if (owned && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels)) vaultChangeSet.unchanged.push({ name: vaultName });
-			else vaultChangeSet.updates.push({
-				name: vaultName,
-				workspaceId
-			});
-			delete existingVaults[vaultName];
-		} else vaultChangeSet.creates.push({
-			name: vaultName,
-			workspaceId
-		});
-		let existingSecrets = [];
-		if (existing) existingSecrets = (await fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { secrets, nextPageToken } = await client.listSecretManagerSecrets({
-					workspaceId,
-					secretmanagerVaultName: vaultName,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [secrets, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
-		})).map((s) => s.name);
-		const existingSet = new Set(existingSecrets);
-		for (const secret of vault.secrets) {
-			if (secret.value == null) {
-				existingSet.delete(secret.name);
-				skippedSecrets.push(`${vaultName}/${secret.name}`);
-				continue;
-			}
-			if (existingSet.has(secret.name)) {
-				const currentHash = hashValue(secret.value);
-				const storedHash = state.vaults[vaultName]?.[secret.name];
-				if (forceApplyAll || currentHash !== storedHash) secretChangeSet.updates.push({
-					name: `${vaultName}/${secret.name}`,
-					secretName: secret.name,
-					workspaceId,
-					vaultName,
-					value: secret.value
-				});
-				existingSet.delete(secret.name);
-			} else secretChangeSet.creates.push({
-				name: `${vaultName}/${secret.name}`,
-				secretName: secret.name,
-				workspaceId,
-				vaultName,
-				value: secret.value
-			});
-		}
-		for (const orphanName of existingSet) secretChangeSet.deletes.push({
-			name: `${vaultName}/${orphanName}`,
-			secretName: orphanName,
-			workspaceId,
-			vaultName
-		});
-	}));
-	for (const [name, entry] of Object.entries(existingVaults)) {
-		if (!entry) continue;
-		const label = entry.label;
-		const owned = isOwnedByApp(entry.allLabels, application.name, application.id);
-		if (label && !owned) resourceOwners.add(label);
-		if (owned) {
-			const secrets = await fetchAll(async (pageToken, maxPageSize) => {
-				try {
-					const { secrets, nextPageToken } = await client.listSecretManagerSecrets({
-						workspaceId,
-						secretmanagerVaultName: name,
-						pageToken,
-						pageSize: maxPageSize
-					});
-					return [secrets, nextPageToken];
-				} catch (error) {
-					if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-					throw error;
-				}
-			});
-			for (const secret of secrets) secretChangeSet.deletes.push({
-				name: `${name}/${secret.name}`,
-				secretName: secret.name,
-				workspaceId,
-				vaultName: name
-			});
-			vaultChangeSet.deletes.push({
-				name,
-				workspaceId
-			});
-		}
-	}
+			type
+		};
+	});
+}
+
+//#endregion
+//#region src/cli/commands/deploy/secret-manager.ts
+/**
+* Build the CreateSecretManagerVault request for a planned vault create.
+* @param create - Planned vault create
+* @returns Request init shape
+*/
+function vaultCreateRequest(create) {
 	return {
-		vaultChangeSet,
-		secretChangeSet,
-		skippedSecrets,
-		conflicts,
-		unmanaged,
-		resourceOwners
+		workspaceId: create.workspaceId,
+		secretmanagerVaultName: create.name
 	};
 }
 /**
-* Apply secret manager changes for the given phase.
-* @param client - Operator client instance
-* @param result - Planned secret changes
-* @param phase - Apply phase
-* @param application - Application to read secrets from for hash state persistence
-* @returns Promise that resolves when secret changes are applied
+* Build the CreateSecretManagerSecret request for a planned secret create.
+* @param create - Planned secret create
+* @returns Request init shape
 */
-async function applySecretManager(client, result, phase = "create-update", application) {
-	const { vaultChangeSet, secretChangeSet } = result;
-	if (phase === "create-update") {
-		await Promise.all(vaultChangeSet.creates.map(async (create) => {
-			await client.createSecretManagerVault(vaultCreateRequest(create));
-			if (application) {
-				const metaRequest = await buildMetaRequest({
-					trn: resourceTrn(create.workspaceId, "vault", create.name),
-					appName: application.name,
-					appId: application.id
-				});
-				await client.setMetadata(metaRequest);
-			}
-		}));
-		if (application) await Promise.all(vaultChangeSet.updates.map(async (update) => {
-			const metaRequest = await buildMetaRequest({
-				trn: resourceTrn(update.workspaceId, "vault", update.name),
-				appName: application.name,
-				appId: application.id
-			});
-			await client.setMetadata(metaRequest);
-		}));
-		await Promise.all(secretChangeSet.creates.map((create) => client.createSecretManagerSecret(secretCreateRequest(create))));
-		await Promise.all(secretChangeSet.updates.map((update) => client.updateSecretManagerSecret(secretUpdateRequest(update))));
-		if (application) {
-			const state = loadSecretsState();
-			for (const vault of application.secrets) {
-				if (!Object.hasOwn(state.vaults, vault.vaultName)) state.vaults[vault.vaultName] = {};
-				for (const secret of vault.secrets) if (secret.value != null) assertDefined(state.vaults[vault.vaultName], "vault state entry missing")[secret.name] = hashValue(secret.value);
-			}
-			saveSecretsState(state);
-		}
-	} else {
-		await Promise.all(secretChangeSet.deletes.map((del) => client.deleteSecretManagerSecret({
-			workspaceId: del.workspaceId,
-			secretmanagerVaultName: del.vaultName,
-			secretmanagerSecretName: del.secretName
-		})));
-		await Promise.all(vaultChangeSet.deletes.map((del) => client.deleteSecretManagerVault({
-			workspaceId: del.workspaceId,
-			secretmanagerVaultName: del.name
-		})));
-		if (secretChangeSet.deletes.length > 0 || vaultChangeSet.deletes.length > 0) {
-			const state = loadSecretsState();
-			for (const del of secretChangeSet.deletes) if (Object.hasOwn(state.vaults, del.vaultName)) {
-				delete assertDefined(state.vaults[del.vaultName], "vault state entry missing")[del.secretName];
-				if (Object.keys(assertDefined(state.vaults[del.vaultName], "vault state entry missing")).length === 0) delete state.vaults[del.vaultName];
-			}
-			for (const del of vaultChangeSet.deletes) delete state.vaults[del.name];
-			saveSecretsState(state);
-		}
-	}
+function secretCreateRequest(create) {
+	return {
+		workspaceId: create.workspaceId,
+		secretmanagerVaultName: create.vaultName,
+		secretmanagerSecretName: create.secretName,
+		secretmanagerSecretValue: create.value
+	};
 }
-
-//#endregion
-//#region src/cli/commands/deploy/staticwebsite.ts
 /**
-* Apply static website changes for the given phase.
-* @param client - Operator client instance
-* @param result - Planned static website changes
-* @param phase - Apply phase
-* @returns Promise that resolves when static websites are applied
+* Build the UpdateSecretManagerSecret request for a planned secret update.
+* @param update - Planned secret update
+* @returns Request init shape
 */
-async function applyStaticWebsite(client, result, phase = "create-update") {
-	const { changeSet, customDomainChangeSet } = result;
-	if (phase === "create-update") {
-		await Promise.all([...changeSet.creates.map(async (create) => {
-			await client.createStaticWebsite(create.request);
-			await client.setMetadata(create.metaRequest);
-		}), ...changeSet.updates.map(async (update) => {
-			await client.updateStaticWebsite(update.request);
-			await client.setMetadata(update.metaRequest);
-		})]);
-		await Promise.all([...customDomainChangeSet.creates.map(async (add) => {
-			await client.addCustomDomain(add.request);
-			await client.setMetadata(add.metaRequest);
-		}), ...customDomainChangeSet.deletes.map((del) => client.removeCustomDomain(del.request))]);
-	} else await Promise.all(changeSet.deletes.map((del) => client.deleteStaticWebsite(del.request)));
-}
-function customDomainTrn(workspaceId, websiteName, domain) {
-	return `trn:v1:workspace:${workspaceId}:staticwebsite:${websiteName}:custom_domain:${domain}`;
-}
-function normalizeComparableStaticWebsiteShape(input) {
+function secretUpdateRequest(update) {
 	return {
-		description: input.description,
-		allowedIpAddresses: input.allowedIpAddresses.toSorted()
+		workspaceId: update.workspaceId,
+		secretmanagerVaultName: update.vaultName,
+		secretmanagerSecretName: update.secretName,
+		secretmanagerSecretValue: update.value
 	};
 }
-function normalizeComparableStaticWebsite(input) {
-	return normalizeComparableStaticWebsiteShape({
-		description: input.description || "",
-		allowedIpAddresses: [...input.allowedIpAddresses || []]
-	});
-}
-function areStaticWebsitesEqual(existing, desired) {
-	return areNormalizedEqual(normalizeComparableStaticWebsite(existing), normalizeComparableStaticWebsite(desired));
-}
 /**
-* Plan static website changes based on current and desired state.
+* Plan secret manager changes based on current and desired state.
 * @param context - Planning context
-* @returns Planned changes
+* @returns Planned changes for vaults and secrets
 */
-async function planStaticWebsite(context) {
-	const { client, workspaceId, application, forRemoval } = context;
-	const changeSet = createChangeSet("StaticWebsites");
-	const customDomainChangeSet = createChangeSet("CustomDomains");
+async function planSecretManager(context) {
+	const { client, workspaceId, application, forRemoval, forceApplyAll = false } = context;
+	const secretVaults = forRemoval ? [] : application.secrets;
+	const vaultChangeSet = createChangeSet("Secret Manager vaults");
+	const secretChangeSet = createChangeSet("Secret Manager secrets");
 	const conflicts = [];
 	const unmanaged = [];
 	const resourceOwners = /* @__PURE__ */ new Set();
-	const existingWebsites = await fetchExistingResourcesWithLabels({
+	const existingVaults = await fetchExistingResourcesWithLabels({
 		client,
-		fetchPage: async (pageToken, pageSize) => {
-			const { staticwebsites, nextPageToken } = await client.listStaticWebsites({
+		fetchPage: async (pageToken, maxPageSize) => {
+			const { vaults, nextPageToken } = await client.listSecretManagerVaults({
 				workspaceId,
 				pageToken,
-				pageSize
+				pageSize: maxPageSize
 			});
-			return [staticwebsites, nextPageToken];
+			return [vaults, nextPageToken];
 		},
 		getName: (resource) => resource.name,
-		getTrn: (name) => resourceTrn(workspaceId, "staticwebsite", name)
+		getTrn: (name) => resourceTrn(workspaceId, "vault", name)
 	});
-	const ownedWebsiteNames = /* @__PURE__ */ new Set();
-	const staticWebsiteServices = forRemoval ? [] : application.staticWebsiteServices;
-	for (const websiteService of staticWebsiteServices) {
-		const config = websiteService;
-		const name = websiteService.name;
-		const existing = existingWebsites[name];
-		const metaRequest = await buildMetaRequest({
-			trn: resourceTrn(workspaceId, "staticwebsite", name),
-			appName: application.name,
-			appId: application.id
-		});
-		const desired = normalizeComparableStaticWebsite(config);
-		const request = {
-			workspaceId,
-			staticwebsite: {
-				name,
-				description: config.description || "",
-				allowedIpAddresses: config.allowedIpAddresses || []
-			}
-		};
+	const state = loadSecretsState();
+	const skippedSecrets = [];
+	await Promise.all(secretVaults.map(async (vault) => {
+		const vaultName = vault.vaultName;
+		const existing = existingVaults[vaultName];
 		if (existing) {
-			const owned = trackDesiredResourceOwnership({
+			const metaRequest = await buildMetaRequest({
+				trn: resourceTrn(workspaceId, "vault", vaultName),
+				appName: application.name,
+				appId: application.id
+			});
+			if (trackDesiredResourceOwnership({
 				labels: existing.allLabels,
 				ownerLabel: existing.label,
 				appName: application.name,
 				appId: application.id,
-				resourceType: "StaticWebsite",
-				resourceName: name,
+				resourceType: "Secret Manager vault",
+				resourceName: vaultName,
 				conflicts,
 				unmanaged
+			}) && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels)) vaultChangeSet.unchanged.push({ name: vaultName });
+			else vaultChangeSet.updates.push({
+				name: vaultName,
+				workspaceId
 			});
-			if (owned && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && areStaticWebsitesEqual(existing.resource, desired)) changeSet.unchanged.push({ name });
-			else changeSet.updates.push({
-				name,
-				request,
-				metaRequest
-			});
-			if (owned) ownedWebsiteNames.add(name);
-			delete existingWebsites[name];
-		} else {
-			changeSet.creates.push({
-				name,
-				request,
-				metaRequest
-			});
-			ownedWebsiteNames.add(name);
-		}
-	}
-	Object.entries(existingWebsites).forEach(([name]) => {
-		const entry = existingWebsites[name];
-		const label = entry?.label;
-		if (trackRemainingResourceOwner({
-			labels: entry?.allLabels,
-			ownerLabel: label,
-			appName: application.name,
-			appId: application.id,
-			resourceOwners
-		})) changeSet.deletes.push({
-			name,
-			request: {
+			delete existingVaults[vaultName];
+		} else vaultChangeSet.creates.push({
+			name: vaultName,
+			workspaceId
+		});
+		let existingSecrets = [];
+		if (existing) existingSecrets = (await fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { secrets, nextPageToken } = await client.listSecretManagerSecrets({
 				workspaceId,
-				name
+				secretmanagerVaultName: vaultName,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [secrets, nextPageToken];
+		})).map((s) => s.name);
+		const existingSet = new Set(existingSecrets);
+		for (const secret of vault.secrets) {
+			if (secret.value == null) {
+				existingSet.delete(secret.name);
+				skippedSecrets.push(`${vaultName}/${secret.name}`);
+				continue;
 			}
-		});
-	});
-	const desiredDomainsByWebsite = /* @__PURE__ */ new Map();
-	for (const service of staticWebsiteServices) if (service.customDomains !== void 0 && ownedWebsiteNames.has(service.name)) desiredDomainsByWebsite.set(service.name, service.customDomains);
-	const existingDomainsByWebsite = /* @__PURE__ */ new Map();
-	const websitesToFetchDomains = [...ownedWebsiteNames].filter((name) => !changeSet.creates.some((c) => c.name === name));
-	await Promise.all(websitesToFetchDomains.map(async (name) => {
-		try {
-			const { customDomains } = await client.listCustomDomains({
+			if (existingSet.has(secret.name)) {
+				const currentHash = hashValue(secret.value);
+				const storedHash = state.vaults[vaultName]?.[secret.name];
+				if (forceApplyAll || currentHash !== storedHash) secretChangeSet.updates.push({
+					name: `${vaultName}/${secret.name}`,
+					secretName: secret.name,
+					workspaceId,
+					vaultName,
+					value: secret.value
+				});
+				existingSet.delete(secret.name);
+			} else secretChangeSet.creates.push({
+				name: `${vaultName}/${secret.name}`,
+				secretName: secret.name,
 				workspaceId,
-				staticWebsiteName: name
+				vaultName,
+				value: secret.value
 			});
-			const domainsWithLabels = await Promise.all(customDomains.map(async (d) => {
-				const { metadata } = await client.getMetadata({ trn: customDomainTrn(workspaceId, name, d.domain) });
-				return {
-					domain: d.domain,
-					allLabels: metadata?.labels
-				};
-			}));
-			existingDomainsByWebsite.set(name, domainsWithLabels);
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return;
-			throw error;
 		}
+		for (const orphanName of existingSet) secretChangeSet.deletes.push({
+			name: `${vaultName}/${orphanName}`,
+			secretName: orphanName,
+			workspaceId,
+			vaultName
+		});
 	}));
-	for (const name of ownedWebsiteNames) {
-		const desired = new Set(desiredDomainsByWebsite.get(name) ?? []);
-		const existingDomains = existingDomainsByWebsite.get(name) ?? [];
-		const existingSet = new Set(existingDomains.map((d) => d.domain));
-		const sdkOwnedDomains = new Set(existingDomains.filter((d) => isOwnedByApp(d.allLabels, application.name, application.id)).map((d) => d.domain));
-		for (const domain of desired) if (!existingSet.has(domain)) {
-			const metaRequest = await buildMetaRequest({
-				trn: customDomainTrn(workspaceId, name, domain),
-				appName: application.name,
-				appId: application.id
-			});
-			customDomainChangeSet.creates.push({
-				name: domain,
-				request: {
+	for (const [name, entry] of Object.entries(existingVaults)) {
+		if (!entry) continue;
+		if (trackRemainingResourceOwner({
+			labels: entry.allLabels,
+			ownerLabel: entry.label,
+			appName: application.name,
+			appId: application.id,
+			resourceOwners
+		})) {
+			const secrets = await fetchAllTolerant(async (pageToken, maxPageSize) => {
+				const { secrets, nextPageToken } = await client.listSecretManagerSecrets({
 					workspaceId,
-					staticWebsiteName: name,
-					domain
-				},
-				metaRequest
+					secretmanagerVaultName: name,
+					pageToken,
+					pageSize: maxPageSize
+				});
+				return [secrets, nextPageToken];
 			});
-		} else customDomainChangeSet.unchanged.push({ name: domain });
-		if (desiredDomainsByWebsite.has(name)) {
-			for (const domain of sdkOwnedDomains) if (!desired.has(domain)) customDomainChangeSet.deletes.push({
-				name: domain,
-				request: {
-					workspaceId,
-					domain
-				}
+			for (const secret of secrets) secretChangeSet.deletes.push({
+				name: `${name}/${secret.name}`,
+				secretName: secret.name,
+				workspaceId,
+				vaultName: name
+			});
+			vaultChangeSet.deletes.push({
+				name,
+				workspaceId
 			});
 		}
 	}
 	return {
-		changeSet,
-		customDomainChangeSet,
+		vaultChangeSet,
+		secretChangeSet,
+		skippedSecrets,
 		conflicts,
 		unmanaged,
 		resourceOwners
 	};
 }
+/**
+* Apply secret manager changes for the given phase.
+* @param client - Operator client instance
+* @param result - Planned secret changes
+* @param phase - Apply phase
+* @param application - Application to read secrets from for hash state persistence
+* @returns Promise that resolves when secret changes are applied
+*/
+async function applySecretManager(client, result, phase = "create-update", application) {
+	const { vaultChangeSet, secretChangeSet } = result;
+	if (phase === "create-update") {
+		await Promise.all(vaultChangeSet.creates.map(async (create) => {
+			await client.createSecretManagerVault(vaultCreateRequest(create));
+			if (application) {
+				const metaRequest = await buildMetaRequest({
+					trn: resourceTrn(create.workspaceId, "vault", create.name),
+					appName: application.name,
+					appId: application.id
+				});
+				await client.setMetadata(metaRequest);
+			}
+		}));
+		if (application) await Promise.all(vaultChangeSet.updates.map(async (update) => {
+			const metaRequest = await buildMetaRequest({
+				trn: resourceTrn(update.workspaceId, "vault", update.name),
+				appName: application.name,
+				appId: application.id
+			});
+			await client.setMetadata(metaRequest);
+		}));
+		await Promise.all(secretChangeSet.creates.map((create) => client.createSecretManagerSecret(secretCreateRequest(create))));
+		await Promise.all(secretChangeSet.updates.map((update) => client.updateSecretManagerSecret(secretUpdateRequest(update))));
+		if (application) {
+			const state = loadSecretsState();
+			for (const vault of application.secrets) {
+				if (!Object.hasOwn(state.vaults, vault.vaultName)) state.vaults[vault.vaultName] = {};
+				for (const secret of vault.secrets) if (secret.value != null) assertDefined(state.vaults[vault.vaultName], "vault state entry missing")[secret.name] = hashValue(secret.value);
+			}
+			saveSecretsState(state);
+		}
+	} else {
+		await Promise.all(secretChangeSet.deletes.map((del) => client.deleteSecretManagerSecret({
+			workspaceId: del.workspaceId,
+			secretmanagerVaultName: del.vaultName,
+			secretmanagerSecretName: del.secretName
+		})));
+		await Promise.all(vaultChangeSet.deletes.map((del) => client.deleteSecretManagerVault({
+			workspaceId: del.workspaceId,
+			secretmanagerVaultName: del.name
+		})));
+		if (secretChangeSet.deletes.length > 0 || vaultChangeSet.deletes.length > 0) {
+			const state = loadSecretsState();
+			for (const del of secretChangeSet.deletes) if (Object.hasOwn(state.vaults, del.vaultName)) {
+				delete assertDefined(state.vaults[del.vaultName], "vault state entry missing")[del.secretName];
+				if (Object.keys(assertDefined(state.vaults[del.vaultName], "vault state entry missing")).length === 0) delete state.vaults[del.vaultName];
+			}
+			for (const del of vaultChangeSet.deletes) delete state.vaults[del.name];
+			saveSecretsState(state);
+		}
+	}
+}
 
 //#endregion
 //#region src/cli/commands/tailordb/migrate/config.ts
@@ -6919,42 +6678,56 @@ function copySnapshotRecord(record) {
 	return copy;
 }
 /**
-* Normalize a snapshot field in place so the snapshot becomes the canonical
-* form for comparison. Currently fills in the platform default decimal scale
-* when omitted, which avoids false drift between local schemas (where scale
-* may be omitted) and the platform (which always materializes a scale).
+* Normalize a snapshot field into the canonical form for comparison, returning
+* a new object rather than mutating the input. Currently fills in the platform
+* default decimal scale when omitted, which avoids false drift between local
+* schemas (where scale may be omitted) and the platform (which always
+* materializes a scale).
 * @param {SnapshotFieldConfig} field - Field configuration to normalize
-* @returns The same field object after normalization
+* @returns {SnapshotFieldConfig} A new, normalized field object
 */
 function normalizeSnapshotField(field) {
-	if (field.type === "decimal" && field.scale === void 0) field.scale = 6;
-	if (field.fields) for (const nested of Object.values(field.fields)) normalizeSnapshotField(nested);
-	return field;
+	const fields = field.fields ? Object.fromEntries(Object.entries(field.fields).map(([name, nested]) => [name, normalizeSnapshotField(nested)])) : void 0;
+	return {
+		...field,
+		...field.type === "decimal" && field.scale === void 0 && { scale: 6 },
+		...fields && { fields }
+	};
 }
 /**
-* Normalize a snapshot type in place to the canonical comparison shape.
-* Currently fills:
+* Normalize a snapshot type into the canonical comparison shape, returning a
+* new object rather than mutating the input. Currently fills:
 *   - `pluralForm` via inflection when missing (legacy snapshots written
 *     before `pluralForm` became required may omit it)
 *   - per-field `scale` defaults via {@link normalizeSnapshotField}
 *
 * Idempotent — safe to call multiple times on the same input.
 * @param {TailorDBSnapshotType} type - Snapshot type to normalize
-* @returns The same snapshot type object after normalization
+* @returns {TailorDBSnapshotType} A new, normalized snapshot type object
 */
 function normalizeSnapshotType(type) {
-	if (!type.pluralForm) type.pluralForm = inflection.pluralize(type.name);
-	for (const field of Object.values(type.fields)) normalizeSnapshotField(field);
-	return type;
+	const pluralForm = type.pluralForm || inflection.pluralize(type.name);
+	const fields = createSnapshotRecord();
+	for (const [fieldName, field] of Object.entries(type.fields)) fields[fieldName] = normalizeSnapshotField(field);
+	return {
+		...type,
+		pluralForm,
+		fields
+	};
 }
 /**
-* Normalize a schema snapshot in place to the canonical comparison shape.
+* Normalize a schema snapshot into the canonical comparison shape, returning a
+* new object rather than mutating the input.
 * @param {SchemaSnapshot} snapshot - Schema snapshot to normalize
-* @returns The same schema snapshot object branded as normalized
+* @returns {NormalizedSchemaSnapshot} A new schema snapshot object branded as normalized
 */
 function normalizeSchemaSnapshot(snapshot) {
-	for (const type of Object.values(snapshot.types)) normalizeSnapshotType(type);
-	return snapshot;
+	const types = createSnapshotRecord();
+	for (const [typeName, type] of Object.entries(snapshot.types)) types[typeName] = normalizeSnapshotType(type);
+	return {
+		...snapshot,
+		types
+	};
 }
 /**
 * Validate that a migration number follows the expected format (4-digit number)
@@ -6995,53 +6768,7 @@ function getMigrationFilePath(migrationsDir, num, type) {
 	return path.join(migrationDir, MIGRATION_FILE_NAMES[type]);
 }
 /**
-* Create a snapshot field config from a parsed field
-* @param {ParsedField} field - Parsed field definition
-* @returns {SnapshotFieldConfig} Snapshot field configuration
-*/
-function createSnapshotFieldConfig(field) {
-	const config = {
-		type: field.config.type,
-		required: field.config.required !== false
-	};
-	if (field.config.array) config.array = true;
-	if (field.config.index) config.index = true;
-	if (field.config.unique) config.unique = true;
-	if (field.config.allowedValues && field.config.allowedValues.length > 0) config.allowedValues = field.config.allowedValues.map((v) => ({
-		value: v.value,
-		...v.description && { description: v.description }
-	}));
-	if (field.config.foreignKey) {
-		config.foreignKey = true;
-		if (field.config.foreignKeyType) config.foreignKeyType = field.config.foreignKeyType;
-		if (field.config.foreignKeyField) config.foreignKeyField = field.config.foreignKeyField;
-	}
-	if (field.config.description) config.description = field.config.description;
-	if (field.config.vector) config.vector = true;
-	if (field.config.hooks) {
-		config.hooks = {};
-		if (field.config.hooks.create) config.hooks.create = { expr: field.config.hooks.create.expr };
-		if (field.config.hooks.update) config.hooks.update = { expr: field.config.hooks.update.expr };
-	}
-	if (field.config.validate && field.config.validate.length > 0) config.validate = field.config.validate.map((v) => ({
-		script: { expr: v.script.expr },
-		errorMessage: v.errorMessage
-	}));
-	if (field.config.serial) config.serial = {
-		start: field.config.serial.start,
-		...field.config.serial.maxValue !== void 0 && { maxValue: field.config.serial.maxValue },
-		...field.config.serial.format && { format: field.config.serial.format }
-	};
-	if (field.config.scale !== void 0) config.scale = field.config.scale;
-	if (field.config.fields && Object.keys(field.config.fields).length > 0) {
-		config.fields = {};
-		for (const [nestedName, nestedConfig] of Object.entries(field.config.fields)) config.fields[nestedName] = createSnapshotFieldConfigFromOperatorConfig(nestedConfig);
-	}
-	normalizeSnapshotField(config);
-	return config;
-}
-/**
-* Create a snapshot field config from an OperatorFieldConfig (for nested fields)
+* Create a snapshot field config from an OperatorFieldConfig.
 * @param {import("#/parser/service/tailordb/types").OperatorFieldConfig} fieldConfig - Field configuration
 * @returns {SnapshotFieldConfig} Snapshot field configuration
 */
@@ -7083,8 +6810,7 @@ function createSnapshotFieldConfigFromOperatorConfig(fieldConfig) {
 		config.fields = {};
 		for (const [nestedName, nestedConfig] of Object.entries(fieldConfig.fields)) config.fields[nestedName] = createSnapshotFieldConfigFromOperatorConfig(nestedConfig);
 	}
-	normalizeSnapshotField(config);
-	return config;
+	return normalizeSnapshotField(config);
 }
 /**
 * Create a snapshot type from a parsed type
@@ -7093,7 +6819,7 @@ function createSnapshotFieldConfigFromOperatorConfig(fieldConfig) {
 */
 function createSnapshotType(type) {
 	const fields = createSnapshotRecord();
-	for (const [fieldName, field] of Object.entries(type.fields)) fields[fieldName] = createSnapshotFieldConfig(field);
+	for (const [fieldName, field] of Object.entries(type.fields)) fields[fieldName] = createSnapshotFieldConfigFromOperatorConfig(field.config);
 	const snapshotType = {
 		name: type.name,
 		pluralForm: type.pluralForm || inflection.pluralize(type.name),
@@ -9640,35 +9366,25 @@ function groupMigrationsByNamespace(migrations) {
 * @returns {Promise<ProtoTailorDBType[]>} Remote TailorDB types
 */
 async function fetchRemoteTypes(client, workspaceId, namespace) {
-	return fetchAll(async (pageToken, maxPageSize) => {
-		try {
-			const { tailordbTypes, nextPageToken } = await client.listTailorDBTypes({
-				workspaceId,
-				namespaceName: namespace,
-				pageToken,
-				pageSize: maxPageSize
-			});
-			return [tailordbTypes, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+	return fetchAllTolerant(async (pageToken, maxPageSize) => {
+		const { tailordbTypes, nextPageToken } = await client.listTailorDBTypes({
+			workspaceId,
+			namespaceName: namespace,
+			pageToken,
+			pageSize: maxPageSize
+		});
+		return [tailordbTypes, nextPageToken];
 	});
 }
 async function fetchRemoteGqlPermissions(client, workspaceId, namespace) {
-	return fetchAll(async (pageToken, maxPageSize) => {
-		try {
-			const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
-				workspaceId,
-				namespaceName: namespace,
-				pageToken,
-				pageSize: maxPageSize
-			});
-			return [permissions, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+	return fetchAllTolerant(async (pageToken, maxPageSize) => {
+		const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
+			workspaceId,
+			namespaceName: namespace,
+			pageToken,
+			pageSize: maxPageSize
+		});
+		return [permissions, nextPageToken];
 	});
 }
 function definedWhenNotEmpty(value) {
@@ -10301,7 +10017,7 @@ async function planTailorDB(context) {
 		tailordbs.push(toTailorDBDeployInput(tailordb));
 	}
 	const executors = forRemoval ? [] : Object.values(await application.executorService?.loadExecutors() ?? {});
-	const executorUsedTypes = /* @__PURE__ */ new Set();
+	const executorUsedTypes = new Set(context.executorUsedTailorDBTypes ?? []);
 	for (const executor of executors) if (executor.trigger.kind === "tailordb") executorUsedTypes.add(executor.trigger.typeName);
 	const { changeSet: serviceChangeSet, conflicts, unmanaged, resourceOwners } = await planServices(client, workspaceId, application.name, application.id, tailordbs);
 	const deletedServices = serviceChangeSet.deletes.map((del) => del.name);
@@ -10406,17 +10122,16 @@ async function planServices(client, workspaceId, appName, appId, tailordbs) {
 			existingLabels: existing?.allLabels
 		});
 		if (existing) {
-			const owned = isOwnedByApp(existing.allLabels, appName, appId);
-			if (!owned) if (!existing.label) unmanaged.push({
-				resourceType: "TailorDB service",
-				resourceName: tailordb.namespace
-			});
-			else conflicts.push({
+			if (trackDesiredResourceOwnership({
+				labels: existing.allLabels,
+				ownerLabel: existing.label,
+				appName,
+				appId,
 				resourceType: "TailorDB service",
 				resourceName: tailordb.namespace,
-				currentOwner: existing.label
-			});
-			if (owned && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && areTailorDBServicesEqual(existing.resource, tailordb)) changeSet.unchanged.push({ name: tailordb.namespace });
+				conflicts,
+				unmanaged
+			}) && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && areTailorDBServicesEqual(existing.resource, tailordb)) changeSet.unchanged.push({ name: tailordb.namespace });
 			else changeSet.updates.push({
 				name: tailordb.namespace,
 				metaRequest
@@ -10434,10 +10149,13 @@ async function planServices(client, workspaceId, appName, appId, tailordbs) {
 	}
 	Object.entries(existingServices).forEach(([namespaceName]) => {
 		const entry = existingServices[namespaceName];
-		const label = entry?.label;
-		const owned = isOwnedByApp(entry?.allLabels, appName, appId);
-		if (label && !owned) resourceOwners.add(label);
-		if (owned) changeSet.deletes.push({
+		if (trackRemainingResourceOwner({
+			labels: entry?.allLabels,
+			ownerLabel: entry?.label,
+			appName,
+			appId,
+			resourceOwners
+		})) changeSet.deletes.push({
 			name: namespaceName,
 			request: {
 				workspaceId,
@@ -10455,19 +10173,14 @@ async function planServices(client, workspaceId, appName, appId, tailordbs) {
 async function planTypes(client, workspaceId, tailordbs, executorUsedTypes, deletedServices, filteredTypesByNamespace, forceApplyAll = false) {
 	const changeSet = createChangeSet("TailorDB types");
 	const fetchTypes = (namespaceName) => {
-		return fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { tailordbTypes, nextPageToken } = await client.listTailorDBTypes({
-					workspaceId,
-					namespaceName,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [tailordbTypes, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
+		return fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { tailordbTypes, nextPageToken } = await client.listTailorDBTypes({
+				workspaceId,
+				namespaceName,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [tailordbTypes, nextPageToken];
 		});
 	};
 	for (const tailordb of tailordbs) {
@@ -10597,24 +10310,19 @@ function matchesNumericStringPath(path) {
 	});
 }
 function isNumericLikeValue(value) {
-	return typeof value === "number" || typeof value === "bigint" || /^-?\d+$/.test(value);
-}
-async function planGqlPermissions(client, workspaceId, tailordbs, deletedServices, forceApplyAll = false) {
-	const changeSet = createChangeSet("TailorDB gqlPermissions");
-	const fetchGqlPermissions = (namespaceName) => {
-		return fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
-					workspaceId,
-					namespaceName,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [permissions, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
+	return typeof value === "number" || typeof value === "bigint" || /^-?\d+$/.test(value);
+}
+async function planGqlPermissions(client, workspaceId, tailordbs, deletedServices, forceApplyAll = false) {
+	const changeSet = createChangeSet("TailorDB gqlPermissions");
+	const fetchGqlPermissions = (namespaceName) => {
+		return fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
+				workspaceId,
+				namespaceName,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [permissions, nextPageToken];
 		});
 	};
 	for (const tailordb of tailordbs) {
@@ -11105,6 +10813,327 @@ function normalizeRetryPolicyForCompare(policy) {
 	};
 }
 
+//#endregion
+//#region src/cli/commands/deploy/apply-phases.ts
+/**
+* Apply planned deploy changes for one or more applications.
+* @param client - Operator client instance
+* @param workspaceId - Target workspace ID
+* @param deployments - Planned deployments to apply
+*/
+async function applyDeploymentPlans(client, workspaceId, deployments) {
+	const forEachDeployment = async (apply) => {
+		for (const deployment of deployments) await apply(deployment);
+	};
+	await withSpan("apply.createUpdateServices", async () => {
+		await forEachDeployment((d) => applySecretManager(client, d.secretManager, "create-update", d.application));
+		await forEachDeployment((d) => applyFunctionRegistry(client, workspaceId, d.functionRegistry, "create-update"));
+		await forEachDeployment((d) => applyStaticWebsite(client, d.staticWebsite, "create-update"));
+		await forEachDeployment((d) => applyAIGateway(client, d.aiGateway, "create-update"));
+		await forEachDeployment((d) => applyIdP(client, d.idp, "create-update"));
+		await forEachDeployment((d) => applyAuth(client, d.auth, "create-update-prerequisites"));
+		await forEachDeployment((d) => applyTailorDB(client, d.tailorDB, "create-update"));
+		await forEachDeployment((d) => applyAuth(client, d.auth, "create-update-dependents"));
+		await forEachDeployment((d) => applyPipeline(client, d.pipeline, "create-update"));
+	});
+	await withSpan("apply.deleteSubgraphResources", async () => {
+		await forEachDeployment((d) => applyPipeline(client, d.pipeline, "delete-resources"));
+		await forEachDeployment((d) => applyAuth(client, d.auth, "delete-resources"));
+		await forEachDeployment((d) => applyIdP(client, d.idp, "delete-resources"));
+	});
+	await withSpan("apply.createUpdateApplication", async () => {
+		await forEachDeployment((d) => applyApplication(client, d.app, "create-update"));
+	});
+	await withSpan("apply.createUpdateDependentServices", async () => {
+		await forEachDeployment((d) => applyExecutor(client, d.executor, "create-update"));
+		await forEachDeployment((d) => applyWorkflow(client, d.workflow, "create-update"));
+	});
+	await withSpan("apply.deleteDependentServices", async () => {
+		await forEachDeployment((d) => applyWorkflow(client, d.workflow, "delete"));
+		await forEachDeployment((d) => applyExecutor(client, d.executor, "delete"));
+		await forEachDeployment((d) => applyStaticWebsite(client, d.staticWebsite, "delete"));
+		await forEachDeployment((d) => applyAIGateway(client, d.aiGateway, "delete"));
+		await forEachDeployment((d) => applySecretManager(client, d.secretManager, "delete", d.application));
+	});
+	await withSpan("apply.deleteApplication", async () => {
+		await forEachDeployment((d) => applyApplication(client, d.app, "delete"));
+	});
+	await withSpan("apply.deleteSubgraphServices", async () => {
+		await forEachDeployment((d) => applyPipeline(client, d.pipeline, "delete-services"));
+		await forEachDeployment((d) => applyAuth(client, d.auth, "delete-services"));
+		await forEachDeployment((d) => applyIdP(client, d.idp, "delete-services"));
+		await forEachDeployment((d) => applyTailorDB(client, d.tailorDB, "delete-services"));
+	});
+	await withSpan("apply.cleanup", async () => {
+		await forEachDeployment((d) => applyFunctionRegistry(client, workspaceId, d.functionRegistry, "delete"));
+	});
+}
+
+//#endregion
+//#region src/cli/commands/deploy/config-id-injector.ts
+const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function findDefineConfigCalls(node, results) {
+	if (!node || typeof node !== "object") return;
+	const n = node;
+	if (n.type === "CallExpression") {
+		const ce = n;
+		if (ce.callee.type === "Identifier" && ce.callee.name === "defineConfig") {
+			const arg = ce.arguments[0];
+			const configObj = arg && arg.type === "ObjectExpression" ? arg : null;
+			results.push({
+				callExpr: ce,
+				configObj
+			});
+		}
+	}
+	for (const key of Object.keys(n)) {
+		const child = n[key];
+		if (Array.isArray(child)) for (const c of child) findDefineConfigCalls(c, results);
+		else if (child && typeof child === "object") findDefineConfigCalls(child, results);
+	}
+}
+function findIdProperty(obj) {
+	for (const prop of obj.properties) {
+		if (prop.type !== "Property") continue;
+		if ((prop.key.type === "Identifier" ? prop.key.name : prop.key.type === "Literal" ? prop.key.value : null) === "id") return prop;
+	}
+	return null;
+}
+/**
+* Ensure `tailor.config.ts` has an `id` property on the `defineConfig({...})`
+* argument. Generates a UUID when missing and writes it back to the file.
+* Returns null when the file does not contain a `defineConfig()` call (e.g.
+* a wrapper that re-exports another config).
+* @param configPath - Absolute path to the config file
+* @returns Resolved id and whether it was newly injected, or null if skipped
+*/
+async function ensureConfigId(configPath) {
+	const source = await fs$1.promises.readFile(configPath, "utf-8");
+	const { program } = parseSync(configPath, source);
+	const calls = [];
+	findDefineConfigCalls(program, calls);
+	if (calls.length === 0) return null;
+	if (calls.length > 1) throw new Error(`Multiple defineConfig() calls found in ${configPath}. Only one is supported.`);
+	const { configObj } = assertDefined(calls[0], "defineConfig call site missing");
+	if (!configObj) throw new Error(`defineConfig() argument must be an inline object literal in ${configPath} so the SDK can manage the 'id' field.`);
+	const idProp = findIdProperty(configObj);
+	if (idProp) {
+		const value = idProp.value;
+		if (value.type !== "Literal") throw new Error(`'id' field in ${configPath} must be a string literal. To use this config for a separate app, delete it.`);
+		const literalValue = value.value;
+		if (typeof literalValue !== "string" || literalValue === "") throw new Error(`'id' field in ${configPath} must be a non-empty string literal. To use this config for a separate app, delete it.`);
+		if (!uuidRegex.test(literalValue)) throw new Error(`'id' field in ${configPath} must be a UUID. To use this config for a separate app, delete it.`);
+		return {
+			id: literalValue,
+			injected: false
+		};
+	}
+	const id = crypto.randomUUID();
+	const newSource = insertIdProperty(source, configObj, id);
+	await fs$1.promises.writeFile(configPath, newSource, "utf-8");
+	logger.info(`Generated app id and wrote to ${configPath}: ${id}`);
+	return {
+		id,
+		injected: true
+	};
+}
+/**
+* Read the resolved `defineConfig({...})` `id` from a config file without
+* mutating it. Returns null when the file has no inline `defineConfig()` call
+* (wrapper/re-export config), and `{ id: null }` when the call exists but has
+* no usable `id` property.
+* @param configPath - Absolute path to the config file
+* @returns The existing id (or null when absent), or null for wrapper configs
+*/
+async function readConfigId(configPath) {
+	const { program } = parseSync(configPath, await fs$1.promises.readFile(configPath, "utf-8"));
+	const calls = [];
+	findDefineConfigCalls(program, calls);
+	if (calls.length === 0) return null;
+	if (calls.length > 1) throw new Error(`Multiple defineConfig() calls found in ${configPath}. Only one is supported.`);
+	const { configObj } = assertDefined(calls[0], "defineConfig call site missing");
+	if (!configObj) throw new Error(`defineConfig() argument must be an inline object literal in ${configPath} so the SDK can manage the 'id' field.`);
+	const idProp = findIdProperty(configObj);
+	if (!idProp || idProp.value.type !== "Literal") return { id: null };
+	const value = idProp.value.value;
+	return { id: typeof value === "string" && value !== "" ? value : null };
+}
+/**
+* Read-only CI check: the config must already carry a valid app id.
+* Wrapper/re-export configs (no inline defineConfig call) are exempt,
+* mirroring the local behavior where {@link ensureConfigId} no-ops.
+* @param configPath - Absolute path to the config file
+*/
+async function assertConfigIdInCI(configPath) {
+	const result = await readConfigId(configPath);
+	if (result === null) return;
+	if (!result.id) throw new Error("tailor.config.ts is missing an 'id'. CI does not auto-generate one (each run would be treated as a separate app and break resource ownership). Run 'tailor-sdk setup' or 'tailor-sdk apply' locally and commit the injected id.");
+	if (!uuidRegex.test(result.id)) throw new Error(`'id' in ${configPath} must be a UUID. To use this config for a separate app, delete it.`);
+}
+/**
+* Ensure the config has an app id for a deploy run.
+*
+* Locally, the id is auto-injected when missing (via {@link ensureConfigId}).
+* In CI, the id is never auto-injected — a missing id is a hard error, because
+* generating one per run would create a fresh app each time and break resource
+* ownership. CI dry-runs (plan) perform the same check read-only, so a
+* forgotten id fails at PR time instead of at deploy. Ephemeral pipelines that
+* intentionally deploy a fresh app per run (such as e2e harnesses) can opt
+* back into injection with `TAILOR_PLATFORM_SDK_ALLOW_CI_ID_INJECTION=true`.
+* Local dry-run and build-only flows skip both injection and the check (no
+* on-disk side effects are expected, and build-only never talks to the
+* platform).
+* @param obj - Inputs
+* @param obj.configPath - Absolute path to the config file
+* @param obj.dryRun - Whether this is a dry-run
+* @param obj.buildOnly - Whether this is a build-only run
+*/
+async function ensureConfigIdForDeploy(obj) {
+	const { configPath, dryRun, buildOnly } = obj;
+	if (buildOnly) return;
+	const allowCIInjection = parseBoolean(process.env.TAILOR_PLATFORM_SDK_ALLOW_CI_ID_INJECTION) === true;
+	const strictCI = isCI && !allowCIInjection;
+	if (dryRun) {
+		if (strictCI) await assertConfigIdInCI(configPath);
+		return;
+	}
+	if (strictCI) {
+		await assertConfigIdInCI(configPath);
+		return;
+	}
+	await ensureConfigId(configPath);
+}
+const idComment = "// SDK-managed app id — do not edit, except when copying this config to a separate app.";
+function insertIdProperty(source, configObj, id) {
+	const idLiteral = `id: ${JSON.stringify(id)}`;
+	if (configObj.properties.length > 0) {
+		const firstProp = assertDefined(configObj.properties[0], "first property missing");
+		const lineStart = source.lastIndexOf("\n", firstProp.start - 1) + 1;
+		const indent = source.slice(lineStart, firstProp.start);
+		if (!/^[\t ]*$/.test(indent)) return source.slice(0, firstProp.start) + `${idLiteral}, ` + source.slice(firstProp.start);
+		const insertion = `${idComment}\n${indent}${idLiteral},\n${indent}`;
+		return source.slice(0, firstProp.start) + insertion + source.slice(firstProp.start);
+	}
+	const openBracePos = configObj.start + 1;
+	const braceLineStart = source.lastIndexOf("\n", configObj.start) + 1;
+	const baseIndent = source.slice(braceLineStart).match(/^[\t ]*/)?.[0] ?? "";
+	const innerIndent = `${baseIndent}  `;
+	const insertion = `\n${innerIndent}${idComment}\n${innerIndent}${idLiteral},\n${baseIndent}`;
+	return source.slice(0, openBracePos) + insertion + source.slice(openBracePos);
+}
+
+//#endregion
+//#region src/cli/commands/deploy/confirm.ts
+/**
+* Confirm reassignment of resources when owner conflicts are detected.
+* Splits into two scenarios: id regeneration (same sdk-name, different
+* sdk-app-id) and name mismatch (different sdk-name). Each gets its own
+* prompt because the user-facing meaning is different.
+* @param conflicts - Detected owner conflicts
+* @param appName - Target application name
+* @param yes - Whether to auto-confirm without prompting
+* @returns Promise that resolves when confirmation completes
+*/
+async function confirmOwnerConflict(conflicts, appName, yes) {
+	if (conflicts.length === 0) return;
+	const idRegenerated = conflicts.filter((c) => c.currentOwner === appName);
+	const nameMismatches = conflicts.filter((c) => c.currentOwner !== appName);
+	if (idRegenerated.length > 0) await confirmIdRegeneration(idRegenerated, appName, yes);
+	if (nameMismatches.length > 0) await confirmNameMismatch(nameMismatches, appName, yes);
+}
+async function confirmIdRegeneration(conflicts, appName, yes) {
+	logger.warn(`Application id was regenerated for "${appName}":`);
+	logger.log("  These resources still carry the previous id.");
+	logger.newline();
+	logger.log(`  ${styles.info("Resources")}:`);
+	for (const c of conflicts) logger.log(`    • ${styles.bold(c.resourceType)} ${styles.info(`"${c.resourceName}"`)}`);
+	if (yes) {
+		logger.success("Re-tagging resources with the new id (--yes flag specified)...", { mode: "plain" });
+		return;
+	}
+	if (!await prompt.confirm({
+		message: `Re-tag these resources with the new id for "${appName}"?\n${styles.dim("(The id in tailor.config.ts was removed since the previous deploy, so a new one was generated)")}`,
+		default: false
+	})) throw new Error(multiline`
+      Apply cancelled. Resources remain tagged with the previous id.
+      To override, run again and confirm, or use --yes flag.
+    `);
+}
+async function confirmNameMismatch(conflicts, appName, yes) {
+	const currentOwners = [...new Set(conflicts.map((c) => c.currentOwner))];
+	logger.warn("Application name mismatch detected:");
+	logger.log(`  ${styles.warning("Current application(s)")}: ${currentOwners.map((o) => styles.bold(`"${o}"`)).join(", ")}`);
+	logger.log(`  ${styles.success("New application")}:        ${styles.bold(`"${appName}"`)}`);
+	logger.newline();
+	logger.log(`  ${styles.info("Resources")}:`);
+	for (const c of conflicts) logger.log(`    • ${styles.bold(c.resourceType)} ${styles.info(`"${c.resourceName}"`)}`);
+	if (yes) {
+		logger.success("Updating resources (--yes flag specified)...", { mode: "plain" });
+		return;
+	}
+	const promptMessage = currentOwners.length === 1 ? `Update these resources to be managed by "${appName}"?\n${styles.dim("(Common when renaming your application)")}` : `Update these resources to be managed by "${appName}"?`;
+	if (!await prompt.confirm({
+		message: promptMessage,
+		default: false
+	})) throw new Error(multiline`
+      Apply cancelled. Resources remain managed by their current applications.
+      To override, run again and confirm, or use --yes flag.
+    `);
+}
+/**
+* Confirm allowing tailor-sdk to manage previously unmanaged resources.
+* @param resources - Unmanaged resources
+* @param appName - Target application name
+* @param yes - Whether to auto-confirm without prompting
+* @returns Promise that resolves when confirmation completes
+*/
+async function confirmUnmanagedResources(resources, appName, yes) {
+	if (resources.length === 0) return;
+	logger.warn("Existing resources not tracked by tailor-sdk were found:");
+	logger.log(`  ${styles.info("Resources")}:`);
+	for (const r of resources) logger.log(`    • ${styles.bold(r.resourceType)} ${styles.info(`"${r.resourceName}"`)}`);
+	logger.newline();
+	logger.log("  These resources may have been created by older SDK versions, Terraform, or CUE.");
+	logger.log("  To continue, confirm that tailor-sdk should manage them.");
+	logger.log("  If they are managed by another tool (e.g., Terraform), cancel and manage them there instead.");
+	if (yes) {
+		logger.success(`Adding to "${appName}" (--yes flag specified)...`, { mode: "plain" });
+		return;
+	}
+	if (!await prompt.confirm({
+		message: `Allow tailor-sdk to manage these resources for "${appName}"?`,
+		default: false
+	})) throw new Error(multiline`
+      Apply cancelled. Resources remain unmanaged.
+      To override, run again and confirm, or use --yes flag.
+    `);
+}
+/**
+* Confirm deletion of important resources.
+* @param resources - Resources scheduled for deletion
+* @param yes - Whether to auto-confirm without prompting
+* @returns Promise that resolves when confirmation completes
+*/
+async function confirmImportantResourceDeletion(resources, yes) {
+	if (resources.length === 0) return;
+	logger.warn("The following resources will be deleted:");
+	logger.log(`  ${styles.info("Resources")}:`);
+	for (const r of resources) logger.log(`    • ${styles.bold(r.resourceType)} ${styles.error(`"${r.resourceName}"`)}`);
+	logger.newline();
+	logger.log(styles.warning("  Deleting these resources will permanently remove all associated data."));
+	if (yes) {
+		logger.success("Deleting resources (--yes flag specified)...", { mode: "plain" });
+		return;
+	}
+	if (!await prompt.confirm({
+		message: "Are you sure you want to delete these resources?",
+		default: false
+	})) throw new Error(multiline`
+      Apply cancelled. Resources will not be deleted.
+      To override, run again and confirm, or use --yes flag.
+    `);
+}
+
 //#endregion
 //#region src/cli/commands/deploy/validate-plan.ts
 function validateItems(params) {
@@ -11336,17 +11365,126 @@ async function validatePlan(input) {
 */
 function collectIdpUserTriggerTargets(application) {
 	const targets = /* @__PURE__ */ new Set();
-	const idps = application.idpServices;
+	const idps = collectApplicationIdpNames(application);
 	for (const executor of Object.values(application.executorService?.executors ?? {})) {
 		if (executor.trigger.kind !== "idpUser") continue;
 		if (executor.trigger.idp != null) targets.add(executor.trigger.idp);
-		else if (idps.length === 1) {
+		else if (idps.size === 1) {
 			const [idp] = idps;
-			if (idp) targets.add(idp.name);
+			if (idp) targets.add(idp);
 		}
 	}
 	return targets;
 }
+function collectDeployIdpUserTriggerTargets(targets) {
+	const triggerTargets = /* @__PURE__ */ new Set();
+	for (const target of targets) for (const idpName of collectIdpUserTriggerTargets(target.application)) triggerTargets.add(idpName);
+	return triggerTargets;
+}
+function collectExecutorUsedTailorDBTypes(owner, targets) {
+	const usedTypes = /* @__PURE__ */ new Set();
+	const ownerNamespaces = new Set(owner.application.tailorDBServices.map((service) => service.namespace));
+	const applications = targets.map((target) => target.application);
+	for (const target of targets) {
+		const visibleNamespaces = collectVisibleTailorDBTypeNamespaces(target.application, applications);
+		for (const executor of Object.values(target.application.executorService?.executors ?? {})) if (executor.trigger.kind === "tailordb") {
+			const namespace = findTailorDBNamespace(target.application, executor.trigger.typeName) ?? resolveSameRunNamespace(visibleNamespaces, executor.trigger.typeName, "TailorDB type");
+			if (namespace && ownerNamespaces.has(namespace)) usedTypes.add(executor.trigger.typeName);
+		}
+	}
+	return usedTypes;
+}
+function collectExecutorUsedResolvers(owner, targets) {
+	const usedResolvers = /* @__PURE__ */ new Set();
+	const ownerNamespaces = new Set(owner.application.resolverServices.map((service) => service.namespace));
+	const applications = targets.map((target) => target.application);
+	for (const target of targets) {
+		const visibleNamespaces = collectVisibleResolverNamespaces(target.application, applications);
+		for (const executor of Object.values(target.application.executorService?.executors ?? {})) if (executor.trigger.kind === "resolverExecuted") {
+			const namespace = findResolverNamespace(target.application, executor.trigger.resolverName) ?? resolveSameRunNamespace(visibleNamespaces, executor.trigger.resolverName, "Resolver");
+			if (namespace && ownerNamespaces.has(namespace)) usedResolvers.add(executor.trigger.resolverName);
+		}
+	}
+	return usedResolvers;
+}
+function collectExpectedLocalStaticWebsiteNames(targets) {
+	const websiteNames = /* @__PURE__ */ new Set();
+	for (const target of targets) for (const website of target.application.staticWebsiteServices) websiteNames.add(website.name);
+	return websiteNames;
+}
+function addPossiblyAmbiguousNamespace(namespaces, key, namespace) {
+	if (namespaces.has(key)) {
+		if (namespaces.get(key) !== namespace) namespaces.set(key, void 0);
+		return;
+	}
+	namespaces.set(key, namespace);
+}
+function collectVisibleResources(params) {
+	const { application, applications, visibleKeysOf, resourcesOf, createResult, addResource } = params;
+	const visibleKeys = visibleKeysOf(application);
+	const result = createResult();
+	for (const candidate of applications) for (const resource of resourcesOf(candidate)) {
+		if (!visibleKeys.has(resource.visibilityKey)) continue;
+		addResource(result, resource.resourceKey, resource.visibilityKey);
+	}
+	return result;
+}
+function collectApplicationTailorDBNamespaces(application) {
+	return /* @__PURE__ */ new Set([...application.tailorDBServices.map((service) => service.namespace), ...application.externalTailorDBNamespaces]);
+}
+function* tailorDBTypeResources(application) {
+	for (const service of application.tailorDBServices) for (const typeName of Object.keys(service.types)) yield {
+		visibilityKey: service.namespace,
+		resourceKey: typeName
+	};
+}
+function collectVisibleTailorDBTypeNamespaces(application, applications) {
+	return collectVisibleResources({
+		application,
+		applications,
+		visibleKeysOf: collectApplicationTailorDBNamespaces,
+		resourcesOf: tailorDBTypeResources,
+		createResult: () => /* @__PURE__ */ new Map(),
+		addResource: addPossiblyAmbiguousNamespace
+	});
+}
+function collectApplicationResolverNamespaces(application) {
+	return new Set(application.subgraphs.filter((subgraph) => subgraph.Type === "pipeline").map((subgraph) => subgraph.Name));
+}
+function* idpNameResources(application) {
+	for (const name of collectApplicationIdpNames(application)) yield {
+		visibilityKey: name,
+		resourceKey: name
+	};
+}
+function collectVisibleIdpNames(application, applications) {
+	return collectVisibleResources({
+		application,
+		applications,
+		visibleKeysOf: collectApplicationIdpNames,
+		resourcesOf: idpNameResources,
+		createResult: () => /* @__PURE__ */ new Set(),
+		addResource: (names, name) => {
+			names.add(name);
+		}
+	});
+}
+function* resolverResources(application) {
+	for (const service of application.resolverServices) for (const resolver of Object.values(service.resolvers)) yield {
+		visibilityKey: service.namespace,
+		resourceKey: resolver.name
+	};
+}
+function collectVisibleResolverNamespaces(application, applications) {
+	return collectVisibleResources({
+		application,
+		applications,
+		visibleKeysOf: collectApplicationResolverNamespaces,
+		resourcesOf: resolverResources,
+		createResult: () => /* @__PURE__ */ new Map(),
+		addResource: addPossiblyAmbiguousNamespace
+	});
+}
 async function shouldForceApplyAll(client, workspaceId, application, functionEntries) {
 	const desiredLabels = (await buildMetaRequest({
 		trn: resourceTrn(workspaceId, "application", application.name),
@@ -11383,39 +11521,31 @@ async function shouldForceApplyAll(client, workspaceId, application, functionEnt
 	functionEntries.forEach((entry) => {
 		candidateTrns.add(resourceTrn(workspaceId, "function_registry", entry.name));
 	});
-	for (const trn of candidateTrns) try {
-		const { metadata } = await client.getMetadata({ trn });
+	for (const trn of candidateTrns) {
+		const metadata = await getOrNull(async () => {
+			const { metadata } = await client.getMetadata({ trn });
+			return metadata;
+		});
 		if (metadata?.labels["sdk-name"] !== application.name) continue;
 		if (!hasMatchingSdkVersion(metadata.labels, desiredLabels)) return true;
-	} catch (error) {
-		if (error instanceof ConnectError && error.code === Code.NotFound) continue;
-		throw error;
 	}
 	return false;
 }
 /**
 * Decide which renamed-away applications should be deleted. Excludes the
-* target itself: id regeneration alone keeps the name unchanged, so deleting
-* by name would destroy the live app.
+* deploy targets themselves: id regeneration alone keeps the name unchanged,
+* so deleting by name would destroy a live app.
 * @param params - Inputs for the computation
 * @param params.conflicts - Detected owner conflicts across all services
 * @param params.resourceOwners - App names that still own resources we don't manage
-* @param params.targetAppName - The application currently being deployed
+* @param params.protectedAppNames - App names that must not be deleted
 * @returns Names of empty old applications that should be deleted
 */
 function computeRenamedAppDeletions(params) {
-	const { conflicts, resourceOwners, targetAppName } = params;
-	return [...new Set(conflicts.map((c) => c.currentOwner))].filter((owner) => !resourceOwners.has(owner) && owner !== targetAppName);
+	const { conflicts, resourceOwners, protectedAppNames } = params;
+	return [...new Set(conflicts.map((c) => c.currentOwner))].filter((owner) => !resourceOwners.has(owner) && !protectedAppNames.has(owner));
 }
-/**
-* Format and output the plan results, then return a summary of change counts.
-* In JSON dry-run mode a JSON payload is written to stdout. In all other modes
-* the human-readable diff goes to stdout (dry-run) or stderr (apply).
-* @param results - Planned results across all services
-* @param opts - Output options (dry-run mode flag)
-* @returns Aggregated plan summary counts
-*/
-function printPlanResults(results, opts) {
+function buildPlanReport(results) {
 	const executorEntries = formatExecutorChangeEntries(results.executor.changeSet, buildPlannedExecutorsByName(results.executor.changeSet), results.functionRegistry.executorFunctionChanges);
 	const resolverEntries = formatResolverChangeEntries(results.pipeline.changeSet.resolver, results.functionRegistry.resolverFunctionChanges);
 	const workflowEntries = formatWorkflowChangeEntries(results.workflow.changeSet, results.functionRegistry.workflowJobChanges);
@@ -11482,132 +11612,808 @@ function printPlanResults(results, opts) {
 		...results.workflow.conflicts,
 		...results.secretManager.conflicts
 	];
-	if (logger.jsonMode && opts?.dryRun) {
-		const changes = [
-			...allDisplayEntries,
-			...tailorDBServiceActions.map(({ action, name }) => ({
-				action,
-				name,
-				labels: ["tailorDB"],
-				namespace: void 0
-			})),
-			...pipelineServiceActions.map(({ action, name }) => ({
-				action,
-				name,
-				labels: ["pipeline"],
-				namespace: void 0
-			})),
-			...idpServiceActions.map(({ action, name }) => ({
-				action,
-				name,
-				labels: ["idp"],
-				namespace: void 0
-			})),
-			...authServiceActions.map(({ action, name }) => ({
-				action,
-				name,
-				labels: ["auth"],
-				namespace: void 0
-			})),
-			...formatChangeSetEntries(otherFunctionRegistryChanges),
-			...formatChangeSetEntries(results.staticWebsite.changeSet, ["staticWebsite"]),
-			...formatChangeSetEntries(results.staticWebsite.customDomainChangeSet, ["customDomain"]),
-			...formatChangeSetEntries(results.aiGateway.changeSet, ["aiGateway"]),
-			...formatChangeSetEntries(results.app, ["application"]),
-			...formatChangeSetEntries(results.secretManager.vaultChangeSet, ["vault"]),
-			...formatChangeSetEntries(results.secretManager.secretChangeSet, ["secret"])
-		].map(({ action, name, labels, namespace }) => ({
-			action,
-			name,
-			labels,
-			namespace
-		}));
-		const warnings = [...allUnmanaged.map(({ resourceType, resourceName }) => ({
-			type: "unmanaged",
-			resourceType,
-			name: resourceName
-		})), ...results.secretManager.skippedSecrets.map((name) => ({
-			type: "skippedSecret",
-			resourceType: "secret",
-			name
-		}))];
-		const conflicts = allConflicts.map(({ resourceType, resourceName, currentOwner }) => ({
-			resourceType,
-			name: resourceName,
-			currentOwner
-		}));
-		logger.out({
-			summary,
-			changes,
-			warnings,
-			conflicts
-		});
-		return summary;
-	}
-	const allLines = [
-		...buildGroupedDisplayLines(results.functionRegistry.changeSet.title, formatChangeSetEntries(otherFunctionRegistryChanges)),
-		...results.staticWebsite.changeSet.lines(),
-		...results.staticWebsite.customDomainChangeSet.lines(),
-		...results.aiGateway.changeSet.lines(),
-		...results.app.lines(),
-		...buildGroupedDisplayLines("TailorDB", tailorDBEntries, tailorDBServiceActions),
-		...buildGroupedDisplayLines("Resolver", pipelineEntries, pipelineServiceActions),
-		...buildGroupedDisplayLines("Executor", executorEntries),
-		...buildGroupedDisplayLines("Workflow", workflowEntries),
-		...buildGroupedDisplayLines("IdP", idpEntries, idpServiceActions),
-		...buildGroupedDisplayLines("Auth", authEntries, authServiceActions),
-		...results.secretManager.vaultChangeSet.lines(),
-		...results.secretManager.secretChangeSet.lines()
+	const changes = [
+		...allDisplayEntries,
+		...tailorDBServiceActions.map(({ action, name }) => ({
+			action,
+			name,
+			labels: ["tailorDB"],
+			namespace: void 0
+		})),
+		...pipelineServiceActions.map(({ action, name }) => ({
+			action,
+			name,
+			labels: ["pipeline"],
+			namespace: void 0
+		})),
+		...idpServiceActions.map(({ action, name }) => ({
+			action,
+			name,
+			labels: ["idp"],
+			namespace: void 0
+		})),
+		...authServiceActions.map(({ action, name }) => ({
+			action,
+			name,
+			labels: ["auth"],
+			namespace: void 0
+		})),
+		...formatChangeSetEntries(otherFunctionRegistryChanges),
+		...formatChangeSetEntries(results.staticWebsite.changeSet, ["staticWebsite"]),
+		...formatChangeSetEntries(results.staticWebsite.customDomainChangeSet, ["customDomain"]),
+		...formatChangeSetEntries(results.aiGateway.changeSet, ["aiGateway"]),
+		...formatChangeSetEntries(results.app, ["application"]),
+		...formatChangeSetEntries(results.secretManager.vaultChangeSet, ["vault"]),
+		...formatChangeSetEntries(results.secretManager.secretChangeSet, ["secret"])
+	].map(({ action, name, labels, namespace }) => ({
+		action,
+		name,
+		labels,
+		namespace
+	}));
+	const warnings = [...allUnmanaged.map(({ resourceType, resourceName }) => ({
+		type: "unmanaged",
+		resourceType,
+		name: resourceName
+	})), ...results.secretManager.skippedSecrets.map((name) => ({
+		type: "skippedSecret",
+		resourceType: "secret",
+		name
+	}))];
+	const conflicts = allConflicts.map(({ resourceType, resourceName, currentOwner }) => ({
+		resourceType,
+		name: resourceName,
+		currentOwner
+	}));
+	const allLines = [
+		...buildGroupedDisplayLines(results.functionRegistry.changeSet.title, formatChangeSetEntries(otherFunctionRegistryChanges)),
+		...results.staticWebsite.changeSet.lines(),
+		...results.staticWebsite.customDomainChangeSet.lines(),
+		...results.aiGateway.changeSet.lines(),
+		...results.app.lines(),
+		...buildGroupedDisplayLines("TailorDB", tailorDBEntries, tailorDBServiceActions),
+		...buildGroupedDisplayLines("Resolver", pipelineEntries, pipelineServiceActions),
+		...buildGroupedDisplayLines("Executor", executorEntries),
+		...buildGroupedDisplayLines("Workflow", workflowEntries),
+		...buildGroupedDisplayLines("IdP", idpEntries, idpServiceActions),
+		...buildGroupedDisplayLines("Auth", authEntries, authServiceActions),
+		...results.secretManager.vaultChangeSet.lines(),
+		...results.secretManager.secretChangeSet.lines()
+	];
+	if (allUnmanaged.length > 0) {
+		allLines.push(styles.bold("Unmanaged resources (not in config):"));
+		for (const { resourceType, resourceName } of allUnmanaged) allLines.push(`  ${styles.warning("⚠")} ${styles.bold(resourceType)} "${resourceName}"`);
+	}
+	if (results.secretManager.skippedSecrets.length > 0) {
+		allLines.push(styles.bold("Secret Manager secrets (skipped - no value provided):"));
+		for (const name of results.secretManager.skippedSecrets) allLines.push(`  ${styles.dim("○")} ${name}`);
+	}
+	if (allConflicts.length > 0) {
+		allLines.push(styles.bold("Owner conflicts (will require confirmation on apply):"));
+		for (const { resourceType, resourceName, currentOwner } of allConflicts) allLines.push(`  ${styles.warning("!")} ${styles.bold(resourceType)} "${resourceName}" — owned by "${currentOwner}"`);
+	}
+	allLines.push(formatPlanSummary(summary));
+	return {
+		summary,
+		json: {
+			summary,
+			changes,
+			warnings,
+			conflicts
+		},
+		lines: allLines
+	};
+}
+/**
+* Format and output the plan results, then return a summary of change counts.
+* In JSON dry-run mode a JSON payload is written to stdout. In all other modes
+* the human-readable diff goes to stdout (dry-run) or stderr (apply).
+* @param results - Planned results across all services
+* @param opts - Output options (dry-run mode flag)
+* @returns Aggregated plan summary counts
+*/
+function printPlanResults(results, opts) {
+	const report = buildPlanReport(results);
+	if (logger.jsonMode && opts?.dryRun) {
+		logger.out(report.json);
+		return report.summary;
+	}
+	const output = report.lines.join("\n");
+	if (opts?.dryRun) logger.out(output);
+	else logger.log(output);
+	return report.summary;
+}
+/**
+* Summarize plan counts from display entries, service actions, and non-grouped changesets.
+* @param results - Planned apply results
+* @param displayEntries - All grouped display entries across sections
+* @param serviceActions - All service-level namespace actions
+* @returns Aggregated plan summary
+*/
+function summarizePlanResults(results, displayEntries, serviceActions) {
+	const summary = {
+		create: 0,
+		update: 0,
+		delete: 0,
+		replace: 0
+	};
+	for (const entry of displayEntries) summary[entry.action] += 1;
+	for (const sa of serviceActions) summary[sa.action] += 1;
+	const { otherChanges } = splitFunctionRegistryChanges(results.functionRegistry.changeSet);
+	const nonGrouped = summarizeChangeSets([
+		otherChanges,
+		results.staticWebsite.changeSet,
+		results.staticWebsite.customDomainChangeSet,
+		results.aiGateway.changeSet,
+		results.app,
+		results.secretManager.vaultChangeSet,
+		results.secretManager.secretChangeSet
+	]);
+	summary.create += nonGrouped.create;
+	summary.update += nonGrouped.update;
+	summary.delete += nonGrouped.delete;
+	summary.replace += nonGrouped.replace;
+	return summary;
+}
+/**
+* Parse the deploy config option into one or more config paths.
+* @param configPath - Raw `--config` option value
+* @returns Config paths, or one undefined entry to preserve default config lookup
+*/
+function parseDeployConfigPaths(configPath) {
+	const rawConfigPath = configPath ?? process.env.TAILOR_PLATFORM_SDK_CONFIG_PATH;
+	if (rawConfigPath === void 0) return [void 0];
+	const configPaths = rawConfigPath.split(",").map((entry) => entry.trim());
+	if (configPaths.some((entry) => entry.length === 0)) throw new Error("--config must contain one or more non-empty config paths.");
+	return configPaths;
+}
+async function buildDeploymentTarget(params) {
+	const { configPath, dryRun, buildOnly, noCache, packageVersion, cacheDir } = params;
+	const { config, plugins } = await withSpan("build.loadConfig", async () => {
+		const foundPath = loadConfigPath(configPath);
+		if (foundPath) {
+			const resolvedPath = path.resolve(process.cwd(), foundPath);
+			if (fs$1.existsSync(resolvedPath)) await ensureConfigIdForDeploy({
+				configPath: resolvedPath,
+				dryRun,
+				buildOnly
+			});
+		}
+		return loadConfig(configPath);
+	});
+	const configDir = path.dirname(config.path);
+	const lockfilePath = findUpSync("pnpm-lock.yaml", { cwd: configDir }) ?? findUpSync("package-lock.json", { cwd: configDir }) ?? findUpSync("yarn.lock", { cwd: configDir }) ?? findUpSync("bun.lock", { cwd: configDir });
+	const cacheManager = createCacheManager({
+		enabled: !noCache,
+		cacheDir,
+		sdkVersion: packageVersion,
+		lockfileHash: lockfilePath ? hashFile(lockfilePath) : void 0
+	});
+	let pluginManager;
+	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
+	await withSpan("build.generateUserTypes", () => generateUserTypes({
+		config,
+		configPath: config.path
+	}));
+	let application;
+	let workflowBuildResult;
+	let httpAdapterBuildResult;
+	let bundledScripts;
+	try {
+		const result = await withSpan("build.loadApplication", () => loadApplication({
+			config,
+			pluginManager,
+			bundleCache: cacheManager.bundleCache
+		}));
+		application = result.application;
+		workflowBuildResult = result.workflowBuildResult;
+		httpAdapterBuildResult = result.httpAdapterBuildResult;
+		bundledScripts = result.bundledScripts;
+	} finally {
+		cacheManager.finalize();
+	}
+	return {
+		config,
+		application,
+		workflowBuildResult,
+		httpAdapterBuildResult,
+		bundledScripts
+	};
+}
+async function buildDeploymentTargets(params) {
+	const { configPaths, buildTarget = buildDeploymentTarget, ...targetParams } = params;
+	return Promise.all(configPaths.map((configPath) => buildTarget({
+		...targetParams,
+		configPath
+	})));
+}
+function setBundledScript(target, name, code, kind) {
+	if (target.has(name)) throw new Error(`Duplicate ${kind} bundle name "${name}" across config files.`);
+	target.set(name, code);
+}
+function addBundledScripts(target, source, kind) {
+	for (const [name, code] of source) setBundledScript(target, name, code, kind);
+}
+function collectDuplicateBundleNames(targets, select) {
+	const seen = /* @__PURE__ */ new Set();
+	const duplicates = /* @__PURE__ */ new Set();
+	for (const target of targets) for (const name of select(target).keys()) {
+		if (seen.has(name)) duplicates.add(name);
+		seen.add(name);
+	}
+	return duplicates;
+}
+function addResolverBundledScripts(target, source, duplicateNames) {
+	const consumedNames = /* @__PURE__ */ new Set();
+	for (const service of source.application.resolverServices) for (const resolver of Object.values(service.resolvers)) {
+		const code = source.bundledScripts.resolvers.get(resolver.name);
+		if (code === void 0) continue;
+		setBundledScript(target, duplicateNames.has(resolver.name) ? resolverFunctionName(service.namespace, resolver.name) : resolver.name, code, "resolver");
+		consumedNames.add(resolver.name);
+	}
+	for (const [name, code] of source.bundledScripts.resolvers) if (!consumedNames.has(name)) setBundledScript(target, name, code, "resolver");
+}
+/**
+* Merge per-config bundled scripts into one build-only result.
+* @param targets - Built deployment targets to merge
+* @returns Combined bundled scripts across all targets
+*/
+function mergeBundledScripts(targets) {
+	const bundledScripts = {
+		resolvers: /* @__PURE__ */ new Map(),
+		executors: /* @__PURE__ */ new Map(),
+		workflowJobs: /* @__PURE__ */ new Map(),
+		authHooks: /* @__PURE__ */ new Map()
+	};
+	const duplicateResolverNames = collectDuplicateBundleNames(targets, (target) => target.bundledScripts.resolvers);
+	for (const target of targets) {
+		addResolverBundledScripts(bundledScripts.resolvers, target, duplicateResolverNames);
+		addBundledScripts(bundledScripts.executors, target.bundledScripts.executors, "executor");
+		addBundledScripts(bundledScripts.workflowJobs, target.bundledScripts.workflowJobs, "workflow job");
+		addBundledScripts(bundledScripts.authHooks, target.bundledScripts.authHooks, "auth hook");
+	}
+	return bundledScripts;
+}
+/**
+* Reject resource names that collide across configs. Each checked resource
+* type is workspace-global (its TRN is not qualified by namespace or app), so
+* a duplicate name would make two configs target the same platform resource:
+* one config's apply could overwrite the other's, or a fresh create could be
+* attempted twice. Resolver and auth-hook function names are namespace- or
+* app-qualified and are intentionally excluded.
+* @param targets - Built deployment targets to check
+*/
+function assertUniqueGlobalResourceNames(targets) {
+	for (const check of DEPLOY_MANAGED_RESOURCE_DEFINITIONS) {
+		const seen = /* @__PURE__ */ new Set();
+		for (const target of targets) for (const name of check.namesOf(target)) {
+			if (seen.has(name)) throw new Error(`Duplicate ${check.resourceLabel} name "${name}" across config files. ${check.resourceLabel} names must be unique across all configs in a single deploy.`);
+			seen.add(name);
+		}
+	}
+}
+function collectPlannedExternalTailorDBServices(target, targets) {
+	const externalNamespaces = new Set(target.application.externalTailorDBNamespaces);
+	if (externalNamespaces.size === 0) return [];
+	return targets.flatMap((candidate) => candidate.application.tailorDBServices.filter((service) => externalNamespaces.has(service.namespace)));
+}
+function collectExternalAuthIdpConfigNames(targets) {
+	const idpConfigNames = /* @__PURE__ */ new Map();
+	for (const target of targets) {
+		const authService = target.application.authService;
+		if (!authService) continue;
+		const { name } = authService.config;
+		const idpConfigName = authService.config.idProvider?.name;
+		if (idpConfigNames.has(name) && idpConfigNames.get(name) !== idpConfigName) throw new Error(`Auth namespace "${name}" is defined by multiple config files with different IdP configs. Auth namespace names must be unique across all configs in a single deploy.`);
+		idpConfigNames.set(name, idpConfigName);
+	}
+	return idpConfigNames;
+}
+function collectDeployRunPlanInputs(targets) {
+	return {
+		idpUserTriggerTargets: collectDeployIdpUserTriggerTargets(targets),
+		expectedLocalStaticWebsiteNames: collectExpectedLocalStaticWebsiteNames(targets),
+		externalAuthIdpConfigNames: collectExternalAuthIdpConfigNames(targets)
+	};
+}
+async function planDeploymentTarget(params) {
+	const { target, targets, runInputs, client, workspaceId, noSchemaCheck } = params;
+	const { config, application, workflowBuildResult, httpAdapterBuildResult, bundledScripts } = target;
+	await withSpan("plan.validateTailorDBTypeNames", () => assertUniqueTailorDBTypeNamesWithExternal({
+		client,
+		workspaceId,
+		tailorDBServices: application.tailorDBServices,
+		externalTailorDBNamespaces: application.externalTailorDBNamespaces,
+		plannedExternalTailorDBServices: collectPlannedExternalTailorDBServices(target, targets)
+	}));
+	const workflowService = application.workflowService;
+	const functionEntries = collectFunctionEntries(application, filterBundledWorkflowJobs(workflowService?.jobs ?? [], workflowBuildResult?.usedJobNames ?? []), bundledScripts);
+	const forceApplyAll = await withSpan("plan.detectSdkVersionChange", () => shouldForceApplyAll(client, workspaceId, application, functionEntries));
+	return withSpan("plan", async () => {
+		const applications = targets.map((target) => target.application);
+		const tailorDBTypeNamespaces = collectVisibleTailorDBTypeNamespaces(application, applications);
+		const resolverNamespaces = collectVisibleResolverNamespaces(application, applications);
+		const idpNames = collectVisibleIdpNames(application, applications);
+		const ctx = {
+			client,
+			workspaceId,
+			application,
+			forRemoval: false,
+			config,
+			noSchemaCheck,
+			forceApplyAll,
+			...runInputs,
+			executorUsedTailorDBTypes: collectExecutorUsedTailorDBTypes(target, targets),
+			executorUsedResolvers: collectExecutorUsedResolvers(target, targets),
+			tailorDBTypeNamespaces,
+			resolverNamespaces,
+			idpNames
+		};
+		const functionRegistry = await withSpan("plan.functionRegistry", () => planFunctionRegistry(client, workspaceId, application.name, application.id, functionEntries));
+		const unchangedWorkflowJobs = new Set(functionRegistry.changeSet.unchanged.filter((entry) => entry.name.startsWith(WORKFLOW_PREFIX)).map((entry) => entry.name.slice(WORKFLOW_PREFIX.length)));
+		const [tailorDB, staticWebsite, aiGateway, idp, auth, pipeline, app, executor, workflow, secretManager] = await Promise.all([
+			withSpan("plan.tailorDB", () => planTailorDB(ctx)),
+			withSpan("plan.staticWebsite", () => planStaticWebsite(ctx)),
+			withSpan("plan.aiGateway", () => planAIGateway(ctx)),
+			withSpan("plan.idp", () => planIdP(ctx)),
+			withSpan("plan.auth", () => planAuth(ctx)),
+			withSpan("plan.pipeline", () => planPipeline(ctx)),
+			withSpan("plan.application", () => planApplication(ctx, httpAdapterBuildResult)),
+			withSpan("plan.executor", () => planExecutor(ctx)),
+			withSpan("plan.workflow", () => planWorkflow(client, workspaceId, application.name, application.id, workflowService?.workflows ?? {}, workflowBuildResult?.mainJobDeps ?? {}, unchangedWorkflowJobs)),
+			withSpan("plan.secretManager", () => planSecretManager(ctx))
+		]);
+		return {
+			application,
+			functionRegistry,
+			tailorDB,
+			staticWebsite,
+			aiGateway,
+			idp,
+			auth,
+			pipeline,
+			app,
+			executor,
+			workflow,
+			secretManager
+		};
+	});
+}
+async function planDeploymentTargets(params) {
+	const { targets, planTarget = planDeploymentTarget, ...planParams } = params;
+	return Promise.all(targets.map((target) => planTarget({
+		...planParams,
+		target,
+		targets
+	})));
+}
+function deploymentPlanResults(deployment) {
+	const { application: _application, ...results } = deployment;
+	return results;
+}
+function collectOwnerConflicts(results) {
+	return [
+		...results.functionRegistry.conflicts,
+		...results.tailorDB.conflicts,
+		...results.staticWebsite.conflicts,
+		...results.aiGateway.conflicts,
+		...results.idp.conflicts,
+		...results.auth.conflicts,
+		...results.pipeline.conflicts,
+		...results.executor.conflicts,
+		...results.workflow.conflicts,
+		...results.secretManager.conflicts
+	];
+}
+function collectUnmanagedResources(results) {
+	return [
+		...results.functionRegistry.unmanaged,
+		...results.tailorDB.unmanaged,
+		...results.staticWebsite.unmanaged,
+		...results.aiGateway.unmanaged,
+		...results.idp.unmanaged,
+		...results.auth.unmanaged,
+		...results.pipeline.unmanaged,
+		...results.executor.unmanaged,
+		...results.workflow.unmanaged,
+		...results.secretManager.unmanaged
 	];
-	if (allUnmanaged.length > 0) {
-		allLines.push(styles.bold("Unmanaged resources (not in config):"));
-		for (const { resourceType, resourceName } of allUnmanaged) allLines.push(`  ${styles.warning("⚠")} ${styles.bold(resourceType)} "${resourceName}"`);
+}
+function collectResourceOwners(results) {
+	return /* @__PURE__ */ new Set([
+		...results.functionRegistry.resourceOwners,
+		...results.tailorDB.resourceOwners,
+		...results.staticWebsite.resourceOwners,
+		...results.aiGateway.resourceOwners,
+		...results.idp.resourceOwners,
+		...results.auth.resourceOwners,
+		...results.pipeline.resourceOwners,
+		...results.executor.resourceOwners,
+		...results.workflow.resourceOwners,
+		...results.secretManager.resourceOwners
+	]);
+}
+function collectImportantResourceDeletions(results) {
+	const importantDeletions = [];
+	for (const del of results.tailorDB.changeSet.type.deletes) importantDeletions.push({
+		resourceType: "TailorDB type",
+		resourceName: del.name
+	});
+	for (const del of results.staticWebsite.changeSet.deletes) importantDeletions.push({
+		resourceType: "StaticWebsite",
+		resourceName: del.name
+	});
+	for (const del of results.aiGateway.changeSet.deletes) importantDeletions.push({
+		resourceType: "AIGateway",
+		resourceName: del.name
+	});
+	for (const del of results.auth.changeSet.oauth2Client.deletes) importantDeletions.push({
+		resourceType: "OAuth2 client",
+		resourceName: del.name
+	});
+	for (const replace of results.auth.changeSet.oauth2Client.replaces) importantDeletions.push({
+		resourceType: "OAuth2 client (client type change)",
+		resourceName: replace.name
+	});
+	for (const del of results.auth.changeSet.connection.deletes) importantDeletions.push({
+		resourceType: "Auth connection",
+		resourceName: del.name
+	});
+	for (const del of results.secretManager.vaultChangeSet.deletes) importantDeletions.push({
+		resourceType: "Secret Manager vault",
+		resourceName: del.name
+	});
+	for (const del of results.secretManager.secretChangeSet.deletes) importantDeletions.push({
+		resourceType: "Secret Manager secret",
+		resourceName: del.name
+	});
+	return importantDeletions;
+}
+function readResourceField(item, field) {
+	const itemRecord = item;
+	for (const requestField of [
+		"request",
+		"deleteRequest",
+		"createRequest"
+	]) {
+		const request = itemRecord[requestField];
+		if (request && typeof request === "object" && field in request) {
+			const value = request[field];
+			return value == null ? void 0 : String(value);
+		}
 	}
-	if (results.secretManager.skippedSecrets.length > 0) {
-		allLines.push(styles.bold("Secret Manager secrets (skipped - no value provided):"));
-		for (const name of results.secretManager.skippedSecrets) allLines.push(`  ${styles.dim("○")} ${name}`);
+	const value = itemRecord[field];
+	return value == null ? void 0 : String(value);
+}
+function managedResourceName(group, item) {
+	if (group.getName) return group.getName(item);
+	return item.name;
+}
+function managedResourceKey(group, item) {
+	const namespace = group.namespaceFields?.map((field) => readResourceField(item, field)).find((value) => value !== void 0);
+	const name = managedResourceName(group, item);
+	return namespace !== void 0 ? `${group.resourceType}:${namespace}:${name}` : `${group.resourceType}:${name}`;
+}
+function managedNamespaceOwnerKey(group, item) {
+	if (!group.namespaceOwnerResourceType) return;
+	const namespace = group.namespaceFields?.map((field) => readResourceField(item, field)).find((value) => value !== void 0);
+	return namespace !== void 0 ? `${group.namespaceOwnerResourceType}:${namespace}` : void 0;
+}
+function addManagedResourceClaims(claims, group, item) {
+	claims.add(managedResourceKey(group, item));
+	const namespaceOwnerKey = managedNamespaceOwnerKey(group, item);
+	if (namespaceOwnerKey) claims.add(namespaceOwnerKey);
+}
+function isManagedResourceClaimed(claims, group, item) {
+	if (claims.has(managedResourceKey(group, item))) return true;
+	const namespaceOwnerKey = managedNamespaceOwnerKey(group, item);
+	return namespaceOwnerKey ? claims.has(namespaceOwnerKey) : false;
+}
+function retainDeletesNotClaimed(group, otherClaims) {
+	let writeIndex = 0;
+	for (const item of group.changeSet.deletes) {
+		if (isManagedResourceClaimed(otherClaims, group, item)) {
+			logger.debug(`Skipping delete of ${managedResourceKey(group, item)}: still managed by another config in this deploy.`);
+			continue;
+		}
+		group.changeSet.deletes[writeIndex] = item;
+		writeIndex += 1;
 	}
-	if (allConflicts.length > 0) {
-		allLines.push(styles.bold("Owner conflicts (will require confirmation on apply):"));
-		for (const { resourceType, resourceName, currentOwner } of allConflicts) allLines.push(`  ${styles.warning("!")} ${styles.bold(resourceType)} "${resourceName}" — owned by "${currentOwner}"`);
+	group.changeSet.deletes.length = writeIndex;
+}
+function workflowJobFunctionItems(items) {
+	const jobNames = /* @__PURE__ */ new Set();
+	for (const item of items) {
+		const usedJobNames = item.usedJobNames;
+		if (!Array.isArray(usedJobNames)) continue;
+		for (const jobName of usedJobNames) if (typeof jobName === "string") jobNames.add(jobName);
 	}
-	allLines.push(formatPlanSummary(summary));
-	const output = allLines.join("\n");
-	if (opts?.dryRun) logger.out(output);
-	else logger.log(output);
-	return summary;
+	return [...jobNames].map((name) => ({ name }));
 }
-/**
-* Summarize plan counts from display entries, service actions, and non-grouped changesets.
-* @param results - Planned apply results
-* @param displayEntries - All grouped display entries across sections
-* @param serviceActions - All service-level namespace actions
-* @returns Aggregated plan summary
-*/
-function summarizePlanResults(results, displayEntries, serviceActions) {
-	const summary = {
+function workflowJobFunctionResourceGroup(results) {
+	return {
+		changeSet: {
+			creates: workflowJobFunctionItems(results.workflow.changeSet.creates),
+			updates: workflowJobFunctionItems(results.workflow.changeSet.updates),
+			replaces: workflowJobFunctionItems(results.workflow.changeSet.replaces),
+			unchanged: [...results.workflow.unchangedWorkflowJobNames].map((name) => ({ name })),
+			deletes: results.workflow.jobFunctionDeletes
+		},
+		resourceType: "workflow_job_function",
+		getName: (item) => "jobFunctionName" in item ? item.jobFunctionName : item.name
+	};
+}
+const MANAGED_RESOURCE_NAMESPACE_FIELDS = [
+	"namespaceName",
+	"authNamespace",
+	"vaultName",
+	"staticWebsiteName"
+];
+const DEPLOY_MANAGED_RESOURCE_DEFINITIONS = [
+	{
+		resourceLabel: "Application",
+		resourceType: "application",
+		namesOf: (target) => [target.application.name],
+		changeSetOf: (results) => results.app
+	},
+	{
+		resourceLabel: "Executor",
+		resourceType: "executor",
+		namesOf: (target) => Object.values(target.application.executorService?.executors ?? {}).map((executor) => executor.name),
+		changeSetOf: (results) => results.executor.changeSet
+	},
+	{
+		resourceLabel: "Workflow job",
+		resourceType: "workflow_job_function",
+		namesOf: (target) => target.bundledScripts.workflowJobs.keys(),
+		changeSetOf: (results) => workflowJobFunctionResourceGroup(results).changeSet,
+		getName: (item) => "jobFunctionName" in item ? item.jobFunctionName : item.name
+	},
+	{
+		resourceLabel: "Workflow",
+		resourceType: "workflow",
+		namesOf: (target) => Object.values(target.application.workflowService?.workflows ?? {}).map((workflow) => workflow.name),
+		changeSetOf: (results) => results.workflow.changeSet
+	},
+	{
+		resourceLabel: "Auth connection",
+		resourceType: "auth.connection",
+		namespaceFields: MANAGED_RESOURCE_NAMESPACE_FIELDS,
+		namespaceOwnerResourceType: "auth.service",
+		namesOf: (target) => Object.keys(target.application.authService?.connections ?? {}),
+		changeSetOf: (results) => results.auth.changeSet.connection
+	},
+	{
+		resourceLabel: "StaticWebsite",
+		resourceType: "staticwebsite",
+		namesOf: (target) => target.application.staticWebsiteServices.map((service) => service.name),
+		changeSetOf: (results) => results.staticWebsite.changeSet
+	},
+	{
+		resourceLabel: "TailorDB namespace",
+		resourceType: "tailordb.service",
+		namesOf: (target) => target.application.tailorDBServices.map((service) => service.namespace),
+		changeSetOf: (results) => results.tailorDB.changeSet.service
+	},
+	{
+		resourceLabel: "Auth namespace",
+		resourceType: "auth.service",
+		namesOf: (target) => {
+			const name = target.application.authService?.config.name;
+			return name === void 0 ? [] : [name];
+		},
+		changeSetOf: (results) => results.auth.changeSet.service
+	},
+	{
+		resourceLabel: "IdP namespace",
+		resourceType: "idp.service",
+		namesOf: (target) => target.application.idpServices.map((idp) => idp.name),
+		changeSetOf: (results) => results.idp.changeSet.service
+	},
+	{
+		resourceLabel: "Resolver namespace",
+		resourceType: "pipeline.service",
+		namesOf: (target) => target.application.resolverServices.map((service) => service.namespace),
+		changeSetOf: (results) => results.pipeline.changeSet.service
+	},
+	{
+		resourceLabel: "AIGateway",
+		resourceType: "aigateway",
+		namesOf: (target) => target.application.aiGatewayServices.map((service) => service.name),
+		changeSetOf: (results) => results.aiGateway.changeSet
+	},
+	{
+		resourceLabel: "Secret Manager vault",
+		resourceType: "secret.vault",
+		namesOf: (target) => target.application.secrets.map((vault) => vault.vaultName),
+		changeSetOf: (results) => results.secretManager.vaultChangeSet
+	}
+];
+function managedResourceGroupFromDefinition(definition, results) {
+	const { changeSetOf, namesOf: _namesOf, resourceLabel: _resourceLabel, ...group } = definition;
+	return {
+		...group,
+		changeSet: changeSetOf(results)
+	};
+}
+function managedResourceGroups(results) {
+	return [
+		{
+			changeSet: results.functionRegistry.changeSet,
+			resourceType: "function_registry"
+		},
+		...DEPLOY_MANAGED_RESOURCE_DEFINITIONS.map((definition) => managedResourceGroupFromDefinition(definition, results)),
+		{
+			changeSet: results.tailorDB.changeSet.type,
+			resourceType: "tailordb.type",
+			namespaceFields: MANAGED_RESOURCE_NAMESPACE_FIELDS,
+			namespaceOwnerResourceType: "tailordb.service"
+		},
+		{
+			changeSet: results.tailorDB.changeSet.gqlPermission,
+			resourceType: "tailordb.gql_permission",
+			namespaceFields: MANAGED_RESOURCE_NAMESPACE_FIELDS,
+			namespaceOwnerResourceType: "tailordb.service"
+		},
+		{
+			changeSet: results.staticWebsite.customDomainChangeSet,
+			resourceType: "staticwebsite.custom_domain",
+			namespaceFields: MANAGED_RESOURCE_NAMESPACE_FIELDS,
+			namespaceOwnerResourceType: "staticwebsite"
+		},
+		{
+			changeSet: results.idp.changeSet.client,
+			resourceType: "idp.client",
+			namespaceFields: MANAGED_RESOURCE_NAMESPACE_FIELDS,
+			namespaceOwnerResourceType: "idp.service"
+		},
+		{
+			changeSet: results.auth.changeSet.idpConfig,
+			resourceType: "auth.idp_config",
+			namespaceFields: MANAGED_RESOURCE_NAMESPACE_FIELDS,
+			namespaceOwnerResourceType: "auth.service"
+		},
+		{
+			changeSet: results.auth.changeSet.userProfileConfig,
+			resourceType: "auth.user_profile_config",
+			namespaceFields: MANAGED_RESOURCE_NAMESPACE_FIELDS,
+			namespaceOwnerResourceType: "auth.service"
+		},
+		{
+			changeSet: results.auth.changeSet.tenantConfig,
+			resourceType: "auth.tenant_config",
+			namespaceFields: MANAGED_RESOURCE_NAMESPACE_FIELDS,
+			namespaceOwnerResourceType: "auth.service"
+		},
+		{
+			changeSet: results.auth.changeSet.machineUser,
+			resourceType: "auth.machine_user",
+			namespaceFields: MANAGED_RESOURCE_NAMESPACE_FIELDS,
+			namespaceOwnerResourceType: "auth.service"
+		},
+		{
+			changeSet: results.auth.changeSet.oauth2Client,
+			resourceType: "auth.oauth2_client",
+			namespaceFields: MANAGED_RESOURCE_NAMESPACE_FIELDS,
+			namespaceOwnerResourceType: "auth.service"
+		},
+		{
+			changeSet: results.auth.changeSet.authHook,
+			resourceType: "auth.hook",
+			namespaceFields: MANAGED_RESOURCE_NAMESPACE_FIELDS,
+			namespaceOwnerResourceType: "auth.service"
+		},
+		{
+			changeSet: results.auth.changeSet.scim,
+			resourceType: "auth.scim",
+			namespaceFields: MANAGED_RESOURCE_NAMESPACE_FIELDS,
+			namespaceOwnerResourceType: "auth.service"
+		},
+		{
+			changeSet: results.auth.changeSet.scimResource,
+			resourceType: "auth.scim_resource",
+			namespaceFields: MANAGED_RESOURCE_NAMESPACE_FIELDS,
+			namespaceOwnerResourceType: "auth.service"
+		},
+		{
+			changeSet: results.pipeline.changeSet.resolver,
+			resourceType: "pipeline.resolver",
+			namespaceFields: MANAGED_RESOURCE_NAMESPACE_FIELDS,
+			namespaceOwnerResourceType: "pipeline.service"
+		},
+		{
+			changeSet: results.secretManager.secretChangeSet,
+			resourceType: "secret.secret",
+			namespaceFields: MANAGED_RESOURCE_NAMESPACE_FIELDS,
+			namespaceOwnerResourceType: "secret.vault"
+		}
+	];
+}
+function dropCrossDeploymentManagedDeletes(deployments) {
+	const groupsByDeployment = deployments.map((deployment) => managedResourceGroups(deploymentPlanResults(deployment)));
+	const claimsByDeployment = groupsByDeployment.map((groups) => groups.reduce((claims, group) => {
+		for (const item of [
+			...group.changeSet.creates,
+			...group.changeSet.updates,
+			...group.changeSet.replaces,
+			...group.changeSet.unchanged
+		]) addManagedResourceClaims(claims, group, item);
+		return claims;
+	}, /* @__PURE__ */ new Set()));
+	groupsByDeployment.forEach((groups, deploymentIndex) => {
+		const otherClaims = /* @__PURE__ */ new Set();
+		claimsByDeployment.forEach((claims, claimIndex) => {
+			if (claimIndex === deploymentIndex) return;
+			for (const claim of claims) otherClaims.add(claim);
+		});
+		for (const group of groups) retainDeletesNotClaimed(group, otherClaims);
+	});
+}
+function collectDeploymentResourceOwners(deployments) {
+	const owners = /* @__PURE__ */ new Set();
+	for (const deployment of deployments) for (const owner of collectResourceOwners(deploymentPlanResults(deployment))) owners.add(owner);
+	return owners;
+}
+async function confirmDeploymentPlans(params) {
+	const { deployments, yes } = params;
+	const targetAppNames = new Set(deployments.map((deployment) => deployment.application.name));
+	const resourceOwners = collectDeploymentResourceOwners(deployments);
+	const scheduledRenamedAppDeletes = /* @__PURE__ */ new Set();
+	const importantDeletions = [];
+	for (const deployment of deployments) {
+		const results = deploymentPlanResults(deployment);
+		const conflicts = collectOwnerConflicts(results);
+		await confirmOwnerConflict(conflicts, deployment.application.name, yes);
+		await confirmUnmanagedResources(collectUnmanagedResources(results), deployment.application.name, yes);
+		importantDeletions.push(...collectImportantResourceDeletions(results));
+		const emptyApps = computeRenamedAppDeletions({
+			conflicts,
+			resourceOwners,
+			protectedAppNames: targetAppNames
+		});
+		for (const emptyApp of emptyApps) {
+			if (scheduledRenamedAppDeletes.has(emptyApp)) continue;
+			scheduledRenamedAppDeletes.add(emptyApp);
+			deployment.app.deletes.push({
+				name: emptyApp,
+				request: {
+					workspaceId: deployment.tailorDB.context.workspaceId,
+					applicationName: emptyApp
+				}
+			});
+		}
+	}
+	await confirmImportantResourceDeletion(importantDeletions, yes);
+}
+function sumPlanSummaries(summaries) {
+	return summaries.reduce((acc, summary) => ({
+		create: acc.create + summary.create,
+		update: acc.update + summary.update,
+		delete: acc.delete + summary.delete,
+		replace: acc.replace + summary.replace
+	}), {
 		create: 0,
 		update: 0,
 		delete: 0,
 		replace: 0
-	};
-	for (const entry of displayEntries) summary[entry.action] += 1;
-	for (const sa of serviceActions) summary[sa.action] += 1;
-	const { otherChanges } = splitFunctionRegistryChanges(results.functionRegistry.changeSet);
-	const nonGrouped = summarizeChangeSets([
-		otherChanges,
-		results.staticWebsite.changeSet,
-		results.staticWebsite.customDomainChangeSet,
-		results.aiGateway.changeSet,
-		results.app,
-		results.secretManager.vaultChangeSet,
-		results.secretManager.secretChangeSet
-	]);
-	summary.create += nonGrouped.create;
-	summary.update += nonGrouped.update;
-	summary.delete += nonGrouped.delete;
-	summary.replace += nonGrouped.replace;
-	return summary;
+	});
+}
+function printDeploymentPlans(deployments, opts) {
+	if (logger.jsonMode && opts?.dryRun) {
+		const reports = deployments.map((deployment) => buildPlanReport(deploymentPlanResults(deployment)));
+		const summary = sumPlanSummaries(reports.map((report) => report.summary));
+		logger.out({
+			summary,
+			changes: reports.flatMap((report) => report.json.changes),
+			warnings: reports.flatMap((report) => report.json.warnings),
+			conflicts: reports.flatMap((report) => report.json.conflicts)
+		});
+		return summary;
+	}
+	return sumPlanSummaries(deployments.map((deployment) => printPlanResults(deploymentPlanResults(deployment), opts)));
+}
+async function validateDeploymentPlans(deployments) {
+	for (const deployment of deployments) await validatePlan(deploymentPlanResults(deployment));
 }
 /**
 * Deploy the configured application to the Tailor platform.
@@ -11617,21 +12423,10 @@ function summarizePlanResults(results, displayEntries, serviceActions) {
 async function deploy(options) {
 	return withSpan("deploy", async (rootSpan) => {
 		rootSpan.setAttribute("deploy.dry_run", options?.dryRun ?? false);
-		const { config, application, workflowBuildResult, httpAdapterBuildResult, bundledScripts, buildOnly } = await withSpan("build", async () => {
+		const configPaths = parseDeployConfigPaths(options?.configPath);
+		const { targets, buildOnly } = await withSpan("build", async () => {
 			const dryRun = options?.dryRun ?? false;
 			const buildOnly = options?.buildOnly ?? parseBoolean(process.env.TAILOR_PLATFORM_SDK_BUILD_ONLY) === true;
-			const { config, plugins } = await withSpan("build.loadConfig", async () => {
-				const foundPath = loadConfigPath(options?.configPath);
-				if (foundPath) {
-					const resolvedPath = path.resolve(process.cwd(), foundPath);
-					if (fs$1.existsSync(resolvedPath)) await ensureConfigIdForDeploy({
-						configPath: resolvedPath,
-						dryRun,
-						buildOnly
-					});
-				}
-				return loadConfig(options?.configPath);
-			});
 			const noCache = options?.noCache ?? false;
 			const packageJson = await readPackageJson();
 			const cacheDir = path.resolve(getDistDir(), "cache");
@@ -11642,256 +12437,51 @@ async function deploy(options) {
 				});
 				logger.info("Bundle cache cleaned");
 			}
-			const configDir = path.dirname(config.path);
-			const lockfilePath = findUpSync("pnpm-lock.yaml", { cwd: configDir }) ?? findUpSync("package-lock.json", { cwd: configDir }) ?? findUpSync("yarn.lock", { cwd: configDir }) ?? findUpSync("bun.lock", { cwd: configDir });
-			const cacheManager = createCacheManager({
-				enabled: !noCache,
-				cacheDir,
-				sdkVersion: packageJson.version ?? "unknown",
-				lockfileHash: lockfilePath ? hashFile(lockfilePath) : void 0
-			});
-			let pluginManager;
-			if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-			await withSpan("build.generateUserTypes", () => generateUserTypes({
-				config,
-				configPath: config.path
-			}));
-			let application;
-			let workflowBuildResult;
-			let httpAdapterBuildResult;
-			let bundledScripts;
-			try {
-				const result = await withSpan("build.loadApplication", () => loadApplication({
-					config,
-					pluginManager,
-					bundleCache: cacheManager.bundleCache
-				}));
-				application = result.application;
-				workflowBuildResult = result.workflowBuildResult;
-				httpAdapterBuildResult = result.httpAdapterBuildResult;
-				bundledScripts = result.bundledScripts;
-			} finally {
-				cacheManager.finalize();
-			}
 			return {
-				config,
-				plugins,
-				application,
-				workflowBuildResult,
-				httpAdapterBuildResult,
-				bundledScripts,
-				dryRun,
+				targets: await buildDeploymentTargets({
+					configPaths,
+					dryRun,
+					buildOnly,
+					noCache,
+					packageVersion: packageJson.version ?? "unknown",
+					cacheDir
+				}),
 				buildOnly
 			};
 		});
-		if (buildOnly) return { bundledScripts };
+		if (buildOnly) return { bundledScripts: mergeBundledScripts(targets) };
+		assertUniqueGlobalResourceNames(targets);
 		const client = await initOperatorClient(await loadAccessToken({ profile: options?.profile }));
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: options?.workspaceId,
 			profile: options?.profile
 		});
-		rootSpan.setAttribute("app.name", application.name);
+		rootSpan.setAttribute("app.name", targets.map((target) => target.application.name).join(","));
 		rootSpan.setAttribute("workspace.id", workspaceId);
-		await withSpan("plan.validateTailorDBTypeNames", () => assertUniqueTailorDBTypeNamesWithExternal({
+		const deployments = await planDeploymentTargets({
+			targets,
+			runInputs: collectDeployRunPlanInputs(targets),
 			client,
 			workspaceId,
-			tailorDBServices: application.tailorDBServices,
-			externalTailorDBNamespaces: application.externalTailorDBNamespaces
-		}));
-		const workflowService = application.workflowService;
-		const functionEntries = collectFunctionEntries(application, filterBundledWorkflowJobs(workflowService?.jobs ?? [], workflowBuildResult?.usedJobNames ?? []), bundledScripts);
+			noSchemaCheck: options?.noSchemaCheck
+		});
 		const dryRun = options?.dryRun ?? false;
 		const yes = options?.yes ?? false;
-		const forceApplyAll = await withSpan("plan.detectSdkVersionChange", () => shouldForceApplyAll(client, workspaceId, application, functionEntries));
-		const { functionRegistry, tailorDB, staticWebsite, aiGateway, idp, auth, pipeline, app, executor, workflow, secretManager } = await withSpan("plan", async () => {
-			const idpUserTriggerTargets = collectIdpUserTriggerTargets(application);
-			const ctx = {
-				client,
-				workspaceId,
-				application,
-				forRemoval: false,
-				config,
-				noSchemaCheck: options?.noSchemaCheck,
-				forceApplyAll,
-				idpUserTriggerTargets
-			};
-			const functionRegistry = await withSpan("plan.functionRegistry", () => planFunctionRegistry(client, workspaceId, application.name, application.id, functionEntries));
-			const unchangedWorkflowJobs = new Set(functionRegistry.changeSet.unchanged.filter((entry) => entry.name.startsWith(WORKFLOW_PREFIX)).map((entry) => entry.name.slice(WORKFLOW_PREFIX.length)));
-			const [tailorDB, staticWebsite, aiGateway, idp, auth, pipeline, app, executor, workflow, secretManager] = await Promise.all([
-				withSpan("plan.tailorDB", () => planTailorDB(ctx)),
-				withSpan("plan.staticWebsite", () => planStaticWebsite(ctx)),
-				withSpan("plan.aiGateway", () => planAIGateway(ctx)),
-				withSpan("plan.idp", () => planIdP(ctx)),
-				withSpan("plan.auth", () => planAuth(ctx)),
-				withSpan("plan.pipeline", () => planPipeline(ctx)),
-				withSpan("plan.application", () => planApplication(ctx, httpAdapterBuildResult)),
-				withSpan("plan.executor", () => planExecutor(ctx)),
-				withSpan("plan.workflow", () => planWorkflow(client, workspaceId, application.name, application.id, workflowService?.workflows ?? {}, workflowBuildResult?.mainJobDeps ?? {}, unchangedWorkflowJobs)),
-				withSpan("plan.secretManager", () => planSecretManager(ctx))
-			]);
-			return {
-				functionRegistry,
-				tailorDB,
-				staticWebsite,
-				aiGateway,
-				idp,
-				auth,
-				pipeline,
-				app,
-				executor,
-				workflow,
-				secretManager
-			};
-		});
+		dropCrossDeploymentManagedDeletes(deployments);
 		await withSpan("confirm", async () => {
-			const allConflicts = [
-				...functionRegistry.conflicts,
-				...tailorDB.conflicts,
-				...staticWebsite.conflicts,
-				...aiGateway.conflicts,
-				...idp.conflicts,
-				...auth.conflicts,
-				...pipeline.conflicts,
-				...executor.conflicts,
-				...workflow.conflicts,
-				...secretManager.conflicts
-			];
-			await confirmOwnerConflict(allConflicts, application.name, yes);
-			await confirmUnmanagedResources([
-				...functionRegistry.unmanaged,
-				...tailorDB.unmanaged,
-				...staticWebsite.unmanaged,
-				...aiGateway.unmanaged,
-				...idp.unmanaged,
-				...auth.unmanaged,
-				...pipeline.unmanaged,
-				...executor.unmanaged,
-				...workflow.unmanaged,
-				...secretManager.unmanaged
-			], application.name, yes);
-			const importantDeletions = [];
-			for (const del of tailorDB.changeSet.type.deletes) importantDeletions.push({
-				resourceType: "TailorDB type",
-				resourceName: del.name
-			});
-			for (const del of staticWebsite.changeSet.deletes) importantDeletions.push({
-				resourceType: "StaticWebsite",
-				resourceName: del.name
-			});
-			for (const del of aiGateway.changeSet.deletes) importantDeletions.push({
-				resourceType: "AIGateway",
-				resourceName: del.name
-			});
-			for (const del of auth.changeSet.oauth2Client.deletes) importantDeletions.push({
-				resourceType: "OAuth2 client",
-				resourceName: del.name
-			});
-			for (const replace of auth.changeSet.oauth2Client.replaces) importantDeletions.push({
-				resourceType: "OAuth2 client (client type change)",
-				resourceName: replace.name
-			});
-			for (const del of auth.changeSet.connection.deletes) importantDeletions.push({
-				resourceType: "Auth connection",
-				resourceName: del.name
-			});
-			for (const del of secretManager.vaultChangeSet.deletes) importantDeletions.push({
-				resourceType: "Secret Manager vault",
-				resourceName: del.name
-			});
-			for (const del of secretManager.secretChangeSet.deletes) importantDeletions.push({
-				resourceType: "Secret Manager secret",
-				resourceName: del.name
-			});
-			await confirmImportantResourceDeletion(importantDeletions, yes);
-			const emptyApps = computeRenamedAppDeletions({
-				conflicts: allConflicts,
-				resourceOwners: /* @__PURE__ */ new Set([
-					...functionRegistry.resourceOwners,
-					...tailorDB.resourceOwners,
-					...staticWebsite.resourceOwners,
-					...aiGateway.resourceOwners,
-					...idp.resourceOwners,
-					...auth.resourceOwners,
-					...pipeline.resourceOwners,
-					...executor.resourceOwners,
-					...workflow.resourceOwners,
-					...secretManager.resourceOwners
-				]),
-				targetAppName: application.name
-			});
-			for (const emptyApp of emptyApps) app.deletes.push({
-				name: emptyApp,
-				request: {
-					workspaceId,
-					applicationName: emptyApp
-				}
+			await confirmDeploymentPlans({
+				deployments,
+				yes
 			});
 		});
-		const planSummary = printPlanResults({
-			functionRegistry,
-			tailorDB,
-			staticWebsite,
-			aiGateway,
-			idp,
-			auth,
-			pipeline,
-			app,
-			executor,
-			workflow,
-			secretManager
-		}, { dryRun: options?.dryRun });
+		const planSummary = printDeploymentPlans(deployments, { dryRun: options?.dryRun });
 		if (options?.noValidate) logger.warn("Client-side validation skipped (--no-validate).");
-		else await validatePlan({
-			functionRegistry,
-			tailorDB,
-			staticWebsite,
-			idp,
-			auth,
-			pipeline,
-			app,
-			executor,
-			workflow,
-			secretManager
-		});
+		else await validateDeploymentPlans(deployments);
 		if (dryRun) {
 			logger.info("Dry run enabled. No changes applied.");
 			return;
 		}
-		await withSpan("apply.createUpdateServices", async () => {
-			await applySecretManager(client, secretManager, "create-update", application);
-			await applyFunctionRegistry(client, workspaceId, functionRegistry, "create-update");
-			await applyStaticWebsite(client, staticWebsite, "create-update");
-			await applyAIGateway(client, aiGateway, "create-update");
-			await applyIdP(client, idp, "create-update");
-			await applyAuth(client, auth, "create-update");
-			await applyTailorDB(client, tailorDB, "create-update");
-			await applyPipeline(client, pipeline, "create-update");
-		});
-		await withSpan("apply.deleteSubgraphResources", async () => {
-			await applyPipeline(client, pipeline, "delete-resources");
-			await applyAuth(client, auth, "delete-resources");
-			await applyIdP(client, idp, "delete-resources");
-		});
-		await withSpan("apply.createUpdateApplication", () => applyApplication(client, app, "create-update"));
-		await withSpan("apply.createUpdateDependentServices", async () => {
-			await applyExecutor(client, executor, "create-update");
-			await applyWorkflow(client, workflow, "create-update");
-		});
-		await withSpan("apply.deleteDependentServices", async () => {
-			await applyWorkflow(client, workflow, "delete");
-			await applyExecutor(client, executor, "delete");
-			await applyStaticWebsite(client, staticWebsite, "delete");
-			await applyAIGateway(client, aiGateway, "delete");
-			await applySecretManager(client, secretManager, "delete");
-		});
-		await withSpan("apply.deleteApplication", () => applyApplication(client, app, "delete"));
-		await withSpan("apply.deleteSubgraphServices", async () => {
-			await applyPipeline(client, pipeline, "delete-services");
-			await applyAuth(client, auth, "delete-services");
-			await applyIdP(client, idp, "delete-services");
-			await applyTailorDB(client, tailorDB, "delete-services");
-		});
-		await withSpan("apply.cleanup", () => applyFunctionRegistry(client, workspaceId, functionRegistry, "delete"));
+		await applyDeploymentPlans(client, workspaceId, deployments);
 		if (logger.jsonMode) logger.out({
 			summary: planSummary,
 			status: "applied"
@@ -16031,10 +16621,12 @@ function createWorkspaceFolderNameResolver(client) {
 	};
 }
 async function workspaceInfoWithFolderName(client, workspace) {
-	return workspaceInfo(workspace, await resolveWorkspaceFolderName(client, workspace));
+	const folderName = await resolveWorkspaceFolderName(client, workspace);
+	return workspaceInfo(workspace, folderName);
 }
 async function workspaceDetailsWithFolderName(client, workspace) {
-	return workspaceDetails(workspace, await resolveWorkspaceFolderName(client, workspace));
+	const folderName = await resolveWorkspaceFolderName(client, workspace);
+	return workspaceDetails(workspace, folderName);
 }
 async function workspaceInfosWithFolderNames(client, workspaces) {
 	const resolveFolderName = createWorkspaceFolderNameResolver(client);
@@ -16705,7 +17297,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-BAo_zFA4.mjs");
+	const { defineApplication } = await import("./application-CSUhZMb5.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -18635,7 +19227,7 @@ async function runRepl(options) {
 	const execute = await prepareQueryExecutor(options);
 	const historyPath = getReplHistoryPath(options.engine, options.profile, options.workspaceId);
 	const validate = createReplValidator(options.engine);
-	const { highlightSqlLine, highlightGraphqlLine, replTransform } = await import("./repl-editor-BmQOyZJd.mjs");
+	const { highlightSqlLine, highlightGraphqlLine, replTransform } = await import("./repl-editor-BCozyiNq.mjs");
 	const highlight = options.engine === "sql" ? highlightSqlLine : highlightGraphqlLine;
 	const prompt = createPrompt({
 		prefix: "",
@@ -18969,5 +19561,5 @@ function isDeno() {
 }
 
 //#endregion
-export { getOrganization as $, generateAllTypeManifestsFromSnapshot as $t, listCommand$3 as A, apiCommand as An, getExecutorWaitFailureMessage as At, show as B, paginationArgs as Bn, listWorkflowExecutions as Bt, listCommand$2 as C, getNamespacesWithMigrations as Cn, listWebhookExecutors as Ct, waitWorkflowExecution as D, PluginManager as Dn, listCommand$9 as Dt, waitCommand as E, sdkNameLabelKey as En, triggerExecutor as Et, generateCommand as F, configArg as Fn, startWorkflow as Ft, removeCommand$1 as G, deploy as Gt, extractOwnedNamespaces as H, workspaceArgs as Hn, formatKeyValueTable as Ht, generateMigrationScript as I, confirmationArgs as In, getCommand$5 as It, organizationTree as J, bundleMigrationScript as Jt, updateCommand$1 as K, executeScript as Kt, writeDbTypesFile as L, deploymentArgs as Ln, getWorkflow as Lt, truncate as M, assertWritable as Mn, listExecutorJobs as Mt, truncateCommand as N, defineAppCommand as Nn, watchExecutorJob as Nt, resumeCommand as O, generateUserTypes as On, listExecutors as Ot, generate as P, commonArgs as Pn, startCommand as Pt, getCommand$1 as Q, compareSnapshotWithRemote as Qt, getConfiguredEditorCommand as R, isVerbose as Rn, executionsCommand as Rt, listApps as S, hasChanges as Sn, getFunctionRegistry as St, healthCommand as T, resourceTrn as Tn, triggerCommand as Tt, logBetaWarning as U, getCommand$6 as Ut, showCommand as V, toPageDirection as Vn, functionExecutionStatusToString as Vt, remove as W, getExecutor as Wt, listCommand$4 as X, handleOptionalToRequiredError as Xt, treeCommand as Y, MIGRATION_LABEL_KEY as Yt, listOrganizations as Z, parseMigrationLabelNumber as Zt, getWorkspace as _, reconstructSnapshotFromMigrations as _n, listMachineUsers as _t, updateUser as a, SCHEMA_FILE_NAME as an, getFolder as at, createCommand as b, formatDiffSummary as bn, listFunctionRegistries as bt, listCommand as c, compareSnapshots as cn, createCommand$1 as ct, inviteUser as d, getMigrationDirPath as dn, listOAuth2Clients as dt, protoGqlPermission as en, updateCommand$2 as et, restoreCommand as f, getMigrationFilePath as fn, getCommand$3 as ft, getCommand as g, loadDiff as gn, listCommand$7 as gt, listWorkspaces as h, isValidMigrationNumber as hn, tokenCommand as ht, updateCommand as i, MIGRATE_FILE_NAME as in, getCommand$2 as it, listWorkflows as j, apiCall as jn, jobsCommand as jt, resumeWorkflow as k, prompt as kn, getExecutorJob as kt, listUsers as l, createSnapshotFromLocalTypes as ln, createFolder as lt, listCommand$1 as m, getNextMigrationNumber as mn, getMachineUserToken as mt, query as n, DIFF_FILE_NAME as nn, listCommand$5 as nt, removeCommand as o, assertValidMigrationFiles as on, deleteCommand$1 as ot, restoreWorkspace as p, getMigrationFiles as pn, getOAuth2Client as pt, updateOrganization as q, waitForExecution as qt, queryCommand as r, INITIAL_SCHEMA_NUMBER as rn, listFolders as rt, removeUser as s, compareLocalTypesWithSnapshot as sn, deleteFolder as st, isNativeTypeScriptRuntime as t, DB_TYPES_FILE_NAME as tn, updateFolder as tt, inviteCommand as u, getLatestMigrationNumber as un, listCommand$6 as ut, deleteCommand as v, formatMigrationNumber as vn, generate$1 as vt, getAppHealth as w, ensureConfigId as wn, webhookCommand as wt, createWorkspace as x, formatMigrationDiff as xn, getCommand$4 as xt, deleteWorkspace as y, parseMigrationNumberArg as yn, listCommand$8 as yt, openInConfiguredEditor as z, pagedLogArgs as zn, getWorkflowExecution as zt };
-//# sourceMappingURL=runtime-SxHHEzVb.mjs.map
+export { getOrganization as $, compareSnapshotWithRemote as $t, listCommand$3 as A, apiCommand as An, getExecutorWaitFailureMessage as At, show as B, pagedLogArgs as Bn, listWorkflowExecutions as Bt, listCommand$2 as C, hasChanges as Cn, listWebhookExecutors as Ct, waitWorkflowExecution as D, PluginManager as Dn, listCommand$9 as Dt, waitCommand as E, sdkNameLabelKey as En, triggerExecutor as Et, generateCommand as F, configArg as Fn, startWorkflow as Ft, removeCommand$1 as G, deploy as Gt, extractOwnedNamespaces as H, toPageDirection as Hn, formatKeyValueTable as Ht, generateMigrationScript as I, confirmationArgs as In, getCommand$5 as It, organizationTree as J, waitForExecution as Jt, updateCommand$1 as K, ensureConfigId as Kt, writeDbTypesFile as L, deploymentArgs as Ln, getWorkflow as Lt, truncate as M, assertWritable as Mn, listExecutorJobs as Mt, truncateCommand as N, defineAppCommand as Nn, watchExecutorJob as Nt, resumeCommand as O, generateUserTypes as On, listExecutors as Ot, generate as P, commonArgs as Pn, startCommand as Pt, getCommand$1 as Q, parseMigrationLabelNumber as Qt, getConfiguredEditorCommand as R, isVerbose as Rn, executionsCommand as Rt, listApps as S, formatMigrationDiff as Sn, getFunctionRegistry as St, healthCommand as T, resourceTrn as Tn, triggerCommand as Tt, logBetaWarning as U, workspaceArgs as Un, getCommand$6 as Ut, showCommand as V, paginationArgs as Vn, functionExecutionStatusToString as Vt, remove as W, getExecutor as Wt, listCommand$4 as X, MIGRATION_LABEL_KEY as Xt, treeCommand as Y, bundleMigrationScript as Yt, listOrganizations as Z, handleOptionalToRequiredError as Zt, getWorkspace as _, loadDiff as _n, listMachineUsers as _t, updateUser as a, MIGRATE_FILE_NAME as an, getFolder as at, createCommand as b, parseMigrationNumberArg as bn, listFunctionRegistries as bt, listCommand as c, compareLocalTypesWithSnapshot as cn, createCommand$1 as ct, inviteUser as d, getLatestMigrationNumber as dn, listOAuth2Clients as dt, generateAllTypeManifestsFromSnapshot as en, updateCommand$2 as et, restoreCommand as f, getMigrationDirPath as fn, getCommand$3 as ft, getCommand as g, isValidMigrationNumber as gn, listCommand$7 as gt, listWorkspaces as h, getNextMigrationNumber as hn, tokenCommand as ht, updateCommand as i, INITIAL_SCHEMA_NUMBER as in, getCommand$2 as it, listWorkflows as j, apiCall as jn, jobsCommand as jt, resumeWorkflow as k, prompt as kn, getExecutorJob as kt, listUsers as l, compareSnapshots as ln, createFolder as lt, listCommand$1 as m, getMigrationFiles as mn, getMachineUserToken as mt, query as n, DB_TYPES_FILE_NAME as nn, listCommand$5 as nt, removeCommand as o, SCHEMA_FILE_NAME as on, deleteCommand$1 as ot, restoreWorkspace as p, getMigrationFilePath as pn, getOAuth2Client as pt, updateOrganization as q, executeScript as qt, queryCommand as r, DIFF_FILE_NAME as rn, listFolders as rt, removeUser as s, assertValidMigrationFiles as sn, deleteFolder as st, isNativeTypeScriptRuntime as t, protoGqlPermission as tn, updateFolder as tt, inviteCommand as u, createSnapshotFromLocalTypes as un, listCommand$6 as ut, deleteCommand as v, reconstructSnapshotFromMigrations as vn, generate$1 as vt, getAppHealth as w, getNamespacesWithMigrations as wn, webhookCommand as wt, createWorkspace as x, formatDiffSummary as xn, getCommand$4 as xt, deleteWorkspace as y, formatMigrationNumber as yn, listCommand$8 as yt, openInConfiguredEditor as z, multiConfigArg as zn, getWorkflowExecution as zt };
+//# sourceMappingURL=runtime-DV1EnfMs.mjs.map