@tailor-platform/sdk 1.74.0 → 1.75.0

package/dist/{runtime-Zkg3SUwi.mjs → runtime-CJ5usBOu.mjs}

@@ -1,8 +1,8 @@
-import { t as db } from "./schema-DAdZSFOd.mjs";
-import { $ as CreateUserProfileConfigRequestSchema, A as UpdatePipelineServiceRequestSchema, At as Condition_Operator, B as UpdateExecutorExecutorRequestSchema, Ct as UserProfileProviderConfig_UserProfileProviderType, D as CreatePipelineResolverRequestSchema, Dt as ApplicationSchemaUpdateAttemptStatus, E as UpdateSecretManagerSecretRequestSchema, Et as UpdateApplicationRequestSchema, F as IdPPermissionOperator, G as CreateAuthHookRequestSchema, H as ExecutorTargetType, I as IdPPermissionPermit, J as CreateAuthOAuth2ClientRequestSchema, K as CreateAuthIDPConfigRequestSchema, L as FunctionExecution_Status, M as CreateIdPServiceRequestSchema, Mt as PageDirection, N as UpdateIdPServiceRequestSchema, O as CreatePipelineServiceRequestSchema, Ot as Subgraph_ServiceType, P as IdPLang, Q as CreateTenantConfigRequestSchema, S as UpdateStaticWebsiteRequestSchema, St as TenantProviderConfig_TenantProviderType, T as CreateSecretManagerVaultRequestSchema, Tt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, U as ExecutorTriggerType, V as ExecutorJobStatus, W as CreateAuthConnectionRequestSchema, X as CreateAuthSCIMResourceRequestSchema, Y as CreateAuthSCIMConfigRequestSchema, Z as CreateAuthServiceRequestSchema, _ as TailorDBType_Permission_Operator, _t as AuthSCIMAttribute_Mutability, a as WorkspacePlatformUserRole, at as UpdateAuthSCIMConfigRequestSchema, b as AddCustomDomainRequestSchema, bt as AuthSCIMConfig_AuthorizationType, c as UpdateWorkflowRequestSchema, ct as UpdateTenantConfigRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as AuthConnection_Type, et as UpdateAuthConnectionRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as AuthHookPoint, g as TailorDBGQLPermission_Permit, gt as AuthOAuth2Client_GrantType, h as TailorDBGQLPermission_Operator, ht as AuthOAuth2Client_ClientType, it as UpdateAuthOAuth2ClientRequestSchema, j as PipelineResolver_OperationType, jt as FilterSchema, k as UpdatePipelineResolverRequestSchema, kt as ConditionSchema, l as WorkflowExecution_Status, lt as UpdateUserProfileConfigRequestSchema, m as TailorDBGQLPermission_Action, mt as AuthInvokerSchema, nt as UpdateAuthIDPConfigRequestSchema, o as CreateWorkflowJobFunctionRequestSchema, ot as UpdateAuthSCIMResourceRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as AuthIDPConfig_AuthType, q as CreateAuthMachineUserRequestSchema, rt as UpdateAuthMachineUserRequestSchema, s as CreateWorkflowRequestSchema, st as UpdateAuthServiceRequestSchema, t as OperatorService, tt as UpdateAuthHookRequestSchema, u as WorkflowJobExecution_Status, ut as AuthConnection_Status, v as TailorDBType_Permission_Permit, vt as AuthSCIMAttribute_Type, w as CreateSecretManagerSecretRequestSchema, wt as CreateApplicationRequestSchema, x as CreateStaticWebsiteRequestSchema, y as TailorDBType_PermitAction, yt as AuthSCIMAttribute_Uniqueness, z as CreateExecutorExecutorRequestSchema } from "./service_pb-CIrhGwHk.mjs";
+import { t as db } from "./schema-Dl_y0m9e.mjs";
+import { $ as CreateAuthServiceRequestSchema, A as CreatePipelineServiceRequestSchema, At as Subgraph_ServiceType, C as CreateStaticWebsiteRequestSchema, D as CreateSecretManagerVaultRequestSchema, Dt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, E as CreateSecretManagerSecretRequestSchema, Et as CreateApplicationRequestSchema, F as UpdateIdPServiceRequestSchema, G as ExecutorTriggerType, H as UpdateExecutorExecutorRequestSchema, I as IdPLang, J as CreateAuthIDPConfigRequestSchema, K as CreateAuthConnectionRequestSchema, L as IdPPermissionOperator, M as UpdatePipelineServiceRequestSchema, Mt as Condition_Operator, N as PipelineResolver_OperationType, Nt as FilterSchema, O as UpdateSecretManagerSecretRequestSchema, Ot as UpdateApplicationRequestSchema, P as CreateIdPServiceRequestSchema, Pt as PageDirection, Q as CreateAuthSCIMResourceRequestSchema, R as IdPPermissionPermit, S as AddCustomDomainRequestSchema, St as AuthSCIMConfig_AuthorizationType, Tt as UserProfileProviderConfig_UserProfileProviderType, U as ExecutorJobStatus, V as CreateExecutorExecutorRequestSchema, W as ExecutorTargetType, X as CreateAuthOAuth2ClientRequestSchema, Y as CreateAuthMachineUserRequestSchema, Z as CreateAuthSCIMConfigRequestSchema, _ as TailorDBGQLPermission_Operator, _t as AuthOAuth2Client_ClientType, a as WorkspacePlatformUserRole, at as UpdateAuthMachineUserRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthSCIMAttribute_Type, c as CreateWorkflowRequestSchema, ct as UpdateAuthSCIMResourceRequestSchema, d as WorkflowExecution_Status, dt as UpdateUserProfileConfigRequestSchema, et as CreateTenantConfigRequestSchema, f as WorkflowJobExecution_Status, ft as AuthConnection_Status, g as TailorDBGQLPermission_Action, gt as AuthInvokerSchema, h as UpdateTailorDBTypeRequestSchema, ht as AuthIDPConfig_AuthType, it as UpdateAuthIDPConfigRequestSchema, j as UpdatePipelineResolverRequestSchema, jt as ConditionSchema, k as CreatePipelineResolverRequestSchema, kt as ApplicationSchemaUpdateAttemptStatus, l as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, lt as UpdateAuthServiceRequestSchema, m as CreateTailorDBTypeRequestSchema, mt as AuthHookPoint, nt as UpdateAuthConnectionRequestSchema, o as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as UpdateAuthOAuth2ClientRequestSchema, p as CreateTailorDBServiceRequestSchema, pt as AuthConnection_Type, q as CreateAuthHookRequestSchema, rt as UpdateAuthHookRequestSchema, s as CreateWorkflowJobFunctionRequestSchema, st as UpdateAuthSCIMConfigRequestSchema, t as OperatorService, tt as CreateUserProfileConfigRequestSchema, u as UpdateWorkflowRequestSchema, ut as UpdateTenantConfigRequestSchema, v as TailorDBGQLPermission_Permit, vt as AuthOAuth2Client_GrantType, w as UpdateStaticWebsiteRequestSchema, wt as TenantProviderConfig_TenantProviderType, x as TailorDBType_PermitAction, xt as AuthSCIMAttribute_Uniqueness, y as TailorDBType_Permission_Operator, yt as AuthSCIMAttribute_Mutability, z as FunctionExecution_Status } from "./service_pb-4unFyubn.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
 import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-BEiZZ3qT.mjs";
-import { A as hasUserTokenEntry, C as getDistDir, E as loadConfig, F as loadPlatformClientConfig, G as fetchAll, H as writePlatformConfig, K as fetchMachineUserToken, L as loadWorkspaceId, M as loadConfigPath, P as loadMachineUserName, Q as getPlatformBaseUrl, R as platformConfigFromProfile, S as createBundleCache, T as hashFile, X as getConsoleBaseUrl, Z as getOAuth2ClientId, b as getPluginGenerationDependencies, c as HTTP_METHODS, d as buildResolverOperationHookExpr, et as initOperatorClient, f as assertUniqueLocalTailorDBTypeNames, g as platformBundleDefinePlugin, h as stringifyFunction, i as resolverBundleKey, j as loadAccessToken, m as TailorDBTypeSchema, n as generatePluginFilesIfNeeded, nt as resolveStaticWebsiteUrls, p as assertUniqueTailorDBTypeNamesWithExternal, q as fetchPaged, r as loadApplication, rt as byName, t as defineApplication, tt as isDefaultPlatform, u as buildExecutorArgsExpr, w as hashContent, x as hasGenerationHooks, z as readPlatformConfig } from "./application-DwmoI6ZQ.mjs";
+import { $ as getOAuth2ClientId, B as readPlatformConfig, C as createBundleCache, D as loadConfig, E as hashFile, F as loadMachineUserName, I as loadPlatformClientConfig, J as fetchMachineUserToken, K as fetchAll, M as loadAccessToken, N as loadConfigPath, Q as getConsoleBaseUrl, R as loadWorkspaceId, S as hasGenerationHooks, T as hashContent, U as writePlatformConfig, Y as fetchPaged, _ as platformBundleDefinePlugin, at as resolveStaticWebsiteUrls, d as buildExecutorArgsExpr, et as getOrNull, f as buildResolverOperationHookExpr, g as stringifyFunction, h as TailorDBTypeSchema, i as resolverBundleKey, it as isDefaultPlatform, j as hasUserTokenEntry, l as HTTP_METHODS, m as assertUniqueTailorDBTypeNamesWithExternal, n as generatePluginFilesIfNeeded, o as WorkflowJobFunctionExecutionPolicySchema, ot as byName, p as assertUniqueLocalTailorDBTypeNames, q as fetchAllTolerant, r as loadApplication, rt as initOperatorClient, t as defineApplication, tt as getPlatformBaseUrl, w as getDistDir, x as getPluginGenerationDependencies, z as platformConfigFromProfile } from "./application-DYshsH-K.mjs";
 import { o as loadFilesWithIgnores, t as createExecutorService } from "./service-BCRJ-3NV.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "./package-json-8b0O9TlX.mjs";
@@ -1849,14 +1849,7 @@ async function buildMetaRequest(params) {
 */
 async function fetchExistingResourcesWithLabels(params) {
 	const { client, fetchPage, getName, getTrn } = params;
-	const withoutLabel = await fetchAll(async (pageToken, maxPageSize) => {
-		try {
-			return await fetchPage(pageToken, maxPageSize);
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
-	});
+	const withoutLabel = await fetchAllTolerant(fetchPage);
 	const existingResources = {};
 	await Promise.all(withoutLabel.map(async (resource) => {
 		const name = getName(resource);
@@ -2062,23 +2055,20 @@ async function planStaticWebsite(context) {
 	const existingDomainsByWebsite = /* @__PURE__ */ new Map();
 	const websitesToFetchDomains = [...ownedWebsiteNames].filter((name) => !changeSet.creates.some((c) => c.name === name));
 	await Promise.all(websitesToFetchDomains.map(async (name) => {
-		try {
+		const domainsWithLabels = await getOrNull(async () => {
 			const { customDomains } = await client.listCustomDomains({
 				workspaceId,
 				staticWebsiteName: name
 			});
-			const domainsWithLabels = await Promise.all(customDomains.map(async (d) => {
+			return await Promise.all(customDomains.map(async (d) => {
 				const { metadata } = await client.getMetadata({ trn: customDomainTrn(workspaceId, name, d.domain) });
 				return {
 					domain: d.domain,
 					allLabels: metadata?.labels
 				};
 			}));
-			existingDomainsByWebsite.set(name, domainsWithLabels);
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return;
-			throw error;
-		}
+		});
+		if (domainsWithLabels) existingDomainsByWebsite.set(name, domainsWithLabels);
 	}));
 	for (const name of ownedWebsiteNames) {
 		const desired = new Set(desiredDomainsByWebsite.get(name) ?? []);
@@ -2346,18 +2336,13 @@ function areApplicationsEqual(existing, desired) {
 async function planApplication(context, httpAdapterBuildResult) {
 	const { client, workspaceId, application, forRemoval } = context;
 	const changeSet = createChangeSet("Applications");
-	const existingApplications = await fetchAll(async (pageToken, maxPageSize) => {
-		try {
-			const { applications, nextPageToken } = await client.listApplications({
-				workspaceId,
-				pageToken,
-				pageSize: maxPageSize
-			});
-			return [applications, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+	const existingApplications = await fetchAllTolerant(async (pageToken, maxPageSize) => {
+		const { applications, nextPageToken } = await client.listApplications({
+			workspaceId,
+			pageToken,
+			pageSize: maxPageSize
+		});
+		return [applications, nextPageToken];
 	});
 	if (forRemoval) {
 		const candidates = application.id ? existingApplications : existingApplications.filter((app) => app.name === application.name);
@@ -2384,19 +2369,14 @@ async function planApplication(context, httpAdapterBuildResult) {
 		authNamespace = application.config.auth.name;
 		if (context.externalAuthIdpConfigNames?.has(authNamespace)) authIdpConfigName = context.externalAuthIdpConfigNames.get(authNamespace);
 		else {
-			const idpConfigs = await fetchAll(async (pageToken, maxPageSize) => {
-				try {
-					const { idpConfigs, nextPageToken } = await client.listAuthIDPConfigs({
-						workspaceId,
-						namespaceName: assertDefined(authNamespace, "authNamespace must be set before listing IDP configs"),
-						pageToken,
-						pageSize: maxPageSize
-					});
-					return [idpConfigs, nextPageToken];
-				} catch (error) {
-					if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-					throw error;
-				}
+			const idpConfigs = await fetchAllTolerant(async (pageToken, maxPageSize) => {
+				const { idpConfigs, nextPageToken } = await client.listAuthIDPConfigs({
+					workspaceId,
+					namespaceName: assertDefined(authNamespace, "authNamespace must be set before listing IDP configs"),
+					pageToken,
+					pageSize: maxPageSize
+				});
+				return [idpConfigs, nextPageToken];
 			});
 			if (idpConfigs.length > 0) {
 				const [firstConfig] = idpConfigs;
@@ -2463,13 +2443,10 @@ async function planApplication(context, httpAdapterBuildResult) {
 	return changeSet;
 }
 async function fetchAppLabels(client, workspaceId, appName) {
-	try {
+	return (await getOrNull(async () => {
 		const { metadata } = await client.getMetadata({ trn: resourceTrn(workspaceId, "application", appName) });
-		return metadata?.labels;
-	} catch (error) {
-		if (error instanceof ConnectError && error.code === Code.NotFound) return;
-		throw error;
-	}
+		return metadata;
+	}))?.labels;
 }
 /**
 * Build per-adapter diff lines for the application plan display. The platform
@@ -2653,18 +2630,13 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 	const resourceOwners = /* @__PURE__ */ new Set();
 	const desiredConnections = {};
 	for (const auth of auths) for (const [name, config] of Object.entries(auth.connections)) desiredConnections[name] = config;
-	const existingList = await fetchAll(async (pageToken, maxPageSize) => {
-		try {
-			const { connections, nextPageToken } = await client.listAuthConnections({
-				workspaceId,
-				pageToken,
-				pageSize: maxPageSize
-			});
-			return [connections, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+	const existingList = await fetchAllTolerant(async (pageToken, maxPageSize) => {
+		const { connections, nextPageToken } = await client.listAuthConnections({
+			workspaceId,
+			pageToken,
+			pageSize: maxPageSize
+		});
+		return [connections, nextPageToken];
 	});
 	const existingConnections = {};
 	await Promise.all(existingList.map(async (resource) => {
@@ -3510,15 +3482,12 @@ async function applyIdP(client, result, phase = "create-update") {
 		}), ...changeSet.client.updates.map(async (update) => {
 			const vaultName = idpClientVaultName(update.namespaceName, update.name);
 			const secretName = idpClientSecretName(update.namespaceName, update.name);
-			try {
-				await client.getSecretManagerVault({
+			if (await getOrNull(async () => {
+				return await client.getSecretManagerVault({
 					workspaceId: update.workspaceId,
 					secretmanagerVaultName: vaultName
 				});
-				return;
-			} catch (error) {
-				if (!(error instanceof ConnectError && error.code === Code.NotFound)) throw error;
-			}
+			})) return;
 			await client.createSecretManagerVault({
 				workspaceId: update.workspaceId,
 				secretmanagerVaultName: vaultName
@@ -3766,19 +3735,14 @@ async function planServices$3(client, workspaceId, appName, appId, idps, idpUser
 async function planClients(client, workspaceId, idps, deletedServices, forceApplyAll = false) {
 	const changeSet = createChangeSet("IdP clients");
 	const fetchClients = (namespaceName) => {
-		return fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { clients, nextPageToken } = await client.listIdPClients({
-					workspaceId,
-					namespaceName,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [clients, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
+		return fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { clients, nextPageToken } = await client.listIdPClients({
+				workspaceId,
+				namespaceName,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [clients, nextPageToken];
 		});
 	};
 	const clientsByIdp = await Promise.all(idps.map((idp) => fetchClients(idp.name)));
@@ -4121,19 +4085,14 @@ async function planServices$2(client, workspaceId, appName, appId, auths, forceA
 async function planIdPConfigs(client, workspaceId, auths, deletedServices, forceApplyAll = false) {
 	const changeSet = createChangeSet("Auth idpConfigs");
 	const fetchIdPConfigs = (namespaceName) => {
-		return fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { idpConfigs, nextPageToken } = await client.listAuthIDPConfigs({
-					workspaceId,
-					namespaceName,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [idpConfigs, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
+		return fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { idpConfigs, nextPageToken } = await client.listAuthIDPConfigs({
+				workspaceId,
+				namespaceName,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [idpConfigs, nextPageToken];
 		});
 	};
 	for (const authService of auths) {
@@ -4290,27 +4249,21 @@ async function protoBuiltinIdPConfig(client, workspaceId, builtinIdPConfig) {
 	return config;
 }
 async function tryProtoBuiltinIdPConfig(client, workspaceId, builtinIdPConfig) {
-	let idpService;
-	try {
-		idpService = await client.getIdPService({
+	const idpService = await getOrNull(async () => {
+		return await client.getIdPService({
 			workspaceId,
 			namespaceName: builtinIdPConfig.namespace
 		});
-	} catch (error) {
-		if (error instanceof ConnectError && error.code === Code.NotFound) return;
-		throw error;
-	}
-	let idpClient;
-	try {
-		idpClient = await client.getIdPClient({
+	});
+	if (!idpService) return void 0;
+	const idpClient = await getOrNull(async () => {
+		return await client.getIdPClient({
 			workspaceId,
 			namespaceName: builtinIdPConfig.namespace,
 			name: builtinIdPConfig.clientName
 		});
-	} catch (error) {
-		if (error instanceof ConnectError && error.code === Code.NotFound) return;
-		throw error;
-	}
+	});
+	if (!idpClient) return void 0;
 	const vaultName = idpClientVaultName(builtinIdPConfig.namespace, builtinIdPConfig.clientName);
 	const secretKey = idpClientSecretName(builtinIdPConfig.namespace, builtinIdPConfig.clientName);
 	return { config: {
@@ -4331,56 +4284,51 @@ async function planUserProfileConfigs(client, workspaceId, auths, deletedService
 	for (const auth of auths) {
 		const { config } = auth;
 		const name = `${config.name}-user-profile-config`;
-		try {
-			const { userProfileProviderConfig } = await client.getUserProfileConfig({
+		const existing = await getOrNull(async () => {
+			return await client.getUserProfileConfig({
 				workspaceId,
 				namespaceName: config.name
 			});
+		});
+		if (!existing) {
 			const userProfileForUpdate = auth.userProfile;
-			if (userProfileForUpdate) {
-				const desired = protoUserProfileConfig(userProfileForUpdate);
-				if (!forceApplyAll && areUserProfileConfigsEqual(userProfileProviderConfig ?? {}, desired)) changeSet.unchanged.push({ name });
-				else changeSet.updates.push({
-					name,
-					request: {
-						workspaceId,
-						namespaceName: config.name,
-						userProfileProviderConfig: desired
-					}
-				});
-			} else changeSet.deletes.push({
+			if (userProfileForUpdate) changeSet.creates.push({
 				name,
 				request: {
 					workspaceId,
-					namespaceName: config.name
+					namespaceName: config.name,
+					userProfileProviderConfig: protoUserProfileConfig(userProfileForUpdate)
 				}
 			});
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) {
-				const userProfileForCreate = auth.userProfile;
-				if (userProfileForCreate) changeSet.creates.push({
-					name,
-					request: {
-						workspaceId,
-						namespaceName: config.name,
-						userProfileProviderConfig: protoUserProfileConfig(userProfileForCreate)
-					}
-				});
-				continue;
-			}
-			throw error;
+			continue;
 		}
+		const userProfileForUpdate = auth.userProfile;
+		if (userProfileForUpdate) {
+			const desired = protoUserProfileConfig(userProfileForUpdate);
+			if (!forceApplyAll && areUserProfileConfigsEqual(existing.userProfileProviderConfig ?? {}, desired)) changeSet.unchanged.push({ name });
+			else changeSet.updates.push({
+				name,
+				request: {
+					workspaceId,
+					namespaceName: config.name,
+					userProfileProviderConfig: desired
+				}
+			});
+		} else changeSet.deletes.push({
+			name,
+			request: {
+				workspaceId,
+				namespaceName: config.name
+			}
+		});
 	}
 	for (const namespaceName of deletedServices) {
-		try {
-			await client.getUserProfileConfig({
+		if (!await getOrNull(async () => {
+			return await client.getUserProfileConfig({
 				workspaceId,
 				namespaceName
 			});
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) continue;
-			throw error;
-		}
+		})) continue;
 		changeSet.deletes.push({
 			name: `${namespaceName}-user-profile-config`,
 			request: {
@@ -4414,54 +4362,49 @@ async function planTenantConfigs(client, workspaceId, auths, deletedServices, fo
 	for (const auth of auths) {
 		const { config } = auth;
 		const name = `${config.name}-tenant-config`;
-		try {
-			const { tenantProviderConfig } = await client.getTenantConfig({
+		const existing = await getOrNull(async () => {
+			return await client.getTenantConfig({
 				workspaceId,
 				namespaceName: config.name
 			});
-			if (config.tenantProvider) {
-				const desired = protoTenantConfig(config.tenantProvider);
-				if (!forceApplyAll && areTenantProviderConfigsEqual(tenantProviderConfig, desired)) changeSet.unchanged.push({ name });
-				else changeSet.updates.push({
-					name,
-					request: {
-						workspaceId,
-						namespaceName: config.name,
-						tenantProviderConfig: desired
-					}
-				});
-			} else changeSet.deletes.push({
+		});
+		if (!existing) {
+			if (config.tenantProvider) changeSet.creates.push({
 				name,
 				request: {
 					workspaceId,
-					namespaceName: config.name
+					namespaceName: config.name,
+					tenantProviderConfig: protoTenantConfig(config.tenantProvider)
 				}
 			});
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) {
-				if (config.tenantProvider) changeSet.creates.push({
-					name,
-					request: {
-						workspaceId,
-						namespaceName: config.name,
-						tenantProviderConfig: protoTenantConfig(config.tenantProvider)
-					}
-				});
-				continue;
-			}
-			throw error;
+			continue;
 		}
+		if (config.tenantProvider) {
+			const desired = protoTenantConfig(config.tenantProvider);
+			if (!forceApplyAll && areTenantProviderConfigsEqual(existing.tenantProviderConfig, desired)) changeSet.unchanged.push({ name });
+			else changeSet.updates.push({
+				name,
+				request: {
+					workspaceId,
+					namespaceName: config.name,
+					tenantProviderConfig: desired
+				}
+			});
+		} else changeSet.deletes.push({
+			name,
+			request: {
+				workspaceId,
+				namespaceName: config.name
+			}
+		});
 	}
 	for (const namespaceName of deletedServices) {
-		try {
-			await client.getTenantConfig({
+		if (!await getOrNull(async () => {
+			return await client.getTenantConfig({
 				workspaceId,
 				namespaceName
 			});
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) continue;
-			throw error;
-		}
+		})) continue;
 		changeSet.deletes.push({
 			name: `${namespaceName}-tenant-config`,
 			request: {
@@ -4488,19 +4431,14 @@ function protoTenantConfig(tenantConfig) {
 async function planMachineUsers(client, workspaceId, auths, deletedServices, forceApplyAll = false) {
 	const changeSet = createChangeSet("Auth machineUsers");
 	const fetchMachineUsers = (authNamespace) => {
-		return fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { machineUsers, nextPageToken } = await client.listAuthMachineUsers({
-					workspaceId,
-					authNamespace,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [machineUsers, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
+		return fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { machineUsers, nextPageToken } = await client.listAuthMachineUsers({
+				workspaceId,
+				authNamespace,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [machineUsers, nextPageToken];
 		});
 	};
 	for (const auth of auths) {
@@ -4627,19 +4565,14 @@ function areOAuth2ClientsEqual(existing, desired) {
 async function planOAuth2Clients(client, workspaceId, auths, deletedServices, expectedLocalWebsites, forceApplyAll = false) {
 	const changeSet = createChangeSet("Auth oauth2Clients");
 	const fetchOAuth2Clients = (namespaceName) => {
-		return fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { oauth2Clients, nextPageToken } = await client.listAuthOAuth2Clients({
-					workspaceId,
-					namespaceName,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [oauth2Clients, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
+		return fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { oauth2Clients, nextPageToken } = await client.listAuthOAuth2Clients({
+				workspaceId,
+				namespaceName,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [oauth2Clients, nextPageToken];
 		});
 	};
 	for (const auth of auths) {
@@ -4756,26 +4689,21 @@ async function planSCIMConfigs(client, workspaceId, auths, deletedServices) {
 	for (const auth of auths) {
 		const { config } = auth;
 		const name = `${config.name}-scim-config`;
-		try {
-			await client.getAuthSCIMConfig({
+		if (!await getOrNull(async () => {
+			return await client.getAuthSCIMConfig({
 				workspaceId,
 				namespaceName: config.name
 			});
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) {
-				if (config.scim) changeSet.creates.push({
-					name,
-					request: {
-						workspaceId,
-						namespaceName: config.name,
-						scimConfig: protoSCIMConfig(config.scim)
-					}
-				});
-				continue;
-			}
-			throw error;
-		}
-		if (config.scim) changeSet.updates.push({
+		})) {
+			if (config.scim) changeSet.creates.push({
+				name,
+				request: {
+					workspaceId,
+					namespaceName: config.name,
+					scimConfig: protoSCIMConfig(config.scim)
+				}
+			});
+		} else if (config.scim) changeSet.updates.push({
 			name,
 			request: {
 				workspaceId,
@@ -4792,15 +4720,12 @@ async function planSCIMConfigs(client, workspaceId, auths, deletedServices) {
 		});
 	}
 	for (const namespaceName of deletedServices) {
-		try {
-			await client.getAuthSCIMConfig({
+		if (!await getOrNull(async () => {
+			return await client.getAuthSCIMConfig({
 				workspaceId,
 				namespaceName
 			});
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) continue;
-			throw error;
-		}
+		})) continue;
 		changeSet.deletes.push({
 			name: `${namespaceName}-scim-config`,
 			request: {
@@ -4837,16 +4762,13 @@ function protoSCIMConfig(scimConfig) {
 async function planSCIMResources(client, workspaceId, auths, deletedServices) {
 	const changeSet = createChangeSet("Auth scimResources");
 	const fetchSCIMResources = async (namespaceName) => {
-		try {
+		return await getOrNull(async () => {
 			const { scimResources } = await client.getAuthSCIMResources({
 				workspaceId,
 				namespaceName
 			});
 			return scimResources;
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [];
-			throw error;
-		}
+		}) ?? [];
 	};
 	for (const auth of auths) {
 		const { config } = auth;
@@ -5004,18 +4926,14 @@ async function planAuthHooks(client, workspaceId, auths, deletedServices, forceA
 	for (const auth of auths) {
 		const { config } = auth;
 		const beforeLogin = config.hooks?.beforeLogin;
-		let existingHook;
-		try {
+		const existingHook = await getOrNull(async () => {
 			const { hook } = await client.getAuthHook({
 				workspaceId,
 				namespaceName: config.name,
 				hookPoint: AuthHookPoint.BEFORE_LOGIN
 			});
-			existingHook = hook;
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) existingHook = void 0;
-			else throw error;
-		}
+			return hook;
+		});
 		if (beforeLogin) {
 			const hookRequest = {
 				workspaceId,
@@ -5047,23 +4965,20 @@ async function planAuthHooks(client, workspaceId, auths, deletedServices, forceA
 			}
 		});
 	}
-	for (const namespaceName of deletedServices) try {
-		await client.getAuthHook({
+	for (const namespaceName of deletedServices) if (await getOrNull(async () => {
+		return await client.getAuthHook({
 			workspaceId,
 			namespaceName,
 			hookPoint: AuthHookPoint.BEFORE_LOGIN
 		});
-		changeSet.deletes.push({
-			name: `${namespaceName}/before-login`,
-			request: {
-				workspaceId,
-				namespaceName,
-				hookPoint: AuthHookPoint.BEFORE_LOGIN
-			}
-		});
-	} catch (error) {
-		if (error instanceof ConnectError && error.code === Code.NotFound) {} else throw error;
-	}
+	})) changeSet.deletes.push({
+		name: `${namespaceName}/before-login`,
+		request: {
+			workspaceId,
+			namespaceName,
+			hookPoint: AuthHookPoint.BEFORE_LOGIN
+		}
+	});
 	return changeSet;
 }
 
@@ -5702,19 +5617,14 @@ async function planServices$1(client, workspaceId, appName, appId, pipelines) {
 async function planResolvers(client, workspaceId, pipelines, executors, initialExecutorUsedResolvers, deletedServices, env, authNamespace, forceApplyAll = false) {
 	const changeSet = createChangeSet("Pipeline resolvers");
 	const fetchResolvers = (namespaceName) => {
-		return fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { pipelineResolvers, nextPageToken } = await client.listPipelineResolvers({
-					workspaceId,
-					namespaceName,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [pipelineResolvers, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
+		return fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { pipelineResolvers, nextPageToken } = await client.listPipelineResolvers({
+				workspaceId,
+				namespaceName,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [pipelineResolvers, nextPageToken];
 		});
 	};
 	const executorUsedResolvers = new Set(initialExecutorUsedResolvers);
@@ -5998,19 +5908,14 @@ async function planSecretManager(context) {
 			workspaceId
 		});
 		let existingSecrets = [];
-		if (existing) existingSecrets = (await fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { secrets, nextPageToken } = await client.listSecretManagerSecrets({
-					workspaceId,
-					secretmanagerVaultName: vaultName,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [secrets, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
+		if (existing) existingSecrets = (await fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { secrets, nextPageToken } = await client.listSecretManagerSecrets({
+				workspaceId,
+				secretmanagerVaultName: vaultName,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [secrets, nextPageToken];
 		})).map((s) => s.name);
 		const existingSet = new Set(existingSecrets);
 		for (const secret of vault.secrets) {
@@ -6054,19 +5959,14 @@ async function planSecretManager(context) {
 			appId: application.id,
 			resourceOwners
 		})) {
-			const secrets = await fetchAll(async (pageToken, maxPageSize) => {
-				try {
-					const { secrets, nextPageToken } = await client.listSecretManagerSecrets({
-						workspaceId,
-						secretmanagerVaultName: name,
-						pageToken,
-						pageSize: maxPageSize
-					});
-					return [secrets, nextPageToken];
-				} catch (error) {
-					if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-					throw error;
-				}
+			const secrets = await fetchAllTolerant(async (pageToken, maxPageSize) => {
+				const { secrets, nextPageToken } = await client.listSecretManagerSecrets({
+					workspaceId,
+					secretmanagerVaultName: name,
+					pageToken,
+					pageSize: maxPageSize
+				});
+				return [secrets, nextPageToken];
 			});
 			for (const secret of secrets) secretChangeSet.deletes.push({
 				name: `${name}/${secret.name}`,
@@ -6868,52 +6768,7 @@ function getMigrationFilePath(migrationsDir, num, type) {
 	return path.join(migrationDir, MIGRATION_FILE_NAMES[type]);
 }
 /**
-* Create a snapshot field config from a parsed field
-* @param {ParsedField} field - Parsed field definition
-* @returns {SnapshotFieldConfig} Snapshot field configuration
-*/
-function createSnapshotFieldConfig(field) {
-	const config = {
-		type: field.config.type,
-		required: field.config.required !== false
-	};
-	if (field.config.array) config.array = true;
-	if (field.config.index) config.index = true;
-	if (field.config.unique) config.unique = true;
-	if (field.config.allowedValues && field.config.allowedValues.length > 0) config.allowedValues = field.config.allowedValues.map((v) => ({
-		value: v.value,
-		...v.description && { description: v.description }
-	}));
-	if (field.config.foreignKey) {
-		config.foreignKey = true;
-		if (field.config.foreignKeyType) config.foreignKeyType = field.config.foreignKeyType;
-		if (field.config.foreignKeyField) config.foreignKeyField = field.config.foreignKeyField;
-	}
-	if (field.config.description) config.description = field.config.description;
-	if (field.config.vector) config.vector = true;
-	if (field.config.hooks) {
-		config.hooks = {};
-		if (field.config.hooks.create) config.hooks.create = { expr: field.config.hooks.create.expr };
-		if (field.config.hooks.update) config.hooks.update = { expr: field.config.hooks.update.expr };
-	}
-	if (field.config.validate && field.config.validate.length > 0) config.validate = field.config.validate.map((v) => ({
-		script: { expr: v.script.expr },
-		errorMessage: v.errorMessage
-	}));
-	if (field.config.serial) config.serial = {
-		start: field.config.serial.start,
-		...field.config.serial.maxValue !== void 0 && { maxValue: field.config.serial.maxValue },
-		...field.config.serial.format && { format: field.config.serial.format }
-	};
-	if (field.config.scale !== void 0) config.scale = field.config.scale;
-	if (field.config.fields && Object.keys(field.config.fields).length > 0) {
-		config.fields = {};
-		for (const [nestedName, nestedConfig] of Object.entries(field.config.fields)) config.fields[nestedName] = createSnapshotFieldConfigFromOperatorConfig(nestedConfig);
-	}
-	return normalizeSnapshotField(config);
-}
-/**
-* Create a snapshot field config from an OperatorFieldConfig (for nested fields)
+* Create a snapshot field config from an OperatorFieldConfig.
 * @param {import("#/parser/service/tailordb/types").OperatorFieldConfig} fieldConfig - Field configuration
 * @returns {SnapshotFieldConfig} Snapshot field configuration
 */
@@ -6964,7 +6819,7 @@ function createSnapshotFieldConfigFromOperatorConfig(fieldConfig) {
 */
 function createSnapshotType(type) {
 	const fields = createSnapshotRecord();
-	for (const [fieldName, field] of Object.entries(type.fields)) fields[fieldName] = createSnapshotFieldConfig(field);
+	for (const [fieldName, field] of Object.entries(type.fields)) fields[fieldName] = createSnapshotFieldConfigFromOperatorConfig(field.config);
 	const snapshotType = {
 		name: type.name,
 		pluralForm: type.pluralForm || inflection.pluralize(type.name),
@@ -9511,35 +9366,25 @@ function groupMigrationsByNamespace(migrations) {
 * @returns {Promise<ProtoTailorDBType[]>} Remote TailorDB types
 */
 async function fetchRemoteTypes(client, workspaceId, namespace) {
-	return fetchAll(async (pageToken, maxPageSize) => {
-		try {
-			const { tailordbTypes, nextPageToken } = await client.listTailorDBTypes({
-				workspaceId,
-				namespaceName: namespace,
-				pageToken,
-				pageSize: maxPageSize
-			});
-			return [tailordbTypes, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+	return fetchAllTolerant(async (pageToken, maxPageSize) => {
+		const { tailordbTypes, nextPageToken } = await client.listTailorDBTypes({
+			workspaceId,
+			namespaceName: namespace,
+			pageToken,
+			pageSize: maxPageSize
+		});
+		return [tailordbTypes, nextPageToken];
 	});
 }
 async function fetchRemoteGqlPermissions(client, workspaceId, namespace) {
-	return fetchAll(async (pageToken, maxPageSize) => {
-		try {
-			const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
-				workspaceId,
-				namespaceName: namespace,
-				pageToken,
-				pageSize: maxPageSize
-			});
-			return [permissions, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+	return fetchAllTolerant(async (pageToken, maxPageSize) => {
+		const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
+			workspaceId,
+			namespaceName: namespace,
+			pageToken,
+			pageSize: maxPageSize
+		});
+		return [permissions, nextPageToken];
 	});
 }
 function definedWhenNotEmpty(value) {
@@ -10328,19 +10173,14 @@ async function planServices(client, workspaceId, appName, appId, tailordbs) {
 async function planTypes(client, workspaceId, tailordbs, executorUsedTypes, deletedServices, filteredTypesByNamespace, forceApplyAll = false) {
 	const changeSet = createChangeSet("TailorDB types");
 	const fetchTypes = (namespaceName) => {
-		return fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { tailordbTypes, nextPageToken } = await client.listTailorDBTypes({
-					workspaceId,
-					namespaceName,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [tailordbTypes, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
+		return fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { tailordbTypes, nextPageToken } = await client.listTailorDBTypes({
+				workspaceId,
+				namespaceName,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [tailordbTypes, nextPageToken];
 		});
 	};
 	for (const tailordb of tailordbs) {
@@ -10475,19 +10315,14 @@ function isNumericLikeValue(value) {
 async function planGqlPermissions(client, workspaceId, tailordbs, deletedServices, forceApplyAll = false) {
 	const changeSet = createChangeSet("TailorDB gqlPermissions");
 	const fetchGqlPermissions = (namespaceName) => {
-		return fetchAll(async (pageToken, maxPageSize) => {
-			try {
-				const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
-					workspaceId,
-					namespaceName,
-					pageToken,
-					pageSize: maxPageSize
-				});
-				return [permissions, nextPageToken];
-			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-				throw error;
-			}
+		return fetchAllTolerant(async (pageToken, maxPageSize) => {
+			const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
+				workspaceId,
+				namespaceName,
+				pageToken,
+				pageSize: maxPageSize
+			});
+			return [permissions, nextPageToken];
 		});
 	};
 	for (const tailordb of tailordbs) {
@@ -10978,6 +10813,198 @@ function normalizeRetryPolicyForCompare(policy) {
 	};
 }
 
+//#endregion
+//#region src/cli/commands/deploy/workflow-execution-policy.ts
+function toConcurrencyPolicyInit(policy) {
+	if (!policy) return void 0;
+	return { maxConcurrentExecutions: policy.maxConcurrentExecutions };
+}
+function normalizeComparableConcurrency(policy) {
+	if (!policy || !policy.maxConcurrentExecutions) return void 0;
+	return { maxConcurrentExecutions: policy.maxConcurrentExecutions };
+}
+/**
+* The declared key prefix, regardless of variant. `ExecutionPolicyWildcardInstance`
+* omits `key` from its public type to force callers through `keyFor()`, but
+* the underlying value always carries it when produced by
+* `defineWorkflowExecutionPolicy()` or `defineWorkflowExecutionPolicies()`.
+* @param policy - Declared policy from the config
+* @returns The declared key prefix
+*/
+function declaredKey(policy) {
+	if (policy.matchType === "exact") return policy.key;
+	const key = policy.key;
+	if (typeof key !== "string") throw new Error(`Invalid workflow execution policy "${policy.name}": prefix policies must be created via defineWorkflowExecutionPolicy() or defineWorkflowExecutionPolicies(), not a hand-constructed object.`);
+	return key;
+}
+/**
+* The literal key the platform registers for a declared policy: `key` with a
+* trailing `*` appended when `matchType` is `"prefix"`.
+* @param policy - Declared policy from the config
+* @returns The platform-facing execution policy key
+*/
+function toPlatformExecutionPolicyKey(policy) {
+	const key = declaredKey(policy);
+	return policy.matchType === "prefix" ? `${key}*` : key;
+}
+/**
+* Validate a declared execution policy against the parser schema. Throws with
+* a descriptive error when `name` or the platform-facing key violates the
+* platform grammar.
+* @param policy - Declared policy from the config
+*/
+function validatePolicy(policy) {
+	if (declaredKey(policy).endsWith("*")) throw new Error(`Invalid workflow execution policy "${policy.name}": key must not end with '*'; omit the '*' and set matchType: "prefix" for wildcard policies (the SDK appends '*' automatically).`);
+	const parsed = WorkflowJobFunctionExecutionPolicySchema.safeParse({
+		name: policy.name,
+		key: toPlatformExecutionPolicyKey(policy),
+		concurrencyPolicy: policy.concurrencyPolicy
+	});
+	if (!parsed.success) throw new Error(`Invalid workflow execution policy "${policy.name}": ${parsed.error.issues.map((issue) => issue.message).join("; ")}`);
+}
+/**
+* Plan workflow job function execution policy changes based on desired
+* declarations and current remote state.
+* @param client - Operator client instance
+* @param workspaceId - Workspace ID
+* @param appName - Application name
+* @param appId - Application ID for ownership metadata
+* @param declared - Policies declared in the config (property name → instance)
+* @returns Planned execution policy changes
+*/
+async function planWorkflowJobFunctionExecutionPolicy(client, workspaceId, appName, appId, declared) {
+	const changeSet = createChangeSet("Workflow execution policies");
+	const conflicts = [];
+	const unmanaged = [];
+	const resourceOwners = /* @__PURE__ */ new Set();
+	const declaredList = Object.values(declared);
+	for (const policy of declaredList) validatePolicy(policy);
+	const existing = await fetchExistingResourcesWithLabels({
+		client,
+		fetchPage: async (pageToken, pageSize) => {
+			const response = await client.listWorkflowJobFunctionExecutionPolicies({
+				workspaceId,
+				pageToken,
+				pageSize
+			});
+			return [response.policies, response.nextPageToken];
+		},
+		getName: (resource) => resource.name,
+		getTrn: (name) => resourceTrn(workspaceId, "workflow_job_function_execution_policy", name)
+	});
+	const seenNames = /* @__PURE__ */ new Set();
+	for (const policy of declaredList) {
+		if (seenNames.has(policy.name)) throw new Error(`Duplicate workflow execution policy name "${policy.name}". Each policy must have a unique name within the workspace.`);
+		seenNames.add(policy.name);
+		const metaRequest = await buildMetaRequest({
+			trn: resourceTrn(workspaceId, "workflow_job_function_execution_policy", policy.name),
+			appName,
+			appId
+		});
+		const found = existing[policy.name];
+		if (found) {
+			const owned = trackDesiredResourceOwnership({
+				labels: found.allLabels,
+				ownerLabel: found.label,
+				appName,
+				appId,
+				resourceType: "Workflow execution policy",
+				resourceName: policy.name,
+				conflicts,
+				unmanaged
+			});
+			const remoteKey = found.resource.executionPolicyKey;
+			const desiredKey = toPlatformExecutionPolicyKey(policy);
+			const remoteConcurrency = normalizeComparableConcurrency(found.resource.concurrencyPolicy);
+			const desiredConcurrency = normalizeComparableConcurrency(policy.concurrencyPolicy);
+			if (owned && hasMatchingSdkVersion(found.allLabels, metaRequest.labels) && remoteKey === desiredKey && areNormalizedEqual(remoteConcurrency, desiredConcurrency)) changeSet.unchanged.push({ name: policy.name });
+			else if (remoteKey !== desiredKey) changeSet.replaces.push({
+				name: policy.name,
+				workspaceId,
+				policy,
+				metaRequest
+			});
+			else changeSet.updates.push({
+				name: policy.name,
+				workspaceId,
+				policy,
+				metaRequest
+			});
+			delete existing[policy.name];
+		} else changeSet.creates.push({
+			name: policy.name,
+			workspaceId,
+			policy,
+			metaRequest
+		});
+	}
+	for (const [name, remaining] of Object.entries(existing)) {
+		if (!remaining) continue;
+		if (trackRemainingResourceOwner({
+			labels: remaining.allLabels,
+			ownerLabel: remaining.label,
+			appName,
+			appId,
+			resourceOwners
+		})) changeSet.deletes.push({
+			name,
+			workspaceId
+		});
+	}
+	return {
+		changeSet,
+		conflicts,
+		unmanaged,
+		resourceOwners
+	};
+}
+/**
+* Apply planned workflow execution policy changes for the given phase.
+* @param client - Operator client instance
+* @param plan - Result of `planWorkflowJobFunctionExecutionPolicy`
+* @param phase - Apply phase
+* @returns Promise that resolves when policies are applied
+*/
+async function applyWorkflowJobFunctionExecutionPolicy(client, plan, phase = "create-update") {
+	const { changeSet } = plan;
+	if (phase === "create-update") await Promise.all([
+		...changeSet.replaces.map(async (replace) => {
+			await client.deleteWorkflowJobFunctionExecutionPolicy({
+				workspaceId: replace.workspaceId,
+				executionPolicyName: replace.name
+			});
+			await client.createWorkflowJobFunctionExecutionPolicy({
+				workspaceId: replace.workspaceId,
+				executionPolicyName: replace.policy.name,
+				executionPolicyKey: toPlatformExecutionPolicyKey(replace.policy),
+				concurrencyPolicy: toConcurrencyPolicyInit(replace.policy.concurrencyPolicy)
+			});
+			await client.setMetadata(replace.metaRequest);
+		}),
+		...changeSet.creates.map(async (create) => {
+			await client.createWorkflowJobFunctionExecutionPolicy({
+				workspaceId: create.workspaceId,
+				executionPolicyName: create.policy.name,
+				executionPolicyKey: toPlatformExecutionPolicyKey(create.policy),
+				concurrencyPolicy: toConcurrencyPolicyInit(create.policy.concurrencyPolicy)
+			});
+			await client.setMetadata(create.metaRequest);
+		}),
+		...changeSet.updates.map(async (update) => {
+			await client.updateWorkflowJobFunctionExecutionPolicy({
+				workspaceId: update.workspaceId,
+				executionPolicyName: update.policy.name,
+				concurrencyPolicy: toConcurrencyPolicyInit(update.policy.concurrencyPolicy)
+			});
+			await client.setMetadata(update.metaRequest);
+		})
+	]);
+	else await Promise.all(changeSet.deletes.map((del) => client.deleteWorkflowJobFunctionExecutionPolicy({
+		workspaceId: del.workspaceId,
+		executionPolicyName: del.name
+	})));
+}
+
 //#endregion
 //#region src/cli/commands/deploy/apply-phases.ts
 /**
@@ -11011,10 +11038,12 @@ async function applyDeploymentPlans(client, workspaceId, deployments) {
 	});
 	await withSpan("apply.createUpdateDependentServices", async () => {
 		await forEachDeployment((d) => applyExecutor(client, d.executor, "create-update"));
+		await forEachDeployment((d) => applyWorkflowJobFunctionExecutionPolicy(client, d.workflowExecutionPolicy, "create-update"));
 		await forEachDeployment((d) => applyWorkflow(client, d.workflow, "create-update"));
 	});
 	await withSpan("apply.deleteDependentServices", async () => {
 		await forEachDeployment((d) => applyWorkflow(client, d.workflow, "delete"));
+		await forEachDeployment((d) => applyWorkflowJobFunctionExecutionPolicy(client, d.workflowExecutionPolicy, "delete"));
 		await forEachDeployment((d) => applyExecutor(client, d.executor, "delete"));
 		await forEachDeployment((d) => applyStaticWebsite(client, d.staticWebsite, "delete"));
 		await forEachDeployment((d) => applyAIGateway(client, d.aiGateway, "delete"));
@@ -11339,7 +11368,7 @@ function validateItems(params) {
 * @param input - Plan results from the plan phase
 */
 async function validatePlan(input) {
-	const { tailorDB, staticWebsite, idp, auth, pipeline, app, executor, workflow, secretManager } = input;
+	const { tailorDB, staticWebsite, idp, auth, pipeline, app, executor, workflow, workflowExecutionPolicy, secretManager } = input;
 	const validator = createValidator();
 	const violations = [];
 	function creates(schema, kind, items) {
@@ -11482,6 +11511,23 @@ async function validatePlan(input) {
 			}
 		})));
 	}
+	creates(CreateWorkflowJobFunctionExecutionPolicyRequestSchema, "Workflow execution policy", [...workflowExecutionPolicy.changeSet.creates, ...workflowExecutionPolicy.changeSet.replaces].map((item) => ({
+		name: item.name,
+		request: {
+			workspaceId: item.workspaceId,
+			executionPolicyName: item.policy.name,
+			executionPolicyKey: toPlatformExecutionPolicyKey(item.policy),
+			...item.policy.concurrencyPolicy && { concurrencyPolicy: { maxConcurrentExecutions: item.policy.concurrencyPolicy.maxConcurrentExecutions } }
+		}
+	})));
+	updates(UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, "Workflow execution policy", workflowExecutionPolicy.changeSet.updates.map((item) => ({
+		name: item.name,
+		request: {
+			workspaceId: item.workspaceId,
+			executionPolicyName: item.policy.name,
+			...item.policy.concurrencyPolicy && { concurrencyPolicy: { maxConcurrentExecutions: item.policy.concurrencyPolicy.maxConcurrentExecutions } }
+		}
+	})));
 	creates(CreateSecretManagerVaultRequestSchema, "Secret Manager vault", secretManager.vaultChangeSet.creates.map((item) => ({
 		name: item.name,
 		request: vaultCreateRequest(item)
@@ -11686,13 +11732,13 @@ async function shouldForceApplyAll(client, workspaceId, application, functionEnt
 	functionEntries.forEach((entry) => {
 		candidateTrns.add(resourceTrn(workspaceId, "function_registry", entry.name));
 	});
-	for (const trn of candidateTrns) try {
-		const { metadata } = await client.getMetadata({ trn });
+	for (const trn of candidateTrns) {
+		const metadata = await getOrNull(async () => {
+			const { metadata } = await client.getMetadata({ trn });
+			return metadata;
+		});
 		if (metadata?.labels["sdk-name"] !== application.name) continue;
 		if (!hasMatchingSdkVersion(metadata.labels, desiredLabels)) return true;
-	} catch (error) {
-		if (error instanceof ConnectError && error.code === Code.NotFound) continue;
-		throw error;
 	}
 	return false;
 }
@@ -11714,6 +11760,7 @@ function buildPlanReport(results) {
 	const executorEntries = formatExecutorChangeEntries(results.executor.changeSet, buildPlannedExecutorsByName(results.executor.changeSet), results.functionRegistry.executorFunctionChanges);
 	const resolverEntries = formatResolverChangeEntries(results.pipeline.changeSet.resolver, results.functionRegistry.resolverFunctionChanges);
 	const workflowEntries = formatWorkflowChangeEntries(results.workflow.changeSet, results.functionRegistry.workflowJobChanges);
+	const workflowExecutionPolicyEntries = formatChangeSetEntries(results.workflowExecutionPolicy.changeSet, ["executionPolicy"]);
 	const authHookEntries = formatAuthHookChangeEntries(results.auth.changeSet.authHook, results.functionRegistry.authHookFunctionChanges);
 	const tailorDBEntries = [...formatTailorDBResourceChangeEntries(results.tailorDB.changeSet.type, results.tailorDB.changeSet.gqlPermission)];
 	const pipelineEntries = [...resolverEntries];
@@ -11744,6 +11791,7 @@ function buildPlanReport(results) {
 		...pipelineEntries,
 		...executorEntries,
 		...workflowEntries,
+		...workflowExecutionPolicyEntries,
 		...idpEntries,
 		...authEntries
 	];
@@ -12116,7 +12164,7 @@ async function planDeploymentTarget(params) {
 		};
 		const functionRegistry = await withSpan("plan.functionRegistry", () => planFunctionRegistry(client, workspaceId, application.name, application.id, functionEntries));
 		const unchangedWorkflowJobs = new Set(functionRegistry.changeSet.unchanged.filter((entry) => entry.name.startsWith(WORKFLOW_PREFIX)).map((entry) => entry.name.slice(WORKFLOW_PREFIX.length)));
-		const [tailorDB, staticWebsite, aiGateway, idp, auth, pipeline, app, executor, workflow, secretManager] = await Promise.all([
+		const [tailorDB, staticWebsite, aiGateway, idp, auth, pipeline, app, executor, workflow, workflowExecutionPolicy, secretManager] = await Promise.all([
 			withSpan("plan.tailorDB", () => planTailorDB(ctx)),
 			withSpan("plan.staticWebsite", () => planStaticWebsite(ctx)),
 			withSpan("plan.aiGateway", () => planAIGateway(ctx)),
@@ -12126,6 +12174,7 @@ async function planDeploymentTarget(params) {
 			withSpan("plan.application", () => planApplication(ctx, httpAdapterBuildResult)),
 			withSpan("plan.executor", () => planExecutor(ctx)),
 			withSpan("plan.workflow", () => planWorkflow(client, workspaceId, application.name, application.id, workflowService?.workflows ?? {}, workflowBuildResult?.mainJobDeps ?? {}, unchangedWorkflowJobs)),
+			withSpan("plan.workflowExecutionPolicy", () => planWorkflowJobFunctionExecutionPolicy(client, workspaceId, application.name, application.id, config.workflow?.executionPolicies ?? {})),
 			withSpan("plan.secretManager", () => planSecretManager(ctx))
 		]);
 		return {
@@ -12140,6 +12189,7 @@ async function planDeploymentTarget(params) {
 			app,
 			executor,
 			workflow,
+			workflowExecutionPolicy,
 			secretManager
 		};
 	});
@@ -12167,6 +12217,7 @@ function collectOwnerConflicts(results) {
 		...results.pipeline.conflicts,
 		...results.executor.conflicts,
 		...results.workflow.conflicts,
+		...results.workflowExecutionPolicy.conflicts,
 		...results.secretManager.conflicts
 	];
 }
@@ -12181,6 +12232,7 @@ function collectUnmanagedResources(results) {
 		...results.pipeline.unmanaged,
 		...results.executor.unmanaged,
 		...results.workflow.unmanaged,
+		...results.workflowExecutionPolicy.unmanaged,
 		...results.secretManager.unmanaged
 	];
 }
@@ -12195,6 +12247,7 @@ function collectResourceOwners(results) {
 		...results.pipeline.resourceOwners,
 		...results.executor.resourceOwners,
 		...results.workflow.resourceOwners,
+		...results.workflowExecutionPolicy.resourceOwners,
 		...results.secretManager.resourceOwners
 	]);
 }
@@ -12340,6 +12393,12 @@ const DEPLOY_MANAGED_RESOURCE_DEFINITIONS = [
 		namesOf: (target) => Object.values(target.application.workflowService?.workflows ?? {}).map((workflow) => workflow.name),
 		changeSetOf: (results) => results.workflow.changeSet
 	},
+	{
+		resourceLabel: "Workflow execution policy",
+		resourceType: "workflow_job_function_execution_policy",
+		namesOf: (target) => Object.values(target.config.workflow?.executionPolicies ?? {}).map((policy) => policy.name),
+		changeSetOf: (results) => results.workflowExecutionPolicy.changeSet
+	},
 	{
 		resourceLabel: "Auth connection",
 		resourceType: "auth.connection",
@@ -17462,7 +17521,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-BndtMTFY.mjs");
+	const { defineApplication } = await import("./application-BJKNlv8c.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -19727,4 +19786,4 @@ function isDeno() {
 
 //#endregion
 export { getOrganization as $, compareSnapshotWithRemote as $t, listCommand$3 as A, apiCommand as An, getExecutorWaitFailureMessage as At, show as B, pagedLogArgs as Bn, listWorkflowExecutions as Bt, listCommand$2 as C, hasChanges as Cn, listWebhookExecutors as Ct, waitWorkflowExecution as D, PluginManager as Dn, listCommand$9 as Dt, waitCommand as E, sdkNameLabelKey as En, triggerExecutor as Et, generateCommand as F, configArg as Fn, startWorkflow as Ft, removeCommand$1 as G, deploy as Gt, extractOwnedNamespaces as H, toPageDirection as Hn, formatKeyValueTable as Ht, generateMigrationScript as I, confirmationArgs as In, getCommand$5 as It, organizationTree as J, waitForExecution as Jt, updateCommand$1 as K, ensureConfigId as Kt, writeDbTypesFile as L, deploymentArgs as Ln, getWorkflow as Lt, truncate as M, assertWritable as Mn, listExecutorJobs as Mt, truncateCommand as N, defineAppCommand as Nn, watchExecutorJob as Nt, resumeCommand as O, generateUserTypes as On, listExecutors as Ot, generate as P, commonArgs as Pn, startCommand as Pt, getCommand$1 as Q, parseMigrationLabelNumber as Qt, getConfiguredEditorCommand as R, isVerbose as Rn, executionsCommand as Rt, listApps as S, formatMigrationDiff as Sn, getFunctionRegistry as St, healthCommand as T, resourceTrn as Tn, triggerCommand as Tt, logBetaWarning as U, workspaceArgs as Un, getCommand$6 as Ut, showCommand as V, paginationArgs as Vn, functionExecutionStatusToString as Vt, remove as W, getExecutor as Wt, listCommand$4 as X, MIGRATION_LABEL_KEY as Xt, treeCommand as Y, bundleMigrationScript as Yt, listOrganizations as Z, handleOptionalToRequiredError as Zt, getWorkspace as _, loadDiff as _n, listMachineUsers as _t, updateUser as a, MIGRATE_FILE_NAME as an, getFolder as at, createCommand as b, parseMigrationNumberArg as bn, listFunctionRegistries as bt, listCommand as c, compareLocalTypesWithSnapshot as cn, createCommand$1 as ct, inviteUser as d, getLatestMigrationNumber as dn, listOAuth2Clients as dt, generateAllTypeManifestsFromSnapshot as en, updateCommand$2 as et, restoreCommand as f, getMigrationDirPath as fn, getCommand$3 as ft, getCommand as g, isValidMigrationNumber as gn, listCommand$7 as gt, listWorkspaces as h, getNextMigrationNumber as hn, tokenCommand as ht, updateCommand as i, INITIAL_SCHEMA_NUMBER as in, getCommand$2 as it, listWorkflows as j, apiCall as jn, jobsCommand as jt, resumeWorkflow as k, prompt as kn, getExecutorJob as kt, listUsers as l, compareSnapshots as ln, createFolder as lt, listCommand$1 as m, getMigrationFiles as mn, getMachineUserToken as mt, query as n, DB_TYPES_FILE_NAME as nn, listCommand$5 as nt, removeCommand as o, SCHEMA_FILE_NAME as on, deleteCommand$1 as ot, restoreWorkspace as p, getMigrationFilePath as pn, getOAuth2Client as pt, updateOrganization as q, executeScript as qt, queryCommand as r, DIFF_FILE_NAME as rn, listFolders as rt, removeUser as s, assertValidMigrationFiles as sn, deleteFolder as st, isNativeTypeScriptRuntime as t, protoGqlPermission as tn, updateFolder as tt, inviteCommand as u, createSnapshotFromLocalTypes as un, listCommand$6 as ut, deleteCommand as v, reconstructSnapshotFromMigrations as vn, generate$1 as vt, getAppHealth as w, getNamespacesWithMigrations as wn, webhookCommand as wt, createWorkspace as x, formatDiffSummary as xn, getCommand$4 as xt, deleteWorkspace as y, formatMigrationNumber as yn, listCommand$8 as yt, openInConfiguredEditor as z, multiConfigArg as zn, getWorkflowExecution as zt };
-//# sourceMappingURL=runtime-Zkg3SUwi.mjs.map
+//# sourceMappingURL=runtime-CJ5usBOu.mjs.map