@tailor-platform/sdk 1.74.1 → 1.75.0

package/dist/{runtime-DV1EnfMs.mjs → runtime-CJ5usBOu.mjs}

@@ -1,8 +1,8 @@
 import { t as db } from "./schema-Dl_y0m9e.mjs";
-import { $ as CreateUserProfileConfigRequestSchema, A as UpdatePipelineServiceRequestSchema, At as Condition_Operator, B as UpdateExecutorExecutorRequestSchema, Ct as UserProfileProviderConfig_UserProfileProviderType, D as CreatePipelineResolverRequestSchema, Dt as ApplicationSchemaUpdateAttemptStatus, E as UpdateSecretManagerSecretRequestSchema, Et as UpdateApplicationRequestSchema, F as IdPPermissionOperator, G as CreateAuthHookRequestSchema, H as ExecutorTargetType, I as IdPPermissionPermit, J as CreateAuthOAuth2ClientRequestSchema, K as CreateAuthIDPConfigRequestSchema, L as FunctionExecution_Status, M as CreateIdPServiceRequestSchema, Mt as PageDirection, N as UpdateIdPServiceRequestSchema, O as CreatePipelineServiceRequestSchema, Ot as Subgraph_ServiceType, P as IdPLang, Q as CreateTenantConfigRequestSchema, S as UpdateStaticWebsiteRequestSchema, St as TenantProviderConfig_TenantProviderType, T as CreateSecretManagerVaultRequestSchema, Tt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, U as ExecutorTriggerType, V as ExecutorJobStatus, W as CreateAuthConnectionRequestSchema, X as CreateAuthSCIMResourceRequestSchema, Y as CreateAuthSCIMConfigRequestSchema, Z as CreateAuthServiceRequestSchema, _ as TailorDBType_Permission_Operator, _t as AuthSCIMAttribute_Mutability, a as WorkspacePlatformUserRole, at as UpdateAuthSCIMConfigRequestSchema, b as AddCustomDomainRequestSchema, bt as AuthSCIMConfig_AuthorizationType, c as UpdateWorkflowRequestSchema, ct as UpdateTenantConfigRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as AuthConnection_Type, et as UpdateAuthConnectionRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as AuthHookPoint, g as TailorDBGQLPermission_Permit, gt as AuthOAuth2Client_GrantType, h as TailorDBGQLPermission_Operator, ht as AuthOAuth2Client_ClientType, it as UpdateAuthOAuth2ClientRequestSchema, j as PipelineResolver_OperationType, jt as FilterSchema, k as UpdatePipelineResolverRequestSchema, kt as ConditionSchema, l as WorkflowExecution_Status, lt as UpdateUserProfileConfigRequestSchema, m as TailorDBGQLPermission_Action, mt as AuthInvokerSchema, nt as UpdateAuthIDPConfigRequestSchema, o as CreateWorkflowJobFunctionRequestSchema, ot as UpdateAuthSCIMResourceRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as AuthIDPConfig_AuthType, q as CreateAuthMachineUserRequestSchema, rt as UpdateAuthMachineUserRequestSchema, s as CreateWorkflowRequestSchema, st as UpdateAuthServiceRequestSchema, t as OperatorService, tt as UpdateAuthHookRequestSchema, u as WorkflowJobExecution_Status, ut as AuthConnection_Status, v as TailorDBType_Permission_Permit, vt as AuthSCIMAttribute_Type, w as CreateSecretManagerSecretRequestSchema, wt as CreateApplicationRequestSchema, x as CreateStaticWebsiteRequestSchema, y as TailorDBType_PermitAction, yt as AuthSCIMAttribute_Uniqueness, z as CreateExecutorExecutorRequestSchema } from "./service_pb-CIrhGwHk.mjs";
+import { $ as CreateAuthServiceRequestSchema, A as CreatePipelineServiceRequestSchema, At as Subgraph_ServiceType, C as CreateStaticWebsiteRequestSchema, D as CreateSecretManagerVaultRequestSchema, Dt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, E as CreateSecretManagerSecretRequestSchema, Et as CreateApplicationRequestSchema, F as UpdateIdPServiceRequestSchema, G as ExecutorTriggerType, H as UpdateExecutorExecutorRequestSchema, I as IdPLang, J as CreateAuthIDPConfigRequestSchema, K as CreateAuthConnectionRequestSchema, L as IdPPermissionOperator, M as UpdatePipelineServiceRequestSchema, Mt as Condition_Operator, N as PipelineResolver_OperationType, Nt as FilterSchema, O as UpdateSecretManagerSecretRequestSchema, Ot as UpdateApplicationRequestSchema, P as CreateIdPServiceRequestSchema, Pt as PageDirection, Q as CreateAuthSCIMResourceRequestSchema, R as IdPPermissionPermit, S as AddCustomDomainRequestSchema, St as AuthSCIMConfig_AuthorizationType, Tt as UserProfileProviderConfig_UserProfileProviderType, U as ExecutorJobStatus, V as CreateExecutorExecutorRequestSchema, W as ExecutorTargetType, X as CreateAuthOAuth2ClientRequestSchema, Y as CreateAuthMachineUserRequestSchema, Z as CreateAuthSCIMConfigRequestSchema, _ as TailorDBGQLPermission_Operator, _t as AuthOAuth2Client_ClientType, a as WorkspacePlatformUserRole, at as UpdateAuthMachineUserRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthSCIMAttribute_Type, c as CreateWorkflowRequestSchema, ct as UpdateAuthSCIMResourceRequestSchema, d as WorkflowExecution_Status, dt as UpdateUserProfileConfigRequestSchema, et as CreateTenantConfigRequestSchema, f as WorkflowJobExecution_Status, ft as AuthConnection_Status, g as TailorDBGQLPermission_Action, gt as AuthInvokerSchema, h as UpdateTailorDBTypeRequestSchema, ht as AuthIDPConfig_AuthType, it as UpdateAuthIDPConfigRequestSchema, j as UpdatePipelineResolverRequestSchema, jt as ConditionSchema, k as CreatePipelineResolverRequestSchema, kt as ApplicationSchemaUpdateAttemptStatus, l as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, lt as UpdateAuthServiceRequestSchema, m as CreateTailorDBTypeRequestSchema, mt as AuthHookPoint, nt as UpdateAuthConnectionRequestSchema, o as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as UpdateAuthOAuth2ClientRequestSchema, p as CreateTailorDBServiceRequestSchema, pt as AuthConnection_Type, q as CreateAuthHookRequestSchema, rt as UpdateAuthHookRequestSchema, s as CreateWorkflowJobFunctionRequestSchema, st as UpdateAuthSCIMConfigRequestSchema, t as OperatorService, tt as CreateUserProfileConfigRequestSchema, u as UpdateWorkflowRequestSchema, ut as UpdateTenantConfigRequestSchema, v as TailorDBGQLPermission_Permit, vt as AuthOAuth2Client_GrantType, w as UpdateStaticWebsiteRequestSchema, wt as TenantProviderConfig_TenantProviderType, x as TailorDBType_PermitAction, xt as AuthSCIMAttribute_Uniqueness, y as TailorDBType_Permission_Operator, yt as AuthSCIMAttribute_Mutability, z as FunctionExecution_Status } from "./service_pb-4unFyubn.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
 import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-BEiZZ3qT.mjs";
-import { $ as getOrNull, A as hasUserTokenEntry, C as getDistDir, E as loadConfig, F as loadPlatformClientConfig, G as fetchAll, H as writePlatformConfig, J as fetchPaged, K as fetchAllTolerant, L as loadWorkspaceId, M as loadConfigPath, P as loadMachineUserName, Q as getOAuth2ClientId, R as platformConfigFromProfile, S as createBundleCache, T as hashFile, Z as getConsoleBaseUrl, at as byName, b as getPluginGenerationDependencies, c as HTTP_METHODS, d as buildResolverOperationHookExpr, et as getPlatformBaseUrl, f as assertUniqueLocalTailorDBTypeNames, g as platformBundleDefinePlugin, h as stringifyFunction, i as resolverBundleKey, it as resolveStaticWebsiteUrls, j as loadAccessToken, m as TailorDBTypeSchema, n as generatePluginFilesIfNeeded, nt as initOperatorClient, p as assertUniqueTailorDBTypeNamesWithExternal, q as fetchMachineUserToken, r as loadApplication, rt as isDefaultPlatform, t as defineApplication, u as buildExecutorArgsExpr, w as hashContent, x as hasGenerationHooks, z as readPlatformConfig } from "./application-BsH6tkZC.mjs";
+import { $ as getOAuth2ClientId, B as readPlatformConfig, C as createBundleCache, D as loadConfig, E as hashFile, F as loadMachineUserName, I as loadPlatformClientConfig, J as fetchMachineUserToken, K as fetchAll, M as loadAccessToken, N as loadConfigPath, Q as getConsoleBaseUrl, R as loadWorkspaceId, S as hasGenerationHooks, T as hashContent, U as writePlatformConfig, Y as fetchPaged, _ as platformBundleDefinePlugin, at as resolveStaticWebsiteUrls, d as buildExecutorArgsExpr, et as getOrNull, f as buildResolverOperationHookExpr, g as stringifyFunction, h as TailorDBTypeSchema, i as resolverBundleKey, it as isDefaultPlatform, j as hasUserTokenEntry, l as HTTP_METHODS, m as assertUniqueTailorDBTypeNamesWithExternal, n as generatePluginFilesIfNeeded, o as WorkflowJobFunctionExecutionPolicySchema, ot as byName, p as assertUniqueLocalTailorDBTypeNames, q as fetchAllTolerant, r as loadApplication, rt as initOperatorClient, t as defineApplication, tt as getPlatformBaseUrl, w as getDistDir, x as getPluginGenerationDependencies, z as platformConfigFromProfile } from "./application-DYshsH-K.mjs";
 import { o as loadFilesWithIgnores, t as createExecutorService } from "./service-BCRJ-3NV.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "./package-json-8b0O9TlX.mjs";
@@ -10813,6 +10813,198 @@ function normalizeRetryPolicyForCompare(policy) {
 	};
 }
 
+//#endregion
+//#region src/cli/commands/deploy/workflow-execution-policy.ts
+function toConcurrencyPolicyInit(policy) {
+	if (!policy) return void 0;
+	return { maxConcurrentExecutions: policy.maxConcurrentExecutions };
+}
+function normalizeComparableConcurrency(policy) {
+	if (!policy || !policy.maxConcurrentExecutions) return void 0;
+	return { maxConcurrentExecutions: policy.maxConcurrentExecutions };
+}
+/**
+* The declared key prefix, regardless of variant. `ExecutionPolicyWildcardInstance`
+* omits `key` from its public type to force callers through `keyFor()`, but
+* the underlying value always carries it when produced by
+* `defineWorkflowExecutionPolicy()` or `defineWorkflowExecutionPolicies()`.
+* @param policy - Declared policy from the config
+* @returns The declared key prefix
+*/
+function declaredKey(policy) {
+	if (policy.matchType === "exact") return policy.key;
+	const key = policy.key;
+	if (typeof key !== "string") throw new Error(`Invalid workflow execution policy "${policy.name}": prefix policies must be created via defineWorkflowExecutionPolicy() or defineWorkflowExecutionPolicies(), not a hand-constructed object.`);
+	return key;
+}
+/**
+* The literal key the platform registers for a declared policy: `key` with a
+* trailing `*` appended when `matchType` is `"prefix"`.
+* @param policy - Declared policy from the config
+* @returns The platform-facing execution policy key
+*/
+function toPlatformExecutionPolicyKey(policy) {
+	const key = declaredKey(policy);
+	return policy.matchType === "prefix" ? `${key}*` : key;
+}
+/**
+* Validate a declared execution policy against the parser schema. Throws with
+* a descriptive error when `name` or the platform-facing key violates the
+* platform grammar.
+* @param policy - Declared policy from the config
+*/
+function validatePolicy(policy) {
+	if (declaredKey(policy).endsWith("*")) throw new Error(`Invalid workflow execution policy "${policy.name}": key must not end with '*'; omit the '*' and set matchType: "prefix" for wildcard policies (the SDK appends '*' automatically).`);
+	const parsed = WorkflowJobFunctionExecutionPolicySchema.safeParse({
+		name: policy.name,
+		key: toPlatformExecutionPolicyKey(policy),
+		concurrencyPolicy: policy.concurrencyPolicy
+	});
+	if (!parsed.success) throw new Error(`Invalid workflow execution policy "${policy.name}": ${parsed.error.issues.map((issue) => issue.message).join("; ")}`);
+}
+/**
+* Plan workflow job function execution policy changes based on desired
+* declarations and current remote state.
+* @param client - Operator client instance
+* @param workspaceId - Workspace ID
+* @param appName - Application name
+* @param appId - Application ID for ownership metadata
+* @param declared - Policies declared in the config (property name → instance)
+* @returns Planned execution policy changes
+*/
+async function planWorkflowJobFunctionExecutionPolicy(client, workspaceId, appName, appId, declared) {
+	const changeSet = createChangeSet("Workflow execution policies");
+	const conflicts = [];
+	const unmanaged = [];
+	const resourceOwners = /* @__PURE__ */ new Set();
+	const declaredList = Object.values(declared);
+	for (const policy of declaredList) validatePolicy(policy);
+	const existing = await fetchExistingResourcesWithLabels({
+		client,
+		fetchPage: async (pageToken, pageSize) => {
+			const response = await client.listWorkflowJobFunctionExecutionPolicies({
+				workspaceId,
+				pageToken,
+				pageSize
+			});
+			return [response.policies, response.nextPageToken];
+		},
+		getName: (resource) => resource.name,
+		getTrn: (name) => resourceTrn(workspaceId, "workflow_job_function_execution_policy", name)
+	});
+	const seenNames = /* @__PURE__ */ new Set();
+	for (const policy of declaredList) {
+		if (seenNames.has(policy.name)) throw new Error(`Duplicate workflow execution policy name "${policy.name}". Each policy must have a unique name within the workspace.`);
+		seenNames.add(policy.name);
+		const metaRequest = await buildMetaRequest({
+			trn: resourceTrn(workspaceId, "workflow_job_function_execution_policy", policy.name),
+			appName,
+			appId
+		});
+		const found = existing[policy.name];
+		if (found) {
+			const owned = trackDesiredResourceOwnership({
+				labels: found.allLabels,
+				ownerLabel: found.label,
+				appName,
+				appId,
+				resourceType: "Workflow execution policy",
+				resourceName: policy.name,
+				conflicts,
+				unmanaged
+			});
+			const remoteKey = found.resource.executionPolicyKey;
+			const desiredKey = toPlatformExecutionPolicyKey(policy);
+			const remoteConcurrency = normalizeComparableConcurrency(found.resource.concurrencyPolicy);
+			const desiredConcurrency = normalizeComparableConcurrency(policy.concurrencyPolicy);
+			if (owned && hasMatchingSdkVersion(found.allLabels, metaRequest.labels) && remoteKey === desiredKey && areNormalizedEqual(remoteConcurrency, desiredConcurrency)) changeSet.unchanged.push({ name: policy.name });
+			else if (remoteKey !== desiredKey) changeSet.replaces.push({
+				name: policy.name,
+				workspaceId,
+				policy,
+				metaRequest
+			});
+			else changeSet.updates.push({
+				name: policy.name,
+				workspaceId,
+				policy,
+				metaRequest
+			});
+			delete existing[policy.name];
+		} else changeSet.creates.push({
+			name: policy.name,
+			workspaceId,
+			policy,
+			metaRequest
+		});
+	}
+	for (const [name, remaining] of Object.entries(existing)) {
+		if (!remaining) continue;
+		if (trackRemainingResourceOwner({
+			labels: remaining.allLabels,
+			ownerLabel: remaining.label,
+			appName,
+			appId,
+			resourceOwners
+		})) changeSet.deletes.push({
+			name,
+			workspaceId
+		});
+	}
+	return {
+		changeSet,
+		conflicts,
+		unmanaged,
+		resourceOwners
+	};
+}
+/**
+* Apply planned workflow execution policy changes for the given phase.
+* @param client - Operator client instance
+* @param plan - Result of `planWorkflowJobFunctionExecutionPolicy`
+* @param phase - Apply phase
+* @returns Promise that resolves when policies are applied
+*/
+async function applyWorkflowJobFunctionExecutionPolicy(client, plan, phase = "create-update") {
+	const { changeSet } = plan;
+	if (phase === "create-update") await Promise.all([
+		...changeSet.replaces.map(async (replace) => {
+			await client.deleteWorkflowJobFunctionExecutionPolicy({
+				workspaceId: replace.workspaceId,
+				executionPolicyName: replace.name
+			});
+			await client.createWorkflowJobFunctionExecutionPolicy({
+				workspaceId: replace.workspaceId,
+				executionPolicyName: replace.policy.name,
+				executionPolicyKey: toPlatformExecutionPolicyKey(replace.policy),
+				concurrencyPolicy: toConcurrencyPolicyInit(replace.policy.concurrencyPolicy)
+			});
+			await client.setMetadata(replace.metaRequest);
+		}),
+		...changeSet.creates.map(async (create) => {
+			await client.createWorkflowJobFunctionExecutionPolicy({
+				workspaceId: create.workspaceId,
+				executionPolicyName: create.policy.name,
+				executionPolicyKey: toPlatformExecutionPolicyKey(create.policy),
+				concurrencyPolicy: toConcurrencyPolicyInit(create.policy.concurrencyPolicy)
+			});
+			await client.setMetadata(create.metaRequest);
+		}),
+		...changeSet.updates.map(async (update) => {
+			await client.updateWorkflowJobFunctionExecutionPolicy({
+				workspaceId: update.workspaceId,
+				executionPolicyName: update.policy.name,
+				concurrencyPolicy: toConcurrencyPolicyInit(update.policy.concurrencyPolicy)
+			});
+			await client.setMetadata(update.metaRequest);
+		})
+	]);
+	else await Promise.all(changeSet.deletes.map((del) => client.deleteWorkflowJobFunctionExecutionPolicy({
+		workspaceId: del.workspaceId,
+		executionPolicyName: del.name
+	})));
+}
+
 //#endregion
 //#region src/cli/commands/deploy/apply-phases.ts
 /**
@@ -10846,10 +11038,12 @@ async function applyDeploymentPlans(client, workspaceId, deployments) {
 	});
 	await withSpan("apply.createUpdateDependentServices", async () => {
 		await forEachDeployment((d) => applyExecutor(client, d.executor, "create-update"));
+		await forEachDeployment((d) => applyWorkflowJobFunctionExecutionPolicy(client, d.workflowExecutionPolicy, "create-update"));
 		await forEachDeployment((d) => applyWorkflow(client, d.workflow, "create-update"));
 	});
 	await withSpan("apply.deleteDependentServices", async () => {
 		await forEachDeployment((d) => applyWorkflow(client, d.workflow, "delete"));
+		await forEachDeployment((d) => applyWorkflowJobFunctionExecutionPolicy(client, d.workflowExecutionPolicy, "delete"));
 		await forEachDeployment((d) => applyExecutor(client, d.executor, "delete"));
 		await forEachDeployment((d) => applyStaticWebsite(client, d.staticWebsite, "delete"));
 		await forEachDeployment((d) => applyAIGateway(client, d.aiGateway, "delete"));
@@ -11174,7 +11368,7 @@ function validateItems(params) {
 * @param input - Plan results from the plan phase
 */
 async function validatePlan(input) {
-	const { tailorDB, staticWebsite, idp, auth, pipeline, app, executor, workflow, secretManager } = input;
+	const { tailorDB, staticWebsite, idp, auth, pipeline, app, executor, workflow, workflowExecutionPolicy, secretManager } = input;
 	const validator = createValidator();
 	const violations = [];
 	function creates(schema, kind, items) {
@@ -11317,6 +11511,23 @@ async function validatePlan(input) {
 			}
 		})));
 	}
+	creates(CreateWorkflowJobFunctionExecutionPolicyRequestSchema, "Workflow execution policy", [...workflowExecutionPolicy.changeSet.creates, ...workflowExecutionPolicy.changeSet.replaces].map((item) => ({
+		name: item.name,
+		request: {
+			workspaceId: item.workspaceId,
+			executionPolicyName: item.policy.name,
+			executionPolicyKey: toPlatformExecutionPolicyKey(item.policy),
+			...item.policy.concurrencyPolicy && { concurrencyPolicy: { maxConcurrentExecutions: item.policy.concurrencyPolicy.maxConcurrentExecutions } }
+		}
+	})));
+	updates(UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, "Workflow execution policy", workflowExecutionPolicy.changeSet.updates.map((item) => ({
+		name: item.name,
+		request: {
+			workspaceId: item.workspaceId,
+			executionPolicyName: item.policy.name,
+			...item.policy.concurrencyPolicy && { concurrencyPolicy: { maxConcurrentExecutions: item.policy.concurrencyPolicy.maxConcurrentExecutions } }
+		}
+	})));
 	creates(CreateSecretManagerVaultRequestSchema, "Secret Manager vault", secretManager.vaultChangeSet.creates.map((item) => ({
 		name: item.name,
 		request: vaultCreateRequest(item)
@@ -11549,6 +11760,7 @@ function buildPlanReport(results) {
 	const executorEntries = formatExecutorChangeEntries(results.executor.changeSet, buildPlannedExecutorsByName(results.executor.changeSet), results.functionRegistry.executorFunctionChanges);
 	const resolverEntries = formatResolverChangeEntries(results.pipeline.changeSet.resolver, results.functionRegistry.resolverFunctionChanges);
 	const workflowEntries = formatWorkflowChangeEntries(results.workflow.changeSet, results.functionRegistry.workflowJobChanges);
+	const workflowExecutionPolicyEntries = formatChangeSetEntries(results.workflowExecutionPolicy.changeSet, ["executionPolicy"]);
 	const authHookEntries = formatAuthHookChangeEntries(results.auth.changeSet.authHook, results.functionRegistry.authHookFunctionChanges);
 	const tailorDBEntries = [...formatTailorDBResourceChangeEntries(results.tailorDB.changeSet.type, results.tailorDB.changeSet.gqlPermission)];
 	const pipelineEntries = [...resolverEntries];
@@ -11579,6 +11791,7 @@ function buildPlanReport(results) {
 		...pipelineEntries,
 		...executorEntries,
 		...workflowEntries,
+		...workflowExecutionPolicyEntries,
 		...idpEntries,
 		...authEntries
 	];
@@ -11951,7 +12164,7 @@ async function planDeploymentTarget(params) {
 		};
 		const functionRegistry = await withSpan("plan.functionRegistry", () => planFunctionRegistry(client, workspaceId, application.name, application.id, functionEntries));
 		const unchangedWorkflowJobs = new Set(functionRegistry.changeSet.unchanged.filter((entry) => entry.name.startsWith(WORKFLOW_PREFIX)).map((entry) => entry.name.slice(WORKFLOW_PREFIX.length)));
-		const [tailorDB, staticWebsite, aiGateway, idp, auth, pipeline, app, executor, workflow, secretManager] = await Promise.all([
+		const [tailorDB, staticWebsite, aiGateway, idp, auth, pipeline, app, executor, workflow, workflowExecutionPolicy, secretManager] = await Promise.all([
 			withSpan("plan.tailorDB", () => planTailorDB(ctx)),
 			withSpan("plan.staticWebsite", () => planStaticWebsite(ctx)),
 			withSpan("plan.aiGateway", () => planAIGateway(ctx)),
@@ -11961,6 +12174,7 @@ async function planDeploymentTarget(params) {
 			withSpan("plan.application", () => planApplication(ctx, httpAdapterBuildResult)),
 			withSpan("plan.executor", () => planExecutor(ctx)),
 			withSpan("plan.workflow", () => planWorkflow(client, workspaceId, application.name, application.id, workflowService?.workflows ?? {}, workflowBuildResult?.mainJobDeps ?? {}, unchangedWorkflowJobs)),
+			withSpan("plan.workflowExecutionPolicy", () => planWorkflowJobFunctionExecutionPolicy(client, workspaceId, application.name, application.id, config.workflow?.executionPolicies ?? {})),
 			withSpan("plan.secretManager", () => planSecretManager(ctx))
 		]);
 		return {
@@ -11975,6 +12189,7 @@ async function planDeploymentTarget(params) {
 			app,
 			executor,
 			workflow,
+			workflowExecutionPolicy,
 			secretManager
 		};
 	});
@@ -12002,6 +12217,7 @@ function collectOwnerConflicts(results) {
 		...results.pipeline.conflicts,
 		...results.executor.conflicts,
 		...results.workflow.conflicts,
+		...results.workflowExecutionPolicy.conflicts,
 		...results.secretManager.conflicts
 	];
 }
@@ -12016,6 +12232,7 @@ function collectUnmanagedResources(results) {
 		...results.pipeline.unmanaged,
 		...results.executor.unmanaged,
 		...results.workflow.unmanaged,
+		...results.workflowExecutionPolicy.unmanaged,
 		...results.secretManager.unmanaged
 	];
 }
@@ -12030,6 +12247,7 @@ function collectResourceOwners(results) {
 		...results.pipeline.resourceOwners,
 		...results.executor.resourceOwners,
 		...results.workflow.resourceOwners,
+		...results.workflowExecutionPolicy.resourceOwners,
 		...results.secretManager.resourceOwners
 	]);
 }
@@ -12175,6 +12393,12 @@ const DEPLOY_MANAGED_RESOURCE_DEFINITIONS = [
 		namesOf: (target) => Object.values(target.application.workflowService?.workflows ?? {}).map((workflow) => workflow.name),
 		changeSetOf: (results) => results.workflow.changeSet
 	},
+	{
+		resourceLabel: "Workflow execution policy",
+		resourceType: "workflow_job_function_execution_policy",
+		namesOf: (target) => Object.values(target.config.workflow?.executionPolicies ?? {}).map((policy) => policy.name),
+		changeSetOf: (results) => results.workflowExecutionPolicy.changeSet
+	},
 	{
 		resourceLabel: "Auth connection",
 		resourceType: "auth.connection",
@@ -17297,7 +17521,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-CSUhZMb5.mjs");
+	const { defineApplication } = await import("./application-BJKNlv8c.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -19562,4 +19786,4 @@ function isDeno() {
 
 //#endregion
 export { getOrganization as $, compareSnapshotWithRemote as $t, listCommand$3 as A, apiCommand as An, getExecutorWaitFailureMessage as At, show as B, pagedLogArgs as Bn, listWorkflowExecutions as Bt, listCommand$2 as C, hasChanges as Cn, listWebhookExecutors as Ct, waitWorkflowExecution as D, PluginManager as Dn, listCommand$9 as Dt, waitCommand as E, sdkNameLabelKey as En, triggerExecutor as Et, generateCommand as F, configArg as Fn, startWorkflow as Ft, removeCommand$1 as G, deploy as Gt, extractOwnedNamespaces as H, toPageDirection as Hn, formatKeyValueTable as Ht, generateMigrationScript as I, confirmationArgs as In, getCommand$5 as It, organizationTree as J, waitForExecution as Jt, updateCommand$1 as K, ensureConfigId as Kt, writeDbTypesFile as L, deploymentArgs as Ln, getWorkflow as Lt, truncate as M, assertWritable as Mn, listExecutorJobs as Mt, truncateCommand as N, defineAppCommand as Nn, watchExecutorJob as Nt, resumeCommand as O, generateUserTypes as On, listExecutors as Ot, generate as P, commonArgs as Pn, startCommand as Pt, getCommand$1 as Q, parseMigrationLabelNumber as Qt, getConfiguredEditorCommand as R, isVerbose as Rn, executionsCommand as Rt, listApps as S, formatMigrationDiff as Sn, getFunctionRegistry as St, healthCommand as T, resourceTrn as Tn, triggerCommand as Tt, logBetaWarning as U, workspaceArgs as Un, getCommand$6 as Ut, showCommand as V, paginationArgs as Vn, functionExecutionStatusToString as Vt, remove as W, getExecutor as Wt, listCommand$4 as X, MIGRATION_LABEL_KEY as Xt, treeCommand as Y, bundleMigrationScript as Yt, listOrganizations as Z, handleOptionalToRequiredError as Zt, getWorkspace as _, loadDiff as _n, listMachineUsers as _t, updateUser as a, MIGRATE_FILE_NAME as an, getFolder as at, createCommand as b, parseMigrationNumberArg as bn, listFunctionRegistries as bt, listCommand as c, compareLocalTypesWithSnapshot as cn, createCommand$1 as ct, inviteUser as d, getLatestMigrationNumber as dn, listOAuth2Clients as dt, generateAllTypeManifestsFromSnapshot as en, updateCommand$2 as et, restoreCommand as f, getMigrationDirPath as fn, getCommand$3 as ft, getCommand as g, isValidMigrationNumber as gn, listCommand$7 as gt, listWorkspaces as h, getNextMigrationNumber as hn, tokenCommand as ht, updateCommand as i, INITIAL_SCHEMA_NUMBER as in, getCommand$2 as it, listWorkflows as j, apiCall as jn, jobsCommand as jt, resumeWorkflow as k, prompt as kn, getExecutorJob as kt, listUsers as l, compareSnapshots as ln, createFolder as lt, listCommand$1 as m, getMigrationFiles as mn, getMachineUserToken as mt, query as n, DB_TYPES_FILE_NAME as nn, listCommand$5 as nt, removeCommand as o, SCHEMA_FILE_NAME as on, deleteCommand$1 as ot, restoreWorkspace as p, getMigrationFilePath as pn, getOAuth2Client as pt, updateOrganization as q, executeScript as qt, queryCommand as r, DIFF_FILE_NAME as rn, listFolders as rt, removeUser as s, assertValidMigrationFiles as sn, deleteFolder as st, isNativeTypeScriptRuntime as t, protoGqlPermission as tn, updateFolder as tt, inviteCommand as u, createSnapshotFromLocalTypes as un, listCommand$6 as ut, deleteCommand as v, reconstructSnapshotFromMigrations as vn, generate$1 as vt, getAppHealth as w, getNamespacesWithMigrations as wn, webhookCommand as wt, createWorkspace as x, formatDiffSummary as xn, getCommand$4 as xt, deleteWorkspace as y, formatMigrationNumber as yn, listCommand$8 as yt, openInConfiguredEditor as z, multiConfigArg as zn, getWorkflowExecution as zt };
-//# sourceMappingURL=runtime-DV1EnfMs.mjs.map
+//# sourceMappingURL=runtime-CJ5usBOu.mjs.map