@tailor-platform/sdk 1.76.1 → 1.76.2

package/dist/{runtime-_vUgjiqT.mjs → runtime-DlklyuHN.mjs}

@@ -1,27 +1,35 @@
-import { t as db } from "./schema-DrVyN-LP.mjs";
-import { i as PageDirection, n as Condition_Operator, r as FilterSchema, t as ConditionSchema } from "./resource_pb-BRv7AMXK.mjs";
+import { t as db } from "./schema-DbTR1c6M.mjs";
+import { $ as CreateAuthIDPConfigRequestSchema, A as CreatePipelineResolverRequestSchema, At as TenantProviderConfig_TenantProviderType, B as IdPPermissionOperator, Bt as CreateAIGatewayRequestSchema, C as UpdateStaticWebsiteRequestSchema, Ct as AuthOAuth2Client_ClientType, D as CreateSecretManagerVaultRequestSchema, Dt as AuthSCIMAttribute_Uniqueness, E as CreateSecretManagerSecretRequestSchema, Et as AuthSCIMAttribute_Type, F as PipelineResolver_OperationType, Ft as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, G as CreateExecutorExecutorRequestSchema, Gt as ConditionSchema, H as FunctionExecution_Status, I as CreateIdPServiceRequestSchema, It as UpdateApplicationRequestSchema, J as ExecutorJobStatus, Jt as PageDirection, K as UpdateExecutorExecutorRequestSchema, Kt as Condition_Operator, L as UpdateIdPServiceRequestSchema, M as UpdatePipelineResolverRequestSchema, N as UpdatePipelineServiceRequestSchema, O as UpdateSecretManagerSecretRequestSchema, Ot as AuthSCIMConfig_AuthorizationType, Pt as CreateApplicationRequestSchema, Q as CreateAuthHookRequestSchema, Rt as ApplicationSchemaUpdateAttemptStatus, S as CreateStaticWebsiteRequestSchema, St as AuthInvokerSchema, Tt as AuthSCIMAttribute_Mutability, V as IdPPermissionPermit, Vt as UpdateAIGatewayRequestSchema, X as ExecutorTriggerType, Y as ExecutorTargetType, Z as CreateAuthConnectionRequestSchema, _ as TailorDBGQLPermission_Permit, a as CreateWorkflowRequestSchema, at as CreateTenantConfigRequestSchema, b as TailorDBType_PermitAction, bt as AuthHookPoint, ct as UpdateAuthHookRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as UpdateAuthOAuth2ClientRequestSchema, et as CreateAuthMachineUserRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as UpdateAuthSCIMConfigRequestSchema, g as TailorDBGQLPermission_Operator, gt as UpdateUserProfileConfigRequestSchema, h as TailorDBGQLPermission_Action, ht as UpdateTenantConfigRequestSchema, i as CreateWorkflowJobFunctionRequestSchema, it as CreateAuthServiceRequestSchema, j as CreatePipelineServiceRequestSchema, jt as UserProfileProviderConfig_UserProfileProviderType, l as WorkflowExecution_Status, lt as UpdateAuthIDPConfigRequestSchema, mt as UpdateAuthServiceRequestSchema, nt as CreateAuthSCIMConfigRequestSchema, o as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as CreateUserProfileConfigRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as UpdateAuthSCIMResourceRequestSchema, qt as FilterSchema, r as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, rt as CreateAuthSCIMResourceRequestSchema, s as UpdateWorkflowRequestSchema, st as UpdateAuthConnectionRequestSchema, t as WorkspacePlatformUserRole, tt as CreateAuthOAuth2ClientRequestSchema, u as WorkflowJobExecution_Status, ut as UpdateAuthMachineUserRequestSchema, v as TailorDBType_Permission_Operator, vt as AuthConnection_Status, wt as AuthOAuth2Client_GrantType, x as AddCustomDomainRequestSchema, xt as AuthIDPConfig_AuthType, y as TailorDBType_Permission_Permit, yt as AuthConnection_Type, z as IdPLang, zt as Subgraph_ServiceType } from "./workspace_resource_pb-Db3fv68L.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
 import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-BEiZZ3qT.mjs";
-import { $ as getOAuth2ClientId, B as readPlatformConfig, C as createBundleCache, Ct as toPageDirection, D as loadConfig, E as hashFile, F as loadMachineUserName, I as loadPlatformClientConfig, J as fetchMachineUserToken, K as fetchAll, M as loadAccessToken, N as loadConfigPath, Q as getConsoleBaseUrl, R as loadWorkspaceId, S as hasGenerationHooks, St as resolveMachineUserInputSource, T as hashContent, U as writePlatformConfig, Y as fetchPaged, _ as platformBundleDefinePlugin, _t as organizationArgs, at as resolveStaticWebsiteUrls, bt as parseDuration, ct as configArg, d as buildExecutorArgsExpr, dt as durationArg, et as getOrNull, f as buildResolverOperationHookExpr, ft as folderArgs, g as stringifyFunction, gt as orderArg, h as TailorDBTypeSchema, ht as nonNegativeIntArg, i as resolverBundleKey, it as isDefaultPlatform, j as hasUserTokenEntry, l as HTTP_METHODS, lt as confirmationArgs, m as assertUniqueTailorDBTypeNamesWithExternal, n as generatePluginFilesIfNeeded, o as WorkflowJobFunctionExecutionPolicySchema, ot as byName, p as assertUniqueLocalTailorDBTypeNames, q as fetchAllTolerant, r as loadApplication, rt as initOperatorClient, t as defineApplication, tt as getPlatformBaseUrl, ut as deploymentArgs, vt as pagedLogArgs, w as getDistDir, wt as workspaceArgs, x as getPluginGenerationDependencies, xt as positiveIntArg, yt as paginationArgs, z as platformConfigFromProfile } from "./application-BUfYmf0O.mjs";
-import { o as loadFilesWithIgnores, t as createExecutorService } from "./service-BCRJ-3NV.mjs";
+import { A as fetchAllTolerant, B as initOperatorClient, C as createBundleCache, E as hashFile, F as getConsoleBaseUrl, G as byName, H as normalizeBaseUrl, I as getOAuth2ClientId, K as LOG_LEVELS, L as getOrNull, M as fetchPaged, O as defaultPlatformBaseUrl, R as getPlatformBaseUrl, S as hasGenerationHooks, T as hashContent, U as rememberPlatformConfigForToken, V as isDefaultPlatform, W as resolveStaticWebsiteUrls, _ as platformBundleDefinePlugin, d as buildExecutorArgsExpr, f as buildResolverOperationHookExpr, g as stringifyFunction, h as TailorDBTypeSchema, i as resolverBundleKey, j as fetchMachineUserToken, k as fetchAll, l as HTTP_METHODS, m as assertUniqueTailorDBTypeNamesWithExternal, n as generatePluginFilesIfNeeded, o as WorkflowJobFunctionExecutionPolicySchema, p as assertUniqueLocalTailorDBTypeNames, r as loadApplication, t as defineApplication, w as getDistDir, x as getPluginGenerationDependencies, z as initOAuth2Client } from "./application-CqjCcZ2n.mjs";
+import { o as loadFilesWithIgnores, s as functionSchema, t as createExecutorService } from "./service-BCRJ-3NV.mjs";
+import { n as enumConstantsPlugin, t as EnumConstantsGeneratorID } from "./enum-constants-j9QBF0cB.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
+import { n as fileUtilsPlugin, t as FileUtilsGeneratorID } from "./file-utils-DcyIPFQh.mjs";
+import { n as kyselyTypePlugin, t as KyselyGeneratorID } from "./kysely-type-D-zflMGf.mjs";
+import { n as seedPlugin, t as SeedGeneratorID } from "./seed-DFFigL8V.mjs";
 import { t as readPackageJson } from "./package-json-8b0O9TlX.mjs";
-import { i as userAgent } from "./secret-file-VSVGy1V0.mjs";
+import { t as userAgent } from "./user-agent-DX2Jnw0-.mjs";
 import { n as isCLIError, t as createCLIError } from "./errors-Dtf2WPaW.mjs";
-import { $ as CreateAuthServiceRequestSchema, A as CreatePipelineServiceRequestSchema, At as Subgraph_ServiceType, C as CreateStaticWebsiteRequestSchema, D as CreateSecretManagerVaultRequestSchema, Dt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, E as CreateSecretManagerSecretRequestSchema, Et as CreateApplicationRequestSchema, F as UpdateIdPServiceRequestSchema, G as ExecutorTriggerType, H as UpdateExecutorExecutorRequestSchema, I as IdPLang, J as CreateAuthIDPConfigRequestSchema, K as CreateAuthConnectionRequestSchema, L as IdPPermissionOperator, M as UpdatePipelineServiceRequestSchema, N as PipelineResolver_OperationType, O as UpdateSecretManagerSecretRequestSchema, Ot as UpdateApplicationRequestSchema, P as CreateIdPServiceRequestSchema, Q as CreateAuthSCIMResourceRequestSchema, R as IdPPermissionPermit, S as AddCustomDomainRequestSchema, St as AuthSCIMConfig_AuthorizationType, Tt as UserProfileProviderConfig_UserProfileProviderType, U as ExecutorJobStatus, V as CreateExecutorExecutorRequestSchema, W as ExecutorTargetType, X as CreateAuthOAuth2ClientRequestSchema, Y as CreateAuthMachineUserRequestSchema, Z as CreateAuthSCIMConfigRequestSchema, _ as TailorDBGQLPermission_Operator, _t as AuthOAuth2Client_ClientType, a as WorkspacePlatformUserRole, at as UpdateAuthMachineUserRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthSCIMAttribute_Type, c as CreateWorkflowRequestSchema, ct as UpdateAuthSCIMResourceRequestSchema, d as WorkflowExecution_Status, dt as UpdateUserProfileConfigRequestSchema, et as CreateTenantConfigRequestSchema, f as WorkflowJobExecution_Status, ft as AuthConnection_Status, g as TailorDBGQLPermission_Action, gt as AuthInvokerSchema, h as UpdateTailorDBTypeRequestSchema, ht as AuthIDPConfig_AuthType, it as UpdateAuthIDPConfigRequestSchema, j as UpdatePipelineResolverRequestSchema, k as CreatePipelineResolverRequestSchema, kt as ApplicationSchemaUpdateAttemptStatus, l as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, lt as UpdateAuthServiceRequestSchema, m as CreateTailorDBTypeRequestSchema, mt as AuthHookPoint, nt as UpdateAuthConnectionRequestSchema, o as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as UpdateAuthOAuth2ClientRequestSchema, p as CreateTailorDBServiceRequestSchema, pt as AuthConnection_Type, q as CreateAuthHookRequestSchema, rt as UpdateAuthHookRequestSchema, s as CreateWorkflowJobFunctionRequestSchema, st as UpdateAuthSCIMConfigRequestSchema, t as OperatorService, tt as CreateUserProfileConfigRequestSchema, u as UpdateWorkflowRequestSchema, ut as UpdateTenantConfigRequestSchema, v as TailorDBGQLPermission_Permit, vt as AuthOAuth2Client_GrantType, w as UpdateStaticWebsiteRequestSchema, wt as TenantProviderConfig_TenantProviderType, x as TailorDBType_PermitAction, xt as AuthSCIMAttribute_Uniqueness, y as TailorDBType_Permission_Operator, yt as AuthSCIMAttribute_Mutability, z as FunctionExecution_Status } from "./service_pb-B5w9rjPY.mjs";
+import { n as tightenSecretFilePermissions, r as writeSecretFile } from "./secret-file-DBqZhjFQ.mjs";
 import { r as withSpan } from "./telemetry-CdqJEzkj.mjs";
 import { arg, createDefineCommand, defineCommand, runCommand } from "politty";
 import { z } from "zod";
-import { ScalarType, create, fromJson, toJson } from "@bufbuild/protobuf";
+import { create, fromJson, toJson } from "@bufbuild/protobuf";
 import * as fs$1 from "node:fs";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { parseEnv } from "node:util";
 import { ValueSchema, timestampDate } from "@bufbuild/protobuf/wkt";
 import * as path from "pathe";
 import { formatDistanceToNowStrict } from "date-fns";
 import { getBorderCharacters, table } from "table";
 import { pathToFileURL } from "node:url";
+import * as os from "node:os";
 import { tmpdir } from "node:os";
+import { parseTOML, parseYAML, stringifyYAML } from "confbox";
 import { findUpSync } from "find-up-simple";
+import { lt } from "semver";
 import { xdgConfig } from "xdg-basedir";
 import { Code, ConnectError } from "@connectrpc/connect";
 import pLimit from "p-limit";
@@ -47,6 +55,256 @@ import { createPrompt } from "@toiroakr/read-multiline";
 import { astVisitor, parse } from "pgsql-ast-parser";
 import { parse as parse$1 } from "@0no-co/graphql.web";
 
+//#region src/cli/shared/args.ts
+const unitToMs = {
+	ms: 1,
+	s: 1e3,
+	m: 60 * 1e3
+};
+const durationPattern = /^(\d+)(ms|s|m)$/;
+/**
+* Schema for duration string validation (e.g., "3s", "500ms", "1m")
+* Only validates format; use parseDuration() to convert to milliseconds
+*/
+const durationArg = z.string().refine((val) => durationPattern.test(val), { message: "Invalid duration format. Expected format: '3s', '500ms', '1m'" }).refine((val) => {
+	const match = val.match(durationPattern);
+	if (!match) return false;
+	const digits = match[1];
+	return digits !== void 0 && parseInt(digits, 10) > 0;
+}, { message: "Duration must be greater than 0" });
+/**
+* Parse a validated duration string into milliseconds
+* @param duration - Duration string (e.g., "3s", "500ms", "1m")
+* @returns Duration in milliseconds
+*/
+function parseDuration(duration) {
+	const match = assertDefined(duration.match(durationPattern), `invalid duration format: ${duration}`);
+	const value = parseInt(assertDefined(match[1], "duration digits group missing"), 10);
+	const unit = assertDefined(match[2], "duration unit group missing");
+	return value * unitToMs[unit];
+}
+/**
+* Schema for positive integer validation (from string input)
+* Transforms the string to a number
+*/
+const positiveIntArg = z.coerce.number().int().positive();
+/**
+* Schema for non-negative integer validation (from string input).
+* Accepts 0 (used for `--limit 0` to disable the limit).
+*/
+const nonNegativeIntArg = z.coerce.number().int().nonnegative();
+/**
+* Schema for sort order (`asc` or `desc`).
+*/
+const orderArg = z.enum(["asc", "desc"]);
+/**
+* Translate a CLI `--order` value into the proto `PageDirection` enum.
+* Returns `undefined` when the user did not specify an order so that
+* callers can omit the field and fall back to the server default.
+* @param order - Order string from CLI args (`"asc"` | `"desc"` | undefined)
+* @returns PageDirection, or undefined when `order` is undefined
+*/
+function toPageDirection(order) {
+	if (order === void 0) return void 0;
+	return order === "asc" ? PageDirection.ASC : PageDirection.DESC;
+}
+function hasMachineUserFlag(argv) {
+	return argv.slice(0, argv.indexOf("--") === -1 ? argv.length : argv.indexOf("--")).some((token) => token === "-m" || token.startsWith("-m=") || token === "--machine-user" || token.startsWith("--machine-user=") || token === "--machineUser" || token.startsWith("--machineUser=") || token === "--machineuser" || token.startsWith("--machineuser="));
+}
+/**
+* Resolve whether a parsed machine user value came from an explicit CLI option or env fallback.
+* @param machineUser - Parsed machine user value
+* @param argv - Raw CLI argv, excluding the executable and script path
+* @param options - Source resolution options
+* @returns Machine user input source, or undefined when no value was parsed
+*/
+function resolveMachineUserInputSource(machineUser, argv = process.argv.slice(2), options = {}) {
+	if (machineUser === void 0) return void 0;
+	if (options.valueIsExplicit) return "option";
+	if (hasMachineUserFlag(argv)) return "option";
+	return process.env.TAILOR_PLATFORM_MACHINE_USER_NAME === machineUser ? "env" : "option";
+}
+/**
+* Load env files from parsed arguments.
+* Processes --env-file first, then --env-file-if-exists.
+*
+* Follows Node.js --env-file behavior:
+* - Variables already set in the environment are NOT overwritten
+* - Variables from later files override those from earlier files
+* @param envFiles - Required env file path(s) that must exist
+* @param envFilesIfExists - Optional env file path(s) that are loaded if they exist
+*/
+function loadEnvFiles(envFiles, envFilesIfExists) {
+	const originalEnvKeys = new Set(Object.keys(process.env));
+	const load = (files, required) => {
+		for (const file of [files ?? []].flat()) {
+			const envPath = path.resolve(process.cwd(), file);
+			if (!fs$1.existsSync(envPath)) {
+				if (required) throw new Error(`Environment file not found: ${envPath}`);
+				continue;
+			}
+			const parsed = parseEnv(fs$1.readFileSync(envPath, "utf-8"));
+			for (const [key, value] of Object.entries(parsed)) {
+				if (originalEnvKeys.has(key)) continue;
+				process.env[key] = value;
+			}
+		}
+	};
+	load(envFiles, true);
+	load(envFilesIfExists, false);
+}
+/**
+* Common arguments for all CLI commands
+*
+* NOTE: --env-file and --env-file-if-exists collide with Node.js flags due to a bug
+* (https://github.com/nodejs/node/issues/54232). Node.js parses these even after the
+* script path, causing warnings (twice due to tsx loader).
+*/
+const commonArgs = {
+	"env-file": arg(z.string().optional(), {
+		alias: "e",
+		description: "Path to the environment file (error if not found)",
+		completion: {
+			type: "file",
+			matcher: [".env.*", ".env"]
+		}
+	}),
+	"env-file-if-exists": arg(z.string().optional(), {
+		description: "Path to the environment file (ignored if not found)",
+		completion: {
+			type: "file",
+			matcher: [".env.*", ".env"]
+		},
+		effect: (_value, { args }) => {
+			loadEnvFiles(args["env-file"], args["env-file-if-exists"]);
+		}
+	}),
+	verbose: arg(z.boolean().default(false), {
+		description: "Enable verbose logging",
+		effect: (value) => {
+			verboseMode = value;
+		}
+	}),
+	json: arg(z.boolean().default(false), {
+		alias: "j",
+		description: "Output as JSON",
+		effect: (value) => {
+			logger.jsonMode = value;
+		}
+	})
+};
+/**
+* Arguments for commands that require workspace context
+*/
+const workspaceArgs = {
+	"workspace-id": arg(z.string().optional(), {
+		alias: "w",
+		description: "Workspace ID",
+		env: "TAILOR_PLATFORM_WORKSPACE_ID",
+		completion: { type: "none" }
+	}),
+	profile: arg(z.string().optional(), {
+		alias: "p",
+		description: "Workspace profile",
+		env: "TAILOR_PLATFORM_PROFILE",
+		completion: { type: "none" }
+	})
+};
+/**
+* Shared config arg for commands that accept a config file path
+*/
+const configArg = { config: arg(z.string().default("tailor.config.ts"), {
+	alias: "c",
+	description: "Path to SDK config file",
+	env: "TAILOR_PLATFORM_SDK_CONFIG_PATH",
+	completion: {
+		type: "file",
+		extensions: ["ts"]
+	}
+}) };
+/**
+* Shared config arg for commands that accept one or more comma-separated config file paths
+*/
+const multiConfigArg = { config: arg(z.string().default("tailor.config.ts"), {
+	alias: "c",
+	description: "Path to SDK config file. Use comma-separated paths to deploy multiple apps together.",
+	env: "TAILOR_PLATFORM_SDK_CONFIG_PATH",
+	completion: {
+		type: "file",
+		extensions: ["ts"]
+	}
+}) };
+/**
+* Arguments for commands that interact with deployed resources (includes config)
+*/
+const deploymentArgs = {
+	...workspaceArgs,
+	...configArg
+};
+/**
+* Arguments for commands that require confirmation
+*/
+const confirmationArgs = { yes: arg(z.boolean().default(false), {
+	alias: "y",
+	description: "Skip confirmation prompts"
+}) };
+/**
+* Arguments for commands that require organization context
+*/
+const organizationArgs = { "organization-id": arg(z.string(), {
+	alias: "o",
+	description: "Organization ID",
+	env: "TAILOR_PLATFORM_ORGANIZATION_ID",
+	completion: { type: "none" }
+}) };
+/**
+* Arguments for list commands that accept `--order` / `--limit`. Sort
+* order defaults to `desc` (newest first) because most callers want the
+* latest items; pass `--order asc` to opt in to ascending order. The
+* limit is unbounded by default so existing invocations keep returning
+* every item; pass `--limit N` to cap the result size.
+* @param defaultOrder - Default value for `--order` (defaults to `"desc"`)
+* @returns Argument shape suitable for spreading into a command schema
+*/
+const paginationArgs = (defaultOrder = "desc") => ({
+	order: arg(orderArg.default(defaultOrder), { description: "Sort order (asc or desc)" }),
+	limit: arg(nonNegativeIntArg.optional(), {
+		alias: "l",
+		description: "Maximum number of items to return (0 or omit: unlimited)"
+	})
+});
+/**
+* Arguments for time-series log list commands. Defaults to newest-first
+* (`desc`) and a 50-item cap so that listing stays responsive on busy
+* workspaces. Pass `--limit 0` to disable the cap and fetch all entries.
+*/
+const pagedLogArgs = {
+	order: arg(orderArg.default("desc"), { description: "Sort order (asc or desc)" }),
+	limit: arg(nonNegativeIntArg.default(50), {
+		alias: "l",
+		description: "Maximum number of items to return (0: unlimited)"
+	})
+};
+/**
+* Arguments for commands that require folder context
+*/
+const folderArgs = { "folder-id": arg(z.string(), {
+	alias: "f",
+	description: "Folder ID",
+	env: "TAILOR_PLATFORM_FOLDER_ID",
+	completion: { type: "none" }
+}) };
+let verboseMode = false;
+/**
+* Returns whether verbose mode is enabled.
+* Used by the global cleanup handler which doesn't have access to parsed args.
+* @returns Whether verbose mode is enabled
+*/
+function isVerbose() {
+	return verboseMode;
+}
+
+//#endregion
 //#region src/cli/shared/command.ts
 /**
 * defineCommand with global args type (CommonArgsType).
@@ -55,6 +313,846 @@ import { parse as parse$1 } from "@0no-co/graphql.web";
 */
 const defineAppCommand = createDefineCommand();
 
+//#endregion
+//#region src/parser/app-config/schema.ts
+const envValueSchema = z.union([
+	z.string(),
+	z.number(),
+	z.boolean()
+]);
+const LogLevelSchema = z.enum(LOG_LEVELS);
+const logLevelSchema = z.string().refine((value) => LogLevelSchema.safeParse(value.trim().toUpperCase()).success, { message: `'logLevel' must be one of: ${LOG_LEVELS.join(", ")}.` });
+/**
+* Structural validation schema for `defineConfig({...})`. Validates only
+* top-level fields with platform-side constraints (notably `id`); fields
+* that carry SDK builder objects (`auth`, `idp`, `db`, ...) are accepted
+* as opaque values, since their internal shapes are validated by their
+* own factory functions and parser-level schemas.
+*
+* The `id` is auto-managed by `deploy` and stored as a plain UUID. A
+* label-compatible prefix is added at the metadata boundary, so user-facing
+* configs only need to carry a UUID.
+*/
+const AppConfigSchema = z.object({
+	id: z.uuid({ message: "'id' must be a UUID." }).optional(),
+	name: z.string().min(1, { message: "'name' must be a non-empty string." }),
+	env: z.record(z.string(), envValueSchema).optional(),
+	cors: z.array(z.string()).optional(),
+	allowedIpAddresses: z.array(z.string()).optional(),
+	disableIntrospection: z.boolean().optional(),
+	inlineSourcemap: z.boolean().optional(),
+	logLevel: logLevelSchema.optional(),
+	db: z.unknown().optional(),
+	resolver: z.unknown().optional(),
+	idp: z.unknown().optional(),
+	auth: z.unknown().optional(),
+	executor: z.unknown().optional(),
+	workflow: z.unknown().optional(),
+	httpAdapter: z.unknown().optional(),
+	staticWebsites: z.unknown().optional(),
+	aiGateways: z.unknown().optional(),
+	secrets: z.unknown().optional()
+});
+
+//#endregion
+//#region src/parser/generator-config/schema.ts
+const DependencyKindSchema = z.enum([
+	"tailordb",
+	"resolver",
+	"executor"
+]);
+const KyselyTypeConfigSchema = z.tuple([z.literal("@tailor-platform/kysely-type"), z.object({ distPath: z.string() })]);
+const SeedConfigSchema = z.tuple([z.literal("@tailor-platform/seed"), z.object({
+	distPath: z.string(),
+	machineUserName: z.string().optional(),
+	disableIdpUserSync: z.object({
+		userToIdp: z.boolean().optional(),
+		idpToUser: z.boolean().optional()
+	}).optional()
+})]);
+const EnumConstantsConfigSchema = z.tuple([z.literal("@tailor-platform/enum-constants"), z.object({ distPath: z.string() })]);
+const FileUtilsConfigSchema = z.tuple([z.literal("@tailor-platform/file-utils"), z.object({ distPath: z.string() })]);
+const CodeGeneratorSchema = z.object({
+	id: z.string(),
+	description: z.string(),
+	dependencies: z.array(DependencyKindSchema),
+	processType: z.function().optional(),
+	processResolver: z.function().optional(),
+	processExecutor: z.function().optional(),
+	processTailorDBNamespace: z.function().optional(),
+	processResolverNamespace: z.function().optional(),
+	aggregate: z.function({ output: z.any() })
+});
+const BaseGeneratorConfigSchema = z.union([
+	KyselyTypeConfigSchema,
+	SeedConfigSchema,
+	EnumConstantsConfigSchema,
+	FileUtilsConfigSchema,
+	CodeGeneratorSchema
+]);
+
+//#endregion
+//#region src/parser/plugin-config/schema.ts
+const PluginConfigSchema = z.object({
+	id: z.string(),
+	description: z.string(),
+	importPath: z.string().optional(),
+	pluginConfig: z.unknown().optional(),
+	typeConfigRequired: z.union([z.boolean(), functionSchema]).optional(),
+	onTypeLoaded: functionSchema.optional(),
+	onNamespaceLoaded: functionSchema.optional(),
+	onTailorDBReady: functionSchema.optional(),
+	onResolverReady: functionSchema.optional(),
+	onExecutorReady: functionSchema.optional()
+}).passthrough().refine((p) => {
+	return !(p.onTypeLoaded || p.onNamespaceLoaded) || !!p.importPath;
+}, { message: "importPath is required when plugin has definition-time hooks (onTypeLoaded/onNamespaceLoaded)" }).transform((plugin) => plugin);
+
+//#endregion
+//#region src/plugin/builtin/registry.ts
+const builtinPlugins = /* @__PURE__ */ new Map([
+	[KyselyGeneratorID, (options) => kyselyTypePlugin(options)],
+	[SeedGeneratorID, (options) => seedPlugin(options)],
+	[EnumConstantsGeneratorID, (options) => enumConstantsPlugin(options)],
+	[FileUtilsGeneratorID, (options) => fileUtilsPlugin(options)]
+]);
+
+//#endregion
+//#region src/cli/shared/token-store.ts
+const SERVICE_NAME = "tailor-platform-cli";
+let entryClass;
+async function getEntryClass() {
+	if (entryClass !== void 0) return entryClass;
+	try {
+		const mod = await import("@napi-rs/keyring");
+		const probe = new mod.Entry(SERVICE_NAME, "__probe__");
+		probe.setPassword("probe");
+		probe.deletePassword();
+		entryClass = mod.Entry;
+	} catch {
+		logger.warn("System keyring is not available. Tokens will be stored in the config file. Set TAILOR_PLATFORM_TOKEN environment variable for CI environments.");
+		entryClass = false;
+	}
+	return entryClass;
+}
+/**
+* Check whether the OS keyring is available and functional.
+* @returns true if keyring is available
+*/
+async function isKeyringAvailable() {
+	return await getEntryClass() !== false;
+}
+/**
+* Load tokens from the OS keyring for a given account.
+* @param account - User identifier (e.g. email or client ID)
+* @returns Token data or undefined if not found or keyring unavailable
+*/
+async function loadKeyringTokens(account) {
+	const Entry = await getEntryClass();
+	if (!Entry) return void 0;
+	try {
+		const raw = new Entry(SERVICE_NAME, account).getPassword();
+		if (raw === null) return void 0;
+		return JSON.parse(raw);
+	} catch {
+		return;
+	}
+}
+/**
+* Save tokens to the OS keyring for a given account.
+* @param account - User identifier (e.g. email or client ID)
+* @param tokens - Token data to store
+*/
+async function saveKeyringTokens(account, tokens) {
+	const Entry = await getEntryClass();
+	if (!Entry) return;
+	new Entry(SERVICE_NAME, account).setPassword(JSON.stringify(tokens));
+}
+/**
+* Delete tokens from the OS keyring for a given account.
+* @param account - User identifier (e.g. email or client ID)
+*/
+async function deleteKeyringTokens(account) {
+	const Entry = await getEntryClass();
+	if (!Entry) return;
+	try {
+		new Entry(SERVICE_NAME, account).deletePassword();
+	} catch {}
+}
+
+//#endregion
+//#region src/cli/shared/context.ts
+const pfProfileSchema = z.object({
+	user: z.string(),
+	workspace_id: z.string(),
+	readonly: z.boolean().optional(),
+	machine_user: z.string().optional(),
+	machine_user_override: z.enum(["allow", "deny"]).optional(),
+	platform_url: z.url().optional(),
+	oauth2_client_id: z.string().optional(),
+	console_url: z.url().optional()
+});
+const pfUserSchemaV1 = z.object({
+	access_token: z.string(),
+	refresh_token: z.string().optional(),
+	token_expires_at: z.string()
+});
+const pfUserKeyringSchema = z.object({
+	storage: z.literal("keyring"),
+	token_expires_at: z.string()
+});
+const pfUserFileSchema = z.object({
+	storage: z.literal("file"),
+	token_expires_at: z.string(),
+	access_token: z.string(),
+	refresh_token: z.string().optional()
+});
+const pfUserSchemaV2 = z.discriminatedUnion("storage", [pfUserKeyringSchema, pfUserFileSchema]);
+const pfConfigSchemaV1 = z.object({
+	version: z.literal(1),
+	users: z.partialRecord(z.string(), pfUserSchemaV1),
+	profiles: z.partialRecord(z.string(), pfProfileSchema),
+	current_user: z.string().nullable()
+});
+const V2_CONFIG_VERSION = 2;
+const LATEST_CONFIG_VERSION = 3;
+const V2_MIN_SDK_VERSION = "1.29.0";
+const V3_MIN_SDK_VERSION = "1.70.0";
+const semverSchema = z.templateLiteral([
+	z.number().int(),
+	".",
+	z.number().int(),
+	".",
+	z.number().int()
+]);
+const pfConfigSchema = z.object({
+	version: z.union([z.literal(V2_CONFIG_VERSION), z.literal(LATEST_CONFIG_VERSION)]),
+	min_sdk_version: semverSchema,
+	latest_version: z.number().int().optional(),
+	latest_min_sdk_version: semverSchema.optional(),
+	users: z.partialRecord(z.string(), pfUserSchemaV2),
+	profiles: z.partialRecord(z.string(), pfProfileSchema),
+	current_user: z.string().nullable()
+});
+function platformConfigPath() {
+	if (!xdgConfig) throw new Error("User home directory not found");
+	return path.join(xdgConfig, "tailor-platform", "config.yaml");
+}
+/**
+* Convert stored profile platform fields to platform client settings.
+* @param profile - Profile platform settings
+* @returns Platform client settings
+*/
+function platformConfigFromProfile(profile) {
+	const config = {
+		...profile?.platform_url ? { platformUrl: profile.platform_url } : {},
+		...profile?.oauth2_client_id ? { oauth2ClientId: profile.oauth2_client_id } : {},
+		...profile?.console_url ? { consoleUrl: profile.console_url } : {}
+	};
+	return Object.keys(config).length > 0 ? config : void 0;
+}
+function platformUserKey(user, config) {
+	const platformUrl = getPlatformBaseUrl(config);
+	if (platformUrl === normalizeBaseUrl("https://api.tailor.tech")) return user;
+	return `${platformUrl}|${user}`;
+}
+function canUseLegacyUserKey(platformUrl) {
+	try {
+		return getPlatformBaseUrl() === platformUrl;
+	} catch {
+		return false;
+	}
+}
+function findUserEntry(config, user, platformConfig, opts = {}) {
+	const userKey = platformUserKey(user, platformConfig);
+	const userEntry = config.users[userKey];
+	if (userEntry) return {
+		userKey,
+		userEntry
+	};
+	const platformUrl = getPlatformBaseUrl(platformConfig);
+	if (userKey !== user && (opts.allowLegacyUserKey === false || !canUseLegacyUserKey(platformUrl))) return {
+		userKey,
+		userEntry
+	};
+	const legacyEntry = config.users[user];
+	return legacyEntry ? {
+		userKey: user,
+		userEntry: legacyEntry
+	} : {
+		userKey,
+		userEntry
+	};
+}
+/**
+* Resolve the config user key that would be used for a user on the selected platform.
+* @param config - Platform config
+* @param user - User name
+* @param platformConfig - Optional platform connection settings
+* @param opts - Token lookup options
+* @returns Resolved config user key
+*/
+function resolveUserTokenKey(config, user, platformConfig, opts) {
+	return findUserEntry(config, user, platformConfig, opts).userKey;
+}
+/**
+* Check whether tokens are registered for a user on the selected platform.
+* @param config - Platform config
+* @param user - User name
+* @param platformConfig - Optional platform connection settings
+* @param opts - Token lookup options
+* @returns True when the user has a registered token entry
+*/
+function hasUserTokenEntry(config, user, platformConfig, opts) {
+	return findUserEntry(config, user, platformConfig, opts).userEntry !== void 0;
+}
+function hasUserKeyForName(users, user) {
+	return users[user] !== void 0 || Object.keys(users).some((key) => key.endsWith(`|${user}`));
+}
+/**
+* Check whether any platform has tokens registered for a user.
+* @param config - Platform config
+* @param user - User name
+* @returns True when the user has a token entry for any platform
+*/
+function hasAnyUserTokenEntry(config, user) {
+	return hasUserKeyForName(config.users, user);
+}
+function hasCurrentUserEntry(users, currentUser) {
+	return hasUserKeyForName(users, currentUser);
+}
+/**
+* Migrate a v1 config to v2.
+* Tokens are kept in the config file (storage: "file") during migration.
+* They will be moved to the OS keyring on next login or token refresh.
+* @param v1Config - v1 configuration to migrate
+* @returns Migrated v2 configuration
+*/
+function migrateV1ToV2(v1Config) {
+	const users = {};
+	for (const [name, v1User] of Object.entries(v1Config.users)) {
+		if (!v1User) continue;
+		users[name] = {
+			access_token: v1User.access_token,
+			refresh_token: v1User.refresh_token,
+			token_expires_at: v1User.token_expires_at,
+			storage: "file"
+		};
+	}
+	return {
+		version: V2_CONFIG_VERSION,
+		min_sdk_version: V2_MIN_SDK_VERSION,
+		users,
+		profiles: v1Config.profiles,
+		current_user: v1Config.current_user
+	};
+}
+async function warnIfNewerConfigAvailable(config) {
+	if (!config.latest_min_sdk_version) return;
+	if (lt((await readPackageJson()).version ?? "0.0.0", config.latest_min_sdk_version)) logger.warn(multiline`
+      A newer config version (${String(config.latest_version)}) is available.
+      Please update your SDK to >= ${config.latest_min_sdk_version}: pnpm update @tailor-platform/sdk
+    `);
+}
+/**
+* Read Tailor Platform CLI configuration, migrating from tailorctl or v1 if necessary.
+* @returns Parsed platform configuration
+*/
+async function readPlatformConfig() {
+	const configPath = platformConfigPath();
+	if (!fs$1.existsSync(configPath)) {
+		logger.warn(`Config not found at ${configPath}, migrating from tailorctl config...`);
+		const tcConfig = readTailorctlConfig();
+		const v1Config = tcConfig ? fromTailorctlConfig(tcConfig) : {
+			version: 1,
+			users: {},
+			profiles: {},
+			current_user: null
+		};
+		writePlatformConfig(v1Config);
+		return migrateV1ToV2(v1Config);
+	}
+	const rawConfig = parseYAML(fs$1.readFileSync(configPath, "utf-8"));
+	tightenSecretFilePermissions(configPath);
+	const version = rawConfig != null && typeof rawConfig === "object" && "version" in rawConfig ? rawConfig.version : void 0;
+	if (typeof version === "number" && version > LATEST_CONFIG_VERSION) {
+		const minSdk = "min_sdk_version" in rawConfig ? String(rawConfig.min_sdk_version) : void 0;
+		const updateHint = minSdk ? `Please update your SDK to >= ${minSdk}: pnpm update @tailor-platform/sdk` : "Please update your SDK: pnpm update @tailor-platform/sdk";
+		throw new Error(multiline`
+      Config file uses version ${String(version)}, but this SDK only supports up to version ${String(LATEST_CONFIG_VERSION)}.
+      ${updateHint}
+    `);
+	}
+	const configResult = pfConfigSchema.safeParse(rawConfig);
+	if (configResult.success) {
+		await warnIfNewerConfigAvailable(configResult.data);
+		return configResult.data;
+	}
+	const v1Result = pfConfigSchemaV1.safeParse(rawConfig);
+	if (v1Result.success) return migrateV1ToV2(v1Result.data);
+	throw new Error(multiline`
+    Failed to parse config file at ${configPath}.
+    The file may be corrupted or created by an incompatible SDK version.
+  `);
+}
+function toV1ForDisk(config) {
+	const users = {};
+	for (const [name, entry] of Object.entries(config.users)) {
+		if (!entry || entry.storage === "keyring") continue;
+		users[name] = {
+			access_token: entry.access_token,
+			refresh_token: entry.refresh_token,
+			token_expires_at: entry.token_expires_at
+		};
+	}
+	const currentUser = config.current_user && hasCurrentUserEntry(users, config.current_user) ? config.current_user : null;
+	return {
+		version: 1,
+		users,
+		profiles: config.profiles,
+		current_user: currentUser
+	};
+}
+function hasProfilePlatformSettings(config) {
+	return Object.values(config.profiles).some((profile) => profile?.platform_url !== void 0 || profile?.oauth2_client_id !== void 0 || profile?.console_url !== void 0);
+}
+function hasScopedUserKeys(config) {
+	return Object.keys(config.users).some((userKey) => userKey.includes("|"));
+}
+function toLatestForDisk(config) {
+	return {
+		...config.version === 1 ? migrateV1ToV2(config) : config,
+		version: LATEST_CONFIG_VERSION,
+		min_sdk_version: V3_MIN_SDK_VERSION
+	};
+}
+/**
+* Write Tailor Platform CLI configuration to disk.
+* By default, file-backed configs without newer fields are converted to V1 for
+* backward compatibility, so an older SDK can still read the file. Configs
+* containing a keyring user are kept in V2 or later because the keyring storage
+* variant is not representable in V1. Configs containing profile-level Platform
+* settings or platform-scoped user tokens are written in the latest
+* min-SDK-gated format because older SDKs would silently drop or misread those
+* settings.
+* Set TAILOR_USE_KEYRING to write the current in-memory format unconditionally.
+*
+* The config file may contain access/refresh tokens when the OS keyring is
+* unavailable, so it is written via {@link writeSecretFile} so other users
+* on the host cannot read it.
+* @param config - Platform configuration to write
+*/
+function writePlatformConfig(config) {
+	const configPath = platformConfigPath();
+	const hasKeyringUser = config.version !== 1 && Object.values(config.users).some((u) => u?.storage === "keyring");
+	writeSecretFile(configPath, stringifyYAML(hasProfilePlatformSettings(config) || hasScopedUserKeys(config) ? toLatestForDisk(config) : config.version !== 1 && !process.env.TAILOR_USE_KEYRING && !hasKeyringUser ? toV1ForDisk(config) : config));
+}
+const tcContextConfigSchema = z.object({
+	username: z.string().optional(),
+	controlplaneaccesstoken: z.string().optional(),
+	controlplanerefreshtoken: z.string().optional(),
+	controlplanetokenexpiresat: z.string().optional(),
+	workspaceid: z.string().optional()
+});
+const tcConfigSchema = z.object({ global: z.object({ context: z.string().optional() }).optional() }).catchall(tcContextConfigSchema.optional());
+function readTailorctlConfig() {
+	const configPath = path.join(os.homedir(), ".tailorctl", "config");
+	if (!fs$1.existsSync(configPath)) return;
+	const rawConfig = parseTOML(fs$1.readFileSync(configPath, "utf-8"));
+	return tcConfigSchema.parse(rawConfig);
+}
+function fromTailorctlConfig(config) {
+	const users = {};
+	const profiles = {};
+	let currentUser = null;
+	const currentContext = config.global?.context || "default";
+	for (const [key, val] of Object.entries(config)) {
+		if (key === "global") continue;
+		const context = val;
+		if (!context.username || !context.controlplaneaccesstoken || !context.controlplanerefreshtoken || !context.controlplanetokenexpiresat || !context.workspaceid) continue;
+		if (key === currentContext) currentUser = context.username;
+		profiles[key] = {
+			user: context.username,
+			workspace_id: context.workspaceid
+		};
+		const user = users[context.username];
+		if (!user || new Date(user.token_expires_at) < new Date(context.controlplanetokenexpiresat)) users[context.username] = {
+			access_token: context.controlplaneaccesstoken,
+			refresh_token: context.controlplanerefreshtoken,
+			token_expires_at: context.controlplanetokenexpiresat
+		};
+	}
+	return {
+		version: 1,
+		users,
+		profiles,
+		current_user: currentUser
+	};
+}
+function validateUUID(value, source) {
+	const result = z.uuid().safeParse(value);
+	if (!result.success) throw new Error(`Invalid value from ${source}: must be a valid UUID`);
+	return result.data;
+}
+/**
+* Load workspace ID from command options, environment variables, or platform config.
+* In CLI context, env fallback is also handled by politty's arg env option.
+* Priority: opts/workspaceId > env/workspaceId > opts/profile > error
+* @param opts - Workspace and profile options
+* @returns Resolved workspace ID
+*/
+async function loadWorkspaceId(opts) {
+	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
+	if (opts?.workspaceId) return validateUUID(opts.workspaceId, "--workspace-id option");
+	if (process.env.TAILOR_PLATFORM_WORKSPACE_ID) return validateUUID(process.env.TAILOR_PLATFORM_WORKSPACE_ID, "TAILOR_PLATFORM_WORKSPACE_ID environment variable");
+	if (profile) {
+		const wsId = (await readPlatformConfig()).profiles[profile]?.workspace_id;
+		if (!wsId) throw new Error(`Profile "${profile}" not found`);
+		return validateUUID(wsId, `profile "${profile}"`);
+	}
+	throw new Error(multiline`
+    Workspace ID not found.
+    Please specify workspace ID via --workspace-id option or TAILOR_PLATFORM_WORKSPACE_ID environment variable.
+  `);
+}
+/**
+* Load machine user name from command options, environment variables, or platform config.
+* In CLI context, env fallback is also handled by politty's arg env option.
+* Priority: opts/machineUser > env/TAILOR_PLATFORM_MACHINE_USER_NAME > opts/profile (profile default) > undefined.
+* An explicitly empty `opts.machineUser` is rejected with a CLIError (`MACHINE_USER_NAME_EMPTY`) rather than falling back to the env var or profile default.
+* When the active profile has `machine_user_override: "deny"`, an explicit value that differs from the profile's machine user throws a CLIError with code `PROFILE_MACHINE_USER_OVERRIDE_DENIED`.
+* @param opts - Machine user and profile options
+* @returns Resolved machine user name, or undefined if not set
+*/
+async function loadMachineUserName(opts) {
+	if (opts?.machineUser === "") throw createCLIError({
+		code: "MACHINE_USER_NAME_EMPTY",
+		message: "Machine user name cannot be empty.",
+		suggestion: "Pass a non-empty machine user name, or omit the option to use the environment variable or profile default."
+	});
+	const envMachineUser = process.env.TAILOR_PLATFORM_MACHINE_USER_NAME || void 0;
+	const explicitMachineUser = opts?.machineUser ? {
+		source: opts.machineUserSource ?? "option",
+		value: opts.machineUser
+	} : envMachineUser ? {
+		source: "env",
+		value: envMachineUser
+	} : void 0;
+	const explicit = explicitMachineUser?.value;
+	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
+	if (!profile) return explicit;
+	const entry = (await readPlatformConfig()).profiles[profile];
+	if (!entry) {
+		if (explicit) return explicit;
+		throw new Error(`Profile "${profile}" not found`);
+	}
+	if (entry.machine_user && entry.machine_user_override === "deny") {
+		if (explicit && explicit !== entry.machine_user) {
+			const details = explicitMachineUser.source === "env" ? `The machine user is being set to "${explicit}" via the TAILOR_PLATFORM_MACHINE_USER_NAME environment variable, which conflicts with this profile's pinned machine user "${entry.machine_user}".` : `This profile fixes the machine user to "${entry.machine_user}" for application-data commands.`;
+			throw createCLIError({
+				code: "PROFILE_MACHINE_USER_OVERRIDE_DENIED",
+				message: `Profile "${profile}" denies overriding the machine user.`,
+				details,
+				suggestion: `Omit the machine user option, unset TAILOR_PLATFORM_MACHINE_USER_NAME, or run 'tailor-sdk profile update ${profile} --machine-user-override allow'.`
+			});
+		}
+		return entry.machine_user;
+	}
+	return explicit || entry.machine_user;
+}
+/**
+* Load access token from environment variables, command options, or platform config.
+* In CLI context, profile env fallback is also handled by politty's arg env option.
+* Priority: env/TAILOR_PLATFORM_TOKEN > env/TAILOR_TOKEN (deprecated) > opts/profile > env/profile > config/currentUser > error
+* @param opts - Profile options
+* @returns Resolved access token
+*/
+async function loadAccessToken(opts) {
+	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
+	const envToken = process.env.TAILOR_PLATFORM_TOKEN ?? process.env.TAILOR_TOKEN;
+	if (envToken && !process.env.TAILOR_PLATFORM_TOKEN) logger.warn("TAILOR_TOKEN is deprecated. Please use TAILOR_PLATFORM_TOKEN instead.");
+	if (envToken) {
+		rememberPlatformConfigForToken(envToken, await loadPlatformClientConfig({
+			profile,
+			allowMissingProfile: true
+		}));
+		return envToken;
+	}
+	const pfConfig = await readPlatformConfig();
+	const profileEntry = profile ? pfConfig.profiles[profile] : void 0;
+	if (profile && !profileEntry) throw new Error(`Profile "${profile}" not found`);
+	const user = profileEntry?.user ?? pfConfig.current_user;
+	if (!user) throw new Error(multiline`
+      Tailor Platform token not found.
+      Please specify token via TAILOR_PLATFORM_TOKEN environment variable or login using 'tailor-sdk login' command.
+    `);
+	return await fetchLatestToken(pfConfig, user, profileEntry ? platformConfigFromProfile(profileEntry) : void 0);
+}
+/**
+* Load platform connection settings from the active profile.
+* @param opts - Profile options
+* @returns Resolved platform connection settings, or undefined for the default environment
+*/
+async function loadPlatformClientConfig(opts) {
+	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
+	if (!profile) return;
+	let pfConfig;
+	try {
+		pfConfig = await readPlatformConfig();
+	} catch (error) {
+		if (opts?.allowMissingProfile) return;
+		throw error;
+	}
+	const profileEntry = pfConfig.profiles[profile];
+	if (!profileEntry) {
+		if (opts?.allowMissingProfile) return;
+		throw new Error(`Profile "${profile}" not found`);
+	}
+	return platformConfigFromProfile(profileEntry);
+}
+/**
+* Load the Tailor Platform Console base URL from environment variables or the active profile.
+* @param opts - Profile options
+* @returns Resolved Console base URL
+*/
+async function loadConsoleBaseUrl(opts) {
+	return getConsoleBaseUrl(await loadPlatformClientConfig(opts));
+}
+/**
+* Resolve the actual token values for a user, reading from keyring or config as appropriate.
+* @param userEntry - User entry from the config
+* @param user - User identifier
+* @param label - User-facing identifier used in error messages
+* @returns Access token and optional refresh token
+*/
+async function resolveTokens(userEntry, user, label = user) {
+	if (userEntry.storage === "keyring") {
+		const tokens = await loadKeyringTokens(user);
+		if (!tokens) throw new Error(multiline`
+        Credentials not found in OS keyring for "${label}".
+        Please run 'tailor-sdk login' and try again.
+      `);
+		return tokens;
+	}
+	return {
+		accessToken: userEntry.access_token,
+		refreshToken: userEntry.refresh_token
+	};
+}
+/**
+* Save tokens for a user, writing to keyring or config as appropriate.
+* @param config - Platform config
+* @param user - User identifier
+* @param tokens - Token data to save
+* @param tokens.accessToken - Access token to persist
+* @param tokens.refreshToken - Refresh token to persist when available
+* @param expiresAt - Token expiration date
+* @param platformConfig - Optional platform connection settings
+*/
+async function saveUserTokens(config, user, tokens, expiresAt, platformConfig) {
+	const userKey = platformUserKey(user, platformConfig);
+	if (process.env.TAILOR_USE_KEYRING && await isKeyringAvailable()) {
+		await saveKeyringTokens(userKey, tokens);
+		config.users[userKey] = {
+			token_expires_at: expiresAt,
+			storage: "keyring"
+		};
+	} else config.users[userKey] = {
+		access_token: tokens.accessToken,
+		refresh_token: tokens.refreshToken,
+		token_expires_at: expiresAt,
+		storage: "file"
+	};
+}
+/**
+* Delete tokens for a user from keyring if applicable.
+* @param config - Platform config
+* @param user - User identifier
+* @param platformConfig - Optional platform connection settings
+* @param opts - Token lookup options
+*/
+async function deleteUserTokens(config, user, platformConfig, opts) {
+	const { userKey, userEntry } = findUserEntry(config, user, platformConfig, opts);
+	if (userEntry?.storage === "keyring") await deleteKeyringTokens(userKey);
+	delete config.users[userKey];
+}
+/**
+* Resolve stored tokens for a user on the selected platform.
+* @param config - Platform config
+* @param user - User name
+* @param platformConfig - Optional platform connection settings
+* @param opts - Token lookup options
+* @returns Stored user entry and token values, or undefined when the user is not logged in
+*/
+async function loadStoredUserTokens(config, user, platformConfig, opts) {
+	const { userKey, userEntry } = findUserEntry(config, user, platformConfig, opts);
+	if (!userEntry) return void 0;
+	return {
+		userEntry,
+		...await resolveTokens(userEntry, userKey, user)
+	};
+}
+/**
+* Fetch the latest access token, refreshing if necessary.
+* @param config - Platform config
+* @param user - User name
+* @param platformConfig - Optional platform connection settings
+* @returns Latest access token
+*/
+async function fetchLatestToken(config, user, platformConfig) {
+	const { userKey, userEntry } = findUserEntry(config, user, platformConfig);
+	if (!userEntry) throw new Error(multiline`
+      User "${user}" not found.
+      Please verify your user name and login using 'tailor-sdk login' command.
+    `);
+	const tokens = await resolveTokens(userEntry, userKey, user);
+	if (new Date(userEntry.token_expires_at) > /* @__PURE__ */ new Date()) {
+		rememberPlatformConfigForToken(tokens.accessToken, platformConfig);
+		return tokens.accessToken;
+	}
+	if (!tokens.refreshToken) throw new Error(multiline`
+      Token expired.
+      Please run 'tailor-sdk login' and try again.
+    `);
+	const client = initOAuth2Client(platformConfig);
+	let resp;
+	try {
+		resp = await client.refreshToken({
+			accessToken: tokens.accessToken,
+			refreshToken: tokens.refreshToken,
+			expiresAt: Date.parse(userEntry.token_expires_at)
+		});
+	} catch {
+		throw new Error(multiline`
+      Failed to refresh token. Your session may have expired.
+      Please run 'tailor-sdk login' and try again.
+    `);
+	}
+	const newExpiresAt = new Date(assertDefined(resp.expiresAt, "token refresh response missing expiresAt")).toISOString();
+	await saveUserTokens(config, user, {
+		accessToken: resp.accessToken,
+		refreshToken: resp.refreshToken ?? void 0
+	}, newExpiresAt, platformConfig);
+	if (userKey !== platformUserKey(user, platformConfig)) {
+		if (userEntry.storage === "keyring") await deleteKeyringTokens(userKey);
+		delete config.users[userKey];
+	}
+	writePlatformConfig(config);
+	rememberPlatformConfigForToken(resp.accessToken, platformConfig);
+	return resp.accessToken;
+}
+const DEFAULT_CONFIG_FILENAME = "tailor.config.ts";
+/**
+* Load config path from command options, environment variables, or search parent directories.
+* In CLI context, env fallback is also handled by politty's arg env option.
+* Priority: opts/config > env/config > search parent directories
+* @param configPath - Optional explicit config path
+* @returns Resolved config path or undefined
+*/
+function loadConfigPath(configPath) {
+	if (configPath) return configPath;
+	if (process.env.TAILOR_PLATFORM_SDK_CONFIG_PATH) return process.env.TAILOR_PLATFORM_SDK_CONFIG_PATH;
+	return findUpSync(DEFAULT_CONFIG_FILENAME);
+}
+
+//#endregion
+//#region src/cli/shared/mock.ts
+/**
+* Install a stub `globalThis.tailordb` so that user code loaded by the CLI
+* (e.g. via `createGetDB` in `@tailor-platform/sdk/kysely`) can reference
+* `tailordb.Client` without hitting a `ReferenceError`. The CLI never
+* actually executes the user code paths that issue queries, so a no-op
+* client suffices.
+*
+* Exposed as a function (rather than a top-level statement) so that
+* `package.json#sideEffects` can keep the file marked side-effect-free
+* without bundlers eliminating the install step.
+*/
+function installCliTailordbStub() {
+	globalThis.tailordb = { Client: class {
+		constructor(_config) {}
+		async connect() {}
+		async end() {}
+		async queryObject() {
+			return {};
+		}
+	} };
+}
+
+//#endregion
+//#region src/cli/shared/config-loader.ts
+const GeneratorConfigSchema = CodeGeneratorSchema.brand("CodeGenerator");
+/**
+* Load Tailor configuration file and associated generators and plugins.
+* @param configPath - Optional explicit config path
+* @param options - Optional module import behavior.
+* @returns Loaded config, generators, plugins, and config path
+*/
+async function loadConfig(configPath, options = {}) {
+	installCliTailordbStub();
+	const foundPath = loadConfigPath(configPath);
+	if (!foundPath) throw new Error("Configuration file not found: tailor.config.ts not found in current or parent directories");
+	const resolvedPath = path.resolve(process.cwd(), foundPath);
+	if (!fs$1.existsSync(resolvedPath)) throw new Error(`Configuration file not found: ${configPath}`);
+	const configUrl = pathToFileURL(resolvedPath);
+	if (options.importNonce) configUrl.searchParams.set("tailorImportNonce", options.importNonce);
+	const configModule = await import(configUrl.href);
+	if (!configModule || !configModule.default) throw new Error("Invalid Tailor config module: default export not found");
+	const validated = AppConfigSchema.safeParse(configModule.default);
+	if (!validated.success) {
+		const issues = validated.error.issues.map((i) => `  - ${i.path.join(".") || "(root)"}: ${i.message}`).join("\n");
+		throw new Error(`Invalid Tailor config in ${resolvedPath}:\n${issues}`);
+	}
+	const allGenerators = [];
+	const allPlugins = [];
+	for (const value of Object.values(configModule)) if (Array.isArray(value)) {
+		const generatorParsed = value.reduce((acc, item) => {
+			if (!acc.success) return acc;
+			const baseResult = BaseGeneratorConfigSchema.safeParse(item);
+			if (baseResult.success && Array.isArray(baseResult.data)) {
+				const [id, options] = baseResult.data;
+				const pluginFactory = builtinPlugins.get(id);
+				if (pluginFactory) {
+					acc.convertedPlugins.push(pluginFactory(options));
+					return acc;
+				}
+			}
+			const result = GeneratorConfigSchema.safeParse(item);
+			if (result.success) acc.items.push(result.data);
+			else acc.success = false;
+			return acc;
+		}, {
+			success: true,
+			items: [],
+			convertedPlugins: []
+		});
+		if (generatorParsed.success && (generatorParsed.items.length > 0 || generatorParsed.convertedPlugins.length > 0)) {
+			allGenerators.push(...generatorParsed.items);
+			allPlugins.push(...generatorParsed.convertedPlugins);
+			continue;
+		}
+		const pluginParsed = value.reduce((acc, item) => {
+			if (!acc.success) return acc;
+			const result = PluginConfigSchema.safeParse(item);
+			if (result.success) acc.items.push(result.data);
+			else acc.success = false;
+			return acc;
+		}, {
+			success: true,
+			items: []
+		});
+		if (pluginParsed.success && pluginParsed.items.length > 0) allPlugins.push(...pluginParsed.items);
+	}
+	return {
+		config: {
+			...configModule.default,
+			path: resolvedPath
+		},
+		generators: allGenerators,
+		plugins: allPlugins
+	};
+}
+
 //#endregion
 //#region src/cli/shared/readonly-guard.ts
 /**
@@ -128,561 +1226,6 @@ async function apiCall(options) {
 	};
 }
 
-//#endregion
-//#region src/cli/commands/api/proto-reflect.ts
-const UNARY_METHODS = OperatorService.methods.filter((m) => m.methodKind === "unary");
-function listMethodNames() {
-	return UNARY_METHODS.map((m) => m.name).toSorted();
-}
-/**
-* Returns every accepted form of the `endpoint` positional — bare method name
-* and fully-qualified `service/Method`. politty's expand completion keys its
-* static table by the literal endpoint string, so both forms must appear in
-* `choices` or the user typing the fully-qualified name gets no `--field`
-* completion candidates back at TAB time.
-* @returns Sorted list of accepted endpoint values
-*/
-function listMethodChoices() {
-	return UNARY_METHODS.flatMap((m) => [m.name, `${OperatorService.typeName}/${m.name}`]).toSorted();
-}
-function getMethodDescriptor(methodName) {
-	return UNARY_METHODS.find((m) => m.name === methodName);
-}
-function extractMethodName(endpoint) {
-	if (!endpoint.includes("/")) return endpoint;
-	return endpoint.split("/").pop() ?? endpoint;
-}
-/**
-* Returns the nested message descriptor when the field is a message, a list of
-* messages, or a map with message values. Otherwise returns undefined.
-* @param field - The proto field descriptor to inspect
-* @returns The nested message descriptor, or undefined when the field isn't message-shaped
-*/
-function nestedMessage(field) {
-	if (field.fieldKind === "message") return field.message;
-	if (field.fieldKind === "list" && field.listKind === "message") return field.message;
-	if (field.fieldKind === "map" && field.mapKind === "message") return field.message;
-}
-/**
-* Most `google.protobuf.*` well-known types serialize as scalars in proto JSON
-* (Timestamp/Duration → RFC3339/duration string, FieldMask → comma-joined
-* string, *Value wrappers → underlying primitive, etc.), so we must not let
-* `--field` drill into their internal fields. Treating them as leaves keeps
-* the completion and the body shape consistent with what the server expects.
-* @param message - The proto message descriptor to inspect
-* @returns True when the message is a well-known type
-*/
-function isWellKnownType(message) {
-	return message.typeName.startsWith("google.protobuf.");
-}
-const UNREPRESENTABLE_WELL_KNOWN_TYPES = /* @__PURE__ */ new Set([
-	"google.protobuf.Struct",
-	"google.protobuf.Value",
-	"google.protobuf.ListValue",
-	"google.protobuf.NullValue",
-	"google.protobuf.Any",
-	"google.protobuf.Empty"
-]);
-/**
-* @param message - The proto message descriptor to inspect
-* @returns True when the message is a well-known type that `--field` cannot represent
-*/
-function isUnrepresentableWellKnownType(message) {
-	return UNREPRESENTABLE_WELL_KNOWN_TYPES.has(message.typeName);
-}
-/**
-* Pre-enumerates every `--field` completion candidate for `methodName`,
-* walking the input message tree to produce a flat list that the shell can
-* prefix-filter at TAB time. Used by the `expand` completion variant so no
-* Node process is spawned per keystroke.
-*
-* For each leaf field, emits `key=` (key completion). Enum leaves additionally
-* emit `key=ENUM_VALUE` per value, bool leaves emit `key=true` and
-* `key=false`. For nested messages, emits `key.` (drill-down) and recurses.
-*
-* Returns an empty array when `methodName` is unknown so the `expand`
-* generator stays exception-free at script-generation time.
-* @param methodName - Name of the unary RPC whose input message is being walked
-* @returns Flat list of `{ value, description }` candidates
-*/
-function enumerateAllFieldCompletions(methodName) {
-	const method = getMethodDescriptor(methodName);
-	if (!method) return [];
-	const candidates = [];
-	const visited = /* @__PURE__ */ new Set();
-	function walk(message, prefix) {
-		visited.add(message);
-		for (const field of message.fields) {
-			if (field.fieldKind === "list" || field.fieldKind === "map") continue;
-			const fullKey = prefix + field.localName;
-			if (field.fieldKind === "message") {
-				if (isUnrepresentableWellKnownType(field.message)) continue;
-				if (!isWellKnownType(field.message)) {
-					const nested = field.message;
-					candidates.push({
-						value: `${fullKey}.`,
-						description: `${fullKey} (message)`
-					});
-					if (!visited.has(nested)) walk(nested, `${fullKey}.`);
-					continue;
-				}
-			}
-			candidates.push({
-				value: `${fullKey}=`,
-				description: `Set ${fullKey}`
-			});
-			if (field.fieldKind === "enum") for (const v of field.enum.values) candidates.push({
-				value: `${fullKey}=${v.name}`,
-				description: v.name
-			});
-			else if (field.fieldKind === "scalar" && field.scalar === ScalarType.BOOL) {
-				candidates.push({
-					value: `${fullKey}=true`,
-					description: "true"
-				});
-				candidates.push({
-					value: `${fullKey}=false`,
-					description: "false"
-				});
-			}
-		}
-		visited.delete(message);
-	}
-	walk(method.input, "");
-	return candidates;
-}
-/**
-* Resolves the leaf `DescField` at a dotted `--field` path within an input
-* message tree. Returns undefined when any segment is missing or when a
-* non-leaf segment isn't a singular message — callers fall back to treating
-* the value as a string in that case.
-* @param input - The RPC input message descriptor
-* @param path - Dot-split path segments to follow (e.g. ["application", "name"])
-* @returns The leaf field descriptor, or undefined when the path doesn't resolve
-*/
-function resolveLeafField(input, path) {
-	let message = input;
-	for (let i = 0; i < path.length; i++) {
-		const field = message.fields.find((f) => f.localName === path[i]);
-		if (!field) return void 0;
-		if (i === path.length - 1) {
-			if (field.fieldKind === "message" && isUnrepresentableWellKnownType(field.message)) return;
-			return field;
-		}
-		if (field.fieldKind !== "message") return void 0;
-		if (isWellKnownType(field.message)) return void 0;
-		message = field.message;
-	}
-}
-
-//#endregion
-//#region src/cli/commands/api/render.ts
-const SCALAR_LABEL = {
-	[ScalarType.DOUBLE]: "double",
-	[ScalarType.FLOAT]: "float",
-	[ScalarType.INT64]: "int64",
-	[ScalarType.UINT64]: "uint64",
-	[ScalarType.INT32]: "int32",
-	[ScalarType.FIXED64]: "fixed64",
-	[ScalarType.FIXED32]: "fixed32",
-	[ScalarType.BOOL]: "bool",
-	[ScalarType.STRING]: "string",
-	[ScalarType.BYTES]: "bytes",
-	[ScalarType.UINT32]: "uint32",
-	[ScalarType.SFIXED32]: "sfixed32",
-	[ScalarType.SFIXED64]: "sfixed64",
-	[ScalarType.SINT32]: "sint32",
-	[ScalarType.SINT64]: "sint64"
-};
-function shortName(typeName) {
-	const dot = typeName.lastIndexOf(".");
-	return dot < 0 ? typeName : typeName.slice(dot + 1);
-}
-function scalarLabel(scalar) {
-	return SCALAR_LABEL[scalar] ?? `scalar(${scalar})`;
-}
-function enumLabel(enumDesc) {
-	return `enum ${shortName(enumDesc.typeName)}`;
-}
-function enumOf(field) {
-	if (field.fieldKind === "enum") return field.enum;
-	if (field.fieldKind === "list" && field.listKind === "enum") return field.enum;
-}
-function describeFieldType(field) {
-	switch (field.fieldKind) {
-		case "scalar": return scalarLabel(field.scalar);
-		case "enum": return enumLabel(field.enum);
-		case "message": return shortName(field.message.typeName);
-		case "list": {
-			let inner;
-			if (field.listKind === "scalar") inner = scalarLabel(field.scalar);
-			else if (field.listKind === "enum") inner = enumLabel(field.enum);
-			else inner = shortName(field.message.typeName);
-			return `repeated ${inner}`;
-		}
-		case "map": {
-			const keyType = scalarLabel(field.mapKey);
-			let valType;
-			if (field.mapKind === "scalar") valType = scalarLabel(field.scalar);
-			else if (field.mapKind === "enum") valType = enumLabel(field.enum);
-			else valType = shortName(field.message.typeName);
-			return `map<${keyType}, ${valType}>`;
-		}
-		default: return "<unknown>";
-	}
-}
-function fieldToJson(field, visited) {
-	const json = {
-		name: field.localName,
-		protoName: field.name,
-		type: describeFieldType(field),
-		fieldKind: field.fieldKind,
-		repeated: field.fieldKind === "list"
-	};
-	if (field.oneof) json.oneof = field.oneof.name;
-	const fieldEnum = enumOf(field);
-	if (fieldEnum) json.enumValues = fieldEnum.values.map((v) => v.name);
-	const nested = nestedMessage(field);
-	if (nested && !visited.has(nested)) {
-		visited.add(nested);
-		json.message = {
-			typeName: nested.typeName,
-			fields: nested.fields.map((f) => fieldToJson(f, visited))
-		};
-		visited.delete(nested);
-	} else if (nested) json.message = {
-		typeName: nested.typeName,
-		fields: [],
-		recursive: true
-	};
-	return json;
-}
-function renderInspectJson(method) {
-	const visited = /* @__PURE__ */ new Set([method.input]);
-	return {
-		method: method.name,
-		input: {
-			typeName: method.input.typeName,
-			fields: method.input.fields.map((f) => fieldToJson(f, visited))
-		},
-		output: { typeName: method.output.typeName }
-	};
-}
-function renderFieldText(field, indent, visited) {
-	const lines = [];
-	const oneofTag = field.oneof ? ` (oneof ${field.oneof.name})` : "";
-	lines.push(`${indent}${field.localName}: ${describeFieldType(field)}${oneofTag}`);
-	const fieldEnum = enumOf(field);
-	if (fieldEnum) {
-		const values = fieldEnum.values.map((v) => v.name).join(", ");
-		lines.push(`${indent}  values: ${values}`);
-	}
-	const nested = nestedMessage(field);
-	if (nested && !visited.has(nested)) {
-		visited.add(nested);
-		for (const sub of nested.fields) lines.push(...renderFieldText(sub, `${indent}  `, visited));
-		visited.delete(nested);
-	} else if (nested) lines.push(`${indent}  …(recursive ${nested.typeName})`);
-	return lines;
-}
-function renderInspectText(method) {
-	const lines = [];
-	lines.push(`${method.name}`);
-	lines.push(`  request: ${method.input.typeName}`);
-	const visited = /* @__PURE__ */ new Set([method.input]);
-	for (const f of method.input.fields) lines.push(...renderFieldText(f, "    ", visited));
-	lines.push(`  response: ${method.output.typeName}`);
-	return lines.join("\n");
-}
-
-//#endregion
-//#region src/cli/commands/api/inspect.ts
-const inspectCommand = defineAppCommand({
-	name: "inspect",
-	description: "Print the input message tree of an OperatorService endpoint.",
-	notes: "Combine with the global `--json` flag for a machine-readable descriptor. Recursive type references and `oneof` membership are annotated. Use `tailor-sdk api list` to discover endpoint names.",
-	examples: [{
-		cmd: "GetApplication",
-		desc: "Show fields of GetApplicationRequest."
-	}, {
-		cmd: "CreateExecutorExecutor",
-		desc: "Inspect a deeply nested input with `(oneof config)` annotations."
-	}],
-	args: z.object({ endpoint: arg(z.string(), {
-		positional: true,
-		description: "API endpoint to inspect (e.g., 'GetApplication' or 'tailor.v1.OperatorService/GetApplication').",
-		completion: { custom: { choices: listMethodNames() } }
-	}) }).strict(),
-	run: (args) => {
-		const methodName = extractMethodName(args.endpoint);
-		const method = getMethodDescriptor(methodName);
-		if (!method) throw createCLIError({
-			message: `unknown method: ${methodName}`,
-			suggestion: "Run `tailor-sdk api list` to see available methods.",
-			command: "api inspect"
-		});
-		if (logger.jsonMode) logger.out(renderInspectJson(method));
-		else logger.out(renderInspectText(method));
-	}
-});
-
-//#endregion
-//#region src/cli/commands/api/list.ts
-const listCommand$10 = defineAppCommand({
-	name: "list",
-	description: "List all invocable OperatorService methods.",
-	notes: "Only single-request (non-streaming) methods are listed, because the CLI issues a single JSON request and reads one JSON response.",
-	args: z.object({}).strict(),
-	run: () => {
-		const names = listMethodNames();
-		if (logger.jsonMode) logger.out(names);
-		else for (const name of names) logger.out(name);
-	}
-});
-
-//#endregion
-//#region src/cli/commands/api/index.ts
-function resolveNamespaceName(methodName, config) {
-	if (/Auth|Tenant|UserProfile/.test(methodName)) return config.auth?.name;
-	if (/IdP/.test(methodName)) {
-		if (config.idp?.length === 1) return assertDefined(config.idp[0], "idp config missing").name;
-		return;
-	}
-	if (/TailorDB/.test(methodName)) {
-		const keys = Object.keys(config.db ?? {});
-		if (keys.length === 1) return keys[0];
-		return;
-	}
-	if (/Pipeline/.test(methodName)) {
-		const keys = Object.keys(config.resolver ?? {});
-		if (keys.length === 1) return keys[0];
-		return;
-	}
-}
-/**
-* Parse a JSON body string as a plain object for field injection.
-* Returns undefined for invalid JSON or non-object values (null, arrays, primitives),
-* so callers can fall back to sending the raw string unchanged.
-* @param body - Raw body string
-* @returns Parsed object or undefined
-*/
-function parseBodyAsObject(body) {
-	let parsed;
-	try {
-		parsed = JSON.parse(body);
-	} catch {
-		return;
-	}
-	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return;
-	return parsed;
-}
-/**
-* Set a dotted path on a body object, replacing non-object intermediates as
-* needed. `--field` takes precedence over `--body`, so collisions overwrite.
-* @param obj - The body object to mutate
-* @param path - Dot-split path segments (e.g. ["application", "name"])
-* @param value - Value to assign at the leaf
-*/
-function setNestedPath(obj, path, value) {
-	let cursor = obj;
-	for (let i = 0; i < path.length - 1; i++) {
-		const key = assertDefined(path[i], "path segment missing");
-		const next = cursor[key];
-		if (typeof next !== "object" || next === null || Array.isArray(next)) cursor[key] = {};
-		cursor = cursor[key];
-	}
-	cursor[assertDefined(path[path.length - 1], "path last segment missing")] = value;
-}
-/**
-* Coerces a raw `--field` string value to match the leaf proto type so the
-* JSON body sends a properly typed value. Today we only coerce bool — the
-* completion candidates explicitly suggest `=true`/`=false`, so sending the
-* literal string "true" would be a visible mismatch. Other scalars are left
-* as strings: proto JSON accepts string forms for ints/floats/int64/etc.,
-* and we'd rather pass through what the user typed than silently coerce.
-* @param field - The resolved leaf field descriptor, or undefined when the path didn't resolve
-* @param raw - The raw string value after `=`
-* @returns The value to write into the body object
-*/
-function coerceFieldValue(field, raw) {
-	if (field && field.fieldKind === "scalar" && field.scalar === ScalarType.BOOL) {
-		if (raw === "true") return true;
-		if (raw === "false") return false;
-		throw new Error(`Invalid value for bool field: '${raw}'. Expected 'true' or 'false'.`);
-	}
-	return raw;
-}
-/**
-* Collapse top-level body keys that address a known input field by its
-* protobuf name (snake_case) or JSON name to the field's `localName`. protojson
-* accepts every alias, so converging them here lets the presence checks below
-* reason in a single namespace — otherwise a `--body` written as
-* `{"workspace_id": ...}` slips past the camelCase check and we inject a second
-* `workspaceId`, which the server rejects as a duplicate field. When both forms
-* are present the canonical key wins and the alias is dropped.
-* @param body - The parsed body object to mutate
-* @param fields - The target endpoint's input fields
-* @returns Whether any key was rewritten
-*/
-function normalizeBodyFieldKeys(body, fields) {
-	const aliasToLocal = /* @__PURE__ */ new Map();
-	for (const f of fields) {
-		aliasToLocal.set(f.name, f.localName);
-		aliasToLocal.set(f.jsonName, f.localName);
-	}
-	let changed = false;
-	for (const key of Object.keys(body)) {
-		const local = aliasToLocal.get(key);
-		if (!local || local === key) continue;
-		if (!Object.hasOwn(body, local)) body[local] = body[key];
-		delete body[key];
-		changed = true;
-	}
-	return changed;
-}
-const FORBIDDEN_SEGMENTS = /* @__PURE__ */ new Set([
-	"__proto__",
-	"constructor",
-	"prototype"
-]);
-const fieldArg = z.string().transform((val, ctx) => {
-	const eq = val.indexOf("=");
-	if (eq < 0) {
-		ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			message: `Invalid field format: '${val}'. Expected format: 'key=value' or 'a.b.c=value'`
-		});
-		return z.NEVER;
-	}
-	const key = val.slice(0, eq);
-	if (key.length === 0) {
-		ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			message: "Field key cannot be empty"
-		});
-		return z.NEVER;
-	}
-	const segments = key.split(".");
-	if (segments.some((seg) => seg.length === 0)) {
-		ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			message: `Invalid field key: '${key}'. Dotted segments cannot be empty`
-		});
-		return z.NEVER;
-	}
-	const forbidden = segments.find((seg) => FORBIDDEN_SEGMENTS.has(seg));
-	if (forbidden) {
-		ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			message: `Invalid field key: '${key}'. Segment '${forbidden}' is not allowed.`
-		});
-		return z.NEVER;
-	}
-	return {
-		path: segments,
-		value: val.slice(eq + 1)
-	};
-});
-const apiCommand = defineAppCommand({
-	name: "api",
-	description: "Call Tailor Platform API endpoints directly.",
-	notes: `Use \`tailor-sdk api list\` to enumerate invocable methods and \`tailor-sdk api inspect <endpoint>\` to print an endpoint's input message tree (combine with \`--json\` for machine-readable output).
-
-The request body is inferred from the target endpoint's request schema, and commonly required fields are auto-injected so they can be omitted from \`--body\`:
-
-- \`workspaceId\` — resolved from \`-w\` / \`TAILOR_PLATFORM_WORKSPACE_ID\` / the selected profile.
-- \`namespaceName\` — resolved from \`tailor.config.ts\` based on the endpoint's service:
-  - Auth / Tenant / UserProfile endpoints use \`auth.name\`.
-  - IdP / TailorDB / Pipeline endpoints use the sole configured namespace when exactly one is defined.
-
-Values already present in \`--body\` are never overridden. If a value cannot be resolved (e.g. no config found), injection is silently skipped and the server-side validation error takes precedence.
-
-Use \`--field key=value\` (repeatable) to set request body fields without writing JSON. Dotted keys (e.g. \`application.name=foo\`) build nested objects. \`--field\` overrides matching fields in \`--body\` and tab-completes from the endpoint's request schema.`,
-	examples: [
-		{
-			cmd: "GetApplication -b '{\"applicationName\":\"app-1\"}'",
-			desc: "Call an endpoint; workspaceId is auto-injected."
-		},
-		{
-			cmd: "GetApplication -f applicationName=app-1",
-			desc: "Same as above, using --field instead of --body."
-		},
-		{
-			cmd: "list",
-			desc: "List all invocable OperatorService methods."
-		},
-		{
-			cmd: "inspect GetApplication",
-			desc: "Show the input message tree for an endpoint."
-		}
-	],
-	subCommands: {
-		list: listCommand$10,
-		inspect: inspectCommand
-	},
-	args: z.object({
-		...workspaceArgs,
-		...configArg,
-		body: arg(z.string().default("{}"), {
-			alias: "b",
-			description: "Request body as JSON."
-		}),
-		field: arg(fieldArg.array().optional(), {
-			alias: "f",
-			description: "Set a body field as `key=value` (repeatable; dotted keys nest). Overrides --body.",
-			completion: { custom: { expand: {
-				dependsOn: ["endpoint"],
-				enumerate: ({ endpoint }) => enumerateAllFieldCompletions(extractMethodName(endpoint ?? ""))
-			} } }
-		}),
-		endpoint: arg(z.string(), {
-			positional: true,
-			description: "API endpoint to call (e.g., 'GetApplication' or 'tailor.v1.OperatorService/GetApplication').",
-			completion: { custom: { choices: listMethodChoices() } }
-		})
-	}).strict(),
-	run: async (args) => {
-		await assertWritable({ profile: args.profile });
-		const methodName = extractMethodName(args.endpoint);
-		const method = getMethodDescriptor(methodName);
-		const parsedBody = parseBodyAsObject(args.body);
-		let mutated = false;
-		if (args.field && args.field.length > 0) {
-			if (!parsedBody) throw new Error("--field requires --body to be a JSON object (or omitted).");
-			for (const f of args.field) {
-				const leaf = method ? resolveLeafField(method.input, f.path) : void 0;
-				setNestedPath(parsedBody, f.path, coerceFieldValue(leaf, f.value));
-			}
-			mutated = true;
-		}
-		if (parsedBody && method) {
-			if (normalizeBodyFieldKeys(parsedBody, method.input.fields)) mutated = true;
-			const fieldNames = method.input.fields.map((f) => f.localName);
-			if (fieldNames.includes("workspaceId") && !Object.hasOwn(parsedBody, "workspaceId")) try {
-				parsedBody.workspaceId = await loadWorkspaceId({
-					workspaceId: args["workspace-id"],
-					profile: args.profile
-				});
-				mutated = true;
-			} catch {}
-			if (fieldNames.includes("namespaceName") && !Object.hasOwn(parsedBody, "namespaceName")) try {
-				const { config } = await loadConfig(args.config);
-				const ns = resolveNamespaceName(methodName, config);
-				if (ns) {
-					parsedBody.namespaceName = ns;
-					mutated = true;
-				}
-			} catch {}
-		}
-		const result = await apiCall({
-			profile: args.profile,
-			endpoint: args.endpoint,
-			body: mutated && parsedBody ? JSON.stringify(parsedBody) : args.body
-		});
-		logger.out(JSON.stringify(result.data, null, 2));
-	}
-});
-
 //#endregion
 //#region src/cli/shared/prompt.ts
 /**
@@ -2296,35 +2839,59 @@ const SecretsStateSchema = z.object({
 	vaults: z.record(z.string(), z.record(z.string(), z.string())),
 	connections: z.record(z.string(), z.string()).optional()
 });
+const PersistedSecretsStateSchema = z.object({
+	version: z.literal(1),
+	workspaceId: z.string(),
+	applicationKey: z.string(),
+	state: SecretsStateSchema
+});
 /**
-* Get the file path for the secrets state JSON.
-* @returns Absolute path to secrets-state.json
+* Get the file path for one workspace and application's secrets state JSON.
+* @param scope - Workspace and application identity for the deployment
+* @returns Absolute path to the scoped state file
 */
-function getSecretsStatePath() {
-	return path.join(getDistDir(), "secrets-state.json");
+function getSecretsStatePath(scope) {
+	const scopeHash = hashValue(JSON.stringify([scope.workspaceId, applicationStateKey(scope)]));
+	return path.join(getDistDir(), "secrets-state", `${scopeHash}.json`);
 }
-/**
-* Load secrets hash state from disk.
-* @returns Persisted state, or empty state if file is missing or corrupted
-*/
-function loadSecretsState() {
-	const filePath = getSecretsStatePath();
-	if (!existsSync(filePath)) return { vaults: {} };
+function loadPersistedSecretsState(scope) {
 	try {
-		const raw = readFileSync(filePath, "utf-8");
-		return SecretsStateSchema.parse(JSON.parse(raw));
+		const raw = readFileSync(getSecretsStatePath(scope), "utf-8");
+		const persistedState = PersistedSecretsStateSchema.parse(JSON.parse(raw));
+		if (persistedState.workspaceId !== scope.workspaceId || persistedState.applicationKey !== applicationStateKey(scope)) return;
+		return persistedState;
 	} catch {
-		return { vaults: {} };
+		return;
 	}
 }
+function applicationStateKey(scope) {
+	if (!scope.applicationId) throw new Error(`Application "${scope.applicationName}" has no stable id for secrets state`);
+	return `id:${scope.applicationId}`;
+}
 /**
-* Save secrets hash state to disk.
+* Load secrets hash state for one workspace and application from disk.
+* @param scope - Workspace and application identity for the deployment
+* @returns Persisted state, or empty state if the scope is missing or the file is invalid
+*/
+function loadSecretsState(scope) {
+	if (!scope.applicationId) return { vaults: {} };
+	return loadPersistedSecretsState(scope)?.state ?? { vaults: {} };
+}
+/**
+* Save secrets hash state for one workspace and application to disk.
+* @param scope - Workspace and application identity for the deployment
 * @param state - The secrets state to persist
 */
-function saveSecretsState(state) {
-	const filePath = getSecretsStatePath();
+function saveSecretsState(scope, state) {
+	if (!scope.applicationId) return;
+	const filePath = getSecretsStatePath(scope);
 	mkdirSync(path.dirname(filePath), { recursive: true });
-	writeFileSync(filePath, JSON.stringify(state, null, 2), "utf-8");
+	writeFileSync(filePath, JSON.stringify({
+		version: 1,
+		workspaceId: scope.workspaceId,
+		applicationKey: applicationStateKey(scope),
+		state
+	}, null, 2), "utf-8");
 }
 /**
 * Compute SHA-256 hex digest of a value.
@@ -2390,6 +2957,11 @@ function buildUpdateMask(existing, desired, secretChanged) {
 * @returns Planned changes for auth connections
 */
 async function planAuthConnections(client, workspaceId, appName, appId, auths) {
+	const stateScope = {
+		workspaceId,
+		applicationId: appId,
+		applicationName: appName
+	};
 	const changeSet = createChangeSet("Auth connections");
 	const conflicts = [];
 	const unmanaged = [];
@@ -2413,7 +2985,7 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 			allLabels: metadata?.labels
 		};
 	}));
-	const state = loadSecretsState();
+	const state = loadSecretsState(stateScope);
 	for (const [name, config] of Object.entries(desiredConnections)) {
 		const existing = existingConnections[name];
 		const metaRequest = await buildMetaRequest({
@@ -2474,7 +3046,8 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 		changeSet,
 		conflicts,
 		unmanaged,
-		resourceOwners
+		resourceOwners,
+		stateScope
 	};
 }
 /**
@@ -2484,7 +3057,7 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 * @param phase - Apply phase
 */
 async function applyAuthConnections(client, result, phase) {
-	const { changeSet } = result;
+	const { changeSet, stateScope } = result;
 	if (phase === "create-update") {
 		await Promise.all(changeSet.creates.map(async (create) => {
 			await client.createAuthConnection(create.request);
@@ -2498,26 +3071,29 @@ async function applyAuthConnections(client, result, phase) {
 		await Promise.all(changeSet.updates.map(async (update) => {
 			await client.setMetadata(update.metaRequest);
 		}));
-		const state = loadSecretsState();
-		if (!state.connections) state.connections = {};
-		for (const create of changeSet.creates) {
-			const conn = create.request.connection;
-			if (conn?.config?.case === "oauth2") state.connections[create.name] = hashValue(conn.config.value.clientSecret ?? "");
-		}
-		for (const replace of changeSet.replaces) {
-			const conn = replace.updateRequest.connection;
-			if (conn?.config?.case === "oauth2" && replace.updateRequest.updateMask?.paths?.includes("oauth2.client_secret")) state.connections[replace.name] = hashValue(conn.config.value.clientSecret ?? "");
+		const secretReplaces = changeSet.replaces.filter((replace) => replace.updateRequest.updateMask?.paths?.includes("oauth2.client_secret"));
+		if (changeSet.creates.length > 0 || secretReplaces.length > 0) {
+			const state = loadSecretsState(stateScope);
+			if (!state.connections) state.connections = {};
+			for (const create of changeSet.creates) {
+				const conn = create.request.connection;
+				if (conn?.config?.case === "oauth2") state.connections[create.name] = hashValue(conn.config.value.clientSecret ?? "");
+			}
+			for (const replace of secretReplaces) {
+				const conn = replace.updateRequest.connection;
+				if (conn?.config?.case === "oauth2") state.connections[replace.name] = hashValue(conn.config.value.clientSecret ?? "");
+			}
+			saveSecretsState(stateScope, state);
 		}
-		saveSecretsState(state);
 	} else {
 		await Promise.all(changeSet.deletes.map(async (del) => {
 			await client.deleteAuthConnection(del.request);
 		}));
 		if (changeSet.deletes.length > 0) {
-			const state = loadSecretsState();
+			const state = loadSecretsState(stateScope);
 			if (state.connections) {
 				for (const del of changeSet.deletes) delete state.connections[del.name];
-				saveSecretsState(state);
+				saveSecretsState(stateScope, state);
 			}
 		}
 	}
@@ -3680,7 +4256,10 @@ async function applyAuth(client, result, phase = "create-update") {
 		await Promise.all([...changeSet.machineUser.creates.map((create) => client.createAuthMachineUser(create.request)), ...changeSet.machineUser.updates.map((update) => client.updateAuthMachineUser(update.request))]);
 	};
 	const applyCreateUpdateDependents = async () => {
-		await applyAuthConnections(client, { changeSet: changeSet.connection }, "create-update");
+		await applyAuthConnections(client, {
+			changeSet: changeSet.connection,
+			stateScope: result.connectionStateScope
+		}, "create-update");
 		await Promise.all([...changeSet.idpConfig.creates.map(async (create) => {
 			if (create.idpConfig.kind === "BuiltInIdP") assertDefined(create.request.idpConfig, "request missing idpConfig").config = await protoBuiltinIdPConfig(client, assertDefined(create.request.workspaceId, "request missing workspaceId"), create.idpConfig);
 			return client.createAuthIDPConfig(create.request);
@@ -3723,7 +4302,10 @@ async function applyAuth(client, result, phase = "create-update") {
 		await Promise.all(changeSet.tenantConfig.deletes.map((del) => client.deleteTenantConfig(del.request)));
 		await Promise.all(changeSet.userProfileConfig.deletes.map((del) => client.deleteUserProfileConfig(del.request)));
 		await Promise.all(changeSet.idpConfig.deletes.map((del) => client.deleteAuthIDPConfig(del.request)));
-		await applyAuthConnections(client, { changeSet: changeSet.connection }, "delete-resources");
+		await applyAuthConnections(client, {
+			changeSet: changeSet.connection,
+			stateScope: result.connectionStateScope
+		}, "delete-resources");
 	} else if (phase === "delete-services") await Promise.all(changeSet.service.deletes.map((del) => client.deleteAuthService(del.request)));
 }
 /**
@@ -3767,7 +4349,8 @@ async function planAuth(context) {
 		},
 		conflicts: [...conflicts, ...connectionResult.conflicts],
 		unmanaged: [...unmanaged, ...connectionResult.unmanaged],
-		resourceOwners: /* @__PURE__ */ new Set([...resourceOwners, ...connectionResult.resourceOwners])
+		resourceOwners: /* @__PURE__ */ new Set([...resourceOwners, ...connectionResult.resourceOwners]),
+		connectionStateScope: connectionResult.stateScope
 	};
 }
 async function planServices$2(client, workspaceId, appName, appId, auths, forceApplyAll = false) {
@@ -5643,7 +6226,12 @@ async function planSecretManager(context) {
 		getName: (resource) => resource.name,
 		getTrn: (name) => resourceTrn(workspaceId, "vault", name)
 	});
-	const state = loadSecretsState();
+	const stateScope = {
+		workspaceId,
+		applicationId: application.id,
+		applicationName: application.name
+	};
+	const state = loadSecretsState(stateScope);
 	const skippedSecrets = [];
 	await Promise.all(secretVaults.map(async (vault) => {
 		const vaultName = vault.vaultName;
@@ -5752,7 +6340,8 @@ async function planSecretManager(context) {
 		skippedSecrets,
 		conflicts,
 		unmanaged,
-		resourceOwners
+		resourceOwners,
+		stateScope
 	};
 }
 /**
@@ -5760,11 +6349,11 @@ async function planSecretManager(context) {
 * @param client - Operator client instance
 * @param result - Planned secret changes
 * @param phase - Apply phase
-* @param application - Application to read secrets from for hash state persistence
+* @param application - Application used for ownership metadata and hash state persistence
 * @returns Promise that resolves when secret changes are applied
 */
 async function applySecretManager(client, result, phase = "create-update", application) {
-	const { vaultChangeSet, secretChangeSet } = result;
+	const { vaultChangeSet, secretChangeSet, stateScope } = result;
 	if (phase === "create-update") {
 		await Promise.all(vaultChangeSet.creates.map(async (create) => {
 			await client.createSecretManagerVault(vaultCreateRequest(create));
@@ -5787,13 +6376,14 @@ async function applySecretManager(client, result, phase = "create-update", appli
 		}));
 		await Promise.all(secretChangeSet.creates.map((create) => client.createSecretManagerSecret(secretCreateRequest(create))));
 		await Promise.all(secretChangeSet.updates.map((update) => client.updateSecretManagerSecret(secretUpdateRequest(update))));
-		if (application) {
-			const state = loadSecretsState();
-			for (const vault of application.secrets) {
-				if (!Object.hasOwn(state.vaults, vault.vaultName)) state.vaults[vault.vaultName] = {};
-				for (const secret of vault.secrets) if (secret.value != null) assertDefined(state.vaults[vault.vaultName], "vault state entry missing")[secret.name] = hashValue(secret.value);
+		const secretHashUpdates = [...secretChangeSet.creates, ...secretChangeSet.updates];
+		if (application && secretHashUpdates.length > 0) {
+			const state = loadSecretsState(stateScope);
+			for (const secret of secretHashUpdates) {
+				if (!Object.hasOwn(state.vaults, secret.vaultName)) state.vaults[secret.vaultName] = {};
+				assertDefined(state.vaults[secret.vaultName], "vault state entry missing")[secret.secretName] = hashValue(secret.value);
 			}
-			saveSecretsState(state);
+			saveSecretsState(stateScope, state);
 		}
 	} else {
 		await Promise.all(secretChangeSet.deletes.map((del) => client.deleteSecretManagerSecret({
@@ -5806,13 +6396,13 @@ async function applySecretManager(client, result, phase = "create-update", appli
 			secretmanagerVaultName: del.name
 		})));
 		if (secretChangeSet.deletes.length > 0 || vaultChangeSet.deletes.length > 0) {
-			const state = loadSecretsState();
+			const state = loadSecretsState(stateScope);
 			for (const del of secretChangeSet.deletes) if (Object.hasOwn(state.vaults, del.vaultName)) {
 				delete assertDefined(state.vaults[del.vaultName], "vault state entry missing")[del.secretName];
 				if (Object.keys(assertDefined(state.vaults[del.vaultName], "vault state entry missing")).length === 0) delete state.vaults[del.vaultName];
 			}
 			for (const del of vaultChangeSet.deletes) delete state.vaults[del.name];
-			saveSecretsState(state);
+			saveSecretsState(stateScope, state);
 		}
 	}
 }
@@ -10311,11 +10901,11 @@ async function registerJobFunctions(client, changeSet, appName, appId, unchanged
 	const allUsedJobNames = /* @__PURE__ */ new Set();
 	unchangedWorkflowJobNames.forEach((jobName) => allUsedJobNames.add(jobName));
 	for (const item of [...changeSet.creates, ...changeSet.updates]) for (const jobName of item.usedJobNames) allUsedJobNames.add(jobName);
-	const existingJobFunctions = await fetchAll(async (pageToken, _maxPageSize) => {
+	const existingJobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
 		const response = await client.listWorkflowJobFunctions({
 			workspaceId,
 			pageToken,
-			pageSize: 100
+			pageSize: maxPageSize
 		});
 		return [response.jobFunctions.map((j) => j.name), response.nextPageToken];
 	});
@@ -10495,11 +11085,11 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 }
 async function planWorkflowJobFunctionDeletes(params) {
 	const { client, workspaceId, appName, appId, retainedWorkflowJobNames } = params;
-	const existingJobFunctions = await fetchAll(async (pageToken, _maxPageSize) => {
+	const existingJobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
 		const response = await client.listWorkflowJobFunctions({
 			workspaceId,
 			pageToken,
-			pageSize: 100
+			pageSize: maxPageSize
 		});
 		return [response.jobFunctions.map((jobFunction) => jobFunction.name), response.nextPageToken];
 	});
@@ -11118,13 +11708,14 @@ function validateItems(params) {
 *
 * Collections not validated: idp client, tailorDB gqlPermission, functionRegistry — no
 * buf.validate annotations.
-* Application cors and IdP userAuthPolicy.allowedReturnOrigins receive special
-* handling: static-website URL placeholders are resolved at apply time, so the
+* Application cors, AIGateway cors, and IdP userAuthPolicy.allowedReturnOrigins receive
+* special handling: static-website URL placeholders are resolved at apply time, so the
 * relevant origin/URL constraints would false-positive on `<name>:url` entries
-* here. Application cors is dropped entirely (no other constraint to lose); IdP
-* `allowedReturnOrigins` substitutes placeholder entries with a dummy origin so
-* the per-item regex and the cross-field `enable_mfa requires ≥1 origin` rule
-* still get exercised on the rest of the payload.
+* here. Application cors and AIGateway cors are dropped entirely, forgoing their
+* per-item URL/origin constraints for the whole list rather than substituting
+* placeholders; IdP `allowedReturnOrigins` instead substitutes placeholder entries
+* with a dummy origin so the per-item regex and the cross-field `enable_mfa requires
+* ≥1 origin` rule still get exercised on the rest of the payload.
 * Workflow jobFunctions map excluded: versions are registered at apply time (registerJobFunctions)
 * and the map field carries no min_items constraint. Job names are validated separately via
 * CreateWorkflowJobFunctionRequestSchema using usedJobNames from the workflow change set.
@@ -11134,7 +11725,7 @@ function validateItems(params) {
 * @param input - Plan results from the plan phase
 */
 async function validatePlan(input) {
-	const { tailorDB, staticWebsite, idp, auth, pipeline, app, executor, workflow, workflowExecutionPolicy, secretManager } = input;
+	const { tailorDB, staticWebsite, aiGateway, idp, auth, pipeline, app, executor, workflow, workflowExecutionPolicy, secretManager } = input;
 	const validator = createValidator();
 	const violations = [];
 	function creates(schema, kind, items) {
@@ -11187,6 +11778,20 @@ async function validatePlan(input) {
 	creates(CreateStaticWebsiteRequestSchema, "StaticWebsite", staticWebsite.changeSet.creates);
 	updates(UpdateStaticWebsiteRequestSchema, "StaticWebsite", staticWebsite.changeSet.updates);
 	creates(AddCustomDomainRequestSchema, "StaticWebsite custom domain", staticWebsite.customDomainChangeSet.creates);
+	creates(CreateAIGatewayRequestSchema, "AIGateway", aiGateway.changeSet.creates.map((item) => ({
+		name: item.name,
+		request: {
+			...item.request,
+			cors: void 0
+		}
+	})));
+	updates(UpdateAIGatewayRequestSchema, "AIGateway", aiGateway.changeSet.updates.map((item) => ({
+		name: item.name,
+		request: {
+			...item.request,
+			cors: void 0
+		}
+	})));
 	const placeholderOriginReplacement = "https://placeholder.invalid";
 	const substituteIdpReturnOrigins = (item) => {
 		const request = item.request;
@@ -11972,50 +12577,25 @@ function deploymentPlanResults(deployment) {
 	const { application: _application, ...results } = deployment;
 	return results;
 }
+/**
+* Every `PlanResults` entry except `app` carries ownership-tracking fields;
+* deriving the list from `results` itself (instead of naming each key) keeps
+* these collectors in sync with `PlannedDeployment` as resource types are added.
+* @param results - Plan results for a single deployment
+* @returns The ownership-tracking plan entries, `app` excluded
+*/
+function ownershipTrackedPlans(results) {
+	const { app: _app, ...rest } = results;
+	return Object.values(rest);
+}
 function collectOwnerConflicts(results) {
-	return [
-		...results.functionRegistry.conflicts,
-		...results.tailorDB.conflicts,
-		...results.staticWebsite.conflicts,
-		...results.aiGateway.conflicts,
-		...results.idp.conflicts,
-		...results.auth.conflicts,
-		...results.pipeline.conflicts,
-		...results.executor.conflicts,
-		...results.workflow.conflicts,
-		...results.workflowExecutionPolicy.conflicts,
-		...results.secretManager.conflicts
-	];
+	return ownershipTrackedPlans(results).flatMap((plan) => plan.conflicts);
 }
 function collectUnmanagedResources(results) {
-	return [
-		...results.functionRegistry.unmanaged,
-		...results.tailorDB.unmanaged,
-		...results.staticWebsite.unmanaged,
-		...results.aiGateway.unmanaged,
-		...results.idp.unmanaged,
-		...results.auth.unmanaged,
-		...results.pipeline.unmanaged,
-		...results.executor.unmanaged,
-		...results.workflow.unmanaged,
-		...results.workflowExecutionPolicy.unmanaged,
-		...results.secretManager.unmanaged
-	];
+	return ownershipTrackedPlans(results).flatMap((plan) => plan.unmanaged);
 }
 function collectResourceOwners(results) {
-	return /* @__PURE__ */ new Set([
-		...results.functionRegistry.resourceOwners,
-		...results.tailorDB.resourceOwners,
-		...results.staticWebsite.resourceOwners,
-		...results.aiGateway.resourceOwners,
-		...results.idp.resourceOwners,
-		...results.auth.resourceOwners,
-		...results.pipeline.resourceOwners,
-		...results.executor.resourceOwners,
-		...results.workflow.resourceOwners,
-		...results.workflowExecutionPolicy.resourceOwners,
-		...results.secretManager.resourceOwners
-	]);
+	return new Set(ownershipTrackedPlans(results).flatMap((plan) => [...plan.resourceOwners]));
 }
 function collectImportantResourceDeletions(results) {
 	const importantDeletions = [];
@@ -16430,62 +17010,67 @@ async function execRemove(client, workspaceId, application, config, confirm) {
 		forRemoval: true,
 		config
 	};
-	const tailorDB = await planTailorDB(ctx);
-	const staticWebsite = await planStaticWebsite(ctx);
-	const aiGateway = await planAIGateway(ctx);
-	const idp = await planIdP(ctx);
-	const auth = await planAuth(ctx);
-	const pipeline = await planPipeline(ctx);
-	const app = await planApplication(ctx);
-	const executor = await planExecutor(ctx);
-	const workflow = await planWorkflow(client, workspaceId, application.name, application.id, {}, {});
-	const functionRegistry = await planFunctionRegistry(client, workspaceId, application.name, application.id, []);
-	const secretManager = await planSecretManager(ctx);
+	const plans = {
+		tailorDB: await planTailorDB(ctx),
+		staticWebsite: await planStaticWebsite(ctx),
+		aiGateway: await planAIGateway(ctx),
+		idp: await planIdP(ctx),
+		auth: await planAuth(ctx),
+		pipeline: await planPipeline(ctx),
+		app: await planApplication(ctx),
+		executor: await planExecutor(ctx),
+		workflow: await planWorkflow(client, workspaceId, application.name, application.id, {}, {}),
+		workflowExecutionPolicy: await planWorkflowJobFunctionExecutionPolicy(client, workspaceId, application.name, application.id, {}),
+		functionRegistry: await planFunctionRegistry(client, workspaceId, application.name, application.id, []),
+		secretManager: await planSecretManager(ctx)
+	};
 	const removeLines = [
-		...functionRegistry.changeSet.lines(),
-		...staticWebsite.changeSet.lines(),
-		...aiGateway.changeSet.lines(),
-		...app.lines(),
-		...tailorDB.changeSet.service.lines(),
-		...tailorDB.changeSet.type.lines(),
-		...tailorDB.changeSet.gqlPermission.lines(),
-		...pipeline.changeSet.service.lines(),
-		...pipeline.changeSet.resolver.lines(),
-		...executor.changeSet.lines(),
-		...workflow.changeSet.lines(),
-		...idp.changeSet.service.lines(),
-		...idp.changeSet.client.lines(),
-		...auth.changeSet.service.lines(),
-		...auth.changeSet.idpConfig.lines(),
-		...auth.changeSet.userProfileConfig.lines(),
-		...auth.changeSet.tenantConfig.lines(),
-		...auth.changeSet.machineUser.lines(),
-		...auth.changeSet.oauth2Client.lines(),
-		...auth.changeSet.authHook.lines(),
-		...auth.changeSet.scim.lines(),
-		...auth.changeSet.scimResource.lines(),
-		...auth.changeSet.connection.lines(),
-		...secretManager.vaultChangeSet.lines(),
-		...secretManager.secretChangeSet.lines()
+		...plans.functionRegistry.changeSet.lines(),
+		...plans.staticWebsite.changeSet.lines(),
+		...plans.aiGateway.changeSet.lines(),
+		...plans.app.lines(),
+		...plans.tailorDB.changeSet.service.lines(),
+		...plans.tailorDB.changeSet.type.lines(),
+		...plans.tailorDB.changeSet.gqlPermission.lines(),
+		...plans.pipeline.changeSet.service.lines(),
+		...plans.pipeline.changeSet.resolver.lines(),
+		...plans.executor.changeSet.lines(),
+		...plans.workflow.changeSet.lines(),
+		...plans.workflowExecutionPolicy.changeSet.lines(),
+		...plans.idp.changeSet.service.lines(),
+		...plans.idp.changeSet.client.lines(),
+		...plans.auth.changeSet.service.lines(),
+		...plans.auth.changeSet.idpConfig.lines(),
+		...plans.auth.changeSet.userProfileConfig.lines(),
+		...plans.auth.changeSet.tenantConfig.lines(),
+		...plans.auth.changeSet.machineUser.lines(),
+		...plans.auth.changeSet.oauth2Client.lines(),
+		...plans.auth.changeSet.authHook.lines(),
+		...plans.auth.changeSet.scim.lines(),
+		...plans.auth.changeSet.scimResource.lines(),
+		...plans.auth.changeSet.connection.lines(),
+		...plans.secretManager.vaultChangeSet.lines(),
+		...plans.secretManager.secretChangeSet.lines()
 	];
 	if (removeLines.length > 0) logger.log(removeLines.join("\n"));
-	if (tailorDB.changeSet.service.deletes.length === 0 && staticWebsite.changeSet.deletes.length === 0 && aiGateway.changeSet.deletes.length === 0 && idp.changeSet.service.deletes.length === 0 && auth.changeSet.service.deletes.length === 0 && pipeline.changeSet.service.deletes.length === 0 && app.deletes.length === 0 && executor.changeSet.deletes.length === 0 && workflow.changeSet.deletes.length === 0 && functionRegistry.changeSet.deletes.length === 0 && secretManager.vaultChangeSet.deletes.length === 0 && secretManager.secretChangeSet.deletes.length === 0) return;
+	if (plans.tailorDB.changeSet.service.deletes.length === 0 && plans.staticWebsite.changeSet.deletes.length === 0 && plans.aiGateway.changeSet.deletes.length === 0 && plans.idp.changeSet.service.deletes.length === 0 && plans.auth.changeSet.service.deletes.length === 0 && plans.pipeline.changeSet.service.deletes.length === 0 && plans.app.deletes.length === 0 && plans.executor.changeSet.deletes.length === 0 && plans.workflow.changeSet.deletes.length === 0 && plans.workflowExecutionPolicy.changeSet.deletes.length === 0 && plans.functionRegistry.changeSet.deletes.length === 0 && plans.secretManager.vaultChangeSet.deletes.length === 0 && plans.secretManager.secretChangeSet.deletes.length === 0) return;
 	if (confirm) await confirm();
-	await applyWorkflow(client, workflow, "delete");
-	await applyExecutor(client, executor, "delete");
-	await applyStaticWebsite(client, staticWebsite, "delete");
-	await applyAIGateway(client, aiGateway, "delete");
-	await applyApplication(client, app, "delete");
-	await applyPipeline(client, pipeline, "delete-resources");
-	await applyPipeline(client, pipeline, "delete-services");
-	await applyAuth(client, auth, "delete-resources");
-	await applyAuth(client, auth, "delete-services");
-	await applyIdP(client, idp, "delete-resources");
-	await applyIdP(client, idp, "delete-services");
-	await applyTailorDB(client, tailorDB, "delete-resources");
-	await applyTailorDB(client, tailorDB, "delete-services");
-	await applyFunctionRegistry(client, workspaceId, functionRegistry, "delete");
-	await applySecretManager(client, secretManager, "delete");
+	await applyWorkflow(client, plans.workflow, "delete");
+	await applyWorkflowJobFunctionExecutionPolicy(client, plans.workflowExecutionPolicy, "delete");
+	await applyExecutor(client, plans.executor, "delete");
+	await applyStaticWebsite(client, plans.staticWebsite, "delete");
+	await applyAIGateway(client, plans.aiGateway, "delete");
+	await applyApplication(client, plans.app, "delete");
+	await applyPipeline(client, plans.pipeline, "delete-resources");
+	await applyPipeline(client, plans.pipeline, "delete-services");
+	await applyAuth(client, plans.auth, "delete-resources");
+	await applyAuth(client, plans.auth, "delete-services");
+	await applyIdP(client, plans.idp, "delete-resources");
+	await applyIdP(client, plans.idp, "delete-services");
+	await applyTailorDB(client, plans.tailorDB, "delete-resources");
+	await applyTailorDB(client, plans.tailorDB, "delete-services");
+	await applyFunctionRegistry(client, workspaceId, plans.functionRegistry, "delete");
+	await applySecretManager(client, plans.secretManager, "delete");
 }
 /**
 * Remove all resources managed by the current application.
@@ -17293,7 +17878,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-DbvD5UUz.mjs");
+	const { defineApplication } = await import("./application-6zsDLGKv.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -19560,5 +20145,5 @@ function isDeno() {
 }
 
 //#endregion
-export { getOrganization as $, compareSnapshotWithRemote as $t, listCommand$3 as A, apiCommand as An, getExecutorWaitFailureMessage as At, show as B, listWorkflowExecutions as Bt, listCommand$2 as C, hasChanges as Cn, listWebhookExecutors as Ct, waitWorkflowExecution as D, PluginManager as Dn, listCommand$9 as Dt, waitCommand as E, sdkNameLabelKey as En, triggerExecutor as Et, generateCommand as F, startWorkflow as Ft, removeCommand$1 as G, deploy as Gt, extractOwnedNamespaces as H, formatKeyValueTable as Ht, generateMigrationScript as I, getCommand$5 as It, organizationTree as J, waitForExecution as Jt, updateCommand$1 as K, ensureConfigId as Kt, writeDbTypesFile as L, getWorkflow as Lt, truncate as M, assertWritable as Mn, listExecutorJobs as Mt, truncateCommand as N, defineAppCommand as Nn, watchExecutorJob as Nt, resumeCommand as O, generateUserTypes as On, listExecutors as Ot, generate as P, startCommand as Pt, getCommand$1 as Q, parseMigrationLabelNumber as Qt, getConfiguredEditorCommand as R, executionsCommand as Rt, listApps as S, formatMigrationDiff as Sn, getFunctionRegistry as St, healthCommand as T, resourceTrn as Tn, triggerCommand as Tt, logBetaWarning as U, getCommand$6 as Ut, showCommand as V, functionExecutionStatusToString as Vt, remove as W, getExecutor as Wt, listCommand$4 as X, MIGRATION_LABEL_KEY as Xt, treeCommand as Y, bundleMigrationScript as Yt, listOrganizations as Z, handleOptionalToRequiredError as Zt, getWorkspace as _, loadDiff as _n, listMachineUsers as _t, updateUser as a, MIGRATE_FILE_NAME as an, getFolder as at, createCommand as b, parseMigrationNumberArg as bn, listFunctionRegistries as bt, listCommand as c, compareLocalTypesWithSnapshot as cn, createCommand$1 as ct, inviteUser as d, getLatestMigrationNumber as dn, listOAuth2Clients as dt, generateAllTypeManifestsFromSnapshot as en, updateCommand$2 as et, restoreCommand as f, getMigrationDirPath as fn, getCommand$3 as ft, getCommand as g, isValidMigrationNumber as gn, listCommand$7 as gt, listWorkspaces as h, getNextMigrationNumber as hn, tokenCommand as ht, updateCommand as i, INITIAL_SCHEMA_NUMBER as in, getCommand$2 as it, listWorkflows as j, apiCall as jn, jobsCommand as jt, resumeWorkflow as k, prompt as kn, getExecutorJob as kt, listUsers as l, compareSnapshots as ln, createFolder as lt, listCommand$1 as m, getMigrationFiles as mn, getMachineUserToken as mt, query as n, DB_TYPES_FILE_NAME as nn, listCommand$5 as nt, removeCommand as o, SCHEMA_FILE_NAME as on, deleteCommand$1 as ot, restoreWorkspace as p, getMigrationFilePath as pn, getOAuth2Client as pt, updateOrganization as q, executeScript as qt, queryCommand as r, DIFF_FILE_NAME as rn, listFolders as rt, removeUser as s, assertValidMigrationFiles as sn, deleteFolder as st, isNativeTypeScriptRuntime as t, protoGqlPermission as tn, updateFolder as tt, inviteCommand as u, createSnapshotFromLocalTypes as un, listCommand$6 as ut, deleteCommand as v, reconstructSnapshotFromMigrations as vn, generate$1 as vt, getAppHealth as w, getNamespacesWithMigrations as wn, webhookCommand as wt, createWorkspace as x, formatDiffSummary as xn, getCommand$4 as xt, deleteWorkspace as y, formatMigrationNumber as yn, listCommand$8 as yt, openInConfiguredEditor as z, getWorkflowExecution as zt };
-//# sourceMappingURL=runtime-_vUgjiqT.mjs.map
+export { getOrganization as $, multiConfigArg as $n, compareSnapshotWithRemote as $t, listCommand$3 as A, apiCall as An, getExecutorWaitFailureMessage as At, show as B, loadStoredUserTokens as Bn, listWorkflowExecutions as Bt, listCommand$2 as C, hasChanges as Cn, listWebhookExecutors as Ct, waitWorkflowExecution as D, PluginManager as Dn, listCommand$9 as Dt, waitCommand as E, sdkNameLabelKey as En, triggerExecutor as Et, generateCommand as F, hasAnyUserTokenEntry as Fn, startWorkflow as Ft, removeCommand$1 as G, saveUserTokens as Gn, deploy as Gt, extractOwnedNamespaces as H, platformConfigFromProfile as Hn, formatKeyValueTable as Ht, generateMigrationScript as I, hasUserTokenEntry as In, getCommand$5 as It, organizationTree as J, commonArgs as Jn, waitForExecution as Jt, updateCommand$1 as K, writePlatformConfig as Kn, ensureConfigId as Kt, writeDbTypesFile as L, loadAccessToken as Ln, getWorkflow as Lt, truncate as M, loadConfig as Mn, listExecutorJobs as Mt, truncateCommand as N, deleteUserTokens as Nn, watchExecutorJob as Nt, resumeCommand as O, generateUserTypes as On, listExecutors as Ot, generate as P, fetchLatestToken as Pn, startCommand as Pt, getCommand$1 as Q, isVerbose as Qn, parseMigrationLabelNumber as Qt, getConfiguredEditorCommand as R, loadConsoleBaseUrl as Rn, executionsCommand as Rt, listApps as S, formatMigrationDiff as Sn, getFunctionRegistry as St, healthCommand as T, resourceTrn as Tn, triggerCommand as Tt, logBetaWarning as U, readPlatformConfig as Un, getCommand$6 as Ut, showCommand as V, loadWorkspaceId as Vn, functionExecutionStatusToString as Vt, remove as W, resolveUserTokenKey as Wn, getExecutor as Wt, listCommand$4 as X, confirmationArgs as Xn, MIGRATION_LABEL_KEY as Xt, treeCommand as Y, configArg as Yn, bundleMigrationScript as Yt, listOrganizations as Z, deploymentArgs as Zn, handleOptionalToRequiredError as Zt, getWorkspace as _, loadDiff as _n, listMachineUsers as _t, updateUser as a, MIGRATE_FILE_NAME as an, getFolder as at, createCommand as b, parseMigrationNumberArg as bn, listFunctionRegistries as bt, listCommand as c, compareLocalTypesWithSnapshot as cn, createCommand$1 as ct, inviteUser as d, getLatestMigrationNumber as dn, listOAuth2Clients as dt, generateAllTypeManifestsFromSnapshot as en, pagedLogArgs as er, updateCommand$2 as et, restoreCommand as f, getMigrationDirPath as fn, getCommand$3 as ft, getCommand as g, isValidMigrationNumber as gn, listCommand$7 as gt, listWorkspaces as h, getNextMigrationNumber as hn, tokenCommand as ht, updateCommand as i, INITIAL_SCHEMA_NUMBER as in, workspaceArgs as ir, getCommand$2 as it, listWorkflows as j, assertWritable as jn, jobsCommand as jt, resumeWorkflow as k, prompt as kn, getExecutorJob as kt, listUsers as l, compareSnapshots as ln, createFolder as lt, listCommand$1 as m, getMigrationFiles as mn, getMachineUserToken as mt, query as n, DB_TYPES_FILE_NAME as nn, resolveMachineUserInputSource as nr, listCommand$5 as nt, removeCommand as o, SCHEMA_FILE_NAME as on, deleteCommand$1 as ot, restoreWorkspace as p, getMigrationFilePath as pn, getOAuth2Client as pt, updateOrganization as q, defineAppCommand as qn, executeScript as qt, queryCommand as r, DIFF_FILE_NAME as rn, toPageDirection as rr, listFolders as rt, removeUser as s, assertValidMigrationFiles as sn, deleteFolder as st, isNativeTypeScriptRuntime as t, protoGqlPermission as tn, paginationArgs as tr, updateFolder as tt, inviteCommand as u, createSnapshotFromLocalTypes as un, listCommand$6 as ut, deleteCommand as v, reconstructSnapshotFromMigrations as vn, generate$1 as vt, getAppHealth as w, getNamespacesWithMigrations as wn, webhookCommand as wt, createWorkspace as x, formatDiffSummary as xn, getCommand$4 as xt, deleteWorkspace as y, formatMigrationNumber as yn, listCommand$8 as yt, openInConfiguredEditor as z, loadMachineUserName as zn, getWorkflowExecution as zt };
+//# sourceMappingURL=runtime-DlklyuHN.mjs.map