@tailor-platform/sdk 1.78.0 → 1.80.0

package/dist/{application-CUxVA7Fs.mjs → application-C1d52JP9.mjs}

@@ -1,18 +1,18 @@
 import { n as isSdkBranded } from "./brand-Eo4pLXPJ.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
 import { a as parseBoolean, n as logger, r as styles } from "./logger-BwS4ppwO.mjs";
-import { a as TailorFieldSchema, i as AuthInvokerSchema, n as ExecutorSchema, o as loadFilesWithIgnores, r as AuthConfigSchema, s as functionSchema, t as createExecutorService } from "./service-D12iQGcS.mjs";
+import { a as TailorFieldSchema, i as AuthInvokerSchema, n as ExecutorSchema, o as loadFilesWithIgnores, r as AuthConfigSchema, s as functionSchema, t as createExecutorService } from "./service-CDPatibu.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { t as isPluginGeneratedType } from "./type-source-DH_LH20p.mjs";
 import { t as userAgent } from "./user-agent-DX2Jnw0-.mjs";
 import { builtinModules, createRequire } from "node:module";
 import { z } from "zod";
 import { create } from "@bufbuild/protobuf";
-import * as fs$1 from "node:fs";
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import * as fs from "node:fs";
+import { readFileSync } from "node:fs";
 import { MethodOptions_IdempotencyLevel } from "@bufbuild/protobuf/wkt";
 import * as path from "pathe";
-import { join, resolve } from "pathe";
+import { resolve } from "pathe";
 import { pathToFileURL } from "node:url";
 import * as os from "node:os";
 import { OAuth2Client } from "@badgateway/oauth2-client";
@@ -22,7 +22,6 @@ import pLimit from "p-limit";
 import { resolveTSConfig } from "pkg-types";
 import * as crypto from "node:crypto";
 import * as rolldown from "rolldown";
-import * as fs from "node:fs/promises";
 import { parseSync } from "oxc-parser";
 import * as inflection from "inflection";
 import * as globals from "globals";
@@ -307,8 +306,10 @@ function connectCodeName(error) {
 *
 * Membership is deliberately an allowlist, not `startsWith("Create")`: swallowing
 * synthesizes an empty response (see `synthesizeEmptyUnaryResponse`), which is only
-* safe when every caller ignores the response body. These are the deploy/apply
-* resource creations that fire under heavy parallelism and discard their response.
+* safe when every caller tolerates an empty response body. These are the deploy/apply
+* resource creations that fire under heavy parallelism and discard their response —
+* except `CreateSecretManagerSecret`, whose caller reads `secret.updateTime` but
+* degrades safely when it is absent (the next deploy re-updates the secret).
 *
 * Intentionally excluded because their callers read the response body — swallowing
 * would hand back an empty message and corrupt downstream state:
@@ -682,7 +683,7 @@ function hashContent(content) {
 * @returns Hex-encoded SHA-256 hash of the file content
 */
 function hashFile(filePath) {
-	const content = fs$1.readFileSync(filePath);
+	const content = fs.readFileSync(filePath);
 	return crypto.createHash("sha256").update(content).digest("hex");
 }
 /**
@@ -811,7 +812,10 @@ function createBundleCache(store) {
 			return;
 		}
 		if (currentHash !== entry.inputHash) return;
-		return store.restoreBundleContent(cacheKey);
+		const content = store.restoreBundleContent(cacheKey);
+		const output = entry.outputFiles.find((file) => file.outputPath === cacheKey);
+		if (content === void 0 || !output || hashContent(content) !== output.contentHash) return;
+		return content;
 	}
 	function save(params) {
 		const { kind, namespace, name, sourceFile, content, dependencyPaths, contextHash } = params;
@@ -858,7 +862,7 @@ function resolveRelativePluginImportPath(pluginImportPath, baseDirs) {
 	if (!pluginImportPath.startsWith(".")) return null;
 	for (const baseDir of baseDirs) {
 		const absolutePath = path.resolve(baseDir, pluginImportPath);
-		if (fs$1.existsSync(absolutePath)) return absolutePath;
+		if (fs.existsSync(absolutePath)) return absolutePath;
 	}
 	return null;
 }
@@ -942,13 +946,13 @@ function generatePluginExecutorFiles(executors, outputDir, typeGenerationResult,
 function generateSingleExecutorFile(info, outputDir, typeGenerationResult, sourceTypeInfoMap, baseDirs = []) {
 	const pluginDir = sanitizePluginId$1(info.pluginId);
 	const executorOutputDir = path.join(outputDir, pluginDir, "executors");
-	fs$1.mkdirSync(executorOutputDir, { recursive: true });
+	fs.mkdirSync(executorOutputDir, { recursive: true });
 	const fileName = sanitizeExecutorFileName(info.executor.name);
 	const filePath = path.join(executorOutputDir, `${fileName}.ts`);
 	let content;
 	if (isPluginExecutorWithFile(info.executor)) content = generateExecutorFileContentNew(info, info.executor, outputDir, typeGenerationResult, sourceTypeInfoMap, baseDirs);
 	else content = generateExecutorFileContentLegacy(info.executor);
-	fs$1.writeFileSync(filePath, content);
+	fs.writeFileSync(filePath, content);
 	return filePath;
 }
 /**
@@ -1180,7 +1184,7 @@ function extractDynamicImportSpecifier(resolve) {
 function resolvePluginBaseDir(pluginImportPath, baseDirs) {
 	if (pluginImportPath.startsWith(".")) {
 		const resolvedPath = resolveRelativePluginImportPath(pluginImportPath, baseDirs) ?? path.resolve(baseDirs[0] ?? process.cwd(), pluginImportPath);
-		if (fs$1.existsSync(resolvedPath)) return fs$1.statSync(resolvedPath).isDirectory() ? resolvedPath : path.dirname(resolvedPath);
+		if (fs.existsSync(resolvedPath)) return fs.statSync(resolvedPath).isDirectory() ? resolvedPath : path.dirname(resolvedPath);
 		return path.extname(resolvedPath) ? path.dirname(resolvedPath) : resolvedPath;
 	}
 	for (const baseDir of baseDirs) try {
@@ -1267,11 +1271,11 @@ function generatePluginTypeFiles(types, outputDir) {
 		seenTypeNames.set(info.type.name, info);
 		const pluginDir = sanitizePluginId(info.pluginId);
 		const typeOutputDir = path.join(outputDir, pluginDir, "types");
-		fs$1.mkdirSync(typeOutputDir, { recursive: true });
+		fs.mkdirSync(typeOutputDir, { recursive: true });
 		const fileName = `${toKebabCase(info.type.name)}.ts`;
 		const filePath = path.join(typeOutputDir, fileName);
 		const content = generateTypeFileContent(info);
-		fs$1.writeFileSync(filePath, content);
+		fs.writeFileSync(filePath, content);
 		generatedFiles.push(filePath);
 		const relativePath = path.relative(outputDir, filePath);
 		typeFilePaths.set(info.type.name, relativePath);
@@ -1392,20 +1396,6 @@ function toCamelCase(str) {
 	return result.charAt(0).toLowerCase() + result.slice(1);
 }
 
-//#endregion
-//#region src/cli/services/stale-cleanup.ts
-/**
-* Remove stale `.entry.js` files from the output directory.
-*
-* Must be called before parallel bundling; concurrent builds
-* sharing the same output directory would otherwise conflict.
-* @param outputDir - Directory to clean
-*/
-async function removeStaleEntryFiles(outputDir) {
-	const files = await fs.readdir(outputDir);
-	await Promise.all(files.filter((file) => file.endsWith(".entry.js")).map((file) => fs.rm(path.join(outputDir, file), { force: true })));
-}
-
 //#endregion
 //#region src/cli/services/workflow/ast-utils.ts
 /**
@@ -1805,16 +1795,17 @@ function createModuleBindings(program, source) {
 * Build trigger context from configured workflow source files.
 * @param workflowConfig - Workflow file loading configuration
 * @param authNamespace - Auth service namespace used by workflow trigger options
+* @param baseDir - Directory the workflow config's file patterns are resolved against (defaults to process.cwd())
 * @returns Module-local workflow and job binding metadata
 */
-async function buildTriggerContext(workflowConfig, authNamespace) {
+async function buildTriggerContext(workflowConfig, authNamespace, baseDir = process.cwd()) {
 	const modules = /* @__PURE__ */ new Map();
 	if (!workflowConfig) return {
 		modules,
 		authNamespace
 	};
-	for (const file of loadFilesWithIgnores(workflowConfig)) try {
-		const source = await fs$1.promises.readFile(file, "utf-8");
+	for (const file of loadFilesWithIgnores(workflowConfig, baseDir)) try {
+		const source = await fs.promises.readFile(file, "utf-8");
 		const { program } = parseSync("input.ts", source);
 		modules.set(normalizeFilePath(file), createModuleBindings(program, source));
 	} catch (error) {
@@ -2133,34 +2124,77 @@ const platformBundleDefinePlugin = {
 	}
 };
 
+//#endregion
+//#region src/cli/shared/resolve-tsconfig.ts
+const warnedBaseDirs = /* @__PURE__ */ new Set();
+/**
+* Resolve the nearest tsconfig.json for baseDir, falling back to the tsconfig
+* resolved from the invocation cwd when baseDir's own ancestry has none.
+* @param baseDir - Directory to resolve the tsconfig against
+* @returns Absolute path to the resolved tsconfig.json, or undefined if none was found
+*/
+async function resolveTSConfigWithFallback(baseDir) {
+	const tsconfig = await tryResolve(baseDir);
+	if (tsconfig || baseDir === process.cwd()) return tsconfig;
+	const fallback = await tryResolve(process.cwd());
+	if (fallback && !warnedBaseDirs.has(baseDir)) {
+		warnedBaseDirs.add(baseDir);
+		logger.warn(`No tsconfig found from "${baseDir}"; falling back to the tsconfig resolved from process.cwd(). Move (or extend) a tsconfig into this directory before v2, when this fallback will be removed.`);
+	}
+	return fallback;
+}
+async function tryResolve(dir) {
+	try {
+		return await resolveTSConfig(dir);
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+//#region src/cli/shared/virtual-entry.ts
+/**
+* Create an in-memory rolldown entry module with a deterministic ID.
+* @param name - Logical entry name
+* @param code - Entry module source
+* @param sourceType - Parser type for the generated module
+* @returns Rolldown input and plugin for loading the entry
+*/
+function createVirtualEntry(name, code, sourceType = "js") {
+	const input = `tailor-sdk-entry:${name}.${sourceType}`;
+	const resolvedId = `\0${input}`;
+	return {
+		input,
+		plugin: {
+			name: "tailor-sdk-virtual-entry",
+			resolveId(source, importer) {
+				return source === input && importer === void 0 ? resolvedId : null;
+			},
+			load(id) {
+				return id === resolvedId ? code : null;
+			}
+		}
+	};
+}
+
 //#endregion
 //#region src/cli/services/auth/bundler.ts
 /**
 * Bundle a single auth hook handler.
 *
 * Follows the same pattern as the executor bundler:
-* 1. Generate an entry file that re-exports the handler as `main`
+* 1. Generate an in-memory entry module that re-exports the handler as `main`
 * 2. Bundle with rolldown + tree-shaking
 * @param options - Bundle options
 * @returns Map of function name to bundled code
 */
 async function bundleAuthHooks(options) {
-	const { configPath, authName, handlerAccessPath, env = {}, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG" } = options;
+	const { configPath, authName, handlerAccessPath, env = {}, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", baseDir } = options;
 	logger.newline();
 	logger.log(`Bundling auth hook for ${styles.info(`"${authName}"`)}`);
-	const outputDir = path.resolve(getDistDir(), "auth-hooks");
-	fs$1.mkdirSync(outputDir, { recursive: true });
-	await removeStaleEntryFiles(outputDir);
-	let tsconfig;
-	try {
-		tsconfig = await resolveTSConfig();
-	} catch {
-		tsconfig = void 0;
-	}
-	const functionName = `auth-hook--${authName}--before-login`;
 	const absoluteConfigPath = path.resolve(configPath);
-	const serializedTriggerContext = serializeTriggerContext(triggerContext);
-	const sortedEnvPrefix = JSON.stringify(Object.fromEntries(Object.entries(env).toSorted(([a], [b]) => a.localeCompare(b))));
+	const tsconfig = await resolveTSConfigWithFallback(baseDir);
+	const functionName = `auth-hook--${authName}--before-login`;
 	const code = await withCache({
 		cache,
 		kind: "auth-hook",
@@ -2168,14 +2202,13 @@ async function bundleAuthHooks(options) {
 		sourceFile: absoluteConfigPath,
 		contextHash: computeBundlerContextHash({
 			sourceFile: absoluteConfigPath,
-			serializedTriggerContext,
+			serializedTriggerContext: serializeTriggerContext(triggerContext),
 			tsconfig,
 			inlineSourcemap,
 			bundleLogLevel,
-			prefix: sortedEnvPrefix
+			prefix: JSON.stringify(Object.fromEntries(Object.entries(env).toSorted(([a], [b]) => a.localeCompare(b))))
 		}),
 		async build(cachePlugins) {
-			const entryPath = path.join(outputDir, `${functionName}.entry.js`);
 			const entryContent = multiline`
         import _config from "${absoluteConfigPath}";
         const __auth_hook_function = _config.${handlerAccessPath};
@@ -2184,12 +2217,13 @@ async function bundleAuthHooks(options) {
           return await __auth_hook_function({ ...args, env });
         }
       `;
-			fs$1.writeFileSync(entryPath, entryContent);
+			const entry = createVirtualEntry(`auth-hook:${functionName}`, entryContent);
 			const triggerPlugin = createTriggerTransformPlugin(triggerContext);
-			const plugins = triggerPlugin ? [triggerPlugin] : [];
+			const plugins = [entry.plugin];
+			if (triggerPlugin) plugins.push(triggerPlugin);
 			plugins.push(platformBundleDefinePlugin, ...cachePlugins);
 			return (await rolldown.build({
-				input: entryPath,
+				input: entry.input,
 				write: false,
 				output: {
 					format: "esm",
@@ -2491,6 +2525,36 @@ function findOmittedPermitRules(rawPermissions) {
 	});
 	return locations;
 }
+/**
+* Check whether GraphQL exposure is fully disabled for a type, given its
+* effective gqlOperations (the type's own setting, falling back to the
+* TailorDB namespace default). `undefined` means the default of all
+* operations enabled, so it is never considered fully disabled.
+* @param gqlOperations - Effective, normalized gqlOperations configuration
+* @returns Whether create, update, delete, and read are all explicitly disabled
+*/
+function isGqlOperationsFullyDisabled(gqlOperations) {
+	if (!gqlOperations) return false;
+	return gqlOperations.create === false && gqlOperations.update === false && gqlOperations.delete === false && gqlOperations.read === false;
+}
+/**
+* Find missing permission configuration for a TailorDB type.
+*
+* Record-level permission is always required: TailorDB denies all record
+* operations for a type without it, regardless of whether the type is
+* exposed via GraphQL. GraphQL permission is required whenever GraphQL
+* exposure is enabled for the type (the default, unless every operation is
+* explicitly disabled via `gqlOperations`).
+* @param rawPermissions - Raw permissions definition for the type
+* @param effectiveGqlOperations - The type's own gqlOperations, falling back to the namespace default
+* @returns Which permission configuration, if any, is missing
+*/
+function findMissingPermissionConfig(rawPermissions, effectiveGqlOperations) {
+	return {
+		missingPermission: !rawPermissions.record,
+		missingGqlPermission: !rawPermissions.gql && !isGqlOperationsFullyDisabled(effectiveGqlOperations)
+	};
+}
 
 //#endregion
 //#region src/parser/service/tailordb/relation.ts
@@ -3311,7 +3375,7 @@ function buildMinimalEntryFromResolved(imports, declarations, fnSource, sourceFi
 	].join("\n");
 }
 async function bundleScriptTarget(args) {
-	const { fn, kind, sourceFilePath, sourceBindings, tempDir, targetIndex, tsconfig } = args;
+	const { fn, kind, sourceFilePath, sourceBindings, typeName, targetIndex, tsconfig } = args;
 	const context = `${kind} in ${sourceFilePath}`;
 	const fnSource = stringifyFunction(fn);
 	const inlineExpr = assertParsableExpression(`(${fnSource})({ value: _value, data: _data, user: ${tailorUserMap} })`, context);
@@ -3321,11 +3385,10 @@ async function bundleScriptTarget(args) {
 	if (unresolved.length > 0) throw new Error(`${context} captures unresolvable variables (${unresolved.join(", ")}). Hooks and validators must not reference variables that cannot be resolved from the source file.
   ${kind}: ${fnSource}`);
 	const entryContent = buildMinimalEntryFromResolved(imports, declarations, fnSource, sourceFilePath);
-	const entryPath = join(tempDir, `tailordb-script-${targetIndex}.entry.ts`);
-	writeFileSync(entryPath, entryContent);
+	const entry = createVirtualEntry(`tailordb-script:${typeName}:${targetIndex}`, entryContent, "ts");
 	const bundledCode = (await rolldown.build({
-		plugins: [platformBundleDefinePlugin],
-		input: entryPath,
+		plugins: [entry.plugin, platformBundleDefinePlugin],
+		input: entry.input,
 		write: false,
 		output: {
 			format: "cjs",
@@ -3355,27 +3418,18 @@ async function precompileTailorDBTypeScripts(type, sourceFilePath, tsconfig) {
 	const targets = collectScriptTargets(type);
 	if (targets.length === 0) return;
 	const sourceBindings = collectSourceBindings(sourceFilePath);
-	const tempDir = resolve(getDistDir(), "hooks-validate-scripts", type.name);
-	mkdirSync(tempDir, { recursive: true });
-	try {
-		const results = await Promise.allSettled(targets.map((target, index) => bundleScriptTarget({
-			fn: target.fn,
-			kind: target.kind,
-			sourceFilePath,
-			sourceBindings,
-			tempDir,
-			targetIndex: index,
-			tsconfig
-		})));
-		const firstError = results.find((r) => r.status === "rejected");
-		if (firstError) throw firstError.reason;
-		for (const [index, result] of results.entries()) if (result.status === "fulfilled") setPrecompiledScriptExpr(assertDefined(targets[index], `bundle target at index ${index} missing`).fn, result.value);
-	} finally {
-		rmSync(tempDir, {
-			recursive: true,
-			force: true
-		});
-	}
+	const results = await Promise.allSettled(targets.map((target, index) => bundleScriptTarget({
+		fn: target.fn,
+		kind: target.kind,
+		sourceFilePath,
+		sourceBindings,
+		typeName: type.name,
+		targetIndex: index,
+		tsconfig
+	})));
+	const firstError = results.find((r) => r.status === "rejected");
+	if (firstError) throw firstError.reason;
+	for (const [index, result] of results.entries()) if (result.status === "fulfilled") setPrecompiledScriptExpr(assertDefined(targets[index], `bundle target at index ${index} missing`).fn, result.value);
 }
 
 //#endregion
@@ -3505,7 +3559,7 @@ function formatTailorDBTypeNameSource(source) {
 * @returns A new TailorDBService instance
 */
 function createTailorDBService(params) {
-	const { namespace, config, pluginManager } = params;
+	const { namespace, config, pluginManager, baseDir } = params;
 	const createRawTypesByName = () => Object.create(null);
 	const rawTypes = Object.create(null);
 	let types = {};
@@ -3533,6 +3587,19 @@ function createTailorDBService(params) {
 			if (locations.length > 0) logger.warn(`TailorDB type "${typeName}" has permission rule(s) ${locations.join(", ")} in object form without an explicit "permit"; they default to "deny". Set permit: true (allow) or permit: false (deny) to silence this warning.`);
 		}
 	};
+	const validateRequiredPermissions = () => {
+		const errors = [];
+		for (const fileTypes of Object.values(rawTypes)) for (const [typeName, type] of Object.entries(fileTypes)) {
+			const effectiveGqlOperations = type.metadata.settings?.gqlOperations ?? config.gqlOperations;
+			const { missingPermission, missingGqlPermission } = findMissingPermissionConfig(type.metadata.permissions, effectiveGqlOperations);
+			if (!missingPermission && !missingGqlPermission) continue;
+			const source = formatTailorDBTypeSourceInfo(typeSourceInfo[typeName]);
+			const location = source ? ` (${source})` : "";
+			if (missingPermission) errors.push(`TailorDB type "${typeName}"${location} has no .permission() configured. TailorDB denies all record operations for types without permission; call .permission(...) to grant access explicitly.`);
+			if (missingGqlPermission) errors.push(`TailorDB type "${typeName}"${location} has no .gqlPermission() configured, but GraphQL operations are enabled for it. Call .gqlPermission(...) to grant GraphQL access explicitly, or disable GraphQL exposure with .features({ gqlOperations: { create: false, update: false, delete: false, read: false } }).`);
+		}
+		if (errors.length > 0) throw new Error(`TailorDB permission configuration errors in service "${namespace}":\n${errors.map((e) => `  - ${e}`).join("\n")}`);
+	};
 	/**
 	* Process plugins for a type and add generated types to rawTypes
 	* @param rawType - The raw TailorDB type being processed
@@ -3612,19 +3679,15 @@ function createTailorDBService(params) {
 		loadTypes: async () => {
 			if (!loadPromise) loadPromise = (async () => {
 				if (config.files.length === 0) return;
-				const typeFiles = [...new Set(loadFilesWithIgnores(config))];
-				let tsconfig;
-				try {
-					tsconfig = await resolveTSConfig();
-				} catch {
-					tsconfig = void 0;
-				}
+				const typeFiles = [...new Set(loadFilesWithIgnores(config, baseDir))];
+				const tsconfig = await resolveTSConfigWithFallback(baseDir);
 				logger.newline();
 				logger.log(`Found ${styles.highlight(typeFiles.length.toString())} type files for TailorDB service ${styles.highlight(`"${namespace}"`)}`);
 				if (pluginManager) for (const typeFile of typeFiles) await loadTypeFile(typeFile, tsconfig);
 				else await Promise.all(typeFiles.map((typeFile) => loadTypeFile(typeFile, tsconfig)));
 				doParseTypes();
 				warnOmittedPermit();
+				validateRequiredPermissions();
 				return types;
 			})();
 			return loadPromise;
@@ -3666,7 +3729,10 @@ function createTailorDBService(params) {
 				hasGeneratedTypes = true;
 				logger.log(`  Generated: ${styles.success(generatedType.name)} by namespace plugin ${styles.info(pluginId)}`);
 			}
-			if (hasGeneratedTypes || hadPreviousGeneratedTypes) doParseTypes();
+			if (hasGeneratedTypes || hadPreviousGeneratedTypes) {
+				doParseTypes();
+				validateRequiredPermissions();
+			}
 		}
 	};
 }
@@ -3753,9 +3819,31 @@ function resolveBundleConcurrency() {
 * @param worker - Async worker function
 * @returns Worker results in input order
 */
-function withBundleConcurrency(items, worker) {
-	const limit = pLimit(resolveBundleConcurrency());
-	return Promise.all(items.map((item) => limit(() => worker(item))));
+async function withBundleConcurrency(items, worker) {
+	const resultCount = items.length;
+	const workItems = items.flatMap((item, index) => [{
+		index,
+		item
+	}]);
+	const results = [];
+	results.length = resultCount;
+	let nextWorkIndex = 0;
+	let rejection;
+	const runWorker = async () => {
+		while (!rejection) {
+			const workItem = workItems[nextWorkIndex++];
+			if (workItem === void 0) return;
+			try {
+				results[workItem.index] = await worker(workItem.item);
+			} catch (reason) {
+				rejection ??= { reason };
+			}
+		}
+	};
+	const workerCount = Math.min(resolveBundleConcurrency(), workItems.length);
+	await Promise.all(Array.from({ length: workerCount }, runWorker));
+	if (rejection) throw rejection.reason;
+	return results;
 }
 
 //#endregion
@@ -3766,7 +3854,7 @@ function withBundleConcurrency(items, worker) {
 * Two delivery paths:
 * - Apply config: shipped with apply and evaluated by the platform before
 *   invoking user code.
-* - Bundle inline: interpolated into the generated `.entry.js` wrapper and
+* - Bundle inline: interpolated into the generated entry module and
 *   evaluated inside the bundled script at function entry.
 *
 * The user field mapping (server → SDK) shared across services is defined in
@@ -3851,15 +3939,15 @@ async function loadExecutor(executorFilePath) {
 * Bundle executors from the specified configuration
 *
 * This function:
-* 1. Creates entry file that extracts operation.body
+* 1. Creates an in-memory entry module that extracts operation.body
 * 2. Bundles in a single step with tree-shaking
 * @param options - Bundle executor options
 * @returns Map of executor name to bundled code
 */
 async function bundleExecutors(options) {
 	const bundledCode = /* @__PURE__ */ new Map();
-	const { config, triggerContext, additionalFiles = [], cache, inlineSourcemap, bundleLogLevel = "DEBUG" } = options;
-	const files = [...loadFilesWithIgnores(config), ...additionalFiles];
+	const { config, triggerContext, additionalFiles = [], cache, inlineSourcemap, bundleLogLevel = "DEBUG", baseDir } = options;
+	const files = [...loadFilesWithIgnores(config, baseDir), ...additionalFiles];
 	if (files.length === 0) {
 		logger.warn(`No executor files found for patterns: ${config.files.join(", ")}`);
 		return bundledCode;
@@ -3886,21 +3974,13 @@ async function bundleExecutors(options) {
 		logger.debug("  No function executors to bundle");
 		return bundledCode;
 	}
-	const outputDir = path.resolve(getDistDir(), "executors");
-	fs$1.mkdirSync(outputDir, { recursive: true });
-	await removeStaleEntryFiles(outputDir);
-	let tsconfig;
-	try {
-		tsconfig = await resolveTSConfig();
-	} catch {
-		tsconfig = void 0;
-	}
-	const results = await withBundleConcurrency(executors, (executor) => bundleSingleExecutor(executor, outputDir, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel));
+	const tsconfig = await resolveTSConfigWithFallback(baseDir);
+	const results = await withBundleConcurrency(executors, (executor) => bundleSingleExecutor(executor, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel));
 	for (const [name, code] of results) bundledCode.set(name, code);
 	logger.log(`${styles.success("Bundled")} ${styles.info("\"executor\"")}`);
 	return bundledCode;
 }
-async function bundleSingleExecutor(executor, outputDir, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+async function bundleSingleExecutor(executor, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
 	const serializedTriggerContext = serializeTriggerContext(triggerContext);
 	const contextHash = computeBundlerContextHash({
 		sourceFile: executor.sourceFile,
@@ -3916,7 +3996,6 @@ async function bundleSingleExecutor(executor, outputDir, tsconfig, triggerContex
 		sourceFile: executor.sourceFile,
 		contextHash,
 		async build(cachePlugins) {
-			const entryPath = path.join(outputDir, `${executor.name}.entry.js`);
 			const entryContent = multiline`
         import _internalExecutor from "${path.resolve(executor.sourceFile)}";
 
@@ -3927,12 +4006,13 @@ async function bundleSingleExecutor(executor, outputDir, tsconfig, triggerContex
 
         export { __executor_function as main };
       `;
-			fs$1.writeFileSync(entryPath, entryContent);
+			const entry = createVirtualEntry(`executor:${executor.name}`, entryContent);
 			const triggerPlugin = createTriggerTransformPlugin(triggerContext);
-			const plugins = triggerPlugin ? [triggerPlugin] : [];
+			const plugins = [entry.plugin];
+			if (triggerPlugin) plugins.push(triggerPlugin);
 			plugins.push(platformBundleDefinePlugin, ...cachePlugins);
 			return (await rolldown.build({
-				input: entryPath,
+				input: entry.input,
 				write: false,
 				output: {
 					format: "esm",
@@ -4004,31 +4084,25 @@ const GRAPHQL_WEB_MODULE = createRequire(import.meta.url).resolve("@0no-co/graph
 * IIFE defining a global `transform(input)` entry point. `input` gets a
 * generated dispatcher that routes by `req.method`; `output` is used as is.
 * @param adapters - Detected adapters to bundle
+* @param baseDir - Directory the owning config's tsconfig is resolved against
 * @param cache - Optional bundle cache for skipping unchanged builds
 * @param bundleLogLevel - Controls which console calls are kept in bundled code
 * @returns Bundled scripts keyed by adapter name
 */
-async function bundleHttpAdapters(adapters, cache, bundleLogLevel = "DEBUG") {
+async function bundleHttpAdapters(adapters, baseDir, cache, bundleLogLevel = "DEBUG") {
 	if (adapters.length === 0) return {
 		bundledInputs: /* @__PURE__ */ new Map(),
 		bundledOutputs: /* @__PURE__ */ new Map()
 	};
 	logger.newline();
 	logger.log(`Bundling ${styles.highlight(adapters.length.toString())} files for ${styles.info("\"http-adapter\"")}`);
-	const outputDir = path.resolve(getDistDir(), "http-adapters");
-	fs$1.mkdirSync(outputDir, { recursive: true });
-	let tsconfig;
-	try {
-		tsconfig = await resolveTSConfig();
-	} catch {
-		tsconfig = void 0;
-	}
+	const tsconfig = await resolveTSConfigWithFallback(baseDir);
 	const results = await withBundleConcurrency(adapters.flatMap((adapter) => {
 		return (adapter.hasOutput ? ["input", "output"] : ["input"]).map((kind) => ({
 			adapter,
 			kind
 		}));
-	}), ({ adapter, kind }) => bundleAdapterScript(adapter, kind, outputDir, tsconfig, cache, bundleLogLevel));
+	}), ({ adapter, kind }) => bundleAdapterScript(adapter, kind, tsconfig, cache, bundleLogLevel));
 	const bundledInputs = /* @__PURE__ */ new Map();
 	const bundledOutputs = /* @__PURE__ */ new Map();
 	for (const [name, kind, code] of results) if (kind === "input") bundledInputs.set(name, code);
@@ -4039,7 +4113,7 @@ async function bundleHttpAdapters(adapters, cache, bundleLogLevel = "DEBUG") {
 		bundledOutputs
 	};
 }
-async function bundleAdapterScript(adapter, kind, outputDir, tsconfig, cache, bundleLogLevel = "DEBUG") {
+async function bundleAdapterScript(adapter, kind, tsconfig, cache, bundleLogLevel = "DEBUG") {
 	const contextHash = computeBundlerContextHash({
 		sourceFile: adapter.sourceFile,
 		serializedTriggerContext: kind === "input" ? adapter.methods.join(",") : "",
@@ -4055,9 +4129,11 @@ async function bundleAdapterScript(adapter, kind, outputDir, tsconfig, cache, bu
 		sourceFile: adapter.sourceFile,
 		contextHash,
 		async build(cachePlugins) {
-			const entryPath = path.join(outputDir, `${adapter.name}.${kind}.entry.js`);
 			const absoluteSourcePath = path.resolve(adapter.sourceFile);
+			const entryContent = kind === "input" ? buildInputEntry(absoluteSourcePath, adapter.methods, GRAPHQL_WEB_MODULE) : buildOutputEntry(absoluteSourcePath);
+			const entry = createVirtualEntry(`http-adapter:${adapter.name}:${kind}`, entryContent);
 			const plugins = [
+				entry.plugin,
 				{
 					name: "http-adapter-reject-node-imports",
 					resolveId(source) {
@@ -4081,30 +4157,21 @@ async function bundleAdapterScript(adapter, kind, outputDir, tsconfig, cache, bu
 				},
 				...cachePlugins
 			];
-			let bundled;
-			try {
-				const entryContent = kind === "input" ? buildInputEntry(absoluteSourcePath, adapter.methods, GRAPHQL_WEB_MODULE) : buildOutputEntry(absoluteSourcePath);
-				fs$1.writeFileSync(entryPath, entryContent);
-				bundled = (await rolldown.build({
-					input: entryPath,
-					write: false,
-					output: {
-						format: "iife",
-						sourcemap: false,
-						minify: true,
-						codeSplitting: false
-					},
-					tsconfig,
-					plugins,
-					transform: { target: "es2017" },
-					treeshake: composeFunctionTreeshakeOptions([createLogLevelTreeshakeOptions(bundleLogLevel)]),
-					logLevel: "silent"
-				})).output[0].code;
-			} finally {
-				try {
-					fs$1.rmSync(entryPath, { force: true });
-				} catch {}
-			}
+			const bundled = (await rolldown.build({
+				input: entry.input,
+				write: false,
+				output: {
+					format: "iife",
+					sourcemap: false,
+					minify: true,
+					codeSplitting: false
+				},
+				tsconfig,
+				plugins,
+				transform: { target: "es2017" },
+				treeshake: composeFunctionTreeshakeOptions([createLogLevelTreeshakeOptions(bundleLogLevel)]),
+				logLevel: "silent"
+			})).output[0].code;
 			const byteLength = Buffer.byteLength(bundled, "utf8");
 			if (byteLength > ADAPTER_BUNDLE_ERROR_BYTES) throw new Error(`HTTP adapter "${adapter.name}" ${kind} script is ${byteLength} bytes, exceeding the ${ADAPTER_BUNDLE_ERROR_BYTES} byte limit`);
 			if (byteLength > ADAPTER_BUNDLE_WARN_BYTES) logger.warn(`HTTP adapter "${adapter.name}" ${kind} script is ${byteLength} bytes, larger than the recommended ${ADAPTER_BUNDLE_WARN_BYTES} byte limit`);
@@ -4178,7 +4245,7 @@ function rejectAsyncInBundle(code, adapterName, kind) {
 //#endregion
 //#region src/cli/services/http-adapter/service.ts
 function createHttpAdapterService(params) {
-	const { config } = params;
+	const { config, baseDir } = params;
 	let adapters = [];
 	let fileCount = 0;
 	let loaded = false;
@@ -4192,7 +4259,7 @@ function createHttpAdapterService(params) {
 		},
 		loadAdapters: async () => {
 			if (loaded) return;
-			const result = await loadAdapterFiles(config);
+			const result = await loadAdapterFiles(config, baseDir);
 			adapters = result.adapters;
 			fileCount = result.fileCount;
 			loaded = true;
@@ -4208,12 +4275,12 @@ function createHttpAdapterService(params) {
 		}
 	};
 }
-async function loadAdapterFiles(config) {
+async function loadAdapterFiles(config, baseDir) {
 	if (config.files.length === 0) return {
 		adapters: [],
 		fileCount: 0
 	};
-	const files = loadFilesWithIgnores(config);
+	const files = loadFilesWithIgnores(config, baseDir);
 	const loadResults = await Promise.all(files.map(loadAdapterFromFile));
 	const adapters = [];
 	const seenNames = /* @__PURE__ */ new Map();
@@ -4303,19 +4370,20 @@ async function loadResolver(resolverFilePath) {
 *
 * This function:
 * 1. Uses a transform plugin to add validation wrapper during bundling
-* 2. Creates entry file
+* 2. Creates an in-memory entry module
 * 3. Bundles in a single step with tree-shaking
 * @param namespace - Resolver namespace name
 * @param config - Resolver file loading configuration
+* @param baseDir - Directory the config's file patterns are resolved against
 * @param triggerContext - Trigger context for workflow/job transformations
 * @param cache - Optional bundle cache for skipping unchanged builds
 * @param inlineSourcemap - Whether to enable inline sourcemaps
 * @param bundleLogLevel - Controls which console calls are kept in bundled code
 * @returns Map of resolver name to bundled code
 */
-async function bundleResolvers(namespace, config, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+async function bundleResolvers(namespace, config, baseDir, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
 	const bundledCode = /* @__PURE__ */ new Map();
-	const files = loadFilesWithIgnores(config);
+	const files = loadFilesWithIgnores(config, baseDir);
 	if (files.length === 0) {
 		logger.warn(`No resolver files found for patterns: ${config.files.join(", ")}`);
 		return bundledCode;
@@ -4334,21 +4402,13 @@ async function bundleResolvers(namespace, config, triggerContext, cache, inlineS
 			sourceFile: file
 		});
 	}
-	const outputDir = path.resolve(getDistDir(), "resolvers");
-	fs$1.mkdirSync(outputDir, { recursive: true });
-	await removeStaleEntryFiles(outputDir);
-	let tsconfig;
-	try {
-		tsconfig = await resolveTSConfig();
-	} catch {
-		tsconfig = void 0;
-	}
-	const results = await withBundleConcurrency(resolvers, (resolver) => bundleSingleResolver(namespace, resolver, outputDir, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel));
+	const tsconfig = await resolveTSConfigWithFallback(baseDir);
+	const results = await withBundleConcurrency(resolvers, (resolver) => bundleSingleResolver(namespace, resolver, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel));
 	for (const [name, code] of results) bundledCode.set(name, code);
 	logger.log(`${styles.success("Bundled")} ${styles.info(`"${namespace}"`)}`);
 	return bundledCode;
 }
-async function bundleSingleResolver(namespace, resolver, outputDir, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+async function bundleSingleResolver(namespace, resolver, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
 	const serializedTriggerContext = serializeTriggerContext(triggerContext);
 	const contextHash = computeBundlerContextHash({
 		sourceFile: resolver.sourceFile,
@@ -4365,7 +4425,6 @@ async function bundleSingleResolver(namespace, resolver, outputDir, tsconfig, tr
 		sourceFile: resolver.sourceFile,
 		contextHash,
 		async build(cachePlugins) {
-			const entryPath = path.join(outputDir, `${resolver.name}.entry.js`);
 			const entryContent = multiline`
         import _internalResolver from "${path.resolve(resolver.sourceFile)}";
         import { t } from "@tailor-platform/sdk";
@@ -4392,12 +4451,13 @@ async function bundleSingleResolver(namespace, resolver, outputDir, tsconfig, tr
 
         export { $tailor_resolver_body as main };
       `;
-			fs$1.writeFileSync(entryPath, entryContent);
+			const entry = createVirtualEntry(`resolver:${resolver.name}`, entryContent);
 			const triggerPlugin = createTriggerTransformPlugin(triggerContext);
-			const plugins = triggerPlugin ? [triggerPlugin] : [];
+			const plugins = [entry.plugin];
+			if (triggerPlugin) plugins.push(triggerPlugin);
 			plugins.push(platformBundleDefinePlugin, ...cachePlugins);
 			return (await rolldown.build({
-				input: entryPath,
+				input: entry.input,
 				write: false,
 				output: {
 					format: "esm",
@@ -4421,9 +4481,10 @@ async function bundleSingleResolver(namespace, resolver, outputDir, tsconfig, tr
 * Creates a new ResolverService instance.
 * @param namespace - The namespace for this resolver service
 * @param config - The resolver service configuration
+* @param baseDir - Directory the config's file patterns are resolved against
 * @returns A new ResolverService instance
 */
-function createResolverService(namespace, config) {
+function createResolverService(namespace, config, baseDir) {
 	const resolvers = {};
 	const loadResolverForFile = async (resolverFile) => {
 		try {
@@ -4452,7 +4513,7 @@ function createResolverService(namespace, config) {
 		loadResolvers: async () => {
 			if (Object.keys(resolvers).length > 0) return;
 			if (config.files.length === 0) return;
-			const resolverFiles = loadFilesWithIgnores(config);
+			const resolverFiles = loadFilesWithIgnores(config, baseDir);
 			logger.log(`Found ${styles.highlight(resolverFiles.length.toString())} resolver files for service ${styles.highlight(`"${namespace}"`)}`);
 			await Promise.all(resolverFiles.map((resolverFile) => loadResolverForFile(resolverFile)));
 			assertUniqueResolverNames(resolvers, namespace);
@@ -4585,7 +4646,7 @@ function transformWorkflowSource(source, targetJobName, targetJobExportName, oth
 function safeRealpath(p) {
 	const resolved = path.resolve(p);
 	try {
-		return fs$1.realpathSync(resolved);
+		return fs.realpathSync(resolved);
 	} catch (e) {
 		logger.debug(`realpathSync failed for ${resolved}: ${e instanceof Error ? e.message : e}`);
 		return resolved;
@@ -4597,19 +4658,20 @@ function safeRealpath(p) {
 * This function:
 * 1. Detects which jobs are actually used (mainJobs + their dependencies)
 * 2. Uses a transform plugin to transform trigger calls during bundling
-* 3. Creates entry file and bundles with tree-shaking
+* 3. Creates an in-memory entry module and bundles with tree-shaking
 *
 * Returns metadata about which jobs each workflow uses.
 * @param allJobs - All available job infos
 * @param mainJobNames - Names of main jobs
 * @param env - Environment variables to inject
 * @param triggerContext - Trigger context for transformations
+* @param baseDir - Directory the owning config's tsconfig is resolved against
 * @param cache - Optional bundle cache for skipping unchanged builds
 * @param inlineSourcemap - Whether to enable inline sourcemaps
 * @param bundleLogLevel - Controls which console calls are kept in bundled code
 * @returns Workflow job bundling result
 */
-async function bundleWorkflowJobs(allJobs, mainJobNames, env = {}, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+async function bundleWorkflowJobs(allJobs, mainJobNames, env = {}, triggerContext, baseDir, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
 	if (allJobs.length === 0) {
 		logger.warn("No workflow jobs to bundle");
 		return {
@@ -4621,19 +4683,8 @@ async function bundleWorkflowJobs(allJobs, mainJobNames, env = {}, triggerContex
 	const { usedJobs, mainJobDeps } = await filterUsedJobs(allJobs, mainJobNames, triggerContext);
 	logger.newline();
 	logger.log(`Bundling ${styles.highlight(usedJobs.length.toString())} files for ${styles.info("\"workflow-job\"")}`);
-	const outputDir = path.resolve(getDistDir(), "workflow-jobs");
-	fs$1.mkdirSync(outputDir, { recursive: true });
-	const currentJobNames = new Set(usedJobs.map((j) => j.name));
-	const existingFiles = fs$1.readdirSync(outputDir);
-	for (const file of existingFiles) if (file.endsWith(".js") && !currentJobNames.has(path.basename(file, ".js"))) fs$1.rmSync(path.join(outputDir, file), { force: true });
-	else if (file.endsWith(".js.map") && !currentJobNames.has(path.basename(file, ".js.map"))) fs$1.rmSync(path.join(outputDir, file), { force: true });
-	let tsconfig;
-	try {
-		tsconfig = await resolveTSConfig();
-	} catch {
-		tsconfig = void 0;
-	}
-	const results = await withBundleConcurrency(usedJobs, (job) => bundleSingleJob(job, usedJobs, outputDir, tsconfig, env, triggerContext, cache, inlineSourcemap, bundleLogLevel));
+	const tsconfig = await resolveTSConfigWithFallback(baseDir);
+	const results = await withBundleConcurrency(usedJobs, (job) => bundleSingleJob(job, usedJobs, tsconfig, env, triggerContext, cache, inlineSourcemap, bundleLogLevel));
 	const bundledCode = /* @__PURE__ */ new Map();
 	for (const [name, code] of results) bundledCode.set(name, code);
 	logger.log(`${styles.success("Bundled")} ${styles.info("\"workflow-job\"")}`);
@@ -4669,7 +4720,7 @@ async function filterUsedJobs(allJobs, mainJobNames, triggerContext) {
 	const dependencies = /* @__PURE__ */ new Map();
 	const fileResults = await Promise.all(Array.from(jobsBySourceFile.entries()).map(async ([sourceFile, jobs]) => {
 		try {
-			const source = await fs$1.promises.readFile(sourceFile, "utf-8");
+			const source = await fs.promises.readFile(sourceFile, "utf-8");
 			const { program } = parseSync("input.ts", source);
 			const detectedJobs = findAllJobs(program, source);
 			const triggerCalls = detectResolvedTriggerCalls(program, source, triggerContext, sourceFile);
@@ -4709,7 +4760,7 @@ async function filterUsedJobs(allJobs, mainJobNames, triggerContext) {
 		mainJobDeps
 	};
 }
-async function bundleSingleJob(job, allJobs, outputDir, tsconfig, env, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+async function bundleSingleJob(job, allJobs, tsconfig, env, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
 	const serializedTriggerContext = serializeTriggerContext(triggerContext);
 	const sortedEnvPrefix = JSON.stringify(Object.fromEntries(Object.entries(env).toSorted(([a], [b]) => a.localeCompare(b))));
 	const contextHash = computeBundlerContextHash({
@@ -4727,7 +4778,6 @@ async function bundleSingleJob(job, allJobs, outputDir, tsconfig, env, triggerCo
 		sourceFile: job.sourceFile,
 		contextHash,
 		async build(cachePlugins) {
-			const entryPath = path.join(outputDir, `${job.name}.entry.js`);
 			const absoluteSourcePath = path.resolve(job.sourceFile);
 			const entryContent = multiline`
         import { ${job.exportName} } from "${absoluteSourcePath}";
@@ -4738,10 +4788,11 @@ async function bundleSingleJob(job, allJobs, outputDir, tsconfig, env, triggerCo
           return await ${job.exportName}.body(input, { env, invoker });
         }
       `;
-			fs$1.writeFileSync(entryPath, entryContent);
+			const entry = createVirtualEntry(`workflow-job:${job.name}`, entryContent);
 			const resolvedSourceFile = safeRealpath(job.sourceFile);
 			const otherJobExportNames = allJobs.filter((candidate) => candidate.name !== job.name && safeRealpath(candidate.sourceFile) === resolvedSourceFile).map((j) => j.exportName);
 			const plugins = [
+				entry.plugin,
 				{
 					name: "workflow-transform",
 					transform: {
@@ -4760,7 +4811,7 @@ async function bundleSingleJob(job, allJobs, outputDir, tsconfig, env, triggerCo
 				...cachePlugins
 			];
 			return (await rolldown.build({
-				input: entryPath,
+				input: entry.input,
 				write: false,
 				output: {
 					format: "esm",
@@ -4819,7 +4870,7 @@ const RetryPolicySchema = z.object({
 });
 const ConcurrencyPolicySchema = z.object({ maxConcurrentExecutions: z.number().int().min(1).max(1e3).describe("Maximum number of concurrent executions (1-1000)") });
 const ExecutionPolicyNameSchema = z.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/, "Invalid execution policy name: must match [a-z0-9-] (3-63 chars; must start and end with [a-z0-9])").describe("Workspace-unique execution policy name embedded in the resource TRN");
-const ExecutionPolicyKeySchema = z.string().regex(/^[a-z0-9][a-z0-9_:.-]{0,62}[a-z0-9*]$/, "Invalid execution policy key: must match [a-z0-9_:.-] (2-64 chars; must start with [a-z0-9] and end with [a-z0-9] or a trailing '*')").describe("Execution policy key passed to triggerJobFunction's executionPolicyKey option");
+const ExecutionPolicyKeySchema = z.string().regex(/^[a-z0-9][a-z0-9_:.-]{0,62}[a-z0-9*]$/, "Invalid execution policy key: must match [a-z0-9_:.-] (2-64 chars; must start with [a-z0-9] and end with [a-z0-9] or a trailing '*')").describe("Execution policy key passed to startJobFunction's (or its frozen alias triggerJobFunction's) executionPolicyKey option");
 const WorkflowJobFunctionExecutionPolicySchema = z.object({
 	name: ExecutionPolicyNameSchema,
 	key: ExecutionPolicyKeySchema,
@@ -4840,7 +4891,7 @@ const WorkflowSchema = z.object({
 * @returns A new WorkflowService instance
 */
 function createWorkflowService(params) {
-	const { config } = params;
+	const { config, baseDir } = params;
 	let workflows = {};
 	let workflowSources = [];
 	let jobs = [];
@@ -4862,7 +4913,7 @@ function createWorkflowService(params) {
 		},
 		loadWorkflows: async () => {
 			if (loaded) return;
-			const result = await loadAndCollectJobs(config);
+			const result = await loadAndCollectJobs(config, baseDir);
 			workflows = result.workflows;
 			workflowSources = result.workflowSources;
 			jobs = result.jobs;
@@ -4884,9 +4935,10 @@ function createWorkflowService(params) {
 * Load workflow files and collect all jobs in a single pass.
 * Dependencies are detected at bundle time via AST analysis.
 * @param config - Workflow service configuration
+* @param baseDir - Directory the config's file patterns are resolved against
 * @returns Loaded workflows and collected jobs
 */
-async function loadAndCollectJobs(config) {
+async function loadAndCollectJobs(config, baseDir) {
 	const workflows = {};
 	const workflowSources = [];
 	const collectedJobs = [];
@@ -4896,7 +4948,7 @@ async function loadAndCollectJobs(config) {
 		jobs: collectedJobs,
 		fileCount: 0
 	};
-	const workflowFiles = loadFilesWithIgnores(config);
+	const workflowFiles = loadFilesWithIgnores(config, baseDir);
 	const fileCount = workflowFiles.length;
 	const allJobsMap = /* @__PURE__ */ new Map();
 	const loadResults = await Promise.all(workflowFiles.map(async (workflowFile) => {
@@ -5198,7 +5250,7 @@ const StaticWebsiteSchema = z.object({
 
 //#endregion
 //#region src/cli/services/application.ts
-function defineTailorDB(config, pluginManager) {
+function defineTailorDB(config, baseDir, pluginManager) {
 	const tailorDBServices = [];
 	const externalTailorDBNamespaces = [];
 	const subgraphs = [];
@@ -5213,7 +5265,8 @@ function defineTailorDB(config, pluginManager) {
 			const tailorDB = createTailorDBService({
 				namespace,
 				config: TailorDBServiceConfigSchema.parse(serviceConfig),
-				pluginManager
+				pluginManager,
+				baseDir
 			});
 			tailorDBServices.push(tailorDB);
 		}
@@ -5228,7 +5281,7 @@ function defineTailorDB(config, pluginManager) {
 		subgraphs
 	};
 }
-function defineResolver(config) {
+function defineResolver(config, baseDir) {
 	const resolverServices = [];
 	const subgraphs = [];
 	if (!config) return {
@@ -5237,7 +5290,7 @@ function defineResolver(config) {
 	};
 	for (const [namespace, serviceConfig] of Object.entries(config)) {
 		if (!("external" in serviceConfig)) {
-			const resolverService = createResolverService(namespace, serviceConfig);
+			const resolverService = createResolverService(namespace, serviceConfig, baseDir);
 			resolverServices.push(resolverService);
 		}
 		subgraphs.push({
@@ -5293,17 +5346,26 @@ function defineAuth(config, tailorDBServices, externalTailorDBNamespaces) {
 		subgraphs
 	};
 }
-function defineExecutor(config, hasPluginExecutors) {
+function defineExecutor(config, baseDir, hasPluginExecutors) {
 	if (!config && !hasPluginExecutors) return;
-	return createExecutorService({ config: config ?? { files: [] } });
+	return createExecutorService({
+		config: config ?? { files: [] },
+		baseDir
+	});
 }
-function defineWorkflow(config) {
+function defineWorkflow(config, baseDir) {
 	if (!config) return;
-	return createWorkflowService({ config });
+	return createWorkflowService({
+		config,
+		baseDir
+	});
 }
-function defineHttpAdapterService(config) {
+function defineHttpAdapterService(config, baseDir) {
 	if (!config) return;
-	return createHttpAdapterService({ config });
+	return createHttpAdapterService({
+		config,
+		baseDir
+	});
 }
 function defineStaticWebsites(websites) {
 	const staticWebsiteServices = [];
@@ -5349,9 +5411,9 @@ function parseSecretManager(config) {
 		ignoreNullishValues
 	};
 }
-function defineServices(config, pluginManager) {
-	const tailordbResult = defineTailorDB(config.db, pluginManager);
-	const resolverResult = defineResolver(config.resolver);
+function defineServices(config, baseDir, pluginManager) {
+	const tailordbResult = defineTailorDB(config.db, baseDir, pluginManager);
+	const resolverResult = defineResolver(config.resolver, baseDir);
 	const idpResult = defineIdp(config.idp);
 	const authResult = defineAuth(config.auth, tailordbResult.tailorDBServices, tailordbResult.externalTailorDBNamespaces);
 	const staticWebsiteServices = defineStaticWebsites(config.staticWebsites);
@@ -5407,10 +5469,11 @@ function buildApplication(params) {
 */
 function defineApplication(params) {
 	const { config, pluginManager } = params;
-	const services = defineServices(config, pluginManager);
-	const executorService = defineExecutor(config.executor, false);
-	const workflowService = defineWorkflow(config.workflow);
-	const httpAdapterService = defineHttpAdapterService(config.httpAdapter);
+	const baseDir = path.dirname(config.path);
+	const services = defineServices(config, baseDir, pluginManager);
+	const executorService = defineExecutor(config.executor, baseDir, false);
+	const workflowService = defineWorkflow(config.workflow, baseDir);
+	const httpAdapterService = defineHttpAdapterService(config.httpAdapter, baseDir);
 	return buildApplication({
 		config,
 		...services,
@@ -5455,19 +5518,20 @@ function generatePluginFilesIfNeeded(pluginManager, tailorDBServices, configPath
 */
 async function loadApplication(params) {
 	const { config, pluginManager, bundleCache } = params;
-	const { tailordbResult, resolverResult, idpResult, authResult, staticWebsiteServices, aiGatewayServices, secrets, ignoreNullishValues } = defineServices(config, pluginManager);
+	const baseDir = path.dirname(config.path);
+	const { tailordbResult, resolverResult, idpResult, authResult, staticWebsiteServices, aiGatewayServices, secrets, ignoreNullishValues } = defineServices(config, baseDir, pluginManager);
 	for (const tailordb of tailordbResult.tailorDBServices) {
 		await tailordb.loadTypes();
 		await tailordb.processNamespacePlugins();
 	}
 	assertUniqueLocalTailorDBTypeNames({ tailorDBServices: tailordbResult.tailorDBServices });
 	const pluginExecutorFiles = generatePluginFilesIfNeeded(pluginManager, tailordbResult.tailorDBServices, config.path);
-	const executorService = defineExecutor(config.executor, pluginExecutorFiles.length > 0);
-	const workflowService = defineWorkflow(config.workflow);
+	const executorService = defineExecutor(config.executor, baseDir, pluginExecutorFiles.length > 0);
+	const workflowService = defineWorkflow(config.workflow, baseDir);
 	if (workflowService) await workflowService.loadWorkflows();
-	const httpAdapterService = defineHttpAdapterService(config.httpAdapter);
+	const httpAdapterService = defineHttpAdapterService(config.httpAdapter, baseDir);
 	if (httpAdapterService) await httpAdapterService.loadAdapters();
-	const triggerContext = await buildTriggerContext(config.workflow, authResult.authService?.config.name);
+	const triggerContext = await buildTriggerContext(config.workflow, authResult.authService?.config.name, baseDir);
 	const inlineSourcemap = resolveInlineSourcemap(config.inlineSourcemap);
 	const bundleLogLevel = resolveBundleLogLevel(config.logLevel);
 	const bundledScripts = {
@@ -5477,7 +5541,7 @@ async function loadApplication(params) {
 		authHooks: /* @__PURE__ */ new Map()
 	};
 	for (const pipeline of resolverResult.resolverServices) {
-		const resolverBundles = await bundleResolvers(pipeline.namespace, pipeline.config, triggerContext, bundleCache, inlineSourcemap, bundleLogLevel);
+		const resolverBundles = await bundleResolvers(pipeline.namespace, pipeline.config, baseDir, triggerContext, bundleCache, inlineSourcemap, bundleLogLevel);
 		for (const [name, code] of resolverBundles) bundledScripts.resolvers.set(resolverBundleKey(pipeline.namespace, name), code);
 	}
 	if (executorService) bundledScripts.executors = await bundleExecutors({
@@ -5486,12 +5550,13 @@ async function loadApplication(params) {
 		additionalFiles: [...pluginExecutorFiles],
 		cache: bundleCache,
 		inlineSourcemap,
-		bundleLogLevel
+		bundleLogLevel,
+		baseDir
 	});
 	let workflowBuildResult;
 	if (workflowService && workflowService.jobs.length > 0) {
 		const mainJobNames = workflowService.workflowSources.map((ws) => ws.workflow.mainJob.name);
-		workflowBuildResult = await bundleWorkflowJobs(workflowService.jobs, mainJobNames, config.env ?? {}, triggerContext, bundleCache, inlineSourcemap, bundleLogLevel);
+		workflowBuildResult = await bundleWorkflowJobs(workflowService.jobs, mainJobNames, config.env ?? {}, triggerContext, baseDir, bundleCache, inlineSourcemap, bundleLogLevel);
 		bundledScripts.workflowJobs = workflowBuildResult.bundledCode;
 	}
 	let httpAdapterBuildResult;
@@ -5500,7 +5565,7 @@ async function loadApplication(params) {
 		sourceFile: a.sourceFile,
 		methods: a.methods,
 		hasOutput: a.hasOutput
-	})), bundleCache, bundleLogLevel);
+	})), baseDir, bundleCache, bundleLogLevel);
 	if (authResult.authService?.config.hooks?.beforeLogin) {
 		const authName = authResult.authService.config.name;
 		bundledScripts.authHooks = await bundleAuthHooks({
@@ -5511,7 +5576,8 @@ async function loadApplication(params) {
 			triggerContext,
 			cache: bundleCache,
 			inlineSourcemap,
-			bundleLogLevel
+			bundleLogLevel,
+			baseDir
 		});
 	}
 	for (const pipeline of resolverResult.resolverServices) await pipeline.loadResolvers();
@@ -5545,5 +5611,5 @@ async function loadApplication(params) {
 }
 
 //#endregion
-export { fetchAllTolerant as A, initOperatorClient as B, createBundleCache as C, closeConnectionPool as D, hashFile as E, getConsoleBaseUrl as F, byName as G, normalizeBaseUrl as H, getOAuth2ClientId as I, LOG_LEVELS as K, getOrNull as L, fetchPaged as M, fetchPlatformMachineUserToken as N, defaultPlatformBaseUrl as O, fetchUserInfo as P, getPlatformBaseUrl as R, hasGenerationHooks as S, hashContent as T, rememberPlatformConfigForToken as U, isDefaultPlatform as V, resolveStaticWebsiteUrls as W, platformBundleDefinePlugin as _, resolveInlineSourcemap as a, resolveBundleLogLevel as b, ResolverSchema as c, buildExecutorArgsExpr as d, buildResolverOperationHookExpr as f, stringifyFunction as g, TailorDBTypeSchema as h, resolverBundleKey as i, fetchMachineUserToken as j, fetchAll as k, HTTP_METHODS as l, assertUniqueTailorDBTypeNamesWithExternal as m, generatePluginFilesIfNeeded as n, WorkflowJobFunctionExecutionPolicySchema as o, assertUniqueLocalTailorDBTypeNames as p, loadApplication as r, WorkflowJobSchema as s, defineApplication as t, INVOKER_EXPR as u, composeFunctionTreeshakeOptions as v, getDistDir as w, getPluginGenerationDependencies as x, createLogLevelTreeshakeOptions as y, initOAuth2Client as z };
-//# sourceMappingURL=application-CUxVA7Fs.mjs.map
+export { fetchAll as A, initOAuth2Client as B, hasGenerationHooks as C, hashFile as D, hashContent as E, fetchUserInfo as F, resolveStaticWebsiteUrls as G, isDefaultPlatform as H, getConsoleBaseUrl as I, LOG_LEVELS as J, byName as K, getOAuth2ClientId as L, fetchMachineUserToken as M, fetchPaged as N, closeConnectionPool as O, fetchPlatformMachineUserToken as P, getOrNull as R, getPluginGenerationDependencies as S, getDistDir as T, normalizeBaseUrl as U, initOperatorClient as V, rememberPlatformConfigForToken as W, resolveTSConfigWithFallback as _, resolveInlineSourcemap as a, createLogLevelTreeshakeOptions as b, ResolverSchema as c, buildExecutorArgsExpr as d, buildResolverOperationHookExpr as f, stringifyFunction as g, TailorDBTypeSchema as h, resolverBundleKey as i, fetchAllTolerant as j, defaultPlatformBaseUrl as k, HTTP_METHODS as l, assertUniqueTailorDBTypeNamesWithExternal as m, generatePluginFilesIfNeeded as n, WorkflowJobFunctionExecutionPolicySchema as o, assertUniqueLocalTailorDBTypeNames as p, createApplyLimiter as q, loadApplication as r, WorkflowJobSchema as s, defineApplication as t, INVOKER_EXPR as u, platformBundleDefinePlugin as v, createBundleCache as w, resolveBundleLogLevel as x, composeFunctionTreeshakeOptions as y, getPlatformBaseUrl as z };
+//# sourceMappingURL=application-C1d52JP9.mjs.map