@tailor-platform/sdk 1.78.0 → 1.80.0

package/dist/{runtime-BD2vYJFT.mjs → register-typescript-runtime-Bd4bcLbW.mjs}

@@ -1,9 +1,9 @@
-import { t as db } from "./schema-U6DxoZ8D.mjs";
+import { t as db } from "./schema-CYrle8JZ.mjs";
 import { $ as CreateAuthIDPConfigRequestSchema, A as CreatePipelineResolverRequestSchema, At as TenantProviderConfig_TenantProviderType, B as IdPPermissionOperator, Bt as CreateAIGatewayRequestSchema, C as UpdateStaticWebsiteRequestSchema, Ct as AuthOAuth2Client_ClientType, D as CreateSecretManagerVaultRequestSchema, Dt as AuthSCIMAttribute_Uniqueness, E as CreateSecretManagerSecretRequestSchema, Et as AuthSCIMAttribute_Type, F as PipelineResolver_OperationType, Ft as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, G as CreateExecutorExecutorRequestSchema, Gt as ConditionSchema, H as FunctionExecution_Status, I as CreateIdPServiceRequestSchema, It as UpdateApplicationRequestSchema, J as ExecutorJobStatus, Jt as PageDirection, K as UpdateExecutorExecutorRequestSchema, Kt as Condition_Operator, L as UpdateIdPServiceRequestSchema, M as UpdatePipelineResolverRequestSchema, N as UpdatePipelineServiceRequestSchema, O as UpdateSecretManagerSecretRequestSchema, Ot as AuthSCIMConfig_AuthorizationType, Pt as CreateApplicationRequestSchema, Q as CreateAuthHookRequestSchema, Rt as ApplicationSchemaUpdateAttemptStatus, S as CreateStaticWebsiteRequestSchema, St as AuthInvokerSchema, Tt as AuthSCIMAttribute_Mutability, V as IdPPermissionPermit, Vt as UpdateAIGatewayRequestSchema, X as ExecutorTriggerType, Y as ExecutorTargetType, Z as CreateAuthConnectionRequestSchema, _ as TailorDBGQLPermission_Permit, a as CreateWorkflowRequestSchema, at as CreateTenantConfigRequestSchema, b as TailorDBType_PermitAction, bt as AuthHookPoint, ct as UpdateAuthHookRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as UpdateAuthOAuth2ClientRequestSchema, et as CreateAuthMachineUserRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as UpdateAuthSCIMConfigRequestSchema, g as TailorDBGQLPermission_Operator, gt as UpdateUserProfileConfigRequestSchema, h as TailorDBGQLPermission_Action, ht as UpdateTenantConfigRequestSchema, i as CreateWorkflowJobFunctionRequestSchema, it as CreateAuthServiceRequestSchema, j as CreatePipelineServiceRequestSchema, jt as UserProfileProviderConfig_UserProfileProviderType, l as WorkflowExecution_Status, lt as UpdateAuthIDPConfigRequestSchema, mt as UpdateAuthServiceRequestSchema, nt as CreateAuthSCIMConfigRequestSchema, o as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as CreateUserProfileConfigRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as UpdateAuthSCIMResourceRequestSchema, qt as FilterSchema, r as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, rt as CreateAuthSCIMResourceRequestSchema, s as UpdateWorkflowRequestSchema, st as UpdateAuthConnectionRequestSchema, t as WorkspacePlatformUserRole, tt as CreateAuthOAuth2ClientRequestSchema, u as WorkflowJobExecution_Status, ut as UpdateAuthMachineUserRequestSchema, v as TailorDBType_Permission_Operator, vt as AuthConnection_Status, wt as AuthOAuth2Client_GrantType, x as AddCustomDomainRequestSchema, xt as AuthIDPConfig_AuthType, y as TailorDBType_Permission_Permit, yt as AuthConnection_Type, z as IdPLang, zt as Subgraph_ServiceType } from "./workspace_resource_pb-Db3fv68L.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
 import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-BwS4ppwO.mjs";
-import { A as fetchAllTolerant, B as initOperatorClient, C as createBundleCache, E as hashFile, F as getConsoleBaseUrl, G as byName, H as normalizeBaseUrl, I as getOAuth2ClientId, K as LOG_LEVELS, L as getOrNull, M as fetchPaged, O as defaultPlatformBaseUrl, R as getPlatformBaseUrl, S as hasGenerationHooks, T as hashContent, U as rememberPlatformConfigForToken, V as isDefaultPlatform, W as resolveStaticWebsiteUrls, _ as platformBundleDefinePlugin, d as buildExecutorArgsExpr, f as buildResolverOperationHookExpr, g as stringifyFunction, h as TailorDBTypeSchema, i as resolverBundleKey, j as fetchMachineUserToken, k as fetchAll, l as HTTP_METHODS, m as assertUniqueTailorDBTypeNamesWithExternal, n as generatePluginFilesIfNeeded, o as WorkflowJobFunctionExecutionPolicySchema, p as assertUniqueLocalTailorDBTypeNames, r as loadApplication, t as defineApplication, w as getDistDir, x as getPluginGenerationDependencies, z as initOAuth2Client } from "./application-CUxVA7Fs.mjs";
-import { o as loadFilesWithIgnores, s as functionSchema, t as createExecutorService } from "./service-D12iQGcS.mjs";
+import { A as fetchAll, B as initOAuth2Client, C as hasGenerationHooks, D as hashFile, E as hashContent, G as resolveStaticWebsiteUrls, H as isDefaultPlatform, I as getConsoleBaseUrl, J as LOG_LEVELS, K as byName, L as getOAuth2ClientId, M as fetchMachineUserToken, N as fetchPaged, R as getOrNull, S as getPluginGenerationDependencies, T as getDistDir, U as normalizeBaseUrl, V as initOperatorClient, W as rememberPlatformConfigForToken, _ as resolveTSConfigWithFallback, d as buildExecutorArgsExpr, f as buildResolverOperationHookExpr, g as stringifyFunction, h as TailorDBTypeSchema, i as resolverBundleKey, j as fetchAllTolerant, k as defaultPlatformBaseUrl, l as HTTP_METHODS, m as assertUniqueTailorDBTypeNamesWithExternal, n as generatePluginFilesIfNeeded, o as WorkflowJobFunctionExecutionPolicySchema, p as assertUniqueLocalTailorDBTypeNames, q as createApplyLimiter, r as loadApplication, t as defineApplication, v as platformBundleDefinePlugin, w as createBundleCache, z as getPlatformBaseUrl } from "./application-C1d52JP9.mjs";
+import { o as loadFilesWithIgnores, s as functionSchema, t as createExecutorService } from "./service-CDPatibu.mjs";
 import { n as enumConstantsPlugin, t as EnumConstantsGeneratorID } from "./enum-constants-j9QBF0cB.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { n as fileUtilsPlugin, t as FileUtilsGeneratorID } from "./file-utils-DcyIPFQh.mjs";
@@ -14,11 +14,12 @@ import { t as userAgent } from "./user-agent-DX2Jnw0-.mjs";
 import { r as isCLIError, t as createCLIError } from "./errors-DVFS0AZk.mjs";
 import { n as tightenSecretFilePermissions, r as writeSecretFile } from "./secret-file-DBqZhjFQ.mjs";
 import { r as withSpan } from "./telemetry-CdqJEzkj.mjs";
+import * as mod from "node:module";
 import { arg, createDefineCommand, defineCommand, runCommand } from "politty";
 import { z } from "zod";
 import { create, fromJson, toJson } from "@bufbuild/protobuf";
 import * as fs$1 from "node:fs";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, renameSync, rmSync, statSync, utimesSync, writeFileSync } from "node:fs";
 import { parseEnv } from "node:util";
 import { ValueSchema, timestampDate } from "@bufbuild/protobuf/wkt";
 import * as path from "pathe";
@@ -34,17 +35,16 @@ import { lt } from "semver";
 import { xdgConfig } from "xdg-basedir";
 import { Code, ConnectError } from "@connectrpc/connect";
 import pLimit from "p-limit";
-import { resolveTSConfig } from "pkg-types";
 import * as crypto$1 from "node:crypto";
 import { createHash, randomUUID } from "node:crypto";
 import { ExitPromptError } from "@inquirer/core";
 import { confirm, input, password, select } from "@inquirer/prompts";
 import { isCI } from "std-env";
 import * as rolldown from "rolldown";
-import * as fs from "node:fs/promises";
-import { glob, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { parseSync } from "oxc-parser";
 import * as inflection from "inflection";
+import * as fs from "node:fs/promises";
+import { glob, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { pathToString } from "@bufbuild/protobuf/reflect";
 import { createValidator } from "@bufbuild/protovalidate";
 import { setTimeout as setTimeout$1 } from "timers/promises";
@@ -1444,6 +1444,54 @@ function createCacheManager(options) {
 	};
 }
 
+//#endregion
+//#region src/cli/services/stale-cleanup.ts
+const legacyBundleDirectories = [
+	{
+		name: "resolvers",
+		suffixes: [".entry.js"]
+	},
+	{
+		name: "executors",
+		suffixes: [".entry.js"]
+	},
+	{
+		name: "workflow-jobs",
+		suffixes: [".js", ".js.map"]
+	},
+	{
+		name: "auth-hooks",
+		suffixes: [".entry.js"]
+	},
+	{
+		name: "http-adapters",
+		suffixes: [".entry.js"]
+	}
+];
+/**
+* Remove bundle artifacts created by SDK versions that used disk-backed entries.
+*
+* Concurrent callers are safe because current bundlers no longer create files
+* in these directories and each removal uses `force: true`.
+* @param outputRoot - SDK output directory
+*/
+async function removeLegacyBundleFiles(outputRoot) {
+	await Promise.all([...legacyBundleDirectories.map(({ name, suffixes }) => removeMatchingFiles(path.join(outputRoot, name), suffixes)), fs.rm(path.join(outputRoot, "hooks-validate-scripts"), {
+		recursive: true,
+		force: true
+	})]);
+}
+async function removeMatchingFiles(outputDir, suffixes) {
+	let files;
+	try {
+		files = await fs.readdir(outputDir);
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+	for (const file of files) if (suffixes.some((suffix) => file.endsWith(suffix))) await fs.rm(path.join(outputDir, file), { force: true });
+}
+
 //#endregion
 //#region src/cli/shared/type-generator.ts
 /**
@@ -1467,7 +1515,7 @@ function extractAttributesFromConfig(config) {
 * @returns Generated type definition source
 */
 function generateTypeDefinition(attributeMap, attributeList, env, machineUserNames, idpNames, connectionNames, aiGatewayNames) {
-	const mapFields = attributeMap ? Object.entries(attributeMap).map(([key, value]) => `    ${key}: ${value};`).join("\n") : "";
+	const mapFields = attributeMap ? Object.entries(attributeMap).map(([key, { type, optional }]) => `    ${key}${optional ? "?" : ""}: ${type};`).join("\n") : "";
 	const mapBody = !attributeMap || Object.keys(attributeMap).length === 0 ? "{}" : `{
 ${mapFields}
   }`;
@@ -1530,12 +1578,15 @@ function collectAttributesFromConfig(config) {
 	const inferAttributeType = (field) => {
 		const type = field?.type;
 		const metadata = field?.metadata;
-		if (!metadata) return "string";
+		if (!metadata) return { type: "string" };
 		let typeStr = "string";
 		if (type === "boolean") typeStr = "boolean";
 		else if (type === "enum" && metadata.allowedValues) typeStr = metadata.allowedValues.map((v) => `"${v.value}"`).join(" | ");
 		if (metadata.array) typeStr += "[]";
-		return typeStr;
+		return {
+			type: typeStr,
+			optional: metadata.required === false
+		};
 	};
 	if ("userProfile" in auth) {
 		const userProfile = auth.userProfile;
@@ -2850,12 +2901,16 @@ function protoSubgraph(subgraph) {
 
 //#endregion
 //#region src/cli/commands/deploy/secrets-state.ts
+const SecretsStateEntrySchema = z.object({
+	hash: z.string(),
+	updateTime: z.string().optional()
+});
 const SecretsStateSchema = z.object({
-	vaults: z.record(z.string(), z.record(z.string(), z.string())),
+	vaults: z.record(z.string(), z.record(z.string(), SecretsStateEntrySchema)),
 	connections: z.record(z.string(), z.string()).optional()
 });
 const PersistedSecretsStateSchema = z.object({
-	version: z.literal(1),
+	version: z.literal(2),
 	workspaceId: z.string(),
 	applicationKey: z.string(),
 	state: SecretsStateSchema
@@ -2901,12 +2956,14 @@ function saveSecretsState(scope, state) {
 	if (!scope.applicationId) return;
 	const filePath = getSecretsStatePath(scope);
 	mkdirSync(path.dirname(filePath), { recursive: true });
-	writeFileSync(filePath, JSON.stringify({
-		version: 1,
+	const tempPath = `${filePath}.tmp-${randomUUID()}`;
+	writeFileSync(tempPath, JSON.stringify({
+		version: 2,
 		workspaceId: scope.workspaceId,
 		applicationKey: applicationStateKey(scope),
 		state
 	}, null, 2), "utf-8");
+	renameSync(tempPath, filePath);
 }
 /**
 * Compute SHA-256 hex digest of a value.
@@ -2916,6 +2973,133 @@ function saveSecretsState(scope, state) {
 function hashValue(value) {
 	return createHash("sha256").update(value).digest("hex");
 }
+/**
+* Serialize a platform timestamp into the string stored as update evidence.
+* @param updateTime - Timestamp from a Secret Manager list or mutation response
+* @returns Serialized timestamp, or undefined when the platform sent none
+*/
+function serializeUpdateTime(updateTime) {
+	return updateTime === void 0 ? void 0 : `${updateTime.seconds}.${updateTime.nanos}`;
+}
+const LOCK_POLL_INTERVAL_MS = 100;
+const LOCK_ACQUIRE_TIMEOUT_MS = 300 * 1e3;
+const LOCK_HEARTBEAT_INTERVAL_MS = 10 * 1e3;
+const LOCK_LEASE_MS = 60 * 1e3;
+const lockQueues = /* @__PURE__ */ new Map();
+/**
+* Run a remote-update/state-save sequence exclusively for one target's secrets state.
+*
+* Serializes concurrent deploys to the same workspace and application (across
+* processes sharing the same output directory) so the persisted hash state
+* always reflects the last remote write.
+* @param scope - Workspace and application identity for the deployment
+* @param fn - Critical section performing remote updates and the state save
+* @returns The value returned by fn
+*/
+async function withSecretsStateLock(scope, fn) {
+	if (!scope.applicationId) return fn();
+	const lockPath = `${getSecretsStatePath(scope)}.lock`;
+	let queue = lockQueues.get(lockPath);
+	if (!queue) {
+		queue = pLimit(1);
+		lockQueues.set(lockPath, queue);
+	}
+	return queue(async () => {
+		const token = await acquireFileLock(lockPath);
+		const heartbeat = setInterval(() => refreshLock(lockPath, token), LOCK_HEARTBEAT_INTERVAL_MS);
+		heartbeat.unref();
+		try {
+			return await fn();
+		} finally {
+			clearInterval(heartbeat);
+			releaseFileLock(lockPath, token);
+		}
+	});
+}
+async function acquireFileLock(lockPath) {
+	mkdirSync(path.dirname(lockPath), { recursive: true });
+	const token = randomUUID();
+	const deadline = Date.now() + LOCK_ACQUIRE_TIMEOUT_MS;
+	for (;;) {
+		let created = true;
+		try {
+			mkdirSync(lockPath);
+		} catch (error) {
+			if (error.code !== "EEXIST") throw error;
+			created = false;
+		}
+		if (created) {
+			try {
+				writeFileSync(path.join(lockPath, "owner.json"), JSON.stringify({
+					pid: process.pid,
+					token
+				}));
+			} catch (error) {
+				rmSync(lockPath, {
+					recursive: true,
+					force: true
+				});
+				throw error;
+			}
+			return token;
+		}
+		if (isLockExpired(lockPath) && stealLock(lockPath)) continue;
+		if (Date.now() >= deadline) throw new Error("Timed out waiting for another deploy to the same workspace and application to finish. Wait for it to complete and retry; an interrupted deploy recovers automatically within a minute.");
+		await new Promise((resolve) => setTimeout(resolve, LOCK_POLL_INTERVAL_MS));
+	}
+}
+function isLockExpired(lockPath) {
+	try {
+		return Date.now() - statSync(lockPath).mtimeMs > LOCK_LEASE_MS;
+	} catch {
+		return false;
+	}
+}
+function readLockToken(lockPath) {
+	try {
+		return JSON.parse(readFileSync(path.join(lockPath, "owner.json"), "utf-8")).token;
+	} catch {
+		return;
+	}
+}
+function refreshLock(lockPath, token) {
+	if (readLockToken(lockPath) !== token) return;
+	const now = /* @__PURE__ */ new Date();
+	try {
+		utimesSync(lockPath, now, now);
+	} catch {}
+}
+function releaseFileLock(lockPath, token) {
+	if (readLockToken(lockPath) !== token) return;
+	rmSync(lockPath, {
+		recursive: true,
+		force: true
+	});
+}
+function stealLock(lockPath) {
+	const trash = `${lockPath}.stale-${process.pid}-${Date.now()}`;
+	try {
+		renameSync(lockPath, trash);
+	} catch {
+		return false;
+	}
+	if (isLockExpired(trash)) {
+		rmSync(trash, {
+			recursive: true,
+			force: true
+		});
+		return true;
+	}
+	try {
+		renameSync(trash, lockPath);
+	} catch {
+		rmSync(trash, {
+			recursive: true,
+			force: true
+		});
+	}
+	return false;
+}
 
 //#endregion
 //#region src/cli/commands/deploy/auth-connection.ts
@@ -3074,44 +3258,44 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 async function applyAuthConnections(client, result, phase) {
 	const { changeSet, stateScope } = result;
 	if (phase === "create-update") {
-		await Promise.all(changeSet.creates.map(async (create) => {
-			await client.createAuthConnection(create.request);
-			await client.setMetadata(create.metaRequest);
-			logger.info(`Connection "${create.name}" was created. Authorize it with:\n  tailor-sdk authconnection authorize --name ${create.name}\nOr via the Console: tailor-sdk authconnection open`);
-		}));
-		for (const replace of changeSet.replaces) {
-			if ((await client.updateAuthConnection(replace.updateRequest)).connection?.status === AuthConnection_Status.UNAUTHORIZED) logger.warn(`Connection "${replace.name}" requires re-authorization. Authorize with:\n  tailor-sdk authconnection authorize --name ${replace.name}\nOr via the Console: tailor-sdk authconnection open`);
-			await client.setMetadata(replace.metaRequest);
-		}
+		if (changeSet.creates.length > 0 || changeSet.replaces.length > 0) await withSecretsStateLock(stateScope, async () => {
+			await Promise.all(changeSet.creates.map(async (create) => {
+				await client.createAuthConnection(create.request);
+				await client.setMetadata(create.metaRequest);
+				logger.info(`Connection "${create.name}" was created. Authorize it with:\n  tailor-sdk authconnection authorize --name ${create.name}\nOr via the Console: tailor-sdk authconnection open`);
+			}));
+			for (const replace of changeSet.replaces) {
+				if ((await client.updateAuthConnection(replace.updateRequest)).connection?.status === AuthConnection_Status.UNAUTHORIZED) logger.warn(`Connection "${replace.name}" requires re-authorization. Authorize with:\n  tailor-sdk authconnection authorize --name ${replace.name}\nOr via the Console: tailor-sdk authconnection open`);
+				await client.setMetadata(replace.metaRequest);
+			}
+			const secretReplaces = changeSet.replaces.filter((replace) => replace.updateRequest.updateMask?.paths?.includes("oauth2.client_secret"));
+			if (changeSet.creates.length > 0 || secretReplaces.length > 0) {
+				const state = loadSecretsState(stateScope);
+				if (!state.connections) state.connections = {};
+				for (const create of changeSet.creates) {
+					const conn = create.request.connection;
+					if (conn?.config?.case === "oauth2") state.connections[create.name] = hashValue(conn.config.value.clientSecret ?? "");
+				}
+				for (const replace of secretReplaces) {
+					const conn = replace.updateRequest.connection;
+					if (conn?.config?.case === "oauth2") state.connections[replace.name] = hashValue(conn.config.value.clientSecret ?? "");
+				}
+				saveSecretsState(stateScope, state);
+			}
+		});
 		await Promise.all(changeSet.updates.map(async (update) => {
 			await client.setMetadata(update.metaRequest);
 		}));
-		const secretReplaces = changeSet.replaces.filter((replace) => replace.updateRequest.updateMask?.paths?.includes("oauth2.client_secret"));
-		if (changeSet.creates.length > 0 || secretReplaces.length > 0) {
-			const state = loadSecretsState(stateScope);
-			if (!state.connections) state.connections = {};
-			for (const create of changeSet.creates) {
-				const conn = create.request.connection;
-				if (conn?.config?.case === "oauth2") state.connections[create.name] = hashValue(conn.config.value.clientSecret ?? "");
-			}
-			for (const replace of secretReplaces) {
-				const conn = replace.updateRequest.connection;
-				if (conn?.config?.case === "oauth2") state.connections[replace.name] = hashValue(conn.config.value.clientSecret ?? "");
-			}
-			saveSecretsState(stateScope, state);
-		}
-	} else {
+	} else if (changeSet.deletes.length > 0) await withSecretsStateLock(stateScope, async () => {
 		await Promise.all(changeSet.deletes.map(async (del) => {
 			await client.deleteAuthConnection(del.request);
 		}));
-		if (changeSet.deletes.length > 0) {
-			const state = loadSecretsState(stateScope);
-			if (state.connections) {
-				for (const del of changeSet.deletes) delete state.connections[del.name];
-				saveSecretsState(stateScope, state);
-			}
+		const state = loadSecretsState(stateScope);
+		if (state.connections) {
+			for (const del of changeSet.deletes) delete state.connections[del.name];
+			saveSecretsState(stateScope, state);
 		}
-	}
+	});
 }
 
 //#endregion
@@ -3424,14 +3608,14 @@ async function uploadFunctionScript(client, workspaceId, entry, isCreate) {
 async function applyFunctionRegistry(client, workspaceId, result, phase = "create-update") {
 	const { changeSet } = result;
 	if (phase === "create-update") {
-		for (const create of changeSet.creates) {
+		const limitFunction = createApplyLimiter();
+		await Promise.all([...changeSet.creates.map((create) => limitFunction(async () => {
 			await uploadFunctionScript(client, workspaceId, create.entry, true);
 			await client.setMetadata(create.metaRequest);
-		}
-		for (const update of changeSet.updates) {
+		})), ...changeSet.updates.map((update) => limitFunction(async () => {
 			await uploadFunctionScript(client, workspaceId, update.entry, false);
 			await client.setMetadata(update.metaRequest);
-		}
+		}))]);
 	} else await Promise.all(changeSet.deletes.map((del) => client.deleteFunctionRegistry({
 		workspaceId: del.workspaceId,
 		name: del.name
@@ -6276,17 +6460,20 @@ async function planSecretManager(context) {
 			name: vaultName,
 			workspaceId
 		});
-		let existingSecrets = [];
-		if (existing) existingSecrets = (await fetchAllTolerant(async (pageToken, maxPageSize) => {
-			const { secrets, nextPageToken } = await client.listSecretManagerSecrets({
-				workspaceId,
-				secretmanagerVaultName: vaultName,
-				pageToken,
-				pageSize: maxPageSize
+		const existingSecretTimes = /* @__PURE__ */ new Map();
+		if (existing) {
+			const secrets = await fetchAllTolerant(async (pageToken, maxPageSize) => {
+				const { secrets, nextPageToken } = await client.listSecretManagerSecrets({
+					workspaceId,
+					secretmanagerVaultName: vaultName,
+					pageToken,
+					pageSize: maxPageSize
+				});
+				return [secrets, nextPageToken];
 			});
-			return [secrets, nextPageToken];
-		})).map((s) => s.name);
-		const existingSet = new Set(existingSecrets);
+			for (const secret of secrets) existingSecretTimes.set(secret.name, serializeUpdateTime(secret.updateTime));
+		}
+		const existingSet = new Set(existingSecretTimes.keys());
 		for (const secret of vault.secrets) {
 			if (secret.value == null) {
 				existingSet.delete(secret.name);
@@ -6294,9 +6481,10 @@ async function planSecretManager(context) {
 				continue;
 			}
 			if (existingSet.has(secret.name)) {
-				const currentHash = hashValue(secret.value);
-				const storedHash = state.vaults[vaultName]?.[secret.name];
-				if (forceApplyAll || currentHash !== storedHash) secretChangeSet.updates.push({
+				const stored = state.vaults[vaultName]?.[secret.name];
+				const remoteUpdateTime = existingSecretTimes.get(secret.name);
+				const unchanged = stored !== void 0 && stored.hash === hashValue(secret.value) && stored.updateTime !== void 0 && stored.updateTime === remoteUpdateTime;
+				if (forceApplyAll || !unchanged) secretChangeSet.updates.push({
 					name: `${vaultName}/${secret.name}`,
 					secretName: secret.name,
 					workspaceId,
@@ -6389,18 +6577,31 @@ async function applySecretManager(client, result, phase = "create-update", appli
 			});
 			await client.setMetadata(metaRequest);
 		}));
-		await Promise.all(secretChangeSet.creates.map((create) => client.createSecretManagerSecret(secretCreateRequest(create))));
-		await Promise.all(secretChangeSet.updates.map((update) => client.updateSecretManagerSecret(secretUpdateRequest(update))));
 		const secretHashUpdates = [...secretChangeSet.creates, ...secretChangeSet.updates];
-		if (application && secretHashUpdates.length > 0) {
-			const state = loadSecretsState(stateScope);
-			for (const secret of secretHashUpdates) {
-				if (!Object.hasOwn(state.vaults, secret.vaultName)) state.vaults[secret.vaultName] = {};
-				assertDefined(state.vaults[secret.vaultName], "vault state entry missing")[secret.secretName] = hashValue(secret.value);
+		if (secretHashUpdates.length > 0) await withSecretsStateLock(stateScope, async () => {
+			const appliedUpdateTimes = /* @__PURE__ */ new Map();
+			await Promise.all(secretChangeSet.creates.map(async (create) => {
+				const response = await client.createSecretManagerSecret(secretCreateRequest(create));
+				appliedUpdateTimes.set(create.name, serializeUpdateTime(response.secret?.updateTime));
+			}));
+			await Promise.all(secretChangeSet.updates.map(async (update) => {
+				const response = await client.updateSecretManagerSecret(secretUpdateRequest(update));
+				appliedUpdateTimes.set(update.name, serializeUpdateTime(response.secret?.updateTime));
+			}));
+			if (application) {
+				const state = loadSecretsState(stateScope);
+				for (const secret of secretHashUpdates) {
+					if (!Object.hasOwn(state.vaults, secret.vaultName)) state.vaults[secret.vaultName] = {};
+					const updateTime = appliedUpdateTimes.get(secret.name);
+					assertDefined(state.vaults[secret.vaultName], "vault state entry missing")[secret.secretName] = {
+						hash: hashValue(secret.value),
+						...updateTime === void 0 ? {} : { updateTime }
+					};
+				}
+				saveSecretsState(stateScope, state);
 			}
-			saveSecretsState(stateScope, state);
-		}
-	} else {
+		});
+	} else if (secretChangeSet.deletes.length > 0 || vaultChangeSet.deletes.length > 0) await withSecretsStateLock(stateScope, async () => {
 		await Promise.all(secretChangeSet.deletes.map((del) => client.deleteSecretManagerSecret({
 			workspaceId: del.workspaceId,
 			secretmanagerVaultName: del.vaultName,
@@ -6410,16 +6611,14 @@ async function applySecretManager(client, result, phase = "create-update", appli
 			workspaceId: del.workspaceId,
 			secretmanagerVaultName: del.name
 		})));
-		if (secretChangeSet.deletes.length > 0 || vaultChangeSet.deletes.length > 0) {
-			const state = loadSecretsState(stateScope);
-			for (const del of secretChangeSet.deletes) if (Object.hasOwn(state.vaults, del.vaultName)) {
-				delete assertDefined(state.vaults[del.vaultName], "vault state entry missing")[del.secretName];
-				if (Object.keys(assertDefined(state.vaults[del.vaultName], "vault state entry missing")).length === 0) delete state.vaults[del.vaultName];
-			}
-			for (const del of vaultChangeSet.deletes) delete state.vaults[del.name];
-			saveSecretsState(stateScope, state);
+		const state = loadSecretsState(stateScope);
+		for (const del of secretChangeSet.deletes) if (Object.hasOwn(state.vaults, del.vaultName)) {
+			delete assertDefined(state.vaults[del.vaultName], "vault state entry missing")[del.secretName];
+			if (Object.keys(assertDefined(state.vaults[del.vaultName], "vault state entry missing")).length === 0) delete state.vaults[del.vaultName];
 		}
-	}
+		for (const del of vaultChangeSet.deletes) delete state.vaults[del.name];
+		saveSecretsState(stateScope, state);
+	});
 }
 
 //#endregion
@@ -9248,19 +9447,21 @@ function handleOptionalToRequiredError(error, messages) {
 * 1. Imports the migration script's main function
 * 2. Defines getDB() function inline
 * 3. Wraps migration in a transaction using getDB()
-* 4. Exports as main() for TestExecScript
+* 4. Exports as main() for server-side execution
 * @param {string} sourceFile - Path to the migration script file
 * @param {string} namespace - TailorDB namespace
 * @param {number} migrationNumber - Migration number
 * @param {Record<string, string | number | boolean>} env - Environment variables to inject into the migration context
+* @param {string} [baseDir] - Directory to resolve the bundler's tsconfig against; defaults to the migration script's directory
 * @returns {Promise<MigrationBundleResult>} Bundled migration result
 */
-async function bundleMigrationScript(sourceFile, namespace, migrationNumber, env = {}) {
+async function bundleMigrationScript(sourceFile, namespace, migrationNumber, env = {}, baseDir) {
 	const outputDir = path.resolve(getDistDir(), "migrations");
 	fs$1.mkdirSync(outputDir, { recursive: true });
 	const entryPath = path.join(outputDir, `migration_${namespace}_${migrationNumber}.entry.js`);
+	const absoluteSourcePath = path.resolve(sourceFile).replace(/\\/g, "/");
 	const entryContent = multiline`
-    import { main as _migrationMain } from "${path.resolve(sourceFile).replace(/\\/g, "/")}";
+    import { main as _migrationMain } from "${absoluteSourcePath}";
     import { Kysely, TailordbDialect } from "@tailor-platform/sdk/kysely";
 
     function getDB(namespace) {
@@ -9280,12 +9481,7 @@ async function bundleMigrationScript(sourceFile, namespace, migrationNumber, env
     }
   `;
 	fs$1.writeFileSync(entryPath, entryContent);
-	let tsconfig;
-	try {
-		tsconfig = await resolveTSConfig();
-	} catch {
-		tsconfig = void 0;
-	}
+	const tsconfig = await resolveTSConfigWithFallback(baseDir ?? path.dirname(absoluteSourcePath));
 	return {
 		namespace,
 		migrationNumber,
@@ -9621,12 +9817,12 @@ async function detectPendingMigrations(client, workspaceId, namespacesWithMigrat
 * @returns {Promise<ExecutionResult>} Execution result
 */
 async function executeSingleMigration(options, migration) {
-	const { client, workspaceId, authInvoker, env } = options;
+	const { client, workspaceId, authInvoker, env, configDir } = options;
 	const result = await executeScript({
 		client,
 		workspaceId,
 		name: `migration-${migration.namespace}-${formatMigrationNumber(migration.number)}.js`,
-		code: (await bundleMigrationScript(migration.scriptPath, migration.namespace, migration.number, env)).bundledCode,
+		code: (await bundleMigrationScript(migration.scriptPath, migration.namespace, migration.number, env, configDir)).bundledCode,
 		invoker: authInvoker
 	});
 	return {
@@ -9680,7 +9876,8 @@ async function executeMigrations(context, migrations) {
 			client: context.client,
 			workspaceId: context.workspaceId,
 			authInvoker,
-			env: context.env
+			env: context.env,
+			configDir: context.configDir
 		};
 		logger.info(`Using machine user: ${styles.bold(machineUserName)} for namespace '${namespace}'`);
 		for (const migration of namespaceMigrations) {
@@ -9993,7 +10190,8 @@ function buildMigrationContextForScripts(client, migrationContext, migrationsReq
 		authNamespace: authService.config.name,
 		machineUsers: authService.config.machineUsers ? Object.keys(authService.config.machineUsers) : void 0,
 		dbConfig: dbConfigMap,
-		env: migrationContext.config.env ?? {}
+		env: migrationContext.config.env ?? {},
+		configDir: path.dirname(migrationContext.config.path)
 	};
 }
 /**
@@ -12907,6 +13105,15 @@ function collectVisibleResolverNamespaces(application, applications) {
 		addResource: addPossiblyAmbiguousNamespace
 	});
 }
+/**
+* Detect whether any resource owned by this application was last applied by a
+* different SDK version, in which case every resource is re-applied.
+* @param client - Operator client instance
+* @param workspaceId - Workspace ID
+* @param application - Application being deployed
+* @param functionEntries - Function registry entries of the application
+* @returns True when an owned resource carries a different sdk-version label
+*/
 async function shouldForceApplyAll(client, workspaceId, application, functionEntries) {
 	const desiredLabels = (await buildMetaRequest({
 		trn: resourceTrn(workspaceId, "application", application.name),
@@ -12943,14 +13150,13 @@ async function shouldForceApplyAll(client, workspaceId, application, functionEnt
 	functionEntries.forEach((entry) => {
 		candidateTrns.add(resourceTrn(workspaceId, "function_registry", entry.name));
 	});
-	for (const trn of candidateTrns) {
-		const metadata = await getOrNull(async () => {
-			const { metadata } = await client.getMetadata({ trn });
-			return metadata;
-		});
-		if (metadata?.labels["sdk-name"] !== application.name) continue;
-		if (!hasMatchingSdkVersion(metadata.labels, desiredLabels)) return true;
-	}
+	const results = await Promise.allSettled([...candidateTrns].map((trn) => getOrNull(async () => {
+		const { metadata } = await client.getMetadata({ trn });
+		return metadata;
+	})));
+	if (results.some((result) => result.status === "fulfilled" && result.value?.labels["sdk-name"] === application.name && !hasMatchingSdkVersion(result.value.labels, desiredLabels))) return true;
+	const failure = results.find((result) => result.status === "rejected");
+	if (failure) throw failure.reason;
 	return false;
 }
 /**
@@ -13282,6 +13488,7 @@ async function loadDeployConfig(params) {
 }
 async function buildDeploymentTargets(params) {
 	const { configPaths, loadedConfigs, buildTarget = buildDeploymentTarget, ...targetParams } = params;
+	await removeLegacyBundleFiles(path.resolve(getDistDir()));
 	return Promise.all(configPaths.map((configPath, index) => buildTarget({
 		...targetParams,
 		configPath,
@@ -16223,6 +16430,7 @@ function hasDependency(generator, dependency) {
 
 //#endregion
 //#region src/cli/commands/generate/watch/index.ts
+const warnedFallbacks = /* @__PURE__ */ new Set();
 /**
 * Error codes.
 */
@@ -16377,6 +16585,22 @@ function createDependencyGraphManager(options = {}) {
 	};
 }
 /**
+* Resolve a watch group's glob patterns against baseDir into absolute file paths.
+* @param groupId - Watch group identifier, used only for the progress log line
+* @param patterns - Glob patterns to resolve
+* @param baseDir - Directory relative patterns are resolved against
+* @returns Absolute paths of every matched file
+*/
+async function globPatterns(groupId, patterns, baseDir) {
+	const files = /* @__PURE__ */ new Set();
+	for (const pattern of patterns) {
+		const absolutePattern = path.resolve(baseDir, pattern);
+		logger.log(`${styles.dim(`Watch pattern for`)} ${styles.dim(groupId + ":")} ${path.relative(process.cwd(), absolutePattern)}`);
+		for await (const file of glob(absolutePattern)) files.add(path.resolve(file));
+	}
+	return files;
+}
+/**
 * Creates a dependency watcher.
 * @param options - Watcher options
 * @returns DependencyWatcher instance
@@ -16544,13 +16768,17 @@ function createDependencyWatcher(options = {}) {
 	}
 	return {
 		initialize,
-		async addWatchGroup(groupId, patterns) {
+		async addWatchGroup(groupId, patterns, baseDir) {
 			validateWatchGroup(groupId, patterns);
 			if (!isInitialized) await initialize();
-			const files = /* @__PURE__ */ new Set();
-			for (const pattern of patterns) {
-				logger.log(`${styles.dim(`Watch pattern for`)} ${styles.dim(groupId + ":")} ${path.relative(process.cwd(), pattern)}`);
-				for await (const file of glob(pattern)) files.add(path.resolve(file));
+			let files = await globPatterns(groupId, patterns, baseDir);
+			if (files.size === 0 && baseDir !== process.cwd()) {
+				const fallbackKey = `${baseDir}\0${groupId}`;
+				if (!warnedFallbacks.has(fallbackKey)) {
+					warnedFallbacks.add(fallbackKey);
+					logger.warn(`No files matched watch patterns for "${groupId}" relative to "${baseDir}"; falling back to process.cwd(). Update this config's file patterns to be relative to its own directory before v2, when this fallback will be removed.`);
+				}
+				files = await globPatterns(groupId, patterns, process.cwd());
 			}
 			const watchGroup = {
 				id: groupId,
@@ -16567,7 +16795,7 @@ function createDependencyWatcher(options = {}) {
 		async removeWatchGroup(groupId) {
 			const watchGroup = watchGroups.get(groupId);
 			if (!watchGroup) return;
-			if (chokidarWatcher) chokidarWatcher.unwatch(watchGroup.patterns);
+			if (chokidarWatcher) chokidarWatcher.unwatch(Array.from(watchGroup.files));
 			for (const filePath of watchGroup.files) dependencyGraphManager.removeNode(filePath);
 			watchGroups.delete(groupId);
 			dependencyCache.clear();
@@ -16967,7 +17195,10 @@ function createGenerationManager(params) {
 				const pluginExecutorFiles = generatePluginFilesIfNeeded(pluginManager, app.tailorDBServices, config.path);
 				return {
 					pluginExecutorFiles,
-					executorService: app.executorService ?? (pluginExecutorFiles.length > 0 ? createExecutorService({ config: { files: [] } }) : void 0)
+					executorService: app.executorService ?? (pluginExecutorFiles.length > 0 ? createExecutorService({
+						config: { files: [] },
+						baseDir: path.dirname(config.path)
+					}) : void 0)
 				};
 			});
 			if (app.authService) {
@@ -17034,15 +17265,16 @@ function createGenerationManager(params) {
 			watcher.setRestartCallback(() => {
 				restartWatchProcess();
 			});
-			await watcher.addWatchGroup("Config", [config.path]);
+			const configDir = path.dirname(config.path);
+			await watcher.addWatchGroup("Config", [config.path], configDir);
 			const app = application;
 			for (const db of app.tailorDBServices) {
 				const dbNamespace = db.namespace;
-				await watcher.addWatchGroup(`TailorDB/${dbNamespace}`, db.config.files);
+				await watcher.addWatchGroup(`TailorDB/${dbNamespace}`, db.config.files, configDir);
 			}
 			for (const resolverService of app.resolverServices) {
 				const resolverNamespace = resolverService.namespace;
-				await watcher.addWatchGroup(`Resolver/${resolverNamespace}`, resolverService["config"].files);
+				await watcher.addWatchGroup(`Resolver/${resolverNamespace}`, resolverService["config"].files, configDir);
 			}
 			await new Promise(() => {});
 		}
@@ -18690,7 +18922,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-Dp_-ioiP.mjs");
+	const { defineApplication } = await import("./application-Nlh9BHQf.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -19894,20 +20126,16 @@ function createGqlEntry() {
 /**
 * Bundle a query executor script for TestExecScript.
 * @param engine - Query engine type
+* @param baseDir - Directory to resolve the bundler's tsconfig against
 * @returns Bundled code
 */
-async function bundleQueryScript(engine) {
+async function bundleQueryScript(engine, baseDir) {
 	const outputDir = path.resolve(getDistDir(), "query");
 	fs$1.mkdirSync(outputDir, { recursive: true });
 	const entryPath = path.join(outputDir, `query_${engine}.entry.ts`);
 	const entryContent = engine === "sql" ? createSqlEntry() : createGqlEntry();
 	fs$1.writeFileSync(entryPath, entryContent);
-	let tsconfig;
-	try {
-		tsconfig = await resolveTSConfig();
-	} catch {
-		tsconfig = void 0;
-	}
+	const tsconfig = await resolveTSConfigWithFallback(baseDir);
 	return (await rolldown.build({
 		plugins: [platformBundleDefinePlugin],
 		input: entryPath,
@@ -20169,7 +20397,7 @@ async function loadTypeFieldOrder(config, namespace) {
 	const fieldOrder = /* @__PURE__ */ new Map();
 	const dbConfig = config.db?.[namespace];
 	if (!dbConfig || !("files" in dbConfig) || dbConfig.files.length === 0) return fieldOrder;
-	const typeFiles = loadFilesWithIgnores(dbConfig);
+	const typeFiles = loadFilesWithIgnores(dbConfig, path.dirname(config.path));
 	await Promise.all(typeFiles.map(async (typeFile) => {
 		try {
 			const module = await import(pathToFileURL(typeFile).href);
@@ -20363,7 +20591,7 @@ async function query(options) {
 }
 async function prepareQueryExecutor(options) {
 	const { client, workspaceId, config, application, machineUserResource, engine, namespaces } = await loadOptions(options);
-	const bundledCode = await bundleQueryScript(engine);
+	const bundledCode = await bundleQueryScript(engine, path.dirname(config.path));
 	const invoker = create(AuthInvokerSchema, {
 		namespace: application.authNamespace,
 		machineUserName: machineUserResource.name
@@ -20775,5 +21003,52 @@ function isDeno() {
 }
 
 //#endregion
-export { listFolders as $, deploymentArgs as $n, handleOptionalToRequiredError as $t, generate as A, generateUserTypes as An, startCommand as At, remove as B, loadConsoleBaseUrl as Bn, deploy as Bt, waitWorkflowExecution as C, formatDiffSummary as Cn, listCommand$8 as Ct, listWorkflows as D, resourceTrn as Dn, jobsCommand as Dt, listCommand$2 as E, getNamespacesWithMigrations as En, getExecutorWaitFailureMessage as Et, openInConfiguredEditor as F, deleteUserTokens as Fn, getWorkflowExecution as Ft, treeCommand as G, readPlatformConfig as Gn, createWorkspace$1 as Gt, updateCommand$1 as H, loadStoredUserTokens as Hn, listCommand$9 as Ht, show as I, fetchLatestToken as In, listWorkflowExecutions as It, getCommand$1 as J, writePlatformConfig as Jn, ensureConfigId as Jt, listCommand$3 as K, resolveUserTokenKey as Kn, formatKeyValueTable as Kt, showCommand as L, hasAnyUserTokenEntry as Ln, functionExecutionStatusToString as Lt, generateMigrationScript as M, apiCall as Mn, getCommand$5 as Mt, writeDbTypesFile as N, assertWritable as Nn, getWorkflow as Nt, truncate as O, sdkNameLabelKey as On, listExecutorJobs as Ot, getConfiguredEditorCommand as P, loadConfig as Pn, executionsCommand as Pt, listCommand$4 as Q, confirmationArgs as Qn, MIGRATION_LABEL_KEY as Qt, extractOwnedNamespaces as R, hasUserTokenEntry as Rn, getCommand$6 as Rt, waitCommand as S, parseMigrationNumberArg as Sn, triggerExecutor as St, resumeWorkflow as T, hasChanges as Tn, getExecutorJob as Tt, updateOrganization as U, loadWorkspaceId as Un, listWorkspaces as Ut, removeCommand$1 as V, loadMachineUserName as Vn, deployFromCLI as Vt, organizationTree as W, platformConfigFromProfile as Wn, createCommand$1 as Wt, updateCommand$2 as X, commonArgs as Xn, waitForExecution as Xt, getOrganization as Y, defineAppCommand as Yn, executeScript as Yt, updateFolder as Z, configArg as Zn, bundleMigrationScript as Zt, deleteWorkspace as _, getNextMigrationNumber as _n, getCommand$4 as _t, updateUser as a, DIFF_FILE_NAME as an, toPageDirection as ar, createFolder as at, getAppHealth as b, reconstructSnapshotFromMigrations as bn, webhookCommand as bt, listCommand as c, SCHEMA_FILE_NAME as cn, getCommand$3 as ct, inviteUser as d, compareSnapshots as dn, tokenCommand as dt, parseMigrationLabelNumber as en, isVerbose as er, getCommand$2 as et, restoreCommand as f, createSnapshotFromLocalTypes as fn, listCommand$6 as ft, deleteCommand as g, getMigrationFiles as gn, listFunctionRegistries as gt, getWorkspace as h, getMigrationFilePath as hn, listCommand$7 as ht, updateCommand as i, DB_TYPES_FILE_NAME as in, resolveMachineUserInputSource as ir, createCommand as it, generateCommand as j, prompt as jn, startWorkflow as jt, truncateCommand as k, PluginManager as kn, watchExecutorJob as kt, listUsers as l, assertValidMigrationFiles as ln, getOAuth2Client as lt, getCommand as m, getMigrationDirPath as mn, generate$1 as mt, query as n, generateAllTypeManifestsFromSnapshot as nn, pagedLogArgs as nr, deleteCommand$1 as nt, removeCommand as o, INITIAL_SCHEMA_NUMBER as on, workspaceArgs as or, listCommand$5 as ot, restoreWorkspace as p, getLatestMigrationNumber as pn, listMachineUsers as pt, listOrganizations as q, saveUserTokens as qn, workspaceNameSchema as qt, queryCommand as r, protoGqlPermission as rn, paginationArgs as rr, deleteFolder as rt, removeUser as s, MIGRATE_FILE_NAME as sn, listOAuth2Clients as st, isNativeTypeScriptRuntime as t, compareSnapshotWithRemote as tn, multiConfigArg as tr, getFolder as tt, inviteCommand as u, compareLocalTypesWithSnapshot as un, getMachineUserToken as ut, listApps as v, isValidMigrationNumber as vn, getFunctionRegistry as vt, resumeCommand as w, formatMigrationDiff as wn, listExecutors as wt, healthCommand as x, formatMigrationNumber as xn, triggerCommand as xt, listCommand$1 as y, loadDiff as yn, listWebhookExecutors as yt, logBetaWarning as z, loadAccessToken as zn, getExecutor as zt };
-//# sourceMappingURL=runtime-BD2vYJFT.mjs.map
+//#region src/cli/shared/register-tsconfig-paths-hook.ts
+/**
+* Register the tsconfig `paths` alias resolve hook alongside tsx.
+*
+* tsx's own tsconfig-paths support is scoped to the tsconfig discovered from
+* where tsx was registered, so a project-local alias in a dynamically
+* imported user file (resolver, executor, workflow, TailorDB type) can fail
+* to resolve when the importing file lives outside that directory. This
+* hook activates only when tsx's own resolution throws (a fallback, not an
+* override): it then re-derives `paths` from each importing file's own
+* directory, without touching TypeScript transformation (left to tsx).
+*
+* Uses `module.register()` rather than `module.registerHooks()`: chaining
+* another `register()` loader after tsx's composes correctly regardless of
+* which of the two internal registration APIs tsx itself picks (it varies
+* by Node.js version).
+* @param hookUrl - URL of the tsconfig-paths-hook.mjs module.
+*/
+async function registerTsconfigPathsHook(hookUrl) {
+	if (isNativeTypeScriptRuntime()) return;
+	if (typeof mod.register !== "function") return;
+	mod.register(hookUrl);
+}
+
+//#endregion
+//#region src/cli/shared/register-typescript-runtime.ts
+/**
+* Register TypeScript loading for the CLI: tsx for transformation, plus the
+* tsconfig `paths` alias resolve hook tsx's own cwd-scoped resolver misses.
+*
+* Shared by both the `tailor` binary entrypoint and the programmatic `./cli`
+* API entrypoint so the two registration steps can't drift apart.
+* @param hookUrl - URL of the tsconfig-paths-hook.mjs module, resolved by the
+* caller via its own `import.meta.url`. Bundling can move this shared module
+* to a different output location than tsconfig-paths-hook.mjs, so the URL
+* can't be resolved relative to this file — it must come from an entrypoint
+* whose bundled output path stays predictable.
+*/
+async function registerTypeScriptRuntime(hookUrl) {
+	if (!isNativeTypeScriptRuntime()) {
+		const { register } = await import("tsx/esm/api");
+		register();
+	}
+	await registerTsconfigPathsHook(hookUrl);
+}
+
+//#endregion
+export { listFolders as $, deploymentArgs as $n, handleOptionalToRequiredError as $t, generate as A, generateUserTypes as An, startCommand as At, remove as B, loadConsoleBaseUrl as Bn, deploy as Bt, waitWorkflowExecution as C, formatDiffSummary as Cn, listCommand$8 as Ct, listWorkflows as D, resourceTrn as Dn, jobsCommand as Dt, listCommand$2 as E, getNamespacesWithMigrations as En, getExecutorWaitFailureMessage as Et, openInConfiguredEditor as F, deleteUserTokens as Fn, getWorkflowExecution as Ft, treeCommand as G, readPlatformConfig as Gn, createWorkspace$1 as Gt, updateCommand$1 as H, loadStoredUserTokens as Hn, listCommand$9 as Ht, show as I, fetchLatestToken as In, listWorkflowExecutions as It, getCommand$1 as J, writePlatformConfig as Jn, ensureConfigId as Jt, listCommand$3 as K, resolveUserTokenKey as Kn, formatKeyValueTable as Kt, showCommand as L, hasAnyUserTokenEntry as Ln, functionExecutionStatusToString as Lt, generateMigrationScript as M, apiCall as Mn, getCommand$5 as Mt, writeDbTypesFile as N, assertWritable as Nn, getWorkflow as Nt, truncate as O, sdkNameLabelKey as On, listExecutorJobs as Ot, getConfiguredEditorCommand as P, loadConfig as Pn, executionsCommand as Pt, listCommand$4 as Q, confirmationArgs as Qn, MIGRATION_LABEL_KEY as Qt, extractOwnedNamespaces as R, hasUserTokenEntry as Rn, getCommand$6 as Rt, waitCommand as S, parseMigrationNumberArg as Sn, triggerExecutor as St, resumeWorkflow as T, hasChanges as Tn, getExecutorJob as Tt, updateOrganization as U, loadWorkspaceId as Un, listWorkspaces as Ut, removeCommand$1 as V, loadMachineUserName as Vn, deployFromCLI as Vt, organizationTree as W, platformConfigFromProfile as Wn, createCommand$1 as Wt, updateCommand$2 as X, commonArgs as Xn, waitForExecution as Xt, getOrganization as Y, defineAppCommand as Yn, executeScript as Yt, updateFolder as Z, configArg as Zn, bundleMigrationScript as Zt, deleteWorkspace as _, getNextMigrationNumber as _n, getCommand$4 as _t, updateUser as a, DIFF_FILE_NAME as an, toPageDirection as ar, createFolder as at, getAppHealth as b, reconstructSnapshotFromMigrations as bn, webhookCommand as bt, listCommand as c, SCHEMA_FILE_NAME as cn, getCommand$3 as ct, inviteUser as d, compareSnapshots as dn, tokenCommand as dt, parseMigrationLabelNumber as en, isVerbose as er, getCommand$2 as et, restoreCommand as f, createSnapshotFromLocalTypes as fn, listCommand$6 as ft, deleteCommand as g, getMigrationFiles as gn, listFunctionRegistries as gt, getWorkspace as h, getMigrationFilePath as hn, listCommand$7 as ht, updateCommand as i, DB_TYPES_FILE_NAME as in, resolveMachineUserInputSource as ir, createCommand as it, generateCommand as j, prompt as jn, startWorkflow as jt, truncateCommand as k, PluginManager as kn, watchExecutorJob as kt, listUsers as l, assertValidMigrationFiles as ln, getOAuth2Client as lt, getCommand as m, getMigrationDirPath as mn, generate$1 as mt, query as n, generateAllTypeManifestsFromSnapshot as nn, pagedLogArgs as nr, deleteCommand$1 as nt, removeCommand as o, INITIAL_SCHEMA_NUMBER as on, workspaceArgs as or, listCommand$5 as ot, restoreWorkspace as p, getLatestMigrationNumber as pn, listMachineUsers as pt, listOrganizations as q, saveUserTokens as qn, workspaceNameSchema as qt, queryCommand as r, protoGqlPermission as rn, paginationArgs as rr, deleteFolder as rt, removeUser as s, MIGRATE_FILE_NAME as sn, listOAuth2Clients as st, registerTypeScriptRuntime as t, compareSnapshotWithRemote as tn, multiConfigArg as tr, getFolder as tt, inviteCommand as u, compareLocalTypesWithSnapshot as un, getMachineUserToken as ut, listApps as v, isValidMigrationNumber as vn, getFunctionRegistry as vt, resumeCommand as w, formatMigrationDiff as wn, listExecutors as wt, healthCommand as x, formatMigrationNumber as xn, triggerCommand as xt, listCommand$1 as y, loadDiff as yn, listWebhookExecutors as yt, logBetaWarning as z, loadAccessToken as zn, getExecutor as zt };
+//# sourceMappingURL=register-typescript-runtime-Bd4bcLbW.mjs.map