@tailor-platform/sdk 1.83.0 → 1.84.0

package/dist/{register-typescript-runtime-CCHyKeXO.mjs → register-typescript-runtime-BCvWR3HC.mjs}

@@ -1,9 +1,9 @@
 import { t as db } from "./schema-CYrle8JZ.mjs";
-import { $ as CreateAuthHookRequestSchema, B as IdPLang, Bt as Subgraph_ServiceType, C as CreateStaticWebsiteRequestSchema, Ct as AuthInvokerSchema, D as CreateSecretManagerSecretRequestSchema, Dt as AuthSCIMAttribute_Type, Et as AuthSCIMAttribute_Mutability, Ft as CreateApplicationRequestSchema, H as IdPPermissionPermit, Ht as UpdateAIGatewayRequestSchema, I as PipelineResolver_OperationType, It as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, Jt as FilterSchema, K as CreateExecutorExecutorRequestSchema, Kt as ConditionSchema, L as CreateIdPServiceRequestSchema, Lt as UpdateApplicationRequestSchema, M as CreatePipelineServiceRequestSchema, Mt as UserProfileProviderConfig_UserProfileProviderType, N as UpdatePipelineResolverRequestSchema, O as CreateSecretManagerVaultRequestSchema, Ot as AuthSCIMAttribute_Uniqueness, P as UpdatePipelineServiceRequestSchema, Q as CreateAuthConnectionRequestSchema, R as UpdateIdPServiceRequestSchema, S as AddCustomDomainRequestSchema, St as AuthIDPConfig_AuthType, Tt as AuthOAuth2Client_GrantType, U as FunctionExecution_Status, V as IdPPermissionOperator, Vt as CreateAIGatewayRequestSchema, X as ExecutorTargetType, Y as ExecutorJobStatus, Yt as PageDirection, Z as ExecutorTriggerType, _ as TailorDBGQLPermission_Permit, _t as UpdateUserProfileConfigRequestSchema, a as CreateWorkflowRequestSchema, at as CreateAuthServiceRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthConnection_Type, ct as UpdateAuthConnectionRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as UpdateAuthMachineUserRequestSchema, et as CreateAuthIDPConfigRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as UpdateAuthOAuth2ClientRequestSchema, g as TailorDBGQLPermission_Operator, gt as UpdateTenantConfigRequestSchema, h as TailorDBGQLPermission_Action, ht as UpdateAuthServiceRequestSchema, i as CreateWorkflowJobFunctionRequestSchema, it as CreateAuthSCIMResourceRequestSchema, j as CreatePipelineResolverRequestSchema, jt as TenantProviderConfig_TenantProviderType, k as UpdateSecretManagerSecretRequestSchema, kt as AuthSCIMConfig_AuthorizationType, l as WorkflowExecution_Status, lt as UpdateAuthHookRequestSchema, mt as UpdateAuthSCIMResourceRequestSchema, nt as CreateAuthOAuth2ClientRequestSchema, o as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as CreateTenantConfigRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as UpdateAuthSCIMConfigRequestSchema, q as UpdateExecutorExecutorRequestSchema, qt as Condition_Operator, r as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, rt as CreateAuthSCIMConfigRequestSchema, s as UpdateWorkflowRequestSchema, st as CreateUserProfileConfigRequestSchema, t as WorkspacePlatformUserRole, tt as CreateAuthMachineUserRequestSchema, u as WorkflowJobExecution_Status, ut as UpdateAuthIDPConfigRequestSchema, v as TailorDBTypeSchema, w as UpdateStaticWebsiteRequestSchema, wt as AuthOAuth2Client_ClientType, x as TailorDBType_PermitAction, xt as AuthHookPoint, y as TailorDBType_Permission_Operator, yt as AuthConnection_Status, zt as ApplicationSchemaUpdateAttemptStatus } from "./workspace_resource_pb-UGK1SSn_.mjs";
+import { $ as CreateAuthHookRequestSchema, B as IdPLang, Bt as Subgraph_ServiceType, C as CreateStaticWebsiteRequestSchema, Ct as AuthInvokerSchema, D as CreateSecretManagerSecretRequestSchema, Dt as AuthSCIMAttribute_Type, Et as AuthSCIMAttribute_Mutability, Ft as CreateApplicationRequestSchema, H as IdPPermissionPermit, Ht as UpdateAIGatewayRequestSchema, I as PipelineResolver_OperationType, It as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, Jt as FilterSchema, K as CreateExecutorExecutorRequestSchema, Kt as ConditionSchema, L as CreateIdPServiceRequestSchema, Lt as UpdateApplicationRequestSchema, M as CreatePipelineServiceRequestSchema, Mt as UserProfileProviderConfig_UserProfileProviderType, N as UpdatePipelineResolverRequestSchema, O as CreateSecretManagerVaultRequestSchema, Ot as AuthSCIMAttribute_Uniqueness, P as UpdatePipelineServiceRequestSchema, Q as CreateAuthConnectionRequestSchema, R as UpdateIdPServiceRequestSchema, S as AddCustomDomainRequestSchema, St as AuthIDPConfig_AuthType, Tt as AuthOAuth2Client_GrantType, U as FunctionExecution_Status, V as IdPPermissionOperator, Vt as CreateAIGatewayRequestSchema, X as ExecutorTargetType, Y as ExecutorJobStatus, Yt as PageDirection, Z as ExecutorTriggerType, _ as TailorDBGQLPermission_Permit, _t as UpdateUserProfileConfigRequestSchema, a as CreateWorkflowRequestSchema, at as CreateAuthServiceRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthConnection_Type, ct as UpdateAuthConnectionRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as UpdateAuthMachineUserRequestSchema, et as CreateAuthIDPConfigRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as UpdateAuthOAuth2ClientRequestSchema, g as TailorDBGQLPermission_Operator, gt as UpdateTenantConfigRequestSchema, h as TailorDBGQLPermission_Action, ht as UpdateAuthServiceRequestSchema, i as CreateWorkflowJobFunctionRequestSchema, it as CreateAuthSCIMResourceRequestSchema, j as CreatePipelineResolverRequestSchema, jt as TenantProviderConfig_TenantProviderType, k as UpdateSecretManagerSecretRequestSchema, kt as AuthSCIMConfig_AuthorizationType, l as WorkflowExecution_Status, lt as UpdateAuthHookRequestSchema, mt as UpdateAuthSCIMResourceRequestSchema, nt as CreateAuthOAuth2ClientRequestSchema, o as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as CreateTenantConfigRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as UpdateAuthSCIMConfigRequestSchema, q as UpdateExecutorExecutorRequestSchema, qt as Condition_Operator, r as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, rt as CreateAuthSCIMConfigRequestSchema, s as UpdateWorkflowRequestSchema, st as CreateUserProfileConfigRequestSchema, t as WorkspacePlatformUserRole, tt as CreateAuthMachineUserRequestSchema, u as WorkflowJobExecution_Status, ut as UpdateAuthIDPConfigRequestSchema, v as TailorDBTypeSchema, w as UpdateStaticWebsiteRequestSchema, wt as AuthOAuth2Client_ClientType, x as TailorDBType_PermitAction, xt as AuthHookPoint, y as TailorDBType_Permission_Operator, yt as AuthConnection_Status, zt as ApplicationSchemaUpdateAttemptStatus } from "./workspace_resource_pb-DXnO2AT-.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
 import { a as parseBoolean, i as symbols, n as logger, o as renderTable, r as styles, t as CIPromptError } from "./logger-CXQq9YIp.mjs";
-import { A as defaultPlatformBaseUrl, B as getPlatformBaseUrl, C as getPluginGenerationDependencies, D as hashContent, E as getDistDir, G as rememberPlatformConfigForToken, H as initOperatorClient, J as createApplyLimiter, K as resolveStaticWebsiteUrls, L as getConsoleBaseUrl, M as fetchAllTolerant, N as fetchMachineUserToken, O as hashFile, P as fetchPaged, R as getOAuth2ClientId, T as createBundleCache, U as isDefaultPlatform, V as initOAuth2Client, W as normalizeBaseUrl, Y as LOG_LEVELS, _ as stringifyFunction, d as buildExecutorArgsExpr, f as buildResolverOperationHookExpr, g as TailorDBTypeSchema$1, h as assertUniqueTailorDBTypeNamesWithExternal, i as resolverBundleKey, j as fetchAll, l as HTTP_METHODS, m as assertUniqueLocalTailorDBTypeNames, n as generatePluginFilesIfNeeded, o as WorkflowJobFunctionExecutionPolicySchema, q as byName, r as loadApplication, t as defineApplication, v as resolveTSConfigWithFallback, w as hasGenerationHooks, y as platformBundleDefinePlugin, z as getOrNull } from "./application-Cp0FxIm2.mjs";
-import { o as loadFilesWithIgnores, s as functionSchema, t as createExecutorService } from "./service-B0MaodSg.mjs";
+import { A as defaultPlatformBaseUrl, B as getPlatformBaseUrl, C as getPluginGenerationDependencies, D as hashContent, E as getDistDir, G as normalizeBaseUrl, H as initOperatorClient, J as byName, K as rememberPlatformConfigForToken, L as getConsoleBaseUrl, M as fetchAllTolerant, N as fetchMachineUserToken, O as hashFile, P as fetchPaged, R as getOAuth2ClientId, T as createBundleCache, U as isDefaultPlatform, V as initOAuth2Client, W as isNotFoundError, X as LOG_LEVELS, Y as createApplyLimiter, _ as stringifyFunction, d as buildExecutorArgsExpr, f as buildResolverOperationHookExpr, g as TailorDBTypeSchema$1, h as assertUniqueTailorDBTypeNamesWithExternal, i as resolverBundleKey, j as fetchAll, l as HTTP_METHODS, m as assertUniqueLocalTailorDBTypeNames, n as generatePluginFilesIfNeeded, o as WorkflowJobFunctionExecutionPolicySchema, q as resolveStaticWebsiteUrls, r as loadApplication, t as defineApplication, v as resolveTSConfigWithFallback, w as hasGenerationHooks, y as platformBundleDefinePlugin, z as getOrNull } from "./application-CnCljDwk.mjs";
+import { o as loadFilesWithIgnores, s as functionSchema, t as createExecutorService } from "./service-CPJWhTLn.mjs";
 import { n as enumConstantsPlugin, t as EnumConstantsGeneratorID } from "./enum-constants-j9QBF0cB.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { n as fileUtilsPlugin, t as FileUtilsGeneratorID } from "./file-utils-DcyIPFQh.mjs";
@@ -5926,6 +5926,18 @@ function protoExecutor(context, executor) {
 				}
 			});
 			break;
+		case "workflowExecution":
+		case "workflowJobExecution":
+			triggerType = ExecutorTriggerType.EVENT;
+			triggerConfig = typedEventTrigger({
+				case: "workflow",
+				value: {
+					eventTypes: trigger.events,
+					workflowName: trigger.workflowName,
+					...trigger.condition ? { condition: { expr: `(${stringifyFunction(trigger.condition)})(${argsExpr})` } } : {}
+				}
+			});
+			break;
 		default: throw new Error(`Unknown trigger: ${trigger}`);
 	}
 	const target = executor.operation;
@@ -7200,6 +7212,10 @@ const warningChangeInfoSchema = z.looseObject({
 	fieldName: z.string().optional(),
 	reason: z.string()
 });
+const scriptSkippedInfoSchema = z.looseObject({
+	reason: z.string().trim().min(1),
+	acknowledgedAt: z.string()
+});
 const migrationDiffSchema = z.looseObject({
 	version: z.number(),
 	namespace: z.string(),
@@ -7210,7 +7226,8 @@ const migrationDiffSchema = z.looseObject({
 	breakingChanges: z.array(breakingChangeInfoSchema),
 	hasWarnings: z.boolean().optional(),
 	warnings: z.array(warningChangeInfoSchema).optional(),
-	requiresMigrationScript: z.boolean()
+	requiresMigrationScript: z.boolean(),
+	scriptSkipped: scriptSkippedInfoSchema.optional()
 });
 
 //#endregion
@@ -7852,75 +7869,81 @@ function areFieldsDifferent(oldField, newField) {
 	return false;
 }
 /**
-* Determine if a field change is a breaking change
+* Collect breaking changes for a field change
 * @param {string} typeName - Name of the type containing the field
 * @param {string} fieldName - Name of the field being changed
 * @param {SnapshotFieldConfig | undefined} oldField - Old field configuration
 * @param {SnapshotFieldConfig | undefined} newField - New field configuration
-* @returns {BreakingChangeInfo | null} Breaking change info or null if not breaking
+* @returns {BreakingChangeInfo[]} Breaking change information
 */
-function isBreakingFieldChange(typeName, fieldName, oldField, newField) {
-	if (!oldField && newField && newField.required) return {
+function getBreakingFieldChanges(typeName, fieldName, oldField, newField) {
+	const breakingChanges = [];
+	if (!oldField && newField && newField.required) breakingChanges.push({
 		typeName,
 		fieldName,
 		reason: "Required field added"
-	};
-	if (oldField && newField && oldField.type !== newField.type) return {
+	});
+	if (oldField && newField && oldField.type !== newField.type) breakingChanges.push({
 		typeName,
 		fieldName,
 		reason: `Field type changed from ${oldField.type} to ${newField.type}`,
 		unsupported: true,
 		showThreeStepHint: true
-	};
-	if (oldField && newField && !oldField.required && newField.required) return {
+	});
+	if (oldField && newField && !oldField.required && newField.required) breakingChanges.push({
 		typeName,
 		fieldName,
 		reason: "Field changed from optional to required"
-	};
+	});
 	if (oldField && newField && (oldField.array ?? false) !== (newField.array ?? false)) {
 		const [fromType, toType] = oldField.array ? ["array", "single value"] : ["single value", "array"];
-		return {
+		breakingChanges.push({
 			typeName,
 			fieldName,
 			reason: `Field changed from ${fromType} to ${toType}`,
 			unsupported: true,
 			showThreeStepHint: true
-		};
+		});
 	}
 	if (oldField && newField) {
 		const oldForeignKeyType = oldField.foreignKeyType;
 		const newForeignKeyType = newField.foreignKeyType;
-		if (oldForeignKeyType && newForeignKeyType && oldForeignKeyType !== newForeignKeyType) return {
+		if (oldForeignKeyType && newForeignKeyType && oldForeignKeyType !== newForeignKeyType) breakingChanges.push({
 			typeName,
 			fieldName,
 			reason: `Foreign key target type changed from ${oldForeignKeyType} to ${newForeignKeyType}`
-		};
+		});
 	}
-	if (oldField && newField && !(oldField.unique ?? false) && (newField.unique ?? false)) return {
+	if (oldField && newField && !(oldField.unique ?? false) && (newField.unique ?? false)) breakingChanges.push({
 		typeName,
 		fieldName,
 		reason: "Unique constraint added to field"
-	};
+	});
+	if (oldField?.type === "decimal" && newField?.type === "decimal" && oldField.scale !== newField.scale) breakingChanges.push({
+		typeName,
+		fieldName,
+		reason: `Decimal scale changed from ${oldField.scale} to ${newField.scale}`
+	});
 	if (oldField && newField && oldField.type === "enum" && newField.type === "enum") {
 		const oldAllowed = oldField.allowedValues ?? [];
 		const newAllowed = newField.allowedValues ?? [];
 		const oldValues = oldAllowed.map((v) => v.value);
 		const newValuesSet = new Set(newAllowed.map((v) => v.value));
 		const removedValues = oldValues.filter((v) => !newValuesSet.has(v));
-		if (removedValues.length > 0) return {
+		if (removedValues.length > 0) breakingChanges.push({
 			typeName,
 			fieldName,
 			reason: `Enum values removed: ${removedValues.join(", ")}`
-		};
+		});
 	}
-	return null;
+	return breakingChanges;
 }
 function addChange(ctx, change, oldField, newField) {
 	ctx.changes.push(change);
 	if (!change.fieldName) return;
-	const breaking = isBreakingFieldChange(change.typeName, change.fieldName, oldField, newField);
-	if (breaking) {
-		ctx.breakingChanges.push(breaking);
+	const breakingChanges = getBreakingFieldChanges(change.typeName, change.fieldName, oldField, newField);
+	if (breakingChanges.length > 0) {
+		ctx.breakingChanges.push(...breakingChanges);
 		return;
 	}
 	if (change.kind === "field_removed") ctx.warnings.push({
@@ -9855,8 +9878,9 @@ async function getCurrentMigrationNumber(client, workspaceId, namespace) {
 		const label = metadata?.labels[MIGRATION_LABEL_KEY];
 		if (!label) return 0;
 		return parseMigrationLabelNumber(label) ?? 0;
-	} catch {
-		return 0;
+	} catch (error) {
+		if (isNotFoundError(error)) return 0;
+		throw error;
 	}
 }
 /**
@@ -9864,9 +9888,10 @@ async function getCurrentMigrationNumber(client, workspaceId, namespace) {
 * @param {OperatorClient} client - Operator client instance
 * @param {string} workspaceId - Workspace ID
 * @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migrations config
+* @param {string} [configPath] - Config file path, included in remediation guidance when provided
 * @returns {Promise<PendingMigration[]>} List of pending migrations
 */
-async function detectPendingMigrations(client, workspaceId, namespacesWithMigrations) {
+async function detectPendingMigrations(client, workspaceId, namespacesWithMigrations, configPath) {
 	const pendingMigrations = [];
 	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
 		const currentMigration = await getCurrentMigrationNumber(client, workspaceId, namespace);
@@ -9878,9 +9903,15 @@ async function detectPendingMigrations(client, workspaceId, namespacesWithMigrat
 			const diff = loadDiff(diffPath);
 			const scriptPath = getMigrationFilePath(migrationsDir, file.number, "migrate");
 			const hasScript = fs$1.existsSync(scriptPath);
-			if (diff.requiresMigrationScript && !hasScript) {
-				logger.warn(`Migration ${namespace}/${file.number} requires a script but migrate.ts not found`);
-				continue;
+			if (diff.requiresMigrationScript && !hasScript && !diff.scriptSkipped) {
+				const configArg = configPath ? ` --config "${path.relative(process.cwd(), configPath) || configPath}"` : "";
+				const scriptCmd = `tailor-sdk tailordb migration script ${file.number} --namespace ${namespace}${configArg}`;
+				throw new Error(`Migration ${namespace}/${formatMigrationNumber(file.number)} requires a migration script but migrate.ts was not found.\nTo resolve, either:\n  - Add a script: ${scriptCmd}\n  - Or record that no script is needed: ${scriptCmd} --no-script --reason "<why no data migration is needed>"`);
+			}
+			if (diff.scriptSkipped) {
+				const migrationLabel = `${namespace}/${formatMigrationNumber(file.number)}`;
+				if (hasScript) logger.warn(`Migration ${migrationLabel} has both a skip acknowledgment and migrate.ts; executing migrate.ts.`);
+				else logger.info(`Migration ${migrationLabel} runs without a script (skip acknowledged at ${diff.scriptSkipped.acknowledgedAt}: ${diff.scriptSkipped.reason})`);
 			}
 			pendingMigrations.push({
 				number: file.number,
@@ -10177,6 +10208,38 @@ function formatRemoteVerificationResults(results) {
 	}
 	return lines.join("\n");
 }
+const MIGRATION_FILE_KINDS = [
+	"schema",
+	"diff",
+	"migrate",
+	"db"
+];
+/**
+* Capture the migration files that a deployment plan depends on.
+* @param namespacesWithMigrations - Configured migration directories by namespace
+* @returns SHA-256 digest by namespace
+*/
+function captureMigrationFileState(namespacesWithMigrations) {
+	const state = {};
+	for (const { namespace, migrationsDir } of namespacesWithMigrations.toSorted((a, b) => a.namespace.localeCompare(b.namespace))) {
+		const hash = createHash("sha256");
+		const migrationNumbers = [...new Set(getMigrationFiles(migrationsDir).map(({ number }) => number))].toSorted((a, b) => a - b);
+		for (const migrationNumber of migrationNumbers) for (const kind of MIGRATION_FILE_KINDS) {
+			const filePath = getMigrationFilePath(migrationsDir, migrationNumber, kind);
+			hash.update(`${formatMigrationNumber(migrationNumber)}/${kind}\0`);
+			if (fs$1.existsSync(filePath)) hash.update(fs$1.readFileSync(filePath));
+			else hash.update("<missing>");
+			hash.update("\0");
+		}
+		state[namespace] = hash.digest("hex");
+	}
+	return state;
+}
+function migrationFileStatesEqual(planned, current) {
+	const plannedNamespaces = Object.keys(planned).toSorted();
+	const currentNamespaces = Object.keys(current).toSorted();
+	return plannedNamespaces.length === currentNamespaces.length && plannedNamespaces.every((namespace, index) => namespace === currentNamespaces[index] && planned[namespace] === current[namespace]);
+}
 /**
 * Validate migration files and detect pending migrations
 * @param {OperatorClient} client - Operator client instance
@@ -10222,19 +10285,20 @@ async function validateAndDetectMigrations(client, workspaceId, typesByNamespace
 				throw new Error("Remote schema verification failed");
 			}
 		}
-		pendingMigrations = await detectPendingMigrations(client, workspaceId, namespacesWithMigrations);
+		pendingMigrations = await detectPendingMigrations(client, workspaceId, namespacesWithMigrations, config.path);
 		if (pendingMigrations.length > 0) {
 			logger.newline();
 			const withScripts = pendingMigrations.filter((m) => m.hasScript);
 			const withoutScripts = pendingMigrations.filter((m) => !m.hasScript);
-			logger.info(`Applying ${pendingMigrations.length} migration(s):`);
+			logger.info(`${pendingMigrations.length} pending migration(s) will be applied:`);
 			if (withoutScripts.length > 0) logger.info(`  • ${withoutScripts.length} schema change(s) (applied automatically with schema deployment)`, { mode: "plain" });
 			if (withScripts.length > 0) logger.info(`  • ${withScripts.length} data migration(s) (requires migration script execution)`, { mode: "plain" });
 		}
 	}
 	return {
 		pendingMigrations,
-		namespacesWithMigrations
+		namespacesWithMigrations,
+		migrationFileState: captureMigrationFileState(namespacesWithMigrations)
 	};
 }
 /**
@@ -10282,6 +10346,22 @@ function buildMigrationContextForScripts(client, migrationContext, migrationsReq
 		configDir: path.dirname(migrationContext.config.path)
 	};
 }
+async function validateTailorDBMigrationState(client, result) {
+	const { context } = result;
+	const typesByNamespace = /* @__PURE__ */ new Map();
+	for (const tailordb of context.tailorDBInputs) typesByNamespace.set(tailordb.namespace, tailordb.types);
+	const validation = await validateAndDetectMigrations(client, context.workspaceId, typesByNamespace, context.config, context.noSchemaCheck, context.tailorDBInputs);
+	if (!migrationFileStatesEqual(context.migrationFileState, validation.migrationFileState)) throw new Error("Migration files changed after deployment planning. Run the deployment again to create a fresh plan.");
+	return validation;
+}
+/**
+* Revalidate migration state before the deployment enters any mutation phase.
+* @param client - Operator client instance
+* @param result - Planned TailorDB changes
+*/
+async function preflightTailorDB(client, result) {
+	await validateTailorDBMigrationState(client, result);
+}
 /**
 * Apply TailorDB-related changes for the given phase.
 * @param client - Operator client instance
@@ -10291,9 +10371,7 @@ function buildMigrationContextForScripts(client, migrationContext, migrationsReq
 async function applyTailorDB(client, result, phase = "create-update") {
 	const { changeSet, context: migrationContext } = result;
 	if (phase === "create-update") {
-		const typesByNamespace = /* @__PURE__ */ new Map();
-		for (const tailordb of migrationContext.tailorDBInputs) typesByNamespace.set(tailordb.namespace, tailordb.types);
-		const { pendingMigrations, namespacesWithMigrations } = await validateAndDetectMigrations(client, migrationContext.workspaceId, typesByNamespace, migrationContext.config, migrationContext.noSchemaCheck, migrationContext.tailorDBInputs);
+		const { pendingMigrations, namespacesWithMigrations } = await validateTailorDBMigrationState(client, result);
 		if (pendingMigrations.length > 0) {
 			processedTypes.reset();
 			deletedResources.reset();
@@ -10701,6 +10779,12 @@ async function planTailorDB(context) {
 	const executors = forRemoval ? [] : Object.values(await application.executorService?.loadExecutors() ?? {});
 	const executorUsedTypes = new Set(context.executorUsedTailorDBTypes ?? []);
 	for (const executor of executors) if (executor.trigger.kind === "tailordb") executorUsedTypes.add(executor.trigger.typeName);
+	const typesByNamespace = /* @__PURE__ */ new Map();
+	for (const tailordb of tailordbs) typesByNamespace.set(tailordb.namespace, tailordb.types);
+	const { namespacesWithMigrations, migrationFileState } = forRemoval ? {
+		namespacesWithMigrations: [],
+		migrationFileState: {}
+	} : await validateAndDetectMigrations(client, workspaceId, typesByNamespace, config, noSchemaCheck ?? false, tailordbs);
 	const { changeSet: serviceChangeSet, conflicts, unmanaged, resourceOwners } = await planServices(client, workspaceId, application.name, application.id, tailordbs);
 	const deletedServices = serviceChangeSet.deletes.map((del) => del.name);
 	const [typeChangeSet, gqlPermissionChangeSet] = await Promise.all([planTypes(client, workspaceId, tailordbs, executorUsedTypes, deletedServices, void 0, forceApplyAll), planGqlPermissions(client, workspaceId, tailordbs, deletedServices, forceApplyAll)]);
@@ -10722,7 +10806,9 @@ async function planTailorDB(context) {
 			tailorDBInputs: tailordbs,
 			executorUsedTypes,
 			config,
-			noSchemaCheck: noSchemaCheck ?? false
+			noSchemaCheck: noSchemaCheck ?? false,
+			namespacesWithMigrations,
+			migrationFileState
 		}
 	};
 }
@@ -11134,7 +11220,7 @@ function formatMigrationCheckResults(results) {
 async function applyWorkflow(client, result, phase = "create-update") {
 	const { changeSet, appName, appId } = result;
 	if (phase === "create-update") {
-		const jobFunctionVersions = await registerJobFunctions(client, changeSet, appName, appId, result.unchangedWorkflowJobNames);
+		const jobFunctionVersions = await registerJobFunctions(client, changeSet, appName, appId, result.unchangedWorkflowJobNames, result.jobFunctionPublishEvents);
 		await Promise.all([...changeSet.creates.map(async (create) => {
 			const filteredVersions = filterJobFunctionVersions(jobFunctionVersions, create.usedJobNames);
 			const shape = buildWorkflowValidationShape(create.workspaceId, create.workflow);
@@ -11144,7 +11230,8 @@ async function applyWorkflow(client, result, phase = "create-update") {
 				mainJobFunctionName: shape.mainJobFunctionName,
 				retryPolicy: shape.retryPolicy,
 				concurrencyPolicy: shape.concurrencyPolicy,
-				jobFunctions: filteredVersions
+				jobFunctions: filteredVersions,
+				publishExecutionEvents: shape.publishExecutionEvents
 			});
 			await client.setMetadata(create.metaRequest);
 		}), ...changeSet.updates.map(async (update) => {
@@ -11156,7 +11243,8 @@ async function applyWorkflow(client, result, phase = "create-update") {
 				mainJobFunctionName: shape.mainJobFunctionName,
 				retryPolicy: shape.retryPolicy,
 				concurrencyPolicy: shape.concurrencyPolicy,
-				jobFunctions: filteredVersions
+				jobFunctions: filteredVersions,
+				publishExecutionEvents: shape.publishExecutionEvents
 			});
 			await client.setMetadata(update.metaRequest);
 		})]);
@@ -11217,9 +11305,10 @@ function filterJobFunctionVersions(allVersions, usedJobNames) {
 * @param appName - Application name
 * @param appId - Application ID used for job function metadata when available
 * @param unchangedWorkflowJobNames - Job function names used by unchanged workflows
+* @param jobFunctionPublishEvents - Resolved `publishExecutionEvents` keyed by job function name
 * @returns Map of job function names to versions
 */
-async function registerJobFunctions(client, changeSet, appName, appId, unchangedWorkflowJobNames = /* @__PURE__ */ new Set()) {
+async function registerJobFunctions(client, changeSet, appName, appId, unchangedWorkflowJobNames = /* @__PURE__ */ new Set(), jobFunctionPublishEvents = /* @__PURE__ */ new Map()) {
 	const jobFunctionVersions = {};
 	const firstWorkflow = changeSet.creates[0] || changeSet.updates[0] || changeSet.deletes[0];
 	if (!firstWorkflow) return jobFunctionVersions;
@@ -11238,15 +11327,14 @@ async function registerJobFunctions(client, changeSet, appName, appId, unchanged
 	const existingJobNamesSet = new Set(existingJobFunctions);
 	if (changeSet.creates.length > 0 || changeSet.updates.length > 0) {
 		const results = await Promise.all(Array.from(allUsedJobNames).map(async (jobName) => {
-			const response = existingJobNamesSet.has(jobName) ? await client.updateWorkflowJobFunction({
-				workspaceId,
-				jobFunctionName: jobName,
-				scriptRef: workflowJobFunctionName(jobName)
-			}) : await client.createWorkflowJobFunction({
+			const isExisting = existingJobNamesSet.has(jobName);
+			const request = {
 				workspaceId,
 				jobFunctionName: jobName,
-				scriptRef: workflowJobFunctionName(jobName)
-			});
+				scriptRef: workflowJobFunctionName(jobName),
+				publishExecutionEvents: jobFunctionPublishEvents.get(jobName) ?? false
+			};
+			const response = isExisting ? await client.updateWorkflowJobFunction(request) : await client.createWorkflowJobFunction(request);
 			await client.setMetadata(await buildMetaRequest({
 				trn: resourceTrn(workspaceId, "workflow_job_function", jobName),
 				appName,
@@ -11293,9 +11381,64 @@ function buildWorkflowValidationShape(workspaceId, workflow) {
 		workflowName: workflow.name,
 		mainJobFunctionName: workflow.mainJob.name,
 		...workflow.retryPolicy && { retryPolicy: toRetryPolicy(workflow.retryPolicy) },
-		...workflow.concurrencyPolicy && { concurrencyPolicy: toConcurrencyPolicy(workflow.concurrencyPolicy) }
+		...workflow.concurrencyPolicy && { concurrencyPolicy: toConcurrencyPolicy(workflow.concurrencyPolicy) },
+		publishExecutionEvents: workflow.publishEvents ?? false
 	};
 }
+const NO_EVENT_SUBSCRIBERS = { workflowNames: /* @__PURE__ */ new Set() };
+function isSubscribed(subscribers, workflowName) {
+	return subscribers.workflowNames.has(workflowName);
+}
+function resolvePublishEvents(params) {
+	const { explicit, subscribed, remote, conflictError } = params;
+	if (explicit === false && subscribed) throw new Error(conflictError);
+	if (explicit !== void 0) return explicit;
+	return subscribed || (remote ?? false);
+}
+/**
+* Resolve `publishExecutionEvents` for every job function used by a workflow.
+*
+* A job execution trigger names a workflow rather than a job, so a subscription
+* opts in every job that workflow runs.
+* @param params - Workflows, their job dependencies, subscribers, explicit job flags, and existing job functions
+* @returns Resolved flags keyed by job function name
+*/
+function resolveJobPublishEvents(params) {
+	const { workflows, mainJobDeps, subscribers, explicit, existing } = params;
+	const usedJobNames = /* @__PURE__ */ new Set();
+	const subscribedJobNames = /* @__PURE__ */ new Set();
+	for (const workflow of Object.values(workflows)) {
+		const jobNames = mainJobDeps[workflow.mainJob.name];
+		if (!jobNames) continue;
+		const subscribed = isSubscribed(subscribers, workflow.name);
+		for (const jobName of jobNames) {
+			usedJobNames.add(jobName);
+			if (subscribed) subscribedJobNames.add(jobName);
+		}
+	}
+	const resolved = /* @__PURE__ */ new Map();
+	for (const jobName of usedJobNames) resolved.set(jobName, resolvePublishEvents({
+		explicit: explicit.get(jobName),
+		subscribed: subscribedJobNames.has(jobName),
+		remote: existing.get(jobName)?.publishExecutionEvents,
+		conflictError: `Job "${jobName}" has "publishEvents: false", but executors with a workflowJobExecution trigger subscribe to a workflow that runs it. Either remove "publishEvents: false" or remove the matching executor triggers.`
+	}));
+	return resolved;
+}
+/**
+* Collect job functions whose remote publishing flag no longer matches the plan.
+* @param existing - Existing job functions keyed by name
+* @param resolved - Resolved `publishExecutionEvents` keyed by job function name
+* @returns Job function names needing re-registration
+*/
+function collectStaleJobFunctionNames(existing, resolved) {
+	const stale = /* @__PURE__ */ new Set();
+	for (const [jobName, publishEvents] of resolved) {
+		const remote = existing.get(jobName);
+		if (remote && remote.publishExecutionEvents !== publishEvents) stale.add(jobName);
+	}
+	return stale;
+}
 /**
 * Plan workflow changes and job functions based on current and desired state.
 * @param client - Operator client instance
@@ -11305,15 +11448,26 @@ function buildWorkflowValidationShape(workspaceId, workflow) {
 * @param workflows - Parsed workflows
 * @param mainJobDeps - Main job dependencies by workflow
 * @param unchangedJobFunctions - Job functions already proven unchanged by function registry plan
+* @param eventPublishing - Executor subscriptions and explicit job flags driving execution event publishing
 * @returns Planned workflow changes
 */
-async function planWorkflow(client, workspaceId, appName, appId, workflows, mainJobDeps, unchangedJobFunctions = /* @__PURE__ */ new Set()) {
+async function planWorkflow(client, workspaceId, appName, appId, workflows, mainJobDeps, unchangedJobFunctions = /* @__PURE__ */ new Set(), eventPublishing = {}) {
 	const changeSet = createChangeSet("Workflows");
 	const conflicts = [];
 	const unmanaged = [];
 	const resourceOwners = /* @__PURE__ */ new Set();
 	const unchangedWorkflowJobNames = /* @__PURE__ */ new Set();
 	const retainedWorkflowJobNames = /* @__PURE__ */ new Set();
+	const executionSubscribers = eventPublishing.execution ?? NO_EVENT_SUBSCRIBERS;
+	const existingJobFunctions = await fetchExistingJobFunctions(client, workspaceId);
+	const jobFunctionPublishEvents = resolveJobPublishEvents({
+		workflows,
+		mainJobDeps,
+		subscribers: eventPublishing.jobExecution ?? NO_EVENT_SUBSCRIBERS,
+		explicit: eventPublishing.jobPublishEvents ?? /* @__PURE__ */ new Map(),
+		existing: existingJobFunctions
+	});
+	const staleJobFunctionNames = collectStaleJobFunctionNames(existingJobFunctions, jobFunctionPublishEvents);
 	const existingWorkflows = await fetchExistingResourcesWithLabels({
 		client,
 		fetchPage: async (pageToken, pageSize) => {
@@ -11337,6 +11491,15 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 		const usedJobNames = mainJobDeps[workflow.mainJob.name];
 		if (!usedJobNames) throw new Error(`Job "${workflow.mainJob.name}" (mainJob of workflow "${workflow.name}") was not found.\n\nPossible causes:\n  - The job is not exported as a named export\n  - The file containing the job is not included in workflow.files glob pattern\n\nSolution:\n  export const ${workflow.mainJob.name} = createWorkflowJob({ name: "${workflow.mainJob.name}", ... })`);
 		usedJobNames.forEach((jobName) => retainedWorkflowJobNames.add(jobName));
+		const desiredWorkflow = {
+			...workflow,
+			publishEvents: resolvePublishEvents({
+				explicit: workflow.publishEvents,
+				subscribed: isSubscribed(executionSubscribers, workflow.name),
+				remote: existing?.resource.publishExecutionEvents,
+				conflictError: `Workflow "${workflow.name}" has "publishEvents: false", but executors with a workflowExecution trigger subscribe to it. Either remove "publishEvents: false" or remove the matching executor triggers.`
+			})
+		};
 		if (existing) {
 			if (trackDesiredResourceOwnership({
 				labels: existing.allLabels,
@@ -11347,13 +11510,19 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 				resourceName: workflow.name,
 				conflicts,
 				unmanaged
-			}) && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && canTreatWorkflowAsUnchanged(existing.resource, workflow, usedJobNames, unchangedJobFunctions)) {
+			}) && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && canTreatWorkflowAsUnchanged({
+				existing: existing.resource,
+				workflow: desiredWorkflow,
+				usedJobNames,
+				unchangedJobFunctions,
+				staleJobFunctionNames
+			})) {
 				changeSet.unchanged.push({ name: workflow.name });
 				for (const jobName of usedJobNames) unchangedWorkflowJobNames.add(jobName);
 			} else changeSet.updates.push({
 				name: workflow.name,
 				workspaceId,
-				workflow,
+				workflow: desiredWorkflow,
 				usedJobNames,
 				metaRequest
 			});
@@ -11361,7 +11530,7 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 		} else changeSet.creates.push({
 			name: workflow.name,
 			workspaceId,
-			workflow,
+			workflow: desiredWorkflow,
 			usedJobNames,
 			metaRequest
 		});
@@ -11391,6 +11560,7 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 		workspaceId,
 		appName,
 		appId,
+		existingJobFunctionNames: [...existingJobFunctions.keys()],
 		retainedWorkflowJobNames
 	});
 	const deletableJobNames = new Set(jobFunctionDeletes.map((del) => del.jobFunctionName));
@@ -11406,20 +11576,24 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 		appName,
 		appId,
 		unchangedWorkflowJobNames,
-		jobFunctionDeletes
+		jobFunctionDeletes,
+		jobFunctionPublishEvents
 	};
 }
-async function planWorkflowJobFunctionDeletes(params) {
-	const { client, workspaceId, appName, appId, retainedWorkflowJobNames } = params;
-	const existingJobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
+async function fetchExistingJobFunctions(client, workspaceId) {
+	const jobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
 		const response = await client.listWorkflowJobFunctions({
 			workspaceId,
 			pageToken,
 			pageSize: maxPageSize
 		});
-		return [response.jobFunctions.map((jobFunction) => jobFunction.name), response.nextPageToken];
+		return [response.jobFunctions, response.nextPageToken];
 	});
-	const candidates = [...new Set(existingJobFunctions)].filter((jobName) => !retainedWorkflowJobNames.has(jobName));
+	return new Map(jobFunctions.map((jobFunction) => [jobFunction.name, jobFunction]));
+}
+async function planWorkflowJobFunctionDeletes(params) {
+	const { client, workspaceId, appName, appId, existingJobFunctionNames, retainedWorkflowJobNames } = params;
+	const candidates = existingJobFunctionNames.filter((jobName) => !retainedWorkflowJobNames.has(jobName));
 	return (await Promise.all(candidates.map(async (jobFunctionName) => {
 		const { metadata } = await client.getMetadata({ trn: resourceTrn(workspaceId, "workflow_job_function", jobFunctionName) });
 		return isOwnedByApp(metadata?.labels, appName, appId) ? {
@@ -11437,12 +11611,14 @@ async function planWorkflowJobFunctionDeletes(params) {
 function formatWorkflowChangeEntries(changeSet, workflowJobFunctionChanges) {
 	return formatChangeEntriesWithFunctionRegistry("workflow", changeSet, workflowJobFunctionChanges, (item) => "usedJobNames" in item ? item.usedJobNames.map((jobName) => workflowJobFunctionName(jobName)) : []);
 }
-function canTreatWorkflowAsUnchanged(existing, workflow, usedJobNames, unchangedJobFunctions) {
+function canTreatWorkflowAsUnchanged(params) {
+	const { existing, workflow, usedJobNames, unchangedJobFunctions, staleJobFunctionNames } = params;
 	if (!usedJobNames.every((jobName) => unchangedJobFunctions.has(jobName))) return false;
+	if (usedJobNames.some((jobName) => staleJobFunctionNames.has(jobName))) return false;
 	return areWorkflowsEqual(existing, workflow, usedJobNames);
 }
 function areWorkflowsEqual(existing, workflow, usedJobNames) {
-	return existing.mainJobFunctionName === workflow.mainJob.name && areNormalizedEqual(normalizeComparableExistingWorkflowRetryPolicy(existing.retryPolicy), normalizeComparableWorkflowRetryPolicy(workflow.retryPolicy)) && areNormalizedEqual(normalizeComparableConcurrencyPolicy(existing.concurrencyPolicy), normalizeComparableConcurrencyPolicy(workflow.concurrencyPolicy)) && areNormalizedEqual(normalizeComparableWorkflowJobNames(existing.jobFunctions), normalizeComparableWorkflowJobNames(usedJobNames));
+	return existing.mainJobFunctionName === workflow.mainJob.name && (existing.publishExecutionEvents ?? false) === (workflow.publishEvents ?? false) && areNormalizedEqual(normalizeComparableExistingWorkflowRetryPolicy(existing.retryPolicy), normalizeComparableWorkflowRetryPolicy(workflow.retryPolicy)) && areNormalizedEqual(normalizeComparableConcurrencyPolicy(existing.concurrencyPolicy), normalizeComparableConcurrencyPolicy(workflow.concurrencyPolicy)) && areNormalizedEqual(normalizeComparableWorkflowJobNames(existing.jobFunctions), normalizeComparableWorkflowJobNames(usedJobNames));
 }
 function normalizeComparableExistingWorkflowRetryPolicy(policy) {
 	if (!policy) return;
@@ -11699,6 +11875,9 @@ async function applyDeploymentPlans(client, workspaceId, deployments) {
 	const forEachDeployment = async (apply) => {
 		for (const deployment of deployments) await apply(deployment);
 	};
+	await withSpan("apply.preflight", async () => {
+		await forEachDeployment((d) => preflightTailorDB(client, d.tailorDB));
+	});
 	await withSpan("apply.createUpdateServices", async () => {
 		await forEachDeployment((d) => applySecretManager(client, d.secretManager, "create-update", d.application));
 		await forEachDeployment((d) => applyFunctionRegistry(client, workspaceId, d.functionRegistry, "create-update"));
@@ -13137,6 +13316,39 @@ function collectExecutorUsedResolvers(owner, targets) {
 	}
 	return usedResolvers;
 }
+/**
+* Resolve which workflows this target's executors subscribe to, per event
+* granularity level.
+*
+* Scoped to the owning target: unlike TailorDB, Auth and IdP, a workflow has no
+* `external` declaration, so no supported configuration shares a workflow and a
+* subscribing executor across configs.
+* @param target - Deployment target being planned
+* @returns Subscribers keyed by event granularity level
+*/
+function collectWorkflowEventSubscribers(target) {
+	const execution = { workflowNames: /* @__PURE__ */ new Set() };
+	const jobExecution = { workflowNames: /* @__PURE__ */ new Set() };
+	for (const executor of Object.values(target.application.executorService?.executors ?? {})) {
+		const { trigger } = executor;
+		if (trigger.kind !== "workflowExecution" && trigger.kind !== "workflowJobExecution") continue;
+		(trigger.kind === "workflowExecution" ? execution : jobExecution).workflowNames.add(trigger.workflowName);
+	}
+	return {
+		execution,
+		jobExecution
+	};
+}
+/**
+* Collect explicit `publishEvents` values declared on this target's workflow jobs.
+* @param target - Deployment target being planned
+* @returns Explicit flags keyed by job name
+*/
+function collectWorkflowJobPublishEvents(target) {
+	const jobPublishEvents = /* @__PURE__ */ new Map();
+	for (const job of target.application.workflowService?.jobs ?? []) if (job.publishEvents !== void 0) jobPublishEvents.set(job.name, job.publishEvents);
+	return jobPublishEvents;
+}
 function collectExpectedLocalStaticWebsiteNames(targets) {
 	const websiteNames = /* @__PURE__ */ new Set();
 	for (const target of targets) for (const website of target.application.staticWebsiteServices) websiteNames.add(website.name);
@@ -13738,7 +13950,10 @@ async function planDeploymentTarget(params) {
 			withSpan("plan.pipeline", () => planPipeline(ctx)),
 			withSpan("plan.application", () => planApplication(ctx, httpAdapterBuildResult)),
 			withSpan("plan.executor", () => planExecutor(ctx)),
-			withSpan("plan.workflow", () => planWorkflow(client, workspaceId, application.name, application.id, workflowService?.workflows ?? {}, workflowBuildResult?.mainJobDeps ?? {}, unchangedWorkflowJobs)),
+			withSpan("plan.workflow", () => planWorkflow(client, workspaceId, application.name, application.id, workflowService?.workflows ?? {}, workflowBuildResult?.mainJobDeps ?? {}, unchangedWorkflowJobs, {
+				...collectWorkflowEventSubscribers(target),
+				jobPublishEvents: collectWorkflowJobPublishEvents(target)
+			})),
 			withSpan("plan.workflowExecutionPolicy", () => planWorkflowJobFunctionExecutionPolicy(client, workspaceId, application.name, application.id, config.workflow?.executionPolicies ?? {})),
 			withSpan("plan.secretManager", () => planSecretManager(ctx))
 		]);
@@ -14553,6 +14768,12 @@ function formatEventTriggerConfig(config) {
 		eventType: config.eventType,
 		condition: config.condition?.expr || ""
 	};
+	if (typedConfig.case === "workflow") return {
+		kind: typedConfig.case,
+		eventTypes: typedConfig.value.eventTypes,
+		condition: typedConfig.value.condition?.expr || "",
+		...typedConfig.value.workflowName && { workflowName: typedConfig.value.workflowName }
+	};
 	const base = {
 		kind: typedConfig.case,
 		eventTypes: typedConfig.value.eventTypes,
@@ -18860,8 +19081,13 @@ async function generateDiffFiles(diff, migrationsDir, migrationNumber, previousS
 function generateMigrationScript(diff) {
 	const updates = [];
 	for (const change of diff.changes) {
-		const script = generateChangeScript(change);
-		if (script) updates.push(script);
+		const decimalScaleScript = generateDecimalScaleChangeScript(change);
+		updates.push(...generateChangeScripts(change, decimalScaleScript !== null));
+		if (decimalScaleScript) {
+			updates.push(decimalScaleScript);
+			const uniqueConstraintScript = generateUniqueConstraintScript(change);
+			if (uniqueConstraintScript) updates.push(uniqueConstraintScript);
+		}
 	}
 	if (updates.length === 0) updates.push(`  // No data migration needed for this schema change
   // Add custom data transformations if required`);
@@ -18886,18 +19112,19 @@ ${updates.join("\n\n")}
 `;
 }
 /**
-* Generate script for a single change
+* Generate scripts for a single change
 * @param {DiffChange} change - Diff change to generate script for
-* @returns {string | null} Script content or null if no script needed
+* @param {boolean} deferUniqueConstraint - Generate the unique check after decimal re-serialization
+* @returns {string[]} Script contents, or an empty array if no script is needed
 */
-function generateChangeScript(change) {
+function generateChangeScripts(change, deferUniqueConstraint = false) {
 	if (change.kind === "index_added" || change.kind === "index_modified") {
 		const before = change.kind === "index_modified" ? change.before : void 0;
-		if (!isBreakingIndexChange(change.typeName, change.indexName, before, change.after)) return null;
+		if (!isBreakingIndexChange(change.typeName, change.indexName, before, change.after)) return [];
 		const fields = change.after.fields;
 		const fieldList = fields.map((f) => `"${f}"`).join(", ");
 		const whereClauses = fields.map((f) => `.where("${f}", "=", dup.${f})`).join("\n        ");
-		return `  // Resolve duplicate (${fields.join(", ")}) combinations before unique index "${change.indexName}" is enforced
+		return [`  // Resolve duplicate (${fields.join(", ")}) combinations before unique index "${change.indexName}" is enforced
   {
     const duplicates = await trx
       .selectFrom("${change.typeName}")
@@ -18920,81 +19147,135 @@ function generateChangeScript(change) {
           .execute();
       }
     }
-  }`;
+  }`];
 	}
 	if (change.kind === "field_added") {
-		if (change.after.required) return `  // Populate ${change.fieldName} for existing ${change.typeName} records
+		if (change.after.required) return [`  // Populate ${change.fieldName} for existing ${change.typeName} records
   await trx
     .updateTable("${change.typeName}")
     .set({
       ${change.fieldName}: null, // TODO: Set appropriate default value
     })
-    .execute();`;
-		return null;
+    .execute();`];
+		return [];
 	}
-	if (change.kind !== "field_modified") return null;
+	if (change.kind !== "field_modified") return [];
 	const { before, after } = change;
-	if (!before.required && after.required) return `  // Set ${change.fieldName} for ${change.typeName} records where it is null
+	const scripts = [];
+	if (!before.required && after.required) scripts.push(`  // Set ${change.fieldName} for ${change.typeName} records where it is null
   await trx
     .updateTable("${change.typeName}")
     .set({
       ${change.fieldName}: null, // TODO: Set appropriate default value
     })
     .where("${change.fieldName}", "is", null)
-    .execute();`;
-	if (!(before.unique ?? false) && (after.unique ?? false)) return `  // Ensure ${change.fieldName} values are unique before adding constraint
-  const duplicates = await trx
-    .selectFrom("${change.typeName}")
-    .select(["${change.fieldName}"])
-    .groupBy("${change.fieldName}")
-    .having((eb) => eb.fn.count("id"), ">", 1)
-    .execute();
-  for (const dup of duplicates) {
-    // Keep first record, add suffix to others
-    const records = await trx
-      .selectFrom("${change.typeName}")
-      .select(["id", "${change.fieldName}"])
-      .where("${change.fieldName}", "=", dup.${change.fieldName})
-      .execute();
-    for (let i = 1; i < records.length; i++) {
-      await trx
-        .updateTable("${change.typeName}")
-        .set({ ${change.fieldName}: \`\${records[i].${change.fieldName}}_\${i}\` }) // TODO: Set appropriate unique value
-        .where("id", "=", records[i].id)
-        .execute();
-    }
-  }`;
+    .execute();`);
+	if (!deferUniqueConstraint) {
+		const uniqueConstraintScript = generateUniqueConstraintScript(change);
+		if (uniqueConstraintScript) scripts.push(uniqueConstraintScript);
+	}
 	if (before.type === "enum" && after.type === "enum") {
 		const beforeValues = (before.allowedValues ?? []).map((v) => v.value);
 		const afterValues = (after.allowedValues ?? []).map((v) => v.value);
 		const removedValues = beforeValues.filter((v) => !afterValues.includes(v));
 		if (removedValues.length > 0) {
 			const defaultValue = afterValues[0] ?? "NEW_VALUE";
-			return `  // Migrate records with removed enum values: ${removedValues.join(", ")}
+			scripts.push(`  // Migrate records with removed enum values: ${removedValues.join(", ")}
   await trx
     .updateTable("${change.typeName}")
     .set({ ${change.fieldName}: "${defaultValue}" }) // TODO: Set appropriate value
     .where("${change.fieldName}", "in", [${removedValues.map((v) => `"${v}"`).join(", ")}])
-    .execute();`;
+    .execute();`);
 		}
 	}
-	if (before.foreignKeyType && after.foreignKeyType && before.foreignKeyType !== after.foreignKeyType) return `  // Migrate ${change.fieldName} references from ${before.foreignKeyType} to ${after.foreignKeyType}
+	if (before.foreignKeyType && after.foreignKeyType && before.foreignKeyType !== after.foreignKeyType) scripts.push(`  // Migrate ${change.fieldName} references from ${before.foreignKeyType} to ${after.foreignKeyType}
   // Find records that don't have a valid reference in the new target table
-  const orphanedRecords = await trx
-    .selectFrom("${change.typeName}")
-    .leftJoin("${after.foreignKeyType}", "${change.typeName}.${change.fieldName}", "${after.foreignKeyType}.id")
-    .select(["${change.typeName}.id", "${change.typeName}.${change.fieldName}"])
-    .where("${after.foreignKeyType}.id", "is", null)
-    .where("${change.typeName}.${change.fieldName}", "is not", null)
-    .execute();
-  for (const record of orphanedRecords) {
-    await trx
-      .updateTable("${change.typeName}")
-      .set({ ${change.fieldName}: null }) // TODO: Set appropriate new reference
-      .where("id", "=", record.id)
+  {
+    const orphanedRecords = await trx
+      .selectFrom("${change.typeName}")
+      .leftJoin("${after.foreignKeyType}", "${change.typeName}.${change.fieldName}", "${after.foreignKeyType}.id")
+      .select(["${change.typeName}.id", "${change.typeName}.${change.fieldName}"])
+      .where("${after.foreignKeyType}.id", "is", null)
+      .where("${change.typeName}.${change.fieldName}", "is not", null)
       .execute();
+    for (const record of orphanedRecords) {
+      await trx
+        .updateTable("${change.typeName}")
+        .set({ ${change.fieldName}: null }) // TODO: Set appropriate new reference
+        .where("id", "=", record.id)
+        .execute();
+    }
+  }`);
+	return scripts;
+}
+function generateUniqueConstraintScript(change) {
+	if (change.kind !== "field_modified") return null;
+	const { before, after } = change;
+	if ((before.unique ?? false) || !(after.unique ?? false)) return null;
+	return `  // Ensure ${change.fieldName} values are unique before adding constraint
+  {
+    const duplicates = await trx
+      .selectFrom("${change.typeName}")
+      .select(["${change.fieldName}"])
+      .groupBy("${change.fieldName}")
+      .having((eb) => eb.fn.count("id"), ">", 1)
+      .execute();
+    for (const dup of duplicates) {
+      // Keep first record, add suffix to others
+      const records = await trx
+        .selectFrom("${change.typeName}")
+        .select(["id", "${change.fieldName}"])
+        .where("${change.fieldName}", "=", dup.${change.fieldName})
+        .execute();
+      for (let i = 1; i < records.length; i++) {
+        await trx
+          .updateTable("${change.typeName}")
+          .set({ ${change.fieldName}: \`\${records[i].${change.fieldName}}_\${i}\` }) // TODO: Set appropriate unique value
+          .where("id", "=", records[i].id)
+          .execute();
+      }
+    }
+  }`;
+}
+function generateDecimalScaleChangeScript(change) {
+	if (change.kind !== "field_modified") return null;
+	const { before, after } = change;
+	if (before.type !== "decimal" || after.type !== "decimal" || before.scale === after.scale) return null;
+	const valueExpression = !before.required && after.required ? `row.${change.fieldName}!` : `row.${change.fieldName}`;
+	const beforeScale = before.scale ?? 6;
+	const roundingWarning = (after.scale ?? 6) < beforeScale ? `
+  // Values that exceed the new scale may be rounded half-up, so review the
+  // resulting precision before deploying.` : "";
+	return `  // Re-save existing ${change.typeName} rows so ${change.fieldName} is stored under the new scale.
+  // This is a workaround for a platform-side gap where rows written under the
+  // previous scale could fail on later updates until re-saved. Keep it unless
+  // your platform is confirmed to handle stored values across scale changes.${roundingWarning}
+  {
+    let lastId: string | undefined;
+    while (true) {
+      let query = trx
+        .selectFrom("${change.typeName}")
+        .select(["id", "${change.fieldName}"])
+        .where("${change.fieldName}", "is not", null)
+        .orderBy("id", "asc")
+        .limit(100);
+      if (lastId) {
+        query = query.where("id", ">", lastId);
+      }
+      const rows = await query.execute();
+      if (rows.length === 0) break;
+
+      for (const row of rows) {
+        await trx
+          .updateTable("${change.typeName}")
+          .set({ ${change.fieldName}: ${valueExpression} })
+          .where("id", "=", row.id)
+          .where("${change.fieldName}", "=", ${valueExpression})
+          .execute();
+      }
+      lastId = rows[rows.length - 1]!.id;
+    }
   }`;
-	return null;
 }
 
 //#endregion
@@ -19063,7 +19344,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-CP7JKG9R.mjs");
+	const { defineApplication } = await import("./application-5FOWIxFQ.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -21192,4 +21473,4 @@ async function registerTypeScriptRuntime(hookUrl) {
 
 //#endregion
 export { listFolders as $, deploymentArgs as $n, handleOptionalToRequiredError as $t, generate as A, generateUserTypes as An, startCommand as At, remove as B, loadConsoleBaseUrl as Bn, deploy as Bt, waitWorkflowExecution as C, formatDiffSummary as Cn, listCommand$8 as Ct, listWorkflows as D, resourceTrn as Dn, jobsCommand as Dt, listCommand$2 as E, getNamespacesWithMigrations as En, getExecutorWaitFailureMessage as Et, openInConfiguredEditor as F, deleteUserTokens as Fn, getWorkflowExecution as Ft, treeCommand as G, readPlatformConfig as Gn, createWorkspace$1 as Gt, updateCommand$1 as H, loadStoredUserTokens as Hn, listCommand$9 as Ht, show as I, fetchLatestToken as In, listWorkflowExecutions as It, getCommand$1 as J, writePlatformConfig as Jn, ensureConfigId as Jt, listCommand$3 as K, resolveUserTokenKey as Kn, formatKeyValueTable as Kt, showCommand as L, hasAnyUserTokenEntry as Ln, functionExecutionStatusToString as Lt, generateMigrationScript as M, apiCall as Mn, getCommand$5 as Mt, writeDbTypesFile as N, assertWritable as Nn, getWorkflow as Nt, truncate as O, sdkNameLabelKey as On, listExecutorJobs as Ot, getConfiguredEditorCommand as P, loadConfig as Pn, executionsCommand as Pt, listCommand$4 as Q, confirmationArgs as Qn, MIGRATION_LABEL_KEY as Qt, extractOwnedNamespaces as R, hasUserTokenEntry as Rn, getCommand$6 as Rt, waitCommand as S, parseMigrationNumberArg as Sn, triggerExecutor as St, resumeWorkflow as T, hasChanges as Tn, getExecutorJob as Tt, updateOrganization as U, loadWorkspaceId as Un, listWorkspaces as Ut, removeCommand$1 as V, loadMachineUserName as Vn, deployFromCLI as Vt, organizationTree as W, platformConfigFromProfile as Wn, createCommand$1 as Wt, updateCommand$2 as X, commonArgs as Xn, waitForExecution as Xt, getOrganization as Y, defineAppCommand as Yn, executeScript as Yt, updateFolder as Z, configArg as Zn, bundleMigrationScript as Zt, deleteWorkspace as _, getNextMigrationNumber as _n, getCommand$4 as _t, updateUser as a, DIFF_FILE_NAME as an, toPageDirection as ar, createFolder as at, getAppHealth as b, reconstructSnapshotFromMigrations as bn, webhookCommand as bt, listCommand as c, SCHEMA_FILE_NAME as cn, getCommand$3 as ct, inviteUser as d, compareSnapshots as dn, tokenCommand as dt, parseMigrationLabelNumber as en, isVerbose as er, getCommand$2 as et, restoreCommand as f, createSnapshotFromLocalTypes as fn, listCommand$6 as ft, deleteCommand as g, getMigrationFiles as gn, listFunctionRegistries as gt, getWorkspace as h, getMigrationFilePath as hn, listCommand$7 as ht, updateCommand as i, DB_TYPES_FILE_NAME as in, resolveMachineUserInputSource as ir, createCommand as it, generateCommand as j, prompt as jn, startWorkflow as jt, truncateCommand as k, PluginManager as kn, watchExecutorJob as kt, listUsers as l, assertValidMigrationFiles as ln, getOAuth2Client as lt, getCommand as m, getMigrationDirPath as mn, generate$1 as mt, query as n, generateAllTypeManifestsFromSnapshot as nn, pagedLogArgs as nr, deleteCommand$1 as nt, removeCommand as o, INITIAL_SCHEMA_NUMBER as on, workspaceArgs as or, listCommand$5 as ot, restoreWorkspace as p, getLatestMigrationNumber as pn, listMachineUsers as pt, listOrganizations as q, saveUserTokens as qn, workspaceNameSchema as qt, queryCommand as r, protoGqlPermission as rn, paginationArgs as rr, deleteFolder as rt, removeUser as s, MIGRATE_FILE_NAME as sn, listOAuth2Clients as st, registerTypeScriptRuntime as t, compareSnapshotWithRemote as tn, multiConfigArg as tr, getFolder as tt, inviteCommand as u, compareLocalTypesWithSnapshot as un, getMachineUserToken as ut, listApps as v, isValidMigrationNumber as vn, getFunctionRegistry as vt, resumeCommand as w, formatMigrationDiff as wn, listExecutors as wt, healthCommand as x, formatMigrationNumber as xn, triggerCommand as xt, listCommand$1 as y, loadDiff as yn, listWebhookExecutors as yt, logBetaWarning as z, loadAccessToken as zn, getExecutor as zt };
-//# sourceMappingURL=register-typescript-runtime-CCHyKeXO.mjs.map
+//# sourceMappingURL=register-typescript-runtime-BCvWR3HC.mjs.map