@tailor-platform/sdk 1.83.0 → 1.85.0

package/dist/{register-typescript-runtime-CCHyKeXO.mjs → register-typescript-runtime-nG-n9lPw.mjs}

@@ -1,14 +1,14 @@
 import { t as db } from "./schema-CYrle8JZ.mjs";
-import { $ as CreateAuthHookRequestSchema, B as IdPLang, Bt as Subgraph_ServiceType, C as CreateStaticWebsiteRequestSchema, Ct as AuthInvokerSchema, D as CreateSecretManagerSecretRequestSchema, Dt as AuthSCIMAttribute_Type, Et as AuthSCIMAttribute_Mutability, Ft as CreateApplicationRequestSchema, H as IdPPermissionPermit, Ht as UpdateAIGatewayRequestSchema, I as PipelineResolver_OperationType, It as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, Jt as FilterSchema, K as CreateExecutorExecutorRequestSchema, Kt as ConditionSchema, L as CreateIdPServiceRequestSchema, Lt as UpdateApplicationRequestSchema, M as CreatePipelineServiceRequestSchema, Mt as UserProfileProviderConfig_UserProfileProviderType, N as UpdatePipelineResolverRequestSchema, O as CreateSecretManagerVaultRequestSchema, Ot as AuthSCIMAttribute_Uniqueness, P as UpdatePipelineServiceRequestSchema, Q as CreateAuthConnectionRequestSchema, R as UpdateIdPServiceRequestSchema, S as AddCustomDomainRequestSchema, St as AuthIDPConfig_AuthType, Tt as AuthOAuth2Client_GrantType, U as FunctionExecution_Status, V as IdPPermissionOperator, Vt as CreateAIGatewayRequestSchema, X as ExecutorTargetType, Y as ExecutorJobStatus, Yt as PageDirection, Z as ExecutorTriggerType, _ as TailorDBGQLPermission_Permit, _t as UpdateUserProfileConfigRequestSchema, a as CreateWorkflowRequestSchema, at as CreateAuthServiceRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthConnection_Type, ct as UpdateAuthConnectionRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as UpdateAuthMachineUserRequestSchema, et as CreateAuthIDPConfigRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as UpdateAuthOAuth2ClientRequestSchema, g as TailorDBGQLPermission_Operator, gt as UpdateTenantConfigRequestSchema, h as TailorDBGQLPermission_Action, ht as UpdateAuthServiceRequestSchema, i as CreateWorkflowJobFunctionRequestSchema, it as CreateAuthSCIMResourceRequestSchema, j as CreatePipelineResolverRequestSchema, jt as TenantProviderConfig_TenantProviderType, k as UpdateSecretManagerSecretRequestSchema, kt as AuthSCIMConfig_AuthorizationType, l as WorkflowExecution_Status, lt as UpdateAuthHookRequestSchema, mt as UpdateAuthSCIMResourceRequestSchema, nt as CreateAuthOAuth2ClientRequestSchema, o as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as CreateTenantConfigRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as UpdateAuthSCIMConfigRequestSchema, q as UpdateExecutorExecutorRequestSchema, qt as Condition_Operator, r as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, rt as CreateAuthSCIMConfigRequestSchema, s as UpdateWorkflowRequestSchema, st as CreateUserProfileConfigRequestSchema, t as WorkspacePlatformUserRole, tt as CreateAuthMachineUserRequestSchema, u as WorkflowJobExecution_Status, ut as UpdateAuthIDPConfigRequestSchema, v as TailorDBTypeSchema, w as UpdateStaticWebsiteRequestSchema, wt as AuthOAuth2Client_ClientType, x as TailorDBType_PermitAction, xt as AuthHookPoint, y as TailorDBType_Permission_Operator, yt as AuthConnection_Status, zt as ApplicationSchemaUpdateAttemptStatus } from "./workspace_resource_pb-UGK1SSn_.mjs";
+import { $ as CreateAuthHookRequestSchema, B as IdPLang, Bt as Subgraph_ServiceType, C as CreateStaticWebsiteRequestSchema, Ct as AuthInvokerSchema, D as CreateSecretManagerSecretRequestSchema, Dt as AuthSCIMAttribute_Type, Et as AuthSCIMAttribute_Mutability, Ft as CreateApplicationRequestSchema, H as IdPPermissionPermit, Ht as UpdateAIGatewayRequestSchema, I as PipelineResolver_OperationType, It as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, Jt as FilterSchema, K as CreateExecutorExecutorRequestSchema, Kt as ConditionSchema, L as CreateIdPServiceRequestSchema, Lt as UpdateApplicationRequestSchema, M as CreatePipelineServiceRequestSchema, Mt as UserProfileProviderConfig_UserProfileProviderType, N as UpdatePipelineResolverRequestSchema, O as CreateSecretManagerVaultRequestSchema, Ot as AuthSCIMAttribute_Uniqueness, P as UpdatePipelineServiceRequestSchema, Q as CreateAuthConnectionRequestSchema, R as UpdateIdPServiceRequestSchema, S as AddCustomDomainRequestSchema, St as AuthIDPConfig_AuthType, Tt as AuthOAuth2Client_GrantType, U as FunctionExecution_Status, V as IdPPermissionOperator, Vt as CreateAIGatewayRequestSchema, X as ExecutorTargetType, Y as ExecutorJobStatus, Yt as PageDirection, Z as ExecutorTriggerType, _ as TailorDBGQLPermission_Permit, _t as UpdateUserProfileConfigRequestSchema, a as CreateWorkflowRequestSchema, at as CreateAuthServiceRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthConnection_Type, ct as UpdateAuthConnectionRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as UpdateAuthMachineUserRequestSchema, et as CreateAuthIDPConfigRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as UpdateAuthOAuth2ClientRequestSchema, g as TailorDBGQLPermission_Operator, gt as UpdateTenantConfigRequestSchema, h as TailorDBGQLPermission_Action, ht as UpdateAuthServiceRequestSchema, i as CreateWorkflowJobFunctionRequestSchema, it as CreateAuthSCIMResourceRequestSchema, j as CreatePipelineResolverRequestSchema, jt as TenantProviderConfig_TenantProviderType, k as UpdateSecretManagerSecretRequestSchema, kt as AuthSCIMConfig_AuthorizationType, l as WorkflowExecution_Status, lt as UpdateAuthHookRequestSchema, mt as UpdateAuthSCIMResourceRequestSchema, nt as CreateAuthOAuth2ClientRequestSchema, o as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as CreateTenantConfigRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as UpdateAuthSCIMConfigRequestSchema, q as UpdateExecutorExecutorRequestSchema, qt as Condition_Operator, r as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, rt as CreateAuthSCIMConfigRequestSchema, s as UpdateWorkflowRequestSchema, st as CreateUserProfileConfigRequestSchema, t as WorkspacePlatformUserRole, tt as CreateAuthMachineUserRequestSchema, u as WorkflowJobExecution_Status, ut as UpdateAuthIDPConfigRequestSchema, v as TailorDBTypeSchema, w as UpdateStaticWebsiteRequestSchema, wt as AuthOAuth2Client_ClientType, x as TailorDBType_PermitAction, xt as AuthHookPoint, y as TailorDBType_Permission_Operator, yt as AuthConnection_Status, zt as ApplicationSchemaUpdateAttemptStatus } from "./workspace_resource_pb-DXnO2AT-.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
 import { a as parseBoolean, i as symbols, n as logger, o as renderTable, r as styles, t as CIPromptError } from "./logger-CXQq9YIp.mjs";
-import { A as defaultPlatformBaseUrl, B as getPlatformBaseUrl, C as getPluginGenerationDependencies, D as hashContent, E as getDistDir, G as rememberPlatformConfigForToken, H as initOperatorClient, J as createApplyLimiter, K as resolveStaticWebsiteUrls, L as getConsoleBaseUrl, M as fetchAllTolerant, N as fetchMachineUserToken, O as hashFile, P as fetchPaged, R as getOAuth2ClientId, T as createBundleCache, U as isDefaultPlatform, V as initOAuth2Client, W as normalizeBaseUrl, Y as LOG_LEVELS, _ as stringifyFunction, d as buildExecutorArgsExpr, f as buildResolverOperationHookExpr, g as TailorDBTypeSchema$1, h as assertUniqueTailorDBTypeNamesWithExternal, i as resolverBundleKey, j as fetchAll, l as HTTP_METHODS, m as assertUniqueLocalTailorDBTypeNames, n as generatePluginFilesIfNeeded, o as WorkflowJobFunctionExecutionPolicySchema, q as byName, r as loadApplication, t as defineApplication, v as resolveTSConfigWithFallback, w as hasGenerationHooks, y as platformBundleDefinePlugin, z as getOrNull } from "./application-Cp0FxIm2.mjs";
-import { o as loadFilesWithIgnores, s as functionSchema, t as createExecutorService } from "./service-B0MaodSg.mjs";
+import { $ as LOG_LEVELS, A as hashContent, B as getConsoleBaseUrl, D as hasGenerationHooks, E as getPluginGenerationDependencies, F as fetchAllTolerant, G as initOperatorClient, H as getOrNull, I as fetchMachineUserToken, J as normalizeBaseUrl, K as isDefaultPlatform, L as fetchPaged, N as defaultPlatformBaseUrl, O as createBundleCache, P as fetchAll, Q as createApplyLimiter, T as createBundleLog, U as getPlatformBaseUrl, V as getOAuth2ClientId, W as initOAuth2Client, X as resolveStaticWebsiteUrls, Y as rememberPlatformConfigForToken, Z as byName, _ as stringifyFunction, b as resolveTSConfigWithFallback, d as buildExecutorArgsExpr, f as buildResolverOperationHookExpr, g as TailorDBTypeSchema$1, h as assertUniqueTailorDBTypeNamesWithExternal, i as resolverBundleKey, j as hashFile, k as getDistDir, l as HTTP_METHODS, m as assertUniqueLocalTailorDBTypeNames, n as generatePluginFilesIfNeeded, o as WorkflowJobFunctionExecutionPolicySchema, q as isNotFoundError, r as loadApplication, t as defineApplication, v as createGeneratedEntryResolverPlugin, x as platformBundleDefinePlugin, y as createTsconfigPathsPlugin } from "./application-m5tYtz0-.mjs";
+import { o as loadFilesWithIgnores, s as functionSchema, t as createExecutorService } from "./service-CPJWhTLn.mjs";
 import { n as enumConstantsPlugin, t as EnumConstantsGeneratorID } from "./enum-constants-j9QBF0cB.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { n as fileUtilsPlugin, t as FileUtilsGeneratorID } from "./file-utils-DcyIPFQh.mjs";
 import { n as kyselyTypePlugin, t as KyselyGeneratorID } from "./kysely-type-D-zflMGf.mjs";
-import { n as seedPlugin, t as SeedGeneratorID } from "./seed-DFFigL8V.mjs";
+import { n as seedPlugin, t as SeedGeneratorID } from "./seed-6eTFj-3Q.mjs";
 import { t as readPackageJson } from "./package-json-8b0O9TlX.mjs";
 import { t as userAgent } from "./user-agent-DX2Jnw0-.mjs";
 import { r as isCLIError, t as createCLIError } from "./errors-DVFS0AZk.mjs";
@@ -5926,6 +5926,18 @@ function protoExecutor(context, executor) {
 				}
 			});
 			break;
+		case "workflowExecution":
+		case "workflowJobExecution":
+			triggerType = ExecutorTriggerType.EVENT;
+			triggerConfig = typedEventTrigger({
+				case: "workflow",
+				value: {
+					eventTypes: trigger.events,
+					workflowName: trigger.workflowName,
+					...trigger.condition ? { condition: { expr: `(${stringifyFunction(trigger.condition)})(${argsExpr})` } } : {}
+				}
+			});
+			break;
 		default: throw new Error(`Unknown trigger: ${trigger}`);
 	}
 	const target = executor.operation;
@@ -7200,6 +7212,10 @@ const warningChangeInfoSchema = z.looseObject({
 	fieldName: z.string().optional(),
 	reason: z.string()
 });
+const scriptSkippedInfoSchema = z.looseObject({
+	reason: z.string().trim().min(1),
+	acknowledgedAt: z.string()
+});
 const migrationDiffSchema = z.looseObject({
 	version: z.number(),
 	namespace: z.string(),
@@ -7210,7 +7226,8 @@ const migrationDiffSchema = z.looseObject({
 	breakingChanges: z.array(breakingChangeInfoSchema),
 	hasWarnings: z.boolean().optional(),
 	warnings: z.array(warningChangeInfoSchema).optional(),
-	requiresMigrationScript: z.boolean()
+	requiresMigrationScript: z.boolean(),
+	scriptSkipped: scriptSkippedInfoSchema.optional()
 });
 
 //#endregion
@@ -7852,75 +7869,81 @@ function areFieldsDifferent(oldField, newField) {
 	return false;
 }
 /**
-* Determine if a field change is a breaking change
+* Collect breaking changes for a field change
 * @param {string} typeName - Name of the type containing the field
 * @param {string} fieldName - Name of the field being changed
 * @param {SnapshotFieldConfig | undefined} oldField - Old field configuration
 * @param {SnapshotFieldConfig | undefined} newField - New field configuration
-* @returns {BreakingChangeInfo | null} Breaking change info or null if not breaking
+* @returns {BreakingChangeInfo[]} Breaking change information
 */
-function isBreakingFieldChange(typeName, fieldName, oldField, newField) {
-	if (!oldField && newField && newField.required) return {
+function getBreakingFieldChanges(typeName, fieldName, oldField, newField) {
+	const breakingChanges = [];
+	if (!oldField && newField && newField.required) breakingChanges.push({
 		typeName,
 		fieldName,
 		reason: "Required field added"
-	};
-	if (oldField && newField && oldField.type !== newField.type) return {
+	});
+	if (oldField && newField && oldField.type !== newField.type) breakingChanges.push({
 		typeName,
 		fieldName,
 		reason: `Field type changed from ${oldField.type} to ${newField.type}`,
 		unsupported: true,
 		showThreeStepHint: true
-	};
-	if (oldField && newField && !oldField.required && newField.required) return {
+	});
+	if (oldField && newField && !oldField.required && newField.required) breakingChanges.push({
 		typeName,
 		fieldName,
 		reason: "Field changed from optional to required"
-	};
+	});
 	if (oldField && newField && (oldField.array ?? false) !== (newField.array ?? false)) {
 		const [fromType, toType] = oldField.array ? ["array", "single value"] : ["single value", "array"];
-		return {
+		breakingChanges.push({
 			typeName,
 			fieldName,
 			reason: `Field changed from ${fromType} to ${toType}`,
 			unsupported: true,
 			showThreeStepHint: true
-		};
+		});
 	}
 	if (oldField && newField) {
 		const oldForeignKeyType = oldField.foreignKeyType;
 		const newForeignKeyType = newField.foreignKeyType;
-		if (oldForeignKeyType && newForeignKeyType && oldForeignKeyType !== newForeignKeyType) return {
+		if (oldForeignKeyType && newForeignKeyType && oldForeignKeyType !== newForeignKeyType) breakingChanges.push({
 			typeName,
 			fieldName,
 			reason: `Foreign key target type changed from ${oldForeignKeyType} to ${newForeignKeyType}`
-		};
+		});
 	}
-	if (oldField && newField && !(oldField.unique ?? false) && (newField.unique ?? false)) return {
+	if (oldField && newField && !(oldField.unique ?? false) && (newField.unique ?? false)) breakingChanges.push({
 		typeName,
 		fieldName,
 		reason: "Unique constraint added to field"
-	};
+	});
+	if (oldField?.type === "decimal" && newField?.type === "decimal" && oldField.scale !== newField.scale) breakingChanges.push({
+		typeName,
+		fieldName,
+		reason: `Decimal scale changed from ${oldField.scale} to ${newField.scale}`
+	});
 	if (oldField && newField && oldField.type === "enum" && newField.type === "enum") {
 		const oldAllowed = oldField.allowedValues ?? [];
 		const newAllowed = newField.allowedValues ?? [];
 		const oldValues = oldAllowed.map((v) => v.value);
 		const newValuesSet = new Set(newAllowed.map((v) => v.value));
 		const removedValues = oldValues.filter((v) => !newValuesSet.has(v));
-		if (removedValues.length > 0) return {
+		if (removedValues.length > 0) breakingChanges.push({
 			typeName,
 			fieldName,
 			reason: `Enum values removed: ${removedValues.join(", ")}`
-		};
+		});
 	}
-	return null;
+	return breakingChanges;
 }
 function addChange(ctx, change, oldField, newField) {
 	ctx.changes.push(change);
 	if (!change.fieldName) return;
-	const breaking = isBreakingFieldChange(change.typeName, change.fieldName, oldField, newField);
-	if (breaking) {
-		ctx.breakingChanges.push(breaking);
+	const breakingChanges = getBreakingFieldChanges(change.typeName, change.fieldName, oldField, newField);
+	if (breakingChanges.length > 0) {
+		ctx.breakingChanges.push(...breakingChanges);
 		return;
 	}
 	if (change.kind === "field_removed") ctx.warnings.push({
@@ -9521,6 +9544,283 @@ function handleOptionalToRequiredError(error, messages) {
 	throw error;
 }
 
+//#endregion
+//#region src/cli/commands/tailordb/migrate/schema-checks.ts
+/**
+* Schema validation checks shared between `deploy` and
+* `tailordb migration validate`.
+*
+* These checks are read-only: they compare local type definitions, the
+* migration snapshot history, and the remote schema without mutating any
+* state.
+*/
+/**
+* Convert a runtime TailorDBService to the snapshot-shaped deploy input.
+* @param service - Loaded TailorDB service (after `loadTypes()`)
+* @returns The canonical snapshot-shaped deploy input for downstream plan/apply phases.
+*/
+function toTailorDBDeployInput(service) {
+	const types = {};
+	for (const [typeName, type] of Object.entries(service.types)) types[typeName] = createSnapshotType(type);
+	return {
+		namespace: service.namespace,
+		config: service.config,
+		types
+	};
+}
+/**
+* Fetch all TailorDB types from remote for a namespace
+* @param {OperatorClient} client - Operator client instance
+* @param {string} workspaceId - Workspace ID
+* @param {string} namespace - TailorDB namespace
+* @returns {Promise<ProtoTailorDBType[]>} Remote TailorDB types
+*/
+async function fetchRemoteTypes(client, workspaceId, namespace) {
+	return fetchAllTolerant(async (pageToken, maxPageSize) => {
+		const { tailordbTypes, nextPageToken } = await client.listTailorDBTypes({
+			workspaceId,
+			namespaceName: namespace,
+			pageToken,
+			pageSize: maxPageSize
+		});
+		return [tailordbTypes, nextPageToken];
+	});
+}
+async function fetchRemoteGqlPermissions(client, workspaceId, namespace) {
+	return fetchAllTolerant(async (pageToken, maxPageSize) => {
+		const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
+			workspaceId,
+			namespaceName: namespace,
+			pageToken,
+			pageSize: maxPageSize
+		});
+		return [permissions, nextPageToken];
+	});
+}
+function definedWhenNotEmpty(value) {
+	return Object.keys(value).length > 0 ? value : void 0;
+}
+function namespaceConfig(config, tailorDBInputs, namespace) {
+	return tailorDBInputs.find((input) => input.namespace === namespace)?.config ?? config.db?.[namespace];
+}
+function namespaceGqlOperations(config, tailorDBInputs, namespace) {
+	return namespaceConfig(config, tailorDBInputs, namespace)?.gqlOperations;
+}
+const GQL_OPERATION_KEYS = [
+	"create",
+	"update",
+	"delete",
+	"read"
+];
+function configuredDisabledGqlOperations(operations) {
+	if (!operations) return void 0;
+	if (operations === "query") return {
+		create: false,
+		update: false,
+		delete: false
+	};
+	const disabled = {};
+	for (const key of GQL_OPERATION_KEYS) if (operations[key] === false) disabled[key] = false;
+	return definedWhenNotEmpty(disabled);
+}
+function appliedConfiguredDisabledGqlOperations(remoteDisabled, configuredDisabled) {
+	if (!remoteDisabled || !configuredDisabled) return void 0;
+	const disabled = {};
+	for (const key of GQL_OPERATION_KEYS) if (configuredDisabled[key] === false && remoteDisabled[key]) disabled[key] = false;
+	return definedWhenNotEmpty(disabled);
+}
+function deployComparableSnapshot(snapshot, remoteTypes, gqlOperations) {
+	const remoteTypesByName = new Map(remoteTypes.map((type) => [type.name, type]));
+	const configuredDisabled = configuredDisabledGqlOperations(gqlOperations);
+	const types = {};
+	for (const [typeName, type] of Object.entries(snapshot.types)) {
+		const settings = { ...type.settings };
+		const remoteSettings = remoteTypesByName.get(typeName)?.schema?.settings;
+		if (type.settings?.publishEvents === void 0 && remoteSettings?.publishRecordEvents) settings.publishEvents = true;
+		if (type.settings?.gqlOperations === void 0) {
+			const disabled = appliedConfiguredDisabledGqlOperations(remoteSettings?.disableGqlOperations, configuredDisabled);
+			if (disabled) settings.gqlOperations = disabled;
+		}
+		const comparableType = { ...type };
+		const comparableSettings = definedWhenNotEmpty(settings);
+		if (comparableSettings) comparableType.settings = comparableSettings;
+		else delete comparableType.settings;
+		types[typeName] = comparableType;
+	}
+	return {
+		...snapshot,
+		types
+	};
+}
+async function getRemoteMigrationNumberState(client, workspaceId, namespace) {
+	const trn = resourceTrn(workspaceId, "tailordb", namespace);
+	const metadata = await getOrNull(async () => {
+		const { metadata } = await client.getMetadata({ trn });
+		return metadata;
+	});
+	if (!metadata) return {
+		metadataExists: false,
+		number: null
+	};
+	const label = metadata.labels[MIGRATION_LABEL_KEY];
+	if (!label) return {
+		metadataExists: true,
+		number: null
+	};
+	return {
+		metadataExists: true,
+		number: parseMigrationLabelNumber(label)
+	};
+}
+/**
+* Get the current migration number from remote metadata
+* @param {OperatorClient} client - Operator client instance
+* @param {string} workspaceId - Workspace ID
+* @param {string} namespace - TailorDB namespace
+* @returns {Promise<number | null>} Current migration number, or null if no migration label exists
+*/
+async function getRemoteMigrationNumber(client, workspaceId, namespace) {
+	return (await getRemoteMigrationNumberState(client, workspaceId, namespace)).number;
+}
+/**
+* Verify remote schema matches the expected snapshot state
+* @param {OperatorClient} client - Operator client instance
+* @param {string} workspaceId - Workspace ID
+* @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migration config
+* @param {LoadedConfig} config - Loaded application config
+* @param {ReadonlyArray<TailorDBDeployInput>} tailorDBInputs - Deploy inputs for namespace defaults
+* @returns {Promise<RemoteSchemaVerificationResult[]>} Verification results per namespace
+*/
+async function verifyRemoteSchema(client, workspaceId, namespacesWithMigrations, config, tailorDBInputs) {
+	const results = [];
+	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
+		const { metadataExists, number: remoteMigrationNumber } = await getRemoteMigrationNumberState(client, workspaceId, namespace);
+		if (remoteMigrationNumber === null) {
+			results.push({
+				namespace,
+				remoteMigrationNumber: 0,
+				drifts: [],
+				hasDrift: false,
+				skipped: metadataExists ? "no_migration_label" : "not_deployed"
+			});
+			continue;
+		}
+		if (remoteMigrationNumber > getLatestMigrationNumber(migrationsDir)) {
+			results.push({
+				namespace,
+				remoteMigrationNumber,
+				drifts: [],
+				hasDrift: false,
+				checkpointMissingLocal: true
+			});
+			continue;
+		}
+		const expectedSnapshot = reconstructSnapshotFromMigrations(migrationsDir, remoteMigrationNumber);
+		if (!expectedSnapshot) {
+			results.push({
+				namespace,
+				remoteMigrationNumber,
+				drifts: [],
+				hasDrift: false,
+				skipped: "no_snapshot"
+			});
+			continue;
+		}
+		const [remoteTypes, remoteGqlPermissions] = await Promise.all([fetchRemoteTypes(client, workspaceId, namespace), fetchRemoteGqlPermissions(client, workspaceId, namespace)]);
+		const drifts = compareRemoteWithSnapshot(remoteTypes, deployComparableSnapshot(expectedSnapshot, remoteTypes, namespaceGqlOperations(config, tailorDBInputs, namespace)), remoteGqlPermissions);
+		results.push({
+			namespace,
+			remoteMigrationNumber,
+			drifts,
+			hasDrift: drifts.length > 0
+		});
+	}
+	return results;
+}
+/**
+* Log common causes of remote schema drift and how to resolve them
+*/
+function logRemoteDriftGuidance() {
+	logger.info("This may indicate:");
+	logger.info("  - Another developer applied different migrations", { mode: "plain" });
+	logger.info("  - Manual schema changes were made directly", { mode: "plain" });
+	logger.info("  - Migration history is out of sync", { mode: "plain" });
+	logger.newline();
+	logger.info("To resolve:");
+	logger.info("  - Run 'tailor-sdk tailordb migration status' to compare local vs remote.", { mode: "plain" });
+	logger.info("  - If remote is correct, update local types and run 'migration generate'.", { mode: "plain" });
+	logger.info("  - If local migration history is correct, run 'migration sync <N>' to overwrite remote.", { mode: "plain" });
+	logger.info("  - If only bookkeeping is stale, run 'migration set <N>'.", { mode: "plain" });
+}
+/**
+* Format remote schema verification results for display
+* @param {RemoteSchemaVerificationResult[]} results - Verification results
+* @returns {string} Formatted results string
+*/
+function formatRemoteVerificationResults(results) {
+	const lines = [];
+	for (const result of results) {
+		if (!result.hasDrift) continue;
+		lines.push(`Namespace: ${result.namespace}`);
+		lines.push(`  Remote migration: ${formatMigrationNumber(result.remoteMigrationNumber)}`);
+		lines.push(`  Differences:`);
+		lines.push(formatSchemaDrifts(result.drifts));
+		lines.push("");
+	}
+	return lines.join("\n");
+}
+/**
+* Check if there are schema differences between migration snapshots and local definitions
+* @param {ReadonlyMap<string, Record<string, TailorDBSnapshotType>>} typesByNamespace - Snapshot-shaped local types by namespace
+* @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migrations config
+* @returns {Promise<MigrationCheckResult[]>} Results for each namespace
+*/
+async function checkMigrationDiffs(typesByNamespace, namespacesWithMigrations) {
+	const results = [];
+	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
+		const localTypes = typesByNamespace.get(namespace);
+		if (!localTypes) continue;
+		const previousSnapshot = reconstructSnapshotFromMigrations(migrationsDir);
+		if (!previousSnapshot) {
+			results.push({
+				namespace,
+				migrationsDir,
+				hasDiff: true,
+				diff: void 0
+			});
+			continue;
+		}
+		const diff = compareLocalTypesWithSnapshot(previousSnapshot, localTypes, namespace);
+		results.push({
+			namespace,
+			migrationsDir,
+			hasDiff: hasChanges(diff),
+			diff: hasChanges(diff) ? diff : void 0
+		});
+	}
+	return results;
+}
+/**
+* Format migration check results for display
+* @param {MigrationCheckResult[]} results - Migration check results
+* @returns {string} Formatted results string
+*/
+function formatMigrationCheckResults(results) {
+	const lines = [];
+	for (const result of results) {
+		if (!result.hasDiff) continue;
+		lines.push(`Namespace: ${result.namespace}`);
+		if (!result.diff) lines.push("  No migration snapshot found. Run 'tailor-sdk tailordb migration generate' first.");
+		else {
+			lines.push(`  ${formatDiffSummary(result.diff)}`);
+			lines.push("");
+			lines.push(formatMigrationDiff(result.diff));
+		}
+		lines.push("");
+	}
+	return lines.join("\n");
+}
+
 //#endregion
 //#region src/cli/commands/tailordb/migrate/bundler.ts
 /**
@@ -9569,31 +9869,39 @@ async function bundleMigrationScript(sourceFile, namespace, migrationNumber, env
     }
   `;
 	fs$1.writeFileSync(entryPath, entryContent);
-	const tsconfig = await resolveTSConfigWithFallback(baseDir ?? path.dirname(absoluteSourcePath));
+	const projectDir = baseDir ?? path.dirname(absoluteSourcePath);
+	const tsconfig = await resolveTSConfigWithFallback(projectDir);
+	const bundleLog = createBundleLog({ tsconfig });
+	const result = await rolldown.build({
+		plugins: [
+			createGeneratedEntryResolverPlugin(entryPath, projectDir),
+			createTsconfigPathsPlugin(),
+			platformBundleDefinePlugin
+		],
+		input: entryPath,
+		write: false,
+		output: {
+			format: "esm",
+			sourcemap: false,
+			minify: false,
+			codeSplitting: false,
+			globals: { tailordb: "tailordb" }
+		},
+		external: ["tailordb"],
+		resolve: { conditionNames: ["node", "import"] },
+		tsconfig,
+		treeshake: {
+			moduleSideEffects: false,
+			annotations: true,
+			unknownGlobalSideEffects: false
+		},
+		...bundleLog.options
+	});
+	bundleLog.assertAllResolved();
 	return {
 		namespace,
 		migrationNumber,
-		bundledCode: (await rolldown.build({
-			plugins: [platformBundleDefinePlugin],
-			input: entryPath,
-			write: false,
-			output: {
-				format: "esm",
-				sourcemap: false,
-				minify: false,
-				codeSplitting: false,
-				globals: { tailordb: "tailordb" }
-			},
-			external: ["tailordb"],
-			resolve: { conditionNames: ["node", "import"] },
-			tsconfig,
-			treeshake: {
-				moduleSideEffects: false,
-				annotations: true,
-				unknownGlobalSideEffects: false
-			},
-			logLevel: "silent"
-		})).output[0].code
+		bundledCode: result.output[0].code
 	};
 }
 
@@ -9855,8 +10163,9 @@ async function getCurrentMigrationNumber(client, workspaceId, namespace) {
 		const label = metadata?.labels[MIGRATION_LABEL_KEY];
 		if (!label) return 0;
 		return parseMigrationLabelNumber(label) ?? 0;
-	} catch {
-		return 0;
+	} catch (error) {
+		if (isNotFoundError(error)) return 0;
+		throw error;
 	}
 }
 /**
@@ -9864,9 +10173,10 @@ async function getCurrentMigrationNumber(client, workspaceId, namespace) {
 * @param {OperatorClient} client - Operator client instance
 * @param {string} workspaceId - Workspace ID
 * @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migrations config
+* @param {string} [configPath] - Config file path, included in remediation guidance when provided
 * @returns {Promise<PendingMigration[]>} List of pending migrations
 */
-async function detectPendingMigrations(client, workspaceId, namespacesWithMigrations) {
+async function detectPendingMigrations(client, workspaceId, namespacesWithMigrations, configPath) {
 	const pendingMigrations = [];
 	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
 		const currentMigration = await getCurrentMigrationNumber(client, workspaceId, namespace);
@@ -9878,9 +10188,15 @@ async function detectPendingMigrations(client, workspaceId, namespacesWithMigrat
 			const diff = loadDiff(diffPath);
 			const scriptPath = getMigrationFilePath(migrationsDir, file.number, "migrate");
 			const hasScript = fs$1.existsSync(scriptPath);
-			if (diff.requiresMigrationScript && !hasScript) {
-				logger.warn(`Migration ${namespace}/${file.number} requires a script but migrate.ts not found`);
-				continue;
+			if (diff.requiresMigrationScript && !hasScript && !diff.scriptSkipped) {
+				const configArg = configPath ? ` --config "${path.relative(process.cwd(), configPath) || configPath}"` : "";
+				const scriptCmd = `tailor-sdk tailordb migration script ${file.number} --namespace ${namespace}${configArg}`;
+				throw new Error(`Migration ${namespace}/${formatMigrationNumber(file.number)} requires a migration script but migrate.ts was not found.\nTo resolve, either:\n  - Add a script: ${scriptCmd}\n  - Or record that no script is needed: ${scriptCmd} --no-script --reason "<why no data migration is needed>"`);
+			}
+			if (diff.scriptSkipped) {
+				const migrationLabel = `${namespace}/${formatMigrationNumber(file.number)}`;
+				if (hasScript) logger.warn(`Migration ${migrationLabel} has both a skip acknowledgment and migrate.ts; executing migrate.ts.`);
+				else logger.info(`Migration ${migrationLabel} runs without a script (skip acknowledged at ${diff.scriptSkipped.acknowledgedAt}: ${diff.scriptSkipped.reason})`);
 			}
 			pendingMigrations.push({
 				number: file.number,
@@ -9984,198 +10300,67 @@ async function executeMigrations(context, migrations) {
 	}
 }
 /**
-* Get the machine user name for migration execution
-*
-* Priority:
-* 1. machineUser from migration config (if set)
-* 2. First machine user from auth config
-* @param {object | undefined} migrationConfig - Migration config for namespace
-* @param {string[] | undefined} machineUsers - Machine users from auth config
-* @returns {string | undefined} Machine user name or undefined if none available
-*/
-function getMigrationMachineUser(migrationConfig, machineUsers) {
-	if (migrationConfig?.machineUser) return migrationConfig.machineUser;
-	if (machineUsers && machineUsers.length > 0) return machineUsers[0];
-}
-/**
-* Group migrations by namespace
-* @param {PendingMigration[]} migrations - Migrations to group
-* @returns {Map<string, PendingMigration[]>} Migrations grouped by namespace
-*/
-function groupMigrationsByNamespace(migrations) {
-	const grouped = /* @__PURE__ */ new Map();
-	for (const migration of migrations) {
-		const existing = grouped.get(migration.namespace) ?? [];
-		existing.push(migration);
-		grouped.set(migration.namespace, existing);
-	}
-	return grouped;
-}
-
-//#endregion
-//#region src/cli/commands/deploy/tailordb/index.ts
-/**
-* Fetch all TailorDB types from remote for a namespace
-* @param {OperatorClient} client - Operator client instance
-* @param {string} workspaceId - Workspace ID
-* @param {string} namespace - TailorDB namespace
-* @returns {Promise<ProtoTailorDBType[]>} Remote TailorDB types
-*/
-async function fetchRemoteTypes(client, workspaceId, namespace) {
-	return fetchAllTolerant(async (pageToken, maxPageSize) => {
-		const { tailordbTypes, nextPageToken } = await client.listTailorDBTypes({
-			workspaceId,
-			namespaceName: namespace,
-			pageToken,
-			pageSize: maxPageSize
-		});
-		return [tailordbTypes, nextPageToken];
-	});
-}
-async function fetchRemoteGqlPermissions(client, workspaceId, namespace) {
-	return fetchAllTolerant(async (pageToken, maxPageSize) => {
-		const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
-			workspaceId,
-			namespaceName: namespace,
-			pageToken,
-			pageSize: maxPageSize
-		});
-		return [permissions, nextPageToken];
-	});
-}
-function definedWhenNotEmpty(value) {
-	return Object.keys(value).length > 0 ? value : void 0;
-}
-function namespaceConfig(config, tailorDBInputs, namespace) {
-	return tailorDBInputs.find((input) => input.namespace === namespace)?.config ?? config.db?.[namespace];
-}
-function namespaceGqlOperations(config, tailorDBInputs, namespace) {
-	return namespaceConfig(config, tailorDBInputs, namespace)?.gqlOperations;
-}
-const GQL_OPERATION_KEYS = [
-	"create",
-	"update",
-	"delete",
-	"read"
-];
-function configuredDisabledGqlOperations(operations) {
-	if (!operations) return void 0;
-	if (operations === "query") return {
-		create: false,
-		update: false,
-		delete: false
-	};
-	const disabled = {};
-	for (const key of GQL_OPERATION_KEYS) if (operations[key] === false) disabled[key] = false;
-	return definedWhenNotEmpty(disabled);
-}
-function appliedConfiguredDisabledGqlOperations(remoteDisabled, configuredDisabled) {
-	if (!remoteDisabled || !configuredDisabled) return void 0;
-	const disabled = {};
-	for (const key of GQL_OPERATION_KEYS) if (configuredDisabled[key] === false && remoteDisabled[key]) disabled[key] = false;
-	return definedWhenNotEmpty(disabled);
-}
-function deployComparableSnapshot(snapshot, remoteTypes, gqlOperations) {
-	const remoteTypesByName = new Map(remoteTypes.map((type) => [type.name, type]));
-	const configuredDisabled = configuredDisabledGqlOperations(gqlOperations);
-	const types = {};
-	for (const [typeName, type] of Object.entries(snapshot.types)) {
-		const settings = { ...type.settings };
-		const remoteSettings = remoteTypesByName.get(typeName)?.schema?.settings;
-		if (type.settings?.publishEvents === void 0 && remoteSettings?.publishRecordEvents) settings.publishEvents = true;
-		if (type.settings?.gqlOperations === void 0) {
-			const disabled = appliedConfiguredDisabledGqlOperations(remoteSettings?.disableGqlOperations, configuredDisabled);
-			if (disabled) settings.gqlOperations = disabled;
-		}
-		const comparableType = { ...type };
-		const comparableSettings = definedWhenNotEmpty(settings);
-		if (comparableSettings) comparableType.settings = comparableSettings;
-		else delete comparableType.settings;
-		types[typeName] = comparableType;
-	}
-	return {
-		...snapshot,
-		types
-	};
-}
-/**
-* Get the current migration number from remote metadata
-* @param {OperatorClient} client - Operator client instance
-* @param {string} workspaceId - Workspace ID
-* @param {string} namespace - TailorDB namespace
-* @returns {Promise<number | null>} Current migration number, or null if no migration label exists
+* Get the machine user name for migration execution
+*
+* Priority:
+* 1. machineUser from migration config (if set)
+* 2. First machine user from auth config
+* @param {object | undefined} migrationConfig - Migration config for namespace
+* @param {string[] | undefined} machineUsers - Machine users from auth config
+* @returns {string | undefined} Machine user name or undefined if none available
 */
-async function getRemoteMigrationNumber(client, workspaceId, namespace) {
-	try {
-		const trn = resourceTrn(workspaceId, "tailordb", namespace);
-		const { metadata } = await client.getMetadata({ trn });
-		const label = metadata?.labels["sdk-migration"];
-		if (!label) return null;
-		const match = label.match(/^m(\d+)$/);
-		return match ? parseInt(assertDefined(match[1], "migration label capture group missing"), 10) : null;
-	} catch {
-		return null;
-	}
+function getMigrationMachineUser(migrationConfig, machineUsers) {
+	if (migrationConfig?.machineUser) return migrationConfig.machineUser;
+	if (machineUsers && machineUsers.length > 0) return machineUsers[0];
 }
 /**
-* Verify remote schema matches the expected snapshot state
-* @param {OperatorClient} client - Operator client instance
-* @param {string} workspaceId - Workspace ID
-* @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migration config
-* @param {LoadedConfig} config - Loaded application config
-* @param {ReadonlyArray<TailorDBDeployInput>} tailorDBInputs - Deploy inputs for namespace defaults
-* @returns {Promise<RemoteSchemaVerificationResult[]>} Verification results per namespace
+* Group migrations by namespace
+* @param {PendingMigration[]} migrations - Migrations to group
+* @returns {Map<string, PendingMigration[]>} Migrations grouped by namespace
 */
-async function verifyRemoteSchema(client, workspaceId, namespacesWithMigrations, config, tailorDBInputs) {
-	const results = [];
-	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
-		const remoteMigrationNumber = await getRemoteMigrationNumber(client, workspaceId, namespace);
-		if (remoteMigrationNumber === null) {
-			results.push({
-				namespace,
-				remoteMigrationNumber: 0,
-				drifts: [],
-				hasDrift: false
-			});
-			continue;
-		}
-		const expectedSnapshot = reconstructSnapshotFromMigrations(migrationsDir, remoteMigrationNumber);
-		if (!expectedSnapshot) {
-			results.push({
-				namespace,
-				remoteMigrationNumber,
-				drifts: [],
-				hasDrift: false
-			});
-			continue;
-		}
-		const [remoteTypes, remoteGqlPermissions] = await Promise.all([fetchRemoteTypes(client, workspaceId, namespace), fetchRemoteGqlPermissions(client, workspaceId, namespace)]);
-		const drifts = compareRemoteWithSnapshot(remoteTypes, deployComparableSnapshot(expectedSnapshot, remoteTypes, namespaceGqlOperations(config, tailorDBInputs, namespace)), remoteGqlPermissions);
-		results.push({
-			namespace,
-			remoteMigrationNumber,
-			drifts,
-			hasDrift: drifts.length > 0
-		});
+function groupMigrationsByNamespace(migrations) {
+	const grouped = /* @__PURE__ */ new Map();
+	for (const migration of migrations) {
+		const existing = grouped.get(migration.namespace) ?? [];
+		existing.push(migration);
+		grouped.set(migration.namespace, existing);
 	}
-	return results;
+	return grouped;
 }
+
+//#endregion
+//#region src/cli/commands/deploy/tailordb/index.ts
+const MIGRATION_FILE_KINDS = [
+	"schema",
+	"diff",
+	"migrate",
+	"db"
+];
 /**
-* Format remote schema verification results for display
-* @param {RemoteSchemaVerificationResult[]} results - Verification results
-* @returns {string} Formatted results string
-*/
-function formatRemoteVerificationResults(results) {
-	const lines = [];
-	for (const result of results) {
-		if (!result.hasDrift) continue;
-		lines.push(`Namespace: ${result.namespace}`);
-		lines.push(`  Remote migration: ${formatMigrationNumber(result.remoteMigrationNumber)}`);
-		lines.push(`  Differences:`);
-		lines.push(formatSchemaDrifts(result.drifts));
-		lines.push("");
+* Capture the migration files that a deployment plan depends on.
+* @param namespacesWithMigrations - Configured migration directories by namespace
+* @returns SHA-256 digest by namespace
+*/
+function captureMigrationFileState(namespacesWithMigrations) {
+	const state = {};
+	for (const { namespace, migrationsDir } of namespacesWithMigrations.toSorted((a, b) => a.namespace.localeCompare(b.namespace))) {
+		const hash = createHash("sha256");
+		const migrationNumbers = [...new Set(getMigrationFiles(migrationsDir).map(({ number }) => number))].toSorted((a, b) => a - b);
+		for (const migrationNumber of migrationNumbers) for (const kind of MIGRATION_FILE_KINDS) {
+			const filePath = getMigrationFilePath(migrationsDir, migrationNumber, kind);
+			hash.update(`${formatMigrationNumber(migrationNumber)}/${kind}\0`);
+			if (fs$1.existsSync(filePath)) hash.update(fs$1.readFileSync(filePath));
+			else hash.update("<missing>");
+			hash.update("\0");
+		}
+		state[namespace] = hash.digest("hex");
 	}
-	return lines.join("\n");
+	return state;
+}
+function migrationFileStatesEqual(planned, current) {
+	const plannedNamespaces = Object.keys(planned).toSorted();
+	const currentNamespaces = Object.keys(current).toSorted();
+	return plannedNamespaces.length === currentNamespaces.length && plannedNamespaces.every((namespace, index) => namespace === currentNamespaces[index] && planned[namespace] === current[namespace]);
 }
 /**
 * Validate migration files and detect pending migrations
@@ -10203,38 +10388,38 @@ async function validateAndDetectMigrations(client, workspaceId, typesByNamespace
 				throw new Error("Schema migration check failed");
 			}
 			const remoteVerificationResults = await verifyRemoteSchema(client, workspaceId, namespacesWithMigrations, config, tailorDBInputs);
+			const missingCheckpointResults = remoteVerificationResults.filter((result) => result.checkpointMissingLocal);
+			if (missingCheckpointResults.length > 0) {
+				logger.error("Remote migration checkpoint is not in the local migration history:");
+				for (const result of missingCheckpointResults) logger.log(`  ${result.namespace}: ${formatMigrationNumber(result.remoteMigrationNumber)}`);
+				logger.newline();
+				logger.info("Pull the latest migration files, or run 'tailor-sdk tailordb migration status' to compare.");
+				throw new Error("Remote migration checkpoint verification failed");
+			}
 			if (remoteVerificationResults.some((r) => r.hasDrift)) {
 				logger.error("Remote schema drift detected:");
 				logger.log(formatRemoteVerificationResults(remoteVerificationResults));
 				logger.newline();
-				logger.info("This may indicate:");
-				logger.info("  - Another developer applied different migrations", { mode: "plain" });
-				logger.info("  - Manual schema changes were made directly", { mode: "plain" });
-				logger.info("  - Migration history is out of sync", { mode: "plain" });
-				logger.newline();
-				logger.info("To resolve:");
-				logger.info("  - Run 'tailor-sdk tailordb migration status' to compare local vs remote.", { mode: "plain" });
-				logger.info("  - If remote is correct, update local types and run 'migration generate'.", { mode: "plain" });
-				logger.info("  - If local migration history is correct, run 'migration sync <N>' to overwrite remote.", { mode: "plain" });
-				logger.info("  - If only bookkeeping is stale, run 'migration set <N>'.", { mode: "plain" });
+				logRemoteDriftGuidance();
 				logger.newline();
 				logger.info("Use '--no-schema-check' to skip this check (not recommended).");
 				throw new Error("Remote schema verification failed");
 			}
 		}
-		pendingMigrations = await detectPendingMigrations(client, workspaceId, namespacesWithMigrations);
+		pendingMigrations = await detectPendingMigrations(client, workspaceId, namespacesWithMigrations, config.path);
 		if (pendingMigrations.length > 0) {
 			logger.newline();
 			const withScripts = pendingMigrations.filter((m) => m.hasScript);
 			const withoutScripts = pendingMigrations.filter((m) => !m.hasScript);
-			logger.info(`Applying ${pendingMigrations.length} migration(s):`);
+			logger.info(`${pendingMigrations.length} pending migration(s) will be applied:`);
 			if (withoutScripts.length > 0) logger.info(`  • ${withoutScripts.length} schema change(s) (applied automatically with schema deployment)`, { mode: "plain" });
 			if (withScripts.length > 0) logger.info(`  • ${withScripts.length} data migration(s) (requires migration script execution)`, { mode: "plain" });
 		}
 	}
 	return {
 		pendingMigrations,
-		namespacesWithMigrations
+		namespacesWithMigrations,
+		migrationFileState: captureMigrationFileState(namespacesWithMigrations)
 	};
 }
 /**
@@ -10253,7 +10438,7 @@ async function reconcileMigrationLabels(client, workspaceId, namespacesWithMigra
 	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
 		if (getMigrationFiles(migrationsDir).length === 0) continue;
 		const targetVersion = getLatestMigrationNumber(migrationsDir);
-		const currentVersion = await getRemoteMigrationNumber(client, workspaceId, namespace);
+		const currentVersion = await getRemoteMigrationNumber(client, workspaceId, namespace).catch(() => null);
 		if (currentVersion === targetVersion) continue;
 		await updateMigrationLabel(client, workspaceId, namespace, targetVersion);
 		const from = currentVersion === null ? "<unset>" : formatMigrationNumber(currentVersion);
@@ -10282,6 +10467,22 @@ function buildMigrationContextForScripts(client, migrationContext, migrationsReq
 		configDir: path.dirname(migrationContext.config.path)
 	};
 }
+async function validateTailorDBMigrationState(client, result) {
+	const { context } = result;
+	const typesByNamespace = /* @__PURE__ */ new Map();
+	for (const tailordb of context.tailorDBInputs) typesByNamespace.set(tailordb.namespace, tailordb.types);
+	const validation = await validateAndDetectMigrations(client, context.workspaceId, typesByNamespace, context.config, context.noSchemaCheck, context.tailorDBInputs);
+	if (!migrationFileStatesEqual(context.migrationFileState, validation.migrationFileState)) throw new Error("Migration files changed after deployment planning. Run the deployment again to create a fresh plan.");
+	return validation;
+}
+/**
+* Revalidate migration state before the deployment enters any mutation phase.
+* @param client - Operator client instance
+* @param result - Planned TailorDB changes
+*/
+async function preflightTailorDB(client, result) {
+	await validateTailorDBMigrationState(client, result);
+}
 /**
 * Apply TailorDB-related changes for the given phase.
 * @param client - Operator client instance
@@ -10291,9 +10492,7 @@ function buildMigrationContextForScripts(client, migrationContext, migrationsReq
 async function applyTailorDB(client, result, phase = "create-update") {
 	const { changeSet, context: migrationContext } = result;
 	if (phase === "create-update") {
-		const typesByNamespace = /* @__PURE__ */ new Map();
-		for (const tailordb of migrationContext.tailorDBInputs) typesByNamespace.set(tailordb.namespace, tailordb.types);
-		const { pendingMigrations, namespacesWithMigrations } = await validateAndDetectMigrations(client, migrationContext.workspaceId, typesByNamespace, migrationContext.config, migrationContext.noSchemaCheck, migrationContext.tailorDBInputs);
+		const { pendingMigrations, namespacesWithMigrations } = await validateTailorDBMigrationState(client, result);
 		if (pendingMigrations.length > 0) {
 			processedTypes.reset();
 			deletedResources.reset();
@@ -10678,19 +10877,10 @@ async function rollbackSingleMigrationPrePhase(client, changeSet, migration, wor
 	}
 }
 /**
-* Convert a runtime TailorDBService to the snapshot-shaped deploy input.
-* @param service - Loaded TailorDB service (after `loadTypes()`)
-* @returns The canonical snapshot-shaped deploy input for downstream plan/apply phases.
+* Plan TailorDB-related changes based on current and desired state.
+* @param context - Planning context
+* @returns Planned changes
 */
-function toTailorDBDeployInput(service) {
-	const types = {};
-	for (const [typeName, type] of Object.entries(service.types)) types[typeName] = createSnapshotType(type);
-	return {
-		namespace: service.namespace,
-		config: service.config,
-		types
-	};
-}
 async function planTailorDB(context) {
 	const { client, workspaceId, application, forRemoval, config, noSchemaCheck, forceApplyAll = false } = context;
 	const tailordbs = [];
@@ -10701,6 +10891,12 @@ async function planTailorDB(context) {
 	const executors = forRemoval ? [] : Object.values(await application.executorService?.loadExecutors() ?? {});
 	const executorUsedTypes = new Set(context.executorUsedTailorDBTypes ?? []);
 	for (const executor of executors) if (executor.trigger.kind === "tailordb") executorUsedTypes.add(executor.trigger.typeName);
+	const typesByNamespace = /* @__PURE__ */ new Map();
+	for (const tailordb of tailordbs) typesByNamespace.set(tailordb.namespace, tailordb.types);
+	const { namespacesWithMigrations, migrationFileState } = forRemoval ? {
+		namespacesWithMigrations: [],
+		migrationFileState: {}
+	} : await validateAndDetectMigrations(client, workspaceId, typesByNamespace, config, noSchemaCheck ?? false, tailordbs);
 	const { changeSet: serviceChangeSet, conflicts, unmanaged, resourceOwners } = await planServices(client, workspaceId, application.name, application.id, tailordbs);
 	const deletedServices = serviceChangeSet.deletes.map((del) => del.name);
 	const [typeChangeSet, gqlPermissionChangeSet] = await Promise.all([planTypes(client, workspaceId, tailordbs, executorUsedTypes, deletedServices, void 0, forceApplyAll), planGqlPermissions(client, workspaceId, tailordbs, deletedServices, forceApplyAll)]);
@@ -10722,7 +10918,9 @@ async function planTailorDB(context) {
 			tailorDBInputs: tailordbs,
 			executorUsedTypes,
 			config,
-			noSchemaCheck: noSchemaCheck ?? false
+			noSchemaCheck: noSchemaCheck ?? false,
+			namespacesWithMigrations,
+			migrationFileState
 		}
 	};
 }
@@ -11070,57 +11268,6 @@ function normalizeComparableGqlPermission(permission) {
 		actions: (policy.actions ?? []).toSorted((left, right) => left - right)
 	})) };
 }
-/**
-* Check if there are schema differences between migration snapshots and local definitions
-* @param {ReadonlyMap<string, Record<string, TailorDBSnapshotType>>} typesByNamespace - Snapshot-shaped local types by namespace
-* @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migrations config
-* @returns {Promise<MigrationCheckResult[]>} Results for each namespace
-*/
-async function checkMigrationDiffs(typesByNamespace, namespacesWithMigrations) {
-	const results = [];
-	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
-		const localTypes = typesByNamespace.get(namespace);
-		if (!localTypes) continue;
-		const previousSnapshot = reconstructSnapshotFromMigrations(migrationsDir);
-		if (!previousSnapshot) {
-			results.push({
-				namespace,
-				migrationsDir,
-				hasDiff: true,
-				diff: void 0
-			});
-			continue;
-		}
-		const diff = compareLocalTypesWithSnapshot(previousSnapshot, localTypes, namespace);
-		results.push({
-			namespace,
-			migrationsDir,
-			hasDiff: hasChanges(diff),
-			diff: hasChanges(diff) ? diff : void 0
-		});
-	}
-	return results;
-}
-/**
-* Format migration check results for display
-* @param {MigrationCheckResult[]} results - Migration check results
-* @returns {string} Formatted results string
-*/
-function formatMigrationCheckResults(results) {
-	const lines = [];
-	for (const result of results) {
-		if (!result.hasDiff) continue;
-		lines.push(`Namespace: ${result.namespace}`);
-		if (!result.diff) lines.push("  No migration snapshot found. Run 'tailor-sdk tailordb migration generate' first.");
-		else {
-			lines.push(`  ${formatDiffSummary(result.diff)}`);
-			lines.push("");
-			lines.push(formatMigrationDiff(result.diff));
-		}
-		lines.push("");
-	}
-	return lines.join("\n");
-}
 
 //#endregion
 //#region src/cli/commands/deploy/workflow.ts
@@ -11134,7 +11281,7 @@ function formatMigrationCheckResults(results) {
 async function applyWorkflow(client, result, phase = "create-update") {
 	const { changeSet, appName, appId } = result;
 	if (phase === "create-update") {
-		const jobFunctionVersions = await registerJobFunctions(client, changeSet, appName, appId, result.unchangedWorkflowJobNames);
+		const jobFunctionVersions = await registerJobFunctions(client, changeSet, appName, appId, result.unchangedWorkflowJobNames, result.jobFunctionPublishEvents);
 		await Promise.all([...changeSet.creates.map(async (create) => {
 			const filteredVersions = filterJobFunctionVersions(jobFunctionVersions, create.usedJobNames);
 			const shape = buildWorkflowValidationShape(create.workspaceId, create.workflow);
@@ -11144,7 +11291,8 @@ async function applyWorkflow(client, result, phase = "create-update") {
 				mainJobFunctionName: shape.mainJobFunctionName,
 				retryPolicy: shape.retryPolicy,
 				concurrencyPolicy: shape.concurrencyPolicy,
-				jobFunctions: filteredVersions
+				jobFunctions: filteredVersions,
+				publishExecutionEvents: shape.publishExecutionEvents
 			});
 			await client.setMetadata(create.metaRequest);
 		}), ...changeSet.updates.map(async (update) => {
@@ -11156,7 +11304,8 @@ async function applyWorkflow(client, result, phase = "create-update") {
 				mainJobFunctionName: shape.mainJobFunctionName,
 				retryPolicy: shape.retryPolicy,
 				concurrencyPolicy: shape.concurrencyPolicy,
-				jobFunctions: filteredVersions
+				jobFunctions: filteredVersions,
+				publishExecutionEvents: shape.publishExecutionEvents
 			});
 			await client.setMetadata(update.metaRequest);
 		})]);
@@ -11217,9 +11366,10 @@ function filterJobFunctionVersions(allVersions, usedJobNames) {
 * @param appName - Application name
 * @param appId - Application ID used for job function metadata when available
 * @param unchangedWorkflowJobNames - Job function names used by unchanged workflows
+* @param jobFunctionPublishEvents - Resolved `publishExecutionEvents` keyed by job function name
 * @returns Map of job function names to versions
 */
-async function registerJobFunctions(client, changeSet, appName, appId, unchangedWorkflowJobNames = /* @__PURE__ */ new Set()) {
+async function registerJobFunctions(client, changeSet, appName, appId, unchangedWorkflowJobNames = /* @__PURE__ */ new Set(), jobFunctionPublishEvents = /* @__PURE__ */ new Map()) {
 	const jobFunctionVersions = {};
 	const firstWorkflow = changeSet.creates[0] || changeSet.updates[0] || changeSet.deletes[0];
 	if (!firstWorkflow) return jobFunctionVersions;
@@ -11238,15 +11388,14 @@ async function registerJobFunctions(client, changeSet, appName, appId, unchanged
 	const existingJobNamesSet = new Set(existingJobFunctions);
 	if (changeSet.creates.length > 0 || changeSet.updates.length > 0) {
 		const results = await Promise.all(Array.from(allUsedJobNames).map(async (jobName) => {
-			const response = existingJobNamesSet.has(jobName) ? await client.updateWorkflowJobFunction({
-				workspaceId,
-				jobFunctionName: jobName,
-				scriptRef: workflowJobFunctionName(jobName)
-			}) : await client.createWorkflowJobFunction({
+			const isExisting = existingJobNamesSet.has(jobName);
+			const request = {
 				workspaceId,
 				jobFunctionName: jobName,
-				scriptRef: workflowJobFunctionName(jobName)
-			});
+				scriptRef: workflowJobFunctionName(jobName),
+				publishExecutionEvents: jobFunctionPublishEvents.get(jobName) ?? false
+			};
+			const response = isExisting ? await client.updateWorkflowJobFunction(request) : await client.createWorkflowJobFunction(request);
 			await client.setMetadata(await buildMetaRequest({
 				trn: resourceTrn(workspaceId, "workflow_job_function", jobName),
 				appName,
@@ -11293,9 +11442,64 @@ function buildWorkflowValidationShape(workspaceId, workflow) {
 		workflowName: workflow.name,
 		mainJobFunctionName: workflow.mainJob.name,
 		...workflow.retryPolicy && { retryPolicy: toRetryPolicy(workflow.retryPolicy) },
-		...workflow.concurrencyPolicy && { concurrencyPolicy: toConcurrencyPolicy(workflow.concurrencyPolicy) }
+		...workflow.concurrencyPolicy && { concurrencyPolicy: toConcurrencyPolicy(workflow.concurrencyPolicy) },
+		publishExecutionEvents: workflow.publishEvents ?? false
 	};
 }
+const NO_EVENT_SUBSCRIBERS = { workflowNames: /* @__PURE__ */ new Set() };
+function isSubscribed(subscribers, workflowName) {
+	return subscribers.workflowNames.has(workflowName);
+}
+function resolvePublishEvents(params) {
+	const { explicit, subscribed, remote, conflictError } = params;
+	if (explicit === false && subscribed) throw new Error(conflictError);
+	if (explicit !== void 0) return explicit;
+	return subscribed || (remote ?? false);
+}
+/**
+* Resolve `publishExecutionEvents` for every job function used by a workflow.
+*
+* A job execution trigger names a workflow rather than a job, so a subscription
+* opts in every job that workflow runs.
+* @param params - Workflows, their job dependencies, subscribers, explicit job flags, and existing job functions
+* @returns Resolved flags keyed by job function name
+*/
+function resolveJobPublishEvents(params) {
+	const { workflows, mainJobDeps, subscribers, explicit, existing } = params;
+	const usedJobNames = /* @__PURE__ */ new Set();
+	const subscribedJobNames = /* @__PURE__ */ new Set();
+	for (const workflow of Object.values(workflows)) {
+		const jobNames = mainJobDeps[workflow.mainJob.name];
+		if (!jobNames) continue;
+		const subscribed = isSubscribed(subscribers, workflow.name);
+		for (const jobName of jobNames) {
+			usedJobNames.add(jobName);
+			if (subscribed) subscribedJobNames.add(jobName);
+		}
+	}
+	const resolved = /* @__PURE__ */ new Map();
+	for (const jobName of usedJobNames) resolved.set(jobName, resolvePublishEvents({
+		explicit: explicit.get(jobName),
+		subscribed: subscribedJobNames.has(jobName),
+		remote: existing.get(jobName)?.publishExecutionEvents,
+		conflictError: `Job "${jobName}" has "publishEvents: false", but executors with a workflowJobExecution trigger subscribe to a workflow that runs it. Either remove "publishEvents: false" or remove the matching executor triggers.`
+	}));
+	return resolved;
+}
+/**
+* Collect job functions whose remote publishing flag no longer matches the plan.
+* @param existing - Existing job functions keyed by name
+* @param resolved - Resolved `publishExecutionEvents` keyed by job function name
+* @returns Job function names needing re-registration
+*/
+function collectStaleJobFunctionNames(existing, resolved) {
+	const stale = /* @__PURE__ */ new Set();
+	for (const [jobName, publishEvents] of resolved) {
+		const remote = existing.get(jobName);
+		if (remote && remote.publishExecutionEvents !== publishEvents) stale.add(jobName);
+	}
+	return stale;
+}
 /**
 * Plan workflow changes and job functions based on current and desired state.
 * @param client - Operator client instance
@@ -11305,15 +11509,26 @@ function buildWorkflowValidationShape(workspaceId, workflow) {
 * @param workflows - Parsed workflows
 * @param mainJobDeps - Main job dependencies by workflow
 * @param unchangedJobFunctions - Job functions already proven unchanged by function registry plan
+* @param eventPublishing - Executor subscriptions and explicit job flags driving execution event publishing
 * @returns Planned workflow changes
 */
-async function planWorkflow(client, workspaceId, appName, appId, workflows, mainJobDeps, unchangedJobFunctions = /* @__PURE__ */ new Set()) {
+async function planWorkflow(client, workspaceId, appName, appId, workflows, mainJobDeps, unchangedJobFunctions = /* @__PURE__ */ new Set(), eventPublishing = {}) {
 	const changeSet = createChangeSet("Workflows");
 	const conflicts = [];
 	const unmanaged = [];
 	const resourceOwners = /* @__PURE__ */ new Set();
 	const unchangedWorkflowJobNames = /* @__PURE__ */ new Set();
 	const retainedWorkflowJobNames = /* @__PURE__ */ new Set();
+	const executionSubscribers = eventPublishing.execution ?? NO_EVENT_SUBSCRIBERS;
+	const existingJobFunctions = await fetchExistingJobFunctions(client, workspaceId);
+	const jobFunctionPublishEvents = resolveJobPublishEvents({
+		workflows,
+		mainJobDeps,
+		subscribers: eventPublishing.jobExecution ?? NO_EVENT_SUBSCRIBERS,
+		explicit: eventPublishing.jobPublishEvents ?? /* @__PURE__ */ new Map(),
+		existing: existingJobFunctions
+	});
+	const staleJobFunctionNames = collectStaleJobFunctionNames(existingJobFunctions, jobFunctionPublishEvents);
 	const existingWorkflows = await fetchExistingResourcesWithLabels({
 		client,
 		fetchPage: async (pageToken, pageSize) => {
@@ -11337,6 +11552,15 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 		const usedJobNames = mainJobDeps[workflow.mainJob.name];
 		if (!usedJobNames) throw new Error(`Job "${workflow.mainJob.name}" (mainJob of workflow "${workflow.name}") was not found.\n\nPossible causes:\n  - The job is not exported as a named export\n  - The file containing the job is not included in workflow.files glob pattern\n\nSolution:\n  export const ${workflow.mainJob.name} = createWorkflowJob({ name: "${workflow.mainJob.name}", ... })`);
 		usedJobNames.forEach((jobName) => retainedWorkflowJobNames.add(jobName));
+		const desiredWorkflow = {
+			...workflow,
+			publishEvents: resolvePublishEvents({
+				explicit: workflow.publishEvents,
+				subscribed: isSubscribed(executionSubscribers, workflow.name),
+				remote: existing?.resource.publishExecutionEvents,
+				conflictError: `Workflow "${workflow.name}" has "publishEvents: false", but executors with a workflowExecution trigger subscribe to it. Either remove "publishEvents: false" or remove the matching executor triggers.`
+			})
+		};
 		if (existing) {
 			if (trackDesiredResourceOwnership({
 				labels: existing.allLabels,
@@ -11347,13 +11571,19 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 				resourceName: workflow.name,
 				conflicts,
 				unmanaged
-			}) && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && canTreatWorkflowAsUnchanged(existing.resource, workflow, usedJobNames, unchangedJobFunctions)) {
+			}) && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && canTreatWorkflowAsUnchanged({
+				existing: existing.resource,
+				workflow: desiredWorkflow,
+				usedJobNames,
+				unchangedJobFunctions,
+				staleJobFunctionNames
+			})) {
 				changeSet.unchanged.push({ name: workflow.name });
 				for (const jobName of usedJobNames) unchangedWorkflowJobNames.add(jobName);
 			} else changeSet.updates.push({
 				name: workflow.name,
 				workspaceId,
-				workflow,
+				workflow: desiredWorkflow,
 				usedJobNames,
 				metaRequest
 			});
@@ -11361,7 +11591,7 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 		} else changeSet.creates.push({
 			name: workflow.name,
 			workspaceId,
-			workflow,
+			workflow: desiredWorkflow,
 			usedJobNames,
 			metaRequest
 		});
@@ -11391,6 +11621,7 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 		workspaceId,
 		appName,
 		appId,
+		existingJobFunctionNames: [...existingJobFunctions.keys()],
 		retainedWorkflowJobNames
 	});
 	const deletableJobNames = new Set(jobFunctionDeletes.map((del) => del.jobFunctionName));
@@ -11406,20 +11637,24 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 		appName,
 		appId,
 		unchangedWorkflowJobNames,
-		jobFunctionDeletes
+		jobFunctionDeletes,
+		jobFunctionPublishEvents
 	};
 }
-async function planWorkflowJobFunctionDeletes(params) {
-	const { client, workspaceId, appName, appId, retainedWorkflowJobNames } = params;
-	const existingJobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
+async function fetchExistingJobFunctions(client, workspaceId) {
+	const jobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
 		const response = await client.listWorkflowJobFunctions({
 			workspaceId,
 			pageToken,
 			pageSize: maxPageSize
 		});
-		return [response.jobFunctions.map((jobFunction) => jobFunction.name), response.nextPageToken];
+		return [response.jobFunctions, response.nextPageToken];
 	});
-	const candidates = [...new Set(existingJobFunctions)].filter((jobName) => !retainedWorkflowJobNames.has(jobName));
+	return new Map(jobFunctions.map((jobFunction) => [jobFunction.name, jobFunction]));
+}
+async function planWorkflowJobFunctionDeletes(params) {
+	const { client, workspaceId, appName, appId, existingJobFunctionNames, retainedWorkflowJobNames } = params;
+	const candidates = existingJobFunctionNames.filter((jobName) => !retainedWorkflowJobNames.has(jobName));
 	return (await Promise.all(candidates.map(async (jobFunctionName) => {
 		const { metadata } = await client.getMetadata({ trn: resourceTrn(workspaceId, "workflow_job_function", jobFunctionName) });
 		return isOwnedByApp(metadata?.labels, appName, appId) ? {
@@ -11437,12 +11672,14 @@ async function planWorkflowJobFunctionDeletes(params) {
 function formatWorkflowChangeEntries(changeSet, workflowJobFunctionChanges) {
 	return formatChangeEntriesWithFunctionRegistry("workflow", changeSet, workflowJobFunctionChanges, (item) => "usedJobNames" in item ? item.usedJobNames.map((jobName) => workflowJobFunctionName(jobName)) : []);
 }
-function canTreatWorkflowAsUnchanged(existing, workflow, usedJobNames, unchangedJobFunctions) {
+function canTreatWorkflowAsUnchanged(params) {
+	const { existing, workflow, usedJobNames, unchangedJobFunctions, staleJobFunctionNames } = params;
 	if (!usedJobNames.every((jobName) => unchangedJobFunctions.has(jobName))) return false;
+	if (usedJobNames.some((jobName) => staleJobFunctionNames.has(jobName))) return false;
 	return areWorkflowsEqual(existing, workflow, usedJobNames);
 }
 function areWorkflowsEqual(existing, workflow, usedJobNames) {
-	return existing.mainJobFunctionName === workflow.mainJob.name && areNormalizedEqual(normalizeComparableExistingWorkflowRetryPolicy(existing.retryPolicy), normalizeComparableWorkflowRetryPolicy(workflow.retryPolicy)) && areNormalizedEqual(normalizeComparableConcurrencyPolicy(existing.concurrencyPolicy), normalizeComparableConcurrencyPolicy(workflow.concurrencyPolicy)) && areNormalizedEqual(normalizeComparableWorkflowJobNames(existing.jobFunctions), normalizeComparableWorkflowJobNames(usedJobNames));
+	return existing.mainJobFunctionName === workflow.mainJob.name && (existing.publishExecutionEvents ?? false) === (workflow.publishEvents ?? false) && areNormalizedEqual(normalizeComparableExistingWorkflowRetryPolicy(existing.retryPolicy), normalizeComparableWorkflowRetryPolicy(workflow.retryPolicy)) && areNormalizedEqual(normalizeComparableConcurrencyPolicy(existing.concurrencyPolicy), normalizeComparableConcurrencyPolicy(workflow.concurrencyPolicy)) && areNormalizedEqual(normalizeComparableWorkflowJobNames(existing.jobFunctions), normalizeComparableWorkflowJobNames(usedJobNames));
 }
 function normalizeComparableExistingWorkflowRetryPolicy(policy) {
 	if (!policy) return;
@@ -11699,6 +11936,9 @@ async function applyDeploymentPlans(client, workspaceId, deployments) {
 	const forEachDeployment = async (apply) => {
 		for (const deployment of deployments) await apply(deployment);
 	};
+	await withSpan("apply.preflight", async () => {
+		await forEachDeployment((d) => preflightTailorDB(client, d.tailorDB));
+	});
 	await withSpan("apply.createUpdateServices", async () => {
 		await forEachDeployment((d) => applySecretManager(client, d.secretManager, "create-update", d.application));
 		await forEachDeployment((d) => applyFunctionRegistry(client, workspaceId, d.functionRegistry, "create-update"));
@@ -13137,6 +13377,39 @@ function collectExecutorUsedResolvers(owner, targets) {
 	}
 	return usedResolvers;
 }
+/**
+* Resolve which workflows this target's executors subscribe to, per event
+* granularity level.
+*
+* Scoped to the owning target: unlike TailorDB, Auth and IdP, a workflow has no
+* `external` declaration, so no supported configuration shares a workflow and a
+* subscribing executor across configs.
+* @param target - Deployment target being planned
+* @returns Subscribers keyed by event granularity level
+*/
+function collectWorkflowEventSubscribers(target) {
+	const execution = { workflowNames: /* @__PURE__ */ new Set() };
+	const jobExecution = { workflowNames: /* @__PURE__ */ new Set() };
+	for (const executor of Object.values(target.application.executorService?.executors ?? {})) {
+		const { trigger } = executor;
+		if (trigger.kind !== "workflowExecution" && trigger.kind !== "workflowJobExecution") continue;
+		(trigger.kind === "workflowExecution" ? execution : jobExecution).workflowNames.add(trigger.workflowName);
+	}
+	return {
+		execution,
+		jobExecution
+	};
+}
+/**
+* Collect explicit `publishEvents` values declared on this target's workflow jobs.
+* @param target - Deployment target being planned
+* @returns Explicit flags keyed by job name
+*/
+function collectWorkflowJobPublishEvents(target) {
+	const jobPublishEvents = /* @__PURE__ */ new Map();
+	for (const job of target.application.workflowService?.jobs ?? []) if (job.publishEvents !== void 0) jobPublishEvents.set(job.name, job.publishEvents);
+	return jobPublishEvents;
+}
 function collectExpectedLocalStaticWebsiteNames(targets) {
 	const websiteNames = /* @__PURE__ */ new Set();
 	for (const target of targets) for (const website of target.application.staticWebsiteServices) websiteNames.add(website.name);
@@ -13738,7 +14011,10 @@ async function planDeploymentTarget(params) {
 			withSpan("plan.pipeline", () => planPipeline(ctx)),
 			withSpan("plan.application", () => planApplication(ctx, httpAdapterBuildResult)),
 			withSpan("plan.executor", () => planExecutor(ctx)),
-			withSpan("plan.workflow", () => planWorkflow(client, workspaceId, application.name, application.id, workflowService?.workflows ?? {}, workflowBuildResult?.mainJobDeps ?? {}, unchangedWorkflowJobs)),
+			withSpan("plan.workflow", () => planWorkflow(client, workspaceId, application.name, application.id, workflowService?.workflows ?? {}, workflowBuildResult?.mainJobDeps ?? {}, unchangedWorkflowJobs, {
+				...collectWorkflowEventSubscribers(target),
+				jobPublishEvents: collectWorkflowJobPublishEvents(target)
+			})),
 			withSpan("plan.workflowExecutionPolicy", () => planWorkflowJobFunctionExecutionPolicy(client, workspaceId, application.name, application.id, config.workflow?.executionPolicies ?? {})),
 			withSpan("plan.secretManager", () => planSecretManager(ctx))
 		]);
@@ -14553,6 +14829,12 @@ function formatEventTriggerConfig(config) {
 		eventType: config.eventType,
 		condition: config.condition?.expr || ""
 	};
+	if (typedConfig.case === "workflow") return {
+		kind: typedConfig.case,
+		eventTypes: typedConfig.value.eventTypes,
+		condition: typedConfig.value.condition?.expr || "",
+		...typedConfig.value.workflowName && { workflowName: typedConfig.value.workflowName }
+	};
 	const base = {
 		kind: typedConfig.case,
 		eventTypes: typedConfig.value.eventTypes,
@@ -18860,8 +19142,13 @@ async function generateDiffFiles(diff, migrationsDir, migrationNumber, previousS
 function generateMigrationScript(diff) {
 	const updates = [];
 	for (const change of diff.changes) {
-		const script = generateChangeScript(change);
-		if (script) updates.push(script);
+		const decimalScaleScript = generateDecimalScaleChangeScript(change);
+		updates.push(...generateChangeScripts(change, decimalScaleScript !== null));
+		if (decimalScaleScript) {
+			updates.push(decimalScaleScript);
+			const uniqueConstraintScript = generateUniqueConstraintScript(change);
+			if (uniqueConstraintScript) updates.push(uniqueConstraintScript);
+		}
 	}
 	if (updates.length === 0) updates.push(`  // No data migration needed for this schema change
   // Add custom data transformations if required`);
@@ -18886,18 +19173,19 @@ ${updates.join("\n\n")}
 `;
 }
 /**
-* Generate script for a single change
+* Generate scripts for a single change
 * @param {DiffChange} change - Diff change to generate script for
-* @returns {string | null} Script content or null if no script needed
+* @param {boolean} deferUniqueConstraint - Generate the unique check after decimal re-serialization
+* @returns {string[]} Script contents, or an empty array if no script is needed
 */
-function generateChangeScript(change) {
+function generateChangeScripts(change, deferUniqueConstraint = false) {
 	if (change.kind === "index_added" || change.kind === "index_modified") {
 		const before = change.kind === "index_modified" ? change.before : void 0;
-		if (!isBreakingIndexChange(change.typeName, change.indexName, before, change.after)) return null;
+		if (!isBreakingIndexChange(change.typeName, change.indexName, before, change.after)) return [];
 		const fields = change.after.fields;
 		const fieldList = fields.map((f) => `"${f}"`).join(", ");
 		const whereClauses = fields.map((f) => `.where("${f}", "=", dup.${f})`).join("\n        ");
-		return `  // Resolve duplicate (${fields.join(", ")}) combinations before unique index "${change.indexName}" is enforced
+		return [`  // Resolve duplicate (${fields.join(", ")}) combinations before unique index "${change.indexName}" is enforced
   {
     const duplicates = await trx
       .selectFrom("${change.typeName}")
@@ -18920,81 +19208,135 @@ function generateChangeScript(change) {
           .execute();
       }
     }
-  }`;
+  }`];
 	}
 	if (change.kind === "field_added") {
-		if (change.after.required) return `  // Populate ${change.fieldName} for existing ${change.typeName} records
+		if (change.after.required) return [`  // Populate ${change.fieldName} for existing ${change.typeName} records
   await trx
     .updateTable("${change.typeName}")
     .set({
       ${change.fieldName}: null, // TODO: Set appropriate default value
     })
-    .execute();`;
-		return null;
+    .execute();`];
+		return [];
 	}
-	if (change.kind !== "field_modified") return null;
+	if (change.kind !== "field_modified") return [];
 	const { before, after } = change;
-	if (!before.required && after.required) return `  // Set ${change.fieldName} for ${change.typeName} records where it is null
+	const scripts = [];
+	if (!before.required && after.required) scripts.push(`  // Set ${change.fieldName} for ${change.typeName} records where it is null
   await trx
     .updateTable("${change.typeName}")
     .set({
       ${change.fieldName}: null, // TODO: Set appropriate default value
     })
     .where("${change.fieldName}", "is", null)
-    .execute();`;
-	if (!(before.unique ?? false) && (after.unique ?? false)) return `  // Ensure ${change.fieldName} values are unique before adding constraint
-  const duplicates = await trx
-    .selectFrom("${change.typeName}")
-    .select(["${change.fieldName}"])
-    .groupBy("${change.fieldName}")
-    .having((eb) => eb.fn.count("id"), ">", 1)
-    .execute();
-  for (const dup of duplicates) {
-    // Keep first record, add suffix to others
-    const records = await trx
-      .selectFrom("${change.typeName}")
-      .select(["id", "${change.fieldName}"])
-      .where("${change.fieldName}", "=", dup.${change.fieldName})
-      .execute();
-    for (let i = 1; i < records.length; i++) {
-      await trx
-        .updateTable("${change.typeName}")
-        .set({ ${change.fieldName}: \`\${records[i].${change.fieldName}}_\${i}\` }) // TODO: Set appropriate unique value
-        .where("id", "=", records[i].id)
-        .execute();
-    }
-  }`;
+    .execute();`);
+	if (!deferUniqueConstraint) {
+		const uniqueConstraintScript = generateUniqueConstraintScript(change);
+		if (uniqueConstraintScript) scripts.push(uniqueConstraintScript);
+	}
 	if (before.type === "enum" && after.type === "enum") {
 		const beforeValues = (before.allowedValues ?? []).map((v) => v.value);
 		const afterValues = (after.allowedValues ?? []).map((v) => v.value);
 		const removedValues = beforeValues.filter((v) => !afterValues.includes(v));
 		if (removedValues.length > 0) {
 			const defaultValue = afterValues[0] ?? "NEW_VALUE";
-			return `  // Migrate records with removed enum values: ${removedValues.join(", ")}
+			scripts.push(`  // Migrate records with removed enum values: ${removedValues.join(", ")}
   await trx
     .updateTable("${change.typeName}")
     .set({ ${change.fieldName}: "${defaultValue}" }) // TODO: Set appropriate value
     .where("${change.fieldName}", "in", [${removedValues.map((v) => `"${v}"`).join(", ")}])
-    .execute();`;
+    .execute();`);
 		}
 	}
-	if (before.foreignKeyType && after.foreignKeyType && before.foreignKeyType !== after.foreignKeyType) return `  // Migrate ${change.fieldName} references from ${before.foreignKeyType} to ${after.foreignKeyType}
+	if (before.foreignKeyType && after.foreignKeyType && before.foreignKeyType !== after.foreignKeyType) scripts.push(`  // Migrate ${change.fieldName} references from ${before.foreignKeyType} to ${after.foreignKeyType}
   // Find records that don't have a valid reference in the new target table
-  const orphanedRecords = await trx
-    .selectFrom("${change.typeName}")
-    .leftJoin("${after.foreignKeyType}", "${change.typeName}.${change.fieldName}", "${after.foreignKeyType}.id")
-    .select(["${change.typeName}.id", "${change.typeName}.${change.fieldName}"])
-    .where("${after.foreignKeyType}.id", "is", null)
-    .where("${change.typeName}.${change.fieldName}", "is not", null)
-    .execute();
-  for (const record of orphanedRecords) {
-    await trx
-      .updateTable("${change.typeName}")
-      .set({ ${change.fieldName}: null }) // TODO: Set appropriate new reference
-      .where("id", "=", record.id)
+  {
+    const orphanedRecords = await trx
+      .selectFrom("${change.typeName}")
+      .leftJoin("${after.foreignKeyType}", "${change.typeName}.${change.fieldName}", "${after.foreignKeyType}.id")
+      .select(["${change.typeName}.id", "${change.typeName}.${change.fieldName}"])
+      .where("${after.foreignKeyType}.id", "is", null)
+      .where("${change.typeName}.${change.fieldName}", "is not", null)
+      .execute();
+    for (const record of orphanedRecords) {
+      await trx
+        .updateTable("${change.typeName}")
+        .set({ ${change.fieldName}: null }) // TODO: Set appropriate new reference
+        .where("id", "=", record.id)
+        .execute();
+    }
+  }`);
+	return scripts;
+}
+function generateUniqueConstraintScript(change) {
+	if (change.kind !== "field_modified") return null;
+	const { before, after } = change;
+	if ((before.unique ?? false) || !(after.unique ?? false)) return null;
+	return `  // Ensure ${change.fieldName} values are unique before adding constraint
+  {
+    const duplicates = await trx
+      .selectFrom("${change.typeName}")
+      .select(["${change.fieldName}"])
+      .groupBy("${change.fieldName}")
+      .having((eb) => eb.fn.count("id"), ">", 1)
       .execute();
+    for (const dup of duplicates) {
+      // Keep first record, add suffix to others
+      const records = await trx
+        .selectFrom("${change.typeName}")
+        .select(["id", "${change.fieldName}"])
+        .where("${change.fieldName}", "=", dup.${change.fieldName})
+        .execute();
+      for (let i = 1; i < records.length; i++) {
+        await trx
+          .updateTable("${change.typeName}")
+          .set({ ${change.fieldName}: \`\${records[i].${change.fieldName}}_\${i}\` }) // TODO: Set appropriate unique value
+          .where("id", "=", records[i].id)
+          .execute();
+      }
+    }
+  }`;
+}
+function generateDecimalScaleChangeScript(change) {
+	if (change.kind !== "field_modified") return null;
+	const { before, after } = change;
+	if (before.type !== "decimal" || after.type !== "decimal" || before.scale === after.scale) return null;
+	const valueExpression = !before.required && after.required ? `row.${change.fieldName}!` : `row.${change.fieldName}`;
+	const beforeScale = before.scale ?? 6;
+	const roundingWarning = (after.scale ?? 6) < beforeScale ? `
+  // Values that exceed the new scale may be rounded half-up, so review the
+  // resulting precision before deploying.` : "";
+	return `  // Re-save existing ${change.typeName} rows so ${change.fieldName} is stored under the new scale.
+  // This is a workaround for a platform-side gap where rows written under the
+  // previous scale could fail on later updates until re-saved. Keep it unless
+  // your platform is confirmed to handle stored values across scale changes.${roundingWarning}
+  {
+    let lastId: string | undefined;
+    while (true) {
+      let query = trx
+        .selectFrom("${change.typeName}")
+        .select(["id", "${change.fieldName}"])
+        .where("${change.fieldName}", "is not", null)
+        .orderBy("id", "asc")
+        .limit(100);
+      if (lastId) {
+        query = query.where("id", ">", lastId);
+      }
+      const rows = await query.execute();
+      if (rows.length === 0) break;
+
+      for (const row of rows) {
+        await trx
+          .updateTable("${change.typeName}")
+          .set({ ${change.fieldName}: ${valueExpression} })
+          .where("id", "=", row.id)
+          .where("${change.fieldName}", "=", ${valueExpression})
+          .execute();
+      }
+      lastId = rows[rows.length - 1]!.id;
+    }
   }`;
-	return null;
 }
 
 //#endregion
@@ -19063,7 +19405,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-CP7JKG9R.mjs");
+	const { defineApplication } = await import("./application-C-zsrNjn.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -20277,8 +20619,13 @@ async function bundleQueryScript(engine, baseDir) {
 	const entryContent = engine === "sql" ? createSqlEntry() : createGqlEntry();
 	fs$1.writeFileSync(entryPath, entryContent);
 	const tsconfig = await resolveTSConfigWithFallback(baseDir);
-	return (await rolldown.build({
-		plugins: [platformBundleDefinePlugin],
+	const bundleLog = createBundleLog({ tsconfig });
+	const result = await rolldown.build({
+		plugins: [
+			createGeneratedEntryResolverPlugin(entryPath, baseDir),
+			createTsconfigPathsPlugin(),
+			platformBundleDefinePlugin
+		],
 		input: entryPath,
 		write: false,
 		output: {
@@ -20296,8 +20643,10 @@ async function bundleQueryScript(engine, baseDir) {
 			annotations: true,
 			unknownGlobalSideEffects: false
 		},
-		logLevel: "silent"
-	})).output[0].code;
+		...bundleLog.options
+	});
+	bundleLog.assertAllResolved();
+	return result.output[0].code;
 }
 
 //#endregion
@@ -21191,5 +21540,5 @@ async function registerTypeScriptRuntime(hookUrl) {
 }
 
 //#endregion
-export { listFolders as $, deploymentArgs as $n, handleOptionalToRequiredError as $t, generate as A, generateUserTypes as An, startCommand as At, remove as B, loadConsoleBaseUrl as Bn, deploy as Bt, waitWorkflowExecution as C, formatDiffSummary as Cn, listCommand$8 as Ct, listWorkflows as D, resourceTrn as Dn, jobsCommand as Dt, listCommand$2 as E, getNamespacesWithMigrations as En, getExecutorWaitFailureMessage as Et, openInConfiguredEditor as F, deleteUserTokens as Fn, getWorkflowExecution as Ft, treeCommand as G, readPlatformConfig as Gn, createWorkspace$1 as Gt, updateCommand$1 as H, loadStoredUserTokens as Hn, listCommand$9 as Ht, show as I, fetchLatestToken as In, listWorkflowExecutions as It, getCommand$1 as J, writePlatformConfig as Jn, ensureConfigId as Jt, listCommand$3 as K, resolveUserTokenKey as Kn, formatKeyValueTable as Kt, showCommand as L, hasAnyUserTokenEntry as Ln, functionExecutionStatusToString as Lt, generateMigrationScript as M, apiCall as Mn, getCommand$5 as Mt, writeDbTypesFile as N, assertWritable as Nn, getWorkflow as Nt, truncate as O, sdkNameLabelKey as On, listExecutorJobs as Ot, getConfiguredEditorCommand as P, loadConfig as Pn, executionsCommand as Pt, listCommand$4 as Q, confirmationArgs as Qn, MIGRATION_LABEL_KEY as Qt, extractOwnedNamespaces as R, hasUserTokenEntry as Rn, getCommand$6 as Rt, waitCommand as S, parseMigrationNumberArg as Sn, triggerExecutor as St, resumeWorkflow as T, hasChanges as Tn, getExecutorJob as Tt, updateOrganization as U, loadWorkspaceId as Un, listWorkspaces as Ut, removeCommand$1 as V, loadMachineUserName as Vn, deployFromCLI as Vt, organizationTree as W, platformConfigFromProfile as Wn, createCommand$1 as Wt, updateCommand$2 as X, commonArgs as Xn, waitForExecution as Xt, getOrganization as Y, defineAppCommand as Yn, executeScript as Yt, updateFolder as Z, configArg as Zn, bundleMigrationScript as Zt, deleteWorkspace as _, getNextMigrationNumber as _n, getCommand$4 as _t, updateUser as a, DIFF_FILE_NAME as an, toPageDirection as ar, createFolder as at, getAppHealth as b, reconstructSnapshotFromMigrations as bn, webhookCommand as bt, listCommand as c, SCHEMA_FILE_NAME as cn, getCommand$3 as ct, inviteUser as d, compareSnapshots as dn, tokenCommand as dt, parseMigrationLabelNumber as en, isVerbose as er, getCommand$2 as et, restoreCommand as f, createSnapshotFromLocalTypes as fn, listCommand$6 as ft, deleteCommand as g, getMigrationFiles as gn, listFunctionRegistries as gt, getWorkspace as h, getMigrationFilePath as hn, listCommand$7 as ht, updateCommand as i, DB_TYPES_FILE_NAME as in, resolveMachineUserInputSource as ir, createCommand as it, generateCommand as j, prompt as jn, startWorkflow as jt, truncateCommand as k, PluginManager as kn, watchExecutorJob as kt, listUsers as l, assertValidMigrationFiles as ln, getOAuth2Client as lt, getCommand as m, getMigrationDirPath as mn, generate$1 as mt, query as n, generateAllTypeManifestsFromSnapshot as nn, pagedLogArgs as nr, deleteCommand$1 as nt, removeCommand as o, INITIAL_SCHEMA_NUMBER as on, workspaceArgs as or, listCommand$5 as ot, restoreWorkspace as p, getLatestMigrationNumber as pn, listMachineUsers as pt, listOrganizations as q, saveUserTokens as qn, workspaceNameSchema as qt, queryCommand as r, protoGqlPermission as rn, paginationArgs as rr, deleteFolder as rt, removeUser as s, MIGRATE_FILE_NAME as sn, listOAuth2Clients as st, registerTypeScriptRuntime as t, compareSnapshotWithRemote as tn, multiConfigArg as tr, getFolder as tt, inviteCommand as u, compareLocalTypesWithSnapshot as un, getMachineUserToken as ut, listApps as v, isValidMigrationNumber as vn, getFunctionRegistry as vt, resumeCommand as w, formatMigrationDiff as wn, listExecutors as wt, healthCommand as x, formatMigrationNumber as xn, triggerCommand as xt, listCommand$1 as y, loadDiff as yn, listWebhookExecutors as yt, logBetaWarning as z, loadAccessToken as zn, getExecutor as zt };
-//# sourceMappingURL=register-typescript-runtime-CCHyKeXO.mjs.map
+export { listFolders as $, writePlatformConfig as $n, logRemoteDriftGuidance as $t, generate as A, hasChanges as An, startCommand as At, remove as B, deleteUserTokens as Bn, deploy as Bt, waitWorkflowExecution as C, isValidMigrationNumber as Cn, listCommand$8 as Ct, listWorkflows as D, parseMigrationNumberArg as Dn, jobsCommand as Dt, listCommand$2 as E, formatMigrationNumber as En, getExecutorWaitFailureMessage as Et, openInConfiguredEditor as F, generateUserTypes as Fn, getWorkflowExecution as Ft, treeCommand as G, loadConsoleBaseUrl as Gn, createWorkspace$1 as Gt, updateCommand$1 as H, hasAnyUserTokenEntry as Hn, listCommand$9 as Ht, show as I, prompt as In, listWorkflowExecutions as It, getCommand$1 as J, loadWorkspaceId as Jn, ensureConfigId as Jt, listCommand$3 as K, loadMachineUserName as Kn, formatKeyValueTable as Kt, showCommand as L, apiCall as Ln, functionExecutionStatusToString as Lt, generateMigrationScript as M, resourceTrn as Mn, getCommand$5 as Mt, writeDbTypesFile as N, sdkNameLabelKey as Nn, getWorkflow as Nt, truncate as O, formatDiffSummary as On, listExecutorJobs as Ot, getConfiguredEditorCommand as P, PluginManager as Pn, executionsCommand as Pt, listCommand$4 as Q, saveUserTokens as Qn, checkMigrationDiffs as Qt, extractOwnedNamespaces as R, assertWritable as Rn, getCommand$6 as Rt, waitCommand as S, getNextMigrationNumber as Sn, triggerExecutor as St, resumeWorkflow as T, reconstructSnapshotFromMigrations as Tn, getExecutorJob as Tt, updateOrganization as U, hasUserTokenEntry as Un, listWorkspaces as Ut, removeCommand$1 as V, fetchLatestToken as Vn, deployFromCLI as Vt, organizationTree as W, loadAccessToken as Wn, createCommand$1 as Wt, updateCommand$2 as X, readPlatformConfig as Xn, waitForExecution as Xt, getOrganization as Y, platformConfigFromProfile as Yn, executeScript as Yt, updateFolder as Z, resolveUserTokenKey as Zn, bundleMigrationScript as Zt, deleteWorkspace as _, formatSchemaDrifts as _n, getCommand$4 as _t, updateUser as a, compareSnapshotWithRemote as an, isVerbose as ar, createFolder as at, getAppHealth as b, getMigrationFilePath as bn, webhookCommand as bt, listCommand as c, DB_TYPES_FILE_NAME as cn, paginationArgs as cr, getCommand$3 as ct, inviteUser as d, MIGRATE_FILE_NAME as dn, workspaceArgs as dr, tokenCommand as dt, toTailorDBDeployInput as en, defineAppCommand as er, getCommand$2 as et, restoreCommand as f, SCHEMA_FILE_NAME as fn, listCommand$6 as ft, deleteCommand as g, createSnapshotFromLocalTypes as gn, listFunctionRegistries as gt, getWorkspace as h, compareSnapshots as hn, listCommand$7 as ht, updateCommand as i, parseMigrationLabelNumber as in, deploymentArgs as ir, createCommand as it, generateCommand as j, getNamespacesWithMigrations as jn, startWorkflow as jt, truncateCommand as k, formatMigrationDiff as kn, watchExecutorJob as kt, listUsers as l, DIFF_FILE_NAME as ln, resolveMachineUserInputSource as lr, getOAuth2Client as lt, getCommand as m, compareLocalTypesWithSnapshot as mn, generate$1 as mt, query as n, MIGRATION_LABEL_KEY as nn, configArg as nr, deleteCommand$1 as nt, removeCommand as o, generateAllTypeManifestsFromSnapshot as on, multiConfigArg as or, listCommand$5 as ot, restoreWorkspace as p, assertValidMigrationFiles as pn, listMachineUsers as pt, listOrganizations as q, loadStoredUserTokens as qn, workspaceNameSchema as qt, queryCommand as r, handleOptionalToRequiredError as rn, confirmationArgs as rr, deleteFolder as rt, removeUser as s, protoGqlPermission as sn, pagedLogArgs as sr, listOAuth2Clients as st, registerTypeScriptRuntime as t, verifyRemoteSchema as tn, commonArgs as tr, getFolder as tt, inviteCommand as u, INITIAL_SCHEMA_NUMBER as un, toPageDirection as ur, getMachineUserToken as ut, listApps as v, getLatestMigrationNumber as vn, getFunctionRegistry as vt, resumeCommand as w, loadDiff as wn, listExecutors as wt, healthCommand as x, getMigrationFiles as xn, triggerCommand as xt, listCommand$1 as y, getMigrationDirPath as yn, listWebhookExecutors as yt, logBetaWarning as z, loadConfig as zn, getExecutor as zt };
+//# sourceMappingURL=register-typescript-runtime-nG-n9lPw.mjs.map