@tailor-platform/sdk 2.0.0-next.1 → 2.0.0-next.3

package/dist/{application-DqS1yBg3.mjs → application-eHp9jXld.mjs}

@@ -1,34 +1,37 @@
 import { n as isSdkBranded } from "./brand-Eo4pLXPJ.mjs";
-import { a as fetchAll, d as initOAuth2Client, l as fetchUserInfo } from "./client-z_oHGVNy.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
-import { a as parseBoolean, n as logger, r as styles } from "./logger-CxF-Ex5d.mjs";
-import { a as TailorFieldSchema, i as AuthInvokerSchema, n as ExecutorSchema, o as loadFilesWithIgnores, r as AuthConfigSchema, s as functionSchema, t as createExecutorService } from "./service-CCL8ruDf.mjs";
+import { a as parseBoolean, n as logger, r as styles } from "./logger-BEiZZ3qT.mjs";
+import { a as AuthConfigSchema, c as stripTailorDBTypeBuilderHelpers, d as applyRelationMetadataToFieldConfig, f as buildRelationInfo, g as functionSchema, h as loadFilesWithIgnores, l as TailorDBServiceConfigSchema, m as validateRelationConfig, n as loadExecutor, o as AuthInvokerSchema, p as processRelationMetadata, s as TailorFieldSchema, t as createExecutorService, u as TailorDBTypeSchema } from "./service-ufH7sS8o.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "./package-json-8b0O9TlX.mjs";
-import { t as createCLIError } from "./errors-Dtf2WPaW.mjs";
-import { n as tightenSecretFilePermissions, r as writeSecretFile } from "./secret-file-DBqZhjFQ.mjs";
+import { i as userAgent, n as tightenSecretFilePermissions, r as writeSecretFile } from "./secret-file-aoNXJmKa.mjs";
+import { t as createCLIError } from "./errors-118wUDRr.mjs";
 import { t as isPluginGeneratedType } from "./type-source-DH_LH20p.mjs";
 import { builtinModules, createRequire } from "node:module";
+import * as path from "pathe";
+import { join, resolve } from "pathe";
+import { resolveTSConfig } from "pkg-types";
 import { z } from "zod";
+import { create } from "@bufbuild/protobuf";
 import * as fs$1 from "node:fs";
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import * as path from "pathe";
-import { join, resolve } from "pathe";
+import { MethodOptions_IdempotencyLevel } from "@bufbuild/protobuf/wkt";
 import { pathToFileURL } from "node:url";
-import * as os from "node:os";
-import { parseTOML, parseYAML, stringifyYAML } from "confbox";
+import { parseYAML, stringifyYAML } from "confbox";
 import { findUpSync } from "find-up-simple";
 import { lt } from "semver";
 import { xdgConfig } from "xdg-basedir";
-import { Code, ConnectError } from "@connectrpc/connect";
-import { resolveTSConfig } from "pkg-types";
+import { OAuth2Client } from "@badgateway/oauth2-client";
+import { Code, ConnectError, createClient } from "@connectrpc/connect";
+import { getGlobalDispatcher } from "undici";
+import pLimit from "p-limit";
 import * as crypto from "node:crypto";
 import * as rolldown from "rolldown";
 import * as fs from "node:fs/promises";
 import { parseSync } from "oxc-parser";
 import * as inflection from "inflection";
 import * as globals from "globals";
-import pLimit from "p-limit";
+import * as os from "node:os";
 
 //#region src/parser/app-config/log-level.ts
 const LOG_LEVELS = [
@@ -62,7 +65,7 @@ const logLevelSchema = z.string().refine((value) => LogLevelSchema.safeParse(val
 * label-compatible prefix is added at the metadata boundary, so user-facing
 * configs only need to carry a UUID.
 */
-const AppConfigSchema = z.object({
+const AppConfigSchema = z.strictObject({
 	id: z.uuid({ message: "'id' must be a UUID." }).optional(),
 	name: z.string().min(1, { message: "'name' must be a non-empty string." }),
 	env: z.record(z.string(), envValueSchema).optional(),
@@ -85,7 +88,7 @@ const AppConfigSchema = z.object({
 
 //#endregion
 //#region src/parser/plugin-config/schema.ts
-const PluginConfigSchema = z.object({
+const PluginConfigSchema = z.looseObject({
 	id: z.string(),
 	description: z.string(),
 	importPath: z.string().optional(),
@@ -96,10 +99,639 @@ const PluginConfigSchema = z.object({
 	onTailorDBReady: functionSchema.optional(),
 	onResolverReady: functionSchema.optional(),
 	onExecutorReady: functionSchema.optional()
-}).passthrough().refine((p) => {
+}).refine((p) => {
 	return !(p.onTypeLoaded || p.onNamespaceLoaded) || !!p.importPath;
 }, { message: "importPath is required when plugin has definition-time hooks (onTypeLoaded/onNamespaceLoaded)" }).transform((plugin) => plugin);
 
+//#endregion
+//#region src/cli/shared/apply-concurrency.ts
+/**
+* Default cap on concurrent operator RPCs when `TAILOR_APPLY_CONCURRENCY` is
+* unset. Chosen to tame the create burst (a fresh workspace fires one
+* `create*` per resource at once) that triggers the platform-side
+* `already_exists` race on compound creates, while still deploying quickly.
+*/
+const DEFAULT_APPLY_CONCURRENCY = 16;
+/**
+* Resolve the maximum number of operator RPCs to run in parallel.
+*
+* Resolution order:
+* 1. `TAILOR_APPLY_CONCURRENCY` env var (positive integer)
+* 2. `DEFAULT_APPLY_CONCURRENCY`
+*
+* A fresh-workspace apply creates every resource at once; firing all of them
+* concurrently overloads the platform, whose responses then come back as
+* `Unavailable`/`ResourceExhausted` and drive retries into the non-idempotent
+* compound-create `already_exists` race. Capping bounds the worst case.
+* @returns Concurrency cap (always >= 1)
+*/
+function resolveApplyConcurrency() {
+	const envValue = process.env.TAILOR_APPLY_CONCURRENCY;
+	if (envValue !== void 0) {
+		const trimmed = envValue.trim();
+		if (trimmed !== "" && /^[1-9]\d*$/.test(trimmed)) return Number.parseInt(trimmed, 10);
+	}
+	return DEFAULT_APPLY_CONCURRENCY;
+}
+/**
+* Create a limiter capped at the resolved apply concurrency. The returned
+* function defers a task until a slot is free, then resolves with its result.
+*
+* Share a single instance across all RPCs that should contend for the same
+* budget (e.g. one per operator client) so the cap bounds total in-flight
+* calls, not per-call-site bursts.
+* @returns A limiter that defers tasks beyond the concurrency cap
+*/
+function createApplyLimiter() {
+	return pLimit(resolveApplyConcurrency());
+}
+/**
+* Comparator that orders `name`-bearing items by `name`, for a stable,
+* reproducible apply order within the concurrency cap.
+*
+* Uses a code-point comparison rather than `localeCompare` so the order does
+* not depend on the runtime's default locale/collation.
+* @param a - Left item
+* @param b - Right item
+* @returns Negative, zero, or positive per code-point ordering of the names
+*/
+function byName(a, b) {
+	if (a.name < b.name) return -1;
+	if (a.name > b.name) return 1;
+	return 0;
+}
+
+//#endregion
+//#region src/cli/shared/client.ts
+const defaultPlatformBaseUrl = "https://api.tailor.tech";
+const defaultConsoleBaseUrl = "https://console.tailor.tech";
+const defaultOAuth2ClientId = "cpoc_0Iudir72fqSpqC6GQ58ri1cLAqcq5vJl";
+const oauth2DiscoveryEndpoint = "/.well-known/oauth-authorization-server/oauth2/platform";
+const tokenPlatformConfigs = /* @__PURE__ */ new Map();
+function getEnvPlatformUrl() {
+	return process.env.TAILOR_PLATFORM_URL ?? process.env.PLATFORM_URL;
+}
+function getEnvOAuth2ClientId() {
+	return process.env.TAILOR_PLATFORM_OAUTH2_CLIENT_ID ?? process.env.PLATFORM_OAUTH2_CLIENT_ID;
+}
+function normalizeBaseUrl(value) {
+	const url = new URL(value);
+	url.hash = "";
+	url.search = "";
+	return url.toString().replace(/\/$/, "");
+}
+function getEffectivePlatformConfig(config = {}) {
+	const platformUrl = config.platformUrl ?? getEnvPlatformUrl();
+	const oauth2ClientId = config.oauth2ClientId ?? getEnvOAuth2ClientId();
+	const consoleUrl = config.consoleUrl ?? process.env.TAILOR_PLATFORM_CONSOLE_URL;
+	const effective = {
+		...platformUrl ? { platformUrl } : {},
+		...oauth2ClientId ? { oauth2ClientId } : {},
+		...consoleUrl ? { consoleUrl } : {}
+	};
+	return Object.keys(effective).length > 0 ? effective : void 0;
+}
+function rememberPlatformConfigForToken(accessToken, config) {
+	const effectiveConfig = getEffectivePlatformConfig(config);
+	if (effectiveConfig) tokenPlatformConfigs.set(accessToken, effectiveConfig);
+	else tokenPlatformConfigs.delete(accessToken);
+}
+function getPlatformConfigForToken(accessToken) {
+	return tokenPlatformConfigs.get(accessToken);
+}
+function getPlatformBaseUrl(config = {}) {
+	return normalizeBaseUrl(config.platformUrl ?? getEnvPlatformUrl() ?? "https://api.tailor.tech");
+}
+function isDefaultPlatform(config) {
+	return getPlatformBaseUrl(config) === normalizeBaseUrl(defaultPlatformBaseUrl);
+}
+function getOAuth2ClientId(config = {}) {
+	return config.oauth2ClientId ?? getEnvOAuth2ClientId() ?? defaultOAuth2ClientId;
+}
+function inferConsoleBaseUrl(platformBaseUrl) {
+	const platformUrl = new URL(platformBaseUrl);
+	if (platformUrl.hostname.startsWith("api.")) {
+		platformUrl.hostname = platformUrl.hostname.replace(/^api\./, "console.");
+		return normalizeBaseUrl(platformUrl.toString());
+	}
+	return defaultConsoleBaseUrl;
+}
+function getConsoleBaseUrl(config = {}) {
+	if (config.consoleUrl) return normalizeBaseUrl(config.consoleUrl);
+	if (config.platformUrl) {
+		const inferredUrl = inferConsoleBaseUrl(config.platformUrl);
+		if (inferredUrl !== "https://console.tailor.tech") return inferredUrl;
+	}
+	if (process.env.TAILOR_PLATFORM_CONSOLE_URL) return normalizeBaseUrl(process.env.TAILOR_PLATFORM_CONSOLE_URL);
+	return inferConsoleBaseUrl(getPlatformBaseUrl(config));
+}
+/**
+* Initialize an OAuth2 client for Tailor Platform.
+* @param config - Optional platform connection settings
+* @returns Configured OAuth2 client
+*/
+function initOAuth2Client(config) {
+	return new OAuth2Client({
+		clientId: getOAuth2ClientId(config),
+		server: getPlatformBaseUrl(config),
+		discoveryEndpoint: oauth2DiscoveryEndpoint
+	});
+}
+/**
+* Initialize an Operator client with the given access token.
+* @param accessToken - Access token for authentication
+* @param config - Optional platform connection settings
+* @returns Configured Operator client
+*/
+async function initOperatorClient(accessToken, config) {
+	const platformConfig = config ?? getPlatformConfigForToken(accessToken);
+	const [{ createTracingInterceptor }, { OperatorService }] = await Promise.all([import("./interceptor-e33JtsC-.mjs"), import("./service_pb-DjwIn4jO.mjs")]);
+	const interceptors = [
+		await userAgentInterceptor(),
+		await bearerTokenInterceptor(accessToken),
+		retryInterceptor(),
+		errorHandlingInterceptor(),
+		createTracingInterceptor(),
+		concurrencyLimitInterceptor()
+	];
+	return createClient(OperatorService, await createTransport(getPlatformBaseUrl(platformConfig), interceptors));
+}
+/**
+* Create a Connect transport using connect-node (HTTP/2).
+*
+* connect-node works on both Node.js and Bun. connect-web is not used because
+* it does not support client_streaming, which is required for function uploads.
+* @param baseUrl - Base URL for the transport
+* @param interceptors - Request interceptors
+* @returns Configured transport
+*/
+async function createTransport(baseUrl, interceptors) {
+	const { createConnectTransport } = await import("@connectrpc/connect-node");
+	return createConnectTransport({
+		httpVersion: "2",
+		baseUrl,
+		interceptors
+	});
+}
+/**
+* Create an interceptor that sets a User-Agent header.
+* @returns User-Agent interceptor
+*/
+async function userAgentInterceptor() {
+	const ua = await userAgent();
+	return (next) => async (req) => {
+		req.header.set("User-Agent", ua);
+		return await next(req);
+	};
+}
+/**
+* Create an interceptor that sets the Authorization bearer token.
+* @param accessToken - Access token to use
+* @returns Bearer token interceptor
+*/
+async function bearerTokenInterceptor(accessToken) {
+	return (next) => async (req) => {
+		req.header.set("Authorization", `Bearer ${accessToken}`);
+		return await next(req);
+	};
+}
+/**
+* Create an interceptor that retries failed unary requests with backoff.
+*
+* Retries any unary method on `Unavailable`/`ResourceExhausted`, and `Internal`
+* only for methods declared idempotent, up to 3 attempts (despite the historical
+* "idempotent" naming, the first two codes are retried regardless of idempotency).
+* As a targeted exception for the deploy/apply flow, a post-retry `AlreadyExists`
+* from an allowlisted Create (see `RETRY_SAFE_CREATE_METHODS`) is treated as
+* success, since it means a prior attempt already committed the resource
+* server-side. A first-attempt `AlreadyExists` from such a Create still
+* surfaces, but is routed to crash/error reporting first (the top-level handler
+* skips `ConnectError`), so the otherwise-silent compound-create race is
+* trackable.
+* @internal
+* @returns Retry interceptor
+*/
+function retryInterceptor() {
+	return (next) => async (req) => {
+		if (req.stream) return await next(req);
+		let lastError;
+		for (let i = 0; i < 3; i++) {
+			if (i > 0) await waitRetryBackoff(i);
+			try {
+				return await next(req);
+			} catch (error) {
+				if (isRetrySafeCreateAlreadyExists(error, req.method.name)) {
+					if (i > 0) {
+						logger.debug(`retry: ${req.method.name} returned AlreadyExists on attempt ${i + 1}; treating as success (prior attempt likely committed)`);
+						return synthesizeEmptyUnaryResponse(req);
+					}
+					const { reportCrash } = await import("./crashreport-D3RjuSYb.mjs");
+					await reportCrash(error, "handledError");
+				}
+				if (isRetirable(error, req.method.idempotency)) {
+					lastError = error;
+					logger.debug(`retry: ${req.method.name} attempt ${i + 1} failed with ${connectCodeName(error)}; retrying`);
+					continue;
+				}
+				throw error;
+			}
+		}
+		throw lastError;
+	};
+}
+/**
+* Create an interceptor that caps the number of concurrent unary RPCs.
+*
+* A fresh-workspace apply fires one `create*` per resource at once; left
+* unbounded, the platform sheds load as `Unavailable`/`ResourceExhausted`,
+* which drives retries into the non-idempotent compound-create `already_exists`
+* race (#1350). One shared limiter per client bounds total in-flight calls
+* across every deploy resource, not just a single call site. Streaming RPCs
+* (e.g. function uploads) are not gated.
+* @internal
+* @returns Concurrency-limiting interceptor
+*/
+function concurrencyLimitInterceptor() {
+	const limit = createApplyLimiter();
+	return (next) => async (req) => {
+		if (req.stream) return await next(req);
+		return await limit(() => next(req));
+	};
+}
+/**
+* Human-readable name for the Connect status code of an error, for diagnostics.
+* @param error - Error thrown by a request (expected to be a ConnectError)
+* @returns The Code name (e.g., "Unavailable"), or "unknown" for non-ConnectError
+*/
+function connectCodeName(error) {
+	return error instanceof ConnectError ? Code[error.code] : "unknown";
+}
+/**
+* Create RPCs for which a post-retry `AlreadyExists` may be treated as success.
+*
+* Membership is deliberately an allowlist, not `startsWith("Create")`: swallowing
+* synthesizes an empty response (see `synthesizeEmptyUnaryResponse`), which is only
+* safe when every caller ignores the response body. These are the deploy/apply
+* resource creations that fire under heavy parallelism and discard their response.
+*
+* Intentionally excluded because their callers read the response body — swallowing
+* would hand back an empty message and corrupt downstream state:
+* - `CreateIdPClient` (uses `resp.client.clientSecret` to seed the secret vault)
+* - `CreateWorkflowJobFunction` (uses `response.jobFunction.version`)
+* - `CreateWorkspace` / `CreatePersonalAccessToken` / `CreateDeployment` /
+*   `CreateOrganizationFolder` (interactive commands that return created data)
+*
+* `CreateFunctionRegistry` is client-streaming and never reaches this path
+* (streaming requests bypass the retry loop entirely).
+*
+* An allowlist miss is safe: the resource simply loses race protection and an
+* `already_exists` surfaces loudly, as before — never a silent empty response.
+*
+* A drift guard (see client.test.ts) fails CI if any `client.create*` used in the
+* deploy flow is neither listed here nor explicitly classified as response-consuming,
+* so a newly added apply create cannot silently miss this list.
+* @internal
+*/
+const RETRY_SAFE_CREATE_METHODS = /* @__PURE__ */ new Set([
+	"CreateAIGateway",
+	"CreateApplication",
+	"CreateAuthConnection",
+	"CreateAuthHook",
+	"CreateAuthIDPConfig",
+	"CreateAuthMachineUser",
+	"CreateAuthOAuth2Client",
+	"CreateAuthSCIMConfig",
+	"CreateAuthSCIMResource",
+	"CreateAuthService",
+	"CreateExecutorExecutor",
+	"CreateIdPService",
+	"CreatePipelineResolver",
+	"CreatePipelineService",
+	"CreateSecretManagerSecret",
+	"CreateSecretManagerVault",
+	"CreateStaticWebsite",
+	"CreateTailorDBGQLPermission",
+	"CreateTailorDBService",
+	"CreateTailorDBType",
+	"CreateTenantConfig",
+	"CreateUserProfileConfig",
+	"CreateWorkflow"
+]);
+/**
+* Whether an error is an `AlreadyExists` from a retry-safe Create RPC.
+*
+* Only `AlreadyExists` stands in for "my prior write already landed"; for other
+* verbs/codes it would be a real conflict that must surface.
+* @param error - Error thrown by the request
+* @param methodName - RPC method name (e.g., "CreateTailorDBType")
+* @returns True if the error is an `AlreadyExists` from a retry-safe Create method
+*/
+function isRetrySafeCreateAlreadyExists(error, methodName) {
+	return error instanceof ConnectError && error.code === Code.AlreadyExists && RETRY_SAFE_CREATE_METHODS.has(methodName);
+}
+/**
+* Build a default (empty) unary response for the request's output message.
+*
+* Used when a retried Create is determined to have already succeeded on a prior
+* attempt: callers in the deploy pipeline ignore Create response bodies, so an
+* empty message faithfully represents the already-applied state.
+* @param req - Unary request whose output schema is used
+* @returns A synthesized unary response with an empty output message
+*/
+function synthesizeEmptyUnaryResponse(req) {
+	return {
+		stream: false,
+		service: req.service,
+		method: req.method,
+		header: new Headers(),
+		message: create(req.method.output),
+		trailer: new Headers()
+	};
+}
+/**
+* Base delay (ms) for the first retry. Subsequent attempts double it.
+*
+* Kept relatively large so a retry does not immediately race an original request
+* that is still settling server-side under load (e.g. a compound create whose
+* response was lost), which is what triggers the `already_exists` race.
+*/
+const RETRY_BASE_DELAY_MS = 500;
+/**
+* Wait for an exponential backoff delay with jitter.
+* @param attempt - Current retry attempt number (1-based)
+* @returns Promise that resolves after the delay
+*/
+function waitRetryBackoff(attempt) {
+	const backoff = RETRY_BASE_DELAY_MS * 2 ** (attempt - 1) * (1 + .1 * (Math.random() * 2 - 1));
+	return new Promise((resolve) => setTimeout(resolve, backoff));
+}
+/**
+* Determine whether the given error is retriable for the method idempotency.
+* @param error - Error thrown by the request
+* @param idempotency - Method idempotency level
+* @returns True if the error should be retried
+*/
+function isRetirable(error, idempotency) {
+	if (!(error instanceof ConnectError)) return false;
+	switch (error.code) {
+		case Code.ResourceExhausted:
+		case Code.Unavailable: return true;
+		case Code.Internal: return idempotency === MethodOptions_IdempotencyLevel.NO_SIDE_EFFECTS || idempotency === MethodOptions_IdempotencyLevel.IDEMPOTENT;
+		default: return false;
+	}
+}
+/**
+* Create an interceptor that enhances error messages from the Operator API.
+* @returns Error handling interceptor
+*/
+function errorHandlingInterceptor() {
+	return (next) => async (req) => {
+		try {
+			return await next(req);
+		} catch (error) {
+			if (error instanceof ConnectError) {
+				const { operation, resourceType } = parseMethodName(req.method.name);
+				const requestParams = formatRequestParams(req.message);
+				throw new ConnectError(`Failed to ${operation} ${resourceType}: ${error.rawMessage}\nRequest: ${requestParams}`, error.code, error.metadata);
+			}
+			throw error;
+		}
+	};
+}
+/**
+* @internal
+* @param methodName - RPC method name (e.g., "CreateWorkspace")
+* @returns Parsed operation and resource type
+*/
+function parseMethodName(methodName) {
+	const match = methodName.match(/^(Create|Update|Delete|Set|List|Get)(.+)$/);
+	if (!match) return {
+		operation: "perform",
+		resourceType: "resource"
+	};
+	const [, action, resource] = match;
+	return {
+		operation: action.toLowerCase(),
+		resourceType: resource
+	};
+}
+/**
+* JSON.stringify replacer that converts BigInt values to strings.
+* @param _key - Object key (unused)
+* @param value - Value to serialize
+* @returns Serializable value
+*/
+function bigIntReplacer(_key, value) {
+	if (typeof value === "bigint") return value.toString();
+	return value;
+}
+/**
+* @internal
+* @param message - Request message to format
+* @returns Pretty-printed JSON or error placeholder
+*/
+function formatRequestParams(message) {
+	try {
+		if (message && typeof message === "object" && "toJson" in message) return JSON.stringify(message.toJson(), bigIntReplacer, 2);
+		return JSON.stringify(message, bigIntReplacer, 2);
+	} catch {
+		return "(unable to serialize request)";
+	}
+}
+const MAX_PAGE_SIZE = 1e3;
+/**
+* Fetch all paginated resources by repeatedly calling the given function.
+* @template T
+* @param fn - Page fetcher returning items and next page token
+* @returns All fetched items
+*/
+async function fetchAll(fn) {
+	const items = [];
+	let pageToken = "";
+	while (true) {
+		const [batch, nextPageToken] = await fn(pageToken, MAX_PAGE_SIZE);
+		items.push(...batch);
+		if (!nextPageToken) break;
+		pageToken = nextPageToken;
+	}
+	return items;
+}
+/**
+* @internal
+* @param error - Error value to inspect
+* @returns Whether the error is a Connect NotFound error
+*/
+function isNotFoundError(error) {
+	return error instanceof ConnectError && error.code === Code.NotFound;
+}
+/**
+* Fetch all paginated resources, treating an absent resource group as empty.
+* @template T
+* @param fn - Page fetcher returning items and next page token
+* @returns Items fetched before pagination completes or the fetcher raises NotFound
+*/
+async function fetchAllTolerant(fn) {
+	return await fetchAll(async (pageToken, maxPageSize) => {
+		try {
+			return await fn(pageToken, maxPageSize);
+		} catch (error) {
+			if (isNotFoundError(error)) return [[], ""];
+			throw error;
+		}
+	});
+}
+/**
+* Fetch a single resource, treating NotFound as an absent value.
+* @template T
+* @param fn - Resource getter
+* @returns Fetched resource, or undefined when the getter raises NotFound
+*/
+async function getOrNull(fn) {
+	try {
+		return await fn();
+	} catch (error) {
+		if (isNotFoundError(error)) return;
+		throw error;
+	}
+}
+/**
+* Fetch paginated resources with an optional upper bound on the number of
+* items returned. When `limit` is 0 or undefined the function behaves
+* like `fetchAll` and returns every page. When `limit` is positive the
+* function stops once enough items are collected, requesting smaller
+* pages as it approaches the boundary.
+* @template T
+* @param fn - Page fetcher returning items and next page token
+* @param options - Pagination options
+* @returns Fetched items (length <= limit when limit > 0)
+*/
+async function fetchPaged(fn, options) {
+	const limit = options?.limit;
+	const unbounded = limit === void 0 || limit === 0;
+	const items = [];
+	let pageToken = "";
+	while (true) {
+		const pageSize = unbounded ? MAX_PAGE_SIZE : Math.min(limit - items.length, MAX_PAGE_SIZE);
+		if (!unbounded && pageSize <= 0) break;
+		const [batch, nextPageToken] = await fn(pageToken, pageSize);
+		items.push(...batch);
+		if (!unbounded && items.length >= limit) break;
+		if (!nextPageToken) break;
+		pageToken = nextPageToken;
+	}
+	if (!unbounded && items.length > limit) return items.slice(0, limit);
+	return items;
+}
+/**
+* Fetch user info from the Tailor Platform userinfo endpoint.
+* @param accessToken - Access token for the current user
+* @param config - Optional platform connection settings
+* @returns Parsed user info
+*/
+async function fetchUserInfo(accessToken, config) {
+	const userInfoUrl = new URL("/auth/platform/userinfo", getPlatformBaseUrl(config)).href;
+	const resp = await fetch(userInfoUrl, { headers: {
+		Authorization: `Bearer ${accessToken}`,
+		"User-Agent": await userAgent()
+	} });
+	if (!resp.ok) throw new Error(`Failed to fetch user info: ${resp.statusText}`);
+	const rawJson = await resp.json();
+	return z.object({
+		sub: z.string(),
+		email: z.string()
+	}).parse(rawJson);
+}
+/**
+* Resolve "name:url" patterns to actual Static Website URLs.
+* @param client - Operator client instance
+* @param workspaceId - Workspace ID
+* @param urls - URLs or name:url patterns
+* @param context - Logging context (e.g., "CORS", "OAuth2 redirect URIs")
+* @param options - Optional behavior overrides
+* @returns Resolved URLs (or the original pattern for entries marked as
+*   expected-but-not-yet-deployed via `options.expectedLocalNames`)
+*/
+async function resolveStaticWebsiteUrls(client, workspaceId, urls, context, options = {}) {
+	if (!urls) return [];
+	const { expectedLocalNames } = options;
+	return (await Promise.all(urls.map(async (url) => {
+		const match = url.match(/:url(\/.*)?$/);
+		if (match && match.index !== void 0) {
+			const siteName = url.substring(0, match.index);
+			const pathSuffix = match[1] || "";
+			try {
+				const response = await client.getStaticWebsite({
+					workspaceId,
+					name: siteName
+				});
+				if (response.staticwebsite?.url) return [response.staticwebsite.url + pathSuffix];
+				logger.warn(`Static website "${siteName}" has no URL assigned yet. Excluding from ${context}.`);
+				return [];
+			} catch (error) {
+				if (isNotFoundError(error) && expectedLocalNames?.has(siteName)) return [url];
+				logger.warn(`Static website "${siteName}" not found for ${context} configuration. Excluding from ${context}.`);
+				return [];
+			}
+		}
+		return [url];
+	}))).flat();
+}
+/**
+* Fetch an OAuth2 access token for a machine user.
+* @param url - OAuth2 server base URL
+* @param clientId - Client ID for the machine user
+* @param clientSecret - Client secret for the machine user
+* @returns Access token
+*/
+async function fetchMachineUserToken(url, clientId, clientSecret) {
+	const tokenEndpoint = new URL("/oauth2/token", url).href;
+	const formData = new URLSearchParams();
+	formData.append("grant_type", "client_credentials");
+	formData.append("client_id", clientId);
+	formData.append("client_secret", clientSecret);
+	const resp = await fetch(tokenEndpoint, {
+		method: "POST",
+		headers: {
+			"User-Agent": await userAgent(),
+			"Content-Type": "application/x-www-form-urlencoded"
+		},
+		body: formData
+	});
+	if (!resp.ok) {
+		const body = await resp.text().catch(() => "");
+		throw new Error(`Failed to fetch machine user token: ${resp.status} ${resp.statusText} ${body.slice(0, 500)}`);
+	}
+	const rawJson = await resp.json();
+	return z.object({
+		token_type: z.string(),
+		access_token: z.string(),
+		expires_in: z.number()
+	}).parse(rawJson);
+}
+/**
+* Fetch an OAuth2 token for a platform machine user via client_credentials grant.
+* @param clientId - Client ID for the platform machine user
+* @param clientSecret - Client secret for the platform machine user
+* @param config - Optional platform connection settings
+* @returns OAuth2 token
+*/
+async function fetchPlatformMachineUserToken(clientId, clientSecret, config) {
+	return await new OAuth2Client({
+		clientId,
+		clientSecret,
+		server: getPlatformBaseUrl(config),
+		discoveryEndpoint: oauth2DiscoveryEndpoint
+	}).clientCredentials();
+}
+/**
+* Close undici's global HTTP connection pool to prevent libuv UV_HANDLE_CLOSING
+* assertion failure on Windows at process exit (Node.js 23.x+).
+* See: https://github.com/nodejs/node/issues/56645
+*/
+async function closeConnectionPool() {
+	await getGlobalDispatcher().close();
+}
+
 //#endregion
 //#region src/cli/shared/token-store.ts
 const SERVICE_NAME = "tailor-platform-cli";
@@ -170,7 +802,10 @@ const pfProfileSchema = z.object({
 	workspace_id: z.string(),
 	readonly: z.boolean().optional(),
 	machine_user: z.string().optional(),
-	machine_user_override: z.enum(["allow", "deny"]).optional()
+	machine_user_override: z.enum(["allow", "deny"]).optional(),
+	platform_url: z.url().optional(),
+	oauth2_client_id: z.string().optional(),
+	console_url: z.url().optional()
 });
 const pfUserSchemaV1 = z.object({
 	access_token: z.string(),
@@ -231,6 +866,114 @@ function platformConfigPath() {
 	return path.join(xdgConfig, "tailor-platform", "config.yaml");
 }
 /**
+* Convert stored profile platform fields to platform client settings.
+* @param profile - Profile platform settings
+* @returns Platform client settings
+*/
+function platformConfigFromProfile(profile) {
+	const config = {
+		...profile?.platform_url ? { platformUrl: profile.platform_url } : {},
+		...profile?.oauth2_client_id ? { oauth2ClientId: profile.oauth2_client_id } : {},
+		...profile?.console_url ? { consoleUrl: profile.console_url } : {}
+	};
+	return Object.keys(config).length > 0 ? config : void 0;
+}
+function platformUserKey(user, config) {
+	const platformUrl = getPlatformBaseUrl(config);
+	if (platformUrl === normalizeBaseUrl("https://api.tailor.tech")) return user;
+	return `${platformUrl}|${user}`;
+}
+function userFromPlatformUserKey(userKey, config) {
+	const platformPrefix = `${getPlatformBaseUrl(config)}|`;
+	return userKey.startsWith(platformPrefix) ? userKey.slice(platformPrefix.length) : userKey;
+}
+function canUseLegacyUserKey(platformUrl) {
+	try {
+		return getPlatformBaseUrl() === platformUrl;
+	} catch {
+		return false;
+	}
+}
+function findUserByEmail(users, email, platformConfig) {
+	const platformUrl = getPlatformBaseUrl(platformConfig);
+	const platformPrefix = `${platformUrl}|`;
+	const defaultPlatform = platformUrl === normalizeBaseUrl(defaultPlatformBaseUrl);
+	return Object.entries(users).find(([key, entry]) => {
+		if (entry?.email !== email) return false;
+		return defaultPlatform ? !key.includes("|") : key.startsWith(platformPrefix);
+	});
+}
+function findUserEntry(config, user, platformConfig, opts = {}) {
+	const userKey = platformUserKey(user, platformConfig);
+	const userEntry = config.users[userKey];
+	if (userEntry) return {
+		userKey,
+		userEntry
+	};
+	const emailMatch = findUserByEmail(config.users, user, platformConfig);
+	if (emailMatch?.[1]) return {
+		userKey: emailMatch[0],
+		userEntry: emailMatch[1]
+	};
+	const platformUrl = getPlatformBaseUrl(platformConfig);
+	if (userKey !== user && (opts.allowLegacyUserKey === false || !canUseLegacyUserKey(platformUrl))) return {
+		userKey,
+		userEntry
+	};
+	const legacyEntry = config.users[user];
+	return legacyEntry ? {
+		userKey: user,
+		userEntry: legacyEntry
+	} : {
+		userKey,
+		userEntry
+	};
+}
+/**
+* Resolve the config user key that would be used for a user on the selected platform.
+* @param config - Platform config
+* @param user - User name
+* @param platformConfig - Optional platform connection settings
+* @param opts - Token lookup options
+* @returns Resolved config user key
+*/
+function resolveUserTokenKey(config, user, platformConfig, opts) {
+	return findUserEntry(config, user, platformConfig, opts).userKey;
+}
+function resolveConfigUser(config, user, platformConfig, opts) {
+	const { userKey, userEntry } = findUserEntry(config, user, platformConfig, opts);
+	return userEntry ? userFromPlatformUserKey(userKey, platformConfig) : void 0;
+}
+/**
+* Check whether tokens are registered for a user on the selected platform.
+* @param config - Platform config
+* @param user - User name
+* @param platformConfig - Optional platform connection settings
+* @param opts - Token lookup options
+* @returns True when the user has a registered token entry
+*/
+function hasUserTokenEntry(config, user, platformConfig, opts) {
+	return findUserEntry(config, user, platformConfig, opts).userEntry !== void 0;
+}
+function hasUserKeyForName(users, user) {
+	return users[user] !== void 0 || Object.keys(users).some((key) => key.endsWith(`|${user}`));
+}
+function hasUserEmailEntry(users, user) {
+	return Object.values(users).some((entry) => entry?.email === user);
+}
+/**
+* Check whether any platform has tokens registered for a user.
+* @param config - Platform config
+* @param user - User name
+* @returns True when the user has a token entry for any platform
+*/
+function hasAnyUserTokenEntry(config, user) {
+	return hasUserKeyForName(config.users, user) || hasUserEmailEntry(config.users, user);
+}
+function hasCurrentUserEntry(users, currentUser) {
+	return hasUserKeyForName(users, currentUser);
+}
+/**
 * Migrate a v1 config to v2.
 * Tokens are kept in the config file (storage: "file") during migration.
 * They will be moved to the OS keyring on next login or token refresh.
@@ -259,10 +1002,6 @@ function migrateV1ToV2(v1Config) {
 function inferEmailFromUserId(user) {
 	return z.email().safeParse(user).success ? user : void 0;
 }
-function findConfigUserKey(config, user) {
-	if (config.users[user]) return user;
-	return Object.entries(config.users).find(([, entry]) => entry?.email === user)?.[0];
-}
 function migrateV2ToV3(v2Config) {
 	const users = {};
 	for (const [user, entry] of Object.entries(v2Config.users)) {
@@ -284,6 +1023,19 @@ function migrateV2ToV3(v2Config) {
 function migrateV1ToV3(v1Config) {
 	return migrateV2ToV3(migrateV1ToV2(v1Config));
 }
+function formatUnknownError(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+async function trySaveTokensInKeyring(user, tokens) {
+	if (!await isKeyringAvailable()) return false;
+	try {
+		await saveKeyringTokens(user, tokens);
+		return true;
+	} catch (error) {
+		logger.warn(`System keyring failed to store credentials. Tokens will be stored in the config file. ${formatUnknownError(error)}`);
+		return false;
+	}
+}
 async function warnIfNewerConfigAvailable(config) {
 	if (!config.latest_min_sdk_version) return;
 	if (lt((await readPackageJson()).version ?? "0.0.0", config.latest_min_sdk_version)) logger.warn(multiline`
@@ -292,22 +1044,21 @@ async function warnIfNewerConfigAvailable(config) {
     `);
 }
 /**
-* Read Tailor Platform CLI configuration, migrating from tailorctl or v1 if necessary.
+* Read Tailor Platform CLI configuration, migrating from v1 if necessary.
 * @returns Parsed platform configuration
 */
 async function readPlatformConfig() {
 	const configPath = platformConfigPath();
 	if (!fs$1.existsSync(configPath)) {
-		logger.warn(`Config not found at ${configPath}, migrating from tailorctl config...`);
-		const tcConfig = readTailorctlConfig();
-		const v1Config = tcConfig ? fromTailorctlConfig(tcConfig) : {
-			version: 1,
+		const config = {
+			version: LATEST_CONFIG_VERSION,
+			min_sdk_version: V3_MIN_SDK_VERSION,
 			users: {},
 			profiles: {},
 			current_user: null
 		};
-		writePlatformConfig(v1Config);
-		return migrateV1ToV3(v1Config);
+		writePlatformConfig(config);
+		return config;
 	}
 	const rawConfig = parseYAML(fs$1.readFileSync(configPath, "utf-8"));
 	tightenSecretFilePermissions(configPath);
@@ -347,7 +1098,7 @@ function toV1ForDisk(config) {
 			token_expires_at: entry.token_expires_at
 		};
 	}
-	const currentUser = config.current_user && users[config.current_user] ? config.current_user : null;
+	const currentUser = config.current_user && hasCurrentUserEntry(users, config.current_user) ? config.current_user : null;
 	return {
 		version: 1,
 		users,
@@ -355,15 +1106,31 @@ function toV1ForDisk(config) {
 		current_user: currentUser
 	};
 }
+function hasProfilePlatformSettings(config) {
+	return Object.values(config.profiles).some((profile) => profile?.platform_url !== void 0 || profile?.oauth2_client_id !== void 0 || profile?.console_url !== void 0);
+}
+function hasScopedUserKeys(config) {
+	return Object.keys(config.users).some((userKey) => userKey.includes("|"));
+}
+function hasUserEmailMetadata(config) {
+	return Object.values(config.users).some((user) => user != null && "email" in user && user.email !== void 0);
+}
+function toLatestForDisk(config) {
+	return {
+		...config.version === 1 ? migrateV1ToV2(config) : config,
+		version: LATEST_CONFIG_VERSION,
+		min_sdk_version: V3_MIN_SDK_VERSION
+	};
+}
 /**
 * Write Tailor Platform CLI configuration to disk.
-* By default, V2 configs are converted to V1 for backward compatibility, so an
-* older SDK can still read the file. Configs containing a keyring user are kept
-* as V2 regardless, because the keyring storage variant is not representable in
-* V1 and downgrading it would silently drop the user's login. V3 configs are
-* kept as V3 because user keys are canonical subject IDs and may include email
-* metadata that is not representable in older versions.
-* Set TAILOR_USE_KEYRING to write V2 format unconditionally.
+* By default, file-backed configs without newer fields are converted to V1 for
+* backward compatibility, so an older SDK can still read the file. Configs
+* containing a keyring user are kept in V2 or later because the keyring storage
+* variant is not representable in V1. Configs containing profile-level Platform
+* settings, platform-scoped user tokens, canonical user IDs, or email metadata
+* are written in the latest min-SDK-gated format because older SDKs would
+* silently drop or misread those settings.
 *
 * The config file may contain access/refresh tokens when the OS keyring is
 * unavailable, so it is written via {@link writeSecretFile} so other users
@@ -372,50 +1139,8 @@ function toV1ForDisk(config) {
 */
 function writePlatformConfig(config) {
 	const configPath = platformConfigPath();
-	const hasKeyringUser = config.version === 2 && Object.values(config.users).some((u) => u?.storage === "keyring");
-	writeSecretFile(configPath, stringifyYAML(config.version === 2 && !process.env.TAILOR_USE_KEYRING && !hasKeyringUser ? toV1ForDisk(config) : config));
-}
-const tcContextConfigSchema = z.object({
-	username: z.string().optional(),
-	controlplaneaccesstoken: z.string().optional(),
-	controlplanerefreshtoken: z.string().optional(),
-	controlplanetokenexpiresat: z.string().optional(),
-	workspaceid: z.string().optional()
-});
-const tcConfigSchema = z.object({ global: z.object({ context: z.string().optional() }).optional() }).catchall(tcContextConfigSchema.optional());
-function readTailorctlConfig() {
-	const configPath = path.join(os.homedir(), ".tailorctl", "config");
-	if (!fs$1.existsSync(configPath)) return;
-	const rawConfig = parseTOML(fs$1.readFileSync(configPath, "utf-8"));
-	return tcConfigSchema.parse(rawConfig);
-}
-function fromTailorctlConfig(config) {
-	const users = {};
-	const profiles = {};
-	let currentUser = null;
-	const currentContext = config.global?.context || "default";
-	for (const [key, val] of Object.entries(config)) {
-		if (key === "global") continue;
-		const context = val;
-		if (!context.username || !context.controlplaneaccesstoken || !context.controlplanerefreshtoken || !context.controlplanetokenexpiresat || !context.workspaceid) continue;
-		if (key === currentContext) currentUser = context.username;
-		profiles[key] = {
-			user: context.username,
-			workspace_id: context.workspaceid
-		};
-		const user = users[context.username];
-		if (!user || new Date(user.token_expires_at) < new Date(context.controlplanetokenexpiresat)) users[context.username] = {
-			access_token: context.controlplaneaccesstoken,
-			refresh_token: context.controlplanerefreshtoken,
-			token_expires_at: context.controlplanetokenexpiresat
-		};
-	}
-	return {
-		version: 1,
-		users,
-		profiles,
-		current_user: currentUser
-	};
+	const hasKeyringUser = config.version !== 1 && Object.values(config.users).some((u) => u?.storage === "keyring");
+	writeSecretFile(configPath, stringifyYAML(config.version === LATEST_CONFIG_VERSION || hasProfilePlatformSettings(config) || hasScopedUserKeys(config) || hasUserEmailMetadata(config) ? toLatestForDisk(config) : config.version === V2_CONFIG_VERSION && !hasKeyringUser ? toV1ForDisk(config) : config));
 }
 function validateUUID(value, source) {
 	const result = z.uuid().safeParse(value);
@@ -430,9 +1155,9 @@ function validateUUID(value, source) {
 * @returns Resolved workspace ID
 */
 async function loadWorkspaceId(opts) {
+	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
 	if (opts?.workspaceId) return validateUUID(opts.workspaceId, "--workspace-id option");
 	if (process.env.TAILOR_PLATFORM_WORKSPACE_ID) return validateUUID(process.env.TAILOR_PLATFORM_WORKSPACE_ID, "TAILOR_PLATFORM_WORKSPACE_ID environment variable");
-	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
 	if (profile) {
 		const wsId = (await readPlatformConfig()).profiles[profile]?.workspace_id;
 		if (!wsId) throw new Error(`Profile "${profile}" not found`);
@@ -471,7 +1196,7 @@ async function loadMachineUserName(opts) {
 			code: "PROFILE_MACHINE_USER_OVERRIDE_DENIED",
 			message: `Profile "${profile}" denies overriding the machine user.`,
 			details: `This profile fixes the machine user to "${entry.machine_user}" for application-data commands.`,
-			suggestion: `Omit the machine user option, unset TAILOR_PLATFORM_MACHINE_USER_NAME, or run 'tailor-sdk profile update ${profile} --machine-user-override allow'.`
+			suggestion: `Omit the machine user option, unset TAILOR_PLATFORM_MACHINE_USER_NAME, or run 'tailor profile update ${profile} --machine-user-override allow'.`
 		});
 		return entry.machine_user;
 	}
@@ -485,40 +1210,69 @@ async function loadMachineUserName(opts) {
 * @returns Resolved access token
 */
 async function loadAccessToken(opts) {
-	if (process.env.TAILOR_PLATFORM_TOKEN) return process.env.TAILOR_PLATFORM_TOKEN;
-	if (process.env.TAILOR_TOKEN) {
-		logger.warn("TAILOR_TOKEN is deprecated. Please use TAILOR_PLATFORM_TOKEN instead.");
-		return process.env.TAILOR_TOKEN;
+	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
+	const envToken = process.env.TAILOR_PLATFORM_TOKEN ?? process.env.TAILOR_TOKEN;
+	if (envToken && !process.env.TAILOR_PLATFORM_TOKEN) logger.warn("TAILOR_TOKEN is deprecated. Please use TAILOR_PLATFORM_TOKEN instead.");
+	if (envToken) {
+		rememberPlatformConfigForToken(envToken, await loadPlatformClientConfig({
+			profile,
+			allowMissingProfile: true
+		}));
+		return envToken;
 	}
 	const pfConfig = await readPlatformConfig();
-	let user;
+	const profileEntry = profile ? pfConfig.profiles[profile] : void 0;
+	if (profile && !profileEntry) throw new Error(`Profile "${profile}" not found`);
+	const user = profileEntry?.user ?? pfConfig.current_user;
+	if (!user) throw new Error(multiline`
+      Tailor Platform token not found.
+      Please specify token via TAILOR_PLATFORM_TOKEN environment variable or login using 'tailor login' command.
+    `);
+	return (await fetchLatestToken(pfConfig, user, profileEntry ? platformConfigFromProfile(profileEntry) : void 0)).accessToken;
+}
+/**
+* Load platform connection settings from the active profile.
+* @param opts - Profile options
+* @returns Resolved platform connection settings, or undefined for the default environment
+*/
+async function loadPlatformClientConfig(opts) {
 	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
-	if (profile) {
-		const u = pfConfig.profiles[profile]?.user;
-		if (!u) throw new Error(`Profile "${profile}" not found`);
-		user = u;
-	} else {
-		const u = pfConfig.current_user;
-		if (!u) throw new Error(multiline`
-        Tailor Platform token not found.
-        Please specify token via TAILOR_PLATFORM_TOKEN environment variable or login using 'tailor-sdk login' command.
-      `);
-		user = u;
+	if (!profile) return;
+	let pfConfig;
+	try {
+		pfConfig = await readPlatformConfig();
+	} catch (error) {
+		if (opts?.allowMissingProfile) return;
+		throw error;
 	}
-	return (await fetchLatestToken(pfConfig, user)).accessToken;
+	const profileEntry = pfConfig.profiles[profile];
+	if (!profileEntry) {
+		if (opts?.allowMissingProfile) return;
+		throw new Error(`Profile "${profile}" not found`);
+	}
+	return platformConfigFromProfile(profileEntry);
+}
+/**
+* Load the Tailor Platform Console base URL from environment variables or the active profile.
+* @param opts - Profile options
+* @returns Resolved Console base URL
+*/
+async function loadConsoleBaseUrl(opts) {
+	return getConsoleBaseUrl(await loadPlatformClientConfig(opts));
 }
 /**
 * Resolve the actual token values for a user, reading from keyring or config as appropriate.
 * @param userEntry - User entry from the config
 * @param user - User identifier
+* @param label - User-facing identifier used in error messages
 * @returns Access token and optional refresh token
 */
-async function resolveTokens(userEntry, user) {
+async function resolveTokens(userEntry, user, label = user) {
 	if (userEntry.storage === "keyring") {
 		const tokens = await loadKeyringTokens(user);
 		if (!tokens) throw new Error(multiline`
-        Credentials not found in OS keyring for "${user}".
-        Please run 'tailor-sdk login' and try again.
+        Credentials not found in OS keyring for "${label}".
+        Please run 'tailor login' and try again.
       `);
 		return tokens;
 	}
@@ -528,39 +1282,61 @@ async function resolveTokens(userEntry, user) {
 	};
 }
 /**
-* Save tokens for a user, writing to keyring or config as appropriate.
+* Save tokens for a user, writing to keyring by default when available.
 * @param config - Platform config
 * @param user - User identifier
 * @param tokens - Token data to save
 * @param tokens.accessToken - Access token to save
 * @param tokens.refreshToken - Optional refresh token to save
 * @param expiresAt - Token expiration date
-* @param metadata - Optional user metadata to persist with the token entry
+* @param opts - Optional platform and user metadata
 */
-async function saveUserTokens(config, user, tokens, expiresAt, metadata) {
-	const email = metadata?.email ?? config.users[user]?.email;
-	if (process.env.TAILOR_USE_KEYRING && await isKeyringAvailable()) {
-		await saveKeyringTokens(user, tokens);
-		config.users[user] = {
-			token_expires_at: expiresAt,
-			storage: "keyring",
-			...email ? { email } : {}
-		};
-	} else config.users[user] = {
-		access_token: tokens.accessToken,
-		refresh_token: tokens.refreshToken,
+async function saveUserTokens(config, user, tokens, expiresAt, opts = {}) {
+	const userKey = platformUserKey(user, opts.platformConfig);
+	const email = opts.email ?? config.users[userKey]?.email;
+	if (await trySaveTokensInKeyring(userKey, tokens)) config.users[userKey] = {
 		token_expires_at: expiresAt,
-		storage: "file",
+		storage: "keyring",
 		...email ? { email } : {}
 	};
+	else {
+		if (config.users[userKey]?.storage === "keyring") await deleteKeyringTokens(userKey);
+		config.users[userKey] = {
+			access_token: tokens.accessToken,
+			refresh_token: tokens.refreshToken,
+			token_expires_at: expiresAt,
+			storage: "file",
+			...email ? { email } : {}
+		};
+	}
 }
 /**
 * Delete tokens for a user from keyring if applicable.
 * @param config - Platform config
 * @param user - User identifier
+* @param platformConfig - Optional platform connection settings
+* @param opts - Token lookup options
 */
-async function deleteUserTokens(config, user) {
-	if (config.users[user]?.storage === "keyring") await deleteKeyringTokens(user);
+async function deleteUserTokens(config, user, platformConfig, opts) {
+	const { userKey, userEntry } = findUserEntry(config, user, platformConfig, opts);
+	if (userEntry?.storage === "keyring") await deleteKeyringTokens(userKey);
+	delete config.users[userKey];
+}
+/**
+* Resolve stored tokens for a user on the selected platform.
+* @param config - Platform config
+* @param user - User name
+* @param platformConfig - Optional platform connection settings
+* @param opts - Token lookup options
+* @returns Stored user entry and token values, or undefined when the user is not logged in
+*/
+async function loadStoredUserTokens(config, user, platformConfig, opts) {
+	const { userKey, userEntry } = findUserEntry(config, user, platformConfig, opts);
+	if (!userEntry) return void 0;
+	return {
+		userEntry,
+		...await resolveTokens(userEntry, userKey, user)
+	};
 }
 function updateUserReferences(config, fromUser, toUser) {
 	if (fromUser === toUser) return;
@@ -572,12 +1348,18 @@ function updateUserReferences(config, fromUser, toUser) {
 * @param config - Platform config
 * @param legacyUser - Previous user key
 * @param canonicalUser - Canonical user key
+* @param platformConfig - Platform settings for scoped token storage
 */
-async function removeLegacyUserAlias(config, legacyUser, canonicalUser) {
+async function removeLegacyUserAlias(config, legacyUser, canonicalUser, platformConfig) {
 	if (legacyUser === canonicalUser) return;
 	updateUserReferences(config, legacyUser, canonicalUser);
-	await deleteUserTokens(config, legacyUser);
-	delete config.users[legacyUser];
+	const canonicalKey = platformUserKey(canonicalUser, platformConfig);
+	const legacyKeys = /* @__PURE__ */ new Set([legacyUser, platformUserKey(legacyUser, platformConfig)]);
+	for (const legacyKey of legacyKeys) {
+		if (legacyKey === canonicalKey) continue;
+		if (config.users[legacyKey]?.storage === "keyring") await deleteKeyringTokens(legacyKey);
+		delete config.users[legacyKey];
+	}
 }
 function shouldResolveSubjectOnRefresh(user, userEntry) {
 	return Boolean(userEntry.email || inferEmailFromUserId(user));
@@ -586,31 +1368,31 @@ function shouldResolveSubjectOnRefresh(user, userEntry) {
 * Fetch the latest access token, refreshing if necessary.
 * @param config - Platform config
 * @param user - User identifier
+* @param platformConfig - Optional platform connection settings
 * @returns Latest access token and the canonical user ID it is stored under
 *   (the resolved subject when a legacy email key was migrated during refresh,
 *   otherwise the matching config user)
 */
-async function fetchLatestToken(config, user) {
-	const storedUser = findConfigUserKey(config, user);
-	if (!storedUser) throw new Error(multiline`
-      User "${user}" not found.
-      Please verify your user name and login using 'tailor-sdk login' command.
-    `);
-	const userEntry = config.users[storedUser];
+async function fetchLatestToken(config, user, platformConfig) {
+	const { userKey: storedUser, userEntry } = findUserEntry(config, user, platformConfig);
 	if (!userEntry) throw new Error(multiline`
       User "${user}" not found.
-      Please verify your user name and login using 'tailor-sdk login' command.
+      Please verify your user name and login using 'tailor login' command.
     `);
-	const tokens = await resolveTokens(userEntry, storedUser);
-	if (new Date(userEntry.token_expires_at) > /* @__PURE__ */ new Date()) return {
-		accessToken: tokens.accessToken,
-		user: storedUser
-	};
+	const storedConfigUser = userFromPlatformUserKey(storedUser, platformConfig);
+	const tokens = await resolveTokens(userEntry, storedUser, user);
+	if (new Date(userEntry.token_expires_at) > /* @__PURE__ */ new Date()) {
+		rememberPlatformConfigForToken(tokens.accessToken, platformConfig);
+		return {
+			accessToken: tokens.accessToken,
+			user: storedConfigUser
+		};
+	}
 	if (!tokens.refreshToken) throw new Error(multiline`
       Token expired.
-      Please run 'tailor-sdk login' and try again.
+      Please run 'tailor login' and try again.
     `);
-	const client = initOAuth2Client();
+	const client = initOAuth2Client(platformConfig);
 	let resp;
 	try {
 		resp = await client.refreshToken({
@@ -621,15 +1403,15 @@ async function fetchLatestToken(config, user) {
 	} catch {
 		throw new Error(multiline`
       Failed to refresh token. Your session may have expired.
-      Please run 'tailor-sdk login' and try again.
+      Please run 'tailor login' and try again.
     `);
 	}
 	const newExpiresAt = new Date(assertDefined(resp.expiresAt, "token refresh response missing expiresAt")).toISOString();
-	let resolvedUser = storedUser;
-	const previousEmail = userEntry.email ?? inferEmailFromUserId(storedUser);
+	let resolvedUser = storedConfigUser;
+	const previousEmail = userEntry.email ?? inferEmailFromUserId(user) ?? inferEmailFromUserId(storedConfigUser);
 	let email = previousEmail;
-	if (shouldResolveSubjectOnRefresh(storedUser, userEntry)) try {
-		const userInfo = await fetchUserInfo(resp.accessToken);
+	if (shouldResolveSubjectOnRefresh(user, userEntry) || shouldResolveSubjectOnRefresh(storedConfigUser, userEntry)) try {
+		const userInfo = await fetchUserInfo(resp.accessToken, platformConfig);
 		resolvedUser = userInfo.sub;
 		email = userInfo.email;
 	} catch (error) {
@@ -638,10 +1420,18 @@ async function fetchLatestToken(config, user) {
 	await saveUserTokens(config, resolvedUser, {
 		accessToken: resp.accessToken,
 		refreshToken: resp.refreshToken ?? void 0
-	}, newExpiresAt, { email });
-	await removeLegacyUserAlias(config, storedUser, resolvedUser);
+	}, newExpiresAt, {
+		platformConfig,
+		email
+	});
+	await removeLegacyUserAlias(config, user, resolvedUser, platformConfig);
+	if (storedUser !== platformUserKey(resolvedUser, platformConfig)) {
+		if (config.users[storedUser]?.storage === "keyring") await deleteKeyringTokens(storedUser);
+		delete config.users[storedUser];
+	}
 	if (previousEmail && email && previousEmail !== email) logger.info(`Updated local user email from "${previousEmail}" to "${email}".`);
 	writePlatformConfig(config);
+	rememberPlatformConfigForToken(resp.accessToken, platformConfig);
 	return {
 		accessToken: resp.accessToken,
 		user: resolvedUser
@@ -657,7 +1447,7 @@ const DEFAULT_CONFIG_FILENAME = "tailor.config.ts";
 */
 function loadConfigPath(configPath) {
 	if (configPath) return configPath;
-	if (process.env.TAILOR_PLATFORM_SDK_CONFIG_PATH) return process.env.TAILOR_PLATFORM_SDK_CONFIG_PATH;
+	if (process.env.TAILOR_CONFIG_PATH) return process.env.TAILOR_CONFIG_PATH;
 	return findUpSync(DEFAULT_CONFIG_FILENAME);
 }
 
@@ -767,9 +1557,9 @@ function hashFiles(filePaths) {
 //#region src/cli/shared/dist-dir.ts
 let distPath = null;
 const getDistDir = () => {
-	const configured = process.env.TAILOR_SDK_OUTPUT_DIR;
+	const configured = process.env.TAILOR_BUILD_OUTPUT_DIR;
 	if (configured && configured !== distPath) distPath = configured;
-	else if (distPath === null) distPath = configured || ".tailor-sdk";
+	else if (distPath === null) distPath = configured || ".tailor";
 	return distPath;
 };
 
@@ -806,8 +1596,8 @@ function createDepCollectorPlugin() {
 
 //#endregion
 //#region src/cli/cache/bundle-cache.ts
-function buildCacheKey(kind, name) {
-	return `${kind}:${name}`;
+function buildCacheKey(kind, name, namespace) {
+	return namespace ? `${kind}:${namespace}:${name}` : `${kind}:${name}`;
 }
 function combineHash(fileHash, contextHash) {
 	if (!contextHash) return fileHash;
@@ -834,10 +1624,11 @@ function computeBundlerContextHash(params) {
 * @returns The bundled code string
 */
 async function withCache(params) {
-	const { cache, kind, name, sourceFile, contextHash, build } = params;
+	const { cache, kind, namespace, name, sourceFile, contextHash, build } = params;
 	if (!cache) return await build([]);
 	const content = cache.tryRestore({
 		kind,
+		namespace,
 		name,
 		contextHash
 	});
@@ -849,6 +1640,7 @@ async function withCache(params) {
 	const code = await build([plugin]);
 	cache.save({
 		kind,
+		namespace,
 		name,
 		sourceFile,
 		content: code,
@@ -864,7 +1656,7 @@ async function withCache(params) {
 */
 function createBundleCache(store) {
 	function tryRestore(params) {
-		const cacheKey = buildCacheKey(params.kind, params.name);
+		const cacheKey = buildCacheKey(params.kind, params.name, params.namespace);
 		const entry = store.getEntry(cacheKey);
 		if (!entry) return;
 		let currentHash;
@@ -877,8 +1669,8 @@ function createBundleCache(store) {
 		return store.restoreBundleContent(cacheKey);
 	}
 	function save(params) {
-		const { kind, name, sourceFile, content, dependencyPaths, contextHash } = params;
-		const cacheKey = buildCacheKey(kind, name);
+		const { kind, namespace, name, sourceFile, content, dependencyPaths, contextHash } = params;
+		const cacheKey = buildCacheKey(kind, name, namespace);
 		const allDeps = dependencyPaths.includes(sourceFile) ? dependencyPaths : [sourceFile, ...dependencyPaths];
 		const inputHash = combineHash(hashFiles(allDeps), contextHash);
 		const contentHash = hashContent(content);
@@ -975,7 +1767,7 @@ function isPluginExecutorWithFile(executor) {
 * Generate TypeScript files for plugin-generated executors.
 * These files will be processed by the standard executor bundler.
 * @param executors - Array of plugin executor information
-* @param outputDir - Base output directory (e.g., .tailor-sdk)
+* @param outputDir - Base output directory (e.g., .tailor)
 * @param typeGenerationResult - Result from plugin type generation (for import resolution)
 * @param sourceTypeInfoMap - Map of source type names to their source info
 * @param configPath - Path to tailor.config.ts (used for resolving plugin import paths)
@@ -996,7 +1788,7 @@ function generatePluginExecutorFiles(executors, outputDir, typeGenerationResult,
 /**
 * Generate a single executor file.
 * @param info - Plugin executor metadata and definition
-* @param outputDir - Base output directory (e.g., .tailor-sdk)
+* @param outputDir - Base output directory (e.g., .tailor)
 * @param typeGenerationResult - Result from plugin type generation
 * @param sourceTypeInfoMap - Map of source type names to their source info
 * @param baseDirs - Base directories for resolving plugin import paths
@@ -1313,7 +2105,7 @@ function isFieldDefinition(value) {
 * Generate TypeScript files for plugin-generated types.
 * These files export the type definition and can be imported by executor files.
 * @param types - Array of plugin type information
-* @param outputDir - Base output directory (e.g., .tailor-sdk)
+* @param outputDir - Base output directory (e.g., .tailor)
 * @returns Generation result with file paths
 */
 function generatePluginTypeFiles(types, outputDir) {
@@ -1551,11 +2343,11 @@ function composeFunctionTreeshakeOptions(fragments = []) {
 
 //#endregion
 //#region src/cli/shared/platform-bundle-plugin.ts
-const GATE = /(?<![\w$.])process\.env\.TAILOR_PLATFORM_BUNDLE\b/g;
+const GATE = /(?<![\w$.])process\.env\.__TAILOR_PLATFORM_BUNDLE\b/g;
 const platformBundleDefinePlugin = {
 	name: "tailor-platform-bundle-define",
 	transform(code) {
-		if (!code.includes("process.env.TAILOR_PLATFORM_BUNDLE")) return null;
+		if (!code.includes("process.env.__TAILOR_PLATFORM_BUNDLE")) return null;
 		return { code: code.replace(GATE, "true") };
 	}
 };
@@ -1590,6 +2382,32 @@ function getImportSource(node) {
 	}
 	return null;
 }
+function argumentSourceText(arg, sourceText) {
+	if (arg && typeof arg === "object" && "start" in arg && "end" in arg) return sourceText.slice(arg.start, arg.end);
+}
+/**
+* Get metadata for a static `identifier.trigger(...)` call.
+* @param node - AST node to inspect
+* @param sourceText - Source code text
+* @returns Trigger call metadata, or null when the node is not a trigger call
+*/
+function getTriggerCallInfo(node, sourceText) {
+	if (!node || typeof node !== "object" || node.type !== "CallExpression") return null;
+	const callExpr = node;
+	const callee = callExpr.callee;
+	if (callee.type !== "MemberExpression") return null;
+	const memberExpr = callee;
+	if (memberExpr.computed || memberExpr.object.type !== "Identifier" || memberExpr.property.name !== "trigger") return null;
+	return {
+		identifierName: memberExpr.object.name,
+		callRange: {
+			start: callExpr.start,
+			end: callExpr.end
+		},
+		argsText: argumentSourceText(callExpr.arguments[0], sourceText) ?? "",
+		optionsText: argumentSourceText(callExpr.arguments[1], sourceText)
+	};
+}
 /**
 * Unwrap AwaitExpression to get the inner expression
 * @param node - AST expression node
@@ -1636,12 +2454,20 @@ function findProperty(properties, name) {
 /**
 * Apply string replacements to source code
 * Replacements are applied from end to start to maintain positions
+* Ranges must not overlap; applying an overlapping range on top of an
+* already-shifted string would splice at stale offsets and corrupt the output,
+* so overlap is rejected up front
 * @param source - Original source code
 * @param replacements - Replacements to apply
 * @returns Transformed source code
 */
 function applyReplacements(source, replacements) {
 	const sorted = replacements.toSorted((a, b) => b.start - a.start);
+	for (let i = 0; i + 1 < sorted.length; i++) {
+		const current = assertDefined(sorted[i], `replacement missing at index ${i}`);
+		const previous = assertDefined(sorted[i + 1], `replacement missing at index ${i + 1}`);
+		if (previous.end > current.start) throw new Error(`applyReplacements: overlapping replacement ranges [${previous.start}, ${previous.end}) and [${current.start}, ${current.end})`);
+	}
 	let result = source;
 	for (const r of sorted) result = result.slice(0, r.start) + r.text + result.slice(r.end);
 	return result;
@@ -1836,29 +2662,12 @@ function detectTriggerCalls(program, sourceText) {
 	const calls = [];
 	function walk(node) {
 		if (!node || typeof node !== "object") return;
-		if (node.type === "CallExpression") {
-			const callExpr = node;
-			const callee = callExpr.callee;
-			if (callee.type === "MemberExpression") {
-				const memberExpr = callee;
-				if (!memberExpr.computed && memberExpr.object.type === "Identifier" && memberExpr.property.name === "trigger") {
-					const identifierName = memberExpr.object.name;
-					let argsText = "";
-					if (callExpr.arguments.length > 0) {
-						const firstArg = callExpr.arguments[0];
-						if (firstArg && "start" in firstArg && "end" in firstArg) argsText = sourceText.slice(firstArg.start, firstArg.end);
-					}
-					calls.push({
-						identifierName,
-						callRange: {
-							start: callExpr.start,
-							end: callExpr.end
-						},
-						argsText
-					});
-				}
-			}
-		}
+		const triggerCall = getTriggerCallInfo(node, sourceText);
+		if (triggerCall) calls.push({
+			identifierName: triggerCall.identifierName,
+			callRange: triggerCall.callRange,
+			argsText: triggerCall.argsText
+		});
 		for (const key of Object.keys(node)) {
 			const child = node[key];
 			if (Array.isArray(child)) child.forEach((c) => walk(c));
@@ -1964,44 +2773,20 @@ function detectDefaultImports(program) {
 * Name of the injected runtime normalizer helper. Chosen to be unique enough
 * to avoid collisions with user code.
 */
-const NORMALIZER_IDENTIFIER = "__tailor_normalizeAuthInvoker";
+const NORMALIZER_IDENTIFIER = "__tailor_normalizeTriggerOptions";
 /**
 * Build the source text of the injected normalizer helper.
 *
-* Accepts a plain string machine user name and returns the object form
-* expected by the platform RPC.
-* The auth namespace is baked in at bundle time.
+* Renames an `invoker` in the trigger options to the `authInvoker` form the
+* platform RPC expects: a plain string (machine user name) becomes
+* `{ namespace, machineUserName }`, while an object form passes through
+* as-is. Any other options value is unchanged. The auth namespace is baked
+* in at bundle time.
 * @param authNamespace - Auth service namespace to embed
 * @returns Source line defining the helper
 */
 function buildNormalizerHelperSource(authNamespace) {
-	return `const ${NORMALIZER_IDENTIFIER} = (machineUserName) => ({ namespace: ${JSON.stringify(authNamespace)}, machineUserName });\n`;
-}
-/**
-* Extract authInvoker info from a config object expression
-* Returns the authInvoker value text and whether it's a shorthand property
-* @param configArg - Config argument node
-* @param sourceText - Source code text
-* @returns Extracted authInvoker info, if any
-*/
-function extractAuthInvokerInfo(configArg, sourceText) {
-	if (!configArg || typeof configArg !== "object") return void 0;
-	if (configArg.type !== "ObjectExpression") return void 0;
-	const objExpr = configArg;
-	for (const prop of objExpr.properties) {
-		if (prop.type !== "Property") continue;
-		const objProp = prop;
-		if ((objProp.key.type === "Identifier" ? objProp.key.name : objProp.key.type === "Literal" ? objProp.key.value : null) === "authInvoker") {
-			if (objProp.shorthand) return {
-				isShorthand: true,
-				valueText: "authInvoker"
-			};
-			return {
-				isShorthand: false,
-				valueText: sourceText.slice(objProp.value.start, objProp.value.end)
-			};
-		}
-	}
+	return `const ${NORMALIZER_IDENTIFIER} = (o) => { if (!o) return o; const { invoker, ...rest } = o; return typeof invoker === "string" ? { ...rest, authInvoker: { namespace: ${JSON.stringify(authNamespace)}, machineUserName: invoker } } : typeof invoker === "object" ? { ...rest, authInvoker: invoker } : o; };\n`;
 }
 /**
 * Check if an AST binding pattern (parameter, catch clause, etc.) contains an Identifier with the given name.
@@ -2131,48 +2916,23 @@ function detectExtendedTriggerCalls(program, sourceText, workflowNames, jobNames
 	const calls = [];
 	function walk(node) {
 		if (!node || typeof node !== "object") return;
-		if (node.type === "CallExpression") {
-			const callExpr = node;
-			const callee = callExpr.callee;
-			if (callee.type === "MemberExpression") {
-				const memberExpr = callee;
-				const identifierName = !memberExpr.computed && memberExpr.object.type === "Identifier" ? memberExpr.object.name : null;
-				const propertyName = !memberExpr.computed ? memberExpr.property.name : null;
-				if (identifierName && propertyName === "trigger") {
-					const isWorkflow = workflowNames.has(identifierName);
-					const isJob = jobNames.has(identifierName);
-					if (isWorkflow || isJob) {
-						const argCount = callExpr.arguments.length;
-						let argsText = "";
-						if (argCount > 0) {
-							const firstArg = callExpr.arguments[0];
-							if (firstArg && "start" in firstArg && "end" in firstArg) argsText = sourceText.slice(firstArg.start, firstArg.end);
-						}
-						if (isWorkflow && argCount >= 2) {
-							const secondArg = callExpr.arguments[1];
-							const authInvoker = extractAuthInvokerInfo(secondArg, sourceText);
-							if (authInvoker) calls.push({
-								kind: "workflow",
-								identifierName,
-								callRange: {
-									start: callExpr.start,
-									end: callExpr.end
-								},
-								argsText,
-								authInvoker
-							});
-						} else if (isJob) calls.push({
-							kind: "job",
-							identifierName,
-							callRange: {
-								start: callExpr.start,
-								end: callExpr.end
-							},
-							argsText
-						});
-					}
-				}
-			}
+		const triggerCall = getTriggerCallInfo(node, sourceText);
+		if (triggerCall) {
+			const isWorkflow = workflowNames.has(triggerCall.identifierName);
+			const isJob = jobNames.has(triggerCall.identifierName);
+			if (isWorkflow) calls.push({
+				kind: "workflow",
+				identifierName: triggerCall.identifierName,
+				callRange: triggerCall.callRange,
+				argsText: triggerCall.argsText,
+				optionsText: triggerCall.optionsText
+			});
+			else if (isJob) calls.push({
+				kind: "job",
+				identifierName: triggerCall.identifierName,
+				callRange: triggerCall.callRange,
+				argsText: triggerCall.argsText
+			});
 		}
 		for (const key of Object.keys(node)) {
 			const child = node[key];
@@ -2191,7 +2951,7 @@ function detectExtendedTriggerCalls(program, sourceText, workflowNames, jobNames
 * @param jobNameMap - Map from variable name to job name
 * @param workflowFileMap - Map from file path (without extension) to workflow name for default exports
 * @param currentFilePath - Path of the current file being transformed (for resolving relative imports)
-* @param authNamespace - Auth service namespace used to expand string-literal `authInvoker` to object form
+* @param authNamespace - Auth service namespace used to expand string-literal `invoker` to object form
 * @returns Transformed source code with trigger calls rewritten
 */
 function transformFunctionTriggers(source, workflowNameMap, jobNameMap, workflowFileMap, currentFilePath, authNamespace) {
@@ -2211,20 +2971,32 @@ function transformFunctionTriggers(source, workflowNameMap, jobNameMap, workflow
 			}
 		}
 	}
-	const triggerCalls = detectExtendedTriggerCalls(program, source, new Set(localWorkflowNameMap.keys()), new Set(jobNameMap.keys()));
+	const allTriggerCalls = detectExtendedTriggerCalls(program, source, new Set(localWorkflowNameMap.keys()), new Set(jobNameMap.keys()));
+	const nestedTriggerCalls = [];
+	const triggerCalls = allTriggerCalls.filter((call) => {
+		const parent = allTriggerCalls.find((other) => other !== call && other.callRange.start <= call.callRange.start && call.callRange.end <= other.callRange.end);
+		if (parent) {
+			nestedTriggerCalls.push({
+				call,
+				parent
+			});
+			return false;
+		}
+		return true;
+	});
+	for (const { call, parent } of nestedTriggerCalls) logger.warn(`Nested trigger call "${call.identifierName}.trigger(...)" inside "${parent.identifierName}.trigger(...)" cannot be converted. Move it to a separate statement and pass the result instead.`);
 	const replacements = [];
 	let needsNormalizerHelper = false;
 	const transformedCallsPerIdentifier = /* @__PURE__ */ new Map();
-	for (const call of triggerCalls) if (call.kind === "workflow" && call.authInvoker) {
+	for (const call of triggerCalls) if (call.kind === "workflow") {
 		const workflowName = localWorkflowNameMap.get(call.identifierName);
 		if (workflowName) {
-			const rawExpr = call.authInvoker.isShorthand ? "authInvoker" : call.authInvoker.valueText;
-			let authInvokerExpr;
-			if (authNamespace) {
-				authInvokerExpr = `${NORMALIZER_IDENTIFIER}(${rawExpr})`;
+			let optionsPart = "";
+			if (call.optionsText !== void 0) if (authNamespace) {
+				optionsPart = `, ${NORMALIZER_IDENTIFIER}(${call.optionsText})`;
 				needsNormalizerHelper = true;
-			} else authInvokerExpr = rawExpr;
-			const transformedCall = `tailor.workflow.triggerWorkflow("${workflowName}", ${call.argsText || "undefined"}, { authInvoker: ${authInvokerExpr} })`;
+			} else optionsPart = `, ${call.optionsText}`;
+			const transformedCall = `tailor.workflow.triggerWorkflow("${workflowName}", ${call.argsText || "undefined"}${optionsPart})`;
 			replacements.push({
 				start: call.callRange.start,
 				end: call.callRange.end,
@@ -2232,7 +3004,7 @@ function transformFunctionTriggers(source, workflowNameMap, jobNameMap, workflow
 			});
 			transformedCallsPerIdentifier.set(call.identifierName, (transformedCallsPerIdentifier.get(call.identifierName) ?? 0) + 1);
 		}
-	} else if (call.kind === "job") {
+	} else {
 		const jobName = jobNameMap.get(call.identifierName);
 		if (jobName) {
 			const transformedCall = `tailor.workflow.triggerJobFunction("${jobName}", ${call.argsText || "undefined"})`;
@@ -2278,7 +3050,7 @@ function normalizeFilePath(filePath) {
 * Build trigger context from workflow configuration
 * Scans workflow files to collect workflow and job mappings
 * @param workflowConfig - Workflow file loading configuration
-* @param authNamespace - Auth service namespace (optional, used for string-literal authInvoker expansion)
+* @param authNamespace - Auth service namespace (optional, used for string-literal invoker expansion)
 * @returns Trigger context built from workflow sources
 */
 async function buildTriggerContext(workflowConfig, authNamespace) {
@@ -2415,7 +3187,7 @@ async function bundleAuthHooks(options) {
 				},
 				tsconfig,
 				plugins,
-				transform: { define: { "process.env.LOG_LEVEL": JSON.stringify(bundleLogLevel) } },
+				transform: { define: { "process.env.TAILOR_APP_LOG_LEVEL": JSON.stringify(bundleLogLevel) } },
 				treeshake: composeFunctionTreeshakeOptions([createLogLevelTreeshakeOptions(bundleLogLevel)]),
 				logLevel: "silent"
 			})).output[0].code;
@@ -2427,6 +3199,28 @@ async function bundleAuthHooks(options) {
 	return bundledCode;
 }
 
+//#endregion
+//#region src/utils/script-expr.ts
+const MAX_GENERATED_CODE_LENGTH = 2e3;
+function formatGeneratedCode(expr) {
+	if (expr.length <= MAX_GENERATED_CODE_LENGTH) return `Generated code:\n${expr}`;
+	return `Generated code (truncated to ${MAX_GENERATED_CODE_LENGTH} of ${expr.length} characters):\n${expr.slice(0, MAX_GENERATED_CODE_LENGTH)}\n...`;
+}
+/**
+* Assert that a generated script expression is syntactically valid JavaScript.
+* Invalid generated code would otherwise surface much later as a confusing
+* bundler or platform-side syntax error, far from the definition that caused it.
+* @param expr - Generated JavaScript expression
+* @param context - What generated the expression, used to label the error
+* @returns The expression unchanged when it parses successfully
+*/
+function assertParsableExpression(expr, context) {
+	const { errors } = parseSync("generated-expr.js", `(${expr}\n);`);
+	if (errors.length === 0) return expr;
+	const details = errors.map((error) => `  - ${error.message}`).join("\n");
+	throw new Error(`Generated ${context} script is not valid JavaScript.\nParse errors:\n${details}\n` + formatGeneratedCode(expr));
+}
+
 //#endregion
 //#region src/parser/service/tailordb/hooks-validate-precompiled-expr.ts
 const PRECOMPILED_EXPR_KEY = "__precompiledScriptExpr";
@@ -2450,36 +3244,128 @@ function getPrecompiledScriptExpr(fn) {
 
 //#endregion
 //#region src/parser/service/tailordb/field.ts
-const tailorUserMap = `{ id: user.id, type: user.type, workspaceId: user.workspace_id, attributes: user.attribute_map, attributeList: user.attributes }`;
+const NIL_UUID = "00000000-0000-0000-0000-000000000000";
+/**
+* Build the server→SDK principal mapping expression shared across services.
+*
+* All principal-bearing call sites (`caller`, `actor`, `invoker`) must agree on
+* the `TailorPrincipal | null` shape, so they are generated here rather than
+* hand-written per service.
+* @param options - Mapping source and field expressions
+* @param options.source - Expression yielding the raw server payload (e.g. `user`)
+* @param options.fields - Per-source accessors for each principal field
+* @param options.normalize - When true, map `USER_TYPE_*` to SDK type literals and
+*   return `null` for unspecified types or the nil-UUID id; when false, the
+*   payload is already in SDK shape and only `null` pass-through is applied
+* @param options.requireId - When true, missing ids are also mapped to `null`
+* @returns A JS expression string evaluating to `TailorPrincipal | null`
+*/
+function makePrincipalExpr(options) {
+	const { source, fields, normalize, requireId = false } = options;
+	const body = `{
+    id,
+    type,
+    workspaceId: ${fields.workspaceId},
+    attributes: ${fields.attributes},
+    attributeList: ${fields.attributeList},
+  }`;
+	if (!normalize) return `(($raw) => {
+  if (!$raw) {
+    return null;
+  }
+  const id = ${fields.id};
+  const type = ${fields.type.raw};
+  return ${body};
+})(${source})`;
+	const missingIdGuard = requireId ? " || !id" : "";
+	return `(($raw) => {
+  if (!$raw) {
+    return null;
+  }
+  const type = ${fields.type.raw} === "USER_TYPE_USER"
+    ? "user"
+    : ${fields.type.raw} === "USER_TYPE_MACHINE_USER"
+      ? "machine_user"
+      : ${fields.type.fallback ?? fields.type.raw};
+  const id = ${fields.id};
+  if (!type || type === "USER_TYPE_UNSPECIFIED" || id === "${NIL_UUID}"${missingIdGuard}) {
+    return null;
+  }
+  return ${body};
+})(${source})`;
+}
+const tailorPrincipalMap = makePrincipalExpr({
+	source: "user",
+	normalize: true,
+	fields: {
+		type: { raw: "$raw?.type" },
+		id: "$raw.id",
+		workspaceId: "$raw.workspace_id ?? $raw.workspaceId",
+		attributes: "$raw.attribute_map ?? $raw.attributeMap ?? {}",
+		attributeList: "$raw.attributes ?? []"
+	}
+});
+/**
+* Parse `wrapped` and return the first property of the top-level parenthesized
+* object expression, or `undefined` if it does not parse as one.
+* @param wrapped - Source wrapped as `({ ... })`
+* @returns The first object property, or `undefined`
+*/
+const firstObjectProperty = (wrapped) => {
+	const parseResult = parseSync("stringify-function.ts", wrapped, { sourceType: "module" });
+	if (parseResult.errors.length > 0) return;
+	const expressionStatement = parseResult.program.body[0];
+	const objectExpression = expressionStatement?.type === "ExpressionStatement" && expressionStatement.expression.type === "ParenthesizedExpression" ? expressionStatement.expression.expression : void 0;
+	return objectExpression?.type === "ObjectExpression" ? objectExpression.properties[0] : void 0;
+};
 /**
 * Convert a function to a string representation.
 * Handles method shorthand syntax (e.g., `create() { ... }`) by converting it to
-* a function expression (e.g., `function create() { ... }`).
+* an anonymous function expression (e.g., `function () { ... }`), including
+* `async` and generator variants and shorthand bodies that themselves contain
+* arrow functions. The result is anonymous (rather than reusing the method
+* name) so a body that references an outer variable of the same name is not
+* shadowed by the generated function's own binding.
 * @param fn - Function to stringify
 * @returns Stringified function source
 */
 const stringifyFunction = (fn) => {
 	const src = fn.toString().trim();
-	if (/^[a-zA-Z_$][a-zA-Z0-9_$]*\s*\(/.test(src) && !src.startsWith("function") && !src.startsWith("(") && !src.includes("=>")) return `function ${src}`;
+	if (firstObjectProperty(`({m: ${src}})`)) return src;
+	const wrapped = `({${src}})`;
+	const property = firstObjectProperty(wrapped);
+	if (property?.type === "Property" && property.method && property.computed) throw new Error("Computed-key method shorthand cannot be converted to a TailorDB script expression. Use an arrow function or function expression instead.");
+	if (property?.type === "Property" && property.method && property.value.type === "FunctionExpression") {
+		const { async, generator } = property.value;
+		const body = wrapped.slice(property.value.start, property.value.end);
+		return `${async ? "async " : ""}function${generator ? "*" : ""} ${body}`;
+	}
 	return src;
 };
+function formatScriptContext(kind, context) {
+	if (!context) return kind === "validate" ? kind : "hooks";
+	return `${kind} for ${context.typeName}.${context.fieldPath.join(".")}`;
+}
 /**
-* Convert a hook function to a script expression.
-* @param fn - Hook function
-* @returns JavaScript expression calling the hook
+* Convert a hook or validator function to a script expression.
+* @param fn - Hook or validator function
+* @param kind - Label naming the source of the expression in conversion errors
+* @param context - Optional field context for conversion errors
+* @returns JavaScript expression calling the function
 */
-const convertHookToExpr = (fn) => {
+const convertToScriptExpr = (fn, kind, context) => {
 	const precompiledExpr = getPrecompiledScriptExpr(fn);
 	if (precompiledExpr) return precompiledExpr;
-	return `(${stringifyFunction(fn)})({ value: _value, data: _data, user: ${tailorUserMap} })`;
+	return assertParsableExpression(`(${stringifyFunction(fn)})({ value: _value, data: _data, invoker: ${tailorPrincipalMap} })`, formatScriptContext(kind, context));
 };
 /**
 * Parse TailorDBField into OperatorFieldConfig.
 * This transforms user-defined functions into script expressions.
 * @param field - TailorDB field definition
+* @param context - Optional field context for conversion errors
 * @returns Parsed operator field configuration
 */
-function parseFieldConfig(field) {
+function parseFieldConfig(field, context) {
 	const metadata = field.metadata;
 	const fieldType = field.type;
 	const rawRelation = field.rawRelation;
@@ -2489,7 +3375,10 @@ function parseFieldConfig(field) {
 		...metadata,
 		rawRelation,
 		...fieldType === "nested" && nestedFields && Object.keys(nestedFields).length > 0 ? { fields: Object.entries(nestedFields).reduce((acc, [key, nestedField]) => {
-			acc[key] = parseFieldConfig(nestedField);
+			acc[key] = parseFieldConfig(nestedField, context && {
+				...context,
+				fieldPath: [...context.fieldPath, key]
+			});
 			return acc;
 		}, {}) } : {},
 		validate: metadata.validate?.map((v) => {
@@ -2501,13 +3390,13 @@ function parseFieldConfig(field) {
 				message: v[1]
 			};
 			return {
-				script: { expr: getPrecompiledScriptExpr(fn) ?? `(${fn.toString().trim()})({ value: _value, data: _data, user: ${tailorUserMap} })` },
+				script: { expr: convertToScriptExpr(fn, "validate", context) },
 				errorMessage: message
 			};
 		}),
 		hooks: metadata.hooks ? {
-			create: metadata.hooks.create ? { expr: convertHookToExpr(metadata.hooks.create) } : void 0,
-			update: metadata.hooks.update ? { expr: convertHookToExpr(metadata.hooks.update) } : void 0
+			create: metadata.hooks.create ? { expr: convertToScriptExpr(metadata.hooks.create, "hooks.create", context) } : void 0,
+			update: metadata.hooks.update ? { expr: convertToScriptExpr(metadata.hooks.update, "hooks.update", context) } : void 0
 		} : void 0,
 		serial: metadata.serial ? {
 			start: metadata.serial.start,
@@ -2651,92 +3540,6 @@ function findOmittedPermitRules(rawPermissions) {
 	return locations;
 }
 
-//#endregion
-//#region src/parser/service/tailordb/relation.ts
-const relationTypes = {
-	"1-1": "1-1",
-	oneToOne: "1-1",
-	"n-1": "n-1",
-	manyToOne: "n-1",
-	"N-1": "n-1",
-	keyOnly: "keyOnly"
-};
-const relationTypesKeys = Object.keys(relationTypes);
-function fieldRef(context) {
-	return `Field "${context.fieldName}" on type "${context.typeName}"`;
-}
-/**
-* Validate relation configuration.
-* @param rawRelation - Raw relation configuration from TailorDB type definition
-* @param context - Context information for the relation (type name, field name, all type names)
-*/
-function validateRelationConfig(rawRelation, context) {
-	if (!rawRelation.type) throw new Error(`${fieldRef(context)} has a relation but is missing the required 'type' property. Valid values: ${relationTypesKeys.join(", ")}.`);
-	if (!(rawRelation.type in relationTypes)) throw new Error(`${fieldRef(context)} has invalid relation type '${rawRelation.type}'. Valid values: ${relationTypesKeys.join(", ")}.`);
-	if (rawRelation.toward.type !== "self" && !context.allTypeNames.has(rawRelation.toward.type)) throw new Error(`${fieldRef(context)} references unknown type "${rawRelation.toward.type}".`);
-}
-/**
-* Process raw relation config and compute derived metadata values.
-* @param rawRelation - Raw relation configuration
-* @param context - Context information for the relation
-* @param isArrayField - Whether the target field is an array field
-* @returns Computed relation metadata to apply to field config
-*/
-function processRelationMetadata(rawRelation, context, isArrayField = false) {
-	const isUnique = relationTypes[rawRelation.type] === "1-1";
-	const key = rawRelation.toward.key ?? "id";
-	const targetTypeName = rawRelation.toward.type === "self" ? context.typeName : rawRelation.toward.type;
-	const shouldSetIndex = !isArrayField;
-	const shouldSetUnique = !isArrayField && isUnique;
-	return {
-		index: shouldSetIndex,
-		foreignKey: true,
-		relationType: rawRelation.type,
-		unique: shouldSetUnique,
-		foreignKeyType: targetTypeName,
-		foreignKeyField: key
-	};
-}
-/**
-* Build relation info for creating forward/backward relationships.
-* Returns undefined for keyOnly relations.
-* @param rawRelation - Raw relation configuration
-* @param context - Context information for the relation
-* @returns Relation information or undefined for keyOnly relations
-*/
-function buildRelationInfo(rawRelation, context) {
-	if (rawRelation.type === "keyOnly") return;
-	const isUnique = relationTypes[rawRelation.type] === "1-1";
-	const key = rawRelation.toward.key ?? "id";
-	const targetTypeName = rawRelation.toward.type === "self" ? context.typeName : rawRelation.toward.type;
-	let forwardName = rawRelation.toward.as;
-	if (!forwardName) if (rawRelation.toward.type === "self") forwardName = context.fieldName.replace(/(ID|Id|id)$/u, "");
-	else forwardName = inflection.camelize(targetTypeName, true);
-	return {
-		targetType: targetTypeName,
-		forwardName,
-		backwardName: rawRelation.backward ?? "",
-		key,
-		unique: isUnique
-	};
-}
-/**
-* Apply processed relation metadata to field config.
-* @param fieldConfig - Original operator field configuration
-* @param metadata - Processed relation metadata to apply
-* @returns Field config with relation metadata applied
-*/
-function applyRelationMetadataToFieldConfig(fieldConfig, metadata) {
-	return {
-		...fieldConfig,
-		index: metadata.index,
-		foreignKey: metadata.foreignKey,
-		unique: metadata.unique,
-		foreignKeyType: metadata.foreignKeyType,
-		foreignKeyField: metadata.foreignKeyField
-	};
-}
-
 //#endregion
 //#region src/parser/service/tailordb/type-parser.ts
 /**
@@ -2750,7 +3553,7 @@ function applyRelationMetadataToFieldConfig(fieldConfig, metadata) {
 function parseTypes(rawTypes, namespace, typeSourceInfo) {
 	const types = createRecord();
 	const allTypeNames = new Set(Object.keys(rawTypes));
-	for (const [typeName, type] of Object.entries(rawTypes)) types[typeName] = parseTailorDBType(type, allTypeNames, rawTypes);
+	for (const [typeName, type] of Object.entries(rawTypes)) types[typeName] = parseTailorDBType(type, allTypeNames, rawTypes, typeSourceInfo);
 	buildBackwardRelationships(types, namespace, typeSourceInfo);
 	validatePluralFormUniqueness(types, namespace, typeSourceInfo);
 	return types;
@@ -2760,21 +3563,26 @@ function parseTypes(rawTypes, namespace, typeSourceInfo) {
 * @param type - TailorDB type to parse
 * @param allTypeNames - Set of all TailorDB type names
 * @param rawTypes - All raw TailorDB types keyed by name
+* @param typeSourceInfo - Optional type source information
 * @returns Parsed TailorDB type
 */
-function parseTailorDBType(type, allTypeNames, rawTypes) {
+function parseTailorDBType(type, allTypeNames, rawTypes, typeSourceInfo) {
 	const metadata = type.metadata;
 	const pluralForm = metadata.settings?.pluralForm || inflection.pluralize(type.name);
+	const typeLocation = formatTypeSourceLocation(getTypeSourceInfo(typeSourceInfo, type.name));
 	const fields = createRecord();
 	const forwardRelationships = createRecord();
 	for (const [fieldName, fieldDef] of Object.entries(type.fields)) {
-		let fieldConfig = parseFieldConfig(fieldDef);
-		const rawRelation = fieldConfig.rawRelation;
 		const context = {
 			typeName: type.name,
 			fieldName,
 			allTypeNames
 		};
+		let fieldConfig = parseFieldConfig(fieldDef, {
+			typeName: type.name,
+			fieldPath: [fieldName]
+		});
+		const rawRelation = fieldConfig.rawRelation;
 		if (rawRelation) {
 			validateRelationConfig(rawRelation, context);
 			if ([
@@ -2794,9 +3602,18 @@ function parseTailorDBType(type, allTypeNames, rawTypes) {
 		const relationInfo = rawRelation ? buildRelationInfo(rawRelation, context) : void 0;
 		if (relationInfo) {
 			parsedField.relation = { ...relationInfo };
+			const forwardName = relationInfo.forwardName;
+			if (forwardName.length === 0) throw new Error(`Forward relation name for field "${fieldName}" on type "${type.name}"${typeLocation} cannot be empty. Use the "as" option in .relation({ toward: { as: ... } }) to specify a non-empty name.`);
+			const existingForward = forwardRelationships[forwardName];
+			if (existingForward) throw new Error(`Forward relation name "${forwardName}" on type "${type.name}"${typeLocation} is duplicated between fields "${existingForward.targetField}" and "${fieldName}". Use the "as" option in .relation({ toward: { as: ... } }) to specify a unique name.`);
+			if (Object.hasOwn(type.fields, forwardName)) {
+				const message = forwardName === fieldName ? `Forward relation name "${forwardName}" on type "${type.name}"${typeLocation} is the same as its own relation field "${fieldName}". Use the "as" option in .relation({ toward: { as: ... } }) to specify a different name.` : `Forward relation name "${forwardName}" from field "${fieldName}" on type "${type.name}"${typeLocation} conflicts with existing field "${forwardName}". Use the "as" option in .relation({ toward: { as: ... } }) to specify a different name.`;
+				throw new Error(message);
+			}
+			if (Object.hasOwn(metadata.files, forwardName)) throw new Error(`Forward relation name "${forwardName}" from field "${fieldName}" on type "${type.name}"${typeLocation} conflicts with files field "${forwardName}". Use the "as" option in .relation({ toward: { as: ... } }) to specify a different name.`);
 			const targetType = rawTypes[relationInfo.targetType];
-			forwardRelationships[relationInfo.forwardName] = {
-				name: relationInfo.forwardName,
+			forwardRelationships[forwardName] = {
+				name: forwardName,
 				targetType: relationInfo.targetType,
 				targetField: fieldName,
 				sourceField: relationInfo.key,
@@ -2857,13 +3674,11 @@ function buildBackwardRelationships(types, namespace, typeSourceInfo) {
 	for (const [targetTypeName, backwardNames] of Object.entries(backwardNameSources)) {
 		const targetType = types[targetTypeName];
 		if (targetType === void 0) throw new Error(`type not found: ${targetTypeName}`);
-		const targetTypeSourceInfo = getTypeSourceInfo(typeSourceInfo, targetTypeName);
-		const targetLocation = targetTypeSourceInfo ? isPluginGeneratedType(targetTypeSourceInfo) ? ` (plugin: ${targetTypeSourceInfo.pluginId})` : ` (${targetTypeSourceInfo.filePath})` : "";
+		const targetLocation = formatTypeSourceLocation(getTypeSourceInfo(typeSourceInfo, targetTypeName));
 		for (const [backwardName, sources] of Object.entries(backwardNames)) {
 			if (sources.length > 1) {
 				const sourceList = sources.map((s) => {
-					const sourceInfo = getTypeSourceInfo(typeSourceInfo, s.sourceType);
-					const location = sourceInfo ? isPluginGeneratedType(sourceInfo) ? ` (plugin: ${sourceInfo.pluginId})` : ` (${sourceInfo.filePath})` : "";
+					const location = formatTypeSourceLocation(getTypeSourceInfo(typeSourceInfo, s.sourceType));
 					return `${s.sourceType}.${s.fieldName}${location}`;
 				}).join(", ");
 				errors.push(`Backward relation name "${backwardName}" on type "${targetTypeName}" is duplicated from: ${sourceList}. Use the "backward" option in .relation() to specify unique names.`);
@@ -2871,17 +3686,21 @@ function buildBackwardRelationships(types, namespace, typeSourceInfo) {
 			if (Object.hasOwn(targetType.fields, backwardName)) {
 				const source = sources[0];
 				if (source === void 0) throw new Error(`no source found for backward name: ${backwardName}`);
-				const sourceInfo = getTypeSourceInfo(typeSourceInfo, source.sourceType);
-				const sourceLocation = sourceInfo ? isPluginGeneratedType(sourceInfo) ? ` (plugin: ${sourceInfo.pluginId})` : ` (${sourceInfo.filePath})` : "";
+				const sourceLocation = formatTypeSourceLocation(getTypeSourceInfo(typeSourceInfo, source.sourceType));
 				errors.push(`Backward relation name "${backwardName}" from ${source.sourceType}.${source.fieldName}${sourceLocation} conflicts with existing field "${backwardName}" on type "${targetTypeName}"${targetLocation}. Use the "backward" option in .relation() to specify a different name.`);
 			}
 			if (targetType.files && Object.hasOwn(targetType.files, backwardName)) {
 				const source = sources[0];
 				if (source === void 0) throw new Error(`no source found for backward name: ${backwardName}`);
-				const sourceInfo = getTypeSourceInfo(typeSourceInfo, source.sourceType);
-				const sourceLocation = sourceInfo ? isPluginGeneratedType(sourceInfo) ? ` (plugin: ${sourceInfo.pluginId})` : ` (${sourceInfo.filePath})` : "";
+				const sourceLocation = formatTypeSourceLocation(getTypeSourceInfo(typeSourceInfo, source.sourceType));
 				errors.push(`Backward relation name "${backwardName}" from ${source.sourceType}.${source.fieldName}${sourceLocation} conflicts with files field "${backwardName}" on type "${targetTypeName}"${targetLocation}. Use the "backward" option in .relation() to specify a different name.`);
 			}
+			if (Object.hasOwn(targetType.forwardRelationships, backwardName)) {
+				const source = sources[0];
+				if (source === void 0) throw new Error(`no source found for backward name: ${backwardName}`);
+				const sourceLocation = formatTypeSourceLocation(getTypeSourceInfo(typeSourceInfo, source.sourceType));
+				errors.push(`Relation name "${backwardName}" on type "${targetTypeName}"${targetLocation} is used by both a forward relationship and a backward relationship from ${source.sourceType}.${source.fieldName}${sourceLocation}. Use the "as" option in .relation({ toward: { as: ... } }) or the "backward" option in .relation() to specify unique names.`);
+			}
 		}
 	}
 	if (errors.length > 0) throw new Error(`Backward relation name conflicts detected in TailorDB service "${namespace}".\n${errors.map((e) => `  - ${e}`).join("\n")}`);
@@ -2900,8 +3719,7 @@ function validatePluralFormUniqueness(types, namespace, typeSourceInfo) {
 	for (const [, parsedType] of Object.entries(types)) {
 		const singularQuery = inflection.camelize(parsedType.name, true);
 		if (singularQuery === inflection.camelize(parsedType.pluralForm, true)) {
-			const sourceInfo = getTypeSourceInfo(typeSourceInfo, parsedType.name);
-			const location = sourceInfo ? isPluginGeneratedType(sourceInfo) ? ` (plugin: ${sourceInfo.pluginId})` : ` (${sourceInfo.filePath})` : "";
+			const location = formatTypeSourceLocation(getTypeSourceInfo(typeSourceInfo, parsedType.name));
 			errors.push(`Type "${parsedType.name}"${location} has identical singular and plural query names "${singularQuery}". Use db.type(["${parsedType.name}", "UniquePluralForm"], {...}) to set a unique pluralForm.`);
 		}
 	}
@@ -2927,8 +3745,7 @@ function validatePluralFormUniqueness(types, namespace, typeSourceInfo) {
 	const duplicates = [...queryNameToSource].filter(([, sources]) => sources.length > 1);
 	for (const [queryName, sources] of duplicates) {
 		const sourceList = sources.map((s) => {
-			const sourceInfo = getTypeSourceInfo(typeSourceInfo, s.typeName);
-			const location = sourceInfo ? isPluginGeneratedType(sourceInfo) ? ` (plugin: ${sourceInfo.pluginId})` : ` (${sourceInfo.filePath})` : "";
+			const location = formatTypeSourceLocation(getTypeSourceInfo(typeSourceInfo, s.typeName));
 			return `"${s.typeName}"${location} (${s.kind})`;
 		}).join(", ");
 		errors.push(`GraphQL query field "${queryName}" conflicts between: ${sourceList}`);
@@ -2938,220 +3755,14 @@ function validatePluralFormUniqueness(types, namespace, typeSourceInfo) {
 function getTypeSourceInfo(typeSourceInfo, typeName) {
 	return typeSourceInfo && Object.hasOwn(typeSourceInfo, typeName) ? typeSourceInfo[typeName] : void 0;
 }
+function formatTypeSourceLocation(sourceInfo) {
+	if (!sourceInfo) return "";
+	return isPluginGeneratedType(sourceInfo) ? ` (plugin: ${sourceInfo.pluginId})` : ` (${sourceInfo.filePath})`;
+}
 function createRecord() {
 	return Object.create(null);
 }
 
-//#endregion
-//#region src/parser/service/tailordb/schema.ts
-/**
-* Normalize GqlOperationsConfig (alias or object) to GqlOperations object.
-* "query" alias expands to read-only mode: { create: false, update: false, delete: false, read: true }
-* @param config - The config to normalize
-* @returns The normalized GqlOperations object
-*/
-function normalizeGqlOperations(config) {
-	if (config === "query") return {
-		create: false,
-		update: false,
-		delete: false,
-		read: true
-	};
-	return config;
-}
-/**
-* Zod schema for GqlOperations configuration with normalization transform.
-* Accepts "query" alias or detailed object, normalizes to GqlOperations object.
-*/
-const GqlOperationsSchema = z.union([z.literal("query"), z.object({
-	create: z.boolean().optional().describe("Enable create mutation (default: true)"),
-	update: z.boolean().optional().describe("Enable update mutation (default: true)"),
-	delete: z.boolean().optional().describe("Enable delete mutation (default: true)"),
-	read: z.boolean().optional().describe("Enable read queries - get, list, aggregation (default: true)")
-})]).describe("Configuration for GraphQL operations on a TailorDB type.\nAll operations are enabled by default (undefined or true = enabled, false = disabled).").transform((val) => normalizeGqlOperations(val));
-const TailorFieldTypeSchema = z.enum([
-	"uuid",
-	"string",
-	"boolean",
-	"integer",
-	"float",
-	"decimal",
-	"enum",
-	"date",
-	"datetime",
-	"time",
-	"nested"
-]);
-const AllowedValueSchema = z.object({
-	value: z.string(),
-	description: z.string().optional()
-});
-const DBFieldMetadataSchema = z.object({
-	required: z.boolean().optional().describe("Whether the field is required"),
-	array: z.boolean().optional().describe("Whether the field is an array"),
-	description: z.string().optional().describe("Field description"),
-	typeName: z.string().optional().describe("Type name for nested or enum fields"),
-	allowedValues: z.array(AllowedValueSchema).optional().describe("Allowed values for enum fields"),
-	index: z.boolean().optional().describe("Whether the field is indexed for faster queries"),
-	unique: z.boolean().optional().describe("Whether the field value must be unique"),
-	vector: z.boolean().optional().describe("Whether the field is a vector field for similarity search"),
-	foreignKey: z.boolean().optional().describe("Whether the field is a foreign key"),
-	foreignKeyType: z.string().optional().describe("Target type name for foreign key relations"),
-	foreignKeyField: z.string().optional().describe("Target field name for foreign key relations"),
-	hooks: z.object({
-		create: functionSchema.optional().describe("Hook function called on record creation"),
-		update: functionSchema.optional().describe("Hook function called on record update")
-	}).optional().describe("Lifecycle hooks for the field"),
-	validate: z.array(z.union([functionSchema, z.tuple([functionSchema, z.string()])])).optional().describe("Validation functions for the field"),
-	serial: z.object({
-		start: z.number().describe("Starting value for the serial sequence"),
-		maxValue: z.number().optional().describe("Maximum value for the serial sequence"),
-		format: z.string().optional().describe("Format string for serial value (string type only)")
-	}).optional().describe("Serial (auto-increment) configuration"),
-	scale: z.number().int().min(0).max(12).optional().describe("Decimal scale (number of digits after decimal point, 0-12)")
-});
-const RelationTypeSchema = z.enum(relationTypesKeys);
-const RawRelationConfigSchema = z.object({
-	type: RelationTypeSchema.describe("Relation cardinality type"),
-	toward: z.object({
-		type: z.string().describe("Target type name, or 'self' for self-relations"),
-		as: z.string().optional().describe("Custom forward relation name"),
-		key: z.string().optional().describe("Target field to join on (default: 'id')")
-	}),
-	backward: z.string().optional().describe("Backward relation name on the target type")
-});
-const TailorDBFieldSchema = z.lazy(() => z.object({
-	type: TailorFieldTypeSchema,
-	fields: z.record(z.string(), TailorDBFieldSchema).optional(),
-	metadata: DBFieldMetadataSchema,
-	rawRelation: RawRelationConfigSchema.optional()
-}));
-/**
-* Schema for TailorDB type settings.
-* Normalizes gqlOperations from alias ("query") to object format.
-*/
-const TailorDBTypeSettingsSchema = z.object({
-	pluralForm: z.string().optional().describe("Custom plural form of the type name for GraphQL"),
-	aggregation: z.boolean().optional().describe("Enable aggregation queries for this type"),
-	bulkUpsert: z.boolean().optional().describe("Enable bulk upsert mutation for this type"),
-	gqlOperations: GqlOperationsSchema.optional().describe("Configure GraphQL operations for this type. Use \"query\" for read-only mode, or an object for granular control."),
-	publishEvents: z.boolean().optional().describe("Enable publishing events for this type.\nWhen enabled, record creation/update/deletion events are published.\nIf not specified, this is automatically set to true when an executor uses this type\nwith recordCreated/recordUpdated/recordDeleted triggers. If explicitly set to false\nwhile an executor uses this type, an error will be thrown during apply.")
-});
-const GQL_PERMISSION_INVALID_OPERAND_MESSAGE = "operand is not supported in gqlPermission. Use permission() for record-level conditions.";
-const GqlPermissionOperandSchema = z.union([
-	z.object({ user: z.string() }).strict(),
-	z.string(),
-	z.boolean(),
-	z.array(z.string()),
-	z.array(z.boolean())
-], { error: (issue) => {
-	if (typeof issue.input === "object" && issue.input !== null) {
-		const keys = Object.keys(issue.input);
-		if (keys.length === 1) return `"${keys[0]}" ${GQL_PERMISSION_INVALID_OPERAND_MESSAGE}`;
-		return "Operand object must have exactly 1 key";
-	}
-	return "Invalid operand in gqlPermission";
-} });
-const RecordPermissionOperandSchema = z.union([
-	GqlPermissionOperandSchema,
-	z.object({ record: z.string() }),
-	z.object({ oldRecord: z.string() }),
-	z.object({ newRecord: z.string() })
-]);
-const PermissionOperatorSchema = z.enum([
-	"=",
-	"!=",
-	"in",
-	"not in",
-	"hasAny",
-	"not hasAny"
-]);
-const RecordPermissionConditionSchema = z.tuple([
-	RecordPermissionOperandSchema,
-	PermissionOperatorSchema,
-	RecordPermissionOperandSchema
-]).readonly();
-const GqlPermissionConditionSchema = z.tuple([
-	GqlPermissionOperandSchema,
-	PermissionOperatorSchema,
-	GqlPermissionOperandSchema
-]).readonly();
-const ActionPermissionSchema = z.union([
-	z.object({
-		conditions: z.union([RecordPermissionConditionSchema, z.array(RecordPermissionConditionSchema).readonly()]),
-		description: z.string().optional(),
-		permit: z.boolean().optional()
-	}),
-	z.tuple([
-		RecordPermissionOperandSchema,
-		PermissionOperatorSchema,
-		RecordPermissionOperandSchema
-	]).readonly(),
-	z.tuple([
-		RecordPermissionOperandSchema,
-		PermissionOperatorSchema,
-		RecordPermissionOperandSchema,
-		z.boolean()
-	]).readonly(),
-	z.array(z.union([RecordPermissionConditionSchema, z.boolean()])).refine((arr) => {
-		const boolIndex = arr.findIndex((item) => typeof item === "boolean");
-		return boolIndex === -1 || boolIndex === arr.length - 1;
-	}, { message: "Boolean permit flag must only appear at the end" }).readonly()
-]);
-const GqlPermissionActionSchema = z.enum([
-	"read",
-	"create",
-	"update",
-	"delete",
-	"aggregate",
-	"bulkUpsert"
-]);
-const GqlPermissionPolicySchema = z.object({
-	conditions: z.array(GqlPermissionConditionSchema).readonly(),
-	actions: z.union([z.literal("all"), z.array(GqlPermissionActionSchema).readonly()]),
-	permit: z.boolean().optional(),
-	description: z.string().optional()
-});
-const RawPermissionsSchema = z.object({
-	record: z.object({
-		create: z.array(ActionPermissionSchema).readonly(),
-		read: z.array(ActionPermissionSchema).readonly(),
-		update: z.array(ActionPermissionSchema).readonly(),
-		delete: z.array(ActionPermissionSchema).readonly()
-	}).optional(),
-	gql: z.array(GqlPermissionPolicySchema).readonly().optional()
-});
-const TailorDBTypeSchema = z.object({
-	name: z.string(),
-	fields: z.record(z.string(), TailorDBFieldSchema),
-	metadata: z.object({
-		name: z.string(),
-		description: z.string().optional(),
-		settings: TailorDBTypeSettingsSchema.optional(),
-		permissions: RawPermissionsSchema,
-		files: z.record(z.string(), z.string()),
-		indexes: z.record(z.string(), z.object({
-			fields: z.array(z.string()),
-			unique: z.boolean().optional()
-		})).optional()
-	})
-});
-const TailorDBMigrationConfigSchema = z.object({
-	directory: z.string().describe("Directory containing migration files"),
-	machineUser: z.string().optional().describe("Machine user name for migration execution")
-});
-/**
-* Schema for TailorDB service configuration.
-* Normalizes gqlOperations from alias ("query") to object format.
-*/
-const TailorDBServiceConfigSchema = z.object({
-	files: z.array(z.string()).describe("Glob patterns for TailorDB type definition files"),
-	ignores: z.array(z.string()).optional().describe("Glob patterns to exclude from type discovery"),
-	erdSite: z.string().optional().describe("URL for the ERD (Entity Relationship Diagram) site"),
-	migration: TailorDBMigrationConfigSchema.optional().describe("Migration configuration"),
-	gqlOperations: GqlOperationsSchema.optional().describe("Default GraphQL operations for all types in this service")
-});
-
 //#endregion
 //#region src/cli/services/tailordb/es-builtins.ts
 const globalsMap = globals.default ?? globals;
@@ -3164,7 +3775,7 @@ const globalsMap = globals.default ?? globals;
 * globals['shared-node-browser'] (shared runtime globals like
 * console, fetch, setTimeout, etc.) from the `globals` npm package.
 */
-const ES_BUILTINS = new Set([...Object.keys(globalsMap.builtin ?? {}), ...Object.keys(globalsMap["shared-node-browser"] ?? {})]);
+const ES_BUILTINS = /* @__PURE__ */ new Set([...Object.keys(globalsMap.builtin ?? {}), ...Object.keys(globalsMap["shared-node-browser"] ?? {})]);
 
 //#endregion
 //#region src/cli/services/tailordb/hooks-validate-bundler.ts
@@ -3192,7 +3803,7 @@ function collectBindingsFromPattern(pattern, bindings) {
 	}
 }
 /** Fields that contain TypeScript type annotations (not runtime references). */
-const TS_TYPE_FIELDS = new Set([
+const TS_TYPE_FIELDS = /* @__PURE__ */ new Set([
 	"typeAnnotation",
 	"typeParameters",
 	"returnType",
@@ -3433,7 +4044,7 @@ function buildPrecompiledExpr(bundleCode) {
 	return `(() => {
   const module = { exports: {} };
   const exports = module.exports;
-${bundleCode}\n  return module.exports.main({ value: _value, data: _data, user: ${tailorUserMap} });\n})()`;
+${bundleCode}\n  return module.exports.main({ value: _value, data: _data, invoker: ${tailorPrincipalMap} });\n})()`;
 }
 /**
 * Build entry file content from already-resolved imports and declarations.
@@ -3453,12 +4064,13 @@ function buildMinimalEntryFromResolved(imports, declarations, fnSource, sourceFi
 }
 async function bundleScriptTarget(args) {
 	const { fn, kind, sourceFilePath, sourceBindings, tempDir, targetIndex, tsconfig } = args;
+	const context = `${kind} in ${sourceFilePath}`;
 	const fnSource = stringifyFunction(fn);
-	const inlineExpr = `(${fnSource})({ value: _value, data: _data, user: ${tailorUserMap} })`;
+	const inlineExpr = assertParsableExpression(`(${fnSource})({ value: _value, data: _data, invoker: ${tailorPrincipalMap} })`, context);
 	const freeVars = findUndefinedReferences(`const __fn = ${fnSource};`);
 	if (freeVars.size === 0) return inlineExpr;
 	const { imports, declarations, unresolved } = resolveNeededBindings(freeVars, sourceBindings);
-	if (unresolved.length > 0) throw new Error(`${kind} in ${sourceFilePath} captures unresolvable variables (${unresolved.join(", ")}). Hooks and validators must not reference variables that cannot be resolved from the source file.
+	if (unresolved.length > 0) throw new Error(`${context} captures unresolvable variables (${unresolved.join(", ")}). Hooks and validators must not reference variables that cannot be resolved from the source file.
   ${kind}: ${fnSource}`);
 	const entryContent = buildMinimalEntryFromResolved(imports, declarations, fnSource, sourceFilePath);
 	const entryPath = join(tempDir, `tailordb-script-${targetIndex}.entry.ts`);
@@ -3481,7 +4093,7 @@ async function bundleScriptTarget(args) {
 		},
 		logLevel: "silent"
 	})).output[0].code;
-	return buildPrecompiledExpr(bundledCode);
+	return assertParsableExpression(buildPrecompiledExpr(bundledCode), context);
 }
 /**
 * Precompile TailorDB hooks/validators into self-contained script expressions using rolldown.
@@ -3569,7 +4181,7 @@ async function fetchExternalTailorDBTypeNameSources(args) {
 				});
 				return [tailordbTypes, nextPageToken ?? ""];
 			} catch (error) {
-				if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
+				if (isNotFoundError(error)) return [[], ""];
 				throw error;
 			}
 		});
@@ -3614,8 +4226,23 @@ function assertUniqueLocalTailorDBTypeNames(args) {
 */
 async function assertUniqueTailorDBTypeNamesWithExternal(args) {
 	const localSources = collectLocalTailorDBTypeNameSources(args);
-	const externalSources = args.externalTailorDBNamespaces.length > 0 ? await fetchExternalTailorDBTypeNameSources(args) : [];
-	assertUniqueTailorDBTypeNames({ sources: [...localSources, ...externalSources] });
+	const plannedExternalServices = args.plannedExternalTailorDBServices ?? [];
+	const plannedExternalNamespaces = new Set(plannedExternalServices.map((service) => service.namespace));
+	const plannedExternalSources = collectLocalTailorDBTypeNameSources({ tailorDBServices: plannedExternalServices }).map((source) => ({
+		...source,
+		kind: "external"
+	}));
+	const remoteExternalNamespaces = args.externalTailorDBNamespaces.filter((namespace) => !plannedExternalNamespaces.has(namespace));
+	const externalSources = remoteExternalNamespaces.length > 0 ? await fetchExternalTailorDBTypeNameSources({
+		client: args.client,
+		workspaceId: args.workspaceId,
+		externalTailorDBNamespaces: remoteExternalNamespaces
+	}) : [];
+	assertUniqueTailorDBTypeNames({ sources: [
+		...localSources,
+		...plannedExternalSources,
+		...externalSources
+	] });
 }
 function formatTailorDBTypeNameSource(source) {
 	const namespaceLabel = source.kind === "external" ? `external namespace "${source.namespace}"` : `namespace "${source.namespace}"`;
@@ -3695,7 +4322,7 @@ function createTailorDBService(params) {
 			const module = await import(pathToFileURL(typeFile).href);
 			for (const exportName of Object.keys(module)) {
 				const exportedValue = module[exportName];
-				const result = TailorDBTypeSchema.safeParse(exportedValue);
+				const result = TailorDBTypeSchema.safeParse(stripTailorDBTypeBuilderHelpers(exportedValue));
 				if (!result.success) {
 					if (isSdkBranded(exportedValue, "tailordb-type")) throw result.error;
 					continue;
@@ -3894,32 +4521,51 @@ function withBundleConcurrency(items, worker) {
 * - Bundle inline: interpolated into the generated `.entry.js` wrapper and
 *   evaluated inside the bundled script at function entry.
 *
-* The user field mapping (server → SDK) shared across services is defined in
-* `@/parser/service/tailordb` as `tailorUserMap`.
+* The principal field mapping (server → SDK) shared across services is built by
+* `makePrincipalExpr` from `@/parser/service/tailordb`; `tailorPrincipalMap`
+* (the `caller` mapping) is one of its outputs. `INVOKER_EXPR` and
+* `ACTOR_TRANSFORM_EXPR` below come from the same factory so the three stay in
+* sync.
 */
 /**
 * `invoker` value expression, inlined into bundler entry wrappers.
 *
 * Calls `tailor.context.getInvoker()` at function entry and maps the server
-* shape to TailorInvoker. Anonymous callers (`null`) pass through as `null`.
-*/
-const INVOKER_EXPR = `(($raw) => $raw ? ({
-  id: $raw.id,
-  type: $raw.type,
-  workspaceId: $raw.workspaceId,
-  attributes: $raw.attributeMap,
-  attributeList: $raw.attributes,
-}) : null)(tailor.context.getInvoker())`;
+* shape to `TailorPrincipal | null`. The payload is already in SDK type shape,
+* so no `USER_TYPE_*` normalization is needed; anonymous callers (`null`) pass
+* through as `null`.
+*/
+const INVOKER_EXPR = makePrincipalExpr({
+	source: "tailor.context.getInvoker()",
+	normalize: false,
+	fields: {
+		type: { raw: "$raw.type" },
+		id: "$raw.id",
+		workspaceId: "$raw.workspaceId",
+		attributes: "$raw.attributeMap",
+		attributeList: "$raw.attributes"
+	}
+});
 /**
 * Actor field transformation expression.
 *
-* Transforms the server's actor object to match the SDK's TailorActor type:
-*   server `attributeMap`  → SDK `attributes`
-*   server `attributes`    → SDK `attributeList`
-*   other fields           → passed through
-*   null/undefined actor   → null
-*/
-const ACTOR_TRANSFORM_EXPR = "actor: args.actor ? (({ attributeMap, attributes: attrList, ...rest }) => ({ ...rest, attributes: attributeMap, attributeList: attrList }))(args.actor) : null";
+* Transforms the server's actor object to match `TailorPrincipal | null`.
+*/
+const ACTOR_TRANSFORM_EXPR = `actor: ${makePrincipalExpr({
+	source: "args.actor",
+	normalize: true,
+	requireId: true,
+	fields: {
+		type: {
+			raw: "$raw?.userType",
+			fallback: "$raw?.type"
+		},
+		id: "$raw?.userId ?? $raw?.id",
+		workspaceId: "$raw.workspaceId",
+		attributes: "$raw.attributeMap ?? {}",
+		attributeList: "$raw.attributes ?? []"
+	}
+})}`;
 /**
 * Build the JavaScript expression that transforms server-format executor event
 * args into SDK-format args at runtime.
@@ -3947,27 +4593,13 @@ function buildExecutorArgsExpr(triggerKind, env) {
 * Transforms server context to SDK resolver context:
 *   context.args        → input
 *   context.pipeline     → spread into result
-*   user (global var)    → TailorUser (via tailorUserMap: workspace_id→workspaceId, attribute_map→attributes, attributes→attributeList)
+*   user (global var)    → caller (`TailorPrincipal | null`)
 *   env                 → injected as JSON
 * @param env - Application env record to embed in the expression
 * @returns A JavaScript expression string for the operationHook
 */
 function buildResolverOperationHookExpr(env) {
-	return `({ ...context.pipeline, input: context.args, user: ${tailorUserMap}, env: ${JSON.stringify(env)} });`;
-}
-
-//#endregion
-//#region src/cli/services/executor/loader.ts
-/**
-* Load and validate an executor definition from a file.
-* @param executorFilePath - Path to the executor file
-* @returns Parsed executor or null if invalid
-*/
-async function loadExecutor(executorFilePath) {
-	const executor = (await import(pathToFileURL(executorFilePath).href)).default;
-	const parseResult = ExecutorSchema.safeParse(executor);
-	if (!parseResult.success) return null;
-	return parseResult.data;
+	return `({ ...context.pipeline, input: context.args, caller: ${tailorPrincipalMap}, env: ${JSON.stringify(env)} });`;
 }
 
 //#endregion
@@ -4123,6 +4755,7 @@ const HttpAdapterConfigSchema = z.strictObject({
 //#region src/cli/services/http-adapter/bundler.ts
 const ADAPTER_BUNDLE_WARN_BYTES = 64 * 1024;
 const ADAPTER_BUNDLE_ERROR_BYTES = 256 * 1024;
+const GRAPHQL_WEB_MODULE = createRequire(import.meta.url).resolve("@0no-co/graphql.web");
 /**
 * Bundle each adapter's `input` (and `output`, if present) into a standalone
 * IIFE defining a global `transform(input)` entry point. `input` gets a
@@ -4170,7 +4803,7 @@ async function bundleAdapterScript(adapter, kind, outputDir, tsconfig, cache, bu
 		tsconfig,
 		inlineSourcemap: false,
 		bundleLogLevel,
-		prefix: kind
+		prefix: `${kind}:document-query-normalize-v1`
 	});
 	const code = await withCache({
 		cache,
@@ -4181,8 +4814,6 @@ async function bundleAdapterScript(adapter, kind, outputDir, tsconfig, cache, bu
 		async build(cachePlugins) {
 			const entryPath = path.join(outputDir, `${adapter.name}.${kind}.entry.js`);
 			const absoluteSourcePath = path.resolve(adapter.sourceFile);
-			const entryContent = kind === "input" ? buildInputEntry(absoluteSourcePath, adapter.methods) : buildOutputEntry(absoluteSourcePath);
-			fs$1.writeFileSync(entryPath, entryContent);
 			const plugins = [
 				{
 					name: "http-adapter-reject-node-imports",
@@ -4209,6 +4840,8 @@ async function bundleAdapterScript(adapter, kind, outputDir, tsconfig, cache, bu
 			];
 			let bundled;
 			try {
+				const entryContent = kind === "input" ? buildInputEntry(absoluteSourcePath, adapter.methods, GRAPHQL_WEB_MODULE) : buildOutputEntry(absoluteSourcePath);
+				fs$1.writeFileSync(entryPath, entryContent);
 				bundled = (await rolldown.build({
 					input: entryPath,
 					write: false,
@@ -4242,10 +4875,20 @@ async function bundleAdapterScript(adapter, kind, outputDir, tsconfig, cache, bu
 		code
 	];
 }
-function buildInputEntry(absoluteSourcePath, methods) {
-	const cases = methods.map((method) => `    case "${HTTP_METHODS[method]}": return __adapter.input.${method}(req);`).join("\n");
+function buildInputEntry(absoluteSourcePath, methods, graphqlPrinterModule) {
+	const cases = methods.map((method) => {
+		const expression = `__normalizeHttpAdapterGraphQLRequest(${`__adapter.input.${method}(req)`})`;
+		return `    case "${HTTP_METHODS[method]}": return ${expression};`;
+	}).join("\n");
 	const supported = methods.map((m) => HTTP_METHODS[m]).join(", ");
-	return `import __adapter from ${JSON.stringify(absoluteSourcePath)};
+	return `${`import { print as __printHttpAdapterDocument } from ${JSON.stringify(graphqlPrinterModule)};
+function __normalizeHttpAdapterGraphQLRequest(result) {
+  if (!result || typeof result.query === "string") {
+    return result;
+  }
+  return { ...result, query: __printHttpAdapterDocument(result.query) };
+}
+`}import __adapter from ${JSON.stringify(absoluteSourcePath)};
 globalThis.transform = function(req) {
   switch (req.method) {
 ${cases}
@@ -4385,7 +5028,7 @@ function isAsyncFunction(fn) {
 //#endregion
 //#region src/parser/service/resolver/schema.ts
 const QueryTypeSchema = z.union([z.literal("query"), z.literal("mutation")]).describe("GraphQL operation type");
-const ResolverSchema = z.object({
+const ResolverSchema = z.strictObject({
 	operation: QueryTypeSchema.describe("GraphQL operation type (query or mutation)"),
 	name: z.string().describe("Resolver name"),
 	description: z.string().optional().describe("Resolver description"),
@@ -4393,7 +5036,7 @@ const ResolverSchema = z.object({
 	body: functionSchema.describe("Resolver implementation function"),
 	output: TailorFieldSchema.describe("Output field definition"),
 	publishEvents: z.boolean().optional().describe("Enable publishing events from this resolver"),
-	authInvoker: AuthInvokerSchema.optional().describe("Machine user to execute this resolver as")
+	invoker: AuthInvokerSchema.optional().describe("Machine user to execute this resolver as")
 });
 
 //#endregion
@@ -4457,12 +5100,12 @@ async function bundleResolvers(namespace, config, triggerContext, cache, inlineS
 	} catch {
 		tsconfig = void 0;
 	}
-	const results = await withBundleConcurrency(resolvers, (resolver) => bundleSingleResolver(resolver, outputDir, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel));
+	const results = await withBundleConcurrency(resolvers, (resolver) => bundleSingleResolver(namespace, resolver, outputDir, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel));
 	for (const [name, code] of results) bundledCode.set(name, code);
 	logger.log(`${styles.success("Bundled")} ${styles.info(`"${namespace}"`)}`);
 	return bundledCode;
 }
-async function bundleSingleResolver(resolver, outputDir, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+async function bundleSingleResolver(namespace, resolver, outputDir, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
 	const serializedTriggerContext = serializeTriggerContext(triggerContext);
 	const contextHash = computeBundlerContextHash({
 		sourceFile: resolver.sourceFile,
@@ -4474,6 +5117,7 @@ async function bundleSingleResolver(resolver, outputDir, tsconfig, triggerContex
 	const code = await withCache({
 		cache,
 		kind: "resolver",
+		namespace,
 		name: resolver.name,
 		sourceFile: resolver.sourceFile,
 		contextHash,
@@ -4489,7 +5133,7 @@ async function bundleSingleResolver(resolver, outputDir, tsconfig, triggerContex
             const result = t.object(_internalResolver.input).parse({
               value: context.input,
               data: context.input,
-              user: context.user,
+              invoker,
             });
 
             if (result.issues) {
@@ -4568,9 +5212,26 @@ function createResolverService(namespace, config) {
 			const resolverFiles = loadFilesWithIgnores(config);
 			logger.log(`Found ${styles.highlight(resolverFiles.length.toString())} resolver files for service ${styles.highlight(`"${namespace}"`)}`);
 			await Promise.all(resolverFiles.map((resolverFile) => loadResolverForFile(resolverFile)));
+			assertUniqueResolverNames(resolvers, namespace);
 		}
 	};
 }
+/**
+* Assert that every loaded resolver in a namespace has a unique name.
+* Resolvers are stored by source file, so two files declaring the same
+* `name` would otherwise silently share a single bundle cache entry.
+* @param resolvers - Loaded resolvers keyed by source file
+* @param namespace - The namespace the resolvers belong to
+*/
+function assertUniqueResolverNames(resolvers, namespace) {
+	const seenNames = /* @__PURE__ */ new Map();
+	for (const [file, resolver] of Object.entries(resolvers)) {
+		const relativePath = path.relative(process.cwd(), file);
+		const existing = seenNames.get(resolver.name);
+		if (existing) throw new Error(`Duplicate resolver name "${resolver.name}" found in namespace "${namespace}":\n  - ${existing}\n  - ${relativePath}\nEach resolver must have a unique name within a namespace.`);
+		seenNames.set(resolver.name, relativePath);
+	}
+}
 
 //#endregion
 //#region src/cli/services/workflow/source-transformer.ts
@@ -4675,11 +5336,17 @@ function transformWorkflowSource(source, targetJobName, targetJobExportName, oth
 				end: endPos,
 				text: ""
 			});
-		} else if (!job.statementRange) replacements.push({
-			start: job.bodyValueRange.start,
-			end: job.bodyValueRange.end,
-			text: "() => {}"
-		});
+		} else if (!job.statementRange) {
+			removedRanges.push({
+				start: job.bodyValueRange.start,
+				end: job.bodyValueRange.end
+			});
+			replacements.push({
+				start: job.bodyValueRange.start,
+				end: job.bodyValueRange.end,
+				text: "() => {}"
+			});
+		}
 	}
 	if (otherJobExportNames) for (const exportName of otherJobExportNames) {
 		if (exportName === targetJobExportName) continue;
@@ -4933,7 +5600,7 @@ async function bundleSingleJob(job, allJobs, outputDir, tsconfig, env, triggerCo
 
 //#endregion
 //#region src/parser/service/workflow/schema.ts
-const WorkflowJobSchema = z.object({
+const WorkflowJobSchema = z.strictObject({
 	name: z.string().describe("Job name (must be unique across the project)"),
 	trigger: functionSchema.describe("Trigger function that initiates the job"),
 	body: functionSchema.describe("Job implementation function")
@@ -4958,7 +5625,7 @@ function durationToSeconds(duration) {
 }
 const baseDurationSchema = z.templateLiteral([z.number().int().positive(), z.enum(durationUnits)]);
 const durationSchema = (maxSeconds) => baseDurationSchema.refine((val) => durationToSeconds(val) <= maxSeconds, { message: `Duration must be at most ${maxSeconds} seconds` });
-const RetryPolicySchema = z.object({
+const RetryPolicySchema = z.strictObject({
 	maxRetries: z.number().int().min(1).max(10).describe("Maximum number of retries (1-10)"),
 	initialBackoff: durationSchema(3600).describe("Initial backoff duration (e.g., '1s', '500ms', '1m', max 1h)"),
 	maxBackoff: durationSchema(86400).describe("Maximum backoff duration (e.g., '30s', '5m', max 24h)"),
@@ -4970,8 +5637,8 @@ const RetryPolicySchema = z.object({
 	message: "initialBackoff must be greater than 0",
 	path: ["initialBackoff"]
 });
-const ConcurrencyPolicySchema = z.object({ maxConcurrentExecutions: z.number().int().min(1).max(1e3).describe("Maximum number of concurrent executions (1-1000)") });
-const WorkflowSchema = z.object({
+const ConcurrencyPolicySchema = z.strictObject({ maxConcurrentExecutions: z.number().int().min(1).max(1e3).describe("Maximum number of concurrent executions (1-1000)") });
+const WorkflowSchema = z.strictObject({
 	name: z.string().describe("Workflow name"),
 	mainJob: WorkflowJobSchema.describe("Main job that starts the workflow"),
 	retryPolicy: RetryPolicySchema.optional().describe("Retry policy for the workflow"),
@@ -4980,6 +5647,11 @@ const WorkflowSchema = z.object({
 
 //#endregion
 //#region src/cli/services/workflow/service.ts
+function stripRuntimeTrigger(workflow) {
+	if (!isSdkBranded(workflow, "workflow") || workflow === null || typeof workflow !== "object" || !("trigger" in workflow)) return workflow;
+	const { trigger: _trigger, ...rest } = workflow;
+	return rest;
+}
 /**
 * Creates a new WorkflowService instance.
 * @param params - Parameters for creating the service
@@ -5087,7 +5759,7 @@ async function loadFileContent(filePath) {
 		const module = await import(pathToFileURL(filePath).href);
 		for (const [exportName, exportValue] of Object.entries(module)) {
 			if (exportName === "default") {
-				const workflowResult = WorkflowSchema.safeParse(exportValue);
+				const workflowResult = WorkflowSchema.safeParse(stripRuntimeTrigger(exportValue));
 				if (workflowResult.success) workflow = workflowResult.data;
 				else if (isSdkBranded(exportValue, ["workflow", "workflow-job"])) throw workflowResult.error;
 				continue;
@@ -5130,23 +5802,29 @@ function getApplicationAuthNamespace(application) {
 *
 * Resolution order:
 * 1. Config value (`inlineSourcemap` in defineConfig) — if explicitly set
-* 2. Environment variable `TAILOR_ENABLE_INLINE_SOURCEMAP` — if explicitly set
+* 2. Environment variable `TAILOR_INLINE_SOURCEMAP` — if explicitly set
 * 3. Default: `true`
 * @param configValue - The `inlineSourcemap` value from AppConfig
 * @returns Whether inline sourcemaps should be enabled
 */
 function resolveInlineSourcemap(configValue) {
 	if (configValue !== void 0) return configValue;
-	const envValue = parseBoolean(process.env.TAILOR_ENABLE_INLINE_SOURCEMAP);
+	const envValue = parseBoolean(process.env.TAILOR_INLINE_SOURCEMAP);
 	if (envValue !== void 0) return envValue;
 	return true;
 }
 
+//#endregion
+//#region src/cli/shared/resolver-bundle-key.ts
+function resolverBundleKey(namespace, resolverName) {
+	return `${namespace}:${resolverName}`;
+}
+
 //#endregion
 //#region src/parser/service/aigateway/schema.ts
 const NAME_PATTERN = /^[a-z0-9][a-z0-9-]{1,28}[a-z0-9]$/;
 const AUTH_NAMESPACE_PATTERN = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
-const AIGatewaySchema = z.object({
+const AIGatewaySchema = z.strictObject({
 	name: z.string().regex(NAME_PATTERN, "Must be 3-30 lowercase alphanumeric characters or hyphens").describe("AI Gateway name"),
 	authNamespace: z.string().regex(AUTH_NAMESPACE_PATTERN, "Must be 3-63 lowercase alphanumeric characters or hyphens").describe("Auth namespace used to resolve request tokens against the workspace's auth"),
 	cors: z.array(z.string()).optional().describe("Allowed CORS origins for browser-based clients. Each entry is `*`, `http(s)://*`, `http(s)://*.example.com`, or `http(s)://app.example.com`, optionally with `:port`. Empty list disables cross-origin access.")
@@ -5156,7 +5834,8 @@ const AIGatewaySchema = z.object({
 //#region src/parser/service/idp/schema.ts
 /**
 * Normalize IdPGqlOperationsConfig (alias or object) to IdPGqlOperations object.
-* "query" alias expands to read-only mode: { create: false, update: false, delete: false, read: true, sendPasswordResetEmail: false }
+* "query" alias expands to read-only mode: every mutation is disabled while
+* queries (`read`, `requestMfaSettingsUrl`) stay enabled.
 * @param config - The config to normalize
 * @returns The normalized IdPGqlOperations object
 */
@@ -5166,7 +5845,9 @@ function normalizeIdPGqlOperations(config) {
 		update: false,
 		delete: false,
 		read: true,
-		sendPasswordResetEmail: false
+		sendPasswordResetEmail: false,
+		requestMfaSettingsUrl: true,
+		unenrollMfa: false
 	};
 	return config;
 }
@@ -5174,15 +5855,18 @@ function normalizeIdPGqlOperations(config) {
 * Zod schema for IdPGqlOperations configuration with normalization transform.
 * Accepts "query" alias or detailed object, normalizes to IdPGqlOperations object.
 */
-const IdPGqlOperationsSchema = z.union([z.literal("query"), z.object({
+const IdPGqlOperationsSchema = z.union([z.literal("query"), z.strictObject({
 	create: z.boolean().optional().describe("Enable _createUser mutation (default: true)"),
 	update: z.boolean().optional().describe("Enable _updateUser mutation (default: true)"),
 	delete: z.boolean().optional().describe("Enable _deleteUser mutation (default: true)"),
 	read: z.boolean().optional().describe("Enable _users and _user queries (default: true)"),
-	sendPasswordResetEmail: z.boolean().optional().describe("Enable _sendPasswordResetEmail mutation (default: true)")
+	sendPasswordResetEmail: z.boolean().optional().describe("Enable _sendPasswordResetEmail mutation (default: true)"),
+	requestMfaSettingsUrl: z.boolean().optional().describe("Enable _requestMfaSettingsUrl query (default: true)"),
+	unenrollMfa: z.boolean().optional().describe("Enable _unenrollMfa mutation (default: true)")
 })]).describe("Configuration for GraphQL operations on IdP users.\nAll operations are enabled by default (undefined or true = enabled, false = disabled).").transform((val) => normalizeIdPGqlOperations(val));
 const IdPLangSchema = z.enum(["en", "ja"]).describe("IdP UI language");
-const IdPUserAuthPolicySchema = z.object({
+const allowedReturnOriginPattern = /^(https?:\/\/[a-zA-Z0-9.-]+(:[0-9]+)?|[a-z0-9][a-z0-9-]{1,61}[a-z0-9]:url)$/;
+const IdPUserAuthPolicySchema = z.strictObject({
 	useNonEmailIdentifier: z.boolean().optional().describe("Use non-email identifier for usernames"),
 	allowSelfPasswordReset: z.boolean().optional().describe("Allow users to reset their own passwords"),
 	passwordRequireUppercase: z.boolean().optional().describe("Require uppercase letters in passwords"),
@@ -5194,7 +5878,11 @@ const IdPUserAuthPolicySchema = z.object({
 	allowedEmailDomains: z.array(z.string()).optional().describe("Restrict registration to these email domains"),
 	allowGoogleOauth: z.boolean().optional().describe("Enable Google OAuth login"),
 	allowMicrosoftOauth: z.boolean().optional().describe("Enable Microsoft OAuth login"),
-	disablePasswordAuth: z.boolean().optional().describe("Disable password-based authentication")
+	disablePasswordAuth: z.boolean().optional().describe("Disable password-based authentication"),
+	enableMfa: z.boolean().optional().describe("Make TOTP MFA available for users in this namespace"),
+	requireMfa: z.boolean().optional().describe("Require TOTP MFA enrollment and challenge for password-authenticated users (requires enableMfa)"),
+	allowedReturnOrigins: z.array(z.string().regex(allowedReturnOriginPattern, "must be an http(s) origin like \"https://app.example.com\" (scheme + host + optional port, no path/query/fragment) or a static-website placeholder like \"<name>:url\"")).optional().describe("Application origins (scheme + host + optional port) allowed as MFA self-service return targets"),
+	mfaIssuer: z.string().max(64, "mfaIssuer must be 64 characters or less").optional().describe("Label shown next to the user account in authenticator apps")
 }).refine((data) => data.passwordMinLength === void 0 || data.passwordMaxLength === void 0 || data.passwordMinLength <= data.passwordMaxLength, {
 	message: "passwordMinLength must be less than or equal to passwordMaxLength",
 	path: ["passwordMinLength"]
@@ -5222,9 +5910,15 @@ const IdPUserAuthPolicySchema = z.object({
 }).refine((data) => !data.disablePasswordAuth || !data.allowSelfPasswordReset, {
 	message: "disablePasswordAuth cannot be used with allowSelfPasswordReset",
 	path: ["disablePasswordAuth"]
+}).refine((data) => !data.requireMfa || data.enableMfa === true, {
+	message: "requireMfa requires enableMfa to be enabled",
+	path: ["requireMfa"]
+}).refine((data) => !data.enableMfa || data.allowedReturnOrigins && data.allowedReturnOrigins.length > 0, {
+	message: "enableMfa requires allowedReturnOrigins to list at least one origin so MFA self-service has a valid return target",
+	path: ["enableMfa"]
 });
 const emailFieldSchema = z.string().max(200, "must be 200 characters or less").regex(/^[^\r\n]*$/, "must not contain newline characters");
-const IdPEmailConfigSchema = z.object({
+const IdPEmailConfigSchema = z.strictObject({
 	fromName: emailFieldSchema.optional().describe("Default sender display name for emails"),
 	passwordResetSubject: emailFieldSchema.optional().describe("Default subject for password reset emails")
 }).describe("Namespace-level email configuration defaults");
@@ -5233,18 +5927,18 @@ const IdPPermissionOperandSchema = z.union([
 	z.boolean(),
 	z.array(z.string()).readonly(),
 	z.array(z.boolean()).readonly(),
-	z.object({ user: z.string() }),
-	z.object({ idpUser: z.enum([
+	z.strictObject({ user: z.string() }),
+	z.strictObject({ idpUser: z.enum([
 		"id",
 		"name",
 		"disabled"
 	]) }),
-	z.object({ oldIdpUser: z.enum([
+	z.strictObject({ oldIdpUser: z.enum([
 		"id",
 		"name",
 		"disabled"
 	]) }),
-	z.object({ newIdpUser: z.enum([
+	z.strictObject({ newIdpUser: z.enum([
 		"id",
 		"name",
 		"disabled"
@@ -5262,7 +5956,7 @@ const IdPPermissionConditionSchema = z.tuple([
 	IdPPermissionOperandSchema
 ]).readonly();
 const IdPActionPermissionSchema = z.union([
-	z.object({
+	z.strictObject({
 		conditions: z.union([IdPPermissionConditionSchema, z.array(IdPPermissionConditionSchema).readonly()]),
 		description: z.string().optional(),
 		permit: z.boolean().optional()
@@ -5283,19 +5977,20 @@ const IdPActionPermissionSchema = z.union([
 		return boolIndex === -1 || boolIndex === arr.length - 1;
 	}, { message: "Boolean permit flag must only appear at the end" }).readonly()
 ]);
-const IdPPermissionSchema = z.object({
+const IdPPermissionSchema = z.strictObject({
 	create: z.array(IdPActionPermissionSchema).readonly(),
 	read: z.array(IdPActionPermissionSchema).readonly(),
 	update: z.array(IdPActionPermissionSchema).readonly(),
 	delete: z.array(IdPActionPermissionSchema).readonly(),
-	sendPasswordResetEmail: z.array(IdPActionPermissionSchema).readonly()
+	sendPasswordResetEmail: z.array(IdPActionPermissionSchema).readonly().optional(),
+	unenrollMfa: z.array(IdPActionPermissionSchema).readonly().optional()
 }).describe("Per-operation permission policies for IdP users");
-const IdPSchema = z.object({
+const IdPSchema = z.strictObject({
 	name: z.string().describe("IdP service name"),
 	authorization: z.union([
 		z.literal("insecure"),
 		z.literal("loggedIn"),
-		z.object({ cel: z.string() })
+		z.strictObject({ cel: z.string() })
 	]).optional().describe("Authorization mode for IdP API access"),
 	clients: z.array(z.string()).describe("OAuth2 client names that can use this IdP"),
 	lang: IdPLangSchema.optional().describe("UI language for IdP pages"),
@@ -5304,20 +5999,26 @@ const IdPSchema = z.object({
 	gqlOperations: IdPGqlOperationsSchema.optional().describe("Configure which GraphQL operations are enabled"),
 	emailConfig: IdPEmailConfigSchema.optional().describe("Namespace-level email configuration defaults"),
 	permission: IdPPermissionSchema.optional().describe("Per-operation permission policies for IdP users")
+}).refine((data) => !data.userAuthPolicy?.enableMfa || data.gqlOperations?.unenrollMfa === false || data.permission !== void 0 && data.permission.unenrollMfa !== void 0, {
+	message: "permission.unenrollMfa must be set explicitly when userAuthPolicy.enableMfa is true (set [{ conditions: [...], permit: true }] to allow, or [] to deny all). permission itself must also be defined. The requirement is only relaxed when gqlOperations.unenrollMfa is false.",
+	path: ["permission", "unenrollMfa"]
+}).refine((data) => !data.permission || data.userAuthPolicy?.disablePasswordAuth === true || data.gqlOperations?.sendPasswordResetEmail === false || data.permission.sendPasswordResetEmail !== void 0, {
+	message: "permission.sendPasswordResetEmail must be set explicitly when password authentication is enabled (set [{ conditions: [...], permit: true }] to allow, or [] to deny; only optional when userAuthPolicy.disablePasswordAuth is true or gqlOperations.sendPasswordResetEmail is false)",
+	path: ["permission", "sendPasswordResetEmail"]
 }).brand("IdPConfig");
 
 //#endregion
 //#region src/parser/service/secrets/schema.ts
 const nameSchema = z.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/);
 const secretsVaultSchema = z.record(nameSchema, z.string().nullish());
-const SecretsSchema = z.object({
+const SecretsSchema = z.strictObject({
 	vaults: z.record(nameSchema, secretsVaultSchema),
-	options: z.object({ ignoreNullishValues: z.boolean() })
+	options: z.strictObject({ ignoreNullishValues: z.boolean() })
 });
 
 //#endregion
 //#region src/parser/service/staticwebsite/schema.ts
-const StaticWebsiteSchema = z.object({
+const StaticWebsiteSchema = z.strictObject({
 	name: z.string().describe("Static website name"),
 	description: z.string().optional().describe("Static website description"),
 	allowedIpAddresses: z.array(z.string()).optional().describe("IP addresses allowed to access the website"),
@@ -5378,6 +6079,12 @@ function defineResolver(config) {
 		subgraphs
 	};
 }
+function stripIdpProviderHelper(idpConfig) {
+	const configWithProvider = idpConfig;
+	if (typeof configWithProvider.provider !== "function") return idpConfig;
+	const { provider: _provider, ...config } = configWithProvider;
+	return config;
+}
 function defineIdp(config) {
 	const idpServices = [];
 	const subgraphs = [];
@@ -5391,7 +6098,7 @@ function defineIdp(config) {
 		if (idpNames.has(name)) throw new Error(`IdP with name "${name}" already defined.`);
 		idpNames.add(name);
 		if (!("external" in idpConfig)) {
-			const idp = IdPSchema.parse(idpConfig);
+			const idp = IdPSchema.parse(stripIdpProviderHelper(idpConfig));
 			idpServices.push(idp);
 		}
 		subgraphs.push({
@@ -5433,11 +6140,17 @@ function defineHttpAdapterService(config) {
 	if (!config) return;
 	return createHttpAdapterService({ config });
 }
+function stripStaticWebsiteUrlHelper(config) {
+	const configWithUrl = config;
+	if (configWithUrl.url !== `${config.name}:url`) return config;
+	const { url: _url, ...websiteConfig } = configWithUrl;
+	return websiteConfig;
+}
 function defineStaticWebsites(websites) {
 	const staticWebsiteServices = [];
 	const websiteNames = /* @__PURE__ */ new Set();
 	(websites ?? []).forEach((config) => {
-		const website = StaticWebsiteSchema.parse(config);
+		const website = StaticWebsiteSchema.parse(stripStaticWebsiteUrlHelper(config));
 		if (websiteNames.has(website.name)) throw new Error(`Static website with name "${website.name}" already defined.`);
 		websiteNames.add(website.name);
 		staticWebsiteServices.push(website);
@@ -5609,7 +6322,7 @@ async function loadApplication(params) {
 	};
 	for (const pipeline of resolverResult.resolverServices) {
 		const resolverBundles = await bundleResolvers(pipeline.namespace, pipeline.config, triggerContext, bundleCache, inlineSourcemap, bundleLogLevel);
-		for (const [name, code] of resolverBundles) bundledScripts.resolvers.set(name, code);
+		for (const [name, code] of resolverBundles) bundledScripts.resolvers.set(resolverBundleKey(pipeline.namespace, name), code);
 	}
 	if (executorService) bundledScripts.executors = await bundleExecutors({
 		config: executorService.config,
@@ -5676,5 +6389,5 @@ async function loadApplication(params) {
 }
 
 //#endregion
-export { loadAccessToken as A, getDistDir as C, deleteUserTokens as D, loadConfig as E, removeLegacyUserAlias as F, resolveTokens as I, saveUserTokens as L, loadMachineUserName as M, loadWorkspaceId as N, fetchLatestToken as O, readPlatformConfig as P, writePlatformConfig as R, createBundleCache as S, hashFile as T, composeFunctionTreeshakeOptions as _, getApplicationAuthNamespace as a, getPluginGenerationDependencies as b, HTTP_METHODS as c, buildResolverOperationHookExpr as d, assertUniqueLocalTailorDBTypeNames as f, platformBundleDefinePlugin as g, stringifyFunction as h, resolveInlineSourcemap as i, loadConfigPath as j, findConfigUserKey as k, INVOKER_EXPR as l, TailorDBTypeSchema as m, generatePluginFilesIfNeeded as n, WorkflowJobSchema as o, assertUniqueTailorDBTypeNamesWithExternal as p, loadApplication as r, ResolverSchema as s, defineApplication as t, buildExecutorArgsExpr as u, createLogLevelTreeshakeOptions as v, hashContent as w, hasGenerationHooks as x, resolveBundleLogLevel as y };
-//# sourceMappingURL=application-DqS1yBg3.mjs.map
+export { getConsoleBaseUrl as $, hasUserTokenEntry as A, removeLegacyUserAlias as B, getDistDir as C, deleteUserTokens as D, loadConfig as E, loadPlatformClientConfig as F, closeConnectionPool as G, resolveUserTokenKey as H, loadStoredUserTokens as I, fetchAllTolerant as J, defaultPlatformBaseUrl as K, loadWorkspaceId as L, loadConfigPath as M, loadConsoleBaseUrl as N, fetchLatestToken as O, loadMachineUserName as P, fetchUserInfo as Q, platformConfigFromProfile as R, createBundleCache as S, hashFile as T, saveUserTokens as U, resolveConfigUser as V, writePlatformConfig as W, fetchPaged as X, fetchMachineUserToken as Y, fetchPlatformMachineUserToken as Z, composeFunctionTreeshakeOptions as _, resolveInlineSourcemap as a, isDefaultPlatform as at, getPluginGenerationDependencies as b, ResolverSchema as c, buildExecutorArgsExpr as d, getOAuth2ClientId as et, buildResolverOperationHookExpr as f, platformBundleDefinePlugin as g, stringifyFunction as h, resolverBundleKey as i, initOperatorClient as it, loadAccessToken as j, hasAnyUserTokenEntry as k, HTTP_METHODS as l, assertUniqueTailorDBTypeNamesWithExternal as m, generatePluginFilesIfNeeded as n, getPlatformBaseUrl as nt, getApplicationAuthNamespace as o, resolveStaticWebsiteUrls as ot, assertUniqueLocalTailorDBTypeNames as p, fetchAll as q, loadApplication as r, initOAuth2Client as rt, WorkflowJobSchema as s, byName as st, defineApplication as t, getOrNull as tt, INVOKER_EXPR as u, createLogLevelTreeshakeOptions as v, hashContent as w, hasGenerationHooks as x, resolveBundleLogLevel as y, readPlatformConfig as z };
+//# sourceMappingURL=application-eHp9jXld.mjs.map