@tailor-platform/sdk 2.0.0-next.10 → 2.0.0-next.11

package/dist/{register-ts-hook-BAHMwxfG.mjs → register-ts-hook-LYV7zH-e.mjs}

@@ -1,9 +1,9 @@
 import { t as db } from "./schema--xYWRGfe.mjs";
-import { $ as CreateAuthHookRequestSchema, B as IdPLang, Bt as Subgraph_ServiceType, C as CreateStaticWebsiteRequestSchema, Ct as AuthInvokerSchema, D as CreateSecretManagerSecretRequestSchema, Dt as AuthSCIMAttribute_Type, Et as AuthSCIMAttribute_Mutability, Ft as CreateApplicationRequestSchema, H as IdPPermissionPermit, Ht as UpdateAIGatewayRequestSchema, I as PipelineResolver_OperationType, It as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, Jt as FilterSchema, K as CreateExecutorExecutorRequestSchema, Kt as ConditionSchema, L as CreateIdPServiceRequestSchema, Lt as UpdateApplicationRequestSchema, M as CreatePipelineServiceRequestSchema, Mt as UserProfileProviderConfig_UserProfileProviderType, N as UpdatePipelineResolverRequestSchema, O as CreateSecretManagerVaultRequestSchema, Ot as AuthSCIMAttribute_Uniqueness, P as UpdatePipelineServiceRequestSchema, Q as CreateAuthConnectionRequestSchema, R as UpdateIdPServiceRequestSchema, S as AddCustomDomainRequestSchema, St as AuthIDPConfig_AuthType, Tt as AuthOAuth2Client_GrantType, U as FunctionExecution_Status, V as IdPPermissionOperator, Vt as CreateAIGatewayRequestSchema, X as ExecutorTargetType, Y as ExecutorJobStatus, Yt as PageDirection, Z as ExecutorTriggerType, _ as TailorDBGQLPermission_Permit, _t as UpdateUserProfileConfigRequestSchema, a as CreateWorkflowRequestSchema, at as CreateAuthServiceRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthConnection_Type, ct as UpdateAuthConnectionRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as UpdateAuthMachineUserRequestSchema, et as CreateAuthIDPConfigRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as UpdateAuthOAuth2ClientRequestSchema, g as TailorDBGQLPermission_Operator, gt as UpdateTenantConfigRequestSchema, h as TailorDBGQLPermission_Action, ht as UpdateAuthServiceRequestSchema, i as CreateWorkflowJobFunctionRequestSchema, it as CreateAuthSCIMResourceRequestSchema, j as CreatePipelineResolverRequestSchema, jt as TenantProviderConfig_TenantProviderType, k as UpdateSecretManagerSecretRequestSchema, kt as AuthSCIMConfig_AuthorizationType, l as WorkflowExecution_Status, lt as UpdateAuthHookRequestSchema, mt as UpdateAuthSCIMResourceRequestSchema, nt as CreateAuthOAuth2ClientRequestSchema, o as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as CreateTenantConfigRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as UpdateAuthSCIMConfigRequestSchema, q as UpdateExecutorExecutorRequestSchema, qt as Condition_Operator, r as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, rt as CreateAuthSCIMConfigRequestSchema, s as UpdateWorkflowRequestSchema, st as CreateUserProfileConfigRequestSchema, t as WorkspacePlatformUserRole, tt as CreateAuthMachineUserRequestSchema, u as WorkflowJobExecution_Status, ut as UpdateAuthIDPConfigRequestSchema, v as TailorDBTypeSchema, w as UpdateStaticWebsiteRequestSchema, wt as AuthOAuth2Client_ClientType, x as TailorDBType_PermitAction, xt as AuthHookPoint, y as TailorDBType_Permission_Operator, yt as AuthConnection_Status, zt as ApplicationSchemaUpdateAttemptStatus } from "./workspace_resource_pb-UGK1SSn_.mjs";
+import { $ as CreateAuthHookRequestSchema, B as IdPLang, Bt as Subgraph_ServiceType, C as CreateStaticWebsiteRequestSchema, Ct as AuthInvokerSchema, D as CreateSecretManagerSecretRequestSchema, Dt as AuthSCIMAttribute_Type, Et as AuthSCIMAttribute_Mutability, Ft as CreateApplicationRequestSchema, H as IdPPermissionPermit, Ht as UpdateAIGatewayRequestSchema, I as PipelineResolver_OperationType, It as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, Jt as FilterSchema, K as CreateExecutorExecutorRequestSchema, Kt as ConditionSchema, L as CreateIdPServiceRequestSchema, Lt as UpdateApplicationRequestSchema, M as CreatePipelineServiceRequestSchema, Mt as UserProfileProviderConfig_UserProfileProviderType, N as UpdatePipelineResolverRequestSchema, O as CreateSecretManagerVaultRequestSchema, Ot as AuthSCIMAttribute_Uniqueness, P as UpdatePipelineServiceRequestSchema, Q as CreateAuthConnectionRequestSchema, R as UpdateIdPServiceRequestSchema, S as AddCustomDomainRequestSchema, St as AuthIDPConfig_AuthType, Tt as AuthOAuth2Client_GrantType, U as FunctionExecution_Status, V as IdPPermissionOperator, Vt as CreateAIGatewayRequestSchema, X as ExecutorTargetType, Y as ExecutorJobStatus, Yt as PageDirection, Z as ExecutorTriggerType, _ as TailorDBGQLPermission_Permit, _t as UpdateUserProfileConfigRequestSchema, a as CreateWorkflowRequestSchema, at as CreateAuthServiceRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthConnection_Type, ct as UpdateAuthConnectionRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as UpdateAuthMachineUserRequestSchema, et as CreateAuthIDPConfigRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as UpdateAuthOAuth2ClientRequestSchema, g as TailorDBGQLPermission_Operator, gt as UpdateTenantConfigRequestSchema, h as TailorDBGQLPermission_Action, ht as UpdateAuthServiceRequestSchema, i as CreateWorkflowJobFunctionRequestSchema, it as CreateAuthSCIMResourceRequestSchema, j as CreatePipelineResolverRequestSchema, jt as TenantProviderConfig_TenantProviderType, k as UpdateSecretManagerSecretRequestSchema, kt as AuthSCIMConfig_AuthorizationType, l as WorkflowExecution_Status, lt as UpdateAuthHookRequestSchema, mt as UpdateAuthSCIMResourceRequestSchema, nt as CreateAuthOAuth2ClientRequestSchema, o as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as CreateTenantConfigRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as UpdateAuthSCIMConfigRequestSchema, q as UpdateExecutorExecutorRequestSchema, qt as Condition_Operator, r as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, rt as CreateAuthSCIMConfigRequestSchema, s as UpdateWorkflowRequestSchema, st as CreateUserProfileConfigRequestSchema, t as WorkspacePlatformUserRole, tt as CreateAuthMachineUserRequestSchema, u as WorkflowJobExecution_Status, ut as UpdateAuthIDPConfigRequestSchema, v as TailorDBTypeSchema, w as UpdateStaticWebsiteRequestSchema, wt as AuthOAuth2Client_ClientType, x as TailorDBType_PermitAction, xt as AuthHookPoint, y as TailorDBType_Permission_Operator, yt as AuthConnection_Status, zt as ApplicationSchemaUpdateAttemptStatus } from "./workspace_resource_pb-DXnO2AT-.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
 import { a as parseBoolean, i as symbols, n as logger, o as renderTable, r as styles, t as CIPromptError } from "./logger-CXQq9YIp.mjs";
-import { A as defaultPlatformBaseUrl, B as getPlatformBaseUrl, C as getPluginGenerationDependencies, D as hashContent, E as getDistDir, G as normalizeBaseUrl, H as initOperatorClient, I as fetchUserInfo, J as byName, K as rememberPlatformConfigForToken, L as getConsoleBaseUrl, M as fetchAllTolerant, N as fetchMachineUserToken, O as hashFile, P as fetchPaged, R as getOAuth2ClientId, T as createBundleCache, U as isDefaultPlatform, V as initOAuth2Client, W as isNotFoundError, X as LOG_LEVELS, Y as createApplyLimiter, _ as stringifyFunction, f as buildExecutorArgsExpr, g as assertUniqueTailorDBTypeNamesWithExternal, h as assertUniqueLocalTailorDBTypeNames, i as resolverBundleKey, j as fetchAll, n as generatePluginFilesIfNeeded, o as getApplicationAuthNamespace, p as buildResolverOperationHookExpr, q as resolveStaticWebsiteUrls, r as loadApplication, s as WorkflowJobFunctionExecutionPolicySchema, t as defineApplication, u as HTTP_METHODS, v as resolveTSConfigWithFallback, w as hasGenerationHooks, y as platformBundleDefinePlugin, z as getOrNull } from "./application-miwiXtB4.mjs";
-import { c as stripTailorDBTypeBuilderHelpers, g as functionSchema, h as loadFilesWithIgnores, t as createExecutorService, u as TailorDBTypeSchema$1 } from "./service-BNtPsK9Q.mjs";
+import { $ as LOG_LEVELS, A as hashContent, B as getConsoleBaseUrl, D as hasGenerationHooks, E as getPluginGenerationDependencies, F as fetchAllTolerant, G as initOperatorClient, H as getOrNull, I as fetchMachineUserToken, J as normalizeBaseUrl, K as isDefaultPlatform, L as fetchPaged, N as defaultPlatformBaseUrl, O as createBundleCache, P as fetchAll, Q as createApplyLimiter, T as createBundleLog, U as getPlatformBaseUrl, V as getOAuth2ClientId, W as initOAuth2Client, X as resolveStaticWebsiteUrls, Y as rememberPlatformConfigForToken, Z as byName, _ as stringifyFunction, b as resolveTSConfigWithFallback, f as buildExecutorArgsExpr, g as assertUniqueTailorDBTypeNamesWithExternal, h as assertUniqueLocalTailorDBTypeNames, i as resolverBundleKey, j as hashFile, k as getDistDir, n as generatePluginFilesIfNeeded, o as getApplicationAuthNamespace, p as buildResolverOperationHookExpr, q as isNotFoundError, r as loadApplication, s as WorkflowJobFunctionExecutionPolicySchema, t as defineApplication, u as HTTP_METHODS, v as createGeneratedEntryResolverPlugin, x as platformBundleDefinePlugin, y as createTsconfigPathsPlugin, z as fetchUserInfo } from "./application-CM6hKnSK.mjs";
+import { c as stripTailorDBTypeBuilderHelpers, g as functionSchema, h as loadFilesWithIgnores, t as createExecutorService, u as TailorDBTypeSchema$1 } from "./service-k1xy_A5G.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "./package-json-8b0O9TlX.mjs";
 import { t as userAgent } from "./user-agent-Bgsszb5I.mjs";
@@ -315,6 +315,11 @@ const envValueSchema = z.union([
 	z.number(),
 	z.boolean()
 ]);
+const allowedSecretValueSchema = z.union([z.string(), z.number()]);
+const envEntrySchema = z.union([envValueSchema, z.strictObject({
+	value: allowedSecretValueSchema,
+	allowSecretReason: z.string().min(1, { message: "'allowSecretReason' must state why the value is safe to keep in 'env'." })
+})]);
 const LogLevelSchema = z.enum(LOG_LEVELS);
 const logLevelSchema = z.string().refine((value) => LogLevelSchema.safeParse(value.trim().toUpperCase()).success, { message: `'logLevel' must be one of: ${LOG_LEVELS.join(", ")}.` });
 /**
@@ -331,7 +336,7 @@ const logLevelSchema = z.string().refine((value) => LogLevelSchema.safeParse(val
 const AppConfigSchema = z.strictObject({
 	id: z.uuid({ message: "'id' must be a UUID." }).optional(),
 	name: z.string().min(1, { message: "'name' must be a non-empty string." }),
-	env: z.record(z.string(), envValueSchema).optional(),
+	env: z.record(z.string(), envEntrySchema).optional(),
 	cors: z.array(z.string()).optional(),
 	allowedIpAddresses: z.array(z.string()).optional(),
 	disableIntrospection: z.boolean().optional(),
@@ -1105,6 +1110,213 @@ function loadConfigPath(configPath) {
 	return findUpSync(DEFAULT_CONFIG_FILENAME);
 }
 
+//#endregion
+//#region src/cli/shared/env-secret-scan.ts
+const AWS_RULE_ID = "@secretlint/secretlint-rule-aws";
+const RULE_ID_PREFIX = "@secretlint/secretlint-rule-";
+/**
+* Honors `secretlint-disable` comments found in the scanned text. `env` values
+* are author-controlled text, so leaving this rule in let a value act as a
+* directive and suppress the findings of the entries after it — defeating the
+* check without the explicit allowance.
+*
+* Matched by id on purpose: the rule declares itself a `scanner`, so it cannot
+* be told apart by `meta.type`, and the preset's `disabled` option has no
+* effect on it.
+*/
+const COMMENT_DIRECTIVE_RULE_ID = "@secretlint/secretlint-rule-filter-comments";
+const HIGH_ENTROPY_DETECTOR = "high-entropy";
+/**
+* The scanned document is assembled in memory, so the path only labels the
+* source for the scanner and never reaches the filesystem.
+*/
+const VIRTUAL_SOURCE_PATH = "/tailor-config-env";
+const ENTROPY_MIN_LENGTH = 20;
+/**
+* Bits per character. Above 4.0 no hex-only string can reach the threshold,
+* which keeps commit hashes, UUIDs and slugs out of the heuristic while still
+* catching base64/base62 credentials.
+*/
+const ENTROPY_MIN_BITS_PER_CHAR = 4.2;
+const TOKEN_LIKE_VALUE = /^[A-Za-z0-9+/=_.-]+$/;
+/**
+* A single command can load the same config repeatedly — `setup generate`
+* derives five separate answers, each through its own `loadConfig` — so results
+* are memoized on the entries scanned. Without this the scanner would run, and
+* warnings would print, once per load.
+*
+* Keys are digests rather than the serialized entries, so the cache does not
+* hold the values it was asked to judge for the life of the process.
+*/
+const scans = /* @__PURE__ */ new Map();
+/**
+* Resolve an `env` entry to the value that gets deployed.
+* @param entry - Entry as written in the config
+* @returns The entry's value, unwrapped when it carries an `allowSecretReason`
+*/
+function resolveEnvValue(entry) {
+	return isAllowedSecret(entry) ? entry.value : entry;
+}
+/**
+* Scan `env` values for credentials.
+*
+* Entries wrapped as `{ value, allowSecretReason }` are skipped.
+* Provider-specific matches are reported as errors; values that merely look
+* randomly generated are reported as warnings.
+* @param input - `env` entries as written in the config
+* @returns Provider matches first, then entropy warnings; empty when nothing matched
+*/
+async function scanEnvForSecrets(input) {
+	const entries = Object.entries(input.env ?? {}).filter(([, entry]) => !isAllowedSecret(entry)).map(([key, entry]) => [key, resolveEnvValue(entry)]);
+	if (entries.length === 0) return [];
+	const findings = await scanWithProviderRules(entries);
+	const alreadyFound = new Set(findings.map((finding) => finding.key));
+	for (const [key, value] of entries) {
+		if (alreadyFound.has(key) || typeof value !== "string") continue;
+		if (looksRandomlyGenerated(value)) findings.push({
+			key,
+			detector: HIGH_ENTROPY_DETECTOR,
+			severity: "warning"
+		});
+	}
+	return findings;
+}
+/**
+* Report secret-looking `env` values, failing when a credential is identified.
+*
+* Warnings are logged and do not fail the command. Repeated calls for the same
+* entries reuse the first result.
+* @param input - `env` entries as written in the config
+* @returns Promise that resolves when the entries carry no credential
+* @throws When a value is identified as a credential
+*/
+async function assertEnvHasNoSecrets(input) {
+	const key = createHash("sha256").update(JSON.stringify([input.configPath ?? "", input.env ?? {}])).digest("hex");
+	const pending = scans.get(key);
+	if (pending) return pending;
+	const scan = reportEnvSecrets(input);
+	scans.set(key, scan);
+	return scan;
+}
+/**
+* Log warnings and throw on credentials found in `env`.
+* @param input - `env` entries as written in the config
+* @throws When a value is identified as a credential
+*/
+async function reportEnvSecrets(input) {
+	const findings = await scanEnvForSecrets(input);
+	for (const finding of findings) {
+		if (finding.severity !== "warning") continue;
+		logger.warn(`env.${finding.key} looks like a randomly generated credential. If it is one, move it to Secret Manager; otherwise allow it with ${styles.bold("allowSecretReason")}.`);
+	}
+	const errors = findings.filter((finding) => finding.severity === "error");
+	if (errors.length === 0) return;
+	const location = input.configPath ? ` in ${input.configPath}` : "";
+	const list = errors.map((error) => {
+		const matched = error.rule ? `${error.detector}: ${error.rule}` : error.detector;
+		const reference = error.docsUrl ? `\n    ${error.docsUrl}` : "";
+		return `  - env.${error.key} (matched ${matched})${reference}`;
+	}).join("\n");
+	const example = errors[0]?.key ?? "KEY";
+	throw new Error(`Secret detected in 'env'${location}:\n${list}\n'env' values are deployed as plaintext and are readable by anyone who can read the application's configuration. Define these with defineSecretManager() instead, and read them through Secret Manager at runtime.
+If a value is genuinely safe to keep in 'env', allow it where it is defined: ${example}: { value: ..., allowSecretReason: "<why this is safe>" }`);
+}
+/**
+* Run the provider rule set over all entries at once.
+*
+* Entries are scanned as one `KEY=value` document because some rules only match
+* when the key name accompanies the value (`AWS_SECRET_ACCESS_KEY`, database
+* connection strings). Each finding is mapped back to its key through the
+* character range the entry occupies, which stays correct for multi-line values.
+* @param entries - `env` entries to scan
+* @returns Error-severity findings, deduplicated per key and rule
+*/
+async function scanWithProviderRules(entries) {
+	const [{ lintSource }, { rules }] = await Promise.all([import("@secretlint/core"), import("@secretlint/secretlint-rule-preset-recommend")]);
+	const ranges = [];
+	let content = "";
+	for (const [key, value] of entries) {
+		const line = `${key}=${String(value)}`;
+		ranges.push({
+			key,
+			start: content.length,
+			end: content.length + line.length
+		});
+		content += `${line}\n`;
+	}
+	const result = await lintSource({
+		source: {
+			filePath: VIRTUAL_SOURCE_PATH,
+			content,
+			contentType: "text"
+		},
+		options: {
+			maskSecrets: true,
+			noPhysicFilePath: true,
+			config: { rules: rules.filter((rule) => rule.meta.id !== COMMENT_DIRECTIVE_RULE_ID).map((rule) => ({
+				id: rule.meta.id,
+				rule,
+				...rule.meta.id === AWS_RULE_ID ? { options: { enableIDScanRule: true } } : {}
+			})) }
+		}
+	});
+	const findings = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const message of result.messages) {
+		const entry = ranges.find((range) => message.range[0] >= range.start && message.range[0] < range.end);
+		if (!entry) continue;
+		const detector = message.ruleId.startsWith(RULE_ID_PREFIX) ? message.ruleId.slice(28) : message.ruleId;
+		const dedupeKey = JSON.stringify([
+			entry.key,
+			detector,
+			message.messageId
+		]);
+		if (seen.has(dedupeKey)) continue;
+		seen.add(dedupeKey);
+		findings.push({
+			key: entry.key,
+			detector,
+			rule: message.messageId,
+			...message.docsUrl ? { docsUrl: message.docsUrl } : {},
+			severity: "error"
+		});
+	}
+	return findings;
+}
+/**
+* Decide whether an entry carries its own allowance.
+* @param entry - Entry as written in the config
+* @returns True when the entry is the `{ value, allowSecretReason }` form
+*/
+function isAllowedSecret(entry) {
+	return typeof entry === "object";
+}
+/**
+* Decide whether a value carries enough randomness to look generated rather
+* than authored.
+* @param value - `env` value to inspect
+* @returns True when the value is long, token-shaped and high-entropy
+*/
+function looksRandomlyGenerated(value) {
+	if (value.length < ENTROPY_MIN_LENGTH || !TOKEN_LIKE_VALUE.test(value)) return false;
+	return shannonEntropyPerChar(value) >= ENTROPY_MIN_BITS_PER_CHAR;
+}
+/**
+* Compute Shannon entropy of a string in bits per character.
+* @param value - String to measure
+* @returns Bits per character
+*/
+function shannonEntropyPerChar(value) {
+	const occurrences = /* @__PURE__ */ new Map();
+	for (const char of value) occurrences.set(char, (occurrences.get(char) ?? 0) + 1);
+	let entropy = 0;
+	for (const count of occurrences.values()) {
+		const probability = count / value.length;
+		entropy -= probability * Math.log2(probability);
+	}
+	return entropy;
+}
+
 //#endregion
 //#region src/cli/shared/mock.ts
 /**
@@ -1152,6 +1364,12 @@ async function loadConfig(configPath, options = {}) {
 		const issues = validated.error.issues.map((i) => `  - ${i.path.join(".") || "(root)"}: ${i.message}`).join("\n");
 		throw new Error(`Invalid Tailor config in ${resolvedPath}:\n${issues}`);
 	}
+	const appConfig = configModule.default;
+	await assertEnvHasNoSecrets({
+		env: appConfig.env,
+		configPath: resolvedPath
+	});
+	const env = appConfig.env ? Object.fromEntries(Object.entries(appConfig.env).map(([key, entry]) => [key, resolveEnvValue(entry)])) : void 0;
 	const allPlugins = [];
 	for (const value of Object.values(configModule)) if (Array.isArray(value)) {
 		const pluginParsed = value.reduce((acc, item) => {
@@ -1169,6 +1387,7 @@ async function loadConfig(configPath, options = {}) {
 	return {
 		config: {
 			...configModule.default,
+			...env ? { env } : {},
 			path: resolvedPath
 		},
 		plugins: allPlugins
@@ -1456,6 +1675,83 @@ function createCacheManager(options) {
 	};
 }
 
+//#endregion
+//#region src/cli/shared/publish-events.ts
+/**
+* How each event-publishing resource is named in user-facing messages.
+*
+* Every message naming one of these reads from here, so a conflict error and the
+* confirmation that lists the same resource cannot drift apart.
+*/
+const eventSourceLabel = {
+	tailorDBType: (name) => `TailorDB type "${name}"`,
+	resolver: (name) => `Resolver "${name}"`,
+	idpService: (name) => `IdP service "${name}"`,
+	workflow: (name) => `Workflow "${name}"`,
+	workflowJob: (name) => `Job "${name}"`,
+	workflowJobs: (workflowName) => `Jobs of workflow "${workflowName}"`
+};
+/** Opt-out conflict details per event-publishing resource. */
+const publishEventsConflict = {
+	tailorDBType: (name) => ({
+		resource: eventSourceLabel.tailorDBType(name),
+		trigger: "record"
+	}),
+	resolver: (name) => ({
+		resource: eventSourceLabel.resolver(name),
+		trigger: "resolverExecuted"
+	}),
+	idpService: (name) => ({
+		resource: eventSourceLabel.idpService(name),
+		trigger: "idpUser"
+	}),
+	workflow: (name) => ({
+		resource: eventSourceLabel.workflow(name),
+		trigger: "workflowExecution"
+	}),
+	workflowJob: (name) => ({
+		resource: eventSourceLabel.workflowJob(name),
+		trigger: "workflowJobExecution",
+		subscribesTo: "a workflow that runs it"
+	})
+};
+/**
+* Build the error raised when a resource opts out of publishing that a
+* subscribing executor needs.
+* @param conflict - Resource, trigger, and subscription target named in the error
+* @returns Error message
+*/
+function publishEventsConflictError(conflict) {
+	const { resource, trigger, subscribesTo = "it" } = conflict;
+	return `${resource} has "publishEvents: false", but executors with ${trigger} triggers subscribe to ${subscribesTo}. Either remove "publishEvents: false" or remove the matching executor triggers.`;
+}
+/**
+* Reject an opt-out that a subscribing executor contradicts.
+*
+* Separate from {@link resolvePublishEvents} so a planner can reject the whole
+* config before issuing any request, rather than partway through.
+* @param params - Declared value, subscriber presence, and conflict error details
+*/
+function assertNoPublishEventsConflict(params) {
+	const { explicit, subscribed, conflict } = params;
+	if (explicit === false && subscribed) throw new Error(publishEventsConflictError(conflict));
+}
+/**
+* Resolve whether a resource publishes events.
+*
+* An unset value is recomputed from the executors taking part in the run, so
+* removing the last subscribing trigger turns publishing back off. A `deploy`
+* covering several configs counts a subscriber in any of them, so a resource
+* shared across configs needs `publishEvents: true` on the resource itself only
+* to keep publishing when the subscribing config is deployed on its own.
+* @param params - Declared value, subscriber presence, and conflict error details
+* @returns Whether the resource publishes events
+*/
+function resolvePublishEvents(params) {
+	assertNoPublishEventsConflict(params);
+	return params.explicit ?? params.subscribed;
+}
+
 //#endregion
 //#region src/cli/shared/type-generator.ts
 /**
@@ -1467,6 +1763,7 @@ function createCacheManager(options) {
 function extractAttributesFromConfig(config) {
 	return collectAttributesFromConfig(config);
 }
+const isValidIdentifier = (s) => /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(s);
 /**
 * Generate the contents of the user-defined type definition file.
 * @param attributes - Attribute configuration
@@ -1486,13 +1783,10 @@ ${attributeFields}
 	const listBody = `{
     __tuple?: ${attributeList ? `[${attributeList.map(() => "string").join(", ")}]` : "[]"};
   }`;
-	const envFields = env ? Object.entries(env).map(([key, value]) => {
-		return `    ${key}: ${typeof value === "string" ? `"${value}"` : String(value)};`;
-	}).join("\n") : "";
+	const envFields = env ? Object.entries(env).map(([key, value]) => `    ${isValidIdentifier(key) ? key : JSON.stringify(key)}: ${typeof value};`).join("\n") : "";
 	const envBody = !env || Object.keys(env).length === 0 ? "{}" : `{
 ${envFields}
   }`;
-	const isValidIdentifier = (s) => /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(s);
 	const machineUserFields = machineUserNames?.length ? machineUserNames.map((name) => `    ${isValidIdentifier(name) ? name : JSON.stringify(name)}: true;`).join("\n") : "";
 	const machineUserBody = !machineUserNames || machineUserNames.length === 0 ? "{}" : `{
 ${machineUserFields}
@@ -2132,6 +2426,42 @@ function trnPrefix(workspaceId) {
 function resourceTrn(workspaceId, kind, name) {
 	return `${trnPrefix(workspaceId)}:${kind}:${name}`;
 }
+/**
+* Build the TRN for a resource nested inside another.
+*
+* The platform reads everything after the workspace id as alternating key/value
+* pairs and matches the pair list against one resource type, so a nested
+* resource is the parent's pair followed by its own. A TailorDB type is
+* `tailordb:<namespace>:type:<name>`, distinct from the namespace's own
+* `tailordb:<namespace>`.
+* @param workspaceId - Workspace ID
+* @param parent - Parent kind and name, e.g. the namespace holding the resource
+* @param child - Nested key and name, e.g. `["type", "Order"]`
+* @returns Fully-qualified TRN string
+*/
+function nestedResourceTrn(workspaceId, parent, child) {
+	return `${trnPrefix(workspaceId)}:${parent[0]}:${parent[1]}:${child[0]}:${child[1]}`;
+}
+/**
+* Build the TRN for one TailorDB type.
+* @param workspaceId - Workspace ID
+* @param namespace - TailorDB namespace holding the type
+* @param typeName - Type name
+* @returns Fully-qualified TRN string
+*/
+function tailorDBTypeTrn(workspaceId, namespace, typeName) {
+	return nestedResourceTrn(workspaceId, ["tailordb", namespace], ["type", typeName]);
+}
+/**
+* Build the TRN for one resolver.
+* @param workspaceId - Workspace ID
+* @param namespace - Resolver namespace holding the resolver
+* @param resolverName - Resolver name
+* @returns Fully-qualified TRN string
+*/
+function resolverTrn(workspaceId, namespace, resolverName) {
+	return nestedResourceTrn(workspaceId, ["pipeline", namespace], ["resolver", resolverName]);
+}
 const sdkNameLabelKey = "sdk-name";
 const sdkVersionLabelKey = "sdk-version";
 const sdkAppIdLabelKey = "sdk-app-id";
@@ -2165,28 +2495,190 @@ function isOwnedByApp(labels, appName, appId) {
 	if (labelAppId) return appId !== void 0 && labelAppId === toAppIdLabelValue(appId);
 	return labels[sdkNameLabelKey] === appName;
 }
+const dependedByAppLabelPrefix = "sdk-depended-by-app-";
+const jobDependedByAppLabelPrefix = "sdk-job-depended-by-app-";
+function prefixFor(scope) {
+	return scope === "jobs" ? jobDependedByAppLabelPrefix : dependedByAppLabelPrefix;
+}
+const RECORDABLE_APP_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/**
+* Build the label key recording that an application depends on this deploy.
+* @param appId - Stable id of the dependent application
+* @param scope - Which of the resource's values the record concerns
+* @returns Label key, or undefined when the id cannot form a valid key
+*/
+function dependedByAppLabelKey(appId, scope = "resource") {
+	return RECORDABLE_APP_ID.test(appId) ? `${prefixFor(scope)}${appId}` : void 0;
+}
+/**
+* Read the dependent applications recorded on a resource.
+*
+* Only keys {@link dependedByAppLabelKey} could have written are read back, so a
+* label the SDK could not have produced cannot raise a confirmation prompt that
+* naming no config in the run makes unanswerable.
+* @param labels - Labels currently stored on the remote resource
+* @param scope - Which of the resource's values to read records for
+* @returns Recorded dependencies, in label-key order
+*/
+function recordedDependencies(labels, scope = "resource") {
+	if (!labels) return [];
+	const prefix = prefixFor(scope);
+	return Object.entries(labels).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).flatMap(([key, reason]) => {
+		if (!key.startsWith(prefix)) return [];
+		const appId = key.slice(prefix.length);
+		return RECORDABLE_APP_ID.test(appId) ? [{
+			appId,
+			reason
+		}] : [];
+	});
+}
+/**
+* Key one event-publishing resource for the dependency records.
+*
+* Planners rebuild the same string from the resource they are applying, so the
+* shape is the TRN's tail rather than anything new to keep in step.
+*/
+const eventSourceKey = {
+	tailorDBType: (namespace, typeName) => `tailordb:${namespace}:type:${typeName}`,
+	resolver: (namespace, resolverName) => `pipeline:${namespace}:resolver:${resolverName}`,
+	idp: (name) => `idp:${name}`,
+	workflow: (name) => `workflow:${name}`,
+	workflowJobs: (name) => `workflow:${name}:jobs`
+};
+/**
+* Split the dependency records into the ones to write and the ones to drop.
+*
+* A record for an application outside the run appears in neither list, so
+* {@link writeMetadataLabels} keeps it: it was written when both took part, and
+* dropping it would lose the only signal that this partial deploy is about to
+* change how the resource is applied. A record for an application that does take
+* part is rewritten or dropped, so a dependency that no longer exists disappears
+* on the next deploy including both.
+*
+* A resource that declares `publishEvents` drops every record instead. Nothing
+* about it depends on which configs the run covers, so a record could only
+* produce a prompt about a change that cannot happen — and one the owner could
+* never clear on its own, since clearing needs the dependent to take part.
+* @param params - Existing labels and the run's dependency inputs
+* @returns Labels to set and label keys to delete
+*/
+function dependencyLabelWrite(params) {
+	const { existingLabels, dependentApps, runAppIds, pinned, scope = "resource" } = params;
+	if (pinned) return {
+		labels: {},
+		remove: recordedDependencies(existingLabels, scope).flatMap(({ appId }) => dependedByAppLabelKey(appId, scope) ?? [])
+	};
+	const dependents = dependentApps ?? /* @__PURE__ */ new Map();
+	const inRun = runAppIds ?? /* @__PURE__ */ new Set();
+	const labels = {};
+	for (const [appId, reason] of dependents) {
+		const key = dependedByAppLabelKey(appId, scope);
+		if (!key) throw new Error(`Application id "${appId}" cannot be recorded as a dependency of this deploy. Ids are written by deploy as lowercase UUIDs; restore the generated value in the config's "id".`);
+		labels[key] = reason;
+	}
+	return {
+		labels,
+		remove: recordedDependencies(existingLabels, scope).flatMap(({ appId }) => {
+			if (!inRun.has(appId) || dependents.has(appId)) return [];
+			const key = dependedByAppLabelKey(appId, scope);
+			return key ? [key] : [];
+		})
+	};
+}
 /**
 * Build metadata request with SDK labels.
+*
+* Sets only the SDK's own labels; {@link writeMetadataLabels} keeps the rest
+* from the labels it reads at write time.
+*
+* Without an app id the id label is removed rather than merely left unset,
+* because {@link isOwnedByApp} decides ownership by that label alone: one left
+* over from an earlier deploy would keep reading as another app's, and every
+* later deploy would ask to re-tag the same resources again.
 * @param params - Parameters for building the metadata request
 * @param params.trn - Target TRN
 * @param params.appName - Application name label
 * @param params.appId - Stable application id label (when managed by SDK)
-* @param params.existingLabels - Existing labels to preserve (optional)
 * @returns Metadata request
 */
 async function buildMetaRequest(params) {
-	const { trn, appName, appId, existingLabels } = params;
+	const { trn, appName, appId } = params;
 	const packageJson = await readPackageJson();
 	const sdkVersion = packageJson.version ? `v${packageJson.version.replace(/\./g, "-")}` : "unknown";
 	return {
 		trn,
 		labels: {
-			...existingLabels,
 			[sdkNameLabelKey]: appName,
 			[sdkVersionLabelKey]: sdkVersion,
 			...appId ? { [sdkAppIdLabelKey]: toAppIdLabelValue(appId) } : {}
-		}
+		},
+		remove: appId ? void 0 : [sdkAppIdLabelKey]
+	};
+}
+/**
+* Fold a resource's dependency records into the write already planned for it.
+*
+* The reconciliation is attached rather than computed, so it runs against the
+* labels read at write time. Whatever {@link buildMetaRequest} asked for —
+* dropping a stale `sdk-app-id`, for instance — still happens alongside it.
+* @param write - The resource's planned metadata write, mutated in place
+* @param params - The resource's key and the run's inputs
+* @returns The same write, for use as an expression
+*/
+function addDependencyRecords(write, params) {
+	const { key, dependentApps, runAppIds, pinned, scope } = params;
+	write.dependencies = [...write.dependencies ?? [], {
+		dependentApps: dependentApps?.get(key),
+		runAppIds,
+		pinned,
+		scope
+	}];
+	return write;
+}
+/**
+* Write metadata labels as a change against the resource's current labels.
+*
+* `SetMetadata` replaces the whole label map, so a request built from labels
+* read earlier deletes anything written in between. This re-reads immediately
+* before writing and applies `labels` and `remove` to what it finds, which is
+* why every label write in the SDK goes through here rather than calling
+* `client.setMetadata` directly.
+*
+* Concurrent writers are still not safe in the strict sense — that needs
+* server-side conditional writes — but a write can no longer be built from
+* state this process read at an unrelated point in time.
+*
+* A write that changes nothing does nothing — whether the caller requested no
+* change or the change turns out to already hold. Writing back what was just
+* read would still overwrite whatever landed in between, for no gain, and the
+* labels the SDK sets are unchanged on most deploys.
+* @param client - Operator client instance
+* @param write - TRN, labels to set, and label keys to delete
+* @returns Promise that resolves when the labels are written
+*/
+async function writeMetadataLabels(client, write) {
+	const { trn, labels, remove, dependencies } = write;
+	if (!Object.keys(labels ?? {}).length && !(remove ?? []).length && !dependencies?.length) return;
+	const currentLabels = (await getOrNull(() => client.getMetadata({ trn })))?.metadata?.labels ?? {};
+	const resolved = (dependencies ?? []).map((pending) => dependencyLabelWrite({
+		...pending,
+		existingLabels: currentLabels
+	}));
+	const merged = {
+		...currentLabels,
+		...labels,
+		...Object.assign({}, ...resolved.map((records) => records.labels))
 	};
+	for (const key of [...remove ?? [], ...resolved.flatMap((records) => records.remove)]) delete merged[key];
+	if (areSameLabels(currentLabels, merged)) return;
+	await client.setMetadata({
+		trn,
+		labels: merged
+	});
+}
+function areSameLabels(a, b) {
+	const keys = Object.keys(a);
+	return keys.length === Object.keys(b).length && keys.every((key) => a[key] === b[key]);
 }
 
 //#endregion
@@ -2277,14 +2769,14 @@ async function applyStaticWebsite(client, result, phase = "create-update") {
 	if (phase === "create-update") {
 		await Promise.all([...changeSet.creates.map(async (create) => {
 			await client.createStaticWebsite(create.request);
-			await client.setMetadata(create.metaRequest);
+			await writeMetadataLabels(client, create.metaRequest);
 		}), ...changeSet.updates.map(async (update) => {
 			await client.updateStaticWebsite(update.request);
-			await client.setMetadata(update.metaRequest);
+			await writeMetadataLabels(client, update.metaRequest);
 		})]);
 		await Promise.all([...customDomainChangeSet.creates.map(async (add) => {
 			await client.addCustomDomain(add.request);
-			await client.setMetadata(add.metaRequest);
+			await writeMetadataLabels(client, add.metaRequest);
 		}), ...customDomainChangeSet.deletes.map((del) => client.removeCustomDomain(del.request))]);
 	} else await Promise.all(changeSet.deletes.map((del) => client.deleteStaticWebsite(del.request)));
 }
@@ -2478,11 +2970,11 @@ async function applyAIGateway(client, result, phase = "create-update") {
 	if (phase === "create-update") await Promise.all([...changeSet.creates.map(async (create) => {
 		create.request.cors = await resolveStaticWebsiteUrls(client, assertDefined(create.request.workspaceId, "request missing workspaceId"), create.request.cors, "AIGateway CORS");
 		await client.createAIGateway(create.request);
-		await client.setMetadata(create.metaRequest);
+		await writeMetadataLabels(client, create.metaRequest);
 	}), ...changeSet.updates.map(async (update) => {
 		update.request.cors = await resolveStaticWebsiteUrls(client, assertDefined(update.request.workspaceId, "request missing workspaceId"), update.request.cors, "AIGateway CORS");
 		await client.updateAIGateway(update.request);
-		await client.setMetadata(update.metaRequest);
+		await writeMetadataLabels(client, update.metaRequest);
 	})]);
 	else await Promise.all(changeSet.deletes.map((del) => client.deleteAIGateway(del.request)));
 }
@@ -2609,11 +3101,11 @@ async function applyApplication(client, changeSet, phase = "create-update") {
 		await Promise.all([...changeSet.creates.map(async (create) => {
 			create.request.cors = await resolveStaticWebsiteUrls(client, assertDefined(create.request.workspaceId, "request missing workspaceId"), create.request.cors, "CORS");
 			await client.createApplication(create.request);
-			await client.setMetadata(create.metaRequest);
+			await writeMetadataLabels(client, create.metaRequest);
 		}), ...updates.map(async (update) => {
 			update.request.cors = await resolveStaticWebsiteUrls(client, assertDefined(update.request.workspaceId, "request missing workspaceId"), update.request.cors, "CORS");
 			await client.updateApplication(update.request);
-			await client.setMetadata(update.metaRequest);
+			await writeMetadataLabels(client, update.metaRequest);
 		})]);
 	} else await Promise.all(changeSet.deletes.map(async (del) => {
 		await client.deleteApplication(del.request);
@@ -2689,6 +3181,9 @@ function areApplicationsEqual(existing, desired) {
 */
 async function planApplication(context, httpAdapterBuildResult) {
 	const { client, workspaceId, application, forRemoval } = context;
+	const conflicts = [];
+	const unmanaged = [];
+	const resourceOwners = /* @__PURE__ */ new Set();
 	const changeSet = createChangeSet("Applications");
 	const existingApplications = await fetchAllTolerant(async (pageToken, maxPageSize) => {
 		const { applications, nextPageToken } = await client.listApplications({
@@ -2701,7 +3196,14 @@ async function planApplication(context, httpAdapterBuildResult) {
 	if (forRemoval) {
 		const candidates = application.id ? existingApplications : existingApplications.filter((app) => app.name === application.name);
 		const owned = await Promise.all(candidates.map(async (app) => {
-			return isOwnedByApp(await fetchAppLabels(client, workspaceId, app.name), application.name, application.id) ? app.name : null;
+			const labels = await fetchAppLabels(client, workspaceId, app.name);
+			return trackRemainingResourceOwner({
+				labels,
+				ownerLabel: labels?.["sdk-name"],
+				appName: application.name,
+				appId: application.id,
+				resourceOwners
+			}) ? app.name : null;
 		}));
 		for (const name of owned) if (name) changeSet.deletes.push({
 			name,
@@ -2710,9 +3212,9 @@ async function planApplication(context, httpAdapterBuildResult) {
 				applicationName: name
 			}
 		});
-		return changeSet;
+		return withOwnership(changeSet, conflicts, unmanaged, resourceOwners);
 	}
-	if (application.subgraphs.length === 0) return changeSet;
+	if (application.subgraphs.length === 0) return withOwnership(changeSet, conflicts, unmanaged, resourceOwners);
 	let authNamespace;
 	let authIdpConfigName;
 	if (application.authService) {
@@ -2743,6 +3245,7 @@ async function planApplication(context, httpAdapterBuildResult) {
 		appName: application.name,
 		appId: application.id
 	});
+	const existingLabels = await fetchAppLabels(client, workspaceId, application.name);
 	const expectedLocalWebsites = expectedLocalStaticWebsiteNames(context);
 	const resolvedCors = await resolveStaticWebsiteUrls(client, workspaceId, application.config.cors, "CORS", { expectedLocalNames: expectedLocalWebsites });
 	const httpAdapters = buildHttpAdapters(application, httpAdapterBuildResult);
@@ -2773,13 +3276,22 @@ async function planApplication(context, httpAdapterBuildResult) {
 		});
 	}
 	if (existing) {
-		const labels = await fetchAppLabels(client, workspaceId, application.name);
+		const owned = trackDesiredResourceOwnership({
+			labels: existingLabels,
+			ownerLabel: existingLabels?.[sdkNameLabelKey],
+			appName: application.name,
+			appId: application.id,
+			resourceType: "Application",
+			resourceName: application.name,
+			conflicts,
+			unmanaged
+		});
 		const update = {
 			name: application.name,
 			request,
 			metaRequest
 		};
-		if (isOwnedByApp(labels, application.name, application.id) && hasMatchingSdkVersion(labels, metaRequest.labels) && areApplicationsEqual(existing, desired)) changeSet.unchanged.push(update);
+		if (owned && hasMatchingSdkVersion(existingLabels, metaRequest.labels) && areApplicationsEqual(existing, desired)) changeSet.unchanged.push(update);
 		else {
 			const details = diffHttpAdapterDisplay(existing.httpAdapters, httpAdapters);
 			if (details.length > 0) update.details = details;
@@ -2794,7 +3306,28 @@ async function planApplication(context, httpAdapterBuildResult) {
 			details: details.length > 0 ? details : void 0
 		});
 	}
-	return changeSet;
+	return withOwnership(changeSet, conflicts, unmanaged, resourceOwners);
+}
+/**
+* Attach the ownership-tracking fields to the plan's change set.
+*
+* The other resource plans return `{ changeSet, conflicts, ... }`; this one
+* returns the change set itself, so the fields are attached to it. Without
+* them the application is the one managed resource that never reaches
+* `confirmOwnerConflict`, which would let a deploy re-tag — or a `remove`
+* silently skip — an application this config does not own.
+* @param changeSet - The application change set
+* @param conflicts - Resources owned by another application
+* @param unmanaged - Resources carrying no SDK label
+* @param resourceOwners - Owners of the resources that were skipped
+* @returns The change set, with the ownership-tracking fields attached
+*/
+function withOwnership(changeSet, conflicts, unmanaged, resourceOwners) {
+	return Object.assign(changeSet, {
+		conflicts,
+		unmanaged,
+		resourceOwners
+	});
 }
 async function fetchAppLabels(client, workspaceId, appName) {
 	return (await getOrNull(async () => {
@@ -3172,7 +3705,7 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 			appId
 		});
 		if (existing) {
-			trackDesiredResourceOwnership({
+			const owned = trackDesiredResourceOwnership({
 				labels: existing.allLabels,
 				ownerLabel: existing.label,
 				appName,
@@ -3192,7 +3725,7 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 				},
 				metaRequest
 			});
-			else if (!existing.label) changeSet.updates.push({
+			else if (!owned) changeSet.updates.push({
 				name,
 				metaRequest
 			});
@@ -3240,12 +3773,12 @@ async function applyAuthConnections(client, result, phase) {
 		if (changeSet.creates.length > 0 || changeSet.replaces.length > 0) await withSecretsStateLock(stateScope, async () => {
 			await Promise.all(changeSet.creates.map(async (create) => {
 				await client.createAuthConnection(create.request);
-				await client.setMetadata(create.metaRequest);
+				await writeMetadataLabels(client, create.metaRequest);
 				logger.info(`Connection "${create.name}" was created. Authorize it with:\n  tailor authconnection authorize --name ${create.name}\nOr via the Console: tailor authconnection open`);
 			}));
 			for (const replace of changeSet.replaces) {
 				if ((await client.updateAuthConnection(replace.updateRequest)).connection?.status === AuthConnection_Status.UNAUTHORIZED) logger.warn(`Connection "${replace.name}" requires re-authorization. Authorize with:\n  tailor authconnection authorize --name ${replace.name}\nOr via the Console: tailor authconnection open`);
-				await client.setMetadata(replace.metaRequest);
+				await writeMetadataLabels(client, replace.metaRequest);
 			}
 			const secretReplaces = changeSet.replaces.filter((replace) => replace.updateRequest.updateMask?.paths?.includes("oauth2.client_secret"));
 			if (changeSet.creates.length > 0 || secretReplaces.length > 0) {
@@ -3263,7 +3796,7 @@ async function applyAuthConnections(client, result, phase) {
 			}
 		});
 		await Promise.all(changeSet.updates.map(async (update) => {
-			await client.setMetadata(update.metaRequest);
+			await writeMetadataLabels(client, update.metaRequest);
 		}));
 	} else if (changeSet.deletes.length > 0) await withSecretsStateLock(stateScope, async () => {
 		await Promise.all(changeSet.deletes.map(async (del) => {
@@ -3590,10 +4123,10 @@ async function applyFunctionRegistry(client, workspaceId, result, phase = "creat
 		const limitFunction = createApplyLimiter();
 		await Promise.all([...changeSet.creates.map((create) => limitFunction(async () => {
 			await uploadFunctionScript(client, workspaceId, create.entry, true);
-			await client.setMetadata(create.metaRequest);
+			await writeMetadataLabels(client, create.metaRequest);
 		})), ...changeSet.updates.map((update) => limitFunction(async () => {
 			await uploadFunctionScript(client, workspaceId, update.entry, false);
-			await client.setMetadata(update.metaRequest);
+			await writeMetadataLabels(client, update.metaRequest);
 		}))]);
 	} else await Promise.all(changeSet.deletes.map((del) => client.deleteFunctionRegistry({
 		workspaceId: del.workspaceId,
@@ -3976,15 +4509,19 @@ function idpClientSecretName(namespaceName, clientName) {
 async function applyIdP(client, result, phase = "create-update") {
 	const { changeSet } = result;
 	if (phase === "create-update") {
-		await Promise.all([...changeSet.service.creates.map(async (create) => {
-			await resolveServiceReturnOrigins(client, create.request);
-			await client.createIdPService(create.request);
-			await client.setMetadata(create.metaRequest);
-		}), ...changeSet.service.updates.map(async (update) => {
-			await resolveServiceReturnOrigins(client, update.request);
-			await client.updateIdPService(update.request);
-			await client.setMetadata(update.metaRequest);
-		})]);
+		await Promise.all([
+			...changeSet.service.creates.map(async (create) => {
+				await resolveServiceReturnOrigins(client, create.request);
+				await client.createIdPService(create.request);
+				await writeMetadataLabels(client, create.metaRequest);
+			}),
+			...changeSet.service.updates.map(async (update) => {
+				await resolveServiceReturnOrigins(client, update.request);
+				await client.updateIdPService(update.request);
+				await writeMetadataLabels(client, update.metaRequest);
+			}),
+			...changeSet.service.unchanged.flatMap((entry) => entry.metaRequest ? [writeMetadataLabels(client, entry.metaRequest)] : [])
+		]);
 		await Promise.all([...changeSet.client.creates.map(async (create) => {
 			const resp = await client.createIdPClient(create.request);
 			const vaultName = idpClientVaultName(assertDefined(create.request.namespaceName, "request missing namespaceName"), create.request.client?.name || "");
@@ -4035,10 +4572,13 @@ async function applyIdP(client, result, phase = "create-update") {
 * @returns Planned changes and metadata
 */
 async function planIdP(context) {
-	const { client, workspaceId, application, forRemoval, forceApplyAll = false, idpUserTriggerTargets } = context;
+	const { client, workspaceId, application, forRemoval, forceApplyAll = false, idpUserTriggerTargets, dependentApps, runAppIds } = context;
 	const idps = forRemoval ? [] : application.idpServices;
 	const expectedLocalWebsites = expectedLocalStaticWebsiteNames(context);
-	const { changeSet: serviceChangeSet, conflicts, unmanaged, resourceOwners } = await planServices$3(client, workspaceId, application.name, application.id, idps, idpUserTriggerTargets ?? /* @__PURE__ */ new Set(), expectedLocalWebsites);
+	const { changeSet: serviceChangeSet, conflicts, unmanaged, resourceOwners } = await planServices$3(client, workspaceId, application.name, application.id, idps, idpUserTriggerTargets ?? /* @__PURE__ */ new Set(), expectedLocalWebsites, {
+		dependentApps,
+		runAppIds
+	});
 	return {
 		changeSet: {
 			service: serviceChangeSet,
@@ -4091,7 +4631,7 @@ function normalizeComparableIdPService(input) {
 		authorization: input.authorization || void 0,
 		lang: input.lang === IdPLang.UNSPECIFIED ? IdPLang.EN : input.lang,
 		userAuthPolicy: input.userAuthPolicy,
-		publishUserEvents: input.publishUserEvents,
+		publishEvents: input.publishEvents,
 		disableGqlOperations: input.disableGqlOperations,
 		emailConfig: input.emailConfig,
 		permission: input.permission
@@ -4123,13 +4663,13 @@ function areIdPServicesEqual(existing, desired) {
 		authorization: existing.authorization,
 		lang: existing.lang,
 		userAuthPolicy: normalizeComparableUserAuthPolicy(existing.userAuthPolicy),
-		publishUserEvents: existing.publishUserEvents,
+		publishEvents: existing.publishUserEvents,
 		disableGqlOperations: normalizeComparableDisableGqlOperations(existing.disableGqlOperations),
 		emailConfig: normalizeComparableEmailConfig(existing.emailConfig),
 		permission: normalizeComparablePermission(existing.permission)
 	}), desired);
 }
-async function planServices$3(client, workspaceId, appName, appId, idps, idpUserTriggerTargets, expectedLocalWebsites) {
+async function planServices$3(client, workspaceId, appName, appId, idps, idpUserTriggerTargets, expectedLocalWebsites, records) {
 	const changeSet = createChangeSet("IdP services");
 	const conflicts = [];
 	const unmanaged = [];
@@ -4150,10 +4690,15 @@ async function planServices$3(client, workspaceId, appName, appId, idps, idpUser
 	for (const idp of idps) {
 		const namespaceName = idp.name;
 		const existing = existingServices[namespaceName];
-		const metaRequest = await buildMetaRequest({
+		const metaRequest = addDependencyRecords(await buildMetaRequest({
 			trn: resourceTrn(workspaceId, "idp", namespaceName),
 			appName,
 			appId
+		}), {
+			key: eventSourceKey.idp(namespaceName),
+			dependentApps: records.dependentApps,
+			runAppIds: records.runAppIds,
+			pinned: idp.publishEvents !== void 0
 		});
 		let authorization;
 		switch (idp.authorization) {
@@ -4172,9 +4717,11 @@ async function planServices$3(client, workspaceId, appName, appId, idps, idpUser
 		}
 		const lang = convertLang(idp.lang);
 		const userAuthPolicy = idp.userAuthPolicy;
-		const isIdpUserTriggerTarget = idpUserTriggerTargets.has(namespaceName);
-		if (isIdpUserTriggerTarget && idp.publishUserEvents === false) throw new Error(`IdP service "${namespaceName}" has "publishUserEvents: false", but executors with idpUser triggers subscribe to it. Either remove "publishUserEvents: false" or remove the matching executor triggers.`);
-		const publishUserEvents = idp.publishUserEvents ?? isIdpUserTriggerTarget;
+		const publishEvents = resolvePublishEvents({
+			explicit: idp.publishEvents,
+			subscribed: idpUserTriggerTargets.has(namespaceName),
+			conflict: publishEventsConflict.idpService(namespaceName)
+		});
 		const emailConfig = idp.emailConfig;
 		if (!idp.permission) logger.warn(`IdP service "${namespaceName}" has no permission configured.`);
 		const omittedPermitLocations = findOmittedPermitRules(idp.permission);
@@ -4190,7 +4737,7 @@ async function planServices$3(client, workspaceId, appName, appId, idps, idpUser
 			authorization,
 			lang,
 			userAuthPolicy: normalizeComparableUserAuthPolicy(userAuthPolicyForCompare),
-			publishUserEvents,
+			publishEvents,
 			disableGqlOperations: normalizeComparableDisableGqlOperations(convertGqlOperationsToDisable(idp.gqlOperations)),
 			emailConfig: normalizeComparableEmailConfig(emailConfig),
 			permission: protoPermission
@@ -4201,7 +4748,7 @@ async function planServices$3(client, workspaceId, appName, appId, idps, idpUser
 			authorization,
 			lang,
 			userAuthPolicy,
-			publishUserEvents,
+			publishUserEvents: publishEvents,
 			disableGqlOperations: convertGqlOperationsToDisable(idp.gqlOperations),
 			emailConfig,
 			permission: protoPermission
@@ -4216,7 +4763,10 @@ async function planServices$3(client, workspaceId, appName, appId, idps, idpUser
 				resourceName: idp.name,
 				conflicts,
 				unmanaged
-			}) && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && areIdPServicesEqual(existing.resource, desired)) changeSet.unchanged.push({ name: namespaceName });
+			}) && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && areIdPServicesEqual(existing.resource, desired)) changeSet.unchanged.push({
+				name: namespaceName,
+				metaRequest
+			});
 			else changeSet.updates.push({
 				name: namespaceName,
 				request,
@@ -4424,10 +4974,10 @@ async function applyAuth(client, result, phase = "create-update") {
 	const applyServices = async () => {
 		await Promise.all([...changeSet.service.creates.map(async (create) => {
 			await client.createAuthService(create.request);
-			await client.setMetadata(create.metaRequest);
+			await writeMetadataLabels(client, create.metaRequest);
 		}), ...changeSet.service.updates.map(async (update) => {
 			await client.updateAuthService(update.request);
-			await client.setMetadata(update.metaRequest);
+			await writeMetadataLabels(client, update.metaRequest);
 		})]);
 	};
 	const applyMachineUsers = async () => {
@@ -5548,10 +6098,10 @@ async function applyExecutor(client, result, phase = "create-update") {
 	const { changeSet } = result;
 	if (phase === "create-update") await Promise.all([...changeSet.creates.map(async (create) => {
 		await client.createExecutorExecutor(create.request);
-		await client.setMetadata(create.metaRequest);
+		await writeMetadataLabels(client, create.metaRequest);
 	}), ...changeSet.updates.map(async (update) => {
 		await client.updateExecutorExecutor(update.request);
-		await client.setMetadata(update.metaRequest);
+		await writeMetadataLabels(client, update.metaRequest);
 	})]);
 	else await Promise.all(changeSet.deletes.map((del) => client.deleteExecutorExecutor(del.request)));
 }
@@ -5891,6 +6441,18 @@ function protoExecutor(context, executor) {
 				}
 			});
 			break;
+		case "workflowExecution":
+		case "workflowJobExecution":
+			triggerType = ExecutorTriggerType.EVENT;
+			triggerConfig = typedEventTrigger({
+				case: "workflow",
+				value: {
+					eventTypes: trigger.events,
+					workflowName: trigger.workflowName,
+					...trigger.condition ? { condition: { expr: `(${stringifyFunction(trigger.condition)})(${argsExpr})` } } : {}
+				}
+			});
+			break;
 		default: throw new Error(`Unknown trigger: ${trigger}`);
 	}
 	const target = executor.operation;
@@ -6029,12 +6591,22 @@ async function applyPipeline(client, result, phase = "create-update") {
 	if (phase === "create-update") {
 		await Promise.all([...changeSet.service.creates.map(async (create) => {
 			await client.createPipelineService(create.request);
-			await client.setMetadata(create.metaRequest);
+			await writeMetadataLabels(client, create.metaRequest);
 		}), ...changeSet.service.updates.map(async (update) => {
 			await client.updatePipelineService(update.request);
-			await client.setMetadata(update.metaRequest);
+			await writeMetadataLabels(client, update.metaRequest);
 		})]);
-		await Promise.all([...changeSet.resolver.creates.map((create) => client.createPipelineResolver(create.request)), ...changeSet.resolver.updates.map((update) => client.updatePipelineResolver(update.request))]);
+		await Promise.all([
+			...changeSet.resolver.creates.map(async (create) => {
+				await client.createPipelineResolver(create.request);
+				await writeMetadataLabels(client, create.metaRequest);
+			}),
+			...changeSet.resolver.updates.map(async (update) => {
+				await client.updatePipelineResolver(update.request);
+				await writeMetadataLabels(client, update.metaRequest);
+			}),
+			...changeSet.resolver.unchanged.flatMap((entry) => entry.metaRequest ? [writeMetadataLabels(client, entry.metaRequest)] : [])
+		]);
 	} else if (phase === "delete-resources") await Promise.all(changeSet.resolver.deletes.map((del) => client.deletePipelineResolver(del.request)));
 	else await Promise.all(changeSet.service.deletes.map((del) => client.deletePipelineService(del.request)));
 }
@@ -6053,7 +6625,12 @@ async function planPipeline(context) {
 	const executors = forRemoval ? [] : Object.values(await application.executorService?.loadExecutors() ?? {});
 	const { changeSet: serviceChangeSet, conflicts, unmanaged, resourceOwners } = await planServices$1(client, workspaceId, application.name, application.id, pipelines);
 	const deletedServices = serviceChangeSet.deletes.map((del) => del.name);
-	const { changeSet: resolverChangeSet } = await planResolvers(client, workspaceId, pipelines, executors, context.executorUsedResolvers ?? /* @__PURE__ */ new Set(), deletedServices, application.env, getApplicationAuthNamespace(application), forceApplyAll);
+	const { changeSet: resolverChangeSet } = await planResolvers(client, workspaceId, pipelines, executors, context.executorUsedResolvers ?? /* @__PURE__ */ new Set(), deletedServices, application.env, getApplicationAuthNamespace(application), forceApplyAll, {
+		appName: application.name,
+		appId: application.id,
+		dependentApps: context.dependentApps,
+		runAppIds: context.runAppIds
+	});
 	return {
 		changeSet: {
 			service: serviceChangeSet,
@@ -6141,8 +6718,28 @@ async function planServices$1(client, workspaceId, appName, appId, pipelines) {
 		resourceOwners
 	};
 }
-async function planResolvers(client, workspaceId, pipelines, executors, initialExecutorUsedResolvers, deletedServices, env, authNamespace, forceApplyAll = false) {
+async function planResolvers(client, workspaceId, pipelines, executors, initialExecutorUsedResolvers, deletedServices, env, authNamespace, forceApplyAll = false, records = {}) {
 	const changeSet = createChangeSet("Pipeline resolvers");
+	const { appName, appId, dependentApps, runAppIds } = records;
+	/**
+	* Build one resolver's metadata write, carrying the dependency records that
+	* belong to it. The resolver is what publishes, so the record lives there.
+	* @param namespace - Namespace holding the resolver
+	* @param resolver - Resolver being planned
+	* @returns The resolver's metadata write
+	*/
+	const resolverMetaRequest = async (namespace, resolver) => {
+		return addDependencyRecords(await buildMetaRequest({
+			trn: resolverTrn(workspaceId, namespace, resolver.name),
+			appName: appName ?? "",
+			appId
+		}), {
+			key: eventSourceKey.resolver(namespace, resolver.name),
+			dependentApps,
+			runAppIds,
+			pinned: resolver.publishEvents !== void 0
+		});
+	};
 	const fetchResolvers = (namespaceName) => {
 		return fetchAllTolerant(async (pageToken, maxPageSize) => {
 			const { pipelineResolvers, nextPageToken } = await client.listPipelineResolvers({
@@ -6156,26 +6753,36 @@ async function planResolvers(client, workspaceId, pipelines, executors, initialE
 	};
 	const executorUsedResolvers = new Set(initialExecutorUsedResolvers);
 	for (const executor of executors) if (executor.trigger.kind === "resolverExecuted") executorUsedResolvers.add(executor.trigger.resolverName);
-	for (const pipeline of pipelines) for (const resolver of Object.values(pipeline.resolvers)) if (executorUsedResolvers.has(resolver.name) && resolver.publishEvents === false) throw new Error(`Resolver "${resolver.name}" has publishEvents set to false, but it is used by an executor with a resolverExecuted trigger. Either remove the publishEvents: false setting or remove the executor trigger for this resolver.`);
+	for (const pipeline of pipelines) for (const resolver of Object.values(pipeline.resolvers)) assertNoPublishEventsConflict({
+		explicit: resolver.publishEvents,
+		subscribed: executorUsedResolvers.has(resolver.name),
+		conflict: publishEventsConflict.resolver(resolver.name)
+	});
 	for (const pipeline of pipelines) {
 		const existingResolvers = await fetchResolvers(pipeline.namespace);
 		const existingResolversMap = new Map(existingResolvers.map((resolver) => [resolver.name, resolver]));
 		for (const resolver of Object.values(pipeline.resolvers)) {
 			const desiredResolver = processResolver(pipeline.namespace, resolver, executorUsedResolvers, env, authNamespace);
-			if (existingResolversMap.get(resolver.name)) {
+			const existingResolver = existingResolversMap.get(resolver.name);
+			const metaRequest = await resolverMetaRequest(pipeline.namespace, resolver);
+			if (existingResolver) {
 				const { pipelineResolver: existingResolverDetail } = await client.getPipelineResolver({
 					workspaceId,
 					namespaceName: pipeline.namespace,
 					resolverName: resolver.name
 				});
-				if (!forceApplyAll && existingResolverDetail && areResolversEqual(existingResolverDetail, desiredResolver)) changeSet.unchanged.push({ name: resolver.name });
+				if (!forceApplyAll && existingResolverDetail && areResolversEqual(existingResolverDetail, desiredResolver)) changeSet.unchanged.push({
+					name: resolver.name,
+					metaRequest
+				});
 				else changeSet.updates.push({
 					name: resolver.name,
 					request: {
 						workspaceId,
 						namespaceName: pipeline.namespace,
 						pipelineResolver: desiredResolver
-					}
+					},
+					metaRequest
 				});
 				existingResolversMap.delete(resolver.name);
 			} else changeSet.creates.push({
@@ -6184,7 +6791,8 @@ async function planResolvers(client, workspaceId, pipelines, executors, initialE
 					workspaceId,
 					namespaceName: pipeline.namespace,
 					pipelineResolver: desiredResolver
-				}
+				},
+				metaRequest
 			});
 		}
 		existingResolversMap.forEach((_resolver, name) => {
@@ -6292,9 +6900,11 @@ function processResolver(namespace, resolver, executorUsedResolvers, env, authNa
 	const resolverDescription = resolver.description || `${resolver.name} resolver`;
 	const outputDescription = resolver.output.metadata.description;
 	const combinedDescription = outputDescription ? `${resolverDescription}\n\nReturns:\n${outputDescription}` : resolverDescription;
-	let publishExecutionEvents = false;
-	if (resolver.publishEvents !== void 0) publishExecutionEvents = resolver.publishEvents;
-	else if (executorUsedResolvers.has(resolver.name)) publishExecutionEvents = true;
+	const publishExecutionEvents = resolvePublishEvents({
+		explicit: resolver.publishEvents,
+		subscribed: executorUsedResolvers.has(resolver.name),
+		conflict: publishEventsConflict.resolver(resolver.name)
+	});
 	return {
 		authorization: "true==true",
 		description: combinedDescription,
@@ -6539,22 +7149,18 @@ async function applySecretManager(client, result, phase = "create-update", appli
 	if (phase === "create-update") {
 		await Promise.all(vaultChangeSet.creates.map(async (create) => {
 			await client.createSecretManagerVault(vaultCreateRequest(create));
-			if (application) {
-				const metaRequest = await buildMetaRequest({
-					trn: resourceTrn(create.workspaceId, "vault", create.name),
-					appName: application.name,
-					appId: application.id
-				});
-				await client.setMetadata(metaRequest);
-			}
+			if (application) await writeMetadataLabels(client, await buildMetaRequest({
+				trn: resourceTrn(create.workspaceId, "vault", create.name),
+				appName: application.name,
+				appId: application.id
+			}));
 		}));
 		if (application) await Promise.all(vaultChangeSet.updates.map(async (update) => {
-			const metaRequest = await buildMetaRequest({
+			await writeMetadataLabels(client, await buildMetaRequest({
 				trn: resourceTrn(update.workspaceId, "vault", update.name),
 				appName: application.name,
 				appId: application.id
-			});
-			await client.setMetadata(metaRequest);
+			}));
 		}));
 		const secretHashUpdates = [...secretChangeSet.creates, ...secretChangeSet.updates];
 		if (secretHashUpdates.length > 0) await withSecretsStateLock(stateScope, async () => {
@@ -6632,197 +7238,46 @@ function getNamespacesWithMigrations(config, configDir) {
 	}
 	return result;
 }
-
-//#endregion
-//#region src/cli/commands/tailordb/migrate/diff-calculator.ts
-/**
-* Check if a migration diff has any changes
-* @param {MigrationDiff} diff - Migration diff to check
-* @returns {boolean} True if diff has changes
-*/
-function hasChanges(diff) {
-	return diff.changes.length > 0;
-}
 /**
-* Format a migration diff for display
-* @param {MigrationDiff} diff - Migration diff to format
-* @returns {string} Formatted diff string
+* Select the single target namespace for a migration command
+* @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migrations configured
+* @param {string | undefined} requested - Namespace requested via --namespace, if any
+* @returns {NamespaceWithMigrations} The selected namespace
 */
-function formatMigrationDiff(diff) {
-	if (diff.changes.length === 0) return "No schema differences detected.";
-	const lines = [];
-	const changesByType = /* @__PURE__ */ new Map();
-	for (const change of diff.changes) {
-		const existing = changesByType.get(change.typeName) ?? [];
-		existing.push(change);
-		changesByType.set(change.typeName, existing);
-	}
-	for (const [typeName, changes] of changesByType) {
-		lines.push(`${diff.namespace}.${typeName}:`);
-		for (const change of changes) lines.push(formatDiffChange(change));
+function selectTargetNamespace(namespacesWithMigrations, requested) {
+	if (namespacesWithMigrations.length === 0) throw new Error("No TailorDB services with migrations configuration found");
+	if (requested) {
+		const found = namespacesWithMigrations.find((ns) => ns.namespace === requested);
+		if (!found) throw new Error(`Namespace "${requested}" not found or does not have migrations configured`);
+		return found;
 	}
-	return lines.join("\n");
+	if (namespacesWithMigrations.length > 1) throw new Error(`Multiple TailorDB services found. Please specify namespace with --namespace flag: ${namespacesWithMigrations.map((ns) => ns.namespace).join(", ")}`);
+	return assertDefined(namespacesWithMigrations[0], "namespace with migrations missing");
 }
-/**
-* Format a single diff change for display
-* @param {DiffChange} change - Diff change to format
-* @returns {string} Formatted change string
-*/
-function formatDiffChange(change) {
-	switch (change.kind) {
-		case "type_added": return `  + [Type] ${change.typeName} (new type)`;
-		case "type_removed": return `  - [Type] ${change.typeName} (removed)`;
-		case "type_modified": return `  ~ [Type] ${change.typeName}: ${change.reason}`;
-		case "type_settings_modified": return `  ~ [Type Settings] ${change.typeName}: ${change.reason ?? "settings changed"}`;
-		case "field_added": {
-			const typeStr = formatFieldType(change.after);
-			return `  + ${change.fieldName}: ${typeStr}`;
-		}
-		case "field_removed": return `  - ${change.fieldName}: ${change.before.type}`;
-		case "field_modified": return `  ~ ${change.fieldName}: ${formatFieldModification(change.before, change.after)}`;
-		case "index_added": return `  + [Index] ${change.indexName}`;
-		case "index_removed": return `  - [Index] ${change.indexName}`;
-		case "index_modified": return `  ~ [Index] ${change.indexName}: ${change.reason ?? "modified"}`;
-		case "file_added": return `  + [File] ${change.fieldName}`;
-		case "file_removed": return `  - [File] ${change.fieldName}`;
-		case "file_modified": return `  ~ [File] ${change.fieldName}: ${change.reason ?? "modified"}`;
-		case "relationship_added": return `  + [Relationship${change.relationshipType ? ` (${change.relationshipType})` : ""}] ${change.relationshipName}`;
-		case "relationship_removed": return `  - [Relationship${change.relationshipType ? ` (${change.relationshipType})` : ""}] ${change.relationshipName}`;
-		case "relationship_modified": return `  ~ [Relationship${change.relationshipType ? ` (${change.relationshipType})` : ""}] ${change.relationshipName}: ${change.reason ?? "modified"}`;
-		case "permission_modified": return `  ~ [Permission] ${change.reason ?? "modified"}`;
-		case "type_scripts_modified": return `  ~ [Type Scripts] ${change.typeName}: ${change.reason ?? "type-level hooks/validate changed"}`;
-		default: {
-			const unknown = change;
-			return `  ? ${unknown.typeName}.${unknown.fieldName ?? ""}`;
-		}
-	}
-}
-/**
-* Format field type with attributes
-* @param {SnapshotFieldConfig} field - Field configuration
-* @returns {string} Formatted field type string
-*/
-function formatFieldType(field) {
-	let type = field.type;
-	if (field.array) type += "[]";
-	if (field.required) type += " (required)";
-	else type += " (optional)";
-	return type;
-}
-/**
-* Format field modification details
-* @param {SnapshotFieldConfig} before - Before field configuration
-* @param {SnapshotFieldConfig} after - After field configuration
-* @returns {string} Formatted modification details
-*/
-function formatFieldModification(before, after) {
-	const changes = [];
-	if (before.type !== after.type) changes.push(`type: ${before.type} → ${after.type}`);
-	if (before.required !== after.required) changes.push(`required: ${before.required} → ${after.required}`);
-	if (Boolean(before.array) !== Boolean(after.array)) changes.push(`array: ${before.array ?? false} → ${after.array ?? false}`);
-	if (Boolean(before.index) !== Boolean(after.index)) changes.push(`index: ${before.index ?? false} → ${after.index ?? false}`);
-	if (Boolean(before.unique) !== Boolean(after.unique)) changes.push(`unique: ${before.unique ?? false} → ${after.unique ?? false}`);
-	if (Boolean(before.vector) !== Boolean(after.vector)) changes.push(`vector: ${before.vector ?? false} → ${after.vector ?? false}`);
-	const beforeAllowed = before.allowedValues ?? [];
-	const afterAllowed = after.allowedValues ?? [];
-	const afterSet = new Set(afterAllowed.map((v) => v.value));
-	if (beforeAllowed.length !== afterAllowed.length || beforeAllowed.some((v) => !afterSet.has(v.value))) {
-		const beforeValues = beforeAllowed.map((v) => v.value).join(", ");
-		const afterValues = afterAllowed.map((v) => v.value).join(", ");
-		changes.push(`allowedValues: [${beforeValues}] → [${afterValues}]`);
-	}
-	const beforeHooks = before.hooks;
-	const afterHooks = after.hooks;
-	if ((beforeHooks?.create?.expr ?? "") !== (afterHooks?.create?.expr ?? "") || (beforeHooks?.update?.expr ?? "") !== (afterHooks?.update?.expr ?? "")) changes.push("hooks modified");
-	const beforeValidate = before.validate ?? [];
-	const afterValidate = after.validate ?? [];
-	if (beforeValidate.length !== afterValidate.length) changes.push(`validations: ${beforeValidate.length} → ${afterValidate.length}`);
-	if (Boolean(before.serial) !== Boolean(after.serial)) changes.push(`serial: ${before.serial ? "enabled" : "disabled"} → ${after.serial ? "enabled" : "disabled"}`);
-	return changes.join(", ");
-}
-/**
-* Format breaking changes for display
-* @param {BreakingChangeInfo[]} breakingChanges - Breaking changes to format
-* @returns {string} Formatted breaking changes string
-*/
-function formatBreakingChanges(breakingChanges) {
-	if (breakingChanges.length === 0) return "";
-	const lines = ["Breaking changes detected:", ""];
-	for (const bc of breakingChanges) {
-		const location = bc.fieldName ? `${bc.typeName}.${bc.fieldName}` : bc.typeName;
-		lines.push(`  - ${location}: ${bc.reason}`);
-	}
-	return lines.join("\n");
-}
-/**
-* Format warning changes for display
-* @param {WarningChangeInfo[]} warnings - Warning changes to format
-* @returns {string} Formatted warning changes string
-*/
-function formatWarnings(warnings) {
-	if (warnings.length === 0) return "";
-	const lines = ["Warning: data loss possible:", ""];
-	for (const w of warnings) {
-		const location = w.fieldName ? `${w.typeName}.${w.fieldName}` : w.typeName;
-		lines.push(`  - ${location}: ${w.reason}`);
-	}
-	return lines.join("\n");
-}
-const DIFF_CHANGE_LABELS = {
-	type_added: "type(s) added",
-	type_removed: "type(s) removed",
-	type_modified: "type(s) modified",
-	type_settings_modified: "type setting(s) modified",
-	field_added: "field(s) added",
-	field_removed: "field(s) removed",
-	field_modified: "field(s) modified",
-	index_added: "index(es) added",
-	index_removed: "index(es) removed",
-	index_modified: "index(es) modified",
-	file_added: "file field(s) added",
-	file_removed: "file field(s) removed",
-	file_modified: "file field(s) modified",
-	relationship_added: "relationship(s) added",
-	relationship_removed: "relationship(s) removed",
-	relationship_modified: "relationship(s) modified",
-	permission_modified: "permission(s) modified",
-	type_scripts_modified: "type script(s) modified"
-};
-/**
-* Format a summary of the migration diff
-* @param {MigrationDiff} diff - Migration diff to summarize
-* @returns {string} Formatted summary string
-*/
-function formatDiffSummary(diff) {
-	const stats = {};
-	for (const change of diff.changes) stats[change.kind] = (stats[change.kind] ?? 0) + 1;
-	const parts = Object.keys(stats).map((kind) => `${stats[kind]} ${DIFF_CHANGE_LABELS[kind]}`);
-	return parts.length > 0 ? parts.join(", ") : "No changes";
-}
-
-//#endregion
-//#region src/parser/service/tailordb/type-script.ts
-const INPUT = "_input";
-const NEW_RECORD = "_newRecord";
-const OLD_RECORD = "_oldRecord";
-const NOW = "_now";
-const SOURCE_HASH_PREFIX = "// @sdk-source-hash:";
-const TIME_TYPES = /* @__PURE__ */ new Set([
-	"datetime",
-	"date",
-	"time"
-]);
-const key = (name) => JSON.stringify(name);
-function collectFieldScriptSources(fields) {
-	const entries = [];
-	for (const [name, config] of Object.entries(fields).toSorted(([a], [b]) => a.localeCompare(b))) {
-		const data = {};
-		if (config.hooks?.create?.expr) data.hc = config.hooks.create.expr;
-		if (config.hooks?.update?.expr) data.hu = config.hooks.update.expr;
-		if (config.validate?.some((v) => v.script?.expr)) data.v = config.validate.filter((v) => v.script?.expr).map((v) => [v.script?.expr, v.errorMessage]);
-		if (config.default !== void 0) {
-			data.d = config.default instanceof Date ? config.default.toISOString() : config.default;
-			data.t = config.type;
+
+//#endregion
+//#region src/parser/service/tailordb/type-script.ts
+const INPUT = "_input";
+const NEW_RECORD = "_newRecord";
+const OLD_RECORD = "_oldRecord";
+const NOW = "_now";
+const SOURCE_HASH_PREFIX = "// @sdk-source-hash:";
+const TIME_TYPES = /* @__PURE__ */ new Set([
+	"datetime",
+	"date",
+	"time"
+]);
+const key = (name) => JSON.stringify(name);
+function collectFieldScriptSources(fields) {
+	const entries = [];
+	for (const [name, config] of Object.entries(fields).toSorted(([a], [b]) => a.localeCompare(b))) {
+		const data = {};
+		if (config.hooks?.create?.expr) data.hc = config.hooks.create.expr;
+		if (config.hooks?.update?.expr) data.hu = config.hooks.update.expr;
+		if (config.validate?.some((v) => v.script?.expr)) data.v = config.validate.filter((v) => v.script?.expr).map((v) => [v.script?.expr, v.errorMessage]);
+		if (config.default !== void 0) {
+			data.d = config.default instanceof Date ? config.default.toISOString() : config.default;
+			data.t = config.type;
 		}
 		if (config.fields) {
 			const nested = collectFieldScriptSources(config.fields);
@@ -6976,77 +7431,244 @@ function buildTypeScripts(fields, options) {
 }
 
 //#endregion
-//#region src/cli/commands/tailordb/migrate/migration-number.ts
+//#region src/cli/commands/tailordb/migrate/diff-calculator.ts
 /**
-* Format migration number as 4-digit string.
-* @param num - Migration number
-* @returns 4-digit padded string
+* Check if a migration diff has any changes
+* @param {MigrationDiff} diff - Migration diff to check
+* @returns {boolean} True if diff has changes
 */
-function formatMigrationNumber(num) {
-	return num.toString().padStart(4, "0");
+function hasChanges(diff) {
+	return diff.changes.length > 0;
 }
 /**
-* Parse a migration number CLI argument.
-*
-* Accepts the canonical 4-digit form ("0001") or a bare integer without
-* leading zeros ("0"–"9999"). Commands that disallow the baseline reject
-* 0 themselves with a context-specific message.
-* @param numberStr - Raw CLI argument
-* @returns Parsed migration number
+* Format a migration diff for display
+* @param {MigrationDiff} diff - Migration diff to format
+* @returns {string} Formatted diff string
 */
-function parseMigrationNumberArg(numberStr) {
-	if (/^\d{4}$/.test(numberStr)) return parseInt(numberStr, 10);
-	if (/^(0|[1-9]\d*)$/.test(numberStr)) {
-		const parsed = parseInt(numberStr, 10);
-		if (parsed > 9999) throw new Error(`Migration number ${numberStr} is out of range. Expected 0-9999.`);
-		return parsed;
+function formatMigrationDiff(diff) {
+	if (diff.changes.length === 0) return "No schema differences detected.";
+	const lines = [];
+	const changesByType = /* @__PURE__ */ new Map();
+	for (const change of diff.changes) {
+		const existing = changesByType.get(change.typeName) ?? [];
+		existing.push(change);
+		changesByType.set(change.typeName, existing);
 	}
-	throw new Error(`Invalid migration number format: ${numberStr}. Expected 4-digit format (e.g., 0001) or integer 0-9999 (e.g., 1).`);
+	for (const [typeName, changes] of changesByType) {
+		lines.push(`${diff.namespace}.${typeName}:`);
+		for (const change of changes) lines.push(formatDiffChange(change));
+	}
+	return lines.join("\n");
 }
-
-//#endregion
-//#region src/cli/commands/tailordb/migrate/snapshot-schema.ts
 /**
-* Zod schemas for TailorDB migration snapshot and diff files.
-*
-* Each schema mirrors the corresponding hand-written interface from
-* snapshot-types.ts / diff-calculator.ts. Schemas are cast to
-* `z.ZodType<T>` to keep them aligned with the interfaces at compile time.
-*
-* All object schemas use `z.looseObject` so that unknown keys written
-* by newer CLI versions survive a load → save round-trip.
+* Format a single diff change for display
+* @param {DiffChange} change - Diff change to format
+* @returns {string} Formatted change string
 */
-function snapshotRecordSchema(valueSchema) {
-	return z.custom((value) => typeof value === "object" && value !== null && !Array.isArray(value), { message: "Expected record" }).transform((value, ctx) => {
-		const record = Object.create(null);
-		for (const key of Object.keys(value)) {
-			const result = valueSchema.safeParse(value[key]);
-			if (!result.success) {
-				for (const issue of result.error.issues) ctx.addIssue({
-					...issue,
-					path: [key, ...issue.path]
-				});
-				continue;
-			}
-			record[key] = result.data;
+function formatDiffChange(change) {
+	switch (change.kind) {
+		case "type_added": return `  + [Type] ${change.typeName} (new type)`;
+		case "type_removed": return `  - [Type] ${change.typeName} (removed)`;
+		case "type_modified": return `  ~ [Type] ${change.typeName}: ${change.reason}`;
+		case "type_settings_modified": return `  ~ [Type Settings] ${change.typeName}: ${change.reason ?? "settings changed"}`;
+		case "field_added": {
+			const typeStr = formatFieldType(change.after);
+			return `  + ${change.fieldName}: ${typeStr}`;
 		}
-		return record;
-	});
+		case "field_removed": return `  - ${change.fieldName}: ${change.before.type}`;
+		case "field_modified": return `  ~ ${change.fieldName}: ${formatFieldModification(change.before, change.after)}`;
+		case "index_added": return `  + [Index] ${change.indexName}`;
+		case "index_removed": return `  - [Index] ${change.indexName}`;
+		case "index_modified": return `  ~ [Index] ${change.indexName}: ${change.reason ?? "modified"}`;
+		case "file_added": return `  + [File] ${change.fieldName}`;
+		case "file_removed": return `  - [File] ${change.fieldName}`;
+		case "file_modified": return `  ~ [File] ${change.fieldName}: ${change.reason ?? "modified"}`;
+		case "relationship_added": return `  + [Relationship${change.relationshipType ? ` (${change.relationshipType})` : ""}] ${change.relationshipName}`;
+		case "relationship_removed": return `  - [Relationship${change.relationshipType ? ` (${change.relationshipType})` : ""}] ${change.relationshipName}`;
+		case "relationship_modified": return `  ~ [Relationship${change.relationshipType ? ` (${change.relationshipType})` : ""}] ${change.relationshipName}: ${change.reason ?? "modified"}`;
+		case "permission_modified": return `  ~ [Permission] ${change.reason ?? "modified"}`;
+		case "type_scripts_modified": return `  ~ [Type Scripts] ${change.typeName}: ${change.reason ?? "type-level hooks/validate changed"}`;
+		default: {
+			const unknown = change;
+			return `  ? ${unknown.typeName}.${unknown.fieldName ?? ""}`;
+		}
+	}
 }
-const snapshotHookSchema = z.looseObject({ expr: z.string() });
-const snapshotValidationSchema = z.looseObject({
-	script: z.looseObject({ expr: z.string() }).optional(),
-	errorMessage: z.string()
-});
-const snapshotSerialSchema = z.looseObject({
-	start: z.number(),
-	maxValue: z.number().optional(),
-	format: z.string().optional()
-});
-const snapshotEnumValueSchema = z.looseObject({
-	value: z.string(),
-	description: z.string().optional()
-});
+/**
+* Format field type with attributes
+* @param {SnapshotFieldConfig} field - Field configuration
+* @returns {string} Formatted field type string
+*/
+function formatFieldType(field) {
+	let type = field.type;
+	if (field.array) type += "[]";
+	if (field.required) type += " (required)";
+	else type += " (optional)";
+	return type;
+}
+/**
+* Format field modification details
+* @param {SnapshotFieldConfig} before - Before field configuration
+* @param {SnapshotFieldConfig} after - After field configuration
+* @returns {string} Formatted modification details
+*/
+function formatFieldModification(before, after) {
+	const changes = [];
+	if (before.type !== after.type) changes.push(`type: ${before.type} → ${after.type}`);
+	if (before.required !== after.required) changes.push(`required: ${before.required} → ${after.required}`);
+	if (Boolean(before.array) !== Boolean(after.array)) changes.push(`array: ${before.array ?? false} → ${after.array ?? false}`);
+	if (Boolean(before.index) !== Boolean(after.index)) changes.push(`index: ${before.index ?? false} → ${after.index ?? false}`);
+	if (Boolean(before.unique) !== Boolean(after.unique)) changes.push(`unique: ${before.unique ?? false} → ${after.unique ?? false}`);
+	if (Boolean(before.vector) !== Boolean(after.vector)) changes.push(`vector: ${before.vector ?? false} → ${after.vector ?? false}`);
+	const beforeAllowed = before.allowedValues ?? [];
+	const afterAllowed = after.allowedValues ?? [];
+	const afterSet = new Set(afterAllowed.map((v) => v.value));
+	if (beforeAllowed.length !== afterAllowed.length || beforeAllowed.some((v) => !afterSet.has(v.value))) {
+		const beforeValues = beforeAllowed.map((v) => v.value).join(", ");
+		const afterValues = afterAllowed.map((v) => v.value).join(", ");
+		changes.push(`allowedValues: [${beforeValues}] → [${afterValues}]`);
+	}
+	const beforeHooks = before.hooks;
+	const afterHooks = after.hooks;
+	if ((beforeHooks?.create?.expr ?? "") !== (afterHooks?.create?.expr ?? "") || (beforeHooks?.update?.expr ?? "") !== (afterHooks?.update?.expr ?? "")) changes.push("hooks modified");
+	const beforeValidate = before.validate ?? [];
+	const afterValidate = after.validate ?? [];
+	if (beforeValidate.length !== afterValidate.length) changes.push(`validations: ${beforeValidate.length} → ${afterValidate.length}`);
+	if (Boolean(before.serial) !== Boolean(after.serial)) changes.push(`serial: ${before.serial ? "enabled" : "disabled"} → ${after.serial ? "enabled" : "disabled"}`);
+	return changes.join(", ");
+}
+/**
+* Format breaking changes for display
+* @param {BreakingChangeInfo[]} breakingChanges - Breaking changes to format
+* @returns {string} Formatted breaking changes string
+*/
+function formatBreakingChanges(breakingChanges) {
+	if (breakingChanges.length === 0) return "";
+	const lines = ["Breaking changes detected:", ""];
+	for (const bc of breakingChanges) {
+		const location = bc.fieldName ? `${bc.typeName}.${bc.fieldName}` : bc.typeName;
+		lines.push(`  - ${location}: ${bc.reason}`);
+	}
+	return lines.join("\n");
+}
+/**
+* Format warning changes for display
+* @param {WarningChangeInfo[]} warnings - Warning changes to format
+* @returns {string} Formatted warning changes string
+*/
+function formatWarnings(warnings) {
+	if (warnings.length === 0) return "";
+	const lines = ["Warning: data loss possible:", ""];
+	for (const w of warnings) {
+		const location = w.fieldName ? `${w.typeName}.${w.fieldName}` : w.typeName;
+		lines.push(`  - ${location}: ${w.reason}`);
+	}
+	return lines.join("\n");
+}
+const DIFF_CHANGE_LABELS = {
+	type_added: "type(s) added",
+	type_removed: "type(s) removed",
+	type_modified: "type(s) modified",
+	type_settings_modified: "type setting(s) modified",
+	field_added: "field(s) added",
+	field_removed: "field(s) removed",
+	field_modified: "field(s) modified",
+	index_added: "index(es) added",
+	index_removed: "index(es) removed",
+	index_modified: "index(es) modified",
+	file_added: "file field(s) added",
+	file_removed: "file field(s) removed",
+	file_modified: "file field(s) modified",
+	relationship_added: "relationship(s) added",
+	relationship_removed: "relationship(s) removed",
+	relationship_modified: "relationship(s) modified",
+	permission_modified: "permission(s) modified",
+	type_scripts_modified: "type script(s) modified"
+};
+/**
+* Format a summary of the migration diff
+* @param {MigrationDiff} diff - Migration diff to summarize
+* @returns {string} Formatted summary string
+*/
+function formatDiffSummary(diff) {
+	const stats = {};
+	for (const change of diff.changes) stats[change.kind] = (stats[change.kind] ?? 0) + 1;
+	const parts = Object.keys(stats).map((kind) => `${stats[kind]} ${DIFF_CHANGE_LABELS[kind]}`);
+	return parts.length > 0 ? parts.join(", ") : "No changes";
+}
+
+//#endregion
+//#region src/cli/commands/tailordb/migrate/migration-number.ts
+/**
+* Format migration number as 4-digit string.
+* @param num - Migration number
+* @returns 4-digit padded string
+*/
+function formatMigrationNumber(num) {
+	return num.toString().padStart(4, "0");
+}
+/**
+* Parse a migration number CLI argument.
+*
+* Accepts the canonical 4-digit form ("0001") or a bare integer without
+* leading zeros ("0"–"9999"). Commands that disallow the baseline reject
+* 0 themselves with a context-specific message.
+* @param numberStr - Raw CLI argument
+* @returns Parsed migration number
+*/
+function parseMigrationNumberArg(numberStr) {
+	if (/^\d{4}$/.test(numberStr)) return parseInt(numberStr, 10);
+	if (/^(0|[1-9]\d*)$/.test(numberStr)) {
+		const parsed = parseInt(numberStr, 10);
+		if (parsed > 9999) throw new Error(`Migration number ${numberStr} is out of range. Expected 0-9999.`);
+		return parsed;
+	}
+	throw new Error(`Invalid migration number format: ${numberStr}. Expected 4-digit format (e.g., 0001) or integer 0-9999 (e.g., 1).`);
+}
+
+//#endregion
+//#region src/cli/commands/tailordb/migrate/snapshot-schema.ts
+/**
+* Zod schemas for TailorDB migration snapshot and diff files.
+*
+* Each schema mirrors the corresponding hand-written interface from
+* snapshot-types.ts / diff-calculator.ts. Schemas are cast to
+* `z.ZodType<T>` to keep them aligned with the interfaces at compile time.
+*
+* All object schemas use `z.looseObject` so that unknown keys written
+* by newer CLI versions survive a load → save round-trip.
+*/
+function snapshotRecordSchema(valueSchema) {
+	return z.custom((value) => typeof value === "object" && value !== null && !Array.isArray(value), { message: "Expected record" }).transform((value, ctx) => {
+		const record = Object.create(null);
+		for (const key of Object.keys(value)) {
+			const result = valueSchema.safeParse(value[key]);
+			if (!result.success) {
+				for (const issue of result.error.issues) ctx.addIssue({
+					...issue,
+					path: [key, ...issue.path]
+				});
+				continue;
+			}
+			record[key] = result.data;
+		}
+		return record;
+	});
+}
+const snapshotHookSchema = z.looseObject({ expr: z.string() });
+const snapshotValidationSchema = z.looseObject({
+	script: z.looseObject({ expr: z.string() }).optional(),
+	errorMessage: z.string()
+});
+const snapshotSerialSchema = z.looseObject({
+	start: z.number(),
+	maxValue: z.number().optional(),
+	format: z.string().optional()
+});
+const snapshotEnumValueSchema = z.looseObject({
+	value: z.string(),
+	description: z.string().optional()
+});
 const snapshotFieldConfigSchema = z.looseObject({
 	type: z.string(),
 	required: z.boolean().default(true),
@@ -7960,11 +8582,29 @@ function reconstructSnapshotFromMigrations(migrationsDir, maxVersion) {
 * @returns {number} Latest migration number or 0 if no migrations exist
 */
 function getLatestMigrationNumber(migrationsDir) {
-	const files = getMigrationFiles(migrationsDir);
+	return latestMigrationNumber(getMigrationFiles(migrationsDir));
+}
+function latestMigrationNumber(files) {
 	if (files.length === 0) return 0;
 	return Math.max(...files.map((f) => f.number));
 }
 /**
+* Assert that a migration number exists in the local migration history.
+* 0 is always accepted as the baseline snapshot.
+*
+* Returns the latest migration number so callers that need it (e.g. sync's
+* post-sync hint) can reuse this function's directory scan instead of
+* scanning the migrations directory a second time.
+* @param {string} migrationsDir - Migrations directory path
+* @param {number} migrationNumber - Migration number to check
+* @returns {number} The latest migration number in the history
+*/
+function assertMigrationNumberExists(migrationsDir, migrationNumber) {
+	const files = getMigrationFiles(migrationsDir);
+	if (migrationNumber !== 0 && !files.some((f) => f.number === migrationNumber)) throw new Error(`Migration ${formatMigrationNumber(migrationNumber)} does not exist in working tree (latest is ${formatMigrationNumber(latestMigrationNumber(files))}).`);
+	return latestMigrationNumber(files);
+}
+/**
 * Compare two field configs and determine if they are different
 * @param {SnapshotFieldConfig} oldField - Old field configuration
 * @param {SnapshotFieldConfig} newField - New field configuration
@@ -9206,7 +9846,11 @@ function generateTailorDBTypeManifestFromSnapshot(snapshotType, options = {}) {
 		defaultQueryLimitSize: 100n,
 		maxBulkUpsertSize: 1000n,
 		pluralForm,
-		publishRecordEvents: snapshotType.settings?.publishEvents ?? options.publishRecordEvents ?? false
+		publishRecordEvents: resolvePublishEvents({
+			explicit: snapshotType.settings?.publishEvents,
+			subscribed: options.subscribed ?? false,
+			conflict: publishEventsConflict.tailorDBType(snapshotType.name)
+		})
 	};
 	const ops = snapshotType.settings?.gqlOperations ?? options.namespaceGqlOperations;
 	if (ops) defaultSettings.disableGqlOperations = {
@@ -9473,14 +10117,9 @@ function generateAllTypeManifestsFromSnapshot(snapshot, options = {}) {
 	const manifests = /* @__PURE__ */ new Map();
 	const { executorUsedTypes, ...baseOptions } = options;
 	for (const [typeName, snapshotType] of Object.entries(snapshot.types)) {
-		if (executorUsedTypes?.has(typeName) && snapshotType.settings?.publishEvents === false) throw new Error(`Type "${typeName}" has publishEvents set to false, but it is used by an executor with a record trigger. Either remove the publishEvents: false setting or remove the executor trigger for this type.`);
-		let publishRecordEvents;
-		if (snapshotType.settings?.publishEvents !== void 0) publishRecordEvents = snapshotType.settings.publishEvents;
-		else if (executorUsedTypes?.has(typeName)) publishRecordEvents = true;
-		else publishRecordEvents = baseOptions.publishRecordEvents ?? false;
 		const typeOptions = {
 			...baseOptions,
-			publishRecordEvents
+			subscribed: executorUsedTypes?.has(typeName) ?? false
 		};
 		manifests.set(typeName, generateTailorDBTypeManifestFromSnapshot(snapshotType, typeOptions));
 	}
@@ -9751,6 +10390,11 @@ function applyPreMigrationIndexAdjustments(indexes, typeIndexChanges) {
 * Types for TailorDB migration execution
 */
 /**
+* Maximum length for Kubernetes label values
+* Labels must match pattern: ^[a-z][a-z0-9_-]{0,62}
+*/
+const MAX_LABEL_LENGTH = 63;
+/**
 * Prefix added to migration numbers in labels (required because migration names start with numbers)
 */
 const MIGRATION_LABEL_PREFIX = "m";
@@ -9759,12 +10403,23 @@ const MIGRATION_LABEL_PREFIX = "m";
 */
 const MIGRATION_LABEL_KEY = "sdk-migration";
 /**
+* Sanitize migration number for use as label value
+* Label pattern: ^[a-z][a-z0-9_-]{0,62}
+* - Must start with lowercase letter (add prefix since migration numbers start with digits)
+* - Max 63 characters
+* @param {number} migrationNumber - Migration number to sanitize
+* @returns {string} Sanitized label value
+*/
+function sanitizeMigrationLabel(migrationNumber) {
+	return (MIGRATION_LABEL_PREFIX + formatMigrationNumber(migrationNumber)).slice(0, 63);
+}
+/**
 * Parse migration number from label value
 * @param {string} label - Label value (e.g., "m0001")
 * @returns {number | null} Parsed number or null if invalid
 */
 function parseMigrationLabelNumber(label) {
-	if (!label.startsWith("m")) return null;
+	if (!label.startsWith(MIGRATION_LABEL_PREFIX)) return null;
 	const numStr = label.slice(1);
 	if (!/^\d+$/.test(numStr)) return null;
 	const num = parseInt(numStr, 10);
@@ -9784,6 +10439,283 @@ function handleOptionalToRequiredError(error, messages) {
 	throw error;
 }
 
+//#endregion
+//#region src/cli/commands/tailordb/migrate/schema-checks.ts
+/**
+* Schema validation checks shared between `deploy` and
+* `tailordb migration validate`.
+*
+* These checks are read-only: they compare local type definitions, the
+* migration snapshot history, and the remote schema without mutating any
+* state.
+*/
+/**
+* Convert a runtime TailorDBService to the snapshot-shaped deploy input.
+* @param service - Loaded TailorDB service (after `loadTypes()`)
+* @returns The canonical snapshot-shaped deploy input for downstream plan/apply phases.
+*/
+function toTailorDBDeployInput(service) {
+	const types = {};
+	for (const [typeName, type] of Object.entries(service.types)) types[typeName] = createSnapshotType(type);
+	return {
+		namespace: service.namespace,
+		config: service.config,
+		types
+	};
+}
+/**
+* Fetch all TailorDB types from remote for a namespace
+* @param {OperatorClient} client - Operator client instance
+* @param {string} workspaceId - Workspace ID
+* @param {string} namespace - TailorDB namespace
+* @returns {Promise<ProtoTailorDBType[]>} Remote TailorDB types
+*/
+async function fetchRemoteTypes(client, workspaceId, namespace) {
+	return fetchAllTolerant(async (pageToken, maxPageSize) => {
+		const { tailordbTypes, nextPageToken } = await client.listTailorDBTypes({
+			workspaceId,
+			namespaceName: namespace,
+			pageToken,
+			pageSize: maxPageSize
+		});
+		return [tailordbTypes, nextPageToken];
+	});
+}
+async function fetchRemoteGqlPermissions(client, workspaceId, namespace) {
+	return fetchAllTolerant(async (pageToken, maxPageSize) => {
+		const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
+			workspaceId,
+			namespaceName: namespace,
+			pageToken,
+			pageSize: maxPageSize
+		});
+		return [permissions, nextPageToken];
+	});
+}
+function definedWhenNotEmpty(value) {
+	return Object.keys(value).length > 0 ? value : void 0;
+}
+function namespaceConfig(config, tailorDBInputs, namespace) {
+	return tailorDBInputs.find((input) => input.namespace === namespace)?.config ?? config.db?.[namespace];
+}
+function namespaceGqlOperations(config, tailorDBInputs, namespace) {
+	return namespaceConfig(config, tailorDBInputs, namespace)?.gqlOperations;
+}
+const GQL_OPERATION_KEYS = [
+	"create",
+	"update",
+	"delete",
+	"read"
+];
+function configuredDisabledGqlOperations(operations) {
+	if (!operations) return void 0;
+	if (operations === "query") return {
+		create: false,
+		update: false,
+		delete: false
+	};
+	const disabled = {};
+	for (const key of GQL_OPERATION_KEYS) if (operations[key] === false) disabled[key] = false;
+	return definedWhenNotEmpty(disabled);
+}
+function appliedConfiguredDisabledGqlOperations(remoteDisabled, configuredDisabled) {
+	if (!remoteDisabled || !configuredDisabled) return void 0;
+	const disabled = {};
+	for (const key of GQL_OPERATION_KEYS) if (configuredDisabled[key] === false && remoteDisabled[key]) disabled[key] = false;
+	return definedWhenNotEmpty(disabled);
+}
+function deployComparableSnapshot(snapshot, remoteTypes, gqlOperations) {
+	const remoteTypesByName = new Map(remoteTypes.map((type) => [type.name, type]));
+	const configuredDisabled = configuredDisabledGqlOperations(gqlOperations);
+	const types = {};
+	for (const [typeName, type] of Object.entries(snapshot.types)) {
+		const settings = { ...type.settings };
+		const remoteSettings = remoteTypesByName.get(typeName)?.schema?.settings;
+		if (type.settings?.publishEvents === void 0 && remoteSettings?.publishRecordEvents) settings.publishEvents = true;
+		if (type.settings?.gqlOperations === void 0) {
+			const disabled = appliedConfiguredDisabledGqlOperations(remoteSettings?.disableGqlOperations, configuredDisabled);
+			if (disabled) settings.gqlOperations = disabled;
+		}
+		const comparableType = { ...type };
+		const comparableSettings = definedWhenNotEmpty(settings);
+		if (comparableSettings) comparableType.settings = comparableSettings;
+		else delete comparableType.settings;
+		types[typeName] = comparableType;
+	}
+	return {
+		...snapshot,
+		types
+	};
+}
+async function getRemoteMigrationNumberState(client, workspaceId, namespace) {
+	const trn = resourceTrn(workspaceId, "tailordb", namespace);
+	const metadata = await getOrNull(async () => {
+		const { metadata } = await client.getMetadata({ trn });
+		return metadata;
+	});
+	if (!metadata) return {
+		metadataExists: false,
+		number: null
+	};
+	const label = metadata.labels[MIGRATION_LABEL_KEY];
+	if (!label) return {
+		metadataExists: true,
+		number: null
+	};
+	return {
+		metadataExists: true,
+		number: parseMigrationLabelNumber(label)
+	};
+}
+/**
+* Get the current migration number from remote metadata
+* @param {OperatorClient} client - Operator client instance
+* @param {string} workspaceId - Workspace ID
+* @param {string} namespace - TailorDB namespace
+* @returns {Promise<number | null>} Current migration number, or null if no migration label exists
+*/
+async function getRemoteMigrationNumber(client, workspaceId, namespace) {
+	return (await getRemoteMigrationNumberState(client, workspaceId, namespace)).number;
+}
+/**
+* Verify remote schema matches the expected snapshot state
+* @param {OperatorClient} client - Operator client instance
+* @param {string} workspaceId - Workspace ID
+* @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migration config
+* @param {LoadedConfig} config - Loaded application config
+* @param {ReadonlyArray<TailorDBDeployInput>} tailorDBInputs - Deploy inputs for namespace defaults
+* @returns {Promise<RemoteSchemaVerificationResult[]>} Verification results per namespace
+*/
+async function verifyRemoteSchema(client, workspaceId, namespacesWithMigrations, config, tailorDBInputs) {
+	const results = [];
+	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
+		const { metadataExists, number: remoteMigrationNumber } = await getRemoteMigrationNumberState(client, workspaceId, namespace);
+		if (remoteMigrationNumber === null) {
+			results.push({
+				namespace,
+				remoteMigrationNumber: 0,
+				drifts: [],
+				hasDrift: false,
+				skipped: metadataExists ? "no_migration_label" : "not_deployed"
+			});
+			continue;
+		}
+		if (remoteMigrationNumber > getLatestMigrationNumber(migrationsDir)) {
+			results.push({
+				namespace,
+				remoteMigrationNumber,
+				drifts: [],
+				hasDrift: false,
+				checkpointMissingLocal: true
+			});
+			continue;
+		}
+		const expectedSnapshot = reconstructSnapshotFromMigrations(migrationsDir, remoteMigrationNumber);
+		if (!expectedSnapshot) {
+			results.push({
+				namespace,
+				remoteMigrationNumber,
+				drifts: [],
+				hasDrift: false,
+				skipped: "no_snapshot"
+			});
+			continue;
+		}
+		const [remoteTypes, remoteGqlPermissions] = await Promise.all([fetchRemoteTypes(client, workspaceId, namespace), fetchRemoteGqlPermissions(client, workspaceId, namespace)]);
+		const drifts = compareRemoteWithSnapshot(remoteTypes, deployComparableSnapshot(expectedSnapshot, remoteTypes, namespaceGqlOperations(config, tailorDBInputs, namespace)), remoteGqlPermissions);
+		results.push({
+			namespace,
+			remoteMigrationNumber,
+			drifts,
+			hasDrift: drifts.length > 0
+		});
+	}
+	return results;
+}
+/**
+* Log common causes of remote schema drift and how to resolve them
+*/
+function logRemoteDriftGuidance() {
+	logger.info("This may indicate:");
+	logger.info("  - Another developer applied different migrations", { mode: "plain" });
+	logger.info("  - Manual schema changes were made directly", { mode: "plain" });
+	logger.info("  - Migration history is out of sync", { mode: "plain" });
+	logger.newline();
+	logger.info("To resolve:");
+	logger.info("  - Run 'tailor tailordb migration status' to compare local vs remote.", { mode: "plain" });
+	logger.info("  - If remote is correct, update local types and run 'migration generate'.", { mode: "plain" });
+	logger.info("  - If local migration history is correct, run 'migration sync <N>' to overwrite remote.", { mode: "plain" });
+	logger.info("  - If only bookkeeping is stale, run 'migration set <N>'.", { mode: "plain" });
+}
+/**
+* Format remote schema verification results for display
+* @param {RemoteSchemaVerificationResult[]} results - Verification results
+* @returns {string} Formatted results string
+*/
+function formatRemoteVerificationResults(results) {
+	const lines = [];
+	for (const result of results) {
+		if (!result.hasDrift) continue;
+		lines.push(`Namespace: ${result.namespace}`);
+		lines.push(`  Remote migration: ${formatMigrationNumber(result.remoteMigrationNumber)}`);
+		lines.push(`  Differences:`);
+		lines.push(formatSchemaDrifts(result.drifts));
+		lines.push("");
+	}
+	return lines.join("\n");
+}
+/**
+* Check if there are schema differences between migration snapshots and local definitions
+* @param {ReadonlyMap<string, Record<string, TailorDBSnapshotType>>} typesByNamespace - Snapshot-shaped local types by namespace
+* @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migrations config
+* @returns {Promise<MigrationCheckResult[]>} Results for each namespace
+*/
+async function checkMigrationDiffs(typesByNamespace, namespacesWithMigrations) {
+	const results = [];
+	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
+		const localTypes = typesByNamespace.get(namespace);
+		if (!localTypes) continue;
+		const previousSnapshot = reconstructSnapshotFromMigrations(migrationsDir);
+		if (!previousSnapshot) {
+			results.push({
+				namespace,
+				migrationsDir,
+				hasDiff: true,
+				diff: void 0
+			});
+			continue;
+		}
+		const diff = compareLocalTypesWithSnapshot(previousSnapshot, localTypes, namespace);
+		results.push({
+			namespace,
+			migrationsDir,
+			hasDiff: hasChanges(diff),
+			diff: hasChanges(diff) ? diff : void 0
+		});
+	}
+	return results;
+}
+/**
+* Format migration check results for display
+* @param {MigrationCheckResult[]} results - Migration check results
+* @returns {string} Formatted results string
+*/
+function formatMigrationCheckResults(results) {
+	const lines = [];
+	for (const result of results) {
+		if (!result.hasDiff) continue;
+		lines.push(`Namespace: ${result.namespace}`);
+		if (!result.diff) lines.push("  No migration snapshot found. Run 'tailor tailordb migration generate' first.");
+		else {
+			lines.push(`  ${formatDiffSummary(result.diff)}`);
+			lines.push("");
+			lines.push(formatMigrationDiff(result.diff));
+		}
+		lines.push("");
+	}
+	return lines.join("\n");
+}
+
 //#endregion
 //#region src/cli/commands/tailordb/migrate/bundler.ts
 /**
@@ -9832,31 +10764,39 @@ async function bundleMigrationScript(sourceFile, namespace, migrationNumber, env
     }
   `;
 	fs$2.writeFileSync(entryPath, entryContent);
-	const tsconfig = await resolveTSConfigWithFallback(baseDir ?? path.dirname(absoluteSourcePath));
+	const projectDir = baseDir ?? path.dirname(absoluteSourcePath);
+	const tsconfig = await resolveTSConfigWithFallback(projectDir);
+	const bundleLog = createBundleLog({ tsconfig });
+	const result = await rolldown.build({
+		plugins: [
+			createGeneratedEntryResolverPlugin(entryPath, projectDir),
+			createTsconfigPathsPlugin(),
+			platformBundleDefinePlugin
+		],
+		input: entryPath,
+		write: false,
+		output: {
+			format: "esm",
+			sourcemap: false,
+			minify: false,
+			codeSplitting: false,
+			globals: { tailordb: "tailordb" }
+		},
+		external: ["tailordb"],
+		resolve: { conditionNames: ["node", "import"] },
+		tsconfig,
+		treeshake: {
+			moduleSideEffects: false,
+			annotations: true,
+			unknownGlobalSideEffects: false
+		},
+		...bundleLog.options
+	});
+	bundleLog.assertAllResolved();
 	return {
 		namespace,
 		migrationNumber,
-		bundledCode: (await rolldown.build({
-			plugins: [platformBundleDefinePlugin],
-			input: entryPath,
-			write: false,
-			output: {
-				format: "esm",
-				sourcemap: false,
-				minify: false,
-				codeSplitting: false,
-				globals: { tailordb: "tailordb" }
-			},
-			external: ["tailordb"],
-			resolve: { conditionNames: ["node", "import"] },
-			tsconfig,
-			treeshake: {
-				moduleSideEffects: false,
-				annotations: true,
-				unknownGlobalSideEffects: false
-			},
-			logLevel: "silent"
-		})).output[0].code
+		bundledCode: result.output[0].code
 	};
 }
 
@@ -10201,16 +11141,9 @@ async function executeSingleMigration(options, migration) {
 * @returns {Promise<void>}
 */
 async function updateMigrationLabel(client, workspaceId, namespace, migrationNumber) {
-	const trn = resourceTrn(workspaceId, "tailordb", namespace);
-	const { metadata } = await client.getMetadata({ trn });
-	const existingLabels = metadata?.labels ?? {};
-	const newLabel = `m${formatMigrationNumber(migrationNumber)}`;
-	await client.setMetadata({
-		trn,
-		labels: {
-			...existingLabels,
-			[MIGRATION_LABEL_KEY]: newLabel
-		}
+	await writeMetadataLabels(client, {
+		trn: resourceTrn(workspaceId, "tailordb", namespace),
+		labels: { [MIGRATION_LABEL_KEY]: sanitizeMigrationLabel(migrationNumber) }
 	});
 }
 /**
@@ -10285,169 +11218,6 @@ function groupMigrationsByNamespace(migrations) {
 
 //#endregion
 //#region src/cli/commands/deploy/tailordb/index.ts
-/**
-* Fetch all TailorDB types from remote for a namespace
-* @param {OperatorClient} client - Operator client instance
-* @param {string} workspaceId - Workspace ID
-* @param {string} namespace - TailorDB namespace
-* @returns {Promise<ProtoTailorDBType[]>} Remote TailorDB types
-*/
-async function fetchRemoteTypes(client, workspaceId, namespace) {
-	return fetchAllTolerant(async (pageToken, maxPageSize) => {
-		const { tailordbTypes, nextPageToken } = await client.listTailorDBTypes({
-			workspaceId,
-			namespaceName: namespace,
-			pageToken,
-			pageSize: maxPageSize
-		});
-		return [tailordbTypes, nextPageToken];
-	});
-}
-async function fetchRemoteGqlPermissions(client, workspaceId, namespace) {
-	return fetchAllTolerant(async (pageToken, maxPageSize) => {
-		const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
-			workspaceId,
-			namespaceName: namespace,
-			pageToken,
-			pageSize: maxPageSize
-		});
-		return [permissions, nextPageToken];
-	});
-}
-function definedWhenNotEmpty(value) {
-	return Object.keys(value).length > 0 ? value : void 0;
-}
-function namespaceConfig(config, tailorDBInputs, namespace) {
-	return tailorDBInputs.find((input) => input.namespace === namespace)?.config ?? config.db?.[namespace];
-}
-function namespaceGqlOperations(config, tailorDBInputs, namespace) {
-	return namespaceConfig(config, tailorDBInputs, namespace)?.gqlOperations;
-}
-const GQL_OPERATION_KEYS = [
-	"create",
-	"update",
-	"delete",
-	"read"
-];
-function configuredDisabledGqlOperations(operations) {
-	if (!operations) return void 0;
-	if (operations === "query") return {
-		create: false,
-		update: false,
-		delete: false
-	};
-	const disabled = {};
-	for (const key of GQL_OPERATION_KEYS) if (operations[key] === false) disabled[key] = false;
-	return definedWhenNotEmpty(disabled);
-}
-function appliedConfiguredDisabledGqlOperations(remoteDisabled, configuredDisabled) {
-	if (!remoteDisabled || !configuredDisabled) return void 0;
-	const disabled = {};
-	for (const key of GQL_OPERATION_KEYS) if (configuredDisabled[key] === false && remoteDisabled[key]) disabled[key] = false;
-	return definedWhenNotEmpty(disabled);
-}
-function deployComparableSnapshot(snapshot, remoteTypes, gqlOperations) {
-	const remoteTypesByName = new Map(remoteTypes.map((type) => [type.name, type]));
-	const configuredDisabled = configuredDisabledGqlOperations(gqlOperations);
-	const types = {};
-	for (const [typeName, type] of Object.entries(snapshot.types)) {
-		const settings = { ...type.settings };
-		const remoteSettings = remoteTypesByName.get(typeName)?.schema?.settings;
-		if (type.settings?.publishEvents === void 0 && remoteSettings?.publishRecordEvents) settings.publishEvents = true;
-		if (type.settings?.gqlOperations === void 0) {
-			const disabled = appliedConfiguredDisabledGqlOperations(remoteSettings?.disableGqlOperations, configuredDisabled);
-			if (disabled) settings.gqlOperations = disabled;
-		}
-		const comparableType = { ...type };
-		const comparableSettings = definedWhenNotEmpty(settings);
-		if (comparableSettings) comparableType.settings = comparableSettings;
-		else delete comparableType.settings;
-		types[typeName] = comparableType;
-	}
-	return {
-		...snapshot,
-		types
-	};
-}
-/**
-* Get the current migration number from remote metadata
-* @param {OperatorClient} client - Operator client instance
-* @param {string} workspaceId - Workspace ID
-* @param {string} namespace - TailorDB namespace
-* @returns {Promise<number | null>} Current migration number, or null if no migration label exists
-*/
-async function getRemoteMigrationNumber(client, workspaceId, namespace) {
-	try {
-		const trn = resourceTrn(workspaceId, "tailordb", namespace);
-		const { metadata } = await client.getMetadata({ trn });
-		const label = metadata?.labels["sdk-migration"];
-		if (!label) return null;
-		const match = label.match(/^m(\d+)$/);
-		return match ? parseInt(assertDefined(match[1], "migration label capture group missing"), 10) : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Verify remote schema matches the expected snapshot state
-* @param {OperatorClient} client - Operator client instance
-* @param {string} workspaceId - Workspace ID
-* @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migration config
-* @param {LoadedConfig} config - Loaded application config
-* @param {ReadonlyArray<TailorDBDeployInput>} tailorDBInputs - Deploy inputs for namespace defaults
-* @returns {Promise<RemoteSchemaVerificationResult[]>} Verification results per namespace
-*/
-async function verifyRemoteSchema(client, workspaceId, namespacesWithMigrations, config, tailorDBInputs) {
-	const results = [];
-	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
-		const remoteMigrationNumber = await getRemoteMigrationNumber(client, workspaceId, namespace);
-		if (remoteMigrationNumber === null) {
-			results.push({
-				namespace,
-				remoteMigrationNumber: 0,
-				drifts: [],
-				hasDrift: false
-			});
-			continue;
-		}
-		const expectedSnapshot = reconstructSnapshotFromMigrations(migrationsDir, remoteMigrationNumber);
-		if (!expectedSnapshot) {
-			results.push({
-				namespace,
-				remoteMigrationNumber,
-				drifts: [],
-				hasDrift: false
-			});
-			continue;
-		}
-		const [remoteTypes, remoteGqlPermissions] = await Promise.all([fetchRemoteTypes(client, workspaceId, namespace), fetchRemoteGqlPermissions(client, workspaceId, namespace)]);
-		const drifts = compareRemoteWithSnapshot(remoteTypes, deployComparableSnapshot(expectedSnapshot, remoteTypes, namespaceGqlOperations(config, tailorDBInputs, namespace)), remoteGqlPermissions);
-		results.push({
-			namespace,
-			remoteMigrationNumber,
-			drifts,
-			hasDrift: drifts.length > 0
-		});
-	}
-	return results;
-}
-/**
-* Format remote schema verification results for display
-* @param {RemoteSchemaVerificationResult[]} results - Verification results
-* @returns {string} Formatted results string
-*/
-function formatRemoteVerificationResults(results) {
-	const lines = [];
-	for (const result of results) {
-		if (!result.hasDrift) continue;
-		lines.push(`Namespace: ${result.namespace}`);
-		lines.push(`  Remote migration: ${formatMigrationNumber(result.remoteMigrationNumber)}`);
-		lines.push(`  Differences:`);
-		lines.push(formatSchemaDrifts(result.drifts));
-		lines.push("");
-	}
-	return lines.join("\n");
-}
 const MIGRATION_FILE_KINDS = [
 	"schema",
 	"diff",
@@ -10506,20 +11276,19 @@ async function validateAndDetectMigrations(client, workspaceId, typesByNamespace
 				throw new Error("Schema migration check failed");
 			}
 			const remoteVerificationResults = await verifyRemoteSchema(client, workspaceId, namespacesWithMigrations, config, tailorDBInputs);
+			const missingCheckpointResults = remoteVerificationResults.filter((result) => result.checkpointMissingLocal);
+			if (missingCheckpointResults.length > 0) {
+				logger.error("Remote migration checkpoint is not in the local migration history:");
+				for (const result of missingCheckpointResults) logger.log(`  ${result.namespace}: ${formatMigrationNumber(result.remoteMigrationNumber)}`);
+				logger.newline();
+				logger.info("Pull the latest migration files, or run 'tailor tailordb migration status' to compare.");
+				throw new Error("Remote migration checkpoint verification failed");
+			}
 			if (remoteVerificationResults.some((r) => r.hasDrift)) {
 				logger.error("Remote schema drift detected:");
 				logger.log(formatRemoteVerificationResults(remoteVerificationResults));
 				logger.newline();
-				logger.info("This may indicate:");
-				logger.info("  - Another developer applied different migrations", { mode: "plain" });
-				logger.info("  - Manual schema changes were made directly", { mode: "plain" });
-				logger.info("  - Migration history is out of sync", { mode: "plain" });
-				logger.newline();
-				logger.info("To resolve:");
-				logger.info("  - Run 'tailor tailordb migration status' to compare local vs remote.", { mode: "plain" });
-				logger.info("  - If remote is correct, update local types and run 'migration generate'.", { mode: "plain" });
-				logger.info("  - If local migration history is correct, run 'migration sync <N>' to overwrite remote.", { mode: "plain" });
-				logger.info("  - If only bookkeeping is stale, run 'migration set <N>'.", { mode: "plain" });
+				logRemoteDriftGuidance();
 				logger.newline();
 				logger.info("Use '--no-schema-check' to skip this check (not recommended).");
 				throw new Error("Remote schema verification failed");
@@ -10557,7 +11326,7 @@ async function reconcileMigrationLabels(client, workspaceId, namespacesWithMigra
 	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
 		if (getMigrationFiles(migrationsDir).length === 0) continue;
 		const targetVersion = getLatestMigrationNumber(migrationsDir);
-		const currentVersion = await getRemoteMigrationNumber(client, workspaceId, namespace);
+		const currentVersion = await getRemoteMigrationNumber(client, workspaceId, namespace).catch(() => null);
 		if (currentVersion === targetVersion) continue;
 		await updateMigrationLabel(client, workspaceId, namespace, targetVersion);
 		const from = currentVersion === null ? "<unset>" : formatMigrationNumber(currentVersion);
@@ -10663,14 +11432,26 @@ async function applyTailorDB(client, result, phase = "create-update") {
 			});
 			if (remainingGqlPermissionDeletes.length > 0) await Promise.all(remainingGqlPermissionDeletes.map((del) => client.deleteTailorDBGQLPermission(del.request)));
 			await Promise.all(changeSet.type.deletes.filter((del) => isOutsideMigrations(del.request.namespaceName) && !deletedResources.types.has(del.name)).map((del) => client.deleteTailorDBType(del.request)));
+			await Promise.all([
+				...changeSet.type.creates,
+				...changeSet.type.updates,
+				...changeSet.type.unchanged
+			].filter((entry) => entry.metaRequest && !deletedResources.types.has(entry.name)).flatMap((entry) => entry.metaRequest ? [writeMetadataLabels(client, entry.metaRequest)] : []));
 		} else {
 			await Promise.all([...changeSet.service.creates.map(async (create) => {
 				await client.createTailorDBService(create.request);
-				await client.setMetadata(create.metaRequest);
-			}), ...changeSet.service.updates.map((update) => client.setMetadata(update.metaRequest))]);
+				await writeMetadataLabels(client, create.metaRequest);
+			}), ...changeSet.service.updates.map((update) => writeMetadataLabels(client, update.metaRequest))]);
 			try {
-				for (const create of changeSet.type.creates) await client.createTailorDBType(create.request);
-				for (const update of changeSet.type.updates) await client.updateTailorDBType(update.request);
+				for (const create of changeSet.type.creates) {
+					await client.createTailorDBType(create.request);
+					await writeMetadataLabels(client, create.metaRequest);
+				}
+				for (const update of changeSet.type.updates) {
+					await client.updateTailorDBType(update.request);
+					await writeMetadataLabels(client, update.metaRequest);
+				}
+				await Promise.all(changeSet.type.unchanged.flatMap((entry) => entry.metaRequest ? [writeMetadataLabels(client, entry.metaRequest)] : []));
 			} catch (error) {
 				handleOptionalToRequiredError(error, ["Run 'tailor tailordb migration generate' to create migration files.", "Migration scripts allow you to handle existing data before applying the schema change."]);
 			}
@@ -10713,8 +11494,8 @@ function getDeletedTypeNames(migration) {
 async function executeServicesCreation(client, changeSet) {
 	await Promise.all([...changeSet.service.creates.map(async (create) => {
 		await client.createTailorDBService(create.request);
-		await client.setMetadata(create.metaRequest);
-	}), ...changeSet.service.updates.map((update) => client.setMetadata(update.metaRequest))]);
+		await writeMetadataLabels(client, create.metaRequest);
+	}), ...changeSet.service.updates.map((update) => writeMetadataLabels(client, update.metaRequest))]);
 }
 /**
 * Track which types have been created/updated across migrations
@@ -10759,7 +11540,7 @@ function buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executor
 	if (!snapshotType) return void 0;
 	const input = tailorDBInputs.find((i) => i.namespace === migration.namespace);
 	return generateTailorDBTypeManifestFromSnapshot(snapshotType, {
-		publishRecordEvents: executorUsedTypes.has(snapshotType.name),
+		subscribed: executorUsedTypes.has(snapshotType.name),
 		namespaceGqlOperations: input?.config.gqlOperations
 	});
 }
@@ -10962,7 +11743,7 @@ async function rollbackSingleMigrationPrePhase(client, changeSet, migration, wor
 		try {
 			if (priorType) {
 				const manifest = generateTailorDBTypeManifestFromSnapshot(priorType, {
-					publishRecordEvents: executorUsedTypes.has(priorType.name),
+					subscribed: executorUsedTypes.has(priorType.name),
 					namespaceGqlOperations: input?.config.gqlOperations
 				});
 				await client.updateTailorDBType({
@@ -10988,19 +11769,10 @@ async function rollbackSingleMigrationPrePhase(client, changeSet, migration, wor
 	}
 }
 /**
-* Convert a runtime TailorDBService to the snapshot-shaped deploy input.
-* @param service - Loaded TailorDB service (after `loadTypes()`)
-* @returns The canonical snapshot-shaped deploy input for downstream plan/apply phases.
+* Plan TailorDB-related changes based on current and desired state.
+* @param context - Planning context
+* @returns Planned changes
 */
-function toTailorDBDeployInput(service) {
-	const types = {};
-	for (const [typeName, type] of Object.entries(service.types)) types[typeName] = createSnapshotType(type);
-	return {
-		namespace: service.namespace,
-		config: service.config,
-		types
-	};
-}
 async function planTailorDB(context) {
 	const { client, workspaceId, application, forRemoval, config, noSchemaCheck, forceApplyAll = false } = context;
 	const tailordbs = [];
@@ -11019,7 +11791,12 @@ async function planTailorDB(context) {
 	} : await validateAndDetectMigrations(client, workspaceId, typesByNamespace, config, noSchemaCheck ?? false, tailordbs);
 	const { changeSet: serviceChangeSet, conflicts, unmanaged, resourceOwners } = await planServices(client, workspaceId, application.name, application.id, tailordbs);
 	const deletedServices = serviceChangeSet.deletes.map((del) => del.name);
-	const [typeChangeSet, gqlPermissionChangeSet] = await Promise.all([planTypes(client, workspaceId, tailordbs, executorUsedTypes, deletedServices, void 0, forceApplyAll), planGqlPermissions(client, workspaceId, tailordbs, deletedServices, forceApplyAll)]);
+	const [typeChangeSet, gqlPermissionChangeSet] = await Promise.all([planTypes(client, workspaceId, tailordbs, executorUsedTypes, deletedServices, void 0, forceApplyAll, {
+		appName: application.name,
+		appId: application.id,
+		dependentApps: context.dependentApps,
+		runAppIds: context.runAppIds
+	}), planGqlPermissions(client, workspaceId, tailordbs, deletedServices, forceApplyAll)]);
 	typeChangeSet.creates.sort(byName);
 	typeChangeSet.updates.sort(byName);
 	typeChangeSet.deletes.sort(byName);
@@ -11118,8 +11895,7 @@ async function planServices(client, workspaceId, appName, appId, tailordbs) {
 		const metaRequest = await buildMetaRequest({
 			trn: resourceTrn(workspaceId, "tailordb", tailordb.namespace),
 			appName,
-			appId,
-			existingLabels: existing?.allLabels
+			appId
 		});
 		if (existing) {
 			if (trackDesiredResourceOwnership({
@@ -11170,8 +11946,29 @@ async function planServices(client, workspaceId, appName, appId, tailordbs) {
 		resourceOwners
 	};
 }
-async function planTypes(client, workspaceId, tailordbs, executorUsedTypes, deletedServices, filteredTypesByNamespace, forceApplyAll = false) {
+async function planTypes(client, workspaceId, tailordbs, executorUsedTypes, deletedServices, filteredTypesByNamespace, forceApplyAll = false, records = {}) {
 	const changeSet = createChangeSet("TailorDB types");
+	const { appName, appId, dependentApps, runAppIds } = records;
+	/**
+	* Build one type's metadata write, carrying the dependency records that belong
+	* to it. The type is what publishes record events, so the record lives there.
+	* @param namespace - Namespace holding the type
+	* @param typeName - Type name
+	* @param explicitPublishEvents - `publishEvents` declared on the type, if any
+	* @returns The type's metadata write
+	*/
+	const typeMetaRequest = async (namespace, typeName, explicitPublishEvents) => {
+		return addDependencyRecords(await buildMetaRequest({
+			trn: tailorDBTypeTrn(workspaceId, namespace, typeName),
+			appName: appName ?? "",
+			appId
+		}), {
+			key: eventSourceKey.tailorDBType(namespace, typeName),
+			dependentApps,
+			runAppIds,
+			pinned: explicitPublishEvents !== void 0
+		});
+	};
 	const fetchTypes = (namespaceName) => {
 		return fetchAllTolerant(async (pageToken, maxPageSize) => {
 			const { tailordbTypes, nextPageToken } = await client.listTailorDBTypes({
@@ -11185,27 +11982,36 @@ async function planTypes(client, workspaceId, tailordbs, executorUsedTypes, dele
 	};
 	for (const tailordb of tailordbs) {
 		const types = filteredTypesByNamespace?.get(tailordb.namespace) ?? tailordb.types;
-		for (const [typeName, type] of Object.entries(types)) if (executorUsedTypes.has(typeName) && type.settings?.publishEvents === false) throw new Error(`Type "${typeName}" has publishEvents set to false, but it is used by an executor with a record trigger. Either remove the publishEvents: false setting or remove the executor trigger for this type.`);
+		for (const [typeName, type] of Object.entries(types)) assertNoPublishEventsConflict({
+			explicit: type.settings?.publishEvents,
+			subscribed: executorUsedTypes.has(typeName),
+			conflict: publishEventsConflict.tailorDBType(typeName)
+		});
 	}
 	for (const tailordb of tailordbs) {
 		const existingTypes = await fetchTypes(tailordb.namespace);
 		const existingTypesMap = new Map(existingTypes.map((type) => [type.name, type]));
 		const types = filteredTypesByNamespace?.get(tailordb.namespace) ?? tailordb.types;
+		const typeMeta = (typeName) => typeMetaRequest(tailordb.namespace, typeName, types[typeName]?.settings?.publishEvents);
 		for (const [typeName, tailordbTypeSnapshot] of Object.entries(types)) {
 			const tailordbType = generateTailorDBTypeManifestFromSnapshot(tailordbTypeSnapshot, {
-				publishRecordEvents: executorUsedTypes.has(typeName),
+				subscribed: executorUsedTypes.has(typeName),
 				namespaceGqlOperations: tailordb.config.gqlOperations
 			});
 			const existingType = existingTypesMap.get(typeName);
 			if (existingType) {
-				if (!forceApplyAll && areNormalizedEqual(normalizeComparableTailorDBType(existingType), normalizeComparableTailorDBType(tailordbType))) changeSet.unchanged.push({ name: typeName });
+				if (!forceApplyAll && areNormalizedEqual(normalizeComparableTailorDBType(existingType), normalizeComparableTailorDBType(tailordbType))) changeSet.unchanged.push({
+					name: typeName,
+					metaRequest: await typeMeta(typeName)
+				});
 				else changeSet.updates.push({
 					name: typeName,
 					request: {
 						workspaceId,
 						namespaceName: tailordb.namespace,
 						tailordbType
-					}
+					},
+					metaRequest: await typeMeta(typeName)
 				});
 				existingTypesMap.delete(typeName);
 			} else changeSet.creates.push({
@@ -11214,7 +12020,8 @@ async function planTypes(client, workspaceId, tailordbs, executorUsedTypes, dele
 					workspaceId,
 					namespaceName: tailordb.namespace,
 					tailordbType
-				}
+				},
+				metaRequest: await typeMeta(typeName)
 			});
 		}
 		existingTypesMap.forEach((_type, name) => {
@@ -11375,83 +12182,32 @@ async function planGqlPermissions(client, workspaceId, tailordbs, deletedService
 		}
 		existingNameSet.forEach((name) => {
 			changeSet.deletes.push({
-				name,
-				request: {
-					workspaceId,
-					namespaceName: tailordb.namespace,
-					typeName: name
-				}
-			});
-		});
-	}
-	for (const namespaceName of deletedServices) (await fetchGqlPermissions(namespaceName)).forEach((gqlPermission) => {
-		changeSet.deletes.push({
-			name: gqlPermission.typeName,
-			request: {
-				workspaceId,
-				namespaceName,
-				typeName: gqlPermission.typeName
-			}
-		});
-	});
-	return changeSet;
-}
-function normalizeComparableGqlPermission(permission) {
-	return { policies: (normalizeProtoConfig(permission)?.policies ?? []).map((policy) => ({
-		...policy,
-		actions: (policy.actions ?? []).toSorted((left, right) => left - right)
-	})) };
-}
-/**
-* Check if there are schema differences between migration snapshots and local definitions
-* @param {ReadonlyMap<string, Record<string, TailorDBSnapshotType>>} typesByNamespace - Snapshot-shaped local types by namespace
-* @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migrations config
-* @returns {Promise<MigrationCheckResult[]>} Results for each namespace
-*/
-async function checkMigrationDiffs(typesByNamespace, namespacesWithMigrations) {
-	const results = [];
-	for (const { namespace, migrationsDir } of namespacesWithMigrations) {
-		const localTypes = typesByNamespace.get(namespace);
-		if (!localTypes) continue;
-		const previousSnapshot = reconstructSnapshotFromMigrations(migrationsDir);
-		if (!previousSnapshot) {
-			results.push({
-				namespace,
-				migrationsDir,
-				hasDiff: true,
-				diff: void 0
-			});
-			continue;
-		}
-		const diff = compareLocalTypesWithSnapshot(previousSnapshot, localTypes, namespace);
-		results.push({
-			namespace,
-			migrationsDir,
-			hasDiff: hasChanges(diff),
-			diff: hasChanges(diff) ? diff : void 0
+				name,
+				request: {
+					workspaceId,
+					namespaceName: tailordb.namespace,
+					typeName: name
+				}
+			});
 		});
 	}
-	return results;
+	for (const namespaceName of deletedServices) (await fetchGqlPermissions(namespaceName)).forEach((gqlPermission) => {
+		changeSet.deletes.push({
+			name: gqlPermission.typeName,
+			request: {
+				workspaceId,
+				namespaceName,
+				typeName: gqlPermission.typeName
+			}
+		});
+	});
+	return changeSet;
 }
-/**
-* Format migration check results for display
-* @param {MigrationCheckResult[]} results - Migration check results
-* @returns {string} Formatted results string
-*/
-function formatMigrationCheckResults(results) {
-	const lines = [];
-	for (const result of results) {
-		if (!result.hasDiff) continue;
-		lines.push(`Namespace: ${result.namespace}`);
-		if (!result.diff) lines.push("  No migration snapshot found. Run 'tailor tailordb migration generate' first.");
-		else {
-			lines.push(`  ${formatDiffSummary(result.diff)}`);
-			lines.push("");
-			lines.push(formatMigrationDiff(result.diff));
-		}
-		lines.push("");
-	}
-	return lines.join("\n");
+function normalizeComparableGqlPermission(permission) {
+	return { policies: (normalizeProtoConfig(permission)?.policies ?? []).map((policy) => ({
+		...policy,
+		actions: (policy.actions ?? []).toSorted((left, right) => left - right)
+	})) };
 }
 
 //#endregion
@@ -11466,32 +12222,38 @@ function formatMigrationCheckResults(results) {
 async function applyWorkflow(client, result, phase = "create-update") {
 	const { changeSet, appName, appId } = result;
 	if (phase === "create-update") {
-		const jobFunctionVersions = await registerJobFunctions(client, changeSet, appName, appId, result.unchangedWorkflowJobNames);
-		await Promise.all([...changeSet.creates.map(async (create) => {
-			const filteredVersions = filterJobFunctionVersions(jobFunctionVersions, create.usedJobNames);
-			const shape = buildWorkflowValidationShape(create.workspaceId, create.workflow);
-			await client.createWorkflow({
-				workspaceId: shape.workspaceId,
-				workflowName: shape.workflowName,
-				mainJobFunctionName: shape.mainJobFunctionName,
-				retryPolicy: shape.retryPolicy,
-				concurrencyPolicy: shape.concurrencyPolicy,
-				jobFunctions: filteredVersions
-			});
-			await client.setMetadata(create.metaRequest);
-		}), ...changeSet.updates.map(async (update) => {
-			const filteredVersions = filterJobFunctionVersions(jobFunctionVersions, update.usedJobNames);
-			const shape = buildWorkflowValidationShape(update.workspaceId, update.workflow);
-			await client.updateWorkflow({
-				workspaceId: shape.workspaceId,
-				workflowName: shape.workflowName,
-				mainJobFunctionName: shape.mainJobFunctionName,
-				retryPolicy: shape.retryPolicy,
-				concurrencyPolicy: shape.concurrencyPolicy,
-				jobFunctions: filteredVersions
-			});
-			await client.setMetadata(update.metaRequest);
-		})]);
+		const jobFunctionVersions = await registerJobFunctions(client, changeSet, appName, appId, result.unchangedWorkflowJobNames, result.jobFunctionPublishEvents);
+		await Promise.all([
+			...changeSet.creates.map(async (create) => {
+				const filteredVersions = filterJobFunctionVersions(jobFunctionVersions, create.usedJobNames);
+				const shape = buildWorkflowValidationShape(create.workspaceId, create.workflow);
+				await client.createWorkflow({
+					workspaceId: shape.workspaceId,
+					workflowName: shape.workflowName,
+					mainJobFunctionName: shape.mainJobFunctionName,
+					retryPolicy: shape.retryPolicy,
+					concurrencyPolicy: shape.concurrencyPolicy,
+					jobFunctions: filteredVersions,
+					publishExecutionEvents: shape.publishExecutionEvents
+				});
+				await writeMetadataLabels(client, create.metaRequest);
+			}),
+			...changeSet.updates.map(async (update) => {
+				const filteredVersions = filterJobFunctionVersions(jobFunctionVersions, update.usedJobNames);
+				const shape = buildWorkflowValidationShape(update.workspaceId, update.workflow);
+				await client.updateWorkflow({
+					workspaceId: shape.workspaceId,
+					workflowName: shape.workflowName,
+					mainJobFunctionName: shape.mainJobFunctionName,
+					retryPolicy: shape.retryPolicy,
+					concurrencyPolicy: shape.concurrencyPolicy,
+					jobFunctions: filteredVersions,
+					publishExecutionEvents: shape.publishExecutionEvents
+				});
+				await writeMetadataLabels(client, update.metaRequest);
+			}),
+			...changeSet.unchanged.flatMap((entry) => entry.metaRequest ? [writeMetadataLabels(client, entry.metaRequest)] : [])
+		]);
 	} else {
 		await deleteAllSettled(changeSet.deletes.map((del) => ({
 			resourceType: "workflow",
@@ -11549,9 +12311,10 @@ function filterJobFunctionVersions(allVersions, usedJobNames) {
 * @param appName - Application name
 * @param appId - Application ID used for job function metadata when available
 * @param unchangedWorkflowJobNames - Job function names used by unchanged workflows
+* @param jobFunctionPublishEvents - Resolved `publishExecutionEvents` keyed by job function name
 * @returns Map of job function names to versions
 */
-async function registerJobFunctions(client, changeSet, appName, appId, unchangedWorkflowJobNames = /* @__PURE__ */ new Set()) {
+async function registerJobFunctions(client, changeSet, appName, appId, unchangedWorkflowJobNames = /* @__PURE__ */ new Set(), jobFunctionPublishEvents = /* @__PURE__ */ new Map()) {
 	const jobFunctionVersions = {};
 	const firstWorkflow = changeSet.creates[0] || changeSet.updates[0] || changeSet.deletes[0];
 	if (!firstWorkflow) return jobFunctionVersions;
@@ -11570,16 +12333,15 @@ async function registerJobFunctions(client, changeSet, appName, appId, unchanged
 	const existingJobNamesSet = new Set(existingJobFunctions);
 	if (changeSet.creates.length > 0 || changeSet.updates.length > 0) {
 		const results = await Promise.all(Array.from(allUsedJobNames).map(async (jobName) => {
-			const response = existingJobNamesSet.has(jobName) ? await client.updateWorkflowJobFunction({
-				workspaceId,
-				jobFunctionName: jobName,
-				scriptRef: workflowJobFunctionName(jobName)
-			}) : await client.createWorkflowJobFunction({
+			const isExisting = existingJobNamesSet.has(jobName);
+			const request = {
 				workspaceId,
 				jobFunctionName: jobName,
-				scriptRef: workflowJobFunctionName(jobName)
-			});
-			await client.setMetadata(await buildMetaRequest({
+				scriptRef: workflowJobFunctionName(jobName),
+				publishExecutionEvents: jobFunctionPublishEvents.get(jobName) ?? false
+			};
+			const response = isExisting ? await client.updateWorkflowJobFunction(request) : await client.createWorkflowJobFunction(request);
+			await writeMetadataLabels(client, await buildMetaRequest({
 				trn: resourceTrn(workspaceId, "workflow_job_function", jobName),
 				appName,
 				appId
@@ -11625,9 +12387,77 @@ function buildWorkflowValidationShape(workspaceId, workflow) {
 		workflowName: workflow.name,
 		mainJobFunctionName: workflow.mainJob.name,
 		...workflow.retryPolicy && { retryPolicy: toRetryPolicy(workflow.retryPolicy) },
-		...workflow.concurrencyPolicy && { concurrencyPolicy: toConcurrencyPolicy(workflow.concurrencyPolicy) }
+		...workflow.concurrencyPolicy && { concurrencyPolicy: toConcurrencyPolicy(workflow.concurrencyPolicy) },
+		publishExecutionEvents: workflow.publishEvents ?? false
 	};
 }
+const NO_EVENT_SUBSCRIBERS = { workflowNames: /* @__PURE__ */ new Set() };
+function isSubscribed(subscribers, workflowName) {
+	return subscribers.workflowNames.has(workflowName);
+}
+/**
+* Job names the given workflows' subscriptions enable.
+*
+* A job execution trigger names a workflow rather than a job, so the value is
+* resolved per job name over the union of the workflows that run it: a job two
+* workflows share stays on while either one is subscribed. Whoever asks whether a
+* job still publishes has to apply that same union, which is why this is shared
+* rather than restated — the two answering it differently is what let a shared
+* job be reported as turning off while a peer subscription kept it on.
+* @param params - Workflows, the jobs each runs, and which are subscribed
+* @param params.workflows - Workflows whose job sets are considered
+* @param params.mainJobDeps - Job names each workflow runs, keyed by its main job
+* @param params.isSubscribed - Whether a workflow's jobs are subscribed in this run
+* @returns Job names those subscriptions enable
+*/
+function subscribedWorkflowJobNames(params) {
+	const { workflows, mainJobDeps, isSubscribed } = params;
+	const jobNames = /* @__PURE__ */ new Set();
+	for (const workflow of workflows) {
+		if (!isSubscribed(workflow.name)) continue;
+		for (const jobName of mainJobDeps[workflow.mainJob.name] ?? []) jobNames.add(jobName);
+	}
+	return jobNames;
+}
+/**
+* Resolve `publishExecutionEvents` for every job function used by a workflow.
+*
+* A job execution trigger names a workflow rather than a job, so a subscription
+* opts in every job that workflow runs.
+* @param params - Workflows, their job dependencies, subscribers, and explicit job flags
+* @returns Resolved flags keyed by job function name
+*/
+function resolveJobPublishEvents(params) {
+	const { workflows, mainJobDeps, subscribers, explicit } = params;
+	const usedJobNames = /* @__PURE__ */ new Set();
+	for (const workflow of Object.values(workflows)) for (const jobName of mainJobDeps[workflow.mainJob.name] ?? []) usedJobNames.add(jobName);
+	const subscribedJobNames = subscribedWorkflowJobNames({
+		workflows: Object.values(workflows),
+		mainJobDeps,
+		isSubscribed: (workflowName) => isSubscribed(subscribers, workflowName)
+	});
+	const resolved = /* @__PURE__ */ new Map();
+	for (const jobName of usedJobNames) resolved.set(jobName, resolvePublishEvents({
+		explicit: explicit.get(jobName),
+		subscribed: subscribedJobNames.has(jobName),
+		conflict: publishEventsConflict.workflowJob(jobName)
+	}));
+	return resolved;
+}
+/**
+* Collect job functions whose remote publishing flag no longer matches the plan.
+* @param existing - Existing job functions keyed by name
+* @param resolved - Resolved `publishExecutionEvents` keyed by job function name
+* @returns Job function names needing re-registration
+*/
+function collectStaleJobFunctionNames(existing, resolved) {
+	const stale = /* @__PURE__ */ new Set();
+	for (const [jobName, publishEvents] of resolved) {
+		const remote = existing.get(jobName);
+		if (remote && remote.publishExecutionEvents !== publishEvents) stale.add(jobName);
+	}
+	return stale;
+}
 /**
 * Plan workflow changes and job functions based on current and desired state.
 * @param client - Operator client instance
@@ -11637,15 +12467,31 @@ function buildWorkflowValidationShape(workspaceId, workflow) {
 * @param workflows - Parsed workflows
 * @param mainJobDeps - Main job dependencies by workflow
 * @param unchangedJobFunctions - Job functions already proven unchanged by function registry plan
+* @param eventPublishing - Executor subscriptions and explicit job flags driving execution event publishing
 * @returns Planned workflow changes
 */
-async function planWorkflow(client, workspaceId, appName, appId, workflows, mainJobDeps, unchangedJobFunctions = /* @__PURE__ */ new Set()) {
+async function planWorkflow(client, workspaceId, appName, appId, workflows, mainJobDeps, unchangedJobFunctions = /* @__PURE__ */ new Set(), eventPublishing = {}) {
 	const changeSet = createChangeSet("Workflows");
 	const conflicts = [];
 	const unmanaged = [];
 	const resourceOwners = /* @__PURE__ */ new Set();
 	const unchangedWorkflowJobNames = /* @__PURE__ */ new Set();
 	const retainedWorkflowJobNames = /* @__PURE__ */ new Set();
+	const executionSubscribers = eventPublishing.execution ?? NO_EVENT_SUBSCRIBERS;
+	const { dependentApps, runAppIds } = eventPublishing;
+	const everyJobDeclaresPublishEvents = (workflowName) => {
+		const jobNames = mainJobDeps[workflows[workflowName]?.mainJob.name ?? ""] ?? [];
+		const explicit = eventPublishing.jobPublishEvents ?? /* @__PURE__ */ new Map();
+		return jobNames.length > 0 && jobNames.every((jobName) => explicit.has(jobName));
+	};
+	const existingJobFunctions = await fetchExistingJobFunctions(client, workspaceId);
+	const jobFunctionPublishEvents = resolveJobPublishEvents({
+		workflows,
+		mainJobDeps,
+		subscribers: eventPublishing.jobExecution ?? NO_EVENT_SUBSCRIBERS,
+		explicit: eventPublishing.jobPublishEvents ?? /* @__PURE__ */ new Map()
+	});
+	const staleJobFunctionNames = collectStaleJobFunctionNames(existingJobFunctions, jobFunctionPublishEvents);
 	const existingWorkflows = await fetchExistingResourcesWithLabels({
 		client,
 		fetchPage: async (pageToken, pageSize) => {
@@ -11661,14 +12507,34 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 	});
 	for (const workflow of Object.values(workflows)) {
 		const existing = existingWorkflows[workflow.name];
-		const metaRequest = await buildMetaRequest({
+		const metaRequest = addDependencyRecords(await buildMetaRequest({
 			trn: resourceTrn(workspaceId, "workflow", workflow.name),
 			appName,
 			appId
+		}), {
+			key: eventSourceKey.workflow(workflow.name),
+			dependentApps,
+			runAppIds,
+			pinned: workflow.publishEvents !== void 0
+		});
+		addDependencyRecords(metaRequest, {
+			key: eventSourceKey.workflowJobs(workflow.name),
+			dependentApps,
+			runAppIds,
+			pinned: everyJobDeclaresPublishEvents(workflow.name),
+			scope: "jobs"
 		});
 		const usedJobNames = mainJobDeps[workflow.mainJob.name];
 		if (!usedJobNames) throw new Error(`Job "${workflow.mainJob.name}" (mainJob of workflow "${workflow.name}") was not found.\n\nPossible causes:\n  - The job is not exported as a named export\n  - The file containing the job is not included in workflow.files glob pattern\n\nSolution:\n  export const ${workflow.mainJob.name} = createWorkflowJob({ name: "${workflow.mainJob.name}", ... })`);
 		usedJobNames.forEach((jobName) => retainedWorkflowJobNames.add(jobName));
+		const desiredWorkflow = {
+			...workflow,
+			publishEvents: resolvePublishEvents({
+				explicit: workflow.publishEvents,
+				subscribed: isSubscribed(executionSubscribers, workflow.name),
+				conflict: publishEventsConflict.workflow(workflow.name)
+			})
+		};
 		if (existing) {
 			if (trackDesiredResourceOwnership({
 				labels: existing.allLabels,
@@ -11679,13 +12545,22 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 				resourceName: workflow.name,
 				conflicts,
 				unmanaged
-			}) && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && canTreatWorkflowAsUnchanged(existing.resource, workflow, usedJobNames, unchangedJobFunctions)) {
-				changeSet.unchanged.push({ name: workflow.name });
+			}) && hasMatchingSdkVersion(existing.allLabels, metaRequest.labels) && canTreatWorkflowAsUnchanged({
+				existing: existing.resource,
+				workflow: desiredWorkflow,
+				usedJobNames,
+				unchangedJobFunctions,
+				staleJobFunctionNames
+			})) {
+				changeSet.unchanged.push({
+					name: workflow.name,
+					metaRequest
+				});
 				for (const jobName of usedJobNames) unchangedWorkflowJobNames.add(jobName);
 			} else changeSet.updates.push({
 				name: workflow.name,
 				workspaceId,
-				workflow,
+				workflow: desiredWorkflow,
 				usedJobNames,
 				metaRequest
 			});
@@ -11693,7 +12568,7 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 		} else changeSet.creates.push({
 			name: workflow.name,
 			workspaceId,
-			workflow,
+			workflow: desiredWorkflow,
 			usedJobNames,
 			metaRequest
 		});
@@ -11723,7 +12598,9 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 		workspaceId,
 		appName,
 		appId,
-		retainedWorkflowJobNames
+		existingJobFunctionNames: [...existingJobFunctions.keys()],
+		retainedWorkflowJobNames,
+		resourceOwners
 	});
 	const deletableJobNames = new Set(jobFunctionDeletes.map((del) => del.jobFunctionName));
 	for (const del of deleteWorkflows) changeSet.deletes.push({
@@ -11738,23 +12615,33 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 		appName,
 		appId,
 		unchangedWorkflowJobNames,
-		jobFunctionDeletes
+		jobFunctionDeletes,
+		jobFunctionPublishEvents
 	};
 }
-async function planWorkflowJobFunctionDeletes(params) {
-	const { client, workspaceId, appName, appId, retainedWorkflowJobNames } = params;
-	const existingJobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
+async function fetchExistingJobFunctions(client, workspaceId) {
+	const jobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
 		const response = await client.listWorkflowJobFunctions({
 			workspaceId,
 			pageToken,
 			pageSize: maxPageSize
 		});
-		return [response.jobFunctions.map((jobFunction) => jobFunction.name), response.nextPageToken];
+		return [response.jobFunctions, response.nextPageToken];
 	});
-	const candidates = [...new Set(existingJobFunctions)].filter((jobName) => !retainedWorkflowJobNames.has(jobName));
+	return new Map(jobFunctions.map((jobFunction) => [jobFunction.name, jobFunction]));
+}
+async function planWorkflowJobFunctionDeletes(params) {
+	const { client, workspaceId, appName, appId, existingJobFunctionNames, retainedWorkflowJobNames, resourceOwners } = params;
+	const candidates = existingJobFunctionNames.filter((jobName) => !retainedWorkflowJobNames.has(jobName));
 	return (await Promise.all(candidates.map(async (jobFunctionName) => {
 		const { metadata } = await client.getMetadata({ trn: resourceTrn(workspaceId, "workflow_job_function", jobFunctionName) });
-		return isOwnedByApp(metadata?.labels, appName, appId) ? {
+		return trackRemainingResourceOwner({
+			labels: metadata?.labels,
+			ownerLabel: metadata?.labels["sdk-name"],
+			appName,
+			appId,
+			resourceOwners
+		}) ? {
 			workspaceId,
 			jobFunctionName
 		} : void 0;
@@ -11769,12 +12656,14 @@ async function planWorkflowJobFunctionDeletes(params) {
 function formatWorkflowChangeEntries(changeSet, workflowJobFunctionChanges) {
 	return formatChangeEntriesWithFunctionRegistry("workflow", changeSet, workflowJobFunctionChanges, (item) => "usedJobNames" in item ? item.usedJobNames.map((jobName) => workflowJobFunctionName(jobName)) : []);
 }
-function canTreatWorkflowAsUnchanged(existing, workflow, usedJobNames, unchangedJobFunctions) {
+function canTreatWorkflowAsUnchanged(params) {
+	const { existing, workflow, usedJobNames, unchangedJobFunctions, staleJobFunctionNames } = params;
 	if (!usedJobNames.every((jobName) => unchangedJobFunctions.has(jobName))) return false;
+	if (usedJobNames.some((jobName) => staleJobFunctionNames.has(jobName))) return false;
 	return areWorkflowsEqual(existing, workflow, usedJobNames);
 }
 function areWorkflowsEqual(existing, workflow, usedJobNames) {
-	return existing.mainJobFunctionName === workflow.mainJob.name && areNormalizedEqual(normalizeComparableExistingWorkflowRetryPolicy(existing.retryPolicy), normalizeComparableWorkflowRetryPolicy(workflow.retryPolicy)) && areNormalizedEqual(normalizeComparableConcurrencyPolicy(existing.concurrencyPolicy), normalizeComparableConcurrencyPolicy(workflow.concurrencyPolicy)) && areNormalizedEqual(normalizeComparableWorkflowJobNames(existing.jobFunctions), normalizeComparableWorkflowJobNames(usedJobNames));
+	return existing.mainJobFunctionName === workflow.mainJob.name && (existing.publishExecutionEvents ?? false) === (workflow.publishEvents ?? false) && areNormalizedEqual(normalizeComparableExistingWorkflowRetryPolicy(existing.retryPolicy), normalizeComparableWorkflowRetryPolicy(workflow.retryPolicy)) && areNormalizedEqual(normalizeComparableConcurrencyPolicy(existing.concurrencyPolicy), normalizeComparableConcurrencyPolicy(workflow.concurrencyPolicy)) && areNormalizedEqual(normalizeComparableWorkflowJobNames(existing.jobFunctions), normalizeComparableWorkflowJobNames(usedJobNames));
 }
 function normalizeComparableExistingWorkflowRetryPolicy(policy) {
 	if (!policy) return;
@@ -11993,7 +12882,7 @@ async function applyWorkflowJobFunctionExecutionPolicy(client, plan, phase = "cr
 				executionPolicyKey: toPlatformExecutionPolicyKey(replace.policy),
 				concurrencyPolicy: toConcurrencyPolicyInit(replace.policy.concurrencyPolicy)
 			});
-			await client.setMetadata(replace.metaRequest);
+			await writeMetadataLabels(client, replace.metaRequest);
 		}),
 		...changeSet.creates.map(async (create) => {
 			await client.createWorkflowJobFunctionExecutionPolicy({
@@ -12002,7 +12891,7 @@ async function applyWorkflowJobFunctionExecutionPolicy(client, plan, phase = "cr
 				executionPolicyKey: toPlatformExecutionPolicyKey(create.policy),
 				concurrencyPolicy: toConcurrencyPolicyInit(create.policy.concurrencyPolicy)
 			});
-			await client.setMetadata(create.metaRequest);
+			await writeMetadataLabels(client, create.metaRequest);
 		}),
 		...changeSet.updates.map(async (update) => {
 			await client.updateWorkflowJobFunctionExecutionPolicy({
@@ -12010,7 +12899,7 @@ async function applyWorkflowJobFunctionExecutionPolicy(client, plan, phase = "cr
 				executionPolicyName: update.policy.name,
 				concurrencyPolicy: toConcurrencyPolicyInit(update.policy.concurrencyPolicy)
 			});
-			await client.setMetadata(update.metaRequest);
+			await writeMetadataLabels(client, update.metaRequest);
 		})
 	]);
 	else await Promise.all(changeSet.deletes.map((del) => client.deleteWorkflowJobFunctionExecutionPolicy({
@@ -12082,6 +12971,21 @@ async function applyDeploymentPlans(client, workspaceId, deployments) {
 
 //#endregion
 //#region src/cli/commands/deploy/config-id-injector.ts
+/**
+* Warn when a command that decides resource ownership resolved a config
+* without an app id.
+*
+* Injection only reaches an inline `defineConfig({...})` call, so a config
+* that re-exports one from another file resolves without an id and nothing
+* says so. Ownership then falls back to the application name, and resources
+* tagged with an id from an earlier deploy read as another application's.
+* @param appId - Application id from the resolved config, when it has one
+*/
+function warnMissingAppId(appId) {
+	if (appId) return;
+	logger.warn("The config resolved without an 'id'.");
+	logger.log("  Resources tagged with an id from an earlier deploy read as another application's:\n  deploy asks before taking them over, and remove leaves them in place. Only resources\n  carrying no id are matched by application name.\n  Add an 'id' to the object passed to defineConfig() — a config that re-exports it from\n  another file cannot have one injected automatically. 'tailor setup' can add it for you.");
+}
 const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function findDefineConfigCalls(node, results) {
 	if (!node || typeof node !== "object") return;
@@ -12237,27 +13141,26 @@ function insertIdProperty(source, configObj, id) {
 //#region src/cli/commands/deploy/confirm.ts
 /**
 * Confirm reassignment of resources when owner conflicts are detected.
-* Splits into two scenarios: id regeneration (same sdk-name, different
-* sdk-app-id) and name mismatch (different sdk-name). Each gets its own
-* prompt because the user-facing meaning is different.
+* Splits into three scenarios, each with its own prompt because the
+* user-facing meaning is different: the resource carries the same sdk-name and
+* an sdk-app-id the config does not match, either because the config now holds
+* a different id (regeneration) or because it holds none at all; or the
+* resource carries a different sdk-name (name mismatch).
 * @param conflicts - Detected owner conflicts
 * @param appName - Target application name
 * @param yes - Whether to auto-confirm without prompting
+* @param appId - Target application id, when the config resolves to one
 * @returns Promise that resolves when confirmation completes
 */
-async function confirmOwnerConflict(conflicts, appName, yes) {
+async function confirmOwnerConflict(conflicts, appName, yes, appId) {
 	if (conflicts.length === 0) return;
-	const idRegenerated = conflicts.filter((c) => c.currentOwner === appName);
+	const idMismatches = conflicts.filter((c) => c.currentOwner === appName);
 	const nameMismatches = conflicts.filter((c) => c.currentOwner !== appName);
-	if (idRegenerated.length > 0) await confirmIdRegeneration(idRegenerated, appName, yes);
+	if (idMismatches.length > 0) await (appId ? confirmIdRegeneration(idMismatches, appName, yes) : confirmMissingConfigId(idMismatches, appName, yes));
 	if (nameMismatches.length > 0) await confirmNameMismatch(nameMismatches, appName, yes);
 }
 async function confirmIdRegeneration(conflicts, appName, yes) {
-	logger.warn(`Application id was regenerated for "${appName}":`);
-	logger.log("  These resources still carry the previous id.");
-	logger.newline();
-	logger.log(`  ${styles.info("Resources")}:`);
-	for (const c of conflicts) logger.log(`    • ${styles.bold(c.resourceType)} ${styles.info(`"${c.resourceName}"`)}`);
+	logIdMismatch(`Application id was regenerated for "${appName}":`, conflicts);
 	if (yes) {
 		logger.success("Re-tagging resources with the new id (--yes flag specified)...", { mode: "plain" });
 		return;
@@ -12270,6 +13173,27 @@ async function confirmIdRegeneration(conflicts, appName, yes) {
       To override, run again and confirm, or use --yes flag.
     `);
 }
+function logIdMismatch(heading, conflicts) {
+	logger.warn(heading);
+	logger.log("  These resources are tagged with an id from an earlier deploy.");
+	logger.newline();
+	logger.log(`  ${styles.info("Resources")}:`);
+	for (const c of conflicts) logger.log(`    • ${styles.bold(c.resourceType)} ${styles.info(`"${c.resourceName}"`)}`);
+}
+async function confirmMissingConfigId(conflicts, appName, yes) {
+	logIdMismatch(`No application id resolved for "${appName}":`, conflicts);
+	if (yes) {
+		logger.success("Managing these resources by name (--yes flag specified)...", { mode: "plain" });
+		return;
+	}
+	if (!await prompt.confirm({
+		message: `Drop that id and manage these resources by name for "${appName}"?\n${styles.dim("(the config resolves without an 'id', so ownership falls back to the application name)")}`,
+		default: false
+	})) throw new Error(multiline`
+      Apply cancelled. Resources remain tagged with their current id.
+      Restore the 'id' in your config to keep owning them by id, or run again and confirm to own them by name.
+    `);
+}
 async function confirmNameMismatch(conflicts, appName, yes) {
 	const currentOwners = [...new Set(conflicts.map((c) => c.currentOwner))];
 	logger.warn("Application name mismatch detected:");
@@ -12344,6 +13268,125 @@ async function confirmImportantResourceDeletion(resources, yes) {
       To override, run again and confirm, or use --yes flag.
     `);
 }
+/**
+* Confirm continuing without an application recorded as a dependency.
+*
+* A previous deploy recorded that another config's executors make this config's
+* resources publish events. Applying this config alone resolves those flags from
+* a smaller set of executors, which turns publishing off.
+* @param missing - Recorded dependencies absent from this deploy
+* @param yes - Whether `--yes` was passed
+* @returns Promise that resolves when the deploy may continue
+*/
+async function confirmMissingDependentApps(missing, yes) {
+	if (missing.length === 0) return;
+	logger.warn("Applications recorded as depending on this deploy are missing:");
+	for (const entry of missing) logger.log(`    • application id ${styles.info(entry.appId)} depends on ${styles.bold(entry.resource)} (${entry.reason})`);
+	logger.newline();
+	logger.log("  Applying without them turns off event publishing on the resources above:");
+	logger.log("  nothing in this deploy subscribes to them, so the value resolves to false.");
+	logger.log("  To keep it, add their configs to --config, or set publishEvents on");
+	logger.log("  the resources above.");
+	if (yes) {
+		logger.warn("Continuing without them (--yes flag specified); applying turns publishing off.");
+		return;
+	}
+	if (!await prompt.confirm({
+		message: "Continue without them?",
+		default: false
+	})) throw new Error(multiline`
+      Apply cancelled. Add the missing configs to --config, or set publishEvents
+      explicitly on the resources that should keep publishing.
+    `);
+}
+
+//#endregion
+//#region src/cli/commands/deploy/dependency-records.ts
+/**
+* List the resources whose `publishEvents` this run recomputes.
+*
+* A resource that declares the value keeps it whatever the run covers, so no
+* absent config can change it and its records cannot matter. Skipping those is
+* what keeps a declared value from prompting forever.
+* @param workspaceId - Workspace being deployed to
+* @param application - Application whose resources are listed
+* @param jobsByWorkflow - Job names each workflow runs, keyed by its main job
+* @param subscribedKeys - Resources this run subscribes to, by resource key
+* @returns One entry per value that leaves `publishEvents` unset
+*/
+function recomputedResources(workspaceId, application, jobsByWorkflow, subscribedKeys) {
+	const resources = [];
+	for (const service of application.tailorDBServices) for (const [typeName, type] of Object.entries(service.types)) if (type.settings.publishEvents === void 0) resources.push({
+		trn: tailorDBTypeTrn(workspaceId, service.namespace, typeName),
+		key: eventSourceKey.tailorDBType(service.namespace, typeName),
+		scope: "resource",
+		label: eventSourceLabel.tailorDBType(typeName)
+	});
+	for (const service of application.resolverServices) for (const resolver of Object.values(service.resolvers)) if (resolver.publishEvents === void 0) resources.push({
+		trn: resolverTrn(workspaceId, service.namespace, resolver.name),
+		key: eventSourceKey.resolver(service.namespace, resolver.name),
+		scope: "resource",
+		label: eventSourceLabel.resolver(resolver.name)
+	});
+	for (const idp of application.idpServices) if (idp.publishEvents === void 0) resources.push({
+		trn: resourceTrn(workspaceId, "idp", idp.name),
+		key: eventSourceKey.idp(idp.name),
+		scope: "resource",
+		label: eventSourceLabel.idpService(idp.name)
+	});
+	const explicitByJob = new Map((application.workflowService?.jobs ?? []).map((job) => [job.name, job.publishEvents]));
+	const subscribedJobNames = subscribedWorkflowJobNames({
+		workflows: Object.values(application.workflowService?.workflows ?? {}),
+		mainJobDeps: jobsByWorkflow,
+		isSubscribed: (workflowName) => subscribedKeys.has(eventSourceKey.workflowJobs(workflowName))
+	});
+	for (const workflow of Object.values(application.workflowService?.workflows ?? {})) {
+		const trn = resourceTrn(workspaceId, "workflow", workflow.name);
+		if (workflow.publishEvents === void 0) resources.push({
+			trn,
+			key: eventSourceKey.workflow(workflow.name),
+			scope: "resource",
+			label: eventSourceLabel.workflow(workflow.name)
+		});
+		if ((jobsByWorkflow[workflow.mainJob.name] ?? []).some((jobName) => explicitByJob.get(jobName) === void 0 && !subscribedJobNames.has(jobName))) resources.push({
+			trn,
+			key: eventSourceKey.workflowJobs(workflow.name),
+			scope: "jobs",
+			label: eventSourceLabel.workflowJobs(workflow.name)
+		});
+	}
+	return resources;
+}
+/**
+* Read the applications recorded as depending on this config's resources but
+* absent from the current deploy.
+*
+* Records live on the resources rather than on the application, so this survives
+* the application being renamed and stops reporting a resource that is gone.
+*
+* A resource this run still subscribes to is skipped: its value resolves to `true`
+* from the run's own executors, so the absent config changes nothing about it and
+* asking would be asking about something that cannot happen. What is left over is
+* a resource that really does turn off.
+* @param params - Client, workspace, application, and the run's inputs
+* @param params.client - Operator client instance
+* @param params.workspaceId - Workspace being deployed to
+* @param params.application - Application being planned
+* @param params.runAppIds - Stable ids of every application in the run
+* @param params.subscribedKeys - Resources this run subscribes to, by resource key
+* @param params.jobsByWorkflow - Job names each workflow runs, keyed by its main job
+* @returns Recorded dependencies missing from the run
+*/
+async function fetchMissingDependentApps(params) {
+	const { client, workspaceId, application, runAppIds, subscribedKeys, jobsByWorkflow } = params;
+	return (await Promise.all(recomputedResources(workspaceId, application, jobsByWorkflow, subscribedKeys).filter(({ key }) => !subscribedKeys.has(key)).map(async ({ trn, scope, label }) => {
+		return recordedDependencies((await getOrNull(() => client.getMetadata({ trn })))?.metadata?.labels, scope).filter((dependency) => !runAppIds.has(dependency.appId)).map((dependency) => ({
+			resource: label,
+			appId: dependency.appId,
+			reason: dependency.reason
+		}));
+	}))).flat();
+}
 
 //#endregion
 //#region src/cli/commands/deploy/validate-plan.ts
@@ -13421,57 +14464,187 @@ async function resolveDeployWorkspace(options = {}) {
 //#endregion
 //#region src/cli/commands/deploy/deploy.ts
 /**
-* Resolve the set of IdP names that have at least one executor subscribed to
-* their user events. When an executor's idpUser trigger omits the `idp` option
-* and exactly one IdP is configured, that IdP is implicitly the target.
-* Executors that omit `idp` while multiple IdPs exist are skipped here; the
-* apply pipeline throws a clearer error for them later.
-* @param application - Loaded application
-* @returns Set of IdP names targeted by idpUser triggers
+* Resolve which IdP an `idpUser` trigger subscribes to. A trigger that omits the
+* `idp` option means the only configured IdP; when several exist the target is
+* ambiguous and the apply pipeline throws a clearer error for it later.
+* @param application - Application declaring the executor
+* @param trigger - The executor's `idpUser` trigger
+* @returns The subscribed IdP name, or undefined when ambiguous
 */
-function collectIdpUserTriggerTargets(application) {
-	const targets = /* @__PURE__ */ new Set();
+function subscribedIdpName(application, trigger) {
+	if (trigger.idp != null) return trigger.idp;
 	const idps = collectApplicationIdpNames(application);
-	for (const executor of Object.values(application.executorService?.executors ?? {})) {
-		if (executor.trigger.kind !== "idpUser") continue;
-		if (executor.trigger.idp != null) targets.add(executor.trigger.idp);
-		else if (idps.size === 1) {
-			const [idp] = idps;
-			if (idp) targets.add(idp);
-		}
-	}
-	return targets;
-}
-function collectDeployIdpUserTriggerTargets(targets) {
-	const triggerTargets = /* @__PURE__ */ new Set();
-	for (const target of targets) for (const idpName of collectIdpUserTriggerTargets(target.application)) triggerTargets.add(idpName);
-	return triggerTargets;
+	if (idps.size !== 1) return;
+	const [only] = idps;
+	return only;
 }
-function collectExecutorUsedTailorDBTypes(owner, targets) {
-	const usedTypes = /* @__PURE__ */ new Set();
-	const ownerNamespaces = new Set(owner.application.tailorDBServices.map((service) => service.namespace));
+/**
+* Build the error for a subscription whose resource no config in the run declares.
+*
+* The advice differs by cause: a config that declares the resource as owned
+* elsewhere is missing its peer from `--config`, while one that declares nothing
+* external is naming a resource that does not exist.
+* @param executorName - Name of the subscribing executor
+* @param lookup - How the subscribed resource is found
+* @param subscriber - Deployment target declaring the executor
+* @returns Error message
+*/
+function missingOwnerMessage(executorName, lookup, subscriber) {
+	const subject = `Executor "${executorName}" subscribes to ${lookup.resource}, which no config in this deploy declares.`;
+	const external = lookup.externalHint(subscriber);
+	if (external) return `${subject} This config declares ${external}, so add the config that owns it to --config.`;
+	if (lookup.trigger.kind === "workflowExecution" || lookup.trigger.kind === "workflowJobExecution") return `${subject} A workflow has no "external" declaration, unlike a TailorDB namespace or resolver, so nothing in this config points at the one that owns it. Check the name, or add the config that declares the workflow to --config.`;
+	return `${subject} This config declares nothing external that could hold it, so check the name.`;
+}
+/**
+* Resolve every event subscription in the run to the config that declares the
+* subscribed resource.
+*
+* Doing this once keeps the flags the planners resolve and the cross-config
+* dependencies recorded on the application in agreement — both are read off the
+* same list.
+* @param targets - Built deployment targets in the run
+* @returns One entry per executor whose trigger names a publishing resource
+*/
+function collectEventSubscriptions(targets) {
+	const subscriptions = [];
 	const applications = targets.map((target) => target.application);
-	for (const target of targets) {
-		const visibleNamespaces = collectVisibleTailorDBTypeNamespaces(target.application, applications);
-		for (const executor of Object.values(target.application.executorService?.executors ?? {})) if (executor.trigger.kind === "tailordb") {
-			const namespace = findTailorDBNamespace(target.application, executor.trigger.typeName) ?? resolveSameRunNamespace(visibleNamespaces, executor.trigger.typeName, "TailorDB type");
-			if (namespace && ownerNamespaces.has(namespace)) usedTypes.add(executor.trigger.typeName);
+	for (const subscriber of targets) {
+		const executors = subscriber.application.executorService?.executors ?? {};
+		const visibility = collectSubscriberVisibility(subscriber, applications);
+		for (const executor of Object.values(executors)) {
+			const lookup = eventSourceLookup(executor, subscriber, visibility);
+			if (!lookup) continue;
+			const entry = {
+				subscriber,
+				executorName: executor.name,
+				resource: lookup.resource,
+				trigger: lookup.trigger
+			};
+			if (lookup.declaredBy(subscriber)) {
+				subscriptions.push({
+					...entry,
+					owner: subscriber,
+					pinned: lookup.pinned(subscriber),
+					key: lookup.keyIn(subscriber)
+				});
+				continue;
+			}
+			const peers = targets.filter((target) => target.config.path !== subscriber.config.path && lookup.declaredBy(target));
+			const owners = lookup.narrowOwners(peers);
+			if (owners === "ambiguous") continue;
+			const [owner] = owners;
+			if (!owner) throw new Error(missingOwnerMessage(executor.name, lookup, subscriber));
+			subscriptions.push({
+				...entry,
+				owner,
+				pinned: lookup.pinned(owner),
+				key: lookup.keyIn(owner)
+			});
 		}
 	}
-	return usedTypes;
+	return subscriptions;
 }
-function collectExecutorUsedResolvers(owner, targets) {
-	const usedResolvers = /* @__PURE__ */ new Set();
-	const ownerNamespaces = new Set(owner.application.resolverServices.map((service) => service.namespace));
-	const applications = targets.map((target) => target.application);
-	for (const target of targets) {
-		const visibleNamespaces = collectVisibleResolverNamespaces(target.application, applications);
-		for (const executor of Object.values(target.application.executorService?.executors ?? {})) if (executor.trigger.kind === "resolverExecuted") {
-			const namespace = findResolverNamespace(target.application, executor.trigger.resolverName) ?? resolveSameRunNamespace(visibleNamespaces, executor.trigger.resolverName, "Resolver");
-			if (namespace && ownerNamespaces.has(namespace)) usedResolvers.add(executor.trigger.resolverName);
-		}
-	}
-	return usedResolvers;
+/**
+* Key the resources this run subscribes to among the target's own.
+*
+* A resource with a subscriber in the run resolves to `true` from that subscriber
+* alone, so no absent config can change it.
+* @param subscriptions - Subscriptions resolved across the run
+* @param owner - Deployment target being planned
+* @returns Resource keys the run subscribes to
+*/
+function subscribedResourceKeys(subscriptions, owner) {
+	return new Set(ownedSubscriptions(subscriptions, owner).flatMap((subscription) => subscription.key ?? []));
+}
+/**
+* Select the subscriptions pointing at resources the given target declares.
+* @param subscriptions - Subscriptions resolved across the run
+* @param owner - Deployment target being planned
+* @returns Subscriptions whose subscribed resource belongs to `owner`
+*/
+function ownedSubscriptions(subscriptions, owner) {
+	return subscriptions.filter((subscription) => subscription.owner.config.path === owner.config.path);
+}
+/**
+* Collect the TailorDB types subscribed to among the given subscriptions.
+* @param subscriptions - Subscriptions owned by the target being planned
+* @returns Subscribed type names
+*/
+function subscribedTailorDBTypes(subscriptions) {
+	return new Set(subscriptions.flatMap((subscription) => subscription.trigger.kind === "tailordb" ? [subscription.trigger.typeName] : []));
+}
+/**
+* Collect the resolvers subscribed to among the given subscriptions.
+* @param subscriptions - Subscriptions owned by the target being planned
+* @returns Subscribed resolver names
+*/
+function subscribedResolvers(subscriptions) {
+	return new Set(subscriptions.flatMap((subscription) => subscription.trigger.kind === "resolverExecuted" ? [subscription.trigger.resolverName] : []));
+}
+/**
+* Collect the IdPs subscribed to among the given subscriptions.
+* @param subscriptions - Subscriptions owned by the target being planned
+* @returns Subscribed IdP names
+*/
+function subscribedIdps(subscriptions) {
+	return new Set(subscriptions.flatMap((subscription) => subscription.trigger.kind === "idpUser" ? [subscribedIdpName(subscription.subscriber.application, subscription.trigger) ?? []].flat() : []));
+}
+/**
+* Collect the workflows subscribed to, per event granularity level.
+* @param subscriptions - Subscriptions owned by the target being planned
+* @returns Subscribers keyed by event granularity level
+*/
+function subscribedWorkflows(subscriptions) {
+	const execution = { workflowNames: /* @__PURE__ */ new Set() };
+	const jobExecution = { workflowNames: /* @__PURE__ */ new Set() };
+	for (const { trigger } of subscriptions) if (trigger.kind === "workflowExecution") execution.workflowNames.add(trigger.workflowName);
+	else if (trigger.kind === "workflowJobExecution") jobExecution.workflowNames.add(trigger.workflowName);
+	return {
+		execution,
+		jobExecution
+	};
+}
+/**
+* Collect the applications that have to take part in the same deploy for this
+* target's resources to be applied the same way.
+*
+* An executor in another config makes the resource it subscribes to publish
+* events, so deploying this config without that one would resolve the flag from
+* a smaller set of executors and turn publishing off.
+*
+* A resource that declares `publishEvents` keeps its value either way, so
+* recording a dependency for it would ask about a partial deploy that changes
+* nothing — and `prompt.confirm` rejects outright where it cannot ask, failing a
+* deploy that was never at risk.
+*
+* Records are keyed by resource rather than by application: the resource is what
+* carries them, so a record survives the owner being renamed and disappears with
+* the resource itself.
+* @param subscriptions - Subscriptions owned by the target being planned
+* @returns Dependent application ids and reasons, keyed by resource
+*/
+function collectDependentApps(subscriptions) {
+	const byResource = /* @__PURE__ */ new Map();
+	for (const { subscriber, owner, pinned, key } of subscriptions) {
+		if (subscriber.config.path === owner.config.path || pinned || key === void 0) continue;
+		const appId = subscriber.application.id;
+		if (appId === void 0) continue;
+		const dependents = byResource.get(key) ?? /* @__PURE__ */ new Map();
+		dependents.set(appId, "publish-events");
+		byResource.set(key, dependents);
+	}
+	return byResource;
+}
+/**
+* Collect explicit `publishEvents` values declared on this target's workflow jobs.
+* @param target - Deployment target being planned
+* @returns Explicit flags keyed by job name
+*/
+function collectWorkflowJobPublishEvents(target) {
+	const jobPublishEvents = /* @__PURE__ */ new Map();
+	for (const job of target.application.workflowService?.jobs ?? []) if (job.publishEvents !== void 0) jobPublishEvents.set(job.name, job.publishEvents);
+	return jobPublishEvents;
 }
 function collectExpectedLocalStaticWebsiteNames(targets) {
 	const websiteNames = /* @__PURE__ */ new Set();
@@ -13929,7 +15102,9 @@ async function loadDeployConfig(params) {
 				buildOnly
 			});
 		}
-		return loadConfig(configPath);
+		const loaded = await loadConfig(configPath);
+		if (!buildOnly) warnMissingAppId(loaded.config.id);
+		return loaded;
 	});
 }
 async function buildDeploymentTargets(params) {
@@ -14005,6 +15180,161 @@ function assertUniqueGlobalResourceNames(targets) {
 		}
 	}
 }
+function collectSubscriberVisibility(subscriber, applications) {
+	return {
+		tailorDBTypes: collectVisibleTailorDBTypeNamespaces(subscriber.application, applications),
+		resolvers: collectVisibleResolverNamespaces(subscriber.application, applications),
+		idps: collectVisibleIdpNames(subscriber.application, applications)
+	};
+}
+/**
+* TailorDB namespaces the config declares as owned elsewhere.
+* @param target - Deployment target declaring the executor
+* @returns Namespace names declared with `external: true`
+*/
+function externalTailorDBNamespaces(target) {
+	return target.application.externalTailorDBNamespaces;
+}
+function externalSubgraphNames(target, subgraphType, localNames) {
+	return target.application.subgraphs.filter((subgraph) => subgraph.Type === subgraphType && !localNames.has(subgraph.Name)).map((subgraph) => subgraph.Name);
+}
+function externalResolverNamespaces(target) {
+	return externalSubgraphNames(target, "pipeline", new Set(target.application.resolverServices.map((service) => service.namespace)));
+}
+function externalIdpNames(target) {
+	return externalSubgraphNames(target, "idp", new Set(target.application.idpServices.map((idp) => idp.name)));
+}
+/**
+* Describe the external declarations that could hold a missing resource.
+* @param kind - Resource kind named in the message, e.g. `TailorDB namespace`
+* @param names - External names the subscribing config declares
+* @returns A phrase for the error message, or undefined when it declares none
+*/
+function describeExternal(kind, names) {
+	if (names.length === 0) return;
+	return `external ${names.length === 1 ? kind : `${kind}s`} ${names.map((name) => `"${name}"`).join(", ")}`;
+}
+function declaresTailorDBType(target, typeName) {
+	return target.application.tailorDBServices.some((service) => service.types[typeName]) || void 0;
+}
+function declaresResolver(target, resolverName) {
+	return target.application.resolverServices.some((service) => Object.values(service.resolvers).some((resolver) => resolver.name === resolverName)) || void 0;
+}
+function declaresIdp(target, idpName) {
+	return target.application.idpServices.some((entry) => entry.name === idpName) || void 0;
+}
+function declaresWorkflow(target, workflowName) {
+	return Object.values(target.application.workflowService?.workflows ?? {}).some((entry) => entry.name === workflowName) || void 0;
+}
+function pinsTailorDBType(target, typeName) {
+	for (const service of target.application.tailorDBServices) {
+		const type = service.types[typeName];
+		if (type) return type.settings.publishEvents !== void 0;
+	}
+	return false;
+}
+function pinsResolverIn(target, namespace, resolverName) {
+	return target.application.resolverServices.some((service) => service.namespace === namespace && Object.values(service.resolvers).some((resolver) => resolver.name === resolverName && resolver.publishEvents !== void 0));
+}
+function pinsIdp(target, idpName) {
+	return target.application.idpServices.some((entry) => entry.name === idpName && entry.publishEvents !== void 0);
+}
+function pinsWorkflow(target, workflowName) {
+	return Object.values(target.application.workflowService?.workflows ?? {}).some((entry) => entry.name === workflowName && entry.publishEvents !== void 0);
+}
+function pinsEveryJobOfWorkflow(target, workflowName) {
+	const workflow = Object.values(target.application.workflowService?.workflows ?? {}).find((entry) => entry.name === workflowName);
+	if (workflow === void 0) return false;
+	const jobNames = target.workflowBuildResult?.mainJobDeps[workflow.mainJob.name] ?? [];
+	const declared = collectWorkflowJobPublishEvents(target);
+	return jobNames.length > 0 && jobNames.every((jobName) => declared.has(jobName));
+}
+function tailorDBTypeNamespaceIn(target, typeName) {
+	return target.application.tailorDBServices.find((service) => service.types[typeName])?.namespace;
+}
+function narrowByVisibleNamespace(params) {
+	const { candidates, visible, resourceKey, declaresIn } = params;
+	if (!visible.has(resourceKey)) return [];
+	const namespace = visible.get(resourceKey);
+	if (namespace === void 0) return "ambiguous";
+	return candidates.filter((target) => declaresIn(target, namespace));
+}
+function declaresTailorDBTypeIn(target, namespace, typeName) {
+	return target.application.tailorDBServices.some((service) => service.namespace === namespace && Boolean(service.types[typeName]));
+}
+function declaresResolverIn(target, namespace, resolverName) {
+	return target.application.resolverServices.some((service) => service.namespace === namespace && Object.values(service.resolvers).some((resolver) => resolver.name === resolverName));
+}
+/**
+* Resolve how to find the resource an executor's event trigger subscribes to.
+* @param executor - Executor declared by the subscribing config
+* @param subscriber - Deployment target declaring the executor
+* @param visibility - What the subscribing config can see, by resource kind
+* @returns The lookup, or undefined for triggers with no publishing resource
+*/
+function eventSourceLookup(executor, subscriber, visibility) {
+	const { trigger } = executor;
+	switch (trigger.kind) {
+		case "tailordb": return {
+			resource: publishEventsConflict.tailorDBType(trigger.typeName).resource,
+			trigger,
+			declaredBy: (target) => declaresTailorDBType(target, trigger.typeName),
+			pinned: (target) => pinsTailorDBType(target, trigger.typeName),
+			keyIn: (owner) => {
+				const namespace = tailorDBTypeNamespaceIn(owner, trigger.typeName);
+				return namespace && eventSourceKey.tailorDBType(namespace, trigger.typeName);
+			},
+			narrowOwners: (candidates) => narrowByVisibleNamespace({
+				candidates,
+				visible: visibility.tailorDBTypes,
+				resourceKey: trigger.typeName,
+				declaresIn: (target, namespace) => declaresTailorDBTypeIn(target, namespace, trigger.typeName)
+			}),
+			externalHint: (target) => describeExternal("TailorDB namespace", externalTailorDBNamespaces(target))
+		};
+		case "resolverExecuted": {
+			const namespace = findResolverNamespace(subscriber.application, trigger.resolverName) ?? visibility.resolvers.get(trigger.resolverName);
+			return {
+				resource: publishEventsConflict.resolver(trigger.resolverName).resource,
+				trigger,
+				declaredBy: (target) => declaresResolver(target, trigger.resolverName),
+				pinned: (target) => namespace !== void 0 && pinsResolverIn(target, namespace, trigger.resolverName),
+				keyIn: () => namespace && eventSourceKey.resolver(namespace, trigger.resolverName),
+				narrowOwners: (candidates) => narrowByVisibleNamespace({
+					candidates,
+					visible: visibility.resolvers,
+					resourceKey: trigger.resolverName,
+					declaresIn: (target, namespace) => declaresResolverIn(target, namespace, trigger.resolverName)
+				}),
+				externalHint: (target) => describeExternal("resolver namespace", externalResolverNamespaces(target))
+			};
+		}
+		case "idpUser": {
+			const idpName = subscribedIdpName(subscriber.application, trigger);
+			if (idpName === void 0) return;
+			return {
+				resource: publishEventsConflict.idpService(idpName).resource,
+				trigger,
+				declaredBy: (target) => declaresIdp(target, idpName),
+				pinned: (target) => pinsIdp(target, idpName),
+				keyIn: () => eventSourceKey.idp(idpName),
+				narrowOwners: (candidates) => visibility.idps.has(idpName) ? candidates.filter((target) => declaresIdp(target, idpName)) : [],
+				externalHint: (target) => describeExternal("IdP", externalIdpNames(target).filter((name) => name === idpName))
+			};
+		}
+		case "workflowExecution":
+		case "workflowJobExecution": return {
+			resource: trigger.kind === "workflowExecution" ? eventSourceLabel.workflow(trigger.workflowName) : eventSourceLabel.workflowJobs(trigger.workflowName),
+			trigger,
+			declaredBy: (target) => declaresWorkflow(target, trigger.workflowName),
+			pinned: (target) => trigger.kind === "workflowExecution" ? pinsWorkflow(target, trigger.workflowName) : pinsEveryJobOfWorkflow(target, trigger.workflowName),
+			keyIn: () => trigger.kind === "workflowExecution" ? eventSourceKey.workflow(trigger.workflowName) : eventSourceKey.workflowJobs(trigger.workflowName),
+			narrowOwners: (candidates) => candidates.filter((target) => declaresWorkflow(target, trigger.workflowName)),
+			externalHint: () => void 0
+		};
+		default: return;
+	}
+}
 function collectPlannedExternalTailorDBServices(target, targets) {
 	const externalNamespaces = new Set(target.application.externalTailorDBNamespaces);
 	if (externalNamespaces.size === 0) return [];
@@ -14022,9 +15352,37 @@ function collectExternalAuthIdpConfigNames(targets) {
 	}
 	return idpConfigNames;
 }
-function collectDeployRunPlanInputs(targets) {
+/**
+* Reject a cross-config subscription whose dependency cannot be recorded.
+*
+* Records live on the subscribed resource, so there is always somewhere to put
+* one. What can be missing is the dependent's name: the record identifies it by
+* application id, and a subscriber that resolves without one cannot be recorded,
+* leaving the next deploy of the owner alone to turn publishing off unannounced.
+*
+* The check applies only to a run that writes: `--dry-run` leaves every id
+* uninjected, so demanding one there would reject configs a real deploy gives one.
+* @param subscriptions - Every event subscription resolved for the run
+* @param writes - Whether this run applies changes rather than only reporting them
+*/
+function assertRecordableDependencies(subscriptions, writes) {
+	for (const { subscriber, owner, executorName, resource, pinned } of subscriptions) {
+		if (subscriber.config.path === owner.config.path) continue;
+		if (pinned) continue;
+		if (!writes) continue;
+		const appId = subscriber.application.id;
+		if (appId !== void 0 && dependedByAppLabelKey(appId) !== void 0) continue;
+		const cause = appId === void 0 ? `${subscriber.config.path} resolves without an "id" — a config that re-exports defineConfig() from another file never gets one` : `${subscriber.config.path} resolves to the id "${appId}", which is not the lowercase UUID deploy writes`;
+		const fix = appId === void 0 ? `Call defineConfig() inline in ${subscriber.config.path} so deploy can manage its "id".` : `Restore the generated value in ${subscriber.config.path}'s "id".`;
+		throw new Error(`Executor "${executorName}" in ${subscriber.config.path} subscribes to ${resource} in ${owner.config.path}, which would enable event publishing on it for this deploy only. ${cause} — so deploy cannot record which config the dependency belongs to, and deploying ${owner.config.path} alone later would turn publishing back off without asking.\n\n${fix}`);
+	}
+}
+function collectDeployRunPlanInputs(targets, writes) {
+	const eventSubscriptions = collectEventSubscriptions(targets);
+	assertRecordableDependencies(eventSubscriptions, writes);
 	return {
-		idpUserTriggerTargets: collectDeployIdpUserTriggerTargets(targets),
+		eventSubscriptions,
+		runAppIds: new Set(targets.map((target) => target.application.id).filter((id) => id !== void 0)),
 		expectedLocalStaticWebsiteNames: collectExpectedLocalStaticWebsiteNames(targets),
 		externalAuthIdpConfigNames: collectExternalAuthIdpConfigNames(targets)
 	};
@@ -14032,6 +15390,7 @@ function collectDeployRunPlanInputs(targets) {
 async function planDeploymentTarget(params) {
 	const { target, targets, runInputs, client, workspaceId, noSchemaCheck } = params;
 	const { config, application, workflowBuildResult, httpAdapterBuildResult, bundledScripts } = target;
+	const owned = ownedSubscriptions(runInputs.eventSubscriptions, target);
 	await withSpan("plan.validateTailorDBTypeNames", () => assertUniqueTailorDBTypeNamesWithExternal({
 		client,
 		workspaceId,
@@ -14056,8 +15415,10 @@ async function planDeploymentTarget(params) {
 			noSchemaCheck,
 			forceApplyAll,
 			...runInputs,
-			executorUsedTailorDBTypes: collectExecutorUsedTailorDBTypes(target, targets),
-			executorUsedResolvers: collectExecutorUsedResolvers(target, targets),
+			idpUserTriggerTargets: subscribedIdps(owned),
+			executorUsedTailorDBTypes: subscribedTailorDBTypes(owned),
+			executorUsedResolvers: subscribedResolvers(owned),
+			dependentApps: collectDependentApps(owned),
 			tailorDBTypeNamespaces,
 			resolverNamespaces,
 			idpNames
@@ -14073,7 +15434,12 @@ async function planDeploymentTarget(params) {
 			withSpan("plan.pipeline", () => planPipeline(ctx)),
 			withSpan("plan.application", () => planApplication(ctx, httpAdapterBuildResult)),
 			withSpan("plan.executor", () => planExecutor(ctx)),
-			withSpan("plan.workflow", () => planWorkflow(client, workspaceId, application.name, application.id, workflowService?.workflows ?? {}, workflowBuildResult?.mainJobDeps ?? {}, unchangedWorkflowJobs)),
+			withSpan("plan.workflow", () => planWorkflow(client, workspaceId, application.name, application.id, workflowService?.workflows ?? {}, workflowBuildResult?.mainJobDeps ?? {}, unchangedWorkflowJobs, {
+				...subscribedWorkflows(owned),
+				jobPublishEvents: collectWorkflowJobPublishEvents(target),
+				dependentApps: ctx.dependentApps,
+				runAppIds: ctx.runAppIds
+			})),
 			withSpan("plan.workflowExecutionPolicy", () => planWorkflowJobFunctionExecutionPolicy(client, workspaceId, application.name, application.id, config.workflow?.executionPolicies ?? {})),
 			withSpan("plan.secretManager", () => planSecretManager(ctx))
 		]);
@@ -14107,15 +15473,14 @@ function deploymentPlanResults(deployment) {
 	return results;
 }
 /**
-* Every `PlanResults` entry except `app` carries ownership-tracking fields;
-* deriving the list from `results` itself (instead of naming each key) keeps
-* these collectors in sync with `PlannedDeployment` as resource types are added.
+* Every `PlanResults` entry carries ownership-tracking fields; deriving the
+* list from `results` itself (instead of naming each key) keeps these
+* collectors in sync with `PlannedDeployment` as resource types are added.
 * @param results - Plan results for a single deployment
-* @returns The ownership-tracking plan entries, `app` excluded
+* @returns The ownership-tracking plan entries
 */
 function ownershipTrackedPlans(results) {
-	const { app: _app, ...rest } = results;
-	return Object.values(rest);
+	return Object.values(results);
 }
 function collectOwnerConflicts(results) {
 	return ownershipTrackedPlans(results).flatMap((plan) => plan.conflicts);
@@ -14454,7 +15819,8 @@ function collectDeploymentResourceOwners(deployments) {
 	return owners;
 }
 async function confirmDeploymentPlans(params) {
-	const { deployments, yes } = params;
+	const { deployments, yes, missingDependentApps = [] } = params;
+	await confirmMissingDependentApps(missingDependentApps, yes);
 	const targetAppNames = new Set(deployments.map((deployment) => deployment.application.name));
 	const resourceOwners = collectDeploymentResourceOwners(deployments);
 	const scheduledRenamedAppDeletes = /* @__PURE__ */ new Set();
@@ -14462,7 +15828,7 @@ async function confirmDeploymentPlans(params) {
 	for (const deployment of deployments) {
 		const results = deploymentPlanResults(deployment);
 		const conflicts = collectOwnerConflicts(results);
-		await confirmOwnerConflict(conflicts, deployment.application.name, yes);
+		await confirmOwnerConflict(conflicts, deployment.application.name, yes, deployment.application.id);
 		await confirmUnmanagedResources(collectUnmanagedResources(results), deployment.application.name, yes);
 		importantDeletions.push(...collectImportantResourceDeletions(results));
 		const emptyApps = computeRenamedAppDeletions({
@@ -14577,19 +15943,29 @@ async function deployInternal(options, cliContext) {
 		const { client, workspaceId } = workspace;
 		rootSpan.setAttribute("app.name", targets.map((target) => target.application.name).join(","));
 		rootSpan.setAttribute("workspace.id", workspaceId);
+		const runInputs = collectDeployRunPlanInputs(targets, !options?.dryRun);
 		const deployments = await planDeploymentTargets({
 			targets,
-			runInputs: collectDeployRunPlanInputs(targets),
+			runInputs,
 			client,
 			workspaceId,
 			noSchemaCheck: options?.noSchemaCheck
 		});
 		const yes = options?.yes ?? false;
 		dropCrossDeploymentManagedDeletes(deployments);
+		const missingDependentApps = (await Promise.all(targets.map((target) => fetchMissingDependentApps({
+			client,
+			workspaceId,
+			application: target.application,
+			runAppIds: runInputs.runAppIds ?? /* @__PURE__ */ new Set(),
+			subscribedKeys: subscribedResourceKeys(runInputs.eventSubscriptions, target),
+			jobsByWorkflow: target.workflowBuildResult?.mainJobDeps ?? {}
+		})))).flat();
 		await withSpan("confirm", async () => {
 			await confirmDeploymentPlans({
 				deployments,
-				yes
+				yes,
+				missingDependentApps
 			});
 		});
 		const planSummary = printDeploymentPlans(deployments, { dryRun: options?.dryRun });
@@ -14888,6 +16264,12 @@ function formatEventTriggerConfig(config) {
 		eventType: config.eventType,
 		condition: config.condition?.expr || ""
 	};
+	if (typedConfig.case === "workflow") return {
+		kind: typedConfig.case,
+		eventTypes: typedConfig.value.eventTypes,
+		condition: typedConfig.value.condition?.expr || "",
+		...typedConfig.value.workflowName && { workflowName: typedConfig.value.workflowName }
+	};
 	const base = {
 		kind: typedConfig.case,
 		eventTypes: typedConfig.value.eventTypes,
@@ -14979,8 +16361,13 @@ async function resolveExecutor(client, workspaceId, name) {
 	if (!executor) throw new Error(`Executor '${name}' not found.`);
 	return executor;
 }
+/**
+* Get an executor by name and return CLI-friendly info.
+* @param options - Executor lookup options
+* @returns Executor information
+*/
 async function getExecutor(options) {
-	const name = "name" in options ? options.name : options.executor.name;
+	const name = options.executor.name;
 	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
@@ -15002,7 +16389,7 @@ const getCommand$6 = defineAppCommand({
 	}),
 	run: async (args) => {
 		const executor = await getExecutor({
-			name: args.name,
+			executor: { name: args.name },
 			workspaceId: args["workspace-id"],
 			profile: args.profile
 		});
@@ -15486,8 +16873,18 @@ function parseStatus(status) {
 		default: throw new Error(`Invalid status: ${status}. Valid values: UNSPECIFIED, PENDING, PENDING_RESUME, RUNNING, SUCCESS, FAILED, PENDING_RETRY, WAITING`);
 	}
 }
+/**
+* List workflow executions with optional filters.
+*
+* Returns at most `options.limit` items. When `limit` is omitted or 0 the
+* function pages through every execution. The CLI caps this at 50 by
+* default via `pagedLogArgs`; programmatic callers that want the same
+* cap should pass `limit: 50` explicitly.
+* @param options - Workflow execution listing options
+* @returns List of workflow executions
+*/
 async function listWorkflowExecutions(options) {
-	const workflowName = options && "workflowName" in options ? options.workflowName : options && "workflow" in options ? options.workflow?.name : void 0;
+	const workflowName = options?.workflow?.name;
 	const client = await initOperatorClient(await loadAccessToken({ profile: options?.profile }));
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options?.workspaceId,
@@ -15708,7 +17105,7 @@ const executionsCommand = defineAppCommand({
 			const executions = await listWorkflowExecutions({
 				workspaceId: args["workspace-id"],
 				profile: args.profile,
-				workflowName: args["workflow-name"],
+				workflow: args["workflow-name"] === void 0 ? void 0 : { name: args["workflow-name"] },
 				status: args.status,
 				order: args.order,
 				limit: args.limit
@@ -15735,8 +17132,13 @@ async function resolveWorkflow(client, workspaceId, name) {
 	if (!workflow) throw new Error(`Workflow '${name}' not found.`);
 	return workflow;
 }
+/**
+* Get a workflow by name and return CLI-friendly info.
+* @param options - Workflow lookup options
+* @returns Workflow information
+*/
 async function getWorkflow(options) {
-	const name = "name" in options ? options.name : options.workflow.name;
+	const name = options.workflow.name;
 	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
@@ -15758,7 +17160,7 @@ const getCommand$5 = defineAppCommand({
 	}),
 	run: async (args) => {
 		const workflow = await getWorkflow({
-			name: args.name,
+			workflow: { name: args.name },
 			workspaceId: args["workspace-id"],
 			profile: args.profile
 		});
@@ -15808,6 +17210,13 @@ async function resolveApplicationAuthNamespace(options) {
 	if (!authNamespace) throw new Error(`Application ${config.name} does not have an auth configuration.`);
 	return authNamespace;
 }
+/**
+* Start a workflow looked up by name, resolving the machine user from the
+* flag, environment, or profile default. Backs the `workflow start` command;
+* programmatic callers use {@link startWorkflow} with a workflow definition.
+* @param options - Start options keyed by workflow name
+* @returns Start result with wait helper
+*/
 async function startWorkflowByName(options) {
 	const machineUser = await loadMachineUserName({
 		machineUser: options.machineUser,
@@ -15837,8 +17246,12 @@ async function startWorkflowByName(options) {
 		interval: options.interval
 	});
 }
+/**
+* Start a workflow and return a handle to wait for completion.
+* @param options - Start options
+* @returns Start result with wait helper
+*/
 async function startWorkflow(options) {
-	if ("name" in options) return await startWorkflowByName(options);
 	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
@@ -15938,8 +17351,18 @@ function createUnknownExecutorJob(executorName, jobId) {
 		updatedAt: "N/A"
 	};
 }
+/**
+* List executor jobs for a given executor.
+*
+* Returns at most `options.limit` items. When `limit` is omitted or 0 the
+* function pages through every job. The CLI caps this at 50 by default
+* via `pagedLogArgs`; programmatic callers that want the same cap should
+* pass `limit: 50` explicitly.
+* @param options - Options for listing executor jobs
+* @returns List of executor job information
+*/
 async function listExecutorJobs(options) {
-	const executorName = "executorName" in options ? options.executorName : options.executor.name;
+	const executorName = options.executor.name;
 	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
@@ -15976,8 +17399,13 @@ async function listExecutorJobs(options) {
 		throw error;
 	}
 }
+/**
+* Get details of a specific executor job.
+* @param options - Options for getting executor job details
+* @returns Executor job detail information
+*/
 async function getExecutorJob(options) {
-	const executorName = "executorName" in options ? options.executorName : options.executor.name;
+	const executorName = options.executor.name;
 	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
@@ -16013,8 +17441,13 @@ async function getExecutorJob(options) {
 		throw error;
 	}
 }
+/**
+* Watch an executor job until completion, including downstream executions.
+* @param options - Options for watching executor job
+* @returns Result including job details and downstream execution info
+*/
 async function watchExecutorJob(options) {
-	const executorName = "executorName" in options ? options.executorName : options.executor.name;
+	const executorName = options.executor.name;
 	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
@@ -16333,7 +17766,7 @@ const jobsCommand = defineAppCommand({
 		if (args.jobId) {
 			if (args.wait) {
 				const result = await watchExecutorJob({
-					executorName: args.executorName,
+					executor: { name: args.executorName },
 					jobId: args.jobId,
 					workspaceId: args["workspace-id"],
 					profile: args.profile,
@@ -16382,7 +17815,7 @@ const jobsCommand = defineAppCommand({
 				return;
 			}
 			const job = await getExecutorJob({
-				executorName: args.executorName,
+				executor: { name: args.executorName },
 				jobId: args.jobId,
 				attempts: args.attempts,
 				workspaceId: args["workspace-id"],
@@ -16393,7 +17826,7 @@ const jobsCommand = defineAppCommand({
 		} else {
 			if (args.wait) logger.warn("--wait flag is ignored in list mode. Specify a job ID to wait.");
 			const jobs = await listExecutorJobs({
-				executorName: args.executorName,
+				executor: { name: args.executorName },
 				status: args.status,
 				order: args.order,
 				limit: args.limit,
@@ -16503,8 +17936,12 @@ async function triggerExecutorByName(options) {
 		throw error;
 	}
 }
+/**
+* Trigger an executor and return the job ID.
+* @param options - Options for triggering executor
+* @returns Result containing the job ID if available
+*/
 async function triggerExecutor(options) {
-	if ("executorName" in options) return await triggerExecutorByName(options);
 	if (options.executor.trigger.kind !== "incomingWebhook" && options.payload !== void 0) throw new Error(`Executor '${options.executor.name}' has '${options.executor.trigger.kind}' trigger type. The payload is only available for 'incomingWebhook' trigger type.`);
 	return await triggerExecutorByName({
 		executorName: options.executor.name,
@@ -16621,7 +18058,7 @@ The \`--logs\` option displays logs from the downstream execution when available
 		logger.success(`Executor '${args.executorName}' triggered successfully. Job ID: ${result.jobId}`);
 		if (args.wait) {
 			const watchResult = await watchExecutorJob({
-				executorName: args.executorName,
+				executor: { name: args.executorName },
 				jobId: result.jobId,
 				workspaceId: args["workspace-id"],
 				profile: args.profile,
@@ -17958,10 +19395,12 @@ async function loadOptions$10(options) {
 		profile: options?.profile
 	});
 	const { config } = await loadConfig(options?.configPath);
+	const application = defineApplication({ config });
+	warnMissingAppId(application.id);
 	return {
 		client,
 		workspaceId,
-		application: defineApplication({ config }),
+		application,
 		config
 	};
 }
@@ -17987,6 +19426,7 @@ async function execRemove(client, workspaceId, application, config, confirm) {
 		functionRegistry: await planFunctionRegistry(client, workspaceId, application.name, application.id, []),
 		secretManager: await planSecretManager(ctx)
 	};
+	const leftBehind = Object.values(plans).some((plan) => "resourceOwners" in plan && plan.resourceOwners.has(application.name));
 	const removeLines = [
 		...plans.functionRegistry.changeSet.lines(),
 		...plans.staticWebsite.changeSet.lines(),
@@ -18016,7 +19456,7 @@ async function execRemove(client, workspaceId, application, config, confirm) {
 		...plans.secretManager.secretChangeSet.lines()
 	];
 	if (removeLines.length > 0) logger.log(removeLines.join("\n"));
-	if (plans.tailorDB.changeSet.service.deletes.length === 0 && plans.staticWebsite.changeSet.deletes.length === 0 && plans.aiGateway.changeSet.deletes.length === 0 && plans.idp.changeSet.service.deletes.length === 0 && plans.auth.changeSet.service.deletes.length === 0 && plans.pipeline.changeSet.service.deletes.length === 0 && plans.app.deletes.length === 0 && plans.executor.changeSet.deletes.length === 0 && plans.workflow.changeSet.deletes.length === 0 && plans.workflowExecutionPolicy.changeSet.deletes.length === 0 && plans.functionRegistry.changeSet.deletes.length === 0 && plans.secretManager.vaultChangeSet.deletes.length === 0 && plans.secretManager.secretChangeSet.deletes.length === 0) return;
+	if (plans.tailorDB.changeSet.service.deletes.length === 0 && plans.staticWebsite.changeSet.deletes.length === 0 && plans.aiGateway.changeSet.deletes.length === 0 && plans.idp.changeSet.service.deletes.length === 0 && plans.auth.changeSet.service.deletes.length === 0 && plans.pipeline.changeSet.service.deletes.length === 0 && plans.app.deletes.length === 0 && plans.executor.changeSet.deletes.length === 0 && plans.workflow.changeSet.deletes.length === 0 && plans.workflowExecutionPolicy.changeSet.deletes.length === 0 && plans.functionRegistry.changeSet.deletes.length === 0 && plans.secretManager.vaultChangeSet.deletes.length === 0 && plans.secretManager.secretChangeSet.deletes.length === 0) return { leftBehind };
 	if (confirm) await confirm();
 	await applyWorkflow(client, plans.workflow, "delete");
 	await applyWorkflowJobFunctionExecutionPolicy(client, plans.workflowExecutionPolicy, "delete");
@@ -18034,6 +19474,7 @@ async function execRemove(client, workspaceId, application, config, confirm) {
 	await applyTailorDB(client, plans.tailorDB, "delete-services");
 	await applyFunctionRegistry(client, workspaceId, plans.functionRegistry, "delete");
 	await applySecretManager(client, plans.secretManager, "delete");
+	return { leftBehind };
 }
 /**
 * Remove all resources managed by the current application.
@@ -18060,7 +19501,7 @@ const removeCommand$1 = defineAppCommand({
 		});
 		logger.info(`Planning removal of resources managed by "${application.name}"...`);
 		logger.newline();
-		await execRemove(client, workspaceId, application, config, async () => {
+		const { leftBehind } = await execRemove(client, workspaceId, application, config, async () => {
 			if (!args.yes) {
 				if (!await prompt.confirm({
 					message: "Are you sure you want to remove all resources?",
@@ -18071,6 +19512,13 @@ const removeCommand$1 = defineAppCommand({
       `);
 			} else logger.success("Removing all resources (--yes flag specified)...");
 		});
+		if (leftBehind) {
+			logger.warn(multiline`
+        Resources tagged with "${application.name}" were left in place: they carry an application id this config does not match.
+        Put that id in your config, or run deploy to take them over first, then remove again.
+      `);
+			return;
+		}
 		logger.success(`Successfully removed all resources managed by "${application.name}".`);
 	}
 });
@@ -19094,7 +20542,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-DArFTTJ9.mjs");
+	const { defineApplication } = await import("./application-CXNaUNhv.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -20308,8 +21756,13 @@ async function bundleQueryScript(engine, baseDir) {
 	const entryContent = engine === "sql" ? createSqlEntry() : createGqlEntry();
 	fs$2.writeFileSync(entryPath, entryContent);
 	const tsconfig = await resolveTSConfigWithFallback(baseDir);
-	return (await rolldown.build({
-		plugins: [platformBundleDefinePlugin],
+	const bundleLog = createBundleLog({ tsconfig });
+	const result = await rolldown.build({
+		plugins: [
+			createGeneratedEntryResolverPlugin(entryPath, baseDir),
+			createTsconfigPathsPlugin(),
+			platformBundleDefinePlugin
+		],
 		input: entryPath,
 		write: false,
 		output: {
@@ -20327,8 +21780,10 @@ async function bundleQueryScript(engine, baseDir) {
 			annotations: true,
 			unknownGlobalSideEffects: false
 		},
-		logLevel: "silent"
-	})).output[0].code;
+		...bundleLog.options
+	});
+	bundleLog.assertAllResolved();
+	return result.output[0].code;
 }
 
 //#endregion
@@ -21246,5 +22701,5 @@ async function registerTsHook(tsHookUrl) {
 }
 
 //#endregion
-export { getOrganization as $, removeLegacyUserAlias as $n, ensureConfigId as $t, truncate as A, hasChanges as An, getExecutorJob as At, show as B, deleteUserTokens as Bn, getWorkflowExecution as Bt, healthCommand as C, isValidMigrationNumber as Cn, getFunctionRegistry as Ct, resumeWorkflow as D, parseMigrationNumberArg as Dn, triggerExecutor as Dt, resumeCommand as E, formatMigrationNumber as En, triggerCommand as Et, writeDbTypesFile as F, generateUserTypes as Fn, startCommand as Ft, removeCommand$1 as G, loadConfigPath as Gn, deploy as Gt, extractOwnedNamespaces as H, hasAnyUserTokenEntry as Hn, functionExecutionStatusToString as Ht, getConfiguredEditorCommand as I, prompt as In, startWorkflow as It, organizationTree as J, loadPlatformClientConfig as Jn, listWorkspaces as Jt, updateCommand$1 as K, loadConsoleBaseUrl as Kn, deployFromCLI as Kt, openInConfiguredEditor as L, apiCall as Ln, getCommand$5 as Lt, generate as M, resourceTrn as Mn, jobsCommand as Mt, generateCommand as N, sdkNameLabelKey as Nn, listExecutorJobs as Nt, listCommand$2 as O, formatDiffSummary as On, listCommand$8 as Ot, generateMigrationScript as P, PluginManager as Pn, watchExecutorJob as Pt, getCommand$1 as Q, readPlatformConfig as Qn, workspaceNameSchema as Qt, deployCommand as R, assertWritable as Rn, getWorkflow as Rt, getAppHealth as S, getNextMigrationNumber as Sn, getCommand$4 as St, waitWorkflowExecution as T, reconstructSnapshotFromMigrations as Tn, webhookCommand as Tt, logBetaWarning as U, hasUserTokenEntry as Un, getCommand$6 as Ut, showCommand as V, fetchLatestToken as Vn, listWorkflowExecutions as Vt, remove as W, loadAccessToken as Wn, getExecutor as Wt, listCommand$3 as X, loadWorkspaceId as Xn, createWorkspace$1 as Xt, treeCommand as Y, loadStoredUserTokens as Yn, createCommand$1 as Yt, listOrganizations as Z, platformConfigFromProfile as Zn, formatKeyValueTable as Zt, getWorkspace as _, createSnapshotFromLocalTypes as _n, listMachineUsers as _t, queryCommand as a, parseMigrationLabelNumber as an, commonArgs as ar, getFolder as at, listApps as b, getMigrationFilePath as bn, listCommand$7 as bt, removeCommand as c, protoGqlPermission as cn, deploymentArgs as cr, createCommand as ct, listUsers as d, INITIAL_SCHEMA_NUMBER as dn, pagedLogArgs as dr, listOAuth2Clients as dt, executeScript as en, resolveConfigUser as er, updateCommand$2 as et, inviteCommand as f, MIGRATE_FILE_NAME as fn, paginationArgs as fr, getCommand$3 as ft, getCommand as g, compareSnapshots as gn, listCommand$6 as gt, restoreWorkspace as h, compareLocalTypesWithSnapshot as hn, workspaceArgs as hr, tokenCommand as ht, query as i, handleOptionalToRequiredError as in, defineAppCommand as ir, getCommand$2 as it, truncateCommand as j, getNamespacesWithMigrations as jn, getExecutorWaitFailureMessage as jt, listWorkflows as k, formatMigrationDiff as kn, listExecutors as kt, removeUser as l, DB_TYPES_FILE_NAME as ln, isVerbose as lr, createFolder as lt, restoreCommand as m, assertValidMigrationFiles as mn, toPageDirection as mr, getMachineUserToken as mt, errorToJson as n, bundleMigrationScript as nn, saveUserTokens as nr, listCommand$4 as nt, updateCommand as o, compareSnapshotWithRemote as on, configArg as or, deleteCommand$1 as ot, inviteUser as p, SCHEMA_FILE_NAME as pn, resolveMachineUserInputSource as pr, getOAuth2Client as pt, updateOrganization as q, loadMachineUserName as qn, listCommand$9 as qt, serializeError as r, MIGRATION_LABEL_KEY as rn, writePlatformConfig as rr, listFolders as rt, updateUser as s, generateAllTypeManifestsFromSnapshot as sn, confirmationArgs as sr, deleteFolder as st, registerTsHook as t, waitForExecution as tn, resolveUserTokenKey as tr, updateFolder as tt, listCommand as u, DIFF_FILE_NAME as un, multiConfigArg as ur, listCommand$5 as ut, deleteCommand as v, getLatestMigrationNumber as vn, generate$1 as vt, waitCommand as w, loadDiff as wn, listWebhookExecutors as wt, listCommand$1 as x, getMigrationFiles as xn, listFunctionRegistries as xt, deleteWorkspace as y, getMigrationDirPath as yn, getAuthInput as yt, deployStaticWebsite as z, loadConfig as zn, executionsCommand as zt };
-//# sourceMappingURL=register-ts-hook-BAHMwxfG.mjs.map
+export { getOrganization as $, hasUserTokenEntry as $n, ensureConfigId as $t, truncate as A, loadDiff as An, getExecutorJob as At, show as B, sdkAppIdLabelKey as Bn, getWorkflowExecution as Bt, healthCommand as C, createSnapshotFromLocalTypes as Cn, resolveMachineUserInputSource as Cr, getFunctionRegistry as Ct, resumeWorkflow as D, getMigrationFilePath as Dn, triggerExecutor as Dt, resumeCommand as E, getMigrationDirPath as En, triggerCommand as Et, writeDbTypesFile as F, formatMigrationDiff as Fn, startCommand as Ft, removeCommand$1 as G, generateUserTypes as Gn, deploy as Gt, extractOwnedNamespaces as H, sdkVersionLabelKey as Hn, functionExecutionStatusToString as Ht, getConfiguredEditorCommand as I, hasChanges as In, startWorkflow as It, organizationTree as J, assertWritable as Jn, listWorkspaces as Jt, updateCommand$1 as K, prompt as Kn, deployFromCLI as Kt, openInConfiguredEditor as L, getNamespacesWithMigrations as Ln, getCommand$5 as Lt, generate as M, formatMigrationNumber as Mn, jobsCommand as Mt, generateCommand as N, parseMigrationNumberArg as Nn, listExecutorJobs as Nt, listCommand$2 as O, getMigrationFiles as On, listCommand$8 as Ot, generateMigrationScript as P, formatDiffSummary as Pn, watchExecutorJob as Pt, getCommand$1 as Q, hasAnyUserTokenEntry as Qn, workspaceNameSchema as Qt, deployCommand as R, selectTargetNamespace as Rn, getWorkflow as Rt, getAppHealth as S, compareSnapshots as Sn, paginationArgs as Sr, getCommand$4 as St, waitWorkflowExecution as T, getLatestMigrationNumber as Tn, workspaceArgs as Tr, webhookCommand as Tt, logBetaWarning as U, writeMetadataLabels as Un, getCommand$6 as Ut, showCommand as V, sdkNameLabelKey as Vn, listWorkflowExecutions as Vt, remove as W, PluginManager as Wn, getExecutor as Wt, listCommand$3 as X, deleteUserTokens as Xn, createWorkspace$1 as Xt, treeCommand as Y, loadConfig as Yn, createCommand$1 as Yt, listOrganizations as Z, fetchLatestToken as Zn, formatKeyValueTable as Zt, getWorkspace as _, MIGRATE_FILE_NAME as _n, confirmationArgs as _r, listMachineUsers as _t, queryCommand as a, toTailorDBDeployInput as an, loadStoredUserTokens as ar, getFolder as at, listApps as b, assertValidMigrationFiles as bn, multiConfigArg as br, listCommand$7 as bt, removeCommand as c, handleOptionalToRequiredError as cn, readPlatformConfig as cr, createCommand as ct, listUsers as d, compareSnapshotWithRemote as dn, resolveUserTokenKey as dr, listOAuth2Clients as dt, executeScript as en, loadAccessToken as er, updateCommand$2 as et, inviteCommand as f, generateAllTypeManifestsFromSnapshot as fn, saveUserTokens as fr, getCommand$3 as ft, getCommand as g, INITIAL_SCHEMA_NUMBER as gn, configArg as gr, listCommand$6 as gt, restoreWorkspace as h, DIFF_FILE_NAME as hn, commonArgs as hr, tokenCommand as ht, query as i, logRemoteDriftGuidance as in, loadPlatformClientConfig as ir, getCommand$2 as it, truncateCommand as j, reconstructSnapshotFromMigrations as jn, getExecutorWaitFailureMessage as jt, listWorkflows as k, getNextMigrationNumber as kn, listExecutors as kt, removeUser as l, parseMigrationLabelNumber as ln, removeLegacyUserAlias as lr, createFolder as lt, restoreCommand as m, DB_TYPES_FILE_NAME as mn, defineAppCommand as mr, getMachineUserToken as mt, errorToJson as n, bundleMigrationScript as nn, loadConsoleBaseUrl as nr, listCommand$4 as nt, updateCommand as o, verifyRemoteSchema as on, loadWorkspaceId as or, deleteCommand$1 as ot, inviteUser as p, protoGqlPermission as pn, writePlatformConfig as pr, getOAuth2Client as pt, updateOrganization as q, apiCall as qn, listCommand$9 as qt, serializeError as r, checkMigrationDiffs as rn, loadMachineUserName as rr, listFolders as rt, updateUser as s, MIGRATION_LABEL_KEY as sn, platformConfigFromProfile as sr, deleteFolder as st, registerTsHook as t, waitForExecution as tn, loadConfigPath as tr, updateFolder as tt, listCommand as u, sanitizeMigrationLabel as un, resolveConfigUser as ur, listCommand$5 as ut, deleteCommand as v, SCHEMA_FILE_NAME as vn, deploymentArgs as vr, generate$1 as vt, waitCommand as w, formatSchemaDrifts as wn, toPageDirection as wr, listWebhookExecutors as wt, listCommand$1 as x, compareLocalTypesWithSnapshot as xn, pagedLogArgs as xr, listFunctionRegistries as xt, deleteWorkspace as y, assertMigrationNumberExists as yn, isVerbose as yr, getAuthInput as yt, deployStaticWebsite as z, resourceTrn as zn, executionsCommand as zt };
+//# sourceMappingURL=register-ts-hook-LYV7zH-e.mjs.map