@tailor-platform/sdk 2.0.0-next.3 → 2.0.0-next.5

package/dist/{register-ts-hook-ZpBacA07.mjs → register-ts-hook-BhzVkej0.mjs}

@@ -1,13 +1,14 @@
-import { t as db } from "./schema-89dYxNC2.mjs";
-import { $ as CreateUserProfileConfigRequestSchema, A as UpdatePipelineServiceRequestSchema, At as Condition_Operator, B as UpdateExecutorExecutorRequestSchema, Ct as UserProfileProviderConfig_UserProfileProviderType, D as CreatePipelineResolverRequestSchema, Dt as ApplicationSchemaUpdateAttemptStatus, E as UpdateSecretManagerSecretRequestSchema, Et as UpdateApplicationRequestSchema, F as IdPPermissionOperator, G as CreateAuthHookRequestSchema, H as ExecutorTargetType, I as IdPPermissionPermit, J as CreateAuthOAuth2ClientRequestSchema, K as CreateAuthIDPConfigRequestSchema, L as FunctionExecution_Status, M as CreateIdPServiceRequestSchema, Mt as PageDirection, N as UpdateIdPServiceRequestSchema, O as CreatePipelineServiceRequestSchema, Ot as Subgraph_ServiceType, P as IdPLang, Q as CreateTenantConfigRequestSchema, S as UpdateStaticWebsiteRequestSchema, St as TenantProviderConfig_TenantProviderType, T as CreateSecretManagerVaultRequestSchema, Tt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, U as ExecutorTriggerType, V as ExecutorJobStatus, W as CreateAuthConnectionRequestSchema, X as CreateAuthSCIMResourceRequestSchema, Y as CreateAuthSCIMConfigRequestSchema, Z as CreateAuthServiceRequestSchema, _ as TailorDBType_Permission_Operator, _t as AuthSCIMAttribute_Mutability, a as WorkspacePlatformUserRole, at as UpdateAuthSCIMConfigRequestSchema, b as AddCustomDomainRequestSchema, bt as AuthSCIMConfig_AuthorizationType, c as UpdateWorkflowRequestSchema, ct as UpdateTenantConfigRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as AuthConnection_Type, et as UpdateAuthConnectionRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as AuthHookPoint, g as TailorDBGQLPermission_Permit, gt as AuthOAuth2Client_GrantType, h as TailorDBGQLPermission_Operator, ht as AuthOAuth2Client_ClientType, it as UpdateAuthOAuth2ClientRequestSchema, j as PipelineResolver_OperationType, jt as FilterSchema, k as UpdatePipelineResolverRequestSchema, kt as ConditionSchema, l as WorkflowExecution_Status, lt as UpdateUserProfileConfigRequestSchema, m as TailorDBGQLPermission_Action, mt as AuthInvokerSchema, nt as UpdateAuthIDPConfigRequestSchema, o as CreateWorkflowJobFunctionRequestSchema, ot as UpdateAuthSCIMResourceRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as AuthIDPConfig_AuthType, q as CreateAuthMachineUserRequestSchema, rt as UpdateAuthMachineUserRequestSchema, s as CreateWorkflowRequestSchema, st as UpdateAuthServiceRequestSchema, t as OperatorService, tt as UpdateAuthHookRequestSchema, u as WorkflowJobExecution_Status, ut as AuthConnection_Status, v as TailorDBType_Permission_Permit, vt as AuthSCIMAttribute_Type, w as CreateSecretManagerSecretRequestSchema, wt as CreateApplicationRequestSchema, x as CreateStaticWebsiteRequestSchema, y as TailorDBType_PermitAction, yt as AuthSCIMAttribute_Uniqueness, z as CreateExecutorExecutorRequestSchema } from "./service_pb-CIrhGwHk.mjs";
+import { t as db } from "./schema-iCd1ugGp.mjs";
+import { i as PageDirection, n as Condition_Operator, r as FilterSchema, t as ConditionSchema } from "./resource_pb-BRv7AMXK.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
 import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-BEiZZ3qT.mjs";
-import { $ as getConsoleBaseUrl, C as getDistDir, E as loadConfig, F as loadPlatformClientConfig, J as fetchAllTolerant, L as loadWorkspaceId, M as loadConfigPath, P as loadMachineUserName, R as platformConfigFromProfile, S as createBundleCache, T as hashFile, V as resolveConfigUser, W as writePlatformConfig, X as fetchPaged, Y as fetchMachineUserToken, at as isDefaultPlatform, b as getPluginGenerationDependencies, d as buildExecutorArgsExpr, et as getOAuth2ClientId, f as buildResolverOperationHookExpr, g as platformBundleDefinePlugin, h as stringifyFunction, i as resolverBundleKey, it as initOperatorClient, j as loadAccessToken, l as HTTP_METHODS, m as assertUniqueTailorDBTypeNamesWithExternal, n as generatePluginFilesIfNeeded, nt as getPlatformBaseUrl, o as getApplicationAuthNamespace, ot as resolveStaticWebsiteUrls, p as assertUniqueLocalTailorDBTypeNames, q as fetchAll, r as loadApplication, st as byName, t as defineApplication, tt as getOrNull, w as hashContent, x as hasGenerationHooks, z as readPlatformConfig } from "./application-eHp9jXld.mjs";
-import { c as stripTailorDBTypeBuilderHelpers, h as loadFilesWithIgnores, t as createExecutorService, u as TailorDBTypeSchema } from "./service-ufH7sS8o.mjs";
+import { B as readPlatformConfig, C as createBundleCache, Ct as positiveIntArg, D as loadConfig, E as hashFile, Et as workspaceArgs, F as loadMachineUserName, G as writePlatformConfig, H as resolveConfigUser, I as loadPlatformClientConfig, J as fetchAll, M as loadAccessToken, N as loadConfigPath, R as loadWorkspaceId, S as hasGenerationHooks, St as parseDuration, T as hashContent, Tt as toPageDirection, X as fetchMachineUserToken, Y as fetchAllTolerant, Z as fetchPaged, _ as platformBundleDefinePlugin, _t as nonNegativeIntArg, at as initOperatorClient, bt as pagedLogArgs, ct as byName, dt as confirmationArgs, et as getConsoleBaseUrl, f as buildExecutorArgsExpr, ft as deploymentArgs, g as stringifyFunction, h as assertUniqueTailorDBTypeNamesWithExternal, i as resolverBundleKey, m as assertUniqueLocalTailorDBTypeNames, mt as folderArgs, n as generatePluginFilesIfNeeded, nt as getOrNull, o as getApplicationAuthNamespace, ot as isDefaultPlatform, p as buildResolverOperationHookExpr, pt as durationArg, r as loadApplication, rt as getPlatformBaseUrl, s as WorkflowJobFunctionExecutionPolicySchema, st as resolveStaticWebsiteUrls, t as defineApplication, tt as getOAuth2ClientId, u as HTTP_METHODS, ut as configArg, vt as orderArg, w as getDistDir, wt as resolveMachineUserInputSource, x as getPluginGenerationDependencies, xt as paginationArgs, yt as organizationArgs, z as platformConfigFromProfile } from "./application-Bf8wxOi6.mjs";
+import { c as stripTailorDBTypeBuilderHelpers, h as loadFilesWithIgnores, t as createExecutorService, u as TailorDBTypeSchema } from "./service-CzZEVrp9.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "./package-json-8b0O9TlX.mjs";
 import { i as userAgent } from "./secret-file-aoNXJmKa.mjs";
 import { n as isCLIError, t as createCLIError } from "./errors-118wUDRr.mjs";
+import { $ as CreateAuthServiceRequestSchema, A as CreatePipelineServiceRequestSchema, At as Subgraph_ServiceType, C as CreateStaticWebsiteRequestSchema, D as CreateSecretManagerVaultRequestSchema, Dt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, E as CreateSecretManagerSecretRequestSchema, Et as CreateApplicationRequestSchema, F as UpdateIdPServiceRequestSchema, G as ExecutorTriggerType, H as UpdateExecutorExecutorRequestSchema, I as IdPLang, J as CreateAuthIDPConfigRequestSchema, K as CreateAuthConnectionRequestSchema, L as IdPPermissionOperator, M as UpdatePipelineServiceRequestSchema, Mt as UpdateAIGatewayRequestSchema, N as PipelineResolver_OperationType, O as UpdateSecretManagerSecretRequestSchema, Ot as UpdateApplicationRequestSchema, P as CreateIdPServiceRequestSchema, Q as CreateAuthSCIMResourceRequestSchema, R as IdPPermissionPermit, S as AddCustomDomainRequestSchema, St as AuthSCIMConfig_AuthorizationType, Tt as UserProfileProviderConfig_UserProfileProviderType, U as ExecutorJobStatus, V as CreateExecutorExecutorRequestSchema, W as ExecutorTargetType, X as CreateAuthOAuth2ClientRequestSchema, Y as CreateAuthMachineUserRequestSchema, Z as CreateAuthSCIMConfigRequestSchema, _ as TailorDBGQLPermission_Operator, _t as AuthOAuth2Client_ClientType, a as WorkspacePlatformUserRole, at as UpdateAuthMachineUserRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthSCIMAttribute_Type, c as CreateWorkflowRequestSchema, ct as UpdateAuthSCIMResourceRequestSchema, d as WorkflowExecution_Status, dt as UpdateUserProfileConfigRequestSchema, et as CreateTenantConfigRequestSchema, f as WorkflowJobExecution_Status, ft as AuthConnection_Status, g as TailorDBGQLPermission_Action, gt as AuthInvokerSchema, h as UpdateTailorDBTypeRequestSchema, ht as AuthIDPConfig_AuthType, it as UpdateAuthIDPConfigRequestSchema, j as UpdatePipelineResolverRequestSchema, jt as CreateAIGatewayRequestSchema, k as CreatePipelineResolverRequestSchema, kt as ApplicationSchemaUpdateAttemptStatus, l as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, lt as UpdateAuthServiceRequestSchema, m as CreateTailorDBTypeRequestSchema, mt as AuthHookPoint, nt as UpdateAuthConnectionRequestSchema, o as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as UpdateAuthOAuth2ClientRequestSchema, p as CreateTailorDBServiceRequestSchema, pt as AuthConnection_Type, q as CreateAuthHookRequestSchema, rt as UpdateAuthHookRequestSchema, s as CreateWorkflowJobFunctionRequestSchema, st as UpdateAuthSCIMConfigRequestSchema, t as OperatorService, tt as CreateUserProfileConfigRequestSchema, u as UpdateWorkflowRequestSchema, ut as UpdateTenantConfigRequestSchema, v as TailorDBGQLPermission_Permit, vt as AuthOAuth2Client_GrantType, w as UpdateStaticWebsiteRequestSchema, wt as TenantProviderConfig_TenantProviderType, x as TailorDBType_PermitAction, xt as AuthSCIMAttribute_Uniqueness, y as TailorDBType_Permission_Operator, yt as AuthSCIMAttribute_Mutability, z as FunctionExecution_Status } from "./service_pb-Bk7dL-yT.mjs";
 import { r as withSpan } from "./telemetry-BRVdwh14.mjs";
 import * as mod from "node:module";
 import * as path from "pathe";
@@ -16,8 +17,7 @@ import { arg, createDefineCommand, defineCommand, runCommand } from "politty";
 import { z } from "zod";
 import { ScalarType, create, fromJson, toJson } from "@bufbuild/protobuf";
 import * as fs$1 from "node:fs";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { parseEnv } from "node:util";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { ValueSchema, timestampDate } from "@bufbuild/protobuf/wkt";
 import { formatDistanceToNowStrict } from "date-fns";
 import { getBorderCharacters, table } from "table";
@@ -48,240 +48,6 @@ import { createPrompt } from "@toiroakr/read-multiline";
 import { astVisitor, parse } from "pgsql-ast-parser";
 import { parse as parse$1 } from "@0no-co/graphql.web";
 
-//#region src/cli/shared/args.ts
-const unitToMs = {
-	ms: 1,
-	s: 1e3,
-	m: 60 * 1e3
-};
-const durationPattern = /^(\d+)(ms|s|m)$/;
-/**
-* Schema for duration string validation (e.g., "3s", "500ms", "1m")
-* Only validates format; use parseDuration() to convert to milliseconds
-*/
-const durationArg = z.string().refine((val) => durationPattern.test(val), { message: "Invalid duration format. Expected format: '3s', '500ms', '1m'" }).refine((val) => {
-	const match = val.match(durationPattern);
-	if (!match) return false;
-	const digits = match[1];
-	return digits !== void 0 && parseInt(digits, 10) > 0;
-}, { message: "Duration must be greater than 0" });
-/**
-* Parse a validated duration string into milliseconds
-* @param duration - Duration string (e.g., "3s", "500ms", "1m")
-* @returns Duration in milliseconds
-*/
-function parseDuration(duration) {
-	const match = assertDefined(duration.match(durationPattern), `invalid duration format: ${duration}`);
-	const value = parseInt(assertDefined(match[1], "duration digits group missing"), 10);
-	const unit = assertDefined(match[2], "duration unit group missing");
-	return value * unitToMs[unit];
-}
-/**
-* Schema for positive integer validation (from string input)
-* Transforms the string to a number
-*/
-const positiveIntArg = z.coerce.number().int().positive();
-/**
-* Schema for non-negative integer validation (from string input).
-* Accepts 0 (used for `--limit 0` to disable the limit).
-*/
-const nonNegativeIntArg = z.coerce.number().int().nonnegative();
-/**
-* Schema for sort order (`asc` or `desc`).
-*/
-const orderArg = z.enum(["asc", "desc"]);
-/**
-* Translate a CLI `--order` value into the proto `PageDirection` enum.
-* Returns `undefined` when the user did not specify an order so that
-* callers can omit the field and fall back to the server default.
-* @param order - Order string from CLI args (`"asc"` | `"desc"` | undefined)
-* @returns PageDirection, or undefined when `order` is undefined
-*/
-function toPageDirection(order) {
-	if (order === void 0) return void 0;
-	return order === "asc" ? PageDirection.ASC : PageDirection.DESC;
-}
-/**
-* Load env files from parsed arguments.
-* Processes --env-file first, then --env-file-if-exists.
-*
-* Follows Node.js --env-file behavior:
-* - Variables already set in the environment are NOT overwritten
-* - Variables from later files override those from earlier files
-* @param envFiles - Required env file path(s) that must exist
-* @param envFilesIfExists - Optional env file path(s) that are loaded if they exist
-*/
-function loadEnvFiles(envFiles, envFilesIfExists) {
-	const originalEnvKeys = new Set(Object.keys(process.env));
-	const load = (files, required) => {
-		for (const file of [files ?? []].flat()) {
-			const envPath = path.resolve(process.cwd(), file);
-			if (!fs$1.existsSync(envPath)) {
-				if (required) throw new Error(`Environment file not found: ${envPath}`);
-				continue;
-			}
-			const parsed = parseEnv(fs$1.readFileSync(envPath, "utf-8"));
-			for (const [key, value] of Object.entries(parsed)) {
-				if (originalEnvKeys.has(key)) continue;
-				process.env[key] = value;
-			}
-		}
-	};
-	load(envFiles, true);
-	load(envFilesIfExists, false);
-}
-/**
-* Common arguments for all CLI commands
-*
-* NOTE: --env-file and --env-file-if-exists collide with Node.js flags due to a bug
-* (https://github.com/nodejs/node/issues/54232). Node.js parses these even after the
-* script path, causing warnings (twice due to tsx loader).
-*/
-const commonArgs = {
-	"env-file": arg(z.string().optional(), {
-		alias: "e",
-		description: "Path to the environment file (error if not found)",
-		completion: {
-			type: "file",
-			matcher: [".env.*", ".env"]
-		}
-	}),
-	"env-file-if-exists": arg(z.string().optional(), {
-		description: "Path to the environment file (ignored if not found)",
-		completion: {
-			type: "file",
-			matcher: [".env.*", ".env"]
-		},
-		effect: (_value, { args }) => {
-			loadEnvFiles(args["env-file"], args["env-file-if-exists"]);
-		}
-	}),
-	verbose: arg(z.boolean().default(false), {
-		description: "Enable verbose logging",
-		effect: (value) => {
-			verboseMode = value;
-		}
-	}),
-	json: arg(z.boolean().default(false), {
-		alias: "j",
-		description: "Output as JSON",
-		effect: (value) => {
-			logger.jsonMode = value;
-		}
-	})
-};
-/**
-* Arguments for commands that require workspace context
-*/
-const workspaceArgs = {
-	"workspace-id": arg(z.string().optional(), {
-		alias: "w",
-		description: "Workspace ID",
-		env: "TAILOR_PLATFORM_WORKSPACE_ID",
-		completion: { type: "none" }
-	}),
-	profile: arg(z.string().optional(), {
-		alias: "p",
-		description: "Workspace profile",
-		env: "TAILOR_PLATFORM_PROFILE",
-		completion: { type: "none" }
-	})
-};
-/**
-* Shared config arg for commands that accept a config file path
-*/
-const configArg = { config: arg(z.string().default("tailor.config.ts"), {
-	alias: "c",
-	description: "Path to Tailor config file",
-	env: "TAILOR_CONFIG_PATH",
-	completion: {
-		type: "file",
-		extensions: ["ts"]
-	}
-}) };
-/**
-* Shared config arg for commands that accept one or more comma-separated config file paths
-*/
-const multiConfigArg = { config: arg(z.string().default("tailor.config.ts"), {
-	alias: "c",
-	description: "Path to SDK config file. Use comma-separated paths to deploy multiple apps together.",
-	env: "TAILOR_PLATFORM_SDK_CONFIG_PATH",
-	completion: {
-		type: "file",
-		extensions: ["ts"]
-	}
-}) };
-/**
-* Arguments for commands that interact with deployed resources (includes config)
-*/
-const deploymentArgs = {
-	...workspaceArgs,
-	...configArg
-};
-/**
-* Arguments for commands that require confirmation
-*/
-const confirmationArgs = { yes: arg(z.boolean().default(false), {
-	alias: "y",
-	description: "Skip confirmation prompts"
-}) };
-/**
-* Arguments for commands that require organization context
-*/
-const organizationArgs = { "organization-id": arg(z.string(), {
-	alias: "o",
-	description: "Organization ID",
-	env: "TAILOR_PLATFORM_ORGANIZATION_ID",
-	completion: { type: "none" }
-}) };
-/**
-* Arguments for list commands that accept `--order` / `--limit`. Sort
-* order defaults to `desc` (newest first) because most callers want the
-* latest items; pass `--order asc` to opt in to ascending order. The
-* limit is unbounded by default so existing invocations keep returning
-* every item; pass `--limit N` to cap the result size.
-* @param defaultOrder - Default value for `--order` (defaults to `"desc"`)
-* @returns Argument shape suitable for spreading into a command schema
-*/
-const paginationArgs = (defaultOrder = "desc") => ({
-	order: arg(orderArg.default(defaultOrder), { description: "Sort order (asc or desc)" }),
-	limit: arg(nonNegativeIntArg.optional(), {
-		alias: "l",
-		description: "Maximum number of items to return (0 or omit: unlimited)"
-	})
-});
-/**
-* Arguments for time-series log list commands. Defaults to newest-first
-* (`desc`) and a 50-item cap so that listing stays responsive on busy
-* workspaces. Pass `--limit 0` to disable the cap and fetch all entries.
-*/
-const pagedLogArgs = {
-	order: arg(orderArg.default("desc"), { description: "Sort order (asc or desc)" }),
-	limit: arg(nonNegativeIntArg.default(50), {
-		alias: "l",
-		description: "Maximum number of items to return (0: unlimited)"
-	})
-};
-/**
-* Arguments for commands that require folder context
-*/
-const folderArgs = { "folder-id": arg(z.string(), {
-	alias: "f",
-	description: "Folder ID",
-	env: "TAILOR_PLATFORM_FOLDER_ID",
-	completion: { type: "none" }
-}) };
-let verboseMode = false;
-/**
-* Returns whether verbose mode is enabled.
-* Used by the global cleanup handler which doesn't have access to parsed args.
-* @returns Whether verbose mode is enabled
-*/
-function isVerbose() {
-	return verboseMode;
-}
-
-//#endregion
 //#region src/cli/shared/command.ts
 /**
 * defineCommand with global args type (CommonArgsType).
@@ -1601,7 +1367,7 @@ var PluginManager = class {
 	}
 	/**
 	* Extend a TailorDB type with new fields.
-	* This method handles the `db.type()` call and metadata copying internally.
+	* This method handles the `db.table()` call and metadata copying internally.
 	* @param params - Parameters for type extension
 	* @returns The extended TailorDB type
 	*/
@@ -1616,7 +1382,7 @@ var PluginManager = class {
 		};
 		const pluralForm = originalType.metadata.settings?.pluralForm;
 		const typeName = pluralForm ? [originalType.name, pluralForm] : originalType.name;
-		return copyMetadataToExtendedType(originalType, db.type(typeName, fieldsWithoutId));
+		return copyMetadataToExtendedType(originalType, db.table(typeName, fieldsWithoutId));
 	}
 };
 /**
@@ -2531,35 +2297,59 @@ const SecretsStateSchema = z.object({
 	vaults: z.record(z.string(), z.record(z.string(), z.string())),
 	connections: z.record(z.string(), z.string()).optional()
 });
+const PersistedSecretsStateSchema = z.object({
+	version: z.literal(1),
+	workspaceId: z.string(),
+	applicationKey: z.string(),
+	state: SecretsStateSchema
+});
 /**
-* Get the file path for the secrets state JSON.
-* @returns Absolute path to secrets-state.json
+* Get the file path for one workspace and application's secrets state JSON.
+* @param scope - Workspace and application identity for the deployment
+* @returns Absolute path to the scoped state file
 */
-function getSecretsStatePath() {
-	return path.join(getDistDir(), "secrets-state.json");
+function getSecretsStatePath(scope) {
+	const scopeHash = hashValue(JSON.stringify([scope.workspaceId, applicationStateKey(scope)]));
+	return path.join(getDistDir(), "secrets-state", `${scopeHash}.json`);
 }
-/**
-* Load secrets hash state from disk.
-* @returns Persisted state, or empty state if file is missing or corrupted
-*/
-function loadSecretsState() {
-	const filePath = getSecretsStatePath();
-	if (!existsSync(filePath)) return { vaults: {} };
+function loadPersistedSecretsState(scope) {
 	try {
-		const raw = readFileSync(filePath, "utf-8");
-		return SecretsStateSchema.parse(JSON.parse(raw));
+		const raw = readFileSync(getSecretsStatePath(scope), "utf-8");
+		const persistedState = PersistedSecretsStateSchema.parse(JSON.parse(raw));
+		if (persistedState.workspaceId !== scope.workspaceId || persistedState.applicationKey !== applicationStateKey(scope)) return;
+		return persistedState;
 	} catch {
-		return { vaults: {} };
+		return;
 	}
 }
+function applicationStateKey(scope) {
+	if (!scope.applicationId) throw new Error(`Application "${scope.applicationName}" has no stable id for secrets state`);
+	return `id:${scope.applicationId}`;
+}
+/**
+* Load secrets hash state for one workspace and application from disk.
+* @param scope - Workspace and application identity for the deployment
+* @returns Persisted state, or empty state if the scope is missing or the file is invalid
+*/
+function loadSecretsState(scope) {
+	if (!scope.applicationId) return { vaults: {} };
+	return loadPersistedSecretsState(scope)?.state ?? { vaults: {} };
+}
 /**
-* Save secrets hash state to disk.
+* Save secrets hash state for one workspace and application to disk.
+* @param scope - Workspace and application identity for the deployment
 * @param state - The secrets state to persist
 */
-function saveSecretsState(state) {
-	const filePath = getSecretsStatePath();
+function saveSecretsState(scope, state) {
+	if (!scope.applicationId) return;
+	const filePath = getSecretsStatePath(scope);
 	mkdirSync(path.dirname(filePath), { recursive: true });
-	writeFileSync(filePath, JSON.stringify(state, null, 2), "utf-8");
+	writeFileSync(filePath, JSON.stringify({
+		version: 1,
+		workspaceId: scope.workspaceId,
+		applicationKey: applicationStateKey(scope),
+		state
+	}, null, 2), "utf-8");
 }
 /**
 * Compute SHA-256 hex digest of a value.
@@ -2625,6 +2415,11 @@ function buildUpdateMask(existing, desired, secretChanged) {
 * @returns Planned changes for auth connections
 */
 async function planAuthConnections(client, workspaceId, appName, appId, auths) {
+	const stateScope = {
+		workspaceId,
+		applicationId: appId,
+		applicationName: appName
+	};
 	const changeSet = createChangeSet("Auth connections");
 	const conflicts = [];
 	const unmanaged = [];
@@ -2648,7 +2443,7 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 			allLabels: metadata?.labels
 		};
 	}));
-	const state = loadSecretsState();
+	const state = loadSecretsState(stateScope);
 	for (const [name, config] of Object.entries(desiredConnections)) {
 		const existing = existingConnections[name];
 		const metaRequest = await buildMetaRequest({
@@ -2709,7 +2504,8 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 		changeSet,
 		conflicts,
 		unmanaged,
-		resourceOwners
+		resourceOwners,
+		stateScope
 	};
 }
 /**
@@ -2719,7 +2515,7 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 * @param phase - Apply phase
 */
 async function applyAuthConnections(client, result, phase) {
-	const { changeSet } = result;
+	const { changeSet, stateScope } = result;
 	if (phase === "create-update") {
 		await Promise.all(changeSet.creates.map(async (create) => {
 			await client.createAuthConnection(create.request);
@@ -2733,26 +2529,29 @@ async function applyAuthConnections(client, result, phase) {
 		await Promise.all(changeSet.updates.map(async (update) => {
 			await client.setMetadata(update.metaRequest);
 		}));
-		const state = loadSecretsState();
-		if (!state.connections) state.connections = {};
-		for (const create of changeSet.creates) {
-			const conn = create.request.connection;
-			if (conn?.config?.case === "oauth2") state.connections[create.name] = hashValue(conn.config.value.clientSecret ?? "");
-		}
-		for (const replace of changeSet.replaces) {
-			const conn = replace.updateRequest.connection;
-			if (conn?.config?.case === "oauth2" && replace.updateRequest.updateMask?.paths?.includes("oauth2.client_secret")) state.connections[replace.name] = hashValue(conn.config.value.clientSecret ?? "");
+		const secretReplaces = changeSet.replaces.filter((replace) => replace.updateRequest.updateMask?.paths?.includes("oauth2.client_secret"));
+		if (changeSet.creates.length > 0 || secretReplaces.length > 0) {
+			const state = loadSecretsState(stateScope);
+			if (!state.connections) state.connections = {};
+			for (const create of changeSet.creates) {
+				const conn = create.request.connection;
+				if (conn?.config?.case === "oauth2") state.connections[create.name] = hashValue(conn.config.value.clientSecret ?? "");
+			}
+			for (const replace of secretReplaces) {
+				const conn = replace.updateRequest.connection;
+				if (conn?.config?.case === "oauth2") state.connections[replace.name] = hashValue(conn.config.value.clientSecret ?? "");
+			}
+			saveSecretsState(stateScope, state);
 		}
-		saveSecretsState(state);
 	} else {
 		await Promise.all(changeSet.deletes.map(async (del) => {
 			await client.deleteAuthConnection(del.request);
 		}));
 		if (changeSet.deletes.length > 0) {
-			const state = loadSecretsState();
+			const state = loadSecretsState(stateScope);
 			if (state.connections) {
 				for (const del of changeSet.deletes) delete state.connections[del.name];
-				saveSecretsState(state);
+				saveSecretsState(stateScope, state);
 			}
 		}
 	}
@@ -3915,7 +3714,10 @@ async function applyAuth(client, result, phase = "create-update") {
 		await Promise.all([...changeSet.machineUser.creates.map((create) => client.createAuthMachineUser(create.request)), ...changeSet.machineUser.updates.map((update) => client.updateAuthMachineUser(update.request))]);
 	};
 	const applyCreateUpdateDependents = async () => {
-		await applyAuthConnections(client, { changeSet: changeSet.connection }, "create-update");
+		await applyAuthConnections(client, {
+			changeSet: changeSet.connection,
+			stateScope: result.connectionStateScope
+		}, "create-update");
 		await Promise.all([...changeSet.idpConfig.creates.map(async (create) => {
 			if (create.idpConfig.kind === "BuiltInIdP") assertDefined(create.request.idpConfig, "request missing idpConfig").config = await protoBuiltinIdPConfig(client, assertDefined(create.request.workspaceId, "request missing workspaceId"), create.idpConfig);
 			return client.createAuthIDPConfig(create.request);
@@ -3958,7 +3760,10 @@ async function applyAuth(client, result, phase = "create-update") {
 		await Promise.all(changeSet.tenantConfig.deletes.map((del) => client.deleteTenantConfig(del.request)));
 		await Promise.all(changeSet.userProfileConfig.deletes.map((del) => client.deleteUserProfileConfig(del.request)));
 		await Promise.all(changeSet.idpConfig.deletes.map((del) => client.deleteAuthIDPConfig(del.request)));
-		await applyAuthConnections(client, { changeSet: changeSet.connection }, "delete-resources");
+		await applyAuthConnections(client, {
+			changeSet: changeSet.connection,
+			stateScope: result.connectionStateScope
+		}, "delete-resources");
 	} else if (phase === "delete-services") await Promise.all(changeSet.service.deletes.map((del) => client.deleteAuthService(del.request)));
 }
 /**
@@ -4002,7 +3807,8 @@ async function planAuth(context) {
 		},
 		conflicts: [...conflicts, ...connectionResult.conflicts],
 		unmanaged: [...unmanaged, ...connectionResult.unmanaged],
-		resourceOwners: /* @__PURE__ */ new Set([...resourceOwners, ...connectionResult.resourceOwners])
+		resourceOwners: /* @__PURE__ */ new Set([...resourceOwners, ...connectionResult.resourceOwners]),
+		connectionStateScope: connectionResult.stateScope
 	};
 }
 async function planServices$2(client, workspaceId, appName, appId, auths, forceApplyAll = false) {
@@ -5878,7 +5684,12 @@ async function planSecretManager(context) {
 		getName: (resource) => resource.name,
 		getTrn: (name) => resourceTrn(workspaceId, "vault", name)
 	});
-	const state = loadSecretsState();
+	const stateScope = {
+		workspaceId,
+		applicationId: application.id,
+		applicationName: application.name
+	};
+	const state = loadSecretsState(stateScope);
 	const skippedSecrets = [];
 	await Promise.all(secretVaults.map(async (vault) => {
 		const vaultName = vault.vaultName;
@@ -5987,7 +5798,8 @@ async function planSecretManager(context) {
 		skippedSecrets,
 		conflicts,
 		unmanaged,
-		resourceOwners
+		resourceOwners,
+		stateScope
 	};
 }
 /**
@@ -5995,11 +5807,11 @@ async function planSecretManager(context) {
 * @param client - Operator client instance
 * @param result - Planned secret changes
 * @param phase - Apply phase
-* @param application - Application to read secrets from for hash state persistence
+* @param application - Application used for ownership metadata and hash state persistence
 * @returns Promise that resolves when secret changes are applied
 */
 async function applySecretManager(client, result, phase = "create-update", application) {
-	const { vaultChangeSet, secretChangeSet } = result;
+	const { vaultChangeSet, secretChangeSet, stateScope } = result;
 	if (phase === "create-update") {
 		await Promise.all(vaultChangeSet.creates.map(async (create) => {
 			await client.createSecretManagerVault(vaultCreateRequest(create));
@@ -6022,13 +5834,14 @@ async function applySecretManager(client, result, phase = "create-update", appli
 		}));
 		await Promise.all(secretChangeSet.creates.map((create) => client.createSecretManagerSecret(secretCreateRequest(create))));
 		await Promise.all(secretChangeSet.updates.map((update) => client.updateSecretManagerSecret(secretUpdateRequest(update))));
-		if (application) {
-			const state = loadSecretsState();
-			for (const vault of application.secrets) {
-				if (!Object.hasOwn(state.vaults, vault.vaultName)) state.vaults[vault.vaultName] = {};
-				for (const secret of vault.secrets) if (secret.value != null) assertDefined(state.vaults[vault.vaultName], "vault state entry missing")[secret.name] = hashValue(secret.value);
+		const secretHashUpdates = [...secretChangeSet.creates, ...secretChangeSet.updates];
+		if (application && secretHashUpdates.length > 0) {
+			const state = loadSecretsState(stateScope);
+			for (const secret of secretHashUpdates) {
+				if (!Object.hasOwn(state.vaults, secret.vaultName)) state.vaults[secret.vaultName] = {};
+				assertDefined(state.vaults[secret.vaultName], "vault state entry missing")[secret.secretName] = hashValue(secret.value);
 			}
-			saveSecretsState(state);
+			saveSecretsState(stateScope, state);
 		}
 	} else {
 		await Promise.all(secretChangeSet.deletes.map((del) => client.deleteSecretManagerSecret({
@@ -6041,13 +5854,13 @@ async function applySecretManager(client, result, phase = "create-update", appli
 			secretmanagerVaultName: del.name
 		})));
 		if (secretChangeSet.deletes.length > 0 || vaultChangeSet.deletes.length > 0) {
-			const state = loadSecretsState();
+			const state = loadSecretsState(stateScope);
 			for (const del of secretChangeSet.deletes) if (Object.hasOwn(state.vaults, del.vaultName)) {
 				delete assertDefined(state.vaults[del.vaultName], "vault state entry missing")[del.secretName];
 				if (Object.keys(assertDefined(state.vaults[del.vaultName], "vault state entry missing")).length === 0) delete state.vaults[del.vaultName];
 			}
 			for (const del of vaultChangeSet.deletes) delete state.vaults[del.name];
-			saveSecretsState(state);
+			saveSecretsState(stateScope, state);
 		}
 	}
 }
@@ -6142,6 +5955,7 @@ function formatDiffChange(change) {
 		case "relationship_removed": return `  - [Relationship${change.relationshipType ? ` (${change.relationshipType})` : ""}] ${change.relationshipName}`;
 		case "relationship_modified": return `  ~ [Relationship${change.relationshipType ? ` (${change.relationshipType})` : ""}] ${change.relationshipName}: ${change.reason ?? "modified"}`;
 		case "permission_modified": return `  ~ [Permission] ${change.reason ?? "modified"}`;
+		case "type_scripts_modified": return `  ~ [Type Scripts] ${change.typeName}: ${change.reason ?? "type-level hooks/validate changed"}`;
 		default: {
 			const unknown = change;
 			return `  ? ${unknown.typeName}.${unknown.fieldName ?? ""}`;
@@ -6236,7 +6050,8 @@ const DIFF_CHANGE_LABELS = {
 	relationship_added: "relationship(s) added",
 	relationship_removed: "relationship(s) removed",
 	relationship_modified: "relationship(s) modified",
-	permission_modified: "permission(s) modified"
+	permission_modified: "permission(s) modified",
+	type_scripts_modified: "type script(s) modified"
 };
 /**
 * Format a summary of the migration diff
@@ -6250,6 +6065,181 @@ function formatDiffSummary(diff) {
 	return parts.length > 0 ? parts.join(", ") : "No changes";
 }
 
+//#endregion
+//#region src/parser/service/tailordb/type-script.ts
+const INPUT = "_input";
+const NEW_RECORD = "_newRecord";
+const OLD_RECORD = "_oldRecord";
+const NOW = "_now";
+const SOURCE_HASH_PREFIX = "// @sdk-source-hash:";
+const TIME_TYPES = /* @__PURE__ */ new Set([
+	"datetime",
+	"date",
+	"time"
+]);
+const key = (name) => JSON.stringify(name);
+function collectFieldScriptSources(fields) {
+	const entries = [];
+	for (const [name, config] of Object.entries(fields).toSorted(([a], [b]) => a.localeCompare(b))) {
+		const data = {};
+		if (config.hooks?.create?.expr) data.hc = config.hooks.create.expr;
+		if (config.hooks?.update?.expr) data.hu = config.hooks.update.expr;
+		if (config.validate?.some((v) => v.script?.expr)) data.v = config.validate.filter((v) => v.script?.expr).map((v) => [v.script?.expr, v.errorMessage]);
+		if (config.default !== void 0) {
+			data.d = config.default instanceof Date ? config.default.toISOString() : config.default;
+			data.t = config.type;
+		}
+		if (config.fields) {
+			const nested = collectFieldScriptSources(config.fields);
+			if (nested.length > 0) {
+				data.f = nested;
+				data.a = !!config.array;
+			}
+		}
+		if (Object.keys(data).length > 0) entries.push([name, data]);
+	}
+	return entries;
+}
+function computeSourceScriptHash(fields, options) {
+	const fieldSources = collectFieldScriptSources(fields);
+	if (!(fieldSources.length > 0 || options?.typeHookExpr?.create || options?.typeHookExpr?.update || options?.typeValidateExpr)) return void 0;
+	const payload = [fieldSources];
+	if (options?.typeHookExpr?.create) payload.push(["thc", options.typeHookExpr.create]);
+	if (options?.typeHookExpr?.update) payload.push(["thu", options.typeHookExpr.update]);
+	if (options?.typeValidateExpr) payload.push(["tve", options.typeValidateExpr]);
+	return createHash("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
+}
+function extractSourceScriptHash(expr) {
+	return expr.match(/\/\/ @sdk-source-hash:([0-9a-f]+)\s*$/)?.[1];
+}
+const isNestedType = (config) => config.type === "nested" && config.fields !== void 0;
+function serializeDefault(value, fieldType) {
+	if (value === "now" && TIME_TYPES.has(fieldType)) return NOW;
+	if (value instanceof Date) return `new Date(${JSON.stringify(value.toISOString())})`;
+	return JSON.stringify(value);
+}
+/**
+* Build the object literal that reconstructs one record level with hook
+* overrides and defaults applied.  For create, defaults are appended as
+* `?? defaultValue` after the hook expression (field hook → default).
+* Returns null when no field under this level has a hook or default for
+* the operation.
+* @param {Record<string, ScriptFieldConfig>} fields - Field configurations
+* @param {string} accessExpr - JS expression to access the parent object
+* @param {string} oldAccessExpr - JS expression to access the old record parent
+* @param {HookOperation} operation - Hook operation type
+* @param {boolean} nested - Whether building inside a nested field (rejects defaults)
+* @returns {string | null} Object literal expression or null
+*/
+function buildHookObject(fields, accessExpr, oldAccessExpr, operation, nested = false) {
+	const parts = [];
+	for (const [name, config] of Object.entries(fields)) {
+		const access = `${accessExpr}[${key(name)}]`;
+		const oldAccess = `${oldAccessExpr}?.[${key(name)}]`;
+		if (isNestedType(config) && config.fields) {
+			if (config.array) {
+				const inner = buildHookObject(config.fields, "__el", "undefined", operation, true);
+				if (inner !== null) parts.push(`${key(name)}: (${access} || []).map((__el) => Object.assign({}, __el, ${inner}))`);
+			} else {
+				const inner = buildHookObject(config.fields, `(${access} || {})`, oldAccess, operation, true);
+				if (inner !== null) parts.push(`${key(name)}: Object.assign({}, ${access}, ${inner})`);
+			}
+			continue;
+		}
+		const hook = config.hooks?.[operation];
+		if (nested && config.default !== void 0) throw new Error(`.default() cannot be used on nested inner field "${name}"`);
+		const hasDefault = operation === "create" && config.default !== void 0;
+		if (hook && hasDefault) parts.push(`${key(name)}: ((_value) => (${hook.expr}))(${access}) ?? ${serializeDefault(config.default, config.type)}`);
+		else if (hook && operation === "create") parts.push(`${key(name)}: ((_value) => (${hook.expr}))(${access})`);
+		else if (hook) parts.push(`${key(name)}: ((_value, _oldValue) => (${hook.expr}))(${access}, ${oldAccess} ?? null)`);
+		else if (hasDefault) parts.push(`${key(name)}: ${access} ?? ${serializeDefault(config.default, config.type)}`);
+	}
+	if (parts.length === 0) return null;
+	return `{ ${parts.join(", ")} }`;
+}
+/**
+* Build validation statements for one record level.
+* Each leaf field with validators contributes a block that runs every
+* validator and records all failing messages keyed by dotted field path.
+* @param {Record<string, ScriptFieldConfig>} fields - Field configurations
+* @param {string} accessExpr - JS expression to access the parent object
+* @param {string} keyPrefix - Dotted path prefix for error keys
+* @returns {string[]} Array of validation statement strings
+*/
+function buildValidateStatements(fields, accessExpr, keyPrefix) {
+	const statements = [];
+	for (const [name, config] of Object.entries(fields)) {
+		const access = `${accessExpr}[${key(name)}]`;
+		const fieldPath = keyPrefix ? `${keyPrefix}.${name}` : name;
+		const validators = (config.validate ?? []).filter((v) => v.script?.expr);
+		if (validators.length > 0) {
+			const checks = validators.map((v) => `{ const __r = (${v.script?.expr}); if (typeof __r === "string") { __errs[${key(fieldPath)}] = __r; } }`).join("\n");
+			statements.push(`{ const _value = ${access};\n${checks}\n}`);
+		}
+		if (isNestedType(config) && config.fields) if (config.array) {
+			const innerParts = [];
+			for (const [innerName, innerConfig] of Object.entries(config.fields)) {
+				const innerValidators = (innerConfig.validate ?? []).filter((v) => v.script?.expr);
+				if (innerValidators.length > 0) {
+					const errorKeyExpr = `${JSON.stringify(fieldPath + "[")} + __idx + ${JSON.stringify("]." + innerName)}`;
+					const checks = innerValidators.map((v) => `{ const __r = (${v.script?.expr}); if (typeof __r === "string") { __errs[${errorKeyExpr}] = __r; } }`).join("\n");
+					innerParts.push(`{ const _value = __el[${key(innerName)}];\n${checks}\n}`);
+				}
+			}
+			if (innerParts.length > 0) statements.push(`(${access} || []).forEach((__el, __idx) => {\n${innerParts.join("\n")}\n});`);
+		} else {
+			const nested = buildValidateStatements(config.fields, access, fieldPath);
+			if (nested.length > 0) statements.push(`if (${access} != null) {\n${nested.join("\n")}\n}`);
+		}
+	}
+	return statements;
+}
+function wrapHook(objectExpr) {
+	return `((_invoker) => { const ${NOW} = new Date(); return ${objectExpr}; })(typeof _invoker !== "undefined" ? _invoker : undefined)`;
+}
+function wrapValidate(statements, typeValidateExpr) {
+	const issuesFn = typeValidateExpr ? " const __issues = (f, m) => { __errs[f] = m; };" : "";
+	const typeValidateStmt = typeValidateExpr ? ` ${typeValidateExpr};` : "";
+	return `((_invoker) => { const __errs = {};${issuesFn}\n${statements.join("\n")}${typeValidateStmt}\nreturn __errs; })(typeof _invoker !== "undefined" ? _invoker : undefined)`;
+}
+/**
+* Aggregate every field's create/update hook, default, and validate into
+* type-level scripts.  Hooks compute a single shared timestamp (`now`) per
+* operation, so all fields touched in one create/update observe the same
+* instant.  Defaults are applied after hooks on create only.  Validators
+* run with the same rules on create and update.
+* @param fields - Per-field script configuration
+* @param options - Optional type-level hook/validate expressions
+* @returns Aggregated type-level scripts
+*/
+function buildTypeScripts(fields, options) {
+	const result = {};
+	const typeHookExpr = options?.typeHookExpr;
+	const typeValidateExpr = options?.typeValidateExpr;
+	const hash = computeSourceScriptHash(fields, options);
+	const hashSuffix = hash ? ` ${SOURCE_HASH_PREFIX}${hash}` : "";
+	const hook = {};
+	for (const operation of ["create", "update"]) {
+		const perFieldExpr = buildHookObject(fields, INPUT, OLD_RECORD, operation);
+		const typeLevelExpr = typeHookExpr?.[operation];
+		let expr;
+		if (perFieldExpr !== null && typeLevelExpr) expr = `((_invoker) => { const ${NOW} = new Date(); const __fl = ${perFieldExpr}; return Object.assign({}, __fl, ((${INPUT}) => ${typeLevelExpr})(Object.assign({}, ${INPUT}, __fl))); })(typeof _invoker !== "undefined" ? _invoker : undefined)`;
+		else if (typeLevelExpr) expr = wrapHook(typeLevelExpr);
+		else if (perFieldExpr !== null) expr = wrapHook(perFieldExpr);
+		if (expr) hook[operation] = { expr: expr + hashSuffix };
+	}
+	if (hook.create || hook.update) result.typeHook = hook;
+	const statements = buildValidateStatements(fields, NEW_RECORD, "");
+	if (statements.length > 0 || typeValidateExpr) {
+		const expr = wrapValidate(statements, typeValidateExpr) + hashSuffix;
+		result.typeValidate = {
+			create: { expr },
+			update: { expr }
+		};
+	}
+	return result;
+}
+
 //#endregion
 //#region src/cli/commands/tailordb/migrate/migration-number.ts
 /**
@@ -6341,6 +6331,7 @@ const snapshotFieldConfigSchema = z.looseObject({
 	validate: z.array(snapshotValidationSchema).optional(),
 	serial: snapshotSerialSchema.optional(),
 	scale: z.number().optional(),
+	default: z.unknown().optional(),
 	fields: z.lazy(() => snapshotRecordSchema(snapshotFieldConfigSchema)).optional()
 });
 const snapshotIndexConfigSchema = z.looseObject({
@@ -6586,6 +6577,20 @@ const permissionModifiedChangeSchema = z.looseObject({
 	before: snapshotPermissionStateSchema.optional(),
 	after: snapshotPermissionStateSchema.optional()
 });
+const typeScriptsStateSchema = z.looseObject({
+	typeHookExpr: z.looseObject({
+		create: z.string().optional(),
+		update: z.string().optional()
+	}).optional(),
+	typeValidateExpr: z.string().optional()
+});
+const typeScriptsModifiedChangeSchema = z.looseObject({
+	kind: z.literal("type_scripts_modified"),
+	typeName: z.string(),
+	reason: z.string().optional(),
+	before: typeScriptsStateSchema,
+	after: typeScriptsStateSchema
+});
 const diffChangeSchema = z.discriminatedUnion("kind", [
 	typeAddedChangeSchema,
 	typeRemovedChangeSchema,
@@ -6603,7 +6608,8 @@ const diffChangeSchema = z.discriminatedUnion("kind", [
 	relationshipAddedChangeSchema,
 	relationshipRemovedChangeSchema,
 	relationshipModifiedChangeSchema,
-	permissionModifiedChangeSchema
+	permissionModifiedChangeSchema,
+	typeScriptsModifiedChangeSchema
 ]);
 const breakingChangeInfoSchema = z.looseObject({
 	typeName: z.string(),
@@ -6807,6 +6813,7 @@ function createSnapshotFieldConfigFromOperatorConfig(fieldConfig) {
 		...fieldConfig.serial.format && { format: fieldConfig.serial.format }
 	};
 	if (fieldConfig.scale !== void 0) config.scale = fieldConfig.scale;
+	if (fieldConfig.default !== void 0) config.default = fieldConfig.default;
 	if (fieldConfig.fields && Object.keys(fieldConfig.fields).length > 0) {
 		config.fields = {};
 		for (const [nestedName, nestedConfig] of Object.entries(fieldConfig.fields)) config.fields[nestedName] = createSnapshotFieldConfigFromOperatorConfig(nestedConfig);
@@ -6848,6 +6855,8 @@ function createSnapshotType(type) {
 		};
 	}
 	if (type.files && Object.keys(type.files).length > 0) snapshotType.files = { ...type.files };
+	if (type.typeHookExpr) snapshotType.typeHookExpr = type.typeHookExpr;
+	if (type.typeValidateExpr) snapshotType.typeValidateExpr = type.typeValidateExpr;
 	if (Object.keys(type.forwardRelationships).length > 0) {
 		snapshotType.forwardRelationships = {};
 		for (const [relName, rel] of Object.entries(type.forwardRelationships)) snapshotType.forwardRelationships[relName] = {
@@ -7031,6 +7040,18 @@ function applyDiffToSnapshot(snapshot, diff) {
 			};
 			break;
 		}
+		case "type_scripts_modified": {
+			const existing = types[change.typeName];
+			if (existing) {
+				const { typeHookExpr: _, typeValidateExpr: __, ...rest } = existing;
+				types[change.typeName] = {
+					...rest,
+					...change.after.typeHookExpr && { typeHookExpr: change.after.typeHookExpr },
+					...change.after.typeValidateExpr !== void 0 && { typeValidateExpr: change.after.typeValidateExpr }
+				};
+			}
+			break;
+		}
 		case "field_added":
 		case "field_modified": {
 			const existing = types[change.typeName];
@@ -7255,6 +7276,10 @@ function areFieldsDifferent(oldField, newField) {
 		if ((oldSerial.format ?? "") !== (newSerial.format ?? "")) return true;
 	}
 	if (oldField.scale !== newField.scale) return true;
+	if (oldField.default !== newField.default) {
+		if (typeof oldField.default !== typeof newField.default) return true;
+		if (JSON.stringify(oldField.default) !== JSON.stringify(newField.default)) return true;
+	}
 	const oldFields = oldField.fields ?? {};
 	const newFields = newField.fields ?? {};
 	const oldFieldNames = Object.keys(oldFields);
@@ -7617,6 +7642,24 @@ function compareTypeSettings(ctx, typeName, previous, current) {
 		after: snapshotTypeSettingsState(current)
 	});
 }
+function typeScriptsState(type) {
+	return {
+		...type.typeHookExpr && { typeHookExpr: type.typeHookExpr },
+		...type.typeValidateExpr !== void 0 && { typeValidateExpr: type.typeValidateExpr }
+	};
+}
+function compareTypeScripts(ctx, typeName, previous, current) {
+	const prevState = typeScriptsState(previous);
+	const currState = typeScriptsState(current);
+	if (JSON.stringify(prevState) === JSON.stringify(currState)) return;
+	ctx.changes.push({
+		kind: "type_scripts_modified",
+		typeName,
+		reason: "type-level scripts changed",
+		before: prevState,
+		after: currState
+	});
+}
 /**
 * Compare two snapshots and generate a diff
 * @param {SchemaSnapshot} previous - Previous schema snapshot
@@ -7655,6 +7698,7 @@ function compareNormalizedSnapshots(previous, current) {
 		const prevType = assertDefined(previous.types[typeName], `type "${typeName}" missing from previous snapshot`);
 		const currType = assertDefined(current.types[typeName], `type "${typeName}" missing from current snapshot`);
 		compareTypeSettings(ctx, typeName, prevType, currType);
+		compareTypeScripts(ctx, typeName, prevType, currType);
 		compareTypeFields(ctx, typeName, prevType, currType);
 		compareIndexes(ctx, typeName, prevType.indexes, currType.indexes);
 		compareFiles(ctx, typeName, prevType.files, currType.files);
@@ -8144,7 +8188,66 @@ const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["id"]);
 * @returns {SchemaDrift[]} List of drifts detected
 */
 function compareRemoteWithSnapshot(remoteTypes, snapshot, remoteGqlPermissions = []) {
-	return compareNormalizedRemoteWithSnapshot(createRemoteComparableSnapshot(createSnapshotFromRemoteTypes(remoteTypes, snapshot.namespace, remoteGqlPermissions, snapshot)), createRemoteComparableSnapshot(snapshot));
+	const structuralDrifts = compareNormalizedRemoteWithSnapshot(createRemoteComparableSnapshot(createSnapshotFromRemoteTypes(remoteTypes, snapshot.namespace, remoteGqlPermissions, snapshot)), createRemoteComparableSnapshot(snapshot));
+	const scriptDrifts = compareScriptHashes(remoteTypes, snapshot);
+	return [...structuralDrifts, ...scriptDrifts];
+}
+function extractRemoteScriptHash(remoteType) {
+	const exprs = [
+		remoteType.schema?.typeHook?.create?.expr,
+		remoteType.schema?.typeHook?.update?.expr,
+		remoteType.schema?.typeValidate?.create?.expr,
+		remoteType.schema?.typeValidate?.update?.expr
+	];
+	let found;
+	for (const expr of exprs) if (expr) {
+		const hash = extractSourceScriptHash(expr);
+		if (hash) {
+			if (found && found !== hash) return void 0;
+			found = hash;
+		}
+	}
+	return found;
+}
+function remoteHasScripts(remoteType) {
+	return !!(remoteType.schema?.typeHook?.create?.expr || remoteType.schema?.typeHook?.update?.expr || remoteType.schema?.typeValidate?.create?.expr || remoteType.schema?.typeValidate?.update?.expr);
+}
+function compareScriptHashes(remoteTypes, snapshot) {
+	const drifts = [];
+	const remoteByName = new Map(remoteTypes.map((t) => [t.name, t]));
+	for (const [typeName, snapshotType] of Object.entries(snapshot.types)) {
+		const localHash = computeSourceScriptHash(snapshotType.fields, {
+			typeHookExpr: snapshotType.typeHookExpr,
+			typeValidateExpr: snapshotType.typeValidateExpr
+		});
+		const remoteType = remoteByName.get(typeName);
+		if (!remoteType) continue;
+		if (localHash) {
+			const remoteHash = extractRemoteScriptHash(remoteType);
+			if (localHash !== remoteHash) drifts.push({
+				typeName,
+				kind: "script_mismatch",
+				details: remoteHash ? `Type '${typeName}' scripts differ between remote and snapshot` : `Type '${typeName}' has no script hash on remote`
+			});
+		} else if (remoteHasScripts(remoteType)) drifts.push({
+			typeName,
+			kind: "script_mismatch",
+			details: `Type '${typeName}' has scripts on remote but not in snapshot`
+		});
+	}
+	return drifts;
+}
+function stripFieldScriptProps(field) {
+	const { hooks: _hooks, validate: _validate, default: _default, ...rest } = field;
+	if (rest.fields) {
+		const nested = createSnapshotRecord();
+		for (const [name, f] of Object.entries(rest.fields)) nested[name] = stripFieldScriptProps(f);
+		return {
+			...rest,
+			fields: nested
+		};
+	}
+	return rest;
 }
 function createRemoteComparableSnapshot(snapshot) {
 	const types = createSnapshotRecord();
@@ -8152,10 +8255,11 @@ function createRemoteComparableSnapshot(snapshot) {
 		const fields = createSnapshotRecord();
 		for (const [fieldName, field] of Object.entries(type.fields)) {
 			if (SYSTEM_FIELDS.has(fieldName)) continue;
-			fields[fieldName] = field;
+			fields[fieldName] = stripFieldScriptProps(field);
 		}
+		const { typeHookExpr: _, typeValidateExpr: __, ...typeRest } = type;
 		types[typeName] = {
-			...type,
+			...typeRest,
 			fields
 		};
 	}
@@ -8265,6 +8369,11 @@ function schemaDriftFromDiffChange(change) {
 			kind: "permission_mismatch",
 			details: change.reason ?? "Permissions differ between remote and snapshot"
 		};
+		case "type_scripts_modified": return {
+			typeName: change.typeName,
+			kind: "script_mismatch",
+			details: change.reason ?? "Type-level scripts differ between remote and snapshot"
+		};
 		default: throw new Error("Unsupported diff change");
 	}
 }
@@ -8349,6 +8458,10 @@ function generateTailorDBTypeManifestFromSnapshot(snapshotType, options = {}) {
 		update: [],
 		delete: []
 	};
+	const { typeHook, typeValidate } = buildTypeScripts(snapshotType.fields, {
+		typeHookExpr: snapshotType.typeHookExpr,
+		typeValidateExpr: snapshotType.typeValidateExpr
+	});
 	return {
 		name: snapshotType.name,
 		schema: {
@@ -8360,10 +8473,15 @@ function generateTailorDBTypeManifestFromSnapshot(snapshotType, options = {}) {
 			directives: [],
 			indexes,
 			files,
-			permission
+			permission,
+			...typeHook && { typeHook },
+			...typeValidate && { typeValidate }
 		}
 	};
 }
+function optionalOnCreate(config) {
+	return config.hooks?.create || config.default !== void 0 ? { optionalOnCreate: true } : {};
+}
 /**
 * Convert a snapshot field config to proto format
 * @param {SnapshotFieldConfig} config - Snapshot field config
@@ -8374,7 +8492,6 @@ function convertFieldConfigToProto(config) {
 		type: config.type,
 		allowedValues: config.type === "enum" ? config.allowedValues?.map((v) => ({ ...v })) ?? [] : [],
 		description: config.description || "",
-		validate: toProtoSnapshotFieldValidate(config),
 		array: config.array ?? false,
 		index: config.index ?? false,
 		unique: config.unique ?? false,
@@ -8383,7 +8500,7 @@ function convertFieldConfigToProto(config) {
 		foreignKeyField: config.foreignKeyField,
 		required: config.required,
 		vector: config.vector ?? false,
-		...toProtoSnapshotFieldHooks(config),
+		...optionalOnCreate(config),
 		...config.serial && { serial: {
 			start: BigInt(config.serial.start),
 			...config.serial.maxValue !== void 0 && { maxValue: BigInt(config.serial.maxValue) },
@@ -8394,20 +8511,6 @@ function convertFieldConfigToProto(config) {
 	if (config.type === "nested" && config.fields) fieldEntry.fields = processNestedFieldsFromSnapshot(config.fields);
 	return fieldEntry;
 }
-function toProtoSnapshotFieldValidate(config) {
-	return (config.validate ?? []).map((val) => ({
-		action: TailorDBType_PermitAction.DENY,
-		errorMessage: val.errorMessage || "",
-		script: { expr: val.script && val.script.expr ? `!${val.script.expr}` : "" }
-	}));
-}
-function toProtoSnapshotFieldHooks(config) {
-	if (!config.hooks) return {};
-	return { hooks: {
-		create: config.hooks.create ? { expr: config.hooks.create.expr || "" } : void 0,
-		update: config.hooks.update ? { expr: config.hooks.update.expr || "" } : void 0
-	} };
-}
 /**
 * Process nested fields from snapshot format to proto format
 * @param {Record<string, SnapshotFieldConfig>} fields - Nested fields
@@ -8421,14 +8524,12 @@ function processNestedFieldsFromSnapshot(fields) {
 			type: "nested",
 			allowedValues: fieldConfig.allowedValues?.map((v) => ({ ...v })) ?? [],
 			description: fieldConfig.description || "",
-			validate: toProtoSnapshotFieldValidate(fieldConfig),
 			required: fieldConfig.required,
 			array: fieldConfig.array ?? false,
 			index: false,
 			unique: false,
 			foreignKey: false,
 			vector: false,
-			...toProtoSnapshotFieldHooks(fieldConfig),
 			fields: deepNestedFields,
 			...fieldConfig.scale !== void 0 && { scale: fieldConfig.scale }
 		};
@@ -8436,14 +8537,13 @@ function processNestedFieldsFromSnapshot(fields) {
 		type: fieldConfig.type,
 		allowedValues: fieldConfig.type === "enum" ? fieldConfig.allowedValues?.map((v) => ({ ...v })) ?? [] : [],
 		description: fieldConfig.description || "",
-		validate: toProtoSnapshotFieldValidate(fieldConfig),
 		required: fieldConfig.required,
 		array: fieldConfig.array ?? false,
 		index: false,
 		unique: false,
 		foreignKey: false,
 		vector: false,
-		...toProtoSnapshotFieldHooks(fieldConfig),
+		...optionalOnCreate(fieldConfig),
 		...fieldConfig.serial && { serial: {
 			start: BigInt(fieldConfig.serial.start),
 			...fieldConfig.serial.maxValue !== void 0 && { maxValue: BigInt(fieldConfig.serial.maxValue) },
@@ -9764,14 +9864,6 @@ const migrationSnapshotCache = {
 		return snapshot;
 	}
 };
-/**
-* Build the TailorDBType manifest for `typeName` from migration N's snapshot.
-* @param migration - The pending migration whose snapshot to consult
-* @param typeName - The type name to look up in the snapshot
-* @param tailorDBInputs - Deploy inputs, used to resolve namespace gqlOperations
-* @param executorUsedTypes - Types used by executors (drives publishRecordEvents default)
-* @returns The manifest, or undefined if `typeName` is not in that snapshot.
-*/
 function buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) {
 	const snapshotType = migrationSnapshotCache.load(migration).types[typeName];
 	if (!snapshotType) return void 0;
@@ -10282,18 +10374,28 @@ function normalizeComparableTailorDBType(type) {
 			settings: normalized?.schema?.settings ?? {},
 			indexes: normalized?.schema?.indexes ?? {},
 			files: normalized?.schema?.files ?? {},
-			permission: normalized?.schema?.permission ?? {}
+			permission: normalized?.schema?.permission ?? {},
+			typeHook: normalized?.schema?.typeHook ?? {},
+			typeValidate: normalized?.schema?.typeValidate ?? {}
 		}
 	}, []);
 }
 function normalizeTailorDBCompareValue(value, path) {
 	if (value === void 0 || value === null) return value;
+	if (typeof value === "boolean") {
+		if (path.at(-1) === "optionalOnCreate" && value === false) return;
+		return value;
+	}
 	if (typeof value === "number" || typeof value === "bigint" || typeof value === "string") {
 		if (matchesNumericStringPath(path) && isNumericLikeValue(value)) return String(value);
 		if ((path.at(-1) === "expr" || path.at(-1) === "description") && value === tailordbCompareKnownDefaults.emptyExpression) return;
 		return value;
 	}
-	if (Array.isArray(value)) return value.map((item, index) => normalizeTailorDBCompareValue(item, [...path, index])).filter((item) => item !== void 0);
+	if (Array.isArray(value)) {
+		const items = value.map((item, index) => normalizeTailorDBCompareValue(item, [...path, index])).filter((item) => item !== void 0);
+		if (items.length === 0 && path.at(-1) === "validate") return;
+		return items;
+	}
 	if (!isPlainObject(value)) return value;
 	const normalizedEntries = Object.entries(value).map(([key, entryValue]) => [key, normalizeTailorDBCompareValue(entryValue, [...path, key])]).filter(([, entryValue]) => entryValue !== void 0);
 	const normalizedObject = Object.fromEntries(normalizedEntries);
@@ -10546,11 +10648,11 @@ async function registerJobFunctions(client, changeSet, appName, appId, unchanged
 	const allUsedJobNames = /* @__PURE__ */ new Set();
 	unchangedWorkflowJobNames.forEach((jobName) => allUsedJobNames.add(jobName));
 	for (const item of [...changeSet.creates, ...changeSet.updates]) for (const jobName of item.usedJobNames) allUsedJobNames.add(jobName);
-	const existingJobFunctions = await fetchAll(async (pageToken, _maxPageSize) => {
+	const existingJobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
 		const response = await client.listWorkflowJobFunctions({
 			workspaceId,
 			pageToken,
-			pageSize: 100
+			pageSize: maxPageSize
 		});
 		return [response.jobFunctions.map((j) => j.name), response.nextPageToken];
 	});
@@ -10730,11 +10832,11 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 }
 async function planWorkflowJobFunctionDeletes(params) {
 	const { client, workspaceId, appName, appId, retainedWorkflowJobNames } = params;
-	const existingJobFunctions = await fetchAll(async (pageToken, _maxPageSize) => {
+	const existingJobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
 		const response = await client.listWorkflowJobFunctions({
 			workspaceId,
 			pageToken,
-			pageSize: 100
+			pageSize: maxPageSize
 		});
 		return [response.jobFunctions.map((jobFunction) => jobFunction.name), response.nextPageToken];
 	});
@@ -10814,6 +10916,198 @@ function normalizeRetryPolicyForCompare(policy) {
 	};
 }
 
+//#endregion
+//#region src/cli/commands/deploy/workflow-execution-policy.ts
+function toConcurrencyPolicyInit(policy) {
+	if (!policy) return void 0;
+	return { maxConcurrentExecutions: policy.maxConcurrentExecutions };
+}
+function normalizeComparableConcurrency(policy) {
+	if (!policy || !policy.maxConcurrentExecutions) return void 0;
+	return { maxConcurrentExecutions: policy.maxConcurrentExecutions };
+}
+/**
+* The declared key prefix, regardless of variant. `ExecutionPolicyWildcardInstance`
+* omits `key` from its public type to force callers through `keyFor()`, but
+* the underlying value always carries it when produced by
+* `defineWorkflowExecutionPolicy()` or `defineWorkflowExecutionPolicies()`.
+* @param policy - Declared policy from the config
+* @returns The declared key prefix
+*/
+function declaredKey(policy) {
+	if (policy.matchType === "exact") return policy.key;
+	const key = policy.key;
+	if (typeof key !== "string") throw new Error(`Invalid workflow execution policy "${policy.name}": prefix policies must be created via defineWorkflowExecutionPolicy() or defineWorkflowExecutionPolicies(), not a hand-constructed object.`);
+	return key;
+}
+/**
+* The literal key the platform registers for a declared policy: `key` with a
+* trailing `*` appended when `matchType` is `"prefix"`.
+* @param policy - Declared policy from the config
+* @returns The platform-facing execution policy key
+*/
+function toPlatformExecutionPolicyKey(policy) {
+	const key = declaredKey(policy);
+	return policy.matchType === "prefix" ? `${key}*` : key;
+}
+/**
+* Validate a declared execution policy against the parser schema. Throws with
+* a descriptive error when `name` or the platform-facing key violates the
+* platform grammar.
+* @param policy - Declared policy from the config
+*/
+function validatePolicy(policy) {
+	if (declaredKey(policy).endsWith("*")) throw new Error(`Invalid workflow execution policy "${policy.name}": key must not end with '*'; omit the '*' and set matchType: "prefix" for wildcard policies (the SDK appends '*' automatically).`);
+	const parsed = WorkflowJobFunctionExecutionPolicySchema.safeParse({
+		name: policy.name,
+		key: toPlatformExecutionPolicyKey(policy),
+		concurrencyPolicy: policy.concurrencyPolicy
+	});
+	if (!parsed.success) throw new Error(`Invalid workflow execution policy "${policy.name}": ${parsed.error.issues.map((issue) => issue.message).join("; ")}`);
+}
+/**
+* Plan workflow job function execution policy changes based on desired
+* declarations and current remote state.
+* @param client - Operator client instance
+* @param workspaceId - Workspace ID
+* @param appName - Application name
+* @param appId - Application ID for ownership metadata
+* @param declared - Policies declared in the config (property name → instance)
+* @returns Planned execution policy changes
+*/
+async function planWorkflowJobFunctionExecutionPolicy(client, workspaceId, appName, appId, declared) {
+	const changeSet = createChangeSet("Workflow execution policies");
+	const conflicts = [];
+	const unmanaged = [];
+	const resourceOwners = /* @__PURE__ */ new Set();
+	const declaredList = Object.values(declared);
+	for (const policy of declaredList) validatePolicy(policy);
+	const existing = await fetchExistingResourcesWithLabels({
+		client,
+		fetchPage: async (pageToken, pageSize) => {
+			const response = await client.listWorkflowJobFunctionExecutionPolicies({
+				workspaceId,
+				pageToken,
+				pageSize
+			});
+			return [response.policies, response.nextPageToken];
+		},
+		getName: (resource) => resource.name,
+		getTrn: (name) => resourceTrn(workspaceId, "workflow_job_function_execution_policy", name)
+	});
+	const seenNames = /* @__PURE__ */ new Set();
+	for (const policy of declaredList) {
+		if (seenNames.has(policy.name)) throw new Error(`Duplicate workflow execution policy name "${policy.name}". Each policy must have a unique name within the workspace.`);
+		seenNames.add(policy.name);
+		const metaRequest = await buildMetaRequest({
+			trn: resourceTrn(workspaceId, "workflow_job_function_execution_policy", policy.name),
+			appName,
+			appId
+		});
+		const found = existing[policy.name];
+		if (found) {
+			const owned = trackDesiredResourceOwnership({
+				labels: found.allLabels,
+				ownerLabel: found.label,
+				appName,
+				appId,
+				resourceType: "Workflow execution policy",
+				resourceName: policy.name,
+				conflicts,
+				unmanaged
+			});
+			const remoteKey = found.resource.executionPolicyKey;
+			const desiredKey = toPlatformExecutionPolicyKey(policy);
+			const remoteConcurrency = normalizeComparableConcurrency(found.resource.concurrencyPolicy);
+			const desiredConcurrency = normalizeComparableConcurrency(policy.concurrencyPolicy);
+			if (owned && hasMatchingSdkVersion(found.allLabels, metaRequest.labels) && remoteKey === desiredKey && areNormalizedEqual(remoteConcurrency, desiredConcurrency)) changeSet.unchanged.push({ name: policy.name });
+			else if (remoteKey !== desiredKey) changeSet.replaces.push({
+				name: policy.name,
+				workspaceId,
+				policy,
+				metaRequest
+			});
+			else changeSet.updates.push({
+				name: policy.name,
+				workspaceId,
+				policy,
+				metaRequest
+			});
+			delete existing[policy.name];
+		} else changeSet.creates.push({
+			name: policy.name,
+			workspaceId,
+			policy,
+			metaRequest
+		});
+	}
+	for (const [name, remaining] of Object.entries(existing)) {
+		if (!remaining) continue;
+		if (trackRemainingResourceOwner({
+			labels: remaining.allLabels,
+			ownerLabel: remaining.label,
+			appName,
+			appId,
+			resourceOwners
+		})) changeSet.deletes.push({
+			name,
+			workspaceId
+		});
+	}
+	return {
+		changeSet,
+		conflicts,
+		unmanaged,
+		resourceOwners
+	};
+}
+/**
+* Apply planned workflow execution policy changes for the given phase.
+* @param client - Operator client instance
+* @param plan - Result of `planWorkflowJobFunctionExecutionPolicy`
+* @param phase - Apply phase
+* @returns Promise that resolves when policies are applied
+*/
+async function applyWorkflowJobFunctionExecutionPolicy(client, plan, phase = "create-update") {
+	const { changeSet } = plan;
+	if (phase === "create-update") await Promise.all([
+		...changeSet.replaces.map(async (replace) => {
+			await client.deleteWorkflowJobFunctionExecutionPolicy({
+				workspaceId: replace.workspaceId,
+				executionPolicyName: replace.name
+			});
+			await client.createWorkflowJobFunctionExecutionPolicy({
+				workspaceId: replace.workspaceId,
+				executionPolicyName: replace.policy.name,
+				executionPolicyKey: toPlatformExecutionPolicyKey(replace.policy),
+				concurrencyPolicy: toConcurrencyPolicyInit(replace.policy.concurrencyPolicy)
+			});
+			await client.setMetadata(replace.metaRequest);
+		}),
+		...changeSet.creates.map(async (create) => {
+			await client.createWorkflowJobFunctionExecutionPolicy({
+				workspaceId: create.workspaceId,
+				executionPolicyName: create.policy.name,
+				executionPolicyKey: toPlatformExecutionPolicyKey(create.policy),
+				concurrencyPolicy: toConcurrencyPolicyInit(create.policy.concurrencyPolicy)
+			});
+			await client.setMetadata(create.metaRequest);
+		}),
+		...changeSet.updates.map(async (update) => {
+			await client.updateWorkflowJobFunctionExecutionPolicy({
+				workspaceId: update.workspaceId,
+				executionPolicyName: update.policy.name,
+				concurrencyPolicy: toConcurrencyPolicyInit(update.policy.concurrencyPolicy)
+			});
+			await client.setMetadata(update.metaRequest);
+		})
+	]);
+	else await Promise.all(changeSet.deletes.map((del) => client.deleteWorkflowJobFunctionExecutionPolicy({
+		workspaceId: del.workspaceId,
+		executionPolicyName: del.name
+	})));
+}
+
 //#endregion
 //#region src/cli/commands/deploy/apply-phases.ts
 /**
@@ -10847,10 +11141,12 @@ async function applyDeploymentPlans(client, workspaceId, deployments) {
 	});
 	await withSpan("apply.createUpdateDependentServices", async () => {
 		await forEachDeployment((d) => applyExecutor(client, d.executor, "create-update"));
+		await forEachDeployment((d) => applyWorkflowJobFunctionExecutionPolicy(client, d.workflowExecutionPolicy, "create-update"));
 		await forEachDeployment((d) => applyWorkflow(client, d.workflow, "create-update"));
 	});
 	await withSpan("apply.deleteDependentServices", async () => {
 		await forEachDeployment((d) => applyWorkflow(client, d.workflow, "delete"));
+		await forEachDeployment((d) => applyWorkflowJobFunctionExecutionPolicy(client, d.workflowExecutionPolicy, "delete"));
 		await forEachDeployment((d) => applyExecutor(client, d.executor, "delete"));
 		await forEachDeployment((d) => applyStaticWebsite(client, d.staticWebsite, "delete"));
 		await forEachDeployment((d) => applyAIGateway(client, d.aiGateway, "delete"));
@@ -11159,13 +11455,14 @@ function validateItems(params) {
 *
 * Collections not validated: idp client, tailorDB gqlPermission, functionRegistry — no
 * buf.validate annotations.
-* Application cors and IdP userAuthPolicy.allowedReturnOrigins receive special
-* handling: static-website URL placeholders are resolved at apply time, so the
+* Application cors, AIGateway cors, and IdP userAuthPolicy.allowedReturnOrigins receive
+* special handling: static-website URL placeholders are resolved at apply time, so the
 * relevant origin/URL constraints would false-positive on `<name>:url` entries
-* here. Application cors is dropped entirely (no other constraint to lose); IdP
-* `allowedReturnOrigins` substitutes placeholder entries with a dummy origin so
-* the per-item regex and the cross-field `enable_mfa requires ≥1 origin` rule
-* still get exercised on the rest of the payload.
+* here. Application cors and AIGateway cors are dropped entirely, forgoing their
+* per-item URL/origin constraints for the whole list rather than substituting
+* placeholders; IdP `allowedReturnOrigins` instead substitutes placeholder entries
+* with a dummy origin so the per-item regex and the cross-field `enable_mfa requires
+* ≥1 origin` rule still get exercised on the rest of the payload.
 * Workflow jobFunctions map excluded: versions are registered at apply time (registerJobFunctions)
 * and the map field carries no min_items constraint. Job names are validated separately via
 * CreateWorkflowJobFunctionRequestSchema using usedJobNames from the workflow change set.
@@ -11175,7 +11472,7 @@ function validateItems(params) {
 * @param input - Plan results from the plan phase
 */
 async function validatePlan(input) {
-	const { tailorDB, staticWebsite, idp, auth, pipeline, app, executor, workflow, secretManager } = input;
+	const { tailorDB, staticWebsite, aiGateway, idp, auth, pipeline, app, executor, workflow, workflowExecutionPolicy, secretManager } = input;
 	const validator = createValidator();
 	const violations = [];
 	function creates(schema, kind, items) {
@@ -11228,6 +11525,20 @@ async function validatePlan(input) {
 	creates(CreateStaticWebsiteRequestSchema, "StaticWebsite", staticWebsite.changeSet.creates);
 	updates(UpdateStaticWebsiteRequestSchema, "StaticWebsite", staticWebsite.changeSet.updates);
 	creates(AddCustomDomainRequestSchema, "StaticWebsite custom domain", staticWebsite.customDomainChangeSet.creates);
+	creates(CreateAIGatewayRequestSchema, "AIGateway", aiGateway.changeSet.creates.map((item) => ({
+		name: item.name,
+		request: {
+			...item.request,
+			cors: void 0
+		}
+	})));
+	updates(UpdateAIGatewayRequestSchema, "AIGateway", aiGateway.changeSet.updates.map((item) => ({
+		name: item.name,
+		request: {
+			...item.request,
+			cors: void 0
+		}
+	})));
 	const placeholderOriginReplacement = "https://placeholder.invalid";
 	const substituteIdpReturnOrigins = (item) => {
 		const request = item.request;
@@ -11318,6 +11629,23 @@ async function validatePlan(input) {
 			}
 		})));
 	}
+	creates(CreateWorkflowJobFunctionExecutionPolicyRequestSchema, "Workflow execution policy", [...workflowExecutionPolicy.changeSet.creates, ...workflowExecutionPolicy.changeSet.replaces].map((item) => ({
+		name: item.name,
+		request: {
+			workspaceId: item.workspaceId,
+			executionPolicyName: item.policy.name,
+			executionPolicyKey: toPlatformExecutionPolicyKey(item.policy),
+			...item.policy.concurrencyPolicy && { concurrencyPolicy: { maxConcurrentExecutions: item.policy.concurrencyPolicy.maxConcurrentExecutions } }
+		}
+	})));
+	updates(UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, "Workflow execution policy", workflowExecutionPolicy.changeSet.updates.map((item) => ({
+		name: item.name,
+		request: {
+			workspaceId: item.workspaceId,
+			executionPolicyName: item.policy.name,
+			...item.policy.concurrencyPolicy && { concurrencyPolicy: { maxConcurrentExecutions: item.policy.concurrencyPolicy.maxConcurrentExecutions } }
+		}
+	})));
 	creates(CreateSecretManagerVaultRequestSchema, "Secret Manager vault", secretManager.vaultChangeSet.creates.map((item) => ({
 		name: item.name,
 		request: vaultCreateRequest(item)
@@ -11550,6 +11878,7 @@ function buildPlanReport(results) {
 	const executorEntries = formatExecutorChangeEntries(results.executor.changeSet, buildPlannedExecutorsByName(results.executor.changeSet), results.functionRegistry.executorFunctionChanges);
 	const resolverEntries = formatResolverChangeEntries(results.pipeline.changeSet.resolver, results.functionRegistry.resolverFunctionChanges);
 	const workflowEntries = formatWorkflowChangeEntries(results.workflow.changeSet, results.functionRegistry.workflowJobChanges);
+	const workflowExecutionPolicyEntries = formatChangeSetEntries(results.workflowExecutionPolicy.changeSet, ["executionPolicy"]);
 	const authHookEntries = formatAuthHookChangeEntries(results.auth.changeSet.authHook, results.functionRegistry.authHookFunctionChanges);
 	const tailorDBEntries = [...formatTailorDBResourceChangeEntries(results.tailorDB.changeSet.type, results.tailorDB.changeSet.gqlPermission)];
 	const pipelineEntries = [...resolverEntries];
@@ -11580,6 +11909,7 @@ function buildPlanReport(results) {
 		...pipelineEntries,
 		...executorEntries,
 		...workflowEntries,
+		...workflowExecutionPolicyEntries,
 		...idpEntries,
 		...authEntries
 	];
@@ -11952,7 +12282,7 @@ async function planDeploymentTarget(params) {
 		};
 		const functionRegistry = await withSpan("plan.functionRegistry", () => planFunctionRegistry(client, workspaceId, application.name, application.id, functionEntries));
 		const unchangedWorkflowJobs = new Set(functionRegistry.changeSet.unchanged.filter((entry) => entry.name.startsWith(WORKFLOW_PREFIX)).map((entry) => entry.name.slice(WORKFLOW_PREFIX.length)));
-		const [tailorDB, staticWebsite, aiGateway, idp, auth, pipeline, app, executor, workflow, secretManager] = await Promise.all([
+		const [tailorDB, staticWebsite, aiGateway, idp, auth, pipeline, app, executor, workflow, workflowExecutionPolicy, secretManager] = await Promise.all([
 			withSpan("plan.tailorDB", () => planTailorDB(ctx)),
 			withSpan("plan.staticWebsite", () => planStaticWebsite(ctx)),
 			withSpan("plan.aiGateway", () => planAIGateway(ctx)),
@@ -11962,6 +12292,7 @@ async function planDeploymentTarget(params) {
 			withSpan("plan.application", () => planApplication(ctx, httpAdapterBuildResult)),
 			withSpan("plan.executor", () => planExecutor(ctx)),
 			withSpan("plan.workflow", () => planWorkflow(client, workspaceId, application.name, application.id, workflowService?.workflows ?? {}, workflowBuildResult?.mainJobDeps ?? {}, unchangedWorkflowJobs)),
+			withSpan("plan.workflowExecutionPolicy", () => planWorkflowJobFunctionExecutionPolicy(client, workspaceId, application.name, application.id, config.workflow?.executionPolicies ?? {})),
 			withSpan("plan.secretManager", () => planSecretManager(ctx))
 		]);
 		return {
@@ -11976,6 +12307,7 @@ async function planDeploymentTarget(params) {
 			app,
 			executor,
 			workflow,
+			workflowExecutionPolicy,
 			secretManager
 		};
 	});
@@ -11992,47 +12324,25 @@ function deploymentPlanResults(deployment) {
 	const { application: _application, ...results } = deployment;
 	return results;
 }
+/**
+* Every `PlanResults` entry except `app` carries ownership-tracking fields;
+* deriving the list from `results` itself (instead of naming each key) keeps
+* these collectors in sync with `PlannedDeployment` as resource types are added.
+* @param results - Plan results for a single deployment
+* @returns The ownership-tracking plan entries, `app` excluded
+*/
+function ownershipTrackedPlans(results) {
+	const { app: _app, ...rest } = results;
+	return Object.values(rest);
+}
 function collectOwnerConflicts(results) {
-	return [
-		...results.functionRegistry.conflicts,
-		...results.tailorDB.conflicts,
-		...results.staticWebsite.conflicts,
-		...results.aiGateway.conflicts,
-		...results.idp.conflicts,
-		...results.auth.conflicts,
-		...results.pipeline.conflicts,
-		...results.executor.conflicts,
-		...results.workflow.conflicts,
-		...results.secretManager.conflicts
-	];
+	return ownershipTrackedPlans(results).flatMap((plan) => plan.conflicts);
 }
 function collectUnmanagedResources(results) {
-	return [
-		...results.functionRegistry.unmanaged,
-		...results.tailorDB.unmanaged,
-		...results.staticWebsite.unmanaged,
-		...results.aiGateway.unmanaged,
-		...results.idp.unmanaged,
-		...results.auth.unmanaged,
-		...results.pipeline.unmanaged,
-		...results.executor.unmanaged,
-		...results.workflow.unmanaged,
-		...results.secretManager.unmanaged
-	];
+	return ownershipTrackedPlans(results).flatMap((plan) => plan.unmanaged);
 }
 function collectResourceOwners(results) {
-	return /* @__PURE__ */ new Set([
-		...results.functionRegistry.resourceOwners,
-		...results.tailorDB.resourceOwners,
-		...results.staticWebsite.resourceOwners,
-		...results.aiGateway.resourceOwners,
-		...results.idp.resourceOwners,
-		...results.auth.resourceOwners,
-		...results.pipeline.resourceOwners,
-		...results.executor.resourceOwners,
-		...results.workflow.resourceOwners,
-		...results.secretManager.resourceOwners
-	]);
+	return new Set(ownershipTrackedPlans(results).flatMap((plan) => [...plan.resourceOwners]));
 }
 function collectImportantResourceDeletions(results) {
 	const importantDeletions = [];
@@ -12176,6 +12486,12 @@ const DEPLOY_MANAGED_RESOURCE_DEFINITIONS = [
 		namesOf: (target) => Object.values(target.application.workflowService?.workflows ?? {}).map((workflow) => workflow.name),
 		changeSetOf: (results) => results.workflow.changeSet
 	},
+	{
+		resourceLabel: "Workflow execution policy",
+		resourceType: "workflow_job_function_execution_policy",
+		namesOf: (target) => Object.values(target.config.workflow?.executionPolicies ?? {}).map((policy) => policy.name),
+		changeSetOf: (results) => results.workflowExecutionPolicy.changeSet
+	},
 	{
 		resourceLabel: "Auth connection",
 		resourceType: "auth.connection",
@@ -13723,6 +14039,7 @@ async function resolveApplicationAuthNamespace(options) {
 async function startWorkflowByName(options) {
 	const machineUser = await loadMachineUserName({
 		machineUser: options.machineUser,
+		machineUserSource: options.machineUserSource,
 		profile: options.profile
 	});
 	if (!machineUser) throw new Error("Machine user is required. Specify --machine-user, set TAILOR_PLATFORM_MACHINE_USER_NAME, or set a profile default with 'tailor profile update <profile> --machine-user <name>'.");
@@ -13793,6 +14110,7 @@ const startCommand = defineAppCommand({
 		const { executionId, wait } = await startWorkflowByName({
 			name: args.name,
 			machineUser: args["machine-user"],
+			machineUserSource: resolveMachineUserInputSource(args["machine-user"]),
 			arg: args.arg,
 			workspaceId: args["workspace-id"],
 			profile: args.profile,
@@ -15578,14 +15896,10 @@ const listCommand$7 = defineAppCommand({
 
 //#endregion
 //#region src/cli/commands/machineuser/token.ts
-/**
-* Get a machine user access token for the current application.
-* @param options - Token retrieval options
-* @returns Machine user token info
-*/
-async function getMachineUserToken(options) {
+async function getMachineUserTokenInternal(options) {
 	const name = await loadMachineUserName({
 		machineUser: options.name,
+		machineUserSource: options.nameSource,
 		profile: options.profile
 	});
 	if (!name) throw new Error("Machine user is required. Provide the NAME positional argument, set TAILOR_PLATFORM_MACHINE_USER_NAME, or set a profile default with 'tailor profile update <profile> --machine-user <name>'.");
@@ -15615,6 +15929,14 @@ async function getMachineUserToken(options) {
 		expiresAt: expiresAt.toISOString()
 	};
 }
+/**
+* Get a machine user access token for the current application.
+* @param options - Token retrieval options
+* @returns Machine user token info
+*/
+async function getMachineUserToken(options) {
+	return await getMachineUserTokenInternal(options);
+}
 const tokenCommand = defineAppCommand({
 	name: "token",
 	description: "Get an access token for a machine user.",
@@ -15622,13 +15944,13 @@ const tokenCommand = defineAppCommand({
 		...deploymentArgs,
 		name: arg(z.string().optional(), {
 			positional: true,
-			description: "Machine user name. Falls back to the active profile's default machine user.",
-			env: "TAILOR_PLATFORM_MACHINE_USER_NAME"
+			description: "Machine user name. Falls back to TAILOR_PLATFORM_MACHINE_USER_NAME, then the active profile's default machine user."
 		})
 	}),
 	run: async (args) => {
-		const token = await getMachineUserToken({
+		const token = await getMachineUserTokenInternal({
 			name: args.name,
+			nameSource: resolveMachineUserInputSource(args.name, process.argv.slice(2), { valueIsExplicit: args.name !== void 0 }),
 			workspaceId: args["workspace-id"],
 			profile: args.profile,
 			configPath: args.config
@@ -16298,62 +16620,67 @@ async function execRemove(client, workspaceId, application, config, confirm) {
 		forRemoval: true,
 		config
 	};
-	const tailorDB = await planTailorDB(ctx);
-	const staticWebsite = await planStaticWebsite(ctx);
-	const aiGateway = await planAIGateway(ctx);
-	const idp = await planIdP(ctx);
-	const auth = await planAuth(ctx);
-	const pipeline = await planPipeline(ctx);
-	const app = await planApplication(ctx);
-	const executor = await planExecutor(ctx);
-	const workflow = await planWorkflow(client, workspaceId, application.name, application.id, {}, {});
-	const functionRegistry = await planFunctionRegistry(client, workspaceId, application.name, application.id, []);
-	const secretManager = await planSecretManager(ctx);
+	const plans = {
+		tailorDB: await planTailorDB(ctx),
+		staticWebsite: await planStaticWebsite(ctx),
+		aiGateway: await planAIGateway(ctx),
+		idp: await planIdP(ctx),
+		auth: await planAuth(ctx),
+		pipeline: await planPipeline(ctx),
+		app: await planApplication(ctx),
+		executor: await planExecutor(ctx),
+		workflow: await planWorkflow(client, workspaceId, application.name, application.id, {}, {}),
+		workflowExecutionPolicy: await planWorkflowJobFunctionExecutionPolicy(client, workspaceId, application.name, application.id, {}),
+		functionRegistry: await planFunctionRegistry(client, workspaceId, application.name, application.id, []),
+		secretManager: await planSecretManager(ctx)
+	};
 	const removeLines = [
-		...functionRegistry.changeSet.lines(),
-		...staticWebsite.changeSet.lines(),
-		...aiGateway.changeSet.lines(),
-		...app.lines(),
-		...tailorDB.changeSet.service.lines(),
-		...tailorDB.changeSet.type.lines(),
-		...tailorDB.changeSet.gqlPermission.lines(),
-		...pipeline.changeSet.service.lines(),
-		...pipeline.changeSet.resolver.lines(),
-		...executor.changeSet.lines(),
-		...workflow.changeSet.lines(),
-		...idp.changeSet.service.lines(),
-		...idp.changeSet.client.lines(),
-		...auth.changeSet.service.lines(),
-		...auth.changeSet.idpConfig.lines(),
-		...auth.changeSet.userProfileConfig.lines(),
-		...auth.changeSet.tenantConfig.lines(),
-		...auth.changeSet.machineUser.lines(),
-		...auth.changeSet.oauth2Client.lines(),
-		...auth.changeSet.authHook.lines(),
-		...auth.changeSet.scim.lines(),
-		...auth.changeSet.scimResource.lines(),
-		...auth.changeSet.connection.lines(),
-		...secretManager.vaultChangeSet.lines(),
-		...secretManager.secretChangeSet.lines()
+		...plans.functionRegistry.changeSet.lines(),
+		...plans.staticWebsite.changeSet.lines(),
+		...plans.aiGateway.changeSet.lines(),
+		...plans.app.lines(),
+		...plans.tailorDB.changeSet.service.lines(),
+		...plans.tailorDB.changeSet.type.lines(),
+		...plans.tailorDB.changeSet.gqlPermission.lines(),
+		...plans.pipeline.changeSet.service.lines(),
+		...plans.pipeline.changeSet.resolver.lines(),
+		...plans.executor.changeSet.lines(),
+		...plans.workflow.changeSet.lines(),
+		...plans.workflowExecutionPolicy.changeSet.lines(),
+		...plans.idp.changeSet.service.lines(),
+		...plans.idp.changeSet.client.lines(),
+		...plans.auth.changeSet.service.lines(),
+		...plans.auth.changeSet.idpConfig.lines(),
+		...plans.auth.changeSet.userProfileConfig.lines(),
+		...plans.auth.changeSet.tenantConfig.lines(),
+		...plans.auth.changeSet.machineUser.lines(),
+		...plans.auth.changeSet.oauth2Client.lines(),
+		...plans.auth.changeSet.authHook.lines(),
+		...plans.auth.changeSet.scim.lines(),
+		...plans.auth.changeSet.scimResource.lines(),
+		...plans.auth.changeSet.connection.lines(),
+		...plans.secretManager.vaultChangeSet.lines(),
+		...plans.secretManager.secretChangeSet.lines()
 	];
 	if (removeLines.length > 0) logger.log(removeLines.join("\n"));
-	if (tailorDB.changeSet.service.deletes.length === 0 && staticWebsite.changeSet.deletes.length === 0 && aiGateway.changeSet.deletes.length === 0 && idp.changeSet.service.deletes.length === 0 && auth.changeSet.service.deletes.length === 0 && pipeline.changeSet.service.deletes.length === 0 && app.deletes.length === 0 && executor.changeSet.deletes.length === 0 && workflow.changeSet.deletes.length === 0 && functionRegistry.changeSet.deletes.length === 0 && secretManager.vaultChangeSet.deletes.length === 0 && secretManager.secretChangeSet.deletes.length === 0) return;
+	if (plans.tailorDB.changeSet.service.deletes.length === 0 && plans.staticWebsite.changeSet.deletes.length === 0 && plans.aiGateway.changeSet.deletes.length === 0 && plans.idp.changeSet.service.deletes.length === 0 && plans.auth.changeSet.service.deletes.length === 0 && plans.pipeline.changeSet.service.deletes.length === 0 && plans.app.deletes.length === 0 && plans.executor.changeSet.deletes.length === 0 && plans.workflow.changeSet.deletes.length === 0 && plans.workflowExecutionPolicy.changeSet.deletes.length === 0 && plans.functionRegistry.changeSet.deletes.length === 0 && plans.secretManager.vaultChangeSet.deletes.length === 0 && plans.secretManager.secretChangeSet.deletes.length === 0) return;
 	if (confirm) await confirm();
-	await applyWorkflow(client, workflow, "delete");
-	await applyExecutor(client, executor, "delete");
-	await applyStaticWebsite(client, staticWebsite, "delete");
-	await applyAIGateway(client, aiGateway, "delete");
-	await applyApplication(client, app, "delete");
-	await applyPipeline(client, pipeline, "delete-resources");
-	await applyPipeline(client, pipeline, "delete-services");
-	await applyAuth(client, auth, "delete-resources");
-	await applyAuth(client, auth, "delete-services");
-	await applyIdP(client, idp, "delete-resources");
-	await applyIdP(client, idp, "delete-services");
-	await applyTailorDB(client, tailorDB, "delete-resources");
-	await applyTailorDB(client, tailorDB, "delete-services");
-	await applyFunctionRegistry(client, workspaceId, functionRegistry, "delete");
-	await applySecretManager(client, secretManager, "delete");
+	await applyWorkflow(client, plans.workflow, "delete");
+	await applyWorkflowJobFunctionExecutionPolicy(client, plans.workflowExecutionPolicy, "delete");
+	await applyExecutor(client, plans.executor, "delete");
+	await applyStaticWebsite(client, plans.staticWebsite, "delete");
+	await applyAIGateway(client, plans.aiGateway, "delete");
+	await applyApplication(client, plans.app, "delete");
+	await applyPipeline(client, plans.pipeline, "delete-resources");
+	await applyPipeline(client, plans.pipeline, "delete-services");
+	await applyAuth(client, plans.auth, "delete-resources");
+	await applyAuth(client, plans.auth, "delete-services");
+	await applyIdP(client, plans.idp, "delete-resources");
+	await applyIdP(client, plans.idp, "delete-services");
+	await applyTailorDB(client, plans.tailorDB, "delete-resources");
+	await applyTailorDB(client, plans.tailorDB, "delete-services");
+	await applyFunctionRegistry(client, workspaceId, plans.functionRegistry, "delete");
+	await applySecretManager(client, plans.secretManager, "delete");
 }
 /**
 * Remove all resources managed by the current application.
@@ -16529,10 +16856,27 @@ function applicationInfo(app) {
 		updatedAt: app.updateTime ? timestampDate(app.updateTime) : null
 	};
 }
+async function fetchAIGateways(client, workspaceId, names) {
+	return (await Promise.all(names.map(async (name) => {
+		try {
+			const { aigateway } = await client.getAIGateway({
+				workspaceId,
+				aigatewayName: name
+			});
+			return aigateway ? {
+				name: aigateway.name,
+				url: aigateway.url
+			} : void 0;
+		} catch (error) {
+			if (error instanceof ConnectError && error.code === Code.NotFound) return;
+			throw error;
+		}
+	}))).filter((gateway) => gateway !== void 0);
+}
 /**
 * Show applied application information for the current workspace.
 * @param options - Show options
-* @returns Application information
+* @returns Deployed application, workspace, and AI Gateway information
 */
 async function show(options) {
 	const client = await initOperatorClient(await loadAccessToken({ profile: options?.profile }));
@@ -16541,10 +16885,15 @@ async function show(options) {
 		profile: options?.profile
 	});
 	const { config } = await loadConfig(options?.configPath);
-	const [workspaceResp, resp] = await Promise.all([client.getWorkspace({ workspaceId }), client.getApplication({
-		workspaceId,
-		applicationName: config.name
-	})]);
+	const aiGatewayNames = config.aiGateways?.length ? [...new Set(config.aiGateways.map((gateway) => gateway.name))] : [];
+	const [workspaceResp, resp, aiGateways] = await Promise.all([
+		client.getWorkspace({ workspaceId }),
+		client.getApplication({
+			workspaceId,
+			applicationName: config.name
+		}),
+		fetchAIGateways(client, workspaceId, aiGatewayNames)
+	]);
 	const { name, ...appInfo } = applicationInfo(assertDefined(resp.application, `application "${config.name}" not found in workspace`));
 	const workspace = workspaceResp.workspace;
 	const workspaceFolderName = workspace ? await resolveWorkspaceFolderName(client, workspace) : "";
@@ -16554,7 +16903,8 @@ async function show(options) {
 		workspaceName: workspace?.name ?? "",
 		...workspaceFolderName ? { workspaceFolderName } : {},
 		workspaceRegion: workspace?.region ?? "",
-		...appInfo
+		...appInfo,
+		aiGateways
 	};
 }
 const showWorkspaceNameTransformer = createWorkspaceNameTransformer("workspaceName", "workspaceFolderName");
@@ -17181,7 +17531,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-D2hSK1ZL.mjs");
+	const { defineApplication } = await import("./application-CUkjzfij.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -18869,7 +19219,8 @@ const queryBaseOptionsSchema = z.object({
 	profile: z.string().optional(),
 	configPath: z.string().optional(),
 	engine: queryEngineSchema,
-	machineUser: z.string().optional()
+	machineUser: z.string().optional(),
+	machineUserSource: z.enum(["option", "env"]).optional()
 });
 const queryOptionsSchema = queryBaseOptionsSchema.extend({ query: z.string() });
 async function getNamespaceFromSqlQuery(workspaceId, query, client, namespaces) {
@@ -18894,6 +19245,7 @@ async function loadOptions(options) {
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "validation error missing issues").message);
 	const machineUser = await loadMachineUserName({
 		machineUser: result.data.machineUser,
+		machineUserSource: result.data.machineUserSource,
 		profile: result.data.profile
 	});
 	if (!machineUser) throw new Error("Machine user is required. Specify --machine-user, set TAILOR_PLATFORM_MACHINE_USER_NAME, or set a profile default with 'tailor profile update <profile> --machine-user <name>'.");
@@ -19313,7 +19665,8 @@ const queryCommand = defineAppCommand({
 			profile: args.profile,
 			configPath: args.config,
 			engine: args.engine,
-			machineUser: args["machine-user"]
+			machineUser: args["machine-user"],
+			machineUserSource: resolveMachineUserInputSource(args["machine-user"])
 		};
 		if (mode.mode === "abort") {
 			logger.info("Editor closed without a query. Nothing was executed.");
@@ -19456,5 +19809,5 @@ async function registerTsHook(tsHookUrl) {
 }
 
 //#endregion
-export { getOrganization as $, compareSnapshotWithRemote as $t, listCommand$3 as A, apiCommand as An, getExecutorWaitFailureMessage as At, show as B, pagedLogArgs as Bn, listWorkflowExecutions as Bt, listCommand$2 as C, hasChanges as Cn, listWebhookExecutors as Ct, waitWorkflowExecution as D, PluginManager as Dn, listCommand$9 as Dt, waitCommand as E, sdkNameLabelKey as En, triggerExecutor as Et, generateCommand as F, configArg as Fn, startWorkflow as Ft, removeCommand$1 as G, deploy as Gt, extractOwnedNamespaces as H, toPageDirection as Hn, formatKeyValueTable as Ht, generateMigrationScript as I, confirmationArgs as In, getCommand$5 as It, organizationTree as J, waitForExecution as Jt, updateCommand$1 as K, ensureConfigId as Kt, writeDbTypesFile as L, deploymentArgs as Ln, getWorkflow as Lt, truncate as M, assertWritable as Mn, listExecutorJobs as Mt, truncateCommand as N, defineAppCommand as Nn, watchExecutorJob as Nt, resumeCommand as O, generateUserTypes as On, listExecutors as Ot, generate as P, commonArgs as Pn, startCommand as Pt, getCommand$1 as Q, parseMigrationLabelNumber as Qt, getConfiguredEditorCommand as R, isVerbose as Rn, executionsCommand as Rt, listApps as S, formatMigrationDiff as Sn, getFunctionRegistry as St, healthCommand as T, resourceTrn as Tn, triggerCommand as Tt, logBetaWarning as U, workspaceArgs as Un, getCommand$6 as Ut, showCommand as V, paginationArgs as Vn, functionExecutionStatusToString as Vt, remove as W, getExecutor as Wt, listCommand$4 as X, MIGRATION_LABEL_KEY as Xt, treeCommand as Y, bundleMigrationScript as Yt, listOrganizations as Z, handleOptionalToRequiredError as Zt, getWorkspace as _, loadDiff as _n, listMachineUsers as _t, updateUser as a, MIGRATE_FILE_NAME as an, getFolder as at, createCommand as b, parseMigrationNumberArg as bn, listFunctionRegistries as bt, listCommand as c, compareLocalTypesWithSnapshot as cn, createCommand$1 as ct, inviteUser as d, getLatestMigrationNumber as dn, listOAuth2Clients as dt, generateAllTypeManifestsFromSnapshot as en, updateCommand$2 as et, restoreCommand as f, getMigrationDirPath as fn, getCommand$3 as ft, getCommand as g, isValidMigrationNumber as gn, listCommand$7 as gt, listWorkspaces as h, getNextMigrationNumber as hn, tokenCommand as ht, updateCommand as i, INITIAL_SCHEMA_NUMBER as in, getCommand$2 as it, listWorkflows as j, apiCall as jn, jobsCommand as jt, resumeWorkflow as k, prompt as kn, getExecutorJob as kt, listUsers as l, compareSnapshots as ln, createFolder as lt, listCommand$1 as m, getMigrationFiles as mn, getMachineUserToken as mt, query as n, DB_TYPES_FILE_NAME as nn, listCommand$5 as nt, removeCommand as o, SCHEMA_FILE_NAME as on, deleteCommand$1 as ot, restoreWorkspace as p, getMigrationFilePath as pn, getOAuth2Client as pt, updateOrganization as q, executeScript as qt, queryCommand as r, DIFF_FILE_NAME as rn, listFolders as rt, removeUser as s, assertValidMigrationFiles as sn, deleteFolder as st, registerTsHook as t, protoGqlPermission as tn, updateFolder as tt, inviteCommand as u, createSnapshotFromLocalTypes as un, listCommand$6 as ut, deleteCommand as v, reconstructSnapshotFromMigrations as vn, generate$1 as vt, getAppHealth as w, getNamespacesWithMigrations as wn, webhookCommand as wt, createWorkspace as x, formatDiffSummary as xn, getCommand$4 as xt, deleteWorkspace as y, formatMigrationNumber as yn, listCommand$8 as yt, openInConfiguredEditor as z, multiConfigArg as zn, getWorkflowExecution as zt };
-//# sourceMappingURL=register-ts-hook-ZpBacA07.mjs.map
+export { getOrganization as $, compareSnapshotWithRemote as $t, listCommand$3 as A, apiCommand as An, getExecutorWaitFailureMessage as At, show as B, listWorkflowExecutions as Bt, listCommand$2 as C, hasChanges as Cn, listWebhookExecutors as Ct, waitWorkflowExecution as D, PluginManager as Dn, listCommand$9 as Dt, waitCommand as E, sdkNameLabelKey as En, triggerExecutor as Et, generateCommand as F, startWorkflow as Ft, removeCommand$1 as G, deploy as Gt, extractOwnedNamespaces as H, formatKeyValueTable as Ht, generateMigrationScript as I, getCommand$5 as It, organizationTree as J, waitForExecution as Jt, updateCommand$1 as K, ensureConfigId as Kt, writeDbTypesFile as L, getWorkflow as Lt, truncate as M, assertWritable as Mn, listExecutorJobs as Mt, truncateCommand as N, defineAppCommand as Nn, watchExecutorJob as Nt, resumeCommand as O, generateUserTypes as On, listExecutors as Ot, generate as P, startCommand as Pt, getCommand$1 as Q, parseMigrationLabelNumber as Qt, getConfiguredEditorCommand as R, executionsCommand as Rt, listApps as S, formatMigrationDiff as Sn, getFunctionRegistry as St, healthCommand as T, resourceTrn as Tn, triggerCommand as Tt, logBetaWarning as U, getCommand$6 as Ut, showCommand as V, functionExecutionStatusToString as Vt, remove as W, getExecutor as Wt, listCommand$4 as X, MIGRATION_LABEL_KEY as Xt, treeCommand as Y, bundleMigrationScript as Yt, listOrganizations as Z, handleOptionalToRequiredError as Zt, getWorkspace as _, loadDiff as _n, listMachineUsers as _t, updateUser as a, MIGRATE_FILE_NAME as an, getFolder as at, createCommand as b, parseMigrationNumberArg as bn, listFunctionRegistries as bt, listCommand as c, compareLocalTypesWithSnapshot as cn, createCommand$1 as ct, inviteUser as d, getLatestMigrationNumber as dn, listOAuth2Clients as dt, generateAllTypeManifestsFromSnapshot as en, updateCommand$2 as et, restoreCommand as f, getMigrationDirPath as fn, getCommand$3 as ft, getCommand as g, isValidMigrationNumber as gn, listCommand$7 as gt, listWorkspaces as h, getNextMigrationNumber as hn, tokenCommand as ht, updateCommand as i, INITIAL_SCHEMA_NUMBER as in, getCommand$2 as it, listWorkflows as j, apiCall as jn, jobsCommand as jt, resumeWorkflow as k, prompt as kn, getExecutorJob as kt, listUsers as l, compareSnapshots as ln, createFolder as lt, listCommand$1 as m, getMigrationFiles as mn, getMachineUserToken as mt, query as n, DB_TYPES_FILE_NAME as nn, listCommand$5 as nt, removeCommand as o, SCHEMA_FILE_NAME as on, deleteCommand$1 as ot, restoreWorkspace as p, getMigrationFilePath as pn, getOAuth2Client as pt, updateOrganization as q, executeScript as qt, queryCommand as r, DIFF_FILE_NAME as rn, listFolders as rt, removeUser as s, assertValidMigrationFiles as sn, deleteFolder as st, registerTsHook as t, protoGqlPermission as tn, updateFolder as tt, inviteCommand as u, createSnapshotFromLocalTypes as un, listCommand$6 as ut, deleteCommand as v, reconstructSnapshotFromMigrations as vn, generate$1 as vt, getAppHealth as w, getNamespacesWithMigrations as wn, webhookCommand as wt, createWorkspace as x, formatDiffSummary as xn, getCommand$4 as xt, deleteWorkspace as y, formatMigrationNumber as yn, listCommand$8 as yt, openInConfiguredEditor as z, getWorkflowExecution as zt };
+//# sourceMappingURL=register-ts-hook-BhzVkej0.mjs.map