@tailor-platform/sdk 2.0.0-next.4 → 2.0.0-next.5

package/dist/{register-ts-hook-BM1caLT0.mjs → register-ts-hook-BhzVkej0.mjs}

@@ -1,14 +1,14 @@
-import { t as db } from "./schema-C4LYbXVG.mjs";
+import { t as db } from "./schema-iCd1ugGp.mjs";
 import { i as PageDirection, n as Condition_Operator, r as FilterSchema, t as ConditionSchema } from "./resource_pb-BRv7AMXK.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
 import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-BEiZZ3qT.mjs";
-import { B as readPlatformConfig, C as createBundleCache, Ct as positiveIntArg, D as loadConfig, E as hashFile, Et as workspaceArgs, F as loadMachineUserName, G as writePlatformConfig, H as resolveConfigUser, I as loadPlatformClientConfig, J as fetchAll, M as loadAccessToken, N as loadConfigPath, R as loadWorkspaceId, S as hasGenerationHooks, St as parseDuration, T as hashContent, Tt as toPageDirection, X as fetchMachineUserToken, Y as fetchAllTolerant, Z as fetchPaged, _ as platformBundleDefinePlugin, _t as nonNegativeIntArg, at as initOperatorClient, bt as pagedLogArgs, ct as byName, dt as confirmationArgs, et as getConsoleBaseUrl, f as buildExecutorArgsExpr, ft as deploymentArgs, g as stringifyFunction, h as assertUniqueTailorDBTypeNamesWithExternal, i as resolverBundleKey, m as assertUniqueLocalTailorDBTypeNames, mt as folderArgs, n as generatePluginFilesIfNeeded, nt as getOrNull, o as getApplicationAuthNamespace, ot as isDefaultPlatform, p as buildResolverOperationHookExpr, pt as durationArg, r as loadApplication, rt as getPlatformBaseUrl, s as WorkflowJobFunctionExecutionPolicySchema, st as resolveStaticWebsiteUrls, t as defineApplication, tt as getOAuth2ClientId, u as HTTP_METHODS, ut as configArg, vt as orderArg, w as getDistDir, wt as resolveMachineUserInputSource, x as getPluginGenerationDependencies, xt as paginationArgs, yt as organizationArgs, z as platformConfigFromProfile } from "./application-BX13RArL.mjs";
-import { c as stripTailorDBTypeBuilderHelpers, h as loadFilesWithIgnores, t as createExecutorService, u as TailorDBTypeSchema } from "./service-ufH7sS8o.mjs";
+import { B as readPlatformConfig, C as createBundleCache, Ct as positiveIntArg, D as loadConfig, E as hashFile, Et as workspaceArgs, F as loadMachineUserName, G as writePlatformConfig, H as resolveConfigUser, I as loadPlatformClientConfig, J as fetchAll, M as loadAccessToken, N as loadConfigPath, R as loadWorkspaceId, S as hasGenerationHooks, St as parseDuration, T as hashContent, Tt as toPageDirection, X as fetchMachineUserToken, Y as fetchAllTolerant, Z as fetchPaged, _ as platformBundleDefinePlugin, _t as nonNegativeIntArg, at as initOperatorClient, bt as pagedLogArgs, ct as byName, dt as confirmationArgs, et as getConsoleBaseUrl, f as buildExecutorArgsExpr, ft as deploymentArgs, g as stringifyFunction, h as assertUniqueTailorDBTypeNamesWithExternal, i as resolverBundleKey, m as assertUniqueLocalTailorDBTypeNames, mt as folderArgs, n as generatePluginFilesIfNeeded, nt as getOrNull, o as getApplicationAuthNamespace, ot as isDefaultPlatform, p as buildResolverOperationHookExpr, pt as durationArg, r as loadApplication, rt as getPlatformBaseUrl, s as WorkflowJobFunctionExecutionPolicySchema, st as resolveStaticWebsiteUrls, t as defineApplication, tt as getOAuth2ClientId, u as HTTP_METHODS, ut as configArg, vt as orderArg, w as getDistDir, wt as resolveMachineUserInputSource, x as getPluginGenerationDependencies, xt as paginationArgs, yt as organizationArgs, z as platformConfigFromProfile } from "./application-Bf8wxOi6.mjs";
+import { c as stripTailorDBTypeBuilderHelpers, h as loadFilesWithIgnores, t as createExecutorService, u as TailorDBTypeSchema } from "./service-CzZEVrp9.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "./package-json-8b0O9TlX.mjs";
 import { i as userAgent } from "./secret-file-aoNXJmKa.mjs";
 import { n as isCLIError, t as createCLIError } from "./errors-118wUDRr.mjs";
-import { $ as CreateAuthServiceRequestSchema, A as CreatePipelineServiceRequestSchema, At as Subgraph_ServiceType, C as CreateStaticWebsiteRequestSchema, D as CreateSecretManagerVaultRequestSchema, Dt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, E as CreateSecretManagerSecretRequestSchema, Et as CreateApplicationRequestSchema, F as UpdateIdPServiceRequestSchema, G as ExecutorTriggerType, H as UpdateExecutorExecutorRequestSchema, I as IdPLang, J as CreateAuthIDPConfigRequestSchema, K as CreateAuthConnectionRequestSchema, L as IdPPermissionOperator, M as UpdatePipelineServiceRequestSchema, N as PipelineResolver_OperationType, O as UpdateSecretManagerSecretRequestSchema, Ot as UpdateApplicationRequestSchema, P as CreateIdPServiceRequestSchema, Q as CreateAuthSCIMResourceRequestSchema, R as IdPPermissionPermit, S as AddCustomDomainRequestSchema, St as AuthSCIMConfig_AuthorizationType, Tt as UserProfileProviderConfig_UserProfileProviderType, U as ExecutorJobStatus, V as CreateExecutorExecutorRequestSchema, W as ExecutorTargetType, X as CreateAuthOAuth2ClientRequestSchema, Y as CreateAuthMachineUserRequestSchema, Z as CreateAuthSCIMConfigRequestSchema, _ as TailorDBGQLPermission_Operator, _t as AuthOAuth2Client_ClientType, a as WorkspacePlatformUserRole, at as UpdateAuthMachineUserRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthSCIMAttribute_Type, c as CreateWorkflowRequestSchema, ct as UpdateAuthSCIMResourceRequestSchema, d as WorkflowExecution_Status, dt as UpdateUserProfileConfigRequestSchema, et as CreateTenantConfigRequestSchema, f as WorkflowJobExecution_Status, ft as AuthConnection_Status, g as TailorDBGQLPermission_Action, gt as AuthInvokerSchema, h as UpdateTailorDBTypeRequestSchema, ht as AuthIDPConfig_AuthType, it as UpdateAuthIDPConfigRequestSchema, j as UpdatePipelineResolverRequestSchema, k as CreatePipelineResolverRequestSchema, kt as ApplicationSchemaUpdateAttemptStatus, l as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, lt as UpdateAuthServiceRequestSchema, m as CreateTailorDBTypeRequestSchema, mt as AuthHookPoint, nt as UpdateAuthConnectionRequestSchema, o as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as UpdateAuthOAuth2ClientRequestSchema, p as CreateTailorDBServiceRequestSchema, pt as AuthConnection_Type, q as CreateAuthHookRequestSchema, rt as UpdateAuthHookRequestSchema, s as CreateWorkflowJobFunctionRequestSchema, st as UpdateAuthSCIMConfigRequestSchema, t as OperatorService, tt as CreateUserProfileConfigRequestSchema, u as UpdateWorkflowRequestSchema, ut as UpdateTenantConfigRequestSchema, v as TailorDBGQLPermission_Permit, vt as AuthOAuth2Client_GrantType, w as UpdateStaticWebsiteRequestSchema, wt as TenantProviderConfig_TenantProviderType, x as TailorDBType_PermitAction, xt as AuthSCIMAttribute_Uniqueness, y as TailorDBType_Permission_Operator, yt as AuthSCIMAttribute_Mutability, z as FunctionExecution_Status } from "./service_pb-B5w9rjPY.mjs";
+import { $ as CreateAuthServiceRequestSchema, A as CreatePipelineServiceRequestSchema, At as Subgraph_ServiceType, C as CreateStaticWebsiteRequestSchema, D as CreateSecretManagerVaultRequestSchema, Dt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, E as CreateSecretManagerSecretRequestSchema, Et as CreateApplicationRequestSchema, F as UpdateIdPServiceRequestSchema, G as ExecutorTriggerType, H as UpdateExecutorExecutorRequestSchema, I as IdPLang, J as CreateAuthIDPConfigRequestSchema, K as CreateAuthConnectionRequestSchema, L as IdPPermissionOperator, M as UpdatePipelineServiceRequestSchema, Mt as UpdateAIGatewayRequestSchema, N as PipelineResolver_OperationType, O as UpdateSecretManagerSecretRequestSchema, Ot as UpdateApplicationRequestSchema, P as CreateIdPServiceRequestSchema, Q as CreateAuthSCIMResourceRequestSchema, R as IdPPermissionPermit, S as AddCustomDomainRequestSchema, St as AuthSCIMConfig_AuthorizationType, Tt as UserProfileProviderConfig_UserProfileProviderType, U as ExecutorJobStatus, V as CreateExecutorExecutorRequestSchema, W as ExecutorTargetType, X as CreateAuthOAuth2ClientRequestSchema, Y as CreateAuthMachineUserRequestSchema, Z as CreateAuthSCIMConfigRequestSchema, _ as TailorDBGQLPermission_Operator, _t as AuthOAuth2Client_ClientType, a as WorkspacePlatformUserRole, at as UpdateAuthMachineUserRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthSCIMAttribute_Type, c as CreateWorkflowRequestSchema, ct as UpdateAuthSCIMResourceRequestSchema, d as WorkflowExecution_Status, dt as UpdateUserProfileConfigRequestSchema, et as CreateTenantConfigRequestSchema, f as WorkflowJobExecution_Status, ft as AuthConnection_Status, g as TailorDBGQLPermission_Action, gt as AuthInvokerSchema, h as UpdateTailorDBTypeRequestSchema, ht as AuthIDPConfig_AuthType, it as UpdateAuthIDPConfigRequestSchema, j as UpdatePipelineResolverRequestSchema, jt as CreateAIGatewayRequestSchema, k as CreatePipelineResolverRequestSchema, kt as ApplicationSchemaUpdateAttemptStatus, l as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, lt as UpdateAuthServiceRequestSchema, m as CreateTailorDBTypeRequestSchema, mt as AuthHookPoint, nt as UpdateAuthConnectionRequestSchema, o as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as UpdateAuthOAuth2ClientRequestSchema, p as CreateTailorDBServiceRequestSchema, pt as AuthConnection_Type, q as CreateAuthHookRequestSchema, rt as UpdateAuthHookRequestSchema, s as CreateWorkflowJobFunctionRequestSchema, st as UpdateAuthSCIMConfigRequestSchema, t as OperatorService, tt as CreateUserProfileConfigRequestSchema, u as UpdateWorkflowRequestSchema, ut as UpdateTenantConfigRequestSchema, v as TailorDBGQLPermission_Permit, vt as AuthOAuth2Client_GrantType, w as UpdateStaticWebsiteRequestSchema, wt as TenantProviderConfig_TenantProviderType, x as TailorDBType_PermitAction, xt as AuthSCIMAttribute_Uniqueness, y as TailorDBType_Permission_Operator, yt as AuthSCIMAttribute_Mutability, z as FunctionExecution_Status } from "./service_pb-Bk7dL-yT.mjs";
 import { r as withSpan } from "./telemetry-BRVdwh14.mjs";
 import * as mod from "node:module";
 import * as path from "pathe";
@@ -17,7 +17,7 @@ import { arg, createDefineCommand, defineCommand, runCommand } from "politty";
 import { z } from "zod";
 import { ScalarType, create, fromJson, toJson } from "@bufbuild/protobuf";
 import * as fs$1 from "node:fs";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { ValueSchema, timestampDate } from "@bufbuild/protobuf/wkt";
 import { formatDistanceToNowStrict } from "date-fns";
 import { getBorderCharacters, table } from "table";
@@ -2297,35 +2297,59 @@ const SecretsStateSchema = z.object({
 	vaults: z.record(z.string(), z.record(z.string(), z.string())),
 	connections: z.record(z.string(), z.string()).optional()
 });
+const PersistedSecretsStateSchema = z.object({
+	version: z.literal(1),
+	workspaceId: z.string(),
+	applicationKey: z.string(),
+	state: SecretsStateSchema
+});
 /**
-* Get the file path for the secrets state JSON.
-* @returns Absolute path to secrets-state.json
+* Get the file path for one workspace and application's secrets state JSON.
+* @param scope - Workspace and application identity for the deployment
+* @returns Absolute path to the scoped state file
 */
-function getSecretsStatePath() {
-	return path.join(getDistDir(), "secrets-state.json");
+function getSecretsStatePath(scope) {
+	const scopeHash = hashValue(JSON.stringify([scope.workspaceId, applicationStateKey(scope)]));
+	return path.join(getDistDir(), "secrets-state", `${scopeHash}.json`);
 }
-/**
-* Load secrets hash state from disk.
-* @returns Persisted state, or empty state if file is missing or corrupted
-*/
-function loadSecretsState() {
-	const filePath = getSecretsStatePath();
-	if (!existsSync(filePath)) return { vaults: {} };
+function loadPersistedSecretsState(scope) {
 	try {
-		const raw = readFileSync(filePath, "utf-8");
-		return SecretsStateSchema.parse(JSON.parse(raw));
+		const raw = readFileSync(getSecretsStatePath(scope), "utf-8");
+		const persistedState = PersistedSecretsStateSchema.parse(JSON.parse(raw));
+		if (persistedState.workspaceId !== scope.workspaceId || persistedState.applicationKey !== applicationStateKey(scope)) return;
+		return persistedState;
 	} catch {
-		return { vaults: {} };
+		return;
 	}
 }
+function applicationStateKey(scope) {
+	if (!scope.applicationId) throw new Error(`Application "${scope.applicationName}" has no stable id for secrets state`);
+	return `id:${scope.applicationId}`;
+}
 /**
-* Save secrets hash state to disk.
+* Load secrets hash state for one workspace and application from disk.
+* @param scope - Workspace and application identity for the deployment
+* @returns Persisted state, or empty state if the scope is missing or the file is invalid
+*/
+function loadSecretsState(scope) {
+	if (!scope.applicationId) return { vaults: {} };
+	return loadPersistedSecretsState(scope)?.state ?? { vaults: {} };
+}
+/**
+* Save secrets hash state for one workspace and application to disk.
+* @param scope - Workspace and application identity for the deployment
 * @param state - The secrets state to persist
 */
-function saveSecretsState(state) {
-	const filePath = getSecretsStatePath();
+function saveSecretsState(scope, state) {
+	if (!scope.applicationId) return;
+	const filePath = getSecretsStatePath(scope);
 	mkdirSync(path.dirname(filePath), { recursive: true });
-	writeFileSync(filePath, JSON.stringify(state, null, 2), "utf-8");
+	writeFileSync(filePath, JSON.stringify({
+		version: 1,
+		workspaceId: scope.workspaceId,
+		applicationKey: applicationStateKey(scope),
+		state
+	}, null, 2), "utf-8");
 }
 /**
 * Compute SHA-256 hex digest of a value.
@@ -2391,6 +2415,11 @@ function buildUpdateMask(existing, desired, secretChanged) {
 * @returns Planned changes for auth connections
 */
 async function planAuthConnections(client, workspaceId, appName, appId, auths) {
+	const stateScope = {
+		workspaceId,
+		applicationId: appId,
+		applicationName: appName
+	};
 	const changeSet = createChangeSet("Auth connections");
 	const conflicts = [];
 	const unmanaged = [];
@@ -2414,7 +2443,7 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 			allLabels: metadata?.labels
 		};
 	}));
-	const state = loadSecretsState();
+	const state = loadSecretsState(stateScope);
 	for (const [name, config] of Object.entries(desiredConnections)) {
 		const existing = existingConnections[name];
 		const metaRequest = await buildMetaRequest({
@@ -2475,7 +2504,8 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 		changeSet,
 		conflicts,
 		unmanaged,
-		resourceOwners
+		resourceOwners,
+		stateScope
 	};
 }
 /**
@@ -2485,7 +2515,7 @@ async function planAuthConnections(client, workspaceId, appName, appId, auths) {
 * @param phase - Apply phase
 */
 async function applyAuthConnections(client, result, phase) {
-	const { changeSet } = result;
+	const { changeSet, stateScope } = result;
 	if (phase === "create-update") {
 		await Promise.all(changeSet.creates.map(async (create) => {
 			await client.createAuthConnection(create.request);
@@ -2499,26 +2529,29 @@ async function applyAuthConnections(client, result, phase) {
 		await Promise.all(changeSet.updates.map(async (update) => {
 			await client.setMetadata(update.metaRequest);
 		}));
-		const state = loadSecretsState();
-		if (!state.connections) state.connections = {};
-		for (const create of changeSet.creates) {
-			const conn = create.request.connection;
-			if (conn?.config?.case === "oauth2") state.connections[create.name] = hashValue(conn.config.value.clientSecret ?? "");
-		}
-		for (const replace of changeSet.replaces) {
-			const conn = replace.updateRequest.connection;
-			if (conn?.config?.case === "oauth2" && replace.updateRequest.updateMask?.paths?.includes("oauth2.client_secret")) state.connections[replace.name] = hashValue(conn.config.value.clientSecret ?? "");
+		const secretReplaces = changeSet.replaces.filter((replace) => replace.updateRequest.updateMask?.paths?.includes("oauth2.client_secret"));
+		if (changeSet.creates.length > 0 || secretReplaces.length > 0) {
+			const state = loadSecretsState(stateScope);
+			if (!state.connections) state.connections = {};
+			for (const create of changeSet.creates) {
+				const conn = create.request.connection;
+				if (conn?.config?.case === "oauth2") state.connections[create.name] = hashValue(conn.config.value.clientSecret ?? "");
+			}
+			for (const replace of secretReplaces) {
+				const conn = replace.updateRequest.connection;
+				if (conn?.config?.case === "oauth2") state.connections[replace.name] = hashValue(conn.config.value.clientSecret ?? "");
+			}
+			saveSecretsState(stateScope, state);
 		}
-		saveSecretsState(state);
 	} else {
 		await Promise.all(changeSet.deletes.map(async (del) => {
 			await client.deleteAuthConnection(del.request);
 		}));
 		if (changeSet.deletes.length > 0) {
-			const state = loadSecretsState();
+			const state = loadSecretsState(stateScope);
 			if (state.connections) {
 				for (const del of changeSet.deletes) delete state.connections[del.name];
-				saveSecretsState(state);
+				saveSecretsState(stateScope, state);
 			}
 		}
 	}
@@ -3681,7 +3714,10 @@ async function applyAuth(client, result, phase = "create-update") {
 		await Promise.all([...changeSet.machineUser.creates.map((create) => client.createAuthMachineUser(create.request)), ...changeSet.machineUser.updates.map((update) => client.updateAuthMachineUser(update.request))]);
 	};
 	const applyCreateUpdateDependents = async () => {
-		await applyAuthConnections(client, { changeSet: changeSet.connection }, "create-update");
+		await applyAuthConnections(client, {
+			changeSet: changeSet.connection,
+			stateScope: result.connectionStateScope
+		}, "create-update");
 		await Promise.all([...changeSet.idpConfig.creates.map(async (create) => {
 			if (create.idpConfig.kind === "BuiltInIdP") assertDefined(create.request.idpConfig, "request missing idpConfig").config = await protoBuiltinIdPConfig(client, assertDefined(create.request.workspaceId, "request missing workspaceId"), create.idpConfig);
 			return client.createAuthIDPConfig(create.request);
@@ -3724,7 +3760,10 @@ async function applyAuth(client, result, phase = "create-update") {
 		await Promise.all(changeSet.tenantConfig.deletes.map((del) => client.deleteTenantConfig(del.request)));
 		await Promise.all(changeSet.userProfileConfig.deletes.map((del) => client.deleteUserProfileConfig(del.request)));
 		await Promise.all(changeSet.idpConfig.deletes.map((del) => client.deleteAuthIDPConfig(del.request)));
-		await applyAuthConnections(client, { changeSet: changeSet.connection }, "delete-resources");
+		await applyAuthConnections(client, {
+			changeSet: changeSet.connection,
+			stateScope: result.connectionStateScope
+		}, "delete-resources");
 	} else if (phase === "delete-services") await Promise.all(changeSet.service.deletes.map((del) => client.deleteAuthService(del.request)));
 }
 /**
@@ -3768,7 +3807,8 @@ async function planAuth(context) {
 		},
 		conflicts: [...conflicts, ...connectionResult.conflicts],
 		unmanaged: [...unmanaged, ...connectionResult.unmanaged],
-		resourceOwners: /* @__PURE__ */ new Set([...resourceOwners, ...connectionResult.resourceOwners])
+		resourceOwners: /* @__PURE__ */ new Set([...resourceOwners, ...connectionResult.resourceOwners]),
+		connectionStateScope: connectionResult.stateScope
 	};
 }
 async function planServices$2(client, workspaceId, appName, appId, auths, forceApplyAll = false) {
@@ -5644,7 +5684,12 @@ async function planSecretManager(context) {
 		getName: (resource) => resource.name,
 		getTrn: (name) => resourceTrn(workspaceId, "vault", name)
 	});
-	const state = loadSecretsState();
+	const stateScope = {
+		workspaceId,
+		applicationId: application.id,
+		applicationName: application.name
+	};
+	const state = loadSecretsState(stateScope);
 	const skippedSecrets = [];
 	await Promise.all(secretVaults.map(async (vault) => {
 		const vaultName = vault.vaultName;
@@ -5753,7 +5798,8 @@ async function planSecretManager(context) {
 		skippedSecrets,
 		conflicts,
 		unmanaged,
-		resourceOwners
+		resourceOwners,
+		stateScope
 	};
 }
 /**
@@ -5761,11 +5807,11 @@ async function planSecretManager(context) {
 * @param client - Operator client instance
 * @param result - Planned secret changes
 * @param phase - Apply phase
-* @param application - Application to read secrets from for hash state persistence
+* @param application - Application used for ownership metadata and hash state persistence
 * @returns Promise that resolves when secret changes are applied
 */
 async function applySecretManager(client, result, phase = "create-update", application) {
-	const { vaultChangeSet, secretChangeSet } = result;
+	const { vaultChangeSet, secretChangeSet, stateScope } = result;
 	if (phase === "create-update") {
 		await Promise.all(vaultChangeSet.creates.map(async (create) => {
 			await client.createSecretManagerVault(vaultCreateRequest(create));
@@ -5788,13 +5834,14 @@ async function applySecretManager(client, result, phase = "create-update", appli
 		}));
 		await Promise.all(secretChangeSet.creates.map((create) => client.createSecretManagerSecret(secretCreateRequest(create))));
 		await Promise.all(secretChangeSet.updates.map((update) => client.updateSecretManagerSecret(secretUpdateRequest(update))));
-		if (application) {
-			const state = loadSecretsState();
-			for (const vault of application.secrets) {
-				if (!Object.hasOwn(state.vaults, vault.vaultName)) state.vaults[vault.vaultName] = {};
-				for (const secret of vault.secrets) if (secret.value != null) assertDefined(state.vaults[vault.vaultName], "vault state entry missing")[secret.name] = hashValue(secret.value);
+		const secretHashUpdates = [...secretChangeSet.creates, ...secretChangeSet.updates];
+		if (application && secretHashUpdates.length > 0) {
+			const state = loadSecretsState(stateScope);
+			for (const secret of secretHashUpdates) {
+				if (!Object.hasOwn(state.vaults, secret.vaultName)) state.vaults[secret.vaultName] = {};
+				assertDefined(state.vaults[secret.vaultName], "vault state entry missing")[secret.secretName] = hashValue(secret.value);
 			}
-			saveSecretsState(state);
+			saveSecretsState(stateScope, state);
 		}
 	} else {
 		await Promise.all(secretChangeSet.deletes.map((del) => client.deleteSecretManagerSecret({
@@ -5807,13 +5854,13 @@ async function applySecretManager(client, result, phase = "create-update", appli
 			secretmanagerVaultName: del.name
 		})));
 		if (secretChangeSet.deletes.length > 0 || vaultChangeSet.deletes.length > 0) {
-			const state = loadSecretsState();
+			const state = loadSecretsState(stateScope);
 			for (const del of secretChangeSet.deletes) if (Object.hasOwn(state.vaults, del.vaultName)) {
 				delete assertDefined(state.vaults[del.vaultName], "vault state entry missing")[del.secretName];
 				if (Object.keys(assertDefined(state.vaults[del.vaultName], "vault state entry missing")).length === 0) delete state.vaults[del.vaultName];
 			}
 			for (const del of vaultChangeSet.deletes) delete state.vaults[del.name];
-			saveSecretsState(state);
+			saveSecretsState(stateScope, state);
 		}
 	}
 }
@@ -5908,6 +5955,7 @@ function formatDiffChange(change) {
 		case "relationship_removed": return `  - [Relationship${change.relationshipType ? ` (${change.relationshipType})` : ""}] ${change.relationshipName}`;
 		case "relationship_modified": return `  ~ [Relationship${change.relationshipType ? ` (${change.relationshipType})` : ""}] ${change.relationshipName}: ${change.reason ?? "modified"}`;
 		case "permission_modified": return `  ~ [Permission] ${change.reason ?? "modified"}`;
+		case "type_scripts_modified": return `  ~ [Type Scripts] ${change.typeName}: ${change.reason ?? "type-level hooks/validate changed"}`;
 		default: {
 			const unknown = change;
 			return `  ? ${unknown.typeName}.${unknown.fieldName ?? ""}`;
@@ -6002,7 +6050,8 @@ const DIFF_CHANGE_LABELS = {
 	relationship_added: "relationship(s) added",
 	relationship_removed: "relationship(s) removed",
 	relationship_modified: "relationship(s) modified",
-	permission_modified: "permission(s) modified"
+	permission_modified: "permission(s) modified",
+	type_scripts_modified: "type script(s) modified"
 };
 /**
 * Format a summary of the migration diff
@@ -6016,6 +6065,181 @@ function formatDiffSummary(diff) {
 	return parts.length > 0 ? parts.join(", ") : "No changes";
 }
 
+//#endregion
+//#region src/parser/service/tailordb/type-script.ts
+const INPUT = "_input";
+const NEW_RECORD = "_newRecord";
+const OLD_RECORD = "_oldRecord";
+const NOW = "_now";
+const SOURCE_HASH_PREFIX = "// @sdk-source-hash:";
+const TIME_TYPES = /* @__PURE__ */ new Set([
+	"datetime",
+	"date",
+	"time"
+]);
+const key = (name) => JSON.stringify(name);
+function collectFieldScriptSources(fields) {
+	const entries = [];
+	for (const [name, config] of Object.entries(fields).toSorted(([a], [b]) => a.localeCompare(b))) {
+		const data = {};
+		if (config.hooks?.create?.expr) data.hc = config.hooks.create.expr;
+		if (config.hooks?.update?.expr) data.hu = config.hooks.update.expr;
+		if (config.validate?.some((v) => v.script?.expr)) data.v = config.validate.filter((v) => v.script?.expr).map((v) => [v.script?.expr, v.errorMessage]);
+		if (config.default !== void 0) {
+			data.d = config.default instanceof Date ? config.default.toISOString() : config.default;
+			data.t = config.type;
+		}
+		if (config.fields) {
+			const nested = collectFieldScriptSources(config.fields);
+			if (nested.length > 0) {
+				data.f = nested;
+				data.a = !!config.array;
+			}
+		}
+		if (Object.keys(data).length > 0) entries.push([name, data]);
+	}
+	return entries;
+}
+function computeSourceScriptHash(fields, options) {
+	const fieldSources = collectFieldScriptSources(fields);
+	if (!(fieldSources.length > 0 || options?.typeHookExpr?.create || options?.typeHookExpr?.update || options?.typeValidateExpr)) return void 0;
+	const payload = [fieldSources];
+	if (options?.typeHookExpr?.create) payload.push(["thc", options.typeHookExpr.create]);
+	if (options?.typeHookExpr?.update) payload.push(["thu", options.typeHookExpr.update]);
+	if (options?.typeValidateExpr) payload.push(["tve", options.typeValidateExpr]);
+	return createHash("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
+}
+function extractSourceScriptHash(expr) {
+	return expr.match(/\/\/ @sdk-source-hash:([0-9a-f]+)\s*$/)?.[1];
+}
+const isNestedType = (config) => config.type === "nested" && config.fields !== void 0;
+function serializeDefault(value, fieldType) {
+	if (value === "now" && TIME_TYPES.has(fieldType)) return NOW;
+	if (value instanceof Date) return `new Date(${JSON.stringify(value.toISOString())})`;
+	return JSON.stringify(value);
+}
+/**
+* Build the object literal that reconstructs one record level with hook
+* overrides and defaults applied.  For create, defaults are appended as
+* `?? defaultValue` after the hook expression (field hook → default).
+* Returns null when no field under this level has a hook or default for
+* the operation.
+* @param {Record<string, ScriptFieldConfig>} fields - Field configurations
+* @param {string} accessExpr - JS expression to access the parent object
+* @param {string} oldAccessExpr - JS expression to access the old record parent
+* @param {HookOperation} operation - Hook operation type
+* @param {boolean} nested - Whether building inside a nested field (rejects defaults)
+* @returns {string | null} Object literal expression or null
+*/
+function buildHookObject(fields, accessExpr, oldAccessExpr, operation, nested = false) {
+	const parts = [];
+	for (const [name, config] of Object.entries(fields)) {
+		const access = `${accessExpr}[${key(name)}]`;
+		const oldAccess = `${oldAccessExpr}?.[${key(name)}]`;
+		if (isNestedType(config) && config.fields) {
+			if (config.array) {
+				const inner = buildHookObject(config.fields, "__el", "undefined", operation, true);
+				if (inner !== null) parts.push(`${key(name)}: (${access} || []).map((__el) => Object.assign({}, __el, ${inner}))`);
+			} else {
+				const inner = buildHookObject(config.fields, `(${access} || {})`, oldAccess, operation, true);
+				if (inner !== null) parts.push(`${key(name)}: Object.assign({}, ${access}, ${inner})`);
+			}
+			continue;
+		}
+		const hook = config.hooks?.[operation];
+		if (nested && config.default !== void 0) throw new Error(`.default() cannot be used on nested inner field "${name}"`);
+		const hasDefault = operation === "create" && config.default !== void 0;
+		if (hook && hasDefault) parts.push(`${key(name)}: ((_value) => (${hook.expr}))(${access}) ?? ${serializeDefault(config.default, config.type)}`);
+		else if (hook && operation === "create") parts.push(`${key(name)}: ((_value) => (${hook.expr}))(${access})`);
+		else if (hook) parts.push(`${key(name)}: ((_value, _oldValue) => (${hook.expr}))(${access}, ${oldAccess} ?? null)`);
+		else if (hasDefault) parts.push(`${key(name)}: ${access} ?? ${serializeDefault(config.default, config.type)}`);
+	}
+	if (parts.length === 0) return null;
+	return `{ ${parts.join(", ")} }`;
+}
+/**
+* Build validation statements for one record level.
+* Each leaf field with validators contributes a block that runs every
+* validator and records all failing messages keyed by dotted field path.
+* @param {Record<string, ScriptFieldConfig>} fields - Field configurations
+* @param {string} accessExpr - JS expression to access the parent object
+* @param {string} keyPrefix - Dotted path prefix for error keys
+* @returns {string[]} Array of validation statement strings
+*/
+function buildValidateStatements(fields, accessExpr, keyPrefix) {
+	const statements = [];
+	for (const [name, config] of Object.entries(fields)) {
+		const access = `${accessExpr}[${key(name)}]`;
+		const fieldPath = keyPrefix ? `${keyPrefix}.${name}` : name;
+		const validators = (config.validate ?? []).filter((v) => v.script?.expr);
+		if (validators.length > 0) {
+			const checks = validators.map((v) => `{ const __r = (${v.script?.expr}); if (typeof __r === "string") { __errs[${key(fieldPath)}] = __r; } }`).join("\n");
+			statements.push(`{ const _value = ${access};\n${checks}\n}`);
+		}
+		if (isNestedType(config) && config.fields) if (config.array) {
+			const innerParts = [];
+			for (const [innerName, innerConfig] of Object.entries(config.fields)) {
+				const innerValidators = (innerConfig.validate ?? []).filter((v) => v.script?.expr);
+				if (innerValidators.length > 0) {
+					const errorKeyExpr = `${JSON.stringify(fieldPath + "[")} + __idx + ${JSON.stringify("]." + innerName)}`;
+					const checks = innerValidators.map((v) => `{ const __r = (${v.script?.expr}); if (typeof __r === "string") { __errs[${errorKeyExpr}] = __r; } }`).join("\n");
+					innerParts.push(`{ const _value = __el[${key(innerName)}];\n${checks}\n}`);
+				}
+			}
+			if (innerParts.length > 0) statements.push(`(${access} || []).forEach((__el, __idx) => {\n${innerParts.join("\n")}\n});`);
+		} else {
+			const nested = buildValidateStatements(config.fields, access, fieldPath);
+			if (nested.length > 0) statements.push(`if (${access} != null) {\n${nested.join("\n")}\n}`);
+		}
+	}
+	return statements;
+}
+function wrapHook(objectExpr) {
+	return `((_invoker) => { const ${NOW} = new Date(); return ${objectExpr}; })(typeof _invoker !== "undefined" ? _invoker : undefined)`;
+}
+function wrapValidate(statements, typeValidateExpr) {
+	const issuesFn = typeValidateExpr ? " const __issues = (f, m) => { __errs[f] = m; };" : "";
+	const typeValidateStmt = typeValidateExpr ? ` ${typeValidateExpr};` : "";
+	return `((_invoker) => { const __errs = {};${issuesFn}\n${statements.join("\n")}${typeValidateStmt}\nreturn __errs; })(typeof _invoker !== "undefined" ? _invoker : undefined)`;
+}
+/**
+* Aggregate every field's create/update hook, default, and validate into
+* type-level scripts.  Hooks compute a single shared timestamp (`now`) per
+* operation, so all fields touched in one create/update observe the same
+* instant.  Defaults are applied after hooks on create only.  Validators
+* run with the same rules on create and update.
+* @param fields - Per-field script configuration
+* @param options - Optional type-level hook/validate expressions
+* @returns Aggregated type-level scripts
+*/
+function buildTypeScripts(fields, options) {
+	const result = {};
+	const typeHookExpr = options?.typeHookExpr;
+	const typeValidateExpr = options?.typeValidateExpr;
+	const hash = computeSourceScriptHash(fields, options);
+	const hashSuffix = hash ? ` ${SOURCE_HASH_PREFIX}${hash}` : "";
+	const hook = {};
+	for (const operation of ["create", "update"]) {
+		const perFieldExpr = buildHookObject(fields, INPUT, OLD_RECORD, operation);
+		const typeLevelExpr = typeHookExpr?.[operation];
+		let expr;
+		if (perFieldExpr !== null && typeLevelExpr) expr = `((_invoker) => { const ${NOW} = new Date(); const __fl = ${perFieldExpr}; return Object.assign({}, __fl, ((${INPUT}) => ${typeLevelExpr})(Object.assign({}, ${INPUT}, __fl))); })(typeof _invoker !== "undefined" ? _invoker : undefined)`;
+		else if (typeLevelExpr) expr = wrapHook(typeLevelExpr);
+		else if (perFieldExpr !== null) expr = wrapHook(perFieldExpr);
+		if (expr) hook[operation] = { expr: expr + hashSuffix };
+	}
+	if (hook.create || hook.update) result.typeHook = hook;
+	const statements = buildValidateStatements(fields, NEW_RECORD, "");
+	if (statements.length > 0 || typeValidateExpr) {
+		const expr = wrapValidate(statements, typeValidateExpr) + hashSuffix;
+		result.typeValidate = {
+			create: { expr },
+			update: { expr }
+		};
+	}
+	return result;
+}
+
 //#endregion
 //#region src/cli/commands/tailordb/migrate/migration-number.ts
 /**
@@ -6107,6 +6331,7 @@ const snapshotFieldConfigSchema = z.looseObject({
 	validate: z.array(snapshotValidationSchema).optional(),
 	serial: snapshotSerialSchema.optional(),
 	scale: z.number().optional(),
+	default: z.unknown().optional(),
 	fields: z.lazy(() => snapshotRecordSchema(snapshotFieldConfigSchema)).optional()
 });
 const snapshotIndexConfigSchema = z.looseObject({
@@ -6352,6 +6577,20 @@ const permissionModifiedChangeSchema = z.looseObject({
 	before: snapshotPermissionStateSchema.optional(),
 	after: snapshotPermissionStateSchema.optional()
 });
+const typeScriptsStateSchema = z.looseObject({
+	typeHookExpr: z.looseObject({
+		create: z.string().optional(),
+		update: z.string().optional()
+	}).optional(),
+	typeValidateExpr: z.string().optional()
+});
+const typeScriptsModifiedChangeSchema = z.looseObject({
+	kind: z.literal("type_scripts_modified"),
+	typeName: z.string(),
+	reason: z.string().optional(),
+	before: typeScriptsStateSchema,
+	after: typeScriptsStateSchema
+});
 const diffChangeSchema = z.discriminatedUnion("kind", [
 	typeAddedChangeSchema,
 	typeRemovedChangeSchema,
@@ -6369,7 +6608,8 @@ const diffChangeSchema = z.discriminatedUnion("kind", [
 	relationshipAddedChangeSchema,
 	relationshipRemovedChangeSchema,
 	relationshipModifiedChangeSchema,
-	permissionModifiedChangeSchema
+	permissionModifiedChangeSchema,
+	typeScriptsModifiedChangeSchema
 ]);
 const breakingChangeInfoSchema = z.looseObject({
 	typeName: z.string(),
@@ -6573,6 +6813,7 @@ function createSnapshotFieldConfigFromOperatorConfig(fieldConfig) {
 		...fieldConfig.serial.format && { format: fieldConfig.serial.format }
 	};
 	if (fieldConfig.scale !== void 0) config.scale = fieldConfig.scale;
+	if (fieldConfig.default !== void 0) config.default = fieldConfig.default;
 	if (fieldConfig.fields && Object.keys(fieldConfig.fields).length > 0) {
 		config.fields = {};
 		for (const [nestedName, nestedConfig] of Object.entries(fieldConfig.fields)) config.fields[nestedName] = createSnapshotFieldConfigFromOperatorConfig(nestedConfig);
@@ -6614,6 +6855,8 @@ function createSnapshotType(type) {
 		};
 	}
 	if (type.files && Object.keys(type.files).length > 0) snapshotType.files = { ...type.files };
+	if (type.typeHookExpr) snapshotType.typeHookExpr = type.typeHookExpr;
+	if (type.typeValidateExpr) snapshotType.typeValidateExpr = type.typeValidateExpr;
 	if (Object.keys(type.forwardRelationships).length > 0) {
 		snapshotType.forwardRelationships = {};
 		for (const [relName, rel] of Object.entries(type.forwardRelationships)) snapshotType.forwardRelationships[relName] = {
@@ -6797,6 +7040,18 @@ function applyDiffToSnapshot(snapshot, diff) {
 			};
 			break;
 		}
+		case "type_scripts_modified": {
+			const existing = types[change.typeName];
+			if (existing) {
+				const { typeHookExpr: _, typeValidateExpr: __, ...rest } = existing;
+				types[change.typeName] = {
+					...rest,
+					...change.after.typeHookExpr && { typeHookExpr: change.after.typeHookExpr },
+					...change.after.typeValidateExpr !== void 0 && { typeValidateExpr: change.after.typeValidateExpr }
+				};
+			}
+			break;
+		}
 		case "field_added":
 		case "field_modified": {
 			const existing = types[change.typeName];
@@ -7021,6 +7276,10 @@ function areFieldsDifferent(oldField, newField) {
 		if ((oldSerial.format ?? "") !== (newSerial.format ?? "")) return true;
 	}
 	if (oldField.scale !== newField.scale) return true;
+	if (oldField.default !== newField.default) {
+		if (typeof oldField.default !== typeof newField.default) return true;
+		if (JSON.stringify(oldField.default) !== JSON.stringify(newField.default)) return true;
+	}
 	const oldFields = oldField.fields ?? {};
 	const newFields = newField.fields ?? {};
 	const oldFieldNames = Object.keys(oldFields);
@@ -7383,6 +7642,24 @@ function compareTypeSettings(ctx, typeName, previous, current) {
 		after: snapshotTypeSettingsState(current)
 	});
 }
+function typeScriptsState(type) {
+	return {
+		...type.typeHookExpr && { typeHookExpr: type.typeHookExpr },
+		...type.typeValidateExpr !== void 0 && { typeValidateExpr: type.typeValidateExpr }
+	};
+}
+function compareTypeScripts(ctx, typeName, previous, current) {
+	const prevState = typeScriptsState(previous);
+	const currState = typeScriptsState(current);
+	if (JSON.stringify(prevState) === JSON.stringify(currState)) return;
+	ctx.changes.push({
+		kind: "type_scripts_modified",
+		typeName,
+		reason: "type-level scripts changed",
+		before: prevState,
+		after: currState
+	});
+}
 /**
 * Compare two snapshots and generate a diff
 * @param {SchemaSnapshot} previous - Previous schema snapshot
@@ -7421,6 +7698,7 @@ function compareNormalizedSnapshots(previous, current) {
 		const prevType = assertDefined(previous.types[typeName], `type "${typeName}" missing from previous snapshot`);
 		const currType = assertDefined(current.types[typeName], `type "${typeName}" missing from current snapshot`);
 		compareTypeSettings(ctx, typeName, prevType, currType);
+		compareTypeScripts(ctx, typeName, prevType, currType);
 		compareTypeFields(ctx, typeName, prevType, currType);
 		compareIndexes(ctx, typeName, prevType.indexes, currType.indexes);
 		compareFiles(ctx, typeName, prevType.files, currType.files);
@@ -7910,7 +8188,66 @@ const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["id"]);
 * @returns {SchemaDrift[]} List of drifts detected
 */
 function compareRemoteWithSnapshot(remoteTypes, snapshot, remoteGqlPermissions = []) {
-	return compareNormalizedRemoteWithSnapshot(createRemoteComparableSnapshot(createSnapshotFromRemoteTypes(remoteTypes, snapshot.namespace, remoteGqlPermissions, snapshot)), createRemoteComparableSnapshot(snapshot));
+	const structuralDrifts = compareNormalizedRemoteWithSnapshot(createRemoteComparableSnapshot(createSnapshotFromRemoteTypes(remoteTypes, snapshot.namespace, remoteGqlPermissions, snapshot)), createRemoteComparableSnapshot(snapshot));
+	const scriptDrifts = compareScriptHashes(remoteTypes, snapshot);
+	return [...structuralDrifts, ...scriptDrifts];
+}
+function extractRemoteScriptHash(remoteType) {
+	const exprs = [
+		remoteType.schema?.typeHook?.create?.expr,
+		remoteType.schema?.typeHook?.update?.expr,
+		remoteType.schema?.typeValidate?.create?.expr,
+		remoteType.schema?.typeValidate?.update?.expr
+	];
+	let found;
+	for (const expr of exprs) if (expr) {
+		const hash = extractSourceScriptHash(expr);
+		if (hash) {
+			if (found && found !== hash) return void 0;
+			found = hash;
+		}
+	}
+	return found;
+}
+function remoteHasScripts(remoteType) {
+	return !!(remoteType.schema?.typeHook?.create?.expr || remoteType.schema?.typeHook?.update?.expr || remoteType.schema?.typeValidate?.create?.expr || remoteType.schema?.typeValidate?.update?.expr);
+}
+function compareScriptHashes(remoteTypes, snapshot) {
+	const drifts = [];
+	const remoteByName = new Map(remoteTypes.map((t) => [t.name, t]));
+	for (const [typeName, snapshotType] of Object.entries(snapshot.types)) {
+		const localHash = computeSourceScriptHash(snapshotType.fields, {
+			typeHookExpr: snapshotType.typeHookExpr,
+			typeValidateExpr: snapshotType.typeValidateExpr
+		});
+		const remoteType = remoteByName.get(typeName);
+		if (!remoteType) continue;
+		if (localHash) {
+			const remoteHash = extractRemoteScriptHash(remoteType);
+			if (localHash !== remoteHash) drifts.push({
+				typeName,
+				kind: "script_mismatch",
+				details: remoteHash ? `Type '${typeName}' scripts differ between remote and snapshot` : `Type '${typeName}' has no script hash on remote`
+			});
+		} else if (remoteHasScripts(remoteType)) drifts.push({
+			typeName,
+			kind: "script_mismatch",
+			details: `Type '${typeName}' has scripts on remote but not in snapshot`
+		});
+	}
+	return drifts;
+}
+function stripFieldScriptProps(field) {
+	const { hooks: _hooks, validate: _validate, default: _default, ...rest } = field;
+	if (rest.fields) {
+		const nested = createSnapshotRecord();
+		for (const [name, f] of Object.entries(rest.fields)) nested[name] = stripFieldScriptProps(f);
+		return {
+			...rest,
+			fields: nested
+		};
+	}
+	return rest;
 }
 function createRemoteComparableSnapshot(snapshot) {
 	const types = createSnapshotRecord();
@@ -7918,10 +8255,11 @@ function createRemoteComparableSnapshot(snapshot) {
 		const fields = createSnapshotRecord();
 		for (const [fieldName, field] of Object.entries(type.fields)) {
 			if (SYSTEM_FIELDS.has(fieldName)) continue;
-			fields[fieldName] = field;
+			fields[fieldName] = stripFieldScriptProps(field);
 		}
+		const { typeHookExpr: _, typeValidateExpr: __, ...typeRest } = type;
 		types[typeName] = {
-			...type,
+			...typeRest,
 			fields
 		};
 	}
@@ -8031,6 +8369,11 @@ function schemaDriftFromDiffChange(change) {
 			kind: "permission_mismatch",
 			details: change.reason ?? "Permissions differ between remote and snapshot"
 		};
+		case "type_scripts_modified": return {
+			typeName: change.typeName,
+			kind: "script_mismatch",
+			details: change.reason ?? "Type-level scripts differ between remote and snapshot"
+		};
 		default: throw new Error("Unsupported diff change");
 	}
 }
@@ -8115,6 +8458,10 @@ function generateTailorDBTypeManifestFromSnapshot(snapshotType, options = {}) {
 		update: [],
 		delete: []
 	};
+	const { typeHook, typeValidate } = buildTypeScripts(snapshotType.fields, {
+		typeHookExpr: snapshotType.typeHookExpr,
+		typeValidateExpr: snapshotType.typeValidateExpr
+	});
 	return {
 		name: snapshotType.name,
 		schema: {
@@ -8126,10 +8473,15 @@ function generateTailorDBTypeManifestFromSnapshot(snapshotType, options = {}) {
 			directives: [],
 			indexes,
 			files,
-			permission
+			permission,
+			...typeHook && { typeHook },
+			...typeValidate && { typeValidate }
 		}
 	};
 }
+function optionalOnCreate(config) {
+	return config.hooks?.create || config.default !== void 0 ? { optionalOnCreate: true } : {};
+}
 /**
 * Convert a snapshot field config to proto format
 * @param {SnapshotFieldConfig} config - Snapshot field config
@@ -8140,7 +8492,6 @@ function convertFieldConfigToProto(config) {
 		type: config.type,
 		allowedValues: config.type === "enum" ? config.allowedValues?.map((v) => ({ ...v })) ?? [] : [],
 		description: config.description || "",
-		validate: toProtoSnapshotFieldValidate(config),
 		array: config.array ?? false,
 		index: config.index ?? false,
 		unique: config.unique ?? false,
@@ -8149,7 +8500,7 @@ function convertFieldConfigToProto(config) {
 		foreignKeyField: config.foreignKeyField,
 		required: config.required,
 		vector: config.vector ?? false,
-		...toProtoSnapshotFieldHooks(config),
+		...optionalOnCreate(config),
 		...config.serial && { serial: {
 			start: BigInt(config.serial.start),
 			...config.serial.maxValue !== void 0 && { maxValue: BigInt(config.serial.maxValue) },
@@ -8160,20 +8511,6 @@ function convertFieldConfigToProto(config) {
 	if (config.type === "nested" && config.fields) fieldEntry.fields = processNestedFieldsFromSnapshot(config.fields);
 	return fieldEntry;
 }
-function toProtoSnapshotFieldValidate(config) {
-	return (config.validate ?? []).map((val) => ({
-		action: TailorDBType_PermitAction.DENY,
-		errorMessage: val.errorMessage || "",
-		script: { expr: val.script && val.script.expr ? `!${val.script.expr}` : "" }
-	}));
-}
-function toProtoSnapshotFieldHooks(config) {
-	if (!config.hooks) return {};
-	return { hooks: {
-		create: config.hooks.create ? { expr: config.hooks.create.expr || "" } : void 0,
-		update: config.hooks.update ? { expr: config.hooks.update.expr || "" } : void 0
-	} };
-}
 /**
 * Process nested fields from snapshot format to proto format
 * @param {Record<string, SnapshotFieldConfig>} fields - Nested fields
@@ -8187,14 +8524,12 @@ function processNestedFieldsFromSnapshot(fields) {
 			type: "nested",
 			allowedValues: fieldConfig.allowedValues?.map((v) => ({ ...v })) ?? [],
 			description: fieldConfig.description || "",
-			validate: toProtoSnapshotFieldValidate(fieldConfig),
 			required: fieldConfig.required,
 			array: fieldConfig.array ?? false,
 			index: false,
 			unique: false,
 			foreignKey: false,
 			vector: false,
-			...toProtoSnapshotFieldHooks(fieldConfig),
 			fields: deepNestedFields,
 			...fieldConfig.scale !== void 0 && { scale: fieldConfig.scale }
 		};
@@ -8202,14 +8537,13 @@ function processNestedFieldsFromSnapshot(fields) {
 		type: fieldConfig.type,
 		allowedValues: fieldConfig.type === "enum" ? fieldConfig.allowedValues?.map((v) => ({ ...v })) ?? [] : [],
 		description: fieldConfig.description || "",
-		validate: toProtoSnapshotFieldValidate(fieldConfig),
 		required: fieldConfig.required,
 		array: fieldConfig.array ?? false,
 		index: false,
 		unique: false,
 		foreignKey: false,
 		vector: false,
-		...toProtoSnapshotFieldHooks(fieldConfig),
+		...optionalOnCreate(fieldConfig),
 		...fieldConfig.serial && { serial: {
 			start: BigInt(fieldConfig.serial.start),
 			...fieldConfig.serial.maxValue !== void 0 && { maxValue: BigInt(fieldConfig.serial.maxValue) },
@@ -9530,14 +9864,6 @@ const migrationSnapshotCache = {
 		return snapshot;
 	}
 };
-/**
-* Build the TailorDBType manifest for `typeName` from migration N's snapshot.
-* @param migration - The pending migration whose snapshot to consult
-* @param typeName - The type name to look up in the snapshot
-* @param tailorDBInputs - Deploy inputs, used to resolve namespace gqlOperations
-* @param executorUsedTypes - Types used by executors (drives publishRecordEvents default)
-* @returns The manifest, or undefined if `typeName` is not in that snapshot.
-*/
 function buildSnapshotTypeManifest(migration, typeName, tailorDBInputs, executorUsedTypes) {
 	const snapshotType = migrationSnapshotCache.load(migration).types[typeName];
 	if (!snapshotType) return void 0;
@@ -10048,18 +10374,28 @@ function normalizeComparableTailorDBType(type) {
 			settings: normalized?.schema?.settings ?? {},
 			indexes: normalized?.schema?.indexes ?? {},
 			files: normalized?.schema?.files ?? {},
-			permission: normalized?.schema?.permission ?? {}
+			permission: normalized?.schema?.permission ?? {},
+			typeHook: normalized?.schema?.typeHook ?? {},
+			typeValidate: normalized?.schema?.typeValidate ?? {}
 		}
 	}, []);
 }
 function normalizeTailorDBCompareValue(value, path) {
 	if (value === void 0 || value === null) return value;
+	if (typeof value === "boolean") {
+		if (path.at(-1) === "optionalOnCreate" && value === false) return;
+		return value;
+	}
 	if (typeof value === "number" || typeof value === "bigint" || typeof value === "string") {
 		if (matchesNumericStringPath(path) && isNumericLikeValue(value)) return String(value);
 		if ((path.at(-1) === "expr" || path.at(-1) === "description") && value === tailordbCompareKnownDefaults.emptyExpression) return;
 		return value;
 	}
-	if (Array.isArray(value)) return value.map((item, index) => normalizeTailorDBCompareValue(item, [...path, index])).filter((item) => item !== void 0);
+	if (Array.isArray(value)) {
+		const items = value.map((item, index) => normalizeTailorDBCompareValue(item, [...path, index])).filter((item) => item !== void 0);
+		if (items.length === 0 && path.at(-1) === "validate") return;
+		return items;
+	}
 	if (!isPlainObject(value)) return value;
 	const normalizedEntries = Object.entries(value).map(([key, entryValue]) => [key, normalizeTailorDBCompareValue(entryValue, [...path, key])]).filter(([, entryValue]) => entryValue !== void 0);
 	const normalizedObject = Object.fromEntries(normalizedEntries);
@@ -10312,11 +10648,11 @@ async function registerJobFunctions(client, changeSet, appName, appId, unchanged
 	const allUsedJobNames = /* @__PURE__ */ new Set();
 	unchangedWorkflowJobNames.forEach((jobName) => allUsedJobNames.add(jobName));
 	for (const item of [...changeSet.creates, ...changeSet.updates]) for (const jobName of item.usedJobNames) allUsedJobNames.add(jobName);
-	const existingJobFunctions = await fetchAll(async (pageToken, _maxPageSize) => {
+	const existingJobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
 		const response = await client.listWorkflowJobFunctions({
 			workspaceId,
 			pageToken,
-			pageSize: 100
+			pageSize: maxPageSize
 		});
 		return [response.jobFunctions.map((j) => j.name), response.nextPageToken];
 	});
@@ -10496,11 +10832,11 @@ async function planWorkflow(client, workspaceId, appName, appId, workflows, main
 }
 async function planWorkflowJobFunctionDeletes(params) {
 	const { client, workspaceId, appName, appId, retainedWorkflowJobNames } = params;
-	const existingJobFunctions = await fetchAll(async (pageToken, _maxPageSize) => {
+	const existingJobFunctions = await fetchAll(async (pageToken, maxPageSize) => {
 		const response = await client.listWorkflowJobFunctions({
 			workspaceId,
 			pageToken,
-			pageSize: 100
+			pageSize: maxPageSize
 		});
 		return [response.jobFunctions.map((jobFunction) => jobFunction.name), response.nextPageToken];
 	});
@@ -11119,13 +11455,14 @@ function validateItems(params) {
 *
 * Collections not validated: idp client, tailorDB gqlPermission, functionRegistry — no
 * buf.validate annotations.
-* Application cors and IdP userAuthPolicy.allowedReturnOrigins receive special
-* handling: static-website URL placeholders are resolved at apply time, so the
+* Application cors, AIGateway cors, and IdP userAuthPolicy.allowedReturnOrigins receive
+* special handling: static-website URL placeholders are resolved at apply time, so the
 * relevant origin/URL constraints would false-positive on `<name>:url` entries
-* here. Application cors is dropped entirely (no other constraint to lose); IdP
-* `allowedReturnOrigins` substitutes placeholder entries with a dummy origin so
-* the per-item regex and the cross-field `enable_mfa requires ≥1 origin` rule
-* still get exercised on the rest of the payload.
+* here. Application cors and AIGateway cors are dropped entirely, forgoing their
+* per-item URL/origin constraints for the whole list rather than substituting
+* placeholders; IdP `allowedReturnOrigins` instead substitutes placeholder entries
+* with a dummy origin so the per-item regex and the cross-field `enable_mfa requires
+* ≥1 origin` rule still get exercised on the rest of the payload.
 * Workflow jobFunctions map excluded: versions are registered at apply time (registerJobFunctions)
 * and the map field carries no min_items constraint. Job names are validated separately via
 * CreateWorkflowJobFunctionRequestSchema using usedJobNames from the workflow change set.
@@ -11135,7 +11472,7 @@ function validateItems(params) {
 * @param input - Plan results from the plan phase
 */
 async function validatePlan(input) {
-	const { tailorDB, staticWebsite, idp, auth, pipeline, app, executor, workflow, workflowExecutionPolicy, secretManager } = input;
+	const { tailorDB, staticWebsite, aiGateway, idp, auth, pipeline, app, executor, workflow, workflowExecutionPolicy, secretManager } = input;
 	const validator = createValidator();
 	const violations = [];
 	function creates(schema, kind, items) {
@@ -11188,6 +11525,20 @@ async function validatePlan(input) {
 	creates(CreateStaticWebsiteRequestSchema, "StaticWebsite", staticWebsite.changeSet.creates);
 	updates(UpdateStaticWebsiteRequestSchema, "StaticWebsite", staticWebsite.changeSet.updates);
 	creates(AddCustomDomainRequestSchema, "StaticWebsite custom domain", staticWebsite.customDomainChangeSet.creates);
+	creates(CreateAIGatewayRequestSchema, "AIGateway", aiGateway.changeSet.creates.map((item) => ({
+		name: item.name,
+		request: {
+			...item.request,
+			cors: void 0
+		}
+	})));
+	updates(UpdateAIGatewayRequestSchema, "AIGateway", aiGateway.changeSet.updates.map((item) => ({
+		name: item.name,
+		request: {
+			...item.request,
+			cors: void 0
+		}
+	})));
 	const placeholderOriginReplacement = "https://placeholder.invalid";
 	const substituteIdpReturnOrigins = (item) => {
 		const request = item.request;
@@ -11973,50 +12324,25 @@ function deploymentPlanResults(deployment) {
 	const { application: _application, ...results } = deployment;
 	return results;
 }
+/**
+* Every `PlanResults` entry except `app` carries ownership-tracking fields;
+* deriving the list from `results` itself (instead of naming each key) keeps
+* these collectors in sync with `PlannedDeployment` as resource types are added.
+* @param results - Plan results for a single deployment
+* @returns The ownership-tracking plan entries, `app` excluded
+*/
+function ownershipTrackedPlans(results) {
+	const { app: _app, ...rest } = results;
+	return Object.values(rest);
+}
 function collectOwnerConflicts(results) {
-	return [
-		...results.functionRegistry.conflicts,
-		...results.tailorDB.conflicts,
-		...results.staticWebsite.conflicts,
-		...results.aiGateway.conflicts,
-		...results.idp.conflicts,
-		...results.auth.conflicts,
-		...results.pipeline.conflicts,
-		...results.executor.conflicts,
-		...results.workflow.conflicts,
-		...results.workflowExecutionPolicy.conflicts,
-		...results.secretManager.conflicts
-	];
+	return ownershipTrackedPlans(results).flatMap((plan) => plan.conflicts);
 }
 function collectUnmanagedResources(results) {
-	return [
-		...results.functionRegistry.unmanaged,
-		...results.tailorDB.unmanaged,
-		...results.staticWebsite.unmanaged,
-		...results.aiGateway.unmanaged,
-		...results.idp.unmanaged,
-		...results.auth.unmanaged,
-		...results.pipeline.unmanaged,
-		...results.executor.unmanaged,
-		...results.workflow.unmanaged,
-		...results.workflowExecutionPolicy.unmanaged,
-		...results.secretManager.unmanaged
-	];
+	return ownershipTrackedPlans(results).flatMap((plan) => plan.unmanaged);
 }
 function collectResourceOwners(results) {
-	return /* @__PURE__ */ new Set([
-		...results.functionRegistry.resourceOwners,
-		...results.tailorDB.resourceOwners,
-		...results.staticWebsite.resourceOwners,
-		...results.aiGateway.resourceOwners,
-		...results.idp.resourceOwners,
-		...results.auth.resourceOwners,
-		...results.pipeline.resourceOwners,
-		...results.executor.resourceOwners,
-		...results.workflow.resourceOwners,
-		...results.workflowExecutionPolicy.resourceOwners,
-		...results.secretManager.resourceOwners
-	]);
+	return new Set(ownershipTrackedPlans(results).flatMap((plan) => [...plan.resourceOwners]));
 }
 function collectImportantResourceDeletions(results) {
 	const importantDeletions = [];
@@ -16294,62 +16620,67 @@ async function execRemove(client, workspaceId, application, config, confirm) {
 		forRemoval: true,
 		config
 	};
-	const tailorDB = await planTailorDB(ctx);
-	const staticWebsite = await planStaticWebsite(ctx);
-	const aiGateway = await planAIGateway(ctx);
-	const idp = await planIdP(ctx);
-	const auth = await planAuth(ctx);
-	const pipeline = await planPipeline(ctx);
-	const app = await planApplication(ctx);
-	const executor = await planExecutor(ctx);
-	const workflow = await planWorkflow(client, workspaceId, application.name, application.id, {}, {});
-	const functionRegistry = await planFunctionRegistry(client, workspaceId, application.name, application.id, []);
-	const secretManager = await planSecretManager(ctx);
+	const plans = {
+		tailorDB: await planTailorDB(ctx),
+		staticWebsite: await planStaticWebsite(ctx),
+		aiGateway: await planAIGateway(ctx),
+		idp: await planIdP(ctx),
+		auth: await planAuth(ctx),
+		pipeline: await planPipeline(ctx),
+		app: await planApplication(ctx),
+		executor: await planExecutor(ctx),
+		workflow: await planWorkflow(client, workspaceId, application.name, application.id, {}, {}),
+		workflowExecutionPolicy: await planWorkflowJobFunctionExecutionPolicy(client, workspaceId, application.name, application.id, {}),
+		functionRegistry: await planFunctionRegistry(client, workspaceId, application.name, application.id, []),
+		secretManager: await planSecretManager(ctx)
+	};
 	const removeLines = [
-		...functionRegistry.changeSet.lines(),
-		...staticWebsite.changeSet.lines(),
-		...aiGateway.changeSet.lines(),
-		...app.lines(),
-		...tailorDB.changeSet.service.lines(),
-		...tailorDB.changeSet.type.lines(),
-		...tailorDB.changeSet.gqlPermission.lines(),
-		...pipeline.changeSet.service.lines(),
-		...pipeline.changeSet.resolver.lines(),
-		...executor.changeSet.lines(),
-		...workflow.changeSet.lines(),
-		...idp.changeSet.service.lines(),
-		...idp.changeSet.client.lines(),
-		...auth.changeSet.service.lines(),
-		...auth.changeSet.idpConfig.lines(),
-		...auth.changeSet.userProfileConfig.lines(),
-		...auth.changeSet.tenantConfig.lines(),
-		...auth.changeSet.machineUser.lines(),
-		...auth.changeSet.oauth2Client.lines(),
-		...auth.changeSet.authHook.lines(),
-		...auth.changeSet.scim.lines(),
-		...auth.changeSet.scimResource.lines(),
-		...auth.changeSet.connection.lines(),
-		...secretManager.vaultChangeSet.lines(),
-		...secretManager.secretChangeSet.lines()
+		...plans.functionRegistry.changeSet.lines(),
+		...plans.staticWebsite.changeSet.lines(),
+		...plans.aiGateway.changeSet.lines(),
+		...plans.app.lines(),
+		...plans.tailorDB.changeSet.service.lines(),
+		...plans.tailorDB.changeSet.type.lines(),
+		...plans.tailorDB.changeSet.gqlPermission.lines(),
+		...plans.pipeline.changeSet.service.lines(),
+		...plans.pipeline.changeSet.resolver.lines(),
+		...plans.executor.changeSet.lines(),
+		...plans.workflow.changeSet.lines(),
+		...plans.workflowExecutionPolicy.changeSet.lines(),
+		...plans.idp.changeSet.service.lines(),
+		...plans.idp.changeSet.client.lines(),
+		...plans.auth.changeSet.service.lines(),
+		...plans.auth.changeSet.idpConfig.lines(),
+		...plans.auth.changeSet.userProfileConfig.lines(),
+		...plans.auth.changeSet.tenantConfig.lines(),
+		...plans.auth.changeSet.machineUser.lines(),
+		...plans.auth.changeSet.oauth2Client.lines(),
+		...plans.auth.changeSet.authHook.lines(),
+		...plans.auth.changeSet.scim.lines(),
+		...plans.auth.changeSet.scimResource.lines(),
+		...plans.auth.changeSet.connection.lines(),
+		...plans.secretManager.vaultChangeSet.lines(),
+		...plans.secretManager.secretChangeSet.lines()
 	];
 	if (removeLines.length > 0) logger.log(removeLines.join("\n"));
-	if (tailorDB.changeSet.service.deletes.length === 0 && staticWebsite.changeSet.deletes.length === 0 && aiGateway.changeSet.deletes.length === 0 && idp.changeSet.service.deletes.length === 0 && auth.changeSet.service.deletes.length === 0 && pipeline.changeSet.service.deletes.length === 0 && app.deletes.length === 0 && executor.changeSet.deletes.length === 0 && workflow.changeSet.deletes.length === 0 && functionRegistry.changeSet.deletes.length === 0 && secretManager.vaultChangeSet.deletes.length === 0 && secretManager.secretChangeSet.deletes.length === 0) return;
+	if (plans.tailorDB.changeSet.service.deletes.length === 0 && plans.staticWebsite.changeSet.deletes.length === 0 && plans.aiGateway.changeSet.deletes.length === 0 && plans.idp.changeSet.service.deletes.length === 0 && plans.auth.changeSet.service.deletes.length === 0 && plans.pipeline.changeSet.service.deletes.length === 0 && plans.app.deletes.length === 0 && plans.executor.changeSet.deletes.length === 0 && plans.workflow.changeSet.deletes.length === 0 && plans.workflowExecutionPolicy.changeSet.deletes.length === 0 && plans.functionRegistry.changeSet.deletes.length === 0 && plans.secretManager.vaultChangeSet.deletes.length === 0 && plans.secretManager.secretChangeSet.deletes.length === 0) return;
 	if (confirm) await confirm();
-	await applyWorkflow(client, workflow, "delete");
-	await applyExecutor(client, executor, "delete");
-	await applyStaticWebsite(client, staticWebsite, "delete");
-	await applyAIGateway(client, aiGateway, "delete");
-	await applyApplication(client, app, "delete");
-	await applyPipeline(client, pipeline, "delete-resources");
-	await applyPipeline(client, pipeline, "delete-services");
-	await applyAuth(client, auth, "delete-resources");
-	await applyAuth(client, auth, "delete-services");
-	await applyIdP(client, idp, "delete-resources");
-	await applyIdP(client, idp, "delete-services");
-	await applyTailorDB(client, tailorDB, "delete-resources");
-	await applyTailorDB(client, tailorDB, "delete-services");
-	await applyFunctionRegistry(client, workspaceId, functionRegistry, "delete");
-	await applySecretManager(client, secretManager, "delete");
+	await applyWorkflow(client, plans.workflow, "delete");
+	await applyWorkflowJobFunctionExecutionPolicy(client, plans.workflowExecutionPolicy, "delete");
+	await applyExecutor(client, plans.executor, "delete");
+	await applyStaticWebsite(client, plans.staticWebsite, "delete");
+	await applyAIGateway(client, plans.aiGateway, "delete");
+	await applyApplication(client, plans.app, "delete");
+	await applyPipeline(client, plans.pipeline, "delete-resources");
+	await applyPipeline(client, plans.pipeline, "delete-services");
+	await applyAuth(client, plans.auth, "delete-resources");
+	await applyAuth(client, plans.auth, "delete-services");
+	await applyIdP(client, plans.idp, "delete-resources");
+	await applyIdP(client, plans.idp, "delete-services");
+	await applyTailorDB(client, plans.tailorDB, "delete-resources");
+	await applyTailorDB(client, plans.tailorDB, "delete-services");
+	await applyFunctionRegistry(client, workspaceId, plans.functionRegistry, "delete");
+	await applySecretManager(client, plans.secretManager, "delete");
 }
 /**
 * Remove all resources managed by the current application.
@@ -16525,10 +16856,27 @@ function applicationInfo(app) {
 		updatedAt: app.updateTime ? timestampDate(app.updateTime) : null
 	};
 }
+async function fetchAIGateways(client, workspaceId, names) {
+	return (await Promise.all(names.map(async (name) => {
+		try {
+			const { aigateway } = await client.getAIGateway({
+				workspaceId,
+				aigatewayName: name
+			});
+			return aigateway ? {
+				name: aigateway.name,
+				url: aigateway.url
+			} : void 0;
+		} catch (error) {
+			if (error instanceof ConnectError && error.code === Code.NotFound) return;
+			throw error;
+		}
+	}))).filter((gateway) => gateway !== void 0);
+}
 /**
 * Show applied application information for the current workspace.
 * @param options - Show options
-* @returns Application information
+* @returns Deployed application, workspace, and AI Gateway information
 */
 async function show(options) {
 	const client = await initOperatorClient(await loadAccessToken({ profile: options?.profile }));
@@ -16537,10 +16885,15 @@ async function show(options) {
 		profile: options?.profile
 	});
 	const { config } = await loadConfig(options?.configPath);
-	const [workspaceResp, resp] = await Promise.all([client.getWorkspace({ workspaceId }), client.getApplication({
-		workspaceId,
-		applicationName: config.name
-	})]);
+	const aiGatewayNames = config.aiGateways?.length ? [...new Set(config.aiGateways.map((gateway) => gateway.name))] : [];
+	const [workspaceResp, resp, aiGateways] = await Promise.all([
+		client.getWorkspace({ workspaceId }),
+		client.getApplication({
+			workspaceId,
+			applicationName: config.name
+		}),
+		fetchAIGateways(client, workspaceId, aiGatewayNames)
+	]);
 	const { name, ...appInfo } = applicationInfo(assertDefined(resp.application, `application "${config.name}" not found in workspace`));
 	const workspace = workspaceResp.workspace;
 	const workspaceFolderName = workspace ? await resolveWorkspaceFolderName(client, workspace) : "";
@@ -16550,7 +16903,8 @@ async function show(options) {
 		workspaceName: workspace?.name ?? "",
 		...workspaceFolderName ? { workspaceFolderName } : {},
 		workspaceRegion: workspace?.region ?? "",
-		...appInfo
+		...appInfo,
+		aiGateways
 	};
 }
 const showWorkspaceNameTransformer = createWorkspaceNameTransformer("workspaceName", "workspaceFolderName");
@@ -17177,7 +17531,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-BO4ZF8wP.mjs");
+	const { defineApplication } = await import("./application-CUkjzfij.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -19456,4 +19810,4 @@ async function registerTsHook(tsHookUrl) {
 
 //#endregion
 export { getOrganization as $, compareSnapshotWithRemote as $t, listCommand$3 as A, apiCommand as An, getExecutorWaitFailureMessage as At, show as B, listWorkflowExecutions as Bt, listCommand$2 as C, hasChanges as Cn, listWebhookExecutors as Ct, waitWorkflowExecution as D, PluginManager as Dn, listCommand$9 as Dt, waitCommand as E, sdkNameLabelKey as En, triggerExecutor as Et, generateCommand as F, startWorkflow as Ft, removeCommand$1 as G, deploy as Gt, extractOwnedNamespaces as H, formatKeyValueTable as Ht, generateMigrationScript as I, getCommand$5 as It, organizationTree as J, waitForExecution as Jt, updateCommand$1 as K, ensureConfigId as Kt, writeDbTypesFile as L, getWorkflow as Lt, truncate as M, assertWritable as Mn, listExecutorJobs as Mt, truncateCommand as N, defineAppCommand as Nn, watchExecutorJob as Nt, resumeCommand as O, generateUserTypes as On, listExecutors as Ot, generate as P, startCommand as Pt, getCommand$1 as Q, parseMigrationLabelNumber as Qt, getConfiguredEditorCommand as R, executionsCommand as Rt, listApps as S, formatMigrationDiff as Sn, getFunctionRegistry as St, healthCommand as T, resourceTrn as Tn, triggerCommand as Tt, logBetaWarning as U, getCommand$6 as Ut, showCommand as V, functionExecutionStatusToString as Vt, remove as W, getExecutor as Wt, listCommand$4 as X, MIGRATION_LABEL_KEY as Xt, treeCommand as Y, bundleMigrationScript as Yt, listOrganizations as Z, handleOptionalToRequiredError as Zt, getWorkspace as _, loadDiff as _n, listMachineUsers as _t, updateUser as a, MIGRATE_FILE_NAME as an, getFolder as at, createCommand as b, parseMigrationNumberArg as bn, listFunctionRegistries as bt, listCommand as c, compareLocalTypesWithSnapshot as cn, createCommand$1 as ct, inviteUser as d, getLatestMigrationNumber as dn, listOAuth2Clients as dt, generateAllTypeManifestsFromSnapshot as en, updateCommand$2 as et, restoreCommand as f, getMigrationDirPath as fn, getCommand$3 as ft, getCommand as g, isValidMigrationNumber as gn, listCommand$7 as gt, listWorkspaces as h, getNextMigrationNumber as hn, tokenCommand as ht, updateCommand as i, INITIAL_SCHEMA_NUMBER as in, getCommand$2 as it, listWorkflows as j, apiCall as jn, jobsCommand as jt, resumeWorkflow as k, prompt as kn, getExecutorJob as kt, listUsers as l, compareSnapshots as ln, createFolder as lt, listCommand$1 as m, getMigrationFiles as mn, getMachineUserToken as mt, query as n, DB_TYPES_FILE_NAME as nn, listCommand$5 as nt, removeCommand as o, SCHEMA_FILE_NAME as on, deleteCommand$1 as ot, restoreWorkspace as p, getMigrationFilePath as pn, getOAuth2Client as pt, updateOrganization as q, executeScript as qt, queryCommand as r, DIFF_FILE_NAME as rn, listFolders as rt, removeUser as s, assertValidMigrationFiles as sn, deleteFolder as st, registerTsHook as t, protoGqlPermission as tn, updateFolder as tt, inviteCommand as u, createSnapshotFromLocalTypes as un, listCommand$6 as ut, deleteCommand as v, reconstructSnapshotFromMigrations as vn, generate$1 as vt, getAppHealth as w, getNamespacesWithMigrations as wn, webhookCommand as wt, createWorkspace as x, formatDiffSummary as xn, getCommand$4 as xt, deleteWorkspace as y, formatMigrationNumber as yn, listCommand$8 as yt, openInConfiguredEditor as z, getWorkflowExecution as zt };
-//# sourceMappingURL=register-ts-hook-BM1caLT0.mjs.map
+//# sourceMappingURL=register-ts-hook-BhzVkej0.mjs.map