@tailor-platform/sdk 2.0.0-next.5 → 2.0.0-next.7

package/dist/{register-ts-hook-BhzVkej0.mjs → register-ts-hook-DvEs6YsL.mjs}

@@ -1,699 +1,1269 @@
-import { t as db } from "./schema-iCd1ugGp.mjs";
-import { i as PageDirection, n as Condition_Operator, r as FilterSchema, t as ConditionSchema } from "./resource_pb-BRv7AMXK.mjs";
+import { t as db } from "./schema--xYWRGfe.mjs";
+import { $ as CreateAuthIDPConfigRequestSchema, A as CreatePipelineResolverRequestSchema, At as TenantProviderConfig_TenantProviderType, B as IdPPermissionOperator, Bt as CreateAIGatewayRequestSchema, C as UpdateStaticWebsiteRequestSchema, Ct as AuthOAuth2Client_ClientType, D as CreateSecretManagerVaultRequestSchema, Dt as AuthSCIMAttribute_Uniqueness, E as CreateSecretManagerSecretRequestSchema, Et as AuthSCIMAttribute_Type, F as PipelineResolver_OperationType, Ft as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, G as CreateExecutorExecutorRequestSchema, Gt as ConditionSchema, H as FunctionExecution_Status, I as CreateIdPServiceRequestSchema, It as UpdateApplicationRequestSchema, J as ExecutorJobStatus, Jt as PageDirection, K as UpdateExecutorExecutorRequestSchema, Kt as Condition_Operator, L as UpdateIdPServiceRequestSchema, M as UpdatePipelineResolverRequestSchema, N as UpdatePipelineServiceRequestSchema, O as UpdateSecretManagerSecretRequestSchema, Ot as AuthSCIMConfig_AuthorizationType, Pt as CreateApplicationRequestSchema, Q as CreateAuthHookRequestSchema, Rt as ApplicationSchemaUpdateAttemptStatus, S as CreateStaticWebsiteRequestSchema, St as AuthInvokerSchema, Tt as AuthSCIMAttribute_Mutability, V as IdPPermissionPermit, Vt as UpdateAIGatewayRequestSchema, X as ExecutorTriggerType, Y as ExecutorTargetType, Z as CreateAuthConnectionRequestSchema, _ as TailorDBGQLPermission_Permit, a as CreateWorkflowRequestSchema, at as CreateTenantConfigRequestSchema, b as TailorDBType_PermitAction, bt as AuthHookPoint, ct as UpdateAuthHookRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as UpdateAuthOAuth2ClientRequestSchema, et as CreateAuthMachineUserRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as UpdateAuthSCIMConfigRequestSchema, g as TailorDBGQLPermission_Operator, gt as UpdateUserProfileConfigRequestSchema, h as TailorDBGQLPermission_Action, ht as UpdateTenantConfigRequestSchema, i as CreateWorkflowJobFunctionRequestSchema, it as CreateAuthServiceRequestSchema, j as CreatePipelineServiceRequestSchema, jt as UserProfileProviderConfig_UserProfileProviderType, l as WorkflowExecution_Status, lt as UpdateAuthIDPConfigRequestSchema, mt as UpdateAuthServiceRequestSchema, nt as CreateAuthSCIMConfigRequestSchema, o as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as CreateUserProfileConfigRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as UpdateAuthSCIMResourceRequestSchema, qt as FilterSchema, r as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, rt as CreateAuthSCIMResourceRequestSchema, s as UpdateWorkflowRequestSchema, st as UpdateAuthConnectionRequestSchema, t as WorkspacePlatformUserRole, tt as CreateAuthOAuth2ClientRequestSchema, u as WorkflowJobExecution_Status, ut as UpdateAuthMachineUserRequestSchema, v as TailorDBType_Permission_Operator, vt as AuthConnection_Status, wt as AuthOAuth2Client_GrantType, x as AddCustomDomainRequestSchema, xt as AuthIDPConfig_AuthType, y as TailorDBType_Permission_Permit, yt as AuthConnection_Type, z as IdPLang, zt as Subgraph_ServiceType } from "./workspace_resource_pb-Db3fv68L.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
-import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-BEiZZ3qT.mjs";
-import { B as readPlatformConfig, C as createBundleCache, Ct as positiveIntArg, D as loadConfig, E as hashFile, Et as workspaceArgs, F as loadMachineUserName, G as writePlatformConfig, H as resolveConfigUser, I as loadPlatformClientConfig, J as fetchAll, M as loadAccessToken, N as loadConfigPath, R as loadWorkspaceId, S as hasGenerationHooks, St as parseDuration, T as hashContent, Tt as toPageDirection, X as fetchMachineUserToken, Y as fetchAllTolerant, Z as fetchPaged, _ as platformBundleDefinePlugin, _t as nonNegativeIntArg, at as initOperatorClient, bt as pagedLogArgs, ct as byName, dt as confirmationArgs, et as getConsoleBaseUrl, f as buildExecutorArgsExpr, ft as deploymentArgs, g as stringifyFunction, h as assertUniqueTailorDBTypeNamesWithExternal, i as resolverBundleKey, m as assertUniqueLocalTailorDBTypeNames, mt as folderArgs, n as generatePluginFilesIfNeeded, nt as getOrNull, o as getApplicationAuthNamespace, ot as isDefaultPlatform, p as buildResolverOperationHookExpr, pt as durationArg, r as loadApplication, rt as getPlatformBaseUrl, s as WorkflowJobFunctionExecutionPolicySchema, st as resolveStaticWebsiteUrls, t as defineApplication, tt as getOAuth2ClientId, u as HTTP_METHODS, ut as configArg, vt as orderArg, w as getDistDir, wt as resolveMachineUserInputSource, x as getPluginGenerationDependencies, xt as paginationArgs, yt as organizationArgs, z as platformConfigFromProfile } from "./application-Bf8wxOi6.mjs";
-import { c as stripTailorDBTypeBuilderHelpers, h as loadFilesWithIgnores, t as createExecutorService, u as TailorDBTypeSchema } from "./service-CzZEVrp9.mjs";
+import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-BwS4ppwO.mjs";
+import { A as fetchAllTolerant, B as initOperatorClient, C as createBundleCache, E as hashFile, F as getConsoleBaseUrl, G as byName, H as normalizeBaseUrl, I as getOAuth2ClientId, K as LOG_LEVELS, L as getOrNull, M as fetchPaged, O as defaultPlatformBaseUrl, P as fetchUserInfo, R as getPlatformBaseUrl, S as hasGenerationHooks, T as hashContent, U as rememberPlatformConfigForToken, V as isDefaultPlatform, W as resolveStaticWebsiteUrls, _ as platformBundleDefinePlugin, f as buildExecutorArgsExpr, g as stringifyFunction, h as assertUniqueTailorDBTypeNamesWithExternal, i as resolverBundleKey, j as fetchMachineUserToken, k as fetchAll, m as assertUniqueLocalTailorDBTypeNames, n as generatePluginFilesIfNeeded, o as getApplicationAuthNamespace, p as buildResolverOperationHookExpr, r as loadApplication, s as WorkflowJobFunctionExecutionPolicySchema, t as defineApplication, u as HTTP_METHODS, w as getDistDir, x as getPluginGenerationDependencies, z as initOAuth2Client } from "./application-GzW98_Xr.mjs";
+import { c as stripTailorDBTypeBuilderHelpers, g as functionSchema, h as loadFilesWithIgnores, t as createExecutorService, u as TailorDBTypeSchema } from "./service-Dmxa2I4i.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "./package-json-8b0O9TlX.mjs";
-import { i as userAgent } from "./secret-file-aoNXJmKa.mjs";
-import { n as isCLIError, t as createCLIError } from "./errors-118wUDRr.mjs";
-import { $ as CreateAuthServiceRequestSchema, A as CreatePipelineServiceRequestSchema, At as Subgraph_ServiceType, C as CreateStaticWebsiteRequestSchema, D as CreateSecretManagerVaultRequestSchema, Dt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, E as CreateSecretManagerSecretRequestSchema, Et as CreateApplicationRequestSchema, F as UpdateIdPServiceRequestSchema, G as ExecutorTriggerType, H as UpdateExecutorExecutorRequestSchema, I as IdPLang, J as CreateAuthIDPConfigRequestSchema, K as CreateAuthConnectionRequestSchema, L as IdPPermissionOperator, M as UpdatePipelineServiceRequestSchema, Mt as UpdateAIGatewayRequestSchema, N as PipelineResolver_OperationType, O as UpdateSecretManagerSecretRequestSchema, Ot as UpdateApplicationRequestSchema, P as CreateIdPServiceRequestSchema, Q as CreateAuthSCIMResourceRequestSchema, R as IdPPermissionPermit, S as AddCustomDomainRequestSchema, St as AuthSCIMConfig_AuthorizationType, Tt as UserProfileProviderConfig_UserProfileProviderType, U as ExecutorJobStatus, V as CreateExecutorExecutorRequestSchema, W as ExecutorTargetType, X as CreateAuthOAuth2ClientRequestSchema, Y as CreateAuthMachineUserRequestSchema, Z as CreateAuthSCIMConfigRequestSchema, _ as TailorDBGQLPermission_Operator, _t as AuthOAuth2Client_ClientType, a as WorkspacePlatformUserRole, at as UpdateAuthMachineUserRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthSCIMAttribute_Type, c as CreateWorkflowRequestSchema, ct as UpdateAuthSCIMResourceRequestSchema, d as WorkflowExecution_Status, dt as UpdateUserProfileConfigRequestSchema, et as CreateTenantConfigRequestSchema, f as WorkflowJobExecution_Status, ft as AuthConnection_Status, g as TailorDBGQLPermission_Action, gt as AuthInvokerSchema, h as UpdateTailorDBTypeRequestSchema, ht as AuthIDPConfig_AuthType, it as UpdateAuthIDPConfigRequestSchema, j as UpdatePipelineResolverRequestSchema, jt as CreateAIGatewayRequestSchema, k as CreatePipelineResolverRequestSchema, kt as ApplicationSchemaUpdateAttemptStatus, l as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, lt as UpdateAuthServiceRequestSchema, m as CreateTailorDBTypeRequestSchema, mt as AuthHookPoint, nt as UpdateAuthConnectionRequestSchema, o as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as UpdateAuthOAuth2ClientRequestSchema, p as CreateTailorDBServiceRequestSchema, pt as AuthConnection_Type, q as CreateAuthHookRequestSchema, rt as UpdateAuthHookRequestSchema, s as CreateWorkflowJobFunctionRequestSchema, st as UpdateAuthSCIMConfigRequestSchema, t as OperatorService, tt as CreateUserProfileConfigRequestSchema, u as UpdateWorkflowRequestSchema, ut as UpdateTenantConfigRequestSchema, v as TailorDBGQLPermission_Permit, vt as AuthOAuth2Client_GrantType, w as UpdateStaticWebsiteRequestSchema, wt as TenantProviderConfig_TenantProviderType, x as TailorDBType_PermitAction, xt as AuthSCIMAttribute_Uniqueness, y as TailorDBType_Permission_Operator, yt as AuthSCIMAttribute_Mutability, z as FunctionExecution_Status } from "./service_pb-Bk7dL-yT.mjs";
+import { t as userAgent } from "./user-agent-Bgsszb5I.mjs";
+import { r as isCLIError, t as createCLIError } from "./errors-DfnF4ibq.mjs";
+import { n as tightenSecretFilePermissions, r as writeSecretFile } from "./secret-file-C3J4Gy8r.mjs";
 import { r as withSpan } from "./telemetry-BRVdwh14.mjs";
 import * as mod from "node:module";
 import * as path from "pathe";
+import { basename, dirname, join, resolve } from "pathe";
 import { resolveTSConfig } from "pkg-types";
 import { arg, createDefineCommand, defineCommand, runCommand } from "politty";
 import { z } from "zod";
-import { ScalarType, create, fromJson, toJson } from "@bufbuild/protobuf";
-import * as fs$1 from "node:fs";
+import { create, fromJson, toJson } from "@bufbuild/protobuf";
+import * as fs$2 from "node:fs";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { parseEnv } from "node:util";
 import { ValueSchema, timestampDate } from "@bufbuild/protobuf/wkt";
 import { formatDistanceToNowStrict } from "date-fns";
 import { getBorderCharacters, table } from "table";
 import { pathToFileURL } from "node:url";
+import { parseYAML, stringifyYAML } from "confbox";
 import { findUpSync } from "find-up-simple";
+import { lt } from "semver";
 import { xdgConfig } from "xdg-basedir";
 import { Code, ConnectError } from "@connectrpc/connect";
 import pLimit from "p-limit";
 import * as crypto$1 from "node:crypto";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { ExitPromptError } from "@inquirer/core";
-import { confirm, input, password } from "@inquirer/prompts";
+import { confirm, input, password, select } from "@inquirer/prompts";
 import { isCI } from "std-env";
 import * as rolldown from "rolldown";
-import * as fs from "node:fs/promises";
-import { glob } from "node:fs/promises";
 import { parseSync } from "oxc-parser";
 import * as inflection from "inflection";
 import { tmpdir } from "node:os";
 import { pathToString } from "@bufbuild/protobuf/reflect";
 import { createValidator } from "@bufbuild/protovalidate";
+import * as fs from "node:fs/promises";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { setTimeout as setTimeout$1 } from "timers/promises";
 import { setTimeout as setTimeout$2 } from "node:timers/promises";
 import { spawn } from "node:child_process";
-import { watch } from "chokidar";
-import * as madgeModule from "madge";
+import * as fs$1 from "fs";
+import { lookup } from "mime-types";
 import { createPrompt } from "@toiroakr/read-multiline";
 import { astVisitor, parse } from "pgsql-ast-parser";
 import { parse as parse$1 } from "@0no-co/graphql.web";
 
-//#region src/cli/shared/command.ts
+//#region src/cli/shared/args.ts
+const unitToMs = {
+	ms: 1,
+	s: 1e3,
+	m: 60 * 1e3
+};
+const durationPattern = /^(\d+)(ms|s|m)$/;
 /**
-* defineCommand with global args type (CommonArgsType).
-* Use this for leaf commands with `run` to get type-safe access to global args.
-* Parent commands with only `subCommands` can use `defineCommand` from politty directly.
+* Schema for duration string validation (e.g., "3s", "500ms", "1m")
+* Only validates format; use parseDuration() to convert to milliseconds
 */
-const defineAppCommand = createDefineCommand();
-
-//#endregion
-//#region src/cli/shared/readonly-guard.ts
+const durationArg = z.string().refine((val) => durationPattern.test(val), { message: "Invalid duration format. Expected format: '3s', '500ms', '1m'" }).refine((val) => {
+	const match = val.match(durationPattern);
+	if (!match) return false;
+	const digits = match[1];
+	return digits !== void 0 && parseInt(digits, 10) > 0;
+}, { message: "Duration must be greater than 0" });
 /**
-* Throw a CLIError if the active profile has `readonly: true`.
-*
-* Resolves the active profile in this order:
-* 1. `opts.profile` (CLI flag)
-* 2. `process.env.TAILOR_PLATFORM_PROFILE`
-*
-* If neither is set, no profile is in scope so the call is allowed. This is
-* intentional: `TAILOR_PLATFORM_TOKEN` direct access (CI / machine user) and
-* `--workspace-id` without a profile are out-of-band paths whose authorization
-* is governed by the bearer token itself, not by the local profile flag.
-*
-* If the resolved profile cannot be found in the config, this function returns
-* silently and lets downstream loaders surface the not-found error.
-* @param opts - Options
-* @param opts.profile - Optional explicit profile name from command args
+* Parse a validated duration string into milliseconds
+* @param duration - Duration string (e.g., "3s", "500ms", "1m")
+* @returns Duration in milliseconds
 */
-async function assertWritable(opts) {
-	const profileName = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
-	if (!profileName) return;
-	const profile = (await readPlatformConfig()).profiles[profileName];
-	if (!profile || profile.readonly !== true) return;
-	throw createCLIError({
-		code: "PROFILE_READONLY",
-		message: `Profile "${profileName}" is read-only.`,
-		details: "This profile blocks platform-state mutations (apply, create/update/delete, deploy, etc.). Application-data operations remain available because their permissions are governed by the machine user.",
-		suggestion: `Use a different profile, unset TAILOR_PLATFORM_PROFILE, or run 'tailor profile update ${profileName} --permission write'.`
-	});
-}
-
-//#endregion
-//#region src/cli/commands/api/api-call.ts
-function hasEnvAccessToken() {
-	const envToken = process.env.TAILOR_PLATFORM_TOKEN ?? process.env.TAILOR_TOKEN;
-	return Boolean(envToken);
+function parseDuration(duration) {
+	const match = assertDefined(duration.match(durationPattern), `invalid duration format: ${duration}`);
+	const value = parseInt(assertDefined(match[1], "duration digits group missing"), 10);
+	const unit = assertDefined(match[2], "duration unit group missing");
+	return value * unitToMs[unit];
 }
 /**
-* Call Tailor Platform API endpoints directly.
-* If the endpoint doesn't contain "/", it defaults to `tailor.v1.OperatorService/{endpoint}`.
-* @param options - API call options (profile, endpoint, body)
-* @returns Response status and data
+* Schema for positive integer validation (from string input)
+* Transforms the string to a number
 */
-async function apiCall(options) {
-	const accessToken = await loadAccessToken({ profile: options.profile });
-	let platformConfig;
-	try {
-		platformConfig = await loadPlatformClientConfig({ profile: options.profile });
-	} catch (error) {
-		if (!hasEnvAccessToken()) throw error;
-	}
-	let endpointPath;
-	if (options.endpoint.includes("/")) endpointPath = options.endpoint;
-	else endpointPath = `tailor.v1.OperatorService/${options.endpoint}`;
-	const url = new URL(endpointPath, getPlatformBaseUrl(platformConfig));
-	const response = await fetch(url.toString(), {
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			Authorization: `Bearer ${accessToken}`,
-			"User-Agent": await userAgent()
-		},
-		body: options.body ?? "{}"
-	});
-	const data = await response.json();
-	if (!response.ok) throw new Error(`API call failed (${response.status}): ${JSON.stringify(data)}`);
-	return {
-		status: response.status,
-		data
-	};
+const positiveIntArg = z.coerce.number().int().positive();
+/**
+* Schema for non-negative integer validation (from string input).
+* Accepts 0 (used for `--limit 0` to disable the limit).
+*/
+const nonNegativeIntArg = z.coerce.number().int().nonnegative();
+/**
+* Schema for sort order (`asc` or `desc`).
+*/
+const orderArg = z.enum(["asc", "desc"]);
+/**
+* Translate a CLI `--order` value into the proto `PageDirection` enum.
+* Returns `undefined` when the user did not specify an order so that
+* callers can omit the field and fall back to the server default.
+* @param order - Order string from CLI args (`"asc"` | `"desc"` | undefined)
+* @returns PageDirection, or undefined when `order` is undefined
+*/
+function toPageDirection(order) {
+	if (order === void 0) return void 0;
+	return order === "asc" ? PageDirection.ASC : PageDirection.DESC;
+}
+function hasMachineUserFlag(argv) {
+	return argv.slice(0, argv.indexOf("--") === -1 ? argv.length : argv.indexOf("--")).some((token) => token === "-m" || token.startsWith("-m=") || token === "--machine-user" || token.startsWith("--machine-user=") || token === "--machineUser" || token.startsWith("--machineUser=") || token === "--machineuser" || token.startsWith("--machineuser="));
 }
-
-//#endregion
-//#region src/cli/commands/api/proto-reflect.ts
-const UNARY_METHODS = OperatorService.methods.filter((m) => m.methodKind === "unary");
-function listMethodNames() {
-	return UNARY_METHODS.map((m) => m.name).toSorted();
-}
-/**
-* Returns every accepted form of the `endpoint` positional — bare method name
-* and fully-qualified `service/Method`. politty's expand completion keys its
-* static table by the literal endpoint string, so both forms must appear in
-* `choices` or the user typing the fully-qualified name gets no `--field`
-* completion candidates back at TAB time.
-* @returns Sorted list of accepted endpoint values
-*/
-function listMethodChoices() {
-	return UNARY_METHODS.flatMap((m) => [m.name, `${OperatorService.typeName}/${m.name}`]).toSorted();
-}
-function getMethodDescriptor(methodName) {
-	return UNARY_METHODS.find((m) => m.name === methodName);
-}
-function extractMethodName(endpoint) {
-	if (!endpoint.includes("/")) return endpoint;
-	return endpoint.split("/").pop() ?? endpoint;
-}
-/**
-* Returns the nested message descriptor when the field is a message, a list of
-* messages, or a map with message values. Otherwise returns undefined.
-* @param field - The proto field descriptor to inspect
-* @returns The nested message descriptor, or undefined when the field isn't message-shaped
-*/
-function nestedMessage(field) {
-	if (field.fieldKind === "message") return field.message;
-	if (field.fieldKind === "list" && field.listKind === "message") return field.message;
-	if (field.fieldKind === "map" && field.mapKind === "message") return field.message;
-}
-/**
-* Most `google.protobuf.*` well-known types serialize as scalars in proto JSON
-* (Timestamp/Duration → RFC3339/duration string, FieldMask → comma-joined
-* string, *Value wrappers → underlying primitive, etc.), so we must not let
-* `--field` drill into their internal fields. Treating them as leaves keeps
-* the completion and the body shape consistent with what the server expects.
-* @param message - The proto message descriptor to inspect
-* @returns True when the message is a well-known type
-*/
-function isWellKnownType(message) {
-	return message.typeName.startsWith("google.protobuf.");
-}
-const UNREPRESENTABLE_WELL_KNOWN_TYPES = /* @__PURE__ */ new Set([
-	"google.protobuf.Struct",
-	"google.protobuf.Value",
-	"google.protobuf.ListValue",
-	"google.protobuf.NullValue",
-	"google.protobuf.Any",
-	"google.protobuf.Empty"
-]);
 /**
-* @param message - The proto message descriptor to inspect
-* @returns True when the message is a well-known type that `--field` cannot represent
+* Resolve whether a parsed machine user value came from an explicit CLI option or env fallback.
+* @param machineUser - Parsed machine user value
+* @param argv - Raw CLI argv, excluding the executable and script path
+* @param options - Source resolution options
+* @returns Machine user input source, or undefined when no value was parsed
 */
-function isUnrepresentableWellKnownType(message) {
-	return UNREPRESENTABLE_WELL_KNOWN_TYPES.has(message.typeName);
+function resolveMachineUserInputSource(machineUser, argv = process.argv.slice(2), options = {}) {
+	if (machineUser === void 0) return void 0;
+	if (options.valueIsExplicit) return "option";
+	if (hasMachineUserFlag(argv)) return "option";
+	return process.env.TAILOR_PLATFORM_MACHINE_USER_NAME === machineUser ? "env" : "option";
 }
 /**
-* Pre-enumerates every `--field` completion candidate for `methodName`,
-* walking the input message tree to produce a flat list that the shell can
-* prefix-filter at TAB time. Used by the `expand` completion variant so no
-* Node process is spawned per keystroke.
-*
-* For each leaf field, emits `key=` (key completion). Enum leaves additionally
-* emit `key=ENUM_VALUE` per value, bool leaves emit `key=true` and
-* `key=false`. For nested messages, emits `key.` (drill-down) and recurses.
+* Load env files from parsed arguments.
+* Processes --env-file first, then --env-file-if-exists.
 *
-* Returns an empty array when `methodName` is unknown so the `expand`
-* generator stays exception-free at script-generation time.
-* @param methodName - Name of the unary RPC whose input message is being walked
-* @returns Flat list of `{ value, description }` candidates
-*/
-function enumerateAllFieldCompletions(methodName) {
-	const method = getMethodDescriptor(methodName);
-	if (!method) return [];
-	const candidates = [];
-	const visited = /* @__PURE__ */ new Set();
-	function walk(message, prefix) {
-		visited.add(message);
-		for (const field of message.fields) {
-			if (field.fieldKind === "list" || field.fieldKind === "map") continue;
-			const fullKey = prefix + field.localName;
-			if (field.fieldKind === "message") {
-				if (isUnrepresentableWellKnownType(field.message)) continue;
-				if (!isWellKnownType(field.message)) {
-					const nested = field.message;
-					candidates.push({
-						value: `${fullKey}.`,
-						description: `${fullKey} (message)`
-					});
-					if (!visited.has(nested)) walk(nested, `${fullKey}.`);
-					continue;
-				}
+* Follows Node.js --env-file behavior:
+* - Variables already set in the environment are NOT overwritten
+* - Variables from later files override those from earlier files
+* @param envFiles - Required env file path(s) that must exist
+* @param envFilesIfExists - Optional env file path(s) that are loaded if they exist
+*/
+function loadEnvFiles(envFiles, envFilesIfExists) {
+	const originalEnvKeys = new Set(Object.keys(process.env));
+	const load = (files, required) => {
+		for (const file of [files ?? []].flat()) {
+			const envPath = path.resolve(process.cwd(), file);
+			if (!fs$2.existsSync(envPath)) {
+				if (required) throw new Error(`Environment file not found: ${envPath}`);
+				continue;
 			}
-			candidates.push({
-				value: `${fullKey}=`,
-				description: `Set ${fullKey}`
-			});
-			if (field.fieldKind === "enum") for (const v of field.enum.values) candidates.push({
-				value: `${fullKey}=${v.name}`,
-				description: v.name
-			});
-			else if (field.fieldKind === "scalar" && field.scalar === ScalarType.BOOL) {
-				candidates.push({
-					value: `${fullKey}=true`,
-					description: "true"
-				});
-				candidates.push({
-					value: `${fullKey}=false`,
-					description: "false"
-				});
+			const parsed = parseEnv(fs$2.readFileSync(envPath, "utf-8"));
+			for (const [key, value] of Object.entries(parsed)) {
+				if (originalEnvKeys.has(key)) continue;
+				process.env[key] = value;
 			}
 		}
-		visited.delete(message);
-	}
-	walk(method.input, "");
-	return candidates;
-}
-/**
-* Resolves the leaf `DescField` at a dotted `--field` path within an input
-* message tree. Returns undefined when any segment is missing or when a
-* non-leaf segment isn't a singular message — callers fall back to treating
-* the value as a string in that case.
-* @param input - The RPC input message descriptor
-* @param path - Dot-split path segments to follow (e.g. ["application", "name"])
-* @returns The leaf field descriptor, or undefined when the path doesn't resolve
-*/
-function resolveLeafField(input, path) {
-	let message = input;
-	for (let i = 0; i < path.length; i++) {
-		const field = message.fields.find((f) => f.localName === path[i]);
-		if (!field) return void 0;
-		if (i === path.length - 1) {
-			if (field.fieldKind === "message" && isUnrepresentableWellKnownType(field.message)) return;
-			return field;
-		}
-		if (field.fieldKind !== "message") return void 0;
-		if (isWellKnownType(field.message)) return void 0;
-		message = field.message;
-	}
+	};
+	load(envFiles, true);
+	load(envFilesIfExists, false);
 }
-
-//#endregion
-//#region src/cli/commands/api/render.ts
-const SCALAR_LABEL = {
-	[ScalarType.DOUBLE]: "double",
-	[ScalarType.FLOAT]: "float",
-	[ScalarType.INT64]: "int64",
-	[ScalarType.UINT64]: "uint64",
-	[ScalarType.INT32]: "int32",
-	[ScalarType.FIXED64]: "fixed64",
-	[ScalarType.FIXED32]: "fixed32",
-	[ScalarType.BOOL]: "bool",
-	[ScalarType.STRING]: "string",
-	[ScalarType.BYTES]: "bytes",
-	[ScalarType.UINT32]: "uint32",
-	[ScalarType.SFIXED32]: "sfixed32",
-	[ScalarType.SFIXED64]: "sfixed64",
-	[ScalarType.SINT32]: "sint32",
-	[ScalarType.SINT64]: "sint64"
-};
-function shortName(typeName) {
-	const dot = typeName.lastIndexOf(".");
-	return dot < 0 ? typeName : typeName.slice(dot + 1);
-}
-function scalarLabel(scalar) {
-	return SCALAR_LABEL[scalar] ?? `scalar(${scalar})`;
-}
-function enumLabel(enumDesc) {
-	return `enum ${shortName(enumDesc.typeName)}`;
-}
-function enumOf(field) {
-	if (field.fieldKind === "enum") return field.enum;
-	if (field.fieldKind === "list" && field.listKind === "enum") return field.enum;
-}
-function describeFieldType(field) {
-	switch (field.fieldKind) {
-		case "scalar": return scalarLabel(field.scalar);
-		case "enum": return enumLabel(field.enum);
-		case "message": return shortName(field.message.typeName);
-		case "list": {
-			let inner;
-			if (field.listKind === "scalar") inner = scalarLabel(field.scalar);
-			else if (field.listKind === "enum") inner = enumLabel(field.enum);
-			else inner = shortName(field.message.typeName);
-			return `repeated ${inner}`;
+/**
+* Common arguments for all CLI commands
+*
+* NOTE: --env-file and --env-file-if-exists collide with Node.js flags due to a bug
+* (https://github.com/nodejs/node/issues/54232). Node.js parses these even after the
+* script path, causing warnings (twice due to tsx loader).
+*/
+const commonArgs = {
+	"env-file": arg(z.string().optional(), {
+		alias: "e",
+		description: "Path to the environment file (error if not found)",
+		completion: {
+			type: "file",
+			matcher: [".env.*", ".env"]
+		}
+	}),
+	"env-file-if-exists": arg(z.string().optional(), {
+		description: "Path to the environment file (ignored if not found)",
+		completion: {
+			type: "file",
+			matcher: [".env.*", ".env"]
+		},
+		effect: (_value, { args }) => {
+			loadEnvFiles(args["env-file"], args["env-file-if-exists"]);
+		}
+	}),
+	verbose: arg(z.boolean().default(false), {
+		description: "Enable verbose logging",
+		effect: (value) => {
+			verboseMode = value;
 		}
-		case "map": {
-			const keyType = scalarLabel(field.mapKey);
-			let valType;
-			if (field.mapKind === "scalar") valType = scalarLabel(field.scalar);
-			else if (field.mapKind === "enum") valType = enumLabel(field.enum);
-			else valType = shortName(field.message.typeName);
-			return `map<${keyType}, ${valType}>`;
+	}),
+	json: arg(z.boolean().default(false), {
+		alias: "j",
+		description: "Output as JSON",
+		effect: (value) => {
+			logger.jsonMode = value;
 		}
-		default: return "<unknown>";
+	})
+};
+/**
+* Arguments for commands that require workspace context
+*/
+const workspaceArgs = {
+	"workspace-id": arg(z.string().optional(), {
+		alias: "w",
+		description: "Workspace ID",
+		env: "TAILOR_PLATFORM_WORKSPACE_ID",
+		completion: { type: "none" }
+	}),
+	profile: arg(z.string().optional(), {
+		alias: "p",
+		description: "Workspace profile",
+		env: "TAILOR_PLATFORM_PROFILE",
+		completion: { type: "none" }
+	})
+};
+/**
+* Shared config arg for commands that accept a config file path
+*/
+const configArg = { config: arg(z.string().default("tailor.config.ts"), {
+	alias: "c",
+	description: "Path to Tailor config file",
+	env: "TAILOR_CONFIG_PATH",
+	completion: {
+		type: "file",
+		extensions: ["ts"]
 	}
-}
-function fieldToJson(field, visited) {
-	const json = {
-		name: field.localName,
-		protoName: field.name,
-		type: describeFieldType(field),
-		fieldKind: field.fieldKind,
-		repeated: field.fieldKind === "list"
-	};
-	if (field.oneof) json.oneof = field.oneof.name;
-	const fieldEnum = enumOf(field);
-	if (fieldEnum) json.enumValues = fieldEnum.values.map((v) => v.name);
-	const nested = nestedMessage(field);
-	if (nested && !visited.has(nested)) {
-		visited.add(nested);
-		json.message = {
-			typeName: nested.typeName,
-			fields: nested.fields.map((f) => fieldToJson(f, visited))
-		};
-		visited.delete(nested);
-	} else if (nested) json.message = {
-		typeName: nested.typeName,
-		fields: [],
-		recursive: true
-	};
-	return json;
-}
-function renderInspectJson(method) {
-	const visited = /* @__PURE__ */ new Set([method.input]);
-	return {
-		method: method.name,
-		input: {
-			typeName: method.input.typeName,
-			fields: method.input.fields.map((f) => fieldToJson(f, visited))
-		},
-		output: { typeName: method.output.typeName }
-	};
-}
-function renderFieldText(field, indent, visited) {
-	const lines = [];
-	const oneofTag = field.oneof ? ` (oneof ${field.oneof.name})` : "";
-	lines.push(`${indent}${field.localName}: ${describeFieldType(field)}${oneofTag}`);
-	const fieldEnum = enumOf(field);
-	if (fieldEnum) {
-		const values = fieldEnum.values.map((v) => v.name).join(", ");
-		lines.push(`${indent}  values: ${values}`);
-	}
-	const nested = nestedMessage(field);
-	if (nested && !visited.has(nested)) {
-		visited.add(nested);
-		for (const sub of nested.fields) lines.push(...renderFieldText(sub, `${indent}  `, visited));
-		visited.delete(nested);
-	} else if (nested) lines.push(`${indent}  …(recursive ${nested.typeName})`);
-	return lines;
-}
-function renderInspectText(method) {
-	const lines = [];
-	lines.push(`${method.name}`);
-	lines.push(`  request: ${method.input.typeName}`);
-	const visited = /* @__PURE__ */ new Set([method.input]);
-	for (const f of method.input.fields) lines.push(...renderFieldText(f, "    ", visited));
-	lines.push(`  response: ${method.output.typeName}`);
-	return lines.join("\n");
+}) };
+/**
+* Shared config arg for commands that accept one or more comma-separated config file paths
+*/
+const multiConfigArg = { config: arg(z.string().default("tailor.config.ts"), {
+	alias: "c",
+	description: "Path to SDK config file. Use comma-separated paths to deploy multiple apps together.",
+	env: "TAILOR_PLATFORM_SDK_CONFIG_PATH",
+	completion: {
+		type: "file",
+		extensions: ["ts"]
+	}
+}) };
+/**
+* Arguments for commands that interact with deployed resources (includes config)
+*/
+const deploymentArgs = {
+	...workspaceArgs,
+	...configArg
+};
+/**
+* Arguments for commands that require confirmation
+*/
+const confirmationArgs = { yes: arg(z.boolean().default(false), {
+	alias: "y",
+	description: "Skip confirmation prompts"
+}) };
+/**
+* Arguments for commands that require organization context
+*/
+const organizationArgs = { "organization-id": arg(z.string(), {
+	alias: "o",
+	description: "Organization ID",
+	env: "TAILOR_PLATFORM_ORGANIZATION_ID",
+	completion: { type: "none" }
+}) };
+/**
+* Arguments for list commands that accept `--order` / `--limit`. Sort
+* order defaults to `desc` (newest first) because most callers want the
+* latest items; pass `--order asc` to opt in to ascending order. The
+* limit is unbounded by default so existing invocations keep returning
+* every item; pass `--limit N` to cap the result size.
+* @param defaultOrder - Default value for `--order` (defaults to `"desc"`)
+* @returns Argument shape suitable for spreading into a command schema
+*/
+const paginationArgs = (defaultOrder = "desc") => ({
+	order: arg(orderArg.default(defaultOrder), { description: "Sort order (asc or desc)" }),
+	limit: arg(nonNegativeIntArg.optional(), {
+		alias: "l",
+		description: "Maximum number of items to return (0 or omit: unlimited)"
+	})
+});
+/**
+* Arguments for time-series log list commands. Defaults to newest-first
+* (`desc`) and a 50-item cap so that listing stays responsive on busy
+* workspaces. Pass `--limit 0` to disable the cap and fetch all entries.
+*/
+const pagedLogArgs = {
+	order: arg(orderArg.default("desc"), { description: "Sort order (asc or desc)" }),
+	limit: arg(nonNegativeIntArg.default(50), {
+		alias: "l",
+		description: "Maximum number of items to return (0: unlimited)"
+	})
+};
+/**
+* Arguments for commands that require folder context
+*/
+const folderArgs = { "folder-id": arg(z.string(), {
+	alias: "f",
+	description: "Folder ID",
+	env: "TAILOR_PLATFORM_FOLDER_ID",
+	completion: { type: "none" }
+}) };
+let verboseMode = false;
+/**
+* Returns whether verbose mode is enabled.
+* Used by the global cleanup handler which doesn't have access to parsed args.
+* @returns Whether verbose mode is enabled
+*/
+function isVerbose() {
+	return verboseMode;
 }
 
 //#endregion
-//#region src/cli/commands/api/inspect.ts
-const inspectCommand = defineAppCommand({
-	name: "inspect",
-	description: "Print the input message tree of an OperatorService endpoint.",
-	notes: "Combine with the global `--json` flag for a machine-readable descriptor. Recursive type references and `oneof` membership are annotated. Use `tailor api list` to discover endpoint names.",
-	examples: [{
-		cmd: "GetApplication",
-		desc: "Show fields of GetApplicationRequest."
-	}, {
-		cmd: "CreateExecutorExecutor",
-		desc: "Inspect a deeply nested input with `(oneof config)` annotations."
-	}],
-	args: z.strictObject({ endpoint: arg(z.string(), {
-		positional: true,
-		description: "API endpoint to inspect (e.g., 'GetApplication' or 'tailor.v1.OperatorService/GetApplication').",
-		completion: { custom: { choices: listMethodNames() } }
-	}) }),
-	run: (args) => {
-		const methodName = extractMethodName(args.endpoint);
-		const method = getMethodDescriptor(methodName);
-		if (!method) throw createCLIError({
-			message: `unknown method: ${methodName}`,
-			suggestion: "Run `tailor api list` to see available methods.",
-			command: "api inspect"
-		});
-		if (logger.jsonMode) logger.out(renderInspectJson(method));
-		else logger.out(renderInspectText(method));
-	}
-});
+//#region src/cli/shared/command.ts
+/**
+* defineCommand with global args type (CommonArgsType).
+* Use this for leaf commands with `run` to get type-safe access to global args.
+* Parent commands with only `subCommands` can use `defineCommand` from politty directly.
+*/
+const defineAppCommand = createDefineCommand();
 
 //#endregion
-//#region src/cli/commands/api/list.ts
-const listCommand$10 = defineAppCommand({
-	name: "list",
-	description: "List all invocable OperatorService methods.",
-	notes: "Only single-request (non-streaming) methods are listed, because the CLI issues a single JSON request and reads one JSON response.",
-	args: z.strictObject({}),
-	run: () => {
-		const names = listMethodNames();
-		if (logger.jsonMode) logger.out(names);
-		else for (const name of names) logger.out(name);
-	}
+//#region src/parser/app-config/schema.ts
+const envValueSchema = z.union([
+	z.string(),
+	z.number(),
+	z.boolean()
+]);
+const LogLevelSchema = z.enum(LOG_LEVELS);
+const logLevelSchema = z.string().refine((value) => LogLevelSchema.safeParse(value.trim().toUpperCase()).success, { message: `'logLevel' must be one of: ${LOG_LEVELS.join(", ")}.` });
+/**
+* Structural validation schema for `defineConfig({...})`. Validates only
+* top-level fields with platform-side constraints (notably `id`); fields
+* that carry SDK builder objects (`auth`, `idp`, `db`, ...) are accepted
+* as opaque values, since their internal shapes are validated by their
+* own factory functions and parser-level schemas.
+*
+* The `id` is auto-managed by `deploy` and stored as a plain UUID. A
+* label-compatible prefix is added at the metadata boundary, so user-facing
+* configs only need to carry a UUID.
+*/
+const AppConfigSchema = z.strictObject({
+	id: z.uuid({ message: "'id' must be a UUID." }).optional(),
+	name: z.string().min(1, { message: "'name' must be a non-empty string." }),
+	env: z.record(z.string(), envValueSchema).optional(),
+	cors: z.array(z.string()).optional(),
+	allowedIpAddresses: z.array(z.string()).optional(),
+	disableIntrospection: z.boolean().optional(),
+	inlineSourcemap: z.boolean().optional(),
+	logLevel: logLevelSchema.optional(),
+	db: z.unknown().optional(),
+	resolver: z.unknown().optional(),
+	idp: z.unknown().optional(),
+	auth: z.unknown().optional(),
+	executor: z.unknown().optional(),
+	workflow: z.unknown().optional(),
+	httpAdapter: z.unknown().optional(),
+	staticWebsites: z.unknown().optional(),
+	aiGateways: z.unknown().optional(),
+	secrets: z.unknown().optional()
 });
 
 //#endregion
-//#region src/cli/commands/api/index.ts
-function resolveNamespaceName(methodName, config) {
-	if (/Auth|Tenant|UserProfile/.test(methodName)) return config.auth?.name;
-	if (/IdP/.test(methodName)) {
-		if (config.idp?.length === 1) return assertDefined(config.idp[0], "idp config missing").name;
-		return;
-	}
-	if (/TailorDB/.test(methodName)) {
-		const keys = Object.keys(config.db ?? {});
-		if (keys.length === 1) return keys[0];
-		return;
-	}
-	if (/Pipeline/.test(methodName)) {
-		const keys = Object.keys(config.resolver ?? {});
-		if (keys.length === 1) return keys[0];
-		return;
+//#region src/parser/plugin-config/schema.ts
+const PluginConfigSchema = z.looseObject({
+	id: z.string(),
+	description: z.string(),
+	importPath: z.string().optional(),
+	pluginConfig: z.unknown().optional(),
+	typeConfigRequired: z.union([z.boolean(), functionSchema]).optional(),
+	onTypeLoaded: functionSchema.optional(),
+	onNamespaceLoaded: functionSchema.optional(),
+	onTailorDBReady: functionSchema.optional(),
+	onResolverReady: functionSchema.optional(),
+	onExecutorReady: functionSchema.optional()
+}).refine((p) => {
+	return !(p.onTypeLoaded || p.onNamespaceLoaded) || !!p.importPath;
+}, { message: "importPath is required when plugin has definition-time hooks (onTypeLoaded/onNamespaceLoaded)" }).transform((plugin) => plugin);
+
+//#endregion
+//#region src/cli/shared/token-store.ts
+const SERVICE_NAME = "tailor-platform-cli";
+let entryClass;
+async function getEntryClass() {
+	if (entryClass !== void 0) return entryClass;
+	try {
+		const mod = await import("@napi-rs/keyring");
+		const probe = new mod.Entry(SERVICE_NAME, "__probe__");
+		probe.setPassword("probe");
+		probe.deletePassword();
+		entryClass = mod.Entry;
+	} catch {
+		logger.warn("System keyring is not available. Tokens will be stored in the config file. Set TAILOR_PLATFORM_TOKEN environment variable for CI environments.");
+		entryClass = false;
 	}
+	return entryClass;
+}
+/**
+* Check whether the OS keyring is available and functional.
+* @returns true if keyring is available
+*/
+async function isKeyringAvailable() {
+	return await getEntryClass() !== false;
 }
 /**
-* Parse a JSON body string as a plain object for field injection.
-* Returns undefined for invalid JSON or non-object values (null, arrays, primitives),
-* so callers can fall back to sending the raw string unchanged.
-* @param body - Raw body string
-* @returns Parsed object or undefined
+* Load tokens from the OS keyring for a given account.
+* @param account - User identifier (e.g. email or client ID)
+* @returns Token data or undefined if not found or keyring unavailable
 */
-function parseBodyAsObject(body) {
-	let parsed;
+async function loadKeyringTokens(account) {
+	const Entry = await getEntryClass();
+	if (!Entry) return void 0;
 	try {
-		parsed = JSON.parse(body);
+		const raw = new Entry(SERVICE_NAME, account).getPassword();
+		if (raw === null) return void 0;
+		return JSON.parse(raw);
 	} catch {
 		return;
 	}
-	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return;
-	return parsed;
-}
-/**
-* Set a dotted path on a body object, replacing non-object intermediates as
-* needed. `--field` takes precedence over `--body`, so collisions overwrite.
-* @param obj - The body object to mutate
-* @param path - Dot-split path segments (e.g. ["application", "name"])
-* @param value - Value to assign at the leaf
-*/
-function setNestedPath(obj, path, value) {
-	let cursor = obj;
-	for (let i = 0; i < path.length - 1; i++) {
-		const key = assertDefined(path[i], "path segment missing");
-		const next = cursor[key];
-		if (typeof next !== "object" || next === null || Array.isArray(next)) cursor[key] = {};
-		cursor = cursor[key];
-	}
-	cursor[assertDefined(path[path.length - 1], "path last segment missing")] = value;
-}
-/**
-* Coerces a raw `--field` string value to match the leaf proto type so the
-* JSON body sends a properly typed value. Today we only coerce bool — the
-* completion candidates explicitly suggest `=true`/`=false`, so sending the
-* literal string "true" would be a visible mismatch. Other scalars are left
-* as strings: proto JSON accepts string forms for ints/floats/int64/etc.,
-* and we'd rather pass through what the user typed than silently coerce.
-* @param field - The resolved leaf field descriptor, or undefined when the path didn't resolve
-* @param raw - The raw string value after `=`
-* @returns The value to write into the body object
-*/
-function coerceFieldValue(field, raw) {
-	if (field && field.fieldKind === "scalar" && field.scalar === ScalarType.BOOL) {
-		if (raw === "true") return true;
-		if (raw === "false") return false;
-		throw new Error(`Invalid value for bool field: '${raw}'. Expected 'true' or 'false'.`);
-	}
-	return raw;
-}
-/**
-* Collapse top-level body keys that address a known input field by its
-* protobuf name (snake_case) or JSON name to the field's `localName`. protojson
-* accepts every alias, so converging them here lets the presence checks below
-* reason in a single namespace — otherwise a `--body` written as
-* `{"workspace_id": ...}` slips past the camelCase check and we inject a second
-* `workspaceId`, which the server rejects as a duplicate field. When both forms
-* are present the canonical key wins and the alias is dropped.
-* @param body - The parsed body object to mutate
-* @param fields - The target endpoint's input fields
-* @returns Whether any key was rewritten
-*/
-function normalizeBodyFieldKeys(body, fields) {
-	const aliasToLocal = /* @__PURE__ */ new Map();
-	for (const f of fields) {
-		aliasToLocal.set(f.name, f.localName);
-		aliasToLocal.set(f.jsonName, f.localName);
-	}
-	let changed = false;
-	for (const key of Object.keys(body)) {
-		const local = aliasToLocal.get(key);
-		if (!local || local === key) continue;
-		if (!Object.hasOwn(body, local)) body[local] = body[key];
-		delete body[key];
-		changed = true;
-	}
-	return changed;
-}
-const FORBIDDEN_SEGMENTS = /* @__PURE__ */ new Set([
-	"__proto__",
-	"constructor",
-	"prototype"
+}
+/**
+* Save tokens to the OS keyring for a given account.
+* @param account - User identifier (e.g. email or client ID)
+* @param tokens - Token data to store
+*/
+async function saveKeyringTokens(account, tokens) {
+	const Entry = await getEntryClass();
+	if (!Entry) return;
+	new Entry(SERVICE_NAME, account).setPassword(JSON.stringify(tokens));
+}
+/**
+* Delete tokens from the OS keyring for a given account.
+* @param account - User identifier (e.g. email or client ID)
+*/
+async function deleteKeyringTokens(account) {
+	const Entry = await getEntryClass();
+	if (!Entry) return;
+	try {
+		new Entry(SERVICE_NAME, account).deletePassword();
+	} catch {}
+}
+
+//#endregion
+//#region src/cli/shared/context.ts
+const pfProfileSchema = z.object({
+	user: z.string(),
+	workspace_id: z.string(),
+	readonly: z.boolean().optional(),
+	machine_user: z.string().optional(),
+	machine_user_override: z.enum(["allow", "deny"]).optional(),
+	platform_url: z.url().optional(),
+	oauth2_client_id: z.string().optional(),
+	console_url: z.url().optional()
+});
+const pfUserSchemaV1 = z.object({
+	access_token: z.string(),
+	refresh_token: z.string().optional(),
+	token_expires_at: z.string()
+});
+const pfUserKeyringSchema = z.object({
+	storage: z.literal("keyring"),
+	token_expires_at: z.string()
+});
+const pfUserFileSchema = z.object({
+	storage: z.literal("file"),
+	token_expires_at: z.string(),
+	access_token: z.string(),
+	refresh_token: z.string().optional()
+});
+const pfUserSchemaV2 = z.discriminatedUnion("storage", [pfUserKeyringSchema, pfUserFileSchema]);
+const pfUserKeyringSchemaV3 = pfUserKeyringSchema.extend({ email: z.string().optional() });
+const pfUserFileSchemaV3 = pfUserFileSchema.extend({ email: z.string().optional() });
+const pfUserSchemaV3 = z.discriminatedUnion("storage", [pfUserKeyringSchemaV3, pfUserFileSchemaV3]);
+const pfConfigSchemaV1 = z.object({
+	version: z.literal(1),
+	users: z.partialRecord(z.string(), pfUserSchemaV1),
+	profiles: z.partialRecord(z.string(), pfProfileSchema),
+	current_user: z.string().nullable()
+});
+const V2_CONFIG_VERSION = 2;
+const LATEST_CONFIG_VERSION = 3;
+const V2_MIN_SDK_VERSION = "1.29.0";
+const V3_MIN_SDK_VERSION = "2.0.0";
+const semverSchema = z.templateLiteral([
+	z.number().int(),
+	".",
+	z.number().int(),
+	".",
+	z.number().int()
 ]);
-const fieldArg = z.string().transform((val, ctx) => {
-	const eq = val.indexOf("=");
-	if (eq < 0) {
-		ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			message: `Invalid field format: '${val}'. Expected format: 'key=value' or 'a.b.c=value'`
-		});
-		return z.NEVER;
-	}
-	const key = val.slice(0, eq);
-	if (key.length === 0) {
-		ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			message: "Field key cannot be empty"
-		});
-		return z.NEVER;
+const pfConfigSchemaV2 = z.object({
+	version: z.literal(V2_CONFIG_VERSION),
+	min_sdk_version: semverSchema,
+	latest_version: z.number().int().optional(),
+	latest_min_sdk_version: semverSchema.optional(),
+	users: z.partialRecord(z.string(), pfUserSchemaV2),
+	profiles: z.partialRecord(z.string(), pfProfileSchema),
+	current_user: z.string().nullable()
+});
+const pfConfigSchemaV3 = z.object({
+	version: z.literal(LATEST_CONFIG_VERSION),
+	min_sdk_version: semverSchema,
+	latest_version: z.number().int().optional(),
+	latest_min_sdk_version: semverSchema.optional(),
+	users: z.partialRecord(z.string(), pfUserSchemaV3),
+	profiles: z.partialRecord(z.string(), pfProfileSchema),
+	current_user: z.string().nullable()
+});
+function platformConfigPath() {
+	if (!xdgConfig) throw new Error("User home directory not found");
+	return path.join(xdgConfig, "tailor-platform", "config.yaml");
+}
+/**
+* Convert stored profile platform fields to platform client settings.
+* @param profile - Profile platform settings
+* @returns Platform client settings
+*/
+function platformConfigFromProfile(profile) {
+	const config = {
+		...profile?.platform_url ? { platformUrl: profile.platform_url } : {},
+		...profile?.oauth2_client_id ? { oauth2ClientId: profile.oauth2_client_id } : {},
+		...profile?.console_url ? { consoleUrl: profile.console_url } : {}
+	};
+	return Object.keys(config).length > 0 ? config : void 0;
+}
+function platformUserKey(user, config) {
+	const platformUrl = getPlatformBaseUrl(config);
+	if (platformUrl === normalizeBaseUrl("https://api.tailor.tech")) return user;
+	return `${platformUrl}|${user}`;
+}
+function userFromPlatformUserKey(userKey, config) {
+	const platformPrefix = `${getPlatformBaseUrl(config)}|`;
+	return userKey.startsWith(platformPrefix) ? userKey.slice(platformPrefix.length) : userKey;
+}
+function canUseLegacyUserKey(platformUrl) {
+	try {
+		return getPlatformBaseUrl() === platformUrl;
+	} catch {
+		return false;
 	}
-	const segments = key.split(".");
-	if (segments.some((seg) => seg.length === 0)) {
-		ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			message: `Invalid field key: '${key}'. Dotted segments cannot be empty`
-		});
-		return z.NEVER;
+}
+function findUserByEmail(users, email, platformConfig) {
+	const platformUrl = getPlatformBaseUrl(platformConfig);
+	const platformPrefix = `${platformUrl}|`;
+	const defaultPlatform = platformUrl === normalizeBaseUrl(defaultPlatformBaseUrl);
+	return Object.entries(users).find(([key, entry]) => {
+		if (entry?.email !== email) return false;
+		return defaultPlatform ? !key.includes("|") : key.startsWith(platformPrefix);
+	});
+}
+function findUserEntry(config, user, platformConfig, opts = {}) {
+	const userKey = platformUserKey(user, platformConfig);
+	const userEntry = config.users[userKey];
+	if (userEntry) return {
+		userKey,
+		userEntry
+	};
+	const emailMatch = findUserByEmail(config.users, user, platformConfig);
+	if (emailMatch?.[1]) return {
+		userKey: emailMatch[0],
+		userEntry: emailMatch[1]
+	};
+	const platformUrl = getPlatformBaseUrl(platformConfig);
+	if (userKey !== user && (opts.allowLegacyUserKey === false || !canUseLegacyUserKey(platformUrl))) return {
+		userKey,
+		userEntry
+	};
+	const legacyEntry = config.users[user];
+	return legacyEntry ? {
+		userKey: user,
+		userEntry: legacyEntry
+	} : {
+		userKey,
+		userEntry
+	};
+}
+/**
+* Resolve the config user key that would be used for a user on the selected platform.
+* @param config - Platform config
+* @param user - User name
+* @param platformConfig - Optional platform connection settings
+* @param opts - Token lookup options
+* @returns Resolved config user key
+*/
+function resolveUserTokenKey(config, user, platformConfig, opts) {
+	return findUserEntry(config, user, platformConfig, opts).userKey;
+}
+function resolveConfigUser(config, user, platformConfig, opts) {
+	const { userKey, userEntry } = findUserEntry(config, user, platformConfig, opts);
+	return userEntry ? userFromPlatformUserKey(userKey, platformConfig) : void 0;
+}
+/**
+* Check whether tokens are registered for a user on the selected platform.
+* @param config - Platform config
+* @param user - User name
+* @param platformConfig - Optional platform connection settings
+* @param opts - Token lookup options
+* @returns True when the user has a registered token entry
+*/
+function hasUserTokenEntry(config, user, platformConfig, opts) {
+	return findUserEntry(config, user, platformConfig, opts).userEntry !== void 0;
+}
+function hasUserKeyForName(users, user) {
+	return users[user] !== void 0 || Object.keys(users).some((key) => key.endsWith(`|${user}`));
+}
+function hasUserEmailEntry(users, user) {
+	return Object.values(users).some((entry) => entry?.email === user);
+}
+/**
+* Check whether any platform has tokens registered for a user.
+* @param config - Platform config
+* @param user - User name
+* @returns True when the user has a token entry for any platform
+*/
+function hasAnyUserTokenEntry(config, user) {
+	return hasUserKeyForName(config.users, user) || hasUserEmailEntry(config.users, user);
+}
+function hasCurrentUserEntry(users, currentUser) {
+	return hasUserKeyForName(users, currentUser);
+}
+/**
+* Migrate a v1 config to v2.
+* Tokens are kept in the config file (storage: "file") during migration.
+* They will be moved to the OS keyring on next login or token refresh.
+* @param v1Config - v1 configuration to migrate
+* @returns Migrated v2 configuration
+*/
+function migrateV1ToV2(v1Config) {
+	const users = {};
+	for (const [name, v1User] of Object.entries(v1Config.users)) {
+		if (!v1User) continue;
+		users[name] = {
+			access_token: v1User.access_token,
+			refresh_token: v1User.refresh_token,
+			token_expires_at: v1User.token_expires_at,
+			storage: "file"
+		};
 	}
-	const forbidden = segments.find((seg) => FORBIDDEN_SEGMENTS.has(seg));
-	if (forbidden) {
-		ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			message: `Invalid field key: '${key}'. Segment '${forbidden}' is not allowed.`
-		});
-		return z.NEVER;
+	return {
+		version: V2_CONFIG_VERSION,
+		min_sdk_version: V2_MIN_SDK_VERSION,
+		users,
+		profiles: v1Config.profiles,
+		current_user: v1Config.current_user
+	};
+}
+function inferEmailFromUserId(user) {
+	return z.email().safeParse(user).success ? user : void 0;
+}
+function migrateV2ToV3(v2Config) {
+	const users = {};
+	for (const [user, entry] of Object.entries(v2Config.users)) {
+		if (!entry) continue;
+		const email = inferEmailFromUserId(user);
+		users[user] = {
+			...entry,
+			...email ? { email } : {}
+		};
 	}
 	return {
-		path: segments,
-		value: val.slice(eq + 1)
+		version: LATEST_CONFIG_VERSION,
+		min_sdk_version: V3_MIN_SDK_VERSION,
+		users,
+		profiles: v2Config.profiles,
+		current_user: v2Config.current_user
 	};
-});
-const apiCommand = defineAppCommand({
-	name: "api",
-	description: "Call Tailor Platform API endpoints directly.",
-	notes: `Use \`tailor api list\` to enumerate invocable methods and \`tailor api inspect <endpoint>\` to print an endpoint's input message tree (combine with \`--json\` for machine-readable output).
-
-The request body is inferred from the target endpoint's request schema, and commonly required fields are auto-injected so they can be omitted from \`--body\`:
-
-- \`workspaceId\` — resolved from \`-w\` / \`TAILOR_PLATFORM_WORKSPACE_ID\` / the selected profile.
-- \`namespaceName\` — resolved from \`tailor.config.ts\` based on the endpoint's service:
-  - Auth / Tenant / UserProfile endpoints use \`auth.name\`.
-  - IdP / TailorDB / Pipeline endpoints use the sole configured namespace when exactly one is defined.
-
-Values already present in \`--body\` are never overridden. If a value cannot be resolved (e.g. no config found), injection is silently skipped and the server-side validation error takes precedence.
-
-Use \`--field key=value\` (repeatable) to set request body fields without writing JSON. Dotted keys (e.g. \`application.name=foo\`) build nested objects. \`--field\` overrides matching fields in \`--body\` and tab-completes from the endpoint's request schema.`,
-	examples: [
-		{
-			cmd: "GetApplication -b '{\"applicationName\":\"app-1\"}'",
-			desc: "Call an endpoint; workspaceId is auto-injected."
-		},
-		{
-			cmd: "GetApplication -f applicationName=app-1",
-			desc: "Same as above, using --field instead of --body."
-		},
-		{
-			cmd: "list",
-			desc: "List all invocable OperatorService methods."
-		},
-		{
-			cmd: "inspect GetApplication",
-			desc: "Show the input message tree for an endpoint."
-		}
-	],
-	subCommands: {
-		list: listCommand$10,
-		inspect: inspectCommand
-	},
-	args: z.strictObject({
-		...workspaceArgs,
-		...configArg,
-		body: arg(z.string().default("{}"), {
-			alias: "b",
-			description: "Request body as JSON."
-		}),
-		field: arg(fieldArg.array().optional(), {
-			alias: "f",
-			description: "Set a body field as `key=value` (repeatable; dotted keys nest). Overrides --body.",
-			completion: { custom: { expand: {
-				dependsOn: ["endpoint"],
-				enumerate: ({ endpoint }) => enumerateAllFieldCompletions(extractMethodName(endpoint ?? ""))
-			} } }
-		}),
-		endpoint: arg(z.string(), {
-			positional: true,
-			description: "API endpoint to call (e.g., 'GetApplication' or 'tailor.v1.OperatorService/GetApplication').",
-			completion: { custom: { choices: listMethodChoices() } }
-		})
-	}),
-	run: async (args) => {
-		await assertWritable({ profile: args.profile });
-		const methodName = extractMethodName(args.endpoint);
-		const method = getMethodDescriptor(methodName);
-		const parsedBody = parseBodyAsObject(args.body);
-		let mutated = false;
-		if (args.field && args.field.length > 0) {
-			if (!parsedBody) throw new Error("--field requires --body to be a JSON object (or omitted).");
-			for (const f of args.field) {
-				const leaf = method ? resolveLeafField(method.input, f.path) : void 0;
-				setNestedPath(parsedBody, f.path, coerceFieldValue(leaf, f.value));
-			}
-			mutated = true;
+}
+function migrateV1ToV3(v1Config) {
+	return migrateV2ToV3(migrateV1ToV2(v1Config));
+}
+function formatUnknownError(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+async function trySaveTokensInKeyring(user, tokens) {
+	if (!await isKeyringAvailable()) return false;
+	try {
+		await saveKeyringTokens(user, tokens);
+		return true;
+	} catch (error) {
+		logger.warn(`System keyring failed to store credentials. Tokens will be stored in the config file. ${formatUnknownError(error)}`);
+		return false;
+	}
+}
+async function warnIfNewerConfigAvailable(config) {
+	if (!config.latest_min_sdk_version) return;
+	if (lt((await readPackageJson()).version ?? "0.0.0", config.latest_min_sdk_version)) logger.warn(multiline`
+      A newer config version (${String(config.latest_version)}) is available.
+      Please update your SDK to >= ${config.latest_min_sdk_version}: pnpm update @tailor-platform/sdk
+    `);
+}
+/**
+* Read Tailor Platform CLI configuration, migrating from v1 if necessary.
+* @returns Parsed platform configuration
+*/
+async function readPlatformConfig() {
+	const configPath = platformConfigPath();
+	if (!fs$2.existsSync(configPath)) {
+		const config = {
+			version: LATEST_CONFIG_VERSION,
+			min_sdk_version: V3_MIN_SDK_VERSION,
+			users: {},
+			profiles: {},
+			current_user: null
+		};
+		writePlatformConfig(config);
+		return config;
+	}
+	const rawConfig = parseYAML(fs$2.readFileSync(configPath, "utf-8"));
+	tightenSecretFilePermissions(configPath);
+	const version = rawConfig != null && typeof rawConfig === "object" && "version" in rawConfig ? rawConfig.version : void 0;
+	if (typeof version === "number" && version > LATEST_CONFIG_VERSION) {
+		const minSdk = "min_sdk_version" in rawConfig ? String(rawConfig.min_sdk_version) : void 0;
+		const updateHint = minSdk ? `Please update your SDK to >= ${minSdk}: pnpm update @tailor-platform/sdk` : "Please update your SDK: pnpm update @tailor-platform/sdk";
+		throw new Error(multiline`
+      Config file uses version ${String(version)}, but this SDK only supports up to version ${String(LATEST_CONFIG_VERSION)}.
+      ${updateHint}
+    `);
+	}
+	const v3Result = pfConfigSchemaV3.safeParse(rawConfig);
+	if (v3Result.success) {
+		await warnIfNewerConfigAvailable(v3Result.data);
+		return v3Result.data;
+	}
+	const v2Result = pfConfigSchemaV2.safeParse(rawConfig);
+	if (v2Result.success) {
+		await warnIfNewerConfigAvailable(v2Result.data);
+		return migrateV2ToV3(v2Result.data);
+	}
+	const v1Result = pfConfigSchemaV1.safeParse(rawConfig);
+	if (v1Result.success) return migrateV1ToV3(v1Result.data);
+	throw new Error(multiline`
+    Failed to parse config file at ${configPath}.
+    The file may be corrupted or created by an incompatible SDK version.
+  `);
+}
+function toV1ForDisk(config) {
+	const users = {};
+	for (const [name, entry] of Object.entries(config.users)) {
+		if (!entry || entry.storage === "keyring") continue;
+		users[name] = {
+			access_token: entry.access_token,
+			refresh_token: entry.refresh_token,
+			token_expires_at: entry.token_expires_at
+		};
+	}
+	const currentUser = config.current_user && hasCurrentUserEntry(users, config.current_user) ? config.current_user : null;
+	return {
+		version: 1,
+		users,
+		profiles: config.profiles,
+		current_user: currentUser
+	};
+}
+function hasProfilePlatformSettings(config) {
+	return Object.values(config.profiles).some((profile) => profile?.platform_url !== void 0 || profile?.oauth2_client_id !== void 0 || profile?.console_url !== void 0);
+}
+function hasScopedUserKeys(config) {
+	return Object.keys(config.users).some((userKey) => userKey.includes("|"));
+}
+function hasUserEmailMetadata(config) {
+	return Object.values(config.users).some((user) => user != null && "email" in user && user.email !== void 0);
+}
+function toLatestForDisk(config) {
+	return {
+		...config.version === 1 ? migrateV1ToV2(config) : config,
+		version: LATEST_CONFIG_VERSION,
+		min_sdk_version: V3_MIN_SDK_VERSION
+	};
+}
+/**
+* Write Tailor Platform CLI configuration to disk.
+* By default, file-backed configs without newer fields are converted to V1 for
+* backward compatibility, so an older SDK can still read the file. Configs
+* containing a keyring user are kept in V2 or later because the keyring storage
+* variant is not representable in V1. Configs containing profile-level Platform
+* settings, platform-scoped user tokens, canonical user IDs, or email metadata
+* are written in the latest min-SDK-gated format because older SDKs would
+* silently drop or misread those settings.
+*
+* The config file may contain access/refresh tokens when the OS keyring is
+* unavailable, so it is written via {@link writeSecretFile} so other users
+* on the host cannot read it.
+* @param config - Platform configuration to write
+*/
+function writePlatformConfig(config) {
+	const configPath = platformConfigPath();
+	const hasKeyringUser = config.version !== 1 && Object.values(config.users).some((u) => u?.storage === "keyring");
+	writeSecretFile(configPath, stringifyYAML(config.version === LATEST_CONFIG_VERSION || hasProfilePlatformSettings(config) || hasScopedUserKeys(config) || hasUserEmailMetadata(config) ? toLatestForDisk(config) : config.version === V2_CONFIG_VERSION && !hasKeyringUser ? toV1ForDisk(config) : config));
+}
+function validateUUID(value, source) {
+	const result = z.uuid().safeParse(value);
+	if (!result.success) throw new Error(`Invalid value from ${source}: must be a valid UUID`);
+	return result.data;
+}
+/**
+* Load workspace ID from command options, environment variables, or platform config.
+* In CLI context, env fallback is also handled by politty's arg env option.
+* Priority: opts/workspaceId > env/workspaceId > opts/profile > error
+* @param opts - Workspace and profile options
+* @returns Resolved workspace ID
+*/
+async function loadWorkspaceId(opts) {
+	const workspaceId = await tryLoadWorkspaceId(opts);
+	if (workspaceId) return workspaceId;
+	throw new Error(multiline`
+    Workspace ID not found.
+    Please specify workspace ID via --workspace-id option or TAILOR_PLATFORM_WORKSPACE_ID environment variable.
+  `);
+}
+/**
+* Load a workspace ID when one is explicitly configured.
+* @param opts - Workspace and profile options
+* @returns Resolved workspace ID, or undefined when no source is configured
+*/
+async function tryLoadWorkspaceId(opts) {
+	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
+	if (opts?.workspaceId !== void 0) return validateUUID(opts.workspaceId, "--workspace-id option");
+	if (process.env.TAILOR_PLATFORM_WORKSPACE_ID) return validateUUID(process.env.TAILOR_PLATFORM_WORKSPACE_ID, "TAILOR_PLATFORM_WORKSPACE_ID environment variable");
+	if (profile) {
+		const wsId = (await readPlatformConfig()).profiles[profile]?.workspace_id;
+		if (!wsId) throw new Error(`Profile "${profile}" not found`);
+		return validateUUID(wsId, `profile "${profile}"`);
+	}
+}
+/**
+* Load machine user name from command options, environment variables, or platform config.
+* In CLI context, env fallback is also handled by politty's arg env option.
+* Priority: opts/machineUser > env/TAILOR_PLATFORM_MACHINE_USER_NAME > opts/profile (profile default) > undefined.
+* An explicitly empty `opts.machineUser` is rejected with a CLIError (`MACHINE_USER_NAME_EMPTY`) rather than falling back to the env var or profile default.
+* When the active profile has `machine_user_override: "deny"`, an explicit value that differs from the profile's machine user throws a CLIError with code `PROFILE_MACHINE_USER_OVERRIDE_DENIED`.
+* @param opts - Machine user and profile options
+* @returns Resolved machine user name, or undefined if not set
+*/
+async function loadMachineUserName(opts) {
+	if (opts?.machineUser === "") throw createCLIError({
+		code: "MACHINE_USER_NAME_EMPTY",
+		message: "Machine user name cannot be empty.",
+		suggestion: "Pass a non-empty machine user name, or omit the option to use the environment variable or profile default."
+	});
+	const envMachineUser = process.env.TAILOR_PLATFORM_MACHINE_USER_NAME || void 0;
+	const explicitMachineUser = opts?.machineUser ? {
+		source: opts.machineUserSource ?? "option",
+		value: opts.machineUser
+	} : envMachineUser ? {
+		source: "env",
+		value: envMachineUser
+	} : void 0;
+	const explicit = explicitMachineUser?.value;
+	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
+	if (!profile) return explicit;
+	const entry = (await readPlatformConfig()).profiles[profile];
+	if (!entry) {
+		if (explicit) return explicit;
+		throw new Error(`Profile "${profile}" not found`);
+	}
+	if (entry.machine_user && entry.machine_user_override === "deny") {
+		if (explicit && explicit !== entry.machine_user) {
+			const details = explicitMachineUser.source === "env" ? `The machine user is being set to "${explicit}" via the TAILOR_PLATFORM_MACHINE_USER_NAME environment variable, which conflicts with this profile's pinned machine user "${entry.machine_user}".` : `This profile fixes the machine user to "${entry.machine_user}" for application-data commands.`;
+			throw createCLIError({
+				code: "PROFILE_MACHINE_USER_OVERRIDE_DENIED",
+				message: `Profile "${profile}" denies overriding the machine user.`,
+				details,
+				suggestion: `Omit the machine user option, unset TAILOR_PLATFORM_MACHINE_USER_NAME, or run 'tailor profile update ${profile} --machine-user-override allow'.`
+			});
 		}
-		if (parsedBody && method) {
-			if (normalizeBodyFieldKeys(parsedBody, method.input.fields)) mutated = true;
-			const fieldNames = method.input.fields.map((f) => f.localName);
-			if (fieldNames.includes("workspaceId") && !Object.hasOwn(parsedBody, "workspaceId")) try {
-				parsedBody.workspaceId = await loadWorkspaceId({
-					workspaceId: args["workspace-id"],
-					profile: args.profile
-				});
-				mutated = true;
-			} catch {}
-			if (fieldNames.includes("namespaceName") && !Object.hasOwn(parsedBody, "namespaceName")) try {
-				const { config } = await loadConfig(args.config);
-				const ns = resolveNamespaceName(methodName, config);
-				if (ns) {
-					parsedBody.namespaceName = ns;
-					mutated = true;
-				}
-			} catch {}
+		return entry.machine_user;
+	}
+	return explicit || entry.machine_user;
+}
+/**
+* Load access token from environment variables, command options, or platform config.
+* In CLI context, profile env fallback is also handled by politty's arg env option.
+* Priority: env/TAILOR_PLATFORM_TOKEN > env/TAILOR_TOKEN (deprecated) > opts/profile > env/profile > config/currentUser > error
+* @param opts - Profile options
+* @returns Resolved access token
+*/
+async function loadAccessToken(opts) {
+	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
+	const envToken = process.env.TAILOR_PLATFORM_TOKEN ?? process.env.TAILOR_TOKEN;
+	if (envToken && !process.env.TAILOR_PLATFORM_TOKEN) logger.warn("TAILOR_TOKEN is deprecated. Please use TAILOR_PLATFORM_TOKEN instead.");
+	if (envToken) {
+		rememberPlatformConfigForToken(envToken, await loadPlatformClientConfig({
+			profile,
+			allowMissingProfile: true
+		}));
+		return envToken;
+	}
+	const pfConfig = await readPlatformConfig();
+	const profileEntry = profile ? pfConfig.profiles[profile] : void 0;
+	if (profile && !profileEntry) throw new Error(`Profile "${profile}" not found`);
+	const user = profileEntry?.user ?? pfConfig.current_user;
+	if (!user) throw new Error(multiline`
+      Tailor Platform token not found.
+      Please specify token via TAILOR_PLATFORM_TOKEN environment variable or login using 'tailor login' command.
+    `);
+	return (await fetchLatestToken(pfConfig, user, profileEntry ? platformConfigFromProfile(profileEntry) : void 0)).accessToken;
+}
+/**
+* Load platform connection settings from the active profile.
+* @param opts - Profile options
+* @returns Resolved platform connection settings, or undefined for the default environment
+*/
+async function loadPlatformClientConfig(opts) {
+	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
+	if (!profile) return;
+	let pfConfig;
+	try {
+		pfConfig = await readPlatformConfig();
+	} catch (error) {
+		if (opts?.allowMissingProfile) return;
+		throw error;
+	}
+	const profileEntry = pfConfig.profiles[profile];
+	if (!profileEntry) {
+		if (opts?.allowMissingProfile) return;
+		throw new Error(`Profile "${profile}" not found`);
+	}
+	return platformConfigFromProfile(profileEntry);
+}
+/**
+* Load the Tailor Platform Console base URL from environment variables or the active profile.
+* @param opts - Profile options
+* @returns Resolved Console base URL
+*/
+async function loadConsoleBaseUrl(opts) {
+	return getConsoleBaseUrl(await loadPlatformClientConfig(opts));
+}
+/**
+* Resolve the actual token values for a user, reading from keyring or config as appropriate.
+* @param userEntry - User entry from the config
+* @param user - User identifier
+* @param label - User-facing identifier used in error messages
+* @returns Access token and optional refresh token
+*/
+async function resolveTokens(userEntry, user, label = user) {
+	if (userEntry.storage === "keyring") {
+		const tokens = await loadKeyringTokens(user);
+		if (!tokens) throw new Error(multiline`
+        Credentials not found in OS keyring for "${label}".
+        Please run 'tailor login' and try again.
+      `);
+		return tokens;
+	}
+	return {
+		accessToken: userEntry.access_token,
+		refreshToken: userEntry.refresh_token
+	};
+}
+/**
+* Save tokens for a user, writing to keyring by default when available.
+* @param config - Platform config
+* @param user - User identifier
+* @param tokens - Token data to save
+* @param tokens.accessToken - Access token to save
+* @param tokens.refreshToken - Optional refresh token to save
+* @param expiresAt - Token expiration date
+* @param opts - Optional platform and user metadata
+*/
+async function saveUserTokens(config, user, tokens, expiresAt, opts = {}) {
+	const userKey = platformUserKey(user, opts.platformConfig);
+	const email = opts.email ?? config.users[userKey]?.email;
+	if (await trySaveTokensInKeyring(userKey, tokens)) config.users[userKey] = {
+		token_expires_at: expiresAt,
+		storage: "keyring",
+		...email ? { email } : {}
+	};
+	else {
+		if (config.users[userKey]?.storage === "keyring") await deleteKeyringTokens(userKey);
+		config.users[userKey] = {
+			access_token: tokens.accessToken,
+			refresh_token: tokens.refreshToken,
+			token_expires_at: expiresAt,
+			storage: "file",
+			...email ? { email } : {}
+		};
+	}
+}
+/**
+* Delete tokens for a user from keyring if applicable.
+* @param config - Platform config
+* @param user - User identifier
+* @param platformConfig - Optional platform connection settings
+* @param opts - Token lookup options
+*/
+async function deleteUserTokens(config, user, platformConfig, opts) {
+	const { userKey, userEntry } = findUserEntry(config, user, platformConfig, opts);
+	if (userEntry?.storage === "keyring") await deleteKeyringTokens(userKey);
+	delete config.users[userKey];
+}
+/**
+* Resolve stored tokens for a user on the selected platform.
+* @param config - Platform config
+* @param user - User name
+* @param platformConfig - Optional platform connection settings
+* @param opts - Token lookup options
+* @returns Stored user entry and token values, or undefined when the user is not logged in
+*/
+async function loadStoredUserTokens(config, user, platformConfig, opts) {
+	const { userKey, userEntry } = findUserEntry(config, user, platformConfig, opts);
+	if (!userEntry) return void 0;
+	return {
+		userEntry,
+		...await resolveTokens(userEntry, userKey, user)
+	};
+}
+function updateUserReferences(config, fromUser, toUser) {
+	if (fromUser === toUser) return;
+	if (config.current_user === fromUser) config.current_user = toUser;
+	for (const profile of Object.values(config.profiles)) if (profile?.user === fromUser) profile.user = toUser;
+}
+/**
+* Remove a legacy alias after a canonical user ID has been written.
+* @param config - Platform config
+* @param legacyUser - Previous user key
+* @param canonicalUser - Canonical user key
+* @param platformConfig - Platform settings for scoped token storage
+*/
+async function removeLegacyUserAlias(config, legacyUser, canonicalUser, platformConfig) {
+	if (legacyUser === canonicalUser) return;
+	updateUserReferences(config, legacyUser, canonicalUser);
+	const canonicalKey = platformUserKey(canonicalUser, platformConfig);
+	const legacyKeys = /* @__PURE__ */ new Set([legacyUser, platformUserKey(legacyUser, platformConfig)]);
+	for (const legacyKey of legacyKeys) {
+		if (legacyKey === canonicalKey) continue;
+		if (config.users[legacyKey]?.storage === "keyring") await deleteKeyringTokens(legacyKey);
+		delete config.users[legacyKey];
+	}
+}
+function shouldResolveSubjectOnRefresh(user, userEntry) {
+	return Boolean(userEntry.email || inferEmailFromUserId(user));
+}
+/**
+* Fetch the latest access token, refreshing if necessary.
+* @param config - Platform config
+* @param user - User identifier
+* @param platformConfig - Optional platform connection settings
+* @returns Latest access token and the canonical user ID it is stored under
+*   (the resolved subject when a legacy email key was migrated during refresh,
+*   otherwise the matching config user)
+*/
+async function fetchLatestToken(config, user, platformConfig) {
+	const { userKey: storedUser, userEntry } = findUserEntry(config, user, platformConfig);
+	if (!userEntry) throw new Error(multiline`
+      User "${user}" not found.
+      Please verify your user name and login using 'tailor login' command.
+    `);
+	const storedConfigUser = userFromPlatformUserKey(storedUser, platformConfig);
+	const tokens = await resolveTokens(userEntry, storedUser, user);
+	if (new Date(userEntry.token_expires_at) > /* @__PURE__ */ new Date()) {
+		rememberPlatformConfigForToken(tokens.accessToken, platformConfig);
+		return {
+			accessToken: tokens.accessToken,
+			user: storedConfigUser
+		};
+	}
+	if (!tokens.refreshToken) throw new Error(multiline`
+      Token expired.
+      Please run 'tailor login' and try again.
+    `);
+	const client = initOAuth2Client(platformConfig);
+	let resp;
+	try {
+		resp = await client.refreshToken({
+			accessToken: tokens.accessToken,
+			refreshToken: tokens.refreshToken,
+			expiresAt: Date.parse(userEntry.token_expires_at)
+		});
+	} catch {
+		throw new Error(multiline`
+      Failed to refresh token. Your session may have expired.
+      Please run 'tailor login' and try again.
+    `);
+	}
+	const newExpiresAt = new Date(assertDefined(resp.expiresAt, "token refresh response missing expiresAt")).toISOString();
+	let resolvedUser = storedConfigUser;
+	const previousEmail = userEntry.email ?? inferEmailFromUserId(user) ?? inferEmailFromUserId(storedConfigUser);
+	let email = previousEmail;
+	if (shouldResolveSubjectOnRefresh(user, userEntry) || shouldResolveSubjectOnRefresh(storedConfigUser, userEntry)) try {
+		const userInfo = await fetchUserInfo(resp.accessToken, platformConfig);
+		resolvedUser = userInfo.sub;
+		email = userInfo.email;
+	} catch (error) {
+		logger.debug(`Failed to resolve refreshed token user info: ${String(error)}`);
+	}
+	await saveUserTokens(config, resolvedUser, {
+		accessToken: resp.accessToken,
+		refreshToken: resp.refreshToken ?? void 0
+	}, newExpiresAt, {
+		platformConfig,
+		email
+	});
+	await removeLegacyUserAlias(config, user, resolvedUser, platformConfig);
+	if (storedUser !== platformUserKey(resolvedUser, platformConfig)) {
+		if (config.users[storedUser]?.storage === "keyring") await deleteKeyringTokens(storedUser);
+		delete config.users[storedUser];
+	}
+	if (previousEmail && email && previousEmail !== email) logger.info(`Updated local user email from "${previousEmail}" to "${email}".`);
+	writePlatformConfig(config);
+	rememberPlatformConfigForToken(resp.accessToken, platformConfig);
+	return {
+		accessToken: resp.accessToken,
+		user: resolvedUser
+	};
+}
+const DEFAULT_CONFIG_FILENAME = "tailor.config.ts";
+/**
+* Load config path from command options, environment variables, or search parent directories.
+* In CLI context, env fallback is also handled by politty's arg env option.
+* Priority: opts/config > env/config > search parent directories
+* @param configPath - Optional explicit config path
+* @returns Resolved config path or undefined
+*/
+function loadConfigPath(configPath) {
+	if (configPath) return configPath;
+	if (process.env.TAILOR_CONFIG_PATH) return process.env.TAILOR_CONFIG_PATH;
+	return findUpSync(DEFAULT_CONFIG_FILENAME);
+}
+
+//#endregion
+//#region src/cli/shared/mock.ts
+/**
+* Install a stub `globalThis.tailordb` so that user code loaded by the CLI
+* (e.g. via `createGetDB` in `@tailor-platform/sdk/kysely`) can reference
+* `tailordb.Client` without hitting a `ReferenceError`. The CLI never
+* actually executes the user code paths that issue queries, so a no-op
+* client suffices.
+*
+* Exposed as a function (rather than a top-level statement) so that
+* `package.json#sideEffects` can keep the file marked side-effect-free
+* without bundlers eliminating the install step.
+*/
+function installCliTailordbStub() {
+	globalThis.tailordb = { Client: class {
+		constructor(_config) {}
+		async connect() {}
+		async end() {}
+		async queryObject() {
+			return {};
 		}
-		const result = await apiCall({
-			profile: args.profile,
-			endpoint: args.endpoint,
-			body: mutated && parsedBody ? JSON.stringify(parsedBody) : args.body
+	} };
+}
+
+//#endregion
+//#region src/cli/shared/config-loader.ts
+/**
+* Load Tailor configuration file and associated plugins.
+* @param configPath - Optional explicit config path
+* @param options - Optional module import behavior.
+* @returns Loaded config, plugins, and config path
+*/
+async function loadConfig(configPath, options = {}) {
+	installCliTailordbStub();
+	const foundPath = loadConfigPath(configPath);
+	if (!foundPath) throw new Error("Configuration file not found: tailor.config.ts not found in current or parent directories");
+	const resolvedPath = path.resolve(process.cwd(), foundPath);
+	if (!fs$2.existsSync(resolvedPath)) throw new Error(`Configuration file not found: ${configPath}`);
+	const configUrl = pathToFileURL(resolvedPath);
+	if (options.importNonce) configUrl.searchParams.set("tailorImportNonce", options.importNonce);
+	const configModule = await import(configUrl.href);
+	if (!configModule || !configModule.default) throw new Error("Invalid Tailor config module: default export not found");
+	const validated = AppConfigSchema.safeParse(configModule.default);
+	if (!validated.success) {
+		const issues = validated.error.issues.map((i) => `  - ${i.path.join(".") || "(root)"}: ${i.message}`).join("\n");
+		throw new Error(`Invalid Tailor config in ${resolvedPath}:\n${issues}`);
+	}
+	const allPlugins = [];
+	for (const value of Object.values(configModule)) if (Array.isArray(value)) {
+		const pluginParsed = value.reduce((acc, item) => {
+			if (!acc.success) return acc;
+			const result = PluginConfigSchema.safeParse(item);
+			if (result.success) acc.items.push(result.data);
+			else acc.success = false;
+			return acc;
+		}, {
+			success: true,
+			items: []
 		});
-		logger.out(JSON.stringify(result.data, null, 2));
+		if (pluginParsed.success && pluginParsed.items.length > 0) allPlugins.push(...pluginParsed.items);
 	}
-});
+	return {
+		config: {
+			...configModule.default,
+			path: resolvedPath
+		},
+		plugins: allPlugins
+	};
+}
+
+//#endregion
+//#region src/cli/shared/readonly-guard.ts
+/**
+* Throw a CLIError if the active profile has `readonly: true`.
+*
+* Resolves the active profile in this order:
+* 1. `opts.profile` (CLI flag)
+* 2. `process.env.TAILOR_PLATFORM_PROFILE`
+*
+* If neither is set, no profile is in scope so the call is allowed. This is
+* intentional: `TAILOR_PLATFORM_TOKEN` direct access (CI / machine user) and
+* `--workspace-id` without a profile are out-of-band paths whose authorization
+* is governed by the bearer token itself, not by the local profile flag.
+*
+* If the resolved profile cannot be found in the config, this function returns
+* silently and lets downstream loaders surface the not-found error.
+* @param opts - Options
+* @param opts.profile - Optional explicit profile name from command args
+*/
+async function assertWritable(opts) {
+	const profileName = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
+	if (!profileName) return;
+	const profile = (await readPlatformConfig()).profiles[profileName];
+	if (!profile || profile.readonly !== true) return;
+	throw createCLIError({
+		code: "PROFILE_READONLY",
+		message: `Profile "${profileName}" is read-only.`,
+		details: "This profile blocks platform-state mutations (apply, create/update/delete, deploy, etc.). Application-data operations remain available because their permissions are governed by the machine user.",
+		suggestion: `Use a different profile, unset TAILOR_PLATFORM_PROFILE, or run 'tailor profile update ${profileName} --permission write'.`
+	});
+}
+
+//#endregion
+//#region src/cli/commands/api/api-call.ts
+function hasEnvAccessToken() {
+	const envToken = process.env.TAILOR_PLATFORM_TOKEN ?? process.env.TAILOR_TOKEN;
+	return Boolean(envToken);
+}
+/**
+* Call Tailor Platform API endpoints directly.
+* If the endpoint doesn't contain "/", it defaults to `tailor.v1.OperatorService/{endpoint}`.
+* @param options - API call options (profile, endpoint, body)
+* @returns Response status and data
+*/
+async function apiCall(options) {
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	let platformConfig;
+	try {
+		platformConfig = await loadPlatformClientConfig({ profile: options.profile });
+	} catch (error) {
+		if (!hasEnvAccessToken()) throw error;
+	}
+	let endpointPath;
+	if (options.endpoint.includes("/")) endpointPath = options.endpoint;
+	else endpointPath = `tailor.v1.OperatorService/${options.endpoint}`;
+	const url = new URL(endpointPath, getPlatformBaseUrl(platformConfig));
+	const response = await fetch(url.toString(), {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			Authorization: `Bearer ${accessToken}`,
+			"User-Agent": await userAgent()
+		},
+		body: options.body ?? "{}"
+	});
+	const data = await response.json();
+	if (!response.ok) throw new Error(`API call failed (${response.status}): ${JSON.stringify(data)}`);
+	return {
+		status: response.status,
+		data
+	};
+}
 
 //#endregion
 //#region src/cli/shared/prompt.ts
+function canPrompt() {
+	return !isCI && process.stdin.isTTY === true && process.stdout.isTTY === true && !logger.jsonMode;
+}
 /**
 * Wraps a prompt function with CI guard and cancellation handling.
 * @param fn - A prompt function from `@inquirer/prompts`
+* @param unavailableMessage - Message used when interactive input is unavailable
 * @returns A wrapped function that throws in CI and exits on cancel
 */
-function withGuard(fn) {
+function withGuard(fn, unavailableMessage) {
 	return async (...args) => {
-		if (isCI) throw new CIPromptError();
+		if (!canPrompt()) throw new CIPromptError(unavailableMessage);
 		try {
 			return await fn(...args);
 		} catch (error) {
@@ -703,9 +1273,10 @@ function withGuard(fn) {
 	};
 }
 const prompt = {
-	confirm: withGuard(confirm),
+	confirm: withGuard(confirm, "Interactive confirmations are not available in this environment. Use --yes to skip confirmation prompts, or provide the required options explicitly."),
 	text: withGuard(input),
-	password: withGuard(password)
+	password: withGuard(password),
+	select: withGuard(select)
 };
 
 //#endregion
@@ -750,7 +1321,7 @@ function createCacheStore(config) {
 	}
 	function loadManifest() {
 		try {
-			const raw = fs$1.readFileSync(manifestPath(), "utf-8");
+			const raw = fs$2.readFileSync(manifestPath(), "utf-8");
 			const result = cacheManifestSchema.safeParse(JSON.parse(raw));
 			if (!result.success) {
 				cachedManifest = void 0;
@@ -777,15 +1348,15 @@ function createCacheStore(config) {
 		return cachedManifest;
 	}
 	function saveManifest(manifest) {
-		fs$1.mkdirSync(config.cacheDir, { recursive: true });
+		fs$2.mkdirSync(config.cacheDir, { recursive: true });
 		const target = manifestPath();
 		const tmpFile = path.join(config.cacheDir, `.manifest.${process.pid}.tmp`);
 		try {
-			fs$1.writeFileSync(tmpFile, JSON.stringify(manifest, null, 2), "utf-8");
-			fs$1.renameSync(tmpFile, target);
+			fs$2.writeFileSync(tmpFile, JSON.stringify(manifest, null, 2), "utf-8");
+			fs$2.renameSync(tmpFile, target);
 		} catch (e) {
 			try {
-				fs$1.rmSync(tmpFile, { force: true });
+				fs$2.rmSync(tmpFile, { force: true });
 			} catch {}
 			throw e;
 		}
@@ -804,19 +1375,19 @@ function createCacheStore(config) {
 	}
 	function storeBundleContent(cacheKey, content) {
 		const dir = bundlesDir();
-		fs$1.mkdirSync(dir, { recursive: true });
-		fs$1.writeFileSync(bundlePath(cacheKey), content, "utf-8");
+		fs$2.mkdirSync(dir, { recursive: true });
+		fs$2.writeFileSync(bundlePath(cacheKey), content, "utf-8");
 	}
 	function restoreBundleContent(cacheKey) {
 		try {
-			return fs$1.readFileSync(bundlePath(cacheKey), "utf-8");
+			return fs$2.readFileSync(bundlePath(cacheKey), "utf-8");
 		} catch (e) {
 			if (e.code === "ENOENT") return void 0;
 			throw e;
 		}
 	}
 	function clean() {
-		fs$1.rmSync(config.cacheDir, {
+		fs$2.rmSync(config.cacheDir, {
 			recursive: true,
 			force: true
 		});
@@ -910,7 +1481,7 @@ function extractAttributesFromConfig(config) {
 * @returns Generated type definition source
 */
 function generateTypeDefinition(attributes, attributeList, env, machineUserNames, idpNames, connectionNames, aiGatewayNames) {
-	const attributeFields = attributes ? Object.entries(attributes).map(([key, value]) => `    ${key}: ${value};`).join("\n") : "";
+	const attributeFields = attributes ? Object.entries(attributes).map(([key, { type, optional }]) => `    ${key}${optional ? "?" : ""}: ${type};`).join("\n") : "";
 	const attributesBody = !attributes || Object.keys(attributes).length === 0 ? "{}" : `{
 ${attributeFields}
   }`;
@@ -973,12 +1544,15 @@ function collectAttributesFromConfig(config) {
 	const inferAttributeType = (field) => {
 		const type = field?.type;
 		const metadata = field?.metadata;
-		if (!metadata) return "string";
+		if (!metadata) return { type: "string" };
 		let typeStr = "string";
 		if (type === "boolean") typeStr = "boolean";
 		else if (type === "enum" && metadata.allowedValues) typeStr = metadata.allowedValues.map((v) => `"${v.value}"`).join(" | ");
 		if (metadata.array) typeStr = typeStr.includes(" | ") ? `(${typeStr})[]` : `${typeStr}[]`;
-		return typeStr;
+		return {
+			type: typeStr,
+			optional: metadata.required === false
+		};
 	};
 	if ("userProfile" in auth) {
 		const userProfile = auth.userProfile;
@@ -1057,8 +1631,8 @@ async function generateUserTypes(options) {
 		if (env) logger.debug(`Extracted Env: ${JSON.stringify(env)}`);
 		const typeDefContent = generateTypeDefinition(attributes, attributeList, env, machineUserNames, idpNames, connectionNames, aiGatewayNames);
 		const outputPath = resolveTypeDefinitionPath(configPath);
-		fs$1.mkdirSync(path.dirname(outputPath), { recursive: true });
-		fs$1.writeFileSync(outputPath, typeDefContent);
+		fs$2.mkdirSync(path.dirname(outputPath), { recursive: true });
+		fs$2.writeFileSync(outputPath, typeDefContent);
 		const relativePath = path.relative(process.cwd(), outputPath);
 		logger.newline();
 		logger.success(`Generated type definitions: ${relativePath}`, { mode: "plain" });
@@ -2559,7 +3133,7 @@ async function applyAuthConnections(client, result, phase) {
 
 //#endregion
 //#region src/cli/commands/deploy/function-registry.ts
-const CHUNK_SIZE = 64 * 1024;
+const CHUNK_SIZE$1 = 64 * 1024;
 /**
 * Compute SHA-256 content hash for a script string.
 * @param content - Script content to hash
@@ -2836,9 +3410,9 @@ async function uploadFunctionScript(client, workspaceId, entry, isCreate) {
 				case: "info",
 				value: info
 			} };
-			for (let i = 0; i < buffer.length; i += CHUNK_SIZE) yield { payload: {
+			for (let i = 0; i < buffer.length; i += CHUNK_SIZE$1) yield { payload: {
 				case: "chunk",
-				value: buffer.subarray(i, Math.min(i + CHUNK_SIZE, buffer.length))
+				value: buffer.subarray(i, Math.min(i + CHUNK_SIZE$1, buffer.length))
 			} };
 		}
 		await client.createFunctionRegistry(createStream());
@@ -2849,9 +3423,9 @@ async function uploadFunctionScript(client, workspaceId, entry, isCreate) {
 				case: "info",
 				value: info
 			} };
-			for (let i = 0; i < buffer.length; i += CHUNK_SIZE) yield { payload: {
+			for (let i = 0; i < buffer.length; i += CHUNK_SIZE$1) yield { payload: {
 				case: "chunk",
-				value: buffer.subarray(i, Math.min(i + CHUNK_SIZE, buffer.length))
+				value: buffer.subarray(i, Math.min(i + CHUNK_SIZE$1, buffer.length))
 			} };
 		}
 		await client.updateFunctionRegistry(updateStream());
@@ -5239,7 +5813,7 @@ function protoExecutor(context, executor) {
 				case: "workflow",
 				value: {
 					workflowName: target.workflowName,
-					variables: target.args ? typeof target.args === "function" ? { expr: `(${stringifyFunction(target.args)})(${argsExpr})` } : { expr: JSON.stringify(target.args) } : void 0,
+					variables: target.args !== void 0 ? typeof target.args === "function" ? { expr: `(${stringifyFunction(target.args)})(${argsExpr})` } : { expr: JSON.stringify(target.args) } : void 0,
 					invoker: normalizeInvoker(target.invoker, authNamespace, invokerContext)
 				}
 			} };
@@ -6928,7 +7502,7 @@ function createSnapshotFromLocalTypes(types, namespace) {
 * @returns {NormalizedSchemaSnapshot} Loaded normalized schema snapshot
 */
 function loadSnapshot(filePath) {
-	const content = fs$1.readFileSync(filePath, "utf-8");
+	const content = fs$2.readFileSync(filePath, "utf-8");
 	let raw;
 	try {
 		raw = JSON.parse(content);
@@ -6946,7 +7520,7 @@ function loadSnapshot(filePath) {
 * @returns {MigrationDiff} Loaded migration diff
 */
 function loadDiff(filePath) {
-	const content = fs$1.readFileSync(filePath, "utf-8");
+	const content = fs$2.readFileSync(filePath, "utf-8");
 	let raw;
 	try {
 		raw = JSON.parse(content);
@@ -6969,8 +7543,8 @@ function loadDiff(filePath) {
 * @returns {Array<{number: number, type: "schema" | "diff", path: string}>} Migration files sorted by number
 */
 function getMigrationFiles(migrationsDir) {
-	if (!fs$1.existsSync(migrationsDir)) return [];
-	const entries = fs$1.readdirSync(migrationsDir, { withFileTypes: true });
+	if (!fs$2.existsSync(migrationsDir)) return [];
+	const entries = fs$2.readdirSync(migrationsDir, { withFileTypes: true });
 	const migrations = [];
 	for (const entry of entries) {
 		if (!entry.isDirectory()) continue;
@@ -6978,13 +7552,13 @@ function getMigrationFiles(migrationsDir) {
 		const num = parseInt(entry.name, 10);
 		const migrationDir = path.join(migrationsDir, entry.name);
 		const schemaPath = path.join(migrationDir, SCHEMA_FILE_NAME);
-		if (fs$1.existsSync(schemaPath)) migrations.push({
+		if (fs$2.existsSync(schemaPath)) migrations.push({
 			number: num,
 			type: "schema",
 			path: schemaPath
 		});
 		const diffPath = path.join(migrationDir, DIFF_FILE_NAME);
-		if (fs$1.existsSync(diffPath)) migrations.push({
+		if (fs$2.existsSync(diffPath)) migrations.push({
 			number: num,
 			type: "diff",
 			path: diffPath
@@ -7750,7 +8324,7 @@ function compareLocalTypesWithSnapshot(snapshot, localTypes, namespace) {
 */
 function validateMigrationFiles(migrationsDir) {
 	const errors = [];
-	if (!fs$1.existsSync(migrationsDir)) return errors;
+	if (!fs$2.existsSync(migrationsDir)) return errors;
 	const migrationFiles = getMigrationFiles(migrationsDir);
 	if (migrationFiles.length === 0) return errors;
 	const schemaFiles = [];
@@ -8987,7 +9561,7 @@ function handleOptionalToRequiredError(error, messages) {
 */
 async function bundleMigrationScript(sourceFile, namespace, migrationNumber, env = {}) {
 	const outputDir = path.resolve(getDistDir(), "migrations");
-	fs$1.mkdirSync(outputDir, { recursive: true });
+	fs$2.mkdirSync(outputDir, { recursive: true });
 	const entryPath = path.join(outputDir, `migration_${namespace}_${migrationNumber}.entry.js`);
 	const entryContent = multiline`
     import { main as _migrationMain } from "${path.resolve(sourceFile).replace(/\\/g, "/")}";
@@ -9009,7 +9583,7 @@ async function bundleMigrationScript(sourceFile, namespace, migrationNumber, env
       return { success: true };
     }
   `;
-	fs$1.writeFileSync(entryPath, entryContent);
+	fs$2.writeFileSync(entryPath, entryContent);
 	let tsconfig;
 	try {
 		tsconfig = await resolveTSConfig();
@@ -9320,10 +9894,10 @@ async function detectPendingMigrations(client, workspaceId, namespacesWithMigrat
 		for (const file of migrationFiles) {
 			if (file.number <= currentMigration) continue;
 			const diffPath = getMigrationFilePath(migrationsDir, file.number, "diff");
-			if (!fs$1.existsSync(diffPath)) continue;
+			if (!fs$2.existsSync(diffPath)) continue;
 			const diff = loadDiff(diffPath);
 			const scriptPath = getMigrationFilePath(migrationsDir, file.number, "migrate");
-			const hasScript = fs$1.existsSync(scriptPath);
+			const hasScript = fs$2.existsSync(scriptPath);
 			if (diff.requiresMigrationScript && !hasScript) {
 				logger.warn(`Migration ${namespace}/${file.number} requires a script but migrate.ts not found`);
 				continue;
@@ -11205,7 +11779,7 @@ function findIdProperty(obj) {
 * @returns Resolved id and whether it was newly injected, or null if skipped
 */
 async function ensureConfigId(configPath) {
-	const source = await fs$1.promises.readFile(configPath, "utf-8");
+	const source = await fs$2.promises.readFile(configPath, "utf-8");
 	const { program } = parseSync(configPath, source);
 	const calls = [];
 	findDefineConfigCalls(program, calls);
@@ -11227,7 +11801,7 @@ async function ensureConfigId(configPath) {
 	}
 	const id = crypto.randomUUID();
 	const newSource = insertIdProperty(source, configObj, id);
-	await fs$1.promises.writeFile(configPath, newSource, "utf-8");
+	await fs$2.promises.writeFile(configPath, newSource, "utf-8");
 	logger.info(`Generated app id and wrote to ${configPath}: ${id}`);
 	return {
 		id,
@@ -11243,7 +11817,7 @@ async function ensureConfigId(configPath) {
 * @returns The existing id (or null when absent), or null for wrapper configs
 */
 async function readConfigId(configPath) {
-	const { program } = parseSync(configPath, await fs$1.promises.readFile(configPath, "utf-8"));
+	const { program } = parseSync(configPath, await fs$2.promises.readFile(configPath, "utf-8"));
 	const calls = [];
 	findDefineConfigCalls(program, calls);
 	if (calls.length === 0) return null;
@@ -11497,188 +12071,1014 @@ async function validatePlan(input) {
 			violations
 		});
 	}
-	function replaces(schema, kind, items) {
-		validateItems({
-			validator,
-			schema,
-			kind,
-			action: "replace",
-			items,
-			requestKey: "createRequest",
-			violations
+	function replaces(schema, kind, items) {
+		validateItems({
+			validator,
+			schema,
+			kind,
+			action: "replace",
+			items,
+			requestKey: "createRequest",
+			violations
+		});
+	}
+	function inPlaceReplaces(schema, kind, items) {
+		validateItems({
+			validator,
+			schema,
+			kind,
+			action: "replace",
+			items,
+			requestKey: "updateRequest",
+			violations
+		});
+	}
+	creates(CreateTailorDBServiceRequestSchema, "TailorDB service", tailorDB.changeSet.service.creates);
+	creates(CreateTailorDBTypeRequestSchema, "TailorDB type", tailorDB.changeSet.type.creates);
+	updates(UpdateTailorDBTypeRequestSchema, "TailorDB type", tailorDB.changeSet.type.updates);
+	creates(CreateStaticWebsiteRequestSchema, "StaticWebsite", staticWebsite.changeSet.creates);
+	updates(UpdateStaticWebsiteRequestSchema, "StaticWebsite", staticWebsite.changeSet.updates);
+	creates(AddCustomDomainRequestSchema, "StaticWebsite custom domain", staticWebsite.customDomainChangeSet.creates);
+	creates(CreateAIGatewayRequestSchema, "AIGateway", aiGateway.changeSet.creates.map((item) => ({
+		name: item.name,
+		request: {
+			...item.request,
+			cors: void 0
+		}
+	})));
+	updates(UpdateAIGatewayRequestSchema, "AIGateway", aiGateway.changeSet.updates.map((item) => ({
+		name: item.name,
+		request: {
+			...item.request,
+			cors: void 0
+		}
+	})));
+	const placeholderOriginReplacement = "https://placeholder.invalid";
+	const substituteIdpReturnOrigins = (item) => {
+		const request = item.request;
+		const origins = request.userAuthPolicy?.allowedReturnOrigins;
+		if (!Array.isArray(origins) || origins.length === 0) return item;
+		const substituted = origins.map((origin) => typeof origin === "string" && /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]:url$/.test(origin) ? placeholderOriginReplacement : origin);
+		return {
+			...item,
+			request: {
+				...request,
+				userAuthPolicy: {
+					...request.userAuthPolicy,
+					allowedReturnOrigins: substituted
+				}
+			}
+		};
+	};
+	creates(CreateIdPServiceRequestSchema, "IdP service", idp.changeSet.service.creates.map(substituteIdpReturnOrigins));
+	updates(UpdateIdPServiceRequestSchema, "IdP service", idp.changeSet.service.updates.map(substituteIdpReturnOrigins));
+	const idpClientVaultItems = [...idp.changeSet.client.creates.map((c) => ({
+		clientName: c.request.client?.name ?? "",
+		namespaceName: c.request.namespaceName ?? "",
+		workspaceId: c.request.workspaceId ?? ""
+	})), ...idp.changeSet.client.updates.map((u) => ({
+		clientName: u.name,
+		namespaceName: u.namespaceName,
+		workspaceId: u.workspaceId
+	}))];
+	creates(CreateSecretManagerVaultRequestSchema, "IdP client secret", idpClientVaultItems.map((item) => ({
+		name: item.clientName,
+		request: {
+			workspaceId: item.workspaceId,
+			secretmanagerVaultName: idpClientVaultName(item.namespaceName, item.clientName)
+		}
+	})));
+	creates(CreateSecretManagerSecretRequestSchema, "IdP client secret", idpClientVaultItems.map((item) => ({
+		name: item.clientName,
+		request: {
+			workspaceId: item.workspaceId,
+			secretmanagerVaultName: idpClientVaultName(item.namespaceName, item.clientName),
+			secretmanagerSecretName: idpClientSecretName(item.namespaceName, item.clientName)
+		}
+	})));
+	creates(CreateAuthServiceRequestSchema, "Auth service", auth.changeSet.service.creates);
+	updates(UpdateAuthServiceRequestSchema, "Auth service", auth.changeSet.service.updates);
+	creates(CreateAuthIDPConfigRequestSchema, "Auth IDP config", auth.changeSet.idpConfig.creates);
+	updates(UpdateAuthIDPConfigRequestSchema, "Auth IDP config", auth.changeSet.idpConfig.updates);
+	creates(CreateUserProfileConfigRequestSchema, "Auth user profile config", auth.changeSet.userProfileConfig.creates);
+	updates(UpdateUserProfileConfigRequestSchema, "Auth user profile config", auth.changeSet.userProfileConfig.updates);
+	creates(CreateTenantConfigRequestSchema, "Auth tenant config", auth.changeSet.tenantConfig.creates);
+	updates(UpdateTenantConfigRequestSchema, "Auth tenant config", auth.changeSet.tenantConfig.updates);
+	creates(CreateAuthMachineUserRequestSchema, "Auth machine user", auth.changeSet.machineUser.creates);
+	updates(UpdateAuthMachineUserRequestSchema, "Auth machine user", auth.changeSet.machineUser.updates);
+	creates(CreateAuthHookRequestSchema, "Auth hook", auth.changeSet.authHook.creates);
+	updates(UpdateAuthHookRequestSchema, "Auth hook", auth.changeSet.authHook.updates);
+	creates(CreateAuthSCIMConfigRequestSchema, "Auth SCIM config", auth.changeSet.scim.creates);
+	updates(UpdateAuthSCIMConfigRequestSchema, "Auth SCIM config", auth.changeSet.scim.updates);
+	creates(CreateAuthSCIMResourceRequestSchema, "Auth SCIM resource", auth.changeSet.scimResource.creates);
+	updates(UpdateAuthSCIMResourceRequestSchema, "Auth SCIM resource", auth.changeSet.scimResource.updates);
+	creates(CreateAuthOAuth2ClientRequestSchema, "OAuth2 client", auth.changeSet.oauth2Client.creates);
+	updates(UpdateAuthOAuth2ClientRequestSchema, "OAuth2 client", auth.changeSet.oauth2Client.updates);
+	replaces(CreateAuthOAuth2ClientRequestSchema, "OAuth2 client", auth.changeSet.oauth2Client.replaces);
+	creates(CreatePipelineServiceRequestSchema, "Pipeline service", pipeline.changeSet.service.creates);
+	updates(UpdatePipelineServiceRequestSchema, "Pipeline service", pipeline.changeSet.service.updates);
+	creates(CreatePipelineResolverRequestSchema, "Resolver", pipeline.changeSet.resolver.creates);
+	updates(UpdatePipelineResolverRequestSchema, "Resolver", pipeline.changeSet.resolver.updates);
+	creates(CreateExecutorExecutorRequestSchema, "Executor", executor.changeSet.creates);
+	updates(UpdateExecutorExecutorRequestSchema, "Executor", executor.changeSet.updates);
+	creates(CreateWorkflowRequestSchema, "Workflow", workflow.changeSet.creates.map((item) => ({
+		name: item.name,
+		request: buildWorkflowValidationShape(item.workspaceId, item.workflow)
+	})));
+	updates(UpdateWorkflowRequestSchema, "Workflow", workflow.changeSet.updates.map((item) => ({
+		name: item.name,
+		request: buildWorkflowValidationShape(item.workspaceId, item.workflow)
+	})));
+	const workflowJobNameWorkspaceId = workflow.changeSet.creates[0]?.workspaceId ?? workflow.changeSet.updates[0]?.workspaceId ?? "";
+	if (workflowJobNameWorkspaceId) {
+		const allJobNames = /* @__PURE__ */ new Set();
+		for (const item of [...workflow.changeSet.creates, ...workflow.changeSet.updates]) for (const jobName of item.usedJobNames) allJobNames.add(jobName);
+		for (const jobName of workflow.unchangedWorkflowJobNames) allJobNames.add(jobName);
+		creates(CreateWorkflowJobFunctionRequestSchema, "Workflow job function", [...allJobNames].map((jobName) => ({
+			name: jobName,
+			request: {
+				workspaceId: workflowJobNameWorkspaceId,
+				jobFunctionName: jobName,
+				scriptRef: jobName
+			}
+		})));
+	}
+	creates(CreateWorkflowJobFunctionExecutionPolicyRequestSchema, "Workflow execution policy", [...workflowExecutionPolicy.changeSet.creates, ...workflowExecutionPolicy.changeSet.replaces].map((item) => ({
+		name: item.name,
+		request: {
+			workspaceId: item.workspaceId,
+			executionPolicyName: item.policy.name,
+			executionPolicyKey: toPlatformExecutionPolicyKey(item.policy),
+			...item.policy.concurrencyPolicy && { concurrencyPolicy: { maxConcurrentExecutions: item.policy.concurrencyPolicy.maxConcurrentExecutions } }
+		}
+	})));
+	updates(UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, "Workflow execution policy", workflowExecutionPolicy.changeSet.updates.map((item) => ({
+		name: item.name,
+		request: {
+			workspaceId: item.workspaceId,
+			executionPolicyName: item.policy.name,
+			...item.policy.concurrencyPolicy && { concurrencyPolicy: { maxConcurrentExecutions: item.policy.concurrencyPolicy.maxConcurrentExecutions } }
+		}
+	})));
+	creates(CreateSecretManagerVaultRequestSchema, "Secret Manager vault", secretManager.vaultChangeSet.creates.map((item) => ({
+		name: item.name,
+		request: vaultCreateRequest(item)
+	})));
+	creates(CreateSecretManagerSecretRequestSchema, "Secret Manager secret", secretManager.secretChangeSet.creates.map((item) => ({
+		name: item.name,
+		request: secretCreateRequest(item)
+	})));
+	updates(UpdateSecretManagerSecretRequestSchema, "Secret Manager secret", secretManager.secretChangeSet.updates.map((item) => ({
+		name: item.name,
+		request: secretUpdateRequest(item)
+	})));
+	creates(CreateApplicationRequestSchema, "Application", app.creates.map((item) => ({
+		name: item.name,
+		request: {
+			...item.request,
+			cors: void 0
+		}
+	})));
+	updates(UpdateApplicationRequestSchema, "Application", [...app.updates, ...app.unchanged].map((item) => ({
+		name: item.name,
+		request: {
+			...item.request,
+			cors: void 0
+		}
+	})));
+	creates(CreateAuthConnectionRequestSchema, "Auth connection", auth.changeSet.connection.creates);
+	inPlaceReplaces(UpdateAuthConnectionRequestSchema, "Auth connection", auth.changeSet.connection.replaces);
+	if (violations.length === 0) return;
+	const resourceNames = new Set(violations.map((v) => `${v.kind}:${v.name}`));
+	logger.error(`Pre-flight validation found ${violations.length} violation(s) across ${resourceNames.size} resource(s):`);
+	for (const v of violations) logger.log(`  ${styles.resourceType(v.kind)} ${styles.resourceName(v.name)} (${v.action}) — ${styles.bold(v.fieldPath)}: ${v.message}`);
+	throw new Error(`${violations.length} validation error(s) found in ${resourceNames.size} resource(s)`);
+}
+
+//#endregion
+//#region src/cli/shared/profile-name.ts
+const profileNameSchema = z.string().min(1, "Profile must not be empty");
+
+//#endregion
+//#region src/cli/shared/workspace-name.ts
+const workspaceNameSchema = z.string().min(3, "Name must be at least 3 characters").max(63, "Name must be at most 63 characters").regex(/^[a-z0-9-]+$/, "Name can only contain lowercase letters, numbers, and hyphens").refine((name) => !name.startsWith("-") && !name.endsWith("-"), "Name cannot start or end with a hyphen");
+/**
+* Validate a workspace name for use in an interactive prompt.
+* @param name - Candidate workspace name
+* @returns True when valid, otherwise a validation message
+*/
+function validateWorkspaceName(name) {
+	const result = workspaceNameSchema.safeParse(name);
+	return result.success ? true : assertDefined(result.error.issues[0], "Zod returned no issues").message;
+}
+
+//#endregion
+//#region src/cli/shared/format.ts
+/**
+* Format a protobuf Timestamp to ISO string.
+* @param timestamp - Protobuf timestamp
+* @returns Date object or null if invalid
+*/
+function formatTimestamp(timestamp) {
+	if (!timestamp) return null;
+	const date = timestampDate(timestamp);
+	if (Number.isNaN(date.getTime())) return null;
+	return date;
+}
+/**
+* Formats a table with consistent single-line border style.
+* Use this instead of importing `table` directly.
+* @param data - Table data
+* @param config - Table configuration
+* @returns Formatted table string
+*/
+function formatTable(data, config) {
+	return table(data, {
+		...config,
+		border: getBorderCharacters("norc")
+	});
+}
+/**
+* Formats a key-value table with single-line border style.
+* @param data - Key-value pairs
+* @returns Formatted key-value table string
+*/
+function formatKeyValueTable(data) {
+	return formatTable(data, { singleLine: true });
+}
+/**
+* Format a Date or ISO timestamp string as a human-readable relative time.
+* @param value - Date object, ISO date string, or null
+* @returns Relative time (e.g., "5 minutes ago") or "N/A" for null/invalid
+*/
+function humanizeRelativeTime(value) {
+	if (value === null) return "N/A";
+	const date = value instanceof Date ? value : new Date(value);
+	if (Number.isNaN(date.getTime())) return typeof value === "string" ? value : "N/A";
+	return formatDistanceToNowStrict(date, { addSuffix: true });
+}
+
+//#endregion
+//#region src/cli/commands/workspace/transform.ts
+const workspaceInfo = (workspace, folderName) => {
+	const info = {
+		id: workspace.id,
+		name: workspace.name,
+		region: workspace.region,
+		...workspace.organizationId ? { organizationId: workspace.organizationId } : {},
+		...workspace.folderId ? { folderId: workspace.folderId } : {},
+		createdAt: formatTimestamp(workspace.createTime),
+		updatedAt: formatTimestamp(workspace.updateTime)
+	};
+	return folderName ? {
+		...info,
+		folderName
+	} : info;
+};
+const workspaceDetails = (workspace, folderName) => {
+	return {
+		...workspaceInfo(workspace, folderName),
+		deleteProtection: workspace.deleteProtection,
+		organizationId: workspace.organizationId,
+		folderId: workspace.folderId
+	};
+};
+async function resolveWorkspaceFolderName(client, workspace) {
+	if (!workspace.organizationId || !workspace.folderId) return void 0;
+	try {
+		return (await client.getOrganizationFolder({
+			organizationId: workspace.organizationId,
+			folderId: workspace.folderId
+		})).folder?.name || void 0;
+	} catch (error) {
+		if (error instanceof ConnectError && (error.code === Code.NotFound || error.code === Code.PermissionDenied)) return;
+		logger.warn(`Failed to resolve workspace folder name: ${error}`);
+		return;
+	}
+}
+function createWorkspaceFolderNameResolver(client) {
+	const cache = /* @__PURE__ */ new Map();
+	return (workspace) => {
+		if (!workspace.organizationId || !workspace.folderId) return Promise.resolve(void 0);
+		const cacheKey = `${workspace.organizationId}/${workspace.folderId}`;
+		const cached = cache.get(cacheKey);
+		if (cached) return cached;
+		const promise = resolveWorkspaceFolderName(client, workspace);
+		cache.set(cacheKey, promise);
+		return promise;
+	};
+}
+async function workspaceInfoWithFolderName(client, workspace) {
+	const folderName = await resolveWorkspaceFolderName(client, workspace);
+	return workspaceInfo(workspace, folderName);
+}
+async function workspaceDetailsWithFolderName(client, workspace) {
+	const folderName = await resolveWorkspaceFolderName(client, workspace);
+	return workspaceDetails(workspace, folderName);
+}
+async function workspaceInfosWithFolderNames(client, workspaces) {
+	const resolveFolderName = createWorkspaceFolderNameResolver(client);
+	const limit = pLimit(5);
+	return Promise.all(workspaces.map((workspace) => limit(async () => workspaceInfo(workspace, await resolveFolderName(workspace)))));
+}
+function workspaceDisplayName(workspace) {
+	return workspace.folderName ? `${workspace.folderName}/${workspace.name}` : workspace.name;
+}
+function createWorkspaceNameTransformer(nameKey, folderNameKey) {
+	return (value, item) => {
+		const workspace = item;
+		const name = workspace[nameKey];
+		const folderName = workspace[folderNameKey];
+		if (typeof name === "string" && typeof folderName === "string") return workspaceDisplayName({
+			name,
+			folderName
+		});
+		return String(value ?? "");
+	};
+}
+const workspaceNameTransformer = createWorkspaceNameTransformer("name", "folderName");
+
+//#endregion
+//#region src/cli/commands/workspace/create.ts
+/**
+* Schema for workspace creation options
+* - name: 3-63 chars, lowercase alphanumeric and hyphens, cannot start/end with hyphen
+* - organizationId, folderId: optional UUIDs
+*/
+const createWorkspaceOptionsSchema = z.object({
+	name: workspaceNameSchema,
+	region: z.string(),
+	deleteProtection: z.boolean().optional(),
+	organizationId: z.uuid().optional(),
+	folderId: z.uuid().optional(),
+	profile: profileNameSchema.optional()
+});
+const validateRegion = async (region, client) => {
+	const availableRegions = await client.listAvailableWorkspaceRegions({});
+	if (!availableRegions.regions.includes(region)) throw new Error(`Region must be one of: ${availableRegions.regions.join(", ")}.`);
+};
+function profilePlatformSettings(platformConfig) {
+	const hasOAuth2ClientId = platformConfig?.oauth2ClientId || process.env.TAILOR_PLATFORM_OAUTH2_CLIENT_ID;
+	const hasConsoleUrl = platformConfig?.consoleUrl || process.env.TAILOR_PLATFORM_CONSOLE_URL;
+	return {
+		...isDefaultPlatform(platformConfig) ? {} : { platform_url: getPlatformBaseUrl(platformConfig) },
+		...hasOAuth2ClientId ? { oauth2_client_id: getOAuth2ClientId(platformConfig) } : {},
+		...hasConsoleUrl ? { console_url: getConsoleBaseUrl(platformConfig) } : {}
+	};
+}
+/**
+* Create a new workspace with the given options.
+* @param options - Workspace creation options
+* @returns Created workspace info
+*/
+async function createWorkspace$1(options) {
+	const validated = validateCreateWorkspaceOptions(options);
+	const client = await initOperatorClient(await loadAccessToken({ profile: validated.profile }), await loadPlatformClientConfig({ profile: validated.profile }));
+	await validateRegion(validated.region, client);
+	return createValidatedWorkspaceWithClient(client, validated);
+}
+/**
+* Create a workspace after its local options and region have been validated.
+* @param client - Authenticated Operator client
+* @param options - Validated workspace creation options
+* @returns Created workspace info
+*/
+async function createValidatedWorkspaceWithClient(client, options) {
+	return workspaceInfoWithFolderName(client, assertDefined((await client.createWorkspace({
+		workspaceName: options.name,
+		workspaceRegion: options.region,
+		deleteProtection: options.deleteProtection ?? false,
+		organizationId: options.organizationId,
+		folderId: options.folderId
+	})).workspace, "createWorkspace response missing workspace"));
+}
+/**
+* Validate workspace creation options without making API calls.
+* @param options - Workspace creation options
+* @returns Validated workspace creation options
+*/
+function validateCreateWorkspaceOptions(options) {
+	const result = createWorkspaceOptionsSchema.safeParse(options);
+	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
+	return result.data;
+}
+const createCommand$1 = defineAppCommand({
+	name: "create",
+	description: "Create a new Tailor Platform workspace.",
+	args: z.strictObject({
+		name: arg(z.string(), {
+			alias: "n",
+			description: "Workspace name"
+		}),
+		region: arg(z.string(), {
+			alias: "r",
+			description: "Workspace region (us-west, asia-northeast)"
+		}),
+		"delete-protection": arg(z.boolean().default(false), {
+			alias: "d",
+			description: "Enable delete protection"
+		}),
+		"organization-id": arg(z.string().optional(), {
+			alias: "o",
+			description: "Organization ID to workspace associate with",
+			env: "TAILOR_PLATFORM_ORGANIZATION_ID"
+		}),
+		"folder-id": arg(z.string().optional(), {
+			alias: "f",
+			description: "Folder ID to workspace associate with",
+			env: "TAILOR_PLATFORM_FOLDER_ID"
+		}),
+		"profile-name": arg(z.string().optional(), {
+			alias: "p",
+			description: "Profile name to create"
+		}),
+		profile: arg(profileNameSchema.optional(), {
+			description: "Workspace profile used for authentication and Platform selection",
+			env: "TAILOR_PLATFORM_PROFILE"
+		}),
+		"profile-user": arg(z.string().optional(), { description: "User email address or machine user client ID for the profile (defaults to current user)" }),
+		permission: arg(z.enum(["write", "read"]).default("write"), { description: "Profile permission (requires --profile-name). 'read' blocks all write commands while the profile is active." })
+	}),
+	run: async (args) => {
+		await assertWritable({ profile: args.profile });
+		const profileName = args["profile-name"];
+		let profileSetup;
+		if (profileName) {
+			const config = await readPlatformConfig();
+			if (config.profiles[profileName]) throw new Error(`Profile "${profileName}" already exists.`);
+			const activeProfileName = args.profile;
+			const activeProfileEntry = activeProfileName ? config.profiles[activeProfileName] : void 0;
+			const platformConfig = activeProfileEntry ? platformConfigFromProfile(activeProfileEntry) : void 0;
+			const profileUser = args["profile-user"] || activeProfileEntry?.user || config.current_user;
+			if (!profileUser) throw new Error("Current user not found. Please login or specify --profile-user to create a profile.");
+			const resolvedProfileUser = resolveConfigUser(config, profileUser, platformConfig);
+			if (!resolvedProfileUser) throw new Error(`User "${profileUser}" not found.\nPlease verify your user name and login using 'tailor login' command.`);
+			profileSetup = {
+				name: profileName,
+				user: resolvedProfileUser,
+				platformSettings: profilePlatformSettings(platformConfig)
+			};
+		}
+		const workspace = await createWorkspace$1({
+			name: args.name,
+			region: args.region,
+			deleteProtection: args["delete-protection"],
+			organizationId: args["organization-id"],
+			folderId: args["folder-id"],
+			profile: args.profile
+		});
+		let profileInfo;
+		if (profileSetup) {
+			const config = await readPlatformConfig();
+			const platformSettings = profileSetup.platformSettings;
+			config.profiles[profileSetup.name] = {
+				user: profileSetup.user,
+				workspace_id: workspace.id,
+				...args.permission === "read" ? { readonly: true } : {},
+				...platformSettings
+			};
+			writePlatformConfig(config);
+			profileInfo = {
+				name: profileSetup.name,
+				user: profileSetup.user,
+				workspaceId: workspace.id,
+				permission: args.permission,
+				...platformSettings.platform_url ? { platformUrl: platformSettings.platform_url } : {},
+				...platformSettings.oauth2_client_id ? { oauth2ClientId: platformSettings.oauth2_client_id } : {},
+				...platformSettings.console_url ? { consoleUrl: platformSettings.console_url } : {}
+			};
+			if (!args.json) logger.success(`Profile "${profileSetup.name}" created successfully.`);
+		}
+		if (!args.json) logger.success(`Workspace "${workspaceDisplayName(workspace)}" created successfully.`);
+		if (args.json && profileInfo) {
+			logger.out({
+				...workspace,
+				profile: profileInfo
+			});
+			return;
+		}
+		logger.out(workspace, { display: {
+			name: workspaceNameTransformer,
+			folderName: null
+		} });
+		if (profileInfo) {
+			logger.out("Profile:");
+			logger.out(profileInfo);
+		}
+	}
+});
+
+//#endregion
+//#region src/cli/commands/workspace/list.ts
+/**
+* List workspaces with an optional order and limit.
+* @param options - Workspace listing options
+* @returns List of workspaces
+*/
+async function listWorkspaces(options) {
+	const profile = profileNameSchema.optional().parse(options?.profile);
+	return listWorkspacesWithClient(await initOperatorClient(await loadAccessToken({ profile }), await loadPlatformClientConfig({ profile })), options);
+}
+/**
+* List workspaces using an existing Operator client.
+* @param client - Authenticated Operator client
+* @param options - Workspace listing options
+* @returns List of workspaces
+*/
+async function listWorkspacesWithClient(client, options) {
+	const pageDirection = toPageDirection(options?.order);
+	return workspaceInfosWithFolderNames(client, await fetchPaged(async (pageToken, pageSize) => {
+		const { workspaces, nextPageToken } = await client.listWorkspaces({
+			pageToken,
+			pageSize,
+			pageDirection
+		});
+		return [workspaces, nextPageToken];
+	}, { limit: options?.limit }));
+}
+const listCommand$9 = defineAppCommand({
+	name: "list",
+	description: "List all Tailor Platform workspaces.",
+	args: z.strictObject({
+		...paginationArgs(),
+		profile: arg(profileNameSchema.optional(), {
+			description: "Workspace profile used for authentication and Platform selection",
+			env: "TAILOR_PLATFORM_PROFILE"
+		})
+	}),
+	run: async (args) => {
+		const workspaces = await listWorkspaces({
+			order: args.order,
+			limit: args.limit,
+			profile: args.profile
+		});
+		logger.out(workspaces, { display: {
+			name: workspaceNameTransformer,
+			folderName: null,
+			organizationId: null,
+			folderId: null,
+			updatedAt: null
+		} });
+	}
+});
+
+//#endregion
+//#region src/cli/commands/deploy/workspace-context.ts
+const workspaceContextSchema = z.object({
+	version: z.literal(1),
+	platformUrl: z.url(),
+	applicationId: z.string().min(1).optional(),
+	workspaceId: z.uuid()
+});
+function defaultConfigPath() {
+	return resolve(process.cwd(), "tailor.config.ts");
+}
+function contextPath(configPath) {
+	return join(dirname(configPath), getDistDir(), `${basename(configPath)}.context.json`);
+}
+/**
+* Load the project workspace context when it belongs to the current platform.
+* Missing, malformed, and cross-platform state is ignored.
+* @param platformUrl - Current Platform API base URL
+* @param configPath - Configuration file whose workspace selection is loaded
+* @param applicationId - Application identity that must match the saved context
+* @returns Valid context for the current platform, or undefined
+*/
+async function loadWorkspaceContext(platformUrl, configPath = defaultConfigPath(), applicationId) {
+	let contents;
+	try {
+		contents = await readFile(contextPath(configPath), "utf8");
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return void 0;
+		throw error;
+	}
+	let value;
+	try {
+		value = JSON.parse(contents);
+	} catch {
+		return;
+	}
+	const result = workspaceContextSchema.safeParse(value);
+	if (!result.success || result.data.platformUrl !== platformUrl || applicationId !== void 0 && result.data.applicationId !== applicationId) return;
+	return result.data;
+}
+/**
+* Persist the selected workspace as project-local SDK state.
+* @param context - Workspace context to persist
+* @param configPath - Configuration file whose workspace selection is persisted
+* @param applicationId - Application identity stored with the workspace selection
+*/
+async function saveWorkspaceContext(context, configPath = defaultConfigPath(), applicationId) {
+	const validated = workspaceContextSchema.parse({
+		...context,
+		...applicationId === void 0 ? {} : { applicationId }
+	});
+	const stateDirectory = join(dirname(configPath), getDistDir());
+	const targetPath = contextPath(configPath);
+	const serialized = `${JSON.stringify(validated, null, 2)}\n`;
+	try {
+		if (await readFile(targetPath, "utf8") === serialized) return;
+	} catch {}
+	const temporaryPath = `${targetPath}.${process.pid}.${randomUUID()}.tmp`;
+	await mkdir(stateDirectory, { recursive: true });
+	try {
+		await writeFile(temporaryPath, serialized, { mode: 384 });
+		await rename(temporaryPath, targetPath);
+	} catch (error) {
+		await rm(temporaryPath, { force: true }).catch(() => void 0);
+		throw error;
+	}
+}
+
+//#endregion
+//#region src/cli/commands/deploy/workspace.ts
+function suggestedWorkspaceName() {
+	const name = basename(process.cwd()).toLowerCase().replaceAll(/[^a-z0-9-]+/g, "-").replaceAll(/^-+|-+$/g, "").slice(0, 63).replace(/-+$/, "");
+	return validateWorkspaceName(name) === true ? name : "my-workspace";
+}
+function executableAction(args) {
+	return {
+		command: "tailor-sdk",
+		args
+	};
+}
+function deployArgs(options) {
+	return options.deployArgs ?? ["deploy"];
+}
+function workspaceCommandArgs(options) {
+	return options.workspaceCommandArgs ?? [];
+}
+function createDeployArgs(options, name, region) {
+	return [
+		...deployArgs(options),
+		"--create-workspace",
+		"--workspace-name",
+		name,
+		"--workspace-region",
+		region,
+		...options.organizationId ? ["--organization-id", options.organizationId] : [],
+		...options.folderId ? ["--folder-id", options.folderId] : []
+	];
+}
+function selectDeployArgs(options) {
+	return [
+		...deployArgs(options),
+		"--workspace-id",
+		"<workspace-id>"
+	];
+}
+function workspaceLabel(workspace) {
+	const organization = workspace.organizationId ?? "personal";
+	return `${workspaceDisplayName(workspace)} (${workspace.region}, org: ${organization}, id: ${workspace.id})`;
+}
+function workspaceMatchesRequestedIdentity(workspace, options) {
+	return options.workspaceName === workspace.name && options.workspaceRegion === workspace.region && options.organizationId === workspace.organizationId && options.folderId === workspace.folderId;
+}
+function workspaceIdentity(workspace) {
+	const { id, name, region, organizationId, folderId } = workspace;
+	return {
+		id,
+		name,
+		region,
+		organizationId,
+		folderId
+	};
+}
+function projectContextTargets(contextTargets) {
+	if (!contextTargets) return void 0;
+	return [...new Map(contextTargets.map((target) => [target.configPath, target])).values()];
+}
+async function loadProjectContexts(platformUrl, contextTargets) {
+	const targets = projectContextTargets(contextTargets);
+	if (!targets || targets.length === 0) {
+		const context = await loadWorkspaceContext(platformUrl);
+		return context ? [context] : [];
+	}
+	return (await Promise.all(targets.map(({ configPath, applicationId }) => loadWorkspaceContext(platformUrl, configPath, applicationId)))).filter((context) => context !== void 0);
+}
+async function persistWorkspaceContext(context, contextTargets) {
+	const targets = projectContextTargets(contextTargets);
+	if (!targets || targets.length === 0) {
+		await saveWorkspaceContext(context);
+		return;
+	}
+	const failures = (await Promise.allSettled(targets.map(({ configPath, applicationId }) => saveWorkspaceContext(context, configPath, applicationId)))).filter((result) => result.status === "rejected");
+	if (failures.length > 0) throw new Error(failures.map(({ reason }) => reason instanceof Error ? reason.message : String(reason)).join("; "));
+}
+async function rememberWorkspaceContext(context, options, failurePolicy = "error-on-partial") {
+	if (options.dryRun) return;
+	try {
+		await persistWorkspaceContext(context, options.contextTargets);
+	} catch (error) {
+		if ((projectContextTargets(options.contextTargets)?.length ?? 0) > 1 && failurePolicy === "error-on-partial") throw createCLIError({
+			code: "WORKSPACE_CONTEXT_SAVE_FAILED",
+			message: "The workspace selection could not be saved for every configuration file.",
+			details: error instanceof Error ? error.message : String(error),
+			suggestion: "Fix project state permissions, then rerun deploy with the workspace ID.",
+			next: executableAction([
+				...deployArgs(options),
+				"--workspace-id",
+				context.workspaceId
+			]),
+			context: {
+				workspaceId: context.workspaceId,
+				configPaths: options.contextTargets?.map(({ configPath }) => configPath)
+			}
+		});
+		logger.warn(`Could not save the project workspace selection (${error instanceof Error ? error.message : String(error)}). Continue with --workspace-id ${context.workspaceId} on later runs.`);
+	}
+}
+async function useWorkspace(client, platformUrl, workspace, options, failurePolicy = "error-on-partial") {
+	await rememberWorkspaceContext({
+		version: 1,
+		platformUrl,
+		workspaceId: workspace.id
+	}, options, failurePolicy);
+	logger.info(`Using workspace: ${workspaceLabel(workspace)}`);
+	return {
+		client,
+		workspaceId: workspace.id
+	};
+}
+function useRememberedWorkspace(client, workspace) {
+	logger.warn(`Using saved workspace selection: ${workspaceLabel(workspace)}`);
+	return {
+		client,
+		workspaceId: workspace.id
+	};
+}
+const createNewWorkspaceSelection = "create-new-workspace";
+async function chooseWorkspace(client, platformUrl, workspaces, options) {
+	const workspaceId = await prompt.select({
+		message: "Select a workspace",
+		choices: [...workspaces.map((workspace) => ({
+			name: workspaceLabel(workspace),
+			value: workspace.id
+		})), {
+			name: "Create new workspace",
+			value: createNewWorkspaceSelection
+		}]
+	});
+	if (workspaceId === createNewWorkspaceSelection) return createWorkspaceForDeploy(client, platformUrl, options);
+	const workspace = workspaces.find(({ id }) => id === workspaceId);
+	if (!workspace) throw new Error("Selected workspace was not found");
+	return useWorkspace(client, platformUrl, workspace, options);
+}
+function invalidCreateOptionsError(options, name, region, details) {
+	return createCLIError({
+		code: "WORKSPACE_CREATE_OPTIONS_INVALID",
+		message: "Workspace creation options are invalid.",
+		details,
+		suggestion: "Correct the workspace creation options and rerun deploy.",
+		next: executableAction(createDeployArgs(options, name, region))
+	});
+}
+async function createWorkspace(client, platformUrl, options, availableRegions, validatedOptions) {
+	let name = options.workspaceName;
+	let region = options.workspaceRegion;
+	const interactive = canPrompt();
+	if (interactive) {
+		name ??= await prompt.text({
+			message: "Workspace name",
+			default: suggestedWorkspaceName(),
+			validate: validateWorkspaceName
+		});
+		region ??= await prompt.select({
+			message: "Workspace region",
+			choices: availableRegions.map((value) => ({
+				name: value,
+				value
+			}))
+		});
+	} else {
+		const missingOptions = [...name === void 0 ? ["--workspace-name"] : [], ...region === void 0 ? ["--workspace-region"] : []];
+		if (missingOptions.length > 0) throw createCLIError({
+			code: "WORKSPACE_CREATE_OPTIONS_REQUIRED",
+			message: "Workspace creation requires a name and region in non-interactive mode.",
+			suggestion: "Provide every workspace creation option and rerun deploy.",
+			next: executableAction(createDeployArgs(options, name ?? "<name>", region ?? "<region>")),
+			context: { missingOptions }
+		});
+	}
+	if (!name || !region) throw new Error("Workspace creation options were not resolved");
+	let validated = validatedOptions;
+	if (!validated) {
+		try {
+			validated = validateCreateWorkspaceOptions({
+				name,
+				region,
+				organizationId: options.organizationId,
+				folderId: options.folderId
+			});
+		} catch (error) {
+			throw invalidCreateOptionsError(options, name, region, error instanceof Error ? error.message : String(error));
+		}
+		if (!availableRegions.includes(region)) throw invalidCreateOptionsError(options, name, region, `Region must be one of: ${availableRegions.join(", ")}.`);
+	}
+	if (interactive) {
+		const scope = [options.organizationId ? `organization: ${options.organizationId}` : void 0, options.folderId ? `folder: ${options.folderId}` : void 0].filter((value) => value !== void 0);
+		if (!await prompt.confirm({
+			message: `Create workspace "${name}" in ${region}${scope.length > 0 ? ` (${scope.join(", ")})` : ""}?`,
+			default: true
+		})) throw createCLIError({
+			code: "WORKSPACE_CREATION_CANCELLED",
+			message: "Workspace creation was cancelled."
 		});
 	}
-	function inPlaceReplaces(schema, kind, items) {
-		validateItems({
-			validator,
-			schema,
-			kind,
-			action: "replace",
-			items,
-			requestKey: "updateRequest",
-			violations
+	let workspace;
+	try {
+		workspace = await createValidatedWorkspaceWithClient(client, validated);
+	} catch (error) {
+		if (error instanceof ConnectError && ![
+			Code.Canceled,
+			Code.Unknown,
+			Code.DeadlineExceeded,
+			Code.Aborted,
+			Code.Internal,
+			Code.Unavailable,
+			Code.DataLoss
+		].includes(error.code)) throw error;
+		throw createCLIError({
+			code: "WORKSPACE_CREATION_FAILED",
+			message: "Workspace creation did not complete successfully.",
+			details: error instanceof Error ? error.message : String(error),
+			suggestion: "The outcome may be uncertain. List workspaces before retrying creation to avoid duplicates.",
+			next: executableAction([
+				"workspace",
+				"list",
+				...workspaceCommandArgs(options),
+				"--json"
+			])
 		});
 	}
-	creates(CreateTailorDBServiceRequestSchema, "TailorDB service", tailorDB.changeSet.service.creates);
-	creates(CreateTailorDBTypeRequestSchema, "TailorDB type", tailorDB.changeSet.type.creates);
-	updates(UpdateTailorDBTypeRequestSchema, "TailorDB type", tailorDB.changeSet.type.updates);
-	creates(CreateStaticWebsiteRequestSchema, "StaticWebsite", staticWebsite.changeSet.creates);
-	updates(UpdateStaticWebsiteRequestSchema, "StaticWebsite", staticWebsite.changeSet.updates);
-	creates(AddCustomDomainRequestSchema, "StaticWebsite custom domain", staticWebsite.customDomainChangeSet.creates);
-	creates(CreateAIGatewayRequestSchema, "AIGateway", aiGateway.changeSet.creates.map((item) => ({
-		name: item.name,
-		request: {
-			...item.request,
-			cors: void 0
-		}
-	})));
-	updates(UpdateAIGatewayRequestSchema, "AIGateway", aiGateway.changeSet.updates.map((item) => ({
-		name: item.name,
-		request: {
-			...item.request,
-			cors: void 0
-		}
-	})));
-	const placeholderOriginReplacement = "https://placeholder.invalid";
-	const substituteIdpReturnOrigins = (item) => {
-		const request = item.request;
-		const origins = request.userAuthPolicy?.allowedReturnOrigins;
-		if (!Array.isArray(origins) || origins.length === 0) return item;
-		const substituted = origins.map((origin) => typeof origin === "string" && /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]:url$/.test(origin) ? placeholderOriginReplacement : origin);
-		return {
-			...item,
-			request: {
-				...request,
-				userAuthPolicy: {
-					...request.userAuthPolicy,
-					allowedReturnOrigins: substituted
-				}
-			}
-		};
+	await rememberWorkspaceContext({
+		version: 1,
+		platformUrl,
+		workspaceId: workspace.id
+	}, options);
+	logger.success(`Created workspace: ${workspaceLabel(workspace)}`);
+	logger.info(`Reuse this workspace with: tailor-sdk deploy --workspace-id ${workspace.id}`);
+	logger.info(`Or set TAILOR_PLATFORM_WORKSPACE_ID=${workspace.id}.`);
+	return {
+		client,
+		workspaceId: workspace.id
 	};
-	creates(CreateIdPServiceRequestSchema, "IdP service", idp.changeSet.service.creates.map(substituteIdpReturnOrigins));
-	updates(UpdateIdPServiceRequestSchema, "IdP service", idp.changeSet.service.updates.map(substituteIdpReturnOrigins));
-	const idpClientVaultItems = [...idp.changeSet.client.creates.map((c) => ({
-		clientName: c.request.client?.name ?? "",
-		namespaceName: c.request.namespaceName ?? "",
-		workspaceId: c.request.workspaceId ?? ""
-	})), ...idp.changeSet.client.updates.map((u) => ({
-		clientName: u.name,
-		namespaceName: u.namespaceName,
-		workspaceId: u.workspaceId
-	}))];
-	creates(CreateSecretManagerVaultRequestSchema, "IdP client secret", idpClientVaultItems.map((item) => ({
-		name: item.clientName,
-		request: {
-			workspaceId: item.workspaceId,
-			secretmanagerVaultName: idpClientVaultName(item.namespaceName, item.clientName)
-		}
-	})));
-	creates(CreateSecretManagerSecretRequestSchema, "IdP client secret", idpClientVaultItems.map((item) => ({
-		name: item.clientName,
-		request: {
-			workspaceId: item.workspaceId,
-			secretmanagerVaultName: idpClientVaultName(item.namespaceName, item.clientName),
-			secretmanagerSecretName: idpClientSecretName(item.namespaceName, item.clientName)
+}
+async function createWorkspaceForDeploy(client, platformUrl, options, requestedRegions, validatedOptions) {
+	const regions = requestedRegions ?? (await client.listAvailableWorkspaceRegions({})).regions;
+	if (options.dryRun) throw createCLIError({
+		code: "WORKSPACE_CREATION_DISABLED_IN_DRY_RUN",
+		message: "Dry-run cannot create the workspace required to build a deployment plan.",
+		suggestion: "Create a workspace explicitly, then rerun the same dry-run with its workspace ID.",
+		context: { availableRegions: regions }
+	});
+	return createWorkspace(client, platformUrl, options, regions, validatedOptions);
+}
+/**
+* Resolve or provision the workspace used by deploy.
+* Explicit configuration wins over project context and account discovery.
+* @param options - Deploy workspace selection and creation options
+* @returns Authenticated client and resolved workspace ID
+*/
+async function resolveDeployWorkspace(options = {}) {
+	const createOptionNames = [options.workspaceName !== void 0 ? "--workspace-name" : void 0, options.workspaceRegion !== void 0 ? "--workspace-region" : void 0].filter((name) => name !== void 0);
+	if (!options.createWorkspace && createOptionNames.length > 0) throw createCLIError({
+		code: "WORKSPACE_CREATE_FLAG_REQUIRED",
+		message: "Workspace creation options require --create-workspace.",
+		suggestion: "Add --create-workspace or remove the workspace creation options.",
+		next: executableAction(createDeployArgs(options, options.workspaceName ?? "<name>", options.workspaceRegion ?? "<region>")),
+		context: { options: createOptionNames }
+	});
+	if (options.createWorkspace && options.workspaceName !== void 0) {
+		const nameValidation = validateWorkspaceName(options.workspaceName);
+		if (nameValidation !== true) throw invalidCreateOptionsError(options, options.workspaceName, options.workspaceRegion ?? "<region>", nameValidation);
+	}
+	if (options.createWorkspace && options.workspaceRegion === "") throw invalidCreateOptionsError(options, options.workspaceName ?? "<name>", options.workspaceRegion, "Region must not be empty.");
+	const explicitWorkspaceId = await tryLoadWorkspaceId({
+		workspaceId: options.workspaceId,
+		profile: options.profile
+	});
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const platformConfig = await loadPlatformClientConfig({
+		profile: options.profile,
+		allowMissingProfile: explicitWorkspaceId !== void 0
+	});
+	const platformUrl = getPlatformBaseUrl(platformConfig);
+	const client = await initOperatorClient(accessToken, platformConfig);
+	if (explicitWorkspaceId) {
+		let response;
+		try {
+			response = await client.getWorkspace({ workspaceId: explicitWorkspaceId });
+		} catch (error) {
+			if (error instanceof ConnectError && error.code === Code.NotFound) throw createCLIError({
+				code: "WORKSPACE_NOT_FOUND",
+				message: `Workspace "${explicitWorkspaceId}" was not found.`
+			});
+			throw error;
 		}
-	})));
-	creates(CreateAuthServiceRequestSchema, "Auth service", auth.changeSet.service.creates);
-	updates(UpdateAuthServiceRequestSchema, "Auth service", auth.changeSet.service.updates);
-	creates(CreateAuthIDPConfigRequestSchema, "Auth IDP config", auth.changeSet.idpConfig.creates);
-	updates(UpdateAuthIDPConfigRequestSchema, "Auth IDP config", auth.changeSet.idpConfig.updates);
-	creates(CreateUserProfileConfigRequestSchema, "Auth user profile config", auth.changeSet.userProfileConfig.creates);
-	updates(UpdateUserProfileConfigRequestSchema, "Auth user profile config", auth.changeSet.userProfileConfig.updates);
-	creates(CreateTenantConfigRequestSchema, "Auth tenant config", auth.changeSet.tenantConfig.creates);
-	updates(UpdateTenantConfigRequestSchema, "Auth tenant config", auth.changeSet.tenantConfig.updates);
-	creates(CreateAuthMachineUserRequestSchema, "Auth machine user", auth.changeSet.machineUser.creates);
-	updates(UpdateAuthMachineUserRequestSchema, "Auth machine user", auth.changeSet.machineUser.updates);
-	creates(CreateAuthHookRequestSchema, "Auth hook", auth.changeSet.authHook.creates);
-	updates(UpdateAuthHookRequestSchema, "Auth hook", auth.changeSet.authHook.updates);
-	creates(CreateAuthSCIMConfigRequestSchema, "Auth SCIM config", auth.changeSet.scim.creates);
-	updates(UpdateAuthSCIMConfigRequestSchema, "Auth SCIM config", auth.changeSet.scim.updates);
-	creates(CreateAuthSCIMResourceRequestSchema, "Auth SCIM resource", auth.changeSet.scimResource.creates);
-	updates(UpdateAuthSCIMResourceRequestSchema, "Auth SCIM resource", auth.changeSet.scimResource.updates);
-	creates(CreateAuthOAuth2ClientRequestSchema, "OAuth2 client", auth.changeSet.oauth2Client.creates);
-	updates(UpdateAuthOAuth2ClientRequestSchema, "OAuth2 client", auth.changeSet.oauth2Client.updates);
-	replaces(CreateAuthOAuth2ClientRequestSchema, "OAuth2 client", auth.changeSet.oauth2Client.replaces);
-	creates(CreatePipelineServiceRequestSchema, "Pipeline service", pipeline.changeSet.service.creates);
-	updates(UpdatePipelineServiceRequestSchema, "Pipeline service", pipeline.changeSet.service.updates);
-	creates(CreatePipelineResolverRequestSchema, "Resolver", pipeline.changeSet.resolver.creates);
-	updates(UpdatePipelineResolverRequestSchema, "Resolver", pipeline.changeSet.resolver.updates);
-	creates(CreateExecutorExecutorRequestSchema, "Executor", executor.changeSet.creates);
-	updates(UpdateExecutorExecutorRequestSchema, "Executor", executor.changeSet.updates);
-	creates(CreateWorkflowRequestSchema, "Workflow", workflow.changeSet.creates.map((item) => ({
-		name: item.name,
-		request: buildWorkflowValidationShape(item.workspaceId, item.workflow)
-	})));
-	updates(UpdateWorkflowRequestSchema, "Workflow", workflow.changeSet.updates.map((item) => ({
-		name: item.name,
-		request: buildWorkflowValidationShape(item.workspaceId, item.workflow)
-	})));
-	const workflowJobNameWorkspaceId = workflow.changeSet.creates[0]?.workspaceId ?? workflow.changeSet.updates[0]?.workspaceId ?? "";
-	if (workflowJobNameWorkspaceId) {
-		const allJobNames = /* @__PURE__ */ new Set();
-		for (const item of [...workflow.changeSet.creates, ...workflow.changeSet.updates]) for (const jobName of item.usedJobNames) allJobNames.add(jobName);
-		for (const jobName of workflow.unchangedWorkflowJobNames) allJobNames.add(jobName);
-		creates(CreateWorkflowJobFunctionRequestSchema, "Workflow job function", [...allJobNames].map((jobName) => ({
-			name: jobName,
-			request: {
-				workspaceId: workflowJobNameWorkspaceId,
-				jobFunctionName: jobName,
-				scriptRef: jobName
+		if (!response.workspace) throw createCLIError({
+			code: "WORKSPACE_NOT_FOUND",
+			message: `Workspace "${explicitWorkspaceId}" was not found.`
+		});
+		return useWorkspace(client, platformUrl, workspaceInfo(response.workspace), options, "warn");
+	}
+	let requestedCreateOptions;
+	if (options.createWorkspace && options.workspaceName !== void 0 && options.workspaceRegion !== void 0) try {
+		requestedCreateOptions = validateCreateWorkspaceOptions({
+			name: options.workspaceName,
+			region: options.workspaceRegion,
+			organizationId: options.organizationId,
+			folderId: options.folderId
+		});
+	} catch (error) {
+		throw invalidCreateOptionsError(options, options.workspaceName, options.workspaceRegion, error instanceof Error ? error.message : String(error));
+	}
+	const [contexts, workspaces] = await Promise.all([loadProjectContexts(platformUrl, options.contextTargets), listWorkspacesWithClient(client)]);
+	const interactive = canPrompt();
+	const contextWorkspaceIds = new Set(contexts.map(({ workspaceId }) => workspaceId));
+	const linkedWorkspace = contextWorkspaceIds.size === 1 ? workspaces.find(({ id }) => contextWorkspaceIds.has(id)) : void 0;
+	if (linkedWorkspace && (!options.createWorkspace || workspaceMatchesRequestedIdentity(linkedWorkspace, options))) {
+		const contextTargetCount = projectContextTargets(options.contextTargets)?.length ?? 1;
+		return contexts.length === contextTargetCount ? useRememberedWorkspace(client, linkedWorkspace) : useWorkspace(client, platformUrl, linkedWorkspace, options);
+	}
+	const onlyWorkspace = workspaces.length === 1 ? workspaces[0] : void 0;
+	const canReuseOnlyWorkspace = onlyWorkspace !== void 0 && requestedCreateOptions !== void 0 && workspaceMatchesRequestedIdentity(onlyWorkspace, options);
+	let requestedRegions;
+	if (requestedCreateOptions && !canReuseOnlyWorkspace) {
+		requestedRegions = await client.listAvailableWorkspaceRegions({});
+		if (!requestedRegions.regions.includes(requestedCreateOptions.region)) throw invalidCreateOptionsError(options, requestedCreateOptions.name, requestedCreateOptions.region, `Region must be one of: ${requestedRegions.regions.join(", ")}.`);
+	}
+	if (workspaces.length === 0 && (interactive || options.createWorkspace || contexts.length === 0)) {
+		const regions = requestedRegions?.regions ?? (await client.listAvailableWorkspaceRegions({})).regions;
+		if (options.dryRun || interactive || options.createWorkspace) return createWorkspaceForDeploy(client, platformUrl, options, regions, requestedCreateOptions);
+		throw createCLIError({
+			code: "WORKSPACE_NOT_FOUND",
+			message: "No workspaces are available for this account.",
+			suggestion: "Create one during deploy by providing the workspace name and one of the available regions.",
+			next: executableAction(createDeployArgs(options, "<name>", "<region>")),
+			context: { availableRegions: regions }
+		});
+	}
+	if (contextWorkspaceIds.size > 1) {
+		const canReplaceStaleContexts = options.createWorkspace === true && options.workspaceName !== void 0 && options.workspaceRegion !== void 0 && workspaces.length === 0;
+		if (!interactive && !canReplaceStaleContexts) throw createCLIError({
+			code: "WORKSPACE_CONTEXT_CONFLICT",
+			message: "The deployed configuration files are linked to different workspaces.",
+			suggestion: "Choose one workspace explicitly for the combined deployment.",
+			next: executableAction(selectDeployArgs(options)),
+			context: { savedWorkspaceIds: [...contextWorkspaceIds] }
+		});
+		if (workspaces.length > 0 && !options.createWorkspace) return chooseWorkspace(client, platformUrl, workspaces, options);
+	}
+	if (!linkedWorkspace && contexts.length > 0) {
+		const explicitlyEnsuringSingleTarget = options.createWorkspace === true && options.workspaceName !== void 0 && options.workspaceRegion !== void 0 && workspaces.length <= 1;
+		if (!interactive && !explicitlyEnsuringSingleTarget) throw createCLIError({
+			code: "WORKSPACE_CONTEXT_STALE",
+			message: "The saved project workspace is no longer available.",
+			suggestion: "Choose an available workspace explicitly before deploying.",
+			next: executableAction(selectDeployArgs(options)),
+			context: {
+				savedWorkspaceIds: [...contextWorkspaceIds],
+				workspaces: workspaces.map(workspaceIdentity)
 			}
-		})));
+		});
+		if (workspaces.length > 0 && interactive && !options.createWorkspace) return chooseWorkspace(client, platformUrl, workspaces, options);
+	}
+	if (workspaces.length === 1) {
+		const [workspace] = workspaces;
+		if (!workspace) throw new Error("Workspace discovery returned an invalid result");
+		if (options.createWorkspace && !workspaceMatchesRequestedIdentity(workspace, options)) throw createCLIError({
+			code: "WORKSPACE_CREATE_CONFLICT",
+			message: "The existing workspace does not match the requested workspace.",
+			suggestion: "Use the existing workspace, or run the explicit workspace create command to create another one.",
+			next: executableAction([
+				"workspace",
+				"create",
+				...workspaceCommandArgs(options),
+				...options.workspaceCommandJson ? ["--json"] : [],
+				"--name",
+				options.workspaceName ?? "<name>",
+				"--region",
+				options.workspaceRegion ?? "<region>",
+				...options.organizationId ? ["--organization-id", options.organizationId] : [],
+				...options.folderId ? ["--folder-id", options.folderId] : []
+			]),
+			context: { existingWorkspace: workspaceIdentity(workspace) }
+		});
+		if (interactive && !options.createWorkspace) return chooseWorkspace(client, platformUrl, workspaces, options);
+		return useWorkspace(client, platformUrl, workspace, options);
+	}
+	if (workspaces.length > 1) {
+		if (!interactive) throw createCLIError({
+			code: "WORKSPACE_SELECTION_REQUIRED",
+			message: "Multiple workspaces are available.",
+			suggestion: "Choose one explicitly for non-interactive deployment.",
+			next: executableAction(selectDeployArgs(options)),
+			context: { workspaces: workspaces.map(workspaceIdentity) }
+		});
+		return chooseWorkspace(client, platformUrl, workspaces, options);
 	}
-	creates(CreateWorkflowJobFunctionExecutionPolicyRequestSchema, "Workflow execution policy", [...workflowExecutionPolicy.changeSet.creates, ...workflowExecutionPolicy.changeSet.replaces].map((item) => ({
-		name: item.name,
-		request: {
-			workspaceId: item.workspaceId,
-			executionPolicyName: item.policy.name,
-			executionPolicyKey: toPlatformExecutionPolicyKey(item.policy),
-			...item.policy.concurrencyPolicy && { concurrencyPolicy: { maxConcurrentExecutions: item.policy.concurrencyPolicy.maxConcurrentExecutions } }
-		}
-	})));
-	updates(UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, "Workflow execution policy", workflowExecutionPolicy.changeSet.updates.map((item) => ({
-		name: item.name,
-		request: {
-			workspaceId: item.workspaceId,
-			executionPolicyName: item.policy.name,
-			...item.policy.concurrencyPolicy && { concurrencyPolicy: { maxConcurrentExecutions: item.policy.concurrencyPolicy.maxConcurrentExecutions } }
-		}
-	})));
-	creates(CreateSecretManagerVaultRequestSchema, "Secret Manager vault", secretManager.vaultChangeSet.creates.map((item) => ({
-		name: item.name,
-		request: vaultCreateRequest(item)
-	})));
-	creates(CreateSecretManagerSecretRequestSchema, "Secret Manager secret", secretManager.secretChangeSet.creates.map((item) => ({
-		name: item.name,
-		request: secretCreateRequest(item)
-	})));
-	updates(UpdateSecretManagerSecretRequestSchema, "Secret Manager secret", secretManager.secretChangeSet.updates.map((item) => ({
-		name: item.name,
-		request: secretUpdateRequest(item)
-	})));
-	creates(CreateApplicationRequestSchema, "Application", app.creates.map((item) => ({
-		name: item.name,
-		request: {
-			...item.request,
-			cors: void 0
-		}
-	})));
-	updates(UpdateApplicationRequestSchema, "Application", [...app.updates, ...app.unchanged].map((item) => ({
-		name: item.name,
-		request: {
-			...item.request,
-			cors: void 0
-		}
-	})));
-	creates(CreateAuthConnectionRequestSchema, "Auth connection", auth.changeSet.connection.creates);
-	inPlaceReplaces(UpdateAuthConnectionRequestSchema, "Auth connection", auth.changeSet.connection.replaces);
-	if (violations.length === 0) return;
-	const resourceNames = new Set(violations.map((v) => `${v.kind}:${v.name}`));
-	logger.error(`Pre-flight validation found ${violations.length} violation(s) across ${resourceNames.size} resource(s):`);
-	for (const v of violations) logger.log(`  ${styles.resourceType(v.kind)} ${styles.resourceName(v.name)} (${v.action}) — ${styles.bold(v.fieldPath)}: ${v.message}`);
-	throw new Error(`${violations.length} validation error(s) found in ${resourceNames.size} resource(s)`);
+	throw new Error("Workspace discovery returned an invalid result");
 }
 
 //#endregion
@@ -12098,19 +13498,40 @@ function parseDeployConfigPaths(configPath) {
 	if (configPaths.some((entry) => entry.length === 0)) throw new Error("--config must contain one or more non-empty config paths.");
 	return configPaths;
 }
+function recoveryEnvironmentArgs(options, cliContext) {
+	return [
+		...cliContext?.envFile ? ["--env-file", path.resolve(process.cwd(), cliContext.envFile)] : [],
+		...cliContext?.envFileIfExists ? ["--env-file-if-exists", path.resolve(process.cwd(), cliContext.envFileIfExists)] : [],
+		...options?.profile ? ["--profile", options.profile] : []
+	];
+}
+function recoveryOutputArgs(cliContext) {
+	return [...cliContext?.verbose ? ["--verbose"] : [], ...cliContext?.json || logger.jsonMode ? ["--json"] : []];
+}
+function retryDeployArgs(options, configPaths, cliContext) {
+	return [
+		"deploy",
+		"--config",
+		configPaths.join(","),
+		...recoveryEnvironmentArgs(options, cliContext),
+		...options?.dryRun ? ["--dry-run"] : [],
+		...options?.yes ? ["--yes"] : [],
+		...options?.noSchemaCheck ? ["--no-schema-check"] : [],
+		...options?.noValidate ? ["--no-validate"] : [],
+		...options?.noCache ? ["--no-cache"] : [],
+		...options?.cleanCache ? ["--clean-cache"] : [],
+		...recoveryOutputArgs(cliContext)
+	];
+}
+function workspaceRecoveryArgs(options, cliContext) {
+	return [...recoveryEnvironmentArgs(options, cliContext), ...cliContext?.verbose ? ["--verbose"] : []];
+}
 async function buildDeploymentTarget(params) {
-	const { configPath, dryRun, buildOnly, noCache, packageVersion, cacheDir } = params;
-	const { config, plugins } = await withSpan("build.loadConfig", async () => {
-		const foundPath = loadConfigPath(configPath);
-		if (foundPath) {
-			const resolvedPath = path.resolve(process.cwd(), foundPath);
-			if (fs$1.existsSync(resolvedPath)) await ensureConfigIdForDeploy({
-				configPath: resolvedPath,
-				dryRun,
-				buildOnly
-			});
-		}
-		return loadConfig(configPath);
+	const { configPath, loadedConfig, dryRun, buildOnly, noCache, packageVersion, cacheDir } = params;
+	const { config, plugins } = loadedConfig ?? await loadDeployConfig({
+		configPath,
+		dryRun,
+		buildOnly
 	});
 	const configDir = path.dirname(config.path);
 	const lockfilePath = findUpSync("pnpm-lock.yaml", { cwd: configDir }) ?? findUpSync("package-lock.json", { cwd: configDir }) ?? findUpSync("yarn.lock", { cwd: configDir }) ?? findUpSync("bun.lock", { cwd: configDir });
@@ -12151,11 +13572,27 @@ async function buildDeploymentTarget(params) {
 		bundledScripts
 	};
 }
+async function loadDeployConfig(params) {
+	const { configPath, dryRun, buildOnly } = params;
+	return withSpan("build.loadConfig", async () => {
+		const foundPath = loadConfigPath(configPath);
+		if (foundPath) {
+			const resolvedPath = path.resolve(process.cwd(), foundPath);
+			if (fs$2.existsSync(resolvedPath)) await ensureConfigIdForDeploy({
+				configPath: resolvedPath,
+				dryRun,
+				buildOnly
+			});
+		}
+		return loadConfig(configPath);
+	});
+}
 async function buildDeploymentTargets(params) {
-	const { configPaths, buildTarget = buildDeploymentTarget, ...targetParams } = params;
-	return Promise.all(configPaths.map((configPath) => buildTarget({
+	const { configPaths, loadedConfigs, buildTarget = buildDeploymentTarget, ...targetParams } = params;
+	return Promise.all(configPaths.map((configPath, index) => buildTarget({
 		...targetParams,
-		configPath
+		configPath,
+		loadedConfig: loadedConfigs?.[index]
 	})));
 }
 function setBundledScript(target, name, code, kind) {
@@ -12734,45 +14171,65 @@ async function validateDeploymentPlans(deployments) {
 }
 /**
 * Deploy the configured application to the Tailor platform.
-* @param options - Options for deploy execution
+* @param options - Deploy execution options
+* @param cliContext - Global CLI arguments to preserve in recovery actions
 * @returns Promise that resolves to `{ bundledScripts }` when `buildOnly` is true, otherwise void
 */
-async function deploy(options) {
+async function deployInternal(options, cliContext) {
 	return withSpan("deploy", async (rootSpan) => {
 		rootSpan.setAttribute("deploy.dry_run", options?.dryRun ?? false);
 		const configPaths = parseDeployConfigPaths(options?.configPath);
-		const { targets, buildOnly } = await withSpan("build", async () => {
-			const dryRun = options?.dryRun ?? false;
-			const buildOnly = options?.buildOnly ?? parseBoolean(process.env.TAILOR_DEPLOY_BUILD_ONLY) === true;
+		const dryRun = options?.dryRun ?? false;
+		const buildOnly = options?.buildOnly ?? parseBoolean(process.env.TAILOR_DEPLOY_BUILD_ONLY) === true;
+		const preflightConfigs = buildOnly ? [] : await withSpan("config.preflight", () => Promise.all(configPaths.map((configPath) => loadDeployConfig({
+			configPath,
+			dryRun,
+			buildOnly
+		}))));
+		const resolvedConfigPaths = preflightConfigs.map(({ config }) => config.path);
+		const workspaceContextTargets = preflightConfigs.map(({ config }) => ({
+			configPath: config.path,
+			applicationId: config.id ?? `name:${config.name}`
+		}));
+		const workspace = buildOnly ? void 0 : await resolveDeployWorkspace({
+			workspaceId: options?.workspaceId,
+			profile: options?.profile,
+			createWorkspace: options?.createWorkspace,
+			workspaceName: options?.workspaceName,
+			workspaceRegion: options?.workspaceRegion,
+			organizationId: options?.organizationId,
+			folderId: options?.folderId,
+			dryRun,
+			contextTargets: workspaceContextTargets,
+			deployArgs: retryDeployArgs(options, resolvedConfigPaths, cliContext),
+			workspaceCommandArgs: workspaceRecoveryArgs(options, cliContext),
+			workspaceCommandJson: cliContext?.json || logger.jsonMode
+		});
+		const targets = await withSpan("build", async () => {
 			const noCache = options?.noCache ?? false;
 			const packageJson = await readPackageJson();
 			const cacheDir = path.resolve(getDistDir(), "cache");
 			if (options?.cleanCache) {
-				fs$1.rmSync(cacheDir, {
+				fs$2.rmSync(cacheDir, {
 					recursive: true,
 					force: true
 				});
 				logger.info("Bundle cache cleaned");
 			}
-			return {
-				targets: await buildDeploymentTargets({
-					configPaths,
-					dryRun,
-					buildOnly,
-					noCache,
-					packageVersion: packageJson.version ?? "unknown",
-					cacheDir
-				}),
-				buildOnly
-			};
+			return await buildDeploymentTargets({
+				configPaths,
+				loadedConfigs: preflightConfigs,
+				dryRun,
+				buildOnly,
+				noCache,
+				packageVersion: packageJson.version ?? "unknown",
+				cacheDir
+			});
 		});
 		if (buildOnly) return { bundledScripts: mergeBundledScripts(targets) };
-		assertUniqueGlobalResourceNames(targets);
-		const client = await initOperatorClient(await loadAccessToken({ profile: options?.profile }));
-		const workspaceId = await loadWorkspaceId({
-			workspaceId: options?.workspaceId,
-			profile: options?.profile
-		});
+		assertUniqueGlobalResourceNames(targets);
+		if (!workspace) throw new Error("Workspace was not resolved");
+		const { client, workspaceId } = workspace;
 		rootSpan.setAttribute("app.name", targets.map((target) => target.application.name).join(","));
 		rootSpan.setAttribute("workspace.id", workspaceId);
 		const deployments = await planDeploymentTargets({
@@ -12782,7 +14239,6 @@ async function deploy(options) {
 			workspaceId,
 			noSchemaCheck: options?.noSchemaCheck
 		});
-		const dryRun = options?.dryRun ?? false;
 		const yes = options?.yes ?? false;
 		dropCrossDeploymentManagedDeletes(deployments);
 		await withSpan("confirm", async () => {
@@ -12806,6 +14262,23 @@ async function deploy(options) {
 		else logger.success("Successfully applied changes.");
 	});
 }
+/**
+* Deploy using the programmatic CLI API.
+* @param options - Deploy execution options
+* @returns Deploy result
+*/
+function deploy(options) {
+	return deployInternal(options);
+}
+/**
+* Deploy from the command adapter while preserving global CLI arguments in recovery actions.
+* @param options - Deploy execution options
+* @param cliContext - Global CLI arguments already applied by the command runner
+* @returns Deploy result
+*/
+function deployFromCLI(options, cliContext) {
+	return deployInternal(options, cliContext);
+}
 
 //#endregion
 //#region src/cli/commands/executor/status.ts
@@ -13195,52 +14668,6 @@ const getCommand$6 = defineAppCommand({
 	}
 });
 
-//#endregion
-//#region src/cli/shared/format.ts
-/**
-* Format a protobuf Timestamp to ISO string.
-* @param timestamp - Protobuf timestamp
-* @returns Date object or null if invalid
-*/
-function formatTimestamp(timestamp) {
-	if (!timestamp) return null;
-	const date = timestampDate(timestamp);
-	if (Number.isNaN(date.getTime())) return null;
-	return date;
-}
-/**
-* Formats a table with consistent single-line border style.
-* Use this instead of importing `table` directly.
-* @param data - Table data
-* @param config - Table configuration
-* @returns Formatted table string
-*/
-function formatTable(data, config) {
-	return table(data, {
-		...config,
-		border: getBorderCharacters("norc")
-	});
-}
-/**
-* Formats a key-value table with single-line border style.
-* @param data - Key-value pairs
-* @returns Formatted key-value table string
-*/
-function formatKeyValueTable(data) {
-	return formatTable(data, { singleLine: true });
-}
-/**
-* Format a Date or ISO timestamp string as a human-readable relative time.
-* @param value - Date object, ISO date string, or null
-* @returns Relative time (e.g., "5 minutes ago") or "N/A" for null/invalid
-*/
-function humanizeRelativeTime(value) {
-	if (value === null) return "N/A";
-	const date = value instanceof Date ? value : new Date(value);
-	if (Number.isNaN(date.getTime())) return typeof value === "string" ? value : "N/A";
-	return formatDistanceToNowStrict(date, { addSuffix: true });
-}
-
 //#endregion
 //#region src/cli/shared/function-execution.ts
 /**
@@ -14657,7 +16084,7 @@ async function listExecutors(options) {
 		return [executors, nextPageToken];
 	}, { limit: options?.limit })).map((e) => toExecutorListInfo(e));
 }
-const listCommand$9 = defineAppCommand({
+const listCommand$8 = defineAppCommand({
 	name: "list",
 	description: "List all executors",
 	args: z.strictObject({
@@ -15082,7 +16509,7 @@ async function listFunctionRegistries(options) {
 		}
 	}, { limit })).map(functionRegistryInfo);
 }
-const listCommand$8 = defineAppCommand({
+const listCommand$7 = defineAppCommand({
 	name: "list",
 	description: "List function registries in a workspace",
 	args: z.strictObject({
@@ -15106,387 +16533,6 @@ const listCommand$8 = defineAppCommand({
 	}
 });
 
-//#endregion
-//#region src/cli/commands/generate/watch/index.ts
-/**
-* Error codes.
-*/
-const WatcherErrorCode = {
-	DEPENDENCY_ANALYSIS_FAILED: "DEPENDENCY_ANALYSIS_FAILED",
-	FILE_WATCH_FAILED: "FILE_WATCH_FAILED",
-	CIRCULAR_DEPENDENCY_DETECTED: "CIRCULAR_DEPENDENCY_DETECTED",
-	INVALID_WATCH_GROUP: "INVALID_WATCH_GROUP",
-	MADGE_INITIALIZATION_FAILED: "MADGE_INITIALIZATION_FAILED"
-};
-/**
-* Watcher-specific error.
-*/
-var WatcherError = class extends Error {
-	code;
-	filePath;
-	originalError;
-	constructor(message, code, filePath, originalError) {
-		super(message);
-		this.code = code;
-		this.filePath = filePath;
-		this.originalError = originalError;
-		this.name = "WatcherError";
-	}
-};
-/**
-* Creates a dependency graph manager.
-* @param options - Options for madge
-* @returns DependencyGraphManager instance
-*/
-function createDependencyGraphManager(options = {}) {
-	const graph = /* @__PURE__ */ new Map();
-	let madgeInstance = null;
-	let madgeLoader = null;
-	function getMadgeLoader() {
-		if (madgeLoader) return madgeLoader;
-		const defaultExport = madgeModule.default;
-		if (typeof defaultExport === "function") {
-			madgeLoader = defaultExport;
-			return madgeLoader;
-		}
-		if (typeof madgeModule === "function") {
-			madgeLoader = madgeModule;
-			return madgeLoader;
-		}
-		throw new WatcherError("Failed to initialize madge analyzer: module did not export a callable function.", WatcherErrorCode.MADGE_INITIALIZATION_FAILED);
-	}
-	function traverseDependents(filePath, visited) {
-		if (visited.has(filePath)) return [];
-		visited.add(filePath);
-		const node = graph.get(filePath);
-		if (!node) return [];
-		const result = [];
-		for (const dependent of node.dependents) {
-			result.push(dependent);
-			result.push(...traverseDependents(dependent, visited));
-		}
-		return result;
-	}
-	function traverseDependencies(filePath, visited) {
-		if (visited.has(filePath)) return [];
-		visited.add(filePath);
-		const node = graph.get(filePath);
-		if (!node) return [];
-		const result = [];
-		for (const dependency of node.dependencies) {
-			result.push(dependency);
-			result.push(...traverseDependencies(dependency, visited));
-		}
-		return result;
-	}
-	function addNode(filePath) {
-		const absolutePath = path.resolve(filePath);
-		if (!graph.has(absolutePath)) graph.set(absolutePath, {
-			filePath: absolutePath,
-			dependencies: /* @__PURE__ */ new Set(),
-			dependents: /* @__PURE__ */ new Set()
-		});
-	}
-	function removeNode(filePath) {
-		const absolutePath = path.resolve(filePath);
-		const node = graph.get(absolutePath);
-		if (!node) return;
-		for (const dep of node.dependencies) {
-			const depNode = graph.get(dep);
-			if (depNode) depNode.dependents.delete(absolutePath);
-		}
-		for (const dependent of node.dependents) {
-			const dependentNode = graph.get(dependent);
-			if (dependentNode) dependentNode.dependencies.delete(absolutePath);
-		}
-		graph.delete(absolutePath);
-	}
-	function findCircularDependencies() {
-		if (!madgeInstance) return [];
-		try {
-			return madgeInstance.circular();
-		} catch (error) {
-			logger.warn(`Failed to detect circular dependencies: ${String(error)}`);
-			return [];
-		}
-	}
-	return {
-		async buildGraph(filePaths) {
-			try {
-				if (filePaths.length === 0) return;
-				madgeInstance = await getMadgeLoader()(filePaths, {
-					fileExtensions: ["ts", "js"],
-					excludeRegExp: [/node_modules/],
-					baseDir: ".",
-					...options
-				});
-				const dependencyObj = madgeInstance.obj();
-				graph.clear();
-				for (const filePath of filePaths) addNode(filePath);
-				for (const [filePath, dependencies] of Object.entries(dependencyObj)) {
-					const absoluteFilePath = path.resolve(".", filePath);
-					const node = graph.get(absoluteFilePath);
-					if (!node) continue;
-					for (const dep of dependencies) {
-						const absoluteDepPath = path.resolve(".", dep);
-						node.dependencies.add(absoluteDepPath);
-						const depNode = graph.get(absoluteDepPath);
-						if (depNode) depNode.dependents.add(absoluteFilePath);
-					}
-				}
-			} catch (error) {
-				if (error instanceof WatcherError) throw error;
-				throw new WatcherError(`Failed to build dependency graph: ${error instanceof Error ? error.message : String(error)}`, WatcherErrorCode.DEPENDENCY_ANALYSIS_FAILED, void 0, error instanceof Error ? error : void 0);
-			}
-		},
-		getDependents(filePath) {
-			const visited = /* @__PURE__ */ new Set();
-			return traverseDependents(path.resolve(filePath), visited);
-		},
-		getDependencies(filePath) {
-			const visited = /* @__PURE__ */ new Set();
-			return traverseDependencies(path.resolve(filePath), visited);
-		},
-		findCircularDependencies,
-		addNode,
-		removeNode,
-		getGraphStats() {
-			let edgeCount = 0;
-			for (const node of graph.values()) edgeCount += node.dependencies.size;
-			return {
-				nodeCount: graph.size,
-				edgeCount,
-				circularDependencyCount: findCircularDependencies().length
-			};
-		}
-	};
-}
-/**
-* Creates a dependency watcher.
-* @param options - Watcher options
-* @returns DependencyWatcher instance
-*/
-function createDependencyWatcher(options = {}) {
-	let chokidarWatcher = null;
-	const watchGroups = /* @__PURE__ */ new Map();
-	const dependencyGraphManager = createDependencyGraphManager(options.madgeOptions);
-	let errorCallback = null;
-	const debounceTimers = /* @__PURE__ */ new Map();
-	let isInitialized = false;
-	const dependencyCache = /* @__PURE__ */ new Map();
-	const maxCacheSize = 1e3;
-	let signalHandlersRegistered = false;
-	let restartCallback = null;
-	function validateWatchGroup(groupId, patterns) {
-		if (!groupId || typeof groupId !== "string") throw new WatcherError("Group ID must be a non-empty string", WatcherErrorCode.INVALID_WATCH_GROUP);
-		if (!Array.isArray(patterns) || patterns.length === 0) throw new WatcherError("Patterns must be a non-empty array", WatcherErrorCode.INVALID_WATCH_GROUP);
-		if (watchGroups.has(groupId)) throw new WatcherError(`Watch group with ID '${groupId}' already exists`, WatcherErrorCode.INVALID_WATCH_GROUP);
-	}
-	function handleError(error) {
-		logger.error(`[DependencyWatcher] ${error.message} (code: ${error.code}, filePath: ${error.filePath})`);
-		if (errorCallback) errorCallback(error);
-	}
-	function setCacheValue(key, value) {
-		if (dependencyCache.size >= maxCacheSize) {
-			const firstKey = dependencyCache.keys().next().value;
-			if (firstKey) dependencyCache.delete(firstKey);
-		}
-		dependencyCache.set(key, value);
-	}
-	function findAffectedFiles(changedFile) {
-		return dependencyGraphManager.getDependents(changedFile);
-	}
-	function findAffectedGroups(affectedFiles) {
-		logger.debug(`Finding affected groups for files: ${affectedFiles.join(", ")}`);
-		const affectedGroupsSet = /* @__PURE__ */ new Set();
-		for (const [groupId, group] of watchGroups) for (const affectedFile of affectedFiles) if (group.files.has(affectedFile)) {
-			logger.debug(`Group ${groupId} is affected by file: ${affectedFile}`);
-			affectedGroupsSet.add(groupId);
-			break;
-		}
-		return Array.from(affectedGroupsSet);
-	}
-	function calculateImpact(filePath) {
-		const cacheKey = `impact:${filePath}`;
-		let affectedFiles = dependencyCache.get(cacheKey);
-		if (!affectedFiles) {
-			affectedFiles = findAffectedFiles(filePath);
-			setCacheValue(cacheKey, affectedFiles);
-		}
-		const allAffectedFiles = [filePath, ...affectedFiles];
-		return {
-			changedFile: filePath,
-			affectedFiles: allAffectedFiles,
-			affectedGroups: findAffectedGroups(allAffectedFiles)
-		};
-	}
-	async function updateDependencyGraph() {
-		const allFiles = [];
-		for (const group of watchGroups.values()) allFiles.push(...Array.from(group.files));
-		await dependencyGraphManager.buildGraph(allFiles);
-		dependencyCache.clear();
-		if (options.detectCircularDependencies) {
-			const circularDeps = dependencyGraphManager.findCircularDependencies();
-			if (circularDeps.length > 0) logger.warn(`Circular dependencies detected: ${JSON.stringify(circularDeps)}`);
-		}
-	}
-	async function handleFileChange(event, filePath) {
-		try {
-			const absolutePath = path.resolve(filePath);
-			if (event === "unlink") dependencyGraphManager.removeNode(absolutePath);
-			else {
-				dependencyGraphManager.addNode(absolutePath);
-				if (event === "change") await updateDependencyGraph();
-			}
-			dependencyCache.clear();
-			const impactResult = calculateImpact(absolutePath);
-			if (impactResult.affectedGroups.length > 0) {
-				logger.info("File change detected, restarting watch process...", { mode: "stream" });
-				logger.info(`Changed file: ${absolutePath}`, { mode: "stream" });
-				logger.info(`Affected groups: ${impactResult.affectedGroups.join(", ")}`, { mode: "stream" });
-				if (restartCallback) restartCallback();
-			} else logger.debug(`No affected groups found for file: ${absolutePath}`);
-		} catch (error) {
-			handleError(new WatcherError(`Failed to handle file change: ${error instanceof Error ? error.message : String(error)}`, WatcherErrorCode.DEPENDENCY_ANALYSIS_FAILED, filePath, error instanceof Error ? error : void 0));
-		}
-	}
-	function debounceFileChange(event, filePath) {
-		const key = `${event}:${filePath}`;
-		if (debounceTimers.has(key)) clearTimeout(debounceTimers.get(key));
-		const timer = setTimeout(() => {
-			handleFileChange(event, filePath);
-			debounceTimers.delete(key);
-		}, options.debounceTime || 100);
-		debounceTimers.set(key, timer);
-	}
-	async function stop() {
-		if (chokidarWatcher) {
-			await chokidarWatcher.close();
-			chokidarWatcher = null;
-		}
-		for (const timer of debounceTimers.values()) clearTimeout(timer);
-		debounceTimers.clear();
-		removeSignalHandlers();
-		isInitialized = false;
-	}
-	function setupSignalHandlers() {
-		if (signalHandlersRegistered) return;
-		const handleSignal = async () => {
-			try {
-				await stop();
-				logger.info("Watcher stopped successfully");
-				process.exit(0);
-			} catch (error) {
-				logger.error(`Error during shutdown: ${String(error)}`);
-				process.exit(0);
-			}
-		};
-		process.on("SIGINT", () => handleSignal());
-		process.on("SIGTERM", () => handleSignal());
-		signalHandlersRegistered = true;
-	}
-	function removeSignalHandlers() {
-		if (!signalHandlersRegistered) return;
-		process.removeAllListeners("SIGINT");
-		process.removeAllListeners("SIGTERM");
-		signalHandlersRegistered = false;
-	}
-	async function initialize() {
-		if (isInitialized) return;
-		try {
-			chokidarWatcher = watch([], {
-				ignored: /node_modules/,
-				persistent: true,
-				ignoreInitial: true,
-				usePolling: false,
-				awaitWriteFinish: {
-					stabilityThreshold: 100,
-					pollInterval: 100
-				},
-				...options.chokidarOptions
-			});
-			chokidarWatcher.on("add", (filePath) => {
-				logger.debug(`File added: ${filePath}`);
-				debounceFileChange("add", filePath);
-			});
-			chokidarWatcher.on("change", (filePath) => {
-				logger.debug(`File changed: ${filePath}`);
-				debounceFileChange("change", filePath);
-			});
-			chokidarWatcher.on("unlink", (filePath) => {
-				logger.debug(`File removed: ${filePath}`);
-				debounceFileChange("unlink", filePath);
-			});
-			chokidarWatcher.on("error", (error) => {
-				logger.error(`Watcher error: ${error instanceof Error ? error.message : String(error)}`, { mode: "stream" });
-				handleError(new WatcherError(`File watcher error: ${error instanceof Error ? error.message : String(error)}`, WatcherErrorCode.FILE_WATCH_FAILED, void 0, error instanceof Error ? error : void 0));
-			});
-			setupSignalHandlers();
-			isInitialized = true;
-		} catch (error) {
-			throw new WatcherError(`Failed to initialize watcher: ${error instanceof Error ? error.message : String(error)}`, WatcherErrorCode.FILE_WATCH_FAILED, void 0, error instanceof Error ? error : void 0);
-		}
-	}
-	return {
-		initialize,
-		async addWatchGroup(groupId, patterns) {
-			validateWatchGroup(groupId, patterns);
-			if (!isInitialized) await initialize();
-			const files = /* @__PURE__ */ new Set();
-			for (const pattern of patterns) {
-				logger.log(`${styles.dim(`Watch pattern for`)} ${styles.dim(groupId + ":")} ${path.relative(process.cwd(), pattern)}`);
-				for await (const file of glob(pattern)) files.add(path.resolve(file));
-			}
-			const watchGroup = {
-				id: groupId,
-				patterns,
-				files
-			};
-			watchGroups.set(groupId, watchGroup);
-			if (chokidarWatcher) {
-				const filePaths = Array.from(files);
-				chokidarWatcher.add(filePaths);
-			}
-			await updateDependencyGraph();
-		},
-		async removeWatchGroup(groupId) {
-			const watchGroup = watchGroups.get(groupId);
-			if (!watchGroup) return;
-			if (chokidarWatcher) chokidarWatcher.unwatch(watchGroup.patterns);
-			for (const filePath of watchGroup.files) dependencyGraphManager.removeNode(filePath);
-			watchGroups.delete(groupId);
-			dependencyCache.clear();
-		},
-		async start() {
-			if (!isInitialized) await initialize();
-			await updateDependencyGraph();
-		},
-		stop,
-		onError(callback) {
-			errorCallback = callback;
-		},
-		updateDependencyGraph,
-		calculateImpact,
-		detectCircularDependencies() {
-			return dependencyGraphManager.findCircularDependencies();
-		},
-		getWatchStatus() {
-			let fileCount = 0;
-			for (const group of watchGroups.values()) fileCount += group.files.size;
-			const stats = dependencyGraphManager.getGraphStats();
-			return {
-				isWatching: isInitialized && chokidarWatcher !== null,
-				groupCount: watchGroups.size,
-				fileCount,
-				dependencyNodeCount: stats.nodeCount
-			};
-		},
-		setRestartCallback(callback) {
-			restartCallback = callback;
-		}
-	};
-}
-
 //#endregion
 //#region src/cli/commands/generate/service.ts
 /**
@@ -15500,13 +16546,12 @@ function createDependencyWatcher(options = {}) {
 function createGenerationManager(params) {
 	const { application, config, pluginManager } = params;
 	const baseDir = path.join(getDistDir(), "generated");
-	fs$1.mkdirSync(baseDir, { recursive: true });
+	fs$2.mkdirSync(baseDir, { recursive: true });
 	const services = {
 		tailordb: {},
 		resolver: {},
 		executor: {}
 	};
-	let watcher = null;
 	const generationPlugins = pluginManager?.getPluginsWithGenerationHooks() ?? [];
 	function getAuthInput() {
 		const authService = application.authService;
@@ -15598,24 +16643,20 @@ function createGenerationManager(params) {
 	* Each hook runs at its natural pipeline phase, ensuring outputs from earlier
 	* phases are available when later phases load resolvers/executors.
 	* @param hookName - Name of the hook to call
-	* @param watch - Whether running in watch mode (suppresses throws)
 	*/
-	async function runPluginHook(hookName, watch) {
+	async function runPluginHook(hookName) {
 		const plugins = generationPlugins.filter((p) => p[hookName] != null);
 		if (plugins.length === 0) return;
-		const results = await Promise.allSettled(plugins.map(async (plugin) => {
+		const failures = (await Promise.allSettled(plugins.map(async (plugin) => {
 			try {
 				await runPluginPhaseHook(plugin, hookName);
 			} catch (error) {
 				logger.error(`Error processing plugin ${styles.bold(plugin.id)} (${hookName})`);
 				logger.error(String(error));
-				if (!watch) throw error;
+				throw error;
 			}
-		}));
-		if (!watch) {
-			const failures = results.filter((r) => r.status === "rejected");
-			if (failures.length > 0) throw new AggregateError(failures.map((f) => f.reason));
-		}
+		}))).filter((r) => r.status === "rejected");
+		if (failures.length > 0) throw new AggregateError(failures.map((f) => f.reason));
 	}
 	/**
 	* Write generated files to disk.
@@ -15624,14 +16665,14 @@ function createGenerationManager(params) {
 	*/
 	async function writeGeneratedFiles(sourceId, result) {
 		await Promise.all(result.files.map(async (file) => {
-			fs$1.mkdirSync(path.dirname(file.path), { recursive: true });
+			fs$2.mkdirSync(path.dirname(file.path), { recursive: true });
 			return new Promise((resolve, reject) => {
-				if (file.skipIfExists && fs$1.existsSync(file.path)) {
+				if (file.skipIfExists && fs$2.existsSync(file.path)) {
 					const relativePath = path.relative(process.cwd(), file.path);
 					logger.debug(`${sourceId} | skip existing: ${relativePath}`);
 					return resolve();
 				}
-				fs$1.writeFile(file.path, file.content, (err) => {
+				fs$2.writeFile(file.path, file.content, (err) => {
 					if (err) {
 						const relativePath = path.relative(process.cwd(), file.path);
 						logger.error(`Error writing file ${styles.bold(relativePath)}`);
@@ -15640,7 +16681,7 @@ function createGenerationManager(params) {
 					} else {
 						const relativePath = path.relative(process.cwd(), file.path);
 						logger.log(`${sourceId} | generate: ${styles.success(relativePath)}`);
-						if (file.executable) fs$1.chmod(file.path, 493, (chmodErr) => {
+						if (file.executable) fs$2.chmod(file.path, 493, (chmodErr) => {
 							if (chmodErr) {
 								const relativePath = path.relative(process.cwd(), file.path);
 								logger.error(`Error setting executable permission on ${styles.bold(relativePath)}`);
@@ -15654,35 +16695,11 @@ function createGenerationManager(params) {
 			});
 		}));
 	}
-	async function restartWatchProcess() {
-		logger.newline();
-		logger.info("Restarting watch process to clear module cache...", { mode: "stream" });
-		logger.newline();
-		if (watcher) await watcher.stop();
-		const args = process.argv.slice(2);
-		const env = {
-			...process.env,
-			__TAILOR_WATCH_GENERATION: (parseInt(process.env.__TAILOR_WATCH_GENERATION || "0", 10) + 1).toString()
-		};
-		const child = spawn(assertDefined(process.argv[0], "argv[0] missing"), [assertDefined(process.argv[1], "argv[1] missing"), ...args], {
-			stdio: "inherit",
-			env,
-			detached: false
-		});
-		const forwardSignal = (signal) => {
-			child.kill(signal);
-		};
-		process.on("SIGINT", forwardSignal);
-		process.on("SIGTERM", forwardSignal);
-		child.on("exit", (code) => {
-			process.exit(code || 0);
-		});
-	}
 	return {
 		application,
 		baseDir,
 		services,
-		async generate(watch) {
+		async generate() {
 			logger.newline();
 			logger.log(`Generation for application: ${styles.highlight(application.config.name)}`);
 			const app = application;
@@ -15702,7 +16719,7 @@ function createGenerationManager(params) {
 						} catch (error) {
 							logger.error(`Error loading types for TailorDB service ${styles.bold(namespace)}`);
 							logger.error(String(error));
-							if (!watch) throw error;
+							throw error;
 						}
 					});
 				}
@@ -15711,14 +16728,17 @@ function createGenerationManager(params) {
 				} catch (error) {
 					logger.error("Error validating TailorDB type names");
 					logger.error(String(error));
-					if (!watch) throw error;
+					throw error;
 				}
 			});
 			const { pluginExecutorFiles, executorService } = await withSpan("generate.pluginFiles", async () => {
 				const pluginExecutorFiles = generatePluginFilesIfNeeded(pluginManager, app.tailorDBServices, config.path);
 				return {
 					pluginExecutorFiles,
-					executorService: app.executorService ?? (pluginExecutorFiles.length > 0 ? createExecutorService({ config: { files: [] } }) : void 0)
+					executorService: app.executorService ?? (pluginExecutorFiles.length > 0 ? createExecutorService({
+						config: { files: [] },
+						baseDir: path.dirname(config.path)
+					}) : void 0)
 				};
 			});
 			if (app.authService) {
@@ -15728,7 +16748,7 @@ function createGenerationManager(params) {
 			if (app.tailorDBServices.length > 0 || pluginExecutorFiles.length > 0) logger.newline();
 			if (generationPlugins.some((p) => p.onTailorDBReady != null)) {
 				await withSpan("generate.onTailorDBReady", async () => {
-					await runPluginHook("onTailorDBReady", watch);
+					await runPluginHook("onTailorDBReady");
 				});
 				logger.newline();
 			}
@@ -15746,14 +16766,14 @@ function createGenerationManager(params) {
 						} catch (error) {
 							logger.error(`Error loading resolvers for Resolver service ${styles.bold(namespace)}`);
 							logger.error(String(error));
-							if (!watch) throw error;
+							throw error;
 						}
 					});
 				}
 			});
 			if (generationPlugins.some((p) => p.onResolverReady != null)) {
 				await withSpan("generate.onResolversReady", async () => {
-					await runPluginHook("onResolverReady", watch);
+					await runPluginHook("onResolverReady");
 				});
 				logger.newline();
 			}
@@ -15769,42 +16789,23 @@ function createGenerationManager(params) {
 			});
 			if (generationPlugins.some((p) => p.onExecutorReady != null)) {
 				await withSpan("generate.onExecutorsReady", async () => {
-					await runPluginHook("onExecutorReady", watch);
+					await runPluginHook("onExecutorReady");
 				});
 				logger.newline();
 			}
-		},
-		async watch() {
-			watcher = createDependencyWatcher();
-			watcher.setRestartCallback(() => {
-				restartWatchProcess();
-			});
-			await watcher.addWatchGroup("Config", [config.path]);
-			const app = application;
-			for (const db of app.tailorDBServices) {
-				const dbNamespace = db.namespace;
-				await watcher.addWatchGroup(`TailorDB/${dbNamespace}`, db.config.files);
-			}
-			for (const resolverService of app.resolverServices) {
-				const resolverNamespace = resolverService.namespace;
-				await watcher.addWatchGroup(`Resolver/${resolverNamespace}`, resolverService["config"].files);
-			}
-			await new Promise(() => {});
 		}
 	};
 }
 /**
 * Run code generation using the Tailor configuration.
 * @param options - Generation options
-* @returns Promise that resolves when generation (and watch, if enabled) completes
+* @returns Promise that resolves when generation completes
 */
 async function generate$1(options) {
 	return withSpan("generate", async (rootSpan) => {
 		const { config, plugins } = await withSpan("generate.loadConfig", async () => {
 			return loadConfig(options?.configPath);
 		});
-		const watch = options?.watch ?? false;
-		rootSpan.setAttribute("generate.watch", watch);
 		await withSpan("generate.generateUserTypes", async () => generateUserTypes({
 			config,
 			configPath: config.path
@@ -15816,13 +16817,11 @@ async function generate$1(options) {
 			pluginManager
 		});
 		rootSpan.setAttribute("app.name", application.config.name);
-		const manager = createGenerationManager({
+		await createGenerationManager({
 			application,
 			config,
 			pluginManager
-		});
-		await manager.generate(watch);
-		if (watch) await manager.watch();
+		}).generate();
 	});
 }
 
@@ -15872,7 +16871,7 @@ async function listMachineUsers(options) {
 		return [machineUsers, nextPageToken];
 	}, { limit: options?.limit })).map(machineUserInfo);
 }
-const listCommand$7 = defineAppCommand({
+const listCommand$6 = defineAppCommand({
 	name: "list",
 	description: "List all machine users in the application.",
 	args: z.strictObject({
@@ -16088,7 +17087,7 @@ async function listOAuth2Clients(options) {
 		return [oauth2Clients, nextPageToken];
 	}, { limit: options?.limit })).map(toOAuth2ClientInfo);
 }
-const listCommand$6 = defineAppCommand({
+const listCommand$5 = defineAppCommand({
 	name: "list",
 	description: "List all OAuth2 clients in the application.",
 	args: z.strictObject({
@@ -16158,7 +17157,7 @@ async function createFolder(options) {
 	if (!response.folder) throw new Error("Failed to create folder.");
 	return folderInfo(response.folder);
 }
-const createCommand$1 = defineAppCommand({
+const createCommand = defineAppCommand({
 	name: "create",
 	description: "Create a new folder in an organization.",
 	args: z.strictObject({
@@ -16306,7 +17305,7 @@ async function listFolders(options) {
 		return [response.folders, response.nextPageToken];
 	}, { limit })).map(folderListInfo);
 }
-const listCommand$5 = defineAppCommand({
+const listCommand$4 = defineAppCommand({
 	name: "list",
 	description: "List folders in an organization.",
 	args: z.strictObject({
@@ -16415,7 +17414,7 @@ async function listOrganizations(options) {
 	if (limit !== void 0) return results.slice(0, limit);
 	return results;
 }
-const listCommand$4 = defineAppCommand({
+const listCommand$3 = defineAppCommand({
 	name: "list",
 	description: "List organizations you belong to.",
 	args: z.strictObject({ limit: arg(positiveIntArg.optional(), {
@@ -16726,7 +17725,7 @@ const removeCommand$1 = defineAppCommand({
 //#region src/cli/shared/beta.ts
 /**
 * Warn that a feature is in beta.
-* @param {string} featureName - Name of the beta feature (e.g., "tailordb erd", "tailordb migration")
+* @param {string} featureName - Name of the beta feature (e.g., "tailordb migration")
 */
 function logBetaWarning(featureName) {
 	logger.warn(`The '${featureName}' command is a beta feature and may introduce breaking changes in future releases.`);
@@ -16757,89 +17756,11 @@ function extractAllNamespaces(config) {
 function extractOwnedNamespaces(config) {
 	const namespaces = /* @__PURE__ */ new Set();
 	if (config.db) for (const [namespaceName, nsConfig] of Object.entries(config.db)) {
-		if ("external" in nsConfig) continue;
-		namespaces.add(namespaceName);
-	}
-	return Array.from(namespaces);
-}
-
-//#endregion
-//#region src/cli/commands/workspace/transform.ts
-const workspaceInfo = (workspace, folderName) => {
-	const info = {
-		id: workspace.id,
-		name: workspace.name,
-		region: workspace.region,
-		createdAt: formatTimestamp(workspace.createTime),
-		updatedAt: formatTimestamp(workspace.updateTime)
-	};
-	return folderName ? {
-		...info,
-		folderName
-	} : info;
-};
-const workspaceDetails = (workspace, folderName) => {
-	return {
-		...workspaceInfo(workspace, folderName),
-		deleteProtection: workspace.deleteProtection,
-		organizationId: workspace.organizationId,
-		folderId: workspace.folderId
-	};
-};
-async function resolveWorkspaceFolderName(client, workspace) {
-	if (!workspace.organizationId || !workspace.folderId) return void 0;
-	try {
-		return (await client.getOrganizationFolder({
-			organizationId: workspace.organizationId,
-			folderId: workspace.folderId
-		})).folder?.name || void 0;
-	} catch (error) {
-		if (error instanceof ConnectError && (error.code === Code.NotFound || error.code === Code.PermissionDenied)) return;
-		logger.warn(`Failed to resolve workspace folder name: ${error}`);
-		return;
-	}
-}
-function createWorkspaceFolderNameResolver(client) {
-	const cache = /* @__PURE__ */ new Map();
-	return (workspace) => {
-		if (!workspace.organizationId || !workspace.folderId) return Promise.resolve(void 0);
-		const cacheKey = `${workspace.organizationId}/${workspace.folderId}`;
-		const cached = cache.get(cacheKey);
-		if (cached) return cached;
-		const promise = resolveWorkspaceFolderName(client, workspace);
-		cache.set(cacheKey, promise);
-		return promise;
-	};
-}
-async function workspaceInfoWithFolderName(client, workspace) {
-	const folderName = await resolveWorkspaceFolderName(client, workspace);
-	return workspaceInfo(workspace, folderName);
-}
-async function workspaceDetailsWithFolderName(client, workspace) {
-	const folderName = await resolveWorkspaceFolderName(client, workspace);
-	return workspaceDetails(workspace, folderName);
-}
-async function workspaceInfosWithFolderNames(client, workspaces) {
-	const resolveFolderName = createWorkspaceFolderNameResolver(client);
-	const limit = pLimit(5);
-	return Promise.all(workspaces.map((workspace) => limit(async () => workspaceInfo(workspace, await resolveFolderName(workspace)))));
-}
-function workspaceDisplayName(workspace) {
-	return workspace.folderName ? `${workspace.folderName}/${workspace.name}` : workspace.name;
-}
-function createWorkspaceNameTransformer(nameKey, folderNameKey) {
-	return (value, item) => {
-		const workspace = item;
-		const name = workspace[nameKey];
-		const folderName = workspace[folderNameKey];
-		if (typeof name === "string" && typeof folderName === "string") return workspaceDisplayName({
-			name,
-			folderName
-		});
-		return String(value ?? "");
-	};
+		if ("external" in nsConfig) continue;
+		namespaces.add(namespaceName);
+	}
+	return Array.from(namespaces);
 }
-const workspaceNameTransformer = createWorkspaceNameTransformer("name", "folderName");
 
 //#endregion
 //#region src/cli/commands/show.ts
@@ -16925,6 +17846,203 @@ const showCommand = defineAppCommand({
 	}
 });
 
+//#endregion
+//#region src/cli/shared/progress.ts
+/**
+* Create a simple progress reporter that writes updates to stderr.
+* @param label - Label to prefix progress output
+* @param total - Total number of steps
+* @returns Progress helpers
+*/
+function createProgress(label, total) {
+	let current = 0;
+	const update = () => {
+		current += 1;
+		const percent = Math.round(current / total * 100);
+		process.stderr.write(`\r${label} ${current}/${total} (${percent}%)`);
+	};
+	const finish = () => {
+		process.stderr.write("\n");
+	};
+	return {
+		update,
+		finish
+	};
+}
+/**
+* Wrap a promise with a timeout, rejecting if the timeout elapses first.
+* @template T
+* @param p - Promise to await
+* @param ms - Timeout in milliseconds
+* @param message - Error message on timeout
+* @returns Result of the original promise if it completes in time
+*/
+async function withTimeout(p, ms, message) {
+	return await Promise.race([p, setTimeout$2(ms).then(() => {
+		throw new Error(message);
+	})]);
+}
+
+//#endregion
+//#region src/cli/commands/staticwebsite/deploy.ts
+const CHUNK_SIZE = 64 * 1024;
+const IGNORED_FILES = /* @__PURE__ */ new Set([
+	".DS_Store",
+	"thumbs.db",
+	"desktop.ini"
+]);
+function shouldIgnoreFile(filePath) {
+	const fileName = path.basename(filePath).toLowerCase();
+	return IGNORED_FILES.has(fileName);
+}
+/**
+* Deploy a static website by creating a deployment, uploading files, and publishing it.
+* @param client - Operator client instance
+* @param workspaceId - Workspace ID
+* @param name - Static website name
+* @param distDir - Directory containing static site files
+* @param showProgress - Whether to show upload progress
+* @returns Deployment result with URL and skipped files
+*/
+async function deployStaticWebsite(client, workspaceId, name, distDir, showProgress = true) {
+	const { deploymentId } = await client.createDeployment({
+		workspaceId,
+		name
+	});
+	if (!deploymentId) throw new Error("createDeployment returned empty deploymentId");
+	const skippedFiles = await uploadDirectory(client, workspaceId, deploymentId, distDir, showProgress);
+	const { url } = await client.publishDeployment({
+		workspaceId,
+		deploymentId
+	});
+	if (!url) throw new Error("publishDeployment returned empty url");
+	return {
+		url,
+		skippedFiles
+	};
+}
+async function uploadDirectory(client, workspaceId, deploymentId, rootDir, showProgress) {
+	const files = await collectFiles(rootDir);
+	if (files.length === 0) {
+		logger.warn(`No files found under ${rootDir}`);
+		return [];
+	}
+	const limit = pLimit(5);
+	const total = files.length;
+	const progress = showProgress ? createProgress("Uploading files", total) : void 0;
+	const skippedFiles = [];
+	await Promise.all(files.map((relativePath) => limit(async () => {
+		await uploadSingleFile(client, workspaceId, deploymentId, rootDir, relativePath, skippedFiles);
+		if (progress) progress.update();
+	})));
+	if (progress) progress.finish();
+	return skippedFiles;
+}
+/**
+* Recursively collect all deployable files under the given directory.
+* @param rootDir - Root directory to scan
+* @param currentDir - Current relative directory (for recursion)
+* @returns List of file paths relative to rootDir
+*/
+async function collectFiles(rootDir, currentDir = "") {
+	const dirPath = path.join(rootDir, currentDir);
+	const entries = await fs$1.promises.readdir(dirPath, { withFileTypes: true });
+	const files = [];
+	for (const entry of entries) {
+		const rel = path.join(currentDir, entry.name);
+		if (entry.isDirectory()) {
+			const sub = await collectFiles(rootDir, rel);
+			files.push(...sub);
+		} else if (entry.isFile() && !entry.isSymbolicLink() && !shouldIgnoreFile(rel)) files.push(rel);
+	}
+	return files;
+}
+async function uploadSingleFile(client, workspaceId, deploymentId, rootDir, filePath, skippedFiles) {
+	const absPath = path.join(rootDir, filePath);
+	const mime = lookup(filePath);
+	if (!mime) {
+		skippedFiles.push(`${filePath} (unsupported content type; no MIME mapping found)`);
+		return;
+	}
+	const contentType = mime;
+	const readStream = fs$1.createReadStream(absPath, { highWaterMark: CHUNK_SIZE });
+	async function* requestStream() {
+		yield { payload: {
+			case: "initialMetadata",
+			value: {
+				workspaceId,
+				deploymentId,
+				filePath,
+				contentType
+			}
+		} };
+		for await (const chunk of readStream) yield { payload: {
+			case: "chunkData",
+			value: chunk
+		} };
+	}
+	async function uploadWithLogging() {
+		try {
+			await client.uploadFile(requestStream());
+		} catch (error) {
+			if (error instanceof ConnectError && error.code === Code.InvalidArgument) {
+				skippedFiles.push(`${filePath} (server rejected file as invalid: ${error.message})`);
+				return;
+			}
+			throw error;
+		}
+	}
+	await withTimeout(uploadWithLogging(), 2 * 6e4, `Upload timed out for "${filePath}"`);
+}
+/**
+* Log skipped files after a deployment, including reasons for skipping.
+* @param skippedFiles - List of skipped file descriptions
+*/
+function logSkippedFiles(skippedFiles) {
+	if (skippedFiles.length === 0) return;
+	logger.warn("Deployment completed, but some files failed to upload. These files may have unsupported content types or other validation issues. Please review the list below:");
+	for (const file of skippedFiles) logger.log(`  - ${file}`);
+}
+const deployCommand = defineAppCommand({
+	name: "deploy",
+	description: "Deploy a static website from a local build directory.",
+	args: z.strictObject({
+		...workspaceArgs,
+		name: arg(z.string(), {
+			alias: "n",
+			description: "Static website name"
+		}),
+		dir: arg(z.string(), {
+			alias: "d",
+			description: "Path to the static website files",
+			completion: { type: "directory" }
+		})
+	}),
+	run: async (args) => {
+		await assertWritable({ profile: args.profile });
+		logger.info(`Deploying static website "${args.name}" from directory: ${args.dir}`);
+		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const name = args.name;
+		const dir = path.resolve(process.cwd(), args.dir);
+		const workspaceId = await loadWorkspaceId({
+			workspaceId: args["workspace-id"],
+			profile: args.profile
+		});
+		if (!fs$1.existsSync(dir) || !fs$1.statSync(dir).isDirectory()) throw new Error(`Directory not found or not a directory: ${dir}`);
+		const { url, skippedFiles } = await withTimeout(deployStaticWebsite(client, workspaceId, name, dir, !args.json), 10 * 6e4, "Deployment timed out after 10 minutes.");
+		if (args.json) logger.out({
+			name,
+			workspaceId,
+			url,
+			skippedFiles
+		});
+		else {
+			logger.success(`Static website "${name}" deployed successfully. URL: ${url}`);
+			logSkippedFiles(skippedFiles);
+		}
+	}
+});
+
 //#endregion
 //#region src/cli/shared/editor.ts
 const DEFAULT_EDITOR = "editor";
@@ -17481,7 +18599,7 @@ function generateChangeScript(change) {
 * @returns {Promise<void>}
 */
 async function handleInitOption(namespaces, skipConfirmation) {
-	const existingDirs = namespaces.filter(({ migrationsDir }) => fs$1.existsSync(migrationsDir));
+	const existingDirs = namespaces.filter(({ migrationsDir }) => fs$2.existsSync(migrationsDir));
 	if (existingDirs.length === 0) {
 		logger.info("No existing migration directories found.");
 		return;
@@ -17531,7 +18649,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-CUkjzfij.mjs");
+	const { defineApplication } = await import("./application-OM0taSPn.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -17891,7 +19009,7 @@ async function listWorkflows(options) {
 		return [workflows, nextPageToken];
 	}, { limit: options?.limit })).map(toWorkflowListInfo);
 }
-const listCommand$3 = defineAppCommand({
+const listCommand$2 = defineAppCommand({
 	name: "list",
 	description: "List all workflows in the workspace.",
 	args: z.strictObject({
@@ -18224,7 +19342,7 @@ async function listApps(options) {
 		return [applications, nextPageToken];
 	}, { limit })).map(appInfo);
 }
-const listCommand$2 = defineAppCommand({
+const listCommand$1 = defineAppCommand({
 	name: "list",
 	description: "List applications in a workspace",
 	args: z.strictObject({
@@ -18247,153 +19365,6 @@ const listCommand$2 = defineAppCommand({
 	}
 });
 
-//#endregion
-//#region src/cli/commands/workspace/create.ts
-/**
-* Schema for workspace creation options
-* - name: 3-63 chars, lowercase alphanumeric and hyphens, cannot start/end with hyphen
-* - organizationId, folderId: optional UUIDs
-*/
-const createWorkspaceOptionsSchema = z.object({
-	name: z.string().min(3, "Name must be at least 3 characters").max(63, "Name must be at most 63 characters").regex(/^[a-z0-9-]+$/, "Name can only contain lowercase letters, numbers, and hyphens").refine((n) => !n.startsWith("-") && !n.endsWith("-"), "Name cannot start or end with a hyphen"),
-	region: z.string(),
-	deleteProtection: z.boolean().optional(),
-	organizationId: z.uuid().optional(),
-	folderId: z.uuid().optional()
-});
-const validateRegion = async (region, client) => {
-	const availableRegions = await client.listAvailableWorkspaceRegions({});
-	if (!availableRegions.regions.includes(region)) throw new Error(`Region must be one of: ${availableRegions.regions.join(", ")}.`);
-};
-function profilePlatformSettings(platformConfig) {
-	const hasOAuth2ClientId = platformConfig?.oauth2ClientId || process.env.TAILOR_PLATFORM_OAUTH2_CLIENT_ID;
-	const hasConsoleUrl = platformConfig?.consoleUrl || process.env.TAILOR_PLATFORM_CONSOLE_URL;
-	return {
-		...isDefaultPlatform(platformConfig) ? {} : { platform_url: getPlatformBaseUrl(platformConfig) },
-		...hasOAuth2ClientId ? { oauth2_client_id: getOAuth2ClientId(platformConfig) } : {},
-		...hasConsoleUrl ? { console_url: getConsoleBaseUrl(platformConfig) } : {}
-	};
-}
-/**
-* Create a new workspace with the given options.
-* @param options - Workspace creation options
-* @returns Created workspace info
-*/
-async function createWorkspace(options) {
-	const result = createWorkspaceOptionsSchema.safeParse(options);
-	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
-	const validated = result.data;
-	const client = await initOperatorClient(await loadAccessToken());
-	await validateRegion(validated.region, client);
-	return workspaceInfoWithFolderName(client, assertDefined((await client.createWorkspace({
-		workspaceName: validated.name,
-		workspaceRegion: validated.region,
-		deleteProtection: validated.deleteProtection ?? false,
-		organizationId: validated.organizationId,
-		folderId: validated.folderId
-	})).workspace, "createWorkspace response missing workspace"));
-}
-const createCommand = defineAppCommand({
-	name: "create",
-	description: "Create a new Tailor Platform workspace.",
-	args: z.strictObject({
-		name: arg(z.string(), {
-			alias: "n",
-			description: "Workspace name"
-		}),
-		region: arg(z.string(), {
-			alias: "r",
-			description: "Workspace region (us-west, asia-northeast)"
-		}),
-		"delete-protection": arg(z.boolean().default(false), {
-			alias: "d",
-			description: "Enable delete protection"
-		}),
-		"organization-id": arg(z.string().optional(), {
-			alias: "o",
-			description: "Organization ID to workspace associate with",
-			env: "TAILOR_PLATFORM_ORGANIZATION_ID"
-		}),
-		"folder-id": arg(z.string().optional(), {
-			alias: "f",
-			description: "Folder ID to workspace associate with",
-			env: "TAILOR_PLATFORM_FOLDER_ID"
-		}),
-		"profile-name": arg(z.string().optional(), {
-			alias: "p",
-			description: "Profile name to create"
-		}),
-		"profile-user": arg(z.string().optional(), { description: "User email address or machine user client ID for the profile (defaults to current user)" }),
-		permission: arg(z.enum(["write", "read"]).default("write"), { description: "Profile permission (requires --profile-name). 'read' blocks all write commands while the profile is active." })
-	}),
-	run: async (args) => {
-		await assertWritable();
-		const profileName = args["profile-name"];
-		let profileSetup;
-		if (profileName) {
-			const config = await readPlatformConfig();
-			if (config.profiles[profileName]) throw new Error(`Profile "${profileName}" already exists.`);
-			const activeProfileName = process.env.TAILOR_PLATFORM_PROFILE;
-			const activeProfileEntry = activeProfileName ? config.profiles[activeProfileName] : void 0;
-			const platformConfig = activeProfileEntry ? platformConfigFromProfile(activeProfileEntry) : void 0;
-			const profileUser = args["profile-user"] || activeProfileEntry?.user || config.current_user;
-			if (!profileUser) throw new Error("Current user not found. Please login or specify --profile-user to create a profile.");
-			const resolvedProfileUser = resolveConfigUser(config, profileUser, platformConfig);
-			if (!resolvedProfileUser) throw new Error(`User "${profileUser}" not found.\nPlease verify your user name and login using 'tailor login' command.`);
-			profileSetup = {
-				name: profileName,
-				user: resolvedProfileUser,
-				platformSettings: profilePlatformSettings(platformConfig)
-			};
-		}
-		const workspace = await createWorkspace({
-			name: args.name,
-			region: args.region,
-			deleteProtection: args["delete-protection"],
-			organizationId: args["organization-id"],
-			folderId: args["folder-id"]
-		});
-		let profileInfo;
-		if (profileSetup) {
-			const config = await readPlatformConfig();
-			const platformSettings = profileSetup.platformSettings;
-			config.profiles[profileSetup.name] = {
-				user: profileSetup.user,
-				workspace_id: workspace.id,
-				...args.permission === "read" ? { readonly: true } : {},
-				...platformSettings
-			};
-			writePlatformConfig(config);
-			profileInfo = {
-				name: profileSetup.name,
-				user: profileSetup.user,
-				workspaceId: workspace.id,
-				permission: args.permission,
-				...platformSettings.platform_url ? { platformUrl: platformSettings.platform_url } : {},
-				...platformSettings.oauth2_client_id ? { oauth2ClientId: platformSettings.oauth2_client_id } : {},
-				...platformSettings.console_url ? { consoleUrl: platformSettings.console_url } : {}
-			};
-			if (!args.json) logger.success(`Profile "${profileSetup.name}" created successfully.`);
-		}
-		if (!args.json) logger.success(`Workspace "${workspaceDisplayName(workspace)}" created successfully.`);
-		if (args.json && profileInfo) {
-			logger.out({
-				...workspace,
-				profile: profileInfo
-			});
-			return;
-		}
-		logger.out(workspace, { display: {
-			name: workspaceNameTransformer,
-			folderName: null
-		} });
-		if (profileInfo) {
-			logger.out("Profile:");
-			logger.out(profileInfo);
-		}
-	}
-});
-
 //#endregion
 //#region src/cli/commands/workspace/delete.ts
 const deleteWorkspaceOptionsSchema = z.object({ workspaceId: z.uuid({ message: "workspace-id must be a valid UUID" }) });
@@ -18507,42 +19478,6 @@ const getCommand = defineAppCommand({
 	}
 });
 
-//#endregion
-//#region src/cli/commands/workspace/list.ts
-/**
-* List workspaces with an optional order and limit.
-* @param options - Workspace listing options
-* @returns List of workspaces
-*/
-async function listWorkspaces(options) {
-	const client = await initOperatorClient(await loadAccessToken());
-	const pageDirection = toPageDirection(options?.order);
-	return workspaceInfosWithFolderNames(client, await fetchPaged(async (pageToken, pageSize) => {
-		const { workspaces, nextPageToken } = await client.listWorkspaces({
-			pageToken,
-			pageSize,
-			pageDirection
-		});
-		return [workspaces, nextPageToken];
-	}, { limit: options?.limit }));
-}
-const listCommand$1 = defineAppCommand({
-	name: "list",
-	description: "List all Tailor Platform workspaces.",
-	args: z.strictObject({ ...paginationArgs() }),
-	run: async (args) => {
-		const workspaces = await listWorkspaces({
-			order: args.order,
-			limit: args.limit
-		});
-		logger.out(workspaces, { display: {
-			name: workspaceNameTransformer,
-			folderName: null,
-			updatedAt: null
-		} });
-	}
-});
-
 //#endregion
 //#region src/cli/commands/workspace/restore.ts
 const restoreWorkspaceOptionsSchema = z.object({ workspaceId: z.uuid({ message: "workspace-id must be a valid UUID" }) });
@@ -18922,10 +19857,10 @@ function createGqlEntry() {
 */
 async function bundleQueryScript(engine) {
 	const outputDir = path.resolve(getDistDir(), "query");
-	fs$1.mkdirSync(outputDir, { recursive: true });
+	fs$2.mkdirSync(outputDir, { recursive: true });
 	const entryPath = path.join(outputDir, `query_${engine}.entry.ts`);
 	const entryContent = engine === "sql" ? createSqlEntry() : createGqlEntry();
-	fs$1.writeFileSync(entryPath, entryContent);
+	fs$2.writeFileSync(entryPath, entryContent);
 	let tsconfig;
 	try {
 		tsconfig = await resolveTSConfig();
@@ -19193,7 +20128,7 @@ async function loadTypeFieldOrder(config, namespace) {
 	const fieldOrder = /* @__PURE__ */ new Map();
 	const dbConfig = config.db?.[namespace];
 	if (!dbConfig || !("files" in dbConfig) || dbConfig.files.length === 0) return fieldOrder;
-	const typeFiles = loadFilesWithIgnores(dbConfig);
+	const typeFiles = loadFilesWithIgnores(dbConfig, path.dirname(config.path));
 	await Promise.all(typeFiles.map(async (typeFile) => {
 		try {
 			const module = await import(pathToFileURL(typeFile).href);
@@ -19809,5 +20744,5 @@ async function registerTsHook(tsHookUrl) {
 }
 
 //#endregion
-export { getOrganization as $, compareSnapshotWithRemote as $t, listCommand$3 as A, apiCommand as An, getExecutorWaitFailureMessage as At, show as B, listWorkflowExecutions as Bt, listCommand$2 as C, hasChanges as Cn, listWebhookExecutors as Ct, waitWorkflowExecution as D, PluginManager as Dn, listCommand$9 as Dt, waitCommand as E, sdkNameLabelKey as En, triggerExecutor as Et, generateCommand as F, startWorkflow as Ft, removeCommand$1 as G, deploy as Gt, extractOwnedNamespaces as H, formatKeyValueTable as Ht, generateMigrationScript as I, getCommand$5 as It, organizationTree as J, waitForExecution as Jt, updateCommand$1 as K, ensureConfigId as Kt, writeDbTypesFile as L, getWorkflow as Lt, truncate as M, assertWritable as Mn, listExecutorJobs as Mt, truncateCommand as N, defineAppCommand as Nn, watchExecutorJob as Nt, resumeCommand as O, generateUserTypes as On, listExecutors as Ot, generate as P, startCommand as Pt, getCommand$1 as Q, parseMigrationLabelNumber as Qt, getConfiguredEditorCommand as R, executionsCommand as Rt, listApps as S, formatMigrationDiff as Sn, getFunctionRegistry as St, healthCommand as T, resourceTrn as Tn, triggerCommand as Tt, logBetaWarning as U, getCommand$6 as Ut, showCommand as V, functionExecutionStatusToString as Vt, remove as W, getExecutor as Wt, listCommand$4 as X, MIGRATION_LABEL_KEY as Xt, treeCommand as Y, bundleMigrationScript as Yt, listOrganizations as Z, handleOptionalToRequiredError as Zt, getWorkspace as _, loadDiff as _n, listMachineUsers as _t, updateUser as a, MIGRATE_FILE_NAME as an, getFolder as at, createCommand as b, parseMigrationNumberArg as bn, listFunctionRegistries as bt, listCommand as c, compareLocalTypesWithSnapshot as cn, createCommand$1 as ct, inviteUser as d, getLatestMigrationNumber as dn, listOAuth2Clients as dt, generateAllTypeManifestsFromSnapshot as en, updateCommand$2 as et, restoreCommand as f, getMigrationDirPath as fn, getCommand$3 as ft, getCommand as g, isValidMigrationNumber as gn, listCommand$7 as gt, listWorkspaces as h, getNextMigrationNumber as hn, tokenCommand as ht, updateCommand as i, INITIAL_SCHEMA_NUMBER as in, getCommand$2 as it, listWorkflows as j, apiCall as jn, jobsCommand as jt, resumeWorkflow as k, prompt as kn, getExecutorJob as kt, listUsers as l, compareSnapshots as ln, createFolder as lt, listCommand$1 as m, getMigrationFiles as mn, getMachineUserToken as mt, query as n, DB_TYPES_FILE_NAME as nn, listCommand$5 as nt, removeCommand as o, SCHEMA_FILE_NAME as on, deleteCommand$1 as ot, restoreWorkspace as p, getMigrationFilePath as pn, getOAuth2Client as pt, updateOrganization as q, executeScript as qt, queryCommand as r, DIFF_FILE_NAME as rn, listFolders as rt, removeUser as s, assertValidMigrationFiles as sn, deleteFolder as st, registerTsHook as t, protoGqlPermission as tn, updateFolder as tt, inviteCommand as u, createSnapshotFromLocalTypes as un, listCommand$6 as ut, deleteCommand as v, reconstructSnapshotFromMigrations as vn, generate$1 as vt, getAppHealth as w, getNamespacesWithMigrations as wn, webhookCommand as wt, createWorkspace as x, formatDiffSummary as xn, getCommand$4 as xt, deleteWorkspace as y, formatMigrationNumber as yn, listCommand$8 as yt, openInConfiguredEditor as z, getWorkflowExecution as zt };
-//# sourceMappingURL=register-ts-hook-BhzVkej0.mjs.map
+export { updateFolder as $, saveUserTokens as $n, bundleMigrationScript as $t, generate as A, sdkNameLabelKey as An, listExecutorJobs as At, extractOwnedNamespaces as B, hasUserTokenEntry as Bn, getCommand$6 as Bt, waitWorkflowExecution as C, formatMigrationNumber as Cn, triggerCommand as Ct, listWorkflows as D, hasChanges as Dn, getExecutorJob as Dt, listCommand$2 as E, formatMigrationDiff as En, listExecutors as Et, openInConfiguredEditor as F, assertWritable as Fn, getWorkflow as Ft, updateOrganization as G, loadPlatformClientConfig as Gn, listWorkspaces as Gt, remove as H, loadConfigPath as Hn, deploy as Ht, deployCommand as I, loadConfig as In, executionsCommand as It, listCommand$3 as J, platformConfigFromProfile as Jn, formatKeyValueTable as Jt, organizationTree as K, loadStoredUserTokens as Kn, createCommand$1 as Kt, deployStaticWebsite as L, deleteUserTokens as Ln, getWorkflowExecution as Lt, generateMigrationScript as M, generateUserTypes as Mn, startCommand as Mt, writeDbTypesFile as N, prompt as Nn, startWorkflow as Nt, truncate as O, getNamespacesWithMigrations as On, getExecutorWaitFailureMessage as Ot, getConfiguredEditorCommand as P, apiCall as Pn, getCommand$5 as Pt, updateCommand$2 as Q, resolveUserTokenKey as Qn, waitForExecution as Qt, show as R, fetchLatestToken as Rn, listWorkflowExecutions as Rt, waitCommand as S, reconstructSnapshotFromMigrations as Sn, webhookCommand as St, resumeWorkflow as T, formatDiffSummary as Tn, listCommand$8 as Tt, removeCommand$1 as U, loadConsoleBaseUrl as Un, deployFromCLI as Ut, logBetaWarning as V, loadAccessToken as Vn, getExecutor as Vt, updateCommand$1 as W, loadMachineUserName as Wn, listCommand$9 as Wt, getCommand$1 as X, removeLegacyUserAlias as Xn, ensureConfigId as Xt, listOrganizations as Y, readPlatformConfig as Yn, workspaceNameSchema as Yt, getOrganization as Z, resolveConfigUser as Zn, executeScript as Zt, deleteWorkspace as _, getMigrationFilePath as _n, listCommand$7 as _t, updateUser as a, protoGqlPermission as an, deploymentArgs as ar, deleteFolder as at, getAppHealth as b, isValidMigrationNumber as bn, getFunctionRegistry as bt, listCommand as c, INITIAL_SCHEMA_NUMBER as cn, pagedLogArgs as cr, listCommand$5 as ct, inviteUser as d, assertValidMigrationFiles as dn, toPageDirection as dr, getOAuth2Client as dt, MIGRATION_LABEL_KEY as en, writePlatformConfig as er, listCommand$4 as et, restoreCommand as f, compareLocalTypesWithSnapshot as fn, workspaceArgs as fr, getMachineUserToken as ft, deleteCommand as g, getMigrationDirPath as gn, generate$1 as gt, getWorkspace as h, getLatestMigrationNumber as hn, listMachineUsers as ht, updateCommand as i, generateAllTypeManifestsFromSnapshot as in, confirmationArgs as ir, deleteCommand$1 as it, generateCommand as j, PluginManager as jn, watchExecutorJob as jt, truncateCommand as k, resourceTrn as kn, jobsCommand as kt, listUsers as l, MIGRATE_FILE_NAME as ln, paginationArgs as lr, listOAuth2Clients as lt, getCommand as m, createSnapshotFromLocalTypes as mn, listCommand$6 as mt, query as n, parseMigrationLabelNumber as nn, commonArgs as nr, getCommand$2 as nt, removeCommand as o, DB_TYPES_FILE_NAME as on, isVerbose as or, createCommand as ot, restoreWorkspace as p, compareSnapshots as pn, tokenCommand as pt, treeCommand as q, loadWorkspaceId as qn, createWorkspace$1 as qt, queryCommand as r, compareSnapshotWithRemote as rn, configArg as rr, getFolder as rt, removeUser as s, DIFF_FILE_NAME as sn, multiConfigArg as sr, createFolder as st, registerTsHook as t, handleOptionalToRequiredError as tn, defineAppCommand as tr, listFolders as tt, inviteCommand as u, SCHEMA_FILE_NAME as un, resolveMachineUserInputSource as ur, getCommand$3 as ut, listApps as v, getMigrationFiles as vn, listFunctionRegistries as vt, resumeCommand as w, parseMigrationNumberArg as wn, triggerExecutor as wt, healthCommand as x, loadDiff as xn, listWebhookExecutors as xt, listCommand$1 as y, getNextMigrationNumber as yn, getCommand$4 as yt, showCommand as z, hasAnyUserTokenEntry as zn, functionExecutionStatusToString as zt };
+//# sourceMappingURL=register-ts-hook-DvEs6YsL.mjs.map