@tailor-platform/sdk 2.0.0-next.5 → 2.0.0-next.7

package/dist/{application-Bf8wxOi6.mjs → application-GzW98_Xr.mjs}

@@ -1,291 +1,31 @@
 import { n as isSdkBranded } from "./brand-Eo4pLXPJ.mjs";
-import { i as PageDirection } from "./resource_pb-BRv7AMXK.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
-import { a as parseBoolean, n as logger, r as styles } from "./logger-BEiZZ3qT.mjs";
-import { a as AuthConfigSchema, c as stripTailorDBTypeBuilderHelpers, d as applyRelationMetadataToFieldConfig, f as buildRelationInfo, g as functionSchema, h as loadFilesWithIgnores, l as TailorDBServiceConfigSchema, m as validateRelationConfig, n as loadExecutor, o as AuthInvokerSchema, p as processRelationMetadata, s as TailorFieldSchema, t as createExecutorService, u as TailorDBTypeSchema } from "./service-CzZEVrp9.mjs";
+import { a as parseBoolean, n as logger, r as styles } from "./logger-BwS4ppwO.mjs";
+import { a as AuthConfigSchema, c as stripTailorDBTypeBuilderHelpers, d as applyRelationMetadataToFieldConfig, f as buildRelationInfo, g as functionSchema, h as loadFilesWithIgnores, l as TailorDBServiceConfigSchema, m as validateRelationConfig, n as loadExecutor, o as AuthInvokerSchema, p as processRelationMetadata, s as TailorFieldSchema, t as createExecutorService, u as TailorDBTypeSchema } from "./service-Dmxa2I4i.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
-import { t as readPackageJson } from "./package-json-8b0O9TlX.mjs";
-import { i as userAgent, n as tightenSecretFilePermissions, r as writeSecretFile } from "./secret-file-aoNXJmKa.mjs";
-import { t as createCLIError } from "./errors-118wUDRr.mjs";
+import { t as userAgent } from "./user-agent-Bgsszb5I.mjs";
 import { t as isPluginGeneratedType } from "./type-source-DH_LH20p.mjs";
 import { builtinModules, createRequire } from "node:module";
 import * as path from "pathe";
-import { join, resolve } from "pathe";
+import { resolve } from "pathe";
 import { resolveTSConfig } from "pkg-types";
-import { arg } from "politty";
 import { z } from "zod";
 import { create } from "@bufbuild/protobuf";
-import * as fs$1 from "node:fs";
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { parseEnv } from "node:util";
+import * as fs from "node:fs";
+import { readFileSync } from "node:fs";
 import { MethodOptions_IdempotencyLevel } from "@bufbuild/protobuf/wkt";
 import { pathToFileURL } from "node:url";
-import { parseYAML, stringifyYAML } from "confbox";
-import { findUpSync } from "find-up-simple";
-import { lt } from "semver";
-import { xdgConfig } from "xdg-basedir";
 import { OAuth2Client } from "@badgateway/oauth2-client";
 import { Code, ConnectError, createClient } from "@connectrpc/connect";
 import { getGlobalDispatcher } from "undici";
 import pLimit from "p-limit";
 import * as crypto from "node:crypto";
 import * as rolldown from "rolldown";
-import * as fs from "node:fs/promises";
 import { parseSync } from "oxc-parser";
 import * as inflection from "inflection";
 import * as globals from "globals";
 import * as os from "node:os";
 
-//#region src/cli/shared/args.ts
-const unitToMs = {
-	ms: 1,
-	s: 1e3,
-	m: 60 * 1e3
-};
-const durationPattern = /^(\d+)(ms|s|m)$/;
-/**
-* Schema for duration string validation (e.g., "3s", "500ms", "1m")
-* Only validates format; use parseDuration() to convert to milliseconds
-*/
-const durationArg = z.string().refine((val) => durationPattern.test(val), { message: "Invalid duration format. Expected format: '3s', '500ms', '1m'" }).refine((val) => {
-	const match = val.match(durationPattern);
-	if (!match) return false;
-	const digits = match[1];
-	return digits !== void 0 && parseInt(digits, 10) > 0;
-}, { message: "Duration must be greater than 0" });
-/**
-* Parse a validated duration string into milliseconds
-* @param duration - Duration string (e.g., "3s", "500ms", "1m")
-* @returns Duration in milliseconds
-*/
-function parseDuration(duration) {
-	const match = assertDefined(duration.match(durationPattern), `invalid duration format: ${duration}`);
-	const value = parseInt(assertDefined(match[1], "duration digits group missing"), 10);
-	const unit = assertDefined(match[2], "duration unit group missing");
-	return value * unitToMs[unit];
-}
-/**
-* Schema for positive integer validation (from string input)
-* Transforms the string to a number
-*/
-const positiveIntArg = z.coerce.number().int().positive();
-/**
-* Schema for non-negative integer validation (from string input).
-* Accepts 0 (used for `--limit 0` to disable the limit).
-*/
-const nonNegativeIntArg = z.coerce.number().int().nonnegative();
-/**
-* Schema for sort order (`asc` or `desc`).
-*/
-const orderArg = z.enum(["asc", "desc"]);
-/**
-* Translate a CLI `--order` value into the proto `PageDirection` enum.
-* Returns `undefined` when the user did not specify an order so that
-* callers can omit the field and fall back to the server default.
-* @param order - Order string from CLI args (`"asc"` | `"desc"` | undefined)
-* @returns PageDirection, or undefined when `order` is undefined
-*/
-function toPageDirection(order) {
-	if (order === void 0) return void 0;
-	return order === "asc" ? PageDirection.ASC : PageDirection.DESC;
-}
-function hasMachineUserFlag(argv) {
-	return argv.slice(0, argv.indexOf("--") === -1 ? argv.length : argv.indexOf("--")).some((token) => token === "-m" || token.startsWith("-m=") || token === "--machine-user" || token.startsWith("--machine-user=") || token === "--machineUser" || token.startsWith("--machineUser=") || token === "--machineuser" || token.startsWith("--machineuser="));
-}
-/**
-* Resolve whether a parsed machine user value came from an explicit CLI option or env fallback.
-* @param machineUser - Parsed machine user value
-* @param argv - Raw CLI argv, excluding the executable and script path
-* @param options - Source resolution options
-* @returns Machine user input source, or undefined when no value was parsed
-*/
-function resolveMachineUserInputSource(machineUser, argv = process.argv.slice(2), options = {}) {
-	if (machineUser === void 0) return void 0;
-	if (options.valueIsExplicit) return "option";
-	if (hasMachineUserFlag(argv)) return "option";
-	return process.env.TAILOR_PLATFORM_MACHINE_USER_NAME === machineUser ? "env" : "option";
-}
-/**
-* Load env files from parsed arguments.
-* Processes --env-file first, then --env-file-if-exists.
-*
-* Follows Node.js --env-file behavior:
-* - Variables already set in the environment are NOT overwritten
-* - Variables from later files override those from earlier files
-* @param envFiles - Required env file path(s) that must exist
-* @param envFilesIfExists - Optional env file path(s) that are loaded if they exist
-*/
-function loadEnvFiles(envFiles, envFilesIfExists) {
-	const originalEnvKeys = new Set(Object.keys(process.env));
-	const load = (files, required) => {
-		for (const file of [files ?? []].flat()) {
-			const envPath = path.resolve(process.cwd(), file);
-			if (!fs$1.existsSync(envPath)) {
-				if (required) throw new Error(`Environment file not found: ${envPath}`);
-				continue;
-			}
-			const parsed = parseEnv(fs$1.readFileSync(envPath, "utf-8"));
-			for (const [key, value] of Object.entries(parsed)) {
-				if (originalEnvKeys.has(key)) continue;
-				process.env[key] = value;
-			}
-		}
-	};
-	load(envFiles, true);
-	load(envFilesIfExists, false);
-}
-/**
-* Common arguments for all CLI commands
-*
-* NOTE: --env-file and --env-file-if-exists collide with Node.js flags due to a bug
-* (https://github.com/nodejs/node/issues/54232). Node.js parses these even after the
-* script path, causing warnings (twice due to tsx loader).
-*/
-const commonArgs = {
-	"env-file": arg(z.string().optional(), {
-		alias: "e",
-		description: "Path to the environment file (error if not found)",
-		completion: {
-			type: "file",
-			matcher: [".env.*", ".env"]
-		}
-	}),
-	"env-file-if-exists": arg(z.string().optional(), {
-		description: "Path to the environment file (ignored if not found)",
-		completion: {
-			type: "file",
-			matcher: [".env.*", ".env"]
-		},
-		effect: (_value, { args }) => {
-			loadEnvFiles(args["env-file"], args["env-file-if-exists"]);
-		}
-	}),
-	verbose: arg(z.boolean().default(false), {
-		description: "Enable verbose logging",
-		effect: (value) => {
-			verboseMode = value;
-		}
-	}),
-	json: arg(z.boolean().default(false), {
-		alias: "j",
-		description: "Output as JSON",
-		effect: (value) => {
-			logger.jsonMode = value;
-		}
-	})
-};
-/**
-* Arguments for commands that require workspace context
-*/
-const workspaceArgs = {
-	"workspace-id": arg(z.string().optional(), {
-		alias: "w",
-		description: "Workspace ID",
-		env: "TAILOR_PLATFORM_WORKSPACE_ID",
-		completion: { type: "none" }
-	}),
-	profile: arg(z.string().optional(), {
-		alias: "p",
-		description: "Workspace profile",
-		env: "TAILOR_PLATFORM_PROFILE",
-		completion: { type: "none" }
-	})
-};
-/**
-* Shared config arg for commands that accept a config file path
-*/
-const configArg = { config: arg(z.string().default("tailor.config.ts"), {
-	alias: "c",
-	description: "Path to Tailor config file",
-	env: "TAILOR_CONFIG_PATH",
-	completion: {
-		type: "file",
-		extensions: ["ts"]
-	}
-}) };
-/**
-* Shared config arg for commands that accept one or more comma-separated config file paths
-*/
-const multiConfigArg = { config: arg(z.string().default("tailor.config.ts"), {
-	alias: "c",
-	description: "Path to SDK config file. Use comma-separated paths to deploy multiple apps together.",
-	env: "TAILOR_PLATFORM_SDK_CONFIG_PATH",
-	completion: {
-		type: "file",
-		extensions: ["ts"]
-	}
-}) };
-/**
-* Arguments for commands that interact with deployed resources (includes config)
-*/
-const deploymentArgs = {
-	...workspaceArgs,
-	...configArg
-};
-/**
-* Arguments for commands that require confirmation
-*/
-const confirmationArgs = { yes: arg(z.boolean().default(false), {
-	alias: "y",
-	description: "Skip confirmation prompts"
-}) };
-/**
-* Arguments for commands that require organization context
-*/
-const organizationArgs = { "organization-id": arg(z.string(), {
-	alias: "o",
-	description: "Organization ID",
-	env: "TAILOR_PLATFORM_ORGANIZATION_ID",
-	completion: { type: "none" }
-}) };
-/**
-* Arguments for list commands that accept `--order` / `--limit`. Sort
-* order defaults to `desc` (newest first) because most callers want the
-* latest items; pass `--order asc` to opt in to ascending order. The
-* limit is unbounded by default so existing invocations keep returning
-* every item; pass `--limit N` to cap the result size.
-* @param defaultOrder - Default value for `--order` (defaults to `"desc"`)
-* @returns Argument shape suitable for spreading into a command schema
-*/
-const paginationArgs = (defaultOrder = "desc") => ({
-	order: arg(orderArg.default(defaultOrder), { description: "Sort order (asc or desc)" }),
-	limit: arg(nonNegativeIntArg.optional(), {
-		alias: "l",
-		description: "Maximum number of items to return (0 or omit: unlimited)"
-	})
-});
-/**
-* Arguments for time-series log list commands. Defaults to newest-first
-* (`desc`) and a 50-item cap so that listing stays responsive on busy
-* workspaces. Pass `--limit 0` to disable the cap and fetch all entries.
-*/
-const pagedLogArgs = {
-	order: arg(orderArg.default("desc"), { description: "Sort order (asc or desc)" }),
-	limit: arg(nonNegativeIntArg.default(50), {
-		alias: "l",
-		description: "Maximum number of items to return (0: unlimited)"
-	})
-};
-/**
-* Arguments for commands that require folder context
-*/
-const folderArgs = { "folder-id": arg(z.string(), {
-	alias: "f",
-	description: "Folder ID",
-	env: "TAILOR_PLATFORM_FOLDER_ID",
-	completion: { type: "none" }
-}) };
-let verboseMode = false;
-/**
-* Returns whether verbose mode is enabled.
-* Used by the global cleanup handler which doesn't have access to parsed args.
-* @returns Whether verbose mode is enabled
-*/
-function isVerbose() {
-	return verboseMode;
-}
-
-//#endregion
 //#region src/parser/app-config/log-level.ts
 const LOG_LEVELS = [
 	"DEBUG",
@@ -298,64 +38,6 @@ function isLogLevel(value) {
 	return LOG_LEVELS.includes(value);
 }
 
-//#endregion
-//#region src/parser/app-config/schema.ts
-const envValueSchema = z.union([
-	z.string(),
-	z.number(),
-	z.boolean()
-]);
-const LogLevelSchema = z.enum(LOG_LEVELS);
-const logLevelSchema = z.string().refine((value) => LogLevelSchema.safeParse(value.trim().toUpperCase()).success, { message: `'logLevel' must be one of: ${LOG_LEVELS.join(", ")}.` });
-/**
-* Structural validation schema for `defineConfig({...})`. Validates only
-* top-level fields with platform-side constraints (notably `id`); fields
-* that carry SDK builder objects (`auth`, `idp`, `db`, ...) are accepted
-* as opaque values, since their internal shapes are validated by their
-* own factory functions and parser-level schemas.
-*
-* The `id` is auto-managed by `deploy` and stored as a plain UUID. A
-* label-compatible prefix is added at the metadata boundary, so user-facing
-* configs only need to carry a UUID.
-*/
-const AppConfigSchema = z.strictObject({
-	id: z.uuid({ message: "'id' must be a UUID." }).optional(),
-	name: z.string().min(1, { message: "'name' must be a non-empty string." }),
-	env: z.record(z.string(), envValueSchema).optional(),
-	cors: z.array(z.string()).optional(),
-	allowedIpAddresses: z.array(z.string()).optional(),
-	disableIntrospection: z.boolean().optional(),
-	inlineSourcemap: z.boolean().optional(),
-	logLevel: logLevelSchema.optional(),
-	db: z.unknown().optional(),
-	resolver: z.unknown().optional(),
-	idp: z.unknown().optional(),
-	auth: z.unknown().optional(),
-	executor: z.unknown().optional(),
-	workflow: z.unknown().optional(),
-	httpAdapter: z.unknown().optional(),
-	staticWebsites: z.unknown().optional(),
-	aiGateways: z.unknown().optional(),
-	secrets: z.unknown().optional()
-});
-
-//#endregion
-//#region src/parser/plugin-config/schema.ts
-const PluginConfigSchema = z.looseObject({
-	id: z.string(),
-	description: z.string(),
-	importPath: z.string().optional(),
-	pluginConfig: z.unknown().optional(),
-	typeConfigRequired: z.union([z.boolean(), functionSchema]).optional(),
-	onTypeLoaded: functionSchema.optional(),
-	onNamespaceLoaded: functionSchema.optional(),
-	onTailorDBReady: functionSchema.optional(),
-	onResolverReady: functionSchema.optional(),
-	onExecutorReady: functionSchema.optional()
-}).refine((p) => {
-	return !(p.onTypeLoaded || p.onNamespaceLoaded) || !!p.importPath;
-}, { message: "importPath is required when plugin has definition-time hooks (onTypeLoaded/onNamespaceLoaded)" }).transform((plugin) => plugin);
-
 //#endregion
 //#region src/cli/shared/apply-concurrency.ts
 /**
@@ -498,7 +180,7 @@ function initOAuth2Client(config) {
 */
 async function initOperatorClient(accessToken, config) {
 	const platformConfig = config ?? getPlatformConfigForToken(accessToken);
-	const [{ createTracingInterceptor }, { OperatorService }] = await Promise.all([import("./interceptor-e33JtsC-.mjs"), import("./service_pb-DZkfjB_6.mjs")]);
+	const [{ createTracingInterceptor }, { OperatorService }] = await Promise.all([import("./interceptor-e33JtsC-.mjs"), import("./service_pb-r1T7kpJc.mjs")]);
 	const interceptors = [
 		await userAgentInterceptor(),
 		await bearerTokenInterceptor(accessToken),
@@ -551,9 +233,9 @@ async function bearerTokenInterceptor(accessToken) {
 /**
 * Create an interceptor that retries failed unary requests with backoff.
 *
-* Retries any unary method on `Unavailable`/`ResourceExhausted`, and `Internal`
-* only for methods declared idempotent, up to 3 attempts (despite the historical
-* "idempotent" naming, the first two codes are retried regardless of idempotency).
+* Retries unary methods on `Unavailable`/`ResourceExhausted`, and `Internal`
+* only for methods declared idempotent, up to 3 attempts. Workspace creation is
+* excluded because it has no idempotency key and a lost response is ambiguous.
 * As a targeted exception for the deploy/apply flow, a post-retry `AlreadyExists`
 * from an allowlisted Create (see `RETRY_SAFE_CREATE_METHODS`) is treated as
 * success, since it means a prior attempt already committed the resource
@@ -578,10 +260,10 @@ function retryInterceptor() {
 						logger.debug(`retry: ${req.method.name} returned AlreadyExists on attempt ${i + 1}; treating as success (prior attempt likely committed)`);
 						return synthesizeEmptyUnaryResponse(req);
 					}
-					const { reportCrash } = await import("./crashreport-D3RjuSYb.mjs");
+					const { reportCrash } = await import("./crashreport-0ioNRZ4K.mjs");
 					await reportCrash(error, "handledError");
 				}
-				if (isRetirable(error, req.method.idempotency)) {
+				if (req.method.name !== "CreateWorkspace" && isRetirable(error, req.method.idempotency)) {
 					lastError = error;
 					logger.debug(`retry: ${req.method.name} attempt ${i + 1} failed with ${connectCodeName(error)}; retrying`);
 					continue;
@@ -986,806 +668,6 @@ async function closeConnectionPool() {
 	await getGlobalDispatcher().close();
 }
 
-//#endregion
-//#region src/cli/shared/token-store.ts
-const SERVICE_NAME = "tailor-platform-cli";
-let entryClass;
-async function getEntryClass() {
-	if (entryClass !== void 0) return entryClass;
-	try {
-		const mod = await import("@napi-rs/keyring");
-		const probe = new mod.Entry(SERVICE_NAME, "__probe__");
-		probe.setPassword("probe");
-		probe.deletePassword();
-		entryClass = mod.Entry;
-	} catch {
-		logger.warn("System keyring is not available. Tokens will be stored in the config file. Set TAILOR_PLATFORM_TOKEN environment variable for CI environments.");
-		entryClass = false;
-	}
-	return entryClass;
-}
-/**
-* Check whether the OS keyring is available and functional.
-* @returns true if keyring is available
-*/
-async function isKeyringAvailable() {
-	return await getEntryClass() !== false;
-}
-/**
-* Load tokens from the OS keyring for a given account.
-* @param account - User identifier (e.g. email or client ID)
-* @returns Token data or undefined if not found or keyring unavailable
-*/
-async function loadKeyringTokens(account) {
-	const Entry = await getEntryClass();
-	if (!Entry) return void 0;
-	try {
-		const raw = new Entry(SERVICE_NAME, account).getPassword();
-		if (raw === null) return void 0;
-		return JSON.parse(raw);
-	} catch {
-		return;
-	}
-}
-/**
-* Save tokens to the OS keyring for a given account.
-* @param account - User identifier (e.g. email or client ID)
-* @param tokens - Token data to store
-*/
-async function saveKeyringTokens(account, tokens) {
-	const Entry = await getEntryClass();
-	if (!Entry) return;
-	new Entry(SERVICE_NAME, account).setPassword(JSON.stringify(tokens));
-}
-/**
-* Delete tokens from the OS keyring for a given account.
-* @param account - User identifier (e.g. email or client ID)
-*/
-async function deleteKeyringTokens(account) {
-	const Entry = await getEntryClass();
-	if (!Entry) return;
-	try {
-		new Entry(SERVICE_NAME, account).deletePassword();
-	} catch {}
-}
-
-//#endregion
-//#region src/cli/shared/context.ts
-const pfProfileSchema = z.object({
-	user: z.string(),
-	workspace_id: z.string(),
-	readonly: z.boolean().optional(),
-	machine_user: z.string().optional(),
-	machine_user_override: z.enum(["allow", "deny"]).optional(),
-	platform_url: z.url().optional(),
-	oauth2_client_id: z.string().optional(),
-	console_url: z.url().optional()
-});
-const pfUserSchemaV1 = z.object({
-	access_token: z.string(),
-	refresh_token: z.string().optional(),
-	token_expires_at: z.string()
-});
-const pfUserKeyringSchema = z.object({
-	storage: z.literal("keyring"),
-	token_expires_at: z.string()
-});
-const pfUserFileSchema = z.object({
-	storage: z.literal("file"),
-	token_expires_at: z.string(),
-	access_token: z.string(),
-	refresh_token: z.string().optional()
-});
-const pfUserSchemaV2 = z.discriminatedUnion("storage", [pfUserKeyringSchema, pfUserFileSchema]);
-const pfUserKeyringSchemaV3 = pfUserKeyringSchema.extend({ email: z.string().optional() });
-const pfUserFileSchemaV3 = pfUserFileSchema.extend({ email: z.string().optional() });
-const pfUserSchemaV3 = z.discriminatedUnion("storage", [pfUserKeyringSchemaV3, pfUserFileSchemaV3]);
-const pfConfigSchemaV1 = z.object({
-	version: z.literal(1),
-	users: z.partialRecord(z.string(), pfUserSchemaV1),
-	profiles: z.partialRecord(z.string(), pfProfileSchema),
-	current_user: z.string().nullable()
-});
-const V2_CONFIG_VERSION = 2;
-const LATEST_CONFIG_VERSION = 3;
-const V2_MIN_SDK_VERSION = "1.29.0";
-const V3_MIN_SDK_VERSION = "2.0.0";
-const semverSchema = z.templateLiteral([
-	z.number().int(),
-	".",
-	z.number().int(),
-	".",
-	z.number().int()
-]);
-const pfConfigSchemaV2 = z.object({
-	version: z.literal(V2_CONFIG_VERSION),
-	min_sdk_version: semverSchema,
-	latest_version: z.number().int().optional(),
-	latest_min_sdk_version: semverSchema.optional(),
-	users: z.partialRecord(z.string(), pfUserSchemaV2),
-	profiles: z.partialRecord(z.string(), pfProfileSchema),
-	current_user: z.string().nullable()
-});
-const pfConfigSchemaV3 = z.object({
-	version: z.literal(LATEST_CONFIG_VERSION),
-	min_sdk_version: semverSchema,
-	latest_version: z.number().int().optional(),
-	latest_min_sdk_version: semverSchema.optional(),
-	users: z.partialRecord(z.string(), pfUserSchemaV3),
-	profiles: z.partialRecord(z.string(), pfProfileSchema),
-	current_user: z.string().nullable()
-});
-function platformConfigPath() {
-	if (!xdgConfig) throw new Error("User home directory not found");
-	return path.join(xdgConfig, "tailor-platform", "config.yaml");
-}
-/**
-* Convert stored profile platform fields to platform client settings.
-* @param profile - Profile platform settings
-* @returns Platform client settings
-*/
-function platformConfigFromProfile(profile) {
-	const config = {
-		...profile?.platform_url ? { platformUrl: profile.platform_url } : {},
-		...profile?.oauth2_client_id ? { oauth2ClientId: profile.oauth2_client_id } : {},
-		...profile?.console_url ? { consoleUrl: profile.console_url } : {}
-	};
-	return Object.keys(config).length > 0 ? config : void 0;
-}
-function platformUserKey(user, config) {
-	const platformUrl = getPlatformBaseUrl(config);
-	if (platformUrl === normalizeBaseUrl("https://api.tailor.tech")) return user;
-	return `${platformUrl}|${user}`;
-}
-function userFromPlatformUserKey(userKey, config) {
-	const platformPrefix = `${getPlatformBaseUrl(config)}|`;
-	return userKey.startsWith(platformPrefix) ? userKey.slice(platformPrefix.length) : userKey;
-}
-function canUseLegacyUserKey(platformUrl) {
-	try {
-		return getPlatformBaseUrl() === platformUrl;
-	} catch {
-		return false;
-	}
-}
-function findUserByEmail(users, email, platformConfig) {
-	const platformUrl = getPlatformBaseUrl(platformConfig);
-	const platformPrefix = `${platformUrl}|`;
-	const defaultPlatform = platformUrl === normalizeBaseUrl(defaultPlatformBaseUrl);
-	return Object.entries(users).find(([key, entry]) => {
-		if (entry?.email !== email) return false;
-		return defaultPlatform ? !key.includes("|") : key.startsWith(platformPrefix);
-	});
-}
-function findUserEntry(config, user, platformConfig, opts = {}) {
-	const userKey = platformUserKey(user, platformConfig);
-	const userEntry = config.users[userKey];
-	if (userEntry) return {
-		userKey,
-		userEntry
-	};
-	const emailMatch = findUserByEmail(config.users, user, platformConfig);
-	if (emailMatch?.[1]) return {
-		userKey: emailMatch[0],
-		userEntry: emailMatch[1]
-	};
-	const platformUrl = getPlatformBaseUrl(platformConfig);
-	if (userKey !== user && (opts.allowLegacyUserKey === false || !canUseLegacyUserKey(platformUrl))) return {
-		userKey,
-		userEntry
-	};
-	const legacyEntry = config.users[user];
-	return legacyEntry ? {
-		userKey: user,
-		userEntry: legacyEntry
-	} : {
-		userKey,
-		userEntry
-	};
-}
-/**
-* Resolve the config user key that would be used for a user on the selected platform.
-* @param config - Platform config
-* @param user - User name
-* @param platformConfig - Optional platform connection settings
-* @param opts - Token lookup options
-* @returns Resolved config user key
-*/
-function resolveUserTokenKey(config, user, platformConfig, opts) {
-	return findUserEntry(config, user, platformConfig, opts).userKey;
-}
-function resolveConfigUser(config, user, platformConfig, opts) {
-	const { userKey, userEntry } = findUserEntry(config, user, platformConfig, opts);
-	return userEntry ? userFromPlatformUserKey(userKey, platformConfig) : void 0;
-}
-/**
-* Check whether tokens are registered for a user on the selected platform.
-* @param config - Platform config
-* @param user - User name
-* @param platformConfig - Optional platform connection settings
-* @param opts - Token lookup options
-* @returns True when the user has a registered token entry
-*/
-function hasUserTokenEntry(config, user, platformConfig, opts) {
-	return findUserEntry(config, user, platformConfig, opts).userEntry !== void 0;
-}
-function hasUserKeyForName(users, user) {
-	return users[user] !== void 0 || Object.keys(users).some((key) => key.endsWith(`|${user}`));
-}
-function hasUserEmailEntry(users, user) {
-	return Object.values(users).some((entry) => entry?.email === user);
-}
-/**
-* Check whether any platform has tokens registered for a user.
-* @param config - Platform config
-* @param user - User name
-* @returns True when the user has a token entry for any platform
-*/
-function hasAnyUserTokenEntry(config, user) {
-	return hasUserKeyForName(config.users, user) || hasUserEmailEntry(config.users, user);
-}
-function hasCurrentUserEntry(users, currentUser) {
-	return hasUserKeyForName(users, currentUser);
-}
-/**
-* Migrate a v1 config to v2.
-* Tokens are kept in the config file (storage: "file") during migration.
-* They will be moved to the OS keyring on next login or token refresh.
-* @param v1Config - v1 configuration to migrate
-* @returns Migrated v2 configuration
-*/
-function migrateV1ToV2(v1Config) {
-	const users = {};
-	for (const [name, v1User] of Object.entries(v1Config.users)) {
-		if (!v1User) continue;
-		users[name] = {
-			access_token: v1User.access_token,
-			refresh_token: v1User.refresh_token,
-			token_expires_at: v1User.token_expires_at,
-			storage: "file"
-		};
-	}
-	return {
-		version: V2_CONFIG_VERSION,
-		min_sdk_version: V2_MIN_SDK_VERSION,
-		users,
-		profiles: v1Config.profiles,
-		current_user: v1Config.current_user
-	};
-}
-function inferEmailFromUserId(user) {
-	return z.email().safeParse(user).success ? user : void 0;
-}
-function migrateV2ToV3(v2Config) {
-	const users = {};
-	for (const [user, entry] of Object.entries(v2Config.users)) {
-		if (!entry) continue;
-		const email = inferEmailFromUserId(user);
-		users[user] = {
-			...entry,
-			...email ? { email } : {}
-		};
-	}
-	return {
-		version: LATEST_CONFIG_VERSION,
-		min_sdk_version: V3_MIN_SDK_VERSION,
-		users,
-		profiles: v2Config.profiles,
-		current_user: v2Config.current_user
-	};
-}
-function migrateV1ToV3(v1Config) {
-	return migrateV2ToV3(migrateV1ToV2(v1Config));
-}
-function formatUnknownError(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-async function trySaveTokensInKeyring(user, tokens) {
-	if (!await isKeyringAvailable()) return false;
-	try {
-		await saveKeyringTokens(user, tokens);
-		return true;
-	} catch (error) {
-		logger.warn(`System keyring failed to store credentials. Tokens will be stored in the config file. ${formatUnknownError(error)}`);
-		return false;
-	}
-}
-async function warnIfNewerConfigAvailable(config) {
-	if (!config.latest_min_sdk_version) return;
-	if (lt((await readPackageJson()).version ?? "0.0.0", config.latest_min_sdk_version)) logger.warn(multiline`
-      A newer config version (${String(config.latest_version)}) is available.
-      Please update your SDK to >= ${config.latest_min_sdk_version}: pnpm update @tailor-platform/sdk
-    `);
-}
-/**
-* Read Tailor Platform CLI configuration, migrating from v1 if necessary.
-* @returns Parsed platform configuration
-*/
-async function readPlatformConfig() {
-	const configPath = platformConfigPath();
-	if (!fs$1.existsSync(configPath)) {
-		const config = {
-			version: LATEST_CONFIG_VERSION,
-			min_sdk_version: V3_MIN_SDK_VERSION,
-			users: {},
-			profiles: {},
-			current_user: null
-		};
-		writePlatformConfig(config);
-		return config;
-	}
-	const rawConfig = parseYAML(fs$1.readFileSync(configPath, "utf-8"));
-	tightenSecretFilePermissions(configPath);
-	const version = rawConfig != null && typeof rawConfig === "object" && "version" in rawConfig ? rawConfig.version : void 0;
-	if (typeof version === "number" && version > LATEST_CONFIG_VERSION) {
-		const minSdk = "min_sdk_version" in rawConfig ? String(rawConfig.min_sdk_version) : void 0;
-		const updateHint = minSdk ? `Please update your SDK to >= ${minSdk}: pnpm update @tailor-platform/sdk` : "Please update your SDK: pnpm update @tailor-platform/sdk";
-		throw new Error(multiline`
-      Config file uses version ${String(version)}, but this SDK only supports up to version ${String(LATEST_CONFIG_VERSION)}.
-      ${updateHint}
-    `);
-	}
-	const v3Result = pfConfigSchemaV3.safeParse(rawConfig);
-	if (v3Result.success) {
-		await warnIfNewerConfigAvailable(v3Result.data);
-		return v3Result.data;
-	}
-	const v2Result = pfConfigSchemaV2.safeParse(rawConfig);
-	if (v2Result.success) {
-		await warnIfNewerConfigAvailable(v2Result.data);
-		return migrateV2ToV3(v2Result.data);
-	}
-	const v1Result = pfConfigSchemaV1.safeParse(rawConfig);
-	if (v1Result.success) return migrateV1ToV3(v1Result.data);
-	throw new Error(multiline`
-    Failed to parse config file at ${configPath}.
-    The file may be corrupted or created by an incompatible SDK version.
-  `);
-}
-function toV1ForDisk(config) {
-	const users = {};
-	for (const [name, entry] of Object.entries(config.users)) {
-		if (!entry || entry.storage === "keyring") continue;
-		users[name] = {
-			access_token: entry.access_token,
-			refresh_token: entry.refresh_token,
-			token_expires_at: entry.token_expires_at
-		};
-	}
-	const currentUser = config.current_user && hasCurrentUserEntry(users, config.current_user) ? config.current_user : null;
-	return {
-		version: 1,
-		users,
-		profiles: config.profiles,
-		current_user: currentUser
-	};
-}
-function hasProfilePlatformSettings(config) {
-	return Object.values(config.profiles).some((profile) => profile?.platform_url !== void 0 || profile?.oauth2_client_id !== void 0 || profile?.console_url !== void 0);
-}
-function hasScopedUserKeys(config) {
-	return Object.keys(config.users).some((userKey) => userKey.includes("|"));
-}
-function hasUserEmailMetadata(config) {
-	return Object.values(config.users).some((user) => user != null && "email" in user && user.email !== void 0);
-}
-function toLatestForDisk(config) {
-	return {
-		...config.version === 1 ? migrateV1ToV2(config) : config,
-		version: LATEST_CONFIG_VERSION,
-		min_sdk_version: V3_MIN_SDK_VERSION
-	};
-}
-/**
-* Write Tailor Platform CLI configuration to disk.
-* By default, file-backed configs without newer fields are converted to V1 for
-* backward compatibility, so an older SDK can still read the file. Configs
-* containing a keyring user are kept in V2 or later because the keyring storage
-* variant is not representable in V1. Configs containing profile-level Platform
-* settings, platform-scoped user tokens, canonical user IDs, or email metadata
-* are written in the latest min-SDK-gated format because older SDKs would
-* silently drop or misread those settings.
-*
-* The config file may contain access/refresh tokens when the OS keyring is
-* unavailable, so it is written via {@link writeSecretFile} so other users
-* on the host cannot read it.
-* @param config - Platform configuration to write
-*/
-function writePlatformConfig(config) {
-	const configPath = platformConfigPath();
-	const hasKeyringUser = config.version !== 1 && Object.values(config.users).some((u) => u?.storage === "keyring");
-	writeSecretFile(configPath, stringifyYAML(config.version === LATEST_CONFIG_VERSION || hasProfilePlatformSettings(config) || hasScopedUserKeys(config) || hasUserEmailMetadata(config) ? toLatestForDisk(config) : config.version === V2_CONFIG_VERSION && !hasKeyringUser ? toV1ForDisk(config) : config));
-}
-function validateUUID(value, source) {
-	const result = z.uuid().safeParse(value);
-	if (!result.success) throw new Error(`Invalid value from ${source}: must be a valid UUID`);
-	return result.data;
-}
-/**
-* Load workspace ID from command options, environment variables, or platform config.
-* In CLI context, env fallback is also handled by politty's arg env option.
-* Priority: opts/workspaceId > env/workspaceId > opts/profile > error
-* @param opts - Workspace and profile options
-* @returns Resolved workspace ID
-*/
-async function loadWorkspaceId(opts) {
-	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
-	if (opts?.workspaceId) return validateUUID(opts.workspaceId, "--workspace-id option");
-	if (process.env.TAILOR_PLATFORM_WORKSPACE_ID) return validateUUID(process.env.TAILOR_PLATFORM_WORKSPACE_ID, "TAILOR_PLATFORM_WORKSPACE_ID environment variable");
-	if (profile) {
-		const wsId = (await readPlatformConfig()).profiles[profile]?.workspace_id;
-		if (!wsId) throw new Error(`Profile "${profile}" not found`);
-		return validateUUID(wsId, `profile "${profile}"`);
-	}
-	throw new Error(multiline`
-    Workspace ID not found.
-    Please specify workspace ID via --workspace-id option or TAILOR_PLATFORM_WORKSPACE_ID environment variable.
-  `);
-}
-/**
-* Load machine user name from command options, environment variables, or platform config.
-* In CLI context, env fallback is also handled by politty's arg env option.
-* Priority: opts/machineUser > env/TAILOR_PLATFORM_MACHINE_USER_NAME > opts/profile (profile default) > undefined.
-* An explicitly empty `opts.machineUser` is rejected with a CLIError (`MACHINE_USER_NAME_EMPTY`) rather than falling back to the env var or profile default.
-* When the active profile has `machine_user_override: "deny"`, an explicit value that differs from the profile's machine user throws a CLIError with code `PROFILE_MACHINE_USER_OVERRIDE_DENIED`.
-* @param opts - Machine user and profile options
-* @returns Resolved machine user name, or undefined if not set
-*/
-async function loadMachineUserName(opts) {
-	if (opts?.machineUser === "") throw createCLIError({
-		code: "MACHINE_USER_NAME_EMPTY",
-		message: "Machine user name cannot be empty.",
-		suggestion: "Pass a non-empty machine user name, or omit the option to use the environment variable or profile default."
-	});
-	const envMachineUser = process.env.TAILOR_PLATFORM_MACHINE_USER_NAME || void 0;
-	const explicitMachineUser = opts?.machineUser ? {
-		source: opts.machineUserSource ?? "option",
-		value: opts.machineUser
-	} : envMachineUser ? {
-		source: "env",
-		value: envMachineUser
-	} : void 0;
-	const explicit = explicitMachineUser?.value;
-	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
-	if (!profile) return explicit;
-	const entry = (await readPlatformConfig()).profiles[profile];
-	if (!entry) {
-		if (explicit) return explicit;
-		throw new Error(`Profile "${profile}" not found`);
-	}
-	if (entry.machine_user && entry.machine_user_override === "deny") {
-		if (explicit && explicit !== entry.machine_user) {
-			const details = explicitMachineUser.source === "env" ? `The machine user is being set to "${explicit}" via the TAILOR_PLATFORM_MACHINE_USER_NAME environment variable, which conflicts with this profile's pinned machine user "${entry.machine_user}".` : `This profile fixes the machine user to "${entry.machine_user}" for application-data commands.`;
-			throw createCLIError({
-				code: "PROFILE_MACHINE_USER_OVERRIDE_DENIED",
-				message: `Profile "${profile}" denies overriding the machine user.`,
-				details,
-				suggestion: `Omit the machine user option, unset TAILOR_PLATFORM_MACHINE_USER_NAME, or run 'tailor profile update ${profile} --machine-user-override allow'.`
-			});
-		}
-		return entry.machine_user;
-	}
-	return explicit || entry.machine_user;
-}
-/**
-* Load access token from environment variables, command options, or platform config.
-* In CLI context, profile env fallback is also handled by politty's arg env option.
-* Priority: env/TAILOR_PLATFORM_TOKEN > env/TAILOR_TOKEN (deprecated) > opts/profile > env/profile > config/currentUser > error
-* @param opts - Profile options
-* @returns Resolved access token
-*/
-async function loadAccessToken(opts) {
-	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
-	const envToken = process.env.TAILOR_PLATFORM_TOKEN ?? process.env.TAILOR_TOKEN;
-	if (envToken && !process.env.TAILOR_PLATFORM_TOKEN) logger.warn("TAILOR_TOKEN is deprecated. Please use TAILOR_PLATFORM_TOKEN instead.");
-	if (envToken) {
-		rememberPlatformConfigForToken(envToken, await loadPlatformClientConfig({
-			profile,
-			allowMissingProfile: true
-		}));
-		return envToken;
-	}
-	const pfConfig = await readPlatformConfig();
-	const profileEntry = profile ? pfConfig.profiles[profile] : void 0;
-	if (profile && !profileEntry) throw new Error(`Profile "${profile}" not found`);
-	const user = profileEntry?.user ?? pfConfig.current_user;
-	if (!user) throw new Error(multiline`
-      Tailor Platform token not found.
-      Please specify token via TAILOR_PLATFORM_TOKEN environment variable or login using 'tailor login' command.
-    `);
-	return (await fetchLatestToken(pfConfig, user, profileEntry ? platformConfigFromProfile(profileEntry) : void 0)).accessToken;
-}
-/**
-* Load platform connection settings from the active profile.
-* @param opts - Profile options
-* @returns Resolved platform connection settings, or undefined for the default environment
-*/
-async function loadPlatformClientConfig(opts) {
-	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
-	if (!profile) return;
-	let pfConfig;
-	try {
-		pfConfig = await readPlatformConfig();
-	} catch (error) {
-		if (opts?.allowMissingProfile) return;
-		throw error;
-	}
-	const profileEntry = pfConfig.profiles[profile];
-	if (!profileEntry) {
-		if (opts?.allowMissingProfile) return;
-		throw new Error(`Profile "${profile}" not found`);
-	}
-	return platformConfigFromProfile(profileEntry);
-}
-/**
-* Load the Tailor Platform Console base URL from environment variables or the active profile.
-* @param opts - Profile options
-* @returns Resolved Console base URL
-*/
-async function loadConsoleBaseUrl(opts) {
-	return getConsoleBaseUrl(await loadPlatformClientConfig(opts));
-}
-/**
-* Resolve the actual token values for a user, reading from keyring or config as appropriate.
-* @param userEntry - User entry from the config
-* @param user - User identifier
-* @param label - User-facing identifier used in error messages
-* @returns Access token and optional refresh token
-*/
-async function resolveTokens(userEntry, user, label = user) {
-	if (userEntry.storage === "keyring") {
-		const tokens = await loadKeyringTokens(user);
-		if (!tokens) throw new Error(multiline`
-        Credentials not found in OS keyring for "${label}".
-        Please run 'tailor login' and try again.
-      `);
-		return tokens;
-	}
-	return {
-		accessToken: userEntry.access_token,
-		refreshToken: userEntry.refresh_token
-	};
-}
-/**
-* Save tokens for a user, writing to keyring by default when available.
-* @param config - Platform config
-* @param user - User identifier
-* @param tokens - Token data to save
-* @param tokens.accessToken - Access token to save
-* @param tokens.refreshToken - Optional refresh token to save
-* @param expiresAt - Token expiration date
-* @param opts - Optional platform and user metadata
-*/
-async function saveUserTokens(config, user, tokens, expiresAt, opts = {}) {
-	const userKey = platformUserKey(user, opts.platformConfig);
-	const email = opts.email ?? config.users[userKey]?.email;
-	if (await trySaveTokensInKeyring(userKey, tokens)) config.users[userKey] = {
-		token_expires_at: expiresAt,
-		storage: "keyring",
-		...email ? { email } : {}
-	};
-	else {
-		if (config.users[userKey]?.storage === "keyring") await deleteKeyringTokens(userKey);
-		config.users[userKey] = {
-			access_token: tokens.accessToken,
-			refresh_token: tokens.refreshToken,
-			token_expires_at: expiresAt,
-			storage: "file",
-			...email ? { email } : {}
-		};
-	}
-}
-/**
-* Delete tokens for a user from keyring if applicable.
-* @param config - Platform config
-* @param user - User identifier
-* @param platformConfig - Optional platform connection settings
-* @param opts - Token lookup options
-*/
-async function deleteUserTokens(config, user, platformConfig, opts) {
-	const { userKey, userEntry } = findUserEntry(config, user, platformConfig, opts);
-	if (userEntry?.storage === "keyring") await deleteKeyringTokens(userKey);
-	delete config.users[userKey];
-}
-/**
-* Resolve stored tokens for a user on the selected platform.
-* @param config - Platform config
-* @param user - User name
-* @param platformConfig - Optional platform connection settings
-* @param opts - Token lookup options
-* @returns Stored user entry and token values, or undefined when the user is not logged in
-*/
-async function loadStoredUserTokens(config, user, platformConfig, opts) {
-	const { userKey, userEntry } = findUserEntry(config, user, platformConfig, opts);
-	if (!userEntry) return void 0;
-	return {
-		userEntry,
-		...await resolveTokens(userEntry, userKey, user)
-	};
-}
-function updateUserReferences(config, fromUser, toUser) {
-	if (fromUser === toUser) return;
-	if (config.current_user === fromUser) config.current_user = toUser;
-	for (const profile of Object.values(config.profiles)) if (profile?.user === fromUser) profile.user = toUser;
-}
-/**
-* Remove a legacy alias after a canonical user ID has been written.
-* @param config - Platform config
-* @param legacyUser - Previous user key
-* @param canonicalUser - Canonical user key
-* @param platformConfig - Platform settings for scoped token storage
-*/
-async function removeLegacyUserAlias(config, legacyUser, canonicalUser, platformConfig) {
-	if (legacyUser === canonicalUser) return;
-	updateUserReferences(config, legacyUser, canonicalUser);
-	const canonicalKey = platformUserKey(canonicalUser, platformConfig);
-	const legacyKeys = /* @__PURE__ */ new Set([legacyUser, platformUserKey(legacyUser, platformConfig)]);
-	for (const legacyKey of legacyKeys) {
-		if (legacyKey === canonicalKey) continue;
-		if (config.users[legacyKey]?.storage === "keyring") await deleteKeyringTokens(legacyKey);
-		delete config.users[legacyKey];
-	}
-}
-function shouldResolveSubjectOnRefresh(user, userEntry) {
-	return Boolean(userEntry.email || inferEmailFromUserId(user));
-}
-/**
-* Fetch the latest access token, refreshing if necessary.
-* @param config - Platform config
-* @param user - User identifier
-* @param platformConfig - Optional platform connection settings
-* @returns Latest access token and the canonical user ID it is stored under
-*   (the resolved subject when a legacy email key was migrated during refresh,
-*   otherwise the matching config user)
-*/
-async function fetchLatestToken(config, user, platformConfig) {
-	const { userKey: storedUser, userEntry } = findUserEntry(config, user, platformConfig);
-	if (!userEntry) throw new Error(multiline`
-      User "${user}" not found.
-      Please verify your user name and login using 'tailor login' command.
-    `);
-	const storedConfigUser = userFromPlatformUserKey(storedUser, platformConfig);
-	const tokens = await resolveTokens(userEntry, storedUser, user);
-	if (new Date(userEntry.token_expires_at) > /* @__PURE__ */ new Date()) {
-		rememberPlatformConfigForToken(tokens.accessToken, platformConfig);
-		return {
-			accessToken: tokens.accessToken,
-			user: storedConfigUser
-		};
-	}
-	if (!tokens.refreshToken) throw new Error(multiline`
-      Token expired.
-      Please run 'tailor login' and try again.
-    `);
-	const client = initOAuth2Client(platformConfig);
-	let resp;
-	try {
-		resp = await client.refreshToken({
-			accessToken: tokens.accessToken,
-			refreshToken: tokens.refreshToken,
-			expiresAt: Date.parse(userEntry.token_expires_at)
-		});
-	} catch {
-		throw new Error(multiline`
-      Failed to refresh token. Your session may have expired.
-      Please run 'tailor login' and try again.
-    `);
-	}
-	const newExpiresAt = new Date(assertDefined(resp.expiresAt, "token refresh response missing expiresAt")).toISOString();
-	let resolvedUser = storedConfigUser;
-	const previousEmail = userEntry.email ?? inferEmailFromUserId(user) ?? inferEmailFromUserId(storedConfigUser);
-	let email = previousEmail;
-	if (shouldResolveSubjectOnRefresh(user, userEntry) || shouldResolveSubjectOnRefresh(storedConfigUser, userEntry)) try {
-		const userInfo = await fetchUserInfo(resp.accessToken, platformConfig);
-		resolvedUser = userInfo.sub;
-		email = userInfo.email;
-	} catch (error) {
-		logger.debug(`Failed to resolve refreshed token user info: ${String(error)}`);
-	}
-	await saveUserTokens(config, resolvedUser, {
-		accessToken: resp.accessToken,
-		refreshToken: resp.refreshToken ?? void 0
-	}, newExpiresAt, {
-		platformConfig,
-		email
-	});
-	await removeLegacyUserAlias(config, user, resolvedUser, platformConfig);
-	if (storedUser !== platformUserKey(resolvedUser, platformConfig)) {
-		if (config.users[storedUser]?.storage === "keyring") await deleteKeyringTokens(storedUser);
-		delete config.users[storedUser];
-	}
-	if (previousEmail && email && previousEmail !== email) logger.info(`Updated local user email from "${previousEmail}" to "${email}".`);
-	writePlatformConfig(config);
-	rememberPlatformConfigForToken(resp.accessToken, platformConfig);
-	return {
-		accessToken: resp.accessToken,
-		user: resolvedUser
-	};
-}
-const DEFAULT_CONFIG_FILENAME = "tailor.config.ts";
-/**
-* Load config path from command options, environment variables, or search parent directories.
-* In CLI context, env fallback is also handled by politty's arg env option.
-* Priority: opts/config > env/config > search parent directories
-* @param configPath - Optional explicit config path
-* @returns Resolved config path or undefined
-*/
-function loadConfigPath(configPath) {
-	if (configPath) return configPath;
-	if (process.env.TAILOR_CONFIG_PATH) return process.env.TAILOR_CONFIG_PATH;
-	return findUpSync(DEFAULT_CONFIG_FILENAME);
-}
-
-//#endregion
-//#region src/cli/shared/mock.ts
-/**
-* Install a stub `globalThis.tailordb` so that user code loaded by the CLI
-* (e.g. via `createGetDB` in `@tailor-platform/sdk/kysely`) can reference
-* `tailordb.Client` without hitting a `ReferenceError`. The CLI never
-* actually executes the user code paths that issue queries, so a no-op
-* client suffices.
-*
-* Exposed as a function (rather than a top-level statement) so that
-* `package.json#sideEffects` can keep the file marked side-effect-free
-* without bundlers eliminating the install step.
-*/
-function installCliTailordbStub() {
-	globalThis.tailordb = { Client: class {
-		constructor(_config) {}
-		async connect() {}
-		async end() {}
-		async queryObject() {
-			return {};
-		}
-	} };
-}
-
-//#endregion
-//#region src/cli/shared/config-loader.ts
-/**
-* Load Tailor configuration file and associated plugins.
-* @param configPath - Optional explicit config path
-* @param options - Optional module import behavior.
-* @returns Loaded config, plugins, and config path
-*/
-async function loadConfig(configPath, options = {}) {
-	installCliTailordbStub();
-	const foundPath = loadConfigPath(configPath);
-	if (!foundPath) throw new Error("Configuration file not found: tailor.config.ts not found in current or parent directories");
-	const resolvedPath = path.resolve(process.cwd(), foundPath);
-	if (!fs$1.existsSync(resolvedPath)) throw new Error(`Configuration file not found: ${configPath}`);
-	const configUrl = pathToFileURL(resolvedPath);
-	if (options.importNonce) configUrl.searchParams.set("tailorImportNonce", options.importNonce);
-	const configModule = await import(configUrl.href);
-	if (!configModule || !configModule.default) throw new Error("Invalid Tailor config module: default export not found");
-	const validated = AppConfigSchema.safeParse(configModule.default);
-	if (!validated.success) {
-		const issues = validated.error.issues.map((i) => `  - ${i.path.join(".") || "(root)"}: ${i.message}`).join("\n");
-		throw new Error(`Invalid Tailor config in ${resolvedPath}:\n${issues}`);
-	}
-	const allPlugins = [];
-	for (const value of Object.values(configModule)) if (Array.isArray(value)) {
-		const pluginParsed = value.reduce((acc, item) => {
-			if (!acc.success) return acc;
-			const result = PluginConfigSchema.safeParse(item);
-			if (result.success) acc.items.push(result.data);
-			else acc.success = false;
-			return acc;
-		}, {
-			success: true,
-			items: []
-		});
-		if (pluginParsed.success && pluginParsed.items.length > 0) allPlugins.push(...pluginParsed.items);
-	}
-	return {
-		config: {
-			...configModule.default,
-			path: resolvedPath
-		},
-		plugins: allPlugins
-	};
-}
-
 //#endregion
 //#region src/cli/cache/hasher.ts
 /**
@@ -1802,7 +684,7 @@ function hashContent(content) {
 * @returns Hex-encoded SHA-256 hash of the file content
 */
 function hashFile(filePath) {
-	const content = fs$1.readFileSync(filePath);
+	const content = fs.readFileSync(filePath);
 	return crypto.createHash("sha256").update(content).digest("hex");
 }
 /**
@@ -1871,15 +753,16 @@ function combineHash(fileHash, contextHash) {
 /**
 * Compute a context hash for cache invalidation across bundlers.
 *
-* Combines the source file path, serialized trigger context, tsconfig hash,
-* sourcemap mode, bundle log level, and an optional prefix (e.g., serialized
-* env variables) into a single SHA-256 hash.
+* Combines the source file path, a caller-supplied extra context string
+* (e.g. serialized workflow start-call bindings, or an HTTP adapter's method
+* list), tsconfig hash, sourcemap mode, bundle log level, and an optional
+* prefix (e.g., serialized env variables) into a single SHA-256 hash.
 * @param params - Context hash computation parameters
 * @returns SHA-256 hex digest of the combined context
 */
 function computeBundlerContextHash(params) {
-	const { sourceFile, serializedTriggerContext, tsconfig, inlineSourcemap, bundleLogLevel, prefix } = params;
-	return hashContent((prefix ?? "") + path.resolve(sourceFile) + serializedTriggerContext + (tsconfig ? hashFile(tsconfig) : "") + String(inlineSourcemap ?? false) + (bundleLogLevel ?? ""));
+	const { sourceFile, extraContext, tsconfig, inlineSourcemap, bundleLogLevel, prefix } = params;
+	return hashContent((prefix ?? "") + path.resolve(sourceFile) + extraContext + (tsconfig ? hashFile(tsconfig) : "") + String(inlineSourcemap ?? false) + (bundleLogLevel ?? ""));
 }
 /**
 * Run a build with optional cache restore/save around it.
@@ -1931,7 +814,10 @@ function createBundleCache(store) {
 			return;
 		}
 		if (currentHash !== entry.inputHash) return;
-		return store.restoreBundleContent(cacheKey);
+		const content = store.restoreBundleContent(cacheKey);
+		const output = entry.outputFiles.find((file) => file.outputPath === cacheKey);
+		if (content === void 0 || !output || hashContent(content) !== output.contentHash) return;
+		return content;
 	}
 	function save(params) {
 		const { kind, namespace, name, sourceFile, content, dependencyPaths, contextHash } = params;
@@ -1978,7 +864,7 @@ function resolveRelativePluginImportPath(pluginImportPath, baseDirs) {
 	if (!pluginImportPath.startsWith(".")) return null;
 	for (const baseDir of baseDirs) {
 		const absolutePath = path.resolve(baseDir, pluginImportPath);
-		if (fs$1.existsSync(absolutePath)) return absolutePath;
+		if (fs.existsSync(absolutePath)) return absolutePath;
 	}
 	return null;
 }
@@ -2062,13 +948,13 @@ function generatePluginExecutorFiles(executors, outputDir, typeGenerationResult,
 function generateSingleExecutorFile(info, outputDir, typeGenerationResult, sourceTypeInfoMap, baseDirs = []) {
 	const pluginDir = sanitizePluginId$1(info.pluginId);
 	const executorOutputDir = path.join(outputDir, pluginDir, "executors");
-	fs$1.mkdirSync(executorOutputDir, { recursive: true });
+	fs.mkdirSync(executorOutputDir, { recursive: true });
 	const fileName = sanitizeExecutorFileName(info.executor.name);
 	const filePath = path.join(executorOutputDir, `${fileName}.ts`);
 	let content;
 	if (isPluginExecutorWithFile(info.executor)) content = generateExecutorFileContentNew(info, info.executor, outputDir, typeGenerationResult, sourceTypeInfoMap, baseDirs);
 	else content = generateExecutorFileContentLegacy(info.executor);
-	fs$1.writeFileSync(filePath, content);
+	fs.writeFileSync(filePath, content);
 	return filePath;
 }
 /**
@@ -2300,7 +1186,7 @@ function extractDynamicImportSpecifier(resolve) {
 function resolvePluginBaseDir(pluginImportPath, baseDirs) {
 	if (pluginImportPath.startsWith(".")) {
 		const resolvedPath = resolveRelativePluginImportPath(pluginImportPath, baseDirs) ?? path.resolve(baseDirs[0] ?? process.cwd(), pluginImportPath);
-		if (fs$1.existsSync(resolvedPath)) return fs$1.statSync(resolvedPath).isDirectory() ? resolvedPath : path.dirname(resolvedPath);
+		if (fs.existsSync(resolvedPath)) return fs.statSync(resolvedPath).isDirectory() ? resolvedPath : path.dirname(resolvedPath);
 		return path.extname(resolvedPath) ? path.dirname(resolvedPath) : resolvedPath;
 	}
 	for (const baseDir of baseDirs) try {
@@ -2387,11 +1273,11 @@ function generatePluginTypeFiles(types, outputDir) {
 		seenTypeNames.set(info.type.name, info);
 		const pluginDir = sanitizePluginId(info.pluginId);
 		const typeOutputDir = path.join(outputDir, pluginDir, "types");
-		fs$1.mkdirSync(typeOutputDir, { recursive: true });
+		fs.mkdirSync(typeOutputDir, { recursive: true });
 		const fileName = `${toKebabCase(info.type.name)}.ts`;
 		const filePath = path.join(typeOutputDir, fileName);
 		const content = generateTypeFileContent(info);
-		fs$1.writeFileSync(filePath, content);
+		fs.writeFileSync(filePath, content);
 		generatedFiles.push(filePath);
 		const relativePath = path.relative(outputDir, filePath);
 		typeFilePaths.set(info.type.name, relativePath);
@@ -2512,20 +1398,6 @@ function toCamelCase(str) {
 	return result.charAt(0).toLowerCase() + result.slice(1);
 }
 
-//#endregion
-//#region src/cli/services/stale-cleanup.ts
-/**
-* Remove stale `.entry.js` files from the output directory.
-*
-* Must be called before parallel bundling; concurrent builds
-* sharing the same output directory would otherwise conflict.
-* @param outputDir - Directory to clean
-*/
-async function removeStaleEntryFiles(outputDir) {
-	const files = await fs.readdir(outputDir);
-	await Promise.all(files.filter((file) => file.endsWith(".entry.js")).map((file) => fs.rm(path.join(outputDir, file), { force: true })));
-}
-
 //#endregion
 //#region src/cli/services/workflow/ast-utils.ts
 /**
@@ -2571,18 +1443,18 @@ function argumentSourceText(arg, sourceText) {
 	if (arg && typeof arg === "object" && "start" in arg && "end" in arg) return sourceText.slice(arg.start, arg.end);
 }
 /**
-* Get metadata for a static `identifier.trigger(...)` call.
+* Get metadata for a static `identifier.start(...)` call.
 * @param node - AST node to inspect
 * @param sourceText - Source code text
-* @returns Trigger call metadata, or null when the node is not a trigger call
+* @returns Start call metadata, or null when the node is not a start call
 */
-function getTriggerCallInfo(node, sourceText) {
+function getStartCallInfo(node, sourceText) {
 	if (!node || typeof node !== "object" || node.type !== "CallExpression") return null;
 	const callExpr = node;
 	const callee = callExpr.callee;
 	if (callee.type !== "MemberExpression") return null;
 	const memberExpr = callee;
-	if (memberExpr.computed || memberExpr.property.name !== "trigger" || memberExpr.object.type !== "Identifier") return null;
+	if (memberExpr.computed || memberExpr.property.name !== "start" || memberExpr.object.type !== "Identifier") return null;
 	return {
 		identifierName: memberExpr.object.name,
 		callRange: {
@@ -2865,9 +1737,9 @@ function findAllWorkflows(program, _sourceText) {
 }
 
 //#endregion
-//#region src/cli/shared/trigger-context.ts
+//#region src/cli/shared/start-context.ts
 /**
-* Normalize a source module path for trigger binding lookup.
+* Normalize a source module path for start-call binding lookup.
 * @param filePath - Source file path or extensionless relative import path
 * @returns Absolute path without a JavaScript or TypeScript extension
 */
@@ -2922,19 +1794,20 @@ function createModuleBindings(program, source) {
 	};
 }
 /**
-* Build trigger context from configured workflow source files.
+* Build start-call context from configured workflow source files.
 * @param workflowConfig - Workflow file loading configuration
 * @param authNamespace - Auth service namespace (optional, used for string-literal invoker expansion)
+* @param baseDir - Directory the workflow config's file patterns are resolved against (defaults to process.cwd())
 * @returns Module-local workflow and job binding metadata
 */
-async function buildTriggerContext(workflowConfig, authNamespace) {
+async function buildStartContext(workflowConfig, authNamespace, baseDir = process.cwd()) {
 	const modules = /* @__PURE__ */ new Map();
 	if (!workflowConfig) return {
 		modules,
 		authNamespace
 	};
-	for (const file of loadFilesWithIgnores(workflowConfig)) try {
-		const source = await fs$1.promises.readFile(file, "utf-8");
+	for (const file of loadFilesWithIgnores(workflowConfig, baseDir)) try {
+		const source = await fs.promises.readFile(file, "utf-8");
 		const { program } = parseSync("input.ts", source);
 		modules.set(normalizeFilePath(file), createModuleBindings(program, source));
 	} catch (error) {
@@ -2954,11 +1827,11 @@ function sortedTargets(bindings) {
 	]);
 }
 /**
-* Serialize trigger context to a deterministic cache input.
-* @param context - Trigger context to serialize
+* Serialize start-call context to a deterministic cache input.
+* @param context - Start-call context to serialize
 * @returns Deterministic string, or an empty string when context is absent
 */
-function serializeTriggerContext(context) {
+function serializeStartContext(context) {
 	if (!context) return "";
 	const modules = [...context.modules].toSorted(([a], [b]) => a.localeCompare(b)).map(([file, bindings]) => [
 		file,
@@ -2969,12 +1842,23 @@ function serializeTriggerContext(context) {
 }
 
 //#endregion
-//#region src/cli/services/workflow/trigger-transformer.ts
-const NORMALIZER_IDENTIFIER = "__tailor_normalizeTriggerOptions";
+//#region src/cli/services/workflow/start-transformer.ts
+const START_CALL_RE = /\.start(?:\s|\/\*[\s\S]*?\*\/|\/\/[^\n]*\n)*\(/;
+/**
+* Fast pre-check for whether `code` contains a `.start(` call, tolerating
+* whitespace, newlines, and comments between `.start` and `(` that a plain
+* substring check would miss.
+* @param code - Source text to scan
+* @returns Whether `code` contains a `.start(` call
+*/
+function hasStartCall(code) {
+	return START_CALL_RE.test(code);
+}
+const NORMALIZER_IDENTIFIER = "__tailor_normalizeStartOptions";
 /**
 * Build the source text of the injected normalizer helper.
 *
-* Renames an `invoker` in the trigger options to the `authInvoker` form the
+* Renames an `invoker` in the start options to the `authInvoker` form the
 * platform RPC expects: a plain string (machine user name) becomes
 * `{ namespace, machineUserName }`, while an object form passes through
 * as-is. Any other options value is unchanged. The auth namespace is baked
@@ -3102,42 +1986,42 @@ function collectLocalTargets(program, context, currentFilePath) {
 	}
 	return targets;
 }
-function detectTriggerCallsWithTargets(program, sourceText, targets) {
+function detectStartCallsWithTargets(program, sourceText, targets) {
 	const calls = [];
 	walkBindingAware(program, new Set(targets.keys()), (node, shadowedNames) => {
-		const triggerCall = getTriggerCallInfo(node, sourceText);
-		if (!triggerCall || shadowedNames.has(triggerCall.identifierName)) return;
-		const target = targets.get(triggerCall.identifierName);
+		const startCall = getStartCallInfo(node, sourceText);
+		if (!startCall || shadowedNames.has(startCall.identifierName)) return;
+		const target = targets.get(startCall.identifierName);
 		if (target) calls.push({
-			...triggerCall,
+			...startCall,
 			kind: target.kind,
 			targetName: target.name
 		});
 	});
 	return calls;
 }
-function detectResolvedTriggerCalls(program, sourceText, context, currentFilePath) {
-	return detectTriggerCallsWithTargets(program, sourceText, collectLocalTargets(program, context, currentFilePath));
+function detectResolvedStartCalls(program, sourceText, context, currentFilePath) {
+	return detectStartCallsWithTargets(program, sourceText, collectLocalTargets(program, context, currentFilePath));
 }
-function transformFunctionTriggers(source, triggerContext, currentFilePath) {
+function transformStartCalls(source, startContext, currentFilePath) {
 	const { program } = parseSync("input.ts", source);
-	const localTargets = collectLocalTargets(program, triggerContext, currentFilePath);
-	const { authNamespace } = triggerContext;
-	const allTriggerCalls = detectTriggerCallsWithTargets(program, source, localTargets);
-	const nestedTriggerCalls = [];
-	const triggerCalls = allTriggerCalls.filter((call) => {
-		const parent = allTriggerCalls.find((other) => other !== call && other.callRange.start <= call.callRange.start && call.callRange.end <= other.callRange.end);
+	const localTargets = collectLocalTargets(program, startContext, currentFilePath);
+	const { authNamespace } = startContext;
+	const allStartCalls = detectStartCallsWithTargets(program, source, localTargets);
+	const nestedStartCalls = [];
+	const startCalls = allStartCalls.filter((call) => {
+		const parent = allStartCalls.find((other) => other !== call && other.callRange.start <= call.callRange.start && call.callRange.end <= other.callRange.end);
 		if (!parent) return true;
-		nestedTriggerCalls.push({
+		nestedStartCalls.push({
 			call,
 			parent
 		});
 		return false;
 	});
-	for (const { call, parent } of nestedTriggerCalls) logger.warn(`Nested trigger call "${call.identifierName}.trigger(...)" inside "${parent.identifierName}.trigger(...)" cannot be converted. Move it to a separate statement and pass the result instead.`);
+	for (const { call, parent } of nestedStartCalls) logger.warn(`Nested start call "${call.identifierName}.start(...)" inside "${parent.identifierName}.start(...)" cannot be converted. Move it to a separate statement and pass the result instead.`);
 	const replacements = [];
 	let needsNormalizerHelper = false;
-	for (const call of triggerCalls) {
+	for (const call of startCalls) {
 		let transformedCall;
 		if (call.kind === "workflow") {
 			let optionsPart = "";
@@ -3145,10 +2029,10 @@ function transformFunctionTriggers(source, triggerContext, currentFilePath) {
 				optionsPart = `, ${NORMALIZER_IDENTIFIER}(${call.optionsText})`;
 				needsNormalizerHelper = true;
 			} else optionsPart = `, ${call.optionsText}`;
-			transformedCall = `tailor.workflow.triggerWorkflow(${JSON.stringify(call.targetName)}, ${call.argsText || "undefined"}${optionsPart})`;
+			transformedCall = `tailor.workflow.startWorkflow(${JSON.stringify(call.targetName)}, ${call.argsText || "undefined"}${optionsPart})`;
 		} else {
 			const optionsPart = call.optionsText !== void 0 ? `, ${call.optionsText}` : "";
-			transformedCall = `tailor.workflow.triggerJobFunction(${JSON.stringify(call.targetName)}, ${call.argsText || "undefined"}${optionsPart})`;
+			transformedCall = `tailor.workflow.startJobFunction(${JSON.stringify(call.targetName)}, ${call.argsText || "undefined"}${optionsPart})`;
 		}
 		replacements.push({
 			start: call.callRange.start,
@@ -3159,15 +2043,15 @@ function transformFunctionTriggers(source, triggerContext, currentFilePath) {
 	const transformed = applyReplacements(source, replacements);
 	return needsNormalizerHelper && authNamespace ? buildNormalizerHelperSource(authNamespace) + transformed : transformed;
 }
-function createTriggerTransformPlugin(triggerContext) {
-	if (!triggerContext) return void 0;
+function createStartTransformPlugin(startContext) {
+	if (!startContext) return void 0;
 	return {
-		name: "trigger-transform",
+		name: "start-transform",
 		transform: {
 			filter: { id: { include: [/\.(ts|mts|cts|js|mjs|cjs)$/] } },
 			handler(code, id) {
-				if (!code.includes(".trigger(")) return null;
-				return { code: transformFunctionTriggers(code, triggerContext, id) };
+				if (!hasStartCall(code)) return null;
+				return { code: transformStartCalls(code, startContext, id) };
 			}
 		}
 	};
@@ -3264,34 +2148,77 @@ const platformBundleDefinePlugin = {
 	}
 };
 
+//#endregion
+//#region src/cli/shared/resolve-tsconfig.ts
+const warnedBaseDirs = /* @__PURE__ */ new Set();
+/**
+* Resolve the nearest tsconfig.json for baseDir, falling back to the tsconfig
+* resolved from the invocation cwd when baseDir's own ancestry has none.
+* @param baseDir - Directory to resolve the tsconfig against
+* @returns Absolute path to the resolved tsconfig.json, or undefined if none was found
+*/
+async function resolveTSConfigWithFallback(baseDir) {
+	const tsconfig = await tryResolve(baseDir);
+	if (tsconfig || baseDir === process.cwd()) return tsconfig;
+	const fallback = await tryResolve(process.cwd());
+	if (fallback && !warnedBaseDirs.has(baseDir)) {
+		warnedBaseDirs.add(baseDir);
+		logger.warn(`No tsconfig found from "${baseDir}"; falling back to the tsconfig resolved from process.cwd(). Move (or extend) a tsconfig into this config's own directory before v2, when this fallback will be removed.`);
+	}
+	return fallback;
+}
+async function tryResolve(dir) {
+	try {
+		return await resolveTSConfig(dir);
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+//#region src/cli/shared/virtual-entry.ts
+/**
+* Create an in-memory rolldown entry module with a deterministic ID.
+* @param name - Logical entry name
+* @param code - Entry module source
+* @param sourceType - Parser type for the generated module
+* @returns Rolldown input and plugin for loading the entry
+*/
+function createVirtualEntry(name, code, sourceType = "js") {
+	const input = `tailor-sdk-entry:${name}.${sourceType}`;
+	const resolvedId = `\0${input}`;
+	return {
+		input,
+		plugin: {
+			name: "tailor-sdk-virtual-entry",
+			resolveId(source, importer) {
+				return source === input && importer === void 0 ? resolvedId : null;
+			},
+			load(id) {
+				return id === resolvedId ? code : null;
+			}
+		}
+	};
+}
+
 //#endregion
 //#region src/cli/services/auth/bundler.ts
 /**
 * Bundle a single auth hook handler.
 *
 * Follows the same pattern as the executor bundler:
-* 1. Generate an entry file that re-exports the handler as `main`
+* 1. Generate an in-memory entry module that re-exports the handler as `main`
 * 2. Bundle with rolldown + tree-shaking
 * @param options - Bundle options
 * @returns Map of function name to bundled code
 */
 async function bundleAuthHooks(options) {
-	const { configPath, authName, handlerAccessPath, env = {}, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG" } = options;
+	const { configPath, authName, handlerAccessPath, env = {}, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", baseDir } = options;
 	logger.newline();
 	logger.log(`Bundling auth hook for ${styles.info(`"${authName}"`)}`);
-	const outputDir = path.resolve(getDistDir(), "auth-hooks");
-	fs$1.mkdirSync(outputDir, { recursive: true });
-	await removeStaleEntryFiles(outputDir);
-	let tsconfig;
-	try {
-		tsconfig = await resolveTSConfig();
-	} catch {
-		tsconfig = void 0;
-	}
-	const functionName = `auth-hook--${authName}--before-login`;
 	const absoluteConfigPath = path.resolve(configPath);
-	const serializedTriggerContext = serializeTriggerContext(triggerContext);
-	const sortedEnvPrefix = JSON.stringify(Object.fromEntries(Object.entries(env).toSorted(([a], [b]) => a.localeCompare(b))));
+	const tsconfig = await resolveTSConfigWithFallback(baseDir);
+	const functionName = `auth-hook--${authName}--before-login`;
 	const code = await withCache({
 		cache,
 		kind: "auth-hook",
@@ -3299,14 +2226,13 @@ async function bundleAuthHooks(options) {
 		sourceFile: absoluteConfigPath,
 		contextHash: computeBundlerContextHash({
 			sourceFile: absoluteConfigPath,
-			serializedTriggerContext,
+			extraContext: serializeStartContext(startContext),
 			tsconfig,
 			inlineSourcemap,
 			bundleLogLevel,
-			prefix: sortedEnvPrefix
+			prefix: JSON.stringify(Object.fromEntries(Object.entries(env).toSorted(([a], [b]) => a.localeCompare(b))))
 		}),
 		async build(cachePlugins) {
-			const entryPath = path.join(outputDir, `${functionName}.entry.js`);
 			const entryContent = multiline`
         import _config from "${absoluteConfigPath}";
         const __auth_hook_function = _config.${handlerAccessPath};
@@ -3315,12 +2241,13 @@ async function bundleAuthHooks(options) {
           return await __auth_hook_function({ ...args, env });
         }
       `;
-			fs$1.writeFileSync(entryPath, entryContent);
-			const triggerPlugin = createTriggerTransformPlugin(triggerContext);
-			const plugins = triggerPlugin ? [triggerPlugin] : [];
+			const entry = createVirtualEntry(`auth-hook:${functionName}`, entryContent);
+			const startPlugin = createStartTransformPlugin(startContext);
+			const plugins = [entry.plugin];
+			if (startPlugin) plugins.push(startPlugin);
 			plugins.push(platformBundleDefinePlugin, ...cachePlugins);
 			return (await rolldown.build({
-				input: entryPath,
+				input: entry.input,
 				write: false,
 				output: {
 					format: "esm",
@@ -3685,6 +2612,36 @@ function findOmittedPermitRules(rawPermissions) {
 	});
 	return locations;
 }
+/**
+* Check whether GraphQL exposure is fully disabled for a type, given its
+* effective gqlOperations (the type's own setting, falling back to the
+* TailorDB namespace default). `undefined` means the default of all
+* operations enabled, so it is never considered fully disabled.
+* @param gqlOperations - Effective, normalized gqlOperations configuration
+* @returns Whether create, update, delete, and read are all explicitly disabled
+*/
+function isGqlOperationsFullyDisabled(gqlOperations) {
+	if (!gqlOperations) return false;
+	return gqlOperations.create === false && gqlOperations.update === false && gqlOperations.delete === false && gqlOperations.read === false;
+}
+/**
+* Find missing permission configuration for a TailorDB type.
+*
+* Record-level permission is always required: TailorDB denies all record
+* operations for a type without it, regardless of whether the type is
+* exposed via GraphQL. GraphQL permission is required whenever GraphQL
+* exposure is enabled for the type (the default, unless every operation is
+* explicitly disabled via `gqlOperations`).
+* @param rawPermissions - Raw permissions definition for the type
+* @param effectiveGqlOperations - The type's own gqlOperations, falling back to the namespace default
+* @returns Which permission configuration, if any, is missing
+*/
+function findMissingPermissionConfig(rawPermissions, effectiveGqlOperations) {
+	return {
+		missingPermission: !rawPermissions.record,
+		missingGqlPermission: !rawPermissions.gql && !isGqlOperationsFullyDisabled(effectiveGqlOperations)
+	};
+}
 
 //#endregion
 //#region src/parser/service/tailordb/type-parser.ts
@@ -4221,7 +3178,7 @@ function buildMinimalEntryFromResolved(imports, declarations, fnSource, sourceFi
 	].join("\n");
 }
 async function bundleScriptTarget(args) {
-	const { fn, kind, sourceFilePath, sourceBindings, tempDir, targetIndex, tsconfig } = args;
+	const { fn, kind, sourceFilePath, sourceBindings, typeName, targetIndex, tsconfig } = args;
 	const context = `${kind} in ${sourceFilePath}`;
 	const fnSource = stringifyFunction(fn);
 	if ((kind === "typeValidate" || kind === "validate") && fn.constructor.name === "AsyncFunction") throw new Error(`${context} must be synchronous — the generated validator runs synchronously, so issues reported after an await are silently lost. Remove the async keyword.`);
@@ -4233,11 +3190,10 @@ async function bundleScriptTarget(args) {
 	if (unresolved.length > 0) throw new Error(`${context} captures unresolvable variables (${unresolved.join(", ")}). Hooks and validators must not reference variables that cannot be resolved from the source file.
   ${kind}: ${fnSource}`);
 	const entryContent = buildMinimalEntryFromResolved(imports, declarations, fnSource, sourceFilePath, kind === "typeValidate");
-	const entryPath = join(tempDir, `tailordb-script-${targetIndex}.entry.ts`);
-	writeFileSync(entryPath, entryContent);
+	const entry = createVirtualEntry(`tailordb-script:${typeName}:${targetIndex}`, entryContent, "ts");
 	const bundledCode = (await rolldown.build({
-		plugins: [platformBundleDefinePlugin],
-		input: entryPath,
+		plugins: [entry.plugin, platformBundleDefinePlugin],
+		input: entry.input,
 		write: false,
 		output: {
 			format: "cjs",
@@ -4267,27 +3223,18 @@ async function precompileTailorDBTypeScripts(type, sourceFilePath, tsconfig) {
 	const targets = collectScriptTargets(type);
 	if (targets.length === 0) return;
 	const sourceBindings = collectSourceBindings(sourceFilePath);
-	const tempDir = resolve(getDistDir(), "hooks-validate-scripts", type.name);
-	mkdirSync(tempDir, { recursive: true });
-	try {
-		const results = await Promise.allSettled(targets.map((target, index) => bundleScriptTarget({
-			fn: target.fn,
-			kind: target.kind,
-			sourceFilePath,
-			sourceBindings,
-			tempDir,
-			targetIndex: index,
-			tsconfig
-		})));
-		const firstError = results.find((r) => r.status === "rejected");
-		if (firstError) throw firstError.reason;
-		for (const [index, result] of results.entries()) if (result.status === "fulfilled") setPrecompiledScriptExpr(assertDefined(targets[index], `bundle target at index ${index} missing`).fn, result.value);
-	} finally {
-		rmSync(tempDir, {
-			recursive: true,
-			force: true
-		});
-	}
+	const results = await Promise.allSettled(targets.map((target, index) => bundleScriptTarget({
+		fn: target.fn,
+		kind: target.kind,
+		sourceFilePath,
+		sourceBindings,
+		typeName: type.name,
+		targetIndex: index,
+		tsconfig
+	})));
+	const firstError = results.find((r) => r.status === "rejected");
+	if (firstError) throw firstError.reason;
+	for (const [index, result] of results.entries()) if (result.status === "fulfilled") setPrecompiledScriptExpr(assertDefined(targets[index], `bundle target at index ${index} missing`).fn, result.value);
 }
 
 //#endregion
@@ -4417,7 +3364,7 @@ function formatTailorDBTypeNameSource(source) {
 * @returns A new TailorDBService instance
 */
 function createTailorDBService(params) {
-	const { namespace, config, pluginManager } = params;
+	const { namespace, config, pluginManager, baseDir } = params;
 	const createRawTypesByName = () => Object.create(null);
 	const rawTypes = Object.create(null);
 	let types = {};
@@ -4445,6 +3392,19 @@ function createTailorDBService(params) {
 			if (locations.length > 0) logger.warn(`TailorDB type "${typeName}" has permission rule(s) ${locations.join(", ")} in object form without an explicit "permit"; they default to "deny". Set permit: true (allow) or permit: false (deny) to silence this warning.`);
 		}
 	};
+	const validateRequiredPermissions = () => {
+		const errors = [];
+		for (const fileTypes of Object.values(rawTypes)) for (const [typeName, type] of Object.entries(fileTypes)) {
+			const effectiveGqlOperations = type.metadata.settings?.gqlOperations ?? config.gqlOperations;
+			const { missingPermission, missingGqlPermission } = findMissingPermissionConfig(type.metadata.permissions, effectiveGqlOperations);
+			if (!missingPermission && !missingGqlPermission) continue;
+			const source = formatTailorDBTypeSourceInfo(typeSourceInfo[typeName]);
+			const location = source ? ` (${source})` : "";
+			if (missingPermission) errors.push(`TailorDB type "${typeName}"${location} has no .permission() configured. TailorDB denies all record operations for types without permission; call .permission(...) to grant access explicitly.`);
+			if (missingGqlPermission) errors.push(`TailorDB type "${typeName}"${location} has no .gqlPermission() configured, but GraphQL operations are enabled for it. Call .gqlPermission(...) to grant GraphQL access explicitly, or disable GraphQL exposure with .features({ gqlOperations: { create: false, update: false, delete: false, read: false } }).`);
+		}
+		if (errors.length > 0) throw new Error(`TailorDB permission configuration errors in service "${namespace}":\n${errors.map((e) => `  - ${e}`).join("\n")}`);
+	};
 	/**
 	* Process plugins for a type and add generated types to rawTypes
 	* @param rawType - The raw TailorDB type being processed
@@ -4524,19 +3484,15 @@ function createTailorDBService(params) {
 		loadTypes: async () => {
 			if (!loadPromise) loadPromise = (async () => {
 				if (config.files.length === 0) return;
-				const typeFiles = [...new Set(loadFilesWithIgnores(config))];
-				let tsconfig;
-				try {
-					tsconfig = await resolveTSConfig();
-				} catch {
-					tsconfig = void 0;
-				}
+				const typeFiles = [...new Set(loadFilesWithIgnores(config, baseDir))];
+				const tsconfig = await resolveTSConfigWithFallback(baseDir);
 				logger.newline();
 				logger.log(`Found ${styles.highlight(typeFiles.length.toString())} type files for TailorDB service ${styles.highlight(`"${namespace}"`)}`);
 				if (pluginManager) for (const typeFile of typeFiles) await loadTypeFile(typeFile, tsconfig);
 				else await Promise.all(typeFiles.map((typeFile) => loadTypeFile(typeFile, tsconfig)));
 				doParseTypes();
 				warnOmittedPermit();
+				validateRequiredPermissions();
 				return types;
 			})();
 			return loadPromise;
@@ -4578,7 +3534,10 @@ function createTailorDBService(params) {
 				hasGeneratedTypes = true;
 				logger.log(`  Generated: ${styles.success(generatedType.name)} by namespace plugin ${styles.info(pluginId)}`);
 			}
-			if (hasGeneratedTypes || hadPreviousGeneratedTypes) doParseTypes();
+			if (hasGeneratedTypes || hadPreviousGeneratedTypes) {
+				doParseTypes();
+				validateRequiredPermissions();
+			}
 		}
 	};
 }
@@ -4665,9 +3624,31 @@ function resolveBundleConcurrency() {
 * @param worker - Async worker function
 * @returns Worker results in input order
 */
-function withBundleConcurrency(items, worker) {
-	const limit = pLimit(resolveBundleConcurrency());
-	return Promise.all(items.map((item) => limit(() => worker(item))));
+async function withBundleConcurrency(items, worker) {
+	const resultCount = items.length;
+	const workItems = items.flatMap((item, index) => [{
+		index,
+		item
+	}]);
+	const results = [];
+	results.length = resultCount;
+	let nextWorkIndex = 0;
+	let rejection;
+	const runWorker = async () => {
+		while (!rejection) {
+			const workItem = workItems[nextWorkIndex++];
+			if (workItem === void 0) return;
+			try {
+				results[workItem.index] = await worker(workItem.item);
+			} catch (reason) {
+				rejection ??= { reason };
+			}
+		}
+	};
+	const workerCount = Math.min(resolveBundleConcurrency(), workItems.length);
+	await Promise.all(Array.from({ length: workerCount }, runWorker));
+	if (rejection) throw rejection.reason;
+	return results;
 }
 
 //#endregion
@@ -4678,7 +3659,7 @@ function withBundleConcurrency(items, worker) {
 * Two delivery paths:
 * - Apply config: shipped with apply and evaluated by the platform before
 *   invoking user code.
-* - Bundle inline: interpolated into the generated `.entry.js` wrapper and
+* - Bundle inline: interpolated into the generated entry module and
 *   evaluated inside the bundled script at function entry.
 *
 * The principal field mapping (server → SDK) shared across services is built by
@@ -4768,15 +3749,15 @@ function buildResolverOperationHookExpr(env) {
 * Bundle executors from the specified configuration
 *
 * This function:
-* 1. Creates entry file that extracts operation.body
+* 1. Creates an in-memory entry module that extracts operation.body
 * 2. Bundles in a single step with tree-shaking
 * @param options - Bundle executor options
 * @returns Map of executor name to bundled code
 */
 async function bundleExecutors(options) {
 	const bundledCode = /* @__PURE__ */ new Map();
-	const { config, triggerContext, additionalFiles = [], cache, inlineSourcemap, bundleLogLevel = "DEBUG" } = options;
-	const files = [...loadFilesWithIgnores(config), ...additionalFiles];
+	const { config, startContext, additionalFiles = [], cache, inlineSourcemap, bundleLogLevel = "DEBUG", baseDir } = options;
+	const files = [...loadFilesWithIgnores(config, baseDir), ...additionalFiles];
 	if (files.length === 0) {
 		logger.warn(`No executor files found for patterns: ${config.files.join(", ")}`);
 		return bundledCode;
@@ -4803,25 +3784,17 @@ async function bundleExecutors(options) {
 		logger.debug("  No function executors to bundle");
 		return bundledCode;
 	}
-	const outputDir = path.resolve(getDistDir(), "executors");
-	fs$1.mkdirSync(outputDir, { recursive: true });
-	await removeStaleEntryFiles(outputDir);
-	let tsconfig;
-	try {
-		tsconfig = await resolveTSConfig();
-	} catch {
-		tsconfig = void 0;
-	}
-	const results = await withBundleConcurrency(executors, (executor) => bundleSingleExecutor(executor, outputDir, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel));
+	const tsconfig = await resolveTSConfigWithFallback(baseDir);
+	const results = await withBundleConcurrency(executors, (executor) => bundleSingleExecutor(executor, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel));
 	for (const [name, code] of results) bundledCode.set(name, code);
 	logger.log(`${styles.success("Bundled")} ${styles.info("\"executor\"")}`);
 	return bundledCode;
 }
-async function bundleSingleExecutor(executor, outputDir, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
-	const serializedTriggerContext = serializeTriggerContext(triggerContext);
+async function bundleSingleExecutor(executor, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+	const serializedStartContext = serializeStartContext(startContext);
 	const contextHash = computeBundlerContextHash({
 		sourceFile: executor.sourceFile,
-		serializedTriggerContext,
+		extraContext: serializedStartContext,
 		tsconfig,
 		inlineSourcemap,
 		bundleLogLevel
@@ -4833,7 +3806,6 @@ async function bundleSingleExecutor(executor, outputDir, tsconfig, triggerContex
 		sourceFile: executor.sourceFile,
 		contextHash,
 		async build(cachePlugins) {
-			const entryPath = path.join(outputDir, `${executor.name}.entry.js`);
 			const entryContent = multiline`
         import _internalExecutor from "${path.resolve(executor.sourceFile)}";
 
@@ -4844,12 +3816,13 @@ async function bundleSingleExecutor(executor, outputDir, tsconfig, triggerContex
 
         export { __executor_function as main };
       `;
-			fs$1.writeFileSync(entryPath, entryContent);
-			const triggerPlugin = createTriggerTransformPlugin(triggerContext);
-			const plugins = triggerPlugin ? [triggerPlugin] : [];
+			const entry = createVirtualEntry(`executor:${executor.name}`, entryContent);
+			const startPlugin = createStartTransformPlugin(startContext);
+			const plugins = [entry.plugin];
+			if (startPlugin) plugins.push(startPlugin);
 			plugins.push(platformBundleDefinePlugin, ...cachePlugins);
 			return (await rolldown.build({
-				input: entryPath,
+				input: entry.input,
 				write: false,
 				output: {
 					format: "esm",
@@ -4921,31 +3894,25 @@ const GRAPHQL_WEB_MODULE = createRequire(import.meta.url).resolve("@0no-co/graph
 * IIFE defining a global `transform(input)` entry point. `input` gets a
 * generated dispatcher that routes by `req.method`; `output` is used as is.
 * @param adapters - Detected adapters to bundle
+* @param baseDir - Directory the owning config's tsconfig is resolved against
 * @param cache - Optional bundle cache for skipping unchanged builds
 * @param bundleLogLevel - Controls which console calls are kept in bundled code
 * @returns Bundled scripts keyed by adapter name
 */
-async function bundleHttpAdapters(adapters, cache, bundleLogLevel = "DEBUG") {
+async function bundleHttpAdapters(adapters, baseDir, cache, bundleLogLevel = "DEBUG") {
 	if (adapters.length === 0) return {
 		bundledInputs: /* @__PURE__ */ new Map(),
 		bundledOutputs: /* @__PURE__ */ new Map()
 	};
 	logger.newline();
 	logger.log(`Bundling ${styles.highlight(adapters.length.toString())} files for ${styles.info("\"http-adapter\"")}`);
-	const outputDir = path.resolve(getDistDir(), "http-adapters");
-	fs$1.mkdirSync(outputDir, { recursive: true });
-	let tsconfig;
-	try {
-		tsconfig = await resolveTSConfig();
-	} catch {
-		tsconfig = void 0;
-	}
+	const tsconfig = await resolveTSConfigWithFallback(baseDir);
 	const results = await withBundleConcurrency(adapters.flatMap((adapter) => {
 		return (adapter.hasOutput ? ["input", "output"] : ["input"]).map((kind) => ({
 			adapter,
 			kind
 		}));
-	}), ({ adapter, kind }) => bundleAdapterScript(adapter, kind, outputDir, tsconfig, cache, bundleLogLevel));
+	}), ({ adapter, kind }) => bundleAdapterScript(adapter, kind, tsconfig, cache, bundleLogLevel));
 	const bundledInputs = /* @__PURE__ */ new Map();
 	const bundledOutputs = /* @__PURE__ */ new Map();
 	for (const [name, kind, code] of results) if (kind === "input") bundledInputs.set(name, code);
@@ -4956,10 +3923,10 @@ async function bundleHttpAdapters(adapters, cache, bundleLogLevel = "DEBUG") {
 		bundledOutputs
 	};
 }
-async function bundleAdapterScript(adapter, kind, outputDir, tsconfig, cache, bundleLogLevel = "DEBUG") {
+async function bundleAdapterScript(adapter, kind, tsconfig, cache, bundleLogLevel = "DEBUG") {
 	const contextHash = computeBundlerContextHash({
 		sourceFile: adapter.sourceFile,
-		serializedTriggerContext: kind === "input" ? adapter.methods.join(",") : "",
+		extraContext: kind === "input" ? adapter.methods.join(",") : "",
 		tsconfig,
 		inlineSourcemap: false,
 		bundleLogLevel,
@@ -4972,9 +3939,11 @@ async function bundleAdapterScript(adapter, kind, outputDir, tsconfig, cache, bu
 		sourceFile: adapter.sourceFile,
 		contextHash,
 		async build(cachePlugins) {
-			const entryPath = path.join(outputDir, `${adapter.name}.${kind}.entry.js`);
 			const absoluteSourcePath = path.resolve(adapter.sourceFile);
+			const entryContent = kind === "input" ? buildInputEntry(absoluteSourcePath, adapter.methods, GRAPHQL_WEB_MODULE) : buildOutputEntry(absoluteSourcePath);
+			const entry = createVirtualEntry(`http-adapter:${adapter.name}:${kind}`, entryContent);
 			const plugins = [
+				entry.plugin,
 				{
 					name: "http-adapter-reject-node-imports",
 					resolveId(source) {
@@ -4998,30 +3967,21 @@ async function bundleAdapterScript(adapter, kind, outputDir, tsconfig, cache, bu
 				},
 				...cachePlugins
 			];
-			let bundled;
-			try {
-				const entryContent = kind === "input" ? buildInputEntry(absoluteSourcePath, adapter.methods, GRAPHQL_WEB_MODULE) : buildOutputEntry(absoluteSourcePath);
-				fs$1.writeFileSync(entryPath, entryContent);
-				bundled = (await rolldown.build({
-					input: entryPath,
-					write: false,
-					output: {
-						format: "iife",
-						sourcemap: false,
-						minify: true,
-						codeSplitting: false
-					},
-					tsconfig,
-					plugins,
-					transform: { target: "es2017" },
-					treeshake: composeFunctionTreeshakeOptions([createLogLevelTreeshakeOptions(bundleLogLevel)]),
-					logLevel: "silent"
-				})).output[0].code;
-			} finally {
-				try {
-					fs$1.rmSync(entryPath, { force: true });
-				} catch {}
-			}
+			const bundled = (await rolldown.build({
+				input: entry.input,
+				write: false,
+				output: {
+					format: "iife",
+					sourcemap: false,
+					minify: true,
+					codeSplitting: false
+				},
+				tsconfig,
+				plugins,
+				transform: { target: "es2017" },
+				treeshake: composeFunctionTreeshakeOptions([createLogLevelTreeshakeOptions(bundleLogLevel)]),
+				logLevel: "silent"
+			})).output[0].code;
 			const byteLength = Buffer.byteLength(bundled, "utf8");
 			if (byteLength > ADAPTER_BUNDLE_ERROR_BYTES) throw new Error(`HTTP adapter "${adapter.name}" ${kind} script is ${byteLength} bytes, exceeding the ${ADAPTER_BUNDLE_ERROR_BYTES} byte limit`);
 			if (byteLength > ADAPTER_BUNDLE_WARN_BYTES) logger.warn(`HTTP adapter "${adapter.name}" ${kind} script is ${byteLength} bytes, larger than the recommended ${ADAPTER_BUNDLE_WARN_BYTES} byte limit`);
@@ -5095,7 +4055,7 @@ function rejectAsyncInBundle(code, adapterName, kind) {
 //#endregion
 //#region src/cli/services/http-adapter/service.ts
 function createHttpAdapterService(params) {
-	const { config } = params;
+	const { config, baseDir } = params;
 	let adapters = [];
 	let fileCount = 0;
 	let loaded = false;
@@ -5109,7 +4069,7 @@ function createHttpAdapterService(params) {
 		},
 		loadAdapters: async () => {
 			if (loaded) return;
-			const result = await loadAdapterFiles(config);
+			const result = await loadAdapterFiles(config, baseDir);
 			adapters = result.adapters;
 			fileCount = result.fileCount;
 			loaded = true;
@@ -5125,12 +4085,12 @@ function createHttpAdapterService(params) {
 		}
 	};
 }
-async function loadAdapterFiles(config) {
+async function loadAdapterFiles(config, baseDir) {
 	if (config.files.length === 0) return {
 		adapters: [],
 		fileCount: 0
 	};
-	const files = loadFilesWithIgnores(config);
+	const files = loadFilesWithIgnores(config, baseDir);
 	const loadResults = await Promise.all(files.map(loadAdapterFromFile));
 	const adapters = [];
 	const seenNames = /* @__PURE__ */ new Map();
@@ -5220,19 +4180,20 @@ async function loadResolver(resolverFilePath) {
 *
 * This function:
 * 1. Uses a transform plugin to add validation wrapper during bundling
-* 2. Creates entry file
+* 2. Creates an in-memory entry module
 * 3. Bundles in a single step with tree-shaking
 * @param namespace - Resolver namespace name
 * @param config - Resolver file loading configuration
-* @param triggerContext - Trigger context for workflow/job transformations
+* @param baseDir - Directory the config's file patterns are resolved against
+* @param startContext - Start context for workflow/job transformations
 * @param cache - Optional bundle cache for skipping unchanged builds
 * @param inlineSourcemap - Whether to enable inline sourcemaps
 * @param bundleLogLevel - Controls which console calls are kept in bundled code
 * @returns Map of resolver name to bundled code
 */
-async function bundleResolvers(namespace, config, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+async function bundleResolvers(namespace, config, baseDir, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
 	const bundledCode = /* @__PURE__ */ new Map();
-	const files = loadFilesWithIgnores(config);
+	const files = loadFilesWithIgnores(config, baseDir);
 	if (files.length === 0) {
 		logger.warn(`No resolver files found for patterns: ${config.files.join(", ")}`);
 		return bundledCode;
@@ -5251,25 +4212,17 @@ async function bundleResolvers(namespace, config, triggerContext, cache, inlineS
 			sourceFile: file
 		});
 	}
-	const outputDir = path.resolve(getDistDir(), "resolvers");
-	fs$1.mkdirSync(outputDir, { recursive: true });
-	await removeStaleEntryFiles(outputDir);
-	let tsconfig;
-	try {
-		tsconfig = await resolveTSConfig();
-	} catch {
-		tsconfig = void 0;
-	}
-	const results = await withBundleConcurrency(resolvers, (resolver) => bundleSingleResolver(namespace, resolver, outputDir, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel));
+	const tsconfig = await resolveTSConfigWithFallback(baseDir);
+	const results = await withBundleConcurrency(resolvers, (resolver) => bundleSingleResolver(namespace, resolver, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel));
 	for (const [name, code] of results) bundledCode.set(name, code);
 	logger.log(`${styles.success("Bundled")} ${styles.info(`"${namespace}"`)}`);
 	return bundledCode;
 }
-async function bundleSingleResolver(namespace, resolver, outputDir, tsconfig, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
-	const serializedTriggerContext = serializeTriggerContext(triggerContext);
+async function bundleSingleResolver(namespace, resolver, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+	const serializedStartContext = serializeStartContext(startContext);
 	const contextHash = computeBundlerContextHash({
 		sourceFile: resolver.sourceFile,
-		serializedTriggerContext,
+		extraContext: serializedStartContext,
 		tsconfig,
 		inlineSourcemap,
 		bundleLogLevel
@@ -5282,7 +4235,6 @@ async function bundleSingleResolver(namespace, resolver, outputDir, tsconfig, tr
 		sourceFile: resolver.sourceFile,
 		contextHash,
 		async build(cachePlugins) {
-			const entryPath = path.join(outputDir, `${resolver.name}.entry.js`);
 			const entryContent = multiline`
         import _internalResolver from "${path.resolve(resolver.sourceFile)}";
         import { t } from "@tailor-platform/sdk";
@@ -5309,12 +4261,13 @@ async function bundleSingleResolver(namespace, resolver, outputDir, tsconfig, tr
 
         export { $tailor_resolver_body as main };
       `;
-			fs$1.writeFileSync(entryPath, entryContent);
-			const triggerPlugin = createTriggerTransformPlugin(triggerContext);
-			const plugins = triggerPlugin ? [triggerPlugin] : [];
+			const entry = createVirtualEntry(`resolver:${resolver.name}`, entryContent);
+			const startPlugin = createStartTransformPlugin(startContext);
+			const plugins = [entry.plugin];
+			if (startPlugin) plugins.push(startPlugin);
 			plugins.push(platformBundleDefinePlugin, ...cachePlugins);
 			return (await rolldown.build({
-				input: entryPath,
+				input: entry.input,
 				write: false,
 				output: {
 					format: "esm",
@@ -5338,9 +4291,10 @@ async function bundleSingleResolver(namespace, resolver, outputDir, tsconfig, tr
 * Creates a new ResolverService instance.
 * @param namespace - The namespace for this resolver service
 * @param config - The resolver service configuration
+* @param baseDir - Directory the config's file patterns are resolved against
 * @returns A new ResolverService instance
 */
-function createResolverService(namespace, config) {
+function createResolverService(namespace, config, baseDir) {
 	const resolvers = {};
 	const loadResolverForFile = async (resolverFile) => {
 		try {
@@ -5369,7 +4323,7 @@ function createResolverService(namespace, config) {
 		loadResolvers: async () => {
 			if (Object.keys(resolvers).length > 0) return;
 			if (config.files.length === 0) return;
-			const resolverFiles = loadFilesWithIgnores(config);
+			const resolverFiles = loadFilesWithIgnores(config, baseDir);
 			logger.log(`Found ${styles.highlight(resolverFiles.length.toString())} resolver files for service ${styles.highlight(`"${namespace}"`)}`);
 			await Promise.all(resolverFiles.map((resolverFile) => loadResolverForFile(resolverFile)));
 			assertUniqueResolverNames(resolvers, namespace);
@@ -5502,7 +4456,7 @@ function transformWorkflowSource(source, targetJobName, targetJobExportName, oth
 function safeRealpath(p) {
 	const resolved = path.resolve(p);
 	try {
-		return fs$1.realpathSync(resolved);
+		return fs.realpathSync(resolved);
 	} catch (e) {
 		logger.debug(`realpathSync failed for ${resolved}: ${e instanceof Error ? e.message : e}`);
 		return resolved;
@@ -5513,20 +4467,21 @@ function safeRealpath(p) {
 *
 * This function:
 * 1. Detects which jobs are actually used (mainJobs + their dependencies)
-* 2. Uses a transform plugin to transform trigger calls during bundling
-* 3. Creates entry file and bundles with tree-shaking
+* 2. Uses a transform plugin to transform start calls during bundling
+* 3. Creates an in-memory entry module and bundles with tree-shaking
 *
 * Returns metadata about which jobs each workflow uses.
 * @param allJobs - All available job infos
 * @param mainJobNames - Names of main jobs
 * @param env - Environment variables to inject
-* @param triggerContext - Trigger context for transformations
+* @param startContext - Start context for transformations
+* @param baseDir - Directory the owning config's tsconfig is resolved against
 * @param cache - Optional bundle cache for skipping unchanged builds
 * @param inlineSourcemap - Whether to enable inline sourcemaps
 * @param bundleLogLevel - Controls which console calls are kept in bundled code
 * @returns Workflow job bundling result
 */
-async function bundleWorkflowJobs(allJobs, mainJobNames, env = {}, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+async function bundleWorkflowJobs(allJobs, mainJobNames, env = {}, startContext, baseDir, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
 	if (allJobs.length === 0) {
 		logger.warn("No workflow jobs to bundle");
 		return {
@@ -5535,22 +4490,11 @@ async function bundleWorkflowJobs(allJobs, mainJobNames, env = {}, triggerContex
 			bundledCode: /* @__PURE__ */ new Map()
 		};
 	}
-	const { usedJobs, mainJobDeps } = await filterUsedJobs(allJobs, mainJobNames, triggerContext);
+	const { usedJobs, mainJobDeps } = await filterUsedJobs(allJobs, mainJobNames, startContext);
 	logger.newline();
 	logger.log(`Bundling ${styles.highlight(usedJobs.length.toString())} files for ${styles.info("\"workflow-job\"")}`);
-	const outputDir = path.resolve(getDistDir(), "workflow-jobs");
-	fs$1.mkdirSync(outputDir, { recursive: true });
-	const currentJobNames = new Set(usedJobs.map((j) => j.name));
-	const existingFiles = fs$1.readdirSync(outputDir);
-	for (const file of existingFiles) if (file.endsWith(".js") && !currentJobNames.has(path.basename(file, ".js"))) fs$1.rmSync(path.join(outputDir, file), { force: true });
-	else if (file.endsWith(".js.map") && !currentJobNames.has(path.basename(file, ".js.map"))) fs$1.rmSync(path.join(outputDir, file), { force: true });
-	let tsconfig;
-	try {
-		tsconfig = await resolveTSConfig();
-	} catch {
-		tsconfig = void 0;
-	}
-	const results = await withBundleConcurrency(usedJobs, (job) => bundleSingleJob(job, usedJobs, outputDir, tsconfig, env, triggerContext, cache, inlineSourcemap, bundleLogLevel));
+	const tsconfig = await resolveTSConfigWithFallback(baseDir);
+	const results = await withBundleConcurrency(usedJobs, (job) => bundleSingleJob(job, usedJobs, tsconfig, env, startContext, cache, inlineSourcemap, bundleLogLevel));
 	const bundledCode = /* @__PURE__ */ new Map();
 	for (const [name, code] of results) bundledCode.set(name, code);
 	logger.log(`${styles.success("Bundled")} ${styles.info("\"workflow-job\"")}`);
@@ -5564,15 +4508,15 @@ async function bundleWorkflowJobs(allJobs, mainJobNames, env = {}, triggerContex
 * Filter jobs to only include those that are actually used.
 * A job is "used" if:
 * - It's a mainJob of a workflow
-* - It's called via .trigger() from another used job (transitively)
+* - It's called via .start() from another used job (transitively)
 *
 * Also returns a map of mainJob -> all jobs it depends on (for metadata).
 * @param allJobs - All available job infos
 * @param mainJobNames - Names of main jobs
-* @param triggerContext - Module binding metadata for resolving trigger targets
+* @param startContext - Module binding metadata for resolving start targets
 * @returns Used jobs and main job dependency map
 */
-async function filterUsedJobs(allJobs, mainJobNames, triggerContext) {
+async function filterUsedJobs(allJobs, mainJobNames, startContext) {
 	if (allJobs.length === 0 || mainJobNames.length === 0) return {
 		usedJobs: [],
 		mainJobDeps: {}
@@ -5586,16 +4530,16 @@ async function filterUsedJobs(allJobs, mainJobNames, triggerContext) {
 	const dependencies = /* @__PURE__ */ new Map();
 	const fileResults = await Promise.all(Array.from(jobsBySourceFile.entries()).map(async ([sourceFile, jobs]) => {
 		try {
-			const source = await fs$1.promises.readFile(sourceFile, "utf-8");
+			const source = await fs.promises.readFile(sourceFile, "utf-8");
 			const { program } = parseSync("input.ts", source);
 			const detectedJobs = findAllJobs(program, source);
-			const triggerCalls = detectResolvedTriggerCalls(program, source, triggerContext, sourceFile);
+			const startCalls = detectResolvedStartCalls(program, source, startContext, sourceFile);
 			const jobDependencies = [];
 			for (const job of jobs) {
 				const detectedJob = detectedJobs.find((d) => d.name === job.name);
 				if (!detectedJob) continue;
 				const jobDeps = /* @__PURE__ */ new Set();
-				for (const call of triggerCalls) if (call.kind === "job" && call.callRange.start >= detectedJob.bodyValueRange.start && call.callRange.end <= detectedJob.bodyValueRange.end) jobDeps.add(call.targetName);
+				for (const call of startCalls) if (call.kind === "job" && call.callRange.start >= detectedJob.bodyValueRange.start && call.callRange.end <= detectedJob.bodyValueRange.end) jobDeps.add(call.targetName);
 				if (jobDeps.size > 0) jobDependencies.push({
 					jobName: job.name,
 					deps: jobDeps
@@ -5626,12 +4570,12 @@ async function filterUsedJobs(allJobs, mainJobNames, triggerContext) {
 		mainJobDeps
 	};
 }
-async function bundleSingleJob(job, allJobs, outputDir, tsconfig, env, triggerContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
-	const serializedTriggerContext = serializeTriggerContext(triggerContext);
+async function bundleSingleJob(job, allJobs, tsconfig, env, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+	const serializedStartContext = serializeStartContext(startContext);
 	const sortedEnvPrefix = JSON.stringify(Object.fromEntries(Object.entries(env).toSorted(([a], [b]) => a.localeCompare(b))));
 	const contextHash = computeBundlerContextHash({
 		sourceFile: job.sourceFile,
-		serializedTriggerContext,
+		extraContext: serializedStartContext,
 		tsconfig,
 		inlineSourcemap,
 		bundleLogLevel,
@@ -5644,7 +4588,6 @@ async function bundleSingleJob(job, allJobs, outputDir, tsconfig, env, triggerCo
 		sourceFile: job.sourceFile,
 		contextHash,
 		async build(cachePlugins) {
-			const entryPath = path.join(outputDir, `${job.name}.entry.js`);
 			const absoluteSourcePath = path.resolve(job.sourceFile);
 			const entryContent = multiline`
         import { ${job.exportName} } from "${absoluteSourcePath}";
@@ -5655,19 +4598,20 @@ async function bundleSingleJob(job, allJobs, outputDir, tsconfig, env, triggerCo
           return await ${job.exportName}.body(input, { env, invoker });
         }
       `;
-			fs$1.writeFileSync(entryPath, entryContent);
+			const entry = createVirtualEntry(`workflow-job:${job.name}`, entryContent);
 			const resolvedSourceFile = safeRealpath(job.sourceFile);
 			const otherJobExportNames = allJobs.filter((candidate) => candidate.name !== job.name && safeRealpath(candidate.sourceFile) === resolvedSourceFile).map((j) => j.exportName);
 			const plugins = [
+				entry.plugin,
 				{
 					name: "workflow-transform",
 					transform: {
 						filter: { id: { include: [/\.(ts|mts|cts|js|mjs|cjs)$/] } },
 						handler(code, id) {
-							if (!code.includes("createWorkflowJob") && !code.includes("createWorkflow") && !code.includes(".trigger(")) return null;
+							if (!code.includes("createWorkflowJob") && !code.includes("createWorkflow") && !hasStartCall(code)) return null;
 							let transformed = code;
 							if (safeRealpath(id) === resolvedSourceFile) transformed = transformWorkflowSource(code, job.name, job.exportName, otherJobExportNames);
-							if (transformed.includes(".trigger(")) transformed = transformFunctionTriggers(transformed, triggerContext, id);
+							if (hasStartCall(transformed)) transformed = transformStartCalls(transformed, startContext, id);
 							if (transformed === code) return null;
 							return { code: transformed };
 						}
@@ -5677,7 +4621,7 @@ async function bundleSingleJob(job, allJobs, outputDir, tsconfig, env, triggerCo
 				...cachePlugins
 			];
 			return (await rolldown.build({
-				input: entryPath,
+				input: entry.input,
 				write: false,
 				output: {
 					format: "esm",
@@ -5699,7 +4643,7 @@ async function bundleSingleJob(job, allJobs, outputDir, tsconfig, env, triggerCo
 //#region src/parser/service/workflow/schema.ts
 const WorkflowJobSchema = z.strictObject({
 	name: z.string().describe("Job name (must be unique across the project)"),
-	trigger: functionSchema.describe("Trigger function that initiates the job"),
+	start: functionSchema.describe("Start function that initiates the job"),
 	body: functionSchema.describe("Job implementation function")
 });
 const durationUnits = [
@@ -5736,7 +4680,7 @@ const RetryPolicySchema = z.strictObject({
 });
 const ConcurrencyPolicySchema = z.strictObject({ maxConcurrentExecutions: z.number().int().min(1).max(1e3).describe("Maximum number of concurrent executions (1-1000)") });
 const ExecutionPolicyNameSchema = z.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/, "Invalid execution policy name: must match [a-z0-9-] (3-63 chars; must start and end with [a-z0-9])").describe("Workspace-unique execution policy name embedded in the resource TRN");
-const ExecutionPolicyKeySchema = z.string().regex(/^[a-z0-9][a-z0-9_:.-]{0,62}[a-z0-9*]$/, "Invalid execution policy key: must match [a-z0-9_:.-] (2-64 chars; must start with [a-z0-9] and end with [a-z0-9] or a trailing '*')").describe("Execution policy key passed to triggerJobFunction's executionPolicyKey option");
+const ExecutionPolicyKeySchema = z.string().regex(/^[a-z0-9][a-z0-9_:.-]{0,62}[a-z0-9*]$/, "Invalid execution policy key: must match [a-z0-9_:.-] (2-64 chars; must start with [a-z0-9] and end with [a-z0-9] or a trailing '*')").describe("Execution policy key passed to startJobFunction's executionPolicyKey option");
 const WorkflowJobFunctionExecutionPolicySchema = z.strictObject({
 	name: ExecutionPolicyNameSchema,
 	key: ExecutionPolicyKeySchema,
@@ -5751,9 +4695,9 @@ const WorkflowSchema = z.strictObject({
 
 //#endregion
 //#region src/cli/services/workflow/service.ts
-function stripRuntimeTrigger(workflow) {
-	if (!isSdkBranded(workflow, "workflow") || workflow === null || typeof workflow !== "object" || !("trigger" in workflow)) return workflow;
-	const { trigger: _trigger, ...rest } = workflow;
+function stripRuntimeStart(workflow) {
+	if (!isSdkBranded(workflow, "workflow") || workflow === null || typeof workflow !== "object" || !("start" in workflow)) return workflow;
+	const { start: _start, ...rest } = workflow;
 	return rest;
 }
 /**
@@ -5762,7 +4706,7 @@ function stripRuntimeTrigger(workflow) {
 * @returns A new WorkflowService instance
 */
 function createWorkflowService(params) {
-	const { config } = params;
+	const { config, baseDir } = params;
 	let workflows = {};
 	let workflowSources = [];
 	let jobs = [];
@@ -5784,7 +4728,7 @@ function createWorkflowService(params) {
 		},
 		loadWorkflows: async () => {
 			if (loaded) return;
-			const result = await loadAndCollectJobs(config);
+			const result = await loadAndCollectJobs(config, baseDir);
 			workflows = result.workflows;
 			workflowSources = result.workflowSources;
 			jobs = result.jobs;
@@ -5806,9 +4750,10 @@ function createWorkflowService(params) {
 * Load workflow files and collect all jobs in a single pass.
 * Dependencies are detected at bundle time via AST analysis.
 * @param config - Workflow service configuration
+* @param baseDir - Directory the config's file patterns are resolved against
 * @returns Loaded workflows and collected jobs
 */
-async function loadAndCollectJobs(config) {
+async function loadAndCollectJobs(config, baseDir) {
 	const workflows = {};
 	const workflowSources = [];
 	const collectedJobs = [];
@@ -5818,7 +4763,7 @@ async function loadAndCollectJobs(config) {
 		jobs: collectedJobs,
 		fileCount: 0
 	};
-	const workflowFiles = loadFilesWithIgnores(config);
+	const workflowFiles = loadFilesWithIgnores(config, baseDir);
 	const fileCount = workflowFiles.length;
 	const allJobsMap = /* @__PURE__ */ new Map();
 	const loadResults = await Promise.all(workflowFiles.map(async (workflowFile) => {
@@ -5863,7 +4808,7 @@ async function loadFileContent(filePath) {
 		const module = await import(pathToFileURL(filePath).href);
 		for (const [exportName, exportValue] of Object.entries(module)) {
 			if (exportName === "default") {
-				const workflowResult = WorkflowSchema.safeParse(stripRuntimeTrigger(exportValue));
+				const workflowResult = WorkflowSchema.safeParse(stripRuntimeStart(exportValue));
 				if (workflowResult.success) workflow = workflowResult.data;
 				else if (isSdkBranded(exportValue, ["workflow", "workflow-job"])) throw workflowResult.error;
 				continue;
@@ -6131,7 +5076,7 @@ const StaticWebsiteSchema = z.strictObject({
 
 //#endregion
 //#region src/cli/services/application.ts
-function defineTailorDB(config, pluginManager) {
+function defineTailorDB(config, baseDir, pluginManager) {
 	const tailorDBServices = [];
 	const externalTailorDBNamespaces = [];
 	const subgraphs = [];
@@ -6146,7 +5091,8 @@ function defineTailorDB(config, pluginManager) {
 			const tailorDB = createTailorDBService({
 				namespace,
 				config: TailorDBServiceConfigSchema.parse(serviceConfig),
-				pluginManager
+				pluginManager,
+				baseDir
 			});
 			tailorDBServices.push(tailorDB);
 		}
@@ -6161,7 +5107,7 @@ function defineTailorDB(config, pluginManager) {
 		subgraphs
 	};
 }
-function defineResolver(config) {
+function defineResolver(config, baseDir) {
 	const resolverServices = [];
 	const subgraphs = [];
 	if (!config) return {
@@ -6170,7 +5116,7 @@ function defineResolver(config) {
 	};
 	for (const [namespace, serviceConfig] of Object.entries(config)) {
 		if (!("external" in serviceConfig)) {
-			const resolverService = createResolverService(namespace, serviceConfig);
+			const resolverService = createResolverService(namespace, serviceConfig, baseDir);
 			resolverServices.push(resolverService);
 		}
 		subgraphs.push({
@@ -6232,17 +5178,26 @@ function defineAuth(config, tailorDBServices, externalTailorDBNamespaces) {
 		subgraphs
 	};
 }
-function defineExecutor(config, hasPluginExecutors) {
+function defineExecutor(config, baseDir, hasPluginExecutors) {
 	if (!config && !hasPluginExecutors) return;
-	return createExecutorService({ config: config ?? { files: [] } });
+	return createExecutorService({
+		config: config ?? { files: [] },
+		baseDir
+	});
 }
-function defineWorkflow(config) {
+function defineWorkflow(config, baseDir) {
 	if (!config) return;
-	return createWorkflowService({ config });
+	return createWorkflowService({
+		config,
+		baseDir
+	});
 }
-function defineHttpAdapterService(config) {
+function defineHttpAdapterService(config, baseDir) {
 	if (!config) return;
-	return createHttpAdapterService({ config });
+	return createHttpAdapterService({
+		config,
+		baseDir
+	});
 }
 function stripStaticWebsiteUrlHelper(config) {
 	const configWithUrl = config;
@@ -6294,9 +5249,9 @@ function parseSecretManager(config) {
 		ignoreNullishValues
 	};
 }
-function defineServices(config, pluginManager) {
-	const tailordbResult = defineTailorDB(config.db, pluginManager);
-	const resolverResult = defineResolver(config.resolver);
+function defineServices(config, baseDir, pluginManager) {
+	const tailordbResult = defineTailorDB(config.db, baseDir, pluginManager);
+	const resolverResult = defineResolver(config.resolver, baseDir);
 	const idpResult = defineIdp(config.idp);
 	const authResult = defineAuth(config.auth, tailordbResult.tailorDBServices, tailordbResult.externalTailorDBNamespaces);
 	const staticWebsiteServices = defineStaticWebsites(config.staticWebsites);
@@ -6352,10 +5307,11 @@ function buildApplication(params) {
 */
 function defineApplication(params) {
 	const { config, pluginManager } = params;
-	const services = defineServices(config, pluginManager);
-	const executorService = defineExecutor(config.executor, false);
-	const workflowService = defineWorkflow(config.workflow);
-	const httpAdapterService = defineHttpAdapterService(config.httpAdapter);
+	const baseDir = path.dirname(config.path);
+	const services = defineServices(config, baseDir, pluginManager);
+	const executorService = defineExecutor(config.executor, baseDir, false);
+	const workflowService = defineWorkflow(config.workflow, baseDir);
+	const httpAdapterService = defineHttpAdapterService(config.httpAdapter, baseDir);
 	return buildApplication({
 		config,
 		...services,
@@ -6400,22 +5356,23 @@ function generatePluginFilesIfNeeded(pluginManager, tailorDBServices, configPath
 */
 async function loadApplication(params) {
 	const { config, pluginManager, bundleCache } = params;
-	const { tailordbResult, resolverResult, idpResult, authResult, staticWebsiteServices, aiGatewayServices, secrets, ignoreNullishValues } = defineServices(config, pluginManager);
+	const baseDir = path.dirname(config.path);
+	const { tailordbResult, resolverResult, idpResult, authResult, staticWebsiteServices, aiGatewayServices, secrets, ignoreNullishValues } = defineServices(config, baseDir, pluginManager);
 	for (const tailordb of tailordbResult.tailorDBServices) {
 		await tailordb.loadTypes();
 		await tailordb.processNamespacePlugins();
 	}
 	assertUniqueLocalTailorDBTypeNames({ tailorDBServices: tailordbResult.tailorDBServices });
 	const pluginExecutorFiles = generatePluginFilesIfNeeded(pluginManager, tailordbResult.tailorDBServices, config.path);
-	const executorService = defineExecutor(config.executor, pluginExecutorFiles.length > 0);
-	const workflowService = defineWorkflow(config.workflow);
+	const executorService = defineExecutor(config.executor, baseDir, pluginExecutorFiles.length > 0);
+	const workflowService = defineWorkflow(config.workflow, baseDir);
 	if (workflowService) await workflowService.loadWorkflows();
-	const httpAdapterService = defineHttpAdapterService(config.httpAdapter);
+	const httpAdapterService = defineHttpAdapterService(config.httpAdapter, baseDir);
 	if (httpAdapterService) await httpAdapterService.loadAdapters();
-	const triggerContext = await buildTriggerContext(config.workflow, getApplicationAuthNamespace({
+	const startContext = await buildStartContext(config.workflow, getApplicationAuthNamespace({
 		authService: authResult.authService,
 		config
-	}));
+	}), baseDir);
 	const inlineSourcemap = resolveInlineSourcemap(config.inlineSourcemap);
 	const bundleLogLevel = resolveBundleLogLevel(config.logLevel);
 	const bundledScripts = {
@@ -6425,21 +5382,22 @@ async function loadApplication(params) {
 		authHooks: /* @__PURE__ */ new Map()
 	};
 	for (const pipeline of resolverResult.resolverServices) {
-		const resolverBundles = await bundleResolvers(pipeline.namespace, pipeline.config, triggerContext, bundleCache, inlineSourcemap, bundleLogLevel);
+		const resolverBundles = await bundleResolvers(pipeline.namespace, pipeline.config, baseDir, startContext, bundleCache, inlineSourcemap, bundleLogLevel);
 		for (const [name, code] of resolverBundles) bundledScripts.resolvers.set(resolverBundleKey(pipeline.namespace, name), code);
 	}
 	if (executorService) bundledScripts.executors = await bundleExecutors({
 		config: executorService.config,
-		triggerContext,
+		startContext,
 		additionalFiles: [...pluginExecutorFiles],
 		cache: bundleCache,
 		inlineSourcemap,
-		bundleLogLevel
+		bundleLogLevel,
+		baseDir
 	});
 	let workflowBuildResult;
 	if (workflowService && workflowService.jobs.length > 0) {
 		const mainJobNames = workflowService.workflowSources.map((ws) => ws.workflow.mainJob.name);
-		workflowBuildResult = await bundleWorkflowJobs(workflowService.jobs, mainJobNames, config.env ?? {}, triggerContext, bundleCache, inlineSourcemap, bundleLogLevel);
+		workflowBuildResult = await bundleWorkflowJobs(workflowService.jobs, mainJobNames, config.env ?? {}, startContext, baseDir, bundleCache, inlineSourcemap, bundleLogLevel);
 		bundledScripts.workflowJobs = workflowBuildResult.bundledCode;
 	}
 	let httpAdapterBuildResult;
@@ -6448,7 +5406,7 @@ async function loadApplication(params) {
 		sourceFile: a.sourceFile,
 		methods: a.methods,
 		hasOutput: a.hasOutput
-	})), bundleCache, bundleLogLevel);
+	})), baseDir, bundleCache, bundleLogLevel);
 	if (authResult.authService?.config.hooks?.beforeLogin) {
 		const authName = authResult.authService.config.name;
 		bundledScripts.authHooks = await bundleAuthHooks({
@@ -6456,10 +5414,11 @@ async function loadApplication(params) {
 			authName,
 			handlerAccessPath: `auth.hooks.beforeLogin.handler`,
 			env: config.env ?? {},
-			triggerContext,
+			startContext,
 			cache: bundleCache,
 			inlineSourcemap,
-			bundleLogLevel
+			bundleLogLevel,
+			baseDir
 		});
 	}
 	for (const pipeline of resolverResult.resolverServices) await pipeline.loadResolvers();
@@ -6493,5 +5452,5 @@ async function loadApplication(params) {
 }
 
 //#endregion
-export { fetchUserInfo as $, hasAnyUserTokenEntry as A, readPlatformConfig as B, createBundleCache as C, positiveIntArg as Ct, loadConfig as D, hashFile as E, workspaceArgs as Et, loadMachineUserName as F, writePlatformConfig as G, resolveConfigUser as H, loadPlatformClientConfig as I, fetchAll as J, closeConnectionPool as K, loadStoredUserTokens as L, loadAccessToken as M, loadConfigPath as N, deleteUserTokens as O, loadConsoleBaseUrl as P, fetchPlatformMachineUserToken as Q, loadWorkspaceId as R, hasGenerationHooks as S, parseDuration as St, hashContent as T, toPageDirection as Tt, resolveUserTokenKey as U, removeLegacyUserAlias as V, saveUserTokens as W, fetchMachineUserToken as X, fetchAllTolerant as Y, fetchPaged as Z, platformBundleDefinePlugin as _, nonNegativeIntArg as _t, resolveInlineSourcemap as a, initOperatorClient as at, resolveBundleLogLevel as b, pagedLogArgs as bt, WorkflowJobSchema as c, byName as ct, INVOKER_EXPR as d, confirmationArgs as dt, getConsoleBaseUrl as et, buildExecutorArgsExpr as f, deploymentArgs as ft, stringifyFunction as g, multiConfigArg as gt, assertUniqueTailorDBTypeNamesWithExternal as h, isVerbose as ht, resolverBundleKey as i, initOAuth2Client as it, hasUserTokenEntry as j, fetchLatestToken as k, ResolverSchema as l, commonArgs as lt, assertUniqueLocalTailorDBTypeNames as m, folderArgs as mt, generatePluginFilesIfNeeded as n, getOrNull as nt, getApplicationAuthNamespace as o, isDefaultPlatform as ot, buildResolverOperationHookExpr as p, durationArg as pt, defaultPlatformBaseUrl as q, loadApplication as r, getPlatformBaseUrl as rt, WorkflowJobFunctionExecutionPolicySchema as s, resolveStaticWebsiteUrls as st, defineApplication as t, getOAuth2ClientId as tt, HTTP_METHODS as u, configArg as ut, composeFunctionTreeshakeOptions as v, orderArg as vt, getDistDir as w, resolveMachineUserInputSource as wt, getPluginGenerationDependencies as x, paginationArgs as xt, createLogLevelTreeshakeOptions as y, organizationArgs as yt, platformConfigFromProfile as z };
-//# sourceMappingURL=application-Bf8wxOi6.mjs.map
+export { fetchAllTolerant as A, initOperatorClient as B, createBundleCache as C, closeConnectionPool as D, hashFile as E, getConsoleBaseUrl as F, byName as G, normalizeBaseUrl as H, getOAuth2ClientId as I, LOG_LEVELS as K, getOrNull as L, fetchPaged as M, fetchPlatformMachineUserToken as N, defaultPlatformBaseUrl as O, fetchUserInfo as P, getPlatformBaseUrl as R, hasGenerationHooks as S, hashContent as T, rememberPlatformConfigForToken as U, isDefaultPlatform as V, resolveStaticWebsiteUrls as W, platformBundleDefinePlugin as _, resolveInlineSourcemap as a, resolveBundleLogLevel as b, WorkflowJobSchema as c, INVOKER_EXPR as d, buildExecutorArgsExpr as f, stringifyFunction as g, assertUniqueTailorDBTypeNamesWithExternal as h, resolverBundleKey as i, fetchMachineUserToken as j, fetchAll as k, ResolverSchema as l, assertUniqueLocalTailorDBTypeNames as m, generatePluginFilesIfNeeded as n, getApplicationAuthNamespace as o, buildResolverOperationHookExpr as p, loadApplication as r, WorkflowJobFunctionExecutionPolicySchema as s, defineApplication as t, HTTP_METHODS as u, composeFunctionTreeshakeOptions as v, getDistDir as w, getPluginGenerationDependencies as x, createLogLevelTreeshakeOptions as y, initOAuth2Client as z };
+//# sourceMappingURL=application-GzW98_Xr.mjs.map