@tailor-platform/sdk 2.0.0-next.9 → 2.0.0

package/dist/{application-D_oSqto2.mjs → application-CM6hKnSK.mjs}

@@ -1,11 +1,13 @@
 import { n as isSdkBranded } from "./brand-Eo4pLXPJ.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
-import { a as parseBoolean, n as logger, r as styles } from "./logger-BwS4ppwO.mjs";
-import { a as AuthConfigSchema, c as stripTailorDBTypeBuilderHelpers, d as applyRelationMetadataToFieldConfig, f as buildRelationInfo, g as functionSchema, h as loadFilesWithIgnores, l as TailorDBServiceConfigSchema, m as validateRelationConfig, n as loadExecutor, o as AuthInvokerSchema, p as processRelationMetadata, s as TailorFieldSchema, t as createExecutorService, u as TailorDBTypeSchema } from "./service-CXFce28G.mjs";
+import { a as parseBoolean, n as logger, r as styles } from "./logger-CXQq9YIp.mjs";
+import { a as AuthConfigSchema, c as stripTailorDBTypeBuilderHelpers, d as applyRelationMetadataToFieldConfig, f as buildRelationInfo, g as functionSchema, h as loadFilesWithIgnores, l as TailorDBServiceConfigSchema, m as validateRelationConfig, n as loadExecutor, o as AuthInvokerSchema, p as processRelationMetadata, s as TailorFieldSchema, t as createExecutorService, u as TailorDBTypeSchema } from "./service-k1xy_A5G.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { t as userAgent } from "./user-agent-Bgsszb5I.mjs";
+import { t as createCLIError } from "./errors-D7583Zz7.mjs";
+import { n as isNodeBuiltinImport, t as getNodeBuiltinMessage } from "./node-builtins-CmaL2Cbq.mjs";
 import { t as isPluginGeneratedType } from "./type-source-DH_LH20p.mjs";
-import { builtinModules, createRequire } from "node:module";
+import { createRequire } from "node:module";
 import * as path from "pathe";
 import { resolve } from "pathe";
 import { resolveTSConfig } from "pkg-types";
@@ -17,11 +19,11 @@ import { MethodOptions_IdempotencyLevel } from "@bufbuild/protobuf/wkt";
 import { pathToFileURL } from "node:url";
 import { OAuth2Client } from "@badgateway/oauth2-client";
 import { Code, ConnectError, createClient } from "@connectrpc/connect";
-import { getGlobalDispatcher } from "undici";
 import pLimit from "p-limit";
 import * as crypto from "node:crypto";
 import * as rolldown from "rolldown";
 import { parseSync } from "oxc-parser";
+import { createPathsMatcher, getTsconfig } from "get-tsconfig";
 import * as inflection from "inflection";
 import * as globals from "globals";
 import * as os from "node:os";
@@ -180,7 +182,7 @@ function initOAuth2Client(config) {
 */
 async function initOperatorClient(accessToken, config) {
 	const platformConfig = config ?? getPlatformConfigForToken(accessToken);
-	const [{ createTracingInterceptor }, { OperatorService }] = await Promise.all([import("./interceptor-e33JtsC-.mjs"), import("./service_pb-r1T7kpJc.mjs")]);
+	const [{ createTracingInterceptor }, { OperatorService }] = await Promise.all([import("./interceptor-e33JtsC-.mjs"), import("./service_pb-i8CmnQP4.mjs")]);
 	const interceptors = [
 		await userAgentInterceptor(),
 		await bearerTokenInterceptor(accessToken),
@@ -233,9 +235,10 @@ async function bearerTokenInterceptor(accessToken) {
 /**
 * Create an interceptor that retries failed unary requests with backoff.
 *
-* Retries unary methods on `Unavailable`/`ResourceExhausted`, and `Internal`
-* only for methods declared idempotent, up to 3 attempts. Workspace creation is
-* excluded because it has no idempotency key and a lost response is ambiguous.
+* Retries unary methods on `Unavailable`/`ResourceExhausted`, and
+* `Aborted`/`Internal` only for methods declared side-effect-free or idempotent,
+* up to 3 attempts. Workspace creation is excluded because it has no idempotency
+* key and a lost response is ambiguous.
 * As a targeted exception for the deploy/apply flow, a post-retry `AlreadyExists`
 * from an allowlisted Create (see `RETRY_SAFE_CREATE_METHODS`) is treated as
 * success, since it means a prior attempt already committed the resource
@@ -260,7 +263,7 @@ function retryInterceptor() {
 						logger.debug(`retry: ${req.method.name} returned AlreadyExists on attempt ${i + 1}; treating as success (prior attempt likely committed)`);
 						return synthesizeEmptyUnaryResponse(req);
 					}
-					const { reportCrash } = await import("./crashreport-0ioNRZ4K.mjs");
+					const { reportCrash } = await import("./crashreport-eI7ty7ok.mjs");
 					await reportCrash(error, "handledError");
 				}
 				if (req.method.name !== "CreateWorkspace" && isRetirable(error, req.method.idempotency)) {
@@ -306,8 +309,10 @@ function connectCodeName(error) {
 *
 * Membership is deliberately an allowlist, not `startsWith("Create")`: swallowing
 * synthesizes an empty response (see `synthesizeEmptyUnaryResponse`), which is only
-* safe when every caller ignores the response body. These are the deploy/apply
-* resource creations that fire under heavy parallelism and discard their response.
+* safe when every caller tolerates an empty response body. These are the deploy/apply
+* resource creations that fire under heavy parallelism and discard their response —
+* except `CreateSecretManagerSecret`, whose caller reads `secret.updateTime` but
+* degrades safely when it is absent (the next deploy re-updates the secret).
 *
 * Intentionally excluded because their callers read the response body — swallowing
 * would hand back an empty message and corrupt downstream state:
@@ -412,6 +417,7 @@ function isRetirable(error, idempotency) {
 	switch (error.code) {
 		case Code.ResourceExhausted:
 		case Code.Unavailable: return true;
+		case Code.Aborted:
 		case Code.Internal: return idempotency === MethodOptions_IdempotencyLevel.NO_SIDE_EFFECTS || idempotency === MethodOptions_IdempotencyLevel.IDEMPOTENT;
 		default: return false;
 	}
@@ -660,12 +666,20 @@ async function fetchPlatformMachineUserToken(clientId, clientSecret, config) {
 	}).clientCredentials();
 }
 /**
-* Close undici's global HTTP connection pool to prevent libuv UV_HANDLE_CLOSING
+* Close the global HTTP connection pool to prevent libuv UV_HANDLE_CLOSING
 * assertion failure on Windows at process exit (Node.js 23.x+).
 * See: https://github.com/nodejs/node/issues/56645
+*
+* The pool is reached through the global dispatcher symbol rather than the `undici`
+* package: importing that package installs its own Agent over these same globals,
+* replacing the HTTP stack Node's `fetch` already uses. The symbol is versioned per
+* Dispatcher API generation, and the newest one wins because older symbols hold a
+* wrapper around that same pool — closing both would destroy it twice.
 */
 async function closeConnectionPool() {
-	await getGlobalDispatcher().close();
+	const globals = globalThis;
+	const dispatcher = globals[Symbol.for("undici.globalDispatcher.2")] ?? globals[Symbol.for("undici.globalDispatcher.1")];
+	if (typeof dispatcher?.close === "function") await dispatcher.close();
 }
 
 //#endregion
@@ -687,17 +701,27 @@ function hashFile(filePath) {
 	const content = fs.readFileSync(filePath);
 	return crypto.createHash("sha256").update(content).digest("hex");
 }
+const MISSING_FILE_MARKER = "<missing>";
 /**
 * Compute a deterministic SHA-256 hash for multiple files.
 *
 * Paths are sorted alphabetically before hashing so that the result
 * is independent of the order the paths are supplied (e.g. glob ordering).
-* Each file's individual hash is concatenated and then hashed again.
+* Each file's individual hash is concatenated and then hashed again. A path
+* that does not exist contributes a fixed marker instead of a content hash.
 * @param filePaths - Array of absolute file paths
 * @returns Hex-encoded SHA-256 hash representing all files
 */
 function hashFiles(filePaths) {
-	return hashContent(filePaths.toSorted().map((fp) => hashFile(fp)).join(""));
+	return hashContent(filePaths.toSorted().map((fp) => hashFileOrMissing(fp)).join(""));
+}
+function hashFileOrMissing(filePath) {
+	try {
+		return hashFile(filePath);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return MISSING_FILE_MARKER;
+		throw error;
+	}
 }
 
 //#endregion
@@ -773,7 +797,7 @@ function computeBundlerContextHash(params) {
 */
 async function withCache(params) {
 	const { cache, kind, namespace, name, sourceFile, contextHash, build } = params;
-	if (!cache) return await build([]);
+	if (!cache) return await build([], () => {});
 	const content = cache.tryRestore({
 		kind,
 		namespace,
@@ -784,15 +808,16 @@ async function withCache(params) {
 		logger.debug(`  ${styles.dim("cached")}: ${name}`);
 		return content;
 	}
+	const extraDependencies = /* @__PURE__ */ new Set();
 	const { plugin, getResult } = createDepCollectorPlugin();
-	const code = await build([plugin]);
+	const code = await build([plugin], (filePath) => extraDependencies.add(filePath));
 	cache.save({
 		kind,
 		namespace,
 		name,
 		sourceFile,
 		content: code,
-		dependencyPaths: getResult(),
+		dependencyPaths: [...getResult(), ...extraDependencies],
 		contextHash
 	});
 	return code;
@@ -823,7 +848,12 @@ function createBundleCache(store) {
 		const { kind, namespace, name, sourceFile, content, dependencyPaths, contextHash } = params;
 		const cacheKey = buildCacheKey(kind, name, namespace);
 		const allDeps = dependencyPaths.includes(sourceFile) ? dependencyPaths : [sourceFile, ...dependencyPaths];
-		const inputHash = combineHash(hashFiles(allDeps), contextHash);
+		let inputHash;
+		try {
+			inputHash = combineHash(hashFiles(allDeps), contextHash);
+		} catch {
+			return;
+		}
 		const contentHash = hashContent(content);
 		store.storeBundleContent(cacheKey, content);
 		store.setEntry(cacheKey, {
@@ -2032,7 +2062,7 @@ function transformStartCalls(source, startContext, currentFilePath) {
 			transformedCall = `tailor.workflow.startWorkflow(${JSON.stringify(call.targetName)}, ${call.argsText || "undefined"}${optionsPart})`;
 		} else {
 			const optionsPart = call.optionsText !== void 0 ? `, ${call.optionsText}` : "";
-			transformedCall = `tailor.workflow.startJobFunction(${JSON.stringify(call.targetName)}, ${call.argsText || "undefined"}${optionsPart})`;
+			transformedCall = `tailor.workflow.execJobFunction(${JSON.stringify(call.targetName)}, ${call.argsText || "undefined"}${optionsPart})`;
 		}
 		replacements.push({
 			start: call.callRange.start,
@@ -2044,7 +2074,7 @@ function transformStartCalls(source, startContext, currentFilePath) {
 	return needsNormalizerHelper && authNamespace ? buildNormalizerHelperSource(authNamespace) + transformed : transformed;
 }
 function createStartTransformPlugin(startContext) {
-	if (!startContext) return void 0;
+	if (!startContext || startContext.modules.size === 0) return void 0;
 	return {
 		name: "start-transform",
 		transform: {
@@ -2057,6 +2087,50 @@ function createStartTransformPlugin(startContext) {
 	};
 }
 
+//#endregion
+//#region src/cli/shared/bundle-log.ts
+const ESCALATED_LOG_CODE = "UNRESOLVED_IMPORT";
+/**
+* Collect unresolved imports while keeping every other rolldown log suppressed.
+* @param options - Context used to explain which tsconfig was in effect
+* @returns Rolldown options and a post-build assertion
+*/
+function createBundleLog(options = {}) {
+	const unresolvedImports = /* @__PURE__ */ new Map();
+	return {
+		options: {
+			logLevel: "warn",
+			onLog: (_level, log) => {
+				if (log.code !== ESCALATED_LOG_CODE) return;
+				unresolvedImports.set(JSON.stringify([log.exporter, log.id]), log);
+			}
+		},
+		assertAllResolved() {
+			if (unresolvedImports.size > 0) throw unresolvedImportError([...unresolvedImports.values()], options.tsconfig);
+		}
+	};
+}
+function unresolvedImportError(logs, tsconfig) {
+	const imports = logs.map(formatUnresolvedImport);
+	return createCLIError({
+		code: "UNRESOLVED_IMPORT",
+		message: imports.length === 1 ? `Could not resolve ${imports[0]}.` : `Could not resolve ${imports.length} imports.`,
+		details: imports.length === 1 ? void 0 : imports.map((item) => `- ${item}`).join("\n"),
+		suggestion: unresolvedImportSuggestion(logs, tsconfig)
+	});
+}
+function unresolvedImportSuggestion(logs, tsconfig) {
+	const nodeSuggestions = logs.map((log) => log.exporter).filter((specifier) => specifier !== void 0).filter(isNodeBuiltinImport).map(getNodeBuiltinMessage);
+	const hasOtherImports = logs.some((log) => log.exporter === void 0 || !isNodeBuiltinImport(log.exporter));
+	const pathSuggestion = tsconfig ? `Check that each import path is correct, and that a \`compilerOptions.paths\` entry covering it is declared in the importing file's own tsconfig.json or an ancestor. The build used "${tsconfig}".` : "No tsconfig.json was found, so `compilerOptions.paths` aliases were not applied. Add a tsconfig.json declaring the aliases these files import.";
+	return [.../* @__PURE__ */ new Set([...nodeSuggestions, ...hasOtherImports ? [pathSuggestion] : []])].join("\n");
+}
+function formatUnresolvedImport(log) {
+	const specifier = log.exporter ?? "an imported module";
+	const importerId = log.id?.startsWith("\0") ? `a generated entry (${log.id.slice(1)})` : log.id && `"${log.id}"`;
+	return `"${specifier}"${importerId ? ` imported from ${importerId}` : ""}`;
+}
+
 //#endregion
 //#region src/cli/shared/bundle-log-level.ts
 const INFO_LEVEL_CONSOLE_METHODS = [
@@ -2081,20 +2155,36 @@ const DEBUG_LEVEL_CONSOLE_METHODS = [
 ];
 const WARN_LEVEL_CONSOLE_METHODS = ["console.warn"];
 const ERROR_LEVEL_CONSOLE_METHODS = ["console.error"];
+const DEBUG_LEVEL_LOGGER_METHODS = ["globalThis.tailor.logger.debug"];
+const INFO_LEVEL_LOGGER_METHODS = ["globalThis.tailor.logger.info"];
+const WARN_LEVEL_LOGGER_METHODS = ["globalThis.tailor.logger.warn"];
+const ERROR_LEVEL_LOGGER_METHODS = ["globalThis.tailor.logger.error"];
 const MANUAL_PURE_FUNCTIONS_BY_LOG_LEVEL = {
 	DEBUG: [],
-	INFO: DEBUG_LEVEL_CONSOLE_METHODS,
-	WARN: [...DEBUG_LEVEL_CONSOLE_METHODS, ...INFO_LEVEL_CONSOLE_METHODS],
+	INFO: [...DEBUG_LEVEL_CONSOLE_METHODS, ...DEBUG_LEVEL_LOGGER_METHODS],
+	WARN: [
+		...DEBUG_LEVEL_CONSOLE_METHODS,
+		...INFO_LEVEL_CONSOLE_METHODS,
+		...DEBUG_LEVEL_LOGGER_METHODS,
+		...INFO_LEVEL_LOGGER_METHODS
+	],
 	ERROR: [
 		...DEBUG_LEVEL_CONSOLE_METHODS,
 		...INFO_LEVEL_CONSOLE_METHODS,
-		...WARN_LEVEL_CONSOLE_METHODS
+		...WARN_LEVEL_CONSOLE_METHODS,
+		...DEBUG_LEVEL_LOGGER_METHODS,
+		...INFO_LEVEL_LOGGER_METHODS,
+		...WARN_LEVEL_LOGGER_METHODS
 	],
 	SILENT: [
 		...DEBUG_LEVEL_CONSOLE_METHODS,
 		...INFO_LEVEL_CONSOLE_METHODS,
 		...WARN_LEVEL_CONSOLE_METHODS,
-		...ERROR_LEVEL_CONSOLE_METHODS
+		...ERROR_LEVEL_CONSOLE_METHODS,
+		...DEBUG_LEVEL_LOGGER_METHODS,
+		...INFO_LEVEL_LOGGER_METHODS,
+		...WARN_LEVEL_LOGGER_METHODS,
+		...ERROR_LEVEL_LOGGER_METHODS
 	]
 };
 function normalizeBundleLogLevel(value) {
@@ -2145,6 +2235,13 @@ const platformBundleDefinePlugin = {
 	transform(code) {
 		if (!code.includes("process.env.__TAILOR_PLATFORM_BUNDLE")) return null;
 		return { code: code.replace(GATE, "true") };
+	},
+	resolveId(source) {
+		if (source === "node:async_hooks") return {
+			id: source,
+			external: true
+		};
+		return null;
 	}
 };
 
@@ -2163,7 +2260,7 @@ async function resolveTSConfigWithFallback(baseDir) {
 	const fallback = await tryResolve(process.cwd());
 	if (fallback && !warnedBaseDirs.has(baseDir)) {
 		warnedBaseDirs.add(baseDir);
-		logger.warn(`No tsconfig found from "${baseDir}"; falling back to the tsconfig resolved from process.cwd(). Move (or extend) a tsconfig into this config's own directory before v2, when this fallback will be removed.`);
+		logger.warn(`No tsconfig found from "${baseDir}"; falling back to the tsconfig resolved from process.cwd(). Move (or extend) a tsconfig into this directory before v2, when this fallback will be removed.`);
 	}
 	return fallback;
 }
@@ -2175,6 +2272,83 @@ async function tryResolve(dir) {
 	}
 }
 
+//#endregion
+//#region src/cli/shared/tsconfig-paths-plugin.ts
+/**
+* Create a {@link TsconfigLookupCache} to share across every bundle in a CLI run.
+* @returns A fresh, empty lookup cache
+*/
+function createTsconfigLookupCache() {
+	return {
+		tsconfigCache: /* @__PURE__ */ new Map(),
+		contextCache: /* @__PURE__ */ new Map()
+	};
+}
+/**
+* Create the rolldown plugin that falls back to tsconfig `paths` aliases from
+* the importing file's own nearest tsconfig.
+* @param options - Resolution context for bundlers whose entry inlines user code
+* @returns Rolldown plugin to add to a bundler's plugin list
+*/
+function createTsconfigPathsPlugin(options = {}) {
+	const { tsconfigCache, contextCache } = options.cache ?? createTsconfigLookupCache();
+	return {
+		name: "tailor-tsconfig-paths",
+		resolveId: {
+			order: "post",
+			async handler(source, importer) {
+				if (!importer) return null;
+				if (source.startsWith(".") || source.startsWith("/") || source.startsWith("\0")) return null;
+				const resolutionBasis = importer.startsWith("\0") ? options.virtualEntrySourceFile : importer;
+				if (!resolutionBasis) return null;
+				const resolution = getResolutionContext(path.dirname(resolutionBasis), tsconfigCache, contextCache, options.onTsconfigRead);
+				if (!resolution) return null;
+				const candidates = resolution.matcher(source);
+				if (candidates.length === 0) return null;
+				if (await this.resolve(source, importer, { skipSelf: true })) return null;
+				for (const candidate of candidates) {
+					const resolved = await this.resolve(candidate, importer, { skipSelf: true });
+					if (resolved) return resolved;
+				}
+				return null;
+			}
+		}
+	};
+}
+function getResolutionContext(startDir, tsconfigCache, contextCache, onTsconfigRead) {
+	const cached = contextCache.get(startDir);
+	if (cached !== void 0) {
+		reportTsconfigDependencies(tsconfigCache, onTsconfigRead);
+		return cached;
+	}
+	const tsconfig = getTsconfig(startDir, "tsconfig.json", tsconfigCache);
+	reportTsconfigDependencies(tsconfigCache, onTsconfigRead);
+	const paths = tsconfig?.config.compilerOptions?.paths;
+	const matcher = paths && Object.keys(paths).length > 0 ? createPathsMatcher(tsconfig) : null;
+	const resolution = matcher ? { matcher } : null;
+	contextCache.set(startDir, resolution);
+	return resolution;
+}
+function reportTsconfigDependencies(cache, onTsconfigRead) {
+	if (!onTsconfigRead) return;
+	const directories = /* @__PURE__ */ new Set();
+	const dependencies = /* @__PURE__ */ new Set();
+	for (const [key, value] of cache) {
+		const dependencyPath = dependencyPathFromCacheKey(key);
+		if (!dependencyPath) continue;
+		if (key.startsWith("statSync:") && isDirectoryStat(value)) directories.add(dependencyPath);
+		else dependencies.add(dependencyPath);
+	}
+	for (const dependencyPath of dependencies) if (!directories.has(dependencyPath)) onTsconfigRead(dependencyPath);
+}
+function dependencyPathFromCacheKey(key) {
+	if (key.startsWith("readFileSync:") && key.endsWith(":utf8")) return key.slice(13, -5);
+	for (const prefix of ["existsSync:", "statSync:"]) if (key.startsWith(prefix)) return key.slice(prefix.length);
+}
+function isDirectoryStat(value) {
+	return typeof value === "object" && value !== null && "isDirectory" in value && typeof value.isDirectory === "function" && value.isDirectory();
+}
+
 //#endregion
 //#region src/cli/shared/virtual-entry.ts
 /**
@@ -2182,17 +2356,20 @@ async function tryResolve(dir) {
 * @param name - Logical entry name
 * @param code - Entry module source
 * @param sourceType - Parser type for the generated module
+* @param resolutionBasis - Source file whose directory resolves generated imports
 * @returns Rolldown input and plugin for loading the entry
 */
-function createVirtualEntry(name, code, sourceType = "js") {
-	const input = `tailor-sdk-entry:${name}.${sourceType}`;
+function createVirtualEntry(name, code, sourceType = "js", resolutionBasis) {
+	const input = `tailor-entry:${name}.${sourceType}`;
 	const resolvedId = `\0${input}`;
 	return {
 		input,
 		plugin: {
-			name: "tailor-sdk-virtual-entry",
-			resolveId(source, importer) {
-				return source === input && importer === void 0 ? resolvedId : null;
+			name: "tailor-virtual-entry",
+			async resolveId(source, importer) {
+				if (source === input && importer === void 0) return resolvedId;
+				if (importer !== resolvedId || !resolutionBasis || source.startsWith(".") || path.isAbsolute(source) || source.startsWith("\0")) return null;
+				return this.resolve(source, resolutionBasis, { skipSelf: true });
 			},
 			load(id) {
 				return id === resolvedId ? code : null;
@@ -2200,6 +2377,27 @@ function createVirtualEntry(name, code, sourceType = "js") {
 		}
 	};
 }
+/**
+* Resolve bare imports in a generated on-disk entry from its owning project.
+*
+* Generated entries live under the CLI output directory, which may be outside
+* the project selected by a config path. Resolving their injected dependencies
+* from that output directory would ignore the selected project's installation.
+* @param entryPath - Absolute path of the generated entry
+* @param projectDir - Directory whose dependencies the generated entry uses
+* @returns Rolldown plugin that rebases generated bare imports
+*/
+function createGeneratedEntryResolverPlugin(entryPath, projectDir) {
+	const normalizedEntryPath = path.resolve(entryPath);
+	const resolutionBasis = path.join(path.resolve(projectDir), "__tailor_sdk_generated_entry__.js");
+	return {
+		name: "tailor-generated-entry-resolver",
+		async resolveId(source, importer) {
+			if (importer === void 0 || path.resolve(importer) !== normalizedEntryPath || source.startsWith(".") || path.isAbsolute(source) || source.startsWith("\0")) return null;
+			return this.resolve(source, resolutionBasis, { skipSelf: true });
+		}
+	};
+}
 
 //#endregion
 //#region src/cli/services/auth/bundler.ts
@@ -2213,7 +2411,7 @@ function createVirtualEntry(name, code, sourceType = "js") {
 * @returns Map of function name to bundled code
 */
 async function bundleAuthHooks(options) {
-	const { configPath, authName, handlerAccessPath, env = {}, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", baseDir } = options;
+	const { configPath, authName, handlerAccessPath, env = {}, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", baseDir, tsconfigCache } = options;
 	logger.newline();
 	logger.log(`Bundling auth hook for ${styles.info(`"${authName}"`)}`);
 	const absoluteConfigPath = path.resolve(configPath);
@@ -2232,7 +2430,7 @@ async function bundleAuthHooks(options) {
 			bundleLogLevel,
 			prefix: JSON.stringify(Object.fromEntries(Object.entries(env).toSorted(([a], [b]) => a.localeCompare(b))))
 		}),
-		async build(cachePlugins) {
+		async build(cachePlugins, trackDependency) {
 			const entryContent = multiline`
         import _config from "${absoluteConfigPath}";
         const __auth_hook_function = _config.${handlerAccessPath};
@@ -2241,12 +2439,16 @@ async function bundleAuthHooks(options) {
           return await __auth_hook_function({ ...args, env });
         }
       `;
-			const entry = createVirtualEntry(`auth-hook:${functionName}`, entryContent);
+			const entry = createVirtualEntry(`auth-hook:${functionName}`, entryContent, "js", absoluteConfigPath);
 			const startPlugin = createStartTransformPlugin(startContext);
 			const plugins = [entry.plugin];
 			if (startPlugin) plugins.push(startPlugin);
-			plugins.push(platformBundleDefinePlugin, ...cachePlugins);
-			return (await rolldown.build({
+			plugins.push(createTsconfigPathsPlugin({
+				onTsconfigRead: trackDependency,
+				cache: tsconfigCache
+			}), platformBundleDefinePlugin, ...cachePlugins);
+			const bundleLog = createBundleLog({ tsconfig });
+			const result = await rolldown.build({
 				input: entry.input,
 				write: false,
 				output: {
@@ -2259,8 +2461,10 @@ async function bundleAuthHooks(options) {
 				plugins,
 				transform: { define: { "process.env.TAILOR_APP_LOG_LEVEL": JSON.stringify(bundleLogLevel) } },
 				treeshake: composeFunctionTreeshakeOptions([createLogLevelTreeshakeOptions(bundleLogLevel)]),
-				logLevel: "silent"
-			})).output[0].code;
+				...bundleLog.options
+			});
+			bundleLog.assertAllResolved();
+			return result.output[0].code;
 		}
 	});
 	logger.log(`${styles.success("Bundled")} auth hook for ${styles.info(`"${authName}"`)}`);
@@ -3190,9 +3394,14 @@ async function bundleScriptTarget(args) {
 	if (unresolved.length > 0) throw new Error(`${context} captures unresolvable variables (${unresolved.join(", ")}). Hooks and validators must not reference variables that cannot be resolved from the source file.
   ${kind}: ${fnSource}`);
 	const entryContent = buildMinimalEntryFromResolved(imports, declarations, fnSource, sourceFilePath, kind === "typeValidate");
-	const entry = createVirtualEntry(`tailordb-script:${typeName}:${targetIndex}`, entryContent, "ts");
-	const bundledCode = (await rolldown.build({
-		plugins: [entry.plugin, platformBundleDefinePlugin],
+	const entry = createVirtualEntry(`tailordb-script:${typeName}:${targetIndex}`, entryContent, "ts", sourceFilePath);
+	const bundleLog = createBundleLog({ tsconfig });
+	const buildResult = await rolldown.build({
+		plugins: [
+			entry.plugin,
+			createTsconfigPathsPlugin({ virtualEntrySourceFile: sourceFilePath }),
+			platformBundleDefinePlugin
+		],
 		input: entry.input,
 		write: false,
 		output: {
@@ -3207,8 +3416,10 @@ async function bundleScriptTarget(args) {
 			annotations: true,
 			unknownGlobalSideEffects: false
 		},
-		logLevel: "silent"
-	})).output[0].code;
+		...bundleLog.options
+	});
+	bundleLog.assertAllResolved();
+	const bundledCode = buildResult.output[0].code;
 	return assertParsableExpression(buildPrecompiledExpr(bundledCode, argsObject), context);
 }
 /**
@@ -3725,6 +3936,8 @@ function buildExecutorArgsExpr(triggerKind, env) {
 		case "schedule": return `({ ...args, appNamespace: args.namespaceName, ${ACTOR_TRANSFORM_EXPR}, ${envExpr} })`;
 		case "resolverExecuted": return `({ ...args, appNamespace: args.namespaceName, ${ACTOR_TRANSFORM_EXPR}, success: !!args.succeeded, result: args.succeeded?.result.resolver, error: args.failed?.error, ${envExpr} })`;
 		case "incomingWebhook": return `({ ...args, appNamespace: args.namespaceName, rawBody: args.raw_body, ${envExpr} })`;
+		case "workflowExecution":
+		case "workflowJobExecution": return `({ ...args, event: args.eventType?.split(".").pop(), rawEvent: args.eventType, ${ACTOR_TRANSFORM_EXPR}, ...(args.succeeded ? { success: true } : args.failed ? { success: false, error: args.failed.error ?? "" } : {}), ${envExpr} })`;
 		default: return `({ ...args, event: args.eventType?.split(".").pop(), rawEvent: args.eventType, appNamespace: args.namespaceName, ${ACTOR_TRANSFORM_EXPR}, ${envExpr} })`;
 	}
 }
@@ -3742,6 +3955,112 @@ function buildExecutorArgsExpr(triggerKind, env) {
 function buildResolverOperationHookExpr(env) {
 	return `({ ...context.pipeline, input: context.args, caller: ${tailorPrincipalMap}, env: ${JSON.stringify(env)} });`;
 }
+function isSingleResolverCondition(conditions) {
+	return conditions.length === 3 && typeof conditions[1] === "string";
+}
+function resolverPermissionOperandExpr(operand) {
+	if (typeof operand === "object") {
+		if (operand.user === "_loggedIn") return `(context.caller !== null)`;
+		if (operand.user === "id") return `context.caller?.id`;
+		return `context.caller?.attributes?.[${JSON.stringify(operand.user)}]`;
+	}
+	return JSON.stringify(operand);
+}
+function isArbitraryAttributeOperand(operand) {
+	return typeof operand === "object" && operand.user !== "_loggedIn";
+}
+function resolverPermissionConditionExpr(condition) {
+	const [left, operator, right] = condition;
+	const leftExpr = resolverPermissionOperandExpr(left);
+	const rightExpr = resolverPermissionOperandExpr(right);
+	if (operator === "!=") {
+		const userOperandExpr = isArbitraryAttributeOperand(left) ? leftExpr : isArbitraryAttributeOperand(right) ? rightExpr : void 0;
+		if (userOperandExpr) return `(${userOperandExpr} !== undefined && ${leftExpr} !== ${rightExpr})`;
+	}
+	return `(${leftExpr} ${operator === "=" ? "===" : "!=="} ${rightExpr})`;
+}
+function resolverPermissionPolicyExpr(policy) {
+	const conditions = isSingleResolverCondition(policy.conditions) ? [policy.conditions] : policy.conditions;
+	if (conditions.length === 0) throw new Error("Resolver permission policy must have at least one condition, got an empty array.");
+	return conditions.map(resolverPermissionConditionExpr).join(" && ");
+}
+/**
+* Build a JS object literal capturing whether `policy` matched and its
+* (possibly empty) description, for runtime denial-reason attribution.
+* @param policy - The policy to compile
+* @returns A JS object literal expression: `{ matched, description }`
+*/
+function policyEntryExpr(policy) {
+	return `{ matched: ${resolverPermissionPolicyExpr(policy)}, description: ${JSON.stringify(policy.description ?? "")} }`;
+}
+/**
+* Build the permission guard statement injected at resolver entry.
+*
+* Rejects the call with `TailorErrorMessage` when the caller doesn't match
+* `permission`, evaluated against `context.caller` — the original caller,
+* unaffected by `authInvoker`. `permission` is deny-by-default: a caller is
+* granted only by a matching `permit: true` policy, and a matching
+* `permit: false` policy always overrides that grant. The thrown message only
+* includes the description(s) of the policy/policies that actually caused the
+* denial.
+*
+* The schema requires at least one `permit: true` policy (an array of only
+* `permit: false` policies is rejected at build time), so `allowPolicies` is
+* never empty here for schema-valid input; this function still handles that
+* case defensively since it also runs against test-authored raw shapes.
+* @param permission - The resolver's `permission` config
+* @returns A JS statement, or `undefined` when `permission` is omitted or `"allowAnonymous"`
+*/
+function buildResolverPermissionGuardExpr(permission) {
+	if (!permission || permission === "allowAnonymous") return;
+	if (permission.length === 0) throw new Error("Resolver permission must have at least one policy, got an empty array.");
+	const denyPolicies = permission.filter((policy) => policy.permit === false);
+	const allowPolicies = permission.filter((policy) => policy.permit !== false);
+	return `{
+    const $denyPolicies = ${`[${denyPolicies.map(policyEntryExpr).join(", ")}]`};
+    const $allowPolicies = ${`[${allowPolicies.map(policyEntryExpr).join(", ")}]`};
+    const $matchedDeny = $denyPolicies.filter((p) => p.matched);
+    const $anyAllowMatched = $allowPolicies.some((p) => p.matched);
+    if ($matchedDeny.length > 0 || ($allowPolicies.length > 0 && !$anyAllowMatched)) {
+      const $reasons = ($matchedDeny.length > 0 ? $matchedDeny : $allowPolicies)
+        .map((p) => p.description)
+        .filter(Boolean);
+      throw new TailorErrorMessage($reasons.length > 0 ? "access denied: " + $reasons.join("; ") : "access denied");
+    }
+  }`;
+}
+/**
+* Build the permission guard and input-validation statements shared by every
+* resolver entry wrapper (production bundling and `function test-run`).
+*
+* Kept as a single generator so a resolver-wrapping behavior (like the
+* permission guard) can't be added to one entry-point template and forgotten
+* in the other. References `context.caller`, `context.input`, `invoker`, and
+* `_internalResolver` — the caller's wrapper must bind a `context` object
+* with `user`/`input` properties and an `invoker` binding (from
+* `INVOKER_EXPR`) before inlining this expression.
+* @param permission - The resolver's `permission` config
+* @returns A JS statement block to inline before calling `_internalResolver.body(...)`
+*/
+function buildResolverPermissionAndInputCheckExpr(permission) {
+	return `
+    ${buildResolverPermissionGuardExpr(permission) ?? ""}
+    if (_internalResolver.input) {
+      const result = t.object(_internalResolver.input).parse({
+        value: context.input,
+        data: context.input,
+        invoker,
+      });
+
+      if (result.issues) {
+        throw new TailorErrors(result.issues.map(issue => ({
+          message: issue.message,
+          path: issue.path ?? [],
+        })));
+      }
+    }
+  `;
+}
 
 //#endregion
 //#region src/cli/services/executor/bundler.ts
@@ -3756,7 +4075,7 @@ function buildResolverOperationHookExpr(env) {
 */
 async function bundleExecutors(options) {
 	const bundledCode = /* @__PURE__ */ new Map();
-	const { config, startContext, additionalFiles = [], cache, inlineSourcemap, bundleLogLevel = "DEBUG", baseDir } = options;
+	const { config, startContext, additionalFiles = [], cache, inlineSourcemap, bundleLogLevel = "DEBUG", baseDir, tsconfigCache } = options;
 	const files = [...loadFilesWithIgnores(config, baseDir), ...additionalFiles];
 	if (files.length === 0) {
 		logger.warn(`No executor files found for patterns: ${config.files.join(", ")}`);
@@ -3785,12 +4104,12 @@ async function bundleExecutors(options) {
 		return bundledCode;
 	}
 	const tsconfig = await resolveTSConfigWithFallback(baseDir);
-	const results = await withBundleConcurrency(executors, (executor) => bundleSingleExecutor(executor, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel));
+	const results = await withBundleConcurrency(executors, (executor) => bundleSingleExecutor(executor, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel, tsconfigCache));
 	for (const [name, code] of results) bundledCode.set(name, code);
 	logger.log(`${styles.success("Bundled")} ${styles.info("\"executor\"")}`);
 	return bundledCode;
 }
-async function bundleSingleExecutor(executor, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+async function bundleSingleExecutor(executor, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", tsconfigCache) {
 	const serializedStartContext = serializeStartContext(startContext);
 	const contextHash = computeBundlerContextHash({
 		sourceFile: executor.sourceFile,
@@ -3805,9 +4124,10 @@ async function bundleSingleExecutor(executor, tsconfig, startContext, cache, inl
 		name: executor.name,
 		sourceFile: executor.sourceFile,
 		contextHash,
-		async build(cachePlugins) {
+		async build(cachePlugins, trackDependency) {
+			const absoluteSourcePath = path.resolve(executor.sourceFile);
 			const entryContent = multiline`
-        import _internalExecutor from "${path.resolve(executor.sourceFile)}";
+        import _internalExecutor from "${absoluteSourcePath}";
 
         const __executor_function = async (args) => {
           const invoker = ${INVOKER_EXPR};
@@ -3816,12 +4136,16 @@ async function bundleSingleExecutor(executor, tsconfig, startContext, cache, inl
 
         export { __executor_function as main };
       `;
-			const entry = createVirtualEntry(`executor:${executor.name}`, entryContent);
+			const entry = createVirtualEntry(`executor:${executor.name}`, entryContent, "js", absoluteSourcePath);
 			const startPlugin = createStartTransformPlugin(startContext);
 			const plugins = [entry.plugin];
 			if (startPlugin) plugins.push(startPlugin);
-			plugins.push(platformBundleDefinePlugin, ...cachePlugins);
-			return (await rolldown.build({
+			plugins.push(createTsconfigPathsPlugin({
+				onTsconfigRead: trackDependency,
+				cache: tsconfigCache
+			}), platformBundleDefinePlugin, ...cachePlugins);
+			const bundleLog = createBundleLog({ tsconfig });
+			const result = await rolldown.build({
 				input: entry.input,
 				write: false,
 				output: {
@@ -3833,22 +4157,15 @@ async function bundleSingleExecutor(executor, tsconfig, startContext, cache, inl
 				tsconfig,
 				plugins,
 				treeshake: composeFunctionTreeshakeOptions([createLogLevelTreeshakeOptions(bundleLogLevel)]),
-				logLevel: "silent"
-			})).output[0].code;
+				...bundleLog.options
+			});
+			bundleLog.assertAllResolved();
+			return result.output[0].code;
 		}
 	});
 	return [executor.name, code];
 }
 
-//#endregion
-//#region src/cli/services/http-adapter/node-builtins.ts
-const NODE_BUILTINS = new Set(builtinModules.filter((m) => !m.startsWith("_")));
-function isNodeBuiltinImport(source) {
-	if (source.startsWith("node:")) return true;
-	const root = source.includes("/") ? source.slice(0, source.indexOf("/")) : source;
-	return NODE_BUILTINS.has(root);
-}
-
 //#endregion
 //#region src/parser/service/http-adapter/methods.ts
 /**
@@ -3897,9 +4214,10 @@ const GRAPHQL_WEB_MODULE = createRequire(import.meta.url).resolve("@0no-co/graph
 * @param baseDir - Directory the owning config's tsconfig is resolved against
 * @param cache - Optional bundle cache for skipping unchanged builds
 * @param bundleLogLevel - Controls which console calls are kept in bundled code
+* @param tsconfigCache - Optional tsconfig lookup cache shared across bundles in this CLI run
 * @returns Bundled scripts keyed by adapter name
 */
-async function bundleHttpAdapters(adapters, baseDir, cache, bundleLogLevel = "DEBUG") {
+async function bundleHttpAdapters(adapters, baseDir, cache, bundleLogLevel = "DEBUG", tsconfigCache) {
 	if (adapters.length === 0) return {
 		bundledInputs: /* @__PURE__ */ new Map(),
 		bundledOutputs: /* @__PURE__ */ new Map()
@@ -3912,7 +4230,7 @@ async function bundleHttpAdapters(adapters, baseDir, cache, bundleLogLevel = "DE
 			adapter,
 			kind
 		}));
-	}), ({ adapter, kind }) => bundleAdapterScript(adapter, kind, tsconfig, cache, bundleLogLevel));
+	}), ({ adapter, kind }) => bundleAdapterScript(adapter, kind, tsconfig, cache, bundleLogLevel, tsconfigCache));
 	const bundledInputs = /* @__PURE__ */ new Map();
 	const bundledOutputs = /* @__PURE__ */ new Map();
 	for (const [name, kind, code] of results) if (kind === "input") bundledInputs.set(name, code);
@@ -3923,7 +4241,7 @@ async function bundleHttpAdapters(adapters, baseDir, cache, bundleLogLevel = "DE
 		bundledOutputs
 	};
 }
-async function bundleAdapterScript(adapter, kind, tsconfig, cache, bundleLogLevel = "DEBUG") {
+async function bundleAdapterScript(adapter, kind, tsconfig, cache, bundleLogLevel = "DEBUG", tsconfigCache) {
 	const contextHash = computeBundlerContextHash({
 		sourceFile: adapter.sourceFile,
 		extraContext: kind === "input" ? adapter.methods.join(",") : "",
@@ -3938,16 +4256,16 @@ async function bundleAdapterScript(adapter, kind, tsconfig, cache, bundleLogLeve
 		name: adapter.name,
 		sourceFile: adapter.sourceFile,
 		contextHash,
-		async build(cachePlugins) {
+		async build(cachePlugins, trackDependency) {
 			const absoluteSourcePath = path.resolve(adapter.sourceFile);
 			const entryContent = kind === "input" ? buildInputEntry(absoluteSourcePath, adapter.methods, GRAPHQL_WEB_MODULE) : buildOutputEntry(absoluteSourcePath);
-			const entry = createVirtualEntry(`http-adapter:${adapter.name}:${kind}`, entryContent);
+			const entry = createVirtualEntry(`http-adapter:${adapter.name}:${kind}`, entryContent, "js", absoluteSourcePath);
 			const plugins = [
 				entry.plugin,
 				{
 					name: "http-adapter-reject-node-imports",
 					resolveId(source) {
-						if (isNodeBuiltinImport(source)) throw new Error(`HTTP adapter "${adapter.name}" imports Node module "${source}", which is unavailable in the gateway runtime`);
+						if (isNodeBuiltinImport(source)) throw new Error(`HTTP adapter "${adapter.name}": ${getNodeBuiltinMessage(source)}`);
 						return null;
 					}
 				},
@@ -3965,9 +4283,14 @@ async function bundleAdapterScript(adapter, kind, tsconfig, cache, bundleLogLeve
 						return null;
 					}
 				},
+				createTsconfigPathsPlugin({
+					onTsconfigRead: trackDependency,
+					cache: tsconfigCache
+				}),
 				...cachePlugins
 			];
-			const bundled = (await rolldown.build({
+			const bundleLog = createBundleLog({ tsconfig });
+			const result = await rolldown.build({
 				input: entry.input,
 				write: false,
 				output: {
@@ -3980,8 +4303,10 @@ async function bundleAdapterScript(adapter, kind, tsconfig, cache, bundleLogLeve
 				plugins,
 				transform: { target: "es2017" },
 				treeshake: composeFunctionTreeshakeOptions([createLogLevelTreeshakeOptions(bundleLogLevel)]),
-				logLevel: "silent"
-			})).output[0].code;
+				...bundleLog.options
+			});
+			bundleLog.assertAllResolved();
+			const bundled = result.output[0].code;
 			const byteLength = Buffer.byteLength(bundled, "utf8");
 			if (byteLength > ADAPTER_BUNDLE_ERROR_BYTES) throw new Error(`HTTP adapter "${adapter.name}" ${kind} script is ${byteLength} bytes, exceeding the ${ADAPTER_BUNDLE_ERROR_BYTES} byte limit`);
 			if (byteLength > ADAPTER_BUNDLE_WARN_BYTES) logger.warn(`HTTP adapter "${adapter.name}" ${kind} script is ${byteLength} bytes, larger than the recommended ${ADAPTER_BUNDLE_WARN_BYTES} byte limit`);
@@ -4148,6 +4473,42 @@ function isAsyncFunction(fn) {
 //#endregion
 //#region src/parser/service/resolver/schema.ts
 const QueryTypeSchema = z.union([z.literal("query"), z.literal("mutation")]).describe("GraphQL operation type");
+const ResolverPermissionOperandSchema = z.union([
+	z.strictObject({ user: z.string() }),
+	z.string(),
+	z.boolean()
+]);
+const ResolverPermissionOperatorSchema = z.union([z.literal("="), z.literal("!=")]);
+const isUserOperand = (operand) => typeof operand === "object";
+const KNOWN_USER_OPERAND_TYPES = {
+	_loggedIn: "boolean",
+	id: "string"
+};
+const operandTypeMismatch = (userOperand, otherOperand) => {
+	if (typeof userOperand !== "object") return;
+	const expected = KNOWN_USER_OPERAND_TYPES[userOperand.user];
+	if (expected === void 0 || typeof otherOperand === "object" || typeof otherOperand === expected) return;
+	return {
+		key: userOperand.user,
+		expected
+	};
+};
+const ResolverPermissionConditionSchema = z.tuple([
+	ResolverPermissionOperandSchema,
+	ResolverPermissionOperatorSchema,
+	ResolverPermissionOperandSchema
+]).refine(([left, , right]) => isUserOperand(left) !== isUserOperand(right), "Resolver permission condition must reference a `user` operand on exactly one side (comparing two `user` operands to each other can match on `undefined === undefined`)").superRefine(([left, , right], ctx) => {
+	for (const mismatch of [operandTypeMismatch(left, right), operandTypeMismatch(right, left)]) if (mismatch) ctx.addIssue({
+		code: "custom",
+		message: `\`${mismatch.key}\` must compare to a ${mismatch.expected}`
+	});
+}).readonly();
+const ResolverPermissionPolicySchema = z.strictObject({
+	conditions: z.union([ResolverPermissionConditionSchema, z.array(ResolverPermissionConditionSchema).min(1, "Resolver permission policy must have at least one condition").readonly()]),
+	permit: z.boolean(),
+	description: z.string().optional().describe("Reason recorded for this policy, used in the access-denied error message")
+});
+const ResolverPermissionSchema = z.union([z.array(ResolverPermissionPolicySchema).min(1, "Resolver permission must have at least one policy").refine((policies) => policies.some((policy) => policy.permit === true), "Resolver permission must include at least one `permit: true` policy — a policy array with only `permit: false` policies still lets any caller through by simply not authenticating, since none of the deny conditions apply to a caller with no user attributes at all").readonly(), z.literal("allowAnonymous")]).describe("Access requirement for this resolver, evaluated against the original caller (unaffected by `invoker`) before `body` runs. \"allowAnonymous\" documents that anonymous callers are allowed. Omitted (default): unchanged, anonymous callers can reach the resolver");
 const ResolverSchema = z.strictObject({
 	operation: QueryTypeSchema.describe("GraphQL operation type (query or mutation)"),
 	name: z.string().describe("Resolver name"),
@@ -4156,7 +4517,8 @@ const ResolverSchema = z.strictObject({
 	body: functionSchema.describe("Resolver implementation function"),
 	output: TailorFieldSchema.describe("Output field definition"),
 	publishEvents: z.boolean().optional().describe("Enable publishing events from this resolver"),
-	invoker: AuthInvokerSchema.optional().describe("Machine user to execute this resolver as")
+	invoker: AuthInvokerSchema.optional().describe("Machine user to execute this resolver as"),
+	permission: ResolverPermissionSchema.optional()
 });
 
 //#endregion
@@ -4189,9 +4551,10 @@ async function loadResolver(resolverFilePath) {
 * @param cache - Optional bundle cache for skipping unchanged builds
 * @param inlineSourcemap - Whether to enable inline sourcemaps
 * @param bundleLogLevel - Controls which console calls are kept in bundled code
+* @param tsconfigCache - Optional tsconfig lookup cache shared across bundles in this CLI run
 * @returns Map of resolver name to bundled code
 */
-async function bundleResolvers(namespace, config, baseDir, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+async function bundleResolvers(namespace, config, baseDir, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", tsconfigCache) {
 	const bundledCode = /* @__PURE__ */ new Map();
 	const files = loadFilesWithIgnores(config, baseDir);
 	if (files.length === 0) {
@@ -4209,16 +4572,17 @@ async function bundleResolvers(namespace, config, baseDir, startContext, cache,
 		}
 		resolvers.push({
 			name: resolver.name,
-			sourceFile: file
+			sourceFile: file,
+			permission: resolver.permission
 		});
 	}
 	const tsconfig = await resolveTSConfigWithFallback(baseDir);
-	const results = await withBundleConcurrency(resolvers, (resolver) => bundleSingleResolver(namespace, resolver, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel));
+	const results = await withBundleConcurrency(resolvers, (resolver) => bundleSingleResolver(namespace, resolver, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel, tsconfigCache));
 	for (const [name, code] of results) bundledCode.set(name, code);
 	logger.log(`${styles.success("Bundled")} ${styles.info(`"${namespace}"`)}`);
 	return bundledCode;
 }
-async function bundleSingleResolver(namespace, resolver, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+async function bundleSingleResolver(namespace, resolver, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", tsconfigCache) {
 	const serializedStartContext = serializeStartContext(startContext);
 	const contextHash = computeBundlerContextHash({
 		sourceFile: resolver.sourceFile,
@@ -4234,39 +4598,30 @@ async function bundleSingleResolver(namespace, resolver, tsconfig, startContext,
 		name: resolver.name,
 		sourceFile: resolver.sourceFile,
 		contextHash,
-		async build(cachePlugins) {
+		async build(cachePlugins, trackDependency) {
+			const absoluteSourcePath = path.resolve(resolver.sourceFile);
 			const entryContent = multiline`
-        import _internalResolver from "${path.resolve(resolver.sourceFile)}";
+        import _internalResolver from "${absoluteSourcePath}";
         import { t } from "@tailor-platform/sdk";
 
         const $tailor_resolver_body = async (context) => {
           const invoker = ${INVOKER_EXPR};
-          if (_internalResolver.input) {
-            const result = t.object(_internalResolver.input).parse({
-              value: context.input,
-              data: context.input,
-              invoker,
-            });
-
-            if (result.issues) {
-              throw new TailorErrors(result.issues.map(issue => ({
-                message: issue.message,
-                path: issue.path ?? [],
-              })));
-            }
-          }
-
+          ${buildResolverPermissionAndInputCheckExpr(resolver.permission)}
           return _internalResolver.body({ ...context, invoker });
         };
 
         export { $tailor_resolver_body as main };
       `;
-			const entry = createVirtualEntry(`resolver:${resolver.name}`, entryContent);
+			const entry = createVirtualEntry(`resolver:${resolver.name}`, entryContent, "js", absoluteSourcePath);
 			const startPlugin = createStartTransformPlugin(startContext);
 			const plugins = [entry.plugin];
 			if (startPlugin) plugins.push(startPlugin);
-			plugins.push(platformBundleDefinePlugin, ...cachePlugins);
-			return (await rolldown.build({
+			plugins.push(createTsconfigPathsPlugin({
+				onTsconfigRead: trackDependency,
+				cache: tsconfigCache
+			}), platformBundleDefinePlugin, ...cachePlugins);
+			const bundleLog = createBundleLog({ tsconfig });
+			const result = await rolldown.build({
 				input: entry.input,
 				write: false,
 				output: {
@@ -4278,8 +4633,10 @@ async function bundleSingleResolver(namespace, resolver, tsconfig, startContext,
 				tsconfig,
 				plugins,
 				treeshake: composeFunctionTreeshakeOptions([createLogLevelTreeshakeOptions(bundleLogLevel)]),
-				logLevel: "silent"
-			})).output[0].code;
+				...bundleLog.options
+			});
+			bundleLog.assertAllResolved();
+			return result.output[0].code;
 		}
 	});
 	return [resolver.name, code];
@@ -4479,9 +4836,10 @@ function safeRealpath(p) {
 * @param cache - Optional bundle cache for skipping unchanged builds
 * @param inlineSourcemap - Whether to enable inline sourcemaps
 * @param bundleLogLevel - Controls which console calls are kept in bundled code
+* @param tsconfigCache - Optional tsconfig lookup cache shared across bundles in this CLI run
 * @returns Workflow job bundling result
 */
-async function bundleWorkflowJobs(allJobs, mainJobNames, env = {}, startContext, baseDir, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+async function bundleWorkflowJobs(allJobs, mainJobNames, env = {}, startContext, baseDir, cache, inlineSourcemap, bundleLogLevel = "DEBUG", tsconfigCache) {
 	if (allJobs.length === 0) {
 		logger.warn("No workflow jobs to bundle");
 		return {
@@ -4494,7 +4852,7 @@ async function bundleWorkflowJobs(allJobs, mainJobNames, env = {}, startContext,
 	logger.newline();
 	logger.log(`Bundling ${styles.highlight(usedJobs.length.toString())} files for ${styles.info("\"workflow-job\"")}`);
 	const tsconfig = await resolveTSConfigWithFallback(baseDir);
-	const results = await withBundleConcurrency(usedJobs, (job) => bundleSingleJob(job, usedJobs, tsconfig, env, startContext, cache, inlineSourcemap, bundleLogLevel));
+	const results = await withBundleConcurrency(usedJobs, (job) => bundleSingleJob(job, usedJobs, tsconfig, env, startContext, cache, inlineSourcemap, bundleLogLevel, tsconfigCache));
 	const bundledCode = /* @__PURE__ */ new Map();
 	for (const [name, code] of results) bundledCode.set(name, code);
 	logger.log(`${styles.success("Bundled")} ${styles.info("\"workflow-job\"")}`);
@@ -4570,7 +4928,7 @@ async function filterUsedJobs(allJobs, mainJobNames, startContext) {
 		mainJobDeps
 	};
 }
-async function bundleSingleJob(job, allJobs, tsconfig, env, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG") {
+async function bundleSingleJob(job, allJobs, tsconfig, env, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", tsconfigCache) {
 	const serializedStartContext = serializeStartContext(startContext);
 	const sortedEnvPrefix = JSON.stringify(Object.fromEntries(Object.entries(env).toSorted(([a], [b]) => a.localeCompare(b))));
 	const contextHash = computeBundlerContextHash({
@@ -4587,7 +4945,7 @@ async function bundleSingleJob(job, allJobs, tsconfig, env, startContext, cache,
 		name: job.name,
 		sourceFile: job.sourceFile,
 		contextHash,
-		async build(cachePlugins) {
+		async build(cachePlugins, trackDependency) {
 			const absoluteSourcePath = path.resolve(job.sourceFile);
 			const entryContent = multiline`
         import { ${job.exportName} } from "${absoluteSourcePath}";
@@ -4598,7 +4956,7 @@ async function bundleSingleJob(job, allJobs, tsconfig, env, startContext, cache,
           return await ${job.exportName}.body(input, { env, invoker });
         }
       `;
-			const entry = createVirtualEntry(`workflow-job:${job.name}`, entryContent);
+			const entry = createVirtualEntry(`workflow-job:${job.name}`, entryContent, "js", absoluteSourcePath);
 			const resolvedSourceFile = safeRealpath(job.sourceFile);
 			const otherJobExportNames = allJobs.filter((candidate) => candidate.name !== job.name && safeRealpath(candidate.sourceFile) === resolvedSourceFile).map((j) => j.exportName);
 			const plugins = [
@@ -4617,10 +4975,15 @@ async function bundleSingleJob(job, allJobs, tsconfig, env, startContext, cache,
 						}
 					}
 				},
+				createTsconfigPathsPlugin({
+					onTsconfigRead: trackDependency,
+					cache: tsconfigCache
+				}),
 				platformBundleDefinePlugin,
 				...cachePlugins
 			];
-			return (await rolldown.build({
+			const bundleLog = createBundleLog({ tsconfig });
+			const result = await rolldown.build({
 				input: entry.input,
 				write: false,
 				output: {
@@ -4632,8 +4995,10 @@ async function bundleSingleJob(job, allJobs, tsconfig, env, startContext, cache,
 				tsconfig,
 				plugins,
 				treeshake: composeFunctionTreeshakeOptions([createLogLevelTreeshakeOptions(bundleLogLevel)]),
-				logLevel: "silent"
-			})).output[0].code;
+				...bundleLog.options
+			});
+			bundleLog.assertAllResolved();
+			return result.output[0].code;
 		}
 	});
 	return [job.name, code];
@@ -4644,7 +5009,8 @@ async function bundleSingleJob(job, allJobs, tsconfig, env, startContext, cache,
 const WorkflowJobSchema = z.strictObject({
 	name: z.string().describe("Job name (must be unique across the project)"),
 	start: functionSchema.describe("Start function that initiates the job"),
-	body: functionSchema.describe("Job implementation function")
+	body: functionSchema.describe("Job implementation function"),
+	publishEvents: z.boolean().optional().describe("Enable publishing job execution events for this job")
 });
 const durationUnits = [
 	"ms",
@@ -4680,7 +5046,7 @@ const RetryPolicySchema = z.strictObject({
 });
 const ConcurrencyPolicySchema = z.strictObject({ maxConcurrentExecutions: z.number().int().min(1).max(1e3).describe("Maximum number of concurrent executions (1-1000)") });
 const ExecutionPolicyNameSchema = z.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/, "Invalid execution policy name: must match [a-z0-9-] (3-63 chars; must start and end with [a-z0-9])").describe("Workspace-unique execution policy name embedded in the resource TRN");
-const ExecutionPolicyKeySchema = z.string().regex(/^[a-z0-9][a-z0-9_:.-]{0,62}[a-z0-9*]$/, "Invalid execution policy key: must match [a-z0-9_:.-] (2-64 chars; must start with [a-z0-9] and end with [a-z0-9] or a trailing '*')").describe("Execution policy key passed to startJobFunction's executionPolicyKey option");
+const ExecutionPolicyKeySchema = z.string().regex(/^[a-z0-9][a-z0-9_:.-]{0,62}[a-z0-9*]$/, "Invalid execution policy key: must match [a-z0-9_:.-] (2-64 chars; must start with [a-z0-9] and end with [a-z0-9] or a trailing '*')").describe("Execution policy key passed to execJobFunction's executionPolicyKey option");
 const WorkflowJobFunctionExecutionPolicySchema = z.strictObject({
 	name: ExecutionPolicyNameSchema,
 	key: ExecutionPolicyKeySchema,
@@ -4690,7 +5056,8 @@ const WorkflowSchema = z.strictObject({
 	name: z.string().describe("Workflow name"),
 	mainJob: WorkflowJobSchema.describe("Main job that starts the workflow"),
 	retryPolicy: RetryPolicySchema.optional().describe("Retry policy for the workflow"),
-	concurrencyPolicy: ConcurrencyPolicySchema.optional().describe("Concurrency policy for the workflow")
+	concurrencyPolicy: ConcurrencyPolicySchema.optional().describe("Concurrency policy for the workflow"),
+	publishEvents: z.boolean().optional().describe("Enable publishing workflow execution events for this workflow")
 });
 
 //#endregion
@@ -4817,7 +5184,8 @@ async function loadFileContent(filePath) {
 			if (jobResult.success) jobs.push({
 				name: jobResult.data.name,
 				exportName,
-				sourceFile: filePath
+				sourceFile: filePath,
+				...jobResult.data.publishEvents !== void 0 ? { publishEvents: jobResult.data.publishEvents } : {}
 			});
 			else if (isSdkBranded(exportValue, ["workflow", "workflow-job"])) throw jobResult.error;
 		}
@@ -5044,7 +5412,7 @@ const IdPSchema = z.strictObject({
 	clients: z.array(z.string()).describe("OAuth2 client names that can use this IdP"),
 	lang: IdPLangSchema.optional().describe("UI language for IdP pages"),
 	userAuthPolicy: IdPUserAuthPolicySchema.transform((input) => IdPUserAuthPolicySchema.parse(input ?? {})).optional().describe("User authentication policy configuration"),
-	publishUserEvents: z.boolean().optional().describe("Enable publishing user lifecycle events"),
+	publishEvents: z.boolean().optional().describe("Enable publishing user lifecycle events"),
 	gqlOperations: IdPGqlOperationsSchema.optional().describe("Configure which GraphQL operations are enabled"),
 	emailConfig: IdPEmailConfigSchema.optional().describe("Namespace-level email configuration defaults"),
 	permission: IdPPermissionSchema.optional().describe("Per-operation permission policies for IdP users")
@@ -5375,6 +5743,7 @@ async function loadApplication(params) {
 	}), baseDir);
 	const inlineSourcemap = resolveInlineSourcemap(config.inlineSourcemap);
 	const bundleLogLevel = resolveBundleLogLevel(config.logLevel);
+	const tsconfigCache = createTsconfigLookupCache();
 	const bundledScripts = {
 		resolvers: /* @__PURE__ */ new Map(),
 		executors: /* @__PURE__ */ new Map(),
@@ -5382,7 +5751,7 @@ async function loadApplication(params) {
 		authHooks: /* @__PURE__ */ new Map()
 	};
 	for (const pipeline of resolverResult.resolverServices) {
-		const resolverBundles = await bundleResolvers(pipeline.namespace, pipeline.config, baseDir, startContext, bundleCache, inlineSourcemap, bundleLogLevel);
+		const resolverBundles = await bundleResolvers(pipeline.namespace, pipeline.config, baseDir, startContext, bundleCache, inlineSourcemap, bundleLogLevel, tsconfigCache);
 		for (const [name, code] of resolverBundles) bundledScripts.resolvers.set(resolverBundleKey(pipeline.namespace, name), code);
 	}
 	if (executorService) bundledScripts.executors = await bundleExecutors({
@@ -5392,12 +5761,13 @@ async function loadApplication(params) {
 		cache: bundleCache,
 		inlineSourcemap,
 		bundleLogLevel,
-		baseDir
+		baseDir,
+		tsconfigCache
 	});
 	let workflowBuildResult;
 	if (workflowService && workflowService.jobs.length > 0) {
 		const mainJobNames = workflowService.workflowSources.map((ws) => ws.workflow.mainJob.name);
-		workflowBuildResult = await bundleWorkflowJobs(workflowService.jobs, mainJobNames, config.env ?? {}, startContext, baseDir, bundleCache, inlineSourcemap, bundleLogLevel);
+		workflowBuildResult = await bundleWorkflowJobs(workflowService.jobs, mainJobNames, config.env ?? {}, startContext, baseDir, bundleCache, inlineSourcemap, bundleLogLevel, tsconfigCache);
 		bundledScripts.workflowJobs = workflowBuildResult.bundledCode;
 	}
 	let httpAdapterBuildResult;
@@ -5406,7 +5776,7 @@ async function loadApplication(params) {
 		sourceFile: a.sourceFile,
 		methods: a.methods,
 		hasOutput: a.hasOutput
-	})), baseDir, bundleCache, bundleLogLevel);
+	})), baseDir, bundleCache, bundleLogLevel, tsconfigCache);
 	if (authResult.authService?.config.hooks?.beforeLogin) {
 		const authName = authResult.authService.config.name;
 		bundledScripts.authHooks = await bundleAuthHooks({
@@ -5418,7 +5788,8 @@ async function loadApplication(params) {
 			cache: bundleCache,
 			inlineSourcemap,
 			bundleLogLevel,
-			baseDir
+			baseDir,
+			tsconfigCache
 		});
 	}
 	for (const pipeline of resolverResult.resolverServices) await pipeline.loadResolvers();
@@ -5452,5 +5823,5 @@ async function loadApplication(params) {
 }
 
 //#endregion
-export { fetchAllTolerant as A, initOperatorClient as B, createBundleCache as C, closeConnectionPool as D, hashFile as E, getConsoleBaseUrl as F, byName as G, normalizeBaseUrl as H, getOAuth2ClientId as I, LOG_LEVELS as K, getOrNull as L, fetchPaged as M, fetchPlatformMachineUserToken as N, defaultPlatformBaseUrl as O, fetchUserInfo as P, getPlatformBaseUrl as R, hasGenerationHooks as S, hashContent as T, rememberPlatformConfigForToken as U, isDefaultPlatform as V, resolveStaticWebsiteUrls as W, platformBundleDefinePlugin as _, resolveInlineSourcemap as a, resolveBundleLogLevel as b, WorkflowJobSchema as c, INVOKER_EXPR as d, buildExecutorArgsExpr as f, stringifyFunction as g, assertUniqueTailorDBTypeNamesWithExternal as h, resolverBundleKey as i, fetchMachineUserToken as j, fetchAll as k, ResolverSchema as l, assertUniqueLocalTailorDBTypeNames as m, generatePluginFilesIfNeeded as n, getApplicationAuthNamespace as o, buildResolverOperationHookExpr as p, loadApplication as r, WorkflowJobFunctionExecutionPolicySchema as s, defineApplication as t, HTTP_METHODS as u, composeFunctionTreeshakeOptions as v, getDistDir as w, getPluginGenerationDependencies as x, createLogLevelTreeshakeOptions as y, initOAuth2Client as z };
-//# sourceMappingURL=application-D_oSqto2.mjs.map
+export { LOG_LEVELS as $, hashContent as A, getConsoleBaseUrl as B, createLogLevelTreeshakeOptions as C, hasGenerationHooks as D, getPluginGenerationDependencies as E, fetchAllTolerant as F, initOperatorClient as G, getOrNull as H, fetchMachineUserToken as I, normalizeBaseUrl as J, isDefaultPlatform as K, fetchPaged as L, closeConnectionPool as M, defaultPlatformBaseUrl as N, createBundleCache as O, fetchAll as P, createApplyLimiter as Q, fetchPlatformMachineUserToken as R, composeFunctionTreeshakeOptions as S, createBundleLog as T, getPlatformBaseUrl as U, getOAuth2ClientId as V, initOAuth2Client as W, resolveStaticWebsiteUrls as X, rememberPlatformConfigForToken as Y, byName as Z, stringifyFunction as _, resolveInlineSourcemap as a, resolveTSConfigWithFallback as b, WorkflowJobSchema as c, INVOKER_EXPR as d, buildExecutorArgsExpr as f, assertUniqueTailorDBTypeNamesWithExternal as g, assertUniqueLocalTailorDBTypeNames as h, resolverBundleKey as i, hashFile as j, getDistDir as k, ResolverSchema as l, buildResolverPermissionAndInputCheckExpr as m, generatePluginFilesIfNeeded as n, getApplicationAuthNamespace as o, buildResolverOperationHookExpr as p, isNotFoundError as q, loadApplication as r, WorkflowJobFunctionExecutionPolicySchema as s, defineApplication as t, HTTP_METHODS as u, createGeneratedEntryResolverPlugin as v, resolveBundleLogLevel as w, platformBundleDefinePlugin as x, createTsconfigPathsPlugin as y, fetchUserInfo as z };
+//# sourceMappingURL=application-CM6hKnSK.mjs.map