@tailor-platform/sdk 2.2.0 → 2.4.0

package/dist/{application-BpLeawBg.mjs → application-C8a0UJ-z.mjs}

@@ -1,10 +1,11 @@
 import { n as isSdkBranded } from "./brand-Eo4pLXPJ.mjs";
+import { n as getScopedWaitPoints } from "./wait-point-registry-TL99zotw.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
-import { a as parseBoolean, n as logger, r as styles } from "./logger-DSdExfor.mjs";
-import { a as AuthConfigSchema, c as stripTailorDBTypeBuilderHelpers, d as applyRelationMetadataToFieldConfig, f as buildRelationInfo, g as functionSchema, h as loadFilesWithIgnores, l as TailorDBServiceConfigSchema, m as validateRelationConfig, n as loadExecutor, o as AuthInvokerSchema, p as processRelationMetadata, s as TailorFieldSchema, t as createExecutorService, u as TailorDBTypeSchema } from "./service-goqlJJgA.mjs";
+import { a as parseBoolean, n as logger, r as styles } from "./logger-D0bEznPv.mjs";
+import { a as AuthConfigSchema, b as functionSchema, c as stripTailorDBTypeBuilderHelpers, d as applyRelationMetadataToFieldConfig, f as buildRelationInfo, h as loadFilesWithIgnores, l as TailorDBServiceConfigSchema, m as validateRelationConfig, n as loadExecutor, o as AuthInvokerSchema, p as processRelationMetadata, s as TailorFieldSchema, t as createExecutorService, u as TailorDBTypeSchema, y as importUserModule } from "./service-2grcAOCJ.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { t as userAgent } from "./user-agent-Bgsszb5I.mjs";
-import { t as createCLIError } from "./errors-CWj21238.mjs";
+import { t as createCLIError } from "./errors-Bxut5_Sy.mjs";
 import { n as isNodeBuiltinImport, t as getNodeBuiltinMessage } from "./node-builtins-CmaL2Cbq.mjs";
 import { t as isPluginGeneratedType } from "./type-source-DH_LH20p.mjs";
 import { createRequire } from "node:module";
@@ -16,7 +17,6 @@ import { create } from "@bufbuild/protobuf";
 import * as fs from "node:fs";
 import { readFileSync } from "node:fs";
 import { MethodOptions_IdempotencyLevel } from "@bufbuild/protobuf/wkt";
-import { pathToFileURL } from "node:url";
 import { OAuth2Client } from "@badgateway/oauth2-client";
 import { Code, ConnectError, createClient } from "@connectrpc/connect";
 import pLimit from "p-limit";
@@ -191,7 +191,8 @@ async function initOperatorClient(accessToken, config) {
 		createTracingInterceptor(),
 		concurrencyLimitInterceptor()
 	];
-	return createClient(OperatorService, await createTransport(getPlatformBaseUrl(platformConfig), interceptors));
+	const transport = await createTransport(getPlatformBaseUrl(platformConfig), interceptors);
+	return createClient(OperatorService, transport);
 }
 /**
 * Create a Connect transport using connect-node (HTTP/2).
@@ -253,7 +254,7 @@ function retryInterceptor() {
 	return (next) => async (req) => {
 		if (req.stream) return await next(req);
 		let lastError;
-		for (let i = 0; i < 3; i++) {
+		for (let i = 0; i < MAX_RETRY_ATTEMPTS; i++) {
 			if (i > 0) await waitRetryBackoff(i);
 			try {
 				return await next(req);
@@ -263,7 +264,7 @@ function retryInterceptor() {
 						logger.debug(`retry: ${req.method.name} returned AlreadyExists on attempt ${i + 1}; treating as success (prior attempt likely committed)`);
 						return synthesizeEmptyUnaryResponse(req);
 					}
-					const { reportCrash } = await import("./crashreport-CINZ5dVN.mjs");
+					const { reportCrash } = await import("./crashreport-Cd4TqfZq.mjs");
 					await reportCrash(error, "handledError");
 				}
 				if (req.method.name !== "CreateWorkspace" && isRetirable(error, req.method.idempotency)) {
@@ -397,6 +398,8 @@ function synthesizeEmptyUnaryResponse(req) {
 * response was lost), which is what triggers the `already_exists` race.
 */
 const RETRY_BASE_DELAY_MS = 500;
+/** Maximum number of attempts, including the initial one, for a retried request. */
+const MAX_RETRY_ATTEMPTS = 3;
 /**
 * Wait for an exponential backoff delay with jitter.
 * @param attempt - Current retry attempt number (1-based)
@@ -424,6 +427,7 @@ function isRetirable(error, idempotency) {
 }
 /**
 * Create an interceptor that enhances error messages from the Operator API.
+* @internal
 * @returns Error handling interceptor
 */
 function errorHandlingInterceptor() {
@@ -433,8 +437,8 @@ function errorHandlingInterceptor() {
 		} catch (error) {
 			if (error instanceof ConnectError) {
 				const { operation, resourceType } = parseMethodName(req.method.name);
-				const requestParams = formatRequestParams(req.message);
-				throw new ConnectError(`Failed to ${operation} ${resourceType}: ${error.rawMessage}\nRequest: ${requestParams}`, error.code, error.metadata);
+				const identity = formatRequestIdentity(req.message, req.method.name);
+				throw new ConnectError(`Failed to ${operation} ${resourceType}${identity}: ${error.rawMessage}`, error.code, error.metadata);
 			}
 			throw error;
 		}
@@ -457,28 +461,45 @@ function parseMethodName(methodName) {
 		resourceType: resource
 	};
 }
-/**
-* JSON.stringify replacer that converts BigInt values to strings.
-* @param _key - Object key (unused)
-* @param value - Value to serialize
-* @returns Serializable value
-*/
-function bigIntReplacer(_key, value) {
-	if (typeof value === "bigint") return value.toString();
-	return value;
+const IDENTITY_KEYS = /* @__PURE__ */ new Set(["name", "id"]);
+const IDENTITY_KEY_SUFFIXES = [
+	"Name",
+	"Id",
+	"Namespace"
+];
+const NESTED_IDENTITY_KEY = "name";
+const METHOD_IDENTITY_KEYS = {
+	GetMetadata: ["trn"],
+	SetMetadata: ["trn"],
+	AddCustomDomain: ["domain"],
+	GetCustomDomain: ["domain"],
+	RemoveCustomDomain: ["domain"],
+	CreateWorkflowJobFunctionExecutionPolicy: ["executionPolicyKey"],
+	UpdateWorkflowJobFunctionExecutionPolicy: ["executionPolicyKey"],
+	GetWorkflowJobFunctionExecutionPolicyByKey: ["executionPolicyKey"]
+};
+function isIdentityKey(key, methodName) {
+	if (key.startsWith("$")) return false;
+	return IDENTITY_KEYS.has(key) || IDENTITY_KEY_SUFFIXES.some((suffix) => key.endsWith(suffix)) || (METHOD_IDENTITY_KEYS[methodName]?.includes(key) ?? false);
 }
 /**
-* @internal
-* @param message - Request message to format
-* @returns Pretty-printed JSON or error placeholder
-*/
-function formatRequestParams(message) {
-	try {
-		if (message && typeof message === "object" && "toJson" in message) return JSON.stringify(message.toJson(), bigIntReplacer, 2);
-		return JSON.stringify(message, bigIntReplacer, 2);
-	} catch {
-		return "(unable to serialize request)";
+* Format an allowlisted identity suffix for enhanced error messages.
+*
+* Only resource identifiers are included — the rest of the request payload
+* can carry credentials and must never reach terminal or CI logs.
+* @param message - Request message to extract identifiers from
+* @param methodName - RPC method name used to resolve method-scoped identifiers
+* @returns Identity suffix like " (namespaceName: x, type.name: y)", or an empty string
+*/
+function formatRequestIdentity(message, methodName) {
+	if (typeof message !== "object" || message === null) return "";
+	const parts = [];
+	for (const [key, value] of Object.entries(message)) if (typeof value === "string" && value !== "" && isIdentityKey(key, methodName)) parts.push(`${key}: ${value}`);
+	else if (!key.startsWith("$") && value !== null && typeof value === "object" && !Array.isArray(value) && typeof value.$typeName === "string") {
+		const nestedName = value[NESTED_IDENTITY_KEY];
+		if (typeof nestedName === "string" && nestedName !== "") parts.push(`${key}.${NESTED_IDENTITY_KEY}: ${nestedName}`);
 	}
+	return parts.length === 0 ? "" : ` (${parts.join(", ")})`;
 }
 const MAX_PAGE_SIZE = 1e3;
 /**
@@ -631,14 +652,15 @@ async function fetchMachineUserToken(url, clientId, clientSecret) {
 	formData.append("grant_type", "client_credentials");
 	formData.append("client_id", clientId);
 	formData.append("client_secret", clientSecret);
-	const resp = await fetch(tokenEndpoint, {
+	const request = {
 		method: "POST",
 		headers: {
 			"User-Agent": await userAgent(),
 			"Content-Type": "application/x-www-form-urlencoded"
 		},
 		body: formData
-	});
+	};
+	const resp = await withConnectTimeoutRetry("machine user token request", () => fetch(tokenEndpoint, request));
 	if (!resp.ok) {
 		const body = await resp.text().catch(() => "");
 		throw new Error(`Failed to fetch machine user token: ${resp.status} ${resp.statusText} ${body.slice(0, 500)}`);
@@ -650,6 +672,29 @@ async function fetchMachineUserToken(url, clientId, clientSecret) {
 		expires_in: z.number()
 	}).parse(rawJson);
 }
+function isUndiciConnectTimeout(error) {
+	if (!(error instanceof TypeError)) return false;
+	const cause = error.cause;
+	return cause instanceof Error && "code" in cause && cause.code === "UND_ERR_CONNECT_TIMEOUT";
+}
+/**
+* Retry a request that failed before the connection was established.
+*
+* Only `UND_ERR_CONNECT_TIMEOUT` is retried: the request provably never reached
+* the server, so replaying it cannot duplicate a server-side effect.
+* @param label - Request description for the retry debug log
+* @param send - Sends the request; called once per attempt
+* @returns The first successful result
+*/
+async function withConnectTimeoutRetry(label, send) {
+	for (let attempt = 1;; attempt++) try {
+		return await send();
+	} catch (error) {
+		if (!isUndiciConnectTimeout(error) || attempt >= MAX_RETRY_ATTEMPTS) throw error;
+		logger.debug(`retry: ${label} attempt ${attempt} failed with UND_ERR_CONNECT_TIMEOUT; retrying`);
+		await waitRetryBackoff(attempt);
+	}
+}
 /**
 * Fetch an OAuth2 token for a platform machine user via client_credentials grant.
 * @param clientId - Client ID for the platform machine user
@@ -658,12 +703,13 @@ async function fetchMachineUserToken(url, clientId, clientSecret) {
 * @returns OAuth2 token
 */
 async function fetchPlatformMachineUserToken(clientId, clientSecret, config) {
-	return await new OAuth2Client({
+	const server = getPlatformBaseUrl(config);
+	return await withConnectTimeoutRetry("platform machine user token request", () => new OAuth2Client({
 		clientId,
 		clientSecret,
-		server: getPlatformBaseUrl(config),
+		server,
 		discoveryEndpoint: oauth2DiscoveryEndpoint
-	}).clientCredentials();
+	}).clientCredentials());
 }
 /**
 * Close the global HTTP connection pool to prevent libuv UV_HANDLE_CLOSING
@@ -950,7 +996,7 @@ function isPluginExecutorWithFile(executor) {
 * @param executors - Array of plugin executor information
 * @param outputDir - Base output directory (e.g., .tailor)
 * @param typeGenerationResult - Result from plugin type generation (for import resolution)
-* @param sourceTypeInfoMap - Map of source type names to their source info
+* @param sourceTypeInfoMap - Map of source table names to their source info
 * @param configPath - Path to tailor.config.ts (used for resolving plugin import paths)
 * @returns Array of generated file paths
 */
@@ -971,7 +1017,7 @@ function generatePluginExecutorFiles(executors, outputDir, typeGenerationResult,
 * @param info - Plugin executor metadata and definition
 * @param outputDir - Base output directory (e.g., .tailor)
 * @param typeGenerationResult - Result from plugin type generation
-* @param sourceTypeInfoMap - Map of source type names to their source info
+* @param sourceTypeInfoMap - Map of source table names to their source info
 * @param baseDirs - Base directories for resolving plugin import paths
 * @returns Absolute path to the generated file
 */
@@ -994,7 +1040,7 @@ function generateSingleExecutorFile(info, outputDir, typeGenerationResult, sourc
 * @param executor - Executor definition with resolve
 * @param outputDir - Base output directory
 * @param typeGenerationResult - Result from plugin type generation
-* @param sourceTypeInfoMap - Map of source type names to their source info
+* @param sourceTypeInfoMap - Map of source table names to their source info
 * @param baseDirs - Base directories for resolving plugin import paths
 * @returns TypeScript source code for executor file
 */
@@ -1029,7 +1075,7 @@ function generateExecutorFileContentNew(info, executor, outputDir, typeGeneratio
 * @param outputDir - Base output directory for generated files
 * @param pluginId - Plugin identifier used for output paths
 * @param typeGenerationResult - Result from plugin type generation
-* @param sourceTypeInfoMap - Map of source type names to their source info
+* @param sourceTypeInfoMap - Map of source table names to their source info
 * @returns Map of context keys to their import information
 */
 function collectTypeImports(context, outputDir, pluginId, typeGenerationResult, sourceTypeInfoMap) {
@@ -1076,9 +1122,9 @@ function generateContextCode(context, typeImports) {
 	return `{\n${entries.join(",\n")},\n}`;
 }
 /**
-* Check if a value is a TailorDB type object.
+* Check if a value is a TailorDB table object.
 * @param value - Value to inspect
-* @returns True if value is a type object with name and fields
+* @returns True if value is a table object with name and fields
 */
 function isTypeObject(value) {
 	return typeof value === "object" && value !== null && "name" in value && "fields" in value && typeof value.name === "string";
@@ -1276,15 +1322,15 @@ function toKebabCase$1(str) {
 /**
 * Plugin Type Generator
 *
-* Generates TypeScript files for plugin-generated types (TailorDB types).
-* These files can be imported by plugin executors to reference generated types.
+* Generates TypeScript files for plugin-generated types (TailorDB tables).
+* These files can be imported by plugin executors to reference generated tables.
 */
 function isFieldDefinition(value) {
 	return typeof value === "object" && value !== null;
 }
 /**
-* Generate TypeScript files for plugin-generated types.
-* These files export the type definition and can be imported by executor files.
+* Generate TypeScript files for plugin-generated tables.
+* These files export the table definition and can be imported by executor files.
 * @param types - Array of plugin type information
 * @param outputDir - Base output directory (e.g., .tailor)
 * @returns Generation result with file paths
@@ -1299,7 +1345,7 @@ function generatePluginTypeFiles(types, outputDir) {
 	const seenTypeNames = /* @__PURE__ */ new Map();
 	for (const info of types) {
 		const existing = seenTypeNames.get(info.type.name);
-		if (existing) throw new Error(`Duplicate plugin-generated type name "${info.type.name}" detected. First: plugin "${existing.pluginId}" (kind: "${existing.kind}", source type: "${existing.sourceTypeName}"), Second: plugin "${info.pluginId}" (kind: "${info.kind}", source type: "${info.sourceTypeName}"). Plugin-generated type names must be unique.`);
+		if (existing) throw new Error(`Duplicate plugin-generated table name "${info.type.name}" detected. First: plugin "${existing.pluginId}" (kind: "${existing.kind}", source: "${existing.sourceTypeName}"), Second: plugin "${info.pluginId}" (kind: "${info.kind}", source: "${info.sourceTypeName}"). Plugin-generated table names must be unique.`);
 		seenTypeNames.set(info.type.name, info);
 		const pluginDir = sanitizePluginId(info.pluginId);
 		const typeOutputDir = path.join(outputDir, pluginDir, "types");
@@ -1330,8 +1376,8 @@ function generateTypeFileContent(info) {
 	const fieldsCode = generateFieldsCode(type);
 	return multiline`
     /**
-     * Auto-generated type by plugin: ${pluginId}
-     * Source type: ${sourceTypeName}
+     * Auto-generated table by plugin: ${pluginId}
+     * Source: ${sourceTypeName}
      * Kind: ${kind}
      *
      * DO NOT EDIT - This file is generated by @tailor-platform/sdk
@@ -1345,8 +1391,8 @@ function generateTypeFileContent(info) {
 }
 /**
 * Generate TypeScript code for field definitions.
-* This creates a simplified version of the type's fields.
-* @param type - TailorDB type
+* This creates a simplified version of the table's fields.
+* @param type - TailorDB table
 * @returns TypeScript code for fields object
 */
 function generateFieldsCode(type) {
@@ -1359,7 +1405,7 @@ function generateFieldsCode(type) {
 	return `{\n${fieldEntries.join(",\n")},\n}`;
 }
 /**
-* Map from TailorDB type to SDK method name.
+* Map from TailorDB table to SDK method name.
 */
 const typeToMethodMap = {
 	string: "string",
@@ -1602,7 +1648,8 @@ function collectSdkBindings(program, functionName) {
 		if (nodeType === "VariableDeclaration") {
 			const varDecl = node;
 			for (const decl of varDecl.declarations) {
-				const source = getImportSource(unwrapAwait(decl.init));
+				const init = unwrapAwait(decl.init);
+				const source = getImportSource(init);
 				if (source && isTailorSdkSource(source)) {
 					const id = decl.id;
 					if (id.type === "Identifier") bindings.add(`__namespace__:${id.name}`);
@@ -1732,7 +1779,8 @@ function findAllWorkflows(program, _sourceText) {
 			const args = node.arguments;
 			const firstArg = args[0];
 			if (args.length >= 1 && firstArg?.type === "ObjectExpression") {
-				const nameProp = findProperty(assertDefined(firstArg, "createWorkflow first argument missing").properties, "name");
+				const configObj = assertDefined(firstArg, "createWorkflow first argument missing");
+				const nameProp = findProperty(configObj.properties, "name");
 				if (nameProp && isStringLiteral(nameProp.value)) {
 					let exportName;
 					let isDefaultExport = false;
@@ -2055,10 +2103,12 @@ function transformStartCalls(source, startContext, currentFilePath) {
 		let transformedCall;
 		if (call.kind === "workflow") {
 			let optionsPart = "";
-			if (call.optionsText !== void 0) if (authNamespace) {
-				optionsPart = `, ${NORMALIZER_IDENTIFIER}(${call.optionsText})`;
-				needsNormalizerHelper = true;
-			} else optionsPart = `, ${call.optionsText}`;
+			if (call.optionsText !== void 0) {
+				if (authNamespace) {
+					optionsPart = `, ${NORMALIZER_IDENTIFIER}(${call.optionsText})`;
+					needsNormalizerHelper = true;
+				} else optionsPart = `, ${call.optionsText}`;
+			}
 			transformedCall = `tailor.workflow.startWorkflow(${JSON.stringify(call.targetName)}, ${call.argsText || "undefined"}${optionsPart})`;
 		} else {
 			const optionsPart = call.optionsText !== void 0 ? `, ${call.optionsText}` : "";
@@ -2112,11 +2162,14 @@ function createBundleLog(options = {}) {
 }
 function unresolvedImportError(logs, tsconfig) {
 	const imports = logs.map(formatUnresolvedImport);
+	const message = imports.length === 1 ? `Could not resolve ${imports[0]}.` : `Could not resolve ${imports.length} imports.`;
+	const details = imports.length === 1 ? void 0 : imports.map((item) => `- ${item}`).join("\n");
+	const suggestion = unresolvedImportSuggestion(logs, tsconfig);
 	return createCLIError({
 		code: "UNRESOLVED_IMPORT",
-		message: imports.length === 1 ? `Could not resolve ${imports[0]}.` : `Could not resolve ${imports.length} imports.`,
-		details: imports.length === 1 ? void 0 : imports.map((item) => `- ${item}`).join("\n"),
-		suggestion: unresolvedImportSuggestion(logs, tsconfig)
+		message,
+		details,
+		suggestion
 	});
 }
 function unresolvedImportSuggestion(logs, tsconfig) {
@@ -2417,19 +2470,22 @@ async function bundleAuthHooks(options) {
 	const absoluteConfigPath = path.resolve(configPath);
 	const tsconfig = await resolveTSConfigWithFallback(baseDir);
 	const functionName = `auth-hook--${authName}--before-login`;
+	const serializedStartContext = serializeStartContext(startContext);
+	const sortedEnvPrefix = JSON.stringify(Object.fromEntries(Object.entries(env).toSorted(([a], [b]) => a.localeCompare(b))));
+	const contextHash = computeBundlerContextHash({
+		sourceFile: absoluteConfigPath,
+		extraContext: serializedStartContext,
+		tsconfig,
+		inlineSourcemap,
+		bundleLogLevel,
+		prefix: sortedEnvPrefix
+	});
 	const code = await withCache({
 		cache,
 		kind: "auth-hook",
 		name: functionName,
 		sourceFile: absoluteConfigPath,
-		contextHash: computeBundlerContextHash({
-			sourceFile: absoluteConfigPath,
-			extraContext: serializeStartContext(startContext),
-			tsconfig,
-			inlineSourcemap,
-			bundleLogLevel,
-			prefix: JSON.stringify(Object.fromEntries(Object.entries(env).toSorted(([a], [b]) => a.localeCompare(b))))
-		}),
+		contextHash,
 		async build(cachePlugins, trackDependency) {
 			const entryContent = multiline`
         import _config from "${absoluteConfigPath}";
@@ -2579,6 +2635,7 @@ const tailorPrincipalMap = makePrincipalExpr({
 		attributeList: "$raw.attributes ?? []"
 	}
 });
+const PRINCIPAL_VAR = "_principal";
 /**
 * Parse `wrapped` and return the first property of the top-level parenthesized
 * object expression, or `undefined` if it does not parse as one.
@@ -2630,17 +2687,20 @@ function formatScriptContext(kind, context) {
 const convertToScriptExpr = (fn, kind, context) => {
 	const precompiledExpr = getPrecompiledScriptExpr(fn);
 	if (precompiledExpr) return precompiledExpr;
-	return assertParsableExpression(`(${stringifyFunction(fn)})(${kind === "validate" ? `{ value: _value }` : kind === "hooks.create" ? `{ input: _value, invoker: ${tailorPrincipalMap}, now: _now }` : `{ input: _value, oldValue: _oldValue, invoker: ${tailorPrincipalMap}, now: _now }`})`, formatScriptContext(kind, context));
+	const normalized = stringifyFunction(fn);
+	return assertParsableExpression(`(${normalized})(${kind === "validate" ? `{ value: _value }` : kind === "hooks.create" ? `{ input: _value, invoker: ${PRINCIPAL_VAR}, now: _now }` : `{ input: _value, oldValue: _oldValue, invoker: ${PRINCIPAL_VAR}, now: _now }`})`, formatScriptContext(kind, context));
 };
 const convertTypeHookToExpr = (fn) => {
 	const precompiledExpr = getPrecompiledScriptExpr(fn);
 	if (precompiledExpr) return precompiledExpr;
-	return assertParsableExpression(`(${stringifyFunction(fn)})({ input: _input, oldRecord: _oldRecord, invoker: ${tailorPrincipalMap}, now: _now })`, "type-hook");
+	const normalized = stringifyFunction(fn);
+	return assertParsableExpression(`(${normalized})({ input: _input, oldRecord: _oldRecord, invoker: ${PRINCIPAL_VAR}, now: _now })`, "type-hook");
 };
 const convertTypeValidateToExpr = (fn) => {
 	const precompiledExpr = getPrecompiledScriptExpr(fn);
 	if (precompiledExpr) return precompiledExpr;
-	return assertParsableExpression(`(${stringifyFunction(fn)})({ newRecord: _newRecord, oldRecord: _oldRecord, invoker: ${tailorPrincipalMap} }, __issues)`, "type-validate");
+	const normalized = stringifyFunction(fn);
+	return assertParsableExpression(`(${normalized})({ newRecord: _newRecord, oldRecord: _oldRecord, invoker: ${PRINCIPAL_VAR} }, __issues)`, "type-validate");
 };
 /**
 * Parse TailorDBField into OperatorFieldConfig.
@@ -2653,8 +2713,8 @@ function parseFieldConfig(field, context) {
 	const metadata = field.metadata;
 	const fieldType = field.type;
 	const rawRelation = field.rawRelation;
-	if (context && context.fieldPath.length > 1 && metadata.default !== void 0) throw new Error(`Field "${context.fieldPath.join(".")}" on type "${context.typeName}": .default() cannot be used on nested inner fields`);
-	if (context && context.fieldPath.length > 1 && metadata.hooks) throw new Error(`Field "${context.fieldPath.join(".")}" on type "${context.typeName}": .hooks() cannot be used on nested inner fields`);
+	if (context && context.fieldPath.length > 1 && metadata.default !== void 0) throw new Error(`Field "${context.fieldPath.join(".")}" on table "${context.typeName}": .default() cannot be used on nested inner fields`);
+	if (context && context.fieldPath.length > 1 && metadata.hooks) throw new Error(`Field "${context.fieldPath.join(".")}" on table "${context.typeName}": .hooks() cannot be used on nested inner fields`);
 	const nestedFields = field.fields;
 	return {
 		type: fieldType,
@@ -2715,7 +2775,7 @@ function isSingleArrayConditionFormat(cond) {
 }
 /**
 * Normalize record-level permissions into a standard structure.
-* @param permission - Tailor type permission
+* @param permission - Tailor table permission
 * @returns Normalized record permissions
 */
 function normalizePermission(permission) {
@@ -2817,8 +2877,8 @@ function findOmittedPermitRules(rawPermissions) {
 	return locations;
 }
 /**
-* Check whether GraphQL exposure is fully disabled for a type, given its
-* effective gqlOperations (the type's own setting, falling back to the
+* Check whether GraphQL exposure is fully disabled for a table, given its
+* effective gqlOperations (the table's own setting, falling back to the
 * TailorDB namespace default). `undefined` means the default of all
 * operations enabled, so it is never considered fully disabled.
 * @param gqlOperations - Effective, normalized gqlOperations configuration
@@ -2829,15 +2889,15 @@ function isGqlOperationsFullyDisabled(gqlOperations) {
 	return gqlOperations.create === false && gqlOperations.update === false && gqlOperations.delete === false && gqlOperations.read === false;
 }
 /**
-* Find missing permission configuration for a TailorDB type.
+* Find missing permission configuration for a TailorDB table.
 *
 * Record-level permission is always required: TailorDB denies all record
-* operations for a type without it, regardless of whether the type is
+* operations for a table without it, regardless of whether the table is
 * exposed via GraphQL. GraphQL permission is required whenever GraphQL
-* exposure is enabled for the type (the default, unless every operation is
+* exposure is enabled for the table (the default, unless every operation is
 * explicitly disabled via `gqlOperations`).
-* @param rawPermissions - Raw permissions definition for the type
-* @param effectiveGqlOperations - The type's own gqlOperations, falling back to the namespace default
+* @param rawPermissions - Raw permissions definition for the table
+* @param effectiveGqlOperations - The table's own gqlOperations, falling back to the namespace default
 * @returns Which permission configuration, if any, is missing
 */
 function findMissingPermissionConfig(rawPermissions, effectiveGqlOperations) {
@@ -2850,12 +2910,12 @@ function findMissingPermissionConfig(rawPermissions, effectiveGqlOperations) {
 //#endregion
 //#region src/parser/service/tailordb/type-parser.ts
 /**
-* Parse multiple TailorDB types, build relationships, and validate uniqueness.
-* This is the main entry point for parsing TailorDB types.
-* @param rawTypes - Raw TailorDB types keyed by name
+* Parse multiple TailorDB tables, build relationships, and validate uniqueness.
+* This is the main entry point for parsing TailorDB tables.
+* @param rawTypes - Raw TailorDB tables keyed by name
 * @param namespace - TailorDB namespace name
-* @param typeSourceInfo - Optional type source information
-* @returns Parsed types
+* @param typeSourceInfo - Optional table source information
+* @returns Parsed tables
 */
 function parseTypes(rawTypes, namespace, typeSourceInfo) {
 	const types = createRecord();
@@ -2867,11 +2927,11 @@ function parseTypes(rawTypes, namespace, typeSourceInfo) {
 }
 /**
 * Parse a TailorDBTypeSchemaOutput into a TailorDBType.
-* @param type - TailorDB type to parse
-* @param allTypeNames - Set of all TailorDB type names
-* @param rawTypes - All raw TailorDB types keyed by name
-* @param typeSourceInfo - Optional type source information
-* @returns Parsed TailorDB type
+* @param type - TailorDB table to parse
+* @param allTypeNames - Set of all TailorDB table names
+* @param rawTypes - All raw TailorDB tables keyed by name
+* @param typeSourceInfo - Optional table source information
+* @returns Parsed TailorDB table
 */
 function parseTailorDBType(type, allTypeNames, rawTypes, typeSourceInfo) {
 	const metadata = type.metadata;
@@ -2896,12 +2956,12 @@ function parseTailorDBType(type, allTypeNames, rawTypes, typeSourceInfo) {
 				"n-1",
 				"manyToOne",
 				"N-1"
-			].includes(rawRelation.type) && fieldConfig.unique) throw new Error(`Field "${fieldName}" on type "${type.name}": cannot set unique on n-1 (manyToOne) relation. Use 1-1 (oneToOne) relation instead, or remove the unique constraint.`);
+			].includes(rawRelation.type) && fieldConfig.unique) throw new Error(`Field "${fieldName}" on table "${type.name}": cannot set unique on n-1 (manyToOne) relation. Use 1-1 (oneToOne) relation instead, or remove the unique constraint.`);
 			const relationMetadata = processRelationMetadata(rawRelation, context, fieldConfig.array);
 			fieldConfig = applyRelationMetadataToFieldConfig(fieldConfig, relationMetadata);
 		}
-		if (fieldConfig.array && fieldConfig.index) throw new Error(`Field "${fieldName}" on type "${type.name}": index cannot be set on array fields`);
-		if (fieldConfig.array && fieldConfig.unique) throw new Error(`Field "${fieldName}" on type "${type.name}": unique cannot be set on array fields`);
+		if (fieldConfig.array && fieldConfig.index) throw new Error(`Field "${fieldName}" on table "${type.name}": index cannot be set on array fields`);
+		if (fieldConfig.array && fieldConfig.unique) throw new Error(`Field "${fieldName}" on table "${type.name}": unique cannot be set on array fields`);
 		const parsedField = {
 			name: fieldName,
 			config: fieldConfig
@@ -2910,14 +2970,14 @@ function parseTailorDBType(type, allTypeNames, rawTypes, typeSourceInfo) {
 		if (relationInfo) {
 			parsedField.relation = { ...relationInfo };
 			const forwardName = relationInfo.forwardName;
-			if (forwardName.length === 0) throw new Error(`Forward relation name for field "${fieldName}" on type "${type.name}"${typeLocation} cannot be empty. Use the "as" option in .relation({ toward: { as: ... } }) to specify a non-empty name.`);
+			if (forwardName.length === 0) throw new Error(`Forward relation name for field "${fieldName}" on table "${type.name}"${typeLocation} cannot be empty. Use the "as" option in .relation({ toward: { as: ... } }) to specify a non-empty name.`);
 			const existingForward = forwardRelationships[forwardName];
-			if (existingForward) throw new Error(`Forward relation name "${forwardName}" on type "${type.name}"${typeLocation} is duplicated between fields "${existingForward.targetField}" and "${fieldName}". Use the "as" option in .relation({ toward: { as: ... } }) to specify a unique name.`);
+			if (existingForward) throw new Error(`Forward relation name "${forwardName}" on table "${type.name}"${typeLocation} is duplicated between fields "${existingForward.targetField}" and "${fieldName}". Use the "as" option in .relation({ toward: { as: ... } }) to specify a unique name.`);
 			if (Object.hasOwn(type.fields, forwardName)) {
-				const message = forwardName === fieldName ? `Forward relation name "${forwardName}" on type "${type.name}"${typeLocation} is the same as its own relation field "${fieldName}". Use the "as" option in .relation({ toward: { as: ... } }) to specify a different name.` : `Forward relation name "${forwardName}" from field "${fieldName}" on type "${type.name}"${typeLocation} conflicts with existing field "${forwardName}". Use the "as" option in .relation({ toward: { as: ... } }) to specify a different name.`;
+				const message = forwardName === fieldName ? `Forward relation name "${forwardName}" on table "${type.name}"${typeLocation} is the same as its own relation field "${fieldName}". Use the "as" option in .relation({ toward: { as: ... } }) to specify a different name.` : `Forward relation name "${forwardName}" from field "${fieldName}" on table "${type.name}"${typeLocation} conflicts with existing field "${forwardName}". Use the "as" option in .relation({ toward: { as: ... } }) to specify a different name.`;
 				throw new Error(message);
 			}
-			if (Object.hasOwn(metadata.files, forwardName)) throw new Error(`Forward relation name "${forwardName}" from field "${fieldName}" on type "${type.name}"${typeLocation} conflicts with files field "${forwardName}". Use the "as" option in .relation({ toward: { as: ... } }) to specify a different name.`);
+			if (Object.hasOwn(metadata.files, forwardName)) throw new Error(`Forward relation name "${forwardName}" from field "${fieldName}" on table "${type.name}"${typeLocation} conflicts with files field "${forwardName}". Use the "as" option in .relation({ toward: { as: ... } }) to specify a different name.`);
 			const targetType = rawTypes[relationInfo.targetType];
 			forwardRelationships[forwardName] = {
 				name: forwardName,
@@ -2949,11 +3009,11 @@ function parseTailorDBType(type, allTypeNames, rawTypes, typeSourceInfo) {
 	};
 }
 /**
-* Build backward relationships between parsed types.
-* Also validates that backward relation names are unique within each type.
-* @param types - Parsed types
+* Build backward relationships between parsed tables.
+* Also validates that backward relation names are unique within each table.
+* @param types - Parsed tables
 * @param namespace - TailorDB namespace name
-* @param typeSourceInfo - Optional type source information
+* @param typeSourceInfo - Optional table source information
 */
 function buildBackwardRelationships(types, namespace, typeSourceInfo) {
 	const backwardNameSources = Object.create(null);
@@ -2993,25 +3053,25 @@ function buildBackwardRelationships(types, namespace, typeSourceInfo) {
 					const location = formatTypeSourceLocation(getTypeSourceInfo(typeSourceInfo, s.sourceType));
 					return `${s.sourceType}.${s.fieldName}${location}`;
 				}).join(", ");
-				errors.push(`Backward relation name "${backwardName}" on type "${targetTypeName}" is duplicated from: ${sourceList}. Use the "backward" option in .relation() to specify unique names.`);
+				errors.push(`Backward relation name "${backwardName}" on table "${targetTypeName}" is duplicated from: ${sourceList}. Use the "backward" option in .relation() to specify unique names.`);
 			}
 			if (Object.hasOwn(targetType.fields, backwardName)) {
 				const source = sources[0];
 				if (source === void 0) throw new Error(`no source found for backward name: ${backwardName}`);
 				const sourceLocation = formatTypeSourceLocation(getTypeSourceInfo(typeSourceInfo, source.sourceType));
-				errors.push(`Backward relation name "${backwardName}" from ${source.sourceType}.${source.fieldName}${sourceLocation} conflicts with existing field "${backwardName}" on type "${targetTypeName}"${targetLocation}. Use the "backward" option in .relation() to specify a different name.`);
+				errors.push(`Backward relation name "${backwardName}" from ${source.sourceType}.${source.fieldName}${sourceLocation} conflicts with existing field "${backwardName}" on table "${targetTypeName}"${targetLocation}. Use the "backward" option in .relation() to specify a different name.`);
 			}
 			if (targetType.files && Object.hasOwn(targetType.files, backwardName)) {
 				const source = sources[0];
 				if (source === void 0) throw new Error(`no source found for backward name: ${backwardName}`);
 				const sourceLocation = formatTypeSourceLocation(getTypeSourceInfo(typeSourceInfo, source.sourceType));
-				errors.push(`Backward relation name "${backwardName}" from ${source.sourceType}.${source.fieldName}${sourceLocation} conflicts with files field "${backwardName}" on type "${targetTypeName}"${targetLocation}. Use the "backward" option in .relation() to specify a different name.`);
+				errors.push(`Backward relation name "${backwardName}" from ${source.sourceType}.${source.fieldName}${sourceLocation} conflicts with files field "${backwardName}" on table "${targetTypeName}"${targetLocation}. Use the "backward" option in .relation() to specify a different name.`);
 			}
 			if (Object.hasOwn(targetType.forwardRelationships, backwardName)) {
 				const source = sources[0];
 				if (source === void 0) throw new Error(`no source found for backward name: ${backwardName}`);
 				const sourceLocation = formatTypeSourceLocation(getTypeSourceInfo(typeSourceInfo, source.sourceType));
-				errors.push(`Relation name "${backwardName}" on type "${targetTypeName}"${targetLocation} is used by both a forward relationship and a backward relationship from ${source.sourceType}.${source.fieldName}${sourceLocation}. Use the "as" option in .relation({ toward: { as: ... } }) or the "backward" option in .relation() to specify unique names.`);
+				errors.push(`Relation name "${backwardName}" on table "${targetTypeName}"${targetLocation} is used by both a forward relationship and a backward relationship from ${source.sourceType}.${source.fieldName}${sourceLocation}. Use the "as" option in .relation({ toward: { as: ... } }) or the "backward" option in .relation() to specify unique names.`);
 			}
 		}
 	}
@@ -3020,11 +3080,11 @@ function buildBackwardRelationships(types, namespace, typeSourceInfo) {
 /**
 * Validate GraphQL query field name uniqueness.
 * Checks for:
-* 1. Each type's singular query name != plural query name
-* 2. No duplicate query names across all types
-* @param types - Parsed types
+* 1. Each table's singular query name != plural query name
+* 2. No duplicate query names across all tables
+* @param types - Parsed tables
 * @param namespace - TailorDB namespace name
-* @param typeSourceInfo - Optional type source information
+* @param typeSourceInfo - Optional table source information
 */
 function validatePluralFormUniqueness(types, namespace, typeSourceInfo) {
 	const errors = [];
@@ -3032,7 +3092,7 @@ function validatePluralFormUniqueness(types, namespace, typeSourceInfo) {
 		const singularQuery = inflection.camelize(parsedType.name, true);
 		if (singularQuery === inflection.camelize(parsedType.pluralForm, true)) {
 			const location = formatTypeSourceLocation(getTypeSourceInfo(typeSourceInfo, parsedType.name));
-			errors.push(`Type "${parsedType.name}"${location} has identical singular and plural query names "${singularQuery}". Use db.table(["${parsedType.name}", "UniquePluralForm"], {...}) to set a unique pluralForm.`);
+			errors.push(`Table "${parsedType.name}"${location} has identical singular and plural query names "${singularQuery}". Use db.table(["${parsedType.name}", "UniquePluralForm"], {...}) to set a unique pluralForm.`);
 		}
 	}
 	const queryNameToSource = /* @__PURE__ */ new Map();
@@ -3106,12 +3166,12 @@ function collectBindingsFromPattern(pattern, bindings) {
 			else collectBindingsFromPattern(prop.value, bindings);
 			break;
 		case "ArrayPattern":
-			for (const elem of pattern.elements) if (elem) if (elem.type === "RestElement") collectBindingsFromPattern(elem.argument, bindings);
-			else collectBindingsFromPattern(elem, bindings);
-			break;
-		case "AssignmentPattern":
-			collectBindingsFromPattern(pattern.left, bindings);
+			for (const elem of pattern.elements) if (elem) {
+				if (elem.type === "RestElement") collectBindingsFromPattern(elem.argument, bindings);
+				else collectBindingsFromPattern(elem, bindings);
+			}
 			break;
+		case "AssignmentPattern": collectBindingsFromPattern(pattern.left, bindings);
 	}
 }
 /** Fields that contain TypeScript type annotations (not runtime references). */
@@ -3386,7 +3446,7 @@ async function bundleScriptTarget(args) {
 	const context = `${kind} in ${sourceFilePath}`;
 	const fnSource = stringifyFunction(fn);
 	if ((kind === "typeValidate" || kind === "validate") && fn.constructor.name === "AsyncFunction") throw new Error(`${context} must be synchronous — the generated validator runs synchronously, so issues reported after an await are silently lost. Remove the async keyword.`);
-	const argsObject = kind === "hooks.create" ? `{ input: _value, invoker: ${tailorPrincipalMap}, now: _now }` : kind === "hooks.update" ? `{ input: _value, oldValue: _oldValue, invoker: ${tailorPrincipalMap}, now: _now }` : kind === "validate" ? `{ value: _value }` : kind === "typeHook" ? `{ input: _input, oldRecord: _oldRecord, invoker: ${tailorPrincipalMap}, now: _now }` : `{ newRecord: _newRecord, oldRecord: _oldRecord, invoker: ${tailorPrincipalMap} }, __issues`;
+	const argsObject = kind === "hooks.create" ? `{ input: _value, invoker: ${PRINCIPAL_VAR}, now: _now }` : kind === "hooks.update" ? `{ input: _value, oldValue: _oldValue, invoker: ${PRINCIPAL_VAR}, now: _now }` : kind === "validate" ? `{ value: _value }` : kind === "typeHook" ? `{ input: _input, oldRecord: _oldRecord, invoker: ${PRINCIPAL_VAR}, now: _now }` : `{ newRecord: _newRecord, oldRecord: _oldRecord, invoker: ${PRINCIPAL_VAR} }, __issues`;
 	const inlineExpr = assertParsableExpression(`(${fnSource})(${argsObject})`, context);
 	const freeVars = findUndefinedReferences(`const __fn = ${fnSource};`);
 	if (freeVars.size === 0) return inlineExpr;
@@ -3426,8 +3486,8 @@ async function bundleScriptTarget(args) {
 * Precompile TailorDB hooks/validators into self-contained script expressions using rolldown.
 * Uses oxc-parser AST walking to extract free variables from functions, then builds
 * minimal entry points containing only the needed imports and declarations.
-* @param type - TailorDB type schema output.
-* @param sourceFilePath - Source file where the type is defined.
+* @param type - TailorDB table schema output.
+* @param sourceFilePath - Source file where the table is defined.
 * @param tsconfig - Resolved tsconfig path, or undefined if not found.
 */
 async function precompileTailorDBTypeScripts(type, sourceFilePath, tsconfig) {
@@ -3451,8 +3511,8 @@ async function precompileTailorDBTypeScripts(type, sourceFilePath, tsconfig) {
 //#endregion
 //#region src/cli/services/tailordb/type-name-validation.ts
 /**
-* Format a TailorDB type source for validation errors.
-* @param sourceInfo - Source information captured when loading the type
+* Format a TailorDB table source for validation errors.
+* @param sourceInfo - Source information captured when loading the table
 * @returns Human-readable source detail
 */
 function formatTailorDBTypeSourceInfo(sourceInfo) {
@@ -3467,9 +3527,9 @@ function formatTailorDBTypeSourceInfo(sourceInfo) {
 	return `${sourceInfo.filePath} export ${sourceInfo.exportName}`;
 }
 /**
-* Collect TailorDB type-name sources from loaded local services.
+* Collect TailorDB table-name sources from loaded local services.
 * @param args - Collection inputs
-* @returns Type-name sources for local services
+* @returns Table-name sources for local services
 */
 function collectLocalTailorDBTypeNameSources(args) {
 	const sources = [];
@@ -3482,9 +3542,9 @@ function collectLocalTailorDBTypeNameSources(args) {
 	return sources;
 }
 /**
-* Fetch TailorDB type-name sources for external namespaces.
+* Fetch TailorDB table-name sources for external namespaces.
 * @param args - Fetch inputs
-* @returns Type-name sources for external services
+* @returns Table-name sources for external services
 */
 async function fetchExternalTailorDBTypeNameSources(args) {
 	return (await Promise.all(args.externalTailorDBNamespaces.map(async (namespace) => {
@@ -3512,7 +3572,7 @@ async function fetchExternalTailorDBTypeNameSources(args) {
 	}))).flat();
 }
 /**
-* Assert that TailorDB type names are unique across all supplied sources.
+* Assert that TailorDB table names are unique across all supplied sources.
 * @param args - Validation inputs
 */
 function assertUniqueTailorDBTypeNames(args) {
@@ -3526,20 +3586,20 @@ function assertUniqueTailorDBTypeNames(args) {
 	for (const [typeName, sources] of sourcesByTypeName) {
 		if (sources.length <= 1) continue;
 		const sourceList = sources.map(formatTailorDBTypeNameSource).join(", ");
-		errors.push(`Type "${typeName}" is defined more than once: ${sourceList}`);
+		errors.push(`Table "${typeName}" is defined more than once: ${sourceList}`);
 	}
-	if (errors.length > 0) throw new Error(`Duplicate TailorDB type names detected.
-${errors.map((error) => `  - ${error}`).join("\n")}\nTailorDB type names must be unique across all TailorDB namespaces in an application.`);
+	if (errors.length > 0) throw new Error(`Duplicate TailorDB table names detected.
+${errors.map((error) => `  - ${error}`).join("\n")}\nTailorDB table names must be unique across all TailorDB namespaces in an application.`);
 }
 /**
-* Assert local TailorDB type names are unique.
+* Assert local TailorDB table names are unique.
 * @param args - Validation inputs
 */
 function assertUniqueLocalTailorDBTypeNames(args) {
 	assertUniqueTailorDBTypeNames({ sources: collectLocalTailorDBTypeNameSources(args) });
 }
 /**
-* Assert TailorDB type names are unique across local and external namespaces.
+* Assert TailorDB table names are unique across local and external namespaces.
 * @param args - Validation inputs
 */
 async function assertUniqueTailorDBTypeNamesWithExternal(args) {
@@ -3587,7 +3647,7 @@ function createTailorDBService(params) {
 		if (existingSourceInfo) {
 			const firstSource = formatTailorDBTypeSourceInfo(existingSourceInfo) ?? "unknown source";
 			const secondSource = formatTailorDBTypeSourceInfo(sourceInfo) ?? "unknown source";
-			throw new Error(`Duplicate TailorDB type name "${typeName}" detected in TailorDB service "${namespace}". First: ${firstSource}. Second: ${secondSource}. TailorDB type names must be unique across all TailorDB files in a service.`);
+			throw new Error(`Duplicate TailorDB table name "${typeName}" detected in TailorDB service "${namespace}". First: ${firstSource}. Second: ${secondSource}. TailorDB table names must be unique across all TailorDB files in a service.`);
 		}
 		assertDefined(rawTypes[rawTypesKey], `raw types entry missing for key: ${rawTypesKey}`)[typeName] = type;
 		typeSourceInfo[typeName] = sourceInfo;
@@ -3600,7 +3660,7 @@ function createTailorDBService(params) {
 	const warnOmittedPermit = () => {
 		for (const fileTypes of Object.values(rawTypes)) for (const [typeName, type] of Object.entries(fileTypes)) {
 			const locations = findOmittedPermitRules(type.metadata.permissions);
-			if (locations.length > 0) logger.warn(`TailorDB type "${typeName}" has permission rule(s) ${locations.join(", ")} in object form without an explicit "permit"; they default to "deny". Set permit: true (allow) or permit: false (deny) to silence this warning.`);
+			if (locations.length > 0) logger.warn(`TailorDB table "${typeName}" has permission rule(s) ${locations.join(", ")} in object form without an explicit "permit"; they default to "deny". Set permit: true (allow) or permit: false (deny) to silence this warning.`);
 		}
 	};
 	const validateRequiredPermissions = () => {
@@ -3611,16 +3671,16 @@ function createTailorDBService(params) {
 			if (!missingPermission && !missingGqlPermission) continue;
 			const source = formatTailorDBTypeSourceInfo(typeSourceInfo[typeName]);
 			const location = source ? ` (${source})` : "";
-			if (missingPermission) errors.push(`TailorDB type "${typeName}"${location} has no .permission() configured. TailorDB denies all record operations for types without permission; call .permission(...) to grant access explicitly.`);
-			if (missingGqlPermission) errors.push(`TailorDB type "${typeName}"${location} has no .gqlPermission() configured, but GraphQL operations are enabled for it. Call .gqlPermission(...) to grant GraphQL access explicitly, or disable GraphQL exposure with .features({ gqlOperations: { create: false, update: false, delete: false, read: false } }).`);
+			if (missingPermission) errors.push(`TailorDB table "${typeName}"${location} has no .permission() configured. TailorDB denies all record operations for tables without permission; call .permission(...) to grant access explicitly.`);
+			if (missingGqlPermission) errors.push(`TailorDB table "${typeName}"${location} has no .gqlPermission() configured, but GraphQL operations are enabled for it. Call .gqlPermission(...) to grant GraphQL access explicitly, or disable GraphQL exposure with .features({ gqlOperations: { create: false, update: false, delete: false, read: false } }).`);
 		}
 		if (errors.length > 0) throw new Error(`TailorDB permission configuration errors in service "${namespace}":\n${errors.map((e) => `  - ${e}`).join("\n")}`);
 	};
 	/**
-	* Process plugins for a type and add generated types to rawTypes
-	* @param rawType - The raw TailorDB type being processed
-	* @param attachments - Plugin attachments for this type
-	* @param sourceFilePath - The file path where the type was loaded from
+	* Process plugins for a table and add generated tables to rawTypes
+	* @param rawType - The raw TailorDB table being processed
+	* @param attachments - Plugin attachments for this table
+	* @param sourceFilePath - The file path where the table was loaded from
 	*/
 	const processPluginsForType = async (rawType, attachments, sourceFilePath) => {
 		if (!pluginManager) return;
@@ -3650,7 +3710,7 @@ function createTailorDBService(params) {
 		rawTypes[typeFile] = createRawTypesByName();
 		const loadedTypes = createRawTypesByName();
 		try {
-			const module = await import(pathToFileURL(typeFile).href);
+			const module = await importUserModule(typeFile);
 			for (const exportName of Object.keys(module)) {
 				const exportedValue = module[exportName];
 				const result = TailorDBTypeSchema.safeParse(stripTailorDBTypeBuilderHelpers(exportedValue));
@@ -3666,15 +3726,16 @@ function createTailorDBService(params) {
 					filePath: typeFile,
 					exportName
 				});
-				if (exportedValue.plugins && Array.isArray(exportedValue.plugins) && exportedValue.plugins.length > 0) {
-					pluginAttachments.set(exportedValue.name, [...exportedValue.plugins]);
-					logger.log(`  Plugin attachments: ${styles.info(exportedValue.plugins.map((p) => p.pluginId).join(", "))}`);
-					await processPluginsForType(exportedValue, exportedValue.plugins, typeFile);
+				const rawType = exportedValue;
+				if (rawType.plugins && Array.isArray(rawType.plugins) && rawType.plugins.length > 0) {
+					pluginAttachments.set(rawType.name, [...rawType.plugins]);
+					logger.log(`  Plugin attachments: ${styles.info(rawType.plugins.map((p) => p.pluginId).join(", "))}`);
+					await processPluginsForType(rawType, rawType.plugins, typeFile);
 				}
 			}
 		} catch (error) {
 			const relativePath = path.relative(process.cwd(), typeFile);
-			logger.error(`Failed to load type from ${styles.bold(relativePath)}`);
+			logger.error(`Failed to load table from ${styles.bold(relativePath)}`);
 			logger.error(String(error));
 			throw error;
 		}
@@ -3698,7 +3759,7 @@ function createTailorDBService(params) {
 				const typeFiles = [...new Set(loadFilesWithIgnores(config, baseDir))];
 				const tsconfig = await resolveTSConfigWithFallback(baseDir);
 				logger.newline();
-				logger.log(`Found ${styles.highlight(typeFiles.length.toString())} type files for TailorDB service ${styles.highlight(`"${namespace}"`)}`);
+				logger.log(`Found ${styles.highlight(typeFiles.length.toString())} table files for TailorDB service ${styles.highlight(`"${namespace}"`)}`);
 				if (pluginManager) for (const typeFile of typeFiles) await loadTypeFile(typeFile, tsconfig);
 				else await Promise.all(typeFiles.map((typeFile) => loadTypeFile(typeFile, tsconfig)));
 				doParseTypes();
@@ -4033,7 +4094,7 @@ function buildResolverPermissionGuardExpr(permission) {
 }
 /**
 * Build the permission guard and input-validation statements shared by every
-* resolver entry wrapper (production bundling and `function test-run`).
+* resolver entry wrapper (production bundling and `function run`).
 *
 * Kept as a single generator so a resolver-wrapping behavior (like the
 * permission guard) can't be added to one entry-point template and forgotten
@@ -4207,8 +4268,8 @@ const HttpAdapterConfigSchema = z.strictObject({
 
 //#endregion
 //#region src/cli/services/http-adapter/bundler.ts
-const ADAPTER_BUNDLE_WARN_BYTES = 64 * 1024;
-const ADAPTER_BUNDLE_ERROR_BYTES = 256 * 1024;
+const ADAPTER_BUNDLE_WARN_BYTES = 65536;
+const ADAPTER_BUNDLE_ERROR_BYTES = 262144;
 const GRAPHQL_WEB_MODULE = createRequire(import.meta.url).resolve("@0no-co/graphql.web");
 /**
 * Bundle each adapter's `input` (and `output`, if present) into a standalone
@@ -4229,12 +4290,13 @@ async function bundleHttpAdapters(adapters, baseDir, cache, bundleLogLevel = "DE
 	logger.newline();
 	logger.log(`Bundling ${styles.highlight(adapters.length.toString())} files for ${styles.info("\"http-adapter\"")}`);
 	const tsconfig = await resolveTSConfigWithFallback(baseDir);
-	const results = await withBundleConcurrency(adapters.flatMap((adapter) => {
+	const tasks = adapters.flatMap((adapter) => {
 		return (adapter.hasOutput ? ["input", "output"] : ["input"]).map((kind) => ({
 			adapter,
 			kind
 		}));
-	}), ({ adapter, kind }) => bundleAdapterScript(adapter, kind, tsconfig, cache, bundleLogLevel, tsconfigCache));
+	});
+	const results = await withBundleConcurrency(tasks, ({ adapter, kind }) => bundleAdapterScript(adapter, kind, tsconfig, cache, bundleLogLevel, tsconfigCache));
 	const bundledInputs = /* @__PURE__ */ new Map();
 	const bundledOutputs = /* @__PURE__ */ new Map();
 	for (const [name, kind, code] of results) if (kind === "input") bundledInputs.set(name, code);
@@ -4437,7 +4499,7 @@ async function loadAdapterFiles(config, baseDir) {
 }
 async function loadAdapterFromFile(filePath) {
 	try {
-		const module = await import(pathToFileURL(filePath).href);
+		const module = await importUserModule(filePath);
 		if (!isSdkBranded(module.default, "http-adapter")) {
 			const named = Object.entries(module).find(([exportName, value]) => exportName !== "default" && isSdkBranded(value, "http-adapter"));
 			if (named) throw new Error(`HTTP adapter must be the default export, but it is exported as \`${named[0]}\`. Re-export it: \`export default createHttpAdapter({...})\`.`);
@@ -4533,7 +4595,7 @@ const ResolverSchema = z.strictObject({
 * @returns Parsed resolver or null if invalid
 */
 async function loadResolver(resolverFilePath) {
-	const resolver = (await import(pathToFileURL(resolverFilePath).href)).default;
+	const resolver = (await importUserModule(resolverFilePath)).default;
 	const parseResult = ResolverSchema.safeParse(resolver);
 	if (!parseResult.success) return null;
 	return parseResult.data;
@@ -4609,16 +4671,17 @@ async function bundleSingleResolver(options) {
 		contextHash,
 		async build(cachePlugins, trackDependency) {
 			const absoluteSourcePath = path.resolve(resolver.sourceFile);
+			const guardAndInputCheckExpr = buildResolverPermissionAndInputCheckExpr({
+				permission: resolver.permission,
+				defaultPermission
+			});
 			const entryContent = multiline`
         import _internalResolver from "${absoluteSourcePath}";
         import { t } from "@tailor-platform/sdk";
 
         const $tailor_resolver_body = async (context) => {
           const invoker = ${INVOKER_EXPR};
-          ${buildResolverPermissionAndInputCheckExpr({
-				permission: resolver.permission,
-				defaultPermission
-			})}
+          ${guardAndInputCheckExpr}
           return _internalResolver.body({ ...context, invoker });
         };
 
@@ -4673,7 +4736,7 @@ function parseResolverDefaultPermission(params) {
 /**
 * Find the `defaultPermission` of the resolver namespace a file belongs to.
 *
-* `function test-run` receives a single file rather than a namespace, so the
+* `function run` receives a single file rather than a namespace, so the
 * namespace is recovered by matching the file against each namespace's own
 * patterns — otherwise a test run would skip a guard the deployed resolver has.
 *
@@ -4718,7 +4781,7 @@ function createResolverService(namespace, config, baseDir) {
 	});
 	const loadResolverForFile = async (resolverFile) => {
 		try {
-			const resolverModule = await import(pathToFileURL(resolverFile).href);
+			const resolverModule = await importUserModule(resolverFile);
 			const result = ResolverSchema.safeParse(resolverModule.default);
 			if (result.success) {
 				const relativePath = path.relative(process.cwd(), resolverFile);
@@ -5260,7 +5323,7 @@ async function loadFileContent(filePath) {
 	const jobs = [];
 	let workflow = null;
 	try {
-		const module = await import(pathToFileURL(filePath).href);
+		const module = await importUserModule(filePath);
 		for (const [exportName, exportValue] of Object.entries(module)) {
 			if (exportName === "default") {
 				const workflowResult = WorkflowSchema.safeParse(stripRuntimeStart(exportValue));
@@ -5299,6 +5362,16 @@ async function loadFileContent(filePath) {
 function getApplicationAuthNamespace(application) {
 	return application.authService?.config.name ?? application.config?.auth?.name;
 }
+/**
+* Resolve the auth namespace configured for an application, throwing when none is configured.
+* @param application - Loaded application with local or external Auth config
+* @returns Auth namespace
+*/
+function requireApplicationAuthNamespace(application) {
+	const authNamespace = getApplicationAuthNamespace(application);
+	if (!authNamespace) throw new Error("No Auth service configured");
+	return authNamespace;
+}
 
 //#endregion
 //#region src/cli/shared/inline-sourcemap.ts
@@ -5331,7 +5404,7 @@ const NAME_PATTERN = /^[a-z0-9][a-z0-9-]{1,28}[a-z0-9]$/;
 const AUTH_NAMESPACE_PATTERN = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
 const AIGatewaySchema = z.strictObject({
 	name: z.string().regex(NAME_PATTERN, "Must be 3-30 lowercase alphanumeric characters or hyphens").describe("AI Gateway name"),
-	authNamespace: z.string().regex(AUTH_NAMESPACE_PATTERN, "Must be 3-63 lowercase alphanumeric characters or hyphens").describe("Auth namespace used to resolve request tokens against the workspace's auth"),
+	authNamespace: z.string().regex(AUTH_NAMESPACE_PATTERN, "Must be 3-63 lowercase alphanumeric characters or hyphens").optional().describe("Auth namespace used to resolve request tokens against the workspace's auth. Defaults to the application's own auth service when omitted; omitting it without an Auth service configured is rejected."),
 	cors: z.array(z.string()).optional().describe("Allowed CORS origins for browser-based clients. Each entry is `*`, `http(s)://*`, `http(s)://*.example.com`, or `http(s)://app.example.com`, optionally with `:port`. Empty list disables cross-origin access.")
 }).brand("AIGatewayConfig");
 
@@ -5530,6 +5603,65 @@ const StaticWebsiteSchema = z.strictObject({
 	customDomains: z.array(z.string()).optional().describe("Custom domains for the static website")
 }).brand("StaticWebsiteConfig");
 
+//#endregion
+//#region src/parser/service/workflow/wait-point-key.ts
+const KEY_REGEX = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
+const LITERAL_SEGMENT_REGEX = /^[a-z0-9]+$/;
+const PARAM_NAME_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const MAX_KEY_LENGTH = 63;
+const KEY_GRAMMAR = "[a-z0-9-] (3-63 characters; must start and end with [a-z0-9])";
+/**
+* Check one declared wait point key against the key rules.
+*
+* The declaration matters: only `createWaitPoints`' `define` receives the key
+* before the type arguments, so only there can TypeScript read the `$params`
+* off the key literal.
+* @param waitPoint - A key as declared, with the declaration it came from
+* @returns The rule the key breaks, or undefined when the key is usable
+*/
+function checkWaitPointKey(waitPoint) {
+	const { key, declaredBy } = waitPoint;
+	const segments = key.split("-");
+	const paramSegments = segments.filter((segment) => segment.startsWith("$") && segment.length > 1);
+	if (paramSegments.length > 0 && declaredBy !== "define") return declaredBy === "property" ? `Invalid wait point key "${key}": $params cannot come from a property name. Pass the key to define instead, e.g. define.for("${key}")<Payload, Result>().` : `Invalid wait point key "${key}": createWaitPoint takes its type arguments first, which stops TypeScript inferring the key as a literal, so it cannot type the $params. Declare it through createWaitPoints instead: createWaitPoints((define) => ({ myWaitPoint: define.for("${key}")<Payload, Result>() })).`;
+	const seen = /* @__PURE__ */ new Set();
+	let literals = 0;
+	for (const segment of segments) {
+		if (segment.startsWith("$")) {
+			const name = segment.slice(1);
+			if (!PARAM_NAME_REGEX.test(name)) return `Invalid wait point key "${key}": "${segment}" is not a usable parameter name. Use letters, digits and underscores, starting with a letter or underscore.`;
+			if (seen.has(name)) return `Invalid wait point key "${key}": parameter "$${name}" appears more than once.`;
+			seen.add(name);
+			continue;
+		}
+		if (segment === "") continue;
+		if (!LITERAL_SEGMENT_REGEX.test(segment)) return `Invalid wait point key "${key}": segment "${segment}" may only contain [a-z0-9]. Wait point keys accept ${KEY_GRAMMAR}, with $params standing in for runtime values.`;
+		literals += 1;
+	}
+	if (literals === 0 && paramSegments.length > 0) return key.startsWith("-") || key.endsWith("-") ? `Invalid wait point key "${key}": must match ${KEY_GRAMMAR}.` : `Invalid wait point key "${key}": it needs at least one literal segment alongside its $params, otherwise the key carries no identity of its own and can collide with an unrelated wait point.`;
+	if (paramSegments.length === 0) return KEY_REGEX.test(key) ? void 0 : `Invalid wait point key "${key}": must match ${KEY_GRAMMAR}.`;
+	const shortest = segments.map((segment) => segment.startsWith("$") ? "0" : segment).join("-");
+	if (shortest.length > MAX_KEY_LENGTH) return `Wait point key "${key}" cannot fit in ${MAX_KEY_LENGTH} characters: even single-character parameter values produce ${shortest.length}.`;
+	return KEY_REGEX.test(shortest) ? void 0 : `Invalid wait point key "${key}": must match ${KEY_GRAMMAR}.`;
+}
+/**
+* Check every declared wait point key, reporting each broken rule once.
+* @param waitPoints - The keys declared across the project, as registered
+* @returns One message per distinct declaration that breaks a rule
+*/
+function collectWaitPointKeyFailures(waitPoints) {
+	const failures = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const waitPoint of waitPoints) {
+		const identity = `${waitPoint.declaredBy} ${waitPoint.key}`;
+		if (seen.has(identity)) continue;
+		seen.add(identity);
+		const failure = checkWaitPointKey(waitPoint);
+		if (failure) failures.push(failure);
+	}
+	return failures;
+}
+
 //#endregion
 //#region src/cli/services/application.ts
 function defineTailorDB(config, baseDir, pluginManager) {
@@ -5544,9 +5676,10 @@ function defineTailorDB(config, baseDir, pluginManager) {
 	for (const [namespace, serviceConfig] of Object.entries(config)) {
 		if ("external" in serviceConfig) externalTailorDBNamespaces.push(namespace);
 		else {
+			const parsedConfig = TailorDBServiceConfigSchema.parse(serviceConfig);
 			const tailorDB = createTailorDBService({
 				namespace,
-				config: TailorDBServiceConfigSchema.parse(serviceConfig),
+				config: parsedConfig,
 				pluginManager,
 				baseDir
 			});
@@ -5672,13 +5805,17 @@ function defineStaticWebsites(websites) {
 	});
 	return staticWebsiteServices;
 }
-function defineAIGateways(gateways) {
+function defineAIGateways(gateways, applicationAuthNamespace) {
 	const aiGatewayServices = [];
 	const gatewayNames = /* @__PURE__ */ new Set();
 	(gateways ?? []).forEach((config) => {
 		const gateway = AIGatewaySchema.parse(config);
 		if (gatewayNames.has(gateway.name)) throw new Error(`AI Gateway with name "${gateway.name}" already defined.`);
 		gatewayNames.add(gateway.name);
+		if (gateway.authNamespace === void 0) {
+			if (!applicationAuthNamespace) throw new Error(`AI Gateway "${gateway.name}" has no "authNamespace" and no Auth service is configured to default to. Define an Auth service, or set "authNamespace" explicitly.`);
+			gateway.authNamespace = applicationAuthNamespace;
+		}
 		aiGatewayServices.push(gateway);
 	});
 	return aiGatewayServices;
@@ -5711,7 +5848,10 @@ function defineServices(config, baseDir, pluginManager) {
 	const idpResult = defineIdp(config.idp);
 	const authResult = defineAuth(config.auth, tailordbResult.tailorDBServices, tailordbResult.externalTailorDBNamespaces);
 	const staticWebsiteServices = defineStaticWebsites(config.staticWebsites);
-	const aiGatewayServices = defineAIGateways(config.aiGateways);
+	const aiGatewayServices = defineAIGateways(config.aiGateways, getApplicationAuthNamespace({
+		authService: authResult.authService,
+		config
+	}));
 	const { secrets, ignoreNullishValues } = parseSecretManager(config.secrets);
 	return {
 		tailordbResult,
@@ -5779,9 +5919,9 @@ function defineApplication(params) {
 }
 /**
 * Generate plugin type and executor files if a plugin manager is provided.
-* Collects source type info from TailorDB services and delegates to PluginManager.
+* Collects source table info from TailorDB services and delegates to PluginManager.
 * @param pluginManager - Plugin manager instance (skips if undefined)
-* @param tailorDBServices - TailorDB services to collect type source info from
+* @param tailorDBServices - TailorDB services to collect table source info from
 * @param configPath - Path to tailor.config.ts for resolving plugin imports
 * @returns Generated executor file paths
 */
@@ -5803,6 +5943,11 @@ function generatePluginFilesIfNeeded(pluginManager, tailorDBServices, configPath
 		executorGenerator: generatePluginExecutorFiles
 	});
 }
+function assertWaitPointKeys() {
+	const failures = collectWaitPointKeyFailures(getScopedWaitPoints());
+	if (failures.length === 0) return;
+	throw new Error(failures.join("\n"));
+}
 /**
 * Load and fully initialize a Tailor application.
 * This performs all I/O-heavy operations: loading types, processing plugins,
@@ -5895,6 +6040,7 @@ async function loadApplication(params) {
 		await executorService.loadExecutors();
 		if (pluginExecutorFiles.length > 0) await executorService.loadPluginExecutorFiles([...pluginExecutorFiles]);
 	}
+	assertWaitPointKeys();
 	if (workflowService) workflowService.printLoadedWorkflows();
 	if (httpAdapterService) httpAdapterService.printLoadedAdapters();
 	logger.newline();
@@ -5921,5 +6067,5 @@ async function loadApplication(params) {
 }
 
 //#endregion
-export { createApplyLimiter as $, getDistDir as A, fetchUserInfo as B, composeFunctionTreeshakeOptions as C, getPluginGenerationDependencies as D, createBundleLog as E, fetchAll as F, initOAuth2Client as G, getOAuth2ClientId as H, fetchAllTolerant as I, isNotFoundError as J, initOperatorClient as K, fetchMachineUserToken as L, hashFile as M, closeConnectionPool as N, hasGenerationHooks as O, defaultPlatformBaseUrl as P, byName as Q, fetchPaged as R, platformBundleDefinePlugin as S, resolveBundleLogLevel as T, getOrNull as U, getConsoleBaseUrl as V, getPlatformBaseUrl as W, rememberPlatformConfigForToken as X, normalizeBaseUrl as Y, resolveStaticWebsiteUrls as Z, assertUniqueTailorDBTypeNamesWithExternal as _, resolveInlineSourcemap as a, createTsconfigPathsPlugin as b, WorkflowJobSchema as c, HTTP_METHODS as d, LOG_LEVELS as et, INVOKER_EXPR as f, assertUniqueLocalTailorDBTypeNames as g, buildResolverPermissionAndInputCheckExpr as h, resolverBundleKey as i, hashContent as j, createBundleCache as k, resolveResolverDefaultPermissionForFile as l, buildResolverOperationHookExpr as m, generatePluginFilesIfNeeded as n, getApplicationAuthNamespace as o, buildExecutorArgsExpr as p, isDefaultPlatform as q, loadApplication as r, WorkflowJobFunctionExecutionPolicySchema as s, defineApplication as t, ResolverSchema as u, stringifyFunction as v, createLogLevelTreeshakeOptions as w, resolveTSConfigWithFallback as x, createGeneratedEntryResolverPlugin as y, fetchPlatformMachineUserToken as z };
-//# sourceMappingURL=application-BpLeawBg.mjs.map
+export { rememberPlatformConfigForToken as $, getPluginGenerationDependencies as A, fetchMachineUserToken as B, createTsconfigPathsPlugin as C, createLogLevelTreeshakeOptions as D, composeFunctionTreeshakeOptions as E, hashFile as F, getOAuth2ClientId as G, fetchPlatformMachineUserToken as H, closeConnectionPool as I, initOAuth2Client as J, getOrNull as K, defaultPlatformBaseUrl as L, createBundleCache as M, getDistDir as N, resolveBundleLogLevel as O, hashContent as P, normalizeBaseUrl as Q, fetchAll as R, createGeneratedEntryResolverPlugin as S, platformBundleDefinePlugin as T, fetchUserInfo as U, fetchPaged as V, getConsoleBaseUrl as W, isDefaultPlatform as X, initOperatorClient as Y, isNotFoundError as Z, assertUniqueLocalTailorDBTypeNames as _, resolveInlineSourcemap as a, stringifyFunction as b, WorkflowJobFunctionExecutionPolicySchema as c, ResolverSchema as d, resolveStaticWebsiteUrls as et, HTTP_METHODS as f, buildResolverPermissionAndInputCheckExpr as g, buildResolverOperationHookExpr as h, resolverBundleKey as i, hasGenerationHooks as j, createBundleLog as k, WorkflowJobSchema as l, buildExecutorArgsExpr as m, generatePluginFilesIfNeeded as n, createApplyLimiter as nt, getApplicationAuthNamespace as o, INVOKER_EXPR as p, getPlatformBaseUrl as q, loadApplication as r, LOG_LEVELS as rt, requireApplicationAuthNamespace as s, defineApplication as t, byName as tt, resolveResolverDefaultPermissionForFile as u, assertUniqueTailorDBTypeNamesWithExternal as v, resolveTSConfigWithFallback as w, tailorPrincipalMap as x, PRINCIPAL_VAR as y, fetchAllTolerant as z };
+//# sourceMappingURL=application-C8a0UJ-z.mjs.map