@tailor-platform/sdk 2.3.0 → 2.4.0

package/dist/{register-ts-hook-ClI226n2.mjs → register-ts-hook-Vqjza10T.mjs}

@@ -1,17 +1,17 @@
-import { t as db } from "./schema--xYWRGfe.mjs";
+import { t as db } from "./schema-D4TC4BC3.mjs";
 import { t as beginWaitPointScope } from "./wait-point-registry-TL99zotw.mjs";
 import { $ as CreateAuthHookRequestSchema, B as IdPLang, Bt as ApplicationSchemaUpdateAttemptStatus, C as CreateStaticWebsiteRequestSchema, Ct as AuthInvokerSchema, D as CreateSecretManagerSecretRequestSchema, Dt as AuthSCIMAttribute_Type, Et as AuthSCIMAttribute_Mutability, H as IdPPermissionPermit, Ht as CreateAIGatewayRequestSchema, I as PipelineResolver_OperationType, It as CreateApplicationRequestSchema, Jt as Condition_Operator, K as CreateExecutorExecutorRequestSchema, L as CreateIdPServiceRequestSchema, Lt as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, M as CreatePipelineServiceRequestSchema, Mt as UserProfileProviderConfig_UserProfileProviderType, N as UpdatePipelineResolverRequestSchema, O as CreateSecretManagerVaultRequestSchema, Ot as AuthSCIMAttribute_Uniqueness, P as UpdatePipelineServiceRequestSchema, Q as CreateAuthConnectionRequestSchema, R as UpdateIdPServiceRequestSchema, Rt as UpdateApplicationRequestSchema, S as AddCustomDomainRequestSchema, St as AuthIDPConfig_AuthType, Tt as AuthOAuth2Client_GrantType, U as FunctionExecution_Status, Ut as UpdateAIGatewayRequestSchema, V as IdPPermissionOperator, Vt as Subgraph_ServiceType, X as ExecutorTargetType, Xt as PageDirection, Y as ExecutorJobStatus, Yt as FilterSchema, Z as ExecutorTriggerType, _ as TailorDBGQLPermission_Permit, _t as UpdateUserProfileConfigRequestSchema, a as CreateWorkflowRequestSchema, at as CreateAuthServiceRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthConnection_Type, ct as UpdateAuthConnectionRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as UpdateAuthMachineUserRequestSchema, et as CreateAuthIDPConfigRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as UpdateAuthOAuth2ClientRequestSchema, g as TailorDBGQLPermission_Operator, gt as UpdateTenantConfigRequestSchema, h as TailorDBGQLPermission_Action, ht as UpdateAuthServiceRequestSchema, i as CreateWorkflowJobFunctionRequestSchema, it as CreateAuthSCIMResourceRequestSchema, j as CreatePipelineResolverRequestSchema, jt as TenantProviderConfig_TenantProviderType, k as UpdateSecretManagerSecretRequestSchema, kt as AuthSCIMConfig_AuthorizationType, l as WorkflowExecution_Status, lt as UpdateAuthHookRequestSchema, mt as UpdateAuthSCIMResourceRequestSchema, nt as CreateAuthOAuth2ClientRequestSchema, o as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as CreateTenantConfigRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as UpdateAuthSCIMConfigRequestSchema, q as UpdateExecutorExecutorRequestSchema, qt as ConditionSchema, r as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, rt as CreateAuthSCIMConfigRequestSchema, s as UpdateWorkflowRequestSchema, st as CreateUserProfileConfigRequestSchema, t as WorkspacePlatformUserRole, tt as CreateAuthMachineUserRequestSchema, u as WorkflowJobExecution_Status, ut as UpdateAuthIDPConfigRequestSchema, v as TailorDBTypeSchema, w as UpdateStaticWebsiteRequestSchema, wt as AuthOAuth2Client_ClientType, x as TailorDBType_PermitAction, xt as AuthHookPoint, y as TailorDBType_Permission_Operator, yt as AuthConnection_Status } from "./workspace_resource_pb-HNIL_Vfj.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
-import { a as parseBoolean, i as symbols, n as logger, o as renderTable, r as styles, s as renderFor, t as CIPromptError } from "./logger-DSdExfor.mjs";
-import { $ as resolveStaticWebsiteUrls, A as hasGenerationHooks, B as fetchPaged, C as resolveTSConfigWithFallback, G as getOrNull, H as fetchUserInfo, I as defaultPlatformBaseUrl, J as initOperatorClient, K as getPlatformBaseUrl, L as fetchAll, M as getDistDir, N as hashContent, O as createBundleLog, P as hashFile, Q as rememberPlatformConfigForToken, R as fetchAllTolerant, S as createTsconfigPathsPlugin, U as getConsoleBaseUrl, W as getOAuth2ClientId, X as isNotFoundError, Y as isDefaultPlatform, Z as normalizeBaseUrl, _ as assertUniqueTailorDBTypeNamesWithExternal, b as tailorPrincipalMap, d as HTTP_METHODS, et as byName, g as assertUniqueLocalTailorDBTypeNames, i as resolverBundleKey, j as createBundleCache, k as getPluginGenerationDependencies, m as buildResolverOperationHookExpr, n as generatePluginFilesIfNeeded, nt as LOG_LEVELS, o as getApplicationAuthNamespace, p as buildExecutorArgsExpr, q as initOAuth2Client, r as loadApplication, s as WorkflowJobFunctionExecutionPolicySchema, t as defineApplication, tt as createApplyLimiter, v as PRINCIPAL_VAR, w as platformBundleDefinePlugin, x as createGeneratedEntryResolverPlugin, y as stringifyFunction, z as fetchMachineUserToken } from "./application-F-nl107y.mjs";
-import { _ as beginUserModuleRun, b as functionSchema, c as stripTailorDBTypeBuilderHelpers, g as IMPORT_NONCE_PARAM, h as loadFilesWithIgnores, t as createExecutorService, u as TailorDBTypeSchema$1, v as currentImportNonce } from "./service-C_WpbKHu.mjs";
+import { a as parseBoolean, i as symbols, n as logger, o as renderTable, r as styles, s as renderFor, t as CIPromptError } from "./logger-D0bEznPv.mjs";
+import { $ as rememberPlatformConfigForToken, A as getPluginGenerationDependencies, B as fetchMachineUserToken, C as createTsconfigPathsPlugin, F as hashFile, G as getOAuth2ClientId, J as initOAuth2Client, K as getOrNull, L as defaultPlatformBaseUrl, M as createBundleCache, N as getDistDir, P as hashContent, Q as normalizeBaseUrl, R as fetchAll, S as createGeneratedEntryResolverPlugin, T as platformBundleDefinePlugin, U as fetchUserInfo, V as fetchPaged, W as getConsoleBaseUrl, X as isDefaultPlatform, Y as initOperatorClient, Z as isNotFoundError, _ as assertUniqueLocalTailorDBTypeNames, b as stringifyFunction, c as WorkflowJobFunctionExecutionPolicySchema, et as resolveStaticWebsiteUrls, f as HTTP_METHODS, h as buildResolverOperationHookExpr, i as resolverBundleKey, j as hasGenerationHooks, k as createBundleLog, m as buildExecutorArgsExpr, n as generatePluginFilesIfNeeded, nt as createApplyLimiter, o as getApplicationAuthNamespace, q as getPlatformBaseUrl, r as loadApplication, rt as LOG_LEVELS, s as requireApplicationAuthNamespace, t as defineApplication, tt as byName, v as assertUniqueTailorDBTypeNamesWithExternal, w as resolveTSConfigWithFallback, x as tailorPrincipalMap, y as PRINCIPAL_VAR, z as fetchAllTolerant } from "./application-C8a0UJ-z.mjs";
+import { _ as beginUserModuleRun, b as functionSchema, c as stripTailorDBTypeBuilderHelpers, g as IMPORT_NONCE_PARAM, h as loadFilesWithIgnores, t as createExecutorService, u as TailorDBTypeSchema$1, v as currentImportNonce } from "./service-2grcAOCJ.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "./package-json-8b0O9TlX.mjs";
 import { t as userAgent } from "./user-agent-Bgsszb5I.mjs";
-import { a as typeOnlyImportHint, i as isCLIError, n as formatCopyableCommand, t as createCLIError } from "./errors-BVb6vYGy.mjs";
+import { a as typeOnlyImportHint, i as isCLIError, n as formatCopyableCommand, t as createCLIError } from "./errors-Bxut5_Sy.mjs";
 import { n as tightenSecretFilePermissions, r as writeSecretFile } from "./secret-file-C3J4Gy8r.mjs";
 import { r as withSpan } from "./telemetry-BRVdwh14.mjs";
-import { a as generateIdpTruncateScriptCode, i as generateIdpSeedScriptCode, o as processIdpUser, r as processLinesDb, t as SeedGeneratorID } from "./seed-xqM9WIHP.mjs";
+import { a as generateIdpTruncateScriptCode, i as generateIdpSeedScriptCode, o as processIdpUser, r as processLinesDb, t as SeedGeneratorID } from "./seed-Cibjmtry.mjs";
 import * as mod from "node:module";
 import * as path from "pathe";
 import { basename, dirname, join, resolve } from "pathe";
@@ -57,7 +57,7 @@ import { parse as parse$1 } from "@0no-co/graphql.web";
 const unitToMs = {
 	ms: 1,
 	s: 1e3,
-	m: 60 * 1e3
+	m: 6e4
 };
 const durationPattern = /^(\d+)(ms|s|m)$/;
 /**
@@ -141,7 +141,8 @@ function loadEnvFiles(envFiles, envFilesIfExists) {
 				if (required) throw new Error(`Environment file not found: ${envPath}`);
 				continue;
 			}
-			const parsed = parseEnv(fs$2.readFileSync(envPath, "utf-8"));
+			const content = fs$2.readFileSync(envPath, "utf-8");
+			const parsed = parseEnv(content);
 			for (const [key, value] of Object.entries(parsed)) {
 				if (originalEnvKeys.has(key)) continue;
 				process.env[key] = value;
@@ -697,7 +698,8 @@ async function trySaveTokensInKeyring(user, tokens) {
 }
 async function warnIfNewerConfigAvailable(config) {
 	if (!config.latest_min_sdk_version) return;
-	if (lt((await readPackageJson()).version ?? "0.0.0", config.latest_min_sdk_version)) logger.warn(multiline`
+	const sdkVersion = (await readPackageJson()).version ?? "0.0.0";
+	if (lt(sdkVersion, config.latest_min_sdk_version)) logger.warn(multiline`
       A newer config version (${String(config.latest_version)}) is available.
       Please update your SDK to >= ${config.latest_min_sdk_version}: pnpm update @tailor-platform/sdk
     `);
@@ -799,7 +801,8 @@ function toLatestForDisk(config) {
 function writePlatformConfig(config) {
 	const configPath = platformConfigPath();
 	const hasKeyringUser = config.version !== 1 && Object.values(config.users).some((u) => u?.storage === "keyring");
-	writeSecretFile(configPath, stringifyYAML(config.version === LATEST_CONFIG_VERSION || hasProfilePlatformSettings(config) || hasScopedUserKeys(config) || hasUserEmailMetadata(config) ? toLatestForDisk(config) : config.version === V2_CONFIG_VERSION && !hasKeyringUser ? toV1ForDisk(config) : config));
+	const diskConfig = config.version === LATEST_CONFIG_VERSION || hasProfilePlatformSettings(config) || hasScopedUserKeys(config) || hasUserEmailMetadata(config) ? toLatestForDisk(config) : config.version === V2_CONFIG_VERSION && !hasKeyringUser ? toV1ForDisk(config) : config;
+	writeSecretFile(configPath, stringifyYAML(diskConfig));
 }
 function validateUUID(value, source) {
 	const result = z.uuid().safeParse(value);
@@ -893,10 +896,11 @@ async function loadAccessToken(opts) {
 	const envToken = process.env.TAILOR_PLATFORM_TOKEN ?? process.env.TAILOR_TOKEN;
 	if (envToken && !process.env.TAILOR_PLATFORM_TOKEN) logger.warn("TAILOR_TOKEN is deprecated. Please use TAILOR_PLATFORM_TOKEN instead.");
 	if (envToken) {
-		rememberPlatformConfigForToken(envToken, await loadPlatformClientConfig({
+		const platformConfig = await loadPlatformClientConfig({
 			profile,
 			allowMissingProfile: true
-		}));
+		});
+		rememberPlatformConfigForToken(envToken, platformConfig);
 		return envToken;
 	}
 	const pfConfig = await readPlatformConfig();
@@ -937,7 +941,8 @@ async function loadPlatformClientConfig(opts) {
 * @returns Resolved Console base URL
 */
 async function loadConsoleBaseUrl(opts) {
-	return getConsoleBaseUrl(await loadPlatformClientConfig(opts));
+	const platformConfig = await loadPlatformClientConfig(opts);
+	return getConsoleBaseUrl(platformConfig);
 }
 /**
 * Resolve the actual token values for a user, reading from keyring or config as appropriate.
@@ -1660,7 +1665,8 @@ function createCacheManager(options) {
 		},
 		finalize() {}
 	};
-	const store = createCacheStore({ cacheDir: options.cacheDir ?? path.resolve(getDistDir(), "cache") });
+	const cacheDir = options.cacheDir ?? path.resolve(getDistDir(), "cache");
+	const store = createCacheStore({ cacheDir });
 	const existingManifest = store.loadManifest();
 	if (existingManifest) {
 		if (existingManifest.sdkVersion !== options.sdkVersion) {
@@ -1734,7 +1740,7 @@ function parseMigrationNumberArg(numberStr) {
 * confirmation that lists the same resource cannot drift apart.
 */
 const eventSourceLabel = {
-	tailorDBType: (name) => `TailorDB type "${name}"`,
+	tailorDBType: (name) => `TailorDB table "${name}"`,
 	resolver: (name) => `Resolver "${name}"`,
 	idpService: (name) => `IdP service "${name}"`,
 	workflow: (name) => `Workflow "${name}"`,
@@ -1823,9 +1829,10 @@ const isValidIdentifier = (s) => /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(s);
 * @param idpNames - Registered IdP names (used to narrow `idpUser*Trigger({ idp })` strings)
 * @param connectionNames - Registered auth connection names (used to narrow `getConnectionToken()` strings)
 * @param aiGatewayNames - Registered AI Gateway names (used to narrow `aigateway.get()` strings)
+* @param authNamespaceNames - Registered auth namespace names (used to narrow `authNamespace` strings)
 * @returns Generated type definition source
 */
-function generateTypeDefinition(attributes, attributeList, env, machineUserNames, idpNames, connectionNames, aiGatewayNames) {
+function generateTypeDefinition(attributes, attributeList, env, machineUserNames, idpNames, connectionNames, aiGatewayNames, authNamespaceNames) {
 	const attributeFields = attributes ? Object.entries(attributes).map(([key, { type, optional }]) => `    ${key}${optional ? "?" : ""}: ${type};`).join("\n") : "";
 	const attributesBody = !attributes || Object.keys(attributes).length === 0 ? "{}" : `{
 ${attributeFields}
@@ -1850,6 +1857,13 @@ ${idpNameFields}
 ${connectionNameFields}
   }`;
 	const aiGatewayNameFields = aiGatewayNames?.length ? aiGatewayNames.map((name) => `    ${isValidIdentifier(name) ? name : JSON.stringify(name)}: true;`).join("\n") : "";
+	const aiGatewayNameBody = !aiGatewayNames || aiGatewayNames.length === 0 ? "{}" : `{
+${aiGatewayNameFields}
+  }`;
+	const authNamespaceNameFields = authNamespaceNames?.length ? authNamespaceNames.map((name) => `    ${isValidIdentifier(name) ? name : JSON.stringify(name)}: true;`).join("\n") : "";
+	const authNamespaceNameBody = !authNamespaceNames || authNamespaceNames.length === 0 ? "{}" : `{
+${authNamespaceNameFields}
+  }`;
 	return multiline`
 // This file is auto-generated by @tailor-platform/sdk
 // Do not edit this file manually
@@ -1862,9 +1876,8 @@ declare module "@tailor-platform/sdk" {
   interface MachineUserNameRegistry ${machineUserBody}
   interface IdpNameRegistry ${idpNameBody}
   interface ConnectionNameRegistry ${connectionNameBody}
-  interface AIGatewayNameRegistry ${!aiGatewayNames || aiGatewayNames.length === 0 ? "{}" : `{
-${aiGatewayNameFields}
-  }`}
+  interface AIGatewayNameRegistry ${aiGatewayNameBody}
+  interface AuthNamespaceNameRegistry ${authNamespaceNameBody}
 }
 
 export {};
@@ -1875,10 +1888,12 @@ function collectAttributesFromConfig(config) {
 	const idpNames = config.idp?.length ? [...new Set(config.idp.map((idp) => idp.name))] : void 0;
 	const aiGatewayNames = config.aiGateways?.length ? [...new Set(config.aiGateways.map((gateway) => gateway.name))] : void 0;
 	const auth = config.auth;
-	if (!auth || typeof auth !== "object") return idpNames || aiGatewayNames ? {
+	const authNamespaceNames = auth && typeof auth === "object" && typeof auth.name === "string" ? [auth.name] : void 0;
+	if (!auth || typeof auth !== "object") return {
 		idpNames,
-		aiGatewayNames
-	} : {};
+		aiGatewayNames,
+		authNamespaceNames
+	};
 	const machineUsersObj = auth.machineUsers;
 	const machineUserNames = machineUsersObj && typeof machineUsersObj === "object" ? Object.keys(machineUsersObj) : void 0;
 	const connectionsObj = auth.connections;
@@ -1910,7 +1925,8 @@ function collectAttributesFromConfig(config) {
 			machineUserNames,
 			idpNames,
 			connectionNames,
-			aiGatewayNames
+			aiGatewayNames,
+			authNamespaceNames
 		};
 	}
 	if ("machineUserAttributes" in auth) {
@@ -1919,7 +1935,8 @@ function collectAttributesFromConfig(config) {
 			machineUserNames,
 			idpNames,
 			connectionNames,
-			aiGatewayNames
+			aiGatewayNames,
+			authNamespaceNames
 		};
 		return {
 			attributes: Object.entries(machineUserAttributes).reduce((acc, [key, field]) => {
@@ -1929,14 +1946,16 @@ function collectAttributesFromConfig(config) {
 			machineUserNames,
 			idpNames,
 			connectionNames,
-			aiGatewayNames
+			aiGatewayNames,
+			authNamespaceNames
 		};
 	}
 	return {
 		machineUserNames,
 		idpNames,
 		connectionNames,
-		aiGatewayNames
+		aiGatewayNames,
+		authNamespaceNames
 	};
 }
 /**
@@ -1961,7 +1980,7 @@ function resolveTypeDefinitionPath(configPath) {
 async function generateUserTypes(options) {
 	const { config, configPath } = options;
 	try {
-		const { attributes, attributeList, machineUserNames, idpNames, connectionNames, aiGatewayNames } = extractAttributesFromConfig(config);
+		const { attributes, attributeList, machineUserNames, idpNames, connectionNames, aiGatewayNames, authNamespaceNames } = extractAttributesFromConfig(config);
 		if (!attributes && !attributeList) logger.info("No attributes found in configuration", { mode: "plain" });
 		if (attributes) logger.debug(`Extracted Attributes: ${JSON.stringify(attributes)}`);
 		if (attributeList) logger.debug(`Extracted AttributeList: ${JSON.stringify(attributeList)}`);
@@ -1969,9 +1988,10 @@ async function generateUserTypes(options) {
 		if (idpNames?.length) logger.debug(`Extracted IdpNames: ${JSON.stringify(idpNames)}`);
 		if (connectionNames?.length) logger.debug(`Extracted ConnectionNames: ${JSON.stringify(connectionNames)}`);
 		if (aiGatewayNames?.length) logger.debug(`Extracted AIGatewayNames: ${JSON.stringify(aiGatewayNames)}`);
+		if (authNamespaceNames?.length) logger.debug(`Extracted AuthNamespaceNames: ${JSON.stringify(authNamespaceNames)}`);
 		const env = config.env;
 		if (env) logger.debug(`Extracted Env: ${JSON.stringify(env)}`);
-		const typeDefContent = generateTypeDefinition(attributes, attributeList, env, machineUserNames, idpNames, connectionNames, aiGatewayNames);
+		const typeDefContent = generateTypeDefinition(attributes, attributeList, env, machineUserNames, idpNames, connectionNames, aiGatewayNames, authNamespaceNames);
 		const outputPath = resolveTypeDefinitionPath(configPath);
 		fs$2.mkdirSync(path.dirname(outputPath), { recursive: true });
 		fs$2.writeFileSync(outputPath, typeDefContent);
@@ -2006,7 +2026,7 @@ var PluginManager = class {
 	/**
 	* Process a single plugin attachment on a raw TailorDBType.
 	* This method is called during type loading before parsing.
-	* @param context - Context containing the raw type, config, namespace, and plugin ID
+	* @param context - Context containing the raw table, config, namespace, and plugin ID
 	* @returns Result with plugin output on success, or error message on failure
 	*/
 	async processAttachment(context) {
@@ -2063,9 +2083,9 @@ var PluginManager = class {
 		};
 	}
 	/**
-	* Process namespace plugins that don't require a source type.
+	* Process namespace plugins that don't require a source table.
 	* This method is called once per namespace for plugins with onNamespaceLoaded method.
-	* @param namespace - The target namespace for generated types
+	* @param namespace - The target namespace for generated tables
 	* @returns Array of results with plugin outputs and configs
 	*/
 	async processNamespacePlugins(namespace) {
@@ -2131,11 +2151,11 @@ var PluginManager = class {
 		return results;
 	}
 	/**
-	* Run every plugin attachment for a single TailorDB type in order, threading the
-	* extended type through the chain. Returns plain data (no logging, no shared state)
+	* Run every plugin attachment for a single TailorDB table in order, threading the
+	* extended table through the chain. Returns plain data (no logging, no shared state)
 	* so the caller decides how to apply updates and render progress.
-	* @param params - The raw type, its attachments, and the target namespace
-	* @returns Final extended type (if any), generated types, and render events
+	* @param params - The raw table, its attachments, and the target namespace
+	* @returns Final extended table (if any), generated tables, and render events
 	*/
 	async processAttachmentsForType(params) {
 		const { rawType, attachments, namespace } = params;
@@ -2238,8 +2258,8 @@ var PluginManager = class {
 		}));
 	}
 	/**
-	* Get all plugin-generated types
-	* @returns Array of plugin-generated type info
+	* Get all plugin-generated tables
+	* @returns Array of plugin-generated table info
 	*/
 	getPluginGeneratedTypes() {
 		return this.generatedTypes;
@@ -2282,10 +2302,10 @@ var PluginManager = class {
 		return this.pluginExecutorFiles;
 	}
 	/**
-	* Extend a TailorDB type with new fields.
+	* Extend a TailorDB table with new fields.
 	* This method handles the `db.table()` call and metadata copying internally.
-	* @param params - Parameters for type extension
-	* @returns The extended TailorDB type
+	* @param params - Parameters for table extension
+	* @returns The extended TailorDB table
 	*/
 	extendType(params) {
 		const { originalType, extendFields, pluginId } = params;
@@ -2302,11 +2322,11 @@ var PluginManager = class {
 	}
 };
 /**
-* Copy metadata from original type to extended type.
+* Copy metadata from original table to extended table.
 * Preserves files, settings, permissions, indexes, and plugins.
-* @param original - The original TailorDB type with metadata
-* @param extended - The newly created extended type
-* @returns The extended type with copied metadata
+* @param original - The original TailorDB table with metadata
+* @param extended - The newly created extended table
+* @returns The extended table with copied metadata
 */
 function copyMetadataToExtendedType(original, extended) {
 	let result = extended;
@@ -2481,7 +2501,7 @@ function resourceTrn(workspaceId, kind, name) {
 *
 * The platform reads everything after the workspace id as alternating key/value
 * pairs and matches the pair list against one resource type, so a nested
-* resource is the parent's pair followed by its own. A TailorDB type is
+* resource is the parent's pair followed by its own. A TailorDB table is
 * `tailordb:<namespace>:type:<name>`, distinct from the namespace's own
 * `tailordb:<namespace>`.
 * @param workspaceId - Workspace ID
@@ -2493,10 +2513,10 @@ function nestedResourceTrn(workspaceId, parent, child) {
 	return `${trnPrefix(workspaceId)}:${parent[0]}:${parent[1]}:${child[0]}:${child[1]}`;
 }
 /**
-* Build the TRN for one TailorDB type.
+* Build the TRN for one TailorDB table.
 * @param workspaceId - Workspace ID
-* @param namespace - TailorDB namespace holding the type
-* @param typeName - Type name
+* @param namespace - TailorDB namespace holding the table
+* @param typeName - Table name
 * @returns Fully-qualified TRN string
 */
 function tailorDBTypeTrn(workspaceId, namespace, typeName) {
@@ -2776,15 +2796,17 @@ async function fetchExistingResourcesWithLabels(params) {
 function trackDesiredResourceOwnership(params) {
 	const { labels, ownerLabel, appName, appId, resourceType, resourceName, conflicts, unmanaged } = params;
 	const owned = isOwnedByApp(labels, appName, appId);
-	if (!owned) if (!ownerLabel) unmanaged.push({
-		resourceType,
-		resourceName
-	});
-	else conflicts.push({
-		resourceType,
-		resourceName,
-		currentOwner: ownerLabel
-	});
+	if (!owned) {
+		if (!ownerLabel) unmanaged.push({
+			resourceType,
+			resourceName
+		});
+		else conflicts.push({
+			resourceType,
+			resourceName,
+			currentOwner: ownerLabel
+		});
+	}
 	return owned;
 }
 /**
@@ -3315,7 +3337,8 @@ async function planApplication(context, httpAdapterBuildResult) {
 	if (application.id) {
 		const otherApps = existingApplications.filter((app) => app.name !== application.name);
 		const renamedAway = await Promise.all(otherApps.map(async (app) => {
-			return isOwnedByApp(await fetchAppLabels(client, workspaceId, app.name), application.name, application.id) ? app.name : null;
+			const labels = await fetchAppLabels(client, workspaceId, app.name);
+			return isOwnedByApp(labels, application.name, application.id) ? app.name : null;
 		}));
 		for (const name of renamedAway) if (name) changeSet.deletes.push({
 			name,
@@ -3517,7 +3540,8 @@ function loadSecretsState(scope) {
 function saveSecretsState(scope, state) {
 	if (!scope.applicationId) return;
 	const filePath = getSecretsStatePath(scope);
-	mkdirSync(path.dirname(filePath), { recursive: true });
+	const dir = path.dirname(filePath);
+	mkdirSync(dir, { recursive: true });
 	const tempPath = `${filePath}.tmp-${randomUUID()}`;
 	writeFileSync(tempPath, JSON.stringify({
 		version: 2,
@@ -3544,9 +3568,9 @@ function serializeUpdateTime(updateTime) {
 	return updateTime === void 0 ? void 0 : `${updateTime.seconds}.${updateTime.nanos}`;
 }
 const LOCK_POLL_INTERVAL_MS = 100;
-const LOCK_ACQUIRE_TIMEOUT_MS = 300 * 1e3;
-const LOCK_HEARTBEAT_INTERVAL_MS = 10 * 1e3;
-const LOCK_LEASE_MS = 60 * 1e3;
+const LOCK_ACQUIRE_TIMEOUT_MS = 3e5;
+const LOCK_HEARTBEAT_INTERVAL_MS = 1e4;
+const LOCK_LEASE_MS = 6e4;
 const lockQueues = /* @__PURE__ */ new Map();
 /**
 * Run a remote-update/state-save sequence exclusively for one target's secrets state.
@@ -3862,7 +3886,7 @@ async function applyAuthConnections(client, result, phase) {
 
 //#endregion
 //#region src/cli/commands/deploy/function-registry.ts
-const CHUNK_SIZE$1 = 64 * 1024;
+const CHUNK_SIZE$1 = 65536;
 /**
 * Compute SHA-256 content hash for a script string.
 * @param content - Script content to hash
@@ -4761,9 +4785,7 @@ async function planServices$3(client, workspaceId, appName, appId, idps, idpUser
 			case void 0:
 				authorization = void 0;
 				break;
-			default:
-				authorization = idp.authorization.cel;
-				break;
+			default: authorization = idp.authorization.cel;
 		}
 		const lang = convertLang(idp.lang);
 		const userAuthPolicy = idp.userAuthPolicy;
@@ -4987,23 +5009,25 @@ function protoIdPCondition(condition) {
 	};
 }
 function protoIdPOperand(operand) {
-	if (typeof operand === "object" && !Array.isArray(operand)) if ("user" in operand) return { kind: {
-		case: "userField",
-		value: operand.user
-	} };
-	else if ("idpUser" in operand) return { kind: {
-		case: "idpUserField",
-		value: operand.idpUser
-	} };
-	else if ("newIdpUser" in operand) return { kind: {
-		case: "newIdpUserField",
-		value: operand.newIdpUser
-	} };
-	else if ("oldIdpUser" in operand) return { kind: {
-		case: "oldIdpUserField",
-		value: operand.oldIdpUser
-	} };
-	else throw new Error(`Unknown operand: ${JSON.stringify(operand)}`);
+	if (typeof operand === "object" && !Array.isArray(operand)) {
+		if ("user" in operand) return { kind: {
+			case: "userField",
+			value: operand.user
+		} };
+		else if ("idpUser" in operand) return { kind: {
+			case: "idpUserField",
+			value: operand.idpUser
+		} };
+		else if ("newIdpUser" in operand) return { kind: {
+			case: "newIdpUserField",
+			value: operand.newIdpUser
+		} };
+		else if ("oldIdpUser" in operand) return { kind: {
+			case: "oldIdpUserField",
+			value: operand.oldIdpUser
+		} };
+		else throw new Error(`Unknown operand: ${JSON.stringify(operand)}`);
+	}
 	return { kind: {
 		case: "value",
 		value: fromJson(ValueSchema, operand)
@@ -6077,12 +6101,13 @@ async function planAuthHooks(client, workspaceId, auths, deletedServices, forceA
 					}
 				}
 			};
-			if (existingHook) if (!forceApplyAll && areAuthHooksEqual(existingHook, hookRequest.hook)) changeSet.unchanged.push({ name: `${config.name}/before-login` });
-			else changeSet.updates.push({
-				name: `${config.name}/before-login`,
-				request: hookRequest
-			});
-			else changeSet.creates.push({
+			if (existingHook) {
+				if (!forceApplyAll && areAuthHooksEqual(existingHook, hookRequest.hook)) changeSet.unchanged.push({ name: `${config.name}/before-login` });
+				else changeSet.updates.push({
+					name: `${config.name}/before-login`,
+					request: hookRequest
+				});
+			} else changeSet.creates.push({
 				name: `${config.name}/before-login`,
 				request: hookRequest
 			});
@@ -6337,9 +6362,9 @@ function resolveSameRunNamespace(sameRunNamespaces, resourceName, resourceLabel)
 	return namespace;
 }
 /**
-* Find the local TailorDB namespace that declares the given type.
+* Find the local TailorDB namespace that declares the given table.
 * @param application - Loaded application
-* @param typeName - TailorDB type name to look up
+* @param typeName - TailorDB table name to look up
 * @returns The declaring namespace, or undefined when no local service has it
 */
 function findTailorDBNamespace(application, typeName) {
@@ -6366,7 +6391,7 @@ function resolveNamespace(params) {
 }
 function resolveTailorDBNamespace(application, typeName, sameRunNamespaces) {
 	return resolveNamespace({
-		resourceLabel: "TailorDB type",
+		resourceLabel: "TailorDB table",
 		resourceName: typeName,
 		localNamespaces: application.tailorDBServices.map((service) => service.namespace),
 		findLocalNamespace: () => findTailorDBNamespace(application, typeName),
@@ -6410,11 +6435,6 @@ function resolveIdpNamespace(application, executorName, idpName, sameRunIdpNames
 	}
 	return assertDefined([...localIdpNames][0], "idp service missing");
 }
-function resolveAuthNamespace(application) {
-	const authNamespace = getApplicationAuthNamespace(application);
-	if (!authNamespace) throw new Error("No Auth service configured");
-	return authNamespace;
-}
 function protoExecutor(context, executor) {
 	const { application } = context;
 	const appName = application.name;
@@ -6490,7 +6510,7 @@ function protoExecutor(context, executor) {
 				case: "auth",
 				value: {
 					eventTypes: trigger.events,
-					namespaceName: resolveAuthNamespace(application)
+					namespaceName: requireApplicationAuthNamespace(application)
 				}
 			});
 			break;
@@ -6782,8 +6802,9 @@ async function planResolvers(client, workspaceId, pipelines, executors, initialE
 	* @returns The resolver's metadata write
 	*/
 	const resolverMetaRequest = async (namespace, resolver) => {
+		const trn = resolverTrn(workspaceId, namespace, resolver.name);
 		return addDependencyRecords(await buildMetaRequest({
-			trn: resolverTrn(workspaceId, namespace, resolver.name),
+			trn,
 			appName: appName ?? "",
 			appId
 		}), {
@@ -7202,18 +7223,22 @@ async function applySecretManager(client, result, phase = "create-update", appli
 	if (phase === "create-update") {
 		await Promise.all(vaultChangeSet.creates.map(async (create) => {
 			await client.createSecretManagerVault(vaultCreateRequest(create));
-			if (application) await writeMetadataLabels(client, await buildMetaRequest({
-				trn: resourceTrn(create.workspaceId, "vault", create.name),
-				appName: application.name,
-				appId: application.id
-			}));
+			if (application) {
+				const metaRequest = await buildMetaRequest({
+					trn: resourceTrn(create.workspaceId, "vault", create.name),
+					appName: application.name,
+					appId: application.id
+				});
+				await writeMetadataLabels(client, metaRequest);
+			}
 		}));
 		if (application) await Promise.all(vaultChangeSet.updates.map(async (update) => {
-			await writeMetadataLabels(client, await buildMetaRequest({
+			const metaRequest = await buildMetaRequest({
 				trn: resourceTrn(update.workspaceId, "vault", update.name),
 				appName: application.name,
 				appId: application.id
-			}));
+			});
+			await writeMetadataLabels(client, metaRequest);
 		}));
 		const secretHashUpdates = [...secretChangeSet.creates, ...secretChangeSet.updates];
 		if (secretHashUpdates.length > 0) await withSecretsStateLock(stateScope, async () => {
@@ -7419,20 +7444,22 @@ function buildValidateStatements(fields, accessExpr, keyPrefix) {
 			const checks = validators.map((v) => `{ const __r = (${v.script?.expr}); if (typeof __r === "string") { __errs[${key(fieldPath)}] = __r; } }`).join("\n");
 			statements.push(`{ const _value = ${access};\n${checks}\n}`);
 		}
-		if (isNestedType(config) && config.fields) if (config.array) {
-			const innerParts = [];
-			for (const [innerName, innerConfig] of Object.entries(config.fields)) {
-				const innerValidators = (innerConfig.validate ?? []).filter((v) => v.script?.expr);
-				if (innerValidators.length > 0) {
-					const errorKeyExpr = `${JSON.stringify(fieldPath + "[")} + __idx + ${JSON.stringify("]." + innerName)}`;
-					const checks = innerValidators.map((v) => `{ const __r = (${v.script?.expr}); if (typeof __r === "string") { __errs[${errorKeyExpr}] = __r; } }`).join("\n");
-					innerParts.push(`{ const _value = __el[${key(innerName)}];\n${checks}\n}`);
+		if (isNestedType(config) && config.fields) {
+			if (config.array) {
+				const innerParts = [];
+				for (const [innerName, innerConfig] of Object.entries(config.fields)) {
+					const innerValidators = (innerConfig.validate ?? []).filter((v) => v.script?.expr);
+					if (innerValidators.length > 0) {
+						const errorKeyExpr = `${JSON.stringify(fieldPath + "[")} + __idx + ${JSON.stringify("]." + innerName)}`;
+						const checks = innerValidators.map((v) => `{ const __r = (${v.script?.expr}); if (typeof __r === "string") { __errs[${errorKeyExpr}] = __r; } }`).join("\n");
+						innerParts.push(`{ const _value = __el[${key(innerName)}];\n${checks}\n}`);
+					}
 				}
+				if (innerParts.length > 0) statements.push(`(${access} || []).forEach((__el, __idx) => {\n${innerParts.join("\n")}\n});`);
+			} else {
+				const nested = buildValidateStatements(config.fields, access, fieldPath);
+				if (nested.length > 0) statements.push(`if (${access} != null) {\n${nested.join("\n")}\n}`);
 			}
-			if (innerParts.length > 0) statements.push(`(${access} || []).forEach((__el, __idx) => {\n${innerParts.join("\n")}\n});`);
-		} else {
-			const nested = buildValidateStatements(config.fields, access, fieldPath);
-			if (nested.length > 0) statements.push(`if (${access} != null) {\n${nested.join("\n")}\n}`);
 		}
 	}
 	return statements;
@@ -7451,13 +7478,13 @@ function wrapValidate(statements, typeValidateExpr) {
 }
 /**
 * Aggregate every field's create/update hook, default, and validate into
-* type-level scripts.  Hooks compute a single shared timestamp (`now`) per
+* table-level scripts.  Hooks compute a single shared timestamp (`now`) per
 * operation, so all fields touched in one create/update observe the same
 * instant.  Defaults are applied after hooks on create only.  Validators
 * run with the same rules on create and update.
 * @param fields - Per-field script configuration
-* @param options - Optional type-level hook/validate expressions
-* @returns Aggregated type-level scripts
+* @param options - Optional table-level hook/validate expressions
+* @returns Aggregated table-level scripts
 */
 function buildTypeScripts(fields, options) {
 	const result = {};
@@ -7792,13 +7819,13 @@ function isSnapshotFieldRefOperand(operand) {
 //#endregion
 //#region src/cli/commands/tailordb/migrate/rename-detection.ts
 /**
-* Field and type rename detection for TailorDB migrations
+* Field and table rename detection for TailorDB migrations
 *
 * A rename has no dedicated platform API, so the diff decomposes it into
-* `field_removed` + `field_added` (`table_removed` + `table_added` for types).
+* `field_removed` + `field_added` (`table_removed` + `table_added` for tables).
 * This module detects removed/added pairs that are compatible enough to be a
 * rename so that `migration generate` can ask the user (or accept
-* `--rename Type.old:new` / `--rename OldType:NewType`) and record a single
+* `--rename Table.oldField:newField` / `--rename OldTable:NewTable`) and record a single
 * `field_renamed` / `table_renamed` change instead.
 */
 /** Modifiers a rename may change, since the Pre-phase relaxes them. */
@@ -7909,7 +7936,7 @@ function assertValidFieldRenames(previous, current, fieldRenames) {
 		}
 		const prevType = previous.tables[tableName];
 		const currType = current.tables[tableName];
-		if (!prevType || !currType) throw new Error(`Cannot rename ${label}: type "${tableName}" must exist in both the previous and the current schema.`);
+		if (!prevType || !currType) throw new Error(`Cannot rename ${label}: table "${tableName}" must exist in both the previous and the current schema.`);
 		const prevField = prevType.fields[previousFieldName];
 		if (!prevField) throw new Error(`Cannot rename ${label}: field "${previousFieldName}" does not exist in the previous schema.`);
 		if (currType.fields[previousFieldName]) throw new Error(`Cannot rename ${label}: field "${previousFieldName}" still exists in the current schema.`);
@@ -7921,13 +7948,13 @@ function assertValidFieldRenames(previous, current, fieldRenames) {
 }
 const RENAME_OPTION_PATTERN = /^([^.:\s]+)\.([^.:\s]+):([^.:\s]+)$/;
 /**
-* Parse a `--rename` option value of the form `Type.old:new`.
+* Parse a `--rename` option value of the form `Table.oldField:newField`.
 * @param {string} value - Raw option value
 * @returns {FieldRenameSpec} Parsed rename spec
 */
 function parseRenameOption(value) {
 	const [, tableName, previousFieldName, fieldName] = value.match(RENAME_OPTION_PATTERN) ?? [];
-	if (!tableName || !previousFieldName || !fieldName) throw new Error(`Invalid --rename value "${value}". Expected format: "Type.oldField:newField".`);
+	if (!tableName || !previousFieldName || !fieldName) throw new Error(`Invalid --rename value "${value}". Expected format: "Table.oldField:newField".`);
 	if (previousFieldName === fieldName) throw new Error(`Invalid --rename value "${value}": old and new field names are identical.`);
 	return {
 		tableName,
@@ -7937,13 +7964,13 @@ function parseRenameOption(value) {
 }
 const DROP_OPTION_PATTERN = /^([^.:\s]+)\.([^.:\s]+)$/;
 /**
-* Parse a `--drop` option value of the form `Type.field`.
+* Parse a `--drop` option value of the form `Table.field`.
 * @param {string} value - Raw option value
 * @returns {FieldDropSpec} Parsed drop spec
 */
 function parseDropOption(value) {
 	const [, tableName, fieldName] = value.match(DROP_OPTION_PATTERN) ?? [];
-	if (!tableName || !fieldName) throw new Error(`Invalid --drop value "${value}". Expected format: "Type.field".`);
+	if (!tableName || !fieldName) throw new Error(`Invalid --drop value "${value}". Expected format: "Table.field".`);
 	return {
 		tableName,
 		fieldName
@@ -7963,13 +7990,13 @@ function dropSpecApplies(spec, previousSnapshot, currentSnapshot) {
 	return Boolean(prevFields?.[spec.fieldName] && !currFields?.[spec.fieldName]);
 }
 /**
-* Parse an `--expand-contract` option value of the form `Type.field`.
+* Parse an `--expand-contract` option value of the form `Table.field`.
 * @param {string} value - Raw option value
 * @returns {FieldExpandContractSpec} Parsed spec
 */
 function parseExpandContractOption(value) {
 	const [, tableName, fieldName] = value.match(DROP_OPTION_PATTERN) ?? [];
-	if (!tableName || !fieldName) throw new Error(`Invalid --expand-contract value "${value}". Expected format: "Type.field".`);
+	if (!tableName || !fieldName) throw new Error(`Invalid --expand-contract value "${value}". Expected format: "Table.field".`);
 	return {
 		tableName,
 		fieldName
@@ -8088,16 +8115,16 @@ function assertValidTypeRenames(previous, current, typeRenames) {
 		const { previousTableName, tableName } = rename;
 		const label = `${previousTableName}:${tableName}`;
 		for (const key of [previousTableName, tableName]) {
-			if (seen.has(key)) throw new Error(`Type "${key}" appears in more than one rename.`);
+			if (seen.has(key)) throw new Error(`Table "${key}" appears in more than one rename.`);
 			seen.add(key);
 		}
 		const prevType = previous.tables[previousTableName];
-		if (!prevType) throw new Error(`Cannot rename ${label}: type "${previousTableName}" does not exist in the previous schema.`);
-		if (current.tables[previousTableName]) throw new Error(`Cannot rename ${label}: type "${previousTableName}" still exists in the current schema.`);
+		if (!prevType) throw new Error(`Cannot rename ${label}: table "${previousTableName}" does not exist in the previous schema.`);
+		if (current.tables[previousTableName]) throw new Error(`Cannot rename ${label}: table "${previousTableName}" still exists in the current schema.`);
 		const currType = current.tables[tableName];
-		if (!currType) throw new Error(`Cannot rename ${label}: type "${tableName}" does not exist in the current schema.`);
-		if (previous.tables[tableName]) throw new Error(`Cannot rename ${label}: type "${tableName}" already exists in the previous schema.`);
-		if (!isTypeRenameCompatible(prevType, currType)) throw new Error(`Cannot rename ${label}: the types are not rename-compatible (every field must keep its name, type, array-ness, required/unique constraints, foreign key target, and scale, enum values must not be removed, indexes must match, self-referential foreign keys must be optional, and types with serial or file fields cannot be renamed).`);
+		if (!currType) throw new Error(`Cannot rename ${label}: table "${tableName}" does not exist in the current schema.`);
+		if (previous.tables[tableName]) throw new Error(`Cannot rename ${label}: table "${tableName}" already exists in the previous schema.`);
+		if (!isTypeRenameCompatible(prevType, currType)) throw new Error(`Cannot rename ${label}: the tables are not rename-compatible (every field must keep its name, type, array-ness, required/unique constraints, foreign key target, and scale, enum values must not be removed, indexes must match, self-referential foreign keys must be optional, and tables with serial or file fields cannot be renamed).`);
 	}
 }
 /**
@@ -8117,14 +8144,14 @@ function isBreakingForeignKeyRetarget(before, after, typeRenameTargets) {
 }
 const TYPE_RENAME_OPTION_PATTERN = /^([^.:\s]+):([^.:\s]+)$/;
 /**
-* Parse a `--rename` option value of the form `OldType:NewType`.
+* Parse a `--rename` option value of the form `OldTable:NewTable`.
 * @param {string} value - Raw option value
 * @returns {TypeRenameSpec} Parsed rename spec
 */
 function parseTypeRenameOption(value) {
 	const [, previousTableName, tableName] = value.match(TYPE_RENAME_OPTION_PATTERN) ?? [];
-	if (!previousTableName || !tableName) throw new Error(`Invalid --rename value "${value}". Expected format: "Type.oldField:newField" or "OldType:NewType".`);
-	if (previousTableName === tableName) throw new Error(`Invalid --rename value "${value}": old and new type names are identical.`);
+	if (!previousTableName || !tableName) throw new Error(`Invalid --rename value "${value}". Expected format: "Table.oldField:newField" or "OldTable:NewTable".`);
+	if (previousTableName === tableName) throw new Error(`Invalid --rename value "${value}": old and new table names are identical.`);
 	return {
 		previousTableName,
 		tableName
@@ -8132,13 +8159,13 @@ function parseTypeRenameOption(value) {
 }
 const TYPE_DROP_OPTION_PATTERN = /^([^.:\s]+)$/;
 /**
-* Parse a `--drop` option value of the form `Type`.
+* Parse a `--drop` option value of the form `Table`.
 * @param {string} value - Raw option value
 * @returns {TypeDropSpec} Parsed drop spec
 */
 function parseTypeDropOption(value) {
 	const [, tableName] = value.match(TYPE_DROP_OPTION_PATTERN) ?? [];
-	if (!tableName) throw new Error(`Invalid --drop value "${value}". Expected format: "Type.field" or "Type".`);
+	if (!tableName) throw new Error(`Invalid --drop value "${value}". Expected format: "Table.field" or "Table".`);
 	return { tableName };
 }
 /**
@@ -8802,15 +8829,15 @@ function normalizeSnapshotField(field) {
 	};
 }
 /**
-* Normalize a snapshot type into the canonical comparison shape, returning a
+* Normalize a snapshot table into the canonical comparison shape, returning a
 * new object rather than mutating the input. Currently fills:
 *   - `pluralForm` via inflection when missing (legacy snapshots written
 *     before `pluralForm` became required may omit it)
 *   - per-field `scale` defaults via {@link normalizeSnapshotField}
 *
 * Idempotent — safe to call multiple times on the same input.
-* @param {TailorDBSnapshotType} type - Snapshot type to normalize
-* @returns {TailorDBSnapshotType} A new, normalized snapshot type object
+* @param {TailorDBSnapshotType} type - Snapshot table to normalize
+* @returns {TailorDBSnapshotType} A new, normalized snapshot table object
 */
 function normalizeSnapshotType(type) {
 	const pluralForm = type.pluralForm || inflection.pluralize(type.name);
@@ -8922,9 +8949,9 @@ function createSnapshotFieldConfigFromOperatorConfig(fieldConfig) {
 	return normalizeSnapshotField(config);
 }
 /**
-* Create a snapshot type from a parsed type
-* @param {TailorDBType} type - Parsed TailorDB type definition
-* @returns {TailorDBSnapshotType} Snapshot type configuration
+* Create a snapshot table from a parsed table
+* @param {TailorDBType} type - Parsed TailorDB table definition
+* @returns {TailorDBSnapshotType} Snapshot table configuration
 */
 function createSnapshotType(type) {
 	const fields = createSnapshotRecord();
@@ -9008,8 +9035,8 @@ function convertActionPermission(permission) {
 	};
 }
 /**
-* Create a schema snapshot from local type definitions
-* @param {Record<string, TailorDBType>} types - Local type definitions
+* Create a schema snapshot from local table definitions
+* @param {Record<string, TailorDBType>} types - Local table definitions
 * @param {string} namespace - Namespace for the snapshot
 * @returns {NormalizedSchemaSnapshot} Normalized schema snapshot
 */
@@ -9067,7 +9094,7 @@ function loadDiff(filePath) {
 	};
 }
 const FIELD_REMOVED_WARNING_REASON = "Field removed (existing data will no longer be accessible through the schema)";
-const TABLE_REMOVED_WARNING_REASON = "Type removed (all records of this type will be deleted during post-migration cleanup)";
+const TABLE_REMOVED_WARNING_REASON = "Table removed (all records in this table will be deleted during post-migration cleanup)";
 /**
 * Reconstruct data-loss warnings from removal changes for diff.json files
 * written before the warning tier existed
@@ -9449,11 +9476,11 @@ function areFieldsDifferent(oldField, newField) {
 }
 /**
 * Collect breaking changes for a field change
-* @param {string} tableName - Name of the type containing the field
+* @param {string} tableName - Name of the table containing the field
 * @param {string} fieldName - Name of the field being changed
 * @param {SnapshotFieldConfig | undefined} oldField - Old field configuration
 * @param {SnapshotFieldConfig | undefined} newField - New field configuration
-* @param {ReadonlyMap<string, string>} [typeRenameTargets] - Confirmed type renames (old name → new name)
+* @param {ReadonlyMap<string, string>} [typeRenameTargets] - Confirmed table renames (old name → new name)
 * @returns {BreakingChangeInfo[]} Breaking change information
 */
 function getBreakingFieldChanges(tableName, fieldName, oldField, newField, typeRenameTargets) {
@@ -9593,11 +9620,11 @@ function compareTypeFields(ctx, tableName, prevType, currType, fieldRenames = []
 	}
 }
 /**
-* Determine if a type-level index change is breaking. Mirrors the field-level
+* Determine if a table-level index change is breaking. Mirrors the field-level
 * unique reasoning: enforcing a unique constraint over existing rows can fail
 * on duplicates, so both adding a unique index and re-pointing an existing
 * unique index at a different field set require a data migration.
-* @param {string} tableName - Name of the type containing the index
+* @param {string} tableName - Name of the table containing the index
 * @param {string} indexName - Name of the index being changed
 * @param {SnapshotIndexConfig | undefined} oldIndex - Old index configuration
 * @param {SnapshotIndexConfig | undefined} newIndex - New index configuration
@@ -9616,9 +9643,9 @@ function isBreakingIndexChange(tableName, indexName, oldIndex, newIndex) {
 	return null;
 }
 /**
-* Compare type-level indexes
+* Compare table-level indexes
 * @param {DiffContext} ctx - Diff context
-* @param {string} tableName - Type name
+* @param {string} tableName - Table name
 * @param {Record<string, SnapshotIndexConfig> | undefined} oldIndexes - Previous indexes
 * @param {Record<string, SnapshotIndexConfig> | undefined} newIndexes - Current indexes
 * @returns {void}
@@ -9664,9 +9691,9 @@ function compareIndexes(ctx, tableName, oldIndexes, newIndexes) {
 	}
 }
 /**
-* Compare type-level file fields
+* Compare table-level file fields
 * @param {DiffContext} ctx - Diff context
-* @param {string} tableName - Type name
+* @param {string} tableName - Table name
 * @param {Record<string, string> | undefined} oldFiles - Previous file fields
 * @param {Record<string, string> | undefined} newFiles - Current file fields
 * @returns {void}
@@ -9699,9 +9726,9 @@ function compareFiles(ctx, tableName, oldFiles, newFiles) {
 	}
 }
 /**
-* Compare type-level relationships
+* Compare table-level relationships
 * @param {DiffContext} ctx - Diff context
-* @param {string} tableName - Type name
+* @param {string} tableName - Table name
 * @param {"forward" | "backward"} relationshipType - Relationship direction to compare
 * @param {Record<string, SnapshotRelationship> | undefined} oldRelationships - Previous relationships
 * @param {Record<string, SnapshotRelationship> | undefined} newRelationships - Current relationships
@@ -9744,9 +9771,9 @@ function compareRelationships(ctx, tableName, relationshipType, oldRelationships
 	}
 }
 /**
-* Compare type-level permissions
+* Compare table-level permissions
 * @param {DiffContext} ctx - Diff context
-* @param {string} tableName - Type name
+* @param {string} tableName - Table name
 * @param {SnapshotRecordPermission | undefined} oldRecordPerm - Previous record permission
 * @param {SnapshotRecordPermission | undefined} newRecordPerm - Current record permission
 * @param {SnapshotGqlPermission | undefined} oldGqlPerm - Previous GQL permission
@@ -9993,8 +10020,8 @@ function compareSnapshots(previous, current, options) {
 	const previousTypeNames = new Set(Object.keys(previous.tables));
 	const currentTypeNames = new Set(Object.keys(current.tables));
 	for (const rename of typeRenames) {
-		const prevType = assertDefined(previous.tables[rename.previousTableName], `renamed type "${rename.previousTableName}" missing from previous snapshot`);
-		const currType = assertDefined(current.tables[rename.tableName], `renamed type "${rename.tableName}" missing from current snapshot`);
+		const prevType = assertDefined(previous.tables[rename.previousTableName], `renamed table "${rename.previousTableName}" missing from previous snapshot`);
+		const currType = assertDefined(current.tables[rename.tableName], `renamed table "${rename.tableName}" missing from current snapshot`);
 		ctx.changes.push({
 			kind: "table_renamed",
 			tableName: rename.tableName,
@@ -10004,7 +10031,7 @@ function compareSnapshots(previous, current, options) {
 		});
 		ctx.breakingChanges.push({
 			tableName: rename.tableName,
-			reason: `Type renamed from ${rename.previousTableName} to ${rename.tableName} (existing records must be copied by the migration script)`
+			reason: `Table renamed from ${rename.previousTableName} to ${rename.tableName} (existing records must be copied by the migration script)`
 		});
 		ctx.breakingChanges.push({
 			tableName: rename.tableName,
@@ -10035,8 +10062,8 @@ function compareSnapshots(previous, current, options) {
 	}
 	for (const tableName of currentTypeNames) {
 		if (!previousTypeNames.has(tableName)) continue;
-		const prevType = assertDefined(previous.tables[tableName], `type "${tableName}" missing from previous snapshot`);
-		const currType = assertDefined(current.tables[tableName], `type "${tableName}" missing from current snapshot`);
+		const prevType = assertDefined(previous.tables[tableName], `table "${tableName}" missing from previous snapshot`);
+		const currType = assertDefined(current.tables[tableName], `table "${tableName}" missing from current snapshot`);
 		compareTypeSettings(ctx, tableName, prevType, currType);
 		compareTypeScripts(ctx, tableName, prevType, currType);
 		compareTypeFields(ctx, tableName, prevType, currType, renamesByType.get(tableName));
@@ -10059,13 +10086,13 @@ function compareSnapshots(previous, current, options) {
 	};
 }
 /**
-* Compare a snapshot against canonical TailorDBSnapshotType-shaped local types.
+* Compare a snapshot against canonical TailorDBSnapshotType-shaped local tables.
 * Callers are expected to pre-convert TailorDBService.types to TailorDBSnapshotType via
 * `createSnapshotType`. As a safety net, both sides are re-run through idempotent
 * normalization here, so a caller that forgets will still get correct
 * comparisons (no silent false drift).
 * @param {SchemaSnapshot} snapshot - Schema snapshot to compare against
-* @param {Record<string, TailorDBSnapshotType>} localTypes - Local snapshot-shaped types
+* @param {Record<string, TailorDBSnapshotType>} localTypes - Local snapshot-shaped tables
 * @param {string} namespace - Namespace for comparison
 * @returns {MigrationDiff} Migration diff
 */
@@ -10186,7 +10213,7 @@ function convertRemoteFieldToSnapshot(remoteField) {
 }
 /**
 * Convert remote ParsedTailorDBType to SnapshotFieldConfig for comparison
-* @param {ProtoTailorDBType} remoteType - Remote TailorDB type from API
+* @param {ProtoTailorDBType} remoteType - Remote TailorDB table from API
 * @returns {Record<string, SnapshotFieldConfig>} Converted field configs
 */
 function convertRemoteFieldsToSnapshot(remoteType) {
@@ -10369,8 +10396,8 @@ function convertRemoteTypeToSnapshot(remoteType, expectedType) {
 	return snapshotType;
 }
 /**
-* Convert remote TailorDB types into the normalized snapshot shape used by drift checks.
-* @param {ProtoTailorDBType[]} remoteTypes - Remote TailorDB types from the API
+* Convert remote TailorDB tables into the normalized snapshot shape used by drift checks.
+* @param {ProtoTailorDBType[]} remoteTypes - Remote TailorDB tables from the API
 * @param {string} namespace - Namespace for the reconstructed snapshot
 * @param {readonly RemoteGqlPermission[]} remoteGqlPermissions - Remote GQL permissions for the namespace
 * @param {SchemaSnapshot} expectedSnapshot - Optional snapshot used to disambiguate remote relationship direction
@@ -10494,7 +10521,7 @@ function addFieldDifferences(differences, prefix, remoteField, snapshotField) {
 }
 /**
 * Compare a single field between remote and snapshot
-* @param {string} tableName - Name of the type
+* @param {string} tableName - Name of the table
 * @param {string} fieldName - Name of the field
 * @param {SnapshotFieldConfig} remoteField - Remote field config
 * @param {SnapshotFieldConfig} snapshotField - Snapshot field config
@@ -10516,8 +10543,8 @@ function compareFields(tableName, fieldName, remoteField, snapshotField) {
 */
 const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["id"]);
 /**
-* Compare remote TailorDB types with a local snapshot
-* @param {ProtoTailorDBType[]} remoteTypes - Remote types from listParsedTailorDBTypes API
+* Compare remote TailorDB tables with a local snapshot
+* @param {ProtoTailorDBType[]} remoteTypes - Remote tables from listParsedTailorDBTypes API
 * @param {SchemaSnapshot} snapshot - Local schema snapshot
 * @param {readonly RemoteGqlPermission[]} remoteGqlPermissions - Remote GQL permissions for the namespace
 * @returns {SchemaDrift[]} List of drifts detected
@@ -10562,12 +10589,12 @@ function compareScriptHashes(remoteTypes, snapshot) {
 			if (localHash !== remoteHash) drifts.push({
 				tableName,
 				kind: "script_mismatch",
-				details: remoteHash ? `Type '${tableName}' scripts differ between remote and snapshot` : `Type '${tableName}' has no script hash on remote`
+				details: remoteHash ? `Table '${tableName}' scripts differ between remote and snapshot` : `Table '${tableName}' has no script hash on remote`
 			});
 		} else if (remoteHasScripts(remoteType)) drifts.push({
 			tableName,
 			kind: "script_mismatch",
-			details: `Type '${tableName}' has scripts on remote but not in snapshot`
+			details: `Table '${tableName}' has scripts on remote but not in snapshot`
 		});
 	}
 	return drifts;
@@ -10616,23 +10643,23 @@ function schemaDriftFromDiffChange(change) {
 		case "table_added": return {
 			tableName: change.tableName,
 			kind: "type_missing_remote",
-			details: `Type '${change.tableName}' exists in snapshot but not in remote`
+			details: `Table '${change.tableName}' exists in snapshot but not in remote`
 		};
 		case "table_removed": return {
 			tableName: change.tableName,
 			kind: "type_missing_local",
-			details: `Type '${change.tableName}' exists in remote but not in snapshot`
+			details: `Table '${change.tableName}' exists in remote but not in snapshot`
 		};
 		case "table_renamed": return {
 			tableName: change.tableName,
 			kind: "type_settings_mismatch",
-			details: `Type '${change.previousTableName}' was renamed to '${change.tableName}'`
+			details: `Table '${change.previousTableName}' was renamed to '${change.tableName}'`
 		};
 		case "table_settings_modified":
 		case "table_modified": return {
 			tableName: change.tableName,
 			kind: "type_settings_mismatch",
-			details: change.reason ?? "Type settings differ between remote and snapshot"
+			details: change.reason ?? "Table settings differ between remote and snapshot"
 		};
 		case "field_added": return {
 			tableName: change.tableName,
@@ -10719,7 +10746,7 @@ function schemaDriftFromDiffChange(change) {
 		case "table_scripts_modified": return {
 			tableName: change.tableName,
 			kind: "script_mismatch",
-			details: change.reason ?? "Type-level scripts differ between remote and snapshot"
+			details: change.reason ?? "Table-level scripts differ between remote and snapshot"
 		};
 		default: throw new Error("Unsupported diff change");
 	}
@@ -10742,7 +10769,7 @@ function formatSchemaDrifts(drifts) {
 		driftsByType.set(drift.tableName, existing);
 	}
 	for (const [tableName, typeDrifts] of driftsByType) {
-		lines.push(`  Type '${tableName}':`);
+		lines.push(`  Table '${tableName}':`);
 		for (const drift of typeDrifts) if (drift.fieldName) lines.push(`    - Field '${drift.fieldName}': ${drift.details}`);
 		else if (drift.indexName) lines.push(`    - Index '${drift.indexName}': ${drift.details}`);
 		else if (drift.fileName) lines.push(`    - File '${drift.fileName}': ${drift.details}`);
@@ -10848,10 +10875,10 @@ function captureMigrationFileState(namespacesWithMigrations) {
 * without relying on local TypeScript definitions.
 */
 /**
-* Generate a TailorDB type manifest from a snapshot type
-* @param {TailorDBSnapshotType} snapshotType - Snapshot type to generate manifest from
+* Generate a TailorDB table manifest from a snapshot table
+* @param {TailorDBSnapshotType} snapshotType - Snapshot table to generate manifest from
 * @param {GenerateManifestOptions} options - Generation options
-* @returns {MessageInitShape<typeof TailorDBTypeSchema>} Type manifest
+* @returns {MessageInitShape<typeof TailorDBTypeSchema>} Table manifest
 */
 function generateTailorDBTypeManifestFromSnapshot(snapshotType, options = {}) {
 	const pluralForm = inflection.camelize(snapshotType.pluralForm, true);
@@ -11120,10 +11147,10 @@ function convertOperandToProto(operand) {
 	} };
 }
 /**
-* Generate all TailorDB type manifests from a schema snapshot
+* Generate all TailorDB table manifests from a schema snapshot
 * @param {SchemaSnapshot} snapshot - Schema snapshot
 * @param {GenerateAllManifestsOptions} options - Generation options
-* @returns {Map<string, MessageInitShape<typeof TailorDBTypeSchema>>} Map of type name to manifest
+* @returns {Map<string, MessageInitShape<typeof TailorDBTypeSchema>>} Map of table name to manifest
 */
 function generateAllTypeManifestsFromSnapshot(snapshot, options = {}) {
 	const manifests = /* @__PURE__ */ new Map();
@@ -11138,9 +11165,9 @@ function generateAllTypeManifestsFromSnapshot(snapshot, options = {}) {
 	return manifests;
 }
 /**
-* Compare snapshot types with existing remote type names
+* Compare snapshot tables with existing remote table names
 * @param {SchemaSnapshot} snapshot - Schema snapshot
-* @param {ReadonlySet<string>} existingTypeNames - Set of existing type names in remote
+* @param {ReadonlySet<string>} existingTypeNames - Set of existing table names in remote
 * @returns {SnapshotTypeComparison} Comparison result
 */
 function compareSnapshotWithRemote(snapshot, existingTypeNames) {
@@ -11273,15 +11300,15 @@ function protoGqlOperand(operand) {
 * - `field_type_modified`: keep the complete previous field config until
 *   Post-phase so migrate.ts runs against the previous type contract.
 *
-* and the type-level index adjustments:
+* and the table-level index adjustments:
 *
 * - `index_added` with `unique: true`: withhold the index until Post-phase.
 * - `index_modified` that gains a unique constraint or re-points a unique
 *   index at different fields: keep the previous definition until Post-phase.
 *
-* Type-level deletions (`table_removed`) and renames (`table_renamed`) are
-* handled by the deploy flow rather than via this module: the old type is
-* retained until Post-phase, and a renamed type's new type is created with
+* Table-level deletions (`table_removed`) and renames (`table_renamed`) are
+* handled by the deploy flow rather than via this module: the old table is
+* retained until Post-phase, and a renamed table's new table is created with
 * its full constraints in the Pre-phase (the copy script writes complete
 * rows, so nothing needs relaxing).
 *
@@ -11308,15 +11335,15 @@ function isPreMigrationFieldChange(change) {
 	return PRE_MIGRATION_FIELD_KINDS.has(change.kind);
 }
 /**
-* Create the type snapshot used to build a Pre-phase manifest.
+* Create the table snapshot used to build a Pre-phase manifest.
 *
 * This adjustment happens before manifest generation because field hooks and
-* validators are aggregated into type-level scripts by the manifest builder.
+* validators are aggregated into table-level scripts by the manifest builder.
 * Replacing only the generated field proto would leave those scripts on the
 * target field contract while migrate.ts still runs against the previous one.
 * @param snapshotType - Final snapshot state for this migration
-* @param typeChanges - Field changes for this type, keyed by field name
-* @param typeScriptsChange - Type-level scripts changed by the same migration
+* @param typeChanges - Field changes for this table, keyed by field name
+* @param typeScriptsChange - Table-level scripts changed by the same migration
 * @returns A snapshot with Pre-phase field contracts
 */
 function createPreMigrationSnapshotType(snapshotType, typeChanges, typeScriptsChange) {
@@ -11366,7 +11393,7 @@ function buildPreMigrationChangesMap(pendingMigrations) {
 * - Modified fields keep the looser side of unique/required/enum.
 *
 * @param {Record<string, MessageInitShape<typeof TailorDBType_FieldConfigSchema>>} fields - Field map to adjust (mutated in place)
-* @param {Map<string, FieldDiffChange>} typeChanges - Changes for this type, keyed by fieldName
+* @param {Map<string, FieldDiffChange>} typeChanges - Changes for this table, keyed by fieldName
 */
 function applyPreMigrationFieldAdjustments(fields, typeChanges) {
 	for (const [fieldName, change] of typeChanges) {
@@ -11411,7 +11438,7 @@ function applyPreMigrationFieldAdjustments(fields, typeChanges) {
 	}
 }
 /**
-* Build a map of type-level index changes that require pre-migration schema
+* Build a map of table-level index changes that require pre-migration schema
 * adjustment (the breaking ones — see {@link isBreakingIndexChange}).
 * @param {PendingMigration[]} pendingMigrations - Pending migrations to scan
 * @returns {PreMigrationIndexChangesMap} Map of changes keyed by tableName/indexName
@@ -11429,7 +11456,7 @@ function buildPreMigrationIndexChangesMap(pendingMigrations) {
 	return map;
 }
 /**
-* Apply pre-migration schema adjustments to a type's index map in place.
+* Apply pre-migration schema adjustments to a table's index map in place.
 *
 * The indexes map is the proto-shape `TailorDBType.schema.indexes` that will
 * be sent in the Pre-phase. We mutate it so that:
@@ -11438,7 +11465,7 @@ function buildPreMigrationIndexChangesMap(pendingMigrations) {
 * - Modified indexes keep their previous definition until Post-phase.
 *
 * @param {Record<string, MessageInitShape<typeof TailorDBType_IndexSchema>>} indexes - Index map to adjust (mutated in place)
-* @param {Map<string, IndexDiffChange>} typeIndexChanges - Changes for this type, keyed by indexName
+* @param {Map<string, IndexDiffChange>} typeIndexChanges - Changes for this table, keyed by indexName
 */
 function applyPreMigrationIndexAdjustments(indexes, typeIndexChanges) {
 	for (const [indexName, change] of typeIndexChanges) {
@@ -11500,7 +11527,7 @@ async function fetchRemoteMigrationNumber(client, trn) {
 * Schema validation checks shared between `deploy` and
 * `tailordb migration validate`.
 *
-* These checks are read-only: they compare local type definitions, the
+* These checks are read-only: they compare local table definitions, the
 * migration snapshot history, and the remote schema without mutating any
 * state.
 */
@@ -11519,11 +11546,11 @@ function toTailorDBDeployInput(service) {
 	};
 }
 /**
-* Fetch all TailorDB types from remote for a namespace
+* Fetch all TailorDB tables from remote for a namespace
 * @param {OperatorClient} client - Operator client instance
 * @param {string} workspaceId - Workspace ID
 * @param {string} namespace - TailorDB namespace
-* @returns {Promise<ProtoTailorDBType[]>} Remote TailorDB types
+* @returns {Promise<ProtoTailorDBType[]>} Remote TailorDB tables
 */
 async function fetchRemoteTypes(client, workspaceId, namespace) {
 	return fetchAllTolerant(async (pageToken, maxPageSize) => {
@@ -11667,7 +11694,8 @@ async function verifyRemoteSchema(client, workspaceId, namespacesWithMigrations,
 			});
 			continue;
 		}
-		const expectedSnapshot = reconstructSnapshotFromMigrations(migrationsDir, checkpointRepair?.to ?? remoteMigrationNumber);
+		const expectedMigrationNumber = checkpointRepair?.to ?? remoteMigrationNumber;
+		const expectedSnapshot = reconstructSnapshotFromMigrations(migrationsDir, expectedMigrationNumber);
 		if (!expectedSnapshot) {
 			results.push({
 				namespace,
@@ -11679,7 +11707,8 @@ async function verifyRemoteSchema(client, workspaceId, namespacesWithMigrations,
 			continue;
 		}
 		const [remoteTypes, remoteGqlPermissions] = await Promise.all([fetchRemoteTypes(client, workspaceId, namespace), fetchRemoteGqlPermissions(client, workspaceId, namespace)]);
-		const drifts = compareRemoteWithSnapshot(remoteTypes, deployComparableSnapshot(expectedSnapshot, remoteTypes, namespaceGqlOperations(config, tailorDBInputs, namespace)), remoteGqlPermissions);
+		const expectedDeploySnapshot = deployComparableSnapshot(expectedSnapshot, remoteTypes, namespaceGqlOperations(config, tailorDBInputs, namespace));
+		const drifts = compareRemoteWithSnapshot(remoteTypes, expectedDeploySnapshot, remoteGqlPermissions);
 		results.push({
 			namespace,
 			remoteMigrationNumber,
@@ -11701,7 +11730,7 @@ function logRemoteDriftGuidance() {
 	logger.newline();
 	logger.info("To resolve:");
 	logger.info("  - Run 'tailor tailordb migration status' to compare local vs remote.", { mode: "plain" });
-	logger.info("  - If remote is correct, update local types and run 'migration generate'.", { mode: "plain" });
+	logger.info("  - If remote is correct, update local tables and run 'migration generate'.", { mode: "plain" });
 	logger.info("  - If local migration history is correct, run 'migration sync <N>' to overwrite remote.", { mode: "plain" });
 	logger.info("  - If only bookkeeping is stale, run 'migration set <N>'.", { mode: "plain" });
 }
@@ -11724,7 +11753,7 @@ function formatRemoteVerificationResults(results) {
 }
 /**
 * Check if there are schema differences between migration snapshots and local definitions
-* @param {ReadonlyMap<string, Record<string, TailorDBSnapshotType>>} typesByNamespace - Snapshot-shaped local types by namespace
+* @param {ReadonlyMap<string, Record<string, TailorDBSnapshotType>>} typesByNamespace - Snapshot-shaped local tables by namespace
 * @param {NamespaceWithMigrations[]} namespacesWithMigrations - Namespaces with migrations config
 * @returns {Promise<MigrationCheckResult[]>} Results for each namespace
 */
@@ -12214,11 +12243,13 @@ async function detectPendingMigrations(client, workspaceId, namespacesWithMigrat
 */
 async function executeSingleMigration(options, migration) {
 	const { client, workspaceId, invoker, env, configDir } = options;
+	const migrationName = `migration-${migration.namespace}-${formatMigrationNumber(migration.number)}.js`;
+	const bundleResult = await bundleMigrationScript(migration.scriptPath, migration.namespace, migration.number, env, configDir);
 	const result = await executeScript({
 		client,
 		workspaceId,
-		name: `migration-${migration.namespace}-${formatMigrationNumber(migration.number)}.js`,
-		code: (await bundleMigrationScript(migration.scriptPath, migration.namespace, migration.number, env, configDir)).bundledCode,
+		name: migrationName,
+		code: bundleResult.bundledCode,
 		invoker
 	});
 	return {
@@ -12239,8 +12270,9 @@ async function executeSingleMigration(options, migration) {
 * @returns {Promise<void>}
 */
 async function updateMigrationLabel(client, workspaceId, namespace, migrationNumber, historyId) {
+	const trn = resourceTrn(workspaceId, "tailordb", namespace);
 	await writeMetadataLabels(client, {
-		trn: resourceTrn(workspaceId, "tailordb", namespace),
+		trn,
 		labels: {
 			[MIGRATION_LABEL_KEY]: sanitizeMigrationLabel(migrationNumber),
 			...historyId ? { [MIGRATION_HISTORY_LABEL_KEY]: historyId } : {}
@@ -12329,14 +12361,15 @@ function migrationFileStatesEqual(planned, current) {
 * Validate migration files and detect pending migrations
 * @param {OperatorClient} client - Operator client instance
 * @param {string} workspaceId - Workspace ID
-* @param {ReadonlyMap<string, Record<string, TailorDBSnapshotType>>} typesByNamespace - Types by namespace
+* @param {ReadonlyMap<string, Record<string, TailorDBSnapshotType>>} typesByNamespace - Tables by namespace
 * @param {LoadedConfig} config - Loaded application config (includes path)
 * @param {boolean} noSchemaCheck - Whether to skip schema diff check
 * @param {ReadonlyArray<TailorDBDeployInput>} tailorDBInputs - Deploy inputs for namespace defaults
 * @returns {Promise<ValidateAndDetectResult>} Pending migrations and namespaces that have migration directories configured
 */
 async function validateAndDetectMigrations(client, workspaceId, typesByNamespace, config, noSchemaCheck, tailorDBInputs) {
-	const namespacesWithMigrations = getNamespacesWithMigrations(config, path.dirname(config.path));
+	const configDir = path.dirname(config.path);
+	const namespacesWithMigrations = getNamespacesWithMigrations(config, configDir);
 	let pendingMigrations = [];
 	let checkpointRepairs = [];
 	const migrationHistoryIds = Object.create(null);
@@ -12498,10 +12531,43 @@ async function applyTailorDB(client, result, phase = "create-update") {
 			await executeServicesCreation(client, changeSet);
 			const migratingNamespaces = new Set(pendingMigrations.map((m) => m.namespace));
 			const isOutsideMigrations = (namespaceName) => namespaceName !== void 0 && !migratingNamespaces.has(namespaceName);
+			const firstPendingByNamespace = /* @__PURE__ */ new Map();
+			const pendingDeletedTypes = /* @__PURE__ */ new Map();
+			for (const migration of pendingMigrations) {
+				const first = firstPendingByNamespace.get(migration.namespace);
+				if (!first || migration.number < first.number) firstPendingByNamespace.set(migration.namespace, migration);
+				const deleted = pendingDeletedTypes.get(migration.namespace) ?? /* @__PURE__ */ new Set();
+				for (const typeName of getDeletedTypeNames(migration)) deleted.add(typeName);
+				pendingDeletedTypes.set(migration.namespace, deleted);
+			}
+			const preMigrationTables = /* @__PURE__ */ new Map();
+			for (const [namespace, first] of firstPendingByNamespace) {
+				const snapshot = reconstructSnapshotFromMigrations(first.migrationsDir, first.number - 1);
+				if (!snapshot) throw new Error(`Cannot reconstruct the schema state before migration ${formatMigrationNumber(first.number)} for namespace "${namespace}"`);
+				preMigrationTables.set(namespace, snapshot.tables);
+			}
 			try {
 				for (const create of changeSet.type.creates) {
-					if (!isOutsideMigrations(create.request.namespaceName)) continue;
-					await client.createTailorDBType(create.request);
+					const namespaceName = create.request.namespaceName;
+					if (isOutsideMigrations(namespaceName)) {
+						await client.createTailorDBType(create.request);
+						continue;
+					}
+					const typeName = create.request.tailordbType?.name;
+					if (!namespaceName || !typeName) continue;
+					const priorType = preMigrationTables.get(namespaceName)?.[typeName];
+					if (!priorType) continue;
+					if (pendingDeletedTypes.get(namespaceName)?.has(typeName)) continue;
+					const input = migrationContext.tailorDBInputs.find((i) => i.namespace === namespaceName);
+					processedTypes.created.add(typeName);
+					await client.createTailorDBType({
+						workspaceId: create.request.workspaceId,
+						namespaceName,
+						tailordbType: generateTailorDBTypeManifestFromSnapshot(priorType, {
+							subscribed: migrationContext.executorUsedTypes.has(typeName),
+							namespaceGqlOperations: input?.config.gqlOperations
+						})
+					});
 				}
 				for (const update of changeSet.type.updates) {
 					if (!isOutsideMigrations(update.request.namespaceName)) continue;
@@ -12518,17 +12584,18 @@ async function applyTailorDB(client, result, phase = "create-update") {
 				logger.newline();
 			}
 			for (const migration of pendingMigrations) {
+				const attemptedTypes = /* @__PURE__ */ new Set();
 				try {
-					await executeSingleMigrationPrePhase(client, changeSet, migration, migrationContext.tailorDBInputs, migrationContext.executorUsedTypes);
+					await executeSingleMigrationPrePhase(client, changeSet, migration, migrationContext.tailorDBInputs, migrationContext.executorUsedTypes, attemptedTypes);
 					if (migration.hasScript && migrationCtx) await executeMigrations(migrationCtx, [migration]);
 				} catch (error) {
-					await rollbackSingleMigrationAfterFailure(client, changeSet, migration, migrationContext.workspaceId, migrationContext.tailorDBInputs, migrationContext.executorUsedTypes);
+					await rollbackSingleMigrationAfterFailure(client, migration, migrationContext.workspaceId, migrationContext.tailorDBInputs, migrationContext.executorUsedTypes, attemptedTypes);
 					throw error;
 				}
 				try {
-					await executeSingleMigrationPostPhase(client, changeSet, migration, migrationContext.tailorDBInputs, migrationContext.executorUsedTypes);
+					await executeSingleMigrationPostPhase(client, changeSet, migration, migrationContext.tailorDBInputs, migrationContext.executorUsedTypes, attemptedTypes);
 				} catch (error) {
-					await rollbackSingleMigrationAfterFailure(client, changeSet, migration, migrationContext.workspaceId, migrationContext.tailorDBInputs, migrationContext.executorUsedTypes);
+					await rollbackSingleMigrationAfterFailure(client, migration, migrationContext.workspaceId, migrationContext.tailorDBInputs, migrationContext.executorUsedTypes, attemptedTypes);
 					throw error;
 				}
 				try {
@@ -12598,9 +12665,9 @@ async function applyTailorDB(client, result, phase = "create-update") {
 	} else await Promise.all(changeSet.service.deletes.map((del) => client.deleteTailorDBService(del.request)));
 }
 /**
-* Get the set of type names affected by a migration
+* Get the set of table names affected by a migration
 * @param {PendingMigration} migration - Pending migration
-* @returns {Set<string>} Set of affected type names
+* @returns {Set<string>} Set of affected table names
 */
 function getAffectedTypeNames(migration) {
 	const typeNames = /* @__PURE__ */ new Set();
@@ -12608,11 +12675,11 @@ function getAffectedTypeNames(migration) {
 	return typeNames;
 }
 /**
-* Get the set of type names to be deleted by a migration. A renamed type's
-* old name is included: the old type survives the Pre-phase and the script
-* (which copies its rows into the new type), then is dropped here.
+* Get the set of table names to be deleted by a migration. A renamed table's
+* old name is included: the old table survives the Pre-phase and the script
+* (which copies its rows into the new table), then is dropped here.
 * @param {PendingMigration} migration - Pending migration
-* @returns {Set<string>} Set of type names to delete
+* @returns {Set<string>} Set of table names to delete
 */
 function getDeletedTypeNames(migration) {
 	const typeNames = /* @__PURE__ */ new Set();
@@ -12633,7 +12700,7 @@ async function executeServicesCreation(client, changeSet) {
 	}), ...changeSet.service.updates.map((update) => writeMetadataLabels(client, update.metaRequest))]);
 }
 /**
-* Track which types have been created/updated across migrations
+* Track which tables have been created/updated across migrations
 */
 const processedTypes = {
 	created: /* @__PURE__ */ new Set(),
@@ -12675,7 +12742,8 @@ function buildSnapshotTypeManifest(migration, tableName, tailorDBInputs, executo
 	if (!snapshotType) return void 0;
 	const input = tailorDBInputs.find((i) => i.namespace === migration.namespace);
 	const typeScriptsChange = migration.diff.changes.find((change) => change.kind === "table_scripts_modified" && change.tableName === tableName);
-	return generateTailorDBTypeManifestFromSnapshot(typeChanges ? createPreMigrationSnapshotType(snapshotType, typeChanges, typeScriptsChange) : snapshotType, {
+	const manifestSnapshotType = typeChanges ? createPreMigrationSnapshotType(snapshotType, typeChanges, typeScriptsChange) : snapshotType;
+	return generateTailorDBTypeManifestFromSnapshot(manifestSnapshotType, {
 		subscribed: executorUsedTypes.has(snapshotType.name),
 		namespaceGqlOperations: input?.config.gqlOperations
 	});
@@ -12697,10 +12765,11 @@ async function awaitAllSettledOrThrow(promises) {
 * @param {TailorDBChangeSet} changeSet - TailorDB change set
 * @param {PendingMigration} migration - Single pending migration
 * @param tailorDBInputs - Deploy inputs, used to resolve namespace gqlOperations for the snapshot
-* @param executorUsedTypes - Types used by executors (drives publishRecordEvents default)
+* @param executorUsedTypes - Tables used by executors (drives publishRecordEvents default)
+* @param attemptedTypes - Tables whose schema this migration attempted to create or update
 * @returns {Promise<void>} Promise that resolves when pre-migration phase completes
 */
-async function executeSingleMigrationPrePhase(client, changeSet, migration, tailorDBInputs, executorUsedTypes) {
+async function executeSingleMigrationPrePhase(client, changeSet, migration, tailorDBInputs, executorUsedTypes, attemptedTypes) {
 	const preMigrationChanges = buildPreMigrationChangesMap([migration]);
 	const preMigrationIndexChanges = buildPreMigrationIndexChangesMap([migration]);
 	const affectedTypes = getAffectedTypeNames(migration);
@@ -12717,6 +12786,7 @@ async function executeSingleMigrationPrePhase(client, changeSet, migration, tail
 		const indexChanges = preMigrationIndexChanges.get(tableName);
 		if (indexChanges && indexChanges.size > 0 && clonedRequest.tailordbType.schema?.indexes) applyPreMigrationIndexAdjustments(clonedRequest.tailordbType.schema.indexes, indexChanges);
 		processedTypes.created.add(tableName);
+		attemptedTypes.add(tableName);
 		await client.createTailorDBType(clonedRequest);
 	}
 	for (const create of changeSet.type.creates) {
@@ -12730,6 +12800,7 @@ async function executeSingleMigrationPrePhase(client, changeSet, migration, tail
 		const indexChanges = preMigrationIndexChanges.get(tableName);
 		if (indexChanges && indexChanges.size > 0 && clonedTypeRequest.schema?.indexes) applyPreMigrationIndexAdjustments(clonedTypeRequest.schema.indexes, indexChanges);
 		processedTypes.updated.add(tableName);
+		attemptedTypes.add(tableName);
 		await client.updateTailorDBType({
 			workspaceId: create.request.workspaceId,
 			namespaceName: create.request.namespaceName,
@@ -12748,6 +12819,7 @@ async function executeSingleMigrationPrePhase(client, changeSet, migration, tail
 		const indexChanges = preMigrationIndexChanges.get(tableName);
 		if (indexChanges && indexChanges.size > 0 && clonedRequest.tailordbType.schema?.indexes) applyPreMigrationIndexAdjustments(clonedRequest.tailordbType.schema.indexes, indexChanges);
 		processedTypes.updated.add(tableName);
+		attemptedTypes.add(tableName);
 		await client.updateTailorDBType(clonedRequest);
 	}
 	if (!processedTypes.gqlPermissionsProcessed.has(migration.namespace)) {
@@ -12760,7 +12832,10 @@ async function executeSingleMigrationPrePhase(client, changeSet, migration, tail
 		});
 		if (missingTypeCreates.length > 0) for (const create of missingTypeCreates) {
 			const tableName = create.request.tailordbType?.name;
-			if (tableName) processedTypes.created.add(tableName);
+			if (tableName) {
+				processedTypes.created.add(tableName);
+				attemptedTypes.add(tableName);
+			}
 			await client.createTailorDBType(create.request);
 		}
 		processedTypes.gqlPermissionsProcessed.add(migration.namespace);
@@ -12768,7 +12843,7 @@ async function executeSingleMigrationPrePhase(client, changeSet, migration, tail
 	}
 }
 /**
-* Track which types/permissions have been deleted across migrations
+* Track which tables/permissions have been deleted across migrations
 */
 const deletedResources = {
 	types: /* @__PURE__ */ new Set(),
@@ -12778,23 +12853,24 @@ const deletedResources = {
 		this.gqlPermissions.clear();
 	}
 };
-async function rollbackSingleMigrationAfterFailure(client, changeSet, migration, workspaceId, tailorDBInputs, executorUsedTypes) {
+async function rollbackSingleMigrationAfterFailure(client, migration, workspaceId, tailorDBInputs, executorUsedTypes, attemptedTypes) {
 	try {
-		await rollbackSingleMigrationPrePhase(client, changeSet, migration, workspaceId, tailorDBInputs, executorUsedTypes);
+		await rollbackSingleMigrationPrePhase(client, migration, workspaceId, tailorDBInputs, executorUsedTypes, attemptedTypes);
 	} catch (rollbackError) {
 		logger.warn(`Failed to roll back migration ${migration.namespace}/${formatMigrationNumber(migration.number)}: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
 	}
 }
 /**
-* Execute post-migration phase for a single migration: Apply final types (with required: true)
+* Execute post-migration phase for a single migration: Apply final tables (with required: true)
 * @param {OperatorClient} client - Operator client instance
 * @param {TailorDBChangeSet} changeSet - TailorDB change set
 * @param {PendingMigration} migration - Single pending migration
 * @param tailorDBInputs - Deploy inputs, used to resolve namespace gqlOperations for the snapshot
-* @param executorUsedTypes - Types used by executors (drives publishRecordEvents default)
+* @param executorUsedTypes - Tables used by executors (drives publishRecordEvents default)
+* @param attemptedTypes - Tables whose schema this migration attempted to create or update
 * @returns {Promise<void>} Promise that resolves when post-migration phase completes
 */
-async function executeSingleMigrationPostPhase(client, changeSet, migration, tailorDBInputs, executorUsedTypes) {
+async function executeSingleMigrationPostPhase(client, changeSet, migration, tailorDBInputs, executorUsedTypes, attemptedTypes) {
 	const preMigrationChanges = buildPreMigrationChangesMap([migration]);
 	const preMigrationIndexChanges = buildPreMigrationIndexChangesMap([migration]);
 	const adjustedTypes = /* @__PURE__ */ new Set([...preMigrationChanges.keys(), ...preMigrationIndexChanges.keys()]);
@@ -12805,6 +12881,7 @@ async function executeSingleMigrationPostPhase(client, changeSet, migration, tai
 			if (!tableName || !affectedTypes.has(tableName) || !adjustedTypes.has(tableName)) continue;
 			const snapshotType = buildSnapshotTypeManifest(migration, tableName, tailorDBInputs, executorUsedTypes);
 			if (!snapshotType) continue;
+			attemptedTypes.add(tableName);
 			await client.updateTailorDBType({
 				workspaceId: create.request.workspaceId,
 				namespaceName: create.request.namespaceName,
@@ -12816,6 +12893,7 @@ async function executeSingleMigrationPostPhase(client, changeSet, migration, tai
 			if (!tableName || !affectedTypes.has(tableName) || !adjustedTypes.has(tableName)) continue;
 			const snapshotType = buildSnapshotTypeManifest(migration, tableName, tailorDBInputs, executorUsedTypes);
 			if (!snapshotType) continue;
+			attemptedTypes.add(tableName);
 			await client.updateTailorDBType({
 				workspaceId: update.request.workspaceId,
 				namespaceName: update.request.namespaceName,
@@ -12853,27 +12931,16 @@ async function executeSingleMigrationPostPhaseDeletions(client, changeSet, migra
 /**
 * Revert a single migration's Pre-phase DDL to the prior checkpoint's schema.
 * @param client - Operator client instance
-* @param changeSet - TailorDB change set
 * @param migration - The migration whose Pre-phase DDL must be reverted
 * @param workspaceId - Workspace ID
 * @param tailorDBInputs - Deploy inputs, used to resolve namespace gqlOperations for the snapshot
-* @param executorUsedTypes - Types used by executors (drives publishRecordEvents default)
+* @param executorUsedTypes - Tables used by executors (drives publishRecordEvents default)
+* @param attemptedTypes - Tables whose schema this migration attempted to create or update
 * @returns {Promise<void>} Promise that resolves when rollback attempts complete
 */
-async function rollbackSingleMigrationPrePhase(client, changeSet, migration, workspaceId, tailorDBInputs, executorUsedTypes) {
+async function rollbackSingleMigrationPrePhase(client, migration, workspaceId, tailorDBInputs, executorUsedTypes, attemptedTypes) {
 	if (migration.number <= 0) return;
-	const namespaceTypes = getAffectedTypeNames(migration);
-	for (const create of changeSet.type.creates) {
-		const name = create.request.tailordbType?.name;
-		if (create.request.namespaceName === migration.namespace && name) namespaceTypes.add(name);
-	}
-	for (const update of changeSet.type.updates) {
-		const name = update.request.tailordbType?.name;
-		if (update.request.namespaceName === migration.namespace && name) namespaceTypes.add(name);
-	}
-	const applied = /* @__PURE__ */ new Set([...processedTypes.created, ...processedTypes.updated]);
-	const rollbackTypes = new Set([...namespaceTypes].filter((name) => applied.has(name)));
-	if (rollbackTypes.size === 0) return;
+	if (attemptedTypes.size === 0) return;
 	const priorSnapshot = reconstructSnapshotFromMigrations(migration.migrationsDir, migration.number - 1);
 	if (!priorSnapshot) {
 		logger.warn(`Cannot roll back migration ${migration.namespace}/${formatMigrationNumber(migration.number)}: prior snapshot (migration ${formatMigrationNumber(migration.number - 1)}) could not be reconstructed. Leaving schema as-is; manual repair may be required.`);
@@ -12881,14 +12948,14 @@ async function rollbackSingleMigrationPrePhase(client, changeSet, migration, wor
 	}
 	const input = tailorDBInputs.find((i) => i.namespace === migration.namespace);
 	logger.warn(`Migration ${migration.namespace}/${formatMigrationNumber(migration.number)} failed; rolling back its pre-migration schema changes.`);
-	const restoredTypes = [...rollbackTypes].flatMap((tableName) => {
+	const restoredTypes = [...attemptedTypes].flatMap((tableName) => {
 		const priorType = priorSnapshot.tables[tableName];
 		return priorType ? [{
 			tableName,
 			priorType
 		}] : [];
 	});
-	const newTypes = [...rollbackTypes].filter((tableName) => !priorSnapshot.tables[tableName]);
+	const newTypes = [...attemptedTypes].filter((tableName) => !priorSnapshot.tables[tableName]);
 	for (const { tableName, priorType } of restoredTypes) try {
 		const manifest = generateTailorDBTypeManifestFromSnapshot(priorType, {
 			subscribed: executorUsedTypes.has(priorType.name),
@@ -12900,7 +12967,7 @@ async function rollbackSingleMigrationPrePhase(client, changeSet, migration, wor
 			tailordbType: manifest
 		});
 	} catch (rollbackError) {
-		logger.warn(`Failed to roll back type '${tableName}' in namespace '${migration.namespace}': ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
+		logger.warn(`Failed to roll back table '${tableName}' in namespace '${migration.namespace}': ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
 	}
 	for (const tableName of newTypes) try {
 		await client.deleteTailorDBGQLPermission({
@@ -12914,7 +12981,7 @@ async function rollbackSingleMigrationPrePhase(client, changeSet, migration, wor
 			tailordbTypeName: tableName
 		});
 	} catch (rollbackError) {
-		logger.warn(`Failed to roll back type '${tableName}' in namespace '${migration.namespace}': ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
+		logger.warn(`Failed to roll back table '${tableName}' in namespace '${migration.namespace}': ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
 	}
 }
 /**
@@ -12946,7 +13013,7 @@ async function planTailorDB(context) {
 		const namespaceByType = /* @__PURE__ */ new Map();
 		for (const tailordb of tailordbs) for (const tableName of Object.keys(tailordb.types)) {
 			const existingNamespace = namespaceByType.get(tableName);
-			if (existingNamespace) throw new Error(`Migration test snapshot has duplicate TailorDB type name "${tableName}" in namespaces "${existingNamespace}" and "${tailordb.namespace}".`);
+			if (existingNamespace) throw new Error(`Migration test snapshot has duplicate TailorDB table name "${tableName}" in namespaces "${existingNamespace}" and "${tailordb.namespace}".`);
 			namespaceByType.set(tableName, tailordb.namespace);
 		}
 	}
@@ -13004,7 +13071,7 @@ function collectTailorDBDisplayEntries(action, typeItems, gqlPermissionItems) {
 		action,
 		symbol: ACTION_SYMBOLS[action],
 		name: item.name,
-		labels: gqlPermissionKeys.has(itemKey(item)) ? ["type", "gqlPermission"] : ["type"],
+		labels: gqlPermissionKeys.has(itemKey(item)) ? ["table", "gqlPermission"] : ["table"],
 		namespace: item.request?.namespaceName
 	}));
 	const gqlPermissionOnlyEntries = gqlPermissionItems.filter((item) => !typeKeys.has(itemKey(item))).map((item) => ({
@@ -13017,8 +13084,8 @@ function collectTailorDBDisplayEntries(action, typeItems, gqlPermissionItems) {
 	return [...typeEntries, ...gqlPermissionOnlyEntries];
 }
 /**
-* Format TailorDB type and gqlPermission changes as grouped dry-run entries.
-* @param typeChangeSet - TailorDB type changes
+* Format TailorDB table and gqlPermission changes as grouped dry-run entries.
+* @param typeChangeSet - TailorDB table changes
 * @param gqlPermissionChangeSet - TailorDB gqlPermission changes
 * @returns Display entries for TailorDB resource output
 */
@@ -13120,19 +13187,20 @@ async function planServices(client, workspaceId, appName, appId, tailordbs) {
 	};
 }
 async function planTypes(client, workspaceId, tailordbs, executorUsedTypes, deletedServices, filteredTypesByNamespace, forceApplyAll = false, records = {}) {
-	const changeSet = createChangeSet("TailorDB types");
+	const changeSet = createChangeSet("TailorDB tables");
 	const { appName, appId, dependentApps, runAppIds } = records;
 	/**
-	* Build one type's metadata write, carrying the dependency records that belong
-	* to it. The type is what publishes record events, so the record lives there.
-	* @param namespace - Namespace holding the type
-	* @param tableName - Type name
-	* @param explicitPublishEvents - `publishEvents` declared on the type, if any
-	* @returns The type's metadata write
+	* Build one table's metadata write, carrying the dependency records that belong
+	* to it. The table is what publishes record events, so the record lives there.
+	* @param namespace - Namespace holding the table
+	* @param tableName - Table name
+	* @param explicitPublishEvents - `publishEvents` declared on the table, if any
+	* @returns The table's metadata write
 	*/
 	const typeMetaRequest = async (namespace, tableName, explicitPublishEvents) => {
+		const trn = tailorDBTypeTrn(workspaceId, namespace, tableName);
 		return addDependencyRecords(await buildMetaRequest({
-			trn: tailorDBTypeTrn(workspaceId, namespace, tableName),
+			trn,
 			appName: appName ?? "",
 			appId
 		}), {
@@ -13251,7 +13319,8 @@ const tailordbCompareKnownDefaults = {
 	])
 };
 function normalizeComparableTailorDBType(type) {
-	const normalized = normalizeProtoConfig(toComparableProtoJson(TailorDBTypeSchema, type));
+	const canonical = toComparableProtoJson(TailorDBTypeSchema, type);
+	const normalized = normalizeProtoConfig(canonical);
 	return normalizeTailorDBCompareValue({
 		name: normalized?.name ?? "",
 		schema: {
@@ -13972,8 +14041,9 @@ async function planWorkflowJobFunctionExecutionPolicy(client, workspaceId, appNa
 	for (const policy of declaredList) {
 		if (seenNames.has(policy.name)) throw new Error(`Duplicate workflow execution policy name "${policy.name}". Each policy must have a unique name within the workspace.`);
 		seenNames.add(policy.name);
+		const currentTrn = resourceTrn(workspaceId, "workflow_job_function_execution_policy", policy.name);
 		const metaRequest = await buildMetaRequest({
-			trn: resourceTrn(workspaceId, "workflow_job_function_execution_policy", policy.name),
+			trn: currentTrn,
 			appName,
 			appId
 		});
@@ -14234,7 +14304,8 @@ async function ensureConfigId(configPath) {
 * @returns The existing id (or null when absent), or null for wrapper configs
 */
 async function readConfigId(configPath) {
-	const { program } = parseSync(configPath, await fs$2.promises.readFile(configPath, "utf-8"));
+	const source = await fs$2.promises.readFile(configPath, "utf-8");
+	const { program } = parseSync(configPath, source);
 	const calls = [];
 	findDefineConfigCalls(program, calls);
 	if (calls.length === 0) return null;
@@ -14569,7 +14640,8 @@ function recomputedResources(workspaceId, application, jobsByWorkflow, subscribe
 async function fetchMissingDependentApps(params) {
 	const { client, workspaceId, application, runAppIds, subscribedKeys, jobsByWorkflow } = params;
 	return (await Promise.all(recomputedResources(workspaceId, application, jobsByWorkflow, subscribedKeys).filter(({ key }) => !subscribedKeys.has(key)).map(async ({ trn, scope, label }) => {
-		return recordedDependencies((await getOrNull(() => client.getMetadata({ trn })))?.metadata?.labels, scope).filter((dependency) => !runAppIds.has(dependency.appId)).map((dependency) => ({
+		const metadata = await getOrNull(() => client.getMetadata({ trn }));
+		return recordedDependencies(metadata?.metadata?.labels, scope).filter((dependency) => !runAppIds.has(dependency.appId)).map((dependency) => ({
 			resource: label,
 			appId: dependency.appId,
 			reason: dependency.reason
@@ -14666,8 +14738,8 @@ async function validatePlan(input) {
 		});
 	}
 	creates(CreateTailorDBServiceRequestSchema, "TailorDB service", tailorDB.changeSet.service.creates);
-	creates(CreateTailorDBTypeRequestSchema, "TailorDB type", tailorDB.changeSet.type.creates);
-	updates(UpdateTailorDBTypeRequestSchema, "TailorDB type", tailorDB.changeSet.type.updates);
+	creates(CreateTailorDBTypeRequestSchema, "TailorDB table", tailorDB.changeSet.type.creates);
+	updates(UpdateTailorDBTypeRequestSchema, "TailorDB table", tailorDB.changeSet.type.updates);
 	creates(CreateStaticWebsiteRequestSchema, "StaticWebsite", staticWebsite.changeSet.creates);
 	updates(UpdateStaticWebsiteRequestSchema, "StaticWebsite", staticWebsite.changeSet.updates);
 	creates(AddCustomDomainRequestSchema, "StaticWebsite custom domain", staticWebsite.customDomainChangeSet.creates);
@@ -15002,7 +15074,9 @@ function profilePlatformSettings(platformConfig) {
 */
 async function createWorkspace$1(options) {
 	const validated = validateCreateWorkspaceOptions(options);
-	const client = await initOperatorClient(await loadAccessToken({ profile: validated.profile }), await loadPlatformClientConfig({ profile: validated.profile }));
+	const accessToken = await loadAccessToken({ profile: validated.profile });
+	const platformConfig = await loadPlatformClientConfig({ profile: validated.profile });
+	const client = await initOperatorClient(accessToken, platformConfig);
 	await validateRegion(validated.region, client);
 	return createValidatedWorkspaceWithClient(client, validated);
 }
@@ -15013,13 +15087,14 @@ async function createWorkspace$1(options) {
 * @returns Created workspace info
 */
 async function createValidatedWorkspaceWithClient(client, options) {
-	return workspaceInfoWithFolderName(client, assertDefined((await client.createWorkspace({
+	const resp = await client.createWorkspace({
 		workspaceName: options.name,
 		workspaceRegion: options.region,
 		deleteProtection: options.deleteProtection ?? false,
 		organizationId: options.organizationId,
 		folderId: options.folderId
-	})).workspace, "createWorkspace response missing workspace"));
+	});
+	return workspaceInfoWithFolderName(client, assertDefined(resp.workspace, "createWorkspace response missing workspace"));
 }
 /**
 * Validate workspace creation options without making API calls.
@@ -15146,7 +15221,9 @@ const createCommand$1 = defineAppCommand({
 */
 async function listWorkspaces(options) {
 	const profile = profileNameSchema.optional().parse(options?.profile);
-	return listWorkspacesWithClient(await initOperatorClient(await loadAccessToken({ profile }), await loadPlatformClientConfig({ profile })), options);
+	const accessToken = await loadAccessToken({ profile });
+	const platformConfig = await loadPlatformClientConfig({ profile });
+	return listWorkspacesWithClient(await initOperatorClient(accessToken, platformConfig), options);
 }
 /**
 * List workspaces using an existing Operator client.
@@ -15156,14 +15233,15 @@ async function listWorkspaces(options) {
 */
 async function listWorkspacesWithClient(client, options) {
 	const pageDirection = toPageDirection(options?.order);
-	return workspaceInfosWithFolderNames(client, await fetchPaged(async (pageToken, pageSize) => {
+	const workspaces = await fetchPaged(async (pageToken, pageSize) => {
 		const { workspaces, nextPageToken } = await client.listWorkspaces({
 			pageToken,
 			pageSize,
 			pageDirection
 		});
 		return [workspaces, nextPageToken];
-	}, { limit: options?.limit }));
+	}, { limit: options?.limit });
+	return workspaceInfosWithFolderNames(client, workspaces);
 }
 const listCommand$9 = defineAppCommand({
 	name: "list",
@@ -15756,9 +15834,9 @@ function ownedSubscriptions(subscriptions, owner) {
 	return subscriptions.filter((subscription) => subscription.owner.config.path === owner.config.path);
 }
 /**
-* Collect the TailorDB types subscribed to among the given subscriptions.
+* Collect the TailorDB tables subscribed to among the given subscriptions.
 * @param subscriptions - Subscriptions owned by the target being planned
-* @returns Subscribed type names
+* @returns Subscribed table names
 */
 function subscribedTailorDBTypes(subscriptions) {
 	return new Set(subscriptions.flatMap((subscription) => subscription.trigger.kind === "tailordb" ? [subscription.trigger.typeName] : []));
@@ -16604,7 +16682,8 @@ async function planDeploymentTarget(params) {
 		plannedExternalTailorDBServices: collectPlannedExternalTailorDBServices(target, targets)
 	}));
 	const workflowService = application.workflowService;
-	const functionEntries = collectFunctionEntries(application, filterBundledWorkflowJobs(workflowService?.jobs ?? [], workflowBuildResult?.usedJobNames ?? []), bundledScripts);
+	const bundledWorkflowJobs = filterBundledWorkflowJobs(workflowService?.jobs ?? [], workflowBuildResult?.usedJobNames ?? []);
+	const functionEntries = collectFunctionEntries(application, bundledWorkflowJobs, bundledScripts);
 	const forceApplyAll = await withSpan("plan.detectSdkVersionChange", () => shouldForceApplyAll(client, workspaceId, application, functionEntries));
 	return withSpan("plan", async () => {
 		const applications = targets.map((target) => target.application);
@@ -16701,7 +16780,7 @@ function collectResourceOwners(results) {
 function collectImportantResourceDeletions(results) {
 	const importantDeletions = [];
 	for (const del of results.tailorDB.changeSet.type.deletes) importantDeletions.push({
-		resourceType: "TailorDB type",
+		resourceType: "TailorDB table",
 		resourceName: del.name
 	});
 	for (const del of results.staticWebsite.changeSet.deletes) importantDeletions.push({
@@ -17037,7 +17116,8 @@ async function confirmDeploymentPlans(params) {
 		const results = deploymentPlanResults(deployment);
 		const conflicts = collectOwnerConflicts(results);
 		await confirmOwnerConflict(conflicts, deployment.application.name, yes, deployment.application.id);
-		await confirmUnmanagedResources(collectUnmanagedResources(results), deployment.application.name, yes);
+		const unmanaged = collectUnmanagedResources(results);
+		await confirmUnmanagedResources(unmanaged, deployment.application.name, yes);
 		importantDeletions.push(...collectImportantResourceDeletions(results));
 		const emptyApps = computeRenamedAppDeletions({
 			conflicts,
@@ -17225,11 +17305,13 @@ async function deployInternal(options, cliContext, internalContext) {
 			return;
 		}
 		await applyDeploymentPlans(client, workspaceId, deployments);
-		if (!internalContext?.suppressResultOutput) if (logger.jsonMode) logger.out({
-			summary: planSummary,
-			status: "applied"
-		});
-		else logger.success("Successfully applied changes.");
+		if (!internalContext?.suppressResultOutput) {
+			if (logger.jsonMode) logger.out({
+				summary: planSummary,
+				status: "applied"
+			});
+			else logger.success("Successfully applied changes.");
+		}
 	});
 }
 /**
@@ -17643,13 +17725,15 @@ async function resolveExecutor(client, workspaceId, name) {
 */
 async function getExecutor(options) {
 	const name = options.executor.name;
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
 	});
 	try {
-		return toExecutorInfo(await resolveExecutor(client, workspaceId, name));
+		const executor = await resolveExecutor(client, workspaceId, name);
+		return toExecutorInfo(executor);
 	} catch (error) {
 		if (error instanceof ConnectError && error.code === Code.NotFound) throw new Error(`Executor '${name}' not found.`, { cause: error });
 		throw error;
@@ -18106,8 +18190,9 @@ async function waitForWorkflowExecution(options) {
 * @returns Workflow wait result
 */
 async function waitForWorkflowExecutionById(options) {
+	const accessToken = await loadAccessToken({ profile: options.profile });
 	return await waitForWorkflowExecution({
-		client: await initOperatorClient(await loadAccessToken({ profile: options.profile })),
+		client: await initOperatorClient(accessToken),
 		workspaceId: await loadWorkspaceId({
 			workspaceId: options.workspaceId,
 			profile: options.profile
@@ -18160,7 +18245,8 @@ function parseStatus(status) {
 */
 async function listWorkflowExecutions(options) {
 	const workflowName = options?.workflow?.name;
-	const client = await initOperatorClient(await loadAccessToken({ profile: options?.profile }));
+	const accessToken = await loadAccessToken({ profile: options?.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options?.workspaceId,
 		profile: options?.profile
@@ -18197,7 +18283,8 @@ async function listWorkflowExecutions(options) {
 * @returns Workflow execution with optional logs
 */
 async function getWorkflowExecution(options) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
@@ -18414,13 +18501,15 @@ async function resolveWorkflow(client, workspaceId, name) {
 */
 async function getWorkflow(options) {
 	const name = options.workflow.name;
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
 	});
 	try {
-		return toWorkflowInfo(await resolveWorkflow(client, workspaceId, name));
+		const workflow = await resolveWorkflow(client, workspaceId, name);
+		return toWorkflowInfo(workflow);
 	} catch (error) {
 		if (error instanceof ConnectError && error.code === Code.NotFound) throw new Error(`Workflow '${name}' not found.`, { cause: error });
 		throw error;
@@ -18499,7 +18588,8 @@ async function startWorkflowByName(options) {
 		profile: options.profile
 	});
 	if (!machineUser) throw new Error("Machine user is required. Specify --machine-user, set TAILOR_PLATFORM_MACHINE_USER_NAME, or set a profile default with 'tailor profile update <profile> --machine-user <name>'.");
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
@@ -18527,7 +18617,8 @@ async function startWorkflowByName(options) {
 * @returns Start result with wait helper
 */
 async function startWorkflow(options) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
@@ -18638,7 +18729,8 @@ function createUnknownExecutorJob(executorName, jobId) {
 */
 async function listExecutorJobs(options) {
 	const executorName = options.executor.name;
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
@@ -18681,7 +18773,8 @@ async function listExecutorJobs(options) {
 */
 async function getExecutorJob(options) {
 	const executorName = options.executor.name;
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
@@ -18723,7 +18816,8 @@ async function getExecutorJob(options) {
 */
 async function watchExecutorJob(options) {
 	const executorName = options.executor.name;
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
@@ -18922,8 +19016,6 @@ async function watchExecutorJob(options) {
 						functionExecutionId: operationReference
 					}, false);
 				}
-				break;
-			default: break;
 		}
 		return withWaitMetadata({
 			job: jobDetail,
@@ -19121,7 +19213,8 @@ const jobsCommand = defineAppCommand({
 * @returns List of executors
 */
 async function listExecutors(options) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options?.profile }));
+	const accessToken = await loadAccessToken({ profile: options?.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options?.workspaceId,
 		profile: options?.profile
@@ -19194,7 +19287,8 @@ const headerArg = z.string().superRefine((val, ctx) => {
 	};
 }).refine((h) => h.key.length > 0, { message: "Header name cannot be empty" });
 async function triggerExecutorByName(options) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
@@ -19299,7 +19393,8 @@ The \`--logs\` option displays logs from the downstream execution when available
 	run: async (args) => {
 		const jsonOutput = logger.jsonMode || args.json;
 		await assertWritable({ profile: args.profile });
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
@@ -19391,7 +19486,8 @@ The \`--logs\` option displays logs from the downstream execution when available
 * @returns List of webhook executors with URLs
 */
 async function listWebhookExecutors(options) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options?.profile }));
+	const accessToken = await loadAccessToken({ profile: options?.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options?.workspaceId,
 		profile: options?.profile
@@ -19467,8 +19563,9 @@ const getFunctionRegistryOptionsSchema = z.object({
 async function loadOptions$12(options) {
 	const result = getFunctionRegistryOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
+	const accessToken = await loadAccessToken({ profile: result.data.profile });
 	return {
-		client: await initOperatorClient(await loadAccessToken({ profile: result.data.profile })),
+		client: await initOperatorClient(accessToken),
 		workspaceId: await loadWorkspaceId({
 			workspaceId: result.data.workspaceId,
 			profile: result.data.profile
@@ -19532,8 +19629,9 @@ const listFunctionRegistriesOptionsSchema = z.object({
 async function loadOptions$11(options) {
 	const result = listFunctionRegistriesOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
+	const accessToken = await loadAccessToken({ profile: result.data.profile });
 	return {
-		client: await initOperatorClient(await loadAccessToken({ profile: result.data.profile })),
+		client: await initOperatorClient(accessToken),
 		workspaceId: await loadWorkspaceId({
 			workspaceId: result.data.workspaceId,
 			profile: result.data.profile
@@ -19690,17 +19788,15 @@ function createGenerationManager(params) {
 					pluginConfig: plugin.pluginConfig
 				});
 				break;
-			case "onExecutorReady":
-				result = await assertDefined(plugin.onExecutorReady, "plugin.onExecutorReady hook missing")({
-					tailordb,
-					resolvers: buildResolverData(),
-					executors: { ...services.executor },
-					auth,
-					baseDir: pluginBaseDir,
-					configPath: config.path,
-					pluginConfig: plugin.pluginConfig
-				});
-				break;
+			case "onExecutorReady": result = await assertDefined(plugin.onExecutorReady, "plugin.onExecutorReady hook missing")({
+				tailordb,
+				resolvers: buildResolverData(),
+				executors: { ...services.executor },
+				auth,
+				baseDir: pluginBaseDir,
+				configPath: config.path,
+				pluginConfig: plugin.pluginConfig
+			});
 		}
 		await writeGeneratedFiles(plugin.id, result);
 	}
@@ -19783,7 +19879,7 @@ function createGenerationManager(params) {
 								pluginAttachments: db.pluginAttachments
 							};
 						} catch (error) {
-							logger.error(`Error loading types for TailorDB service ${styles.bold(namespace)}`);
+							logger.error(`Error loading tables for TailorDB service ${styles.bold(namespace)}`);
 							logger.error(String(error));
 							throw error;
 						}
@@ -19792,7 +19888,7 @@ function createGenerationManager(params) {
 				try {
 					assertUniqueLocalTailorDBTypeNames({ tailorDBServices: app.tailorDBServices });
 				} catch (error) {
-					logger.error("Error validating TailorDB type names");
+					logger.error("Error validating TailorDB table names");
 					logger.error(String(error));
 					throw error;
 				}
@@ -19914,7 +20010,8 @@ function machineUserInfo(user) {
 * @returns List of machine users
 */
 async function listMachineUsers(options) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options?.profile }));
+	const accessToken = await loadAccessToken({ profile: options?.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options?.workspaceId,
 		profile: options?.profile
@@ -19968,7 +20065,8 @@ async function getMachineUserTokenInternal(options) {
 		profile: options.profile
 	});
 	if (!name) throw new Error("Machine user is required. Provide the NAME positional argument, set TAILOR_PLATFORM_MACHINE_USER_NAME, or set a profile default with 'tailor profile update <profile> --machine-user <name>'.");
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
@@ -20078,7 +20176,8 @@ function toOAuth2ClientCredentials(client) {
 * @returns OAuth2 client credentials
 */
 async function getOAuth2Client(options) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
@@ -20130,7 +20229,8 @@ const getCommand$3 = defineAppCommand({
 * @returns List of OAuth2 clients
 */
 async function listOAuth2Clients(options) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options?.profile }));
+	const accessToken = await loadAccessToken({ profile: options?.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options?.workspaceId,
 		profile: options?.profile
@@ -20215,7 +20315,8 @@ const createFolderOptionsSchema = z.object({
 async function createFolder(options) {
 	const result = createFolderOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
-	const response = await (await initOperatorClient(await loadAccessToken())).createOrganizationFolder({
+	const accessToken = await loadAccessToken();
+	const response = await (await initOperatorClient(accessToken)).createOrganizationFolder({
 		organizationId: result.data.organizationId,
 		parentFolderId: result.data.parentFolderId ?? "",
 		folderName: result.data.name
@@ -20260,7 +20361,8 @@ const deleteFolderOptionsSchema = z.object({
 async function deleteFolder(options) {
 	const result = deleteFolderOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
-	await (await initOperatorClient(await loadAccessToken())).deleteOrganizationFolder({
+	const accessToken = await loadAccessToken();
+	await (await initOperatorClient(accessToken)).deleteOrganizationFolder({
 		organizationId: result.data.organizationId,
 		folderId: result.data.folderId
 	});
@@ -20275,7 +20377,8 @@ const deleteCommand$1 = defineAppCommand({
 	}),
 	run: async (args) => {
 		await assertWritable();
-		const client = await initOperatorClient(await loadAccessToken());
+		const accessToken = await loadAccessToken();
+		const client = await initOperatorClient(accessToken);
 		let folderName;
 		try {
 			folderName = (await client.getOrganizationFolder({
@@ -20313,7 +20416,8 @@ const getFolderOptionsSchema = z.object({
 async function getFolder(options) {
 	const result = getFolderOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
-	const response = await (await initOperatorClient(await loadAccessToken())).getOrganizationFolder({
+	const accessToken = await loadAccessToken();
+	const response = await (await initOperatorClient(accessToken)).getOrganizationFolder({
 		organizationId: result.data.organizationId,
 		folderId: result.data.folderId
 	});
@@ -20358,7 +20462,8 @@ async function listFolders(options) {
 	const result = listFoldersOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
 	const { organizationId, parentFolderId, order, limit } = result.data;
-	const client = await initOperatorClient(await loadAccessToken());
+	const accessToken = await loadAccessToken();
+	const client = await initOperatorClient(accessToken);
 	const pageDirection = toPageDirection(order);
 	return (await fetchPaged(async (pageToken, pageSize) => {
 		const response = await client.listOrganizationFolders({
@@ -20405,7 +20510,8 @@ const updateFolderOptionsSchema = z.object({
 async function updateFolder(options) {
 	const result = updateFolderOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
-	const response = await (await initOperatorClient(await loadAccessToken())).updateOrganizationFolder({
+	const accessToken = await loadAccessToken();
+	const response = await (await initOperatorClient(accessToken)).updateOrganizationFolder({
 		organizationId: result.data.organizationId,
 		folderId: result.data.folderId,
 		folderName: result.data.name
@@ -20447,7 +20553,8 @@ const getOrganizationOptionsSchema = z.object({ organizationId: z.uuid({ message
 async function getOrganization(options) {
 	const result = getOrganizationOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
-	const response = await (await initOperatorClient(await loadAccessToken())).getOrganization({ organizationId: result.data.organizationId });
+	const accessToken = await loadAccessToken();
+	const response = await (await initOperatorClient(accessToken)).getOrganization({ organizationId: result.data.organizationId });
 	if (!response.organization) throw new Error(`Organization "${result.data.organizationId}" not found.`);
 	return organizationInfo(response.organization);
 }
@@ -20475,7 +20582,8 @@ const getCommand$1 = defineAppCommand({
 */
 async function listOrganizations(options) {
 	const limit = options?.limit;
-	const { userOrganizations } = await (await initOperatorClient(await loadAccessToken())).listUserOrganizations({});
+	const accessToken = await loadAccessToken();
+	const { userOrganizations } = await (await initOperatorClient(accessToken)).listUserOrganizations({});
 	const results = userOrganizations.map(userOrganizationInfo);
 	if (limit !== void 0) return results.slice(0, limit);
 	return results;
@@ -20561,7 +20669,8 @@ async function buildOrgTree(client, org, depth) {
 * @returns Organization tree as structured data
 */
 async function organizationTree(options) {
-	const client = await initOperatorClient(await loadAccessToken());
+	const accessToken = await loadAccessToken();
+	const client = await initOperatorClient(accessToken);
 	let orgs;
 	if (options?.organizationId) {
 		orgs = (await listOrganizations()).filter((o) => o.organizationId === options.organizationId);
@@ -20594,7 +20703,8 @@ const treeCommand = defineAppCommand({
 		})
 	}),
 	run: async (args) => {
-		const client = await initOperatorClient(await loadAccessToken());
+		const accessToken = await loadAccessToken();
+		const client = await initOperatorClient(accessToken);
 		let orgs;
 		if (args["organization-id"]) {
 			orgs = (await listOrganizations()).filter((o) => o.organizationId === args["organization-id"]);
@@ -20633,7 +20743,8 @@ const updateOrganizationOptionsSchema = z.object({
 async function updateOrganization(options) {
 	const result = updateOrganizationOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
-	const response = await (await initOperatorClient(await loadAccessToken())).updateOrganization({
+	const accessToken = await loadAccessToken();
+	const response = await (await initOperatorClient(accessToken)).updateOrganization({
 		organizationId: result.data.organizationId,
 		organizationName: result.data.name
 	});
@@ -20664,7 +20775,8 @@ const updateCommand$1 = defineAppCommand({
 //#endregion
 //#region src/cli/commands/remove.ts
 async function loadOptions$10(options) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options?.profile }));
+	const accessToken = await loadAccessToken({ profile: options?.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options?.workspaceId,
 		profile: options?.profile
@@ -20877,7 +20989,8 @@ async function fetchAIGateways(client, workspaceId, names) {
 * @returns Deployed application, workspace, and AI Gateway information
 */
 async function show(options) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options?.profile }));
+	const accessToken = await loadAccessToken({ profile: options?.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options?.workspaceId,
 		profile: options?.profile
@@ -20962,7 +21075,7 @@ async function withTimeout(p, ms, message) {
 
 //#endregion
 //#region src/cli/commands/staticwebsite/deploy.ts
-const CHUNK_SIZE = 64 * 1024;
+const CHUNK_SIZE = 65536;
 const IGNORED_FILES = /* @__PURE__ */ new Set([
 	".DS_Store",
 	"thumbs.db",
@@ -21069,7 +21182,7 @@ async function uploadSingleFile(client, workspaceId, deploymentId, rootDir, file
 			throw error;
 		}
 	}
-	await withTimeout(uploadWithLogging(), 2 * 6e4, `Upload timed out for "${filePath}"`);
+	await withTimeout(uploadWithLogging(), 12e4, `Upload timed out for "${filePath}"`);
 }
 /**
 * Log skipped files after a deployment, including reasons for skipping.
@@ -21098,7 +21211,8 @@ const deployCommand = defineAppCommand({
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
 		logger.info(`Deploying static website "${args.name}" from directory: ${args.dir}`);
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
+		const accessToken = await loadAccessToken({ profile: args.profile });
+		const client = await initOperatorClient(accessToken);
 		const name = args.name;
 		const dir = path.resolve(process.cwd(), args.dir);
 		const workspaceId = await loadWorkspaceId({
@@ -21106,7 +21220,7 @@ const deployCommand = defineAppCommand({
 			profile: args.profile
 		});
 		if (!fs$1.existsSync(dir) || !fs$1.statSync(dir).isDirectory()) throw new Error(`Directory not found or not a directory: ${dir}`);
-		const { url, skippedFiles } = await withTimeout(deployStaticWebsite(client, workspaceId, name, dir, !args.json), 10 * 6e4, "Deployment timed out after 10 minutes.");
+		const { url, skippedFiles } = await withTimeout(deployStaticWebsite(client, workspaceId, name, dir, !args.json), 6e5, "Deployment timed out after 10 minutes.");
 		if (args.json) logger.out({
 			name,
 			workspaceId,
@@ -21198,9 +21312,9 @@ const MAX_FIELD_NAME_LENGTH = 63;
 const TEMP_FIELD_SUFFIX = "Migrate";
 /**
 * Key identifying a field across snapshots and user-supplied options.
-* @param tableName - Name of the type holding the field
+* @param tableName - Name of the table holding the field
 * @param fieldName - Name of the field
-* @returns Key in `Type.field` form
+* @returns Key in `Table.field` form
 */
 function fieldKey(tableName, fieldName) {
 	return `${tableName}.${fieldName}`;
@@ -22330,7 +22444,8 @@ async function script(options) {
 	const migrationNumber = parseMigrationNumberArg(options.number);
 	if (migrationNumber === 0) throw new Error(`Migration ${options.number} is the initial schema snapshot and cannot have a migration script.`);
 	const { config } = await loadConfig(options.configPath);
-	const namespacesWithMigrations = getNamespacesWithMigrations(config, path.dirname(config.path));
+	const configDir = path.dirname(config.path);
+	const namespacesWithMigrations = getNamespacesWithMigrations(config, configDir);
 	if (namespacesWithMigrations.length === 0) throw new Error("No TailorDB services with migrations configuration found");
 	const targetNamespace = resolveTargetNamespace(namespacesWithMigrations, options.namespace);
 	const { migrationsDir } = assertDefined(namespacesWithMigrations.find((ns) => ns.namespace === targetNamespace), "namespace with migrations not found");
@@ -22502,7 +22617,8 @@ async function handleInitOption(namespaces, skipConfirmation) {
 async function generate(options) {
 	logBetaWarning("tailordb migration");
 	const { config, plugins } = await loadConfig(options.configPath);
-	const namespacesWithMigrations = getNamespacesWithMigrations(config, path.dirname(config.path));
+	const configDir = path.dirname(config.path);
+	const namespacesWithMigrations = getNamespacesWithMigrations(config, configDir);
 	if (namespacesWithMigrations.length === 0) {
 		logger.warn("No TailorDB namespaces with migrations config found.");
 		logger.info("Add \"migration: { directory: \\\"./migrations\\\" }\" to your db config to enable migrations.");
@@ -22542,7 +22658,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-BZfk4HKm.mjs");
+	const { defineApplication } = await import("./application-D4zOiLLa.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -22567,9 +22683,9 @@ async function generate(options) {
 		});
 	}
 	const renameSpecsByNamespace = matchFlagsToNamespaces(renameFlags, generations, renameSpecApplies, "--rename does not match a removed + added field pair");
-	const typeRenameSpecsByNamespace = matchFlagsToNamespaces(typeRenameFlags, generations, typeRenameSpecApplies, "--rename does not match a removed + added type pair");
+	const typeRenameSpecsByNamespace = matchFlagsToNamespaces(typeRenameFlags, generations, typeRenameSpecApplies, "--rename does not match a removed + added table pair");
 	const dropSpecsByNamespace = matchFlagsToNamespaces(dropFlags, generations, dropSpecApplies, "--drop does not match a removed field");
-	const typeDropSpecsByNamespace = matchFlagsToNamespaces(typeDropFlags, generations, typeDropSpecApplies, "--drop does not match a removed type");
+	const typeDropSpecsByNamespace = matchFlagsToNamespaces(typeDropFlags, generations, typeDropSpecApplies, "--drop does not match a removed table");
 	const expandContractKeysByNamespace = /* @__PURE__ */ new Map();
 	const matchedExpandContractFlags = /* @__PURE__ */ new Set();
 	const ineligibleExpandContracts = [];
@@ -22626,7 +22742,7 @@ async function generate(options) {
 	}
 	if (unresolvedCandidates.length > 0) {
 		const details = unresolvedCandidates.map(({ namespace, label, targets }) => `  - ${label} → ${targets.join(", ")}? (namespace: ${namespace})`).join("\n");
-		throw new Error(`Possible rename(s) detected:\n${details}\nRe-run with --rename "Type.oldField:newField" (field) or --rename "OldType:NewType" (type) to record a rename and scaffold a data copy script, or --drop "Type.field" / --drop "Type" to confirm the removal.`);
+		throw new Error(`Possible rename(s) detected:\n${details}\nRe-run with --rename "Table.oldField:newField" (field) or --rename "OldTable:NewTable" (table) to record a rename and scaffold a data copy script, or --drop "Table.field" / --drop "Table" to confirm the removal.`);
 	}
 	for (const { migrationsDir, currentSnapshot, previousSnapshot, diff, expandPlans } of generations) if (!previousSnapshot) await generateInitialSnapshot(currentSnapshot, migrationsDir);
 	else await generateDiffFromSnapshot(previousSnapshot, assertDefined(diff, "Migration diff was not resolved during preflight"), migrationsDir, options, currentSnapshot, expandPlans ?? []);
@@ -22674,7 +22790,7 @@ async function generateInitialSnapshot(snapshot, migrationsDir) {
 	const result = await generateSchemaFile(snapshot, migrationsDir, 0);
 	logger.success(`Generated initial schema snapshot`);
 	logger.info(`  File: ${result.filePath}`);
-	logger.info(`  Types: ${Object.keys(snapshot.tables).length}`);
+	logger.info(`  Tables: ${Object.keys(snapshot.tables).length}`);
 	logger.log("\nThis is the baseline schema. Future changes will be tracked as diffs.");
 }
 /**
@@ -22746,7 +22862,7 @@ async function promptTypeRenameCandidate(candidate, addedTypeNames) {
 		default: true
 	}) ? firstTypeName : void 0;
 	return await prompt.select({
-		message: `${oldTypeName} was removed. Was it renamed to one of these added types?`,
+		message: `${oldTypeName} was removed. Was it renamed to one of these added tables?`,
 		choices: [...addedTypeNames.map((tableName) => ({
 			name: `Yes, renamed to ${tableName}`,
 			value: tableName
@@ -22905,7 +23021,8 @@ async function generateDiffFromSnapshot(previousSnapshot, diff, migrationsDir, o
 		});
 		return;
 	}
-	const result = await generateDiffFiles(diff, migrationsDir, getNextMigrationNumber(migrationsDir), previousSnapshot, options.name);
+	const migrationNumber = getNextMigrationNumber(migrationsDir);
+	const result = await generateDiffFiles(diff, migrationsDir, migrationNumber, previousSnapshot, options.name);
 	logger.success(`Generated migration ${styles.bold(formatMigrationNumber(result.migrationNumber))}`);
 	logger.info(`  Diff file: ${result.diffFilePath}`);
 	if (result.migrateFilePath) {
@@ -22991,13 +23108,14 @@ async function acknowledgeWarnings(options) {
 			message: "Record a reason acknowledging that this migration intentionally has no script?",
 			default: true
 		})) {
+			const reason = await prompt.text({
+				message: "Reason:",
+				validate: (value) => value.trim() !== "" || "Reason must not be empty."
+			});
 			const scriptSkipped = markMigrationScriptSkipped({
 				migrationsDir,
 				migrationNumber,
-				reason: await prompt.text({
-					message: "Reason:",
-					validate: (value) => value.trim() !== "" || "Reason must not be empty."
-				})
+				reason
 			});
 			logger.success(`Recorded that migration ${styles.bold(label)} intentionally has no migration script`);
 			logger.info(`  Reason: ${scriptSkipped.reason}`);
@@ -23022,7 +23140,7 @@ async function acknowledgeWarnings(options) {
 */
 const generateCommand = defineAppCommand({
 	name: "generate",
-	description: "Generate migration files by detecting schema differences between current local types and the previous migration snapshot.",
+	description: "Generate migration files by detecting schema differences between current local tables and the previous migration snapshot.",
 	args: z.strictObject({
 		...confirmationArgs,
 		...configArg,
@@ -23031,9 +23149,9 @@ const generateCommand = defineAppCommand({
 			description: "Optional description for the migration"
 		}),
 		init: arg(z.boolean().default(false), { description: "Delete existing migrations and start fresh" }),
-		rename: arg(z.array(z.string()).optional(), { description: "Record a field or type rename instead of remove + add (format: \"Type.oldField:newField\" or \"OldType:NewType\"; repeatable). Renames require a migration script that copies the data." }),
-		drop: arg(z.array(z.string()).optional(), { description: "Confirm that a removed field or type is a genuine removal, not a rename (format: \"Type.field\" or \"Type\"; repeatable). Required in non-interactive runs for a removal with rename candidates." }),
-		"expand-contract": arg(z.array(z.string()).optional(), { description: "Convert a field type through a temporary field (format: \"Type.field\"; repeatable). Generates two migrations." })
+		rename: arg(z.array(z.string()).optional(), { description: "Record a field or table rename instead of remove + add (format: \"Table.oldField:newField\" or \"OldTable:NewTable\"; repeatable). Renames require a migration script that copies the data." }),
+		drop: arg(z.array(z.string()).optional(), { description: "Confirm that a removed field or table is a genuine removal, not a rename (format: \"Table.field\" or \"Table\"; repeatable). Required in non-interactive runs for a removal with rename candidates." }),
+		"expand-contract": arg(z.array(z.string()).optional(), { description: "Convert a field type through a temporary field (format: \"Table.field\"; repeatable). Generates two migrations." })
 	}),
 	run: async (args) => {
 		await generate({
@@ -23247,7 +23365,7 @@ async function bundleSeedScript(namespace, typeNames, baseDir = process.cwd()) {
 * into multiple chunks at type boundaries (or record boundaries for large types).
 */
 /** Default maximum message size: 3.5MB (conservative limit for gRPC) */
-const DEFAULT_MAX_MESSAGE_SIZE = 3.5 * 1024 * 1024;
+const DEFAULT_MAX_MESSAGE_SIZE = 3670016;
 /** Reserved bytes for message metadata overhead */
 const METADATA_OVERHEAD = 1024;
 /**
@@ -23327,7 +23445,7 @@ function chunkSeedData(options) {
 				order: [type]
 			})) > argBudget) {
 				const singleRecordSize = byteSize(JSON.stringify(record));
-				throw new Error(`A single record in type "${type}" (${singleRecordSize} bytes) exceeds the message size budget (${argBudget} bytes). Consider increasing maxMessageSize or reducing the record size.`);
+				throw new Error(`A single record in table "${type}" (${singleRecordSize} bytes) exceeds the message size budget (${argBudget} bytes). Consider increasing maxMessageSize or reducing the record size.`);
 			}
 			const testBatch = [...recordBatch, record];
 			const testData = {
@@ -23374,9 +23492,9 @@ function byteSize(str) {
 //#endregion
 //#region src/plugin/builtin/seed/seed-type-processor.ts
 /**
-* Processes TailorDB types to extract seed type information
-* @param type - Parsed TailorDB type
-* @param namespace - Namespace of the type
+* Processes TailorDB tables to extract seed type information
+* @param type - Parsed TailorDB table
+* @param namespace - Namespace of the table
 * @returns Seed type information
 */
 function processSeedTypeInfo(type, namespace) {
@@ -23412,7 +23530,8 @@ function buildSeedNamespaceConfigs(tailordb) {
 			types.push(typeInfo.name);
 			dependencies[typeInfo.name] = typeInfo.dependencies;
 			if (typeInfo.selfRefFields.length > 0) selfRefTypes.push(typeInfo.name);
-			const linesDb = processLinesDb(type, assertDefined(ns.sourceInfo.get(typeName), `source info missing for type: ${typeName}`));
+			const source = assertDefined(ns.sourceInfo.get(typeName), `source info missing for type: ${typeName}`);
+			const linesDb = processLinesDb(type, source);
 			requiredFields[typeInfo.name] = Object.entries(type.fields).filter(([fieldName, field]) => field.config.required !== false && !linesDb.optionalFields.includes(fieldName) && !linesDb.omitFields.includes(fieldName)).map(([fieldName]) => fieldName);
 		}
 		return {
@@ -23439,9 +23558,10 @@ async function loadApplicationNamespaces(options = {}) {
 		config,
 		configPath: config.path
 	});
+	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
 	const application = defineApplication({
 		config,
-		pluginManager: plugins.length > 0 ? new PluginManager(plugins) : void 0
+		pluginManager
 	});
 	const namespaceNames = typeof options.namespaces === "function" ? options.namespaces(config, plugins) : options.namespaces;
 	const namespaceFilter = namespaceNames ? new Set(namespaceNames) : void 0;
@@ -23523,9 +23643,9 @@ async function loadSeedContext(options = {}) {
 //#endregion
 //#region src/cli/shared/tailordb-namespace.ts
 /**
-* Resolve TailorDB type names to namespace names.
+* Resolve TailorDB table names to namespace names.
 * @param args - Resolution inputs
-* @returns Type to namespace map for found types
+* @returns Table to namespace map for found tables
 */
 async function resolveTypeNamespaces(args) {
 	const requestedTypesByLowercase = /* @__PURE__ */ new Map();
@@ -23571,18 +23691,18 @@ async function truncateSingleType(options, client) {
 		namespaceName: options.namespaceName,
 		tailordbTypeName: options.typeName
 	});
-	logger.success(`Truncated type "${options.typeName}" in namespace "${options.namespaceName}"`);
+	logger.success(`Truncated table "${options.typeName}" in namespace "${options.namespaceName}"`);
 }
 async function truncateNamespace(workspaceId, namespaceName, client) {
 	await client.truncateTailorDBTypes({
 		workspaceId,
 		namespaceName
 	});
-	logger.success(`Truncated all types in namespace "${namespaceName}"`);
+	logger.success(`Truncated all tables in namespace "${namespaceName}"`);
 }
 /**
 * Truncate TailorDB data based on the given options.
-* @param options - Truncate options (all, namespace, or types)
+* @param options - Truncate options (all, namespace, or tables)
 * @returns Promise that resolves when truncation completes
 */
 async function truncate(options) {
@@ -23592,21 +23712,22 @@ async function truncate(options) {
 	});
 }
 async function $truncate(options = {}) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
 	});
-	const hasTypes = options.types && options.types.length > 0;
+	const hasTables = options.tables && options.tables.length > 0;
 	const hasNamespace = !!options.namespace;
 	const hasAll = !!options.all;
 	const optionCount = [
 		hasAll,
 		hasNamespace,
-		hasTypes
+		hasTables
 	].filter(Boolean).length;
-	if (optionCount === 0) throw new Error("Please specify one of: --all, --namespace <name>, or type names");
-	if (optionCount > 1) throw new Error("Options --all, --namespace, and type names are mutually exclusive. Please specify only one.");
+	if (optionCount === 0) throw new Error("Please specify one of: --all, --namespace <name>, or table names");
+	if (optionCount > 1) throw new Error("Options --all, --namespace, and table names are mutually exclusive. Please specify only one.");
 	const { config } = await loadConfig(options.configPath);
 	const namespaces = extractOwnedNamespaces(config);
 	if (hasAll) {
@@ -23647,20 +23768,20 @@ async function $truncate(options = {}) {
 		await truncateNamespace(workspaceId, namespace, client);
 		return;
 	}
-	if (hasTypes) {
-		const typeNames = assertDefined(options.types, "types option missing");
+	if (hasTables) {
+		const typeNames = assertDefined(options.tables, "tables option missing");
 		const typeNamespaceMap = await resolveTypeNamespaces({
 			workspaceId,
 			namespaces,
 			typeNames,
 			client
 		});
-		const notFoundTypes = typeNames.filter((typeName) => !typeNamespaceMap.has(typeName));
-		if (notFoundTypes.length > 0) throw new Error(`The following types were not found in any namespace: ${notFoundTypes.join(", ")}`);
+		const notFoundTables = typeNames.filter((typeName) => !typeNamespaceMap.has(typeName));
+		if (notFoundTables.length > 0) throw new Error(`The following tables were not found in any namespace: ${notFoundTables.join(", ")}`);
 		if (!options.yes) {
-			const typeList = typeNames.join(", ");
+			const tableList = typeNames.join(", ");
 			if (!await prompt.confirm({
-				message: `This will truncate the following types: ${typeList}. Continue?`,
+				message: `This will truncate the following tables: ${tableList}. Continue?`,
 				default: false
 			})) {
 				logger.info("Truncate cancelled.");
@@ -23684,9 +23805,9 @@ const truncateCommand = defineAppCommand({
 	args: z.strictObject({
 		...deploymentArgs,
 		...confirmationArgs,
-		types: arg(z.string().array().optional(), {
+		tables: arg(z.string().array().optional(), {
 			positional: true,
-			description: "Type names to truncate"
+			description: "Table names to truncate"
 		}),
 		all: arg(z.boolean().default(false), {
 			alias: "a",
@@ -23699,14 +23820,14 @@ const truncateCommand = defineAppCommand({
 	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
-		const types = args.types && args.types.length > 0 ? args.types : void 0;
+		const tables = args.tables && args.tables.length > 0 ? args.tables : void 0;
 		await $truncate({
 			workspaceId: args["workspace-id"],
 			profile: args.profile,
 			configPath: args.config,
 			all: args.all,
 			namespace: args.namespace,
-			types,
+			tables,
 			yes: args.yes
 		});
 	}
@@ -23720,7 +23841,8 @@ const truncateCommand = defineAppCommand({
 * @returns List of workflows
 */
 async function listWorkflows(options) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options?.profile }));
+	const accessToken = await loadAccessToken({ profile: options?.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options?.workspaceId,
 		profile: options?.profile
@@ -23767,7 +23889,8 @@ const listCommand$2 = defineAppCommand({
 * @returns Resume result with wait helper
 */
 async function resumeWorkflow(options) {
-	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const accessToken = await loadAccessToken({ profile: options.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
@@ -23984,8 +24107,9 @@ const healthOptionsSchema = z.object({
 async function loadOptions$9(options) {
 	const result = healthOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
+	const accessToken = await loadAccessToken({ profile: result.data.profile });
 	return {
-		client: await initOperatorClient(await loadAccessToken({ profile: result.data.profile })),
+		client: await initOperatorClient(accessToken),
 		workspaceId: await loadWorkspaceId({
 			workspaceId: result.data.workspaceId,
 			profile: result.data.profile
@@ -24000,10 +24124,11 @@ async function loadOptions$9(options) {
 */
 async function getAppHealth(options) {
 	const { client, workspaceId, name } = await loadOptions$9(options);
-	return appHealthInfo(name, await client.getApplicationSchemaHealth({
+	const response = await client.getApplicationSchemaHealth({
 		workspaceId,
 		applicationName: name
-	}));
+	});
+	return appHealthInfo(name, response);
 }
 const healthCommand = defineAppCommand({
 	name: "health",
@@ -24041,8 +24166,9 @@ const listAppsOptionsSchema = z.object({
 async function loadOptions$8(options) {
 	const result = listAppsOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
+	const accessToken = await loadAccessToken({ profile: result.data.profile });
 	return {
-		client: await initOperatorClient(await loadAccessToken({ profile: result.data.profile })),
+		client: await initOperatorClient(accessToken),
 		workspaceId: await loadWorkspaceId({
 			workspaceId: result.data.workspaceId,
 			profile: result.data.profile
@@ -24098,8 +24224,9 @@ const deleteWorkspaceOptionsSchema = z.object({ workspaceId: z.uuid({ message: "
 async function loadOptions$7(options) {
 	const result = deleteWorkspaceOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
+	const accessToken = await loadAccessToken();
 	return {
-		client: await initOperatorClient(await loadAccessToken()),
+		client: await initOperatorClient(accessToken),
 		workspaceId: result.data.workspaceId
 	};
 }
@@ -24133,9 +24260,10 @@ const deleteCommand = defineAppCommand({
 		}
 		const workspaceResource = workspace.workspace;
 		const workspaceName = workspaceResource?.name ?? workspaceId;
+		const folderName = workspaceResource ? await resolveWorkspaceFolderName(client, workspaceResource) : "";
 		const displayName = workspaceDisplayName({
 			name: workspaceName,
-			folderName: workspaceResource ? await resolveWorkspaceFolderName(client, workspaceResource) : ""
+			folderName
 		});
 		if (!args.yes) {
 			const confirmation = await prompt.text({ message: `Enter the workspace name to confirm deletion (${displayName}):` });
@@ -24165,8 +24293,9 @@ const getWorkspaceOptionsSchema = z.object({
 async function loadOptions$6(options) {
 	const result = getWorkspaceOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
+	const accessToken = await loadAccessToken({ profile: result.data.profile });
 	return {
-		client: await initOperatorClient(await loadAccessToken({ profile: result.data.profile })),
+		client: await initOperatorClient(accessToken),
 		workspaceId: await loadWorkspaceId({
 			workspaceId: result.data.workspaceId,
 			profile: result.data.profile
@@ -24211,8 +24340,9 @@ const restoreWorkspaceOptionsSchema = z.object({ workspaceId: z.uuid({ message:
 async function loadOptions$5(options) {
 	const result = restoreWorkspaceOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
+	const accessToken = await loadAccessToken();
 	return {
-		client: await initOperatorClient(await loadAccessToken()),
+		client: await initOperatorClient(accessToken),
 		workspaceId: result.data.workspaceId
 	};
 }
@@ -24291,8 +24421,9 @@ const inviteUserOptionsSchema = z.object({
 async function loadOptions$4(options) {
 	const result = inviteUserOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
+	const accessToken = await loadAccessToken({ profile: result.data.profile });
 	return {
-		client: await initOperatorClient(await loadAccessToken({ profile: result.data.profile })),
+		client: await initOperatorClient(accessToken),
 		workspaceId: await loadWorkspaceId({
 			workspaceId: result.data.workspaceId,
 			profile: result.data.profile
@@ -24348,8 +24479,9 @@ const listUsersOptionsSchema = z.object({
 async function loadOptions$3(options) {
 	const result = listUsersOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
+	const accessToken = await loadAccessToken({ profile: result.data.profile });
 	return {
-		client: await initOperatorClient(await loadAccessToken({ profile: result.data.profile })),
+		client: await initOperatorClient(accessToken),
 		workspaceId: await loadWorkspaceId({
 			workspaceId: result.data.workspaceId,
 			profile: result.data.profile
@@ -24404,8 +24536,9 @@ const removeUserOptionsSchema = z.object({
 async function loadOptions$2(options) {
 	const result = removeUserOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
+	const accessToken = await loadAccessToken({ profile: result.data.profile });
 	return {
-		client: await initOperatorClient(await loadAccessToken({ profile: result.data.profile })),
+		client: await initOperatorClient(accessToken),
 		workspaceId: await loadWorkspaceId({
 			workspaceId: result.data.workspaceId,
 			profile: result.data.profile
@@ -24461,8 +24594,9 @@ const updateUserOptionsSchema = z.object({
 async function loadOptions$1(options) {
 	const result = updateUserOptionsSchema.safeParse(options);
 	if (!result.success) throw new Error(assertDefined(result.error.issues[0], "Zod returned no issues").message);
+	const accessToken = await loadAccessToken({ profile: result.data.profile });
 	return {
-		client: await initOperatorClient(await loadAccessToken({ profile: result.data.profile })),
+		client: await initOperatorClient(accessToken),
 		workspaceId: await loadWorkspaceId({
 			workspaceId: result.data.workspaceId,
 			profile: result.data.profile
@@ -24641,7 +24775,7 @@ function mapQueryExecutionError(args) {
 	if (args.engine === "sql" && message.includes("sqlaccess error: failed to fetch schema: query returned an unexpected number of rows")) return createCLIError({
 		code: "invalid_namespace",
 		message: `Failed to load TailorDB schema for namespace '${args.namespace}'.`,
-		suggestion: "Ensure the query references TailorDB types from a single namespace and re-apply if needed."
+		suggestion: "Ensure the query references TailorDB tables from a single namespace and re-apply if needed."
 	});
 	if (args.engine === "sql" && message.includes("sqlaccess error: failed to parse:")) {
 		const parserReason = message.split("sqlaccess error: failed to parse:").at(1)?.split("\n").at(0)?.trim();
@@ -24769,9 +24903,9 @@ function isSqlInputComplete(input) {
 //#endregion
 //#region src/cli/query/sql-type-extractor.ts
 /**
-* Extract TailorDB type names from SQL query.
+* Extract TailorDB table names from SQL query.
 * @param query - SQL query
-* @returns Type names referenced by query
+* @returns Table names referenced by query
 */
 function extractTypeNamesFromSql(query) {
 	let statements;
@@ -24849,16 +24983,17 @@ function extractColumnTemplate(query) {
 //#endregion
 //#region src/cli/query/type-field-order.ts
 /**
-* Load field definition order for all TailorDB types in a namespace.
+* Load field definition order for all TailorDB tables in a namespace.
 * @param config - Loaded application configuration
 * @param namespace - TailorDB namespace name
-* @returns Map of type name to field names in definition order
+* @returns Map of table name to field names in definition order
 */
 async function loadTypeFieldOrder(config, namespace) {
 	const fieldOrder = /* @__PURE__ */ new Map();
 	const dbConfig = config.db?.[namespace];
 	if (!dbConfig || !("files" in dbConfig) || dbConfig.files.length === 0) return fieldOrder;
-	const typeFiles = loadFilesWithIgnores(dbConfig, path.dirname(config.path));
+	const baseDir = path.dirname(config.path);
+	const typeFiles = loadFilesWithIgnores(dbConfig, baseDir);
 	await Promise.all(typeFiles.map(async (typeFile) => {
 		try {
 			const module = await import(pathToFileURL(typeFile).href);
@@ -24900,10 +25035,10 @@ async function getNamespaceFromSqlQuery(workspaceId, query, client, namespaces)
 		client
 	});
 	const notFoundTypes = typeNames.filter((typeName) => !typeNamespaceMap.has(typeName));
-	if (notFoundTypes.length > 0) throw new Error(`Could not find namespace for types in query: ${notFoundTypes.join(", ")}.`);
+	if (notFoundTypes.length > 0) throw new Error(`Could not find namespace for tables in query: ${notFoundTypes.join(", ")}.`);
 	const namespacesFromTypes = new Set(typeNamespaceMap.values());
 	if (namespacesFromTypes.size === 1) return assertDefined([...namespacesFromTypes][0], "namespace from types missing");
-	throw new Error(`Query references types from multiple namespaces: ${[...namespacesFromTypes].join(", ")}.`);
+	throw new Error(`Query references tables from multiple namespaces: ${[...namespacesFromTypes].join(", ")}.`);
 }
 async function loadOptions(options) {
 	const result = queryBaseOptionsSchema.safeParse(options);
@@ -24914,7 +25049,8 @@ async function loadOptions(options) {
 		profile: result.data.profile
 	});
 	if (!machineUser) throw new Error("Machine user is required. Specify --machine-user, set TAILOR_PLATFORM_MACHINE_USER_NAME, or set a profile default with 'tailor profile update <profile> --machine-user <name>'.");
-	const client = await initOperatorClient(await loadAccessToken({ profile: result.data.profile }));
+	const accessToken = await loadAccessToken({ profile: result.data.profile });
+	const client = await initOperatorClient(accessToken);
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: result.data.workspaceId,
 		profile: result.data.profile
@@ -25129,7 +25265,7 @@ async function runRepl(options) {
 	const execute = await prepareQueryExecutor(options);
 	const historyPath = getReplHistoryPath(options.engine, options.profile, options.workspaceId);
 	const validate = createReplValidator(options.engine);
-	const { highlightSqlLine, highlightGraphqlLine, replTransform } = await import("./repl-editor-BCozyiNq.mjs");
+	const { highlightSqlLine, highlightGraphqlLine, replTransform } = await import("./repl-editor-F9LotMNx.mjs");
 	const highlight = options.engine === "sql" ? highlightSqlLine : highlightGraphqlLine;
 	const prompt = createPrompt({
 		prefix: "",
@@ -25540,4 +25676,4 @@ async function registerTsHook(tsHookUrl) {
 
 //#endregion
 export { treeCommand as $, sanitizeMigrationLabel as $n, listWorkspaces as $t, truncate as A, MIGRATION_FILE_NAMES as An, readPlatformConfig as Ar, triggerExecutor as At, MIGRATION_REVIEW_REQUIRED_MARKER as B, getLatestMigrationNumber as Bn, deploymentArgs as Br, getCommand$5 as Bt, healthCommand as C, captureFileState as Cn, loadConfigPath as Cr, listCommand$7 as Ct, resumeWorkflow as D, INITIAL_SCHEMA_NUMBER as Dn, loadStoredUserTokens as Dr, listWebhookExecutors as Dt, resumeCommand as E, DIFF_FILE_NAME as En, loadPlatformClientConfig as Er, getFunctionRegistry as Et, chunkSeedData as F, assertValidMigrationFiles as Fn, writePlatformConfig as Fr, jobsCommand as Ft, showCommand as G, loadDiff as Gn, resolveMachineUserInputSource as Gr, functionExecutionStatusToString as Gt, deployCommand as H, getMigrationFilePath as Hn, multiConfigArg as Hr, executionsCommand as Ht, bundleSeedScript as I, compareLocalTypesWithSnapshot as In, defineAppCommand as Ir, listExecutorJobs as It, remove as J, reconstructSnapshotFromMigrations as Jn, deploy as Jt, extractOwnedNamespaces as K, loadSnapshot as Kn, toPageDirection as Kr, getCommand$6 as Kt, generate as L, compareSnapshots as Ln, commonArgs as Lr, watchExecutorJob as Lt, loadSeedContext as M, SCHEMA_FILE_NAME as Mn, resolveConfigUser as Mr, listExecutors as Mt, loadApplicationNamespaces as N, UnsupportedMigrationFileVersionError as Nn, resolveUserTokenKey as Nr, getExecutorJob as Nt, listCommand$2 as O, MIGRATE_FILE_NAME as On, loadWorkspaceId as Or, webhookCommand as Ot, loadTailorDBNamespaces as P, assertMigrationNumberExists as Pn, saveUserTokens as Pr, getExecutorWaitFailureMessage as Pt, organizationTree as Q, handleOptionalToRequiredError as Qn, listCommand$9 as Qt, generateCommand as R, createSnapshotFromLocalTypes as Rn, configArg as Rr, startCommand as Rt, getAppHealth as S, protoGqlPermission as Sn, loadAccessToken as Sr, generate$1 as St, waitWorkflowExecution as T, DB_TYPES_FILE_NAME as Tn, loadMachineUserName as Tr, getCommand$4 as Tt, deployStaticWebsite as U, getMigrationFiles as Un, pagedLogArgs as Ur, getWorkflowExecution as Ut, generateSchemaFile as V, getMigrationDirPath as Vn, isVerbose as Vr, getWorkflow as Vt, show as W, getNextMigrationNumber as Wn, paginationArgs as Wr, listWorkflowExecutions as Wt, updateCommand$1 as X, MIGRATION_LABEL_KEY as Xn, deployMigrationTestBaseline as Xt, removeCommand$1 as Y, MIGRATION_HISTORY_LABEL_KEY as Yn, deployFromCLI as Yt, updateOrganization as Z, createMigrationHistoryId as Zn, deployMigrationTestTarget as Zt, getWorkspace as _, verifyRemoteSchema as _n, loadConfig as _r, getOAuth2Client as _t, queryCommand as a, ensureConfigId as an, resourceTrn as ar, updateFolder as at, listApps as b, compareSnapshotWithRemote as bn, hasAnyUserTokenEntry as br, listCommand$6 as bt, removeCommand as c, executeScript as cn, sdkVersionLabelKey as cr, getCommand$2 as ct, listUsers as d, bundleMigrationScript as dn, generateUserTypes as dr, deleteFolder as dt, createCommand$1 as en, formatDiffSummary as er, listCommand$3 as et, inviteCommand as f, checkMigrationDiffs as fn, formatMigrationNumber as fr, createCommand as ft, getCommand as g, toTailorDBDeployInput as gn, assertWritable as gr, getCommand$3 as gt, restoreWorkspace as h, logRemoteDriftGuidance as hn, apiCall as hr, listOAuth2Clients as ht, query as i, workspaceNameSchema as in, selectTargetNamespace as ir, updateCommand$2 as it, truncateCommand as j, MIGRATION_NUMBER_PATTERN as jn, removeLegacyUserAlias as jr, listCommand$8 as jt, listWorkflows as k, MIGRATE_TEST_FILE_NAME as kn, platformConfigFromProfile as kr, triggerCommand as kt, removeUser as l, waitForExecution as ln, writeMetadataLabels as lr, getFolder as lt, restoreCommand as m, formatRemoteVerificationResults as mn, prompt as mr, listCommand$5 as mt, errorToJson as n, createWorkspace$1 as nn, hasChanges as nr, getCommand$1 as nt, updateCommand as o, getMigrationMachineUser as on, sdkAppIdLabelKey as or, listCommand$4 as ot, inviteUser as p, fetchRemoteSchemaSnapshot as pn, parseMigrationNumberArg as pr, createFolder as pt, logBetaWarning as q, normalizeSchemaSnapshot as qn, workspaceArgs as qr, getExecutor as qt, serializeError as r, formatKeyValueTable as rn, getNamespacesWithMigrations as rr, getOrganization as rt, updateUser as s, updateMigrationLabel as sn, sdkNameLabelKey as sr, listFolders as st, registerTsHook as t, createValidatedWorkspaceWithClient as tn, formatMigrationDiff as tr, listOrganizations as tt, listCommand as u, formatMigrationScriptCommand as un, PluginManager as ur, deleteCommand$1 as ut, deleteCommand as v, fetchRemoteMigrationNumber as vn, deleteUserTokens as vr, getMachineUserToken as vt, waitCommand as w, captureMigrationFileState as wn, loadConsoleBaseUrl as wr, listFunctionRegistries as wt, listCommand$1 as x, generateAllTypeManifestsFromSnapshot as xn, hasUserTokenEntry as xr, listMachineUsers as xt, deleteWorkspace as y, fetchRemoteMigrationState as yn, fetchLatestToken as yr, tokenCommand as yt, scriptCommand as z, formatSchemaDrifts as zn, confirmationArgs as zr, startWorkflow as zt };
-//# sourceMappingURL=register-ts-hook-ClI226n2.mjs.map
+//# sourceMappingURL=register-ts-hook-Vqjza10T.mjs.map