diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index fb790716..0ca76eb8 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -566,8 +566,8 @@ importers:
         version: 0.2.2
     devDependencies:
       '@constructive-io/graphql-codegen':
-        specifier: ^4.47.0
-        version: 4.47.6(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(@dataplan/pg@1.0.3(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(pg-sql2@5.0.1)(pg@8.21.0))(@tanstack/react-query@5.101.0(react@19.2.7))(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(grafserv@1.0.0(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0))(graphile-build@5.0.2(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0))(pg-sql2@5.0.1)(pg@8.21.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tamedevil@0.1.1)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0)
+        specifier: ^4.47.7
+        version: 4.47.7(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(@dataplan/pg@1.0.3(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(pg-sql2@5.0.1)(pg@8.21.0))(@tanstack/react-query@5.101.0(react@19.2.7))(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(grafserv@1.0.0(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0))(graphile-build@5.0.2(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0))(pg-sql2@5.0.1)(pg@8.21.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tamedevil@0.1.1)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0)
       '@types/node':
         specifier: ^20.19.27
         version: 20.19.43
@@ -610,8 +610,8 @@ importers:
         version: 19.2.7
     devDependencies:
       '@constructive-io/graphql-codegen':
-        specifier: ^4.47.0
-        version: 4.47.6(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(@dataplan/pg@1.0.3(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(pg-sql2@5.0.1)(pg@8.21.0))(@tanstack/react-query@5.101.0(react@19.2.7))(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(grafserv@1.0.0(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0))(graphile-build@5.0.2(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0))(pg-sql2@5.0.1)(pg@8.21.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tamedevil@0.1.1)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0)
+        specifier: ^4.47.7
+        version: 4.47.7(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(@dataplan/pg@1.0.3(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(pg-sql2@5.0.1)(pg@8.21.0))(@tanstack/react-query@5.101.0(react@19.2.7))(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(grafserv@1.0.0(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0))(graphile-build@5.0.2(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0))(pg-sql2@5.0.1)(pg@8.21.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tamedevil@0.1.1)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0)
       '@types/node':
         specifier: ^20.19.27
         version: 20.19.43
@@ -674,8 +674,8 @@ importers:
         version: 16.13.0
     devDependencies:
       '@constructive-io/graphql-codegen':
-        specifier: ^4.47.0
-        version: 4.47.6(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(@dataplan/pg@1.0.3(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(pg-sql2@5.0.1)(pg@8.21.0))(@tanstack/react-query@5.101.0(react@19.2.7))(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(grafserv@1.0.0(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0))(graphile-build@5.0.2(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0))(pg-sql2@5.0.1)(pg@8.21.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tamedevil@0.1.1)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0)
+        specifier: ^4.47.7
+        version: 4.47.7(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(@dataplan/pg@1.0.3(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(pg-sql2@5.0.1)(pg@8.21.0))(@tanstack/react-query@5.101.0(react@19.2.7))(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(grafserv@1.0.0(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0))(graphile-build@5.0.2(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0))(pg-sql2@5.0.1)(pg@8.21.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tamedevil@0.1.1)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0)
       '@types/node':
         specifier: ^20.19.27
         version: 20.19.43
@@ -1141,8 +1141,8 @@ packages:
   '@constructive-io/fetch@1.1.1':
     resolution: {integrity: sha512-kpus6sqQwMUTBNpqYvSejG27HJXDucV+BQUNUg3T5U92Qy94Q6of7OhbovICteDMmgcRKCdc5S2e2pXnIY8L5A==}
 
-  '@constructive-io/graphql-codegen@4.47.6':
-    resolution: {integrity: sha512-4frodMOpt1h4WHkx/Zcq9iUYHbnULk9C1qtLn25+Um6RWDnngI8F1asQK4W7mYBR5t3wm7ZI9XLgCfDVDzGbfg==}
+  '@constructive-io/graphql-codegen@4.47.7':
+    resolution: {integrity: sha512-/mk8IcDfTb8D9RYMUJP6gYumhMQ1NbiGjz5hsYLYZOdnPGE04/Ig5/tbmnIRiIiSTWq3/mdMK39lw6dlMatfgg==}
     hasBin: true
     peerDependencies:
       '@tanstack/react-query': ^5.0.0
@@ -7125,7 +7125,7 @@ snapshots:
 
   '@constructive-io/cli@7.23.2(c45acc6f553969d8bb955b30616b98fe)':
     dependencies:
-      '@constructive-io/graphql-codegen': 4.47.6(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(@dataplan/pg@1.0.3(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(pg-sql2@5.0.1)(pg@8.21.0))(@tanstack/react-query@5.101.0(react@19.2.7))(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(grafserv@1.0.0(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0))(graphile-build@5.0.2(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0))(pg-sql2@5.0.1)(pg@8.21.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tamedevil@0.1.1)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0)
+      '@constructive-io/graphql-codegen': 4.47.7(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(@dataplan/pg@1.0.3(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(pg-sql2@5.0.1)(pg@8.21.0))(@tanstack/react-query@5.101.0(react@19.2.7))(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(grafserv@1.0.0(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0))(graphile-build@5.0.2(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0))(pg-sql2@5.0.1)(pg@8.21.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tamedevil@0.1.1)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0)
       '@constructive-io/graphql-env': 3.13.0
       '@constructive-io/graphql-explorer': 4.21.5(b30f70d8bf2c98b98734629c12b63d07)
       '@constructive-io/graphql-server': 4.35.5(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(@dataplan/pg@1.0.3(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(pg-sql2@5.0.1)(pg@8.21.0))(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tamedevil@0.1.1)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0)
@@ -7209,7 +7209,7 @@ snapshots:
 
   '@constructive-io/fetch@1.1.1': {}
 
-  '@constructive-io/graphql-codegen@4.47.6(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(@dataplan/pg@1.0.3(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(pg-sql2@5.0.1)(pg@8.21.0))(@tanstack/react-query@5.101.0(react@19.2.7))(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(grafserv@1.0.0(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0))(graphile-build@5.0.2(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0))(pg-sql2@5.0.1)(pg@8.21.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tamedevil@0.1.1)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0)':
+  '@constructive-io/graphql-codegen@4.47.7(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(@dataplan/pg@1.0.3(@dataplan/json@1.0.0(grafast@1.0.2(graphql@16.13.0)))(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(pg-sql2@5.0.1)(pg@8.21.0))(@tanstack/react-query@5.101.0(react@19.2.7))(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(grafserv@1.0.0(@types/node@20.19.43)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0))(graphile-build@5.0.2(grafast@1.0.2(graphql@16.13.0))(graphile-config@1.0.1)(graphql@16.13.0))(pg-sql2@5.0.1)(pg@8.21.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tamedevil@0.1.1)(use-sync-external-store@1.6.0(react@19.2.7))(ws@8.21.0)':
     dependencies:
       '@0no-co/graphql.web': 1.2.0(graphql@16.13.0)
       '@babel/generator': 7.29.7
diff --git a/sdk/constructive-functions-cli/package.json b/sdk/constructive-functions-cli/package.json
index 33dcd74b..56e3c548 100644
--- a/sdk/constructive-functions-cli/package.json
+++ b/sdk/constructive-functions-cli/package.json
@@ -49,7 +49,7 @@
     "nested-obj": "^0.2.2"
   },
   "devDependencies": {
-    "@constructive-io/graphql-codegen": "^4.47.0",
+    "@constructive-io/graphql-codegen": "^4.47.7",
     "@types/node": "^20.19.27",
     "makage": "^0.3.0",
     "rimraf": "^5.0.5",
diff --git a/sdk/constructive-functions-cli/src/api/orm/input-types.ts b/sdk/constructive-functions-cli/src/api/orm/input-types.ts
index fd9be1f8..4c6aa88b 100644
--- a/sdk/constructive-functions-cli/src/api/orm/input-types.ts
+++ b/sdk/constructive-functions-cli/src/api/orm/input-types.ts
@@ -1569,6 +1569,172 @@ export interface TrgmSearchInput {
   /** Minimum similarity threshold (0.0 to 1.0). Higher = stricter matching. Default is 0.3. */
   threshold?: number;
 }
+/** An input for mutations affecting `RoleType` */
+export interface RoleTypeInput {
+  id: number;
+  name: string;
+}
+/** An input for mutations affecting `PlatformConfigDefinition` */
+export interface PlatformConfigDefinitionInput {
+  /** Freeform metadata annotations for config definitions */
+  annotations?: Record<string, unknown>;
+  createdAt?: string;
+  /** Default value used when no config entry exists for a namespace */
+  defaultValue?: string;
+  /** Human-readable description of what this config key controls */
+  description?: string;
+  /** Unique identifier for this config definition */
+  id?: string;
+  /** Whether this row was seeded as a built-in config definition */
+  isBuiltIn?: boolean;
+  /** Key-value metadata for filtering and grouping config definitions */
+  labels?: Record<string, unknown>;
+  /** Config key name (must match config table name for resolution) */
+  name: string;
+  updatedAt?: string;
+}
+/** An input for mutations affecting `PlatformNamespace` */
+export interface PlatformNamespaceInput {
+  /** Freeform metadata for tooling and operational notes */
+  annotations?: Record<string, unknown>;
+  createdAt?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Optional human-readable description of this namespace */
+  description?: string;
+  id?: string;
+  /** Whether this namespace is active (soft-disable for filtering) */
+  isActive?: boolean;
+  /** Key/value pairs for selecting and filtering namespaces */
+  labels?: Record<string, unknown>;
+  /** Human-readable namespace name (e.g. default, production, oauth) */
+  name: string;
+  /** Globally unique computed namespace identifier via inflection.underscore */
+  namespaceName: string;
+  updatedAt?: string;
+}
+/** An input for mutations affecting `PlatformConfig` */
+export interface PlatformConfigInput {
+  /** Freeform metadata for tooling and operational notes */
+  annotations?: Record<string, unknown>;
+  createdAt?: string;
+  /** Human-readable note about this config entry */
+  description?: string;
+  /** Optional expiration timestamp for time-limited config entries */
+  expiresAt?: string;
+  /** Unique identifier for this config entry */
+  id?: string;
+  /** Key/value pairs for selecting/filtering config entries */
+  labels?: Record<string, unknown>;
+  /** Key name identifying the config entry */
+  name: string;
+  /** FK to namespaces — logical grouping for config entries */
+  namespaceId: string;
+  updatedAt?: string;
+  /** Plaintext config value */
+  value?: string;
+}
+/** An input for mutations affecting `PlatformBucket` */
+export interface PlatformBucketInput {
+  /** User who created this bucket. Forced to current_user_id() on INSERT. */
+  actorId: string;
+  /** When true, clients can provide custom S3 keys (e.g. reports/2024/Q1.pdf). When false (default), S3 key = content hash (automatic dedup). contentHash always required for integrity. */
+  allowCustomKeys?: boolean;
+  /** Whitelist of allowed MIME types for files in this bucket (NULL = all allowed, enforcement deferred) */
+  allowedMimeTypes?: string[];
+  /** Per-bucket CORS allowed origins override (NULL = inherit from storage_module/plugin defaults). Use ARRAY['*'] for open/CDN mode. */
+  allowedOrigins?: string[];
+  createdAt?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Human-readable description of the bucket purpose */
+  description?: string;
+  id?: string;
+  /** Whether bucket contents are publicly readable. Set to true when type is public. */
+  isPublic?: boolean;
+  /** Unique bucket identifier used in S3 key paths (e.g. avatars, documents, temp) */
+  key: string;
+  /** Maximum file size in bytes allowed in this bucket (NULL = no limit, enforcement deferred) */
+  maxFileSize?: string;
+  /** Bucket CDN access type: public (CDN-served), private (presigned GET), temp (staging uploads) */
+  type?: string;
+  updatedAt?: string;
+}
+/** An input for mutations affecting `PlatformFile` */
+export interface PlatformFileInput {
+  /** User who uploaded this file. Forced to current_user_id() on INSERT. Used for UPDATE/DELETE authorization. */
+  actorId: string;
+  /** Bucket this file belongs to. Determines owner_id and is_public via inheritance trigger. */
+  bucketId: string;
+  /** SHA-256 content hash for integrity verification and dedup. In default mode, equals the S3 key. In custom key mode, stored separately. */
+  contentHash?: string;
+  createdAt?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Human-readable description or alt text for the file (mutable) */
+  description?: string;
+  /** Original filename provided by the uploader. Used for display and Content-Disposition header on download. */
+  filename?: string;
+  id?: string;
+  /** Whether this file is publicly readable. Inherited from bucket on INSERT. */
+  isPublic?: boolean;
+  /** S3 object key for this file, unique within its bucket */
+  key: string;
+  /** MIME type of the file (e.g. image/png, application/pdf). Immutable after INSERT. */
+  mimeType: string;
+  /** File size in bytes. Immutable after INSERT. */
+  size: string;
+  /** User-defined tags for categorization and search (mutable) */
+  tags?: string[];
+  updatedAt?: string;
+  /** Processed file reference (upload domain). Populated by processing jobs after file is uploaded. Copy this value to other tables to reference the file. */
+  upload?: ConstructiveInternalTypeUpload;
+  /** File lifecycle status: requested (presigned URL generated, not yet in S3), uploaded (file in S3, ready for basic use), processed (MIME verified, image resized, embedding computed). */
+  status?: FileStatus;
+}
+/** An input for mutations affecting `User` */
+export interface UserInput {
+  createdAt?: string;
+  displayName?: string;
+  id?: string;
+  profilePicture?: ConstructiveInternalTypeImage;
+  type?: number;
+  updatedAt?: string;
+  username?: string;
+}
+/** An input for mutations affecting `PlatformNamespaceEvent` */
+export interface PlatformNamespaceEventInput {
+  /** Event timestamp (partition key) */
+  createdAt?: string;
+  /** User who triggered this event (NULL for system/automated) */
+  actorId?: string;
+  /** CPU usage in millicores at time of event */
+  cpuMillicores?: number;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Event type: created, activated, deactivated, labels_updated, annotations_updated, renamed */
+  eventType: string;
+  /** Unique event identifier */
+  id?: string;
+  /** Memory usage in bytes at time of event */
+  memoryBytes?: string;
+  /** Human-readable description of the event */
+  message?: string;
+  /** Structured context (old/new values, labels diff, etc.) */
+  metadata?: Record<string, unknown>;
+  /** Additional resource metrics (gpu, replicas, quotas, etc.) */
+  metrics?: Record<string, unknown>;
+  /** Namespace this event belongs to */
+  namespaceId: string;
+  /** Network egress in bytes during event window */
+  networkEgressBytes?: string;
+  /** Network ingress in bytes during event window */
+  networkIngressBytes?: string;
+  /** Number of active pods in the namespace at time of event */
+  podCount?: number;
+  /** Storage usage in bytes at time of event */
+  storageBytes?: string;
+}
 export interface UploadPlatformFileBulkFileInput {
   /** SHA-256 content hash (hex-encoded, 64 chars) */
   contentHash: string;
diff --git a/sdk/constructive-functions-cli/src/compute/orm/input-types.ts b/sdk/constructive-functions-cli/src/compute/orm/input-types.ts
index 3f975267..bf89a74a 100644
--- a/sdk/constructive-functions-cli/src/compute/orm/input-types.ts
+++ b/sdk/constructive-functions-cli/src/compute/orm/input-types.ts
@@ -1746,6 +1746,256 @@ export interface ProvisionBucketInput {
    */
   ownerId?: string;
 }
+/** An input for mutations affecting `PlatformFunctionGraphRef` */
+export interface PlatformFunctionGraphRefInput {
+  /** Commit this ref points to */
+  commitId?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Unique ref identifier */
+  id?: string;
+  /** Ref name (e.g. HEAD, main) */
+  name: string;
+  /** Store this ref belongs to */
+  storeId: string;
+}
+/** An input for mutations affecting `PlatformFunctionGraphStore` */
+export interface PlatformFunctionGraphStoreInput {
+  /** Timestamp of store creation */
+  createdAt?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Current root object hash of this store */
+  hash?: string;
+  /** Unique store identifier */
+  id?: string;
+  /** Human-readable store name */
+  name: string;
+}
+/** An input for mutations affecting `PlatformFunctionGraphObject` */
+export interface PlatformFunctionGraphObjectInput {
+  /** Timestamp of object creation */
+  createdAt?: string;
+  /** Payload data for this object node */
+  data?: Record<string, unknown>;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Content-addressed UUID v5 — deterministic hash of (data, kids, ktree) */
+  id: string;
+  /** Ordered array of child object IDs */
+  kids?: string[];
+  /** Ordered array of child path names (parallel to kids) */
+  ktree?: string[];
+}
+/** An input for mutations affecting `OrgFunctionExecutionLog` */
+export interface OrgFunctionExecutionLogInput {
+  /** Log entry timestamp (partition key) */
+  createdAt?: string;
+  /** User who triggered the execution (NULL for system/cron) */
+  actorId?: string;
+  /** Unique log entry identifier */
+  id?: string;
+  /** Invocation this log entry belongs to (NULL for standalone job logs) */
+  invocationId?: string;
+  /** Log severity: debug, info, warn, error */
+  logLevel?: string;
+  /** Log message text */
+  message: string;
+  /** Structured context (labels, trace data, extra fields) */
+  metadata?: Record<string, unknown>;
+  /** Function routing key (NULL for generic job logs) */
+  taskIdentifier?: string;
+}
+/** An input for mutations affecting `PlatformFunctionGraphCommit` */
+export interface PlatformFunctionGraphCommitInput {
+  /** User who authored the changes */
+  authorId?: string;
+  /** User who committed (may differ from author) */
+  committerId?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Commit timestamp */
+  date?: string;
+  /** Unique commit identifier */
+  id?: string;
+  /** Optional commit message */
+  message?: string;
+  /** Parent commit IDs (supports merge commits) */
+  parentIds?: string[];
+  /** Store this commit belongs to */
+  storeId: string;
+  /** Root object ID of the tree snapshot at this commit */
+  treeId?: string;
+}
+/** An input for mutations affecting `PlatformSecretDefinition` */
+export interface PlatformSecretDefinitionInput {
+  /** Freeform metadata annotations for secret definitions */
+  annotations?: Record<string, unknown>;
+  createdAt?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Human-readable description of what this secret is used for */
+  description?: string;
+  id?: string;
+  /** Whether this row was seeded as a built-in secret definition. Built-in rows are immutable. */
+  isBuiltIn?: boolean;
+  /** Key-value metadata for filtering and grouping secret definitions */
+  labels?: Record<string, unknown>;
+  /** Secret name (must match app_secrets.name for resolution) */
+  name: string;
+  updatedAt?: string;
+}
+/** An input for mutations affecting `PlatformFunctionExecutionLog` */
+export interface PlatformFunctionExecutionLogInput {
+  /** Log entry timestamp (partition key) */
+  createdAt?: string;
+  /** User who triggered the execution (NULL for system/cron) */
+  actorId?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Unique log entry identifier */
+  id?: string;
+  /** Invocation this log entry belongs to (NULL for standalone job logs) */
+  invocationId?: string;
+  /** Log severity: debug, info, warn, error */
+  logLevel?: string;
+  /** Log message text */
+  message: string;
+  /** Structured context (labels, trace data, extra fields) */
+  metadata?: Record<string, unknown>;
+  /** Function routing key (NULL for generic job logs) */
+  taskIdentifier?: string;
+}
+/** An input for mutations affecting `PlatformFunctionGraph` */
+export interface PlatformFunctionGraphInput {
+  /** Evaluator/runtime context (function, js, sql, system) */
+  context?: string;
+  /** Timestamp of graph creation */
+  createdAt?: string;
+  /** Actor who created this graph */
+  createdBy?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Pinned definitions store commit for deterministic evaluation */
+  definitionsCommitId?: string;
+  /** Human-readable description of the graph */
+  description?: string;
+  /** Entity context (org/team) for scoped billing */
+  entityId?: string;
+  /** Unique graph identifier */
+  id?: string;
+  /** Whether graph passes structural validation */
+  isValid?: boolean;
+  /** Graph name (unique per database) */
+  name: string;
+  /** Graph store (Merkle store) holding the graph definition */
+  storeId: string;
+  /** Timestamp of last modification */
+  updatedAt?: string;
+  /** Array of validation error objects when is_valid = false */
+  validationErrors?: Record<string, unknown>;
+}
+/** An input for mutations affecting `OrgFunctionInvocation` */
+export interface OrgFunctionInvocationInput {
+  /** Invocation creation timestamp (partition key) */
+  createdAt?: string;
+  /** Who triggered the invocation (NULL for system/cron) */
+  actorId?: string;
+  /** When execution completed */
+  completedAt?: string;
+  /** Wall-clock execution time in milliseconds */
+  durationMs?: number;
+  /** Error message when status is failed */
+  error?: string;
+  /** Groups all node invocations from a single flow graph execution */
+  graphExecutionId?: string;
+  /** Unique invocation identifier */
+  id?: string;
+  /** FK to app_jobs.jobs — the underlying transport */
+  jobId?: string;
+  /** Parent invocation when this is a child node of a flow graph execution */
+  parentInvocationId?: string;
+  /** Function input payload */
+  payload?: Record<string, unknown>;
+  /** Function return value (success) or structured error (failure) */
+  result?: Record<string, unknown>;
+  /** When execution started */
+  startedAt?: string;
+  /** Lifecycle: pending → running → completed/failed/cancelled */
+  status?: string;
+  /** Function routing slug (scope:name). Links to function_definitions.task_identifier by convention — no FK. */
+  taskIdentifier: string;
+}
+/** An input for mutations affecting `PlatformFunctionInvocation` */
+export interface PlatformFunctionInvocationInput {
+  /** Invocation creation timestamp (partition key) */
+  createdAt?: string;
+  /** Who triggered the invocation (NULL for system/cron) */
+  actorId?: string;
+  /** When execution completed */
+  completedAt?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Wall-clock execution time in milliseconds */
+  durationMs?: number;
+  /** Error message when status is failed */
+  error?: string;
+  /** Groups all node invocations from a single flow graph execution */
+  graphExecutionId?: string;
+  /** Unique invocation identifier */
+  id?: string;
+  /** FK to app_jobs.jobs — the underlying transport */
+  jobId?: string;
+  /** Parent invocation when this is a child node of a flow graph execution */
+  parentInvocationId?: string;
+  /** Function input payload */
+  payload?: Record<string, unknown>;
+  /** Function return value (success) or structured error (failure) */
+  result?: Record<string, unknown>;
+  /** When execution started */
+  startedAt?: string;
+  /** Lifecycle: pending → running → completed/failed/cancelled */
+  status?: string;
+  /** Function routing slug (scope:name). Links to function_definitions.task_identifier by convention — no FK. */
+  taskIdentifier: string;
+}
+/** An input for mutations affecting `PlatformFunctionDefinition` */
+export interface PlatformFunctionDefinitionInput {
+  createdAt?: string;
+  /** Human-readable description of what this function does */
+  description?: string;
+  id?: string;
+  /** Whether this function is a built-in platform function (synced from platform) vs user-created */
+  isBuiltIn?: boolean;
+  /** Whether this function can be called via function_invocations (public API). Default false = internal-only via add_job() */
+  isInvocable?: boolean;
+  /** Maximum retry attempts for the underlying job */
+  maxAttempts?: number;
+  /** Function name within scope (e.g. send_verification_link, process_file_embedding) */
+  name: string;
+  /** Namespace this function belongs to (FK to namespaces table) */
+  namespaceId?: string;
+  /** Job priority (lower = higher priority) */
+  priority?: number;
+  /** Job queue name for serialization (e.g. email, ai, default) */
+  queueName?: string;
+  /** Function grouping scope (e.g. email, embed, chunk, custom) */
+  scope: string;
+  /** Optional service URL override for function dispatch. NULL = use gateway convention (gatewayUrl/task_identifier). Set for customer-deployed functions or external endpoints. */
+  serviceUrl?: string;
+  /** Computed routing slug: scope:name (used by Knative job worker for dispatch) */
+  taskIdentifier: string;
+  updatedAt?: string;
+  /** Embedded config requirements: array of (name, required) tuples */
+  requiredConfigs?: FunctionRequirementInput[];
+  /** Embedded secret requirements: array of (name, required) tuples */
+  requiredSecrets?: FunctionRequirementInput[];
+}
+/** An input for mutations affecting `FunctionRequirement` */
+export interface FunctionRequirementInput {
+  name?: string;
+  required?: boolean;
+}
 /** An interval of time that has passed where the smallest distinct unit is a second. */
 export interface IntervalInput {
   /**
diff --git a/sdk/constructive-functions-cli/src/objects/orm/input-types.ts b/sdk/constructive-functions-cli/src/objects/orm/input-types.ts
index cbcf4e09..95309c14 100644
--- a/sdk/constructive-functions-cli/src/objects/orm/input-types.ts
+++ b/sdk/constructive-functions-cli/src/objects/orm/input-types.ts
@@ -680,6 +680,68 @@ export interface ProvisionBucketInput {
    */
   ownerId?: string;
 }
+/** An input for mutations affecting `Store` */
+export interface StoreInput {
+  /** Timestamp of store creation */
+  createdAt?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Current root object hash of this store */
+  hash?: string;
+  /** Unique store identifier */
+  id?: string;
+  /** Human-readable store name */
+  name: string;
+}
+/** An input for mutations affecting `Ref` */
+export interface RefInput {
+  /** Commit this ref points to */
+  commitId?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Unique ref identifier */
+  id?: string;
+  /** Ref name (e.g. HEAD, main) */
+  name: string;
+  /** Store this ref belongs to */
+  storeId: string;
+}
+/** An input for mutations affecting `Object` */
+export interface ObjectInput {
+  /** Timestamp of object creation */
+  createdAt?: string;
+  /** Payload data for this object node */
+  data?: Record<string, unknown>;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Content-addressed UUID v5 — deterministic hash of (data, kids, ktree) */
+  id: string;
+  /** Ordered array of child object IDs */
+  kids?: string[];
+  /** Ordered array of child path names (parallel to kids) */
+  ktree?: string[];
+}
+/** An input for mutations affecting `Commit` */
+export interface CommitInput {
+  /** User who authored the changes */
+  authorId?: string;
+  /** User who committed (may differ from author) */
+  committerId?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Commit timestamp */
+  date?: string;
+  /** Unique commit identifier */
+  id?: string;
+  /** Optional commit message */
+  message?: string;
+  /** Parent commit IDs (supports merge commits) */
+  parentIds?: string[];
+  /** Store this commit belongs to */
+  storeId: string;
+  /** Root object ID of the tree snapshot at this commit */
+  treeId?: string;
+}
 // ============ Payload/Return Types (for custom operations) ============
 export interface InitEmptyRepoPayload {
   clientMutationId?: string | null;
diff --git a/sdk/constructive-functions-hooks/package.json b/sdk/constructive-functions-hooks/package.json
index 79b3825e..7a5eead2 100644
--- a/sdk/constructive-functions-hooks/package.json
+++ b/sdk/constructive-functions-hooks/package.json
@@ -50,7 +50,7 @@
     "react": ">=18.0.0"
   },
   "devDependencies": {
-    "@constructive-io/graphql-codegen": "^4.47.0",
+    "@constructive-io/graphql-codegen": "^4.47.7",
     "@types/node": "^20.19.27",
     "@types/react": "^19.0.0",
     "makage": "^0.3.0",
diff --git a/sdk/constructive-functions-hooks/src/api/orm/input-types.ts b/sdk/constructive-functions-hooks/src/api/orm/input-types.ts
index fd9be1f8..4c6aa88b 100644
--- a/sdk/constructive-functions-hooks/src/api/orm/input-types.ts
+++ b/sdk/constructive-functions-hooks/src/api/orm/input-types.ts
@@ -1569,6 +1569,172 @@ export interface TrgmSearchInput {
   /** Minimum similarity threshold (0.0 to 1.0). Higher = stricter matching. Default is 0.3. */
   threshold?: number;
 }
+/** An input for mutations affecting `RoleType` */
+export interface RoleTypeInput {
+  id: number;
+  name: string;
+}
+/** An input for mutations affecting `PlatformConfigDefinition` */
+export interface PlatformConfigDefinitionInput {
+  /** Freeform metadata annotations for config definitions */
+  annotations?: Record<string, unknown>;
+  createdAt?: string;
+  /** Default value used when no config entry exists for a namespace */
+  defaultValue?: string;
+  /** Human-readable description of what this config key controls */
+  description?: string;
+  /** Unique identifier for this config definition */
+  id?: string;
+  /** Whether this row was seeded as a built-in config definition */
+  isBuiltIn?: boolean;
+  /** Key-value metadata for filtering and grouping config definitions */
+  labels?: Record<string, unknown>;
+  /** Config key name (must match config table name for resolution) */
+  name: string;
+  updatedAt?: string;
+}
+/** An input for mutations affecting `PlatformNamespace` */
+export interface PlatformNamespaceInput {
+  /** Freeform metadata for tooling and operational notes */
+  annotations?: Record<string, unknown>;
+  createdAt?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Optional human-readable description of this namespace */
+  description?: string;
+  id?: string;
+  /** Whether this namespace is active (soft-disable for filtering) */
+  isActive?: boolean;
+  /** Key/value pairs for selecting and filtering namespaces */
+  labels?: Record<string, unknown>;
+  /** Human-readable namespace name (e.g. default, production, oauth) */
+  name: string;
+  /** Globally unique computed namespace identifier via inflection.underscore */
+  namespaceName: string;
+  updatedAt?: string;
+}
+/** An input for mutations affecting `PlatformConfig` */
+export interface PlatformConfigInput {
+  /** Freeform metadata for tooling and operational notes */
+  annotations?: Record<string, unknown>;
+  createdAt?: string;
+  /** Human-readable note about this config entry */
+  description?: string;
+  /** Optional expiration timestamp for time-limited config entries */
+  expiresAt?: string;
+  /** Unique identifier for this config entry */
+  id?: string;
+  /** Key/value pairs for selecting/filtering config entries */
+  labels?: Record<string, unknown>;
+  /** Key name identifying the config entry */
+  name: string;
+  /** FK to namespaces — logical grouping for config entries */
+  namespaceId: string;
+  updatedAt?: string;
+  /** Plaintext config value */
+  value?: string;
+}
+/** An input for mutations affecting `PlatformBucket` */
+export interface PlatformBucketInput {
+  /** User who created this bucket. Forced to current_user_id() on INSERT. */
+  actorId: string;
+  /** When true, clients can provide custom S3 keys (e.g. reports/2024/Q1.pdf). When false (default), S3 key = content hash (automatic dedup). contentHash always required for integrity. */
+  allowCustomKeys?: boolean;
+  /** Whitelist of allowed MIME types for files in this bucket (NULL = all allowed, enforcement deferred) */
+  allowedMimeTypes?: string[];
+  /** Per-bucket CORS allowed origins override (NULL = inherit from storage_module/plugin defaults). Use ARRAY['*'] for open/CDN mode. */
+  allowedOrigins?: string[];
+  createdAt?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Human-readable description of the bucket purpose */
+  description?: string;
+  id?: string;
+  /** Whether bucket contents are publicly readable. Set to true when type is public. */
+  isPublic?: boolean;
+  /** Unique bucket identifier used in S3 key paths (e.g. avatars, documents, temp) */
+  key: string;
+  /** Maximum file size in bytes allowed in this bucket (NULL = no limit, enforcement deferred) */
+  maxFileSize?: string;
+  /** Bucket CDN access type: public (CDN-served), private (presigned GET), temp (staging uploads) */
+  type?: string;
+  updatedAt?: string;
+}
+/** An input for mutations affecting `PlatformFile` */
+export interface PlatformFileInput {
+  /** User who uploaded this file. Forced to current_user_id() on INSERT. Used for UPDATE/DELETE authorization. */
+  actorId: string;
+  /** Bucket this file belongs to. Determines owner_id and is_public via inheritance trigger. */
+  bucketId: string;
+  /** SHA-256 content hash for integrity verification and dedup. In default mode, equals the S3 key. In custom key mode, stored separately. */
+  contentHash?: string;
+  createdAt?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Human-readable description or alt text for the file (mutable) */
+  description?: string;
+  /** Original filename provided by the uploader. Used for display and Content-Disposition header on download. */
+  filename?: string;
+  id?: string;
+  /** Whether this file is publicly readable. Inherited from bucket on INSERT. */
+  isPublic?: boolean;
+  /** S3 object key for this file, unique within its bucket */
+  key: string;
+  /** MIME type of the file (e.g. image/png, application/pdf). Immutable after INSERT. */
+  mimeType: string;
+  /** File size in bytes. Immutable after INSERT. */
+  size: string;
+  /** User-defined tags for categorization and search (mutable) */
+  tags?: string[];
+  updatedAt?: string;
+  /** Processed file reference (upload domain). Populated by processing jobs after file is uploaded. Copy this value to other tables to reference the file. */
+  upload?: ConstructiveInternalTypeUpload;
+  /** File lifecycle status: requested (presigned URL generated, not yet in S3), uploaded (file in S3, ready for basic use), processed (MIME verified, image resized, embedding computed). */
+  status?: FileStatus;
+}
+/** An input for mutations affecting `User` */
+export interface UserInput {
+  createdAt?: string;
+  displayName?: string;
+  id?: string;
+  profilePicture?: ConstructiveInternalTypeImage;
+  type?: number;
+  updatedAt?: string;
+  username?: string;
+}
+/** An input for mutations affecting `PlatformNamespaceEvent` */
+export interface PlatformNamespaceEventInput {
+  /** Event timestamp (partition key) */
+  createdAt?: string;
+  /** User who triggered this event (NULL for system/automated) */
+  actorId?: string;
+  /** CPU usage in millicores at time of event */
+  cpuMillicores?: number;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Event type: created, activated, deactivated, labels_updated, annotations_updated, renamed */
+  eventType: string;
+  /** Unique event identifier */
+  id?: string;
+  /** Memory usage in bytes at time of event */
+  memoryBytes?: string;
+  /** Human-readable description of the event */
+  message?: string;
+  /** Structured context (old/new values, labels diff, etc.) */
+  metadata?: Record<string, unknown>;
+  /** Additional resource metrics (gpu, replicas, quotas, etc.) */
+  metrics?: Record<string, unknown>;
+  /** Namespace this event belongs to */
+  namespaceId: string;
+  /** Network egress in bytes during event window */
+  networkEgressBytes?: string;
+  /** Network ingress in bytes during event window */
+  networkIngressBytes?: string;
+  /** Number of active pods in the namespace at time of event */
+  podCount?: number;
+  /** Storage usage in bytes at time of event */
+  storageBytes?: string;
+}
 export interface UploadPlatformFileBulkFileInput {
   /** SHA-256 content hash (hex-encoded, 64 chars) */
   contentHash: string;
diff --git a/sdk/constructive-functions-hooks/src/compute/orm/input-types.ts b/sdk/constructive-functions-hooks/src/compute/orm/input-types.ts
index 3f975267..bf89a74a 100644
--- a/sdk/constructive-functions-hooks/src/compute/orm/input-types.ts
+++ b/sdk/constructive-functions-hooks/src/compute/orm/input-types.ts
@@ -1746,6 +1746,256 @@ export interface ProvisionBucketInput {
    */
   ownerId?: string;
 }
+/** An input for mutations affecting `PlatformFunctionGraphRef` */
+export interface PlatformFunctionGraphRefInput {
+  /** Commit this ref points to */
+  commitId?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Unique ref identifier */
+  id?: string;
+  /** Ref name (e.g. HEAD, main) */
+  name: string;
+  /** Store this ref belongs to */
+  storeId: string;
+}
+/** An input for mutations affecting `PlatformFunctionGraphStore` */
+export interface PlatformFunctionGraphStoreInput {
+  /** Timestamp of store creation */
+  createdAt?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Current root object hash of this store */
+  hash?: string;
+  /** Unique store identifier */
+  id?: string;
+  /** Human-readable store name */
+  name: string;
+}
+/** An input for mutations affecting `PlatformFunctionGraphObject` */
+export interface PlatformFunctionGraphObjectInput {
+  /** Timestamp of object creation */
+  createdAt?: string;
+  /** Payload data for this object node */
+  data?: Record<string, unknown>;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Content-addressed UUID v5 — deterministic hash of (data, kids, ktree) */
+  id: string;
+  /** Ordered array of child object IDs */
+  kids?: string[];
+  /** Ordered array of child path names (parallel to kids) */
+  ktree?: string[];
+}
+/** An input for mutations affecting `OrgFunctionExecutionLog` */
+export interface OrgFunctionExecutionLogInput {
+  /** Log entry timestamp (partition key) */
+  createdAt?: string;
+  /** User who triggered the execution (NULL for system/cron) */
+  actorId?: string;
+  /** Unique log entry identifier */
+  id?: string;
+  /** Invocation this log entry belongs to (NULL for standalone job logs) */
+  invocationId?: string;
+  /** Log severity: debug, info, warn, error */
+  logLevel?: string;
+  /** Log message text */
+  message: string;
+  /** Structured context (labels, trace data, extra fields) */
+  metadata?: Record<string, unknown>;
+  /** Function routing key (NULL for generic job logs) */
+  taskIdentifier?: string;
+}
+/** An input for mutations affecting `PlatformFunctionGraphCommit` */
+export interface PlatformFunctionGraphCommitInput {
+  /** User who authored the changes */
+  authorId?: string;
+  /** User who committed (may differ from author) */
+  committerId?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Commit timestamp */
+  date?: string;
+  /** Unique commit identifier */
+  id?: string;
+  /** Optional commit message */
+  message?: string;
+  /** Parent commit IDs (supports merge commits) */
+  parentIds?: string[];
+  /** Store this commit belongs to */
+  storeId: string;
+  /** Root object ID of the tree snapshot at this commit */
+  treeId?: string;
+}
+/** An input for mutations affecting `PlatformSecretDefinition` */
+export interface PlatformSecretDefinitionInput {
+  /** Freeform metadata annotations for secret definitions */
+  annotations?: Record<string, unknown>;
+  createdAt?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Human-readable description of what this secret is used for */
+  description?: string;
+  id?: string;
+  /** Whether this row was seeded as a built-in secret definition. Built-in rows are immutable. */
+  isBuiltIn?: boolean;
+  /** Key-value metadata for filtering and grouping secret definitions */
+  labels?: Record<string, unknown>;
+  /** Secret name (must match app_secrets.name for resolution) */
+  name: string;
+  updatedAt?: string;
+}
+/** An input for mutations affecting `PlatformFunctionExecutionLog` */
+export interface PlatformFunctionExecutionLogInput {
+  /** Log entry timestamp (partition key) */
+  createdAt?: string;
+  /** User who triggered the execution (NULL for system/cron) */
+  actorId?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Unique log entry identifier */
+  id?: string;
+  /** Invocation this log entry belongs to (NULL for standalone job logs) */
+  invocationId?: string;
+  /** Log severity: debug, info, warn, error */
+  logLevel?: string;
+  /** Log message text */
+  message: string;
+  /** Structured context (labels, trace data, extra fields) */
+  metadata?: Record<string, unknown>;
+  /** Function routing key (NULL for generic job logs) */
+  taskIdentifier?: string;
+}
+/** An input for mutations affecting `PlatformFunctionGraph` */
+export interface PlatformFunctionGraphInput {
+  /** Evaluator/runtime context (function, js, sql, system) */
+  context?: string;
+  /** Timestamp of graph creation */
+  createdAt?: string;
+  /** Actor who created this graph */
+  createdBy?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Pinned definitions store commit for deterministic evaluation */
+  definitionsCommitId?: string;
+  /** Human-readable description of the graph */
+  description?: string;
+  /** Entity context (org/team) for scoped billing */
+  entityId?: string;
+  /** Unique graph identifier */
+  id?: string;
+  /** Whether graph passes structural validation */
+  isValid?: boolean;
+  /** Graph name (unique per database) */
+  name: string;
+  /** Graph store (Merkle store) holding the graph definition */
+  storeId: string;
+  /** Timestamp of last modification */
+  updatedAt?: string;
+  /** Array of validation error objects when is_valid = false */
+  validationErrors?: Record<string, unknown>;
+}
+/** An input for mutations affecting `OrgFunctionInvocation` */
+export interface OrgFunctionInvocationInput {
+  /** Invocation creation timestamp (partition key) */
+  createdAt?: string;
+  /** Who triggered the invocation (NULL for system/cron) */
+  actorId?: string;
+  /** When execution completed */
+  completedAt?: string;
+  /** Wall-clock execution time in milliseconds */
+  durationMs?: number;
+  /** Error message when status is failed */
+  error?: string;
+  /** Groups all node invocations from a single flow graph execution */
+  graphExecutionId?: string;
+  /** Unique invocation identifier */
+  id?: string;
+  /** FK to app_jobs.jobs — the underlying transport */
+  jobId?: string;
+  /** Parent invocation when this is a child node of a flow graph execution */
+  parentInvocationId?: string;
+  /** Function input payload */
+  payload?: Record<string, unknown>;
+  /** Function return value (success) or structured error (failure) */
+  result?: Record<string, unknown>;
+  /** When execution started */
+  startedAt?: string;
+  /** Lifecycle: pending → running → completed/failed/cancelled */
+  status?: string;
+  /** Function routing slug (scope:name). Links to function_definitions.task_identifier by convention — no FK. */
+  taskIdentifier: string;
+}
+/** An input for mutations affecting `PlatformFunctionInvocation` */
+export interface PlatformFunctionInvocationInput {
+  /** Invocation creation timestamp (partition key) */
+  createdAt?: string;
+  /** Who triggered the invocation (NULL for system/cron) */
+  actorId?: string;
+  /** When execution completed */
+  completedAt?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Wall-clock execution time in milliseconds */
+  durationMs?: number;
+  /** Error message when status is failed */
+  error?: string;
+  /** Groups all node invocations from a single flow graph execution */
+  graphExecutionId?: string;
+  /** Unique invocation identifier */
+  id?: string;
+  /** FK to app_jobs.jobs — the underlying transport */
+  jobId?: string;
+  /** Parent invocation when this is a child node of a flow graph execution */
+  parentInvocationId?: string;
+  /** Function input payload */
+  payload?: Record<string, unknown>;
+  /** Function return value (success) or structured error (failure) */
+  result?: Record<string, unknown>;
+  /** When execution started */
+  startedAt?: string;
+  /** Lifecycle: pending → running → completed/failed/cancelled */
+  status?: string;
+  /** Function routing slug (scope:name). Links to function_definitions.task_identifier by convention — no FK. */
+  taskIdentifier: string;
+}
+/** An input for mutations affecting `PlatformFunctionDefinition` */
+export interface PlatformFunctionDefinitionInput {
+  createdAt?: string;
+  /** Human-readable description of what this function does */
+  description?: string;
+  id?: string;
+  /** Whether this function is a built-in platform function (synced from platform) vs user-created */
+  isBuiltIn?: boolean;
+  /** Whether this function can be called via function_invocations (public API). Default false = internal-only via add_job() */
+  isInvocable?: boolean;
+  /** Maximum retry attempts for the underlying job */
+  maxAttempts?: number;
+  /** Function name within scope (e.g. send_verification_link, process_file_embedding) */
+  name: string;
+  /** Namespace this function belongs to (FK to namespaces table) */
+  namespaceId?: string;
+  /** Job priority (lower = higher priority) */
+  priority?: number;
+  /** Job queue name for serialization (e.g. email, ai, default) */
+  queueName?: string;
+  /** Function grouping scope (e.g. email, embed, chunk, custom) */
+  scope: string;
+  /** Optional service URL override for function dispatch. NULL = use gateway convention (gatewayUrl/task_identifier). Set for customer-deployed functions or external endpoints. */
+  serviceUrl?: string;
+  /** Computed routing slug: scope:name (used by Knative job worker for dispatch) */
+  taskIdentifier: string;
+  updatedAt?: string;
+  /** Embedded config requirements: array of (name, required) tuples */
+  requiredConfigs?: FunctionRequirementInput[];
+  /** Embedded secret requirements: array of (name, required) tuples */
+  requiredSecrets?: FunctionRequirementInput[];
+}
+/** An input for mutations affecting `FunctionRequirement` */
+export interface FunctionRequirementInput {
+  name?: string;
+  required?: boolean;
+}
 /** An interval of time that has passed where the smallest distinct unit is a second. */
 export interface IntervalInput {
   /**
diff --git a/sdk/constructive-functions-hooks/src/objects/orm/input-types.ts b/sdk/constructive-functions-hooks/src/objects/orm/input-types.ts
index cbcf4e09..95309c14 100644
--- a/sdk/constructive-functions-hooks/src/objects/orm/input-types.ts
+++ b/sdk/constructive-functions-hooks/src/objects/orm/input-types.ts
@@ -680,6 +680,68 @@ export interface ProvisionBucketInput {
    */
   ownerId?: string;
 }
+/** An input for mutations affecting `Store` */
+export interface StoreInput {
+  /** Timestamp of store creation */
+  createdAt?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Current root object hash of this store */
+  hash?: string;
+  /** Unique store identifier */
+  id?: string;
+  /** Human-readable store name */
+  name: string;
+}
+/** An input for mutations affecting `Ref` */
+export interface RefInput {
+  /** Commit this ref points to */
+  commitId?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Unique ref identifier */
+  id?: string;
+  /** Ref name (e.g. HEAD, main) */
+  name: string;
+  /** Store this ref belongs to */
+  storeId: string;
+}
+/** An input for mutations affecting `Object` */
+export interface ObjectInput {
+  /** Timestamp of object creation */
+  createdAt?: string;
+  /** Payload data for this object node */
+  data?: Record<string, unknown>;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Content-addressed UUID v5 — deterministic hash of (data, kids, ktree) */
+  id: string;
+  /** Ordered array of child object IDs */
+  kids?: string[];
+  /** Ordered array of child path names (parallel to kids) */
+  ktree?: string[];
+}
+/** An input for mutations affecting `Commit` */
+export interface CommitInput {
+  /** User who authored the changes */
+  authorId?: string;
+  /** User who committed (may differ from author) */
+  committerId?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Commit timestamp */
+  date?: string;
+  /** Unique commit identifier */
+  id?: string;
+  /** Optional commit message */
+  message?: string;
+  /** Parent commit IDs (supports merge commits) */
+  parentIds?: string[];
+  /** Store this commit belongs to */
+  storeId: string;
+  /** Root object ID of the tree snapshot at this commit */
+  treeId?: string;
+}
 // ============ Payload/Return Types (for custom operations) ============
 export interface InitEmptyRepoPayload {
   clientMutationId?: string | null;
diff --git a/sdk/constructive-functions-schema/scripts/generate-schemas.ts b/sdk/constructive-functions-schema/scripts/generate-schemas.ts
index 78cf3fb5..7d009995 100644
--- a/sdk/constructive-functions-schema/scripts/generate-schemas.ts
+++ b/sdk/constructive-functions-schema/scripts/generate-schemas.ts
@@ -1,8 +1,8 @@
-import fs from 'fs';
 import * as http from 'node:http';
-import path from 'path';
 
+import fs from 'fs';
 import { buildClientSchema, getIntrospectionQuery, printSchema } from 'graphql';
+import path from 'path';
 
 const SCHEMAS_DIR = path.resolve(__dirname, '../schemas');
 const INDEX_PATH = path.resolve(__dirname, '../src/index.ts');
diff --git a/sdk/constructive-functions-sdk/package.json b/sdk/constructive-functions-sdk/package.json
index 86106440..931d3aad 100644
--- a/sdk/constructive-functions-sdk/package.json
+++ b/sdk/constructive-functions-sdk/package.json
@@ -46,7 +46,7 @@
     "graphql": "16.13.0"
   },
   "devDependencies": {
-    "@constructive-io/graphql-codegen": "^4.47.0",
+    "@constructive-io/graphql-codegen": "^4.47.7",
     "@types/node": "^20.19.27",
     "makage": "^0.3.0",
     "rimraf": "^5.0.5",
diff --git a/sdk/constructive-functions-sdk/src/api/orm/input-types.ts b/sdk/constructive-functions-sdk/src/api/orm/input-types.ts
index fd9be1f8..4c6aa88b 100644
--- a/sdk/constructive-functions-sdk/src/api/orm/input-types.ts
+++ b/sdk/constructive-functions-sdk/src/api/orm/input-types.ts
@@ -1569,6 +1569,172 @@ export interface TrgmSearchInput {
   /** Minimum similarity threshold (0.0 to 1.0). Higher = stricter matching. Default is 0.3. */
   threshold?: number;
 }
+/** An input for mutations affecting `RoleType` */
+export interface RoleTypeInput {
+  id: number;
+  name: string;
+}
+/** An input for mutations affecting `PlatformConfigDefinition` */
+export interface PlatformConfigDefinitionInput {
+  /** Freeform metadata annotations for config definitions */
+  annotations?: Record<string, unknown>;
+  createdAt?: string;
+  /** Default value used when no config entry exists for a namespace */
+  defaultValue?: string;
+  /** Human-readable description of what this config key controls */
+  description?: string;
+  /** Unique identifier for this config definition */
+  id?: string;
+  /** Whether this row was seeded as a built-in config definition */
+  isBuiltIn?: boolean;
+  /** Key-value metadata for filtering and grouping config definitions */
+  labels?: Record<string, unknown>;
+  /** Config key name (must match config table name for resolution) */
+  name: string;
+  updatedAt?: string;
+}
+/** An input for mutations affecting `PlatformNamespace` */
+export interface PlatformNamespaceInput {
+  /** Freeform metadata for tooling and operational notes */
+  annotations?: Record<string, unknown>;
+  createdAt?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Optional human-readable description of this namespace */
+  description?: string;
+  id?: string;
+  /** Whether this namespace is active (soft-disable for filtering) */
+  isActive?: boolean;
+  /** Key/value pairs for selecting and filtering namespaces */
+  labels?: Record<string, unknown>;
+  /** Human-readable namespace name (e.g. default, production, oauth) */
+  name: string;
+  /** Globally unique computed namespace identifier via inflection.underscore */
+  namespaceName: string;
+  updatedAt?: string;
+}
+/** An input for mutations affecting `PlatformConfig` */
+export interface PlatformConfigInput {
+  /** Freeform metadata for tooling and operational notes */
+  annotations?: Record<string, unknown>;
+  createdAt?: string;
+  /** Human-readable note about this config entry */
+  description?: string;
+  /** Optional expiration timestamp for time-limited config entries */
+  expiresAt?: string;
+  /** Unique identifier for this config entry */
+  id?: string;
+  /** Key/value pairs for selecting/filtering config entries */
+  labels?: Record<string, unknown>;
+  /** Key name identifying the config entry */
+  name: string;
+  /** FK to namespaces — logical grouping for config entries */
+  namespaceId: string;
+  updatedAt?: string;
+  /** Plaintext config value */
+  value?: string;
+}
+/** An input for mutations affecting `PlatformBucket` */
+export interface PlatformBucketInput {
+  /** User who created this bucket. Forced to current_user_id() on INSERT. */
+  actorId: string;
+  /** When true, clients can provide custom S3 keys (e.g. reports/2024/Q1.pdf). When false (default), S3 key = content hash (automatic dedup). contentHash always required for integrity. */
+  allowCustomKeys?: boolean;
+  /** Whitelist of allowed MIME types for files in this bucket (NULL = all allowed, enforcement deferred) */
+  allowedMimeTypes?: string[];
+  /** Per-bucket CORS allowed origins override (NULL = inherit from storage_module/plugin defaults). Use ARRAY['*'] for open/CDN mode. */
+  allowedOrigins?: string[];
+  createdAt?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Human-readable description of the bucket purpose */
+  description?: string;
+  id?: string;
+  /** Whether bucket contents are publicly readable. Set to true when type is public. */
+  isPublic?: boolean;
+  /** Unique bucket identifier used in S3 key paths (e.g. avatars, documents, temp) */
+  key: string;
+  /** Maximum file size in bytes allowed in this bucket (NULL = no limit, enforcement deferred) */
+  maxFileSize?: string;
+  /** Bucket CDN access type: public (CDN-served), private (presigned GET), temp (staging uploads) */
+  type?: string;
+  updatedAt?: string;
+}
+/** An input for mutations affecting `PlatformFile` */
+export interface PlatformFileInput {
+  /** User who uploaded this file. Forced to current_user_id() on INSERT. Used for UPDATE/DELETE authorization. */
+  actorId: string;
+  /** Bucket this file belongs to. Determines owner_id and is_public via inheritance trigger. */
+  bucketId: string;
+  /** SHA-256 content hash for integrity verification and dedup. In default mode, equals the S3 key. In custom key mode, stored separately. */
+  contentHash?: string;
+  createdAt?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Human-readable description or alt text for the file (mutable) */
+  description?: string;
+  /** Original filename provided by the uploader. Used for display and Content-Disposition header on download. */
+  filename?: string;
+  id?: string;
+  /** Whether this file is publicly readable. Inherited from bucket on INSERT. */
+  isPublic?: boolean;
+  /** S3 object key for this file, unique within its bucket */
+  key: string;
+  /** MIME type of the file (e.g. image/png, application/pdf). Immutable after INSERT. */
+  mimeType: string;
+  /** File size in bytes. Immutable after INSERT. */
+  size: string;
+  /** User-defined tags for categorization and search (mutable) */
+  tags?: string[];
+  updatedAt?: string;
+  /** Processed file reference (upload domain). Populated by processing jobs after file is uploaded. Copy this value to other tables to reference the file. */
+  upload?: ConstructiveInternalTypeUpload;
+  /** File lifecycle status: requested (presigned URL generated, not yet in S3), uploaded (file in S3, ready for basic use), processed (MIME verified, image resized, embedding computed). */
+  status?: FileStatus;
+}
+/** An input for mutations affecting `User` */
+export interface UserInput {
+  createdAt?: string;
+  displayName?: string;
+  id?: string;
+  profilePicture?: ConstructiveInternalTypeImage;
+  type?: number;
+  updatedAt?: string;
+  username?: string;
+}
+/** An input for mutations affecting `PlatformNamespaceEvent` */
+export interface PlatformNamespaceEventInput {
+  /** Event timestamp (partition key) */
+  createdAt?: string;
+  /** User who triggered this event (NULL for system/automated) */
+  actorId?: string;
+  /** CPU usage in millicores at time of event */
+  cpuMillicores?: number;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Event type: created, activated, deactivated, labels_updated, annotations_updated, renamed */
+  eventType: string;
+  /** Unique event identifier */
+  id?: string;
+  /** Memory usage in bytes at time of event */
+  memoryBytes?: string;
+  /** Human-readable description of the event */
+  message?: string;
+  /** Structured context (old/new values, labels diff, etc.) */
+  metadata?: Record<string, unknown>;
+  /** Additional resource metrics (gpu, replicas, quotas, etc.) */
+  metrics?: Record<string, unknown>;
+  /** Namespace this event belongs to */
+  namespaceId: string;
+  /** Network egress in bytes during event window */
+  networkEgressBytes?: string;
+  /** Network ingress in bytes during event window */
+  networkIngressBytes?: string;
+  /** Number of active pods in the namespace at time of event */
+  podCount?: number;
+  /** Storage usage in bytes at time of event */
+  storageBytes?: string;
+}
 export interface UploadPlatformFileBulkFileInput {
   /** SHA-256 content hash (hex-encoded, 64 chars) */
   contentHash: string;
diff --git a/sdk/constructive-functions-sdk/src/compute/orm/input-types.ts b/sdk/constructive-functions-sdk/src/compute/orm/input-types.ts
index 3f975267..bf89a74a 100644
--- a/sdk/constructive-functions-sdk/src/compute/orm/input-types.ts
+++ b/sdk/constructive-functions-sdk/src/compute/orm/input-types.ts
@@ -1746,6 +1746,256 @@ export interface ProvisionBucketInput {
    */
   ownerId?: string;
 }
+/** An input for mutations affecting `PlatformFunctionGraphRef` */
+export interface PlatformFunctionGraphRefInput {
+  /** Commit this ref points to */
+  commitId?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Unique ref identifier */
+  id?: string;
+  /** Ref name (e.g. HEAD, main) */
+  name: string;
+  /** Store this ref belongs to */
+  storeId: string;
+}
+/** An input for mutations affecting `PlatformFunctionGraphStore` */
+export interface PlatformFunctionGraphStoreInput {
+  /** Timestamp of store creation */
+  createdAt?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Current root object hash of this store */
+  hash?: string;
+  /** Unique store identifier */
+  id?: string;
+  /** Human-readable store name */
+  name: string;
+}
+/** An input for mutations affecting `PlatformFunctionGraphObject` */
+export interface PlatformFunctionGraphObjectInput {
+  /** Timestamp of object creation */
+  createdAt?: string;
+  /** Payload data for this object node */
+  data?: Record<string, unknown>;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Content-addressed UUID v5 — deterministic hash of (data, kids, ktree) */
+  id: string;
+  /** Ordered array of child object IDs */
+  kids?: string[];
+  /** Ordered array of child path names (parallel to kids) */
+  ktree?: string[];
+}
+/** An input for mutations affecting `OrgFunctionExecutionLog` */
+export interface OrgFunctionExecutionLogInput {
+  /** Log entry timestamp (partition key) */
+  createdAt?: string;
+  /** User who triggered the execution (NULL for system/cron) */
+  actorId?: string;
+  /** Unique log entry identifier */
+  id?: string;
+  /** Invocation this log entry belongs to (NULL for standalone job logs) */
+  invocationId?: string;
+  /** Log severity: debug, info, warn, error */
+  logLevel?: string;
+  /** Log message text */
+  message: string;
+  /** Structured context (labels, trace data, extra fields) */
+  metadata?: Record<string, unknown>;
+  /** Function routing key (NULL for generic job logs) */
+  taskIdentifier?: string;
+}
+/** An input for mutations affecting `PlatformFunctionGraphCommit` */
+export interface PlatformFunctionGraphCommitInput {
+  /** User who authored the changes */
+  authorId?: string;
+  /** User who committed (may differ from author) */
+  committerId?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Commit timestamp */
+  date?: string;
+  /** Unique commit identifier */
+  id?: string;
+  /** Optional commit message */
+  message?: string;
+  /** Parent commit IDs (supports merge commits) */
+  parentIds?: string[];
+  /** Store this commit belongs to */
+  storeId: string;
+  /** Root object ID of the tree snapshot at this commit */
+  treeId?: string;
+}
+/** An input for mutations affecting `PlatformSecretDefinition` */
+export interface PlatformSecretDefinitionInput {
+  /** Freeform metadata annotations for secret definitions */
+  annotations?: Record<string, unknown>;
+  createdAt?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Human-readable description of what this secret is used for */
+  description?: string;
+  id?: string;
+  /** Whether this row was seeded as a built-in secret definition. Built-in rows are immutable. */
+  isBuiltIn?: boolean;
+  /** Key-value metadata for filtering and grouping secret definitions */
+  labels?: Record<string, unknown>;
+  /** Secret name (must match app_secrets.name for resolution) */
+  name: string;
+  updatedAt?: string;
+}
+/** An input for mutations affecting `PlatformFunctionExecutionLog` */
+export interface PlatformFunctionExecutionLogInput {
+  /** Log entry timestamp (partition key) */
+  createdAt?: string;
+  /** User who triggered the execution (NULL for system/cron) */
+  actorId?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Unique log entry identifier */
+  id?: string;
+  /** Invocation this log entry belongs to (NULL for standalone job logs) */
+  invocationId?: string;
+  /** Log severity: debug, info, warn, error */
+  logLevel?: string;
+  /** Log message text */
+  message: string;
+  /** Structured context (labels, trace data, extra fields) */
+  metadata?: Record<string, unknown>;
+  /** Function routing key (NULL for generic job logs) */
+  taskIdentifier?: string;
+}
+/** An input for mutations affecting `PlatformFunctionGraph` */
+export interface PlatformFunctionGraphInput {
+  /** Evaluator/runtime context (function, js, sql, system) */
+  context?: string;
+  /** Timestamp of graph creation */
+  createdAt?: string;
+  /** Actor who created this graph */
+  createdBy?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Pinned definitions store commit for deterministic evaluation */
+  definitionsCommitId?: string;
+  /** Human-readable description of the graph */
+  description?: string;
+  /** Entity context (org/team) for scoped billing */
+  entityId?: string;
+  /** Unique graph identifier */
+  id?: string;
+  /** Whether graph passes structural validation */
+  isValid?: boolean;
+  /** Graph name (unique per database) */
+  name: string;
+  /** Graph store (Merkle store) holding the graph definition */
+  storeId: string;
+  /** Timestamp of last modification */
+  updatedAt?: string;
+  /** Array of validation error objects when is_valid = false */
+  validationErrors?: Record<string, unknown>;
+}
+/** An input for mutations affecting `OrgFunctionInvocation` */
+export interface OrgFunctionInvocationInput {
+  /** Invocation creation timestamp (partition key) */
+  createdAt?: string;
+  /** Who triggered the invocation (NULL for system/cron) */
+  actorId?: string;
+  /** When execution completed */
+  completedAt?: string;
+  /** Wall-clock execution time in milliseconds */
+  durationMs?: number;
+  /** Error message when status is failed */
+  error?: string;
+  /** Groups all node invocations from a single flow graph execution */
+  graphExecutionId?: string;
+  /** Unique invocation identifier */
+  id?: string;
+  /** FK to app_jobs.jobs — the underlying transport */
+  jobId?: string;
+  /** Parent invocation when this is a child node of a flow graph execution */
+  parentInvocationId?: string;
+  /** Function input payload */
+  payload?: Record<string, unknown>;
+  /** Function return value (success) or structured error (failure) */
+  result?: Record<string, unknown>;
+  /** When execution started */
+  startedAt?: string;
+  /** Lifecycle: pending → running → completed/failed/cancelled */
+  status?: string;
+  /** Function routing slug (scope:name). Links to function_definitions.task_identifier by convention — no FK. */
+  taskIdentifier: string;
+}
+/** An input for mutations affecting `PlatformFunctionInvocation` */
+export interface PlatformFunctionInvocationInput {
+  /** Invocation creation timestamp (partition key) */
+  createdAt?: string;
+  /** Who triggered the invocation (NULL for system/cron) */
+  actorId?: string;
+  /** When execution completed */
+  completedAt?: string;
+  /** Database that owns this resource (database-scoped isolation) */
+  databaseId: string;
+  /** Wall-clock execution time in milliseconds */
+  durationMs?: number;
+  /** Error message when status is failed */
+  error?: string;
+  /** Groups all node invocations from a single flow graph execution */
+  graphExecutionId?: string;
+  /** Unique invocation identifier */
+  id?: string;
+  /** FK to app_jobs.jobs — the underlying transport */
+  jobId?: string;
+  /** Parent invocation when this is a child node of a flow graph execution */
+  parentInvocationId?: string;
+  /** Function input payload */
+  payload?: Record<string, unknown>;
+  /** Function return value (success) or structured error (failure) */
+  result?: Record<string, unknown>;
+  /** When execution started */
+  startedAt?: string;
+  /** Lifecycle: pending → running → completed/failed/cancelled */
+  status?: string;
+  /** Function routing slug (scope:name). Links to function_definitions.task_identifier by convention — no FK. */
+  taskIdentifier: string;
+}
+/** An input for mutations affecting `PlatformFunctionDefinition` */
+export interface PlatformFunctionDefinitionInput {
+  createdAt?: string;
+  /** Human-readable description of what this function does */
+  description?: string;
+  id?: string;
+  /** Whether this function is a built-in platform function (synced from platform) vs user-created */
+  isBuiltIn?: boolean;
+  /** Whether this function can be called via function_invocations (public API). Default false = internal-only via add_job() */
+  isInvocable?: boolean;
+  /** Maximum retry attempts for the underlying job */
+  maxAttempts?: number;
+  /** Function name within scope (e.g. send_verification_link, process_file_embedding) */
+  name: string;
+  /** Namespace this function belongs to (FK to namespaces table) */
+  namespaceId?: string;
+  /** Job priority (lower = higher priority) */
+  priority?: number;
+  /** Job queue name for serialization (e.g. email, ai, default) */
+  queueName?: string;
+  /** Function grouping scope (e.g. email, embed, chunk, custom) */
+  scope: string;
+  /** Optional service URL override for function dispatch. NULL = use gateway convention (gatewayUrl/task_identifier). Set for customer-deployed functions or external endpoints. */
+  serviceUrl?: string;
+  /** Computed routing slug: scope:name (used by Knative job worker for dispatch) */
+  taskIdentifier: string;
+  updatedAt?: string;
+  /** Embedded config requirements: array of (name, required) tuples */
+  requiredConfigs?: FunctionRequirementInput[];
+  /** Embedded secret requirements: array of (name, required) tuples */
+  requiredSecrets?: FunctionRequirementInput[];
+}
+/** An input for mutations affecting `FunctionRequirement` */
+export interface FunctionRequirementInput {
+  name?: string;
+  required?: boolean;
+}
 /** An interval of time that has passed where the smallest distinct unit is a second. */
 export interface IntervalInput {
   /**
diff --git a/sdk/constructive-functions-sdk/src/objects/orm/input-types.ts b/sdk/constructive-functions-sdk/src/objects/orm/input-types.ts
index cbcf4e09..95309c14 100644
--- a/sdk/constructive-functions-sdk/src/objects/orm/input-types.ts
+++ b/sdk/constructive-functions-sdk/src/objects/orm/input-types.ts
@@ -680,6 +680,68 @@ export interface ProvisionBucketInput {
    */
   ownerId?: string;
 }
+/** An input for mutations affecting `Store` */
+export interface StoreInput {
+  /** Timestamp of store creation */
+  createdAt?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Current root object hash of this store */
+  hash?: string;
+  /** Unique store identifier */
+  id?: string;
+  /** Human-readable store name */
+  name: string;
+}
+/** An input for mutations affecting `Ref` */
+export interface RefInput {
+  /** Commit this ref points to */
+  commitId?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Unique ref identifier */
+  id?: string;
+  /** Ref name (e.g. HEAD, main) */
+  name: string;
+  /** Store this ref belongs to */
+  storeId: string;
+}
+/** An input for mutations affecting `Object` */
+export interface ObjectInput {
+  /** Timestamp of object creation */
+  createdAt?: string;
+  /** Payload data for this object node */
+  data?: Record<string, unknown>;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Content-addressed UUID v5 — deterministic hash of (data, kids, ktree) */
+  id: string;
+  /** Ordered array of child object IDs */
+  kids?: string[];
+  /** Ordered array of child path names (parallel to kids) */
+  ktree?: string[];
+}
+/** An input for mutations affecting `Commit` */
+export interface CommitInput {
+  /** User who authored the changes */
+  authorId?: string;
+  /** User who committed (may differ from author) */
+  committerId?: string;
+  /** Database scope for multi-tenant isolation */
+  databaseId: string;
+  /** Commit timestamp */
+  date?: string;
+  /** Unique commit identifier */
+  id?: string;
+  /** Optional commit message */
+  message?: string;
+  /** Parent commit IDs (supports merge commits) */
+  parentIds?: string[];
+  /** Store this commit belongs to */
+  storeId: string;
+  /** Root object ID of the tree snapshot at this commit */
+  treeId?: string;
+}
 // ============ Payload/Return Types (for custom operations) ============
 export interface InitEmptyRepoPayload {
   clientMutationId?: string | null;