@tailor-platform/sdk 0.13.0 → 0.14.1

package/dist/{list-D-R1mEOM.mjs → list-CCYkqZyi.mjs}

@@ -1,4 +1,4 @@
-import { WORKFLOW_JOB_BRAND, getDistDir, tailorUserMap } from "./job-vYIg6hFf.mjs";
+import { WORKFLOW_JOB_BRAND, getDistDir, tailorUserMap } from "./job-BGBMNqRW.mjs";
 import { createRequire } from "node:module";
 import { defineCommand } from "citty";
 import * as path from "node:path";
@@ -115,16 +115,180 @@ function loadFilesWithIgnores(config) {
 	return files;
 }
 
+//#endregion
+//#region src/parser/service/auth/schema.ts
+const AuthInvokerSchema = z.object({
+	namespace: z.string(),
+	machineUserName: z.string()
+});
+const secretValueSchema = z.object({
+	vaultName: z.string(),
+	secretKey: z.string()
+});
+const samlBaseSchema = z.object({
+	name: z.string(),
+	kind: z.literal("SAML"),
+	spCertBase64: secretValueSchema.optional(),
+	spKeyBase64: secretValueSchema.optional()
+});
+const OIDCSchema = z.object({
+	name: z.string(),
+	kind: z.literal("OIDC"),
+	clientID: z.string(),
+	clientSecret: secretValueSchema,
+	providerURL: z.string(),
+	issuerURL: z.string().optional(),
+	usernameClaim: z.string().optional()
+});
+const SAMLSchema = samlBaseSchema.extend({
+	metadataURL: z.string().optional(),
+	rawMetadata: z.string().optional()
+}).refine((value) => {
+	const hasMetadata = value.metadataURL !== void 0;
+	const hasRaw = value.rawMetadata !== void 0;
+	return hasMetadata !== hasRaw;
+}, "Provide either metadataURL or rawMetadata");
+const IDTokenSchema = z.object({
+	name: z.string(),
+	kind: z.literal("IDToken"),
+	providerURL: z.string(),
+	issuerURL: z.string().optional(),
+	clientID: z.string(),
+	usernameClaim: z.string().optional()
+});
+const BuiltinIdPSchema = z.object({
+	name: z.string(),
+	kind: z.literal("BuiltInIdP"),
+	namespace: z.string(),
+	clientName: z.string()
+});
+const IdProviderSchema = z.discriminatedUnion("kind", [
+	OIDCSchema,
+	SAMLSchema,
+	IDTokenSchema,
+	BuiltinIdPSchema
+]);
+const OAuth2ClientGrantTypeSchema = z.union([z.literal("authorization_code"), z.literal("refresh_token")]);
+const OAuth2ClientSchema = z.object({
+	description: z.string().optional(),
+	grantTypes: z.array(OAuth2ClientGrantTypeSchema).default(["authorization_code", "refresh_token"]),
+	redirectURIs: z.array(z.union([
+		z.templateLiteral(["https://", z.string()]),
+		z.templateLiteral(["http://", z.string()]),
+		z.templateLiteral([z.string(), ":url"]),
+		z.templateLiteral([
+			z.string(),
+			":url/",
+			z.string()
+		])
+	])),
+	clientType: z.union([
+		z.literal("confidential"),
+		z.literal("public"),
+		z.literal("browser")
+	]).optional()
+});
+const SCIMAuthorizationSchema = z.object({
+	type: z.union([z.literal("oauth2"), z.literal("bearer")]),
+	bearerSecret: secretValueSchema.optional()
+});
+const SCIMAttributeTypeSchema = z.union([
+	z.literal("string"),
+	z.literal("number"),
+	z.literal("boolean"),
+	z.literal("datetime"),
+	z.literal("complex")
+]);
+const SCIMAttributeSchema = z.object({
+	type: SCIMAttributeTypeSchema,
+	name: z.string(),
+	description: z.string().optional(),
+	mutability: z.union([
+		z.literal("readOnly"),
+		z.literal("readWrite"),
+		z.literal("writeOnly")
+	]).optional(),
+	required: z.boolean().optional(),
+	multiValued: z.boolean().optional(),
+	uniqueness: z.union([
+		z.literal("none"),
+		z.literal("server"),
+		z.literal("global")
+	]).optional(),
+	canonicalValues: z.array(z.string()).nullable().optional(),
+	get subAttributes() {
+		return z.array(SCIMAttributeSchema).nullable().optional();
+	}
+});
+const SCIMSchemaSchema = z.object({
+	name: z.string(),
+	attributes: z.array(SCIMAttributeSchema)
+});
+const SCIMAttributeMappingSchema = z.object({
+	tailorDBField: z.string(),
+	scimPath: z.string()
+});
+const SCIMResourceSchema = z.object({
+	name: z.string(),
+	tailorDBNamespace: z.string(),
+	tailorDBType: z.string(),
+	coreSchema: SCIMSchemaSchema,
+	attributeMapping: z.array(SCIMAttributeMappingSchema)
+});
+const SCIMSchema = z.object({
+	machineUserName: z.string(),
+	authorization: SCIMAuthorizationSchema,
+	resources: z.array(SCIMResourceSchema)
+});
+const TenantProviderSchema = z.object({
+	namespace: z.string(),
+	type: z.string(),
+	signatureField: z.string()
+});
+const UserProfileSchema = z.object({
+	type: z.object({
+		name: z.string(),
+		fields: z.any(),
+		metadata: z.any(),
+		hooks: z.any(),
+		validate: z.any(),
+		features: z.any(),
+		indexes: z.any(),
+		files: z.any(),
+		permission: z.any(),
+		gqlPermission: z.any(),
+		_output: z.any()
+	}),
+	usernameField: z.string(),
+	attributes: z.record(z.string(), z.literal(true)).optional(),
+	attributeList: z.array(z.string()).optional()
+});
+const ValueOperandSchema = z.union([
+	z.string(),
+	z.boolean(),
+	z.array(z.string()),
+	z.array(z.boolean())
+]);
+const MachineUserSchema = z.object({
+	attributes: z.record(z.string(), ValueOperandSchema).optional(),
+	attributeList: z.array(z.uuid()).optional()
+});
+const AuthConfigSchema = z.object({
+	name: z.string(),
+	userProfile: UserProfileSchema.optional(),
+	machineUsers: z.record(z.string(), MachineUserSchema).optional(),
+	oauth2Clients: z.record(z.string(), OAuth2ClientSchema).optional(),
+	idProvider: IdProviderSchema.optional(),
+	scim: SCIMSchema.optional(),
+	tenantProvider: TenantProviderSchema.optional()
+}).brand("AuthConfig");
+
 //#endregion
 //#region src/parser/service/common.ts
 const functionSchema = z.custom((val) => typeof val === "function");
 
 //#endregion
 //#region src/parser/service/executor/schema.ts
-const InvokerSchema = z.object({
-	authName: z.string(),
-	machineUser: z.string()
-});
 const RecordTriggerSchema = z.object({
 	kind: z.enum([
 		"recordCreated",
@@ -154,14 +318,14 @@ const TriggerSchema = z.discriminatedUnion("kind", [
 const FunctionOperationSchema = z.object({
 	kind: z.enum(["function", "jobFunction"]),
 	body: functionSchema,
-	invoker: InvokerSchema.optional()
+	authInvoker: AuthInvokerSchema.optional()
 });
 const GqlOperationSchema = z.object({
 	kind: z.literal("graphql"),
 	appName: z.string().optional(),
 	query: z.string(),
 	variables: functionSchema.optional(),
-	invoker: InvokerSchema.optional()
+	authInvoker: AuthInvokerSchema.optional()
 });
 const WebhookOperationSchema = z.object({
 	kind: z.literal("webhook"),
@@ -690,6 +854,568 @@ function isWorkflowJob(value) {
 	return value != null && typeof value === "object" && WORKFLOW_JOB_BRAND in value && value[WORKFLOW_JOB_BRAND] === true;
 }
 
+//#endregion
+//#region src/cli/bundler/workflow/ast-utils.ts
+/**
+* Check if a module source is from \@tailor-platform/sdk (including subpaths)
+*/
+function isTailorSdkSource(source) {
+	return /^@tailor-platform\/sdk(\/|$)/.test(source);
+}
+/**
+* Get the source string from a dynamic import or require call
+*/
+function getImportSource(node) {
+	if (!node) return null;
+	if (node.type === "ImportExpression") {
+		const source = node.source;
+		if (source.type === "Literal" && typeof source.value === "string") return source.value;
+	}
+	if (node.type === "CallExpression") {
+		const callExpr = node;
+		if (callExpr.callee.type === "Identifier" && callExpr.callee.name === "require") {
+			const arg = callExpr.arguments[0];
+			if (arg && "type" in arg && arg.type === "Literal" && "value" in arg && typeof arg.value === "string") return arg.value;
+		}
+	}
+	return null;
+}
+/**
+* Unwrap AwaitExpression to get the inner expression
+*/
+function unwrapAwait(node) {
+	if (node?.type === "AwaitExpression") return node.argument;
+	return node;
+}
+/**
+* Check if a node is a string literal
+*/
+function isStringLiteral(node) {
+	return node?.type === "Literal" && typeof node.value === "string";
+}
+/**
+* Check if a node is a function expression (arrow or regular)
+*/
+function isFunctionExpression(node) {
+	return node?.type === "ArrowFunctionExpression" || node?.type === "FunctionExpression";
+}
+/**
+* Find a property in an object expression
+*/
+function findProperty(properties, name) {
+	for (const prop of properties) if (prop.type === "Property") {
+		const objProp = prop;
+		if ((objProp.key.type === "Identifier" ? objProp.key.name : objProp.key.type === "Literal" ? objProp.key.value : null) === name) return {
+			key: objProp.key,
+			value: objProp.value,
+			start: objProp.start,
+			end: objProp.end
+		};
+	}
+	return null;
+}
+/**
+* Apply string replacements to source code
+* Replacements are applied from end to start to maintain positions
+*/
+function applyReplacements(source, replacements) {
+	const sorted = [...replacements].sort((a, b) => b.start - a.start);
+	let result = source;
+	for (const r of sorted) result = result.slice(0, r.start) + r.text + result.slice(r.end);
+	return result;
+}
+/**
+* Find the end of a statement including any trailing newline
+*/
+function findStatementEnd(source, position) {
+	let i = position;
+	while (i < source.length && (source[i] === ";" || source[i] === " " || source[i] === "	")) i++;
+	if (i < source.length && source[i] === "\n") i++;
+	return i;
+}
+/**
+* Resolve a relative path from a base directory
+* Simple implementation that handles ./ and ../ prefixes
+*/
+function resolvePath(baseDir, relativePath) {
+	const parts = relativePath.replace(/\\/g, "/").split("/");
+	const baseParts = baseDir.replace(/\\/g, "/").split("/");
+	for (const part of parts) if (part === ".") {} else if (part === "..") baseParts.pop();
+	else baseParts.push(part);
+	return baseParts.join("/");
+}
+
+//#endregion
+//#region src/cli/bundler/workflow/sdk-binding-collector.ts
+/**
+* Collect all import bindings for a specific function from \@tailor-platform/sdk
+* Returns a Set of local names that refer to the function
+*/
+function collectSdkBindings(program, functionName) {
+	const bindings = /* @__PURE__ */ new Set();
+	function walk(node) {
+		if (!node || typeof node !== "object") return;
+		const nodeType = node.type;
+		if (nodeType === "ImportDeclaration") {
+			const importDecl = node;
+			const source = importDecl.source?.value;
+			if (typeof source === "string" && isTailorSdkSource(source)) {
+				for (const specifier of importDecl.specifiers || []) if (specifier.type === "ImportSpecifier") {
+					const importSpec = specifier;
+					const imported = importSpec.imported.type === "Identifier" ? importSpec.imported.name : importSpec.imported.value;
+					if (imported === functionName) bindings.add(importSpec.local?.name || imported);
+				} else if (specifier.type === "ImportDefaultSpecifier" || specifier.type === "ImportNamespaceSpecifier") {
+					const spec = specifier;
+					bindings.add(`__namespace__:${spec.local?.name}`);
+				}
+			}
+		}
+		if (nodeType === "VariableDeclaration") {
+			const varDecl = node;
+			for (const decl of varDecl.declarations || []) {
+				const init = unwrapAwait(decl.init);
+				const source = getImportSource(init);
+				if (source && isTailorSdkSource(source)) {
+					const id = decl.id;
+					if (id?.type === "Identifier") bindings.add(`__namespace__:${id.name}`);
+					else if (id?.type === "ObjectPattern") {
+						const objPattern = id;
+						for (const prop of objPattern.properties || []) if (prop.type === "Property") {
+							const bindingProp = prop;
+							const keyName = bindingProp.key.type === "Identifier" ? bindingProp.key.name : bindingProp.key.value;
+							if (keyName === functionName) {
+								const localName = bindingProp.value.type === "Identifier" ? bindingProp.value.name : keyName;
+								bindings.add(localName ?? "");
+							}
+						}
+					}
+				}
+			}
+		}
+		for (const key of Object.keys(node)) {
+			const child = node[key];
+			if (Array.isArray(child)) child.forEach((c) => walk(c));
+			else if (child && typeof child === "object") walk(child);
+		}
+	}
+	walk(program);
+	return bindings;
+}
+/**
+* Check if a CallExpression is a call to a specific SDK function
+*/
+function isSdkFunctionCall(node, bindings, functionName) {
+	if (node.type !== "CallExpression") return false;
+	const callee = node.callee;
+	if (callee.type === "Identifier") {
+		const identifier = callee;
+		return bindings.has(identifier.name);
+	}
+	if (callee.type === "MemberExpression") {
+		const memberExpr = callee;
+		if (!memberExpr.computed) {
+			const object = memberExpr.object;
+			const property = memberExpr.property;
+			if (object.type === "Identifier" && bindings.has(`__namespace__:${object.name}`) && property.name === functionName) return true;
+		}
+	}
+	return false;
+}
+
+//#endregion
+//#region src/cli/bundler/workflow/job-detector.ts
+/**
+* Find all workflow jobs by detecting createWorkflowJob calls from \@tailor-platform/sdk
+*/
+function findAllJobs(program, _sourceText) {
+	const jobs = [];
+	const bindings = collectSdkBindings(program, "createWorkflowJob");
+	function walk(node, parents = []) {
+		if (!node || typeof node !== "object") return;
+		if (isSdkFunctionCall(node, bindings, "createWorkflowJob")) {
+			const args = node.arguments;
+			if (args?.length >= 1 && args[0]?.type === "ObjectExpression") {
+				const configObj = args[0];
+				const nameProp = findProperty(configObj.properties, "name");
+				const bodyProp = findProperty(configObj.properties, "body");
+				if (nameProp && isStringLiteral(nameProp.value) && bodyProp && isFunctionExpression(bodyProp.value)) {
+					let statementRange;
+					let exportName;
+					for (let i = parents.length - 1; i >= 0; i--) {
+						const parent = parents[i];
+						if (parent.type === "VariableDeclarator") {
+							const declarator = parent;
+							if (declarator.id?.type === "Identifier") exportName = declarator.id.name;
+						}
+						if (parent.type === "ExportNamedDeclaration" || parent.type === "VariableDeclaration") statementRange = {
+							start: parent.start,
+							end: parent.end
+						};
+					}
+					jobs.push({
+						name: nameProp.value.value,
+						exportName,
+						nameRange: {
+							start: nameProp.start,
+							end: nameProp.end
+						},
+						bodyValueRange: {
+							start: bodyProp.value.start,
+							end: bodyProp.value.end
+						},
+						statementRange
+					});
+				}
+			}
+		}
+		const newParents = [...parents, node];
+		for (const key of Object.keys(node)) {
+			const child = node[key];
+			if (Array.isArray(child)) child.forEach((c) => walk(c, newParents));
+			else if (child && typeof child === "object") walk(child, newParents);
+		}
+	}
+	walk(program);
+	return jobs;
+}
+/**
+* Build a map from export name to job name from detected jobs
+*/
+function buildJobNameMap(jobs) {
+	const map = /* @__PURE__ */ new Map();
+	for (const job of jobs) if (job.exportName) map.set(job.exportName, job.name);
+	return map;
+}
+/**
+* Detect all .trigger() calls in the source code
+* Returns information about each trigger call for transformation
+*/
+function detectTriggerCalls(program, sourceText) {
+	const calls = [];
+	function walk(node) {
+		if (!node || typeof node !== "object") return;
+		if (node.type === "CallExpression") {
+			const callExpr = node;
+			const callee = callExpr.callee;
+			if (callee.type === "MemberExpression") {
+				const memberExpr = callee;
+				if (!memberExpr.computed && memberExpr.object.type === "Identifier" && memberExpr.property.name === "trigger") {
+					const identifierName = memberExpr.object.name;
+					let argsText = "";
+					if (callExpr.arguments.length > 0) {
+						const firstArg = callExpr.arguments[0];
+						const lastArg = callExpr.arguments[callExpr.arguments.length - 1];
+						if (firstArg && lastArg && "start" in firstArg && "end" in lastArg) argsText = sourceText.slice(firstArg.start, lastArg.end);
+					}
+					calls.push({
+						identifierName,
+						callRange: {
+							start: callExpr.start,
+							end: callExpr.end
+						},
+						argsText
+					});
+				}
+			}
+		}
+		for (const key of Object.keys(node)) {
+			const child = node[key];
+			if (Array.isArray(child)) child.forEach((c) => walk(c));
+			else if (child && typeof child === "object") walk(child);
+		}
+	}
+	walk(program);
+	return calls;
+}
+
+//#endregion
+//#region src/cli/bundler/workflow/workflow-detector.ts
+/**
+* Find all workflows by detecting createWorkflow calls from \@tailor-platform/sdk
+*/
+function findAllWorkflows(program, _sourceText) {
+	const workflows = [];
+	const bindings = collectSdkBindings(program, "createWorkflow");
+	function walk(node, parents = []) {
+		if (!node || typeof node !== "object") return;
+		if (isSdkFunctionCall(node, bindings, "createWorkflow")) {
+			const args = node.arguments;
+			if (args?.length >= 1 && args[0]?.type === "ObjectExpression") {
+				const configObj = args[0];
+				const nameProp = findProperty(configObj.properties, "name");
+				if (nameProp && isStringLiteral(nameProp.value)) {
+					let exportName;
+					let isDefaultExport = false;
+					for (let i = parents.length - 1; i >= 0; i--) {
+						const parent = parents[i];
+						if (parent.type === "VariableDeclarator") {
+							const declarator = parent;
+							if (declarator.id?.type === "Identifier") {
+								exportName = declarator.id.name;
+								break;
+							}
+						}
+						if (parent.type === "ExportDefaultDeclaration") isDefaultExport = true;
+					}
+					workflows.push({
+						name: nameProp.value.value,
+						exportName,
+						isDefaultExport
+					});
+				}
+			}
+		}
+		const newParents = [...parents, node];
+		for (const key of Object.keys(node)) {
+			const child = node[key];
+			if (Array.isArray(child)) child.forEach((c) => walk(c, newParents));
+			else if (child && typeof child === "object") walk(child, newParents);
+		}
+	}
+	walk(program);
+	return workflows;
+}
+/**
+* Build a map from export name to workflow name from detected workflows
+*/
+function buildWorkflowNameMap(workflows) {
+	const map = /* @__PURE__ */ new Map();
+	for (const workflow of workflows) if (workflow.exportName) map.set(workflow.exportName, workflow.name);
+	return map;
+}
+/**
+* Detect default imports in a source file and return a map from local name to import source
+*/
+function detectDefaultImports(program) {
+	const imports = /* @__PURE__ */ new Map();
+	function walk(node) {
+		if (!node || typeof node !== "object") return;
+		if (node.type === "ImportDeclaration") {
+			const importDecl = node;
+			const source = importDecl.source?.value;
+			if (typeof source === "string") {
+				for (const specifier of importDecl.specifiers || []) if (specifier.type === "ImportDefaultSpecifier") {
+					const spec = specifier;
+					if (spec.local?.name) imports.set(spec.local.name, source);
+				}
+			}
+		}
+		for (const key of Object.keys(node)) {
+			const child = node[key];
+			if (Array.isArray(child)) child.forEach((c) => walk(c));
+			else if (child && typeof child === "object") walk(child);
+		}
+	}
+	walk(program);
+	return imports;
+}
+
+//#endregion
+//#region src/cli/bundler/workflow/trigger-transformer.ts
+/**
+* Extract authInvoker info from a config object expression
+* Returns the authInvoker value text and whether it's a shorthand property
+*/
+function extractAuthInvokerInfo(configArg, sourceText) {
+	if (!configArg || typeof configArg !== "object") return void 0;
+	if (configArg.type !== "ObjectExpression") return void 0;
+	const objExpr = configArg;
+	for (const prop of objExpr.properties) {
+		if (prop.type !== "Property") continue;
+		const objProp = prop;
+		if ((objProp.key.type === "Identifier" ? objProp.key.name : objProp.key.type === "Literal" ? objProp.key.value : null) === "authInvoker") {
+			if (objProp.shorthand) return {
+				isShorthand: true,
+				valueText: "authInvoker"
+			};
+			return {
+				isShorthand: false,
+				valueText: sourceText.slice(objProp.value.start, objProp.value.end)
+			};
+		}
+	}
+}
+/**
+* Detect .trigger() calls for known workflows and jobs
+* Only detects calls where the identifier is in workflowNames or jobNames
+*
+* @param program - The parsed AST program
+* @param sourceText - The source code text
+* @param workflowNames - Set of known workflow identifier names
+* @param jobNames - Set of known job identifier names
+*/
+function detectExtendedTriggerCalls(program, sourceText, workflowNames, jobNames) {
+	const calls = [];
+	function walk(node) {
+		if (!node || typeof node !== "object") return;
+		if (node.type === "CallExpression") {
+			const callExpr = node;
+			const callee = callExpr.callee;
+			if (callee.type === "MemberExpression") {
+				const memberExpr = callee;
+				if (!memberExpr.computed && memberExpr.object.type === "Identifier" && memberExpr.property.name === "trigger") {
+					const identifierName = memberExpr.object.name;
+					const isWorkflow = workflowNames.has(identifierName);
+					const isJob = jobNames.has(identifierName);
+					if (!isWorkflow && !isJob) return;
+					const argCount = callExpr.arguments.length;
+					let argsText = "";
+					if (argCount > 0) {
+						const firstArg = callExpr.arguments[0];
+						if (firstArg && "start" in firstArg && "end" in firstArg) argsText = sourceText.slice(firstArg.start, firstArg.end);
+					}
+					if (isWorkflow && argCount >= 2) {
+						const secondArg = callExpr.arguments[1];
+						const authInvoker = extractAuthInvokerInfo(secondArg, sourceText);
+						if (authInvoker) calls.push({
+							kind: "workflow",
+							identifierName,
+							callRange: {
+								start: callExpr.start,
+								end: callExpr.end
+							},
+							argsText,
+							authInvoker
+						});
+					} else if (isJob) calls.push({
+						kind: "job",
+						identifierName,
+						callRange: {
+							start: callExpr.start,
+							end: callExpr.end
+						},
+						argsText
+					});
+				}
+			}
+		}
+		for (const key of Object.keys(node)) {
+			const child = node[key];
+			if (Array.isArray(child)) child.forEach((c) => walk(c));
+			else if (child && typeof child === "object") walk(child);
+		}
+	}
+	walk(program);
+	return calls;
+}
+/**
+* Transform trigger calls for resolver/executor/workflow functions
+* Handles both job.trigger() and workflow.trigger() calls
+*
+* @param source - The source code to transform
+* @param workflowNameMap - Map from variable name to workflow name
+* @param jobNameMap - Map from variable name to job name
+* @param workflowFileMap - Map from file path (without extension) to workflow name for default exports
+* @param currentFilePath - Path of the current file being transformed (for resolving relative imports)
+*/
+function transformFunctionTriggers(source, workflowNameMap, jobNameMap, workflowFileMap, currentFilePath) {
+	const { program } = parseSync("input.ts", source);
+	const localWorkflowNameMap = new Map(workflowNameMap);
+	if (workflowFileMap && currentFilePath) {
+		const defaultImports = detectDefaultImports(program);
+		const currentDir = currentFilePath.replace(/[/\\][^/\\]+$/, "");
+		for (const [localName, importSource] of defaultImports) {
+			if (!importSource.startsWith(".")) continue;
+			const resolvedPath = resolvePath(currentDir, importSource);
+			const workflowName = workflowFileMap.get(resolvedPath);
+			if (workflowName) localWorkflowNameMap.set(localName, workflowName);
+		}
+	}
+	const workflowNames = new Set(localWorkflowNameMap.keys());
+	const jobNames = new Set(jobNameMap.keys());
+	const triggerCalls = detectExtendedTriggerCalls(program, source, workflowNames, jobNames);
+	const replacements = [];
+	for (const call of triggerCalls) if (call.kind === "workflow" && call.authInvoker) {
+		const workflowName = localWorkflowNameMap.get(call.identifierName);
+		if (workflowName) {
+			const authInvokerExpr = call.authInvoker.isShorthand ? "authInvoker" : call.authInvoker.valueText;
+			const transformedCall = `tailor.workflow.triggerWorkflow("${workflowName}", ${call.argsText || "undefined"}, { authInvoker: ${authInvokerExpr} })`;
+			replacements.push({
+				start: call.callRange.start,
+				end: call.callRange.end,
+				text: transformedCall
+			});
+		}
+	} else if (call.kind === "job") {
+		const jobName = jobNameMap.get(call.identifierName);
+		if (jobName) {
+			const transformedCall = `tailor.workflow.triggerJobFunction("${jobName}", ${call.argsText || "undefined"})`;
+			replacements.push({
+				start: call.callRange.start,
+				end: call.callRange.end,
+				text: transformedCall
+			});
+		}
+	}
+	return applyReplacements(source, replacements);
+}
+
+//#endregion
+//#region src/cli/bundler/trigger-context.ts
+/**
+* Normalize a file path by removing extension and resolving to absolute path
+*/
+function normalizeFilePath(filePath) {
+	const absolutePath = path.resolve(filePath);
+	const ext = path.extname(absolutePath);
+	return absolutePath.slice(0, -ext.length);
+}
+/**
+* Build trigger context from workflow configuration
+* Scans workflow files to collect workflow and job mappings
+*/
+async function buildTriggerContext(workflowConfig) {
+	const workflowNameMap = /* @__PURE__ */ new Map();
+	const jobNameMap = /* @__PURE__ */ new Map();
+	const workflowFileMap = /* @__PURE__ */ new Map();
+	if (!workflowConfig) return {
+		workflowNameMap,
+		jobNameMap,
+		workflowFileMap
+	};
+	const workflowFiles = loadFilesWithIgnores(workflowConfig);
+	for (const file of workflowFiles) try {
+		const source = await fs.promises.readFile(file, "utf-8");
+		const { program } = parseSync("input.ts", source);
+		const workflows = findAllWorkflows(program, source);
+		const workflowMap = buildWorkflowNameMap(workflows);
+		for (const [exportName, workflowName] of workflowMap) workflowNameMap.set(exportName, workflowName);
+		for (const workflow of workflows) if (workflow.isDefaultExport) {
+			const normalizedPath = normalizeFilePath(file);
+			workflowFileMap.set(normalizedPath, workflow.name);
+		}
+		const jobs = findAllJobs(program, source);
+		const jobMap = buildJobNameMap(jobs);
+		for (const [exportName, jobName] of jobMap) jobNameMap.set(exportName, jobName);
+	} catch (error) {
+		const errorMessage = error instanceof Error ? error.message : String(error);
+		console.warn(styleText("yellow", `Warning: Failed to process workflow file ${file}: ${errorMessage}`));
+		continue;
+	}
+	return {
+		workflowNameMap,
+		jobNameMap,
+		workflowFileMap
+	};
+}
+/**
+* Create a rolldown plugin for transforming trigger calls
+* Returns undefined if no trigger context is provided
+*/
+function createTriggerTransformPlugin(triggerContext) {
+	if (!triggerContext) return;
+	return {
+		name: "trigger-transform",
+		transform: {
+			filter: { id: { include: [/\.ts$/, /\.js$/] } },
+			handler(code, id) {
+				if (!code.includes(".trigger(")) return null;
+				return { code: transformFunctionTriggers(code, triggerContext.workflowNameMap, triggerContext.jobNameMap, triggerContext.workflowFileMap, id) };
+			}
+		}
+	};
+}
+
 //#endregion
 //#region src/cli/bundler/executor/loader.ts
 async function loadExecutor(executorFilePath) {
@@ -708,7 +1434,7 @@ async function loadExecutor(executorFilePath) {
 * 1. Creates entry file that extracts operation.body
 * 2. Bundles in a single step with tree-shaking
 */
-async function bundleExecutors(config) {
+async function bundleExecutors(config, triggerContext) {
 	const files = loadFilesWithIgnores(config);
 	if (files.length === 0) throw new Error(`No files found matching pattern: ${config.files?.join(", ")}`);
 	console.log("");
@@ -741,10 +1467,10 @@ async function bundleExecutors(config) {
 	} catch {
 		tsconfig = void 0;
 	}
-	await Promise.all(executors.map((executor) => bundleSingleExecutor(executor, outputDir, tsconfig)));
+	await Promise.all(executors.map((executor) => bundleSingleExecutor(executor, outputDir, tsconfig, triggerContext)));
 	console.log(styleText("green", "Bundled"), styleText("cyan", "\"executor\""));
 }
-async function bundleSingleExecutor(executor, outputDir, tsconfig) {
+async function bundleSingleExecutor(executor, outputDir, tsconfig, triggerContext) {
 	const entryPath = path.join(outputDir, `${executor.name}.entry.js`);
 	const absoluteSourcePath = path.resolve(executor.sourceFile).replace(/\\/g, "/");
 	const entryContent = ml`
@@ -756,6 +1482,8 @@ async function bundleSingleExecutor(executor, outputDir, tsconfig) {
   `;
 	fs.writeFileSync(entryPath, entryContent);
 	const outputPath = path.join(outputDir, `${executor.name}.js`);
+	const triggerPlugin = createTriggerTransformPlugin(triggerContext);
+	const plugins = triggerPlugin ? [triggerPlugin] : [];
 	await rolldown.build(rolldown.defineConfig({
 		input: entryPath,
 		output: {
@@ -766,6 +1494,7 @@ async function bundleSingleExecutor(executor, outputDir, tsconfig) {
 			inlineDynamicImports: true
 		},
 		tsconfig,
+		plugins,
 		treeshake: {
 			moduleSideEffects: false,
 			annotations: true,
@@ -794,7 +1523,7 @@ async function loadResolver(resolverFilePath) {
 * 2. Creates entry file
 * 3. Bundles in a single step with tree-shaking
 */
-async function bundleResolvers(namespace, config) {
+async function bundleResolvers(namespace, config, triggerContext) {
 	const files = loadFilesWithIgnores(config);
 	if (files.length === 0) throw new Error(`No files found matching pattern: ${config.files?.join(", ")}`);
 	console.log("");
@@ -819,10 +1548,10 @@ async function bundleResolvers(namespace, config) {
 	} catch {
 		tsconfig = void 0;
 	}
-	await Promise.all(resolvers.map((resolver) => bundleSingleResolver(resolver, outputDir, tsconfig)));
+	await Promise.all(resolvers.map((resolver) => bundleSingleResolver(resolver, outputDir, tsconfig, triggerContext)));
 	console.log(styleText("green", "Bundled"), styleText("cyan", `"${namespace}"`));
 }
-async function bundleSingleResolver(resolver, outputDir, tsconfig) {
+async function bundleSingleResolver(resolver, outputDir, tsconfig, triggerContext) {
 	const entryPath = path.join(outputDir, `${resolver.name}.entry.js`);
 	const absoluteSourcePath = path.resolve(resolver.sourceFile).replace(/\\/g, "/");
 	const entryContent = ml`
@@ -855,6 +1584,8 @@ async function bundleSingleResolver(resolver, outputDir, tsconfig) {
   `;
 	fs.writeFileSync(entryPath, entryContent);
 	const outputPath = path.join(outputDir, `${resolver.name}.js`);
+	const triggerPlugin = createTriggerTransformPlugin(triggerContext);
+	const plugins = triggerPlugin ? [triggerPlugin] : [];
 	await rolldown.build(rolldown.defineConfig({
 		input: entryPath,
 		output: {
@@ -865,6 +1596,7 @@ async function bundleSingleResolver(resolver, outputDir, tsconfig) {
 			inlineDynamicImports: true
 		},
 		tsconfig,
+		plugins,
 		treeshake: {
 			moduleSideEffects: false,
 			annotations: true,
@@ -875,261 +1607,7 @@ async function bundleSingleResolver(resolver, outputDir, tsconfig) {
 }
 
 //#endregion
-//#region src/cli/bundler/workflow/ast-transformer.ts
-/**
-* Check if a module source is from \@tailor-platform/sdk (including subpaths)
-*/
-function isTailorSdkSource(source) {
-	return /^@tailor-platform\/sdk(\/|$)/.test(source);
-}
-/**
-* Get the source string from a dynamic import or require call
-*/
-function getImportSource(node) {
-	if (!node) return null;
-	if (node.type === "ImportExpression") {
-		const source = node.source;
-		if (source.type === "Literal" && typeof source.value === "string") return source.value;
-	}
-	if (node.type === "CallExpression") {
-		const callExpr = node;
-		if (callExpr.callee.type === "Identifier" && callExpr.callee.name === "require") {
-			const arg = callExpr.arguments[0];
-			if (arg && "type" in arg && arg.type === "Literal" && "value" in arg && typeof arg.value === "string") return arg.value;
-		}
-	}
-	return null;
-}
-/**
-* Unwrap AwaitExpression to get the inner expression
-*/
-function unwrapAwait(node) {
-	if (node?.type === "AwaitExpression") return node.argument;
-	return node;
-}
-/**
-* Collect all import bindings for createWorkflowJob from \@tailor-platform/sdk
-* Returns a Set of local names that refer to createWorkflowJob
-*/
-function collectCreateWorkflowJobBindings(program) {
-	const bindings = /* @__PURE__ */ new Set();
-	function walk(node) {
-		if (!node || typeof node !== "object") return;
-		const nodeType = node.type;
-		if (nodeType === "ImportDeclaration") {
-			const importDecl = node;
-			const source = importDecl.source?.value;
-			if (typeof source === "string" && isTailorSdkSource(source)) {
-				for (const specifier of importDecl.specifiers || []) if (specifier.type === "ImportSpecifier") {
-					const importSpec = specifier;
-					const imported = importSpec.imported.type === "Identifier" ? importSpec.imported.name : importSpec.imported.value;
-					if (imported === "createWorkflowJob") bindings.add(importSpec.local?.name || imported);
-				} else if (specifier.type === "ImportDefaultSpecifier" || specifier.type === "ImportNamespaceSpecifier") {
-					const spec = specifier;
-					bindings.add(`__namespace__:${spec.local?.name}`);
-				}
-			}
-		}
-		if (nodeType === "VariableDeclaration") {
-			const varDecl = node;
-			for (const decl of varDecl.declarations || []) {
-				const init = unwrapAwait(decl.init);
-				const source = getImportSource(init);
-				if (source && isTailorSdkSource(source)) {
-					const id = decl.id;
-					if (id?.type === "Identifier") bindings.add(`__namespace__:${id.name}`);
-					else if (id?.type === "ObjectPattern") {
-						const objPattern = id;
-						for (const prop of objPattern.properties || []) if (prop.type === "Property") {
-							const bindingProp = prop;
-							const keyName = bindingProp.key.type === "Identifier" ? bindingProp.key.name : bindingProp.key.value;
-							if (keyName === "createWorkflowJob") {
-								const localName = bindingProp.value.type === "Identifier" ? bindingProp.value.name : keyName;
-								bindings.add(localName ?? "");
-							}
-						}
-					}
-				}
-			}
-		}
-		for (const key of Object.keys(node)) {
-			const child = node[key];
-			if (Array.isArray(child)) child.forEach((c) => walk(c));
-			else if (child && typeof child === "object") walk(child);
-		}
-	}
-	walk(program);
-	return bindings;
-}
-/**
-* Check if a CallExpression is a createWorkflowJob call
-*/
-function isCreateWorkflowJobCall(node, bindings) {
-	if (node.type !== "CallExpression") return false;
-	const callee = node.callee;
-	if (callee.type === "Identifier") {
-		const identifier = callee;
-		return bindings.has(identifier.name);
-	}
-	if (callee.type === "MemberExpression") {
-		const memberExpr = callee;
-		if (!memberExpr.computed) {
-			const object = memberExpr.object;
-			const property = memberExpr.property;
-			if (object.type === "Identifier" && bindings.has(`__namespace__:${object.name}`) && property.name === "createWorkflowJob") return true;
-		}
-	}
-	return false;
-}
-/**
-* Check if a node is a string literal
-*/
-function isStringLiteral(node) {
-	return node?.type === "Literal" && typeof node.value === "string";
-}
-/**
-* Check if a node is a function expression (arrow or regular)
-*/
-function isFunctionExpression(node) {
-	return node?.type === "ArrowFunctionExpression" || node?.type === "FunctionExpression";
-}
-/**
-* Find a property in an object expression
-*/
-function findProperty(properties, name) {
-	for (const prop of properties) if (prop.type === "Property") {
-		const objProp = prop;
-		if ((objProp.key.type === "Identifier" ? objProp.key.name : objProp.key.type === "Literal" ? objProp.key.value : null) === name) return {
-			key: objProp.key,
-			value: objProp.value,
-			start: objProp.start,
-			end: objProp.end
-		};
-	}
-	return null;
-}
-/**
-* Find all workflow jobs by detecting createWorkflowJob calls from \@tailor-platform/sdk
-*/
-function findAllJobs(program, _sourceText) {
-	const jobs = [];
-	const bindings = collectCreateWorkflowJobBindings(program);
-	function walk(node, parents = []) {
-		if (!node || typeof node !== "object") return;
-		if (isCreateWorkflowJobCall(node, bindings)) {
-			const args = node.arguments;
-			if (args?.length >= 1 && args[0]?.type === "ObjectExpression") {
-				const configObj = args[0];
-				const nameProp = findProperty(configObj.properties, "name");
-				const bodyProp = findProperty(configObj.properties, "body");
-				if (nameProp && isStringLiteral(nameProp.value) && bodyProp && isFunctionExpression(bodyProp.value)) {
-					let statementRange;
-					let exportName;
-					for (let i = parents.length - 1; i >= 0; i--) {
-						const parent = parents[i];
-						if (parent.type === "VariableDeclarator") {
-							const declarator = parent;
-							if (declarator.id?.type === "Identifier") exportName = declarator.id.name;
-						}
-						if (parent.type === "ExportNamedDeclaration" || parent.type === "VariableDeclaration") statementRange = {
-							start: parent.start,
-							end: parent.end
-						};
-					}
-					jobs.push({
-						name: nameProp.value.value,
-						exportName,
-						nameRange: {
-							start: nameProp.start,
-							end: nameProp.end
-						},
-						bodyValueRange: {
-							start: bodyProp.value.start,
-							end: bodyProp.value.end
-						},
-						statementRange
-					});
-				}
-			}
-		}
-		const newParents = [...parents, node];
-		for (const key of Object.keys(node)) {
-			const child = node[key];
-			if (Array.isArray(child)) child.forEach((c) => walk(c, newParents));
-			else if (child && typeof child === "object") walk(child, newParents);
-		}
-	}
-	walk(program);
-	return jobs;
-}
-/**
-* Apply string replacements to source code
-* Replacements are applied from end to start to maintain positions
-*/
-function applyReplacements(source, replacements) {
-	const sorted = [...replacements].sort((a, b) => b.start - a.start);
-	let result = source;
-	for (const r of sorted) result = result.slice(0, r.start) + r.text + result.slice(r.end);
-	return result;
-}
-/**
-* Find the end of a statement including any trailing newline
-*/
-function findStatementEnd(source, position) {
-	let i = position;
-	while (i < source.length && (source[i] === ";" || source[i] === " " || source[i] === "	")) i++;
-	if (i < source.length && source[i] === "\n") i++;
-	return i;
-}
-/**
-* Detect all .trigger() calls in the source code
-* Returns information about each trigger call for transformation
-*/
-function detectTriggerCalls(program, sourceText) {
-	const calls = [];
-	function walk(node) {
-		if (!node || typeof node !== "object") return;
-		if (node.type === "CallExpression") {
-			const callExpr = node;
-			const callee = callExpr.callee;
-			if (callee.type === "MemberExpression") {
-				const memberExpr = callee;
-				if (!memberExpr.computed && memberExpr.object.type === "Identifier" && memberExpr.property.name === "trigger") {
-					const identifierName = memberExpr.object.name;
-					let argsText = "";
-					if (callExpr.arguments.length > 0) {
-						const firstArg = callExpr.arguments[0];
-						const lastArg = callExpr.arguments[callExpr.arguments.length - 1];
-						if (firstArg && lastArg && "start" in firstArg && "end" in lastArg) argsText = sourceText.slice(firstArg.start, lastArg.end);
-					}
-					calls.push({
-						identifierName,
-						callRange: {
-							start: callExpr.start,
-							end: callExpr.end
-						},
-						argsText
-					});
-				}
-			}
-		}
-		for (const key of Object.keys(node)) {
-			const child = node[key];
-			if (Array.isArray(child)) child.forEach((c) => walk(c));
-			else if (child && typeof child === "object") walk(child);
-		}
-	}
-	walk(program);
-	return calls;
-}
-/**
-* Build a map from export name to job name from detected jobs
-*/
-function buildJobNameMap(jobs) {
-	const map = /* @__PURE__ */ new Map();
-	for (const job of jobs) if (job.exportName) map.set(job.exportName, job.name);
-	return map;
-}
+//#region src/cli/bundler/workflow/source-transformer.ts
 /**
 * Find variable declarations by export names
 * Returns a map of export name to statement range
@@ -1252,13 +1730,15 @@ function transformWorkflowSource(source, targetJobName, targetJobExportName, oth
 * 1. Detects which jobs are actually used (mainJobs + their dependencies)
 * 2. Uses a transform plugin to transform trigger calls during bundling
 * 3. Creates entry file and bundles with tree-shaking
+*
+* Returns metadata about which jobs each workflow uses.
 */
-async function bundleWorkflowJobs(allJobs, mainJobNames, env = {}) {
+async function bundleWorkflowJobs(allJobs, mainJobNames, env = {}, triggerContext) {
 	if (allJobs.length === 0) {
 		console.log(styleText("dim", "No workflow jobs to bundle"));
-		return;
+		return { mainJobDeps: {} };
 	}
-	const usedJobs = await filterUsedJobs(allJobs, mainJobNames);
+	const { usedJobs, mainJobDeps } = await filterUsedJobs(allJobs, mainJobNames);
 	console.log("");
 	console.log("Bundling", styleText("cyanBright", usedJobs.length.toString()), "files for", styleText("cyan", "\"workflow-job\""));
 	const outputDir = path.resolve(getDistDir(), "workflow-jobs");
@@ -1270,17 +1750,23 @@ async function bundleWorkflowJobs(allJobs, mainJobNames, env = {}) {
 	} catch {
 		tsconfig = void 0;
 	}
-	await Promise.all(usedJobs.map((job) => bundleSingleJob(job, usedJobs, outputDir, tsconfig, env)));
+	await Promise.all(usedJobs.map((job) => bundleSingleJob(job, usedJobs, outputDir, tsconfig, env, triggerContext)));
 	console.log(styleText("green", "Bundled"), styleText("cyan", "\"workflow-job\""));
+	return { mainJobDeps };
 }
 /**
 * Filter jobs to only include those that are actually used.
 * A job is "used" if:
 * - It's a mainJob of a workflow
 * - It's called via .trigger() from another used job (transitively)
+*
+* Also returns a map of mainJob -> all jobs it depends on (for metadata).
 */
 async function filterUsedJobs(allJobs, mainJobNames) {
-	if (allJobs.length === 0 || mainJobNames.length === 0) return [];
+	if (allJobs.length === 0 || mainJobNames.length === 0) return {
+		usedJobs: [],
+		mainJobDeps: {}
+	};
 	const jobsBySourceFile = /* @__PURE__ */ new Map();
 	for (const job of allJobs) {
 		const existing = jobsBySourceFile.get(job.sourceFile) || [];
@@ -1319,16 +1805,25 @@ async function filterUsedJobs(allJobs, mainJobNames) {
 	}));
 	for (const jobDependencies of fileResults) for (const { jobName, deps } of jobDependencies) dependencies.set(jobName, deps);
 	const usedJobNames = /* @__PURE__ */ new Set();
-	function markUsed(jobName) {
-		if (usedJobNames.has(jobName)) return;
-		usedJobNames.add(jobName);
+	const mainJobDeps = {};
+	function collectDeps(jobName, collected) {
+		if (collected.has(jobName)) return;
+		collected.add(jobName);
 		const deps = dependencies.get(jobName);
-		if (deps) for (const dep of deps) markUsed(dep);
+		if (deps) for (const dep of deps) collectDeps(dep, collected);
 	}
-	for (const mainJobName of mainJobNames) markUsed(mainJobName);
-	return allJobs.filter((job) => usedJobNames.has(job.name));
+	for (const mainJobName of mainJobNames) {
+		const depsForMainJob = /* @__PURE__ */ new Set();
+		collectDeps(mainJobName, depsForMainJob);
+		mainJobDeps[mainJobName] = Array.from(depsForMainJob);
+		for (const dep of depsForMainJob) usedJobNames.add(dep);
+	}
+	return {
+		usedJobs: allJobs.filter((job) => usedJobNames.has(job.name)),
+		mainJobDeps
+	};
 }
-async function bundleSingleJob(job, allJobs, outputDir, tsconfig, env) {
+async function bundleSingleJob(job, allJobs, outputDir, tsconfig, env, triggerContext) {
 	const entryPath = path.join(outputDir, `${job.name}.entry.js`);
 	const absoluteSourcePath = path.resolve(job.sourceFile).replace(/\\/g, "/");
 	const entryContent = ml`
@@ -1359,9 +1854,11 @@ async function bundleSingleJob(job, allJobs, outputDir, tsconfig, env) {
 			name: "workflow-transform",
 			transform: {
 				filter: { id: { include: [/\.ts$/, /\.js$/] } },
-				handler(code) {
-					if (!code.includes("createWorkflowJob") && !code.includes(".trigger(")) return null;
-					return { code: transformWorkflowSource(code, job.name, job.exportName, otherJobExportNames, allJobsMap) };
+				handler(code, id) {
+					if (!code.includes("createWorkflowJob") && !code.includes("createWorkflow") && !code.includes(".trigger(")) return null;
+					let transformed = transformWorkflowSource(code, job.name, job.exportName, otherJobExportNames, allJobsMap);
+					if (triggerContext && transformed.includes(".trigger(")) transformed = transformFunctionTriggers(transformed, triggerContext.workflowNameMap, triggerContext.jobNameMap, triggerContext.workflowFileMap, id);
+					return { code: transformed };
 				}
 			}
 		}],
@@ -3937,12 +4434,12 @@ function protoIdPConfig(idpConfig) {
 				value: {
 					...idpConfig.metadataURL !== void 0 ? { metadataUrl: idpConfig.metadataURL } : { rawMetadata: idpConfig.rawMetadata },
 					...idpConfig.spCertBase64 && { spCertBase64: {
-						vaultName: idpConfig.spCertBase64.VaultName,
-						secretKey: idpConfig.spCertBase64.SecretKey
+						vaultName: idpConfig.spCertBase64.vaultName,
+						secretKey: idpConfig.spCertBase64.secretKey
 					} },
 					...idpConfig.spKeyBase64 && { spKeyBase64: {
-						vaultName: idpConfig.spKeyBase64.VaultName,
-						secretKey: idpConfig.spKeyBase64.SecretKey
+						vaultName: idpConfig.spKeyBase64.vaultName,
+						secretKey: idpConfig.spKeyBase64.secretKey
 					} }
 				}
 			} }
@@ -3955,8 +4452,8 @@ function protoIdPConfig(idpConfig) {
 				value: {
 					clientIdKey: idpConfig.clientID,
 					clientSecretKey: {
-						vaultName: idpConfig.clientSecret.VaultName,
-						secretKey: idpConfig.clientSecret.SecretKey
+						vaultName: idpConfig.clientSecret.vaultName,
+						secretKey: idpConfig.clientSecret.secretKey
 					},
 					providerUrl: idpConfig.providerURL,
 					issuerUrl: idpConfig.issuerURL,
@@ -4392,8 +4889,8 @@ function protoSCIMConfig(scimConfig) {
 		authorizationConfig: {
 			case: "bearerSecret",
 			value: {
-				vaultName: scimConfig.authorization.bearerSecret?.VaultName,
-				secretKey: scimConfig.authorization.bearerSecret?.SecretKey
+				vaultName: scimConfig.authorization.bearerSecret?.vaultName,
+				secretKey: scimConfig.authorization.bearerSecret?.secretKey
 			}
 		}
 	};
@@ -4780,10 +5277,7 @@ function protoExecutor(appName, executor, env) {
 					appName: target.appName ?? appName,
 					query: target.query,
 					variables: target.variables ? { expr: `(${target.variables.toString()})(args)` } : void 0,
-					invoker: target.invoker ? {
-						namespace: target.invoker.authName,
-						machineUserName: target.invoker.machineUser
-					} : void 0
+					invoker: target.authInvoker ?? void 0
 				}
 			} };
 			break;
@@ -4799,10 +5293,7 @@ function protoExecutor(appName, executor, env) {
 					name: `${executor.name}__target`,
 					script,
 					variables: { expr: `({ ...args, appNamespace: args.namespaceName, env: ${JSON.stringify(env)} })` },
-					invoker: target.invoker ? {
-						namespace: target.invoker.authName,
-						machineUserName: target.invoker.machineUser
-					} : void 0
+					invoker: target.authInvoker ?? void 0
 				}
 			} };
 			break;
@@ -5758,19 +6249,21 @@ async function applyWorkflow(client, result, phase = "create-update") {
 	if (phase === "create-update") {
 		const jobFunctionVersions = await registerJobFunctions(client, changeSet);
 		await Promise.all([...changeSet.creates.map(async (create) => {
+			const filteredVersions = filterJobFunctionVersions(jobFunctionVersions, create.usedJobNames);
 			await client.createWorkflow({
 				workspaceId: create.workspaceId,
 				workflowName: create.workflow.name,
 				mainJobFunctionName: create.workflow.mainJob.name,
-				jobFunctions: jobFunctionVersions
+				jobFunctions: filteredVersions
 			});
 			await client.setMetadata(create.metaRequest);
 		}), ...changeSet.updates.map(async (update) => {
+			const filteredVersions = filterJobFunctionVersions(jobFunctionVersions, update.usedJobNames);
 			await client.updateWorkflow({
 				workspaceId: update.workspaceId,
 				workflowName: update.workflow.name,
 				mainJobFunctionName: update.workflow.mainJob.name,
-				jobFunctions: jobFunctionVersions
+				jobFunctions: filteredVersions
 			});
 			await client.setMetadata(update.metaRequest);
 		})]);
@@ -5780,7 +6273,16 @@ async function applyWorkflow(client, result, phase = "create-update") {
 	})));
 }
 /**
-* Register all job functions once, returns a map of job name to version.
+* Filter job function versions to only include those used by a workflow
+*/
+function filterJobFunctionVersions(allVersions, usedJobNames) {
+	const filtered = {};
+	for (const jobName of usedJobNames) if (allVersions[jobName] !== void 0) filtered[jobName] = allVersions[jobName];
+	return filtered;
+}
+/**
+* Register job functions used by any workflow.
+* Only registers jobs that are actually used (based on usedJobNames in changeSet).
 * Uses update for existing workflows, create for new workflows.
 */
 async function registerJobFunctions(client, changeSet) {
@@ -5788,8 +6290,12 @@ async function registerJobFunctions(client, changeSet) {
 	const firstWorkflow = changeSet.creates[0] || changeSet.updates[0];
 	if (!firstWorkflow) return jobFunctionVersions;
 	const { workspaceId, scripts } = firstWorkflow;
+	const allUsedJobNames = /* @__PURE__ */ new Set();
+	for (const item of [...changeSet.creates, ...changeSet.updates]) for (const jobName of item.usedJobNames) allUsedJobNames.add(jobName);
 	const hasExistingWorkflows = changeSet.updates.length > 0;
-	const results = await Promise.all(Array.from(scripts.entries()).map(async ([jobName, script]) => {
+	const results = await Promise.all(Array.from(allUsedJobNames).map(async (jobName) => {
+		const script = scripts.get(jobName);
+		if (!script) throw new Error(`No bundled script found for job "${jobName}". Please run "generate" command before "apply".`);
 		const response = hasExistingWorkflows ? await client.updateWorkflowJobFunction({
 			workspaceId,
 			jobFunctionName: jobName,
@@ -5810,7 +6316,7 @@ async function registerJobFunctions(client, changeSet) {
 function trn(workspaceId, name) {
 	return `trn:v1:workspace:${workspaceId}:workflow:${name}`;
 }
-async function planWorkflow(client, workspaceId, appName, workflows) {
+async function planWorkflow(client, workspaceId, appName, workflows, mainJobDeps) {
 	const changeSet = new ChangeSet("Workflows");
 	const conflicts = [];
 	const unmanaged = [];
@@ -5837,6 +6343,8 @@ async function planWorkflow(client, workspaceId, appName, workflows) {
 	for (const workflow of Object.values(workflows)) {
 		const existing = existingWorkflows[workflow.name];
 		const metaRequest = await buildMetaRequest(trn(workspaceId, workflow.name), appName);
+		const usedJobNames = mainJobDeps[workflow.mainJob.name];
+		if (!usedJobNames) throw new Error(`No dependency info found for mainJob "${workflow.mainJob.name}". Please run "generate" command before "apply".`);
 		if (existing) {
 			if (!existing.label) unmanaged.push({
 				resourceType: "Workflow",
@@ -5852,6 +6360,7 @@ async function planWorkflow(client, workspaceId, appName, workflows) {
 				workspaceId,
 				workflow,
 				scripts: allScripts,
+				usedJobNames,
 				metaRequest
 			});
 			delete existingWorkflows[workflow.name];
@@ -5860,6 +6369,7 @@ async function planWorkflow(client, workspaceId, appName, workflows) {
 			workspaceId,
 			workflow,
 			scripts: allScripts,
+			usedJobNames,
 			metaRequest
 		});
 	}
@@ -5905,11 +6415,13 @@ async function apply(options) {
 	const application = defineApplication(config);
 	let workflowResult;
 	if (application.workflowConfig) workflowResult = await loadAndCollectJobs(application.workflowConfig);
-	for (const app$1 of application.applications) for (const pipeline$1 of app$1.resolverServices) await buildPipeline(pipeline$1.namespace, pipeline$1.config);
-	if (application.executorService) await buildExecutor(application.executorService.config);
+	const triggerContext = await buildTriggerContext(application.workflowConfig);
+	for (const app$1 of application.applications) for (const pipeline$1 of app$1.resolverServices) await buildPipeline(pipeline$1.namespace, pipeline$1.config, triggerContext);
+	if (application.executorService) await buildExecutor(application.executorService.config, triggerContext);
+	let workflowBuildResult;
 	if (workflowResult && workflowResult.jobs.length > 0) {
 		const mainJobNames = workflowResult.workflowSources.map((ws) => ws.workflow.mainJob.name);
-		await buildWorkflow(workflowResult.jobs, mainJobNames, application.env);
+		workflowBuildResult = await buildWorkflow(workflowResult.jobs, mainJobNames, application.env, triggerContext);
 	}
 	if (buildOnly) return;
 	const accessToken = await loadAccessToken({
@@ -5939,7 +6451,7 @@ async function apply(options) {
 	const pipeline = await planPipeline(ctx);
 	const app = await planApplication(ctx);
 	const executor = await planExecutor(ctx);
-	const workflow = await planWorkflow(client, workspaceId, application.name, workflowResult?.workflows ?? {});
+	const workflow = await planWorkflow(client, workspaceId, application.name, workflowResult?.workflows ?? {}, workflowBuildResult?.mainJobDeps ?? {});
 	const allConflicts = [
 		...tailorDB.conflicts,
 		...staticWebsite.conflicts,
@@ -6009,14 +6521,14 @@ async function apply(options) {
 	await applyTailorDB(client, tailorDB, "delete");
 	console.log("Successfully applied changes.");
 }
-async function buildPipeline(namespace, config) {
-	await bundleResolvers(namespace, config);
+async function buildPipeline(namespace, config, triggerContext) {
+	await bundleResolvers(namespace, config, triggerContext);
 }
-async function buildExecutor(config) {
-	await bundleExecutors(config);
+async function buildExecutor(config, triggerContext) {
+	await bundleExecutors(config, triggerContext);
 }
-async function buildWorkflow(collectedJobs, mainJobNames, env) {
-	await bundleWorkflowJobs(collectedJobs, mainJobNames, env);
+async function buildWorkflow(collectedJobs, mainJobNames, env, triggerContext) {
+	return bundleWorkflowJobs(collectedJobs, mainJobNames, env, triggerContext);
 }
 const applyCommand = defineCommand({
 	meta: {
@@ -6889,7 +7401,7 @@ async function execRemove(client, workspaceId, application, confirm) {
 	const pipeline = await planPipeline(ctx);
 	const app = await planApplication(ctx);
 	const executor = await planExecutor(ctx);
-	const workflow = await planWorkflow(client, workspaceId, application.name, {});
+	const workflow = await planWorkflow(client, workspaceId, application.name, {}, {});
 	if (tailorDB.changeSet.service.deletes.length === 0 && staticWebsite.changeSet.deletes.length === 0 && idp.changeSet.service.deletes.length === 0 && auth.changeSet.service.deletes.length === 0 && pipeline.changeSet.service.deletes.length === 0 && app.deletes.length === 0 && executor.changeSet.deletes.length === 0 && workflow.changeSet.deletes.length === 0) return;
 	if (confirm) await confirm();
 	await applyWorkflow(client, workflow, "delete");
@@ -7448,4 +7960,4 @@ const listCommand = defineCommand({
 
 //#endregion
 export { PATScope, apply, applyCommand, commonArgs, createCommand, deleteCommand, fetchAll, fetchLatestToken, fetchUserInfo, formatArgs, generate, generateCommand, generateUserTypes, getCommand, initOAuth2Client, initOperatorClient, listCommand, listCommand$1, listCommand$2, loadAccessToken, loadConfig, loadWorkspaceId, machineUserList, machineUserToken, oauth2ClientGet, oauth2ClientList, parseFormat, printWithFormat, readPackageJson, readPlatformConfig, remove, removeCommand, show, showCommand, tokenCommand, withCommonArgs, workspaceCreate, workspaceDelete, workspaceList, writePlatformConfig };
-//# sourceMappingURL=list-D-R1mEOM.mjs.map
+//# sourceMappingURL=list-CCYkqZyi.mjs.map