@tailor-platform/sdk 1.24.0 → 1.25.1

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @tailor-platform/sdk
 
+## 1.25.1
+
+### Patch Changes
+
+- [#727](https://github.com/tailor-platform/sdk/pull/727) [`cf08b9b`](https://github.com/tailor-platform/sdk/commit/cf08b9be9af5027b4bfce6537ee182fb4d3586ab) Thanks [@dqn](https://github.com/dqn)! - fix: use kind-specific brand symbols to prevent cross-service false positives during generate
+
+## 1.25.0
+
+### Minor Changes
+
+- [#670](https://github.com/tailor-platform/sdk/pull/670) [`0659515`](https://github.com/tailor-platform/sdk/commit/0659515f2aa2db5fa0e23c2cfe3e3af04dec2b3d) Thanks [@toiroakr](https://github.com/toiroakr)! - Add `validate` subcommand to generated seed `exec.mjs` for validating JSONL data against schema definitions without deploying. Add `@tailor-platform/sdk/seed` export that provides `defineSchema` (re-exported from `@toiroakr/lines-db`) and `validateSeedData` wrapper to avoid phantom dependency issues.
+
+### Patch Changes
+
+- [#711](https://github.com/tailor-platform/sdk/pull/711) [`60d4803`](https://github.com/tailor-platform/sdk/commit/60d48038a5faa80846f8e7ce46a45fbe49e0cbdc) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update changesets/action action to v1.7.0
+
+- [#713](https://github.com/tailor-platform/sdk/pull/713) [`a20860d`](https://github.com/tailor-platform/sdk/commit/a20860d67cda7a16f009fc11e7f06e488b54189a) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update dependency @changesets/changelog-github to v0.6.0
+
+- [#715](https://github.com/tailor-platform/sdk/pull/715) [`1ae10fc`](https://github.com/tailor-platform/sdk/commit/1ae10fc99e953f3e44e23a7ad75d9c8c1fe6e8ed) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update dependency @changesets/cli to v2.30.0
+
+- [#718](https://github.com/tailor-platform/sdk/pull/718) [`1f85c44`](https://github.com/tailor-platform/sdk/commit/1f85c44cb2bf20a932b4c002ffec9d8e83b696b5) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update dependency aquaproj/aqua-registry to v4.481.0
+
+- [#720](https://github.com/tailor-platform/sdk/pull/720) [`681daa4`](https://github.com/tailor-platform/sdk/commit/681daa473d7bce4cda8e12fa9525175c2d19e4ad) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update dependency aquaproj/aqua-renovate-config to v2.11.0
+
+- [#721](https://github.com/tailor-platform/sdk/pull/721) [`aa7d7ef`](https://github.com/tailor-platform/sdk/commit/aa7d7ef407cbe8d022f104589fc331db70788336) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update dependency bufbuild/buf to v1.66.1
+
+- [#652](https://github.com/tailor-platform/sdk/pull/652) [`988d5af`](https://github.com/tailor-platform/sdk/commit/988d5af6031d6a4373140590710186edef54529f) Thanks [@riku99](https://github.com/riku99)! - Add declarative secret management in tailor.config.ts via defineSecretManager() API
+
 ## 1.24.0
 
 ### Minor Changes

package/dist/{app-config-BNKHurwr.d.mts → app-config-QzNOFnEy.d.mts}

@@ -1,4 +1,4 @@
-import { S as TailorDBServiceInput, T as AuthConfig, kt as BuiltinIdP } from "./plugin-CE-BZZgX.mjs";
+import { S as TailorDBServiceInput, T as AuthConfig, kt as BuiltinIdP } from "./plugin-3sT6Tcq0.mjs";
 
 //#region src/types/idp.generated.d.ts
 
@@ -74,6 +74,27 @@ type IdPExternalConfig = {
 type IdPOwnConfig = Omit<DefinedIdp<string, IdPInput, string>, "provider">;
 type IdPConfig = IdPOwnConfig | IdPExternalConfig;
 //#endregion
+//#region src/configure/services/secrets/index.d.ts
+declare const secretsDefinitionBrand: unique symbol;
+type SecretsDefinitionBrand = {
+  readonly [secretsDefinitionBrand]: true;
+};
+type SecretsVaultInput = Record<string, string>;
+type SecretsInput = Record<string, SecretsVaultInput>;
+type DefinedSecrets<T extends SecretsInput> = {
+  get<V extends Extract<keyof T, string>, S extends Extract<keyof T[V], string>>(vault: V, secret: S): Promise<string | undefined>;
+  getAll<V extends Extract<keyof T, string>, S extends Extract<keyof T[V], string>>(vault: V, secrets: readonly S[]): Promise<(string | undefined)[]>;
+} & SecretsDefinitionBrand;
+/** Type accepted by `AppConfig.secrets`. Only values returned by `defineSecretManager()` satisfy this. */
+type SecretsConfig = Omit<ReturnType<typeof defineSecretManager>, "get" | "getAll">;
+/**
+ * Define secrets configuration for the Tailor SDK.
+ * Each key is a vault name, and its value is a record of secret name to secret value.
+ * @param config - Secrets configuration mapping vault names to their secrets
+ * @returns Defined secrets with typed runtime access methods
+ */
+declare function defineSecretManager<const T extends SecretsInput>(config: T): DefinedSecrets<T>;
+//#endregion
 //#region src/types/staticwebsite.generated.d.ts
 type StaticWebsite = {
   /** Static website name */
@@ -163,6 +184,8 @@ interface AppConfig<Auth extends AuthConfig = AuthConfig, Idp extends IdPConfig[
   workflow?: WorkflowServiceInput;
   /** Static website configurations. Must be an array, e.g. `[website]`. */
   staticWebsites?: StaticWebsites;
+  /** Secret Manager vault configurations. Keys are vault names, values are records of secret names to values. */
+  secrets?: SecretsConfig;
   /**
    * Enable inline sourcemaps in bundled functions for better error stack traces.
    * @default true
@@ -170,5 +193,5 @@ interface AppConfig<Auth extends AuthConfig = AuthConfig, Idp extends IdPConfig[
   inlineSourcemap?: boolean;
 }
 //#endregion
-export { ResolverServiceConfig as a, WorkflowServiceInput as c, IdPConfig as d, IdPExternalConfig as f, IdPInput as g, IdPGqlOperationsInput as h, ResolverExternalConfig as i, StaticWebsiteConfig as l, IdPGqlOperations as m, ExecutorServiceConfig as n, ResolverServiceInput as o, IdpDefinitionBrand as p, ExecutorServiceInput as r, WorkflowServiceConfig as s, AppConfig as t, defineStaticWebSite as u };
-//# sourceMappingURL=app-config-BNKHurwr.d.mts.map
+export { IdPGqlOperationsInput as _, ResolverServiceConfig as a, WorkflowServiceInput as c, SecretsConfig as d, defineSecretManager as f, IdPGqlOperations as g, IdpDefinitionBrand as h, ResolverExternalConfig as i, StaticWebsiteConfig as l, IdPExternalConfig as m, ExecutorServiceConfig as n, ResolverServiceInput as o, IdPConfig as p, ExecutorServiceInput as r, WorkflowServiceConfig as s, AppConfig as t, defineStaticWebSite as u, IdPInput as v };
+//# sourceMappingURL=app-config-QzNOFnEy.d.mts.map

package/dist/application-B4ORumjE.mjs

@@ -0,0 +1,8 @@
+import "./brand-BOaOlsiP.mjs";
+import { n as generatePluginFilesIfNeeded, r as loadApplication, t as defineApplication } from "./application-iRp2OYMz.mjs";
+import "./package-json-DnbGCOkg.mjs";
+import "./seed-DkKAheSe.mjs";
+import "./file-utils-C2r3AVbI.mjs";
+import "./kysely-type-DzLBuVp6.mjs";
+
+export { defineApplication };

package/dist/{application-DThE2HW7.mjs → application-iRp2OYMz.mjs}

@@ -1,9 +1,9 @@
-import { n as isSdkBranded } from "./brand-64NrPh_e.mjs";
-import { t as readPackageJson } from "./package-json-4G3gLWMd.mjs";
-import { n as seedPlugin, r as isPluginGeneratedType, t as SeedGeneratorID } from "./seed-Cl5QXYsL.mjs";
-import { n as enumConstantsPlugin, t as EnumConstantsGeneratorID } from "./enum-constants-B5Nl-yzx.mjs";
-import { n as fileUtilsPlugin, t as FileUtilsGeneratorID } from "./file-utils-sEOwAdJ4.mjs";
-import { n as kyselyTypePlugin, t as KyselyGeneratorID } from "./kysely-type-CSlcwNFH.mjs";
+import { n as isSdkBranded } from "./brand-BOaOlsiP.mjs";
+import { t as readPackageJson } from "./package-json-DnbGCOkg.mjs";
+import { n as seedPlugin, r as isPluginGeneratedType, t as SeedGeneratorID } from "./seed-DkKAheSe.mjs";
+import { n as enumConstantsPlugin, t as EnumConstantsGeneratorID } from "./enum-constants-BxdLbhsW.mjs";
+import { n as fileUtilsPlugin, t as FileUtilsGeneratorID } from "./file-utils-C2r3AVbI.mjs";
+import { n as kyselyTypePlugin, t as KyselyGeneratorID } from "./kysely-type-DzLBuVp6.mjs";
 import { createRequire } from "node:module";
 import { z } from "zod";
 import * as fs$1 from "node:fs";
@@ -913,7 +913,7 @@ function initOAuth2Client() {
 * @returns Configured Operator client
 */
 async function initOperatorClient(accessToken) {
-	const { createTracingInterceptor } = await import("./interceptor-B-0OmiDZ.mjs");
+	const { createTracingInterceptor } = await import("./interceptor-DVy32eIG.mjs");
 	return createClient(OperatorService, createConnectTransport({
 		httpVersion: "2",
 		baseUrl: platformBaseUrl,
@@ -3242,7 +3242,7 @@ function createTailorDBService(params) {
 				const exportedValue = module[exportName];
 				const result = TailorDBTypeSchema.safeParse(exportedValue);
 				if (!result.success) {
-					if (isSdkBranded(exportedValue)) throw result.error;
+					if (isSdkBranded(exportedValue, "tailordb-type")) throw result.error;
 					continue;
 				}
 				const relativePath = path.relative(process.cwd(), typeFile);
@@ -4503,7 +4503,7 @@ function createExecutorService(params) {
 				executors[executorFile] = result.data;
 				return result.data;
 			}
-			if (isSdkBranded(executorModule.default)) throw result.error;
+			if (isSdkBranded(executorModule.default, "executor")) throw result.error;
 		} catch (error) {
 			const relativePath = path.relative(process.cwd(), executorFile);
 			logger.error(`Failed to load executor from ${styles.bold(relativePath)}`);
@@ -4700,7 +4700,7 @@ function createResolverService(namespace, config) {
 				resolvers[resolverFile] = result.data;
 				return result.data;
 			}
-			if (isSdkBranded(resolverModule.default)) throw result.error;
+			if (isSdkBranded(resolverModule.default, "resolver")) throw result.error;
 		} catch (error) {
 			const relativePath = path.relative(process.cwd(), resolverFile);
 			logger.error(`Failed to load resolver from ${styles.bold(relativePath)}`);
@@ -5181,7 +5181,7 @@ async function loadFileContent(filePath) {
 			if (exportName === "default") {
 				const workflowResult = WorkflowSchema.safeParse(exportValue);
 				if (workflowResult.success) workflow = workflowResult.data;
-				else if (isSdkBranded(exportValue)) throw workflowResult.error;
+				else if (isSdkBranded(exportValue, ["workflow", "workflow-job"])) throw workflowResult.error;
 				continue;
 			}
 			const jobResult = WorkflowJobSchema.safeParse(exportValue);
@@ -5190,7 +5190,7 @@ async function loadFileContent(filePath) {
 				exportName,
 				sourceFile: filePath
 			});
-			else if (isSdkBranded(exportValue)) throw jobResult.error;
+			else if (isSdkBranded(exportValue, ["workflow", "workflow-job"])) throw jobResult.error;
 		}
 	} catch (error) {
 		const relativePath = path.relative(process.cwd(), filePath);
@@ -5442,6 +5442,12 @@ const IdPSchema = z.object({
 	gqlOperations: IdPGqlOperationsSchema.optional().describe("Configure which GraphQL operations are enabled")
 }).brand("IdPConfig");
 
+//#endregion
+//#region src/parser/service/secrets/schema.ts
+const nameSchema = z.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/);
+const secretsVaultSchema = z.record(nameSchema, z.string());
+const SecretsSchema = z.record(nameSchema, secretsVaultSchema);
+
 //#endregion
 //#region src/parser/service/staticwebsite/schema.ts
 const StaticWebsiteSchema = z.object({
@@ -5566,6 +5572,18 @@ function defineStaticWebsites(websites) {
 	});
 	return staticWebsiteServices;
 }
+function defineSecretManager(config) {
+	if (!config) return [];
+	const data = Object.fromEntries(Object.entries(config));
+	const parsed = SecretsSchema.parse(data);
+	return Object.entries(parsed).map(([vaultName, vaultSecrets]) => ({
+		vaultName,
+		secrets: Object.entries(vaultSecrets).map(([name, value]) => ({
+			name,
+			value
+		}))
+	}));
+}
 function defineServices(config, pluginManager) {
 	const tailordbResult = defineTailorDB(config.db, pluginManager);
 	return {
@@ -5573,7 +5591,8 @@ function defineServices(config, pluginManager) {
 		resolverResult: defineResolver(config.resolver),
 		idpResult: defineIdp(config.idp),
 		authResult: defineAuth(config.auth, tailordbResult.tailorDBServices, tailordbResult.externalTailorDBNamespaces),
-		staticWebsiteServices: defineStaticWebsites(config.staticWebsites)
+		staticWebsiteServices: defineStaticWebsites(config.staticWebsites),
+		secrets: defineSecretManager(config.secrets)
 	};
 }
 function buildApplication(params) {
@@ -5594,6 +5613,7 @@ function buildApplication(params) {
 		executorService: params.executorService,
 		workflowService: params.workflowService,
 		staticWebsiteServices: params.staticWebsiteServices,
+		secrets: params.secrets,
 		env: params.env,
 		get applications() {
 			return [application];
@@ -5656,7 +5676,7 @@ function generatePluginFilesIfNeeded(pluginManager, tailorDBServices, configPath
 */
 async function loadApplication(params) {
 	const { config, pluginManager, bundleCache } = params;
-	const { tailordbResult, resolverResult, idpResult, authResult, staticWebsiteServices } = defineServices(config, pluginManager);
+	const { tailordbResult, resolverResult, idpResult, authResult, staticWebsiteServices, secrets } = defineServices(config, pluginManager);
 	for (const tailordb of tailordbResult.tailorDBServices) {
 		await tailordb.loadTypes();
 		await tailordb.processNamespacePlugins();
@@ -5697,6 +5717,7 @@ async function loadApplication(params) {
 			executorService,
 			workflowService,
 			staticWebsiteServices,
+			secrets,
 			env: config.env ?? {}
 		}),
 		workflowBuildResult
@@ -5705,4 +5726,4 @@ async function loadApplication(params) {
 
 //#endregion
 export { AuthSCIMAttribute_Mutability as $, platformBaseUrl as A, TailorDBType_Permission_Permit as B, readPlatformConfig as C, fetchUserInfo as D, fetchMachineUserToken as E, WorkflowJobExecution_Status as F, FunctionExecution_Type as G, PipelineResolver_OperationType as H, TailorDBGQLPermission_Action as I, ExecutorTriggerType as J, ExecutorJobStatus as K, TailorDBGQLPermission_Operator as L, userAgent as M, WorkspacePlatformUserRole as N, initOAuth2Client as O, WorkflowExecution_Status as P, AuthOAuth2Client_GrantType as Q, TailorDBGQLPermission_Permit as R, loadWorkspaceId as S, fetchAll as T, IdPLang as U, TailorDBType_PermitAction as V, FunctionExecution_Status as W, AuthInvokerSchema$1 as X, AuthIDPConfig_AuthType as Y, AuthOAuth2Client_ClientType as Z, hashFile as _, loadConfig as a, UserProfileProviderConfig_UserProfileProviderType as at, loadFolderId as b, ExecutorSchema as c, Condition_Operator as ct, TailorDBTypeSchema as d, ApplicationSchemaUpdateAttemptStatus as dt, AuthSCIMAttribute_Type as et, stringifyFunction as f, Subgraph_ServiceType as ft, getDistDir as g, createBundleCache as h, symbols as ht, resolveInlineSourcemap as i, TenantProviderConfig_TenantProviderType as it, resolveStaticWebsiteUrls as j, initOperatorClient as k, OAuth2ClientSchema as l, FilterSchema as lt, loadFilesWithIgnores as m, styles as mt, generatePluginFilesIfNeeded as n, AuthSCIMConfig_AuthorizationType as nt, WorkflowJobSchema as o, GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus as ot, tailorUserMap as p, logger as pt, ExecutorTargetType as q, loadApplication as r, PATScope as rt, createExecutorService as s, ConditionSchema as st, defineApplication as t, AuthSCIMAttribute_Uniqueness as tt, ResolverSchema as u, PageDirection as ut, fetchLatestToken as v, writePlatformConfig as w, loadOrganizationId as x, loadAccessToken as y, TailorDBType_Permission_Operator as z };
-//# sourceMappingURL=application-DThE2HW7.mjs.map
+//# sourceMappingURL=application-iRp2OYMz.mjs.map