@tailor-platform/sdk 1.35.1 → 1.36.0

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # @tailor-platform/sdk
 
+## 1.36.0
+
+### Minor Changes
+
+- [#920](https://github.com/tailor-platform/sdk/pull/920) [`1b64d8e`](https://github.com/tailor-platform/sdk/commit/1b64d8e07c4b8b2c8bcfaded5210b8774d4556ff) Thanks [@dqn](https://github.com/dqn)! - Show original source locations and code snippets in `function test-run` errors using inline sourcemaps
+
+- [#931](https://github.com/tailor-platform/sdk/pull/931) [`a1dab54`](https://github.com/tailor-platform/sdk/commit/a1dab54dfec4c7eb69348ab94a82de9d22231c45) Thanks [@toiroakr](https://github.com/toiroakr)! - Add `ignoreNullishValues` option to `defineSecretManager` to skip secrets with nullish values during deploy
+
+- [#965](https://github.com/tailor-platform/sdk/pull/965) [`c273be3`](https://github.com/tailor-platform/sdk/commit/c273be330071a9e3d2d2ebc65ef9b17e9c995ddc) Thanks [@haru0017](https://github.com/haru0017)! - Add `defaultRedirectURL` to SAML IdP config for handling SAML ACS responses with empty RelayState
+
+### Patch Changes
+
+- [#911](https://github.com/tailor-platform/sdk/pull/911) [`3cf9975`](https://github.com/tailor-platform/sdk/commit/3cf997591ac06c18a973cd16b3c6bc70b05f6793) Thanks [@k1LoW](https://github.com/k1LoW)! - Add `permission` option to `defineIdp()` for per-operation permission policies on IdP users (create, read, update, delete, sendPasswordResetEmail)
+
+- [#947](https://github.com/tailor-platform/sdk/pull/947) [`19f95c2`](https://github.com/tailor-platform/sdk/commit/19f95c27e22027037457fcfcd9adca360f62553d) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update dependency oxlint to v1.59.0
+
+- [#956](https://github.com/tailor-platform/sdk/pull/956) [`391c53d`](https://github.com/tailor-platform/sdk/commit/391c53d32dd7108aead8917abb12a2b928df792a) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): lock file maintenance
+
+- [#957](https://github.com/tailor-platform/sdk/pull/957) [`cc14d77`](https://github.com/tailor-platform/sdk/commit/cc14d773c1f62b9e14c935cf4541983ed514fe90) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update actions/upload-artifact action to v7.0.1
+
+- [#958](https://github.com/tailor-platform/sdk/pull/958) [`32e6b1f`](https://github.com/tailor-platform/sdk/commit/32e6b1fa67a582db685f8268dbbb38c0ac45b101) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update anthropics/claude-code-action action to v1.0.93
+
+- [#959](https://github.com/tailor-platform/sdk/pull/959) [`61b60c9`](https://github.com/tailor-platform/sdk/commit/61b60c9b0e8af467a50bc4ee06ada89fba76a653) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update dependency knip to v6.3.1
+
+- [#960](https://github.com/tailor-platform/sdk/pull/960) [`9e0ce60`](https://github.com/tailor-platform/sdk/commit/9e0ce60b2d5c662c6983c60a377f5ce7c3dea7df) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update dependency turbo to v2.9.5
+
+- [#962](https://github.com/tailor-platform/sdk/pull/962) [`dd74185`](https://github.com/tailor-platform/sdk/commit/dd74185d593be00122a173ca427c238292a627bf) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update marocchino/sticky-pull-request-comment action to v3.0.4
+
+## 1.35.2
+
+### Patch Changes
+
+- [#925](https://github.com/tailor-platform/sdk/pull/925) [`ce5b766`](https://github.com/tailor-platform/sdk/commit/ce5b76662951cbe89779d45512a57c80cf4a2984) Thanks [@toiroakr](https://github.com/toiroakr)! - `function test-run` resolver arg no longer requires the `input` wrapper key — pass input fields directly (e.g. `-a '{"a":1}'`). The old `{"input":{...}}` format is detected via schema validation and emits a deprecation warning. When no input schema is defined, `--arg` is ignored with a warning.
+
+- [#945](https://github.com/tailor-platform/sdk/pull/945) [`4d9892e`](https://github.com/tailor-platform/sdk/commit/4d9892e6e40c6eb4852714b8437339080e935189) Thanks [@anukiransolur](https://github.com/anukiransolur)! - chore(docs): added requirements for deterministic execution that the workflow must satisfy
+
+- [#890](https://github.com/tailor-platform/sdk/pull/890) [`f0e03f2`](https://github.com/tailor-platform/sdk/commit/f0e03f267435094e88ec3cedd0af22bb4655264c) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update dependency oxfmt to v0.43.0
+
+- [#927](https://github.com/tailor-platform/sdk/pull/927) [`dc699f3`](https://github.com/tailor-platform/sdk/commit/dc699f386b68d9647a77961f5ff34910f1b67939) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update dependency @typescript/native-preview to v7.0.0-dev.20260406.1
+
+- [#936](https://github.com/tailor-platform/sdk/pull/936) [`7a1f37b`](https://github.com/tailor-platform/sdk/commit/7a1f37bd376736a47f367ac06fdbb3fbb5fa1446) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update dependency oxc-parser to v0.123.0
+
+- [#943](https://github.com/tailor-platform/sdk/pull/943) [`14af922`](https://github.com/tailor-platform/sdk/commit/14af922e82d945c76b8c864d1bb177eb9fae26f6) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update anthropics/claude-code-action action to v1.0.92
+
+- [#944](https://github.com/tailor-platform/sdk/pull/944) [`f0070a9`](https://github.com/tailor-platform/sdk/commit/f0070a9f41a15c9802b9c5caf201cf802e19a589) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update dependency @inquirer/core to v11.1.8
+
+- [#946](https://github.com/tailor-platform/sdk/pull/946) [`c06dd0e`](https://github.com/tailor-platform/sdk/commit/c06dd0e16688b7863a4c85e569ed4e2e60bba971) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update dependency oxfmt to v0.44.0
+
+- [#948](https://github.com/tailor-platform/sdk/pull/948) [`d5f365f`](https://github.com/tailor-platform/sdk/commit/d5f365ff1153d34362b743d8d9019183f67b668a) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update dependency @inquirer/prompts to v8.4.0
+
+- [#950](https://github.com/tailor-platform/sdk/pull/950) [`0dc96f9`](https://github.com/tailor-platform/sdk/commit/0dc96f9e2fde7088cef29142ce7917694dee5fca) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update dependency oxc-parser to v0.124.0
+
 ## 1.35.1
 
 ### Patch Changes

package/dist/application-BB5TqXWY.mjs

@@ -0,0 +1,4 @@
+
+import { n as generatePluginFilesIfNeeded, r as loadApplication, t as defineApplication } from "./application-BwboBFcU.mjs";
+
+export { defineApplication };

package/dist/{application-BnJRroGX.mjs → application-BwboBFcU.mjs}

@@ -1,5 +1,5 @@
 
-import { l as initOAuth2Client } from "./client-CA2NM_4R.mjs";
+import { l as initOAuth2Client } from "./client-CN15WgW2.mjs";
 import { n as isSdkBranded } from "./brand-0SscafcY.mjs";
 import { n as logger, r as styles } from "./logger-qz-Y4sBV.mjs";
 import { t as readPackageJson } from "./package-json-CfUqjJaQ.mjs";
@@ -3201,7 +3201,8 @@ const SAMLSchema = z.object({
 	kind: z.literal("SAML"),
 	enableSignRequest: z.boolean().default(false).describe("Enable signing of SAML requests"),
 	metadataURL: z.string().optional().describe("URL to fetch SAML metadata (mutually exclusive with rawMetadata)"),
-	rawMetadata: z.string().optional().describe("Raw SAML metadata XML (mutually exclusive with metadataURL)")
+	rawMetadata: z.string().optional().describe("Raw SAML metadata XML (mutually exclusive with metadataURL)"),
+	defaultRedirectURL: z.string().optional().describe("URL to redirect to when SAML ACS receives a response with an empty RelayState.")
 }).refine((value) => {
 	return value.metadataURL !== void 0 !== (value.rawMetadata !== void 0);
 }, "Provide either metadataURL or rawMetadata");
@@ -4644,6 +4645,68 @@ const IdPEmailConfigSchema = z.object({
 	fromName: emailFieldSchema.optional().describe("Default sender display name for emails"),
 	passwordResetSubject: emailFieldSchema.optional().describe("Default subject for password reset emails")
 }).describe("Namespace-level email configuration defaults");
+const IdPPermissionOperandSchema = z.union([
+	z.string(),
+	z.boolean(),
+	z.array(z.string()).readonly(),
+	z.array(z.boolean()).readonly(),
+	z.object({ user: z.string() }),
+	z.object({ idpUser: z.enum([
+		"id",
+		"name",
+		"disabled"
+	]) }),
+	z.object({ oldIdpUser: z.enum([
+		"id",
+		"name",
+		"disabled"
+	]) }),
+	z.object({ newIdpUser: z.enum([
+		"id",
+		"name",
+		"disabled"
+	]) })
+]);
+const IdPPermissionOperatorSchema = z.enum([
+	"=",
+	"!=",
+	"in",
+	"not in"
+]);
+const IdPPermissionConditionSchema = z.tuple([
+	IdPPermissionOperandSchema,
+	IdPPermissionOperatorSchema,
+	IdPPermissionOperandSchema
+]).readonly();
+const IdPActionPermissionSchema = z.union([
+	z.object({
+		conditions: z.union([IdPPermissionConditionSchema, z.array(IdPPermissionConditionSchema).readonly()]),
+		description: z.string().optional(),
+		permit: z.boolean().optional()
+	}),
+	z.tuple([
+		IdPPermissionOperandSchema,
+		IdPPermissionOperatorSchema,
+		IdPPermissionOperandSchema
+	]).readonly(),
+	z.tuple([
+		IdPPermissionOperandSchema,
+		IdPPermissionOperatorSchema,
+		IdPPermissionOperandSchema,
+		z.boolean()
+	]).readonly(),
+	z.array(z.union([IdPPermissionConditionSchema, z.boolean()])).refine((arr) => {
+		const boolIndex = arr.findIndex((item) => typeof item === "boolean");
+		return boolIndex === -1 || boolIndex === arr.length - 1;
+	}, { message: "Boolean permit flag must only appear at the end" }).readonly()
+]);
+const IdPPermissionSchema = z.object({
+	create: z.array(IdPActionPermissionSchema).readonly(),
+	read: z.array(IdPActionPermissionSchema).readonly(),
+	update: z.array(IdPActionPermissionSchema).readonly(),
+	delete: z.array(IdPActionPermissionSchema).readonly(),
+	sendPasswordResetEmail: z.array(IdPActionPermissionSchema).readonly()
+}).describe("Per-operation permission policies for IdP users");
 const IdPSchema = z.object({
 	name: z.string().describe("IdP service name"),
 	authorization: z.union([
@@ -4656,14 +4719,18 @@ const IdPSchema = z.object({
 	userAuthPolicy: IdPUserAuthPolicySchema.transform((input) => IdPUserAuthPolicySchema.parse(input ?? {})).optional().describe("User authentication policy configuration"),
 	publishUserEvents: z.boolean().optional().describe("Enable publishing user lifecycle events"),
 	gqlOperations: IdPGqlOperationsSchema.optional().describe("Configure which GraphQL operations are enabled"),
-	emailConfig: IdPEmailConfigSchema.optional().describe("Namespace-level email configuration defaults")
+	emailConfig: IdPEmailConfigSchema.optional().describe("Namespace-level email configuration defaults"),
+	permission: IdPPermissionSchema.optional().describe("Per-operation permission policies for IdP users")
 }).brand("IdPConfig");
 
 //#endregion
 //#region src/parser/service/secrets/schema.ts
 const nameSchema = z.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/);
-const secretsVaultSchema = z.record(nameSchema, z.string());
-const SecretsSchema = z.record(nameSchema, secretsVaultSchema);
+const secretsVaultSchema = z.record(nameSchema, z.string().nullish());
+const SecretsSchema = z.object({
+	vaults: z.record(nameSchema, secretsVaultSchema),
+	options: z.object({ ignoreNullishValues: z.boolean() })
+});
 
 //#endregion
 //#region src/parser/service/staticwebsite/schema.ts
@@ -4789,27 +4856,43 @@ function defineStaticWebsites(websites) {
 	});
 	return staticWebsiteServices;
 }
-function defineSecretManager(config) {
-	if (!config) return [];
-	const data = Object.fromEntries(Object.entries(config));
-	const parsed = SecretsSchema.parse(data);
-	return Object.entries(parsed).map(([vaultName, vaultSecrets]) => ({
+function parseSecretManager(config) {
+	if (!config) return {
+		secrets: [],
+		ignoreNullishValues: false
+	};
+	const parsed = SecretsSchema.parse(config);
+	const { ignoreNullishValues } = parsed.options;
+	const secrets = Object.entries(parsed.vaults).map(([vaultName, vaultSecrets]) => ({
 		vaultName,
 		secrets: Object.entries(vaultSecrets).map(([name, value]) => ({
 			name,
 			value
 		}))
 	}));
+	if (!ignoreNullishValues) {
+		for (const vault of secrets) for (const secret of vault.secrets) if (secret.value == null) throw new Error(`Secret "${vault.vaultName}/${secret.name}" has no value. Use { ignoreNullishValues: true } option in defineSecretManager() to skip secrets without values.`);
+	}
+	return {
+		secrets,
+		ignoreNullishValues
+	};
 }
 function defineServices(config, pluginManager) {
 	const tailordbResult = defineTailorDB(config.db, pluginManager);
+	const resolverResult = defineResolver(config.resolver);
+	const idpResult = defineIdp(config.idp);
+	const authResult = defineAuth(config.auth, tailordbResult.tailorDBServices, tailordbResult.externalTailorDBNamespaces);
+	const staticWebsiteServices = defineStaticWebsites(config.staticWebsites);
+	const { secrets, ignoreNullishValues } = parseSecretManager(config.secrets);
 	return {
 		tailordbResult,
-		resolverResult: defineResolver(config.resolver),
-		idpResult: defineIdp(config.idp),
-		authResult: defineAuth(config.auth, tailordbResult.tailorDBServices, tailordbResult.externalTailorDBNamespaces),
-		staticWebsiteServices: defineStaticWebsites(config.staticWebsites),
-		secrets: defineSecretManager(config.secrets)
+		resolverResult,
+		idpResult,
+		authResult,
+		staticWebsiteServices,
+		secrets,
+		ignoreNullishValues
 	};
 }
 function buildApplication(params) {
@@ -4831,6 +4914,7 @@ function buildApplication(params) {
 		workflowService: params.workflowService,
 		staticWebsiteServices: params.staticWebsiteServices,
 		secrets: params.secrets,
+		ignoreNullishValues: params.ignoreNullishValues,
 		env: params.env,
 		get applications() {
 			return [application];
@@ -4893,7 +4977,7 @@ function generatePluginFilesIfNeeded(pluginManager, tailorDBServices, configPath
 */
 async function loadApplication(params) {
 	const { config, pluginManager, bundleCache } = params;
-	const { tailordbResult, resolverResult, idpResult, authResult, staticWebsiteServices, secrets } = defineServices(config, pluginManager);
+	const { tailordbResult, resolverResult, idpResult, authResult, staticWebsiteServices, secrets, ignoreNullishValues } = defineServices(config, pluginManager);
 	for (const tailordb of tailordbResult.tailorDBServices) {
 		await tailordb.loadTypes();
 		await tailordb.processNamespacePlugins();
@@ -4956,6 +5040,7 @@ async function loadApplication(params) {
 			workflowService,
 			staticWebsiteServices,
 			secrets,
+			ignoreNullishValues,
 			env: config.env ?? {}
 		}),
 		workflowBuildResult,
@@ -4965,4 +5050,4 @@ async function loadApplication(params) {
 
 //#endregion
 export { resolveTokens as C, readPlatformConfig as S, writePlatformConfig as T, hashFile as _, loadConfig as a, loadAccessToken as b, createExecutorService as c, TailorDBTypeSchema as d, stringifyFunction as f, getDistDir as g, createBundleCache as h, resolveInlineSourcemap as i, ExecutorSchema as l, loadFilesWithIgnores as m, generatePluginFilesIfNeeded as n, WorkflowJobSchema as o, tailorUserMap as p, loadApplication as r, ResolverSchema as s, defineApplication as t, OAuth2ClientSchema as u, deleteUserTokens as v, saveUserTokens as w, loadWorkspaceId as x, fetchLatestToken as y };
-//# sourceMappingURL=application-BnJRroGX.mjs.map
+//# sourceMappingURL=application-BwboBFcU.mjs.map