@tailor-platform/sdk 1.47.1 → 1.49.0

package/dist/{workflow.generated-i7PK4fg-.d.mts → workflow.generated-OYAu_6zX.d.mts}

@@ -1,5 +1,5 @@
 /// <reference types="@tailor-platform/function-types" />
-import { A as RelationType, Bt as InferredAttributeMap, D as DefinedDBFieldMetadata, Dt as ArrayFieldOutput, E as DBFieldMetadata, F as AuthConfig, Ft as FieldValidateInput, Ht as TailorUser, It as Validators, Jt as output, M as TailorDBServiceInput, Mt as FieldOutput, O as GqlOperationsConfig, Pt as TailorToTs, Wt as InferFieldsOutput, Y as TailorField, c as PluginConfigs, ht as BuiltinIdP, i as TailorDBType$1, j as SerialConfig, jt as FieldOptions, k as IndexDef, kt as EnumValue, qt as Prettify, r as TailorDBField$1, t as TailorAnyDBField$1 } from "./tailor-db-field-Bn8ZC5lK.mjs";
+import { A as RelationType, Bt as InferredAttributeMap, D as DefinedDBFieldMetadata, Dt as ArrayFieldOutput, E as DBFieldMetadata, F as AuthConfig, Ft as FieldValidateInput, Ht as TailorUser, It as Validators, Jt as output, M as TailorDBServiceInput, Mt as FieldOutput, O as GqlOperationsConfig, Pt as TailorToTs, Wt as InferFieldsOutput, Y as TailorField, c as PluginConfigs, ht as BuiltinIdP, i as TailorDBType$1, j as SerialConfig, jt as FieldOptions, k as IndexDef, kt as EnumValue, qt as Prettify, r as TailorDBField$1, t as TailorAnyDBField$1 } from "./tailor-db-field-4bMLe25-.mjs";
 import { NonEmptyObject } from "type-fest";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 
@@ -1164,6 +1164,16 @@ type WorkflowServiceInput = WorkflowServiceConfig;
 interface AppConfig<Auth extends AuthConfig = AuthConfig, Idp extends IdPConfig[] = IdPConfig[], StaticWebsites extends StaticWebsiteConfig[] = StaticWebsiteConfig[], Env extends Record<string, string | number | boolean> = Record<string, string | number | boolean>> {
   /** Application name (required). */
   name: string;
+  /**
+   * Stable identifier used to track the application across renames.
+   * Managed by the SDK: auto-generated and written into `tailor.config.ts`
+   * on first `deploy`. Delete this field if you want the SDK to assign a
+   * new id on the next `deploy` — typical case: `tailor.config.ts` was
+   * copied from another project and the new application should not share
+   * the original's id. Existing resources are re-tagged with the new id;
+   * data is preserved.
+   */
+  id?: string;
   /** Environment variables accessible via `context.env` in resolvers and via the second argument `{ env }` in workflow job bodies. */
   env?: Env;
   /** Allowed CORS origins. Must be an array of strings, e.g. `["https://example.com"]`. */
@@ -1207,4 +1217,4 @@ type ConcurrencyPolicy = {
 };
 //#endregion
 export { PermissionCondition as A, IdPInput as C, TailorDBInstance as D, TailorDBField as E, AllowedValues as F, AllowedValuesOutput as I, TailorTypePermission as M, unsafeAllowAllGqlPermission as N, TailorDBType as O, unsafeAllowAllTypePermission as P, IdPGqlOperationsInput as S, TailorAnyDBType as T, IdPExternalConfig as _, ExecutorServiceInput as a, IdPEmailConfig as b, ResolverServiceInput as c, StaticWebsiteConfig as d, StaticWebsiteDefinitionBrand as f, IdPConfig as g, SecretsDefinitionBrand as h, ExecutorServiceConfig as i, TailorTypeGqlPermission as j, db as k, WorkflowServiceConfig as l, SecretsConfig as m, RetryPolicy as n, ResolverExternalConfig as o, StaticWebsiteInput as p, AppConfig as r, ResolverServiceConfig as s, ConcurrencyPolicy as t, WorkflowServiceInput as u, IdPUserField as v, TailorAnyDBField as w, IdPGqlOperations as x, IdpDefinitionBrand as y };
-//# sourceMappingURL=workflow.generated-i7PK4fg-.d.mts.map
+//# sourceMappingURL=workflow.generated-OYAu_6zX.d.mts.map

package/docs/cli/application.md

@@ -136,6 +136,10 @@ See [Global Options](../cli-reference.md#global-options) for options available t
 
 <!-- politty:command:deploy:global-options-link:end -->
 
+**Config File Modification:**
+
+On first run, `deploy` automatically injects a stable `id: "<uuid>"` field into your `defineConfig({...})` call in `tailor.config.ts`. This UUID is used to track your application across renames so the SDK can recognize ownership across renames. Commit the generated id to version control. See [Configuration](../configuration.md#application-settings) for details.
+
 **Migration Handling:**
 
 When migrations are configured (`db.tailordb.migration` in config), the `deploy` command automatically:

package/docs/cli/workspace.md

@@ -71,15 +71,16 @@ tailor-sdk workspace create [options]
 
 **Options**
 
-| Option                                | Alias | Description                                           | Required | Default | Env                               |
-| ------------------------------------- | ----- | ----------------------------------------------------- | -------- | ------- | --------------------------------- |
-| `--name <NAME>`                       | `-n`  | Workspace name                                        | Yes      | -       | -                                 |
-| `--region <REGION>`                   | `-r`  | Workspace region (us-west, asia-northeast)            | Yes      | -       | -                                 |
-| `--delete-protection`                 | `-d`  | Enable delete protection                              | No       | `false` | -                                 |
-| `--organization-id <ORGANIZATION_ID>` | `-o`  | Organization ID to workspace associate with           | No       | -       | `TAILOR_PLATFORM_ORGANIZATION_ID` |
-| `--folder-id <FOLDER_ID>`             | `-f`  | Folder ID to workspace associate with                 | No       | -       | `TAILOR_PLATFORM_FOLDER_ID`       |
-| `--profile-name <PROFILE_NAME>`       | `-p`  | Profile name to create                                | No       | -       | -                                 |
-| `--profile-user <PROFILE_USER>`       | -     | User email for the profile (defaults to current user) | No       | -       | -                                 |
+| Option                                | Alias | Description                                                                                                 | Required | Default   | Env                               |
+| ------------------------------------- | ----- | ----------------------------------------------------------------------------------------------------------- | -------- | --------- | --------------------------------- |
+| `--name <NAME>`                       | `-n`  | Workspace name                                                                                              | Yes      | -         | -                                 |
+| `--region <REGION>`                   | `-r`  | Workspace region (us-west, asia-northeast)                                                                  | Yes      | -         | -                                 |
+| `--delete-protection`                 | `-d`  | Enable delete protection                                                                                    | No       | `false`   | -                                 |
+| `--organization-id <ORGANIZATION_ID>` | `-o`  | Organization ID to workspace associate with                                                                 | No       | -         | `TAILOR_PLATFORM_ORGANIZATION_ID` |
+| `--folder-id <FOLDER_ID>`             | `-f`  | Folder ID to workspace associate with                                                                       | No       | -         | `TAILOR_PLATFORM_FOLDER_ID`       |
+| `--profile-name <PROFILE_NAME>`       | `-p`  | Profile name to create                                                                                      | No       | -         | -                                 |
+| `--profile-user <PROFILE_USER>`       | -     | User email for the profile (defaults to current user)                                                       | No       | -         | -                                 |
+| `--permission <PERMISSION>`           | -     | Profile permission (requires --profile-name). 'read' blocks all write commands while the profile is active. | No       | `"write"` | -                                 |
 
 <!-- politty:command:workspace create:options:end -->
 
@@ -240,10 +241,11 @@ tailor-sdk profile create [options] <name>
 
 **Options**
 
-| Option                          | Alias | Description  | Required | Default |
-| ------------------------------- | ----- | ------------ | -------- | ------- |
-| `--user <USER>`                 | `-u`  | User email   | Yes      | -       |
-| `--workspace-id <WORKSPACE_ID>` | `-w`  | Workspace ID | Yes      | -       |
+| Option                          | Alias | Description                                                                       | Required | Default   |
+| ------------------------------- | ----- | --------------------------------------------------------------------------------- | -------- | --------- |
+| `--user <USER>`                 | `-u`  | User email                                                                        | Yes      | -         |
+| `--workspace-id <WORKSPACE_ID>` | `-w`  | Workspace ID                                                                      | Yes      | -         |
+| `--permission <PERMISSION>`     | -     | Profile permission. 'read' blocks all write commands while the profile is active. | No       | `"write"` |
 
 <!-- politty:command:profile create:options:end -->
 
@@ -318,10 +320,11 @@ tailor-sdk profile update [options] <name>
 
 **Options**
 
-| Option                          | Alias | Description      | Required | Default |
-| ------------------------------- | ----- | ---------------- | -------- | ------- |
-| `--user <USER>`                 | `-u`  | New user email   | No       | -       |
-| `--workspace-id <WORKSPACE_ID>` | `-w`  | New workspace ID | No       | -       |
+| Option                          | Alias | Description                                                                          | Required | Default |
+| ------------------------------- | ----- | ------------------------------------------------------------------------------------ | -------- | ------- |
+| `--user <USER>`                 | `-u`  | New user email                                                                       | No       | -       |
+| `--workspace-id <WORKSPACE_ID>` | `-w`  | New workspace ID                                                                     | No       | -       |
+| `--permission <PERMISSION>`     | -     | Profile permission. 'read' blocks all write commands; 'write' lifts the restriction. | No       | -       |
 
 <!-- politty:command:profile update:options:end -->
 

package/docs/configuration.md

@@ -19,6 +19,8 @@ For service-specific documentation, see:
 import { defineConfig } from "@tailor-platform/sdk";
 
 export default defineConfig({
+  // SDK-managed app id — do not edit, except when copying this config to a separate app.
+  // id: "<uuid>" — written here automatically on first run
   name: "my-app",
   cors: ["https://example.com"],
   allowedIpAddresses: ["192.168.1.0/24"],
@@ -28,6 +30,8 @@ export default defineConfig({
 
 **Name**: Set the application name.
 
+**Id (auto-managed)**: A stable identifier used to recognize resources managed by the SDK across renames. On first `deploy`, the SDK injects an `id: "<uuid>"` field into your `defineConfig({...})` call and commits it to `tailor.config.ts`. Keep it under version control; do not edit it by hand. Delete it only if you want the SDK to assign a new id on the next `deploy` — typically when `tailor.config.ts` was copied from another project and the new application should not share the original's id. Auto-injection requires `defineConfig({...})` to be called with an inline object literal: if the argument is a separate variable (e.g. `defineConfig(config)`), or if `tailor.config.ts` is a wrapper that re-exports `defineConfig` from another file, the SDK cannot inject — add the `id` field manually to the file that contains the actual `defineConfig({...})` object literal.
+
 **CORS**: Specify CORS settings as an array. You can also include Static Website URL references (e.g. `website.url`) in this array; see [Static Website](./services/staticwebsite.md).
 
 **Allowed IP Addresses**: Specify IP addresses allowed to access the application in CIDR format.

package/docs/generator/builtin.md

@@ -183,10 +183,41 @@ Generates seed data configuration files for database initialization.
 ["@tailor-platform/seed", { distPath: "./seed", machineUserName: "admin" }];
 ```
 
-| Option            | Type     | Description                                              |
-| ----------------- | -------- | -------------------------------------------------------- |
-| `distPath`        | `string` | Output directory path (required)                         |
-| `machineUserName` | `string` | Default machine user name (can be overridden at runtime) |
+| Option               | Type                                           | Description                                                                                                                                                       |
+| -------------------- | ---------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `distPath`           | `string`                                       | Output directory path (required)                                                                                                                                  |
+| `machineUserName`    | `string`                                       | Default machine user name (can be overridden at runtime)                                                                                                          |
+| `disableIdpUserSync` | `{ userToIdp?: boolean; idpToUser?: boolean }` | Skip emitting individual `_User <-> userProfile` foreign keys. Both directions are emitted by default. See [IdP user synchronization](#idp-user-synchronization). |
+
+### IdP user synchronization
+
+When `auth.userProfile` is configured, the seed plugin treats the userProfile
+type (e.g. `User`) and the IdP-managed `_User` table as a pair. By default it
+emits foreign keys in both directions so that `validate` rejects any row in
+either table that does not have a matching counterpart:
+
+| Direction   | Foreign key                                    | Catches                                        |
+| ----------- | ---------------------------------------------- | ---------------------------------------------- |
+| `idpToUser` | `_User.name` → `<userProfile>.<usernameField>` | Creating an IdP credential with no profile row |
+| `userToIdp` | `<userProfile>.<usernameField>` → `_User.name` | Creating a profile row with no IdP credential  |
+
+Neither direction is enforced by the runtime. In production it is normal for
+one side to exist without the other — for example a userProfile row exists
+the moment a user is invited, but the corresponding `_User` row appears only
+after the user finishes signing up. To seed such states, set the relevant
+direction in `disableIdpUserSync` to `true`:
+
+```typescript
+// Allow seeding invited-but-not-registered userProfile rows.
+// Still rejects _User rows without a matching userProfile row.
+["@tailor-platform/seed", { distPath: "./seed", disableIdpUserSync: { userToIdp: true } }];
+
+// Allow seeding _User rows whose userProfile does not exist yet.
+// Still rejects userProfile rows without a matching _User row.
+["@tailor-platform/seed", { distPath: "./seed", disableIdpUserSync: { idpToUser: true } }];
+```
+
+Omitted directions default to `false` (FK emitted).
 
 ### Output
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tailor-platform/sdk",
-  "version": "1.47.1",
+  "version": "1.49.0",
   "description": "Tailor Platform SDK - The SDK to work with Tailor Platform",
   "license": "MIT",
   "repository": {
@@ -21,6 +21,10 @@
     "skills"
   ],
   "type": "module",
+  "sideEffects": [
+    "./dist/cli/**/*.mjs",
+    "./dist/vitest/setup.mjs"
+  ],
   "main": "./dist/configure/index.mjs",
   "types": "./dist/configure/index.d.mts",
   "exports": {
@@ -91,8 +95,8 @@
     "@bufbuild/protobuf": "2.12.0",
     "@connectrpc/connect": "2.1.1",
     "@connectrpc/connect-node": "2.1.1",
-    "@inquirer/core": "11.1.9",
-    "@inquirer/prompts": "8.4.2",
+    "@inquirer/core": "11.1.10",
+    "@inquirer/prompts": "8.4.3",
     "@jridgewell/trace-mapping": "0.3.31",
     "@liam-hq/cli": "0.7.24",
     "@napi-rs/keyring": "1.3.0",
@@ -127,39 +131,34 @@
     "pgsql-ast-parser": "12.0.2",
     "pkg-types": "2.3.1",
     "politty": "0.4.15",
-    "rolldown": "1.0.0",
+    "rolldown": "1.0.1",
     "semver": "7.7.4",
     "serve": "14.2.6",
     "sql-highlight": "6.1.0",
     "std-env": "4.1.0",
     "table": "6.9.0",
     "ts-cron-validator": "1.1.5",
-    "tsx": "4.21.0",
+    "tsx": "4.21.1",
     "type-fest": "5.6.0",
     "undici": "6.25.0",
     "xdg-basedir": "5.1.0",
     "zod": "4.3.6"
   },
   "devDependencies": {
-    "@eslint/js": "10.0.1",
     "@opentelemetry/sdk-trace-base": "2.7.1",
     "@types/madge": "5.0.3",
     "@types/mime-types": "3.0.1",
-    "@types/node": "24.12.3",
+    "@types/node": "24.12.4",
     "@types/semver": "7.7.1",
-    "@typescript/native-preview": "7.0.0-dev.20260503.1",
-    "@vitest/coverage-v8": "4.1.5",
-    "eslint": "10.3.0",
-    "eslint-plugin-jsdoc": "62.9.0",
-    "eslint-plugin-oxlint": "1.61.0",
+    "@typescript/native-preview": "7.0.0-dev.20260516.1",
+    "@vitest/coverage-v8": "4.1.6",
     "oxfmt": "0.46.0",
     "oxlint": "1.61.0",
     "oxlint-tsgolint": "0.22.1",
     "sonda": "0.11.1",
     "tsdown": "0.22.0",
     "typescript": "5.9.3",
-    "typescript-eslint": "8.59.2",
-    "vitest": "4.1.5",
+    "vitest": "4.1.6",
     "zinfer": "0.1.8"
   },
   "peerDependencies": {
@@ -186,8 +185,9 @@
     "docs:check": "vitest run --project=unit src/cli/docs.test.ts",
     "docs:update": "POLITTY_DOCS_UPDATE=true vitest run --project=unit src/cli/docs.test.ts",
     "build": "tsdown",
-    "lint": "oxlint --type-aware . && eslint --cache .",
-    "lint:fix": "oxlint --type-aware . --fix && eslint --cache . --fix",
+    "lint": "oxlint --type-aware .",
+    "check:public-api-jsdoc": "tsx scripts/check-public-api-jsdoc.ts",
+    "lint:fix": "oxlint --type-aware . --fix",
     "typecheck": "tsc --noEmit",
     "typecheck:go": "tsgo",
     "perf:typecheck": "bash scripts/perf/exec.sh",

package/postinstall.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 import { existsSync } from "node:fs";
+import { register } from "node:module";
 import { dirname, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
-import { register } from "node:module";
 import { findUpSync } from "find-up-simple";
 
 const __dirname = import.meta.dirname;