@tailor-platform/sdk 1.62.0 → 1.65.0

package/dist/{tailordb-BlBGmQK-.d.mts → tailordb-C-ar4XCX.d.mts}

@@ -11,8 +11,8 @@ type InferFieldsOutput<F extends Record<string, {
   _output: any;
   [key: string]: any;
 }>> = DeepWritable<Prettify<NullableToOptional<{ [K in keyof F]: output<F[K]> }>>>;
-type JsonValue = string | number | boolean | null | JsonValue[] | {
-  [key: string]: JsonValue;
+type JsonValue$1 = string | number | boolean | null | JsonValue$1[] | {
+  [key: string]: JsonValue$1;
 };
 /**
  * A looser version of JsonValue that accepts interfaces.
@@ -859,5 +859,5 @@ interface TailorDBType {
   files?: TailorDBTypeMetadata["files"];
 }
 //#endregion
-export { InferredAttributeList as A, FieldOutput as C, Validators as D, FieldValidateInput as E, InferFieldsOutput as F, JsonCompatible as I, JsonValue as L, TailorInvoker as M, TailorUser as N, AttributeList as O, unauthenticatedTailorUser as P, Prettify as R, FieldOptions as S, TailorToTs as T, PluginAttachment as _, TypeSourceInfoEntry as a, EnumValue as b, TailorAnyDBType as c, TailorDBType$1 as d, DBFieldMetadata as f, TailorField as g, SerialConfig as h, TailorDBType as i, InferredAttributeMap as j, AttributeMap as k, TailorDBField as l, GqlOperationsConfig as m, RelationType as n, ValueOperand as o, DefinedDBFieldMetadata as p, TailorDBServiceInput as r, TailorAnyDBField as s, IndexDef as t, TailorDBInstance as u, ArrayFieldOutput as v, TailorFieldType as w, FieldMetadata as x, DefinedFieldMetadata as y, output as z };
-//# sourceMappingURL=tailordb-BlBGmQK-.d.mts.map
+export { InferredAttributeList as A, FieldOutput as C, Validators as D, FieldValidateInput as E, InferFieldsOutput as F, JsonCompatible as I, JsonValue$1 as L, TailorInvoker as M, TailorUser as N, AttributeList as O, unauthenticatedTailorUser as P, Prettify as R, FieldOptions as S, TailorToTs as T, PluginAttachment as _, TypeSourceInfoEntry as a, EnumValue as b, TailorAnyDBType as c, TailorDBType$1 as d, DBFieldMetadata as f, TailorField as g, SerialConfig as h, TailorDBType as i, InferredAttributeMap as j, AttributeMap as k, TailorDBField as l, GqlOperationsConfig as m, RelationType as n, ValueOperand as o, DefinedDBFieldMetadata as p, TailorDBServiceInput as r, TailorAnyDBField as s, IndexDef as t, TailorDBInstance as u, ArrayFieldOutput as v, TailorFieldType as w, FieldMetadata as x, DefinedFieldMetadata as y, output as z };
+//# sourceMappingURL=tailordb-C-ar4XCX.d.mts.map

package/dist/utils/test/index.d.mts

@@ -1,6 +1,6 @@
-import { M as TailorInvoker } from "../../tailordb-BlBGmQK-.mjs";
-import { W as TailorDBType } from "../../workflow.generated-Bf1tWylx.mjs";
-import { At as TailorField, Ct as WORKFLOW_TEST_ENV_KEY, n as output } from "../../index-CLxubakC.mjs";
+import { M as TailorInvoker } from "../../tailordb-C-ar4XCX.mjs";
+import { J as TailorDBType } from "../../workflow.generated-CCDsY0ce.mjs";
+import { At as TailorField, Ct as WORKFLOW_TEST_ENV_KEY, n as output } from "../../index-DcXIjt9F.mjs";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 
 //#region src/utils/test/mock.d.ts

package/dist/{workflow.generated-Bf1tWylx.d.mts → workflow.generated-CCDsY0ce.d.mts}

@@ -1,7 +1,7 @@
-import { C as FieldOutput$1, D as Validators, E as FieldValidateInput, F as InferFieldsOutput, N as TailorUser, R as Prettify, S as FieldOptions, T as TailorToTs, b as EnumValue, d as TailorDBType$1, f as DBFieldMetadata, g as TailorField, h as SerialConfig, j as InferredAttributeMap, l as TailorDBField$1, m as GqlOperationsConfig, n as RelationType, o as ValueOperand, p as DefinedDBFieldMetadata, r as TailorDBServiceInput, s as TailorAnyDBField$1, t as IndexDef, u as TailorDBInstance$1, v as ArrayFieldOutput, w as TailorFieldType, x as FieldMetadata, y as DefinedFieldMetadata, z as output } from "./tailordb-BlBGmQK-.mjs";
-import { B as IdProvider, G as SCIMAttribute, H as OAuth2ClientInput, J as SCIMConfig, L as AuthInvoker, R as BuiltinIdP, V as OAuth2Client, X as TenantProvider, r as PluginConfigs } from "./plugin-C_FyVSdl.mjs";
+import { C as FieldOutput$1, D as Validators, E as FieldValidateInput, F as InferFieldsOutput, N as TailorUser, R as Prettify, S as FieldOptions, T as TailorToTs, b as EnumValue, d as TailorDBType$1, f as DBFieldMetadata, g as TailorField, h as SerialConfig, j as InferredAttributeMap, l as TailorDBField$1, m as GqlOperationsConfig, n as RelationType, o as ValueOperand, p as DefinedDBFieldMetadata, r as TailorDBServiceInput, s as TailorAnyDBField$1, t as IndexDef, u as TailorDBInstance$1, v as ArrayFieldOutput, w as TailorFieldType, x as FieldMetadata, y as DefinedFieldMetadata, z as output } from "./tailordb-C-ar4XCX.mjs";
+import { B as IdProvider, G as SCIMAttribute, H as OAuth2ClientInput, J as SCIMConfig, L as AuthInvoker, R as BuiltinIdP, V as OAuth2Client, X as TenantProvider, r as PluginConfigs } from "./plugin-DylAsA4Z.mjs";
 import { n as TailorEnv } from "./env-B-g-qgE4.mjs";
-import { IsAny, JsonObject, NonEmptyObject } from "type-fest";
+import { IsAny, JsonObject, JsonValue, NonEmptyObject } from "type-fest";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 
 //#region src/configure/types/field.d.ts
@@ -700,8 +700,44 @@ type MachineUser<User extends TailorDBInstance$1, AttributeMap extends UserAttri
 } : {
   attributeList: AttributeListToTuple<User, AttributeList>;
 });
+/** Upstream OAuth provider that federated a login through the Built-in IdP. */
+type FederatedIdentityProvider = "google" | "microsoft";
+/**
+ * Profile claims forwarded from the upstream OAuth provider's ID token.
+ *
+ * Commonly present claims are typed; any other claim the provider issues is
+ * forwarded as-is and reachable through the index signature. Availability
+ * varies by provider (e.g. Microsoft does not issue `picture`).
+ */
+type FederatedIdentityClaims = {
+  name?: string;
+  given_name?: string;
+  family_name?: string;
+  picture?: string;
+  locale?: string;
+  [claim: string]: JsonValue | undefined;
+};
+/**
+ * The upstream identity that federated this login, populated when a user signs
+ * in through a Built-in IdP OAuth provider (Google or Microsoft).
+ *
+ * Available on {@link BeforeLoginClaims.federated_identity}; `undefined` for
+ * password logins.
+ */
+type FederatedIdentity = {
+  provider: FederatedIdentityProvider;
+  claims: FederatedIdentityClaims;
+};
+/**
+ * Token claims passed to the {@link BeforeLoginHook} handler. Carries the IdP's
+ * own claims (e.g. `sub`, `email`) plus, for federated logins, the upstream
+ * provider's profile under {@link BeforeLoginClaims.federated_identity}.
+ */
+type BeforeLoginClaims = JsonObject & {
+  /** Present only for federated (Google/Microsoft) logins; `undefined` for password logins. */federated_identity?: FederatedIdentity;
+};
 type BeforeLoginHookArgs = {
-  claims: JsonObject;
+  claims: BeforeLoginClaims;
   idpConfigName: string; /** Environment variables defined in `defineConfig({ env })`. */
   env: TailorEnv;
 };
@@ -1412,5 +1448,5 @@ type ConcurrencyPolicy = {
   /** Maximum number of concurrent executions (1-1000) */maxConcurrentExecutions: number;
 };
 //#endregion
-export { BeforeLoginHookArgs as A, TailorAnyDBField as B, IdPGqlOperationsInput as C, AuthExternalConfig as D, AuthConnectionTokenResult as E, UserAttributeListKey as F, db as G, TailorDBField as H, UserAttributeMap as I, TailorTypePermission as J, PermissionCondition as K, UsernameFieldKey as L, OAuth2ClientGrantType as M, SCIMAttributeType as N, AuthOwnConfig as O, UserAttributeKey as P, AllowedValuesOutput as Q, AuthConnectionConfig as R, IdPGqlOperations as S, AuthConfig as T, TailorDBInstance as U, TailorAnyDBType as V, TailorDBType as W, unsafeAllowAllTypePermission as X, unsafeAllowAllGqlPermission as Y, AllowedValues as Z, IdPConfig as _, ExecutorServiceConfig as a, IdpDefinitionBrand as b, ResolverServiceConfig as c, WorkflowServiceInput as d, StaticWebsiteConfig as f, SecretsDefinitionBrand as g, SecretsConfig as h, AppConfig as i, DefinedAuth as j, AuthServiceInput as k, ResolverServiceInput as l, StaticWebsiteInput as m, RetryPolicy as n, ExecutorServiceInput as o, StaticWebsiteDefinitionBrand as p, TailorTypeGqlPermission as q, HttpAdapterConfigInput as r, ResolverExternalConfig as s, ConcurrencyPolicy as t, WorkflowServiceConfig as u, IdPExternalConfig as v, IdPInput as w, IdPEmailConfig as x, IdPUserField as y, AuthConnectionOAuth2Config as z };
-//# sourceMappingURL=workflow.generated-Bf1tWylx.d.mts.map
+export { unsafeAllowAllGqlPermission as $, BeforeLoginClaims as A, UserAttributeMap as B, IdPGqlOperationsInput as C, AuthExternalConfig as D, AuthConnectionTokenResult as E, FederatedIdentityProvider as F, TailorAnyDBType as G, AuthConnectionConfig as H, OAuth2ClientGrantType as I, TailorDBType as J, TailorDBField as K, SCIMAttributeType as L, DefinedAuth as M, FederatedIdentity as N, AuthOwnConfig as O, FederatedIdentityClaims as P, TailorTypePermission as Q, UserAttributeKey as R, IdPGqlOperations as S, AuthConfig as T, AuthConnectionOAuth2Config as U, UsernameFieldKey as V, TailorAnyDBField as W, PermissionCondition as X, db as Y, TailorTypeGqlPermission as Z, IdPConfig as _, ExecutorServiceConfig as a, IdpDefinitionBrand as b, ResolverServiceConfig as c, WorkflowServiceInput as d, unsafeAllowAllTypePermission as et, StaticWebsiteConfig as f, SecretsDefinitionBrand as g, SecretsConfig as h, AppConfig as i, BeforeLoginHookArgs as j, AuthServiceInput as k, ResolverServiceInput as l, StaticWebsiteInput as m, RetryPolicy as n, AllowedValuesOutput as nt, ExecutorServiceInput as o, StaticWebsiteDefinitionBrand as p, TailorDBInstance as q, HttpAdapterConfigInput as r, ResolverExternalConfig as s, ConcurrencyPolicy as t, AllowedValues as tt, WorkflowServiceConfig as u, IdPExternalConfig as v, IdPInput as w, IdPEmailConfig as x, IdPUserField as y, UserAttributeListKey as z };
+//# sourceMappingURL=workflow.generated-CCDsY0ce.d.mts.map

package/docs/cli/auth.md

@@ -350,7 +350,7 @@ Get an access token for a machine user.
 **Usage**
 
 ```
-tailor-sdk machineuser token [options] <name>
+tailor-sdk machineuser token [options] [name]
 ```
 
 <!-- politty:command:machineuser token:usage:end -->
@@ -359,9 +359,9 @@ tailor-sdk machineuser token [options] <name>
 
 **Arguments**
 
-| Argument | Description       | Required |
-| -------- | ----------------- | -------- |
-| `name`   | Machine user name | Yes      |
+| Argument | Description                                                                 | Required |
+| -------- | --------------------------------------------------------------------------- | -------- |
+| `name`   | Machine user name. Falls back to the active profile's default machine user. | No       |
 
 <!-- politty:command:machineuser token:arguments:end -->
 

package/docs/cli/function.md

@@ -245,14 +245,14 @@ tailor-sdk function test-run [options] <file>
 
 **Options**
 
-| Option                          | Alias | Description                                                              | Required | Default              | Env                                 |
-| ------------------------------- | ----- | ------------------------------------------------------------------------ | -------- | -------------------- | ----------------------------------- |
-| `--workspace-id <WORKSPACE_ID>` | `-w`  | Workspace ID                                                             | No       | -                    | `TAILOR_PLATFORM_WORKSPACE_ID`      |
-| `--profile <PROFILE>`           | `-p`  | Workspace profile                                                        | No       | -                    | `TAILOR_PLATFORM_PROFILE`           |
-| `--name <NAME>`                 | `-n`  | Workflow job name to run (matches the `name` field of createWorkflowJob) | No       | -                    | -                                   |
-| `--arg <ARG>`                   | `-a`  | JSON argument to pass to the function                                    | No       | -                    | -                                   |
-| `--machine-user <MACHINE_USER>` | `-m`  | Machine user name for authentication                                     | No       | -                    | `TAILOR_PLATFORM_MACHINE_USER_NAME` |
-| `--config <CONFIG>`             | `-c`  | Path to SDK config file                                                  | No       | `"tailor.config.ts"` | -                                   |
+| Option                          | Alias | Description                                                                                    | Required | Default              | Env                                 |
+| ------------------------------- | ----- | ---------------------------------------------------------------------------------------------- | -------- | -------------------- | ----------------------------------- |
+| `--workspace-id <WORKSPACE_ID>` | `-w`  | Workspace ID                                                                                   | No       | -                    | `TAILOR_PLATFORM_WORKSPACE_ID`      |
+| `--profile <PROFILE>`           | `-p`  | Workspace profile                                                                              | No       | -                    | `TAILOR_PLATFORM_PROFILE`           |
+| `--name <NAME>`                 | `-n`  | Workflow job name to run (matches the `name` field of createWorkflowJob)                       | No       | -                    | -                                   |
+| `--arg <ARG>`                   | `-a`  | JSON argument to pass to the function                                                          | No       | -                    | -                                   |
+| `--machine-user <MACHINE_USER>` | `-m`  | Machine user name for authentication. Falls back to the active profile's default machine user. | No       | -                    | `TAILOR_PLATFORM_MACHINE_USER_NAME` |
+| `--config <CONFIG>`             | `-c`  | Path to SDK config file                                                                        | No       | `"tailor.config.ts"` | -                                   |
 
 <!-- politty:command:function test-run:options:end -->
 <!-- politty:command:function test-run:examples:start -->

package/docs/cli/query.md

@@ -33,7 +33,7 @@ tailor-sdk query [options]
 | `--query <QUERY>`               | `-q`  | Query string to execute directly; omit to start REPL mode                                            | No       | -                    | -                                   |
 | `--file <FILE>`                 | `-f`  | Read query string from file; omit to start REPL mode                                                 | No       | -                    | -                                   |
 | `--edit`                        | -     | Open a temporary file in your editor; omit to start REPL mode                                        | No       | `false`              | -                                   |
-| `--machine-user <MACHINE_USER>` | `-m`  | Machine user name for query execution                                                                | Yes      | -                    | `TAILOR_PLATFORM_MACHINE_USER_NAME` |
+| `--machine-user <MACHINE_USER>` | `-m`  | Machine user name for query execution. Falls back to the active profile's default machine user.      | No       | -                    | `TAILOR_PLATFORM_MACHINE_USER_NAME` |
 | `--newline-on-enter`            | -     | REPL: when true, Enter inserts a newline and Shift+Enter submits. Use --no-newline-on-enter to swap. | No       | -                    | -                                   |
 
 <!-- politty:command:query:options:end -->

package/docs/cli/setup.md

@@ -28,9 +28,9 @@ tailor-sdk setup [command]
 
 **Commands**
 
-| Command                         | Description                                             |
-| ------------------------------- | ------------------------------------------------------- |
-| [`setup github`](#setup-github) | Generate GitHub Actions workflow for deployment. (beta) |
+| Command                         | Description                                       |
+| ------------------------------- | ------------------------------------------------- |
+| [`setup github`](#setup-github) | Generate a GitHub Actions deploy workflow. (beta) |
 
 <!-- politty:command:setup:subcommands:end -->
 
@@ -47,7 +47,7 @@ See [Global Options](../cli-reference.md#global-options) for options available t
 
 <!-- politty:command:setup github:description:start -->
 
-Generate GitHub Actions workflow for deployment. (beta)
+Generate a GitHub Actions deploy workflow. (beta)
 
 <!-- politty:command:setup github:description:end -->
 
@@ -65,14 +65,16 @@ tailor-sdk setup github [options]
 
 **Options**
 
-| Option                                  | Alias | Description                         | Required | Default |
-| --------------------------------------- | ----- | ----------------------------------- | -------- | ------- |
-| `--workspace-name <WORKSPACE_NAME>`     | `-n`  | Workspace name                      | Yes      | -       |
-| `--workspace-region <WORKSPACE_REGION>` | `-r`  | Workspace region                    | Yes      | -       |
-| `--organization-id <ORGANIZATION_ID>`   | `-o`  | Organization ID                     | Yes      | -       |
-| `--folder-id <FOLDER_ID>`               | `-f`  | Folder ID                           | Yes      | -       |
-| `--dir <DIR>`                           | `-d`  | App directory (for monorepo setups) | No       | `"."`   |
-| `--with-plan`                           | `-p`  | Include plan job for PR previews    | No       | `false` |
+| Option                              | Alias | Description                                                                                                                                       | Required | Default |
+| ----------------------------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------- |
+| `--workspace-name <WORKSPACE_NAME>` | `-n`  | Workspace name (defaults to the config 'name')                                                                                                    | No       | -       |
+| `--branch <BRANCH>`                 | -     | Branch target: deploy trigger branch (defaults to the detected default branch). Tag target: tag-reachability guard branch (no guard when omitted) | No       | -       |
+| `--tag`                             | -     | Generate a tag target (deploy on tag push)                                                                                                        | No       | `false` |
+| `--tag-pattern <TAG_PATTERN>`       | -     | Tag glob to match (requires --tag; defaults to v\*)                                                                                               | No       | -       |
+| `--environment <ENVIRONMENT>`       | -     | GitHub Environment for the plan/deploy jobs (defaults to the workspace name)                                                                      | No       | -       |
+| `--no-plan`                         | -     | Disable the plan job for a branch target (cannot be combined with --tag)                                                                          | No       | `false` |
+| `--dir <DIR>`                       | `-d`  | App directory (for monorepo setups)                                                                                                               | No       | `"."`   |
+| `--force`                           | -     | Discard hand edits / take over unmanaged files and regenerate                                                                                     | No       | `false` |
 
 <!-- politty:command:setup github:options:end -->
 
@@ -81,3 +83,7 @@ tailor-sdk setup github [options]
 See [Global Options](../cli-reference.md#global-options) for options available to all commands.
 
 <!-- politty:command:setup github:global-options-link:end -->
+
+## Further reading
+
+- [GitHub Actions Integration](../github-actions.md) — usage guide: targets, generated files, secrets, approval gates, and rollback.

package/docs/cli/workflow.md

@@ -167,16 +167,16 @@ tailor-sdk workflow start [options] <name>
 
 **Options**
 
-| Option                          | Alias | Description                                                    | Required | Default              | Env                                 |
-| ------------------------------- | ----- | -------------------------------------------------------------- | -------- | -------------------- | ----------------------------------- |
-| `--workspace-id <WORKSPACE_ID>` | `-w`  | Workspace ID                                                   | No       | -                    | `TAILOR_PLATFORM_WORKSPACE_ID`      |
-| `--profile <PROFILE>`           | `-p`  | Workspace profile                                              | No       | -                    | `TAILOR_PLATFORM_PROFILE`           |
-| `--config <CONFIG>`             | `-c`  | Path to SDK config file                                        | No       | `"tailor.config.ts"` | `TAILOR_PLATFORM_SDK_CONFIG_PATH`   |
-| `--machine-user <MACHINE_USER>` | `-m`  | Machine user name                                              | Yes      | -                    | `TAILOR_PLATFORM_MACHINE_USER_NAME` |
-| `--arg <ARG>`                   | `-a`  | Workflow argument (JSON string)                                | No       | -                    | -                                   |
-| `--wait`                        | `-W`  | Wait for execution to complete                                 | No       | `false`              | -                                   |
-| `--interval <INTERVAL>`         | `-i`  | Polling interval when using --wait (e.g., '3s', '500ms', '1m') | No       | `"3s"`               | -                                   |
-| `--logs`                        | `-l`  | Display job execution logs after completion (requires --wait)  | No       | `false`              | -                                   |
+| Option                          | Alias | Description                                                                 | Required | Default              | Env                                 |
+| ------------------------------- | ----- | --------------------------------------------------------------------------- | -------- | -------------------- | ----------------------------------- |
+| `--workspace-id <WORKSPACE_ID>` | `-w`  | Workspace ID                                                                | No       | -                    | `TAILOR_PLATFORM_WORKSPACE_ID`      |
+| `--profile <PROFILE>`           | `-p`  | Workspace profile                                                           | No       | -                    | `TAILOR_PLATFORM_PROFILE`           |
+| `--config <CONFIG>`             | `-c`  | Path to SDK config file                                                     | No       | `"tailor.config.ts"` | `TAILOR_PLATFORM_SDK_CONFIG_PATH`   |
+| `--machine-user <MACHINE_USER>` | `-m`  | Machine user name. Falls back to the active profile's default machine user. | No       | -                    | `TAILOR_PLATFORM_MACHINE_USER_NAME` |
+| `--arg <ARG>`                   | `-a`  | Workflow argument (JSON string)                                             | No       | -                    | -                                   |
+| `--wait`                        | `-W`  | Wait for execution to complete                                              | No       | `false`              | -                                   |
+| `--interval <INTERVAL>`         | `-i`  | Polling interval when using --wait (e.g., '3s', '500ms', '1m')              | No       | `"3s"`               | -                                   |
+| `--logs`                        | `-l`  | Display job execution logs after completion (requires --wait)               | No       | `false`              | -                                   |
 
 <!-- politty:command:workflow start:options:end -->
 

package/docs/cli/workspace.md

@@ -241,11 +241,13 @@ tailor-sdk profile create [options] <name>
 
 **Options**
 
-| Option                          | Alias | Description                                                                       | Required | Default   |
-| ------------------------------- | ----- | --------------------------------------------------------------------------------- | -------- | --------- |
-| `--user <USER>`                 | `-u`  | User email                                                                        | Yes      | -         |
-| `--workspace-id <WORKSPACE_ID>` | `-w`  | Workspace ID                                                                      | Yes      | -         |
-| `--permission <PERMISSION>`     | -     | Profile permission. 'read' blocks all write commands while the profile is active. | No       | `"write"` |
+| Option                                            | Alias | Description                                                                                                                            | Required | Default   |
+| ------------------------------------------------- | ----- | -------------------------------------------------------------------------------------------------------------------------------------- | -------- | --------- |
+| `--user <USER>`                                   | `-u`  | User email                                                                                                                             | Yes      | -         |
+| `--workspace-id <WORKSPACE_ID>`                   | `-w`  | Workspace ID                                                                                                                           | Yes      | -         |
+| `--permission <PERMISSION>`                       | -     | Profile permission. 'read' blocks all write commands while the profile is active.                                                      | No       | `"write"` |
+| `--machine-user <MACHINE_USER>`                   | `-m`  | Default machine user name for application-data commands (query, workflow start, function test-run, machineuser token).                 | No       | -         |
+| `--machine-user-override <MACHINE_USER_OVERRIDE>` | -     | Whether the command line or TAILOR_PLATFORM_MACHINE_USER_NAME may override the profile's machine user. 'deny' requires --machine-user. | No       | -         |
 
 <!-- politty:command:profile create:options:end -->
 
@@ -320,11 +322,13 @@ tailor-sdk profile update [options] <name>
 
 **Options**
 
-| Option                          | Alias | Description                                                                          | Required | Default |
-| ------------------------------- | ----- | ------------------------------------------------------------------------------------ | -------- | ------- |
-| `--user <USER>`                 | `-u`  | New user email                                                                       | No       | -       |
-| `--workspace-id <WORKSPACE_ID>` | `-w`  | New workspace ID                                                                     | No       | -       |
-| `--permission <PERMISSION>`     | -     | Profile permission. 'read' blocks all write commands; 'write' lifts the restriction. | No       | -       |
+| Option                                            | Alias | Description                                                                                                                                                           | Required | Default |
+| ------------------------------------------------- | ----- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------- |
+| `--user <USER>`                                   | `-u`  | New user email                                                                                                                                                        | No       | -       |
+| `--workspace-id <WORKSPACE_ID>`                   | `-w`  | New workspace ID                                                                                                                                                      | No       | -       |
+| `--permission <PERMISSION>`                       | -     | Profile permission. 'read' blocks all write commands; 'write' lifts the restriction.                                                                                  | No       | -       |
+| `--machine-user <MACHINE_USER>`                   | `-m`  | Default machine user name for application-data commands (query, workflow start, function test-run, machineuser token). Pass an empty string to clear.                 | No       | -       |
+| `--machine-user-override <MACHINE_USER_OVERRIDE>` | -     | Whether the command line or TAILOR_PLATFORM_MACHINE_USER_NAME may override the profile's machine user. 'deny' requires --machine-user; 'allow' lifts the restriction. | No       | -       |
 
 <!-- politty:command:profile update:options:end -->
 

package/docs/cli-reference.md

@@ -77,7 +77,7 @@ You can use environment variables to configure workspace and authentication:
 | `TAILOR_PLATFORM_SDK_DTS_PATH`               | Output path for generated `tailor.d.ts` type definition file                                      |
 | `TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID`     | Client ID for `login --machine-user`                                                              |
 | `TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET` | Client secret for `login --machine-user`                                                          |
-| `TAILOR_PLATFORM_MACHINE_USER_NAME`          | Default machine user name for `query`, `workflow start`, `function test-run`                      |
+| `TAILOR_PLATFORM_MACHINE_USER_NAME`          | Default machine user name for `query`, `workflow start`, `function test-run`, `machineuser token` |
 | `TAILOR_BUNDLE_CONCURRENCY`                  | Max concurrent bundle workers for `deploy` (resolvers/executors/workflows). Defaults to CPU count |
 | `VISUAL` / `EDITOR`                          | Preferred editor for commands that open files (e.g., `vim`, `code`, `nano`)                       |
 | `TAILOR_CRASH_REPORTS_LOCAL`                 | Local crash log writing: `on` (default) or `off`                                                  |
@@ -287,9 +287,9 @@ Commands for managing crash reports.
 
 Commands for setting up project infrastructure.
 
-| Command                                     | Description                                             |
-| ------------------------------------------- | ------------------------------------------------------- |
-| [setup github](./cli/setup.md#setup-github) | Generate GitHub Actions workflow for deployment. (beta) |
+| Command                                     | Description                                       |
+| ------------------------------------------- | ------------------------------------------------- |
+| [setup github](./cli/setup.md#setup-github) | Generate a GitHub Actions deploy workflow. (beta) |
 
 ### [Upgrade Commands](./cli/upgrade.md)