@tailor-platform/sdk 1.70.0 → 1.71.0

package/dist/types-v_ErzNUF.d.mts

@@ -0,0 +1,345 @@
+import { o as TailorEnv } from "./types-DTcZ2Yax.mjs";
+import { C as FieldMetadata, D as TailorField, F as output, O as TailorFieldType, m as TailorDBInstance, x as DefinedFieldMetadata } from "./types-rj8YJcEe.mjs";
+import { IsAny, JsonObject, JsonValue } from "type-fest";
+
+//#region src/types/auth-connection.generated.d.ts
+type AuthConnectionOAuth2Config = {
+  /** OAuth2 provider URL */providerUrl: string; /** OAuth2 issuer URL */
+  issuerUrl: string; /** OAuth2 client ID */
+  clientId: string; /** OAuth2 client secret */
+  clientSecret: string; /** OAuth2 authorization endpoint override */
+  authUrl?: string | undefined; /** OAuth2 token endpoint override */
+  tokenUrl?: string | undefined;
+};
+type AuthConnectionConfig = {
+  type: "oauth2";
+  providerUrl: string;
+  issuerUrl: string;
+  clientId: string;
+  clientSecret: string;
+  authUrl?: string | undefined;
+  tokenUrl?: string | undefined;
+};
+//#endregion
+//#region src/types/auth.generated.d.ts
+type AuthInvokerObject = {
+  /** Auth namespace */namespace: string; /** Machine user name for authentication */
+  machineUserName: string;
+};
+type AuthInvoker = AuthInvokerObject;
+type OIDC = {
+  /** Identity provider name */name: string;
+  kind: "OIDC"; /** OAuth2 client ID */
+  clientID: string; /** OAuth2 client secret */
+  clientSecret: {
+    vaultName: string;
+    secretKey: string;
+  }; /** OIDC provider URL */
+  providerURL: string; /** OIDC issuer URL (defaults to providerURL) */
+  issuerURL?: string | undefined; /** JWT claim to use as username */
+  usernameClaim?: string | undefined;
+};
+type SAML = {
+  /** Identity provider name */name: string;
+  kind: "SAML"; /** Enable signing of SAML requests */
+  enableSignRequest: boolean; /** URL to fetch SAML metadata (mutually exclusive with rawMetadata) */
+  metadataURL?: string | undefined; /** Raw SAML metadata XML (mutually exclusive with metadataURL) */
+  rawMetadata?: string | undefined; /** URL to redirect to when SAML ACS receives a response with an empty RelayState. */
+  defaultRedirectURL?: string | undefined;
+};
+type IDToken = {
+  /** Identity provider name */name: string;
+  kind: "IDToken"; /** ID token provider URL */
+  providerURL: string; /** Client ID for ID token validation */
+  clientID: string; /** ID token issuer URL */
+  issuerURL?: string | undefined; /** JWT claim to use as username */
+  usernameClaim?: string | undefined;
+};
+type BuiltinIdP = {
+  /** Identity provider name */name: string;
+  kind: "BuiltInIdP"; /** IdP namespace */
+  namespace: string; /** OAuth2 client name in the IdP */
+  clientName: string;
+};
+type IdProvider = OIDC | SAML | IDToken | BuiltinIdP;
+type OAuth2ClientInput = {
+  /** Allowed redirect URIs */redirectURIs: (`https://${string}` | `http://${string}` | `${string}:url` | `${string}:url/${string}`)[]; /** Client description */
+  description?: string | undefined; /** Allowed OAuth2 grant types */
+  grantTypes?: ("authorization_code" | "refresh_token")[] | undefined; /** OAuth2 client type */
+  clientType?: "confidential" | "public" | "browser" | undefined; /** Access token lifetime in seconds (60-86400) */
+  accessTokenLifetimeSeconds?: number | undefined; /** Refresh token lifetime in seconds (60-604800) */
+  refreshTokenLifetimeSeconds?: number | undefined; /** Require DPoP (Demonstrating Proof-of-Possession) for token requests */
+  requireDpop?: boolean | undefined;
+};
+type OAuth2Client = {
+  /** Allowed OAuth2 grant types */grantTypes: ("authorization_code" | "refresh_token")[]; /** Allowed redirect URIs */
+  redirectURIs: (`https://${string}` | `http://${string}` | `${string}:url` | `${string}:url/${string}`)[]; /** Access token lifetime in seconds (60-86400) */
+  accessTokenLifetimeSeconds: {
+    seconds: bigint;
+    nanos: number;
+  } | undefined; /** Refresh token lifetime in seconds (60-604800) */
+  refreshTokenLifetimeSeconds: {
+    seconds: bigint;
+    nanos: number;
+  } | undefined; /** Client description */
+  description?: string | undefined; /** OAuth2 client type */
+  clientType?: "confidential" | "public" | "browser" | undefined; /** Require DPoP (Demonstrating Proof-of-Possession) for token requests */
+  requireDpop?: boolean | undefined;
+};
+type SCIMAuthorization = {
+  /** SCIM authorization type */type: "oauth2" | "bearer"; /** Bearer token secret (required for bearer type) */
+  bearerSecret?: {
+    vaultName: string;
+    secretKey: string;
+  } | undefined;
+};
+type SCIMAttribute = {
+  /** Attribute data type */type: "string" | "number" | "boolean" | "datetime" | "complex"; /** Attribute name */
+  name: string; /** Attribute description */
+  description?: string | undefined; /** Attribute mutability */
+  mutability?: "readOnly" | "readWrite" | "writeOnly" | undefined; /** Whether the attribute is required */
+  required?: boolean | undefined; /** Whether the attribute can have multiple values */
+  multiValued?: boolean | undefined; /** Uniqueness constraint */
+  uniqueness?: "none" | "server" | "global" | undefined; /** List of canonical values */
+  canonicalValues?: string[] | null | undefined;
+  subAttributes?: SCIMAttribute[] | null | undefined;
+};
+type SCIMAttributeMapping = {
+  /** TailorDB field name to map to */tailorDBField: string; /** SCIM attribute path */
+  scimPath: string;
+};
+type SCIMResource = {
+  /** SCIM resource name */name: string; /** TailorDB namespace for the resource */
+  tailorDBNamespace: string; /** TailorDB type name for the resource */
+  tailorDBType: string; /** Core SCIM schema definition */
+  coreSchema: {
+    /** SCIM resource name */name: string;
+    attributes: {
+      type: "string" | "number" | "boolean" | "datetime" | "complex"; /** SCIM resource name */
+      name: string;
+      description?: string | undefined;
+      mutability?: "readOnly" | "readWrite" | "writeOnly" | undefined;
+      required?: boolean | undefined;
+      multiValued?: boolean | undefined;
+      uniqueness?: "none" | "server" | "global" | undefined;
+      canonicalValues?: string[] | null | undefined;
+      subAttributes?: any[] | null | undefined;
+    }[];
+  }; /** Attribute mapping configuration */
+  attributeMapping: {
+    tailorDBField: string;
+    scimPath: string;
+  }[];
+};
+type SCIMConfig = {
+  /** Machine user name for SCIM operations */machineUserName: string; /** SCIM authorization configuration */
+  authorization: {
+    type: "oauth2" | "bearer";
+    bearerSecret?: {
+      vaultName: string;
+      secretKey: string;
+    } | undefined;
+  }; /** SCIM resource definitions */
+  resources: {
+    name: string;
+    tailorDBNamespace: string;
+    tailorDBType: string;
+    coreSchema: {
+      name: string;
+      attributes: {
+        type: "string" | "number" | "boolean" | "datetime" | "complex";
+        name: string;
+        description?: string | undefined;
+        mutability?: "readOnly" | "readWrite" | "writeOnly" | undefined;
+        required?: boolean | undefined;
+        multiValued?: boolean | undefined;
+        uniqueness?: "none" | "server" | "global" | undefined;
+        canonicalValues?: string[] | null | undefined;
+        subAttributes?: any[] | null | undefined;
+      }[];
+    };
+    attributeMapping: {
+      tailorDBField: string;
+      scimPath: string;
+    }[];
+  }[];
+};
+type TenantProvider = {
+  /** TailorDB namespace for the tenant type */namespace: string; /** TailorDB type name for tenants */
+  type: string; /** Field used as the tenant signature */
+  signatureField: string;
+};
+//#endregion
+//#region src/configure/services/auth/types.d.ts
+type OAuth2ClientGrantType = OAuth2Client["grantTypes"][number];
+type SCIMAttributeType = SCIMAttribute["type"];
+type AuthInvokerWithName<M extends string> = Omit<AuthInvoker, "machineUserName"> & {
+  machineUserName: M;
+};
+/** Result of retrieving a connection token at runtime. */
+type AuthConnectionTokenResult = {
+  access_token: string;
+};
+type ValueOperand = string | boolean | string[] | boolean[];
+type AuthAttributeValue = ValueOperand | null | undefined;
+type UserFieldKeys<User extends TailorDBInstance> = keyof output<User> & string;
+type FieldDefined<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = User["fields"][Key] extends {
+  _defined: infer Defined;
+} ? Defined : never;
+type FieldOutput<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = output<User>[Key];
+type FieldIsRequired<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = undefined extends FieldOutput<User, Key> ? false : true;
+type FieldIsOfType<User extends TailorDBInstance, Key extends UserFieldKeys<User>, Type extends string> = FieldDefined<User, Key> extends {
+  type: Type;
+} ? true : false;
+type FieldIsArray<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = FieldDefined<User, Key> extends {
+  array: true;
+} ? true : false;
+type FieldIsUnique<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = FieldDefined<User, Key> extends {
+  unique: true;
+} ? true : false;
+type FieldSupportsValueOperand<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = FieldOutput<User, Key> extends ValueOperand | null | undefined ? true : false;
+type UsernameFieldKey<User extends TailorDBInstance> = IsAny<User> extends true ? string : { [K in UserFieldKeys<User>]: FieldIsRequired<User, K> extends true ? FieldIsOfType<User, K, "string"> extends true ? FieldIsArray<User, K> extends true ? never : FieldIsUnique<User, K> extends true ? K : never : never : never }[UserFieldKeys<User>];
+type UserAttributeKey<User extends TailorDBInstance> = { [K in UserFieldKeys<User>]: K extends "id" ? never : FieldSupportsValueOperand<User, K> extends true ? FieldIsOfType<User, K, "datetime" | "date" | "time"> extends true ? never : K : never }[UserFieldKeys<User>];
+type UserAttributeListKey<User extends TailorDBInstance> = { [K in UserFieldKeys<User>]: K extends "id" ? never : FieldIsOfType<User, K, "uuid"> extends true ? FieldIsArray<User, K> extends true ? never : K : never }[UserFieldKeys<User>];
+type UserAttributeMap<User extends TailorDBInstance> = { [K in UserAttributeKey<User>]?: true };
+type DisallowExtraKeys<T, Allowed extends PropertyKey> = T & { [K in Exclude<keyof T, Allowed>]: never };
+type AttributeListValue<User extends TailorDBInstance, Key extends UserAttributeListKey<User>> = Key extends keyof output<User> ? output<User>[Key] : never;
+type AttributeListToTuple<User extends TailorDBInstance, AttributeList extends readonly UserAttributeListKey<User>[]> = { [Index in keyof AttributeList]: AttributeList[Index] extends UserAttributeListKey<User> ? AttributeListValue<User, AttributeList[Index]> : never };
+type AttributeMapSelectedKeys<User extends TailorDBInstance, AttributeMap extends UserAttributeMap<User>> = Extract<{ [K in keyof AttributeMap]-?: undefined extends AttributeMap[K] ? never : K }[keyof AttributeMap], UserAttributeKey<User>>;
+type UserProfile<User extends TailorDBInstance, AttributeMap extends UserAttributeMap<User>, AttributeList extends UserAttributeListKey<User>[]> = {
+  /**
+   * TailorDB namespace where the user type is defined.
+   *
+   * Usually auto-resolved, so you don't need to specify this.
+   * Required only when multiple TailorDBs exist and the type is in an external TailorDB.
+   */
+  namespace?: string;
+  type: User;
+  usernameField: UsernameFieldKey<User>;
+  attributes?: DisallowExtraKeys<AttributeMap, UserAttributeKey<User>>;
+  attributeList?: AttributeList;
+};
+type MachineUserAttributeFields = Record<string, TailorField<DefinedFieldMetadata, unknown, FieldMetadata, TailorFieldType>>;
+type TailorFieldOutputValue<Field> = Field extends TailorField<DefinedFieldMetadata, infer Output, FieldMetadata, TailorFieldType> ? Output : never;
+type MachineUserAttributeValues<Fields extends MachineUserAttributeFields> = { [K in keyof Fields]: TailorFieldOutputValue<Fields[K]> extends ValueOperand | null | undefined ? TailorFieldOutputValue<Fields[K]> : never };
+type MachineUserFromAttributes<Fields extends MachineUserAttributeFields> = (keyof Fields extends never ? {
+  attributes?: never;
+} : {
+  attributes: DisallowExtraKeys<MachineUserAttributeValues<Fields>, keyof Fields>;
+}) & {
+  attributeList?: string[];
+};
+type MachineUser<User extends TailorDBInstance, AttributeMap extends UserAttributeMap<User> = UserAttributeMap<User>, AttributeList extends UserAttributeListKey<User>[] = [], MachineUserAttributes extends MachineUserAttributeFields | undefined = undefined> = IsAny<MachineUserAttributes> extends true ? IsAny<User> extends true ? {
+  attributes: Record<string, AuthAttributeValue>;
+  attributeList?: string[];
+} : (AttributeMapSelectedKeys<User, AttributeMap> extends never ? {
+  attributes?: never;
+} : {
+  attributes: { [K in AttributeMapSelectedKeys<User, AttributeMap>]: K extends keyof output<User> ? output<User>[K] : never } & { [K in Exclude<keyof output<User>, AttributeMapSelectedKeys<User, AttributeMap>>]?: never };
+}) & ([] extends AttributeList ? {
+  attributeList?: never;
+} : {
+  attributeList: AttributeListToTuple<User, AttributeList>;
+}) : [MachineUserAttributes] extends [MachineUserAttributeFields] ? MachineUserFromAttributes<MachineUserAttributes> : IsAny<User> extends true ? {
+  attributes: Record<string, AuthAttributeValue>;
+  attributeList?: string[];
+} : (AttributeMapSelectedKeys<User, AttributeMap> extends never ? {
+  attributes?: never;
+} : {
+  attributes: { [K in AttributeMapSelectedKeys<User, AttributeMap>]: K extends keyof output<User> ? output<User>[K] : never } & { [K in Exclude<keyof output<User>, AttributeMapSelectedKeys<User, AttributeMap>>]?: never };
+}) & ([] extends AttributeList ? {
+  attributeList?: never;
+} : {
+  attributeList: AttributeListToTuple<User, AttributeList>;
+});
+/** Upstream OAuth provider that federated a login through the Built-in IdP. */
+type FederatedIdentityProvider = "google" | "microsoft";
+/**
+ * Profile claims forwarded from the upstream OAuth provider's ID token.
+ *
+ * Commonly present claims are typed; any other claim the provider issues is
+ * forwarded as-is and reachable through the index signature. Availability
+ * varies by provider (e.g. Microsoft does not issue `picture`).
+ */
+type FederatedIdentityClaims = {
+  name?: string;
+  given_name?: string;
+  family_name?: string;
+  picture?: string;
+  locale?: string;
+  [claim: string]: JsonValue | undefined;
+};
+/**
+ * The upstream identity that federated this login, populated when a user signs
+ * in through a Built-in IdP OAuth provider (Google or Microsoft).
+ *
+ * Available on {@link BeforeLoginClaims.federated_identity}; `undefined` for
+ * password logins.
+ */
+type FederatedIdentity = {
+  provider: FederatedIdentityProvider;
+  claims: FederatedIdentityClaims;
+};
+/**
+ * Token claims passed to the {@link BeforeLoginHook} handler. Carries the IdP's
+ * own claims (e.g. `sub`, `email`) plus, for federated logins, the upstream
+ * provider's profile under {@link BeforeLoginClaims.federated_identity}.
+ */
+type BeforeLoginClaims = JsonObject & {
+  /** Present only for federated (Google/Microsoft) logins; `undefined` for password logins. */federated_identity?: FederatedIdentity;
+};
+type BeforeLoginHookArgs = {
+  claims: BeforeLoginClaims;
+  idpConfigName: string; /** Environment variables defined in `defineConfig({ env })`. */
+  env: TailorEnv;
+};
+type BeforeLoginHook<MachineUserNames extends string> = {
+  handler(args: BeforeLoginHookArgs): Promise<void>;
+  invoker: NoInfer<MachineUserNames>;
+};
+type AuthHooks<MachineUserNames extends string> = {
+  beforeLogin?: BeforeLoginHook<MachineUserNames>;
+};
+type AuthServiceInput<User extends TailorDBInstance, AttributeMap extends UserAttributeMap<User>, AttributeList extends UserAttributeListKey<User>[], MachineUserNames extends string, MachineUserAttributes extends MachineUserAttributeFields | undefined = MachineUserAttributeFields | undefined, ConnectionNames extends string = string> = {
+  hooks?: AuthHooks<MachineUserNames>;
+  userProfile?: UserProfile<User, AttributeMap, AttributeList>;
+  machineUserAttributes?: MachineUserAttributes;
+  machineUsers?: Record<MachineUserNames, MachineUser<User, AttributeMap, AttributeList, MachineUserAttributes>>;
+  oauth2Clients?: Record<string, OAuth2ClientInput>;
+  idProvider?: IdProvider;
+  scim?: SCIMConfig;
+  tenantProvider?: TenantProvider;
+  connections?: Record<ConnectionNames, AuthConnectionConfig>;
+  publishSessionEvents?: boolean;
+};
+declare const authDefinitionBrand: unique symbol;
+type AuthDefinitionBrand = {
+  readonly [authDefinitionBrand]: true;
+};
+type ConnectionNames<Config> = Config extends {
+  connections?: Record<infer K, unknown>;
+} ? K & string : string;
+type DefinedAuth<Name extends string, Config, MachineUserNames extends string> = Config & {
+  name: Name;
+  /**
+   * @deprecated Pass the machine user name directly as a string instead, e.g. `authInvoker: "machine-user-name"`.
+   * Using this function pulls config-layer (Node-only) dependencies into runtime bundles.
+   */
+  invoker<M extends MachineUserNames>(machineUser: M): AuthInvokerWithName<M>;
+  /**
+   * @deprecated Use `authconnection.getConnectionToken(...)` from `@tailor-platform/sdk/runtime` instead.
+   * Importing `auth` from `tailor.config.ts` into runtime files pulls config-layer (Node-only)
+   * dependencies into the bundle.
+   */
+  getConnectionToken<C extends ConnectionNames<Config>>(connectionName: C): Promise<AuthConnectionTokenResult>;
+} & AuthDefinitionBrand;
+type AuthExternalConfig = {
+  name: string;
+  external: true;
+};
+type AuthServiceInputLoose = AuthServiceInput<any, any, any, string, any>;
+type AuthOwnConfig = DefinedAuth<string, AuthServiceInputLoose, string>;
+type AuthConfig = AuthOwnConfig | AuthExternalConfig;
+//#endregion
+export { SCIMConfig as A, OAuth2Client as C, SCIMAttribute as D, SAML as E, TenantProvider as M, AuthConnectionConfig as N, SCIMAttributeMapping as O, AuthConnectionOAuth2Config as P, IdProvider as S, OIDC as T, UsernameFieldKey as _, AuthServiceInput as a, BuiltinIdP as b, DefinedAuth as c, FederatedIdentityProvider as d, OAuth2ClientGrantType as f, UserAttributeMap as g, UserAttributeListKey as h, AuthOwnConfig as i, SCIMResource as j, SCIMAuthorization as k, FederatedIdentity as l, UserAttributeKey as m, AuthConnectionTokenResult as n, BeforeLoginClaims as o, SCIMAttributeType as p, AuthExternalConfig as r, BeforeLoginHookArgs as s, AuthConfig as t, FederatedIdentityClaims as u, ValueOperand as v, OAuth2ClientInput as w, IDToken as x, AuthInvoker as y };
+//# sourceMappingURL=types-v_ErzNUF.d.mts.map

package/dist/utils/test/index.d.mts

@@ -1,6 +1,6 @@
 import { s as TailorInvoker } from "../../types-DTcZ2Yax.mjs";
-import { j as TailorDBType } from "../../workflow.generated-DJULCuRr.mjs";
-import { Et as WORKFLOW_TEST_ENV_KEY, It as TailorField, n as output } from "../../index-BAEaAqmz.mjs";
+import { j as TailorDBType } from "../../workflow.generated-Da1zECDw.mjs";
+import { Et as WORKFLOW_TEST_ENV_KEY, Rt as TailorField, n as output } from "../../index-BzGqTY5x.mjs";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 
 //#region src/utils/test/mock.d.ts

package/dist/vitest/index.d.mts

@@ -1,6 +1,7 @@
 import { o as TailorEnv } from "../types-DTcZ2Yax.mjs";
 import { Kysely, OperationNode, OperationNodeKind, Transaction } from "kysely";
 import { Mock } from "vitest";
+import { AuthConnectionTokenResult, ConnectionName } from "@tailor-platform/sdk";
 import { Plugin } from "vitest/config";
 
 //#region src/vitest/mock.d.ts
@@ -41,7 +42,7 @@ interface SecretCall {
   names?: readonly string[];
 }
 interface AuthConnectionCall {
-  connectionName: string;
+  connectionName: ConnectionName;
 }
 interface IdpCall {
   method: string;
@@ -241,8 +242,8 @@ declare function mockSecretmanager(): {
  * ```
  */
 declare function mockAuthconnection(): {
-  /** The `getConnectionToken` `vi.fn`. */getConnectionToken: Mock<(connectionName: string) => Promise<any>>;
-  setTokens(value: Record<string, unknown>): void;
+  /** The `getConnectionToken` `vi.fn`. */getConnectionToken: Mock<(connectionName: ConnectionName) => Promise<AuthConnectionTokenResult>>;
+  setTokens(value: Partial<Record<ConnectionName, AuthConnectionTokenResult>>): void;
   readonly calls: AuthConnectionCall[];
   reset(): void;
 } & Disposable;

package/dist/{workflow.generated-DJULCuRr.d.mts → workflow.generated-Da1zECDw.d.mts}

@@ -1,6 +1,7 @@
 import { c as TailorUser, i as InferredAttributeMap } from "./types-DTcZ2Yax.mjs";
 import { A as Validators, E as FieldValidateInput, F as output, O as TailorFieldType, P as TypeLevelError, S as EnumValue, T as FieldOutput, a as Hooks, g as TailorDBType$1, h as TailorDBServiceInput, i as Hook, j as InferFieldsOutput, k as TailorToTs, l as RelationType, n as DefinedDBFieldMetadata, o as IndexDef, p as TailorDBField$1, r as ExcludeNestedDBFields, t as DBFieldMetadata, u as SerialConfig, v as TypeFeatures, w as FieldOptions } from "./types-rj8YJcEe.mjs";
-import { it as BuiltinIdP, o as PluginConfigs, z as AuthConfig } from "./types-Dynq4AJv.mjs";
+import { b as BuiltinIdP, t as AuthConfig } from "./types-v_ErzNUF.mjs";
+import { o as PluginConfigs } from "./types-aqnqTCfO.mjs";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 
 //#region src/configure/types/field.d.ts
@@ -1344,4 +1345,4 @@ type ConcurrencyPolicy = {
 };
 //#endregion
 export { TailorDBInstance as A, IdPInput as C, TailorAnyDBField as D, AIGatewayInput as E, TailorTypePermission as F, unsafeAllowAllGqlPermission as I, unsafeAllowAllTypePermission as L, db as M, PermissionCondition as N, TailorAnyDBType as O, TailorTypeGqlPermission as P, AllowedValues as R, IdPGqlOperationsInput as S, AIGatewayDefinitionBrand as T, IdPConfig as _, ExecutorServiceConfig as a, IdPEmailConfig as b, ResolverServiceConfig as c, WorkflowServiceInput as d, StaticWebsiteConfig as f, SecretsDefinitionBrand as g, SecretsConfig as h, AppConfig as i, TailorDBType as j, TailorDBField as k, ResolverServiceInput as l, StaticWebsiteInput as m, RetryPolicy as n, ExecutorServiceInput as o, StaticWebsiteDefinitionBrand as p, HttpAdapterConfigInput as r, ResolverExternalConfig as s, ConcurrencyPolicy as t, WorkflowServiceConfig as u, IdPExternalConfig as v, AIGatewayConfig as w, IdPGqlOperations as x, IdpDefinitionBrand as y, AllowedValuesOutput as z };
-//# sourceMappingURL=workflow.generated-DJULCuRr.d.mts.map
+//# sourceMappingURL=workflow.generated-Da1zECDw.d.mts.map

package/docs/services/auth.md

@@ -308,7 +308,7 @@ export default createResolver({
 });
 ```
 
-Type narrowing is provided by the generated `tailor.d.ts` (the `MachineUserNameRegistry` interface). Run `tailor-sdk generate` (or `apply`) after defining new machine users to refresh it.
+Type narrowing is provided by the generated `tailor.d.ts` (the `MachineUserNameRegistry` interface). Run `tailor-sdk generate` (or `deploy`) after defining new machine users to refresh it.
 
 > **Deprecated:** The `auth.invoker("<name>")` helper is still available for backward compatibility. Prefer the string form — it does not require importing `auth` from `tailor.config.ts` into runtime files, avoiding bundling config-layer (Node-only) dependencies.
 
@@ -365,21 +365,18 @@ See [IdP](./idp.md) for configuring identity providers.
 
 ## Auth Connections
 
-Auth connections enable OAuth2 authentication with external providers (Google, Microsoft 365, QuickBooks, etc.) for application-to-application flows. Functions can access connection tokens at runtime via `tailor.authconnection.getConnectionToken()`.
+Auth connections enable OAuth2 authentication with external providers (Google, Microsoft 365, QuickBooks, etc.) for application-to-application flows. Functions can access connection tokens at runtime via `authconnection.getConnectionToken()` (from `@tailor-platform/sdk/runtime`).
 
 For the official Tailor Platform documentation, see [AuthConnection Guide](https://docs.tailor.tech/guides/auth/authconnection).
 
-> [!WARNING]
-> **Managing connections through `tailor.config.ts` is unreliable for shared and CI deploys.**
-> A deploy revokes and recreates the connection — discarding the token obtained via `authconnection authorize` — whenever it cannot confirm the secret is unchanged. That check relies on a hash stored locally in `.tailor-sdk/secrets-state.json`, which is gitignored and therefore not shared across machines. So a deploy from CI, a clean checkout, another developer's machine, or after deleting `.tailor-sdk/` recreates the connection and drops its token. Only repeated deploys from the same machine that still holds that state keep the token.
->
-> Because of this, prefer to **create the connection and its token from the Console**. You can jump to the connections page with:
+> [!NOTE]
+> Deploy updates connections **in-place**, preserving the OAuth token. If the connection requires re-authorization after an update, the deploy will warn you:
 >
 > ```bash
+> tailor-sdk authconnection authorize --name <connection-name>
+> # Or via the Console:
 > tailor-sdk authconnection open
 > ```
->
-> The `connections` field in `defineAuth()` and the `authconnection authorize` flow are documented below for reference.
 
 ### Setup Flow
 
@@ -432,30 +429,25 @@ The authorize command opens a browser for the OAuth2 flow. The authorization cod
 | `authUrl`      | `string` | No       | Override for the authorization endpoint.    |
 | `tokenUrl`     | `string` | No       | Override for the token endpoint.            |
 
-### Change Detection
-
-The SDK uses hash-based change detection for connection configs. Only connections whose configuration has changed since the last `apply` are updated (revoked and recreated). Deleting the `.tailor-sdk/` directory forces all connections to be re-sent.
+### Retrieving Connection Tokens
 
-> [!WARNING]
-> The secret hash lives in `.tailor-sdk/secrets-state.json`, which is gitignored and not shared across machines or CI. When that state is missing — a clean checkout, CI, another machine, or after deleting `.tailor-sdk/` — a deploy cannot confirm the secret is unchanged, so it revokes and recreates the connection and discards the token stored by `authconnection authorize`. For shared and CI workflows, manage the connection and create its token from the Console (`tailor-sdk authconnection open`) instead.
-
-### `auth.getConnectionToken()`
-
-`auth.getConnectionToken()` retrieves connection tokens at runtime by calling `tailor.authconnection.getConnectionToken()` internally. When `connections` is defined in `defineAuth()`, the connection name is type-checked and autocompleted against the defined keys:
+Use `authconnection.getConnectionToken()` from `@tailor-platform/sdk/runtime` to retrieve connection tokens at runtime. The connection name is type-checked and autocompleted against the connections defined in `defineAuth()`'s `connections`:
 
 ```typescript
-import { auth } from "../tailor.config";
+import { authconnection } from "@tailor-platform/sdk/runtime";
 
 // In a resolver, executor, or workflow:
-const tokens = await auth.getConnectionToken("google-connection");
+const tokens = await authconnection.getConnectionToken("google-connection");
 const response = await fetch("https://www.googleapis.com/...", {
   headers: { Authorization: `Bearer ${tokens.access_token}` },
 });
 
-// auth.getConnectionToken("unknown"); // Type error — only "google-connection" is allowed
+// authconnection.getConnectionToken("unknown"); // Type error — only "google-connection" is allowed
 ```
 
-When `connections` is not defined, `getConnectionToken()` accepts any string. This supports connections managed entirely via the CLI.
+Type narrowing is provided by the generated `tailor.d.ts` (the `ConnectionNameRegistry` interface). Run `tailor-sdk generate` (or `deploy`) after defining new connections to refresh it. Before the first generate, or when `connections` is not defined in `defineAuth()`, `getConnectionToken()` accepts any string — this also supports connections managed entirely via the CLI.
+
+> **Deprecated:** `auth.getConnectionToken("<name>")` still works, but is deprecated. Importing `auth` from `tailor.config.ts` into runtime files pulls config-layer (Node-only) dependencies into the bundle.
 
 See [Built-in Interfaces](https://docs.tailor.tech/guides/function/builtin-interfaces.html#auth-connection) for the full runtime API.
 

package/docs/testing.md

@@ -185,7 +185,7 @@ import { mockAuthconnection } from "@tailor-platform/sdk/vitest";
 test("returns configured token", async () => {
   using ac = mockAuthconnection();
   ac.setTokens({
-    google: { access_token: "ya29.xxx", expires_in: 3600 },
+    google: { access_token: "ya29.xxx" },
   });
 
   const token = await tailor.authconnection.getConnectionToken("google");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tailor-platform/sdk",
-  "version": "1.70.0",
+  "version": "1.71.0",
   "description": "Tailor Platform SDK - The SDK to work with Tailor Platform",
   "license": "MIT",
   "repository": {
@@ -141,7 +141,7 @@
   "dependencies": {
     "@0no-co/graphql.web": "1.3.2",
     "@badgateway/oauth2-client": "3.3.1",
-    "@bufbuild/protobuf": "2.12.0",
+    "@bufbuild/protobuf": "2.12.1",
     "@bufbuild/protovalidate": "1.2.0",
     "@connectrpc/connect": "2.1.2",
     "@connectrpc/connect-node": "2.1.2",
@@ -157,16 +157,16 @@
     "@oxc-project/types": "0.137.0",
     "@standard-schema/spec": "1.1.0",
     "@tailor-platform/function-kysely-tailordb": "0.1.3",
-    "@toiroakr/lines-db": "0.9.2",
+    "@toiroakr/lines-db": "0.10.0",
     "@toiroakr/read-multiline": "0.4.1",
-    "@urql/core": "6.0.2",
+    "@urql/core": "6.0.3",
     "chalk": "5.6.2",
     "chokidar": "5.0.0",
     "confbox": "0.2.4",
     "date-fns": "4.4.0",
-    "es-toolkit": "1.48.1",
+    "es-toolkit": "1.49.0",
     "find-up-simple": "1.0.1",
-    "globals": "17.6.0",
+    "globals": "17.7.0",
     "graphql": "17.0.1",
     "inflection": "3.0.2",
     "kysely": "0.29.2",
@@ -178,8 +178,8 @@
     "pathe": "2.0.3",
     "pgsql-ast-parser": "12.0.2",
     "pkg-types": "2.3.1",
-    "politty": "0.9.2",
-    "rolldown": "1.1.2",
+    "politty": "0.10.1",
+    "rolldown": "1.1.3",
     "semver": "7.8.5",
     "sql-highlight": "6.1.0",
     "std-env": "4.1.0",
@@ -199,14 +199,14 @@
     "@types/semver": "7.7.1",
     "@typescript/native-preview": "7.0.0-dev.20260621.1",
     "@vitest/coverage-v8": "4.1.9",
-    "oxfmt": "0.55.0",
-    "oxlint": "1.70.0",
+    "oxfmt": "0.56.0",
+    "oxlint": "1.71.0",
     "oxlint-tsgolint": "0.23.0",
     "sonda": "0.13.1",
     "tsdown": "0.22.3",
     "typescript": "6.0.3",
     "vitest": "4.1.9",
-    "zinfer": "0.2.2",
+    "zinfer": "0.2.3",
     "@tailor-platform/tailor-proto": "^0.0.0"
   },
   "peerDependencies": {

package/dist/application-BakHtldG.mjs

@@ -1,4 +0,0 @@
-
-import { n as generatePluginFilesIfNeeded, r as loadApplication, t as defineApplication } from "./application-Df5_I83n.mjs";
-
-export { defineApplication, generatePluginFilesIfNeeded };

package/dist/authconnection-Ds2Ahpum.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"authconnection-Ds2Ahpum.mjs","names":[],"sources":["../src/runtime/authconnection.ts"],"sourcesContent":["/**\n * Auth connection utilities.\n *\n * Thin typed wrapper around the platform-provided `tailor.authconnection` runtime API.\n * At runtime this delegates to `globalThis.tailor.authconnection`. Use\n * `mockAuthconnection` from `@tailor-platform/sdk/vitest` to mock in unit tests.\n * @example\n * import { authconnection } from \"@tailor-platform/sdk/runtime\";\n *\n * const token = await authconnection.getConnectionToken(\"my-connection\");\n */\n\n/* eslint-disable @typescript-eslint/no-explicit-any */\n\n/**\n * Platform API surface for `tailor.authconnection`. Describes the shape the\n * platform runtime injects on `globalThis.tailor.authconnection`.\n *\n * Each method below is also re-exported as a top-level named export from this\n * module so callers can either `import * as authconnection from\n * \"@tailor-platform/sdk/runtime/authconnection\"` or pick individual methods.\n */\nexport interface TailorAuthconnectionAPI {\n  /**\n   * Returns the access token for the given auth connection.\n   * @param connectionName - Auth connection name as defined in tailor.config\n   * @returns Token payload (provider-specific shape)\n   */\n  getConnectionToken(connectionName: string): Promise<any>;\n}\n\nconst api = (): TailorAuthconnectionAPI =>\n  (globalThis as { tailor: { authconnection: TailorAuthconnectionAPI } }).tailor.authconnection;\n\n/**\n * See {@link TailorAuthconnectionAPI.getConnectionToken}.\n * @param args - Forwarded to {@link TailorAuthconnectionAPI.getConnectionToken}\n * @returns Token payload (provider-specific shape)\n */\nexport const getConnectionToken: TailorAuthconnectionAPI[\"getConnectionToken\"] = (...args) =>\n  api().getConnectionToken(...args);\n"],"mappings":";;;;;AA+BA,MAAM,YACH,WAAuE,OAAO;;;;;;AAOjF,MAAa,sBAAqE,GAAG,SACnF,IAAI,CAAC,CAAC,mBAAmB,GAAG,IAAI"}