@tailor-platform/sdk 1.80.0 → 1.81.0

package/dist/configure/services/idp/index.d.mts

@@ -1,6 +1,6 @@
+import { IdPPermission, IdPPermissionCondition, unsafeAllowAllIdPPermission } from "./permission.mjs";
 import { IdPEmailConfig, IdPGqlOperations, IdPGqlOperationsInput, IdPInput } from "../../../types/idp.generated.mjs";
 import { IdPConfig, IdPExternalConfig, IdpDefinitionBrand } from "./types.mjs";
-import { IdPPermission, IdPPermissionCondition, unsafeAllowAllIdPPermission } from "./permission.mjs";
 //#region src/configure/services/idp/index.d.ts
 /**
  * Define an IdP service configuration for the Tailor SDK.

package/dist/configure/services/idp/permission.d.mts

@@ -1,24 +1,9 @@
 import { InferredAttributeMap } from "../../../runtime/types.mjs";
+import { UserBooleanArrayOperand, UserBooleanOperand, UserStringArrayOperand, UserStringOperand } from "../../types/permission-operand.types.mjs";
 import { IdPUserField } from "../../../parser/service/idp/types.mjs";
 //#region src/configure/services/idp/permission.d.ts
 type EqualityOperator = "=" | "!=";
 type ContainsOperator = "in" | "not in";
-type StringFieldKeys<User extends object> = { [K in keyof User]: User[K] extends string ? K : never; }[keyof User];
-type StringArrayFieldKeys<User extends object> = { [K in keyof User]: User[K] extends string[] ? K : never; }[keyof User];
-type BooleanFieldKeys<User extends object> = { [K in keyof User]: User[K] extends boolean ? K : never; }[keyof User];
-type BooleanArrayFieldKeys<User extends object> = { [K in keyof User]: User[K] extends boolean[] ? K : never; }[keyof User];
-type UserStringOperand<User extends object = InferredAttributeMap> = {
-  user: StringFieldKeys<User> | "id";
-};
-type UserStringArrayOperand<User extends object = InferredAttributeMap> = {
-  user: StringArrayFieldKeys<User>;
-};
-type UserBooleanOperand<User extends object = InferredAttributeMap> = {
-  user: BooleanFieldKeys<User> | "_loggedIn";
-};
-type UserBooleanArrayOperand<User extends object = InferredAttributeMap> = {
-  user: BooleanArrayFieldKeys<User>;
-};
 type IdPUserOperand<Update extends boolean = false> = Update extends true ? {
   oldIdpUser: IdPUserField;
 } | {

package/dist/configure/services/idp/types.d.mts

@@ -1,4 +1,5 @@
 import { BuiltinIdP } from "../../../types/auth.generated.mjs";
+import { IdPPermission } from "./permission.mjs";
 import { IdPInput } from "../../../types/idp.generated.mjs";
 //#region src/configure/services/idp/types.d.ts
 declare const idpDefinitionBrand: unique symbol;
@@ -13,7 +14,10 @@ type IdPExternalConfig = {
   name: string;
   external: true;
 };
-type IdPOwnConfig = Omit<DefinedIdp<string, IdPInput, string>, "provider">;
+type IdPOwnConfigInput = Omit<IdPInput, "permission"> & {
+  permission?: IdPPermission;
+};
+type IdPOwnConfig = Omit<DefinedIdp<string, IdPOwnConfigInput, string>, "provider">;
 type IdPConfig = IdPOwnConfig | IdPExternalConfig;
 //#endregion
 export { DefinedIdp, IdPConfig, IdPExternalConfig, IdPOwnConfig, IdpDefinitionBrand };

package/dist/configure/services/index.d.mts

@@ -6,6 +6,7 @@ import { PermissionCondition, TailorTypeGqlPermission, TailorTypePermission, uns
 import { TailorAnyDBField, TailorAnyDBType, TailorDBField, TailorDBInstance, TailorDBType, db } from "./tailordb/schema.mjs";
 import "./tailordb/index.mjs";
 import { AIGatewayConfig } from "./aigateway/types.mjs";
+import { IdPPermission, IdPPermissionCondition, unsafeAllowAllIdPPermission } from "./idp/permission.mjs";
 import { IdPEmailConfig, IdPGqlOperations, IdPGqlOperationsInput } from "../../types/idp.generated.mjs";
 import { IdPConfig, IdPExternalConfig } from "./idp/types.mjs";
 import { SecretsConfig } from "./secrets/types.mjs";
@@ -14,6 +15,7 @@ import { ExecutionPolicyConcurrency, ExecutionPolicyDefInput, ExecutionPolicyExa
 import { ExecutorServiceConfig, ExecutorServiceInput, ResolverExternalConfig, ResolverServiceConfig, ResolverServiceInput, WorkflowServiceConfig, WorkflowServiceInput } from "../config/types.mjs";
 import { ConcurrencyPolicy, RetryPolicy } from "../../types/workflow.generated.mjs";
 import { AuthInvoker, defineAuth } from "./auth/index.mjs";
+import { ResolverPermission, ResolverPermissionCondition, ResolverPermissionPolicy } from "./resolver/permission.mjs";
 import { createResolver } from "./resolver/resolver.mjs";
 import { QueryType } from "./resolver/types.mjs";
 import "./resolver/index.mjs";
@@ -32,9 +34,8 @@ import { WaitPointInstance, defineWaitPoint, defineWaitPoints } from "./workflow
 import "./workflow/index.mjs";
 import { defineStaticWebSite } from "./staticwebsite/index.mjs";
 import { defineAIGateway } from "./aigateway/index.mjs";
-import { IdPPermission, IdPPermissionCondition, unsafeAllowAllIdPPermission } from "./idp/permission.mjs";
 import { defineIdp } from "./idp/index.mjs";
 import { defineSecretManager } from "./secrets/index.mjs";
 import { HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, createHttpAdapter } from "./http-adapter/http-adapter.mjs";
 import "./http-adapter/index.mjs";
-export { type AIGatewayConfig, AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, type AuthConfig, type AuthConnectionConfig, type AuthConnectionOAuth2Config, type AuthConnectionTokenResult, type AuthExternalConfig, AuthInvoker, type AuthOwnConfig, type AuthServiceInput, type BeforeLoginClaims, type BeforeLoginHookArgs, type BuiltinIdP, type ConcurrencyPolicy, type DefinedAuth, type ExecutionPolicyConcurrency, type ExecutionPolicyDefInput, type ExecutionPolicyExactInstance, type ExecutionPolicyGroupOptions, type ExecutionPolicyInstance, type ExecutionPolicyWildcardInstance, type ExecutorServiceConfig, type ExecutorServiceInput, type FederatedIdentity, type FederatedIdentityClaims, type FederatedIdentityProvider, FunctionOperation, GqlOperation, HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, type IDToken, type IdPConfig, type IdPEmailConfig, type IdPExternalConfig, type IdPGqlOperations, type IdPGqlOperationsInput as IdPGqlOperationsConfig, type IdPPermission, type IdPPermissionCondition, type IdProvider as IdProviderConfig, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, type OAuth2ClientInput as OAuth2Client, type OAuth2ClientGrantType, type OIDC, Operation, type PermissionCondition, type QueryType, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, type ResolvedExecutionPolicyInstance, type Resolver, ResolverExecutedArgs, ResolverExecutedTrigger, type ResolverExternalConfig, type ResolverServiceConfig, type ResolverServiceInput, type RetryPolicy, type SAML, type SCIMAttribute, type SCIMAttributeMapping, type SCIMAttributeType, type SCIMAuthorization, type SCIMConfig, type SCIMResource, ScheduleArgs, ScheduleTrigger, type SecretsConfig, type StaticWebsiteConfig, type TailorAnyDBField, type TailorAnyDBType, type TailorDBField, type TailorDBInstance, TailorDBTrigger, type TailorDBType, type TailorTypeGqlPermission, type TailorTypePermission, type TenantProvider as TenantProviderConfig, Trigger, type UserAttributeKey, type UserAttributeListKey, type UserAttributeMap, type UsernameFieldKey, type ValueOperand, WORKFLOW_TEST_ENV_KEY, WaitPointInstance, WebhookOperation, Workflow, WorkflowConfig, WorkflowJob, WorkflowJobContext, WorkflowOperation, type WorkflowServiceConfig, type WorkflowServiceInput, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, createExecutor, createHttpAdapter, createResolver, createWorkflow, createWorkflowJob, db, defineAIGateway, defineAuth, defineIdp, defineSecretManager, defineStaticWebSite, defineWaitPoint, defineWaitPoints, defineWorkflowExecutionPolicies, defineWorkflowExecutionPolicy, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, incomingWebhookTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, scheduleTrigger, unsafeAllowAllGqlPermission, unsafeAllowAllIdPPermission, unsafeAllowAllTypePermission };
+export { type AIGatewayConfig, AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, type AuthConfig, type AuthConnectionConfig, type AuthConnectionOAuth2Config, type AuthConnectionTokenResult, type AuthExternalConfig, AuthInvoker, type AuthOwnConfig, type AuthServiceInput, type BeforeLoginClaims, type BeforeLoginHookArgs, type BuiltinIdP, type ConcurrencyPolicy, type DefinedAuth, type ExecutionPolicyConcurrency, type ExecutionPolicyDefInput, type ExecutionPolicyExactInstance, type ExecutionPolicyGroupOptions, type ExecutionPolicyInstance, type ExecutionPolicyWildcardInstance, type ExecutorServiceConfig, type ExecutorServiceInput, type FederatedIdentity, type FederatedIdentityClaims, type FederatedIdentityProvider, FunctionOperation, GqlOperation, HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, type IDToken, type IdPConfig, type IdPEmailConfig, type IdPExternalConfig, type IdPGqlOperations, type IdPGqlOperationsInput as IdPGqlOperationsConfig, type IdPPermission, type IdPPermissionCondition, type IdProvider as IdProviderConfig, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, type OAuth2ClientInput as OAuth2Client, type OAuth2ClientGrantType, type OIDC, Operation, type PermissionCondition, type QueryType, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, type ResolvedExecutionPolicyInstance, type Resolver, ResolverExecutedArgs, ResolverExecutedTrigger, type ResolverExternalConfig, type ResolverPermission, type ResolverPermissionCondition, type ResolverPermissionPolicy, type ResolverServiceConfig, type ResolverServiceInput, type RetryPolicy, type SAML, type SCIMAttribute, type SCIMAttributeMapping, type SCIMAttributeType, type SCIMAuthorization, type SCIMConfig, type SCIMResource, ScheduleArgs, ScheduleTrigger, type SecretsConfig, type StaticWebsiteConfig, type TailorAnyDBField, type TailorAnyDBType, type TailorDBField, type TailorDBInstance, TailorDBTrigger, type TailorDBType, type TailorTypeGqlPermission, type TailorTypePermission, type TenantProvider as TenantProviderConfig, Trigger, type UserAttributeKey, type UserAttributeListKey, type UserAttributeMap, type UsernameFieldKey, type ValueOperand, WORKFLOW_TEST_ENV_KEY, WaitPointInstance, WebhookOperation, Workflow, WorkflowConfig, WorkflowJob, WorkflowJobContext, WorkflowOperation, type WorkflowServiceConfig, type WorkflowServiceInput, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, createExecutor, createHttpAdapter, createResolver, createWorkflow, createWorkflowJob, db, defineAIGateway, defineAuth, defineIdp, defineSecretManager, defineStaticWebSite, defineWaitPoint, defineWaitPoints, defineWorkflowExecutionPolicies, defineWorkflowExecutionPolicy, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, incomingWebhookTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, scheduleTrigger, unsafeAllowAllGqlPermission, unsafeAllowAllIdPPermission, unsafeAllowAllTypePermission };

package/dist/configure/services/resolver/index.d.mts

@@ -1,5 +1,6 @@
 import { Resolver } from "../../../types/resolver.generated.mjs";
 import { ResolverExternalConfig, ResolverServiceConfig, ResolverServiceInput } from "../../config/types.mjs";
+import { ResolverPermission, ResolverPermissionCondition, ResolverPermissionPolicy } from "./permission.mjs";
 import { createResolver } from "./resolver.mjs";
 import { QueryType } from "./types.mjs";
-export { type QueryType, type Resolver, type ResolverExternalConfig, type ResolverServiceConfig, type ResolverServiceInput, createResolver };
+export { type QueryType, type Resolver, type ResolverExternalConfig, type ResolverPermission, type ResolverPermissionCondition, type ResolverPermissionPolicy, type ResolverServiceConfig, type ResolverServiceInput, createResolver };

package/dist/configure/services/resolver/permission.d.mts

@@ -0,0 +1,64 @@
+import { InferredAttributeMap } from "../../../runtime/types.mjs";
+import { UserBooleanOperand, UserStringOperand } from "../../types/permission-operand.types.mjs";
+//#region src/configure/services/resolver/permission.d.ts
+type EqualityOperator = "=" | "!=";
+type StringEqualityCondition<User extends object> = readonly [UserStringOperand<User>, EqualityOperator, string] | readonly [string, EqualityOperator, UserStringOperand<User>];
+type BooleanEqualityCondition<User extends object> = readonly [UserBooleanOperand<User>, EqualityOperator, boolean] | readonly [boolean, EqualityOperator, UserBooleanOperand<User>];
+/**
+ * A single condition for {@link ResolverPermission}.
+ *
+ * Only `user` operands are supported (unlike TailorDB's `record`/`newRecord`/
+ * `oldRecord` operands) — a resolver has no associated record to compare
+ * against. Only equality (`=`/`!=`) is supported for now.
+ *
+ * The User type is extended by `tailor.d.ts`, which is automatically generated
+ * when running `tailor-sdk generate`. Attributes enabled in the config file's
+ * `auth.userProfile.attributes` (or `auth.machineUserAttributes` when
+ * `userProfile` is omitted) become available as types.
+ */
+type ResolverPermissionCondition<User extends object = InferredAttributeMap> = StringEqualityCondition<User> | BooleanEqualityCondition<User>;
+/**
+ * A single access policy, in the same style as TailorDB's `.permission()`
+ * policies.
+ */
+type ResolverPermissionPolicy<User extends object = InferredAttributeMap> = {
+  conditions: ResolverPermissionCondition<User> | readonly ResolverPermissionCondition<User>[];
+  /** Whether matching callers are granted (`true`) or denied (`false`) access. */
+  permit: boolean;
+  description?: string;
+};
+/**
+ * Access requirement for a resolver, evaluated against the original caller
+ * (`context.user`) before `body` runs — unaffected by `authInvoker`.
+ *
+ * At least one `permit: true` policy is required: a caller is granted only by
+ * a matching `permit: true` policy (deny by default), and a matching
+ * `permit: false` policy always overrides that grant, even when another
+ * policy would otherwise allow the same caller — use it to carve out an
+ * explicit exception from a broader grant. A policy array with only
+ * `permit: false` policies is rejected, since none of its conditions apply to
+ * a caller presenting no user attributes at all (e.g. one who simply doesn't
+ * authenticate), so it wouldn't actually keep anyone out. `"allowAnonymous"`
+ * explicitly documents that anonymous callers are allowed.
+ * @example
+ * const permission: ResolverPermission = [
+ *   { conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true },
+ * ];
+ * @example
+ * // Allow machine-user callers unconditionally, gate regular users behind a role
+ * const permission: ResolverPermission = [
+ *   { conditions: [[{ user: "isServiceAccount" }, "=", true]], permit: true },
+ *   { conditions: [[{ user: "role" }, "=", "ADMIN"]], permit: true },
+ * ];
+ * @example
+ * // Exception: allow logged-in users broadly, but reject a banned role
+ * const permission: ResolverPermission = [
+ *   { conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true },
+ *   { conditions: [[{ user: "role" }, "=", "BANNED"]], permit: false },
+ * ];
+ * @example
+ * const permission: ResolverPermission = "allowAnonymous";
+ */
+type ResolverPermission<User extends object = InferredAttributeMap> = readonly ResolverPermissionPolicy<User>[] | "allowAnonymous";
+//#endregion
+export { ResolverPermission, ResolverPermissionCondition, ResolverPermissionPolicy };

package/dist/configure/services/resolver/resolver.d.mts

@@ -4,6 +4,7 @@ import { ResolverInput } from "../../../types/resolver.generated.mjs";
 import { TailorAnyField, TailorField } from "../../types/type.mjs";
 import { MachineUserName } from "../../types/machine-user.mjs";
 import { AuthInvoker } from "../auth/index.mjs";
+import { ResolverPermission } from "./permission.mjs";
 //#region src/configure/services/resolver/resolver.d.ts
 type Context<Input extends Record<string, TailorAnyField> | undefined> = {
   input: Input extends Record<string, TailorAnyField> ? InferFieldsOutput<Input> : never;
@@ -21,11 +22,12 @@ type NormalizedOutput<Output extends TailorAnyField | Record<string, TailorAnyFi
   type: "nested";
   array: false;
 }, InferFieldsOutput<Extract<Output, Record<string, TailorAnyField>>>>;
-type ResolverReturn<Input extends Record<string, TailorAnyField> | undefined, Output extends TailorAnyField | Record<string, TailorAnyField>> = Omit<ResolverInput, "input" | "output" | "body" | "authInvoker"> & Readonly<{
+type ResolverReturn<Input extends Record<string, TailorAnyField> | undefined, Output extends TailorAnyField | Record<string, TailorAnyField>> = Omit<ResolverInput, "input" | "output" | "body" | "authInvoker" | "permission"> & Readonly<{
   input?: Input;
   output: NormalizedOutput<Output>;
   body: (context: Context<Input>) => OutputType<Output> | Promise<OutputType<Output>>;
   authInvoker?: AuthInvoker<string> | MachineUserName;
+  permission?: ResolverPermission;
 }>;
 /**
  * Create a resolver definition for the Tailor SDK.
@@ -41,6 +43,14 @@ type ResolverReturn<Input extends Record<string, TailorAnyField> | undefined, Ou
  * If not specified, this is automatically set to true when an executor uses this resolver
  * with `resolverExecutedTrigger`. If explicitly set to false while an executor uses this
  * resolver, an error will be thrown during apply.
+ *
+ * `permission` declares the resolver's access requirement, checked against `context.user` (the
+ * original caller, unaffected by `authInvoker`) before `body` runs. Omitted (default):
+ * unchanged, anonymous callers can reach the resolver. `"allowAnonymous"`: explicitly documents
+ * that anonymous callers are allowed. An array of `{ conditions, permit }` policies (in the same
+ * style as TailorDB's `.permission()`) rejects non-matching callers: at least one `permit: true`
+ * policy is required (denied unless it matches), and a matching `permit: false` policy always
+ * overrides that grant.
  * @template Input
  * @template Output
  * @param config - Resolver configuration
@@ -51,6 +61,7 @@ type ResolverReturn<Input extends Record<string, TailorAnyField> | undefined, Ou
  * export default createResolver({
  *   name: "getUser",
  *   operation: "query",
+ *   permission: [{ conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true }],
  *   input: {
  *     id: t.string(),
  *   },
@@ -65,11 +76,12 @@ type ResolverReturn<Input extends Record<string, TailorAnyField> | undefined, Ou
  *   }),
  * });
  */
-declare function createResolver<Input extends Record<string, TailorAnyField> | undefined = undefined, Output extends TailorAnyField | Record<string, TailorAnyField> = TailorAnyField>(config: Omit<ResolverInput, "input" | "output" | "body" | "authInvoker"> & Readonly<{
+declare function createResolver<Input extends Record<string, TailorAnyField> | undefined = undefined, Output extends TailorAnyField | Record<string, TailorAnyField> = TailorAnyField>(config: Omit<ResolverInput, "input" | "output" | "body" | "authInvoker" | "permission"> & Readonly<{
   input?: Input;
   output: Output;
   body: (context: Context<Input>) => OutputType<Output> | Promise<OutputType<Output>>;
   authInvoker?: AuthInvoker<string> | MachineUserName;
+  permission?: ResolverPermission;
 }>): ResolverReturn<Input, Output>;
 type ResolverConfig = ReturnType<typeof createResolver<any, any>>;
 //#endregion

package/dist/configure/services/tailordb/permission.d.mts

@@ -1,4 +1,5 @@
 import { InferredAttributeMap } from "../../../runtime/types.mjs";
+import { UserBooleanArrayOperand, UserBooleanOperand, UserStringArrayOperand, UserStringOperand } from "../../types/permission-operand.types.mjs";
 //#region src/configure/services/tailordb/permission.d.ts
 /**
  * Record-level permission configuration for a TailorDB type.
@@ -47,22 +48,6 @@ type GqlPermissionAction = "read" | "create" | "update" | "delete" | "aggregate"
 type EqualityOperator = "=" | "!=";
 type ContainsOperator = "in" | "not in";
 type HasAnyOperator = "hasAny" | "not hasAny";
-type StringFieldKeys<User extends object> = { [K in keyof User]: User[K] extends string ? K : never; }[keyof User];
-type StringArrayFieldKeys<User extends object> = { [K in keyof User]: User[K] extends string[] ? K : never; }[keyof User];
-type BooleanFieldKeys<User extends object> = { [K in keyof User]: User[K] extends boolean ? K : never; }[keyof User];
-type BooleanArrayFieldKeys<User extends object> = { [K in keyof User]: User[K] extends boolean[] ? K : never; }[keyof User];
-type UserStringOperand<User extends object = InferredAttributeMap> = {
-  user: StringFieldKeys<User> | "id";
-};
-type UserStringArrayOperand<User extends object = InferredAttributeMap> = {
-  user: StringArrayFieldKeys<User>;
-};
-type UserBooleanOperand<User extends object = InferredAttributeMap> = {
-  user: BooleanFieldKeys<User> | "_loggedIn";
-};
-type UserBooleanArrayOperand<User extends object = InferredAttributeMap> = {
-  user: BooleanArrayFieldKeys<User>;
-};
 type RecordOperand<Type extends object, Update extends boolean = false> = Update extends true ? {
   oldRecord: (keyof Type & string) | "id";
 } | {

package/dist/configure/types/permission-operand.types.d.mts

@@ -0,0 +1,20 @@
+import { InferredAttributeMap } from "../../runtime/types.mjs";
+//#region src/configure/types/permission-operand.types.d.ts
+type StringFieldKeys<User extends object> = { [K in keyof User]: NonNullable<User[K]> extends string ? K : never; }[keyof User];
+type StringArrayFieldKeys<User extends object> = { [K in keyof User]: NonNullable<User[K]> extends string[] ? K : never; }[keyof User];
+type BooleanFieldKeys<User extends object> = { [K in keyof User]: NonNullable<User[K]> extends boolean ? K : never; }[keyof User];
+type BooleanArrayFieldKeys<User extends object> = { [K in keyof User]: NonNullable<User[K]> extends boolean[] ? K : never; }[keyof User];
+type UserStringOperand<User extends object = InferredAttributeMap> = {
+  user: StringFieldKeys<User> | "id";
+};
+type UserStringArrayOperand<User extends object = InferredAttributeMap> = {
+  user: StringArrayFieldKeys<User>;
+};
+type UserBooleanOperand<User extends object = InferredAttributeMap> = {
+  user: BooleanFieldKeys<User> | "_loggedIn";
+};
+type UserBooleanArrayOperand<User extends object = InferredAttributeMap> = {
+  user: BooleanArrayFieldKeys<User>;
+};
+//#endregion
+export { BooleanArrayFieldKeys, BooleanFieldKeys, StringArrayFieldKeys, StringFieldKeys, UserBooleanArrayOperand, UserBooleanOperand, UserStringArrayOperand, UserStringOperand };

package/dist/{globals-B-n_3uYu.mjs → globals-DUqEetIh.mjs}

@@ -77,23 +77,39 @@ var TailorDBFileErrorMock = class extends Error {
 function defaultGetInvoker() {
 	return null;
 }
+function noop() {}
+const defaultLogger = {
+	debug: noop,
+	info: noop,
+	warn: noop,
+	error: noop,
+	setAttributes: noop
+};
 /**
 * Install the always-present base platform globals (containers, context stub,
 * error classes, runtime flag). Per-namespace mocks are layered on top by the
 * `xMock()` factories in `./mock`.
+*
+* Acquire with a `using` declaration and the globals are removed when the
+* scope exits; alternatively call `cleanupPlatformGlobals` yourself.
 * @param global - The global object to install into (typically `globalThis`)
+* @returns A `Disposable` that removes the installed globals
 */
 function installPlatformGlobals(global) {
 	const g = global;
 	g[RUNTIME_FLAG_KEY] = true;
 	g.tailor = {
 		context: { getInvoker: defaultGetInvoker },
-		workflow: createDefaultWorkflowRuntime()
+		workflow: createDefaultWorkflowRuntime(),
+		logger: { ...defaultLogger }
 	};
 	g.tailordb = {};
 	g.TailorErrors = TailorErrorsMock;
 	g.TailorErrorMessage = TailorErrorMessageMock;
 	g.TailorDBFileError = TailorDBFileErrorMock;
+	return { [Symbol.dispose]() {
+		cleanupPlatformGlobals(global);
+	} };
 }
 /**
 * Remove the base platform globals (and anything the namespace mocks layered on
@@ -112,4 +128,4 @@ function cleanupPlatformGlobals(global) {
 
 //#endregion
 export { cleanupPlatformGlobals as n, installPlatformGlobals as r, RUNTIME_FLAG_KEY as t };
-//# sourceMappingURL=globals-B-n_3uYu.mjs.map
+//# sourceMappingURL=globals-DUqEetIh.mjs.map

package/dist/{globals-B-n_3uYu.mjs.map → globals-DUqEetIh.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"globals-B-n_3uYu.mjs","names":[],"sources":["../src/vitest/workflow-runtime.ts","../src/vitest/globals.ts"],"sourcesContent":["// Default `tailor.workflow` runner installed by the `tailor-runtime` environment.\n// Must stay free of `vitest` (`vi`): it loads via `./globals` in the environment\n// realm where `vi` is unavailable, hence relative imports only (no `@/` alias).\nimport { runRegisteredJob, runRegisteredWorkflow } from \"../configure/services/workflow/registry\";\nimport type { StartJobFunctionOptions, StartWorkflowOptions } from \"../runtime/workflow\";\n\nexport interface DefaultWorkflowRuntime {\n  startJobFunction: (name: string, args?: unknown, options?: StartJobFunctionOptions) => unknown;\n  triggerJobFunction: (name: string, args?: unknown, options?: StartJobFunctionOptions) => unknown;\n  startWorkflow: (name: string, args?: unknown, options?: StartWorkflowOptions) => Promise<string>;\n  triggerWorkflow: (\n    name: string,\n    args?: unknown,\n    options?: StartWorkflowOptions,\n  ) => Promise<string>;\n  resumeWorkflowExecution: (executionId: string) => Promise<string>;\n  resumeWorkflow: (executionId: string) => Promise<string>;\n  wait: (key: string, payload?: unknown) => unknown;\n  resolve: (\n    executionId: string,\n    key: string,\n    callback: (payload: unknown) => unknown,\n  ) => Promise<void>;\n}\n\nexport function createDefaultWorkflowRuntime(): DefaultWorkflowRuntime {\n  const startJobFunction: DefaultWorkflowRuntime[\"startJobFunction\"] = (name, args) =>\n    runRegisteredJob(name, args);\n  const startWorkflow: DefaultWorkflowRuntime[\"startWorkflow\"] = (name, args) =>\n    runRegisteredWorkflow(name, args);\n  const resumeWorkflowExecution: DefaultWorkflowRuntime[\"resumeWorkflowExecution\"] = async (\n    executionId,\n  ) => executionId;\n  return {\n    startJobFunction,\n    triggerJobFunction: startJobFunction,\n    startWorkflow,\n    triggerWorkflow: startWorkflow,\n    resumeWorkflowExecution,\n    resumeWorkflow: resumeWorkflowExecution,\n    wait: (key: string): unknown => {\n      throw new Error(\n        `No wait handler for \"${key}\". Acquire mockWorkflow() and call setWaitHandler(...).`,\n      );\n    },\n    resolve: async (): Promise<void> => {\n      throw new Error(\n        \"No resolve handler. Acquire mockWorkflow() and call setResolveHandler(...).\",\n      );\n    },\n  };\n}\n","/**\n * Base platform globals for the tailor-runtime test environment.\n *\n * This module is intentionally free of any `vitest` (`vi`) dependency so it can\n * be imported from the Vitest *environment* module (which runs in a realm where\n * `vi` is not available). It installs only the always-present structural pieces:\n *\n * - `globalThis.tailor` / `globalThis.tailordb` container objects\n * - `globalThis.tailor.context.getInvoker` default stub\n * - the platform error classes (`TailorErrors`, `TailorErrorMessage`,\n *   `TailorDBFileError`)\n * - the `__tailorRuntimeActive` sentinel flag\n *\n * The per-namespace mock behavior (TailorDB client, workflow, secretmanager, …)\n * is installed on demand by the `xMock()` factories in `./mock`, which run in\n * test context where `vi` *is* available.\n */\n\nimport { createDefaultWorkflowRuntime } from \"./workflow-runtime\";\nimport type { ContextInvoker } from \"../runtime/context\";\nimport type { TailorDBFileErrorCode } from \"../runtime/file\";\n\n// Sentinel set when the tailor-runtime environment is active. setup.ts reads it\n// to decide whether to run its blocked-globals lifecycle and config-secret\n// loading.\nexport const RUNTIME_FLAG_KEY = \"__tailorRuntimeActive\";\n\n// ---------------------------------------------------------------------------\n// Error class mocks\n// ---------------------------------------------------------------------------\n\ninterface TailorErrorItem {\n  message: string;\n  path: (string | number)[];\n}\n\nclass TailorErrorsMock extends Error {\n  errors: TailorErrorItem[];\n\n  constructor(errors: TailorErrorItem[]) {\n    if (!Array.isArray(errors)) {\n      throw new TypeError(\"TailorErrors: errors must be an array\");\n    }\n    const validated = errors.map((e, i) => {\n      if (typeof e.message !== \"string\") {\n        throw new TypeError(`TailorErrors: errors[${i}].message must be a string`);\n      }\n      if (!Array.isArray(e.path)) {\n        throw new TypeError(`TailorErrors: errors[${i}].path must be an array`);\n      }\n      return { message: e.message, path: e.path };\n    });\n    // Match the PF runtime's TailorErrors serialization, which prefixes the\n    // JSON payload with \"TailorErrors: \". Other SDK code (e.g. apply\n    // integration fixtures) strips this prefix before JSON.parse.\n    super(`TailorErrors: ${JSON.stringify({ errors: validated })}`);\n    this.name = \"TailorErrors\";\n    this.errors = validated;\n  }\n}\n\nclass TailorErrorMessageMock extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"TailorErrorMessage\";\n  }\n}\n\nclass TailorDBFileErrorMock extends Error {\n  code?: TailorDBFileErrorCode;\n  override cause: unknown;\n\n  constructor(message: string, code?: TailorDBFileErrorCode, cause?: unknown) {\n    super(message);\n    this.name = \"TailorDBFileError\";\n    this.code = code;\n    this.cause = cause;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Base install / cleanup\n// ---------------------------------------------------------------------------\n\n// Stub-only injection. SDK consumers configure invokers at the body level\n// (resolver/executor/workflow `.body()` `invoker` arg) or, for bundled tests,\n// via `vi.spyOn(globalThis.tailor.context, \"getInvoker\")`.\nfunction defaultGetInvoker(): ContextInvoker | null {\n  return null;\n}\n\n/**\n * Install the always-present base platform globals (containers, context stub,\n * error classes, runtime flag). Per-namespace mocks are layered on top by the\n * `xMock()` factories in `./mock`.\n * @param global - The global object to install into (typically `globalThis`)\n */\nexport function installPlatformGlobals(global: typeof globalThis): void {\n  const g = global as Record<string, unknown>;\n\n  g[RUNTIME_FLAG_KEY] = true;\n\n  // Containers. Namespace mocks (secretmanager, …) are added to these by the\n  // corresponding `xMock()` on acquisition. `workflow` carries a default runner\n  // so `.trigger()` runs the real job chain locally without `mockWorkflow()`;\n  // `mockWorkflow()` overlays and restores it.\n  g.tailor = {\n    context: { getInvoker: defaultGetInvoker },\n    workflow: createDefaultWorkflowRuntime(),\n  };\n  g.tailordb = {};\n\n  g.TailorErrors = TailorErrorsMock;\n  g.TailorErrorMessage = TailorErrorMessageMock;\n  g.TailorDBFileError = TailorDBFileErrorMock;\n}\n\n/**\n * Remove the base platform globals (and anything the namespace mocks layered on\n * top, since they live under the same containers).\n * @param global - The global object to clean up (typically `globalThis`)\n */\nexport function cleanupPlatformGlobals(global: typeof globalThis): void {\n  const g = global as Record<string, unknown>;\n  delete g.tailordb;\n  delete g.tailor;\n  delete g.TailorErrors;\n  delete g.TailorErrorMessage;\n  delete g.TailorDBFileError;\n  delete g[RUNTIME_FLAG_KEY];\n}\n"],"mappings":";;;AAyBA,SAAgB,+BAAuD;CACrE,MAAM,oBAAgE,MAAM,SAC1E,iBAAiB,MAAM,IAAI;CAC7B,MAAM,iBAA0D,MAAM,SACpE,sBAAsB,MAAM,IAAI;CAClC,MAAM,0BAA6E,OACjF,gBACG;CACL,OAAO;EACL;EACA,oBAAoB;EACpB;EACA,iBAAiB;EACjB;EACA,gBAAgB;EAChB,OAAO,QAAyB;GAC9B,MAAM,IAAI,MACR,wBAAwB,IAAI,wDAC9B;EACF;EACA,SAAS,YAA2B;GAClC,MAAM,IAAI,MACR,6EACF;EACF;CACF;AACF;;;;;;;;;;;;;;;;;;;;;AC1BA,MAAa,mBAAmB;AAWhC,IAAM,mBAAN,cAA+B,MAAM;CACnC;CAEA,YAAY,QAA2B;EACrC,IAAI,CAAC,MAAM,QAAQ,MAAM,GACvB,MAAM,IAAI,UAAU,uCAAuC;EAE7D,MAAM,YAAY,OAAO,KAAK,GAAG,MAAM;GACrC,IAAI,OAAO,EAAE,YAAY,UACvB,MAAM,IAAI,UAAU,wBAAwB,EAAE,2BAA2B;GAE3E,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,GACvB,MAAM,IAAI,UAAU,wBAAwB,EAAE,wBAAwB;GAExE,OAAO;IAAE,SAAS,EAAE;IAAS,MAAM,EAAE;GAAK;EAC5C,CAAC;EAID,MAAM,iBAAiB,KAAK,UAAU,EAAE,QAAQ,UAAU,CAAC,GAAG;EAC9D,KAAK,OAAO;EACZ,KAAK,SAAS;CAChB;AACF;AAEA,IAAM,yBAAN,cAAqC,MAAM;CACzC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAEA,IAAM,wBAAN,cAAoC,MAAM;CACxC;CACA,AAAS;CAET,YAAY,SAAiB,MAA8B,OAAiB;EAC1E,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF;AASA,SAAS,oBAA2C;CAClD,OAAO;AACT;;;;;;;AAQA,SAAgB,uBAAuB,QAAiC;CACtE,MAAM,IAAI;CAEV,EAAE,oBAAoB;CAMtB,EAAE,SAAS;EACT,SAAS,EAAE,YAAY,kBAAkB;EACzC,UAAU,6BAA6B;CACzC;CACA,EAAE,WAAW,CAAC;CAEd,EAAE,eAAe;CACjB,EAAE,qBAAqB;CACvB,EAAE,oBAAoB;AACxB;;;;;;AAOA,SAAgB,uBAAuB,QAAiC;CACtE,MAAM,IAAI;CACV,OAAO,EAAE;CACT,OAAO,EAAE;CACT,OAAO,EAAE;CACT,OAAO,EAAE;CACT,OAAO,EAAE;CACT,OAAO,EAAE;AACX"}
+{"version":3,"file":"globals-DUqEetIh.mjs","names":[],"sources":["../src/vitest/workflow-runtime.ts","../src/vitest/globals.ts"],"sourcesContent":["// Default `tailor.workflow` runner installed by the `tailor-runtime` environment.\n// Must stay free of `vitest` (`vi`): it loads via `./globals` in the environment\n// realm where `vi` is unavailable, hence relative imports only (no `@/` alias).\nimport { runRegisteredJob, runRegisteredWorkflow } from \"../configure/services/workflow/registry\";\nimport type { StartJobFunctionOptions, StartWorkflowOptions } from \"../runtime/workflow\";\n\nexport interface DefaultWorkflowRuntime {\n  startJobFunction: (name: string, args?: unknown, options?: StartJobFunctionOptions) => unknown;\n  triggerJobFunction: (name: string, args?: unknown, options?: StartJobFunctionOptions) => unknown;\n  startWorkflow: (name: string, args?: unknown, options?: StartWorkflowOptions) => Promise<string>;\n  triggerWorkflow: (\n    name: string,\n    args?: unknown,\n    options?: StartWorkflowOptions,\n  ) => Promise<string>;\n  resumeWorkflowExecution: (executionId: string) => Promise<string>;\n  resumeWorkflow: (executionId: string) => Promise<string>;\n  wait: (key: string, payload?: unknown) => unknown;\n  resolve: (\n    executionId: string,\n    key: string,\n    callback: (payload: unknown) => unknown,\n  ) => Promise<void>;\n}\n\nexport function createDefaultWorkflowRuntime(): DefaultWorkflowRuntime {\n  const startJobFunction: DefaultWorkflowRuntime[\"startJobFunction\"] = (name, args) =>\n    runRegisteredJob(name, args);\n  const startWorkflow: DefaultWorkflowRuntime[\"startWorkflow\"] = (name, args) =>\n    runRegisteredWorkflow(name, args);\n  const resumeWorkflowExecution: DefaultWorkflowRuntime[\"resumeWorkflowExecution\"] = async (\n    executionId,\n  ) => executionId;\n  return {\n    startJobFunction,\n    triggerJobFunction: startJobFunction,\n    startWorkflow,\n    triggerWorkflow: startWorkflow,\n    resumeWorkflowExecution,\n    resumeWorkflow: resumeWorkflowExecution,\n    wait: (key: string): unknown => {\n      throw new Error(\n        `No wait handler for \"${key}\". Acquire mockWorkflow() and call setWaitHandler(...).`,\n      );\n    },\n    resolve: async (): Promise<void> => {\n      throw new Error(\n        \"No resolve handler. Acquire mockWorkflow() and call setResolveHandler(...).\",\n      );\n    },\n  };\n}\n","/**\n * Base platform globals for the tailor-runtime test environment.\n *\n * This module is intentionally free of any `vitest` (`vi`) dependency so it can\n * be imported from the Vitest *environment* module (which runs in a realm where\n * `vi` is not available). It installs only the always-present structural pieces:\n *\n * - `globalThis.tailor` / `globalThis.tailordb` container objects\n * - `globalThis.tailor.context.getInvoker` default stub\n * - the platform error classes (`TailorErrors`, `TailorErrorMessage`,\n *   `TailorDBFileError`)\n * - the `__tailorRuntimeActive` sentinel flag\n *\n * The per-namespace mock behavior (TailorDB client, workflow, secretmanager, …)\n * is installed on demand by the `xMock()` factories in `./mock`, which run in\n * test context where `vi` *is* available.\n */\n\nimport { createDefaultWorkflowRuntime } from \"./workflow-runtime\";\nimport type { ContextInvoker } from \"../runtime/context\";\nimport type { TailorDBFileErrorCode } from \"../runtime/file\";\n\n// Sentinel set when the tailor-runtime environment is active. setup.ts reads it\n// to decide whether to run its blocked-globals lifecycle and config-secret\n// loading.\nexport const RUNTIME_FLAG_KEY = \"__tailorRuntimeActive\";\n\n// ---------------------------------------------------------------------------\n// Error class mocks\n// ---------------------------------------------------------------------------\n\ninterface TailorErrorItem {\n  message: string;\n  path: (string | number)[];\n}\n\nclass TailorErrorsMock extends Error {\n  errors: TailorErrorItem[];\n\n  constructor(errors: TailorErrorItem[]) {\n    if (!Array.isArray(errors)) {\n      throw new TypeError(\"TailorErrors: errors must be an array\");\n    }\n    const validated = errors.map((e, i) => {\n      if (typeof e.message !== \"string\") {\n        throw new TypeError(`TailorErrors: errors[${i}].message must be a string`);\n      }\n      if (!Array.isArray(e.path)) {\n        throw new TypeError(`TailorErrors: errors[${i}].path must be an array`);\n      }\n      return { message: e.message, path: e.path };\n    });\n    // Match the PF runtime's TailorErrors serialization, which prefixes the\n    // JSON payload with \"TailorErrors: \". Other SDK code (e.g. apply\n    // integration fixtures) strips this prefix before JSON.parse.\n    super(`TailorErrors: ${JSON.stringify({ errors: validated })}`);\n    this.name = \"TailorErrors\";\n    this.errors = validated;\n  }\n}\n\nclass TailorErrorMessageMock extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"TailorErrorMessage\";\n  }\n}\n\nclass TailorDBFileErrorMock extends Error {\n  code?: TailorDBFileErrorCode;\n  override cause: unknown;\n\n  constructor(message: string, code?: TailorDBFileErrorCode, cause?: unknown) {\n    super(message);\n    this.name = \"TailorDBFileError\";\n    this.code = code;\n    this.cause = cause;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Base install / cleanup\n// ---------------------------------------------------------------------------\n\n// Stub-only injection. SDK consumers configure invokers at the body level\n// (resolver/executor/workflow `.body()` `invoker` arg) or, for bundled tests,\n// via `vi.spyOn(globalThis.tailor.context, \"getInvoker\")`.\nfunction defaultGetInvoker(): ContextInvoker | null {\n  return null;\n}\n\n// No-op logger stub so `tailor.logger.*` calls in code under test don't throw\n// without an explicit `mockLogger()`. `mockLogger()` overlays vi.fn spies and\n// restores this on dispose.\nfunction noop(): void {}\nconst defaultLogger = {\n  debug: noop,\n  info: noop,\n  warn: noop,\n  error: noop,\n  setAttributes: noop,\n};\n\n/**\n * Install the always-present base platform globals (containers, context stub,\n * error classes, runtime flag). Per-namespace mocks are layered on top by the\n * `xMock()` factories in `./mock`.\n *\n * Acquire with a `using` declaration and the globals are removed when the\n * scope exits; alternatively call `cleanupPlatformGlobals` yourself.\n * @param global - The global object to install into (typically `globalThis`)\n * @returns A `Disposable` that removes the installed globals\n */\nexport function installPlatformGlobals(global: typeof globalThis): Disposable {\n  const g = global as Record<string, unknown>;\n\n  g[RUNTIME_FLAG_KEY] = true;\n\n  // Containers. Namespace mocks (secretmanager, …) are added to these by the\n  // corresponding `xMock()` on acquisition. `workflow` carries a default runner\n  // so `.trigger()` runs the real job chain locally without `mockWorkflow()`;\n  // `mockWorkflow()` overlays and restores it.\n  g.tailor = {\n    context: { getInvoker: defaultGetInvoker },\n    workflow: createDefaultWorkflowRuntime(),\n    logger: { ...defaultLogger },\n  };\n  g.tailordb = {};\n\n  g.TailorErrors = TailorErrorsMock;\n  g.TailorErrorMessage = TailorErrorMessageMock;\n  g.TailorDBFileError = TailorDBFileErrorMock;\n\n  return {\n    [Symbol.dispose]() {\n      cleanupPlatformGlobals(global);\n    },\n  };\n}\n\n/**\n * Remove the base platform globals (and anything the namespace mocks layered on\n * top, since they live under the same containers).\n * @param global - The global object to clean up (typically `globalThis`)\n */\nexport function cleanupPlatformGlobals(global: typeof globalThis): void {\n  const g = global as Record<string, unknown>;\n  delete g.tailordb;\n  delete g.tailor;\n  delete g.TailorErrors;\n  delete g.TailorErrorMessage;\n  delete g.TailorDBFileError;\n  delete g[RUNTIME_FLAG_KEY];\n}\n"],"mappings":";;;AAyBA,SAAgB,+BAAuD;CACrE,MAAM,oBAAgE,MAAM,SAC1E,iBAAiB,MAAM,IAAI;CAC7B,MAAM,iBAA0D,MAAM,SACpE,sBAAsB,MAAM,IAAI;CAClC,MAAM,0BAA6E,OACjF,gBACG;CACL,OAAO;EACL;EACA,oBAAoB;EACpB;EACA,iBAAiB;EACjB;EACA,gBAAgB;EAChB,OAAO,QAAyB;GAC9B,MAAM,IAAI,MACR,wBAAwB,IAAI,wDAC9B;EACF;EACA,SAAS,YAA2B;GAClC,MAAM,IAAI,MACR,6EACF;EACF;CACF;AACF;;;;;;;;;;;;;;;;;;;;;AC1BA,MAAa,mBAAmB;AAWhC,IAAM,mBAAN,cAA+B,MAAM;CACnC;CAEA,YAAY,QAA2B;EACrC,IAAI,CAAC,MAAM,QAAQ,MAAM,GACvB,MAAM,IAAI,UAAU,uCAAuC;EAE7D,MAAM,YAAY,OAAO,KAAK,GAAG,MAAM;GACrC,IAAI,OAAO,EAAE,YAAY,UACvB,MAAM,IAAI,UAAU,wBAAwB,EAAE,2BAA2B;GAE3E,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,GACvB,MAAM,IAAI,UAAU,wBAAwB,EAAE,wBAAwB;GAExE,OAAO;IAAE,SAAS,EAAE;IAAS,MAAM,EAAE;GAAK;EAC5C,CAAC;EAID,MAAM,iBAAiB,KAAK,UAAU,EAAE,QAAQ,UAAU,CAAC,GAAG;EAC9D,KAAK,OAAO;EACZ,KAAK,SAAS;CAChB;AACF;AAEA,IAAM,yBAAN,cAAqC,MAAM;CACzC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAEA,IAAM,wBAAN,cAAoC,MAAM;CACxC;CACA,AAAS;CAET,YAAY,SAAiB,MAA8B,OAAiB;EAC1E,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF;AASA,SAAS,oBAA2C;CAClD,OAAO;AACT;AAKA,SAAS,OAAa,CAAC;AACvB,MAAM,gBAAgB;CACpB,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACP,eAAe;AACjB;;;;;;;;;;;AAYA,SAAgB,uBAAuB,QAAuC;CAC5E,MAAM,IAAI;CAEV,EAAE,oBAAoB;CAMtB,EAAE,SAAS;EACT,SAAS,EAAE,YAAY,kBAAkB;EACzC,UAAU,6BAA6B;EACvC,QAAQ,EAAE,GAAG,cAAc;CAC7B;CACA,EAAE,WAAW,CAAC;CAEd,EAAE,eAAe;CACjB,EAAE,qBAAqB;CACvB,EAAE,oBAAoB;CAEtB,OAAO,EACL,CAAC,OAAO,WAAW;EACjB,uBAAuB,MAAM;CAC/B,EACF;AACF;;;;;;AAOA,SAAgB,uBAAuB,QAAiC;CACtE,MAAM,IAAI;CACV,OAAO,EAAE;CACT,OAAO,EAAE;CACT,OAAO,EAAE;CACT,OAAO,EAAE;CACT,OAAO,EAAE;CACT,OAAO,EAAE;AACX"}

package/dist/logger-B-fqZe2W.mjs

@@ -0,0 +1,50 @@
+import { t as __exportAll } from "./rolldown-runtime-DXywRVcq.mjs";
+
+//#region src/runtime/logger.ts
+var logger_exports = /* @__PURE__ */ __exportAll({
+	debug: () => debug,
+	error: () => error,
+	info: () => info,
+	setAttributes: () => setAttributes,
+	warn: () => warn
+});
+const api = () => globalThis.tailor.logger;
+/**
+* See {@link TailorLoggerAPI.debug}.
+* @param args - Forwarded to {@link TailorLoggerAPI.debug}
+*/
+const debug = (...args) => {
+	api().debug(...args);
+};
+/**
+* See {@link TailorLoggerAPI.info}.
+* @param args - Forwarded to {@link TailorLoggerAPI.info}
+*/
+const info = (...args) => {
+	api().info(...args);
+};
+/**
+* See {@link TailorLoggerAPI.warn}.
+* @param args - Forwarded to {@link TailorLoggerAPI.warn}
+*/
+const warn = (...args) => {
+	api().warn(...args);
+};
+/**
+* See {@link TailorLoggerAPI.error}.
+* @param args - Forwarded to {@link TailorLoggerAPI.error}
+*/
+const error = (...args) => {
+	api().error(...args);
+};
+/**
+* See {@link TailorLoggerAPI.setAttributes}.
+* @param args - Forwarded to {@link TailorLoggerAPI.setAttributes}
+*/
+const setAttributes = (...args) => {
+	api().setAttributes(...args);
+};
+
+//#endregion
+export { setAttributes as a, logger_exports as i, error as n, warn as o, info as r, debug as t };
+//# sourceMappingURL=logger-B-fqZe2W.mjs.map

package/dist/logger-B-fqZe2W.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger-B-fqZe2W.mjs","names":[],"sources":["../src/runtime/logger.ts"],"sourcesContent":["/**\n * Structured logging utilities.\n *\n * Thin typed wrapper around the platform-provided `tailor.logger` runtime API.\n * At runtime this delegates to `globalThis.tailor.logger`. Use `mockLogger`\n * from `@tailor-platform/sdk/vitest` to mock these calls in unit tests.\n *\n * Unlike `console.*`, each call carries a severity and structured attributes.\n * The message is written to standard output, and the full entry with its\n * attributes is exported over OpenTelemetry, where the attributes are queryable.\n * @example\n * import { logger } from \"@tailor-platform/sdk/runtime\";\n *\n * logger.setAttributes({ requestId: \"r-123\" });\n * logger.info(\"order processed\", { orderId: \"o-1\", total: 99.5 });\n */\n\n/**\n * A single log attribute value. Values outside this union (`null`, nested\n * objects, mixed-type arrays) are silently dropped by the platform.\n */\nexport type LogAttributeValue =\n  | string\n  | number\n  | boolean\n  | readonly string[]\n  | readonly number[]\n  | readonly boolean[];\n\n/**\n * Structured attributes attached to a log entry. The platform keeps at most 32\n * entries, drops any entry whose key exceeds 128 bytes, and truncates string\n * values over 4096 bytes and arrays over 64 elements.\n */\nexport type LogAttributes = Record<string, LogAttributeValue>;\n\n/**\n * Platform API surface for `tailor.logger`. Describes the shape the platform\n * runtime injects on `globalThis.tailor.logger`.\n *\n * Each method below is also re-exported as a top-level named export from this\n * module so callers can either `import * as logger from\n * \"@tailor-platform/sdk/runtime/logger\"` or pick individual methods.\n */\nexport interface TailorLoggerAPI {\n  /**\n   * Emits a `debug`-severity log entry.\n   * @param message - The log message\n   * @param attributes - Structured attributes to attach to this entry\n   */\n  debug(message: string, attributes?: LogAttributes): void;\n\n  /**\n   * Emits an `info`-severity log entry.\n   * @param message - The log message\n   * @param attributes - Structured attributes to attach to this entry\n   */\n  info(message: string, attributes?: LogAttributes): void;\n\n  /**\n   * Emits a `warn`-severity log entry.\n   * @param message - The log message\n   * @param attributes - Structured attributes to attach to this entry\n   */\n  warn(message: string, attributes?: LogAttributes): void;\n\n  /**\n   * Emits an `error`-severity log entry.\n   * @param message - The log message\n   * @param attributes - Structured attributes to attach to this entry\n   */\n  error(message: string, attributes?: LogAttributes): void;\n\n  /**\n   * Merges attributes into every subsequent log entry from the current\n   * execution. Later keys overwrite earlier ones; per-call attributes passed to\n   * `debug`/`info`/`warn`/`error` take precedence.\n   * @param attributes - Attributes to attach to subsequent entries\n   */\n  setAttributes(attributes: LogAttributes): void;\n}\n\nconst api = (): TailorLoggerAPI =>\n  (globalThis as { tailor: { logger: TailorLoggerAPI } }).tailor.logger;\n\n/**\n * See {@link TailorLoggerAPI.debug}.\n * @param args - Forwarded to {@link TailorLoggerAPI.debug}\n */\nexport const debug: TailorLoggerAPI[\"debug\"] = (...args) => {\n  api().debug(...args);\n};\n\n/**\n * See {@link TailorLoggerAPI.info}.\n * @param args - Forwarded to {@link TailorLoggerAPI.info}\n */\nexport const info: TailorLoggerAPI[\"info\"] = (...args) => {\n  api().info(...args);\n};\n\n/**\n * See {@link TailorLoggerAPI.warn}.\n * @param args - Forwarded to {@link TailorLoggerAPI.warn}\n */\nexport const warn: TailorLoggerAPI[\"warn\"] = (...args) => {\n  api().warn(...args);\n};\n\n/**\n * See {@link TailorLoggerAPI.error}.\n * @param args - Forwarded to {@link TailorLoggerAPI.error}\n */\nexport const error: TailorLoggerAPI[\"error\"] = (...args) => {\n  api().error(...args);\n};\n\n/**\n * See {@link TailorLoggerAPI.setAttributes}.\n * @param args - Forwarded to {@link TailorLoggerAPI.setAttributes}\n */\nexport const setAttributes: TailorLoggerAPI[\"setAttributes\"] = (...args) => {\n  api().setAttributes(...args);\n};\n"],"mappings":";;;;;;;;;;AAkFA,MAAM,YACH,WAAuD,OAAO;;;;;AAMjE,MAAa,SAAmC,GAAG,SAAS;CAC1D,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI;AACrB;;;;;AAMA,MAAa,QAAiC,GAAG,SAAS;CACxD,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI;AACpB;;;;;AAMA,MAAa,QAAiC,GAAG,SAAS;CACxD,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI;AACpB;;;;;AAMA,MAAa,SAAmC,GAAG,SAAS;CAC1D,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI;AACrB;;;;;AAMA,MAAa,iBAAmD,GAAG,SAAS;CAC1E,IAAI,CAAC,CAAC,cAAc,GAAG,IAAI;AAC7B"}

package/dist/{register-typescript-runtime-Bd4bcLbW.mjs → register-typescript-runtime-QAWucsg0.mjs}

@@ -1,8 +1,8 @@
 import { t as db } from "./schema-CYrle8JZ.mjs";
-import { $ as CreateAuthIDPConfigRequestSchema, A as CreatePipelineResolverRequestSchema, At as TenantProviderConfig_TenantProviderType, B as IdPPermissionOperator, Bt as CreateAIGatewayRequestSchema, C as UpdateStaticWebsiteRequestSchema, Ct as AuthOAuth2Client_ClientType, D as CreateSecretManagerVaultRequestSchema, Dt as AuthSCIMAttribute_Uniqueness, E as CreateSecretManagerSecretRequestSchema, Et as AuthSCIMAttribute_Type, F as PipelineResolver_OperationType, Ft as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, G as CreateExecutorExecutorRequestSchema, Gt as ConditionSchema, H as FunctionExecution_Status, I as CreateIdPServiceRequestSchema, It as UpdateApplicationRequestSchema, J as ExecutorJobStatus, Jt as PageDirection, K as UpdateExecutorExecutorRequestSchema, Kt as Condition_Operator, L as UpdateIdPServiceRequestSchema, M as UpdatePipelineResolverRequestSchema, N as UpdatePipelineServiceRequestSchema, O as UpdateSecretManagerSecretRequestSchema, Ot as AuthSCIMConfig_AuthorizationType, Pt as CreateApplicationRequestSchema, Q as CreateAuthHookRequestSchema, Rt as ApplicationSchemaUpdateAttemptStatus, S as CreateStaticWebsiteRequestSchema, St as AuthInvokerSchema, Tt as AuthSCIMAttribute_Mutability, V as IdPPermissionPermit, Vt as UpdateAIGatewayRequestSchema, X as ExecutorTriggerType, Y as ExecutorTargetType, Z as CreateAuthConnectionRequestSchema, _ as TailorDBGQLPermission_Permit, a as CreateWorkflowRequestSchema, at as CreateTenantConfigRequestSchema, b as TailorDBType_PermitAction, bt as AuthHookPoint, ct as UpdateAuthHookRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as UpdateAuthOAuth2ClientRequestSchema, et as CreateAuthMachineUserRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as UpdateAuthSCIMConfigRequestSchema, g as TailorDBGQLPermission_Operator, gt as UpdateUserProfileConfigRequestSchema, h as TailorDBGQLPermission_Action, ht as UpdateTenantConfigRequestSchema, i as CreateWorkflowJobFunctionRequestSchema, it as CreateAuthServiceRequestSchema, j as CreatePipelineServiceRequestSchema, jt as UserProfileProviderConfig_UserProfileProviderType, l as WorkflowExecution_Status, lt as UpdateAuthIDPConfigRequestSchema, mt as UpdateAuthServiceRequestSchema, nt as CreateAuthSCIMConfigRequestSchema, o as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as CreateUserProfileConfigRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as UpdateAuthSCIMResourceRequestSchema, qt as FilterSchema, r as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, rt as CreateAuthSCIMResourceRequestSchema, s as UpdateWorkflowRequestSchema, st as UpdateAuthConnectionRequestSchema, t as WorkspacePlatformUserRole, tt as CreateAuthOAuth2ClientRequestSchema, u as WorkflowJobExecution_Status, ut as UpdateAuthMachineUserRequestSchema, v as TailorDBType_Permission_Operator, vt as AuthConnection_Status, wt as AuthOAuth2Client_GrantType, x as AddCustomDomainRequestSchema, xt as AuthIDPConfig_AuthType, y as TailorDBType_Permission_Permit, yt as AuthConnection_Type, z as IdPLang, zt as Subgraph_ServiceType } from "./workspace_resource_pb-Db3fv68L.mjs";
+import { $ as CreateAuthHookRequestSchema, B as IdPLang, Bt as Subgraph_ServiceType, C as CreateStaticWebsiteRequestSchema, Ct as AuthInvokerSchema, D as CreateSecretManagerSecretRequestSchema, Dt as AuthSCIMAttribute_Type, Et as AuthSCIMAttribute_Mutability, Ft as CreateApplicationRequestSchema, H as IdPPermissionPermit, Ht as UpdateAIGatewayRequestSchema, I as PipelineResolver_OperationType, It as GetApplicationSchemaHealthResponse_ApplicationSchemaHealthStatus, Jt as FilterSchema, K as CreateExecutorExecutorRequestSchema, Kt as ConditionSchema, L as CreateIdPServiceRequestSchema, Lt as UpdateApplicationRequestSchema, M as CreatePipelineServiceRequestSchema, Mt as UserProfileProviderConfig_UserProfileProviderType, N as UpdatePipelineResolverRequestSchema, O as CreateSecretManagerVaultRequestSchema, Ot as AuthSCIMAttribute_Uniqueness, P as UpdatePipelineServiceRequestSchema, Q as CreateAuthConnectionRequestSchema, R as UpdateIdPServiceRequestSchema, S as AddCustomDomainRequestSchema, St as AuthIDPConfig_AuthType, Tt as AuthOAuth2Client_GrantType, U as FunctionExecution_Status, V as IdPPermissionOperator, Vt as CreateAIGatewayRequestSchema, X as ExecutorTargetType, Y as ExecutorJobStatus, Yt as PageDirection, Z as ExecutorTriggerType, _ as TailorDBGQLPermission_Permit, _t as UpdateUserProfileConfigRequestSchema, a as CreateWorkflowRequestSchema, at as CreateAuthServiceRequestSchema, b as TailorDBType_Permission_Permit, bt as AuthConnection_Type, ct as UpdateAuthConnectionRequestSchema, d as CreateTailorDBServiceRequestSchema, dt as UpdateAuthMachineUserRequestSchema, et as CreateAuthIDPConfigRequestSchema, f as CreateTailorDBTypeRequestSchema, ft as UpdateAuthOAuth2ClientRequestSchema, g as TailorDBGQLPermission_Operator, gt as UpdateTenantConfigRequestSchema, h as TailorDBGQLPermission_Action, ht as UpdateAuthServiceRequestSchema, i as CreateWorkflowJobFunctionRequestSchema, it as CreateAuthSCIMResourceRequestSchema, j as CreatePipelineResolverRequestSchema, jt as TenantProviderConfig_TenantProviderType, k as UpdateSecretManagerSecretRequestSchema, kt as AuthSCIMConfig_AuthorizationType, l as WorkflowExecution_Status, lt as UpdateAuthHookRequestSchema, mt as UpdateAuthSCIMResourceRequestSchema, nt as CreateAuthOAuth2ClientRequestSchema, o as UpdateWorkflowJobFunctionExecutionPolicyRequestSchema, ot as CreateTenantConfigRequestSchema, p as UpdateTailorDBTypeRequestSchema, pt as UpdateAuthSCIMConfigRequestSchema, q as UpdateExecutorExecutorRequestSchema, qt as Condition_Operator, r as CreateWorkflowJobFunctionExecutionPolicyRequestSchema, rt as CreateAuthSCIMConfigRequestSchema, s as UpdateWorkflowRequestSchema, st as CreateUserProfileConfigRequestSchema, t as WorkspacePlatformUserRole, tt as CreateAuthMachineUserRequestSchema, u as WorkflowJobExecution_Status, ut as UpdateAuthIDPConfigRequestSchema, v as TailorDBTypeSchema, w as UpdateStaticWebsiteRequestSchema, wt as AuthOAuth2Client_ClientType, x as TailorDBType_PermitAction, xt as AuthHookPoint, y as TailorDBType_Permission_Operator, yt as AuthConnection_Status, zt as ApplicationSchemaUpdateAttemptStatus } from "./workspace_resource_pb-UGK1SSn_.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
 import { a as parseBoolean, i as symbols, n as logger, r as styles, t as CIPromptError } from "./logger-BwS4ppwO.mjs";
-import { A as fetchAll, B as initOAuth2Client, C as hasGenerationHooks, D as hashFile, E as hashContent, G as resolveStaticWebsiteUrls, H as isDefaultPlatform, I as getConsoleBaseUrl, J as LOG_LEVELS, K as byName, L as getOAuth2ClientId, M as fetchMachineUserToken, N as fetchPaged, R as getOrNull, S as getPluginGenerationDependencies, T as getDistDir, U as normalizeBaseUrl, V as initOperatorClient, W as rememberPlatformConfigForToken, _ as resolveTSConfigWithFallback, d as buildExecutorArgsExpr, f as buildResolverOperationHookExpr, g as stringifyFunction, h as TailorDBTypeSchema, i as resolverBundleKey, j as fetchAllTolerant, k as defaultPlatformBaseUrl, l as HTTP_METHODS, m as assertUniqueTailorDBTypeNamesWithExternal, n as generatePluginFilesIfNeeded, o as WorkflowJobFunctionExecutionPolicySchema, p as assertUniqueLocalTailorDBTypeNames, q as createApplyLimiter, r as loadApplication, t as defineApplication, v as platformBundleDefinePlugin, w as createBundleCache, z as getPlatformBaseUrl } from "./application-C1d52JP9.mjs";
+import { A as defaultPlatformBaseUrl, B as getPlatformBaseUrl, C as getPluginGenerationDependencies, D as hashContent, E as getDistDir, G as rememberPlatformConfigForToken, H as initOperatorClient, J as createApplyLimiter, K as resolveStaticWebsiteUrls, L as getConsoleBaseUrl, M as fetchAllTolerant, N as fetchMachineUserToken, O as hashFile, P as fetchPaged, R as getOAuth2ClientId, T as createBundleCache, U as isDefaultPlatform, V as initOAuth2Client, W as normalizeBaseUrl, Y as LOG_LEVELS, _ as stringifyFunction, d as buildExecutorArgsExpr, f as buildResolverOperationHookExpr, g as TailorDBTypeSchema$1, h as assertUniqueTailorDBTypeNamesWithExternal, i as resolverBundleKey, j as fetchAll, l as HTTP_METHODS, m as assertUniqueLocalTailorDBTypeNames, n as generatePluginFilesIfNeeded, o as WorkflowJobFunctionExecutionPolicySchema, q as byName, r as loadApplication, t as defineApplication, v as resolveTSConfigWithFallback, w as hasGenerationHooks, y as platformBundleDefinePlugin, z as getOrNull } from "./application-DDe0er6L.mjs";
 import { o as loadFilesWithIgnores, s as functionSchema, t as createExecutorService } from "./service-CDPatibu.mjs";
 import { n as enumConstantsPlugin, t as EnumConstantsGeneratorID } from "./enum-constants-j9QBF0cB.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
@@ -2096,6 +2096,21 @@ function formatPlanSummary(summary) {
 //#endregion
 //#region src/cli/commands/deploy/compare.ts
 /**
+* Canonicalize a proto message (or init shape) into proto JSON for comparison.
+*
+* Deserialized messages materialize implicit proto3 fields with their zero
+* values while locally built init shapes omit them, so comparing the raw
+* objects reports a diff for every field the SDK does not set — including
+* fields newly added to the proto. Proto JSON omits implicit zero values on
+* both sides, which matches wire semantics (unset == zero value).
+* @param schema - Message schema describing the value
+* @param value - Message or init shape to canonicalize
+* @returns Proto JSON representation of the value
+*/
+function toComparableProtoJson(schema, value) {
+	return toJson(schema, create(schema, value));
+}
+/**
 * Stable JSON-like serialization that sorts object keys and ignores proto runtime metadata.
 * @param value - Value to serialize
 * @returns Stable serialized string
@@ -4078,8 +4093,8 @@ function normalizeComparableUserAuthPolicy(policy) {
 		passwordRequireLowercase: policy?.passwordRequireLowercase ?? false,
 		passwordRequireNonAlphanumeric: policy?.passwordRequireNonAlphanumeric ?? false,
 		passwordRequireNumeric: policy?.passwordRequireNumeric ?? false,
-		passwordMinLength: policy?.passwordMinLength ?? 0,
-		passwordMaxLength: policy?.passwordMaxLength ?? 0,
+		passwordMinLength: policy?.passwordMinLength || 6,
+		passwordMaxLength: policy?.passwordMaxLength || 4096,
 		allowedEmailDomains: (policy?.allowedEmailDomains ?? []).toSorted(),
 		allowGoogleOauth: policy?.allowGoogleOauth ?? false,
 		disablePasswordAuth: policy?.disablePasswordAuth ?? false,
@@ -10211,6 +10226,21 @@ async function applyTailorDB(client, result, phase = "create-update") {
 			deletedResources.reset();
 			migrationSnapshotCache.reset();
 			await executeServicesCreation(client, changeSet);
+			const migratingNamespaces = new Set(pendingMigrations.map((m) => m.namespace));
+			const isOutsideMigrations = (namespaceName) => namespaceName !== void 0 && !migratingNamespaces.has(namespaceName);
+			try {
+				for (const create of changeSet.type.creates) {
+					if (!isOutsideMigrations(create.request.namespaceName)) continue;
+					await client.createTailorDBType(create.request);
+				}
+				for (const update of changeSet.type.updates) {
+					if (!isOutsideMigrations(update.request.namespaceName)) continue;
+					await client.updateTailorDBType(update.request);
+				}
+			} catch (error) {
+				handleOptionalToRequiredError(error, ["Run 'tailor-sdk tailordb migration generate' to create migration files.", "Migration scripts allow you to handle existing data before applying the schema change."]);
+			}
+			await Promise.all([...changeSet.gqlPermission.creates.filter((create) => isOutsideMigrations(create.request.namespaceName)).map((create) => client.createTailorDBGQLPermission(create.request)), ...changeSet.gqlPermission.updates.filter((update) => isOutsideMigrations(update.request.namespaceName)).map((update) => client.updateTailorDBGQLPermission(update.request))]);
 			const migrationsRequiringScripts = pendingMigrations.filter((m) => m.hasScript);
 			const migrationCtx = migrationsRequiringScripts.length > 0 ? buildMigrationContextForScripts(client, migrationContext, migrationsRequiringScripts) : void 0;
 			if (migrationsRequiringScripts.length > 0) {
@@ -10241,6 +10271,7 @@ async function applyTailorDB(client, result, phase = "create-update") {
 				return !deletedResources.gqlPermissions.has(permKey);
 			});
 			if (remainingGqlPermissionDeletes.length > 0) await Promise.all(remainingGqlPermissionDeletes.map((del) => client.deleteTailorDBGQLPermission(del.request)));
+			await Promise.all(changeSet.type.deletes.filter((del) => isOutsideMigrations(del.request.namespaceName) && !deletedResources.types.has(del.name)).map((del) => client.deleteTailorDBType(del.request)));
 		} else {
 			await Promise.all([...changeSet.service.creates.map(async (create) => {
 				await client.createTailorDBService(create.request);
@@ -10840,7 +10871,7 @@ const tailordbCompareKnownDefaults = {
 	])
 };
 function normalizeComparableTailorDBType(type) {
-	const normalized = normalizeProtoConfig(type);
+	const normalized = normalizeProtoConfig(toComparableProtoJson(TailorDBTypeSchema, type));
 	return normalizeTailorDBCompareValue({
 		name: normalized?.name ?? "",
 		schema: {
@@ -10866,7 +10897,7 @@ function normalizeTailorDBCompareValue(value, path) {
 	const normalizedEntries = Object.entries(value).map(([key, entryValue]) => [key, normalizeTailorDBCompareValue(entryValue, [...path, key])]).filter(([, entryValue]) => entryValue !== void 0);
 	const normalizedObject = Object.fromEntries(normalizedEntries);
 	if (path.at(-1) === "fields" && Object.keys(normalizedObject).length === 0) return;
-	if (path.at(-1) === "disableGqlOperations" && areNormalizedEqual(normalizedObject, tailordbCompareKnownDefaults.disableGqlOperations)) return;
+	if (path.at(-1) === "disableGqlOperations" && (Object.keys(normalizedObject).length === 0 || areNormalizedEqual(normalizedObject, tailordbCompareKnownDefaults.disableGqlOperations))) return;
 	return normalizedObject;
 }
 function matchesNumericStringPath(path) {
@@ -18922,7 +18953,7 @@ async function generate(options) {
 	if (options.init) await handleInitOption(namespacesWithMigrations, options.yes);
 	let pluginManager;
 	if (plugins.length > 0) pluginManager = new PluginManager(plugins);
-	const { defineApplication } = await import("./application-Nlh9BHQf.mjs");
+	const { defineApplication } = await import("./application-B1_7Wm37.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -20402,7 +20433,7 @@ async function loadTypeFieldOrder(config, namespace) {
 		try {
 			const module = await import(pathToFileURL(typeFile).href);
 			for (const exportedValue of Object.values(module)) {
-				const result = TailorDBTypeSchema.safeParse(exportedValue);
+				const result = TailorDBTypeSchema$1.safeParse(exportedValue);
 				if (!result.success) continue;
 				fieldOrder.set(result.data.name, Object.keys(result.data.fields));
 			}
@@ -21051,4 +21082,4 @@ async function registerTypeScriptRuntime(hookUrl) {
 
 //#endregion
 export { listFolders as $, deploymentArgs as $n, handleOptionalToRequiredError as $t, generate as A, generateUserTypes as An, startCommand as At, remove as B, loadConsoleBaseUrl as Bn, deploy as Bt, waitWorkflowExecution as C, formatDiffSummary as Cn, listCommand$8 as Ct, listWorkflows as D, resourceTrn as Dn, jobsCommand as Dt, listCommand$2 as E, getNamespacesWithMigrations as En, getExecutorWaitFailureMessage as Et, openInConfiguredEditor as F, deleteUserTokens as Fn, getWorkflowExecution as Ft, treeCommand as G, readPlatformConfig as Gn, createWorkspace$1 as Gt, updateCommand$1 as H, loadStoredUserTokens as Hn, listCommand$9 as Ht, show as I, fetchLatestToken as In, listWorkflowExecutions as It, getCommand$1 as J, writePlatformConfig as Jn, ensureConfigId as Jt, listCommand$3 as K, resolveUserTokenKey as Kn, formatKeyValueTable as Kt, showCommand as L, hasAnyUserTokenEntry as Ln, functionExecutionStatusToString as Lt, generateMigrationScript as M, apiCall as Mn, getCommand$5 as Mt, writeDbTypesFile as N, assertWritable as Nn, getWorkflow as Nt, truncate as O, sdkNameLabelKey as On, listExecutorJobs as Ot, getConfiguredEditorCommand as P, loadConfig as Pn, executionsCommand as Pt, listCommand$4 as Q, confirmationArgs as Qn, MIGRATION_LABEL_KEY as Qt, extractOwnedNamespaces as R, hasUserTokenEntry as Rn, getCommand$6 as Rt, waitCommand as S, parseMigrationNumberArg as Sn, triggerExecutor as St, resumeWorkflow as T, hasChanges as Tn, getExecutorJob as Tt, updateOrganization as U, loadWorkspaceId as Un, listWorkspaces as Ut, removeCommand$1 as V, loadMachineUserName as Vn, deployFromCLI as Vt, organizationTree as W, platformConfigFromProfile as Wn, createCommand$1 as Wt, updateCommand$2 as X, commonArgs as Xn, waitForExecution as Xt, getOrganization as Y, defineAppCommand as Yn, executeScript as Yt, updateFolder as Z, configArg as Zn, bundleMigrationScript as Zt, deleteWorkspace as _, getNextMigrationNumber as _n, getCommand$4 as _t, updateUser as a, DIFF_FILE_NAME as an, toPageDirection as ar, createFolder as at, getAppHealth as b, reconstructSnapshotFromMigrations as bn, webhookCommand as bt, listCommand as c, SCHEMA_FILE_NAME as cn, getCommand$3 as ct, inviteUser as d, compareSnapshots as dn, tokenCommand as dt, parseMigrationLabelNumber as en, isVerbose as er, getCommand$2 as et, restoreCommand as f, createSnapshotFromLocalTypes as fn, listCommand$6 as ft, deleteCommand as g, getMigrationFiles as gn, listFunctionRegistries as gt, getWorkspace as h, getMigrationFilePath as hn, listCommand$7 as ht, updateCommand as i, DB_TYPES_FILE_NAME as in, resolveMachineUserInputSource as ir, createCommand as it, generateCommand as j, prompt as jn, startWorkflow as jt, truncateCommand as k, PluginManager as kn, watchExecutorJob as kt, listUsers as l, assertValidMigrationFiles as ln, getOAuth2Client as lt, getCommand as m, getMigrationDirPath as mn, generate$1 as mt, query as n, generateAllTypeManifestsFromSnapshot as nn, pagedLogArgs as nr, deleteCommand$1 as nt, removeCommand as o, INITIAL_SCHEMA_NUMBER as on, workspaceArgs as or, listCommand$5 as ot, restoreWorkspace as p, getLatestMigrationNumber as pn, listMachineUsers as pt, listOrganizations as q, saveUserTokens as qn, workspaceNameSchema as qt, queryCommand as r, protoGqlPermission as rn, paginationArgs as rr, deleteFolder as rt, removeUser as s, MIGRATE_FILE_NAME as sn, listOAuth2Clients as st, registerTypeScriptRuntime as t, compareSnapshotWithRemote as tn, multiConfigArg as tr, getFolder as tt, inviteCommand as u, compareLocalTypesWithSnapshot as un, getMachineUserToken as ut, listApps as v, isValidMigrationNumber as vn, getFunctionRegistry as vt, resumeCommand as w, formatMigrationDiff as wn, listExecutors as wt, healthCommand as x, formatMigrationNumber as xn, triggerCommand as xt, listCommand$1 as y, loadDiff as yn, listWebhookExecutors as yt, logBetaWarning as z, loadAccessToken as zn, getExecutor as zt };
-//# sourceMappingURL=register-typescript-runtime-Bd4bcLbW.mjs.map
+//# sourceMappingURL=register-typescript-runtime-QAWucsg0.mjs.map