@tailor-platform/sdk 1.85.1 → 1.85.3

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @tailor-platform/sdk
 
+## 1.85.3
+
+### Patch Changes
+
+- [#2642](https://github.com/tailor-platform/sdk/pull/2642) [`0806be7`](https://github.com/tailor-platform/sdk/commit/0806be713533a3d67aa56c0a5b5a6e33657dbc12) Thanks [@dqn](https://github.com/dqn)! - Find types in TailorDB namespaces with more than 50 types in `tailor-sdk tailordb truncate <types...>`, and in `tailor-sdk query --engine sql` for apps with more than one TailorDB namespace. Types created after the first 50 in a namespace were reported as `The following types were not found in any namespace` or `Could not find namespace for types in query`. When listing a namespace's types fails, both commands now stop with that error instead of skipping that namespace and continuing with the others.
+
+## 1.85.2
+
+### Patch Changes
+
+- [#2592](https://github.com/tailor-platform/sdk/pull/2592) [`9e4a644`](https://github.com/tailor-platform/sdk/commit/9e4a644807dae43f42f5cf0f2ccaaa7f3bfe0651) Thanks [@k1LoW](https://github.com/k1LoW)! - Fix function execution logs coming back empty. The logs that `tailor-sdk function test-run`, `function logs`, `workflow executions --logs`, `executor jobs --logs`, TailorDB migrations, seeding, and `executeScript()` show are now read from the platform's structured log entries, joined with newlines, instead of the deprecated flat `logs` field the platform no longer fills.
+
+- [#2592](https://github.com/tailor-platform/sdk/pull/2592) [`c84153e`](https://github.com/tailor-platform/sdk/commit/c84153ebc1c758585739914d074dd85f0e6eaf39) Thanks [@k1LoW](https://github.com/k1LoW)! - Accept IdP `userAuthPolicy.allowedEmailDomains: ["*"]`, the lone entry that allows every email domain. `tailor-sdk deploy` used to reject it with "must be a valid hostname" during pre-flight validation because the bundled protobuf descriptors carried the platform's older hostname-only rule. Each entry is now validated locally: it must be a hostname or `"*"`, entries must be unique when compared case-insensitively and number at most 100, and `"*"` cannot sit alongside another entry. Entries that differ only in letter case, such as `["Example.com", "example.com"]`, used to deploy and be merged into one domain by the platform, and are now rejected so the list says what is stored.
+  
+  `tailor-sdk deploy` also warns on an IdP service that leaves `allowedEmailDomains` empty. An empty list still allows every domain, but a future platform release requires that state to be explicit, so set `["*"]` to keep the current behavior or list the domains you accept.
+  
+  Fixes a plan diff that re-applied `allowedEmailDomains` on every deploy when an entry was written in mixed case.
+
 ## 1.85.1
 
 ### Patch Changes

package/dist/application-CzmT8-Nh.mjs

@@ -0,0 +1,3 @@
+import { n as generatePluginFilesIfNeeded, r as loadApplication, t as defineApplication } from "./application-D9j1a2Xc.mjs";
+
+export { defineApplication, generatePluginFilesIfNeeded };

package/dist/{application-m5tYtz0-.mjs → application-D9j1a2Xc.mjs}

@@ -182,7 +182,7 @@ function initOAuth2Client(config) {
 */
 async function initOperatorClient(accessToken, config) {
 	const platformConfig = config ?? getPlatformConfigForToken(accessToken);
-	const [{ createTracingInterceptor }, { OperatorService }] = await Promise.all([import("./interceptor-D-q1rvRl.mjs"), import("./service_pb-i8CmnQP4.mjs")]);
+	const [{ createTracingInterceptor }, { OperatorService }] = await Promise.all([import("./interceptor-D-q1rvRl.mjs"), import("./service_pb-_V6qjFDF.mjs")]);
 	const interceptors = [
 		await userAgentInterceptor(),
 		await bearerTokenInterceptor(accessToken),
@@ -5376,6 +5376,51 @@ const AIGatewaySchema = z.object({
 	cors: z.array(z.string()).optional().describe("Allowed CORS origins for browser-based clients. Each entry is `*`, `http(s)://*`, `http(s)://*.example.com`, or `http(s)://app.example.com`, optionally with `:port`. Empty list disables cross-origin access.")
 }).brand("AIGatewayConfig");
 
+//#endregion
+//#region src/parser/service/idp/email-domains.ts
+/**
+* The `allowedEmailDomains` entry that permits every email domain. It has to be
+* the only entry in the list.
+*/
+const ALL_EMAIL_DOMAINS = "*";
+/**
+* A single `allowedEmailDomains` entry: a hostname, or {@link ALL_EMAIL_DOMAINS}.
+*
+* Two forms the platform accepts are rejected here, because each stores an entry
+* that can never match: surrounding whitespace, which the platform trims and then
+* echoes back normalized as a permanent diff in every later plan, and a trailing
+* dot, which a domain taken from an email address never carries. Elsewhere this
+* is looser than the platform's own check, so nothing else it accepts is rejected
+* here.
+*/
+const allowedEmailDomainPattern = /^(\*|[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*)$/;
+/**
+* Whether the list carries the all-domains entry.
+*
+* Trimming mirrors the platform, which trims before comparing, so a padded
+* entry cannot slip past the exclusivity check here either.
+* @param domains - Raw `allowedEmailDomains` entries
+* @returns Whether any entry is the all-domains entry
+*/
+function containsAllEmailDomains(domains) {
+	return domains.some((domain) => domain.trim() === "*");
+}
+/**
+* Whether a policy leaves the accepted email domains implicit.
+*
+* An empty or omitted `allowedEmailDomains` currently means "every domain", but
+* the platform is moving that meaning behind an explicit `["*"]`, so the CLI
+* warns about such policies to nudge authors into declaring their intent while
+* both forms still work. Namespaces with `useNonEmailIdentifier` never reach
+* domain validation and cannot set the field at all, so they are not affected.
+* @param policy - The IdP user auth policy from user config
+* @returns Whether the CLI should warn about an implicit all-domains state
+*/
+function hasImplicitAllEmailDomains(policy) {
+	if (policy?.useNonEmailIdentifier === true) return false;
+	return !policy?.allowedEmailDomains || policy.allowedEmailDomains.length === 0;
+}
+
 //#endregion
 //#region src/parser/service/idp/schema.ts
 /**
@@ -5421,7 +5466,7 @@ const IdPUserAuthPolicySchema = z.object({
 	passwordRequireNumeric: z.boolean().optional().describe("Require numeric characters in passwords"),
 	passwordMinLength: z.number().int().refine((val) => val >= 6 && val <= 30, { message: "passwordMinLength must be between 6 and 30" }).optional().describe("Minimum password length (6-30)"),
 	passwordMaxLength: z.number().int().refine((val) => val >= 6 && val <= 4096, { message: "passwordMaxLength must be between 6 and 4096" }).optional().describe("Maximum password length (6-4096)"),
-	allowedEmailDomains: z.array(z.string()).optional().describe("Restrict registration to these email domains"),
+	allowedEmailDomains: z.array(z.string().regex(allowedEmailDomainPattern, `must be a hostname, or ${"*"} to allow all email domains`)).max(100, "allowedEmailDomains accepts at most 100 entries").refine((domains) => new Set(domains.map((d) => d.toLowerCase())).size === domains.length, { message: "allowedEmailDomains entries must be unique, compared case-insensitively" }).refine((domains) => domains.length <= 1 || !containsAllEmailDomains(domains), { message: `allowedEmailDomains cannot contain other entries when ${"*"} is set` }).optional().describe(`Restrict registration to these email domains. A lone ${"*"} entry allows every domain`),
 	allowGoogleOauth: z.boolean().optional().describe("Enable Google OAuth login"),
 	allowMicrosoftOauth: z.boolean().optional().describe("Enable Microsoft OAuth login"),
 	disablePasswordAuth: z.boolean().optional().describe("Disable password-based authentication"),
@@ -5439,13 +5484,13 @@ const IdPUserAuthPolicySchema = z.object({
 	message: "allowGoogleOauth cannot be set when useNonEmailIdentifier is true",
 	path: ["allowGoogleOauth"]
 }).refine((data) => !data.allowGoogleOauth || data.allowedEmailDomains && data.allowedEmailDomains.length > 0, {
-	message: "allowGoogleOauth requires allowedEmailDomains to be set",
+	message: `allowGoogleOauth requires a non-empty allowedEmailDomains (["${"*"}"] to allow every domain)`,
 	path: ["allowGoogleOauth"]
 }).refine((data) => !data.allowMicrosoftOauth || !data.useNonEmailIdentifier, {
 	message: "allowMicrosoftOauth cannot be set when useNonEmailIdentifier is true",
 	path: ["allowMicrosoftOauth"]
 }).refine((data) => !data.allowMicrosoftOauth || data.allowedEmailDomains && data.allowedEmailDomains.length > 0, {
-	message: "allowMicrosoftOauth requires allowedEmailDomains to be set",
+	message: `allowMicrosoftOauth requires a non-empty allowedEmailDomains (["${"*"}"] to allow every domain)`,
 	path: ["allowMicrosoftOauth"]
 }).refine((data) => !data.allowMicrosoftOauth || data.disablePasswordAuth === true, {
 	message: "allowMicrosoftOauth requires disablePasswordAuth to be enabled",
@@ -5934,5 +5979,5 @@ async function loadApplication(params) {
 }
 
 //#endregion
-export { LOG_LEVELS as $, hashContent as A, getConsoleBaseUrl as B, createLogLevelTreeshakeOptions as C, hasGenerationHooks as D, getPluginGenerationDependencies as E, fetchAllTolerant as F, initOperatorClient as G, getOrNull as H, fetchMachineUserToken as I, normalizeBaseUrl as J, isDefaultPlatform as K, fetchPaged as L, closeConnectionPool as M, defaultPlatformBaseUrl as N, createBundleCache as O, fetchAll as P, createApplyLimiter as Q, fetchPlatformMachineUserToken as R, composeFunctionTreeshakeOptions as S, createBundleLog as T, getPlatformBaseUrl as U, getOAuth2ClientId as V, initOAuth2Client as W, resolveStaticWebsiteUrls as X, rememberPlatformConfigForToken as Y, byName as Z, stringifyFunction as _, resolveInlineSourcemap as a, resolveTSConfigWithFallback as b, ResolverSchema as c, buildExecutorArgsExpr as d, buildResolverOperationHookExpr as f, TailorDBTypeSchema as g, assertUniqueTailorDBTypeNamesWithExternal as h, resolverBundleKey as i, hashFile as j, getDistDir as k, HTTP_METHODS as l, assertUniqueLocalTailorDBTypeNames as m, generatePluginFilesIfNeeded as n, WorkflowJobFunctionExecutionPolicySchema as o, buildResolverPermissionAndInputCheckExpr as p, isNotFoundError as q, loadApplication as r, WorkflowJobSchema as s, defineApplication as t, INVOKER_EXPR as u, createGeneratedEntryResolverPlugin as v, resolveBundleLogLevel as w, platformBundleDefinePlugin as x, createTsconfigPathsPlugin as y, fetchUserInfo as z };
-//# sourceMappingURL=application-m5tYtz0-.mjs.map
+export { byName as $, getDistDir as A, fetchPlatformMachineUserToken as B, composeFunctionTreeshakeOptions as C, getPluginGenerationDependencies as D, createBundleLog as E, defaultPlatformBaseUrl as F, getPlatformBaseUrl as G, getConsoleBaseUrl as H, fetchAll as I, isDefaultPlatform as J, initOAuth2Client as K, fetchAllTolerant as L, hashFile as M, MAX_PAGE_SIZE as N, hasGenerationHooks as O, closeConnectionPool as P, resolveStaticWebsiteUrls as Q, fetchMachineUserToken as R, platformBundleDefinePlugin as S, resolveBundleLogLevel as T, getOAuth2ClientId as U, fetchUserInfo as V, getOrNull as W, normalizeBaseUrl as X, isNotFoundError as Y, rememberPlatformConfigForToken as Z, TailorDBTypeSchema as _, resolverBundleKey as a, createTsconfigPathsPlugin as b, WorkflowJobSchema as c, INVOKER_EXPR as d, createApplyLimiter as et, buildExecutorArgsExpr as f, assertUniqueTailorDBTypeNamesWithExternal as g, assertUniqueLocalTailorDBTypeNames as h, hasImplicitAllEmailDomains as i, hashContent as j, createBundleCache as k, ResolverSchema as l, buildResolverPermissionAndInputCheckExpr as m, generatePluginFilesIfNeeded as n, resolveInlineSourcemap as o, buildResolverOperationHookExpr as p, initOperatorClient as q, loadApplication as r, WorkflowJobFunctionExecutionPolicySchema as s, defineApplication as t, LOG_LEVELS as tt, HTTP_METHODS as u, stringifyFunction as v, createLogLevelTreeshakeOptions as w, resolveTSConfigWithFallback as x, createGeneratedEntryResolverPlugin as y, fetchPaged as z };
+//# sourceMappingURL=application-D9j1a2Xc.mjs.map