@tailor-platform/sdk 2.0.0-next.1 → 2.0.0-next.11

package/dist/configure/services/http-adapter/http-adapter.d.mts

@@ -0,0 +1,124 @@
+import { HttpAdapterConfigInput } from "../../../types/http-adapter.generated.mjs";
+import { DocumentNode } from "graphql";
+//#region src/configure/services/http-adapter/http-adapter.d.ts
+/**
+ * Lowercase HTTP method keys accepted in `input`, derived from the config
+ * schema via the generated type so they cannot drift.
+ */
+type HttpMethodKey = keyof Required<HttpAdapterConfigInput["input"]>;
+/** Incoming HTTP request passed to an `input` handler. */
+type HttpAdapterRequest = {
+  method: Uppercase<HttpMethodKey>;
+  path: string;
+  headers: Record<string, string>;
+  query: Record<string, string>;
+  body: string;
+};
+/** GraphQL request returned by an `input` handler. */
+type HttpAdapterGraphQLRequest<Query extends HttpAdapterGraphQLQuery = string> = {
+  query: Query;
+  operationName?: string;
+} & HttpAdapterGraphQLRequestVariables<Query>;
+/**
+ * Typed GraphQL document accepted by an HTTP adapter input handler.
+ * Compatible with generated `TypedDocumentNode` values.
+ */
+type HttpAdapterTypedDocumentNode<TResult = unknown, TVariables = Record<string, unknown>> = DocumentNode & {
+  __apiType?: (variables: TVariables) => TResult;
+  __ensureTypesOfVariablesAndResultMatching?: (variables: TVariables) => TResult;
+};
+/** GraphQL query value accepted by an HTTP adapter input handler. */
+type HttpAdapterGraphQLQuery = string | DocumentNode;
+type HttpAdapterGraphQLData<Query> = Query extends HttpAdapterTypedDocumentNode<infer Result, infer _Variables> ? Result : unknown;
+type HttpAdapterGraphQLVariables<Query> = Query extends HttpAdapterTypedDocumentNode<infer _Result, infer Variables> ? Variables : Record<string, unknown>;
+type HttpAdapterHasRequiredVariables<T> = [T] extends [never] ? false : T extends object ? Record<never, never> extends T ? false : true : false;
+type HttpAdapterGraphQLRequestVariables<Query> = true extends HttpAdapterHasRequiredVariables<HttpAdapterGraphQLVariables<Query>> ? {
+  variables: HttpAdapterGraphQLVariables<Query>;
+} : {
+  variables?: HttpAdapterGraphQLVariables<Query>;
+};
+/**
+ * Converts an incoming HTTP request into a GraphQL request.
+ * Pass a typed document type as `Query` when annotating extracted handlers.
+ */
+type HttpAdapterInputFn<Query extends HttpAdapterGraphQLQuery = string> = (req: HttpAdapterRequest) => HttpAdapterGraphQLRequest<Query>;
+/** GraphQL execution result passed to the `output` handler. */
+type HttpAdapterGraphQLResponse<Data = unknown> = {
+  data?: Data | null;
+  errors?: unknown;
+  extensions?: unknown;
+};
+/** HTTP response returned by the `output` handler. */
+type HttpAdapterResponse = {
+  statusCode?: number;
+  headers?: Record<string, string>;
+  body: string;
+};
+/** Converts a GraphQL response into an HTTP response. */
+type HttpAdapterOutputFn<Data = unknown> = (resp: HttpAdapterGraphQLResponse<Data>) => HttpAdapterResponse;
+/**
+ * Per-method input handlers. At least one method must be provided.
+ * Each handler transforms an HTTP request into a GraphQL request.
+ */
+type HttpAdapterInput = Partial<Record<HttpMethodKey, HttpAdapterInputFn<HttpAdapterGraphQLQuery>>>;
+type HttpAdapterInputHandlerData<Handler> = Handler extends ((req: HttpAdapterRequest) => infer Request) ? Request extends {
+  query: infer Query;
+} ? HttpAdapterGraphQLData<Query> : unknown : never;
+type HttpAdapterInputData<Input extends HttpAdapterInput> = [HttpAdapterInputHandlerData<Input[keyof Input]>] extends [never] ? unknown : HttpAdapterInputHandlerData<Input[keyof Input]>;
+type HttpAdapterValidatedRequest<Request> = Request extends {
+  query: infer Query extends HttpAdapterGraphQLQuery;
+} ? Request & HttpAdapterGraphQLRequest<Query> : never;
+type HttpAdapterValidatedInput<Input extends HttpAdapterInput> = { [Method in keyof Input]: Input[Method] extends ((req: HttpAdapterRequest) => infer Request) ? (req: HttpAdapterRequest) => HttpAdapterValidatedRequest<Request> : Input[Method]; };
+/**
+ * HTTP adapter configuration accepted by `createHttpAdapter` with typed
+ * `input` and `output` signatures.
+ */
+type HttpAdapter<Input extends HttpAdapterInput = HttpAdapterInput> = Omit<HttpAdapterConfigInput, "input" | "output"> & {
+  input: Input & HttpAdapterValidatedInput<Input>;
+  output?: HttpAdapterOutputFn<HttpAdapterInputData<Input>>;
+};
+/**
+ * Defines an HTTP adapter that translates HTTP requests to GraphQL queries
+ * and shapes the GraphQL response back into an HTTP response.
+ *
+ * The adapter MUST be the default export of its file.
+ * Files are discovered via the `httpAdapter.files` glob in `defineConfig()`.
+ *
+ * `input` is an object keyed by lowercase HTTP method (`get`, `post`, `put`,
+ * `patch`, `delete`). Each handler can return a GraphQL query string or a
+ * typed document node. At least one method must be declared; the methods the
+ * adapter serves are derived from these keys.
+ *
+ * `output` is optional and shared across all methods. If `input` returns typed
+ * document nodes, `output` receives the corresponding result type as
+ * `resp.data`. If you need different response shapes per method, discriminate
+ * inside `output` based on the GraphQL response shape.
+ *
+ * Each handler runs server-side and must be synchronous: Node APIs, `fetch`,
+ * `async`/`await`, Promises, and top-level `await` are not available.
+ *
+ * Optional fields: `enabled` (default `true`; set `false` to deploy the adapter
+ * without serving it) and `priority` (non-negative integer, default `0`; when
+ * multiple adapters match the same request path, the lowest value wins).
+ * @param config - HTTP adapter configuration
+ * @returns Branded HTTP adapter definition
+ * @example
+ * export default createHttpAdapter({
+ *   name: "get-user",
+ *   pathPattern: "/users/*",
+ *   input: {
+ *     get: (req) => ({
+ *       query: `query($id: ID!) { user(id: $id) { id name } }`,
+ *       variables: { id: req.path.split("/")[2] },
+ *     }),
+ *   },
+ *   output: (resp) => ({
+ *     statusCode: 200,
+ *     headers: { "content-type": "application/json" },
+ *     body: JSON.stringify(resp.data),
+ *   }),
+ * });
+ */
+declare function createHttpAdapter<const Input extends HttpAdapterInput>(config: HttpAdapter<Input>): HttpAdapter<Input>;
+//#endregion
+export { HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, createHttpAdapter };

package/dist/configure/services/http-adapter/index.d.mts

@@ -0,0 +1,2 @@
+import { HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, createHttpAdapter } from "./http-adapter.mjs";
+export { HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, createHttpAdapter };

package/dist/configure/services/idp/index.d.mts

@@ -0,0 +1,60 @@
+import { IdPPermission, IdPPermissionCondition, unsafeAllowAllIdPPermission } from "./permission.mjs";
+import { IdPEmailConfig, IdPGqlOperations, IdPGqlOperationsInput, IdPInput } from "../../../types/idp.generated.mjs";
+import { IdPConfig, IdPExternalConfig, IdpDefinitionBrand } from "./types.mjs";
+//#region src/configure/services/idp/index.d.ts
+/**
+ * Define an IdP service configuration for the Tailor SDK.
+ * @template TClients
+ * @param name - IdP service name
+ * @param config - IdP configuration
+ * @returns Defined IdP service
+ */
+declare function defineIdp<const TClients extends string[]>(name: string, config: Omit<IdPInput, "name" | "clients" | "permission"> & {
+  clients: TClients;
+  permission?: IdPPermission;
+}): {
+  readonly name: string;
+  readonly provider: (providerName: string, clientName: TClients[number]) => {
+    readonly name: string;
+    readonly kind: "BuiltInIdP";
+    readonly namespace: string;
+    readonly clientName: TClients[number];
+  };
+  readonly publishEvents?: boolean | undefined;
+  readonly authorization?: "insecure" | "loggedIn" | {
+    cel: string;
+  } | undefined;
+  readonly lang?: "en" | "ja" | undefined;
+  readonly userAuthPolicy?: {
+    useNonEmailIdentifier?: boolean | undefined;
+    allowSelfPasswordReset?: boolean | undefined;
+    passwordRequireUppercase?: boolean | undefined;
+    passwordRequireLowercase?: boolean | undefined;
+    passwordRequireNonAlphanumeric?: boolean | undefined;
+    passwordRequireNumeric?: boolean | undefined;
+    passwordMinLength?: number | undefined;
+    passwordMaxLength?: number | undefined;
+    allowedEmailDomains?: string[] | undefined;
+    allowGoogleOauth?: boolean | undefined;
+    allowMicrosoftOauth?: boolean | undefined;
+    disablePasswordAuth?: boolean | undefined;
+    enableMfa?: boolean | undefined;
+    requireMfa?: boolean | undefined;
+    allowedReturnOrigins?: string[] | undefined;
+    mfaIssuer?: string | undefined;
+  } | undefined;
+  readonly gqlOperations?: "query" | {
+    create?: boolean | undefined;
+    update?: boolean | undefined;
+    delete?: boolean | undefined;
+    read?: boolean | undefined;
+    sendPasswordResetEmail?: boolean | undefined;
+    requestMfaSettingsUrl?: boolean | undefined;
+    unenrollMfa?: boolean | undefined;
+  } | undefined;
+  readonly emailConfig?: IdPEmailConfig;
+  readonly clients: TClients;
+  readonly permission?: IdPPermission;
+} & IdpDefinitionBrand;
+//#endregion
+export { type IdPConfig, type IdPEmailConfig, type IdPExternalConfig, type IdPGqlOperations, type IdPGqlOperationsInput as IdPGqlOperationsConfig, type IdPPermission, type IdPPermissionCondition, defineIdp, unsafeAllowAllIdPPermission };

package/dist/configure/services/idp/permission.d.mts

@@ -0,0 +1,64 @@
+import { InferredAttributes } from "../../../runtime/types.mjs";
+import { UserBooleanArrayOperand, UserBooleanOperand, UserStringArrayOperand, UserStringOperand } from "../../types/permission-operand.types.mjs";
+import { IdPUserField } from "../../../parser/service/idp/types.mjs";
+//#region src/configure/services/idp/permission.d.ts
+type EqualityOperator = "=" | "!=";
+type ContainsOperator = "in" | "not in";
+type IdPUserOperand<Update extends boolean = false> = Update extends true ? {
+  oldIdpUser: IdPUserField;
+} | {
+  newIdpUser: IdPUserField;
+} : {
+  idpUser: IdPUserField;
+};
+type StringEqualityCondition<User extends object, Update extends boolean> = readonly [string, EqualityOperator, string] | readonly [UserStringOperand<User>, EqualityOperator, string] | readonly [string, EqualityOperator, UserStringOperand<User>] | readonly [IdPUserOperand<Update>, EqualityOperator, string | UserStringOperand<User> | IdPUserOperand<Update>] | readonly [string | UserStringOperand<User>, EqualityOperator, IdPUserOperand<Update>];
+type BooleanEqualityCondition<User extends object, Update extends boolean> = readonly [boolean, EqualityOperator, boolean] | readonly [UserBooleanOperand<User>, EqualityOperator, boolean] | readonly [boolean, EqualityOperator, UserBooleanOperand<User>] | readonly [IdPUserOperand<Update>, EqualityOperator, boolean | UserBooleanOperand<User> | IdPUserOperand<Update>] | readonly [boolean | UserBooleanOperand<User>, EqualityOperator, IdPUserOperand<Update>];
+type EqualityCondition<User extends object = InferredAttributes, Update extends boolean = boolean> = StringEqualityCondition<User, Update> | BooleanEqualityCondition<User, Update>;
+type StringContainsCondition<User extends object, Update extends boolean> = readonly [string, ContainsOperator, string[]] | readonly [UserStringOperand<User>, ContainsOperator, string[]] | readonly [string, ContainsOperator, UserStringArrayOperand<User>] | readonly [IdPUserOperand<Update>, ContainsOperator, string[] | UserStringArrayOperand<User>];
+type BooleanContainsCondition<User extends object, Update extends boolean> = readonly [boolean, ContainsOperator, boolean[]] | readonly [UserBooleanOperand<User>, ContainsOperator, boolean[]] | readonly [boolean, ContainsOperator, UserBooleanArrayOperand<User>] | readonly [IdPUserOperand<Update>, ContainsOperator, boolean[] | UserBooleanArrayOperand<User>];
+type ContainsCondition<User extends object = InferredAttributes, Update extends boolean = boolean> = StringContainsCondition<User, Update> | BooleanContainsCondition<User, Update>;
+type IdPPermissionCondition<User extends object = InferredAttributes, Update extends boolean = boolean> = EqualityCondition<User, Update> | ContainsCondition<User, Update>;
+type IdPActionPermission<User extends object = InferredAttributes, Update extends boolean = boolean> = {
+  conditions: IdPPermissionCondition<User, Update> | readonly IdPPermissionCondition<User, Update>[];
+  description?: string | undefined;
+  /**
+   * Whether matching users are granted (`true`) or denied (`false`).
+   * Omitting `permit` in this object form defaults to `deny` and emits a
+   * warning; set it explicitly. (The array shorthand defaults to `allow`.)
+   */
+  permit?: boolean;
+} | readonly [...IdPPermissionCondition<User, Update>, ...([] | [boolean])] | readonly [...IdPPermissionCondition<User, Update>[], ...([] | [boolean])];
+/**
+ * Per-operation permission policies for an IdP service.
+ * Defines create, read, update, delete, sendPasswordResetEmail, and
+ * unenrollMfa permissions.
+ *
+ * For update operations, use `newIdpUser`/`oldIdpUser` operands instead of `idpUser`.
+ * @example
+ * const permission: IdPPermission = {
+ *   create: [{ conditions: [[{ user: "role" }, "=", "ADMIN"]], permit: true }],
+ *   read: [{ conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true }],
+ *   update: [{ conditions: [[{ newIdpUser: "name" }, "=", { user: "id" }]], permit: true }],
+ *   delete: [{ conditions: [[{ user: "role" }, "=", "ADMIN"]], permit: true }],
+ *   sendPasswordResetEmail: [{ conditions: [], permit: true }],
+ *   unenrollMfa: [{ conditions: [[{ user: "role" }, "=", "ADMIN"]], permit: true }],
+ * };
+ */
+type IdPPermission<User extends object = InferredAttributes> = {
+  create: readonly IdPActionPermission<User, false>[];
+  read: readonly IdPActionPermission<User, false>[];
+  update: readonly IdPActionPermission<User, true>[];
+  delete: readonly IdPActionPermission<User, false>[];
+  sendPasswordResetEmail?: readonly IdPActionPermission<User, false>[];
+  unenrollMfa?: readonly IdPActionPermission<User, false>[];
+};
+/**
+ * Grants full IdP permission access without any conditions.
+ *
+ * Unsafe and intended only for local development, prototyping, or tests.
+ * Do not use this in production environments, as it effectively disables
+ * authorization checks.
+ */
+declare const unsafeAllowAllIdPPermission: IdPPermission;
+//#endregion
+export { IdPPermission, IdPPermissionCondition, unsafeAllowAllIdPPermission };

package/dist/configure/services/idp/types.d.mts

@@ -0,0 +1,23 @@
+import { BuiltinIdP } from "../../../types/auth.generated.mjs";
+import { IdPPermission } from "./permission.mjs";
+import { IdPInput } from "../../../types/idp.generated.mjs";
+//#region src/configure/services/idp/types.d.ts
+declare const idpDefinitionBrand: unique symbol;
+type IdpDefinitionBrand = {
+  readonly [idpDefinitionBrand]: true;
+};
+type DefinedIdp<Name extends string, Config, ClientNames extends string> = Config & {
+  name: Name;
+  provider(providerName: string, clientName: ClientNames): BuiltinIdP;
+} & IdpDefinitionBrand;
+type IdPExternalConfig = {
+  name: string;
+  external: true;
+};
+type IdPOwnConfigInput = Omit<IdPInput, "permission"> & {
+  permission?: IdPPermission;
+};
+type IdPOwnConfig = Omit<DefinedIdp<string, IdPOwnConfigInput, string>, "provider">;
+type IdPConfig = IdPOwnConfig | IdPExternalConfig;
+//#endregion
+export { DefinedIdp, IdPConfig, IdPExternalConfig, IdPOwnConfig, IdpDefinitionBrand };

package/dist/configure/services/index.d.mts

@@ -0,0 +1,40 @@
+import { AuthConnectionConfig, AuthConnectionOAuth2Config } from "../../types/auth-connection.generated.mjs";
+import { BuiltinIdP, IDToken, IdProvider, OAuth2ClientInput, OIDC, SAML, SCIMAttribute, SCIMAttributeMapping, SCIMAuthorization, SCIMConfig, SCIMResource, TenantProvider } from "../../types/auth.generated.mjs";
+import { AuthConfig, AuthConnectionTokenResult, AuthExternalConfig, AuthOwnConfig, AuthServiceInput, BeforeLoginClaims, BeforeLoginHookArgs, DefinedAuth, FederatedIdentity, FederatedIdentityClaims, FederatedIdentityProvider, OAuth2ClientGrantType, SCIMAttributeType, UserAttributeKey, UserAttributeListKey, UserAttributes, UsernameFieldKey, ValueOperand } from "./auth/types.mjs";
+import { Resolver } from "../../types/resolver.generated.mjs";
+import { PermissionCondition, TailorTypeGqlPermission, TailorTypePermission, unsafeAllowAllGqlPermission, unsafeAllowAllTypePermission } from "./tailordb/permission.mjs";
+import { TailorAnyDBField, TailorAnyDBType, TailorDBField, TailorDBInstance, TailorDBType, db } from "./tailordb/schema.mjs";
+import "./tailordb/index.mjs";
+import { AIGatewayConfig } from "./aigateway/types.mjs";
+import { IdPPermission, IdPPermissionCondition, unsafeAllowAllIdPPermission } from "./idp/permission.mjs";
+import { IdPEmailConfig, IdPGqlOperations, IdPGqlOperationsInput } from "../../types/idp.generated.mjs";
+import { IdPConfig, IdPExternalConfig } from "./idp/types.mjs";
+import { SecretsConfig } from "./secrets/types.mjs";
+import { StaticWebsiteConfig } from "./staticwebsite/types.mjs";
+import { ExecutionPolicyConcurrency, ExecutionPolicyDefInput, ExecutionPolicyExactInstance, ExecutionPolicyGroupOptions, ExecutionPolicyInstance, ExecutionPolicyWildcardInstance, ResolvedExecutionPolicyInstance } from "./workflow/execution-policy.types.mjs";
+import { ExecutorServiceConfig, ExecutorServiceInput, ResolverExternalConfig, ResolverServiceConfig, ResolverServiceInput, WorkflowServiceConfig, WorkflowServiceInput } from "../config/types.mjs";
+import { ConcurrencyPolicy, RetryPolicy } from "../../types/workflow.generated.mjs";
+import { defineAuth } from "./auth/index.mjs";
+import { ResolverPermission, ResolverPermissionCondition, ResolverPermissionPolicy } from "./resolver/permission.mjs";
+import { createResolver } from "./resolver/resolver.mjs";
+import { QueryType } from "./resolver/types.mjs";
+import "./resolver/index.mjs";
+import { WorkflowJob, WorkflowJobContext, createWorkflowJob } from "./workflow/job.mjs";
+import { Workflow, WorkflowConfig, createWorkflow } from "./workflow/workflow.mjs";
+import { FunctionOperation, GqlOperation, Operation, WebhookOperation, WorkflowOperation } from "./executor/operation.mjs";
+import { AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, ResolverExecutedArgs, ResolverExecutedTrigger, TailorDBTrigger, WorkflowExecutionArgs, WorkflowExecutionCompletedArgs, WorkflowExecutionResumedArgs, WorkflowExecutionRetriedArgs, WorkflowExecutionStartedArgs, WorkflowExecutionTrigger, WorkflowExecutionWaitResolvedArgs, WorkflowExecutionWaitStartedArgs, WorkflowJobExecutionArgs, WorkflowJobExecutionCompletedArgs, WorkflowJobExecutionStartedArgs, WorkflowJobExecutionTrigger, WorkflowJobExecutionWaitResolvedArgs, WorkflowJobExecutionWaitStartedArgs, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, workflowExecutionCompletedTrigger, workflowExecutionResumedTrigger, workflowExecutionRetriedTrigger, workflowExecutionStartedTrigger, workflowExecutionTrigger, workflowExecutionWaitResolvedTrigger, workflowExecutionWaitStartedTrigger, workflowJobExecutionCompletedTrigger, workflowJobExecutionStartedTrigger, workflowJobExecutionTrigger, workflowJobExecutionWaitResolvedTrigger, workflowJobExecutionWaitStartedTrigger } from "./executor/trigger/event.mjs";
+import { ScheduleArgs, ScheduleTrigger, scheduleTrigger } from "./executor/trigger/schedule.mjs";
+import { IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, incomingWebhookTrigger } from "./executor/trigger/webhook.mjs";
+import { Trigger } from "./executor/trigger/index.mjs";
+import { createExecutor } from "./executor/executor.mjs";
+import "./executor/index.mjs";
+import { defineWorkflowExecutionPolicies, defineWorkflowExecutionPolicy } from "./workflow/execution-policy.mjs";
+import { WaitPointInstance, createWaitPoint, createWaitPoints } from "./workflow/wait-point.mjs";
+import "./workflow/index.mjs";
+import { defineStaticWebSite } from "./staticwebsite/index.mjs";
+import { defineAIGateway } from "./aigateway/index.mjs";
+import { defineIdp } from "./idp/index.mjs";
+import { defineSecretManager } from "./secrets/index.mjs";
+import { HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, createHttpAdapter } from "./http-adapter/http-adapter.mjs";
+import "./http-adapter/index.mjs";
+export { type AIGatewayConfig, AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, type AuthConfig, type AuthConnectionConfig, type AuthConnectionOAuth2Config, type AuthConnectionTokenResult, type AuthExternalConfig, type AuthOwnConfig, type AuthServiceInput, type BeforeLoginClaims, type BeforeLoginHookArgs, type BuiltinIdP, type ConcurrencyPolicy, type DefinedAuth, type ExecutionPolicyConcurrency, type ExecutionPolicyDefInput, type ExecutionPolicyExactInstance, type ExecutionPolicyGroupOptions, type ExecutionPolicyInstance, type ExecutionPolicyWildcardInstance, type ExecutorServiceConfig, type ExecutorServiceInput, type FederatedIdentity, type FederatedIdentityClaims, type FederatedIdentityProvider, FunctionOperation, GqlOperation, HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, type IDToken, type IdPConfig, type IdPEmailConfig, type IdPExternalConfig, type IdPGqlOperations, type IdPGqlOperationsInput as IdPGqlOperationsConfig, type IdPPermission, type IdPPermissionCondition, type IdProvider as IdProviderConfig, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, type OAuth2ClientInput as OAuth2Client, type OAuth2ClientGrantType, type OIDC, Operation, type PermissionCondition, type QueryType, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, type ResolvedExecutionPolicyInstance, type Resolver, ResolverExecutedArgs, ResolverExecutedTrigger, type ResolverExternalConfig, type ResolverPermission, type ResolverPermissionCondition, type ResolverPermissionPolicy, type ResolverServiceConfig, type ResolverServiceInput, type RetryPolicy, type SAML, type SCIMAttribute, type SCIMAttributeMapping, type SCIMAttributeType, type SCIMAuthorization, type SCIMConfig, type SCIMResource, ScheduleArgs, ScheduleTrigger, type SecretsConfig, type StaticWebsiteConfig, type TailorAnyDBField, type TailorAnyDBType, type TailorDBField, type TailorDBInstance, TailorDBTrigger, type TailorDBType, type TailorTypeGqlPermission, type TailorTypePermission, type TenantProvider as TenantProviderConfig, Trigger, type UserAttributeKey, type UserAttributeListKey, type UserAttributes, type UsernameFieldKey, type ValueOperand, WaitPointInstance, WebhookOperation, Workflow, WorkflowConfig, WorkflowExecutionArgs, WorkflowExecutionCompletedArgs, WorkflowExecutionResumedArgs, WorkflowExecutionRetriedArgs, WorkflowExecutionStartedArgs, WorkflowExecutionTrigger, WorkflowExecutionWaitResolvedArgs, WorkflowExecutionWaitStartedArgs, WorkflowJob, WorkflowJobContext, WorkflowJobExecutionArgs, WorkflowJobExecutionCompletedArgs, WorkflowJobExecutionStartedArgs, WorkflowJobExecutionTrigger, WorkflowJobExecutionWaitResolvedArgs, WorkflowJobExecutionWaitStartedArgs, WorkflowOperation, type WorkflowServiceConfig, type WorkflowServiceInput, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, createExecutor, createHttpAdapter, createResolver, createWaitPoint, createWaitPoints, createWorkflow, createWorkflowJob, db, defineAIGateway, defineAuth, defineIdp, defineSecretManager, defineStaticWebSite, defineWorkflowExecutionPolicies, defineWorkflowExecutionPolicy, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, incomingWebhookTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, scheduleTrigger, unsafeAllowAllGqlPermission, unsafeAllowAllIdPPermission, unsafeAllowAllTypePermission, workflowExecutionCompletedTrigger, workflowExecutionResumedTrigger, workflowExecutionRetriedTrigger, workflowExecutionStartedTrigger, workflowExecutionTrigger, workflowExecutionWaitResolvedTrigger, workflowExecutionWaitStartedTrigger, workflowJobExecutionCompletedTrigger, workflowJobExecutionStartedTrigger, workflowJobExecutionTrigger, workflowJobExecutionWaitResolvedTrigger, workflowJobExecutionWaitStartedTrigger };

package/dist/configure/services/resolver/index.d.mts

@@ -0,0 +1,6 @@
+import { Resolver } from "../../../types/resolver.generated.mjs";
+import { ResolverExternalConfig, ResolverServiceConfig, ResolverServiceInput } from "../../config/types.mjs";
+import { ResolverPermission, ResolverPermissionCondition, ResolverPermissionPolicy } from "./permission.mjs";
+import { createResolver } from "./resolver.mjs";
+import { QueryType } from "./types.mjs";
+export { type QueryType, type Resolver, type ResolverExternalConfig, type ResolverPermission, type ResolverPermissionCondition, type ResolverPermissionPolicy, type ResolverServiceConfig, type ResolverServiceInput, createResolver };

package/dist/configure/services/resolver/permission.d.mts

@@ -0,0 +1,64 @@
+import { InferredAttributes } from "../../../runtime/types.mjs";
+import { UserBooleanOperand, UserStringOperand } from "../../types/permission-operand.types.mjs";
+//#region src/configure/services/resolver/permission.d.ts
+type EqualityOperator = "=" | "!=";
+type StringEqualityCondition<User extends object> = readonly [UserStringOperand<User>, EqualityOperator, string] | readonly [string, EqualityOperator, UserStringOperand<User>];
+type BooleanEqualityCondition<User extends object> = readonly [UserBooleanOperand<User>, EqualityOperator, boolean] | readonly [boolean, EqualityOperator, UserBooleanOperand<User>];
+/**
+ * A single condition for {@link ResolverPermission}.
+ *
+ * Only `user` operands are supported (unlike TailorDB's `record`/`newRecord`/
+ * `oldRecord` operands) — a resolver has no associated record to compare
+ * against. Only equality (`=`/`!=`) is supported for now.
+ *
+ * The User type is extended by `tailor.d.ts`, which is automatically generated
+ * when running `tailor generate`. Attributes enabled in the config file's
+ * `auth.userProfile.attributes` (or `auth.machineUserAttributes` when
+ * `userProfile` is omitted) become available as types.
+ */
+type ResolverPermissionCondition<User extends object = InferredAttributes> = StringEqualityCondition<User> | BooleanEqualityCondition<User>;
+/**
+ * A single access policy, in the same style as TailorDB's `.permission()`
+ * policies.
+ */
+type ResolverPermissionPolicy<User extends object = InferredAttributes> = {
+  conditions: ResolverPermissionCondition<User> | readonly ResolverPermissionCondition<User>[];
+  /** Whether matching callers are granted (`true`) or denied (`false`) access. */
+  permit: boolean;
+  description?: string;
+};
+/**
+ * Access requirement for a resolver, evaluated against the original caller
+ * (`context.user`) before `body` runs — unaffected by `authInvoker`.
+ *
+ * At least one `permit: true` policy is required: a caller is granted only by
+ * a matching `permit: true` policy (deny by default), and a matching
+ * `permit: false` policy always overrides that grant, even when another
+ * policy would otherwise allow the same caller — use it to carve out an
+ * explicit exception from a broader grant. A policy array with only
+ * `permit: false` policies is rejected, since none of its conditions apply to
+ * a caller presenting no user attributes at all (e.g. one who simply doesn't
+ * authenticate), so it wouldn't actually keep anyone out. `"allowAnonymous"`
+ * explicitly documents that anonymous callers are allowed.
+ * @example
+ * const permission: ResolverPermission = [
+ *   { conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true },
+ * ];
+ * @example
+ * // Allow machine-user callers unconditionally, gate regular users behind a role
+ * const permission: ResolverPermission = [
+ *   { conditions: [[{ user: "isServiceAccount" }, "=", true]], permit: true },
+ *   { conditions: [[{ user: "role" }, "=", "ADMIN"]], permit: true },
+ * ];
+ * @example
+ * // Exception: allow logged-in users broadly, but reject a banned role
+ * const permission: ResolverPermission = [
+ *   { conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true },
+ *   { conditions: [[{ user: "role" }, "=", "BANNED"]], permit: false },
+ * ];
+ * @example
+ * const permission: ResolverPermission = "allowAnonymous";
+ */
+type ResolverPermission<User extends object = InferredAttributes> = readonly ResolverPermissionPolicy<User>[] | "allowAnonymous";
+//#endregion
+export { ResolverPermission, ResolverPermissionCondition, ResolverPermissionPolicy };

package/dist/configure/services/resolver/resolver.d.mts

@@ -0,0 +1,88 @@
+import { TailorEnv, TailorPrincipal } from "../../../runtime/types.mjs";
+import { InferFieldsOutput, output } from "../../../types/helpers.mjs";
+import { MachineUserName } from "../auth/types.mjs";
+import { ResolverInput } from "../../../types/resolver.generated.mjs";
+import { TailorAnyField, TailorField } from "../../types/type.mjs";
+import "../../types/machine-user.mjs";
+import { ResolverPermission } from "./permission.mjs";
+//#region src/configure/services/resolver/resolver.d.ts
+type Context<Input extends Record<string, TailorAnyField> | undefined> = {
+  input: Input extends Record<string, TailorAnyField> ? InferFieldsOutput<Input> : never;
+  caller: TailorPrincipal | null;
+  invoker: TailorPrincipal | null;
+  env: TailorEnv;
+};
+type OutputType<O> = O extends TailorAnyField ? output<O> : O extends Record<string, TailorAnyField> ? InferFieldsOutput<O> : never;
+/**
+ * Normalized output type that preserves generic type information.
+ * - If Output is already a TailorField, use it as-is
+ * - If Output is a Record of fields, wrap it as a nested TailorField
+ */
+type NormalizedOutput<Output extends TailorAnyField | Record<string, TailorAnyField>> = Output extends TailorAnyField ? Output : TailorField<{
+  type: "nested";
+  array: false;
+}, InferFieldsOutput<Extract<Output, Record<string, TailorAnyField>>>>;
+type ResolverReturn<Input extends Record<string, TailorAnyField> | undefined, Output extends TailorAnyField | Record<string, TailorAnyField>> = Omit<ResolverInput, "input" | "output" | "body" | "invoker" | "permission"> & Readonly<{
+  input?: Input;
+  output: NormalizedOutput<Output>;
+  body: (context: Context<Input>) => OutputType<Output> | Promise<OutputType<Output>>;
+  invoker?: MachineUserName;
+  permission?: ResolverPermission;
+}>;
+/**
+ * Create a resolver definition for the Tailor SDK.
+ *
+ * The `body` function receives a context with `input` (typed from `config.input`),
+ * `caller`, `invoker` (reflects configured machine-user delegation), and `env`.
+ * The return value of `body` must match the `output` type.
+ *
+ * `output` accepts either a single TailorField (e.g. `t.string()`) or a
+ * Record of fields (e.g. `{ name: t.string(), age: t.int() }`).
+ *
+ * `publishEvents` enables publishing execution events for this resolver.
+ * If not specified, this is automatically set to true when an executor uses this resolver
+ * with `resolverExecutedTrigger`. If explicitly set to false while an executor uses this
+ * resolver, an error will be thrown during apply.
+ *
+ * `permission` declares the resolver's access requirement, checked against `context.user` (the
+ * original caller, unaffected by `authInvoker`) before `body` runs. Omitted (default):
+ * unchanged, anonymous callers can reach the resolver. `"allowAnonymous"`: explicitly documents
+ * that anonymous callers are allowed. An array of `{ conditions, permit }` policies (in the same
+ * style as TailorDB's `.permission()`) rejects non-matching callers: at least one `permit: true`
+ * policy is required (denied unless it matches), and a matching `permit: false` policy always
+ * overrides that grant.
+ * @template Input
+ * @template Output
+ * @param config - Resolver configuration
+ * @returns Normalized resolver configuration
+ * @example
+ * import { createResolver, t } from "@tailor-platform/sdk";
+ *
+ * export default createResolver({
+ *   name: "getUser",
+ *   operation: "query",
+ *   permission: [{ conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true }],
+ *   input: {
+ *     id: t.string(),
+ *   },
+ *   body: async ({ input, caller }) => {
+ *     const db = getDB("tailordb");
+ *     const result = await db.selectFrom("User").selectAll().where("id", "=", input.id).executeTakeFirst();
+ *     return { name: result?.name ?? "", email: result?.email ?? "" };
+ *   },
+ *   output: t.object({
+ *     name: t.string(),
+ *     email: t.string(),
+ *   }),
+ * });
+ */
+declare function createResolver<Input extends Record<string, TailorAnyField> | undefined = undefined, Output extends TailorAnyField | Record<string, TailorAnyField> = TailorAnyField>(config: Omit<ResolverInput, "input" | "output" | "body" | "invoker" | "permission"> & Readonly<{
+  input?: Input;
+  output: Output;
+  body: (context: Context<Input>) => OutputType<Output> | Promise<OutputType<Output>>;
+  invoker?: MachineUserName;
+  permission?: ResolverPermission;
+}>): ResolverReturn<Input, Output>;
+type ResolverConfig = ReturnType<typeof createResolver<any, any>>;
+//#endregion
+export { ResolverConfig, createResolver };

package/dist/configure/services/resolver/types.d.mts

@@ -0,0 +1,5 @@
+import { Resolver } from "../../../types/resolver.generated.mjs";
+//#region src/configure/services/resolver/types.d.ts
+type QueryType = Resolver["operation"];
+//#endregion
+export { QueryType };

package/dist/configure/services/secrets/index.d.mts

@@ -0,0 +1,37 @@
+import { SecretsConfig, SecretsDefinitionBrand } from "./types.mjs";
+//#region src/configure/services/secrets/index.d.ts
+type SecretsVaultInput = Record<string, string>;
+type SecretsVaultInputNullish = Record<string, string | undefined | null>;
+type SecretsInput = Record<string, SecretsVaultInput>;
+type SecretsInputNullish = Record<string, SecretsVaultInputNullish>;
+type SecretsOptions = {
+  readonly ignoreNullishValues: boolean;
+};
+type DefinedSecrets<T extends SecretsInputNullish> = {
+  readonly vaults: T;
+  readonly options: SecretsOptions;
+  get<V extends Extract<keyof T, string>, S extends Extract<keyof T[V], string>>(vault: V, secret: S): Promise<string | undefined>;
+  getAll<V extends Extract<keyof T, string>, S extends Extract<keyof T[V], string>>(vault: V, secrets: readonly S[]): Promise<(string | undefined)[]>;
+} & SecretsDefinitionBrand;
+/**
+ * Define secrets configuration for the Tailor SDK.
+ * Each key is a vault name, and its value is a record of secret name to secret value.
+ * @param config - Secrets configuration mapping vault names to their secrets
+ * @returns Defined secrets with typed runtime access methods
+ */
+declare function defineSecretManager<const T extends SecretsInput>(config: T): DefinedSecrets<T>;
+/**
+ * Define secrets configuration for the Tailor SDK with ignoreNullishValues option.
+ * When `ignoreNullishValues` is true, secrets with nullish values are skipped during deploy
+ * instead of causing an error. This is useful for CI environments where not all
+ * secret values are available.
+ * @param config - Secrets configuration mapping vault names to their secrets
+ * @param options - Options for secret management behavior
+ * @param options.ignoreNullishValues - When true, secrets with nullish values are skipped during deploy
+ * @returns Defined secrets with typed runtime access methods
+ */
+declare function defineSecretManager<const T extends SecretsInputNullish>(config: T, options: {
+  ignoreNullishValues: true;
+}): DefinedSecrets<T>;
+//#endregion
+export { type SecretsConfig, defineSecretManager };

package/dist/configure/services/secrets/types.d.mts

@@ -0,0 +1,10 @@
+import { SecretsInput } from "../../../types/secrets.generated.mjs";
+//#region src/configure/services/secrets/types.d.ts
+declare const secretsDefinitionBrand: unique symbol;
+type SecretsDefinitionBrand = {
+  readonly [secretsDefinitionBrand]: true;
+};
+/** Type accepted by `AppConfig.secrets`. Only values returned by `defineSecretManager()` satisfy this. */
+type SecretsConfig = SecretsInput & SecretsDefinitionBrand;
+//#endregion
+export { SecretsConfig, SecretsDefinitionBrand };

package/dist/configure/services/staticwebsite/index.d.mts

@@ -0,0 +1,18 @@
+import { StaticWebsiteInput } from "../../../types/staticwebsite.generated.mjs";
+import { StaticWebsiteConfig, StaticWebsiteDefinitionBrand } from "./types.mjs";
+//#region src/configure/services/staticwebsite/index.d.ts
+/**
+ * Define a static website configuration for the Tailor SDK.
+ * @param name - Static website name
+ * @param config - Static website configuration
+ * @returns Defined static website
+ */
+declare function defineStaticWebSite(name: string, config: Omit<StaticWebsiteInput, "name">): {
+  readonly name: string;
+  readonly url: `${string}:url`;
+  readonly description?: string | undefined;
+  readonly allowedIpAddresses?: string[] | undefined;
+  readonly customDomains?: string[] | undefined;
+} & StaticWebsiteDefinitionBrand;
+//#endregion
+export { type StaticWebsiteConfig, defineStaticWebSite };

package/dist/configure/services/staticwebsite/types.d.mts

@@ -0,0 +1,10 @@
+import { StaticWebsiteInput } from "../../../types/staticwebsite.generated.mjs";
+//#region src/configure/services/staticwebsite/types.d.ts
+declare const staticWebsiteDefinitionBrand: unique symbol;
+type StaticWebsiteDefinitionBrand = {
+  readonly [staticWebsiteDefinitionBrand]: true;
+};
+/** Type accepted by `AppConfig.staticWebsites`. Only values returned by `defineStaticWebSite()` satisfy this. */
+type StaticWebsiteConfig = StaticWebsiteInput & StaticWebsiteDefinitionBrand;
+//#endregion
+export { StaticWebsiteConfig, StaticWebsiteDefinitionBrand };

package/dist/configure/services/tailordb/index.d.mts

@@ -0,0 +1,3 @@
+import { PermissionCondition, TailorTypeGqlPermission, TailorTypePermission, unsafeAllowAllGqlPermission, unsafeAllowAllTypePermission } from "./permission.mjs";
+import { TailorAnyDBField, TailorAnyDBType, TailorDBField, TailorDBInstance, TailorDBType, db } from "./schema.mjs";
+export { type PermissionCondition, type TailorAnyDBField, type TailorAnyDBType, type TailorDBField, type TailorDBInstance, type TailorDBType, type TailorTypeGqlPermission, type TailorTypePermission, db, unsafeAllowAllGqlPermission, unsafeAllowAllTypePermission };