@tailor-platform/sdk 2.0.0-next.1 → 2.0.0-next.3

package/dist/service-ufH7sS8o.mjs

@@ -0,0 +1,797 @@
+import { n as isSdkBranded } from "./brand-Eo4pLXPJ.mjs";
+import { n as logger, r as styles } from "./logger-BEiZZ3qT.mjs";
+import * as path from "pathe";
+import { z } from "zod";
+import * as fs from "node:fs";
+import { pathToFileURL } from "node:url";
+import * as inflection from "inflection";
+
+//#region src/parser/service/common.ts
+const functionSchema = z.custom((val) => typeof val === "function");
+
+//#endregion
+//#region src/cli/services/file-loader.ts
+const DEFAULT_IGNORE_PATTERNS = ["**/*.test.ts", "**/*.spec.ts"];
+/**
+* Load files matching the given patterns, excluding files that match ignore patterns.
+* By default, test files (*.test.ts, *.spec.ts) are excluded unless ignores is explicitly specified.
+* @param config - Configuration with files patterns and optional ignores patterns
+* @returns Array of absolute file paths
+*/
+function loadFilesWithIgnores(config) {
+	const ignorePatterns = config.ignores ?? DEFAULT_IGNORE_PATTERNS;
+	const ignoreFiles = /* @__PURE__ */ new Set();
+	for (const ignorePattern of ignorePatterns) {
+		const absoluteIgnorePattern = path.resolve(process.cwd(), ignorePattern);
+		try {
+			fs.globSync(absoluteIgnorePattern).forEach((file) => ignoreFiles.add(file));
+		} catch (error) {
+			logger.warn(`Failed to glob ignore pattern "${ignorePattern}": ${String(error)}`);
+		}
+	}
+	const files = [];
+	for (const pattern of config.files) {
+		const absolutePattern = path.resolve(process.cwd(), pattern);
+		try {
+			const filteredFiles = fs.globSync(absolutePattern).filter((file) => !ignoreFiles.has(file));
+			files.push(...filteredFiles);
+		} catch (error) {
+			logger.warn(`Failed to glob pattern "${pattern}": ${String(error)}`);
+		}
+	}
+	return files;
+}
+
+//#endregion
+//#region src/parser/service/tailordb/relation.ts
+const relationTypes = {
+	"1-1": "1-1",
+	oneToOne: "1-1",
+	"n-1": "n-1",
+	manyToOne: "n-1",
+	"N-1": "n-1",
+	keyOnly: "keyOnly"
+};
+const relationTypesKeys = Object.keys(relationTypes);
+function fieldRef(context) {
+	return `Field "${context.fieldName}" on type "${context.typeName}"`;
+}
+/**
+* Validate relation configuration.
+* @param rawRelation - Raw relation configuration from TailorDB type definition
+* @param context - Context information for the relation (type name, field name, all type names)
+*/
+function validateRelationConfig(rawRelation, context) {
+	if (!rawRelation.type) throw new Error(`${fieldRef(context)} has a relation but is missing the required 'type' property. Valid values: ${relationTypesKeys.join(", ")}.`);
+	if (!(rawRelation.type in relationTypes)) throw new Error(`${fieldRef(context)} has invalid relation type '${rawRelation.type}'. Valid values: ${relationTypesKeys.join(", ")}.`);
+	if (rawRelation.toward.type !== "self" && !context.allTypeNames.has(rawRelation.toward.type)) throw new Error(`${fieldRef(context)} references unknown type "${rawRelation.toward.type}".`);
+}
+/**
+* Process raw relation config and compute derived metadata values.
+* @param rawRelation - Raw relation configuration
+* @param context - Context information for the relation
+* @param isArrayField - Whether the target field is an array field
+* @returns Computed relation metadata to apply to field config
+*/
+function processRelationMetadata(rawRelation, context, isArrayField = false) {
+	const isUnique = relationTypes[rawRelation.type] === "1-1";
+	const key = rawRelation.toward.key ?? "id";
+	const targetTypeName = rawRelation.toward.type === "self" ? context.typeName : rawRelation.toward.type;
+	const shouldSetIndex = !isArrayField;
+	const shouldSetUnique = !isArrayField && isUnique;
+	return {
+		index: shouldSetIndex,
+		foreignKey: true,
+		relationType: rawRelation.type,
+		unique: shouldSetUnique,
+		foreignKeyType: targetTypeName,
+		foreignKeyField: key
+	};
+}
+/**
+* Build relation info for creating forward/backward relationships.
+* Returns undefined for keyOnly relations.
+* @param rawRelation - Raw relation configuration
+* @param context - Context information for the relation
+* @returns Relation information or undefined for keyOnly relations
+*/
+function buildRelationInfo(rawRelation, context) {
+	if (rawRelation.type === "keyOnly") return;
+	const isUnique = relationTypes[rawRelation.type] === "1-1";
+	const key = rawRelation.toward.key ?? "id";
+	const targetTypeName = rawRelation.toward.type === "self" ? context.typeName : rawRelation.toward.type;
+	let forwardName = rawRelation.toward.as;
+	if (!forwardName) if (rawRelation.toward.type === "self") forwardName = context.fieldName.replace(/(ID|Id|id)$/u, "");
+	else forwardName = inflection.camelize(targetTypeName, true);
+	return {
+		targetType: targetTypeName,
+		forwardName,
+		backwardName: rawRelation.backward ?? "",
+		key,
+		unique: isUnique
+	};
+}
+/**
+* Apply processed relation metadata to field config.
+* @param fieldConfig - Original operator field configuration
+* @param metadata - Processed relation metadata to apply
+* @returns Field config with relation metadata applied
+*/
+function applyRelationMetadataToFieldConfig(fieldConfig, metadata) {
+	return {
+		...fieldConfig,
+		index: metadata.index,
+		foreignKey: metadata.foreignKey,
+		unique: metadata.unique,
+		foreignKeyType: metadata.foreignKeyType,
+		foreignKeyField: metadata.foreignKeyField
+	};
+}
+
+//#endregion
+//#region src/parser/service/tailordb/schema.ts
+/**
+* Normalize GqlOperationsConfig (alias or object) to GqlOperations object.
+* "query" alias expands to read-only mode: { create: false, update: false, delete: false, read: true }
+* @param config - The config to normalize
+* @returns The normalized GqlOperations object
+*/
+function normalizeGqlOperations(config) {
+	if (config === "query") return {
+		create: false,
+		update: false,
+		delete: false,
+		read: true
+	};
+	return config;
+}
+/**
+* Zod schema for GqlOperations configuration with normalization transform.
+* Accepts "query" alias or detailed object, normalizes to GqlOperations object.
+*/
+const GqlOperationsSchema = z.union([z.literal("query"), z.strictObject({
+	create: z.boolean().optional().describe("Enable create mutation (default: true)"),
+	update: z.boolean().optional().describe("Enable update mutation (default: true)"),
+	delete: z.boolean().optional().describe("Enable delete mutation (default: true)"),
+	read: z.boolean().optional().describe("Enable read queries - get, list, aggregation (default: true)")
+})]).describe("Configuration for GraphQL operations on a TailorDB type.\nAll operations are enabled by default (undefined or true = enabled, false = disabled).").transform((val) => normalizeGqlOperations(val));
+const TailorFieldTypeSchema$1 = z.enum([
+	"uuid",
+	"string",
+	"boolean",
+	"integer",
+	"float",
+	"decimal",
+	"enum",
+	"date",
+	"datetime",
+	"time",
+	"nested"
+]);
+const AllowedValueSchema$1 = z.strictObject({
+	value: z.string(),
+	description: z.string().optional()
+});
+const DBFieldMetadataSchema = z.strictObject({
+	required: z.boolean().optional().describe("Whether the field is required"),
+	array: z.boolean().optional().describe("Whether the field is an array"),
+	description: z.string().optional().describe("Field description"),
+	typeName: z.string().optional().describe("Type name for nested or enum fields"),
+	allowedValues: z.array(AllowedValueSchema$1).optional().describe("Allowed values for enum fields"),
+	index: z.boolean().optional().describe("Whether the field is indexed for faster queries"),
+	unique: z.boolean().optional().describe("Whether the field value must be unique"),
+	vector: z.boolean().optional().describe("Whether the field is a vector field for similarity search"),
+	foreignKey: z.boolean().optional().describe("Whether the field is a foreign key"),
+	foreignKeyType: z.string().optional().describe("Target type name for foreign key relations"),
+	foreignKeyField: z.string().optional().describe("Target field name for foreign key relations"),
+	hooks: z.strictObject({
+		create: functionSchema.optional().describe("Hook function called on record creation"),
+		update: functionSchema.optional().describe("Hook function called on record update")
+	}).optional().describe("Lifecycle hooks for the field"),
+	validate: z.array(z.union([functionSchema, z.tuple([functionSchema, z.string()])])).optional().describe("Validation functions for the field"),
+	serial: z.strictObject({
+		start: z.number().describe("Starting value for the serial sequence"),
+		maxValue: z.number().optional().describe("Maximum value for the serial sequence"),
+		format: z.string().optional().describe("Format string for serial value (string type only)")
+	}).optional().describe("Serial (auto-increment) configuration"),
+	scale: z.number().int().min(0).max(12).optional().describe("Decimal scale (number of digits after decimal point, 0-12)")
+});
+const RelationTypeSchema = z.enum(relationTypesKeys);
+const RawRelationConfigSchema = z.strictObject({
+	type: RelationTypeSchema.describe("Relation cardinality type"),
+	toward: z.strictObject({
+		type: z.string().describe("Target type name, or 'self' for self-relations"),
+		as: z.string().optional().describe("Custom forward relation name"),
+		key: z.string().optional().describe("Target field to join on (default: 'id')")
+	}),
+	backward: z.string().optional().describe("Backward relation name on the target type")
+});
+const TailorDBFieldSchema = z.lazy(() => z.object({
+	type: TailorFieldTypeSchema$1,
+	fields: z.record(z.string(), TailorDBFieldSchema).optional(),
+	metadata: DBFieldMetadataSchema,
+	rawRelation: RawRelationConfigSchema.optional()
+}));
+/**
+* Schema for TailorDB type settings.
+* Normalizes gqlOperations from alias ("query") to object format.
+*/
+const TailorDBTypeSettingsSchema = z.strictObject({
+	pluralForm: z.string().optional().describe("Custom plural form of the type name for GraphQL"),
+	aggregation: z.boolean().optional().describe("Enable aggregation queries for this type"),
+	bulkUpsert: z.boolean().optional().describe("Enable bulk upsert mutation for this type"),
+	gqlOperations: GqlOperationsSchema.optional().describe("Configure GraphQL operations for this type. Use \"query\" for read-only mode, or an object for granular control."),
+	publishEvents: z.boolean().optional().describe("Enable publishing events for this type.\nWhen enabled, record creation/update/deletion events are published.\nIf not specified, this is automatically set to true when an executor uses this type\nwith recordCreated/recordUpdated/recordDeleted triggers. If explicitly set to false\nwhile an executor uses this type, an error will be thrown during apply.")
+});
+const GQL_PERMISSION_INVALID_OPERAND_MESSAGE = "operand is not supported in gqlPermission. Use permission() for record-level conditions.";
+const GqlPermissionOperandSchema = z.union([
+	z.strictObject({ user: z.string() }),
+	z.string(),
+	z.boolean(),
+	z.array(z.string()),
+	z.array(z.boolean())
+], { error: (issue) => {
+	if (typeof issue.input === "object" && issue.input !== null) {
+		const keys = Object.keys(issue.input);
+		if (keys.length === 1) return `"${keys[0]}" ${GQL_PERMISSION_INVALID_OPERAND_MESSAGE}`;
+		return "Operand object must have exactly 1 key";
+	}
+	return "Invalid operand in gqlPermission";
+} });
+const RecordPermissionOperandSchema = z.union([
+	GqlPermissionOperandSchema,
+	z.strictObject({ record: z.string() }),
+	z.strictObject({ oldRecord: z.string() }),
+	z.strictObject({ newRecord: z.string() })
+]);
+const PermissionOperatorSchema = z.enum([
+	"=",
+	"!=",
+	"in",
+	"not in",
+	"hasAny",
+	"not hasAny"
+]);
+const RecordPermissionConditionSchema = z.tuple([
+	RecordPermissionOperandSchema,
+	PermissionOperatorSchema,
+	RecordPermissionOperandSchema
+]).readonly();
+const GqlPermissionConditionSchema = z.tuple([
+	GqlPermissionOperandSchema,
+	PermissionOperatorSchema,
+	GqlPermissionOperandSchema
+]).readonly();
+const ActionPermissionSchema = z.union([
+	z.strictObject({
+		conditions: z.union([RecordPermissionConditionSchema, z.array(RecordPermissionConditionSchema).readonly()]),
+		description: z.string().optional(),
+		permit: z.boolean().optional()
+	}),
+	z.tuple([
+		RecordPermissionOperandSchema,
+		PermissionOperatorSchema,
+		RecordPermissionOperandSchema
+	]).readonly(),
+	z.tuple([
+		RecordPermissionOperandSchema,
+		PermissionOperatorSchema,
+		RecordPermissionOperandSchema,
+		z.boolean()
+	]).readonly(),
+	z.array(z.union([RecordPermissionConditionSchema, z.boolean()])).refine((arr) => {
+		const boolIndex = arr.findIndex((item) => typeof item === "boolean");
+		return boolIndex === -1 || boolIndex === arr.length - 1;
+	}, { message: "Boolean permit flag must only appear at the end" }).readonly()
+]);
+const GqlPermissionActionSchema = z.enum([
+	"read",
+	"create",
+	"update",
+	"delete",
+	"aggregate",
+	"bulkUpsert"
+]);
+const GqlPermissionPolicySchema = z.strictObject({
+	conditions: z.array(GqlPermissionConditionSchema).readonly(),
+	actions: z.union([z.literal("all"), z.array(GqlPermissionActionSchema).readonly()]),
+	permit: z.boolean().optional(),
+	description: z.string().optional()
+});
+const RawPermissionsSchema = z.strictObject({
+	record: z.strictObject({
+		create: z.array(ActionPermissionSchema).readonly(),
+		read: z.array(ActionPermissionSchema).readonly(),
+		update: z.array(ActionPermissionSchema).readonly(),
+		delete: z.array(ActionPermissionSchema).readonly()
+	}).optional(),
+	gql: z.array(GqlPermissionPolicySchema).readonly().optional()
+});
+const TailorDBTypeSchema = z.strictObject({
+	name: z.string(),
+	fields: z.record(z.string(), TailorDBFieldSchema),
+	metadata: z.object({
+		name: z.string(),
+		description: z.string().optional(),
+		settings: TailorDBTypeSettingsSchema.optional(),
+		permissions: RawPermissionsSchema,
+		files: z.record(z.string(), z.string()),
+		indexes: z.record(z.string(), z.strictObject({
+			fields: z.array(z.string()),
+			unique: z.boolean().optional()
+		})).optional()
+	}).strict()
+});
+const TailorDBMigrationConfigSchema = z.strictObject({
+	directory: z.string().describe("Directory containing migration files"),
+	machineUser: z.string().optional().describe("Machine user name for migration execution")
+});
+/**
+* Schema for TailorDB service configuration.
+* Normalizes gqlOperations from alias ("query") to object format.
+*/
+const TailorDBServiceConfigSchema = z.strictObject({
+	files: z.array(z.string()).describe("Glob patterns for TailorDB type definition files"),
+	ignores: z.array(z.string()).optional().describe("Glob patterns to exclude from type discovery"),
+	erdSite: z.string().optional().describe("URL for the ERD (Entity Relationship Diagram) site"),
+	migration: TailorDBMigrationConfigSchema.optional().describe("Migration configuration"),
+	gqlOperations: GqlOperationsSchema.optional().describe("Default GraphQL operations for all types in this service")
+});
+
+//#endregion
+//#region src/parser/service/tailordb/builder-helpers.ts
+const TAILORDB_TYPE_SCHEMA_KEYS = TailorDBTypeSchema.keyof().options;
+function stripTailorDBTypeBuilderHelpers(type) {
+	if (!isSdkBranded(type, "tailordb-type")) return type;
+	const config = {};
+	const input = type;
+	for (const key of TAILORDB_TYPE_SCHEMA_KEYS) if (Object.prototype.hasOwnProperty.call(input, key)) config[key] = input[key];
+	return config;
+}
+
+//#endregion
+//#region src/parser/service/auth-connection/schema.ts
+const AuthConnectionOAuth2ConfigSchema = z.strictObject({
+	providerUrl: z.string().describe("OAuth2 provider URL"),
+	issuerUrl: z.string().describe("OAuth2 issuer URL"),
+	clientId: z.string().describe("OAuth2 client ID"),
+	clientSecret: z.string().describe("OAuth2 client secret"),
+	authUrl: z.string().optional().describe("OAuth2 authorization endpoint override"),
+	tokenUrl: z.string().optional().describe("OAuth2 token endpoint override")
+});
+const AuthConnectionConfigSchema = AuthConnectionOAuth2ConfigSchema.extend({ type: z.literal("oauth2").describe("Connection type") });
+
+//#endregion
+//#region src/parser/service/field/schema.ts
+const TailorFieldTypeSchema = z.enum([
+	"uuid",
+	"string",
+	"boolean",
+	"integer",
+	"float",
+	"decimal",
+	"enum",
+	"date",
+	"datetime",
+	"time",
+	"nested"
+]);
+const AllowedValueSchema = z.strictObject({
+	value: z.string().describe("The allowed value"),
+	description: z.string().optional().describe("Description of the allowed value")
+});
+const FieldMetadataSchema = z.strictObject({
+	required: z.boolean().optional().describe("Whether the field is required"),
+	array: z.boolean().optional().describe("Whether the field is an array"),
+	description: z.string().optional().describe("Field description"),
+	allowedValues: z.array(AllowedValueSchema).optional().describe("Allowed values for enum fields"),
+	hooks: z.strictObject({
+		create: functionSchema.optional().describe("Hook function called on creation"),
+		update: functionSchema.optional().describe("Hook function called on update")
+	}).optional().describe("Lifecycle hooks"),
+	validate: z.array(z.union([functionSchema, z.tuple([functionSchema, z.string()])])).optional().describe("Validation functions for the field"),
+	typeName: z.string().optional().describe("Type name for nested or enum fields")
+});
+const TailorFieldSchema = z.object({
+	type: TailorFieldTypeSchema.describe("Field data type"),
+	metadata: FieldMetadataSchema.describe("Field metadata configuration"),
+	get fields() {
+		return z.record(z.string(), TailorFieldSchema);
+	}
+});
+
+//#endregion
+//#region src/parser/service/auth/schema.ts
+const AuthInvokerObjectSchema = z.strictObject({
+	namespace: z.string().describe("Auth namespace"),
+	machineUserName: z.string().describe("Machine user name for authentication")
+});
+const AuthInvokerSchema = z.union([z.string().describe("Machine user name (namespace auto-resolved from auth service)"), AuthInvokerObjectSchema]);
+const secretValueSchema = z.strictObject({
+	vaultName: z.string().describe("Vault name containing the secret"),
+	secretKey: z.string().describe("Key of the secret in the vault")
+});
+const OIDCSchema = z.strictObject({
+	name: z.string().describe("Identity provider name"),
+	kind: z.literal("OIDC"),
+	clientID: z.string().describe("OAuth2 client ID"),
+	clientSecret: secretValueSchema.describe("OAuth2 client secret"),
+	providerURL: z.string().describe("OIDC provider URL"),
+	issuerURL: z.string().optional().describe("OIDC issuer URL (defaults to providerURL)"),
+	usernameClaim: z.string().optional().describe("JWT claim to use as username")
+});
+const SAMLSchema = z.strictObject({
+	name: z.string().describe("Identity provider name"),
+	kind: z.literal("SAML"),
+	enableSignRequest: z.boolean().default(false).describe("Enable signing of SAML requests"),
+	metadataURL: z.string().optional().describe("URL to fetch SAML metadata (mutually exclusive with rawMetadata)"),
+	rawMetadata: z.string().optional().describe("Raw SAML metadata XML (mutually exclusive with metadataURL)"),
+	defaultRedirectURL: z.string().optional().describe("URL to redirect to when SAML ACS receives a response with an empty RelayState.")
+}).refine((value) => {
+	return value.metadataURL !== void 0 !== (value.rawMetadata !== void 0);
+}, "Provide either metadataURL or rawMetadata");
+const IDTokenSchema = z.strictObject({
+	name: z.string().describe("Identity provider name"),
+	kind: z.literal("IDToken"),
+	providerURL: z.string().describe("ID token provider URL"),
+	issuerURL: z.string().optional().describe("ID token issuer URL"),
+	clientID: z.string().describe("Client ID for ID token validation"),
+	usernameClaim: z.string().optional().describe("JWT claim to use as username")
+});
+const BuiltinIdPSchema = z.strictObject({
+	name: z.string().describe("Identity provider name"),
+	kind: z.literal("BuiltInIdP"),
+	namespace: z.string().describe("IdP namespace"),
+	clientName: z.string().describe("OAuth2 client name in the IdP")
+});
+const IdProviderSchema = z.discriminatedUnion("kind", [
+	OIDCSchema,
+	SAMLSchema,
+	IDTokenSchema,
+	BuiltinIdPSchema
+]);
+const OAuth2ClientGrantTypeSchema = z.union([z.literal("authorization_code"), z.literal("refresh_token")]).describe("OAuth2 grant type");
+const OAuth2ClientSchema = z.strictObject({
+	description: z.string().optional().describe("Client description"),
+	grantTypes: z.array(OAuth2ClientGrantTypeSchema).default(["authorization_code", "refresh_token"]).describe("Allowed OAuth2 grant types"),
+	redirectURIs: z.array(z.union([
+		z.templateLiteral(["https://", z.string()]),
+		z.templateLiteral(["http://", z.string()]),
+		z.templateLiteral([z.string(), ":url"]),
+		z.templateLiteral([
+			z.string(),
+			":url/",
+			z.string()
+		])
+	])).describe("Allowed redirect URIs"),
+	clientType: z.union([
+		z.literal("confidential"),
+		z.literal("public"),
+		z.literal("browser")
+	]).optional().describe("OAuth2 client type"),
+	accessTokenLifetimeSeconds: z.number().int().min(60, "Minimum access token lifetime is 60 seconds").max(86400, "Maximum access token lifetime is 1 day (86400 seconds)").optional().describe("Access token lifetime in seconds (60-86400)").transform((val) => val ? {
+		seconds: BigInt(val),
+		nanos: 0
+	} : void 0),
+	refreshTokenLifetimeSeconds: z.number().int().min(60, "Minimum refresh token lifetime is 60 seconds").max(604800, "Maximum refresh token lifetime is 7 days (604800 seconds)").optional().describe("Refresh token lifetime in seconds (60-604800)").transform((val) => val ? {
+		seconds: BigInt(val),
+		nanos: 0
+	} : void 0),
+	requireDpop: z.boolean().optional().describe("Require DPoP (Demonstrating Proof-of-Possession) for token requests")
+}).refine((data) => !(data.clientType === "browser" && data.requireDpop === true), {
+	message: "requireDpop cannot be set to true for browser clients as they don't support DPoP",
+	path: ["requireDpop"]
+});
+const SCIMAuthorizationSchema = z.strictObject({
+	type: z.union([z.literal("oauth2"), z.literal("bearer")]).describe("SCIM authorization type"),
+	bearerSecret: secretValueSchema.optional().describe("Bearer token secret (required for bearer type)")
+});
+const SCIMAttributeTypeSchema = z.union([
+	z.literal("string"),
+	z.literal("number"),
+	z.literal("boolean"),
+	z.literal("datetime"),
+	z.literal("complex")
+]).describe("SCIM attribute data type");
+const SCIMAttributeSchema = z.strictObject({
+	type: SCIMAttributeTypeSchema.describe("Attribute data type"),
+	name: z.string().describe("Attribute name"),
+	description: z.string().optional().describe("Attribute description"),
+	mutability: z.union([
+		z.literal("readOnly"),
+		z.literal("readWrite"),
+		z.literal("writeOnly")
+	]).optional().describe("Attribute mutability"),
+	required: z.boolean().optional().describe("Whether the attribute is required"),
+	multiValued: z.boolean().optional().describe("Whether the attribute can have multiple values"),
+	uniqueness: z.union([
+		z.literal("none"),
+		z.literal("server"),
+		z.literal("global")
+	]).optional().describe("Uniqueness constraint"),
+	canonicalValues: z.array(z.string()).nullable().optional().describe("List of canonical values"),
+	get subAttributes() {
+		return z.array(SCIMAttributeSchema).nullable().optional();
+	}
+});
+const SCIMSchemaSchema = z.strictObject({
+	name: z.string().describe("SCIM schema name"),
+	attributes: z.array(SCIMAttributeSchema).describe("Schema attributes")
+});
+const SCIMAttributeMappingSchema = z.strictObject({
+	tailorDBField: z.string().describe("TailorDB field name to map to"),
+	scimPath: z.string().describe("SCIM attribute path")
+});
+const SCIMResourceSchema = z.strictObject({
+	name: z.string().describe("SCIM resource name"),
+	tailorDBNamespace: z.string().describe("TailorDB namespace for the resource"),
+	tailorDBType: z.string().describe("TailorDB type name for the resource"),
+	coreSchema: SCIMSchemaSchema.describe("Core SCIM schema definition"),
+	attributeMapping: z.array(SCIMAttributeMappingSchema).describe("Attribute mapping configuration")
+});
+const SCIMSchema = z.strictObject({
+	machineUserName: z.string().describe("Machine user name for SCIM operations"),
+	authorization: SCIMAuthorizationSchema.describe("SCIM authorization configuration"),
+	resources: z.array(SCIMResourceSchema).describe("SCIM resource definitions")
+});
+const TenantProviderSchema = z.strictObject({
+	namespace: z.string().describe("TailorDB namespace for the tenant type"),
+	type: z.string().describe("TailorDB type name for tenants"),
+	signatureField: z.string().describe("Field used as the tenant signature")
+});
+const UserProfileSchema = z.strictObject({
+	namespace: z.string().optional().describe("TailorDB namespace where the user type is defined"),
+	type: z.custom().transform(stripTailorDBTypeBuilderHelpers).pipe(TailorDBTypeSchema),
+	usernameField: z.string(),
+	attributes: z.record(z.string(), z.literal(true)).optional(),
+	attributeList: z.array(z.string()).optional()
+});
+const ValueOperandSchema = z.union([
+	z.string(),
+	z.boolean(),
+	z.array(z.string()),
+	z.array(z.boolean())
+]);
+const MachineUserSchema = z.strictObject({
+	attributes: z.record(z.string(), ValueOperandSchema).optional(),
+	attributeList: z.array(z.uuid()).optional()
+});
+const BeforeLoginHookSchema = z.strictObject({
+	handler: z.function(),
+	invoker: z.string()
+});
+const AuthConfigBaseSchema = z.strictObject({
+	name: z.string().describe("Auth service name"),
+	hooks: z.strictObject({ beforeLogin: BeforeLoginHookSchema.optional().describe("Before login auth hook") }).optional().describe("Auth hooks"),
+	machineUsers: z.record(z.string(), MachineUserSchema).optional().describe("Machine user definitions"),
+	oauth2Clients: z.record(z.string(), OAuth2ClientSchema).optional().describe("OAuth2 client definitions"),
+	idProvider: IdProviderSchema.optional().describe("Identity provider configuration"),
+	scim: SCIMSchema.optional().describe("SCIM provisioning configuration"),
+	tenantProvider: TenantProviderSchema.optional().describe("Multi-tenant provider configuration"),
+	connections: z.record(z.string(), AuthConnectionConfigSchema).optional().describe("Auth connection definitions for external OAuth2 providers"),
+	publishSessionEvents: z.boolean().optional().describe("Enable publishing session events")
+});
+const AuthConfigSchema = z.xor([AuthConfigBaseSchema.extend({
+	userProfile: UserProfileSchema.optional().describe("User profile configuration"),
+	machineUserAttributes: z.undefined().optional()
+}), AuthConfigBaseSchema.extend({
+	userProfile: z.undefined().optional(),
+	machineUserAttributes: z.record(z.string(), TailorFieldSchema).describe("Machine user attribute fields")
+})], { error: (iss) => {
+	if (iss.code !== "invalid_union") return void 0;
+	if (iss.errors.length < 2) return void 0;
+	if (iss.errors.every((variantErrors) => variantErrors.every((e) => e.path.length === 1 && (e.path[0] === "userProfile" || e.path[0] === "machineUserAttributes")))) return "Specify either `userProfile` or `machineUserAttributes`, not both.";
+} }).brand("AuthConfig");
+
+//#endregion
+//#region src/parser/service/executor/schema.ts
+const TailorDBTriggerSchema = z.strictObject({
+	kind: z.literal("tailordb").describe("TailorDB record event trigger"),
+	events: z.array(z.enum([
+		"tailordb.type_record.created",
+		"tailordb.type_record.updated",
+		"tailordb.type_record.deleted"
+	])).min(1).transform((arr) => [...new Set(arr)]).describe("TailorDB event types to trigger on"),
+	typeName: z.string().describe("TailorDB type name to watch for events"),
+	condition: functionSchema.optional().describe("Condition function to filter events")
+});
+const ResolverExecutedTriggerSchema = z.strictObject({
+	kind: z.literal("resolverExecuted"),
+	resolverName: z.string().describe("Name of the resolver to trigger on"),
+	condition: functionSchema.optional().describe("Condition function to filter events")
+});
+const ScheduleTriggerSchema = z.strictObject({
+	kind: z.literal("schedule"),
+	cron: z.string().describe("CRON expression for the schedule"),
+	timezone: z.string().optional().default("UTC").describe("Timezone for the CRON schedule (default: UTC)")
+});
+const IncomingWebhookTriggerResponseSchema = z.strictObject({
+	body: functionSchema.optional().describe("Function returning the response body"),
+	statusCode: z.number().int().optional().describe("HTTP status code for the response")
+});
+const IncomingWebhookTriggerSchema = z.strictObject({
+	kind: z.literal("incomingWebhook"),
+	response: IncomingWebhookTriggerResponseSchema.optional().describe("Response configuration")
+});
+const IdpUserTriggerSchema = z.strictObject({
+	kind: z.literal("idpUser").describe("IdP user event trigger"),
+	events: z.array(z.enum([
+		"idp.user.created",
+		"idp.user.updated",
+		"idp.user.deleted"
+	])).min(1).transform((arr) => [...new Set(arr)]).describe("IdP user event types to trigger on"),
+	idp: z.string().optional().describe("IdP namespace name to subscribe to. If omitted, the project's only IdP is used; throws when multiple IdPs exist.")
+});
+const AuthAccessTokenTriggerSchema = z.strictObject({
+	kind: z.literal("authAccessToken").describe("Auth access token event trigger"),
+	events: z.array(z.enum([
+		"auth.access_token.issued",
+		"auth.access_token.refreshed",
+		"auth.access_token.revoked"
+	])).min(1).transform((arr) => [...new Set(arr)]).describe("Auth access token event types to trigger on")
+});
+const TriggerSchema = z.discriminatedUnion("kind", [
+	TailorDBTriggerSchema,
+	ResolverExecutedTriggerSchema,
+	ScheduleTriggerSchema,
+	IncomingWebhookTriggerSchema,
+	IdpUserTriggerSchema,
+	AuthAccessTokenTriggerSchema
+]);
+const FunctionOperationSchema = z.strictObject({
+	kind: z.enum(["function", "jobFunction"]),
+	body: functionSchema.describe("Function implementation"),
+	invoker: AuthInvokerSchema.optional().describe("Invoker for the function execution")
+});
+const GqlOperationSchema = z.strictObject({
+	kind: z.literal("graphql"),
+	appName: z.string().optional().describe("Target application name for the GraphQL query"),
+	query: z.preprocess((val) => String(val), z.string().describe("GraphQL query string")),
+	variables: functionSchema.optional().describe("Function to compute GraphQL variables"),
+	invoker: AuthInvokerSchema.optional().describe("Invoker for the GraphQL execution")
+});
+const WebhookOperationSchema = z.strictObject({
+	kind: z.literal("webhook"),
+	url: functionSchema.describe("Function returning the webhook URL"),
+	requestBody: functionSchema.optional().describe("Function to compute the request body"),
+	headers: z.record(z.string(), z.union([z.string(), z.strictObject({
+		vault: z.string(),
+		key: z.string()
+	})])).optional().describe("HTTP headers for the webhook request")
+});
+const WorkflowOperationSchema = z.preprocess((val) => {
+	if (val == null || typeof val !== "object" || !("workflow" in val) || typeof val.workflow !== "object" || val.workflow === null) return val;
+	const { workflow, ...rest } = val;
+	return {
+		...rest,
+		workflowName: workflow.name
+	};
+}, z.strictObject({
+	kind: z.literal("workflow"),
+	workflowName: z.string().describe("Name of the workflow to execute"),
+	args: z.union([z.record(z.string(), z.unknown()), functionSchema]).optional().describe("Arguments to pass to the workflow"),
+	invoker: AuthInvokerSchema.optional().describe("Invoker for the workflow execution")
+}));
+const OperationSchema = z.union([
+	FunctionOperationSchema,
+	GqlOperationSchema,
+	WebhookOperationSchema,
+	WorkflowOperationSchema
+]);
+const ExecutorSchema = z.strictObject({
+	name: z.string().describe("Executor name"),
+	description: z.string().optional().describe("Executor description"),
+	disabled: z.boolean().optional().default(false).describe("Whether the executor is disabled"),
+	trigger: TriggerSchema.describe("Event trigger configuration"),
+	operation: OperationSchema.describe("Operation to execute when triggered")
+});
+
+//#endregion
+//#region src/cli/services/executor/loader.ts
+function stripExecutorTriggerArgs(executor) {
+	if (!isSdkBranded(executor, "executor")) return executor;
+	const trigger = executor.trigger;
+	if (trigger === null || typeof trigger !== "object" || !("__args" in trigger)) return executor;
+	const { __args: _args, ...triggerConfig } = trigger;
+	return {
+		...executor,
+		trigger: triggerConfig
+	};
+}
+/**
+* Load and validate an executor definition from a file.
+* @param executorFilePath - Path to the executor file
+* @returns Parsed executor or null if invalid
+*/
+async function loadExecutor(executorFilePath) {
+	const executor = (await import(pathToFileURL(executorFilePath).href)).default;
+	const parseResult = ExecutorSchema.safeParse(stripExecutorTriggerArgs(executor));
+	if (!parseResult.success) return null;
+	return parseResult.data;
+}
+
+//#endregion
+//#region src/cli/services/executor/service.ts
+/**
+* Creates a new ExecutorService instance.
+* @param params - Parameters for creating the service
+* @returns A new ExecutorService instance
+*/
+function createExecutorService(params) {
+	const { config } = params;
+	const executors = {};
+	const pluginExecutors = [];
+	let loadPromise;
+	const loadExecutorForFile = async (executorFile) => {
+		try {
+			const executorModule = await import(pathToFileURL(executorFile).href);
+			const result = ExecutorSchema.safeParse(stripExecutorTriggerArgs(executorModule.default));
+			if (result.success) {
+				const relativePath = path.relative(process.cwd(), executorFile);
+				logger.log(`Executor: ${styles.successBright(`"${result.data.name}"`)} loaded from ${styles.path(relativePath)}`);
+				executors[executorFile] = result.data;
+				return result.data;
+			}
+			if (isSdkBranded(executorModule.default, "executor")) throw result.error;
+		} catch (error) {
+			const relativePath = path.relative(process.cwd(), executorFile);
+			logger.error(`Failed to load executor from ${styles.bold(relativePath)}`);
+			logger.error(String(error));
+			throw error;
+		}
+	};
+	return {
+		config,
+		get executors() {
+			return executors;
+		},
+		get pluginExecutors() {
+			return pluginExecutors;
+		},
+		loadExecutors: async () => {
+			if (!loadPromise) loadPromise = (async () => {
+				if (config.files.length === 0) return;
+				const executorFiles = loadFilesWithIgnores(config);
+				logger.newline();
+				logger.log(`Found ${styles.highlight(executorFiles.length.toString())} executor files`);
+				await Promise.all(executorFiles.map((executorFile) => loadExecutorForFile(executorFile)));
+				assertUniqueExecutorNames(executors);
+				return executors;
+			})();
+			return loadPromise;
+		},
+		loadPluginExecutorFiles: async (filePaths) => {
+			if (filePaths.length === 0) return;
+			logger.newline();
+			logger.log(`Loading ${styles.highlight(filePaths.length.toString())} plugin-generated executor files`);
+			for (const filePath of filePaths) {
+				const executor = await loadExecutorForFile(filePath);
+				if (executor) pluginExecutors.push({
+					executor,
+					pluginId: "plugin-generated",
+					sourceTypeName: void 0
+				});
+			}
+			assertUniqueExecutorNames(executors);
+		}
+	};
+}
+/**
+* Assert that every loaded executor has a unique name.
+* Executors are stored by source file, so two files declaring the same
+* `name` would otherwise silently share a single bundle cache entry.
+* @param executors - Loaded executors keyed by source file
+*/
+function assertUniqueExecutorNames(executors) {
+	const seenNames = /* @__PURE__ */ new Map();
+	for (const [file, executor] of Object.entries(executors)) {
+		const relativePath = path.relative(process.cwd(), file);
+		const existing = seenNames.get(executor.name);
+		if (existing) throw new Error(`Duplicate executor name "${executor.name}" found:\n  - ${existing}\n  - ${relativePath}\nEach executor must have a unique name.`);
+		seenNames.set(executor.name, relativePath);
+	}
+}
+
+//#endregion
+export { AuthConfigSchema as a, stripTailorDBTypeBuilderHelpers as c, applyRelationMetadataToFieldConfig as d, buildRelationInfo as f, functionSchema as g, loadFilesWithIgnores as h, ExecutorSchema as i, TailorDBServiceConfigSchema as l, validateRelationConfig as m, loadExecutor as n, AuthInvokerSchema as o, processRelationMetadata as p, stripExecutorTriggerArgs as r, TailorFieldSchema as s, createExecutorService as t, TailorDBTypeSchema as u };
+//# sourceMappingURL=service-ufH7sS8o.mjs.map