@tailor-platform/sdk 2.0.0-next.3 → 2.0.0-next.4

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # @tailor-platform/sdk
 
+## 2.0.0-next.4
+
+### Major Changes
+
+- [#1693](https://github.com/tailor-platform/sdk/pull/1693) [`4751214`](https://github.com/tailor-platform/sdk/commit/4751214c0923e094a844f9ce322279a47e871075) Thanks [@dqn](https://github.com/dqn)! - Rename the TailorDB schema builder from `db.type()` to `db.table()`.
+  
+  Update TailorDB definitions:
+  
+  ```diff
+   import { db } from "@tailor-platform/sdk";
+  
+  -export const user = db.type("User", {
+  +export const user = db.table("User", {
+     name: db.string(),
+   });
+  ```
+
+- [#1704](https://github.com/tailor-platform/sdk/pull/1704) [`9c81d9c`](https://github.com/tailor-platform/sdk/commit/9c81d9c18b1d29b3e9307ea17fe54c8ce55f4dda) Thanks [@dqn](https://github.com/dqn)! - Remove flat value and default exports from `@tailor-platform/sdk/runtime/*` subpath modules. Import each subpath through its self-named namespace export instead, for example `import { iconv } from "@tailor-platform/sdk/runtime/iconv"`.
+  
+  The aggregate `@tailor-platform/sdk/runtime` entry remains named-only, and its deprecated `file.deleteFile` alias is removed in favor of `file.delete`. The v2 codemod rewrites straightforward namespace-star subpath imports, flat named value imports, and aggregate `file.deleteFile` calls to the new namespace-object style.
+  
+  `TailorContextAPI` and `TailorWorkflowAPI` now describe the SDK wrapper objects. Code that types the platform-provided `globalThis.tailor.context` or `globalThis.tailor.workflow` objects directly must use `PlatformContextAPI` or `PlatformWorkflowAPI` instead.
+
+### Minor Changes
+
+- [#1699](https://github.com/tailor-platform/sdk/pull/1699) [`f6a8d07`](https://github.com/tailor-platform/sdk/commit/f6a8d0779f94c2de5502dfdc68348e4a41ceee47) Thanks [@dqn](https://github.com/dqn)! - Allow `setup coordinate --action` values to group multiple generated actions into one multi-config deploy by separating action names with commas.
+
+### Patch Changes
+
+- [#1702](https://github.com/tailor-platform/sdk/pull/1702) [`03143f5`](https://github.com/tailor-platform/sdk/commit/03143f5213d9fa9d3c7697de78f2376994716679) Thanks [@dqn](https://github.com/dqn)! - Clarify the setup delete warning for coordinator action references so grouped `--action` values tell users to remove the action name from the relevant value.
+
+- [#1691](https://github.com/tailor-platform/sdk/pull/1691) [`2f3dbab`](https://github.com/tailor-platform/sdk/commit/2f3dbab7ed3cf40fa174a82053d70c23c356204d) Thanks [@dqn](https://github.com/dqn)! - Clarify when profile machine user override errors are caused by `TAILOR_PLATFORM_MACHINE_USER_NAME`.
+
+- [#1700](https://github.com/tailor-platform/sdk/pull/1700) [`0063115`](https://github.com/tailor-platform/sdk/commit/0063115f567ba7e73c0b679a392d5983869e8ac4) Thanks [@toiroakr](https://github.com/toiroakr)! - Fix `tailor` CLI failing with `ERR_MODULE_NOT_FOUND` when resolving extensionless relative imports of files whose basename contains a dot (e.g. `./permissions.generated`).
+
+- [#1705](https://github.com/tailor-platform/sdk/pull/1705) [`958d571`](https://github.com/tailor-platform/sdk/commit/958d571555a5c66e2e3b9beb3d2247f63cbb8f2c) Thanks [@toiroakr](https://github.com/toiroakr)! - Fix `tailor` CLI failing with `ERR_MODULE_NOT_FOUND` when resolving `tsconfig.json` path aliases (`compilerOptions.paths`) in projects that omit `baseUrl`, which is the standard style since TypeScript 5.0. Also fix path alias resolution to match TypeScript's `extends` behavior: a child config's `baseUrl` is now correctly inherited from an extended config, and a child config's own `paths` now replaces (rather than merges with) inherited `paths`.
+
+- [#1703](https://github.com/tailor-platform/sdk/pull/1703) [`4681778`](https://github.com/tailor-platform/sdk/commit/46817786354665cb97d0de63b78fa83e64096e03) Thanks [@toiroakr](https://github.com/toiroakr)! - Fix generated Kysely types for `db.date()` fields to use `Timestamp` instead of `string`, matching `db.datetime()` and allowing `insertInto`/`updateTable` calls to accept a `Date` value.
+
 ## 2.0.0-next.3
 
 ### Major Changes
@@ -226,6 +265,12 @@
 
 - [#1421](https://github.com/tailor-platform/sdk/pull/1421) [`b933f47`](https://github.com/tailor-platform/sdk/commit/b933f474d65f8dfed56f3991aae3a52589368b10) Thanks [@dqn](https://github.com/dqn)! - Corrupted or hand-edited TailorDB migration snapshot/diff files now fail with a clear validation error when loaded, instead of causing undefined behavior later.
 
+## 1.75.0
+
+### Minor Changes
+
+- [#1679](https://github.com/tailor-platform/sdk/pull/1679) [`4ff2b23`](https://github.com/tailor-platform/sdk/commit/4ff2b23d84c5dd5f1692cc3b3f7b32b273b4d550) Thanks [@k1LoW](https://github.com/k1LoW)! - Add workflow job function execution policies. Declare them with `defineWorkflowExecutionPolicies` (or the single-key `defineWorkflowExecutionPolicy`), register them via `workflow.executionPolicies` on `defineConfig`, and pass the policy's `key` (or, for wildcard policies declared with `matchType: "prefix"`, the value returned by `keyFor(suffix)`) through the new `executionPolicyKey` option on `triggerJobFunction` / `job.trigger()` to apply the platform-side concurrency cap. `executionPolicyKey` only accepts values produced by a declared policy. `keyFor` joins the prefix and suffix with `.` by default; override it with `separator`, passed as the second argument to `defineWorkflowExecutionPolicies` (applies to every policy in the group) or as a `def` field on a single `defineWorkflowExecutionPolicy`.
+
 ## 1.74.1
 
 ### Patch Changes

package/dist/aigateway-DR4Kwuik.mjs

@@ -0,0 +1,9 @@
+//#region src/runtime/aigateway.ts
+const api = () => globalThis.tailor.aigateway;
+const get = (...args) => api().get(...args);
+/** Runtime wrapper namespace for `tailor.aigateway`. */
+const aigateway = { get };
+
+//#endregion
+export { aigateway as t };
+//# sourceMappingURL=aigateway-DR4Kwuik.mjs.map

package/dist/{aigateway-B3oZZE6v.mjs.map → aigateway-DR4Kwuik.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"aigateway-B3oZZE6v.mjs","names":[],"sources":["../src/runtime/aigateway.ts"],"sourcesContent":["/**\n * AI Gateway utilities.\n *\n * Thin typed wrapper around the platform-provided `tailor.aigateway` runtime API.\n * At runtime this delegates to `globalThis.tailor.aigateway`. Use `mockAigateway`\n * from `@tailor-platform/sdk/vitest` to mock these calls in unit tests.\n *\n * `name` is narrowed to the AI Gateway names defined via `defineAIGateway()`\n * once `tailor.d.ts` has been generated (via `tailor deploy`/`generate`).\n * @example\n * import { aigateway } from \"@tailor-platform/sdk/runtime\";\n *\n * const { url } = await aigateway.get(\"my-aigateway\");\n */\n\n// Import from the public entry (not `#/configure/types/aigateway-name`) so this d.ts\n// references `@tailor-platform/sdk` externally instead of inlining the registry — the\n// same generated `declare module \"@tailor-platform/sdk\"` that narrows\n// `authconnection.getConnectionToken` then also narrows this entry.\nimport type { AIGatewayName } from \"@tailor-platform/sdk\";\n\n/** Result of {@link TailorAigatewayAPI.get}. */\nexport interface GetAIGatewayResult {\n  /** The platform-assigned URL of the AI Gateway. */\n  url: string;\n}\n\n/**\n * Platform API surface for `tailor.aigateway`. Describes the shape the\n * platform runtime injects on `globalThis.tailor.aigateway`.\n *\n * Each method below is also re-exported as a top-level named export from this\n * module so callers can either `import * as aigateway from\n * \"@tailor-platform/sdk/runtime/aigateway\"` or pick individual methods.\n */\nexport interface TailorAigatewayAPI {\n  /**\n   * Resolves an AI Gateway defined in the caller's own workspace.\n   * @param name - AI Gateway name, as passed to `defineAIGateway()`\n   * @returns The resolved AI Gateway's platform-assigned URL\n   */\n  get(name: AIGatewayName): Promise<GetAIGatewayResult>;\n}\n\nconst api = (): TailorAigatewayAPI =>\n  (globalThis as { tailor: { aigateway: TailorAigatewayAPI } }).tailor.aigateway;\n\n/**\n * See {@link TailorAigatewayAPI.get}.\n * @param args - Forwarded to {@link TailorAigatewayAPI.get}\n * @returns The resolved AI Gateway's platform-assigned URL\n */\nexport const get: TailorAigatewayAPI[\"get\"] = (...args) => api().get(...args);\n"],"mappings":";;;;AA4CA,MAAM,YACH,WAA6D,OAAO;;;;;;AAOvE,MAAa,OAAkC,GAAG,SAAS,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI"}
+{"version":3,"file":"aigateway-DR4Kwuik.mjs","names":[],"sources":["../src/runtime/aigateway.ts"],"sourcesContent":["/**\n * AI Gateway utilities.\n *\n * Thin typed wrapper around the platform-provided `tailor.aigateway` runtime API.\n * At runtime this delegates to `globalThis.tailor.aigateway`. Use `mockAigateway`\n * from `@tailor-platform/sdk/vitest` to mock these calls in unit tests.\n *\n * `name` is narrowed to the AI Gateway names defined via `defineAIGateway()`\n * once `tailor.d.ts` has been generated (via `tailor deploy`/`generate`).\n * @example\n * import { aigateway } from \"@tailor-platform/sdk/runtime\";\n *\n * const { url } = await aigateway.get(\"my-aigateway\");\n */\n\n// Import from the public entry (not `#/configure/types/aigateway-name`) so this d.ts\n// references `@tailor-platform/sdk` externally instead of inlining the registry — the\n// same generated `declare module \"@tailor-platform/sdk\"` that narrows\n// `authconnection.getConnectionToken` then also narrows this entry.\nimport type { AIGatewayName } from \"@tailor-platform/sdk\";\n\n/** Result of {@link TailorAigatewayAPI.get}. */\nexport interface GetAIGatewayResult {\n  /** The platform-assigned URL of the AI Gateway. */\n  url: string;\n}\n\n/**\n * Platform API surface for `tailor.aigateway`. Describes the shape the\n * platform runtime injects on `globalThis.tailor.aigateway`.\n */\nexport interface TailorAigatewayAPI {\n  /**\n   * Resolves an AI Gateway defined in the caller's own workspace.\n   * @param name - AI Gateway name, as passed to `defineAIGateway()`\n   * @returns The resolved AI Gateway's platform-assigned URL\n   */\n  get(name: AIGatewayName): Promise<GetAIGatewayResult>;\n}\n\nconst api = (): TailorAigatewayAPI =>\n  (globalThis as unknown as { tailor: { aigateway: TailorAigatewayAPI } }).tailor.aigateway;\n\nconst get: TailorAigatewayAPI[\"get\"] = (...args) => api().get(...args);\n\n/** Runtime wrapper namespace for `tailor.aigateway`. */\nexport const aigateway = { get } as const satisfies TailorAigatewayAPI;\n"],"mappings":";AAwCA,MAAM,YACH,WAAwE,OAAO;AAElF,MAAM,OAAkC,GAAG,SAAS,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI;;AAGrE,MAAa,YAAY,EAAE,IAAI"}

package/dist/application-BO4ZF8wP.mjs

@@ -0,0 +1,3 @@
+import { n as generatePluginFilesIfNeeded, r as loadApplication, t as defineApplication } from "./application-BX13RArL.mjs";
+
+export { defineApplication, generatePluginFilesIfNeeded };

package/dist/{application-eHp9jXld.mjs → application-BX13RArL.mjs}

@@ -1,4 +1,5 @@
 import { n as isSdkBranded } from "./brand-Eo4pLXPJ.mjs";
+import { i as PageDirection } from "./resource_pb-BRv7AMXK.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
 import { a as parseBoolean, n as logger, r as styles } from "./logger-BEiZZ3qT.mjs";
 import { a as AuthConfigSchema, c as stripTailorDBTypeBuilderHelpers, d as applyRelationMetadataToFieldConfig, f as buildRelationInfo, g as functionSchema, h as loadFilesWithIgnores, l as TailorDBServiceConfigSchema, m as validateRelationConfig, n as loadExecutor, o as AuthInvokerSchema, p as processRelationMetadata, s as TailorFieldSchema, t as createExecutorService, u as TailorDBTypeSchema } from "./service-ufH7sS8o.mjs";
@@ -11,10 +12,12 @@ import { builtinModules, createRequire } from "node:module";
 import * as path from "pathe";
 import { join, resolve } from "pathe";
 import { resolveTSConfig } from "pkg-types";
+import { arg } from "politty";
 import { z } from "zod";
 import { create } from "@bufbuild/protobuf";
 import * as fs$1 from "node:fs";
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { parseEnv } from "node:util";
 import { MethodOptions_IdempotencyLevel } from "@bufbuild/protobuf/wkt";
 import { pathToFileURL } from "node:url";
 import { parseYAML, stringifyYAML } from "confbox";
@@ -33,6 +36,256 @@ import * as inflection from "inflection";
 import * as globals from "globals";
 import * as os from "node:os";
 
+//#region src/cli/shared/args.ts
+const unitToMs = {
+	ms: 1,
+	s: 1e3,
+	m: 60 * 1e3
+};
+const durationPattern = /^(\d+)(ms|s|m)$/;
+/**
+* Schema for duration string validation (e.g., "3s", "500ms", "1m")
+* Only validates format; use parseDuration() to convert to milliseconds
+*/
+const durationArg = z.string().refine((val) => durationPattern.test(val), { message: "Invalid duration format. Expected format: '3s', '500ms', '1m'" }).refine((val) => {
+	const match = val.match(durationPattern);
+	if (!match) return false;
+	const digits = match[1];
+	return digits !== void 0 && parseInt(digits, 10) > 0;
+}, { message: "Duration must be greater than 0" });
+/**
+* Parse a validated duration string into milliseconds
+* @param duration - Duration string (e.g., "3s", "500ms", "1m")
+* @returns Duration in milliseconds
+*/
+function parseDuration(duration) {
+	const match = assertDefined(duration.match(durationPattern), `invalid duration format: ${duration}`);
+	const value = parseInt(assertDefined(match[1], "duration digits group missing"), 10);
+	const unit = assertDefined(match[2], "duration unit group missing");
+	return value * unitToMs[unit];
+}
+/**
+* Schema for positive integer validation (from string input)
+* Transforms the string to a number
+*/
+const positiveIntArg = z.coerce.number().int().positive();
+/**
+* Schema for non-negative integer validation (from string input).
+* Accepts 0 (used for `--limit 0` to disable the limit).
+*/
+const nonNegativeIntArg = z.coerce.number().int().nonnegative();
+/**
+* Schema for sort order (`asc` or `desc`).
+*/
+const orderArg = z.enum(["asc", "desc"]);
+/**
+* Translate a CLI `--order` value into the proto `PageDirection` enum.
+* Returns `undefined` when the user did not specify an order so that
+* callers can omit the field and fall back to the server default.
+* @param order - Order string from CLI args (`"asc"` | `"desc"` | undefined)
+* @returns PageDirection, or undefined when `order` is undefined
+*/
+function toPageDirection(order) {
+	if (order === void 0) return void 0;
+	return order === "asc" ? PageDirection.ASC : PageDirection.DESC;
+}
+function hasMachineUserFlag(argv) {
+	return argv.slice(0, argv.indexOf("--") === -1 ? argv.length : argv.indexOf("--")).some((token) => token === "-m" || token.startsWith("-m=") || token === "--machine-user" || token.startsWith("--machine-user=") || token === "--machineUser" || token.startsWith("--machineUser=") || token === "--machineuser" || token.startsWith("--machineuser="));
+}
+/**
+* Resolve whether a parsed machine user value came from an explicit CLI option or env fallback.
+* @param machineUser - Parsed machine user value
+* @param argv - Raw CLI argv, excluding the executable and script path
+* @param options - Source resolution options
+* @returns Machine user input source, or undefined when no value was parsed
+*/
+function resolveMachineUserInputSource(machineUser, argv = process.argv.slice(2), options = {}) {
+	if (machineUser === void 0) return void 0;
+	if (options.valueIsExplicit) return "option";
+	if (hasMachineUserFlag(argv)) return "option";
+	return process.env.TAILOR_PLATFORM_MACHINE_USER_NAME === machineUser ? "env" : "option";
+}
+/**
+* Load env files from parsed arguments.
+* Processes --env-file first, then --env-file-if-exists.
+*
+* Follows Node.js --env-file behavior:
+* - Variables already set in the environment are NOT overwritten
+* - Variables from later files override those from earlier files
+* @param envFiles - Required env file path(s) that must exist
+* @param envFilesIfExists - Optional env file path(s) that are loaded if they exist
+*/
+function loadEnvFiles(envFiles, envFilesIfExists) {
+	const originalEnvKeys = new Set(Object.keys(process.env));
+	const load = (files, required) => {
+		for (const file of [files ?? []].flat()) {
+			const envPath = path.resolve(process.cwd(), file);
+			if (!fs$1.existsSync(envPath)) {
+				if (required) throw new Error(`Environment file not found: ${envPath}`);
+				continue;
+			}
+			const parsed = parseEnv(fs$1.readFileSync(envPath, "utf-8"));
+			for (const [key, value] of Object.entries(parsed)) {
+				if (originalEnvKeys.has(key)) continue;
+				process.env[key] = value;
+			}
+		}
+	};
+	load(envFiles, true);
+	load(envFilesIfExists, false);
+}
+/**
+* Common arguments for all CLI commands
+*
+* NOTE: --env-file and --env-file-if-exists collide with Node.js flags due to a bug
+* (https://github.com/nodejs/node/issues/54232). Node.js parses these even after the
+* script path, causing warnings (twice due to tsx loader).
+*/
+const commonArgs = {
+	"env-file": arg(z.string().optional(), {
+		alias: "e",
+		description: "Path to the environment file (error if not found)",
+		completion: {
+			type: "file",
+			matcher: [".env.*", ".env"]
+		}
+	}),
+	"env-file-if-exists": arg(z.string().optional(), {
+		description: "Path to the environment file (ignored if not found)",
+		completion: {
+			type: "file",
+			matcher: [".env.*", ".env"]
+		},
+		effect: (_value, { args }) => {
+			loadEnvFiles(args["env-file"], args["env-file-if-exists"]);
+		}
+	}),
+	verbose: arg(z.boolean().default(false), {
+		description: "Enable verbose logging",
+		effect: (value) => {
+			verboseMode = value;
+		}
+	}),
+	json: arg(z.boolean().default(false), {
+		alias: "j",
+		description: "Output as JSON",
+		effect: (value) => {
+			logger.jsonMode = value;
+		}
+	})
+};
+/**
+* Arguments for commands that require workspace context
+*/
+const workspaceArgs = {
+	"workspace-id": arg(z.string().optional(), {
+		alias: "w",
+		description: "Workspace ID",
+		env: "TAILOR_PLATFORM_WORKSPACE_ID",
+		completion: { type: "none" }
+	}),
+	profile: arg(z.string().optional(), {
+		alias: "p",
+		description: "Workspace profile",
+		env: "TAILOR_PLATFORM_PROFILE",
+		completion: { type: "none" }
+	})
+};
+/**
+* Shared config arg for commands that accept a config file path
+*/
+const configArg = { config: arg(z.string().default("tailor.config.ts"), {
+	alias: "c",
+	description: "Path to Tailor config file",
+	env: "TAILOR_CONFIG_PATH",
+	completion: {
+		type: "file",
+		extensions: ["ts"]
+	}
+}) };
+/**
+* Shared config arg for commands that accept one or more comma-separated config file paths
+*/
+const multiConfigArg = { config: arg(z.string().default("tailor.config.ts"), {
+	alias: "c",
+	description: "Path to SDK config file. Use comma-separated paths to deploy multiple apps together.",
+	env: "TAILOR_PLATFORM_SDK_CONFIG_PATH",
+	completion: {
+		type: "file",
+		extensions: ["ts"]
+	}
+}) };
+/**
+* Arguments for commands that interact with deployed resources (includes config)
+*/
+const deploymentArgs = {
+	...workspaceArgs,
+	...configArg
+};
+/**
+* Arguments for commands that require confirmation
+*/
+const confirmationArgs = { yes: arg(z.boolean().default(false), {
+	alias: "y",
+	description: "Skip confirmation prompts"
+}) };
+/**
+* Arguments for commands that require organization context
+*/
+const organizationArgs = { "organization-id": arg(z.string(), {
+	alias: "o",
+	description: "Organization ID",
+	env: "TAILOR_PLATFORM_ORGANIZATION_ID",
+	completion: { type: "none" }
+}) };
+/**
+* Arguments for list commands that accept `--order` / `--limit`. Sort
+* order defaults to `desc` (newest first) because most callers want the
+* latest items; pass `--order asc` to opt in to ascending order. The
+* limit is unbounded by default so existing invocations keep returning
+* every item; pass `--limit N` to cap the result size.
+* @param defaultOrder - Default value for `--order` (defaults to `"desc"`)
+* @returns Argument shape suitable for spreading into a command schema
+*/
+const paginationArgs = (defaultOrder = "desc") => ({
+	order: arg(orderArg.default(defaultOrder), { description: "Sort order (asc or desc)" }),
+	limit: arg(nonNegativeIntArg.optional(), {
+		alias: "l",
+		description: "Maximum number of items to return (0 or omit: unlimited)"
+	})
+});
+/**
+* Arguments for time-series log list commands. Defaults to newest-first
+* (`desc`) and a 50-item cap so that listing stays responsive on busy
+* workspaces. Pass `--limit 0` to disable the cap and fetch all entries.
+*/
+const pagedLogArgs = {
+	order: arg(orderArg.default("desc"), { description: "Sort order (asc or desc)" }),
+	limit: arg(nonNegativeIntArg.default(50), {
+		alias: "l",
+		description: "Maximum number of items to return (0: unlimited)"
+	})
+};
+/**
+* Arguments for commands that require folder context
+*/
+const folderArgs = { "folder-id": arg(z.string(), {
+	alias: "f",
+	description: "Folder ID",
+	env: "TAILOR_PLATFORM_FOLDER_ID",
+	completion: { type: "none" }
+}) };
+let verboseMode = false;
+/**
+* Returns whether verbose mode is enabled.
+* Used by the global cleanup handler which doesn't have access to parsed args.
+* @returns Whether verbose mode is enabled
+*/
+function isVerbose() {
+	return verboseMode;
+}
+
+//#endregion
 //#region src/parser/app-config/log-level.ts
 const LOG_LEVELS = [
 	"DEBUG",
@@ -245,7 +498,7 @@ function initOAuth2Client(config) {
 */
 async function initOperatorClient(accessToken, config) {
 	const platformConfig = config ?? getPlatformConfigForToken(accessToken);
-	const [{ createTracingInterceptor }, { OperatorService }] = await Promise.all([import("./interceptor-e33JtsC-.mjs"), import("./service_pb-DjwIn4jO.mjs")]);
+	const [{ createTracingInterceptor }, { OperatorService }] = await Promise.all([import("./interceptor-e33JtsC-.mjs"), import("./service_pb-B2FF59sP.mjs")]);
 	const interceptors = [
 		await userAgentInterceptor(),
 		await bearerTokenInterceptor(accessToken),
@@ -415,7 +668,8 @@ const RETRY_SAFE_CREATE_METHODS = /* @__PURE__ */ new Set([
 	"CreateTailorDBType",
 	"CreateTenantConfig",
 	"CreateUserProfileConfig",
-	"CreateWorkflow"
+	"CreateWorkflow",
+	"CreateWorkflowJobFunctionExecutionPolicy"
 ]);
 /**
 * Whether an error is an `AlreadyExists` from a retry-safe Create RPC.
@@ -1183,7 +1437,15 @@ async function loadMachineUserName(opts) {
 		message: "Machine user name cannot be empty.",
 		suggestion: "Pass a non-empty machine user name, or omit the option to use the environment variable or profile default."
 	});
-	const explicit = opts?.machineUser || process.env.TAILOR_PLATFORM_MACHINE_USER_NAME || void 0;
+	const envMachineUser = process.env.TAILOR_PLATFORM_MACHINE_USER_NAME || void 0;
+	const explicitMachineUser = opts?.machineUser ? {
+		source: opts.machineUserSource ?? "option",
+		value: opts.machineUser
+	} : envMachineUser ? {
+		source: "env",
+		value: envMachineUser
+	} : void 0;
+	const explicit = explicitMachineUser?.value;
 	const profile = opts?.profile || process.env.TAILOR_PLATFORM_PROFILE;
 	if (!profile) return explicit;
 	const entry = (await readPlatformConfig()).profiles[profile];
@@ -1192,12 +1454,15 @@ async function loadMachineUserName(opts) {
 		throw new Error(`Profile "${profile}" not found`);
 	}
 	if (entry.machine_user && entry.machine_user_override === "deny") {
-		if (explicit && explicit !== entry.machine_user) throw createCLIError({
-			code: "PROFILE_MACHINE_USER_OVERRIDE_DENIED",
-			message: `Profile "${profile}" denies overriding the machine user.`,
-			details: `This profile fixes the machine user to "${entry.machine_user}" for application-data commands.`,
-			suggestion: `Omit the machine user option, unset TAILOR_PLATFORM_MACHINE_USER_NAME, or run 'tailor profile update ${profile} --machine-user-override allow'.`
-		});
+		if (explicit && explicit !== entry.machine_user) {
+			const details = explicitMachineUser.source === "env" ? `The machine user is being set to "${explicit}" via the TAILOR_PLATFORM_MACHINE_USER_NAME environment variable, which conflicts with this profile's pinned machine user "${entry.machine_user}".` : `This profile fixes the machine user to "${entry.machine_user}" for application-data commands.`;
+			throw createCLIError({
+				code: "PROFILE_MACHINE_USER_OVERRIDE_DENIED",
+				message: `Profile "${profile}" denies overriding the machine user.`,
+				details,
+				suggestion: `Omit the machine user option, unset TAILOR_PLATFORM_MACHINE_USER_NAME, or run 'tailor profile update ${profile} --machine-user-override allow'.`
+			});
+		}
 		return entry.machine_user;
 	}
 	return explicit || entry.machine_user;
@@ -2157,7 +2422,7 @@ function generateTypeFileContent(info) {
      */
     import { db } from "@tailor-platform/sdk";
 
-    export const ${variableName} = db.type(${JSON.stringify(type.name)}, ${fieldsCode});
+    export const ${variableName} = db.table(${JSON.stringify(type.name)}, ${fieldsCode});
 
     export type ${type.name} = typeof ${variableName};
   `;
@@ -2666,7 +2931,8 @@ function detectTriggerCalls(program, sourceText) {
 		if (triggerCall) calls.push({
 			identifierName: triggerCall.identifierName,
 			callRange: triggerCall.callRange,
-			argsText: triggerCall.argsText
+			argsText: triggerCall.argsText,
+			optionsText: triggerCall.optionsText
 		});
 		for (const key of Object.keys(node)) {
 			const child = node[key];
@@ -2931,7 +3197,8 @@ function detectExtendedTriggerCalls(program, sourceText, workflowNames, jobNames
 				kind: "job",
 				identifierName: triggerCall.identifierName,
 				callRange: triggerCall.callRange,
-				argsText: triggerCall.argsText
+				argsText: triggerCall.argsText,
+				optionsText: triggerCall.optionsText
 			});
 		}
 		for (const key of Object.keys(node)) {
@@ -3007,7 +3274,8 @@ function transformFunctionTriggers(source, workflowNameMap, jobNameMap, workflow
 	} else {
 		const jobName = jobNameMap.get(call.identifierName);
 		if (jobName) {
-			const transformedCall = `tailor.workflow.triggerJobFunction("${jobName}", ${call.argsText || "undefined"})`;
+			const optionsPart = call.optionsText !== void 0 ? `, ${call.optionsText}` : "";
+			const transformedCall = `tailor.workflow.triggerJobFunction("${jobName}", ${call.argsText || "undefined"}${optionsPart})`;
 			replacements.push({
 				start: call.callRange.start,
 				end: call.callRange.end,
@@ -3720,7 +3988,7 @@ function validatePluralFormUniqueness(types, namespace, typeSourceInfo) {
 		const singularQuery = inflection.camelize(parsedType.name, true);
 		if (singularQuery === inflection.camelize(parsedType.pluralForm, true)) {
 			const location = formatTypeSourceLocation(getTypeSourceInfo(typeSourceInfo, parsedType.name));
-			errors.push(`Type "${parsedType.name}"${location} has identical singular and plural query names "${singularQuery}". Use db.type(["${parsedType.name}", "UniquePluralForm"], {...}) to set a unique pluralForm.`);
+			errors.push(`Type "${parsedType.name}"${location} has identical singular and plural query names "${singularQuery}". Use db.table(["${parsedType.name}", "UniquePluralForm"], {...}) to set a unique pluralForm.`);
 		}
 	}
 	const queryNameToSource = /* @__PURE__ */ new Map();
@@ -5381,7 +5649,8 @@ function transformWorkflowSource(source, targetJobName, targetJobExportName, oth
 		if (isInsideRemovedRange(call.callRange.start)) continue;
 		const jobName = jobNameMap.get(call.identifierName);
 		if (jobName) {
-			const transformedCall = `tailor.workflow.triggerJobFunction("${jobName}", ${call.argsText || "undefined"})`;
+			const optionsPart = call.optionsText !== void 0 ? `, ${call.optionsText}` : "";
+			const transformedCall = `tailor.workflow.triggerJobFunction("${jobName}", ${call.argsText || "undefined"}${optionsPart})`;
 			replacements.push({
 				start: call.callRange.start,
 				end: call.callRange.end,
@@ -5638,6 +5907,13 @@ const RetryPolicySchema = z.strictObject({
 	path: ["initialBackoff"]
 });
 const ConcurrencyPolicySchema = z.strictObject({ maxConcurrentExecutions: z.number().int().min(1).max(1e3).describe("Maximum number of concurrent executions (1-1000)") });
+const ExecutionPolicyNameSchema = z.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/, "Invalid execution policy name: must match [a-z0-9-] (3-63 chars; must start and end with [a-z0-9])").describe("Workspace-unique execution policy name embedded in the resource TRN");
+const ExecutionPolicyKeySchema = z.string().regex(/^[a-z0-9][a-z0-9_:.-]{0,62}[a-z0-9*]$/, "Invalid execution policy key: must match [a-z0-9_:.-] (2-64 chars; must start with [a-z0-9] and end with [a-z0-9] or a trailing '*')").describe("Execution policy key passed to triggerJobFunction's executionPolicyKey option");
+const WorkflowJobFunctionExecutionPolicySchema = z.strictObject({
+	name: ExecutionPolicyNameSchema,
+	key: ExecutionPolicyKeySchema,
+	concurrencyPolicy: ConcurrencyPolicySchema.optional().describe("Optional per-key concurrency cap for job function dispatches matching this policy")
+});
 const WorkflowSchema = z.strictObject({
 	name: z.string().describe("Workflow name"),
 	mainJob: WorkflowJobSchema.describe("Main job that starts the workflow"),
@@ -6389,5 +6665,5 @@ async function loadApplication(params) {
 }
 
 //#endregion
-export { getConsoleBaseUrl as $, hasUserTokenEntry as A, removeLegacyUserAlias as B, getDistDir as C, deleteUserTokens as D, loadConfig as E, loadPlatformClientConfig as F, closeConnectionPool as G, resolveUserTokenKey as H, loadStoredUserTokens as I, fetchAllTolerant as J, defaultPlatformBaseUrl as K, loadWorkspaceId as L, loadConfigPath as M, loadConsoleBaseUrl as N, fetchLatestToken as O, loadMachineUserName as P, fetchUserInfo as Q, platformConfigFromProfile as R, createBundleCache as S, hashFile as T, saveUserTokens as U, resolveConfigUser as V, writePlatformConfig as W, fetchPaged as X, fetchMachineUserToken as Y, fetchPlatformMachineUserToken as Z, composeFunctionTreeshakeOptions as _, resolveInlineSourcemap as a, isDefaultPlatform as at, getPluginGenerationDependencies as b, ResolverSchema as c, buildExecutorArgsExpr as d, getOAuth2ClientId as et, buildResolverOperationHookExpr as f, platformBundleDefinePlugin as g, stringifyFunction as h, resolverBundleKey as i, initOperatorClient as it, loadAccessToken as j, hasAnyUserTokenEntry as k, HTTP_METHODS as l, assertUniqueTailorDBTypeNamesWithExternal as m, generatePluginFilesIfNeeded as n, getPlatformBaseUrl as nt, getApplicationAuthNamespace as o, resolveStaticWebsiteUrls as ot, assertUniqueLocalTailorDBTypeNames as p, fetchAll as q, loadApplication as r, initOAuth2Client as rt, WorkflowJobSchema as s, byName as st, defineApplication as t, getOrNull as tt, INVOKER_EXPR as u, createLogLevelTreeshakeOptions as v, hashContent as w, hasGenerationHooks as x, resolveBundleLogLevel as y, readPlatformConfig as z };
-//# sourceMappingURL=application-eHp9jXld.mjs.map
+export { fetchUserInfo as $, hasAnyUserTokenEntry as A, readPlatformConfig as B, createBundleCache as C, positiveIntArg as Ct, loadConfig as D, hashFile as E, workspaceArgs as Et, loadMachineUserName as F, writePlatformConfig as G, resolveConfigUser as H, loadPlatformClientConfig as I, fetchAll as J, closeConnectionPool as K, loadStoredUserTokens as L, loadAccessToken as M, loadConfigPath as N, deleteUserTokens as O, loadConsoleBaseUrl as P, fetchPlatformMachineUserToken as Q, loadWorkspaceId as R, hasGenerationHooks as S, parseDuration as St, hashContent as T, toPageDirection as Tt, resolveUserTokenKey as U, removeLegacyUserAlias as V, saveUserTokens as W, fetchMachineUserToken as X, fetchAllTolerant as Y, fetchPaged as Z, platformBundleDefinePlugin as _, nonNegativeIntArg as _t, resolveInlineSourcemap as a, initOperatorClient as at, resolveBundleLogLevel as b, pagedLogArgs as bt, WorkflowJobSchema as c, byName as ct, INVOKER_EXPR as d, confirmationArgs as dt, getConsoleBaseUrl as et, buildExecutorArgsExpr as f, deploymentArgs as ft, stringifyFunction as g, multiConfigArg as gt, assertUniqueTailorDBTypeNamesWithExternal as h, isVerbose as ht, resolverBundleKey as i, initOAuth2Client as it, hasUserTokenEntry as j, fetchLatestToken as k, ResolverSchema as l, commonArgs as lt, assertUniqueLocalTailorDBTypeNames as m, folderArgs as mt, generatePluginFilesIfNeeded as n, getOrNull as nt, getApplicationAuthNamespace as o, isDefaultPlatform as ot, buildResolverOperationHookExpr as p, durationArg as pt, defaultPlatformBaseUrl as q, loadApplication as r, getPlatformBaseUrl as rt, WorkflowJobFunctionExecutionPolicySchema as s, resolveStaticWebsiteUrls as st, defineApplication as t, getOAuth2ClientId as tt, HTTP_METHODS as u, configArg as ut, composeFunctionTreeshakeOptions as v, orderArg as vt, getDistDir as w, resolveMachineUserInputSource as wt, getPluginGenerationDependencies as x, paginationArgs as xt, createLogLevelTreeshakeOptions as y, organizationArgs as yt, platformConfigFromProfile as z };
+//# sourceMappingURL=application-BX13RArL.mjs.map