@tailor-platform/sdk 2.0.0-next.8 → 2.0.0

package/dist/configure/config/types.d.mts

@@ -9,6 +9,22 @@ import { LogLevelEnum } from "../../types/app-config.generated.mjs";
 //#region src/configure/config/types.d.ts
 type LogLevel = LogLevelEnum;
 type LogLevelInput = LogLevel | (string & {});
+/** Value an `env` entry resolves to at runtime. */
+type EnvValue = string | number | boolean;
+/**
+ * An `env` value that credential detection flags, allowed through together with
+ * the reason it is safe to deploy as plaintext.
+ *
+ * Booleans are excluded: `true` and `false` match no credential format and are
+ * far too short for the randomness heuristic, so they are never flagged.
+ */
+type AllowedSecretEnvValue = {
+  value: Exclude<EnvValue, boolean>;
+  /** Why this value is safe to deploy as plaintext even though it looks like a credential. */
+  allowSecretReason: string;
+};
+/** An entry of `defineConfig({ env })`. */
+type EnvEntry = EnvValue | AllowedSecretEnvValue;
 /** `files`/`ignores` patterns are resolved relative to this config's own directory, not the invocation directory. */
 type ExecutorServiceConfig = {
   files: string[];
@@ -53,7 +69,7 @@ type WorkflowServiceInput = WorkflowServiceConfig;
  * - `aiGateways`: Array of AI Gateway configs, e.g. `[gateway]`
  * - `db`, `resolver`, `executor`, `workflow`, `httpAdapter`: Service configs with file globs (resolved relative to this config file's own directory, not the invocation directory)
  */
-interface AppConfig<Auth extends AuthConfig = AuthConfig, Idp extends IdPConfig[] = IdPConfig[], StaticWebsites extends StaticWebsiteConfig[] = StaticWebsiteConfig[], AIGateways extends AIGatewayConfig[] = AIGatewayConfig[], Env extends Record<string, string | number | boolean> = Record<string, string | number | boolean>> {
+interface AppConfig<Auth extends AuthConfig = AuthConfig, Idp extends IdPConfig[] = IdPConfig[], StaticWebsites extends StaticWebsiteConfig[] = StaticWebsiteConfig[], AIGateways extends AIGatewayConfig[] = AIGatewayConfig[], Env extends Record<string, EnvEntry> = Record<string, EnvEntry>> {
   /** Application name (required). */
   name: string;
   /**
@@ -66,7 +82,14 @@ interface AppConfig<Auth extends AuthConfig = AuthConfig, Idp extends IdPConfig[
    * data is preserved.
    */
   id?: string;
-  /** Environment variables accessible via `context.env` in resolvers and via the second argument `{ env }` in workflow job bodies. */
+  /**
+   * Environment variables accessible via `context.env` in resolvers and via the second argument `{ env }` in workflow job bodies.
+   *
+   * A value that looks like a credential is rejected, since `env` is deployed
+   * as plaintext. When the detection is wrong about a value, wrap it as
+   * `{ value, allowSecretReason }` to allow it and record why it is safe. Real
+   * credentials belong in `defineSecretManager()`.
+   */
   env?: Env;
   /** Allowed CORS origins. Must be an array of strings, e.g. `["https://example.com"]`. */
   cors?: string[];
@@ -100,10 +123,12 @@ interface AppConfig<Auth extends AuthConfig = AuthConfig, Idp extends IdPConfig[
    */
   inlineSourcemap?: boolean;
   /**
-   * Controls which `console.*` calls remain in bundled functions.
+   * Controls which `console.*` and `logger.*` (from `@tailor-platform/sdk/runtime`)
+   * calls remain in bundled functions. `logger.setAttributes` has no severity and
+   * is never dropped.
    * @default "DEBUG"
    */
   logLevel?: LogLevelInput;
 }
 //#endregion
-export { AppConfig, ExecutorServiceConfig, ExecutorServiceInput, HttpAdapterServiceInput, LogLevel, LogLevelInput, ResolverExternalConfig, ResolverServiceConfig, ResolverServiceInput, WorkflowServiceConfig, WorkflowServiceInput };
+export { AllowedSecretEnvValue, AppConfig, EnvEntry, EnvValue, ExecutorServiceConfig, ExecutorServiceInput, HttpAdapterServiceInput, LogLevel, LogLevelInput, ResolverExternalConfig, ResolverServiceConfig, ResolverServiceInput, WorkflowServiceConfig, WorkflowServiceInput };

package/dist/configure/index.d.mts

@@ -11,6 +11,7 @@ import { ExecutorReadyContext, GeneratorResult, NamespacePluginOutput, Plugin, P
 import { PermissionCondition, TailorTypeGqlPermission, TailorTypePermission, unsafeAllowAllGqlPermission, unsafeAllowAllTypePermission } from "./services/tailordb/permission.mjs";
 import { TailorAnyDBField, TailorAnyDBType, TailorDBField, TailorDBInstance, TailorDBType, db } from "./services/tailordb/schema.mjs";
 import { AIGatewayConfig } from "./services/aigateway/types.mjs";
+import { IdPPermission, IdPPermissionCondition, unsafeAllowAllIdPPermission } from "./services/idp/permission.mjs";
 import { IdPEmailConfig, IdPGqlOperations, IdPGqlOperationsInput } from "../types/idp.generated.mjs";
 import { IdPConfig, IdPExternalConfig } from "./services/idp/types.mjs";
 import { SecretsConfig } from "./services/secrets/types.mjs";
@@ -25,12 +26,13 @@ import { IdpName, IdpNameRegistry } from "./types/idp-name.mjs";
 import { ConnectionName, ConnectionNameRegistry } from "./types/connection-name.mjs";
 import { AIGatewayName, AIGatewayNameRegistry } from "./types/aigateway-name.mjs";
 import { defineAuth } from "./services/auth/index.mjs";
+import { ResolverPermission, ResolverPermissionCondition, ResolverPermissionPolicy } from "./services/resolver/permission.mjs";
 import { createResolver } from "./services/resolver/resolver.mjs";
 import { QueryType } from "./services/resolver/types.mjs";
 import { WorkflowJob, WorkflowJobContext, createWorkflowJob } from "./services/workflow/job.mjs";
 import { Workflow, WorkflowConfig, createWorkflow } from "./services/workflow/workflow.mjs";
 import { FunctionOperation, GqlOperation, Operation, WebhookOperation, WorkflowOperation } from "./services/executor/operation.mjs";
-import { AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, ResolverExecutedArgs, ResolverExecutedTrigger, TailorDBTrigger, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger } from "./services/executor/trigger/event.mjs";
+import { AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, ResolverExecutedArgs, ResolverExecutedTrigger, TailorDBTrigger, WorkflowExecutionArgs, WorkflowExecutionCompletedArgs, WorkflowExecutionResumedArgs, WorkflowExecutionRetriedArgs, WorkflowExecutionStartedArgs, WorkflowExecutionTrigger, WorkflowExecutionWaitResolvedArgs, WorkflowExecutionWaitStartedArgs, WorkflowJobExecutionArgs, WorkflowJobExecutionCompletedArgs, WorkflowJobExecutionStartedArgs, WorkflowJobExecutionTrigger, WorkflowJobExecutionWaitResolvedArgs, WorkflowJobExecutionWaitStartedArgs, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, workflowExecutionCompletedTrigger, workflowExecutionResumedTrigger, workflowExecutionRetriedTrigger, workflowExecutionStartedTrigger, workflowExecutionTrigger, workflowExecutionWaitResolvedTrigger, workflowExecutionWaitStartedTrigger, workflowJobExecutionCompletedTrigger, workflowJobExecutionStartedTrigger, workflowJobExecutionTrigger, workflowJobExecutionWaitResolvedTrigger, workflowJobExecutionWaitStartedTrigger } from "./services/executor/trigger/event.mjs";
 import { ScheduleArgs, ScheduleTrigger, scheduleTrigger } from "./services/executor/trigger/schedule.mjs";
 import { IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, incomingWebhookTrigger } from "./services/executor/trigger/webhook.mjs";
 import { Trigger } from "./services/executor/trigger/index.mjs";
@@ -39,7 +41,6 @@ import { defineWorkflowExecutionPolicies, defineWorkflowExecutionPolicy } from "
 import { WaitPointInstance, createWaitPoint, createWaitPoints } from "./services/workflow/wait-point.mjs";
 import { defineStaticWebSite } from "./services/staticwebsite/index.mjs";
 import { defineAIGateway } from "./services/aigateway/index.mjs";
-import { IdPPermission, IdPPermissionCondition, unsafeAllowAllIdPPermission } from "./services/idp/permission.mjs";
 import { defineIdp } from "./services/idp/index.mjs";
 import { defineSecretManager } from "./services/secrets/index.mjs";
 import { HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, createHttpAdapter } from "./services/http-adapter/http-adapter.mjs";
@@ -131,4 +132,4 @@ declare namespace t {
   type infer<T> = TailorOutput<T>;
 }
 //#endregion
-export { type AIGatewayConfig, type AIGatewayName, type AIGatewayNameRegistry, type AttributeList, type Attributes, AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, type AuthConfig, type AuthConnectionConfig, type AuthConnectionOAuth2Config, type AuthConnectionTokenResult, type AuthExternalConfig, type AuthOwnConfig, type AuthServiceInput, type BeforeLoginClaims, type BeforeLoginHookArgs, type BuiltinIdP, type ConcurrencyPolicy, type ConnectionName, type ConnectionNameRegistry, type DefinedAuth, type Env, type ExecutionPolicyConcurrency, type ExecutionPolicyDefInput, type ExecutionPolicyExactInstance, type ExecutionPolicyGroupOptions, type ExecutionPolicyInstance, type ExecutionPolicyWildcardInstance, type ExecutorReadyContext, type ExecutorServiceConfig, type ExecutorServiceInput, type FederatedIdentity, type FederatedIdentityClaims, type FederatedIdentityProvider, FunctionOperation, type GeneratorResult, GqlOperation, HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, type IDToken, type IdPConfig, type IdPEmailConfig, type IdPExternalConfig, type IdPGqlOperations, type IdPGqlOperationsInput as IdPGqlOperationsConfig, type IdPPermission, type IdPPermissionCondition, type IdProvider as IdProviderConfig, type IdpName, type IdpNameRegistry, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, type MachineUserName, type MachineUserNameRegistry, type NamespacePluginOutput, type OAuth2ClientInput as OAuth2Client, type OAuth2ClientGrantType, type OIDC, Operation, type PermissionCondition, type Plugin, type PluginAttachment, type PluginConfigs, type PluginExecutorContext, type PluginExecutorContextBase, type PluginGeneratedExecutor, type PluginGeneratedExecutorWithFile, type PluginGeneratedResolver, type PluginGeneratedType, type PluginNamespaceProcessContext, type PluginOutput, type PluginProcessContext, type QueryType, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, type ResolvedExecutionPolicyInstance, type Resolver, ResolverExecutedArgs, ResolverExecutedTrigger, type ResolverExternalConfig, type ResolverNamespaceData, type ResolverReadyContext, type ResolverServiceConfig, type ResolverServiceInput, type RetryPolicy, type SAML, type SCIMAttribute, type SCIMAttributeMapping, type SCIMAttributeType, type SCIMAuthorization, type SCIMConfig, type SCIMResource, ScheduleArgs, ScheduleTrigger, type SecretsConfig, type StaticWebsiteConfig, type TailorAnyDBField, type TailorAnyDBType, type TailorDBField, type TailorDBInstance, type TailorDBNamespaceData, type TailorDBReadyContext, TailorDBTrigger, type TailorDBType, type TailorDBTypeForPlugin, type TailorField, type TailorPrincipal, type TailorTypeGqlPermission, type TailorTypePermission, type TenantProvider as TenantProviderConfig, Trigger, type TypePluginOutput, type UserAttributeKey, type UserAttributeListKey, type UserAttributes, type UsernameFieldKey, type ValueOperand, WaitPointInstance, WebhookOperation, Workflow, WorkflowConfig, WorkflowJob, WorkflowJobContext, WorkflowOperation, type WorkflowServiceConfig, type WorkflowServiceInput, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, createExecutor, createHttpAdapter, createResolver, createWaitPoint, createWaitPoints, createWorkflow, createWorkflowJob, db, defineAIGateway, defineAuth, defineConfig, defineIdp, definePlugins, defineSecretManager, defineStaticWebSite, defineWorkflowExecutionPolicies, defineWorkflowExecutionPolicy, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, incomingWebhookTrigger, infer, output, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, scheduleTrigger, t, unsafeAllowAllGqlPermission, unsafeAllowAllIdPPermission, unsafeAllowAllTypePermission };
+export { type AIGatewayConfig, type AIGatewayName, type AIGatewayNameRegistry, type AttributeList, type Attributes, AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, type AuthConfig, type AuthConnectionConfig, type AuthConnectionOAuth2Config, type AuthConnectionTokenResult, type AuthExternalConfig, type AuthOwnConfig, type AuthServiceInput, type BeforeLoginClaims, type BeforeLoginHookArgs, type BuiltinIdP, type ConcurrencyPolicy, type ConnectionName, type ConnectionNameRegistry, type DefinedAuth, type Env, type ExecutionPolicyConcurrency, type ExecutionPolicyDefInput, type ExecutionPolicyExactInstance, type ExecutionPolicyGroupOptions, type ExecutionPolicyInstance, type ExecutionPolicyWildcardInstance, type ExecutorReadyContext, type ExecutorServiceConfig, type ExecutorServiceInput, type FederatedIdentity, type FederatedIdentityClaims, type FederatedIdentityProvider, FunctionOperation, type GeneratorResult, GqlOperation, HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, type IDToken, type IdPConfig, type IdPEmailConfig, type IdPExternalConfig, type IdPGqlOperations, type IdPGqlOperationsInput as IdPGqlOperationsConfig, type IdPPermission, type IdPPermissionCondition, type IdProvider as IdProviderConfig, type IdpName, type IdpNameRegistry, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, type MachineUserName, type MachineUserNameRegistry, type NamespacePluginOutput, type OAuth2ClientInput as OAuth2Client, type OAuth2ClientGrantType, type OIDC, Operation, type PermissionCondition, type Plugin, type PluginAttachment, type PluginConfigs, type PluginExecutorContext, type PluginExecutorContextBase, type PluginGeneratedExecutor, type PluginGeneratedExecutorWithFile, type PluginGeneratedResolver, type PluginGeneratedType, type PluginNamespaceProcessContext, type PluginOutput, type PluginProcessContext, type QueryType, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, type ResolvedExecutionPolicyInstance, type Resolver, ResolverExecutedArgs, ResolverExecutedTrigger, type ResolverExternalConfig, type ResolverNamespaceData, type ResolverPermission, type ResolverPermissionCondition, type ResolverPermissionPolicy, type ResolverReadyContext, type ResolverServiceConfig, type ResolverServiceInput, type RetryPolicy, type SAML, type SCIMAttribute, type SCIMAttributeMapping, type SCIMAttributeType, type SCIMAuthorization, type SCIMConfig, type SCIMResource, ScheduleArgs, ScheduleTrigger, type SecretsConfig, type StaticWebsiteConfig, type TailorAnyDBField, type TailorAnyDBType, type TailorDBField, type TailorDBInstance, type TailorDBNamespaceData, type TailorDBReadyContext, TailorDBTrigger, type TailorDBType, type TailorDBTypeForPlugin, type TailorField, type TailorPrincipal, type TailorTypeGqlPermission, type TailorTypePermission, type TenantProvider as TenantProviderConfig, Trigger, type TypePluginOutput, type UserAttributeKey, type UserAttributeListKey, type UserAttributes, type UsernameFieldKey, type ValueOperand, WaitPointInstance, WebhookOperation, Workflow, WorkflowConfig, WorkflowExecutionArgs, WorkflowExecutionCompletedArgs, WorkflowExecutionResumedArgs, WorkflowExecutionRetriedArgs, WorkflowExecutionStartedArgs, WorkflowExecutionTrigger, WorkflowExecutionWaitResolvedArgs, WorkflowExecutionWaitStartedArgs, WorkflowJob, WorkflowJobContext, WorkflowJobExecutionArgs, WorkflowJobExecutionCompletedArgs, WorkflowJobExecutionStartedArgs, WorkflowJobExecutionTrigger, WorkflowJobExecutionWaitResolvedArgs, WorkflowJobExecutionWaitStartedArgs, WorkflowOperation, type WorkflowServiceConfig, type WorkflowServiceInput, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, createExecutor, createHttpAdapter, createResolver, createWaitPoint, createWaitPoints, createWorkflow, createWorkflowJob, db, defineAIGateway, defineAuth, defineConfig, defineIdp, definePlugins, defineSecretManager, defineStaticWebSite, defineWorkflowExecutionPolicies, defineWorkflowExecutionPolicy, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, incomingWebhookTrigger, infer, output, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, scheduleTrigger, t, unsafeAllowAllGqlPermission, unsafeAllowAllIdPPermission, unsafeAllowAllTypePermission, workflowExecutionCompletedTrigger, workflowExecutionResumedTrigger, workflowExecutionRetriedTrigger, workflowExecutionStartedTrigger, workflowExecutionTrigger, workflowExecutionWaitResolvedTrigger, workflowExecutionWaitStartedTrigger, workflowJobExecutionCompletedTrigger, workflowJobExecutionStartedTrigger, workflowJobExecutionTrigger, workflowJobExecutionWaitResolvedTrigger, workflowJobExecutionWaitStartedTrigger };

package/dist/configure/index.mjs

@@ -1,6 +1,6 @@
 import { i as parseInternal, n as mapAllowedValues, t as db } from "../schema--xYWRGfe.mjs";
 import { t as brandValue } from "../brand-Eo4pLXPJ.mjs";
-import { a as registerJob, n as dispatchStartJob, r as dispatchStartWorkflow } from "../registry-i7EdJ-D5.mjs";
+import { a as registerJob, n as dispatchStartJob, r as dispatchStartWorkflow } from "../registry-BIGVUrMB.mjs";
 import { i as withWorkflowTestInvoker } from "../test-env-key-D7UkZp99.mjs";
 
 //#region src/configure/types/type.ts
@@ -262,6 +262,14 @@ const unsafeAllowAllGqlPermission = [{
 * If not specified, this is automatically set to true when an executor uses this resolver
 * with `resolverExecutedTrigger`. If explicitly set to false while an executor uses this
 * resolver, an error will be thrown during apply.
+*
+* `permission` declares the resolver's access requirement, checked against `context.user` (the
+* original caller, unaffected by `authInvoker`) before `body` runs. Omitted (default):
+* unchanged, anonymous callers can reach the resolver. `"allowAnonymous"`: explicitly documents
+* that anonymous callers are allowed. An array of `{ conditions, permit }` policies (in the same
+* style as TailorDB's `.permission()`) rejects non-matching callers: at least one `permit: true`
+* policy is required (denied unless it matches), and a matching `permit: false` policy always
+* overrides that grant.
 * @template Input
 * @template Output
 * @param config - Resolver configuration
@@ -272,6 +280,7 @@ const unsafeAllowAllGqlPermission = [{
 * export default createResolver({
 *   name: "getUser",
 *   operation: "query",
+*   permission: [{ conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true }],
 *   input: {
 *     id: t.string(),
 *   },
@@ -506,6 +515,173 @@ function authAccessTokenTrigger(options) {
 		__args: {}
 	};
 }
+const workflowExecutionEventMap = {
+	started: "workflow.workflow_execution.started",
+	completed: "workflow.workflow_execution.completed",
+	retried: "workflow.workflow_execution.retried",
+	resumed: "workflow.workflow_execution.resumed",
+	wait_started: "workflow.workflow_execution.wait_started",
+	wait_resolved: "workflow.workflow_execution.wait_resolved"
+};
+function workflowExecutionTriggerConfig(events, options) {
+	return {
+		kind: "workflowExecution",
+		events,
+		workflowName: options.workflow.name,
+		condition: options.condition,
+		__args: {}
+	};
+}
+/**
+* Create a trigger that fires when a workflow execution starts running.
+* @param options - Trigger options
+* @param options.workflow - Workflow to subscribe to
+* @param options.condition - Condition function to filter events
+* @returns Workflow execution started trigger
+*/
+function workflowExecutionStartedTrigger(options) {
+	return workflowExecutionTriggerConfig(["workflow.workflow_execution.started"], options);
+}
+/**
+* Create a trigger that fires when a workflow execution succeeds or fails.
+* @param options - Trigger options
+* @param options.workflow - Workflow to subscribe to
+* @param options.condition - Condition function to filter events
+* @returns Workflow execution completed trigger
+*/
+function workflowExecutionCompletedTrigger(options) {
+	return workflowExecutionTriggerConfig(["workflow.workflow_execution.completed"], options);
+}
+/**
+* Create a trigger that fires when a workflow execution is retried by its retry policy.
+* @param options - Trigger options
+* @param options.workflow - Workflow to subscribe to
+* @param options.condition - Condition function to filter events
+* @returns Workflow execution retried trigger
+*/
+function workflowExecutionRetriedTrigger(options) {
+	return workflowExecutionTriggerConfig(["workflow.workflow_execution.retried"], options);
+}
+/**
+* Create a trigger that fires when a failed workflow execution is manually resumed.
+* @param options - Trigger options
+* @param options.workflow - Workflow to subscribe to
+* @param options.condition - Condition function to filter events
+* @returns Workflow execution resumed trigger
+*/
+function workflowExecutionResumedTrigger(options) {
+	return workflowExecutionTriggerConfig(["workflow.workflow_execution.resumed"], options);
+}
+/**
+* Create a trigger that fires when a workflow execution starts waiting on a wait point.
+* @param options - Trigger options
+* @param options.workflow - Workflow to subscribe to
+* @param options.condition - Condition function to filter events
+* @returns Workflow execution wait started trigger
+*/
+function workflowExecutionWaitStartedTrigger(options) {
+	return workflowExecutionTriggerConfig(["workflow.workflow_execution.wait_started"], options);
+}
+/**
+* Create a trigger that fires when a waiting workflow execution is released.
+* @param options - Trigger options
+* @param options.workflow - Workflow to subscribe to
+* @param options.condition - Condition function to filter events
+* @returns Workflow execution wait resolved trigger
+*/
+function workflowExecutionWaitResolvedTrigger(options) {
+	return workflowExecutionTriggerConfig(["workflow.workflow_execution.wait_resolved"], options);
+}
+/**
+* Create a trigger that fires on multiple workflow execution event types.
+* @template K
+* @param options - Trigger options with events array
+* @param options.events - Workflow execution event kinds to subscribe to
+* @param options.workflow - Workflow to subscribe to
+* @param options.condition - Condition function to filter events
+* @returns Workflow execution trigger
+*/
+function workflowExecutionTrigger(options) {
+	const { events, workflow, condition } = options;
+	return workflowExecutionTriggerConfig(events.map((k) => workflowExecutionEventMap[k]), {
+		workflow,
+		condition
+	});
+}
+const workflowJobExecutionEventMap = {
+	started: "workflow.workflow_execution.job_execution.started",
+	completed: "workflow.workflow_execution.job_execution.completed",
+	wait_started: "workflow.workflow_execution.job_execution.wait_started",
+	wait_resolved: "workflow.workflow_execution.job_execution.wait_resolved"
+};
+function workflowJobExecutionTriggerConfig(events, options) {
+	return {
+		kind: "workflowJobExecution",
+		events,
+		workflowName: options.workflow.name,
+		condition: options.condition,
+		__args: {}
+	};
+}
+/**
+* Create a trigger that fires when a job inside a workflow starts running.
+* @param options - Trigger options
+* @param options.workflow - Workflow whose job executions to subscribe to
+* @param options.condition - Condition function to filter events
+* @returns Workflow job execution started trigger
+*/
+function workflowJobExecutionStartedTrigger(options) {
+	return workflowJobExecutionTriggerConfig(["workflow.workflow_execution.job_execution.started"], options);
+}
+/**
+* Create a trigger that fires when a job inside a workflow succeeds or fails.
+*
+* A job released from a wait point reports `wait_resolved` instead of
+* `completed`; subscribe to both to observe every way a job can end.
+* @param options - Trigger options
+* @param options.workflow - Workflow whose job executions to subscribe to
+* @param options.condition - Condition function to filter events
+* @returns Workflow job execution completed trigger
+*/
+function workflowJobExecutionCompletedTrigger(options) {
+	return workflowJobExecutionTriggerConfig(["workflow.workflow_execution.job_execution.completed"], options);
+}
+/**
+* Create a trigger that fires when a job inside a workflow starts waiting on a wait point.
+* @param options - Trigger options
+* @param options.workflow - Workflow whose job executions to subscribe to
+* @param options.condition - Condition function to filter events
+* @returns Workflow job execution wait started trigger
+*/
+function workflowJobExecutionWaitStartedTrigger(options) {
+	return workflowJobExecutionTriggerConfig(["workflow.workflow_execution.job_execution.wait_started"], options);
+}
+/**
+* Create a trigger that fires when a waiting job inside a workflow is released.
+* @param options - Trigger options
+* @param options.workflow - Workflow whose job executions to subscribe to
+* @param options.condition - Condition function to filter events
+* @returns Workflow job execution wait resolved trigger
+*/
+function workflowJobExecutionWaitResolvedTrigger(options) {
+	return workflowJobExecutionTriggerConfig(["workflow.workflow_execution.job_execution.wait_resolved"], options);
+}
+/**
+* Create a trigger that fires on multiple workflow job execution event types.
+* @template K
+* @param options - Trigger options with events array
+* @param options.events - Workflow job execution event kinds to subscribe to
+* @param options.workflow - Workflow whose job executions to subscribe to
+* @param options.condition - Condition function to filter events
+* @returns Workflow job execution trigger
+*/
+function workflowJobExecutionTrigger(options) {
+	const { events, workflow, condition } = options;
+	return workflowJobExecutionTriggerConfig(events.map((k) => workflowJobExecutionEventMap[k]), {
+		workflow,
+		condition
+	});
+}
 
 //#endregion
 //#region src/configure/services/executor/trigger/schedule.ts
@@ -596,7 +772,7 @@ function defineWorkflowExecutionPolicy(name, def) {
 /**
 * Define a group of workflow job function execution policies. Property names
 * become the workspace-unique `name` and default `key` verbatim, matching the
-* mental model of {@link defineWaitPoints}. Provide `name` / `key` explicitly
+* mental model of {@link createWaitPoints}. Provide `name` / `key` explicitly
 * to override the property-name default (for example, when the property name
 * is not valid for the execution policy grammar or when the runtime key
 * prefix needs to differ).
@@ -621,10 +797,10 @@ function defineWorkflowExecutionPolicy(name, def) {
 * }));
 *
 * // In a workflow job function:
-* await tailor.workflow.startJobFunction("worker", args, {
+* await tailor.workflow.execJobFunction("worker", args, {
 *   executionPolicyKey: executionPolicies.premium.key,
 * });
-* await tailor.workflow.startJobFunction("worker", args, {
+* await tailor.workflow.execJobFunction("worker", args, {
 *   executionPolicyKey: executionPolicies["tenant-api"].keyFor(input.tenantId),
 * });
 */
@@ -697,7 +873,8 @@ function createWorkflowJob(config) {
 	return brandValue({
 		name: config.name,
 		start,
-		body
+		body,
+		...config.publishEvents !== void 0 ? { publishEvents: config.publishEvents } : {}
 	}, "workflow-job");
 }
 
@@ -1020,5 +1197,5 @@ function definePlugins(...configs) {
 const t = t$1;
 
 //#endregion
-export { authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, createExecutor, createHttpAdapter, createResolver, createWaitPoint, createWaitPoints, createWorkflow, createWorkflowJob, db, defineAIGateway, defineAuth, defineConfig, defineIdp, definePlugins, defineSecretManager, defineStaticWebSite, defineWorkflowExecutionPolicies, defineWorkflowExecutionPolicy, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, incomingWebhookTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, scheduleTrigger, t, unsafeAllowAllGqlPermission, unsafeAllowAllIdPPermission, unsafeAllowAllTypePermission };
+export { authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, createExecutor, createHttpAdapter, createResolver, createWaitPoint, createWaitPoints, createWorkflow, createWorkflowJob, db, defineAIGateway, defineAuth, defineConfig, defineIdp, definePlugins, defineSecretManager, defineStaticWebSite, defineWorkflowExecutionPolicies, defineWorkflowExecutionPolicy, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, incomingWebhookTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, scheduleTrigger, t, unsafeAllowAllGqlPermission, unsafeAllowAllIdPPermission, unsafeAllowAllTypePermission, workflowExecutionCompletedTrigger, workflowExecutionResumedTrigger, workflowExecutionRetriedTrigger, workflowExecutionStartedTrigger, workflowExecutionTrigger, workflowExecutionWaitResolvedTrigger, workflowExecutionWaitStartedTrigger, workflowJobExecutionCompletedTrigger, workflowJobExecutionStartedTrigger, workflowJobExecutionTrigger, workflowJobExecutionWaitResolvedTrigger, workflowJobExecutionWaitStartedTrigger };
 //# sourceMappingURL=index.mjs.map