@tailor-platform/sdk 2.0.0-next.8 → 2.0.0

package/dist/configure/services/executor/index.d.mts

@@ -1,9 +1,9 @@
 import { ExecutorServiceConfig, ExecutorServiceInput } from "../../config/types.mjs";
 import { FunctionOperation, GqlOperation, Operation, WebhookOperation, WorkflowOperation } from "./operation.mjs";
-import { AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, ResolverExecutedArgs, ResolverExecutedTrigger, TailorDBTrigger, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger } from "./trigger/event.mjs";
+import { AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, ResolverExecutedArgs, ResolverExecutedTrigger, TailorDBTrigger, WorkflowExecutionArgs, WorkflowExecutionCompletedArgs, WorkflowExecutionResumedArgs, WorkflowExecutionRetriedArgs, WorkflowExecutionStartedArgs, WorkflowExecutionTrigger, WorkflowExecutionWaitResolvedArgs, WorkflowExecutionWaitStartedArgs, WorkflowJobExecutionArgs, WorkflowJobExecutionCompletedArgs, WorkflowJobExecutionStartedArgs, WorkflowJobExecutionTrigger, WorkflowJobExecutionWaitResolvedArgs, WorkflowJobExecutionWaitStartedArgs, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, workflowExecutionCompletedTrigger, workflowExecutionResumedTrigger, workflowExecutionRetriedTrigger, workflowExecutionStartedTrigger, workflowExecutionTrigger, workflowExecutionWaitResolvedTrigger, workflowExecutionWaitStartedTrigger, workflowJobExecutionCompletedTrigger, workflowJobExecutionStartedTrigger, workflowJobExecutionTrigger, workflowJobExecutionWaitResolvedTrigger, workflowJobExecutionWaitStartedTrigger } from "./trigger/event.mjs";
 import { ScheduleArgs, ScheduleTrigger, scheduleTrigger } from "./trigger/schedule.mjs";
 import { IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, incomingWebhookTrigger } from "./trigger/webhook.mjs";
 import { Trigger } from "./trigger/index.mjs";
 import { createExecutor } from "./executor.mjs";
 import "./types.mjs";
-export { AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, type ExecutorServiceConfig, type ExecutorServiceInput, FunctionOperation, GqlOperation, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, Operation, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, ResolverExecutedArgs, ResolverExecutedTrigger, ScheduleArgs, ScheduleTrigger, TailorDBTrigger, Trigger, WebhookOperation, WorkflowOperation, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, createExecutor, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, incomingWebhookTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, scheduleTrigger };
+export { AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, type ExecutorServiceConfig, type ExecutorServiceInput, FunctionOperation, GqlOperation, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, Operation, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, ResolverExecutedArgs, ResolverExecutedTrigger, ScheduleArgs, ScheduleTrigger, TailorDBTrigger, Trigger, WebhookOperation, WorkflowExecutionArgs, WorkflowExecutionCompletedArgs, WorkflowExecutionResumedArgs, WorkflowExecutionRetriedArgs, WorkflowExecutionStartedArgs, WorkflowExecutionTrigger, WorkflowExecutionWaitResolvedArgs, WorkflowExecutionWaitStartedArgs, WorkflowJobExecutionArgs, WorkflowJobExecutionCompletedArgs, WorkflowJobExecutionStartedArgs, WorkflowJobExecutionTrigger, WorkflowJobExecutionWaitResolvedArgs, WorkflowJobExecutionWaitStartedArgs, WorkflowOperation, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, createExecutor, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, incomingWebhookTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, scheduleTrigger, workflowExecutionCompletedTrigger, workflowExecutionResumedTrigger, workflowExecutionRetriedTrigger, workflowExecutionStartedTrigger, workflowExecutionTrigger, workflowExecutionWaitResolvedTrigger, workflowExecutionWaitStartedTrigger, workflowJobExecutionCompletedTrigger, workflowJobExecutionStartedTrigger, workflowJobExecutionTrigger, workflowJobExecutionWaitResolvedTrigger, workflowJobExecutionWaitStartedTrigger };

package/dist/configure/services/executor/trigger/event.d.mts

@@ -1,9 +1,10 @@
 import { TailorEnv, TailorPrincipal } from "../../../../runtime/types.mjs";
 import { output } from "../../../../types/helpers.mjs";
-import { AuthAccessTokenTrigger as AuthAccessTokenTrigger$1, IdpUserTrigger as IdpUserTrigger$1, ResolverExecutedTrigger as ResolverExecutedTrigger$1, TailorDBTrigger as TailorDBTrigger$1 } from "../../../../types/executor.generated.mjs";
+import { AuthAccessTokenTrigger as AuthAccessTokenTrigger$1, IdpUserTrigger as IdpUserTrigger$1, ResolverExecutedTrigger as ResolverExecutedTrigger$1, TailorDBTrigger as TailorDBTrigger$1, WorkflowExecutionTrigger as WorkflowExecutionTrigger$1, WorkflowJobExecutionTrigger as WorkflowJobExecutionTrigger$1 } from "../../../../types/executor.generated.mjs";
 import { TailorDBType } from "../../tailordb/schema.mjs";
 import { IdpName } from "../../../types/idp-name.mjs";
 import { ResolverConfig } from "../../resolver/resolver.mjs";
+import { Workflow } from "../../workflow/workflow.mjs";
 //#region src/configure/services/executor/trigger/event.d.ts
 interface EventArgs {
   workspaceId: string;
@@ -95,6 +96,85 @@ interface AuthAccessTokenRevokedArgs extends EventArgs {
   userId: string;
 }
 type AuthAccessTokenArgs = AuthAccessTokenIssuedArgs | AuthAccessTokenRefreshedArgs | AuthAccessTokenRevokedArgs;
+interface WorkflowExecutionEventArgs {
+  workspaceId: string;
+  env: TailorEnv;
+  actor: TailorPrincipal | null;
+  workflowId: string;
+  workflowName: string;
+  workflowExecutionId: string;
+}
+/**
+ * Discriminated union on `success` shared by the `completed` events of both
+ * granularity levels.
+ *
+ * When `success` is false, `error` carries the failure message; narrow on
+ * `success` before accessing it.
+ */
+type CompletedResult = {
+  success: true;
+  error?: never;
+} | {
+  success: false;
+  error: string;
+};
+interface WorkflowExecutionStartedArgs extends WorkflowExecutionEventArgs {
+  event: "started";
+  rawEvent: "workflow.workflow_execution.started";
+}
+type WorkflowExecutionCompletedArgs = WorkflowExecutionEventArgs & {
+  event: "completed";
+  rawEvent: "workflow.workflow_execution.completed";
+} & CompletedResult;
+interface WorkflowExecutionRetriedArgs extends WorkflowExecutionEventArgs {
+  event: "retried";
+  rawEvent: "workflow.workflow_execution.retried";
+  /** Number of retries already attempted for this execution. */
+  retryCount: number;
+  /** RFC 3339 timestamp the retry is scheduled for. */
+  retryAfter: string;
+}
+interface WorkflowExecutionResumedArgs extends WorkflowExecutionEventArgs {
+  event: "resumed";
+  rawEvent: "workflow.workflow_execution.resumed";
+}
+interface WorkflowExecutionWaitStartedArgs extends WorkflowExecutionEventArgs {
+  event: "wait_started";
+  rawEvent: "workflow.workflow_execution.wait_started";
+}
+interface WorkflowExecutionWaitResolvedArgs extends WorkflowExecutionEventArgs {
+  event: "wait_resolved";
+  rawEvent: "workflow.workflow_execution.wait_resolved";
+}
+type WorkflowExecutionArgs = WorkflowExecutionStartedArgs | WorkflowExecutionCompletedArgs | WorkflowExecutionRetriedArgs | WorkflowExecutionResumedArgs | WorkflowExecutionWaitStartedArgs | WorkflowExecutionWaitResolvedArgs;
+interface WorkflowJobExecutionEventArgs extends WorkflowExecutionEventArgs {
+  workflowJobExecutionId: string;
+  /** Name of the job, as passed to `createWorkflowJob({ name })`. */
+  jobFunctionName: string;
+}
+interface WorkflowJobExecutionStartedArgs extends WorkflowJobExecutionEventArgs {
+  event: "started";
+  rawEvent: "workflow.workflow_execution.job_execution.started";
+}
+type WorkflowJobExecutionCompletedArgs = WorkflowJobExecutionEventArgs & {
+  event: "completed";
+  rawEvent: "workflow.workflow_execution.job_execution.completed";
+} & CompletedResult;
+interface WorkflowJobExecutionWaitStartedArgs extends WorkflowJobExecutionEventArgs {
+  event: "wait_started";
+  rawEvent: "workflow.workflow_execution.job_execution.wait_started";
+  /** Wait point key the job is suspended on. */
+  waitKey: string;
+  /** JSON-serialized payload recorded with the wait point, absent when none was recorded. */
+  waitPayload?: string;
+}
+interface WorkflowJobExecutionWaitResolvedArgs extends WorkflowJobExecutionEventArgs {
+  event: "wait_resolved";
+  rawEvent: "workflow.workflow_execution.job_execution.wait_resolved";
+  /** Wait point key that was resolved. */
+  waitKey: string;
+}
+type WorkflowJobExecutionArgs = WorkflowJobExecutionStartedArgs | WorkflowJobExecutionCompletedArgs | WorkflowJobExecutionWaitStartedArgs | WorkflowJobExecutionWaitResolvedArgs;
 declare const recordEventMap: {
   readonly created: "tailordb.type_record.created";
   readonly updated: "tailordb.type_record.updated";
@@ -267,5 +347,168 @@ type AuthAccessTokenTriggerOptions<K extends AuthAccessTokenEventKind[]> = {
  * @returns Auth access token trigger
  */
 declare function authAccessTokenTrigger<const K extends [AuthAccessTokenEventKind, ...AuthAccessTokenEventKind[]]>(options: AuthAccessTokenTriggerOptions<K>): AuthAccessTokenTrigger<AuthAccessTokenMultiArgs<K>>;
+declare const workflowExecutionEventMap: {
+  readonly started: "workflow.workflow_execution.started";
+  readonly completed: "workflow.workflow_execution.completed";
+  readonly retried: "workflow.workflow_execution.retried";
+  readonly resumed: "workflow.workflow_execution.resumed";
+  readonly wait_started: "workflow.workflow_execution.wait_started";
+  readonly wait_resolved: "workflow.workflow_execution.wait_resolved";
+};
+type WorkflowExecutionEventKind = keyof typeof workflowExecutionEventMap;
+type WorkflowExecutionArgsMap = {
+  started: WorkflowExecutionStartedArgs;
+  completed: WorkflowExecutionCompletedArgs;
+  retried: WorkflowExecutionRetriedArgs;
+  resumed: WorkflowExecutionResumedArgs;
+  wait_started: WorkflowExecutionWaitStartedArgs;
+  wait_resolved: WorkflowExecutionWaitResolvedArgs;
+};
+type WorkflowExecutionMultiArgs<K extends WorkflowExecutionEventKind[]> = WorkflowExecutionArgsMap[K[number]];
+type WorkflowExecutionTrigger<Args> = WorkflowExecutionTrigger$1 & {
+  __args: Args;
+};
+type WorkflowExecutionSingleTriggerOptions<Args> = {
+  /** Workflow to subscribe to. */
+  workflow: Workflow;
+  condition?: (args: Args) => boolean;
+};
+/**
+ * Create a trigger that fires when a workflow execution starts running.
+ * @param options - Trigger options
+ * @param options.workflow - Workflow to subscribe to
+ * @param options.condition - Condition function to filter events
+ * @returns Workflow execution started trigger
+ */
+declare function workflowExecutionStartedTrigger(options: WorkflowExecutionSingleTriggerOptions<WorkflowExecutionStartedArgs>): WorkflowExecutionTrigger<WorkflowExecutionStartedArgs>;
+/**
+ * Create a trigger that fires when a workflow execution succeeds or fails.
+ * @param options - Trigger options
+ * @param options.workflow - Workflow to subscribe to
+ * @param options.condition - Condition function to filter events
+ * @returns Workflow execution completed trigger
+ */
+declare function workflowExecutionCompletedTrigger(options: WorkflowExecutionSingleTriggerOptions<WorkflowExecutionCompletedArgs>): WorkflowExecutionTrigger<WorkflowExecutionCompletedArgs>;
+/**
+ * Create a trigger that fires when a workflow execution is retried by its retry policy.
+ * @param options - Trigger options
+ * @param options.workflow - Workflow to subscribe to
+ * @param options.condition - Condition function to filter events
+ * @returns Workflow execution retried trigger
+ */
+declare function workflowExecutionRetriedTrigger(options: WorkflowExecutionSingleTriggerOptions<WorkflowExecutionRetriedArgs>): WorkflowExecutionTrigger<WorkflowExecutionRetriedArgs>;
+/**
+ * Create a trigger that fires when a failed workflow execution is manually resumed.
+ * @param options - Trigger options
+ * @param options.workflow - Workflow to subscribe to
+ * @param options.condition - Condition function to filter events
+ * @returns Workflow execution resumed trigger
+ */
+declare function workflowExecutionResumedTrigger(options: WorkflowExecutionSingleTriggerOptions<WorkflowExecutionResumedArgs>): WorkflowExecutionTrigger<WorkflowExecutionResumedArgs>;
+/**
+ * Create a trigger that fires when a workflow execution starts waiting on a wait point.
+ * @param options - Trigger options
+ * @param options.workflow - Workflow to subscribe to
+ * @param options.condition - Condition function to filter events
+ * @returns Workflow execution wait started trigger
+ */
+declare function workflowExecutionWaitStartedTrigger(options: WorkflowExecutionSingleTriggerOptions<WorkflowExecutionWaitStartedArgs>): WorkflowExecutionTrigger<WorkflowExecutionWaitStartedArgs>;
+/**
+ * Create a trigger that fires when a waiting workflow execution is released.
+ * @param options - Trigger options
+ * @param options.workflow - Workflow to subscribe to
+ * @param options.condition - Condition function to filter events
+ * @returns Workflow execution wait resolved trigger
+ */
+declare function workflowExecutionWaitResolvedTrigger(options: WorkflowExecutionSingleTriggerOptions<WorkflowExecutionWaitResolvedArgs>): WorkflowExecutionTrigger<WorkflowExecutionWaitResolvedArgs>;
+type WorkflowExecutionTriggerOptions<K extends WorkflowExecutionEventKind[]> = {
+  events: K;
+  /** Workflow to subscribe to. */
+  workflow: Workflow;
+  condition?: (args: WorkflowExecutionMultiArgs<K>) => boolean;
+};
+/**
+ * Create a trigger that fires on multiple workflow execution event types.
+ * @template K
+ * @param options - Trigger options with events array
+ * @param options.events - Workflow execution event kinds to subscribe to
+ * @param options.workflow - Workflow to subscribe to
+ * @param options.condition - Condition function to filter events
+ * @returns Workflow execution trigger
+ */
+declare function workflowExecutionTrigger<const K extends [WorkflowExecutionEventKind, ...WorkflowExecutionEventKind[]]>(options: WorkflowExecutionTriggerOptions<K>): WorkflowExecutionTrigger<WorkflowExecutionMultiArgs<K>>;
+declare const workflowJobExecutionEventMap: {
+  readonly started: "workflow.workflow_execution.job_execution.started";
+  readonly completed: "workflow.workflow_execution.job_execution.completed";
+  readonly wait_started: "workflow.workflow_execution.job_execution.wait_started";
+  readonly wait_resolved: "workflow.workflow_execution.job_execution.wait_resolved";
+};
+type WorkflowJobExecutionEventKind = keyof typeof workflowJobExecutionEventMap;
+type WorkflowJobExecutionArgsMap = {
+  started: WorkflowJobExecutionStartedArgs;
+  completed: WorkflowJobExecutionCompletedArgs;
+  wait_started: WorkflowJobExecutionWaitStartedArgs;
+  wait_resolved: WorkflowJobExecutionWaitResolvedArgs;
+};
+type WorkflowJobExecutionMultiArgs<K extends WorkflowJobExecutionEventKind[]> = WorkflowJobExecutionArgsMap[K[number]];
+type WorkflowJobExecutionTrigger<Args> = WorkflowJobExecutionTrigger$1 & {
+  __args: Args;
+};
+type WorkflowJobExecutionSingleTriggerOptions<Args> = {
+  /** Workflow whose job executions to subscribe to. */
+  workflow: Workflow;
+  condition?: (args: Args) => boolean;
+};
+/**
+ * Create a trigger that fires when a job inside a workflow starts running.
+ * @param options - Trigger options
+ * @param options.workflow - Workflow whose job executions to subscribe to
+ * @param options.condition - Condition function to filter events
+ * @returns Workflow job execution started trigger
+ */
+declare function workflowJobExecutionStartedTrigger(options: WorkflowJobExecutionSingleTriggerOptions<WorkflowJobExecutionStartedArgs>): WorkflowJobExecutionTrigger<WorkflowJobExecutionStartedArgs>;
+/**
+ * Create a trigger that fires when a job inside a workflow succeeds or fails.
+ *
+ * A job released from a wait point reports `wait_resolved` instead of
+ * `completed`; subscribe to both to observe every way a job can end.
+ * @param options - Trigger options
+ * @param options.workflow - Workflow whose job executions to subscribe to
+ * @param options.condition - Condition function to filter events
+ * @returns Workflow job execution completed trigger
+ */
+declare function workflowJobExecutionCompletedTrigger(options: WorkflowJobExecutionSingleTriggerOptions<WorkflowJobExecutionCompletedArgs>): WorkflowJobExecutionTrigger<WorkflowJobExecutionCompletedArgs>;
+/**
+ * Create a trigger that fires when a job inside a workflow starts waiting on a wait point.
+ * @param options - Trigger options
+ * @param options.workflow - Workflow whose job executions to subscribe to
+ * @param options.condition - Condition function to filter events
+ * @returns Workflow job execution wait started trigger
+ */
+declare function workflowJobExecutionWaitStartedTrigger(options: WorkflowJobExecutionSingleTriggerOptions<WorkflowJobExecutionWaitStartedArgs>): WorkflowJobExecutionTrigger<WorkflowJobExecutionWaitStartedArgs>;
+/**
+ * Create a trigger that fires when a waiting job inside a workflow is released.
+ * @param options - Trigger options
+ * @param options.workflow - Workflow whose job executions to subscribe to
+ * @param options.condition - Condition function to filter events
+ * @returns Workflow job execution wait resolved trigger
+ */
+declare function workflowJobExecutionWaitResolvedTrigger(options: WorkflowJobExecutionSingleTriggerOptions<WorkflowJobExecutionWaitResolvedArgs>): WorkflowJobExecutionTrigger<WorkflowJobExecutionWaitResolvedArgs>;
+type WorkflowJobExecutionTriggerOptions<K extends WorkflowJobExecutionEventKind[]> = {
+  events: K;
+  /** Workflow whose job executions to subscribe to. */
+  workflow: Workflow;
+  condition?: (args: WorkflowJobExecutionMultiArgs<K>) => boolean;
+};
+/**
+ * Create a trigger that fires on multiple workflow job execution event types.
+ * @template K
+ * @param options - Trigger options with events array
+ * @param options.events - Workflow job execution event kinds to subscribe to
+ * @param options.workflow - Workflow whose job executions to subscribe to
+ * @param options.condition - Condition function to filter events
+ * @returns Workflow job execution trigger
+ */
+declare function workflowJobExecutionTrigger<const K extends [WorkflowJobExecutionEventKind, ...WorkflowJobExecutionEventKind[]]>(options: WorkflowJobExecutionTriggerOptions<K>): WorkflowJobExecutionTrigger<WorkflowJobExecutionMultiArgs<K>>;
 //#endregion
-export { AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, ResolverExecutedArgs, ResolverExecutedTrigger, TailorDBTrigger, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger };
+export { AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, ResolverExecutedArgs, ResolverExecutedTrigger, TailorDBTrigger, WorkflowExecutionArgs, WorkflowExecutionCompletedArgs, WorkflowExecutionResumedArgs, WorkflowExecutionRetriedArgs, WorkflowExecutionStartedArgs, WorkflowExecutionTrigger, WorkflowExecutionWaitResolvedArgs, WorkflowExecutionWaitStartedArgs, WorkflowJobExecutionArgs, WorkflowJobExecutionCompletedArgs, WorkflowJobExecutionStartedArgs, WorkflowJobExecutionTrigger, WorkflowJobExecutionWaitResolvedArgs, WorkflowJobExecutionWaitStartedArgs, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, workflowExecutionCompletedTrigger, workflowExecutionResumedTrigger, workflowExecutionRetriedTrigger, workflowExecutionStartedTrigger, workflowExecutionTrigger, workflowExecutionWaitResolvedTrigger, workflowExecutionWaitStartedTrigger, workflowJobExecutionCompletedTrigger, workflowJobExecutionStartedTrigger, workflowJobExecutionTrigger, workflowJobExecutionWaitResolvedTrigger, workflowJobExecutionWaitStartedTrigger };

package/dist/configure/services/executor/trigger/index.d.mts

@@ -1,7 +1,7 @@
-import { AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, ResolverExecutedArgs, ResolverExecutedTrigger, TailorDBTrigger, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger } from "./event.mjs";
+import { AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, ResolverExecutedArgs, ResolverExecutedTrigger, TailorDBTrigger, WorkflowExecutionArgs, WorkflowExecutionCompletedArgs, WorkflowExecutionResumedArgs, WorkflowExecutionRetriedArgs, WorkflowExecutionStartedArgs, WorkflowExecutionTrigger, WorkflowExecutionWaitResolvedArgs, WorkflowExecutionWaitStartedArgs, WorkflowJobExecutionArgs, WorkflowJobExecutionCompletedArgs, WorkflowJobExecutionStartedArgs, WorkflowJobExecutionTrigger, WorkflowJobExecutionWaitResolvedArgs, WorkflowJobExecutionWaitStartedArgs, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, workflowExecutionCompletedTrigger, workflowExecutionResumedTrigger, workflowExecutionRetriedTrigger, workflowExecutionStartedTrigger, workflowExecutionTrigger, workflowExecutionWaitResolvedTrigger, workflowExecutionWaitStartedTrigger, workflowJobExecutionCompletedTrigger, workflowJobExecutionStartedTrigger, workflowJobExecutionTrigger, workflowJobExecutionWaitResolvedTrigger, workflowJobExecutionWaitStartedTrigger } from "./event.mjs";
 import { ScheduleArgs, ScheduleTrigger, scheduleTrigger } from "./schedule.mjs";
 import { IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, incomingWebhookTrigger } from "./webhook.mjs";
 //#region src/configure/services/executor/trigger/index.d.ts
-type Trigger<Args> = TailorDBTrigger<Args> | ResolverExecutedTrigger<Args> | ScheduleTrigger<Args> | IncomingWebhookTrigger<Args> | IdpUserTrigger<Args> | AuthAccessTokenTrigger<Args>;
+type Trigger<Args> = TailorDBTrigger<Args> | ResolverExecutedTrigger<Args> | ScheduleTrigger<Args> | IncomingWebhookTrigger<Args> | IdpUserTrigger<Args> | AuthAccessTokenTrigger<Args> | WorkflowExecutionTrigger<Args> | WorkflowJobExecutionTrigger<Args>;
 //#endregion
-export { AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, ResolverExecutedArgs, ResolverExecutedTrigger, ScheduleArgs, ScheduleTrigger, TailorDBTrigger, Trigger, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, incomingWebhookTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, scheduleTrigger };
+export { AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, ResolverExecutedArgs, ResolverExecutedTrigger, ScheduleArgs, ScheduleTrigger, TailorDBTrigger, Trigger, WorkflowExecutionArgs, WorkflowExecutionCompletedArgs, WorkflowExecutionResumedArgs, WorkflowExecutionRetriedArgs, WorkflowExecutionStartedArgs, WorkflowExecutionTrigger, WorkflowExecutionWaitResolvedArgs, WorkflowExecutionWaitStartedArgs, WorkflowJobExecutionArgs, WorkflowJobExecutionCompletedArgs, WorkflowJobExecutionStartedArgs, WorkflowJobExecutionTrigger, WorkflowJobExecutionWaitResolvedArgs, WorkflowJobExecutionWaitStartedArgs, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, incomingWebhookTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, scheduleTrigger, workflowExecutionCompletedTrigger, workflowExecutionResumedTrigger, workflowExecutionRetriedTrigger, workflowExecutionStartedTrigger, workflowExecutionTrigger, workflowExecutionWaitResolvedTrigger, workflowExecutionWaitStartedTrigger, workflowJobExecutionCompletedTrigger, workflowJobExecutionStartedTrigger, workflowJobExecutionTrigger, workflowJobExecutionWaitResolvedTrigger, workflowJobExecutionWaitStartedTrigger };

package/dist/configure/services/idp/index.d.mts

@@ -1,6 +1,6 @@
+import { IdPPermission, IdPPermissionCondition, unsafeAllowAllIdPPermission } from "./permission.mjs";
 import { IdPEmailConfig, IdPGqlOperations, IdPGqlOperationsInput, IdPInput } from "../../../types/idp.generated.mjs";
 import { IdPConfig, IdPExternalConfig, IdpDefinitionBrand } from "./types.mjs";
-import { IdPPermission, IdPPermissionCondition, unsafeAllowAllIdPPermission } from "./permission.mjs";
 //#region src/configure/services/idp/index.d.ts
 /**
  * Define an IdP service configuration for the Tailor SDK.
@@ -20,6 +20,7 @@ declare function defineIdp<const TClients extends string[]>(name: string, config
     readonly namespace: string;
     readonly clientName: TClients[number];
   };
+  readonly publishEvents?: boolean | undefined;
   readonly authorization?: "insecure" | "loggedIn" | {
     cel: string;
   } | undefined;
@@ -42,7 +43,6 @@ declare function defineIdp<const TClients extends string[]>(name: string, config
     allowedReturnOrigins?: string[] | undefined;
     mfaIssuer?: string | undefined;
   } | undefined;
-  readonly publishUserEvents?: boolean | undefined;
   readonly gqlOperations?: "query" | {
     create?: boolean | undefined;
     update?: boolean | undefined;

package/dist/configure/services/idp/permission.d.mts

@@ -1,24 +1,9 @@
 import { InferredAttributes } from "../../../runtime/types.mjs";
+import { UserBooleanArrayOperand, UserBooleanOperand, UserStringArrayOperand, UserStringOperand } from "../../types/permission-operand.types.mjs";
 import { IdPUserField } from "../../../parser/service/idp/types.mjs";
 //#region src/configure/services/idp/permission.d.ts
 type EqualityOperator = "=" | "!=";
 type ContainsOperator = "in" | "not in";
-type StringFieldKeys<User extends object> = { [K in keyof User]-?: Exclude<User[K], undefined> extends string ? K : never; }[keyof User];
-type StringArrayFieldKeys<User extends object> = { [K in keyof User]-?: Exclude<User[K], undefined> extends string[] ? K : never; }[keyof User];
-type BooleanFieldKeys<User extends object> = { [K in keyof User]-?: Exclude<User[K], undefined> extends boolean ? K : never; }[keyof User];
-type BooleanArrayFieldKeys<User extends object> = { [K in keyof User]-?: Exclude<User[K], undefined> extends boolean[] ? K : never; }[keyof User];
-type UserStringOperand<User extends object = InferredAttributes> = {
-  user: StringFieldKeys<User> | "id";
-};
-type UserStringArrayOperand<User extends object = InferredAttributes> = {
-  user: StringArrayFieldKeys<User>;
-};
-type UserBooleanOperand<User extends object = InferredAttributes> = {
-  user: BooleanFieldKeys<User> | "_loggedIn";
-};
-type UserBooleanArrayOperand<User extends object = InferredAttributes> = {
-  user: BooleanArrayFieldKeys<User>;
-};
 type IdPUserOperand<Update extends boolean = false> = Update extends true ? {
   oldIdpUser: IdPUserField;
 } | {

package/dist/configure/services/idp/types.d.mts

@@ -1,4 +1,5 @@
 import { BuiltinIdP } from "../../../types/auth.generated.mjs";
+import { IdPPermission } from "./permission.mjs";
 import { IdPInput } from "../../../types/idp.generated.mjs";
 //#region src/configure/services/idp/types.d.ts
 declare const idpDefinitionBrand: unique symbol;
@@ -13,7 +14,10 @@ type IdPExternalConfig = {
   name: string;
   external: true;
 };
-type IdPOwnConfig = Omit<DefinedIdp<string, IdPInput, string>, "provider">;
+type IdPOwnConfigInput = Omit<IdPInput, "permission"> & {
+  permission?: IdPPermission;
+};
+type IdPOwnConfig = Omit<DefinedIdp<string, IdPOwnConfigInput, string>, "provider">;
 type IdPConfig = IdPOwnConfig | IdPExternalConfig;
 //#endregion
 export { DefinedIdp, IdPConfig, IdPExternalConfig, IdPOwnConfig, IdpDefinitionBrand };

package/dist/configure/services/index.d.mts

@@ -6,6 +6,7 @@ import { PermissionCondition, TailorTypeGqlPermission, TailorTypePermission, uns
 import { TailorAnyDBField, TailorAnyDBType, TailorDBField, TailorDBInstance, TailorDBType, db } from "./tailordb/schema.mjs";
 import "./tailordb/index.mjs";
 import { AIGatewayConfig } from "./aigateway/types.mjs";
+import { IdPPermission, IdPPermissionCondition, unsafeAllowAllIdPPermission } from "./idp/permission.mjs";
 import { IdPEmailConfig, IdPGqlOperations, IdPGqlOperationsInput } from "../../types/idp.generated.mjs";
 import { IdPConfig, IdPExternalConfig } from "./idp/types.mjs";
 import { SecretsConfig } from "./secrets/types.mjs";
@@ -14,13 +15,14 @@ import { ExecutionPolicyConcurrency, ExecutionPolicyDefInput, ExecutionPolicyExa
 import { ExecutorServiceConfig, ExecutorServiceInput, ResolverExternalConfig, ResolverServiceConfig, ResolverServiceInput, WorkflowServiceConfig, WorkflowServiceInput } from "../config/types.mjs";
 import { ConcurrencyPolicy, RetryPolicy } from "../../types/workflow.generated.mjs";
 import { defineAuth } from "./auth/index.mjs";
+import { ResolverPermission, ResolverPermissionCondition, ResolverPermissionPolicy } from "./resolver/permission.mjs";
 import { createResolver } from "./resolver/resolver.mjs";
 import { QueryType } from "./resolver/types.mjs";
 import "./resolver/index.mjs";
 import { WorkflowJob, WorkflowJobContext, createWorkflowJob } from "./workflow/job.mjs";
 import { Workflow, WorkflowConfig, createWorkflow } from "./workflow/workflow.mjs";
 import { FunctionOperation, GqlOperation, Operation, WebhookOperation, WorkflowOperation } from "./executor/operation.mjs";
-import { AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, ResolverExecutedArgs, ResolverExecutedTrigger, TailorDBTrigger, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger } from "./executor/trigger/event.mjs";
+import { AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, ResolverExecutedArgs, ResolverExecutedTrigger, TailorDBTrigger, WorkflowExecutionArgs, WorkflowExecutionCompletedArgs, WorkflowExecutionResumedArgs, WorkflowExecutionRetriedArgs, WorkflowExecutionStartedArgs, WorkflowExecutionTrigger, WorkflowExecutionWaitResolvedArgs, WorkflowExecutionWaitStartedArgs, WorkflowJobExecutionArgs, WorkflowJobExecutionCompletedArgs, WorkflowJobExecutionStartedArgs, WorkflowJobExecutionTrigger, WorkflowJobExecutionWaitResolvedArgs, WorkflowJobExecutionWaitStartedArgs, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, workflowExecutionCompletedTrigger, workflowExecutionResumedTrigger, workflowExecutionRetriedTrigger, workflowExecutionStartedTrigger, workflowExecutionTrigger, workflowExecutionWaitResolvedTrigger, workflowExecutionWaitStartedTrigger, workflowJobExecutionCompletedTrigger, workflowJobExecutionStartedTrigger, workflowJobExecutionTrigger, workflowJobExecutionWaitResolvedTrigger, workflowJobExecutionWaitStartedTrigger } from "./executor/trigger/event.mjs";
 import { ScheduleArgs, ScheduleTrigger, scheduleTrigger } from "./executor/trigger/schedule.mjs";
 import { IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, incomingWebhookTrigger } from "./executor/trigger/webhook.mjs";
 import { Trigger } from "./executor/trigger/index.mjs";
@@ -31,9 +33,8 @@ import { WaitPointInstance, createWaitPoint, createWaitPoints } from "./workflow
 import "./workflow/index.mjs";
 import { defineStaticWebSite } from "./staticwebsite/index.mjs";
 import { defineAIGateway } from "./aigateway/index.mjs";
-import { IdPPermission, IdPPermissionCondition, unsafeAllowAllIdPPermission } from "./idp/permission.mjs";
 import { defineIdp } from "./idp/index.mjs";
 import { defineSecretManager } from "./secrets/index.mjs";
 import { HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, createHttpAdapter } from "./http-adapter/http-adapter.mjs";
 import "./http-adapter/index.mjs";
-export { type AIGatewayConfig, AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, type AuthConfig, type AuthConnectionConfig, type AuthConnectionOAuth2Config, type AuthConnectionTokenResult, type AuthExternalConfig, type AuthOwnConfig, type AuthServiceInput, type BeforeLoginClaims, type BeforeLoginHookArgs, type BuiltinIdP, type ConcurrencyPolicy, type DefinedAuth, type ExecutionPolicyConcurrency, type ExecutionPolicyDefInput, type ExecutionPolicyExactInstance, type ExecutionPolicyGroupOptions, type ExecutionPolicyInstance, type ExecutionPolicyWildcardInstance, type ExecutorServiceConfig, type ExecutorServiceInput, type FederatedIdentity, type FederatedIdentityClaims, type FederatedIdentityProvider, FunctionOperation, GqlOperation, HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, type IDToken, type IdPConfig, type IdPEmailConfig, type IdPExternalConfig, type IdPGqlOperations, type IdPGqlOperationsInput as IdPGqlOperationsConfig, type IdPPermission, type IdPPermissionCondition, type IdProvider as IdProviderConfig, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, type OAuth2ClientInput as OAuth2Client, type OAuth2ClientGrantType, type OIDC, Operation, type PermissionCondition, type QueryType, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, type ResolvedExecutionPolicyInstance, type Resolver, ResolverExecutedArgs, ResolverExecutedTrigger, type ResolverExternalConfig, type ResolverServiceConfig, type ResolverServiceInput, type RetryPolicy, type SAML, type SCIMAttribute, type SCIMAttributeMapping, type SCIMAttributeType, type SCIMAuthorization, type SCIMConfig, type SCIMResource, ScheduleArgs, ScheduleTrigger, type SecretsConfig, type StaticWebsiteConfig, type TailorAnyDBField, type TailorAnyDBType, type TailorDBField, type TailorDBInstance, TailorDBTrigger, type TailorDBType, type TailorTypeGqlPermission, type TailorTypePermission, type TenantProvider as TenantProviderConfig, Trigger, type UserAttributeKey, type UserAttributeListKey, type UserAttributes, type UsernameFieldKey, type ValueOperand, WaitPointInstance, WebhookOperation, Workflow, WorkflowConfig, WorkflowJob, WorkflowJobContext, WorkflowOperation, type WorkflowServiceConfig, type WorkflowServiceInput, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, createExecutor, createHttpAdapter, createResolver, createWaitPoint, createWaitPoints, createWorkflow, createWorkflowJob, db, defineAIGateway, defineAuth, defineIdp, defineSecretManager, defineStaticWebSite, defineWorkflowExecutionPolicies, defineWorkflowExecutionPolicy, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, incomingWebhookTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, scheduleTrigger, unsafeAllowAllGqlPermission, unsafeAllowAllIdPPermission, unsafeAllowAllTypePermission };
+export { type AIGatewayConfig, AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, type AuthConfig, type AuthConnectionConfig, type AuthConnectionOAuth2Config, type AuthConnectionTokenResult, type AuthExternalConfig, type AuthOwnConfig, type AuthServiceInput, type BeforeLoginClaims, type BeforeLoginHookArgs, type BuiltinIdP, type ConcurrencyPolicy, type DefinedAuth, type ExecutionPolicyConcurrency, type ExecutionPolicyDefInput, type ExecutionPolicyExactInstance, type ExecutionPolicyGroupOptions, type ExecutionPolicyInstance, type ExecutionPolicyWildcardInstance, type ExecutorServiceConfig, type ExecutorServiceInput, type FederatedIdentity, type FederatedIdentityClaims, type FederatedIdentityProvider, FunctionOperation, GqlOperation, HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, type IDToken, type IdPConfig, type IdPEmailConfig, type IdPExternalConfig, type IdPGqlOperations, type IdPGqlOperationsInput as IdPGqlOperationsConfig, type IdPPermission, type IdPPermissionCondition, type IdProvider as IdProviderConfig, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, type OAuth2ClientInput as OAuth2Client, type OAuth2ClientGrantType, type OIDC, Operation, type PermissionCondition, type QueryType, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, type ResolvedExecutionPolicyInstance, type Resolver, ResolverExecutedArgs, ResolverExecutedTrigger, type ResolverExternalConfig, type ResolverPermission, type ResolverPermissionCondition, type ResolverPermissionPolicy, type ResolverServiceConfig, type ResolverServiceInput, type RetryPolicy, type SAML, type SCIMAttribute, type SCIMAttributeMapping, type SCIMAttributeType, type SCIMAuthorization, type SCIMConfig, type SCIMResource, ScheduleArgs, ScheduleTrigger, type SecretsConfig, type StaticWebsiteConfig, type TailorAnyDBField, type TailorAnyDBType, type TailorDBField, type TailorDBInstance, TailorDBTrigger, type TailorDBType, type TailorTypeGqlPermission, type TailorTypePermission, type TenantProvider as TenantProviderConfig, Trigger, type UserAttributeKey, type UserAttributeListKey, type UserAttributes, type UsernameFieldKey, type ValueOperand, WaitPointInstance, WebhookOperation, Workflow, WorkflowConfig, WorkflowExecutionArgs, WorkflowExecutionCompletedArgs, WorkflowExecutionResumedArgs, WorkflowExecutionRetriedArgs, WorkflowExecutionStartedArgs, WorkflowExecutionTrigger, WorkflowExecutionWaitResolvedArgs, WorkflowExecutionWaitStartedArgs, WorkflowJob, WorkflowJobContext, WorkflowJobExecutionArgs, WorkflowJobExecutionCompletedArgs, WorkflowJobExecutionStartedArgs, WorkflowJobExecutionTrigger, WorkflowJobExecutionWaitResolvedArgs, WorkflowJobExecutionWaitStartedArgs, WorkflowOperation, type WorkflowServiceConfig, type WorkflowServiceInput, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, createExecutor, createHttpAdapter, createResolver, createWaitPoint, createWaitPoints, createWorkflow, createWorkflowJob, db, defineAIGateway, defineAuth, defineIdp, defineSecretManager, defineStaticWebSite, defineWorkflowExecutionPolicies, defineWorkflowExecutionPolicy, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, incomingWebhookTrigger, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, scheduleTrigger, unsafeAllowAllGqlPermission, unsafeAllowAllIdPPermission, unsafeAllowAllTypePermission, workflowExecutionCompletedTrigger, workflowExecutionResumedTrigger, workflowExecutionRetriedTrigger, workflowExecutionStartedTrigger, workflowExecutionTrigger, workflowExecutionWaitResolvedTrigger, workflowExecutionWaitStartedTrigger, workflowJobExecutionCompletedTrigger, workflowJobExecutionStartedTrigger, workflowJobExecutionTrigger, workflowJobExecutionWaitResolvedTrigger, workflowJobExecutionWaitStartedTrigger };

package/dist/configure/services/resolver/index.d.mts

@@ -1,5 +1,6 @@
 import { Resolver } from "../../../types/resolver.generated.mjs";
 import { ResolverExternalConfig, ResolverServiceConfig, ResolverServiceInput } from "../../config/types.mjs";
+import { ResolverPermission, ResolverPermissionCondition, ResolverPermissionPolicy } from "./permission.mjs";
 import { createResolver } from "./resolver.mjs";
 import { QueryType } from "./types.mjs";
-export { type QueryType, type Resolver, type ResolverExternalConfig, type ResolverServiceConfig, type ResolverServiceInput, createResolver };
+export { type QueryType, type Resolver, type ResolverExternalConfig, type ResolverPermission, type ResolverPermissionCondition, type ResolverPermissionPolicy, type ResolverServiceConfig, type ResolverServiceInput, createResolver };

package/dist/configure/services/resolver/permission.d.mts

@@ -0,0 +1,64 @@
+import { InferredAttributes } from "../../../runtime/types.mjs";
+import { UserBooleanOperand, UserStringOperand } from "../../types/permission-operand.types.mjs";
+//#region src/configure/services/resolver/permission.d.ts
+type EqualityOperator = "=" | "!=";
+type StringEqualityCondition<User extends object> = readonly [UserStringOperand<User>, EqualityOperator, string] | readonly [string, EqualityOperator, UserStringOperand<User>];
+type BooleanEqualityCondition<User extends object> = readonly [UserBooleanOperand<User>, EqualityOperator, boolean] | readonly [boolean, EqualityOperator, UserBooleanOperand<User>];
+/**
+ * A single condition for {@link ResolverPermission}.
+ *
+ * Only `user` operands are supported (unlike TailorDB's `record`/`newRecord`/
+ * `oldRecord` operands) — a resolver has no associated record to compare
+ * against. Only equality (`=`/`!=`) is supported for now.
+ *
+ * The User type is extended by `tailor.d.ts`, which is automatically generated
+ * when running `tailor generate`. Attributes enabled in the config file's
+ * `auth.userProfile.attributes` (or `auth.machineUserAttributes` when
+ * `userProfile` is omitted) become available as types.
+ */
+type ResolverPermissionCondition<User extends object = InferredAttributes> = StringEqualityCondition<User> | BooleanEqualityCondition<User>;
+/**
+ * A single access policy, in the same style as TailorDB's `.permission()`
+ * policies.
+ */
+type ResolverPermissionPolicy<User extends object = InferredAttributes> = {
+  conditions: ResolverPermissionCondition<User> | readonly ResolverPermissionCondition<User>[];
+  /** Whether matching callers are granted (`true`) or denied (`false`) access. */
+  permit: boolean;
+  description?: string;
+};
+/**
+ * Access requirement for a resolver, evaluated against the original caller
+ * (`context.user`) before `body` runs — unaffected by `authInvoker`.
+ *
+ * At least one `permit: true` policy is required: a caller is granted only by
+ * a matching `permit: true` policy (deny by default), and a matching
+ * `permit: false` policy always overrides that grant, even when another
+ * policy would otherwise allow the same caller — use it to carve out an
+ * explicit exception from a broader grant. A policy array with only
+ * `permit: false` policies is rejected, since none of its conditions apply to
+ * a caller presenting no user attributes at all (e.g. one who simply doesn't
+ * authenticate), so it wouldn't actually keep anyone out. `"allowAnonymous"`
+ * explicitly documents that anonymous callers are allowed.
+ * @example
+ * const permission: ResolverPermission = [
+ *   { conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true },
+ * ];
+ * @example
+ * // Allow machine-user callers unconditionally, gate regular users behind a role
+ * const permission: ResolverPermission = [
+ *   { conditions: [[{ user: "isServiceAccount" }, "=", true]], permit: true },
+ *   { conditions: [[{ user: "role" }, "=", "ADMIN"]], permit: true },
+ * ];
+ * @example
+ * // Exception: allow logged-in users broadly, but reject a banned role
+ * const permission: ResolverPermission = [
+ *   { conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true },
+ *   { conditions: [[{ user: "role" }, "=", "BANNED"]], permit: false },
+ * ];
+ * @example
+ * const permission: ResolverPermission = "allowAnonymous";
+ */
+type ResolverPermission<User extends object = InferredAttributes> = readonly ResolverPermissionPolicy<User>[] | "allowAnonymous";
+//#endregion
+export { ResolverPermission, ResolverPermissionCondition, ResolverPermissionPolicy };

package/dist/configure/services/resolver/resolver.d.mts

@@ -4,6 +4,7 @@ import { MachineUserName } from "../auth/types.mjs";
 import { ResolverInput } from "../../../types/resolver.generated.mjs";
 import { TailorAnyField, TailorField } from "../../types/type.mjs";
 import "../../types/machine-user.mjs";
+import { ResolverPermission } from "./permission.mjs";
 //#region src/configure/services/resolver/resolver.d.ts
 type Context<Input extends Record<string, TailorAnyField> | undefined> = {
   input: Input extends Record<string, TailorAnyField> ? InferFieldsOutput<Input> : never;
@@ -21,11 +22,12 @@ type NormalizedOutput<Output extends TailorAnyField | Record<string, TailorAnyFi
   type: "nested";
   array: false;
 }, InferFieldsOutput<Extract<Output, Record<string, TailorAnyField>>>>;
-type ResolverReturn<Input extends Record<string, TailorAnyField> | undefined, Output extends TailorAnyField | Record<string, TailorAnyField>> = Omit<ResolverInput, "input" | "output" | "body" | "invoker"> & Readonly<{
+type ResolverReturn<Input extends Record<string, TailorAnyField> | undefined, Output extends TailorAnyField | Record<string, TailorAnyField>> = Omit<ResolverInput, "input" | "output" | "body" | "invoker" | "permission"> & Readonly<{
   input?: Input;
   output: NormalizedOutput<Output>;
   body: (context: Context<Input>) => OutputType<Output> | Promise<OutputType<Output>>;
   invoker?: MachineUserName;
+  permission?: ResolverPermission;
 }>;
 /**
  * Create a resolver definition for the Tailor SDK.
@@ -41,6 +43,14 @@ type ResolverReturn<Input extends Record<string, TailorAnyField> | undefined, Ou
  * If not specified, this is automatically set to true when an executor uses this resolver
  * with `resolverExecutedTrigger`. If explicitly set to false while an executor uses this
  * resolver, an error will be thrown during apply.
+ *
+ * `permission` declares the resolver's access requirement, checked against `context.user` (the
+ * original caller, unaffected by `authInvoker`) before `body` runs. Omitted (default):
+ * unchanged, anonymous callers can reach the resolver. `"allowAnonymous"`: explicitly documents
+ * that anonymous callers are allowed. An array of `{ conditions, permit }` policies (in the same
+ * style as TailorDB's `.permission()`) rejects non-matching callers: at least one `permit: true`
+ * policy is required (denied unless it matches), and a matching `permit: false` policy always
+ * overrides that grant.
  * @template Input
  * @template Output
  * @param config - Resolver configuration
@@ -51,6 +61,7 @@ type ResolverReturn<Input extends Record<string, TailorAnyField> | undefined, Ou
  * export default createResolver({
  *   name: "getUser",
  *   operation: "query",
+ *   permission: [{ conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true }],
  *   input: {
  *     id: t.string(),
  *   },
@@ -65,11 +76,12 @@ type ResolverReturn<Input extends Record<string, TailorAnyField> | undefined, Ou
  *   }),
  * });
  */
-declare function createResolver<Input extends Record<string, TailorAnyField> | undefined = undefined, Output extends TailorAnyField | Record<string, TailorAnyField> = TailorAnyField>(config: Omit<ResolverInput, "input" | "output" | "body" | "invoker"> & Readonly<{
+declare function createResolver<Input extends Record<string, TailorAnyField> | undefined = undefined, Output extends TailorAnyField | Record<string, TailorAnyField> = TailorAnyField>(config: Omit<ResolverInput, "input" | "output" | "body" | "invoker" | "permission"> & Readonly<{
   input?: Input;
   output: Output;
   body: (context: Context<Input>) => OutputType<Output> | Promise<OutputType<Output>>;
   invoker?: MachineUserName;
+  permission?: ResolverPermission;
 }>): ResolverReturn<Input, Output>;
 type ResolverConfig = ReturnType<typeof createResolver<any, any>>;
 //#endregion

package/dist/configure/services/tailordb/index.d.mts

@@ -1,4 +1,3 @@
-import { DBFieldMetadata, GqlOperationsConfig, Hook, TailorDBServiceInput, TypeFeatures } from "./types.mjs";
 import { PermissionCondition, TailorTypeGqlPermission, TailorTypePermission, unsafeAllowAllGqlPermission, unsafeAllowAllTypePermission } from "./permission.mjs";
 import { TailorAnyDBField, TailorAnyDBType, TailorDBField, TailorDBInstance, TailorDBType, db } from "./schema.mjs";
 export { type PermissionCondition, type TailorAnyDBField, type TailorAnyDBType, type TailorDBField, type TailorDBInstance, type TailorDBType, type TailorTypeGqlPermission, type TailorTypePermission, db, unsafeAllowAllGqlPermission, unsafeAllowAllTypePermission };

package/dist/configure/services/tailordb/permission.d.mts

@@ -1,4 +1,5 @@
 import { InferredAttributes } from "../../../runtime/types.mjs";
+import { UserBooleanArrayOperand, UserBooleanOperand, UserStringArrayOperand, UserStringOperand } from "../../types/permission-operand.types.mjs";
 //#region src/configure/services/tailordb/permission.d.ts
 /**
  * Record-level permission configuration for a TailorDB type.
@@ -47,22 +48,6 @@ type GqlPermissionAction = "read" | "create" | "update" | "delete" | "aggregate"
 type EqualityOperator = "=" | "!=";
 type ContainsOperator = "in" | "not in";
 type HasAnyOperator = "hasAny" | "not hasAny";
-type StringFieldKeys<User extends object> = { [K in keyof User]-?: Exclude<User[K], undefined> extends string ? K : never; }[keyof User];
-type StringArrayFieldKeys<User extends object> = { [K in keyof User]-?: Exclude<User[K], undefined> extends string[] ? K : never; }[keyof User];
-type BooleanFieldKeys<User extends object> = { [K in keyof User]-?: Exclude<User[K], undefined> extends boolean ? K : never; }[keyof User];
-type BooleanArrayFieldKeys<User extends object> = { [K in keyof User]-?: Exclude<User[K], undefined> extends boolean[] ? K : never; }[keyof User];
-type UserStringOperand<User extends object = InferredAttributes> = {
-  user: StringFieldKeys<User> | "id";
-};
-type UserStringArrayOperand<User extends object = InferredAttributes> = {
-  user: StringArrayFieldKeys<User>;
-};
-type UserBooleanOperand<User extends object = InferredAttributes> = {
-  user: BooleanFieldKeys<User> | "_loggedIn";
-};
-type UserBooleanArrayOperand<User extends object = InferredAttributes> = {
-  user: BooleanArrayFieldKeys<User>;
-};
 type RecordOperand<Type extends object, Update extends boolean = false> = Update extends true ? {
   oldRecord: (keyof Type & string) | "id";
 } | {

package/dist/configure/services/workflow/execution-policy.d.mts

@@ -33,7 +33,7 @@ declare function defineWorkflowExecutionPolicy<const N extends string, const D e
 /**
  * Define a group of workflow job function execution policies. Property names
  * become the workspace-unique `name` and default `key` verbatim, matching the
- * mental model of {@link defineWaitPoints}. Provide `name` / `key` explicitly
+ * mental model of {@link createWaitPoints}. Provide `name` / `key` explicitly
  * to override the property-name default (for example, when the property name
  * is not valid for the execution policy grammar or when the runtime key
  * prefix needs to differ).
@@ -58,10 +58,10 @@ declare function defineWorkflowExecutionPolicy<const N extends string, const D e
  * }));
  *
  * // In a workflow job function:
- * await tailor.workflow.startJobFunction("worker", args, {
+ * await tailor.workflow.execJobFunction("worker", args, {
  *   executionPolicyKey: executionPolicies.premium.key,
  * });
- * await tailor.workflow.startJobFunction("worker", args, {
+ * await tailor.workflow.execJobFunction("worker", args, {
  *   executionPolicyKey: executionPolicies["tenant-api"].keyFor(input.tenantId),
  * });
  */