@tailor-platform/sdk 2.0.0 → 2.1.0

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # @tailor-platform/sdk
 
+## 2.1.0
+
+### Minor Changes
+
+- [#1976](https://github.com/tailor-platform/sdk/pull/1976) [`aef43a7`](https://github.com/tailor-platform/sdk/commit/aef43a765d2ab26c2eee9bbbe5463e28c845f8dc) Thanks [@toiroakr](https://github.com/toiroakr)! - Add `defaultPermission` to resolver namespaces in `defineConfig`, applying an access requirement to every resolver in the namespace that declares no `permission` of its own — securing a namespace no longer means editing every resolver. It takes the same values as a resolver's `permission`, including `"allowAnonymous"` for a namespace that is public by design, and a resolver's own `permission` replaces it rather than merging with it. `generate` and `deploy` now warn when a namespace declares neither a `defaultPermission` nor a `permission` on each of its resolvers.
+
+### Patch Changes
+
+- [#1982](https://github.com/tailor-platform/sdk/pull/1982) [`287c551`](https://github.com/tailor-platform/sdk/commit/287c55173c75ae6533732fb1128a16e4366961e0) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update dependency get-tsconfig to v4.14.1
+
+- [#1995](https://github.com/tailor-platform/sdk/pull/1995) [`b6ed05d`](https://github.com/tailor-platform/sdk/commit/b6ed05db825886dba844664210f32855572e3f88) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update dependency tsx to v4.23.5
+
+- [#1976](https://github.com/tailor-platform/sdk/pull/1976) [`5d0f513`](https://github.com/tailor-platform/sdk/commit/5d0f5135fb1dc6dc9a467f48a7b5aa3d8ac57e5e) Thanks [@toiroakr](https://github.com/toiroakr)! - Fix a resolver `permission` denial returning `ReferenceError: TailorErrorMessage is not defined` to the caller instead of `access denied`. The generated guard now raises `TailorErrors`, which is the only error class the platform turns back into a message the caller can read.
+  
+  `TailorErrorMessage` no longer exists in the platform runtime, so its ambient global declaration and its Vitest mock are removed as well — together they let code that always failed in production pass both type checking and tests. Code that throws `TailorErrorMessage` now fails to compile; replace it with `TailorErrors`:
+  
+  ```ts
+  throw new TailorErrors([{ message: "not found", path: [] }]);
+  ```
+
+- [#1978](https://github.com/tailor-platform/sdk/pull/1978) [`49aa0d3`](https://github.com/tailor-platform/sdk/commit/49aa0d38fc60224d701d7663483f2137b280841f) Thanks [@toiroakr](https://github.com/toiroakr)! - `createTailorDBHook` now takes each field from the data's own properties. A type declaring a field named after a member of `Object` — `toString`, say — used to get that member as the field's value on every record that omitted the field, so validation rejected otherwise valid rows:
+  
+  ```
+  ✗ Found 1 error(s) in ./seed/data/Customer.jsonl
+     Expected a string: received function toString() { [native code] }
+  ```
+  
+  A field named `__proto__` is recorded as a data property rather than assigned, so its value is kept instead of being swallowed by the inherited setter.
+  
+  A field the data does not carry still lands as an `undefined` key, which is what keeps a column inferred from these records nullable.
+
+- [#1967](https://github.com/tailor-platform/sdk/pull/1967) [`47e4f2b`](https://github.com/tailor-platform/sdk/commit/47e4f2bc37a735de091f83f3c4d453a004daec62) Thanks [@toiroakr](https://github.com/toiroakr)! - Drop internal RPC vocabulary from the JSDoc on the `tailor.workflow` runtime API. The module doc and `execJobFunction`'s own doc described the wire-format history behind the current names, which reached editor tooltips without telling users anything they could act on. The behaviour the text was explaining is kept: `execJobFunction` blocks until the job finishes and returns its result, while `startWorkflow` returns only an execution ID.
+
+## 2.0.1
+
+### Patch Changes
+
+- [#1957](https://github.com/tailor-platform/sdk/pull/1957) [`a465547`](https://github.com/tailor-platform/sdk/commit/a465547df712ca8c607c1e42cf12c15fe3e830d1) Thanks [@toiroakr](https://github.com/toiroakr)! - Invoke the CLI as `npx @tailor-platform/sdk <command>` wherever an invocation is written for you. `npx` resolves a command it cannot find locally as a package name, so `npx tailor` fell through to an unrelated `tailor` package on npm whenever the SDK was not installed in the project — including in CI, where npm installs without prompting. Omitting the version specifier keeps using the project's installed SDK when there is one.
+  
+  - Setup examples in the README, the quickstart, and the scaffolded project READMEs now use the package-runner form. Bun examples use `bun tailor <command>`, which resolves the local binary without fetching from the registry.
+  - Workflows generated by `tailor setup` use `npx @tailor-platform/sdk` for npm projects and `bun run tailor` for Bun projects. `tailor setup check` reports the template as outdated so existing projects regenerate; re-run `tailor setup` to pick it up.
+  - The `v2/seed-exec-to-cli-plugin` and `v2/sdk-skills-shim` codemods write the package-runner form when the invocation they produce goes through a runner that installs from the registry (`npx`, `bunx`, `pnpm`/`yarn dlx`, `npm exec`). A runner that resolves project binaries, such as `pnpm exec`, still gets the bare `tailor` binary.
+
+- [#1948](https://github.com/tailor-platform/sdk/pull/1948) [`8af9031`](https://github.com/tailor-platform/sdk/commit/8af9031aee675da1d570d29ed18e76287ea0c184) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): lock file maintenance
+
+- [#1953](https://github.com/tailor-platform/sdk/pull/1953) [`0871279`](https://github.com/tailor-platform/sdk/commit/0871279e943f1f5dfa1fbe6ad838b6485cb3c0a0) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update dependency amaro to v1.1.11
+
+- [#1954](https://github.com/tailor-platform/sdk/pull/1954) [`e78df40`](https://github.com/tailor-platform/sdk/commit/e78df401bc46cfe6aeada19f0551a97f454cc1db) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update dependency execa to v10.0.1
+
+- [#1964](https://github.com/tailor-platform/sdk/pull/1964) [`0f73487`](https://github.com/tailor-platform/sdk/commit/0f734878c4c2115ec5f59eb5870e98862b6541ba) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update dependency @toiroakr/lines-db to v0.11.0
+
 ## 2.0.0
 
 ### Major Changes

package/README.md

@@ -53,10 +53,10 @@ For more details, see the [Quickstart Guide](./docs/quickstart.md).
 Install the `tailor` skill from the locally installed SDK package:
 
 ```bash
-npx tailor skills add
+npx @tailor-platform/sdk skills add
 
 # Or refresh all skills owned by this CLI
-npx tailor skills sync
+npx @tailor-platform/sdk skills sync
 ```
 
 This sources the skill from `node_modules/@tailor-platform/sdk/agent-skills`

package/dist/application-Af1zIqSI.mjs

@@ -0,0 +1,3 @@
+import { n as generatePluginFilesIfNeeded, r as loadApplication, t as defineApplication } from "./application-D77KJFKD.mjs";
+
+export { defineApplication, generatePluginFilesIfNeeded };

package/dist/{application-CM6hKnSK.mjs → application-D77KJFKD.mjs}

@@ -3996,7 +3996,8 @@ function policyEntryExpr(policy) {
 /**
 * Build the permission guard statement injected at resolver entry.
 *
-* Rejects the call with `TailorErrorMessage` when the caller doesn't match
+* Rejects the call with `TailorErrors` — the only error class the platform
+* turns back into a message the caller can read — when the caller doesn't match
 * `permission`, evaluated against `context.caller` — the original caller,
 * unaffected by `authInvoker`. `permission` is deny-by-default: a caller is
 * granted only by a matching `permit: true` policy, and a matching
@@ -4025,7 +4026,8 @@ function buildResolverPermissionGuardExpr(permission) {
       const $reasons = ($matchedDeny.length > 0 ? $matchedDeny : $allowPolicies)
         .map((p) => p.description)
         .filter(Boolean);
-      throw new TailorErrorMessage($reasons.length > 0 ? "access denied: " + $reasons.join("; ") : "access denied");
+      const $message = $reasons.length > 0 ? "access denied: " + $reasons.join("; ") : "access denied";
+      throw new TailorErrors([{ message: $message, path: [] }]);
     }
   }`;
 }
@@ -4035,16 +4037,18 @@ function buildResolverPermissionGuardExpr(permission) {
 *
 * Kept as a single generator so a resolver-wrapping behavior (like the
 * permission guard) can't be added to one entry-point template and forgotten
-* in the other. References `context.caller`, `context.input`, `invoker`, and
-* `_internalResolver` — the caller's wrapper must bind a `context` object
+* in the other — the namespace-default precedence below is resolved here for
+* the same reason. References `context.caller`, `context.input`, `invoker`,
+* and `_internalResolver` — the caller's wrapper must bind a `context` object
 * with `user`/`input` properties and an `invoker` binding (from
 * `INVOKER_EXPR`) before inlining this expression.
-* @param permission - The resolver's `permission` config
+* @param params - The resolver's and its namespace's permission config
 * @returns A JS statement block to inline before calling `_internalResolver.body(...)`
 */
-function buildResolverPermissionAndInputCheckExpr(permission) {
+function buildResolverPermissionAndInputCheckExpr(params) {
+	const { permission, defaultPermission } = params;
 	return `
-    ${buildResolverPermissionGuardExpr(permission) ?? ""}
+    ${buildResolverPermissionGuardExpr(permission ?? defaultPermission) ?? ""}
     if (_internalResolver.input) {
       const result = t.object(_internalResolver.input).parse({
         value: context.input,
@@ -4544,17 +4548,11 @@ async function loadResolver(resolverFilePath) {
 * 1. Uses a transform plugin to add validation wrapper during bundling
 * 2. Creates an in-memory entry module
 * 3. Bundles in a single step with tree-shaking
-* @param namespace - Resolver namespace name
-* @param config - Resolver file loading configuration
-* @param baseDir - Directory the config's file patterns are resolved against
-* @param startContext - Start context for workflow/job transformations
-* @param cache - Optional bundle cache for skipping unchanged builds
-* @param inlineSourcemap - Whether to enable inline sourcemaps
-* @param bundleLogLevel - Controls which console calls are kept in bundled code
-* @param tsconfigCache - Optional tsconfig lookup cache shared across bundles in this CLI run
+* @param options - Bundle options
 * @returns Map of resolver name to bundled code
 */
-async function bundleResolvers(namespace, config, baseDir, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", tsconfigCache) {
+async function bundleResolvers(options) {
+	const { namespace, config, baseDir, defaultPermission, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", tsconfigCache } = options;
 	const bundledCode = /* @__PURE__ */ new Map();
 	const files = loadFilesWithIgnores(config, baseDir);
 	if (files.length === 0) {
@@ -4577,16 +4575,27 @@ async function bundleResolvers(namespace, config, baseDir, startContext, cache,
 		});
 	}
 	const tsconfig = await resolveTSConfigWithFallback(baseDir);
-	const results = await withBundleConcurrency(resolvers, (resolver) => bundleSingleResolver(namespace, resolver, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel, tsconfigCache));
+	const results = await withBundleConcurrency(resolvers, (resolver) => bundleSingleResolver({
+		namespace,
+		resolver,
+		tsconfig,
+		defaultPermission,
+		startContext,
+		cache,
+		inlineSourcemap,
+		bundleLogLevel,
+		tsconfigCache
+	}));
 	for (const [name, code] of results) bundledCode.set(name, code);
 	logger.log(`${styles.success("Bundled")} ${styles.info(`"${namespace}"`)}`);
 	return bundledCode;
 }
-async function bundleSingleResolver(namespace, resolver, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", tsconfigCache) {
+async function bundleSingleResolver(options) {
+	const { namespace, resolver, tsconfig, defaultPermission, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", tsconfigCache } = options;
 	const serializedStartContext = serializeStartContext(startContext);
 	const contextHash = computeBundlerContextHash({
 		sourceFile: resolver.sourceFile,
-		extraContext: serializedStartContext,
+		extraContext: JSON.stringify([serializedStartContext, defaultPermission ?? null]),
 		tsconfig,
 		inlineSourcemap,
 		bundleLogLevel
@@ -4606,7 +4615,10 @@ async function bundleSingleResolver(namespace, resolver, tsconfig, startContext,
 
         const $tailor_resolver_body = async (context) => {
           const invoker = ${INVOKER_EXPR};
-          ${buildResolverPermissionAndInputCheckExpr(resolver.permission)}
+          ${buildResolverPermissionAndInputCheckExpr({
+				permission: resolver.permission,
+				defaultPermission
+			})}
           return _internalResolver.body({ ...context, invoker });
         };
 
@@ -4642,6 +4654,53 @@ async function bundleSingleResolver(namespace, resolver, tsconfig, startContext,
 	return [resolver.name, code];
 }
 
+//#endregion
+//#region src/cli/services/resolver/default-permission.ts
+/**
+* Validate a resolver namespace's `defaultPermission` with the same schema as
+* a resolver's own `permission`, so an invalid policy fails the build instead
+* of compiling into a guard that lets everyone through.
+* @param params - The namespace name and its resolver service config
+* @returns The validated default, or `undefined` when the namespace declares none
+*/
+function parseResolverDefaultPermission(params) {
+	const { namespace, config } = params;
+	if (config.defaultPermission === void 0) return;
+	const result = ResolverPermissionSchema.safeParse(config.defaultPermission);
+	if (!result.success) throw new Error(`Invalid \`defaultPermission\` for resolver namespace "${namespace}": ` + result.error.issues.map((issue) => issue.message).join("; "));
+	return result.data;
+}
+/**
+* Find the `defaultPermission` of the resolver namespace a file belongs to.
+*
+* `function test-run` receives a single file rather than a namespace, so the
+* namespace is recovered by matching the file against each namespace's own
+* patterns — otherwise a test run would skip a guard the deployed resolver has.
+*
+* Nothing stops two namespaces' patterns from claiming the same file, and
+* `deploy` then bundles that resolver once per namespace, each with its own
+* default. Picking one here would make the test run agree with only one of
+* the deployed copies, so an ambiguous file is rejected instead.
+* @param params - The config's resolver section, the resolver file, and the config's own directory
+* @returns The owning namespace's validated default, or `undefined` when no namespace claims the file
+*/
+function resolveResolverDefaultPermissionForFile(params) {
+	const { config, filePath, baseDir } = params;
+	if (!config) return;
+	const targetFile = path.resolve(filePath);
+	const owners = [];
+	for (const [namespace, serviceConfig] of Object.entries(config)) {
+		if ("external" in serviceConfig) continue;
+		if (loadFilesWithIgnores(serviceConfig, baseDir).some((file) => path.resolve(file) === targetFile)) owners.push({
+			namespace,
+			config: serviceConfig
+		});
+	}
+	if (owners.length > 1) throw new Error(`Resolver ${path.relative(process.cwd(), targetFile)} matches more than one resolver namespace: ${owners.map((owner) => `"${owner.namespace}"`).join(", ")}. Each namespace applies its own \`defaultPermission\`, so narrow the \`files\`/\`ignores\` patterns until exactly one namespace claims this file.`);
+	const [owner] = owners;
+	return owner ? parseResolverDefaultPermission(owner) : void 0;
+}
+
 //#endregion
 //#region src/cli/services/resolver/service.ts
 /**
@@ -4653,6 +4712,10 @@ async function bundleSingleResolver(namespace, resolver, tsconfig, startContext,
 */
 function createResolverService(namespace, config, baseDir) {
 	const resolvers = {};
+	const defaultPermission = parseResolverDefaultPermission({
+		namespace,
+		config
+	});
 	const loadResolverForFile = async (resolverFile) => {
 		try {
 			const resolverModule = await import(pathToFileURL(resolverFile).href);
@@ -4674,6 +4737,7 @@ function createResolverService(namespace, config, baseDir) {
 	return {
 		namespace,
 		config,
+		defaultPermission,
 		get resolvers() {
 			return resolvers;
 		},
@@ -4684,10 +4748,34 @@ function createResolverService(namespace, config, baseDir) {
 			logger.log(`Found ${styles.highlight(resolverFiles.length.toString())} resolver files for service ${styles.highlight(`"${namespace}"`)}`);
 			await Promise.all(resolverFiles.map((resolverFile) => loadResolverForFile(resolverFile)));
 			assertUniqueResolverNames(resolvers, namespace);
+			warnUndeclaredPermissions({
+				namespace,
+				defaultPermission,
+				resolvers
+			});
 		}
 	};
 }
 /**
+* Warn about resolvers that declare no access requirement at all.
+*
+* A namespace-level `defaultPermission` covers every resolver in the
+* namespace, so the warning only fires when the namespace declares none and
+* at least one of its resolvers declares none either — those resolvers are
+* reachable by anonymous callers.
+* @param params - The namespace, its default permission, and its loaded resolvers
+*/
+function warnUndeclaredPermissions(params) {
+	const { namespace, defaultPermission, resolvers } = params;
+	if (defaultPermission !== void 0) return;
+	const loaded = Object.values(resolvers);
+	const undeclared = loaded.filter((resolver) => resolver.permission === void 0);
+	if (undeclared.length === 0) return;
+	logger.warn(`Resolver namespace ${styles.highlight(`"${namespace}"`)}: ${undeclared.length} of ${loaded.length} resolvers declare no \`permission\`, so anonymous callers can reach them. Set \`defaultPermission\` on the namespace, or declare \`permission\` on each resolver ("allowAnonymous" if public access is intended).`);
+	const names = undeclared.map((resolver) => resolver.name).toSorted();
+	logger.debug(`  Resolvers without \`permission\`: ${names.join(", ")}`);
+}
+/**
 * Assert that every loaded resolver in a namespace has a unique name.
 * Resolvers are stored by source file, so two files declaring the same
 * `name` would otherwise silently share a single bundle cache entry.
@@ -5751,7 +5839,17 @@ async function loadApplication(params) {
 		authHooks: /* @__PURE__ */ new Map()
 	};
 	for (const pipeline of resolverResult.resolverServices) {
-		const resolverBundles = await bundleResolvers(pipeline.namespace, pipeline.config, baseDir, startContext, bundleCache, inlineSourcemap, bundleLogLevel, tsconfigCache);
+		const resolverBundles = await bundleResolvers({
+			namespace: pipeline.namespace,
+			config: pipeline.config,
+			baseDir,
+			defaultPermission: pipeline.defaultPermission,
+			startContext,
+			cache: bundleCache,
+			inlineSourcemap,
+			bundleLogLevel,
+			tsconfigCache
+		});
 		for (const [name, code] of resolverBundles) bundledScripts.resolvers.set(resolverBundleKey(pipeline.namespace, name), code);
 	}
 	if (executorService) bundledScripts.executors = await bundleExecutors({
@@ -5823,5 +5921,5 @@ async function loadApplication(params) {
 }
 
 //#endregion
-export { LOG_LEVELS as $, hashContent as A, getConsoleBaseUrl as B, createLogLevelTreeshakeOptions as C, hasGenerationHooks as D, getPluginGenerationDependencies as E, fetchAllTolerant as F, initOperatorClient as G, getOrNull as H, fetchMachineUserToken as I, normalizeBaseUrl as J, isDefaultPlatform as K, fetchPaged as L, closeConnectionPool as M, defaultPlatformBaseUrl as N, createBundleCache as O, fetchAll as P, createApplyLimiter as Q, fetchPlatformMachineUserToken as R, composeFunctionTreeshakeOptions as S, createBundleLog as T, getPlatformBaseUrl as U, getOAuth2ClientId as V, initOAuth2Client as W, resolveStaticWebsiteUrls as X, rememberPlatformConfigForToken as Y, byName as Z, stringifyFunction as _, resolveInlineSourcemap as a, resolveTSConfigWithFallback as b, WorkflowJobSchema as c, INVOKER_EXPR as d, buildExecutorArgsExpr as f, assertUniqueTailorDBTypeNamesWithExternal as g, assertUniqueLocalTailorDBTypeNames as h, resolverBundleKey as i, hashFile as j, getDistDir as k, ResolverSchema as l, buildResolverPermissionAndInputCheckExpr as m, generatePluginFilesIfNeeded as n, getApplicationAuthNamespace as o, buildResolverOperationHookExpr as p, isNotFoundError as q, loadApplication as r, WorkflowJobFunctionExecutionPolicySchema as s, defineApplication as t, HTTP_METHODS as u, createGeneratedEntryResolverPlugin as v, resolveBundleLogLevel as w, platformBundleDefinePlugin as x, createTsconfigPathsPlugin as y, fetchUserInfo as z };
-//# sourceMappingURL=application-CM6hKnSK.mjs.map
+export { createApplyLimiter as $, getDistDir as A, fetchUserInfo as B, composeFunctionTreeshakeOptions as C, getPluginGenerationDependencies as D, createBundleLog as E, fetchAll as F, initOAuth2Client as G, getOAuth2ClientId as H, fetchAllTolerant as I, isNotFoundError as J, initOperatorClient as K, fetchMachineUserToken as L, hashFile as M, closeConnectionPool as N, hasGenerationHooks as O, defaultPlatformBaseUrl as P, byName as Q, fetchPaged as R, platformBundleDefinePlugin as S, resolveBundleLogLevel as T, getOrNull as U, getConsoleBaseUrl as V, getPlatformBaseUrl as W, rememberPlatformConfigForToken as X, normalizeBaseUrl as Y, resolveStaticWebsiteUrls as Z, assertUniqueTailorDBTypeNamesWithExternal as _, resolveInlineSourcemap as a, createTsconfigPathsPlugin as b, WorkflowJobSchema as c, HTTP_METHODS as d, LOG_LEVELS as et, INVOKER_EXPR as f, assertUniqueLocalTailorDBTypeNames as g, buildResolverPermissionAndInputCheckExpr as h, resolverBundleKey as i, hashContent as j, createBundleCache as k, resolveResolverDefaultPermissionForFile as l, buildResolverOperationHookExpr as m, generatePluginFilesIfNeeded as n, getApplicationAuthNamespace as o, buildExecutorArgsExpr as p, isDefaultPlatform as q, loadApplication as r, WorkflowJobFunctionExecutionPolicySchema as s, defineApplication as t, ResolverSchema as u, stringifyFunction as v, createLogLevelTreeshakeOptions as w, resolveTSConfigWithFallback as x, createGeneratedEntryResolverPlugin as y, fetchPlatformMachineUserToken as z };
+//# sourceMappingURL=application-D77KJFKD.mjs.map