@tailor-platform/sdk 2.0.1 → 2.2.0

package/CHANGELOG.md

@@ -1,5 +1,122 @@
 # @tailor-platform/sdk
 
+## 2.2.0
+
+### Minor Changes
+
+- [#1992](https://github.com/tailor-platform/sdk/pull/1992) [`6e67451`](https://github.com/tailor-platform/sdk/commit/6e6745147d07d6d1a26291f3d2cc8510170ae407) Thanks [@dqn](https://github.com/dqn)! - TailorDB migration scripts can now be unit-tested before deploying:
+  
+  - The generated `db.ts` exports the `Database` interface, so `createKyselyMock<Database>()` from `@tailor-platform/sdk/vitest` types queries against the migration's schema state.
+  - `tailor tailordb migration script <number> --with-test` scaffolds a ready-to-fill `migrate.test.ts` next to the migration script. When `migrate.ts` already exists (e.g. auto-generated for a breaking change), the flag adds only the test file.
+  - `createKyselyPGlite<Database>(new PGlite())` from `@tailor-platform/sdk/vitest` runs a migration script against an in-memory Postgres (`@electric-sql/pglite`, installed separately) to verify what it does to real rows.
+  - The migration guide's Testing section now documents the workflow.
+
+- [#1975](https://github.com/tailor-platform/sdk/pull/1975) [`b5ca25b`](https://github.com/tailor-platform/sdk/commit/b5ca25b796e8a5e4262ea2e3527973d77cab766a) Thanks [@toiroakr](https://github.com/toiroakr)! - Add `tailor seed fill` to fill in the values a record gets on create for the JSONL seed data rows that are missing them. It fills `id` by default, so rows can reference each other by id, and `--fields` names any other create-time field:
+  
+  ```bash
+  # ./seed/data/Customer.jsonl: {"name":"Acme Corporation"}
+  tailor seed fill
+  # ./seed/data/Customer.jsonl: {"id":"0b6b6f5e-...","name":"Acme Corporation"}
+  
+  # also stamp a creation time on rows that have none
+  tailor seed fill --fields id,createdAt
+  ```
+  
+  The values come from the type itself — its `id`, its field defaults, its create hooks — applied to each row on its own. Nothing is validated, so a row can be filled while a required field is still missing or while another file references an id that does not exist yet; that is the point, since the ids are what you need in order to write the rows that reference them. Run `tailor seed validate` when the data is ready.
+  
+  Only the named fields are written, and only into a row that has no value for them, so a value already in the file is never replaced. A line that gains nothing is left byte for byte as it was; a line that takes a value is written with its keys in the order the type declares its fields, so a filled-in `id` lands at the front. A field the type gives no value to is skipped, so `--fields id` covers a whole data directory and leaves the IdP `_User` data alone, and naming a field the platform assigns — a `serial` field, for instance — fills nothing and says so.
+  
+  `tailor seed apply --upsert` now points at the command when a row has no `id`, since that is the run it blocks, and newly scaffolded projects get a `seed:fill` script next to `seed:validate`.
+  
+  The generated seed schema files now export the type's create hook, which is where the values come from. Run `tailor generate` after upgrading; until then `tailor seed fill` reports which file needs regenerating.
+  
+  `createTailorDBHook` from `@tailor-platform/sdk/test` no longer runs the type's own `validate`. Computing the values a record gets on create and deciding whether a record is acceptable are separate jobs, and the second one now sits where the field-level validation already was: `createStandardSchema` takes the type as a third argument and reports type-level issues through its result.
+  
+  `tailor seed validate` also stops printing two markers on the header of a failed run (`\u2716 \u2717 Found 2 error(s) in ...`), now that it hands the CLI a report that is already formatted.
+  
+  That also fixes how `tailor seed validate` reports them. A type-level `validate` failure used to end the run at the first offending row with a bare message; it now lands in the same report as every other issue, naming the file and every row that fails.
+  
+  A test calling `createTailorDBHook` directly to assert a type-level `validate` throws needs to go through `createStandardSchema` instead.
+  
+  The same operation is available as `fillSeedData` from `@tailor-platform/sdk/seed`.
+
+- [#1979](https://github.com/tailor-platform/sdk/pull/1979) [`07c50a6`](https://github.com/tailor-platform/sdk/commit/07c50a6d5728827b937160a97182c3996c00baad) Thanks [@toiroakr](https://github.com/toiroakr)! - Add `TailorDBColumns` / `TailorDBInsertable` / `TailorDBSelectable` / `TailorDBUpdateable` to `@tailor-platform/sdk/kysely`. They accept either a table (`typeof myTable`) or a bare field collection, so code that is generic over the fields can derive create/read/update inputs the same way the generated table types do: `.serial()` fields are never caller-supplied, `.default()` and `.hooks({ create })` fields may be omitted on create, optional fields stay optional, and `id` is generated. `IsReadOnlyDBField` and `IsAutoFilledDBField` are also exported from `@tailor-platform/sdk` for asking whether callers can never write a single field, or may omit it on create.
+  
+  Supplying a value for a `.serial()` column now fails with the reason instead of `'<column>' does not exist in type ...`, which read as a typo:
+  
+  ```
+  Type 'string' is not assignable to type 'TypeLevelError<"assigned by .serial(); remove it from the input">'.
+  ```
+  
+  This applies to the tables `kyselyTypePlugin` generates as well, because it comes from `Serial`. A serial column is now an omittable key on `Insertable`/`Updateable` rather than an absent one, so `keyof Insertable<Table<"MyType">>` includes it, and copying a whole record into a create input (`{ ...row }`) now reports the serial column instead of silently dropping it. Assigning the same values as before still compiles, and passing `undefined` is equivalent to omitting the column.
+  
+  `Insertable`, `Selectable` and `Updateable` from the generated `Namespace` also print as a flat object rather than an intersection, so assignability errors name the shape directly.
+  
+  `TailorDBField` gains an optional third type parameter carrying a nested object's own fields, so `db.object({ at: db.datetime() })` keeps that shape through the builder chain. Without it a date or datetime nested in an object resolved to `string | Date` (or `string`) while the runtime hands back a `Date`. Writing `TailorDBField<Defined, Output>` still works.
+
+- [#1988](https://github.com/tailor-platform/sdk/pull/1988) [`f45ed5b`](https://github.com/tailor-platform/sdk/commit/f45ed5b380620d58f332fd2dd8fc5bb92ea28ecd) Thanks [@dqn](https://github.com/dqn)! - Add `tailor tailordb migration test` to rehearse pending migrations in an isolated workspace. The command can load generated seed fixtures or clone source TailorDB records, run the real migration phases, optionally execute a Kysely assertion script, and deletes workspaces it creates unless `--keep` is passed.
+
+- [#1984](https://github.com/tailor-platform/sdk/pull/1984) [`2f8457d`](https://github.com/tailor-platform/sdk/commit/2f8457d433b583769b136ece9a0c483cfccf6cdd) Thanks [@dqn](https://github.com/dqn)! - Add `--strict` to `tailordb migration validate`: validation additionally fails when a migration not yet applied to the remote has data-loss warnings (e.g. a removed field or type) but neither a `migrate.ts` nor a recorded `--no-script` acknowledgment. The failure names the affected type and field and prints the exact command to record the acknowledgment, so CI can require destructive changes to be explicitly acknowledged before merge.
+  
+  To support this, `tailordb migration script <number> --no-script --reason "..."` now accepts warning-tier migrations (previously it was rejected unless the migration required a script), and `migration generate` offers to record the reason interactively when it detects warnings. Additionally, running `migration script <number>` when `migrate.ts` already exists now clears a stale `--no-script` acknowledgment from `diff.json` instead of failing, resolving the previously unclearable state after hand-adding a script.
+  
+  `diff.json` files written before data-loss warnings existed now have their warnings reconstructed from the recorded field/type removals when loaded, so `validate --strict` and `--no-script` acknowledgments treat them the same as newly generated migrations.
+
+- [#1993](https://github.com/tailor-platform/sdk/pull/1993) [`ecff3b2`](https://github.com/tailor-platform/sdk/commit/ecff3b2267f666de0ef83aef6b7727913e724a35) Thanks [@dqn](https://github.com/dqn)! - Add generated in-place TailorDB migrations for verified field type changes. Migration scripts normalize existing values while the previous field contract remains active, and the target type is applied in the post-migration phase. Generated scripts intentionally fail TypeScript checks until their normalization logic is reviewed.
+
+- [#1990](https://github.com/tailor-platform/sdk/pull/1990) [`36715da`](https://github.com/tailor-platform/sdk/commit/36715da7a125863c9dadd99cdcbb5fd45a51b4c9) Thanks [@dqn](https://github.com/dqn)! - Add a safe `tailordb migration rebaseline` workflow, let checked deployments adopt the new baseline, keep migration history IDs aligned across recovery commands, and reject unsupported migration file formats with upgrade guidance
+
+### Patch Changes
+
+- [#1960](https://github.com/tailor-platform/sdk/pull/1960) [`50743ad`](https://github.com/tailor-platform/sdk/commit/50743ad4cb38dc8f237934d3f9c905f2512ff6e4) Thanks [@toiroakr](https://github.com/toiroakr)! - Resolve the `tailor`, `tailor-seed`, and `tailor-tailordb-erd` executables through committed compile-cache launchers. The `tailor seed` command is now available as soon as the plugin is installed, and the seed and ERD plugin CLIs reuse Node's on-disk compile cache for faster warm starts.
+
+- [#1934](https://github.com/tailor-platform/sdk/pull/1934) [`2a3ec7b`](https://github.com/tailor-platform/sdk/commit/2a3ec7b108275410bf5b35d23784b07aa147c5ea) Thanks [@toiroakr](https://github.com/toiroakr)! - Drop the `chalk` dependency in favor of Node's built-in styling, and decide color support per output stream. Diagnostics on stderr now keep their colors when you redirect stdout (`tailor executor list > out.txt`), and stop writing escape codes into the file when you redirect stderr (`tailor deploy 2> log.txt`). `NO_COLOR`, `FORCE_COLOR` and non-TTY detection keep working as before.
+  
+  `@tailor-platform/sdk-codemod`, `@tailor-platform/sdk-plugin-seed` and `@tailor-platform/sdk-plugin-tailordb-erd` now declare the Node and Bun versions they need (`node >=22.15.0`, `bun >=1.2.0`), matching `@tailor-platform/sdk`. Installing them on an older runtime reports the mismatch instead of failing once the CLI runs.
+
+- [#1985](https://github.com/tailor-platform/sdk/pull/1985) [`ab23d97`](https://github.com/tailor-platform/sdk/commit/ab23d97e79eb2be6fb3f9d7ddd21515c1bf1c244) Thanks [@dqn](https://github.com/dqn)! - Copyable migration-script hint commands — from `migration generate`, `migration validate --strict`, and deploy's missing-script error — are now rendered by one shell-aware formatter. Values are quoted for the platform shell, and on Windows a value containing `%`, `$`, or `!` (which cmd.exe/PowerShell expand even inside double quotes) switches the hint to an argv rendering instead of a command line that would resolve to a different path. The deploy hint now also pads the migration number, binds `--config` with the `=` form, and omits it for the default config path.
+
+- [#1999](https://github.com/tailor-platform/sdk/pull/1999) [`4364357`](https://github.com/tailor-platform/sdk/commit/436435740510accbdb3aa627fe4439bd1656bb96) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update dependency globals to v17.9.0
+
+- [#1994](https://github.com/tailor-platform/sdk/pull/1994) [`7e804d4`](https://github.com/tailor-platform/sdk/commit/7e804d464e40a73fb524338cf7eda42e88f5ede8) Thanks [@dqn](https://github.com/dqn)! - Make `tailor tailordb migration validate` reject generated field type normalization scaffolds until their review marker is removed.
+
+- [#2008](https://github.com/tailor-platform/sdk/pull/2008) [`f2135ab`](https://github.com/tailor-platform/sdk/commit/f2135ab6dd3d130d88803b9829a26024de930ed3) Thanks [@toiroakr](https://github.com/toiroakr)! - Consistently call a TailorDB schema definition a "table" instead of a "type" across the docs, matching the `db.type()` → `db.table()` rename. Also fix three leftover `db.type(...)` code samples in `docs/services/tailordb.md` that should have read `db.table(...)`.
+  
+  Update the `v2/idp-publish-events-rename` codemod registry description to say "tables" instead of "types", matching the same wording fix.
+
+## 2.1.0
+
+### Minor Changes
+
+- [#1976](https://github.com/tailor-platform/sdk/pull/1976) [`aef43a7`](https://github.com/tailor-platform/sdk/commit/aef43a765d2ab26c2eee9bbbe5463e28c845f8dc) Thanks [@toiroakr](https://github.com/toiroakr)! - Add `defaultPermission` to resolver namespaces in `defineConfig`, applying an access requirement to every resolver in the namespace that declares no `permission` of its own — securing a namespace no longer means editing every resolver. It takes the same values as a resolver's `permission`, including `"allowAnonymous"` for a namespace that is public by design, and a resolver's own `permission` replaces it rather than merging with it. `generate` and `deploy` now warn when a namespace declares neither a `defaultPermission` nor a `permission` on each of its resolvers.
+
+### Patch Changes
+
+- [#1982](https://github.com/tailor-platform/sdk/pull/1982) [`287c551`](https://github.com/tailor-platform/sdk/commit/287c55173c75ae6533732fb1128a16e4366961e0) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update dependency get-tsconfig to v4.14.1
+
+- [#1995](https://github.com/tailor-platform/sdk/pull/1995) [`b6ed05d`](https://github.com/tailor-platform/sdk/commit/b6ed05db825886dba844664210f32855572e3f88) Thanks [@renovate](https://github.com/apps/renovate)! - chore(deps): update dependency tsx to v4.23.5
+
+- [#1976](https://github.com/tailor-platform/sdk/pull/1976) [`5d0f513`](https://github.com/tailor-platform/sdk/commit/5d0f5135fb1dc6dc9a467f48a7b5aa3d8ac57e5e) Thanks [@toiroakr](https://github.com/toiroakr)! - Fix a resolver `permission` denial returning `ReferenceError: TailorErrorMessage is not defined` to the caller instead of `access denied`. The generated guard now raises `TailorErrors`, which is the only error class the platform turns back into a message the caller can read.
+  
+  `TailorErrorMessage` no longer exists in the platform runtime, so its ambient global declaration and its Vitest mock are removed as well — together they let code that always failed in production pass both type checking and tests. Code that throws `TailorErrorMessage` now fails to compile; replace it with `TailorErrors`:
+  
+  ```ts
+  throw new TailorErrors([{ message: "not found", path: [] }]);
+  ```
+
+- [#1978](https://github.com/tailor-platform/sdk/pull/1978) [`49aa0d3`](https://github.com/tailor-platform/sdk/commit/49aa0d38fc60224d701d7663483f2137b280841f) Thanks [@toiroakr](https://github.com/toiroakr)! - `createTailorDBHook` now takes each field from the data's own properties. A type declaring a field named after a member of `Object` — `toString`, say — used to get that member as the field's value on every record that omitted the field, so validation rejected otherwise valid rows:
+  
+  ```
+  ✗ Found 1 error(s) in ./seed/data/Customer.jsonl
+     Expected a string: received function toString() { [native code] }
+  ```
+  
+  A field named `__proto__` is recorded as a data property rather than assigned, so its value is kept instead of being swallowed by the inherited setter.
+  
+  A field the data does not carry still lands as an `undefined` key, which is what keeps a column inferred from these records nullable.
+
+- [#1967](https://github.com/tailor-platform/sdk/pull/1967) [`47e4f2b`](https://github.com/tailor-platform/sdk/commit/47e4f2bc37a735de091f83f3c4d453a004daec62) Thanks [@toiroakr](https://github.com/toiroakr)! - Drop internal RPC vocabulary from the JSDoc on the `tailor.workflow` runtime API. The module doc and `execJobFunction`'s own doc described the wire-format history behind the current names, which reached editor tooltips without telling users anything they could act on. The behaviour the text was explaining is kept: `execJobFunction` blocks until the job finishes and returns its result, while `startWorkflow` returns only an execution ID.
+
 ## 2.0.1
 
 ### Patch Changes

package/{dist/cli/index.mjs → bin/tailor.mjs}

@@ -11,4 +11,4 @@ try {
   // politty is not resolvable from here (e.g. a fully bundled CLI) —
   // start without the compile cache rather than failing the CLI.
 }
-await import("./main.mjs");
+await import("../dist/cli/main.mjs");

package/dist/{application-CM6hKnSK.mjs → application-BpLeawBg.mjs}

@@ -1,10 +1,10 @@
 import { n as isSdkBranded } from "./brand-Eo4pLXPJ.mjs";
 import { t as assertDefined } from "./assert-DBxo8jPo.mjs";
-import { a as parseBoolean, n as logger, r as styles } from "./logger-CXQq9YIp.mjs";
-import { a as AuthConfigSchema, c as stripTailorDBTypeBuilderHelpers, d as applyRelationMetadataToFieldConfig, f as buildRelationInfo, g as functionSchema, h as loadFilesWithIgnores, l as TailorDBServiceConfigSchema, m as validateRelationConfig, n as loadExecutor, o as AuthInvokerSchema, p as processRelationMetadata, s as TailorFieldSchema, t as createExecutorService, u as TailorDBTypeSchema } from "./service-k1xy_A5G.mjs";
+import { a as parseBoolean, n as logger, r as styles } from "./logger-DSdExfor.mjs";
+import { a as AuthConfigSchema, c as stripTailorDBTypeBuilderHelpers, d as applyRelationMetadataToFieldConfig, f as buildRelationInfo, g as functionSchema, h as loadFilesWithIgnores, l as TailorDBServiceConfigSchema, m as validateRelationConfig, n as loadExecutor, o as AuthInvokerSchema, p as processRelationMetadata, s as TailorFieldSchema, t as createExecutorService, u as TailorDBTypeSchema } from "./service-goqlJJgA.mjs";
 import { t as multiline } from "./multiline-sfHpTZZK.mjs";
 import { t as userAgent } from "./user-agent-Bgsszb5I.mjs";
-import { t as createCLIError } from "./errors-D7583Zz7.mjs";
+import { t as createCLIError } from "./errors-CWj21238.mjs";
 import { n as isNodeBuiltinImport, t as getNodeBuiltinMessage } from "./node-builtins-CmaL2Cbq.mjs";
 import { t as isPluginGeneratedType } from "./type-source-DH_LH20p.mjs";
 import { createRequire } from "node:module";
@@ -182,7 +182,7 @@ function initOAuth2Client(config) {
 */
 async function initOperatorClient(accessToken, config) {
 	const platformConfig = config ?? getPlatformConfigForToken(accessToken);
-	const [{ createTracingInterceptor }, { OperatorService }] = await Promise.all([import("./interceptor-e33JtsC-.mjs"), import("./service_pb-i8CmnQP4.mjs")]);
+	const [{ createTracingInterceptor }, { OperatorService }] = await Promise.all([import("./interceptor-e33JtsC-.mjs"), import("./service_pb-BjlhvK9E.mjs")]);
 	const interceptors = [
 		await userAgentInterceptor(),
 		await bearerTokenInterceptor(accessToken),
@@ -263,7 +263,7 @@ function retryInterceptor() {
 						logger.debug(`retry: ${req.method.name} returned AlreadyExists on attempt ${i + 1}; treating as success (prior attempt likely committed)`);
 						return synthesizeEmptyUnaryResponse(req);
 					}
-					const { reportCrash } = await import("./crashreport-eI7ty7ok.mjs");
+					const { reportCrash } = await import("./crashreport-CINZ5dVN.mjs");
 					await reportCrash(error, "handledError");
 				}
 				if (req.method.name !== "CreateWorkspace" && isRetirable(error, req.method.idempotency)) {
@@ -3996,7 +3996,8 @@ function policyEntryExpr(policy) {
 /**
 * Build the permission guard statement injected at resolver entry.
 *
-* Rejects the call with `TailorErrorMessage` when the caller doesn't match
+* Rejects the call with `TailorErrors` — the only error class the platform
+* turns back into a message the caller can read — when the caller doesn't match
 * `permission`, evaluated against `context.caller` — the original caller,
 * unaffected by `authInvoker`. `permission` is deny-by-default: a caller is
 * granted only by a matching `permit: true` policy, and a matching
@@ -4025,7 +4026,8 @@ function buildResolverPermissionGuardExpr(permission) {
       const $reasons = ($matchedDeny.length > 0 ? $matchedDeny : $allowPolicies)
         .map((p) => p.description)
         .filter(Boolean);
-      throw new TailorErrorMessage($reasons.length > 0 ? "access denied: " + $reasons.join("; ") : "access denied");
+      const $message = $reasons.length > 0 ? "access denied: " + $reasons.join("; ") : "access denied";
+      throw new TailorErrors([{ message: $message, path: [] }]);
     }
   }`;
 }
@@ -4035,16 +4037,18 @@ function buildResolverPermissionGuardExpr(permission) {
 *
 * Kept as a single generator so a resolver-wrapping behavior (like the
 * permission guard) can't be added to one entry-point template and forgotten
-* in the other. References `context.caller`, `context.input`, `invoker`, and
-* `_internalResolver` — the caller's wrapper must bind a `context` object
+* in the other — the namespace-default precedence below is resolved here for
+* the same reason. References `context.caller`, `context.input`, `invoker`,
+* and `_internalResolver` — the caller's wrapper must bind a `context` object
 * with `user`/`input` properties and an `invoker` binding (from
 * `INVOKER_EXPR`) before inlining this expression.
-* @param permission - The resolver's `permission` config
+* @param params - The resolver's and its namespace's permission config
 * @returns A JS statement block to inline before calling `_internalResolver.body(...)`
 */
-function buildResolverPermissionAndInputCheckExpr(permission) {
+function buildResolverPermissionAndInputCheckExpr(params) {
+	const { permission, defaultPermission } = params;
 	return `
-    ${buildResolverPermissionGuardExpr(permission) ?? ""}
+    ${buildResolverPermissionGuardExpr(permission ?? defaultPermission) ?? ""}
     if (_internalResolver.input) {
       const result = t.object(_internalResolver.input).parse({
         value: context.input,
@@ -4544,17 +4548,11 @@ async function loadResolver(resolverFilePath) {
 * 1. Uses a transform plugin to add validation wrapper during bundling
 * 2. Creates an in-memory entry module
 * 3. Bundles in a single step with tree-shaking
-* @param namespace - Resolver namespace name
-* @param config - Resolver file loading configuration
-* @param baseDir - Directory the config's file patterns are resolved against
-* @param startContext - Start context for workflow/job transformations
-* @param cache - Optional bundle cache for skipping unchanged builds
-* @param inlineSourcemap - Whether to enable inline sourcemaps
-* @param bundleLogLevel - Controls which console calls are kept in bundled code
-* @param tsconfigCache - Optional tsconfig lookup cache shared across bundles in this CLI run
+* @param options - Bundle options
 * @returns Map of resolver name to bundled code
 */
-async function bundleResolvers(namespace, config, baseDir, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", tsconfigCache) {
+async function bundleResolvers(options) {
+	const { namespace, config, baseDir, defaultPermission, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", tsconfigCache } = options;
 	const bundledCode = /* @__PURE__ */ new Map();
 	const files = loadFilesWithIgnores(config, baseDir);
 	if (files.length === 0) {
@@ -4577,16 +4575,27 @@ async function bundleResolvers(namespace, config, baseDir, startContext, cache,
 		});
 	}
 	const tsconfig = await resolveTSConfigWithFallback(baseDir);
-	const results = await withBundleConcurrency(resolvers, (resolver) => bundleSingleResolver(namespace, resolver, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel, tsconfigCache));
+	const results = await withBundleConcurrency(resolvers, (resolver) => bundleSingleResolver({
+		namespace,
+		resolver,
+		tsconfig,
+		defaultPermission,
+		startContext,
+		cache,
+		inlineSourcemap,
+		bundleLogLevel,
+		tsconfigCache
+	}));
 	for (const [name, code] of results) bundledCode.set(name, code);
 	logger.log(`${styles.success("Bundled")} ${styles.info(`"${namespace}"`)}`);
 	return bundledCode;
 }
-async function bundleSingleResolver(namespace, resolver, tsconfig, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", tsconfigCache) {
+async function bundleSingleResolver(options) {
+	const { namespace, resolver, tsconfig, defaultPermission, startContext, cache, inlineSourcemap, bundleLogLevel = "DEBUG", tsconfigCache } = options;
 	const serializedStartContext = serializeStartContext(startContext);
 	const contextHash = computeBundlerContextHash({
 		sourceFile: resolver.sourceFile,
-		extraContext: serializedStartContext,
+		extraContext: JSON.stringify([serializedStartContext, defaultPermission ?? null]),
 		tsconfig,
 		inlineSourcemap,
 		bundleLogLevel
@@ -4606,7 +4615,10 @@ async function bundleSingleResolver(namespace, resolver, tsconfig, startContext,
 
         const $tailor_resolver_body = async (context) => {
           const invoker = ${INVOKER_EXPR};
-          ${buildResolverPermissionAndInputCheckExpr(resolver.permission)}
+          ${buildResolverPermissionAndInputCheckExpr({
+				permission: resolver.permission,
+				defaultPermission
+			})}
           return _internalResolver.body({ ...context, invoker });
         };
 
@@ -4642,6 +4654,53 @@ async function bundleSingleResolver(namespace, resolver, tsconfig, startContext,
 	return [resolver.name, code];
 }
 
+//#endregion
+//#region src/cli/services/resolver/default-permission.ts
+/**
+* Validate a resolver namespace's `defaultPermission` with the same schema as
+* a resolver's own `permission`, so an invalid policy fails the build instead
+* of compiling into a guard that lets everyone through.
+* @param params - The namespace name and its resolver service config
+* @returns The validated default, or `undefined` when the namespace declares none
+*/
+function parseResolverDefaultPermission(params) {
+	const { namespace, config } = params;
+	if (config.defaultPermission === void 0) return;
+	const result = ResolverPermissionSchema.safeParse(config.defaultPermission);
+	if (!result.success) throw new Error(`Invalid \`defaultPermission\` for resolver namespace "${namespace}": ` + result.error.issues.map((issue) => issue.message).join("; "));
+	return result.data;
+}
+/**
+* Find the `defaultPermission` of the resolver namespace a file belongs to.
+*
+* `function test-run` receives a single file rather than a namespace, so the
+* namespace is recovered by matching the file against each namespace's own
+* patterns — otherwise a test run would skip a guard the deployed resolver has.
+*
+* Nothing stops two namespaces' patterns from claiming the same file, and
+* `deploy` then bundles that resolver once per namespace, each with its own
+* default. Picking one here would make the test run agree with only one of
+* the deployed copies, so an ambiguous file is rejected instead.
+* @param params - The config's resolver section, the resolver file, and the config's own directory
+* @returns The owning namespace's validated default, or `undefined` when no namespace claims the file
+*/
+function resolveResolverDefaultPermissionForFile(params) {
+	const { config, filePath, baseDir } = params;
+	if (!config) return;
+	const targetFile = path.resolve(filePath);
+	const owners = [];
+	for (const [namespace, serviceConfig] of Object.entries(config)) {
+		if ("external" in serviceConfig) continue;
+		if (loadFilesWithIgnores(serviceConfig, baseDir).some((file) => path.resolve(file) === targetFile)) owners.push({
+			namespace,
+			config: serviceConfig
+		});
+	}
+	if (owners.length > 1) throw new Error(`Resolver ${path.relative(process.cwd(), targetFile)} matches more than one resolver namespace: ${owners.map((owner) => `"${owner.namespace}"`).join(", ")}. Each namespace applies its own \`defaultPermission\`, so narrow the \`files\`/\`ignores\` patterns until exactly one namespace claims this file.`);
+	const [owner] = owners;
+	return owner ? parseResolverDefaultPermission(owner) : void 0;
+}
+
 //#endregion
 //#region src/cli/services/resolver/service.ts
 /**
@@ -4653,6 +4712,10 @@ async function bundleSingleResolver(namespace, resolver, tsconfig, startContext,
 */
 function createResolverService(namespace, config, baseDir) {
 	const resolvers = {};
+	const defaultPermission = parseResolverDefaultPermission({
+		namespace,
+		config
+	});
 	const loadResolverForFile = async (resolverFile) => {
 		try {
 			const resolverModule = await import(pathToFileURL(resolverFile).href);
@@ -4674,6 +4737,7 @@ function createResolverService(namespace, config, baseDir) {
 	return {
 		namespace,
 		config,
+		defaultPermission,
 		get resolvers() {
 			return resolvers;
 		},
@@ -4684,10 +4748,34 @@ function createResolverService(namespace, config, baseDir) {
 			logger.log(`Found ${styles.highlight(resolverFiles.length.toString())} resolver files for service ${styles.highlight(`"${namespace}"`)}`);
 			await Promise.all(resolverFiles.map((resolverFile) => loadResolverForFile(resolverFile)));
 			assertUniqueResolverNames(resolvers, namespace);
+			warnUndeclaredPermissions({
+				namespace,
+				defaultPermission,
+				resolvers
+			});
 		}
 	};
 }
 /**
+* Warn about resolvers that declare no access requirement at all.
+*
+* A namespace-level `defaultPermission` covers every resolver in the
+* namespace, so the warning only fires when the namespace declares none and
+* at least one of its resolvers declares none either — those resolvers are
+* reachable by anonymous callers.
+* @param params - The namespace, its default permission, and its loaded resolvers
+*/
+function warnUndeclaredPermissions(params) {
+	const { namespace, defaultPermission, resolvers } = params;
+	if (defaultPermission !== void 0) return;
+	const loaded = Object.values(resolvers);
+	const undeclared = loaded.filter((resolver) => resolver.permission === void 0);
+	if (undeclared.length === 0) return;
+	logger.warn(`Resolver namespace ${styles.highlight(`"${namespace}"`)}: ${undeclared.length} of ${loaded.length} resolvers declare no \`permission\`, so anonymous callers can reach them. Set \`defaultPermission\` on the namespace, or declare \`permission\` on each resolver ("allowAnonymous" if public access is intended).`);
+	const names = undeclared.map((resolver) => resolver.name).toSorted();
+	logger.debug(`  Resolvers without \`permission\`: ${names.join(", ")}`);
+}
+/**
 * Assert that every loaded resolver in a namespace has a unique name.
 * Resolvers are stored by source file, so two files declaring the same
 * `name` would otherwise silently share a single bundle cache entry.
@@ -5751,7 +5839,17 @@ async function loadApplication(params) {
 		authHooks: /* @__PURE__ */ new Map()
 	};
 	for (const pipeline of resolverResult.resolverServices) {
-		const resolverBundles = await bundleResolvers(pipeline.namespace, pipeline.config, baseDir, startContext, bundleCache, inlineSourcemap, bundleLogLevel, tsconfigCache);
+		const resolverBundles = await bundleResolvers({
+			namespace: pipeline.namespace,
+			config: pipeline.config,
+			baseDir,
+			defaultPermission: pipeline.defaultPermission,
+			startContext,
+			cache: bundleCache,
+			inlineSourcemap,
+			bundleLogLevel,
+			tsconfigCache
+		});
 		for (const [name, code] of resolverBundles) bundledScripts.resolvers.set(resolverBundleKey(pipeline.namespace, name), code);
 	}
 	if (executorService) bundledScripts.executors = await bundleExecutors({
@@ -5823,5 +5921,5 @@ async function loadApplication(params) {
 }
 
 //#endregion
-export { LOG_LEVELS as $, hashContent as A, getConsoleBaseUrl as B, createLogLevelTreeshakeOptions as C, hasGenerationHooks as D, getPluginGenerationDependencies as E, fetchAllTolerant as F, initOperatorClient as G, getOrNull as H, fetchMachineUserToken as I, normalizeBaseUrl as J, isDefaultPlatform as K, fetchPaged as L, closeConnectionPool as M, defaultPlatformBaseUrl as N, createBundleCache as O, fetchAll as P, createApplyLimiter as Q, fetchPlatformMachineUserToken as R, composeFunctionTreeshakeOptions as S, createBundleLog as T, getPlatformBaseUrl as U, getOAuth2ClientId as V, initOAuth2Client as W, resolveStaticWebsiteUrls as X, rememberPlatformConfigForToken as Y, byName as Z, stringifyFunction as _, resolveInlineSourcemap as a, resolveTSConfigWithFallback as b, WorkflowJobSchema as c, INVOKER_EXPR as d, buildExecutorArgsExpr as f, assertUniqueTailorDBTypeNamesWithExternal as g, assertUniqueLocalTailorDBTypeNames as h, resolverBundleKey as i, hashFile as j, getDistDir as k, ResolverSchema as l, buildResolverPermissionAndInputCheckExpr as m, generatePluginFilesIfNeeded as n, getApplicationAuthNamespace as o, buildResolverOperationHookExpr as p, isNotFoundError as q, loadApplication as r, WorkflowJobFunctionExecutionPolicySchema as s, defineApplication as t, HTTP_METHODS as u, createGeneratedEntryResolverPlugin as v, resolveBundleLogLevel as w, platformBundleDefinePlugin as x, createTsconfigPathsPlugin as y, fetchUserInfo as z };
-//# sourceMappingURL=application-CM6hKnSK.mjs.map
+export { createApplyLimiter as $, getDistDir as A, fetchUserInfo as B, composeFunctionTreeshakeOptions as C, getPluginGenerationDependencies as D, createBundleLog as E, fetchAll as F, initOAuth2Client as G, getOAuth2ClientId as H, fetchAllTolerant as I, isNotFoundError as J, initOperatorClient as K, fetchMachineUserToken as L, hashFile as M, closeConnectionPool as N, hasGenerationHooks as O, defaultPlatformBaseUrl as P, byName as Q, fetchPaged as R, platformBundleDefinePlugin as S, resolveBundleLogLevel as T, getOrNull as U, getConsoleBaseUrl as V, getPlatformBaseUrl as W, rememberPlatformConfigForToken as X, normalizeBaseUrl as Y, resolveStaticWebsiteUrls as Z, assertUniqueTailorDBTypeNamesWithExternal as _, resolveInlineSourcemap as a, createTsconfigPathsPlugin as b, WorkflowJobSchema as c, HTTP_METHODS as d, LOG_LEVELS as et, INVOKER_EXPR as f, assertUniqueLocalTailorDBTypeNames as g, buildResolverPermissionAndInputCheckExpr as h, resolverBundleKey as i, hashContent as j, createBundleCache as k, resolveResolverDefaultPermissionForFile as l, buildResolverOperationHookExpr as m, generatePluginFilesIfNeeded as n, getApplicationAuthNamespace as o, buildExecutorArgsExpr as p, isDefaultPlatform as q, loadApplication as r, WorkflowJobFunctionExecutionPolicySchema as s, defineApplication as t, ResolverSchema as u, stringifyFunction as v, createLogLevelTreeshakeOptions as w, resolveTSConfigWithFallback as x, createGeneratedEntryResolverPlugin as y, fetchPlatformMachineUserToken as z };
+//# sourceMappingURL=application-BpLeawBg.mjs.map