@tailor-platform/sdk 2.1.0 → 2.3.0

package/dist/cli/ts-hook.mjs

@@ -80,8 +80,11 @@ function collectPathsInto(out, configFilePath, content, visited) {
   }
 }
 
-function loadTsconfigPaths(startDir) {
-  if (tsconfigPathsCache.has(startDir)) return tsconfigPathsCache.get(startDir);
+// cacheGeneration partitions the cache per import-nonce run, so a tsconfig
+// edited between two in-process runs is re-read instead of served stale.
+function loadTsconfigPaths(startDir, cacheGeneration) {
+  const cacheKey = `${cacheGeneration}\u0000${startDir}`;
+  if (tsconfigPathsCache.has(cacheKey)) return tsconfigPathsCache.get(cacheKey);
 
   const paths = Object.create(null);
   let dir = startDir;
@@ -100,7 +103,7 @@ function loadTsconfigPaths(startDir) {
     dir = dirname(dir);
   }
 
-  tsconfigPathsCache.set(startDir, paths);
+  tsconfigPathsCache.set(cacheKey, paths);
   return paths;
 }
 
@@ -163,9 +166,44 @@ function tryResolveWithExtensionsSync(base, context, nextResolve) {
   return null;
 }
 
+// --- import-nonce propagation ---
+
+const IMPORT_NONCE_PARAM = "tailorImportNonce";
+
+// Carries a parent's cache-busting nonce onto project-local resolutions, so a
+// nonce'd entry module gets a fresh evaluation of its whole project subgraph.
+// Bare specifiers are left alone: node_modules packages (and workspace-linked
+// ones resolving outside node_modules) must stay singletons.
+function propagateImportNonce(resolved, context) {
+  if (!resolved?.url?.startsWith("file:")) return resolved;
+  if (!context.parentURL?.startsWith("file:")) return resolved;
+  const nonce = new URL(context.parentURL).searchParams.get(IMPORT_NONCE_PARAM);
+  if (!nonce) return resolved;
+  const url = new URL(resolved.url);
+  if (url.searchParams.has(IMPORT_NONCE_PARAM) || url.pathname.includes("/node_modules/")) {
+    return resolved;
+  }
+  url.searchParams.set(IMPORT_NONCE_PARAM, nonce);
+  return { ...resolved, url: url.href };
+}
+
+function isProjectLocalSpecifier(specifier) {
+  return (
+    specifier.startsWith(".") ||
+    specifier.startsWith("/") ||
+    specifier.startsWith("file:") ||
+    specifier.startsWith("#")
+  );
+}
+
 // --- module hooks ---
 
 export async function resolve(specifier, context, nextResolve) {
+  const resolved = await resolveTs(specifier, context, nextResolve);
+  return isProjectLocalSpecifier(specifier) ? propagateImportNonce(resolved, context) : resolved;
+}
+
+async function resolveTs(specifier, context, nextResolve) {
   try {
     return await nextResolve(specifier, context);
   } catch (err) {
@@ -189,15 +227,16 @@ export async function resolve(specifier, context, nextResolve) {
       // Non-relative: try tsconfig path aliases
       if (context.parentURL?.startsWith("file://")) {
         const parentParsed = new URL(context.parentURL);
+        const parentNonce = parentParsed.searchParams.get(IMPORT_NONCE_PARAM) ?? "";
         parentParsed.search = "";
         parentParsed.hash = "";
         const parentDir = dirname(fileURLToPath(parentParsed));
-        const tsconfigPaths = loadTsconfigPaths(parentDir);
+        const tsconfigPaths = loadTsconfigPaths(parentDir, parentNonce);
         const candidates = matchTsconfigPaths(specifier, tsconfigPaths);
         if (candidates) {
           for (const candidate of candidates) {
             const result = await tryResolveWithExtensions(candidate, context, nextResolve);
-            if (result) return result;
+            if (result) return propagateImportNonce(result, context);
           }
         }
       }
@@ -250,6 +289,11 @@ export async function load(url, context, nextLoad) {
 
 // Sync hooks for module.registerHooks() (Node >= 22.15.0).
 export function resolveSync(specifier, context, nextResolve) {
+  const resolved = resolveTsSync(specifier, context, nextResolve);
+  return isProjectLocalSpecifier(specifier) ? propagateImportNonce(resolved, context) : resolved;
+}
+
+function resolveTsSync(specifier, context, nextResolve) {
   try {
     return nextResolve(specifier, context);
   } catch (err) {
@@ -273,15 +317,16 @@ export function resolveSync(specifier, context, nextResolve) {
       // Non-relative: try tsconfig path aliases
       if (context.parentURL?.startsWith("file://")) {
         const parentParsed = new URL(context.parentURL);
+        const parentNonce = parentParsed.searchParams.get(IMPORT_NONCE_PARAM) ?? "";
         parentParsed.search = "";
         parentParsed.hash = "";
         const parentDir = dirname(fileURLToPath(parentParsed));
-        const tsconfigPaths = loadTsconfigPaths(parentDir);
+        const tsconfigPaths = loadTsconfigPaths(parentDir, parentNonce);
         const candidates = matchTsconfigPaths(specifier, tsconfigPaths);
         if (candidates) {
           for (const candidate of candidates) {
             const result = tryResolveWithExtensionsSync(candidate, context, nextResolve);
-            if (result) return result;
+            if (result) return propagateImportNonce(result, context);
           }
         }
       }

package/dist/completion/zsh-worker.zsh

@@ -1,5 +1,5 @@
 # politty-completion-version: 1
-# politty-bin-sig: 1785985067
+# politty-bin-sig: 1786713018
 # politty-bin-path: /home/runner/work/sdk/sdk/node_modules/.bin/tailor
 # program: tailor
 # shell: zsh
@@ -739,6 +739,13 @@ __tailor_worker_opt_takes_value() {
         tailordb:truncate:--namespace|tailordb:truncate:-n|tailordb:truncate:--n) return 0 ;;
         tailordb:migration:generate:--config|tailordb:migration:generate:-c|tailordb:migration:generate:--c) return 0 ;;
         tailordb:migration:generate:--name|tailordb:migration:generate:-n|tailordb:migration:generate:--n) return 0 ;;
+        tailordb:migration:generate:--rename) return 0 ;;
+        tailordb:migration:generate:--drop) return 0 ;;
+        tailordb:migration:generate:--expand-contract|tailordb:migration:generate:--expandContract) return 0 ;;
+        tailordb:migration:rebaseline:--workspace-id|tailordb:migration:rebaseline:--workspaceId|tailordb:migration:rebaseline:-w|tailordb:migration:rebaseline:--w) return 0 ;;
+        tailordb:migration:rebaseline:--profile|tailordb:migration:rebaseline:-p|tailordb:migration:rebaseline:--p) return 0 ;;
+        tailordb:migration:rebaseline:--config|tailordb:migration:rebaseline:-c|tailordb:migration:rebaseline:--c) return 0 ;;
+        tailordb:migration:rebaseline:--namespace|tailordb:migration:rebaseline:-n|tailordb:migration:rebaseline:--n) return 0 ;;
         tailordb:migration:script:--config|tailordb:migration:script:-c|tailordb:migration:script:--c) return 0 ;;
         tailordb:migration:script:--namespace|tailordb:migration:script:-n|tailordb:migration:script:--n) return 0 ;;
         tailordb:migration:script:--reason) return 0 ;;
@@ -754,6 +761,14 @@ __tailor_worker_opt_takes_value() {
         tailordb:migration:sync:--profile|tailordb:migration:sync:-p|tailordb:migration:sync:--p) return 0 ;;
         tailordb:migration:sync:--config|tailordb:migration:sync:-c|tailordb:migration:sync:--c) return 0 ;;
         tailordb:migration:sync:--namespace|tailordb:migration:sync:-n|tailordb:migration:sync:--n) return 0 ;;
+        tailordb:migration:test:--workspace-id|tailordb:migration:test:--workspaceId|tailordb:migration:test:-w|tailordb:migration:test:--w) return 0 ;;
+        tailordb:migration:test:--profile|tailordb:migration:test:-p|tailordb:migration:test:--p) return 0 ;;
+        tailordb:migration:test:--config|tailordb:migration:test:-c|tailordb:migration:test:--c) return 0 ;;
+        tailordb:migration:test:--data) return 0 ;;
+        tailordb:migration:test:--target-workspace-id|tailordb:migration:test:--targetWorkspaceId) return 0 ;;
+        tailordb:migration:test:--assert) return 0 ;;
+        tailordb:migration:test:--assert-namespace|tailordb:migration:test:--assertNamespace) return 0 ;;
+        tailordb:migration:test:--machine-user|tailordb:migration:test:--machineUser) return 0 ;;
         tailordb:migration:validate:--workspace-id|tailordb:migration:validate:--workspaceId|tailordb:migration:validate:-w|tailordb:migration:validate:--w) return 0 ;;
         tailordb:migration:validate:--profile|tailordb:migration:validate:-p|tailordb:migration:validate:--p) return 0 ;;
         tailordb:migration:validate:--config|tailordb:migration:validate:-c|tailordb:migration:validate:--c) return 0 ;;
@@ -933,6 +948,7 @@ __tailor_worker_is_subcmd() {
         setup:preview) return 0 ;;
         setup:action) return 0 ;;
         setup:coordinate) return 0 ;;
+        setup:renovate) return 0 ;;
         setup:check) return 0 ;;
         setup:delete) return 0 ;;
         :setup) return 0 ;;
@@ -946,10 +962,12 @@ __tailor_worker_is_subcmd() {
         :staticwebsite) return 0 ;;
         tailordb:truncate) return 0 ;;
         tailordb:migration:generate) return 0 ;;
+        tailordb:migration:rebaseline) return 0 ;;
         tailordb:migration:script) return 0 ;;
         tailordb:migration:set) return 0 ;;
         tailordb:migration:status) return 0 ;;
         tailordb:migration:sync) return 0 ;;
+        tailordb:migration:test) return 0 ;;
         tailordb:migration:validate) return 0 ;;
         tailordb:migration) return 0 ;;
         :tailordb) return 0 ;;
@@ -2691,6 +2709,18 @@ __tailor_worker_complete_setup_coordinate() {
     fi
 }
 
+__tailor_worker_complete_setup_renovate() {
+    local -a _vals=()
+    if __tailor_worker_opt_takes_value "setup:renovate" "${words[CURRENT-1]}"; then return 0; fi
+    if (( _after_dd )); then return 0; fi
+    if [[ "${words[CURRENT]}" == -* ]]; then
+        local -a _opts=()
+        __tailor_worker_not_used "--help" && _opts+=("--help:Show help")
+        __tailor_worker_cdescribe 'options' _opts
+        return 0
+    fi
+}
+
 __tailor_worker_complete_setup_check() {
     local -a _vals=()
     if __tailor_worker_opt_takes_value "setup:check" "${words[CURRENT-1]}"; then return 0; fi
@@ -2737,7 +2767,7 @@ __tailor_worker_complete_setup() {
         __tailor_worker_cdescribe 'options' _opts
         return 0
     fi
-    local -a _subs=("branch:Generate a branch-target deploy workflow (push to branch triggers deploy)." "tag:Generate a tag-target deploy workflow (tag push triggers deploy)." "preview:Generate a preview workflow (PR open/sync triggers deploy to a per-PR workspace)." "action:Generate a per-app composite action for use with setup coordinate (monorepo multi-app deploys)." "coordinate:Generate a coordinator workflow that orchestrates multiple --action-generated composite actions." "check:Audit generated workflows for drift against the current config/repo (read-only)." "delete:Delete managed workflow/action file(s) and their .github/tailor.lock entries.")
+    local -a _subs=("branch:Generate a branch-target deploy workflow (push to branch triggers deploy)." "tag:Generate a tag-target deploy workflow (tag push triggers deploy)." "preview:Generate a preview workflow (PR open/sync triggers deploy to a per-PR workspace)." "action:Generate a per-app composite action for use with setup coordinate (monorepo multi-app deploys)." "coordinate:Generate a coordinator workflow that orchestrates multiple --action-generated composite actions." "renovate:Generate a Renovate config for Tailor dependency and workflow updates." "check:Audit generated workflows for drift against the current config/repo (read-only)." "delete:Delete managed workflow/action file(s) and their .github/tailor.lock entries.")
     __tailor_worker_cdescribe 'subcommands' _subs
 }
 
@@ -3021,6 +3051,54 @@ __tailor_worker_complete_tailordb_migration_generate() {
         __tailor_worker_not_used "--config" "-c" "--c" && _opts+=("--config:Path to Tailor config file")
         __tailor_worker_not_used "--name" "-n" "--n" && _opts+=("--name:Optional description for the migration")
         __tailor_worker_not_used "--init" && _opts+=("--init:Delete existing migrations and start fresh")
+        _opts+=("--rename:Record a field or type rename instead of remove + add (format\: \"Type.oldField\:newField\" or \"OldType\:NewType\"; repeatable). Renames require a migration script that copies the data.")
+        _opts+=("--drop:Confirm that a removed field or type is a genuine removal, not a rename (format\: \"Type.field\" or \"Type\"; repeatable). Required in non-interactive runs for a removal with rename candidates.")
+        _opts+=("--expand-contract:Convert a field type through a temporary field (format\: \"Type.field\"; repeatable). Generates two migrations.")
+        __tailor_worker_not_used "--help" && _opts+=("--help:Show help")
+        __tailor_worker_cdescribe 'options' _opts
+        return 0
+    fi
+}
+
+__tailor_worker_complete_tailordb_migration_rebaseline() {
+    local -a _vals=()
+    case "${words[CURRENT-1]}" in
+            --config|-c|--c)
+                setopt local_options null_glob
+                local _cur="${words[CURRENT]:-}" _dir _prefix _f _out
+                local -a _exts=("ts")
+                if [[ -z "$_cur" || "$_cur" != */* ]]; then
+                    _dir="."
+                    _prefix="$_cur"
+                elif [[ "$_cur" == */ ]]; then
+                    _dir="${_cur%/}"
+                    _prefix=""
+                else
+                    _dir="${_cur%/*}"
+                    _prefix="${_cur##*/}"
+                fi
+                for _f in "$_dir"/"$_prefix"*(N/); do
+                    _out="${_f#./}"
+                    __tailor_worker_add_path_candidate "$_out"
+                done
+                local _ext
+                for _f in "$_dir"/"$_prefix"*(N.); do
+                    _out="${_f#./}"
+                    for _ext in "${_exts[@]}"; do
+                        [[ -n "$_ext" && "$_out" == *."$_ext" ]] && { __tailor_worker_add_path_candidate "$_out"; break; }
+                    done
+                done
+                return 0 ;;
+    esac
+    if __tailor_worker_opt_takes_value "tailordb:migration:rebaseline" "${words[CURRENT-1]}"; then return 0; fi
+    if (( _after_dd )); then return 0; fi
+    if [[ "${words[CURRENT]}" == -* ]]; then
+        local -a _opts=()
+        __tailor_worker_not_used "--workspace-id" "--workspaceId" "-w" "--w" && _opts+=("--workspace-id:Workspace ID")
+        __tailor_worker_not_used "--profile" "-p" "--p" && _opts+=("--profile:Workspace profile")
+        __tailor_worker_not_used "--config" "-c" "--c" && _opts+=("--config:Path to Tailor config file")
+        __tailor_worker_not_used "--yes" "-y" "--y" && _opts+=("--yes:Skip confirmation prompts")
+        __tailor_worker_not_used "--namespace" "-n" "--n" && _opts+=("--namespace:Target TailorDB namespace (required if multiple namespaces exist)")
         __tailor_worker_not_used "--help" && _opts+=("--help:Show help")
         __tailor_worker_cdescribe 'options' _opts
         return 0
@@ -3071,6 +3149,7 @@ __tailor_worker_complete_tailordb_migration_script() {
         __tailor_worker_not_used "--namespace" "-n" "--n" && _opts+=("--namespace:Target TailorDB namespace (required if multiple namespaces exist)")
         __tailor_worker_not_used "--no-script" "--noScript" && _opts+=("--no-script:Record that this migration intentionally runs without a migration script (requires --reason)")
         __tailor_worker_not_used "--reason" && _opts+=("--reason:Reason why no migration script is needed (used with --no-script)")
+        __tailor_worker_not_used "--with-test" "--withTest" && _opts+=("--with-test:Also add a migrate.test.ts unit-test scaffold; when migrate.ts already exists, only the test is added")
         __tailor_worker_not_used "--help" && _opts+=("--help:Show help")
         __tailor_worker_cdescribe 'options' _opts
         return 0
@@ -3235,6 +3314,86 @@ __tailor_worker_complete_tailordb_migration_sync() {
     esac
 }
 
+__tailor_worker_complete_tailordb_migration_test() {
+    local -a _vals=()
+    case "${words[CURRENT-1]}" in
+            --config|-c|--c)
+                setopt local_options null_glob
+                local _cur="${words[CURRENT]:-}" _dir _prefix _f _out
+                local -a _exts=("ts")
+                if [[ -z "$_cur" || "$_cur" != */* ]]; then
+                    _dir="."
+                    _prefix="$_cur"
+                elif [[ "$_cur" == */ ]]; then
+                    _dir="${_cur%/}"
+                    _prefix=""
+                else
+                    _dir="${_cur%/*}"
+                    _prefix="${_cur##*/}"
+                fi
+                for _f in "$_dir"/"$_prefix"*(N/); do
+                    _out="${_f#./}"
+                    __tailor_worker_add_path_candidate "$_out"
+                done
+                local _ext
+                for _f in "$_dir"/"$_prefix"*(N.); do
+                    _out="${_f#./}"
+                    for _ext in "${_exts[@]}"; do
+                        [[ -n "$_ext" && "$_out" == *."$_ext" ]] && { __tailor_worker_add_path_candidate "$_out"; break; }
+                    done
+                done
+                return 0 ;;
+            --data)
+                _vals=("seed" "clone")
+                __tailor_worker_cdescribe 'completions' _vals
+                return 0 ;;
+            --assert)
+                setopt local_options null_glob
+                local _cur="${words[CURRENT]:-}" _dir _prefix _f _out
+                local -a _exts=("ts")
+                if [[ -z "$_cur" || "$_cur" != */* ]]; then
+                    _dir="."
+                    _prefix="$_cur"
+                elif [[ "$_cur" == */ ]]; then
+                    _dir="${_cur%/}"
+                    _prefix=""
+                else
+                    _dir="${_cur%/*}"
+                    _prefix="${_cur##*/}"
+                fi
+                for _f in "$_dir"/"$_prefix"*(N/); do
+                    _out="${_f#./}"
+                    __tailor_worker_add_path_candidate "$_out"
+                done
+                local _ext
+                for _f in "$_dir"/"$_prefix"*(N.); do
+                    _out="${_f#./}"
+                    for _ext in "${_exts[@]}"; do
+                        [[ -n "$_ext" && "$_out" == *."$_ext" ]] && { __tailor_worker_add_path_candidate "$_out"; break; }
+                    done
+                done
+                return 0 ;;
+    esac
+    if __tailor_worker_opt_takes_value "tailordb:migration:test" "${words[CURRENT-1]}"; then return 0; fi
+    if (( _after_dd )); then return 0; fi
+    if [[ "${words[CURRENT]}" == -* ]]; then
+        local -a _opts=()
+        __tailor_worker_not_used "--workspace-id" "--workspaceId" "-w" "--w" && _opts+=("--workspace-id:Workspace ID")
+        __tailor_worker_not_used "--profile" "-p" "--p" && _opts+=("--profile:Workspace profile")
+        __tailor_worker_not_used "--config" "-c" "--c" && _opts+=("--config:Path to Tailor config file")
+        __tailor_worker_not_used "--yes" "-y" "--y" && _opts+=("--yes:Acknowledge that a designated target workspace may be overwritten")
+        __tailor_worker_not_used "--data" && _opts+=("--data:Data source for the migration test (seed or clone)")
+        __tailor_worker_not_used "--target-workspace-id" "--targetWorkspaceId" && _opts+=("--target-workspace-id:Existing throwaway workspace to retain after the test (requires --yes)")
+        __tailor_worker_not_used "--keep" && _opts+=("--keep:Keep the automatically created workspace after the test")
+        __tailor_worker_not_used "--assert" && _opts+=("--assert:Path to a TypeScript assertion script to run after migrations")
+        __tailor_worker_not_used "--assert-namespace" "--assertNamespace" && _opts+=("--assert-namespace:TailorDB namespace exposed to the assertion script")
+        __tailor_worker_not_used "--machine-user" "--machineUser" && _opts+=("--machine-user:Machine user for seed and assertion script execution")
+        __tailor_worker_not_used "--help" && _opts+=("--help:Show help")
+        __tailor_worker_cdescribe 'options' _opts
+        return 0
+    fi
+}
+
 __tailor_worker_complete_tailordb_migration_validate() {
     local -a _vals=()
     case "${words[CURRENT-1]}" in
@@ -3273,6 +3432,7 @@ __tailor_worker_complete_tailordb_migration_validate() {
         __tailor_worker_not_used "--profile" "-p" "--p" && _opts+=("--profile:Workspace profile")
         __tailor_worker_not_used "--config" "-c" "--c" && _opts+=("--config:Path to Tailor config file")
         __tailor_worker_not_used "--namespace" "-n" "--n" && _opts+=("--namespace:Target TailorDB namespace (validates all namespaces if not specified)")
+        __tailor_worker_not_used "--strict" && _opts+=("--strict:Also fail when a pending migration can drop data without an acknowledgment")
         __tailor_worker_not_used "--help" && _opts+=("--help:Show help")
         __tailor_worker_cdescribe 'options' _opts
         return 0
@@ -3289,7 +3449,7 @@ __tailor_worker_complete_tailordb_migration() {
         __tailor_worker_cdescribe 'options' _opts
         return 0
     fi
-    local -a _subs=("generate:Generate migration files by detecting schema differences between current local types and the previous migration snapshot." "script:Add a migration script (migrate.ts) template to an existing migration directory, or record with --no-script that a migration intentionally has none." "set:Set migration checkpoint to a specific number." "status:Show the current migration status for TailorDB namespaces, including applied and pending migrations." "sync:Sync remote TailorDB schema to a specific migration snapshot (recovery from --no-schema-check drift)." "validate:Validate the full migration history and detect schema drift (local types vs. migration snapshot, remote schema vs. migration checkpoint) without deploying. This includes the migration and schema-drift checks used by 'deploy' and exits with a non-zero code when issues are found.")
+    local -a _subs=("generate:Generate migration files by detecting schema differences between current local types and the previous migration snapshot." "rebaseline:Collapse the full migration history into a new 0000 baseline." "script:Add a migration script (migrate.ts) template to an existing migration directory, or record with --no-script that a migration intentionally has none." "set:Set migration checkpoint to a specific number." "status:Show the current migration status for TailorDB namespaces, including applied and pending migrations." "sync:Sync remote TailorDB schema to a specific migration snapshot (recovery from --no-schema-check drift)." "test:Test pending migrations with seed fixtures or cloned data in a temporary workspace." "validate:Validate the full migration history, unreviewed generated migration scripts, and schema drift (local types vs. migration snapshot, remote schema vs. migration checkpoint) without deploying. This includes the migration and schema-drift checks used by 'deploy' and exits with a non-zero code when issues are found.")
     __tailor_worker_cdescribe 'subcommands' _subs
 }
 
@@ -4100,7 +4260,7 @@ __tailor_worker_complete_root() {
         __tailor_worker_not_used "--help" && _opts+=("--help:Show help")
         __tailor_worker_cdescribe 'options' _opts
     else
-        local -a _subs=("api:Call Tailor Platform API endpoints directly." "auth:Authentication helpers for scripts and plugins." "authconnection:Manage auth connections." "crashreport:Manage crash reports." "deploy:Deploy your application by applying the Tailor configuration." "executor:Manage executors" "function:Manage functions" "generate:Generate files using Tailor configuration." "init:Initialize a new project using create-sdk." "login:Login to Tailor Platform." "logout:Logout from Tailor Platform." "machineuser:Manage machine users in your Tailor Platform application." "oauth2client:Manage OAuth2 clients in your Tailor Platform application." "open:Open Tailor Platform Console." "organization:Manage Tailor Platform organizations." "plugin:Manage and inspect CLI plugins (beta)." "profile:Manage workspace profiles (user + workspace combinations)." "query:Run SQL/GraphQL query." "remove:Remove all resources managed by the application from the workspace." "secret:Manage Secret Manager vaults and secrets." "setup:Generate CI deploy workflows for your project. (beta)" "show:Show information about the deployed application." "staticwebsite:Manage static websites in your workspace." "tailordb:Manage TailorDB tables and data." "upgrade:Run codemods to upgrade your project to a newer SDK version." "user:Manage Tailor Platform users." "workflow:Manage workflows and workflow executions." "workspace:Manage Tailor Platform workspaces." "skills:Manage Tailor SDK agent skills." "completion:Generate shell completion script")
+        local -a _subs=("api:Call Tailor Platform API endpoints directly." "auth:Authentication helpers for scripts and plugins." "authconnection:Manage auth connections." "crashreport:Manage crash reports." "deploy:Deploy your application by applying the Tailor configuration." "executor:Manage executors" "function:Manage functions" "generate:Generate files using Tailor configuration." "init:Initialize a new project using create-sdk." "login:Login to Tailor Platform." "logout:Logout from Tailor Platform." "machineuser:Manage machine users in your Tailor Platform application." "oauth2client:Manage OAuth2 clients in your Tailor Platform application." "open:Open Tailor Platform Console." "organization:Manage Tailor Platform organizations." "plugin:Manage and inspect CLI plugins (beta)." "profile:Manage workspace profiles (user + workspace combinations)." "query:Run SQL/GraphQL query." "remove:Remove all resources managed by the application from the workspace." "secret:Manage Secret Manager vaults and secrets." "setup:Set up repository automation for your project. (beta)" "show:Show information about the deployed application." "staticwebsite:Manage static websites in your workspace." "tailordb:Manage TailorDB tables and data." "upgrade:Run codemods to upgrade your project to a newer SDK version." "user:Manage Tailor Platform users." "workflow:Manage workflows and workflow executions." "workspace:Manage Tailor Platform workspaces." "skills:Manage Tailor SDK agent skills." "completion:Generate shell completion script")
         __tailor_worker_cdescribe 'subcommands' _subs
     fi
 }
@@ -4219,6 +4379,7 @@ _tailor_worker_completions() {
         setup:preview) __tailor_worker_complete_setup_preview ;;
         setup:action) __tailor_worker_complete_setup_action ;;
         setup:coordinate) __tailor_worker_complete_setup_coordinate ;;
+        setup:renovate) __tailor_worker_complete_setup_renovate ;;
         setup:check) __tailor_worker_complete_setup_check ;;
         setup:delete) __tailor_worker_complete_setup_delete ;;
         setup) __tailor_worker_complete_setup ;;
@@ -4232,10 +4393,12 @@ _tailor_worker_completions() {
         staticwebsite) __tailor_worker_complete_staticwebsite ;;
         tailordb:truncate) __tailor_worker_complete_tailordb_truncate ;;
         tailordb:migration:generate) __tailor_worker_complete_tailordb_migration_generate ;;
+        tailordb:migration:rebaseline) __tailor_worker_complete_tailordb_migration_rebaseline ;;
         tailordb:migration:script) __tailor_worker_complete_tailordb_migration_script ;;
         tailordb:migration:set) __tailor_worker_complete_tailordb_migration_set ;;
         tailordb:migration:status) __tailor_worker_complete_tailordb_migration_status ;;
         tailordb:migration:sync) __tailor_worker_complete_tailordb_migration_sync ;;
+        tailordb:migration:test) __tailor_worker_complete_tailordb_migration_test ;;
         tailordb:migration:validate) __tailor_worker_complete_tailordb_migration_validate ;;
         tailordb:migration) __tailor_worker_complete_tailordb_migration ;;
         tailordb) __tailor_worker_complete_tailordb ;;

package/dist/configure/index.d.mts

@@ -1,7 +1,7 @@
 import { ArrayFieldOutput, FieldMetadata, FieldOptions, FieldOutput, TailorFieldType } from "./types/field.types.mjs";
 import { AttributeList, Attributes, Env, TailorPrincipal } from "../runtime/types.mjs";
 import { DeepWritable, NullableToOptional, output as output$1 } from "../types/helpers.mjs";
-import { PluginAttachment } from "./services/tailordb/types.mjs";
+import { IsAutoFilledDBField, IsReadOnlyDBField, PluginAttachment } from "./services/tailordb/types.mjs";
 import { AuthConnectionConfig, AuthConnectionOAuth2Config } from "../types/auth-connection.generated.mjs";
 import { BuiltinIdP, IDToken, IdProvider, OAuth2ClientInput, OIDC, SAML, SCIMAttribute, SCIMAttributeMapping, SCIMAuthorization, SCIMConfig, SCIMResource, TenantProvider } from "../types/auth.generated.mjs";
 import { AuthConfig, AuthConnectionTokenResult, AuthExternalConfig, AuthOwnConfig, AuthServiceInput, BeforeLoginClaims, BeforeLoginHookArgs, DefinedAuth, FederatedIdentity, FederatedIdentityClaims, FederatedIdentityProvider, MachineUserName, MachineUserNameRegistry, OAuth2ClientGrantType, SCIMAttributeType, UserAttributeKey, UserAttributeListKey, UserAttributes, UsernameFieldKey, ValueOperand } from "./services/auth/types.mjs";
@@ -38,7 +38,7 @@ import { IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, I
 import { Trigger } from "./services/executor/trigger/index.mjs";
 import { createExecutor } from "./services/executor/executor.mjs";
 import { defineWorkflowExecutionPolicies, defineWorkflowExecutionPolicy } from "./services/workflow/execution-policy.mjs";
-import { WaitPointInstance, createWaitPoint, createWaitPoints } from "./services/workflow/wait-point.mjs";
+import { ParameterizedWaitPointInstance, WaitPointInstance, createWaitPoint, createWaitPoints } from "./services/workflow/wait-point.mjs";
 import { defineStaticWebSite } from "./services/staticwebsite/index.mjs";
 import { defineAIGateway } from "./services/aigateway/index.mjs";
 import { defineIdp } from "./services/idp/index.mjs";
@@ -132,4 +132,4 @@ declare namespace t {
   type infer<T> = TailorOutput<T>;
 }
 //#endregion
-export { type AIGatewayConfig, type AIGatewayName, type AIGatewayNameRegistry, type AttributeList, type Attributes, AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, type AuthConfig, type AuthConnectionConfig, type AuthConnectionOAuth2Config, type AuthConnectionTokenResult, type AuthExternalConfig, type AuthOwnConfig, type AuthServiceInput, type BeforeLoginClaims, type BeforeLoginHookArgs, type BuiltinIdP, type ConcurrencyPolicy, type ConnectionName, type ConnectionNameRegistry, type DefinedAuth, type Env, type ExecutionPolicyConcurrency, type ExecutionPolicyDefInput, type ExecutionPolicyExactInstance, type ExecutionPolicyGroupOptions, type ExecutionPolicyInstance, type ExecutionPolicyWildcardInstance, type ExecutorReadyContext, type ExecutorServiceConfig, type ExecutorServiceInput, type FederatedIdentity, type FederatedIdentityClaims, type FederatedIdentityProvider, FunctionOperation, type GeneratorResult, GqlOperation, HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, type IDToken, type IdPConfig, type IdPEmailConfig, type IdPExternalConfig, type IdPGqlOperations, type IdPGqlOperationsInput as IdPGqlOperationsConfig, type IdPPermission, type IdPPermissionCondition, type IdProvider as IdProviderConfig, type IdpName, type IdpNameRegistry, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, type MachineUserName, type MachineUserNameRegistry, type NamespacePluginOutput, type OAuth2ClientInput as OAuth2Client, type OAuth2ClientGrantType, type OIDC, Operation, type PermissionCondition, type Plugin, type PluginAttachment, type PluginConfigs, type PluginExecutorContext, type PluginExecutorContextBase, type PluginGeneratedExecutor, type PluginGeneratedExecutorWithFile, type PluginGeneratedResolver, type PluginGeneratedType, type PluginNamespaceProcessContext, type PluginOutput, type PluginProcessContext, type QueryType, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, type ResolvedExecutionPolicyInstance, type Resolver, ResolverExecutedArgs, ResolverExecutedTrigger, type ResolverExternalConfig, type ResolverNamespaceData, type ResolverPermission, type ResolverPermissionCondition, type ResolverPermissionPolicy, type ResolverReadyContext, type ResolverServiceConfig, type ResolverServiceInput, type RetryPolicy, type SAML, type SCIMAttribute, type SCIMAttributeMapping, type SCIMAttributeType, type SCIMAuthorization, type SCIMConfig, type SCIMResource, ScheduleArgs, ScheduleTrigger, type SecretsConfig, type StaticWebsiteConfig, type TailorAnyDBField, type TailorAnyDBType, type TailorDBField, type TailorDBInstance, type TailorDBNamespaceData, type TailorDBReadyContext, TailorDBTrigger, type TailorDBType, type TailorDBTypeForPlugin, type TailorField, type TailorPrincipal, type TailorTypeGqlPermission, type TailorTypePermission, type TenantProvider as TenantProviderConfig, Trigger, type TypePluginOutput, type UserAttributeKey, type UserAttributeListKey, type UserAttributes, type UsernameFieldKey, type ValueOperand, WaitPointInstance, WebhookOperation, Workflow, WorkflowConfig, WorkflowExecutionArgs, WorkflowExecutionCompletedArgs, WorkflowExecutionResumedArgs, WorkflowExecutionRetriedArgs, WorkflowExecutionStartedArgs, WorkflowExecutionTrigger, WorkflowExecutionWaitResolvedArgs, WorkflowExecutionWaitStartedArgs, WorkflowJob, WorkflowJobContext, WorkflowJobExecutionArgs, WorkflowJobExecutionCompletedArgs, WorkflowJobExecutionStartedArgs, WorkflowJobExecutionTrigger, WorkflowJobExecutionWaitResolvedArgs, WorkflowJobExecutionWaitStartedArgs, WorkflowOperation, type WorkflowServiceConfig, type WorkflowServiceInput, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, createExecutor, createHttpAdapter, createResolver, createWaitPoint, createWaitPoints, createWorkflow, createWorkflowJob, db, defineAIGateway, defineAuth, defineConfig, defineIdp, definePlugins, defineSecretManager, defineStaticWebSite, defineWorkflowExecutionPolicies, defineWorkflowExecutionPolicy, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, incomingWebhookTrigger, infer, output, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, scheduleTrigger, t, unsafeAllowAllGqlPermission, unsafeAllowAllIdPPermission, unsafeAllowAllTypePermission, workflowExecutionCompletedTrigger, workflowExecutionResumedTrigger, workflowExecutionRetriedTrigger, workflowExecutionStartedTrigger, workflowExecutionTrigger, workflowExecutionWaitResolvedTrigger, workflowExecutionWaitStartedTrigger, workflowJobExecutionCompletedTrigger, workflowJobExecutionStartedTrigger, workflowJobExecutionTrigger, workflowJobExecutionWaitResolvedTrigger, workflowJobExecutionWaitStartedTrigger };
+export { type AIGatewayConfig, type AIGatewayName, type AIGatewayNameRegistry, type AttributeList, type Attributes, AuthAccessTokenArgs, AuthAccessTokenIssuedArgs, AuthAccessTokenRefreshedArgs, AuthAccessTokenRevokedArgs, AuthAccessTokenTrigger, type AuthConfig, type AuthConnectionConfig, type AuthConnectionOAuth2Config, type AuthConnectionTokenResult, type AuthExternalConfig, type AuthOwnConfig, type AuthServiceInput, type BeforeLoginClaims, type BeforeLoginHookArgs, type BuiltinIdP, type ConcurrencyPolicy, type ConnectionName, type ConnectionNameRegistry, type DefinedAuth, type Env, type ExecutionPolicyConcurrency, type ExecutionPolicyDefInput, type ExecutionPolicyExactInstance, type ExecutionPolicyGroupOptions, type ExecutionPolicyInstance, type ExecutionPolicyWildcardInstance, type ExecutorReadyContext, type ExecutorServiceConfig, type ExecutorServiceInput, type FederatedIdentity, type FederatedIdentityClaims, type FederatedIdentityProvider, FunctionOperation, type GeneratorResult, GqlOperation, HttpAdapter, HttpAdapterGraphQLQuery, HttpAdapterGraphQLRequest, HttpAdapterGraphQLResponse, HttpAdapterInput, HttpAdapterInputFn, HttpAdapterOutputFn, HttpAdapterRequest, HttpAdapterResponse, HttpAdapterTypedDocumentNode, type IDToken, type IdPConfig, type IdPEmailConfig, type IdPExternalConfig, type IdPGqlOperations, type IdPGqlOperationsInput as IdPGqlOperationsConfig, type IdPPermission, type IdPPermissionCondition, type IdProvider as IdProviderConfig, type IdpName, type IdpNameRegistry, IdpUserArgs, IdpUserCreatedArgs, IdpUserDeletedArgs, IdpUserTrigger, IdpUserUpdatedArgs, IncomingWebhookArgs, IncomingWebhookRequest, IncomingWebhookResponse, IncomingWebhookResponseConfig, IncomingWebhookTrigger, IncomingWebhookTriggerOptions, type IsAutoFilledDBField, type IsReadOnlyDBField, type MachineUserName, type MachineUserNameRegistry, type NamespacePluginOutput, type OAuth2ClientInput as OAuth2Client, type OAuth2ClientGrantType, type OIDC, Operation, ParameterizedWaitPointInstance, type PermissionCondition, type Plugin, type PluginAttachment, type PluginConfigs, type PluginExecutorContext, type PluginExecutorContextBase, type PluginGeneratedExecutor, type PluginGeneratedExecutorWithFile, type PluginGeneratedResolver, type PluginGeneratedType, type PluginNamespaceProcessContext, type PluginOutput, type PluginProcessContext, type QueryType, RecordCreatedArgs, RecordDeletedArgs, RecordUpdatedArgs, type ResolvedExecutionPolicyInstance, type Resolver, ResolverExecutedArgs, ResolverExecutedTrigger, type ResolverExternalConfig, type ResolverNamespaceData, type ResolverPermission, type ResolverPermissionCondition, type ResolverPermissionPolicy, type ResolverReadyContext, type ResolverServiceConfig, type ResolverServiceInput, type RetryPolicy, type SAML, type SCIMAttribute, type SCIMAttributeMapping, type SCIMAttributeType, type SCIMAuthorization, type SCIMConfig, type SCIMResource, ScheduleArgs, ScheduleTrigger, type SecretsConfig, type StaticWebsiteConfig, type TailorAnyDBField, type TailorAnyDBType, type TailorDBField, type TailorDBInstance, type TailorDBNamespaceData, type TailorDBReadyContext, TailorDBTrigger, type TailorDBType, type TailorDBTypeForPlugin, type TailorField, type TailorPrincipal, type TailorTypeGqlPermission, type TailorTypePermission, type TenantProvider as TenantProviderConfig, Trigger, type TypePluginOutput, type UserAttributeKey, type UserAttributeListKey, type UserAttributes, type UsernameFieldKey, type ValueOperand, WaitPointInstance, WebhookOperation, Workflow, WorkflowConfig, WorkflowExecutionArgs, WorkflowExecutionCompletedArgs, WorkflowExecutionResumedArgs, WorkflowExecutionRetriedArgs, WorkflowExecutionStartedArgs, WorkflowExecutionTrigger, WorkflowExecutionWaitResolvedArgs, WorkflowExecutionWaitStartedArgs, WorkflowJob, WorkflowJobContext, WorkflowJobExecutionArgs, WorkflowJobExecutionCompletedArgs, WorkflowJobExecutionStartedArgs, WorkflowJobExecutionTrigger, WorkflowJobExecutionWaitResolvedArgs, WorkflowJobExecutionWaitStartedArgs, WorkflowOperation, type WorkflowServiceConfig, type WorkflowServiceInput, authAccessTokenIssuedTrigger, authAccessTokenRefreshedTrigger, authAccessTokenRevokedTrigger, authAccessTokenTrigger, createExecutor, createHttpAdapter, createResolver, createWaitPoint, createWaitPoints, createWorkflow, createWorkflowJob, db, defineAIGateway, defineAuth, defineConfig, defineIdp, definePlugins, defineSecretManager, defineStaticWebSite, defineWorkflowExecutionPolicies, defineWorkflowExecutionPolicy, idpUserCreatedTrigger, idpUserDeletedTrigger, idpUserTrigger, idpUserUpdatedTrigger, incomingWebhookTrigger, infer, output, recordCreatedTrigger, recordDeletedTrigger, recordTrigger, recordUpdatedTrigger, resolverExecutedTrigger, scheduleTrigger, t, unsafeAllowAllGqlPermission, unsafeAllowAllIdPPermission, unsafeAllowAllTypePermission, workflowExecutionCompletedTrigger, workflowExecutionResumedTrigger, workflowExecutionRetriedTrigger, workflowExecutionStartedTrigger, workflowExecutionTrigger, workflowExecutionWaitResolvedTrigger, workflowExecutionWaitStartedTrigger, workflowJobExecutionCompletedTrigger, workflowJobExecutionStartedTrigger, workflowJobExecutionTrigger, workflowJobExecutionWaitResolvedTrigger, workflowJobExecutionWaitStartedTrigger };

package/dist/configure/index.mjs

@@ -1,7 +1,8 @@
 import { i as parseInternal, n as mapAllowedValues, t as db } from "../schema--xYWRGfe.mjs";
 import { t as brandValue } from "../brand-Eo4pLXPJ.mjs";
 import { a as registerJob, n as dispatchStartJob, r as dispatchStartWorkflow } from "../registry-BIGVUrMB.mjs";
-import { i as withWorkflowTestInvoker } from "../test-env-key-D7UkZp99.mjs";
+import { l as withWorkflowTestInvoker, n as attachWaitPointKey, r as createWaitPointInvoker, t as attachWaitPointInvoker } from "../wait-point-invoker-__oE88_P.mjs";
+import { r as registerWaitPoint } from "../wait-point-registry-TL99zotw.mjs";
 
 //#region src/configure/types/type.ts
 function createTailorField(type, options, fields, values, metadata) {
@@ -880,10 +881,39 @@ function createWorkflowJob(config) {
 
 //#endregion
 //#region src/configure/services/workflow/wait-point.ts
-function getPlatformWorkflow() {
-	const workflow = globalThis.tailor?.workflow;
-	if (!workflow) throw new Error("tailor.workflow is not available. Run tests in the `tailor-runtime` Vitest environment, or acquire mockWorkflow() from @tailor-platform/sdk/vitest and set a wait/resolve handler.");
-	return workflow;
+const KEY_REGEX = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
+const PARAM_VALUE_REGEX = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+const MAX_KEY_LENGTH = 63;
+const KEY_GRAMMAR = "[a-z0-9-] (3-63 characters; must start and end with [a-z0-9])";
+function parseKey(key) {
+	const segments = key.split("-");
+	return {
+		segments,
+		paramNames: segments.filter((s) => s.startsWith("$") && s.length > 1).map((s) => s.slice(1))
+	};
+}
+function composeKey(key, parsed, params) {
+	const composed = parsed.segments.map((segment) => {
+		if (!segment.startsWith("$") || segment.length === 1) return segment;
+		const name = segment.slice(1);
+		const value = params[name];
+		if (typeof value !== "string") throw new Error(`Wait point "${key}" needs a string for parameter "${name}" but received ${value === void 0 ? "undefined" : typeof value}.`);
+		if (!PARAM_VALUE_REGEX.test(value)) throw new Error(`Wait point "${key}" cannot use ${JSON.stringify(value)} for parameter "${name}": values may only contain [a-z0-9-] and cannot be empty or start or end with "-".`);
+		return value;
+	}).join("-");
+	if (composed.length > MAX_KEY_LENGTH) throw new Error(`Wait point key "${composed}" built from "${key}" is ${composed.length} characters; the limit is ${MAX_KEY_LENGTH}.`);
+	if (!KEY_REGEX.test(composed)) throw new Error(`Wait point key "${composed}" built from "${key}" must match ${KEY_GRAMMAR}.`);
+	return composed;
+}
+function createBoundWaitPoint(invoker, readKey) {
+	return {
+		wait(payload) {
+			return Promise.resolve(invoker.wait(readKey(), payload));
+		},
+		async resolve(executionId, callback) {
+			await invoker.resolve(readKey(), executionId, callback);
+		}
+	};
 }
 /**
 * Create a WaitPointInstance that delegates to the platform runtime.
@@ -894,22 +924,47 @@ function getPlatformWorkflow() {
 */
 function createWaitPointInstance(initialKey) {
 	let key = initialKey;
+	const invoker = createWaitPointInvoker();
+	const instance = brandValue(createBoundWaitPoint(invoker, () => key), "wait-point");
+	attachWaitPointInvoker(instance, invoker);
 	return {
-		instance: brandValue({
-			wait(payload) {
-				return Promise.resolve(getPlatformWorkflow().wait(key, payload));
-			},
-			async resolve(executionId, callback) {
-				await getPlatformWorkflow().resolve(executionId, key, callback);
-			}
-		}, "wait-point"),
+		instance,
 		setKey: (k) => {
 			key = k;
 		}
 	};
 }
+function createParameterizedWaitPointInstance(key, parsed, declaredBy) {
+	const invoker = createWaitPointInvoker();
+	const unbound = () => {
+		throw new Error(declaredBy === "define" ? `Wait point key "${key}" has $params, so it identifies no single suspension on its own. Bind them first: waitPoint.with({ ... }).wait(...).` : `Wait point key "${key}" has $params, which createWaitPoint cannot type. Declare it through createWaitPoints instead: createWaitPoints((define) => ({ myWaitPoint: define.for("${key}")<Payload, Result>() })).`);
+	};
+	const instance = brandValue({
+		with(params) {
+			const composed = composeKey(key, parsed, params);
+			return attachWaitPointKey(createBoundWaitPoint(invoker, () => composed), composed);
+		},
+		wait: unbound,
+		resolve: unbound
+	}, "wait-point");
+	attachWaitPointInvoker(instance, invoker);
+	return instance;
+}
+function createKeyedWaitPoint(key, declaredBy) {
+	registerWaitPoint({
+		key,
+		declaredBy
+	});
+	const parsed = parseKey(key);
+	return parsed.paramNames.length > 0 ? createParameterizedWaitPointInstance(key, parsed, declaredBy) : createWaitPointInstance(key).instance;
+}
 /**
-* Create a single typed wait point with an explicit key.
+* Create a single typed wait point with a fixed key.
+*
+* The key must match `[a-z0-9-]` (3-63 characters, starting and ending with
+* `[a-z0-9]`), which `deploy` reports on. For a key with `$params`, use
+* {@link createWaitPoints}: binding params needs the key inferred as a literal
+* type, which only its `define` offers.
 *
 * `Payload` and `Result` must be JsonValue-compatible.
 * Functions and objects with a `toJSON` method are rejected at the type level;
@@ -921,13 +976,14 @@ function createWaitPointInstance(initialKey) {
 *
 * await approval.wait({ message: "Please approve" });
 */
-/* @__NO_SIDE_EFFECTS__ */
 function createWaitPoint(key) {
-	return createWaitPointInstance(key).instance;
+	return createKeyedWaitPoint(key, "createWaitPoint");
 }
 /**
 * Create a group of typed wait points for human-in-the-loop workflows.
-* Property names become the wait point keys.
+* Property names become the wait point keys, so they must match
+* `[a-z0-9-]`, which `deploy` reports on — pass an explicit key to `define`
+* when they do not.
 *
 * The return type is the same as the builder's return type, so JSDoc on each
 * property is preserved and visible in IDE autocompletion.
@@ -941,23 +997,34 @@ function createWaitPoint(key) {
 * export const waitPoints = createWaitPoints(define => ({
 *   // Preceding JSDoc on this property is shown in IDE autocompletion
 *   approval: define<{ message: string }, { approved: boolean }>(),
+*   // A key with $params is bound per call through `.with()`
+*   lineApproval: define.for("line-approval-$lineId")<{ message: string }, { approved: boolean }>(),
 * }));
 *
-* // IDE shows the JSDoc when typing `waitPoints.`
 * await waitPoints.approval.wait({ message: "Please approve" });
+* await waitPoints.lineApproval.with({ lineId: line.id }).wait({ message: "Please approve" });
 *
 * // For 2-level access, use destructured export with JSDoc attached to the export itself.
 */
-/* @__NO_SIDE_EFFECTS__ */
 function createWaitPoints(builder) {
 	const setters = /* @__PURE__ */ new Map();
-	const define = (() => {
+	const result = builder(Object.assign(() => {
 		const { instance, setKey } = createWaitPointInstance("__pending__");
 		setters.set(instance, setKey);
 		return instance;
-	});
-	const result = builder(define);
-	for (const key of Object.keys(result)) setters.get(result[key])?.(key);
+	}, { for: (key) => {
+		const instance = createKeyedWaitPoint(key, "define");
+		return () => instance;
+	} }));
+	for (const propName of Object.keys(result)) {
+		const setter = setters.get(result[propName]);
+		if (!setter) continue;
+		registerWaitPoint({
+			key: propName,
+			declaredBy: "property"
+		});
+		setter(propName);
+	}
 	return result;
 }