@tailor-platform/sdk 2.19.0 → 2.21.0

package/docs/configuration.md

@@ -245,6 +245,23 @@ export default defineConfig({
 });
 ```
 
+A value can reference a [static website](./services/staticwebsite.md#type-safe-url-references) through its `url` property, the same reference `cors` and OAuth2 redirect URIs accept. Resolver, executor, workflow job, and auth before-login hook code, and TailorDB migration scripts, then read the deployed website URL:
+
+```typescript
+const website = defineStaticWebSite("my-frontend", { description: "Frontend" });
+
+export default defineConfig({
+  name: "my-app",
+  env: {
+    siteUrl: website.url, // https://my-frontend.example.com
+    callbackUrl: `${website.url}/callback`, // https://my-frontend.example.com/callback
+  },
+  staticWebsites: [website],
+});
+```
+
+This resolves even when the same deploy both creates the website and reads its URL — one `deploy` call is enough, with no second, manually-triggered `deploy` needed. If the referenced website does not exist at all, the CLI warns and leaves the unresolved reference in place. If the reference still can't be resolved after this deploy's rebuild, the deploy fails instead of shipping the unresolved reference. This platform lookup only happens during `deploy`; `function run` passes the literal `<name>:url` string unchanged, since it never talks to the platform to resolve it.
+
 `tailor.config.ts` runs locally when an SDK command loads the config. If values come from your shell or an env file, SDK commands can load them before config evaluation with the global [`--env-file`](./cli-reference.md#environment-file-loading) and `--env-file-if-exists` options:
 
 ```typescript
@@ -260,7 +277,7 @@ export default defineConfig({
 
 If the same config defines an auth before-login hook, make sure the config module can be evaluated without Node-only globals in the platform runtime. Avoid arbitrary `process.env` reads in that module; pass literal values, or values generated into a config module before deployment, and read them from the hook's `env` argument.
 
-When the SDK deploys application code or runs detected service code with `function run`, it passes the resolved values as the `env` argument. Do not read `process.env` from deployed resolvers, executors, workflow jobs, auth hooks, or migration scripts; Node-side environment variables are not available there. Put sensitive values in [Secret Manager](./services/secret.md) instead of `env`.
+When the SDK deploys application code or runs detected service code with `function run`, it passes the values `tailor.config.ts` evaluated to as the `env` argument -- except a static website `<name>:url` reference, which only `deploy` resolves (see above). Do not read `process.env` from deployed resolvers, executors, workflow jobs, auth hooks, or migration scripts; Node-side environment variables are not available there. Put sensitive values in [Secret Manager](./services/secret.md) instead of `env`.
 
 | Code location             | Runtime access                                                                                                                            |
 | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |

package/docs/migration/v3.md

@@ -165,3 +165,67 @@ Do not change unrelated upload APIs or already explicit encodings.
 ```
 
 </details>
+
+## secrets.get()/getAll() (defineSecretManager) removed — use secretmanager from @tailor-platform/sdk/runtime
+
+**Migration:** Manual
+
+The `get()`/`getAll()` methods on the object `defineSecretManager()` returns are removed in v3. Importing that object into a resolver, executor, or workflow file bundles the raw values passed to `defineSecretManager()` into that function's deployed code, which fails to build once any value comes from `process.env`. `secretmanager.getSecret()`/`getSecrets()` from `@tailor-platform/sdk/runtime` read the same secrets without importing the config object.
+
+Before:
+
+```ts
+import { secrets } from "../tailor.config";
+
+const apiKey = await secrets.get("api-keys", "stripe-secret-key");
+```
+
+After:
+
+```ts
+import { secretmanager } from "@tailor-platform/sdk/runtime";
+
+const apiKey = await secretmanager.getSecret("api-keys", "stripe-secret-key");
+```
+
+Before:
+
+```ts
+import { secrets } from "../tailor.config";
+
+const [apiKey, webhookSecret] = await secrets.getAll("api-keys", [
+  "sendgrid-api-key",
+  "stripe-secret-key",
+]);
+```
+
+After:
+
+```ts
+import { secretmanager } from "@tailor-platform/sdk/runtime";
+
+const { "sendgrid-api-key": apiKey, "stripe-secret-key": webhookSecret } =
+  await secretmanager.getSecrets("api-keys", ["sendgrid-api-key", "stripe-secret-key"]);
+```
+
+<details>
+<summary>Prompt for an AI agent (to perform this migration)</summary>
+
+```text
+`secrets.get()`/`getAll()` on the object `defineSecretManager()` returns are removed in v3.
+Replace the import with `import { secretmanager } from "@tailor-platform/sdk/runtime";` and
+call `secretmanager.getSecret(vault, name)` in place of `secrets.get(vault, name)`.
+
+`getAll()` needs more than a rename: `secrets.getAll(vault, names)` returned an array of
+values in the same order as `names`, while `secretmanager.getSecrets(vault, names)` returns
+a partial record keyed by each requested name (a name with no value is omitted instead of
+being `undefined` at its index). Rewrite positional destructuring (`const [a, b] = await
+secrets.getAll(v, ["A", "B"])`) into keyed destructuring (`const { A: a, B: b } = await
+secretmanager.getSecrets(v, ["A", "B"])`).
+
+Also review: a `secrets` object re-exported or re-assigned to another name before use, and a
+file that already imports something else named `secretmanager` (rename one of the two on
+conflict).
+```
+
+</details>

package/docs/services/resolver.md

@@ -141,6 +141,27 @@ GraphQL still accepts and returns `YYYY-MM-DD` strings. The SDK converts input t
 
 This option also works in nested objects and with `array: true` or `optional: true`. Input must be a valid calendar date, and output must be a valid `Date` with a 4-digit UTC year (0000-9999). Both deployed resolvers and `tailor function run` perform these conversions.
 
+A resolver bundle only includes the conversion code for the representations (`as: "date"` or `as: "temporal"`) its `input` and `output` use. To parse other values with such fields inside `body`, for example an external API response, use `parseDateFields` instead of `.parse()`. It takes the same arguments and returns the same result as `.parse()`. Calling `.parse()` on a field whose representation the bundle leaves out throws an error that points to `parseDateFields`.
+
+```typescript
+import { parseDateFields } from "@tailor-platform/sdk/runtime";
+
+const payload = t.object({ due: t.date({ as: "date" }) });
+
+createResolver({
+  name: "importDueDate",
+  operation: "mutation",
+  input: { id: t.string() },
+  body: async ({ input }) => {
+    const response = await fetchDueDate(input.id);
+    const result = parseDateFields(payload, { value: response, data: response, invoker: null });
+    if (result.issues) throw new Error(result.issues[0].message);
+    return result.value.due.toISOString();
+  },
+  output: t.string(),
+});
+```
+
 An executor subscribing to the resolver with `resolverExecutedTrigger` receives the event as JSON, so `result` holds the `YYYY-MM-DD` string rather than a `Date`.
 
 Use `t.date({ as: "temporal" })` to work with the [`Temporal.PlainDate`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Temporal/PlainDate) value instead:

package/docs/services/secret.md

@@ -62,7 +62,7 @@ export default defineConfig({
 });
 ```
 
-The exported `secrets` object provides type-safe `get()` and `getAll()` methods for runtime access from resolvers, executors, and workflows.
+The exported `secrets` object also carries the values you passed in, so import it only where you build your `tailor.config.ts` config (the file itself, or a helper module you import into it) — never from a resolver, executor, or workflow file. This `secrets` object's `get()`/`getAll()` methods are deprecated for the same reason and will be removed in a future major version; to read a secret at runtime, use the `secretmanager` API described below instead.
 
 ### Skipping Secrets with Missing Values
 
@@ -91,50 +91,55 @@ This allows you to set secret values once (e.g., via local `tailor deploy` or th
 
 ## Using Secrets
 
-### Runtime Access with `get()` / `getAll()`
+### Runtime Access with `secretmanager`
 
-Use the `secrets` object exported from `tailor.config.ts` to retrieve secret values at runtime. The vault and secret names are fully type-checked based on the `defineSecretManager()` configuration.
+Read secret values at runtime with the `secretmanager` API from `@tailor-platform/sdk/runtime`, the same module you use for other platform runtime APIs (`idp`, `workflow`, `authconnection`, etc.). Pass the vault and secret names as strings. Once `tailor generate`/`tailor deploy` has run, vault names are autocompleted from `defineSecretManager()` (any other string still works, since vaults can also be managed imperatively via the CLI — see [Managing Secrets](#managing-secrets)), and inside a declared vault, secret names are checked against that vault's configuration.
 
-#### `get(vault, secret)`
+#### `getSecret(vault, name)`
 
 Retrieves a single secret value.
 
 ```typescript
 import { createResolver } from "@tailor-platform/sdk";
-import { secrets } from "../tailor.config";
+import { secretmanager } from "@tailor-platform/sdk/runtime";
 
 export default createResolver({
   name: "call-stripe",
+  operation: "query",
   // ...
-  operation: async ({ input }) => {
-    const apiKey = await secrets.get("api-keys", "stripe-secret-key");
+  body: async ({ input }) => {
+    const apiKey = await secretmanager.getSecret("api-keys", "stripe-secret-key");
     // Use apiKey to call the Stripe API
+
+    // await secretmanager.getSecret("api-keys", "unknown-key"); // Type error — "api-keys" only has "stripe-secret-key" and "sendgrid-api-key"
+    // await secretmanager.getSecret("cli-managed-vault", "anything"); // Fine — "cli-managed-vault" isn't declared in defineSecretManager(), so its secret names aren't checked
   },
 });
 ```
 
-#### `getAll(vault, secrets)`
+#### `getSecrets(vault, names)`
 
 Retrieves multiple secret values at once from the same vault.
 
 ```typescript
 import { createResolver } from "@tailor-platform/sdk";
-import { secrets } from "../tailor.config";
+import { secretmanager } from "@tailor-platform/sdk/runtime";
 
 export default createResolver({
   name: "send-notification",
+  operation: "query",
   // ...
-  operation: async ({ input }) => {
-    const [apiKey, webhookSecret] = await secrets.getAll("api-keys", [
-      "sendgrid-api-key",
-      "stripe-secret-key",
-    ]);
+  body: async ({ input }) => {
+    const { "sendgrid-api-key": apiKey, "stripe-secret-key": webhookSecret } =
+      await secretmanager.getSecrets("api-keys", ["sendgrid-api-key", "stripe-secret-key"]);
     // Use the retrieved secrets
   },
 });
 ```
 
-Both methods return `Promise<string | undefined>` (or an array of them for `getAll`).
+`getSecret` returns `Promise<string | undefined>`; `getSecrets` returns a `Promise` of a partial record keyed by the requested names, omitting any name that has no value.
+
+Import `secretmanager` directly in resolver, executor, and workflow files — never the `secrets` object from `tailor.config.ts` (see [Declarative Configuration](#declarative-configuration) above).
 
 ### In Webhook Operations
 

package/docs/services/staticwebsite.md

@@ -113,6 +113,23 @@ const auth = defineAuth("my-auth", {
 });
 ```
 
+### Application Environment Variables
+
+```typescript
+const website = defineStaticWebSite("my-frontend", {
+  description: "Frontend application",
+});
+
+export default defineConfig({
+  env: {
+    siteUrl: website.url, // https://my-frontend.example.com
+  },
+  staticWebsites: [website],
+});
+```
+
+Resolver, executor, workflow job, and auth before-login hook code, and TailorDB migration scripts, that read [`env`](../configuration.md#environment-variables) receive the deployed URL, even when the same deploy both creates the website and reads its URL — one `deploy` call resolves it, with no second, manually-triggered `deploy` needed. If the referenced website does not exist at all, the CLI warns and leaves the unresolved reference in place. If the reference still can't be resolved after this deploy's rebuild, the deploy fails instead of shipping the unresolved reference. This platform lookup only happens during `deploy`; `function run` passes the literal `<name>:url` string unchanged, since it never talks to the platform to resolve it.
+
 ## Complete Example
 
 ```typescript

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tailor-platform/sdk",
-  "version": "2.19.0",
+  "version": "2.21.0",
   "description": "Tailor Platform SDK - The SDK to work with Tailor Platform",
   "license": "MIT",
   "repository": {
@@ -152,7 +152,7 @@
     "@0no-co/graphql.web": "1.3.4",
     "@badgateway/oauth2-client": "3.3.1",
     "@bufbuild/protobuf": "2.15.0",
-    "@bufbuild/protovalidate": "1.2.0",
+    "@bufbuild/protovalidate": "1.3.0",
     "@connectrpc/connect": "2.2.0",
     "@connectrpc/connect-node": "2.2.0",
     "@inquirer/core": "12.0.3",
@@ -165,7 +165,7 @@
     "@opentelemetry/sdk-trace-node": "2.11.0",
     "@opentelemetry/semantic-conventions": "1.43.0",
     "@oxc-project/types": "0.149.0",
-    "@politty/zod": "0.2.1",
+    "@politty/zod": "0.3.0",
     "@secretlint/core": "13.0.5",
     "@secretlint/secretlint-rule-preset-recommend": "13.0.5",
     "@standard-schema/spec": "1.1.0",
@@ -173,7 +173,7 @@
     "@toiroakr/lines-db": "0.12.7",
     "@toiroakr/read-multiline": "0.4.1",
     "@urql/core": "6.0.3",
-    "amaro": "1.1.11",
+    "amaro": "1.2.1",
     "confbox": "0.3.1",
     "date-fns": "4.4.0",
     "es-toolkit": "1.52.0",
@@ -183,15 +183,15 @@
     "globals": "17.12.0",
     "graphql": "17.0.2",
     "inflection": "3.0.2",
-    "kysely": "0.29.5",
+    "kysely": "0.29.6",
     "mime-types": "3.0.2",
-    "open": "11.0.3",
+    "open": "11.0.4",
     "oxc-parser": "0.149.0",
-    "p-limit": "7.3.2",
+    "p-limit": "7.3.3",
     "pathe": "2.0.3",
     "pgsql-ast-parser": "12.0.2",
     "pkg-types": "2.3.3",
-    "rolldown": "1.2.8",
+    "rolldown": "1.2.9",
     "semver": "7.8.5",
     "sql-highlight": "6.1.0",
     "std-env": "4.2.0",
@@ -208,19 +208,19 @@
     "@tailor-platform/shared": "^0.0.0",
     "@tailor-platform/tailor-proto": "^0.0.1",
     "@types/mime-types": "3.0.1",
-    "@types/node": "24.13.4",
+    "@types/node": "24.13.6",
     "@types/semver": "7.8.0",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
-    "@vitest/coverage-v8": "5.0.0",
-    "eslint-plugin-zod": "4.12.1",
+    "@vitest/coverage-v8": "5.0.1",
+    "eslint-plugin-zod": "4.14.2",
     "oxfmt": "0.67.0",
     "oxlint": "1.82.0",
-    "oxlint-tsgolint": "7.0.2001",
+    "oxlint-tsgolint": "7.0.2002",
     "sonda": "0.14.0",
     "tsdown": "0.23.0",
     "typescript": "6.0.3",
-    "vitest": "5.0.0",
-    "zinfer": "0.4.6"
+    "vitest": "5.0.1",
+    "zinfer": "0.4.7"
   },
   "peerDependencies": {
     "@electric-sql/pglite": ">=0.2.0",