@tailor-platform/sdk 2.20.0 → 2.21.0

package/docs/migration/v3.md

@@ -165,3 +165,67 @@ Do not change unrelated upload APIs or already explicit encodings.
 ```
 
 </details>
+
+## secrets.get()/getAll() (defineSecretManager) removed — use secretmanager from @tailor-platform/sdk/runtime
+
+**Migration:** Manual
+
+The `get()`/`getAll()` methods on the object `defineSecretManager()` returns are removed in v3. Importing that object into a resolver, executor, or workflow file bundles the raw values passed to `defineSecretManager()` into that function's deployed code, which fails to build once any value comes from `process.env`. `secretmanager.getSecret()`/`getSecrets()` from `@tailor-platform/sdk/runtime` read the same secrets without importing the config object.
+
+Before:
+
+```ts
+import { secrets } from "../tailor.config";
+
+const apiKey = await secrets.get("api-keys", "stripe-secret-key");
+```
+
+After:
+
+```ts
+import { secretmanager } from "@tailor-platform/sdk/runtime";
+
+const apiKey = await secretmanager.getSecret("api-keys", "stripe-secret-key");
+```
+
+Before:
+
+```ts
+import { secrets } from "../tailor.config";
+
+const [apiKey, webhookSecret] = await secrets.getAll("api-keys", [
+  "sendgrid-api-key",
+  "stripe-secret-key",
+]);
+```
+
+After:
+
+```ts
+import { secretmanager } from "@tailor-platform/sdk/runtime";
+
+const { "sendgrid-api-key": apiKey, "stripe-secret-key": webhookSecret } =
+  await secretmanager.getSecrets("api-keys", ["sendgrid-api-key", "stripe-secret-key"]);
+```
+
+<details>
+<summary>Prompt for an AI agent (to perform this migration)</summary>
+
+```text
+`secrets.get()`/`getAll()` on the object `defineSecretManager()` returns are removed in v3.
+Replace the import with `import { secretmanager } from "@tailor-platform/sdk/runtime";` and
+call `secretmanager.getSecret(vault, name)` in place of `secrets.get(vault, name)`.
+
+`getAll()` needs more than a rename: `secrets.getAll(vault, names)` returned an array of
+values in the same order as `names`, while `secretmanager.getSecrets(vault, names)` returns
+a partial record keyed by each requested name (a name with no value is omitted instead of
+being `undefined` at its index). Rewrite positional destructuring (`const [a, b] = await
+secrets.getAll(v, ["A", "B"])`) into keyed destructuring (`const { A: a, B: b } = await
+secretmanager.getSecrets(v, ["A", "B"])`).
+
+Also review: a `secrets` object re-exported or re-assigned to another name before use, and a
+file that already imports something else named `secretmanager` (rename one of the two on
+conflict).
+```
+
+</details>

package/docs/services/resolver.md

@@ -141,6 +141,27 @@ GraphQL still accepts and returns `YYYY-MM-DD` strings. The SDK converts input t
 
 This option also works in nested objects and with `array: true` or `optional: true`. Input must be a valid calendar date, and output must be a valid `Date` with a 4-digit UTC year (0000-9999). Both deployed resolvers and `tailor function run` perform these conversions.
 
+A resolver bundle only includes the conversion code for the representations (`as: "date"` or `as: "temporal"`) its `input` and `output` use. To parse other values with such fields inside `body`, for example an external API response, use `parseDateFields` instead of `.parse()`. It takes the same arguments and returns the same result as `.parse()`. Calling `.parse()` on a field whose representation the bundle leaves out throws an error that points to `parseDateFields`.
+
+```typescript
+import { parseDateFields } from "@tailor-platform/sdk/runtime";
+
+const payload = t.object({ due: t.date({ as: "date" }) });
+
+createResolver({
+  name: "importDueDate",
+  operation: "mutation",
+  input: { id: t.string() },
+  body: async ({ input }) => {
+    const response = await fetchDueDate(input.id);
+    const result = parseDateFields(payload, { value: response, data: response, invoker: null });
+    if (result.issues) throw new Error(result.issues[0].message);
+    return result.value.due.toISOString();
+  },
+  output: t.string(),
+});
+```
+
 An executor subscribing to the resolver with `resolverExecutedTrigger` receives the event as JSON, so `result` holds the `YYYY-MM-DD` string rather than a `Date`.
 
 Use `t.date({ as: "temporal" })` to work with the [`Temporal.PlainDate`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Temporal/PlainDate) value instead:

package/docs/services/secret.md

@@ -62,7 +62,7 @@ export default defineConfig({
 });
 ```
 
-The exported `secrets` object provides type-safe `get()` and `getAll()` methods for runtime access from resolvers, executors, and workflows.
+The exported `secrets` object also carries the values you passed in, so import it only where you build your `tailor.config.ts` config (the file itself, or a helper module you import into it) — never from a resolver, executor, or workflow file. This `secrets` object's `get()`/`getAll()` methods are deprecated for the same reason and will be removed in a future major version; to read a secret at runtime, use the `secretmanager` API described below instead.
 
 ### Skipping Secrets with Missing Values
 
@@ -91,50 +91,55 @@ This allows you to set secret values once (e.g., via local `tailor deploy` or th
 
 ## Using Secrets
 
-### Runtime Access with `get()` / `getAll()`
+### Runtime Access with `secretmanager`
 
-Use the `secrets` object exported from `tailor.config.ts` to retrieve secret values at runtime. The vault and secret names are fully type-checked based on the `defineSecretManager()` configuration.
+Read secret values at runtime with the `secretmanager` API from `@tailor-platform/sdk/runtime`, the same module you use for other platform runtime APIs (`idp`, `workflow`, `authconnection`, etc.). Pass the vault and secret names as strings. Once `tailor generate`/`tailor deploy` has run, vault names are autocompleted from `defineSecretManager()` (any other string still works, since vaults can also be managed imperatively via the CLI — see [Managing Secrets](#managing-secrets)), and inside a declared vault, secret names are checked against that vault's configuration.
 
-#### `get(vault, secret)`
+#### `getSecret(vault, name)`
 
 Retrieves a single secret value.
 
 ```typescript
 import { createResolver } from "@tailor-platform/sdk";
-import { secrets } from "../tailor.config";
+import { secretmanager } from "@tailor-platform/sdk/runtime";
 
 export default createResolver({
   name: "call-stripe",
+  operation: "query",
   // ...
-  operation: async ({ input }) => {
-    const apiKey = await secrets.get("api-keys", "stripe-secret-key");
+  body: async ({ input }) => {
+    const apiKey = await secretmanager.getSecret("api-keys", "stripe-secret-key");
     // Use apiKey to call the Stripe API
+
+    // await secretmanager.getSecret("api-keys", "unknown-key"); // Type error — "api-keys" only has "stripe-secret-key" and "sendgrid-api-key"
+    // await secretmanager.getSecret("cli-managed-vault", "anything"); // Fine — "cli-managed-vault" isn't declared in defineSecretManager(), so its secret names aren't checked
   },
 });
 ```
 
-#### `getAll(vault, secrets)`
+#### `getSecrets(vault, names)`
 
 Retrieves multiple secret values at once from the same vault.
 
 ```typescript
 import { createResolver } from "@tailor-platform/sdk";
-import { secrets } from "../tailor.config";
+import { secretmanager } from "@tailor-platform/sdk/runtime";
 
 export default createResolver({
   name: "send-notification",
+  operation: "query",
   // ...
-  operation: async ({ input }) => {
-    const [apiKey, webhookSecret] = await secrets.getAll("api-keys", [
-      "sendgrid-api-key",
-      "stripe-secret-key",
-    ]);
+  body: async ({ input }) => {
+    const { "sendgrid-api-key": apiKey, "stripe-secret-key": webhookSecret } =
+      await secretmanager.getSecrets("api-keys", ["sendgrid-api-key", "stripe-secret-key"]);
     // Use the retrieved secrets
   },
 });
 ```
 
-Both methods return `Promise<string | undefined>` (or an array of them for `getAll`).
+`getSecret` returns `Promise<string | undefined>`; `getSecrets` returns a `Promise` of a partial record keyed by the requested names, omitting any name that has no value.
+
+Import `secretmanager` directly in resolver, executor, and workflow files — never the `secrets` object from `tailor.config.ts` (see [Declarative Configuration](#declarative-configuration) above).
 
 ### In Webhook Operations
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tailor-platform/sdk",
-  "version": "2.20.0",
+  "version": "2.21.0",
   "description": "Tailor Platform SDK - The SDK to work with Tailor Platform",
   "license": "MIT",
   "repository": {
@@ -152,7 +152,7 @@
     "@0no-co/graphql.web": "1.3.4",
     "@badgateway/oauth2-client": "3.3.1",
     "@bufbuild/protobuf": "2.15.0",
-    "@bufbuild/protovalidate": "1.2.0",
+    "@bufbuild/protovalidate": "1.3.0",
     "@connectrpc/connect": "2.2.0",
     "@connectrpc/connect-node": "2.2.0",
     "@inquirer/core": "12.0.3",
@@ -165,7 +165,7 @@
     "@opentelemetry/sdk-trace-node": "2.11.0",
     "@opentelemetry/semantic-conventions": "1.43.0",
     "@oxc-project/types": "0.149.0",
-    "@politty/zod": "0.2.1",
+    "@politty/zod": "0.3.0",
     "@secretlint/core": "13.0.5",
     "@secretlint/secretlint-rule-preset-recommend": "13.0.5",
     "@standard-schema/spec": "1.1.0",
@@ -173,7 +173,7 @@
     "@toiroakr/lines-db": "0.12.7",
     "@toiroakr/read-multiline": "0.4.1",
     "@urql/core": "6.0.3",
-    "amaro": "1.1.11",
+    "amaro": "1.2.1",
     "confbox": "0.3.1",
     "date-fns": "4.4.0",
     "es-toolkit": "1.52.0",
@@ -183,15 +183,15 @@
     "globals": "17.12.0",
     "graphql": "17.0.2",
     "inflection": "3.0.2",
-    "kysely": "0.29.5",
+    "kysely": "0.29.6",
     "mime-types": "3.0.2",
     "open": "11.0.4",
     "oxc-parser": "0.149.0",
-    "p-limit": "7.3.2",
+    "p-limit": "7.3.3",
     "pathe": "2.0.3",
     "pgsql-ast-parser": "12.0.2",
     "pkg-types": "2.3.3",
-    "rolldown": "1.2.8",
+    "rolldown": "1.2.9",
     "semver": "7.8.5",
     "sql-highlight": "6.1.0",
     "std-env": "4.2.0",
@@ -208,18 +208,18 @@
     "@tailor-platform/shared": "^0.0.0",
     "@tailor-platform/tailor-proto": "^0.0.1",
     "@types/mime-types": "3.0.1",
-    "@types/node": "24.13.4",
+    "@types/node": "24.13.6",
     "@types/semver": "7.8.0",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
-    "@vitest/coverage-v8": "5.0.0",
-    "eslint-plugin-zod": "4.13.1",
+    "@vitest/coverage-v8": "5.0.1",
+    "eslint-plugin-zod": "4.14.2",
     "oxfmt": "0.67.0",
     "oxlint": "1.82.0",
-    "oxlint-tsgolint": "7.0.2001",
+    "oxlint-tsgolint": "7.0.2002",
     "sonda": "0.14.0",
     "tsdown": "0.23.0",
     "typescript": "6.0.3",
-    "vitest": "5.0.0",
+    "vitest": "5.0.1",
     "zinfer": "0.4.7"
   },
   "peerDependencies": {