@tailor-platform/sdk 2.33.0 → 2.34.0

package/dist/types/staticwebsite.generated.d.mts

@@ -1,4 +1,3 @@
-//#region src/types/staticwebsite.generated.d.ts
 export type StaticWebsite = {
   /** Static website name */
   name: string;
@@ -17,5 +16,4 @@ export type StaticWebsite = {
     };
   })[] | undefined;
 };
-export type StaticWebsiteInput = StaticWebsite;
-//#endregion
+export type StaticWebsiteInput = StaticWebsite;

package/dist/types/tailordb.generated.d.mts

@@ -1,4 +1,3 @@
-//#region src/types/tailordb.generated.d.ts
 /**
  * Configuration for GraphQL operations on a TailorDB table.
  * All operations are enabled by default (undefined or true = enabled, false = disabled).
@@ -465,5 +464,4 @@ export type TailorDBServiceConfigInput = {
     /** Enable read queries - get, list, aggregation (default: true) */
     read?: boolean | undefined;
   } | undefined;
-};
-//#endregion
+};

package/dist/types/workflow.generated.d.mts

@@ -1,4 +1,3 @@
-//#region src/types/workflow.generated.d.ts
 export type RetryPolicy = {
   /** Maximum number of retries (1-10) */
   maxRetries: number;
@@ -12,5 +11,4 @@ export type RetryPolicy = {
 export type ConcurrencyPolicy = {
   /** Maximum number of concurrent executions (1-1000) */
   maxConcurrentExecutions: number;
-};
-//#endregion
+};

package/dist/utils/test/index.d.mts

@@ -2,7 +2,6 @@ import { TailorDBType } from "../../configure/services/tailordb/schema.mjs";
 import { TailorField } from "../../configure/types/type.mjs";
 import { output } from "../../configure/index.mjs";
 import { StandardSchemaV1 } from "@standard-schema/spec";
-//#region src/utils/test/index.d.ts
 /**
  * Creates a hook function that processes TailorDB table fields
  * - Uses existing id from data if provided, otherwise generates UUID for id fields
@@ -37,5 +36,4 @@ export declare function createStandardSchema<T = Record<string, unknown>>(schema
     readonly vendor: "@tailor-platform/sdk";
     readonly validate: (value: unknown) => StandardSchemaV1.Result<T>;
   };
-};
-//#endregion
+};

package/dist/utils/test/index.mjs

@@ -1,2 +1,2 @@
-import{t as e}from"../../field-parse-C41e3UAF.mjs";function setField(e,t,n){Object.defineProperty(e,t,{value:n,enumerable:!0,writable:!0,configurable:!0})}function createTailorDBHook(t){return(n,r=/* @__PURE__ */ new Date)=>{let i=n&&typeof n==`object`?n:void 0,a=Object.entries(t.fields).reduce((t,[n,a])=>{let o=a,s=i&&Object.hasOwn(i,n)?i[n]:void 0,c;if(n===`id`)c=s??crypto.randomUUID();else if(o.type===`nested`){let t=createTailorDBHook({fields:o.fields});c=o.metadata.array?Array.isArray(s)?s.map(n=>e(n)?t(n,r):n):s:e(s)?t(s,r):s}else o.metadata.hooks?.create?(c=o.metadata.hooks.create({input:s,invoker:null,now:r}),c instanceof Date&&(c=c.toISOString())):c=s;if(c==null&&o.metadata.default!==void 0){let e=o.type===`datetime`||o.type===`date`||o.type===`time`;c=o.metadata.default===`now`&&e?r.toISOString():o.metadata.default}return setField(t,n,c),t},{});if(t.metadata?.typeHook?.create){let{id:e,...n}=a,i=t.metadata.typeHook.create({input:n,invoker:null,now:r});if(i&&typeof i==`object`)for(let[e,t]of Object.entries(i))setField(a,e,t instanceof Date?t.toISOString():t)}return a}}function typeLevelIssues(e,t){let n=e?.metadata?.typeValidate;if(!n)return[];let{id:r,...i}=t,a=[];return n({newRecord:i,oldRecord:null,invoker:null},(e,t)=>{a.push({message:t,path:[e]})}),a}function undeclaredFieldMessage(e){return`Field "${e}" is not declared by the table. Remove it from the row, or add it to the table definition and run \`tailor generate\`.`}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function collectUndeclaredFieldIssues(e,t,n,r){if(isRecord(e))for(let i of Object.keys(e)){if(!Object.hasOwn(t,i)){r.push({message:undeclaredFieldMessage(i),path:n.concat(i)});continue}let a=t[i];if(a?.type!==`nested`)continue;let o=e[i],s=a.fields;a.metadata.array?Array.isArray(o)&&o.forEach((e,t)=>{collectUndeclaredFieldIssues(e,s,n.concat(i,`[${t}]`),r)}):collectUndeclaredFieldIssues(o,s,n.concat(i),r)}}function createStandardSchema(e,t,n){let validateHooked=t=>{let r=typeLevelIssues(n,t);if(r.length>0)return{issues:r};let i=e.parse({value:t,data:t,invoker:null});return i.issues?i:{value:t}};return{"~standard":{version:1,vendor:`@tailor-platform/sdk`,validate:e=>{let r=t(e),i=[];n&&collectUndeclaredFieldIssues(e,n.fields,[],i);let a=validateHooked(r),o=[...i,...a.issues??[]];return o.length>0?{issues:o}:a}}}}export{createStandardSchema,createTailorDBHook};
+import{t as e}from"../../field-parse-BQhUAbpM.mjs";function setField(e,t,n){Object.defineProperty(e,t,{value:n,enumerable:!0,writable:!0,configurable:!0})}function createTailorDBHook(t){return(n,r=/* @__PURE__ */ new Date)=>{let i=n&&typeof n==`object`?n:void 0,a=Object.entries(t.fields).reduce((t,[n,a])=>{let o=a,s=i&&Object.hasOwn(i,n)?i[n]:void 0,c;if(n===`id`)c=s??crypto.randomUUID();else if(o.type===`nested`){let t=createTailorDBHook({fields:o.fields});c=o.metadata.array?Array.isArray(s)?s.map(n=>e(n)?t(n,r):n):s:e(s)?t(s,r):s}else o.metadata.hooks?.create?(c=o.metadata.hooks.create({input:s,invoker:null,now:r}),c instanceof Date&&(c=c.toISOString())):c=s;if(c==null&&o.metadata.default!==void 0){let e=o.type===`datetime`||o.type===`date`||o.type===`time`;c=o.metadata.default===`now`&&e?r.toISOString():o.metadata.default}return setField(t,n,c),t},{});if(t.metadata?.typeHook?.create){let{id:e,...n}=a,i=t.metadata.typeHook.create({input:n,invoker:null,now:r});if(i&&typeof i==`object`)for(let[e,t]of Object.entries(i))setField(a,e,t instanceof Date?t.toISOString():t)}return a}}function typeLevelIssues(e,t){let n=e?.metadata?.typeValidate;if(!n)return[];let{id:r,...i}=t,a=[];return n({newRecord:i,oldRecord:null,invoker:null},(e,t)=>{a.push({message:t,path:[e]})}),a}function undeclaredFieldMessage(e){return`Field "${e}" is not declared by the table. Remove it from the row, or add it to the table definition and run \`tailor generate\`.`}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function collectUndeclaredFieldIssues(e,t,n,r){if(isRecord(e))for(let i of Object.keys(e)){if(!Object.hasOwn(t,i)){r.push({message:undeclaredFieldMessage(i),path:n.concat(i)});continue}let a=t[i];if(a?.type!==`nested`)continue;let o=e[i],s=a.fields;a.metadata.array?Array.isArray(o)&&o.forEach((e,t)=>{collectUndeclaredFieldIssues(e,s,n.concat(i,`[${t}]`),r)}):collectUndeclaredFieldIssues(o,s,n.concat(i),r)}}function createStandardSchema(e,t,n){let validateHooked=t=>{let r=typeLevelIssues(n,t);if(r.length>0)return{issues:r};let i=e.parse({value:t,data:t,invoker:null});return i.issues?i:{value:t}};return{"~standard":{version:1,vendor:`@tailor-platform/sdk`,validate:e=>{let r=t(e),i=[];n&&collectUndeclaredFieldIssues(e,n.fields,[],i);let a=validateHooked(r),o=[...i,...a.issues??[]];return o.length>0?{issues:o}:a}}}}export{createStandardSchema,createTailorDBHook};
 //# sourceMappingURL=index.mjs.map

package/dist/vitest/date-representation.d.mts

@@ -1,6 +1,5 @@
 import { DateRepresentationOption } from "../configure/types/field.types.mjs";
 import { EffectiveDateDefault } from "../runtime/types.mjs";
-//#region src/vitest/date-representation.d.ts
 /**
  * Expose the date default to `t` date fields in this worker, the way the
  * define plugin folds it into deployed bundles.
@@ -19,5 +18,4 @@ export declare function applyDateDefault(dateDefault: EffectiveDateDefault): ()
  * @param representation - The representation to apply, as `as` names it
  * @returns A function that restores the previous representation
  */
-export declare function applyDateRepresentation(representation: DateRepresentationOption): () => void;
-//#endregion
+export declare function applyDateRepresentation(representation: DateRepresentationOption): () => void;

package/dist/vitest/environment.d.mts

@@ -1,4 +1,3 @@
-//#region src/vitest/environment.d.ts
 declare const _default: {
   name: string;
   viteEnvironment: string;
@@ -6,5 +5,4 @@ declare const _default: {
     teardown(global: typeof globalThis): void;
   }>;
 };
-//#endregion
 export { _default as default };

package/dist/vitest/index.d.mts

@@ -16,7 +16,6 @@ import { applyDateRepresentation } from "./date-representation.mjs";
 import { ExecutedQuery, KyselyMock, createKyselyMock } from "./mock-kysely.mjs";
 import { MigrationStepError, RunMigrationStepsOptions, RunnableMigrationStep, runMigrationSteps } from "./migration-steps.mjs";
 import { Plugin } from "vitest/config";
-//#region src/vitest/index.d.ts
 /**
  * Creates Vitest plugins that emulate the Tailor Platform function runtime environment.
  *
@@ -74,5 +73,4 @@ import { Plugin } from "vitest/config";
 export declare function tailorRuntime(options?: {
   config?: string;
 }): Plugin[];
-//#endregion
 export { type CreateKyselyPGliteOptions, type ExecutedPGliteQuery, type ExecutedQuery, type KyselyMock, MigrationStepError, type MockAigatewayOptions, type MockAuthconnectionOptions, type MockFileOptions, type MockIconvOptions, type MockIdpOptions, type MockLoggerOptions, type MockSecretmanagerOptions, type MockTailordbOptions, type MockTailordbPGliteOptions, type PGliteClient, type PGliteField, type PGliteQueryResult, type QueryBehavior, type QueryMatch, type QueryMatcher, type RunMigrationStepsOptions, type RunWorkflowLocallyOptions, type RunnableMigrationStep, type Unmigrated, applyDateRepresentation, createKyselyMock, createKyselyPGlite, mockAigateway, mockAuthconnection, mockFile, mockIconv, mockIdp, mockLogger, mockSecretmanager, mockTailordb, mockTailordbWithPGlite, mockWorkflow, prepareFixtures, runMigrationSteps, runWorkflowLocally };

package/dist/vitest/migration-steps.d.mts

@@ -1,4 +1,3 @@
-//#region src/vitest/migration-steps.d.ts
 /**
  * Run a multi-step migration script's `steps` in tests the way `tailor deploy`
  * does: in dependency order, each step in its own transaction.
@@ -41,5 +40,4 @@ export declare class MigrationStepError extends Error {
  */
 export declare function runMigrationSteps<Trx, Context extends {
   env: unknown;
-}>(steps: Readonly<Record<string, RunnableMigrationStep<Trx, Context>>>, options: RunMigrationStepsOptions<Trx, Context>): Promise<string[]>;
-//#endregion
+}>(steps: Readonly<Record<string, RunnableMigrationStep<Trx, Context>>>, options: RunMigrationStepsOptions<Trx, Context>): Promise<string[]>;

package/dist/vitest/mock-kysely.d.mts

@@ -1,5 +1,4 @@
 import { Kysely, OperationNode, OperationNodeKind, Transaction } from "kysely";
-//#region src/vitest/mock-kysely.d.ts
 /** A single statement executed against the mock, captured in order. */
 export interface ExecutedQuery {
   /** The Kysely operation node kind, e.g. `"SelectQueryNode"`. */
@@ -57,5 +56,4 @@ export interface KyselyMock<DB> {
  * @returns A {@link KyselyMock} with the mock `db`, recorded queries, and result staging.
  */
 export declare function createKyselyMock<DB = Record<string, never>>(): KyselyMock<DB>;
-//#endregion
 export {};

package/dist/vitest/mocks/aigateway.d.mts

@@ -1,5 +1,4 @@
 import { AIGatewayName } from "@tailor-platform/sdk";
-//#region src/vitest/mocks/aigateway.d.ts
 interface AigatewayCall {
   name: AIGatewayName;
 }
@@ -36,5 +35,4 @@ export declare function mockAigateway(options?: MockAigatewayOptions): {
   clear(): void;
   reset(): void;
 } & Disposable;
-//#endregion
 export {};

package/dist/vitest/mocks/authconnection.d.mts

@@ -1,5 +1,4 @@
 import { AuthConnectionTokenResult, ConnectionName } from "@tailor-platform/sdk";
-//#region src/vitest/mocks/authconnection.d.ts
 interface AuthConnectionCall {
   connectionName: ConnectionName;
 }
@@ -34,5 +33,4 @@ export declare function mockAuthconnection(options?: MockAuthconnectionOptions):
   clear(): void;
   reset(): void;
 } & Disposable;
-//#endregion
 export {};

package/dist/vitest/mocks/file.d.mts

@@ -1,6 +1,5 @@
 import { FileDownloadAsBase64Response, FileDownloadResponse, FileDownloadStreamResponse, FileMetadata, FileUploadBytes, FileUploadOptions, FileUploadResponse, FileUploadStreamOptions } from "../../runtime/file.mjs";
 import { Mock } from "vitest";
-//#region src/vitest/mocks/file.d.ts
 type FileResolver = (method: string, call: FileCall) => unknown;
 interface FileCall {
   method: string;
@@ -54,5 +53,4 @@ export declare function mockFile(options?: MockFileOptions): {
   uploadStream: Mock<(namespace: string, tableName: string, fieldName: string, recordId: string, readableStream: ReadableStream<Uint8Array | ArrayBuffer>, options?: FileUploadStreamOptions) => Promise<FileUploadResponse>>;
   upload: Mock<(namespace: string, tableName: string, fieldName: string, recordId: string, data: string | FileUploadBytes, options?: Omit<FileUploadOptions, "encoding">) => Promise<FileUploadResponse>>;
 } & Disposable;
-//#endregion
 export {};

package/dist/vitest/mocks/iconv.d.mts

@@ -1,5 +1,4 @@
 import { MockInstance } from "vitest";
-//#region src/vitest/mocks/iconv.d.ts
 type IconvResolver = (method: string, args: unknown[]) => unknown;
 type IconvMethod = "convert" | "convertBuffer" | "decode" | "encode" | "encodings";
 interface IconvCall {
@@ -47,5 +46,4 @@ export declare function mockIconv(options?: MockIconvOptions): {
   clear: () => void;
   reset(): void;
 } & Disposable;
-//#endregion
 export {};

package/dist/vitest/mocks/idp.d.mts

@@ -1,6 +1,5 @@
 import { IdpClientConstructor, IdpClientInstance } from "../../runtime/idp.mjs";
 import { Mock } from "vitest";
-//#region src/vitest/mocks/idp.d.ts
 type IdpMethod = keyof IdpClientInstance;
 type IdpResolver = (method: string, args: unknown[], namespace: string) => unknown;
 interface IdpCall {
@@ -57,5 +56,4 @@ export declare function mockIdp(options?: MockIdpOptions): {
   clear(): void;
   reset(): void;
 } & Disposable;
-//#endregion
 export {};

package/dist/vitest/mocks/logger.d.mts

@@ -1,5 +1,4 @@
 import { LogAttributes } from "../../runtime/logger.mjs";
-//#region src/vitest/mocks/logger.d.ts
 type LogSeverity = "debug" | "info" | "warn" | "error";
 /** A recorded `debug`/`info`/`warn`/`error` call. */
 interface LogCall {
@@ -41,5 +40,4 @@ export declare function mockLogger(_options?: MockLoggerOptions): {
   clear(): void;
   reset(): void;
 } & Disposable;
-//#endregion
 export {};

package/dist/vitest/mocks/secretmanager.d.mts

@@ -1,4 +1,3 @@
-//#region src/vitest/mocks/secretmanager.d.ts
 interface SecretCall {
   method: "getSecret" | "getSecrets";
   vault: string;
@@ -40,5 +39,4 @@ export declare function mockSecretmanager(options?: MockSecretmanagerOptions): {
   clear(): void;
   reset(): void;
 } & Disposable;
-//#endregion
 export {};

package/dist/vitest/mocks/tailordb-pglite.d.mts

@@ -1,5 +1,4 @@
 import { PGliteClient } from "../pglite-kysely.mjs";
-//#region src/vitest/mocks/tailordb-pglite.d.ts
 /** A query executed through the PGlite-backed TailorDB client. */
 export interface ExecutedPGliteQuery {
   /** Namespace of the `getDB` call that issued the query. */
@@ -86,5 +85,4 @@ export declare function mockTailordbWithPGlite(options: MockTailordbPGliteOption
    */
   reset(): void;
 } & Disposable;
-//#endregion
 export {};

package/dist/vitest/mocks/tailordb.d.mts

@@ -1,4 +1,3 @@
-//#region src/vitest/mocks/tailordb.d.ts
 type QueryResolver = (query: string, params: unknown[]) => unknown[] | undefined;
 /** Controls how unmatched TailorDB queries are handled. */
 export interface MockTailordbOptions {
@@ -111,5 +110,4 @@ export declare function mockTailordb(options?: MockTailordbOptions): {
   /** Reset query responses and recorded calls (keeps the mock installed). */
   reset(): void;
 } & Disposable;
-//#endregion
 export {};

package/dist/vitest/mocks/workflow.d.mts

@@ -4,7 +4,6 @@ import { WorkflowJob } from "../../configure/services/workflow/job.mjs";
 import { Workflow } from "../../configure/services/workflow/workflow.mjs";
 import { ParameterizedWaitPointInstance, WaitPointInstance } from "../../configure/services/workflow/wait-point.mjs";
 import { Mock } from "vitest";
-//#region src/vitest/mocks/workflow.d.ts
 type JobHandler = (jobName: string, args: unknown, options?: ExecJobFunctionOptions) => unknown;
 type StartHandlerFn = (workflowName: string, args: unknown, options?: StartWorkflowOptions) => string;
 type ResumeHandlerFn = (executionId: string) => string;
@@ -157,5 +156,4 @@ export declare function mockWorkflow(): {
   /** Reset all workflow responses and recorded calls (keeps the mock installed). */
   reset(): void;
 } & Disposable;
-//#endregion
 export {};

package/dist/vitest/pglite-kysely.d.mts

@@ -1,6 +1,5 @@
 import { PGliteField } from "./pglite-temporal.mjs";
 import { ColumnType, Kysely } from "kysely";
-//#region src/vitest/pglite-kysely.d.ts
 /** Result of a {@link PGliteClient.query} call. */
 export interface PGliteQueryResult {
   /** Rows returned by the statement. */
@@ -101,5 +100,4 @@ export declare function createKyselyPGlite<DB = Record<string, never>>(client: P
  * ```
  */
 export declare function prepareFixtures<T>(client: PGliteClient, prepare: () => Promise<T>): Promise<T>;
-//#endregion
 export {};

package/dist/vitest/pglite-temporal.d.mts

@@ -1,9 +1,7 @@
-//#region src/vitest/pglite-temporal.d.ts
 /** Name and Postgres type OID of a column PGlite returned. */
 export interface PGliteField {
   /** Column name */
   name: string;
   /** Postgres type OID */
   dataTypeID: number;
-}
-//#endregion
+}

package/dist/vitest/setup.d.mts

@@ -1,5 +1,4 @@
 import { applyDateDefault } from "./date-representation.mjs";
-//#region src/vitest/setup.d.ts
 /**
  * Extract a vault store from a secrets-shaped value.
  *
@@ -22,5 +21,4 @@ export declare function extractVaultStore(secrets: unknown): Record<string, Reco
  * @returns Vault store keyed by vault name, or null if unavailable
  */
 export declare function loadSecretsFromConfig(configPath: string): Promise<Record<string, Record<string, string>> | null>;
-//#endregion
 export { applyDateDefault };

package/dist/vitest/workflow-local.d.mts

@@ -2,7 +2,6 @@ import { TailorEnv } from "../runtime/types.mjs";
 import { WorkflowJob } from "../configure/services/workflow/job.mjs";
 import { Workflow } from "../configure/services/workflow/workflow.mjs";
 import "../configure/services/workflow/index.mjs";
-//#region src/vitest/workflow-local.d.ts
 type AnyWorkflowJob = WorkflowJob<string, any, any>;
 type AnyWorkflow = Workflow<AnyWorkflowJob>;
 type WorkflowInput<W extends AnyWorkflow> = W["mainJob"] extends WorkflowJob<string, infer I, any> ? I : never;
@@ -37,5 +36,4 @@ export declare function runWorkflowLocally<W extends Workflow<WorkflowJob<string
  * @returns The main job output
  */
 export declare function runWorkflowLocally<W extends AnyWorkflow>(workflow: W, args: WorkflowInput<W>, options?: RunWorkflowLocallyOptions): Promise<WorkflowOutput<W>>;
-//#endregion
 export {};

package/docs/cli/application.md

@@ -270,7 +270,8 @@ Pass the global `--json` / `-j` flag to get machine-readable output.
 
 - `summary` — counts of each change type. `forcedBySdkVersion` counts the updates forced by the SDK version, which are also included in `update`.
 - `changes` — planned resource changes, each with `action`, `name`, and optional `labels` / `namespace`. An update forced by the SDK version also has `forcedBySdkVersion: true`.
-- `warnings` — resources not in config (`type: "unmanaged"`) or secrets with missing values (`type: "skippedSecret"`). Unmanaged resources require confirmation in apply mode (apply is cancelled if declined); skipped secrets are non-blocking.
+- `warnings` — resources not in config (`type: "unmanaged"`), secrets with missing values (`type: "skippedSecret"`), or applications recorded as depending on this deploy but missing from it (`type: "missingDependentApp"`). Unmanaged resources and missing dependent applications require confirmation in apply mode (apply is cancelled if declined); skipped secrets are non-blocking.
+  - A `missingDependentApp` entry names the missing application's `appId`, the `reason` it depends on this deploy, and the resource whose event publishing turns off when applying without it (`resourceType` and `name`, plus `namespace` for a TailorDB table or resolver). An entry about a workflow's jobs rather than the workflow itself has `scope: "jobs"`.
 - `conflicts` — resources owned by another application that conflict with the current config. Require confirmation in apply mode; apply is cancelled if declined.
 - `resourceType` in `warnings` and `conflicts` is a stable identifier of the resource kind, such as `executor`, `tailordb.service`, or `secret.secret`. The human-readable plan shows a display name instead.
 

package/docs/cli/tailordb.md

@@ -286,7 +286,7 @@ See [Global Options](../cli-reference.md#global-options) for options available t
 
 **Notes**
 
-Every local migration file is checked for a compatible format version, and deployed migration history IDs must match the local baseline. Compatibility errors, history mismatches, and metadata lookup failures are reported per namespace and make the command exit non-zero; only a not-yet-deployed namespace is treated as having no applied migrations.
+Local migration files are checked for a valid layout (numbering and required files in each migration directory) and a compatible format version, and deployed migration history IDs must match the local baseline. Invalid or incompatible files, history mismatches, and metadata lookup failures are reported per namespace and make the command exit non-zero; only a not-yet-deployed namespace is treated as having no applied migrations.
 
 #### tailordb migration sync
 

package/docs/cli/user.md

@@ -70,10 +70,10 @@ See [Global Options](../cli-reference.md#global-options) for options available t
 
 **Commands**
 
-| Command                       | Description                                                                           |
-| ----------------------------- | ------------------------------------------------------------------------------------- |
-| [`auth status`](#auth-status) | Show the active Tailor Platform authentication status without printing tokens.        |
-| [`auth token`](#auth-token)   | Print a valid Tailor Platform access token to stdout, refreshing it first if expired. |
+| Command                       | Description                                                                                                  |
+| ----------------------------- | ------------------------------------------------------------------------------------------------------------ |
+| [`auth status`](#auth-status) | Show the active Tailor Platform authentication status without printing tokens.                               |
+| [`auth token`](#auth-token)   | Print a valid Tailor Platform access token to stdout, refreshing it first if it expires within five minutes. |
 
 ### auth status
 
@@ -95,7 +95,7 @@ See [Global Options](../cli-reference.md#global-options) for options available t
 
 ### auth token
 
-Print a valid Tailor Platform access token to stdout, refreshing it first if expired.
+Print a valid Tailor Platform access token to stdout, refreshing it first if it expires within five minutes.
 
 **Usage**
 

package/docs/cli/workspace.md

@@ -253,7 +253,7 @@ Manage when a workspace becomes prunable.
 **Usage**
 
 ```
-tailor workspace ttl [command]
+tailor workspace ttl <command>
 ```
 
 See [Global Options](../cli-reference.md#global-options) for options available to all commands.

package/docs/cli-reference.md

@@ -20,8 +20,8 @@ tailor <command> [options]
 | ------------------------------------------- | ----- | --------------------------------------------------- | -------- | ------- | -------------------- |
 | `--env-file <ENV_FILE>`                     | `-e`  | Path to the environment file (error if not found)   | No       | -       | -                    |
 | `--env-file-if-exists <ENV_FILE_IF_EXISTS>` | -     | Path to the environment file (ignored if not found) | No       | -       | -                    |
-| `--verbose`                                 | -     | Enable verbose logging                              | No       | `false` | -                    |
-| `--json`                                    | `-j`  | Output as JSON                                      | No       | `false` | `TAILOR_JSON_OUTPUT` |
+| `--verbose` / `--no-verbose`                | -     | Enable verbose logging                              | No       | `false` | -                    |
+| `--json` / `--no-json`                      | `-j`  | Output as JSON                                      | No       | `false` | `TAILOR_JSON_OUTPUT` |
 
 ### Progress and Detailed Logs
 
@@ -82,13 +82,13 @@ unexpected argument, or an option value that fails validation (including one set
 environment variable), and `1` for other failures, including checks a command makes after reading
 its arguments. A command that only warns about an unknown option or an extra argument keeps
 running. Cancelling an interactive prompt exits with `130`, and a CLI plugin exits with its own
-code. A command group run without a subcommand, such as `tailor` or `tailor tailordb`, can exit
-with `0` after printing its help or a warning even when an option is unknown or its value is
-invalid, so name the subcommand to rely on `2`.
+code.
 
 Authentication failures distinguish missing credentials (`AUTH_TOKEN_NOT_FOUND`), a missing saved
 user (`AUTH_USER_NOT_FOUND`), an expired token (`AUTH_TOKEN_EXPIRED`), and a failed token refresh
-(`AUTH_TOKEN_REFRESH_FAILED`). Login recovery preserves the selected profile. For saved identities,
+(`AUTH_TOKEN_REFRESH_FAILED`). `CONFIG_LOCK_TIMEOUT` means another `tailor` command kept the saved
+credentials locked for too long; `error.context.lockPath` names the lock file to delete if no other
+command is running. Login recovery preserves the selected profile. For saved identities,
 the next step opens login help so you can reuse the original browser or machine-user login method. Permission and
 connection failures include guidance in `error.suggestion`; API failures also identify the operation
 and affected resources in `error.context`.
@@ -107,7 +107,8 @@ excluded from that list.
 Use `--verbose` to include debug diagnostics and error stack traces. `DEBUG=true` or
 `RUNNER_DEBUG=1` also enables verbose output, including stacks in JSON errors. GitHub Actions
 sets `RUNNER_DEBUG=1` when debug logging is enabled, so the same command automatically includes
-these details in a debug run. These settings do not enable JSON output; pass `--json` separately.
+these details in a debug run. `--no-verbose` turns verbose output off even when these are set.
+These settings do not enable JSON output; pass `--json` separately.
 
 Capture the original failure's stderr and exit code before retrying. Failures before the CLI starts,
 a rejected `--json` or `TAILOR_JSON_OUTPUT` value, argument errors in the bundled CLI plugins, and
@@ -300,7 +301,7 @@ the plugin does not need to re-implement authentication or re-resolve the active
 The token, workspace ID, and user are best-effort: whatever the current context can resolve is injected,
 and auth-free plugins still run when you are not logged in. A long-running plugin (or one started on its
 own) can obtain a fresh token at any time with `tailor auth token`, which prints a valid access token to
-stdout, refreshing it first if it has expired.
+stdout, refreshing it first if it expires within five minutes.
 
 ## Commands
 
@@ -362,23 +363,23 @@ Run ad-hoc SQL/GraphQL queries or enter the interactive REPL.
 
 Commands for authentication and user management.
 
-| Command                                          | Description                                                                           |
-| ------------------------------------------------ | ------------------------------------------------------------------------------------- |
-| [login](./cli/user.md#login)                     | Login to Tailor Platform.                                                             |
-| [logout](./cli/user.md#logout)                   | Logout from Tailor Platform.                                                          |
-| [auth](./cli/user.md#auth)                       | Authentication helpers for scripts and plugins.                                       |
-| [auth status](./cli/user.md#auth-status)         | Show the active Tailor Platform authentication status without printing tokens.        |
-| [auth token](./cli/user.md#auth-token)           | Print a valid Tailor Platform access token to stdout, refreshing it first if expired. |
-| [user](./cli/user.md#user)                       | Manage Tailor Platform users.                                                         |
-| [user current](./cli/user.md#user-current)       | Show current user.                                                                    |
-| [user list](./cli/user.md#user-list)             | List all users.                                                                       |
-| [user pat](./cli/user.md#user-pat)               | Manage personal access tokens.                                                        |
-| [user pat create](./cli/user.md#user-pat-create) | Create a new personal access token.                                                   |
-| [user pat delete](./cli/user.md#user-pat-delete) | Delete a personal access token.                                                       |
-| [user pat list](./cli/user.md#user-pat-list)     | List all personal access tokens.                                                      |
-| [user pat update](./cli/user.md#user-pat-update) | Update a personal access token (delete and recreate).                                 |
-| [user switch](./cli/user.md#user-switch)         | Set current user.                                                                     |
-| [user update](./cli/user.md#user-update)         | Set the current user's default organization and folder for new workspaces.            |
+| Command                                          | Description                                                                                                  |
+| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------ |
+| [login](./cli/user.md#login)                     | Login to Tailor Platform.                                                                                    |
+| [logout](./cli/user.md#logout)                   | Logout from Tailor Platform.                                                                                 |
+| [auth](./cli/user.md#auth)                       | Authentication helpers for scripts and plugins.                                                              |
+| [auth status](./cli/user.md#auth-status)         | Show the active Tailor Platform authentication status without printing tokens.                               |
+| [auth token](./cli/user.md#auth-token)           | Print a valid Tailor Platform access token to stdout, refreshing it first if it expires within five minutes. |
+| [user](./cli/user.md#user)                       | Manage Tailor Platform users.                                                                                |
+| [user current](./cli/user.md#user-current)       | Show current user.                                                                                           |
+| [user list](./cli/user.md#user-list)             | List all users.                                                                                              |
+| [user pat](./cli/user.md#user-pat)               | Manage personal access tokens.                                                                               |
+| [user pat create](./cli/user.md#user-pat-create) | Create a new personal access token.                                                                          |
+| [user pat delete](./cli/user.md#user-pat-delete) | Delete a personal access token.                                                                              |
+| [user pat list](./cli/user.md#user-pat-list)     | List all personal access tokens.                                                                             |
+| [user pat update](./cli/user.md#user-pat-update) | Update a personal access token (delete and recreate).                                                        |
+| [user switch](./cli/user.md#user-switch)         | Set current user.                                                                                            |
+| [user update](./cli/user.md#user-update)         | Set the current user's default organization and folder for new workspaces.                                   |
 
 ### [Organization Commands](./cli/organization.md)
 

package/docs/configuration.md

@@ -64,9 +64,9 @@ export default defineConfig({
 
 Entries are only added or overwritten. An entry removed from the config keeps its last deployed value on the platform, and labels the config does not name are left untouched. Because those retained labels count towards the platform's limit of 20 labels per resource, `deploy` reports the overflow and stops before changing the application when the labels it would leave behind exceed that limit. The labels are written when the application itself is deployed, so a config with no TailorDB, Resolver, IdP, or Auth service has no application to carry them.
 
-**Build Options**: `buildOptions` groups the settings that control how resolvers, executors, workflow jobs, and other functions are bundled: `logLevel` (below), `inlineSourcemap` (whether bundled functions embed an inline sourcemap for readable error stack traces; default `true`), `inlineSourcemapDependencySources` (below), `allowedRuntimeGlobals` (see [Node-only globals](#node-only-globals)), and `treeshake` (see [Removing unused code](#removing-unused-code)). The top-level `logLevel` and `inlineSourcemap` fields still work but are deprecated; `tailor upgrade` moves them into `buildOptions`. Setting the same option both at the top level and in `buildOptions` is rejected.
+**Build Options**: `buildOptions` groups the settings that control how resolvers, executors, workflow jobs, and other functions are bundled: `logLevel` (below), `inlineSourcemap` (whether bundled functions embed an inline sourcemap for readable error stack traces; default `true`), `inlineSourcemapDependencySources` and `inlineSourcemapProjectSources` (below), `allowedRuntimeGlobals` (see [Node-only globals](#node-only-globals)), and `treeshake` (see [Removing unused code](#removing-unused-code)). The top-level `logLevel` and `inlineSourcemap` fields still work but are deprecated; `tailor upgrade` moves them into `buildOptions`. Setting the same option both at the top level and in `buildOptions` is rejected.
 
-**Sourcemap Sources** (`buildOptions.inlineSourcemapDependencySources`): Whether the inline sourcemap embeds the source text of installed packages, that is, everything under `node_modules`. The default is `false`: only your own source files are embedded, which makes bundled functions much smaller. Error positions in stack traces resolve to the original files and lines either way. With the default, `tailor function run` and `tailor function logs` show the code snippet for a frame inside an installed package from the package's file on your machine, so the snippet is missing when that file is not installed locally (for `tailor function logs`, run it from the project directory you deployed from). Set it to `true` to embed the source text of installed packages as well, or to a list of package names such as `["kysely", "@scope/lib"]` to embed only those packages. A listed package's own dependencies are not embedded unless they are listed too. It has no effect when `inlineSourcemap` is `false`.
+**Sourcemap Sources** (`buildOptions.inlineSourcemapDependencySources`): Whether the inline sourcemap embeds the source text of installed packages, that is, everything under `node_modules`. The default is `false`: only your own source files are embedded, which makes bundled functions much smaller. Error positions in stack traces resolve to the original files and lines either way. With the default, `tailor function run` and `tailor function logs` show the code snippet for a frame inside an installed package from the package's file on your machine, so the snippet is missing when that file is not installed locally (for `tailor function logs`, run it from the project directory you deployed from). Set it to `true` to embed the source text of installed packages as well, or to a list of package names such as `["kysely", "@scope/lib"]` to embed only those packages. A listed package's own dependencies are not embedded unless they are listed too. Files under `node_modules` that belong to no package, such as a generated client in `node_modules/.prisma`, are embedded only when the option is `true`. It has no effect when `inlineSourcemap` is `false`.
 
 ```typescript
 export default defineConfig({
@@ -79,6 +79,17 @@ export default defineConfig({
 
 This is a bundle-time setting. It affects newly bundled deployments; already deployed functions keep the sourcemap they were deployed with until they are redeployed.
 
+**Project Sourcemap Sources** (`buildOptions.inlineSourcemapProjectSources`): Which of your own source files embed their text in the inline sourcemap. By default all of them do. `include` and `exclude` are globs relative to the directory containing your config file, written without a leading `./` (a `./` prefix is ignored). Only files matching `include` (all files when omitted) and not matching `exclude` keep their text. `**` does not match a dot-directory such as `src/.cache`. Files under `node_modules` are controlled by `inlineSourcemapDependencySources` instead. Error positions still resolve to the original files and lines, but `tailor function run` shows no code snippet for a frame in a file whose text is left out. It has no effect when `inlineSourcemap` is `false`.
+
+```typescript
+export default defineConfig({
+  name: "my-app",
+  buildOptions: {
+    inlineSourcemapProjectSources: { exclude: ["src/generated/**"] },
+  },
+});
+```
+
 **Log Level** (`buildOptions.logLevel`): Controls which `console.*` and `logger.*` (from `@tailor-platform/sdk/runtime`) calls are kept when deployment functions are bundled. Supported values are `"DEBUG"`, `"INFO"`, `"WARN"`, `"ERROR"`, and `"SILENT"`. The default is `"DEBUG"` and keeps all calls. `console.log` is treated as a DEBUG-level call (matching the platform's OpenTelemetry severity mapping), so it is dropped at `"INFO"` and above, alongside `console.debug` and `logger.debug`. `logger.setAttributes` has no severity and is never dropped, regardless of `logLevel`. For production deployments, use `"WARN"` to keep warn/error calls while dropping debug, log, and info calls:
 
 ```typescript

package/docs/github-actions.md

@@ -249,6 +249,29 @@ For a preview target, the name can be at most 50 characters: each pull request
 gets its own workspace named `<name>-pr-<number>`, which must fit in 63
 characters.
 
+### Preview target (per-pull-request workspace)
+
+The preview target deploys each pull request to its own workspace and deletes
+that workspace when the pull request is closed:
+
+```bash
+tailor setup ci preview --name my-app --region asia-northeast
+```
+
+Fork pull requests are skipped. Every other pull request gets a preview, draft
+pull requests included. `--require` narrows that to one of:
+
+- `--require ready` skips draft pull requests. The preview is deployed when the
+  draft is marked ready for review.
+- `--require label` deploys only pull requests labeled `tailor:preview`. A
+  labeled draft deploys too, because the label asks for the preview.
+
+When `tailor setup update` regenerates a preview target generated before
+`--require` existed, it reads the target as `--require ready`, or as
+`--require label` if it required the label. The first keeps skipping drafts; the
+second now also deploys a labeled draft. To deploy drafts as well, run
+`tailor setup ci preview` again without `--require`.
+
 ## Targeting a workspace
 
 The generated `plan` and `deploy` jobs target a workspace by **id**, read from
@@ -385,8 +408,8 @@ A job that runs `tailor` against the workspace needs the machine-user
 that only uses `app-url`, such as end-to-end tests, does not.
 
 The job is skipped whenever `tailor-preview-deploy` is skipped: when a pull
-request is closed, for draft and fork pull requests, and for unlabeled ones with
-`--require-preview-label`.
+request is closed, for fork pull requests, for draft pull requests with
+`--require ready`, and for unlabeled ones with `--require label`.
 
 A preview workspace expires 7 days (`ttl: 7d` on `tailor-preview-deploy`) after
 the last push to its pull request. When a pull request is closed,
@@ -476,11 +499,11 @@ failed also counts as passing, so list every job of yours whose failure should
 block merging, not only the last one: above, `seed` is listed because `e2e`
 needs it.
 
-With `--require-preview-label`, the preview workflow does not start when a pull
-request is opened, so its check is not reported until the pull request is
-labeled, reopened, or pushed to. A draft pull request skips the preview deploy,
-and marking it ready for review does not start the workflow, so the check that
-passed while it was a draft stays until the next push. Tag workflows have no
+With `--require label`, the preview workflow does not start when a pull request
+is opened, so its check is not reported until the pull request is labeled,
+reopened, or pushed to. With `--require ready`, a draft pull request skips the
+preview deploy and its check passes; marking it ready for review starts the
+workflow, so the deploy and its check follow right away. Tag workflows have no
 such job: they run on tags, not on pull requests.
 
 ### `.github/tailor.lock`
@@ -758,7 +781,7 @@ Before enabling it, note that:
   and validation run, `updatedAt` changes, and executors with
   `recordUpdatedTrigger` fire once per seeded row on every deploy.
 - Every preview deploy deletes the data reviewers added to the preview
-  workspace. That is every push, and with `--require-preview-label` also every
+  workspace. That is every push, and with `--require label` also every
   label added to the pull request, since each one redeploys the preview.
 - A seed failure fails the deploy job and its notification, although the deploy
   itself went through.
@@ -1016,8 +1039,8 @@ targets it reports.
 Workflows generated by `setup ci branch`, `setup ci tag`, and `setup ci preview`
 self-audit: each contains a `tailor-drift-check` step that
 runs the check in CI. Preview workflows run it alongside each preview deploy,
-so pull requests that deploy no preview (drafts, fork PRs, and unlabeled PRs
-in label-triggered mode) skip the check. A single run audits every target
+so pull requests that deploy no preview (drafts with `--require ready`, fork
+PRs, and unlabeled PRs with `--require label`) skip the check. A single run audits every target
 recorded in `.github/tailor.lock`.
 
 Drift findings are advisory by default. Set the repository variable

package/docs/services/secret.md

@@ -32,6 +32,12 @@ workspace/
     └── analytics-connection-string
 ```
 
+### Reserved Vault Names
+
+Vault names that start with `tailor--` (two hyphens) are reserved in advance for the platform and have no use today. Declaring such a vault in `defineSecretManager()` prints a warning on `tailor deploy` and will become an error in v3. A name that starts with a single `tailor-`, such as `tailor-reports`, is not reserved.
+
+`tailor deploy` also creates a vault named `idp-<namespace>-<client>` for each IdP client of your application. A declared vault with exactly that name is an error, because both would write to the same vault.
+
 ### Secrets
 
 Secrets are key-value pairs stored within a vault. Secret values are encrypted at rest and only accessible at runtime by authorized services.