[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@tailor-platform/sdk (source)	2.28.0 → 2.32.0

---

Release Notes

tailor-platform/sdk (@​tailor-platform/sdk)

v2.32.0

Compare Source

Minor Changes

• #​2697 8706209 Thanks @​dqn! - Add a provider-independent System One client for boolean, choice, and ordered score decisions through AI Gateway.

• #​2727 cc8a577 Thanks @​toiroakr! - tailordb migration test now records a 24-hour expiry on every temporary workspace it creates, right after creating it. If the run is interrupted (for example, a cancelled CI job), the workspace stays and tailor workspace prune --expired deletes it once the expiry has passed. A workspace given with --target-workspace-id gets no expiry, and --keep without --keep-ttl still records none.

• #​2696 dc605c2 Thanks @​toiroakr! - kyselyTypePlugin's pgliteSchemaPath script now enforces relations: a row pointing at a parent that does not exist is rejected, as on the platform. Tests that insert child rows before their parents must create the parents first.

  A relation to a field other than id that is not unique, or whose type differs from the referencing field, fails generation, as the platform rejects it on deploy.

Patch Changes

• #​2725 c85d2d8 Thanks @​dqn! - Fix migration detection and Pre-phase relaxation for nested required and enum constraints, and reject unsupported nested shape changes and rename combinations.

• #​2724 6152316 Thanks @​dqn! - tailor deploy and tailor remove no longer fail when deleting an IdP client whose Secret Manager vault (idp-<namespace>-<client>) has already been deleted.

• 127454d Thanks @​haru0017! - Re-apply rolldown 1.2.14

  rolldown's output was fine; the crash came from another platform dependency, which has been fixed, so the temporary downgrade to 1.2.13 is no longer needed.

• #​2685 3b21d1c Thanks @​dqn! - Split how tailor deploy applies TailorDB changes and migrations into smaller steps. No observable behavior change.

• #​2707 ab7cb70 Thanks @​renovate! - fix(deps): update dependency kysely to v0.29.7

• #​2716 698343b Thanks @​renovate! - fix(deps): update dependency execa to v10.2.0

• #​2726 bfea8a3 Thanks @​dqn! - Fix migration templates to replace removed enum values within array fields while preserving other elements.

v2.30.0

Compare Source

Minor Changes

• #​2686 b77ebdd Thanks @​toiroakr! - tailor machineuser list no longer outputs clientSecret, and MachineUserInfo.clientSecret returned by listMachineUsers is now an optional property that is never set and is marked @deprecated. The Platform is moving to return a machine user's secret only from the single-user get call, so that a read-only credential can list machine users. TypeScript code that reads MachineUserInfo.clientSecret keeps compiling but receives undefined; scripts that read clientSecret from the JSON output of machineuser list no longer find the key. Use tailor machineuser token <name> to obtain an access token for a machine user instead.

• #​2647 e45ca2b Thanks @​toiroakr! - The password of IdP users (_User) can now come from the SEED_USER_PASSWORD environment variable. A _User row without a password gets it from the variable: a plain string is used for every such user, and a JSON object such as {"alice@example.com":"..."} sets it per user name. A password written in _User.jsonl is kept, and with --upsert the variable only sets the password of users that do not exist yet. tailor seed validate and tailor seed apply both apply it, and the generated _User.schema.ts calls it from its hook, so run tailor generate to update existing projects. The workflows tailor setup ci generates pass the SEED_USER_PASSWORD secret to the seed steps; run tailor setup update to regenerate them.

Patch Changes

• #​2683 2905c85 Thanks @​dqn! - Hide secrets that contain a line break or a quote in CLI errors and suggested commands. Values the CLI masks as <redacted>, such as client secrets and access tokens, appeared unmasked in multi-line error details and suggestions, in suggested commands, and in the matching GitHub Actions annotation.

• #​2668 ad679fa Thanks @​dqn! - Hide secrets in CLI log output and --json error output when only part of the value is highlighted, and in progress spinner lines. Values the CLI masks as <redacted>, such as client secrets and access tokens, appeared unmasked in these cases. --json error output no longer includes color codes in its string values.

• #​2689 9bffa6e Thanks @​renovate! - fix(deps): update dependency lines-db to v0.18.0

• #​2699 ae44247 Thanks @​haru0017! - Revert "fix(deps): update dependency rolldown to v1.2.14"

  rolldown 1.2.14 can emit a malformed source map (a negative source line) for bundled functions, which can crash the platform runtime on debug builds while source-mapping a thrown error's stack trace. Downgrade to 1.2.13 as a temporary measure until the rolldown regression is resolved.

• #​2693 373dafd Thanks @​toiroakr! - Stop tailor deploy from reporting Table '<name>' scripts differ between remote and snapshot when machines with different system locales deploy the same schema. The TailorDB script hash ordered field names by the machine's default locale (for example, Czech sorts ch after h), so the same schema could hash differently and fail the deploy with remote schema drift. Hashes from en-US, ja-JP and C locales are unchanged. A table with scripts that was last deployed from a locale that orders its field names differently from English (for example cs-CZ, sk-SK, lt-LT or et-EE) may report this drift after upgrading, because the hash stored on the remote was computed in that locale's order.

v2.29.2

Compare Source

Patch Changes

• #​2639 48377b3 Thanks @​renovate! - fix(deps): update dependency execa to v10.1.1

• #​2675 4c63cf3 Thanks @​renovate! - fix(deps): update dependency @​​politty/zod to v0.5.2

• #​2676 d1479d8 Thanks @​renovate! - fix(deps): update dependency @​​toiroakr/read-multiline to v0.4.3

• #​2677 5fd1e48 Thanks @​renovate! - fix(deps): update dependency rolldown to v1.2.14

• #​2678 80d7b54 Thanks @​renovate! - fix(deps): update dependency temporal-polyfill to v1.0.6

• #​2663 587fd77 Thanks @​dqn! - Report invalid configs and SDK definitions with specific error codes that list each offending field, instead of UNEXPECTED_ERROR carrying the raw validation output:

  • CONFIG_INVALID: tailor.config.ts fails validation, in its top-level fields, its plugins export, or a TailorDB, IdP, Auth, static website, AI Gateway, or secret manager config. Each field is named by its path in the failing export, such as auth.machineUserAttributes.role or a plugins item's index. Under --json, error.context carries file, exportName, and issues (path and message per field), plus configKey and name for a service.
  • DEFINITION_INVALID: a resolver, executor, TailorDB type, HTTP adapter, workflow, or workflow job fails validation. error.context carries kind, file, exportName, and issues.
  • OPTIONS_INVALID: options passed to an SDK function such as listWorkspaces() fail validation. The message is unchanged, and error.context.issues lists each field.
  • MIGRATION_FILE_INVALID: an invalid schema snapshot or migration diff now lists its fields in the same format, with error.context.issues.
  • DEFINITION_EXPORT_INVALID: a workflow or HTTP adapter is exported under a name, or a workflow job is the default export. A misplaced workflow or job was previously reported with validation errors that did not apply to it.

v2.29.1

Compare Source

Patch Changes

• #​2653 98d8d01 Thanks @​toiroakr! - Move the TailorDB guides under docs/services/tailordb/: the service guide is now docs/services/tailordb/index.md and the migration guide docs/services/tailordb/migration.md. Add a docs/data-clone.md guide for tailor data clone, and note that tailor tailordb migration test --data clone copies TailorDB records only, without the --copy-files and --copy-idp-users options of data clone.

v2.29.0

Compare Source

Minor Changes

• #​2631 9f617fa Thanks @​toiroakr! - Add buildOptions.treeshake to defineConfig to control how unused code is removed from bundled functions. Set propertyReadSideEffects: false to drop calls whose arguments only read properties, which keeps modules a function never reaches out of its bundle. moduleSideEffects, annotations, and unknownGlobalSideEffects override the SDK's defaults. Nothing changes unless you set it.

• #​2584 78acf8d Thanks @​toiroakr! - Add tailor tailordb migration resolve to settle a migration that a failed deploy left in progress. --rollback returns the namespace to the schema before the failed migration and leaves the checkpoint where it was, so the next deploy runs that migration again from its first step. --complete applies the schema of the failed migration, moves the checkpoint to it without running its migrate.ts again, and is meant for use after you repaired the data by hand. Both options clear the in-progress record, take the namespace's tables out of maintenance mode, and remove the temporary resources of the failed run, so deploy and the other migration commands work again.

• #​2635 9fb24be Thanks @​toiroakr! - Leave the source text of installed packages (everything under node_modules) out of the inline sourcemap in bundled resolvers, executors, workflow jobs, and auth hooks. The sourcemap makes up most of a bundled function's size, so this makes the bundles much smaller: in one project's resolver bundles the median dropped from 5.7 MB to 3.1 MB. Error positions in stack traces still resolve to the original files and lines, and your own source text is still embedded. tailor function run and tailor function logs show the code snippet for a frame inside an installed package from the package's file in your local node_modules. tailor function logs also no longer prints the paths of a deployed function's files one folder too high (../src/handler.ts instead of ./src/handler.ts). Set buildOptions.inlineSourcemapDependencySources: true to embed the source text of installed packages as before, or list package names (for example ["kysely"]) to embed only those.

• #​2660 df71b44 Thanks @​dqn! - The tailor CLI, the setup, seed, and TailorDB ERD plugins, create-sdk, and the codemod CLI now exit with code 2 when they reject the command line itself, such as an unknown option or subcommand, an unexpected argument, or an option value that fails validation, so scripts and agents can tell a mistyped command from one that failed while running, which still exits with 1. A command that only warns about an unknown option or an extra argument, such as create-sdk, keeps running as before. A script that checks for exactly 1 after a mistyped command needs to accept 2. runMain and runCommand from @tailor-platform/sdk/cli follow the same rule, so a CLI plugin built on them exits with 2 for these errors, and runCommand reports them with exitCode 2.

Patch Changes

• #​2649 e0fb7c0 Thanks @​dqn! - Fix tailor deploy --dry-run --json reporting resourceType in warnings and conflicts as the display name from the human-readable plan, such as Executor or TailorDB service. It now reports a stable identifier such as executor or tailordb.service, and the human-readable plan is unchanged. The values change as follows:

  Before	After
  Application	application
  AIGateway	aigateway
  Auth connection	auth.connection
  Auth service	auth.service
  Executor	executor
  Function registry	function_registry
  IdP service	idp.service
  Pipeline service	pipeline.service
  Secret Manager vault	secret.vault
  StaticWebsite	staticwebsite
  TailorDB service	tailordb.service
  Workflow	workflow
  Workflow execution policy	workflow_job_function_execution_policy
  secret (skipped secrets)	secret.secret

• #​2652 ac872f3 Thanks @​dqn! - Guard the resourceType values in tailor deploy --dry-run --json output against accidental changes. No observable behavior change.

• #​2640 4b626ce Thanks @​dqn! - When tailor deploy is given multiple configs that define the same resource name, the DEPLOY_DUPLICATE_RESOURCE_NAME error now lists every duplicate in one run, each with its resource type, name, and the config files that define it, instead of stopping at the first one. With --json, the duplicates are also available in error.context.duplicates.

• #​2659 3accb07 Thanks @​dqn! - Hide secrets in the GitHub Actions ::error:: annotation a failed command writes. Values the CLI already masks as <redacted> in its log output, such as client secrets and access tokens, appeared unmasked in the annotation when they were part of the error.

• #​2646 76d4f9c Thanks @​toiroakr! - fix(deps): migrate from @​toiroakr/lines-db to lines-db

• #​2626 c97c8f3 Thanks @​dqn! - Keep tailor deploy migrations within their own TailorDB namespace when a table name exists in more than one, such as after moving a table between namespaces. A migration in one namespace could write its own schema over another namespace's table of the same name, fail the deploy by creating that table a second time, delete that table before the other namespace's migration script read it, or skip writing that table's metadata.

• #​2627 9cc6efb Thanks @​dqn! - Find tables in TailorDB namespaces with more than 50 tables in tailor tailordb truncate <tables...>, and in tailor query --engine sql for apps with more than one TailorDB namespace. Tables created after the first 50 in a namespace were reported as The following tables were not found in any namespace or Could not find namespace for tables in query. When listing a namespace's tables fails, both commands now stop with that error instead of skipping that namespace and continuing with the others.

• #​2621 1108cb3 Thanks @​renovate! - fix(deps): update @​​opentelemetry

• #​2638 55c8466 Thanks @​renovate! - fix(deps): update dependency zod to v4.6.7

• #​2641 5dd5e9c Thanks @​renovate! - fix(deps): update oxc

• #​2601 00c5613 Thanks @​dqn! - The workflows tailor setup ci generates now run on GitHub Enterprise Server: the plan comment, change detection, preview deployment, and ERD preview comment call the GitHub API of the server the workflow runs on instead of github.com. Run tailor setup update to regenerate existing workflows.

  GitHub Enterprise Server does not support the artifact upload the ERD preview uses, so pass --ghes with --erd-preview to tailor setup ci branch there: each ERD viewer is then uploaded as a zip file, and the pull request comment links to the workflow run. The GitHub Actions guide lists the runner and action setup GitHub Enterprise Server needs.

• #​2643 f5c304f Thanks @​dqn! - Add tailor setup ci env --check, which reads GitHub with gh and reports which secrets and variables each GitHub Environment used by the generated workflows still lacks. It fails when a required entry is missing, only reports missing optional ones, and prints the gh commands that set the missing entries together with where each value comes from. Entries set on the repository or organization count as registered, and an entry registered as the wrong kind (a secret where the workflow reads a variable) is pointed out. When gh is not installed, not logged in, or cannot read the repository's secrets and variables, the check says so instead of reporting entries as missing. The next steps printed after tailor setup ci branch, tag, and preview now suggest running it.

  When the origin remote is not on github.com, tailor setup ci env now names the repository that gh repo view reports, with its host on GitHub Enterprise Server, instead of leaving it to gh at run time: the printed gh commands pass that host, and the Terraform output sets GITHUB_BASE_URL to it. --check prints its commands for the host it checked. When gh cannot tell the repository, the output says how to point gh and Terraform at a GitHub Enterprise Server host.

• #​2645 c12410d Thanks @​toiroakr! - Fix Cannot find package '@/...' from commands that load tailor.config.ts (for example tailor generate) when the project uses tsconfig paths aliases together with pnpm 11.23.0 or later and enableGlobalVirtualStore: true. pnpm's NODE_PATH resolve hook retries a failed import with a different parentURL and leaves it on the hook's context, so the TypeScript loader looked for tsconfig.json from node_modules instead of from the importing file. The loader now reads the importer before resolving and uses that value afterwards.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[anukiransolur]

@tailor-platform/sdk 2.28.0 → 2.32.0 (2.29.0–2.29.2, 2.30.0, 2.32.0). Behavior changes reviewed against the tutorial steps, none apply: CLI usage errors now exit 2; deploy --dry-run --json resourceType values; machineuser list drops clientSecret; kyselyTypePlugin pgliteSchemaPath relation enforcement (steps only set distPath). Remaining changes are bug fixes, secret-masking hardening, smaller bundles, and opt-in features. CI (generate, typecheck, lint, format:check) passes on all steps. Safe to merge.