Update SDK pages

Author: tailor-docs-bot[bot]

docs/sdk/services/auth.md

@@ -256,9 +256,9 @@ Get a machine user token using the CLI:
 tailor-sdk machineuser token <name>
 ```
 
-### Using auth.invoker()
+### Specifying a machine user invoker
 
-The `auth.invoker()` method creates a type-safe reference to a machine user for use in workflow triggers. This specifies which machine user's permissions should be used when executing the workflow.
+Resolvers, executors, and `workflow.trigger()` accept an `authInvoker` option that chooses which machine user runs the operation. Pass the machine user name as a plain string — it is type-narrowed to the names you registered in `machineUsers`.
 
 ```typescript
 // tailor.config.ts
@@ -275,7 +275,6 @@ export const auth = defineAuth("my-auth", {
 ```typescript
 // resolvers/trigger-workflow.ts
 import { createResolver, t } from "@tailor-platform/sdk";
-import { auth } from "../tailor.config";
 import myWorkflow from "../workflows/my-workflow";
 
 export default createResolver({
@@ -288,7 +287,7 @@ export default createResolver({
     // Trigger workflow with machine user permissions
     const workflowRunId = await myWorkflow.trigger(
       { id: input.id },
-      { authInvoker: auth.invoker("admin-machine-user") },
+      { authInvoker: "admin-machine-user" },
     );
     return { workflowRunId };
   },
@@ -298,7 +297,9 @@ export default createResolver({
 });
 ```
 
-The `invoker()` method is type-safe and only accepts machine user names defined in the auth configuration.
+Type narrowing is provided by the generated `tailor.d.ts` (the `MachineUserNameRegistry` interface). Run `tailor-sdk generate` (or `apply`) after defining new machine users to refresh it.
+
+> **Deprecated:** The `auth.invoker("<name>")` helper is still available for backward compatibility. Prefer the string form — it does not require importing `auth` from `tailor.config.ts` into runtime files, avoiding bundling config-layer (Node-only) dependencies.
 
 ## OAuth 2.0 Clients
 

docs/sdk/services/executor.md

@@ -294,31 +294,24 @@ createExecutor({
 
 ### Authentication for Operations
 
-GraphQL and Workflow operations can specify an `authInvoker` to execute with machine user credentials:
+GraphQL and Workflow operations can specify an `authInvoker` to execute with machine user credentials. Pass the machine user name as a plain string — it is type-narrowed to the names defined in your auth config:
 
 ```typescript
-import { defineAuth, createExecutor, scheduleTrigger } from "@tailor-platform/sdk";
-
-const auth = defineAuth("my-auth", {
-  // ... auth configuration
-  machineUsers: {
-    "batch-processor": {
-      attributes: { role: "ADMIN" },
-    },
-  },
-});
+import { createExecutor, scheduleTrigger } from "@tailor-platform/sdk";
 
 export default createExecutor({
   name: "scheduled-cleanup",
   trigger: scheduleTrigger({ cron: "0 0 * * *" }),
   operation: {
     kind: "graphql",
     query: `mutation { cleanupOldRecords { count } }`,
-    authInvoker: auth.invoker("batch-processor"),
+    authInvoker: "batch-processor",
   },
 });
 ```
 
+> **Deprecated:** `auth.invoker("batch-processor")` still works, but is deprecated. Prefer the string form to avoid importing config-layer modules into runtime files.
+
 ## Event Payloads
 
 Each trigger type provides specific context data in the callback functions.

docs/sdk/services/resolver.md

@@ -350,19 +350,10 @@ createResolver({
 
 ## Authentication
 
-Specify an `authInvoker` to execute the resolver with machine user credentials:
+Specify an `authInvoker` to execute the resolver with machine user credentials. Pass the machine user name as a plain string — it is type-narrowed to the names you defined in your auth config:
 
 ```typescript
-import { defineAuth, createResolver, t } from "@tailor-platform/sdk";
-
-const auth = defineAuth("my-auth", {
-  // ... auth configuration
-  machineUsers: {
-    "batch-processor": {
-      attributes: { role: "ADMIN" },
-    },
-  },
-});
+import { createResolver, t } from "@tailor-platform/sdk";
 
 export default createResolver({
   name: "adminQuery",
@@ -372,10 +363,12 @@ export default createResolver({
     // Executes as "batch-processor" machine user
     return { result: "ok" };
   },
-  authInvoker: auth.invoker("batch-processor"),
+  authInvoker: "batch-processor",
 });
 ```
 
-The `authInvoker` option accepts the return value of `auth.invoker()`, which specifies the auth namespace and machine user name.
+The machine user name is looked up in the auth service configured on your app (`machineUsers` in `defineAuth`). The namespace is resolved automatically — no need to import `auth` from `tailor.config.ts` in resolver files.
+
+> **Deprecated:** `auth.invoker("batch-processor")` still works, but is deprecated. Importing `auth` into runtime files pulls config-layer (Node-only) dependencies into the bundle.
 
 **Note:** `authInvoker` controls the permissions for database operations and other platform actions, but the `user` object passed to the `body` function still reflects the original caller who invoked the resolver.

docs/sdk/services/workflow.md

@@ -227,11 +227,10 @@ export default createWorkflow({
 You can start a workflow execution from a resolver using `workflow.trigger()`.
 
 - `workflow.trigger(args, options?)` returns a workflow run ID (`Promise<string>`).
-- To run with machine-user permissions, pass `{ authInvoker: auth.invoker("<machine-user>") }`.
+- To run with machine-user permissions, pass `{ authInvoker: "<machine-user>" }`. The name is type-narrowed to the machine users defined in your auth config.
 
 ```typescript
 import { createResolver, t } from "@tailor-platform/sdk";
-import { auth } from "../tailor.config";
 import orderProcessingWorkflow from "../workflows/order-processing";
 
 export default createResolver({
@@ -244,7 +243,7 @@ export default createResolver({
   body: async ({ input }) => {
     const workflowRunId = await orderProcessingWorkflow.trigger(
       { orderId: input.orderId, customerId: input.customerId },
-      { authInvoker: auth.invoker("manager-machine-user") },
+      { authInvoker: "manager-machine-user" },
     );
 
     return { workflowRunId };
@@ -255,6 +254,8 @@ export default createResolver({
 });
 ```
 
+> **Deprecated:** `auth.invoker("manager-machine-user")` still works but is deprecated. Using the string form avoids importing `auth` into runtime code.
+
 See the full working example in the repository: [example/resolvers/triggerWorkflow.ts](../../../../example/resolvers/triggerWorkflow.ts).
 
 ## File Organization