@tailor-platform/sdk 1.70.1 → 1.72.0

package/dist/types-v_ErzNUF.d.mts

@@ -0,0 +1,345 @@
+import { o as TailorEnv } from "./types-DTcZ2Yax.mjs";
+import { C as FieldMetadata, D as TailorField, F as output, O as TailorFieldType, m as TailorDBInstance, x as DefinedFieldMetadata } from "./types-rj8YJcEe.mjs";
+import { IsAny, JsonObject, JsonValue } from "type-fest";
+
+//#region src/types/auth-connection.generated.d.ts
+type AuthConnectionOAuth2Config = {
+  /** OAuth2 provider URL */providerUrl: string; /** OAuth2 issuer URL */
+  issuerUrl: string; /** OAuth2 client ID */
+  clientId: string; /** OAuth2 client secret */
+  clientSecret: string; /** OAuth2 authorization endpoint override */
+  authUrl?: string | undefined; /** OAuth2 token endpoint override */
+  tokenUrl?: string | undefined;
+};
+type AuthConnectionConfig = {
+  type: "oauth2";
+  providerUrl: string;
+  issuerUrl: string;
+  clientId: string;
+  clientSecret: string;
+  authUrl?: string | undefined;
+  tokenUrl?: string | undefined;
+};
+//#endregion
+//#region src/types/auth.generated.d.ts
+type AuthInvokerObject = {
+  /** Auth namespace */namespace: string; /** Machine user name for authentication */
+  machineUserName: string;
+};
+type AuthInvoker = AuthInvokerObject;
+type OIDC = {
+  /** Identity provider name */name: string;
+  kind: "OIDC"; /** OAuth2 client ID */
+  clientID: string; /** OAuth2 client secret */
+  clientSecret: {
+    vaultName: string;
+    secretKey: string;
+  }; /** OIDC provider URL */
+  providerURL: string; /** OIDC issuer URL (defaults to providerURL) */
+  issuerURL?: string | undefined; /** JWT claim to use as username */
+  usernameClaim?: string | undefined;
+};
+type SAML = {
+  /** Identity provider name */name: string;
+  kind: "SAML"; /** Enable signing of SAML requests */
+  enableSignRequest: boolean; /** URL to fetch SAML metadata (mutually exclusive with rawMetadata) */
+  metadataURL?: string | undefined; /** Raw SAML metadata XML (mutually exclusive with metadataURL) */
+  rawMetadata?: string | undefined; /** URL to redirect to when SAML ACS receives a response with an empty RelayState. */
+  defaultRedirectURL?: string | undefined;
+};
+type IDToken = {
+  /** Identity provider name */name: string;
+  kind: "IDToken"; /** ID token provider URL */
+  providerURL: string; /** Client ID for ID token validation */
+  clientID: string; /** ID token issuer URL */
+  issuerURL?: string | undefined; /** JWT claim to use as username */
+  usernameClaim?: string | undefined;
+};
+type BuiltinIdP = {
+  /** Identity provider name */name: string;
+  kind: "BuiltInIdP"; /** IdP namespace */
+  namespace: string; /** OAuth2 client name in the IdP */
+  clientName: string;
+};
+type IdProvider = OIDC | SAML | IDToken | BuiltinIdP;
+type OAuth2ClientInput = {
+  /** Allowed redirect URIs */redirectURIs: (`https://${string}` | `http://${string}` | `${string}:url` | `${string}:url/${string}`)[]; /** Client description */
+  description?: string | undefined; /** Allowed OAuth2 grant types */
+  grantTypes?: ("authorization_code" | "refresh_token")[] | undefined; /** OAuth2 client type */
+  clientType?: "confidential" | "public" | "browser" | undefined; /** Access token lifetime in seconds (60-86400) */
+  accessTokenLifetimeSeconds?: number | undefined; /** Refresh token lifetime in seconds (60-604800) */
+  refreshTokenLifetimeSeconds?: number | undefined; /** Require DPoP (Demonstrating Proof-of-Possession) for token requests */
+  requireDpop?: boolean | undefined;
+};
+type OAuth2Client = {
+  /** Allowed OAuth2 grant types */grantTypes: ("authorization_code" | "refresh_token")[]; /** Allowed redirect URIs */
+  redirectURIs: (`https://${string}` | `http://${string}` | `${string}:url` | `${string}:url/${string}`)[]; /** Access token lifetime in seconds (60-86400) */
+  accessTokenLifetimeSeconds: {
+    seconds: bigint;
+    nanos: number;
+  } | undefined; /** Refresh token lifetime in seconds (60-604800) */
+  refreshTokenLifetimeSeconds: {
+    seconds: bigint;
+    nanos: number;
+  } | undefined; /** Client description */
+  description?: string | undefined; /** OAuth2 client type */
+  clientType?: "confidential" | "public" | "browser" | undefined; /** Require DPoP (Demonstrating Proof-of-Possession) for token requests */
+  requireDpop?: boolean | undefined;
+};
+type SCIMAuthorization = {
+  /** SCIM authorization type */type: "oauth2" | "bearer"; /** Bearer token secret (required for bearer type) */
+  bearerSecret?: {
+    vaultName: string;
+    secretKey: string;
+  } | undefined;
+};
+type SCIMAttribute = {
+  /** Attribute data type */type: "string" | "number" | "boolean" | "datetime" | "complex"; /** Attribute name */
+  name: string; /** Attribute description */
+  description?: string | undefined; /** Attribute mutability */
+  mutability?: "readOnly" | "readWrite" | "writeOnly" | undefined; /** Whether the attribute is required */
+  required?: boolean | undefined; /** Whether the attribute can have multiple values */
+  multiValued?: boolean | undefined; /** Uniqueness constraint */
+  uniqueness?: "none" | "server" | "global" | undefined; /** List of canonical values */
+  canonicalValues?: string[] | null | undefined;
+  subAttributes?: SCIMAttribute[] | null | undefined;
+};
+type SCIMAttributeMapping = {
+  /** TailorDB field name to map to */tailorDBField: string; /** SCIM attribute path */
+  scimPath: string;
+};
+type SCIMResource = {
+  /** SCIM resource name */name: string; /** TailorDB namespace for the resource */
+  tailorDBNamespace: string; /** TailorDB type name for the resource */
+  tailorDBType: string; /** Core SCIM schema definition */
+  coreSchema: {
+    /** SCIM resource name */name: string;
+    attributes: {
+      type: "string" | "number" | "boolean" | "datetime" | "complex"; /** SCIM resource name */
+      name: string;
+      description?: string | undefined;
+      mutability?: "readOnly" | "readWrite" | "writeOnly" | undefined;
+      required?: boolean | undefined;
+      multiValued?: boolean | undefined;
+      uniqueness?: "none" | "server" | "global" | undefined;
+      canonicalValues?: string[] | null | undefined;
+      subAttributes?: any[] | null | undefined;
+    }[];
+  }; /** Attribute mapping configuration */
+  attributeMapping: {
+    tailorDBField: string;
+    scimPath: string;
+  }[];
+};
+type SCIMConfig = {
+  /** Machine user name for SCIM operations */machineUserName: string; /** SCIM authorization configuration */
+  authorization: {
+    type: "oauth2" | "bearer";
+    bearerSecret?: {
+      vaultName: string;
+      secretKey: string;
+    } | undefined;
+  }; /** SCIM resource definitions */
+  resources: {
+    name: string;
+    tailorDBNamespace: string;
+    tailorDBType: string;
+    coreSchema: {
+      name: string;
+      attributes: {
+        type: "string" | "number" | "boolean" | "datetime" | "complex";
+        name: string;
+        description?: string | undefined;
+        mutability?: "readOnly" | "readWrite" | "writeOnly" | undefined;
+        required?: boolean | undefined;
+        multiValued?: boolean | undefined;
+        uniqueness?: "none" | "server" | "global" | undefined;
+        canonicalValues?: string[] | null | undefined;
+        subAttributes?: any[] | null | undefined;
+      }[];
+    };
+    attributeMapping: {
+      tailorDBField: string;
+      scimPath: string;
+    }[];
+  }[];
+};
+type TenantProvider = {
+  /** TailorDB namespace for the tenant type */namespace: string; /** TailorDB type name for tenants */
+  type: string; /** Field used as the tenant signature */
+  signatureField: string;
+};
+//#endregion
+//#region src/configure/services/auth/types.d.ts
+type OAuth2ClientGrantType = OAuth2Client["grantTypes"][number];
+type SCIMAttributeType = SCIMAttribute["type"];
+type AuthInvokerWithName<M extends string> = Omit<AuthInvoker, "machineUserName"> & {
+  machineUserName: M;
+};
+/** Result of retrieving a connection token at runtime. */
+type AuthConnectionTokenResult = {
+  access_token: string;
+};
+type ValueOperand = string | boolean | string[] | boolean[];
+type AuthAttributeValue = ValueOperand | null | undefined;
+type UserFieldKeys<User extends TailorDBInstance> = keyof output<User> & string;
+type FieldDefined<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = User["fields"][Key] extends {
+  _defined: infer Defined;
+} ? Defined : never;
+type FieldOutput<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = output<User>[Key];
+type FieldIsRequired<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = undefined extends FieldOutput<User, Key> ? false : true;
+type FieldIsOfType<User extends TailorDBInstance, Key extends UserFieldKeys<User>, Type extends string> = FieldDefined<User, Key> extends {
+  type: Type;
+} ? true : false;
+type FieldIsArray<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = FieldDefined<User, Key> extends {
+  array: true;
+} ? true : false;
+type FieldIsUnique<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = FieldDefined<User, Key> extends {
+  unique: true;
+} ? true : false;
+type FieldSupportsValueOperand<User extends TailorDBInstance, Key extends UserFieldKeys<User>> = FieldOutput<User, Key> extends ValueOperand | null | undefined ? true : false;
+type UsernameFieldKey<User extends TailorDBInstance> = IsAny<User> extends true ? string : { [K in UserFieldKeys<User>]: FieldIsRequired<User, K> extends true ? FieldIsOfType<User, K, "string"> extends true ? FieldIsArray<User, K> extends true ? never : FieldIsUnique<User, K> extends true ? K : never : never : never }[UserFieldKeys<User>];
+type UserAttributeKey<User extends TailorDBInstance> = { [K in UserFieldKeys<User>]: K extends "id" ? never : FieldSupportsValueOperand<User, K> extends true ? FieldIsOfType<User, K, "datetime" | "date" | "time"> extends true ? never : K : never }[UserFieldKeys<User>];
+type UserAttributeListKey<User extends TailorDBInstance> = { [K in UserFieldKeys<User>]: K extends "id" ? never : FieldIsOfType<User, K, "uuid"> extends true ? FieldIsArray<User, K> extends true ? never : K : never }[UserFieldKeys<User>];
+type UserAttributeMap<User extends TailorDBInstance> = { [K in UserAttributeKey<User>]?: true };
+type DisallowExtraKeys<T, Allowed extends PropertyKey> = T & { [K in Exclude<keyof T, Allowed>]: never };
+type AttributeListValue<User extends TailorDBInstance, Key extends UserAttributeListKey<User>> = Key extends keyof output<User> ? output<User>[Key] : never;
+type AttributeListToTuple<User extends TailorDBInstance, AttributeList extends readonly UserAttributeListKey<User>[]> = { [Index in keyof AttributeList]: AttributeList[Index] extends UserAttributeListKey<User> ? AttributeListValue<User, AttributeList[Index]> : never };
+type AttributeMapSelectedKeys<User extends TailorDBInstance, AttributeMap extends UserAttributeMap<User>> = Extract<{ [K in keyof AttributeMap]-?: undefined extends AttributeMap[K] ? never : K }[keyof AttributeMap], UserAttributeKey<User>>;
+type UserProfile<User extends TailorDBInstance, AttributeMap extends UserAttributeMap<User>, AttributeList extends UserAttributeListKey<User>[]> = {
+  /**
+   * TailorDB namespace where the user type is defined.
+   *
+   * Usually auto-resolved, so you don't need to specify this.
+   * Required only when multiple TailorDBs exist and the type is in an external TailorDB.
+   */
+  namespace?: string;
+  type: User;
+  usernameField: UsernameFieldKey<User>;
+  attributes?: DisallowExtraKeys<AttributeMap, UserAttributeKey<User>>;
+  attributeList?: AttributeList;
+};
+type MachineUserAttributeFields = Record<string, TailorField<DefinedFieldMetadata, unknown, FieldMetadata, TailorFieldType>>;
+type TailorFieldOutputValue<Field> = Field extends TailorField<DefinedFieldMetadata, infer Output, FieldMetadata, TailorFieldType> ? Output : never;
+type MachineUserAttributeValues<Fields extends MachineUserAttributeFields> = { [K in keyof Fields]: TailorFieldOutputValue<Fields[K]> extends ValueOperand | null | undefined ? TailorFieldOutputValue<Fields[K]> : never };
+type MachineUserFromAttributes<Fields extends MachineUserAttributeFields> = (keyof Fields extends never ? {
+  attributes?: never;
+} : {
+  attributes: DisallowExtraKeys<MachineUserAttributeValues<Fields>, keyof Fields>;
+}) & {
+  attributeList?: string[];
+};
+type MachineUser<User extends TailorDBInstance, AttributeMap extends UserAttributeMap<User> = UserAttributeMap<User>, AttributeList extends UserAttributeListKey<User>[] = [], MachineUserAttributes extends MachineUserAttributeFields | undefined = undefined> = IsAny<MachineUserAttributes> extends true ? IsAny<User> extends true ? {
+  attributes: Record<string, AuthAttributeValue>;
+  attributeList?: string[];
+} : (AttributeMapSelectedKeys<User, AttributeMap> extends never ? {
+  attributes?: never;
+} : {
+  attributes: { [K in AttributeMapSelectedKeys<User, AttributeMap>]: K extends keyof output<User> ? output<User>[K] : never } & { [K in Exclude<keyof output<User>, AttributeMapSelectedKeys<User, AttributeMap>>]?: never };
+}) & ([] extends AttributeList ? {
+  attributeList?: never;
+} : {
+  attributeList: AttributeListToTuple<User, AttributeList>;
+}) : [MachineUserAttributes] extends [MachineUserAttributeFields] ? MachineUserFromAttributes<MachineUserAttributes> : IsAny<User> extends true ? {
+  attributes: Record<string, AuthAttributeValue>;
+  attributeList?: string[];
+} : (AttributeMapSelectedKeys<User, AttributeMap> extends never ? {
+  attributes?: never;
+} : {
+  attributes: { [K in AttributeMapSelectedKeys<User, AttributeMap>]: K extends keyof output<User> ? output<User>[K] : never } & { [K in Exclude<keyof output<User>, AttributeMapSelectedKeys<User, AttributeMap>>]?: never };
+}) & ([] extends AttributeList ? {
+  attributeList?: never;
+} : {
+  attributeList: AttributeListToTuple<User, AttributeList>;
+});
+/** Upstream OAuth provider that federated a login through the Built-in IdP. */
+type FederatedIdentityProvider = "google" | "microsoft";
+/**
+ * Profile claims forwarded from the upstream OAuth provider's ID token.
+ *
+ * Commonly present claims are typed; any other claim the provider issues is
+ * forwarded as-is and reachable through the index signature. Availability
+ * varies by provider (e.g. Microsoft does not issue `picture`).
+ */
+type FederatedIdentityClaims = {
+  name?: string;
+  given_name?: string;
+  family_name?: string;
+  picture?: string;
+  locale?: string;
+  [claim: string]: JsonValue | undefined;
+};
+/**
+ * The upstream identity that federated this login, populated when a user signs
+ * in through a Built-in IdP OAuth provider (Google or Microsoft).
+ *
+ * Available on {@link BeforeLoginClaims.federated_identity}; `undefined` for
+ * password logins.
+ */
+type FederatedIdentity = {
+  provider: FederatedIdentityProvider;
+  claims: FederatedIdentityClaims;
+};
+/**
+ * Token claims passed to the {@link BeforeLoginHook} handler. Carries the IdP's
+ * own claims (e.g. `sub`, `email`) plus, for federated logins, the upstream
+ * provider's profile under {@link BeforeLoginClaims.federated_identity}.
+ */
+type BeforeLoginClaims = JsonObject & {
+  /** Present only for federated (Google/Microsoft) logins; `undefined` for password logins. */federated_identity?: FederatedIdentity;
+};
+type BeforeLoginHookArgs = {
+  claims: BeforeLoginClaims;
+  idpConfigName: string; /** Environment variables defined in `defineConfig({ env })`. */
+  env: TailorEnv;
+};
+type BeforeLoginHook<MachineUserNames extends string> = {
+  handler(args: BeforeLoginHookArgs): Promise<void>;
+  invoker: NoInfer<MachineUserNames>;
+};
+type AuthHooks<MachineUserNames extends string> = {
+  beforeLogin?: BeforeLoginHook<MachineUserNames>;
+};
+type AuthServiceInput<User extends TailorDBInstance, AttributeMap extends UserAttributeMap<User>, AttributeList extends UserAttributeListKey<User>[], MachineUserNames extends string, MachineUserAttributes extends MachineUserAttributeFields | undefined = MachineUserAttributeFields | undefined, ConnectionNames extends string = string> = {
+  hooks?: AuthHooks<MachineUserNames>;
+  userProfile?: UserProfile<User, AttributeMap, AttributeList>;
+  machineUserAttributes?: MachineUserAttributes;
+  machineUsers?: Record<MachineUserNames, MachineUser<User, AttributeMap, AttributeList, MachineUserAttributes>>;
+  oauth2Clients?: Record<string, OAuth2ClientInput>;
+  idProvider?: IdProvider;
+  scim?: SCIMConfig;
+  tenantProvider?: TenantProvider;
+  connections?: Record<ConnectionNames, AuthConnectionConfig>;
+  publishSessionEvents?: boolean;
+};
+declare const authDefinitionBrand: unique symbol;
+type AuthDefinitionBrand = {
+  readonly [authDefinitionBrand]: true;
+};
+type ConnectionNames<Config> = Config extends {
+  connections?: Record<infer K, unknown>;
+} ? K & string : string;
+type DefinedAuth<Name extends string, Config, MachineUserNames extends string> = Config & {
+  name: Name;
+  /**
+   * @deprecated Pass the machine user name directly as a string instead, e.g. `authInvoker: "machine-user-name"`.
+   * Using this function pulls config-layer (Node-only) dependencies into runtime bundles.
+   */
+  invoker<M extends MachineUserNames>(machineUser: M): AuthInvokerWithName<M>;
+  /**
+   * @deprecated Use `authconnection.getConnectionToken(...)` from `@tailor-platform/sdk/runtime` instead.
+   * Importing `auth` from `tailor.config.ts` into runtime files pulls config-layer (Node-only)
+   * dependencies into the bundle.
+   */
+  getConnectionToken<C extends ConnectionNames<Config>>(connectionName: C): Promise<AuthConnectionTokenResult>;
+} & AuthDefinitionBrand;
+type AuthExternalConfig = {
+  name: string;
+  external: true;
+};
+type AuthServiceInputLoose = AuthServiceInput<any, any, any, string, any>;
+type AuthOwnConfig = DefinedAuth<string, AuthServiceInputLoose, string>;
+type AuthConfig = AuthOwnConfig | AuthExternalConfig;
+//#endregion
+export { SCIMConfig as A, OAuth2Client as C, SCIMAttribute as D, SAML as E, TenantProvider as M, AuthConnectionConfig as N, SCIMAttributeMapping as O, AuthConnectionOAuth2Config as P, IdProvider as S, OIDC as T, UsernameFieldKey as _, AuthServiceInput as a, BuiltinIdP as b, DefinedAuth as c, FederatedIdentityProvider as d, OAuth2ClientGrantType as f, UserAttributeMap as g, UserAttributeListKey as h, AuthOwnConfig as i, SCIMResource as j, SCIMAuthorization as k, FederatedIdentity as l, UserAttributeKey as m, AuthConnectionTokenResult as n, BeforeLoginClaims as o, SCIMAttributeType as p, AuthExternalConfig as r, BeforeLoginHookArgs as s, AuthConfig as t, FederatedIdentityClaims as u, ValueOperand as v, OAuth2ClientInput as w, IDToken as x, AuthInvoker as y };
+//# sourceMappingURL=types-v_ErzNUF.d.mts.map

package/dist/utils/test/index.d.mts

@@ -1,6 +1,6 @@
 import { s as TailorInvoker } from "../../types-DTcZ2Yax.mjs";
-import { j as TailorDBType } from "../../workflow.generated-DJULCuRr.mjs";
-import { Et as WORKFLOW_TEST_ENV_KEY, It as TailorField, n as output } from "../../index-BAEaAqmz.mjs";
+import { j as TailorDBType } from "../../workflow.generated-Da1zECDw.mjs";
+import { Et as WORKFLOW_TEST_ENV_KEY, Rt as TailorField, n as output } from "../../index-BzGqTY5x.mjs";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 
 //#region src/utils/test/mock.d.ts

package/dist/vitest/index.d.mts

@@ -1,6 +1,7 @@
 import { o as TailorEnv } from "../types-DTcZ2Yax.mjs";
 import { Kysely, OperationNode, OperationNodeKind, Transaction } from "kysely";
 import { Mock } from "vitest";
+import { AuthConnectionTokenResult, ConnectionName } from "@tailor-platform/sdk";
 import { Plugin } from "vitest/config";
 
 //#region src/vitest/mock.d.ts
@@ -41,7 +42,7 @@ interface SecretCall {
   names?: readonly string[];
 }
 interface AuthConnectionCall {
-  connectionName: string;
+  connectionName: ConnectionName;
 }
 interface IdpCall {
   method: string;
@@ -241,8 +242,8 @@ declare function mockSecretmanager(): {
  * ```
  */
 declare function mockAuthconnection(): {
-  /** The `getConnectionToken` `vi.fn`. */getConnectionToken: Mock<(connectionName: string) => Promise<any>>;
-  setTokens(value: Record<string, unknown>): void;
+  /** The `getConnectionToken` `vi.fn`. */getConnectionToken: Mock<(connectionName: ConnectionName) => Promise<AuthConnectionTokenResult>>;
+  setTokens(value: Partial<Record<ConnectionName, AuthConnectionTokenResult>>): void;
   readonly calls: AuthConnectionCall[];
   reset(): void;
 } & Disposable;

package/dist/{workflow.generated-DJULCuRr.d.mts → workflow.generated-Da1zECDw.d.mts}

@@ -1,6 +1,7 @@
 import { c as TailorUser, i as InferredAttributeMap } from "./types-DTcZ2Yax.mjs";
 import { A as Validators, E as FieldValidateInput, F as output, O as TailorFieldType, P as TypeLevelError, S as EnumValue, T as FieldOutput, a as Hooks, g as TailorDBType$1, h as TailorDBServiceInput, i as Hook, j as InferFieldsOutput, k as TailorToTs, l as RelationType, n as DefinedDBFieldMetadata, o as IndexDef, p as TailorDBField$1, r as ExcludeNestedDBFields, t as DBFieldMetadata, u as SerialConfig, v as TypeFeatures, w as FieldOptions } from "./types-rj8YJcEe.mjs";
-import { it as BuiltinIdP, o as PluginConfigs, z as AuthConfig } from "./types-Dynq4AJv.mjs";
+import { b as BuiltinIdP, t as AuthConfig } from "./types-v_ErzNUF.mjs";
+import { o as PluginConfigs } from "./types-aqnqTCfO.mjs";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 
 //#region src/configure/types/field.d.ts
@@ -1344,4 +1345,4 @@ type ConcurrencyPolicy = {
 };
 //#endregion
 export { TailorDBInstance as A, IdPInput as C, TailorAnyDBField as D, AIGatewayInput as E, TailorTypePermission as F, unsafeAllowAllGqlPermission as I, unsafeAllowAllTypePermission as L, db as M, PermissionCondition as N, TailorAnyDBType as O, TailorTypeGqlPermission as P, AllowedValues as R, IdPGqlOperationsInput as S, AIGatewayDefinitionBrand as T, IdPConfig as _, ExecutorServiceConfig as a, IdPEmailConfig as b, ResolverServiceConfig as c, WorkflowServiceInput as d, StaticWebsiteConfig as f, SecretsDefinitionBrand as g, SecretsConfig as h, AppConfig as i, TailorDBType as j, TailorDBField as k, ResolverServiceInput as l, StaticWebsiteInput as m, RetryPolicy as n, ExecutorServiceInput as o, StaticWebsiteDefinitionBrand as p, HttpAdapterConfigInput as r, ResolverExternalConfig as s, ConcurrencyPolicy as t, WorkflowServiceConfig as u, IdPExternalConfig as v, AIGatewayConfig as w, IdPGqlOperations as x, IdpDefinitionBrand as y, AllowedValuesOutput as z };
-//# sourceMappingURL=workflow.generated-DJULCuRr.d.mts.map
+//# sourceMappingURL=workflow.generated-Da1zECDw.d.mts.map

package/docs/cli/setup.md

@@ -4,36 +4,70 @@ Commands for setting up project infrastructure.
 
 ## setup
 
-Generate a CI deploy workflow for your project. (beta)
+Generate CI deploy workflows for your project. (beta)
 
 **Usage**
 
 ```
-tailor-sdk setup [options] [command]
+tailor-sdk setup <command>
+```
+
+See [Global Options](../cli-reference.md#global-options) for options available to all commands.
+
+**Commands**
+
+| Command                                 | Description                                                                                      |
+| --------------------------------------- | ------------------------------------------------------------------------------------------------ |
+| [`setup branch`](#setup-branch)         | Generate a branch-target deploy workflow (push to branch triggers deploy).                       |
+| [`setup tag`](#setup-tag)               | Generate a tag-target deploy workflow (tag push triggers deploy).                                |
+| [`setup preview`](#setup-preview)       | Generate a preview workflow (PR open/sync triggers deploy to a per-PR workspace).                |
+| [`setup action`](#setup-action)         | Generate a per-app composite action for use with setup coordinate (monorepo multi-app deploys).  |
+| [`setup coordinate`](#setup-coordinate) | Generate a coordinator workflow that orchestrates multiple --action-generated composite actions. |
+| [`setup check`](#setup-check)           | Audit generated workflows for drift against the current config/repo (read-only).                 |
+
+### setup action
+
+Generate a per-app composite action for use with setup coordinate (monorepo multi-app deploys).
+
+**Usage**
+
+```
+tailor-sdk setup action [options]
 ```
 
 **Options**
 
-| Option                              | Alias | Description                                                                                                                                       | Required | Default    |
-| ----------------------------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------- |
-| `--provider <PROVIDER>`             | `-p`  | CI provider to generate for (only 'github' is supported)                                                                                          | No       | `"github"` |
-| `--workspace-name <WORKSPACE_NAME>` | `-n`  | Workspace name (defaults to the config 'name')                                                                                                    | No       | -          |
-| `--branch <BRANCH>`                 | -     | Branch target: deploy trigger branch (defaults to the detected default branch). Tag target: tag-reachability guard branch (no guard when omitted) | No       | -          |
-| `--tag`                             | -     | Generate a tag target (deploy on tag push)                                                                                                        | No       | `false`    |
-| `--tag-pattern <TAG_PATTERN>`       | -     | Tag glob to match (requires --tag; defaults to v\*)                                                                                               | No       | -          |
-| `--environment <ENVIRONMENT>`       | -     | GitHub Environment for the plan/deploy jobs (defaults to the workspace name)                                                                      | No       | -          |
-| `--no-plan`                         | -     | Disable the plan job for a branch target (cannot be combined with --tag)                                                                          | No       | `false`    |
-| `--erd-preview`                     | -     | Add PR ERD viewer artifacts with current/diff previews for TailorDB namespaces                                                                    | No       | `false`    |
-| `--dir <DIR>`                       | `-d`  | App directory (for monorepo setups)                                                                                                               | No       | `"."`      |
-| `--force`                           | -     | Discard hand edits / take over unmanaged files and regenerate                                                                                     | No       | `false`    |
+| Option                        | Alias | Description                                         | Required | Default |
+| ----------------------------- | ----- | --------------------------------------------------- | -------- | ------- |
+| `--name <NAME>`               | `-n`  | Name (defaults to the config 'name')                | No       | -       |
+| `--dir <DIR>`                 | `-d`  | App directory                                       | No       | `"."`   |
+| `--environment <ENVIRONMENT>` | -     | GitHub Environment (defaults to the workspace name) | No       | -       |
+| `--force`                     | -     | Discard hand edits and regenerate                   | No       | `false` |
 
 See [Global Options](../cli-reference.md#global-options) for options available to all commands.
 
-**Commands**
+### setup branch
+
+Generate a branch-target deploy workflow (push to branch triggers deploy).
 
-| Command                       | Description                                                                      |
-| ----------------------------- | -------------------------------------------------------------------------------- |
-| [`setup check`](#setup-check) | Audit generated workflows for drift against the current config/repo (read-only). |
+**Usage**
+
+```
+tailor-sdk setup branch [options]
+```
+
+**Options**
+
+| Option                        | Alias | Description                                                                    | Required | Default |
+| ----------------------------- | ----- | ------------------------------------------------------------------------------ | -------- | ------- |
+| `--name <NAME>`               | `-n`  | Name (defaults to the config 'name')                                           | No       | -       |
+| `--branch <BRANCH>`           | -     | Deploy trigger branch (defaults to the detected default branch)                | No       | -       |
+| `--environment <ENVIRONMENT>` | -     | GitHub Environment for the plan/deploy jobs (defaults to the workspace name)   | No       | -       |
+| `--erd-preview`               | -     | Add PR ERD viewer artifacts with current/diff previews for TailorDB namespaces | No       | `false` |
+| `--dir <DIR>`                 | `-d`  | App directory (for monorepo setups)                                            | No       | `"."`   |
+| `--force`                     | -     | Discard hand edits / take over unmanaged files and regenerate                  | No       | `false` |
+
+See [Global Options](../cli-reference.md#global-options) for options available to all commands.
 
 ### setup check
 
@@ -42,9 +76,85 @@ Audit generated workflows for drift against the current config/repo (read-only).
 **Usage**
 
 ```
-tailor-sdk setup check
+tailor-sdk setup check [options]
+```
+
+**Options**
+
+| Option | Alias | Description                                                                                      | Required | Default |
+| ------ | ----- | ------------------------------------------------------------------------------------------------ | -------- | ------- |
+| `--ci` | -     | Run in CI mode: skip checks that are handled by the runtime (e.g. TAILOR_PLATFORM_WORKSPACE_ID). | No       | `false` |
+
+See [Global Options](../cli-reference.md#global-options) for options available to all commands.
+
+### setup coordinate
+
+Generate a coordinator workflow that orchestrates multiple --action-generated composite actions.
+
+**Usage**
+
+```
+tailor-sdk setup coordinate [options]
+```
+
+**Options**
+
+| Option                        | Alias | Description                                                                             | Required | Default |
+| ----------------------------- | ----- | --------------------------------------------------------------------------------------- | -------- | ------- |
+| `--name <NAME>`               | `-n`  | Coordinator name (used in the generated workflow file name and job names)               | Yes      | -       |
+| `--action <ACTION>`           | -     | Composite action to include (can be specified multiple times). tailor- prefix optional. | Yes      | -       |
+| `--branch <BRANCH>`           | -     | Branch target: deploy trigger branch (defaults to the detected default branch)          | No       | -       |
+| `--tag`                       | -     | Generate a tag target coordinator                                                       | No       | `false` |
+| `--environment <ENVIRONMENT>` | -     | GitHub Environment for the plan/deploy jobs                                             | No       | -       |
+| `--force`                     | -     | Discard hand edits and regenerate                                                       | No       | `false` |
+
+See [Global Options](../cli-reference.md#global-options) for options available to all commands.
+
+### setup preview
+
+Generate a preview workflow (PR open/sync triggers deploy to a per-PR workspace).
+
+**Usage**
+
+```
+tailor-sdk setup preview [options]
 ```
 
+**Options**
+
+| Option                        | Alias | Description                                                               | Required | Default |
+| ----------------------------- | ----- | ------------------------------------------------------------------------- | -------- | ------- |
+| `--name <NAME>`               | `-n`  | Name (defaults to the config 'name')                                      | No       | -       |
+| `--branch <BRANCH>`           | -     | Branch to filter PRs by (defaults to the detected default branch)         | No       | -       |
+| `--region <REGION>`           | -     | Workspace region for preview workspace creation (e.g. us-west). Required. | Yes      | -       |
+| `--require-preview-label`     | -     | Deploy preview only for PRs labeled `tailor:preview` instead of all PRs.  | No       | `false` |
+| `--environment <ENVIRONMENT>` | -     | GitHub Environment for the preview jobs (defaults to the workspace name)  | No       | -       |
+| `--dir <DIR>`                 | `-d`  | App directory (for monorepo setups)                                       | No       | `"."`   |
+| `--force`                     | -     | Discard hand edits / take over unmanaged files and regenerate             | No       | `false` |
+
+See [Global Options](../cli-reference.md#global-options) for options available to all commands.
+
+### setup tag
+
+Generate a tag-target deploy workflow (tag push triggers deploy).
+
+**Usage**
+
+```
+tailor-sdk setup tag [options]
+```
+
+**Options**
+
+| Option                        | Alias | Description                                                                  | Required | Default |
+| ----------------------------- | ----- | ---------------------------------------------------------------------------- | -------- | ------- |
+| `--name <NAME>`               | `-n`  | Name (defaults to the config 'name')                                         | No       | -       |
+| `--tag-pattern <TAG_PATTERN>` | -     | Tag glob to match (defaults to v\*)                                          | No       | `"v*"`  |
+| `--branch <BRANCH>`           | -     | Tag-reachability guard branch (no guard when omitted)                        | No       | -       |
+| `--environment <ENVIRONMENT>` | -     | GitHub Environment for the plan/deploy jobs (defaults to the workspace name) | No       | -       |
+| `--dir <DIR>`                 | `-d`  | App directory (for monorepo setups)                                          | No       | `"."`   |
+| `--force`                     | -     | Discard hand edits / take over unmanaged files and regenerate                | No       | `false` |
+
 See [Global Options](../cli-reference.md#global-options) for options available to all commands.
 
 ## Further reading

package/docs/cli-reference.md

@@ -313,10 +313,15 @@ Commands for managing crash reports.
 
 Commands for setting up project infrastructure.
 
-| Command                                   | Description                                                                      |
-| ----------------------------------------- | -------------------------------------------------------------------------------- |
-| [setup](./cli/setup.md#setup)             | Generate a CI deploy workflow for your project. (beta)                           |
-| [setup check](./cli/setup.md#setup-check) | Audit generated workflows for drift against the current config/repo (read-only). |
+| Command                                             | Description                                                                                      |
+| --------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
+| [setup](./cli/setup.md#setup)                       | Generate CI deploy workflows for your project. (beta)                                            |
+| [setup action](./cli/setup.md#setup-action)         | Generate a per-app composite action for use with setup coordinate (monorepo multi-app deploys).  |
+| [setup branch](./cli/setup.md#setup-branch)         | Generate a branch-target deploy workflow (push to branch triggers deploy).                       |
+| [setup check](./cli/setup.md#setup-check)           | Audit generated workflows for drift against the current config/repo (read-only).                 |
+| [setup coordinate](./cli/setup.md#setup-coordinate) | Generate a coordinator workflow that orchestrates multiple --action-generated composite actions. |
+| [setup preview](./cli/setup.md#setup-preview)       | Generate a preview workflow (PR open/sync triggers deploy to a per-PR workspace).                |
+| [setup tag](./cli/setup.md#setup-tag)               | Generate a tag-target deploy workflow (tag push triggers deploy).                                |
 
 ### [Upgrade Commands](./cli/upgrade.md)