@tailor-platform/sdk 1.75.0 → 1.76.1

package/dist/application-DbvD5UUz.mjs

@@ -0,0 +1,3 @@
+import { n as generatePluginFilesIfNeeded, r as loadApplication, t as defineApplication } from "./application-BUfYmf0O.mjs";
+
+export { defineApplication, generatePluginFilesIfNeeded };

package/dist/cli/index.mjs

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
-import { B as FunctionExecution_Type, Ct as PATScope, T as CustomDomainStatus, gt as AuthInvokerSchema } from "../service_pb-4unFyubn.mjs";
 import { t as assertDefined } from "../assert-DBxo8jPo.mjs";
 import { n as logger, r as styles } from "../logger-BEiZZ3qT.mjs";
-import { $t as compareSnapshotWithRemote, A as listCommand$12, An as apiCommand, Bn as pagedLogArgs, C as listCommand$13, Cn as hasChanges, Dn as PluginManager, Dt as listCommand$6, E as waitCommand, En as sdkNameLabelKey, F as generateCommand$1, Fn as configArg, G as removeCommand$1, Gt as deploy, H as extractOwnedNamespaces, Hn as toPageDirection, Ht as formatKeyValueTable, I as generateMigrationScript, In as confirmationArgs, It as getCommand$6, K as updateCommand$3, Kt as ensureConfigId, L as writeDbTypesFile, Ln as deploymentArgs, Mn as assertWritable, N as truncateCommand, Nn as defineAppCommand, O as resumeCommand, On as generateUserTypes, Pn as commonArgs, Pt as startCommand, Q as getCommand$5, Qt as parseMigrationLabelNumber, R as getConfiguredEditorCommand, Rn as isVerbose, Rt as executionsCommand, Sn as formatMigrationDiff, T as healthCommand, Tn as resourceTrn, Tt as triggerCommand, U as logBetaWarning, Un as workspaceArgs, Ut as getCommand$1, V as showCommand, Vn as paginationArgs, Vt as functionExecutionStatusToString, X as listCommand$11, Xt as MIGRATION_LABEL_KEY, Y as treeCommand, Zt as handleOptionalToRequiredError, _n as loadDiff, b as createCommand$4, bn as parseMigrationNumberArg, c as listCommand$14, cn as compareLocalTypesWithSnapshot, ct as createCommand$3, dn as getLatestMigrationNumber, en as generateAllTypeManifestsFromSnapshot, et as updateCommand$2, f as restoreCommand, ft as getCommand$3, g as getCommand$7, gn as isValidMigrationNumber, gt as listCommand$8, ht as tokenCommand, i as updateCommand$4, in as INITIAL_SCHEMA_NUMBER, it as getCommand$4, jt as jobsCommand, kn as prompt, m as listCommand$15, mn as getMigrationFiles, nt as listCommand$10, o as removeCommand, ot as deleteCommand$4, pn as getMigrationFilePath, qt as executeScript, r as queryCommand, sn as assertValidMigrationFiles, t as isNativeTypeScriptRuntime, tn as protoGqlPermission, u as inviteCommand, un as createSnapshotFromLocalTypes, ut as listCommand$9, v as deleteCommand$5, vn as reconstructSnapshotFromMigrations, vt as generate, wn as getNamespacesWithMigrations, wt as webhookCommand, xt as getCommand$2, yn as formatMigrationNumber, yt as listCommand$7, z as openInConfiguredEditor, zn as multiConfigArg } from "../runtime-CJ5usBOu.mjs";
-import { A as hasAnyUserTokenEntry, B as readPlatformConfig, D as loadConfig, F as loadMachineUserName, G as defaultPlatformBaseUrl, H as saveUserTokens, K as fetchAll, L as loadStoredUserTokens, M as loadAccessToken, O as deleteUserTokens, P as loadConsoleBaseUrl, R as loadWorkspaceId, T as hashContent$1, U as writePlatformConfig, V as resolveUserTokenKey, W as closeConnectionPool, X as fetchPlatformMachineUserToken, Y as fetchPaged, Z as fetchUserInfo, _ as platformBundleDefinePlugin, a as resolveInlineSourcemap, b as resolveBundleLogLevel, c as ResolverSchema, et as getOrNull, it as isDefaultPlatform, j as hasUserTokenEntry, k as fetchLatestToken, nt as initOAuth2Client, q as fetchAllTolerant, rt as initOperatorClient, s as WorkflowJobSchema, t as defineApplication, u as INVOKER_EXPR, v as composeFunctionTreeshakeOptions, w as getDistDir, y as createLogLevelTreeshakeOptions, z as platformConfigFromProfile } from "../application-DYshsH-K.mjs";
+import { A as hasAnyUserTokenEntry, B as readPlatformConfig, Ct as toPageDirection, D as loadConfig, F as loadMachineUserName, G as defaultPlatformBaseUrl, H as saveUserTokens, K as fetchAll, L as loadStoredUserTokens, M as loadAccessToken, O as deleteUserTokens, P as loadConsoleBaseUrl, R as loadWorkspaceId, St as resolveMachineUserInputSource, T as hashContent$1, U as writePlatformConfig, V as resolveUserTokenKey, W as closeConnectionPool, X as fetchPlatformMachineUserToken, Y as fetchPaged, Z as fetchUserInfo, _ as platformBundleDefinePlugin, a as resolveInlineSourcemap, b as resolveBundleLogLevel, c as ResolverSchema, ct as configArg, et as getOrNull, it as isDefaultPlatform, j as hasUserTokenEntry, k as fetchLatestToken, lt as confirmationArgs, mt as multiConfigArg, nt as initOAuth2Client, pt as isVerbose, q as fetchAllTolerant, rt as initOperatorClient, s as WorkflowJobSchema, st as commonArgs, t as defineApplication, u as INVOKER_EXPR, ut as deploymentArgs, v as composeFunctionTreeshakeOptions, vt as pagedLogArgs, w as getDistDir, wt as workspaceArgs, y as createLogLevelTreeshakeOptions, yt as paginationArgs, z as platformConfigFromProfile } from "../application-BUfYmf0O.mjs";
+import { $t as compareSnapshotWithRemote, A as listCommand$12, An as apiCommand, C as listCommand$13, Cn as hasChanges, Dn as PluginManager, Dt as listCommand$6, E as waitCommand, En as sdkNameLabelKey, F as generateCommand$1, G as removeCommand$1, Gt as deploy, H as extractOwnedNamespaces, Ht as formatKeyValueTable, I as generateMigrationScript, It as getCommand$6, K as updateCommand$3, Kt as ensureConfigId, L as writeDbTypesFile, Mn as assertWritable, N as truncateCommand, Nn as defineAppCommand, O as resumeCommand, On as generateUserTypes, Pt as startCommand, Q as getCommand$5, Qt as parseMigrationLabelNumber, R as getConfiguredEditorCommand, Rt as executionsCommand, Sn as formatMigrationDiff, T as healthCommand, Tn as resourceTrn, Tt as triggerCommand, U as logBetaWarning, Ut as getCommand$1, V as showCommand, Vt as functionExecutionStatusToString, X as listCommand$11, Xt as MIGRATION_LABEL_KEY, Y as treeCommand, Zt as handleOptionalToRequiredError, _n as loadDiff, b as createCommand$4, bn as parseMigrationNumberArg, c as listCommand$14, cn as compareLocalTypesWithSnapshot, ct as createCommand$3, dn as getLatestMigrationNumber, en as generateAllTypeManifestsFromSnapshot, et as updateCommand$2, f as restoreCommand, ft as getCommand$3, g as getCommand$7, gn as isValidMigrationNumber, gt as listCommand$8, ht as tokenCommand, i as updateCommand$4, in as INITIAL_SCHEMA_NUMBER, it as getCommand$4, jt as jobsCommand, kn as prompt, m as listCommand$15, mn as getMigrationFiles, nt as listCommand$10, o as removeCommand, ot as deleteCommand$4, pn as getMigrationFilePath, qt as executeScript, r as queryCommand, sn as assertValidMigrationFiles, t as isNativeTypeScriptRuntime, tn as protoGqlPermission, u as inviteCommand, un as createSnapshotFromLocalTypes, ut as listCommand$9, v as deleteCommand$5, vn as reconstructSnapshotFromMigrations, vt as generate, wn as getNamespacesWithMigrations, wt as webhookCommand, xt as getCommand$2, yn as formatMigrationNumber, yt as listCommand$7, z as openInConfiguredEditor } from "../runtime-_vUgjiqT.mjs";
 import { n as ExecutorSchema } from "../service-BCRJ-3NV.mjs";
 import { t as multiline } from "../multiline-sfHpTZZK.mjs";
 import { r as isPluginGeneratedType } from "../seed-fm0LeYP2.mjs";
 import { t as readPackageJson } from "../package-json-8b0O9TlX.mjs";
 import { i as userAgent } from "../secret-file-VSVGy1V0.mjs";
 import { n as isCLIError } from "../errors-Dtf2WPaW.mjs";
+import { B as FunctionExecution_Type, Ct as PATScope, T as CustomDomainStatus, gt as AuthInvokerSchema } from "../service_pb-B5w9rjPY.mjs";
 import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-ayWANEZ6.mjs";
 import { arg, defineCommand, runCommand, runMain } from "politty";
 import { withCompletionCommand } from "politty/completion";
@@ -1440,6 +1440,7 @@ When a \`.js\` file is provided, detection and bundling are skipped and the file
 		const authNamespace = resolveAuthNamespace(config.auth);
 		const machineUserName = await resolveMachineUserName({
 			cliMachineUser: args["machine-user"],
+			cliMachineUserSource: resolveMachineUserInputSource(args["machine-user"]),
 			profile: args.profile,
 			authConfig: config.auth
 		});
@@ -1556,9 +1557,10 @@ function resolveAuthNamespace(authConfig) {
 * @returns Resolved machine user name
 */
 async function resolveMachineUserName(options) {
-	const { cliMachineUser, profile, authConfig } = options;
+	const { cliMachineUser, cliMachineUserSource, profile, authConfig } = options;
 	const resolved = await loadMachineUserName({
 		machineUser: cliMachineUser,
+		machineUserSource: cliMachineUserSource,
 		profile
 	});
 	if (resolved) return resolved;
@@ -1737,8 +1739,47 @@ const redirectUri = `http://localhost:${redirectPort}/callback`;
 function randomState() {
 	return crypto.randomBytes(32).toString("base64url");
 }
-function assertProfileLoginUser(args, authenticatedUser) {
-	if (args.profile && args.profileUser && authenticatedUser !== args.profileUser) throw new Error(`Profile "${args.profile}" is configured for "${args.profileUser}", but login authenticated "${authenticatedUser}".`);
+function getProfileUserMismatch(args, authenticatedUser) {
+	if (!args.profile || !args.profileUser || authenticatedUser === args.profileUser) return;
+	return {
+		profile: args.profile,
+		oldUser: args.profileUser,
+		authenticatedUser,
+		loginMode: args.loginMode ?? "user"
+	};
+}
+function quoteCommandArg(value, platform = process.platform) {
+	if (platform === "win32") {
+		if (/^[A-Za-z0-9_./:@+=,-]+$/.test(value)) return value;
+		return;
+	}
+	return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function profileUpdateCommand(mismatch) {
+	const profileArg = quoteCommandArg(mismatch.profile);
+	const userArg = quoteCommandArg(mismatch.authenticatedUser);
+	if (profileArg && userArg) return `tailor-sdk profile update --user ${userArg} -- ${profileArg}`;
+	return [
+		"tailor-sdk profile update --user <authenticated-user> -- <profile>",
+		`profile = ${JSON.stringify(mismatch.profile)}`,
+		`authenticated user = ${JSON.stringify(mismatch.authenticatedUser)}`
+	].join("\n");
+}
+function retryInstruction(mismatch) {
+	if (mismatch.loginMode === "machine-user") return "Then retry the original machine-user login command.";
+	const profileArg = quoteCommandArg(mismatch.profile);
+	if (!profileArg) return "Then retry the browser login with the same profile value.";
+	return `Then run:\n  tailor-sdk login --profile ${profileArg}`;
+}
+function profileUserMismatchError(mismatch) {
+	const updateCommand = profileUpdateCommand(mismatch);
+	const nextStep = retryInstruction(mismatch);
+	return new Error(multiline`
+    Profile "${mismatch.profile}" is configured for "${mismatch.oldUser}", but login authenticated "${mismatch.authenticatedUser}".
+    The authenticated user has been saved. To use it with this profile, run:
+      ${updateCommand}
+    ${nextStep}
+  `);
 }
 function shouldUpdateCurrentUser(profile, platformConfig) {
 	if (!profile) return true;
@@ -1758,12 +1799,16 @@ const startAuthServer = async (args = {}) => {
 					codeVerifier
 				});
 				const userInfo = await fetchUserInfo(tokens.accessToken, args.platformConfig);
-				assertProfileLoginUser(args, userInfo.email);
 				const pfConfig = await readPlatformConfig();
 				await saveUserTokens(pfConfig, userInfo.email, {
 					accessToken: tokens.accessToken,
 					refreshToken: tokens.refreshToken ?? void 0
 				}, new Date(assertDefined(tokens.expiresAt, "token response missing expiresAt")).toISOString(), args.platformConfig);
+				const mismatch = getProfileUserMismatch(args, userInfo.email);
+				if (mismatch) {
+					writePlatformConfig(pfConfig);
+					throw profileUserMismatchError(mismatch);
+				}
 				if (args.updateCurrentUser ?? true) pfConfig.current_user = userInfo.email;
 				writePlatformConfig(pfConfig);
 				res.writeHead(200, { "Content-Type": "application/json" });
@@ -1806,11 +1851,15 @@ const startAuthServer = async (args = {}) => {
 	});
 };
 async function loginAsMachineUser(args) {
-	assertProfileLoginUser(args, args.clientId);
 	const clientSecret = args.clientSecret ?? await prompt.password({ message: "Client secret" });
 	const tokens = await fetchPlatformMachineUserToken(args.clientId, clientSecret, args.platformConfig);
 	const pfConfig = await readPlatformConfig();
 	await saveUserTokens(pfConfig, args.clientId, { accessToken: tokens.accessToken }, new Date(assertDefined(tokens.expiresAt, "token response missing expiresAt")).toISOString(), args.platformConfig);
+	const mismatch = getProfileUserMismatch(args, args.clientId);
+	if (mismatch) {
+		writePlatformConfig(pfConfig);
+		throw profileUserMismatchError(mismatch);
+	}
 	if (args.updateCurrentUser ?? true) pfConfig.current_user = args.clientId;
 	writePlatformConfig(pfConfig);
 }
@@ -1843,31 +1892,36 @@ const loginCommand = defineAppCommand({
 		})
 	}).strict().describe("Machine User Login")]),
 	run: async (args) => {
-		let platformConfig;
-		let profileUser;
-		if ("profile" in args && args.profile) {
-			const profileEntry = (await readPlatformConfig()).profiles[args.profile];
-			if (!profileEntry) throw new Error(`Profile "${args.profile}" not found`);
-			platformConfig = platformConfigFromProfile(profileEntry);
-			profileUser = profileEntry.user;
+		try {
+			let platformConfig;
+			let profileUser;
+			if ("profile" in args && args.profile) {
+				const profileEntry = (await readPlatformConfig()).profiles[args.profile];
+				if (!profileEntry) throw new Error(`Profile "${args.profile}" not found`);
+				platformConfig = platformConfigFromProfile(profileEntry);
+				profileUser = profileEntry.user;
+			}
+			const updateCurrentUser = shouldUpdateCurrentUser(args.profile, platformConfig);
+			if ("machine-user" in args) await loginAsMachineUser({
+				clientId: args.clientId,
+				clientSecret: args.clientSecret,
+				profile: args.profile,
+				profileUser,
+				platformConfig,
+				updateCurrentUser,
+				loginMode: "machine-user"
+			});
+			else await startAuthServer({
+				profile: args.profile,
+				profileUser,
+				platformConfig,
+				updateCurrentUser,
+				loginMode: "user"
+			});
+			logger.success("Successfully logged in to Tailor Platform.");
+		} finally {
+			await closeConnectionPool();
 		}
-		const updateCurrentUser = shouldUpdateCurrentUser(args.profile, platformConfig);
-		if ("machine-user" in args) await loginAsMachineUser({
-			clientId: args.clientId,
-			clientSecret: args.clientSecret,
-			profile: args.profile,
-			profileUser,
-			platformConfig,
-			updateCurrentUser
-		});
-		else await startAuthServer({
-			profile: args.profile,
-			profileUser,
-			platformConfig,
-			updateCurrentUser
-		});
-		logger.success("Successfully logged in to Tailor Platform.");
-		await closeConnectionPool();
 	}
 });
 
@@ -2822,7 +2876,7 @@ function findTarget(lock, kind, workspaceName) {
 
 //#endregion
 //#region src/cli/commands/setup/action.yml
-var action_default = "# __HEADER__\nname: __WORKSPACE_NAME__\ndescription: >-\n  Deploy __WORKSPACE_NAME__ to Tailor Platform.\n  Checkout and dependency installation are expected to be handled by the caller.\n\ninputs:\n  workspace-id:\n    description: Tailor Platform workspace id\n    required: true\n  name:\n    description: Workspace name (used in Slack notifications)\n    required: true\n  working-directory:\n    description: App directory relative to the repository root\n    required: false\n    default: \".\"\n  platform-client-id:\n    description: Machine-user client id\n    required: true\n  platform-client-secret:\n    description: Machine-user client secret\n    required: true\n  slack-token:\n    description: Slack bot token\n    required: false\n  slack-channel-id:\n    description: Slack channel id\n    required: false\n  user-mapping:\n    description: JSON string mapping GitHub usernames to Slack user IDs\n    required: false\n  package-manager:\n    description: Package manager used for dependency installation (pnpm, npm, yarn, bun)\n    required: false\n    default: pnpm\n\noutputs:\n  app-url:\n    description: Deployed application URL\n    value: ${{ steps.tailor-apply.outputs.app-url }}\n\nruns:\n  using: composite\n  steps:\n    # __STATIC_WEBSITE_BUILD_START__\n    - id: build-site\n      shell: bash\n      run: |\n        # Replace with your static website build command.\n        # Example: pnpm --filter <package-name> run build:static\n        # Note: this run: command is user-editable. Custom build commands are preserved across\n        # reruns and are not treated as drift by setup check. Other edits to this file are flagged\n        # as drift and will be overwritten if you re-run setup action with --force.\n        true\n    # __STATIC_WEBSITE_BUILD_END__\n    - id: tailor-apply\n      uses: tailor-platform/actions/deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n      with:\n        workspace-id: ${{ inputs.workspace-id }}\n        working-directory: ${{ inputs.working-directory }}\n        package-manager: ${{ inputs.package-manager }}\n        platform-client-id: ${{ inputs.platform-client-id }}\n        platform-client-secret: ${{ inputs.platform-client-secret }}\n    - id: tailor-notify\n      if: failure() && inputs.slack-token != '' && inputs.slack-channel-id != ''\n      uses: tailor-platform/actions/notify@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n      with:\n        provider: slack\n        status: failure\n        workspace-name: ${{ inputs.name }}\n        slack-token: ${{ inputs.slack-token }}\n        slack-channel-id: ${{ inputs.slack-channel-id }}\n        user-mapping: ${{ inputs.user-mapping }}\n";
+var action_default = "# __HEADER__\nname: __WORKSPACE_NAME__\ndescription: >-\n  Deploy __WORKSPACE_NAME__ to Tailor Platform.\n  Checkout and dependency installation are expected to be handled by the caller.\n\ninputs:\n  workspace-id:\n    description: Tailor Platform workspace id\n    required: true\n  name:\n    description: Workspace name (used in Slack notifications)\n    required: true\n  working-directory:\n    description: App directory relative to the repository root\n    required: false\n    default: \".\"\n  config:\n    description: SDK config path, or comma-separated config paths for multi-config deploys\n    required: false\n    default: \"tailor.config.ts\"\n  deploy:\n    description: Whether to run the Tailor deploy step after build steps\n    required: false\n    default: \"true\"\n  build-site:\n    description: Whether to run the static website build slot when present\n    required: false\n    default: \"true\"\n  platform-client-id:\n    description: Machine-user client id\n    required: true\n  platform-client-secret:\n    description: Machine-user client secret\n    required: true\n  slack-token:\n    description: Slack bot token\n    required: false\n  slack-channel-id:\n    description: Slack channel id\n    required: false\n  user-mapping:\n    description: JSON string mapping GitHub usernames to Slack user IDs\n    required: false\n  package-manager:\n    description: Package manager used for dependency installation (pnpm, npm, yarn, bun)\n    required: false\n    default: pnpm\n\noutputs:\n  app-url:\n    description: Deployed application URL\n    value: ${{ steps.tailor-apply.outputs.app-url }}\n\nruns:\n  using: composite\n  steps:\n    # __STATIC_WEBSITE_BUILD_START__\n    - id: build-site\n      if: inputs.build-site == 'true'\n      shell: bash\n      run: |\n        # Replace with your static website build command.\n        # Example: pnpm --filter <package-name> run build:static\n        # Note: this run: command is user-editable. Custom build commands are preserved across\n        # reruns and are not treated as drift by setup check. Other edits to this file are flagged\n        # as drift and will be overwritten if you re-run setup action with --force.\n        true\n    # __STATIC_WEBSITE_BUILD_END__\n    - id: tailor-apply\n      if: inputs.deploy == 'true'\n      uses: tailor-platform/actions/deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n      env:\n        TAILOR_PLATFORM_SDK_CONFIG_PATH: ${{ inputs.config }}\n      with:\n        workspace-id: ${{ inputs.workspace-id }}\n        working-directory: ${{ inputs.working-directory }}\n        package-manager: ${{ inputs.package-manager }}\n        platform-client-id: ${{ inputs.platform-client-id }}\n        platform-client-secret: ${{ inputs.platform-client-secret }}\n    - id: tailor-notify\n      if: failure() && inputs.slack-token != '' && inputs.slack-channel-id != ''\n      uses: tailor-platform/actions/notify@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n      with:\n        provider: slack\n        status: failure\n        workspace-name: ${{ inputs.name }}\n        slack-token: ${{ inputs.slack-token }}\n        slack-channel-id: ${{ inputs.slack-channel-id }}\n        user-mapping: ${{ inputs.user-mapping }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/branch.workflow.yml
@@ -3019,7 +3073,7 @@ const ACTIONS_SHA = "e74173d4bdd931d036ad359cf5f7729fc6aa7067";
 * @returns Rendered YAML and the list of managed job/step ids
 */
 function renderCoordinateWorkflow(params) {
-	const { coordinatorName, kind, apps, environment, packageManager } = params;
+	const { coordinatorName, kind, actionGroups, environment, packageManager } = params;
 	const isTag = kind === "tag";
 	const branch = params.branch;
 	const tagPattern = params.tagPattern ?? "v*";
@@ -3054,29 +3108,60 @@ function renderCoordinateWorkflow(params) {
 		`  with:`,
 		`    package-manager: ${packageManager}`
 	].join("\n");
-	const perAppPlanSteps = apps.flatMap((app) => {
+	const configPath = (app) => app.dir === "." ? "tailor.config.ts" : `${app.dir}/tailor.config.ts`;
+	const groupConfigPath = (group) => group.apps.map(configPath).join(",");
+	const firstApp = (group) => {
+		const [app] = group.apps;
+		if (!app) throw new Error("Coordinate action groups must contain at least one app.");
+		return app;
+	};
+	const singleAppPlanStep = (group, app) => {
 		const wd = app.dir !== "." ? app.dir : void 0;
 		const wdLine = wd ? `\n    working-directory: ${wd}` : "";
 		return [
-			`- id: tailor-generate-check-${app.name}`,
-			`  uses: tailor-platform/actions/generate-check@${ACTIONS_SHA} # v1.5.1`,
-			`  with:`,
-			`    package-manager: ${packageManager}${wdLine}`,
-			`- id: tailor-plan-${app.name}`,
+			`- id: tailor-plan-${group.id}`,
 			`  if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork`,
 			`  uses: tailor-platform/actions/plan@${ACTIONS_SHA} # v1.5.1`,
 			`  with:`,
 			`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
 			`    package-manager: ${packageManager}${wdLine}`,
-			`    label: ${coordinatorName}/${app.name}`,
+			`    label: ${coordinatorName}/${group.id}`,
 			`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
 			`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
 			`    github-token: \${{ secrets.GITHUB_TOKEN }}`
 		];
+	};
+	const multiConfigPlanStep = (group) => [
+		`- id: tailor-plan-${group.id}`,
+		`  if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork`,
+		`  uses: tailor-platform/actions/plan@${ACTIONS_SHA} # v1.5.1`,
+		`  env:`,
+		`    TAILOR_PLATFORM_SDK_CONFIG_PATH: ${groupConfigPath(group)}`,
+		`  with:`,
+		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+		`    package-manager: ${packageManager}`,
+		`    label: ${coordinatorName}/${group.id}`,
+		`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+		`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+		`    github-token: \${{ secrets.GITHUB_TOKEN }}`
+	];
+	const perAppPlanSteps = actionGroups.flatMap((group) => {
+		const generateCheckSteps = group.apps.flatMap((app) => {
+			const wd = app.dir !== "." ? app.dir : void 0;
+			const wdLine = wd ? `\n    working-directory: ${wd}` : "";
+			return [
+				`- id: tailor-generate-check-${app.name}`,
+				`  uses: tailor-platform/actions/generate-check@${ACTIONS_SHA} # v1.5.1`,
+				`  with:`,
+				`    package-manager: ${packageManager}${wdLine}`
+			];
+		});
+		const planStep = group.apps.length === 1 ? singleAppPlanStep(group, firstApp(group)) : multiConfigPlanStep(group);
+		return [...generateCheckSteps, ...planStep];
 	}).join("\n");
 	out = line(out, "PER_APP_PLAN_STEPS", `${driftCheckStep}\n${perAppPlanSteps}`);
-	const deploySteps = apps.flatMap((app) => [
-		`- id: tailor-deploy-${app.name}`,
+	const singleAppDeployStep = (group, app) => [
+		`- id: tailor-deploy-${group.id}`,
 		`  uses: ./.github/actions/tailor-${app.name}`,
 		`  with:`,
 		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
@@ -3088,7 +3173,39 @@ function renderCoordinateWorkflow(params) {
 		`    slack-token: \${{ secrets.TAILOR_SLACK_BOT_TOKEN }}`,
 		`    slack-channel-id: \${{ vars.TAILOR_SLACK_CHANNEL_ID }}`,
 		`    # editable: api-url:`
-	]).join("\n");
+	];
+	const buildSiteStep = (app) => [
+		`- id: tailor-build-site-${app.name}`,
+		`  uses: ./.github/actions/tailor-${app.name}`,
+		`  with:`,
+		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+		`    name: ${app.name}`,
+		`    working-directory: ${app.dir}`,
+		`    deploy: "false"`,
+		`    package-manager: ${packageManager}`,
+		`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+		`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+		`    slack-token: \${{ secrets.TAILOR_SLACK_BOT_TOKEN }}`,
+		`    slack-channel-id: \${{ vars.TAILOR_SLACK_CHANNEL_ID }}`
+	];
+	const multiConfigDeployStep = (group) => [
+		...group.apps.filter((app) => app.hasStaticWebsites).flatMap(buildSiteStep),
+		`- id: tailor-deploy-${group.id}`,
+		`  uses: ./.github/actions/tailor-${firstApp(group).name}`,
+		`  with:`,
+		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+		`    name: ${coordinatorName}/${group.id}`,
+		`    working-directory: .`,
+		`    config: ${groupConfigPath(group)}`,
+		`    build-site: "false"`,
+		`    package-manager: ${packageManager}`,
+		`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+		`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+		`    slack-token: \${{ secrets.TAILOR_SLACK_BOT_TOKEN }}`,
+		`    slack-channel-id: \${{ vars.TAILOR_SLACK_CHANNEL_ID }}`,
+		`    # editable: api-url:`
+	];
+	const deploySteps = actionGroups.flatMap((group) => group.apps.length === 1 ? singleAppDeployStep(group, firstApp(group)) : multiConfigDeployStep(group)).join("\n");
 	out = line(out, "PER_APP_DEPLOY_STEPS", deploySteps);
 	out = out.replaceAll("__WORKSPACE_NAME__", () => coordinatorName);
 	out = out.replaceAll("__ENVIRONMENT__", () => environment);
@@ -3097,9 +3214,15 @@ function renderCoordinateWorkflow(params) {
 	const generatedIds = [];
 	if (isTag && branch !== void 0) generatedIds.push("tailor-tag-guard", "tailor-tag-guard/tailor-checkout", "tailor-tag-guard/tailor-tag-guard");
 	generatedIds.push("tailor-plan", "tailor-plan/tailor-checkout", "tailor-plan/tailor-setup", "tailor-plan/tailor-drift-check");
-	for (const app of apps) generatedIds.push(`tailor-plan/tailor-generate-check-${app.name}`, `tailor-plan/tailor-plan-${app.name}`);
+	for (const group of actionGroups) {
+		for (const app of group.apps) generatedIds.push(`tailor-plan/tailor-generate-check-${app.name}`);
+		generatedIds.push(`tailor-plan/tailor-plan-${group.id}`);
+	}
 	generatedIds.push("tailor-deploy", "tailor-deploy/tailor-checkout", "tailor-deploy/tailor-setup");
-	for (const app of apps) generatedIds.push(`tailor-deploy/tailor-deploy-${app.name}`);
+	for (const group of actionGroups) {
+		for (const app of group.apps) if (group.apps.length > 1 && app.hasStaticWebsites) generatedIds.push(`tailor-deploy/tailor-build-site-${app.name}`);
+		generatedIds.push(`tailor-deploy/tailor-deploy-${group.id}`);
+	}
 	return {
 		content: out,
 		generatedIds
@@ -3137,6 +3260,25 @@ function renderTailorSetupAction(params) {
 
 //#endregion
 //#region src/cli/commands/setup/generate.ts
+function actionName(input) {
+	return input.startsWith("tailor-") ? input.slice(7) : input;
+}
+function splitActionGroup(input) {
+	const names = input.split(",").map((entry) => actionName(entry.trim()));
+	if (names.some((name) => name.length === 0)) throw new Error("--action must contain one or more non-empty action names.");
+	return names;
+}
+function uniqueGroupId(names, usedIds) {
+	const base = names.join("-");
+	let id = base;
+	let suffix = 2;
+	while (usedIds.has(id)) {
+		id = `${base}-${suffix}`;
+		suffix += 1;
+	}
+	usedIds.add(id);
+	return id;
+}
 async function defaultLoadConfigName(configPath) {
 	const { config } = await loadConfig(configPath);
 	return config.name;
@@ -3327,7 +3469,7 @@ async function resolve$1(options) {
 		configPath
 	};
 }
-const BUILD_SITE_RUN_RE = /([ \t]*- id: build-site\n[ \t]+shell: bash\n[ \t]+run: \|)([\s\S]*?)(\n[ \t]*- |\n*$)/;
+const BUILD_SITE_RUN_RE = /([ \t]*- id: build-site\n(?:[ \t]+if: [^\n]+\n)?[ \t]+shell: bash\n[ \t]+run: \|)([\s\S]*?)(\n[ \t]*- |\n*$)/;
 /**
 * Strip the mutable run: body of the build-site step before hashing.
 * When hasStaticWebsites is true the step is present; users are expected to
@@ -3469,7 +3611,7 @@ async function setupTarget(options) {
 		kind: resolved.kind,
 		workspaceName: resolved.workspaceName,
 		file: resolved.file,
-		templateVersion: 6,
+		templateVersion: 7,
 		inputs: resolved.inputs,
 		generatedIds: resolved.render.generatedIds,
 		ejectedIds: existing?.ejectedIds ?? [],
@@ -3527,23 +3669,33 @@ async function setupCoordinate(options) {
 	const packageManager = detectPackageManager(outputDir);
 	const lock = readLock(outputDir);
 	if (!lock) throw new Error(".github/tailor-sdk.lock not found. Run `tailor-sdk setup action --name <name>` for each app before running setup coordinate.");
+	const actionTargets = new Map(lock.targets.filter((t) => t.kind === "action").map((target) => [target.workspaceName, target]));
 	const seenNames = /* @__PURE__ */ new Set();
-	const apps = actions.map((actionName) => {
-		const name = actionName.startsWith("tailor-") ? actionName.slice(7) : actionName;
-		if (seenNames.has(name)) throw new Error(`Duplicate --action "${name}". Each composite action can only appear once in a coordinator.`);
-		seenNames.add(name);
-		const entry = lock.targets.find((t) => t.kind === "action" && t.workspaceName === name);
-		if (!entry) throw new Error(`Action target "${name}" not found in .github/tailor-sdk.lock. Run \`tailor-sdk setup action --name ${name}\` first.`);
-		validateDir(entry.inputs.dir);
+	const usedGroupIds = /* @__PURE__ */ new Set();
+	const actionGroups = actions.map((actionGroup) => {
+		const names = splitActionGroup(actionGroup);
+		const apps = names.map((name) => {
+			if (seenNames.has(name)) throw new Error(`Duplicate --action "${name}". Each composite action can only appear once in a coordinator.`);
+			seenNames.add(name);
+			const entry = actionTargets.get(name);
+			if (!entry) throw new Error(`Action target "${name}" not found in .github/tailor-sdk.lock. Run \`tailor-sdk setup action --name ${name}\` first.`);
+			if (names.length > 1 && entry.templateVersion < 7) throw new Error(`Action target "${name}" was generated with an older setup template. Run \`tailor-sdk setup action --name ${name} --force\` before grouping it in setup coordinate.`);
+			validateDir(entry.inputs.dir);
+			return {
+				name,
+				dir: entry.inputs.dir,
+				hasStaticWebsites: entry.inputs.hasStaticWebsites
+			};
+		});
 		return {
-			name,
-			dir: entry.inputs.dir
+			id: uniqueGroupId(names, usedGroupIds),
+			apps
 		};
 	});
 	const render = renderCoordinateWorkflow({
 		coordinatorName,
 		kind: coordinateKind,
-		apps,
+		actionGroups,
 		branch: branch ?? void 0,
 		tagPattern: coordinateKind === "tag" ? tagPattern : void 0,
 		environment,
@@ -3579,7 +3731,7 @@ async function setupCoordinate(options) {
 		kind: "coordinate",
 		workspaceName: coordinatorName,
 		file,
-		templateVersion: 6,
+		templateVersion: 7,
 		inputs: {
 			branch,
 			branchAutoDetected: coordinateKind === "branch" ? branchAutoDetected : branch !== null ? false : void 0,
@@ -3587,7 +3739,7 @@ async function setupCoordinate(options) {
 			environment,
 			dir: ".",
 			packageManager,
-			actionDirs: apps.map((a) => a.dir)
+			actionDirs: actionGroups.flatMap((group) => group.apps.map((a) => a.dir))
 		},
 		generatedIds: render.generatedIds,
 		ejectedIds: existing?.ejectedIds ?? [],
@@ -3611,8 +3763,8 @@ async function setupCoordinate(options) {
 	logger.log(`   gh secret set TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID --env ${environment}`);
 	logger.log(`   gh secret set TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET --env ${environment}`);
 	logger.newline();
-	logger.log(`2. Provision each workspace and set TAILOR_PLATFORM_WORKSPACE_ID on the "${environment}" environment:`);
-	logger.log("   tailor-sdk workspace create   # one per app; copy the id");
+	logger.log(`2. Provision the target workspace and set TAILOR_PLATFORM_WORKSPACE_ID on the "${environment}" environment:`);
+	logger.log("   tailor-sdk workspace create   # if it does not exist yet; copy the id");
 	logger.log(`   gh variable set TAILOR_PLATFORM_WORKSPACE_ID --env ${environment}`);
 	logger.newline();
 	logger.log("3. Commit the generated files:");
@@ -3767,7 +3919,7 @@ async function checkGitHub(options) {
 			currentHash,
 			configExists,
 			defaultBranch,
-			templateVersion: 6,
+			templateVersion: 7,
 			erdNamespaces,
 			hasMigrations,
 			hasSeeds,
@@ -3805,7 +3957,7 @@ function resolveMatch(outputDir, targets, input) {
 }
 function warnCoordinatorReferences(allTargets, deletedKeys, match) {
 	if (match.target.kind !== "action") return;
-	for (const coordinator of allTargets) if (coordinator.kind === "coordinate" && coordinator.inputs.actionDirs?.includes(match.target.inputs.dir) && !deletedKeys.has(targetKey(coordinator))) logger.warn(`Coordinator "${coordinator.workspaceName}" still references this action's directory (${match.target.inputs.dir}). Re-run \`tailor-sdk setup coordinate\` without --action ${match.target.workspaceName} to remove it there too.`);
+	for (const coordinator of allTargets) if (coordinator.kind === "coordinate" && coordinator.inputs.actionDirs?.includes(match.target.inputs.dir) && !deletedKeys.has(targetKey(coordinator))) logger.warn(`Coordinator "${coordinator.workspaceName}" still references this action's directory (${match.target.inputs.dir}). Remove \`${match.target.workspaceName}\` from the relevant \`--action\` value and re-run \`tailor-sdk setup coordinate\` to update it.`);
 }
 /**
 * Delete managed workflow/action files and their `.github/tailor-sdk.lock` entries.
@@ -3873,7 +4025,7 @@ const coordinateCommand = defineAppCommand({
 			alias: "n",
 			description: "Coordinator name (used in the generated workflow file name and job names)"
 		}),
-		action: arg(z.array(z.string().min(1)).min(1), { description: "Composite action to include (can be specified multiple times). tailor- prefix optional." }),
+		action: arg(z.array(z.string().min(1)).min(1), { description: "Composite action to include. Repeat for separate deploy steps, or use commas to deploy actions as one multi-config group. tailor- prefix optional." }),
 		branch: arg(z.string().min(1).optional(), { description: "Branch target: deploy trigger branch (defaults to the detected default branch)" }),
 		tag: arg(z.boolean().default(false), { description: "Generate a tag target coordinator" }),
 		environment: arg(z.string().min(1).optional(), { description: "GitHub Environment for the plan/deploy jobs" }),
@@ -6070,7 +6222,7 @@ async function fetchRemoteTypes(client, workspaceId, namespace) {
 async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	const { config, plugins } = loaded;
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-BJKNlv8c.mjs");
+	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-DbvD5UUz.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager