@tailor-platform/sdk 2.0.0-next.3 → 2.0.0-next.4

package/dist/authconnection-CZvi9ANm.mjs

@@ -0,0 +1,9 @@
+//#region src/runtime/authconnection.ts
+const api = () => globalThis.tailor.authconnection;
+const getConnectionToken = (...args) => api().getConnectionToken(...args);
+/** Runtime wrapper namespace for `tailor.authconnection`. */
+const authconnection = { getConnectionToken };
+
+//#endregion
+export { authconnection as t };
+//# sourceMappingURL=authconnection-CZvi9ANm.mjs.map

package/dist/authconnection-CZvi9ANm.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authconnection-CZvi9ANm.mjs","names":[],"sources":["../src/runtime/authconnection.ts"],"sourcesContent":["/**\n * Auth connection utilities.\n *\n * Thin typed wrapper around the platform-provided `tailor.authconnection` runtime API.\n * At runtime this delegates to `globalThis.tailor.authconnection`. Use\n * `mockAuthconnection` from `@tailor-platform/sdk/vitest` to mock in unit tests.\n *\n * `connectionName` is narrowed to the connection names defined in `defineAuth()`'s\n * `connections` once `tailor.d.ts` has been generated (via `tailor deploy`/`generate`).\n * @example\n * import { authconnection } from \"@tailor-platform/sdk/runtime\";\n *\n * const token = await authconnection.getConnectionToken(\"my-connection\");\n */\n\nimport type { AuthConnectionTokenResult } from \"#/configure/services/auth/types\";\n// Import from the public entry (not `#/configure/types/connection-name`) so this d.ts\n// references `@tailor-platform/sdk` externally instead of inlining the registry — a single\n// generated `declare module \"@tailor-platform/sdk\"` then narrows this entry too.\nimport type { ConnectionName } from \"@tailor-platform/sdk\";\n\n/**\n * Platform API surface for `tailor.authconnection`. Describes the shape the\n * platform runtime injects on `globalThis.tailor.authconnection`.\n */\nexport interface TailorAuthconnectionAPI {\n  /**\n   * Returns the access token for the given auth connection.\n   * @param connectionName - Auth connection name as defined in tailor.config\n   * @returns Token payload\n   */\n  getConnectionToken(connectionName: ConnectionName): Promise<AuthConnectionTokenResult>;\n}\n\nconst api = (): TailorAuthconnectionAPI =>\n  (globalThis as unknown as { tailor: { authconnection: TailorAuthconnectionAPI } }).tailor\n    .authconnection;\n\nconst getConnectionToken: TailorAuthconnectionAPI[\"getConnectionToken\"] = (...args) =>\n  api().getConnectionToken(...args);\n\n/** Runtime wrapper namespace for `tailor.authconnection`. */\nexport const authconnection = { getConnectionToken } as const satisfies TailorAuthconnectionAPI;\n"],"mappings":";AAkCA,MAAM,YACH,WAAkF,OAChF;AAEL,MAAM,sBAAqE,GAAG,SAC5E,IAAI,CAAC,CAAC,mBAAmB,GAAG,IAAI;;AAGlC,MAAa,iBAAiB,EAAE,mBAAmB"}

package/dist/brand-Eo4pLXPJ.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"brand-Eo4pLXPJ.mjs","names":[],"sources":["../src/utils/brand.ts"],"sourcesContent":["// Symbol.for ensures the same symbol is returned across different ESM module instances,\n// avoiding identity mismatches when multiple copies of the SDK are loaded.\nexport const SDK_BRAND: unique symbol = Symbol.for(\"tailor-platform/sdk\");\n\nexport type SdkBrandKind =\n  | \"tailordb-type\"\n  | \"resolver\"\n  | \"executor\"\n  | \"workflow\"\n  | \"workflow-job\"\n  | \"wait-point\"\n  | \"http-adapter\";\n\n/**\n * Adds a non-enumerable SDK brand symbol to the given object (in-place).\n * The brand stores the kind so service loaders can distinguish between\n * different SDK object types (e.g. a type loader skips executors).\n * @param value - The object to brand\n * @param kind - The kind of SDK object\n * @returns The same object with the brand applied\n */\nexport function brandValue<T extends object>(value: T, kind: SdkBrandKind): T {\n  Object.defineProperty(value, SDK_BRAND, {\n    value: kind,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  });\n  return value;\n}\n\n/**\n * Checks whether the given value has been branded by the SDK.\n * When kind is specified, only returns true if the brand matches that kind.\n * Accepts a single kind or an array of kinds for multi-kind matching.\n * @param value - The value to check\n * @param kind - Optional kind or kinds to match against\n * @returns True if the value has the SDK brand symbol (and matches kind if specified)\n */\nexport function isSdkBranded(\n  value: unknown,\n  kind?: SdkBrandKind | readonly SdkBrandKind[],\n): boolean {\n  if (value === null || typeof value !== \"object\" || !(SDK_BRAND in value)) return false;\n  const stored = (value as Record<symbol, unknown>)[SDK_BRAND];\n  // No kind filter → any brand matches. Legacy `true` brand → matches any kind.\n  return (\n    kind === undefined ||\n    stored === true ||\n    (Array.isArray(kind) ? kind.includes(stored as SdkBrandKind) : stored === kind)\n  );\n}\n"],"mappings":";AAEA,MAAa,YAA2B,OAAO,IAAI,qBAAqB;;;;;;;;;AAmBxE,SAAgB,WAA6B,OAAU,MAAuB;CAC5E,OAAO,eAAe,OAAO,WAAW;EACtC,OAAO;EACP,YAAY;EACZ,cAAc;EACd,UAAU;CACZ,CAAC;CACD,OAAO;AACT;;;;;;;;;AAUA,SAAgB,aACd,OACA,MACS;CACT,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,EAAE,aAAa,QAAQ,OAAO;CACjF,MAAM,SAAU,MAAkC;CAElD,OACE,SAAS,UACT,WAAW,SACV,MAAM,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAsB,IAAI,WAAW;AAE9E"}
+{"version":3,"file":"brand-Eo4pLXPJ.mjs","names":[],"sources":["../src/utils/brand.ts"],"sourcesContent":["// Symbol.for ensures the same symbol is returned across different ESM module instances,\n// avoiding identity mismatches when multiple copies of the SDK are loaded.\nexport const SDK_BRAND: unique symbol = Symbol.for(\"tailor-platform/sdk\");\n\nexport type SdkBrandKind =\n  | \"tailordb-type\"\n  | \"resolver\"\n  | \"executor\"\n  | \"workflow\"\n  | \"workflow-job\"\n  | \"wait-point\"\n  | \"execution-policy\"\n  | \"http-adapter\";\n\n/**\n * Adds a non-enumerable SDK brand symbol to the given object (in-place).\n * The brand stores the kind so service loaders can distinguish between\n * different SDK object types (e.g. a type loader skips executors).\n * @param value - The object to brand\n * @param kind - The kind of SDK object\n * @returns The same object with the brand applied\n */\nexport function brandValue<T extends object>(value: T, kind: SdkBrandKind): T {\n  Object.defineProperty(value, SDK_BRAND, {\n    value: kind,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  });\n  return value;\n}\n\n/**\n * Checks whether the given value has been branded by the SDK.\n * When kind is specified, only returns true if the brand matches that kind.\n * Accepts a single kind or an array of kinds for multi-kind matching.\n * @param value - The value to check\n * @param kind - Optional kind or kinds to match against\n * @returns True if the value has the SDK brand symbol (and matches kind if specified)\n */\nexport function isSdkBranded(\n  value: unknown,\n  kind?: SdkBrandKind | readonly SdkBrandKind[],\n): boolean {\n  if (value === null || typeof value !== \"object\" || !(SDK_BRAND in value)) return false;\n  const stored = (value as Record<symbol, unknown>)[SDK_BRAND];\n  // No kind filter → any brand matches. Legacy `true` brand → matches any kind.\n  return (\n    kind === undefined ||\n    stored === true ||\n    (Array.isArray(kind) ? kind.includes(stored as SdkBrandKind) : stored === kind)\n  );\n}\n"],"mappings":";AAEA,MAAa,YAA2B,OAAO,IAAI,qBAAqB;;;;;;;;;AAoBxE,SAAgB,WAA6B,OAAU,MAAuB;CAC5E,OAAO,eAAe,OAAO,WAAW;EACtC,OAAO;EACP,YAAY;EACZ,cAAc;EACd,UAAU;CACZ,CAAC;CACD,OAAO;AACT;;;;;;;;;AAUA,SAAgB,aACd,OACA,MACS;CACT,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,EAAE,aAAa,QAAQ,OAAO;CACjF,MAAM,SAAU,MAAkC;CAElD,OACE,SAAS,UACT,WAAW,SACV,MAAM,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAsB,IAAI,WAAW;AAE9E"}

package/dist/cli/commands/deploy/workflow-execution-policy.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/cli/index.mjs

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import { C as CustomDomainStatus, R as FunctionExecution_Type, mt as AuthInvokerSchema, xt as PATScope } from "../service_pb-CIrhGwHk.mjs";
 import { t as assertDefined } from "../assert-DBxo8jPo.mjs";
 import { n as logger, r as styles } from "../logger-BEiZZ3qT.mjs";
-import { $t as compareSnapshotWithRemote, A as listCommand$13, An as apiCommand, Bn as pagedLogArgs, C as listCommand$14, Cn as hasChanges, Dn as PluginManager, Dt as listCommand$7, E as waitCommand, En as sdkNameLabelKey, F as generateCommand$1, Fn as configArg, G as removeCommand$1, Gt as deploy, H as extractOwnedNamespaces, Hn as toPageDirection, Ht as formatKeyValueTable, I as generateMigrationScript, In as confirmationArgs, It as getCommand$6, K as updateCommand$3, Kt as ensureConfigId, L as writeDbTypesFile, Ln as deploymentArgs, Mn as assertWritable, N as truncateCommand, Nn as defineAppCommand, O as resumeCommand, On as generateUserTypes, Pn as commonArgs, Pt as startCommand, Q as getCommand$5, Qt as parseMigrationLabelNumber, R as getConfiguredEditorCommand, Rn as isVerbose, Rt as executionsCommand, Sn as formatMigrationDiff, T as healthCommand, Tn as resourceTrn, Tt as triggerCommand, U as logBetaWarning, Un as workspaceArgs, Ut as getCommand$1, V as showCommand, Vn as paginationArgs, Vt as functionExecutionStatusToString, X as listCommand$12, Xt as MIGRATION_LABEL_KEY, Y as treeCommand, Zt as handleOptionalToRequiredError, _n as loadDiff, b as createCommand$4, bn as parseMigrationNumberArg, c as listCommand$15, cn as compareLocalTypesWithSnapshot, ct as createCommand$3, dn as getLatestMigrationNumber, en as generateAllTypeManifestsFromSnapshot, et as updateCommand$2, f as restoreCommand, ft as getCommand$3, g as getCommand$7, gn as isValidMigrationNumber, gt as listCommand$9, ht as tokenCommand$1, i as updateCommand$4, in as INITIAL_SCHEMA_NUMBER, it as getCommand$4, jt as jobsCommand, kn as prompt, m as listCommand$16, mn as getMigrationFiles, nt as listCommand$11, o as removeCommand, ot as deleteCommand$4, pn as getMigrationFilePath, qt as executeScript, r as queryCommand, sn as assertValidMigrationFiles, t as registerTsHook, tn as protoGqlPermission, u as inviteCommand, un as createSnapshotFromLocalTypes, ut as listCommand$10, v as deleteCommand$5, vn as reconstructSnapshotFromMigrations, vt as generate, wn as getNamespacesWithMigrations, wt as webhookCommand, xt as getCommand$2, yn as formatMigrationNumber, yt as listCommand$8, z as openInConfiguredEditor, zn as multiConfigArg } from "../register-ts-hook-ZpBacA07.mjs";
-import { A as hasUserTokenEntry, B as removeLegacyUserAlias, C as getDistDir, D as deleteUserTokens, E as loadConfig, F as loadPlatformClientConfig, G as closeConnectionPool, H as resolveUserTokenKey, I as loadStoredUserTokens, J as fetchAllTolerant, K as defaultPlatformBaseUrl, L as loadWorkspaceId, M as loadConfigPath, N as loadConsoleBaseUrl, O as fetchLatestToken, P as loadMachineUserName, Q as fetchUserInfo, R as platformConfigFromProfile, U as saveUserTokens, V as resolveConfigUser, W as writePlatformConfig, X as fetchPaged, Z as fetchPlatformMachineUserToken, _ as composeFunctionTreeshakeOptions, a as resolveInlineSourcemap, at as isDefaultPlatform, c as ResolverSchema, et as getOAuth2ClientId, g as platformBundleDefinePlugin, it as initOperatorClient, j as loadAccessToken, k as hasAnyUserTokenEntry, nt as getPlatformBaseUrl, q as fetchAll, rt as initOAuth2Client, s as WorkflowJobSchema, t as defineApplication, tt as getOrNull, u as INVOKER_EXPR, v as createLogLevelTreeshakeOptions, w as hashContent$1, y as resolveBundleLogLevel, z as readPlatformConfig } from "../application-eHp9jXld.mjs";
+import { $ as fetchUserInfo, A as hasAnyUserTokenEntry, B as readPlatformConfig, D as loadConfig, Et as workspaceArgs, F as loadMachineUserName, G as writePlatformConfig, H as resolveConfigUser, I as loadPlatformClientConfig, J as fetchAll, K as closeConnectionPool, L as loadStoredUserTokens, M as loadAccessToken, N as loadConfigPath, O as deleteUserTokens, P as loadConsoleBaseUrl, Q as fetchPlatformMachineUserToken, R as loadWorkspaceId, T as hashContent$1, Tt as toPageDirection, U as resolveUserTokenKey, V as removeLegacyUserAlias, W as saveUserTokens, Y as fetchAllTolerant, Z as fetchPaged, _ as platformBundleDefinePlugin, a as resolveInlineSourcemap, at as initOperatorClient, b as resolveBundleLogLevel, bt as pagedLogArgs, c as WorkflowJobSchema, d as INVOKER_EXPR, dt as confirmationArgs, ft as deploymentArgs, gt as multiConfigArg, ht as isVerbose, it as initOAuth2Client, j as hasUserTokenEntry, k as fetchLatestToken, l as ResolverSchema, lt as commonArgs, nt as getOrNull, ot as isDefaultPlatform, q as defaultPlatformBaseUrl, rt as getPlatformBaseUrl, t as defineApplication, tt as getOAuth2ClientId, ut as configArg, v as composeFunctionTreeshakeOptions, w as getDistDir, wt as resolveMachineUserInputSource, xt as paginationArgs, y as createLogLevelTreeshakeOptions, z as platformConfigFromProfile } from "../application-BX13RArL.mjs";
+import { $t as compareSnapshotWithRemote, A as listCommand$13, An as apiCommand, C as listCommand$14, Cn as hasChanges, Dn as PluginManager, Dt as listCommand$7, E as waitCommand, En as sdkNameLabelKey, F as generateCommand$1, G as removeCommand$1, Gt as deploy, H as extractOwnedNamespaces, Ht as formatKeyValueTable, I as generateMigrationScript, It as getCommand$6, K as updateCommand$3, Kt as ensureConfigId, L as writeDbTypesFile, Mn as assertWritable, N as truncateCommand, Nn as defineAppCommand, O as resumeCommand, On as generateUserTypes, Pt as startCommand, Q as getCommand$5, Qt as parseMigrationLabelNumber, R as getConfiguredEditorCommand, Rt as executionsCommand, Sn as formatMigrationDiff, T as healthCommand, Tn as resourceTrn, Tt as triggerCommand, U as logBetaWarning, Ut as getCommand$1, V as showCommand, Vt as functionExecutionStatusToString, X as listCommand$12, Xt as MIGRATION_LABEL_KEY, Y as treeCommand, Zt as handleOptionalToRequiredError, _n as loadDiff, b as createCommand$4, bn as parseMigrationNumberArg, c as listCommand$15, cn as compareLocalTypesWithSnapshot, ct as createCommand$3, dn as getLatestMigrationNumber, en as generateAllTypeManifestsFromSnapshot, et as updateCommand$2, f as restoreCommand, ft as getCommand$3, g as getCommand$7, gn as isValidMigrationNumber, gt as listCommand$9, ht as tokenCommand$1, i as updateCommand$4, in as INITIAL_SCHEMA_NUMBER, it as getCommand$4, jt as jobsCommand, kn as prompt, m as listCommand$16, mn as getMigrationFiles, nt as listCommand$11, o as removeCommand, ot as deleteCommand$4, pn as getMigrationFilePath, qt as executeScript, r as queryCommand, sn as assertValidMigrationFiles, t as registerTsHook, tn as protoGqlPermission, u as inviteCommand, un as createSnapshotFromLocalTypes, ut as listCommand$10, v as deleteCommand$5, vn as reconstructSnapshotFromMigrations, vt as generate, wn as getNamespacesWithMigrations, wt as webhookCommand, xt as getCommand$2, yn as formatMigrationNumber, yt as listCommand$8, z as openInConfiguredEditor } from "../register-ts-hook-BM1caLT0.mjs";
 import { i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-ufH7sS8o.mjs";
 import { t as multiline } from "../multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "../package-json-8b0O9TlX.mjs";
 import { i as userAgent } from "../secret-file-aoNXJmKa.mjs";
 import { n as isCLIError } from "../errors-118wUDRr.mjs";
+import { B as FunctionExecution_Type, Ct as PATScope, T as CustomDomainStatus, gt as AuthInvokerSchema } from "../service_pb-B5w9rjPY.mjs";
 import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-Cg-pqRJV.mjs";
 import { t as isPluginGeneratedType } from "../type-source-DH_LH20p.mjs";
 import * as path from "pathe";
@@ -1425,6 +1425,7 @@ When a \`.js\` file is provided, detection and bundling are skipped and the file
 		const authNamespace = resolveAuthNamespace(config.auth);
 		const machineUserName = await resolveMachineUserName({
 			cliMachineUser: args["machine-user"],
+			cliMachineUserSource: resolveMachineUserInputSource(args["machine-user"]),
 			profile: args.profile,
 			authConfig: config.auth
 		});
@@ -1545,9 +1546,10 @@ function resolveAuthNamespace(authConfig) {
 * @returns Resolved machine user name
 */
 async function resolveMachineUserName(options) {
-	const { cliMachineUser, profile, authConfig } = options;
+	const { cliMachineUser, cliMachineUserSource, profile, authConfig } = options;
 	const resolved = await loadMachineUserName({
 		machineUser: cliMachineUser,
+		machineUserSource: cliMachineUserSource,
 		profile
 	});
 	if (resolved) return resolved;
@@ -3169,7 +3171,7 @@ function findTarget(lock, kind, workspaceName) {
 
 //#endregion
 //#region src/cli/commands/setup/action.yml
-var action_default = "# __HEADER__\nname: __WORKSPACE_NAME__\ndescription: >-\n  Deploy __WORKSPACE_NAME__ to Tailor Platform.\n  Checkout and dependency installation are expected to be handled by the caller.\n\ninputs:\n  workspace-id:\n    description: Tailor Platform workspace id\n    required: true\n  name:\n    description: Workspace name (used in Slack notifications)\n    required: true\n  working-directory:\n    description: App directory relative to the repository root\n    required: false\n    default: \".\"\n  platform-client-id:\n    description: Machine-user client id\n    required: true\n  platform-client-secret:\n    description: Machine-user client secret\n    required: true\n  slack-token:\n    description: Slack bot token\n    required: false\n  slack-channel-id:\n    description: Slack channel id\n    required: false\n  user-mapping:\n    description: JSON string mapping GitHub usernames to Slack user IDs\n    required: false\n  package-manager:\n    description: Package manager used for dependency installation (pnpm, npm, yarn, bun)\n    required: false\n    default: pnpm\n\noutputs:\n  app-url:\n    description: Deployed application URL\n    value: ${{ steps.tailor-apply.outputs.app-url }}\n\nruns:\n  using: composite\n  steps:\n    # __STATIC_WEBSITE_BUILD_START__\n    - id: build-site\n      shell: bash\n      run: |\n        # Replace with your static website build command.\n        # Example: pnpm --filter <package-name> run build:static\n        # Note: this run: command is user-editable. Custom build commands are preserved across\n        # reruns and are not treated as drift by setup check. Other edits to this file are flagged\n        # as drift and will be overwritten if you re-run setup action with --force.\n        true\n    # __STATIC_WEBSITE_BUILD_END__\n    - id: tailor-apply\n      uses: tailor-platform/actions/deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n      with:\n        workspace-id: ${{ inputs.workspace-id }}\n        working-directory: ${{ inputs.working-directory }}\n        package-manager: ${{ inputs.package-manager }}\n        platform-client-id: ${{ inputs.platform-client-id }}\n        platform-client-secret: ${{ inputs.platform-client-secret }}\n    - id: tailor-notify\n      if: failure() && inputs.slack-token != '' && inputs.slack-channel-id != ''\n      uses: tailor-platform/actions/notify@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n      with:\n        provider: slack\n        status: failure\n        workspace-name: ${{ inputs.name }}\n        slack-token: ${{ inputs.slack-token }}\n        slack-channel-id: ${{ inputs.slack-channel-id }}\n        user-mapping: ${{ inputs.user-mapping }}\n";
+var action_default = "# __HEADER__\nname: __WORKSPACE_NAME__\ndescription: >-\n  Deploy __WORKSPACE_NAME__ to Tailor Platform.\n  Checkout and dependency installation are expected to be handled by the caller.\n\ninputs:\n  workspace-id:\n    description: Tailor Platform workspace id\n    required: true\n  name:\n    description: Workspace name (used in Slack notifications)\n    required: true\n  working-directory:\n    description: App directory relative to the repository root\n    required: false\n    default: \".\"\n  config:\n    description: SDK config path, or comma-separated config paths for multi-config deploys\n    required: false\n    default: \"tailor.config.ts\"\n  deploy:\n    description: Whether to run the Tailor deploy step after build steps\n    required: false\n    default: \"true\"\n  build-site:\n    description: Whether to run the static website build slot when present\n    required: false\n    default: \"true\"\n  platform-client-id:\n    description: Machine-user client id\n    required: true\n  platform-client-secret:\n    description: Machine-user client secret\n    required: true\n  slack-token:\n    description: Slack bot token\n    required: false\n  slack-channel-id:\n    description: Slack channel id\n    required: false\n  user-mapping:\n    description: JSON string mapping GitHub usernames to Slack user IDs\n    required: false\n  package-manager:\n    description: Package manager used for dependency installation (pnpm, npm, yarn, bun)\n    required: false\n    default: pnpm\n\noutputs:\n  app-url:\n    description: Deployed application URL\n    value: ${{ steps.tailor-apply.outputs.app-url }}\n\nruns:\n  using: composite\n  steps:\n    # __STATIC_WEBSITE_BUILD_START__\n    - id: build-site\n      if: inputs.build-site == 'true'\n      shell: bash\n      run: |\n        # Replace with your static website build command.\n        # Example: pnpm --filter <package-name> run build:static\n        # Note: this run: command is user-editable. Custom build commands are preserved across\n        # reruns and are not treated as drift by setup check. Other edits to this file are flagged\n        # as drift and will be overwritten if you re-run setup action with --force.\n        true\n    # __STATIC_WEBSITE_BUILD_END__\n    - id: tailor-apply\n      if: inputs.deploy == 'true'\n      uses: tailor-platform/actions/deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n      env:\n        TAILOR_PLATFORM_SDK_CONFIG_PATH: ${{ inputs.config }}\n      with:\n        workspace-id: ${{ inputs.workspace-id }}\n        working-directory: ${{ inputs.working-directory }}\n        package-manager: ${{ inputs.package-manager }}\n        platform-client-id: ${{ inputs.platform-client-id }}\n        platform-client-secret: ${{ inputs.platform-client-secret }}\n    - id: tailor-notify\n      if: failure() && inputs.slack-token != '' && inputs.slack-channel-id != ''\n      uses: tailor-platform/actions/notify@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n      with:\n        provider: slack\n        status: failure\n        workspace-name: ${{ inputs.name }}\n        slack-token: ${{ inputs.slack-token }}\n        slack-channel-id: ${{ inputs.slack-channel-id }}\n        user-mapping: ${{ inputs.user-mapping }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/branch.workflow.yml
@@ -3366,7 +3368,7 @@ const ACTIONS_SHA = "e74173d4bdd931d036ad359cf5f7729fc6aa7067";
 * @returns Rendered YAML and the list of managed job/step ids
 */
 function renderCoordinateWorkflow(params) {
-	const { coordinatorName, kind, apps, environment, packageManager } = params;
+	const { coordinatorName, kind, actionGroups, environment, packageManager } = params;
 	const isTag = kind === "tag";
 	const branch = params.branch;
 	const tagPattern = params.tagPattern ?? "v*";
@@ -3401,29 +3403,60 @@ function renderCoordinateWorkflow(params) {
 		`  with:`,
 		`    package-manager: ${packageManager}`
 	].join("\n");
-	const perAppPlanSteps = apps.flatMap((app) => {
+	const configPath = (app) => app.dir === "." ? "tailor.config.ts" : `${app.dir}/tailor.config.ts`;
+	const groupConfigPath = (group) => group.apps.map(configPath).join(",");
+	const firstApp = (group) => {
+		const [app] = group.apps;
+		if (!app) throw new Error("Coordinate action groups must contain at least one app.");
+		return app;
+	};
+	const singleAppPlanStep = (group, app) => {
 		const wd = app.dir !== "." ? app.dir : void 0;
 		const wdLine = wd ? `\n    working-directory: ${wd}` : "";
 		return [
-			`- id: tailor-generate-check-${app.name}`,
-			`  uses: tailor-platform/actions/generate-check@${ACTIONS_SHA} # v1.5.1`,
-			`  with:`,
-			`    package-manager: ${packageManager}${wdLine}`,
-			`- id: tailor-plan-${app.name}`,
+			`- id: tailor-plan-${group.id}`,
 			`  if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork`,
 			`  uses: tailor-platform/actions/plan@${ACTIONS_SHA} # v1.5.1`,
 			`  with:`,
 			`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
 			`    package-manager: ${packageManager}${wdLine}`,
-			`    label: ${coordinatorName}/${app.name}`,
+			`    label: ${coordinatorName}/${group.id}`,
 			`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
 			`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
 			`    github-token: \${{ secrets.GITHUB_TOKEN }}`
 		];
+	};
+	const multiConfigPlanStep = (group) => [
+		`- id: tailor-plan-${group.id}`,
+		`  if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork`,
+		`  uses: tailor-platform/actions/plan@${ACTIONS_SHA} # v1.5.1`,
+		`  env:`,
+		`    TAILOR_PLATFORM_SDK_CONFIG_PATH: ${groupConfigPath(group)}`,
+		`  with:`,
+		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+		`    package-manager: ${packageManager}`,
+		`    label: ${coordinatorName}/${group.id}`,
+		`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+		`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+		`    github-token: \${{ secrets.GITHUB_TOKEN }}`
+	];
+	const perAppPlanSteps = actionGroups.flatMap((group) => {
+		const generateCheckSteps = group.apps.flatMap((app) => {
+			const wd = app.dir !== "." ? app.dir : void 0;
+			const wdLine = wd ? `\n    working-directory: ${wd}` : "";
+			return [
+				`- id: tailor-generate-check-${app.name}`,
+				`  uses: tailor-platform/actions/generate-check@${ACTIONS_SHA} # v1.5.1`,
+				`  with:`,
+				`    package-manager: ${packageManager}${wdLine}`
+			];
+		});
+		const planStep = group.apps.length === 1 ? singleAppPlanStep(group, firstApp(group)) : multiConfigPlanStep(group);
+		return [...generateCheckSteps, ...planStep];
 	}).join("\n");
 	out = line(out, "PER_APP_PLAN_STEPS", `${driftCheckStep}\n${perAppPlanSteps}`);
-	const deploySteps = apps.flatMap((app) => [
-		`- id: tailor-deploy-${app.name}`,
+	const singleAppDeployStep = (group, app) => [
+		`- id: tailor-deploy-${group.id}`,
 		`  uses: ./.github/actions/tailor-${app.name}`,
 		`  with:`,
 		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
@@ -3435,7 +3468,39 @@ function renderCoordinateWorkflow(params) {
 		`    slack-token: \${{ secrets.TAILOR_SLACK_BOT_TOKEN }}`,
 		`    slack-channel-id: \${{ vars.TAILOR_SLACK_CHANNEL_ID }}`,
 		`    # editable: api-url:`
-	]).join("\n");
+	];
+	const buildSiteStep = (app) => [
+		`- id: tailor-build-site-${app.name}`,
+		`  uses: ./.github/actions/tailor-${app.name}`,
+		`  with:`,
+		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+		`    name: ${app.name}`,
+		`    working-directory: ${app.dir}`,
+		`    deploy: "false"`,
+		`    package-manager: ${packageManager}`,
+		`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+		`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+		`    slack-token: \${{ secrets.TAILOR_SLACK_BOT_TOKEN }}`,
+		`    slack-channel-id: \${{ vars.TAILOR_SLACK_CHANNEL_ID }}`
+	];
+	const multiConfigDeployStep = (group) => [
+		...group.apps.filter((app) => app.hasStaticWebsites).flatMap(buildSiteStep),
+		`- id: tailor-deploy-${group.id}`,
+		`  uses: ./.github/actions/tailor-${firstApp(group).name}`,
+		`  with:`,
+		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+		`    name: ${coordinatorName}/${group.id}`,
+		`    working-directory: .`,
+		`    config: ${groupConfigPath(group)}`,
+		`    build-site: "false"`,
+		`    package-manager: ${packageManager}`,
+		`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+		`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+		`    slack-token: \${{ secrets.TAILOR_SLACK_BOT_TOKEN }}`,
+		`    slack-channel-id: \${{ vars.TAILOR_SLACK_CHANNEL_ID }}`,
+		`    # editable: api-url:`
+	];
+	const deploySteps = actionGroups.flatMap((group) => group.apps.length === 1 ? singleAppDeployStep(group, firstApp(group)) : multiConfigDeployStep(group)).join("\n");
 	out = line(out, "PER_APP_DEPLOY_STEPS", deploySteps);
 	out = out.replaceAll("__WORKSPACE_NAME__", () => coordinatorName);
 	out = out.replaceAll("__ENVIRONMENT__", () => environment);
@@ -3444,9 +3509,15 @@ function renderCoordinateWorkflow(params) {
 	const generatedIds = [];
 	if (isTag && branch !== void 0) generatedIds.push("tailor-tag-guard", "tailor-tag-guard/tailor-checkout", "tailor-tag-guard/tailor-tag-guard");
 	generatedIds.push("tailor-plan", "tailor-plan/tailor-checkout", "tailor-plan/tailor-setup", "tailor-plan/tailor-drift-check");
-	for (const app of apps) generatedIds.push(`tailor-plan/tailor-generate-check-${app.name}`, `tailor-plan/tailor-plan-${app.name}`);
+	for (const group of actionGroups) {
+		for (const app of group.apps) generatedIds.push(`tailor-plan/tailor-generate-check-${app.name}`);
+		generatedIds.push(`tailor-plan/tailor-plan-${group.id}`);
+	}
 	generatedIds.push("tailor-deploy", "tailor-deploy/tailor-checkout", "tailor-deploy/tailor-setup");
-	for (const app of apps) generatedIds.push(`tailor-deploy/tailor-deploy-${app.name}`);
+	for (const group of actionGroups) {
+		for (const app of group.apps) if (group.apps.length > 1 && app.hasStaticWebsites) generatedIds.push(`tailor-deploy/tailor-build-site-${app.name}`);
+		generatedIds.push(`tailor-deploy/tailor-deploy-${group.id}`);
+	}
 	return {
 		content: out,
 		generatedIds
@@ -3484,6 +3555,25 @@ function renderTailorSetupAction(params) {
 
 //#endregion
 //#region src/cli/commands/setup/generate.ts
+function actionName(input) {
+	return input.startsWith("tailor-") ? input.slice(7) : input;
+}
+function splitActionGroup(input) {
+	const names = input.split(",").map((entry) => actionName(entry.trim()));
+	if (names.some((name) => name.length === 0)) throw new Error("--action must contain one or more non-empty action names.");
+	return names;
+}
+function uniqueGroupId(names, usedIds) {
+	const base = names.join("-");
+	let id = base;
+	let suffix = 2;
+	while (usedIds.has(id)) {
+		id = `${base}-${suffix}`;
+		suffix += 1;
+	}
+	usedIds.add(id);
+	return id;
+}
 async function defaultLoadConfigName(configPath) {
 	const { config } = await loadConfig(configPath);
 	return config.name;
@@ -3674,7 +3764,7 @@ async function resolve$1(options) {
 		configPath
 	};
 }
-const BUILD_SITE_RUN_RE = /([ \t]*- id: build-site\n[ \t]+shell: bash\n[ \t]+run: \|)([\s\S]*?)(\n[ \t]*- |\n*$)/;
+const BUILD_SITE_RUN_RE = /([ \t]*- id: build-site\n(?:[ \t]+if: [^\n]+\n)?[ \t]+shell: bash\n[ \t]+run: \|)([\s\S]*?)(\n[ \t]*- |\n*$)/;
 /**
 * Strip the mutable run: body of the build-site step before hashing.
 * When hasStaticWebsites is true the step is present; users are expected to
@@ -3816,7 +3906,7 @@ async function setupTarget(options) {
 		kind: resolved.kind,
 		workspaceName: resolved.workspaceName,
 		file: resolved.file,
-		templateVersion: 6,
+		templateVersion: 7,
 		inputs: resolved.inputs,
 		generatedIds: resolved.render.generatedIds,
 		ejectedIds: existing?.ejectedIds ?? [],
@@ -3874,23 +3964,33 @@ async function setupCoordinate(options) {
 	const packageManager = detectPackageManager(outputDir);
 	const lock = readLock(outputDir);
 	if (!lock) throw new Error(".github/tailor.lock not found. Run `tailor setup action --name <name>` for each app before running setup coordinate.");
+	const actionTargets = new Map(lock.targets.filter((t) => t.kind === "action").map((target) => [target.workspaceName, target]));
 	const seenNames = /* @__PURE__ */ new Set();
-	const apps = actions.map((actionName) => {
-		const name = actionName.startsWith("tailor-") ? actionName.slice(7) : actionName;
-		if (seenNames.has(name)) throw new Error(`Duplicate --action "${name}". Each composite action can only appear once in a coordinator.`);
-		seenNames.add(name);
-		const entry = lock.targets.find((t) => t.kind === "action" && t.workspaceName === name);
-		if (!entry) throw new Error(`Action target "${name}" not found in .github/tailor.lock. Run \`tailor setup action --name ${name}\` first.`);
-		validateDir(entry.inputs.dir);
+	const usedGroupIds = /* @__PURE__ */ new Set();
+	const actionGroups = actions.map((actionGroup) => {
+		const names = splitActionGroup(actionGroup);
+		const apps = names.map((name) => {
+			if (seenNames.has(name)) throw new Error(`Duplicate --action "${name}". Each composite action can only appear once in a coordinator.`);
+			seenNames.add(name);
+			const entry = actionTargets.get(name);
+			if (!entry) throw new Error(`Action target "${name}" not found in .github/tailor.lock. Run \`tailor setup action --name ${name}\` first.`);
+			if (names.length > 1 && entry.templateVersion < 7) throw new Error(`Action target "${name}" was generated with an older setup template. Run \`tailor setup action --name ${name} --force\` before grouping it in setup coordinate.`);
+			validateDir(entry.inputs.dir);
+			return {
+				name,
+				dir: entry.inputs.dir,
+				hasStaticWebsites: entry.inputs.hasStaticWebsites
+			};
+		});
 		return {
-			name,
-			dir: entry.inputs.dir
+			id: uniqueGroupId(names, usedGroupIds),
+			apps
 		};
 	});
 	const render = renderCoordinateWorkflow({
 		coordinatorName,
 		kind: coordinateKind,
-		apps,
+		actionGroups,
 		branch: branch ?? void 0,
 		tagPattern: coordinateKind === "tag" ? tagPattern : void 0,
 		environment,
@@ -3926,7 +4026,7 @@ async function setupCoordinate(options) {
 		kind: "coordinate",
 		workspaceName: coordinatorName,
 		file,
-		templateVersion: 6,
+		templateVersion: 7,
 		inputs: {
 			branch,
 			branchAutoDetected: coordinateKind === "branch" ? branchAutoDetected : branch !== null ? false : void 0,
@@ -3934,7 +4034,7 @@ async function setupCoordinate(options) {
 			environment,
 			dir: ".",
 			packageManager,
-			actionDirs: apps.map((a) => a.dir)
+			actionDirs: actionGroups.flatMap((group) => group.apps.map((a) => a.dir))
 		},
 		generatedIds: render.generatedIds,
 		ejectedIds: existing?.ejectedIds ?? [],
@@ -3958,8 +4058,8 @@ async function setupCoordinate(options) {
 	logger.log(`   gh secret set TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID --env ${environment}`);
 	logger.log(`   gh secret set TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET --env ${environment}`);
 	logger.newline();
-	logger.log(`2. Provision each workspace and set TAILOR_PLATFORM_WORKSPACE_ID on the "${environment}" environment:`);
-	logger.log("   tailor workspace create   # one per app; copy the id");
+	logger.log(`2. Provision the target workspace and set TAILOR_PLATFORM_WORKSPACE_ID on the "${environment}" environment:`);
+	logger.log("   tailor workspace create   # if it does not exist yet; copy the id");
 	logger.log(`   gh variable set TAILOR_PLATFORM_WORKSPACE_ID --env ${environment}`);
 	logger.newline();
 	logger.log("3. Commit the generated files:");
@@ -4114,7 +4214,7 @@ async function checkGitHub(options) {
 			currentHash,
 			configExists,
 			defaultBranch,
-			templateVersion: 6,
+			templateVersion: 7,
 			erdNamespaces,
 			hasMigrations,
 			hasSeeds,
@@ -4152,7 +4252,7 @@ function resolveMatch(outputDir, targets, input) {
 }
 function warnCoordinatorReferences(allTargets, deletedKeys, match) {
 	if (match.target.kind !== "action") return;
-	for (const coordinator of allTargets) if (coordinator.kind === "coordinate" && coordinator.inputs.actionDirs?.includes(match.target.inputs.dir) && !deletedKeys.has(targetKey(coordinator))) logger.warn(`Coordinator "${coordinator.workspaceName}" still references this action's directory (${match.target.inputs.dir}). Re-run \`tailor-sdk setup coordinate\` without --action ${match.target.workspaceName} to remove it there too.`);
+	for (const coordinator of allTargets) if (coordinator.kind === "coordinate" && coordinator.inputs.actionDirs?.includes(match.target.inputs.dir) && !deletedKeys.has(targetKey(coordinator))) logger.warn(`Coordinator "${coordinator.workspaceName}" still references this action's directory (${match.target.inputs.dir}). Remove \`${match.target.workspaceName}\` from the relevant \`--action\` value and re-run \`tailor-sdk setup coordinate\` to update it.`);
 }
 /**
 * Delete managed workflow/action files and their `.github/tailor-sdk.lock` entries.
@@ -4220,7 +4320,7 @@ const coordinateCommand = defineAppCommand({
 			alias: "n",
 			description: "Coordinator name (used in the generated workflow file name and job names)"
 		}),
-		action: arg(z.array(z.string().min(1)).min(1), { description: "Composite action to include (can be specified multiple times). tailor- prefix optional." }),
+		action: arg(z.array(z.string().min(1)).min(1), { description: "Composite action to include. Repeat for separate deploy steps, or use commas to deploy actions as one multi-config group. tailor- prefix optional." }),
 		branch: arg(z.string().min(1).optional(), { description: "Branch target: deploy trigger branch (defaults to the detected default branch)" }),
 		tag: arg(z.boolean().default(false), { description: "Generate a tag target coordinator" }),
 		environment: arg(z.string().min(1).optional(), { description: "GitHub Environment for the plan/deploy jobs" }),
@@ -6327,7 +6427,7 @@ async function fetchRemoteTypes(client, workspaceId, namespace) {
 async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	const { config, plugins } = loaded;
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-D2hSK1ZL.mjs");
+	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-BO4ZF8wP.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager