fix(cli): track auth connection ownership via platform labels

[toiroakr]

Summary

• deploy now tags auth connections with SDK ownership labels (via the auth_connection TRN) and uses those labels to decide which connections to manage, consistent with every other auth resource.
• When the platform does not support auth connection metadata, deploy falls back to the local secrets-state, so connections created outside the SDK (e.g. Terraform or the console) are never deleted.
• Auth connection deletions are surfaced in the important-deletion confirmation prompt.

[changeset-bot]

🦋 Changeset detected

Latest commit: 0aed96a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@tailor-platform/sdk	Patch
@tailor-platform/create-sdk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

⚡ pkg.pr.new

@tailor-platform/sdk

pnpm add https://pkg.pr.new/@tailor-platform/sdk@9e4c726

pnpm dlx https://pkg.pr.new/@tailor-platform/sdk@9e4c726 --help

@tailor-platform/create-sdk

pnpm add https://pkg.pr.new/@tailor-platform/create-sdk@9e4c726

pnpm dlx https://pkg.pr.new/@tailor-platform/create-sdk@9e4c726 my-app

commit: 9e4c726

[pkg-pr-new]

Open in StackBlitz

pnpm add https://pkg.pr.new/@tailor-platform/create-sdk@0aed96a

pnpm add https://pkg.pr.new/@tailor-platform/sdk@0aed96a

commit: 0aed96a

[github-actions]

Code Metrics Report (packages/sdk)

	main (7e4200f)	#1309 (92202d8)	+/-
Coverage	66.0%	66.1%	+0.1%
Code to Test Ratio	1:0.4	1:0.4	+0.0

Details

  |                    | main (7e4200f) | #1309 (92202d8) |  +/-  |
  |--------------------|----------------|-----------------|-------|
+ | Coverage           |          66.0% |           66.1% | +0.1% |
  |   Files            |            394 |             394 |     0 |
  |   Lines            |          13519 |           13522 |    +3 |
+ |   Covered          |           8928 |            8944 |   +16 |
+ | Code to Test Ratio |          1:0.4 |           1:0.4 |  +0.0 |
  |   Code             |          90419 |           90584 |  +165 |
+ |   Test             |          39066 |           39224 |  +158 |

Code coverage of files in pull request scope (66.2% → 70.4%)

Files	Coverage	+/-	Status
packages/sdk/src/cli/commands/deploy/auth-connection.ts	44.3%	+13.8%	modified
packages/sdk/src/cli/commands/deploy/deploy.ts	82.3%	-0.3%	modified

SDK Configure Bundle Size

	main (7e4200f)	#1309 (92202d8)	+/-
configure-index-size	19.69KB	19.69KB	0KB
dependency-chunks-size	34.65KB	34.65KB	0KB
total-bundle-size	54.34KB	54.34KB	0KB

Runtime Performance

	main (7e4200f)	#1309 (92202d8)	+/-
Generate Median	2,132ms	2,769ms	637ms
Generate Max	2,175ms	2,791ms	616ms
Apply Build Median	2,167ms	2,813ms	646ms
Apply Build Max	2,185ms	2,851ms	666ms

Type Performance (instantiations)

	main (7e4200f)	#1309 (92202d8)	+/-
tailordb-basic	33,959	33,959	0
tailordb-optional	3,841	3,841	0
tailordb-relation	5,921	5,921	0
tailordb-validate	2,566	2,566	0
tailordb-hooks	5,767	5,767	0
tailordb-object	12,136	12,136	0
tailordb-enum	2,462	2,462	0
resolver-basic	9,424	9,424	0
resolver-nested	26,111	26,111	0
resolver-array	18,187	18,187	0
executor-schedule	4,234	4,234	0
executor-webhook	873	873	0
executor-record	6,659	6,659	0
executor-resolver	4,369	4,369	0
executor-operation-function	868	868	0
executor-operation-gql	869	869	0
executor-operation-webhook	888	888	0
executor-operation-workflow	1,714	1,714	0

---

Reported by octocov

[Copilot]

Pull request overview

This PR updates the deploy CLI’s auth-connection handling to align with the ownership/metadata approach used for other auth resources: connections are labeled via platform metadata (using the auth_connection TRN segment) and deletions are gated by those labels, with a safe fallback to local secrets-state when metadata isn’t supported.

Changes:

• Switch auth connection TRNs from auth-connection to auth_connection for platform metadata operations.
• Change deletion eligibility: when metadata is unsupported, only delete connections previously tracked in secrets-state (preventing deletion of externally-managed connections).
• Surface auth connection deletions in the “important deletions” confirmation prompt and add unit tests covering the new ownership/deletion behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
packages/sdk/src/cli/commands/deploy/deploy.ts	Includes auth connection deletions in the important-deletion confirmation list.
packages/sdk/src/cli/commands/deploy/auth-connection.ts	Uses auth_connection TRNs and label-based ownership; adds secrets-state fallback to constrain deletions when metadata is unsupported.
packages/sdk/src/cli/commands/deploy/auth-connection.test.ts	Adds tests for TRN segment usage and deletion behavior across metadata-supported vs unsupported platforms.
.changeset/auth-connection-labels.md	Documents the CLI behavior change as a patch release note.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.