@tailor-platform/sdk 1.71.0 → 1.73.0

package/dist/cli/index.mjs

@@ -1,17 +1,16 @@
 #!/usr/bin/env node
-
-import { C as CustomDomainStatus, R as FunctionExecution_Type, mt as AuthInvokerSchema, xt as PATScope } from "../service_pb-BsBR6yW5.mjs";
-import { t as assertDefined } from "../assert-CKfwrmCV.mjs";
-import { n as logger, r as styles } from "../logger-DKF-JsAK.mjs";
-import { $t as generateAllTypeManifestsFromSnapshot, A as listCommand$12, An as apiCommand, Bn as paginationArgs, C as listCommand$13, Cn as getNamespacesWithMigrations, Dn as PluginManager, Dt as listCommand$6, E as waitCommand, En as sdkNameLabelKey, F as generateCommand$1, Fn as configArg, G as removeCommand$1, Gt as deploy, H as extractOwnedNamespaces, Hn as workspaceArgs, Ht as formatKeyValueTable, I as generateMigrationScript, In as confirmationArgs, It as getCommand$6, K as updateCommand$3, Kt as executeScript, L as writeDbTypesFile, Ln as deploymentArgs, Mn as assertWritable, N as truncateCommand, Nn as defineAppCommand, O as resumeCommand, On as generateUserTypes, Pn as commonArgs, Pt as startCommand, Q as getCommand$5, Qt as compareSnapshotWithRemote, R as getConfiguredEditorCommand, Rn as isVerbose, Rt as executionsCommand, Sn as hasChanges, T as healthCommand, Tn as resourceTrn, Tt as triggerCommand, U as logBetaWarning, Ut as getCommand$1, V as showCommand, Vn as toPageDirection, Vt as functionExecutionStatusToString, X as listCommand$11, Xt as handleOptionalToRequiredError, Y as treeCommand, Yt as MIGRATION_LABEL_KEY, Zt as parseMigrationLabelNumber, _n as reconstructSnapshotFromMigrations, b as createCommand$4, c as listCommand$14, ct as createCommand$3, en as protoGqlPermission, et as updateCommand$2, f as restoreCommand, fn as getMigrationFilePath, ft as getCommand$3, g as getCommand$7, gn as loadDiff, gt as listCommand$8, hn as isValidMigrationNumber, ht as tokenCommand, i as updateCommand$4, it as getCommand$4, jt as jobsCommand, kn as prompt, ln as createSnapshotFromLocalTypes, m as listCommand$15, nt as listCommand$10, o as removeCommand, on as assertValidMigrationFiles, ot as deleteCommand$3, pn as getMigrationFiles, r as queryCommand, rn as INITIAL_SCHEMA_NUMBER, sn as compareLocalTypesWithSnapshot, t as isNativeTypeScriptRuntime, u as inviteCommand, un as getLatestMigrationNumber, ut as listCommand$9, v as deleteCommand$4, vn as formatMigrationNumber, vt as generate, wn as ensureConfigId, wt as webhookCommand, xn as formatMigrationDiff, xt as getCommand$2, yn as parseMigrationNumberArg, yt as listCommand$7, z as openInConfiguredEditor, zn as pagedLogArgs } from "../runtime-Cd375HD-.mjs";
-import { $ as initOperatorClient, A as loadAccessToken, B as saveUserTokens, C as hashContent$1, D as fetchLatestToken, E as deleteUserTokens, F as loadStoredUserTokens, H as closeConnectionPool, I as loadWorkspaceId, J as fetchUserInfo, K as fetchPaged, L as platformConfigFromProfile, M as loadConsoleBaseUrl, N as loadMachineUserName, O as hasAnyUserTokenEntry, Q as initOAuth2Client, R as readPlatformConfig, S as getDistDir, T as loadConfig, U as defaultPlatformBaseUrl, V as writePlatformConfig, W as fetchAll, _ as createLogLevelTreeshakeOptions, a as WorkflowJobSchema, c as INVOKER_EXPR, et as isDefaultPlatform, g as composeFunctionTreeshakeOptions, h as platformBundleDefinePlugin, i as resolveInlineSourcemap, k as hasUserTokenEntry, o as ResolverSchema, q as fetchPlatformMachineUserToken, t as defineApplication, v as resolveBundleLogLevel, z as resolveUserTokenKey } from "../application-DmjIKQ-a.mjs";
-import { n as ExecutorSchema } from "../service-B2Jd9CxS.mjs";
-import { t as multiline } from "../multiline-Cf9ODpr1.mjs";
-import { r as isPluginGeneratedType } from "../seed-YAbtMy65.mjs";
-import { t as readPackageJson } from "../package-json-DcQApfPQ.mjs";
-import { i as userAgent } from "../secret-file-eB3R3Fil.mjs";
-import { n as isCLIError } from "../errors-EsY4XO6O.mjs";
-import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-BqyvFk-_.mjs";
+import { C as CustomDomainStatus, R as FunctionExecution_Type, mt as AuthInvokerSchema, xt as PATScope } from "../service_pb-CIrhGwHk.mjs";
+import { t as assertDefined } from "../assert-DBxo8jPo.mjs";
+import { n as logger, r as styles } from "../logger-BEiZZ3qT.mjs";
+import { $t as generateAllTypeManifestsFromSnapshot, A as listCommand$12, An as apiCommand, Bn as paginationArgs, C as listCommand$13, Cn as getNamespacesWithMigrations, Dn as PluginManager, Dt as listCommand$6, E as waitCommand, En as sdkNameLabelKey, F as generateCommand$1, Fn as configArg, G as removeCommand$1, Gt as deploy, H as extractOwnedNamespaces, Hn as workspaceArgs, Ht as formatKeyValueTable, I as generateMigrationScript, In as confirmationArgs, It as getCommand$6, K as updateCommand$3, Kt as executeScript, L as writeDbTypesFile, Ln as deploymentArgs, Mn as assertWritable, N as truncateCommand, Nn as defineAppCommand, O as resumeCommand, On as generateUserTypes, Pn as commonArgs, Pt as startCommand, Q as getCommand$5, Qt as compareSnapshotWithRemote, R as getConfiguredEditorCommand, Rn as isVerbose, Rt as executionsCommand, Sn as hasChanges, T as healthCommand, Tn as resourceTrn, Tt as triggerCommand, U as logBetaWarning, Ut as getCommand$1, V as showCommand, Vn as toPageDirection, Vt as functionExecutionStatusToString, X as listCommand$11, Xt as handleOptionalToRequiredError, Y as treeCommand, Yt as MIGRATION_LABEL_KEY, Zt as parseMigrationLabelNumber, _n as reconstructSnapshotFromMigrations, b as createCommand$4, c as listCommand$14, ct as createCommand$3, en as protoGqlPermission, et as updateCommand$2, f as restoreCommand, fn as getMigrationFilePath, ft as getCommand$3, g as getCommand$7, gn as loadDiff, gt as listCommand$8, hn as isValidMigrationNumber, ht as tokenCommand, i as updateCommand$4, it as getCommand$4, jt as jobsCommand, kn as prompt, ln as createSnapshotFromLocalTypes, m as listCommand$15, nt as listCommand$10, o as removeCommand, on as assertValidMigrationFiles, ot as deleteCommand$3, pn as getMigrationFiles, r as queryCommand, rn as INITIAL_SCHEMA_NUMBER, sn as compareLocalTypesWithSnapshot, t as isNativeTypeScriptRuntime, u as inviteCommand, un as getLatestMigrationNumber, ut as listCommand$9, v as deleteCommand$4, vn as formatMigrationNumber, vt as generate, wn as ensureConfigId, wt as webhookCommand, xn as formatMigrationDiff, xt as getCommand$2, yn as parseMigrationNumberArg, yt as listCommand$7, z as openInConfiguredEditor, zn as pagedLogArgs } from "../runtime-CEFC05qX.mjs";
+import { $ as initOperatorClient, A as loadAccessToken, B as saveUserTokens, C as hashContent$1, D as fetchLatestToken, E as deleteUserTokens, F as loadStoredUserTokens, H as closeConnectionPool, I as loadWorkspaceId, J as fetchUserInfo, K as fetchPaged, L as platformConfigFromProfile, M as loadConsoleBaseUrl, N as loadMachineUserName, O as hasAnyUserTokenEntry, Q as initOAuth2Client, R as readPlatformConfig, S as getDistDir, T as loadConfig, U as defaultPlatformBaseUrl, V as writePlatformConfig, W as fetchAll, _ as createLogLevelTreeshakeOptions, a as WorkflowJobSchema, c as INVOKER_EXPR, et as isDefaultPlatform, g as composeFunctionTreeshakeOptions, h as platformBundleDefinePlugin, i as resolveInlineSourcemap, k as hasUserTokenEntry, o as ResolverSchema, q as fetchPlatformMachineUserToken, t as defineApplication, v as resolveBundleLogLevel, z as resolveUserTokenKey } from "../application-Dxhdq_nu.mjs";
+import { n as ExecutorSchema } from "../service-DiEtAsvc.mjs";
+import { t as multiline } from "../multiline-sfHpTZZK.mjs";
+import { r as isPluginGeneratedType } from "../seed-DoMTMLcm.mjs";
+import { t as readPackageJson } from "../package-json-8b0O9TlX.mjs";
+import { i as userAgent } from "../secret-file-VSVGy1V0.mjs";
+import { n as isCLIError } from "../errors-Dtf2WPaW.mjs";
+import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-ayWANEZ6.mjs";
 import { arg, defineCommand, runCommand, runMain } from "politty";
 import { withCompletionCommand } from "politty/completion";
 import { z } from "zod";
@@ -488,7 +487,7 @@ const deployCommand$1 = defineAppCommand({
 	}).strict(),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
-		const { initTelemetry } = await import("../telemetry-w92bvGdC.mjs");
+		const { initTelemetry } = await import("../telemetry-ClwW5ohF.mjs");
 		await initTelemetry();
 		await deploy({
 			workspaceId: args["workspace-id"],
@@ -1288,7 +1287,7 @@ async function detectFunctionType(options) {
 		const rawInput = module.default.input;
 		let inputSchema;
 		if (rawInput) {
-			const { t } = await import("../types-32lUMToj.mjs");
+			const { t } = await import("../types-qhFZ8y9B.mjs");
 			inputSchema = t.object(rawInput);
 		}
 		return {
@@ -1673,7 +1672,7 @@ const generateCommand = defineAppCommand({
 		})
 	}).strict(),
 	run: async (args) => {
-		const { initTelemetry } = await import("../telemetry-w92bvGdC.mjs");
+		const { initTelemetry } = await import("../telemetry-ClwW5ohF.mjs");
 		await initTelemetry();
 		await generate({
 			configPath: args.config,
@@ -2820,13 +2819,25 @@ function findTarget(lock, kind, workspaceName) {
 	return lock?.targets.find((t) => t.kind === kind && t.workspaceName === workspaceName);
 }
 
+//#endregion
+//#region src/cli/commands/setup/action.yml
+var action_default = "# __HEADER__\nname: __WORKSPACE_NAME__\ndescription: >-\n  Deploy __WORKSPACE_NAME__ to Tailor Platform.\n  Checkout and dependency installation are expected to be handled by the caller.\n\ninputs:\n  workspace-id:\n    description: Tailor Platform workspace id\n    required: true\n  name:\n    description: Workspace name (used in Slack notifications)\n    required: true\n  working-directory:\n    description: App directory relative to the repository root\n    required: false\n    default: \".\"\n  platform-client-id:\n    description: Machine-user client id\n    required: true\n  platform-client-secret:\n    description: Machine-user client secret\n    required: true\n  slack-token:\n    description: Slack bot token\n    required: false\n  slack-channel-id:\n    description: Slack channel id\n    required: false\n  user-mapping:\n    description: JSON string mapping GitHub usernames to Slack user IDs\n    required: false\n  package-manager:\n    description: Package manager used for dependency installation (pnpm, npm, yarn, bun)\n    required: false\n    default: pnpm\n\noutputs:\n  app-url:\n    description: Deployed application URL\n    value: ${{ steps.tailor-apply.outputs.app-url }}\n\nruns:\n  using: composite\n  steps:\n    # __STATIC_WEBSITE_BUILD_START__\n    - id: build-site\n      shell: bash\n      run: |\n        # Replace with your static website build command.\n        # Example: pnpm --filter <package-name> run build:static\n        # Note: this run: command is user-editable. Custom build commands are preserved across\n        # reruns and are not treated as drift by setup check. Other edits to this file are flagged\n        # as drift and will be overwritten if you re-run setup action with --force.\n        true\n    # __STATIC_WEBSITE_BUILD_END__\n    - id: tailor-apply\n      uses: tailor-platform/actions/deploy@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n      with:\n        workspace-id: ${{ inputs.workspace-id }}\n        working-directory: ${{ inputs.working-directory }}\n        package-manager: ${{ inputs.package-manager }}\n        platform-client-id: ${{ inputs.platform-client-id }}\n        platform-client-secret: ${{ inputs.platform-client-secret }}\n    - id: tailor-notify\n      if: failure() && inputs.slack-token != '' && inputs.slack-channel-id != ''\n      uses: tailor-platform/actions/notify@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n      with:\n        provider: slack\n        status: failure\n        workspace-name: ${{ inputs.name }}\n        slack-token: ${{ inputs.slack-token }}\n        slack-channel-id: ${{ inputs.slack-channel-id }}\n        user-mapping: ${{ inputs.user-mapping }}\n";
+
 //#endregion
 //#region src/cli/commands/setup/branch.workflow.yml
-var branch_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  # __PULL_REQUEST_END__\n  push:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  workflow_dispatch:\n    # __DISPATCH_INPUTS_START__\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n    # __DISPATCH_INPUTS_END__\n\npermissions:\n  contents: read\n\njobs:\n  # __PLAN_JOB_START__\n  tailor-plan:\n    if: >-\n      github.event_name == 'pull_request' ||\n      (github.event_name == 'workflow_dispatch' && inputs['dry-run'])\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      - id: tailor-plan\n        # Fork PRs cannot read secrets; the checks above still run for them.\n        if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork\n        uses: tailor-platform/actions/plan@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n  # __PLAN_JOB_END__\n  # __ERD_PREVIEW_JOB_START__\n  tailor-erd-preview-matrix:\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      namespaces: ${{ steps.tailor-erd-preview-matrix.outputs.namespaces }}\n      base-app-dir: ${{ steps.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          persist-credentials: false\n      - id: tailor-checkout-base\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-erd-preview-matrix\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          WORKSPACE_NAME: \"__WORKSPACE_NAME__\"\n        run: |\n          set -euo pipefail\n          node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const appDir = process.env.APP_DIR || \".\";\n          const workspaceName = process.env.WORKSPACE_NAME;\n          const output = process.env.GITHUB_OUTPUT;\n          const dirPattern = /^[A-Za-z0-9._/-]+$/;\n          const namespacePattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n          function lockTarget(file) {\n            try {\n              const lock = JSON.parse(fs.readFileSync(file, \"utf8\"));\n              return lock.targets?.find(\n                (candidate) =>\n                  candidate.kind === \"branch\" &&\n                  candidate.workspaceName === workspaceName,\n              );\n            } catch (error) {\n              if (error && error.code === \"ENOENT\") return undefined;\n              throw error;\n            }\n          }\n\n          function namespacesFromTarget(target, label) {\n            const namespaces =\n              target?.inputs?.erdPreview === true && Array.isArray(target.inputs?.erdNamespaces)\n                ? target.inputs.erdNamespaces\n                : [];\n            for (const namespace of namespaces) {\n              if (typeof namespace !== \"string\" || !namespacePattern.test(namespace)) {\n                throw new Error(`Invalid ERD namespace in ${label}: ${String(namespace)}`);\n              }\n            }\n            return namespaces;\n          }\n\n          function normalizeDir(value, label) {\n            const raw = typeof value === \"string\" && value.length > 0 ? value : appDir;\n            const normalized =\n              raw.replaceAll(\"\\\\\", \"/\").replace(/\\/{2,}/g, \"/\").replace(/^\\.\\//, \"\").replace(/\\/$/, \"\") ||\n              \".\";\n            if (\n              !dirPattern.test(normalized) ||\n              normalized.startsWith(\"/\") ||\n              normalized.split(\"/\").includes(\"..\")\n            ) {\n              throw new Error(`Invalid ERD app dir in ${label}: ${raw}`);\n            }\n            return normalized;\n          }\n\n          const headTarget = lockTarget(\".github/tailor-sdk.lock\");\n          const baseTarget = lockTarget(\".tailor-erd-base/.github/tailor-sdk.lock\");\n          const baseAppDir = normalizeDir(baseTarget?.inputs?.dir, \"base setup lock\");\n          const namespaces = [\n            ...new Set([\n              ...namespacesFromTarget(headTarget, \"head setup lock\"),\n              ...namespacesFromTarget(baseTarget, \"base setup lock\"),\n            ]),\n          ].sort((a, b) => a.localeCompare(b));\n\n          if (namespaces.length === 0) {\n            console.error(\"No ERD preview namespaces found in the head or base setup lock.\");\n            process.exit(1);\n          }\n\n          fs.appendFileSync(output, `namespaces=${JSON.stringify(namespaces)}\\n`);\n          fs.appendFileSync(output, `base-app-dir=${baseAppDir}\\n`);\n          NODE\n\n  tailor-erd-preview:\n    needs: tailor-erd-preview-matrix\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    strategy:\n      fail-fast: false\n      matrix:\n        namespace: ${{ fromJSON(needs.tailor-erd-preview-matrix.outputs.namespaces) }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          persist-credentials: false\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-checkout-base\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-detect-base-package-manager\n        shell: bash\n        run: |\n          set -euo pipefail\n          cd .tailor-erd-base\n          base_package_manager=\"$(\n            if [ -f pnpm-lock.yaml ]; then\n              echo pnpm\n            elif [ -f yarn.lock ]; then\n              echo yarn\n            elif [ -f bun.lockb ] || [ -f bun.lock ]; then\n              echo bun\n            elif [ -f package-lock.json ]; then\n              echo npm\n            else\n              echo \"__PACKAGE_MANAGER__\"\n            fi\n          )\"\n          echo \"package-manager=$base_package_manager\" >> \"$GITHUB_OUTPUT\"\n          if [ \"$base_package_manager\" = \"pnpm\" ]; then\n            base_pnpm_version=\"$(node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const fallback = \"10\";\n\n          function readManifest(file) {\n            try {\n              return JSON.parse(fs.readFileSync(file, \"utf8\"));\n            } catch {\n              return {};\n            }\n          }\n\n          function pnpmVersion(manifest) {\n            const packageManager = manifest.packageManager;\n            if (typeof packageManager === \"string\" && packageManager.startsWith(\"pnpm@\")) {\n              return packageManager.slice(\"pnpm@\".length).split(\"+\")[0];\n            }\n\n            const devPackageManager = manifest.devEngines?.packageManager;\n            if (devPackageManager?.name === \"pnpm\" && devPackageManager.version) {\n              return devPackageManager.version;\n            }\n\n            return undefined;\n          }\n\n          process.stdout.write(\n            pnpmVersion(readManifest(\"package.json\")) ?? fallback,\n          );\n          NODE\n          )\"\n            echo \"pnpm-version=$base_pnpm_version\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-setup-base-pnpm\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'pnpm'\n        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9\n        with:\n          version: ${{ steps.tailor-detect-base-package-manager.outputs['pnpm-version'] }}\n          package_json_file: .tailor-erd-base/package.json\n          run_install: false\n      - id: tailor-setup-base-node\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] != 'bun'\n        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n        with:\n          node-version-file: .tailor-erd-base/package.json\n      - id: tailor-setup-base-yarn\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'yarn'\n        shell: bash\n        working-directory: .tailor-erd-base\n        run: |\n          set -euo pipefail\n          corepack enable\n      - id: tailor-setup-base-bun\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'bun'\n        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0\n      - id: tailor-install-base\n        shell: bash\n        working-directory: .tailor-erd-base\n        env:\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n        run: |\n          set -euo pipefail\n          case \"$BASE_PACKAGE_MANAGER\" in\n            pnpm) pnpm install --frozen-lockfile ;;\n            npm) npm ci ;;\n            yarn)\n              if grep -q '^__metadata:' yarn.lock; then\n                yarn install --immutable\n              else\n                yarn install --frozen-lockfile\n              fi\n              ;;\n            bun) bun install --frozen-lockfile ;;\n            *)\n              echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n              exit 1\n              ;;\n          esac\n      - id: tailor-restore-head-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-build-erd-preview\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          BASE_APP_DIR: ${{ needs.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n          NAMESPACE: ${{ matrix.namespace }}\n        run: |\n          set -euo pipefail\n\n          run_tailor_sdk() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec tailor-sdk \"$@\" ;;\n              npm) npx tailor-sdk \"$@\" ;;\n              yarn) yarn tailor-sdk \"$@\" ;;\n              bun) bunx tailor-sdk \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          run_head_node() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec node \"$@\" ;;\n              npm) node \"$@\" ;;\n              yarn) yarn node \"$@\" ;;\n              bun) node \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          tailor_sdk_bin=\"$(\n            run_head_node - <<'NODE'\n          const path = require(\"node:path\");\n          const { createRequire } = require(\"node:module\");\n          const appDir = process.env.APP_DIR || \".\";\n          const githubWorkspace = process.env.GITHUB_WORKSPACE;\n          if (!githubWorkspace) {\n            throw new Error(\"GITHUB_WORKSPACE is required.\");\n          }\n\n          let lastError;\n          for (const manifestPath of [\n            path.join(githubWorkspace, appDir, \"package.json\"),\n            path.join(githubWorkspace, \"package.json\"),\n          ]) {\n            try {\n              const requireFromManifest = createRequire(manifestPath);\n              process.stdout.write(\n                path.join(\n                  path.dirname(requireFromManifest.resolve(\"@tailor-platform/sdk/cli\")),\n                  \"index.mjs\",\n                ),\n              );\n              process.exit(0);\n            } catch (error) {\n              lastError = error;\n            }\n          }\n          throw lastError || new Error(\"Failed to resolve @tailor-platform/sdk/cli.\");\n          NODE\n          )\"\n\n          run_head_tailor_sdk_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_SDK_BIN=\"$tailor_sdk_bin\" TAILOR_SDK_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$GITHUB_WORKSPACE\" || exit 1\n              case \"__PACKAGE_MANAGER__\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          run_base_tailor_sdk_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_SDK_BIN=\"$tailor_sdk_bin\" TAILOR_SDK_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$command_cwd\" || exit 1\n              case \"$BASE_PACKAGE_MANAGER\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          head_output=\"$RUNNER_TEMP/tailor-erd/head\"\n          base_output=\"$RUNNER_TEMP/tailor-erd/base\"\n          preview_output=\"$RUNNER_TEMP/tailor-erd/preview\"\n          dts_output=\"$RUNNER_TEMP/tailor-erd/dts\"\n          head_cli_runner=\"$RUNNER_TEMP/tailor-erd/run-head-tailor-sdk.mjs\"\n          head_log=\"$RUNNER_TEMP/tailor-erd/head-$NAMESPACE.log\"\n          base_log=\"$RUNNER_TEMP/tailor-erd/base-$NAMESPACE.log\"\n          rm -rf \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          mkdir -p \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          cat > \"$head_cli_runner\" <<'NODE'\n          import { pathToFileURL } from \"node:url\";\n\n          const cliBin = process.env.TAILOR_SDK_BIN;\n          const commandCwd = process.env.TAILOR_SDK_CWD;\n          if (!cliBin || !commandCwd) {\n            throw new Error(\"TAILOR_SDK_BIN and TAILOR_SDK_CWD are required.\");\n          }\n\n          process.chdir(commandCwd);\n          process.argv = [process.argv[0], cliBin, ...process.argv.slice(2)];\n          await import(pathToFileURL(cliBin).href);\n          NODE\n\n          head_config=\"$GITHUB_WORKSPACE/$APP_DIR/tailor.config.ts\"\n          base_config=\"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR/tailor.config.ts\"\n          head_html=\"$head_output/$NAMESPACE/dist/index.html\"\n          base_html=\"$base_output/$NAMESPACE/dist/index.html\"\n          preview_html=\"$preview_output/$NAMESPACE-viewer.html\"\n\n          head_missing=\"false\"\n          if [ ! -f \"$head_config\" ]; then\n            echo \"Head ERD config not found; rendering base objects as removed.\"\n            head_missing=\"true\"\n          elif ! (\n            cd \"$GITHUB_WORKSPACE/$APP_DIR\" || exit 1\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/head-$NAMESPACE.d.ts\" \\\n              run_tailor_sdk tailordb erd export --config \"$head_config\" --namespace \"$NAMESPACE\" --output \"$head_output\"\n          ) >\"$head_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$head_log\"; then\n              cat \"$head_log\"\n              echo \"Head ERD namespace '$NAMESPACE' not found; rendering base objects as removed.\"\n              head_missing=\"true\"\n            else\n              cat \"$head_log\"\n              exit 1\n            fi\n          elif [ -s \"$head_log\" ]; then\n            cat \"$head_log\"\n          fi\n\n          base_missing=\"false\"\n          if [ ! -f \"$base_config\" ]; then\n            echo \"Base ERD config not found; rendering current objects as added.\"\n            base_missing=\"true\"\n          elif ! (\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/base-$NAMESPACE.d.ts\" \\\n              run_base_tailor_sdk_bin \"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR\" tailordb erd export --config \"$base_config\" --namespace \"$NAMESPACE\" --output \"$base_output\"\n          ) >\"$base_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$base_log\"; then\n              cat \"$base_log\"\n              echo \"Base ERD namespace '$NAMESPACE' not found; rendering current objects as added.\"\n              base_missing=\"true\"\n            else\n              cat \"$base_log\"\n              exit 1\n            fi\n          elif [ -s \"$base_log\" ]; then\n            cat \"$base_log\"\n          fi\n\n          if [ \"$head_missing\" = \"true\" ] && [ \"$base_missing\" = \"true\" ]; then\n            echo \"::error::ERD namespace '$NAMESPACE' was not found in head or base.\"\n            exit 1\n          fi\n          if [ \"$head_missing\" = \"false\" ] && [ ! -f \"$head_html\" ]; then\n            echo \"::error::Head ERD viewer was not generated at $head_html\"\n            exit 1\n          fi\n          if [ \"$base_missing\" = \"false\" ] && [ ! -f \"$base_html\" ]; then\n            echo \"::error::Base ERD viewer was not generated at $base_html\"\n            exit 1\n          fi\n\n          diff_args=(--namespace \"$NAMESPACE\" --output \"$preview_html\")\n          if [ \"$head_missing\" = \"false\" ]; then\n            diff_args+=(--head-html \"$head_html\")\n          fi\n          if [ \"$base_missing\" = \"false\" ]; then\n            diff_args+=(--base-html \"$base_html\")\n          fi\n          run_head_tailor_sdk_bin \"$GITHUB_WORKSPACE\" tailordb erd diff \"${diff_args[@]}\"\n      - id: tailor-upload-erd-viewer\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: ${{ matrix.namespace }}-viewer.html\n          path: ${{ runner.temp }}/tailor-erd/preview/${{ matrix.namespace }}-viewer.html\n          if-no-files-found: error\n          archive: false\n          retention-days: 7\n\n  # __ERD_PREVIEW_JOB_END__\n  # __ERD_PREVIEW_COMMENT_JOB_START__\n  tailor-erd-preview-comment:\n    needs: tailor-erd-preview\n    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      actions: read\n      pull-requests: write\n    steps:\n      - id: tailor-comment-erd-preview\n        env:\n          GH_TOKEN: ${{ github.token }}\n          REPO: ${{ github.repository }}\n          RUN_ID: ${{ github.run_id }}\n          SERVER: ${{ github.server_url }}\n          PR_NUMBER: ${{ github.event.pull_request.number }}\n          BASE_REF: ${{ github.event.pull_request.base.ref }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n          MARKER: \"<!-- tailor-erd-preview: __WORKSPACE_NAME__ -->\"\n        run: |\n          set -euo pipefail\n\n          current_head=$(gh api \"repos/$REPO/pulls/$PR_NUMBER\" --jq '.head.sha')\n          if [ \"$current_head\" != \"$HEAD_SHA\" ]; then\n            echo \"Skipping stale ERD preview comment for $HEAD_SHA; current head is $current_head.\"\n            exit 0\n          fi\n\n          body=\"$MARKER\"$'\\n'\"### TailorDB ERD preview (__WORKSPACE_NAME__)\"$'\\n\\n'\n          body+=\"Self-contained ERD viewer HTML artifacts for this pull request. Each viewer can switch between the current schema and a diff against base branch \\`$BASE_REF\\`.\"$'\\n'\n\n          while IFS=$'\\t' read -r name id; do\n            [ -z \"$name\" ] && continue\n            if [[ \"$name\" != *-viewer.html ]]; then\n              continue\n            fi\n            ns=${name%-viewer.html}\n            label=\"$ns viewer\"\n            body+=$'\\n'\"- **$label**: [$name]($SERVER/$REPO/actions/runs/$RUN_ID/artifacts/$id)\"\n          done < <(gh api \"repos/$REPO/actions/runs/$RUN_ID/artifacts\" --paginate \\\n            --jq '.artifacts[] | select(.name | endswith(\"-viewer.html\")) | [.name, (.id|tostring)] | @tsv' | sort)\n\n          existing=$(gh api \"repos/$REPO/issues/$PR_NUMBER/comments\" --paginate \\\n            --jq 'map(select(.body | contains(env.MARKER))) | .[0].id // empty')\n          if [ -n \"$existing\" ]; then\n            gh api --method PATCH \"repos/$REPO/issues/comments/$existing\" -f body=\"$body\" >/dev/null\n          else\n            gh api --method POST \"repos/$REPO/issues/$PR_NUMBER/comments\" -f body=\"$body\" >/dev/null\n          fi\n\n  # __ERD_PREVIEW_COMMENT_JOB_END__\n  tailor-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    environment: __ENVIRONMENT__\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n";
+var branch_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  # __PULL_REQUEST_END__\n  push:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  workflow_dispatch:\n    # __DISPATCH_INPUTS_START__\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n    # __DISPATCH_INPUTS_END__\n\npermissions:\n  contents: read\n\njobs:\n  # __PLAN_JOB_START__\n  tailor-plan:\n    if: >-\n      github.event_name == 'pull_request' ||\n      (github.event_name == 'workflow_dispatch' && inputs['dry-run'])\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        uses: tailor-platform/actions/seed-validate@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        # Fork PRs cannot read secrets; the checks above still run for them.\n        if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork\n        uses: tailor-platform/actions/plan@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n  # __PLAN_JOB_END__\n  # __ERD_PREVIEW_JOB_START__\n  tailor-erd-preview-matrix:\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      namespaces: ${{ steps.tailor-erd-preview-matrix.outputs.namespaces }}\n      base-app-dir: ${{ steps.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          persist-credentials: false\n      - id: tailor-checkout-base\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-erd-preview-matrix\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          WORKSPACE_NAME: \"__WORKSPACE_NAME__\"\n        run: |\n          set -euo pipefail\n          node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const appDir = process.env.APP_DIR || \".\";\n          const workspaceName = process.env.WORKSPACE_NAME;\n          const output = process.env.GITHUB_OUTPUT;\n          const dirPattern = /^[A-Za-z0-9._/-]+$/;\n          const namespacePattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n          function lockTarget(file) {\n            try {\n              const lock = JSON.parse(fs.readFileSync(file, \"utf8\"));\n              return lock.targets?.find(\n                (candidate) =>\n                  candidate.kind === \"branch\" &&\n                  candidate.workspaceName === workspaceName,\n              );\n            } catch (error) {\n              if (error && error.code === \"ENOENT\") return undefined;\n              throw error;\n            }\n          }\n\n          function namespacesFromTarget(target, label) {\n            const namespaces =\n              target?.inputs?.erdPreview === true && Array.isArray(target.inputs?.erdNamespaces)\n                ? target.inputs.erdNamespaces\n                : [];\n            for (const namespace of namespaces) {\n              if (typeof namespace !== \"string\" || !namespacePattern.test(namespace)) {\n                throw new Error(`Invalid ERD namespace in ${label}: ${String(namespace)}`);\n              }\n            }\n            return namespaces;\n          }\n\n          function normalizeDir(value, label) {\n            const raw = typeof value === \"string\" && value.length > 0 ? value : appDir;\n            const normalized =\n              raw.replaceAll(\"\\\\\", \"/\").replace(/\\/{2,}/g, \"/\").replace(/^\\.\\//, \"\").replace(/\\/$/, \"\") ||\n              \".\";\n            if (\n              !dirPattern.test(normalized) ||\n              normalized.startsWith(\"/\") ||\n              normalized.split(\"/\").includes(\"..\")\n            ) {\n              throw new Error(`Invalid ERD app dir in ${label}: ${raw}`);\n            }\n            return normalized;\n          }\n\n          const headTarget = lockTarget(\".github/tailor-sdk.lock\");\n          const baseTarget = lockTarget(\".tailor-erd-base/.github/tailor-sdk.lock\");\n          const baseAppDir = normalizeDir(baseTarget?.inputs?.dir, \"base setup lock\");\n          const namespaces = [\n            ...new Set([\n              ...namespacesFromTarget(headTarget, \"head setup lock\"),\n              ...namespacesFromTarget(baseTarget, \"base setup lock\"),\n            ]),\n          ].sort((a, b) => a.localeCompare(b));\n\n          if (namespaces.length === 0) {\n            console.error(\"No ERD preview namespaces found in the head or base setup lock.\");\n            process.exit(1);\n          }\n\n          fs.appendFileSync(output, `namespaces=${JSON.stringify(namespaces)}\\n`);\n          fs.appendFileSync(output, `base-app-dir=${baseAppDir}\\n`);\n          NODE\n\n  tailor-erd-preview:\n    needs: tailor-erd-preview-matrix\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    strategy:\n      fail-fast: false\n      matrix:\n        namespace: ${{ fromJSON(needs.tailor-erd-preview-matrix.outputs.namespaces) }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          persist-credentials: false\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-checkout-base\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-detect-base-package-manager\n        shell: bash\n        run: |\n          set -euo pipefail\n          cd .tailor-erd-base\n          base_package_manager=\"$(\n            if [ -f pnpm-lock.yaml ]; then\n              echo pnpm\n            elif [ -f yarn.lock ]; then\n              echo yarn\n            elif [ -f bun.lockb ] || [ -f bun.lock ]; then\n              echo bun\n            elif [ -f package-lock.json ]; then\n              echo npm\n            else\n              echo \"__PACKAGE_MANAGER__\"\n            fi\n          )\"\n          echo \"package-manager=$base_package_manager\" >> \"$GITHUB_OUTPUT\"\n          if [ \"$base_package_manager\" = \"pnpm\" ]; then\n            base_pnpm_version=\"$(node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const fallback = \"10\";\n\n          function readManifest(file) {\n            try {\n              return JSON.parse(fs.readFileSync(file, \"utf8\"));\n            } catch {\n              return {};\n            }\n          }\n\n          function pnpmVersion(manifest) {\n            const packageManager = manifest.packageManager;\n            if (typeof packageManager === \"string\" && packageManager.startsWith(\"pnpm@\")) {\n              return packageManager.slice(\"pnpm@\".length).split(\"+\")[0];\n            }\n\n            const devPackageManager = manifest.devEngines?.packageManager;\n            if (devPackageManager?.name === \"pnpm\" && devPackageManager.version) {\n              return devPackageManager.version;\n            }\n\n            return undefined;\n          }\n\n          process.stdout.write(\n            pnpmVersion(readManifest(\"package.json\")) ?? fallback,\n          );\n          NODE\n          )\"\n            echo \"pnpm-version=$base_pnpm_version\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-setup-base-pnpm\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'pnpm'\n        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9\n        with:\n          version: ${{ steps.tailor-detect-base-package-manager.outputs['pnpm-version'] }}\n          package_json_file: .tailor-erd-base/package.json\n          run_install: false\n      - id: tailor-setup-base-node\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] != 'bun'\n        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n        with:\n          node-version-file: .tailor-erd-base/package.json\n      - id: tailor-setup-base-yarn\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'yarn'\n        shell: bash\n        working-directory: .tailor-erd-base\n        run: |\n          set -euo pipefail\n          corepack enable\n      - id: tailor-setup-base-bun\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'bun'\n        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0\n      - id: tailor-install-base\n        shell: bash\n        working-directory: .tailor-erd-base\n        env:\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n        run: |\n          set -euo pipefail\n          case \"$BASE_PACKAGE_MANAGER\" in\n            pnpm) pnpm install --frozen-lockfile ;;\n            npm) npm ci ;;\n            yarn)\n              if grep -q '^__metadata:' yarn.lock; then\n                yarn install --immutable\n              else\n                yarn install --frozen-lockfile\n              fi\n              ;;\n            bun) bun install --frozen-lockfile ;;\n            *)\n              echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n              exit 1\n              ;;\n          esac\n      - id: tailor-restore-head-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-build-erd-preview\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          BASE_APP_DIR: ${{ needs.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n          NAMESPACE: ${{ matrix.namespace }}\n        run: |\n          set -euo pipefail\n\n          run_tailor_sdk() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec tailor-sdk \"$@\" ;;\n              npm) npx tailor-sdk \"$@\" ;;\n              yarn) yarn tailor-sdk \"$@\" ;;\n              bun) bunx tailor-sdk \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          run_head_node() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec node \"$@\" ;;\n              npm) node \"$@\" ;;\n              yarn) yarn node \"$@\" ;;\n              bun) node \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          tailor_sdk_bin=\"$(\n            run_head_node - <<'NODE'\n          const path = require(\"node:path\");\n          const { createRequire } = require(\"node:module\");\n          const appDir = process.env.APP_DIR || \".\";\n          const githubWorkspace = process.env.GITHUB_WORKSPACE;\n          if (!githubWorkspace) {\n            throw new Error(\"GITHUB_WORKSPACE is required.\");\n          }\n\n          let lastError;\n          for (const manifestPath of [\n            path.join(githubWorkspace, appDir, \"package.json\"),\n            path.join(githubWorkspace, \"package.json\"),\n          ]) {\n            try {\n              const requireFromManifest = createRequire(manifestPath);\n              process.stdout.write(\n                path.join(\n                  path.dirname(requireFromManifest.resolve(\"@tailor-platform/sdk/cli\")),\n                  \"index.mjs\",\n                ),\n              );\n              process.exit(0);\n            } catch (error) {\n              lastError = error;\n            }\n          }\n          throw lastError || new Error(\"Failed to resolve @tailor-platform/sdk/cli.\");\n          NODE\n          )\"\n\n          run_head_tailor_sdk_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_SDK_BIN=\"$tailor_sdk_bin\" TAILOR_SDK_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$GITHUB_WORKSPACE\" || exit 1\n              case \"__PACKAGE_MANAGER__\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          run_base_tailor_sdk_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_SDK_BIN=\"$tailor_sdk_bin\" TAILOR_SDK_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$command_cwd\" || exit 1\n              case \"$BASE_PACKAGE_MANAGER\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          head_output=\"$RUNNER_TEMP/tailor-erd/head\"\n          base_output=\"$RUNNER_TEMP/tailor-erd/base\"\n          preview_output=\"$RUNNER_TEMP/tailor-erd/preview\"\n          dts_output=\"$RUNNER_TEMP/tailor-erd/dts\"\n          head_cli_runner=\"$RUNNER_TEMP/tailor-erd/run-head-tailor-sdk.mjs\"\n          head_log=\"$RUNNER_TEMP/tailor-erd/head-$NAMESPACE.log\"\n          base_log=\"$RUNNER_TEMP/tailor-erd/base-$NAMESPACE.log\"\n          rm -rf \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          mkdir -p \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          cat > \"$head_cli_runner\" <<'NODE'\n          import { pathToFileURL } from \"node:url\";\n\n          const cliBin = process.env.TAILOR_SDK_BIN;\n          const commandCwd = process.env.TAILOR_SDK_CWD;\n          if (!cliBin || !commandCwd) {\n            throw new Error(\"TAILOR_SDK_BIN and TAILOR_SDK_CWD are required.\");\n          }\n\n          process.chdir(commandCwd);\n          process.argv = [process.argv[0], cliBin, ...process.argv.slice(2)];\n          await import(pathToFileURL(cliBin).href);\n          NODE\n\n          head_config=\"$GITHUB_WORKSPACE/$APP_DIR/tailor.config.ts\"\n          base_config=\"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR/tailor.config.ts\"\n          head_html=\"$head_output/$NAMESPACE/dist/index.html\"\n          base_html=\"$base_output/$NAMESPACE/dist/index.html\"\n          preview_html=\"$preview_output/$NAMESPACE-viewer.html\"\n\n          head_missing=\"false\"\n          if [ ! -f \"$head_config\" ]; then\n            echo \"Head ERD config not found; rendering base objects as removed.\"\n            head_missing=\"true\"\n          elif ! (\n            cd \"$GITHUB_WORKSPACE/$APP_DIR\" || exit 1\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/head-$NAMESPACE.d.ts\" \\\n              run_tailor_sdk tailordb erd export --config \"$head_config\" --namespace \"$NAMESPACE\" --output \"$head_output\"\n          ) >\"$head_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$head_log\"; then\n              cat \"$head_log\"\n              echo \"Head ERD namespace '$NAMESPACE' not found; rendering base objects as removed.\"\n              head_missing=\"true\"\n            else\n              cat \"$head_log\"\n              exit 1\n            fi\n          elif [ -s \"$head_log\" ]; then\n            cat \"$head_log\"\n          fi\n\n          base_missing=\"false\"\n          if [ ! -f \"$base_config\" ]; then\n            echo \"Base ERD config not found; rendering current objects as added.\"\n            base_missing=\"true\"\n          elif ! (\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/base-$NAMESPACE.d.ts\" \\\n              run_base_tailor_sdk_bin \"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR\" tailordb erd export --config \"$base_config\" --namespace \"$NAMESPACE\" --output \"$base_output\"\n          ) >\"$base_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$base_log\"; then\n              cat \"$base_log\"\n              echo \"Base ERD namespace '$NAMESPACE' not found; rendering current objects as added.\"\n              base_missing=\"true\"\n            else\n              cat \"$base_log\"\n              exit 1\n            fi\n          elif [ -s \"$base_log\" ]; then\n            cat \"$base_log\"\n          fi\n\n          if [ \"$head_missing\" = \"true\" ] && [ \"$base_missing\" = \"true\" ]; then\n            echo \"::error::ERD namespace '$NAMESPACE' was not found in head or base.\"\n            exit 1\n          fi\n          if [ \"$head_missing\" = \"false\" ] && [ ! -f \"$head_html\" ]; then\n            echo \"::error::Head ERD viewer was not generated at $head_html\"\n            exit 1\n          fi\n          if [ \"$base_missing\" = \"false\" ] && [ ! -f \"$base_html\" ]; then\n            echo \"::error::Base ERD viewer was not generated at $base_html\"\n            exit 1\n          fi\n\n          diff_args=(--namespace \"$NAMESPACE\" --output \"$preview_html\")\n          if [ \"$head_missing\" = \"false\" ]; then\n            diff_args+=(--head-html \"$head_html\")\n          fi\n          if [ \"$base_missing\" = \"false\" ]; then\n            diff_args+=(--base-html \"$base_html\")\n          fi\n          run_head_tailor_sdk_bin \"$GITHUB_WORKSPACE\" tailordb erd diff \"${diff_args[@]}\"\n      - id: tailor-upload-erd-viewer\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: ${{ matrix.namespace }}-viewer.html\n          path: ${{ runner.temp }}/tailor-erd/preview/${{ matrix.namespace }}-viewer.html\n          if-no-files-found: error\n          archive: false\n          retention-days: 7\n\n  # __ERD_PREVIEW_JOB_END__\n  # __ERD_PREVIEW_COMMENT_JOB_START__\n  tailor-erd-preview-comment:\n    needs: tailor-erd-preview\n    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      actions: read\n      pull-requests: write\n    steps:\n      - id: tailor-comment-erd-preview\n        env:\n          GH_TOKEN: ${{ github.token }}\n          REPO: ${{ github.repository }}\n          RUN_ID: ${{ github.run_id }}\n          SERVER: ${{ github.server_url }}\n          PR_NUMBER: ${{ github.event.pull_request.number }}\n          BASE_REF: ${{ github.event.pull_request.base.ref }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n          MARKER: \"<!-- tailor-erd-preview: __WORKSPACE_NAME__ -->\"\n        run: |\n          set -euo pipefail\n\n          current_head=$(gh api \"repos/$REPO/pulls/$PR_NUMBER\" --jq '.head.sha')\n          if [ \"$current_head\" != \"$HEAD_SHA\" ]; then\n            echo \"Skipping stale ERD preview comment for $HEAD_SHA; current head is $current_head.\"\n            exit 0\n          fi\n\n          body=\"$MARKER\"$'\\n'\"### TailorDB ERD preview (__WORKSPACE_NAME__)\"$'\\n\\n'\n          body+=\"Self-contained ERD viewer HTML artifacts for this pull request. Each viewer can switch between the current schema and a diff against base branch \\`$BASE_REF\\`.\"$'\\n'\n\n          while IFS=$'\\t' read -r name id; do\n            [ -z \"$name\" ] && continue\n            if [[ \"$name\" != *-viewer.html ]]; then\n              continue\n            fi\n            ns=${name%-viewer.html}\n            label=\"$ns viewer\"\n            body+=$'\\n'\"- **$label**: [$name]($SERVER/$REPO/actions/runs/$RUN_ID/artifacts/$id)\"\n          done < <(gh api \"repos/$REPO/actions/runs/$RUN_ID/artifacts\" --paginate \\\n            --jq '.artifacts[] | select(.name | endswith(\"-viewer.html\")) | [.name, (.id|tostring)] | @tsv' | sort)\n\n          existing=$(gh api \"repos/$REPO/issues/$PR_NUMBER/comments\" --paginate \\\n            --jq 'map(select(.body | contains(env.MARKER))) | .[0].id // empty')\n          if [ -n \"$existing\" ]; then\n            gh api --method PATCH \"repos/$REPO/issues/comments/$existing\" -f body=\"$body\" >/dev/null\n          else\n            gh api --method POST \"repos/$REPO/issues/$PR_NUMBER/comments\" -f body=\"$body\" >/dev/null\n          fi\n\n  # __ERD_PREVIEW_COMMENT_JOB_END__\n  tailor-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    environment: __ENVIRONMENT__\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
+
+//#endregion
+//#region src/cli/commands/setup/coordinate.workflow.yml
+var coordinate_workflow_default = "# __HEADER__\nname: Tailor Coordinator (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n  # __PULL_REQUEST_END__\n  push:\n    # __PUSH_BRANCHES_START__\n    branches: [\"__BRANCH__\"]\n    # __PUSH_BRANCHES_END__\n    # __PUSH_TAGS_START__\n    tags: [__TAG_PATTERN__]\n    # __PUSH_TAGS_END__\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          target-branch: __BRANCH__\n  # __TAG_GUARD_JOB_END__\n\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_PLAN_STEPS__\n\n  tailor-deploy:\n    # __DEPLOY_NEEDS__\n    # __DEPLOY_IF__\n    # __DEPLOY_ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_DEPLOY_STEPS__\n";
+
+//#endregion
+//#region src/cli/commands/setup/preview.workflow.yml
+var preview_workflow_default = "# __HEADER__\nname: Tailor Preview (__WORKSPACE_NAME__)\n\non:\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PR_TYPES__\n    # To deploy only for PRs that carry the `tailor:preview` label instead of all PRs,\n    # re-run: tailor-sdk setup --require-preview-label\n    # __PATHS__\n\npermissions:\n  contents: read\n  pull-requests: write\n\njobs:\n  tailor-preview-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-preview-__WORKSPACE_NAME__-${{ github.event.pull_request.number }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      - id: tailor-preview-deploy\n        uses: tailor-platform/actions/preview-deploy@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          region: \"__REGION__\"\n          organization-id: ${{ vars.TAILOR_PLATFORM_ORGANIZATION_ID }}\n          folder-id: ${{ vars.TAILOR_PLATFORM_FOLDER_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n      - id: tailor-preview-comment\n        if: always()\n        uses: tailor-platform/actions/preview-comment@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          workspace-id: ${{ steps.tailor-preview-deploy.outputs.workspace-id }}\n          workspace-name: ${{ steps.tailor-preview-deploy.outputs.workspace-name }}\n          status: ${{ job.status == 'success' && 'success' || 'failure' }}\n          app-url: ${{ steps.tailor-preview-deploy.outputs.app-url }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n\n  tailor-preview-cleanup:\n    # __CLEANUP_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-preview-cleanup\n        uses: tailor-platform/actions/preview-cleanup@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/tag.workflow.yml
-var tag_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  push:\n    tags: [\"__TAG_PATTERN__\"]\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          target-branch: \"__BRANCH__\"\n  # __TAG_GUARD_JOB_END__\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      - id: tailor-plan\n        uses: tailor-platform/actions/plan@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n\n  tailor-deploy:\n    needs: tailor-plan\n    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs['dry-run']) }}\n    environment: __ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n";
+var tag_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  push:\n    tags: [\"__TAG_PATTERN__\"]\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          target-branch: \"__BRANCH__\"\n  # __TAG_GUARD_JOB_END__\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        uses: tailor-platform/actions/seed-validate@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        uses: tailor-platform/actions/plan@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n\n  tailor-deploy:\n    needs: tailor-plan\n    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs['dry-run']) }}\n    environment: __ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@d203a37c87b7a69c6040611c33e9e50c1d564ed1 # v1.5.0\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/templates.ts
@@ -2870,29 +2881,39 @@ function applyCommon(content, params) {
 }
 /**
 * Render the branch-target deploy workflow.
-*
-* When `plan` is false the plan job, the pull_request trigger, and the
-* workflow_dispatch dry-run input are all removed (a plan-less workflow has no
-* meaningful dry-run), and the deploy job runs unconditionally.
 * @param params - Workspace and rendering configuration
 * @returns Rendered YAML and the list of managed job/step ids
 */
 function renderBranchWorkflow(params) {
-	const { branch, plan } = params;
-	const erdPreview = plan ? params.erdPreview : null;
+	const { branch } = params;
+	const seedValidate = params.seedValidate ?? false;
+	const migrationDriftCheck = params.migrationDriftCheck ?? false;
+	const erdPreview = params.erdPreview;
 	let out = branch_workflow_default;
-	out = block(out, "PLAN_JOB", plan);
+	out = block(out, "PLAN_JOB", true);
 	out = block(out, "ERD_PREVIEW_JOB", erdPreview !== null);
 	out = block(out, "ERD_PREVIEW_COMMENT_JOB", erdPreview !== null);
-	out = block(out, "PULL_REQUEST", plan);
-	out = block(out, "DISPATCH_INPUTS", plan);
-	out = line(out, "DEPLOY_IF", plan ? `if: >-\n  github.event_name == 'push' ||\n  (github.event_name == 'workflow_dispatch' && !inputs['dry-run'])` : void 0);
+	out = block(out, "PULL_REQUEST", true);
+	out = block(out, "DISPATCH_INPUTS", true);
+	out = block(out, "SEED_VALIDATE", seedValidate);
+	out = block(out, "MIGRATION_DRIFT_CHECK", migrationDriftCheck);
+	out = block(out, "SEED_DATA", false);
+	out = line(out, "DEPLOY_IF", `if: >-\n  github.event_name == 'push' ||\n  (github.event_name == 'workflow_dispatch' && !inputs['dry-run'])`);
 	out = line(out, "PATHS", params.workingDirectory ? `paths: ["${params.workingDirectory}/**"]` : void 0);
 	out = applyCommon(out, params).replaceAll("__BRANCH__", () => branch);
-	const generatedIds = [];
-	if (plan) generatedIds.push("tailor-plan", "tailor-plan/tailor-checkout", "tailor-plan/tailor-setup", "tailor-plan/tailor-generate-check", "tailor-plan/tailor-plan");
+	const generatedIds = [
+		"tailor-plan",
+		"tailor-plan/tailor-checkout",
+		"tailor-plan/tailor-setup",
+		"tailor-plan/tailor-install",
+		"tailor-plan/tailor-generate-check"
+	];
+	if (seedValidate) generatedIds.push("tailor-plan/tailor-seed-validate");
+	generatedIds.push("tailor-plan/tailor-drift-check");
+	if (migrationDriftCheck) generatedIds.push("tailor-plan/tailor-migration-drift-check");
+	generatedIds.push("tailor-plan/tailor-plan");
 	if (erdPreview) generatedIds.push("tailor-erd-preview-matrix", "tailor-erd-preview-matrix/tailor-checkout", "tailor-erd-preview-matrix/tailor-checkout-base", "tailor-erd-preview-matrix/tailor-erd-preview-matrix", "tailor-erd-preview", "tailor-erd-preview/tailor-checkout", "tailor-erd-preview/tailor-setup", "tailor-erd-preview/tailor-checkout-base", "tailor-erd-preview/tailor-detect-base-package-manager", "tailor-erd-preview/tailor-setup-base-pnpm", "tailor-erd-preview/tailor-setup-base-node", "tailor-erd-preview/tailor-setup-base-yarn", "tailor-erd-preview/tailor-setup-base-bun", "tailor-erd-preview/tailor-install-base", "tailor-erd-preview/tailor-restore-head-setup", "tailor-erd-preview/tailor-build-erd-preview", "tailor-erd-preview/tailor-upload-erd-viewer", "tailor-erd-preview-comment", "tailor-erd-preview-comment/tailor-comment-erd-preview");
-	generatedIds.push("tailor-deploy", "tailor-deploy/tailor-checkout", "tailor-deploy/tailor-setup", "tailor-deploy/tailor-apply");
+	generatedIds.push("tailor-deploy", "tailor-deploy/tailor-checkout", "tailor-deploy/tailor-setup", "tailor-deploy/tailor-install", "tailor-deploy/tailor-apply", "tailor-deploy/tailor-notify");
 	return {
 		content: out,
 		generatedIds
@@ -2909,139 +2930,208 @@ function renderBranchWorkflow(params) {
 function renderTagWorkflow(params) {
 	const { tagPattern, branch } = params;
 	const hasGuard = branch !== void 0;
+	const seedValidate = params.seedValidate ?? false;
+	const migrationDriftCheck = params.migrationDriftCheck ?? false;
 	let out = tag_workflow_default;
 	out = block(out, "TAG_GUARD_JOB", hasGuard);
+	out = block(out, "SEED_VALIDATE", seedValidate);
+	out = block(out, "MIGRATION_DRIFT_CHECK", migrationDriftCheck);
+	out = block(out, "SEED_DATA", false);
 	out = line(out, "PLAN_NEEDS", hasGuard ? "needs: tailor-tag-guard" : void 0);
 	out = line(out, "PLAN_IF", hasGuard ? `if: >-\n  github.event_name == 'workflow_dispatch' ||\n  needs.tailor-tag-guard.outputs.on-branch == 'true'` : void 0);
 	out = applyCommon(out, params).replaceAll("__TAG_PATTERN__", () => tagPattern);
 	if (hasGuard) out = out.replaceAll("__BRANCH__", () => branch);
 	const generatedIds = [];
 	if (hasGuard) generatedIds.push("tailor-tag-guard", "tailor-tag-guard/tailor-checkout", "tailor-tag-guard/tailor-tag-guard");
-	generatedIds.push("tailor-plan", "tailor-plan/tailor-checkout", "tailor-plan/tailor-setup", "tailor-plan/tailor-generate-check", "tailor-plan/tailor-plan", "tailor-deploy", "tailor-deploy/tailor-checkout", "tailor-deploy/tailor-setup", "tailor-deploy/tailor-apply");
+	generatedIds.push("tailor-plan", "tailor-plan/tailor-checkout", "tailor-plan/tailor-setup", "tailor-plan/tailor-install", "tailor-plan/tailor-generate-check");
+	if (seedValidate) generatedIds.push("tailor-plan/tailor-seed-validate");
+	generatedIds.push("tailor-plan/tailor-drift-check");
+	if (migrationDriftCheck) generatedIds.push("tailor-plan/tailor-migration-drift-check");
+	generatedIds.push("tailor-plan/tailor-plan", "tailor-deploy", "tailor-deploy/tailor-checkout", "tailor-deploy/tailor-setup", "tailor-deploy/tailor-install", "tailor-deploy/tailor-apply", "tailor-deploy/tailor-notify");
 	return {
 		content: out,
 		generatedIds
 	};
 }
-
-//#endregion
-//#region src/cli/commands/setup/check.ts
 /**
-* Compute drift findings for one target by comparing its recorded lock state
-* against the current repository/config state.
-* @param target - The lock target being audited
-* @param state - Current repository/config state for this target
-* @returns Drift findings (empty when the target is in sync)
+* Render the preview workflow (PR open/sync/close triggers).
+*
+* The deploy job runs on opened/synchronize/reopened events; the cleanup job
+* runs on the closed event.  Both jobs run in the same workflow so PR number
+* context is always available.
+* @param params - Workspace and rendering configuration
+* @returns Rendered YAML and the list of managed job/step ids
 */
-function findTargetDrift(target, state) {
-	const id = `${target.kind} ${target.workspaceName}`;
-	const findings = [];
-	if (!state.fileExists) findings.push({
-		target: id,
-		rule: "missing-file",
-		message: `${target.file} is missing or unreadable. Re-run setup to restore it.`
-	});
-	else if (state.currentHash !== null && state.currentHash !== target.contentHash) findings.push({
-		target: id,
-		rule: "hand-edit",
-		message: `${target.file} was edited by hand since it was generated. Re-run setup with --force to regenerate, or keep customizations in your own jobs/steps.`
-	});
-	if (target.templateVersion < state.templateVersion) findings.push({
-		target: id,
-		rule: "template-version",
-		message: `A newer workflow template is available (generated with v${String(target.templateVersion)}, current v${String(state.templateVersion)}). Re-run setup to update.`
-	});
-	if (!state.configExists) findings.push({
-		target: id,
-		rule: "config-dir",
-		message: `tailor.config.ts not found under "${target.inputs.dir}". The app directory may have moved; re-run setup with the correct --dir.`
-	});
-	if (target.kind === "branch" && target.inputs.branchAutoDetected !== false && state.defaultBranch !== null && target.inputs.branch !== null && target.inputs.branch !== state.defaultBranch) findings.push({
-		target: id,
-		rule: "default-branch",
-		message: `The workflow triggers on "${target.inputs.branch}" but the repository default branch is now "${state.defaultBranch}". If this is intentional, ignore this; otherwise re-run setup so the trigger matches the default branch.`
-	});
-	if (target.kind === "branch" && target.inputs.erdPreview && state.configExists) {
-		const recorded = [...target.inputs.erdNamespaces ?? []].toSorted((a, b) => a.localeCompare(b));
-		const current = state.erdNamespaces?.toSorted((a, b) => a.localeCompare(b)) ?? null;
-		if (current === null || recorded.length !== current.length || recorded.some((namespace, index) => namespace !== current[index])) findings.push({
-			target: id,
-			rule: "erd-namespaces",
-			message: "TailorDB namespaces for ERD preview changed. Re-run setup so the ERD preview matrix is regenerated."
-		});
-	}
-	return findings;
-}
-function detectDefaultBranchSafe(cwd, run) {
-	try {
-		return detectDefaultBranch(cwd, run);
-	} catch {
-		return null;
-	}
-}
-function escapesRoot$1(rel) {
-	return path.isAbsolute(rel) || rel === ".." || rel.startsWith(`..${path.sep}`) || rel.startsWith("../");
+function renderPreviewWorkflow(params) {
+	const { branch } = params;
+	const requirePreviewLabel = params.requirePreviewLabel ?? false;
+	let out = preview_workflow_default;
+	out = line(out, "PATHS", params.workingDirectory ? `paths: ["${params.workingDirectory}/**"]` : void 0);
+	out = line(out, "PR_TYPES", requirePreviewLabel ? "types: [labeled, synchronize, reopened, closed]" : "types: [opened, synchronize, reopened, closed]");
+	out = line(out, "DEPLOY_IF", requirePreviewLabel ? `if: >-\n  contains(github.event.pull_request.labels.*.name, 'tailor:preview') &&\n  github.event.action != 'closed' &&\n  !github.event.pull_request.draft &&\n  !github.event.pull_request.head.repo.fork` : `if: >-\n  github.event.action != 'closed' &&\n  !github.event.pull_request.draft &&\n  !github.event.pull_request.head.repo.fork`);
+	out = line(out, "CLEANUP_IF", `if: >-\n  github.event.action == 'closed' &&\n  !github.event.pull_request.head.repo.fork`);
+	out = applyCommon(out, params).replaceAll("__BRANCH__", () => branch).replaceAll("__REGION__", () => params.region);
+	return {
+		content: out,
+		generatedIds: [
+			"tailor-preview-deploy",
+			"tailor-preview-deploy/tailor-checkout",
+			"tailor-preview-deploy/tailor-setup",
+			"tailor-preview-deploy/tailor-install",
+			"tailor-preview-deploy/tailor-generate-check",
+			"tailor-preview-deploy/tailor-preview-deploy",
+			"tailor-preview-deploy/tailor-preview-comment",
+			"tailor-preview-cleanup",
+			"tailor-preview-cleanup/tailor-checkout",
+			"tailor-preview-cleanup/tailor-setup",
+			"tailor-preview-cleanup/tailor-install",
+			"tailor-preview-cleanup/tailor-preview-cleanup"
+		]
+	};
 }
-function resolveWithinRoot(outputDir, relPath) {
-	if (path.isAbsolute(relPath)) return null;
-	const abs = path.join(outputDir, relPath);
-	if (escapesRoot$1(path.relative(outputDir, abs))) return null;
-	try {
-		if (escapesRoot$1(path.relative(fs$1.realpathSync(outputDir), fs$1.realpathSync(abs)))) return null;
-	} catch {}
-	return abs;
+/**
+* Render the per-app composite action.
+*
+* The action contains only the deploy step and a failure notification.
+* Checkout, setup, and install are the caller's responsibility (coordinator workflow).
+* @param params - Workspace and rendering configuration
+* @returns Rendered YAML and the list of managed step ids
+*/
+function renderActionWorkflow(params) {
+	let out = action_default;
+	out = line(out, "HEADER", HEADER);
+	out = block(out, "STATIC_WEBSITE_BUILD", params.hasStaticWebsites ?? false);
+	out = out.replaceAll("__WORKSPACE_NAME__", () => params.workspaceName);
+	return {
+		content: out,
+		generatedIds: ["tailor-apply", "tailor-notify"]
+	};
 }
-function readHash(absFile) {
-	try {
-		return hashContent(fs$1.readFileSync(absFile, "utf-8"));
-	} catch {
-		return null;
+const ACTIONS_SHA = "d203a37c87b7a69c6040611c33e9e50c1d564ed1";
+/**
+* Render the coordinator workflow that orchestrates per-app composite actions.
+*
+* Generates per-app plan steps (generate-check, drift-check, plan) and per-app
+* deploy steps (calling each app's composite action at .github/actions/tailor-<name>).
+* Checkout, setup, and install are done once per job using the local tailor-setup action.
+* @param params - Coordinator and app configuration
+* @returns Rendered YAML and the list of managed job/step ids
+*/
+function renderCoordinateWorkflow(params) {
+	const { coordinatorName, kind, apps, environment, packageManager } = params;
+	const isTag = kind === "tag";
+	const branch = params.branch;
+	const tagPattern = params.tagPattern ?? "v*";
+	let out = coordinate_workflow_default;
+	out = line(out, "HEADER", HEADER);
+	out = block(out, "PULL_REQUEST", !isTag);
+	out = block(out, "PUSH_BRANCHES", !isTag);
+	out = block(out, "PUSH_TAGS", isTag);
+	out = block(out, "TAG_GUARD_JOB", isTag && branch !== void 0);
+	if (isTag && branch !== void 0) {
+		out = line(out, "PLAN_NEEDS", "needs: tailor-tag-guard");
+		out = line(out, "PLAN_IF", `if: >-\n  github.event_name == 'workflow_dispatch' ||\n  needs.tailor-tag-guard.outputs.on-branch == 'true'`);
+	} else if (isTag) {
+		out = line(out, "PLAN_NEEDS", void 0);
+		out = line(out, "PLAN_IF", void 0);
+	} else {
+		out = line(out, "PLAN_NEEDS", void 0);
+		out = line(out, "PLAN_IF", `if: >-\n  github.event_name == 'pull_request' ||\n  (github.event_name == 'workflow_dispatch' && inputs['dry-run'])`);
 	}
-}
-async function defaultLoadErdNamespaces$1(configPath) {
-	const { config } = await loadConfig(configPath);
-	return extractOwnedNamespaces(config);
+	if (isTag) {
+		out = line(out, "DEPLOY_NEEDS", "needs: tailor-plan");
+		out = line(out, "DEPLOY_IF", `if: \${{ !(github.event_name == 'workflow_dispatch' && inputs['dry-run']) }}`);
+		out = line(out, "DEPLOY_ENVIRONMENT", `environment: ${environment}`);
+	} else {
+		out = line(out, "DEPLOY_NEEDS", void 0);
+		out = line(out, "DEPLOY_IF", `if: >-\n  github.event_name == 'push' ||\n  (github.event_name == 'workflow_dispatch' && !inputs['dry-run'])`);
+		out = line(out, "DEPLOY_ENVIRONMENT", `environment: ${environment}`);
+	}
+	const driftCheckStep = [
+		`- id: tailor-drift-check`,
+		`  uses: tailor-platform/actions/drift-check@${ACTIONS_SHA} # v1.5.0`,
+		`  with:`,
+		`    package-manager: ${packageManager}`
+	].join("\n");
+	const perAppPlanSteps = apps.flatMap((app) => {
+		const wd = app.dir !== "." ? app.dir : void 0;
+		const wdLine = wd ? `\n    working-directory: ${wd}` : "";
+		return [
+			`- id: tailor-generate-check-${app.name}`,
+			`  uses: tailor-platform/actions/generate-check@${ACTIONS_SHA} # v1.5.0`,
+			`  with:`,
+			`    package-manager: ${packageManager}${wdLine}`,
+			`- id: tailor-plan-${app.name}`,
+			`  if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork`,
+			`  uses: tailor-platform/actions/plan@${ACTIONS_SHA} # v1.5.0`,
+			`  with:`,
+			`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+			`    package-manager: ${packageManager}${wdLine}`,
+			`    label: ${coordinatorName}/${app.name}`,
+			`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+			`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+			`    github-token: \${{ secrets.GITHUB_TOKEN }}`
+		];
+	}).join("\n");
+	out = line(out, "PER_APP_PLAN_STEPS", `${driftCheckStep}\n${perAppPlanSteps}`);
+	const deploySteps = apps.flatMap((app) => [
+		`- id: tailor-deploy-${app.name}`,
+		`  uses: ./.github/actions/tailor-${app.name}`,
+		`  with:`,
+		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+		`    name: ${app.name}`,
+		`    working-directory: ${app.dir}`,
+		`    package-manager: ${packageManager}`,
+		`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+		`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+		`    slack-token: \${{ secrets.TAILOR_SLACK_BOT_TOKEN }}`,
+		`    slack-channel-id: \${{ vars.TAILOR_SLACK_CHANNEL_ID }}`,
+		`    # editable: api-url:`
+	]).join("\n");
+	out = line(out, "PER_APP_DEPLOY_STEPS", deploySteps);
+	out = out.replaceAll("__WORKSPACE_NAME__", () => coordinatorName);
+	out = out.replaceAll("__ENVIRONMENT__", () => environment);
+	if (branch !== void 0) out = out.replaceAll("__BRANCH__", () => branch);
+	if (isTag) out = out.replaceAll("__TAG_PATTERN__", () => tagPattern);
+	const generatedIds = [];
+	if (isTag && branch !== void 0) generatedIds.push("tailor-tag-guard", "tailor-tag-guard/tailor-checkout", "tailor-tag-guard/tailor-tag-guard");
+	generatedIds.push("tailor-plan", "tailor-plan/tailor-checkout", "tailor-plan/tailor-setup", "tailor-plan/tailor-drift-check");
+	for (const app of apps) generatedIds.push(`tailor-plan/tailor-generate-check-${app.name}`, `tailor-plan/tailor-plan-${app.name}`);
+	generatedIds.push("tailor-deploy", "tailor-deploy/tailor-checkout", "tailor-deploy/tailor-setup");
+	for (const app of apps) generatedIds.push(`tailor-deploy/tailor-deploy-${app.name}`);
+	return {
+		content: out,
+		generatedIds
+	};
 }
 /**
-* Audit the generated workflows for drift against the current config/repo
-* state. Read-only: never writes files, the lock, or the config.
+* Render the content of the user-owned .github/actions/tailor-setup/action.yml local action.
 *
-* Throws when drift is found (so it composes like the other `:check`
-* commands). The workflow drift-check step layers advisory behaviour on top
-* (per-rule ignore / continue-on-error); the CLI itself reports via exit code.
-* @param options - Check options
+* This file is generated once by `setup coordinate` and never overwritten.
+* It wraps the setup and install actions with the package manager baked in.
+* @param params - Package manager configuration
+* @returns File content string
 */
-async function checkGitHub(options) {
-	logBetaWarning("setup");
-	const { outputDir } = options;
-	const lock = readLock(outputDir);
-	if (!lock || lock.targets.length === 0) throw new Error("No managed workflows found (.github/tailor-sdk.lock is missing or empty). Run `tailor-sdk setup` first.");
-	const exists = options.configExistsAt ?? ((p) => fs$1.existsSync(p));
-	const defaultBranch = detectDefaultBranchSafe(outputDir, options.gitRunner);
-	const loadErdNamespaces = options.loadErdNamespaces ?? defaultLoadErdNamespaces$1;
-	const findings = [];
-	for (const target of lock.targets) {
-		const absFile = resolveWithinRoot(outputDir, target.file);
-		const currentHash = absFile === null ? null : readHash(absFile);
-		const configAbs = resolveWithinRoot(outputDir, path.join(target.inputs.dir, "tailor.config.ts"));
-		const configExists = configAbs !== null && exists(configAbs);
-		const erdNamespaces = target.kind === "branch" && target.inputs.erdPreview && configAbs !== null && configExists ? await loadErdNamespaces(configAbs) : null;
-		findings.push(...findTargetDrift(target, {
-			fileExists: currentHash !== null,
-			currentHash,
-			configExists,
-			defaultBranch,
-			templateVersion: 5,
-			erdNamespaces
-		}));
-	}
-	const count = lock.targets.length;
-	if (findings.length === 0) {
-		logger.success(`No drift detected across ${String(count)} target(s).`);
-		return;
-	}
-	for (const finding of findings) logger.warn(`[${finding.target}] ${finding.message} (ignore key: ${finding.rule})`);
-	throw new Error(`Detected ${String(findings.length)} drift finding(s) across ${String(count)} target(s). Re-run \`tailor-sdk setup\` to regenerate, or address each finding above.`);
+function renderTailorSetupAction(params) {
+	const { packageManager } = params;
+	return [
+		`# This file is user-owned. Generated once by \`tailor-sdk setup coordinate\` and never overwritten.`,
+		`# Customize freely: add pre/post steps, change install flags, etc.`,
+		`name: Tailor Setup`,
+		`description: Install dependencies and run tailor-sdk setup for composite action callers.`,
+		`runs:`,
+		`  using: composite`,
+		`  steps:`,
+		`    - uses: tailor-platform/actions/setup@${ACTIONS_SHA} # v1.5.0`,
+		`      with:`,
+		`        package-manager: ${packageManager}`,
+		`    # Add custom steps here (e.g. private registry authentication)`,
+		`    - uses: tailor-platform/actions/install@${ACTIONS_SHA} # v1.5.0`,
+		`      with:`,
+		`        package-manager: ${packageManager}`,
+		`        # editable: install-command:`,
+		``
+	].join("\n");
 }
 
 //#endregion
@@ -3050,13 +3140,25 @@ async function defaultLoadConfigName(configPath) {
 	const { config } = await loadConfig(configPath);
 	return config.name;
 }
-async function defaultLoadErdNamespaces(configPath) {
+async function defaultLoadErdNamespaces$1(configPath) {
 	const { config } = await loadConfig(configPath);
 	return extractOwnedNamespaces(config);
 }
+async function defaultLoadHasMigrations$1(configPath) {
+	const { config } = await loadConfig(configPath);
+	return getNamespacesWithMigrations(config, path.dirname(configPath)).length > 0;
+}
+async function defaultLoadHasSeeds$1(configPath) {
+	const { plugins } = await loadConfig(configPath);
+	return plugins.some((p) => p.id === "@tailor-platform/seed");
+}
+async function defaultLoadHasStaticWebsites$1(configPath) {
+	const { config } = await loadConfig(configPath);
+	return (config.staticWebsites?.length ?? 0) > 0;
+}
 const WORKSPACE_NAME_RE = /^[a-z0-9-]+$/;
 function validateWorkspaceName(name) {
-	if (name.length < 3 || name.length > 63 || !WORKSPACE_NAME_RE.test(name) || name.startsWith("-") || name.endsWith("-")) throw new Error(`Invalid workspace name "${name}". Names must be 3-63 characters of lowercase letters, numbers, and hyphens, and cannot start or end with a hyphen. Pass a valid name with --workspace-name.`);
+	if (name.length < 3 || name.length > 63 || !WORKSPACE_NAME_RE.test(name) || name.startsWith("-") || name.endsWith("-")) throw new Error(`Invalid workspace name "${name}". Names must be 3-63 characters of lowercase letters, numbers, and hyphens, and cannot start or end with a hyphen. Pass a valid name with --name.`);
 }
 const BRANCH_RE = /^[A-Za-z0-9._/-]+$/;
 const TAG_PATTERN_RE = /^[A-Za-z0-9._/*?![\]-]+$/;
@@ -3070,6 +3172,10 @@ const ENVIRONMENT_RE = /^[A-Za-z0-9._/-]+$/;
 function validateEnvironment(environment) {
 	if (!ENVIRONMENT_RE.test(environment)) throw new Error(`Invalid environment name "${environment}". Only letters, numbers, ".", "_", "/", and "-" are supported.`);
 }
+const REGION_RE = /^[A-Za-z0-9._-]+$/;
+function validateRegion(region) {
+	if (!REGION_RE.test(region)) throw new Error(`Invalid region "${region}". Only letters, numbers, ".", "_", and "-" are supported.`);
+}
 const DIR_RE = /^[A-Za-z0-9._/-]+$/;
 function validateDir(dir) {
 	if (!DIR_RE.test(dir)) throw new Error(`Invalid --dir "${dir}". Only letters, numbers, ".", "_", "/", and "-" are supported.`);
@@ -3078,7 +3184,7 @@ const ERD_NAMESPACE_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 function validateErdNamespaces(namespaces) {
 	for (const namespace of namespaces) if (!ERD_NAMESPACE_RE.test(namespace)) throw new Error(`TailorDB namespace "${namespace}" cannot be used in --erd-preview. Only letters, numbers, '.', '_', and '-' are supported, and the name must start with a letter or number.`);
 }
-function escapesRoot(rel) {
+function escapesRoot$1(rel) {
 	return rel === ".." || rel.startsWith(`..${path.sep}`) || rel.startsWith("../") || path.isAbsolute(rel);
 }
 /**
@@ -3094,11 +3200,11 @@ function escapesRoot(rel) {
 function resolveConfigPath(outputDir, dir) {
 	const appDir = path.resolve(outputDir, dir);
 	const rel = path.relative(outputDir, appDir);
-	if (path.isAbsolute(dir) || escapesRoot(rel)) throw new Error(`--dir must be a relative path inside the repository (got "${dir}").`);
+	if (path.isAbsolute(dir) || escapesRoot$1(rel)) throw new Error(`--dir must be a relative path inside the repository (got "${dir}").`);
 	if (fs$1.existsSync(appDir)) {
 		const realAppDir = path.normalize(fs$1.realpathSync(appDir));
 		const realOutputDir = path.normalize(fs$1.realpathSync(outputDir));
-		if (escapesRoot(path.relative(realOutputDir, realAppDir))) throw new Error(`--dir must resolve to a directory inside the repository (got "${dir}", which links outside it).`);
+		if (escapesRoot$1(path.relative(realOutputDir, realAppDir))) throw new Error(`--dir must resolve to a directory inside the repository (got "${dir}", which links outside it).`);
 	}
 	const configPath = path.join(appDir, "tailor.config.ts");
 	if (!fs$1.existsSync(configPath)) throw new Error(`tailor.config.ts not found at ${configPath}. Run this from your SDK project root, or pass the app directory with --dir.`);
@@ -3110,17 +3216,15 @@ function resolveConfigPath(outputDir, dir) {
 * @returns Resolved target metadata and rendered content
 */
 async function resolve$1(options) {
-	if (options.tag && !options.plan) throw new Error("--no-plan cannot be combined with --tag (tag targets always run plan before deploy). Drop --no-plan or use a branch target.");
-	if (options.erdPreview && (options.tag || !options.plan)) throw new Error("--erd-preview requires a branch target with plan enabled.");
 	const dir = options.dir.replaceAll("\\", "/").replace(/\/{2,}/g, "/").replace(/^\.\//, "").replace(/\/$/, "") || ".";
 	validateDir(dir);
 	const workingDirectory = dir !== "." ? dir : void 0;
 	const configPath = resolveConfigPath(options.outputDir, dir);
 	const loadName = options.loadConfigName ?? defaultLoadConfigName;
 	const workspaceName = options.workspaceName ?? await loadName(configPath);
-	if (!workspaceName) throw new Error("Could not determine the workspace name. Pass --workspace-name, or set 'name' in tailor.config.ts.");
+	if (!workspaceName) throw new Error("Could not determine the workspace name. Pass --name, or set 'name' in tailor.config.ts.");
 	validateWorkspaceName(workspaceName);
-	const kind = options.tag ? "tag" : "branch";
+	const { kind } = options;
 	const packageManager = detectPackageManager(options.outputDir);
 	const environment = options.environment ?? workspaceName;
 	validateEnvironment(environment);
@@ -3129,47 +3233,85 @@ async function resolve$1(options) {
 	let branchAutoDetected = false;
 	let render;
 	let erdNamespaces = [];
-	if (options.erdPreview) {
-		erdNamespaces = await (options.loadErdNamespaces ?? defaultLoadErdNamespaces)(configPath);
-		if (erdNamespaces.length === 0) throw new Error("No TailorDB namespaces found for --erd-preview. Define owned db namespaces in tailor.config.ts.");
-		validateErdNamespaces(erdNamespaces);
-	}
+	let hasMigrations = false;
+	let hasSeeds = false;
+	let hasStaticWebsites = false;
+	const loadHasMigrations = options.loadHasMigrations ?? defaultLoadHasMigrations$1;
+	const loadHasSeeds = options.loadHasSeeds ?? defaultLoadHasSeeds$1;
+	const loadHasStaticWebsites = options.loadHasStaticWebsites ?? defaultLoadHasStaticWebsites$1;
 	if (kind === "branch") {
+		if (options.erdPreview) {
+			erdNamespaces = await (options.loadErdNamespaces ?? defaultLoadErdNamespaces$1)(configPath);
+			if (erdNamespaces.length === 0) throw new Error("No TailorDB namespaces found for --erd-preview. Define owned db namespaces in tailor.config.ts.");
+			validateErdNamespaces(erdNamespaces);
+		}
 		branchAutoDetected = options.branch === void 0;
 		branch = options.branch ?? detectDefaultBranch(options.outputDir, options.gitRunner);
 		validateBranch(branch);
+		hasMigrations = await loadHasMigrations(configPath);
+		hasSeeds = await loadHasSeeds(configPath);
 		render = renderBranchWorkflow({
 			workspaceName,
 			branch,
 			workingDirectory,
 			environment,
 			packageManager,
-			plan: options.plan,
-			erdPreview: options.erdPreview ? { namespaces: erdNamespaces } : null
+			erdPreview: options.erdPreview ? { namespaces: erdNamespaces } : null,
+			migrationDriftCheck: hasMigrations,
+			seedValidate: hasSeeds
 		});
-	} else {
+	} else if (kind === "tag") {
 		branch = options.branch ?? null;
 		if (branch !== null) validateBranch(branch);
+		hasMigrations = await loadHasMigrations(configPath);
+		hasSeeds = await loadHasSeeds(configPath);
 		render = renderTagWorkflow({
 			workspaceName,
 			tagPattern: options.tagPattern,
 			branch: options.branch,
 			workingDirectory,
 			environment,
-			packageManager
+			packageManager,
+			migrationDriftCheck: hasMigrations,
+			seedValidate: hasSeeds
+		});
+	} else if (kind === "preview") {
+		branchAutoDetected = options.branch === void 0;
+		branch = options.branch ?? detectDefaultBranch(options.outputDir, options.gitRunner);
+		validateBranch(branch);
+		validateRegion(options.region);
+		render = renderPreviewWorkflow({
+			workspaceName,
+			branch,
+			workingDirectory,
+			environment,
+			packageManager,
+			region: options.region,
+			requirePreviewLabel: options.requirePreviewLabel ?? false
+		});
+	} else {
+		hasStaticWebsites = await loadHasStaticWebsites(configPath);
+		render = renderActionWorkflow({
+			workspaceName,
+			workingDirectory,
+			hasStaticWebsites
 		});
 	}
-	const file = `.github/workflows/tailor-${workspaceName}.yml`;
+	const file = kind === "action" ? `.github/actions/tailor-${workspaceName}/action.yml` : `.github/workflows/tailor-${workspaceName}${kind === "tag" ? "-tag" : kind === "preview" ? "-preview" : ""}.yml`;
 	const inputs = {
-		branch,
-		branchAutoDetected: kind === "branch" ? branchAutoDetected : void 0,
+		branch: kind === "action" ? null : branch,
+		branchAutoDetected: kind === "branch" || kind === "preview" ? branchAutoDetected : void 0,
 		tagPattern: kind === "tag" ? options.tagPattern : null,
 		environment,
 		dir,
 		packageManager,
-		plan: kind === "branch" ? options.plan : true,
+		region: kind === "preview" ? options.region : void 0,
+		requirePreviewLabel: kind === "preview" ? options.requirePreviewLabel ?? false : void 0,
 		erdPreview: kind === "branch" ? options.erdPreview : false,
-		erdNamespaces: kind === "branch" && options.erdPreview ? erdNamespaces : void 0
+		erdNamespaces: kind === "branch" && options.erdPreview ? erdNamespaces : void 0,
+		migrationDriftCheck: kind === "branch" || kind === "tag" ? hasMigrations : void 0,
+		seedValidate: kind === "branch" || kind === "tag" ? hasSeeds : void 0,
+		hasStaticWebsites: kind === "action" ? hasStaticWebsites : void 0
 	};
 	return {
 		kind,
@@ -3184,6 +3326,40 @@ async function resolve$1(options) {
 		configPath
 	};
 }
+const BUILD_SITE_RUN_RE = /([ \t]*- id: build-site\n[ \t]+shell: bash\n[ \t]+run: \|)([\s\S]*?)(\n[ \t]*- |\n*$)/;
+/**
+* Strip the mutable run: body of the build-site step before hashing.
+* When hasStaticWebsites is true the step is present; users are expected to
+* replace the placeholder command with their actual build command.  We only
+* hash the structural parts (step id, shell declaration, run: key) so that
+* editing the build command does not look like unintended drift.
+* When hasStaticWebsites is false the step is absent, so the regex is a no-op.
+* @param content - Raw action workflow content
+* @returns Normalised content with the build-site run body replaced by a placeholder
+*/
+function normalizeActionContent(content) {
+	return content.replace(BUILD_SITE_RUN_RE, (_, header, _body, tail) => `${header}\n        true${tail}`);
+}
+/**
+* Extract the run: body of the build-site step from action content.
+* Returns null when the step is absent (hasStaticWebsites is false).
+* @param content - Action workflow content
+* @returns The captured run body string (includes leading newline), or null
+*/
+function extractBuildSiteRunBody(content) {
+	const m = BUILD_SITE_RUN_RE.exec(content);
+	return m ? m[2] ?? null : null;
+}
+/**
+* Replace the run: body of the build-site step in action content.
+* No-op when the step is absent.
+* @param content - Target action workflow content
+* @param body - Run body to inject (includes leading newline and indentation)
+* @returns Content with the run body replaced
+*/
+function injectBuildSiteRunBody(content, body) {
+	return content.replace(BUILD_SITE_RUN_RE, (_, header, _placeholder, tail) => `${header}${body}${tail}`);
+}
 /**
 * Decide how to reconcile a target with the on-disk file and lock state.
 * @param obj - Decision inputs
@@ -3191,10 +3367,11 @@ async function resolve$1(options) {
 * @param obj.fileExists - Whether the workflow file is present on disk
 * @param obj.currentContent - On-disk content when present
 * @param obj.force - Whether --force was passed
+* @param obj.normalize - Optional content normaliser applied before hashing
 * @returns The reconciliation action
 */
 function decideAction(obj) {
-	const { existing, fileExists, currentContent, force } = obj;
+	const { existing, fileExists, currentContent, force, normalize } = obj;
 	if (!existing) {
 		if (!fileExists) return { action: "create" };
 		if (force) return { action: "regenerate" };
@@ -3204,7 +3381,9 @@ function decideAction(obj) {
 		};
 	}
 	if (!fileExists) return { action: "restore" };
-	if (currentContent !== null && hashContent(currentContent) === existing.contentHash) return { action: "regenerate" };
+	if (currentContent !== null) {
+		if (hashContent(normalize ? normalize(currentContent) : currentContent) === existing.contentHash) return { action: "regenerate" };
+	}
 	if (force) return { action: "regenerate" };
 	return {
 		action: "conflict",
@@ -3222,7 +3401,7 @@ function decideAction(obj) {
 function assertNoKindCollision(obj) {
 	const { lock, kind, workspaceName, file } = obj;
 	const collision = lock?.targets.find((t) => t.file === file && !(t.kind === kind && t.workspaceName === workspaceName));
-	if (collision) throw new Error(`A ${collision.kind} target already owns ${file}, which conflicts with this ${kind} target. Pass a different name with --workspace-name to generate a separate workflow.`);
+	if (collision) throw new Error(`A ${collision.kind} target already owns ${file}, which conflicts with this ${kind} target. Pass a different name with --name to generate a separate workflow.`);
 }
 /**
 * Print next-step guidance after generating workflow files.
@@ -3249,11 +3428,10 @@ function printNextSteps(obj) {
 	if (idInjected) logger.log("   - tailor.config.ts (app id was added)");
 }
 /**
-* Generate the GitHub Actions workflow for a deploy target and reconcile it
-* with the lock file.
+* Generate a deploy target workflow and reconcile it with the lock file.
 * @param options - Setup options
 */
-async function setupGitHub(options) {
+async function setupTarget(options) {
 	logBetaWarning("setup");
 	const resolved = await resolve$1(options);
 	const lock = readLock(options.outputDir);
@@ -3266,27 +3444,35 @@ async function setupGitHub(options) {
 	});
 	const existing = findTarget(lock, resolved.kind, resolved.workspaceName);
 	const fileExists = fs$1.existsSync(absFile);
+	const currentContent = fileExists ? fs$1.readFileSync(absFile, "utf-8") : null;
+	const normalize = resolved.kind === "action" ? normalizeActionContent : void 0;
 	const decision = decideAction({
 		existing,
 		fileExists,
-		currentContent: fileExists ? fs$1.readFileSync(absFile, "utf-8") : null,
-		force: options.force
+		currentContent,
+		force: options.force,
+		normalize
 	});
 	if (decision.action === "conflict") throw new Error(`${resolved.file}: ${decision.reason}`);
 	const idResult = await ensureConfigId(resolved.configPath);
 	if (idResult === null) logger.warn("Could not find a defineConfig() call to confirm an app id. The CI deploy will fail unless your config resolves to one with an 'id'.");
 	const idInjected = idResult?.injected ?? false;
+	let contentToWrite = resolved.render.content;
+	if (decision.action === "regenerate" && normalize && currentContent !== null) {
+		const existingBody = extractBuildSiteRunBody(currentContent);
+		if (existingBody !== null) contentToWrite = injectBuildSiteRunBody(contentToWrite, existingBody);
+	}
 	fs$1.mkdirSync(path.dirname(absFile), { recursive: true });
-	fs$1.writeFileSync(absFile, resolved.render.content, "utf-8");
+	fs$1.writeFileSync(absFile, contentToWrite, "utf-8");
 	const newTarget = {
 		kind: resolved.kind,
 		workspaceName: resolved.workspaceName,
 		file: resolved.file,
-		templateVersion: 5,
+		templateVersion: 6,
 		inputs: resolved.inputs,
 		generatedIds: resolved.render.generatedIds,
 		ejectedIds: existing?.ejectedIds ?? [],
-		contentHash: hashContent(resolved.render.content)
+		contentHash: hashContent(normalize ? normalize(resolved.render.content) : resolved.render.content)
 	};
 	const targets = [...lock?.targets ?? []];
 	const index = targets.findIndex((t) => t.kind === newTarget.kind && t.workspaceName === newTarget.workspaceName);
@@ -3299,39 +3485,379 @@ async function setupGitHub(options) {
 	if (decision.action === "restore") logger.success(`Regenerated ${styles.path(resolved.file)} (was missing on disk)`);
 	else if (decision.action === "regenerate") logger.success(`Regenerated ${styles.path(resolved.file)}`);
 	else logger.success(`Generated ${styles.path(resolved.file)}`);
-	printNextSteps({
+	if (resolved.kind === "action") {
+		logger.newline();
+		logger.info("Next steps:");
+		logger.newline();
+		logger.log(`The composite action has been generated at ${styles.path(resolved.file)}.`);
+		logger.log("Use `tailor-sdk setup coordinate` to generate a coordinator workflow that orchestrates this action.");
+	} else printNextSteps({
 		environment: resolved.environment,
 		idInjected
 	});
 }
+/**
+* Generate the coordinator workflow that orchestrates per-app composite actions.
+*
+* Unlike `setupTarget`, this function does not read a Tailor config. The coordinator
+* name is required via `--name`. App working directories are resolved from
+* the lock file entries created by `setup action`.
+* @param options - Coordinate setup options
+*/
+async function setupCoordinate(options) {
+	logBetaWarning("setup");
+	const { coordinatorName, coordinateKind, actions, force, outputDir } = options;
+	validateWorkspaceName(coordinatorName);
+	if (actions.length === 0) throw new Error("At least one --action is required. Run `tailor-sdk setup action --dir <app-dir>` for each app first.");
+	const environment = options.environment ?? coordinatorName;
+	validateEnvironment(environment);
+	let branch = null;
+	let branchAutoDetected = false;
+	if (coordinateKind === "branch") {
+		branchAutoDetected = options.branch === void 0;
+		branch = options.branch ?? detectDefaultBranch(outputDir, options.gitRunner);
+		validateBranch(branch);
+	} else if (options.branch !== void 0) {
+		validateBranch(options.branch);
+		branch = options.branch;
+	}
+	const tagPattern = options.tagPattern ?? "v*";
+	if (coordinateKind === "tag") validateTagPattern(tagPattern);
+	const packageManager = detectPackageManager(outputDir);
+	const lock = readLock(outputDir);
+	if (!lock) throw new Error(".github/tailor-sdk.lock not found. Run `tailor-sdk setup action --name <name>` for each app before running setup coordinate.");
+	const seenNames = /* @__PURE__ */ new Set();
+	const apps = actions.map((actionName) => {
+		const name = actionName.startsWith("tailor-") ? actionName.slice(7) : actionName;
+		if (seenNames.has(name)) throw new Error(`Duplicate --action "${name}". Each composite action can only appear once in a coordinator.`);
+		seenNames.add(name);
+		const entry = lock.targets.find((t) => t.kind === "action" && t.workspaceName === name);
+		if (!entry) throw new Error(`Action target "${name}" not found in .github/tailor-sdk.lock. Run \`tailor-sdk setup action --name ${name}\` first.`);
+		validateDir(entry.inputs.dir);
+		return {
+			name,
+			dir: entry.inputs.dir
+		};
+	});
+	const render = renderCoordinateWorkflow({
+		coordinatorName,
+		kind: coordinateKind,
+		apps,
+		branch: branch ?? void 0,
+		tagPattern: coordinateKind === "tag" ? tagPattern : void 0,
+		environment,
+		packageManager
+	});
+	const file = `.github/workflows/tailor-coordinate-${coordinatorName}${coordinateKind === "tag" ? "-tag" : ""}.yml`;
+	const absFile = path.join(outputDir, file);
+	assertNoKindCollision({
+		lock,
+		kind: "coordinate",
+		workspaceName: coordinatorName,
+		file
+	});
+	const existing = findTarget(lock, "coordinate", coordinatorName);
+	const fileExists = fs$1.existsSync(absFile);
+	const decision = decideAction({
+		existing,
+		fileExists,
+		currentContent: fileExists ? fs$1.readFileSync(absFile, "utf-8") : null,
+		force
+	});
+	if (decision.action === "conflict") throw new Error(`${file}: ${decision.reason}`);
+	fs$1.mkdirSync(path.dirname(absFile), { recursive: true });
+	fs$1.writeFileSync(absFile, render.content, "utf-8");
+	const tailorSetupFile = ".github/actions/tailor-setup/action.yml";
+	const absTailorSetupFile = path.join(outputDir, tailorSetupFile);
+	if (!fs$1.existsSync(absTailorSetupFile)) {
+		fs$1.mkdirSync(path.dirname(absTailorSetupFile), { recursive: true });
+		fs$1.writeFileSync(absTailorSetupFile, renderTailorSetupAction({ packageManager }), "utf-8");
+		logger.success(`Generated ${styles.path(tailorSetupFile)}`);
+	}
+	const newTarget = {
+		kind: "coordinate",
+		workspaceName: coordinatorName,
+		file,
+		templateVersion: 6,
+		inputs: {
+			branch,
+			branchAutoDetected: coordinateKind === "branch" ? branchAutoDetected : branch !== null ? false : void 0,
+			tagPattern: coordinateKind === "tag" ? tagPattern : null,
+			environment,
+			dir: ".",
+			packageManager,
+			actionDirs: apps.map((a) => a.dir)
+		},
+		generatedIds: render.generatedIds,
+		ejectedIds: existing?.ejectedIds ?? [],
+		contentHash: hashContent(render.content)
+	};
+	const targets = [...lock.targets];
+	const idx = targets.findIndex((t) => t.kind === newTarget.kind && t.workspaceName === newTarget.workspaceName);
+	if (idx === -1) targets.push(newTarget);
+	else targets[idx] = newTarget;
+	writeLock(outputDir, {
+		version: 1,
+		targets
+	});
+	if (decision.action === "restore") logger.success(`Regenerated ${styles.path(file)} (was missing on disk)`);
+	else if (decision.action === "regenerate") logger.success(`Regenerated ${styles.path(file)}`);
+	else logger.success(`Generated ${styles.path(file)}`);
+	logger.newline();
+	logger.info("Next steps:");
+	logger.newline();
+	logger.log(`1. Set the machine-user credentials as secrets on the "${environment}" environment:`);
+	logger.log(`   gh secret set TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID --env ${environment}`);
+	logger.log(`   gh secret set TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET --env ${environment}`);
+	logger.newline();
+	logger.log(`2. Provision each workspace and set TAILOR_PLATFORM_WORKSPACE_ID on the "${environment}" environment:`);
+	logger.log("   tailor-sdk workspace create   # one per app; copy the id");
+	logger.log(`   gh variable set TAILOR_PLATFORM_WORKSPACE_ID --env ${environment}`);
+	logger.newline();
+	logger.log("3. Commit the generated files:");
+	logger.log(`   - ${file}`);
+	logger.log(`   - ${tailorSetupFile}  (if newly created)`);
+	logger.log("   - .github/tailor-sdk.lock");
+}
+
+//#endregion
+//#region src/cli/commands/setup/check.ts
+/**
+* Compute drift findings for one target by comparing its recorded lock state
+* against the current repository/config state.
+* @param target - The lock target being audited
+* @param state - Current repository/config state for this target
+* @returns Drift findings (empty when the target is in sync)
+*/
+function findTargetDrift(target, state) {
+	const id = `${target.kind} ${target.workspaceName}`;
+	const findings = [];
+	if (!state.fileExists) findings.push({
+		target: id,
+		rule: "missing-file",
+		message: `${target.file} is missing or unreadable. Re-run setup to restore it.`
+	});
+	else if (state.currentHash !== null && state.currentHash !== target.contentHash) findings.push({
+		target: id,
+		rule: "hand-edit",
+		message: `${target.file} was edited by hand since it was generated. Re-run setup with --force to regenerate, or keep customizations in your own jobs/steps.`
+	});
+	if (target.templateVersion < state.templateVersion) findings.push({
+		target: id,
+		rule: "template-version",
+		message: `A newer workflow template is available (generated with v${String(target.templateVersion)}, current v${String(state.templateVersion)}). Re-run setup to update.`
+	});
+	if (!state.configExists) findings.push({
+		target: id,
+		rule: "config-dir",
+		message: `tailor.config.ts not found under "${target.inputs.dir}". The app directory may have moved; re-run setup with the correct --dir.`
+	});
+	if ((target.kind === "branch" || target.kind === "coordinate" || target.kind === "preview") && target.inputs.branchAutoDetected !== false && state.defaultBranch !== null && target.inputs.branch !== null && target.inputs.branch !== state.defaultBranch) findings.push({
+		target: id,
+		rule: "default-branch",
+		message: `The workflow triggers on "${target.inputs.branch}" but the repository default branch is now "${state.defaultBranch}". If this is intentional, ignore this; otherwise re-run setup so the trigger matches the default branch.`
+	});
+	if (target.kind === "branch" && target.inputs.erdPreview && state.configExists) {
+		const recorded = [...target.inputs.erdNamespaces ?? []].toSorted((a, b) => a.localeCompare(b));
+		const current = state.erdNamespaces?.toSorted((a, b) => a.localeCompare(b)) ?? null;
+		if (current === null || recorded.length !== current.length || recorded.some((namespace, index) => namespace !== current[index])) findings.push({
+			target: id,
+			rule: "erd-namespaces",
+			message: "TailorDB namespaces for ERD preview changed. Re-run setup so the ERD preview matrix is regenerated."
+		});
+	}
+	if ((target.kind === "branch" || target.kind === "tag") && target.inputs.migrationDriftCheck === false && state.hasMigrations === true) findings.push({
+		target: id,
+		rule: "migration-drift",
+		message: "TailorDB namespaces with migrations were added to the config. Re-run setup so the tailor-migration-drift-check step is included in the plan job."
+	});
+	if ((target.kind === "branch" || target.kind === "tag") && target.inputs.seedValidate === false && state.hasSeeds === true) findings.push({
+		target: id,
+		rule: "seed-validate",
+		message: "Seed plugin detected in the current config. Re-run setup so the tailor-seed-validate step is included in the plan job."
+	});
+	if (target.kind === "action" && target.inputs.hasStaticWebsites === false && state.hasStaticWebsites === true) findings.push({
+		target: id,
+		rule: "static-websites",
+		message: "Static websites were added to the config. Re-run setup so the build-site slot is included in the composite action."
+	});
+	return findings;
+}
+function detectDefaultBranchSafe(cwd, run) {
+	try {
+		return detectDefaultBranch(cwd, run);
+	} catch {
+		return null;
+	}
+}
+function escapesRoot(rel) {
+	return path.isAbsolute(rel) || rel === ".." || rel.startsWith(`..${path.sep}`) || rel.startsWith("../");
+}
+function resolveWithinRoot(outputDir, relPath) {
+	if (path.isAbsolute(relPath)) return null;
+	const abs = path.join(outputDir, relPath);
+	if (escapesRoot(path.relative(outputDir, abs))) return null;
+	try {
+		if (escapesRoot(path.relative(fs$1.realpathSync(outputDir), fs$1.realpathSync(abs)))) return null;
+	} catch {}
+	return abs;
+}
+function readHash(absFile, normalize) {
+	try {
+		const content = fs$1.readFileSync(absFile, "utf-8");
+		return hashContent(normalize ? normalize(content) : content);
+	} catch {
+		return null;
+	}
+}
+async function defaultLoadErdNamespaces(configPath) {
+	const { config } = await loadConfig(configPath);
+	return extractOwnedNamespaces(config);
+}
+async function defaultLoadHasMigrations(configPath) {
+	const { config } = await loadConfig(configPath);
+	return getNamespacesWithMigrations(config, path.dirname(configPath)).length > 0;
+}
+async function defaultLoadHasSeeds(configPath) {
+	const { plugins } = await loadConfig(configPath);
+	return plugins.some((p) => p.id === "@tailor-platform/seed");
+}
+async function defaultLoadHasStaticWebsites(configPath) {
+	const { config } = await loadConfig(configPath);
+	return (config.staticWebsites?.length ?? 0) > 0;
+}
+/**
+* Audit the generated workflows for drift against the current config/repo
+* state. Read-only: never writes files, the lock, or the config.
+*
+* Throws when drift is found (so it composes like the other `:check`
+* commands). The workflow drift-check step layers advisory behaviour on top
+* (per-rule ignore / continue-on-error); the CLI itself reports via exit code.
+* @param options - Check options
+*/
+async function checkGitHub(options) {
+	logBetaWarning("setup");
+	const { outputDir } = options;
+	const lock = readLock(outputDir);
+	if (!lock || lock.targets.length === 0) throw new Error("No managed workflows found (.github/tailor-sdk.lock is missing or empty). Run `tailor-sdk setup branch` (or another setup subcommand) first.");
+	if (!options.ci) {
+		if (lock.targets.some((t) => t.kind === "branch" || t.kind === "tag" || t.kind === "coordinate") && !process.env["TAILOR_PLATFORM_WORKSPACE_ID"]) throw new Error("TAILOR_PLATFORM_WORKSPACE_ID is not set. Provision the workspace and set the variable:\n  tailor-sdk workspace create   # if it does not exist yet; copy the id\n  gh variable set TAILOR_PLATFORM_WORKSPACE_ID --env <environment>");
+	}
+	const slackToken = Boolean(process.env["TAILOR_SLACK_BOT_TOKEN"]);
+	if (slackToken !== Boolean(process.env["TAILOR_SLACK_CHANNEL_ID"])) throw new Error(`Slack is partially configured: ${slackToken ? "TAILOR_SLACK_BOT_TOKEN is set" : "TAILOR_SLACK_CHANNEL_ID is set"} but not both. TAILOR_SLACK_BOT_TOKEN (secret) and TAILOR_SLACK_CHANNEL_ID (variable) must be set together, or neither should be set.`);
+	const exists = options.configExistsAt ?? ((p) => fs$1.existsSync(p));
+	const defaultBranch = detectDefaultBranchSafe(outputDir, options.gitRunner);
+	const loadErdNamespaces = options.loadErdNamespaces ?? defaultLoadErdNamespaces;
+	const loadHasMigrations = options.loadHasMigrations ?? defaultLoadHasMigrations;
+	const loadHasSeeds = options.loadHasSeeds ?? defaultLoadHasSeeds;
+	const loadHasStaticWebsites = options.loadHasStaticWebsites ?? defaultLoadHasStaticWebsites;
+	const findings = [];
+	for (const target of lock.targets) {
+		const absFile = resolveWithinRoot(outputDir, target.file);
+		const currentHash = absFile === null ? null : readHash(absFile, target.kind === "action" ? normalizeActionContent : void 0);
+		const configAbs = target.kind === "coordinate" ? null : resolveWithinRoot(outputDir, path.join(target.inputs.dir, "tailor.config.ts"));
+		const configExists = target.kind === "coordinate" || configAbs !== null && exists(configAbs);
+		const erdNamespaces = target.kind === "branch" && target.inputs.erdPreview && configAbs !== null && configExists ? await loadErdNamespaces(configAbs) : null;
+		const hasMigrations = (target.kind === "branch" || target.kind === "tag") && target.inputs.migrationDriftCheck !== void 0 && configAbs !== null && configExists ? await loadHasMigrations(configAbs) : void 0;
+		const hasSeeds = (target.kind === "branch" || target.kind === "tag") && target.inputs.seedValidate !== void 0 && configAbs !== null && configExists ? await loadHasSeeds(configAbs) : void 0;
+		const hasStaticWebsites = target.kind === "action" && target.inputs.hasStaticWebsites !== void 0 && configAbs !== null && configExists ? await loadHasStaticWebsites(configAbs) : void 0;
+		findings.push(...findTargetDrift(target, {
+			fileExists: currentHash !== null,
+			currentHash,
+			configExists,
+			defaultBranch,
+			templateVersion: 6,
+			erdNamespaces,
+			hasMigrations,
+			hasSeeds,
+			hasStaticWebsites
+		}));
+	}
+	const count = lock.targets.length;
+	if (findings.length === 0) {
+		logger.success(`No drift detected across ${String(count)} target(s).`);
+		return;
+	}
+	for (const finding of findings) logger.warn(`[${finding.target}] ${finding.message} (ignore key: ${finding.rule})`);
+	throw new Error(`Detected ${String(findings.length)} drift finding(s) across ${String(count)} target(s). Re-run \`tailor-sdk setup\` to regenerate, or address each finding above.`);
+}
 
 //#endregion
 //#region src/cli/commands/setup/index.ts
 const checkCommand = defineAppCommand({
 	name: "check",
 	description: "Audit generated workflows for drift against the current config/repo (read-only).",
-	args: z.object({}).strict(),
-	run: async () => {
-		await checkGitHub({ outputDir: process.cwd() });
+	args: z.object({ ci: arg(z.boolean().default(false), { description: "Run in CI mode: skip checks that are handled by the runtime (e.g. TAILOR_PLATFORM_WORKSPACE_ID)." }) }).strict(),
+	run: async (args) => {
+		await checkGitHub({
+			outputDir: process.cwd(),
+			ci: args.ci
+		});
 	}
 });
-const setupCommand = defineAppCommand({
-	name: "setup",
-	description: "Generate a CI deploy workflow for your project. (beta)",
+const coordinateCommand = defineAppCommand({
+	name: "coordinate",
+	description: "Generate a coordinator workflow that orchestrates multiple --action-generated composite actions.",
 	args: z.object({
-		provider: arg(z.enum(["github"], { message: "Only the 'github' provider is supported." }).default("github"), {
-			alias: "p",
-			description: "CI provider to generate for (only 'github' is supported)"
+		name: arg(z.string().min(1), {
+			alias: "n",
+			description: "Coordinator name (used in the generated workflow file name and job names)"
 		}),
-		"workspace-name": arg(z.string().min(1).optional(), {
+		action: arg(z.array(z.string().min(1)).min(1), { description: "Composite action to include (can be specified multiple times). tailor- prefix optional." }),
+		branch: arg(z.string().min(1).optional(), { description: "Branch target: deploy trigger branch (defaults to the detected default branch)" }),
+		tag: arg(z.boolean().default(false), { description: "Generate a tag target coordinator" }),
+		environment: arg(z.string().min(1).optional(), { description: "GitHub Environment for the plan/deploy jobs" }),
+		force: arg(z.boolean().default(false), { description: "Discard hand edits and regenerate" })
+	}).strict(),
+	run: async (args) => {
+		const coordinateKind = args.tag ? "tag" : "branch";
+		await setupCoordinate({
+			coordinatorName: args.name,
+			coordinateKind,
+			actions: args.action,
+			branch: args.branch,
+			environment: args.environment,
+			force: args.force,
+			outputDir: process.cwd()
+		});
+	}
+});
+const actionCommand = defineAppCommand({
+	name: "action",
+	description: "Generate a per-app composite action for use with setup coordinate (monorepo multi-app deploys).",
+	args: z.object({
+		name: arg(z.string().min(1).optional(), {
 			alias: "n",
-			description: "Workspace name (defaults to the config 'name')"
+			description: "Name (defaults to the config 'name')"
+		}),
+		dir: arg(z.string().min(1).default("."), {
+			alias: "d",
+			description: "App directory"
 		}),
-		branch: arg(z.string().min(1).optional(), { description: "Branch target: deploy trigger branch (defaults to the detected default branch). Tag target: tag-reachability guard branch (no guard when omitted)" }),
-		tag: arg(z.boolean().default(false), { description: "Generate a tag target (deploy on tag push)" }),
-		"tag-pattern": arg(z.string().min(1).optional(), { description: "Tag glob to match (requires --tag; defaults to v*)" }),
+		environment: arg(z.string().min(1).optional(), { description: "GitHub Environment (defaults to the workspace name)" }),
+		force: arg(z.boolean().default(false), { description: "Discard hand edits and regenerate" })
+	}).strict(),
+	run: async (args) => {
+		await setupTarget({
+			kind: "action",
+			workspaceName: args.name,
+			dir: args.dir,
+			environment: args.environment,
+			force: args.force,
+			outputDir: process.cwd()
+		});
+	}
+});
+const branchCommand = defineAppCommand({
+	name: "branch",
+	description: "Generate a branch-target deploy workflow (push to branch triggers deploy).",
+	args: z.object({
+		name: arg(z.string().min(1).optional(), {
+			alias: "n",
+			description: "Name (defaults to the config 'name')"
+		}),
+		branch: arg(z.string().min(1).optional(), { description: "Deploy trigger branch (defaults to the detected default branch)" }),
 		environment: arg(z.string().min(1).optional(), { description: "GitHub Environment for the plan/deploy jobs (defaults to the workspace name)" }),
-		"no-plan": arg(z.boolean().default(false), { description: "Disable the plan job for a branch target (cannot be combined with --tag)" }),
 		"erd-preview": arg(z.boolean().default(false), { description: "Add PR ERD viewer artifacts with current/diff previews for TailorDB namespaces" }),
 		dir: arg(z.string().min(1).default("."), {
 			alias: "d",
@@ -3339,17 +3865,12 @@ const setupCommand = defineAppCommand({
 		}),
 		force: arg(z.boolean().default(false), { description: "Discard hand edits / take over unmanaged files and regenerate" })
 	}).strict(),
-	subCommands: { check: checkCommand },
 	run: async (args) => {
-		if (args["tag-pattern"] !== void 0 && !args.tag) throw new Error("--tag-pattern requires --tag.");
-		if (args["no-plan"] && args.tag) throw new Error("--no-plan cannot be combined with --tag.");
-		await setupGitHub({
-			workspaceName: args["workspace-name"],
+		await setupTarget({
+			kind: "branch",
+			workspaceName: args.name,
 			branch: args.branch,
-			tag: args.tag,
-			tagPattern: args["tag-pattern"] ?? "v*",
 			environment: args.environment,
-			plan: !args["no-plan"],
 			erdPreview: args["erd-preview"],
 			dir: args.dir,
 			force: args.force,
@@ -3357,6 +3878,80 @@ const setupCommand = defineAppCommand({
 		});
 	}
 });
+const tagCommand = defineAppCommand({
+	name: "tag",
+	description: "Generate a tag-target deploy workflow (tag push triggers deploy).",
+	args: z.object({
+		name: arg(z.string().min(1).optional(), {
+			alias: "n",
+			description: "Name (defaults to the config 'name')"
+		}),
+		"tag-pattern": arg(z.string().min(1).default("v*"), { description: "Tag glob to match (defaults to v*)" }),
+		branch: arg(z.string().min(1).optional(), { description: "Tag-reachability guard branch (no guard when omitted)" }),
+		environment: arg(z.string().min(1).optional(), { description: "GitHub Environment for the plan/deploy jobs (defaults to the workspace name)" }),
+		dir: arg(z.string().min(1).default("."), {
+			alias: "d",
+			description: "App directory (for monorepo setups)"
+		}),
+		force: arg(z.boolean().default(false), { description: "Discard hand edits / take over unmanaged files and regenerate" })
+	}).strict(),
+	run: async (args) => {
+		await setupTarget({
+			kind: "tag",
+			workspaceName: args.name,
+			tagPattern: args["tag-pattern"],
+			branch: args.branch,
+			environment: args.environment,
+			dir: args.dir,
+			force: args.force,
+			outputDir: process.cwd()
+		});
+	}
+});
+const previewCommand = defineAppCommand({
+	name: "preview",
+	description: "Generate a preview workflow (PR open/sync triggers deploy to a per-PR workspace).",
+	args: z.object({
+		name: arg(z.string().min(1).optional(), {
+			alias: "n",
+			description: "Name (defaults to the config 'name')"
+		}),
+		branch: arg(z.string().min(1).optional(), { description: "Branch to filter PRs by (defaults to the detected default branch)" }),
+		region: arg(z.string().min(1), { description: "Workspace region for preview workspace creation (e.g. us-west). Required." }),
+		"require-preview-label": arg(z.boolean().default(false), { description: "Deploy preview only for PRs labeled `tailor:preview` instead of all PRs." }),
+		environment: arg(z.string().min(1).optional(), { description: "GitHub Environment for the preview jobs (defaults to the workspace name)" }),
+		dir: arg(z.string().min(1).default("."), {
+			alias: "d",
+			description: "App directory (for monorepo setups)"
+		}),
+		force: arg(z.boolean().default(false), { description: "Discard hand edits / take over unmanaged files and regenerate" })
+	}).strict(),
+	run: async (args) => {
+		await setupTarget({
+			kind: "preview",
+			workspaceName: args.name,
+			branch: args.branch,
+			region: args.region,
+			requirePreviewLabel: args["require-preview-label"],
+			environment: args.environment,
+			dir: args.dir,
+			force: args.force,
+			outputDir: process.cwd()
+		});
+	}
+});
+const setupCommand = defineCommand({
+	name: "setup",
+	description: "Generate CI deploy workflows for your project. (beta)",
+	subCommands: {
+		branch: branchCommand,
+		tag: tagCommand,
+		preview: previewCommand,
+		action: actionCommand,
+		coordinate: coordinateCommand,
+		check: checkCommand
+	}
+});
 
 //#endregion
 //#region src/cli/shared/skills-installer.ts
@@ -5391,7 +5986,7 @@ async function fetchRemoteTypes(client, workspaceId, namespace) {
 async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	const { config, plugins } = loaded;
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-a_ApFuPh.mjs");
+	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-BhRnH42h.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -5403,7 +5998,7 @@ async function assertMigrationsReproduceLocalTypes(loaded, target) {
 		await service.processNamespacePlugins();
 	}
 	const pluginExecutorFiles = generatePluginFilesIfNeeded(pluginManager, application.tailorDBServices, config.path);
-	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-CRaa4Joe.mjs")).createExecutorService({ config: { files: [] } }) : void 0);
+	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-BXmdFwSH.mjs")).createExecutorService({ config: { files: [] } }) : void 0);
 	await executorService?.loadExecutors();
 	if (pluginExecutorFiles.length > 0) await executorService?.loadPluginExecutorFiles([...pluginExecutorFiles]);
 	const executorUsedTypes = /* @__PURE__ */ new Set();
@@ -5678,9 +6273,9 @@ const upgradeCommand = defineAppCommand({
 		})
 	}).strict(),
 	run: async (args) => {
-		const { initTelemetry } = await import("../telemetry-w92bvGdC.mjs");
+		const { initTelemetry } = await import("../telemetry-ClwW5ohF.mjs");
 		await initTelemetry();
-		const { upgrade } = await import("../service-DDWgZL_L2.mjs");
+		const { upgrade } = await import("../service-DBFZQloR.mjs");
 		await upgrade({
 			from: args.from,
 			dryRun: args["dry-run"],
@@ -6140,11 +6735,11 @@ runMain(mainCommand, {
 				if (isVerbose() && error.stack) logger.debug(`\nStack trace:\n${error.stack}`);
 			} else logger.error(`Unknown error: ${error}`);
 			if (!isCLIError(error) && (!(error instanceof Error) || error instanceof TypeError || error instanceof RangeError)) {
-				const { reportCrash } = await import("../crashreport-BwF8cHF0.mjs");
+				const { reportCrash } = await import("../crashreport-Dy4ZzSkd.mjs");
 				await reportCrash(error, "handledError");
 			}
 		}
-		const { shutdownTelemetry } = await import("../telemetry-w92bvGdC.mjs");
+		const { shutdownTelemetry } = await import("../telemetry-ClwW5ohF.mjs");
 		await shutdownTelemetry();
 	}
 });