@tailor-platform/sdk 2.0.0-next.2 → 2.0.0-next.4

package/dist/cli/index.mjs

@@ -1,28 +1,31 @@
 #!/usr/bin/env node
-import { A as loadAccessToken, At as FunctionExecution_Type, B as fetchAll, C as getDistDir, D as deleteUserTokens, E as loadConfig, F as removeLegacyUserAlias, G as initOAuth2Client, H as fetchPaged, I as resolveTokens, K as initOperatorClient, L as saveUserTokens, M as loadMachineUserName, N as loadWorkspaceId, O as fetchLatestToken, P as readPlatformConfig, R as writePlatformConfig, U as fetchPlatformMachineUserToken, W as fetchUserInfo, _ as composeFunctionTreeshakeOptions, dn as PATScope, g as platformBundleDefinePlugin, ht as CustomDomainStatus, i as resolveInlineSourcemap, in as AuthInvokerSchema, k as findConfigUserKey, l as INVOKER_EXPR, o as WorkflowJobSchema, s as ResolverSchema, t as defineApplication, v as createLogLevelTreeshakeOptions, w as hashContent$1, y as resolveBundleLogLevel, z as closeConnectionPool } from "../application-XuMWK4eq.mjs";
 import { t as assertDefined } from "../assert-DBxo8jPo.mjs";
-import { n as logger, r as styles } from "../logger-CxF-Ex5d.mjs";
-import { $ as updateCommand$2, $t as protoGqlPermission, A as listCommand$12, At as jobsCommand, Bn as toPageDirection, Bt as functionExecutionStatusToString, C as listCommand$13, Cn as ensureConfigId, Ct as webhookCommand, Dn as generateUserTypes, E as waitCommand, En as PluginManager, Et as listCommand$6, F as generateCommand$1, Fn as confirmationArgs, Ft as getCommand$6, G as updateCommand$3, Gt as executeScript, H as logBetaWarning, Ht as getCommand$1, I as generateMigrationScript, In as deploymentArgs, J as treeCommand, Jt as MIGRATION_LABEL_KEY, L as writeDbTypesFile, Ln as isVerbose, Lt as executionsCommand, Mn as defineAppCommand, N as truncateCommand, Nn as commonArgs, Nt as startCommand, O as resumeCommand, On as prompt, Pn as configArg, Qt as generateAllTypeManifestsFromSnapshot, R as getConfiguredEditorCommand, Rn as pagedLogArgs, Sn as getNamespacesWithMigrations, T as healthCommand, Tn as sdkNameLabelKey, V as showCommand, Vn as workspaceArgs, Vt as formatKeyValueTable, W as removeCommand$1, Wt as deploy, Xt as parseMigrationLabelNumber, Y as listCommand$11, Yt as handleOptionalToRequiredError, Z as getCommand$5, Zt as compareSnapshotWithRemote, _n as formatMigrationNumber, _t as generate, an as assertValidMigrationFiles, at as deleteCommand$3, b as createCommand$4, bn as formatMigrationDiff, bt as getCommand$2, c as listCommand$14, cn as createSnapshotFromLocalTypes, dn as getMigrationFilePath, dt as getCommand$3, f as restoreCommand, fn as getMigrationFiles, g as getCommand$7, gn as reconstructSnapshotFromMigrations, hn as loadDiff, ht as listCommand$8, i as updateCommand$4, jn as assertWritable, kn as apiCommand, ln as getLatestMigrationNumber, lt as listCommand$9, m as listCommand$15, mn as isValidMigrationNumber, mt as tokenCommand, nn as INITIAL_SCHEMA_NUMBER, o as removeCommand, on as compareLocalTypesWithSnapshot, r as queryCommand, rt as getCommand$4, st as createCommand$3, t as isNativeTypeScriptRuntime, tt as listCommand$10, u as inviteCommand, v as deleteCommand$4, vn as parseMigrationNumberArg, vt as listCommand$7, wn as resourceTrn, wt as triggerCommand, xn as hasChanges, z as openInConfiguredEditor, zn as paginationArgs } from "../runtime-CY4JvrDj.mjs";
-import { n as ExecutorSchema } from "../service-DjyqbCaJ.mjs";
+import { n as logger, r as styles } from "../logger-BEiZZ3qT.mjs";
+import { $ as fetchUserInfo, A as hasAnyUserTokenEntry, B as readPlatformConfig, D as loadConfig, Et as workspaceArgs, F as loadMachineUserName, G as writePlatformConfig, H as resolveConfigUser, I as loadPlatformClientConfig, J as fetchAll, K as closeConnectionPool, L as loadStoredUserTokens, M as loadAccessToken, N as loadConfigPath, O as deleteUserTokens, P as loadConsoleBaseUrl, Q as fetchPlatformMachineUserToken, R as loadWorkspaceId, T as hashContent$1, Tt as toPageDirection, U as resolveUserTokenKey, V as removeLegacyUserAlias, W as saveUserTokens, Y as fetchAllTolerant, Z as fetchPaged, _ as platformBundleDefinePlugin, a as resolveInlineSourcemap, at as initOperatorClient, b as resolveBundleLogLevel, bt as pagedLogArgs, c as WorkflowJobSchema, d as INVOKER_EXPR, dt as confirmationArgs, ft as deploymentArgs, gt as multiConfigArg, ht as isVerbose, it as initOAuth2Client, j as hasUserTokenEntry, k as fetchLatestToken, l as ResolverSchema, lt as commonArgs, nt as getOrNull, ot as isDefaultPlatform, q as defaultPlatformBaseUrl, rt as getPlatformBaseUrl, t as defineApplication, tt as getOAuth2ClientId, ut as configArg, v as composeFunctionTreeshakeOptions, w as getDistDir, wt as resolveMachineUserInputSource, xt as paginationArgs, y as createLogLevelTreeshakeOptions, z as platformConfigFromProfile } from "../application-BX13RArL.mjs";
+import { $t as compareSnapshotWithRemote, A as listCommand$13, An as apiCommand, C as listCommand$14, Cn as hasChanges, Dn as PluginManager, Dt as listCommand$7, E as waitCommand, En as sdkNameLabelKey, F as generateCommand$1, G as removeCommand$1, Gt as deploy, H as extractOwnedNamespaces, Ht as formatKeyValueTable, I as generateMigrationScript, It as getCommand$6, K as updateCommand$3, Kt as ensureConfigId, L as writeDbTypesFile, Mn as assertWritable, N as truncateCommand, Nn as defineAppCommand, O as resumeCommand, On as generateUserTypes, Pt as startCommand, Q as getCommand$5, Qt as parseMigrationLabelNumber, R as getConfiguredEditorCommand, Rt as executionsCommand, Sn as formatMigrationDiff, T as healthCommand, Tn as resourceTrn, Tt as triggerCommand, U as logBetaWarning, Ut as getCommand$1, V as showCommand, Vt as functionExecutionStatusToString, X as listCommand$12, Xt as MIGRATION_LABEL_KEY, Y as treeCommand, Zt as handleOptionalToRequiredError, _n as loadDiff, b as createCommand$4, bn as parseMigrationNumberArg, c as listCommand$15, cn as compareLocalTypesWithSnapshot, ct as createCommand$3, dn as getLatestMigrationNumber, en as generateAllTypeManifestsFromSnapshot, et as updateCommand$2, f as restoreCommand, ft as getCommand$3, g as getCommand$7, gn as isValidMigrationNumber, gt as listCommand$9, ht as tokenCommand$1, i as updateCommand$4, in as INITIAL_SCHEMA_NUMBER, it as getCommand$4, jt as jobsCommand, kn as prompt, m as listCommand$16, mn as getMigrationFiles, nt as listCommand$11, o as removeCommand, ot as deleteCommand$4, pn as getMigrationFilePath, qt as executeScript, r as queryCommand, sn as assertValidMigrationFiles, t as registerTsHook, tn as protoGqlPermission, u as inviteCommand, un as createSnapshotFromLocalTypes, ut as listCommand$10, v as deleteCommand$5, vn as reconstructSnapshotFromMigrations, vt as generate, wn as getNamespacesWithMigrations, wt as webhookCommand, xt as getCommand$2, yn as formatMigrationNumber, yt as listCommand$8, z as openInConfiguredEditor } from "../register-ts-hook-BM1caLT0.mjs";
+import { i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-ufH7sS8o.mjs";
 import { t as multiline } from "../multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "../package-json-8b0O9TlX.mjs";
-import { i as userAgent } from "../secret-file-VSVGy1V0.mjs";
-import { n as isCLIError } from "../errors-Dtf2WPaW.mjs";
-import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-DFq-vsU0.mjs";
+import { i as userAgent } from "../secret-file-aoNXJmKa.mjs";
+import { n as isCLIError } from "../errors-118wUDRr.mjs";
+import { B as FunctionExecution_Type, Ct as PATScope, T as CustomDomainStatus, gt as AuthInvokerSchema } from "../service_pb-B5w9rjPY.mjs";
+import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-Cg-pqRJV.mjs";
 import { t as isPluginGeneratedType } from "../type-source-DH_LH20p.mjs";
+import * as path from "pathe";
+import { dirname, resolve } from "pathe";
+import { resolvePackageJSON, resolveTSConfig } from "pkg-types";
 import { arg, defineCommand, runCommand, runMain } from "politty";
 import { withCompletionCommand } from "politty/completion";
+import { withSkillCommand } from "politty/skill";
 import { z } from "zod";
 import { create } from "@bufbuild/protobuf";
 import * as fs$1 from "node:fs";
+import { accessSync, constants, readdirSync } from "node:fs";
 import { timestampDate } from "@bufbuild/protobuf/wkt";
-import * as path from "pathe";
-import { dirname, resolve } from "pathe";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { generateCodeVerifier } from "@badgateway/oauth2-client";
 import { Code, ConnectError } from "@connectrpc/connect";
 import pLimit from "p-limit";
-import { resolvePackageJSON, resolveTSConfig } from "pkg-types";
 import * as crypto from "node:crypto";
 import { createHash } from "node:crypto";
 import * as http from "node:http";
@@ -30,6 +33,7 @@ import open from "open";
 import * as rolldown from "rolldown";
 import * as fsPromises from "node:fs/promises";
 import { glob } from "node:fs/promises";
+import * as os from "node:os";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { TraceMap, generatedPositionFor, originalPositionFor } from "@jridgewell/trace-mapping";
 import { spawn, spawnSync } from "node:child_process";
@@ -37,6 +41,26 @@ import { watch } from "chokidar";
 import * as fs from "fs";
 import { lookup } from "mime-types";
 
+//#region src/cli/commands/auth/token.ts
+const tokenCommand = defineAppCommand({
+	name: "token",
+	description: "Print a valid Tailor Platform access token to stdout, refreshing it first if expired.",
+	args: z.strictObject({ profile: workspaceArgs.profile }),
+	run: async ({ profile }) => {
+		const token = await loadAccessToken({ profile });
+		logger.out(token);
+	}
+});
+
+//#endregion
+//#region src/cli/commands/auth/index.ts
+const authCommand = defineCommand({
+	name: "auth",
+	description: "Authentication helpers for scripts and plugins.",
+	subCommands: { token: tokenCommand }
+});
+
+//#endregion
 //#region src/cli/commands/authconnection/args.ts
 /**
 * Arguments for identifying an auth connection
@@ -67,13 +91,13 @@ function randomState$1() {
 const authorizeAuthConnectionCommand = defineAppCommand({
 	name: "authorize",
 	description: "Authorize an auth connection via OAuth2 flow.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		...connectionNameArgs,
 		scopes: z.string().optional().default(defaultScopes).describe("OAuth2 scopes to request (comma-separated)"),
 		port: z.coerce.number().optional().default(defaultPort).describe("Local callback server port"),
 		"no-browser": z.boolean().optional().default(false).describe("Don't open browser automatically")
-	}).strict(),
+	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
@@ -147,13 +171,13 @@ const authorizeAuthConnectionCommand = defineAppCommand({
 				clearTimeout(timeout);
 				const code = err.code;
 				const portHint = code === "EADDRINUSE" || code === "EACCES" ? `Try a different port with --port, or authorize via the Console instead:` : `Authorize via the Console instead:`;
-				logger.warn(`Could not start the local callback server on port ${args.port}${code ? ` (${code})` : ""}.\n${portHint}\n  tailor-sdk authconnection open`);
+				logger.warn(`Could not start the local callback server on port ${args.port}${code ? ` (${code})` : ""}.\n${portHint}\n  tailor authconnection open`);
 				reject(err);
 			});
 			server.listen(args.port, async () => {
 				const authorizeUrl = authUrl.toString();
 				logger.info(args["no-browser"] ? `Open this URL in your browser to authorize:\n\n${authorizeUrl}\n` : `Opening browser for authorization:\n\n${authorizeUrl}\n`);
-				logger.info("If this flow doesn't complete, you can authorize via the Console instead:\n  tailor-sdk authconnection open");
+				logger.info("If this flow doesn't complete, you can authorize via the Console instead:\n  tailor authconnection open");
 				if (!args["no-browser"]) try {
 					await open(authorizeUrl);
 				} catch {
@@ -170,11 +194,11 @@ const authorizeAuthConnectionCommand = defineAppCommand({
 const deleteAuthConnectionCommand = defineAppCommand({
 	name: "delete",
 	description: "Delete an auth connection entirely.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		...connectionNameArgs,
 		...confirmationArgs
-	}).strict(),
+	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
@@ -219,10 +243,10 @@ function connectionInfo(connection) {
 const listAuthConnectionCommand = defineAppCommand({
 	name: "list",
 	description: "List all auth connections.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		...paginationArgs()
-	}).strict(),
+	}),
 	run: async (args) => {
 		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
 		const workspaceId = await loadWorkspaceId({
@@ -253,18 +277,21 @@ const listAuthConnectionCommand = defineAppCommand({
 
 //#endregion
 //#region src/cli/commands/authconnection/open.ts
-const consoleBaseUrl$1 = "https://console.tailor.tech";
 const openAuthConnectionCommand = defineAppCommand({
 	name: "open",
 	description: "Open the auth connections page in the Tailor Platform Console.",
-	args: z.object({ ...workspaceArgs }).strict(),
+	args: z.strictObject({ ...workspaceArgs }),
 	run: async (args) => {
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
 			profile: args.profile
 		});
 		const consolePath = `/workspaces/${workspaceId}/settings/connections`;
-		const consoleUrl = new URL(consolePath, consoleBaseUrl$1).toString();
+		const consoleBaseUrl = await loadConsoleBaseUrl({
+			profile: args.profile,
+			...args["workspace-id"] !== void 0 ? { allowMissingProfile: true } : {}
+		});
+		const consoleUrl = new URL(consolePath, consoleBaseUrl).toString();
 		const jsonOutput = logger.jsonMode;
 		logger.info("Opening auth connections page in Tailor Platform Console...");
 		let opened = true;
@@ -294,11 +321,11 @@ const revokeAuthConnectionCommand = defineAppCommand({
 	name: "revoke",
 	description: "Revoke an auth connection's tokens (keeps the connection; use 'delete' to remove it).",
 	notes: "Revoke invalidates the connection's active session and tokens but keeps the connection and its stored credentials, so it can be re-authorized later. Use `delete` to remove the connection entirely.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		...connectionNameArgs,
 		...confirmationArgs
-	}).strict(),
+	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
@@ -355,10 +382,10 @@ function formatCrashReportFiles(files, localDir) {
 		path: path.join(localDir, file)
 	}));
 }
-const listCommand$5 = defineAppCommand({
+const listCommand$6 = defineAppCommand({
 	name: "list",
 	description: "List local crash report files.",
-	args: z.object({ ...paginationArgs() }).strict(),
+	args: z.strictObject({ ...paginationArgs() }),
 	run: async (args) => {
 		const config = parseCrashReportConfig();
 		const jsonOutput = logger.jsonMode;
@@ -398,14 +425,14 @@ const listCommand$5 = defineAppCommand({
 const sendCommand = defineAppCommand({
 	name: "send",
 	description: "Submit a crash report to help improve the SDK.",
-	args: z.object({ file: arg(z.string(), {
+	args: z.strictObject({ file: arg(z.string(), {
 		description: "Path to the crash report file",
 		required: true,
 		completion: {
 			type: "file",
 			extensions: ["log"]
 		}
-	}) }).strict(),
+	}) }),
 	run: async (args) => {
 		let content;
 		try {
@@ -454,11 +481,11 @@ const crashReportCommand = defineCommand({
 	name: "crashreport",
 	description: "Manage crash reports.",
 	subCommands: {
-		list: listCommand$5,
+		list: listCommand$6,
 		send: sendCommand
 	},
 	async run() {
-		await runCommand(listCommand$5, []);
+		await runCommand(listCommand$6, []);
 	}
 });
 
@@ -467,8 +494,9 @@ const crashReportCommand = defineCommand({
 const deployCommand$1 = defineAppCommand({
 	name: "deploy",
 	description: "Deploy your application by applying the Tailor configuration.",
-	args: z.object({
-		...deploymentArgs,
+	args: z.strictObject({
+		...workspaceArgs,
+		...multiConfigArg,
 		...confirmationArgs,
 		"dry-run": arg(z.boolean().optional(), {
 			alias: "d",
@@ -478,10 +506,10 @@ const deployCommand$1 = defineAppCommand({
 		"no-validate": arg(z.boolean().optional(), { description: "Skip client-side validation against platform resource constraints" }),
 		"no-cache": arg(z.boolean().optional(), { description: "Disable bundle caching for this run" }),
 		"clean-cache": arg(z.boolean().optional(), { description: "Clean the bundle cache before building" })
-	}).strict(),
+	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
-		const { initTelemetry } = await import("../telemetry-ClwW5ohF.mjs");
+		const { initTelemetry } = await import("../telemetry-CkbkeJxl.mjs");
 		await initTelemetry();
 		await deploy({
 			workspaceId: args["workspace-id"],
@@ -505,12 +533,12 @@ const executorCommand = defineCommand({
 	subCommands: {
 		trigger: triggerCommand,
 		jobs: jobsCommand,
-		list: listCommand$6,
+		list: listCommand$7,
 		get: getCommand$1,
 		webhook: webhookCommand
 	},
 	async run() {
-		await runCommand(listCommand$6, []);
+		await runCommand(listCommand$7, []);
 	}
 });
 
@@ -1020,14 +1048,14 @@ Stack traces are mapped only when the execution includes a content hash for the
 			desc: "Get execution details as JSON"
 		}
 	],
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		...pagedLogArgs,
 		"execution-id": arg(z.string().optional(), {
 			positional: true,
 			description: "Execution ID (if provided, shows details with logs)"
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
 		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
 		const workspaceId = await loadWorkspaceId({
@@ -1245,7 +1273,7 @@ async function detectFunctionType(options) {
 		const rawInput = module.default.input;
 		let inputSchema;
 		if (rawInput) {
-			const { t } = await import("../types-74etvaxy.mjs");
+			const { t } = await import("../types-C-lQ4se3.mjs");
 			inputSchema = t.object(rawInput);
 		}
 		return {
@@ -1255,7 +1283,7 @@ async function detectFunctionType(options) {
 			inputSchema
 		};
 	}
-	const executorResult = ExecutorSchema.safeParse(module.default);
+	const executorResult = ExecutorSchema.safeParse(stripExecutorTriggerArgs(module.default));
 	if (executorResult.success) {
 		const { operation } = executorResult.data;
 		if (operation.kind === "function" || operation.kind === "jobFunction") return {
@@ -1337,7 +1365,7 @@ function deriveNameFromPath(filePath) {
 //#endregion
 //#region src/cli/commands/function/test-run.ts
 /**
-* `tailor-sdk function test-run` command
+* `tailor function test-run` command
 *
 * Bundles and executes a function on the Tailor Platform server
 * without deploying (applying) the application.
@@ -1397,6 +1425,7 @@ When a \`.js\` file is provided, detection and bundling are skipped and the file
 		const authNamespace = resolveAuthNamespace(config.auth);
 		const machineUserName = await resolveMachineUserName({
 			cliMachineUser: args["machine-user"],
+			cliMachineUserSource: resolveMachineUserInputSource(args["machine-user"]),
 			profile: args.profile,
 			authConfig: config.auth
 		});
@@ -1517,9 +1546,10 @@ function resolveAuthNamespace(authConfig) {
 * @returns Resolved machine user name
 */
 async function resolveMachineUserName(options) {
-	const { cliMachineUser, profile, authConfig } = options;
+	const { cliMachineUser, cliMachineUserSource, profile, authConfig } = options;
 	const resolved = await loadMachineUserName({
 		machineUser: cliMachineUser,
+		machineUserSource: cliMachineUserSource,
 		profile
 	});
 	if (resolved) return resolved;
@@ -1530,7 +1560,7 @@ async function resolveMachineUserName(options) {
 			if (keys.length > 0) return assertDefined(keys[0], "machine user key missing");
 		}
 	}
-	throw new Error("Machine user is required. Provide --machine-user, set TAILOR_PLATFORM_MACHINE_USER_NAME, set a profile default with 'tailor-sdk profile update <profile> --machine-user <name>', or ensure tailor.config.ts has machine users configured.");
+	throw new Error("Machine user is required. Provide --machine-user, set TAILOR_PLATFORM_MACHINE_USER_NAME, set a profile default with 'tailor profile update <profile> --machine-user <name>', or ensure tailor.config.ts has machine users configured.");
 }
 /**
 * Resolve full machine user info: name, id (from API), and attributes (from config).
@@ -1573,12 +1603,12 @@ const functionCommand = defineCommand({
 	description: "Manage functions",
 	subCommands: {
 		get: getCommand$2,
-		list: listCommand$7,
+		list: listCommand$8,
 		logs: logsCommand,
 		"test-run": testRunCommand
 	},
 	async run() {
-		await runCommand(listCommand$7, []);
+		await runCommand(listCommand$8, []);
 	}
 });
 
@@ -1587,7 +1617,7 @@ const functionCommand = defineCommand({
 const generateCommand = defineAppCommand({
 	name: "generate",
 	description: "Generate files using Tailor configuration.",
-	args: z.object({
+	args: z.strictObject({
 		config: arg(z.string().default("tailor.config.ts"), {
 			alias: "c",
 			description: "Path to SDK config file"
@@ -1596,9 +1626,9 @@ const generateCommand = defineAppCommand({
 			alias: "W",
 			description: "Watch for type/resolver changes and regenerate"
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
-		const { initTelemetry } = await import("../telemetry-ClwW5ohF.mjs");
+		const { initTelemetry } = await import("../telemetry-CkbkeJxl.mjs");
 		await initTelemetry();
 		await generate({
 			configPath: args.config,
@@ -1625,7 +1655,7 @@ const detectPackageManager$1 = () => {
 const initCommand = defineAppCommand({
 	name: "init",
 	description: "Initialize a new project using create-sdk.",
-	args: z.object({
+	args: z.strictObject({
 		name: arg(z.string().optional(), {
 			positional: true,
 			description: "Project name"
@@ -1634,7 +1664,7 @@ const initCommand = defineAppCommand({
 			alias: "t",
 			description: "Template name"
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
 		const packageJson = await readPackageJson();
 		const version = packageJson.version && packageJson.version !== "0.0.0" ? packageJson.version : "latest";
@@ -1662,8 +1692,15 @@ const redirectUri = `http://localhost:${redirectPort}/callback`;
 function randomState() {
 	return crypto.randomBytes(32).toString("base64url");
 }
-const startAuthServer = async () => {
-	const client = initOAuth2Client();
+function assertProfileLoginUser(args, authenticatedUser, authenticatedSubject) {
+	if (args.profile && args.profileUser && authenticatedUser !== args.profileUser && authenticatedSubject !== args.profileUser) throw new Error(`Profile "${args.profile}" is configured for "${args.profileUser}", but login authenticated "${authenticatedUser}".`);
+}
+function shouldUpdateCurrentUser(profile, platformConfig) {
+	if (!profile) return true;
+	return isDefaultPlatform(platformConfig);
+}
+const startAuthServer = async (args = {}) => {
+	const client = initOAuth2Client(args.platformConfig);
 	const state = randomState();
 	const codeVerifier = await generateCodeVerifier();
 	return new Promise((resolve, reject) => {
@@ -1675,14 +1712,18 @@ const startAuthServer = async () => {
 					state,
 					codeVerifier
 				});
-				const userInfo = await fetchUserInfo(tokens.accessToken);
+				const userInfo = await fetchUserInfo(tokens.accessToken, args.platformConfig);
+				assertProfileLoginUser(args, userInfo.email, userInfo.sub);
 				const pfConfig = await readPlatformConfig();
 				await saveUserTokens(pfConfig, userInfo.sub, {
 					accessToken: tokens.accessToken,
 					refreshToken: tokens.refreshToken ?? void 0
-				}, new Date(assertDefined(tokens.expiresAt, "token response missing expiresAt")).toISOString(), { email: userInfo.email });
-				await removeLegacyUserAlias(pfConfig, userInfo.email, userInfo.sub);
-				pfConfig.current_user = userInfo.sub;
+				}, new Date(assertDefined(tokens.expiresAt, "token response missing expiresAt")).toISOString(), {
+					platformConfig: args.platformConfig,
+					email: userInfo.email
+				});
+				if (args.updateCurrentUser ?? true) pfConfig.current_user = userInfo.sub;
+				await removeLegacyUserAlias(pfConfig, userInfo.email, userInfo.sub, args.platformConfig);
 				writePlatformConfig(pfConfig);
 				res.writeHead(200, { "Content-Type": "application/json" });
 				res.end(JSON.stringify({
@@ -1724,17 +1765,22 @@ const startAuthServer = async () => {
 	});
 };
 async function loginAsMachineUser(args) {
+	assertProfileLoginUser(args, args.clientId);
 	const clientSecret = args.clientSecret ?? await prompt.password({ message: "Client secret" });
-	const tokens = await fetchPlatformMachineUserToken(args.clientId, clientSecret);
+	const tokens = await fetchPlatformMachineUserToken(args.clientId, clientSecret, args.platformConfig);
 	const pfConfig = await readPlatformConfig();
-	await saveUserTokens(pfConfig, args.clientId, { accessToken: tokens.accessToken }, new Date(assertDefined(tokens.expiresAt, "token response missing expiresAt")).toISOString());
-	pfConfig.current_user = args.clientId;
+	await saveUserTokens(pfConfig, args.clientId, { accessToken: tokens.accessToken }, new Date(assertDefined(tokens.expiresAt, "token response missing expiresAt")).toISOString(), { platformConfig: args.platformConfig });
+	if (args.updateCurrentUser ?? true) pfConfig.current_user = args.clientId;
 	writePlatformConfig(pfConfig);
 }
 const loginCommand = defineAppCommand({
 	name: "login",
 	description: "Login to Tailor Platform.",
-	args: z.xor([z.object({}).strict().describe("User Login"), z.object({
+	args: z.xor([z.strictObject({ profile: arg(z.string().optional(), {
+		alias: "p",
+		description: "Workspace profile whose platform settings should be used for login.",
+		env: "TAILOR_PLATFORM_PROFILE"
+	}) }).describe("User Login"), z.strictObject({
 		"machine-user": arg(z.literal(true), {
 			description: "Login as a platform machine user.",
 			required: true
@@ -1747,14 +1793,37 @@ const loginCommand = defineAppCommand({
 		"client-secret": arg(z.string().optional(), {
 			description: "Client secret",
 			env: "TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET"
+		}),
+		profile: arg(z.string().optional(), {
+			alias: "p",
+			description: "Workspace profile whose platform settings should be used for login.",
+			env: "TAILOR_PLATFORM_PROFILE"
 		})
-	}).strict().describe("Machine User Login")]),
+	}).describe("Machine User Login")]),
 	run: async (args) => {
+		let platformConfig;
+		let profileUser;
+		if ("profile" in args && args.profile) {
+			const profileEntry = (await readPlatformConfig()).profiles[args.profile];
+			if (!profileEntry) throw new Error(`Profile "${args.profile}" not found`);
+			platformConfig = platformConfigFromProfile(profileEntry);
+			profileUser = profileEntry.user;
+		}
+		const updateCurrentUser = shouldUpdateCurrentUser(args.profile, platformConfig);
 		if ("machine-user" in args) await loginAsMachineUser({
 			clientId: args.clientId,
-			clientSecret: args.clientSecret
+			clientSecret: args.clientSecret,
+			profile: args.profile,
+			profileUser,
+			platformConfig,
+			updateCurrentUser
+		});
+		else await startAuthServer({
+			profile: args.profile,
+			profileUser,
+			platformConfig,
+			updateCurrentUser
 		});
-		else await startAuthServer();
 		logger.success("Successfully logged in to Tailor Platform.");
 		await closeConnectionPool();
 	}
@@ -1765,30 +1834,53 @@ const loginCommand = defineAppCommand({
 const logoutCommand = defineAppCommand({
 	name: "logout",
 	description: "Logout from Tailor Platform.",
-	args: z.object({}).strict(),
-	run: async () => {
+	args: z.strictObject({ profile: arg(z.string().optional(), {
+		alias: "p",
+		description: "Workspace profile whose platform settings should be used for logout.",
+		env: "TAILOR_PLATFORM_PROFILE"
+	}) }),
+	run: async (args) => {
+		const profile = args.profile || process.env.TAILOR_PLATFORM_PROFILE;
 		const pfConfig = await readPlatformConfig();
-		const currentUser = pfConfig.current_user;
-		const userEntry = currentUser ? pfConfig.users[currentUser] : void 0;
-		if (!userEntry || !currentUser) {
+		const profileEntry = profile ? pfConfig.profiles[profile] : void 0;
+		if (profile && !profileEntry) throw new Error(`Profile "${profile}" not found`);
+		const platformConfig = profileEntry ? platformConfigFromProfile(profileEntry) : void 0;
+		const currentUser = profileEntry ? profileEntry.user : pfConfig.current_user;
+		const deletesDefaultToken = isDefaultPlatform(platformConfig);
+		const lookupOptions = profile ? { allowLegacyUserKey: true } : void 0;
+		if (!currentUser) {
 			logger.info("You are not logged in.");
 			return;
 		}
+		const hasDefaultUserToken = () => hasUserTokenEntry(pfConfig, currentUser, { platformUrl: defaultPlatformBaseUrl });
+		const shouldClearCurrentUser = () => pfConfig.current_user === currentUser && (deletesDefaultToken ? !hasDefaultUserToken() : !hasAnyUserTokenEntry(pfConfig, currentUser) && !hasDefaultUserToken());
+		let storedTokens;
+		let tokenLoadFailed = false;
 		try {
-			const { accessToken, refreshToken } = await resolveTokens(userEntry, currentUser);
-			const client = initOAuth2Client();
-			const tokenTypeHint = refreshToken ? "refresh_token" : "access_token";
+			storedTokens = await loadStoredUserTokens(pfConfig, currentUser, platformConfig, lookupOptions);
+		} catch (error) {
+			tokenLoadFailed = true;
+			logger.warn(`Failed to revoke token: ${error instanceof Error ? error.message : error}`);
+		}
+		if (!storedTokens && !tokenLoadFailed) {
+			logger.info("You are not logged in.");
+			if (shouldClearCurrentUser()) pfConfig.current_user = null;
+			writePlatformConfig(pfConfig);
+			return;
+		}
+		if (storedTokens) try {
+			const client = initOAuth2Client(platformConfig);
+			const tokenTypeHint = storedTokens.refreshToken ? "refresh_token" : "access_token";
 			await client.revoke({
-				accessToken,
-				refreshToken: refreshToken ?? null,
-				expiresAt: Date.parse(userEntry.token_expires_at)
+				accessToken: storedTokens.accessToken,
+				refreshToken: storedTokens.refreshToken ?? null,
+				expiresAt: Date.parse(storedTokens.userEntry.token_expires_at)
 			}, tokenTypeHint);
 		} catch (error) {
 			logger.warn(`Failed to revoke token: ${error instanceof Error ? error.message : error}`);
 		}
-		await deleteUserTokens(pfConfig, currentUser);
-		delete pfConfig.users[currentUser];
-		pfConfig.current_user = null;
+		await deleteUserTokens(pfConfig, currentUser, platformConfig, lookupOptions);
+		if (shouldClearCurrentUser()) pfConfig.current_user = null;
 		writePlatformConfig(pfConfig);
 		logger.success("Successfully logged out from Tailor Platform.");
 	}
@@ -1800,11 +1892,11 @@ const machineuserCommand = defineCommand({
 	name: "machineuser",
 	description: "Manage machine users in your Tailor Platform application.",
 	subCommands: {
-		list: listCommand$8,
-		token: tokenCommand
+		list: listCommand$9,
+		token: tokenCommand$1
 	},
 	async run() {
-		await runCommand(listCommand$8, []);
+		await runCommand(listCommand$9, []);
 	}
 });
 
@@ -1814,21 +1906,20 @@ const oauth2clientCommand = defineCommand({
 	name: "oauth2client",
 	description: "Manage OAuth2 clients in your Tailor Platform application.",
 	subCommands: {
-		list: listCommand$9,
+		list: listCommand$10,
 		get: getCommand$3
 	},
 	async run() {
-		await runCommand(listCommand$9, []);
+		await runCommand(listCommand$10, []);
 	}
 });
 
 //#endregion
 //#region src/cli/commands/open.ts
-const consoleBaseUrl = "https://console.tailor.tech";
 const openCommand = defineAppCommand({
 	name: "open",
 	description: "Open Tailor Platform Console.",
-	args: z.object({ ...deploymentArgs }).strict(),
+	args: z.strictObject({ ...deploymentArgs }),
 	run: async (args) => {
 		const workspaceId = await loadWorkspaceId({
 			workspaceId: args["workspace-id"],
@@ -1837,6 +1928,10 @@ const openCommand = defineAppCommand({
 		const { config } = await loadConfig(args.config);
 		const applicationName = config.name;
 		const consolePath = `/workspaces/${workspaceId}/applications/${encodeURIComponent(applicationName)}/overview`;
+		const consoleBaseUrl = await loadConsoleBaseUrl({
+			profile: args.profile,
+			...args["workspace-id"] !== void 0 ? { allowMissingProfile: true } : {}
+		});
 		const consoleUrl = new URL(consolePath, consoleBaseUrl).toString();
 		const jsonOutput = logger.jsonMode;
 		logger.info("Opening Tailor Platform Console...");
@@ -1870,9 +1965,9 @@ const folderCommand = defineCommand({
 	description: "Manage organization folders.",
 	subCommands: {
 		create: createCommand$3,
-		delete: deleteCommand$3,
+		delete: deleteCommand$4,
 		get: getCommand$4,
-		list: listCommand$10,
+		list: listCommand$11,
 		update: updateCommand$2
 	}
 });
@@ -1885,12 +1980,399 @@ const organizationCommand = defineCommand({
 	subCommands: {
 		folder: folderCommand,
 		get: getCommand$5,
-		list: listCommand$11,
+		list: listCommand$12,
 		tree: treeCommand,
 		update: updateCommand$3
 	},
 	async run() {
-		await runCommand(listCommand$11, []);
+		await runCommand(listCommand$12, []);
+	}
+});
+
+//#endregion
+//#region src/cli/shared/builtin-commands.ts
+/**
+* Top-level builtin command names. A plugin named the same as one of these is
+* shadowed by the builtin and can never be dispatched.
+*
+* This list is the single source of truth used by `plugin list` to flag
+* shadowed plugins without importing the (cyclic) command tree. It is kept in
+* sync with `main-command.ts` by a drift test in `options.test.ts`.
+*/
+const BUILTIN_COMMAND_NAMES = [
+	"api",
+	"auth",
+	"authconnection",
+	"crashreport",
+	"deploy",
+	"executor",
+	"function",
+	"generate",
+	"init",
+	"login",
+	"logout",
+	"machineuser",
+	"oauth2client",
+	"open",
+	"organization",
+	"plugin",
+	"profile",
+	"query",
+	"remove",
+	"secret",
+	"setup",
+	"show",
+	"skills",
+	"staticwebsite",
+	"tailordb",
+	"upgrade",
+	"user",
+	"workflow",
+	"workspace"
+];
+
+//#endregion
+//#region src/cli/shared/plugin.ts
+/** PATH entry separator (`;` on Windows, `:` elsewhere). */
+const pathDelimiter = process.platform === "win32" ? ";" : ":";
+/**
+* Yield `start` and each ancestor directory up to the filesystem root.
+* @param start - Directory to start from
+* @yields Each ancestor directory, starting with `start`
+*/
+function* ancestorDirs(start) {
+	let dir = path.resolve(start);
+	let parent = path.dirname(dir);
+	while (parent !== dir) {
+		yield dir;
+		dir = parent;
+		parent = path.dirname(dir);
+	}
+	yield dir;
+}
+/** Fallback executable extensions when `PATHEXT` is unset (Windows). */
+const DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD;.PS1";
+/**
+* Lowercased executable extensions from `PATHEXT` (Windows).
+* @returns Recognized executable extensions (e.g. `.exe`, `.cmd`)
+*/
+function windowsExecutableExts() {
+	return (process.env.PATHEXT ?? DEFAULT_PATHEXT).split(";").map((e) => e.trim().toLowerCase()).filter(Boolean);
+}
+/**
+* Check whether a path exists and is runnable: X_OK on POSIX; on Windows, the
+* file must exist and either be extension-less (shebang script) or carry a
+* `PATHEXT` extension, so plain data files are not mistaken for plugins.
+* @param filePath - Path to check
+* @returns Whether the path is an executable file
+*/
+function isExecutable(filePath) {
+	try {
+		accessSync(filePath, process.platform === "win32" ? constants.F_OK : constants.X_OK);
+	} catch {
+		return false;
+	}
+	if (process.platform === "win32") {
+		const ext = path.extname(filePath).toLowerCase();
+		return ext === "" || windowsExecutableExts().includes(ext);
+	}
+	return true;
+}
+/**
+* Candidate file names for a plugin binary, accounting for Windows extensions.
+* @param binName - Base binary name (e.g. `tailor-foo`)
+* @returns Ordered candidate file names
+*/
+function binaryCandidates(binName) {
+	if (process.platform !== "win32") return [binName];
+	return [binName, ...windowsExecutableExts().map((ext) => `${binName}${ext}`)];
+}
+/**
+* Directories on the user's PATH.
+* @returns PATH entries
+*/
+function pathDirs() {
+	return (process.env.PATH ?? "").split(pathDelimiter).filter(Boolean);
+}
+/**
+* Nearest `node_modules/.bin` directories, walking up from the current working
+* directory. Project-local bins take precedence over those higher in the tree.
+* @returns Ordered `node_modules/.bin` directories
+*/
+function nodeModulesBinDirs() {
+	const dirs = [];
+	for (const dir of ancestorDirs(process.cwd())) dirs.push(path.join(dir, "node_modules", ".bin"));
+	return dirs;
+}
+/**
+* Find the first existing executable for the given base name across a set of
+* directories.
+* @param dirs - Directories to search
+* @param binName - Base binary name
+* @returns Absolute path, or undefined when not found
+*/
+function findExecutableIn(dirs, binName) {
+	const candidates = binaryCandidates(binName);
+	for (const dir of dirs) for (const candidate of candidates) {
+		const full = path.join(dir, candidate);
+		if (isExecutable(full)) return full;
+	}
+}
+/**
+* Resolve a plugin executable by name.
+* Search order: project-local `node_modules/.bin` (nearest first), then PATH.
+* @param name - Plugin name (without the `<cli>-` prefix)
+* @param cliName - The host CLI name (e.g. `tailor`)
+* @returns The discovered plugin, or null when not found
+*/
+function resolvePlugin(name, cliName) {
+	if (name.includes("/") || name.includes("\\") || name.includes("\0")) return null;
+	const binName = `${cliName}-${name}`;
+	const fromNodeModules = findExecutableIn(nodeModulesBinDirs(), binName);
+	if (fromNodeModules) return {
+		name,
+		path: fromNodeModules,
+		source: "node_modules"
+	};
+	const fromPath = findExecutableIn(pathDirs(), binName);
+	if (fromPath) return {
+		name,
+		path: fromPath,
+		source: "path"
+	};
+	return null;
+}
+/**
+* Strip a known binary extension from a file name (Windows).
+* @param fileName - File name
+* @returns File name without a recognized executable extension
+*/
+function stripBinExt(fileName) {
+	if (process.platform !== "win32") return fileName;
+	const ext = path.extname(fileName);
+	return ext ? fileName.slice(0, -ext.length) : fileName;
+}
+/**
+* Discover all plugins reachable from `node_modules/.bin` and PATH.
+* Earlier entries win on name collisions (project-local over PATH).
+* @param cliName - The host CLI name (e.g. `tailor`)
+* @returns Discovered plugins, deduped by name
+*/
+function listPlugins(cliName) {
+	const prefix = `${cliName}-`;
+	const seen = /* @__PURE__ */ new Map();
+	const scan = (dirs, source) => {
+		for (const dir of dirs) {
+			let entries;
+			try {
+				entries = readdirSync(dir);
+			} catch {
+				continue;
+			}
+			for (const entry of entries) {
+				const base = stripBinExt(entry);
+				if (!base.startsWith(prefix) || base.length === prefix.length) continue;
+				const name = base.slice(prefix.length);
+				if (seen.has(name)) continue;
+				const full = path.join(dir, entry);
+				if (!isExecutable(full)) continue;
+				seen.set(name, {
+					name,
+					path: full,
+					source
+				});
+			}
+		}
+	};
+	scan(nodeModulesBinDirs(), "node_modules");
+	scan(pathDirs(), "path");
+	return [...seen.values()];
+}
+/**
+* Resolve the active user identifier, preferring the stored email over the
+* internal user key.
+* @param profile - Active profile name, if any
+* @returns The resolved user (email when known), or undefined when not logged in
+*/
+async function resolveActiveUser(profile) {
+	const config = await readPlatformConfig();
+	const user = profile ? config.profiles[profile]?.user : config.current_user;
+	if (!user) return void 0;
+	return config.users[user]?.email ?? user;
+}
+/**
+* Build the environment variables injected into a dispatched plugin.
+* Workspace, user, and token are resolved best-effort: whichever the current
+* context can provide is injected, and the rest are omitted so auth-free
+* plugins still run.
+* @param options - Plugin context options
+* @returns Environment variables to merge into the child process env
+*/
+async function buildPluginEnv(options = {}) {
+	const { profile } = options;
+	let platformConfig;
+	try {
+		platformConfig = await loadPlatformClientConfig({
+			profile,
+			allowMissingProfile: true
+		});
+	} catch {}
+	const env = {
+		TAILOR_PLATFORM_URL: getPlatformBaseUrl(platformConfig),
+		TAILOR_PLATFORM_OAUTH2_CLIENT_ID: getOAuth2ClientId(platformConfig)
+	};
+	const binPath = process.argv[1];
+	if (binPath) env.TAILOR_BIN = binPath;
+	try {
+		const { version } = await readPackageJson();
+		if (version) env.TAILOR_VERSION = version;
+	} catch {}
+	const configPath = loadConfigPath();
+	if (configPath) env.TAILOR_CONFIG_PATH = configPath;
+	try {
+		env.TAILOR_PLATFORM_WORKSPACE_ID = await loadWorkspaceId({ profile });
+	} catch {}
+	try {
+		const user = await resolveActiveUser(profile);
+		if (user) env.TAILOR_PLATFORM_USER = user;
+	} catch {}
+	try {
+		const token = await loadAccessToken({ profile });
+		if (token) env.TAILOR_PLATFORM_TOKEN = token;
+	} catch {}
+	return env;
+}
+/**
+* Map an exit signal to a conventional exit code (128 + signal number).
+* @param signal - Signal name
+* @returns Exit code
+*/
+function signalToExitCode(signal) {
+	const num = os.constants.signals[signal];
+	return typeof num === "number" ? 128 + num : 1;
+}
+/**
+* Build the command + args for spawning a plugin, handling Windows shebang
+* scripts via `sh` (following the `gh` extension dispatcher).
+* @param pluginPath - Resolved plugin executable path
+* @param args - Args to forward to the plugin
+* @returns Spawn command, args, and whether a shell is required
+*/
+function buildSpawnTarget(pluginPath, args) {
+	if (process.platform !== "win32") return {
+		command: pluginPath,
+		args: [...args],
+		shell: false
+	};
+	const ext = path.extname(pluginPath).toLowerCase();
+	if (ext === ".exe" || ext === ".com") return {
+		command: pluginPath,
+		args: [...args],
+		shell: false
+	};
+	if (ext === ".cmd" || ext === ".bat") return {
+		command: pluginPath,
+		args: [...args],
+		shell: true
+	};
+	if (ext === ".ps1") return {
+		command: findExecutableIn(pathDirs(), "pwsh") ?? findExecutableIn(pathDirs(), "powershell") ?? "powershell",
+		args: [
+			"-NoProfile",
+			"-ExecutionPolicy",
+			"Bypass",
+			"-File",
+			pluginPath,
+			...args
+		],
+		shell: false
+	};
+	return {
+		command: findExecutableIn(pathDirs(), "sh") ?? "sh",
+		args: [
+			"-c",
+			"command \"$@\"",
+			"--",
+			pluginPath,
+			...args
+		],
+		shell: false
+	};
+}
+/**
+* Resolve and execute a plugin, forwarding stdio and propagating its exit code.
+* @param params - Dispatch parameters
+* @param params.name - Plugin name (without the `<cli>-` prefix)
+* @param params.args - Args to forward to the plugin
+* @param params.cliName - The host CLI name
+* @param params.profile - Active profile name, if any
+* @returns The plugin's exit code, or undefined when no matching plugin exists
+*/
+async function dispatchPlugin(params) {
+	const slug = [...params.commandPath ?? [], params.name].join("-");
+	const plugin = resolvePlugin(slug, params.cliName);
+	if (!plugin) return;
+	const env = {
+		...process.env,
+		...await buildPluginEnv({ profile: params.profile })
+	};
+	const { command, args, shell } = buildSpawnTarget(plugin.path, params.args);
+	return await new Promise((resolve) => {
+		const child = spawn(command, args, {
+			stdio: "inherit",
+			env,
+			shell
+		});
+		child.on("error", (error) => {
+			logger.error(`Failed to run plugin "${params.cliName}-${slug}": ${error.message}`);
+			resolve(1);
+		});
+		child.on("close", (code, signal) => {
+			if (signal) resolve(signalToExitCode(signal));
+			else resolve(code ?? 0);
+		});
+	});
+}
+
+//#endregion
+//#region src/cli/commands/plugin/list.ts
+const listCommand$5 = defineAppCommand({
+	name: "list",
+	description: "List discovered plugins (executables named `<cli>-<name>` on PATH or node_modules/.bin).",
+	args: z.strictObject({}),
+	run: async () => {
+		const pkg = await readPackageJson();
+		const cliName = Object.keys(pkg.bin ?? {})[0] || "tailor";
+		const builtins = new Set(BUILTIN_COMMAND_NAMES);
+		const plugins = listPlugins(cliName);
+		if (plugins.length === 0) {
+			logger.info(multiline`
+        No plugins found.
+        Install an executable named "${cliName}-<name>" on your PATH or in node_modules/.bin,
+        then run it with "${cliName} <name>".
+      `);
+			if (logger.jsonMode) logger.out([]);
+			return;
+		}
+		const items = plugins.map((plugin) => ({
+			name: plugin.name,
+			source: plugin.source,
+			path: plugin.path,
+			shadowed: builtins.has(plugin.name)
+		}));
+		logger.out(items);
+		for (const item of items) if (item.shadowed) logger.warn(`Plugin "${cliName}-${item.name}" is shadowed by the builtin "${cliName} ${item.name}" command and will not be dispatched.`);
+	}
+});
+
+//#endregion
+//#region src/cli/commands/plugin/index.ts
+const pluginCommand = defineCommand({
+	name: "plugin",
+	description: "Manage and inspect CLI plugins (beta).",
+	subCommands: { list: listCommand$5 },
+	async run() {
+		await runCommand(listCommand$5, []);
 	}
 });
 
@@ -1899,7 +2381,7 @@ const organizationCommand = defineCommand({
 const createCommand$2 = defineAppCommand({
 	name: "create",
 	description: "Create a new profile.",
-	args: z.object({
+	args: z.strictObject({
 		name: arg(z.string(), {
 			positional: true,
 			description: "Profile name"
@@ -1917,14 +2399,32 @@ const createCommand$2 = defineAppCommand({
 			alias: "m",
 			description: "Default machine user name for application-data commands (query, workflow start, function test-run, machineuser token)."
 		}),
-		"machine-user-override": arg(z.enum(["allow", "deny"]).optional(), { description: "Whether the command line or TAILOR_PLATFORM_MACHINE_USER_NAME may override the profile's machine user. 'deny' requires --machine-user." })
-	}).strict(),
+		"machine-user-override": arg(z.enum(["allow", "deny"]).optional(), { description: "Whether the command line or TAILOR_PLATFORM_MACHINE_USER_NAME may override the profile's machine user. 'deny' requires --machine-user." }),
+		"platform-url": arg(z.url().optional(), {
+			description: "Platform API base URL for this profile.",
+			env: "TAILOR_PLATFORM_URL"
+		}),
+		"oauth2-client-id": arg(z.string().optional(), {
+			description: "OAuth2 client ID for logging in to this profile's platform.",
+			env: "TAILOR_PLATFORM_OAUTH2_CLIENT_ID"
+		}),
+		"console-url": arg(z.url().optional(), {
+			description: "Console base URL for this profile.",
+			env: "TAILOR_PLATFORM_CONSOLE_URL"
+		})
+	}),
 	run: async (args) => {
 		if (args["machine-user-override"] === "deny" && !args["machine-user"]) throw new Error("--machine-user-override deny requires --machine-user.");
 		const config = await readPlatformConfig();
 		if (config.profiles[args.name]) throw new Error(`Profile "${args.name}" already exists.`);
-		const { accessToken: token, user: resolvedUser } = await fetchLatestToken(config, args.user);
-		const client = await initOperatorClient(token);
+		const platformConfigInput = {
+			...args["platform-url"] ? { platformUrl: args["platform-url"] } : {},
+			...args["oauth2-client-id"] ? { oauth2ClientId: args["oauth2-client-id"] } : {},
+			...args["console-url"] ? { consoleUrl: args["console-url"] } : {}
+		};
+		const platformConfig = Object.keys(platformConfigInput).length > 0 ? platformConfigInput : void 0;
+		const { accessToken: token, user: resolvedUser } = await fetchLatestToken(config, args.user, platformConfig);
+		const client = await initOperatorClient(token, platformConfig);
 		if (!(await fetchAll(async (pageToken, maxPageSize) => {
 			const { workspaces, nextPageToken } = await client.listWorkspaces({
 				pageToken,
@@ -1937,7 +2437,10 @@ const createCommand$2 = defineAppCommand({
 			workspace_id: args["workspace-id"],
 			...args.permission === "read" ? { readonly: true } : {},
 			...args["machine-user"] ? { machine_user: args["machine-user"] } : {},
-			...args["machine-user-override"] === "deny" ? { machine_user_override: "deny" } : {}
+			...args["machine-user-override"] === "deny" ? { machine_user_override: "deny" } : {},
+			...args["platform-url"] ? { platform_url: args["platform-url"] } : {},
+			...args["oauth2-client-id"] ? { oauth2_client_id: args["oauth2-client-id"] } : {},
+			...args["console-url"] ? { console_url: args["console-url"] } : {}
 		};
 		writePlatformConfig(config);
 		if (!args.json) logger.success(`Profile "${args.name}" created successfully.`);
@@ -1949,7 +2452,10 @@ const createCommand$2 = defineAppCommand({
 			...args["machine-user"] ? {
 				machineUser: args["machine-user"],
 				machineUserOverride: args["machine-user-override"] ?? "allow"
-			} : {}
+			} : {},
+			...args["platform-url"] ? { platformUrl: args["platform-url"] } : {},
+			...args["oauth2-client-id"] ? { oauth2ClientId: args["oauth2-client-id"] } : {},
+			...args["console-url"] ? { consoleUrl: args["console-url"] } : {}
 		};
 		logger.out(profileInfo);
 	}
@@ -1957,13 +2463,13 @@ const createCommand$2 = defineAppCommand({
 
 //#endregion
 //#region src/cli/commands/profile/delete.ts
-const deleteCommand$2 = defineAppCommand({
+const deleteCommand$3 = defineAppCommand({
 	name: "delete",
 	description: "Delete a profile.",
-	args: z.object({ name: arg(z.string(), {
+	args: z.strictObject({ name: arg(z.string(), {
 		positional: true,
 		description: "Profile name"
-	}) }).strict(),
+	}) }),
 	run: async (args) => {
 		const config = await readPlatformConfig();
 		if (!config.profiles[args.name]) throw new Error(`Profile "${args.name}" not found.`);
@@ -1978,7 +2484,7 @@ const deleteCommand$2 = defineAppCommand({
 const listCommand$4 = defineAppCommand({
 	name: "list",
 	description: "List all profiles.",
-	args: z.object({}).strict(),
+	args: z.strictObject({}),
 	run: async () => {
 		const config = await readPlatformConfig();
 		const jsonOutput = logger.jsonMode;
@@ -1986,7 +2492,7 @@ const listCommand$4 = defineAppCommand({
 		if (profiles.length === 0) {
 			logger.info(multiline`
         No profiles found.
-        Please create a profile first using 'tailor-sdk profile create' command.
+        Please create a profile first using 'tailor profile create' command.
       `);
 			if (jsonOutput) logger.out([]);
 			return;
@@ -2001,7 +2507,10 @@ const listCommand$4 = defineAppCommand({
 				...p.machine_user ? {
 					machineUser: p.machine_user,
 					machineUserOverride: p.machine_user_override ?? "allow"
-				} : {}
+				} : {},
+				...p.platform_url ? { platformUrl: p.platform_url } : {},
+				...p.oauth2_client_id ? { oauth2ClientId: p.oauth2_client_id } : {},
+				...p.console_url ? { consoleUrl: p.console_url } : {}
 			};
 		});
 		logger.out(profileInfos);
@@ -2013,7 +2522,7 @@ const listCommand$4 = defineAppCommand({
 const updateCommand$1 = defineAppCommand({
 	name: "update",
 	description: "Update profile properties.",
-	args: z.object({
+	args: z.strictObject({
 		name: arg(z.string(), {
 			positional: true,
 			description: "Profile name"
@@ -2031,13 +2540,16 @@ const updateCommand$1 = defineAppCommand({
 			alias: "m",
 			description: "Default machine user name for application-data commands (query, workflow start, function test-run, machineuser token). Pass an empty string to clear."
 		}),
-		"machine-user-override": arg(z.enum(["allow", "deny"]).optional(), { description: "Whether the command line or TAILOR_PLATFORM_MACHINE_USER_NAME may override the profile's machine user. 'deny' requires --machine-user; 'allow' lifts the restriction." })
-	}).strict(),
+		"machine-user-override": arg(z.enum(["allow", "deny"]).optional(), { description: "Whether the command line or TAILOR_PLATFORM_MACHINE_USER_NAME may override the profile's machine user. 'deny' requires --machine-user; 'allow' lifts the restriction." }),
+		"platform-url": arg(z.union([z.url(), z.literal("")]).optional(), { description: "Platform API base URL for this profile. Pass an empty string to clear." }),
+		"oauth2-client-id": arg(z.string().optional(), { description: "OAuth2 client ID for logging in to this profile's platform. Pass an empty string to clear." }),
+		"console-url": arg(z.union([z.url(), z.literal("")]).optional(), { description: "Console base URL for this profile. Pass an empty string to clear." })
+	}),
 	run: async (args) => {
 		const config = await readPlatformConfig();
 		const profile = config.profiles[args.name];
 		if (!profile) throw new Error(`Profile "${args.name}" not found.`);
-		if (!args.user && !args["workspace-id"] && args.permission === void 0 && args["machine-user"] === void 0 && args["machine-user-override"] === void 0) throw new Error("Please provide at least one property to update.");
+		if (!args.user && !args["workspace-id"] && args.permission === void 0 && args["machine-user"] === void 0 && args["machine-user-override"] === void 0 && args["platform-url"] === void 0 && args["oauth2-client-id"] === void 0 && args["console-url"] === void 0) throw new Error("Please provide at least one property to update.");
 		const oldUser = profile.user;
 		const newUser = args.user || oldUser;
 		const oldWorkspaceId = profile.workspace_id;
@@ -2045,14 +2557,24 @@ const updateCommand$1 = defineAppCommand({
 		let resolvedUser = newUser;
 		const finalMachineUser = args["machine-user"] === "" ? void 0 : args["machine-user"] ?? profile.machine_user;
 		const finalOverride = args["machine-user-override"] === "allow" ? void 0 : args["machine-user-override"] ?? profile.machine_user_override;
+		const finalPlatformUrl = args["platform-url"] === "" ? void 0 : args["platform-url"] ?? profile.platform_url;
+		const finalOAuth2ClientId = args["oauth2-client-id"] === "" ? void 0 : args["oauth2-client-id"] ?? profile.oauth2_client_id;
+		const finalConsoleUrl = args["console-url"] === "" ? void 0 : args["console-url"] ?? profile.console_url;
+		const finalPlatformConfigInput = {
+			...finalPlatformUrl ? { platformUrl: finalPlatformUrl } : {},
+			...finalOAuth2ClientId ? { oauth2ClientId: finalOAuth2ClientId } : {},
+			...finalConsoleUrl ? { consoleUrl: finalConsoleUrl } : {}
+		};
+		const finalPlatformConfig = Object.keys(finalPlatformConfigInput).length > 0 ? finalPlatformConfigInput : void 0;
+		const tokenLookupPlatformConfig = args["platform-url"] === "" ? platformConfigFromProfile(profile) : finalPlatformConfig;
 		if ((args["machine-user"] !== void 0 || args["machine-user-override"] !== void 0) && finalOverride === "deny" && !finalMachineUser) {
 			if (args["machine-user-override"] === "deny") throw new Error("--machine-user-override deny requires --machine-user.");
 			throw new Error(`Cannot clear the machine user while machine-user-override is "deny". Also pass --machine-user-override allow.`);
 		}
-		if (args.user !== void 0 || args["workspace-id"] !== void 0) {
-			const refreshed = await fetchLatestToken(config, newUser);
+		if (args.user !== void 0 || args["workspace-id"] !== void 0 || args["platform-url"] !== void 0) {
+			const refreshed = await fetchLatestToken(config, newUser, tokenLookupPlatformConfig);
 			resolvedUser = refreshed.user;
-			const client = await initOperatorClient(refreshed.accessToken);
+			const client = await initOperatorClient(refreshed.accessToken, finalPlatformConfig);
 			if (!(await fetchAll(async (pageToken, maxPageSize) => {
 				const { workspaces, nextPageToken } = await client.listWorkspaces({
 					pageToken,
@@ -2069,6 +2591,12 @@ const updateCommand$1 = defineAppCommand({
 		else profile.machine_user = args["machine-user"];
 		if (args["machine-user-override"] === "deny") profile.machine_user_override = "deny";
 		else if (args["machine-user-override"] === "allow") delete profile.machine_user_override;
+		if (args["platform-url"] !== void 0) if (args["platform-url"] === "") delete profile.platform_url;
+		else profile.platform_url = args["platform-url"];
+		if (args["oauth2-client-id"] !== void 0) if (args["oauth2-client-id"] === "") delete profile.oauth2_client_id;
+		else profile.oauth2_client_id = args["oauth2-client-id"];
+		if (args["console-url"] !== void 0) if (args["console-url"] === "") delete profile.console_url;
+		else profile.console_url = args["console-url"];
 		writePlatformConfig(config);
 		if (!args.json) logger.success(`Profile "${args.name}" updated successfully`);
 		const profileInfo = {
@@ -2079,7 +2607,10 @@ const updateCommand$1 = defineAppCommand({
 			...profile.machine_user ? {
 				machineUser: profile.machine_user,
 				machineUserOverride: profile.machine_user_override ?? "allow"
-			} : {}
+			} : {},
+			...profile.platform_url ? { platformUrl: profile.platform_url } : {},
+			...profile.oauth2_client_id ? { oauth2ClientId: profile.oauth2_client_id } : {},
+			...profile.console_url ? { consoleUrl: profile.console_url } : {}
 		};
 		logger.out(profileInfo);
 	}
@@ -2092,7 +2623,7 @@ const profileCommand = defineCommand({
 	description: "Manage workspace profiles (user + workspace combinations).",
 	subCommands: {
 		create: createCommand$2,
-		delete: deleteCommand$2,
+		delete: deleteCommand$3,
 		list: listCommand$4,
 		update: updateCommand$1
 	},
@@ -2187,11 +2718,11 @@ async function releaseVaultOwnership(params) {
 const createSecretCommand = defineAppCommand({
 	name: "create",
 	description: "Create a secret in a vault.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		...secretValueArgs,
 		...confirmationArgs
-	}).strict(),
+	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
@@ -2237,11 +2768,11 @@ const createSecretCommand = defineAppCommand({
 const deleteSecretCommand = defineAppCommand({
 	name: "delete",
 	description: "Delete a secret in a vault.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		...secretIdentifyArgs,
 		...confirmationArgs
-	}).strict(),
+	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
@@ -2313,11 +2844,11 @@ async function secretList(options) {
 const listSecretCommand = defineAppCommand({
 	name: "list",
 	description: "List all secrets in a vault.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		...vaultArgs,
 		...paginationArgs()
-	}).strict(),
+	}),
 	run: async (args) => {
 		try {
 			const secrets = await secretList({
@@ -2340,11 +2871,11 @@ const listSecretCommand = defineAppCommand({
 const updateSecretCommand = defineAppCommand({
 	name: "update",
 	description: "Update a secret in a vault.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		...secretValueArgs,
 		...confirmationArgs
-	}).strict(),
+	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
@@ -2394,10 +2925,10 @@ const nameArgs = { name: arg(z.string(), {
 const createCommand$1 = defineAppCommand({
 	name: "create",
 	description: "Create a new Secret Manager vault.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		...nameArgs
-	}).strict(),
+	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
@@ -2420,14 +2951,14 @@ const createCommand$1 = defineAppCommand({
 
 //#endregion
 //#region src/cli/commands/secret/vault/delete.ts
-const deleteCommand$1 = defineAppCommand({
+const deleteCommand$2 = defineAppCommand({
 	name: "delete",
 	description: "Delete a Secret Manager vault.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		...nameArgs,
 		...confirmationArgs
-	}).strict(),
+	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
 		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
@@ -2494,10 +3025,10 @@ async function vaultList(options) {
 const listCommand$3 = defineAppCommand({
 	name: "list",
 	description: "List all Secret Manager vaults in the workspace.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		...paginationArgs()
-	}).strict(),
+	}),
 	run: async (args) => {
 		const vaults = await vaultList({
 			workspaceId: args["workspace-id"],
@@ -2516,7 +3047,7 @@ const vaultCommand = defineCommand({
 	description: "Manage Secret Manager vaults.",
 	subCommands: {
 		create: createCommand$1,
-		delete: deleteCommand$1,
+		delete: deleteCommand$2,
 		list: listCommand$3
 	},
 	async run() {
@@ -2577,7 +3108,7 @@ function detectDefaultBranch(cwd, run = defaultGitRunner) {
 /** Current lock schema version. Bumped only on breaking lock-format changes. */
 const LOCK_VERSION = 1;
 /** Lock file path, relative to the repository root. */
-const LOCK_FILENAME = ".github/tailor-sdk.lock";
+const LOCK_FILENAME = ".github/tailor.lock";
 /**
 * Compute the lock content hash for a rendered workflow file.
 * @param content - File content to hash
@@ -2609,11 +3140,11 @@ function readLock(outputDir) {
 	try {
 		parsed = JSON.parse(fs$1.readFileSync(file, "utf-8"));
 	} catch (cause) {
-		throw new Error(`${LOCK_FILENAME} is not valid JSON. The lock file is machine-owned; restore it from git (git checkout -- .github/tailor-sdk.lock) and re-run setup.`, { cause });
+		throw new Error(`${LOCK_FILENAME} is not valid JSON. The lock file is machine-owned; restore it from git (git checkout -- .github/tailor.lock) and re-run setup.`, { cause });
 	}
-	if (typeof parsed.version !== "number") throw new Error(`${LOCK_FILENAME} has no valid 'version' field. The lock file is machine-owned; restore it from git (git checkout -- .github/tailor-sdk.lock) and re-run setup.`);
+	if (typeof parsed.version !== "number") throw new Error(`${LOCK_FILENAME} has no valid 'version' field. The lock file is machine-owned; restore it from git (git checkout -- .github/tailor.lock) and re-run setup.`);
 	if (parsed.version > 1) throw new Error(`${LOCK_FILENAME} was written by a newer SDK (lock version ${String(parsed.version)}). Update @tailor-platform/sdk to continue (e.g. pnpm update @tailor-platform/sdk).`);
-	if (!Array.isArray(parsed.targets)) throw new Error(`${LOCK_FILENAME} has no valid 'targets' array. The lock file is machine-owned; restore it from git (git checkout -- .github/tailor-sdk.lock) and re-run setup.`);
+	if (!Array.isArray(parsed.targets)) throw new Error(`${LOCK_FILENAME} has no valid 'targets' array. The lock file is machine-owned; restore it from git (git checkout -- .github/tailor.lock) and re-run setup.`);
 	return parsed;
 }
 /**
@@ -2638,22 +3169,34 @@ function findTarget(lock, kind, workspaceName) {
 	return lock?.targets.find((t) => t.kind === kind && t.workspaceName === workspaceName);
 }
 
+//#endregion
+//#region src/cli/commands/setup/action.yml
+var action_default = "# __HEADER__\nname: __WORKSPACE_NAME__\ndescription: >-\n  Deploy __WORKSPACE_NAME__ to Tailor Platform.\n  Checkout and dependency installation are expected to be handled by the caller.\n\ninputs:\n  workspace-id:\n    description: Tailor Platform workspace id\n    required: true\n  name:\n    description: Workspace name (used in Slack notifications)\n    required: true\n  working-directory:\n    description: App directory relative to the repository root\n    required: false\n    default: \".\"\n  config:\n    description: SDK config path, or comma-separated config paths for multi-config deploys\n    required: false\n    default: \"tailor.config.ts\"\n  deploy:\n    description: Whether to run the Tailor deploy step after build steps\n    required: false\n    default: \"true\"\n  build-site:\n    description: Whether to run the static website build slot when present\n    required: false\n    default: \"true\"\n  platform-client-id:\n    description: Machine-user client id\n    required: true\n  platform-client-secret:\n    description: Machine-user client secret\n    required: true\n  slack-token:\n    description: Slack bot token\n    required: false\n  slack-channel-id:\n    description: Slack channel id\n    required: false\n  user-mapping:\n    description: JSON string mapping GitHub usernames to Slack user IDs\n    required: false\n  package-manager:\n    description: Package manager used for dependency installation (pnpm, npm, yarn, bun)\n    required: false\n    default: pnpm\n\noutputs:\n  app-url:\n    description: Deployed application URL\n    value: ${{ steps.tailor-apply.outputs.app-url }}\n\nruns:\n  using: composite\n  steps:\n    # __STATIC_WEBSITE_BUILD_START__\n    - id: build-site\n      if: inputs.build-site == 'true'\n      shell: bash\n      run: |\n        # Replace with your static website build command.\n        # Example: pnpm --filter <package-name> run build:static\n        # Note: this run: command is user-editable. Custom build commands are preserved across\n        # reruns and are not treated as drift by setup check. Other edits to this file are flagged\n        # as drift and will be overwritten if you re-run setup action with --force.\n        true\n    # __STATIC_WEBSITE_BUILD_END__\n    - id: tailor-apply\n      if: inputs.deploy == 'true'\n      uses: tailor-platform/actions/deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n      env:\n        TAILOR_PLATFORM_SDK_CONFIG_PATH: ${{ inputs.config }}\n      with:\n        workspace-id: ${{ inputs.workspace-id }}\n        working-directory: ${{ inputs.working-directory }}\n        package-manager: ${{ inputs.package-manager }}\n        platform-client-id: ${{ inputs.platform-client-id }}\n        platform-client-secret: ${{ inputs.platform-client-secret }}\n    - id: tailor-notify\n      if: failure() && inputs.slack-token != '' && inputs.slack-channel-id != ''\n      uses: tailor-platform/actions/notify@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n      with:\n        provider: slack\n        status: failure\n        workspace-name: ${{ inputs.name }}\n        slack-token: ${{ inputs.slack-token }}\n        slack-channel-id: ${{ inputs.slack-channel-id }}\n        user-mapping: ${{ inputs.user-mapping }}\n";
+
 //#endregion
 //#region src/cli/commands/setup/branch.workflow.yml
-var branch_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  # __PULL_REQUEST_END__\n  push:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  workflow_dispatch:\n    # __DISPATCH_INPUTS_START__\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n    # __DISPATCH_INPUTS_END__\n\npermissions:\n  contents: read\n\njobs:\n  # __PLAN_JOB_START__\n  tailor-plan:\n    if: >-\n      github.event_name == 'pull_request' ||\n      (github.event_name == 'workflow_dispatch' && inputs['dry-run'])\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      - id: tailor-plan\n        # Fork PRs cannot read secrets; the checks above still run for them.\n        if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork\n        uses: tailor-platform/actions/plan@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n  # __PLAN_JOB_END__\n  tailor-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    environment: __ENVIRONMENT__\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n";
+var branch_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  # __PULL_REQUEST_END__\n  push:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  workflow_dispatch:\n    # __DISPATCH_INPUTS_START__\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n    # __DISPATCH_INPUTS_END__\n\npermissions:\n  contents: read\n\njobs:\n  # __PLAN_JOB_START__\n  tailor-plan:\n    if: >-\n      github.event_name == 'pull_request' ||\n      (github.event_name == 'workflow_dispatch' && inputs['dry-run'])\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        uses: tailor-platform/actions/seed-validate@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        # Fork PRs cannot read secrets; the checks above still run for them.\n        if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork\n        uses: tailor-platform/actions/plan@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n  # __PLAN_JOB_END__\n  # __ERD_PREVIEW_JOB_START__\n  tailor-erd-preview-matrix:\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      namespaces: ${{ steps.tailor-erd-preview-matrix.outputs.namespaces }}\n      base-app-dir: ${{ steps.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          persist-credentials: false\n      - id: tailor-checkout-base\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-erd-preview-matrix\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          WORKSPACE_NAME: \"__WORKSPACE_NAME__\"\n        run: |\n          set -euo pipefail\n          node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const appDir = process.env.APP_DIR || \".\";\n          const workspaceName = process.env.WORKSPACE_NAME;\n          const output = process.env.GITHUB_OUTPUT;\n          const dirPattern = /^[A-Za-z0-9._/-]+$/;\n          const namespacePattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n          function lockTarget(file) {\n            try {\n              const lock = JSON.parse(fs.readFileSync(file, \"utf8\"));\n              return lock.targets?.find(\n                (candidate) =>\n                  candidate.kind === \"branch\" &&\n                  candidate.workspaceName === workspaceName,\n              );\n            } catch (error) {\n              if (error && error.code === \"ENOENT\") return undefined;\n              throw error;\n            }\n          }\n\n          function namespacesFromTarget(target, label) {\n            const namespaces =\n              target?.inputs?.erdPreview === true && Array.isArray(target.inputs?.erdNamespaces)\n                ? target.inputs.erdNamespaces\n                : [];\n            for (const namespace of namespaces) {\n              if (typeof namespace !== \"string\" || !namespacePattern.test(namespace)) {\n                throw new Error(`Invalid ERD namespace in ${label}: ${String(namespace)}`);\n              }\n            }\n            return namespaces;\n          }\n\n          function normalizeDir(value, label) {\n            const raw = typeof value === \"string\" && value.length > 0 ? value : appDir;\n            const normalized =\n              raw.replaceAll(\"\\\\\", \"/\").replace(/\\/{2,}/g, \"/\").replace(/^\\.\\//, \"\").replace(/\\/$/, \"\") ||\n              \".\";\n            if (\n              !dirPattern.test(normalized) ||\n              normalized.startsWith(\"/\") ||\n              normalized.split(\"/\").includes(\"..\")\n            ) {\n              throw new Error(`Invalid ERD app dir in ${label}: ${raw}`);\n            }\n            return normalized;\n          }\n\n          const headTarget = lockTarget(\".github/tailor.lock\");\n          const baseTarget = lockTarget(\".tailor-erd-base/.github/tailor.lock\");\n          const baseAppDir = normalizeDir(baseTarget?.inputs?.dir, \"base setup lock\");\n          const namespaces = [\n            ...new Set([\n              ...namespacesFromTarget(headTarget, \"head setup lock\"),\n              ...namespacesFromTarget(baseTarget, \"base setup lock\"),\n            ]),\n          ].sort((a, b) => a.localeCompare(b));\n\n          if (namespaces.length === 0) {\n            console.error(\"No ERD preview namespaces found in the head or base setup lock.\");\n            process.exit(1);\n          }\n\n          fs.appendFileSync(output, `namespaces=${JSON.stringify(namespaces)}\\n`);\n          fs.appendFileSync(output, `base-app-dir=${baseAppDir}\\n`);\n          NODE\n\n  tailor-erd-preview:\n    needs: tailor-erd-preview-matrix\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    strategy:\n      fail-fast: false\n      matrix:\n        namespace: ${{ fromJSON(needs.tailor-erd-preview-matrix.outputs.namespaces) }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          persist-credentials: false\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-checkout-base\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-detect-base-package-manager\n        shell: bash\n        run: |\n          set -euo pipefail\n          cd .tailor-erd-base\n          base_package_manager=\"$(\n            if [ -f pnpm-lock.yaml ]; then\n              echo pnpm\n            elif [ -f yarn.lock ]; then\n              echo yarn\n            elif [ -f bun.lockb ] || [ -f bun.lock ]; then\n              echo bun\n            elif [ -f package-lock.json ]; then\n              echo npm\n            else\n              echo \"__PACKAGE_MANAGER__\"\n            fi\n          )\"\n          echo \"package-manager=$base_package_manager\" >> \"$GITHUB_OUTPUT\"\n          if [ \"$base_package_manager\" = \"pnpm\" ]; then\n            base_pnpm_version=\"$(node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const fallback = \"10\";\n\n          function readManifest(file) {\n            try {\n              return JSON.parse(fs.readFileSync(file, \"utf8\"));\n            } catch {\n              return {};\n            }\n          }\n\n          function pnpmVersion(manifest) {\n            const packageManager = manifest.packageManager;\n            if (typeof packageManager === \"string\" && packageManager.startsWith(\"pnpm@\")) {\n              return packageManager.slice(\"pnpm@\".length).split(\"+\")[0];\n            }\n\n            const devPackageManager = manifest.devEngines?.packageManager;\n            if (devPackageManager?.name === \"pnpm\" && devPackageManager.version) {\n              return devPackageManager.version;\n            }\n\n            return undefined;\n          }\n\n          process.stdout.write(\n            pnpmVersion(readManifest(\"package.json\")) ?? fallback,\n          );\n          NODE\n          )\"\n            echo \"pnpm-version=$base_pnpm_version\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-setup-base-pnpm\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'pnpm'\n        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9\n        with:\n          version: ${{ steps.tailor-detect-base-package-manager.outputs['pnpm-version'] }}\n          package_json_file: .tailor-erd-base/package.json\n          run_install: false\n      - id: tailor-setup-base-node\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] != 'bun'\n        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n        with:\n          node-version-file: .tailor-erd-base/package.json\n      - id: tailor-setup-base-yarn\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'yarn'\n        shell: bash\n        working-directory: .tailor-erd-base\n        run: |\n          set -euo pipefail\n          corepack enable\n      - id: tailor-setup-base-bun\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'bun'\n        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0\n      - id: tailor-install-base\n        shell: bash\n        working-directory: .tailor-erd-base\n        env:\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n        run: |\n          set -euo pipefail\n          case \"$BASE_PACKAGE_MANAGER\" in\n            pnpm) pnpm install --frozen-lockfile ;;\n            npm) npm ci ;;\n            yarn)\n              if grep -q '^__metadata:' yarn.lock; then\n                yarn install --immutable\n              else\n                yarn install --frozen-lockfile\n              fi\n              ;;\n            bun) bun install --frozen-lockfile ;;\n            *)\n              echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n              exit 1\n              ;;\n          esac\n      - id: tailor-restore-head-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-build-erd-preview\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          BASE_APP_DIR: ${{ needs.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n          NAMESPACE: ${{ matrix.namespace }}\n        run: |\n          set -euo pipefail\n\n          run_tailor_cli() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec tailor \"$@\" ;;\n              npm) npx tailor \"$@\" ;;\n              yarn) yarn tailor \"$@\" ;;\n              bun) bunx tailor \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          run_head_node() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec node \"$@\" ;;\n              npm) node \"$@\" ;;\n              yarn) yarn node \"$@\" ;;\n              bun) node \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          tailor_cli_bin=\"$(\n            run_head_node - <<'NODE'\n          const path = require(\"node:path\");\n          const { createRequire } = require(\"node:module\");\n          const appDir = process.env.APP_DIR || \".\";\n          const githubWorkspace = process.env.GITHUB_WORKSPACE;\n          if (!githubWorkspace) {\n            throw new Error(\"GITHUB_WORKSPACE is required.\");\n          }\n\n          let lastError;\n          for (const manifestPath of [\n            path.join(githubWorkspace, appDir, \"package.json\"),\n            path.join(githubWorkspace, \"package.json\"),\n          ]) {\n            try {\n              const requireFromManifest = createRequire(manifestPath);\n              process.stdout.write(\n                path.join(\n                  path.dirname(requireFromManifest.resolve(\"@tailor-platform/sdk/cli\")),\n                  \"index.mjs\",\n                ),\n              );\n              process.exit(0);\n            } catch (error) {\n              lastError = error;\n            }\n          }\n          throw lastError || new Error(\"Failed to resolve @tailor-platform/sdk/cli.\");\n          NODE\n          )\"\n\n          run_head_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$GITHUB_WORKSPACE\" || exit 1\n              case \"__PACKAGE_MANAGER__\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          run_base_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$command_cwd\" || exit 1\n              case \"$BASE_PACKAGE_MANAGER\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          head_output=\"$RUNNER_TEMP/tailor-erd/head\"\n          base_output=\"$RUNNER_TEMP/tailor-erd/base\"\n          preview_output=\"$RUNNER_TEMP/tailor-erd/preview\"\n          dts_output=\"$RUNNER_TEMP/tailor-erd/dts\"\n          head_cli_runner=\"$RUNNER_TEMP/tailor-erd/run-head-cli.mjs\"\n          head_log=\"$RUNNER_TEMP/tailor-erd/head-$NAMESPACE.log\"\n          base_log=\"$RUNNER_TEMP/tailor-erd/base-$NAMESPACE.log\"\n          rm -rf \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          mkdir -p \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          cat > \"$head_cli_runner\" <<'NODE'\n          import { pathToFileURL } from \"node:url\";\n\n          const cliBin = process.env.TAILOR_CLI_BIN;\n          const commandCwd = process.env.TAILOR_CLI_CWD;\n          if (!cliBin || !commandCwd) {\n            throw new Error(\"TAILOR_CLI_BIN and TAILOR_CLI_CWD are required.\");\n          }\n\n          process.chdir(commandCwd);\n          process.argv = [process.argv[0], cliBin, ...process.argv.slice(2)];\n          await import(pathToFileURL(cliBin).href);\n          NODE\n\n          head_config=\"$GITHUB_WORKSPACE/$APP_DIR/tailor.config.ts\"\n          base_config=\"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR/tailor.config.ts\"\n          head_html=\"$head_output/$NAMESPACE/dist/index.html\"\n          base_html=\"$base_output/$NAMESPACE/dist/index.html\"\n          preview_html=\"$preview_output/$NAMESPACE-viewer.html\"\n\n          head_missing=\"false\"\n          if [ ! -f \"$head_config\" ]; then\n            echo \"Head ERD config not found; rendering base objects as removed.\"\n            head_missing=\"true\"\n          elif ! (\n            cd \"$GITHUB_WORKSPACE/$APP_DIR\" || exit 1\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/head-$NAMESPACE.d.ts\" \\\n              run_tailor_cli tailordb erd export --config \"$head_config\" --namespace \"$NAMESPACE\" --output \"$head_output\"\n          ) >\"$head_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$head_log\"; then\n              cat \"$head_log\"\n              echo \"Head ERD namespace '$NAMESPACE' not found; rendering base objects as removed.\"\n              head_missing=\"true\"\n            else\n              cat \"$head_log\"\n              exit 1\n            fi\n          elif [ -s \"$head_log\" ]; then\n            cat \"$head_log\"\n          fi\n\n          base_missing=\"false\"\n          if [ ! -f \"$base_config\" ]; then\n            echo \"Base ERD config not found; rendering current objects as added.\"\n            base_missing=\"true\"\n          elif ! (\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/base-$NAMESPACE.d.ts\" \\\n              run_base_tailor_cli_bin \"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR\" tailordb erd export --config \"$base_config\" --namespace \"$NAMESPACE\" --output \"$base_output\"\n          ) >\"$base_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$base_log\"; then\n              cat \"$base_log\"\n              echo \"Base ERD namespace '$NAMESPACE' not found; rendering current objects as added.\"\n              base_missing=\"true\"\n            else\n              cat \"$base_log\"\n              exit 1\n            fi\n          elif [ -s \"$base_log\" ]; then\n            cat \"$base_log\"\n          fi\n\n          if [ \"$head_missing\" = \"true\" ] && [ \"$base_missing\" = \"true\" ]; then\n            echo \"::error::ERD namespace '$NAMESPACE' was not found in head or base.\"\n            exit 1\n          fi\n          if [ \"$head_missing\" = \"false\" ] && [ ! -f \"$head_html\" ]; then\n            echo \"::error::Head ERD viewer was not generated at $head_html\"\n            exit 1\n          fi\n          if [ \"$base_missing\" = \"false\" ] && [ ! -f \"$base_html\" ]; then\n            echo \"::error::Base ERD viewer was not generated at $base_html\"\n            exit 1\n          fi\n\n          diff_args=(--namespace \"$NAMESPACE\" --output \"$preview_html\")\n          if [ \"$head_missing\" = \"false\" ]; then\n            diff_args+=(--head-html \"$head_html\")\n          fi\n          if [ \"$base_missing\" = \"false\" ]; then\n            diff_args+=(--base-html \"$base_html\")\n          fi\n          run_head_tailor_cli_bin \"$GITHUB_WORKSPACE\" tailordb erd diff \"${diff_args[@]}\"\n      - id: tailor-upload-erd-viewer\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: ${{ matrix.namespace }}-viewer.html\n          path: ${{ runner.temp }}/tailor-erd/preview/${{ matrix.namespace }}-viewer.html\n          if-no-files-found: error\n          archive: false\n          retention-days: 7\n\n  # __ERD_PREVIEW_JOB_END__\n  # __ERD_PREVIEW_COMMENT_JOB_START__\n  tailor-erd-preview-comment:\n    needs: tailor-erd-preview\n    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      actions: read\n      pull-requests: write\n    steps:\n      - id: tailor-comment-erd-preview\n        env:\n          GH_TOKEN: ${{ github.token }}\n          REPO: ${{ github.repository }}\n          RUN_ID: ${{ github.run_id }}\n          SERVER: ${{ github.server_url }}\n          PR_NUMBER: ${{ github.event.pull_request.number }}\n          BASE_REF: ${{ github.event.pull_request.base.ref }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n          MARKER: \"<!-- tailor-erd-preview: __WORKSPACE_NAME__ -->\"\n        run: |\n          set -euo pipefail\n\n          current_head=$(gh api \"repos/$REPO/pulls/$PR_NUMBER\" --jq '.head.sha')\n          if [ \"$current_head\" != \"$HEAD_SHA\" ]; then\n            echo \"Skipping stale ERD preview comment for $HEAD_SHA; current head is $current_head.\"\n            exit 0\n          fi\n\n          body=\"$MARKER\"$'\\n'\"### TailorDB ERD preview (__WORKSPACE_NAME__)\"$'\\n\\n'\n          body+=\"Self-contained ERD viewer HTML artifacts for this pull request. Each viewer can switch between the current schema and a diff against base branch \\`$BASE_REF\\`.\"$'\\n'\n\n          while IFS=$'\\t' read -r name id; do\n            [ -z \"$name\" ] && continue\n            if [[ \"$name\" != *-viewer.html ]]; then\n              continue\n            fi\n            ns=${name%-viewer.html}\n            label=\"$ns viewer\"\n            body+=$'\\n'\"- **$label**: [$name]($SERVER/$REPO/actions/runs/$RUN_ID/artifacts/$id)\"\n          done < <(gh api \"repos/$REPO/actions/runs/$RUN_ID/artifacts\" --paginate \\\n            --jq '.artifacts[] | select(.name | endswith(\"-viewer.html\")) | [.name, (.id|tostring)] | @tsv' | sort)\n\n          existing=$(gh api \"repos/$REPO/issues/$PR_NUMBER/comments\" --paginate \\\n            --jq 'map(select(.body | contains(env.MARKER))) | .[0].id // empty')\n          if [ -n \"$existing\" ]; then\n            gh api --method PATCH \"repos/$REPO/issues/comments/$existing\" -f body=\"$body\" >/dev/null\n          else\n            gh api --method POST \"repos/$REPO/issues/$PR_NUMBER/comments\" -f body=\"$body\" >/dev/null\n          fi\n\n  # __ERD_PREVIEW_COMMENT_JOB_END__\n  tailor-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    environment: __ENVIRONMENT__\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
+
+//#endregion
+//#region src/cli/commands/setup/coordinate.workflow.yml
+var coordinate_workflow_default = "# __HEADER__\nname: Tailor Coordinator (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n  # __PULL_REQUEST_END__\n  push:\n    # __PUSH_BRANCHES_START__\n    branches: [\"__BRANCH__\"]\n    # __PUSH_BRANCHES_END__\n    # __PUSH_TAGS_START__\n    tags: [__TAG_PATTERN__]\n    # __PUSH_TAGS_END__\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          target-branch: __BRANCH__\n  # __TAG_GUARD_JOB_END__\n\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_PLAN_STEPS__\n\n  tailor-deploy:\n    # __DEPLOY_NEEDS__\n    # __DEPLOY_IF__\n    # __DEPLOY_ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_DEPLOY_STEPS__\n";
+
+//#endregion
+//#region src/cli/commands/setup/preview.workflow.yml
+var preview_workflow_default = "# __HEADER__\nname: Tailor Preview (__WORKSPACE_NAME__)\n\non:\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PR_TYPES__\n    # To deploy only for PRs that carry the `tailor:preview` label instead of all PRs,\n    # re-run: tailor setup preview --require-preview-label\n    # __PATHS__\n\npermissions:\n  contents: read\n  pull-requests: write\n\njobs:\n  tailor-preview-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-preview-__WORKSPACE_NAME__-${{ github.event.pull_request.number }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      - id: tailor-preview-deploy\n        uses: tailor-platform/actions/preview-deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          region: \"__REGION__\"\n          organization-id: ${{ vars.TAILOR_PLATFORM_ORGANIZATION_ID }}\n          folder-id: ${{ vars.TAILOR_PLATFORM_FOLDER_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n      - id: tailor-preview-comment\n        if: always()\n        uses: tailor-platform/actions/preview-comment@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-id: ${{ steps.tailor-preview-deploy.outputs.workspace-id }}\n          workspace-name: ${{ steps.tailor-preview-deploy.outputs.workspace-name }}\n          status: ${{ job.status == 'success' && 'success' || 'failure' }}\n          app-url: ${{ steps.tailor-preview-deploy.outputs.app-url }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n\n  tailor-preview-cleanup:\n    # __CLEANUP_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-preview-cleanup\n        uses: tailor-platform/actions/preview-cleanup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/tag.workflow.yml
-var tag_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  push:\n    tags: [\"__TAG_PATTERN__\"]\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          target-branch: \"__BRANCH__\"\n  # __TAG_GUARD_JOB_END__\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      - id: tailor-plan\n        uses: tailor-platform/actions/plan@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n\n  tailor-deploy:\n    needs: tailor-plan\n    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs['dry-run']) }}\n    environment: __ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n";
+var tag_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  push:\n    tags: [\"__TAG_PATTERN__\"]\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          target-branch: \"__BRANCH__\"\n  # __TAG_GUARD_JOB_END__\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        uses: tailor-platform/actions/seed-validate@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        uses: tailor-platform/actions/plan@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n\n  tailor-deploy:\n    needs: tailor-plan\n    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs['dry-run']) }}\n    environment: __ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/templates.ts
-const HEADER = `# Generated by \`tailor-sdk setup\` — managed by the Tailor SDK.
+const HEADER = `# Generated by \`tailor setup\` — managed by the Tailor SDK.
 #
 # - Jobs and steps whose id starts with \`tailor-\` are managed by the SDK.
 #   Do not edit or rename them.
-# - State is tracked in .github/tailor-sdk.lock (machine-owned: commit it, never edit it).
-# - Re-running \`tailor-sdk setup\` regenerates this file. If you have
+# - State is tracked in .github/tailor.lock (machine-owned: commit it, never edit it).
+# - Re-running \`tailor setup\` regenerates this file. If you have
 #   edited it by hand, regeneration stops and asks for --force (which discards
 #   your edits), so prefer keeping customizations in your own jobs/steps and
 #   re-running setup after SDK updates.`;
@@ -2684,29 +3227,43 @@ function applyCommon(content, params) {
 	const { workingDirectory, environment, packageManager } = params;
 	let out = line(content, "HEADER", HEADER);
 	out = line(out, "WORKING_DIRECTORY", workingDirectory ? `working-directory: ${workingDirectory}` : void 0);
-	return out.replaceAll("__WORKSPACE_NAME__", () => params.workspaceName).replaceAll("__ENVIRONMENT__", () => environment).replaceAll("__PACKAGE_MANAGER__", () => packageManager);
+	return out.replaceAll("__WORKSPACE_NAME__", () => params.workspaceName).replaceAll("__ENVIRONMENT__", () => environment).replaceAll("__PACKAGE_MANAGER__", () => packageManager).replaceAll("__APP_DIR__", () => workingDirectory ?? ".");
 }
 /**
 * Render the branch-target deploy workflow.
-*
-* When `plan` is false the plan job, the pull_request trigger, and the
-* workflow_dispatch dry-run input are all removed (a plan-less workflow has no
-* meaningful dry-run), and the deploy job runs unconditionally.
 * @param params - Workspace and rendering configuration
 * @returns Rendered YAML and the list of managed job/step ids
 */
 function renderBranchWorkflow(params) {
-	const { branch, plan } = params;
+	const { branch } = params;
+	const seedValidate = params.seedValidate ?? false;
+	const migrationDriftCheck = params.migrationDriftCheck ?? false;
+	const erdPreview = params.erdPreview;
 	let out = branch_workflow_default;
-	out = block(out, "PLAN_JOB", plan);
-	out = block(out, "PULL_REQUEST", plan);
-	out = block(out, "DISPATCH_INPUTS", plan);
-	out = line(out, "DEPLOY_IF", plan ? `if: >-\n  github.event_name == 'push' ||\n  (github.event_name == 'workflow_dispatch' && !inputs['dry-run'])` : void 0);
+	out = block(out, "PLAN_JOB", true);
+	out = block(out, "ERD_PREVIEW_JOB", erdPreview !== null);
+	out = block(out, "ERD_PREVIEW_COMMENT_JOB", erdPreview !== null);
+	out = block(out, "PULL_REQUEST", true);
+	out = block(out, "DISPATCH_INPUTS", true);
+	out = block(out, "SEED_VALIDATE", seedValidate);
+	out = block(out, "MIGRATION_DRIFT_CHECK", migrationDriftCheck);
+	out = block(out, "SEED_DATA", false);
+	out = line(out, "DEPLOY_IF", `if: >-\n  github.event_name == 'push' ||\n  (github.event_name == 'workflow_dispatch' && !inputs['dry-run'])`);
 	out = line(out, "PATHS", params.workingDirectory ? `paths: ["${params.workingDirectory}/**"]` : void 0);
 	out = applyCommon(out, params).replaceAll("__BRANCH__", () => branch);
-	const generatedIds = [];
-	if (plan) generatedIds.push("tailor-plan", "tailor-plan/tailor-checkout", "tailor-plan/tailor-setup", "tailor-plan/tailor-generate-check", "tailor-plan/tailor-plan");
-	generatedIds.push("tailor-deploy", "tailor-deploy/tailor-checkout", "tailor-deploy/tailor-setup", "tailor-deploy/tailor-apply");
+	const generatedIds = [
+		"tailor-plan",
+		"tailor-plan/tailor-checkout",
+		"tailor-plan/tailor-setup",
+		"tailor-plan/tailor-install",
+		"tailor-plan/tailor-generate-check"
+	];
+	if (seedValidate) generatedIds.push("tailor-plan/tailor-seed-validate");
+	generatedIds.push("tailor-plan/tailor-drift-check");
+	if (migrationDriftCheck) generatedIds.push("tailor-plan/tailor-migration-drift-check");
+	generatedIds.push("tailor-plan/tailor-plan");
+	if (erdPreview) generatedIds.push("tailor-erd-preview-matrix", "tailor-erd-preview-matrix/tailor-checkout", "tailor-erd-preview-matrix/tailor-checkout-base", "tailor-erd-preview-matrix/tailor-erd-preview-matrix", "tailor-erd-preview", "tailor-erd-preview/tailor-checkout", "tailor-erd-preview/tailor-setup", "tailor-erd-preview/tailor-checkout-base", "tailor-erd-preview/tailor-detect-base-package-manager", "tailor-erd-preview/tailor-setup-base-pnpm", "tailor-erd-preview/tailor-setup-base-node", "tailor-erd-preview/tailor-setup-base-yarn", "tailor-erd-preview/tailor-setup-base-bun", "tailor-erd-preview/tailor-install-base", "tailor-erd-preview/tailor-restore-head-setup", "tailor-erd-preview/tailor-build-erd-preview", "tailor-erd-preview/tailor-upload-erd-viewer", "tailor-erd-preview-comment", "tailor-erd-preview-comment/tailor-comment-erd-preview");
+	generatedIds.push("tailor-deploy", "tailor-deploy/tailor-checkout", "tailor-deploy/tailor-setup", "tailor-deploy/tailor-install", "tailor-deploy/tailor-apply", "tailor-deploy/tailor-notify");
 	return {
 		content: out,
 		generatedIds
@@ -2723,133 +3280,323 @@ function renderBranchWorkflow(params) {
 function renderTagWorkflow(params) {
 	const { tagPattern, branch } = params;
 	const hasGuard = branch !== void 0;
+	const seedValidate = params.seedValidate ?? false;
+	const migrationDriftCheck = params.migrationDriftCheck ?? false;
 	let out = tag_workflow_default;
 	out = block(out, "TAG_GUARD_JOB", hasGuard);
+	out = block(out, "SEED_VALIDATE", seedValidate);
+	out = block(out, "MIGRATION_DRIFT_CHECK", migrationDriftCheck);
+	out = block(out, "SEED_DATA", false);
 	out = line(out, "PLAN_NEEDS", hasGuard ? "needs: tailor-tag-guard" : void 0);
 	out = line(out, "PLAN_IF", hasGuard ? `if: >-\n  github.event_name == 'workflow_dispatch' ||\n  needs.tailor-tag-guard.outputs.on-branch == 'true'` : void 0);
 	out = applyCommon(out, params).replaceAll("__TAG_PATTERN__", () => tagPattern);
 	if (hasGuard) out = out.replaceAll("__BRANCH__", () => branch);
 	const generatedIds = [];
 	if (hasGuard) generatedIds.push("tailor-tag-guard", "tailor-tag-guard/tailor-checkout", "tailor-tag-guard/tailor-tag-guard");
-	generatedIds.push("tailor-plan", "tailor-plan/tailor-checkout", "tailor-plan/tailor-setup", "tailor-plan/tailor-generate-check", "tailor-plan/tailor-plan", "tailor-deploy", "tailor-deploy/tailor-checkout", "tailor-deploy/tailor-setup", "tailor-deploy/tailor-apply");
+	generatedIds.push("tailor-plan", "tailor-plan/tailor-checkout", "tailor-plan/tailor-setup", "tailor-plan/tailor-install", "tailor-plan/tailor-generate-check");
+	if (seedValidate) generatedIds.push("tailor-plan/tailor-seed-validate");
+	generatedIds.push("tailor-plan/tailor-drift-check");
+	if (migrationDriftCheck) generatedIds.push("tailor-plan/tailor-migration-drift-check");
+	generatedIds.push("tailor-plan/tailor-plan", "tailor-deploy", "tailor-deploy/tailor-checkout", "tailor-deploy/tailor-setup", "tailor-deploy/tailor-install", "tailor-deploy/tailor-apply", "tailor-deploy/tailor-notify");
 	return {
 		content: out,
 		generatedIds
 	};
 }
-
-//#endregion
-//#region src/cli/commands/setup/check.ts
 /**
-* Compute drift findings for one target by comparing its recorded lock state
-* against the current repository/config state.
-* @param target - The lock target being audited
-* @param state - Current repository/config state for this target
-* @returns Drift findings (empty when the target is in sync)
+* Render the preview workflow (PR open/sync/close triggers).
+*
+* The deploy job runs on opened/synchronize/reopened events; the cleanup job
+* runs on the closed event.  Both jobs run in the same workflow so PR number
+* context is always available.
+* @param params - Workspace and rendering configuration
+* @returns Rendered YAML and the list of managed job/step ids
 */
-function findTargetDrift(target, state) {
-	const id = `${target.kind} ${target.workspaceName}`;
-	const findings = [];
-	if (!state.fileExists) findings.push({
-		target: id,
-		rule: "missing-file",
-		message: `${target.file} is missing or unreadable. Re-run setup to restore it.`
-	});
-	else if (state.currentHash !== null && state.currentHash !== target.contentHash) findings.push({
-		target: id,
-		rule: "hand-edit",
-		message: `${target.file} was edited by hand since it was generated. Re-run setup with --force to regenerate, or keep customizations in your own jobs/steps.`
-	});
-	if (target.templateVersion < state.templateVersion) findings.push({
-		target: id,
-		rule: "template-version",
-		message: `A newer workflow template is available (generated with v${String(target.templateVersion)}, current v${String(state.templateVersion)}). Re-run setup to update.`
-	});
-	if (!state.configExists) findings.push({
-		target: id,
-		rule: "config-dir",
-		message: `tailor.config.ts not found under "${target.inputs.dir}". The app directory may have moved; re-run setup with the correct --dir.`
-	});
-	if (target.kind === "branch" && target.inputs.branchAutoDetected !== false && state.defaultBranch !== null && target.inputs.branch !== null && target.inputs.branch !== state.defaultBranch) findings.push({
-		target: id,
-		rule: "default-branch",
-		message: `The workflow triggers on "${target.inputs.branch}" but the repository default branch is now "${state.defaultBranch}". If this is intentional, ignore this; otherwise re-run setup so the trigger matches the default branch.`
-	});
-	return findings;
-}
-function detectDefaultBranchSafe(cwd, run) {
-	try {
-		return detectDefaultBranch(cwd, run);
-	} catch {
-		return null;
-	}
-}
-function escapesRoot$1(rel) {
-	return path.isAbsolute(rel) || rel === ".." || rel.startsWith(`..${path.sep}`) || rel.startsWith("../");
-}
-function resolveWithinRoot(outputDir, relPath) {
-	if (path.isAbsolute(relPath)) return null;
-	const abs = path.join(outputDir, relPath);
-	if (escapesRoot$1(path.relative(outputDir, abs))) return null;
-	try {
-		if (escapesRoot$1(path.relative(fs$1.realpathSync(outputDir), fs$1.realpathSync(abs)))) return null;
-	} catch {}
-	return abs;
+function renderPreviewWorkflow(params) {
+	const { branch } = params;
+	const requirePreviewLabel = params.requirePreviewLabel ?? false;
+	let out = preview_workflow_default;
+	out = line(out, "PATHS", params.workingDirectory ? `paths: ["${params.workingDirectory}/**"]` : void 0);
+	out = line(out, "PR_TYPES", requirePreviewLabel ? "types: [labeled, synchronize, reopened, closed]" : "types: [opened, synchronize, reopened, closed]");
+	out = line(out, "DEPLOY_IF", requirePreviewLabel ? `if: >-\n  contains(github.event.pull_request.labels.*.name, 'tailor:preview') &&\n  github.event.action != 'closed' &&\n  !github.event.pull_request.draft &&\n  !github.event.pull_request.head.repo.fork` : `if: >-\n  github.event.action != 'closed' &&\n  !github.event.pull_request.draft &&\n  !github.event.pull_request.head.repo.fork`);
+	out = line(out, "CLEANUP_IF", `if: >-\n  github.event.action == 'closed' &&\n  !github.event.pull_request.head.repo.fork`);
+	out = applyCommon(out, params).replaceAll("__BRANCH__", () => branch).replaceAll("__REGION__", () => params.region);
+	return {
+		content: out,
+		generatedIds: [
+			"tailor-preview-deploy",
+			"tailor-preview-deploy/tailor-checkout",
+			"tailor-preview-deploy/tailor-setup",
+			"tailor-preview-deploy/tailor-install",
+			"tailor-preview-deploy/tailor-generate-check",
+			"tailor-preview-deploy/tailor-preview-deploy",
+			"tailor-preview-deploy/tailor-preview-comment",
+			"tailor-preview-cleanup",
+			"tailor-preview-cleanup/tailor-checkout",
+			"tailor-preview-cleanup/tailor-setup",
+			"tailor-preview-cleanup/tailor-install",
+			"tailor-preview-cleanup/tailor-preview-cleanup"
+		]
+	};
 }
-function readHash(absFile) {
-	try {
-		return hashContent(fs$1.readFileSync(absFile, "utf-8"));
-	} catch {
-		return null;
-	}
+/**
+* Render the per-app composite action.
+*
+* The action contains only the deploy step and a failure notification.
+* Checkout, setup, and install are the caller's responsibility (coordinator workflow).
+* @param params - Workspace and rendering configuration
+* @returns Rendered YAML and the list of managed step ids
+*/
+function renderActionWorkflow(params) {
+	let out = action_default;
+	out = line(out, "HEADER", HEADER);
+	out = block(out, "STATIC_WEBSITE_BUILD", params.hasStaticWebsites ?? false);
+	out = out.replaceAll("__WORKSPACE_NAME__", () => params.workspaceName);
+	return {
+		content: out,
+		generatedIds: ["tailor-apply", "tailor-notify"]
+	};
 }
+const ACTIONS_SHA = "e74173d4bdd931d036ad359cf5f7729fc6aa7067";
 /**
-* Audit the generated workflows for drift against the current config/repo
-* state. Read-only: never writes files, the lock, or the config.
+* Render the coordinator workflow that orchestrates per-app composite actions.
 *
-* Throws when drift is found (so it composes like the other `:check`
-* commands). The workflow drift-check step layers advisory behaviour on top
-* (per-rule ignore / continue-on-error); the CLI itself reports via exit code.
-* @param options - Check options
+* Generates per-app plan steps (generate-check, drift-check, plan) and per-app
+* deploy steps (calling each app's composite action at .github/actions/tailor-<name>).
+* Checkout, setup, and install are done once per job using the local tailor-setup action.
+* @param params - Coordinator and app configuration
+* @returns Rendered YAML and the list of managed job/step ids
 */
-function checkGitHub(options) {
-	logBetaWarning("setup");
-	const { outputDir } = options;
-	const lock = readLock(outputDir);
-	if (!lock || lock.targets.length === 0) throw new Error("No managed workflows found (.github/tailor-sdk.lock is missing or empty). Run `tailor-sdk setup` first.");
-	const exists = options.configExistsAt ?? ((p) => fs$1.existsSync(p));
-	const defaultBranch = detectDefaultBranchSafe(outputDir, options.gitRunner);
-	const findings = [];
-	for (const target of lock.targets) {
-		const absFile = resolveWithinRoot(outputDir, target.file);
-		const currentHash = absFile === null ? null : readHash(absFile);
-		const configAbs = resolveWithinRoot(outputDir, path.join(target.inputs.dir, "tailor.config.ts"));
-		findings.push(...findTargetDrift(target, {
-			fileExists: currentHash !== null,
-			currentHash,
-			configExists: configAbs !== null && exists(configAbs),
-			defaultBranch,
-			templateVersion: 2
-		}));
+function renderCoordinateWorkflow(params) {
+	const { coordinatorName, kind, actionGroups, environment, packageManager } = params;
+	const isTag = kind === "tag";
+	const branch = params.branch;
+	const tagPattern = params.tagPattern ?? "v*";
+	let out = coordinate_workflow_default;
+	out = line(out, "HEADER", HEADER);
+	out = block(out, "PULL_REQUEST", !isTag);
+	out = block(out, "PUSH_BRANCHES", !isTag);
+	out = block(out, "PUSH_TAGS", isTag);
+	out = block(out, "TAG_GUARD_JOB", isTag && branch !== void 0);
+	if (isTag && branch !== void 0) {
+		out = line(out, "PLAN_NEEDS", "needs: tailor-tag-guard");
+		out = line(out, "PLAN_IF", `if: >-\n  github.event_name == 'workflow_dispatch' ||\n  needs.tailor-tag-guard.outputs.on-branch == 'true'`);
+	} else if (isTag) {
+		out = line(out, "PLAN_NEEDS", void 0);
+		out = line(out, "PLAN_IF", void 0);
+	} else {
+		out = line(out, "PLAN_NEEDS", void 0);
+		out = line(out, "PLAN_IF", `if: >-\n  github.event_name == 'pull_request' ||\n  (github.event_name == 'workflow_dispatch' && inputs['dry-run'])`);
 	}
-	const count = lock.targets.length;
-	if (findings.length === 0) {
-		logger.success(`No drift detected across ${String(count)} target(s).`);
-		return;
+	if (isTag) {
+		out = line(out, "DEPLOY_NEEDS", "needs: tailor-plan");
+		out = line(out, "DEPLOY_IF", `if: \${{ !(github.event_name == 'workflow_dispatch' && inputs['dry-run']) }}`);
+		out = line(out, "DEPLOY_ENVIRONMENT", `environment: ${environment}`);
+	} else {
+		out = line(out, "DEPLOY_NEEDS", void 0);
+		out = line(out, "DEPLOY_IF", `if: >-\n  github.event_name == 'push' ||\n  (github.event_name == 'workflow_dispatch' && !inputs['dry-run'])`);
+		out = line(out, "DEPLOY_ENVIRONMENT", `environment: ${environment}`);
+	}
+	const driftCheckStep = [
+		`- id: tailor-drift-check`,
+		`  uses: tailor-platform/actions/drift-check@${ACTIONS_SHA} # v1.5.1`,
+		`  with:`,
+		`    package-manager: ${packageManager}`
+	].join("\n");
+	const configPath = (app) => app.dir === "." ? "tailor.config.ts" : `${app.dir}/tailor.config.ts`;
+	const groupConfigPath = (group) => group.apps.map(configPath).join(",");
+	const firstApp = (group) => {
+		const [app] = group.apps;
+		if (!app) throw new Error("Coordinate action groups must contain at least one app.");
+		return app;
+	};
+	const singleAppPlanStep = (group, app) => {
+		const wd = app.dir !== "." ? app.dir : void 0;
+		const wdLine = wd ? `\n    working-directory: ${wd}` : "";
+		return [
+			`- id: tailor-plan-${group.id}`,
+			`  if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork`,
+			`  uses: tailor-platform/actions/plan@${ACTIONS_SHA} # v1.5.1`,
+			`  with:`,
+			`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+			`    package-manager: ${packageManager}${wdLine}`,
+			`    label: ${coordinatorName}/${group.id}`,
+			`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+			`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+			`    github-token: \${{ secrets.GITHUB_TOKEN }}`
+		];
+	};
+	const multiConfigPlanStep = (group) => [
+		`- id: tailor-plan-${group.id}`,
+		`  if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork`,
+		`  uses: tailor-platform/actions/plan@${ACTIONS_SHA} # v1.5.1`,
+		`  env:`,
+		`    TAILOR_PLATFORM_SDK_CONFIG_PATH: ${groupConfigPath(group)}`,
+		`  with:`,
+		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+		`    package-manager: ${packageManager}`,
+		`    label: ${coordinatorName}/${group.id}`,
+		`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+		`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+		`    github-token: \${{ secrets.GITHUB_TOKEN }}`
+	];
+	const perAppPlanSteps = actionGroups.flatMap((group) => {
+		const generateCheckSteps = group.apps.flatMap((app) => {
+			const wd = app.dir !== "." ? app.dir : void 0;
+			const wdLine = wd ? `\n    working-directory: ${wd}` : "";
+			return [
+				`- id: tailor-generate-check-${app.name}`,
+				`  uses: tailor-platform/actions/generate-check@${ACTIONS_SHA} # v1.5.1`,
+				`  with:`,
+				`    package-manager: ${packageManager}${wdLine}`
+			];
+		});
+		const planStep = group.apps.length === 1 ? singleAppPlanStep(group, firstApp(group)) : multiConfigPlanStep(group);
+		return [...generateCheckSteps, ...planStep];
+	}).join("\n");
+	out = line(out, "PER_APP_PLAN_STEPS", `${driftCheckStep}\n${perAppPlanSteps}`);
+	const singleAppDeployStep = (group, app) => [
+		`- id: tailor-deploy-${group.id}`,
+		`  uses: ./.github/actions/tailor-${app.name}`,
+		`  with:`,
+		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+		`    name: ${app.name}`,
+		`    working-directory: ${app.dir}`,
+		`    package-manager: ${packageManager}`,
+		`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+		`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+		`    slack-token: \${{ secrets.TAILOR_SLACK_BOT_TOKEN }}`,
+		`    slack-channel-id: \${{ vars.TAILOR_SLACK_CHANNEL_ID }}`,
+		`    # editable: api-url:`
+	];
+	const buildSiteStep = (app) => [
+		`- id: tailor-build-site-${app.name}`,
+		`  uses: ./.github/actions/tailor-${app.name}`,
+		`  with:`,
+		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+		`    name: ${app.name}`,
+		`    working-directory: ${app.dir}`,
+		`    deploy: "false"`,
+		`    package-manager: ${packageManager}`,
+		`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+		`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+		`    slack-token: \${{ secrets.TAILOR_SLACK_BOT_TOKEN }}`,
+		`    slack-channel-id: \${{ vars.TAILOR_SLACK_CHANNEL_ID }}`
+	];
+	const multiConfigDeployStep = (group) => [
+		...group.apps.filter((app) => app.hasStaticWebsites).flatMap(buildSiteStep),
+		`- id: tailor-deploy-${group.id}`,
+		`  uses: ./.github/actions/tailor-${firstApp(group).name}`,
+		`  with:`,
+		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+		`    name: ${coordinatorName}/${group.id}`,
+		`    working-directory: .`,
+		`    config: ${groupConfigPath(group)}`,
+		`    build-site: "false"`,
+		`    package-manager: ${packageManager}`,
+		`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+		`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+		`    slack-token: \${{ secrets.TAILOR_SLACK_BOT_TOKEN }}`,
+		`    slack-channel-id: \${{ vars.TAILOR_SLACK_CHANNEL_ID }}`,
+		`    # editable: api-url:`
+	];
+	const deploySteps = actionGroups.flatMap((group) => group.apps.length === 1 ? singleAppDeployStep(group, firstApp(group)) : multiConfigDeployStep(group)).join("\n");
+	out = line(out, "PER_APP_DEPLOY_STEPS", deploySteps);
+	out = out.replaceAll("__WORKSPACE_NAME__", () => coordinatorName);
+	out = out.replaceAll("__ENVIRONMENT__", () => environment);
+	if (branch !== void 0) out = out.replaceAll("__BRANCH__", () => branch);
+	if (isTag) out = out.replaceAll("__TAG_PATTERN__", () => tagPattern);
+	const generatedIds = [];
+	if (isTag && branch !== void 0) generatedIds.push("tailor-tag-guard", "tailor-tag-guard/tailor-checkout", "tailor-tag-guard/tailor-tag-guard");
+	generatedIds.push("tailor-plan", "tailor-plan/tailor-checkout", "tailor-plan/tailor-setup", "tailor-plan/tailor-drift-check");
+	for (const group of actionGroups) {
+		for (const app of group.apps) generatedIds.push(`tailor-plan/tailor-generate-check-${app.name}`);
+		generatedIds.push(`tailor-plan/tailor-plan-${group.id}`);
 	}
-	for (const finding of findings) logger.warn(`[${finding.target}] ${finding.message} (ignore key: ${finding.rule})`);
-	throw new Error(`Detected ${String(findings.length)} drift finding(s) across ${String(count)} target(s). Re-run \`tailor-sdk setup\` to regenerate, or address each finding above.`);
+	generatedIds.push("tailor-deploy", "tailor-deploy/tailor-checkout", "tailor-deploy/tailor-setup");
+	for (const group of actionGroups) {
+		for (const app of group.apps) if (group.apps.length > 1 && app.hasStaticWebsites) generatedIds.push(`tailor-deploy/tailor-build-site-${app.name}`);
+		generatedIds.push(`tailor-deploy/tailor-deploy-${group.id}`);
+	}
+	return {
+		content: out,
+		generatedIds
+	};
+}
+/**
+* Render the content of the user-owned .github/actions/tailor-setup/action.yml local action.
+*
+* This file is generated once by `setup coordinate` and never overwritten.
+* It wraps the setup and install actions with the package manager baked in.
+* @param params - Package manager configuration
+* @returns File content string
+*/
+function renderTailorSetupAction(params) {
+	const { packageManager } = params;
+	return [
+		`# This file is user-owned. Generated once by \`tailor setup coordinate\` and never overwritten.`,
+		`# Customize freely: add pre/post steps, change install flags, etc.`,
+		`name: Tailor Setup`,
+		`description: Install dependencies and run tailor setup for composite action callers.`,
+		`runs:`,
+		`  using: composite`,
+		`  steps:`,
+		`    - uses: tailor-platform/actions/setup@${ACTIONS_SHA} # v1.5.1`,
+		`      with:`,
+		`        package-manager: ${packageManager}`,
+		`    # Add custom steps here (e.g. private registry authentication)`,
+		`    - uses: tailor-platform/actions/install@${ACTIONS_SHA} # v1.5.1`,
+		`      with:`,
+		`        package-manager: ${packageManager}`,
+		`        # editable: install-command:`,
+		``
+	].join("\n");
 }
 
 //#endregion
 //#region src/cli/commands/setup/generate.ts
+function actionName(input) {
+	return input.startsWith("tailor-") ? input.slice(7) : input;
+}
+function splitActionGroup(input) {
+	const names = input.split(",").map((entry) => actionName(entry.trim()));
+	if (names.some((name) => name.length === 0)) throw new Error("--action must contain one or more non-empty action names.");
+	return names;
+}
+function uniqueGroupId(names, usedIds) {
+	const base = names.join("-");
+	let id = base;
+	let suffix = 2;
+	while (usedIds.has(id)) {
+		id = `${base}-${suffix}`;
+		suffix += 1;
+	}
+	usedIds.add(id);
+	return id;
+}
 async function defaultLoadConfigName(configPath) {
 	const { config } = await loadConfig(configPath);
 	return config.name;
 }
+async function defaultLoadErdNamespaces$1(configPath) {
+	const { config } = await loadConfig(configPath);
+	return extractOwnedNamespaces(config);
+}
+async function defaultLoadHasMigrations$1(configPath) {
+	const { config } = await loadConfig(configPath);
+	return getNamespacesWithMigrations(config, path.dirname(configPath)).length > 0;
+}
+async function defaultLoadHasSeeds$1(configPath) {
+	const { plugins } = await loadConfig(configPath);
+	return plugins.some((p) => p.id === "@tailor-platform/seed");
+}
+async function defaultLoadHasStaticWebsites$1(configPath) {
+	const { config } = await loadConfig(configPath);
+	return (config.staticWebsites?.length ?? 0) > 0;
+}
 const WORKSPACE_NAME_RE = /^[a-z0-9-]+$/;
 function validateWorkspaceName(name) {
-	if (name.length < 3 || name.length > 63 || !WORKSPACE_NAME_RE.test(name) || name.startsWith("-") || name.endsWith("-")) throw new Error(`Invalid workspace name "${name}". Names must be 3-63 characters of lowercase letters, numbers, and hyphens, and cannot start or end with a hyphen. Pass a valid name with --workspace-name.`);
+	if (name.length < 3 || name.length > 63 || !WORKSPACE_NAME_RE.test(name) || name.startsWith("-") || name.endsWith("-")) throw new Error(`Invalid workspace name "${name}". Names must be 3-63 characters of lowercase letters, numbers, and hyphens, and cannot start or end with a hyphen. Pass a valid name with --name.`);
 }
 const BRANCH_RE = /^[A-Za-z0-9._/-]+$/;
 const TAG_PATTERN_RE = /^[A-Za-z0-9._/*?![\]-]+$/;
@@ -2863,11 +3610,19 @@ const ENVIRONMENT_RE = /^[A-Za-z0-9._/-]+$/;
 function validateEnvironment(environment) {
 	if (!ENVIRONMENT_RE.test(environment)) throw new Error(`Invalid environment name "${environment}". Only letters, numbers, ".", "_", "/", and "-" are supported.`);
 }
+const REGION_RE = /^[A-Za-z0-9._-]+$/;
+function validateRegion(region) {
+	if (!REGION_RE.test(region)) throw new Error(`Invalid region "${region}". Only letters, numbers, ".", "_", and "-" are supported.`);
+}
 const DIR_RE = /^[A-Za-z0-9._/-]+$/;
 function validateDir(dir) {
 	if (!DIR_RE.test(dir)) throw new Error(`Invalid --dir "${dir}". Only letters, numbers, ".", "_", "/", and "-" are supported.`);
 }
-function escapesRoot(rel) {
+const ERD_NAMESPACE_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function validateErdNamespaces(namespaces) {
+	for (const namespace of namespaces) if (!ERD_NAMESPACE_RE.test(namespace)) throw new Error(`TailorDB namespace "${namespace}" cannot be used in --erd-preview. Only letters, numbers, '.', '_', and '-' are supported, and the name must start with a letter or number.`);
+}
+function escapesRoot$1(rel) {
 	return rel === ".." || rel.startsWith(`..${path.sep}`) || rel.startsWith("../") || path.isAbsolute(rel);
 }
 /**
@@ -2883,11 +3638,11 @@ function escapesRoot(rel) {
 function resolveConfigPath(outputDir, dir) {
 	const appDir = path.resolve(outputDir, dir);
 	const rel = path.relative(outputDir, appDir);
-	if (path.isAbsolute(dir) || escapesRoot(rel)) throw new Error(`--dir must be a relative path inside the repository (got "${dir}").`);
+	if (path.isAbsolute(dir) || escapesRoot$1(rel)) throw new Error(`--dir must be a relative path inside the repository (got "${dir}").`);
 	if (fs$1.existsSync(appDir)) {
 		const realAppDir = path.normalize(fs$1.realpathSync(appDir));
 		const realOutputDir = path.normalize(fs$1.realpathSync(outputDir));
-		if (escapesRoot(path.relative(realOutputDir, realAppDir))) throw new Error(`--dir must resolve to a directory inside the repository (got "${dir}", which links outside it).`);
+		if (escapesRoot$1(path.relative(realOutputDir, realAppDir))) throw new Error(`--dir must resolve to a directory inside the repository (got "${dir}", which links outside it).`);
 	}
 	const configPath = path.join(appDir, "tailor.config.ts");
 	if (!fs$1.existsSync(configPath)) throw new Error(`tailor.config.ts not found at ${configPath}. Run this from your SDK project root, or pass the app directory with --dir.`);
@@ -2899,16 +3654,15 @@ function resolveConfigPath(outputDir, dir) {
 * @returns Resolved target metadata and rendered content
 */
 async function resolve$1(options) {
-	if (options.tag && !options.plan) throw new Error("--no-plan cannot be combined with --tag (tag targets always run plan before deploy). Drop --no-plan or use a branch target.");
 	const dir = options.dir.replaceAll("\\", "/").replace(/\/{2,}/g, "/").replace(/^\.\//, "").replace(/\/$/, "") || ".";
 	validateDir(dir);
 	const workingDirectory = dir !== "." ? dir : void 0;
 	const configPath = resolveConfigPath(options.outputDir, dir);
 	const loadName = options.loadConfigName ?? defaultLoadConfigName;
 	const workspaceName = options.workspaceName ?? await loadName(configPath);
-	if (!workspaceName) throw new Error("Could not determine the workspace name. Pass --workspace-name, or set 'name' in tailor.config.ts.");
+	if (!workspaceName) throw new Error("Could not determine the workspace name. Pass --name, or set 'name' in tailor.config.ts.");
 	validateWorkspaceName(workspaceName);
-	const kind = options.tag ? "tag" : "branch";
+	const { kind } = options;
 	const packageManager = detectPackageManager(options.outputDir);
 	const environment = options.environment ?? workspaceName;
 	validateEnvironment(environment);
@@ -2916,39 +3670,86 @@ async function resolve$1(options) {
 	let branch = null;
 	let branchAutoDetected = false;
 	let render;
+	let erdNamespaces = [];
+	let hasMigrations = false;
+	let hasSeeds = false;
+	let hasStaticWebsites = false;
+	const loadHasMigrations = options.loadHasMigrations ?? defaultLoadHasMigrations$1;
+	const loadHasSeeds = options.loadHasSeeds ?? defaultLoadHasSeeds$1;
+	const loadHasStaticWebsites = options.loadHasStaticWebsites ?? defaultLoadHasStaticWebsites$1;
 	if (kind === "branch") {
+		if (options.erdPreview) {
+			erdNamespaces = await (options.loadErdNamespaces ?? defaultLoadErdNamespaces$1)(configPath);
+			if (erdNamespaces.length === 0) throw new Error("No TailorDB namespaces found for --erd-preview. Define owned db namespaces in tailor.config.ts.");
+			validateErdNamespaces(erdNamespaces);
+		}
 		branchAutoDetected = options.branch === void 0;
 		branch = options.branch ?? detectDefaultBranch(options.outputDir, options.gitRunner);
 		validateBranch(branch);
+		hasMigrations = await loadHasMigrations(configPath);
+		hasSeeds = await loadHasSeeds(configPath);
 		render = renderBranchWorkflow({
 			workspaceName,
 			branch,
 			workingDirectory,
 			environment,
 			packageManager,
-			plan: options.plan
+			erdPreview: options.erdPreview ? { namespaces: erdNamespaces } : null,
+			migrationDriftCheck: hasMigrations,
+			seedValidate: hasSeeds
 		});
-	} else {
+	} else if (kind === "tag") {
 		branch = options.branch ?? null;
 		if (branch !== null) validateBranch(branch);
+		hasMigrations = await loadHasMigrations(configPath);
+		hasSeeds = await loadHasSeeds(configPath);
 		render = renderTagWorkflow({
 			workspaceName,
 			tagPattern: options.tagPattern,
 			branch: options.branch,
 			workingDirectory,
 			environment,
-			packageManager
+			packageManager,
+			migrationDriftCheck: hasMigrations,
+			seedValidate: hasSeeds
+		});
+	} else if (kind === "preview") {
+		branchAutoDetected = options.branch === void 0;
+		branch = options.branch ?? detectDefaultBranch(options.outputDir, options.gitRunner);
+		validateBranch(branch);
+		validateRegion(options.region);
+		render = renderPreviewWorkflow({
+			workspaceName,
+			branch,
+			workingDirectory,
+			environment,
+			packageManager,
+			region: options.region,
+			requirePreviewLabel: options.requirePreviewLabel ?? false
+		});
+	} else {
+		hasStaticWebsites = await loadHasStaticWebsites(configPath);
+		render = renderActionWorkflow({
+			workspaceName,
+			workingDirectory,
+			hasStaticWebsites
 		});
 	}
-	const file = `.github/workflows/tailor-${workspaceName}.yml`;
+	const file = kind === "action" ? `.github/actions/tailor-${workspaceName}/action.yml` : `.github/workflows/tailor-${workspaceName}${kind === "tag" ? "-tag" : kind === "preview" ? "-preview" : ""}.yml`;
 	const inputs = {
-		branch,
-		branchAutoDetected: kind === "branch" ? branchAutoDetected : void 0,
+		branch: kind === "action" ? null : branch,
+		branchAutoDetected: kind === "branch" || kind === "preview" ? branchAutoDetected : void 0,
 		tagPattern: kind === "tag" ? options.tagPattern : null,
 		environment,
 		dir,
 		packageManager,
-		plan: kind === "branch" ? options.plan : true
+		region: kind === "preview" ? options.region : void 0,
+		requirePreviewLabel: kind === "preview" ? options.requirePreviewLabel ?? false : void 0,
+		erdPreview: kind === "branch" ? options.erdPreview : false,
+		erdNamespaces: kind === "branch" && options.erdPreview ? erdNamespaces : void 0,
+		migrationDriftCheck: kind === "branch" || kind === "tag" ? hasMigrations : void 0,
+		seedValidate: kind === "branch" || kind === "tag" ? hasSeeds : void 0,
+		hasStaticWebsites: kind === "action" ? hasStaticWebsites : void 0
 	};
 	return {
 		kind,
@@ -2956,12 +3757,47 @@ async function resolve$1(options) {
 		branch,
 		environment,
 		packageManager,
+		erdNamespaces,
 		render,
 		inputs,
 		file,
 		configPath
 	};
 }
+const BUILD_SITE_RUN_RE = /([ \t]*- id: build-site\n(?:[ \t]+if: [^\n]+\n)?[ \t]+shell: bash\n[ \t]+run: \|)([\s\S]*?)(\n[ \t]*- |\n*$)/;
+/**
+* Strip the mutable run: body of the build-site step before hashing.
+* When hasStaticWebsites is true the step is present; users are expected to
+* replace the placeholder command with their actual build command.  We only
+* hash the structural parts (step id, shell declaration, run: key) so that
+* editing the build command does not look like unintended drift.
+* When hasStaticWebsites is false the step is absent, so the regex is a no-op.
+* @param content - Raw action workflow content
+* @returns Normalised content with the build-site run body replaced by a placeholder
+*/
+function normalizeActionContent(content) {
+	return content.replace(BUILD_SITE_RUN_RE, (_, header, _body, tail) => `${header}\n        true${tail}`);
+}
+/**
+* Extract the run: body of the build-site step from action content.
+* Returns null when the step is absent (hasStaticWebsites is false).
+* @param content - Action workflow content
+* @returns The captured run body string (includes leading newline), or null
+*/
+function extractBuildSiteRunBody(content) {
+	const m = BUILD_SITE_RUN_RE.exec(content);
+	return m ? m[2] ?? null : null;
+}
+/**
+* Replace the run: body of the build-site step in action content.
+* No-op when the step is absent.
+* @param content - Target action workflow content
+* @param body - Run body to inject (includes leading newline and indentation)
+* @returns Content with the run body replaced
+*/
+function injectBuildSiteRunBody(content, body) {
+	return content.replace(BUILD_SITE_RUN_RE, (_, header, _placeholder, tail) => `${header}${body}${tail}`);
+}
 /**
 * Decide how to reconcile a target with the on-disk file and lock state.
 * @param obj - Decision inputs
@@ -2969,10 +3805,11 @@ async function resolve$1(options) {
 * @param obj.fileExists - Whether the workflow file is present on disk
 * @param obj.currentContent - On-disk content when present
 * @param obj.force - Whether --force was passed
+* @param obj.normalize - Optional content normaliser applied before hashing
 * @returns The reconciliation action
 */
 function decideAction(obj) {
-	const { existing, fileExists, currentContent, force } = obj;
+	const { existing, fileExists, currentContent, force, normalize } = obj;
 	if (!existing) {
 		if (!fileExists) return { action: "create" };
 		if (force) return { action: "regenerate" };
@@ -2982,7 +3819,9 @@ function decideAction(obj) {
 		};
 	}
 	if (!fileExists) return { action: "restore" };
-	if (currentContent !== null && hashContent(currentContent) === existing.contentHash) return { action: "regenerate" };
+	if (currentContent !== null) {
+		if (hashContent(normalize ? normalize(currentContent) : currentContent) === existing.contentHash) return { action: "regenerate" };
+	}
 	if (force) return { action: "regenerate" };
 	return {
 		action: "conflict",
@@ -3000,7 +3839,7 @@ function decideAction(obj) {
 function assertNoKindCollision(obj) {
 	const { lock, kind, workspaceName, file } = obj;
 	const collision = lock?.targets.find((t) => t.file === file && !(t.kind === kind && t.workspaceName === workspaceName));
-	if (collision) throw new Error(`A ${collision.kind} target already owns ${file}, which conflicts with this ${kind} target. Pass a different name with --workspace-name to generate a separate workflow.`);
+	if (collision) throw new Error(`A ${collision.kind} target already owns ${file}, which conflicts with this ${kind} target. Pass a different name with --name to generate a separate workflow.`);
 }
 /**
 * Print next-step guidance after generating workflow files.
@@ -3018,20 +3857,19 @@ function printNextSteps(obj) {
 	logger.log(`   gh secret set TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET --env ${environment}`);
 	logger.newline();
 	logger.log(`2. Provision the workspace and set its id as the TAILOR_PLATFORM_WORKSPACE_ID variable on the "${environment}" environment:`);
-	logger.log("   tailor-sdk workspace create   # if it does not exist yet; copy the id");
+	logger.log("   tailor workspace create   # if it does not exist yet; copy the id");
 	logger.log(`   gh variable set TAILOR_PLATFORM_WORKSPACE_ID --env ${environment}`);
 	logger.newline();
 	logger.log("3. Commit the generated files:");
 	logger.log("   - .github/workflows/tailor-*.yml");
-	logger.log("   - .github/tailor-sdk.lock");
+	logger.log("   - .github/tailor.lock");
 	if (idInjected) logger.log("   - tailor.config.ts (app id was added)");
 }
 /**
-* Generate the GitHub Actions workflow for a deploy target and reconcile it
-* with the lock file.
+* Generate a deploy target workflow and reconcile it with the lock file.
 * @param options - Setup options
 */
-async function setupGitHub(options) {
+async function setupTarget(options) {
 	logBetaWarning("setup");
 	const resolved = await resolve$1(options);
 	const lock = readLock(options.outputDir);
@@ -3044,27 +3882,35 @@ async function setupGitHub(options) {
 	});
 	const existing = findTarget(lock, resolved.kind, resolved.workspaceName);
 	const fileExists = fs$1.existsSync(absFile);
+	const currentContent = fileExists ? fs$1.readFileSync(absFile, "utf-8") : null;
+	const normalize = resolved.kind === "action" ? normalizeActionContent : void 0;
 	const decision = decideAction({
 		existing,
 		fileExists,
-		currentContent: fileExists ? fs$1.readFileSync(absFile, "utf-8") : null,
-		force: options.force
+		currentContent,
+		force: options.force,
+		normalize
 	});
 	if (decision.action === "conflict") throw new Error(`${resolved.file}: ${decision.reason}`);
 	const idResult = await ensureConfigId(resolved.configPath);
 	if (idResult === null) logger.warn("Could not find a defineConfig() call to confirm an app id. The CI deploy will fail unless your config resolves to one with an 'id'.");
 	const idInjected = idResult?.injected ?? false;
+	let contentToWrite = resolved.render.content;
+	if (decision.action === "regenerate" && normalize && currentContent !== null) {
+		const existingBody = extractBuildSiteRunBody(currentContent);
+		if (existingBody !== null) contentToWrite = injectBuildSiteRunBody(contentToWrite, existingBody);
+	}
 	fs$1.mkdirSync(path.dirname(absFile), { recursive: true });
-	fs$1.writeFileSync(absFile, resolved.render.content, "utf-8");
+	fs$1.writeFileSync(absFile, contentToWrite, "utf-8");
 	const newTarget = {
 		kind: resolved.kind,
 		workspaceName: resolved.workspaceName,
 		file: resolved.file,
-		templateVersion: 2,
+		templateVersion: 7,
 		inputs: resolved.inputs,
 		generatedIds: resolved.render.generatedIds,
 		ejectedIds: existing?.ejectedIds ?? [],
-		contentHash: hashContent(resolved.render.content)
+		contentHash: hashContent(normalize ? normalize(resolved.render.content) : resolved.render.content)
 	};
 	const targets = [...lock?.targets ?? []];
 	const index = targets.findIndex((t) => t.kind === newTarget.kind && t.workspaceName === newTarget.workspaceName);
@@ -3077,150 +3923,569 @@ async function setupGitHub(options) {
 	if (decision.action === "restore") logger.success(`Regenerated ${styles.path(resolved.file)} (was missing on disk)`);
 	else if (decision.action === "regenerate") logger.success(`Regenerated ${styles.path(resolved.file)}`);
 	else logger.success(`Generated ${styles.path(resolved.file)}`);
-	printNextSteps({
+	if (resolved.kind === "action") {
+		logger.newline();
+		logger.info("Next steps:");
+		logger.newline();
+		logger.log(`The composite action has been generated at ${styles.path(resolved.file)}.`);
+		logger.log("Use `tailor setup coordinate` to generate a coordinator workflow that orchestrates this action.");
+	} else printNextSteps({
 		environment: resolved.environment,
 		idInjected
 	});
 }
+/**
+* Generate the coordinator workflow that orchestrates per-app composite actions.
+*
+* Unlike `setupTarget`, this function does not read a Tailor config. The coordinator
+* name is required via `--name`. App working directories are resolved from
+* the lock file entries created by `setup action`.
+* @param options - Coordinate setup options
+*/
+async function setupCoordinate(options) {
+	logBetaWarning("setup");
+	const { coordinatorName, coordinateKind, actions, force, outputDir } = options;
+	validateWorkspaceName(coordinatorName);
+	if (actions.length === 0) throw new Error("At least one --action is required. Run `tailor setup action --dir <app-dir>` for each app first.");
+	const environment = options.environment ?? coordinatorName;
+	validateEnvironment(environment);
+	let branch = null;
+	let branchAutoDetected = false;
+	if (coordinateKind === "branch") {
+		branchAutoDetected = options.branch === void 0;
+		branch = options.branch ?? detectDefaultBranch(outputDir, options.gitRunner);
+		validateBranch(branch);
+	} else if (options.branch !== void 0) {
+		validateBranch(options.branch);
+		branch = options.branch;
+	}
+	const tagPattern = options.tagPattern ?? "v*";
+	if (coordinateKind === "tag") validateTagPattern(tagPattern);
+	const packageManager = detectPackageManager(outputDir);
+	const lock = readLock(outputDir);
+	if (!lock) throw new Error(".github/tailor.lock not found. Run `tailor setup action --name <name>` for each app before running setup coordinate.");
+	const actionTargets = new Map(lock.targets.filter((t) => t.kind === "action").map((target) => [target.workspaceName, target]));
+	const seenNames = /* @__PURE__ */ new Set();
+	const usedGroupIds = /* @__PURE__ */ new Set();
+	const actionGroups = actions.map((actionGroup) => {
+		const names = splitActionGroup(actionGroup);
+		const apps = names.map((name) => {
+			if (seenNames.has(name)) throw new Error(`Duplicate --action "${name}". Each composite action can only appear once in a coordinator.`);
+			seenNames.add(name);
+			const entry = actionTargets.get(name);
+			if (!entry) throw new Error(`Action target "${name}" not found in .github/tailor.lock. Run \`tailor setup action --name ${name}\` first.`);
+			if (names.length > 1 && entry.templateVersion < 7) throw new Error(`Action target "${name}" was generated with an older setup template. Run \`tailor setup action --name ${name} --force\` before grouping it in setup coordinate.`);
+			validateDir(entry.inputs.dir);
+			return {
+				name,
+				dir: entry.inputs.dir,
+				hasStaticWebsites: entry.inputs.hasStaticWebsites
+			};
+		});
+		return {
+			id: uniqueGroupId(names, usedGroupIds),
+			apps
+		};
+	});
+	const render = renderCoordinateWorkflow({
+		coordinatorName,
+		kind: coordinateKind,
+		actionGroups,
+		branch: branch ?? void 0,
+		tagPattern: coordinateKind === "tag" ? tagPattern : void 0,
+		environment,
+		packageManager
+	});
+	const file = `.github/workflows/tailor-coordinate-${coordinatorName}${coordinateKind === "tag" ? "-tag" : ""}.yml`;
+	const absFile = path.join(outputDir, file);
+	assertNoKindCollision({
+		lock,
+		kind: "coordinate",
+		workspaceName: coordinatorName,
+		file
+	});
+	const existing = findTarget(lock, "coordinate", coordinatorName);
+	const fileExists = fs$1.existsSync(absFile);
+	const decision = decideAction({
+		existing,
+		fileExists,
+		currentContent: fileExists ? fs$1.readFileSync(absFile, "utf-8") : null,
+		force
+	});
+	if (decision.action === "conflict") throw new Error(`${file}: ${decision.reason}`);
+	fs$1.mkdirSync(path.dirname(absFile), { recursive: true });
+	fs$1.writeFileSync(absFile, render.content, "utf-8");
+	const tailorSetupFile = ".github/actions/tailor-setup/action.yml";
+	const absTailorSetupFile = path.join(outputDir, tailorSetupFile);
+	if (!fs$1.existsSync(absTailorSetupFile)) {
+		fs$1.mkdirSync(path.dirname(absTailorSetupFile), { recursive: true });
+		fs$1.writeFileSync(absTailorSetupFile, renderTailorSetupAction({ packageManager }), "utf-8");
+		logger.success(`Generated ${styles.path(tailorSetupFile)}`);
+	}
+	const newTarget = {
+		kind: "coordinate",
+		workspaceName: coordinatorName,
+		file,
+		templateVersion: 7,
+		inputs: {
+			branch,
+			branchAutoDetected: coordinateKind === "branch" ? branchAutoDetected : branch !== null ? false : void 0,
+			tagPattern: coordinateKind === "tag" ? tagPattern : null,
+			environment,
+			dir: ".",
+			packageManager,
+			actionDirs: actionGroups.flatMap((group) => group.apps.map((a) => a.dir))
+		},
+		generatedIds: render.generatedIds,
+		ejectedIds: existing?.ejectedIds ?? [],
+		contentHash: hashContent(render.content)
+	};
+	const targets = [...lock.targets];
+	const idx = targets.findIndex((t) => t.kind === newTarget.kind && t.workspaceName === newTarget.workspaceName);
+	if (idx === -1) targets.push(newTarget);
+	else targets[idx] = newTarget;
+	writeLock(outputDir, {
+		version: 1,
+		targets
+	});
+	if (decision.action === "restore") logger.success(`Regenerated ${styles.path(file)} (was missing on disk)`);
+	else if (decision.action === "regenerate") logger.success(`Regenerated ${styles.path(file)}`);
+	else logger.success(`Generated ${styles.path(file)}`);
+	logger.newline();
+	logger.info("Next steps:");
+	logger.newline();
+	logger.log(`1. Set the machine-user credentials as secrets on the "${environment}" environment:`);
+	logger.log(`   gh secret set TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID --env ${environment}`);
+	logger.log(`   gh secret set TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET --env ${environment}`);
+	logger.newline();
+	logger.log(`2. Provision the target workspace and set TAILOR_PLATFORM_WORKSPACE_ID on the "${environment}" environment:`);
+	logger.log("   tailor workspace create   # if it does not exist yet; copy the id");
+	logger.log(`   gh variable set TAILOR_PLATFORM_WORKSPACE_ID --env ${environment}`);
+	logger.newline();
+	logger.log("3. Commit the generated files:");
+	logger.log(`   - ${file}`);
+	logger.log(`   - ${tailorSetupFile}  (if newly created)`);
+	logger.log("   - .github/tailor.lock");
+}
+
+//#endregion
+//#region src/cli/commands/setup/check.ts
+/**
+* Compute drift findings for one target by comparing its recorded lock state
+* against the current repository/config state.
+* @param target - The lock target being audited
+* @param state - Current repository/config state for this target
+* @returns Drift findings (empty when the target is in sync)
+*/
+function findTargetDrift(target, state) {
+	const id = `${target.kind} ${target.workspaceName}`;
+	const findings = [];
+	if (!state.fileExists) findings.push({
+		target: id,
+		rule: "missing-file",
+		message: `${target.file} is missing or unreadable. Re-run setup to restore it.`
+	});
+	else if (state.currentHash !== null && state.currentHash !== target.contentHash) findings.push({
+		target: id,
+		rule: "hand-edit",
+		message: `${target.file} was edited by hand since it was generated. Re-run setup with --force to regenerate, or keep customizations in your own jobs/steps.`
+	});
+	if (target.templateVersion < state.templateVersion) findings.push({
+		target: id,
+		rule: "template-version",
+		message: `A newer workflow template is available (generated with v${String(target.templateVersion)}, current v${String(state.templateVersion)}). Re-run setup to update.`
+	});
+	if (!state.configExists) findings.push({
+		target: id,
+		rule: "config-dir",
+		message: `tailor.config.ts not found under "${target.inputs.dir}". The app directory may have moved; re-run setup with the correct --dir.`
+	});
+	if ((target.kind === "branch" || target.kind === "coordinate" || target.kind === "preview") && target.inputs.branchAutoDetected !== false && state.defaultBranch !== null && target.inputs.branch !== null && target.inputs.branch !== state.defaultBranch) findings.push({
+		target: id,
+		rule: "default-branch",
+		message: `The workflow triggers on "${target.inputs.branch}" but the repository default branch is now "${state.defaultBranch}". If this is intentional, ignore this; otherwise re-run setup so the trigger matches the default branch.`
+	});
+	if (target.kind === "branch" && target.inputs.erdPreview && state.configExists) {
+		const recorded = [...target.inputs.erdNamespaces ?? []].toSorted((a, b) => a.localeCompare(b));
+		const current = state.erdNamespaces?.toSorted((a, b) => a.localeCompare(b)) ?? null;
+		if (current === null || recorded.length !== current.length || recorded.some((namespace, index) => namespace !== current[index])) findings.push({
+			target: id,
+			rule: "erd-namespaces",
+			message: "TailorDB namespaces for ERD preview changed. Re-run setup so the ERD preview matrix is regenerated."
+		});
+	}
+	if ((target.kind === "branch" || target.kind === "tag") && target.inputs.migrationDriftCheck === false && state.hasMigrations === true) findings.push({
+		target: id,
+		rule: "migration-drift",
+		message: "TailorDB namespaces with migrations were added to the config. Re-run setup so the tailor-migration-drift-check step is included in the plan job."
+	});
+	if ((target.kind === "branch" || target.kind === "tag") && target.inputs.seedValidate === false && state.hasSeeds === true) findings.push({
+		target: id,
+		rule: "seed-validate",
+		message: "Seed plugin detected in the current config. Re-run setup so the tailor-seed-validate step is included in the plan job."
+	});
+	if (target.kind === "action" && target.inputs.hasStaticWebsites === false && state.hasStaticWebsites === true) findings.push({
+		target: id,
+		rule: "static-websites",
+		message: "Static websites were added to the config. Re-run setup so the build-site slot is included in the composite action."
+	});
+	return findings;
+}
+function detectDefaultBranchSafe(cwd, run) {
+	try {
+		return detectDefaultBranch(cwd, run);
+	} catch {
+		return null;
+	}
+}
+function escapesRoot(rel) {
+	return path.isAbsolute(rel) || rel === ".." || rel.startsWith(`..${path.sep}`) || rel.startsWith("../");
+}
+function resolveWithinRoot(outputDir, relPath) {
+	if (path.isAbsolute(relPath)) return null;
+	const abs = path.join(outputDir, relPath);
+	if (escapesRoot(path.relative(outputDir, abs))) return null;
+	try {
+		if (escapesRoot(path.relative(fs$1.realpathSync(outputDir), fs$1.realpathSync(abs)))) return null;
+	} catch {}
+	return abs;
+}
+function readHash(absFile, normalize) {
+	try {
+		const content = fs$1.readFileSync(absFile, "utf-8");
+		return hashContent(normalize ? normalize(content) : content);
+	} catch {
+		return null;
+	}
+}
+async function defaultLoadErdNamespaces(configPath) {
+	const { config } = await loadConfig(configPath);
+	return extractOwnedNamespaces(config);
+}
+async function defaultLoadHasMigrations(configPath) {
+	const { config } = await loadConfig(configPath);
+	return getNamespacesWithMigrations(config, path.dirname(configPath)).length > 0;
+}
+async function defaultLoadHasSeeds(configPath) {
+	const { plugins } = await loadConfig(configPath);
+	return plugins.some((p) => p.id === "@tailor-platform/seed");
+}
+async function defaultLoadHasStaticWebsites(configPath) {
+	const { config } = await loadConfig(configPath);
+	return (config.staticWebsites?.length ?? 0) > 0;
+}
+/**
+* Audit the generated workflows for drift against the current config/repo
+* state. Read-only: never writes files, the lock, or the config.
+*
+* Throws when drift is found (so it composes like the other `:check`
+* commands). The workflow drift-check step layers advisory behaviour on top
+* (per-rule ignore / continue-on-error); the CLI itself reports via exit code.
+* @param options - Check options
+*/
+async function checkGitHub(options) {
+	logBetaWarning("setup");
+	const { outputDir } = options;
+	const lock = readLock(outputDir);
+	if (!lock || lock.targets.length === 0) throw new Error("No managed workflows found (.github/tailor.lock is missing or empty). Run `tailor setup branch` (or another setup subcommand) first.");
+	if (!options.ci) {
+		if (lock.targets.some((t) => t.kind === "branch" || t.kind === "tag" || t.kind === "coordinate") && !process.env["TAILOR_PLATFORM_WORKSPACE_ID"]) throw new Error("TAILOR_PLATFORM_WORKSPACE_ID is not set. Provision the workspace and set the variable:\n  tailor workspace create   # if it does not exist yet; copy the id\n  gh variable set TAILOR_PLATFORM_WORKSPACE_ID --env <environment>");
+	}
+	const slackToken = Boolean(process.env["TAILOR_SLACK_BOT_TOKEN"]);
+	if (slackToken !== Boolean(process.env["TAILOR_SLACK_CHANNEL_ID"])) throw new Error(`Slack is partially configured: ${slackToken ? "TAILOR_SLACK_BOT_TOKEN is set" : "TAILOR_SLACK_CHANNEL_ID is set"} but not both. TAILOR_SLACK_BOT_TOKEN (secret) and TAILOR_SLACK_CHANNEL_ID (variable) must be set together, or neither should be set.`);
+	const exists = options.configExistsAt ?? ((p) => fs$1.existsSync(p));
+	const defaultBranch = detectDefaultBranchSafe(outputDir, options.gitRunner);
+	const loadErdNamespaces = options.loadErdNamespaces ?? defaultLoadErdNamespaces;
+	const loadHasMigrations = options.loadHasMigrations ?? defaultLoadHasMigrations;
+	const loadHasSeeds = options.loadHasSeeds ?? defaultLoadHasSeeds;
+	const loadHasStaticWebsites = options.loadHasStaticWebsites ?? defaultLoadHasStaticWebsites;
+	const findings = [];
+	for (const target of lock.targets) {
+		const absFile = resolveWithinRoot(outputDir, target.file);
+		const currentHash = absFile === null ? null : readHash(absFile, target.kind === "action" ? normalizeActionContent : void 0);
+		const configAbs = target.kind === "coordinate" ? null : resolveWithinRoot(outputDir, path.join(target.inputs.dir, "tailor.config.ts"));
+		const configExists = target.kind === "coordinate" || configAbs !== null && exists(configAbs);
+		const erdNamespaces = target.kind === "branch" && target.inputs.erdPreview && configAbs !== null && configExists ? await loadErdNamespaces(configAbs) : null;
+		const hasMigrations = (target.kind === "branch" || target.kind === "tag") && target.inputs.migrationDriftCheck !== void 0 && configAbs !== null && configExists ? await loadHasMigrations(configAbs) : void 0;
+		const hasSeeds = (target.kind === "branch" || target.kind === "tag") && target.inputs.seedValidate !== void 0 && configAbs !== null && configExists ? await loadHasSeeds(configAbs) : void 0;
+		const hasStaticWebsites = target.kind === "action" && target.inputs.hasStaticWebsites !== void 0 && configAbs !== null && configExists ? await loadHasStaticWebsites(configAbs) : void 0;
+		findings.push(...findTargetDrift(target, {
+			fileExists: currentHash !== null,
+			currentHash,
+			configExists,
+			defaultBranch,
+			templateVersion: 7,
+			erdNamespaces,
+			hasMigrations,
+			hasSeeds,
+			hasStaticWebsites
+		}));
+	}
+	const count = lock.targets.length;
+	if (findings.length === 0) {
+		logger.success(`No drift detected across ${String(count)} target(s).`);
+		return;
+	}
+	for (const finding of findings) logger.warn(`[${finding.target}] ${finding.message} (ignore key: ${finding.rule})`);
+	throw new Error(`Detected ${String(findings.length)} drift finding(s) across ${String(count)} target(s). Re-run \`tailor setup\` to regenerate, or address each finding above.`);
+}
+
+//#endregion
+//#region src/cli/commands/setup/delete.ts
+function normalizeRelPath(input) {
+	return input.replaceAll("\\", "/").replace(/\/{2,}/g, "/").replace(/^\.\//, "").replace(/\/$/, "");
+}
+function targetKey(target) {
+	return `${target.kind}:${target.workspaceName}`;
+}
+function resolveMatch(outputDir, targets, input) {
+	const relPath = normalizeRelPath(input);
+	const absPath = resolveWithinRoot(outputDir, relPath);
+	if (absPath === null) throw new Error(`"${input}" must be a path inside the repository.`);
+	const target = targets.find((t) => t.file === relPath);
+	if (!target) throw new Error(`"${relPath}" is not a managed workflow/action file (not recorded in .github/tailor-sdk.lock). Only files generated by \`tailor-sdk setup\` can be deleted with this command.`);
+	return {
+		relPath,
+		absPath,
+		target
+	};
+}
+function warnCoordinatorReferences(allTargets, deletedKeys, match) {
+	if (match.target.kind !== "action") return;
+	for (const coordinator of allTargets) if (coordinator.kind === "coordinate" && coordinator.inputs.actionDirs?.includes(match.target.inputs.dir) && !deletedKeys.has(targetKey(coordinator))) logger.warn(`Coordinator "${coordinator.workspaceName}" still references this action's directory (${match.target.inputs.dir}). Remove \`${match.target.workspaceName}\` from the relevant \`--action\` value and re-run \`tailor-sdk setup coordinate\` to update it.`);
+}
+/**
+* Delete managed workflow/action files and their `.github/tailor-sdk.lock` entries.
+*
+* Refuses to touch files that are not recorded in the lock, so it never
+* deletes hand-written workflows or the user-owned tailor-setup action.
+* @param options - Delete options
+*/
+async function setupDelete(options) {
+	logBetaWarning("setup");
+	const { outputDir, yes } = options;
+	const lock = readLock(outputDir);
+	if (!lock || lock.targets.length === 0) throw new Error("No managed workflows found (.github/tailor-sdk.lock is missing or empty). Run `tailor-sdk setup branch` (or another setup subcommand) first.");
+	const matches = [...new Set(options.files.map(normalizeRelPath))].map((relPath) => resolveMatch(outputDir, lock.targets, relPath));
+	const deletedKeys = new Set(matches.map((m) => targetKey(m.target)));
+	for (const match of matches) warnCoordinatorReferences(lock.targets, deletedKeys, match);
+	if (!yes) {
+		const list = matches.map((m) => m.relPath).join("\n  ");
+		if (!await prompt.confirm({
+			message: `This will delete the following file(s) and their .github/tailor-sdk.lock entries:\n  ${list}\nContinue?`,
+			default: false
+		})) {
+			logger.info("Delete cancelled.");
+			return;
+		}
+	}
+	const remaining = [...lock.targets];
+	try {
+		for (const { relPath, absPath, target } of matches) {
+			fs$1.rmSync(absPath, { force: true });
+			if (target.kind === "action") {
+				const dir = path.dirname(absPath);
+				if (fs$1.existsSync(dir) && fs$1.readdirSync(dir).length === 0) fs$1.rmdirSync(dir);
+			}
+			const index = remaining.findIndex((t) => targetKey(t) === targetKey(target));
+			if (index !== -1) remaining.splice(index, 1);
+			logger.success(`Deleted ${styles.path(relPath)} (${target.kind} ${target.workspaceName})`);
+		}
+	} finally {
+		if (remaining.length !== lock.targets.length) writeLock(outputDir, {
+			version: 1,
+			targets: remaining
+		});
+	}
+}
 
 //#endregion
 //#region src/cli/commands/setup/index.ts
 const checkCommand = defineAppCommand({
 	name: "check",
 	description: "Audit generated workflows for drift against the current config/repo (read-only).",
-	args: z.object({}).strict(),
-	run: () => {
-		checkGitHub({ outputDir: process.cwd() });
+	args: z.strictObject({ ci: arg(z.boolean().default(false), { description: "Run in CI mode: skip checks that are handled by the runtime (e.g. TAILOR_PLATFORM_WORKSPACE_ID)." }) }),
+	run: async (args) => {
+		await checkGitHub({
+			outputDir: process.cwd(),
+			ci: args.ci
+		});
+	}
+});
+const coordinateCommand = defineAppCommand({
+	name: "coordinate",
+	description: "Generate a coordinator workflow that orchestrates multiple --action-generated composite actions.",
+	args: z.strictObject({
+		name: arg(z.string().min(1), {
+			alias: "n",
+			description: "Coordinator name (used in the generated workflow file name and job names)"
+		}),
+		action: arg(z.array(z.string().min(1)).min(1), { description: "Composite action to include. Repeat for separate deploy steps, or use commas to deploy actions as one multi-config group. tailor- prefix optional." }),
+		branch: arg(z.string().min(1).optional(), { description: "Branch target: deploy trigger branch (defaults to the detected default branch)" }),
+		tag: arg(z.boolean().default(false), { description: "Generate a tag target coordinator" }),
+		environment: arg(z.string().min(1).optional(), { description: "GitHub Environment for the plan/deploy jobs" }),
+		force: arg(z.boolean().default(false), { description: "Discard hand edits and regenerate" })
+	}),
+	run: async (args) => {
+		const coordinateKind = args.tag ? "tag" : "branch";
+		await setupCoordinate({
+			coordinatorName: args.name,
+			coordinateKind,
+			actions: args.action,
+			branch: args.branch,
+			environment: args.environment,
+			force: args.force,
+			outputDir: process.cwd()
+		});
+	}
+});
+const actionCommand = defineAppCommand({
+	name: "action",
+	description: "Generate a per-app composite action for use with setup coordinate (monorepo multi-app deploys).",
+	args: z.strictObject({
+		name: arg(z.string().min(1).optional(), {
+			alias: "n",
+			description: "Name (defaults to the config 'name')"
+		}),
+		dir: arg(z.string().min(1).default("."), {
+			alias: "d",
+			description: "App directory"
+		}),
+		environment: arg(z.string().min(1).optional(), { description: "GitHub Environment (defaults to the workspace name)" }),
+		force: arg(z.boolean().default(false), { description: "Discard hand edits and regenerate" })
+	}),
+	run: async (args) => {
+		await setupTarget({
+			kind: "action",
+			workspaceName: args.name,
+			dir: args.dir,
+			environment: args.environment,
+			force: args.force,
+			outputDir: process.cwd()
+		});
 	}
 });
-const setupCommand = defineAppCommand({
-	name: "setup",
-	description: "Generate a CI deploy workflow for your project. (beta)",
-	args: z.object({
-		provider: arg(z.enum(["github"], { message: "Only the 'github' provider is supported." }).default("github"), {
-			alias: "p",
-			description: "CI provider to generate for (only 'github' is supported)"
+const branchCommand = defineAppCommand({
+	name: "branch",
+	description: "Generate a branch-target deploy workflow (push to branch triggers deploy).",
+	args: z.strictObject({
+		name: arg(z.string().min(1).optional(), {
+			alias: "n",
+			description: "Name (defaults to the config 'name')"
+		}),
+		branch: arg(z.string().min(1).optional(), { description: "Deploy trigger branch (defaults to the detected default branch)" }),
+		environment: arg(z.string().min(1).optional(), { description: "GitHub Environment for the plan/deploy jobs (defaults to the workspace name)" }),
+		"erd-preview": arg(z.boolean().default(false), { description: "Add PR ERD viewer artifacts with current/diff previews for TailorDB namespaces" }),
+		dir: arg(z.string().min(1).default("."), {
+			alias: "d",
+			description: "App directory (for monorepo setups)"
 		}),
-		"workspace-name": arg(z.string().min(1).optional(), {
+		force: arg(z.boolean().default(false), { description: "Discard hand edits / take over unmanaged files and regenerate" })
+	}),
+	run: async (args) => {
+		await setupTarget({
+			kind: "branch",
+			workspaceName: args.name,
+			branch: args.branch,
+			environment: args.environment,
+			erdPreview: args["erd-preview"],
+			dir: args.dir,
+			force: args.force,
+			outputDir: process.cwd()
+		});
+	}
+});
+const tagCommand = defineAppCommand({
+	name: "tag",
+	description: "Generate a tag-target deploy workflow (tag push triggers deploy).",
+	args: z.strictObject({
+		name: arg(z.string().min(1).optional(), {
 			alias: "n",
-			description: "Workspace name (defaults to the config 'name')"
+			description: "Name (defaults to the config 'name')"
 		}),
-		branch: arg(z.string().min(1).optional(), { description: "Branch target: deploy trigger branch (defaults to the detected default branch). Tag target: tag-reachability guard branch (no guard when omitted)" }),
-		tag: arg(z.boolean().default(false), { description: "Generate a tag target (deploy on tag push)" }),
-		"tag-pattern": arg(z.string().min(1).optional(), { description: "Tag glob to match (requires --tag; defaults to v*)" }),
+		"tag-pattern": arg(z.string().min(1).default("v*"), { description: "Tag glob to match (defaults to v*)" }),
+		branch: arg(z.string().min(1).optional(), { description: "Tag-reachability guard branch (no guard when omitted)" }),
 		environment: arg(z.string().min(1).optional(), { description: "GitHub Environment for the plan/deploy jobs (defaults to the workspace name)" }),
-		"no-plan": arg(z.boolean().default(false), { description: "Disable the plan job for a branch target (cannot be combined with --tag)" }),
 		dir: arg(z.string().min(1).default("."), {
 			alias: "d",
 			description: "App directory (for monorepo setups)"
 		}),
 		force: arg(z.boolean().default(false), { description: "Discard hand edits / take over unmanaged files and regenerate" })
-	}).strict(),
-	subCommands: { check: checkCommand },
+	}),
 	run: async (args) => {
-		if (args["tag-pattern"] !== void 0 && !args.tag) throw new Error("--tag-pattern requires --tag.");
-		if (args["no-plan"] && args.tag) throw new Error("--no-plan cannot be combined with --tag.");
-		await setupGitHub({
-			workspaceName: args["workspace-name"],
+		await setupTarget({
+			kind: "tag",
+			workspaceName: args.name,
+			tagPattern: args["tag-pattern"],
 			branch: args.branch,
-			tag: args.tag,
-			tagPattern: args["tag-pattern"] ?? "v*",
 			environment: args.environment,
-			plan: !args["no-plan"],
 			dir: args.dir,
 			force: args.force,
 			outputDir: process.cwd()
 		});
 	}
 });
-
-//#endregion
-//#region src/cli/shared/skills-installer.ts
-const SKILL_NAME = "tailor-sdk";
-const SKILLS_SOURCE_ENV_KEY = "TAILOR_SDK_SKILLS_SOURCE";
-function resolveNpxCommand(platform = process.platform) {
-	return platform === "win32" ? "npx.cmd" : "npx";
-}
-function resolveSkillsSource(source) {
-	return process.env[SKILLS_SOURCE_ENV_KEY] ?? source;
-}
-/**
-* Build CLI arguments for `skills add` with the fixed tailor-sdk skill target.
-* `--copy` is included so the installed skill survives `pnpm install` wiping `node_modules`.
-* @param options - Options controlling the generated `skills add` arguments
-* @param options.source
-* @param options.agent
-* @param options.yes
-* @returns CLI arguments for `npx skills add`
-*/
-function buildSkillsAddArgs(options) {
-	const args = [
-		"skills",
-		"add",
-		resolveSkillsSource(options.source),
-		"--skill",
-		SKILL_NAME,
-		"--copy"
-	];
-	if (options.agent) args.push("--agent", options.agent);
-	if (options.yes) args.push("--yes");
-	return args;
-}
-/**
-* Run `npx skills add` to install the tailor-sdk skill.
-* @param options - Runtime options for skill installation
-* @returns Process exit code from the spawned `npx` command
-*/
-async function runSkillsInstaller(options) {
-	const args = buildSkillsAddArgs({
-		source: options.source,
-		agent: options.agent,
-		yes: options.yes
-	});
-	const childProcess = (options.spawnFn ?? ((command, spawnArgs, spawnOptions) => spawn(command, spawnArgs, spawnOptions)))(resolveNpxCommand(), args, { stdio: "inherit" });
-	return await new Promise((resolve, reject) => {
-		childProcess.on("error", (error) => reject(error));
-		childProcess.on("close", (code) => resolve(code ?? 1));
-	});
-}
-
-//#endregion
-//#region src/cli/commands/skills/install.ts
-async function resolveBundledSkillsDir() {
-	return resolve(dirname(await resolvePackageJSON(import.meta.url)), "agent-skills");
-}
-const DEFAULT_AGENT = "claude-code";
-const installCommand = defineAppCommand({
-	name: "install",
-	description: "Install the tailor-sdk agent skill from the installed SDK package.",
-	args: z.object({
-		agent: arg(z.string().default(DEFAULT_AGENT), {
-			alias: "a",
-			description: `vercel/skills agent name (e.g. ${DEFAULT_AGENT}, codex). Defaults to ${DEFAULT_AGENT}.`
+const previewCommand = defineAppCommand({
+	name: "preview",
+	description: "Generate a preview workflow (PR open/sync triggers deploy to a per-PR workspace).",
+	args: z.strictObject({
+		name: arg(z.string().min(1).optional(), {
+			alias: "n",
+			description: "Name (defaults to the config 'name')"
+		}),
+		branch: arg(z.string().min(1).optional(), { description: "Branch to filter PRs by (defaults to the detected default branch)" }),
+		region: arg(z.string().min(1), { description: "Workspace region for preview workspace creation (e.g. us-west). Required." }),
+		"require-preview-label": arg(z.boolean().default(false), { description: "Deploy preview only for PRs labeled `tailor:preview` instead of all PRs." }),
+		environment: arg(z.string().min(1).optional(), { description: "GitHub Environment for the preview jobs (defaults to the workspace name)" }),
+		dir: arg(z.string().min(1).default("."), {
+			alias: "d",
+			description: "App directory (for monorepo setups)"
 		}),
-		yes: arg(z.boolean().default(false), {
-			alias: "y",
-			description: "Auto-approve prompts."
+		force: arg(z.boolean().default(false), { description: "Discard hand edits / take over unmanaged files and regenerate" })
+	}),
+	run: async (args) => {
+		await setupTarget({
+			kind: "preview",
+			workspaceName: args.name,
+			branch: args.branch,
+			region: args.region,
+			requirePreviewLabel: args["require-preview-label"],
+			environment: args.environment,
+			dir: args.dir,
+			force: args.force,
+			outputDir: process.cwd()
+		});
+	}
+});
+const deleteCommand$1 = defineAppCommand({
+	name: "delete",
+	description: "Delete managed workflow/action file(s) and their .github/tailor.lock entries.",
+	args: z.strictObject({
+		...confirmationArgs,
+		files: arg(z.string().array().min(1), {
+			positional: true,
+			description: "Workflow/action file(s) to delete, as generated under .github/workflows or .github/actions"
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
-		const exitCode = await runSkillsInstaller({
-			source: await resolveBundledSkillsDir(),
-			agent: args.agent,
-			yes: args.yes
+		await setupDelete({
+			files: args.files,
+			yes: args.yes,
+			outputDir: process.cwd()
 		});
-		if (exitCode !== 0) process.exit(exitCode);
 	}
 });
-
-//#endregion
-//#region src/cli/commands/skills/index.ts
-const skillsCommand = defineCommand({
-	name: "skills",
-	description: "Manage Tailor SDK agent skills.",
-	subCommands: { install: installCommand },
-	async run() {
-		await runCommand(installCommand, []);
+const setupCommand = defineCommand({
+	name: "setup",
+	description: "Generate CI deploy workflows for your project. (beta)",
+	subCommands: {
+		branch: branchCommand,
+		tag: tagCommand,
+		preview: previewCommand,
+		action: actionCommand,
+		coordinate: coordinateCommand,
+		check: checkCommand,
+		delete: deleteCommand$1
 	}
 });
 
@@ -3264,7 +4529,7 @@ async function withTimeout(p, ms, message) {
 //#endregion
 //#region src/cli/commands/staticwebsite/deploy.ts
 const CHUNK_SIZE = 64 * 1024;
-const IGNORED_FILES = new Set([
+const IGNORED_FILES = /* @__PURE__ */ new Set([
 	".DS_Store",
 	"thumbs.db",
 	"desktop.ini"
@@ -3384,7 +4649,7 @@ function logSkippedFiles(skippedFiles) {
 const deployCommand = defineAppCommand({
 	name: "deploy",
 	description: "Deploy a static website from a local build directory.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		name: arg(z.string(), {
 			alias: "n",
@@ -3395,7 +4660,7 @@ const deployCommand = defineAppCommand({
 			description: "Path to the static website files",
 			completion: { type: "directory" }
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
 		logger.info(`Deploying static website "${args.name}" from directory: ${args.dir}`);
@@ -3437,13 +4702,13 @@ const statusLabels = {
 const domainGetCommand = defineAppCommand({
 	name: "get",
 	description: "Get details of a custom domain.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		domain: arg(z.string(), {
 			positional: true,
 			description: "Custom domain name"
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
 		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
 		const workspaceId = await loadWorkspaceId({
@@ -3477,13 +4742,13 @@ const domainGetCommand = defineAppCommand({
 const domainListCommand = defineAppCommand({
 	name: "list",
 	description: "List custom domains for a static website.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		name: arg(z.string(), {
 			positional: true,
 			description: "Static website name"
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
 		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
 		const workspaceId = await loadWorkspaceId({
@@ -3529,13 +4794,13 @@ const domainCommand = defineCommand({
 const getCommand = defineAppCommand({
 	name: "get",
 	description: "Get details of a specific static website.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		name: arg(z.string(), {
 			positional: true,
 			description: "Static website name"
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
 		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
 		const workspaceId = await loadWorkspaceId({
@@ -3597,10 +4862,10 @@ async function listStaticWebsites(options) {
 const listCommand$2 = defineAppCommand({
 	name: "list",
 	description: "List all static websites in a workspace.",
-	args: z.object({
+	args: z.strictObject({
 		...workspaceArgs,
 		...paginationArgs()
-	}).strict(),
+	}),
 	run: async (args) => {
 		const jsonOutput = logger.jsonMode;
 		const websites = await listStaticWebsites({
@@ -3862,7 +5127,7 @@ function buildTailorDbErdSchema(options) {
 		namespace: namespaceData.namespace,
 		source: options.source ?? "local",
 		cleanRoom: {
-			implementation: "tailor-sdk",
+			implementation: "tailor",
 			notes: CLEAN_ROOM_NOTES
 		},
 		tables,
@@ -3904,6 +5169,9 @@ async function initErdDeployContext(args) {
 const VIEWER_ASSETS_DIR = "erd-viewer-assets";
 const STYLES_LINK = "<link rel=\"stylesheet\" href=\"./styles.css\" />";
 const APP_SCRIPT = "<script src=\"./app.js\" type=\"module\"><\/script>";
+function escapeHtml(value) {
+	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;");
+}
 function assetDirCandidates() {
 	const currentDir = path.dirname(fileURLToPath(import.meta.url));
 	return [
@@ -3926,8 +5194,8 @@ function resolveViewerAssetsDir() {
 * are inlined as separately extractable blocks: a `<style>` element, a
 * `<script type="module">`, and a `<script type="application/json"
 * id="erd-schema">` data block. This renders without any sibling asset files
-* and lets external tooling (e.g. a future ERD diff) pull out the schema via
-* `JSON.parse`.
+* and lets external tooling (including the ERD diff command) pull out the
+* schema via `JSON.parse`.
 * @param options - Viewer build options.
 * @returns The self-contained HTML document.
 */
@@ -3938,8 +5206,10 @@ function buildViewerHtml(options) {
 	const appJs = fs$1.readFileSync(path.join(assetsDir, "app.js"), "utf8");
 	if (!html.includes(STYLES_LINK) || !html.includes(APP_SCRIPT)) throw new Error("ERD viewer index.html is missing expected asset references for inlining.");
 	const embedScript = `<script type="application/json" id="erd-schema">${JSON.stringify(options.schema).replaceAll("<", "\\u003c")}<\/script>`;
+	const currentSchemaScript = options.currentSchema === void 0 ? "" : `\n    <script type="application/json" id="erd-current-schema">${JSON.stringify(options.currentSchema).replaceAll("<", "\\u003c")}<\/script>`;
+	const diffScript = options.diff === void 0 ? "" : `\n    <script type="application/json" id="erd-diff">${JSON.stringify(options.diff).replaceAll("<", "\\u003c")}<\/script>`;
 	const inlineScript = `<script type="module">\n${appJs.replace(/<\/script/gi, "<\\/script")}\n<\/script>`;
-	return html.replace(STYLES_LINK, `<style>\n${css}\n</style>`).replace(APP_SCRIPT, `${embedScript}\n    ${inlineScript}`);
+	return html.replace("<title>TailorDB ERD</title>", () => `<title>${escapeHtml(options.title ?? "TailorDB ERD")}</title>`).replace(STYLES_LINK, () => `<style>\n${css}\n</style>`).replace(APP_SCRIPT, () => `${embedScript}${currentSchemaScript}${diffScript}\n    ${inlineScript}`);
 }
 /**
 * Write the self-contained TailorDB ERD viewer to `<distDir>/index.html`.
@@ -3956,7 +5226,7 @@ function writeViewerDist(options) {
 
 //#endregion
 //#region src/cli/commands/tailordb/erd/export.ts
-const DEFAULT_ERD_BASE_DIR$1 = ".tailor-sdk/erd";
+const DEFAULT_ERD_BASE_DIR$1 = ".tailor/erd";
 function getErdSite(context, namespace) {
 	const dbConfig = context.config.db?.[namespace];
 	if (!dbConfig || "external" in dbConfig) return;
@@ -4036,7 +5306,7 @@ function prepareErdBuildsFromContext(options) {
 const erdExportCommand = defineAppCommand({
 	name: "export",
 	description: "Export TailorDB ERD static viewer from local TailorDB schema.",
-	args: z.object({
+	args: z.strictObject({
 		...configArg,
 		namespace: arg(z.string().optional(), {
 			alias: "n",
@@ -4047,7 +5317,7 @@ const erdExportCommand = defineAppCommand({
 			description: "Output directory path for TailorDB ERD viewer files (writes to `<outputDir>/<namespace>/dist`)",
 			completion: { type: "directory" }
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
 		initErdCommand();
 		const results = await prepareErdBuilds({
@@ -4072,13 +5342,13 @@ const erdExportCommand = defineAppCommand({
 const erdDeployCommand = defineAppCommand({
 	name: "deploy",
 	description: "Deploy ERD static website for TailorDB namespace(s).",
-	args: z.object({
+	args: z.strictObject({
 		...deploymentArgs,
 		namespace: arg(z.string().optional(), {
 			alias: "n",
 			description: "TailorDB namespace name (optional - deploys all namespaces with erdSite if omitted)"
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
 		const { client, workspaceId } = await initErdDeployContext(args);
@@ -4109,13 +5379,369 @@ const erdDeployCommand = defineAppCommand({
 	}
 });
 
+//#endregion
+//#region src/cli/commands/tailordb/erd/diff.ts
+const SCHEMA_BLOCK_PATTERN = /<script type="application\/json" id="erd-schema">([\s\S]*?)<\/script>/;
+function stableValue(value) {
+	if (Array.isArray(value)) return value.map((item) => stableValue(item));
+	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).toSorted(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, stableValue(item)]));
+	return value;
+}
+function stableJson(value) {
+	return JSON.stringify(stableValue(value));
+}
+function changedFields(base, head) {
+	return [.../* @__PURE__ */ new Set([...Object.keys(base), ...Object.keys(head)])].toSorted((a, b) => a.localeCompare(b)).filter((key) => stableJson(base[key]) !== stableJson(head[key]));
+}
+function detailForChangedFields(fields) {
+	return `Changed fields: ${fields.join(", ")}`;
+}
+function mapByName(items) {
+	return new Map(items.map((item) => [item.name, item]));
+}
+function compareCommonNamed(baseItems, headItems, addChange) {
+	const baseByName = mapByName(baseItems);
+	const headByName = mapByName(headItems);
+	const commonNames = [...baseByName.keys()].filter((name) => headByName.has(name)).toSorted((a, b) => a.localeCompare(b));
+	for (const name of commonNames) {
+		const base = baseByName.get(name);
+		const head = headByName.get(name);
+		if (!base || !head) continue;
+		const fields = changedFields(base, head);
+		if (fields.length > 0) addChange(name, fields);
+	}
+}
+function removedNames(baseItems, headItems) {
+	const headByName = mapByName(headItems);
+	return baseItems.map((item) => item.name).filter((name) => !headByName.has(name)).toSorted((a, b) => a.localeCompare(b));
+}
+function addedNames(baseItems, headItems) {
+	const baseByName = mapByName(baseItems);
+	return headItems.map((item) => item.name).filter((name) => !baseByName.has(name)).toSorted((a, b) => a.localeCompare(b));
+}
+function tableMetadata(table) {
+	return {
+		backwardRelationships: table.backwardRelationships,
+		description: table.description,
+		forwardRelationships: table.forwardRelationships,
+		pluralForm: table.pluralForm,
+		source: table.source
+	};
+}
+function pushChange(changes, change) {
+	changes.push(change);
+}
+function diffColumns(changes, tableName, baseColumns, headColumns) {
+	compareCommonNamed(baseColumns, headColumns, (name, fields) => {
+		pushChange(changes, {
+			action: "changed",
+			entity: "column",
+			path: `${tableName}.${name}`,
+			detail: detailForChangedFields(fields)
+		});
+	});
+	for (const name of removedNames(baseColumns, headColumns)) pushChange(changes, {
+		action: "removed",
+		entity: "column",
+		path: `${tableName}.${name}`,
+		detail: "Column removed"
+	});
+	for (const name of addedNames(baseColumns, headColumns)) pushChange(changes, {
+		action: "added",
+		entity: "column",
+		path: `${tableName}.${name}`,
+		detail: "Column added"
+	});
+}
+function diffIndexes(changes, tableName, baseIndexes, headIndexes) {
+	compareCommonNamed(baseIndexes, headIndexes, (name, fields) => {
+		pushChange(changes, {
+			action: "changed",
+			entity: "index",
+			path: `${tableName}.${name}`,
+			detail: detailForChangedFields(fields)
+		});
+	});
+	for (const name of removedNames(baseIndexes, headIndexes)) pushChange(changes, {
+		action: "removed",
+		entity: "index",
+		path: `${tableName}.${name}`,
+		detail: "Index removed"
+	});
+	for (const name of addedNames(baseIndexes, headIndexes)) pushChange(changes, {
+		action: "added",
+		entity: "index",
+		path: `${tableName}.${name}`,
+		detail: "Index added"
+	});
+}
+function diffTables(changes, baseTables, headTables) {
+	const baseByName = mapByName(baseTables);
+	const headByName = mapByName(headTables);
+	for (const name of removedNames(baseTables, headTables)) pushChange(changes, {
+		action: "removed",
+		entity: "table",
+		path: name,
+		detail: "Table removed"
+	});
+	for (const name of addedNames(baseTables, headTables)) pushChange(changes, {
+		action: "added",
+		entity: "table",
+		path: name,
+		detail: "Table added"
+	});
+	const commonNames = [...baseByName.keys()].filter((name) => headByName.has(name)).toSorted((a, b) => a.localeCompare(b));
+	for (const name of commonNames) {
+		const base = baseByName.get(name);
+		const head = headByName.get(name);
+		if (!base || !head) continue;
+		const tableFields = changedFields(tableMetadata(base), tableMetadata(head));
+		if (tableFields.length > 0) pushChange(changes, {
+			action: "changed",
+			entity: "table",
+			path: name,
+			detail: detailForChangedFields(tableFields)
+		});
+		diffColumns(changes, name, base.columns, head.columns);
+		diffIndexes(changes, name, base.indexes, head.indexes);
+	}
+}
+function diffRelations(changes, baseRelations, headRelations) {
+	compareCommonNamed(baseRelations, headRelations, (name, fields) => {
+		pushChange(changes, {
+			action: "changed",
+			entity: "relation",
+			path: name,
+			detail: detailForChangedFields(fields)
+		});
+	});
+	for (const name of removedNames(baseRelations, headRelations)) pushChange(changes, {
+		action: "removed",
+		entity: "relation",
+		path: name,
+		detail: "Relation removed"
+	});
+	for (const name of addedNames(baseRelations, headRelations)) pushChange(changes, {
+		action: "added",
+		entity: "relation",
+		path: name,
+		detail: "Relation added"
+	});
+}
+function summarize(changes) {
+	return {
+		added: changes.filter((change) => change.action === "added").length,
+		changed: changes.filter((change) => change.action === "changed").length,
+		removed: changes.filter((change) => change.action === "removed").length
+	};
+}
+function extractEmbeddedErdSchema(html) {
+	const match = SCHEMA_BLOCK_PATTERN.exec(html);
+	if (!match?.[1]) throw new Error("ERD schema block not found.");
+	try {
+		return JSON.parse(match[1]);
+	} catch (error) {
+		throw new Error(`Failed to parse ERD schema block: ${String(error)}`, { cause: error });
+	}
+}
+function createEmptyErdSchema(options) {
+	return {
+		version: 1,
+		namespace: options.namespace,
+		generatedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
+		revision: options.revision,
+		source: "local",
+		cleanRoom: {
+			implementation: "tailor",
+			notes: ["Synthetic empty schema used for ERD diff generation."]
+		},
+		tables: [],
+		relations: []
+	};
+}
+function buildErdSchemaDiff(options) {
+	const { base, head } = options;
+	if (base.namespace !== head.namespace) throw new Error(`Cannot diff ERD schemas from different namespaces: ${base.namespace}, ${head.namespace}`);
+	const changes = [];
+	diffTables(changes, base.tables, head.tables);
+	diffRelations(changes, base.relations, head.relations);
+	const summary = summarize(changes);
+	return {
+		namespace: head.namespace,
+		baseRevision: base.revision,
+		headRevision: head.revision,
+		changed: changes.length > 0,
+		summary,
+		changes
+	};
+}
+function mergeNamedByHead(baseItems, headItems) {
+	const headByName = mapByName(headItems);
+	const removedItems = baseItems.filter((item) => !headByName.has(item.name)).toSorted((a, b) => a.name.localeCompare(b.name));
+	return [...headItems, ...removedItems];
+}
+function mergeDiffViewerTable(baseTable, headTable) {
+	return {
+		...headTable,
+		columns: mergeNamedByHead(baseTable.columns, headTable.columns),
+		indexes: mergeNamedByHead(baseTable.indexes, headTable.indexes)
+	};
+}
+function mergeDiffViewerTables(baseTables, headTables) {
+	const baseByName = mapByName(baseTables);
+	const headByName = mapByName(headTables);
+	const merged = headTables.map((headTable) => {
+		const baseTable = baseByName.get(headTable.name);
+		return baseTable ? mergeDiffViewerTable(baseTable, headTable) : headTable;
+	});
+	const removedTables = baseTables.filter((table) => !headByName.has(table.name)).toSorted((a, b) => a.name.localeCompare(b.name));
+	return [...merged, ...removedTables];
+}
+/**
+* Build the schema rendered by the diff viewer. The ordinary ERD viewer only
+* knows how to draw objects present in its schema, so the diff schema keeps
+* base-only tables, columns, indexes, and relations visible for removal
+* highlighting while preferring head-side metadata for unchanged objects.
+* @param options - Base and head schemas to merge for diff rendering.
+* @returns A TailorDB ERD schema suitable for the visual diff viewer.
+*/
+function buildErdDiffViewerSchema(options) {
+	const { base, head } = options;
+	if (base.namespace !== head.namespace) throw new Error(`Cannot diff ERD schemas from different namespaces: ${base.namespace}, ${head.namespace}`);
+	return {
+		...head,
+		tables: mergeDiffViewerTables(base.tables, head.tables),
+		relations: mergeNamedByHead(base.relations, head.relations)
+	};
+}
+function renderErdDiffHtml(options) {
+	return buildViewerHtml({
+		schema: options.schema,
+		currentSchema: options.currentSchema,
+		diff: options.diff,
+		title: `TailorDB ERD diff - ${options.diff.namespace}`
+	});
+}
+
+//#endregion
+//#region src/cli/commands/tailordb/erd/diff-command.ts
+function readSchema(filePath) {
+	if (!filePath) return void 0;
+	return extractEmbeddedErdSchema(fs$1.readFileSync(filePath, "utf8"));
+}
+function resolveNamespace(options) {
+	const namespace = options.namespace ?? options.head?.namespace ?? options.base?.namespace;
+	if (!namespace) throw new Error("Missing --namespace when one side of the ERD diff is omitted.");
+	if (options.base && options.base.namespace !== namespace) throw new Error(`Base ERD namespace "${options.base.namespace}" does not match "${namespace}".`);
+	if (options.head && options.head.namespace !== namespace) throw new Error(`Head ERD namespace "${options.head.namespace}" does not match "${namespace}".`);
+	return namespace;
+}
+function writeFile(filePath, content) {
+	fs$1.mkdirSync(path.dirname(filePath), { recursive: true });
+	fs$1.writeFileSync(filePath, content, "utf8");
+}
+function writeErdDiff(options) {
+	const base = readSchema(options.baseHtml);
+	const head = readSchema(options.headHtml);
+	if (!base && !head) throw new Error("At least one of --base-html or --head-html is required.");
+	const namespace = resolveNamespace({
+		namespace: options.namespace,
+		base,
+		head
+	});
+	const baseSchema = base ?? createEmptyErdSchema({
+		namespace,
+		revision: "missing-base"
+	});
+	const headSchema = head ?? createEmptyErdSchema({
+		namespace,
+		revision: "missing-head"
+	});
+	const diff = buildErdSchemaDiff({
+		base: baseSchema,
+		head: headSchema
+	});
+	const viewerSchema = buildErdDiffViewerSchema({
+		base: baseSchema,
+		head: headSchema
+	});
+	writeFile(options.outputHtml, renderErdDiffHtml({
+		schema: viewerSchema,
+		currentSchema: headSchema,
+		diff
+	}));
+	if (options.outputJson) writeFile(options.outputJson, `${JSON.stringify(diff, null, 2)}\n`);
+	return {
+		namespace,
+		outputHtml: options.outputHtml,
+		outputJson: options.outputJson,
+		diff
+	};
+}
+const erdDiffCommand = defineAppCommand({
+	name: "diff",
+	description: "Render TailorDB ERD schema diff HTML from exported ERD viewers.",
+	args: z.strictObject({
+		"base-html": arg(z.string().optional(), {
+			description: "Base ERD viewer HTML file",
+			completion: {
+				type: "file",
+				matcher: [".html"]
+			}
+		}),
+		"head-html": arg(z.string().optional(), {
+			description: "Head ERD viewer HTML file",
+			completion: {
+				type: "file",
+				matcher: [".html"]
+			}
+		}),
+		namespace: arg(z.string().optional(), {
+			alias: "n",
+			description: "TailorDB namespace name (defaults to the provided ERD schema namespace)"
+		}),
+		output: arg(z.string().min(1), {
+			alias: "o",
+			description: "Output ERD diff HTML file",
+			completion: {
+				type: "file",
+				matcher: [".html"]
+			}
+		}),
+		"output-json": arg(z.string().optional(), {
+			description: "Optional output JSON file for the computed diff",
+			completion: {
+				type: "file",
+				matcher: [".json"]
+			}
+		})
+	}),
+	run: (args) => {
+		initErdCommand();
+		const result = writeErdDiff({
+			baseHtml: args["base-html"],
+			headHtml: args["head-html"],
+			namespace: args.namespace,
+			outputHtml: args.output,
+			outputJson: args["output-json"]
+		});
+		if (args.json) logger.out({
+			namespace: result.namespace,
+			outputHtml: result.outputHtml,
+			outputJson: result.outputJson,
+			summary: result.diff.summary
+		});
+		else logger.success(`Wrote ERD diff to ${path.relative(process.cwd(), result.outputHtml)}`);
+	}
+});
+
 //#endregion
 //#region src/cli/commands/tailordb/erd/serve.ts
-const DEFAULT_ERD_BASE_DIR = ".tailor-sdk/erd";
+const DEFAULT_ERD_BASE_DIR = ".tailor/erd";
 const LOCAL_HOST = "127.0.0.1";
 const GLOB_CHARS = /[*?[\]{}()!+@]/;
 function formatServeCommand(namespace) {
-	return `tailor-sdk tailordb erd serve --namespace ${namespace}`;
+	return `tailor tailordb erd serve --namespace ${namespace}`;
 }
 function getCacheControl(filePath) {
 	return filePath.endsWith(".html") || filePath.endsWith(".json") ? "no-cache" : "public, max-age=3600";
@@ -4409,7 +6035,7 @@ async function waitForShutdown(server, watcher) {
 const erdServeCommand = defineAppCommand({
 	name: "serve",
 	description: "Generate and serve TailorDB ERD locally with watch reload. (beta)",
-	args: z.object({
+	args: z.strictObject({
 		...configArg,
 		namespace: arg(z.string().optional(), {
 			alias: "n",
@@ -4417,7 +6043,7 @@ const erdServeCommand = defineAppCommand({
 		}),
 		port: arg(z.coerce.number().int().min(0).max(65535).default(0), { description: "Local server port (0 selects a free port)" }),
 		open: arg(z.boolean().default(false), { description: "Open the ERD viewer in the default browser" })
-	}).strict(),
+	}),
 	run: async (args) => {
 		initErdCommand();
 		const outputDir = path.resolve(process.cwd(), DEFAULT_ERD_BASE_DIR);
@@ -4469,6 +6095,7 @@ const erdCommand = defineCommand({
 	description: "Generate TailorDB ERD viewer artifacts from local TailorDB schema. (beta)",
 	subCommands: {
 		export: erdExportCommand,
+		diff: erdDiffCommand,
 		serve: erdServeCommand,
 		deploy: erdDeployCommand
 	}
@@ -4512,7 +6139,7 @@ async function script(options) {
 	logger.info(`  DB types: ${getMigrationFilePath(migrationsDir, migrationNumber, "db")}`);
 	logger.newline();
 	logger.log("Edit the script to implement your data migration logic.");
-	logger.log("It will be executed by 'tailor-sdk deploy' between Pre and Post phases.");
+	logger.log("It will be executed by 'tailor deploy' between Pre and Post phases.");
 	const editor = getConfiguredEditorCommand();
 	if (!editor) return;
 	logger.newline();
@@ -4537,7 +6164,7 @@ function resolveTargetNamespace(namespacesWithMigrations, requested) {
 const scriptCommand = defineAppCommand({
 	name: "script",
 	description: "Add a migration script (migrate.ts) template to an existing migration directory.",
-	args: z.object({
+	args: z.strictObject({
 		...configArg,
 		number: arg(z.string(), {
 			positional: true,
@@ -4547,7 +6174,7 @@ const scriptCommand = defineAppCommand({
 			alias: "n",
 			description: "Target TailorDB namespace (required if multiple namespaces exist)"
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
 		await script({
 			configPath: args.config,
@@ -4633,7 +6260,7 @@ async function set(options) {
 const setCommand = defineAppCommand({
 	name: "set",
 	description: "Set migration checkpoint to a specific number.",
-	args: z.object({
+	args: z.strictObject({
 		...deploymentArgs,
 		...confirmationArgs,
 		number: arg(z.string(), {
@@ -4644,7 +6271,7 @@ const setCommand = defineAppCommand({
 			alias: "n",
 			description: "Target TailorDB namespace (required if multiple namespaces exist)"
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
 		await set({
@@ -4732,13 +6359,13 @@ async function status(options) {
 const statusCommand = defineAppCommand({
 	name: "status",
 	description: "Show the current migration status for TailorDB namespaces, including applied and pending migrations.",
-	args: z.object({
+	args: z.strictObject({
 		...deploymentArgs,
 		namespace: arg(z.string().optional(), {
 			alias: "n",
 			description: "Target TailorDB namespace (shows all namespaces if not specified)"
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
 		await status({
 			configPath: args.config,
@@ -4753,19 +6380,14 @@ const statusCommand = defineAppCommand({
 //#endregion
 //#region src/cli/commands/tailordb/migrate/sync.ts
 async function fetchRemoteGqlPermissions(client, workspaceId, namespace) {
-	return fetchAll(async (pageToken, maxPageSize) => {
-		try {
-			const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
-				workspaceId,
-				namespaceName: namespace,
-				pageToken,
-				pageSize: maxPageSize
-			});
-			return [permissions, nextPageToken];
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.NotFound) return [[], ""];
-			throw error;
-		}
+	return fetchAllTolerant(async (pageToken, maxPageSize) => {
+		const { permissions, nextPageToken } = await client.listTailorDBGQLPermissions({
+			workspaceId,
+			namespaceName: namespace,
+			pageToken,
+			pageSize: maxPageSize
+		});
+		return [permissions, nextPageToken];
 	});
 }
 async function fetchRemoteTypes(client, workspaceId, namespace) {
@@ -4805,7 +6427,7 @@ async function fetchRemoteTypes(client, workspaceId, namespace) {
 async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	const { config, plugins } = loaded;
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-Dtqap5jM.mjs");
+	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-BO4ZF8wP.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -4817,7 +6439,7 @@ async function assertMigrationsReproduceLocalTypes(loaded, target) {
 		await service.processNamespacePlugins();
 	}
 	const pluginExecutorFiles = generatePluginFilesIfNeeded(pluginManager, application.tailorDBServices, config.path);
-	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-DCqIWibD.mjs")).createExecutorService({ config: { files: [] } }) : void 0);
+	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-CkIwEctX.mjs")).createExecutorService({ config: { files: [] } }) : void 0);
 	await executorService?.loadExecutors();
 	if (pluginExecutorFiles.length > 0) await executorService?.loadPluginExecutorFiles([...pluginExecutorFiles]);
 	const executorUsedTypes = /* @__PURE__ */ new Set();
@@ -4835,7 +6457,7 @@ async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	logger.newline();
 	logger.info("This usually means one of the following:");
 	logger.info("  - Migration files were edited and replaying them no longer matches the type definitions — fix the migration files.", { mode: "plain" });
-	logger.info("  - Type definitions changed without a new migration — run 'tailor-sdk tailordb migration generate' first.", { mode: "plain" });
+	logger.info("  - Type definitions changed without a new migration — run 'tailor tailordb migration generate' first.", { mode: "plain" });
 	logger.newline();
 	throw new Error("Refusing to sync: the migration history must reproduce the current local schema before it can be applied to the remote.");
 }
@@ -4852,21 +6474,15 @@ async function assertMigrationsReproduceLocalTypes(loaded, target) {
 * @returns Existing labels and the parsed current migration number
 */
 async function fetchRemoteMigrationState(client, trn) {
-	try {
+	const labels = (await getOrNull(async () => {
 		const { metadata } = await client.getMetadata({ trn });
-		const labels = metadata?.labels ?? {};
-		const label = labels[MIGRATION_LABEL_KEY];
-		return {
-			labels,
-			current: label ? parseMigrationLabelNumber(label) : null
-		};
-	} catch (error) {
-		if (error instanceof ConnectError && error.code === Code.NotFound) return {
-			labels: {},
-			current: null
-		};
-		throw error;
-	}
+		return metadata;
+	}))?.labels ?? {};
+	const label = labels[MIGRATION_LABEL_KEY];
+	return {
+		labels,
+		current: label ? parseMigrationLabelNumber(label) : null
+	};
 }
 function selectTargetNamespace(namespacesWithMigrations, requested) {
 	if (namespacesWithMigrations.length === 0) throw new Error("No TailorDB services with migrations configuration found");
@@ -4977,7 +6593,7 @@ async function sync(options) {
 			tailordbType
 		}))]);
 	} catch (error) {
-		handleOptionalToRequiredError(error, ["The target snapshot marks a field as required, but existing remote records have no value for it.", "Populate those records first (e.g. with a migration script applied via 'tailor-sdk deploy'), then re-run the sync."]);
+		handleOptionalToRequiredError(error, ["The target snapshot marks a field as required, but existing remote records have no value for it.", "Populate those records first (e.g. with a migration script applied via 'tailor deploy'), then re-run the sync."]);
 	}
 	await Promise.all(desiredGqlPermissions.map(({ typeName, permission }) => {
 		const request = {
@@ -5008,13 +6624,13 @@ async function sync(options) {
 	logger.success(`Synced namespace ${styles.bold(target.namespace)} to migration ${styles.bold(formatMigrationNumber(targetVersion))}.`);
 	if (targetVersion < latest) {
 		logger.newline();
-		logger.info(`Run 'tailor-sdk deploy' to apply migrations ${formatMigrationNumber(targetVersion + 1)}–${formatMigrationNumber(latest)} from the working tree.`);
+		logger.info(`Run 'tailor deploy' to apply migrations ${formatMigrationNumber(targetVersion + 1)}–${formatMigrationNumber(latest)} from the working tree.`);
 	}
 }
 const syncCommand = defineAppCommand({
 	name: "sync",
 	description: "Sync remote TailorDB schema to a specific migration snapshot (recovery from --no-schema-check drift).",
-	args: z.object({
+	args: z.strictObject({
 		...deploymentArgs,
 		...confirmationArgs,
 		number: arg(z.string(), {
@@ -5025,7 +6641,7 @@ const syncCommand = defineAppCommand({
 			alias: "n",
 			description: "Target TailorDB namespace (required if multiple namespaces exist)"
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
 		await assertWritable({ profile: args.profile });
 		await sync({
@@ -5080,7 +6696,7 @@ const tailordbCommand = defineCommand({
 const upgradeCommand = defineAppCommand({
 	name: "upgrade",
 	description: "Run codemods to upgrade your project to a newer SDK version.",
-	args: z.object({
+	args: z.strictObject({
 		from: arg(z.string(), { description: "SDK version before the upgrade (e.g., 1.33.0)" }),
 		"dry-run": arg(z.boolean().default(false), {
 			alias: "d",
@@ -5090,11 +6706,11 @@ const upgradeCommand = defineAppCommand({
 			description: "Project directory to upgrade",
 			completion: { type: "directory" }
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
-		const { initTelemetry } = await import("../telemetry-ClwW5ohF.mjs");
+		const { initTelemetry } = await import("../telemetry-CkbkeJxl.mjs");
 		await initTelemetry();
-		const { upgrade } = await import("../service-DU1mVzri2.mjs");
+		const { upgrade } = await import("../service-DeZeYa06.mjs");
 		await upgrade({
 			from: args.from,
 			dryRun: args["dry-run"],
@@ -5108,32 +6724,59 @@ const upgradeCommand = defineAppCommand({
 const currentCommand = defineAppCommand({
 	name: "current",
 	description: "Show current user.",
-	args: z.object({}).strict(),
+	args: z.strictObject({}),
 	run: async () => {
 		const config = await readPlatformConfig();
+		const profile = process.env.TAILOR_PLATFORM_PROFILE;
+		const profileEntry = profile ? config.profiles[profile] : void 0;
+		if (profile && !profileEntry) throw new Error(`Profile "${profile}" not found`);
+		const platformConfig = profileEntry ? platformConfigFromProfile(profileEntry) : void 0;
+		const currentUser = profile ? profileEntry?.user ?? null : config.current_user;
 		const jsonOutput = logger.jsonMode;
-		if (!config.current_user) throw new Error(multiline`
+		if (!currentUser) throw new Error(multiline`
         Current user not set.
-        Please login first using 'tailor-sdk login' command to register a user.
+        Please login first using 'tailor login' command to register a user.
       `);
-		if (!config.users[config.current_user]) throw new Error(multiline`
-        Current user '${config.current_user}' not found in registered users.
-        Please login again using 'tailor-sdk login' command to register the user.
+		if (!hasUserTokenEntry(config, currentUser, platformConfig)) throw new Error(multiline`
+        Current user '${currentUser}' not found in registered users.
+        Please login again using 'tailor login' command to register the user.
       `);
 		if (jsonOutput) {
-			logger.out({ user: config.current_user });
+			logger.out({ user: currentUser });
 			return;
 		}
-		logger.out(config.current_user);
+		logger.out(currentUser);
 	}
 });
 
 //#endregion
 //#region src/cli/commands/user/list.ts
+function activeCurrentUserKey(config) {
+	const activeProfile = process.env.TAILOR_PLATFORM_PROFILE;
+	if (!activeProfile) {
+		if (!config.current_user) return null;
+		return resolveUserTokenKey(config, config.current_user);
+	}
+	const profile = config.profiles[activeProfile];
+	if (!profile) return null;
+	return resolveUserTokenKey(config, profile.user, platformConfigFromProfile(profile));
+}
+function toUserListInfo(userKey, currentUserKey) {
+	const separatorIndex = userKey.indexOf("|");
+	const platformUrl = separatorIndex === -1 ? null : userKey.slice(0, separatorIndex);
+	return {
+		user: separatorIndex === -1 ? userKey : userKey.slice(separatorIndex + 1),
+		platformUrl,
+		current: currentUserKey === userKey
+	};
+}
+function formatUserListInfo(info) {
+	return `${info.user}${info.platformUrl ? ` [${info.platformUrl}]` : ""}${info.current ? " (current)" : ""}`;
+}
 const listCommand$1 = defineAppCommand({
 	name: "list",
 	description: "List all users.",
-	args: z.object({}).strict(),
+	args: z.strictObject({}),
 	run: async () => {
 		const config = await readPlatformConfig();
 		const jsonOutput = logger.jsonMode;
@@ -5141,18 +6784,20 @@ const listCommand$1 = defineAppCommand({
 		if (users.length === 0) {
 			logger.info(multiline`
         No users found.
-        Please login first using 'tailor-sdk login' command to register a user.
+        Please login first using 'tailor login' command to register a user.
       `);
 			if (jsonOutput) logger.out([]);
 			return;
 		}
+		const currentUserKey = activeCurrentUserKey(config);
+		const userInfos = users.map((user) => toUserListInfo(user, currentUserKey));
 		if (jsonOutput) {
-			logger.out(users);
+			logger.out([...new Set(userInfos.map((userInfo) => userInfo.user))]);
 			return;
 		}
-		users.forEach((user) => {
-			if (user === config.current_user) logger.success(`${user} (current)`, { mode: "plain" });
-			else logger.log(user);
+		userInfos.forEach((userInfo) => {
+			if (userInfo.current) logger.success(formatUserListInfo(userInfo), { mode: "plain" });
+			else logger.log(formatUserListInfo(userInfo));
 		});
 	}
 });
@@ -5213,12 +6858,31 @@ function printCreatedToken(name, token, write, action) {
     `);
 }
 
+//#endregion
+//#region src/cli/commands/user/pat/user.ts
+function resolvePatUser(config) {
+	const activeProfile = process.env.TAILOR_PLATFORM_PROFILE;
+	if (activeProfile) return config.profiles[activeProfile]?.user ?? null;
+	return config.current_user;
+}
+async function createPatOperatorClient() {
+	const config = await readPlatformConfig();
+	const activeProfile = process.env.TAILOR_PLATFORM_PROFILE;
+	const profileEntry = activeProfile ? config.profiles[activeProfile] : void 0;
+	if (activeProfile && !profileEntry) throw new Error(`Profile "${activeProfile}" not found`);
+	const platformConfig = profileEntry ? platformConfigFromProfile(profileEntry) : void 0;
+	const user = resolvePatUser(config);
+	if (!user) throw new Error("No user logged in.\nPlease login first using 'tailor login' command.");
+	const { accessToken } = await fetchLatestToken(config, user, platformConfig);
+	return await initOperatorClient(accessToken, platformConfig);
+}
+
 //#endregion
 //#region src/cli/commands/user/pat/create.ts
 const createCommand = defineAppCommand({
 	name: "create",
 	description: "Create a new personal access token.",
-	args: z.object({
+	args: z.strictObject({
 		name: arg(z.string(), {
 			positional: true,
 			description: "Token name"
@@ -5227,16 +6891,10 @@ const createCommand = defineAppCommand({
 			alias: "W",
 			description: "Grant write permission (default: read-only)"
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
 		await assertWritable();
-		const config = await readPlatformConfig();
-		if (!config.current_user) throw new Error(multiline`
-        No user logged in.
-        Please login first using 'tailor-sdk login' command.
-      `);
-		const { accessToken: token } = await fetchLatestToken(config, config.current_user);
-		const client = await initOperatorClient(token);
+		const client = await createPatOperatorClient();
 		const scopes = getScopesFromWriteFlag(args.write);
 		const result = await client.createPersonalAccessToken({
 			name: args.name,
@@ -5252,19 +6910,13 @@ const createCommand = defineAppCommand({
 const deleteCommand = defineAppCommand({
 	name: "delete",
 	description: "Delete a personal access token.",
-	args: z.object({ name: arg(z.string(), {
+	args: z.strictObject({ name: arg(z.string(), {
 		positional: true,
 		description: "Token name"
-	}) }).strict(),
+	}) }),
 	run: async (args) => {
 		await assertWritable();
-		const config = await readPlatformConfig();
-		if (!config.current_user) throw new Error(multiline`
-        No user logged in.
-        Please login first using 'tailor-sdk login' command.
-      `);
-		const { accessToken: token } = await fetchLatestToken(config, config.current_user);
-		await (await initOperatorClient(token)).deletePersonalAccessToken({ name: args.name });
+		await (await createPatOperatorClient()).deletePersonalAccessToken({ name: args.name });
 		logger.success(`Personal access token "${args.name}" deleted successfully.`);
 	}
 });
@@ -5274,16 +6926,10 @@ const deleteCommand = defineAppCommand({
 const listCommand = defineAppCommand({
 	name: "list",
 	description: "List all personal access tokens.",
-	args: z.object({ ...paginationArgs() }).strict(),
+	args: z.strictObject({ ...paginationArgs() }),
 	run: async (args) => {
 		const jsonOutput = logger.jsonMode;
-		const config = await readPlatformConfig();
-		if (!config.current_user) throw new Error(multiline`
-        No user logged in.
-        Please login first using 'tailor-sdk login' command.
-      `);
-		const { accessToken: token } = await fetchLatestToken(config, config.current_user);
-		const client = await initOperatorClient(token);
+		const client = await createPatOperatorClient();
 		const pageDirection = toPageDirection(args.order);
 		const pats = await fetchPaged(async (pageToken, pageSize) => {
 			const { personalAccessTokens, nextPageToken } = await client.listPersonalAccessTokens({
@@ -5296,7 +6942,7 @@ const listCommand = defineAppCommand({
 		if (pats.length === 0) {
 			logger.info(multiline`
         No personal access tokens found.
-        Please create a token using 'tailor-sdk user pat create' command.
+        Please create a token using 'tailor user pat create' command.
       `);
 			if (!jsonOutput) return;
 		}
@@ -5319,7 +6965,7 @@ const listCommand = defineAppCommand({
 const updateCommand = defineAppCommand({
 	name: "update",
 	description: "Update a personal access token (delete and recreate).",
-	args: z.object({
+	args: z.strictObject({
 		name: arg(z.string(), {
 			positional: true,
 			description: "Token name"
@@ -5328,16 +6974,10 @@ const updateCommand = defineAppCommand({
 			alias: "W",
 			description: "Grant write permission (if not specified, keeps read-only)"
 		})
-	}).strict(),
+	}),
 	run: async (args) => {
 		await assertWritable();
-		const config = await readPlatformConfig();
-		if (!config.current_user) throw new Error(multiline`
-        No user logged in.
-        Please login first using 'tailor-sdk login' command.
-      `);
-		const { accessToken: token } = await fetchLatestToken(config, config.current_user);
-		const client = await initOperatorClient(token);
+		const client = await createPatOperatorClient();
 		await client.deletePersonalAccessToken({ name: args.name });
 		const scopes = getScopesFromWriteFlag(args.write);
 		const result = await client.createPersonalAccessToken({
@@ -5370,20 +7010,26 @@ const patCommand = defineCommand({
 const switchCommand = defineAppCommand({
 	name: "switch",
 	description: "Set current user.",
-	args: z.object({ user: arg(z.string(), {
+	args: z.strictObject({ user: arg(z.string(), {
 		positional: true,
 		description: "User email address or machine user client ID"
-	}) }).strict(),
+	}) }),
 	run: async (args) => {
 		const config = await readPlatformConfig();
-		const user = findConfigUserKey(config, args.user);
+		const activeProfileName = process.env.TAILOR_PLATFORM_PROFILE;
+		const activeProfileEntry = activeProfileName ? config.profiles[activeProfileName] : void 0;
+		if (activeProfileName && !activeProfileEntry) throw new Error(`Profile "${activeProfileName}" not found`);
+		const platformConfig = activeProfileEntry ? platformConfigFromProfile(activeProfileEntry) : void 0;
+		if (args.user.includes("|")) throw new Error(`User "${args.user}" looks like a platform-scoped token key. Pass the user name without the platform URL and select the platform with TAILOR_PLATFORM_URL or a profile.`);
+		const user = resolveConfigUser(config, args.user, platformConfig);
 		if (!user) throw new Error(multiline`
         User "${args.user}" not found.
-        Please login first using 'tailor-sdk login' command to register this user.
+        Please login first using 'tailor login' command to register this user.
       `);
-		config.current_user = user;
+		if (activeProfileEntry) activeProfileEntry.user = user;
+		else config.current_user = user;
 		writePlatformConfig(config);
-		logger.success(`Current user set to "${args.user}" successfully.`);
+		logger.success(`Current user set to "${user}" successfully.`);
 	}
 });
 
@@ -5409,7 +7055,7 @@ const workflowCommand = defineCommand({
 	name: "workflow",
 	description: "Manage workflows and workflow executions.",
 	subCommands: {
-		list: listCommand$12,
+		list: listCommand$13,
 		get: getCommand$6,
 		start: startCommand,
 		wait: waitCommand,
@@ -5417,7 +7063,7 @@ const workflowCommand = defineCommand({
 		resume: resumeCommand
 	},
 	async run() {
-		await runCommand(listCommand$12, []);
+		await runCommand(listCommand$13, []);
 	}
 });
 
@@ -5428,10 +7074,10 @@ const appCommand = defineCommand({
 	description: "Manage workspace applications",
 	subCommands: {
 		health: healthCommand,
-		list: listCommand$13
+		list: listCommand$14
 	},
 	async run() {
-		await runCommand(listCommand$13, []);
+		await runCommand(listCommand$14, []);
 	}
 });
 
@@ -5442,12 +7088,12 @@ const userCommand = defineCommand({
 	description: "Manage workspace users",
 	subCommands: {
 		invite: inviteCommand,
-		list: listCommand$14,
+		list: listCommand$15,
 		remove: removeCommand,
 		update: updateCommand$4
 	},
 	async run() {
-		await runCommand(listCommand$14, []);
+		await runCommand(listCommand$15, []);
 	}
 });
 
@@ -5459,31 +7105,82 @@ const workspaceCommand = defineCommand({
 	subCommands: {
 		app: appCommand,
 		create: createCommand$4,
-		delete: deleteCommand$4,
+		delete: deleteCommand$5,
 		get: getCommand$7,
-		list: listCommand$15,
+		list: listCommand$16,
 		restore: restoreCommand,
 		user: userCommand
 	},
 	async run() {
-		await runCommand(listCommand$15, []);
+		await runCommand(listCommand$16, []);
 	}
 });
 
 //#endregion
 //#region src/cli/index.ts
-if (!isNativeTypeScriptRuntime()) {
-	const { register } = await import("tsx/esm/api");
-	register();
-}
+await registerTsHook(new URL("./ts-hook.mjs", import.meta.url));
 initCrashReporting();
 const packageJson = await readPackageJson();
-const cliName = Object.keys(packageJson.bin ?? {})[0] || "tailor-sdk";
-const mainCommand = withCompletionCommand(defineCommand({
+const cliName = Object.keys(packageJson.bin ?? {})[0] || "tailor";
+const packageName = packageJson.name ?? "@tailor-platform/sdk";
+const bundledSkillsDir = resolve(dirname(await resolvePackageJSON(import.meta.url)), "agent-skills");
+function replaceCommandArgs(command, removals = []) {
+	const args = command.args;
+	if (!args?.shape) return command;
+	const shape = { ...args.shape };
+	for (const name of removals) delete shape[name];
+	return {
+		...command,
+		args: z.strictObject({ ...shape })
+	};
+}
+function removeCommandAliases(command) {
+	const next = { ...command };
+	delete next.aliases;
+	return next;
+}
+function alignSkillCommand(command) {
+	const subCommands = command.subCommands ?? {};
+	const add = {
+		...removeCommandAliases(replaceCommandArgs(subCommands.add, ["verbose"])),
+		description: "Install Tailor SDK agent skills."
+	};
+	const list = {
+		...replaceCommandArgs(subCommands.list, ["json"]),
+		description: "List Tailor SDK agent skills."
+	};
+	const remove = {
+		...removeCommandAliases(replaceCommandArgs(subCommands.remove)),
+		description: "Remove installed Tailor SDK agent skills."
+	};
+	const sync = {
+		...replaceCommandArgs(subCommands.sync, ["verbose"]),
+		description: "Remove and reinstall Tailor SDK agent skills."
+	};
+	return {
+		...command,
+		description: "Manage Tailor SDK agent skills.",
+		async run() {
+			const result = await runCommand(add, []);
+			if (!result.success) throw result.error;
+		},
+		subCommands: {
+			...subCommands,
+			add,
+			list,
+			remove,
+			sync
+		}
+	};
+}
+const commandWithSkills = withSkillCommand(defineCommand({
 	name: cliName,
 	description: packageJson.description || "Tailor CLI for managing Tailor Platform SDK applications",
+	notes: `CLI plugins (beta): an unknown subcommand is dispatched to an external plugin executable named \`${cliName}-<name>\` (found on your PATH or in node_modules/.bin), similar to \`gh\` extensions.
+Run \`${cliName} plugin list\` to see which plugins are installed and where they resolve from.`,
 	subCommands: {
 		api: apiCommand,
+		auth: authCommand,
 		authconnection: authconnectionCommand,
 		crashreport: crashReportCommand,
 		deploy: deployCommand$1,
@@ -5497,13 +7194,13 @@ const mainCommand = withCompletionCommand(defineCommand({
 		oauth2client: oauth2clientCommand,
 		open: openCommand,
 		organization: organizationCommand,
+		plugin: pluginCommand,
 		profile: profileCommand,
 		query: queryCommand,
 		remove: removeCommand$1,
 		secret: secretCommand,
 		setup: setupCommand,
 		show: showCommand,
-		skills: skillsCommand,
 		staticwebsite: staticwebsiteCommand,
 		tailordb: tailordbCommand,
 		upgrade: upgradeCommand,
@@ -5511,11 +7208,31 @@ const mainCommand = withCompletionCommand(defineCommand({
 		workflow: workflowCommand,
 		workspace: workspaceCommand
 	}
-}));
+}), {
+	sourceDir: bundledSkillsDir,
+	package: packageName,
+	mode: "copy",
+	descriptionAppend: false
+});
+const commandWithSkillsSubCommands = commandWithSkills.subCommands ?? {};
+const mainCommand = withCompletionCommand({
+	...commandWithSkills,
+	subCommands: {
+		...commandWithSkillsSubCommands,
+		skills: alignSkillCommand(commandWithSkillsSubCommands.skills)
+	}
+});
 runMain(mainCommand, {
 	version: packageJson.version,
 	globalArgs: z.object(commonArgs),
 	displayErrors: false,
+	onUnknownSubcommand: ({ commandPath, name, args }) => dispatchPlugin({
+		commandPath,
+		name,
+		args,
+		cliName,
+		profile: process.env.TAILOR_PLATFORM_PROFILE
+	}),
 	cleanup: async ({ error }) => {
 		if (error) {
 			if (isCLIError(error)) {
@@ -5526,11 +7243,11 @@ runMain(mainCommand, {
 				if (isVerbose() && error.stack) logger.debug(`\nStack trace:\n${error.stack}`);
 			} else logger.error(`Unknown error: ${error}`);
 			if (!isCLIError(error) && (!(error instanceof Error) || error instanceof TypeError || error instanceof RangeError)) {
-				const { reportCrash } = await import("../crashreport-BMWcxeSE.mjs");
+				const { reportCrash } = await import("../crashreport-D3RjuSYb.mjs");
 				await reportCrash(error, "handledError");
 			}
 		}
-		const { shutdownTelemetry } = await import("../telemetry-ClwW5ohF.mjs");
+		const { shutdownTelemetry } = await import("../telemetry-CkbkeJxl.mjs");
 		await shutdownTelemetry();
 	}
 });