@tailor-platform/sdk 2.0.0-next.3 → 2.0.0-next.5

package/dist/cli/index.mjs

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import { C as CustomDomainStatus, R as FunctionExecution_Type, mt as AuthInvokerSchema, xt as PATScope } from "../service_pb-CIrhGwHk.mjs";
 import { t as assertDefined } from "../assert-DBxo8jPo.mjs";
 import { n as logger, r as styles } from "../logger-BEiZZ3qT.mjs";
-import { $t as compareSnapshotWithRemote, A as listCommand$13, An as apiCommand, Bn as pagedLogArgs, C as listCommand$14, Cn as hasChanges, Dn as PluginManager, Dt as listCommand$7, E as waitCommand, En as sdkNameLabelKey, F as generateCommand$1, Fn as configArg, G as removeCommand$1, Gt as deploy, H as extractOwnedNamespaces, Hn as toPageDirection, Ht as formatKeyValueTable, I as generateMigrationScript, In as confirmationArgs, It as getCommand$6, K as updateCommand$3, Kt as ensureConfigId, L as writeDbTypesFile, Ln as deploymentArgs, Mn as assertWritable, N as truncateCommand, Nn as defineAppCommand, O as resumeCommand, On as generateUserTypes, Pn as commonArgs, Pt as startCommand, Q as getCommand$5, Qt as parseMigrationLabelNumber, R as getConfiguredEditorCommand, Rn as isVerbose, Rt as executionsCommand, Sn as formatMigrationDiff, T as healthCommand, Tn as resourceTrn, Tt as triggerCommand, U as logBetaWarning, Un as workspaceArgs, Ut as getCommand$1, V as showCommand, Vn as paginationArgs, Vt as functionExecutionStatusToString, X as listCommand$12, Xt as MIGRATION_LABEL_KEY, Y as treeCommand, Zt as handleOptionalToRequiredError, _n as loadDiff, b as createCommand$4, bn as parseMigrationNumberArg, c as listCommand$15, cn as compareLocalTypesWithSnapshot, ct as createCommand$3, dn as getLatestMigrationNumber, en as generateAllTypeManifestsFromSnapshot, et as updateCommand$2, f as restoreCommand, ft as getCommand$3, g as getCommand$7, gn as isValidMigrationNumber, gt as listCommand$9, ht as tokenCommand$1, i as updateCommand$4, in as INITIAL_SCHEMA_NUMBER, it as getCommand$4, jt as jobsCommand, kn as prompt, m as listCommand$16, mn as getMigrationFiles, nt as listCommand$11, o as removeCommand, ot as deleteCommand$4, pn as getMigrationFilePath, qt as executeScript, r as queryCommand, sn as assertValidMigrationFiles, t as registerTsHook, tn as protoGqlPermission, u as inviteCommand, un as createSnapshotFromLocalTypes, ut as listCommand$10, v as deleteCommand$5, vn as reconstructSnapshotFromMigrations, vt as generate, wn as getNamespacesWithMigrations, wt as webhookCommand, xt as getCommand$2, yn as formatMigrationNumber, yt as listCommand$8, z as openInConfiguredEditor, zn as multiConfigArg } from "../register-ts-hook-ZpBacA07.mjs";
-import { A as hasUserTokenEntry, B as removeLegacyUserAlias, C as getDistDir, D as deleteUserTokens, E as loadConfig, F as loadPlatformClientConfig, G as closeConnectionPool, H as resolveUserTokenKey, I as loadStoredUserTokens, J as fetchAllTolerant, K as defaultPlatformBaseUrl, L as loadWorkspaceId, M as loadConfigPath, N as loadConsoleBaseUrl, O as fetchLatestToken, P as loadMachineUserName, Q as fetchUserInfo, R as platformConfigFromProfile, U as saveUserTokens, V as resolveConfigUser, W as writePlatformConfig, X as fetchPaged, Z as fetchPlatformMachineUserToken, _ as composeFunctionTreeshakeOptions, a as resolveInlineSourcemap, at as isDefaultPlatform, c as ResolverSchema, et as getOAuth2ClientId, g as platformBundleDefinePlugin, it as initOperatorClient, j as loadAccessToken, k as hasAnyUserTokenEntry, nt as getPlatformBaseUrl, q as fetchAll, rt as initOAuth2Client, s as WorkflowJobSchema, t as defineApplication, tt as getOrNull, u as INVOKER_EXPR, v as createLogLevelTreeshakeOptions, w as hashContent$1, y as resolveBundleLogLevel, z as readPlatformConfig } from "../application-eHp9jXld.mjs";
-import { i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-ufH7sS8o.mjs";
+import { $ as fetchUserInfo, A as hasAnyUserTokenEntry, B as readPlatformConfig, D as loadConfig, Et as workspaceArgs, F as loadMachineUserName, G as writePlatformConfig, H as resolveConfigUser, I as loadPlatformClientConfig, J as fetchAll, K as closeConnectionPool, L as loadStoredUserTokens, M as loadAccessToken, N as loadConfigPath, O as deleteUserTokens, P as loadConsoleBaseUrl, Q as fetchPlatformMachineUserToken, R as loadWorkspaceId, T as hashContent$1, Tt as toPageDirection, U as resolveUserTokenKey, V as removeLegacyUserAlias, W as saveUserTokens, Y as fetchAllTolerant, Z as fetchPaged, _ as platformBundleDefinePlugin, a as resolveInlineSourcemap, at as initOperatorClient, b as resolveBundleLogLevel, bt as pagedLogArgs, c as WorkflowJobSchema, d as INVOKER_EXPR, dt as confirmationArgs, ft as deploymentArgs, gt as multiConfigArg, ht as isVerbose, it as initOAuth2Client, j as hasUserTokenEntry, k as fetchLatestToken, l as ResolverSchema, lt as commonArgs, nt as getOrNull, ot as isDefaultPlatform, q as defaultPlatformBaseUrl, rt as getPlatformBaseUrl, t as defineApplication, tt as getOAuth2ClientId, ut as configArg, v as composeFunctionTreeshakeOptions, w as getDistDir, wt as resolveMachineUserInputSource, xt as paginationArgs, y as createLogLevelTreeshakeOptions, z as platformConfigFromProfile } from "../application-Bf8wxOi6.mjs";
+import { $t as compareSnapshotWithRemote, A as listCommand$13, An as apiCommand, C as listCommand$14, Cn as hasChanges, Dn as PluginManager, Dt as listCommand$7, E as waitCommand, En as sdkNameLabelKey, F as generateCommand$1, G as removeCommand$1, Gt as deploy, H as extractOwnedNamespaces, Ht as formatKeyValueTable, I as generateMigrationScript, It as getCommand$6, K as updateCommand$3, Kt as ensureConfigId, L as writeDbTypesFile, Mn as assertWritable, N as truncateCommand, Nn as defineAppCommand, O as resumeCommand, On as generateUserTypes, Pt as startCommand, Q as getCommand$5, Qt as parseMigrationLabelNumber, R as getConfiguredEditorCommand, Rt as executionsCommand, Sn as formatMigrationDiff, T as healthCommand, Tn as resourceTrn, Tt as triggerCommand, U as logBetaWarning, Ut as getCommand$1, V as showCommand, Vt as functionExecutionStatusToString, X as listCommand$12, Xt as MIGRATION_LABEL_KEY, Y as treeCommand, Zt as handleOptionalToRequiredError, _n as loadDiff, b as createCommand$4, bn as parseMigrationNumberArg, c as listCommand$15, cn as compareLocalTypesWithSnapshot, ct as createCommand$3, dn as getLatestMigrationNumber, en as generateAllTypeManifestsFromSnapshot, et as updateCommand$2, f as restoreCommand, ft as getCommand$3, g as getCommand$7, gn as isValidMigrationNumber, gt as listCommand$9, ht as tokenCommand$1, i as updateCommand$4, in as INITIAL_SCHEMA_NUMBER, it as getCommand$4, jt as jobsCommand, kn as prompt, m as listCommand$16, mn as getMigrationFiles, nt as listCommand$11, o as removeCommand, ot as deleteCommand$4, pn as getMigrationFilePath, qt as executeScript, r as queryCommand, sn as assertValidMigrationFiles, t as registerTsHook, tn as protoGqlPermission, u as inviteCommand, un as createSnapshotFromLocalTypes, ut as listCommand$10, v as deleteCommand$5, vn as reconstructSnapshotFromMigrations, vt as generate, wn as getNamespacesWithMigrations, wt as webhookCommand, xt as getCommand$2, yn as formatMigrationNumber, yt as listCommand$8, z as openInConfiguredEditor } from "../register-ts-hook-BhzVkej0.mjs";
+import { i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-CzZEVrp9.mjs";
 import { t as multiline } from "../multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "../package-json-8b0O9TlX.mjs";
 import { i as userAgent } from "../secret-file-aoNXJmKa.mjs";
 import { n as isCLIError } from "../errors-118wUDRr.mjs";
+import { B as FunctionExecution_Type, Ct as PATScope, T as CustomDomainStatus, gt as AuthInvokerSchema } from "../service_pb-Bk7dL-yT.mjs";
 import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-Cg-pqRJV.mjs";
 import { t as isPluginGeneratedType } from "../type-source-DH_LH20p.mjs";
 import * as path from "pathe";
@@ -489,6 +489,35 @@ const crashReportCommand = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/parser/service/resolver/local-input-parser.ts
+/**
+* Build a local, in-process validator for a resolver's declared input fields.
+* Each field already carries its own bound `_parseInternal` (attached when the
+* user's resolver module was loaded via dynamic import), so this only needs to
+* orchestrate calling every field and collecting issues.
+* @param fields - Resolver's raw input field definitions (already-built TailorField instances)
+* @returns An object exposing a `.parse()` method for local format detection
+*/
+function buildLocalInputParser(fields) {
+	return { parse(args) {
+		const { value, data, invoker } = args;
+		if (typeof value !== "object" || value === null || Array.isArray(value) || value instanceof Date) return { issues: [{ message: `Expected an object: received ${String(value)}` }] };
+		const record = value;
+		const issues = [];
+		for (const [name, field] of Object.entries(fields)) {
+			const result = field._parseInternal({
+				value: record[name],
+				data,
+				invoker,
+				pathArray: [name]
+			});
+			if (result.issues) issues.push(...result.issues);
+		}
+		return issues.length > 0 ? { issues } : {};
+	} };
+}
+
 //#endregion
 //#region src/cli/commands/deploy/index.ts
 const deployCommand$1 = defineAppCommand({
@@ -1272,10 +1301,7 @@ async function detectFunctionType(options) {
 	if (resolverResult.success) {
 		const rawInput = module.default.input;
 		let inputSchema;
-		if (rawInput) {
-			const { t } = await import("../types-C-lQ4se3.mjs");
-			inputSchema = t.object(rawInput);
-		}
+		if (rawInput) inputSchema = buildLocalInputParser(rawInput);
 		return {
 			type: "resolver",
 			name: resolverResult.data.name,
@@ -1425,6 +1451,7 @@ When a \`.js\` file is provided, detection and bundling are skipped and the file
 		const authNamespace = resolveAuthNamespace(config.auth);
 		const machineUserName = await resolveMachineUserName({
 			cliMachineUser: args["machine-user"],
+			cliMachineUserSource: resolveMachineUserInputSource(args["machine-user"]),
 			profile: args.profile,
 			authConfig: config.auth
 		});
@@ -1545,9 +1572,10 @@ function resolveAuthNamespace(authConfig) {
 * @returns Resolved machine user name
 */
 async function resolveMachineUserName(options) {
-	const { cliMachineUser, profile, authConfig } = options;
+	const { cliMachineUser, cliMachineUserSource, profile, authConfig } = options;
 	const resolved = await loadMachineUserName({
 		machineUser: cliMachineUser,
+		machineUserSource: cliMachineUserSource,
 		profile
 	});
 	if (resolved) return resolved;
@@ -1690,8 +1718,47 @@ const redirectUri = `http://localhost:${redirectPort}/callback`;
 function randomState() {
 	return crypto.randomBytes(32).toString("base64url");
 }
-function assertProfileLoginUser(args, authenticatedUser, authenticatedSubject) {
-	if (args.profile && args.profileUser && authenticatedUser !== args.profileUser && authenticatedSubject !== args.profileUser) throw new Error(`Profile "${args.profile}" is configured for "${args.profileUser}", but login authenticated "${authenticatedUser}".`);
+function getProfileUserMismatch(args, authenticatedUser, authenticatedSubject) {
+	if (!args.profile || !args.profileUser || authenticatedUser === args.profileUser || authenticatedSubject === args.profileUser) return;
+	return {
+		profile: args.profile,
+		oldUser: args.profileUser,
+		authenticatedUser,
+		loginMode: args.loginMode ?? "user"
+	};
+}
+function quoteCommandArg(value, platform = process.platform) {
+	if (platform === "win32") {
+		if (/^[A-Za-z0-9_./:@+=,-]+$/.test(value)) return value;
+		return;
+	}
+	return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function profileUpdateCommand(mismatch) {
+	const profileArg = quoteCommandArg(mismatch.profile);
+	const userArg = quoteCommandArg(mismatch.authenticatedUser);
+	if (profileArg && userArg) return `tailor-sdk profile update --user ${userArg} -- ${profileArg}`;
+	return [
+		"tailor-sdk profile update --user <authenticated-user> -- <profile>",
+		`profile = ${JSON.stringify(mismatch.profile)}`,
+		`authenticated user = ${JSON.stringify(mismatch.authenticatedUser)}`
+	].join("\n");
+}
+function retryInstruction(mismatch) {
+	if (mismatch.loginMode === "machine-user") return "Then retry the original machine-user login command.";
+	const profileArg = quoteCommandArg(mismatch.profile);
+	if (!profileArg) return "Then retry the browser login with the same profile value.";
+	return `Then run:\n  tailor-sdk login --profile ${profileArg}`;
+}
+function profileUserMismatchError(mismatch) {
+	const updateCommand = profileUpdateCommand(mismatch);
+	const nextStep = retryInstruction(mismatch);
+	return new Error(multiline`
+    Profile "${mismatch.profile}" is configured for "${mismatch.oldUser}", but login authenticated "${mismatch.authenticatedUser}".
+    The authenticated user has been saved. To use it with this profile, run:
+      ${updateCommand}
+    ${nextStep}
+  `);
 }
 function shouldUpdateCurrentUser(profile, platformConfig) {
 	if (!profile) return true;
@@ -1711,7 +1778,6 @@ const startAuthServer = async (args = {}) => {
 					codeVerifier
 				});
 				const userInfo = await fetchUserInfo(tokens.accessToken, args.platformConfig);
-				assertProfileLoginUser(args, userInfo.email, userInfo.sub);
 				const pfConfig = await readPlatformConfig();
 				await saveUserTokens(pfConfig, userInfo.sub, {
 					accessToken: tokens.accessToken,
@@ -1720,6 +1786,11 @@ const startAuthServer = async (args = {}) => {
 					platformConfig: args.platformConfig,
 					email: userInfo.email
 				});
+				const mismatch = getProfileUserMismatch(args, userInfo.email, userInfo.sub);
+				if (mismatch) {
+					writePlatformConfig(pfConfig);
+					throw profileUserMismatchError(mismatch);
+				}
 				if (args.updateCurrentUser ?? true) pfConfig.current_user = userInfo.sub;
 				await removeLegacyUserAlias(pfConfig, userInfo.email, userInfo.sub, args.platformConfig);
 				writePlatformConfig(pfConfig);
@@ -1763,11 +1834,15 @@ const startAuthServer = async (args = {}) => {
 	});
 };
 async function loginAsMachineUser(args) {
-	assertProfileLoginUser(args, args.clientId);
 	const clientSecret = args.clientSecret ?? await prompt.password({ message: "Client secret" });
 	const tokens = await fetchPlatformMachineUserToken(args.clientId, clientSecret, args.platformConfig);
 	const pfConfig = await readPlatformConfig();
 	await saveUserTokens(pfConfig, args.clientId, { accessToken: tokens.accessToken }, new Date(assertDefined(tokens.expiresAt, "token response missing expiresAt")).toISOString(), { platformConfig: args.platformConfig });
+	const mismatch = getProfileUserMismatch(args, args.clientId);
+	if (mismatch) {
+		writePlatformConfig(pfConfig);
+		throw profileUserMismatchError(mismatch);
+	}
 	if (args.updateCurrentUser ?? true) pfConfig.current_user = args.clientId;
 	writePlatformConfig(pfConfig);
 }
@@ -1799,31 +1874,36 @@ const loginCommand = defineAppCommand({
 		})
 	}).describe("Machine User Login")]),
 	run: async (args) => {
-		let platformConfig;
-		let profileUser;
-		if ("profile" in args && args.profile) {
-			const profileEntry = (await readPlatformConfig()).profiles[args.profile];
-			if (!profileEntry) throw new Error(`Profile "${args.profile}" not found`);
-			platformConfig = platformConfigFromProfile(profileEntry);
-			profileUser = profileEntry.user;
+		try {
+			let platformConfig;
+			let profileUser;
+			if ("profile" in args && args.profile) {
+				const profileEntry = (await readPlatformConfig()).profiles[args.profile];
+				if (!profileEntry) throw new Error(`Profile "${args.profile}" not found`);
+				platformConfig = platformConfigFromProfile(profileEntry);
+				profileUser = profileEntry.user;
+			}
+			const updateCurrentUser = shouldUpdateCurrentUser(args.profile, platformConfig);
+			if ("machine-user" in args) await loginAsMachineUser({
+				clientId: args.clientId,
+				clientSecret: args.clientSecret,
+				profile: args.profile,
+				profileUser,
+				platformConfig,
+				updateCurrentUser,
+				loginMode: "machine-user"
+			});
+			else await startAuthServer({
+				profile: args.profile,
+				profileUser,
+				platformConfig,
+				updateCurrentUser,
+				loginMode: "user"
+			});
+			logger.success("Successfully logged in to Tailor Platform.");
+		} finally {
+			await closeConnectionPool();
 		}
-		const updateCurrentUser = shouldUpdateCurrentUser(args.profile, platformConfig);
-		if ("machine-user" in args) await loginAsMachineUser({
-			clientId: args.clientId,
-			clientSecret: args.clientSecret,
-			profile: args.profile,
-			profileUser,
-			platformConfig,
-			updateCurrentUser
-		});
-		else await startAuthServer({
-			profile: args.profile,
-			profileUser,
-			platformConfig,
-			updateCurrentUser
-		});
-		logger.success("Successfully logged in to Tailor Platform.");
-		await closeConnectionPool();
 	}
 });
 
@@ -3169,23 +3249,23 @@ function findTarget(lock, kind, workspaceName) {
 
 //#endregion
 //#region src/cli/commands/setup/action.yml
-var action_default = "# __HEADER__\nname: __WORKSPACE_NAME__\ndescription: >-\n  Deploy __WORKSPACE_NAME__ to Tailor Platform.\n  Checkout and dependency installation are expected to be handled by the caller.\n\ninputs:\n  workspace-id:\n    description: Tailor Platform workspace id\n    required: true\n  name:\n    description: Workspace name (used in Slack notifications)\n    required: true\n  working-directory:\n    description: App directory relative to the repository root\n    required: false\n    default: \".\"\n  platform-client-id:\n    description: Machine-user client id\n    required: true\n  platform-client-secret:\n    description: Machine-user client secret\n    required: true\n  slack-token:\n    description: Slack bot token\n    required: false\n  slack-channel-id:\n    description: Slack channel id\n    required: false\n  user-mapping:\n    description: JSON string mapping GitHub usernames to Slack user IDs\n    required: false\n  package-manager:\n    description: Package manager used for dependency installation (pnpm, npm, yarn, bun)\n    required: false\n    default: pnpm\n\noutputs:\n  app-url:\n    description: Deployed application URL\n    value: ${{ steps.tailor-apply.outputs.app-url }}\n\nruns:\n  using: composite\n  steps:\n    # __STATIC_WEBSITE_BUILD_START__\n    - id: build-site\n      shell: bash\n      run: |\n        # Replace with your static website build command.\n        # Example: pnpm --filter <package-name> run build:static\n        # Note: this run: command is user-editable. Custom build commands are preserved across\n        # reruns and are not treated as drift by setup check. Other edits to this file are flagged\n        # as drift and will be overwritten if you re-run setup action with --force.\n        true\n    # __STATIC_WEBSITE_BUILD_END__\n    - id: tailor-apply\n      uses: tailor-platform/actions/deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n      with:\n        workspace-id: ${{ inputs.workspace-id }}\n        working-directory: ${{ inputs.working-directory }}\n        package-manager: ${{ inputs.package-manager }}\n        platform-client-id: ${{ inputs.platform-client-id }}\n        platform-client-secret: ${{ inputs.platform-client-secret }}\n    - id: tailor-notify\n      if: failure() && inputs.slack-token != '' && inputs.slack-channel-id != ''\n      uses: tailor-platform/actions/notify@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n      with:\n        provider: slack\n        status: failure\n        workspace-name: ${{ inputs.name }}\n        slack-token: ${{ inputs.slack-token }}\n        slack-channel-id: ${{ inputs.slack-channel-id }}\n        user-mapping: ${{ inputs.user-mapping }}\n";
+var action_default = "# __HEADER__\nname: __WORKSPACE_NAME__\ndescription: >-\n  Deploy __WORKSPACE_NAME__ to Tailor Platform.\n  Checkout and dependency installation are expected to be handled by the caller.\n\ninputs:\n  workspace-id:\n    description: Tailor Platform workspace id\n    required: true\n  name:\n    description: Workspace name (used in Slack notifications)\n    required: true\n  working-directory:\n    description: App directory relative to the repository root\n    required: false\n    default: \".\"\n  config:\n    description: SDK config path, or comma-separated config paths for multi-config deploys\n    required: false\n    default: \"tailor.config.ts\"\n  deploy:\n    description: Whether to run the Tailor deploy step after build steps\n    required: false\n    default: \"true\"\n  build-site:\n    description: Whether to run the static website build slot when present\n    required: false\n    default: \"true\"\n  platform-client-id:\n    description: Machine-user client id\n    required: true\n  platform-client-secret:\n    description: Machine-user client secret\n    required: true\n  slack-token:\n    description: Slack bot token\n    required: false\n  slack-channel-id:\n    description: Slack channel id\n    required: false\n  user-mapping:\n    description: JSON string mapping GitHub usernames to Slack user IDs\n    required: false\n  package-manager:\n    description: Package manager used for dependency installation (pnpm, npm, yarn, bun)\n    required: false\n    default: pnpm\n\noutputs:\n  app-url:\n    description: Deployed application URL\n    value: ${{ steps.tailor-apply.outputs.app-url }}\n\nruns:\n  using: composite\n  steps:\n    # __STATIC_WEBSITE_BUILD_START__\n    - id: build-site\n      if: inputs.build-site == 'true'\n      shell: bash\n      run: |\n        # Replace with your static website build command.\n        # Example: pnpm --filter <package-name> run build:static\n        # Note: this run: command is user-editable. Custom build commands are preserved across\n        # reruns and are not treated as drift by setup check. Other edits to this file are flagged\n        # as drift and will be overwritten if you re-run setup action with --force.\n        true\n    # __STATIC_WEBSITE_BUILD_END__\n    - id: tailor-apply\n      if: inputs.deploy == 'true'\n      uses: tailor-platform/actions/deploy@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n      env:\n        TAILOR_PLATFORM_SDK_CONFIG_PATH: ${{ inputs.config }}\n      with:\n        workspace-id: ${{ inputs.workspace-id }}\n        working-directory: ${{ inputs.working-directory }}\n        package-manager: ${{ inputs.package-manager }}\n        platform-client-id: ${{ inputs.platform-client-id }}\n        platform-client-secret: ${{ inputs.platform-client-secret }}\n    - id: tailor-notify\n      if: failure() && inputs.slack-token != '' && inputs.slack-channel-id != ''\n      uses: tailor-platform/actions/notify@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n      with:\n        provider: slack\n        status: failure\n        workspace-name: ${{ inputs.name }}\n        slack-token: ${{ inputs.slack-token }}\n        slack-channel-id: ${{ inputs.slack-channel-id }}\n        user-mapping: ${{ inputs.user-mapping }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/branch.workflow.yml
-var branch_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  # __PULL_REQUEST_END__\n  push:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  workflow_dispatch:\n    # __DISPATCH_INPUTS_START__\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n    # __DISPATCH_INPUTS_END__\n\npermissions:\n  contents: read\n\njobs:\n  # __PLAN_JOB_START__\n  tailor-plan:\n    if: >-\n      github.event_name == 'pull_request' ||\n      (github.event_name == 'workflow_dispatch' && inputs['dry-run'])\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        uses: tailor-platform/actions/seed-validate@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        # Fork PRs cannot read secrets; the checks above still run for them.\n        if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork\n        uses: tailor-platform/actions/plan@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n  # __PLAN_JOB_END__\n  # __ERD_PREVIEW_JOB_START__\n  tailor-erd-preview-matrix:\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      namespaces: ${{ steps.tailor-erd-preview-matrix.outputs.namespaces }}\n      base-app-dir: ${{ steps.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          persist-credentials: false\n      - id: tailor-checkout-base\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-erd-preview-matrix\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          WORKSPACE_NAME: \"__WORKSPACE_NAME__\"\n        run: |\n          set -euo pipefail\n          node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const appDir = process.env.APP_DIR || \".\";\n          const workspaceName = process.env.WORKSPACE_NAME;\n          const output = process.env.GITHUB_OUTPUT;\n          const dirPattern = /^[A-Za-z0-9._/-]+$/;\n          const namespacePattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n          function lockTarget(file) {\n            try {\n              const lock = JSON.parse(fs.readFileSync(file, \"utf8\"));\n              return lock.targets?.find(\n                (candidate) =>\n                  candidate.kind === \"branch\" &&\n                  candidate.workspaceName === workspaceName,\n              );\n            } catch (error) {\n              if (error && error.code === \"ENOENT\") return undefined;\n              throw error;\n            }\n          }\n\n          function namespacesFromTarget(target, label) {\n            const namespaces =\n              target?.inputs?.erdPreview === true && Array.isArray(target.inputs?.erdNamespaces)\n                ? target.inputs.erdNamespaces\n                : [];\n            for (const namespace of namespaces) {\n              if (typeof namespace !== \"string\" || !namespacePattern.test(namespace)) {\n                throw new Error(`Invalid ERD namespace in ${label}: ${String(namespace)}`);\n              }\n            }\n            return namespaces;\n          }\n\n          function normalizeDir(value, label) {\n            const raw = typeof value === \"string\" && value.length > 0 ? value : appDir;\n            const normalized =\n              raw.replaceAll(\"\\\\\", \"/\").replace(/\\/{2,}/g, \"/\").replace(/^\\.\\//, \"\").replace(/\\/$/, \"\") ||\n              \".\";\n            if (\n              !dirPattern.test(normalized) ||\n              normalized.startsWith(\"/\") ||\n              normalized.split(\"/\").includes(\"..\")\n            ) {\n              throw new Error(`Invalid ERD app dir in ${label}: ${raw}`);\n            }\n            return normalized;\n          }\n\n          const headTarget = lockTarget(\".github/tailor.lock\");\n          const baseTarget = lockTarget(\".tailor-erd-base/.github/tailor.lock\");\n          const baseAppDir = normalizeDir(baseTarget?.inputs?.dir, \"base setup lock\");\n          const namespaces = [\n            ...new Set([\n              ...namespacesFromTarget(headTarget, \"head setup lock\"),\n              ...namespacesFromTarget(baseTarget, \"base setup lock\"),\n            ]),\n          ].sort((a, b) => a.localeCompare(b));\n\n          if (namespaces.length === 0) {\n            console.error(\"No ERD preview namespaces found in the head or base setup lock.\");\n            process.exit(1);\n          }\n\n          fs.appendFileSync(output, `namespaces=${JSON.stringify(namespaces)}\\n`);\n          fs.appendFileSync(output, `base-app-dir=${baseAppDir}\\n`);\n          NODE\n\n  tailor-erd-preview:\n    needs: tailor-erd-preview-matrix\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    strategy:\n      fail-fast: false\n      matrix:\n        namespace: ${{ fromJSON(needs.tailor-erd-preview-matrix.outputs.namespaces) }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          persist-credentials: false\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-checkout-base\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-detect-base-package-manager\n        shell: bash\n        run: |\n          set -euo pipefail\n          cd .tailor-erd-base\n          base_package_manager=\"$(\n            if [ -f pnpm-lock.yaml ]; then\n              echo pnpm\n            elif [ -f yarn.lock ]; then\n              echo yarn\n            elif [ -f bun.lockb ] || [ -f bun.lock ]; then\n              echo bun\n            elif [ -f package-lock.json ]; then\n              echo npm\n            else\n              echo \"__PACKAGE_MANAGER__\"\n            fi\n          )\"\n          echo \"package-manager=$base_package_manager\" >> \"$GITHUB_OUTPUT\"\n          if [ \"$base_package_manager\" = \"pnpm\" ]; then\n            base_pnpm_version=\"$(node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const fallback = \"10\";\n\n          function readManifest(file) {\n            try {\n              return JSON.parse(fs.readFileSync(file, \"utf8\"));\n            } catch {\n              return {};\n            }\n          }\n\n          function pnpmVersion(manifest) {\n            const packageManager = manifest.packageManager;\n            if (typeof packageManager === \"string\" && packageManager.startsWith(\"pnpm@\")) {\n              return packageManager.slice(\"pnpm@\".length).split(\"+\")[0];\n            }\n\n            const devPackageManager = manifest.devEngines?.packageManager;\n            if (devPackageManager?.name === \"pnpm\" && devPackageManager.version) {\n              return devPackageManager.version;\n            }\n\n            return undefined;\n          }\n\n          process.stdout.write(\n            pnpmVersion(readManifest(\"package.json\")) ?? fallback,\n          );\n          NODE\n          )\"\n            echo \"pnpm-version=$base_pnpm_version\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-setup-base-pnpm\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'pnpm'\n        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9\n        with:\n          version: ${{ steps.tailor-detect-base-package-manager.outputs['pnpm-version'] }}\n          package_json_file: .tailor-erd-base/package.json\n          run_install: false\n      - id: tailor-setup-base-node\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] != 'bun'\n        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n        with:\n          node-version-file: .tailor-erd-base/package.json\n      - id: tailor-setup-base-yarn\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'yarn'\n        shell: bash\n        working-directory: .tailor-erd-base\n        run: |\n          set -euo pipefail\n          corepack enable\n      - id: tailor-setup-base-bun\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'bun'\n        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0\n      - id: tailor-install-base\n        shell: bash\n        working-directory: .tailor-erd-base\n        env:\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n        run: |\n          set -euo pipefail\n          case \"$BASE_PACKAGE_MANAGER\" in\n            pnpm) pnpm install --frozen-lockfile ;;\n            npm) npm ci ;;\n            yarn)\n              if grep -q '^__metadata:' yarn.lock; then\n                yarn install --immutable\n              else\n                yarn install --frozen-lockfile\n              fi\n              ;;\n            bun) bun install --frozen-lockfile ;;\n            *)\n              echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n              exit 1\n              ;;\n          esac\n      - id: tailor-restore-head-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-build-erd-preview\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          BASE_APP_DIR: ${{ needs.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n          NAMESPACE: ${{ matrix.namespace }}\n        run: |\n          set -euo pipefail\n\n          run_tailor_cli() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec tailor \"$@\" ;;\n              npm) npx tailor \"$@\" ;;\n              yarn) yarn tailor \"$@\" ;;\n              bun) bunx tailor \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          run_head_node() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec node \"$@\" ;;\n              npm) node \"$@\" ;;\n              yarn) yarn node \"$@\" ;;\n              bun) node \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          tailor_cli_bin=\"$(\n            run_head_node - <<'NODE'\n          const path = require(\"node:path\");\n          const { createRequire } = require(\"node:module\");\n          const appDir = process.env.APP_DIR || \".\";\n          const githubWorkspace = process.env.GITHUB_WORKSPACE;\n          if (!githubWorkspace) {\n            throw new Error(\"GITHUB_WORKSPACE is required.\");\n          }\n\n          let lastError;\n          for (const manifestPath of [\n            path.join(githubWorkspace, appDir, \"package.json\"),\n            path.join(githubWorkspace, \"package.json\"),\n          ]) {\n            try {\n              const requireFromManifest = createRequire(manifestPath);\n              process.stdout.write(\n                path.join(\n                  path.dirname(requireFromManifest.resolve(\"@tailor-platform/sdk/cli\")),\n                  \"index.mjs\",\n                ),\n              );\n              process.exit(0);\n            } catch (error) {\n              lastError = error;\n            }\n          }\n          throw lastError || new Error(\"Failed to resolve @tailor-platform/sdk/cli.\");\n          NODE\n          )\"\n\n          run_head_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$GITHUB_WORKSPACE\" || exit 1\n              case \"__PACKAGE_MANAGER__\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          run_base_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$command_cwd\" || exit 1\n              case \"$BASE_PACKAGE_MANAGER\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          head_output=\"$RUNNER_TEMP/tailor-erd/head\"\n          base_output=\"$RUNNER_TEMP/tailor-erd/base\"\n          preview_output=\"$RUNNER_TEMP/tailor-erd/preview\"\n          dts_output=\"$RUNNER_TEMP/tailor-erd/dts\"\n          head_cli_runner=\"$RUNNER_TEMP/tailor-erd/run-head-cli.mjs\"\n          head_log=\"$RUNNER_TEMP/tailor-erd/head-$NAMESPACE.log\"\n          base_log=\"$RUNNER_TEMP/tailor-erd/base-$NAMESPACE.log\"\n          rm -rf \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          mkdir -p \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          cat > \"$head_cli_runner\" <<'NODE'\n          import { pathToFileURL } from \"node:url\";\n\n          const cliBin = process.env.TAILOR_CLI_BIN;\n          const commandCwd = process.env.TAILOR_CLI_CWD;\n          if (!cliBin || !commandCwd) {\n            throw new Error(\"TAILOR_CLI_BIN and TAILOR_CLI_CWD are required.\");\n          }\n\n          process.chdir(commandCwd);\n          process.argv = [process.argv[0], cliBin, ...process.argv.slice(2)];\n          await import(pathToFileURL(cliBin).href);\n          NODE\n\n          head_config=\"$GITHUB_WORKSPACE/$APP_DIR/tailor.config.ts\"\n          base_config=\"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR/tailor.config.ts\"\n          head_html=\"$head_output/$NAMESPACE/dist/index.html\"\n          base_html=\"$base_output/$NAMESPACE/dist/index.html\"\n          preview_html=\"$preview_output/$NAMESPACE-viewer.html\"\n\n          head_missing=\"false\"\n          if [ ! -f \"$head_config\" ]; then\n            echo \"Head ERD config not found; rendering base objects as removed.\"\n            head_missing=\"true\"\n          elif ! (\n            cd \"$GITHUB_WORKSPACE/$APP_DIR\" || exit 1\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/head-$NAMESPACE.d.ts\" \\\n              run_tailor_cli tailordb erd export --config \"$head_config\" --namespace \"$NAMESPACE\" --output \"$head_output\"\n          ) >\"$head_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$head_log\"; then\n              cat \"$head_log\"\n              echo \"Head ERD namespace '$NAMESPACE' not found; rendering base objects as removed.\"\n              head_missing=\"true\"\n            else\n              cat \"$head_log\"\n              exit 1\n            fi\n          elif [ -s \"$head_log\" ]; then\n            cat \"$head_log\"\n          fi\n\n          base_missing=\"false\"\n          if [ ! -f \"$base_config\" ]; then\n            echo \"Base ERD config not found; rendering current objects as added.\"\n            base_missing=\"true\"\n          elif ! (\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/base-$NAMESPACE.d.ts\" \\\n              run_base_tailor_cli_bin \"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR\" tailordb erd export --config \"$base_config\" --namespace \"$NAMESPACE\" --output \"$base_output\"\n          ) >\"$base_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$base_log\"; then\n              cat \"$base_log\"\n              echo \"Base ERD namespace '$NAMESPACE' not found; rendering current objects as added.\"\n              base_missing=\"true\"\n            else\n              cat \"$base_log\"\n              exit 1\n            fi\n          elif [ -s \"$base_log\" ]; then\n            cat \"$base_log\"\n          fi\n\n          if [ \"$head_missing\" = \"true\" ] && [ \"$base_missing\" = \"true\" ]; then\n            echo \"::error::ERD namespace '$NAMESPACE' was not found in head or base.\"\n            exit 1\n          fi\n          if [ \"$head_missing\" = \"false\" ] && [ ! -f \"$head_html\" ]; then\n            echo \"::error::Head ERD viewer was not generated at $head_html\"\n            exit 1\n          fi\n          if [ \"$base_missing\" = \"false\" ] && [ ! -f \"$base_html\" ]; then\n            echo \"::error::Base ERD viewer was not generated at $base_html\"\n            exit 1\n          fi\n\n          diff_args=(--namespace \"$NAMESPACE\" --output \"$preview_html\")\n          if [ \"$head_missing\" = \"false\" ]; then\n            diff_args+=(--head-html \"$head_html\")\n          fi\n          if [ \"$base_missing\" = \"false\" ]; then\n            diff_args+=(--base-html \"$base_html\")\n          fi\n          run_head_tailor_cli_bin \"$GITHUB_WORKSPACE\" tailordb erd diff \"${diff_args[@]}\"\n      - id: tailor-upload-erd-viewer\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: ${{ matrix.namespace }}-viewer.html\n          path: ${{ runner.temp }}/tailor-erd/preview/${{ matrix.namespace }}-viewer.html\n          if-no-files-found: error\n          archive: false\n          retention-days: 7\n\n  # __ERD_PREVIEW_JOB_END__\n  # __ERD_PREVIEW_COMMENT_JOB_START__\n  tailor-erd-preview-comment:\n    needs: tailor-erd-preview\n    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      actions: read\n      pull-requests: write\n    steps:\n      - id: tailor-comment-erd-preview\n        env:\n          GH_TOKEN: ${{ github.token }}\n          REPO: ${{ github.repository }}\n          RUN_ID: ${{ github.run_id }}\n          SERVER: ${{ github.server_url }}\n          PR_NUMBER: ${{ github.event.pull_request.number }}\n          BASE_REF: ${{ github.event.pull_request.base.ref }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n          MARKER: \"<!-- tailor-erd-preview: __WORKSPACE_NAME__ -->\"\n        run: |\n          set -euo pipefail\n\n          current_head=$(gh api \"repos/$REPO/pulls/$PR_NUMBER\" --jq '.head.sha')\n          if [ \"$current_head\" != \"$HEAD_SHA\" ]; then\n            echo \"Skipping stale ERD preview comment for $HEAD_SHA; current head is $current_head.\"\n            exit 0\n          fi\n\n          body=\"$MARKER\"$'\\n'\"### TailorDB ERD preview (__WORKSPACE_NAME__)\"$'\\n\\n'\n          body+=\"Self-contained ERD viewer HTML artifacts for this pull request. Each viewer can switch between the current schema and a diff against base branch \\`$BASE_REF\\`.\"$'\\n'\n\n          while IFS=$'\\t' read -r name id; do\n            [ -z \"$name\" ] && continue\n            if [[ \"$name\" != *-viewer.html ]]; then\n              continue\n            fi\n            ns=${name%-viewer.html}\n            label=\"$ns viewer\"\n            body+=$'\\n'\"- **$label**: [$name]($SERVER/$REPO/actions/runs/$RUN_ID/artifacts/$id)\"\n          done < <(gh api \"repos/$REPO/actions/runs/$RUN_ID/artifacts\" --paginate \\\n            --jq '.artifacts[] | select(.name | endswith(\"-viewer.html\")) | [.name, (.id|tostring)] | @tsv' | sort)\n\n          existing=$(gh api \"repos/$REPO/issues/$PR_NUMBER/comments\" --paginate \\\n            --jq 'map(select(.body | contains(env.MARKER))) | .[0].id // empty')\n          if [ -n \"$existing\" ]; then\n            gh api --method PATCH \"repos/$REPO/issues/comments/$existing\" -f body=\"$body\" >/dev/null\n          else\n            gh api --method POST \"repos/$REPO/issues/$PR_NUMBER/comments\" -f body=\"$body\" >/dev/null\n          fi\n\n  # __ERD_PREVIEW_COMMENT_JOB_END__\n  tailor-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    environment: __ENVIRONMENT__\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
+var branch_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  # __PULL_REQUEST_END__\n  push:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  workflow_dispatch:\n    # __DISPATCH_INPUTS_START__\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n    # __DISPATCH_INPUTS_END__\n\npermissions:\n  contents: read\n\njobs:\n  # __PLAN_JOB_START__\n  tailor-plan:\n    if: >-\n      github.event_name == 'pull_request' ||\n      (github.event_name == 'workflow_dispatch' && inputs['dry-run'])\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        uses: tailor-platform/actions/seed-validate@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        # Fork PRs cannot read secrets; the checks above still run for them.\n        if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork\n        uses: tailor-platform/actions/plan@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n  # __PLAN_JOB_END__\n  # __ERD_PREVIEW_JOB_START__\n  tailor-erd-preview-matrix:\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      namespaces: ${{ steps.tailor-erd-preview-matrix.outputs.namespaces }}\n      base-app-dir: ${{ steps.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          persist-credentials: false\n      - id: tailor-checkout-base\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-erd-preview-matrix\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          WORKSPACE_NAME: \"__WORKSPACE_NAME__\"\n        run: |\n          set -euo pipefail\n          node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const appDir = process.env.APP_DIR || \".\";\n          const workspaceName = process.env.WORKSPACE_NAME;\n          const output = process.env.GITHUB_OUTPUT;\n          const dirPattern = /^[A-Za-z0-9._/-]+$/;\n          const namespacePattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n          function lockTarget(file) {\n            try {\n              const lock = JSON.parse(fs.readFileSync(file, \"utf8\"));\n              return lock.targets?.find(\n                (candidate) =>\n                  candidate.kind === \"branch\" &&\n                  candidate.workspaceName === workspaceName,\n              );\n            } catch (error) {\n              if (error && error.code === \"ENOENT\") return undefined;\n              throw error;\n            }\n          }\n\n          function namespacesFromTarget(target, label) {\n            const namespaces =\n              target?.inputs?.erdPreview === true && Array.isArray(target.inputs?.erdNamespaces)\n                ? target.inputs.erdNamespaces\n                : [];\n            for (const namespace of namespaces) {\n              if (typeof namespace !== \"string\" || !namespacePattern.test(namespace)) {\n                throw new Error(`Invalid ERD namespace in ${label}: ${String(namespace)}`);\n              }\n            }\n            return namespaces;\n          }\n\n          function normalizeDir(value, label) {\n            const raw = typeof value === \"string\" && value.length > 0 ? value : appDir;\n            const normalized =\n              raw.replaceAll(\"\\\\\", \"/\").replace(/\\/{2,}/g, \"/\").replace(/^\\.\\//, \"\").replace(/\\/$/, \"\") ||\n              \".\";\n            if (\n              !dirPattern.test(normalized) ||\n              normalized.startsWith(\"/\") ||\n              normalized.split(\"/\").includes(\"..\")\n            ) {\n              throw new Error(`Invalid ERD app dir in ${label}: ${raw}`);\n            }\n            return normalized;\n          }\n\n          const headTarget = lockTarget(\".github/tailor.lock\");\n          const baseTarget = lockTarget(\".tailor-erd-base/.github/tailor.lock\");\n          const baseAppDir = normalizeDir(baseTarget?.inputs?.dir, \"base setup lock\");\n          const namespaces = [\n            ...new Set([\n              ...namespacesFromTarget(headTarget, \"head setup lock\"),\n              ...namespacesFromTarget(baseTarget, \"base setup lock\"),\n            ]),\n          ].sort((a, b) => a.localeCompare(b));\n\n          if (namespaces.length === 0) {\n            console.error(\"No ERD preview namespaces found in the head or base setup lock.\");\n            process.exit(1);\n          }\n\n          fs.appendFileSync(output, `namespaces=${JSON.stringify(namespaces)}\\n`);\n          fs.appendFileSync(output, `base-app-dir=${baseAppDir}\\n`);\n          NODE\n\n  tailor-erd-preview:\n    needs: tailor-erd-preview-matrix\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    strategy:\n      fail-fast: false\n      matrix:\n        namespace: ${{ fromJSON(needs.tailor-erd-preview-matrix.outputs.namespaces) }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          persist-credentials: false\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-checkout-base\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-detect-base-package-manager\n        shell: bash\n        run: |\n          set -euo pipefail\n          cd .tailor-erd-base\n          base_package_manager=\"$(\n            if [ -f pnpm-lock.yaml ]; then\n              echo pnpm\n            elif [ -f yarn.lock ]; then\n              echo yarn\n            elif [ -f bun.lockb ] || [ -f bun.lock ]; then\n              echo bun\n            elif [ -f package-lock.json ]; then\n              echo npm\n            else\n              echo \"__PACKAGE_MANAGER__\"\n            fi\n          )\"\n          echo \"package-manager=$base_package_manager\" >> \"$GITHUB_OUTPUT\"\n          if [ \"$base_package_manager\" = \"pnpm\" ]; then\n            base_pnpm_version=\"$(node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const fallback = \"10\";\n\n          function readManifest(file) {\n            try {\n              return JSON.parse(fs.readFileSync(file, \"utf8\"));\n            } catch {\n              return {};\n            }\n          }\n\n          function pnpmVersion(manifest) {\n            const packageManager = manifest.packageManager;\n            if (typeof packageManager === \"string\" && packageManager.startsWith(\"pnpm@\")) {\n              return packageManager.slice(\"pnpm@\".length).split(\"+\")[0];\n            }\n\n            const devPackageManager = manifest.devEngines?.packageManager;\n            if (devPackageManager?.name === \"pnpm\" && devPackageManager.version) {\n              return devPackageManager.version;\n            }\n\n            return undefined;\n          }\n\n          process.stdout.write(\n            pnpmVersion(readManifest(\"package.json\")) ?? fallback,\n          );\n          NODE\n          )\"\n            echo \"pnpm-version=$base_pnpm_version\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-setup-base-pnpm\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'pnpm'\n        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9\n        with:\n          version: ${{ steps.tailor-detect-base-package-manager.outputs['pnpm-version'] }}\n          package_json_file: .tailor-erd-base/package.json\n          run_install: false\n      - id: tailor-setup-base-node\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] != 'bun'\n        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7\n        with:\n          node-version-file: .tailor-erd-base/package.json\n      - id: tailor-setup-base-yarn\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'yarn'\n        shell: bash\n        working-directory: .tailor-erd-base\n        run: |\n          set -euo pipefail\n          corepack enable\n      - id: tailor-setup-base-bun\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'bun'\n        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0\n      - id: tailor-install-base\n        shell: bash\n        working-directory: .tailor-erd-base\n        env:\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n        run: |\n          set -euo pipefail\n          case \"$BASE_PACKAGE_MANAGER\" in\n            pnpm) pnpm install --frozen-lockfile ;;\n            npm) npm ci ;;\n            yarn)\n              if grep -q '^__metadata:' yarn.lock; then\n                yarn install --immutable\n              else\n                yarn install --frozen-lockfile\n              fi\n              ;;\n            bun) bun install --frozen-lockfile ;;\n            *)\n              echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n              exit 1\n              ;;\n          esac\n      - id: tailor-restore-head-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-build-erd-preview\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          BASE_APP_DIR: ${{ needs.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n          NAMESPACE: ${{ matrix.namespace }}\n        run: |\n          set -euo pipefail\n\n          run_tailor_cli() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec tailor \"$@\" ;;\n              npm) npx tailor \"$@\" ;;\n              yarn) yarn tailor \"$@\" ;;\n              bun) bunx tailor \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          run_head_node() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec node \"$@\" ;;\n              npm) node \"$@\" ;;\n              yarn) yarn node \"$@\" ;;\n              bun) node \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          tailor_cli_bin=\"$(\n            run_head_node - <<'NODE'\n          const path = require(\"node:path\");\n          const { createRequire } = require(\"node:module\");\n          const appDir = process.env.APP_DIR || \".\";\n          const githubWorkspace = process.env.GITHUB_WORKSPACE;\n          if (!githubWorkspace) {\n            throw new Error(\"GITHUB_WORKSPACE is required.\");\n          }\n\n          let lastError;\n          for (const manifestPath of [\n            path.join(githubWorkspace, appDir, \"package.json\"),\n            path.join(githubWorkspace, \"package.json\"),\n          ]) {\n            try {\n              const requireFromManifest = createRequire(manifestPath);\n              process.stdout.write(\n                path.join(\n                  path.dirname(requireFromManifest.resolve(\"@tailor-platform/sdk/cli\")),\n                  \"index.mjs\",\n                ),\n              );\n              process.exit(0);\n            } catch (error) {\n              lastError = error;\n            }\n          }\n          throw lastError || new Error(\"Failed to resolve @tailor-platform/sdk/cli.\");\n          NODE\n          )\"\n\n          run_head_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$GITHUB_WORKSPACE\" || exit 1\n              case \"__PACKAGE_MANAGER__\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          run_base_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$command_cwd\" || exit 1\n              case \"$BASE_PACKAGE_MANAGER\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          head_output=\"$RUNNER_TEMP/tailor-erd/head\"\n          base_output=\"$RUNNER_TEMP/tailor-erd/base\"\n          preview_output=\"$RUNNER_TEMP/tailor-erd/preview\"\n          dts_output=\"$RUNNER_TEMP/tailor-erd/dts\"\n          head_cli_runner=\"$RUNNER_TEMP/tailor-erd/run-head-cli.mjs\"\n          head_log=\"$RUNNER_TEMP/tailor-erd/head-$NAMESPACE.log\"\n          base_log=\"$RUNNER_TEMP/tailor-erd/base-$NAMESPACE.log\"\n          rm -rf \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          mkdir -p \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          cat > \"$head_cli_runner\" <<'NODE'\n          import { pathToFileURL } from \"node:url\";\n\n          const cliBin = process.env.TAILOR_CLI_BIN;\n          const commandCwd = process.env.TAILOR_CLI_CWD;\n          if (!cliBin || !commandCwd) {\n            throw new Error(\"TAILOR_CLI_BIN and TAILOR_CLI_CWD are required.\");\n          }\n\n          process.chdir(commandCwd);\n          process.argv = [process.argv[0], cliBin, ...process.argv.slice(2)];\n          await import(pathToFileURL(cliBin).href);\n          NODE\n\n          head_config=\"$GITHUB_WORKSPACE/$APP_DIR/tailor.config.ts\"\n          base_config=\"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR/tailor.config.ts\"\n          head_html=\"$head_output/$NAMESPACE/dist/index.html\"\n          base_html=\"$base_output/$NAMESPACE/dist/index.html\"\n          preview_html=\"$preview_output/$NAMESPACE-viewer.html\"\n\n          head_missing=\"false\"\n          if [ ! -f \"$head_config\" ]; then\n            echo \"Head ERD config not found; rendering base objects as removed.\"\n            head_missing=\"true\"\n          elif ! (\n            cd \"$GITHUB_WORKSPACE/$APP_DIR\" || exit 1\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/head-$NAMESPACE.d.ts\" \\\n              run_tailor_cli tailordb erd export --config \"$head_config\" --namespace \"$NAMESPACE\" --output \"$head_output\"\n          ) >\"$head_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$head_log\"; then\n              cat \"$head_log\"\n              echo \"Head ERD namespace '$NAMESPACE' not found; rendering base objects as removed.\"\n              head_missing=\"true\"\n            else\n              cat \"$head_log\"\n              exit 1\n            fi\n          elif [ -s \"$head_log\" ]; then\n            cat \"$head_log\"\n          fi\n\n          base_missing=\"false\"\n          if [ ! -f \"$base_config\" ]; then\n            echo \"Base ERD config not found; rendering current objects as added.\"\n            base_missing=\"true\"\n          elif ! (\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/base-$NAMESPACE.d.ts\" \\\n              run_base_tailor_cli_bin \"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR\" tailordb erd export --config \"$base_config\" --namespace \"$NAMESPACE\" --output \"$base_output\"\n          ) >\"$base_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$base_log\"; then\n              cat \"$base_log\"\n              echo \"Base ERD namespace '$NAMESPACE' not found; rendering current objects as added.\"\n              base_missing=\"true\"\n            else\n              cat \"$base_log\"\n              exit 1\n            fi\n          elif [ -s \"$base_log\" ]; then\n            cat \"$base_log\"\n          fi\n\n          if [ \"$head_missing\" = \"true\" ] && [ \"$base_missing\" = \"true\" ]; then\n            echo \"::error::ERD namespace '$NAMESPACE' was not found in head or base.\"\n            exit 1\n          fi\n          if [ \"$head_missing\" = \"false\" ] && [ ! -f \"$head_html\" ]; then\n            echo \"::error::Head ERD viewer was not generated at $head_html\"\n            exit 1\n          fi\n          if [ \"$base_missing\" = \"false\" ] && [ ! -f \"$base_html\" ]; then\n            echo \"::error::Base ERD viewer was not generated at $base_html\"\n            exit 1\n          fi\n\n          diff_args=(--namespace \"$NAMESPACE\" --output \"$preview_html\")\n          if [ \"$head_missing\" = \"false\" ]; then\n            diff_args+=(--head-html \"$head_html\")\n          fi\n          if [ \"$base_missing\" = \"false\" ]; then\n            diff_args+=(--base-html \"$base_html\")\n          fi\n          run_head_tailor_cli_bin \"$GITHUB_WORKSPACE\" tailordb erd diff \"${diff_args[@]}\"\n      - id: tailor-upload-erd-viewer\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: ${{ matrix.namespace }}-viewer.html\n          path: ${{ runner.temp }}/tailor-erd/preview/${{ matrix.namespace }}-viewer.html\n          if-no-files-found: error\n          archive: false\n          retention-days: 7\n\n  # __ERD_PREVIEW_JOB_END__\n  # __ERD_PREVIEW_COMMENT_JOB_START__\n  tailor-erd-preview-comment:\n    needs: tailor-erd-preview\n    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      actions: read\n      pull-requests: write\n    steps:\n      - id: tailor-comment-erd-preview\n        env:\n          GH_TOKEN: ${{ github.token }}\n          REPO: ${{ github.repository }}\n          RUN_ID: ${{ github.run_id }}\n          SERVER: ${{ github.server_url }}\n          PR_NUMBER: ${{ github.event.pull_request.number }}\n          BASE_REF: ${{ github.event.pull_request.base.ref }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n          MARKER: \"<!-- tailor-erd-preview: __WORKSPACE_NAME__ -->\"\n        run: |\n          set -euo pipefail\n\n          current_head=$(gh api \"repos/$REPO/pulls/$PR_NUMBER\" --jq '.head.sha')\n          if [ \"$current_head\" != \"$HEAD_SHA\" ]; then\n            echo \"Skipping stale ERD preview comment for $HEAD_SHA; current head is $current_head.\"\n            exit 0\n          fi\n\n          body=\"$MARKER\"$'\\n'\"### TailorDB ERD preview (__WORKSPACE_NAME__)\"$'\\n\\n'\n          body+=\"Self-contained ERD viewer HTML artifacts for this pull request. Each viewer can switch between the current schema and a diff against base branch \\`$BASE_REF\\`.\"$'\\n'\n\n          while IFS=$'\\t' read -r name id; do\n            [ -z \"$name\" ] && continue\n            if [[ \"$name\" != *-viewer.html ]]; then\n              continue\n            fi\n            ns=${name%-viewer.html}\n            label=\"$ns viewer\"\n            body+=$'\\n'\"- **$label**: [$name]($SERVER/$REPO/actions/runs/$RUN_ID/artifacts/$id)\"\n          done < <(gh api \"repos/$REPO/actions/runs/$RUN_ID/artifacts\" --paginate \\\n            --jq '.artifacts[] | select(.name | endswith(\"-viewer.html\")) | [.name, (.id|tostring)] | @tsv' | sort)\n\n          existing=$(gh api \"repos/$REPO/issues/$PR_NUMBER/comments\" --paginate \\\n            --jq 'map(select(.body | contains(env.MARKER))) | .[0].id // empty')\n          if [ -n \"$existing\" ]; then\n            gh api --method PATCH \"repos/$REPO/issues/comments/$existing\" -f body=\"$body\" >/dev/null\n          else\n            gh api --method POST \"repos/$REPO/issues/$PR_NUMBER/comments\" -f body=\"$body\" >/dev/null\n          fi\n\n  # __ERD_PREVIEW_COMMENT_JOB_END__\n  tailor-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    environment: __ENVIRONMENT__\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/coordinate.workflow.yml
-var coordinate_workflow_default = "# __HEADER__\nname: Tailor Coordinator (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n  # __PULL_REQUEST_END__\n  push:\n    # __PUSH_BRANCHES_START__\n    branches: [\"__BRANCH__\"]\n    # __PUSH_BRANCHES_END__\n    # __PUSH_TAGS_START__\n    tags: [__TAG_PATTERN__]\n    # __PUSH_TAGS_END__\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          target-branch: __BRANCH__\n  # __TAG_GUARD_JOB_END__\n\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_PLAN_STEPS__\n\n  tailor-deploy:\n    # __DEPLOY_NEEDS__\n    # __DEPLOY_IF__\n    # __DEPLOY_ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_DEPLOY_STEPS__\n";
+var coordinate_workflow_default = "# __HEADER__\nname: Tailor Coordinator (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n  # __PULL_REQUEST_END__\n  push:\n    # __PUSH_BRANCHES_START__\n    branches: [\"__BRANCH__\"]\n    # __PUSH_BRANCHES_END__\n    # __PUSH_TAGS_START__\n    tags: [__TAG_PATTERN__]\n    # __PUSH_TAGS_END__\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          target-branch: __BRANCH__\n  # __TAG_GUARD_JOB_END__\n\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_PLAN_STEPS__\n\n  tailor-deploy:\n    # __DEPLOY_NEEDS__\n    # __DEPLOY_IF__\n    # __DEPLOY_ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_DEPLOY_STEPS__\n";
 
 //#endregion
 //#region src/cli/commands/setup/preview.workflow.yml
-var preview_workflow_default = "# __HEADER__\nname: Tailor Preview (__WORKSPACE_NAME__)\n\non:\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PR_TYPES__\n    # To deploy only for PRs that carry the `tailor:preview` label instead of all PRs,\n    # re-run: tailor setup preview --require-preview-label\n    # __PATHS__\n\npermissions:\n  contents: read\n  pull-requests: write\n\njobs:\n  tailor-preview-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-preview-__WORKSPACE_NAME__-${{ github.event.pull_request.number }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      - id: tailor-preview-deploy\n        uses: tailor-platform/actions/preview-deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          region: \"__REGION__\"\n          organization-id: ${{ vars.TAILOR_PLATFORM_ORGANIZATION_ID }}\n          folder-id: ${{ vars.TAILOR_PLATFORM_FOLDER_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n      - id: tailor-preview-comment\n        if: always()\n        uses: tailor-platform/actions/preview-comment@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-id: ${{ steps.tailor-preview-deploy.outputs.workspace-id }}\n          workspace-name: ${{ steps.tailor-preview-deploy.outputs.workspace-name }}\n          status: ${{ job.status == 'success' && 'success' || 'failure' }}\n          app-url: ${{ steps.tailor-preview-deploy.outputs.app-url }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n\n  tailor-preview-cleanup:\n    # __CLEANUP_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-preview-cleanup\n        uses: tailor-platform/actions/preview-cleanup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n";
+var preview_workflow_default = "# __HEADER__\nname: Tailor Preview (__WORKSPACE_NAME__)\n\non:\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PR_TYPES__\n    # To deploy only for PRs that carry the `tailor:preview` label instead of all PRs,\n    # re-run: tailor setup preview --require-preview-label\n    # __PATHS__\n\npermissions:\n  contents: read\n  pull-requests: write\n\njobs:\n  tailor-preview-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-preview-__WORKSPACE_NAME__-${{ github.event.pull_request.number }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      - id: tailor-preview-deploy\n        uses: tailor-platform/actions/preview-deploy@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          region: \"__REGION__\"\n          organization-id: ${{ vars.TAILOR_PLATFORM_ORGANIZATION_ID }}\n          folder-id: ${{ vars.TAILOR_PLATFORM_FOLDER_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n      - id: tailor-preview-comment\n        if: always()\n        uses: tailor-platform/actions/preview-comment@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          workspace-id: ${{ steps.tailor-preview-deploy.outputs.workspace-id }}\n          workspace-name: ${{ steps.tailor-preview-deploy.outputs.workspace-name }}\n          status: ${{ job.status == 'success' && 'success' || 'failure' }}\n          app-url: ${{ steps.tailor-preview-deploy.outputs.app-url }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n\n  tailor-preview-cleanup:\n    # __CLEANUP_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-preview-cleanup\n        uses: tailor-platform/actions/preview-cleanup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/tag.workflow.yml
-var tag_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  push:\n    tags: [\"__TAG_PATTERN__\"]\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          target-branch: \"__BRANCH__\"\n  # __TAG_GUARD_JOB_END__\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        uses: tailor-platform/actions/seed-validate@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        uses: tailor-platform/actions/plan@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n\n  tailor-deploy:\n    needs: tailor-plan\n    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs['dry-run']) }}\n    environment: __ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
+var tag_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  push:\n    tags: [\"__TAG_PATTERN__\"]\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          target-branch: \"__BRANCH__\"\n  # __TAG_GUARD_JOB_END__\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        uses: tailor-platform/actions/seed-validate@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        uses: tailor-platform/actions/plan@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n\n  tailor-deploy:\n    needs: tailor-plan\n    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs['dry-run']) }}\n    environment: __ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/templates.ts
@@ -3355,7 +3435,8 @@ function renderActionWorkflow(params) {
 		generatedIds: ["tailor-apply", "tailor-notify"]
 	};
 }
-const ACTIONS_SHA = "e74173d4bdd931d036ad359cf5f7729fc6aa7067";
+const ACTIONS_SHA = "a3c3032e14277e81039eb26ae1a425adb22eb532";
+const ACTIONS_VERSION = "v1.7.0";
 /**
 * Render the coordinator workflow that orchestrates per-app composite actions.
 *
@@ -3366,7 +3447,7 @@ const ACTIONS_SHA = "e74173d4bdd931d036ad359cf5f7729fc6aa7067";
 * @returns Rendered YAML and the list of managed job/step ids
 */
 function renderCoordinateWorkflow(params) {
-	const { coordinatorName, kind, apps, environment, packageManager } = params;
+	const { coordinatorName, kind, actionGroups, environment, packageManager } = params;
 	const isTag = kind === "tag";
 	const branch = params.branch;
 	const tagPattern = params.tagPattern ?? "v*";
@@ -3397,45 +3478,108 @@ function renderCoordinateWorkflow(params) {
 	}
 	const driftCheckStep = [
 		`- id: tailor-drift-check`,
-		`  uses: tailor-platform/actions/drift-check@${ACTIONS_SHA} # v1.5.1`,
+		`  uses: tailor-platform/actions/drift-check@${ACTIONS_SHA} # ${ACTIONS_VERSION}`,
 		`  with:`,
 		`    package-manager: ${packageManager}`
 	].join("\n");
-	const perAppPlanSteps = apps.flatMap((app) => {
+	const configPath = (app) => app.dir === "." ? "tailor.config.ts" : `${app.dir}/tailor.config.ts`;
+	const groupConfigPath = (group) => group.apps.map(configPath).join(",");
+	const firstApp = (group) => {
+		const [app] = group.apps;
+		if (!app) throw new Error("Coordinate action groups must contain at least one app.");
+		return app;
+	};
+	const singleAppPlanStep = (group, app) => {
 		const wd = app.dir !== "." ? app.dir : void 0;
 		const wdLine = wd ? `\n    working-directory: ${wd}` : "";
 		return [
-			`- id: tailor-generate-check-${app.name}`,
-			`  uses: tailor-platform/actions/generate-check@${ACTIONS_SHA} # v1.5.1`,
-			`  with:`,
-			`    package-manager: ${packageManager}${wdLine}`,
-			`- id: tailor-plan-${app.name}`,
+			`- id: tailor-plan-${group.id}`,
 			`  if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork`,
-			`  uses: tailor-platform/actions/plan@${ACTIONS_SHA} # v1.5.1`,
+			`  uses: tailor-platform/actions/plan@${ACTIONS_SHA} # ${ACTIONS_VERSION}`,
 			`  with:`,
 			`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
 			`    package-manager: ${packageManager}${wdLine}`,
-			`    label: ${coordinatorName}/${app.name}`,
+			`    label: ${coordinatorName}/${group.id}`,
 			`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
 			`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
 			`    github-token: \${{ secrets.GITHUB_TOKEN }}`
 		];
+	};
+	const multiConfigPlanStep = (group) => [
+		`- id: tailor-plan-${group.id}`,
+		`  if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork`,
+		`  uses: tailor-platform/actions/plan@${ACTIONS_SHA} # ${ACTIONS_VERSION}`,
+		`  env:`,
+		`    TAILOR_PLATFORM_SDK_CONFIG_PATH: ${groupConfigPath(group)}`,
+		`  with:`,
+		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+		`    package-manager: ${packageManager}`,
+		`    label: ${coordinatorName}/${group.id}`,
+		`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+		`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+		`    github-token: \${{ secrets.GITHUB_TOKEN }}`
+	];
+	const perAppPlanSteps = actionGroups.flatMap((group) => {
+		const generateCheckSteps = group.apps.flatMap((app) => {
+			const wd = app.dir !== "." ? app.dir : void 0;
+			const wdLine = wd ? `\n    working-directory: ${wd}` : "";
+			return [
+				`- id: tailor-generate-check-${app.name}`,
+				`  uses: tailor-platform/actions/generate-check@${ACTIONS_SHA} # ${ACTIONS_VERSION}`,
+				`  with:`,
+				`    package-manager: ${packageManager}${wdLine}`
+			];
+		});
+		const planStep = group.apps.length === 1 ? singleAppPlanStep(group, firstApp(group)) : multiConfigPlanStep(group);
+		return [...generateCheckSteps, ...planStep];
 	}).join("\n");
 	out = line(out, "PER_APP_PLAN_STEPS", `${driftCheckStep}\n${perAppPlanSteps}`);
-	const deploySteps = apps.flatMap((app) => [
-		`- id: tailor-deploy-${app.name}`,
+	const singleAppDeployStep = (group, app) => [
+		`- id: tailor-deploy-${group.id}`,
+		`  uses: ./.github/actions/tailor-${app.name}`,
+		`  with:`,
+		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+		`    name: ${app.name}`,
+		`    working-directory: ${app.dir}`,
+		`    package-manager: ${packageManager}`,
+		`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+		`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+		`    slack-token: \${{ secrets.TAILOR_SLACK_BOT_TOKEN }}`,
+		`    slack-channel-id: \${{ vars.TAILOR_SLACK_CHANNEL_ID }}`,
+		`    # editable: api-url:`
+	];
+	const buildSiteStep = (app) => [
+		`- id: tailor-build-site-${app.name}`,
 		`  uses: ./.github/actions/tailor-${app.name}`,
 		`  with:`,
 		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
 		`    name: ${app.name}`,
 		`    working-directory: ${app.dir}`,
+		`    deploy: "false"`,
+		`    package-manager: ${packageManager}`,
+		`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
+		`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
+		`    slack-token: \${{ secrets.TAILOR_SLACK_BOT_TOKEN }}`,
+		`    slack-channel-id: \${{ vars.TAILOR_SLACK_CHANNEL_ID }}`
+	];
+	const multiConfigDeployStep = (group) => [
+		...group.apps.filter((app) => app.hasStaticWebsites).flatMap(buildSiteStep),
+		`- id: tailor-deploy-${group.id}`,
+		`  uses: ./.github/actions/tailor-${firstApp(group).name}`,
+		`  with:`,
+		`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
+		`    name: ${coordinatorName}/${group.id}`,
+		`    working-directory: .`,
+		`    config: ${groupConfigPath(group)}`,
+		`    build-site: "false"`,
 		`    package-manager: ${packageManager}`,
 		`    platform-client-id: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}`,
 		`    platform-client-secret: \${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}`,
 		`    slack-token: \${{ secrets.TAILOR_SLACK_BOT_TOKEN }}`,
 		`    slack-channel-id: \${{ vars.TAILOR_SLACK_CHANNEL_ID }}`,
 		`    # editable: api-url:`
-	]).join("\n");
+	];
+	const deploySteps = actionGroups.flatMap((group) => group.apps.length === 1 ? singleAppDeployStep(group, firstApp(group)) : multiConfigDeployStep(group)).join("\n");
 	out = line(out, "PER_APP_DEPLOY_STEPS", deploySteps);
 	out = out.replaceAll("__WORKSPACE_NAME__", () => coordinatorName);
 	out = out.replaceAll("__ENVIRONMENT__", () => environment);
@@ -3444,9 +3588,15 @@ function renderCoordinateWorkflow(params) {
 	const generatedIds = [];
 	if (isTag && branch !== void 0) generatedIds.push("tailor-tag-guard", "tailor-tag-guard/tailor-checkout", "tailor-tag-guard/tailor-tag-guard");
 	generatedIds.push("tailor-plan", "tailor-plan/tailor-checkout", "tailor-plan/tailor-setup", "tailor-plan/tailor-drift-check");
-	for (const app of apps) generatedIds.push(`tailor-plan/tailor-generate-check-${app.name}`, `tailor-plan/tailor-plan-${app.name}`);
+	for (const group of actionGroups) {
+		for (const app of group.apps) generatedIds.push(`tailor-plan/tailor-generate-check-${app.name}`);
+		generatedIds.push(`tailor-plan/tailor-plan-${group.id}`);
+	}
 	generatedIds.push("tailor-deploy", "tailor-deploy/tailor-checkout", "tailor-deploy/tailor-setup");
-	for (const app of apps) generatedIds.push(`tailor-deploy/tailor-deploy-${app.name}`);
+	for (const group of actionGroups) {
+		for (const app of group.apps) if (group.apps.length > 1 && app.hasStaticWebsites) generatedIds.push(`tailor-deploy/tailor-build-site-${app.name}`);
+		generatedIds.push(`tailor-deploy/tailor-deploy-${group.id}`);
+	}
 	return {
 		content: out,
 		generatedIds
@@ -3470,11 +3620,11 @@ function renderTailorSetupAction(params) {
 		`runs:`,
 		`  using: composite`,
 		`  steps:`,
-		`    - uses: tailor-platform/actions/setup@${ACTIONS_SHA} # v1.5.1`,
+		`    - uses: tailor-platform/actions/setup@${ACTIONS_SHA} # ${ACTIONS_VERSION}`,
 		`      with:`,
 		`        package-manager: ${packageManager}`,
 		`    # Add custom steps here (e.g. private registry authentication)`,
-		`    - uses: tailor-platform/actions/install@${ACTIONS_SHA} # v1.5.1`,
+		`    - uses: tailor-platform/actions/install@${ACTIONS_SHA} # ${ACTIONS_VERSION}`,
 		`      with:`,
 		`        package-manager: ${packageManager}`,
 		`        # editable: install-command:`,
@@ -3484,6 +3634,25 @@ function renderTailorSetupAction(params) {
 
 //#endregion
 //#region src/cli/commands/setup/generate.ts
+function actionName(input) {
+	return input.startsWith("tailor-") ? input.slice(7) : input;
+}
+function splitActionGroup(input) {
+	const names = input.split(",").map((entry) => actionName(entry.trim()));
+	if (names.some((name) => name.length === 0)) throw new Error("--action must contain one or more non-empty action names.");
+	return names;
+}
+function uniqueGroupId(names, usedIds) {
+	const base = names.join("-");
+	let id = base;
+	let suffix = 2;
+	while (usedIds.has(id)) {
+		id = `${base}-${suffix}`;
+		suffix += 1;
+	}
+	usedIds.add(id);
+	return id;
+}
 async function defaultLoadConfigName(configPath) {
 	const { config } = await loadConfig(configPath);
 	return config.name;
@@ -3674,7 +3843,7 @@ async function resolve$1(options) {
 		configPath
 	};
 }
-const BUILD_SITE_RUN_RE = /([ \t]*- id: build-site\n[ \t]+shell: bash\n[ \t]+run: \|)([\s\S]*?)(\n[ \t]*- |\n*$)/;
+const BUILD_SITE_RUN_RE = /([ \t]*- id: build-site\n(?:[ \t]+if: [^\n]+\n)?[ \t]+shell: bash\n[ \t]+run: \|)([\s\S]*?)(\n[ \t]*- |\n*$)/;
 /**
 * Strip the mutable run: body of the build-site step before hashing.
 * When hasStaticWebsites is true the step is present; users are expected to
@@ -3816,7 +3985,7 @@ async function setupTarget(options) {
 		kind: resolved.kind,
 		workspaceName: resolved.workspaceName,
 		file: resolved.file,
-		templateVersion: 6,
+		templateVersion: 7,
 		inputs: resolved.inputs,
 		generatedIds: resolved.render.generatedIds,
 		ejectedIds: existing?.ejectedIds ?? [],
@@ -3874,23 +4043,33 @@ async function setupCoordinate(options) {
 	const packageManager = detectPackageManager(outputDir);
 	const lock = readLock(outputDir);
 	if (!lock) throw new Error(".github/tailor.lock not found. Run `tailor setup action --name <name>` for each app before running setup coordinate.");
+	const actionTargets = new Map(lock.targets.filter((t) => t.kind === "action").map((target) => [target.workspaceName, target]));
 	const seenNames = /* @__PURE__ */ new Set();
-	const apps = actions.map((actionName) => {
-		const name = actionName.startsWith("tailor-") ? actionName.slice(7) : actionName;
-		if (seenNames.has(name)) throw new Error(`Duplicate --action "${name}". Each composite action can only appear once in a coordinator.`);
-		seenNames.add(name);
-		const entry = lock.targets.find((t) => t.kind === "action" && t.workspaceName === name);
-		if (!entry) throw new Error(`Action target "${name}" not found in .github/tailor.lock. Run \`tailor setup action --name ${name}\` first.`);
-		validateDir(entry.inputs.dir);
+	const usedGroupIds = /* @__PURE__ */ new Set();
+	const actionGroups = actions.map((actionGroup) => {
+		const names = splitActionGroup(actionGroup);
+		const apps = names.map((name) => {
+			if (seenNames.has(name)) throw new Error(`Duplicate --action "${name}". Each composite action can only appear once in a coordinator.`);
+			seenNames.add(name);
+			const entry = actionTargets.get(name);
+			if (!entry) throw new Error(`Action target "${name}" not found in .github/tailor.lock. Run \`tailor setup action --name ${name}\` first.`);
+			if (names.length > 1 && entry.templateVersion < 7) throw new Error(`Action target "${name}" was generated with an older setup template. Run \`tailor setup action --name ${name} --force\` before grouping it in setup coordinate.`);
+			validateDir(entry.inputs.dir);
+			return {
+				name,
+				dir: entry.inputs.dir,
+				hasStaticWebsites: entry.inputs.hasStaticWebsites
+			};
+		});
 		return {
-			name,
-			dir: entry.inputs.dir
+			id: uniqueGroupId(names, usedGroupIds),
+			apps
 		};
 	});
 	const render = renderCoordinateWorkflow({
 		coordinatorName,
 		kind: coordinateKind,
-		apps,
+		actionGroups,
 		branch: branch ?? void 0,
 		tagPattern: coordinateKind === "tag" ? tagPattern : void 0,
 		environment,
@@ -3926,7 +4105,7 @@ async function setupCoordinate(options) {
 		kind: "coordinate",
 		workspaceName: coordinatorName,
 		file,
-		templateVersion: 6,
+		templateVersion: 7,
 		inputs: {
 			branch,
 			branchAutoDetected: coordinateKind === "branch" ? branchAutoDetected : branch !== null ? false : void 0,
@@ -3934,7 +4113,7 @@ async function setupCoordinate(options) {
 			environment,
 			dir: ".",
 			packageManager,
-			actionDirs: apps.map((a) => a.dir)
+			actionDirs: actionGroups.flatMap((group) => group.apps.map((a) => a.dir))
 		},
 		generatedIds: render.generatedIds,
 		ejectedIds: existing?.ejectedIds ?? [],
@@ -3958,8 +4137,8 @@ async function setupCoordinate(options) {
 	logger.log(`   gh secret set TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID --env ${environment}`);
 	logger.log(`   gh secret set TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET --env ${environment}`);
 	logger.newline();
-	logger.log(`2. Provision each workspace and set TAILOR_PLATFORM_WORKSPACE_ID on the "${environment}" environment:`);
-	logger.log("   tailor workspace create   # one per app; copy the id");
+	logger.log(`2. Provision the target workspace and set TAILOR_PLATFORM_WORKSPACE_ID on the "${environment}" environment:`);
+	logger.log("   tailor workspace create   # if it does not exist yet; copy the id");
 	logger.log(`   gh variable set TAILOR_PLATFORM_WORKSPACE_ID --env ${environment}`);
 	logger.newline();
 	logger.log("3. Commit the generated files:");
@@ -4114,7 +4293,7 @@ async function checkGitHub(options) {
 			currentHash,
 			configExists,
 			defaultBranch,
-			templateVersion: 6,
+			templateVersion: 7,
 			erdNamespaces,
 			hasMigrations,
 			hasSeeds,
@@ -4152,7 +4331,7 @@ function resolveMatch(outputDir, targets, input) {
 }
 function warnCoordinatorReferences(allTargets, deletedKeys, match) {
 	if (match.target.kind !== "action") return;
-	for (const coordinator of allTargets) if (coordinator.kind === "coordinate" && coordinator.inputs.actionDirs?.includes(match.target.inputs.dir) && !deletedKeys.has(targetKey(coordinator))) logger.warn(`Coordinator "${coordinator.workspaceName}" still references this action's directory (${match.target.inputs.dir}). Re-run \`tailor-sdk setup coordinate\` without --action ${match.target.workspaceName} to remove it there too.`);
+	for (const coordinator of allTargets) if (coordinator.kind === "coordinate" && coordinator.inputs.actionDirs?.includes(match.target.inputs.dir) && !deletedKeys.has(targetKey(coordinator))) logger.warn(`Coordinator "${coordinator.workspaceName}" still references this action's directory (${match.target.inputs.dir}). Remove \`${match.target.workspaceName}\` from the relevant \`--action\` value and re-run \`tailor-sdk setup coordinate\` to update it.`);
 }
 /**
 * Delete managed workflow/action files and their `.github/tailor-sdk.lock` entries.
@@ -4220,7 +4399,7 @@ const coordinateCommand = defineAppCommand({
 			alias: "n",
 			description: "Coordinator name (used in the generated workflow file name and job names)"
 		}),
-		action: arg(z.array(z.string().min(1)).min(1), { description: "Composite action to include (can be specified multiple times). tailor- prefix optional." }),
+		action: arg(z.array(z.string().min(1)).min(1), { description: "Composite action to include. Repeat for separate deploy steps, or use commas to deploy actions as one multi-config group. tailor- prefix optional." }),
 		branch: arg(z.string().min(1).optional(), { description: "Branch target: deploy trigger branch (defaults to the detected default branch)" }),
 		tag: arg(z.boolean().default(false), { description: "Generate a tag target coordinator" }),
 		environment: arg(z.string().min(1).optional(), { description: "GitHub Environment for the plan/deploy jobs" }),
@@ -6327,7 +6506,7 @@ async function fetchRemoteTypes(client, workspaceId, namespace) {
 async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	const { config, plugins } = loaded;
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-D2hSK1ZL.mjs");
+	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-CUkjzfij.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -6339,7 +6518,7 @@ async function assertMigrationsReproduceLocalTypes(loaded, target) {
 		await service.processNamespacePlugins();
 	}
 	const pluginExecutorFiles = generatePluginFilesIfNeeded(pluginManager, application.tailorDBServices, config.path);
-	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-CkIwEctX.mjs")).createExecutorService({ config: { files: [] } }) : void 0);
+	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-BT0GPd01.mjs")).createExecutorService({ config: { files: [] } }) : void 0);
 	await executorService?.loadExecutors();
 	if (pluginExecutorFiles.length > 0) await executorService?.loadPluginExecutorFiles([...pluginExecutorFiles]);
 	const executorUsedTypes = /* @__PURE__ */ new Set();
@@ -7024,37 +7203,22 @@ const packageJson = await readPackageJson();
 const cliName = Object.keys(packageJson.bin ?? {})[0] || "tailor";
 const packageName = packageJson.name ?? "@tailor-platform/sdk";
 const bundledSkillsDir = resolve(dirname(await resolvePackageJSON(import.meta.url)), "agent-skills");
-function replaceCommandArgs(command, removals = []) {
-	const args = command.args;
-	if (!args?.shape) return command;
-	const shape = { ...args.shape };
-	for (const name of removals) delete shape[name];
-	return {
-		...command,
-		args: z.strictObject({ ...shape })
-	};
-}
-function removeCommandAliases(command) {
-	const next = { ...command };
-	delete next.aliases;
-	return next;
-}
 function alignSkillCommand(command) {
 	const subCommands = command.subCommands ?? {};
 	const add = {
-		...removeCommandAliases(replaceCommandArgs(subCommands.add, ["verbose"])),
+		...subCommands.add,
 		description: "Install Tailor SDK agent skills."
 	};
 	const list = {
-		...replaceCommandArgs(subCommands.list, ["json"]),
+		...subCommands.list,
 		description: "List Tailor SDK agent skills."
 	};
 	const remove = {
-		...removeCommandAliases(replaceCommandArgs(subCommands.remove)),
+		...subCommands.remove,
 		description: "Remove installed Tailor SDK agent skills."
 	};
 	const sync = {
-		...replaceCommandArgs(subCommands.sync, ["verbose"]),
+		...subCommands.sync,
 		description: "Remove and reinstall Tailor SDK agent skills."
 	};
 	return {
@@ -7112,14 +7276,19 @@ Run \`${cliName} plugin list\` to see which plugins are installed and where they
 	sourceDir: bundledSkillsDir,
 	package: packageName,
 	mode: "copy",
-	descriptionAppend: false
+	descriptionAppend: false,
+	globalArgs: z.object(commonArgs),
+	commandMap: {
+		add: ["add"],
+		remove: ["remove"]
+	},
+	unknownKeys: "strict"
 });
-const commandWithSkillsSubCommands = commandWithSkills.subCommands ?? {};
 const mainCommand = withCompletionCommand({
 	...commandWithSkills,
 	subCommands: {
-		...commandWithSkillsSubCommands,
-		skills: alignSkillCommand(commandWithSkillsSubCommands.skills)
+		...commandWithSkills.subCommands,
+		skills: alignSkillCommand(commandWithSkills.subCommands.skills)
 	}
 });
 runMain(mainCommand, {